Home | History | Annotate | Line # | Download | only in sdmmc
if_bwfm_sdio.c revision 1.21
      1 /* $NetBSD: if_bwfm_sdio.c,v 1.21 2020/07/20 06:47:02 mrg Exp $ */
      2 /* $OpenBSD: if_bwfm_sdio.c,v 1.1 2017/10/11 17:19:50 patrick Exp $ */
      3 /*
      4  * Copyright (c) 2010-2016 Broadcom Corporation
      5  * Copyright (c) 2016,2017 Patrick Wildt <patrick (at) blueri.se>
      6  *
      7  * Permission to use, copy, modify, and/or distribute this software for any
      8  * purpose with or without fee is hereby granted, provided that the above
      9  * copyright notice and this permission notice appear in all copies.
     10  *
     11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
     12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
     13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
     14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
     15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
     16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
     17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
     18  */
     19 
     20 #include <sys/param.h>
     21 #include <sys/systm.h>
     22 #include <sys/buf.h>
     23 #include <sys/endian.h>
     24 #include <sys/kernel.h>
     25 #include <sys/malloc.h>
     26 #include <sys/device.h>
     27 #include <sys/queue.h>
     28 #include <sys/socket.h>
     29 #include <sys/mutex.h>
     30 
     31 #include <net/bpf.h>
     32 #include <net/if.h>
     33 #include <net/if_dl.h>
     34 #include <net/if_media.h>
     35 #include <net/if_ether.h>
     36 
     37 #include <netinet/in.h>
     38 
     39 #include <dev/ofw/openfirm.h>
     40 #include <dev/fdt/fdtvar.h>
     41 
     42 #include <net80211/ieee80211_var.h>
     43 
     44 #include <dev/sdmmc/sdmmcdevs.h>
     45 #include <dev/sdmmc/sdmmcvar.h>
     46 
     47 #include <dev/ic/bwfmreg.h>
     48 #include <dev/ic/bwfmvar.h>
     49 #include <dev/sdmmc/if_bwfm_sdio.h>
     50 
     51 #ifdef BWFM_DEBUG
     52 #define DPRINTF(x)	do { if (bwfm_debug > 0) printf x; } while (0)
     53 #define DPRINTFN(n, x)	do { if (bwfm_debug >= (n)) printf x; } while (0)
     54 static int bwfm_debug = 2;
     55 #else
     56 #define DPRINTF(x)	do { ; } while (0)
     57 #define DPRINTFN(n, x)	do { ; } while (0)
     58 #endif
     59 
     60 #define DEVNAME(sc)	device_xname((sc)->sc_sc.sc_dev)
     61 
     62 enum bwfm_sdio_clkstate {
     63 	CLK_NONE,
     64 	CLK_SDONLY,
     65 	CLK_PENDING,
     66 	CLK_AVAIL
     67 };
     68 
     69 struct bwfm_sdio_softc {
     70 	struct bwfm_softc	sc_sc;
     71 	kmutex_t		sc_lock;
     72 
     73 	bool			sc_bwfm_attached;
     74 
     75 	struct sdmmc_function	**sc_sf;
     76 	size_t			sc_sf_size;
     77 
     78 	uint32_t		sc_bar0;
     79 	enum bwfm_sdio_clkstate	sc_clkstate;
     80 	bool			sc_sr_enabled;
     81 	bool			sc_alp_only;
     82 	bool			sc_sleeping;
     83 	bool			sc_rxskip;
     84 
     85 	struct sdmmc_task	sc_task;
     86 	bool			sc_task_queued;
     87 
     88 	uint8_t			sc_tx_seq;
     89 	uint8_t			sc_tx_max_seq;
     90 	int			sc_tx_count;
     91 	MBUFQ_HEAD()		sc_tx_queue;
     92 
     93 	struct mbuf		*sc_rxctl_queue;
     94 	kcondvar_t		sc_rxctl_cv;
     95 
     96 	void			*sc_ih;
     97 	struct bwfm_core	*sc_cc;
     98 
     99 	char			*sc_bounce_buf;
    100 	size_t			sc_bounce_size;
    101 
    102 	uint32_t		sc_console_addr;
    103 	char			*sc_console_buf;
    104 	size_t			sc_console_buf_size;
    105 	uint32_t		sc_console_readidx;
    106 
    107 	int			sc_phandle;
    108 	void			*sc_fdtih;
    109 };
    110 
    111 static int	bwfm_sdio_match(device_t, cfdata_t, void *);
    112 static void	bwfm_sdio_attach(device_t, device_t, void *);
    113 static int	bwfm_sdio_detach(device_t, int);
    114 static void	bwfm_sdio_attachhook(device_t);
    115 static int	bwfm_fdt_find_phandle(device_t, device_t);
    116 static const char *bwfm_fdt_get_model(void);
    117 
    118 static void	bwfm_sdio_backplane(struct bwfm_sdio_softc *, uint32_t);
    119 static uint8_t	bwfm_sdio_read_1(struct bwfm_sdio_softc *, uint32_t);
    120 static uint32_t	bwfm_sdio_read_4(struct bwfm_sdio_softc *, uint32_t);
    121 static void	bwfm_sdio_write_1(struct bwfm_sdio_softc *, uint32_t,
    122 		     uint8_t);
    123 static void	bwfm_sdio_write_4(struct bwfm_sdio_softc *, uint32_t,
    124 		     uint32_t);
    125 
    126 static uint32_t	bwfm_sdio_dev_read(struct bwfm_sdio_softc *, uint32_t);
    127 static void	bwfm_sdio_dev_write(struct bwfm_sdio_softc *, uint32_t,
    128 		     uint32_t);
    129 
    130 static uint32_t	bwfm_sdio_buscore_read(struct bwfm_softc *, uint32_t);
    131 static void	bwfm_sdio_buscore_write(struct bwfm_softc *, uint32_t,
    132 		     uint32_t);
    133 static int	bwfm_sdio_buscore_prepare(struct bwfm_softc *);
    134 static void	bwfm_sdio_buscore_activate(struct bwfm_softc *, uint32_t);
    135 
    136 static int	bwfm_sdio_buf_read(struct bwfm_sdio_softc *,
    137 		    struct sdmmc_function *, uint32_t, char *, size_t);
    138 static int	bwfm_sdio_buf_write(struct bwfm_sdio_softc *,
    139 		    struct sdmmc_function *, uint32_t, char *, size_t);
    140 
    141 static struct mbuf	*bwfm_sdio_newbuf(void);
    142 static void		bwfm_qput(struct mbuf **, struct mbuf *);
    143 static struct mbuf	*bwfm_qget(struct mbuf **);
    144 
    145 static uint32_t	bwfm_sdio_ram_read_write(struct bwfm_sdio_softc *,
    146 		    uint32_t, char *, size_t, int);
    147 static uint32_t	bwfm_sdio_frame_read_write(struct bwfm_sdio_softc *,
    148 		    char *, size_t, int);
    149 
    150 static int	bwfm_sdio_intr1(void *, const char *);
    151 static int	bwfm_sdio_intr(void *);
    152 static void	bwfm_sdio_task(void *);
    153 static void	bwfm_sdio_task1(struct bwfm_sdio_softc *);
    154 
    155 static int	bwfm_nvram_convert(u_char *, size_t, size_t *);
    156 static int	bwfm_sdio_load_microcode(struct bwfm_sdio_softc *,
    157 		    u_char *, size_t, u_char *, size_t);
    158 static void	bwfm_sdio_clkctl(struct bwfm_sdio_softc *,
    159 		    enum bwfm_sdio_clkstate, bool);
    160 static void	bwfm_sdio_htclk(struct bwfm_sdio_softc *, bool, bool);
    161 
    162 #ifdef notyet
    163 static int	bwfm_sdio_bus_sleep(struct bwfm_sdio_softc *, bool, bool);
    164 #endif
    165 static void	bwfm_sdio_drivestrength(struct bwfm_sdio_softc *, unsigned);
    166 static void	bwfm_sdio_readshared(struct bwfm_sdio_softc *);
    167 
    168 static int	bwfm_sdio_txcheck(struct bwfm_softc *);
    169 static int	bwfm_sdio_txdata(struct bwfm_softc *, struct mbuf **);
    170 static int	bwfm_sdio_txctl(struct bwfm_softc *, char *, size_t);
    171 static int	bwfm_sdio_rxctl(struct bwfm_softc *, char *, size_t *);
    172 
    173 static int		bwfm_sdio_tx_ok(struct bwfm_sdio_softc *);
    174 static void	bwfm_sdio_tx_frames(struct bwfm_sdio_softc *);
    175 static void	bwfm_sdio_tx_ctrlframe(struct bwfm_sdio_softc *,
    176 		    struct mbuf *);
    177 static void	bwfm_sdio_tx_dataframe(struct bwfm_sdio_softc *,
    178 		    struct mbuf *);
    179 
    180 static void	bwfm_sdio_rx_frames(struct bwfm_sdio_softc *);
    181 static void	bwfm_sdio_rx_glom(struct bwfm_sdio_softc *,
    182 		    uint16_t *, int, uint16_t *);
    183 
    184 #ifdef BWFM_DEBUG
    185 static void	bwfm_sdio_debug_console(struct bwfm_sdio_softc *);
    186 #endif
    187 
    188 static const struct bwfm_firmware_selector bwfm_sdio_fwtab[] = {
    189 	BWFM_FW_ENTRY(BRCM_CC_43143_CHIP_ID,
    190 		      BWFM_FWSEL_ALLREVS, "brcmfmac43143-sdio"),
    191 
    192 	BWFM_FW_ENTRY(BRCM_CC_43241_CHIP_ID,
    193 		      BWFM_FWSEL_REV_LE(4), "brcmfmac43241b0-sdio"),
    194 	BWFM_FW_ENTRY(BRCM_CC_43241_CHIP_ID,
    195 		      BWFM_FWSEL_REV_EQ(5), "brcmfmac43241b4-sdio"),
    196 	BWFM_FW_ENTRY(BRCM_CC_43241_CHIP_ID,
    197 		      BWFM_FWSEL_REV_GE(6), "brcmfmac43241b5-sdio"),
    198 
    199 	BWFM_FW_ENTRY(BRCM_CC_4329_CHIP_ID,
    200 		      BWFM_FWSEL_ALLREVS, "brcmfmac4329-sdio"),
    201 
    202 	BWFM_FW_ENTRY(BRCM_CC_4330_CHIP_ID,
    203 		      BWFM_FWSEL_ALLREVS, "brcmfmac4330-sdio"),
    204 
    205 	BWFM_FW_ENTRY(BRCM_CC_4334_CHIP_ID,
    206 		      BWFM_FWSEL_ALLREVS, "brcmfmac4334-sdio"),
    207 
    208 	BWFM_FW_ENTRY(BRCM_CC_43340_CHIP_ID,
    209 		      BWFM_FWSEL_ALLREVS, "brcmfmac43340-sdio"),
    210 	BWFM_FW_ENTRY(BRCM_CC_43341_CHIP_ID,
    211 		      BWFM_FWSEL_ALLREVS, "brcmfmac43340-sdio"),
    212 
    213 	BWFM_FW_ENTRY(BRCM_CC_4335_CHIP_ID,
    214 		      BWFM_FWSEL_ALLREVS, "brcmfmac4335-sdio"),
    215 
    216 	BWFM_FW_ENTRY(BRCM_CC_43362_CHIP_ID,
    217 		      BWFM_FWSEL_REV_GE(1), "brcmfmac43362-sdio"),
    218 
    219 	BWFM_FW_ENTRY(BRCM_CC_4339_CHIP_ID,
    220 		      BWFM_FWSEL_ALLREVS, "brcmfmac4339-sdio"),
    221 
    222 	BWFM_FW_ENTRY(BRCM_CC_43430_CHIP_ID,
    223 		      BWFM_FWSEL_REV_EQ(0), "brcmfmac43430a0-sdio"),
    224 	BWFM_FW_ENTRY(BRCM_CC_43430_CHIP_ID,
    225 		      BWFM_FWSEL_REV_GE(1), "brcmfmac43430-sdio"),
    226 
    227 	BWFM_FW_ENTRY(BRCM_CC_4345_CHIP_ID,
    228 		      BWFM_FWSEL_REV_EQ(9), "brcmfmac43456-sdio"),
    229 	BWFM_FW_ENTRY(BRCM_CC_4345_CHIP_ID,
    230 		      BWFM_FWSEL_REV_LE(8) + BWFM_FWSEL_REV_GE(10),
    231 		      "brcmfmac43455-sdio"),
    232 
    233 	BWFM_FW_ENTRY(BRCM_CC_4354_CHIP_ID,
    234 		      BWFM_FWSEL_ALLREVS, "brcmfmac4354-sdio"),
    235 
    236 	BWFM_FW_ENTRY(BRCM_CC_4356_CHIP_ID,
    237 		      BWFM_FWSEL_ALLREVS, "brcmfmac4356-sdio"),
    238 
    239 	BWFM_FW_ENTRY(CY_CC_4373_CHIP_ID,
    240 		      BWFM_FWSEL_ALLREVS, "brcmfmac4373-sdio"),
    241 
    242 	BWFM_FW_ENTRY(CY_CC_43012_CHIP_ID,
    243 		      BWFM_FWSEL_ALLREVS, "brcmfmac43012-sdio"),
    244 
    245 	BWFM_FW_ENTRY_END
    246 };
    247 
    248 static const struct bwfm_bus_ops bwfm_sdio_bus_ops = {
    249 	.bs_init = NULL,
    250 	.bs_stop = NULL,
    251 	.bs_txcheck = bwfm_sdio_txcheck,
    252 	.bs_txdata = bwfm_sdio_txdata,
    253 	.bs_txctl = bwfm_sdio_txctl,
    254 	.bs_rxctl = bwfm_sdio_rxctl,
    255 };
    256 
    257 static const struct bwfm_buscore_ops bwfm_sdio_buscore_ops = {
    258 	.bc_read = bwfm_sdio_buscore_read,
    259 	.bc_write = bwfm_sdio_buscore_write,
    260 	.bc_prepare = bwfm_sdio_buscore_prepare,
    261 	.bc_reset = NULL,
    262 	.bc_setup = NULL,
    263 	.bc_activate = bwfm_sdio_buscore_activate,
    264 };
    265 
    266 CFATTACH_DECL_NEW(bwfm_sdio, sizeof(struct bwfm_sdio_softc),
    267     bwfm_sdio_match, bwfm_sdio_attach, bwfm_sdio_detach, NULL);
    268 
    269 static const struct bwfm_sdio_product {
    270 	uint32_t	manufacturer;
    271 	uint32_t	product;
    272 	const char	*cisinfo[4];
    273 } bwfm_sdio_products[] = {
    274 	{
    275 		SDMMC_VENDOR_BROADCOM,
    276 		SDMMC_PRODUCT_BROADCOM_BCM4330,
    277 		SDMMC_CIS_BROADCOM_BCM4330
    278 	},
    279 	{
    280 		SDMMC_VENDOR_BROADCOM,
    281 		SDMMC_PRODUCT_BROADCOM_BCM4334,
    282 		SDMMC_CIS_BROADCOM_BCM4334
    283 	},
    284 	{
    285 		SDMMC_VENDOR_BROADCOM,
    286 		SDMMC_PRODUCT_BROADCOM_BCM43143,
    287 		SDMMC_CIS_BROADCOM_BCM43143
    288 	},
    289 	{
    290 		SDMMC_VENDOR_BROADCOM,
    291 		SDMMC_PRODUCT_BROADCOM_BCM43430,
    292 		SDMMC_CIS_BROADCOM_BCM43430
    293 	},
    294 	{
    295 		SDMMC_VENDOR_BROADCOM,
    296 		SDMMC_PRODUCT_BROADCOM_BCM43455,
    297 		SDMMC_CIS_BROADCOM_BCM43455
    298 	},
    299 	{
    300 		SDMMC_VENDOR_BROADCOM,
    301 		SDMMC_PRODUCT_BROADCOM_BCM43362,
    302 		SDMMC_CIS_BROADCOM_BCM43362
    303 	},
    304 };
    305 
    306 static const char * const compatible[] = {
    307 	"brcm,bcm4329-fmac",
    308 	NULL
    309 };
    310 
    311 static int
    312 bwfm_sdio_match(device_t parent, cfdata_t match, void *aux)
    313 {
    314 	struct sdmmc_attach_args *saa = aux;
    315 	struct sdmmc_function *sf = saa->sf;
    316 	struct sdmmc_cis *cis;
    317 	const struct bwfm_sdio_product *bsp;
    318 	int i;
    319 
    320 	/* Not SDIO. */
    321 	if (sf == NULL)
    322 		return 0;
    323 
    324 	cis = &sf->sc->sc_fn0->cis;
    325 	for (i = 0; i < __arraycount(bwfm_sdio_products); ++i) {
    326 		bsp = &bwfm_sdio_products[i];
    327 		if (cis->manufacturer == bsp->manufacturer &&
    328 		    cis->product == bsp->product)
    329 			break;
    330 	}
    331 	if (i >= __arraycount(bwfm_sdio_products))
    332 		return 0;
    333 
    334 	/* We need both functions, but ... */
    335 	if (sf->sc->sc_function_count <= 1)
    336 		return 0;
    337 
    338 	/* ... only attach for one. */
    339 	if (sf->number != 1)
    340 		return 0;
    341 
    342 	return 1;
    343 }
    344 
    345 static void
    346 bwfm_sdio_attach(device_t parent, device_t self, void *aux)
    347 {
    348 	struct bwfm_sdio_softc *sc = device_private(self);
    349 	struct sdmmc_attach_args *saa = aux;
    350 	struct sdmmc_function *sf = saa->sf;
    351 	struct bwfm_core *core;
    352 	uint32_t reg;
    353 
    354 	sc->sc_sc.sc_dev = self;
    355 
    356 	aprint_naive("\n");
    357 	aprint_normal("\n");
    358 
    359 	sc->sc_phandle = bwfm_fdt_find_phandle(self, parent);
    360 
    361 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_NONE);
    362 	cv_init(&sc->sc_rxctl_cv, "bwfmctl");
    363 
    364 	sdmmc_init_task(&sc->sc_task, bwfm_sdio_task, sc);
    365 
    366 	sc->sc_bounce_size = 64 * 1024;
    367 	sc->sc_bounce_buf = kmem_alloc(sc->sc_bounce_size, KM_SLEEP);
    368 	sc->sc_tx_seq = 0xff;
    369 	MBUFQ_INIT(&sc->sc_tx_queue);
    370 	sc->sc_rxctl_queue = NULL;
    371 
    372 	sc->sc_sf_size = (sf->sc->sc_function_count + 1)
    373 	    * sizeof(struct sdmmc_function *);
    374 	sc->sc_sf = kmem_zalloc(sc->sc_sf_size, KM_SLEEP);
    375 
    376 	/* Copy all function pointers. */
    377 	SIMPLEQ_FOREACH(sf, &saa->sf->sc->sf_head, sf_list) {
    378 		sc->sc_sf[sf->number] = sf;
    379 	}
    380 
    381 	sdmmc_io_set_blocklen(sc->sc_sf[1], 64);
    382 	sdmmc_io_set_blocklen(sc->sc_sf[2], 512);
    383 
    384 	/* Enable Function 1. */
    385 	if (sdmmc_io_function_enable(sc->sc_sf[1]) != 0) {
    386 		printf("%s: cannot enable function 1\n", DEVNAME(sc));
    387 		return;
    388 	}
    389 
    390 	DPRINTF(("%s: F1 signature read @0x18000000=%x\n", DEVNAME(sc),
    391 	    bwfm_sdio_read_4(sc, 0x18000000)));
    392 
    393 	/* Force PLL off */
    394 	bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR,
    395 	    BWFM_SDIO_FUNC1_CHIPCLKCSR_FORCE_HW_CLKREQ_OFF |
    396 	    BWFM_SDIO_FUNC1_CHIPCLKCSR_ALP_AVAIL_REQ);
    397 
    398 	sc->sc_sc.sc_buscore_ops = &bwfm_sdio_buscore_ops;
    399 	if (bwfm_chip_attach(&sc->sc_sc) != 0) {
    400 		aprint_error_dev(self, "cannot attach chip\n");
    401 		return;
    402 	}
    403 
    404 	sc->sc_cc = bwfm_chip_get_core(&sc->sc_sc, BWFM_AGENT_CORE_CHIPCOMMON);
    405 	if (sc->sc_cc == NULL) {
    406 		aprint_error_dev(self, "cannot find chipcommon core\n");
    407 		return;
    408 	}
    409 
    410 	core = bwfm_chip_get_core(&sc->sc_sc, BWFM_AGENT_CORE_SDIO_DEV);
    411 	if (core->co_rev >= 12) {
    412 		reg = bwfm_sdio_read_1(sc, BWFM_SDIO_FUNC1_SLEEPCSR);
    413 		if ((reg & BWFM_SDIO_FUNC1_SLEEPCSR_KSO) == 0) {
    414 			reg |= BWFM_SDIO_FUNC1_SLEEPCSR_KSO;
    415 			bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_SLEEPCSR, reg);
    416 		}
    417 	}
    418 
    419 	/* Default, override from "brcm,drive-strength" */
    420 	bwfm_sdio_drivestrength(sc, 6);
    421 
    422 	bwfm_sdio_write_1(sc, BWFM_SDIO_CCCR_CARDCTRL,
    423 	    bwfm_sdio_read_1(sc, BWFM_SDIO_CCCR_CARDCTRL) |
    424 	    BWFM_SDIO_CCCR_CARDCTRL_WLANRESET);
    425 
    426 	core = bwfm_chip_get_pmu(&sc->sc_sc);
    427 	bwfm_sdio_write_4(sc, core->co_base + BWFM_CHIP_REG_PMUCONTROL,
    428 	    bwfm_sdio_read_4(sc, core->co_base + BWFM_CHIP_REG_PMUCONTROL) |
    429 	    (BWFM_CHIP_REG_PMUCONTROL_RES_RELOAD <<
    430 	     BWFM_CHIP_REG_PMUCONTROL_RES_SHIFT));
    431 
    432 	sdmmc_io_function_disable(sc->sc_sf[2]);
    433 
    434 	bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR, 0);
    435 	sc->sc_clkstate = CLK_SDONLY;
    436 
    437 	config_mountroot(self, bwfm_sdio_attachhook);
    438 }
    439 
    440 static void
    441 bwfm_sdio_attachhook(device_t self)
    442 {
    443 	struct bwfm_sdio_softc *sc = device_private(self);
    444 	struct bwfm_softc *bwfm = &sc->sc_sc;
    445 	struct bwfm_firmware_context fwctx;
    446 	size_t ucsize = 0, nvlen = 0, nvsize = 0;
    447 	uint8_t *ucode, *nvram;
    448 	uint32_t reg, clk;
    449 
    450 	DPRINTF(("%s: chip 0x%08x rev %u\n", DEVNAME(sc),
    451 	    bwfm->sc_chip.ch_chip, bwfm->sc_chip.ch_chiprev));
    452 
    453 	/*
    454 	 * 4335s >= rev 2 are considered 4339s.
    455 	 */
    456 	if (bwfm->sc_chip.ch_chip == BRCM_CC_4335_CHIP_ID &&
    457 	    bwfm->sc_chip.ch_chiprev >= 2)
    458 		bwfm->sc_chip.ch_chip = BRCM_CC_4339_CHIP_ID;
    459 
    460 	bwfm_firmware_context_init(&fwctx,
    461 	    bwfm->sc_chip.ch_chip, bwfm->sc_chip.ch_chiprev,
    462 	    bwfm_fdt_get_model(),
    463 	    BWFM_FWREQ(BWFM_FILETYPE_UCODE) | BWFM_FWREQ(BWFM_FILETYPE_NVRAM));
    464 
    465 	if (!bwfm_firmware_open(bwfm, bwfm_sdio_fwtab, &fwctx)) {
    466 		/* Error message already displayed. */
    467 		goto err;
    468 	}
    469 
    470 	ucode = bwfm_firmware_data(&fwctx, BWFM_FILETYPE_UCODE, &ucsize);
    471 	KASSERT(ucode != NULL);
    472 	nvram = bwfm_firmware_data(&fwctx, BWFM_FILETYPE_NVRAM, &nvlen);
    473 	KASSERT(nvram != NULL);
    474 
    475 	if (bwfm_nvram_convert(nvram, nvlen, &nvsize)) {
    476 		aprint_error_dev(bwfm->sc_dev,
    477 		    "unable to convert %s file\n",
    478 		    bwfm_firmware_description(BWFM_FILETYPE_NVRAM));
    479 		goto err;
    480 	}
    481 
    482 	sc->sc_alp_only = true;
    483 	if (bwfm_sdio_load_microcode(sc, ucode, ucsize, nvram, nvsize) != 0) {
    484 		aprint_error_dev(bwfm->sc_dev, "could not load microcode\n");
    485 		goto err;
    486 	}
    487 	sc->sc_alp_only = false;
    488 
    489 	sdmmc_pause(hztoms(1)*1000, NULL);
    490 
    491 	bwfm_sdio_clkctl(sc, CLK_AVAIL, false);
    492 	if (sc->sc_clkstate != CLK_AVAIL) {
    493 		aprint_error_dev(bwfm->sc_dev, "could not access clock\n");
    494 		goto err;
    495 	}
    496 
    497 	clk = bwfm_sdio_read_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR);
    498 	bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR,
    499 	    clk | BWFM_SDIO_FUNC1_CHIPCLKCSR_FORCE_HT);
    500 
    501 	bwfm_sdio_dev_write(sc, SDPCMD_TOSBMAILBOXDATA,
    502 	    SDPCM_PROT_VERSION << SDPCM_PROT_VERSION_SHIFT);
    503 	if (sdmmc_io_function_enable(sc->sc_sf[2])) {
    504 		aprint_error_dev(bwfm->sc_dev, "cannot enable function 2\n");
    505 		goto err;
    506 	}
    507 
    508 	bwfm_sdio_dev_write(sc, SDPCMD_HOSTINTMASK,
    509 	    SDPCMD_INTSTATUS_HMB_SW_MASK | SDPCMD_INTSTATUS_CHIPACTIVE);
    510 	bwfm_sdio_write_1(sc, BWFM_SDIO_WATERMARK, 8);
    511 
    512 	if (bwfm_chip_sr_capable(bwfm)) {
    513 		reg = bwfm_sdio_read_1(sc, BWFM_SDIO_FUNC1_WAKEUPCTRL);
    514 		reg |= BWFM_SDIO_FUNC1_WAKEUPCTRL_HTWAIT;
    515 		bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_WAKEUPCTRL, reg);
    516 		bwfm_sdio_write_1(sc, BWFM_SDIO_CCCR_CARDCAP,
    517 		    BWFM_SDIO_CCCR_CARDCAP_CMD14_SUPPORT |
    518 		    BWFM_SDIO_CCCR_CARDCAP_CMD14_EXT);
    519 		bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR,
    520 		    BWFM_SDIO_FUNC1_CHIPCLKCSR_FORCE_HT);
    521 		sc->sc_sr_enabled = 1;
    522 	} else {
    523 		bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR, clk);
    524 	}
    525 
    526 #ifdef notyet
    527 	if (sc->sc_phandle >= 0) {
    528 		sc->sc_fdtih = fdtbus_intr_establish(sc->sc_phandle,
    529 		    0, IPL_SDMMC, IST_LEVEL, bwfm_sdio_intr, sc);
    530 	}
    531 #endif
    532 	if (sc->sc_fdtih != NULL) {
    533 		aprint_normal_dev(self, "enabling GPIO interrupt\n");
    534 	} else {
    535 		sc->sc_ih = sdmmc_intr_establish(device_parent(self),
    536 		    bwfm_sdio_intr, sc, DEVNAME(sc));
    537 	}
    538 
    539 	if (sc->sc_ih == NULL && sc->sc_fdtih == NULL) {
    540 		aprint_error_dev(self, "could not establish interrupt\n");
    541 		bwfm_sdio_clkctl(sc, CLK_NONE, false);
    542 		return;
    543 	}
    544 	sdmmc_intr_enable(sc->sc_sf[1]);
    545 
    546 	sdmmc_pause(100000, NULL);
    547 
    548 	sc->sc_sc.sc_bus_ops = &bwfm_sdio_bus_ops;
    549 	sc->sc_sc.sc_proto_ops = &bwfm_proto_bcdc_ops;
    550 	bwfm_attach(&sc->sc_sc);
    551 	sc->sc_bwfm_attached = true;
    552 
    553  err:
    554 	bwfm_firmware_close(&fwctx);
    555 }
    556 
    557 static int
    558 bwfm_fdt_find_phandle(device_t self, device_t parent)
    559 {
    560 	prop_dictionary_t dict;
    561 	device_t dev;
    562 	const char *str;
    563 	int phandle;
    564 
    565 	/* locate in FDT */
    566 	dict = device_properties(self);
    567 	if (prop_dictionary_get_cstring_nocopy(dict, "fdt-path", &str)) {
    568 		/* search in FDT */
    569 		phandle = OF_finddevice(str);
    570 	} else {
    571 
    572 		/* parent parent is sdhc controller */
    573 		dev = device_parent(parent);
    574 		if (dev == NULL)
    575 			return -1;
    576 		/* locate in FDT */
    577 		dict = device_properties(dev);
    578 		if (!prop_dictionary_get_cstring_nocopy(dict, "fdt-path", &str))
    579 			return -1;
    580 
    581 		/* are we the only FDT child ? */
    582 		phandle = OF_child(OF_finddevice(str));
    583 	}
    584 
    585 	if (!of_match_compatible(phandle, compatible))
    586 		return -1;
    587 
    588 	return phandle;
    589 }
    590 
    591 static const char *
    592 bwfm_fdt_get_model(void)
    593 {
    594 	int phandle;
    595 
    596 	phandle = OF_finddevice("/");
    597 	return fdtbus_get_string_index(phandle, "compatible", 0);
    598 }
    599 
    600 static int
    601 bwfm_sdio_detach(device_t self, int flags)
    602 {
    603 	struct bwfm_sdio_softc *sc = (struct bwfm_sdio_softc *)self;
    604 
    605 #ifdef BWFM_DEBUG
    606 	bwfm_sdio_debug_console(sc);
    607 #endif
    608 
    609 	if (sc->sc_ih || sc->sc_fdtih) {
    610 		sdmmc_intr_disable(sc->sc_sf[1]);
    611 		if (sc->sc_ih)
    612 			sdmmc_intr_disestablish(sc->sc_ih);
    613 		if (sc->sc_fdtih)
    614 			fdtbus_intr_disestablish(sc->sc_phandle, sc->sc_fdtih);
    615 	}
    616 	if (sc->sc_bwfm_attached)
    617 		bwfm_detach(&sc->sc_sc, flags);
    618 
    619 	sdmmc_del_task(sc->sc_sf[1]->sc, &sc->sc_task, NULL);
    620 
    621 	kmem_free(sc->sc_sf, sc->sc_sf_size);
    622 	kmem_free(sc->sc_bounce_buf, sc->sc_bounce_size);
    623 
    624 	cv_destroy(&sc->sc_rxctl_cv);
    625 	mutex_destroy(&sc->sc_lock);
    626 
    627 	return 0;
    628 }
    629 
    630 static void
    631 bwfm_sdio_backplane(struct bwfm_sdio_softc *sc, uint32_t addr)
    632 {
    633 	uint32_t bar0 = addr & ~BWFM_SDIO_SB_OFT_ADDR_MASK;
    634 
    635 	if (sc->sc_bar0 == bar0)
    636 		return;
    637 
    638 	bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_SBADDRLOW,
    639 	    (bar0 >>  8) & 0xff);
    640 	bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_SBADDRMID,
    641 	    (bar0 >> 16) & 0xff);
    642 	bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_SBADDRHIGH,
    643 	    (bar0 >> 24) & 0xff);
    644 	sc->sc_bar0 = bar0;
    645 }
    646 
    647 static uint8_t
    648 bwfm_sdio_read_1(struct bwfm_sdio_softc *sc, uint32_t addr)
    649 {
    650 	struct sdmmc_function *sf;
    651 	uint8_t rv;
    652 
    653 	/*
    654 	 * figure out how to read the register based on address range
    655 	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
    656 	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
    657 	 * The rest: function 1 silicon backplane core registers
    658 	 */
    659 	if ((addr & ~0x7ff) == 0)
    660 		sf = sc->sc_sf[0];
    661 	else
    662 		sf = sc->sc_sf[1];
    663 
    664 	rv = sdmmc_io_read_1(sf, addr);
    665 	return rv;
    666 }
    667 
    668 static uint32_t
    669 bwfm_sdio_read_4(struct bwfm_sdio_softc *sc, uint32_t addr)
    670 {
    671 	struct sdmmc_function *sf;
    672 	uint32_t rv;
    673 
    674 	bwfm_sdio_backplane(sc, addr);
    675 
    676 	addr &= BWFM_SDIO_SB_OFT_ADDR_MASK;
    677 	addr |= BWFM_SDIO_SB_ACCESS_2_4B_FLAG;
    678 
    679 	/*
    680 	 * figure out how to read the register based on address range
    681 	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
    682 	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
    683 	 * The rest: function 1 silicon backplane core registers
    684 	 */
    685 	if ((addr & ~0x7ff) == 0)
    686 		sf = sc->sc_sf[0];
    687 	else
    688 		sf = sc->sc_sf[1];
    689 
    690 	rv = sdmmc_io_read_4(sf, addr);
    691 	return htole32(rv);
    692 }
    693 
    694 static void
    695 bwfm_sdio_write_1(struct bwfm_sdio_softc *sc, uint32_t addr, uint8_t data)
    696 {
    697 	struct sdmmc_function *sf;
    698 
    699 	/*
    700 	 * figure out how to read the register based on address range
    701 	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
    702 	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
    703 	 * The rest: function 1 silicon backplane core registers
    704 	 */
    705 	if ((addr & ~0x7ff) == 0)
    706 		sf = sc->sc_sf[0];
    707 	else
    708 		sf = sc->sc_sf[1];
    709 
    710 	sdmmc_io_write_1(sf, addr, data);
    711 }
    712 
    713 static void
    714 bwfm_sdio_write_4(struct bwfm_sdio_softc *sc, uint32_t addr, uint32_t data)
    715 {
    716 	struct sdmmc_function *sf;
    717 
    718 	bwfm_sdio_backplane(sc, addr);
    719 
    720 	addr &= BWFM_SDIO_SB_OFT_ADDR_MASK;
    721 	addr |= BWFM_SDIO_SB_ACCESS_2_4B_FLAG;
    722 
    723 	/*
    724 	 * figure out how to read the register based on address range
    725 	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
    726 	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
    727 	 * The rest: function 1 silicon backplane core registers
    728 	 */
    729 	if ((addr & ~0x7ff) == 0)
    730 		sf = sc->sc_sf[0];
    731 	else
    732 		sf = sc->sc_sf[1];
    733 
    734 	sdmmc_io_write_4(sf, addr, htole32(data));
    735 }
    736 
    737 static int
    738 bwfm_sdio_buf_read(struct bwfm_sdio_softc *sc, struct sdmmc_function *sf,
    739     uint32_t reg, char *data, size_t size)
    740 {
    741 	int err;
    742 
    743 	KASSERT(((vaddr_t)data & 0x3) == 0);
    744 	KASSERT((size & 0x3) == 0);
    745 
    746 	if (sf == sc->sc_sf[1])
    747 		err = sdmmc_io_read_region_1(sf, reg, data, size);
    748 	else
    749 		err = sdmmc_io_read_multi_1(sf, reg, data, size);
    750 
    751 	if (err)
    752 		printf("%s: error %d\n", __func__, err);
    753 
    754 	return err;
    755 }
    756 
    757 static int
    758 bwfm_sdio_buf_write(struct bwfm_sdio_softc *sc, struct sdmmc_function *sf,
    759     uint32_t reg, char *data, size_t size)
    760 {
    761 	int err;
    762 
    763 	KASSERT(((vaddr_t)data & 0x3) == 0);
    764 	KASSERT((size & 0x3) == 0);
    765 
    766 	err = sdmmc_io_write_region_1(sf, reg, data, size);
    767 
    768 	if (err)
    769 		printf("%s: error %d\n", __func__, err);
    770 
    771 	return err;
    772 }
    773 
    774 static uint32_t
    775 bwfm_sdio_ram_read_write(struct bwfm_sdio_softc *sc, uint32_t reg,
    776     char *data, size_t left, int write)
    777 {
    778 	uint32_t sbaddr, sdaddr, off;
    779 	size_t size;
    780 	int err;
    781 
    782 	err = off = 0;
    783 	while (left > 0) {
    784 		sbaddr = reg + off;
    785 		bwfm_sdio_backplane(sc, sbaddr);
    786 
    787 		sdaddr = sbaddr & BWFM_SDIO_SB_OFT_ADDR_MASK;
    788 		size = ulmin(left, (BWFM_SDIO_SB_OFT_ADDR_PAGE - sdaddr));
    789 		sdaddr |= BWFM_SDIO_SB_ACCESS_2_4B_FLAG;
    790 
    791 		if (write) {
    792 			memcpy(sc->sc_bounce_buf, data + off, size);
    793 			if (roundup(size, 4) != size)
    794 				memset(sc->sc_bounce_buf + size, 0,
    795 				    roundup(size, 4) - size);
    796 			err = bwfm_sdio_buf_write(sc, sc->sc_sf[1], sdaddr,
    797 			    sc->sc_bounce_buf, roundup(size, 4));
    798 		} else {
    799 			err = bwfm_sdio_buf_read(sc, sc->sc_sf[1], sdaddr,
    800 			    sc->sc_bounce_buf, roundup(size, 4));
    801 			memcpy(data + off, sc->sc_bounce_buf, size);
    802 		}
    803 		if (err)
    804 			break;
    805 
    806 		off += size;
    807 		left -= size;
    808 	}
    809 
    810 	if (err)
    811 		printf("%s: error %d\n", __func__, err);
    812 
    813 	return err;
    814 }
    815 
    816 static uint32_t
    817 bwfm_sdio_frame_read_write(struct bwfm_sdio_softc *sc,
    818     char *data, size_t size, int write)
    819 {
    820 	uint32_t addr;
    821 	int err;
    822 
    823 	addr = sc->sc_cc->co_base;
    824 	bwfm_sdio_backplane(sc, addr);
    825 
    826 	addr &= BWFM_SDIO_SB_OFT_ADDR_MASK;
    827 	addr |= BWFM_SDIO_SB_ACCESS_2_4B_FLAG;
    828 
    829 	if (write)
    830 		err = bwfm_sdio_buf_write(sc, sc->sc_sf[2], addr, data, size);
    831 	else
    832 		err = bwfm_sdio_buf_read(sc, sc->sc_sf[2], addr, data, size);
    833 
    834 	if (err)
    835 		printf("%s: error %d\n", __func__, err);
    836 
    837 	return err;
    838 }
    839 
    840 static uint32_t
    841 bwfm_sdio_dev_read(struct bwfm_sdio_softc *sc, uint32_t reg)
    842 {
    843 	struct bwfm_core *core;
    844 	uint32_t val;
    845 
    846 	core = bwfm_chip_get_core(&sc->sc_sc, BWFM_AGENT_CORE_SDIO_DEV);
    847 	val = bwfm_sdio_read_4(sc, core->co_base + reg);
    848 	/* TODO: Workaround for 4335/4339 */
    849 
    850 	return val;
    851 }
    852 
    853 static void
    854 bwfm_sdio_dev_write(struct bwfm_sdio_softc *sc, uint32_t reg, uint32_t val)
    855 {
    856 	struct bwfm_core *core;
    857 
    858 	core = bwfm_chip_get_core(&sc->sc_sc, BWFM_AGENT_CORE_SDIO_DEV);
    859 	bwfm_sdio_write_4(sc, core->co_base + reg, val);
    860 }
    861 
    862 static uint32_t
    863 bwfm_sdio_buscore_read(struct bwfm_softc *bwfm, uint32_t reg)
    864 {
    865 	struct bwfm_sdio_softc *sc = (void *)bwfm;
    866 	uint32_t val;
    867 
    868 	mutex_enter(&sc->sc_lock);
    869 	val = bwfm_sdio_read_4(sc, reg);
    870 	/* TODO: Workaround for 4335/4339 */
    871 	mutex_exit(&sc->sc_lock);
    872 
    873 	return val;
    874 }
    875 
    876 static void
    877 bwfm_sdio_buscore_write(struct bwfm_softc *bwfm, uint32_t reg, uint32_t val)
    878 {
    879 	struct bwfm_sdio_softc *sc = (void *)bwfm;
    880 
    881 	mutex_enter(&sc->sc_lock);
    882 	bwfm_sdio_write_4(sc, reg, val);
    883 	mutex_exit(&sc->sc_lock);
    884 }
    885 
    886 static int
    887 bwfm_sdio_buscore_prepare(struct bwfm_softc *bwfm)
    888 {
    889 	struct bwfm_sdio_softc *sc = (void *)bwfm;
    890 	uint8_t clkval, clkset, clkmask;
    891 	int i, error = 0;
    892 
    893 	mutex_enter(&sc->sc_lock);
    894 
    895 	clkset = BWFM_SDIO_FUNC1_CHIPCLKCSR_ALP_AVAIL_REQ |
    896 	    BWFM_SDIO_FUNC1_CHIPCLKCSR_FORCE_HW_CLKREQ_OFF;
    897 	bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR, clkset);
    898 
    899 	clkmask = BWFM_SDIO_FUNC1_CHIPCLKCSR_ALP_AVAIL |
    900 	    BWFM_SDIO_FUNC1_CHIPCLKCSR_HT_AVAIL;
    901 	clkval = bwfm_sdio_read_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR);
    902 
    903 	if ((clkval & ~clkmask) != clkset) {
    904 		printf("%s: wrote 0x%02x read 0x%02x\n", DEVNAME(sc),
    905 		    clkset, clkval);
    906 		error = 1;
    907 		goto done;
    908 	}
    909 
    910 	for (i = 1000; i > 0; i--) {
    911 		clkval = bwfm_sdio_read_1(sc,
    912 		    BWFM_SDIO_FUNC1_CHIPCLKCSR);
    913 		if (clkval & clkmask)
    914 			break;
    915 	}
    916 	if (i == 0) {
    917 		printf("%s: timeout on ALPAV wait, clkval 0x%02x\n",
    918 		    DEVNAME(sc), clkval);
    919 		error = 1;
    920 		goto done;
    921 	}
    922 
    923 	clkset = BWFM_SDIO_FUNC1_CHIPCLKCSR_FORCE_HW_CLKREQ_OFF |
    924 	    BWFM_SDIO_FUNC1_CHIPCLKCSR_FORCE_ALP;
    925 	bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR, clkset);
    926 	delay(65);
    927 
    928 	bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_SDIOPULLUP, 0);
    929 
    930 done:
    931 	mutex_exit(&sc->sc_lock);
    932 
    933 	return error;
    934 }
    935 
    936 static void
    937 bwfm_sdio_buscore_activate(struct bwfm_softc *bwfm, uint32_t rstvec)
    938 {
    939 	struct bwfm_sdio_softc *sc = (void *)bwfm;
    940 	struct bwfm_core *core;
    941 
    942 	core = bwfm_chip_get_core(&sc->sc_sc, BWFM_AGENT_CORE_SDIO_DEV);
    943 	bwfm_sdio_buscore_write(&sc->sc_sc,
    944 	    core->co_base + BWFM_SDPCMD_INTSTATUS, 0xFFFFFFFF);
    945 
    946 	mutex_enter(&sc->sc_lock);
    947 	if (rstvec)
    948 		bwfm_sdio_ram_read_write(sc, 0, (char *)&rstvec,
    949 		    sizeof(rstvec), 1);
    950 	mutex_exit(&sc->sc_lock);
    951 }
    952 
    953 static struct mbuf *
    954 bwfm_sdio_newbuf(void)
    955 {
    956 	struct mbuf *m;
    957 
    958 	MGETHDR(m, M_DONTWAIT, MT_DATA);
    959 	if (m == NULL)
    960 		return NULL;
    961 
    962 	MCLGET(m, M_DONTWAIT);
    963 	if (!(m->m_flags & M_EXT)) {
    964 		m_freem(m);
    965 		return NULL;
    966 	}
    967 
    968 	m->m_len = m->m_pkthdr.len = MCLBYTES;
    969 	return m;
    970 }
    971 
    972 static struct mbuf *
    973 bwfm_qget(struct mbuf **q)
    974 {
    975 	struct mbuf *m = NULL;
    976 
    977 	if (*q != NULL) {
    978 		m = *q;
    979 		*q = m->m_next;
    980 		m->m_next = NULL;
    981 	}
    982 
    983 	return m;
    984 }
    985 
    986 static void
    987 bwfm_qput(struct mbuf **q, struct mbuf *m)
    988 {
    989 
    990 	if (*q == NULL)
    991 		*q = m;
    992 	else
    993 		m_cat(*q, m);
    994 }
    995 
    996 static int
    997 bwfm_sdio_txcheck(struct bwfm_softc *bwfm)
    998 {
    999 	struct bwfm_sdio_softc *sc = (void *)bwfm;
   1000 	int error = 0;
   1001 
   1002 	mutex_enter(&sc->sc_lock);
   1003 	if (sc->sc_tx_count >= 64)
   1004 		error = ENOBUFS;
   1005 	mutex_exit(&sc->sc_lock);
   1006 
   1007 	return error;
   1008 }
   1009 
   1010 
   1011 static int
   1012 bwfm_sdio_txdata(struct bwfm_softc *bwfm, struct mbuf **mp)
   1013 {
   1014 	struct bwfm_sdio_softc *sc = (void *)bwfm;
   1015 
   1016 	if (sc->sc_tx_count >= 64) {
   1017 		printf("%s: tx count limit reached\n",DEVNAME(sc));
   1018 		return ENOBUFS;
   1019 	}
   1020 
   1021 	mutex_enter(&sc->sc_lock);
   1022 	sc->sc_tx_count++;
   1023 	MBUFQ_ENQUEUE(&sc->sc_tx_queue, *mp);
   1024 	mutex_exit(&sc->sc_lock);
   1025 
   1026 	bwfm_sdio_intr1(sc, "sdio_txdata");
   1027 
   1028 	return 0;
   1029 }
   1030 
   1031 static int
   1032 bwfm_sdio_txctl(struct bwfm_softc *bwfm, char *buf, size_t len)
   1033 {
   1034 	struct bwfm_sdio_softc *sc = (void *)bwfm;
   1035 	struct mbuf *m;
   1036 
   1037 	KASSERT(len <= MCLBYTES);
   1038 
   1039 	MGET(m, M_DONTWAIT, MT_CONTROL);
   1040 	if (m == NULL)
   1041 		goto fail;
   1042 	if (len > MLEN) {
   1043 		MCLGET(m, M_DONTWAIT);
   1044 		if (!(m->m_flags & M_EXT)) {
   1045 			m_freem(m);
   1046 			goto fail;
   1047 		}
   1048 	}
   1049 	memcpy(mtod(m, char *), buf, len);
   1050 	m->m_len = len;
   1051 
   1052 	mutex_enter(&sc->sc_lock);
   1053 	MBUFQ_ENQUEUE(&sc->sc_tx_queue, m);
   1054 	mutex_exit(&sc->sc_lock);
   1055 
   1056 	bwfm_sdio_intr1(sc, "sdio_txctl");
   1057 
   1058 	return 0;
   1059 
   1060 fail:
   1061 	return ENOBUFS;
   1062 }
   1063 
   1064 static int
   1065 bwfm_nvram_convert(u_char *buf, size_t len, size_t *newlenp)
   1066 {
   1067 	u_char *src, *dst, *end = buf + len;
   1068 	bool skip = false;
   1069 	size_t count = 0, pad;
   1070 	uint32_t token;
   1071 
   1072 	for (src = buf, dst = buf; src != end; ++src) {
   1073 		if (*src == '\n') {
   1074 			if (count > 0)
   1075 				*dst++ = '\0';
   1076 			count = 0;
   1077 			skip = false;
   1078 			continue;
   1079 		}
   1080 		if (skip)
   1081 			continue;
   1082 		if (*src == '#' && count == 0) {
   1083 			skip = true;
   1084 			continue;
   1085 		}
   1086 		if (*src == '\r' || *src == ' ')
   1087 			continue;
   1088 		*dst++ = *src;
   1089 		++count;
   1090 	}
   1091 
   1092 	count = dst - buf;
   1093 	pad = roundup(count + 1, 4) - count;
   1094 
   1095 	if (count + pad + sizeof(token) > len)
   1096 		return 1;
   1097 
   1098 	memset(dst, 0, pad);
   1099 	count += pad;
   1100 	dst += pad;
   1101 
   1102 	token = (count / 4) & 0xffff;
   1103 	token |= ~token << 16;
   1104 	token = htole32(token);
   1105 
   1106 	memcpy(dst, &token, sizeof(token));
   1107 	count += sizeof(token);
   1108 
   1109 	*newlenp = count;
   1110 
   1111 	return 0;
   1112 }
   1113 
   1114 static int
   1115 bwfm_sdio_load_microcode(struct bwfm_sdio_softc *sc, u_char *ucode, size_t size,
   1116     u_char *nvram, size_t nvlen)
   1117 {
   1118 	struct bwfm_softc *bwfm = &sc->sc_sc;
   1119 	char *verify = NULL;
   1120 	int err = 0;
   1121 
   1122 	bwfm_sdio_clkctl(sc, CLK_AVAIL, false);
   1123 
   1124 	DPRINTF(("ucode %zu bytes to 0x%08lx\n", size,
   1125 		(u_long)bwfm->sc_chip.ch_rambase));
   1126 	/* Upload firmware */
   1127 	err = bwfm_sdio_ram_read_write(sc, bwfm->sc_chip.ch_rambase,
   1128 	    ucode, size, 1);
   1129 	if (err)
   1130 		goto out;
   1131 
   1132 	/* Verify firmware */
   1133 	verify = kmem_zalloc(size, KM_SLEEP);
   1134 	err = bwfm_sdio_ram_read_write(sc, bwfm->sc_chip.ch_rambase,
   1135 	    verify, size, 0);
   1136 	if (err || memcmp(verify, ucode, size)) {
   1137 		printf("%s: firmware verification failed\n",
   1138 		    DEVNAME(sc));
   1139 		kmem_free(verify, size);
   1140 		goto out;
   1141 	}
   1142 	kmem_free(verify, size);
   1143 
   1144 	DPRINTF(("nvram %zu bytes to 0x%08lx\n", nvlen,
   1145 	    (u_long)bwfm->sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize
   1146 	    - nvlen));
   1147 	/* Upload nvram */
   1148 	err = bwfm_sdio_ram_read_write(sc, bwfm->sc_chip.ch_rambase +
   1149 	    bwfm->sc_chip.ch_ramsize - nvlen, nvram, nvlen, 1);
   1150 	if (err)
   1151 		goto out;
   1152 
   1153 	/* Verify nvram */
   1154 	verify = kmem_zalloc(nvlen, KM_SLEEP);
   1155 	err = bwfm_sdio_ram_read_write(sc, bwfm->sc_chip.ch_rambase +
   1156 	    bwfm->sc_chip.ch_ramsize - nvlen, verify, nvlen, 0);
   1157 	if (err || memcmp(verify, nvram, nvlen)) {
   1158 		printf("%s: nvram verification failed\n",
   1159 		    DEVNAME(sc));
   1160 		kmem_free(verify, nvlen);
   1161 		goto out;
   1162 	}
   1163 	kmem_free(verify, nvlen);
   1164 
   1165 	DPRINTF(("Reset core 0x%08x\n", *(uint32_t *)ucode));
   1166 	/* Load reset vector from firmware and kickstart core. */
   1167 	bwfm_chip_set_active(bwfm, *(uint32_t *)ucode);
   1168 
   1169 out:
   1170 	bwfm_sdio_clkctl(sc, CLK_SDONLY, false);
   1171 	return err;
   1172 }
   1173 
   1174 static void
   1175 bwfm_sdio_clkctl(struct bwfm_sdio_softc *sc, enum bwfm_sdio_clkstate newstate,
   1176     bool pendok)
   1177 {
   1178 	enum bwfm_sdio_clkstate oldstate;
   1179 
   1180 	oldstate = sc->sc_clkstate;
   1181 	if (oldstate == newstate)
   1182 		return;
   1183 
   1184 	switch (newstate) {
   1185 	case CLK_AVAIL:
   1186 		if (oldstate == CLK_NONE)
   1187 			sc->sc_clkstate = CLK_SDONLY; /* XXX */
   1188 		bwfm_sdio_htclk(sc, true, pendok);
   1189 		break;
   1190 	case CLK_SDONLY:
   1191 		if (oldstate == CLK_NONE)
   1192 			sc->sc_clkstate = newstate;
   1193 		else if (oldstate == CLK_AVAIL)
   1194 			bwfm_sdio_htclk(sc, false, false);
   1195 		else
   1196 			printf("%s: clkctl %d -> %d\n", DEVNAME(sc),
   1197 				sc->sc_clkstate, newstate);
   1198 		break;
   1199 	case CLK_NONE:
   1200 		if (oldstate == CLK_AVAIL)
   1201 			bwfm_sdio_htclk(sc, false, false);
   1202 		sc->sc_clkstate = newstate;
   1203 		break;
   1204 	default:
   1205 		break;
   1206 	}
   1207 
   1208 	DPRINTF(("%s: %d -> %d = %d\n", DEVNAME(sc), oldstate, newstate,
   1209 	    sc->sc_clkstate));
   1210 }
   1211 
   1212 static void
   1213 bwfm_sdio_htclk(struct bwfm_sdio_softc *sc, bool on, bool pendok)
   1214 {
   1215 	uint32_t clkctl, devctl, req;
   1216 	int i;
   1217 
   1218 	if (sc->sc_sr_enabled) {
   1219 		if (on)
   1220 			sc->sc_clkstate = CLK_AVAIL;
   1221 		else
   1222 			sc->sc_clkstate = CLK_SDONLY;
   1223 		return;
   1224 	}
   1225 
   1226 	if (on) {
   1227 		if (sc->sc_alp_only)
   1228 			req = BWFM_SDIO_FUNC1_CHIPCLKCSR_ALP_AVAIL_REQ;
   1229 		else
   1230 			req = BWFM_SDIO_FUNC1_CHIPCLKCSR_HT_AVAIL_REQ;
   1231 		bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR, req);
   1232 
   1233 		clkctl = bwfm_sdio_read_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR);
   1234 		if (!BWFM_SDIO_FUNC1_CHIPCLKCSR_CLKAV(clkctl, sc->sc_alp_only)
   1235 		    && pendok) {
   1236 			devctl = bwfm_sdio_read_1(sc, BWFM_SDIO_DEVICE_CTL);
   1237 			devctl |= BWFM_SDIO_DEVICE_CTL_CA_INT_ONLY;
   1238 			bwfm_sdio_write_1(sc, BWFM_SDIO_DEVICE_CTL, devctl);
   1239 			sc->sc_clkstate = CLK_PENDING;
   1240 			return;
   1241 		} else if (sc->sc_clkstate == CLK_PENDING) {
   1242 			devctl = bwfm_sdio_read_1(sc, BWFM_SDIO_DEVICE_CTL);
   1243 			devctl &= ~BWFM_SDIO_DEVICE_CTL_CA_INT_ONLY;
   1244 			bwfm_sdio_write_1(sc, BWFM_SDIO_DEVICE_CTL, devctl);
   1245 		}
   1246 
   1247 		for (i = 0; i < 50; i++) {
   1248 			if (BWFM_SDIO_FUNC1_CHIPCLKCSR_CLKAV(clkctl,
   1249 			    sc->sc_alp_only))
   1250 				break;
   1251 			clkctl = bwfm_sdio_read_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR
   1252 );
   1253 			sdmmc_pause(100000, NULL);
   1254 		}
   1255 		if (i >= 50) {
   1256 			printf("%s: HT avail timeout\n", DEVNAME(sc));
   1257 			return;
   1258 		}
   1259 
   1260 		sc->sc_clkstate = CLK_AVAIL;
   1261 	} else {
   1262 		if (sc->sc_clkstate == CLK_PENDING) {
   1263 			devctl = bwfm_sdio_read_1(sc, BWFM_SDIO_DEVICE_CTL);
   1264 			devctl &= ~BWFM_SDIO_DEVICE_CTL_CA_INT_ONLY;
   1265 			bwfm_sdio_write_1(sc, BWFM_SDIO_DEVICE_CTL, devctl);
   1266 		}
   1267 		sc->sc_clkstate = CLK_SDONLY;
   1268 		bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR, 0);
   1269 	}
   1270 }
   1271 
   1272 struct bwfm_sdio_dstab {
   1273 	uint8_t milli;
   1274 	uint8_t val;
   1275 };
   1276 
   1277 static struct bwfm_sdio_dstab pmu11_1v8[] = {
   1278 	{32, 0x6},
   1279 	{26, 0x7},
   1280 	{22, 0x4},
   1281 	{16, 0x5},
   1282 	{12, 0x2},
   1283 	{8, 0x3},
   1284 	{4, 0x0},
   1285 	{0, 0x1}
   1286 }, pmu13_1v8[] = {
   1287 	{6, 0x7},
   1288 	{5, 0x6},
   1289 	{4, 0x5},
   1290 	{3, 0x4},
   1291 	{2, 0x2},
   1292 	{1, 0x1},
   1293 	{0, 0x0}
   1294 }, pmu17_1v8[] = {
   1295 	{3, 0x3},
   1296 	{2, 0x2},
   1297 	{1, 0x1},
   1298 	{0, 0x0}
   1299 }, pmu17_3v3[] = {
   1300 	{16, 0x7},
   1301 	{12, 0x5},
   1302 	{8,  0x3},
   1303 	{4,  0x1},
   1304 	{0,  0x0}
   1305 };
   1306 
   1307 static void
   1308 bwfm_sdio_drivestrength(struct bwfm_sdio_softc *sc, unsigned milli)
   1309 {
   1310 	struct bwfm_softc *bwfm = &sc->sc_sc;
   1311 	struct bwfm_core *core;
   1312 	struct bwfm_sdio_dstab *tab;
   1313 	uint32_t tmp, mask;
   1314 	unsigned i;
   1315 
   1316 	if ((bwfm->sc_chip.ch_cc_caps & BWFM_CHIP_REG_CAPABILITIES_PMU) == 0)
   1317 		return;
   1318 
   1319 	switch (bwfm->sc_chip.ch_chip) {
   1320 	case BRCM_CC_4330_CHIP_ID:
   1321 		tab = pmu11_1v8;
   1322 		mask = __BITS(11,13);
   1323 		break;
   1324 	case BRCM_CC_4334_CHIP_ID:
   1325 		tab = pmu17_1v8;
   1326 		mask = __BITS(11,12);
   1327 		break;
   1328 	case BRCM_CC_43143_CHIP_ID:
   1329 		tab = pmu17_3v3;
   1330 		mask = __BITS(0,3);
   1331 		break;
   1332 	case BRCM_CC_43362_CHIP_ID:
   1333 		tab = pmu13_1v8;
   1334 		mask = __BITS(11,13);
   1335 		break;
   1336 	default:
   1337 		return;
   1338 	}
   1339 
   1340 	for (i=0; tab[i].milli != 0; ++i) {
   1341 		if (milli >= tab[i].milli)
   1342 			break;
   1343 	}
   1344 	if (tab[i].milli == 0)
   1345 		return;
   1346 
   1347 	core = bwfm_chip_get_pmu(&sc->sc_sc);
   1348 	tmp = bwfm_sdio_read_4(sc, core->co_base + BWFM_CHIP_REG_CHIPCONTROL_ADDR);
   1349 	tmp &= mask;
   1350 	tmp |= __SHIFTIN(tab[i].val, mask);
   1351 	bwfm_sdio_write_4(sc, core->co_base + BWFM_CHIP_REG_CHIPCONTROL_ADDR, tmp);
   1352 }
   1353 
   1354 
   1355 #if notyet
   1356 static int
   1357 bwfm_sdio_bus_sleep(struct bwfm_sdio_softc *sc, bool sleep, bool pendok)
   1358 {
   1359 	uint32_t clkctl;
   1360 
   1361 	if (sc->sleeping == sleep)
   1362 		return 0;
   1363 
   1364 	if (sc->sc_sr_enabled) {
   1365 		if (sleep) {
   1366 			clkctl = bwfm_sdio_read_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR);
   1367 			if ((clkctl & BWFM_SDIO_FUNC1_CHIPCLKCSR_CSR_MASK) == 0)
   1368 				bwfm_sdio_write_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR, BWFM_SDIO_FUNC1_CHIPCLKCSR_ALP_AVAIL_REQ);
   1369 		}
   1370 		/* kso_ctrl(sc, sleep) */
   1371 	}
   1372 
   1373 	if (sleep) {
   1374 		if (!sc->sc_sr_enabled)
   1375 			bwfm_sdio_clkctl(sc, CLK_NONE, pendok);
   1376 	} else {
   1377 		bwfm_sdio_clkctl(sc, CLK_AVAIL, pendok);
   1378 	}
   1379 
   1380 	sc->sleeping = sleep;
   1381 
   1382 	return 0;
   1383 }
   1384 #endif
   1385 
   1386 static void
   1387 bwfm_sdio_readshared(struct bwfm_sdio_softc *sc)
   1388 {
   1389 	struct bwfm_softc *bwfm = &sc->sc_sc;
   1390 	struct bwfm_sdio_sdpcm sdpcm;
   1391 	uint32_t addr, shaddr;
   1392 	int err;
   1393 
   1394 	bwfm_sdio_clkctl(sc, CLK_AVAIL, false);
   1395 	if (sc->sc_clkstate != CLK_AVAIL)
   1396 		return;
   1397 
   1398 	shaddr = bwfm->sc_chip.ch_rambase + bwfm->sc_chip.ch_ramsize - 4;
   1399 	if (!bwfm->sc_chip.ch_rambase && sc->sc_sr_enabled)
   1400 		shaddr -= bwfm->sc_chip.ch_srsize;
   1401 
   1402 	err = bwfm_sdio_ram_read_write(sc, shaddr, (char *)&addr,
   1403 	    sizeof(addr), 0);
   1404 	if (err)
   1405 		return;
   1406 
   1407 	addr = le32toh(addr);
   1408 	if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff))
   1409 		return;
   1410 
   1411 	err = bwfm_sdio_ram_read_write(sc, addr, (char *)&sdpcm,
   1412 	    sizeof(sdpcm), 0);
   1413 	if (err)
   1414 		return;
   1415 
   1416 	sc->sc_console_addr = le32toh(sdpcm.console_addr);
   1417 }
   1418 
   1419 static int
   1420 bwfm_sdio_intr1(void *v, const char *name)
   1421 {
   1422 	struct bwfm_sdio_softc *sc = (void *)v;
   1423 
   1424 	DPRINTF(("%s: %s\n", DEVNAME(sc), name));
   1425 
   1426 	sdmmc_add_task(sc->sc_sf[1]->sc, &sc->sc_task);
   1427 	return 1;
   1428 }
   1429 
   1430 static int
   1431 bwfm_sdio_intr(void *v)
   1432 {
   1433 	return bwfm_sdio_intr1(v, "sdio_intr");
   1434 }
   1435 
   1436 static void
   1437 bwfm_sdio_task(void *v)
   1438 {
   1439 	struct bwfm_sdio_softc *sc = (void *)v;
   1440 
   1441 	mutex_enter(&sc->sc_lock);
   1442 	bwfm_sdio_task1(sc);
   1443 #ifdef BWFM_DEBUG
   1444 	bwfm_sdio_debug_console(sc);
   1445 #endif
   1446 	mutex_exit(&sc->sc_lock);
   1447 }
   1448 
   1449 static void
   1450 bwfm_sdio_task1(struct bwfm_sdio_softc *sc)
   1451 {
   1452 	uint32_t clkctl, devctl, intstat, hostint;
   1453 	bool dorecv, dosend;
   1454 
   1455 	if (!sc->sc_sr_enabled && sc->sc_clkstate == CLK_PENDING) {
   1456 		clkctl = bwfm_sdio_read_1(sc, BWFM_SDIO_FUNC1_CHIPCLKCSR);
   1457 		if (BWFM_SDIO_FUNC1_CHIPCLKCSR_HTAV(clkctl)) {
   1458 			devctl = bwfm_sdio_read_1(sc, BWFM_SDIO_DEVICE_CTL);
   1459 			devctl &= ~BWFM_SDIO_DEVICE_CTL_CA_INT_ONLY;
   1460 			bwfm_sdio_write_1(sc, BWFM_SDIO_DEVICE_CTL, devctl);
   1461 			sc->sc_clkstate = CLK_AVAIL;
   1462 		}
   1463 	}
   1464 
   1465 	dorecv = dosend = sc->sc_clkstate == CLK_AVAIL;
   1466 
   1467 	intstat = bwfm_sdio_dev_read(sc, BWFM_SDPCMD_INTSTATUS);
   1468 	DPRINTF(("%s: intstat 0x%" PRIx32 "\n", DEVNAME(sc), intstat));
   1469 	if (intstat)
   1470 		bwfm_sdio_dev_write(sc, BWFM_SDPCMD_INTSTATUS, intstat);
   1471 
   1472 	if (intstat & SDPCMD_INTSTATUS_CHIPACTIVE)
   1473 		printf("%s: CHIPACTIVE\n", DEVNAME(sc));
   1474 
   1475 	if (intstat & SDPCMD_INTSTATUS_HMB_HOST_INT) {
   1476 		hostint = bwfm_sdio_dev_read(sc, SDPCMD_TOHOSTMAILBOXDATA);
   1477 		DPRINTF(("%s: hostint 0x%" PRIx32 "\n", DEVNAME(sc), hostint));
   1478 		bwfm_sdio_dev_write(sc, SDPCMD_TOSBMAILBOX,
   1479 		    SDPCMD_TOSBMAILBOX_INT_ACK);
   1480 		if (hostint & SDPCMD_TOHOSTMAILBOXDATA_NAKHANDLED)
   1481 			sc->sc_rxskip = false;
   1482 		if (hostint & SDPCMD_TOHOSTMAILBOXDATA_DEVREADY ||
   1483 		    hostint & SDPCMD_TOHOSTMAILBOXDATA_FWREADY)
   1484 			bwfm_sdio_readshared(sc);
   1485 	}
   1486 
   1487 	if (intstat & SDPCMD_INTSTATUS_HMB_FRAME_IND) {
   1488 		/* ignore receive indications while recovering */
   1489 		if (dorecv && !sc->sc_rxskip) {
   1490 			DPRINTF(("%s: recv\n", DEVNAME(sc)));
   1491 			bwfm_sdio_rx_frames(sc);
   1492 		}
   1493 	}
   1494 
   1495 	if (intstat & SDPCMD_INTSTATUS_HMB_FC_STATE)
   1496 		dosend = false;
   1497 
   1498 	if (intstat & SDPCMD_INTSTATUS_HMB_FC_CHANGE) {
   1499 		if (dosend) {
   1500 			intstat = bwfm_sdio_dev_read(sc, BWFM_SDPCMD_INTSTATUS);
   1501 			DPRINTF(("%s: intstat2 0x%" PRIx32 "\n", DEVNAME(sc), intstat));
   1502 			if (intstat & (SDPCMD_INTSTATUS_HMB_FC_STATE | SDPCMD_INTSTATUS_HMB_FC_CHANGE))
   1503 				dosend = false;
   1504 		}
   1505 	}
   1506 
   1507 if (!dosend && MBUFQ_FIRST(&sc->sc_tx_queue)) printf("%s: flowctl\n", DEVNAME(sc));
   1508 	if (dosend && MBUFQ_FIRST(&sc->sc_tx_queue)) {
   1509 		DPRINTF(("%s: xmit\n", DEVNAME(sc)));
   1510 		bwfm_sdio_tx_frames(sc);
   1511 	}
   1512 }
   1513 
   1514 static int
   1515 bwfm_sdio_tx_ok(struct bwfm_sdio_softc *sc)
   1516 {
   1517 	return (uint8_t)(sc->sc_tx_max_seq - sc->sc_tx_seq) != 0 &&
   1518 	    ((uint8_t)(sc->sc_tx_max_seq - sc->sc_tx_seq) & 0x80) == 0;
   1519 }
   1520 
   1521 static void
   1522 bwfm_sdio_tx_frames(struct bwfm_sdio_softc *sc)
   1523 {
   1524 	struct mbuf *m;
   1525 	struct ifnet *ifp = sc->sc_sc.sc_ic.ic_ifp;
   1526 	bool ifstart = false;
   1527 	int i;
   1528 
   1529 	if (!bwfm_sdio_tx_ok(sc))
   1530 		return;
   1531 
   1532 	i = uimin((uint8_t)(sc->sc_tx_max_seq - sc->sc_tx_seq), 32);
   1533 	while (i--) {
   1534 		MBUFQ_DEQUEUE(&sc->sc_tx_queue, m);
   1535 		if (m == NULL)
   1536 			break;
   1537 
   1538 		if (m->m_type == MT_CONTROL)
   1539 			bwfm_sdio_tx_ctrlframe(sc, m);
   1540 		else {
   1541 			bwfm_sdio_tx_dataframe(sc, m);
   1542 			if_statinc(ifp, if_opackets);
   1543 			ifstart = true;
   1544 		}
   1545 
   1546 		m_freem(m);
   1547 	}
   1548 
   1549 	if (ifstart) {
   1550 		ifp->if_flags &= ~IFF_OACTIVE;
   1551 		if_schedule_deferred_start(ifp);
   1552 	}
   1553 }
   1554 
   1555 static void
   1556 bwfm_sdio_tx_ctrlframe(struct bwfm_sdio_softc *sc, struct mbuf *m)
   1557 {
   1558 	struct bwfm_sdio_hwhdr *hwhdr;
   1559 	struct bwfm_sdio_swhdr *swhdr;
   1560 	size_t len, roundto;
   1561 
   1562 	len = sizeof(*hwhdr) + sizeof(*swhdr) + m->m_len;
   1563 
   1564 	/* Zero-pad to either block-size or 4-byte alignment. */
   1565 	if (len > 512 && (len % 512) != 0)
   1566 		roundto = 512;
   1567 	else
   1568 		roundto = 4;
   1569 
   1570 	KASSERT(roundup(len, roundto) <= sc->sc_bounce_size);
   1571 
   1572 	hwhdr = (void *)sc->sc_bounce_buf;
   1573 	hwhdr->frmlen = htole16(len);
   1574 	hwhdr->cksum = htole16(~len);
   1575 
   1576 	swhdr = (void *)&hwhdr[1];
   1577 	swhdr->seqnr = sc->sc_tx_seq++;
   1578 	swhdr->chanflag = BWFM_SDIO_SWHDR_CHANNEL_CONTROL;
   1579 	swhdr->nextlen = 0;
   1580 	swhdr->dataoff = sizeof(*hwhdr) + sizeof(*swhdr);
   1581 	swhdr->maxseqnr = 0;
   1582 
   1583 	m_copydata(m, 0, m->m_len, &swhdr[1]);
   1584 
   1585 	if (roundup(len, roundto) != len)
   1586 		memset(sc->sc_bounce_buf + len, 0,
   1587 		    roundup(len, roundto) - len);
   1588 
   1589 	bwfm_sdio_frame_read_write(sc, sc->sc_bounce_buf,
   1590 	    roundup(len, roundto), 1);
   1591 }
   1592 
   1593 static void
   1594 bwfm_sdio_tx_dataframe(struct bwfm_sdio_softc *sc, struct mbuf *m)
   1595 {
   1596 	struct bwfm_sdio_hwhdr *hwhdr;
   1597 	struct bwfm_sdio_swhdr *swhdr;
   1598 	struct bwfm_proto_bcdc_hdr *bcdc;
   1599 	size_t len, roundto;
   1600 
   1601 	len = sizeof(*hwhdr) + sizeof(*swhdr) + sizeof(*bcdc)
   1602 	    + m->m_pkthdr.len;
   1603 
   1604 	/* Zero-pad to either block-size or 4-byte alignment. */
   1605 	if (len > 512 && (len % 512) != 0)
   1606 		roundto = 512;
   1607 	else
   1608 		roundto = 4;
   1609 
   1610 	KASSERT(roundup(len, roundto) <= sc->sc_bounce_size);
   1611 
   1612 	hwhdr = (void *)sc->sc_bounce_buf;
   1613 	hwhdr->frmlen = htole16(len);
   1614 	hwhdr->cksum = htole16(~len);
   1615 
   1616 	swhdr = (void *)&hwhdr[1];
   1617 	swhdr->seqnr = sc->sc_tx_seq++;
   1618 	swhdr->chanflag = BWFM_SDIO_SWHDR_CHANNEL_DATA;
   1619 	swhdr->nextlen = 0;
   1620 	swhdr->dataoff = sizeof(*hwhdr) + sizeof(*swhdr);
   1621 	swhdr->maxseqnr = 0;
   1622 
   1623 	bcdc = (void *)&swhdr[1];
   1624 	bcdc->data_offset = 0;
   1625 	bcdc->priority = WME_AC_BE;
   1626 	bcdc->flags = BWFM_BCDC_FLAG_VER(BWFM_BCDC_FLAG_PROTO_VER);
   1627 	bcdc->flags2 = 0;
   1628 
   1629 	m_copydata(m, 0, m->m_pkthdr.len, &bcdc[1]);
   1630 
   1631 	if (roundup(len, roundto) != len)
   1632 		memset(sc->sc_bounce_buf + len, 0,
   1633 		    roundup(len, roundto) - len);
   1634 
   1635 	bwfm_sdio_frame_read_write(sc, sc->sc_bounce_buf,
   1636 	    roundup(len, roundto), 1);
   1637 
   1638 	sc->sc_tx_count--;
   1639 }
   1640 
   1641 static int
   1642 bwfm_sdio_rxctl(struct bwfm_softc *bwfm, char *buf, size_t *lenp)
   1643 {
   1644 	struct bwfm_sdio_softc *sc = (void *)bwfm;
   1645 	struct mbuf *m;
   1646 	int err = 0;
   1647 
   1648 	mutex_enter(&sc->sc_lock);
   1649 	while ((m = bwfm_qget(&sc->sc_rxctl_queue)) == NULL) {
   1650 		err = cv_timedwait(&sc->sc_rxctl_cv, &sc->sc_lock,
   1651 		    mstohz(5000));
   1652 		if (err == EWOULDBLOCK)
   1653 			break;
   1654 	}
   1655 	mutex_exit(&sc->sc_lock);
   1656 
   1657 	if (err)
   1658 		return 1;
   1659 
   1660 	if (m->m_len > *lenp) {
   1661 		m_freem(m);
   1662 		return 1;
   1663 	}
   1664 
   1665 	*lenp = m->m_len;
   1666 	m_copydata(m, 0, m->m_len, buf);
   1667 	m_freem(m);
   1668 	return 0;
   1669 }
   1670 
   1671 static void
   1672 bwfm_sdio_rx_frames(struct bwfm_sdio_softc *sc)
   1673 {
   1674 	struct bwfm_sdio_hwhdr *hwhdr;
   1675 	struct bwfm_sdio_swhdr *swhdr;
   1676 	struct bwfm_proto_bcdc_hdr *bcdc;
   1677 	uint16_t *sublen, nextlen = 0;
   1678 	struct mbuf *m;
   1679 	size_t flen, off, hoff;
   1680 	char *data;
   1681 	int nsub;
   1682 	size_t subsize;
   1683 
   1684 	hwhdr = (struct bwfm_sdio_hwhdr *)sc->sc_bounce_buf;
   1685 	swhdr = (struct bwfm_sdio_swhdr *)&hwhdr[1];
   1686 	data = (char *)&swhdr[1];
   1687 
   1688 	for (;;) {
   1689 		/* If we know the next size, just read ahead. */
   1690 		if (nextlen) {
   1691 			if (bwfm_sdio_frame_read_write(sc, sc->sc_bounce_buf,
   1692 			    nextlen, 0))
   1693 				break;
   1694 			nextlen = 0;
   1695 		} else {
   1696 			if (bwfm_sdio_frame_read_write(sc, sc->sc_bounce_buf,
   1697 			    sizeof(*hwhdr) + sizeof(*swhdr), 0))
   1698 				break;
   1699 		}
   1700 
   1701 		hwhdr->frmlen = le16toh(hwhdr->frmlen);
   1702 		hwhdr->cksum = le16toh(hwhdr->cksum);
   1703 
   1704 		if (hwhdr->frmlen == 0 && hwhdr->cksum == 0) {
   1705 			break;
   1706 		}
   1707 
   1708 		if ((hwhdr->frmlen ^ hwhdr->cksum) != 0xffff) {
   1709 			printf("%s: checksum error\n", DEVNAME(sc));
   1710 			break;
   1711 		}
   1712 
   1713 		if (hwhdr->frmlen < sizeof(*hwhdr) + sizeof(*swhdr)) {
   1714 			printf("%s: length error\n", DEVNAME(sc));
   1715 			break;
   1716 		}
   1717 
   1718 		if (nextlen && hwhdr->frmlen > nextlen) {
   1719 			printf("%s: read ahead length error (%u > %u)\n",
   1720 			    DEVNAME(sc), hwhdr->frmlen, nextlen);
   1721 			break;
   1722 		}
   1723 
   1724 		sc->sc_tx_max_seq = swhdr->maxseqnr;
   1725 
   1726 		flen = hwhdr->frmlen - (sizeof(*hwhdr) + sizeof(*swhdr));
   1727 		if (flen == 0) {
   1728 			nextlen = swhdr->nextlen << 4;
   1729 			continue;
   1730 		}
   1731 
   1732 		if (!nextlen) {
   1733 			KASSERT(roundup(flen, 4) <= sc->sc_bounce_size -
   1734 			    (sizeof(*hwhdr) + sizeof(*swhdr)));
   1735 			if (bwfm_sdio_frame_read_write(sc, data,
   1736 			    roundup(flen, 4), 0)) {
   1737 				printf("%s: I/O error roundup(%zu, 4) bytes\n",
   1738 				    DEVNAME(sc), flen);
   1739 				break;
   1740 			}
   1741 		}
   1742 
   1743 		if (swhdr->dataoff < (sizeof(*hwhdr) + sizeof(*swhdr))) {
   1744 			printf("%s: data offset %u in header\n",
   1745 			    DEVNAME(sc), swhdr->dataoff);
   1746 			break;
   1747 		}
   1748 
   1749 		off = swhdr->dataoff - (sizeof(*hwhdr) + sizeof(*swhdr));
   1750 		if (off > flen) {
   1751 			printf("%s: offset %zu beyond end %zu\n",
   1752 			    DEVNAME(sc), off, flen);
   1753 			break;
   1754 		}
   1755 
   1756 		switch (swhdr->chanflag & BWFM_SDIO_SWHDR_CHANNEL_MASK) {
   1757 		case BWFM_SDIO_SWHDR_CHANNEL_CONTROL:
   1758 			m = bwfm_sdio_newbuf();
   1759 			if (m == NULL)
   1760 				break;
   1761 			if (flen - off > m->m_len) {
   1762 				printf("%s: ctl bigger than anticipated\n",
   1763 				    DEVNAME(sc));
   1764 				m_freem(m);
   1765 				break;
   1766 			}
   1767 			m->m_len = m->m_pkthdr.len = flen - off;
   1768 			memcpy(mtod(m, char *), data + off, flen - off);
   1769 			bwfm_qput(&sc->sc_rxctl_queue, m);
   1770 			cv_broadcast(&sc->sc_rxctl_cv);
   1771 			nextlen = swhdr->nextlen << 4;
   1772 			break;
   1773 		case BWFM_SDIO_SWHDR_CHANNEL_EVENT:
   1774 		case BWFM_SDIO_SWHDR_CHANNEL_DATA:
   1775 			m = bwfm_sdio_newbuf();
   1776 			if (m == NULL)
   1777 				break;
   1778 			if (flen - off > m->m_len) {
   1779 				printf("%s: frame bigger than anticipated\n",
   1780 				    DEVNAME(sc));
   1781 				m_freem(m);
   1782 				break;
   1783 			}
   1784 			m->m_len = m->m_pkthdr.len = flen - off;
   1785 			memcpy(mtod(m, char *), data + off, flen - off);
   1786 			bcdc = mtod(m, struct bwfm_proto_bcdc_hdr *);
   1787 			hoff = sizeof(*bcdc) + ((size_t)bcdc->data_offset << 2);
   1788 			if (m->m_len < hoff) {
   1789 				printf("%s: short bcdc packet %d < %zu\n",
   1790 				    DEVNAME(sc), m->m_len, hoff);
   1791 				m_freem(m);
   1792 				break;
   1793 			}
   1794 			m_adj(m, hoff);
   1795 			/* don't pass empty packet to stack */
   1796 			if (m->m_len == 0) {
   1797 				m_freem(m);
   1798 				break;
   1799 			}
   1800 			bwfm_rx(&sc->sc_sc, m);
   1801 			nextlen = swhdr->nextlen << 4;
   1802 			break;
   1803 		case BWFM_SDIO_SWHDR_CHANNEL_GLOM:
   1804 			if ((flen % sizeof(uint16_t)) != 0) {
   1805 				printf("%s: odd length (%zu) glom table\n",
   1806 				    DEVNAME(sc), flen);
   1807 				break;
   1808 			}
   1809 			nsub = flen / sizeof(uint16_t);
   1810 			subsize = nsub * sizeof(uint16_t);
   1811 			sublen = NULL;
   1812 			nextlen = 0;
   1813 			if (subsize > 0)
   1814 				sublen = kmem_zalloc(subsize, KM_NOSLEEP);
   1815 			if (sublen != NULL) {
   1816 				memcpy(sublen, data, subsize);
   1817 				bwfm_sdio_rx_glom(sc, sublen, nsub, &nextlen);
   1818 				kmem_free(sublen, subsize);
   1819 			}
   1820 			break;
   1821 		default:
   1822 			printf("%s: unknown channel\n", DEVNAME(sc));
   1823 			break;
   1824 		}
   1825 	}
   1826 }
   1827 
   1828 static void
   1829 bwfm_sdio_rx_glom(struct bwfm_sdio_softc *sc, uint16_t *sublen, int nsub,
   1830     uint16_t *nextlen)
   1831 {
   1832 	struct bwfm_sdio_hwhdr hwhdr;
   1833 	struct bwfm_sdio_swhdr swhdr;
   1834 	struct bwfm_proto_bcdc_hdr *bcdc;
   1835 	struct mbuf *m, *m0;
   1836 	size_t flen, off, hoff;
   1837 	int i;
   1838 
   1839 	if (nsub == 0)
   1840 		return;
   1841 
   1842 	m0 = NULL;
   1843 	for (i = 0; i < nsub; i++) {
   1844 		m = bwfm_sdio_newbuf();
   1845 		if (m == NULL) {
   1846 			m_freem(m0);
   1847 			return;
   1848 		}
   1849 		bwfm_qput(&m0, m);
   1850 		if (le16toh(sublen[i]) > m->m_len) {
   1851 			m_freem(m0);
   1852 			printf("%s: header larger than mbuf\n", DEVNAME(sc));
   1853 			return;
   1854 		}
   1855 		if (bwfm_sdio_frame_read_write(sc, mtod(m, char *),
   1856 		    le16toh(sublen[i]), 0)) {
   1857 			m_freem(m0);
   1858 			printf("%s: frame I/O error\n", DEVNAME(sc));
   1859 			return;
   1860 		}
   1861 		m->m_len = m->m_pkthdr.len = le16toh(sublen[i]);
   1862 	}
   1863 
   1864 	if (m0->m_len >= sizeof(hwhdr) + sizeof(swhdr)) {
   1865 		m_copydata(m0, 0, sizeof(hwhdr), &hwhdr);
   1866 		m_copydata(m0, sizeof(hwhdr), sizeof(swhdr), &swhdr);
   1867 
   1868 		/* TODO: Verify actual superframe header */
   1869 
   1870 		/* remove superframe header */
   1871 		if (m0->m_len >= swhdr.dataoff)
   1872 			m_adj(m0, swhdr.dataoff);
   1873 	}
   1874 
   1875 	*nextlen = 0;
   1876 	while ((m = bwfm_qget(&m0)) != NULL) {
   1877 		if (m->m_len < sizeof(hwhdr) + sizeof(swhdr)) {
   1878 			printf("%s: tiny mbuf %d < %zu\n", DEVNAME(sc),
   1879 			    m->m_len, sizeof(hwhdr) + sizeof(swhdr));
   1880 			goto drop;
   1881 		}
   1882 
   1883 		m_copydata(m, 0, sizeof(hwhdr), &hwhdr);
   1884 		m_copydata(m, sizeof(hwhdr), sizeof(swhdr), &swhdr);
   1885 
   1886 		hwhdr.frmlen = le16toh(hwhdr.frmlen);
   1887 		hwhdr.cksum = le16toh(hwhdr.cksum);
   1888 
   1889 		if (hwhdr.frmlen == 0 && hwhdr.cksum == 0)
   1890 			goto drop;
   1891 
   1892 		if ((hwhdr.frmlen ^ hwhdr.cksum) != 0xffff) {
   1893 			printf("%s: checksum error\n", DEVNAME(sc));
   1894 			goto drop;
   1895 		}
   1896 
   1897 
   1898 		if (hwhdr.frmlen < sizeof(hwhdr) + sizeof(swhdr)) {
   1899 			printf("%s: length error\n", DEVNAME(sc));
   1900 			goto drop;
   1901 		}
   1902 
   1903 		flen = hwhdr.frmlen - (sizeof(hwhdr) + sizeof(swhdr));
   1904 		if (flen == 0)
   1905 			goto drop;
   1906 
   1907 		if (hwhdr.frmlen > m->m_len) {
   1908 			printf("%s: short mbuf %d < %zu\n",
   1909 			    DEVNAME(sc),m->m_len,flen);
   1910 			goto drop;
   1911 		}
   1912 
   1913 		if (swhdr.dataoff < (sizeof(hwhdr) + sizeof(swhdr))) {
   1914 			printf("%s: data offset %u in header\n",
   1915 			    DEVNAME(sc), swhdr.dataoff);
   1916 			goto drop;
   1917 		}
   1918 
   1919 		off = swhdr.dataoff - (sizeof(hwhdr) + sizeof(swhdr));
   1920 		if (off > flen) {
   1921 			printf("%s: offset %zu beyond end %zu\n",
   1922 			    DEVNAME(sc), off, flen);
   1923 			goto drop;
   1924 		}
   1925 
   1926 		m_adj(m, (int)hwhdr.frmlen - m->m_len);
   1927 		*nextlen = swhdr.nextlen << 4;
   1928 
   1929 		switch (swhdr.chanflag & BWFM_SDIO_SWHDR_CHANNEL_MASK) {
   1930 		case BWFM_SDIO_SWHDR_CHANNEL_CONTROL:
   1931 			printf("%s: control channel not allowed in glom\n",
   1932 			    DEVNAME(sc));
   1933 			goto drop;
   1934 		case BWFM_SDIO_SWHDR_CHANNEL_EVENT:
   1935 		case BWFM_SDIO_SWHDR_CHANNEL_DATA:
   1936 			m_adj(m, swhdr.dataoff);
   1937 			bcdc = mtod(m, struct bwfm_proto_bcdc_hdr *);
   1938 			hoff = sizeof(*bcdc) + ((size_t)bcdc->data_offset << 2);
   1939 			if (m->m_len < hoff) {
   1940 				printf("%s: short bcdc packet %d < %zu\n",
   1941 				    DEVNAME(sc), m->m_len, hoff);
   1942 				m_freem(m);
   1943 				break;
   1944 			}
   1945 			m_adj(m, hoff);
   1946 			/* don't pass empty packet to stack */
   1947 			if (m->m_len == 0) {
   1948 				m_freem(m);
   1949 				break;
   1950 			}
   1951 			bwfm_rx(&sc->sc_sc, m);
   1952 			break;
   1953 		case BWFM_SDIO_SWHDR_CHANNEL_GLOM:
   1954 			printf("%s: glom not allowed in glom\n",
   1955 			    DEVNAME(sc));
   1956 			goto drop;
   1957 		default:
   1958 			printf("%s: unknown channel\n", DEVNAME(sc));
   1959 			goto drop;
   1960 		}
   1961 
   1962 		continue;
   1963 drop:
   1964 		printf("rx dropped %p len %d\n",mtod(m, char *),m->m_pkthdr.len);
   1965 		m_free(m);
   1966 		break;
   1967 	}
   1968 }
   1969 
   1970 #ifdef BWFM_DEBUG
   1971 static void
   1972 bwfm_sdio_debug_console(struct bwfm_sdio_softc *sc)
   1973 {
   1974 	struct bwfm_sdio_console c;
   1975 	uint32_t newidx;
   1976 	int err;
   1977 
   1978 	if (!sc->sc_console_addr)
   1979 		return;
   1980 
   1981 	err = bwfm_sdio_ram_read_write(sc, sc->sc_console_addr,
   1982 	    (char *)&c, sizeof(c), 0);
   1983 	if (err)
   1984 		return;
   1985 
   1986 	c.log_buf = le32toh(c.log_buf);
   1987 	c.log_bufsz = le32toh(c.log_bufsz);
   1988 	c.log_idx = le32toh(c.log_idx);
   1989 
   1990 	if (sc->sc_console_buf == NULL) {
   1991 		sc->sc_console_buf = malloc(c.log_bufsz, M_DEVBUF,
   1992 		    M_WAITOK|M_ZERO);
   1993 		sc->sc_console_buf_size = c.log_bufsz;
   1994 	}
   1995 
   1996 	newidx = c.log_idx;
   1997 	if (newidx >= sc->sc_console_buf_size)
   1998 		return;
   1999 
   2000 	err = bwfm_sdio_ram_read_write(sc, c.log_buf, sc->sc_console_buf,
   2001 	    sc->sc_console_buf_size, 0);
   2002 	if (err)
   2003 		return;
   2004 
   2005 	if (newidx != sc->sc_console_readidx)
   2006 		DPRINTFN(3, ("BWFM CONSOLE: "));
   2007 	while (newidx != sc->sc_console_readidx) {
   2008 		uint8_t ch = sc->sc_console_buf[sc->sc_console_readidx];
   2009 		sc->sc_console_readidx++;
   2010 		if (sc->sc_console_readidx == sc->sc_console_buf_size)
   2011 			sc->sc_console_readidx = 0;
   2012 		if (ch == '\r')
   2013 			continue;
   2014 		DPRINTFN(3, ("%c", ch));
   2015 	}
   2016 }
   2017 #endif
   2018