Home | History | Annotate | Download | only in sys
      1 /*
      2  * DHD Bus Module for SDIO
      3  *
      4  * Copyright (C) 1999-2010, Broadcom Corporation
      5  *
      6  *      Unless you and Broadcom execute a separate written software license
      7  * agreement governing use of this software, this software is licensed to you
      8  * under the terms of the GNU General Public License version 2 (the "GPL"),
      9  * available at http://www.broadcom.com/licenses/GPLv2.php, with the
     10  * following added to such license:
     11  *
     12  *      As a special exception, the copyright holders of this software give you
     13  * permission to link this software with independent modules, and to copy and
     14  * distribute the resulting executable under terms of your choice, provided that
     15  * you also meet, for each linked independent module, the terms and conditions of
     16  * the license of that module.  An independent module is a module which is not
     17  * derived from this software.  The special exception does not apply to any
     18  * modifications of the software.
     19  *
     20  *      Notwithstanding the above, under no circumstances may you combine this
     21  * software in any way with any other Broadcom software provided under a license
     22  * other than the GPL, without Broadcom's express prior written consent.
     23  *
     24  * $Id: dhd_sdio.c,v 1.157.2.27.2.33.2.129.4.1 2010/09/02 23:13:16 Exp $
     25  */
     26 
     27 #include <typedefs.h>
     28 #include <osl.h>
     29 #include <bcmsdh.h>
     30 
     31 #ifdef BCMEMBEDIMAGE
     32 #include BCMEMBEDIMAGE
     33 #endif /* BCMEMBEDIMAGE */
     34 
     35 #include <bcmdefs.h>
     36 #include <bcmutils.h>
     37 #include <bcmendian.h>
     38 #include <bcmdevs.h>
     39 #include <siutils.h>
     40 #include <hndpmu.h>
     41 #include <hndsoc.h>
     42 #include <sbchipc.h>
     43 #include <sbhnddma.h>
     44 #include <sdio.h>
     45 #include <sbsdio.h>
     46 #include <sbsdpcmdev.h>
     47 #include <bcmsdpcm.h>
     48 
     49 #include <proto/ethernet.h>
     50 #include <proto/802.1d.h>
     51 #include <proto/802.11.h>
     52 
     53 #include <dngl_stats.h>
     54 #include <dhd.h>
     55 #include <dhd_bus.h>
     56 #include <dhd_proto.h>
     57 #include <dhd_dbg.h>
     58 #include <dhdioctl.h>
     59 #include <sdiovar.h>
     60 
     61 #ifdef DHD_DEBUG
     62 #include <hndrte_cons.h>
     63 #endif /* DHD_DEBUG */
     64 #ifdef DHD_DEBUG_TRAP
     65 #include <hndrte_armtrap.h>
     66 #endif /* DHD_DEBUG_TRAP */
     67 
     68 #define QLEN		256	/* bulk rx and tx queue lengths */
     69 #define FCHI		(QLEN - 10)
     70 #define FCLOW		(FCHI / 2)
     71 #define PRIOMASK	7
     72 
     73 #define TXRETRIES	2	/* # of retries for tx frames */
     74 
     75 #if defined(CONFIG_MACH_SANDGATE2G)
     76 #define DHD_RXBOUND	250	/* Default for max rx frames in one scheduling */
     77 #else
     78 #define DHD_RXBOUND	50	/* Default for max rx frames in one scheduling */
     79 #endif /* defined(CONFIG_MACH_SANDGATE2G) */
     80 
     81 #define DHD_TXBOUND	20	/* Default for max tx frames in one scheduling */
     82 
     83 #define DHD_TXMINMAX	1	/* Max tx frames if rx still pending */
     84 
     85 #define MEMBLOCK	2048		/* Block size used for downloading of dongle image */
     86 #define MAX_DATA_BUF	(32 * 1024)	/* Must be large enough to hold biggest possible glom */
     87 
     88 /* Packet alignment for most efficient SDIO (can change based on platform) */
     89 #ifndef DHD_SDALIGN
     90 #define DHD_SDALIGN	32
     91 #endif
     92 #if !ISPOWEROF2(DHD_SDALIGN)
     93 #error DHD_SDALIGN is not a power of 2!
     94 #endif
     95 
     96 #ifndef DHD_FIRSTREAD
     97 #define DHD_FIRSTREAD	32
     98 #endif
     99 #if !ISPOWEROF2(DHD_FIRSTREAD)
    100 #error DHD_FIRSTREAD is not a power of 2!
    101 #endif
    102 
    103 /* Total length of frame header for dongle protocol */
    104 #define SDPCM_HDRLEN	(SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
    105 #ifdef SDTEST
    106 #define SDPCM_RESERVE	(SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN)
    107 #else
    108 #define SDPCM_RESERVE	(SDPCM_HDRLEN + DHD_SDALIGN)
    109 #endif
    110 
    111 /* Space for header read, limit for data packets */
    112 #ifndef MAX_HDR_READ
    113 #define MAX_HDR_READ	32
    114 #endif
    115 #if !ISPOWEROF2(MAX_HDR_READ)
    116 #error MAX_HDR_READ is not a power of 2!
    117 #endif
    118 
    119 #define MAX_RX_DATASZ	2048
    120 
    121 /* Maximum milliseconds to wait for F2 to come up */
    122 #define DHD_WAIT_F2RDY	3000
    123 
    124 /* Bump up limit on waiting for HT to account for first startup;
    125  * if the image is doing a CRC calculation before programming the PMU
    126  * for HT availability, it could take a couple hundred ms more, so
    127  * max out at a 1 second (1000000us).
    128  */
    129 #if (PMU_MAX_TRANSITION_DLY < 1000000)
    130 #undef PMU_MAX_TRANSITION_DLY
    131 #define PMU_MAX_TRANSITION_DLY 1000000
    132 #endif
    133 
    134 /* Value for ChipClockCSR during initial setup */
    135 #define DHD_INIT_CLKCTL1	(SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ)
    136 #define DHD_INIT_CLKCTL2	(SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP)
    137 
    138 /* Flags for SDH calls */
    139 #define F2SYNC	(SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
    140 
    141 /* Packet free applicable unconditionally for sdio and sdspi.  Conditional if
    142  * bufpool was present for gspi bus.
    143  */
    144 #define PKTFREE2()		if ((bus->bus != SPI_BUS) || bus->usebufpool) \
    145 					PKTFREE(bus->dhd->osh, pkt, FALSE);
    146 DHD_SPINWAIT_SLEEP_INIT(sdioh_spinwait_sleep);
    147 extern int dhdcdc_set_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len);
    148 
    149 #ifdef DHD_DEBUG
    150 /* Device console log buffer state */
    151 typedef struct dhd_console {
    152 	uint		count;			/* Poll interval msec counter */
    153 	uint		log_addr;		/* Log struct address (fixed) */
    154 	hndrte_log_t	log;			/* Log struct (host copy) */
    155 	uint		bufsize;		/* Size of log buffer */
    156 	uint8		*buf;			/* Log buffer (host copy) */
    157 	uint		last;			/* Last buffer read index */
    158 } dhd_console_t;
    159 #endif /* DHD_DEBUG */
    160 
    161 /* Private data for SDIO bus interaction */
    162 typedef struct dhd_bus {
    163 	dhd_pub_t	*dhd;
    164 
    165 	bcmsdh_info_t	*sdh;			/* Handle for BCMSDH calls */
    166 	si_t		*sih;			/* Handle for SI calls */
    167 	char		*vars;			/* Variables (from CIS and/or other) */
    168 	uint		varsz;			/* Size of variables buffer */
    169 	uint32		sbaddr;			/* Current SB window pointer (-1, invalid) */
    170 
    171 	sdpcmd_regs_t	*regs;			/* Registers for SDIO core */
    172 	uint		sdpcmrev;		/* SDIO core revision */
    173 	uint		armrev;			/* CPU core revision */
    174 	uint		ramrev;			/* SOCRAM core revision */
    175 	uint32		ramsize;		/* Size of RAM in SOCRAM (bytes) */
    176 	uint32		orig_ramsize;		/* Size of RAM in SOCRAM (bytes) */
    177 
    178 	uint32		bus;			/* gSPI or SDIO bus */
    179 	uint32		hostintmask;		/* Copy of Host Interrupt Mask */
    180 	uint32		intstatus;		/* Intstatus bits (events) pending */
    181 	bool		dpc_sched;		/* Indicates DPC schedule (intrpt rcvd) */
    182 	bool		fcstate;		/* State of dongle flow-control */
    183 
    184 	uint16		cl_devid;		/* cached devid for dhdsdio_probe_attach() */
    185 	char		*fw_path; /* module_param: path to firmware image */
    186 	char		*nv_path; /* module_param: path to nvram vars file */
    187 	const char      *nvram_params;		/* user specified nvram params. */
    188 
    189 	uint		blocksize;		/* Block size of SDIO transfers */
    190 	uint		roundup;		/* Max roundup limit */
    191 
    192 	struct pktq	txq;			/* Queue length used for flow-control */
    193 	uint8		flowcontrol;		/* per prio flow control bitmask */
    194 	uint8		tx_seq;			/* Transmit sequence number (next) */
    195 	uint8		tx_max;			/* Maximum transmit sequence allowed */
    196 
    197 	uint8		hdrbuf[MAX_HDR_READ + DHD_SDALIGN];
    198 	uint8		*rxhdr;			/* Header of current rx frame (in hdrbuf) */
    199 	uint16		nextlen;		/* Next Read Len from last header */
    200 	uint8		rx_seq;			/* Receive sequence number (expected) */
    201 	bool		rxskip;			/* Skip receive (awaiting NAK ACK) */
    202 
    203 	void		*glomd;			/* Packet containing glomming descriptor */
    204 	void		*glom;			/* Packet chain for glommed superframe */
    205 	uint		glomerr;		/* Glom packet read errors */
    206 
    207 	uint8		*rxbuf;			/* Buffer for receiving control packets */
    208 	uint		rxblen;			/* Allocated length of rxbuf */
    209 	uint8		*rxctl;			/* Aligned pointer into rxbuf */
    210 	uint8		*databuf;		/* Buffer for receiving big glom packet */
    211 	uint8		*dataptr;		/* Aligned pointer into databuf */
    212 	uint		rxlen;			/* Length of valid data in buffer */
    213 
    214 	uint8		sdpcm_ver;		/* Bus protocol reported by dongle */
    215 
    216 	bool		intr;			/* Use interrupts */
    217 	bool		poll;			/* Use polling */
    218 	bool		ipend;			/* Device interrupt is pending */
    219 	bool		intdis;			/* Interrupts disabled by isr */
    220 	uint 		intrcount;		/* Count of device interrupt callbacks */
    221 	uint		lastintrs;		/* Count as of last watchdog timer */
    222 	uint		spurious;		/* Count of spurious interrupts */
    223 	uint		pollrate;		/* Ticks between device polls */
    224 	uint		polltick;		/* Tick counter */
    225 	uint		pollcnt;		/* Count of active polls */
    226 
    227 #ifdef DHD_DEBUG
    228 	dhd_console_t	console;		/* Console output polling support */
    229 	uint		console_addr;		/* Console address from shared struct */
    230 #endif /* DHD_DEBUG */
    231 
    232 	uint		regfails;		/* Count of R_REG/W_REG failures */
    233 
    234 	uint		clkstate;		/* State of sd and backplane clock(s) */
    235 	bool		activity;		/* Activity flag for clock down */
    236 	int32		idletime;		/* Control for activity timeout */
    237 	int32		idlecount;		/* Activity timeout counter */
    238 	int32		idleclock;		/* How to set bus driver when idle */
    239 	int32		sd_divisor;		/* Speed control to bus driver */
    240 	int32		sd_mode;		/* Mode control to bus driver */
    241 	int32		sd_rxchain;		/* If bcmsdh api accepts PKT chains */
    242 	bool		use_rxchain;		/* If dhd should use PKT chains */
    243 	bool		sleeping;		/* Is SDIO bus sleeping? */
    244 	bool		rxflow_mode;	/* Rx flow control mode */
    245 	bool		rxflow;			/* Is rx flow control on */
    246 	uint		prev_rxlim_hit;		/* Is prev rx limit exceeded (per dpc schedule) */
    247 	bool		alp_only;		/* Don't use HT clock (ALP only) */
    248 	/* Field to decide if rx of control frames happen in rxbuf or lb-pool */
    249 	bool		usebufpool;
    250 
    251 #ifdef SDTEST
    252 	/* external loopback */
    253 	bool		ext_loop;
    254 	uint8		loopid;
    255 
    256 	/* pktgen configuration */
    257 	uint		pktgen_freq;		/* Ticks between bursts */
    258 	uint		pktgen_count;		/* Packets to send each burst */
    259 	uint		pktgen_print;		/* Bursts between count displays */
    260 	uint		pktgen_total;		/* Stop after this many */
    261 	uint		pktgen_minlen;		/* Minimum packet data len */
    262 	uint		pktgen_maxlen;		/* Maximum packet data len */
    263 	uint		pktgen_mode;		/* Configured mode: tx, rx, or echo */
    264 	uint		pktgen_stop;		/* Number of tx failures causing stop */
    265 
    266 	/* active pktgen fields */
    267 	uint		pktgen_tick;		/* Tick counter for bursts */
    268 	uint		pktgen_ptick;		/* Burst counter for printing */
    269 	uint		pktgen_sent;		/* Number of test packets generated */
    270 	uint		pktgen_rcvd;		/* Number of test packets received */
    271 	uint		pktgen_fail;		/* Number of failed send attempts */
    272 	uint16		pktgen_len;		/* Length of next packet to send */
    273 #endif /* SDTEST */
    274 
    275 	/* Some additional counters */
    276 	uint		tx_sderrs;		/* Count of tx attempts with sd errors */
    277 	uint		fcqueued;		/* Tx packets that got queued */
    278 	uint		rxrtx;			/* Count of rtx requests (NAK to dongle) */
    279 	uint		rx_toolong;		/* Receive frames too long to receive */
    280 	uint		rxc_errors;		/* SDIO errors when reading control frames */
    281 	uint		rx_hdrfail;		/* SDIO errors on header reads */
    282 	uint		rx_badhdr;		/* Bad received headers (roosync?) */
    283 	uint		rx_badseq;		/* Mismatched rx sequence number */
    284 	uint		fc_rcvd;		/* Number of flow-control events received */
    285 	uint		fc_xoff;		/* Number which turned on flow-control */
    286 	uint		fc_xon;			/* Number which turned off flow-control */
    287 	uint		rxglomfail;		/* Failed deglom attempts */
    288 	uint		rxglomframes;		/* Number of glom frames (superframes) */
    289 	uint		rxglompkts;		/* Number of packets from glom frames */
    290 	uint		f2rxhdrs;		/* Number of header reads */
    291 	uint		f2rxdata;		/* Number of frame data reads */
    292 	uint		f2txdata;		/* Number of f2 frame writes */
    293 	uint		f1regdata;		/* Number of f1 register accesses */
    294 
    295 	uint8		*ctrl_frame_buf;
    296 	uint32		ctrl_frame_len;
    297 	bool		ctrl_frame_stat;
    298 } dhd_bus_t;
    299 
    300 /* clkstate */
    301 #define CLK_NONE	0
    302 #define CLK_SDONLY	1
    303 #define CLK_PENDING	2	/* Not used yet */
    304 #define CLK_AVAIL	3
    305 
    306 #define DHD_NOPMU(dhd)	(FALSE)
    307 
    308 #ifdef DHD_DEBUG
    309 static int qcount[NUMPRIO];
    310 static int tx_packets[NUMPRIO];
    311 #endif /* DHD_DEBUG */
    312 
    313 /* Deferred transmit */
    314 const uint dhd_deferred_tx = 1;
    315 
    316 extern uint dhd_watchdog_ms;
    317 extern void dhd_os_wd_timer(void *bus, uint wdtick);
    318 
    319 /* Tx/Rx bounds */
    320 uint dhd_txbound;
    321 uint dhd_rxbound;
    322 uint dhd_txminmax;
    323 
    324 /* override the RAM size if possible */
    325 #define DONGLE_MIN_MEMSIZE (128 *1024)
    326 int dhd_dongle_memsize;
    327 
    328 static bool dhd_doflow;
    329 static bool dhd_alignctl;
    330 
    331 static bool sd1idle;
    332 
    333 static bool retrydata;
    334 #define RETRYCHAN(chan) (((chan) == SDPCM_EVENT_CHANNEL) || retrydata)
    335 
    336 static const uint watermark = 8;
    337 static const uint firstread = DHD_FIRSTREAD;
    338 
    339 #define HDATLEN (firstread - (SDPCM_HDRLEN))
    340 
    341 /* Retry count for register access failures */
    342 static const uint retry_limit = 2;
    343 
    344 /* Force even SD lengths (some host controllers mess up on odd bytes) */
    345 static bool forcealign;
    346 
    347 #define ALIGNMENT  4
    348 
    349 #if defined(OOB_INTR_ONLY) && defined(HW_OOB)
    350 extern void bcmsdh_enable_hw_oob_intr(void *sdh, bool enable);
    351 #endif
    352 
    353 #if defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD)
    354 #error OOB_INTR_ONLY is NOT working with SDIO_ISR_THREAD
    355 #endif /* defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD) */
    356 #define PKTALIGN(osh, p, len, align)					\
    357 	do {								\
    358 		uint datalign;						\
    359 		datalign = (uintptr)PKTDATA((osh), (p));		\
    360 		datalign = ROUNDUP(datalign, (align)) - datalign;	\
    361 		ASSERT(datalign < (align));				\
    362 		ASSERT(PKTLEN((osh), (p)) >= ((len) + datalign));	\
    363 		if (datalign)						\
    364 			PKTPULL((osh), (p), datalign);			\
    365 		PKTSETLEN((osh), (p), (len));				\
    366 	} while (0)
    367 
    368 /* Limit on rounding up frames */
    369 static const uint max_roundup = 512;
    370 
    371 /* Try doing readahead */
    372 static bool dhd_readahead;
    373 
    374 
    375 /* To check if there's window offered */
    376 #define DATAOK(bus) \
    377 	(((uint8)(bus->tx_max - bus->tx_seq) != 0) && \
    378 	(((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
    379 
    380 /* Macros to get register read/write status */
    381 /* NOTE: these assume a local dhdsdio_bus_t *bus! */
    382 #define R_SDREG(regvar, regaddr, retryvar) \
    383 do { \
    384 	retryvar = 0; \
    385 	do { \
    386 		regvar = R_REG(bus->dhd->osh, regaddr); \
    387 	} while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
    388 	if (retryvar) { \
    389 		bus->regfails += (retryvar-1); \
    390 		if (retryvar > retry_limit) { \
    391 			DHD_ERROR(("%s: FAILED" #regvar "READ, LINE %d\n", \
    392 			           __FUNCTION__, __LINE__)); \
    393 			regvar = 0; \
    394 		} \
    395 	} \
    396 } while (0)
    397 
    398 #define W_SDREG(regval, regaddr, retryvar) \
    399 do { \
    400 	retryvar = 0; \
    401 	do { \
    402 		W_REG(bus->dhd->osh, regaddr, regval); \
    403 	} while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
    404 	if (retryvar) { \
    405 		bus->regfails += (retryvar-1); \
    406 		if (retryvar > retry_limit) \
    407 			DHD_ERROR(("%s: FAILED REGISTER WRITE, LINE %d\n", \
    408 			           __FUNCTION__, __LINE__)); \
    409 	} \
    410 } while (0)
    411 
    412 
    413 #define DHD_BUS			SDIO_BUS
    414 
    415 #define PKT_AVAILABLE()		(intstatus & I_HMB_FRAME_IND)
    416 
    417 #define HOSTINTMASK		(I_HMB_SW_MASK | I_CHIPACTIVE)
    418 
    419 #define GSPI_PR55150_BAILOUT
    420 
    421 
    422 #ifdef SDTEST
    423 static void dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq);
    424 static void dhdsdio_sdtest_set(dhd_bus_t *bus, bool start);
    425 #endif
    426 
    427 #ifdef DHD_DEBUG_TRAP
    428 static int dhdsdio_checkdied(dhd_bus_t *bus, uint8 *data, uint size);
    429 static int dhdsdio_mem_dump(dhd_bus_t *bus);
    430 #endif /* DHD_DEBUG_TRAP */
    431 static int dhdsdio_download_state(dhd_bus_t *bus, bool enter);
    432 
    433 static void dhdsdio_release(dhd_bus_t *bus, osl_t *osh);
    434 static void dhdsdio_release_malloc(dhd_bus_t *bus, osl_t *osh);
    435 static void dhdsdio_disconnect(void *ptr);
    436 static bool dhdsdio_chipmatch(uint16 chipid);
    437 static bool dhdsdio_probe_attach(dhd_bus_t *bus, osl_t *osh, void *sdh,
    438                                  void * regsva, uint16  devid);
    439 static bool dhdsdio_probe_malloc(dhd_bus_t *bus, osl_t *osh, void *sdh);
    440 static bool dhdsdio_probe_init(dhd_bus_t *bus, osl_t *osh, void *sdh);
    441 static void dhdsdio_release_dongle(dhd_bus_t *bus, osl_t *osh);
    442 
    443 static uint process_nvram_vars(char *varbuf, uint len);
    444 
    445 static void dhd_dongle_setmemsize(struct dhd_bus *bus, int mem_size);
    446 static int dhd_bcmsdh_recv_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
    447 	uint8 *buf, uint nbytes,
    448 	void *pkt, bcmsdh_cmplt_fn_t complete, void *handle);
    449 static int dhd_bcmsdh_send_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
    450 	uint8 *buf, uint nbytes,
    451 	void *pkt, bcmsdh_cmplt_fn_t complete, void *handle);
    452 
    453 static bool dhdsdio_download_firmware(struct dhd_bus *bus, osl_t *osh, void *sdh);
    454 static int _dhdsdio_download_firmware(struct dhd_bus *bus);
    455 
    456 static int dhdsdio_download_code_file(struct dhd_bus *bus, char *image_path);
    457 static int dhdsdio_download_nvram(struct dhd_bus *bus);
    458 #ifdef BCMEMBEDIMAGE
    459 static int dhdsdio_download_code_array(struct dhd_bus *bus);
    460 #endif
    461 
    462 
    463 static void
    464 dhd_dongle_setmemsize(struct dhd_bus *bus, int mem_size)
    465 {
    466 	int32 min_size =  DONGLE_MIN_MEMSIZE;
    467 	/* Restrict the memsize to user specified limit */
    468 	DHD_ERROR(("user: Restrict the dongle ram size to %d, min accepted %d\n",
    469 		dhd_dongle_memsize, min_size));
    470 	if ((dhd_dongle_memsize > min_size) &&
    471 		(dhd_dongle_memsize < (int32)bus->orig_ramsize))
    472 		bus->ramsize = dhd_dongle_memsize;
    473 }
    474 
    475 static int
    476 dhdsdio_set_siaddr_window(dhd_bus_t *bus, uint32 address)
    477 {
    478 	int err = 0;
    479 	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
    480 	                 (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
    481 	if (!err)
    482 		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRMID,
    483 		                 (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
    484 	if (!err)
    485 		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRHIGH,
    486 		                 (address >> 24) & SBSDIO_SBADDRHIGH_MASK, &err);
    487 	return err;
    488 }
    489 
    490 
    491 /* Turn backplane clock on or off */
    492 static int
    493 dhdsdio_htclk(dhd_bus_t *bus, bool on, bool pendok)
    494 {
    495 	int err;
    496 	uint8 clkctl, clkreq, devctl;
    497 	bcmsdh_info_t *sdh;
    498 
    499 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
    500 
    501 #if defined(OOB_INTR_ONLY)
    502 	pendok = FALSE;
    503 #endif
    504 	clkctl = 0;
    505 	sdh = bus->sdh;
    506 
    507 
    508 	if (on) {
    509 		/* Request HT Avail */
    510 		clkreq = bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
    511 
    512 		if ((bus->sih->chip == BCM4329_CHIP_ID) && (bus->sih->chiprev == 0))
    513 			clkreq |= SBSDIO_FORCE_ALP;
    514 
    515 
    516 
    517 
    518 		bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
    519 		if (err) {
    520 			DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
    521 			return BCME_ERROR;
    522 		}
    523 
    524 		if (pendok &&
    525 		    ((bus->sih->buscoretype == PCMCIA_CORE_ID) && (bus->sih->buscorerev == 9))) {
    526 			uint32 dummy, retries;
    527 			R_SDREG(dummy, &bus->regs->clockctlstatus, retries);
    528 		}
    529 
    530 		/* Check current status */
    531 		clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
    532 		if (err) {
    533 			DHD_ERROR(("%s: HT Avail read error: %d\n", __FUNCTION__, err));
    534 			return BCME_ERROR;
    535 		}
    536 
    537 		/* Go to pending and await interrupt if appropriate */
    538 		if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
    539 			/* Allow only clock-available interrupt */
    540 			devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
    541 			if (err) {
    542 				DHD_ERROR(("%s: Devctl access error setting CA: %d\n",
    543 				           __FUNCTION__, err));
    544 				return BCME_ERROR;
    545 			}
    546 
    547 			devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
    548 			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
    549 			DHD_INFO(("CLKCTL: set PENDING\n"));
    550 			bus->clkstate = CLK_PENDING;
    551 			return BCME_OK;
    552 		} else if (bus->clkstate == CLK_PENDING) {
    553 			/* Cancel CA-only interrupt filter */
    554 			devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
    555 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
    556 			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
    557 		}
    558 
    559 		/* Otherwise, wait here (polling) for HT Avail */
    560 		if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
    561 			SPINWAIT_SLEEP(sdioh_spinwait_sleep,
    562 				((clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
    563 			                                    SBSDIO_FUNC1_CHIPCLKCSR, &err)),
    564 			          !SBSDIO_CLKAV(clkctl, bus->alp_only)), PMU_MAX_TRANSITION_DLY);
    565 		}
    566 		if (err) {
    567 			DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
    568 			return BCME_ERROR;
    569 		}
    570 		if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
    571 			DHD_ERROR(("%s: HT Avail timeout (%d): clkctl 0x%02x\n",
    572 			           __FUNCTION__, PMU_MAX_TRANSITION_DLY, clkctl));
    573 			return BCME_ERROR;
    574 		}
    575 
    576 
    577 		/* Mark clock available */
    578 		bus->clkstate = CLK_AVAIL;
    579 		DHD_INFO(("CLKCTL: turned ON\n"));
    580 
    581 #if defined(DHD_DEBUG)
    582 		if (bus->alp_only == TRUE) {
    583 #if !defined(BCMLXSDMMC)
    584 			if (!SBSDIO_ALPONLY(clkctl)) {
    585 				DHD_ERROR(("%s: HT Clock, when ALP Only\n", __FUNCTION__));
    586 			}
    587 #endif /* !defined(BCMLXSDMMC) */
    588 		} else {
    589 			if (SBSDIO_ALPONLY(clkctl)) {
    590 				DHD_ERROR(("%s: HT Clock should be on.\n", __FUNCTION__));
    591 			}
    592 		}
    593 #endif /* defined (DHD_DEBUG) */
    594 
    595 		bus->activity = TRUE;
    596 	} else {
    597 		clkreq = 0;
    598 
    599 		if (bus->clkstate == CLK_PENDING) {
    600 			/* Cancel CA-only interrupt filter */
    601 			devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
    602 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
    603 			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
    604 		}
    605 
    606 		bus->clkstate = CLK_SDONLY;
    607 		bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
    608 		DHD_INFO(("CLKCTL: turned OFF\n"));
    609 		if (err) {
    610 			DHD_ERROR(("%s: Failed access turning clock off: %d\n",
    611 			           __FUNCTION__, err));
    612 			return BCME_ERROR;
    613 		}
    614 	}
    615 	return BCME_OK;
    616 }
    617 
    618 /* Change idle/active SD state */
    619 static int
    620 dhdsdio_sdclk(dhd_bus_t *bus, bool on)
    621 {
    622 	int err;
    623 	int32 iovalue;
    624 
    625 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
    626 
    627 	if (on) {
    628 		if (bus->idleclock == DHD_IDLE_STOP) {
    629 			/* Turn on clock and restore mode */
    630 			iovalue = 1;
    631 			err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
    632 			                      &iovalue, sizeof(iovalue), TRUE);
    633 			if (err) {
    634 				DHD_ERROR(("%s: error enabling sd_clock: %d\n",
    635 				           __FUNCTION__, err));
    636 				return BCME_ERROR;
    637 			}
    638 
    639 			iovalue = bus->sd_mode;
    640 			err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
    641 			                      &iovalue, sizeof(iovalue), TRUE);
    642 			if (err) {
    643 				DHD_ERROR(("%s: error changing sd_mode: %d\n",
    644 				           __FUNCTION__, err));
    645 				return BCME_ERROR;
    646 			}
    647 		} else if (bus->idleclock != DHD_IDLE_ACTIVE) {
    648 			/* Restore clock speed */
    649 			iovalue = bus->sd_divisor;
    650 			err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
    651 			                      &iovalue, sizeof(iovalue), TRUE);
    652 			if (err) {
    653 				DHD_ERROR(("%s: error restoring sd_divisor: %d\n",
    654 				           __FUNCTION__, err));
    655 				return BCME_ERROR;
    656 			}
    657 		}
    658 		bus->clkstate = CLK_SDONLY;
    659 	} else {
    660 		/* Stop or slow the SD clock itself */
    661 		if ((bus->sd_divisor == -1) || (bus->sd_mode == -1)) {
    662 			DHD_TRACE(("%s: can't idle clock, divisor %d mode %d\n",
    663 			           __FUNCTION__, bus->sd_divisor, bus->sd_mode));
    664 			return BCME_ERROR;
    665 		}
    666 		if (bus->idleclock == DHD_IDLE_STOP) {
    667 			if (sd1idle) {
    668 				/* Change to SD1 mode and turn off clock */
    669 				iovalue = 1;
    670 				err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
    671 				                      &iovalue, sizeof(iovalue), TRUE);
    672 				if (err) {
    673 					DHD_ERROR(("%s: error changing sd_clock: %d\n",
    674 					           __FUNCTION__, err));
    675 					return BCME_ERROR;
    676 				}
    677 			}
    678 
    679 			iovalue = 0;
    680 			err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
    681 			                      &iovalue, sizeof(iovalue), TRUE);
    682 			if (err) {
    683 				DHD_ERROR(("%s: error disabling sd_clock: %d\n",
    684 				           __FUNCTION__, err));
    685 				return BCME_ERROR;
    686 			}
    687 		} else if (bus->idleclock != DHD_IDLE_ACTIVE) {
    688 			/* Set divisor to idle value */
    689 			iovalue = bus->idleclock;
    690 			err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
    691 			                      &iovalue, sizeof(iovalue), TRUE);
    692 			if (err) {
    693 				DHD_ERROR(("%s: error changing sd_divisor: %d\n",
    694 				           __FUNCTION__, err));
    695 				return BCME_ERROR;
    696 			}
    697 		}
    698 		bus->clkstate = CLK_NONE;
    699 	}
    700 
    701 	return BCME_OK;
    702 }
    703 
    704 /* Transition SD and backplane clock readiness */
    705 static int
    706 dhdsdio_clkctl(dhd_bus_t *bus, uint target, bool pendok)
    707 {
    708 #ifdef DHD_DEBUG
    709 	uint oldstate = bus->clkstate;
    710 #endif /* DHD_DEBUG */
    711 
    712 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
    713 
    714 	/* Early exit if we're already there */
    715 	if (bus->clkstate == target) {
    716 		if (target == CLK_AVAIL) {
    717 			dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
    718 			bus->activity = TRUE;
    719 		}
    720 		return BCME_OK;
    721 	}
    722 
    723 	switch (target) {
    724 	case CLK_AVAIL:
    725 		/* Make sure SD clock is available */
    726 		if (bus->clkstate == CLK_NONE)
    727 			dhdsdio_sdclk(bus, TRUE);
    728 		/* Now request HT Avail on the backplane */
    729 		dhdsdio_htclk(bus, TRUE, pendok);
    730 		dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
    731 		bus->activity = TRUE;
    732 		break;
    733 
    734 	case CLK_SDONLY:
    735 		/* Remove HT request, or bring up SD clock */
    736 		if (bus->clkstate == CLK_NONE)
    737 			dhdsdio_sdclk(bus, TRUE);
    738 		else if (bus->clkstate == CLK_AVAIL)
    739 			dhdsdio_htclk(bus, FALSE, FALSE);
    740 		else
    741 			DHD_ERROR(("dhdsdio_clkctl: request for %d -> %d\n",
    742 			           bus->clkstate, target));
    743 		dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
    744 		break;
    745 
    746 	case CLK_NONE:
    747 		/* Make sure to remove HT request */
    748 		if (bus->clkstate == CLK_AVAIL)
    749 			dhdsdio_htclk(bus, FALSE, FALSE);
    750 		/* Now remove the SD clock */
    751 		dhdsdio_sdclk(bus, FALSE);
    752 		dhd_os_wd_timer(bus->dhd, 0);
    753 		break;
    754 	}
    755 #ifdef DHD_DEBUG
    756 	DHD_INFO(("dhdsdio_clkctl: %d -> %d\n", oldstate, bus->clkstate));
    757 #endif /* DHD_DEBUG */
    758 
    759 	return BCME_OK;
    760 }
    761 
    762 int
    763 dhdsdio_bussleep(dhd_bus_t *bus, bool sleep)
    764 {
    765 	bcmsdh_info_t *sdh = bus->sdh;
    766 	sdpcmd_regs_t *regs = bus->regs;
    767 	uint retries = 0;
    768 
    769 	DHD_INFO(("dhdsdio_bussleep: request %s (currently %s)\n",
    770 	          (sleep ? "SLEEP" : "WAKE"),
    771 	          (bus->sleeping ? "SLEEP" : "WAKE")));
    772 
    773 	/* Done if we're already in the requested state */
    774 	if (sleep == bus->sleeping)
    775 		return BCME_OK;
    776 
    777 	/* Going to sleep: set the alarm and turn off the lights... */
    778 	if (sleep) {
    779 		/* Don't sleep if something is pending */
    780 		if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
    781 			return BCME_BUSY;
    782 
    783 
    784 		/* Disable SDIO interrupts (no longer interested) */
    785 		bcmsdh_intr_disable(bus->sdh);
    786 
    787 		/* Make sure the controller has the bus up */
    788 		dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
    789 
    790 		/* Tell device to start using OOB wakeup */
    791 		W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
    792 		if (retries > retry_limit)
    793 			DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
    794 
    795 		/* Turn off our contribution to the HT clock request */
    796 		dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
    797 
    798 		bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
    799 		                 SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
    800 
    801 		/* Isolate the bus */
    802 		if (bus->sih->chip != BCM4329_CHIP_ID && bus->sih->chip != BCM4319_CHIP_ID) {
    803 				bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL,
    804 					SBSDIO_DEVCTL_PADS_ISO, NULL);
    805 		}
    806 
    807 		/* Change state */
    808 		bus->sleeping = TRUE;
    809 
    810 	} else {
    811 		/* Waking up: bus power up is ok, set local state */
    812 
    813 		bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
    814 		                 0, NULL);
    815 
    816 		/* Force pad isolation off if possible (in case power never toggled) */
    817 		if ((bus->sih->buscoretype == PCMCIA_CORE_ID) && (bus->sih->buscorerev >= 10))
    818 			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, 0, NULL);
    819 
    820 
    821 		/* Make sure the controller has the bus up */
    822 		dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
    823 
    824 		/* Send misc interrupt to indicate OOB not needed */
    825 		W_SDREG(0, &regs->tosbmailboxdata, retries);
    826 		if (retries <= retry_limit)
    827 			W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
    828 
    829 		if (retries > retry_limit)
    830 			DHD_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
    831 
    832 		/* Make sure we have SD bus access */
    833 		dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
    834 
    835 		/* Change state */
    836 		bus->sleeping = FALSE;
    837 
    838 		/* Enable interrupts again */
    839 		if (bus->intr && (bus->dhd->busstate == DHD_BUS_DATA)) {
    840 			bus->intdis = FALSE;
    841 			bcmsdh_intr_enable(bus->sdh);
    842 		}
    843 	}
    844 
    845 	return BCME_OK;
    846 }
    847 #if defined(OOB_INTR_ONLY)
    848 void
    849 dhd_enable_oob_intr(struct dhd_bus *bus, bool enable)
    850 {
    851 #if defined(HW_OOB)
    852 	bcmsdh_enable_hw_oob_intr(bus->sdh, enable);
    853 #else
    854 	sdpcmd_regs_t *regs = bus->regs;
    855 	uint retries = 0;
    856 
    857 	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
    858 	if (enable == TRUE) {
    859 
    860 		/* Tell device to start using OOB wakeup */
    861 		W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
    862 		if (retries > retry_limit)
    863 			DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
    864 
    865 	} else {
    866 		/* Send misc interrupt to indicate OOB not needed */
    867 		W_SDREG(0, &regs->tosbmailboxdata, retries);
    868 		if (retries <= retry_limit)
    869 			W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
    870 	}
    871 
    872 	/* Turn off our contribution to the HT clock request */
    873 	dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
    874 #endif /* !defined(HW_OOB) */
    875 }
    876 #endif /* defined(OOB_INTR_ONLY) */
    877 
    878 #define BUS_WAKE(bus) \
    879 	do { \
    880 		if ((bus)->sleeping) \
    881 			dhdsdio_bussleep((bus), FALSE); \
    882 	} while (0);
    883 
    884 
    885 /* Writes a HW/SW header into the packet and sends it. */
    886 /* Assumes: (a) header space already there, (b) caller holds lock */
    887 static int
    888 dhdsdio_txpkt(dhd_bus_t *bus, void *pkt, uint chan, bool free_pkt)
    889 {
    890 	int ret;
    891 	osl_t *osh;
    892 	uint8 *frame;
    893 	uint16 len, pad = 0;
    894 	uint32 swheader;
    895 	uint retries = 0;
    896 	bcmsdh_info_t *sdh;
    897 	void *new;
    898 	int i;
    899 
    900 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
    901 
    902 	sdh = bus->sdh;
    903 	osh = bus->dhd->osh;
    904 
    905 	if (bus->dhd->dongle_reset) {
    906 		ret = BCME_NOTREADY;
    907 		goto done;
    908 	}
    909 
    910 	frame = (uint8*)PKTDATA(osh, pkt);
    911 
    912 	/* Add alignment padding, allocate new packet if needed */
    913 	if ((pad = ((uintptr)frame % DHD_SDALIGN))) {
    914 		if (PKTHEADROOM(osh, pkt) < pad) {
    915 			DHD_INFO(("%s: insufficient headroom %d for %d pad\n",
    916 			          __FUNCTION__, (int)PKTHEADROOM(osh, pkt), pad));
    917 			bus->dhd->tx_realloc++;
    918 			new = PKTGET(osh, (PKTLEN(osh, pkt) + DHD_SDALIGN), TRUE);
    919 			if (!new) {
    920 				DHD_ERROR(("%s: couldn't allocate new %d-byte packet\n",
    921 				           __FUNCTION__, PKTLEN(osh, pkt) + DHD_SDALIGN));
    922 				ret = BCME_NOMEM;
    923 				goto done;
    924 			}
    925 
    926 			PKTALIGN(osh, new, PKTLEN(osh, pkt), DHD_SDALIGN);
    927 			bcopy(PKTDATA(osh, pkt), PKTDATA(osh, new), PKTLEN(osh, pkt));
    928 			if (free_pkt)
    929 				PKTFREE(osh, pkt, TRUE);
    930 			/* free the pkt if canned one is not used */
    931 			free_pkt = TRUE;
    932 			pkt = new;
    933 			frame = (uint8*)PKTDATA(osh, pkt);
    934 			ASSERT(((uintptr)frame % DHD_SDALIGN) == 0);
    935 			pad = 0;
    936 		} else {
    937 			PKTPUSH(osh, pkt, pad);
    938 			frame = (uint8*)PKTDATA(osh, pkt);
    939 
    940 			ASSERT((pad + SDPCM_HDRLEN) <= (int) PKTLEN(osh, pkt));
    941 			bzero(frame, pad + SDPCM_HDRLEN);
    942 		}
    943 	}
    944 	ASSERT(pad < DHD_SDALIGN);
    945 
    946 	/* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
    947 	len = (uint16)PKTLEN(osh, pkt);
    948 	*(uint16*)frame = htol16(len);
    949 	*(((uint16*)frame) + 1) = htol16(~len);
    950 
    951 	/* Software tag: channel, sequence number, data offset */
    952 	swheader = ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
    953 	        (((pad + SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
    954 	htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN);
    955 	htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
    956 
    957 #ifdef DHD_DEBUG
    958 	tx_packets[PKTPRIO(pkt)]++;
    959 	if (DHD_BYTES_ON() &&
    960 	    (((DHD_CTL_ON() && (chan == SDPCM_CONTROL_CHANNEL)) ||
    961 	      (DHD_DATA_ON() && (chan != SDPCM_CONTROL_CHANNEL))))) {
    962 		prhex("Tx Frame", frame, len);
    963 	} else if (DHD_HDRS_ON()) {
    964 		prhex("TxHdr", frame, MIN(len, 16));
    965 	}
    966 #endif
    967 
    968 	/* Raise len to next SDIO block to eliminate tail command */
    969 	if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
    970 		uint16 pad = bus->blocksize - (len % bus->blocksize);
    971 		if ((pad <= bus->roundup) && (pad < bus->blocksize))
    972 #ifdef NOTUSED
    973 			if (pad <= PKTTAILROOM(osh, pkt))
    974 #endif /* NOTUSED */
    975 				len += pad;
    976 	} else if (len % DHD_SDALIGN) {
    977 		len += DHD_SDALIGN - (len % DHD_SDALIGN);
    978 	}
    979 
    980 	/* Some controllers have trouble with odd bytes -- round to even */
    981 	if (forcealign && (len & (ALIGNMENT - 1))) {
    982 #ifdef NOTUSED
    983 		if (PKTTAILROOM(osh, pkt))
    984 #endif
    985 			len = ROUNDUP(len, ALIGNMENT);
    986 #ifdef NOTUSED
    987 		else
    988 			DHD_ERROR(("%s: sending unrounded %d-byte packet\n", __FUNCTION__, len));
    989 #endif
    990 	}
    991 
    992 	do {
    993 		ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
    994 		                      frame, len, pkt, NULL, NULL);
    995 		bus->f2txdata++;
    996 		ASSERT(ret != BCME_PENDING);
    997 
    998 		if (ret < 0) {
    999 			/* On failure, abort the command and terminate the frame */
   1000 			DHD_INFO(("%s: sdio error %d, abort command and terminate frame.\n",
   1001 			          __FUNCTION__, ret));
   1002 			bus->tx_sderrs++;
   1003 
   1004 			bcmsdh_abort(sdh, SDIO_FUNC_2);
   1005 			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
   1006 			                 SFC_WF_TERM, NULL);
   1007 			bus->f1regdata++;
   1008 
   1009 			for (i = 0; i < 3; i++) {
   1010 				uint8 hi, lo;
   1011 				hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
   1012 				                     SBSDIO_FUNC1_WFRAMEBCHI, NULL);
   1013 				lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
   1014 				                     SBSDIO_FUNC1_WFRAMEBCLO, NULL);
   1015 				bus->f1regdata += 2;
   1016 				if ((hi == 0) && (lo == 0))
   1017 					break;
   1018 			}
   1019 
   1020 		}
   1021 		if (ret == 0) {
   1022 			bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
   1023 		}
   1024 	} while ((ret < 0) && retrydata && retries++ < TXRETRIES);
   1025 
   1026 done:
   1027 	/* restore pkt buffer pointer before calling tx complete routine */
   1028 	PKTPULL(osh, pkt, SDPCM_HDRLEN + pad);
   1029 	dhd_os_sdunlock(bus->dhd);
   1030 	dhd_txcomplete(bus->dhd, pkt, ret != 0);
   1031 	dhd_os_sdlock(bus->dhd);
   1032 
   1033 	if (free_pkt)
   1034 		PKTFREE(osh, pkt, TRUE);
   1035 
   1036 	return ret;
   1037 }
   1038 
   1039 int
   1040 dhd_bus_txdata(struct dhd_bus *bus, void *pkt)
   1041 {
   1042 	int ret = BCME_ERROR;
   1043 	osl_t *osh;
   1044 	uint datalen, prec;
   1045 
   1046 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   1047 
   1048 	osh = bus->dhd->osh;
   1049 	datalen = PKTLEN(osh, pkt);
   1050 
   1051 #ifdef SDTEST
   1052 	/* Push the test header if doing loopback */
   1053 	if (bus->ext_loop) {
   1054 		uint8* data;
   1055 		PKTPUSH(osh, pkt, SDPCM_TEST_HDRLEN);
   1056 		data = PKTDATA(osh, pkt);
   1057 		*data++ = SDPCM_TEST_ECHOREQ;
   1058 		*data++ = (uint8)bus->loopid++;
   1059 		*data++ = (datalen >> 0);
   1060 		*data++ = (datalen >> 8);
   1061 		datalen += SDPCM_TEST_HDRLEN;
   1062 	}
   1063 #endif /* SDTEST */
   1064 
   1065 	/* Add space for the header */
   1066 	PKTPUSH(osh, pkt, SDPCM_HDRLEN);
   1067 	ASSERT(ISALIGNED((uintptr)PKTDATA(osh, pkt), 2));
   1068 
   1069 	prec = PRIO2PREC((PKTPRIO(pkt) & PRIOMASK));
   1070 
   1071 
   1072 	/* Check for existing queue, current flow-control, pending event, or pending clock */
   1073 	if (dhd_deferred_tx || bus->fcstate || pktq_len(&bus->txq) || bus->dpc_sched ||
   1074 	    (!DATAOK(bus)) || (bus->flowcontrol & NBITVAL(prec)) ||
   1075 	    (bus->clkstate != CLK_AVAIL)) {
   1076 		DHD_TRACE(("%s: deferring pktq len %d\n", __FUNCTION__,
   1077 			pktq_len(&bus->txq)));
   1078 		bus->fcqueued++;
   1079 
   1080 		/* Priority based enq */
   1081 		dhd_os_sdlock_txq(bus->dhd);
   1082 		if (dhd_prec_enq(bus->dhd, &bus->txq, pkt, prec) == FALSE) {
   1083 			PKTPULL(osh, pkt, SDPCM_HDRLEN);
   1084 			dhd_txcomplete(bus->dhd, pkt, FALSE);
   1085 			PKTFREE(osh, pkt, TRUE);
   1086 			DHD_ERROR(("%s: out of bus->txq !!!\n", __FUNCTION__));
   1087 			ret = BCME_NORESOURCE;
   1088 		} else {
   1089 			ret = BCME_OK;
   1090 		}
   1091 		dhd_os_sdunlock_txq(bus->dhd);
   1092 
   1093 		if ((pktq_len(&bus->txq) >= FCHI) && dhd_doflow)
   1094 			dhd_txflowcontrol(bus->dhd, 0, ON);
   1095 
   1096 #ifdef DHD_DEBUG
   1097 		if (pktq_plen(&bus->txq, prec) > qcount[prec])
   1098 			qcount[prec] = pktq_plen(&bus->txq, prec);
   1099 #endif
   1100 		/* Schedule DPC if needed to send queued packet(s) */
   1101 		if (dhd_deferred_tx && !bus->dpc_sched) {
   1102 			bus->dpc_sched = TRUE;
   1103 			dhd_sched_dpc(bus->dhd);
   1104 		}
   1105 	} else {
   1106 		/* Lock: we're about to use shared data/code (and SDIO) */
   1107 		dhd_os_sdlock(bus->dhd);
   1108 
   1109 		/* Otherwise, send it now */
   1110 		BUS_WAKE(bus);
   1111 		/* Make sure back plane ht clk is on, no pending allowed */
   1112 		dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
   1113 
   1114 #ifndef SDTEST
   1115 		DHD_TRACE(("%s: calling txpkt\n", __FUNCTION__));
   1116 		ret = dhdsdio_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, TRUE);
   1117 #else
   1118 		ret = dhdsdio_txpkt(bus, pkt,
   1119 		        (bus->ext_loop ? SDPCM_TEST_CHANNEL : SDPCM_DATA_CHANNEL), TRUE);
   1120 #endif
   1121 		if (ret)
   1122 			bus->dhd->tx_errors++;
   1123 		else
   1124 			bus->dhd->dstats.tx_bytes += datalen;
   1125 
   1126 		if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
   1127 			bus->activity = FALSE;
   1128 			dhdsdio_clkctl(bus, CLK_NONE, TRUE);
   1129 		}
   1130 
   1131 		dhd_os_sdunlock(bus->dhd);
   1132 	}
   1133 
   1134 
   1135 	return ret;
   1136 }
   1137 
   1138 static uint
   1139 dhdsdio_sendfromq(dhd_bus_t *bus, uint maxframes)
   1140 {
   1141 	void *pkt;
   1142 	uint32 intstatus = 0;
   1143 	uint retries = 0;
   1144 	int ret = 0, prec_out;
   1145 	uint cnt = 0;
   1146 	uint datalen;
   1147 	uint8 tx_prec_map;
   1148 
   1149 	dhd_pub_t *dhd = bus->dhd;
   1150 	sdpcmd_regs_t *regs = bus->regs;
   1151 
   1152 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   1153 
   1154 	tx_prec_map = ~bus->flowcontrol;
   1155 
   1156 	/* Send frames until the limit or some other event */
   1157 	for (cnt = 0; (cnt < maxframes) && DATAOK(bus); cnt++) {
   1158 		dhd_os_sdlock_txq(bus->dhd);
   1159 		if ((pkt = pktq_mdeq(&bus->txq, tx_prec_map, &prec_out)) == NULL) {
   1160 			dhd_os_sdunlock_txq(bus->dhd);
   1161 			break;
   1162 		}
   1163 		dhd_os_sdunlock_txq(bus->dhd);
   1164 		datalen = PKTLEN(bus->dhd->osh, pkt) - SDPCM_HDRLEN;
   1165 
   1166 #ifndef SDTEST
   1167 		ret = dhdsdio_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, TRUE);
   1168 #else
   1169 		ret = dhdsdio_txpkt(bus, pkt,
   1170 		        (bus->ext_loop ? SDPCM_TEST_CHANNEL : SDPCM_DATA_CHANNEL), TRUE);
   1171 #endif
   1172 		if (ret)
   1173 			bus->dhd->tx_errors++;
   1174 		else
   1175 			bus->dhd->dstats.tx_bytes += datalen;
   1176 
   1177 		/* In poll mode, need to check for other events */
   1178 		if (!bus->intr && cnt)
   1179 		{
   1180 			/* Check device status, signal pending interrupt */
   1181 			R_SDREG(intstatus, &regs->intstatus, retries);
   1182 			bus->f2txdata++;
   1183 			if (bcmsdh_regfail(bus->sdh))
   1184 				break;
   1185 			if (intstatus & bus->hostintmask)
   1186 				bus->ipend = TRUE;
   1187 		}
   1188 	}
   1189 
   1190 	/* Deflow-control stack if needed */
   1191 	if (dhd_doflow && dhd->up && (dhd->busstate == DHD_BUS_DATA) &&
   1192 	    dhd->txoff && (pktq_len(&bus->txq) < FCLOW))
   1193 		dhd_txflowcontrol(dhd, 0, OFF);
   1194 
   1195 	return cnt;
   1196 }
   1197 
   1198 int
   1199 dhd_bus_txctl(struct dhd_bus *bus, uchar *msg, uint msglen)
   1200 {
   1201 	uint8 *frame;
   1202 	uint16 len;
   1203 	uint32 swheader;
   1204 	uint retries = 0;
   1205 	bcmsdh_info_t *sdh = bus->sdh;
   1206 	uint8 doff = 0;
   1207 	int ret = -1;
   1208 	int i;
   1209 
   1210 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   1211 
   1212 	if (bus->dhd->dongle_reset)
   1213 		return -EIO;
   1214 
   1215 	/* Back the pointer to make a room for bus header */
   1216 	frame = msg - SDPCM_HDRLEN;
   1217 	len = (msglen += SDPCM_HDRLEN);
   1218 
   1219 	/* Add alignment padding (optional for ctl frames) */
   1220 	if (dhd_alignctl) {
   1221 		if ((doff = ((uintptr)frame % DHD_SDALIGN))) {
   1222 			frame -= doff;
   1223 			len += doff;
   1224 			msglen += doff;
   1225 			bzero(frame, doff + SDPCM_HDRLEN);
   1226 		}
   1227 		ASSERT(doff < DHD_SDALIGN);
   1228 	}
   1229 	doff += SDPCM_HDRLEN;
   1230 
   1231 	/* Round send length to next SDIO block */
   1232 	if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
   1233 		uint16 pad = bus->blocksize - (len % bus->blocksize);
   1234 		if ((pad <= bus->roundup) && (pad < bus->blocksize))
   1235 			len += pad;
   1236 	} else if (len % DHD_SDALIGN) {
   1237 		len += DHD_SDALIGN - (len % DHD_SDALIGN);
   1238 	}
   1239 
   1240 	/* Satisfy length-alignment requirements */
   1241 	if (forcealign && (len & (ALIGNMENT - 1)))
   1242 		len = ROUNDUP(len, ALIGNMENT);
   1243 
   1244 	ASSERT(ISALIGNED((uintptr)frame, 2));
   1245 
   1246 
   1247 	/* Need to lock here to protect txseq and SDIO tx calls */
   1248 	dhd_os_sdlock(bus->dhd);
   1249 
   1250 	BUS_WAKE(bus);
   1251 
   1252 	/* Make sure backplane clock is on */
   1253 	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
   1254 
   1255 	/* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
   1256 	*(uint16*)frame = htol16((uint16)msglen);
   1257 	*(((uint16*)frame) + 1) = htol16(~msglen);
   1258 
   1259 	/* Software tag: channel, sequence number, data offset */
   1260 	swheader = ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
   1261 	        | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
   1262 	htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN);
   1263 	htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
   1264 
   1265 	if (!DATAOK(bus)) {
   1266 		DHD_INFO(("%s: No bus credit bus->tx_max %d, bus->tx_seq %d\n",
   1267 			__FUNCTION__, bus->tx_max, bus->tx_seq));
   1268 		bus->ctrl_frame_stat = TRUE;
   1269 		/* Send from dpc */
   1270 		bus->ctrl_frame_buf = frame;
   1271 		bus->ctrl_frame_len = len;
   1272 
   1273 		dhd_wait_for_event(bus->dhd, &bus->ctrl_frame_stat);
   1274 
   1275 		if (bus->ctrl_frame_stat == FALSE) {
   1276 			DHD_INFO(("%s: ctrl_frame_stat == FALSE\n", __FUNCTION__));
   1277 			ret = 0;
   1278 		} else {
   1279 			DHD_INFO(("%s: ctrl_frame_stat == TRUE\n", __FUNCTION__));
   1280 			ret = -1;
   1281 		}
   1282 	}
   1283 
   1284 	if (ret == -1) {
   1285 #ifdef DHD_DEBUG
   1286 		if (DHD_BYTES_ON() && DHD_CTL_ON()) {
   1287 			prhex("Tx Frame", frame, len);
   1288 		} else if (DHD_HDRS_ON()) {
   1289 			prhex("TxHdr", frame, MIN(len, 16));
   1290 		}
   1291 #endif
   1292 
   1293 		do {
   1294 			bus->ctrl_frame_stat = FALSE;
   1295 			ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
   1296 			                          frame, len, NULL, NULL, NULL);
   1297 			ASSERT(ret != BCME_PENDING);
   1298 
   1299 			if (ret < 0) {
   1300 				/* On failure, abort the command and terminate the frame */
   1301 				DHD_INFO(("%s: sdio error %d, abort command and terminate frame.\n",
   1302 				          __FUNCTION__, ret));
   1303 				bus->tx_sderrs++;
   1304 
   1305 				bcmsdh_abort(sdh, SDIO_FUNC_2);
   1306 
   1307 				bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
   1308 				                 SFC_WF_TERM, NULL);
   1309 				bus->f1regdata++;
   1310 
   1311 				for (i = 0; i < 3; i++) {
   1312 					uint8 hi, lo;
   1313 					hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
   1314 					                     SBSDIO_FUNC1_WFRAMEBCHI, NULL);
   1315 					lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
   1316 					                     SBSDIO_FUNC1_WFRAMEBCLO, NULL);
   1317 					bus->f1regdata += 2;
   1318 					if ((hi == 0) && (lo == 0))
   1319 						break;
   1320 				}
   1321 
   1322 			}
   1323 			if (ret == 0) {
   1324 				bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
   1325 			}
   1326 		} while ((ret < 0) && retries++ < TXRETRIES);
   1327 	}
   1328 
   1329 	if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
   1330 		bus->activity = FALSE;
   1331 		dhdsdio_clkctl(bus, CLK_NONE, TRUE);
   1332 	}
   1333 
   1334 	dhd_os_sdunlock(bus->dhd);
   1335 
   1336 	if (ret)
   1337 		bus->dhd->tx_ctlerrs++;
   1338 	else
   1339 		bus->dhd->tx_ctlpkts++;
   1340 
   1341 	return ret ? -EIO : 0;
   1342 }
   1343 
   1344 int
   1345 dhd_bus_rxctl(struct dhd_bus *bus, uchar *msg, uint msglen)
   1346 {
   1347 	int timeleft;
   1348 	uint rxlen = 0;
   1349 	bool pending;
   1350 
   1351 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   1352 
   1353 	if (bus->dhd->dongle_reset)
   1354 		return -EIO;
   1355 
   1356 	/* Wait until control frame is available */
   1357 	timeleft = dhd_os_ioctl_resp_wait(bus->dhd, &bus->rxlen, &pending);
   1358 
   1359 	dhd_os_sdlock(bus->dhd);
   1360 	rxlen = bus->rxlen;
   1361 	bcopy(bus->rxctl, msg, MIN(msglen, rxlen));
   1362 	bus->rxlen = 0;
   1363 	dhd_os_sdunlock(bus->dhd);
   1364 
   1365 	if (rxlen) {
   1366 		DHD_CTL(("%s: resumed on rxctl frame, got %d expected %d\n",
   1367 		         __FUNCTION__, rxlen, msglen));
   1368 	} else if (timeleft == 0) {
   1369 		DHD_ERROR(("%s: resumed on timeout\n", __FUNCTION__));
   1370 #ifdef DHD_DEBUG_TRAP
   1371 		dhd_os_sdlock(bus->dhd);
   1372 		dhdsdio_checkdied(bus, NULL, 0);
   1373 		dhd_os_sdunlock(bus->dhd);
   1374 #endif /* DHD_DEBUG_TRAP */
   1375 	} else if (pending == TRUE) {
   1376 		DHD_CTL(("%s: cancelled\n", __FUNCTION__));
   1377 		return -ERESTARTSYS;
   1378 	} else {
   1379 		DHD_CTL(("%s: resumed for unknown reason?\n", __FUNCTION__));
   1380 #ifdef DHD_DEBUG_TRAP
   1381 		dhd_os_sdlock(bus->dhd);
   1382 		dhdsdio_checkdied(bus, NULL, 0);
   1383 		dhd_os_sdunlock(bus->dhd);
   1384 #endif /* DHD_DEBUG_TRAP */
   1385 	}
   1386 
   1387 	if (rxlen)
   1388 		bus->dhd->rx_ctlpkts++;
   1389 	else
   1390 		bus->dhd->rx_ctlerrs++;
   1391 
   1392 	return rxlen ? (int)rxlen : -ETIMEDOUT;
   1393 }
   1394 
   1395 /* IOVar table */
   1396 enum {
   1397 	IOV_INTR = 1,
   1398 	IOV_POLLRATE,
   1399 	IOV_SDREG,
   1400 	IOV_SBREG,
   1401 	IOV_SDCIS,
   1402 	IOV_MEMBYTES,
   1403 	IOV_MEMSIZE,
   1404 #ifdef DHD_DEBUG_TRAP
   1405 	IOV_CHECKDIED,
   1406 #endif
   1407 	IOV_DOWNLOAD,
   1408 	IOV_FORCEEVEN,
   1409 	IOV_SDIOD_DRIVE,
   1410 	IOV_READAHEAD,
   1411 	IOV_SDRXCHAIN,
   1412 	IOV_ALIGNCTL,
   1413 	IOV_SDALIGN,
   1414 	IOV_DEVRESET,
   1415 	IOV_CPU,
   1416 #ifdef SDTEST
   1417 	IOV_PKTGEN,
   1418 	IOV_EXTLOOP,
   1419 #endif /* SDTEST */
   1420 	IOV_SPROM,
   1421 	IOV_TXBOUND,
   1422 	IOV_RXBOUND,
   1423 	IOV_TXMINMAX,
   1424 	IOV_IDLETIME,
   1425 	IOV_IDLECLOCK,
   1426 	IOV_SD1IDLE,
   1427 	IOV_SLEEP,
   1428 	IOV_VARS
   1429 };
   1430 
   1431 const bcm_iovar_t dhdsdio_iovars[] = {
   1432 	{"intr",	IOV_INTR,	0,	IOVT_BOOL,	0 },
   1433 	{"sleep",	IOV_SLEEP,	0,	IOVT_BOOL,	0 },
   1434 	{"pollrate",	IOV_POLLRATE,	0,	IOVT_UINT32,	0 },
   1435 	{"idletime",	IOV_IDLETIME,	0,	IOVT_INT32,	0 },
   1436 	{"idleclock",	IOV_IDLECLOCK,	0,	IOVT_INT32,	0 },
   1437 	{"sd1idle",	IOV_SD1IDLE,	0,	IOVT_BOOL,	0 },
   1438 	{"membytes",	IOV_MEMBYTES,	0,	IOVT_BUFFER,	2 * sizeof(int) },
   1439 	{"memsize",	IOV_MEMSIZE,	0,	IOVT_UINT32,	0 },
   1440 	{"download",	IOV_DOWNLOAD,	0,	IOVT_BOOL,	0 },
   1441 	{"vars",	IOV_VARS,	0,	IOVT_BUFFER,	0 },
   1442 	{"sdiod_drive",	IOV_SDIOD_DRIVE, 0,	IOVT_UINT32,	0 },
   1443 	{"readahead",	IOV_READAHEAD,	0,	IOVT_BOOL,	0 },
   1444 	{"sdrxchain",	IOV_SDRXCHAIN,	0,	IOVT_BOOL,	0 },
   1445 	{"alignctl",	IOV_ALIGNCTL,	0,	IOVT_BOOL,	0 },
   1446 	{"sdalign",	IOV_SDALIGN,	0,	IOVT_BOOL,	0 },
   1447 	{"devreset",	IOV_DEVRESET,	0,	IOVT_BOOL,	0 },
   1448 #ifdef DHD_DEBUG
   1449 	{"sdreg",	IOV_SDREG,	0,	IOVT_BUFFER,	sizeof(sdreg_t) },
   1450 	{"sbreg",	IOV_SBREG,	0,	IOVT_BUFFER,	sizeof(sdreg_t) },
   1451 	{"sd_cis",	IOV_SDCIS,	0,	IOVT_BUFFER,	DHD_IOCTL_MAXLEN },
   1452 	{"forcealign",	IOV_FORCEEVEN,	0,	IOVT_BOOL,	0 },
   1453 	{"txbound",	IOV_TXBOUND,	0,	IOVT_UINT32,	0 },
   1454 	{"rxbound",	IOV_RXBOUND,	0,	IOVT_UINT32,	0 },
   1455 	{"txminmax", IOV_TXMINMAX,	0,	IOVT_UINT32,	0 },
   1456 	{"cpu",		IOV_CPU,	0,	IOVT_BOOL,	0 },
   1457 #endif /* DHD_DEBUG */
   1458 #ifdef DHD_DEBUG_TRAP
   1459 	{"checkdied",	IOV_CHECKDIED,	0,	IOVT_BUFFER,	0 },
   1460 #endif /* DHD_DEBUG_TRAP  */
   1461 #ifdef SDTEST
   1462 	{"extloop",	IOV_EXTLOOP,	0,	IOVT_BOOL,	0 },
   1463 	{"pktgen",	IOV_PKTGEN,	0,	IOVT_BUFFER,	sizeof(dhd_pktgen_t) },
   1464 #endif /* SDTEST */
   1465 
   1466 	{NULL, 0, 0, 0, 0 }
   1467 };
   1468 
   1469 static void
   1470 dhd_dump_pct(struct bcmstrbuf *strbuf, char *desc, uint num, uint div)
   1471 {
   1472 	uint q1, q2;
   1473 
   1474 	if (!div) {
   1475 		bcm_bprintf(strbuf, "%s N/A", desc);
   1476 	} else {
   1477 		q1 = num / div;
   1478 		q2 = (100 * (num - (q1 * div))) / div;
   1479 		bcm_bprintf(strbuf, "%s %d.%02d", desc, q1, q2);
   1480 	}
   1481 }
   1482 
   1483 void
   1484 dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
   1485 {
   1486 	dhd_bus_t *bus = dhdp->bus;
   1487 
   1488 	bcm_bprintf(strbuf, "Bus SDIO structure:\n");
   1489 	bcm_bprintf(strbuf, "hostintmask 0x%08x intstatus 0x%08x sdpcm_ver %d\n",
   1490 	            bus->hostintmask, bus->intstatus, bus->sdpcm_ver);
   1491 	bcm_bprintf(strbuf, "fcstate %d qlen %d tx_seq %d, max %d, rxskip %d rxlen %d rx_seq %d\n",
   1492 	            bus->fcstate, pktq_len(&bus->txq), bus->tx_seq, bus->tx_max, bus->rxskip,
   1493 	            bus->rxlen, bus->rx_seq);
   1494 	bcm_bprintf(strbuf, "intr %d intrcount %d lastintrs %d spurious %d\n",
   1495 	            bus->intr, bus->intrcount, bus->lastintrs, bus->spurious);
   1496 	bcm_bprintf(strbuf, "pollrate %d pollcnt %d regfails %d\n",
   1497 	            bus->pollrate, bus->pollcnt, bus->regfails);
   1498 
   1499 	bcm_bprintf(strbuf, "\nAdditional counters:\n");
   1500 	bcm_bprintf(strbuf, "tx_sderrs %d fcqueued %d rxrtx %d rx_toolong %d rxc_errors %d\n",
   1501 	            bus->tx_sderrs, bus->fcqueued, bus->rxrtx, bus->rx_toolong,
   1502 	            bus->rxc_errors);
   1503 	bcm_bprintf(strbuf, "rx_hdrfail %d badhdr %d badseq %d\n",
   1504 	            bus->rx_hdrfail, bus->rx_badhdr, bus->rx_badseq);
   1505 	bcm_bprintf(strbuf, "fc_rcvd %d, fc_xoff %d, fc_xon %d\n",
   1506 	            bus->fc_rcvd, bus->fc_xoff, bus->fc_xon);
   1507 	bcm_bprintf(strbuf, "rxglomfail %d, rxglomframes %d, rxglompkts %d\n",
   1508 	            bus->rxglomfail, bus->rxglomframes, bus->rxglompkts);
   1509 	bcm_bprintf(strbuf, "f2rx (hdrs/data) %d (%d/%d), f2tx %d f1regs %d\n",
   1510 	            (bus->f2rxhdrs + bus->f2rxdata), bus->f2rxhdrs, bus->f2rxdata,
   1511 	            bus->f2txdata, bus->f1regdata);
   1512 	{
   1513 		dhd_dump_pct(strbuf, "\nRx: pkts/f2rd", bus->dhd->rx_packets,
   1514 		             (bus->f2rxhdrs + bus->f2rxdata));
   1515 		dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->rx_packets, bus->f1regdata);
   1516 		dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->rx_packets,
   1517 		             (bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
   1518 		dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->rx_packets, bus->intrcount);
   1519 		bcm_bprintf(strbuf, "\n");
   1520 
   1521 		dhd_dump_pct(strbuf, "Rx: glom pct", (100 * bus->rxglompkts),
   1522 		             bus->dhd->rx_packets);
   1523 		dhd_dump_pct(strbuf, ", pkts/glom", bus->rxglompkts, bus->rxglomframes);
   1524 		bcm_bprintf(strbuf, "\n");
   1525 
   1526 		dhd_dump_pct(strbuf, "Tx: pkts/f2wr", bus->dhd->tx_packets, bus->f2txdata);
   1527 		dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->tx_packets, bus->f1regdata);
   1528 		dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->tx_packets,
   1529 		             (bus->f2txdata + bus->f1regdata));
   1530 		dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->tx_packets, bus->intrcount);
   1531 		bcm_bprintf(strbuf, "\n");
   1532 
   1533 		dhd_dump_pct(strbuf, "Total: pkts/f2rw",
   1534 		             (bus->dhd->tx_packets + bus->dhd->rx_packets),
   1535 		             (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata));
   1536 		dhd_dump_pct(strbuf, ", pkts/f1sd",
   1537 		             (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->f1regdata);
   1538 		dhd_dump_pct(strbuf, ", pkts/sd",
   1539 		             (bus->dhd->tx_packets + bus->dhd->rx_packets),
   1540 		             (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
   1541 		dhd_dump_pct(strbuf, ", pkts/int",
   1542 		             (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->intrcount);
   1543 		bcm_bprintf(strbuf, "\n\n");
   1544 	}
   1545 
   1546 #ifdef SDTEST
   1547 	if (bus->pktgen_count) {
   1548 		bcm_bprintf(strbuf, "pktgen config and count:\n");
   1549 		bcm_bprintf(strbuf, "freq %d count %d print %d total %d min %d len %d\n",
   1550 		            bus->pktgen_freq, bus->pktgen_count, bus->pktgen_print,
   1551 		            bus->pktgen_total, bus->pktgen_minlen, bus->pktgen_maxlen);
   1552 		bcm_bprintf(strbuf, "send attempts %d rcvd %d fail %d\n",
   1553 		            bus->pktgen_sent, bus->pktgen_rcvd, bus->pktgen_fail);
   1554 	}
   1555 #endif /* SDTEST */
   1556 #ifdef DHD_DEBUG
   1557 	bcm_bprintf(strbuf, "dpc_sched %d host interrupt%spending\n",
   1558 	            bus->dpc_sched, (bcmsdh_intr_pending(bus->sdh) ? " " : " not "));
   1559 	bcm_bprintf(strbuf, "blocksize %d roundup %d\n", bus->blocksize, bus->roundup);
   1560 #endif /* DHD_DEBUG */
   1561 	bcm_bprintf(strbuf, "clkstate %d activity %d idletime %d idlecount %d sleeping %d\n",
   1562 	            bus->clkstate, bus->activity, bus->idletime, bus->idlecount, bus->sleeping);
   1563 }
   1564 
   1565 void
   1566 dhd_bus_clearcounts(dhd_pub_t *dhdp)
   1567 {
   1568 	dhd_bus_t *bus = (dhd_bus_t *)dhdp->bus;
   1569 
   1570 	bus->intrcount = bus->lastintrs = bus->spurious = bus->regfails = 0;
   1571 	bus->rxrtx = bus->rx_toolong = bus->rxc_errors = 0;
   1572 	bus->rx_hdrfail = bus->rx_badhdr = bus->rx_badseq = 0;
   1573 	bus->tx_sderrs = bus->fc_rcvd = bus->fc_xoff = bus->fc_xon = 0;
   1574 	bus->rxglomfail = bus->rxglomframes = bus->rxglompkts = 0;
   1575 	bus->f2rxhdrs = bus->f2rxdata = bus->f2txdata = bus->f1regdata = 0;
   1576 }
   1577 
   1578 #ifdef SDTEST
   1579 static int
   1580 dhdsdio_pktgen_get(dhd_bus_t *bus, uint8 *arg)
   1581 {
   1582 	dhd_pktgen_t pktgen;
   1583 
   1584 	pktgen.version = DHD_PKTGEN_VERSION;
   1585 	pktgen.freq = bus->pktgen_freq;
   1586 	pktgen.count = bus->pktgen_count;
   1587 	pktgen.print = bus->pktgen_print;
   1588 	pktgen.total = bus->pktgen_total;
   1589 	pktgen.minlen = bus->pktgen_minlen;
   1590 	pktgen.maxlen = bus->pktgen_maxlen;
   1591 	pktgen.numsent = bus->pktgen_sent;
   1592 	pktgen.numrcvd = bus->pktgen_rcvd;
   1593 	pktgen.numfail = bus->pktgen_fail;
   1594 	pktgen.mode = bus->pktgen_mode;
   1595 	pktgen.stop = bus->pktgen_stop;
   1596 
   1597 	bcopy(&pktgen, arg, sizeof(pktgen));
   1598 
   1599 	return 0;
   1600 }
   1601 
   1602 static int
   1603 dhdsdio_pktgen_set(dhd_bus_t *bus, uint8 *arg)
   1604 {
   1605 	dhd_pktgen_t pktgen;
   1606 	uint oldcnt, oldmode;
   1607 
   1608 	bcopy(arg, &pktgen, sizeof(pktgen));
   1609 	if (pktgen.version != DHD_PKTGEN_VERSION)
   1610 		return BCME_BADARG;
   1611 
   1612 	oldcnt = bus->pktgen_count;
   1613 	oldmode = bus->pktgen_mode;
   1614 
   1615 	bus->pktgen_freq = pktgen.freq;
   1616 	bus->pktgen_count = pktgen.count;
   1617 	bus->pktgen_print = pktgen.print;
   1618 	bus->pktgen_total = pktgen.total;
   1619 	bus->pktgen_minlen = pktgen.minlen;
   1620 	bus->pktgen_maxlen = pktgen.maxlen;
   1621 	bus->pktgen_mode = pktgen.mode;
   1622 	bus->pktgen_stop = pktgen.stop;
   1623 
   1624 	bus->pktgen_tick = bus->pktgen_ptick = 0;
   1625 	bus->pktgen_len = MAX(bus->pktgen_len, bus->pktgen_minlen);
   1626 	bus->pktgen_len = MIN(bus->pktgen_len, bus->pktgen_maxlen);
   1627 
   1628 	/* Clear counts for a new pktgen (mode change, or was stopped) */
   1629 	if (bus->pktgen_count && (!oldcnt || oldmode != bus->pktgen_mode))
   1630 		bus->pktgen_sent = bus->pktgen_rcvd = bus->pktgen_fail = 0;
   1631 
   1632 	return 0;
   1633 }
   1634 #endif /* SDTEST */
   1635 
   1636 static int
   1637 dhdsdio_membytes(dhd_bus_t *bus, bool write, uint32 address, uint8 *data, uint size)
   1638 {
   1639 	int bcmerror = 0;
   1640 	uint32 sdaddr;
   1641 	uint dsize;
   1642 
   1643 	/* Determine initial transfer parameters */
   1644 	sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
   1645 	if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
   1646 		dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
   1647 	else
   1648 		dsize = size;
   1649 
   1650 	/* Set the backplane window to include the start address */
   1651 	if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
   1652 		DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
   1653 		goto xfer_done;
   1654 	}
   1655 
   1656 	/* Do the transfer(s) */
   1657 	while (size) {
   1658 		DHD_INFO(("%s: %s %d bytes at offset 0x%08x in window 0x%08x\n",
   1659 		          __FUNCTION__, (write ? "write" : "read"), dsize, sdaddr,
   1660 		          (address & SBSDIO_SBWINDOW_MASK)));
   1661 		if ((bcmerror = bcmsdh_rwdata(bus->sdh, write, sdaddr, data, dsize))) {
   1662 			DHD_ERROR(("%s: membytes transfer failed\n", __FUNCTION__));
   1663 			break;
   1664 		}
   1665 
   1666 		/* Adjust for next transfer (if any) */
   1667 		if ((size -= dsize)) {
   1668 			data += dsize;
   1669 			address += dsize;
   1670 			if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
   1671 				DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
   1672 				break;
   1673 			}
   1674 			sdaddr = 0;
   1675 			dsize = MIN(SBSDIO_SB_OFT_ADDR_LIMIT, size);
   1676 		}
   1677 	}
   1678 
   1679 xfer_done:
   1680 	/* Return the window to backplane enumeration space for core access */
   1681 	if (dhdsdio_set_siaddr_window(bus, bcmsdh_cur_sbwad(bus->sdh))) {
   1682 		DHD_ERROR(("%s: FAILED to set window back to 0x%x\n", __FUNCTION__,
   1683 			bcmsdh_cur_sbwad(bus->sdh)));
   1684 	}
   1685 
   1686 	return bcmerror;
   1687 }
   1688 
   1689 #ifdef DHD_DEBUG_TRAP
   1690 static int
   1691 dhdsdio_readshared(dhd_bus_t *bus, sdpcm_shared_t *sh)
   1692 {
   1693 	uint32 addr;
   1694 	int rv;
   1695 
   1696 	/* Read last word in memory to determine address of sdpcm_shared structure */
   1697 	if ((rv = dhdsdio_membytes(bus, FALSE, bus->ramsize - 4, (uint8 *)&addr, 4)) < 0)
   1698 		return rv;
   1699 
   1700 	addr = ltoh32(addr);
   1701 
   1702 	DHD_INFO(("sdpcm_shared address 0x%08X\n", addr));
   1703 
   1704 	/*
   1705 	 * Check if addr is valid.
   1706 	 * NVRAM length at the end of memory should have been overwritten.
   1707 	 */
   1708 	if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff)) {
   1709 		DHD_ERROR(("%s: address (0x%08x) of sdpcm_shared invalid\n", __FUNCTION__, addr));
   1710 		return BCME_ERROR;
   1711 	}
   1712 
   1713 	/* Read hndrte_shared structure */
   1714 	if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)sh, sizeof(sdpcm_shared_t))) < 0)
   1715 		return rv;
   1716 
   1717 	/* Endianness */
   1718 	sh->flags = ltoh32(sh->flags);
   1719 	sh->trap_addr = ltoh32(sh->trap_addr);
   1720 	sh->assert_exp_addr = ltoh32(sh->assert_exp_addr);
   1721 	sh->assert_file_addr = ltoh32(sh->assert_file_addr);
   1722 	sh->assert_line = ltoh32(sh->assert_line);
   1723 	sh->console_addr = ltoh32(sh->console_addr);
   1724 	sh->msgtrace_addr = ltoh32(sh->msgtrace_addr);
   1725 
   1726 	if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
   1727 		DHD_ERROR(("%s: sdpcm_shared version %d in dhd "
   1728 		           "is different than sdpcm_shared version %d in dongle\n",
   1729 		           __FUNCTION__, SDPCM_SHARED_VERSION,
   1730 		           sh->flags & SDPCM_SHARED_VERSION_MASK));
   1731 		return BCME_ERROR;
   1732 	}
   1733 
   1734 	return BCME_OK;
   1735 }
   1736 
   1737 static int
   1738 dhdsdio_checkdied(dhd_bus_t *bus, uint8 *data, uint size)
   1739 {
   1740 	int bcmerror = 0;
   1741 	uint msize = 512;
   1742 	char *mbuffer = NULL;
   1743 	uint maxstrlen = 256;
   1744 	char *str = NULL;
   1745 	trap_t tr;
   1746 	sdpcm_shared_t sdpcm_shared;
   1747 	struct bcmstrbuf strbuf;
   1748 
   1749 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   1750 
   1751 	if (data == NULL) {
   1752 		/*
   1753 		 * Called after a rx ctrl timeout. "data" is NULL.
   1754 		 * allocate memory to trace the trap or assert.
   1755 		 */
   1756 		size = msize;
   1757 		mbuffer = data = MALLOC(bus->dhd->osh, msize);
   1758 		if (mbuffer == NULL) {
   1759 			DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, msize));
   1760 			bcmerror = BCME_NOMEM;
   1761 			goto done;
   1762 		}
   1763 	}
   1764 
   1765 	if ((str = MALLOC(bus->dhd->osh, maxstrlen)) == NULL) {
   1766 		DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, maxstrlen));
   1767 		bcmerror = BCME_NOMEM;
   1768 		goto done;
   1769 	}
   1770 
   1771 	if ((bcmerror = dhdsdio_readshared(bus, &sdpcm_shared)) < 0)
   1772 		goto done;
   1773 
   1774 	bcm_binit(&strbuf, data, size);
   1775 
   1776 	bcm_bprintf(&strbuf, "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
   1777 	            sdpcm_shared.msgtrace_addr, sdpcm_shared.console_addr);
   1778 
   1779 	if ((sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
   1780 		/* NOTE: Misspelled assert is intentional - DO NOT FIX.
   1781 		 * (Avoids conflict with real asserts for programmatic parsing of output.)
   1782 		 */
   1783 		bcm_bprintf(&strbuf, "Assrt not built in dongle\n");
   1784 	}
   1785 
   1786 	if ((sdpcm_shared.flags & (SDPCM_SHARED_ASSERT|SDPCM_SHARED_TRAP)) == 0) {
   1787 		/* NOTE: Misspelled assert is intentional - DO NOT FIX.
   1788 		 * (Avoids conflict with real asserts for programmatic parsing of output.)
   1789 		 */
   1790 		bcm_bprintf(&strbuf, "No trap%s in dongle",
   1791 		          (sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT)
   1792 		          ?"/assrt" :"");
   1793 	} else {
   1794 		if (sdpcm_shared.flags & SDPCM_SHARED_ASSERT) {
   1795 			/* Download assert */
   1796 			bcm_bprintf(&strbuf, "Dongle assert");
   1797 			if (sdpcm_shared.assert_exp_addr != 0) {
   1798 				str[0] = '\0';
   1799 				if ((bcmerror = dhdsdio_membytes(bus, FALSE,
   1800 				                                 sdpcm_shared.assert_exp_addr,
   1801 				                                 (uint8 *)str, maxstrlen)) < 0)
   1802 					goto done;
   1803 
   1804 				str[maxstrlen - 1] = '\0';
   1805 				bcm_bprintf(&strbuf, " expr \"%s\"", str);
   1806 			}
   1807 
   1808 			if (sdpcm_shared.assert_file_addr != 0) {
   1809 				str[0] = '\0';
   1810 				if ((bcmerror = dhdsdio_membytes(bus, FALSE,
   1811 				                                 sdpcm_shared.assert_file_addr,
   1812 				                                 (uint8 *)str, maxstrlen)) < 0)
   1813 					goto done;
   1814 
   1815 				str[maxstrlen - 1] = '\0';
   1816 				bcm_bprintf(&strbuf, " file \"%s\"", str);
   1817 			}
   1818 
   1819 			bcm_bprintf(&strbuf, " line %d ", sdpcm_shared.assert_line);
   1820 		}
   1821 
   1822 		if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
   1823 			if ((bcmerror = dhdsdio_membytes(bus, FALSE,
   1824 			                                 sdpcm_shared.trap_addr,
   1825 			                                 (uint8*)&tr, sizeof(trap_t))) < 0)
   1826 				goto done;
   1827 
   1828 			bcm_bprintf(&strbuf,
   1829 			"Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
   1830 			"lp 0x%x, rpc 0x%x Trap offset 0x%x, "
   1831 			"r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n",
   1832 			tr.type, tr.epc, tr.cpsr, tr.spsr, tr.r13, tr.r14, tr.pc,
   1833 			sdpcm_shared.trap_addr,
   1834 			tr.r0, tr.r1, tr.r2, tr.r3, tr.r4, tr.r5, tr.r6, tr.r7);
   1835 		}
   1836 	}
   1837 
   1838 	if (sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP)) {
   1839 		DHD_ERROR(("%s: %s\n", __FUNCTION__, strbuf.origbuf));
   1840 	}
   1841 
   1842 	if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
   1843 			/* Mem dump to a file on device */
   1844 			dhdsdio_mem_dump(bus);
   1845 	}
   1846 
   1847 done:
   1848 	if (mbuffer)
   1849 		MFREE(bus->dhd->osh, mbuffer, msize);
   1850 	if (str)
   1851 		MFREE(bus->dhd->osh, str, maxstrlen);
   1852 
   1853 	return bcmerror;
   1854 }
   1855 
   1856 static int
   1857 dhdsdio_mem_dump(dhd_bus_t *bus)
   1858 {
   1859 	int ret = 0;
   1860 	int size; /* Full mem size */
   1861 	int start = 0; /* Start address */
   1862 	int read_size = 0; /* Read size of each iteration */
   1863 	uint8 *buf = NULL, *databuf = NULL;
   1864 
   1865 	/* Get full mem size */
   1866 	size = bus->ramsize;
   1867 	buf = MALLOC(bus->dhd->osh, size);
   1868 	if (!buf) {
   1869 		printf("%s: Out of memory (%d bytes)\n", __FUNCTION__, size);
   1870 		return -1;
   1871 	}
   1872 
   1873 	/* Read mem content */
   1874 	printf("Dump dongle memory");
   1875 	databuf = buf;
   1876 	while (size)
   1877 	{
   1878 		read_size = MIN(MEMBLOCK, size);
   1879 		if ((ret = dhdsdio_membytes(bus, FALSE, start, databuf, read_size)))
   1880 		{
   1881 			printf("%s: Error membytes %d\n", __FUNCTION__, ret);
   1882 			if (buf) {
   1883 				MFREE(bus->dhd->osh, buf, size);
   1884 			}
   1885 			return -1;
   1886 		}
   1887 		printf(".");
   1888 
   1889 		/* Decrement size and increment start address */
   1890 		size -= read_size;
   1891 		start += read_size;
   1892 		databuf += read_size;
   1893 	}
   1894 	printf("Done\n");
   1895 
   1896 #ifdef DHD_DEBUG
   1897 	/* free buf before return !!! */
   1898 	if (write_to_file(bus->dhd, buf, bus->ramsize))
   1899 	{
   1900 		printf("%s: Error writing to files\n", __FUNCTION__);
   1901 		return -1;
   1902 	}
   1903 	/* buf free handled in write_to_file, not here */
   1904 #else
   1905 	MFREE(bus->dhd->osh, buf, size);
   1906 #endif
   1907 	return 0;
   1908 }
   1909 #endif /* DHD_DEBUG_TRAP */
   1910 
   1911 #ifdef DHD_DEBUG
   1912 #define CONSOLE_LINE_MAX	192
   1913 
   1914 static int
   1915 dhdsdio_readconsole(dhd_bus_t *bus)
   1916 {
   1917 	dhd_console_t *c = &bus->console;
   1918 	uint8 line[CONSOLE_LINE_MAX], ch;
   1919 	uint32 n, idx, addr;
   1920 	int rv;
   1921 
   1922 	/* Don't do anything until FWREADY updates console address */
   1923 	if (bus->console_addr == 0)
   1924 		return 0;
   1925 
   1926 	/* Read console log struct */
   1927 	addr = bus->console_addr + OFFSETOF(hndrte_cons_t, log);
   1928 	if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)&c->log, sizeof(c->log))) < 0)
   1929 		return rv;
   1930 
   1931 	/* Allocate console buffer (one time only) */
   1932 	if (c->buf == NULL) {
   1933 		c->bufsize = ltoh32(c->log.buf_size);
   1934 		if ((c->buf = MALLOC(bus->dhd->osh, c->bufsize)) == NULL)
   1935 			return BCME_NOMEM;
   1936 	}
   1937 
   1938 	idx = ltoh32(c->log.idx);
   1939 
   1940 	/* Protect against corrupt value */
   1941 	if (idx > c->bufsize)
   1942 		return BCME_ERROR;
   1943 
   1944 	/* Skip reading the console buffer if the index pointer has not moved */
   1945 	if (idx == c->last)
   1946 		return BCME_OK;
   1947 
   1948 	/* Read the console buffer */
   1949 	addr = ltoh32(c->log.buf);
   1950 	if ((rv = dhdsdio_membytes(bus, FALSE, addr, c->buf, c->bufsize)) < 0)
   1951 		return rv;
   1952 
   1953 	while (c->last != idx) {
   1954 		for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
   1955 			if (c->last == idx) {
   1956 				/* This would output a partial line.  Instead, back up
   1957 				 * the buffer pointer and output this line next time around.
   1958 				 */
   1959 				if (c->last >= n)
   1960 					c->last -= n;
   1961 				else
   1962 					c->last = c->bufsize - n;
   1963 				goto break2;
   1964 			}
   1965 			ch = c->buf[c->last];
   1966 			c->last = (c->last + 1) % c->bufsize;
   1967 			if (ch == '\n')
   1968 				break;
   1969 			line[n] = ch;
   1970 		}
   1971 
   1972 		if (n > 0) {
   1973 			if (line[n - 1] == '\r')
   1974 				n--;
   1975 			line[n] = 0;
   1976 			printf("CONSOLE: %s\n", line);
   1977 		}
   1978 	}
   1979 break2:
   1980 
   1981 	return BCME_OK;
   1982 }
   1983 #endif /* DHD_DEBUG */
   1984 
   1985 int
   1986 dhdsdio_downloadvars(dhd_bus_t *bus, void *arg, int len)
   1987 {
   1988 	int bcmerror = BCME_OK;
   1989 
   1990 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   1991 
   1992 	/* Basic sanity checks */
   1993 	if (bus->dhd->up) {
   1994 		bcmerror = BCME_NOTDOWN;
   1995 		goto err;
   1996 	}
   1997 	if (!len) {
   1998 		bcmerror = BCME_BUFTOOSHORT;
   1999 		goto err;
   2000 	}
   2001 
   2002 	/* Free the old ones and replace with passed variables */
   2003 	if (bus->vars)
   2004 		MFREE(bus->dhd->osh, bus->vars, bus->varsz);
   2005 
   2006 	bus->vars = MALLOC(bus->dhd->osh, len);
   2007 	bus->varsz = bus->vars ? len : 0;
   2008 	if (bus->vars == NULL) {
   2009 		bcmerror = BCME_NOMEM;
   2010 		goto err;
   2011 	}
   2012 
   2013 	/* Copy the passed variables, which should include the terminating double-null */
   2014 	bcopy(arg, bus->vars, bus->varsz);
   2015 err:
   2016 	return bcmerror;
   2017 }
   2018 
   2019 static int
   2020 dhdsdio_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid, const char *name,
   2021                 void *params, int plen, void *arg, int len, int val_size)
   2022 {
   2023 	int bcmerror = 0;
   2024 	int32 int_val = 0;
   2025 	bool bool_val = 0;
   2026 
   2027 	DHD_TRACE(("%s: Enter, action %d name %s params %p plen %d arg %p len %d val_size %d\n",
   2028 	           __FUNCTION__, actionid, name, params, plen, arg, len, val_size));
   2029 
   2030 	if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
   2031 		goto exit;
   2032 
   2033 	if (plen >= (int)sizeof(int_val))
   2034 		bcopy(params, &int_val, sizeof(int_val));
   2035 
   2036 	bool_val = (int_val != 0) ? TRUE : FALSE;
   2037 
   2038 
   2039 	/* Some ioctls use the bus */
   2040 	dhd_os_sdlock(bus->dhd);
   2041 
   2042 	/* Check if dongle is in reset. If so, only allow DEVRESET iovars */
   2043 	if (bus->dhd->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
   2044 	                                actionid == IOV_GVAL(IOV_DEVRESET))) {
   2045 		bcmerror = BCME_NOTREADY;
   2046 		goto exit;
   2047 	}
   2048 
   2049 	/* Handle sleep stuff before any clock mucking */
   2050 	if (vi->varid == IOV_SLEEP) {
   2051 		if (IOV_ISSET(actionid)) {
   2052 			bcmerror = dhdsdio_bussleep(bus, bool_val);
   2053 		} else {
   2054 			int_val = (int32)bus->sleeping;
   2055 			bcopy(&int_val, arg, val_size);
   2056 		}
   2057 		goto exit;
   2058 	}
   2059 
   2060 	/* Request clock to allow SDIO accesses */
   2061 	if (!bus->dhd->dongle_reset) {
   2062 		BUS_WAKE(bus);
   2063 		dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
   2064 	}
   2065 
   2066 	switch (actionid) {
   2067 	case IOV_GVAL(IOV_INTR):
   2068 		int_val = (int32)bus->intr;
   2069 		bcopy(&int_val, arg, val_size);
   2070 		break;
   2071 
   2072 	case IOV_SVAL(IOV_INTR):
   2073 		bus->intr = bool_val;
   2074 		bus->intdis = FALSE;
   2075 		if (bus->dhd->up) {
   2076 			if (bus->intr) {
   2077 				DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
   2078 				bcmsdh_intr_enable(bus->sdh);
   2079 			} else {
   2080 				DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
   2081 				bcmsdh_intr_disable(bus->sdh);
   2082 			}
   2083 		}
   2084 		break;
   2085 
   2086 	case IOV_GVAL(IOV_POLLRATE):
   2087 		int_val = (int32)bus->pollrate;
   2088 		bcopy(&int_val, arg, val_size);
   2089 		break;
   2090 
   2091 	case IOV_SVAL(IOV_POLLRATE):
   2092 		bus->pollrate = (uint)int_val;
   2093 		bus->poll = (bus->pollrate != 0);
   2094 		break;
   2095 
   2096 	case IOV_GVAL(IOV_IDLETIME):
   2097 		int_val = bus->idletime;
   2098 		bcopy(&int_val, arg, val_size);
   2099 		break;
   2100 
   2101 	case IOV_SVAL(IOV_IDLETIME):
   2102 		if ((int_val < 0) && (int_val != DHD_IDLE_IMMEDIATE)) {
   2103 			bcmerror = BCME_BADARG;
   2104 		} else {
   2105 			bus->idletime = int_val;
   2106 		}
   2107 		break;
   2108 
   2109 	case IOV_GVAL(IOV_IDLECLOCK):
   2110 		int_val = (int32)bus->idleclock;
   2111 		bcopy(&int_val, arg, val_size);
   2112 		break;
   2113 
   2114 	case IOV_SVAL(IOV_IDLECLOCK):
   2115 		bus->idleclock = int_val;
   2116 		break;
   2117 
   2118 	case IOV_GVAL(IOV_SD1IDLE):
   2119 		int_val = (int32)sd1idle;
   2120 		bcopy(&int_val, arg, val_size);
   2121 		break;
   2122 
   2123 	case IOV_SVAL(IOV_SD1IDLE):
   2124 		sd1idle = bool_val;
   2125 		break;
   2126 
   2127 
   2128 	case IOV_SVAL(IOV_MEMBYTES):
   2129 	case IOV_GVAL(IOV_MEMBYTES):
   2130 	{
   2131 		uint32 address;
   2132 		uint size, dsize;
   2133 		uint8 *data;
   2134 
   2135 		bool set = (actionid == IOV_SVAL(IOV_MEMBYTES));
   2136 
   2137 		ASSERT(plen >= 2*sizeof(int));
   2138 
   2139 		address = (uint32)int_val;
   2140 		bcopy((char *)params + sizeof(int_val), &int_val, sizeof(int_val));
   2141 		size = (uint)int_val;
   2142 
   2143 		/* Do some validation */
   2144 		dsize = set ? plen - (2 * sizeof(int)) : len;
   2145 		if (dsize < size) {
   2146 			DHD_ERROR(("%s: error on %s membytes, addr 0x%08x size %d dsize %d\n",
   2147 			           __FUNCTION__, (set ? "set" : "get"), address, size, dsize));
   2148 			bcmerror = BCME_BADARG;
   2149 			break;
   2150 		}
   2151 
   2152 		DHD_INFO(("%s: Request to %s %d bytes at address 0x%08x\n", __FUNCTION__,
   2153 		          (set ? "write" : "read"), size, address));
   2154 
   2155 		/* If we know about SOCRAM, check for a fit */
   2156 		if ((bus->orig_ramsize) &&
   2157 		    ((address > bus->orig_ramsize) || (address + size > bus->orig_ramsize))) {
   2158 			DHD_ERROR(("%s: ramsize 0x%08x doesn't have %d bytes at 0x%08x\n",
   2159 			           __FUNCTION__, bus->orig_ramsize, size, address));
   2160 			bcmerror = BCME_BADARG;
   2161 			break;
   2162 		}
   2163 
   2164 		/* Generate the actual data pointer */
   2165 		data = set ? (uint8*)params + 2 * sizeof(int): (uint8*)arg;
   2166 
   2167 		/* Call to do the transfer */
   2168 		bcmerror = dhdsdio_membytes(bus, set, address, data, size);
   2169 
   2170 		break;
   2171 	}
   2172 
   2173 	case IOV_GVAL(IOV_MEMSIZE):
   2174 		int_val = (int32)bus->ramsize;
   2175 		bcopy(&int_val, arg, val_size);
   2176 		break;
   2177 
   2178 	case IOV_GVAL(IOV_SDIOD_DRIVE):
   2179 		int_val = (int32)dhd_sdiod_drive_strength;
   2180 		bcopy(&int_val, arg, val_size);
   2181 		break;
   2182 
   2183 	case IOV_SVAL(IOV_SDIOD_DRIVE):
   2184 		dhd_sdiod_drive_strength = int_val;
   2185 		si_sdiod_drive_strength_init(bus->sih, bus->dhd->osh, dhd_sdiod_drive_strength);
   2186 		break;
   2187 
   2188 	case IOV_SVAL(IOV_DOWNLOAD):
   2189 		bcmerror = dhdsdio_download_state(bus, bool_val);
   2190 		break;
   2191 
   2192 	case IOV_SVAL(IOV_VARS):
   2193 		bcmerror = dhdsdio_downloadvars(bus, arg, len);
   2194 		break;
   2195 
   2196 	case IOV_GVAL(IOV_READAHEAD):
   2197 		int_val = (int32)dhd_readahead;
   2198 		bcopy(&int_val, arg, val_size);
   2199 		break;
   2200 
   2201 	case IOV_SVAL(IOV_READAHEAD):
   2202 		if (bool_val && !dhd_readahead)
   2203 			bus->nextlen = 0;
   2204 		dhd_readahead = bool_val;
   2205 		break;
   2206 
   2207 	case IOV_GVAL(IOV_SDRXCHAIN):
   2208 		int_val = (int32)bus->use_rxchain;
   2209 		bcopy(&int_val, arg, val_size);
   2210 		break;
   2211 
   2212 	case IOV_SVAL(IOV_SDRXCHAIN):
   2213 		if (bool_val && !bus->sd_rxchain)
   2214 			bcmerror = BCME_UNSUPPORTED;
   2215 		else
   2216 			bus->use_rxchain = bool_val;
   2217 		break;
   2218 	case IOV_GVAL(IOV_ALIGNCTL):
   2219 		int_val = (int32)dhd_alignctl;
   2220 		bcopy(&int_val, arg, val_size);
   2221 		break;
   2222 
   2223 	case IOV_SVAL(IOV_ALIGNCTL):
   2224 		dhd_alignctl = bool_val;
   2225 		break;
   2226 
   2227 	case IOV_GVAL(IOV_SDALIGN):
   2228 		int_val = DHD_SDALIGN;
   2229 		bcopy(&int_val, arg, val_size);
   2230 		break;
   2231 
   2232 #ifdef DHD_DEBUG
   2233 	case IOV_GVAL(IOV_VARS):
   2234 		if (bus->varsz < (uint)len)
   2235 			bcopy(bus->vars, arg, bus->varsz);
   2236 		else
   2237 			bcmerror = BCME_BUFTOOSHORT;
   2238 		break;
   2239 #endif /* DHD_DEBUG */
   2240 
   2241 #ifdef DHD_DEBUG
   2242 	case IOV_GVAL(IOV_SDREG):
   2243 	{
   2244 		sdreg_t *sd_ptr;
   2245 		uint32 addr, size;
   2246 
   2247 		sd_ptr = (sdreg_t *)params;
   2248 
   2249 		addr = (uintptr)bus->regs + sd_ptr->offset;
   2250 		size = sd_ptr->func;
   2251 		int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
   2252 		if (bcmsdh_regfail(bus->sdh))
   2253 			bcmerror = BCME_SDIO_ERROR;
   2254 		bcopy(&int_val, arg, sizeof(int32));
   2255 		break;
   2256 	}
   2257 
   2258 	case IOV_SVAL(IOV_SDREG):
   2259 	{
   2260 		sdreg_t *sd_ptr;
   2261 		uint32 addr, size;
   2262 
   2263 		sd_ptr = (sdreg_t *)params;
   2264 
   2265 		addr = (uintptr)bus->regs + sd_ptr->offset;
   2266 		size = sd_ptr->func;
   2267 		bcmsdh_reg_write(bus->sdh, addr, size, sd_ptr->value);
   2268 		if (bcmsdh_regfail(bus->sdh))
   2269 			bcmerror = BCME_SDIO_ERROR;
   2270 		break;
   2271 	}
   2272 
   2273 	/* Same as above, but offset is not backplane (not SDIO core) */
   2274 	case IOV_GVAL(IOV_SBREG):
   2275 	{
   2276 		sdreg_t sdreg;
   2277 		uint32 addr, size;
   2278 
   2279 		bcopy(params, &sdreg, sizeof(sdreg));
   2280 
   2281 		addr = SI_ENUM_BASE + sdreg.offset;
   2282 		size = sdreg.func;
   2283 		int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
   2284 		if (bcmsdh_regfail(bus->sdh))
   2285 			bcmerror = BCME_SDIO_ERROR;
   2286 		bcopy(&int_val, arg, sizeof(int32));
   2287 		break;
   2288 	}
   2289 
   2290 	case IOV_SVAL(IOV_SBREG):
   2291 	{
   2292 		sdreg_t sdreg;
   2293 		uint32 addr, size;
   2294 
   2295 		bcopy(params, &sdreg, sizeof(sdreg));
   2296 
   2297 		addr = SI_ENUM_BASE + sdreg.offset;
   2298 		size = sdreg.func;
   2299 		bcmsdh_reg_write(bus->sdh, addr, size, sdreg.value);
   2300 		if (bcmsdh_regfail(bus->sdh))
   2301 			bcmerror = BCME_SDIO_ERROR;
   2302 		break;
   2303 	}
   2304 
   2305 	case IOV_GVAL(IOV_SDCIS):
   2306 	{
   2307 		*(char *)arg = 0;
   2308 
   2309 		bcmstrcat(arg, "\nFunc 0\n");
   2310 		bcmsdh_cis_read(bus->sdh, 0x10, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
   2311 		bcmstrcat(arg, "\nFunc 1\n");
   2312 		bcmsdh_cis_read(bus->sdh, 0x11, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
   2313 		bcmstrcat(arg, "\nFunc 2\n");
   2314 		bcmsdh_cis_read(bus->sdh, 0x12, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
   2315 		break;
   2316 	}
   2317 
   2318 	case IOV_GVAL(IOV_FORCEEVEN):
   2319 		int_val = (int32)forcealign;
   2320 		bcopy(&int_val, arg, val_size);
   2321 		break;
   2322 
   2323 	case IOV_SVAL(IOV_FORCEEVEN):
   2324 		forcealign = bool_val;
   2325 		break;
   2326 
   2327 	case IOV_GVAL(IOV_TXBOUND):
   2328 		int_val = (int32)dhd_txbound;
   2329 		bcopy(&int_val, arg, val_size);
   2330 		break;
   2331 
   2332 	case IOV_SVAL(IOV_TXBOUND):
   2333 		dhd_txbound = (uint)int_val;
   2334 		break;
   2335 
   2336 	case IOV_GVAL(IOV_RXBOUND):
   2337 		int_val = (int32)dhd_rxbound;
   2338 		bcopy(&int_val, arg, val_size);
   2339 		break;
   2340 
   2341 	case IOV_SVAL(IOV_RXBOUND):
   2342 		dhd_rxbound = (uint)int_val;
   2343 		break;
   2344 
   2345 	case IOV_GVAL(IOV_TXMINMAX):
   2346 		int_val = (int32)dhd_txminmax;
   2347 		bcopy(&int_val, arg, val_size);
   2348 		break;
   2349 
   2350 	case IOV_SVAL(IOV_TXMINMAX):
   2351 		dhd_txminmax = (uint)int_val;
   2352 		break;
   2353 
   2354 
   2355 
   2356 #endif /* DHD_DEBUG */
   2357 
   2358 
   2359 #ifdef SDTEST
   2360 	case IOV_GVAL(IOV_EXTLOOP):
   2361 		int_val = (int32)bus->ext_loop;
   2362 		bcopy(&int_val, arg, val_size);
   2363 		break;
   2364 
   2365 	case IOV_SVAL(IOV_EXTLOOP):
   2366 		bus->ext_loop = bool_val;
   2367 		break;
   2368 
   2369 	case IOV_GVAL(IOV_PKTGEN):
   2370 		bcmerror = dhdsdio_pktgen_get(bus, arg);
   2371 		break;
   2372 
   2373 	case IOV_SVAL(IOV_PKTGEN):
   2374 		bcmerror = dhdsdio_pktgen_set(bus, arg);
   2375 		break;
   2376 #endif /* SDTEST */
   2377 
   2378 
   2379 	case IOV_SVAL(IOV_DEVRESET):
   2380 		DHD_TRACE(("%s: Called set IOV_DEVRESET=%d dongle_reset=%d busstate=%d\n",
   2381 		           __FUNCTION__, bool_val, bus->dhd->dongle_reset,
   2382 		           bus->dhd->busstate));
   2383 
   2384 		ASSERT(bus->dhd->osh);
   2385 		/* ASSERT(bus->cl_devid); */
   2386 
   2387 		dhd_bus_devreset(bus->dhd, (uint8)bool_val);
   2388 
   2389 		break;
   2390 
   2391 	case IOV_GVAL(IOV_DEVRESET):
   2392 		DHD_TRACE(("%s: Called get IOV_DEVRESET\n", __FUNCTION__));
   2393 
   2394 		/* Get its status */
   2395 		int_val = (bool) bus->dhd->dongle_reset;
   2396 		bcopy(&int_val, arg, val_size);
   2397 
   2398 		break;
   2399 
   2400 	default:
   2401 		bcmerror = BCME_UNSUPPORTED;
   2402 		break;
   2403 	}
   2404 
   2405 exit:
   2406 	if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
   2407 		bus->activity = FALSE;
   2408 		dhdsdio_clkctl(bus, CLK_NONE, TRUE);
   2409 	}
   2410 
   2411 	dhd_os_sdunlock(bus->dhd);
   2412 
   2413 	if (actionid == IOV_SVAL(IOV_DEVRESET) && bool_val == FALSE)
   2414 		dhd_preinit_ioctls((dhd_pub_t *) bus->dhd);
   2415 
   2416 	return bcmerror;
   2417 }
   2418 
   2419 static int
   2420 dhdsdio_write_vars(dhd_bus_t *bus)
   2421 {
   2422 	int bcmerror = 0;
   2423 	uint32 varsize;
   2424 	uint32 varaddr;
   2425 	uint8 *vbuffer;
   2426 	uint32 varsizew;
   2427 #ifdef DHD_DEBUG
   2428 	char *nvram_ularray;
   2429 #endif /* DHD_DEBUG */
   2430 
   2431 	/* Even if there are no vars are to be written, we still need to set the ramsize. */
   2432 	varsize = bus->varsz ? ROUNDUP(bus->varsz, 4) : 0;
   2433 	varaddr = (bus->ramsize - 4) - varsize;
   2434 
   2435 	if (bus->vars) {
   2436 		vbuffer = (uint8 *)MALLOC(bus->dhd->osh, varsize);
   2437 		if (!vbuffer)
   2438 			return BCME_NOMEM;
   2439 
   2440 		bzero(vbuffer, varsize);
   2441 		bcopy(bus->vars, vbuffer, bus->varsz);
   2442 
   2443 		/* Write the vars list */
   2444 		bcmerror = dhdsdio_membytes(bus, TRUE, varaddr, vbuffer, varsize);
   2445 #ifdef DHD_DEBUG
   2446 		/* Verify NVRAM bytes */
   2447 		DHD_INFO(("Compare NVRAM dl & ul; varsize=%d\n", varsize));
   2448 		nvram_ularray = (char*)MALLOC(bus->dhd->osh, varsize);
   2449 		if (!nvram_ularray)
   2450 			return BCME_NOMEM;
   2451 
   2452 		/* Upload image to verify downloaded contents. */
   2453 		memset(nvram_ularray, 0xaa, varsize);
   2454 
   2455 		/* Read the vars list to temp buffer for comparison */
   2456 		bcmerror = dhdsdio_membytes(bus, FALSE, varaddr, nvram_ularray, varsize);
   2457 		if (bcmerror) {
   2458 				DHD_ERROR(("%s: error %d on reading %d nvram bytes at 0x%08x\n",
   2459 					__FUNCTION__, bcmerror, varsize, varaddr));
   2460 		}
   2461 		/* Compare the org NVRAM with the one read from RAM */
   2462 		if (memcmp(vbuffer, nvram_ularray, varsize)) {
   2463 			DHD_ERROR(("%s: Downloaded NVRAM image is corrupted.\n", __FUNCTION__));
   2464 		} else
   2465 			DHD_ERROR(("%s: Download, Upload and compare of NVRAM succeeded.\n",
   2466 			__FUNCTION__));
   2467 
   2468 		MFREE(bus->dhd->osh, nvram_ularray, varsize);
   2469 #endif /* DHD_DEBUG */
   2470 
   2471 		MFREE(bus->dhd->osh, vbuffer, varsize);
   2472 	}
   2473 
   2474 	/* adjust to the user specified RAM */
   2475 	DHD_INFO(("Physical memory size: %d, usable memory size: %d\n",
   2476 		bus->orig_ramsize, bus->ramsize));
   2477 	DHD_INFO(("Vars are at %d, orig varsize is %d\n",
   2478 		varaddr, varsize));
   2479 	varsize = ((bus->orig_ramsize - 4) - varaddr);
   2480 
   2481 	/*
   2482 	 * Determine the length token:
   2483 	 * Varsize, converted to words, in lower 16-bits, checksum in upper 16-bits.
   2484 	 */
   2485 	if (bcmerror) {
   2486 		varsizew = 0;
   2487 	} else {
   2488 		varsizew = varsize / 4;
   2489 		varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
   2490 		varsizew = htol32(varsizew);
   2491 	}
   2492 
   2493 	DHD_INFO(("New varsize is %d, length token=0x%08x\n", varsize, varsizew));
   2494 
   2495 	/* Write the length token to the last word */
   2496 	bcmerror = dhdsdio_membytes(bus, TRUE, (bus->orig_ramsize - 4),
   2497 		(uint8*)&varsizew, 4);
   2498 
   2499 	return bcmerror;
   2500 }
   2501 
   2502 static int
   2503 dhdsdio_download_state(dhd_bus_t *bus, bool enter)
   2504 {
   2505 	uint retries;
   2506 	int bcmerror = 0;
   2507 
   2508 	/* To enter download state, disable ARM and reset SOCRAM.
   2509 	 * To exit download state, simply reset ARM (default is RAM boot).
   2510 	 */
   2511 	if (enter) {
   2512 
   2513 		bus->alp_only = TRUE;
   2514 
   2515 		if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
   2516 		    !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
   2517 			DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
   2518 			bcmerror = BCME_ERROR;
   2519 			goto fail;
   2520 		}
   2521 
   2522 		si_core_disable(bus->sih, 0);
   2523 		if (bcmsdh_regfail(bus->sdh)) {
   2524 			bcmerror = BCME_SDIO_ERROR;
   2525 			goto fail;
   2526 		}
   2527 
   2528 		if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
   2529 			DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
   2530 			bcmerror = BCME_ERROR;
   2531 			goto fail;
   2532 		}
   2533 
   2534 		si_core_reset(bus->sih, 0, 0);
   2535 		if (bcmsdh_regfail(bus->sdh)) {
   2536 			DHD_ERROR(("%s: Failure trying reset SOCRAM core?\n", __FUNCTION__));
   2537 			bcmerror = BCME_SDIO_ERROR;
   2538 			goto fail;
   2539 		}
   2540 
   2541 		/* Clear the top bit of memory */
   2542 		if (bus->ramsize) {
   2543 			uint32 zeros = 0;
   2544 			dhdsdio_membytes(bus, TRUE, bus->ramsize - 4, (uint8*)&zeros, 4);
   2545 		}
   2546 	} else {
   2547 		if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
   2548 			DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
   2549 			bcmerror = BCME_ERROR;
   2550 			goto fail;
   2551 		}
   2552 
   2553 		if (!si_iscoreup(bus->sih)) {
   2554 			DHD_ERROR(("%s: SOCRAM core is down after reset?\n", __FUNCTION__));
   2555 			bcmerror = BCME_ERROR;
   2556 			goto fail;
   2557 		}
   2558 
   2559 		if ((bcmerror = dhdsdio_write_vars(bus))) {
   2560 			DHD_ERROR(("%s: no vars written to RAM\n", __FUNCTION__));
   2561 			bcmerror = 0;
   2562 		}
   2563 
   2564 		if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
   2565 		    !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
   2566 			DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
   2567 			bcmerror = BCME_ERROR;
   2568 			goto fail;
   2569 		}
   2570 		W_SDREG(0xFFFFFFFF, &bus->regs->intstatus, retries);
   2571 
   2572 
   2573 		if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
   2574 		    !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
   2575 			DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
   2576 			bcmerror = BCME_ERROR;
   2577 			goto fail;
   2578 		}
   2579 
   2580 		si_core_reset(bus->sih, 0, 0);
   2581 		if (bcmsdh_regfail(bus->sdh)) {
   2582 			DHD_ERROR(("%s: Failure trying to reset ARM core?\n", __FUNCTION__));
   2583 			bcmerror = BCME_SDIO_ERROR;
   2584 			goto fail;
   2585 		}
   2586 
   2587 		/* Allow HT Clock now that the ARM is running. */
   2588 		bus->alp_only = FALSE;
   2589 
   2590 		bus->dhd->busstate = DHD_BUS_LOAD;
   2591 	}
   2592 
   2593 fail:
   2594 	/* Always return to SDIOD core */
   2595 	if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0))
   2596 		si_setcore(bus->sih, SDIOD_CORE_ID, 0);
   2597 
   2598 	return bcmerror;
   2599 }
   2600 
   2601 int
   2602 dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
   2603                  void *params, int plen, void *arg, int len, bool set)
   2604 {
   2605 	dhd_bus_t *bus = dhdp->bus;
   2606 	const bcm_iovar_t *vi = NULL;
   2607 	int bcmerror = 0;
   2608 	int val_size;
   2609 	uint32 actionid;
   2610 
   2611 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   2612 
   2613 	ASSERT(name);
   2614 	ASSERT(len >= 0);
   2615 
   2616 	/* Get MUST have return space */
   2617 	ASSERT(set || (arg && len));
   2618 
   2619 	/* Set does NOT take qualifiers */
   2620 	ASSERT(!set || (!params && !plen));
   2621 
   2622 	/* Look up var locally; if not found pass to host driver */
   2623 	if ((vi = bcm_iovar_lookup(dhdsdio_iovars, name)) == NULL) {
   2624 		dhd_os_sdlock(bus->dhd);
   2625 
   2626 		BUS_WAKE(bus);
   2627 
   2628 		/* Turn on clock in case SD command needs backplane */
   2629 		dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
   2630 
   2631 		bcmerror = bcmsdh_iovar_op(bus->sdh, name, params, plen, arg, len, set);
   2632 
   2633 		/* Check for bus configuration changes of interest */
   2634 
   2635 		/* If it was divisor change, read the new one */
   2636 		if (set && strcmp(name, "sd_divisor") == 0) {
   2637 			if (bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
   2638 			                    &bus->sd_divisor, sizeof(int32), FALSE) != BCME_OK) {
   2639 				bus->sd_divisor = -1;
   2640 				DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
   2641 			} else {
   2642 				DHD_INFO(("%s: noted %s update, value now %d\n",
   2643 				          __FUNCTION__, name, bus->sd_divisor));
   2644 			}
   2645 		}
   2646 		/* If it was a mode change, read the new one */
   2647 		if (set && strcmp(name, "sd_mode") == 0) {
   2648 			if (bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
   2649 			                    &bus->sd_mode, sizeof(int32), FALSE) != BCME_OK) {
   2650 				bus->sd_mode = -1;
   2651 				DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
   2652 			} else {
   2653 				DHD_INFO(("%s: noted %s update, value now %d\n",
   2654 				          __FUNCTION__, name, bus->sd_mode));
   2655 			}
   2656 		}
   2657 		/* Similar check for blocksize change */
   2658 		if (set && strcmp(name, "sd_blocksize") == 0) {
   2659 			int32 fnum = 2;
   2660 			if (bcmsdh_iovar_op(bus->sdh, "sd_blocksize", &fnum, sizeof(int32),
   2661 			                    &bus->blocksize, sizeof(int32), FALSE) != BCME_OK) {
   2662 				bus->blocksize = 0;
   2663 				DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_blocksize"));
   2664 			} else {
   2665 				DHD_INFO(("%s: noted %s update, value now %d\n",
   2666 				          __FUNCTION__, "sd_blocksize", bus->blocksize));
   2667 			}
   2668 		}
   2669 		bus->roundup = MIN(max_roundup, bus->blocksize);
   2670 
   2671 		if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
   2672 			bus->activity = FALSE;
   2673 			dhdsdio_clkctl(bus, CLK_NONE, TRUE);
   2674 		}
   2675 
   2676 		dhd_os_sdunlock(bus->dhd);
   2677 		goto exit;
   2678 	}
   2679 
   2680 	DHD_CTL(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
   2681 	         name, (set ? "set" : "get"), len, plen));
   2682 
   2683 	/* set up 'params' pointer in case this is a set command so that
   2684 	 * the convenience int and bool code can be common to set and get
   2685 	 */
   2686 	if (params == NULL) {
   2687 		params = arg;
   2688 		plen = len;
   2689 	}
   2690 
   2691 	if (vi->type == IOVT_VOID)
   2692 		val_size = 0;
   2693 	else if (vi->type == IOVT_BUFFER)
   2694 		val_size = len;
   2695 	else
   2696 		/* all other types are integer sized */
   2697 		val_size = sizeof(int);
   2698 
   2699 	actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
   2700 	bcmerror = dhdsdio_doiovar(bus, vi, actionid, name, params, plen, arg, len, val_size);
   2701 
   2702 exit:
   2703 	return bcmerror;
   2704 }
   2705 
   2706 void
   2707 dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex)
   2708 {
   2709 	osl_t *osh = bus->dhd->osh;
   2710 	uint32 local_hostintmask;
   2711 	uint8 saveclk;
   2712 	uint retries;
   2713 	int err;
   2714 
   2715 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   2716 
   2717 	if (enforce_mutex)
   2718 		dhd_os_sdlock(bus->dhd);
   2719 
   2720 	BUS_WAKE(bus);
   2721 
   2722 	/* Enable clock for device interrupts */
   2723 	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
   2724 
   2725 	/* Disable and clear interrupts at the chip level also */
   2726 	W_SDREG(0, &bus->regs->hostintmask, retries);
   2727 	local_hostintmask = bus->hostintmask;
   2728 	bus->hostintmask = 0;
   2729 
   2730 	/* Change our idea of bus state */
   2731 	bus->dhd->busstate = DHD_BUS_DOWN;
   2732 
   2733 	/* Force clocks on backplane to be sure F2 interrupt propagates */
   2734 	saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
   2735 	if (!err) {
   2736 		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
   2737 		                 (saveclk | SBSDIO_FORCE_HT), &err);
   2738 	}
   2739 	if (err) {
   2740 		DHD_ERROR(("%s: Failed to force clock for F2: err %d\n", __FUNCTION__, err));
   2741 	}
   2742 
   2743 	/* Turn off the bus (F2), free any pending packets */
   2744 	DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
   2745 	bcmsdh_intr_disable(bus->sdh);
   2746 	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, SDIO_FUNC_ENABLE_1, NULL);
   2747 
   2748 	/* Clear any pending interrupts now that F2 is disabled */
   2749 	W_SDREG(local_hostintmask, &bus->regs->intstatus, retries);
   2750 
   2751 	/* Turn off the backplane clock (only) */
   2752 	dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
   2753 
   2754 	/* Clear the data packet queues */
   2755 	pktq_flush(osh, &bus->txq, TRUE);
   2756 
   2757 	/* Clear any held glomming stuff */
   2758 	if (bus->glomd)
   2759 		PKTFREE(osh, bus->glomd, FALSE);
   2760 
   2761 	if (bus->glom)
   2762 		PKTFREE(osh, bus->glom, FALSE);
   2763 
   2764 	bus->glom = bus->glomd = NULL;
   2765 
   2766 	/* Clear rx control and wake any waiters */
   2767 	bus->rxlen = 0;
   2768 	dhd_os_ioctl_resp_wake(bus->dhd);
   2769 
   2770 	/* Reset some F2 state stuff */
   2771 	bus->rxskip = FALSE;
   2772 	bus->tx_seq = bus->rx_seq = 0;
   2773 
   2774 	if (enforce_mutex)
   2775 		dhd_os_sdunlock(bus->dhd);
   2776 }
   2777 
   2778 int
   2779 dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex)
   2780 {
   2781 	dhd_bus_t *bus = dhdp->bus;
   2782 	dhd_timeout_t tmo;
   2783 	uint retries = 0;
   2784 	uint8 ready, enable;
   2785 	int err, ret = 0;
   2786 	uint8 saveclk;
   2787 
   2788 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   2789 
   2790 	ASSERT(bus->dhd);
   2791 	if (!bus->dhd)
   2792 		return 0;
   2793 
   2794 	if (enforce_mutex)
   2795 		dhd_os_sdlock(bus->dhd);
   2796 
   2797 	/* Make sure backplane clock is on, needed to generate F2 interrupt */
   2798 	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
   2799 	if (bus->clkstate != CLK_AVAIL)
   2800 		goto exit;
   2801 
   2802 
   2803 	/* Force clocks on backplane to be sure F2 interrupt propagates */
   2804 	saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
   2805 	if (!err) {
   2806 		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
   2807 		                 (saveclk | SBSDIO_FORCE_HT), &err);
   2808 	}
   2809 	if (err) {
   2810 		DHD_ERROR(("%s: Failed to force clock for F2: err %d\n", __FUNCTION__, err));
   2811 		goto exit;
   2812 	}
   2813 
   2814 	/* Enable function 2 (frame transfers) */
   2815 	W_SDREG((SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT),
   2816 	        &bus->regs->tosbmailboxdata, retries);
   2817 	enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
   2818 
   2819 	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
   2820 
   2821 	/* Give the dongle some time to do its thing and set IOR2 */
   2822 	dhd_timeout_start(&tmo, DHD_WAIT_F2RDY * 1000);
   2823 
   2824 	ready = 0;
   2825 	while (ready != enable && !dhd_timeout_expired(&tmo))
   2826 	        ready = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IORDY, NULL);
   2827 
   2828 
   2829 	DHD_INFO(("%s: enable 0x%02x, ready 0x%02x (waited %uus)\n",
   2830 	          __FUNCTION__, enable, ready, tmo.elapsed));
   2831 
   2832 
   2833 	/* If F2 successfully enabled, set core and enable interrupts */
   2834 	if (ready == enable) {
   2835 		/* Make sure we're talking to the core. */
   2836 		if (!(bus->regs = si_setcore(bus->sih, PCMCIA_CORE_ID, 0)))
   2837 			bus->regs = si_setcore(bus->sih, SDIOD_CORE_ID, 0);
   2838 
   2839 		/* Set up the interrupt mask and enable interrupts */
   2840 		bus->hostintmask = HOSTINTMASK;
   2841 		W_SDREG(bus->hostintmask, &bus->regs->hostintmask, retries);
   2842 
   2843 		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, (uint8)watermark, &err);
   2844 
   2845 		/* Set bus state according to enable result */
   2846 		dhdp->busstate = DHD_BUS_DATA;
   2847 
   2848 		/* bcmsdh_intr_unmask(bus->sdh); */
   2849 
   2850 		bus->intdis = FALSE;
   2851 		if (bus->intr) {
   2852 			DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
   2853 			bcmsdh_intr_enable(bus->sdh);
   2854 		} else {
   2855 			DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
   2856 			bcmsdh_intr_disable(bus->sdh);
   2857 		}
   2858 
   2859 	}
   2860 
   2861 
   2862 	else {
   2863 		/* Disable F2 again */
   2864 		enable = SDIO_FUNC_ENABLE_1;
   2865 		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
   2866 	}
   2867 
   2868 	/* Restore previous clock setting */
   2869 	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
   2870 
   2871 
   2872 	/* If we didn't come up, turn off backplane clock */
   2873 	if (dhdp->busstate != DHD_BUS_DATA)
   2874 		dhdsdio_clkctl(bus, CLK_NONE, FALSE);
   2875 
   2876 exit:
   2877 	if (enforce_mutex)
   2878 		dhd_os_sdunlock(bus->dhd);
   2879 
   2880 	return ret;
   2881 }
   2882 
   2883 static void
   2884 dhdsdio_rxfail(dhd_bus_t *bus, bool abort, bool rtx)
   2885 {
   2886 	bcmsdh_info_t *sdh = bus->sdh;
   2887 	sdpcmd_regs_t *regs = bus->regs;
   2888 	uint retries = 0;
   2889 	uint16 lastrbc;
   2890 	uint8 hi, lo;
   2891 	int err;
   2892 
   2893 	DHD_ERROR(("%s: %sterminate frame%s\n", __FUNCTION__,
   2894 	           (abort ? "abort command, " : ""), (rtx ? ", send NAK" : "")));
   2895 
   2896 	if (abort) {
   2897 		bcmsdh_abort(sdh, SDIO_FUNC_2);
   2898 	}
   2899 
   2900 	bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM, &err);
   2901 	bus->f1regdata++;
   2902 
   2903 	/* Wait until the packet has been flushed (device/FIFO stable) */
   2904 	for (lastrbc = retries = 0xffff; retries > 0; retries--) {
   2905 		hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCHI, NULL);
   2906 		lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCLO, NULL);
   2907 		bus->f1regdata += 2;
   2908 
   2909 		if ((hi == 0) && (lo == 0))
   2910 			break;
   2911 
   2912 		if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
   2913 			DHD_ERROR(("%s: count growing: last 0x%04x now 0x%04x\n",
   2914 			           __FUNCTION__, lastrbc, ((hi << 8) + lo)));
   2915 		}
   2916 		lastrbc = (hi << 8) + lo;
   2917 	}
   2918 
   2919 	if (!retries) {
   2920 		DHD_ERROR(("%s: count never zeroed: last 0x%04x\n", __FUNCTION__, lastrbc));
   2921 	} else {
   2922 		DHD_INFO(("%s: flush took %d iterations\n", __FUNCTION__, (0xffff - retries)));
   2923 	}
   2924 
   2925 	if (rtx) {
   2926 		bus->rxrtx++;
   2927 		W_SDREG(SMB_NAK, &regs->tosbmailbox, retries);
   2928 		bus->f1regdata++;
   2929 		if (retries <= retry_limit) {
   2930 			bus->rxskip = TRUE;
   2931 		}
   2932 	}
   2933 
   2934 	/* Clear partial in any case */
   2935 	bus->nextlen = 0;
   2936 
   2937 	/* If we can't reach the device, signal failure */
   2938 	if (err || bcmsdh_regfail(sdh))
   2939 		bus->dhd->busstate = DHD_BUS_DOWN;
   2940 }
   2941 
   2942 static void
   2943 dhdsdio_read_control(dhd_bus_t *bus, uint8 *hdr, uint len, uint doff)
   2944 {
   2945 	bcmsdh_info_t *sdh = bus->sdh;
   2946 	uint rdlen, pad;
   2947 
   2948 	int sdret;
   2949 
   2950 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   2951 
   2952 	/* Control data already received in aligned rxctl */
   2953 	if ((bus->bus == SPI_BUS) && (!bus->usebufpool))
   2954 		goto gotpkt;
   2955 
   2956 	ASSERT(bus->rxbuf);
   2957 	/* Set rxctl for frame (w/optional alignment) */
   2958 	bus->rxctl = bus->rxbuf;
   2959 	if (dhd_alignctl) {
   2960 		bus->rxctl += firstread;
   2961 		if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
   2962 			bus->rxctl += (DHD_SDALIGN - pad);
   2963 		bus->rxctl -= firstread;
   2964 	}
   2965 	ASSERT(bus->rxctl >= bus->rxbuf);
   2966 
   2967 	/* Copy the already-read portion over */
   2968 	bcopy(hdr, bus->rxctl, firstread);
   2969 	if (len <= firstread)
   2970 		goto gotpkt;
   2971 
   2972 	/* Copy the full data pkt in gSPI case and process ioctl. */
   2973 	if (bus->bus == SPI_BUS) {
   2974 		bcopy(hdr, bus->rxctl, len);
   2975 		goto gotpkt;
   2976 	}
   2977 
   2978 	/* Raise rdlen to next SDIO block to avoid tail command */
   2979 	rdlen = len - firstread;
   2980 	if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
   2981 		pad = bus->blocksize - (rdlen % bus->blocksize);
   2982 		if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
   2983 		    ((len + pad) < bus->dhd->maxctl))
   2984 			rdlen += pad;
   2985 	} else if (rdlen % DHD_SDALIGN) {
   2986 		rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
   2987 	}
   2988 
   2989 	/* Satisfy length-alignment requirements */
   2990 	if (forcealign && (rdlen & (ALIGNMENT - 1)))
   2991 		rdlen = ROUNDUP(rdlen, ALIGNMENT);
   2992 
   2993 	/* Drop if the read is too big or it exceeds our maximum */
   2994 	if ((rdlen + firstread) > bus->dhd->maxctl) {
   2995 		DHD_ERROR(("%s: %d-byte control read exceeds %d-byte buffer\n",
   2996 		           __FUNCTION__, rdlen, bus->dhd->maxctl));
   2997 		bus->dhd->rx_errors++;
   2998 		dhdsdio_rxfail(bus, FALSE, FALSE);
   2999 		goto done;
   3000 	}
   3001 
   3002 	if ((len - doff) > bus->dhd->maxctl) {
   3003 		DHD_ERROR(("%s: %d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
   3004 		           __FUNCTION__, len, (len - doff), bus->dhd->maxctl));
   3005 		bus->dhd->rx_errors++; bus->rx_toolong++;
   3006 		dhdsdio_rxfail(bus, FALSE, FALSE);
   3007 		goto done;
   3008 	}
   3009 
   3010 
   3011 	/* Read remainder of frame body into the rxctl buffer */
   3012 	sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
   3013 	                            (bus->rxctl + firstread), rdlen, NULL, NULL, NULL);
   3014 	bus->f2rxdata++;
   3015 	ASSERT(sdret != BCME_PENDING);
   3016 
   3017 	/* Control frame failures need retransmission */
   3018 	if (sdret < 0) {
   3019 		DHD_ERROR(("%s: read %d control bytes failed: %d\n", __FUNCTION__, rdlen, sdret));
   3020 		bus->rxc_errors++; /* dhd.rx_ctlerrs is higher level */
   3021 		dhdsdio_rxfail(bus, TRUE, TRUE);
   3022 		goto done;
   3023 	}
   3024 
   3025 gotpkt:
   3026 
   3027 #ifdef DHD_DEBUG
   3028 	if (DHD_BYTES_ON() && DHD_CTL_ON()) {
   3029 		prhex("RxCtrl", bus->rxctl, len);
   3030 	}
   3031 #endif
   3032 
   3033 	/* Point to valid data and indicate its length */
   3034 	bus->rxctl += doff;
   3035 	bus->rxlen = len - doff;
   3036 
   3037 done:
   3038 	/* Awake any waiters */
   3039 	dhd_os_ioctl_resp_wake(bus->dhd);
   3040 }
   3041 
   3042 static uint8
   3043 dhdsdio_rxglom(dhd_bus_t *bus, uint8 rxseq)
   3044 {
   3045 	uint16 dlen, totlen;
   3046 	uint8 *dptr, num = 0;
   3047 
   3048 	uint16 sublen, check;
   3049 	void *pfirst, *plast, *pnext, *save_pfirst;
   3050 	osl_t *osh = bus->dhd->osh;
   3051 
   3052 	int errcode;
   3053 	uint8 chan, seq, doff, sfdoff;
   3054 	uint8 txmax;
   3055 
   3056 	int ifidx = 0;
   3057 	bool usechain = bus->use_rxchain;
   3058 
   3059 	/* If packets, issue read(s) and send up packet chain */
   3060 	/* Return sequence numbers consumed? */
   3061 
   3062 	DHD_TRACE(("dhdsdio_rxglom: start: glomd %p glom %p\n", bus->glomd, bus->glom));
   3063 
   3064 	/* If there's a descriptor, generate the packet chain */
   3065 	if (bus->glomd) {
   3066 		dhd_os_sdlock_rxq(bus->dhd);
   3067 
   3068 		pfirst = plast = pnext = NULL;
   3069 		dlen = (uint16)PKTLEN(osh, bus->glomd);
   3070 		dptr = PKTDATA(osh, bus->glomd);
   3071 		if (!dlen || (dlen & 1)) {
   3072 			DHD_ERROR(("%s: bad glomd len (%d), ignore descriptor\n",
   3073 			           __FUNCTION__, dlen));
   3074 			dlen = 0;
   3075 		}
   3076 
   3077 		for (totlen = num = 0; dlen; num++) {
   3078 			/* Get (and move past) next length */
   3079 			sublen = ltoh16_ua(dptr);
   3080 			dlen -= sizeof(uint16);
   3081 			dptr += sizeof(uint16);
   3082 			if ((sublen < SDPCM_HDRLEN) ||
   3083 			    ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
   3084 				DHD_ERROR(("%s: descriptor len %d bad: %d\n",
   3085 				           __FUNCTION__, num, sublen));
   3086 				pnext = NULL;
   3087 				break;
   3088 			}
   3089 			if (sublen % DHD_SDALIGN) {
   3090 				DHD_ERROR(("%s: sublen %d not a multiple of %d\n",
   3091 				           __FUNCTION__, sublen, DHD_SDALIGN));
   3092 				usechain = FALSE;
   3093 			}
   3094 			totlen += sublen;
   3095 
   3096 			/* For last frame, adjust read len so total is a block multiple */
   3097 			if (!dlen) {
   3098 				sublen += (ROUNDUP(totlen, bus->blocksize) - totlen);
   3099 				totlen = ROUNDUP(totlen, bus->blocksize);
   3100 			}
   3101 
   3102 			/* Allocate/chain packet for next subframe */
   3103 			if ((pnext = PKTGET(osh, sublen + DHD_SDALIGN, FALSE)) == NULL) {
   3104 				DHD_ERROR(("%s: PKTGET failed, num %d len %d\n",
   3105 				           __FUNCTION__, num, sublen));
   3106 				break;
   3107 			}
   3108 			ASSERT(!PKTLINK(pnext));
   3109 			if (!pfirst) {
   3110 				ASSERT(!plast);
   3111 				pfirst = plast = pnext;
   3112 			} else {
   3113 				ASSERT(plast);
   3114 				PKTSETNEXT(osh, plast, pnext);
   3115 				plast = pnext;
   3116 			}
   3117 
   3118 			/* Adhere to start alignment requirements */
   3119 			PKTALIGN(osh, pnext, sublen, DHD_SDALIGN);
   3120 		}
   3121 
   3122 		/* If all allocations succeeded, save packet chain in bus structure */
   3123 		if (pnext) {
   3124 			DHD_GLOM(("%s: allocated %d-byte packet chain for %d subframes\n",
   3125 			          __FUNCTION__, totlen, num));
   3126 			if (DHD_GLOM_ON() && bus->nextlen) {
   3127 				if (totlen != bus->nextlen) {
   3128 					DHD_GLOM(("%s: glomdesc mismatch: nextlen %d glomdesc %d "
   3129 					          "rxseq %d\n", __FUNCTION__, bus->nextlen,
   3130 					          totlen, rxseq));
   3131 				}
   3132 			}
   3133 			bus->glom = pfirst;
   3134 			pfirst = pnext = NULL;
   3135 		} else {
   3136 			if (pfirst)
   3137 				PKTFREE(osh, pfirst, FALSE);
   3138 			bus->glom = NULL;
   3139 			num = 0;
   3140 		}
   3141 
   3142 		/* Done with descriptor packet */
   3143 		PKTFREE(osh, bus->glomd, FALSE);
   3144 		bus->glomd = NULL;
   3145 		bus->nextlen = 0;
   3146 
   3147 		dhd_os_sdunlock_rxq(bus->dhd);
   3148 	}
   3149 
   3150 	/* Ok -- either we just generated a packet chain, or had one from before */
   3151 	if (bus->glom) {
   3152 		if (DHD_GLOM_ON()) {
   3153 			DHD_GLOM(("%s: attempt superframe read, packet chain:\n", __FUNCTION__));
   3154 			for (pnext = bus->glom; pnext; pnext = PKTNEXT(osh, pnext)) {
   3155 				DHD_GLOM(("    %p: %p len 0x%04x (%d)\n",
   3156 				          pnext, (uint8*)PKTDATA(osh, pnext),
   3157 				          PKTLEN(osh, pnext), PKTLEN(osh, pnext)));
   3158 			}
   3159 		}
   3160 
   3161 		pfirst = bus->glom;
   3162 		dlen = (uint16)pkttotlen(osh, pfirst);
   3163 
   3164 		/* Do an SDIO read for the superframe.  Configurable iovar to
   3165 		 * read directly into the chained packet, or allocate a large
   3166 		 * packet and and copy into the chain.
   3167 		 */
   3168 		if (usechain) {
   3169 			errcode = dhd_bcmsdh_recv_buf(bus,
   3170 			                              bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
   3171 			                              F2SYNC, (uint8*)PKTDATA(osh, pfirst),
   3172 			                              dlen, pfirst, NULL, NULL);
   3173 		} else if (bus->dataptr) {
   3174 			errcode = dhd_bcmsdh_recv_buf(bus,
   3175 			                              bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
   3176 			                              F2SYNC, bus->dataptr,
   3177 			                              dlen, NULL, NULL, NULL);
   3178 			sublen = (uint16)pktfrombuf(osh, pfirst, 0, dlen, bus->dataptr);
   3179 			if (sublen != dlen) {
   3180 				DHD_ERROR(("%s: FAILED TO COPY, dlen %d sublen %d\n",
   3181 				           __FUNCTION__, dlen, sublen));
   3182 				errcode = -1;
   3183 			}
   3184 			pnext = NULL;
   3185 		} else {
   3186 			DHD_ERROR(("COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n", dlen));
   3187 			errcode = -1;
   3188 		}
   3189 		bus->f2rxdata++;
   3190 		ASSERT(errcode != BCME_PENDING);
   3191 
   3192 		/* On failure, kill the superframe, allow a couple retries */
   3193 		if (errcode < 0) {
   3194 			DHD_ERROR(("%s: glom read of %d bytes failed: %d\n",
   3195 			           __FUNCTION__, dlen, errcode));
   3196 			bus->dhd->rx_errors++;
   3197 
   3198 			if (bus->glomerr++ < 3) {
   3199 				dhdsdio_rxfail(bus, TRUE, TRUE);
   3200 			} else {
   3201 				bus->glomerr = 0;
   3202 				dhdsdio_rxfail(bus, TRUE, FALSE);
   3203 				dhd_os_sdlock_rxq(bus->dhd);
   3204 				PKTFREE(osh, bus->glom, FALSE);
   3205 				dhd_os_sdunlock_rxq(bus->dhd);
   3206 				bus->rxglomfail++;
   3207 				bus->glom = NULL;
   3208 			}
   3209 			return 0;
   3210 		}
   3211 
   3212 #ifdef DHD_DEBUG
   3213 		if (DHD_GLOM_ON()) {
   3214 			prhex("SUPERFRAME", PKTDATA(osh, pfirst),
   3215 			      MIN(PKTLEN(osh, pfirst), 48));
   3216 		}
   3217 #endif
   3218 
   3219 
   3220 		/* Validate the superframe header */
   3221 		dptr = (uint8 *)PKTDATA(osh, pfirst);
   3222 		sublen = ltoh16_ua(dptr);
   3223 		check = ltoh16_ua(dptr + sizeof(uint16));
   3224 
   3225 		chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
   3226 		seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
   3227 		bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
   3228 		if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
   3229 			DHD_INFO(("%s: got frame w/nextlen too large (%d) seq %d\n",
   3230 			          __FUNCTION__, bus->nextlen, seq));
   3231 			bus->nextlen = 0;
   3232 		}
   3233 		doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
   3234 		txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
   3235 
   3236 		errcode = 0;
   3237 		if ((uint16)~(sublen^check)) {
   3238 			DHD_ERROR(("%s (superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
   3239 			           __FUNCTION__, sublen, check));
   3240 			errcode = -1;
   3241 		} else if (ROUNDUP(sublen, bus->blocksize) != dlen) {
   3242 			DHD_ERROR(("%s (superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
   3243 			           __FUNCTION__, sublen, ROUNDUP(sublen, bus->blocksize), dlen));
   3244 			errcode = -1;
   3245 		} else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) != SDPCM_GLOM_CHANNEL) {
   3246 			DHD_ERROR(("%s (superframe): bad channel %d\n", __FUNCTION__,
   3247 			           SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN])));
   3248 			errcode = -1;
   3249 		} else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
   3250 			DHD_ERROR(("%s (superframe): got second descriptor?\n", __FUNCTION__));
   3251 			errcode = -1;
   3252 		} else if ((doff < SDPCM_HDRLEN) ||
   3253 		           (doff > (PKTLEN(osh, pfirst) - SDPCM_HDRLEN))) {
   3254 			DHD_ERROR(("%s (superframe): Bad data offset %d: HW %d pkt %d min %d\n",
   3255 			           __FUNCTION__, doff, sublen, PKTLEN(osh, pfirst), SDPCM_HDRLEN));
   3256 			errcode = -1;
   3257 		}
   3258 
   3259 		/* Check sequence number of superframe SW header */
   3260 		if (rxseq != seq) {
   3261 			DHD_INFO(("%s: (superframe) rx_seq %d, expected %d\n",
   3262 			          __FUNCTION__, seq, rxseq));
   3263 			bus->rx_badseq++;
   3264 			rxseq = seq;
   3265 		}
   3266 
   3267 		/* Check window for sanity */
   3268 		if ((uint8)(txmax - bus->tx_seq) > 0x40) {
   3269 			DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
   3270 			           __FUNCTION__, txmax, bus->tx_seq));
   3271 			txmax = bus->tx_seq + 2;
   3272 		}
   3273 		bus->tx_max = txmax;
   3274 
   3275 		/* Remove superframe header, remember offset */
   3276 		PKTPULL(osh, pfirst, doff);
   3277 		sfdoff = doff;
   3278 
   3279 		/* Validate all the subframe headers */
   3280 		for (num = 0, pnext = pfirst; pnext && !errcode;
   3281 		     num++, pnext = PKTNEXT(osh, pnext)) {
   3282 			dptr = (uint8 *)PKTDATA(osh, pnext);
   3283 			dlen = (uint16)PKTLEN(osh, pnext);
   3284 			sublen = ltoh16_ua(dptr);
   3285 			check = ltoh16_ua(dptr + sizeof(uint16));
   3286 			chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
   3287 			doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
   3288 #ifdef DHD_DEBUG
   3289 			if (DHD_GLOM_ON()) {
   3290 				prhex("subframe", dptr, 32);
   3291 			}
   3292 #endif
   3293 
   3294 			if ((uint16)~(sublen^check)) {
   3295 				DHD_ERROR(("%s (subframe %d): HW hdr error: "
   3296 				           "len/check 0x%04x/0x%04x\n",
   3297 				           __FUNCTION__, num, sublen, check));
   3298 				errcode = -1;
   3299 			} else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
   3300 				DHD_ERROR(("%s (subframe %d): length mismatch: "
   3301 				           "len 0x%04x, expect 0x%04x\n",
   3302 				           __FUNCTION__, num, sublen, dlen));
   3303 				errcode = -1;
   3304 			} else if ((chan != SDPCM_DATA_CHANNEL) &&
   3305 			           (chan != SDPCM_EVENT_CHANNEL)) {
   3306 				DHD_ERROR(("%s (subframe %d): bad channel %d\n",
   3307 				           __FUNCTION__, num, chan));
   3308 				errcode = -1;
   3309 			} else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
   3310 				DHD_ERROR(("%s (subframe %d): Bad data offset %d: HW %d min %d\n",
   3311 				           __FUNCTION__, num, doff, sublen, SDPCM_HDRLEN));
   3312 				errcode = -1;
   3313 			}
   3314 		}
   3315 
   3316 		if (errcode) {
   3317 			/* Terminate frame on error, request a couple retries */
   3318 			if (bus->glomerr++ < 3) {
   3319 				/* Restore superframe header space */
   3320 				PKTPUSH(osh, pfirst, sfdoff);
   3321 				dhdsdio_rxfail(bus, TRUE, TRUE);
   3322 			} else {
   3323 				bus->glomerr = 0;
   3324 				dhdsdio_rxfail(bus, TRUE, FALSE);
   3325 				dhd_os_sdlock_rxq(bus->dhd);
   3326 				PKTFREE(osh, bus->glom, FALSE);
   3327 				dhd_os_sdunlock_rxq(bus->dhd);
   3328 				bus->rxglomfail++;
   3329 				bus->glom = NULL;
   3330 			}
   3331 			bus->nextlen = 0;
   3332 			return 0;
   3333 		}
   3334 
   3335 		/* Basic SD framing looks ok - process each packet (header) */
   3336 		save_pfirst = pfirst;
   3337 		bus->glom = NULL;
   3338 		plast = NULL;
   3339 
   3340 		dhd_os_sdlock_rxq(bus->dhd);
   3341 		for (num = 0; pfirst; rxseq++, pfirst = pnext) {
   3342 			pnext = PKTNEXT(osh, pfirst);
   3343 			PKTSETNEXT(osh, pfirst, NULL);
   3344 
   3345 			dptr = (uint8 *)PKTDATA(osh, pfirst);
   3346 			sublen = ltoh16_ua(dptr);
   3347 			chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
   3348 			seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
   3349 			doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
   3350 
   3351 			DHD_GLOM(("%s: Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
   3352 			          __FUNCTION__, num, pfirst, PKTDATA(osh, pfirst),
   3353 			          PKTLEN(osh, pfirst), sublen, chan, seq));
   3354 
   3355 			ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL));
   3356 
   3357 			if (rxseq != seq) {
   3358 				DHD_GLOM(("%s: rx_seq %d, expected %d\n",
   3359 				          __FUNCTION__, seq, rxseq));
   3360 				bus->rx_badseq++;
   3361 				rxseq = seq;
   3362 			}
   3363 
   3364 #ifdef DHD_DEBUG
   3365 			if (DHD_BYTES_ON() && DHD_DATA_ON()) {
   3366 				prhex("Rx Subframe Data", dptr, dlen);
   3367 			}
   3368 #endif
   3369 
   3370 			PKTSETLEN(osh, pfirst, sublen);
   3371 			PKTPULL(osh, pfirst, doff);
   3372 
   3373 			if (PKTLEN(osh, pfirst) == 0) {
   3374 				PKTFREE(bus->dhd->osh, pfirst, FALSE);
   3375 				if (plast) {
   3376 					PKTSETNEXT(osh, plast, pnext);
   3377 				} else {
   3378 					ASSERT(save_pfirst == pfirst);
   3379 					save_pfirst = pnext;
   3380 				}
   3381 				continue;
   3382 			} else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pfirst) != 0) {
   3383 				DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
   3384 				bus->dhd->rx_errors++;
   3385 				PKTFREE(osh, pfirst, FALSE);
   3386 				if (plast) {
   3387 					PKTSETNEXT(osh, plast, pnext);
   3388 				} else {
   3389 					ASSERT(save_pfirst == pfirst);
   3390 					save_pfirst = pnext;
   3391 				}
   3392 				continue;
   3393 			}
   3394 
   3395 			/* this packet will go up, link back into chain and count it */
   3396 			PKTSETNEXT(osh, pfirst, pnext);
   3397 			plast = pfirst;
   3398 			num++;
   3399 
   3400 #ifdef DHD_DEBUG
   3401 			if (DHD_GLOM_ON()) {
   3402 				DHD_GLOM(("%s subframe %d to stack, %p(%p/%d) nxt/lnk %p/%p\n",
   3403 				          __FUNCTION__, num, pfirst,
   3404 				          PKTDATA(osh, pfirst), PKTLEN(osh, pfirst),
   3405 				          PKTNEXT(osh, pfirst), PKTLINK(pfirst)));
   3406 				prhex("", (uint8 *)PKTDATA(osh, pfirst),
   3407 				      MIN(PKTLEN(osh, pfirst), 32));
   3408 			}
   3409 #endif /* DHD_DEBUG */
   3410 		}
   3411 		dhd_os_sdunlock_rxq(bus->dhd);
   3412 		if (num) {
   3413 			dhd_os_sdunlock(bus->dhd);
   3414 			dhd_rx_frame(bus->dhd, ifidx, save_pfirst, num);
   3415 			dhd_os_sdlock(bus->dhd);
   3416 		}
   3417 
   3418 		bus->rxglomframes++;
   3419 		bus->rxglompkts += num;
   3420 	}
   3421 	return num;
   3422 }
   3423 
   3424 /* Return TRUE if there may be more frames to read */
   3425 static uint
   3426 dhdsdio_readframes(dhd_bus_t *bus, uint maxframes, bool *finished)
   3427 {
   3428 	osl_t *osh = bus->dhd->osh;
   3429 	bcmsdh_info_t *sdh = bus->sdh;
   3430 
   3431 	uint16 len, check;	/* Extracted hardware header fields */
   3432 	uint8 chan, seq, doff;	/* Extracted software header fields */
   3433 	uint8 fcbits;		/* Extracted fcbits from software header */
   3434 	uint8 delta;
   3435 
   3436 	void *pkt;	/* Packet for event or data frames */
   3437 	uint16 pad;	/* Number of pad bytes to read */
   3438 	uint16 rdlen;	/* Total number of bytes to read */
   3439 	uint8 rxseq;	/* Next sequence number to expect */
   3440 	uint rxleft = 0;	/* Remaining number of frames allowed */
   3441 	int sdret;	/* Return code from bcmsdh calls */
   3442 	uint8 txmax;	/* Maximum tx sequence offered */
   3443 	bool len_consistent; /* Result of comparing readahead len and len from hw-hdr */
   3444 	uint8 *rxbuf;
   3445 	int ifidx = 0;
   3446 	uint rxcount = 0; /* Total frames read */
   3447 
   3448 #if defined(DHD_DEBUG) || defined(SDTEST)
   3449 	bool sdtest = FALSE;	/* To limit message spew from test mode */
   3450 #endif
   3451 
   3452 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   3453 
   3454 	ASSERT(maxframes);
   3455 
   3456 #ifdef SDTEST
   3457 	/* Allow pktgen to override maxframes */
   3458 	if (bus->pktgen_count && (bus->pktgen_mode == DHD_PKTGEN_RECV)) {
   3459 		maxframes = bus->pktgen_count;
   3460 		sdtest = TRUE;
   3461 	}
   3462 #endif
   3463 
   3464 	/* Not finished unless we encounter no more frames indication */
   3465 	*finished = FALSE;
   3466 
   3467 
   3468 	for (rxseq = bus->rx_seq, rxleft = maxframes;
   3469 	     !bus->rxskip && rxleft && bus->dhd->busstate != DHD_BUS_DOWN;
   3470 	     rxseq++, rxleft--) {
   3471 
   3472 		/* Handle glomming separately */
   3473 		if (bus->glom || bus->glomd) {
   3474 			uint8 cnt;
   3475 			DHD_GLOM(("%s: calling rxglom: glomd %p, glom %p\n",
   3476 			          __FUNCTION__, bus->glomd, bus->glom));
   3477 			cnt = dhdsdio_rxglom(bus, rxseq);
   3478 			DHD_GLOM(("%s: rxglom returned %d\n", __FUNCTION__, cnt));
   3479 			rxseq += cnt - 1;
   3480 			rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
   3481 			continue;
   3482 		}
   3483 
   3484 		/* Try doing single read if we can */
   3485 		if (dhd_readahead && bus->nextlen) {
   3486 			uint16 nextlen = bus->nextlen;
   3487 			bus->nextlen = 0;
   3488 
   3489 			if (bus->bus == SPI_BUS) {
   3490 				rdlen = len = nextlen;
   3491 			}
   3492 			else {
   3493 				rdlen = len = nextlen << 4;
   3494 
   3495 				/* Pad read to blocksize for efficiency */
   3496 				if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
   3497 					pad = bus->blocksize - (rdlen % bus->blocksize);
   3498 					if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
   3499 						((rdlen + pad + firstread) < MAX_RX_DATASZ))
   3500 						rdlen += pad;
   3501 				} else if (rdlen % DHD_SDALIGN) {
   3502 					rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
   3503 				}
   3504 			}
   3505 
   3506 			/* We use bus->rxctl buffer in WinXP for initial control pkt receives.
   3507 			 * Later we use buffer-poll for data as well as control packets.
   3508 			 * This is required becuase dhd receives full frame in gSPI unlike SDIO.
   3509 			 * After the frame is received we have to distinguish whether it is data
   3510 			 * or non-data frame.
   3511 			 */
   3512 			/* Allocate a packet buffer */
   3513 			dhd_os_sdlock_rxq(bus->dhd);
   3514 			if (!(pkt = PKTGET(osh, rdlen + DHD_SDALIGN, FALSE))) {
   3515 				if (bus->bus == SPI_BUS) {
   3516 					bus->usebufpool = FALSE;
   3517 					bus->rxctl = bus->rxbuf;
   3518 					if (dhd_alignctl) {
   3519 						bus->rxctl += firstread;
   3520 						if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
   3521 							bus->rxctl += (DHD_SDALIGN - pad);
   3522 						bus->rxctl -= firstread;
   3523 					}
   3524 					ASSERT(bus->rxctl >= bus->rxbuf);
   3525 					rxbuf = bus->rxctl;
   3526 					/* Read the entire frame */
   3527 					sdret = dhd_bcmsdh_recv_buf(bus,
   3528 					                            bcmsdh_cur_sbwad(sdh),
   3529 					                            SDIO_FUNC_2,
   3530 					                            F2SYNC, rxbuf, rdlen,
   3531 					                            NULL, NULL, NULL);
   3532 					bus->f2rxdata++;
   3533 					ASSERT(sdret != BCME_PENDING);
   3534 
   3535 
   3536 					/* Control frame failures need retransmission */
   3537 					if (sdret < 0) {
   3538 						DHD_ERROR(("%s: read %d control bytes failed: %d\n",
   3539 						   __FUNCTION__, rdlen, sdret));
   3540 						/* dhd.rx_ctlerrs is higher level */
   3541 						bus->rxc_errors++;
   3542 						dhd_os_sdunlock_rxq(bus->dhd);
   3543 						dhdsdio_rxfail(bus, TRUE,
   3544 						    (bus->bus == SPI_BUS) ? FALSE : TRUE);
   3545 						continue;
   3546 					}
   3547 				} else {
   3548 					/* Give up on data, request rtx of events */
   3549 					DHD_ERROR(("%s (nextlen): PKTGET failed: len %d rdlen %d "
   3550 					           "expected rxseq %d\n",
   3551 					           __FUNCTION__, len, rdlen, rxseq));
   3552 					/* Just go try again w/normal header read */
   3553 					dhd_os_sdunlock_rxq(bus->dhd);
   3554 					continue;
   3555 				}
   3556 			} else {
   3557 				if (bus->bus == SPI_BUS)
   3558 					bus->usebufpool = TRUE;
   3559 
   3560 				ASSERT(!PKTLINK(pkt));
   3561 				PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
   3562 				rxbuf = (uint8 *)PKTDATA(osh, pkt);
   3563 				/* Read the entire frame */
   3564 				sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh),
   3565 				                            SDIO_FUNC_2,
   3566 				                            F2SYNC, rxbuf, rdlen,
   3567 				                            pkt, NULL, NULL);
   3568 				bus->f2rxdata++;
   3569 				ASSERT(sdret != BCME_PENDING);
   3570 
   3571 				if (sdret < 0) {
   3572 					DHD_ERROR(("%s (nextlen): read %d bytes failed: %d\n",
   3573 					   __FUNCTION__, rdlen, sdret));
   3574 					PKTFREE(bus->dhd->osh, pkt, FALSE);
   3575 					bus->dhd->rx_errors++;
   3576 					dhd_os_sdunlock_rxq(bus->dhd);
   3577 					/* Force retry w/normal header read.  Don't attemp NAK for
   3578 					 * gSPI
   3579 					 */
   3580 					dhdsdio_rxfail(bus, TRUE,
   3581 					      (bus->bus == SPI_BUS) ? FALSE : TRUE);
   3582 					continue;
   3583 				}
   3584 			}
   3585 			dhd_os_sdunlock_rxq(bus->dhd);
   3586 
   3587 			/* Now check the header */
   3588 			bcopy(rxbuf, bus->rxhdr, SDPCM_HDRLEN);
   3589 
   3590 			/* Extract hardware header fields */
   3591 			len = ltoh16_ua(bus->rxhdr);
   3592 			check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
   3593 
   3594 			/* All zeros means readahead info was bad */
   3595 			if (!(len|check)) {
   3596 				DHD_INFO(("%s (nextlen): read zeros in HW header???\n",
   3597 				           __FUNCTION__));
   3598 				dhd_os_sdlock_rxq(bus->dhd);
   3599 				PKTFREE2();
   3600 				dhd_os_sdunlock_rxq(bus->dhd);
   3601 				GSPI_PR55150_BAILOUT;
   3602 				continue;
   3603 			}
   3604 
   3605 			/* Validate check bytes */
   3606 			if ((uint16)~(len^check)) {
   3607 				DHD_ERROR(("%s (nextlen): HW hdr error: nextlen/len/check"
   3608 				           " 0x%04x/0x%04x/0x%04x\n", __FUNCTION__, nextlen,
   3609 				           len, check));
   3610 				dhd_os_sdlock_rxq(bus->dhd);
   3611 				PKTFREE2();
   3612 				dhd_os_sdunlock_rxq(bus->dhd);
   3613 				bus->rx_badhdr++;
   3614 				dhdsdio_rxfail(bus, FALSE, FALSE);
   3615 				GSPI_PR55150_BAILOUT;
   3616 				continue;
   3617 			}
   3618 
   3619 			/* Validate frame length */
   3620 			if (len < SDPCM_HDRLEN) {
   3621 				DHD_ERROR(("%s (nextlen): HW hdr length invalid: %d\n",
   3622 				           __FUNCTION__, len));
   3623 				dhd_os_sdlock_rxq(bus->dhd);
   3624 				PKTFREE2();
   3625 				dhd_os_sdunlock_rxq(bus->dhd);
   3626 				GSPI_PR55150_BAILOUT;
   3627 				continue;
   3628 			}
   3629 
   3630 			/* Check for consistency with readahead info */
   3631 				len_consistent = (nextlen != (ROUNDUP(len, 16) >> 4));
   3632 			if (len_consistent) {
   3633 				/* Mismatch, force retry w/normal header (may be >4K) */
   3634 				DHD_ERROR(("%s (nextlen): mismatch, nextlen %d len %d rnd %d; "
   3635 				           "expected rxseq %d\n",
   3636 				           __FUNCTION__, nextlen, len, ROUNDUP(len, 16), rxseq));
   3637 				dhd_os_sdlock_rxq(bus->dhd);
   3638 				PKTFREE2();
   3639 				dhd_os_sdunlock_rxq(bus->dhd);
   3640 				dhdsdio_rxfail(bus, TRUE, (bus->bus == SPI_BUS) ? FALSE : TRUE);
   3641 				GSPI_PR55150_BAILOUT;
   3642 				continue;
   3643 			}
   3644 
   3645 
   3646 			/* Extract software header fields */
   3647 			chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
   3648 			seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
   3649 			doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
   3650 			txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
   3651 
   3652 				bus->nextlen =
   3653 				         bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
   3654 				if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
   3655 					DHD_INFO(("%s (nextlen): got frame w/nextlen too large"
   3656 					          " (%d), seq %d\n", __FUNCTION__, bus->nextlen,
   3657 					          seq));
   3658 					bus->nextlen = 0;
   3659 				}
   3660 
   3661 				bus->dhd->rx_readahead_cnt ++;
   3662 			/* Handle Flow Control */
   3663 			fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
   3664 
   3665 			delta = 0;
   3666 			if (~bus->flowcontrol & fcbits) {
   3667 				bus->fc_xoff++;
   3668 				delta = 1;
   3669 			}
   3670 			if (bus->flowcontrol & ~fcbits) {
   3671 				bus->fc_xon++;
   3672 				delta = 1;
   3673 			}
   3674 
   3675 			if (delta) {
   3676 				bus->fc_rcvd++;
   3677 				bus->flowcontrol = fcbits;
   3678 			}
   3679 
   3680 			/* Check and update sequence number */
   3681 			if (rxseq != seq) {
   3682 				DHD_INFO(("%s (nextlen): rx_seq %d, expected %d\n",
   3683 				          __FUNCTION__, seq, rxseq));
   3684 				bus->rx_badseq++;
   3685 				rxseq = seq;
   3686 			}
   3687 
   3688 			/* Check window for sanity */
   3689 			if ((uint8)(txmax - bus->tx_seq) > 0x40) {
   3690 					DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
   3691 						__FUNCTION__, txmax, bus->tx_seq));
   3692 					txmax = bus->tx_seq + 2;
   3693 			}
   3694 			bus->tx_max = txmax;
   3695 
   3696 #ifdef DHD_DEBUG
   3697 			if (DHD_BYTES_ON() && DHD_DATA_ON()) {
   3698 				prhex("Rx Data", rxbuf, len);
   3699 			} else if (DHD_HDRS_ON()) {
   3700 				prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
   3701 			}
   3702 #endif
   3703 
   3704 			if (chan == SDPCM_CONTROL_CHANNEL) {
   3705 				if (bus->bus == SPI_BUS) {
   3706 					dhdsdio_read_control(bus, rxbuf, len, doff);
   3707 					if (bus->usebufpool) {
   3708 						dhd_os_sdlock_rxq(bus->dhd);
   3709 						PKTFREE(bus->dhd->osh, pkt, FALSE);
   3710 						dhd_os_sdunlock_rxq(bus->dhd);
   3711 					}
   3712 					continue;
   3713 				} else {
   3714 					DHD_ERROR(("%s (nextlen): readahead on control"
   3715 					           " packet %d?\n", __FUNCTION__, seq));
   3716 					/* Force retry w/normal header read */
   3717 					bus->nextlen = 0;
   3718 					dhdsdio_rxfail(bus, FALSE, TRUE);
   3719 					dhd_os_sdlock_rxq(bus->dhd);
   3720 					PKTFREE2();
   3721 					dhd_os_sdunlock_rxq(bus->dhd);
   3722 					continue;
   3723 				}
   3724 			}
   3725 
   3726 			if ((bus->bus == SPI_BUS) && !bus->usebufpool) {
   3727 				DHD_ERROR(("Received %d bytes on %d channel. Running out of "
   3728 				           "rx pktbuf's or not yet malloced.\n", len, chan));
   3729 				continue;
   3730 			}
   3731 
   3732 			/* Validate data offset */
   3733 			if ((doff < SDPCM_HDRLEN) || (doff > len)) {
   3734 				DHD_ERROR(("%s (nextlen): bad data offset %d: HW len %d min %d\n",
   3735 				           __FUNCTION__, doff, len, SDPCM_HDRLEN));
   3736 				dhd_os_sdlock_rxq(bus->dhd);
   3737 				PKTFREE2();
   3738 				dhd_os_sdunlock_rxq(bus->dhd);
   3739 				ASSERT(0);
   3740 				dhdsdio_rxfail(bus, FALSE, FALSE);
   3741 				continue;
   3742 			}
   3743 
   3744 			/* All done with this one -- now deliver the packet */
   3745 			goto deliver;
   3746 		}
   3747 		/* gSPI frames should not be handled in fractions */
   3748 		if (bus->bus == SPI_BUS) {
   3749 			break;
   3750 		}
   3751 
   3752 		/* Read frame header (hardware and software) */
   3753 		sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
   3754 		                            bus->rxhdr, firstread, NULL, NULL, NULL);
   3755 		bus->f2rxhdrs++;
   3756 		ASSERT(sdret != BCME_PENDING);
   3757 
   3758 		if (sdret < 0) {
   3759 			DHD_ERROR(("%s: RXHEADER FAILED: %d\n", __FUNCTION__, sdret));
   3760 			bus->rx_hdrfail++;
   3761 			dhdsdio_rxfail(bus, TRUE, TRUE);
   3762 			continue;
   3763 		}
   3764 
   3765 #ifdef DHD_DEBUG
   3766 		if (DHD_BYTES_ON() || DHD_HDRS_ON()) {
   3767 			prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
   3768 		}
   3769 #endif
   3770 
   3771 		/* Extract hardware header fields */
   3772 		len = ltoh16_ua(bus->rxhdr);
   3773 		check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
   3774 
   3775 		/* All zeros means no more frames */
   3776 		if (!(len|check)) {
   3777 			*finished = TRUE;
   3778 			break;
   3779 		}
   3780 
   3781 		/* Validate check bytes */
   3782 		if ((uint16)~(len^check)) {
   3783 			DHD_ERROR(("%s: HW hdr error: len/check 0x%04x/0x%04x\n",
   3784 			           __FUNCTION__, len, check));
   3785 			bus->rx_badhdr++;
   3786 			dhdsdio_rxfail(bus, FALSE, FALSE);
   3787 			continue;
   3788 		}
   3789 
   3790 		/* Validate frame length */
   3791 		if (len < SDPCM_HDRLEN) {
   3792 			DHD_ERROR(("%s: HW hdr length invalid: %d\n", __FUNCTION__, len));
   3793 			continue;
   3794 		}
   3795 
   3796 		/* Extract software header fields */
   3797 		chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
   3798 		seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
   3799 		doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
   3800 		txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
   3801 
   3802 		/* Validate data offset */
   3803 		if ((doff < SDPCM_HDRLEN) || (doff > len)) {
   3804 			DHD_ERROR(("%s: Bad data offset %d: HW len %d, min %d seq %d\n",
   3805 			           __FUNCTION__, doff, len, SDPCM_HDRLEN, seq));
   3806 			bus->rx_badhdr++;
   3807 			ASSERT(0);
   3808 			dhdsdio_rxfail(bus, FALSE, FALSE);
   3809 			continue;
   3810 		}
   3811 
   3812 		/* Save the readahead length if there is one */
   3813 		bus->nextlen = bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
   3814 		if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
   3815 			DHD_INFO(("%s (nextlen): got frame w/nextlen too large (%d), seq %d\n",
   3816 			          __FUNCTION__, bus->nextlen, seq));
   3817 			bus->nextlen = 0;
   3818 		}
   3819 
   3820 		/* Handle Flow Control */
   3821 		fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
   3822 
   3823 		delta = 0;
   3824 		if (~bus->flowcontrol & fcbits) {
   3825 			bus->fc_xoff++;
   3826 			delta = 1;
   3827 		}
   3828 		if (bus->flowcontrol & ~fcbits) {
   3829 			bus->fc_xon++;
   3830 			delta = 1;
   3831 		}
   3832 
   3833 		if (delta) {
   3834 			bus->fc_rcvd++;
   3835 			bus->flowcontrol = fcbits;
   3836 		}
   3837 
   3838 		/* Check and update sequence number */
   3839 		if (rxseq != seq) {
   3840 			DHD_INFO(("%s: rx_seq %d, expected %d\n", __FUNCTION__, seq, rxseq));
   3841 			bus->rx_badseq++;
   3842 			rxseq = seq;
   3843 		}
   3844 
   3845 		/* Check window for sanity */
   3846 		if ((uint8)(txmax - bus->tx_seq) > 0x40) {
   3847 			DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
   3848 			           __FUNCTION__, txmax, bus->tx_seq));
   3849 			txmax = bus->tx_seq + 2;
   3850 		}
   3851 		bus->tx_max = txmax;
   3852 
   3853 		/* Call a separate function for control frames */
   3854 		if (chan == SDPCM_CONTROL_CHANNEL) {
   3855 			dhdsdio_read_control(bus, bus->rxhdr, len, doff);
   3856 			continue;
   3857 		}
   3858 
   3859 		ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL) ||
   3860 		       (chan == SDPCM_TEST_CHANNEL) || (chan == SDPCM_GLOM_CHANNEL));
   3861 
   3862 		/* Length to read */
   3863 		rdlen = (len > firstread) ? (len - firstread) : 0;
   3864 
   3865 		/* May pad read to blocksize for efficiency */
   3866 		if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
   3867 			pad = bus->blocksize - (rdlen % bus->blocksize);
   3868 			if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
   3869 			    ((rdlen + pad + firstread) < MAX_RX_DATASZ))
   3870 				rdlen += pad;
   3871 		} else if (rdlen % DHD_SDALIGN) {
   3872 			rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
   3873 		}
   3874 
   3875 		/* Satisfy length-alignment requirements */
   3876 		if (forcealign && (rdlen & (ALIGNMENT - 1)))
   3877 			rdlen = ROUNDUP(rdlen, ALIGNMENT);
   3878 
   3879 		if ((rdlen + firstread) > MAX_RX_DATASZ) {
   3880 			/* Too long -- skip this frame */
   3881 			DHD_ERROR(("%s: too long: len %d rdlen %d\n", __FUNCTION__, len, rdlen));
   3882 			bus->dhd->rx_errors++; bus->rx_toolong++;
   3883 			dhdsdio_rxfail(bus, FALSE, FALSE);
   3884 			continue;
   3885 		}
   3886 
   3887 		dhd_os_sdlock_rxq(bus->dhd);
   3888 		if (!(pkt = PKTGET(osh, (rdlen + firstread + DHD_SDALIGN), FALSE))) {
   3889 			/* Give up on data, request rtx of events */
   3890 			DHD_ERROR(("%s: PKTGET failed: rdlen %d chan %d\n",
   3891 			           __FUNCTION__, rdlen, chan));
   3892 			bus->dhd->rx_dropped++;
   3893 			dhd_os_sdunlock_rxq(bus->dhd);
   3894 			dhdsdio_rxfail(bus, FALSE, RETRYCHAN(chan));
   3895 			continue;
   3896 		}
   3897 		dhd_os_sdunlock_rxq(bus->dhd);
   3898 
   3899 		ASSERT(!PKTLINK(pkt));
   3900 
   3901 		/* Leave room for what we already read, and align remainder */
   3902 		ASSERT(firstread < (PKTLEN(osh, pkt)));
   3903 		PKTPULL(osh, pkt, firstread);
   3904 		PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
   3905 
   3906 		/* Read the remaining frame data */
   3907 		sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
   3908 		                            ((uint8 *)PKTDATA(osh, pkt)), rdlen, pkt, NULL, NULL);
   3909 		bus->f2rxdata++;
   3910 		ASSERT(sdret != BCME_PENDING);
   3911 
   3912 		if (sdret < 0) {
   3913 			DHD_ERROR(("%s: read %d %s bytes failed: %d\n", __FUNCTION__, rdlen,
   3914 			           ((chan == SDPCM_EVENT_CHANNEL) ? "event" :
   3915 			            ((chan == SDPCM_DATA_CHANNEL) ? "data" : "test")), sdret));
   3916 			dhd_os_sdlock_rxq(bus->dhd);
   3917 			PKTFREE(bus->dhd->osh, pkt, FALSE);
   3918 			dhd_os_sdunlock_rxq(bus->dhd);
   3919 			bus->dhd->rx_errors++;
   3920 			dhdsdio_rxfail(bus, TRUE, RETRYCHAN(chan));
   3921 			continue;
   3922 		}
   3923 
   3924 		/* Copy the already-read portion */
   3925 		PKTPUSH(osh, pkt, firstread);
   3926 		bcopy(bus->rxhdr, PKTDATA(osh, pkt), firstread);
   3927 
   3928 #ifdef DHD_DEBUG
   3929 		if (DHD_BYTES_ON() && DHD_DATA_ON()) {
   3930 			prhex("Rx Data", PKTDATA(osh, pkt), len);
   3931 		}
   3932 #endif
   3933 
   3934 deliver:
   3935 		/* Save superframe descriptor and allocate packet frame */
   3936 		if (chan == SDPCM_GLOM_CHANNEL) {
   3937 			if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
   3938 				DHD_GLOM(("%s: got glom descriptor, %d bytes:\n",
   3939 				          __FUNCTION__, len));
   3940 #ifdef DHD_DEBUG
   3941 				if (DHD_GLOM_ON()) {
   3942 					prhex("Glom Data", PKTDATA(osh, pkt), len);
   3943 				}
   3944 #endif
   3945 				PKTSETLEN(osh, pkt, len);
   3946 				ASSERT(doff == SDPCM_HDRLEN);
   3947 				PKTPULL(osh, pkt, SDPCM_HDRLEN);
   3948 				bus->glomd = pkt;
   3949 			} else {
   3950 				DHD_ERROR(("%s: glom superframe w/o descriptor!\n", __FUNCTION__));
   3951 				dhdsdio_rxfail(bus, FALSE, FALSE);
   3952 			}
   3953 			continue;
   3954 		}
   3955 
   3956 		/* Fill in packet len and prio, deliver upward */
   3957 		PKTSETLEN(osh, pkt, len);
   3958 		PKTPULL(osh, pkt, doff);
   3959 
   3960 #ifdef SDTEST
   3961 		/* Test channel packets are processed separately */
   3962 		if (chan == SDPCM_TEST_CHANNEL) {
   3963 			dhdsdio_testrcv(bus, pkt, seq);
   3964 			continue;
   3965 		}
   3966 #endif /* SDTEST */
   3967 
   3968 		if (PKTLEN(osh, pkt) == 0) {
   3969 			dhd_os_sdlock_rxq(bus->dhd);
   3970 			PKTFREE(bus->dhd->osh, pkt, FALSE);
   3971 			dhd_os_sdunlock_rxq(bus->dhd);
   3972 			continue;
   3973 		} else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pkt) != 0) {
   3974 			DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
   3975 			dhd_os_sdlock_rxq(bus->dhd);
   3976 			PKTFREE(bus->dhd->osh, pkt, FALSE);
   3977 			dhd_os_sdunlock_rxq(bus->dhd);
   3978 			bus->dhd->rx_errors++;
   3979 			continue;
   3980 		}
   3981 
   3982 
   3983 		/* Unlock during rx call */
   3984 		dhd_os_sdunlock(bus->dhd);
   3985 		dhd_rx_frame(bus->dhd, ifidx, pkt, 1);
   3986 		dhd_os_sdlock(bus->dhd);
   3987 	}
   3988 	rxcount = maxframes - rxleft;
   3989 #ifdef DHD_DEBUG
   3990 	/* Message if we hit the limit */
   3991 	if (!rxleft && !sdtest)
   3992 		DHD_DATA(("%s: hit rx limit of %d frames\n", __FUNCTION__, maxframes));
   3993 	else
   3994 #endif /* DHD_DEBUG */
   3995 	DHD_DATA(("%s: processed %d frames\n", __FUNCTION__, rxcount));
   3996 	/* Back off rxseq if awaiting rtx, update rx_seq */
   3997 	if (bus->rxskip)
   3998 		rxseq--;
   3999 	bus->rx_seq = rxseq;
   4000 
   4001 	return rxcount;
   4002 }
   4003 
   4004 static uint32
   4005 dhdsdio_hostmail(dhd_bus_t *bus)
   4006 {
   4007 	sdpcmd_regs_t *regs = bus->regs;
   4008 	uint32 intstatus = 0;
   4009 	uint32 hmb_data;
   4010 	uint8 fcbits;
   4011 	uint retries = 0;
   4012 
   4013 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   4014 
   4015 	/* Read mailbox data and ack that we did so */
   4016 	R_SDREG(hmb_data, &regs->tohostmailboxdata, retries);
   4017 	if (retries <= retry_limit)
   4018 		W_SDREG(SMB_INT_ACK, &regs->tosbmailbox, retries);
   4019 	bus->f1regdata += 2;
   4020 
   4021 	/* Dongle recomposed rx frames, accept them again */
   4022 	if (hmb_data & HMB_DATA_NAKHANDLED) {
   4023 		DHD_INFO(("Dongle reports NAK handled, expect rtx of %d\n", bus->rx_seq));
   4024 		if (!bus->rxskip) {
   4025 			DHD_ERROR(("%s: unexpected NAKHANDLED!\n", __FUNCTION__));
   4026 		}
   4027 		bus->rxskip = FALSE;
   4028 		intstatus |= I_HMB_FRAME_IND;
   4029 	}
   4030 
   4031 	/*
   4032 	 * DEVREADY does not occur with gSPI.
   4033 	 */
   4034 	if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
   4035 		bus->sdpcm_ver = (hmb_data & HMB_DATA_VERSION_MASK) >> HMB_DATA_VERSION_SHIFT;
   4036 		if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
   4037 			DHD_ERROR(("Version mismatch, dongle reports %d, expecting %d\n",
   4038 			           bus->sdpcm_ver, SDPCM_PROT_VERSION));
   4039 		else
   4040 			DHD_INFO(("Dongle ready, protocol version %d\n", bus->sdpcm_ver));
   4041 	}
   4042 
   4043 	/*
   4044 	 * Flow Control has been moved into the RX headers and this out of band
   4045 	 * method isn't used any more.  Leae this here for possibly remaining backward
   4046 	 * compatible with older dongles
   4047 	 */
   4048 	if (hmb_data & HMB_DATA_FC) {
   4049 		fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >> HMB_DATA_FCDATA_SHIFT;
   4050 
   4051 		if (fcbits & ~bus->flowcontrol)
   4052 			bus->fc_xoff++;
   4053 		if (bus->flowcontrol & ~fcbits)
   4054 			bus->fc_xon++;
   4055 
   4056 		bus->fc_rcvd++;
   4057 		bus->flowcontrol = fcbits;
   4058 	}
   4059 
   4060 	/* Shouldn't be any others */
   4061 	if (hmb_data & ~(HMB_DATA_DEVREADY |
   4062 	                 HMB_DATA_NAKHANDLED |
   4063 	                 HMB_DATA_FC |
   4064 	                 HMB_DATA_FWREADY |
   4065 	                 HMB_DATA_FCDATA_MASK |
   4066 	                 HMB_DATA_VERSION_MASK)) {
   4067 		DHD_ERROR(("Unknown mailbox data content: 0x%02x\n", hmb_data));
   4068 	}
   4069 
   4070 	return intstatus;
   4071 }
   4072 
   4073 bool
   4074 dhdsdio_dpc(dhd_bus_t *bus)
   4075 {
   4076 	bcmsdh_info_t *sdh = bus->sdh;
   4077 	sdpcmd_regs_t *regs = bus->regs;
   4078 	uint32 intstatus, newstatus = 0;
   4079 	uint retries = 0;
   4080 	uint rxlimit = dhd_rxbound; /* Rx frames to read before resched */
   4081 	uint txlimit = dhd_txbound; /* Tx frames to send before resched */
   4082 	uint framecnt = 0;		  /* Temporary counter of tx/rx frames */
   4083 	bool rxdone = TRUE;		  /* Flag for no more read data */
   4084 	bool resched = FALSE;	  /* Flag indicating resched wanted */
   4085 
   4086 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   4087 
   4088 	/* Start with leftover status bits */
   4089 	intstatus = bus->intstatus;
   4090 
   4091 	dhd_os_sdlock(bus->dhd);
   4092 
   4093 	/* If waiting for HTAVAIL, check status */
   4094 	if (bus->clkstate == CLK_PENDING) {
   4095 		int err;
   4096 		uint8 clkctl, devctl = 0;
   4097 
   4098 #ifdef DHD_DEBUG
   4099 		/* Check for inconsistent device control */
   4100 		devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
   4101 		if (err) {
   4102 			DHD_ERROR(("%s: error reading DEVCTL: %d\n", __FUNCTION__, err));
   4103 			bus->dhd->busstate = DHD_BUS_DOWN;
   4104 		} else {
   4105 			ASSERT(devctl & SBSDIO_DEVCTL_CA_INT_ONLY);
   4106 		}
   4107 #endif /* DHD_DEBUG */
   4108 
   4109 		/* Read CSR, if clock on switch to AVAIL, else ignore */
   4110 		clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
   4111 		if (err) {
   4112 			DHD_ERROR(("%s: error reading CSR: %d\n", __FUNCTION__, err));
   4113 			bus->dhd->busstate = DHD_BUS_DOWN;
   4114 		}
   4115 
   4116 		DHD_INFO(("DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n", devctl, clkctl));
   4117 
   4118 		if (SBSDIO_HTAV(clkctl)) {
   4119 			devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
   4120 			if (err) {
   4121 				DHD_ERROR(("%s: error reading DEVCTL: %d\n",
   4122 				           __FUNCTION__, err));
   4123 				bus->dhd->busstate = DHD_BUS_DOWN;
   4124 			}
   4125 			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
   4126 			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
   4127 			if (err) {
   4128 				DHD_ERROR(("%s: error writing DEVCTL: %d\n",
   4129 				           __FUNCTION__, err));
   4130 				bus->dhd->busstate = DHD_BUS_DOWN;
   4131 			}
   4132 			bus->clkstate = CLK_AVAIL;
   4133 		} else {
   4134 			goto clkwait;
   4135 		}
   4136 	}
   4137 
   4138 	BUS_WAKE(bus);
   4139 
   4140 	/* Make sure backplane clock is on */
   4141 	dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
   4142 	if (bus->clkstate == CLK_PENDING)
   4143 		goto clkwait;
   4144 
   4145 	/* Pending interrupt indicates new device status */
   4146 	if (bus->ipend) {
   4147 		bus->ipend = FALSE;
   4148 		R_SDREG(newstatus, &regs->intstatus, retries);
   4149 		bus->f1regdata++;
   4150 		if (bcmsdh_regfail(bus->sdh))
   4151 			newstatus = 0;
   4152 		newstatus &= bus->hostintmask;
   4153 		bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
   4154 		if (newstatus) {
   4155 			W_SDREG(newstatus, &regs->intstatus, retries);
   4156 			bus->f1regdata++;
   4157 		}
   4158 	}
   4159 
   4160 	/* Merge new bits with previous */
   4161 	intstatus |= newstatus;
   4162 	bus->intstatus = 0;
   4163 
   4164 	/* Handle flow-control change: read new state in case our ack
   4165 	 * crossed another change interrupt.  If change still set, assume
   4166 	 * FC ON for safety, let next loop through do the debounce.
   4167 	 */
   4168 	if (intstatus & I_HMB_FC_CHANGE) {
   4169 		intstatus &= ~I_HMB_FC_CHANGE;
   4170 		W_SDREG(I_HMB_FC_CHANGE, &regs->intstatus, retries);
   4171 		R_SDREG(newstatus, &regs->intstatus, retries);
   4172 		bus->f1regdata += 2;
   4173 		bus->fcstate = !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
   4174 		intstatus |= (newstatus & bus->hostintmask);
   4175 	}
   4176 
   4177 	/* Handle host mailbox indication */
   4178 	if (intstatus & I_HMB_HOST_INT) {
   4179 		intstatus &= ~I_HMB_HOST_INT;
   4180 		intstatus |= dhdsdio_hostmail(bus);
   4181 	}
   4182 
   4183 	/* Generally don't ask for these, can get CRC errors... */
   4184 	if (intstatus & I_WR_OOSYNC) {
   4185 		DHD_ERROR(("Dongle reports WR_OOSYNC\n"));
   4186 		intstatus &= ~I_WR_OOSYNC;
   4187 	}
   4188 
   4189 	if (intstatus & I_RD_OOSYNC) {
   4190 		DHD_ERROR(("Dongle reports RD_OOSYNC\n"));
   4191 		intstatus &= ~I_RD_OOSYNC;
   4192 	}
   4193 
   4194 	if (intstatus & I_SBINT) {
   4195 		DHD_ERROR(("Dongle reports SBINT\n"));
   4196 		intstatus &= ~I_SBINT;
   4197 	}
   4198 
   4199 	/* Would be active due to wake-wlan in gSPI */
   4200 	if (intstatus & I_CHIPACTIVE) {
   4201 		DHD_INFO(("Dongle reports CHIPACTIVE\n"));
   4202 		intstatus &= ~I_CHIPACTIVE;
   4203 	}
   4204 
   4205 	/* Ignore frame indications if rxskip is set */
   4206 	if (bus->rxskip)
   4207 		intstatus &= ~I_HMB_FRAME_IND;
   4208 
   4209 	/* On frame indication, read available frames */
   4210 	if (PKT_AVAILABLE()) {
   4211 		framecnt = dhdsdio_readframes(bus, rxlimit, &rxdone);
   4212 		if (rxdone || bus->rxskip)
   4213 			intstatus &= ~I_HMB_FRAME_IND;
   4214 		rxlimit -= MIN(framecnt, rxlimit);
   4215 	}
   4216 
   4217 	/* Keep still-pending events for next scheduling */
   4218 	bus->intstatus = intstatus;
   4219 
   4220 clkwait:
   4221 	/* Re-enable interrupts to detect new device events (mailbox, rx frame)
   4222 	 * or clock availability.  (Allows tx loop to check ipend if desired.)
   4223 	 * (Unless register access seems hosed, as we may not be able to ACK...)
   4224 	 */
   4225 	if (bus->intr && bus->intdis && !bcmsdh_regfail(sdh)) {
   4226 		DHD_INTR(("%s: enable SDIO interrupts, rxdone %d framecnt %d\n",
   4227 		          __FUNCTION__, rxdone, framecnt));
   4228 		bus->intdis = FALSE;
   4229 #if defined(OOB_INTR_ONLY)
   4230 		bcmsdh_oob_intr_set(1);
   4231 #endif /* (OOB_INTR_ONLY) */
   4232 		bcmsdh_intr_enable(sdh);
   4233 	}
   4234 
   4235 	if (DATAOK(bus) && bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL)) {
   4236 		int ret, i;
   4237 
   4238 		ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
   4239 		                      (uint8 *)bus->ctrl_frame_buf, (uint32)bus->ctrl_frame_len,
   4240 			NULL, NULL, NULL);
   4241 		ASSERT(ret != BCME_PENDING);
   4242 
   4243 		if (ret < 0) {
   4244 			/* On failure, abort the command and terminate the frame */
   4245 			DHD_INFO(("%s: sdio error %d, abort command and terminate frame.\n",
   4246 			          __FUNCTION__, ret));
   4247 			bus->tx_sderrs++;
   4248 
   4249 			bcmsdh_abort(sdh, SDIO_FUNC_2);
   4250 
   4251 			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
   4252 			                 SFC_WF_TERM, NULL);
   4253 			bus->f1regdata++;
   4254 
   4255 			for (i = 0; i < 3; i++) {
   4256 				uint8 hi, lo;
   4257 				hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
   4258 				                     SBSDIO_FUNC1_WFRAMEBCHI, NULL);
   4259 				lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
   4260 				                     SBSDIO_FUNC1_WFRAMEBCLO, NULL);
   4261 				bus->f1regdata += 2;
   4262 				if ((hi == 0) && (lo == 0))
   4263 					break;
   4264 			}
   4265 
   4266 		}
   4267 		if (ret == 0) {
   4268 				bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
   4269 		}
   4270 
   4271 		printf("Return_dpc value is : %d\n", ret);
   4272 		bus->ctrl_frame_stat = FALSE;
   4273 		dhd_wait_event_wakeup(bus->dhd);
   4274 	}
   4275 	/* Send queued frames (limit 1 if rx may still be pending) */
   4276 	else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
   4277 	    pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit && DATAOK(bus)) {
   4278 		framecnt = rxdone ? txlimit : MIN(txlimit, dhd_txminmax);
   4279 		framecnt = dhdsdio_sendfromq(bus, framecnt);
   4280 		txlimit -= framecnt;
   4281 	}
   4282 
   4283 	/* Resched if events or tx frames are pending, else await next interrupt */
   4284 	/* On failed register access, all bets are off: no resched or interrupts */
   4285 	if ((bus->dhd->busstate == DHD_BUS_DOWN) || bcmsdh_regfail(sdh)) {
   4286 		DHD_ERROR(("%s: failed backplane access over SDIO, halting operation %d \n",
   4287 		           __FUNCTION__, bcmsdh_regfail(sdh)));
   4288 		bus->dhd->busstate = DHD_BUS_DOWN;
   4289 		bus->intstatus = 0;
   4290 	} else if (bus->clkstate == CLK_PENDING) {
   4291 		DHD_INFO(("%s: rescheduled due to CLK_PENDING awaiting \
   4292 			I_CHIPACTIVE interrupt", __FUNCTION__));
   4293 			resched = TRUE;
   4294 	} else if (bus->intstatus || bus->ipend ||
   4295 	           (!bus->fcstate && pktq_mlen(&bus->txq, ~bus->flowcontrol) && DATAOK(bus)) ||
   4296 			PKT_AVAILABLE()) {  /* Read multiple frames */
   4297 		resched = TRUE;
   4298 	}
   4299 
   4300 
   4301 	bus->dpc_sched = resched;
   4302 
   4303 	/* If we're done for now, turn off clock request. */
   4304 	if ((bus->clkstate != CLK_PENDING) && bus->idletime == DHD_IDLE_IMMEDIATE) {
   4305 		bus->activity = FALSE;
   4306 		dhdsdio_clkctl(bus, CLK_NONE, FALSE);
   4307 	}
   4308 
   4309 	dhd_os_sdunlock(bus->dhd);
   4310 
   4311 	return resched;
   4312 }
   4313 
   4314 bool
   4315 dhd_bus_dpc(struct dhd_bus *bus)
   4316 {
   4317 	bool resched;
   4318 
   4319 	/* Call the DPC directly. */
   4320 	DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
   4321 	resched = dhdsdio_dpc(bus);
   4322 
   4323 	return resched;
   4324 }
   4325 
   4326 void
   4327 dhdsdio_isr(void *arg)
   4328 {
   4329 	dhd_bus_t *bus = (dhd_bus_t*)arg;
   4330 	bcmsdh_info_t *sdh;
   4331 
   4332 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   4333 
   4334 	if (!bus) {
   4335 		DHD_ERROR(("%s : bus is null pointer , exit \n", __FUNCTION__));
   4336 		return;
   4337 	}
   4338 	sdh = bus->sdh;
   4339 
   4340 	if (bus->dhd->busstate == DHD_BUS_DOWN) {
   4341 		DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
   4342 		return;
   4343 	}
   4344 	/* Count the interrupt call */
   4345 	bus->intrcount++;
   4346 	bus->ipend = TRUE;
   4347 
   4348 	/* Shouldn't get this interrupt if we're sleeping? */
   4349 	if (bus->sleeping) {
   4350 		DHD_ERROR(("INTERRUPT WHILE SLEEPING??\n"));
   4351 		return;
   4352 	}
   4353 
   4354 	/* Disable additional interrupts (is this needed now)? */
   4355 	if (bus->intr) {
   4356 		DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
   4357 	} else {
   4358 		DHD_ERROR(("dhdsdio_isr() w/o interrupt configured!\n"));
   4359 	}
   4360 
   4361 	bcmsdh_intr_disable(sdh);
   4362 	bus->intdis = TRUE;
   4363 
   4364 #if defined(SDIO_ISR_THREAD)
   4365 	DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
   4366 	dhd_os_wake_lock(bus->dhd);
   4367 	while (dhdsdio_dpc(bus));
   4368 	dhd_os_wake_unlock(bus->dhd);
   4369 #else
   4370 	bus->dpc_sched = TRUE;
   4371 	dhd_sched_dpc(bus->dhd);
   4372 #endif
   4373 
   4374 }
   4375 
   4376 #ifdef SDTEST
   4377 static void
   4378 dhdsdio_pktgen_init(dhd_bus_t *bus)
   4379 {
   4380 	/* Default to specified length, or full range */
   4381 	if (dhd_pktgen_len) {
   4382 		bus->pktgen_maxlen = MIN(dhd_pktgen_len, MAX_PKTGEN_LEN);
   4383 		bus->pktgen_minlen = bus->pktgen_maxlen;
   4384 	} else {
   4385 		bus->pktgen_maxlen = MAX_PKTGEN_LEN;
   4386 		bus->pktgen_minlen = 0;
   4387 	}
   4388 	bus->pktgen_len = (uint16)bus->pktgen_minlen;
   4389 
   4390 	/* Default to per-watchdog burst with 10s print time */
   4391 	bus->pktgen_freq = 1;
   4392 	bus->pktgen_print = 10000 / dhd_watchdog_ms;
   4393 	bus->pktgen_count = (dhd_pktgen * dhd_watchdog_ms + 999) / 1000;
   4394 
   4395 	/* Default to echo mode */
   4396 	bus->pktgen_mode = DHD_PKTGEN_ECHO;
   4397 	bus->pktgen_stop = 1;
   4398 }
   4399 
   4400 static void
   4401 dhdsdio_pktgen(dhd_bus_t *bus)
   4402 {
   4403 	void *pkt;
   4404 	uint8 *data;
   4405 	uint pktcount;
   4406 	uint fillbyte;
   4407 	osl_t *osh = bus->dhd->osh;
   4408 	uint16 len;
   4409 
   4410 	/* Display current count if appropriate */
   4411 	if (bus->pktgen_print && (++bus->pktgen_ptick >= bus->pktgen_print)) {
   4412 		bus->pktgen_ptick = 0;
   4413 		printf("%s: send attempts %d rcvd %d\n",
   4414 		       __FUNCTION__, bus->pktgen_sent, bus->pktgen_rcvd);
   4415 	}
   4416 
   4417 	/* For recv mode, just make sure dongle has started sending */
   4418 	if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
   4419 		if (!bus->pktgen_rcvd)
   4420 			dhdsdio_sdtest_set(bus, TRUE);
   4421 		return;
   4422 	}
   4423 
   4424 	/* Otherwise, generate or request the specified number of packets */
   4425 	for (pktcount = 0; pktcount < bus->pktgen_count; pktcount++) {
   4426 		/* Stop if total has been reached */
   4427 		if (bus->pktgen_total && (bus->pktgen_sent >= bus->pktgen_total)) {
   4428 			bus->pktgen_count = 0;
   4429 			break;
   4430 		}
   4431 
   4432 		/* Allocate an appropriate-sized packet */
   4433 		len = bus->pktgen_len;
   4434 		if (!(pkt = PKTGET(osh, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN),
   4435 		                   TRUE))) {;
   4436 			DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
   4437 			break;
   4438 		}
   4439 		PKTALIGN(osh, pkt, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), DHD_SDALIGN);
   4440 		data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
   4441 
   4442 		/* Write test header cmd and extra based on mode */
   4443 		switch (bus->pktgen_mode) {
   4444 		case DHD_PKTGEN_ECHO:
   4445 			*data++ = SDPCM_TEST_ECHOREQ;
   4446 			*data++ = (uint8)bus->pktgen_sent;
   4447 			break;
   4448 
   4449 		case DHD_PKTGEN_SEND:
   4450 			*data++ = SDPCM_TEST_DISCARD;
   4451 			*data++ = (uint8)bus->pktgen_sent;
   4452 			break;
   4453 
   4454 		case DHD_PKTGEN_RXBURST:
   4455 			*data++ = SDPCM_TEST_BURST;
   4456 			*data++ = (uint8)bus->pktgen_count;
   4457 			break;
   4458 
   4459 		default:
   4460 			DHD_ERROR(("Unrecognized pktgen mode %d\n", bus->pktgen_mode));
   4461 			PKTFREE(osh, pkt, TRUE);
   4462 			bus->pktgen_count = 0;
   4463 			return;
   4464 		}
   4465 
   4466 		/* Write test header length field */
   4467 		*data++ = (len >> 0);
   4468 		*data++ = (len >> 8);
   4469 
   4470 		/* Then fill in the remainder -- N/A for burst, but who cares... */
   4471 		for (fillbyte = 0; fillbyte < len; fillbyte++)
   4472 			*data++ = SDPCM_TEST_FILL(fillbyte, (uint8)bus->pktgen_sent);
   4473 
   4474 #ifdef DHD_DEBUG
   4475 		if (DHD_BYTES_ON() && DHD_DATA_ON()) {
   4476 			data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
   4477 			prhex("dhdsdio_pktgen: Tx Data", data, PKTLEN(osh, pkt) - SDPCM_HDRLEN);
   4478 		}
   4479 #endif
   4480 
   4481 		/* Send it */
   4482 		if (dhdsdio_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, TRUE)) {
   4483 			bus->pktgen_fail++;
   4484 			if (bus->pktgen_stop && bus->pktgen_stop == bus->pktgen_fail)
   4485 				bus->pktgen_count = 0;
   4486 		}
   4487 		bus->pktgen_sent++;
   4488 
   4489 		/* Bump length if not fixed, wrap at max */
   4490 		if (++bus->pktgen_len > bus->pktgen_maxlen)
   4491 			bus->pktgen_len = (uint16)bus->pktgen_minlen;
   4492 
   4493 		/* Special case for burst mode: just send one request! */
   4494 		if (bus->pktgen_mode == DHD_PKTGEN_RXBURST)
   4495 			break;
   4496 	}
   4497 }
   4498 
   4499 static void
   4500 dhdsdio_sdtest_set(dhd_bus_t *bus, bool start)
   4501 {
   4502 	void *pkt;
   4503 	uint8 *data;
   4504 	osl_t *osh = bus->dhd->osh;
   4505 
   4506 	/* Allocate the packet */
   4507 	if (!(pkt = PKTGET(osh, SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN, TRUE))) {
   4508 		DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
   4509 		return;
   4510 	}
   4511 	PKTALIGN(osh, pkt, (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), DHD_SDALIGN);
   4512 	data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
   4513 
   4514 	/* Fill in the test header */
   4515 	*data++ = SDPCM_TEST_SEND;
   4516 	*data++ = start;
   4517 	*data++ = (bus->pktgen_maxlen >> 0);
   4518 	*data++ = (bus->pktgen_maxlen >> 8);
   4519 
   4520 	/* Send it */
   4521 	if (dhdsdio_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, TRUE))
   4522 		bus->pktgen_fail++;
   4523 }
   4524 
   4525 
   4526 static void
   4527 dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq)
   4528 {
   4529 	osl_t *osh = bus->dhd->osh;
   4530 	uint8 *data;
   4531 	uint pktlen;
   4532 
   4533 	uint8 cmd;
   4534 	uint8 extra;
   4535 	uint16 len;
   4536 	uint16 offset;
   4537 
   4538 	/* Check for min length */
   4539 	if ((pktlen = PKTLEN(osh, pkt)) < SDPCM_TEST_HDRLEN) {
   4540 		DHD_ERROR(("dhdsdio_restrcv: toss runt frame, pktlen %d\n", pktlen));
   4541 		PKTFREE(osh, pkt, FALSE);
   4542 		return;
   4543 	}
   4544 
   4545 	/* Extract header fields */
   4546 	data = PKTDATA(osh, pkt);
   4547 	cmd = *data++;
   4548 	extra = *data++;
   4549 	len = *data++; len += *data++ << 8;
   4550 
   4551 	/* Check length for relevant commands */
   4552 	if (cmd == SDPCM_TEST_DISCARD || cmd == SDPCM_TEST_ECHOREQ || cmd == SDPCM_TEST_ECHORSP) {
   4553 		if (pktlen != len + SDPCM_TEST_HDRLEN) {
   4554 			DHD_ERROR(("dhdsdio_testrcv: frame length mismatch, pktlen %d seq %d"
   4555 			           " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
   4556 			PKTFREE(osh, pkt, FALSE);
   4557 			return;
   4558 		}
   4559 	}
   4560 
   4561 	/* Process as per command */
   4562 	switch (cmd) {
   4563 	case SDPCM_TEST_ECHOREQ:
   4564 		/* Rx->Tx turnaround ok (even on NDIS w/current implementation) */
   4565 		*(uint8 *)(PKTDATA(osh, pkt)) = SDPCM_TEST_ECHORSP;
   4566 		if (dhdsdio_txpkt(bus, pkt, SDPCM_TEST_CHANNEL, TRUE) == 0) {
   4567 			bus->pktgen_sent++;
   4568 		} else {
   4569 			bus->pktgen_fail++;
   4570 			PKTFREE(osh, pkt, FALSE);
   4571 		}
   4572 		bus->pktgen_rcvd++;
   4573 		break;
   4574 
   4575 	case SDPCM_TEST_ECHORSP:
   4576 		if (bus->ext_loop) {
   4577 			PKTFREE(osh, pkt, FALSE);
   4578 			bus->pktgen_rcvd++;
   4579 			break;
   4580 		}
   4581 
   4582 		for (offset = 0; offset < len; offset++, data++) {
   4583 			if (*data != SDPCM_TEST_FILL(offset, extra)) {
   4584 				DHD_ERROR(("dhdsdio_testrcv: echo data mismatch: "
   4585 				           "offset %d (len %d) expect 0x%02x rcvd 0x%02x\n",
   4586 				           offset, len, SDPCM_TEST_FILL(offset, extra), *data));
   4587 				break;
   4588 			}
   4589 		}
   4590 		PKTFREE(osh, pkt, FALSE);
   4591 		bus->pktgen_rcvd++;
   4592 		break;
   4593 
   4594 	case SDPCM_TEST_DISCARD:
   4595 		PKTFREE(osh, pkt, FALSE);
   4596 		bus->pktgen_rcvd++;
   4597 		break;
   4598 
   4599 	case SDPCM_TEST_BURST:
   4600 	case SDPCM_TEST_SEND:
   4601 	default:
   4602 		DHD_INFO(("dhdsdio_testrcv: unsupported or unknown command, pktlen %d seq %d"
   4603 		          " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
   4604 		PKTFREE(osh, pkt, FALSE);
   4605 		break;
   4606 	}
   4607 
   4608 	/* For recv mode, stop at limie (and tell dongle to stop sending) */
   4609 	if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
   4610 		if (bus->pktgen_total && (bus->pktgen_rcvd >= bus->pktgen_total)) {
   4611 			bus->pktgen_count = 0;
   4612 			dhdsdio_sdtest_set(bus, FALSE);
   4613 		}
   4614 	}
   4615 }
   4616 #endif /* SDTEST */
   4617 
   4618 extern bool
   4619 dhd_bus_watchdog(dhd_pub_t *dhdp)
   4620 {
   4621 	dhd_bus_t *bus;
   4622 
   4623 	DHD_TIMER(("%s: Enter\n", __FUNCTION__));
   4624 
   4625 	bus = dhdp->bus;
   4626 
   4627 	if (bus->dhd->dongle_reset)
   4628 		return FALSE;
   4629 
   4630 	/* Ignore the timer if simulating bus down */
   4631 	if (bus->sleeping)
   4632 		return FALSE;
   4633 
   4634 	dhd_os_sdlock(bus->dhd);
   4635 
   4636 	/* Poll period: check device if appropriate. */
   4637 	if (bus->poll && (++bus->polltick >= bus->pollrate)) {
   4638 		uint32 intstatus = 0;
   4639 
   4640 		/* Reset poll tick */
   4641 		bus->polltick = 0;
   4642 
   4643 		/* Check device if no interrupts */
   4644 		if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
   4645 
   4646 			if (!bus->dpc_sched) {
   4647 				uint8 devpend;
   4648 				devpend = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0,
   4649 				                          SDIOD_CCCR_INTPEND, NULL);
   4650 				intstatus = devpend & (INTR_STATUS_FUNC1 | INTR_STATUS_FUNC2);
   4651 			}
   4652 
   4653 			/* If there is something, make like the ISR and schedule the DPC */
   4654 			if (intstatus) {
   4655 				bus->pollcnt++;
   4656 				bus->ipend = TRUE;
   4657 				if (bus->intr) {
   4658 					bcmsdh_intr_disable(bus->sdh);
   4659 				}
   4660 				bus->dpc_sched = TRUE;
   4661 				dhd_sched_dpc(bus->dhd);
   4662 
   4663 			}
   4664 		}
   4665 
   4666 		/* Update interrupt tracking */
   4667 		bus->lastintrs = bus->intrcount;
   4668 	}
   4669 
   4670 #ifdef DHD_DEBUG
   4671 	/* Poll for console output periodically */
   4672 	if (dhdp->busstate == DHD_BUS_DATA && dhd_console_ms != 0) {
   4673 		bus->console.count += dhd_watchdog_ms;
   4674 		if (bus->console.count >= dhd_console_ms) {
   4675 			bus->console.count -= dhd_console_ms;
   4676 			/* Make sure backplane clock is on */
   4677 			dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
   4678 			if (dhdsdio_readconsole(bus) < 0)
   4679 				dhd_console_ms = 0;	/* On error, stop trying */
   4680 		}
   4681 	}
   4682 #endif /* DHD_DEBUG */
   4683 
   4684 #ifdef SDTEST
   4685 	/* Generate packets if configured */
   4686 	if (bus->pktgen_count && (++bus->pktgen_tick >= bus->pktgen_freq)) {
   4687 		/* Make sure backplane clock is on */
   4688 		dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
   4689 		bus->pktgen_tick = 0;
   4690 		dhdsdio_pktgen(bus);
   4691 	}
   4692 #endif
   4693 
   4694 	/* On idle timeout clear activity flag and/or turn off clock */
   4695 	if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
   4696 		if (++bus->idlecount >= bus->idletime) {
   4697 			bus->idlecount = 0;
   4698 			if (bus->activity) {
   4699 				bus->activity = FALSE;
   4700 				dhdsdio_clkctl(bus, CLK_NONE, FALSE);
   4701 			}
   4702 		}
   4703 	}
   4704 
   4705 	dhd_os_sdunlock(bus->dhd);
   4706 
   4707 	return bus->ipend;
   4708 }
   4709 
   4710 #ifdef DHD_DEBUG
   4711 extern int
   4712 dhd_bus_console_in(dhd_pub_t *dhdp, uchar *msg, uint msglen)
   4713 {
   4714 	dhd_bus_t *bus = dhdp->bus;
   4715 	uint32 addr, val;
   4716 	int rv;
   4717 	void *pkt;
   4718 
   4719 	/* Address could be zero if CONSOLE := 0 in dongle Makefile */
   4720 	if (bus->console_addr == 0)
   4721 		return BCME_UNSUPPORTED;
   4722 
   4723 	/* Exclusive bus access */
   4724 	dhd_os_sdlock(bus->dhd);
   4725 
   4726 	/* Don't allow input if dongle is in reset */
   4727 	if (bus->dhd->dongle_reset) {
   4728 		dhd_os_sdunlock(bus->dhd);
   4729 		return BCME_NOTREADY;
   4730 	}
   4731 
   4732 	/* Request clock to allow SDIO accesses */
   4733 	BUS_WAKE(bus);
   4734 	/* No pend allowed since txpkt is called later, ht clk has to be on */
   4735 	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
   4736 
   4737 	/* Zero cbuf_index */
   4738 	addr = bus->console_addr + OFFSETOF(hndrte_cons_t, cbuf_idx);
   4739 	val = htol32(0);
   4740 	if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
   4741 		goto done;
   4742 
   4743 	/* Write message into cbuf */
   4744 	addr = bus->console_addr + OFFSETOF(hndrte_cons_t, cbuf);
   4745 	if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)msg, msglen)) < 0)
   4746 		goto done;
   4747 
   4748 	/* Write length into vcons_in */
   4749 	addr = bus->console_addr + OFFSETOF(hndrte_cons_t, vcons_in);
   4750 	val = htol32(msglen);
   4751 	if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
   4752 		goto done;
   4753 
   4754 	/* Bump dongle by sending an empty event pkt.
   4755 	 * sdpcm_sendup (RX) checks for virtual console input.
   4756 	 */
   4757 	if (((pkt = PKTGET(bus->dhd->osh, 4 + SDPCM_RESERVE, TRUE)) != NULL) &&
   4758 		bus->clkstate == CLK_AVAIL)
   4759 		dhdsdio_txpkt(bus, pkt, SDPCM_EVENT_CHANNEL, TRUE);
   4760 
   4761 done:
   4762 	if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
   4763 		bus->activity = FALSE;
   4764 		dhdsdio_clkctl(bus, CLK_NONE, TRUE);
   4765 	}
   4766 
   4767 	dhd_os_sdunlock(bus->dhd);
   4768 
   4769 	return rv;
   4770 }
   4771 #endif /* DHD_DEBUG */
   4772 
   4773 #ifdef DHD_DEBUG
   4774 static void
   4775 dhd_dump_cis(uint fn, uint8 *cis)
   4776 {
   4777 	uint byte, tag, tdata;
   4778 	DHD_INFO(("Function %d CIS:\n", fn));
   4779 
   4780 	for (tdata = byte = 0; byte < SBSDIO_CIS_SIZE_LIMIT; byte++) {
   4781 		if ((byte % 16) == 0)
   4782 			DHD_INFO(("    "));
   4783 		DHD_INFO(("%02x ", cis[byte]));
   4784 		if ((byte % 16) == 15)
   4785 			DHD_INFO(("\n"));
   4786 		if (!tdata--) {
   4787 			tag = cis[byte];
   4788 			if (tag == 0xff)
   4789 				break;
   4790 			else if (!tag)
   4791 				tdata = 0;
   4792 			else if ((byte + 1) < SBSDIO_CIS_SIZE_LIMIT)
   4793 				tdata = cis[byte + 1] + 1;
   4794 			else
   4795 				DHD_INFO(("]"));
   4796 		}
   4797 	}
   4798 	if ((byte % 16) != 15)
   4799 		DHD_INFO(("\n"));
   4800 }
   4801 #endif /* DHD_DEBUG */
   4802 
   4803 static bool
   4804 dhdsdio_chipmatch(uint16 chipid)
   4805 {
   4806 	if (chipid == BCM4325_CHIP_ID)
   4807 		return TRUE;
   4808 	if (chipid == BCM4329_CHIP_ID)
   4809 		return TRUE;
   4810 	if (chipid == BCM4315_CHIP_ID)
   4811 		return TRUE;
   4812 	if (chipid == BCM4319_CHIP_ID)
   4813 		return TRUE;
   4814 	return FALSE;
   4815 }
   4816 
   4817 static void *
   4818 dhdsdio_probe(uint16 venid, uint16 devid, uint16 bus_no, uint16 slot,
   4819 	uint16 func, uint bustype, void *regsva, osl_t * osh, void *sdh)
   4820 {
   4821 	int ret;
   4822 	dhd_bus_t *bus;
   4823 
   4824 	/* Init global variables at run-time, not as part of the declaration.
   4825 	 * This is required to support init/de-init of the driver. Initialization
   4826 	 * of globals as part of the declaration results in non-deterministic
   4827 	 * behavior since the value of the globals may be different on the
   4828 	 * first time that the driver is initialized vs subsequent initializations.
   4829 	 */
   4830 	dhd_txbound = DHD_TXBOUND;
   4831 	dhd_rxbound = DHD_RXBOUND;
   4832 	dhd_alignctl = TRUE;
   4833 	sd1idle = TRUE;
   4834 	dhd_readahead = TRUE;
   4835 	retrydata = FALSE;
   4836 	dhd_doflow = FALSE;
   4837 	dhd_dongle_memsize = 0;
   4838 	dhd_txminmax = DHD_TXMINMAX;
   4839 
   4840 	forcealign = TRUE;
   4841 
   4842 
   4843 	dhd_common_init();
   4844 
   4845 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   4846 	DHD_INFO(("%s: venid 0x%04x devid 0x%04x\n", __FUNCTION__, venid, devid));
   4847 
   4848 	/* We make assumptions about address window mappings */
   4849 	ASSERT((uintptr)regsva == SI_ENUM_BASE);
   4850 
   4851 	/* BCMSDH passes venid and devid based on CIS parsing -- but low-power start
   4852 	 * means early parse could fail, so here we should get either an ID
   4853 	 * we recognize OR (-1) indicating we must request power first.
   4854 	 */
   4855 	/* Check the Vendor ID */
   4856 	switch (venid) {
   4857 		case 0x0000:
   4858 		case VENDOR_BROADCOM:
   4859 			break;
   4860 		default:
   4861 			DHD_ERROR(("%s: unknown vendor: 0x%04x\n",
   4862 			           __FUNCTION__, venid));
   4863 			return NULL;
   4864 	}
   4865 
   4866 	/* Check the Device ID and make sure it's one that we support */
   4867 	switch (devid) {
   4868 		case BCM4325_D11DUAL_ID:		/* 4325 802.11a/g id */
   4869 		case BCM4325_D11G_ID:			/* 4325 802.11g 2.4Ghz band id */
   4870 		case BCM4325_D11A_ID:			/* 4325 802.11a 5Ghz band id */
   4871 			DHD_INFO(("%s: found 4325 Dongle\n", __FUNCTION__));
   4872 			break;
   4873 		case BCM4329_D11NDUAL_ID:		/* 4329 802.11n dualband device */
   4874 		case BCM4329_D11N2G_ID:		/* 4329 802.11n 2.4G device */
   4875 		case BCM4329_D11N5G_ID:		/* 4329 802.11n 5G device */
   4876 		case 0x4329:
   4877 			DHD_INFO(("%s: found 4329 Dongle\n", __FUNCTION__));
   4878 			break;
   4879 		case BCM4315_D11DUAL_ID:		/* 4315 802.11a/g id */
   4880 		case BCM4315_D11G_ID:			/* 4315 802.11g id */
   4881 		case BCM4315_D11A_ID:			/* 4315 802.11a id */
   4882 			DHD_INFO(("%s: found 4315 Dongle\n", __FUNCTION__));
   4883 			break;
   4884 		case BCM4319_D11N_ID:			/* 4319 802.11n id */
   4885 		case BCM4319_D11N2G_ID:			/* 4319 802.11n2g id */
   4886 		case BCM4319_D11N5G_ID:			/* 4319 802.11n5g id */
   4887 			DHD_INFO(("%s: found 4319 Dongle\n", __FUNCTION__));
   4888 			break;
   4889 		case 0:
   4890 			DHD_INFO(("%s: allow device id 0, will check chip internals\n",
   4891 			          __FUNCTION__));
   4892 			break;
   4893 
   4894 		default:
   4895 			DHD_ERROR(("%s: skipping 0x%04x/0x%04x, not a dongle\n",
   4896 			           __FUNCTION__, venid, devid));
   4897 			return NULL;
   4898 	}
   4899 
   4900 	if (osh == NULL) {
   4901 		/* Ask the OS interface part for an OSL handle */
   4902 		if (!(osh = dhd_osl_attach(sdh, DHD_BUS))) {
   4903 			DHD_ERROR(("%s: osl_attach failed!\n", __FUNCTION__));
   4904 			return NULL;
   4905 		}
   4906 	}
   4907 
   4908 	/* Allocate private bus interface state */
   4909 	if (!(bus = MALLOC(osh, sizeof(dhd_bus_t)))) {
   4910 		DHD_ERROR(("%s: MALLOC of dhd_bus_t failed\n", __FUNCTION__));
   4911 		goto fail;
   4912 	}
   4913 	bzero(bus, sizeof(dhd_bus_t));
   4914 	bus->sdh = sdh;
   4915 	bus->cl_devid = (uint16)devid;
   4916 	bus->bus = DHD_BUS;
   4917 	bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
   4918 	bus->usebufpool = FALSE; /* Use bufpool if allocated, else use locally malloced rxbuf */
   4919 
   4920 	/* attempt to attach to the dongle */
   4921 	if (!(dhdsdio_probe_attach(bus, osh, sdh, regsva, devid))) {
   4922 		DHD_ERROR(("%s: dhdsdio_probe_attach failed\n", __FUNCTION__));
   4923 		goto fail;
   4924 	}
   4925 
   4926 	/* Attach to the dhd/OS/network interface */
   4927 	if (!(bus->dhd = dhd_attach(osh, bus, SDPCM_RESERVE))) {
   4928 		DHD_ERROR(("%s: dhd_attach failed\n", __FUNCTION__));
   4929 		goto fail;
   4930 	}
   4931 
   4932 	/* Allocate buffers */
   4933 	if (!(dhdsdio_probe_malloc(bus, osh, sdh))) {
   4934 		DHD_ERROR(("%s: dhdsdio_probe_malloc failed\n", __FUNCTION__));
   4935 		goto fail;
   4936 	}
   4937 
   4938 	if (!(dhdsdio_probe_init(bus, osh, sdh))) {
   4939 		DHD_ERROR(("%s: dhdsdio_probe_init failed\n", __FUNCTION__));
   4940 		goto fail;
   4941 	}
   4942 
   4943 	/* Register interrupt callback, but mask it (not operational yet). */
   4944 	DHD_INTR(("%s: disable SDIO interrupts (not interested yet)\n", __FUNCTION__));
   4945 	bcmsdh_intr_disable(sdh);
   4946 	if ((ret = bcmsdh_intr_reg(sdh, dhdsdio_isr, bus)) != 0) {
   4947 		DHD_ERROR(("%s: FAILED: bcmsdh_intr_reg returned %d\n",
   4948 		           __FUNCTION__, ret));
   4949 		goto fail;
   4950 	}
   4951 	DHD_INTR(("%s: registered SDIO interrupt function ok\n", __FUNCTION__));
   4952 
   4953 	DHD_INFO(("%s: completed!!\n", __FUNCTION__));
   4954 
   4955 
   4956 	/* if firmware path present try to download and bring up bus */
   4957 	if ((ret = dhd_bus_start(bus->dhd)) != 0) {
   4958 #if 1
   4959 		DHD_ERROR(("%s: failed\n", __FUNCTION__));
   4960 		goto fail;
   4961 #else
   4962 		if (ret == BCME_NOTUP)  {
   4963 			DHD_ERROR(("%s: dongle is not responding\n", __FUNCTION__));
   4964 			goto fail;
   4965 		}
   4966 #endif
   4967 	}
   4968 	/* Ok, have the per-port tell the stack we're open for business */
   4969 	if (dhd_net_attach(bus->dhd, 0) != 0) {
   4970 		DHD_ERROR(("%s: Net attach failed!!\n", __FUNCTION__));
   4971 		goto fail;
   4972 	}
   4973 
   4974 	return bus;
   4975 
   4976 fail:
   4977 	dhdsdio_release(bus, osh);
   4978 	return NULL;
   4979 }
   4980 
   4981 
   4982 static bool
   4983 dhdsdio_probe_attach(struct dhd_bus *bus, osl_t *osh, void *sdh, void *regsva,
   4984                     uint16 devid)
   4985 {
   4986 	uint8 clkctl = 0;
   4987 	int err = 0;
   4988 
   4989 	bus->alp_only = TRUE;
   4990 
   4991 	/* Return the window to backplane enumeration space for core access */
   4992 	if (dhdsdio_set_siaddr_window(bus, SI_ENUM_BASE)) {
   4993 		DHD_ERROR(("%s: FAILED to return to SI_ENUM_BASE\n", __FUNCTION__));
   4994 	}
   4995 
   4996 #ifdef DHD_DEBUG
   4997 	printf("F1 signature read @0x18000000=0x%4x\n",
   4998 	       bcmsdh_reg_read(bus->sdh, SI_ENUM_BASE, 4));
   4999 
   5000 
   5001 #endif /* DHD_DEBUG */
   5002 
   5003 
   5004 	/* Force PLL off until si_attach() programs PLL control regs */
   5005 
   5006 
   5007 
   5008 	bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, DHD_INIT_CLKCTL1, &err);
   5009 	if (!err)
   5010 		clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
   5011 
   5012 	if (err || ((clkctl & ~SBSDIO_AVBITS) != DHD_INIT_CLKCTL1)) {
   5013 		DHD_ERROR(("dhdsdio_probe: ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
   5014 		           err, DHD_INIT_CLKCTL1, clkctl));
   5015 		goto fail;
   5016 	}
   5017 
   5018 
   5019 #ifdef DHD_DEBUG
   5020 	if (DHD_INFO_ON()) {
   5021 		uint fn, numfn;
   5022 		uint8 *cis[SDIOD_MAX_IOFUNCS];
   5023 		int err = 0;
   5024 
   5025 		numfn = bcmsdh_query_iofnum(sdh);
   5026 		ASSERT(numfn <= SDIOD_MAX_IOFUNCS);
   5027 
   5028 		/* Make sure ALP is available before trying to read CIS */
   5029 		SPINWAIT(((clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
   5030 		                                    SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
   5031 		          !SBSDIO_ALPAV(clkctl)), PMU_MAX_TRANSITION_DLY);
   5032 
   5033 		/* Now request ALP be put on the bus */
   5034 		bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
   5035 		                 DHD_INIT_CLKCTL2, &err);
   5036 		OSL_DELAY(65);
   5037 
   5038 		for (fn = 0; fn <= numfn; fn++) {
   5039 			if (!(cis[fn] = MALLOC(osh, SBSDIO_CIS_SIZE_LIMIT))) {
   5040 				DHD_INFO(("dhdsdio_probe: fn %d cis malloc failed\n", fn));
   5041 				break;
   5042 			}
   5043 			bzero(cis[fn], SBSDIO_CIS_SIZE_LIMIT);
   5044 
   5045 			if ((err = bcmsdh_cis_read(sdh, fn, cis[fn], SBSDIO_CIS_SIZE_LIMIT))) {
   5046 				DHD_INFO(("dhdsdio_probe: fn %d cis read err %d\n", fn, err));
   5047 				MFREE(osh, cis[fn], SBSDIO_CIS_SIZE_LIMIT);
   5048 				break;
   5049 			}
   5050 			dhd_dump_cis(fn, cis[fn]);
   5051 		}
   5052 
   5053 		while (fn-- > 0) {
   5054 			ASSERT(cis[fn]);
   5055 			MFREE(osh, cis[fn], SBSDIO_CIS_SIZE_LIMIT);
   5056 		}
   5057 
   5058 		if (err) {
   5059 			DHD_ERROR(("dhdsdio_probe: failure reading or parsing CIS\n"));
   5060 			goto fail;
   5061 		}
   5062 	}
   5063 #endif /* DHD_DEBUG */
   5064 
   5065 	/* si_attach() will provide an SI handle and scan the backplane */
   5066 	if (!(bus->sih = si_attach((uint)devid, osh, regsva, DHD_BUS, sdh,
   5067 	                           &bus->vars, &bus->varsz))) {
   5068 		DHD_ERROR(("%s: si_attach failed!\n", __FUNCTION__));
   5069 		goto fail;
   5070 	}
   5071 
   5072 	bcmsdh_chipinfo(sdh, bus->sih->chip, bus->sih->chiprev);
   5073 
   5074 	if (!dhdsdio_chipmatch((uint16)bus->sih->chip)) {
   5075 		DHD_ERROR(("%s: unsupported chip: 0x%04x\n",
   5076 		           __FUNCTION__, bus->sih->chip));
   5077 		goto fail;
   5078 	}
   5079 
   5080 	si_sdiod_drive_strength_init(bus->sih, osh, dhd_sdiod_drive_strength);
   5081 
   5082 
   5083 	/* Get info on the ARM and SOCRAM cores... */
   5084 	if (!DHD_NOPMU(bus)) {
   5085 		if ((si_setcore(bus->sih, ARM7S_CORE_ID, 0)) ||
   5086 		    (si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
   5087 			bus->armrev = si_corerev(bus->sih);
   5088 		} else {
   5089 			DHD_ERROR(("%s: failed to find ARM core!\n", __FUNCTION__));
   5090 			goto fail;
   5091 		}
   5092 		if (!(bus->orig_ramsize = si_socram_size(bus->sih))) {
   5093 			DHD_ERROR(("%s: failed to find SOCRAM memory!\n", __FUNCTION__));
   5094 			goto fail;
   5095 		}
   5096 		bus->ramsize = bus->orig_ramsize;
   5097 		if (dhd_dongle_memsize)
   5098 			dhd_dongle_setmemsize(bus, dhd_dongle_memsize);
   5099 
   5100 		DHD_ERROR(("DHD: dongle ram size is set to %d(orig %d)\n",
   5101 			bus->ramsize, bus->orig_ramsize));
   5102 	}
   5103 
   5104 	/* ...but normally deal with the SDPCMDEV core */
   5105 	if (!(bus->regs = si_setcore(bus->sih, PCMCIA_CORE_ID, 0)) &&
   5106 	    !(bus->regs = si_setcore(bus->sih, SDIOD_CORE_ID, 0))) {
   5107 		DHD_ERROR(("%s: failed to find SDIODEV core!\n", __FUNCTION__));
   5108 		goto fail;
   5109 	}
   5110 	bus->sdpcmrev = si_corerev(bus->sih);
   5111 
   5112 	/* Set core control so an SDIO reset does a backplane reset */
   5113 	OR_REG(osh, &bus->regs->corecontrol, CC_BPRESEN);
   5114 
   5115 	pktq_init(&bus->txq, (PRIOMASK + 1), QLEN);
   5116 
   5117 	/* Locate an appropriately-aligned portion of hdrbuf */
   5118 	bus->rxhdr = (uint8 *)ROUNDUP((uintptr)&bus->hdrbuf[0], DHD_SDALIGN);
   5119 
   5120 	/* Set the poll and/or interrupt flags */
   5121 	bus->intr = (bool)dhd_intr;
   5122 	if ((bus->poll = (bool)dhd_poll))
   5123 		bus->pollrate = 1;
   5124 
   5125 	return TRUE;
   5126 
   5127 fail:
   5128 	return FALSE;
   5129 }
   5130 
   5131 static bool
   5132 dhdsdio_probe_malloc(dhd_bus_t *bus, osl_t *osh, void *sdh)
   5133 {
   5134 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   5135 
   5136 #ifndef DHD_USE_STATIC_BUF
   5137 	if (bus->dhd->maxctl) {
   5138 		bus->rxblen = ROUNDUP((bus->dhd->maxctl + SDPCM_HDRLEN), ALIGNMENT) + DHD_SDALIGN;
   5139 		if (!(bus->rxbuf = MALLOC(osh, bus->rxblen))) {
   5140 			DHD_ERROR(("%s: MALLOC of %d-byte rxbuf failed\n",
   5141 			           __FUNCTION__, bus->rxblen));
   5142 			goto fail;
   5143 		}
   5144 	}
   5145 
   5146 	/* Allocate buffer to receive glomed packet */
   5147 	if (!(bus->databuf = MALLOC(osh, MAX_DATA_BUF))) {
   5148 		DHD_ERROR(("%s: MALLOC of %d-byte databuf failed\n",
   5149 			__FUNCTION__, MAX_DATA_BUF));
   5150 		/* release rxbuf which was already located as above */
   5151 		if (!bus->rxblen) MFREE(osh, bus->rxbuf, bus->rxblen);
   5152 		goto fail;
   5153 	}
   5154 #else
   5155 	if (bus->dhd->maxctl) {
   5156 		bus->rxblen = ROUNDUP((bus->dhd->maxctl + SDPCM_HDRLEN), ALIGNMENT) + DHD_SDALIGN;
   5157 		if (!(bus->rxbuf = dhd_os_prealloc(DHD_PREALLOC_RXBUF, bus->rxblen))) {
   5158 			DHD_ERROR(("%s: MALLOC of %d-byte rxbuf failed\n",
   5159 			           __FUNCTION__, bus->rxblen));
   5160 			goto fail;
   5161 		}
   5162 	}
   5163 	/* Allocate buffer to receive glomed packet */
   5164 	if (!(bus->databuf = dhd_os_prealloc(DHD_PREALLOC_DATABUF, MAX_DATA_BUF))) {
   5165 		DHD_ERROR(("%s: MALLOC of %d-byte databuf failed\n",
   5166 			__FUNCTION__, MAX_DATA_BUF));
   5167 		goto fail;
   5168 	}
   5169 #endif /* DHD_USE_STATIC_BUF */
   5170 
   5171 	/* Align the buffer */
   5172 	if ((uintptr)bus->databuf % DHD_SDALIGN)
   5173 		bus->dataptr = bus->databuf + (DHD_SDALIGN - ((uintptr)bus->databuf % DHD_SDALIGN));
   5174 	else
   5175 		bus->dataptr = bus->databuf;
   5176 
   5177 	return TRUE;
   5178 
   5179 fail:
   5180 	return FALSE;
   5181 }
   5182 
   5183 
   5184 static bool
   5185 dhdsdio_probe_init(dhd_bus_t *bus, osl_t *osh, void *sdh)
   5186 {
   5187 	int32 fnum;
   5188 
   5189 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   5190 
   5191 #ifdef SDTEST
   5192 	dhdsdio_pktgen_init(bus);
   5193 #endif /* SDTEST */
   5194 
   5195 	/* Disable F2 to clear any intermediate frame state on the dongle */
   5196 	bcmsdh_cfg_write(sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, SDIO_FUNC_ENABLE_1, NULL);
   5197 
   5198 	bus->dhd->busstate = DHD_BUS_DOWN;
   5199 	bus->sleeping = FALSE;
   5200 	bus->rxflow = FALSE;
   5201 	bus->prev_rxlim_hit = 0;
   5202 
   5203 
   5204 	/* Done with backplane-dependent accesses, can drop clock... */
   5205 	bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
   5206 
   5207 	/* ...and initialize clock/power states */
   5208 	bus->clkstate = CLK_SDONLY;
   5209 	bus->idletime = (int32)dhd_idletime;
   5210 	bus->idleclock = DHD_IDLE_ACTIVE;
   5211 
   5212 	/* Query the SD clock speed */
   5213 	if (bcmsdh_iovar_op(sdh, "sd_divisor", NULL, 0,
   5214 	                    &bus->sd_divisor, sizeof(int32), FALSE) != BCME_OK) {
   5215 		DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_divisor"));
   5216 		bus->sd_divisor = -1;
   5217 	} else {
   5218 		DHD_INFO(("%s: Initial value for %s is %d\n",
   5219 		          __FUNCTION__, "sd_divisor", bus->sd_divisor));
   5220 	}
   5221 
   5222 	/* Query the SD bus mode */
   5223 	if (bcmsdh_iovar_op(sdh, "sd_mode", NULL, 0,
   5224 	                    &bus->sd_mode, sizeof(int32), FALSE) != BCME_OK) {
   5225 		DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_mode"));
   5226 		bus->sd_mode = -1;
   5227 	} else {
   5228 		DHD_INFO(("%s: Initial value for %s is %d\n",
   5229 		          __FUNCTION__, "sd_mode", bus->sd_mode));
   5230 	}
   5231 
   5232 	/* Query the F2 block size, set roundup accordingly */
   5233 	fnum = 2;
   5234 	if (bcmsdh_iovar_op(sdh, "sd_blocksize", &fnum, sizeof(int32),
   5235 	                    &bus->blocksize, sizeof(int32), FALSE) != BCME_OK) {
   5236 		bus->blocksize = 0;
   5237 		DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_blocksize"));
   5238 	} else {
   5239 		DHD_INFO(("%s: Initial value for %s is %d\n",
   5240 		          __FUNCTION__, "sd_blocksize", bus->blocksize));
   5241 	}
   5242 	bus->roundup = MIN(max_roundup, bus->blocksize);
   5243 
   5244 	/* Query if bus module supports packet chaining, default to use if supported */
   5245 	if (bcmsdh_iovar_op(sdh, "sd_rxchain", NULL, 0,
   5246 	                    &bus->sd_rxchain, sizeof(int32), FALSE) != BCME_OK) {
   5247 		bus->sd_rxchain = FALSE;
   5248 	} else {
   5249 		DHD_INFO(("%s: bus module (through bcmsdh API) %s chaining\n",
   5250 		          __FUNCTION__, (bus->sd_rxchain ? "supports" : "does not support")));
   5251 	}
   5252 	bus->use_rxchain = (bool)bus->sd_rxchain;
   5253 
   5254 	return TRUE;
   5255 }
   5256 
   5257 bool
   5258 dhd_bus_download_firmware(struct dhd_bus *bus, osl_t *osh,
   5259                           char *fw_path, char *nv_path)
   5260 {
   5261 	bool ret;
   5262 	bus->fw_path = fw_path;
   5263 	bus->nv_path = nv_path;
   5264 
   5265 	ret = dhdsdio_download_firmware(bus, osh, bus->sdh);
   5266 
   5267 	return ret;
   5268 }
   5269 
   5270 static bool
   5271 dhdsdio_download_firmware(struct dhd_bus *bus, osl_t *osh, void *sdh)
   5272 {
   5273 	bool ret;
   5274 
   5275 	/* Download the firmware */
   5276 	dhd_os_wake_lock(bus->dhd);
   5277 	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
   5278 
   5279 	ret = _dhdsdio_download_firmware(bus) == 0;
   5280 
   5281 	dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
   5282 	dhd_os_wake_unlock(bus->dhd);
   5283 	return ret;
   5284 }
   5285 
   5286 /* Detach and free everything */
   5287 static void
   5288 dhdsdio_release(dhd_bus_t *bus, osl_t *osh)
   5289 {
   5290 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   5291 
   5292 	if (bus) {
   5293 		ASSERT(osh);
   5294 
   5295 
   5296 		/* De-register interrupt handler */
   5297 		bcmsdh_intr_disable(bus->sdh);
   5298 		bcmsdh_intr_dereg(bus->sdh);
   5299 
   5300 		if (bus->dhd) {
   5301 
   5302 			dhdsdio_release_dongle(bus, osh);
   5303 
   5304 			dhd_detach(bus->dhd);
   5305 			bus->dhd = NULL;
   5306 		}
   5307 
   5308 		dhdsdio_release_malloc(bus, osh);
   5309 
   5310 
   5311 		MFREE(osh, bus, sizeof(dhd_bus_t));
   5312 	}
   5313 
   5314 	if (osh)
   5315 		dhd_osl_detach(osh);
   5316 
   5317 	DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
   5318 }
   5319 
   5320 static void
   5321 dhdsdio_release_malloc(dhd_bus_t *bus, osl_t *osh)
   5322 {
   5323 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   5324 
   5325 	if (bus->dhd && bus->dhd->dongle_reset)
   5326 		return;
   5327 
   5328 	if (bus->rxbuf) {
   5329 #ifndef DHD_USE_STATIC_BUF
   5330 		MFREE(osh, bus->rxbuf, bus->rxblen);
   5331 #endif
   5332 		bus->rxctl = bus->rxbuf = NULL;
   5333 		bus->rxlen = 0;
   5334 	}
   5335 
   5336 	if (bus->databuf) {
   5337 #ifndef DHD_USE_STATIC_BUF
   5338 		MFREE(osh, bus->databuf, MAX_DATA_BUF);
   5339 #endif
   5340 		bus->databuf = NULL;
   5341 	}
   5342 }
   5343 
   5344 
   5345 static void
   5346 dhdsdio_release_dongle(dhd_bus_t *bus, osl_t *osh)
   5347 {
   5348 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   5349 
   5350 	if (bus->dhd && bus->dhd->dongle_reset)
   5351 		return;
   5352 
   5353 	if (bus->sih) {
   5354 		dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
   5355 #if !defined(BCMLXSDMMC)
   5356 		si_watchdog(bus->sih, 4);
   5357 #endif /* !defined(BCMLXSDMMC) */
   5358 		dhdsdio_clkctl(bus, CLK_NONE, FALSE);
   5359 		si_detach(bus->sih);
   5360 		if (bus->vars && bus->varsz)
   5361 			MFREE(osh, bus->vars, bus->varsz);
   5362 		bus->vars = NULL;
   5363 	}
   5364 
   5365 	DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
   5366 }
   5367 
   5368 static void
   5369 dhdsdio_disconnect(void *ptr)
   5370 {
   5371 	dhd_bus_t *bus = (dhd_bus_t *)ptr;
   5372 
   5373 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   5374 
   5375 	if (bus) {
   5376 		ASSERT(bus->dhd);
   5377 		dhdsdio_release(bus, bus->dhd->osh);
   5378 	}
   5379 
   5380 	DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
   5381 }
   5382 
   5383 
   5384 /* Register/Unregister functions are called by the main DHD entry
   5385  * point (e.g. module insertion) to link with the bus driver, in
   5386  * order to look for or await the device.
   5387  */
   5388 
   5389 static bcmsdh_driver_t dhd_sdio = {
   5390 	dhdsdio_probe,
   5391 	dhdsdio_disconnect
   5392 };
   5393 
   5394 int
   5395 dhd_bus_register(void)
   5396 {
   5397 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   5398 
   5399 	return bcmsdh_register(&dhd_sdio);
   5400 }
   5401 
   5402 void
   5403 dhd_bus_unregister(void)
   5404 {
   5405 	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
   5406 
   5407 	bcmsdh_unregister();
   5408 }
   5409 
   5410 #ifdef BCMEMBEDIMAGE
   5411 static int
   5412 dhdsdio_download_code_array(struct dhd_bus *bus)
   5413 {
   5414 	int bcmerror = -1;
   5415 	int offset = 0;
   5416 
   5417 	DHD_INFO(("%s: download embedded firmware...\n", __FUNCTION__));
   5418 
   5419 	/* Download image */
   5420 	while ((offset + MEMBLOCK) < sizeof(dlarray)) {
   5421 		bcmerror = dhdsdio_membytes(bus, TRUE, offset, dlarray + offset, MEMBLOCK);
   5422 		if (bcmerror) {
   5423 			DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
   5424 			        __FUNCTION__, bcmerror, MEMBLOCK, offset));
   5425 			goto err;
   5426 		}
   5427 
   5428 		offset += MEMBLOCK;
   5429 	}
   5430 
   5431 	if (offset < sizeof(dlarray)) {
   5432 		bcmerror = dhdsdio_membytes(bus, TRUE, offset,
   5433 			dlarray + offset, sizeof(dlarray) - offset);
   5434 		if (bcmerror) {
   5435 			DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
   5436 			        __FUNCTION__, bcmerror, sizeof(dlarray) - offset, offset));
   5437 			goto err;
   5438 		}
   5439 	}
   5440 
   5441 #ifdef DHD_DEBUG
   5442 	/* Upload and compare the downloaded code */
   5443 	{
   5444 		unsigned char *ularray;
   5445 
   5446 		ularray = MALLOC(bus->dhd->osh, bus->ramsize);
   5447 		/* Upload image to verify downloaded contents. */
   5448 		offset = 0;
   5449 		memset(ularray, 0xaa, bus->ramsize);
   5450 		while ((offset + MEMBLOCK) < sizeof(dlarray)) {
   5451 			bcmerror = dhdsdio_membytes(bus, FALSE, offset, ularray + offset, MEMBLOCK);
   5452 			if (bcmerror) {
   5453 				DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
   5454 					__FUNCTION__, bcmerror, MEMBLOCK, offset));
   5455 				goto err;
   5456 			}
   5457 
   5458 			offset += MEMBLOCK;
   5459 		}
   5460 
   5461 		if (offset < sizeof(dlarray)) {
   5462 			bcmerror = dhdsdio_membytes(bus, FALSE, offset,
   5463 				ularray + offset, sizeof(dlarray) - offset);
   5464 			if (bcmerror) {
   5465 				DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
   5466 					__FUNCTION__, bcmerror, sizeof(dlarray) - offset, offset));
   5467 				goto err;
   5468 			}
   5469 		}
   5470 
   5471 		if (memcmp(dlarray, ularray, sizeof(dlarray))) {
   5472 			DHD_ERROR(("%s: Downloaded image is corrupted.\n", __FUNCTION__));
   5473 			ASSERT(0);
   5474 			goto err;
   5475 		} else
   5476 			DHD_ERROR(("%s: Download, Upload and compare succeeded.\n", __FUNCTION__));
   5477 
   5478 		MFREE(bus->dhd->osh, ularray, bus->ramsize);
   5479 	}
   5480 #endif /* DHD_DEBUG */
   5481 
   5482 err:
   5483 	return bcmerror;
   5484 }
   5485 #endif /* BCMEMBEDIMAGE */
   5486 
   5487 static int
   5488 dhdsdio_download_code_file(struct dhd_bus *bus, char *fw_path)
   5489 {
   5490 	int bcmerror = -1;
   5491 	int offset = 0;
   5492 	uint len;
   5493 	void *image = NULL;
   5494 	uint8 *memblock = NULL, *memptr;
   5495 
   5496 	DHD_INFO(("%s: download firmware %s\n", __FUNCTION__, fw_path));
   5497 
   5498 	image = dhd_os_open_image(fw_path);
   5499 	if (image == NULL)
   5500 		goto err;
   5501 
   5502 	memptr = memblock = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
   5503 	if (memblock == NULL) {
   5504 		DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
   5505 		goto err;
   5506 	}
   5507 	if ((uint32)(uintptr)memblock % DHD_SDALIGN)
   5508 		memptr += (DHD_SDALIGN - ((uint32)(uintptr)memblock % DHD_SDALIGN));
   5509 
   5510 	/* Download image */
   5511 	while ((len = dhd_os_get_image_block((char*)memptr, MEMBLOCK, image))) {
   5512 		bcmerror = dhdsdio_membytes(bus, TRUE, offset, memptr, len);
   5513 		if (bcmerror) {
   5514 			DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
   5515 			        __FUNCTION__, bcmerror, MEMBLOCK, offset));
   5516 			goto err;
   5517 		}
   5518 
   5519 		offset += MEMBLOCK;
   5520 	}
   5521 
   5522 err:
   5523 	if (memblock)
   5524 		MFREE(bus->dhd->osh, memblock, MEMBLOCK + DHD_SDALIGN);
   5525 
   5526 	if (image)
   5527 		dhd_os_close_image(image);
   5528 
   5529 	return bcmerror;
   5530 }
   5531 
   5532 /*
   5533  * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file and ending in a NUL.
   5534  * Removes carriage returns, empty lines, comment lines, and converts newlines to NULs.
   5535  * Shortens buffer as needed and pads with NULs.  End of buffer is marked by two NULs.
   5536 */
   5537 
   5538 static uint
   5539 process_nvram_vars(char *varbuf, uint len)
   5540 {
   5541 	char *dp;
   5542 	bool findNewline;
   5543 	int column;
   5544 	uint buf_len, n;
   5545 
   5546 	dp = varbuf;
   5547 
   5548 	findNewline = FALSE;
   5549 	column = 0;
   5550 
   5551 	for (n = 0; n < len; n++) {
   5552 		if (varbuf[n] == 0)
   5553 			break;
   5554 		if (varbuf[n] == '\r')
   5555 			continue;
   5556 		if (findNewline && varbuf[n] != '\n')
   5557 			continue;
   5558 		findNewline = FALSE;
   5559 		if (varbuf[n] == '#') {
   5560 			findNewline = TRUE;
   5561 			continue;
   5562 		}
   5563 		if (varbuf[n] == '\n') {
   5564 			if (column == 0)
   5565 				continue;
   5566 			*dp++ = 0;
   5567 			column = 0;
   5568 			continue;
   5569 		}
   5570 		*dp++ = varbuf[n];
   5571 		column++;
   5572 	}
   5573 	buf_len = dp - varbuf;
   5574 
   5575 	while (dp < varbuf + n)
   5576 		*dp++ = 0;
   5577 
   5578 	return buf_len;
   5579 }
   5580 
   5581 /*
   5582 	EXAMPLE: nvram_array
   5583 	nvram_arry format:
   5584 	name=value
   5585 	Use carriage return at the end of each assignment, and an empty string with
   5586 	carriage return at the end of array.
   5587 
   5588 	For example:
   5589 	unsigned char  nvram_array[] = {"name1=value1\n", "name2=value2\n", "\n"};
   5590 	Hex values start with 0x, and mac addr format: xx:xx:xx:xx:xx:xx.
   5591 
   5592 	Search "EXAMPLE: nvram_array" to see how the array is activated.
   5593 */
   5594 
   5595 void
   5596 dhd_bus_set_nvram_params(struct dhd_bus * bus, const char *nvram_params)
   5597 {
   5598 	bus->nvram_params = nvram_params;
   5599 }
   5600 
   5601 static int
   5602 dhdsdio_download_nvram(struct dhd_bus *bus)
   5603 {
   5604 	int bcmerror = -1;
   5605 	uint len;
   5606 	void * image = NULL;
   5607 	char * memblock = NULL;
   5608 	char *bufp;
   5609 	char *nv_path;
   5610 	bool nvram_file_exists;
   5611 
   5612 	nv_path = bus->nv_path;
   5613 
   5614 	nvram_file_exists = ((nv_path != NULL) && (nv_path[0] != '\0'));
   5615 	if (!nvram_file_exists && (bus->nvram_params == NULL))
   5616 		return (0);
   5617 
   5618 	if (nvram_file_exists) {
   5619 		image = dhd_os_open_image(nv_path);
   5620 		if (image == NULL)
   5621 			goto err;
   5622 	}
   5623 
   5624 	memblock = MALLOC(bus->dhd->osh, MEMBLOCK);
   5625 	if (memblock == NULL) {
   5626 		DHD_ERROR(("%s: Failed to allocate memory %d bytes\n",
   5627 		           __FUNCTION__, MEMBLOCK));
   5628 		goto err;
   5629 	}
   5630 
   5631 	/* Download variables */
   5632 	if (nvram_file_exists) {
   5633 		len = dhd_os_get_image_block(memblock, MEMBLOCK, image);
   5634 	}
   5635 	else {
   5636 		len = strlen(bus->nvram_params);
   5637 		ASSERT(len <= MEMBLOCK);
   5638 		if (len > MEMBLOCK)
   5639 			len = MEMBLOCK;
   5640 		memcpy(memblock, bus->nvram_params, len);
   5641 	}
   5642 
   5643 	if (len > 0 && len < MEMBLOCK) {
   5644 		bufp = (char *)memblock;
   5645 		bufp[len] = 0;
   5646 		len = process_nvram_vars(bufp, len);
   5647 		bufp += len;
   5648 		*bufp++ = 0;
   5649 		if (len)
   5650 			bcmerror = dhdsdio_downloadvars(bus, memblock, len + 1);
   5651 		if (bcmerror) {
   5652 			DHD_ERROR(("%s: error downloading vars: %d\n",
   5653 			           __FUNCTION__, bcmerror));
   5654 		}
   5655 	}
   5656 	else {
   5657 		DHD_ERROR(("%s: error reading nvram file: %d\n",
   5658 		           __FUNCTION__, len));
   5659 		bcmerror = BCME_SDIO_ERROR;
   5660 	}
   5661 
   5662 err:
   5663 	if (memblock)
   5664 		MFREE(bus->dhd->osh, memblock, MEMBLOCK);
   5665 
   5666 	if (image)
   5667 		dhd_os_close_image(image);
   5668 
   5669 	return bcmerror;
   5670 }
   5671 
   5672 static int
   5673 _dhdsdio_download_firmware(struct dhd_bus *bus)
   5674 {
   5675 	int bcmerror = -1;
   5676 
   5677 	bool embed = FALSE;	/* download embedded firmware */
   5678 	bool dlok = FALSE;	/* download firmware succeeded */
   5679 
   5680 	/* Out immediately if no image to download */
   5681 	if ((bus->fw_path == NULL) || (bus->fw_path[0] == '\0')) {
   5682 #ifdef BCMEMBEDIMAGE
   5683 		embed = TRUE;
   5684 #else
   5685 		return bcmerror;
   5686 #endif
   5687 	}
   5688 
   5689 	/* Keep arm in reset */
   5690 	if (dhdsdio_download_state(bus, TRUE)) {
   5691 		DHD_ERROR(("%s: error placing ARM core in reset\n", __FUNCTION__));
   5692 		goto err;
   5693 	}
   5694 
   5695 	/* External image takes precedence if specified */
   5696 	if ((bus->fw_path != NULL) && (bus->fw_path[0] != '\0')) {
   5697 		if (dhdsdio_download_code_file(bus, bus->fw_path)) {
   5698 			DHD_ERROR(("%s: dongle image file download failed\n", __FUNCTION__));
   5699 #ifdef BCMEMBEDIMAGE
   5700 			embed = TRUE;
   5701 #else
   5702 			goto err;
   5703 #endif
   5704 		}
   5705 		else {
   5706 			embed = FALSE;
   5707 			dlok = TRUE;
   5708 		}
   5709 	}
   5710 #ifdef BCMEMBEDIMAGE
   5711 	if (embed) {
   5712 		if (dhdsdio_download_code_array(bus)) {
   5713 			DHD_ERROR(("%s: dongle image array download failed\n", __FUNCTION__));
   5714 			goto err;
   5715 		}
   5716 		else {
   5717 			dlok = TRUE;
   5718 		}
   5719 	}
   5720 #endif
   5721 	if (!dlok) {
   5722 		DHD_ERROR(("%s: dongle image download failed\n", __FUNCTION__));
   5723 		goto err;
   5724 	}
   5725 
   5726 	/* EXAMPLE: nvram_array */
   5727 	/* If a valid nvram_arry is specified as above, it can be passed down to dongle */
   5728 	/* dhd_bus_set_nvram_params(bus, (char *)&nvram_array); */
   5729 
   5730 	/* External nvram takes precedence if specified */
   5731 	if (dhdsdio_download_nvram(bus)) {
   5732 		DHD_ERROR(("%s: dongle nvram file download failed\n", __FUNCTION__));
   5733 	}
   5734 
   5735 	/* Take arm out of reset */
   5736 	if (dhdsdio_download_state(bus, FALSE)) {
   5737 		DHD_ERROR(("%s: error getting out of ARM core reset\n", __FUNCTION__));
   5738 		goto err;
   5739 	}
   5740 
   5741 	bcmerror = 0;
   5742 
   5743 err:
   5744 	return bcmerror;
   5745 }
   5746 
   5747 static int
   5748 dhd_bcmsdh_recv_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags, uint8 *buf, uint nbytes,
   5749 	void *pkt, bcmsdh_cmplt_fn_t complete, void *handle)
   5750 {
   5751 	int status;
   5752 
   5753 	/* 4329: GSPI check */
   5754 	status = bcmsdh_recv_buf(bus->sdh, addr, fn, flags, buf, nbytes, pkt, complete, handle);
   5755 	return status;
   5756 }
   5757 
   5758 static int
   5759 dhd_bcmsdh_send_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags, uint8 *buf, uint nbytes,
   5760 	void *pkt, bcmsdh_cmplt_fn_t complete, void *handle)
   5761 {
   5762 	return (bcmsdh_send_buf(bus->sdh, addr, fn, flags, buf, nbytes, pkt, complete, handle));
   5763 }
   5764 
   5765 uint
   5766 dhd_bus_chip(struct dhd_bus *bus)
   5767 {
   5768 	ASSERT(bus->sih != NULL);
   5769 	return bus->sih->chip;
   5770 }
   5771 
   5772 void *
   5773 dhd_bus_pub(struct dhd_bus *bus)
   5774 {
   5775 	return bus->dhd;
   5776 }
   5777 
   5778 void *
   5779 dhd_bus_txq(struct dhd_bus *bus)
   5780 {
   5781 	return &bus->txq;
   5782 }
   5783 
   5784 uint
   5785 dhd_bus_hdrlen(struct dhd_bus *bus)
   5786 {
   5787 	return SDPCM_HDRLEN;
   5788 }
   5789 
   5790 int
   5791 dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag)
   5792 {
   5793 	int bcmerror = 0;
   5794 	dhd_bus_t *bus;
   5795 
   5796 	bus = dhdp->bus;
   5797 
   5798 	if (flag == TRUE) {
   5799 		if (!bus->dhd->dongle_reset) {
   5800 #if !defined(IGNORE_ETH0_DOWN)
   5801 			/* Force flow control as protection when stop come before ifconfig_down */
   5802 			dhd_txflowcontrol(bus->dhd, 0, ON);
   5803 #endif /* !defined(IGNORE_ETH0_DOWN) */
   5804 			/* save country settinng if was pre-setup with priv ioctl */
   5805 			dhd_os_proto_block(dhdp);
   5806 			dhdcdc_query_ioctl(bus->dhd, 0, WLC_GET_COUNTRY,
   5807 				bus->dhd->country_code, sizeof(bus->dhd->country_code));
   5808 			dhd_os_proto_unblock(dhdp);
   5809 			/* Expect app to have torn down any connection before calling */
   5810 			/* Stop the bus, disable F2 */
   5811 			dhd_os_sdlock(dhdp);
   5812 
   5813 			dhd_bus_stop(bus, FALSE);
   5814 
   5815 			/* Clean tx/rx buffer pointers, detach from the dongle */
   5816 			dhdsdio_release_dongle(bus, bus->dhd->osh);
   5817 
   5818 			bus->dhd->dongle_reset = TRUE;
   5819 			bus->dhd->up = FALSE;
   5820 
   5821 			dhd_os_sdunlock(dhdp);
   5822 
   5823 			DHD_TRACE(("%s:  WLAN OFF DONE\n", __FUNCTION__));
   5824 			/* App can now remove power from device */
   5825 		} else
   5826 			bcmerror = BCME_SDIO_ERROR;
   5827 	} else {
   5828 		/* App must have restored power to device before calling */
   5829 
   5830 		DHD_TRACE(("\n\n%s: == WLAN ON ==\n", __FUNCTION__));
   5831 
   5832 		if (bus->dhd->dongle_reset) {
   5833 			/* Turn on WLAN */
   5834 			dhd_os_sdlock(dhdp);
   5835 
   5836 			/* Reset SD client */
   5837 			bcmsdh_reset(bus->sdh);
   5838 
   5839 			/* Attempt to re-attach & download */
   5840 			if (dhdsdio_probe_attach(bus, bus->dhd->osh, bus->sdh,
   5841 			                        (uint32 *)SI_ENUM_BASE,
   5842 			                        bus->cl_devid)) {
   5843 				/* Attempt to download binary to the dongle */
   5844 				if (dhdsdio_probe_init(bus, bus->dhd->osh, bus->sdh) &&
   5845 					dhdsdio_download_firmware(bus, bus->dhd->osh, bus->sdh)) {
   5846 
   5847 					/* Re-init bus, enable F2 transfer */
   5848 					dhd_bus_init((dhd_pub_t *) bus->dhd, FALSE);
   5849 
   5850 #if defined(OOB_INTR_ONLY)
   5851 					dhd_enable_oob_intr(bus, TRUE);
   5852 #endif /* defined(OOB_INTR_ONLY) */
   5853 
   5854 					bus->dhd->dongle_reset = FALSE;
   5855 					bus->dhd->up = TRUE;
   5856 
   5857 #if !defined(IGNORE_ETH0_DOWN)
   5858 					/* Restore flow control  */
   5859 					dhd_txflowcontrol(bus->dhd, 0, OFF);
   5860 #endif
   5861 
   5862 					DHD_TRACE(("%s: WLAN ON DONE\n", __FUNCTION__));
   5863 				} else
   5864 					bcmerror = BCME_SDIO_ERROR;
   5865 			} else
   5866 				bcmerror = BCME_SDIO_ERROR;
   5867 			dhd_os_sdunlock(dhdp);
   5868 		} else {
   5869 			bcmerror = BCME_NOTDOWN;
   5870 			DHD_ERROR(("%s: Set DEVRESET=FALSE invoked when device is on\n",
   5871 				__FUNCTION__));
   5872 			bcmerror = BCME_SDIO_ERROR;
   5873 		}
   5874 	}
   5875 	return bcmerror;
   5876 }
   5877