Merge pull request #656 from Telecominfraproject/main

Merge for 3.0.2-rc3

.github/workflows/build-dev.yml

@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [ 'cig_wf186h', 'cig_wf186w', 'cig_wf188n', 'cig_wf196', 'cig_wf660a', 'cybertan_eww622-a1', 'cybertan_eww631-a1', 'cybertan_eww631-b1', 'edgecore_eap101', 'edgecore_eap102', 'edgecore_eap104', 'edgecore_eap111', 'edgecore_ecw5211', 'edgecore_oap101', 'edgecore_oap101-6e', 'edgecore_oap101e', 'edgecore_oap101e-6e', 'edgecore_oap102', 'hfcl_ion4','hfcl_ion4xi_wp', 'hfcl_ion4xe', 'hfcl_ion4xi', 'hfcl_ion4x', 'hfcl_ion4x_2', 'hfcl_ion4xi_w', 'hfcl_ion4xi_HMR', 'hfcl_ion4x_w', 'indio_um-305ax', 'indio_um-325ac', 'indio_um-510ac-v3', 'indio_um-550ac', 'indio_um-310ax-v1', 'indio_um-510axp-v1', 'indio_um-510axm-v1', 'udaya_a5-id2', 'wallys_dr40x9', 'wallys_dr6018', 'wallys_dr6018_v4', 'yuncore_ax820', 'yuncore_ax840', 'yuncore_fap640', 'yuncore_fap650', 'yuncore_fap655' ]
+        target: [ 'cig_wf186h', 'cig_wf186w', 'cig_wf188n', 'cig_wf196', 'cig_wf189', 'cig_wf660a', 'cybertan_eww622-a1', 'cybertan_eww631-a1', 'cybertan_eww631-b1', 'edgecore_eap101', 'edgecore_eap102', 'edgecore_eap104', 'edgecore_eap111', 'edgecore_ecw5211', 'edgecore_oap101', 'edgecore_oap101-6e', 'edgecore_oap101e', 'edgecore_oap101e-6e', 'edgecore_oap102', 'hfcl_ion4','hfcl_ion4xi_wp', 'hfcl_ion4xe', 'hfcl_ion4xi', 'hfcl_ion4x', 'hfcl_ion4x_2', 'hfcl_ion4xi_w', 'hfcl_ion4xi_HMR', 'hfcl_ion4x_w', 'indio_um-305ax', 'indio_um-325ac', 'indio_um-510ac-v3', 'indio_um-550ac', 'indio_um-310ax-v1', 'indio_um-510axp-v1', 'indio_um-510axm-v1', 'sercomm_ap72tip', 'udaya_a5-id2', 'wallys_dr40x9', 'wallys_dr6018', 'wallys_dr6018-v4', 'yuncore_ax820', 'yuncore_ax840', 'yuncore_fap640', 'yuncore_fap650', 'yuncore_fap655' ]
 
     steps:
     - uses: actions/checkout@v3

LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2024, Telecom Infra Project
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

feeds/ipq40xx/ipq40xx/base-files/lib/upgrade/platform.sh

@@ -83,12 +83,12 @@ platform_do_upgrade() {
 		part="$(awk -F 'ubi.mtd=' '{printf $2}' /proc/cmdline | cut -d " " -f 1)"
 		case "$part" in
 		rootfs1)
-			fw_setenv active 2 || exit 1
 			CI_UBIPART="rootfs2"
+			CI_FWSETENV="active 2"
 			;;
 		rootfs2)
-			fw_setenv active 1 || exit 1
 			CI_UBIPART="rootfs1"
+			CI_FWSETENV="active 1"
 			;;
 		*)
 			# legacy bootloader

feeds/ipq807x/ipq807x/base-files/etc/init.d/bootcount

@@ -16,7 +16,8 @@ boot() {
 		;;		
 	edgecore,eap101|\
 	edgecore,eap102|\
-	edgecore,oap102)
+	edgecore,oap102|\
+	edgecore.eap104)
 		avail=$(fw_printenv -n upgrade_available)
 		[ "${avail}" -eq 1 ] || fw_setenv upgrade_available 1
 		fw_setenv bootcount 0

feeds/ipq807x/ipq807x/base-files/lib/upgrade/nand.sh

@@ -247,8 +247,8 @@ nand_do_upgrade_success() {
 	local conf_tar="/tmp/sysupgrade.tgz"
 	sync
 	[ "$CI_BOOTCFG" = 1 ] && nand_qca_update_bootconfig
+	[ -f "$conf_tar" ] && nand_restore_config "$conf_tar" && sync
 	[ -n "$CI_FWSETENV" ] && fw_setenv $CI_FWSETENV
-	[ -f "$conf_tar" ] && nand_restore_config "$conf_tar"
 	echo "sysupgrade successful"
 	umount -a
 	reboot -f

feeds/ipq807x/ipq807x/base-files/lib/upgrade/platform.sh

@@ -194,8 +194,6 @@ platform_do_upgrade() {
 	cig,wf194c4|\
 	cig,wf196|\
 	cybertan,eww622-a1|\
-	cybertan,eww631-a1|\
-	cybertan,eww631-b1|\
 	glinet,ax1800|\
 	glinet,axt1800|\
 	indio,um-310ax-v1|\
@@ -262,8 +260,8 @@ platform_do_upgrade() {
 		else
 			if [ -e /tmp/downgrade ]; then
 				CI_UBIPART="rootfs1"
-				fw_setenv active 1 || exit 1
+				{ echo 'active 1'; echo 'upgrade_available 0'; } > /tmp/fw_setenv.txt || exit 1
-				fw_setenv upgrade_available 0 || exit 1
+				CI_FWSETENV="-s /tmp/fw_setenv.txt"
 			elif grep -q rootfs1 /proc/cmdline; then
 				CI_UBIPART="rootfs2"
 				CI_FWSETENV="active 2"
@@ -289,5 +287,18 @@ platform_do_upgrade() {
 		}
 		nand_upgrade_tar "$1"
 		;;
+	cybertan,eww631-a1|\
+	cybertan,eww631-b1)
+		boot_part=$(fw_printenv bootfrom | cut  -d = -f2)
+		echo "Current bootfrom is $boot_part"
+		if [[ $boot_part == 1 ]]; then
+			CI_UBIPART="rootfs"
+			CI_FWSETENV="bootfrom 0"
+		else
+			CI_UBIPART="rootfs_1"
+			CI_FWSETENV="bootfrom 1"
+		fi
+		nand_upgrade_tar "$1"
+		;;
 	esac
 }

feeds/ipq807x_v5.4/ath11k-wifi/Makefile

@@ -29,9 +29,9 @@ ALLWIFIBOARDS:= \
 	cig-wf660a \
 	cig-wf194c \
 	cig-wf194c4 \
-	cig-wf196-ca \
-	cig-wf196-us \
 	cybertan-eww622-a1 \
+	cybertan-eww631-a1 \
+	cybertan-eww631-b1 \
 	edgecore-eap101 \
 	gl-ax1800 \
 	gl-axt1800 \
@@ -89,14 +89,9 @@ $(call Package/ath11k-wifi-default)
     TITLE:=board-2.bin for QCOM IPQ6122 eval kits
 endef
 
-define Package/ath11k-wifi-cig-wf196_6g-ca
+define Package/ath11k-wifi-cig-wf196
 $(call Package/ath11k-wifi-default)
-    TITLE:=cig-wf196 6G bdf CA
+    TITLE:=cig-wf196 bdf
-endef
-
-define Package/ath11k-wifi-cig-wf196_6g-us
-$(call Package/ath11k-wifi-default)
-    TITLE:=cig-wf196 6G bdf US
 endef
 
 define Package/ath11k-wifi-gl-ax1800
@@ -175,14 +170,9 @@ $(call Package/ath11k-wifi-default)
     TITLE:=edgecore-oap101e bdf
 endef
 
-define Package/ath11k-wifi-cig-wf188n-ca
+define Package/ath11k-wifi-cig-wf188n
 $(call Package/ath11k-wifi-default)
-    TITLE:=cig-wf188n bdf CA
+    TITLE:=cig-wf188n bdf
-endef
-
-define Package/ath11k-wifi-cig-wf188n-us
-$(call Package/ath11k-wifi-default)
-    TITLE:=cig-wf188n bdf US
 endef
 
 define ath11k-wifi-install-one-to
@@ -262,16 +252,12 @@ define Package/ath11k-wifi-qcom-qcn9000/install
 	$(INSTALL_DATA) ./board-2.bin.QCN9000 $(1)/lib/firmware/ath11k/QCN9074/hw1.0/board-2.bin
 endef
 
-define Package/ath11k-wifi-cig-wf196_6g-ca/install
+define Package/ath11k-wifi-cig-wf196/install
-	$(INSTALL_DIR) $(1)/lib/firmware/ath11k/QCN9074/hw1.0/
+	$(INSTALL_DIR) $(1)/lib/firmware/ath11k/QCN9074/hw1.0/ $(1)/lib/firmware/ath11k/IPQ8074/hw2.0/
-	$(INSTALL_DATA) ./board-cig-wf196_6g-ca.bin.QCN9074 $(1)/lib/firmware/ath11k/QCN9074/hw1.0/board.bin
+	$(INSTALL_DATA) ./board-cig-wf196_6g-ca.bin.QCN9074 $(1)/lib/firmware/ath11k/QCN9074/hw1.0/board.bin.CA
-	echo -n 'CA' > $(1)/lib/firmware/country
+	$(INSTALL_DATA) ./board-cig-wf196_6g-us.bin.QCN9074 $(1)/lib/firmware/ath11k/QCN9074/hw1.0/board.bin.US
-endef
+	$(INSTALL_DATA) ./board-cig-wf196-ca.bin.IPQ8074 $(1)/lib/firmware/ath11k/IPQ8074/hw2.0/board.bin.CA
-
+	$(INSTALL_DATA) ./board-cig-wf196-us.bin.IPQ8074 $(1)/lib/firmware/ath11k/IPQ8074/hw2.0/board.bin.US
-define Package/ath11k-wifi-cig-wf196_6g-us/install
-	$(INSTALL_DIR) $(1)/lib/firmware/ath11k/QCN9074/hw1.0/
-	$(INSTALL_DATA) ./board-cig-wf196_6g-us.bin.QCN9074 $(1)/lib/firmware/ath11k/QCN9074/hw1.0/board.bin
-	echo -n 'US' > $(1)/lib/firmware/country
 endef
 
 define Package/ath11k-wifi-optimcloud-d50/install
@@ -365,16 +351,10 @@ define Package/ath11k-wifi-edgecore-oap101e/install
 	$(INSTALL_DATA) ./board-2-edgecore-oap101e.bin.QCN6122 $(1)/lib/firmware/ath11k/qcn6122/hw1.0/board-2.bin
 endef
 
-define Package/ath11k-wifi-cig-wf188n-ca/install
+define Package/ath11k-wifi-cig-wf188n/install
 	$(INSTALL_DIR) $(1)/lib/firmware/ath11k/IPQ6018/hw1.0/
-	$(INSTALL_DATA) ./board-cig-wf188n-ca.bin.IPQ6018 $(1)/lib/firmware/ath11k/IPQ6018/hw1.0/board.bin
+	$(INSTALL_DATA) ./board-cig-wf188n-ca.bin.IPQ6018 $(1)/lib/firmware/ath11k/IPQ6018/hw1.0/board.bin.CA
-	echo -n 'CA MY DE' > $(1)/lib/firmware/country
+	$(INSTALL_DATA) ./board-cig-wf188n-us.bin.IPQ6018 $(1)/lib/firmware/ath11k/IPQ6018/hw1.0/board.bin.US
-endef
-
-define Package/ath11k-wifi-cig-wf188n-us/install
-	$(INSTALL_DIR) $(1)/lib/firmware/ath11k/IPQ6018/hw1.0/
-	$(INSTALL_DATA) ./board-cig-wf188n-us.bin.IPQ6018 $(1)/lib/firmware/ath11k/IPQ6018/hw1.0/board.bin
-	echo -n 'US MY DE' > $(1)/lib/firmware/country
 endef
 
 $(eval $(call generate-ath11k-wifi-package,cig-wf186w,Cigtech WF186w))
@@ -382,9 +362,9 @@ $(eval $(call generate-ath11k-wifi-package,cig-wf186h,Cigtech WF186h))
 $(eval $(call generate-ath11k-wifi-package,cig-wf660a,Cigtech WF660a))
 $(eval $(call generate-ath11k-wifi-package,cig-wf194c,Cigtech WF194c))
 $(eval $(call generate-ath11k-wifi-package,cig-wf194c4,Cigtech WF194c4))
-$(eval $(call generate-ath11k-wifi-package,cig-wf196-ca,Cigtech WF196 CA))
-$(eval $(call generate-ath11k-wifi-package,cig-wf196-us,Cigtech WF196 US))
 $(eval $(call generate-ath11k-wifi-package,cybertan-eww622-a1,CyberTan EWW622 A1))
+$(eval $(call generate-ath11k-wifi-package,cybertan-eww631-a1,CyberTan EWW631 A1))
+$(eval $(call generate-ath11k-wifi-package,cybertan-eww631-b1,CyberTan EWW631 B1))
 $(eval $(call generate-ath11k-wifi-package,sercomm-wallaby,Sercomm Kiwi))
 $(eval $(call generate-ath11k-wifi-package,wallys-dr6018,Wallys DR6018))
 $(eval $(call generate-ath11k-wifi-package,wallys-dr6018-v4,Wallys DR6018 V4))
@@ -410,8 +390,7 @@ $(eval $(call BuildPackage,ath11k-wifi-qcom-ipq6122))
 $(eval $(call BuildPackage,ath11k-wifi-qcom-ipq8074))
 $(eval $(call BuildPackage,ath11k-wifi-qcom-ipq6018))
 $(eval $(call BuildPackage,ath11k-wifi-qcom-qcn9000))
-$(eval $(call BuildPackage,ath11k-wifi-cig-wf196_6g-ca))
+$(eval $(call BuildPackage,ath11k-wifi-cig-wf196))
-$(eval $(call BuildPackage,ath11k-wifi-cig-wf196_6g-us))
 $(eval $(call BuildPackage,ath11k-wifi-motorola-q14))
 $(eval $(call BuildPackage,ath11k-wifi-optimcloud-d50))
 $(eval $(call BuildPackage,ath11k-wifi-optimcloud-d60))
@@ -423,5 +402,4 @@ $(eval $(call BuildPackage,ath11k-wifi-hfcl-ion4x_w))
 $(eval $(call BuildPackage,ath11k-wifi-hfcl-ion4xi_HMR))
 $(eval $(call BuildPackage,ath11k-wifi-edgecore-oap101))
 $(eval $(call BuildPackage,ath11k-wifi-edgecore-oap101e))
-$(eval $(call BuildPackage,ath11k-wifi-cig-wf188n-ca))
+$(eval $(call BuildPackage,ath11k-wifi-cig-wf188n))
-$(eval $(call BuildPackage,ath11k-wifi-cig-wf188n-us))

feeds/ipq807x_v5.4/hostapd/patches/s00-001-RADIUS-ACL-PSK-check-during-4-way-handshake.patch

@@ -0,0 +1,459 @@
+From 1c3438fec4bad13a676617915ff56af54e7b4542 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sat, 2 Apr 2022 13:12:43 +0300
+Subject: [PATCH] RADIUS ACL/PSK check during 4-way handshake
+
+Add an alternative sequence for performing the RADIUS ACL check and PSK
+fetch. The previously used (macaddr_acl=2, wpa_psk_radius=2) combination
+does this during IEEE 802.11 Authentication frame exchange while the new
+option (wpa_psk_radius=3) does this during the 4-way handshake. This
+allows some more information to be provided to the RADIUS authentication
+server.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ hostapd/config_file.c    |  3 +-
+ hostapd/hostapd.conf     |  5 ++-
+ src/ap/ap_config.c       |  4 ++-
+ src/ap/ap_config.h       |  5 +--
+ src/ap/ieee802_11.c      |  5 ++-
+ src/ap/ieee802_11.h      |  2 ++
+ src/ap/ieee802_11_auth.c | 76 ++++++++++++++++++++++++++++++++++++----
+ src/ap/ieee802_11_auth.h |  5 ++-
+ src/ap/wpa_auth.c        | 51 ++++++++++++++++++++++++++-
+ src/ap/wpa_auth.h        |  9 ++++-
+ src/ap/wpa_auth_glue.c   | 25 ++++++++++++-
+ src/ap/wpa_auth_i.h      |  1 +
+ 12 files changed, 172 insertions(+), 19 deletions(-)
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2858,7 +2858,8 @@ static int hostapd_config_fill(struct ho
+ 		bss->wpa_psk_radius = atoi(pos);
+ 		if (bss->wpa_psk_radius != PSK_RADIUS_IGNORED &&
+ 		    bss->wpa_psk_radius != PSK_RADIUS_ACCEPTED &&
+-		    bss->wpa_psk_radius != PSK_RADIUS_REQUIRED) {
++		    bss->wpa_psk_radius != PSK_RADIUS_REQUIRED &&
++		    bss->wpa_psk_radius != PSK_RADIUS_DURING_4WAY_HS) {
+ 			wpa_printf(MSG_ERROR,
+ 				   "Line %d: unknown wpa_psk_radius %d",
+ 				   line, bss->wpa_psk_radius);
+--- a/hostapd/hostapd.conf
++++ b/hostapd/hostapd.conf
+@@ -1635,12 +1635,15 @@ own_ip_addr=127.0.0.1
+ #wpa_psk_file=/etc/hostapd.wpa_psk
+ 
+ # Optionally, WPA passphrase can be received from RADIUS authentication server
+-# This requires macaddr_acl to be set to 2 (RADIUS)
++# This requires macaddr_acl to be set to 2 (RADIUS) for wpa_psk_radius values
++# 1 and 2.
+ # 0 = disabled (default)
+ # 1 = optional; use default passphrase/psk if RADIUS server does not include
+ #	Tunnel-Password
+ # 2 = required; reject authentication if RADIUS server does not include
+ #	Tunnel-Password
++# 3 = ask RADIUS server during 4-way handshake if there is no locally
++#	configured PSK/passphrase for the STA
+ #wpa_psk_radius=0
+ 
+ # Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). The
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -1,6 +1,6 @@
+ /*
+  * hostapd / Configuration helper functions
+- * Copyright (c) 2003-2014, Jouni Malinen <j@w1.fi>
++ * Copyright (c) 2003-2022, Jouni Malinen <j@w1.fi>
+  *
+  * This software may be distributed under the terms of the BSD license.
+  * See README for more details.
+@@ -1245,6 +1245,7 @@ static int hostapd_config_check_bss(stru
+ 
+ 	if (full_config && bss->wpa &&
+ 	    bss->wpa_psk_radius != PSK_RADIUS_IGNORED &&
++	    bss->wpa_psk_radius != PSK_RADIUS_DURING_4WAY_HS &&
+ 	    bss->macaddr_acl != USE_EXTERNAL_RADIUS_AUTH) {
+ 		wpa_printf(MSG_ERROR, "WPA-PSK using RADIUS enabled, but no "
+ 			   "RADIUS checking (macaddr_acl=2) enabled.");
+@@ -1254,6 +1255,7 @@ static int hostapd_config_check_bss(stru
+ 	if (full_config && bss->wpa && (bss->wpa_key_mgmt & WPA_KEY_MGMT_PSK) &&
+ 	    bss->ssid.wpa_psk == NULL && bss->ssid.wpa_passphrase == NULL &&
+ 	    bss->ssid.wpa_psk_file == NULL &&
++	    bss->wpa_psk_radius != PSK_RADIUS_DURING_4WAY_HS &&
+ 	    (bss->wpa_psk_radius != PSK_RADIUS_REQUIRED ||
+ 	     bss->macaddr_acl != USE_EXTERNAL_RADIUS_AUTH)) {
+ 		wpa_printf(MSG_ERROR, "WPA-PSK enabled, but PSK or passphrase "
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -1,6 +1,6 @@
+ /*
+  * hostapd / Configuration definitions and helpers functions
+- * Copyright (c) 2003-2015, Jouni Malinen <j@w1.fi>
++ * Copyright (c) 2003-2022, Jouni Malinen <j@w1.fi>
+  *
+  * This software may be distributed under the terms of the BSD license.
+  * See README for more details.
+@@ -367,7 +367,8 @@ struct hostapd_bss_config {
+ 	enum {
+ 		PSK_RADIUS_IGNORED = 0,
+ 		PSK_RADIUS_ACCEPTED = 1,
+-		PSK_RADIUS_REQUIRED = 2
++		PSK_RADIUS_REQUIRED = 2,
++		PSK_RADIUS_DURING_4WAY_HS = 3,
+ 	} wpa_psk_radius;
+ 	int wpa_pairwise;
+ 	int group_cipher; /* wpa_group value override from configuation */
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -2348,9 +2348,8 @@ static int ieee802_11_allowed_address(st
+ }
+ 
+ 
+-static int
+-ieee802_11_set_radius_info(struct hostapd_data *hapd, struct sta_info *sta,
+-			   int res, struct radius_sta *info)
++int ieee802_11_set_radius_info(struct hostapd_data *hapd, struct sta_info *sta,
++			       int res, struct radius_sta *info)
+ {
+ 	u32 session_timeout = info->session_timeout;
+ 	u32 acct_interim_interval = info->acct_interim_interval;
+--- a/src/ap/ieee802_11.h
++++ b/src/ap/ieee802_11.h
+@@ -220,4 +220,6 @@ void auth_sae_process_commit(void *eloop
+ u8 * hostapd_eid_rsnxe(struct hostapd_data *hapd, u8 *eid, size_t len);
+ u8 * hostapd_get_rsne(struct hostapd_data *hapd, u8 *pos, size_t len);
+ u8 * hostapd_get_rsnxe(struct hostapd_data *hapd, u8 *pos, size_t len);
++int ieee802_11_set_radius_info(struct hostapd_data *hapd, struct sta_info *sta,
++		                              int res, struct radius_sta *info);
+ #endif /* IEEE802_11_H */
+--- a/src/ap/ieee802_11_auth.c
++++ b/src/ap/ieee802_11_auth.c
+@@ -1,6 +1,6 @@
+ /*
+  * hostapd / IEEE 802.11 authentication (ACL)
+- * Copyright (c) 2003-2012, Jouni Malinen <j@w1.fi>
++ * Copyright (c) 2003-2022, Jouni Malinen <j@w1.fi>
+  *
+  * This software may be distributed under the terms of the BSD license.
+  * See README for more details.
+@@ -20,6 +20,8 @@
+ #include "hostapd.h"
+ #include "ap_config.h"
+ #include "ap_drv_ops.h"
++#include "sta_info.h"
++#include "wpa_auth.h"
+ #include "ieee802_11.h"
+ #include "ieee802_1x.h"
+ #include "ieee802_11_auth.h"
+@@ -43,6 +45,8 @@ struct hostapd_acl_query_data {
+ 	u8 *auth_msg; /* IEEE 802.11 authentication frame from station */
+ 	size_t auth_msg_len;
+ 	struct hostapd_acl_query_data *next;
++	bool radius_psk;
++	int akm;
+ };
+ 
+ 
+@@ -153,6 +157,13 @@ static int hostapd_radius_acl_query(stru
+ 		goto fail;
+ 	}
+ 
++	if (query->akm &&
++	    !radius_msg_add_attr_int32(msg, RADIUS_ATTR_WLAN_AKM_SUITE,
++				       wpa_akm_to_suite(query->akm))) {
++		wpa_printf(MSG_DEBUG, "Could not add WLAN-AKM-Suite");
++		goto fail;
++	}
++
+ 	if (radius_client_send(hapd->radius, msg, RADIUS_AUTH, addr) < 0)
+ 		goto fail;
+ 	return 0;
+@@ -566,17 +577,40 @@ hostapd_acl_recv_radius(struct radius_ms
+ 	cache->next = hapd->acl_cache;
+ 	hapd->acl_cache = cache;
+ 
++	if (query->radius_psk) {
++		struct sta_info *sta;
++		bool success = cache->accepted == HOSTAPD_ACL_ACCEPT;
++
++		sta = ap_get_sta(hapd, query->addr);
++		if (!sta || !sta->wpa_sm) {
++			wpa_printf(MSG_DEBUG,
++				   "No STA/SM entry found for the RADIUS PSK response");
++			goto done;
++		}
++#ifdef NEED_AP_MLME
++		if (success &&
++		    (ieee802_11_set_radius_info(hapd, sta, cache->accepted,
++						info) < 0 ||
++		     ap_sta_bind_vlan(hapd, sta) < 0))
++			success = false;
++#endif /* NEED_AP_MLME */
++		wpa_auth_sta_radius_psk_resp(sta->wpa_sm, success);
++	} else {
+ #ifdef CONFIG_DRIVER_RADIUS_ACL
+-	hostapd_drv_set_radius_acl_auth(hapd, query->addr, cache->accepted,
+-					info->session_timeout);
++		hostapd_drv_set_radius_acl_auth(hapd, query->addr,
++						cache->accepted,
++						info->session_timeout);
+ #else /* CONFIG_DRIVER_RADIUS_ACL */
+ #ifdef NEED_AP_MLME
+-	/* Re-send original authentication frame for 802.11 processing */
+-	wpa_printf(MSG_DEBUG, "Re-sending authentication frame after "
+-		   "successful RADIUS ACL query");
+-	ieee802_11_mgmt(hapd, query->auth_msg, query->auth_msg_len, NULL);
++		/* Re-send original authentication frame for 802.11 processing
++		 */
++		wpa_printf(MSG_DEBUG,
++			   "Re-sending authentication frame after successful RADIUS ACL query");
++		ieee802_11_mgmt(hapd, query->auth_msg, query->auth_msg_len,
++				NULL);
+ #endif /* NEED_AP_MLME */
+ #endif /* CONFIG_DRIVER_RADIUS_ACL */
++	}
+ 
+  done:
+ 	if (prev == NULL)
+@@ -658,3 +692,31 @@ void hostapd_free_psk_list(struct hostap
+ 		os_free(prev);
+ 	}
+ }
++
++
++#ifndef CONFIG_NO_RADIUS
++void hostapd_acl_req_radius_psk(struct hostapd_data *hapd, const u8 *addr,
++				int key_mgmt, const u8 *anonce,
++				const u8 *eapol, size_t eapol_len)
++{
++	struct hostapd_acl_query_data *query;
++
++	query = os_zalloc(sizeof(*query));
++	if (!query)
++		return;
++
++	query->radius_psk = true;
++	query->akm = key_mgmt;
++	os_get_reltime(&query->timestamp);
++	os_memcpy(query->addr, addr, ETH_ALEN);
++	if (hostapd_radius_acl_query(hapd, addr, query)) {
++		wpa_printf(MSG_DEBUG,
++			   "Failed to send Access-Request for RADIUS PSK/ACL query");
++		hostapd_acl_query_free(query);
++		return;
++	}
++
++	query->next = hapd->acl_queries;
++	hapd->acl_queries = query;
++}
++#endif /* CONFIG_NO_RADIUS */
+--- a/src/ap/ieee802_11_auth.h
++++ b/src/ap/ieee802_11_auth.h
+@@ -1,6 +1,6 @@
+ /*
+  * hostapd / IEEE 802.11 authentication (ACL)
+- * Copyright (c) 2003-2005, Jouni Malinen <j@w1.fi>
++ * Copyright (c) 2003-2022, Jouni Malinen <j@w1.fi>
+  *
+  * This software may be distributed under the terms of the BSD license.
+  * See README for more details.
+@@ -36,5 +36,8 @@ void hostapd_free_psk_list(struct hostap
+ void hostapd_acl_expire(struct hostapd_data *hapd);
+ void hostapd_copy_psk_list(struct hostapd_sta_wpa_psk_short **psk,
+ 			   struct hostapd_sta_wpa_psk_short *src);
++void hostapd_acl_req_radius_psk(struct hostapd_data *hapd, const u8 *addr,
++				int key_mgmt, const u8 *anonce,
++				const u8 *eapol, size_t eapol_len);
+ 
+ #endif /* IEEE802_11_AUTH_H */
+--- a/src/ap/wpa_auth.c
++++ b/src/ap/wpa_auth.c
+@@ -1,6 +1,6 @@
+ /*
+  * IEEE 802.11 RSN / WPA Authenticator
+- * Copyright (c) 2004-2019, Jouni Malinen <j@w1.fi>
++ * Copyright (c) 2004-2022, Jouni Malinen <j@w1.fi>
+  *
+  * This software may be distributed under the terms of the BSD license.
+  * See README for more details.
+@@ -1465,6 +1465,12 @@ static void wpa_send_eapol_timeout(void
+ 	struct wpa_authenticator *wpa_auth = eloop_ctx;
+ 	struct wpa_state_machine *sm = timeout_ctx;
+ 
++	if (sm->waiting_radius_psk) {
++		wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG,
++				"Ignore EAPOL-Key timeout while waiting for RADIUS PSK");
++		return;
++	}
++
+ 	sm->pending_1_of_4_timeout = 0;
+ 	wpa_auth_logger(wpa_auth, sm->addr, LOGGER_DEBUG, "EAPOL-Key timeout");
+ 	sm->TimeoutEvt = true;
+@@ -3003,6 +3009,19 @@ SM_STATE(WPA_PTK, PTKCALCNEGOTIATING)
+ 			break;
+ 	}
+ 
++	if (!ok && wpa_key_mgmt_wpa_psk_no_sae(sm->wpa_key_mgmt) &&
++	    wpa_auth->conf.radius_psk && wpa_auth->cb->request_radius_psk &&
++	    !sm->waiting_radius_psk) {
++		wpa_printf(MSG_DEBUG, "No PSK available - ask RADIUS server");
++		wpa_auth->cb->request_radius_psk(wpa_auth->cb_ctx, sm->addr,
++						 sm->wpa_key_mgmt,
++						 sm->ANonce,
++						 sm->last_rx_eapol_key,
++						 sm->last_rx_eapol_key_len);
++		sm->waiting_radius_psk = 1;
++		return;
++	}
++
+ 	if (!ok) {
+ 		wpa_auth_logger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
+ 				"invalid MIC in msg 2/4 of 4-Way Handshake");
+@@ -3758,6 +3777,11 @@ SM_STEP(WPA_PTK)
+ 		} else if (wpa_auth_uses_sae(sm) && sm->pmksa) {
+ 			SM_ENTER(WPA_PTK, PTKSTART);
+ #endif /* CONFIG_SAE */
++		} else if (wpa_key_mgmt_wpa_psk_no_sae(sm->wpa_key_mgmt) &&
++			   wpa_auth->conf.radius_psk) {
++			wpa_printf(MSG_DEBUG,
++				   "INITPSK: No PSK yet available for STA - use RADIUS later");
++			SM_ENTER(WPA_PTK, PTKSTART);
+ 		} else {
+ 			wpa_auth_logger(wpa_auth, sm->addr, LOGGER_INFO,
+ 					"no PSK configured for the STA");
+@@ -5661,3 +5685,28 @@ void wpa_auth_set_ocv_override_freq(stru
+ }
+ 
+ #endif /* CONFIG_TESTING_OPTIONS */
++
++
++void wpa_auth_sta_radius_psk_resp(struct wpa_state_machine *sm, bool success)
++{
++	if (!sm->waiting_radius_psk) {
++		wpa_printf(MSG_DEBUG,
++			   "Ignore RADIUS PSK response for " MACSTR
++			   " that did not wait one",
++			   MAC2STR(sm->addr));
++		return;
++	}
++
++	wpa_printf(MSG_DEBUG, "RADIUS PSK response for " MACSTR " (%s)",
++		   MAC2STR(sm->addr), success ? "success" : "fail");
++	sm->waiting_radius_psk = 0;
++
++	if (success) {
++		/* Try to process the EAPOL-Key msg 2/4 again */
++		sm->EAPOLKeyReceived = true;
++	} else {
++		sm->Disconnect = true;
++	}
++
++	eloop_register_timeout(0, 0, wpa_sm_call_step, sm, NULL);
++}
+--- a/src/ap/wpa_auth.h
++++ b/src/ap/wpa_auth.h
+@@ -1,6 +1,6 @@
+ /*
+  * hostapd - IEEE 802.11i-2004 / WPA Authenticator
+- * Copyright (c) 2004-2017, Jouni Malinen <j@w1.fi>
++ * Copyright (c) 2004-2022, Jouni Malinen <j@w1.fi>
+  *
+  * This software may be distributed under the terms of the BSD license.
+  * See README for more details.
+@@ -273,6 +273,8 @@ struct wpa_auth_config {
+ 	 * PTK derivation regardless of advertised capabilities.
+ 	 */
+ 	bool force_kdk_derivation;
++
++	bool radius_psk;
+ };
+ 
+ typedef enum {
+@@ -320,6 +322,9 @@ struct wpa_auth_callbacks {
+ 	void (*store_ptksa)(void *ctx, const u8 *addr, int cipher,
+ 			    u32 life_time, const struct wpa_ptk *ptk);
+ 	void (*clear_ptksa)(void *ctx, const u8 *addr, int cipher);
++	void (*request_radius_psk)(void *ctx, const u8 *addr, int key_mgmt,
++				   const u8 *anonce,
++				   const u8 *eapol, size_t eapol_len);
+ #ifdef CONFIG_IEEE80211R_AP
+ 	struct wpa_state_machine * (*add_sta)(void *ctx, const u8 *sta_addr);
+ 	int (*add_sta_ft)(void *ctx, const u8 *sta_addr);
+@@ -567,4 +572,6 @@ void wpa_auth_set_ocv_override_freq(stru
+ 				    enum wpa_auth_ocv_override_frame frame,
+ 				    unsigned int freq);
+ 
++void wpa_auth_sta_radius_psk_resp(struct wpa_state_machine *sm, bool success);
++
+ #endif /* WPA_AUTH_H */
+--- a/src/ap/wpa_auth_glue.c
++++ b/src/ap/wpa_auth_glue.c
+@@ -1,6 +1,6 @@
+ /*
+  * hostapd / WPA authenticator glue code
+- * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
++ * Copyright (c) 2002-2022, Jouni Malinen <j@w1.fi>
+  *
+  * This software may be distributed under the terms of the BSD license.
+  * See README for more details.
+@@ -29,6 +29,7 @@
+ #include "ap_drv_ops.h"
+ #include "ap_config.h"
+ #include "ieee802_11.h"
++#include "ieee802_11_auth.h"
+ #include "pmksa_cache_auth.h"
+ #include "wpa_auth.h"
+ #include "wpa_auth_glue.h"
+@@ -214,6 +215,8 @@ static void hostapd_wpa_auth_conf(struct
+ 	wconf->force_kdk_derivation = conf->force_kdk_derivation;
+ #endif /* CONFIG_TESTING_OPTIONS */
+ #endif /* CONFIG_PASN */
++
++	wconf->radius_psk = conf->wpa_psk_radius == PSK_RADIUS_DURING_4WAY_HS;
+ }
+ 
+ 
+@@ -1435,6 +1438,23 @@ static void hostapd_wpa_unregister_ft_ou
+ #endif /* CONFIG_IEEE80211R_AP */
+ 
+ 
++#ifndef CONFIG_NO_RADIUS
++static void hostapd_request_radius_psk(void *ctx, const u8 *addr, int key_mgmt,
++				       const u8 *anonce,
++				       const u8 *eapol, size_t eapol_len)
++{
++	struct hostapd_data *hapd = ctx;
++
++	wpa_printf(MSG_DEBUG, "RADIUS PSK request for " MACSTR " key_mgmt=0x%x",
++		   MAC2STR(addr), key_mgmt);
++	wpa_hexdump(MSG_DEBUG, "ANonce", anonce, WPA_NONCE_LEN);
++	wpa_hexdump(MSG_DEBUG, "EAPOL", eapol, eapol_len);
++	hostapd_acl_req_radius_psk(hapd, addr, key_mgmt, anonce, eapol,
++				   eapol_len);
++}
++#endif /* CONFIG_NO_RADIUS */
++
++
+ int hostapd_setup_wpa(struct hostapd_data *hapd)
+ {
+ 	struct wpa_auth_config _conf;
+@@ -1478,6 +1498,9 @@ int hostapd_setup_wpa(struct hostapd_dat
+ 		.set_session_timeout = hostapd_wpa_auth_set_session_timeout,
+ 		.get_session_timeout = hostapd_wpa_auth_get_session_timeout,
+ #endif /* CONFIG_IEEE80211R_AP */
++#ifndef CONFIG_NO_RADIUS
++		.request_radius_psk = hostapd_request_radius_psk,
++#endif /* CONFIG_NO_RADIUS */
+ 	};
+ 	const u8 *wpa_ie;
+ 	size_t wpa_ie_len;
+--- a/src/ap/wpa_auth_i.h
++++ b/src/ap/wpa_auth_i.h
+@@ -89,6 +89,7 @@ struct wpa_state_machine {
+ 	unsigned int rx_eapol_key_secure:1;
+ 	unsigned int update_snonce:1;
+ 	unsigned int alt_snonce_valid:1;
++	unsigned int waiting_radius_psk:1;
+ #ifdef CONFIG_IEEE80211R_AP
+ 	unsigned int ft_completed:1;
+ 	unsigned int pmk_r1_name_valid:1;

feeds/ipq807x_v5.4/hostapd/patches/s00-002-RADIUS-Attributes-with-Extended-Types-RFC-6929.patch

@@ -0,0 +1,350 @@
+From 24763e3cd0a564eb71f3c501bbb4fbb0d7070762 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Fri, 15 Apr 2022 17:31:48 +0300
+Subject: [PATCH] RADIUS: Attributes with Extended Types (RFC 6929)
+
+Supported extended types for RADIUS attributes for the cases defined in
+RFC 6929.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/radius/radius.c | 195 ++++++++++++++++++++++++++++++++++++++------
+ src/radius/radius.h |  26 +++++-
+ 2 files changed, 193 insertions(+), 28 deletions(-)
+
+diff --git a/src/radius/radius.c b/src/radius/radius.c
+index be16e27b9..a64228067 100644
+--- a/src/radius/radius.c
++++ b/src/radius/radius.c
+@@ -1,6 +1,6 @@
+ /*
+  * RADIUS message processing
+- * Copyright (c) 2002-2009, 2011-2015, Jouni Malinen <j@w1.fi>
++ * Copyright (c) 2002-2009, 2011-2022, Jouni Malinen <j@w1.fi>
+  *
+  * This software may be distributed under the terms of the BSD license.
+  * See README for more details.
+@@ -159,7 +159,8 @@ static const char *radius_code_string(u8 code)
+ 
+ 
+ struct radius_attr_type {
+-	u8 type;
++	u16 type; /* 0..255 for basic types;
++		   * (241 << 8) | <ext-type> for extended types */
+ 	char *name;
+ 	enum {
+ 		RADIUS_ATTR_UNDIST, RADIUS_ATTR_TEXT, RADIUS_ATTR_IP,
+@@ -260,11 +261,31 @@ static const struct radius_attr_type radius_attrs[] =
+ 	  RADIUS_ATTR_HEXDUMP },
+ 	{ RADIUS_ATTR_WLAN_GROUP_MGMT_CIPHER, "WLAN-Group-Mgmt-Pairwise-Cipher",
+ 	  RADIUS_ATTR_HEXDUMP },
++	{ RADIUS_ATTR_EXT_TYPE_1, "Extended-Type-1", RADIUS_ATTR_UNDIST },
++	{ RADIUS_ATTR_EXT_TYPE_2, "Extended-Type-2", RADIUS_ATTR_UNDIST },
++	{ RADIUS_ATTR_EXT_TYPE_3, "Extended-Type-3", RADIUS_ATTR_UNDIST },
++	{ RADIUS_ATTR_EXT_TYPE_4, "Extended-Type-4", RADIUS_ATTR_UNDIST },
++	{ RADIUS_ATTR_LONG_EXT_TYPE_1, "Long-Extended-Type-1",
++	  RADIUS_ATTR_UNDIST },
++	{ RADIUS_ATTR_LONG_EXT_TYPE_2, "Long-Extended-Type-2",
++	  RADIUS_ATTR_UNDIST },
++	{ RADIUS_ATTR_EXT_VENDOR_SPECIFIC_1, "Extended-Vendor-Specific-1",
++	  RADIUS_ATTR_UNDIST },
++	{ RADIUS_ATTR_EXT_VENDOR_SPECIFIC_2, "Extended-Vendor-Specific-2",
++	  RADIUS_ATTR_UNDIST },
++	{ RADIUS_ATTR_EXT_VENDOR_SPECIFIC_3, "Extended-Vendor-Specific-3",
++	  RADIUS_ATTR_UNDIST },
++	{ RADIUS_ATTR_EXT_VENDOR_SPECIFIC_4, "Extended-Vendor-Specific-4",
++	  RADIUS_ATTR_UNDIST },
++	{ RADIUS_ATTR_EXT_VENDOR_SPECIFIC_5, "Extended-Vendor-Specific-5",
++	  RADIUS_ATTR_UNDIST },
++	{ RADIUS_ATTR_EXT_VENDOR_SPECIFIC_6, "Extended-Vendor-Specific-6",
++	  RADIUS_ATTR_UNDIST },
+ };
+ #define RADIUS_ATTRS ARRAY_SIZE(radius_attrs)
+ 
+ 
+-static const struct radius_attr_type *radius_get_attr_type(u8 type)
++static const struct radius_attr_type * radius_get_attr_type(u16 type)
+ {
+ 	size_t i;
+ 
+@@ -277,23 +298,60 @@ static const struct radius_attr_type *radius_get_attr_type(u8 type)
+ }
+ 
+ 
++static bool radius_is_long_ext_type(u8 type)
++{
++	return type == RADIUS_ATTR_LONG_EXT_TYPE_1 ||
++		type == RADIUS_ATTR_LONG_EXT_TYPE_2;
++}
++
++
++static bool radius_is_ext_type(u8 type)
++{
++	return type >= RADIUS_ATTR_EXT_TYPE_1 &&
++		type <= RADIUS_ATTR_LONG_EXT_TYPE_2;
++}
++
++
+ static void radius_msg_dump_attr(struct radius_attr_hdr *hdr)
+ {
++	struct radius_attr_hdr_ext *ext = NULL;
+ 	const struct radius_attr_type *attr;
+ 	int len;
+ 	unsigned char *pos;
+ 	char buf[1000];
+ 
+-	attr = radius_get_attr_type(hdr->type);
++	if (hdr->length < sizeof(struct radius_attr_hdr))
++		return;
+ 
+-	wpa_printf(MSG_INFO, "   Attribute %d (%s) length=%d",
+-		   hdr->type, attr ? attr->name : "?Unknown?", hdr->length);
++	if (radius_is_ext_type(hdr->type)) {
++		if (hdr->length < 4) {
++			wpa_printf(MSG_INFO,
++				   "   Invalid attribute %d (too short for extended type)",
++				hdr->type);
++			return;
++		}
+ 
+-	if (attr == NULL || hdr->length < sizeof(struct radius_attr_hdr))
+-		return;
++		ext = (struct radius_attr_hdr_ext *) hdr;
++	}
++
++	if (ext) {
++		attr = radius_get_attr_type((ext->type << 8) | ext->ext_type);
++		wpa_printf(MSG_INFO, "   Attribute %d.%d (%s) length=%d",
++			   ext->type, ext->ext_type,
++			   attr ? attr->name : "?Unknown?", ext->length);
++		pos = (unsigned char *) (ext + 1);
++		len = ext->length - sizeof(struct radius_attr_hdr_ext);
++	} else {
++		attr = radius_get_attr_type(hdr->type);
++		wpa_printf(MSG_INFO, "   Attribute %d (%s) length=%d",
++			   hdr->type, attr ? attr->name : "?Unknown?",
++			   hdr->length);
++		pos = (unsigned char *) (hdr + 1);
++		len = hdr->length - sizeof(struct radius_attr_hdr);
++	}
+ 
+-	len = hdr->length - sizeof(struct radius_attr_hdr);
+-	pos = (unsigned char *) (hdr + 1);
++	if (!attr)
++		return;
+ 
+ 	switch (attr->data_type) {
+ 	case RADIUS_ATTR_TEXT:
+@@ -627,22 +685,54 @@ static int radius_msg_add_attr_to_array(struct radius_msg *msg,
+ }
+ 
+ 
+-struct radius_attr_hdr *radius_msg_add_attr(struct radius_msg *msg, u8 type,
+-					    const u8 *data, size_t data_len)
++struct radius_attr_hdr * radius_msg_add_attr(struct radius_msg *msg, u16 type,
++					     const u8 *data, size_t data_len)
+ {
+-	size_t buf_needed;
+-	struct radius_attr_hdr *attr;
++	size_t buf_needed, max_len;
++	struct radius_attr_hdr *attr = NULL;
++	struct radius_attr_hdr_ext *ext;
++	u8 ext_type = 0;
+ 
+ 	if (TEST_FAIL())
+ 		return NULL;
+ 
+-	if (data_len > RADIUS_MAX_ATTR_LEN) {
+-		wpa_printf(MSG_ERROR, "radius_msg_add_attr: too long attribute (%lu bytes)",
+-		       (unsigned long) data_len);
+-		return NULL;
++	if (type > 255) {
++		if (!radius_is_ext_type(type >> 8)) {
++			wpa_printf(MSG_ERROR,
++				   "%s: Undefined extended type %d.%d",
++				   __func__, type >> 8, type & 0xff);
++			return NULL;
++		}
++		ext_type = type & 0xff;
++		type >>= 8;
++	} else if (radius_is_ext_type(type)) {
++		wpa_printf(MSG_ERROR, "%s: Unexpected extended type use for %d",
++			   __func__, type);
+ 	}
+ 
+-	buf_needed = sizeof(*attr) + data_len;
++	if (radius_is_long_ext_type(type)) {
++		size_t hdr_len = sizeof(struct radius_attr_hdr_ext) + 1;
++		size_t plen = 255 - hdr_len;
++		size_t num;
++
++		max_len = 4096;
++		num = (data_len + plen - 1) / plen;
++		if (num == 0)
++			num = 1;
++		buf_needed = num * hdr_len + data_len;
++	} else if (radius_is_ext_type(type)) {
++		max_len = RADIUS_MAX_EXT_ATTR_LEN;
++		buf_needed = sizeof(struct radius_attr_hdr_ext) + data_len;
++	} else {
++		max_len = RADIUS_MAX_ATTR_LEN;
++		buf_needed = sizeof(*attr) + data_len;
++	}
++	if (data_len > max_len) {
++		wpa_printf(MSG_ERROR,
++			   "%s: too long attribute (%zu > %zu bytes)",
++			   __func__, data_len, max_len);
++		return NULL;
++	}
+ 
+ 	if (wpabuf_tailroom(msg->buf) < buf_needed) {
+ 		/* allocate more space for message buffer */
+@@ -651,13 +741,44 @@ struct radius_attr_hdr *radius_msg_add_attr(struct radius_msg *msg, u8 type,
+ 		msg->hdr = wpabuf_mhead(msg->buf);
+ 	}
+ 
+-	attr = wpabuf_put(msg->buf, sizeof(struct radius_attr_hdr));
+-	attr->type = type;
+-	attr->length = sizeof(*attr) + data_len;
+-	wpabuf_put_data(msg->buf, data, data_len);
+-
+-	if (radius_msg_add_attr_to_array(msg, attr))
+-		return NULL;
++	if (radius_is_long_ext_type(type)) {
++		size_t plen = 255 - sizeof(struct radius_attr_hdr_ext) - 1;
++		size_t alen;
++
++		do {
++			alen = data_len > plen ? plen : data_len;
++			ext = wpabuf_put(msg->buf,
++					 sizeof(struct radius_attr_hdr_ext));
++			if (!attr)
++				attr = (struct radius_attr_hdr *) ext;
++			ext->type = type;
++			ext->length = sizeof(*ext) + 1 + alen;
++			ext->ext_type = ext_type;
++			wpabuf_put_u8(msg->buf, data_len > alen ? 0x80 : 0);
++			wpabuf_put_data(msg->buf, data, data_len);
++			data += alen;
++			data_len -= alen;
++			if (radius_msg_add_attr_to_array(
++				    msg, (struct radius_attr_hdr *) ext))
++				return NULL;
++		} while (data_len > 0);
++	} else if (radius_is_ext_type(type)) {
++		ext = wpabuf_put(msg->buf, sizeof(struct radius_attr_hdr_ext));
++		attr = (struct radius_attr_hdr *) ext;
++		ext->type = type;
++		ext->length = sizeof(*ext) + data_len;
++		ext->ext_type = ext_type;
++		wpabuf_put_data(msg->buf, data, data_len);
++		if (radius_msg_add_attr_to_array(msg, attr))
++			return NULL;
++	} else {
++		attr = wpabuf_put(msg->buf, sizeof(struct radius_attr_hdr));
++		attr->type = type;
++		attr->length = sizeof(*attr) + data_len;
++		wpabuf_put_data(msg->buf, data, data_len);
++		if (radius_msg_add_attr_to_array(msg, attr))
++			return NULL;
++	}
+ 
+ 	return attr;
+ }
+@@ -1285,6 +1406,28 @@ int radius_msg_add_wfa(struct radius_msg *msg, u8 subtype, const u8 *data,
+ }
+ 
+ 
++int radius_msg_add_ext_vs(struct radius_msg *msg, u16 type, u32 vendor_id,
++			  u8 vendor_type, const u8 *data, size_t len)
++{
++	struct radius_attr_hdr *attr;
++	u8 *buf, *pos;
++	size_t alen;
++
++	alen = 4 + 1 + len;
++	buf = os_malloc(alen);
++	if (!buf)
++		return 0;
++	pos = buf;
++	WPA_PUT_BE32(pos, vendor_id);
++	pos += 4;
++	*pos++ = vendor_type;
++	os_memcpy(pos, data, len);
++	attr = radius_msg_add_attr(msg, type, buf, alen);
++	os_free(buf);
++	return attr != NULL;
++}
++
++
+ int radius_user_password_hide(struct radius_msg *msg,
+ 			      const u8 *data, size_t data_len,
+ 			      const u8 *secret, size_t secret_len,
+diff --git a/src/radius/radius.h b/src/radius/radius.h
+index fb8148180..490c8d1f6 100644
+--- a/src/radius/radius.h
++++ b/src/radius/radius.h
+@@ -1,6 +1,6 @@
+ /*
+  * RADIUS message processing
+- * Copyright (c) 2002-2009, 2012, 2014-2015, Jouni Malinen <j@w1.fi>
++ * Copyright (c) 2002-2009, 2012, 2014-2022, Jouni Malinen <j@w1.fi>
+  *
+  * This software may be distributed under the terms of the BSD license.
+  * See README for more details.
+@@ -46,7 +46,15 @@ struct radius_attr_hdr {
+ 	/* followed by length-2 octets of attribute value */
+ } STRUCT_PACKED;
+ 
++struct radius_attr_hdr_ext {
++	u8 type;
++	u8 length; /* including this header */
++	u8 ext_type;
++	/* followed by length-3 octets of attribute value */
++} STRUCT_PACKED;
++
+ #define RADIUS_MAX_ATTR_LEN (255 - sizeof(struct radius_attr_hdr))
++#define RADIUS_MAX_EXT_ATTR_LEN (255 - sizeof(struct radius_attr_hdr_ext))
+ 
+ enum { RADIUS_ATTR_USER_NAME = 1,
+        RADIUS_ATTR_USER_PASSWORD = 2,
+@@ -113,6 +121,18 @@ enum { RADIUS_ATTR_USER_NAME = 1,
+        RADIUS_ATTR_WLAN_GROUP_CIPHER = 187,
+        RADIUS_ATTR_WLAN_AKM_SUITE = 188,
+        RADIUS_ATTR_WLAN_GROUP_MGMT_CIPHER = 189,
++       RADIUS_ATTR_EXT_TYPE_1 = 241,
++       RADIUS_ATTR_EXT_TYPE_2 = 242,
++       RADIUS_ATTR_EXT_TYPE_3 = 243,
++       RADIUS_ATTR_EXT_TYPE_4 = 244,
++       RADIUS_ATTR_LONG_EXT_TYPE_1 = 245,
++       RADIUS_ATTR_LONG_EXT_TYPE_2 = 246,
++       RADIUS_ATTR_EXT_VENDOR_SPECIFIC_1 = (241 << 8) | 26,
++       RADIUS_ATTR_EXT_VENDOR_SPECIFIC_2 = (242 << 8) | 26,
++       RADIUS_ATTR_EXT_VENDOR_SPECIFIC_3 = (243 << 8) | 26,
++       RADIUS_ATTR_EXT_VENDOR_SPECIFIC_4 = (244 << 8) | 26,
++       RADIUS_ATTR_EXT_VENDOR_SPECIFIC_5 = (245 << 8) | 26,
++       RADIUS_ATTR_EXT_VENDOR_SPECIFIC_6 = (246 << 8) | 26,
+ };
+ 
+ 
+@@ -257,7 +277,7 @@ int radius_msg_verify_acct_req(struct radius_msg *msg, const u8 *secret,
+ int radius_msg_verify_das_req(struct radius_msg *msg, const u8 *secret,
+ 			      size_t secret_len,
+ 			      int require_message_authenticator);
+-struct radius_attr_hdr * radius_msg_add_attr(struct radius_msg *msg, u8 type,
++struct radius_attr_hdr * radius_msg_add_attr(struct radius_msg *msg, u16 type,
+ 					     const u8 *data, size_t data_len);
+ struct radius_msg * radius_msg_parse(const u8 *data, size_t len);
+ int radius_msg_add_eap(struct radius_msg *msg, const u8 *data,
+@@ -284,6 +304,8 @@ int radius_msg_add_mppe_keys(struct radius_msg *msg,
+ 			     const u8 *recv_key, size_t recv_key_len);
+ int radius_msg_add_wfa(struct radius_msg *msg, u8 subtype, const u8 *data,
+ 		       size_t len);
++int radius_msg_add_ext_vs(struct radius_msg *msg, u16 type, u32 vendor_id,
++			  u8 vendor_type, const u8 *data, size_t len);
+ int radius_user_password_hide(struct radius_msg *msg,
+ 			      const u8 *data, size_t data_len,
+ 			      const u8 *secret, size_t secret_len,
+-- 
+2.25.1
+

feeds/ipq807x_v5.4/hostapd/patches/s00-003-RADIUS-attributes-for-EAPOL-Key-message-details.patch

@@ -0,0 +1,102 @@
+From b94371af8402f60218716552e571ca72cff4e3c0 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Fri, 15 Apr 2022 17:36:25 +0300
+Subject: [PATCH] RADIUS attributes for EAPOL-Key message details
+
+Use vendor specific RADIUS attributes for sending ANonce and EAPOL-Key
+msg 2/4 for the wpa_psk_radius=3 case. The vendor specific attributes
+for this are defined in FreeRADIUS as follows:
+
+BEGIN-VENDOR    FreeRADIUS      format=Extended-Vendor-Specific-5
+ATTRIBUTE       FreeRADIUS-802.1X-Anonce        1       octets[32]
+ATTRIBUTE       FreeRADIUS-802.1X-EAPoL-Key-Msg 2       octets
+END-VENDOR      FreeRADIUS
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/ap/ieee802_11_auth.c | 29 +++++++++++++++++++++++++++++
+ src/radius/radius.h      |  7 +++++++
+ 2 files changed, 36 insertions(+)
+
+diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c
+index a54d7616e..4277d82cb 100644
+--- a/src/ap/ieee802_11_auth.c
++++ b/src/ap/ieee802_11_auth.c
+@@ -47,6 +47,9 @@ struct hostapd_acl_query_data {
+ 	struct hostapd_acl_query_data *next;
+ 	bool radius_psk;
+ 	int akm;
++	u8 *anonce;
++	u8 *eapol;
++	size_t eapol_len;
+ };
+ 
+ 
+@@ -102,6 +105,8 @@ static void hostapd_acl_query_free(struct hostapd_acl_query_data *query)
+ 	if (!query)
+ 		return;
+ 	os_free(query->auth_msg);
++	os_free(query->anonce);
++	os_free(query->eapol);
+ 	os_free(query);
+ }
+ 
+@@ -164,6 +169,24 @@ static int hostapd_radius_acl_query(struct hostapd_data *hapd, const u8 *addr,
+ 		goto fail;
+ 	}
+ 
++	if (query->anonce &&
++	    !radius_msg_add_ext_vs(msg, RADIUS_ATTR_EXT_VENDOR_SPECIFIC_5,
++				   RADIUS_VENDOR_ID_FREERADIUS,
++				   RADIUS_VENDOR_ATTR_FREERADIUS_802_1X_ANONCE,
++				   query->anonce, WPA_NONCE_LEN)) {
++		wpa_printf(MSG_DEBUG, "Could not add FreeRADIUS-802.1X-Anonce");
++		goto fail;
++	}
++
++	if (query->eapol &&
++	    !radius_msg_add_ext_vs(msg, RADIUS_ATTR_EXT_VENDOR_SPECIFIC_5,
++				   RADIUS_VENDOR_ID_FREERADIUS,
++				   RADIUS_VENDOR_ATTR_FREERADIUS_802_1X_EAPOL_KEY_MSG,
++				   query->eapol, query->eapol_len)) {
++		wpa_printf(MSG_DEBUG, "Could not add FreeRADIUS-802.1X-EAPoL-Key-Msg");
++		goto fail;
++	}
++
+ 	if (radius_client_send(hapd->radius, msg, RADIUS_AUTH, addr) < 0)
+ 		goto fail;
+ 	return 0;
+@@ -703,6 +726,12 @@ void hostapd_acl_req_radius_psk(struct hostapd_data *hapd, const u8 *addr,
+ 	query->akm = key_mgmt;
+ 	os_get_reltime(&query->timestamp);
+ 	os_memcpy(query->addr, addr, ETH_ALEN);
++	if (anonce)
++		query->anonce = os_memdup(anonce, WPA_NONCE_LEN);
++	if (eapol) {
++		query->eapol = os_memdup(eapol, eapol_len);
++		query->eapol_len = eapol_len;
++	}
+ 	if (hostapd_radius_acl_query(hapd, addr, query)) {
+ 		wpa_printf(MSG_DEBUG,
+ 			   "Failed to send Access-Request for RADIUS PSK/ACL query");
+diff --git a/src/radius/radius.h b/src/radius/radius.h
+index 490c8d1f6..177c64a66 100644
+--- a/src/radius/radius.h
++++ b/src/radius/radius.h
+@@ -208,6 +208,13 @@ enum { RADIUS_VENDOR_ATTR_MS_MPPE_SEND_KEY = 16,
+        RADIUS_VENDOR_ATTR_MS_MPPE_RECV_KEY = 17
+ };
+ 
++/* FreeRADIUS vendor-specific attributes */
++#define RADIUS_VENDOR_ID_FREERADIUS 11344
++/* Extended-Vendor-Specific-5 (245.26; long extended header) */
++enum {
++	RADIUS_VENDOR_ATTR_FREERADIUS_802_1X_ANONCE = 1,
++	RADIUS_VENDOR_ATTR_FREERADIUS_802_1X_EAPOL_KEY_MSG = 2,
++};
+ 
+ /* Hotspot 2.0 - WFA Vendor-specific RADIUS Attributes */
+ #define RADIUS_VENDOR_ID_WFA 40808
+-- 
+2.25.1
+

feeds/ipq807x_v5.4/hostapd/patches/s00-004-RADIUS-ACL-PSK-wispr.patch

@@ -0,0 +1,32 @@
+--- a/src/ap/ieee802_11_auth.c
++++ b/src/ap/ieee802_11_auth.c
+@@ -578,6 +578,8 @@ hostapd_acl_recv_radius(struct radius_ms
+ 				os_memcpy(info->radius_cui, buf, len);
+ 		}
+ 
++		radius_msg_get_wispr(msg, info->bandwidth);
++
+ 		if (hapd->conf->wpa_psk_radius == PSK_RADIUS_REQUIRED &&
+ 		    !info->psk)
+ 			cache->accepted = HOSTAPD_ACL_REJECT;
+--- a/src/ap/ieee802_11_auth.h
++++ b/src/ap/ieee802_11_auth.h
+@@ -23,6 +23,7 @@ struct radius_sta {
+ 	struct hostapd_sta_wpa_psk_short *psk;
+ 	char *identity;
+ 	char *radius_cui;
++	u32 bandwidth[2];
+ };
+ 
+ int hostapd_check_acl(struct hostapd_data *hapd, const u8 *addr,
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -2406,6 +2406,8 @@ int ieee802_11_set_radius_info(struct ho
+ 		ap_sta_no_session_timeout(hapd, sta);
+ 	}
+ 
++	os_memcpy(sta->bandwidth, info->bandwidth, sizeof(sta->bandwidth));
++
+ 	return 0;
+ }
+ 

feeds/ipq807x_v5.4/ipq50xx/base-files/etc/board.d/02_network

@@ -18,6 +18,13 @@ qcom_setup_interfaces()
 	cig,wf186h)
 		ucidef_add_switch "switch0" "4:wan" "1:lan" "2:lan" "6@eth0"
 		;;
+	cybertan,eww631-a1)
+		ucidef_set_interface_wan "eth0"
+		ucidef_set_interface_lan ""
+		;;
+	cybertan,eww631-b1)
+		ucidef_add_switch "switch1" "5:wan" "2:lan" "3:lan" "4:lan" "6@eth0"
+		;;
 	edgecore,oap101|\
  	edgecore,oap101-6e|\
 	edgecore,oap101e|\
@@ -63,6 +70,18 @@ qcom_setup_macs()
 		ucidef_set_network_device_mac eth0 $wan_mac
 		ip link set eth0 address $wan_mac
 		;;
+	cybertan,eww631-a1|\
+	cybertan,eww631-b1)
+		mtd=$(find_mtd_chardev "0:APPSBLENV")
+		[ -z "$mtd" ] && return;
+		mac=$(grep BaseMacAddress= $mtd | cut -d '=' -f2)
+		[ -z "$mac" ] && return;
+		wan_mac=$(macaddr_canonicalize $mac)
+		lan_mac=$(macaddr_add "$wan_mac" 1)
+		ucidef_set_network_device_mac eth0 $wan_mac
+		ip link set eth0 address $wan_mac
+		ucidef_set_label_macaddr $wan_mac
+		;;
 	*)
 		wan_mac=$(cat /sys/class/net/eth0/address)
 		lan_mac=$(macaddr_add "$wan_mac" 1)

feeds/ipq807x_v5.4/ipq50xx/base-files/etc/hotplug.d/firmware/10-ath11k-caldata

@@ -39,6 +39,28 @@ ath11k_generate_macs_ion4x() {
 	echo -ne \\x${wifimac2//:/\\x} >> /lib/firmware/ath11k-macs
 }
 
+ath11k_generate_macs_eww631_a1() {
+	touch /lib/firmware/ath11k-macs
+	local dev=$(find_mtd_chardev "0:APPSBLENV")
+	mac=$(grep BaseMacAddress= $dev | cut -d '=' -f2)
+	eth=$(macaddr_canonicalize $mac)
+	mac1=$(macaddr_add $eth 1)
+	mac2=$(macaddr_add $eth 2)
+	echo -ne \\x${mac1//:/\\x} >> /lib/firmware/ath11k-macs
+	echo -ne \\x${mac2//:/\\x} >> /lib/firmware/ath11k-macs
+}
+
+ath11k_generate_macs_eww631_b1() {
+	touch /lib/firmware/ath11k-macs
+	local dev=$(find_mtd_chardev "0:APPSBLENV")
+	mac=$(grep BaseMacAddress= $dev | cut -d '=' -f2)
+	eth=$(macaddr_canonicalize $mac)
+	mac1=$(macaddr_add $eth 2)
+	mac2=$(macaddr_add $eth 3)
+	echo -ne \\x${mac1//:/\\x} >> /lib/firmware/ath11k-macs
+	echo -ne \\x${mac2//:/\\x} >> /lib/firmware/ath11k-macs
+}
+
 caldata_die() {
 	echo "caldata: " "$*"
 	exit 1
@@ -64,6 +86,8 @@ ath11k/IPQ5018/hw1.0/caldata.bin)
 	case "$board" in
 	cig,wf186w|\
 	cig,wf186h|\
+	cybertan,eww631-a1|\
+	cybertan,eww631-b1|\
 	edgecore,eap104|\
 	edgecore,oap101|\
 	edgecore,oap101-6e|\
@@ -84,6 +108,8 @@ ath11k/qcn6122/hw1.0/caldata_1.bin)
 	case "$board" in
 	cig,wf186w|\
 	cig,wf186h|\
+	cybertan,eww631-a1|\
+	cybertan,eww631-b1|\
 	edgecore,oap101|\
 	edgecore,oap101-6e|\
 	edgecore,oap101e|\
@@ -101,6 +127,10 @@ ath11k/qcn6122/hw1.0/caldata_2.bin)
 	edgecore,oap101e-6e)
 		caldata_extract "0:ART" 0x4c000 0x20000  
 		;;
+	cybertan,eww631-a1|\
+	cybertan,eww631-b1)
+		caldata_extract "0:ART" 0x26800 0x20000
+		;;
 	esac
 	;;
 ath11k/QCN9074/hw1.0/caldata_1.bin)
@@ -119,7 +149,15 @@ ath11k-macs)
 	cig,wf186h)
 		ath11k_generate_macs_wf186w
 		;;
+	cybertan,eww631-a1)
+		ath11k_generate_macs_eww631_a1
+		;;
+	cybertan,eww631-b1)
+		ath11k_generate_macs_eww631_b1
+		;;
 	edgecore,eap104|\
+	edgecore,oap101-6e|\
+	edgecore,oap101e-6e|\
 	optimcloud,d60|\
 	optimcloud,d60-5g|\
 	optimcloud,d50|\

feeds/ipq807x_v5.4/ipq50xx/base-files/lib/upgrade/nand.sh

@@ -247,8 +247,8 @@ nand_do_upgrade_success() {
 	local conf_tar="/tmp/sysupgrade.tgz"
 	sync
 	[ "$CI_BOOTCFG" = 1 ] && nand_qca_update_bootconfig
+	[ -f "$conf_tar" ] && nand_restore_config "$conf_tar" && sync
 	[ -n "$CI_FWSETENV" ] && fw_setenv $CI_FWSETENV
-	[ -f "$conf_tar" ] && nand_restore_config "$conf_tar"
 	echo "sysupgrade successful"
 	umount -a
 	reboot -f

feeds/ipq807x_v5.4/ipq50xx/base-files/lib/upgrade/platform.sh

@@ -70,6 +70,8 @@ platform_check_image() {
 	case $board in
 	cig,wf186w|\
 	cig,wf186h|\
+	cybertan,eww631-a1|\
+	cybertan,eww631-b1|\
 	edgecore,eap104|\
 	hfcl,ion4x_w|\
 	hfcl,ion4xi_w|\
@@ -130,5 +132,18 @@ platform_do_upgrade() {
 		}
 		nand_upgrade_tar "$1"
 		;;
+	cybertan,eww631-a1|\
+	cybertan,eww631-b1)
+		boot_part=$(fw_printenv bootfrom | cut  -d = -f2)
+		echo "Current bootfrom is $boot_part"
+		if [[ $boot_part == 1 ]]; then
+			CI_UBIPART="rootfs"
+			CI_FWSETENV="bootfrom 0"
+		else
+			CI_UBIPART="rootfs_1"
+			CI_FWSETENV="bootfrom 1"
+		fi
+		nand_upgrade_tar "$1"
+		;;
 	esac
 }

feeds/ipq807x_v5.4/ipq50xx/files/arch/arm64/boot/dts/qcom/qcom-ipq5018-eww631-a1.dts

@@ -0,0 +1,915 @@
+/dts-v1/;
+/* Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ *
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ipq5018.dtsi"
+
+/ {
+	#address-cells = <0x2>;
+	#size-cells = <0x2>;
+	model = "CyberTan EWW631-A1";
+	compatible = "cybertan,eww631-a1", "qcom,ipq5018-mp03.5", "qcom,ipq5018";
+	interrupt-parent = <&intc>;
+
+	aliases {
+		sdhc1 = &sdhc_1; /* SDC1 eMMC slot */
+		serial0 = &blsp1_uart1;
+		serial1 = &blsp1_uart2;
+		ethernet0 = "/soc/dp1";
+		ethernet1 = "/soc/dp2";
+	};
+
+	chosen {
+		bootargs = "console=ttyMSM0,115200,n8 rw init=/init";
+		bootargs-append = " swiotlb=1 coherent_pool=2M";
+		stdout-path = "serial0";
+	};
+
+	reserved-memory {
+	#ifdef __IPQ_MEM_PROFILE_256_MB__
+	/*                   256 MB Profile
+	 * +==========+==============+=========================+
+	 * |          |              |                         |
+	 * |  Region  | Start Offset |          Size           |
+	 * |          |              |                         |
+	 * +----------+--------------+-------------------------+
+	 * |    NSS   |  0x40000000  |           8MB           |
+	 * +----------+--------------+-------------------------+
+	 * |   Linux  |  0x40800000  | Depends on total memory |
+	 * +----------+--------------+-------------------------+
+	 * |   uboot  |  0x4A600000  |           4MB           |
+	 * +----------+--------------+-------------------------+
+	 * |    SBL   |  0x4AA00000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |   smem   |  0x4AB00000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |    TZ    |  0x4AC00000  |           4MB           |
+	 * +----------+--------------+-------------------------+
+	 * |    Q6    |              |                         |
+	 * |   code/  |  0x4B000000  |          20MB           |
+	 * |   data   |              |                         |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |   data   |  0x4C400000  |          13MB           |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |  M3 Dump |  0x4D100000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |   QDSS   |  0x4D200000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |   data   |  0x4D300000  |          13MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |  M3 Dump |  0x4E000000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |   QDSS   |  0x4E100000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |   data   |  0x4E200000  |          13MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |  M3 Dump |  0x4EF00000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |   QDSS   |  0x4F000000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |                                                   |
+	 * |            Rest of the memory for Linux           |
+	 * |                                                   |
+	 * +===================================================+
+	 */
+		q6_mem_regions: q6_mem_regions@4B000000 {
+			no-map;
+			reg = <0x0 0x4B000000 0x0 0x4100000>;
+		};
+
+		q6_code_data: q6_code_data@4B000000 {
+			no-map;
+			reg = <0x0 0x4B000000 0x0 0x1400000>;
+		};
+
+		q6_ipq5018_data: q6_ipq5018_data@4C400000 {
+			no-map;
+			reg = <0x0 0x4C400000 0x0 0xD00000>;
+		};
+
+		m3_dump: m3_dump@4D100000 {
+			no-map;
+			reg = <0x0 0x4D100000 0x0 0x100000>;
+		};
+
+		q6_etr_region: q6_etr_dump@4D200000 {
+			no-map;
+			reg = <0x0 0x4D200000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_data1: q6_qcn6122_data1@4D300000 {
+			no-map;
+			reg = <0x0 0x4D300000 0x0 0xD00000>;
+		};
+
+		m3_dump_qcn6122_1: m3_dump_qcn6122_1@4E000000 {
+			no-map;
+			reg = <0x0 0x4E000000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_etr_1: q6_qcn6122_etr_1@4E100000 {
+			no-map;
+			reg = <0x0 0x4E100000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_data2: q6_qcn6122_data2@4E200000 {
+			no-map;
+			reg = <0x0 0x4E200000 0x0 0xD00000>;
+		};
+
+		m3_dump_qcn6122_2: m3_dump_qcn6122_2@4EF00000 {
+			no-map;
+			reg = <0x0 0x4EF00000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_etr_2: q6_qcn6122_etr_2@4F000000 {
+			no-map;
+			reg = <0x0 0x4F000000 0x0 0x100000>;
+		};
+	#else
+	/*                 512MB/1GB Profiles
+	 * +==========+==============+=========================+
+	 * |          |              |                         |
+	 * |  Region  | Start Offset |          Size           |
+	 * |          |              |                         |
+	 * +----------+--------------+-------------------------+
+	 * |    NSS   |  0x40000000  |          16MB           |
+	 * +----------+--------------+-------------------------+
+	 * |   Linux  |  0x41000000  | Depends on total memory |
+	 * +----------+--------------+-------------------------+
+	 * |   uboot  |  0x4A600000  |           4MB           |
+	 * +----------+--------------+-------------------------+
+	 * |    SBL   |  0x4AA00000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |   smem   |  0x4AB00000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |    TZ    |  0x4AC00000  |           4MB           |
+	 * +----------+--------------+-------------------------+
+	 * |    Q6    |              |                         |
+	 * |   code/  |  0x4B000000  |          20MB           |
+	 * |   data   |              |                         |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |   data   |  0x4C400000  |          13MB           |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |  M3 Dump |  0x4D100000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |   QDSS   |  0x4D200000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |  Caldb   |  0x4D300000  |           2MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |   data   |  0x4D500000  |          13MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |  M3 Dump |  0x4E200000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |   QDSS   |  0x4E300000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |  Caldb   |  0x4E400000  |           5MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |   data   |  0x4E900000  |          13MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |  M3 Dump |  0x4F600000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |   QDSS   |  0x4F700000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |  Caldb   |  0x4F800000  |           5MB           |
+	 * +----------+--------------+-------------------------+
+	 * |                                                   |
+	 * |            Rest of the memory for Linux           |
+	 * |                                                   |
+	 * +===================================================+
+	 */
+		q6_mem_regions: q6_mem_regions@4B000000 {
+			no-map;
+			reg = <0x0 0x4B000000 0x0 0x4D00000>;
+		};
+
+		q6_code_data: q6_code_data@4B000000 {
+			no-map;
+			reg = <0x0 0x4B000000 0x0 01400000>;
+		};
+
+		q6_ipq5018_data: q6_ipq5018_data@4C400000 {
+			no-map;
+			reg = <0x0 0x4C400000 0x0 0xD00000>;
+		};
+
+		m3_dump: m3_dump@4D100000 {
+			no-map;
+			reg = <0x0 0x4D100000 0x0 0x100000>;
+		};
+
+		q6_etr_region: q6_etr_dump@4D200000 {
+			no-map;
+			reg = <0x0 0x4D200000 0x0 0x100000>;
+		};
+
+		q6_caldb_region: q6_caldb_region@4D300000 {
+			no-map;
+			reg = <0x0 0x4D300000 0x0 0x200000>;
+		};
+
+		q6_qcn6122_data1: q6_qcn6122_data1@4D500000 {
+			no-map;
+			reg = <0x0 0x4D500000 0x0 0xD00000>;
+		};
+
+		m3_dump_qcn6122_1: m3_dump_qcn6122_1@4E200000 {
+			no-map;
+			reg = <0x0 0x4E200000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_etr_1: q6_qcn6122_etr_1@4E300000 {
+			no-map;
+			reg = <0x0 0x4E300000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_caldb_1: q6_qcn6122_caldb_1@4E400000 {
+			no-map;
+			reg = <0x0 0x4E400000 0x0 0x500000>;
+		};
+
+		q6_qcn6122_data2: q6_qcn6122_data2@4E900000 {
+			no-map;
+			reg = <0x0 0x4E900000 0x0 0xD00000>;
+		};
+
+		m3_dump_qcn6122_2: m3_dump_qcn6122_2@4F600000 {
+			no-map;
+			reg = <0x0 0x4F600000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_etr_2: q6_qcn6122_etr_2@4F700000 {
+			no-map;
+			reg = <0x0 0x4F700000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_caldb_2: q6_qcn6122_caldb_2@4F800000 {
+			no-map;
+			reg = <0x0 0x4F800000 0x0 0x500000>;
+		};
+
+	#endif
+	};
+
+	soc {
+		serial@78af000 {
+			status = "ok";
+		};
+
+		blsp1_uart2: serial@78b0000 {
+			pinctrl-0 = <&blsp1_uart_pins>;
+			pinctrl-names = "default";
+		};
+
+		qpic_bam: dma@7984000{
+			status = "ok";
+		};
+
+		nand: qpic-nand@79b0000 {
+			pinctrl-0 = <&qspi_nand_pins>;
+			pinctrl-names = "default";
+			status = "ok";
+		};
+
+		spi_0: spi@78b5000 { /* BLSP1 QUP0 */
+			pinctrl-0 = <&blsp0_spi_pins>;
+			pinctrl-names = "default";
+			cs-select = <0>;
+			status = "ok";
+
+			m25p80@0 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				reg = <0>;
+				compatible = "n25q128a11";
+				linux,modalias = "m25p80", "n25q128a11";
+				spi-max-frequency = <50000000>;
+				use-default-sizes;
+			};
+		};
+
+		mdio0: mdio@88000 {
+			status = "ok";
+
+			ethernet-phy@0 {
+				reg = <7>;
+			};
+		};
+
+		mdio1: mdio@90000 {
+			status = "disabled";
+			pinctrl-0 = <&mdio1_pins>;
+			pinctrl-names = "default";
+			phy-reset-gpio = <&tlmm 39 0>;
+
+			ethernet-phy@0 {
+				reg = <28>;
+			};
+		};
+
+		ess-instance {
+			num_devices = <0x1>;
+			ess-switch@0x39c00000 {
+				switch_mac_mode = <0xf>; /* mac mode for uniphy instance*/
+				cmnblk_clk = "internal_96MHz"; /* cmnblk clk*/
+				qcom,port_phyinfo {
+					port@0 {
+						port_id = <1>;
+						phy_address = <7>;
+						mdiobus = <&mdio0>;
+					};
+					/*
+					port@1 {
+						port_id = <2>;
+						phy_address = <0x1c>;
+						mdiobus = <&mdio1>;
+						port_mac_sel = "QGMAC_PORT";
+					};
+					*/
+				};
+				
+				led_source@0 {
+					source = <0>;
+					mode = "normal";
+					speed = "all";
+					blink_en = "enable";
+					active = "high";
+				};
+				
+			};
+		};
+
+		dp1 {
+			device_type = "network";
+			compatible = "qcom,nss-dp";
+			clocks = <&gcc GCC_SNOC_GMAC0_AXI_CLK>;
+			clock-names = "nss-snoc-gmac-axi-clk";
+			qcom,id = <1>;
+			reg = <0x39C00000 0x10000>;
+			interrupts = <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>;
+			qcom,mactype = <2>;
+			qcom,link-poll = <1>;
+			qcom,phy-mdio-addr = <7>;
+			mdio-bus = <&mdio0>;
+			local-mac-address = [000000000000];
+			phy-mode = "sgmii";
+			qcom,rx-page-mode = <0>;
+		};
+		/*
+		dp2 {
+			device_type = "network";
+			compatible = "qcom,nss-dp";
+			clocks = <&gcc GCC_SNOC_GMAC1_AXI_CLK>;
+			clock-names = "nss-snoc-gmac-axi-clk";
+			qcom,id = <2>;
+			reg = <0x39D00000 0x10000>;
+			interrupts = <GIC_SPI 109 IRQ_TYPE_LEVEL_HIGH>;
+			qcom,mactype = <2>;
+			qcom,link-poll = <1>;
+			qcom,phy-mdio-addr = <28>;
+			mdio-bus = <&mdio1>;
+			local-mac-address = [000000000000];
+			phy-mode = "sgmii";
+			qcom,rx-page-mode = <0>;
+		};
+		*/
+
+		nss-macsec1 {
+			compatible = "qcom,nss-macsec";
+			phy_addr = <0x1c>;
+			mdiobus = <&mdio1>;
+		};
+	};
+
+	qcom,test@0 {
+		status = "ok";
+	};
+
+	thermal-zones {
+		status = "ok";
+	};
+};
+
+&tlmm {
+	pinctrl-0 = <&blsp0_uart_pins &phy_led_pins>;
+	pinctrl-names = "default";
+
+	blsp0_uart_pins: blsp0_uart_pins {
+		blsp0_uart_rx_tx {
+			pins = "gpio20", "gpio21";
+			function = "blsp0_uart0";
+			bias-disable;
+		};
+	};
+
+	blsp1_uart_pins: blsp1_uart_pins {
+		blsp1_uart_rx_tx {
+			pins = "gpio23", "gpio25", "gpio24", "gpio26";
+			function = "blsp1_uart2";
+			bias-disable;
+		};
+	};
+
+	blsp0_spi_pins: blsp0_spi_pins {
+		mux {
+			pins = "gpio10", "gpio11", "gpio12", "gpio13";
+			function = "blsp0_spi";
+			drive-strength = <2>;
+			bias-disable;
+		};
+	};
+
+	qspi_nand_pins: qspi_nand_pins {
+		qspi_clock {
+			pins = "gpio9";
+			function = "qspi_clk";
+			drive-strength = <8>;
+			bias-disable;
+		};
+
+		qspi_cs {
+			pins = "gpio8";
+			function = "qspi_cs";
+			drive-strength = <8>;
+			bias-disable;
+		};
+
+		qspi_data {
+			pins = "gpio4", "gpio5", "gpio6", "gpio7";
+			function = "qspi_data";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+
+	mdio1_pins: mdio_pinmux {
+		mux_0 {
+			pins = "gpio36";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mux_1 {
+			pins = "gpio37";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+
+	phy_led_pins: phy_led_pins {
+		gephy_led_pin {
+			pins = "gpio46";
+			function = "led0";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+	};
+
+	i2c_pins: i2c_pins {
+		i2c_scl {
+			pins = "gpio25";
+			function = "blsp2_i2c1";
+			drive-strength = <8>;
+			bias-disable;
+		};
+
+		i2c_sda {
+			pins = "gpio26";
+			function = "blsp2_i2c1";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+
+	button_pins: button_pins {
+		reset_button {
+			pins = "gpio28";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+
+	audio_pins: audio_pinmux {
+		mux_1 {
+			pins = "gpio24";
+			function = "audio_rxbclk";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+
+		mux_2 {
+			pins = "gpio25";
+			function = "audio_rxfsync";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+
+		mux_3 {
+			pins = "gpio26";
+			function = "audio_rxd";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+
+		mux_4 {
+			pins = "gpio27";
+			function = "audio_txmclk";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+
+		mux_5 {
+			pins = "gpio28";
+			function = "audio_txbclk";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+
+		mux_6 {
+			pins = "gpio29";
+			function = "audio_txfsync";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+
+		mux_7 {
+			pins = "gpio30";
+			function = "audio_txd";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+	};
+	leds_pins: leds_pinmux {
+		sys_blue {
+			pins = "gpio30";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+		sys_red {
+			pins = "gpio36";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-disable;
+		};
+		sys_green {
+			pins = "gpio37";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		button@1 {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&tlmm 28 GPIO_ACTIVE_LOW>;
+			linux,input-type = <1>;
+			debounce-interval = <60>;
+		};
+	};
+	gpio_leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&leds_pins>;
+		pinctrl-names = "default";
+
+		led@30 {
+			label = "sys:blue";
+			gpios = <&tlmm 30 GPIO_ACTIVE_HIGH>;  /* GPIO_30 */
+			default-state="on";
+		/*	linux,default-trigger = "timer";
+			active-delay = <700>;
+			inactive-delay = <700>;
+			default-state="on";		*/
+		};
+		led@36 {
+			label = "sys:red";
+			gpios = <&tlmm 36 GPIO_ACTIVE_HIGH>;  /* GPIO_36 */
+			default-state="off";
+		/*	linux,default-trigger = "timer";
+			active-delay = <700>;
+			inactive-delay = <700>;
+			default-state="on";		*/
+		};
+		led@37 {
+			label = "sys:green";
+			gpios = <&tlmm 37 GPIO_ACTIVE_HIGH>;  /* GPIO_37 */
+			default-state="off";
+		/*	linux,default-trigger = "timer";
+			active-delay = <700>;
+			inactive-delay = <700>;
+			default-state="on";		*/
+		};
+	};
+
+};
+
+&q6v5_wcss {
+	compatible = "qcom,ipq5018-q6-mpd";
+	#address-cells = <1>;
+	#size-cells = <1>;
+	ranges;
+	firmware = "IPQ5018/q6_fw.mdt";
+	reg = <0x0cd00000 0x4040>,
+		<0x1938000 0x8>,
+		<0x193d204 0x4>;
+	reg-names = "qdsp6",
+			"tcsr-msip",
+			"tcsr-q6";
+	resets = <&gcc GCC_WCSSAON_RESET>,
+			<&gcc GCC_WCSS_Q6_BCR>;
+
+	reset-names = "wcss_aon_reset",
+			"wcss_q6_reset";
+
+	clocks = <&gcc GCC_Q6_AXIS_CLK>,
+		<&gcc GCC_WCSS_ECAHB_CLK>,
+		<&gcc GCC_Q6_AXIM_CLK>,
+		<&gcc GCC_Q6_AXIM2_CLK>,
+		<&gcc GCC_Q6_AHB_CLK>,
+		<&gcc GCC_Q6_AHB_S_CLK>,
+		<&gcc GCC_WCSS_AXI_S_CLK>;
+	clock-names = "gcc_q6_axis_clk",
+		"gcc_wcss_ecahb_clk",
+		"gcc_q6_axim_clk",
+		"gcc_q6_axim2_clk",
+		"gcc_q6_ahb_clk",
+		"gcc_q6_ahb_s_clk",
+		"gcc_wcss_axi_s_clk";
+
+	#ifdef __IPQ_MEM_PROFILE_256_MB__
+		memory-region = <&q6_mem_regions>, <&q6_etr_region>;
+	#else
+		memory-region = <&q6_mem_regions>, <&q6_etr_region>,
+				<&q6_caldb_region>;
+	#endif
+
+	qcom,rproc = <&q6v5_wcss>;
+	qcom,bootargs_smem = <507>;
+	boot-args = <0x1 0x4 0x3 0x0F 0x0 0x0>,
+			<0x2 0x4 0x2 0x12 0x0 0x0>;
+	status = "ok";
+	q6_wcss_pd1: remoteproc_pd1@4ab000 {
+		compatible = "qcom,ipq5018-wcss-ahb-mpd";
+		reg = <0x4ab000 0x20>;
+		reg-names = "rmb";
+		firmware = "IPQ5018/q6_fw.mdt";
+		m3_firmware = "IPQ5018/m3_fw.mdt";
+		interrupts-extended = <&wcss_smp2p_in 8 0>,
+					<&wcss_smp2p_in 9 0>,
+					<&wcss_smp2p_in 12 0>,
+					<&wcss_smp2p_in 11 0>;
+		interrupt-names = "fatal",
+					"ready",
+					"spawn-ack",
+					"stop-ack";
+
+		resets = <&gcc GCC_WCSSAON_RESET>,
+				<&gcc GCC_WCSS_BCR>,
+				<&gcc GCC_CE_BCR>;
+		reset-names = "wcss_aon_reset",
+				"wcss_reset",
+				"ce_reset";
+
+		clocks = <&gcc GCC_WCSS_AHB_S_CLK>,
+				<&gcc GCC_WCSS_ACMT_CLK>,
+				<&gcc GCC_WCSS_AXI_M_CLK>;
+		clock-names = "gcc_wcss_ahb_s_clk",
+					"gcc_wcss_acmt_clk",
+					"gcc_wcss_axi_m_clk";
+
+		qcom,halt-regs = <&tcsr_q6_block 0xa000 0xd000 0x0>;
+
+		qcom,smem-states = <&wcss_smp2p_out 8>,
+					<&wcss_smp2p_out 9>,
+					<&wcss_smp2p_out 10>;
+		qcom,smem-state-names = "shutdown",
+					"stop",
+					"spawn";
+	#ifdef __IPQ_MEM_PROFILE_256_MB__
+		memory-region = <&q6_ipq5018_data>, <&m3_dump>,
+				<&q6_etr_region>;
+	#else
+		memory-region = <&q6_ipq5018_data>, <&m3_dump>,
+				<&q6_etr_region>, <&q6_caldb_region>;
+	#endif
+
+	};
+
+	q6_wcss_pd2: remoteproc_pd2 {
+		compatible = "qcom,ipq5018-wcss-pcie-mpd";
+		firmware = "IPQ5018/q6_fw.mdt";
+		m3_firmware = "qcn6122/m3_fw.mdt";
+		interrupts-extended = <&wcss_smp2p_in 16 0>,
+					<&wcss_smp2p_in 17 0>,
+					<&wcss_smp2p_in 20 0>,
+					<&wcss_smp2p_in 19 0>;
+		interrupt-names = "fatal",
+					"ready",
+					"spawn-ack",
+					"stop-ack";
+
+		qcom,smem-states = <&wcss_smp2p_out 16>,
+					<&wcss_smp2p_out 17>,
+					<&wcss_smp2p_out 18>;
+		qcom,smem-state-names = "shutdown",
+					"stop",
+					"spawn";
+	#ifdef __IPQ_MEM_PROFILE_256_MB__
+		memory-region = <&q6_qcn6122_data1>, <&m3_dump_qcn6122_1>,
+				<&q6_qcn6122_etr_1>;
+	#else
+		memory-region = <&q6_qcn6122_data1>, <&m3_dump_qcn6122_1>,
+				<&q6_qcn6122_etr_1>, <&q6_qcn6122_caldb_1>;
+	#endif
+
+	};
+
+	q6_wcss_pd3: remoteproc_pd3 {
+		compatible = "qcom,ipq5018-wcss-pcie-mpd";
+		firmware = "IPQ5018/q6_fw.mdt";
+		interrupts-extended = <&wcss_smp2p_in 24 0>,
+					<&wcss_smp2p_in 25 0>,
+					<&wcss_smp2p_in 28 0>,
+					<&wcss_smp2p_in 27 0>;
+		interrupt-names = "fatal",
+					"ready",
+					"spawn-ack",
+					"stop-ack";
+
+		qcom,smem-states = <&wcss_smp2p_out 24>,
+					<&wcss_smp2p_out 25>,
+					<&wcss_smp2p_out 26>;
+		qcom,smem-state-names = "shutdown",
+					"stop",
+					"spawn";
+	#ifdef	__IPQ_MEM_PROFILE_256_MB__
+		memory-region = <&q6_qcn6122_data2>, <&m3_dump_qcn6122_2>,
+				<&q6_qcn6122_etr_2>;
+	#else
+		memory-region = <&q6_qcn6122_data2>, <&m3_dump_qcn6122_2>,
+				<&q6_qcn6122_etr_2>, <&q6_qcn6122_caldb_2>;
+	#endif
+	};
+};
+
+&i2c_0 {
+	pinctrl-0 = <&i2c_pins>;
+	pinctrl-names = "default";
+	status = "disabled";
+};
+
+&wifi0 {
+	/* IPQ5018 */
+	qcom,multipd_arch;
+	qcom,rproc = <&q6_wcss_pd1>;
+	qcom,userpd-subsys-name = "q6v5_wcss_userpd1";
+#ifdef __IPQ_MEM_PROFILE_256_MB__
+	qcom,tgt-mem-mode = <2>;
+#else
+	qcom,tgt-mem-mode = <1>;
+#endif
+	qcom,board_id = <0x24>;
+#ifdef __CNSS2__
+	qcom,bdf-addr = <0x4C400000 0x4C400000 0x4C400000 0x0 0x0>;
+	qcom,caldb-addr = <0x4D300000 0x4D300000 0 0 0 0>;
+	qcom,caldb-size = <0x200000>;
+	mem-region = <&q6_ipq5018_data>;
+1235
+#else
+	memory-region = <&q6_ipq5018_data>;
+#endif
+	status = "ok";
+};
+
+&wifi1 {
+	/* QCN6122 5G */
+	qcom,multipd_arch;
+	qcom,userpd-subsys-name = "q6v5_wcss_userpd3";
+	qcom,rproc = <&q6_wcss_pd3>;
+#ifdef __IPQ_MEM_PROFILE_256_MB__
+	qcom,tgt-mem-mode = <2>;
+#else
+	qcom,tgt-mem-mode = <1>;
+#endif
+	qcom,board_id = <0x60>;
+#ifdef __CNSS2__
+	qcom,bdf-addr = <0x4E900000 0x4E900000 0x4E200000 0x0 0x0>;
+	qcom,caldb-addr = <0x4F800000 0x4F800000 0 0 0>;
+	qcom,caldb-size = <0x500000>;
+	mem-region = <&q6_qcn6122_data2>;
+#else
+	memory-region = <&q6_qcn6122_data2>;
+#endif
+	status = "ok";
+};
+
+&wifi2 {
+	/* QCN6122 6G */
+	qcom,multipd_arch;
+	qcom,userpd-subsys-name = "q6v5_wcss_userpd3";
+#ifdef __IPQ_MEM_PROFILE_256_MB__
+	qcom,tgt-mem-mode = <2>;
+#else
+	qcom,tgt-mem-mode = <1>;
+#endif
+	qcom,board_id = <0xb0>;
+	qcom,bdf-addr = <0x4ED00000 0x4ED00000 0x4E400000 0x0 0x0>;
+#ifdef __CNSS2__
+	qcom,caldb-addr = <0x4FF00000 0x4FF00000 0 0 0>;
+#else
+	qcom,caldb-addr = <0x4FF00000>;
+	m3-dump-addr = <0x4FD00000>;
+#endif
+	qcom,caldb-size = <0x500000>;
+	status = "disabled";
+};
+
+&usb3 {
+       status = "ok";
+       device-power-gpio = <&tlmm 24 1>;
+};
+
+&dwc_0 {
+       /delete-property/ #phy-cells;
+       /delete-property/ phys;
+       /delete-property/ phy-names;
+};
+
+&hs_m31phy_0 {
+       status = "ok";
+};
+
+&eud {
+	status = "ok";
+};
+
+&pcie_x1 {
+	perst-gpio = <&tlmm 18 GPIO_ACTIVE_LOW>;
+};
+
+&pcie_x2 {
+	perst-gpio = <&tlmm 15 GPIO_ACTIVE_LOW>;
+};
+
+&pcie_x1_rp {
+	status = "disabled";
+
+	mhi_0: qcom,mhi@0 {
+		reg = <0 0 0 0 0 >;
+	};
+};
+
+&pcie_x2_rp {
+	status = "disabled";
+
+	mhi_1: qcom,mhi@1 {
+		reg = <0 0 0 0 0 >;
+
+	};
+};

feeds/ipq807x_v5.4/ipq50xx/files/arch/arm64/boot/dts/qcom/qcom-ipq5018-eww631-b1.dts

@@ -0,0 +1,981 @@
+/dts-v1/;
+/* Copyright (c) 2018-2021, The Linux Foundation. All rights reserved.
+ *
+ * Copyright (c) 2021 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ipq5018.dtsi"
+
+/ {
+	#address-cells = <0x2>;
+	#size-cells = <0x2>;
+	model = "CyberTan EWW631-B1";
+	compatible = "cybertan,eww631-b1", "qcom,ipq5018-mp03.5", "qcom,ipq5018";
+	interrupt-parent = <&intc>;
+
+	aliases {
+		sdhc1 = &sdhc_1; /* SDC1 eMMC slot */
+		serial0 = &blsp1_uart1;
+		serial1 = &blsp1_uart2;
+		ethernet0 = "/soc/dp1";
+		ethernet1 = "/soc/dp2";
+	};
+
+	chosen {
+		bootargs = "console=ttyMSM0,115200,n8 rw init=/init";
+		bootargs-append = " swiotlb=1 coherent_pool=2M";
+		stdout-path = "serial0";
+	};
+
+	reserved-memory {
+	#ifdef __IPQ_MEM_PROFILE_256_MB__
+	/*                   256 MB Profile
+	 * +==========+==============+=========================+
+	 * |          |              |                         |
+	 * |  Region  | Start Offset |          Size           |
+	 * |          |              |                         |
+	 * +----------+--------------+-------------------------+
+	 * |    NSS   |  0x40000000  |           8MB           |
+	 * +----------+--------------+-------------------------+
+	 * |   Linux  |  0x40800000  | Depends on total memory |
+	 * +----------+--------------+-------------------------+
+	 * |   uboot  |  0x4A600000  |           4MB           |
+	 * +----------+--------------+-------------------------+
+	 * |    SBL   |  0x4AA00000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |   smem   |  0x4AB00000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |    TZ    |  0x4AC00000  |           4MB           |
+	 * +----------+--------------+-------------------------+
+	 * |    Q6    |              |                         |
+	 * |   code/  |  0x4B000000  |          20MB           |
+	 * |   data   |              |                         |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |   data   |  0x4C400000  |          13MB           |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |  M3 Dump |  0x4D100000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |   QDSS   |  0x4D200000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |   data   |  0x4D300000  |          13MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |  M3 Dump |  0x4E000000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |   QDSS   |  0x4E100000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |   data   |  0x4E200000  |          13MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |  M3 Dump |  0x4EF00000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |   QDSS   |  0x4F000000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |                                                   |
+	 * |            Rest of the memory for Linux           |
+	 * |                                                   |
+	 * +===================================================+
+	 */
+		q6_mem_regions: q6_mem_regions@4B000000 {
+			no-map;
+			reg = <0x0 0x4B000000 0x0 0x4100000>;
+		};
+
+		q6_code_data: q6_code_data@4B000000 {
+			no-map;
+			reg = <0x0 0x4B000000 0x0 0x1400000>;
+		};
+
+		q6_ipq5018_data: q6_ipq5018_data@4C400000 {
+			no-map;
+			reg = <0x0 0x4C400000 0x0 0xD00000>;
+		};
+
+		m3_dump: m3_dump@4D100000 {
+			no-map;
+			reg = <0x0 0x4D100000 0x0 0x100000>;
+		};
+
+		q6_etr_region: q6_etr_dump@4D200000 {
+			no-map;
+			reg = <0x0 0x4D200000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_data1: q6_qcn6122_data1@4D300000 {
+			no-map;
+			reg = <0x0 0x4D300000 0x0 0xD00000>;
+		};
+
+		m3_dump_qcn6122_1: m3_dump_qcn6122_1@4E000000 {
+			no-map;
+			reg = <0x0 0x4E000000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_etr_1: q6_qcn6122_etr_1@4E100000 {
+			no-map;
+			reg = <0x0 0x4E100000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_data2: q6_qcn6122_data2@4E200000 {
+			no-map;
+			reg = <0x0 0x4E200000 0x0 0xD00000>;
+		};
+
+		m3_dump_qcn6122_2: m3_dump_qcn6122_2@4EF00000 {
+			no-map;
+			reg = <0x0 0x4EF00000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_etr_2: q6_qcn6122_etr_2@4F000000 {
+			no-map;
+			reg = <0x0 0x4F000000 0x0 0x100000>;
+		};
+	#else
+	/*                 512MB/1GB Profiles
+	 * +==========+==============+=========================+
+	 * |          |              |                         |
+	 * |  Region  | Start Offset |          Size           |
+	 * |          |              |                         |
+	 * +----------+--------------+-------------------------+
+	 * |    NSS   |  0x40000000  |          16MB           |
+	 * +----------+--------------+-------------------------+
+	 * |   Linux  |  0x41000000  | Depends on total memory |
+	 * +----------+--------------+-------------------------+
+	 * |   uboot  |  0x4A600000  |           4MB           |
+	 * +----------+--------------+-------------------------+
+	 * |    SBL   |  0x4AA00000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |   smem   |  0x4AB00000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |    TZ    |  0x4AC00000  |           4MB           |
+	 * +----------+--------------+-------------------------+
+	 * |    Q6    |              |                         |
+	 * |   code/  |  0x4B000000  |          20MB           |
+	 * |   data   |              |                         |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |   data   |  0x4C400000  |          14MB           |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |  M3 Dump |  0x4D200000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |   QDSS   |  0x4D300000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * |  IPQ5018 |              |                         |
+	 * |  Caldb   |  0x4D400000  |           2MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |   data   |  0x4D600000  |          16MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |  M3 Dump |  0x4E600000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |   QDSS   |  0x4E700000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_1|              |                         |
+	 * |  Caldb   |  0x4E800000  |           5MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |   data   |  0x4ED00000  |          16MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |  M3 Dump |  0x4FD00000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |   QDSS   |  0x4FE00000  |           1MB           |
+	 * +----------+--------------+-------------------------+
+	 * | QCN6122_2|              |                         |
+	 * |  Caldb   |  0x4FF00000  |           5MB           |
+	 * +----------+--------------+-------------------------+
+	 * |                                                   |
+	 * |            Rest of the memory for Linux           |
+	 * |                                                   |
+	 * +===================================================+
+	 */
+		q6_mem_regions: q6_mem_regions@4B000000 {
+			no-map;
+			reg = <0x0 0x4B000000 0x0 0x5400000>;
+		};
+
+		q6_code_data: q6_code_data@4B000000 {
+			no-map;
+			reg = <0x0 0x4B000000 0x0 01400000>;
+		};
+
+		q6_ipq5018_data: q6_ipq5018_data@4C400000 {
+			no-map;
+			reg = <0x0 0x4C400000 0x0 0xE00000>;
+		};
+
+		m3_dump: m3_dump@4D200000 {
+			no-map;
+			reg = <0x0 0x4D200000 0x0 0x100000>;
+		};
+
+		q6_etr_region: q6_etr_dump@4D300000 {
+			no-map;
+			reg = <0x0 0x4D300000 0x0 0x100000>;
+		};
+
+		q6_caldb_region: q6_caldb_region@4D400000 {
+			no-map;
+			reg = <0x0 0x4D400000 0x0 0x200000>;
+		};
+
+		q6_qcn6122_data1: q6_qcn6122_data1@4D600000 {
+			no-map;
+			reg = <0x0 0x4D600000 0x0 0x1000000>;
+		};
+
+		m3_dump_qcn6122_1: m3_dump_qcn6122_1@4E600000 {
+			no-map;
+			reg = <0x0 0x4E600000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_etr_1: q6_qcn6122_etr_1@4E700000 {
+			no-map;
+			reg = <0x0 0x4E700000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_caldb_1: q6_qcn6122_caldb_1@4E800000 {
+			no-map;
+			reg = <0x0 0x4E800000 0x0 0x500000>;
+		};
+
+		q6_qcn6122_data2: q6_qcn6122_data2@4E900000 {
+			no-map;
+			reg = <0x0 0x4ED00000 0x0 0x1000000>;
+		};
+
+		m3_dump_qcn6122_2: m3_dump_qcn6122_2@4FD00000 {
+			no-map;
+			reg = <0x0 0x4FD00000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_etr_2: q6_qcn6122_etr_2@4FE00000 {
+			no-map;
+			reg = <0x0 0x4FE00000 0x0 0x100000>;
+		};
+
+		q6_qcn6122_caldb_2: q6_qcn6122_caldb_2@4FF00000 {
+			no-map;
+			reg = <0x0 0x4FF00000 0x0 0x500000>;
+		};
+
+	#endif
+	};
+
+	soc {
+		serial@78af000 {
+			status = "ok";
+		};
+/*
+		blsp1_uart2: serial@78b0000 {
+			pinctrl-0 = <&blsp1_uart_pins>;
+			pinctrl-names = "default";
+		};
+*/
+		qpic_bam: dma@7984000{
+			status = "ok";
+		};
+
+		nand: qpic-nand@79b0000 {
+			pinctrl-0 = <&qspi_nand_pins>;
+			pinctrl-names = "default";
+			status = "ok";
+		};
+
+		spi_0: spi@78b5000 { /* BLSP1 QUP0 */
+			pinctrl-0 = <&blsp0_spi_pins>;
+			pinctrl-names = "default";
+			cs-select = <0>;
+			status = "ok";
+
+			m25p80@0 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				reg = <0>;
+				compatible = "n25q128a11";
+				linux,modalias = "m25p80", "n25q128a11";
+				spi-max-frequency = <50000000>;
+				use-default-sizes;
+			};
+		};
+
+		mdio0: mdio@88000 {
+			status = "ok";
+
+			ethernet-phy@0 {
+				reg = <7>;
+			};
+		};
+
+		mdio1: mdio@90000 {
+			status = "ok";
+			pinctrl-0 = <&mdio1_pins>;
+			pinctrl-names = "default";
+			phy-reset-gpio = <&tlmm 38 0>;
+
+			ethernet-phy@0 {
+				reg = <0>;
+			};
+
+			ethernet-phy@1 {
+				reg = <1>;
+			};
+
+			ethernet-phy@2 {
+				reg = <2>;
+			};
+
+			ethernet-phy@3 {
+				reg = <3>;
+			};
+
+			ethernet-phy@4 {
+				reg = <4>;
+			};
+		};
+
+		ess-instance {
+			num_devices = <0x2>;
+			ess-switch@0x39c00000 {
+				compatible = "qcom,ess-switch-ipq50xx";
+				device_id = <0>;
+				switch_mac_mode = <0xf>; /* mac mode for uniphy instance*/
+				cmnblk_clk = "internal_96MHz"; /* cmnblk clk*/
+				qcom,port_phyinfo {
+					port@0 {
+						port_id = <1>;
+						phy_address = <7>;
+					};
+					port@1 {
+						port_id = <2>;
+						forced-speed = <1000>;
+						forced-duplex = <1>;
+					};
+				};
+				led_source@0 {
+					source = <0>;
+					mode = "normal";
+					speed = "all";
+					blink_en = "enable";
+					active = "high";
+				};
+			};
+			ess-switch1@1 {
+				compatible = "qcom,ess-switch-qca83xx";
+				device_id = <1>;
+				switch_access_mode = "mdio";
+				mdio-bus = <&mdio1>;
+				reset_gpio = <&tlmm 0x26 0>;
+				switch_cpu_bmp = <0x40>;  /* cpu port bitmap (Port 6 GMAC) */
+				switch_lan_bmp = <0x3c>; /* lan port bitmap */
+				switch_wan_bmp = <0x0>;  /* wan port bitmap */
+				qca,ar8327-initvals = <
+						0x00004 0x7600000   /* PAD0_MODE */
+						0x00008 0x1000000   /* PAD5_MODE */
+						0x0000c 0x80        /* PAD6_MODE */
+						0x00010 0x2613a0    /* PORT6 FORCE MODE*/
+						0x000e4 0xaa545     /* MAC_POWER_SEL */
+						0x000e0 0xc74164de  /* SGMII_CTRL */
+						0x0007c 0x4e        /* PORT0_STATUS */
+						0x00094 0x4e        /* PORT6_STATUS */
+				>;
+				qcom,port_phyinfo {
+					port@0 {
+						port_id = <1>;
+						phy_address = <0>;
+					};
+					port@1 {
+						port_id = <2>;
+						phy_address = <1>;
+					};
+					port@2 {
+						port_id = <3>;
+						phy_address = <2>;
+					};
+					port@3 {
+						port_id = <4>;
+						phy_address = <3>;
+					};
+					port@4 {
+						port_id = <5>;
+						phy_address = <4>;
+					};
+				};
+			};
+		};
+		dp1 {
+			device_type = "network";
+			compatible = "qcom,nss-dp";
+			clocks = <&gcc GCC_SNOC_GMAC1_AXI_CLK>;
+			clock-names = "nss-snoc-gmac-axi-clk";
+			qcom,id = <2>;
+			reg = <0x39D00000 0x10000>;
+			interrupts = <GIC_SPI 109 IRQ_TYPE_LEVEL_HIGH>;
+			qcom,mactype = <2>;
+			local-mac-address = [000000000000];
+			phy-mode = "sgmii";
+		};
+
+		dp2 {
+			device_type = "network";
+			compatible = "qcom,nss-dp";
+			clocks = <&gcc GCC_SNOC_GMAC0_AXI_CLK>;
+			clock-names = "nss-snoc-gmac-axi-clk";
+			qcom,id = <1>;
+			reg = <0x39C00000 0x10000>;
+			interrupts = <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>;
+			qcom,mactype = <2>;
+			qcom,link-poll = <1>;
+			qcom,phy-mdio-addr = <7>;
+			mdio-bus = <&mdio0>;
+			local-mac-address = [000000000000];
+			phy-mode = "sgmii";
+		};
+
+		qcom,test@0 {
+			status = "ok";
+		};
+
+/*
+		lpass: lpass@0xA000000{
+			status = "disabled";
+		};
+
+		pcm: pcm@0xA3C0000{
+			pinctrl-0 = <&audio_pins>;
+			pinctrl-names = "default";
+			status = "disabled";
+		};
+
+		pcm_lb: pcm_lb@0 {
+			status = "disabled";
+		};
+*/
+	};
+
+	thermal-zones {
+		status = "ok";
+	};
+};
+
+&tlmm {
+	pinctrl-0 = <&blsp0_uart_pins>; //<&blsp0_uart_pins &phy_led_pins>;
+	pinctrl-names = "default";
+
+	blsp0_uart_pins: blsp0_uart_pins {
+		blsp0_uart_rx_tx {
+			pins = "gpio20", "gpio21";
+			function = "blsp0_uart0";
+			bias-disable;
+		};
+	};
+/*
+	blsp1_uart_pins: blsp1_uart_pins {
+		blsp1_uart_rx_tx {
+			pins = "gpio23", "gpio25", "gpio24", "gpio26";
+			function = "blsp1_uart2";
+			bias-disable;
+		};
+	};
+*/
+	blsp0_spi_pins: blsp0_spi_pins {
+		mux {
+			pins = "gpio10", "gpio11", "gpio12", "gpio13";
+			function = "blsp0_spi";
+			drive-strength = <2>;
+			bias-disable;
+		};
+	};
+
+	qspi_nand_pins: qspi_nand_pins {
+		qspi_clock {
+			pins = "gpio9";
+			function = "qspi_clk";
+			drive-strength = <8>;
+			bias-disable;
+		};
+
+		qspi_cs {
+			pins = "gpio8";
+			function = "qspi_cs";
+			drive-strength = <8>;
+			bias-disable;
+		};
+
+		qspi_data {
+			pins = "gpio4", "gpio5", "gpio6", "gpio7";
+			function = "qspi_data";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+
+	mdio1_pins: mdio_pinmux {
+		mux_0 {
+			pins = "gpio36";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mux_1 {
+			pins = "gpio37";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+/*
+	phy_led_pins: phy_led_pins {
+		gephy_led_pin {
+			pins = "gpio46";
+			function = "led0";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+	};
+*/
+	i2c_pins: i2c_pins {
+		i2c_scl {
+			pins = "gpio25";
+			function = "blsp2_i2c1";
+			drive-strength = <8>;
+			bias-disable;
+		};
+
+		i2c_sda {
+			pins = "gpio26";
+			function = "blsp2_i2c1";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+
+	button_pins: button_pins {
+		reset_button {
+			pins = "gpio28";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+/*
+	audio_pins: audio_pinmux {
+		mux_1 {
+			pins = "gpio24";
+			function = "audio_rxbclk";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+
+		mux_2 {
+			pins = "gpio25";
+			function = "audio_rxfsync";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+
+		mux_3 {
+			pins = "gpio26";
+			function = "audio_rxd";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+
+		mux_4 {
+			pins = "gpio27";
+			function = "audio_txmclk";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+
+		mux_5 {
+			pins = "gpio28";
+			function = "audio_txbclk";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+
+		mux_6 {
+			pins = "gpio29";
+			function = "audio_txfsync";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+
+		mux_7 {
+			pins = "gpio30";
+			function = "audio_txd";
+			drive-strength = <8>;
+			bias-pull-down;
+		};
+	};
+*/
+	poe_pins: poe_pinmux {
+		/*
+			LAN port PoE output enable
+			H --> enable; L --> disable (Default setting to H)
+		*/
+		mux_0 { /* PoE_OUT_EN */
+			pins = "gpio24";
+			function = "gpio";
+			drive-strength = <2>;
+			bias-pull-up;
+			output-high;
+		};
+
+		mux_1 { /* PSE_INT_N */
+			pins = "gpio27";
+			function = "gpio";
+			bias-pull-up;
+			input;
+		};
+	};
+
+	leds_pins: leds_pinmux {
+		sys_green {
+			pins = "gpio1";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-disable;
+		};
+		sys_blue {
+			pins = "gpio30";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+		sys_red {
+			pins = "gpio46";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		button@1 {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&tlmm 28 GPIO_ACTIVE_LOW>;
+			linux,input-type = <1>;
+			debounce-interval = <60>;
+		};
+	};
+
+	gpio_leds {
+		compatible = "gpio-leds";
+		pinctrl-0 = <&leds_pins>;
+		pinctrl-names = "default";
+
+		led@1 {
+			label = "sys:green";
+			gpios = <&tlmm 1 GPIO_ACTIVE_HIGH>;  /* GPIO_1/ATST_QP0 */
+			default-state="off";
+		};
+		led@30 {
+			label = "sys:blue";
+			gpios = <&tlmm 30 GPIO_ACTIVE_HIGH>;  /* GPIO_30 */
+			default-state="on";
+		};
+		led@46 {
+			label = "sys:red";
+			gpios = <&tlmm 46 GPIO_ACTIVE_HIGH>;  /* GPIO_46 */
+			default-state="off";
+		};
+	};
+};
+
+&q6v5_wcss {
+	compatible = "qcom,ipq5018-q6-mpd";
+	#address-cells = <1>;
+	#size-cells = <1>;
+	ranges;
+	firmware = "IPQ5018/q6_fw.mdt";
+	reg = <0x0cd00000 0x4040>,
+		<0x1938000 0x8>,
+		<0x193d204 0x4>;
+	reg-names = "qdsp6",
+			"tcsr-msip",
+			"tcsr-q6";
+	resets = <&gcc GCC_WCSSAON_RESET>,
+			<&gcc GCC_WCSS_Q6_BCR>;
+
+	reset-names = "wcss_aon_reset",
+			"wcss_q6_reset";
+
+	clocks = <&gcc GCC_Q6_AXIS_CLK>,
+		<&gcc GCC_WCSS_ECAHB_CLK>,
+		<&gcc GCC_Q6_AXIM_CLK>,
+		<&gcc GCC_Q6_AXIM2_CLK>,
+		<&gcc GCC_Q6_AHB_CLK>,
+		<&gcc GCC_Q6_AHB_S_CLK>,
+		<&gcc GCC_WCSS_AXI_S_CLK>;
+	clock-names = "gcc_q6_axis_clk",
+		"gcc_wcss_ecahb_clk",
+		"gcc_q6_axim_clk",
+		"gcc_q6_axim2_clk",
+		"gcc_q6_ahb_clk",
+		"gcc_q6_ahb_s_clk",
+		"gcc_wcss_axi_s_clk";
+
+	#ifdef __IPQ_MEM_PROFILE_256_MB__
+		memory-region = <&q6_mem_regions>, <&q6_etr_region>;
+	#else
+		memory-region = <&q6_mem_regions>, <&q6_etr_region>,
+				<&q6_caldb_region>;
+	#endif
+
+	qcom,rproc = <&q6v5_wcss>;
+	qcom,bootargs_smem = <507>;
+	boot-args = <0x1 0x4 0x3 0x0F 0x0 0x0>,
+			<0x2 0x4 0x2 0x12 0x0 0x0>;
+	status = "ok";
+	q6_wcss_pd1: remoteproc_pd1@4ab000 {
+		compatible = "qcom,ipq5018-wcss-ahb-mpd";
+		reg = <0x4ab000 0x20>;
+		reg-names = "rmb";
+		firmware = "IPQ5018/q6_fw.mdt";
+		m3_firmware = "IPQ5018/m3_fw.mdt";
+		interrupts-extended = <&wcss_smp2p_in 8 0>,
+					<&wcss_smp2p_in 9 0>,
+					<&wcss_smp2p_in 12 0>,
+					<&wcss_smp2p_in 11 0>;
+		interrupt-names = "fatal",
+					"ready",
+					"spawn-ack",
+					"stop-ack";
+
+		resets = <&gcc GCC_WCSSAON_RESET>,
+				<&gcc GCC_WCSS_BCR>,
+				<&gcc GCC_CE_BCR>;
+		reset-names = "wcss_aon_reset",
+				"wcss_reset",
+				"ce_reset";
+
+		clocks = <&gcc GCC_WCSS_AHB_S_CLK>,
+				<&gcc GCC_WCSS_ACMT_CLK>,
+				<&gcc GCC_WCSS_AXI_M_CLK>;
+		clock-names = "gcc_wcss_ahb_s_clk",
+					"gcc_wcss_acmt_clk",
+					"gcc_wcss_axi_m_clk";
+
+		qcom,halt-regs = <&tcsr_q6_block 0xa000 0xd000 0x0>;
+
+		qcom,smem-states = <&wcss_smp2p_out 8>,
+					<&wcss_smp2p_out 9>,
+					<&wcss_smp2p_out 10>;
+		qcom,smem-state-names = "shutdown",
+					"stop",
+					"spawn";
+	#ifdef __IPQ_MEM_PROFILE_256_MB__
+		memory-region = <&q6_ipq5018_data>, <&m3_dump>,
+				<&q6_etr_region>;
+	#else
+		memory-region = <&q6_ipq5018_data>, <&m3_dump>,
+				<&q6_etr_region>, <&q6_caldb_region>;
+	#endif
+
+	};
+
+	q6_wcss_pd2: remoteproc_pd2 {
+		compatible = "qcom,ipq5018-wcss-pcie-mpd";
+		firmware = "IPQ5018/q6_fw.mdt";
+		m3_firmware = "qcn6122/m3_fw.mdt";
+		interrupts-extended = <&wcss_smp2p_in 16 0>,
+					<&wcss_smp2p_in 17 0>,
+					<&wcss_smp2p_in 20 0>,
+					<&wcss_smp2p_in 19 0>;
+		interrupt-names = "fatal",
+					"ready",
+					"spawn-ack",
+					"stop-ack";
+
+		qcom,smem-states = <&wcss_smp2p_out 16>,
+					<&wcss_smp2p_out 17>,
+					<&wcss_smp2p_out 18>;
+		qcom,smem-state-names = "shutdown",
+					"stop",
+					"spawn";
+	#ifdef __IPQ_MEM_PROFILE_256_MB__
+		memory-region = <&q6_qcn6122_data1>, <&m3_dump_qcn6122_1>,
+				<&q6_qcn6122_etr_1>;
+	#else
+		memory-region = <&q6_qcn6122_data1>, <&m3_dump_qcn6122_1>,
+				<&q6_qcn6122_etr_1>, <&q6_qcn6122_caldb_1>;
+	#endif
+
+	};
+
+	q6_wcss_pd3: remoteproc_pd3 {
+		compatible = "qcom,ipq5018-wcss-pcie-mpd";
+		firmware = "IPQ5018/q6_fw.mdt";
+		interrupts-extended = <&wcss_smp2p_in 24 0>,
+					<&wcss_smp2p_in 25 0>,
+					<&wcss_smp2p_in 28 0>,
+					<&wcss_smp2p_in 27 0>;
+		interrupt-names = "fatal",
+					"ready",
+					"spawn-ack",
+					"stop-ack";
+
+		qcom,smem-states = <&wcss_smp2p_out 24>,
+					<&wcss_smp2p_out 25>,
+					<&wcss_smp2p_out 26>;
+		qcom,smem-state-names = "shutdown",
+					"stop",
+					"spawn";
+	#ifdef	__IPQ_MEM_PROFILE_256_MB__
+		memory-region = <&q6_qcn6122_data2>, <&m3_dump_qcn6122_2>,
+				<&q6_qcn6122_etr_2>;
+	#else
+		memory-region = <&q6_qcn6122_data2>, <&m3_dump_qcn6122_2>,
+				<&q6_qcn6122_etr_2>, <&q6_qcn6122_caldb_2>;
+	#endif
+	};
+};
+
+&i2c_0 {
+	pinctrl-0 = <&i2c_pins>;
+	pinctrl-names = "default";
+	status = "ok";
+};
+
+&wifi0 {
+	/* IPQ5018 */
+	qcom,multipd_arch;
+	qcom,rproc = <&q6_wcss_pd1>;
+	qcom,userpd-subsys-name = "q6v5_wcss_userpd1";
+#ifdef __IPQ_MEM_PROFILE_256_MB__
+	qcom,tgt-mem-mode = <2>;
+#else
+	qcom,tgt-mem-mode = <1>;
+#endif
+	qcom,board_id = <0x24>;
+#ifdef __CNSS2__
+	qcom,bdf-addr = <0x4C400000 0x4C400000 0x4C400000 0x0 0x0 0x0>;
+	qcom,caldb-addr = <0x4D300000 0x4D300000 0 0 0 0>;
+	qcom,caldb-size = <0x200000>;
+	mem-region = <&q6_ipq5018_data>;
+#else
+	memory-region = <&q6_ipq5018_data>;
+#endif
+	status = "ok";
+};
+
+&wifi1 {
+	/* QCN6122 5G */
+	qcom,multipd_arch;
+	qcom,userpd-subsys-name = "q6v5_wcss_userpd3";
+	qcom,rproc = <&q6_wcss_pd3>;
+#ifdef __IPQ_MEM_PROFILE_256_MB__
+	qcom,tgt-mem-mode = <2>;
+#else
+	qcom,tgt-mem-mode = <1>;
+#endif
+	qcom,board_id = <0x60>;
+#ifdef __CNSS2__
+	qcom,bdf-addr = <0x4E900000 0x4E900000 0x4E200000 0x0 0x0>;
+	qcom,caldb-addr = <0x4F800000 0x4F800000 0 0 0>;
+	qcom,caldb-size = <0x500000>;
+	mem-region = <&q6_qcn6122_data2>;
+#else
+	memory-region = <&q6_qcn6122_data2>;
+#endif
+	status = "ok";
+};
+
+&wifi2 {
+	/* QCN6122 6G */
+	qcom,multipd_arch;
+	qcom,userpd-subsys-name = "q6v5_wcss_userpd3";
+#ifdef __IPQ_MEM_PROFILE_256_MB__
+	qcom,tgt-mem-mode = <2>;
+#else
+	qcom,tgt-mem-mode = <1>;
+#endif
+	qcom,board_id = <0xb0>;
+	qcom,bdf-addr = <0x4ED00000 0x4ED00000 0x4E400000 0x0 0x0>;
+#ifdef __CNSS2__
+	qcom,caldb-addr = <0x4FF00000 0x4FF00000 0 0 0>;
+#else
+	qcom,caldb-addr = <0x4FF00000>;
+	m3-dump-addr = <0x4FD00000>;
+#endif
+	qcom,caldb-size = <0x500000>;
+	status = "disabled";
+};
+
+&usb3 {
+       status = "ok";
+       device-power-gpio = <&tlmm 24 1>;
+};
+
+&dwc_0 {
+       /delete-property/ #phy-cells;
+       /delete-property/ phys;
+       /delete-property/ phy-names;
+};
+
+&hs_m31phy_0 {
+       status = "ok";
+};
+
+&eud {
+	status = "ok";
+};
+
+&pcie_x1 {
+	perst-gpio = <&tlmm 18 GPIO_ACTIVE_LOW>;
+};
+
+&pcie_x2 {
+	perst-gpio = <&tlmm 15 GPIO_ACTIVE_LOW>;
+};
+
+&pcie_x1_rp {
+	status = "disabled";
+
+	mhi_0: qcom,mhi@0 {
+		reg = <0 0 0 0 0 >;
+	};
+};
+
+&pcie_x2_rp {
+	status = "disabled";
+
+	mhi_1: qcom,mhi@1 {
+		reg = <0 0 0 0 0 >;
+
+	};
+};

feeds/ipq807x_v5.4/ipq50xx/image/ipq50xx.mk

@@ -18,6 +18,28 @@ define Device/cig_wf186w
 endef
 TARGET_DEVICES += cig_wf186w
 
+define Device/cybertan_eww631_a1
+  DEVICE_TITLE := CyberTan EWW631-A1
+  DEVICE_DTS := qcom-ipq5018-eww631-a1
+  SUPPORTED_DEVICES := cybertan,eww631-a1
+  DEVICE_PACKAGES := ath11k-wifi-cybertan-eww631-a1 ath11k-firmware-ipq50xx-spruce ath11k-firmware-qcn6122
+  DEVICE_DTS_CONFIG := config@mp03.5-c1
+  IMAGES := sysupgrade.tar nand-factory.bin nand-factory.ubi
+  IMAGE/nand-factory.ubi := append-ubi
+endef
+TARGET_DEVICES += cybertan_eww631_a1
+
+define Device/cybertan_eww631_b1
+  DEVICE_TITLE := CyberTan EWW631-B1
+  DEVICE_DTS := qcom-ipq5018-eww631-b1
+  SUPPORTED_DEVICES := cybertan,eww631-b1
+  DEVICE_PACKAGES := ath11k-wifi-cybertan-eww631-b1 ath11k-firmware-ipq50xx-spruce ath11k-firmware-qcn6122
+  DEVICE_DTS_CONFIG := config@mp03.5-c1
+  IMAGES := sysupgrade.tar nand-factory.bin nand-factory.ubi
+  IMAGE/nand-factory.ubi := append-ubi
+endef
+TARGET_DEVICES += cybertan_eww631_b1
+
 define Device/edgecore_eap104
   DEVICE_TITLE := EdgeCore EAP104
   DEVICE_DTS := qcom-ipq5018-eap104

feeds/ipq807x_v5.4/ipq50xx/patches/301-diag_char.patch

@@ -0,0 +1,54 @@
+Index: linux-5.4.164-qsdk-26349818b464f8c7b52d59ce73579d9f3dd6bd5d/drivers/char/diag/diagchar_core.c
+===================================================================
+--- linux-5.4.164-qsdk-26349818b464f8c7b52d59ce73579d9f3dd6bd5d.orig/drivers/char/diag/diagchar_core.c
++++ linux-5.4.164-qsdk-26349818b464f8c7b52d59ce73579d9f3dd6bd5d/drivers/char/diag/diagchar_core.c
+@@ -763,11 +763,6 @@ static void diag_cmd_invalidate_polling(
+ 	driver->polling_reg_flag = 0;
+ 	list_for_each_safe(start, temp, &driver->cmd_reg_list) {
+ 		item = list_entry(start, struct diag_cmd_reg_t, link);
+-		if (&item->entry == NULL) {
+-			pr_err("diag: In %s, unable to search command\n",
+-			       __func__);
+-			return;
+-		}
+ 		polling = diag_cmd_chk_polling(&item->entry);
+ 		if (polling == DIAG_CMD_POLLING) {
+ 			driver->polling_reg_flag = 1;
+@@ -829,11 +824,6 @@ struct diag_cmd_reg_entry_t *diag_cmd_se
+ 
+ 	list_for_each_safe(start, temp, &driver->cmd_reg_list) {
+ 		item = list_entry(start, struct diag_cmd_reg_t, link);
+-		if (&item->entry == NULL) {
+-			pr_err("diag: In %s, unable to search command\n",
+-			       __func__);
+-			return NULL;
+-		}
+ 		temp_entry = &item->entry;
+ 		if (temp_entry->cmd_code == entry->cmd_code &&
+ 		    temp_entry->subsys_id == entry->subsys_id &&
+@@ -907,12 +897,6 @@ void diag_cmd_remove_reg_by_pid(int pid)
+ 	mutex_lock(&driver->cmd_reg_mutex);
+ 	list_for_each_safe(start, temp, &driver->cmd_reg_list) {
+ 		item = list_entry(start, struct diag_cmd_reg_t, link);
+-		if (&item->entry == NULL) {
+-			pr_err("diag: In %s, unable to search command\n",
+-			       __func__);
+-			mutex_unlock(&driver->cmd_reg_mutex);
+-			return;
+-		}
+ 		if (item->pid == pid) {
+ 			list_del(&item->link);
+ 			kfree(item);
+@@ -931,12 +915,6 @@ void diag_cmd_remove_reg_by_proc(int pro
+ 	mutex_lock(&driver->cmd_reg_mutex);
+ 	list_for_each_safe(start, temp, &driver->cmd_reg_list) {
+ 		item = list_entry(start, struct diag_cmd_reg_t, link);
+-		if (&item->entry == NULL) {
+-			pr_err("diag: In %s, unable to search command\n",
+-			       __func__);
+-			mutex_unlock(&driver->cmd_reg_mutex);
+-			return;
+-		}
+ 		if (item->proc == proc) {
+ 			list_del(&item->link);
+ 			kfree(item);

feeds/ipq807x_v5.4/ipq50xx/patches/400-NAND-MX35UF2GE4AD-ECC-8BIT.patch

@@ -0,0 +1,16 @@
+Index: linux-5.4.164-qsdk-26349818b464f8c7b52d59ce73579d9f3dd6bd5d.orig/mtd/nand/raw/nand_ids.c
+===================================================================
+--- linux-5.4.164-qsdk-26349818b464f8c7b52d59ce73579d9f3dd6bd5d.orig/drivers/mtd/nand/raw/nand_ids.c
++++ linux-5.4.164-qsdk-26349818b464f8c7b52d59ce73579d9f3dd6bd5d/drivers/mtd/nand/raw/nand_ids.c
+@@ -79,9 +79,9 @@
+ 		{ .id = {0xc2, 0xb7} },
+ 		SZ_4K, SZ_512, SZ_256K, 0, 2, 256, NAND_ECC_INFO(8, SZ_512), 0},
+ 
+-	{"MX35UF2GE4AD-Z4I SPI NAND 2G 1.8V",
++	{"MX35UF2GE4AD-Z4I SPI NAND 2G 1.8V 8-bit",
+ 		{ .id = {0xc2, 0xa6} },
+-		SZ_2K, SZ_128, SZ_128K, 0, 2, 160, NAND_ECC_INFO(4, SZ_512), 0 },
++		SZ_2K, SZ_256, SZ_128K, 0, 2, 128, NAND_ECC_INFO(8, SZ_512), 0 },
+ 
+ 	{"GD5F1GQ5REYIH SPI NAND 1G 1.8V",
+ 		{ .id = {0xc8, 0x21} },

feeds/ipq807x_v5.4/ipq60xx/base-files/etc/hotplug.d/firmware/10-ath11k-caldata

@@ -1,5 +1,4 @@
 #!/bin/sh
-
 [ -e /lib/firmware/$FIRMWARE ] && exit 0
 
 . /lib/functions.sh
@@ -98,6 +97,18 @@ ath11k-macs)
 		;;
 	esac
 	;;
+ath11k/IPQ6018/hw1.0/board.bin)
+	case "$board" in
+	cig,wf188n)
+		country=`cat /etc/ucentral/country`
+		if [ "$country" == "CA" ]; then
+			ln -s /lib/firmware/ath11k/IPQ6018/hw1.0/board.bin.CA /lib/firmware/ath11k/IPQ6018/hw1.0/board.bin
+		else
+			ln -s /lib/firmware/ath11k/IPQ6018/hw1.0/board.bin.US /lib/firmware/ath11k/IPQ6018/hw1.0/board.bin
+		fi
+		;;
+	esac
+	;;
 *)
 	exit 1
 	;;

feeds/ipq807x_v5.4/ipq60xx/base-files/etc/init.d/bootcount

@@ -10,7 +10,8 @@ boot() {
 		;;		
 	edgecore,eap101|\
 	edgecore,eap102|\
-	edgecore,oap102)
+	edgecore,oap102|\
+	edgecore.eap104)
 		avail=$(fw_printenv -n upgrade_available)
 		[ ${avail} -eq 0 ] && fw_setenv upgrade_available 1
 		fw_setenv bootcount 0

feeds/ipq807x_v5.4/ipq60xx/base-files/lib/upgrade/nand.sh

@@ -247,8 +247,8 @@ nand_do_upgrade_success() {
 	local conf_tar="/tmp/sysupgrade.tgz"
 	sync
 	[ "$CI_BOOTCFG" = 1 ] && nand_qca_update_bootconfig
+	[ -f "$conf_tar" ] && nand_restore_config "$conf_tar" && sync
 	[ -n "$CI_FWSETENV" ] && fw_setenv $CI_FWSETENV
-	[ -f "$conf_tar" ] && nand_restore_config "$conf_tar"
 	echo "sysupgrade successful"
 	umount -a
 	reboot -f

feeds/ipq807x_v5.4/ipq60xx/base-files/lib/upgrade/platform.sh

@@ -122,10 +122,10 @@ platform_do_upgrade() {
 		else
 			if grep -q rootfs1 /proc/cmdline; then
 				CI_UBIPART="rootfs2"
-				fw_setenv active 2 || exit 1
+				CI_FWSETENV="active 2"
 			else
 				CI_UBIPART="rootfs1"
-				fw_setenv active 1 || exit 1
+				CI_FWSETENV="active 1"
 			fi
 		fi
 		nand_upgrade_tar "$1"

feeds/ipq807x_v5.4/ipq60xx/image/ipq60xx.mk

@@ -2,23 +2,14 @@ KERNEL_LOADADDR := 0x41080000
 
 DEVICE_VARS += CE_TYPE
 
-define Device/cig_wf188n-ca
+define Device/cig_wf188n
   DEVICE_TITLE := Cigtech WF-188n
   DEVICE_DTS := qcom-ipq6018-cig-wf188n
   DEVICE_DTS_CONFIG := config@cp03-c1
   SUPPORTED_DEVICES := cig,wf188n
-  DEVICE_PACKAGES := ath11k-wifi-cig-wf188n-ca uboot-env
+  DEVICE_PACKAGES := ath11k-wifi-cig-wf188n uboot-env
 endef
-TARGET_DEVICES += cig_wf188n-ca
+TARGET_DEVICES += cig_wf188n
-
-define Device/cig_wf188n-us
-  DEVICE_TITLE := Cigtech WF-188n
-  DEVICE_DTS := qcom-ipq6018-cig-wf188n
-  DEVICE_DTS_CONFIG := config@cp03-c1
-  SUPPORTED_DEVICES := cig,wf188n
-  DEVICE_PACKAGES := ath11k-wifi-cig-wf188n-us uboot-env
-endef
-TARGET_DEVICES += cig_wf188n-us
 
 define Device/hfcl_ion4xe
   DEVICE_TITLE := HFCL ION4Xe
@@ -101,14 +92,14 @@ define Device/wallys_dr6018
 endef
 TARGET_DEVICES += wallys_dr6018
 
-define Device/wallys_dr6018_v4
+define Device/wallys_dr6018-v4
   DEVICE_TITLE := Wallys DR6018 V4
   DEVICE_DTS := qcom-ipq6018-wallys-dr6018-v4
   DEVICE_DTS_CONFIG := config@cp01-c4
   SUPPORTED_DEVICES := wallys,dr6018-v4
   DEVICE_PACKAGES := ath11k-wifi-wallys-dr6018-v4 uboot-envtools ath11k-firmware-qcn9000
 endef
-TARGET_DEVICES += wallys_dr6018_v4
+TARGET_DEVICES += wallys_dr6018-v4
 
 define Device/glinet_ax1800
   DEVICE_TITLE := GL-iNet AX1800

feeds/ipq807x_v5.4/ipq60xx/patches/301-diag_char.patch

@@ -0,0 +1,54 @@
+Index: linux-5.4.164-qsdk-26349818b464f8c7b52d59ce73579d9f3dd6bd5d/drivers/char/diag/diagchar_core.c
+===================================================================
+--- linux-5.4.164-qsdk-26349818b464f8c7b52d59ce73579d9f3dd6bd5d.orig/drivers/char/diag/diagchar_core.c
++++ linux-5.4.164-qsdk-26349818b464f8c7b52d59ce73579d9f3dd6bd5d/drivers/char/diag/diagchar_core.c
+@@ -763,11 +763,6 @@ static void diag_cmd_invalidate_polling(
+ 	driver->polling_reg_flag = 0;
+ 	list_for_each_safe(start, temp, &driver->cmd_reg_list) {
+ 		item = list_entry(start, struct diag_cmd_reg_t, link);
+-		if (&item->entry == NULL) {
+-			pr_err("diag: In %s, unable to search command\n",
+-			       __func__);
+-			return;
+-		}
+ 		polling = diag_cmd_chk_polling(&item->entry);
+ 		if (polling == DIAG_CMD_POLLING) {
+ 			driver->polling_reg_flag = 1;
+@@ -829,11 +824,6 @@ struct diag_cmd_reg_entry_t *diag_cmd_se
+ 
+ 	list_for_each_safe(start, temp, &driver->cmd_reg_list) {
+ 		item = list_entry(start, struct diag_cmd_reg_t, link);
+-		if (&item->entry == NULL) {
+-			pr_err("diag: In %s, unable to search command\n",
+-			       __func__);
+-			return NULL;
+-		}
+ 		temp_entry = &item->entry;
+ 		if (temp_entry->cmd_code == entry->cmd_code &&
+ 		    temp_entry->subsys_id == entry->subsys_id &&
+@@ -907,12 +897,6 @@ void diag_cmd_remove_reg_by_pid(int pid)
+ 	mutex_lock(&driver->cmd_reg_mutex);
+ 	list_for_each_safe(start, temp, &driver->cmd_reg_list) {
+ 		item = list_entry(start, struct diag_cmd_reg_t, link);
+-		if (&item->entry == NULL) {
+-			pr_err("diag: In %s, unable to search command\n",
+-			       __func__);
+-			mutex_unlock(&driver->cmd_reg_mutex);
+-			return;
+-		}
+ 		if (item->pid == pid) {
+ 			list_del(&item->link);
+ 			kfree(item);
+@@ -931,12 +915,6 @@ void diag_cmd_remove_reg_by_proc(int pro
+ 	mutex_lock(&driver->cmd_reg_mutex);
+ 	list_for_each_safe(start, temp, &driver->cmd_reg_list) {
+ 		item = list_entry(start, struct diag_cmd_reg_t, link);
+-		if (&item->entry == NULL) {
+-			pr_err("diag: In %s, unable to search command\n",
+-			       __func__);
+-			mutex_unlock(&driver->cmd_reg_mutex);
+-			return;
+-		}
+ 		if (item->proc == proc) {
+ 			list_del(&item->link);
+ 			kfree(item);

feeds/ipq807x_v5.4/ipq807x/base-files/etc/board.d/01_leds

@@ -18,6 +18,9 @@ edgecore,oap102)
         ucidef_set_led_wlan "wlan5g" "WLAN5G" "green:wifi5" "phy0tpt"
         ucidef_set_led_wlan "wlan2g" "WLAN2G" "green:wifi2" "phy1tpt"
 	;;
+cybertan,eww631-b1)
+	ucidef_set_led_default "power" "POWER" "sys:blue" "on"
+	;;
 esac
 
 board_config_flush

feeds/ipq807x_v5.4/ipq807x/base-files/etc/board.d/02_network

@@ -43,8 +43,10 @@ qcom_setup_macs()
 		[ -z "$mac" ] && return;
 		wan_mac=$(macaddr_canonicalize $mac)
 		lan_mac=$(macaddr_add "$wan_mac" 1)
-		ucidef_set_network_device_mac eth0 $lan_mac
+		ucidef_set_network_device_mac eth0 $wan_mac
-		ucidef_set_network_device_mac eth1 $wan_mac
+		ucidef_set_network_device_mac eth1 $lan_mac
+		ip link set eth0 address $wan_mac
+		ip link set eth1 address $lan_mac
 		ucidef_set_label_macaddr $wan_mac
 		;;
 	*)

feeds/ipq807x_v5.4/ipq807x/base-files/etc/hotplug.d/firmware/10-ath11k-caldata

@@ -16,9 +16,9 @@ ath11k_generate_macs() {
 	echo -ne \\x${mac3//:/\\x} >> /lib/firmware/ath11k-macs
 }
 
-ath11k_generate_macs_wf194() {
+ath11k_generate_macs_wf196() {
 	touch /lib/firmware/ath11k-macs
-	mac=$(grep BaseMacAddress= /dev/mtd14 | cut -dx -f2)
+	mac=$(grep BaseMacAddress= /dev/mtd18 | cut -dx -f2)
 	eth=$(macaddr_canonicalize $mac)
 	mac1=$(macaddr_add $eth 2)
 	mac2=$(macaddr_add $eth 3)
@@ -92,8 +92,32 @@ ath11k-macs)
 	edgecore,eap106)
 		ath11k_generate_macs
 		;;
-	cig,wf194c)
+	cig,wf196)
-		ath11k_generate_macs_wf194
+		ath11k_generate_macs_wf196
+		;;
+	esac
+	;;
+ath11k/IPQ8074/hw2.0/board.bin)
+	case "$board" in
+	cig,wf196)
+		country=`cat /etc/ucentral/country`
+		if [ "$country" == "CA" ]; then
+			ln -s /lib/firmware/ath11k/IPQ8074/hw2.0/board.bin.CA /lib/firmware/ath11k/IPQ8074/hw2.0/board.bin
+		else
+			ln -s /lib/firmware/ath11k/IPQ8074/hw2.0/board.bin.US /lib/firmware/ath11k/IPQ8074/hw2.0/board.bin
+		fi
+		;;
+	esac
+	;;
+ath11k/QCN9074/hw1.0/board.bin)
+	case "$board" in
+	cig,wf196)
+		country=`cat /etc/ucentral/country`
+		if [ "$country" == "CA" ]; then
+			ln -s /lib/firmware/ath11k/QCN9074/hw1.0/board.bin.CA /lib/firmware/ath11k/QCN9074/hw1.0/board.bin
+		else
+			ln -s /lib/firmware/ath11k/QCN9074/hw1.0/board.bin.US /lib/firmware/ath11k/QCN9074/hw1.0/board.bin
+		fi
 		;;
 	esac
 	;;

feeds/ipq807x_v5.4/ipq807x/base-files/etc/init.d/bootcount

@@ -10,7 +10,8 @@ boot() {
 		;;		
 	edgecore,eap101|\
 	edgecore,eap102|\
-	edgecore,oap102)
+	edgecore,oap102|\
+	edgecore.eap104)
 		avail=$(fw_printenv -n upgrade_available)
 		[ ${avail} -eq 0 ] && fw_setenv upgrade_available 1
 		fw_setenv bootcount 0

feeds/ipq807x_v5.4/ipq807x/base-files/lib/upgrade/nand.sh

@@ -247,8 +247,8 @@ nand_do_upgrade_success() {
 	local conf_tar="/tmp/sysupgrade.tgz"
 	sync
 	[ "$CI_BOOTCFG" = 1 ] && nand_qca_update_bootconfig
+	[ -f "$conf_tar" ] && nand_restore_config "$conf_tar" && sync
 	[ -n "$CI_FWSETENV" ] && fw_setenv $CI_FWSETENV
-	[ -f "$conf_tar" ] && nand_restore_config "$conf_tar"
 	echo "sysupgrade successful"
 	umount -a
 	reboot -f

feeds/ipq807x_v5.4/ipq807x/base-files/lib/upgrade/platform.sh

@@ -61,12 +61,16 @@ platform_do_upgrade() {
 		if [ "$(find_mtd_chardev rootfs)" ]; then
 			CI_UBIPART="rootfs"
 		else
-			if grep -q rootfs1 /proc/cmdline; then
+			if [ -e /tmp/downgrade ]; then
+				CI_UBIPART="rootfs1"
+				{ echo 'active 1'; echo 'upgrade_available 0'; } > /tmp/fw_setenv.txt || exit 1
+				CI_FWSETENV="-s /tmp/fw_setenv.txt"
+			elif grep -q rootfs1 /proc/cmdline; then
 				CI_UBIPART="rootfs2"
-				fw_setenv active 2 || exit 1
+				CI_FWSETENV="active 2"
 			else
 				CI_UBIPART="rootfs1"
-				fw_setenv active 1 || exit 1
+				CI_FWSETENV="active 1"
 			fi
 		fi
 		nand_upgrade_tar "$1"

feeds/ipq807x_v5.4/ipq807x/files/arch/arm64/boot/dts/qcom/qcom-ipq807x-eap102.dts

@@ -29,8 +29,79 @@
 		stdout-path = "serial0";
 	};
 
+	gpio-export {
+		compatible = "gpio-export";
+		#size-cells = <0>;
+
+		mcu-enable {
+			gpio-export,name = "mcu-enable";
+			gpio-export,output = <0>;
+			gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb-hub-enable {
+			gpio-export,name = "usb-hub-enable";
+			gpio-export,output = <1>;
+			gpios = <&tlmm 55 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb-rear-power {
+			gpio-export,name = "usb-rear-power";
+			gpio-export,output = <1>;
+			gpios = <&tlmm 29 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb-side-power {
+			gpio-export,name = "usb-side-power";
+			gpio-export,output = <1>;
+			gpios = <&tlmm 30 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
 	soc {
 		pinctrl@1000000 {
+			pinctrl-0 = <&mcu_rst &mcu_rsv &usb_rear_pwr &usb_side_pwr &usb_hub_rst>;
+			pinctrl-names = "default";
+
+			mcu_rst: mcu_rst_pins {
+				pins = "gpio54";
+				function = "gpio";
+				drive-strength = <8>;
+				bias-disable;
+				output-low;
+			};
+
+			mcu_rsv: mcu_rsv_pins {
+				pins = "gpio56";
+				function = "gpio";
+				drive-strength = <8>;
+				bias-disable;
+			};
+
+			usb_rear_pwr: usb_rear_pwr_pins {
+				pins = "gpio29";
+				function = "gpio";
+				drive-strength = <8>;
+				bias-disable;
+				output-high;
+			};
+
+			usb_side_pwr: usb_side_pwr_pins {
+				pins = "gpio30";
+				function = "gpio";
+				drive-strength = <8>;
+				bias-disable;
+				output-high;
+			};
+
+			usb_hub_rst: usb_hub_rst_pins {
+				pins = "gpio55";
+				function = "gpio";
+				drive-strength = <8>;
+				bias-disable;
+				output-high;
+			};
+
 			button_pins: button_pins {
 				reset_button {
 					pins = "gpio66";
@@ -40,30 +111,6 @@
 				};
 			};
 
-			usb_mux_sel_pins: usb_mux_pins {
-				mux {
-					pins = "gpio27";
-					function = "gpio";
-					drive-strength = <8>;
-					bias-pull-down;
-				};
-			};
-
-			pcie0_pins: pcie_pins {
-				pcie0_rst {
-					pins = "gpio58";
-					function = "pcie0_rst";
-					drive-strength = <8>;
-					bias-pull-down;
-				};
-				pcie0_wake {
-					pins = "gpio59";
-					function = "pcie0_wake";
-					drive-strength = <8>;
-					bias-pull-down;
-				};
-			};
-
 			mdio_pins: mdio_pinmux {
 				mux_0 {
 					pins = "gpio68";
@@ -170,19 +217,6 @@
 			status = "ok";
 		};
 
-		phy@84000 {
-			status = "ok";
-		};
-
-		phy@86000 {
-			status = "ok";
-		};
-
-		pci@20000000 {
-			perst-gpio = <&tlmm 58 1>;
-			status = "ok";
-		};
-
 		gpio_keys {
 			compatible = "gpio-keys";
 			pinctrl-0 = <&button_pins>;

feeds/ipq807x_v5.4/ipq807x/files/arch/arm64/boot/dts/qcom/qcom-ipq807x-oap102.dts

@@ -29,8 +29,79 @@
 		stdout-path = "serial0";
 	};
 
+	gpio-export {
+		compatible = "gpio-export";
+		#size-cells = <0>;
+
+		mcu-enable {
+			gpio-export,name = "mcu-enable";
+			gpio-export,output = <0>;
+			gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb-hub-enable {
+			gpio-export,name = "usb-hub-enable";
+			gpio-export,output = <1>;
+			gpios = <&tlmm 55 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb-rear-power {
+			gpio-export,name = "usb-rear-power";
+			gpio-export,output = <1>;
+			gpios = <&tlmm 29 GPIO_ACTIVE_HIGH>;
+		};
+
+		usb-side-power {
+			gpio-export,name = "usb-side-power";
+			gpio-export,output = <1>;
+			gpios = <&tlmm 30 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
 	soc {
 		pinctrl@1000000 {
+			pinctrl-0 = <&mcu_rst &mcu_rsv &usb_rear_pwr &usb_side_pwr &usb_hub_rst>;
+			pinctrl-names = "default";
+
+			mcu_rst: mcu_rst_pins {
+				pins = "gpio54";
+				function = "gpio";
+				drive-strength = <8>;
+				bias-disable;
+				output-low;
+			};
+
+			mcu_rsv: mcu_rsv_pins {
+				pins = "gpio56";
+				function = "gpio";
+				drive-strength = <8>;
+				bias-disable;
+			};
+
+			usb_rear_pwr: usb_rear_pwr_pins {
+				pins = "gpio29";
+				function = "gpio";
+				drive-strength = <8>;
+				bias-disable;
+				output-high;
+			};
+
+			usb_side_pwr: usb_side_pwr_pins {
+				pins = "gpio30";
+				function = "gpio";
+				drive-strength = <8>;
+				bias-disable;
+				output-high;
+			};
+
+			usb_hub_rst: usb_hub_rst_pins {
+				pins = "gpio55";
+				function = "gpio";
+				drive-strength = <8>;
+				bias-disable;
+				output-high;
+			};
+
 			button_pins: button_pins {
 				reset_button {
 					pins = "gpio66";
@@ -40,30 +111,6 @@
 				};
 			};
 
-			usb_mux_sel_pins: usb_mux_pins {
-				mux {
-					pins = "gpio27";
-					function = "gpio";
-					drive-strength = <8>;
-					bias-pull-down;
-				};
-			};
-
-			pcie0_pins: pcie_pins {
-				pcie0_rst {
-					pins = "gpio58";
-					function = "pcie0_rst";
-					drive-strength = <8>;
-					bias-pull-down;
-				};
-				pcie0_wake {
-					pins = "gpio59";
-					function = "pcie0_wake";
-					drive-strength = <8>;
-					bias-pull-down;
-				};
-			};
-
 			mdio_pins: mdio_pinmux {
 				mux_0 {
 					pins = "gpio68";
@@ -170,19 +217,6 @@
 			status = "ok";
 		};
 
-		phy@84000 {
-			status = "ok";
-		};
-
-		phy@86000 {
-			status = "ok";
-		};
-
-		pci@20000000 {
-			perst-gpio = <&tlmm 58 1>;
-			status = "ok";
-		};
-
 		gpio_keys {
 			compatible = "gpio-keys";
 			pinctrl-0 = <&button_pins>;

feeds/ipq807x_v5.4/ipq807x/files/arch/arm64/boot/dts/qcom/qcom-ipq807x-wf196.dts

@@ -16,6 +16,7 @@
 
 	aliases {
 		serial0 = &blsp1_uart5;
+		serial1 = &blsp1_uart3;
 		/* Aliases as required by u-boot to patch MAC addresses */
 		ethernet0 = "/soc/dp1";
 		ethernet1 = "/soc/dp2";
@@ -29,6 +30,17 @@
 		stdout-path = "serial0";
 	};
 
+	gpio-export {
+		compatible = "gpio-export";
+		#size-cells = <0>;
+
+		mcu-enable {
+			gpio-export,name = "mcu-enable";
+			gpio-export,output = <0>;
+			gpios = <&tlmm 34 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
 	reserved-memory {
 /* No Pine attach in 256M profile */
 #if !defined(__IPQ_MEM_PROFILE_256_MB__)
@@ -130,6 +142,26 @@
 
 	soc {
 		pinctrl@1000000 {
+			pinctrl-0 = <&mcu_rst>;
+			pinctrl-names = "default";
+
+			mcu_rst: mcu_rst_pins {
+				pins = "gpio34";
+				function = "gpio";
+				drive-strength = <8>;
+				bias-disable;
+				output-low;
+			};
+
+			mcu_uart: mcu_uart_pins {
+				mux {
+					pins = "gpio48", "gpio49";
+					function = "blsp2_uart";
+					drive-strength = <8>;
+					bias-disable;
+				};
+			};
+
 			button_pins: button_pins {
 				wps_button {
 					pins = "gpio67";
@@ -688,6 +720,12 @@
 	};
 };
 
+&blsp1_uart3 {
+	pinctrl-0 = <&mcu_uart>;
+	pinctrl-names = "default";
+	status = "ok";
+};
+
 &npu_cpr {
 	status = "disabled";
 };

feeds/ipq807x_v5.4/ipq807x/image/ipq807x.mk

@@ -9,29 +9,17 @@ define Device/cig_wf194c4
 endef
 TARGET_DEVICES += cig_wf194c4
 
-define Device/cig_wf196_us
+define Device/cig_wf196
   DEVICE_TITLE := CIG WF196
   DEVICE_DTS := qcom-ipq807x-wf196
   DEVICE_DTS_CONFIG=config@hk14
   SUPPORTED_DEVICES := cig,wf196
   BLOCKSIZE := 256k
   PAGESIZE := 4096
-  DEVICE_PACKAGES := ath11k-wifi-cig-wf196-us aq-fw-download uboot-envtools kmod-usb3 kmod-usb2 \
+  DEVICE_PACKAGES := ath11k-wifi-cig-wf196 aq-fw-download uboot-envtools kmod-usb3 kmod-usb2 \
-  	ath11k-firmware-qcn9000 ath11k-wifi-cig-wf196_6g-us
+  	ath11k-firmware-qcn9000
 endef
-TARGET_DEVICES += cig_wf196_us
+TARGET_DEVICES += cig_wf196
-
-define Device/cig_wf196_ca
-  DEVICE_TITLE := CIG WF196
-  DEVICE_DTS := qcom-ipq807x-wf196
-  DEVICE_DTS_CONFIG=config@hk14
-  SUPPORTED_DEVICES := cig,wf196
-  BLOCKSIZE := 256k
-  PAGESIZE := 4096
-  DEVICE_PACKAGES := ath11k-wifi-cig-wf196-ca aq-fw-download uboot-envtools kmod-usb3 kmod-usb2 \
-  	ath11k-firmware-qcn9000 ath11k-wifi-cig-wf196_6g-ca
-endef
-TARGET_DEVICES += cig_wf196_ca
 
 define Device/edgecore_eap102
   DEVICE_TITLE := Edgecore EAP102

feeds/ipq807x_v5.4/ipq807x/patches/301-diag_char.patch

@@ -0,0 +1,54 @@
+Index: linux-5.4.164-qsdk-26349818b464f8c7b52d59ce73579d9f3dd6bd5d/drivers/char/diag/diagchar_core.c
+===================================================================
+--- linux-5.4.164-qsdk-26349818b464f8c7b52d59ce73579d9f3dd6bd5d.orig/drivers/char/diag/diagchar_core.c
++++ linux-5.4.164-qsdk-26349818b464f8c7b52d59ce73579d9f3dd6bd5d/drivers/char/diag/diagchar_core.c
+@@ -763,11 +763,6 @@ static void diag_cmd_invalidate_polling(
+ 	driver->polling_reg_flag = 0;
+ 	list_for_each_safe(start, temp, &driver->cmd_reg_list) {
+ 		item = list_entry(start, struct diag_cmd_reg_t, link);
+-		if (&item->entry == NULL) {
+-			pr_err("diag: In %s, unable to search command\n",
+-			       __func__);
+-			return;
+-		}
+ 		polling = diag_cmd_chk_polling(&item->entry);
+ 		if (polling == DIAG_CMD_POLLING) {
+ 			driver->polling_reg_flag = 1;
+@@ -829,11 +824,6 @@ struct diag_cmd_reg_entry_t *diag_cmd_se
+ 
+ 	list_for_each_safe(start, temp, &driver->cmd_reg_list) {
+ 		item = list_entry(start, struct diag_cmd_reg_t, link);
+-		if (&item->entry == NULL) {
+-			pr_err("diag: In %s, unable to search command\n",
+-			       __func__);
+-			return NULL;
+-		}
+ 		temp_entry = &item->entry;
+ 		if (temp_entry->cmd_code == entry->cmd_code &&
+ 		    temp_entry->subsys_id == entry->subsys_id &&
+@@ -907,12 +897,6 @@ void diag_cmd_remove_reg_by_pid(int pid)
+ 	mutex_lock(&driver->cmd_reg_mutex);
+ 	list_for_each_safe(start, temp, &driver->cmd_reg_list) {
+ 		item = list_entry(start, struct diag_cmd_reg_t, link);
+-		if (&item->entry == NULL) {
+-			pr_err("diag: In %s, unable to search command\n",
+-			       __func__);
+-			mutex_unlock(&driver->cmd_reg_mutex);
+-			return;
+-		}
+ 		if (item->pid == pid) {
+ 			list_del(&item->link);
+ 			kfree(item);
+@@ -931,12 +915,6 @@ void diag_cmd_remove_reg_by_proc(int pro
+ 	mutex_lock(&driver->cmd_reg_mutex);
+ 	list_for_each_safe(start, temp, &driver->cmd_reg_list) {
+ 		item = list_entry(start, struct diag_cmd_reg_t, link);
+-		if (&item->entry == NULL) {
+-			pr_err("diag: In %s, unable to search command\n",
+-			       __func__);
+-			mutex_unlock(&driver->cmd_reg_mutex);
+-			return;
+-		}
+ 		if (item->proc == proc) {
+ 			list_del(&item->link);
+ 			kfree(item);

feeds/ipq807x_v5.4/libtcmd/patches/100-compile.patch

@@ -0,0 +1,27 @@
+Index: libtcmd-11.5/libtcmd.h
+===================================================================
+--- libtcmd-11.5.orig/libtcmd.h
++++ libtcmd-11.5/libtcmd.h
+@@ -71,7 +71,9 @@ struct tcmd_cfg {
+ 	struct sigevent sev;
+ 	timer_t timer;
+ 	bool timeout;
+-} tcmd_cfg;
++};
++
++extern struct tcmd_cfg tcmd_cfg;
+ 
+ /* WLAN API */
+ #ifdef WLAN_API_NL80211
+Index: libtcmd-11.5/nl80211.c
+===================================================================
+--- libtcmd-11.5.orig/nl80211.c
++++ libtcmd-11.5/nl80211.c
+@@ -23,6 +23,7 @@
+ #endif
+ 
+ int cb_ret;
++struct tcmd_cfg tcmd_cfg;
+ 
+ #ifdef LIBNL_2
+ static inline struct nl_sock *nl_handle_alloc(void)

feeds/ipq807x_v5.4/mac80211/patches/pending/315-set_6G_txpower_via_iw.patch

@@ -0,0 +1,58 @@
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -786,6 +786,7 @@ struct ath11k {
+ 	u32 max_tx_power;
+ 	u32 txpower_limit_2g;
+ 	u32 txpower_limit_5g;
++	u32 txpower_limit_6g;
+ 	u32 txpower_scale;
+ 	u32 power_scale;
+ 	u32 chan_tx_pwr;
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -633,6 +633,7 @@ static void ath11k_pdev_caps_update(stru
+ 
+ 	ar->txpower_limit_2g = ar->max_tx_power;
+ 	ar->txpower_limit_5g = ar->max_tx_power;
++	ar->txpower_limit_6g = ar->max_tx_power;
+ 	ar->txpower_scale = WMI_HOST_TP_SCALE_MAX;
+ }
+ 
+@@ -803,6 +804,16 @@ static int ath11k_mac_txpower_recalc(str
+ 		ar->txpower_limit_5g = txpower;
+ 	}
+ 
++        if ((ar->hw->wiphy->bands[NL80211_BAND_6GHZ]) &&
++            ar->txpower_limit_6g != txpower) {
++                param = WMI_PDEV_PARAM_TXPOWER_LIMIT5G;
++                ret = ath11k_wmi_pdev_set_param(ar, param,
++                                                txpower, ar->pdev->pdev_id);
++                if (ret)
++                        goto fail;
++                ar->txpower_limit_6g = txpower;
++        }
++
+ 	return 0;
+ 
+ fail:
+@@ -3542,18 +3553,8 @@ static void ath11k_mac_op_bss_info_chang
+ 		ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac vdev_id %i txpower %d\n",
+ 			   arvif->vdev_id, info->txpower);
+ 
+-		if (ar->supports_6ghz && info->chandef.chan &&
+-		    info->chandef.chan->band == NL80211_BAND_6GHZ &&
+-		    (arvif->vdev_type == WMI_VDEV_TYPE_STA ||
+-		     arvif->vdev_type == WMI_VDEV_TYPE_AP) &&
+-		    test_bit(WMI_TLV_SERVICE_EXT_TPC_REG_SUPPORT,
+-			     ar->ab->wmi_ab.svc_map)) {
+-			ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
+-				   "discard tx power, change to set TPC power\n");
+-		} else {
+-			arvif->txpower = info->txpower;
+-			ath11k_mac_txpower_recalc(ar);
+-		}
++		arvif->txpower = info->txpower;
++		ath11k_mac_txpower_recalc(ar);
+ 	}
+ 
+ 	if (changed & BSS_CHANGED_MCAST_RATE &&

feeds/ipq807x_v5.4/qca-diag/Makefile

@@ -29,7 +29,6 @@ define Package/qca-diag/Description
   stack.
 endef
 
-
 QCASSDK_CONFIG_OPTS+= TOOL_PATH=$(TOOLCHAIN_DIR)/bin/ \
                 SYS_PATH=$(LINUX_DIR) \
                 TOOLPREFIX=$(TARGET_CROSS) \

feeds/ipq807x_v5.4/qca-diag/src/Makefile

@@ -2,7 +2,7 @@ INCLUDE_DIR +=  include -I src
 LIB	:= -lpthread -shared
 LDFLAGS +=  -Llib/ -ldiag -lpthread -pie
 FLAGS = -fPIC -g -DUSE_MUSL
-EXTRA_CFLAGS = $(TARGET_CFLAGS) $(TARGET_LDFLAGS) $(TARGET_CPPFLAGS) -fstack-protector-all -znow -zrelro -Werror -Wno-error=attributes
+EXTRA_CFLAGS = $(TARGET_CFLAGS) $(TARGET_LDFLAGS) $(TARGET_CPPFLAGS) -fstack-protector-all -znow -zrelro -Werror -Wno-error=address-of-packed-member -Wl,--allow-multiple-definition -Wno-error=attributes 
 sample_cliobj	:= dci_client/diag_dci_sample.c
 klogobj		:= klog/diag_klog.c
 mdobj		:= mdlog/diag_mdlog.c

feeds/ipq807x_v5.4/qca-diag/src/include/diag_lsm.h

@@ -123,17 +123,23 @@ when       who     what, where, why
 
 #define GUID_LEN 16
 
-#ifdef ANDROID
+#if defined (ANDROID) || defined (USE_ANDROID_LOGGING)
 	#define LOG_TAG "Diag_Lib"
 	#define DIAG_LOGE(...)  { \
 		ALOGE(__VA_ARGS__); \
 		if (!diag_disable_console) \
 			printf(__VA_ARGS__); \
 	}
-	#include <cutils/log.h>
+	#define DIAG_LOGD(...)  { \
+		ALOGE(__VA_ARGS__); \
+		if (!diag_disable_console) \
+			printf(__VA_ARGS__); \
+	}
+	#include <log/log.h>
     #include "common_log.h"
 #else
 	#define DIAG_LOGE(...) printf (__VA_ARGS__)
+	#define DIAG_LOGD(...) printf (__VA_ARGS__)
 #endif
 #include <pthread.h>
 #include <stdio.h>
@@ -167,6 +173,12 @@ typedef enum {
 	DB_PARSER_STATE_CLOSE,
 } qsr4_db_file_parser_state;
 
+/* enum to handle packet processing status */
+enum pkt_status{
+	PKT_PROCESS_ONGOING,
+	PKT_PROCESS_DONE
+};
+
 /*
  * Structure to keep track of diag callback interface clients. Please note that
  * there can be only client communicating with an ASIC at a given time.

feeds/ipq807x_v5.4/qca-diag/src/socket_log/diag_socket_log.c

@@ -64,7 +64,7 @@ when       who    what, where, why
 #define PID_DIR "/root/diag_logs"
 #define MAX_CHAN	4
 
-static unsigned char read_buf[4096];
+static unsigned char read_buf[MAX_CHAN][4096];
 static char ip_addr_name[FILE_NAME_LEN] = "192.168.0.10";
 static char port_number_string[FILE_NAME_LEN] = "2500";
 static int port_number = 2500;
@@ -397,13 +397,22 @@ int open_connection(struct diag_socket *sock)
 int read_socket(struct diag_socket *socket)
 {
 	int num_read;
+	int status;
 
+repeat:
 	/* Read from the socket */
-	memset(read_buf, 0, 4096);
+	memset(read_buf[socket->id], 0, 4096);
-	num_read = recv(socket->fd, (unsigned char *)read_buf, 4096, 0);
+	num_read = recv(socket->fd, (unsigned char *)read_buf[socket->id], 4096, 0);
 	if (num_read > 0) {
-		/* Send the data read off of the socket to the kernel via the library */
+		/*
-		diag_send_socket_data(socket->id, read_buf, num_read);
+		 * Process socket data to make sure full command is received before send it
+		 * to the diag core via the library. If return value is not PKT_PROCESS_DONE
+		 * then this is the case of partial packet and wait for pending bytes to
+		 * get full diag command.
+		 */
+		status = diag_send_socket_data(socket->id, read_buf[socket->id], num_read);
+		if (status != PKT_PROCESS_DONE)
+			goto repeat;
 	} else if (num_read == -1) {
 		DIAG_LOGE("diag_socket_log: Read socket error: %s, errno: %d\n",
 				strerror(errno), errno);

feeds/ipq807x_v5.4/qca-diag/src/src/diag_lsm.c

@@ -89,6 +89,9 @@ when       who    what, where, why
 
 #define MAX_CHANNELS 4
 
+#define MAX_USER_PKT_SIZE		16384
+#define USER_SPACE_DATA_TYPE_SIZE	4
+
 #define DCI_HEADER_LENGTH	sizeof(int)
 #define DCI_LEN_FIELD_LENGTH	sizeof(int)
 #define DCI_EVENT_OFFSET	sizeof(uint16)
@@ -134,6 +137,13 @@ when       who    what, where, why
 	char dir_name[FILE_NAME_LEN];
 	char peripheral_name[FILE_NAME_LEN];
 
+/* enum defined to handle full/partial packet case */
+typedef enum {
+	PKT_START,
+	PKT_HEADER,
+	PKT_PAYLOAD
+} diag_pkt_states;
+
 static struct diag_callback_tbl_t cb_clients[NUM_PROC];
 static int socket_inited = 0;
 static int (*socket_cb_ptr)(void *socket_cb_data_ptr, int socket_id);
@@ -619,46 +629,246 @@ SIDE EFFECTS
 ===========================================================================*/
 int diag_send_socket_data(int id, unsigned char buf[], int num_bytes)
 {
-	unsigned char send_buf[4100];
+	static unsigned char send_buf[MAX_CHANNELS][MAX_USER_PKT_SIZE];
-	unsigned char offset = 4;
+	static unsigned char extra_header = USER_SPACE_DATA_TYPE_SIZE;
-	int i;
+	static unsigned char tmp_header[DIAG_NON_HDLC_HEADER_SIZE];
-	int start = 0;
+	static diag_pkt_states pkt_state = PKT_START;
-	int end = 0;
+	static int hdlc_pkt_pending = FALSE;
-	int copy_bytes;
+	static uint32_t total_pkt_size = 0;
-	int success;
+	static uint32_t bytes_required = 0;
+	static int s_char = 0, e_char = 0;
+	static uint32_t pkt_start_off = 0;
+	static uint32_t saved_bytes = 0;
+	int status = PKT_PROCESS_DONE;
+	int packet_len_index = 0;
+	uint16_t packet_len = 0;
+	int i = 0, j = 0;
 
-	if ((id >= 0) && (id < MAX_CHANNELS)) {
+	if ((id < 0) || id >= MAX_CHANNELS) {
-		*(int *)send_buf = USER_SPACE_DATA_TYPE;
+		DIAG_LOGE("diag_socket_log: %s: Error sending socket data. socket id: %d, num_bytes: %d\n",
-		if (socket_token[id] != 0 ) {
+			__func__, id, num_bytes);
-			*(int *)(send_buf + offset) = socket_token[id];
+		return PKT_PROCESS_DONE;
-			offset += 4;
 	}
 
 	for (i = 0; i < num_bytes; i++) {
-			if (hdlc_disabled) {
+		status = PKT_PROCESS_ONGOING;
-				if (buf[i] == CONTROL_CHAR && i == 0) {
+		switch (pkt_state)
-					end = end + 1;
+		{
-					continue;
+		case PKT_START:
+			if (buf[i] == CONTROL_CHAR && !hdlc_pkt_pending) {
+				s_char = buf[i];
+				pkt_start_off = i;
+				/* probably it is non-HDLC packet */
+				if (num_bytes >= (pkt_start_off + DIAG_NON_HDLC_HEADER_SIZE)) {
+					/* received full header */
+					packet_len_index = pkt_start_off + 2;
+					packet_len = (uint16_t)(*(uint16_t *)(buf + packet_len_index));
+					total_pkt_size = DIAG_NON_HDLC_HEADER_SIZE + packet_len + 1;
+					if (total_pkt_size <= (num_bytes - pkt_start_off)) {
+						e_char = buf[total_pkt_size-1];
+						if (s_char == e_char) {
+							/* full non-HDLC packet received */
+							memset(send_buf[id], 0, MAX_USER_PKT_SIZE);
+							*(int *)send_buf[id] = USER_SPACE_DATA_TYPE;
+							if (socket_token[id] != 0) {
+								*(int *)(send_buf[id] + extra_header) = socket_token[id];
+								extra_header += sizeof(int);
 							}
+							memcpy(send_buf[id] + extra_header, buf, total_pkt_size);
+							/* send it diag core */
+							diag_send_data(send_buf[id], total_pkt_size + extra_header);
+							i += total_pkt_size - 1;
+							s_char = 0;
+							e_char = 0;
+							total_pkt_size = 0;
+							extra_header = USER_SPACE_DATA_TYPE_SIZE;
+							status = PKT_PROCESS_DONE;
 						}
-			if (buf[i] == CONTROL_CHAR) {
-				copy_bytes = end-start+1;
-				memcpy(send_buf+offset, buf+start, copy_bytes);
-				diag_send_data(send_buf, copy_bytes+offset);
-				start = i+1;
-				end = i+1;
-				continue;
-			}
-			end = end+1;
-		}
-		success = 1;
 					} else {
-		DIAG_LOGE("diag: In %s, Error sending socket data. Invalid socket id: %d\n",
+						/* full header + partial packet received */
-			__func__, id);
+						pkt_state = PKT_PAYLOAD;
-		success = 0;
+						memset(send_buf[id], 0, MAX_USER_PKT_SIZE);
+						*(int *)send_buf[id] = USER_SPACE_DATA_TYPE;
+						if (socket_token[id] != 0) {
+							*(int *)(send_buf[id] + extra_header) = socket_token[id];
+							extra_header += sizeof(int);
+						}
+						memcpy(send_buf[id] + extra_header, (buf + pkt_start_off), (num_bytes - pkt_start_off));
+						saved_bytes = (num_bytes - pkt_start_off + extra_header);
+						bytes_required = total_pkt_size - (saved_bytes - extra_header);
+						i += num_bytes - 1;
+						DIAG_LOGD("%s:PKT_START: full header + partial pkt received, total_pkt_size %d recvd %d pending %d\n",
+							__func__, total_pkt_size, (saved_bytes - extra_header), bytes_required);
+					}
+				} else {
+					/* partial header received */
+					memcpy(tmp_header, (buf + pkt_start_off), (num_bytes - pkt_start_off));
+					saved_bytes = (num_bytes - pkt_start_off);
+					bytes_required = DIAG_NON_HDLC_HEADER_SIZE - saved_bytes;
+					i += num_bytes - 1;
+					pkt_state = PKT_HEADER;
+					DIAG_LOGD("%s:PKT_START: partial header received, recvd %d pending %d\n",
+						__func__, saved_bytes, bytes_required);
+				}
+			} else {
+				/* HDLC packet will enter here */
+				if (!hdlc_pkt_pending) {
+					hdlc_pkt_pending = TRUE;
+					memset(send_buf[id], 0, MAX_USER_PKT_SIZE);
+					*(int *)send_buf[id] = USER_SPACE_DATA_TYPE;
+					if (socket_token[id] != 0) {
+						*(int *)(send_buf[id] + extra_header) = socket_token[id];
+						extra_header += sizeof(int);
+					}
+					saved_bytes = extra_header;
+				}
+				/* iterate through the packet to find the delimiter */
+				for (j = 0; j < num_bytes; j++) {
+					if (buf[j] == CONTROL_CHAR) {
+						if (j == (num_bytes - 1)) {
+							/* delimiter found at the end of current packet
+							 * probably this is end of HDLC packet
+							 */
+							if (saved_bytes + num_bytes >= MAX_USER_PKT_SIZE) {
+								DIAG_LOGE("%s:hdlc: command too large, dropping pkt\n", __func__);
+								hdlc_pkt_pending = FALSE;
+								saved_bytes = 0;
+								i += num_bytes - 1;
+								break;
+							}
+							memcpy(send_buf[id] + saved_bytes, buf, num_bytes);
+							/* send it to diag core */
+							diag_send_data(send_buf[id], saved_bytes + num_bytes);
+							hdlc_pkt_pending = FALSE;
+							i += num_bytes - 1;
+							saved_bytes = 0;
+							extra_header = USER_SPACE_DATA_TYPE_SIZE;
+							status = PKT_PROCESS_DONE;
+						} else {
+							/* delimiter character may come at the middle of packet
+							 * just ignore as we cant handle this case
+							 */
+							DIAG_LOGD("%s:hdlc: Delimiter found at the middle index %d\n", __func__, j);
+						}
+					}
+				}
+				/* full HDLC packet has not received */
+				if (hdlc_pkt_pending) {
+					if (saved_bytes + num_bytes >= MAX_USER_PKT_SIZE) {
+						DIAG_LOGE("%s:hdlc: command too large, dropping pkt\n", __func__);
+						hdlc_pkt_pending = FALSE;
+						saved_bytes = 0;
+						i += num_bytes - 1;
+						break;
+					}
+					memcpy(send_buf[id] + saved_bytes, buf, num_bytes);
+					saved_bytes += num_bytes;
+					i += num_bytes - 1;
+					DIAG_LOGD("%s:hdlc: Partial Packet received, recvd %d\n", __func__,
+						(saved_bytes - extra_header));
+				}
+			}
+			break;
+
+		case PKT_HEADER:
+			if(num_bytes >= bytes_required){
+				/* we have full header now */
+				memcpy(tmp_header+saved_bytes, buf, bytes_required);
+				packet_len = (uint16_t)(*(uint16_t *)(tmp_header + 2));
+				total_pkt_size = DIAG_NON_HDLC_HEADER_SIZE + packet_len + 1;
+				if (total_pkt_size <= (num_bytes + saved_bytes)) {
+					/* might received full packet */
+					e_char = buf[total_pkt_size - saved_bytes - 1];
+					if (s_char == e_char) {
+						/* full non-HDLC packet received */
+						memset(send_buf[id], 0, MAX_USER_PKT_SIZE);
+						*(int *)send_buf[id] = USER_SPACE_DATA_TYPE;
+						if (socket_token[id] != 0) {
+							*(int *)(send_buf[id] + extra_header) = socket_token[id];
+							extra_header += sizeof(int);
+						}
+						memcpy(send_buf[id] + extra_header, tmp_header, saved_bytes);
+						memcpy(send_buf[id] + extra_header + saved_bytes, buf,
+								total_pkt_size - saved_bytes);
+						/* send it to diag core */
+						diag_send_data(send_buf[id], total_pkt_size + extra_header);
+						i += total_pkt_size - saved_bytes - 1;
+						s_char = 0;
+						e_char = 0;
+						total_pkt_size = 0;
+						bytes_required = 0;
+						saved_bytes = 0;
+						extra_header = USER_SPACE_DATA_TYPE_SIZE;
+						pkt_state = PKT_START;
+						status = PKT_PROCESS_DONE;
+					}
+				} else {
+					/* full header + partial packet received */
+					pkt_state = PKT_PAYLOAD;
+					memset(send_buf[id], 0, MAX_USER_PKT_SIZE);
+					*(int *)send_buf[id] = USER_SPACE_DATA_TYPE;
+					if (socket_token[id] != 0) {
+						*(int *)(send_buf[id] + extra_header) = socket_token[id];
+						extra_header += sizeof(int);
+					}
+					/* copy partial header received */
+					memcpy(send_buf[id] + extra_header, tmp_header, saved_bytes);
+					memcpy(send_buf[id] + extra_header + saved_bytes, buf, num_bytes);
+					bytes_required = total_pkt_size - saved_bytes - num_bytes;
+					i += num_bytes - 1;
+					saved_bytes += num_bytes + extra_header;
+					DIAG_LOGD("%s:PKT_HEADER: full header + partial pkt received, total_pkt_size %d recvd %d pending %d\n",
+						__func__, total_pkt_size, (saved_bytes - extra_header), bytes_required);
+				}
+			} else {
+				/* still full header not yet received */
+				memcpy(tmp_header + saved_bytes, buf, num_bytes);
+				saved_bytes += num_bytes;
+				bytes_required = DIAG_NON_HDLC_HEADER_SIZE - saved_bytes;
+				i += num_bytes - 1;
+				DIAG_LOGD("%s:PKT_HEADER: still partial header received, recvd %d pending %d\n",
+					__func__, saved_bytes, bytes_required);
+			}
+			break;
+
+		case PKT_PAYLOAD:
+			if(num_bytes >= bytes_required){
+				/* received pending bytes */
+				e_char = buf[bytes_required - 1];
+				if (s_char == e_char) {
+					/* full non-HDLC packet received */
+					memcpy(send_buf[id] + saved_bytes, buf, bytes_required);
+					/* send it to diag core */
+					diag_send_data(send_buf[id], total_pkt_size + extra_header);
+					i += bytes_required - 1;
+					s_char = 0;
+					e_char = 0;
+					total_pkt_size = 0;
+					bytes_required = 0;
+					saved_bytes = 0;
+					extra_header = USER_SPACE_DATA_TYPE_SIZE;
+					pkt_state = PKT_START;
+					status = PKT_PROCESS_DONE;
+				}
+			} else {
+				/* still not yet received the full packet */
+				memcpy(send_buf[id] + saved_bytes, buf, num_bytes);
+				bytes_required = total_pkt_size - (saved_bytes -
+								extra_header) - num_bytes;
+				i += num_bytes - 1;
+				saved_bytes += num_bytes;
+				DIAG_LOGD("%s:PKT_PAYLOAD: Still waiting for full packet,saved %d pending %d\n",
+							__func__, (saved_bytes - extra_header), bytes_required);
+			}
+			break;
+		default:
+			DIAG_LOGD("%s:default: Unexpected packet state\n",
+						__func__);
+			break;
+		}
 	}
 
-	return success;
+	return status;
 }
 
 /*==========================================================================
@@ -2300,6 +2510,7 @@ int diag_read_mask_file(void)
 		if (!found_cmd) {
 			DIAG_LOGE("Sorry, could not find valid commands in the mask file,"
 					"please check the mask file again\n");
+			fclose(read_mask_fp);
 			return -1;
 		}
 	} else {
@@ -2321,6 +2532,7 @@ int diag_read_mask_file(void)
 			if (mask_buf[count_mask_bytes] != CONTROL_CHAR && i == 0) {
 				DIAG_LOGE("Sorry, the mask file doesn't adhere to framing definition,"
 					"please check the mask file again\n");
+				fclose(read_mask_fp);
 				return -1;
 			}
 			if (count_mask_bytes > payload && mask_buf[count_mask_bytes] == CONTROL_CHAR && i != 0) {

feeds/ipq807x_v5.4/qca-diag/src/src/diag_lsmi.h

@@ -34,6 +34,14 @@ when       who     what, where, why
 #define DIAG_MDLOG_PID_FILE_SZ  100
 #define NUM_PROC 10
 #define HDLC_DISABLE	1
+
+/* Non-HDLC Header:
+ * 1 byte - Control char
+ * 1 byte - Version
+ * 2 bytes - Packet length
+ */
+#define DIAG_NON_HDLC_HEADER_SIZE       4
+
 extern int diag_fd;
 extern int fd_md[NUM_PROC];
 extern int gdwClientID;

feeds/ipq807x_v5.4/qca-diag/src/src/diag_qshrink4_db_parser.c

@@ -249,6 +249,8 @@ static int diag_qsr4_db_file_mem_init(qsr4_db_file_list** file_entry)
 	}
 	if (entry->head == NULL)
 		entry->head = file_block_offset;
+	else
+		free(file_block_offset);
 
 	return TRUE;
 

feeds/ipq95xx/ath12k-firmware/Makefile

@@ -1,11 +1,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ath12k-firmware
+PKG_MIRROR_HASH:=a325f86b1d613f713d2e015abca4a9ff86c8448d4cd540fa022866da2c5aa042
 PKG_SOURCE_PROTO:=git
 PKG_BRANCH:=main
 PKG_SOURCE_URL:=https://github.com/quic/upstream-wifi-fw.git
-PKG_MIRROR_HASH:=ade4287ff2935ad1d54e5dabb8e6de28f648d0974fa76238fcc1616235e6773e
+PKG_SOURCE_VERSION:=e90d32aaa149800ea79760639cb5ac9ddcfc8281
-PKG_SOURCE_VERSION:=3417bb86645c5ff4c58258db7cc33e43260b4222
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 
@@ -18,20 +18,59 @@ define Package/ath12k-firmware-default
   DEPENDS:=
 endef
 
+define Package/ath12k-firmware-qcn92xx-split-phy
+  $(Package/ath12k-firmware-default)
+  TITLE:=ath12k firmware for qcn92xx split phy devices
+  DEPENDS:=@(TARGET_ipq95xx||TARGET_ipq53xx)
+endef
+
 define Package/ath12k-firmware-qcn92xx
   $(Package/ath12k-firmware-default)
   TITLE:=ath12k firmware for qcn92xx devices
-  DEPENDS:=@TARGET_ipq95xx
+  DEPENDS:=@(TARGET_ipq95xx||TARGET_ipq53xx)
+endef
+
+define Package/ath12k-firmware-ipq53xx
+  $(Package/ath12k-firmware-default)
+  TITLE:=ath12k firmware for ipq53xx devices
+  DEPENDS:=@TARGET_ipq53xx
+endef
+
+define Package/ath12k-firmware-ipq53xx-wk-wk
+  $(Package/ath12k-firmware-default)
+  TITLE:=ath12k firmware for ipq53xx + wk + wk devices
+  DEPENDS:=@TARGET_ipq53xx
 endef
 
 define Build/Compile
 
 endef
 
+define Package/ath12k-firmware-qcn92xx-split-phy/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath12k/QCN92XX/hw1.0
+	$(CP) $(PKG_BUILD_DIR)/ath12k-firmware/QCN9274/hw2.0_split_phy/1.2.1/WLAN.WBE.1.2.1-00148-QCAHKSWPL_SILICONZ-1/* \
+		$(1)/lib/firmware/ath12k/QCN92XX/hw1.0
+endef
+
 define Package/ath12k-firmware-qcn92xx/install
-	$(INSTALL_DIR) $(1)/lib/firmware/ath12k/QCN92XX/hw2.0
+	$(INSTALL_DIR) $(1)/lib/firmware/ath12k/QCN92XX/hw1.0
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/ath12k-firmware/QCN9274/hw2.0/1.1.1/WLAN.WBE.1.1.1-00126-QCAHKSWPL_SILICONZ-1/* \
+	$(CP) $(PKG_BUILD_DIR)/ath12k-firmware/QCN9274/hw2.0/1.2.1/WLAN.WBE.1.2.1-00201-QCAHKSWPL_SILICONZ-1/* \
-		$(1)/lib/firmware/ath12k/QCN92XX/hw2.0
+		$(1)/lib/firmware/ath12k/QCN92XX/hw1.0
+endef
+
+define Package/ath12k-firmware-ipq53xx/install
+	$(INSTALL_DIR) $(1)/lib/firmware/IPQ5332/
+	$(CP) $(PKG_BUILD_DIR)/ath12k-firmware//IPQ5322/hw1.0/1.2.1/WLAN.WBE.1.2.1-00201-QCAHKSWPL_SILICONZ-1/* \
+		$(1)/lib/firmware/IPQ5332/
+endef
+
+define Package/ath12k-firmware-ipq53xx-wk-wk/install
+	$(INSTALL_DIR) $(1)/lib/firmware/IPQ5332/
+	$(CP) $(PKG_BUILD_DIR)/ath12k-firmware/IPQ5322_QCN6432_QCN6432/hw1.0/testing/1.3/WLAN.WBE.1.3-02907-QCAHKSWPL_SILICONZ-1/* \
+		$(1)/lib/firmware/IPQ5332/
 endef
 
 $(eval $(call BuildPackage,ath12k-firmware-qcn92xx))
+$(eval $(call BuildPackage,ath12k-firmware-qcn92xx-split-phy))
+$(eval $(call BuildPackage,ath12k-firmware-ipq53xx))
+$(eval $(call BuildPackage,ath12k-firmware-ipq53xx-wk-wk))

feeds/ipq95xx/ath12k-wifi/Makefile

@@ -19,7 +19,7 @@ define Package/ath12k-wifi-default
   SUBMENU:=ath12k Board-Specific Overrides
   SECTION:=firmware
   CATEGORY:=Firmware
-  DEPENDS:=@TARGET_qcn9274
+  DEPENDS:=@(TARGET_qcn9274||TARGET_ipq53xx)
   TITLE:=Custom Board
 endef
 
@@ -33,4 +33,32 @@ define Package/ath12k-wifi-qcom-qcn9274/install
 	$(INSTALL_DATA) ./board-2.bin.QCN9274 $(1)/lib/firmware/ath12k/QCN9274/hw1.0/board-2.bin
 endef
 
+define Package/ath12k-wifi-cig-wf189
+$(call Package/ath12k-wifi-default)
+    TITLE:=board.bin for CIG WF189
+endef
+
+define Package/ath12k-wifi-sercomm-ap72tip
+$(call Package/ath12k-wifi-default)
+    TITLE:=board.bin for Sercomm WIFI-7
+endef
+
+define Package/ath12k-wifi-cig-wf189/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath12k/QCN92XX/hw1.0 $(1)/lib/firmware/ath12k/IPQ5332/hw1.0
+	$(INSTALL_DATA) ./regdb.bin $(1)/lib/firmware/ath12k/QCN92XX/hw1.0/
+	$(INSTALL_DATA) ./board-cig-wf189.bin.qcn9224 $(1)/lib/firmware/ath12k/QCN92XX/hw1.0/board.bin
+	$(INSTALL_DATA) ./regdb.bin $(1)/lib/firmware/ath12k/IPQ5332/hw1.0/
+	$(INSTALL_DATA) ./board-cig-wf189.bin.ipq53xx $(1)/lib/firmware/ath12k/IPQ5332/hw1.0/board.bin
+endef
+
+define Package/ath12k-wifi-sercomm-ap72tip/install
+	$(INSTALL_DIR) $(1)/lib/firmware/ath12k/QCN92XX/hw1.0 $(1)/lib/firmware/ath12k/IPQ5332/hw1.0
+	$(INSTALL_DATA) ./regdb.bin $(1)/lib/firmware/ath12k/QCN92XX/hw1.0/
+	$(INSTALL_DATA) ./board-sercomm-ap72tip.bin.qcn9224 $(1)/lib/firmware/ath12k/QCN92XX/hw1.0/board.bin
+	$(INSTALL_DATA) ./regdb.bin $(1)/lib/firmware/ath12k/IPQ5332/hw1.0/
+	$(INSTALL_DATA) ./board-sercomm-ap72tip.bin.ipq53xx $(1)/lib/firmware/ath12k/IPQ5332/hw1.0/board.bin
+endef
+
 $(eval $(call BuildPackage,ath12k-wifi-qcom-qcn9274))
+$(eval $(call BuildPackage,ath12k-wifi-cig-wf189))
+$(eval $(call BuildPackage,ath12k-wifi-sercomm-ap72tip))

feeds/ipq95xx/ftm/Makefile

@@ -0,0 +1,82 @@
+include $(TOPDIR)/rules.mk
+
+PKG:=ftm
+PKG_NAME:=$(PKG)
+PKG_RELEASE:=1
+
+LOCAL_SRC:=$(TOPDIR)/qca/src/common-tools/ftm
+
+PKG_VERSION:=12.3
+
+#PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG)
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/$(PKG_NAME)
+  SECTION:=QCA
+  CATEGORY:=QTI software
+  URL:=http://www.qca.qualcomm.com
+  MAINTAINER:=Qualcomm Atheros
+  TITLE:= QCA ftm utils
+  DEPENDS:= @TARGET_ipq_ipq807x||TARGET_ipq_ipq807x_64||TARGET_ipq_ipq60xx||TARGET_ipq_ipq60xx_64||TARGET_ipq_ipq50xx||TARGET_ipq_ipq50xx_64||TARGET_ipq807x||TARGET_ipq50xx||TARGET_ipq60xx||TARGET_ipq95xx||TARGET_ipq53xx +libnl +libtcmd +qca-diag +librt +kmod-diag-char
+endef
+
+define Package/$(PKG_NAME)/description/Default
+	FTM Package Support for QCA WIFI 11 drivers
+endef
+
+TARGET_CFLAGS += -DCONFIG_FTM_WLAN -DDEBUG -DFTM_DEBUG -DWIN_AP_HOST
+TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include/qca-diag
+TARGET_CFLAGS += -MMD -O2 -Wall -g
+TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include
+TARGET_CFLAGS += -fpie
+TARGET_LDFLAGS += -ldiag -lnl-3 -lnl-genl-3 -lrt -ltcmd
+TARGET_CSRCS := ftm_main.c ftm_wlan.c ftm_write_to_flash.c
+TARGET_LDFLAGS += -pie
+
+ifeq ($(CONFIG_FEATURE_IPQ_PROVISION_SUPPORT),y)
+        TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include/qti-mfg-provision
+        TARGET_CFLAGS += -DWIN_AP_AFC
+        TARGET_LDFLAGS += -lprovision
+endif
+
+ifneq ($(CONFIG_PACKAGE_kmod-mac80211),)
+        TARGET_CFLAGS+=-DWIN_AP_HOST_OPEN=1
+endif
+
+ifeq ($(CONFIG_FEATURE_QCA_IOT),y)
+TARGET_CFLAGS += -DIPQ_AP_HOST_IOT -DIPQ_AP_HOST_IOT_QCA402X -ggdb3 -DCONFIG_DAEMON_MODE
+TARGET_CSRCS += ftm_iot.c
+TARGET_LDFLAGS += -lpthread
+TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include/qca-iot
+TARGET_LDFLAGS += -ldiag_demo
+endif
+
+ifeq ($(CONFIG_FEATURE_IPQ_IOT_SUPPORT),y)
+TARGET_CFLAGS += -DIPQ_AP_HOST_IOT -DIPQ_AP_HOST_IOT_IPQ -ggdb3 -I$(STAGING_DIR)/usr/include/btdaemon
+TARGET_CSRCS += ftm_iot.c
+TARGET_LDFLAGS += -lpthread -lbtdaemon
+endif
+
+define Build/Compile
+$(MAKE) -C $(PKG_BUILD_DIR) \
+	CC="$(TARGET_CC)" \
+	CFLAGS="$(TARGET_CFLAGS)" \
+	LDFLAGS="$(TARGET_LDFLAGS)" \
+	CSRCS="$(TARGET_CSRCS)"
+endef
+
+define Package/$(PKG_NAME)/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/ftm $(1)/usr/sbin/
+	$(INSTALL_BIN) ./files/ftm.init $(1)/etc/init.d/ftm
+	$(INSTALL_DIR) $(1)/lib/wifi
+	$(INSTALL_BIN) ./files/compress_vart.sh $(1)/lib/compress_vart.sh
+ifneq (, $(findstring ipq95xx, $(CONFIG_TARGET_BOARD)))
+	$(INSTALL_DIR) $(1)/sbin
+	$(INSTALL_BIN) ./files/ftm_qcc710_start.sh $(1)/sbin/ftm_qcc710_start
+endif
+endef
+
+$(eval $(call BuildPackage,ftm))

feeds/ipq95xx/ftm/files/compress_vart.sh

@@ -0,0 +1,75 @@
+#!/bin/sh
+#
+# Copyright (c) 2020 Qualcomm Technologies, Inc.
+#
+#  All Rights Reserved.
+# Confidential and Proprietary - Qualcomm Technologies, Inc.
+#
+#
+
+[ -e /lib/functions.sh ] && . /lib/functions.sh
+[ -e /lib/ipq806x.sh ] && . /lib/ipq806x.sh
+[ -e /lib/functions/boot.sh ] && . /lib/functions/boot.sh
+
+low_mem_compress_art()
+{
+	local mtdblock=$(find_mtd_part 0:ART)
+
+	if [ -z "$mtdblock" ]; then
+	    # read from mmc
+	    mtdblock=$(find_mmc_part 0:ART)
+	fi
+
+	[ -n "$mtdblock" ] || return
+
+        local apmp="/tmp"
+
+        lzma -zvfk -4 ${apmp}/virtual_art.bin 2> /dev/null || {
+                echo "Error Compressing Virtual ART" > /dev/console
+                return
+        }
+
+	dd if=${apmp}/virtual_art.bin.lzma of=${mtdblock}
+        echo "Success compressing Virtual ART(${mtdblock})" > /dev/console
+        return
+}
+
+normal_art()
+{
+	local mtdblock=$(find_mtd_part 0:ART)
+
+	if [ -z "$mtdblock" ]; then
+	    # read from mmc
+	    mtdblock=$(find_mmc_part 0:ART)
+	fi
+
+	[ -n "$mtdblock" ] || return
+
+	local apmp="/tmp"
+
+	dd if=${apmp}/virtual_art.bin of=${mtdblock}
+	echo "Success writing to ART(${mtdblock})" > /dev/console
+	return
+}
+
+write_caldata()
+{
+	local board
+	[ -f /tmp/sysinfo/board_name ] && {
+		board=ap$(cat /tmp/sysinfo/board_name | awk -F 'ap' '{print$2}')
+	}
+
+	if [ -e /sys/firmware/devicetree/base/compressed_art ]
+	then
+		echo "Compressed ART Supported Platform $board " > /dev/console
+		low_mem_compress_art
+	else
+		echo "Non Compressed ART Platform $board " > /dev/console
+		normal_art
+	fi
+}
+
+if [ "$1" = "write_caldata" ]
+then
+        write_caldata
+fi

feeds/ipq95xx/ftm/files/ftm.init

@@ -0,0 +1,99 @@
+#!/bin/sh /etc/rc.common
+#
+# Copyright (c) 2013, 2017, 2020 Qualcomm Technologies, Inc.
+#
+# All Rights Reserved.
+# Confidential and Proprietary - Qualcomm Technologies, Inc.
+#
+# 2013 Qualcomm Atheros, Inc.
+#
+# All Rights Reserved.
+# Qualcomm Atheros Confidential and Proprietary
+#
+
+[ -e /lib/functions.sh ] && . /lib/functions.sh
+[ -e /lib/ipq806x.sh ] && . /lib/ipq806x.sh
+[ -e /lib/functions/boot.sh ] && . /lib/functions/boot.sh
+
+START=97
+SERVICE_DAEMONIZE=1
+SERVICE_WRITE_PID=1
+
+MTD_ART_PART_NAME="art"
+
+compressed_art_read() {
+	local mtdblock=$(find_mtd_part 0:ART)
+
+	if [ -z "$mtdblock" ]; then
+		#read from mmc
+		mtdblock=$(find_mmc_part 0:ART)
+	fi
+
+	[ -n "$mtdblock" ] || return
+
+	local apmp="/tmp"
+
+	dd if=${mtdblock} of=${apmp}/virtual_art.bin.lzma
+	lzma -fdv --single-stream ${apmp}/virtual_art.bin.lzma || {
+	# Create dummy virtual_art.bin file of size 512K
+	dd if=/dev/zero of=${apmp}/virtual_art.bin bs=1024 count=512
+	}
+	echo "Uncompressed and Copied ART content from ${mtdblock} to /tmp/virtual_art.bin" > /dev/console
+}
+
+raw_art_read() {
+	local mtdblock=$(find_mtd_part 0:ART)
+
+	if [ -z "$mtdblock" ]; then
+		#read from mmc
+		mtdblock=$(find_mmc_part 0:ART)
+	fi
+
+	[ -n "$mtdblock" ] || return
+
+	local apmp="/tmp"
+
+	dd if=${mtdblock} of=${apmp}/virtual_art.bin
+	echo "Copy ART caldata from ${mtdblock} to /tmp/virtual_art.bin" > /dev/console
+}
+
+retrieve_caldata() {
+	local board
+	[ -f /tmp/sysinfo/board_name ] && {
+		board=ap$(cat /tmp/sysinfo/board_name | awk -F 'ap' '{print$2}')
+	}
+	echo "**** Platform Name: $board *****" > /dev/console
+
+	if [ -e /sys/firmware/devicetree/base/compressed_art ]
+	then
+		compressed_art_read
+	else
+		raw_art_read
+	fi
+}
+
+
+start() {
+	local emmc_flash=""
+	local nor_flash=""
+
+	emmc_flash=$(find_mmc_part 0:ART 2> /dev/null)
+	mtd_name=$(grep -i -w ${MTD_ART_PART_NAME} /proc/mtd | cut -f1 -d:)
+	nor_flash=`find /sys/bus/spi/devices/*/mtd -name ${mtd_name} 2> /dev/null`
+
+	if [ -n "$emmc_flash" ]; then
+		[ -L /dev/caldata ] || \
+			ln -s $emmc_flash /dev/caldata
+	elif [ -n "$nor_flash" ]; then
+		[ -L /dev/caldata ] || \
+			ln -s /dev/${mtd_name//mtd/mtdblock} /dev/caldata
+	elif [ -n "$mtd_name" ]; then
+		[ -L /dev/caldata ] || \
+			ln -s /dev/${mtd_name//mtd/mtdblock} /dev/caldata
+	fi
+	retrieve_caldata
+}
+
+stop() {
+	[ -L /dev/caldata ] && rm /dev/caldata
+}

feeds/ipq95xx/ftm/files/ftm_qcc710_start.sh

@@ -0,0 +1,86 @@
+#!/bin/sh
+#
+# Copyright (c) 2021 Qualcomm Technologies, Inc.
+#
+# All Rights Reserved.
+# Confidential and Proprietary - Qualcomm Technologies, Inc.
+#
+#
+
+# QCC710 v1.0 reset for BT bringup
+qcc710_reset() {
+	reset_gpio_pin=$(cat /proc/device-tree/soc/pinctrl@1000000/QCC710_pins/QCC710_reset/pins | sed s/"gpio"//)
+	[[ -z $reset_gpio_pin ]] && return
+	gpio_base=$(cat /sys/class/gpio/gpiochip*/base | head -n1)
+	gpio_reset=$(( gpio_base + reset_gpio_pin ))
+	if [[ ! -e /sys/class/gpio/gpio$gpio_reset ]]; then
+		[ -z ${SLEEP} ] && echo -e "Enter sleep value for reset. Options:\n10 \n1" && read -p "Enter : "  SLEEP
+		[ -z ${SLEEP} ] && SLEEP=10
+		echo $gpio_reset > /sys/class/gpio/export
+		echo out > /sys/class/gpio/gpio$gpio_reset/direction
+		echo "Performing QCC710 reset ...." > /dev/console
+		{ echo 1 > /sys/class/gpio/gpio$gpio_reset/value ; \
+			sleep $SLEEP; \
+			echo 0 > /sys/class/gpio/gpio$gpio_reset/value; \
+			echo "QCC710 reset complete ...." > /dev/console; }
+	fi
+}
+
+while [ -n "$1" ]; do
+	case "$1" in
+		-h|--help) HELP=1; break;;
+		-a|--ipaddr) SERVERIP="$2";shift;;
+		-s|--sleep) SLEEP="$2";shift;;
+		-r|--baud-rate) BAUDRATE="$2";shift;;
+		-*)
+			echo "Invalid option: $1"
+			ERROR=1;
+			break
+		;;
+		*)break;;
+	esac
+	shift
+done
+[ -n "$HELP" -o -n "$ERROR" ] && {
+	        cat <<EOF
+Usage: $0 [-h] [-a SERVERIP] [-r baud-rate] [-s sleep]
+ftm_qcc710_start options:
+	-h	print this help
+	-a	ipaddr of the server for diag connection
+	-r	baudrate
+	-s	sleep
+
+Example:
+ftm_qcc710_start -a <serverip> -r <baud-rate> -s <sleep>
+
+version 1 : ./sbin/ftm_qcc710_start -a 192.168.1.121 -r 2000000 -s 10
+version 2 : ./sbin/ftm_qcc710_start -a 192.168.1.121 -r 115200 -s 1
+EOF
+	# If we requested the help flag, then exit normally.
+	# Else, it's probably an error so report it as such.
+	[ -n "$HELP" ] && exit 0
+	exit 1
+}
+
+[ -z ${SERVERIP} ] && SERVERIP=$(grep -oh "serverip.*#"  /proc/cmdline  | awk -F '#' '{print $2}')
+[ -z ${SERVERIP} ] && read -p "No serverip in cmdline, please enter the serverip : "  SERVERIP
+[ -z ${BAUDRATE} ] && echo -e "Enter baudrate for stack bringup. Options:\n2000000\n115200" && read -p "Enter : "  BAUDRATE
+[ -z ${BAUDRATE} ] && BAUDRATE=2000000
+qcc710_reset
+DIAG_PID=$(ps | grep diag_socket_app | grep -v grep | awk '{print $1}')
+while [ -n "$DIAG_PID" ]
+do
+    kill -s SIGTERM $DIAG_PID
+    DIAG_PID=$(ps | grep diag_socket_app | grep -v grep | awk '{print $1}')
+done
+echo "Stopped previous instances of diag_socket_app process"
+[ -z "$DIAG_PID" ] && /usr/sbin/diag_socket_app -a $SERVERIP -p 2500 &
+
+FTM_PID=$(ps | grep "ftm " | grep -v grep | awk '{print $1}')
+while [ -n "$FTM_PID" ]
+do
+    kill -s SIGTERM $FTM_PID
+    FTM_PID=$(ps | grep "ftm " | grep -v grep | awk '{print $1}')
+done
+echo "Stopped previous instances ftm process"
+[ -z "$FTM_PID" ] && /usr/sbin/ftm -n -dd -r $BAUDRATE

feeds/ipq95xx/ftm/src/Android.mk

@@ -0,0 +1,133 @@
+ifeq ($(call is-vendor-board-platform,QCOM),true)
+
+# Build only if board has BT/FM/WLAN
+ifeq ($(findstring true, $(BOARD_HAVE_QCOM_FM) $(BOARD_HAVE_BLUETOOTH) $(BOARD_HAS_ATH_WLAN_AR6320)),true)
+
+LOCAL_PATH:= $(call my-dir)
+
+BDROID_DIR:= system/bt
+ifeq ($(TARGET_SUPPORTS_WEARABLES),true)
+QTI_DIR  := hardware/qcom/bt/msm8909/libbt-vendor
+else
+QTI_DIR  := hardware/qcom/bt/libbt-vendor
+endif
+
+
+include $(CLEAR_VARS)
+
+LOCAL_C_INCLUDES := $(TARGET_OUT_HEADERS)/diag/include \
+LOCAL_C_INCLUDES += vendor/qcom/proprietary/diag/src \
+LOCAL_C_INCLUDES += $(TARGET_OUT_HEADERS)/common/inc \
+LOCAL_C_INCLUDES += vendor/qcom/proprietary/bt/hci_qcomm_init \
+LOCAL_C_INCLUDES += vendor/qcom/opensource/fm/helium \
+LOCAL_C_INCLUDES += $(TARGET_OUT_INTERMEDIATES)/KERNEL_OBJ/usr/include \
+LOCAL_C_INCLUDES += $(BDROID_DIR)/hci/include \
+LOCAL_C_INCLUDES += $(QTI_DIR)/include
+ifeq ($(TARGET_SUPPORTS_WEARABLES),true)
+LOCAL_C_INCLUDES += device/qcom/msm8909w/opensource/bluetooth/tools/hidl_client/inc
+else
+LOCAL_C_INCLUDES += vendor/qcom/opensource/bluetooth/tools/hidl_client/inc
+endif
+
+LOCAL_ADDITIONAL_DEPENDENCIES := $(TARGET_OUT_INTERMEDIATES)/KERNEL_OBJ/usr
+
+LOCAL_CFLAGS:= \
+              -DANDROID \
+              -DDEBUG
+
+#LOCAL_CFLAGS += -include bionic/libc/include/sys/socket.h
+#LOCAL_CFLAGS += -include bionic/libc/include/netinet/in.h
+
+ifneq ($(DISABLE_BT_FTM),true)
+LOCAL_CFLAGS +=  -DCONFIG_FTM_BT
+endif
+
+ifeq ($(BOARD_HAVE_QCOM_FM),true)
+LOCAL_CFLAGS +=  -DCONFIG_FTM_FM
+endif
+
+ifeq ($(BOARD_HAS_QCA_FM_SOC), "cherokee")
+LOCAL_CFLAGS += -DFM_SOC_TYPE_CHEROKEE
+endif
+
+ifneq ($(BOARD_ANT_WIRELESS_DEVICE), )
+LOCAL_CFLAGS +=  -DCONFIG_FTM_ANT
+endif
+LOCAL_CFLAGS +=  -DCONFIG_FTM_NFC
+
+ifeq ($(BOARD_HAVE_BLUETOOTH_BLUEZ), true)
+    LOCAL_CFLAGS += -DHAS_BLUEZ_BUILDCFG
+endif # BOARD_HAVE_BLUETOOTH_BLUEZ
+
+LOCAL_SRC_FILES:= \
+    ftm_main.c \
+    ftm_nfc.c \
+    ftm_nfcnq.c \
+    ftm_nfcqti.c \
+    ftm_nfcnq_fwdl.c \
+    ftm_nfcnq_test.c
+
+ifneq ($(DISABLE_BT_FTM),true)
+LOCAL_SRC_FILES += \
+    ftm_bt.c \
+    ftm_bt_power_pfal_linux.c \
+    ftm_bt_hci_pfal_linux.c \
+    ftm_bt_persist.cpp
+endif
+
+ifeq ($(call is-platform-sdk-version-at-least,23),true)
+LOCAL_CFLAGS += -DANDROID_M
+endif
+
+ifeq ($(BOARD_HAVE_QCOM_FM),true)
+ifeq ($(BOARD_HAS_QCA_FM_SOC), "cherokee")
+LOCAL_SRC_FILES += ftm_fm.c ftm_fm_pfal_linux_3990.c
+else
+LOCAL_SRC_FILES += ftm_fm.c ftm_fm_pfal_linux.c
+endif
+endif
+
+ifneq ($(BOARD_ANT_WIRELESS_DEVICE), )
+LOCAL_SRC_FILES += ftm_ant.c
+endif
+
+ifeq ($(findstring true, $(BOARD_HAS_ATH_WLAN) $(BOARD_HAS_ATH_WLAN_AR6320)),true)
+LOCAL_CFLAGS += -DBOARD_HAS_ATH_WLAN_AR6320
+LOCAL_CFLAGS +=  -DCONFIG_FTM_WLAN
+LOCAL_CFLAGS +=  -DCONFIG_FTM_WLAN_AUTOLOAD
+LOCAL_STATIC_LIBRARIES += libtcmd
+LOCAL_SHARED_LIBRARIES += libnl
+LOCAL_C_INCLUDES += $(TARGET_OUT_HEADERS)/libtcmd
+LOCAL_SRC_FILES  += ftm_wlan.c
+endif
+
+LOCAL_SHARED_LIBRARIES += libdl
+
+ifneq ($(DISABLE_BT_FTM),true)
+LOCAL_SHARED_LIBRARIES += libbt-hidlclient
+endif
+
+LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR_EXECUTABLES)
+LOCAL_MODULE:= ftmdaemon
+LOCAL_CLANG := true
+ifeq ($(PRODUCT_VENDOR_MOVE_ENABLED),true)
+LOCAL_PROPRIETARY_MODULE := true
+endif
+LOCAL_MODULE_TAGS := optional
+LOCAL_SHARED_LIBRARIES  += libdiag
+LOCAL_SHARED_LIBRARIES  += libcutils liblog libhardware
+
+ifneq ($(DISABLE_BT_FTM),true)
+LOCAL_SHARED_LIBRARIES  += libbtnv
+endif
+
+# By default NV persist gets used
+LOCAL_CFLAGS += -DBT_NV_SUPPORT
+
+LDFLAGS += -ldl
+
+include $(BUILD_EXECUTABLE)
+include $(call all-makefiles-under,$(LOCAL_PATH))
+
+endif # filter
+endif # is-vendor-board-platform

feeds/ipq95xx/ftm/src/LICENSE

@@ -0,0 +1,181 @@
+This text file is provided to comply with the attribution requirements of
+the licenses herein, but see NOTICE for license terms of this software.
+The Apache 2.0 license can be found at
+http://www.apache.org/licenses/LICENSE-2.0.html
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

feeds/ipq95xx/ftm/src/Makefile

@@ -0,0 +1,12 @@
+#CC := $(ATH_CROSS_COMPILE_TYPE)gcc
+TARGET_TYPE ?= AR9888
+TARGET_VERS ?= v2
+
+#Sources to compile
+CSRCS := ftm_main.c ftm_wlan.c ftm_write_to_flash.c
+
+all:
+	$(CC) $(CFLAGS) $(LDFLAGS) -g3 -Wall  \
+		$(CSRCS) -o ftm
+clean:
+	rm -f ftm

feeds/ipq95xx/ftm/src/Makefile.am

@@ -0,0 +1,86 @@
+AM_CFLAGS = -Wall \
+            -g -O0 \
+            $(DIAG_CFLAGS)
+
+AM_CPPFLAGS = -Wall \
+            -g -O0 \
+            $(DIAG_CFLAGS)
+
+AM_CFLAGS += -I${WORKSPACE}/system/bt/hci/include
+AM_CFLAGS += -I${WORKSPACE}/vendor/qcom/proprietary/bt/hci_qcomm_init/
+
+AM_CPPFLAGS += -I${WORKSPACE}/system/bt/hci/include
+AM_CPPFLAGS += -I${WORKSPACE}/vendor/qcom/proprietary/bt/hci_qcomm_init/
+
+if DEBUG
+AM_CFLAGS += -DDEBUG
+AM_CPPFLAGS += -DDEBUG
+endif
+
+requiredlibs = -lrt $(DIAG_LIBS)
+
+if USE_GLIB
+AM_CFLAGS += -DUSE_GLIB $(GLIB_CFLAGS)
+AM_CPPFLAGS += -DUSE_GLIB $(GLIB_CFLAGS)
+requiredlibs += $(GLIB_LIBS)
+endif
+
+#By default build for MDM_LE
+AM_CFLAGS += -DMDM_LE
+AM_CPPFLAGS += -DMDM_LE
+
+if MDM_ROME
+AM_CFLAGS += -DBT_SOC_TYPE_ROME
+AM_CPPFLAGS += -DBT_SOC_TYPE_ROME
+else
+if MDM_PRONTO
+AM_CFLAGS += -DHCI_USE_MCT
+AM_CPPFLAGS += -DHCI_USE_MCT
+endif
+endif
+
+c_sources = ftm_main.c
+
+if CONFIG_FTM_BT
+AM_CFLAGS += -DCONFIG_FTM_BT -DBT_NV_SUPPORT
+AM_CPPFLAGS += -DCONFIG_FTM_BT -DBT_NV_SUPPORT
+c_sources += ftm_bt.c
+c_sources += ftm_bt_power_pfal_linux.c
+c_sources += ftm_bt_hci_pfal_linux.c
+c_sources += ftm_bt_persist.cpp
+endif
+
+if CONFIG_FTM_FM
+AM_CFLAGS += -DCONFIG_FTM_FM
+c_sources += ftm_fm.c
+c_sources += ftm_fm_pfal_linux.c
+endif
+
+if CONFIG_FTM_ANT
+AM_CFLAGS += -DCONFIG_FTM_ANT
+c_sources += ftm_ant.c
+endif
+
+if CONFIG_FTM_NFC
+AM_CFLAGS += -DCONFIG_FTM_NFC
+c_sources += ftm_nfc.c
+c_sources += ftm_nfcnq.c
+c_sources += ftm_nfcqti.c
+c_sources += ftm_nfcnq_fwdl.c
+c_sources += ftm_nfcnq_test.c
+endif
+
+if CONFIG_FTM_WLAN
+
+AM_CFLAGS += -DCONFIG_FTM_WLAN -DCONFIG_FTM_WLAN_AUTOLOAD
+AM_CFLAGS += $(LIBNL_CFLAGS) $(ATH6KL_UTILS_CFLAGS)
+AM_CPPFLAGS += $(LIBNL_CFLAGS) $(ATH6KL_UTILS_CFLAGS)
+
+requiredlibs += $(ATH6KL_UTILS_LIBS) $(LIBNL_LIBS)
+
+c_sources += ftm_wlan.c
+endif
+
+ftmdaemon_SOURCES = $(c_sources)
+ftmdaemon_LDADD = -ldl $(requiredlibs) -lbtnv
+bin_PROGRAMS = ftmdaemon

feeds/ipq95xx/ftm/src/NOTICE

@@ -0,0 +1,72 @@
+This NOTICE file contains certain notices of software components included
+with the software that Qualcomm Technologies, Inc. ("Qualcomm Technologies")
+is required to provide you. Notwithstanding anything in the notices in this
+file, your use of these software components together with the
+Qualcomm Technologies software (Qualcomm Technologies software hereinafter
+referred to as "Software") is subject to the terms of your license from
+Qualcomm Technologies. Compliance with all copyright laws and software
+license agreements included in the notice section of this file are the
+responsibility of the user. Except as may be granted by separate express
+written agreement, this file provides no license to any patents,
+trademarks, copyrights, or other intellectual property.
+
+Copyright (c) 2016 Qualcomm Technologies, Inc.
+All rights reserved.
+Qualcomm is a registered trademark and registered service mark of
+QUALCOMM Incorporated. All other trademarks and service marks are the
+property of their respective owners.
+________________________________________
+NOTICES
+________________________________________
+
+Copyright (C) 2010 The Android Open Source Project
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+________________________________________
+
+Copyright (C) 2015 NXP Semiconductors
+The original Work has been changed by NXP Semiconductors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+________________________________________
+
+Copyright (C) 2015 The Android Open Source Project
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+________________________________________
+
+Note: Any files for which the above Apache License notices are required
+to be provided are not contributions.
+
+A copy of the Apache 2.0 license is included in the file LICENSE
+for attribution purposes only.

feeds/ipq95xx/ftm/src/configure.ac

@@ -0,0 +1,149 @@
+#                                               -*- Autoconf -*-
+
+# configure.ac -- Autoconf script for ftm.
+#
+
+# Process this file with autoconf to produce a configure script
+
+# Requires autoconf tool later than 2.61
+AC_PREREQ(2.61)
+# Initialize the ftm package version 1.0.0
+AC_INIT([ftm],1.0.0)
+# Does not strictly follow GNU Coding standards
+AM_INIT_AUTOMAKE([foreign])
+# Disables auto rebuilding of configure, Makefile.ins
+AM_MAINTAINER_MODE
+# defines some macros variable to be included by source
+AC_CONFIG_HEADERS([config.h])
+AC_CONFIG_MACRO_DIR([m4])
+
+# Checks for programs.
+AC_PROG_CC
+AC_PROG_CXX
+AM_PROG_CC_C_O
+AC_PROG_LIBTOOL
+AC_PROG_AWK
+AC_PROG_CPP
+AC_PROG_INSTALL
+AC_PROG_LN_S
+AC_PROG_MAKE_SET
+
+# Checks for libraries.
+PKG_CHECK_MODULES([DIAG], [diag])
+AC_SUBST([DIAG_CFLAGS])
+AC_SUBST([DIAG_LIBS])
+
+has_libnl_ver=0
+# libnl-2 provides only libnl-2.0.pc file, so we check for separate libnl-genl-3.0.pc
+# pkg-config file just for libnl-3.0 case.
+#
+PKG_CHECK_MODULES([LIBNL], [libnl-3.0 >= 3.0 libnl-genl-3.0 >= 3.0], [has_libnl_ver=3], [
+   PKG_CHECK_MODULES([LIBNL], [libnl-2.0 >= 2.0], [has_libnl_ver=2], [
+           PKG_CHECK_MODULES([LIBNL], [libnl-1], [has_libnl_ver=1], [has_libnl_ver=0])])])
+
+if (test "$has_libnl_ver" -eq 0); then
+        AC_MSG_ERROR(libnl and libnl-genl are required but were not found)
+fi
+
+if (test "$has_libnl_ver" -gt 1); then
+        AC_DEFINE([HAVE_LIBNL20], [1], [Define if you have libnl-2.0 or higher])
+fi
+
+AC_SUBST([LIBNL_CFLAGS])
+AC_SUBST([LIBNL_LIBS])
+
+PKG_CHECK_MODULES([ATH6KL_UTILS], [ath6kl-utils])
+AC_SUBST([ATH6KL_UTILS_CFLAGS])
+AC_SUBST([ATH6KL_UTILS_LIBS])
+
+AC_ARG_WITH([glib],
+      AC_HELP_STRING([--with-glib],
+         [enable glib, building FTM Daemon which use glib]))
+
+if (test "x${with_glib}" = "xyes"); then
+        PKG_CHECK_MODULES(GTHREAD, gthread-2.0 >= 2.16, dummy=yes,
+                                AC_MSG_ERROR(GThread >= 2.16 is required))
+        PKG_CHECK_MODULES(GLIB, glib-2.0 >= 2.16, dummy=yes,
+                                AC_MSG_ERROR(GLib >= 2.16 is required))
+        GLIB_CFLAGS="$GLIB_CFLAGS $GTHREAD_CFLAGS"
+        GLIB_LIBS="$GLIB_LIBS $GTHREAD_LIBS"
+
+        AC_SUBST(GLIB_CFLAGS)
+        AC_SUBST(GLIB_LIBS)
+fi
+AM_CONDITIONAL(USE_GLIB, test "x${with_glib}" = "xyes")
+
+AC_ARG_ENABLE([debug],
+        [  --enable-debug    Turn on debugging],
+        [case "${enableval}" in
+            yes) debug=true ;;
+            no)  debug=false ;;
+            *) AC_MSG_ERROR([bad value ${enableval} for --enable-debug]) ;;
+        esac],[debug=false])
+
+AM_CONDITIONAL([DEBUG], [test x$debug = xtrue])
+
+AC_ARG_ENABLE([all],
+        [  --enable-all Enable all FTM functionality],
+        [case "${enableval}" in
+            yes) all=true ;;
+            no)  all=false ;;
+            *) AC_MSG_ERROR([bad value ${enableval} for --enable-all]) ;;
+        esac],[all=false])
+
+AM_CONDITIONAL([CONFIG_FTM_BT], [test x$all = xtrue])
+AM_CONDITIONAL([CONFIG_FTM_FM], [test x$all = xtrue])
+AM_CONDITIONAL([CONFIG_FTM_ANT], [test x$all = xtrue])
+AM_CONDITIONAL([CONFIG_FTM_NFC], [test x$all = xtrue])
+
+AC_ARG_ENABLE([wlan],
+        [  --enable-wlan Enable WLAN FTM functionality],
+        [case "${enableval}" in
+            yes) wlan=true ;;
+            no)  wlan=false ;;
+            *) AC_MSG_ERROR([bad value ${enableval} for --enable-wlan]) ;;
+        esac],[wlan=false])
+
+AM_CONDITIONAL([CONFIG_FTM_WLAN], [test x$wlan = xtrue -o x$all = xtrue])
+
+AC_ARG_ENABLE([bt],
+        [  --enable-bt Enable BT FTM functionality],
+        [case "${enableval}" in
+           yes) bt=true ;;
+           no)  bt=false ;;
+        *) AC_MSG_ERROR([bad value ${enableval} for --enable-bt]) ;;
+         esac],[bt=false])
+
+AM_CONDITIONAL([CONFIG_FTM_BT], [test x$bt = xtrue -o x$all = xtrue])
+
+
+AC_ARG_ENABLE(target,
+  [AS_HELP_STRING([--enable-target=TARGET], [Specify the target product to build])],
+  [TARGET=$enableval],
+  [TARGET=none]
+)
+AM_CONDITIONAL([MDM_ROME], [test "x$TARGET" = "xmdm9607" -o "x$TARGET" = "xmdm9635" -o "x$TARGET" = "xmdm9640" -o "x$TARGET" = "xmdmcalifornium"])
+AM_CONDITIONAL([MDM_PRONTO], [test "x$TARGET" = "xapq8009" -o "x$TARGET" = "xapq8017" -o "x$TARGET" = "xapq8053"])
+
+# Checks for typedefs, structures, and compiler characteristics.
+AC_HEADER_STDBOOL
+AC_HEADER_STDC
+AC_C_INLINE
+AC_TYPE_INT64_T
+AC_TYPE_PID_T
+AC_TYPE_SIZE_T
+AC_TYPE_SSIZE_T
+AC_TYPE_UINT16_T
+AC_TYPE_UINT32_T
+AC_TYPE_UINT8_T
+
+# Checks for library functions.
+AC_FUNC_ERROR_AT_LINE
+AC_FUNC_FORK
+AC_FUNC_MALLOC
+
+AC_CONFIG_FILES([ \
+        Makefile \
+        ])
+AC_OUTPUT
+

feeds/ipq95xx/ftm/src/ftm_ant.c

@@ -0,0 +1,585 @@
+/*==========================================================================
+
+         FTM ANT Source File
+
+Description
+  FTM platform independent processing of packet data
+
+# Copyright (c) 2010-2012 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+         Edit History
+
+
+when       who      what, where, why
+--------   ---      ----------------------------------------------------------
+05/16/12  ankurn    Adding support for ANT commands
+11/28/12  c_ssugas  implements efficent method for Ant cmd transfer
+                     and implements Rx thread for event handling.
+===========================================================================*/
+#include "event.h"
+#include "msg.h"
+#include "log.h"
+
+#include "diag_lsm.h"
+#include "diagpkt.h"
+#include "diagcmd.h"
+#include "diag.h"
+#include "termios.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <stdlib.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <stdbool.h>
+#include <dlfcn.h>
+#include "bt_vendor_qcom.h"
+#include "ftm_ant_common.h"
+#include "ftm_bt.h"
+#include <string.h>
+#include "hidl_client.h"
+
+#ifdef ANDROID
+#include <cutils/properties.h>
+#endif
+
+#ifdef ANDROID
+extern int soc_type;
+#endif
+
+#define ANT_CTRL_PACKET_TYPE    0x0c
+#define ANT_DATA_PACKET_TYPE    0x0e
+
+#define UNUSED(x) (void)(x)
+
+int init_transport_ant(int on);
+// The following functions are dummy implementations of the callbacks required by libbt-vendor.
+static void vendor_fwcfg_cb(bt_vendor_op_result_t result) {
+    UNUSED(result);
+}
+static void vendor_scocfg_cb(bt_vendor_op_result_t result) {
+    UNUSED(result);
+}
+static void vendor_lpm_vnd_cb(bt_vendor_op_result_t result) {
+    UNUSED(result);
+}
+static void vendor_audio_state_cb(bt_vendor_op_result_t result) {
+    UNUSED(result);
+}
+static void* vendor_alloc(int size) {
+    UNUSED(size);
+    return NULL;
+}
+static void vendor_dealloc(void *p_buf) {
+    UNUSED(p_buf);
+}
+static uint8_t vendor_xmit_cb(uint16_t opcode, void *p_buf, tINT_CMD_CBACK p_cback) {
+    UNUSED(opcode);
+    UNUSED(p_buf);
+    UNUSED(p_cback);
+    return 0;
+}
+static void vendor_epilog_cb(bt_vendor_op_result_t result) {
+    UNUSED(result);
+}
+static void vendor_a2dp_offload_cb(bt_vendor_op_result_t result, bt_vendor_opcode_t op, unsigned char handle) {
+    UNUSED(result);
+    UNUSED(op);
+    UNUSED(handle);
+}
+
+// This struct is used to regsiter the dummy callbacks with libbt-vendor
+static bt_vendor_interface_t *vendor_interface=NULL;
+static const bt_vendor_callbacks_t vendor_callbacks = {
+  sizeof(bt_vendor_callbacks_t),
+    vendor_fwcfg_cb,
+    vendor_scocfg_cb,
+    vendor_lpm_vnd_cb,
+    vendor_audio_state_cb,
+    vendor_alloc,
+    vendor_dealloc,
+    vendor_xmit_cb,
+    vendor_epilog_cb,
+    vendor_a2dp_offload_cb
+};
+
+/* Transport file descriptor */
+int fd_transport_ant_cmd;
+extern int first_ant_command;
+/* Reader thread handle */
+pthread_t ant_cmd_thread_hdl;
+/* Pipe file descriptors for cancelling read operation */
+int ant_pipefd[2];
+
+/* Enable FTM_DEBUG to turn on Debug messages  */
+//#define FTM_DEBUG
+
+/*===========================================================================
+FUNCTION   ftm_ant_readerthread
+
+DESCRIPTION
+  Thread Routine to perfom asynchrounous handling of events coming on Smd
+  descriptor. It invokes a callback to the FTM ANT layer to intiate a request
+  to read event bytes.
+
+DEPENDENCIES
+  The LifeTime of ReaderThraad is dependent on the status returned by the
+  call to ftm_ant_qcomm_handle_event
+
+RETURN VALUE
+  RETURN NULL
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+void *ftm_ant_readerthread(void *ptr)
+{
+   boolean status = FALSE;
+   int retval;
+   fd_set readfds;
+   int buf;
+
+   UNUSED(ptr);
+#ifdef FTM_DEBUG
+   printf("ftm_ant_readerthread --> \n");
+#endif
+   do
+   {
+      FD_ZERO(&readfds);
+      FD_SET(fd_transport_ant_cmd, &readfds);
+      FD_SET(ant_pipefd[0],&readfds);
+      retval = select((fd_transport_ant_cmd>ant_pipefd[0]?fd_transport_ant_cmd
+                  :ant_pipefd[0]) + 1, &readfds, NULL, NULL, NULL);
+      if(retval == -1)
+      {
+         printf("select failed\n");
+         break;
+      }
+      if(FD_ISSET(ant_pipefd[0],&readfds))
+      {
+#ifdef FTM_DEBUG
+         printf("Pipe descriptor set\n");
+#endif
+         read(ant_pipefd[0],&buf,1);
+         if(buf == 1)
+            break;
+      }
+      if(FD_ISSET(fd_transport_ant_cmd,&readfds))
+      {
+#ifdef FTM_DEBUG
+         printf("Read descriptor set\n");
+#endif
+         status = ftm_ant_qcomm_handle_event();
+         if(TRUE != status)
+            break;
+      }
+   }
+   while(1);
+#ifdef FTM_DEBUG
+   printf("\nReader thread exited\n");
+#endif
+   return 0;
+}
+
+/*===========================================================================
+FUNCTION   ftm_ant_open_channel
+
+DESCRIPTION
+   Open the SMD transport associated with ANT
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  int value indicating success or failure
+
+SIDE EFFECTS
+  NONE
+
+===========================================================================*/
+static bool ftm_ant_open_channel()
+{
+   struct termios term_port;
+   int opts;
+
+   printf("%s: \n",__func__ );
+   switch (soc_type)
+   {
+       case BT_SOC_ROME:
+       case BT_SOC_CHEROKEE:
+       case BT_SOC_NAPIER:
+           //Use hidl_client_initialize for chip initialization
+           if (hidl_client_initialize(MODE_ANT,&fd_transport_ant_cmd) == false) {
+               printf("%s: HIDL client initialization failed, opening port with init_transpor_ant\n", __func__);
+               //Use libbt-vendor for chip initialization
+               fd_transport_ant_cmd = init_transport_ant(TRUE);
+               if (fd_transport_ant_cmd == -1) {
+                   printf("%s: ANT Device open Failed, fd:%d: \n", __func__, fd_transport_ant_cmd);
+                   return false;
+               }
+           }
+           break;
+       case BT_SOC_AR3K:
+       case BT_SOC_SMD:
+#ifdef FTM_DEBUG
+           printf("ftm_ant_open_channel --> \n");
+#endif
+
+           fd_transport_ant_cmd = open(APPS_RIVA_ANT_CMD_CH, (O_RDWR));
+           if (fd_transport_ant_cmd == -1) {
+               printf("Ant Device open Failed= %d\n ", fd_transport_ant_cmd);
+               return false;
+           }
+
+           // Blocking Read
+           opts = fcntl(fd_transport_ant_cmd, F_GETFL);
+           if (opts < 0) {
+               perror("fcntl(F_GETFL)");
+               exit(EXIT_FAILURE);
+           }
+
+           opts = opts & (~O_NONBLOCK);
+           if (fcntl(fd_transport_ant_cmd, F_SETFL, opts) < 0) {
+               perror("fcntl(F_SETFL)");
+               exit(EXIT_FAILURE);
+           }
+
+           if (tcgetattr(fd_transport_ant_cmd, &term_port) < 0)
+               close(fd_transport_ant_cmd);
+           cfmakeraw(&term_port);
+           if (tcsetattr(fd_transport_ant_cmd, TCSANOW, &term_port) < 0) {
+               printf("\n Error while setting attributes\n");
+               return false;
+           }
+
+           tcflush(fd_transport_ant_cmd, TCIFLUSH);
+#ifdef FTM_DEBUG
+           printf("ftm_ant_open_channel success \n");
+#endif
+           break;
+       default:
+           ALOGE("%s:Unknown soc type.",__func__);
+           return false;
+   }
+   if (pipe(ant_pipefd) == -1)
+   {
+       printf("pipe create error");
+       return STATUS_FAIL;
+   }
+   /* Creating read thread which listens for various masks & pkt requests */
+   pthread_create( &ant_cmd_thread_hdl, NULL, ftm_ant_readerthread, NULL);
+   return true;
+}
+
+int init_transport_ant(int on) {
+
+    void *so_handle;
+    unsigned char bdaddr[] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06};
+    int  fd[CH_MAX], powerstate, ret = -1;
+    char ref_count[PROPERTY_VALUE_MAX];
+    int value;
+
+    if (on) {
+        so_handle = dlopen("libbt-vendor.so", RTLD_NOW);
+        if (!so_handle)
+        {
+           ALOGE("Failed to load vendor component");
+           return -1;
+        }
+
+        vendor_interface = (bt_vendor_interface_t *) dlsym(so_handle, "BLUETOOTH_VENDOR_LIB_INTERFACE");
+        if (!vendor_interface)
+        {
+            ALOGE("Failed to accesst bt vendor interface");
+            return -1;
+        }
+
+        vendor_interface->init(&vendor_callbacks, bdaddr);
+
+        ALOGI("Turn On BT power");
+        powerstate = BT_VND_PWR_ON;
+        ret = vendor_interface->op(BT_VND_OP_POWER_CTRL, &powerstate);
+        if (ret < 0)
+        {
+            ALOGE("Failed to turn on power from  bt vendor interface");
+            return -1;
+        }
+        for (int i = 0; i < CH_MAX; i++)
+            fd[i] = -1;
+
+#ifdef ANDROID
+        if (soc_type == BT_SOC_ROME || soc_type == BT_SOC_CHEROKEE || soc_type == BT_SOC_NAPIER) {
+            /*call ANT_USERIAL_OPEN to get ANT handle*/
+            ret = vendor_interface->op((bt_vendor_opcode_t)BT_VND_OP_ANT_USERIAL_OPEN, fd);
+    }
+#else
+#ifdef BT_SOC_TYPE_ROME
+        /*call ANT_USERIAL_OPEN to get ANT handle*/
+        ret = vendor_interface->op((bt_vendor_opcode_t)BT_VND_OP_ANT_USERIAL_OPEN, fd);
+#endif
+#endif
+        ALOGE("ret value: %d", ret);
+        if (ret != 1)
+        {
+            ALOGE("Failed to get fd from  bt vendor interface");
+            return -1;
+        } else {
+            ALOGE("FD: %x", fd[0]);
+            return fd[0];
+        }
+    } else {
+        if (vendor_interface) {
+            ALOGE("Close and cleanup the interfaces");
+
+#ifdef ANDROID
+            if (soc_type == BT_SOC_ROME || soc_type == BT_SOC_CHEROKEE || soc_type == BT_SOC_NAPIER) {
+                int ret = vendor_interface->op((bt_vendor_opcode_t)BT_VND_OP_ANT_USERIAL_CLOSE, NULL);
+            }
+#else
+#ifdef BT_SOC_TYPE_ROME
+            int ret = vendor_interface->op((bt_vendor_opcode_t)BT_VND_OP_ANT_USERIAL_CLOSE, NULL);
+#endif
+#endif
+
+            ALOGE("ret value: %d", ret);
+            ALOGI("Turn off BT power");
+            powerstate = BT_VND_PWR_OFF;
+            ret = vendor_interface->op(BT_VND_OP_POWER_CTRL, &powerstate);
+            if (ret < 0)
+            {
+                ALOGE("Failed to turn off power from  bt vendor interface");
+                return -1;
+            }
+            vendor_interface->cleanup();
+            vendor_interface = NULL;
+            return 0;
+        } else {
+
+            ALOGE("Not able to find vendor interface handle");
+            return -1;
+        }
+    }
+}
+
+/*===========================================================================
+FUNCTION   ftm_log_send_msg
+
+DESCRIPTION
+  Processes the buffer sent and sends it to the libdiag for sending the Cmd
+  response
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  NIL
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+void ftm_ant_log_send_msg(const uint8 *pEventBuf,int event_bytes)
+{
+   int result = log_status(LOG_FTM_VER_2_C);
+   ftm_ant_log_pkt_type*  ftm_ant_log_pkt_ptr = NULL;
+
+   if((pEventBuf == NULL) || (event_bytes == 0))
+      return;
+#ifdef FTM_DEBUG
+   printf("ftm_ant_log_send_msg --> \n");
+#endif
+   if(result == 1)
+   {
+      ftm_ant_log_pkt_ptr = (ftm_ant_log_pkt_type *)log_alloc(LOG_FTM_VER_2_C,
+      FTM_ANT_LOG_HEADER_SIZE + (event_bytes-1));
+      if(ftm_ant_log_pkt_ptr != NULL)
+      {
+         /* FTM ANT Log PacketID */
+         ftm_ant_log_pkt_ptr->ftm_log_id = FTM_ANT_LOG_PKT_ID;
+         memcpy((void *)ftm_ant_log_pkt_ptr->data,(void *)pEventBuf,event_bytes);
+         log_commit( ftm_ant_log_pkt_ptr );
+      }
+   }
+}
+
+/*===========================================================================
+FUNCTION   ftm_ant_dispatch
+
+DESCRIPTION
+  Dispatch routine for the various FM Rx/Tx commands. Copies the data into
+  a global union data structure before calling the processing routine
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  A Packed structre pointer including the response to the FTM FM packet
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+void * ftm_ant_dispatch(ftm_ant_pkt_type *ant_ftm_pkt, uint16 pkt_len)
+{
+   ftm_ant_generic_sudo_res *rsp;
+   int err = 0, i;
+   int data_len = ant_ftm_pkt->cmd_data_len;
+   bool resp = false;
+   unsigned char *pdata = NULL, *ptemp;
+#ifdef FTM_DEBUG
+   printf("ftm_ant_dispatch --> \n");
+#endif
+
+   UNUSED(pkt_len);
+
+   if (first_ant_command == 0) {
+       first_ant_command = 1;
+       ftm_ant_open_channel();
+   }
+
+   rsp = (ftm_ant_generic_sudo_res*)diagpkt_subsys_alloc( DIAG_SUBSYS_FTM
+                                                , FTM_ANT_CMD_CODE
+                                                , sizeof(ftm_ant_generic_sudo_res)
+                                                );
+   if(rsp ==  NULL)
+   {
+       printf("%s Failed to allocate resource",__func__);
+       return NULL;
+   }
+
+   switch (soc_type) {
+      //Rome shares the same UART transport for ANT and BT. Hence, to differenciate the
+      //packets by controller, adding one extra byte for ANT data and control packets
+       case BT_SOC_ROME:
+       case BT_SOC_CHEROKEE:
+       case BT_SOC_NAPIER:
+           data_len = data_len + 1;
+           pdata = (unsigned char *) malloc(data_len);
+           if (pdata == NULL) {
+               ALOGE("Failed to allocate the memory for ANT command packet");
+               rsp->result = FTM_ANT_FAIL;
+               return (void *) rsp;
+           }
+           //To be compatible with Legacy, SMD based PLs, send all the packets
+           //with cmd opcode 0x0c
+           pdata[0] = 0x0c;
+           memcpy(pdata+1, ant_ftm_pkt->data, data_len-1);
+           err = write(fd_transport_ant_cmd, pdata, data_len);
+           ptemp = pdata;
+           break;
+       case BT_SOC_AR3K:
+       case BT_SOC_SMD:
+           /* Send the packet to controller and send a dummy response back to host*/
+           err = write(fd_transport_ant_cmd, ant_ftm_pkt->data, data_len);
+           ptemp = ant_ftm_pkt->data;
+           break;
+       default:
+           ALOGE("%s:Unknown soc type", __func__);
+           break;
+   }
+   if (err == data_len) {
+       rsp->result = FTM_ANT_SUCCESS;
+       printf("ANT CMD: ");
+       for (i = 1; i<data_len; i++) {
+           printf("%02X ", ptemp[i]);
+       }
+       printf("\n");
+   } else {
+       rsp->result = FTM_ANT_FAIL;
+       printf("FTM ANT write fail len: %d\n", err);
+   }
+   if (pdata)
+     free(pdata);
+   return (void *)rsp;
+}
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_qcomm_handle_event
+
+DESCRIPTION
+ Routine called by the HAL layer reader thread to process the HCI events
+ The post conditions of each event is covered in a state machine pattern
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  FALSE = failure, else TRUE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+
+boolean ftm_ant_qcomm_handle_event ()
+{
+   boolean status = TRUE;
+   int nbytes,i,len =0;
+   int event_type;
+   ftm_ant_generic_res *res = (ftm_ant_generic_res *)diagpkt_subsys_alloc(
+                                   DIAG_SUBSYS_FTM
+                                   , FTM_ANT_CMD_CODE
+                                   , sizeof(ftm_ant_generic_res)
+                               );
+   if(res ==  NULL)
+    {
+       printf("%s Failed to allocate res",__func__);
+       tcflush(fd_transport_ant_cmd, TCIFLUSH);
+       return FALSE;
+    }
+#ifdef FTM_DEBUG
+   printf("ftm_ant_hci_qcomm_handle_event --> \n");
+#endif
+
+   /* Read length and event type  of Ant Resp event*/
+   nbytes = read(fd_transport_ant_cmd, (void *)res->evt, 2);
+   if(nbytes <= 0) {
+      status = FALSE;
+      printf("ftm_ant_qcomm_handle_event read fail len=%d\n", nbytes);
+      return status;
+   }
+   event_type = res->evt[0];
+   len = res->evt[1];
+#ifdef FTM_DEBUG
+   printf(" event type  =%d\n",event_type);
+   printf("length of event =%d\n",len);
+#endif
+   /* Read out the Ant Resp event*/
+   if (len <= (int)sizeof(res->evt))
+   {
+      nbytes = read(fd_transport_ant_cmd, (void *)res->evt, len);
+      if (nbytes != len) {
+          res->result = FTM_ANT_FAIL;
+          status = FALSE;
+          printf("ftm_ant_qcomm_handle_event read fail len=%d\n", nbytes);
+      }
+      else  {
+          res->result = FTM_ANT_SUCCESS;
+          printf("ANT EVT: ");
+          for (i=0; i<nbytes; i++) {
+            printf("%02X ", res->evt[i]);
+          }
+          printf("\n");
+          ftm_ant_log_send_msg(res->evt, nbytes);
+          tcflush(fd_transport_ant_cmd, TCIOFLUSH);
+      }
+   }
+   else
+   {
+       res->result = FTM_ANT_FAIL;
+       status = FALSE;
+       printf("ftm_ant_qcomm_handle_event read fail len=%d is more than sizeof(res->evt)=%d\n", len, (int)sizeof(res->evt));
+   }
+   return status;
+}

feeds/ipq95xx/ftm/src/ftm_ant_common.h

@@ -0,0 +1,124 @@
+/*==========================================================================
+
+                     FTM FM Common Header File
+
+Description
+  Global Data declarations of the ftm ant component.
+
+# Copyright (c) 2012,2014 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who      what, where, why
+--------   ---      ----------------------------------------------------------
+05/16/2012 ankurn   Adding support for ANT+
+11/28/12  c_ssugas  Adds data structures and macro for ant log event support.
+===========================================================================*/
+
+#ifdef CONFIG_FTM_ANT
+
+#include "diagpkt.h"
+#include "log.h"
+#include "ftm_bt_common.h"
+
+#include <sys/types.h>
+
+#define APPS_RIVA_ANT_CMD_CH            "/dev/smd5"
+#define APPS_RIVA_ANT_DATA_CH           "/dev/smd6"
+
+#define FTM_ANT_CMD_CODE                94
+#define OPCODE_OFFSET                   5
+
+#define FTM_ANT_LOG_HEADER_SIZE (sizeof(ftm_ant_log_pkt_type) - 1)
+#define FTM_ANT_LOG_PKT_ID 0x0D
+
+/* FTM Log Packet - Used to send back the event of a ANT Command */
+typedef PACKED struct
+{
+   log_hdr_type hdr;
+   word         ftm_log_id;     /* FTM log id */
+   byte         data[1];        /* Variable length payload,
+                                 look at FTM log id for contents */
+} ftm_ant_log_pkt_type;
+
+/* Generic result, used for any command that only returns an error code */
+typedef enum {
+     FTM_ANT_FAIL,
+     FTM_ANT_SUCCESS,
+} ftm_ant_api_result_type;
+
+typedef PACKED struct
+{
+    diagpkt_subsys_header_type  header ;
+    char    result ;
+} ftm_ant_generic_sudo_res;
+
+
+/* Generic Response */
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header; /*Diag header*/
+  uint8     evt[18];  /*allocates memory to hold longest valid event */
+  char      result; /* result */
+}__attribute__((packed)) ftm_ant_generic_res;
+
+/* FTM ANT request type */
+typedef PACKED struct
+{
+  diagpkt_cmd_code_type              cmd_code;
+  diagpkt_subsys_id_type             subsys_id;
+  diagpkt_subsys_cmd_code_type       subsys_cmd_code;
+  uint8                              cmd_id; /* command id (required) */
+  uint8                              cmd_data_len;
+  byte                               data[1];
+}__attribute__((packed))ftm_ant_pkt_type;
+
+
+
+/*===========================================================================
+FUNCTION   ftm_ant_dispatch
+
+DESCRIPTION
+  Dispatch routine for the various ANT commands. Copies the data into
+  a global union data structure before calling the processing routine
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  A Packed structre pointer including the response to the FTM ANT packet
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+
+void * ftm_ant_dispatch(ftm_ant_pkt_type *ftm_ant_pkt, uint16 length );
+
+/*===========================================================================
+FUNCTION   ftm_ant_qcomm_handle_event
+
+DESCRIPTION
+  Handler for the various ANT Events received. Sends data as log packets
+  using diag to upper layers.
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  Status value TRUE if event received successfuly
+  otherwise returns status value FALSE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+
+boolean ftm_ant_qcomm_handle_event ();
+
+#endif /* CONFIG_FTM_ANT */

feeds/ipq95xx/ftm/src/ftm_bt.h

@@ -0,0 +1,289 @@
+/*==========================================================================
+
+                     FTM BT Task Header File
+
+Description
+  Global Data declarations of the ftm bt component.
+
+# Copyright (c) 2010-2011, 2013-2014 by Qualcomm Technologies, Inc.
+# All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+09/28/11   rrr      Moved peristent NV item related APIs to CPP,
+                    for having BD address being programmed twice if previous
+                    BD address was random generated.
+09/03/11   agaja    Added support for NV_READ and NV_WRITE Commands to write
+                    onto Persist File system
+02/08/11   braghave Changes to read the HCI commands from a binary file for
+		    non-Android case
+06/18/10   rakeshk  Created a header file to hold the definitons for ftm bt
+                    task
+===========================================================================*/
+
+#ifdef  CONFIG_FTM_BT
+
+#include "diagpkt.h"
+#include <sys/types.h>
+#ifdef USE_LIBSOCCFG
+#include "btqsocnvm.h"
+#include "btqsocnvmutils.h"
+#endif
+
+/* -------------------------------------------------------------------------
+** Definitions and Declarations
+** ------------------------------------------------------------------------- */
+
+#define FTM_BT_CMD_CODE 4          /* BT FTM Command code */
+#define FTM_FM_CMD_CODE 28         /* FM FTM Command code */
+#define HCI_EVT_HDR_SIZE  3
+#define HCI_ACL_HDR_SIZE  5
+#define PROTOCOL_BYTE_SIZE 1
+#define HC_VS_MAX_CMD_EVENT  260
+#define HC_VS_MAX_ACL  1200
+#define FTM_BT_HCI_USER_CMD 0
+#define BT_FTM_CMD_RSP_LEN 1100
+#define FTM_BT_DRV_START_TEST 0xA
+
+/* MACROS for pin connectivty test*/
+#define BT_CMD_SLIM_TEST          0xBFAC
+#define LOOP_BACK_EVT_OGF         0x02
+#define LOOP_BACK_EVT_OCF         0x18
+#define LOOP_BACK_EVT_STATUS      0x00
+#define LOOP_BACK_EVT_OGF_BIT     0x04
+#define LOOP_BACK_EVT_OCF_BIT     0x05
+#define LOOP_BACK_EVT_STATUS_BIT  0x06
+
+
+#define FTM_BT_LOG_HEADER_SIZE (sizeof(ftm_bt_log_pkt_type) - 1)
+
+
+/* Vendor Specific command codes */
+#define BT_QSOC_EDL_CMD_OPCODE             (0xFC00)
+#define BT_QSOC_NVM_ACCESS_OPCODE          (0xFC0B)
+
+#define BT_QSOC_EDL_CMD_CODE             (0x00)
+#define BT_QSOC_NVM_ACCESS_CODE          (0x0B)
+#define BT_QSOC_VS_EDL_APPVER_RESP   	(0x02)
+
+#ifndef HC_VS_MAX_CMD_EVENT
+#define HC_VS_MAX_CMD_EVENT  260
+#endif /* HC_VS_MAX_CMD_EVENT */
+
+#define BT_QSOC_MAX_NVM_CMD_SIZE     0x64  /* Maximum size config (NVM) cmd  */
+#define BT_QSOC_MAX_BD_ADDRESS_SIZE  0x06  /**< Length of BT Address */
+
+#ifndef HCI_CMD_HDR_SIZE
+#define HCI_CMD_HDR_SIZE  4
+#endif /* HCI_CMD_HDR_SIZE */
+
+#ifndef HCI_EVT_HDR_SIZE
+#define HCI_EVT_HDR_SIZE  3
+#endif /* HCI_EVT_HDR_SIZE */
+
+#define FTM_BT_LOG_PKT_ID 0x01
+
+
+#define BT_HCI_CMD_PKT 0x01
+#define BT_HCI_ACL_PKT 0x02
+#define BT_HCI_EVT_PKT 0x04
+
+#define BT_HCI_CMD_CMPLT_EVT 0x0E
+#define FM_HCI_EVT_PKT 0x14
+#define FM_HCI_CMD_PKT 0x11
+
+extern int boardtype;
+
+/* VS command structure */
+typedef struct
+{
+  uint8  vs_cmd_len;
+  uint8  vs_cmd_data[BT_QSOC_MAX_NVM_CMD_SIZE];
+} bt_qsoc_cfg_tbl_struct_type;
+
+/* First Commamd structure - Used to store the First command for later
+*  processing
+*/
+struct first_cmd
+{
+  uint8 *cmd_buf;
+  int cmd_len;
+};
+
+/* FTM Global State - Enum defines the various states of the FTM
+* module
+*/
+typedef enum ftm_state
+{
+  FTM_SOC_NOT_INITIALISED,
+  FTM_SOC_READ_APP_VER,
+  FTM_SOC_READ_HW_VER,
+  FTM_SOC_POKE8_TBL_INIT,
+  FTM_SOC_DOWNLOAD_NVM,
+  FTM_SOC_DOWNLOAD_NVM_EFS,
+  FTM_SOC_SLEEP_DISABLE,
+  FTM_SOC_RESET,
+  FTM_SOC_INITIALISED
+}ftm_state;
+/* FTM CMD status */
+typedef enum ftm_log_packet_type
+{
+  FTM_USER_CMD_PASS,
+  FTM_USER_CMD_FAIL,
+  FTM_HCI_EVENT
+}ftm_log_packet_type;
+
+/* FTM Log Packet - Used to send back the event of a HCI Command */
+typedef PACKED struct
+{
+  log_hdr_type hdr;
+  byte         data[1];         /* Variable length payload,
+                                   look at FTM log id for contents */
+} ftm_bt_log_pkt_type;
+
+
+/* FTM (BT) PKT Header */
+typedef PACKED struct
+{
+  word cmd_id;            /* command id (required) */
+  word cmd_data_len;      /* request pkt data length, excluding the diag and ftm headers
+                             (optional, set to 0 if not used)*/
+  word cmd_rsp_pkt_size;  /* rsp pkt size, size of response pkt if different then req pkt
+                             (optional, set to 0 if not used)*/
+} ftm_bt_cmd_header_type;
+
+/* Bluetooth FTM packet */
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type diag_hdr;
+  ftm_bt_cmd_header_type     ftm_hdr;
+  byte                       data[1];
+} ftm_bt_pkt_type;
+
+/* SoC Cfg open Struct*/
+#ifdef USE_LIBSOCCFG
+typedef struct
+{
+   bt_qsoc_config_params_struct_type run_time_params;
+   bt_qsoc_enum_nvm_mode nvm_mode;
+   bt_qsoc_enum_type soc_type;
+}ftm_bt_soc_runtime_cfg_type;
+#endif
+
+/*===========================================================================
+FUNCTION   ftm_bt_err_timedout
+
+DESCRIPTION
+  This routine triggers the shutdown of the HCI and Power resources in case
+  a HCI command previously sent times out.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN NIL
+
+SIDE EFFECTS
+  NONE
+
+===========================================================================*/
+void ftm_bt_err_timedout();
+
+/*===========================================================================
+FUNCTION   ftm_bt_dispatch
+
+DESCRIPTION
+  Processes the BT FTM packet and dispatches the command to FTM HCI driver
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  NIL,The error in the Command Processing is sent to the DIAG App on PC via
+  log packets
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+void ftm_bt_dispatch(void *ftm_bt_pkt ,int cmd_len );
+
+/*===========================================================================
+FUNCTION   bt_hci_send_ftm_cmd
+
+DESCRIPTION
+ Helper Routine to process the HCI cmd and invokes the sub routines to intialise
+ the SoC if needed based on the state of the FTM module
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  FALSE = failure, else TRUE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+
+boolean ftm_bt_hci_send_cmd
+(
+  uint8 * cmd_buf,   /* pointer to Cmd */
+  uint16 cmd_len     /* Cmd length */
+);
+
+/*===========================================================================
+FUNCTION   bt_hci_hal_vs_sendcmd
+
+DESCRIPTION
+ Helper Routine to process the VS HCI cmd and constucts the HCI packet before
+ calling bt_hci_send_ftm_cmd routine
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  FALSE = failure, else TRUE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean ftm_bt_hci_hal_vs_sendcmd
+(
+uint16 opcode,       /* Opcode */
+uint8  *pCmdBuffer,  /* Pointer to Payload*/
+uint8  nSize         /* Cmd Size */
+);
+
+/*===========================================================================
+FUNCTION   isLatestTarget
+
+DESCRIPTION
+For all the target/solution which has Bluedroid as stack and libbt-vendor as
+vendor initialization component considered as latest target
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  FALSE = failure, else TRUE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean isLatestTarget();
+char *get_current_time(void);
+#endif /* CONFIG_FTM_BT */

feeds/ipq95xx/ftm/src/ftm_bt_common.h

@@ -0,0 +1,115 @@
+/*==========================================================================
+
+                     FTM BT Commom Header File
+
+Description
+  The header file includes helper enums for request_status and bt_power_state.
+
+# Copyright (c) 2010-2011, 2014 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+09/28/11   rrr      Common utility API abstracted,
+06/18/10   rakeshk  Created a header file to hold the  helper enums for
+                    request_status and bt_power_state
+========================================================================*/
+
+#ifdef  CONFIG_FTM_BT
+
+#include "event.h"
+#include "msg.h"
+#include "log.h"
+
+#include "diag_lsm.h"
+#include <sys/types.h>
+
+#ifndef __FTM_BT_COMMON_H__
+
+#define __FTM_BT_COMMON_H__
+
+#define TRUE 1
+#define FALSE 0
+
+/* request_status - enum to encapuslate the status of a HAL request*/
+typedef enum request_status
+{
+  STATUS_SUCCESS,
+  STATUS_FAIL,
+  STATUS_NO_RESOURCES,
+  STATUS_SHORT_WRITE,
+  STATUS_SHORT_READ
+}request_status;
+
+/* request_status - enum to encapuslate the possible statea of BT power*/
+typedef enum bt_power_state
+{
+  BT_OFF = 0x30, /* Its the value 0 to be input to rfkill driver */
+  BT_ON = 0x31 /* ASCII value for '1'*/
+}bt_power_state;
+
+typedef enum
+{
+  FTM_BT_DRV_NO_ERR = 0,
+  FTM_BT_DRV_CONN_TEST_FAILS,
+  FTM_BT_DRV_QSOC_POWERUP_FAILS,
+  FTM_BT_DRV_RX_PKT_TYPE_NOT_SUPPORTED,
+  FTM_BT_DRV_SIO_OPEN_FAILS,
+  FTM_BT_DRV_NO_SOC_RSP_TOUT,
+  FTM_BT_DRV_BAD_NVM,
+#ifdef BT_NV_SUPPORT
+  FTM_BT_NV_READ_FAIL,
+  FTM_BT_NV_WRITE_FAIL,
+#endif
+  FTM_BT_DRV_UNKNOWN_ERR
+} ftm_bt_drv_err_state_type;
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_qcomm_handle_event
+
+DESCRIPTION
+  Routine called by the HAL layer reader thread to process the HCI events
+  The post conditions of each event is covered in a state machine pattern
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  FALSE = failure, else TRUE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean ftm_bt_hci_qcomm_handle_event();
+
+/*===========================================================================
+FUNCTION   ftm_log_send_msg
+
+DESCRIPTION
+  Processes the buffer sent and sends it to the libdiag for sending the Cmd
+  response
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  NIL
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+
+
+void ftm_log_send_msg(const uint8 *pEventBuf,int event_bytes);
+#endif //__FTM_BT_COMMON_H__
+#endif /* CONFIG_FTM_BT */

feeds/ipq95xx/ftm/src/ftm_bt_hci_hal.h

@@ -0,0 +1,161 @@
+/*==========================================================================
+
+                     FTM BT HCI PFAL Header File
+
+Description
+   Warpper API definitions of the ftm bt hci hal component.
+
+# Copyright (c) 2010 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+06/18/10   rakeshk  Created a header file to hold the wrapper HAL
+                    definitions for HCI UART control
+===========================================================================*/
+
+#include "ftm_bt_common.h"
+#include "ftm_bt_hci_pfal.h"
+/*===========================================================================
+FUNCTION   ftm_bt_hci_hal_set_transport
+
+DESCRIPTION
+  sets the type of transport based on the msm type
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+returns the type of transport
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean ftm_bt_hci_hal_set_transport()
+{
+   return ftm_bt_hci_pfal_set_transport();
+}
+/*===========================================================================
+FUNCTION   ftm_bt_hci_hal_deinit_transport
+
+DESCRIPTION
+  Platform independent wrapper API which intiatea a De-intialise of UART/SMD
+  resources with PFAL layer and returns the status of the PFAL operation
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_hci_hal_deinit_transport()
+{
+  return ftm_bt_hci_pfal_deinit_transport();
+}
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_hal_init_transport
+
+DESCRIPTION
+  Platform independent wrapper API which intiatea a intialise of UART/SMD
+  resources with PFAL layer and returns the status of the PFAL operation
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_hci_hal_init_transport (int mode)
+{
+  return ftm_bt_hci_pfal_init_transport(mode);
+}
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_hal_nwrite
+
+DESCRIPTION
+  Platform independent wrapper API which intiates a write operation
+  with the PFAL layer and returns the status of the PFAL operation.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_hci_hal_nwrite(uint8 *buf, int size)
+{
+  return ftm_bt_hci_pfal_nwrite(buf,size);
+
+}
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_hal_nread
+
+DESCRIPTION
+  Platform independent wrapper API which intiates a read operation
+  with the PFAL layer and returns the status of the PFAL operation.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_hci_hal_nread(uint8 *buf, int size)
+{
+  return ftm_bt_hci_pfal_nread(buf,size);
+}
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_hal_changebaudrate
+
+DESCRIPTION
+  Platform independent wrapper API which intiatea a UART baud rate change
+  with the PFAL layer and returns the status of the PFAL request.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  TRUE if SUCCESS, else FAIL
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean ftm_bt_hci_hal_changebaudrate (uint32 new_baud)
+{
+  return ftm_bt_hci_pfal_changebaudrate(new_baud);
+}
+

feeds/ipq95xx/ftm/src/ftm_bt_hci_pfal.h

@@ -0,0 +1,177 @@
+/*==========================================================================
+
+                     FTM BT HCI PFAL Header File
+
+Description
+   PFAL API declarations of the ftm bt hci pfal component.
+
+# Copyright (c) 2010 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+06/18/10   rakeshk  Created a header file to hold the PFAL declarations for
+                    HCI UART programming
+===========================================================================*/
+#include "ftm_bt_common.h"
+
+#ifndef __FTM_BT_HCI_PFAL_H__
+#define __FTM_BT_HCI_PFAL_H__
+
+#define PIN_CON_CMD_OGF               0xFC
+#define PIN_CON_CMD_OCF               0x0C
+#define PIN_CON_CMD_SUB_OP            0x38
+#define PIN_CON_INTERFACE_ID          0x01
+#define PIN_CON_EVENT_LEN             0x06
+#define EXT_PIN_CON_LEN               0x02
+
+#define PIN_CON_CMD_OCF_BIT           0x01
+#define PIN_CON_CMD_OGF_BIT           0x02
+#define PIN_CON_CMD_SUBOP_BIT         0x04
+#define PIN_CON_CMD_INTER_BIT         0x05
+
+#define PIN_CON_EVT_OGF_BIT           0x05
+#define PIN_CON_EVT_OCF_BIT           0x04
+#define PIN_CON_EVT_SUB_OP_BIT        0x07
+#define PIN_CON_INTERFACE_ID_EVT_BIT  0x08
+#define PIN_CON_EVENT_LEN_BIT         0x02
+#define PIN_CON_EVT_STATUS_BIT        0x06
+
+#define LOG_TAG "ftmdaemon"
+
+#define PRI_INFO " I"
+#define PRI_WARN " W"
+#define PRI_ERROR " E"
+#define PRI_DEBUG " D"
+#define PRI_VERB " V"
+
+#define ALOG(pri, tag, fmt, arg...) fprintf(stderr, tag pri ": " fmt"\n", ##arg)
+#define ALOGV(fmt, arg...) ALOG(PRI_VERB, LOG_TAG, fmt, ##arg)
+#define ALOGD(fmt, arg...) ALOG(PRI_DEBUG, LOG_TAG, fmt, ##arg)
+#define ALOGI(fmt, arg...) ALOG(PRI_INFO, LOG_TAG, fmt, ##arg)
+#define ALOGW(fmt, arg...) ALOG(PRI_WARN, LOG_TAG, fmt, ##arg)
+#define ALOGE(fmt, arg...) ALOG(PRI_ERROR, LOG_TAG, fmt, ##arg)
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_pfal_set_transport
+
+DESCRIPTION
+ sets the type of transport based on the msm type
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+returns the type of transport
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean ftm_bt_hci_pfal_set_transport(void);
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_pfal_deinit_transport
+
+DESCRIPTION
+  Platform specific routine to de-intialise the UART/SMD resource.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_hci_pfal_deinit_transport();
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_pfal_init_transport
+
+DESCRIPTION
+  Platform specific routine to intialise the UART/SMD resources.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_hci_pfal_init_transport ();
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_pfal_nwrite
+
+DESCRIPTION
+  Platform specific routine to write the data in the argument to the UART/SMD
+  port intialised.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_hci_pfal_nwrite(uint8 *buf, int size);
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_pfal_nread
+
+DESCRIPTION
+  Platform specific routine to read data from the UART/SMD port intialised into
+  the buffer passed in argument.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_hci_pfal_nread(uint8 *buf, int size);
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_pfal_changebaudrate
+
+DESCRIPTION
+  Platform specific routine to intiate a change in baud rate
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  TRUE if SUCCESS, else FALSE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean ftm_bt_hci_pfal_changebaudrate (uint32 new_baud);
+
+#endif //__FTM_BT_HCI_PFAL_H__

feeds/ipq95xx/ftm/src/ftm_bt_hci_pfal_linux.c

@@ -0,0 +1,674 @@
+/*==========================================================================
+
+                     FTM Platform specfic HCI UART/SMD File
+
+Description
+  Platform specific routines to program the UART/SMD descriptors
+
+# Copyright (c) 2010-2011, 2013 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+06/07/11   bneti       Add support smd support for msm8960
+06/18/10   rakeshk  Created a source file to implement platform specific
+                    routines for UART
+07/07/10   rakeshk  Removed the conversion of 3.2 Mbps baud rate
+01/07/10   rakeshk  Added support for verbose logging of Cmd and events
+===========================================================================*/
+
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <stdlib.h>
+#include <sys/select.h>
+#include <termios.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <dlfcn.h>
+#include "bt_vendor_lib.h"
+#include "ftm_bt_hci_pfal.h"
+#include "ftm_common.h"
+#include <string.h>
+#include "log.h"
+#include <cutils/properties.h>
+#include "hidl_client.h"
+
+#ifdef ANDROID
+#define VENDOR_LIB "libbt-vendor.so"
+#else
+#define VENDOR_LIB "libbt-vendor.so.0"
+#endif
+
+uint8_t is_slim_bus_test = 0;
+#define UNUSED(x) (void)(x)
+
+/*identify the transport type*/
+static char *transport_dev;
+
+typedef enum {
+    BT_SOC_DEFAULT = 0,
+    BT_SOC_SMD = BT_SOC_DEFAULT,
+    BT_SOC_AR3K,
+    BT_SOC_ROME,
+    BT_SOC_CHEROKEE,
+    BT_SOC_NAPIER,
+    /* Add chipset type here */
+    BT_SOC_RESERVED
+} bt_soc_type;
+
+static void vendor_fwcfg_cb(bt_vendor_op_result_t result) {
+    UNUSED(result);
+}
+static void vendor_scocfg_cb(bt_vendor_op_result_t result) {
+    UNUSED(result);
+}
+static void vendor_lpm_vnd_cb(bt_vendor_op_result_t result) {
+    UNUSED(result);
+}
+static void vendor_audio_state_cb(bt_vendor_op_result_t result) {
+    UNUSED(result);
+}
+static void* vendor_alloc(int size) {
+    UNUSED(size);
+    return NULL;
+}
+static void vendor_dealloc(void *p_buf) {
+    UNUSED(p_buf);
+}
+static uint8_t vendor_xmit_cb(uint16_t opcode, void *p_buf, tINT_CMD_CBACK p_cback) {
+    UNUSED(opcode);
+    UNUSED(p_buf);
+    UNUSED(p_cback);
+    return 0;
+}
+static void vendor_epilog_cb(bt_vendor_op_result_t result) {
+    UNUSED(result);
+}
+static void vendor_a2dp_offload_cb(bt_vendor_op_result_t result, bt_vendor_opcode_t op, unsigned char handle) {
+    UNUSED(result);
+    UNUSED(op);
+    UNUSED(handle);
+}
+
+
+bt_vendor_interface_t *vendor_interface=NULL;
+static const bt_vendor_callbacks_t vendor_callbacks = {
+  sizeof(bt_vendor_callbacks_t),
+    vendor_fwcfg_cb,
+    vendor_scocfg_cb,
+    vendor_lpm_vnd_cb,
+    vendor_audio_state_cb,
+    vendor_alloc,
+    vendor_dealloc,
+    vendor_xmit_cb,
+    vendor_epilog_cb,
+    vendor_a2dp_offload_cb
+};
+
+
+/*BT HS UART TTY DEVICE */
+#define BT_HS_UART_DEVICE "/dev/ttyHS0"
+
+/*BT RIVA-SMD CHANNELS */
+#define APPS_RIVA_BT_ACL_CH  "/dev/smd2"
+#define APPS_RIVA_BT_CMD_CH  "/dev/smd3"
+
+/* Variables to identify the platform */
+char transport_type[PROPERTY_VALUE_MAX];
+static boolean is_transportSMD;
+
+extern int soc_type;
+
+/* Reader thread handle */
+pthread_t hci_cmd_thread_hdl;
+/* Pipe file descriptors for cancelling read operation */
+int pipefd[2];
+/* Transport file descriptor */
+int fd_transport;
+/* Starting baud rate to init the tty device */
+int starting_baud = 115200;
+/* Verbose output monitoring variable */
+int verbose = 1;
+/* Defintion to convert integer baud rate to the
+ * Data type understood by tty device
+ */
+#define BAUDCLAUS(i) case (i): return ( B##i )
+
+/*===========================================================================
+FUNCTION   convert_baud
+
+DESCRIPTION
+  Routine to convert the integer baud rate to type speed_t
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  Converted Baud rate, else default 0
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+static speed_t convert_baud(uint32 baud_rate)
+{
+  switch (baud_rate)
+  {
+    BAUDCLAUS(50);
+    BAUDCLAUS(75);
+    BAUDCLAUS(110);
+    BAUDCLAUS(134);
+    BAUDCLAUS(150);
+    BAUDCLAUS(200);
+    BAUDCLAUS(300);
+    BAUDCLAUS(600);
+    BAUDCLAUS(1200);
+    BAUDCLAUS(1800);
+    BAUDCLAUS(2400);
+    BAUDCLAUS(4800);
+    BAUDCLAUS(9600);
+    BAUDCLAUS(19200);
+    BAUDCLAUS(38400);
+    BAUDCLAUS(57600);
+    BAUDCLAUS(115200);
+    BAUDCLAUS(230400);
+    BAUDCLAUS(460800);
+    BAUDCLAUS(500000);
+    BAUDCLAUS(576000);
+    BAUDCLAUS(921600);
+    BAUDCLAUS(1000000);
+    BAUDCLAUS(1152000);
+    BAUDCLAUS(1500000);
+    BAUDCLAUS(2000000);
+    BAUDCLAUS(2500000);
+    BAUDCLAUS(3000000);
+    BAUDCLAUS(3500000);
+    BAUDCLAUS(4000000);
+
+    default: return 0;
+  }
+}
+
+/*===========================================================================
+FUNCTION   ftm_readerthread
+
+DESCRIPTION
+  Thread Routine to perfom asynchrounous handling of events coming on Uart/Smd
+  descriptor. It invokes a callback to the FTM BT layer to intiate a request
+  to read event bytes.
+
+DEPENDENCIES
+  The LifeTime of ReaderThraad is dependent on the status returned by the
+  call to ftm_bt_hci_qcomm_handle_event
+
+RETURN VALUE
+  RETURN NIL
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+void *ftm_readerthread(void *ptr)
+{
+  UNUSED(ptr);
+  boolean status = FALSE;
+  int retval;
+  fd_set readfds;
+  int buf;
+
+  do
+  {
+    FD_ZERO(&readfds);
+    FD_SET(fd_transport, &readfds);
+    FD_SET(pipefd[0],&readfds);
+    retval = select((pipefd[0] > fd_transport? pipefd[0] : fd_transport) + 1,
+                   &readfds, NULL, NULL, NULL);
+    if(retval == -1)
+    {
+      printf("select failed\n");
+      break;
+    }
+    if(FD_ISSET(pipefd[0],&readfds))
+    {
+#ifdef FTM_DEBUG
+       printf("Pipe descriptor set\n");
+#endif
+       read(pipefd[0],&buf,1);
+       if(buf == 1)
+         break;
+    }
+    if(FD_ISSET(fd_transport,&readfds))
+    {
+#ifdef FTM_DEBUG
+      printf("Read descriptor set\n");
+#endif
+      status = ftm_bt_hci_qcomm_handle_event();
+      if(TRUE != status)
+        break;
+    }
+  }
+  while(1);
+#ifdef FTM_DEBUG
+  printf("\nReader thread exited\n");
+#endif
+  return 0;
+}
+/*===========================================================================
+FUNCTION   ftm_bt_pfal_set_transport
+
+DESCRIPTION
+ sets the type of transport based on the msm type
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+returns the type of transport
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean ftm_bt_hci_pfal_set_transport(void)
+{
+    if (soc_type == BT_SOC_ROME || soc_type == BT_SOC_CHEROKEE || soc_type == BT_SOC_NAPIER) {
+        strlcpy(transport_type, "uart", sizeof(transport_type));
+        printf("[%s]: Transport type is: %s\n", __FUNCTION__, transport_type);
+        is_transportSMD = 0;
+        transport_dev = BT_HS_UART_DEVICE;
+    } else {
+        strlcpy(transport_type, "smd", sizeof(transport_type));
+        printf("[%s]: Transport type is: %s\n", __FUNCTION__, transport_type);
+        is_transportSMD = 1;
+        transport_dev = APPS_RIVA_BT_CMD_CH;
+    }
+    return is_transportSMD;
+}
+
+
+int init_transport_bdroid(boolean on) {
+
+    void *so_handle;
+    unsigned char bdaddr[] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06};
+    request_status st;
+    int  fd[CH_MAX], powerstate, ret;
+
+    if (on) {
+        so_handle = dlopen(VENDOR_LIB, RTLD_NOW);
+        if (!so_handle)
+        {
+           ALOGE("Failed to load vendor component %s", dlerror());
+           return -1;
+        }
+
+        vendor_interface = (bt_vendor_interface_t *) dlsym(so_handle, "BLUETOOTH_VENDOR_LIB_INTERFACE");
+        if (!vendor_interface)
+        {
+            ALOGE("Failed to accesst bt vendor interface");
+            return -1;
+        }
+
+        vendor_interface->init(&vendor_callbacks, bdaddr);
+
+        ALOGI("Turn On BT power");
+        powerstate = BT_VND_PWR_ON;
+        ret = vendor_interface->op(BT_VND_OP_POWER_CTRL, &powerstate);
+        if (ret < 0)
+        {
+            ALOGE("Failed to turn on power from  bt vendor interface");
+            return -1;
+        }
+        ret = vendor_interface->op(BT_VND_OP_USERIAL_OPEN, fd);
+        ALOGE("ret value: %d", ret);
+        /* This is just a hack; needs to be removed */
+        ret = 1;
+        ALOGE("setting ret value to 1 manually");
+        if (ret != 1)
+        {
+            ALOGE("Failed to get fd from  bt vendor interface");
+            return -1;
+        } else {
+            ALOGE("FD: %x", fd[0]);
+            return fd[0];
+        }
+    } else {
+        if (vendor_interface) {
+            ALOGE("Close and cleanup the interfaces");
+            int ret = vendor_interface->op(BT_VND_OP_USERIAL_CLOSE, NULL);
+
+            ALOGE("ret value: %d", ret);
+            vendor_interface->cleanup();
+            return 0;
+        } else {
+
+            ALOGE("Not able to find vendor interface handle");
+            return -1;
+        }
+    }
+}
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_pfal_deinit_transport
+
+DESCRIPTION
+  Platform specific routine to de-intialise the UART/SMD resource.
+
+PLATFORM SPECIFIC DESCRIPTION
+  Closes the TTY/SMD file descriptor and sets the descriptor value to -1
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  The Close of the descriptor will trigger a failure in the Reader Thread
+  and hence cause a Deinit of the ReaderThread
+
+===========================================================================*/
+request_status ftm_bt_hci_pfal_deinit_transport()
+{
+  int buf = 1;
+  write(pipefd[1],&buf,1);
+  if(!isLatestTarget())
+  {
+    close(fd_transport);
+    fd_transport = -1;
+  }
+  else
+  {
+    //Use libbt-vendor for chip de-initialization
+    init_transport_bdroid(FALSE);
+  }
+  return STATUS_SUCCESS;
+}
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_pfal_init_uart
+
+DESCRIPTION
+  Platform specific routine to intialise the UART/SMD resources.
+
+PLATFORM SPECIFIC DESCRIPTION
+  Opens the TTY/SMD device file descriptor, congiures the TTY/SMD device for CTS/RTS
+  flow control,sets 115200 for TTY as the default baudrate and starts the Reader
+  Thread
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_hci_pfal_init_transport(int mode)
+{
+  struct termios   term;
+  if(isLatestTarget())
+  {
+    printf("%s: ",__func__ );
+    //Use hidl_client_initialize for chip initialization
+    if (hidl_client_initialize(mode, &fd_transport) == false) {
+        printf("%s: HIDL client initialization failed \n", __func__);
+        return STATUS_NO_RESOURCES;
+    }
+    printf("%s: , fd:%d: ", __func__, fd_transport);
+  }
+  else
+  {
+    fd_transport = open(transport_dev, (O_RDWR | O_NOCTTY));
+
+    if (-1 == fd_transport)
+    {
+      return STATUS_NO_RESOURCES;
+    }
+
+    if (tcflush(fd_transport, TCIOFLUSH) < 0)
+    {
+      close(fd_transport);
+      return STATUS_FAIL;
+    }
+
+    if (tcgetattr(fd_transport, &term) < 0)
+    {
+      close(fd_transport);
+      return STATUS_FAIL;
+    }
+
+    cfmakeraw(&term);
+    /* Set RTS/CTS HW Flow Control*/
+    term.c_cflag |= (CRTSCTS | CLOCAL);
+
+    if (tcsetattr(fd_transport, TCSANOW, &term) < 0)
+    {
+      close(fd_transport);
+      return STATUS_FAIL;
+    }
+
+    /* Configure the /dev/ttyHS0 device to operate at 115200.
+     no need for msm8960 as it is using smd as transport
+     */
+    if (!is_transportSMD)
+       if (ftm_bt_hci_pfal_changebaudrate(starting_baud) == FALSE)
+       {
+          close(fd_transport);
+          return STATUS_FAIL;
+       }
+  }
+  if (pipe(pipefd) == -1)
+  {
+    printf("pipe create error");
+    return STATUS_FAIL;
+  }
+  if(mode != MODE_FM) {
+  /* Creating read thread which listens for various masks & pkt requests */
+  pthread_create( &hci_cmd_thread_hdl, NULL, ftm_readerthread, NULL);
+  }
+  return STATUS_SUCCESS;
+}
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_pfal_nwrite
+
+DESCRIPTION
+  Platform specific routine to write the data in the argument to the UART/SMD
+  port intialised.
+
+PLATFORM SPECIFIC DESCRIPTION
+  Write the buffer to the tty device and ensure it is completely written
+  In case of short write report error to the BT FTM layer.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_hci_pfal_nwrite(uint8 *buf, int size)
+{
+  int tx_bytes = 0, nwrite;
+  int i = 0, buf_size = size;
+  uint8 loop_back_cmd[6] = {0x1, 0x02, 0x18, 0x01, 0x01};
+  /*hci packet is not required to carry the Packet indicator (for UART interfaces) for msm8960
+     as it is using share memory interface */
+  int hci_uart_pkt_ind = 0;
+
+  if(fd_transport < 0)
+    return STATUS_NO_RESOURCES;
+  if ( buf[PIN_CON_CMD_OGF_BIT] == PIN_CON_CMD_OGF &&
+       buf[PIN_CON_CMD_OCF_BIT] == PIN_CON_CMD_OCF &&
+      (size > PIN_CON_CMD_SUBOP_BIT) &&
+       buf[PIN_CON_CMD_SUBOP_BIT] == PIN_CON_CMD_SUB_OP &&
+      (size > PIN_CON_CMD_INTER_BIT) &&
+       buf[PIN_CON_CMD_INTER_BIT] == PIN_CON_INTERFACE_ID)
+  {
+     is_slim_bus_test = 1;
+     printf("\nPinConnectivityTest: Sending loopback command to SOC before initiasing slimbus\n");
+     strlcpy(buf, loop_back_cmd, size);
+  }
+  do
+  {
+    nwrite = write(fd_transport, (buf + hci_uart_pkt_ind + tx_bytes), (size - hci_uart_pkt_ind - tx_bytes));
+
+    if (nwrite < 0)
+    {
+      printf("Error while writing ->\n");
+      return STATUS_SHORT_WRITE;
+    }
+    if (nwrite == 0)
+    {
+      printf("ftm_bt_hci_pfal_nwrite: zero-length write\n");
+      return STATUS_SHORT_WRITE;
+    }
+
+    tx_bytes += nwrite;
+    size     -= nwrite;
+  } while (tx_bytes < size - hci_uart_pkt_ind);
+
+  if (verbose == 1)
+  {
+    printf("[%s] %s: CMD:", get_current_time(), __FUNCTION__);
+    for (i = 0; i < buf_size; i++)
+    {
+      printf(" %02X", buf[i]);
+    }
+    printf("\n");
+  }
+
+  return STATUS_SUCCESS;
+}
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_pfal_nread
+
+DESCRIPTION
+  Platform specific routine to read data from the UART/SMD port intialised into
+  the buffer passed in argument.
+
+PLATFORM SPECIFIC DESCRIPTION
+  Read from the tty device into the buffer and ensure  the read request is
+  completed, in case of short read report error to the BT FTM layer.
+
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_hci_pfal_nread(uint8 *buf, int size)
+{
+  int rx_bytes = 0, nread;
+
+  if(fd_transport < 0)
+    return STATUS_NO_RESOURCES;
+
+  do
+  {
+    nread = read(fd_transport, (buf + rx_bytes), (size - rx_bytes));
+    if (nread < 0)
+    {
+      printf("Error while reading ->\n");
+      return STATUS_SHORT_READ;
+    }
+
+    rx_bytes += nread;
+
+  } while (rx_bytes < size);
+
+  return STATUS_SUCCESS;
+}
+
+/*===========================================================================
+FUNCTION   ftm_bt_hci_pfal_changebaudrate
+
+DESCRIPTION
+  Platform specific routine to intiate a change in baud rate
+
+PLATFORM SPECIFIC DESCRIPTION
+  Convert the Baud rate passed to the speed_t type and program the
+  Baud rate change after ensuring all transmit is drained at the
+  current baud rate
+
+DEPENDENCIES
+  It is expected that the Upper layer will intiate a Flow Off to the
+  BT SoC, to signal the stop of receive if the baud rate change is
+  initiated while SoC init is in progress
+
+RETURN VALUE
+  RETURN VALUE
+  TRUE if SUCCESS, else FALSE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean ftm_bt_hci_pfal_changebaudrate (uint32 new_baud)
+{
+  struct termios term;
+  boolean status = TRUE;
+  speed_t baud_code;
+  speed_t actual_baud_code;
+
+  if (tcgetattr(fd_transport, &term) < 0)
+  {
+    printf("Can't get port settings\n");
+    status = FALSE;
+  }
+  else
+  {
+    baud_code = convert_baud(new_baud);
+    (void) cfsetospeed(&term, baud_code);
+    if (tcsetattr(fd_transport, TCSADRAIN, &term) < 0) /* don't change speed until last write done */
+    {
+      printf("bt_hci_qcomm_pfal_changebaudrate: tcsetattr:\n");
+      status = FALSE;
+    }
+    /* make sure that we reportedly got the speed we tried to set */
+    if (1 < verbose)
+    {
+      if (tcgetattr(fd_transport, &term) < 0)
+      {
+        printf("bt_hci_qcomm_pfal_changebaudrate: tcgetattr:\n");
+        status = FALSE;
+      }
+      if (baud_code != (actual_baud_code = cfgetospeed(&term)))
+      {
+        printf("bt_hci_qcomm_pfal_changebaudrate: new baud %u FAILED, got 0x%x\n", new_baud, actual_baud_code);
+      }
+      else
+      {
+        printf("bt_hci_qcomm_pfal_changebaudrate: new baud %u SUCCESS, got 0x%x\n", new_baud, actual_baud_code);
+      }
+    }
+  }
+
+  return status;
+}

feeds/ipq95xx/ftm/src/ftm_bt_persist.cpp

@@ -0,0 +1,278 @@
+/*==========================================================================
+
+                     BT persist NV items access source file
+
+Description
+  Read/Write APIs for retreiving NV items from persist memory.
+
+# Copyright (c) 2011-12 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+05/25/12   jav    Added FTM log that will display bt address while testing.
+09/27/11   rrr     Moved persist related API for c/c++ compatibility, needed
+                   for random BD address to be persistent across target
+                   reboots.
+==========================================================================*/
+
+#include "ftm_bt_persist.h"
+#include <semaphore.h>
+
+#ifdef BT_NV_SUPPORT
+#include "bt_nv.h"
+
+/* Semaphore shared by the Event handler and main thread */
+extern sem_t semaphore_cmd_complete;
+/*Flag to manage the verbose output */
+extern int verbose;
+
+/*===========================================================================
+FUNCTION   ftm_bt_send_nv_read_cmd
+
+DESCRIPTION
+ Helper Routine to process the nv read command
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  FALSE = failure, else TRUE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean ftm_bt_send_nv_read_cmd
+(
+  uint8 * cmd_buf,   /* pointer to Cmd */
+  uint16 cmd_len     /* Cmd length */
+)
+{
+  nv_persist_item_type my_nv_item;
+  nv_persist_stat_enum_type cmd_result;
+  boolean result = TRUE;
+
+  if(cmd_len >1)
+  {
+    switch(*(cmd_buf+1))
+    {
+      case NV_BD_ADDR_I:
+        cmd_result = (nv_persist_stat_enum_type)bt_nv_cmd(NV_READ_F,  NV_BD_ADDR_I, &my_nv_item);
+        if (NV_SUCCESS != cmd_result)
+        {
+          if (verbose > 0)
+          {
+            fprintf (stderr, "nv_cmd_remote failed to get BD_ADDR from NV, code %d\n", cmd_result);
+          }
+          /* Send fail response */
+          result = FALSE;
+        }
+        else
+        {
+          /* copy bytes */
+          event_buf_nv_read_response[0] = FTM_BT_CMD_NV_READ;
+          event_buf_nv_read_response[1] = NV_BD_ADDR_I;
+          event_buf_nv_read_response[7] = my_nv_item.bd_addr[5];
+          event_buf_nv_read_response[6] = my_nv_item.bd_addr[4];
+          event_buf_nv_read_response[5] = my_nv_item.bd_addr[3];
+          event_buf_nv_read_response[4] = my_nv_item.bd_addr[2];
+          event_buf_nv_read_response[3] = my_nv_item.bd_addr[1];
+          event_buf_nv_read_response[2] = my_nv_item.bd_addr[0];
+          /* send BD_ADDR in the response */
+          fprintf (stderr, "nv_cmd_remote got NV_BD_ADDR_I from NV: %x:%x:%x:%x:%x:%x\n",
+                           (unsigned int) my_nv_item.bd_addr[5], (unsigned int) my_nv_item.bd_addr[4],
+                           (unsigned int) my_nv_item.bd_addr[3], (unsigned int) my_nv_item.bd_addr[2],
+                           (unsigned int) my_nv_item.bd_addr[1], (unsigned int) my_nv_item.bd_addr[0]);
+
+          ftm_log_send_msg((const uint8 *)event_buf_nv_read_response,nv_read_response_size);
+          result = TRUE;
+        }
+        break;
+
+      case NV_BT_SOC_REFCLOCK_TYPE_I:
+        cmd_result = (nv_persist_stat_enum_type)bt_nv_cmd(NV_READ_F,  NV_BT_SOC_REFCLOCK_TYPE_I, &my_nv_item);
+        if (NV_SUCCESS != cmd_result)
+        {
+          if (verbose > 0)
+          {
+            fprintf (stderr, "nv_cmd_remote failed to get BD_ADDR from NV, code %d\n", cmd_result);
+          }
+          /* Send fail response */
+          result = FALSE;
+        }
+        else
+        {
+          event_buf_nv_read_response[0] = FTM_BT_CMD_NV_READ;
+          event_buf_nv_read_response[1] = NV_BT_SOC_REFCLOCK_TYPE_I;
+          event_buf_nv_read_response[2] = (uint8) my_nv_item.bt_soc_refclock_type ;
+          event_buf_nv_read_response[7] = 0x0;
+          event_buf_nv_read_response[6] = 0x0;
+          event_buf_nv_read_response[5] = 0x0;
+          event_buf_nv_read_response[4] = 0x0;
+          event_buf_nv_read_response[3] = 0x0;
+          fprintf (stderr, "nv_cmd_remote got NV_BT_SOC_REFCLOCK_TYPE_I from NV: 0x%x\n",
+                           (unsigned int) my_nv_item.bt_soc_refclock_type);
+          ftm_log_send_msg((const uint8 *)event_buf_nv_read_response,nv_read_response_size);
+          result = TRUE;
+        }
+        break;
+
+      case NV_BT_SOC_CLK_SHARING_TYPE_I:
+        cmd_result = (nv_persist_stat_enum_type)bt_nv_cmd(NV_READ_F,  NV_BT_SOC_CLK_SHARING_TYPE_I, &my_nv_item);
+        if (NV_SUCCESS != cmd_result)
+        {
+          if (verbose > 0)
+          {
+            fprintf (stderr, "nv_cmd_remote failed to get CLK_SHARING from NV, code %d\n", cmd_result);
+          }
+          /* Send fail response */
+          result = FALSE;
+        }
+        else
+        {
+          event_buf_nv_read_response[0] = FTM_BT_CMD_NV_READ;
+          event_buf_nv_read_response[1] = NV_BT_SOC_CLK_SHARING_TYPE_I;
+          event_buf_nv_read_response[2] = (uint8) my_nv_item.bt_soc_clk_sharing_type ;
+          event_buf_nv_read_response[7] = 0x0;
+          event_buf_nv_read_response[6] = 0x0;
+          event_buf_nv_read_response[5] = 0x0;
+          event_buf_nv_read_response[4] = 0x0;
+          event_buf_nv_read_response[3] = 0x0;
+          fprintf (stderr, "nv_cmd_remote got NV_BT_SOC_CLK_SHARING_TYPE_I from NV: 0x%x\n",
+                        (unsigned int) my_nv_item.bt_soc_refclock_type);
+          ftm_log_send_msg((const uint8 *)event_buf_nv_read_response,nv_read_response_size);
+          result = TRUE;
+        }
+        break;
+    }
+    if(result == FALSE)
+      ftm_log_send_msg(event_buf_nv_read_response_fail,nv_read_response_size_fail);
+
+    sem_post(&semaphore_cmd_complete);
+    return result;
+  }
+  return TRUE;
+}
+/*===========================================================================
+FUNCTION   ftm_bt_send_nv_write_cmd
+
+DESCRIPTION
+ Helper Routine to process the nv write command
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  FALSE = failure, else TRUE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean ftm_bt_send_nv_write_cmd
+(
+  uint8 * cmd_buf,   /* pointer to Cmd */
+  uint16 cmd_len     /* Cmd length */
+)
+{
+  nv_persist_item_type my_nv_item;
+  nv_persist_stat_enum_type cmd_result;
+  boolean result = TRUE;
+  if(cmd_len >1)
+  {
+    switch(*(cmd_buf+1))
+    {
+      case NV_BD_ADDR_I:
+        memcpy(&my_nv_item.bd_addr, (cmd_buf+2), NV_BD_ADDR_SIZE);
+        cmd_result = (nv_persist_stat_enum_type)bt_nv_cmd(NV_WRITE_F,  NV_BD_ADDR_I, &my_nv_item);
+        if (NV_SUCCESS != cmd_result)
+        {
+          if (verbose > 0)
+          {
+            fprintf (stderr, "nv_cmd_remote failed to get BD_ADDR from NV, code %d\n", cmd_result);
+          }
+          /* Send fail response */
+          result = FALSE;
+        }
+        else
+        {
+          result = TRUE;
+        }
+        break;
+
+      case NV_BT_SOC_REFCLOCK_TYPE_I:
+        switch (*(cmd_buf+2))
+        {
+          case NV_PS_BT_SOC_REFCLOCK_32MHZ:
+          case NV_PS_BT_SOC_REFCLOCK_19P2MHZ:
+            my_nv_item.bt_soc_refclock_type = (nv_ps_bt_soc_refclock_enum_type)(*(cmd_buf+2)) ;
+            break;
+          default:
+          fprintf (stderr, "Invalid Ref Clock option\n");
+          result = FALSE;
+        }
+        if (result != FALSE)
+        {
+          cmd_result= (nv_persist_stat_enum_type)bt_nv_cmd(NV_WRITE_F,  NV_BT_SOC_REFCLOCK_TYPE_I, &my_nv_item);
+          if (NV_SUCCESS != cmd_result)
+          {
+            fprintf (stderr, "nv_cmd_remote failed to write SOC_REFCLOCK_TYPE to NV, code %d\n", cmd_result);
+            result = FALSE;
+          }
+          else
+          {
+            result = TRUE;
+          }
+          break;
+        }
+      case NV_BT_SOC_CLK_SHARING_TYPE_I:
+        switch (*(cmd_buf+2))
+        {
+          case NV_PS_BT_SOC_CLOCK_SHARING_ENABLED:
+          case NV_PS_BT_SOC_CLOCK_SHARING_DISABLED:
+            my_nv_item.bt_soc_clk_sharing_type = (nv_ps_bt_soc_clock_sharing_enum_type)(*(cmd_buf+2)) ;
+            break;
+          default:
+          fprintf (stderr, "Invalid Clock Sharing option\n");
+          result = FALSE;
+        }
+        if (result != FALSE)
+        {
+          cmd_result= (nv_persist_stat_enum_type)bt_nv_cmd(NV_WRITE_F, NV_BT_SOC_CLK_SHARING_TYPE_I, &my_nv_item);
+          if (NV_SUCCESS != cmd_result)
+          {
+            fprintf (stderr, "nv_cmd_remote failed to write SOC_CLK_SHARING_TYPE to NV, code %d\n", cmd_result);
+            result = FALSE;
+          }
+          else
+          {
+            result = TRUE;
+          }
+          break;
+        }
+    }
+    if(result == FALSE)
+    {
+      ftm_log_send_msg(event_buf_bt_nv_write_fail,nv_write_response_size);
+      sem_post(&semaphore_cmd_complete);
+    }
+    else
+    {
+      ftm_log_send_msg((const uint8 *)event_buf_bt_nv_write_pass,nv_write_response_size);
+      sem_post(&semaphore_cmd_complete);
+    }
+    return result;
+  }
+  return TRUE;
+}
+#endif /* End of BT_NV_SUPPORT */

feeds/ipq95xx/ftm/src/ftm_bt_persist.h

@@ -0,0 +1,113 @@
+#ifndef _FTM_BT_PERSIST_H_
+#define _FTM_BT_PERSIST_H_
+
+/*==========================================================================
+
+                     BT persist NV items access source file
+
+Description
+  Read/Write APIs for retreiving NV items from persist memory.
+
+# Copyright (c) 2011 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+09/27/11   rrr     Moved persist related API for c/c++ compatibility, needed
+                   for random BD address to be persistent across target
+                   reboots.
+==========================================================================*/
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include "ftm_bt_common.h"
+#include <string.h>
+
+
+#ifdef BT_NV_SUPPORT
+
+#define FTM_BT_CMD_NV_READ 0xB
+#define FTM_BT_CMD_NV_WRITE 0xC
+
+const uint8 nv_read_response_size = 8;
+const uint8 nv_read_response_size_fail = 2;
+const uint8 nv_write_response_size = 2;
+
+/* NV Write Responses */
+const uint8 event_buf_bt_nv_write_pass[2] = { FTM_BT_CMD_NV_WRITE, FTM_BT_DRV_NO_ERR};
+const uint8 event_buf_bt_nv_write_fail[2] = { FTM_BT_CMD_NV_WRITE, FTM_BT_NV_WRITE_FAIL};
+
+/* NV Read Responses */
+const uint8 event_buf_nv_read_response_fail[8] =
+{
+  FTM_BT_CMD_NV_READ, FTM_BT_NV_READ_FAIL, 0x0, 0x0,0x0,0x0,0x0,0x0
+};
+
+uint8 event_buf_nv_read_response[8];
+#endif /* BT_NV_SUPPORT */
+
+/*===========================================================================
+FUNCTION   ftm_bt_send_nv_read_cmd
+
+DESCRIPTION
+ Helper Routine to process the nv read command
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  FALSE = failure, else TRUE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean ftm_bt_send_nv_read_cmd
+(
+  uint8 * cmd_buf,   /* pointer to Cmd */
+  uint16 cmd_len     /* Cmd length */
+);
+
+/*===========================================================================
+FUNCTION   ftm_bt_send_nv_write_cmd
+
+DESCRIPTION
+ Helper Routine to process the nv write command
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  FALSE = failure, else TRUE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean ftm_bt_send_nv_write_cmd
+(
+  uint8 * cmd_buf,   /* pointer to Cmd */
+  uint16 cmd_len     /* Cmd length */
+);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _FTM_BT_PERSIST_H_ */
+

feeds/ipq95xx/ftm/src/ftm_bt_power_hal.h

@@ -0,0 +1,76 @@
+/*==========================================================================
+
+                     FTM BT POWER HAL Header File
+
+Description
+   Wrapper API definitions of the ftm bt power hal component.
+
+# Copyright (c) 2010 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+06/18/10   rakeshk  Created a header file to include the wrapper API
+                    definitions for BT power control
+07/07/10   rakeshk  Modified the function name of BT power set HAL routine
+===========================================================================*/
+#include "ftm_bt_common.h"
+#include "ftm_bt_power_pfal.h"
+
+
+#ifndef __FTM_BT_POWER_HAL_H__
+#define __FTM_BT_POWER_HAL_H__
+/*===========================================================================
+FUNCTION   ftm_bt_power_hal_set
+
+DESCRIPTION
+  Platform independent wrapper API which sets a BT power  from PFAL
+  layer and returns the status of the PFAL operation.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_power_hal_set(bt_power_state state)
+{
+  return ftm_bt_power_pfal_set(state);
+}
+/*===========================================================================
+FtUNCTION    ftm_bt_power_hal_check
+
+DESCRIPTION
+
+  Platform independent wrapper API which gets the BT power from PFAL
+  layer and returns the current state of the BT HW.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  Current BT power state
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+bt_power_state ftm_bt_power_hal_check()
+{
+  return ftm_bt_power_pfal_check();
+}
+
+#endif //__FTM_BT_POWER_HAL_H__

feeds/ipq95xx/ftm/src/ftm_bt_power_pfal.h

@@ -0,0 +1,71 @@
+/*==========================================================================
+
+                     FTM BT POWER PFAL Header File
+
+Description
+   PFAL API declarations of the ftm bt power pfal component.
+
+# Copyright (c) 2010 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+06/18/10   rakeshk  Created a header file to hold the PFAL declarations for
+                    BT power programming
+07/07/10   rakeshk  Modified the function name of BT power set PFAL routine
+===========================================================================*/
+#include "ftm_bt_common.h"
+
+#ifndef __FTM_BT_POWER_PFAL_H__
+#define __FTM_BT_POWER_PFAL_H__
+
+/*===========================================================================
+FUNCTION   ftm_bt_power_pfal_set
+
+DESCRIPTION
+  Platform dependent interface API which sets the BT power
+  and returns the status of the toggle operation.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_power_pfal_set(bt_power_state state);
+
+/*===========================================================================
+FUNCTION   ftm_bt_power_pfal_check
+
+DESCRIPTION
+
+  Platform dependent interface API which intiates a BT power read/check
+  and returns the current state of the BT HW.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  Current BT power state
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+bt_power_state ftm_bt_power_pfal_check();
+
+#endif
+

feeds/ipq95xx/ftm/src/ftm_bt_power_pfal_linux.c

@@ -0,0 +1,197 @@
+/*==========================================================================
+
+                     FTM Platform specfic BT power File
+
+Description
+  Platform specific routines to toggle/read the BT power state
+
+# Copyright (c) 2010-2011 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+06/18/10   rakeshk  Created a source file to implement platform specific
+                    routines for BT power.
+07/07/10   rakeshk  Added routine to find the sysfs entry for bluetooth in
+                    runtime
+07/07/10   rakeshk  Added call to init the rfkill state path in case of first
+                    read
+===========================================================================*/
+
+
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include "ftm_bt_power_pfal.h"
+#include <string.h>
+
+/* Bluetooth Rfkill Entry for Android */
+static char *rfkill_state_path = NULL;
+/*===========================================================================
+FUNCTION   init_rfkill_path
+
+DESCRIPTION
+  Opens the sysfs entry for different types of rfkill and finds the one
+  which matches Bluetooth by iterating through the rfkill entries
+  and checking for bluetooth
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  TRUE if SUCCESS, else FALSE
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+boolean init_rfkill_path()
+{
+  int fd;
+  int readsize;
+  int rfkillid;
+  char rfkill_path[64];
+  char buf[16];
+
+  for (rfkillid = 0; ; rfkillid++)
+  {
+    /* Open the different rfkill type entries and check if type macthes bluetooth */
+    snprintf(rfkill_path, sizeof(rfkill_path), "/sys/class/rfkill/rfkill%d/type", rfkillid);
+    fd = open(rfkill_path, O_RDONLY);
+    if (fd < 0)
+    {
+      printf("open(%s) failed: \n", rfkill_path);
+      return FALSE;
+    }
+    readsize = read(fd, &buf, sizeof(buf));
+    close(fd);
+
+    if (memcmp(buf, "bluetooth", 9) == 0)
+    {
+      break;
+    }
+  }
+
+  asprintf(&rfkill_state_path, "/sys/class/rfkill/rfkill%d/state", rfkillid);
+  return TRUE;
+}
+
+/*===========================================================================
+FUNCTION   ftm_bt_power_pfal_set
+
+DESCRIPTION
+  Platform dependent interface API which sets the BT power state
+  and returns the status of the toggle operation.
+
+PLATFORM SPECIFIC DESCRIPTION
+  Opens the rfkill entry for Bleutooth and initiates a write of the value
+  passed as argument.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  STATUS_SUCCESS if SUCCESS, else other reasons
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+request_status ftm_bt_power_pfal_set(bt_power_state state)
+{
+  int sz;
+  int fd = -1;
+  request_status ret = STATUS_FAIL;
+  const char buffer = state;
+  if(rfkill_state_path == NULL)
+  {
+    if(init_rfkill_path() != TRUE)
+      goto out;
+  }
+
+  fd = open(rfkill_state_path, O_WRONLY);
+  if (fd < 0)
+  {
+    ret = STATUS_NO_RESOURCES;
+    goto out;
+  }
+  sz = write(fd, &buffer, 1);
+  if (sz < 0)
+  {
+    goto out;
+  }
+  ret = STATUS_SUCCESS;
+
+out:
+  if (fd >= 0)
+    close(fd);
+  return ret;
+}
+
+/*===========================================================================
+FUNCTION   ftm_bt_power_pfal_check
+
+DESCRIPTION
+
+  Platform dependent interface API which intiates a BT power read/check
+  and returns the current state of the BT HW.
+
+PLATFORM SPECIFIC DESCRIPTION
+  Opens the rfkill entry for Bleutooth and initiates a read on the rfkill
+  descriptor.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN VALUE
+  Current BT power state
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+bt_power_state ftm_bt_power_pfal_check()
+{
+  int sz;
+  bt_power_state state= BT_OFF;
+  int fd = -1;
+  char buffer = '0';
+
+  if(rfkill_state_path == NULL)
+  {
+    if(init_rfkill_path() != TRUE)
+      goto out;
+  }
+  fd = open(rfkill_state_path, O_RDONLY);
+  if (fd < 0)
+  {
+    goto out;
+  }
+  sz = read(fd, &buffer, 1);
+  if (sz < 0)
+  {
+    goto out;
+  }
+
+out:
+  if (fd >= 0)
+    close(fd);
+  state = (bt_power_state)buffer;
+  return state;
+}
+

feeds/ipq95xx/ftm/src/ftm_common.h

@@ -0,0 +1,141 @@
+/*==========================================================================
+
+                     FTM BT HCI PFAL Header File
+
+Description
+   Queue insert/delete routines and data structures
+
+# Copyright (c) 2010-2011, 2014 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+06/18/10   rakeshk  Created
+11/09/10   rakeshk  Added two APIs to perform read/write of BT Top level
+                    I2C registers
+===========================================================================*/
+
+#if defined(CONFIG_FTM_BT) || defined(CONFIG_FTM_FM)
+#include <ftm_bt_common.h>
+#include "ftm_bt.h"
+#include <semaphore.h>
+#include <pthread.h>
+/* Semaphore shared by the Event handler and main thread */
+extern sem_t semaphore_cmd_complete;
+/* Structure used by the FTM BT/FM component to
+ * queue the FTM packet contents
+ */
+
+pthread_mutex_t fm_event_lock;
+pthread_cond_t fm_event_cond;
+extern int fm_passthrough;
+
+typedef struct cmdQ
+{
+  int command_id;/*Command id */
+  void *data; /* Command data */
+  boolean bt_command; /* whether BT or FM command */
+  int cmd_len; /* Command length */
+  struct cmdQ *next; /* pointer to next CmdQ item */
+}cmdQ;
+
+/* Callback declaration for BT FTM packet processing */
+void *bt_ftm_diag_dispatch(void *req_pkt, uint16 pkt_len);
+
+/*===========================================================================
+FUNCTION   qinsert_cmd
+
+DESCRIPTION
+  Command Queue insert routine. Add the FTM BT packet to the Queue
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURNS FALSE without adding queue entry in failure
+  to allocate a new Queue item
+  else returns TRUE
+
+SIDE EFFECTS
+  increments the number of commands queued
+
+===========================================================================*/
+boolean qinsert_cmd(ftm_bt_pkt_type *ftm_bt_pkt);
+/*===========================================================================
+FUNCTION   dequeue_send
+
+DESCRIPTION
+  Command Queue delete and calls HCI send routine. Dequeues the HCI data from
+  the queue and sends it to HCI HAL layer.
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  RETURN NIL
+
+SIDE EFFECTS
+  decrements the number of command queued
+
+===========================================================================*/
+void dequeue_send();
+
+/*===========================================================================
+FUNCTION  i2c_write
+
+DESCRIPTION
+  Helper function to construct the I@C request to be sent to the FM I2C
+  driver
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  -1 in failure,positive or zero in success
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+int i2c_write
+(
+int fd,
+unsigned char offset,
+const unsigned char* buf,
+unsigned char len,
+unsigned int slave_addr
+);
+
+/*===========================================================================
+FUNCTION  i2c_read
+
+DESCRIPTION
+  Helper function to construct the I2C request to read data from the FM I2C
+  driver
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  -1 in failure,positive or zero in success
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+int i2c_read
+(
+int fd,
+unsigned char offset,
+const unsigned char* buf,
+unsigned char len,
+unsigned int slave_addr
+);
+#endif

feeds/ipq95xx/ftm/src/ftm_dbg.h

@@ -0,0 +1,43 @@
+/*==========================================================================
+
+                     FTM WLAN Source File
+
+# Copyright (c) 2013-2014 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+#ifndef _FTM_DBG_H_
+#define _FTM_DBG_H_
+#include <stdint.h>
+
+#define FTM_DBG_ERROR   0x00000001
+#define FTM_DBG_INFO    0x00000002
+#define FTM_DBG_TRACE   0x00000004
+
+#define FTM_DBG_DEFAULT (FTM_DBG_ERROR)
+
+extern unsigned int g_dbg_level;
+
+struct ftm_config
+{
+    int total_num_slots;
+    uint32_t slot_id[4];
+    uint32_t slot_size[4];
+};
+extern struct ftm_config ftm_cfg;
+
+#ifdef DEBUG
+void current_time();
+#define DPRINTF(_level, _x...)\
+    do {\
+        if (g_dbg_level & (_level))\
+        {\
+            fprintf(stderr, _x);\
+        }\
+    } while (0);
+
+#else
+#define DPRINTF(_level, x...)  do { } while (0);
+#endif
+
+#endif /* _FTM_DBG_H_ */

feeds/ipq95xx/ftm/src/ftm_fm_common.h

@@ -0,0 +1,993 @@
+/*==========================================================================
+
+                     FTM FM Common Header File
+
+Description
+  Global Data declarations of the ftm fm component.
+
+# Copyright (c) 2010-2012, 2014 by Qualcomm Technologies, Inc.  All Rights Reserved.
+# Qualcomm Technologies Proprietary and Confidential.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+08/03/2011 uppalas  Adding support for new ftm commands
+06/18/10   rakeshk  Created a header file to hold the definitons for ftm fm
+                    task
+07/06/10   rakeshk  Clean roomed the data structures and defined data
+                    structures to be passed to the PFAL layers
+01/11/11   rakeshk  Added support for new FTM APIS
+02/09/11   rakeshk  Added support for BLER FTM APIs
+04/03/11   ananthk  Added support for FM FTM Transmit APIs
+===========================================================================*/
+#ifdef CONFIG_FTM_FM
+
+#include "diagpkt.h"
+#include "log.h"
+#include <sys/types.h>
+
+#define FTM_FM_LOG_PKT_ID 65
+#define FTM_FM_CMD_CODE 28
+#define LOG_FTM_FM_C  ((uint16) 0x14CC)
+#define FEATURE_FTM_FM_DEBUG
+#define DEFAULT_DATA_SIZE 249
+
+/* FM6500 A0 chip version.
+ **/
+#define FM6500_A0_VERSION                     (0x01010013)
+/**
+ *  * FM6500 2.0 chip version.
+ **/
+#define FMQSOCCOM_FM6500_20_VERSION           (0x01010010)
+/**
+ *  * FM6500 2.1 chip version.
+ **/
+#define FMQSOCCOM_FM6500_21_VERSION           (0x02010204)
+/**
+ *  WCN 2243 1.0's FM chip version.
+ */
+#define FMQSOCCOM_FM6500_WCN2243_10_VERSION   (0x0302010A)
+/**
+ *  WCN 2243 2.0's FM chip version.
+ */
+#define FMQSOCCOM_FM6500_WCN2243_20_VERSION   (0x04020205)
+
+extern int chipVersion;
+
+/* RDS Group processing parameters */
+#define FM_RX_RDS_GRP_RT_EBL         1
+#define FM_RX_RDS_GRP_PS_EBL         2
+#define FM_RX_RDS_GRP_AF_EBL         4
+#ifdef FM_SOC_TYPE_CHEROKEE
+#define FM_RX_RDS_GRP_PS_SIMPLE_EBL  8
+#define FM_RX_RDS_GRP_ECC_EBL        32
+#define FM_RX_RDS_GRP_PTYN_EBL       64
+#define FM_RX_RDS_GRP_RT_PLUS_EBL    128
+#else
+#define FM_RX_RDS_GRP_PS_SIMPLE_EBL  16
+#endif
+
+
+/* lower and upper band limits of regions */
+#define REGION_US_EU_BAND_LOW              87500
+#define REGION_US_EU_BAND_HIGH             107900
+#define REGION_JAPAN_STANDARD_BAND_LOW     76000
+#define REGION_JAPAN_STANDARD_BAND_HIGH    90000
+#define REGION_JAPAN_WIDE_BAND_LOW         90000
+#define REGION_JAPAN_WIDE_BAND_HIGH        108000
+#define V4L2_CID_PRIVATE_BASE 0x08000000
+#define MAX_RDS_PS_LENGTH 108
+#define MAX_RDS_RT_LENGTH  64
+#define V4L2_CID_PRIVATE_IRIS_RDS_GRP_COUNTERS_EXT    0x08000042
+
+typedef enum  {
+V4L2_CID_PRIVATE_IRIS_HLSI = (V4L2_CID_PRIVATE_BASE + 0x1d),
+V4L2_CID_PRIVATE_IRIS_SOFT_MUTE,
+V4L2_CID_PRIVATE_IRIS_RIVA_ACCS_ADDR,
+V4L2_CID_PRIVATE_IRIS_RIVA_ACCS_LEN,
+V4L2_CID_PRIVATE_IRIS_RIVA_PEEK,
+V4L2_CID_PRIVATE_IRIS_RIVA_POKE,
+V4L2_CID_PRIVATE_IRIS_SSBI_ACCS_ADDR,
+V4L2_CID_PRIVATE_IRIS_SSBI_PEEK,
+V4L2_CID_PRIVATE_IRIS_SSBI_POKE,
+V4L2_CID_PRIVATE_IRIS_TX_TONE,
+V4L2_CID_PRIVATE_IRIS_RDS_GRP_COUNTERS,
+V4L2_CID_PRIVATE_IRIS_SET_NOTCH_FILTER,
+V4L2_CID_PRIVATE_IRIS_AGC_CTRL = 0x08000043,
+V4L2_CID_PRIVATE_IRIS_AGC_STATE,
+V4L2_CID_PRIVATE_IRIS_READ_DEFAULT = 0x00980928,//using private CIDs under userclass
+V4L2_CID_PRIVATE_IRIS_WRITE_DEFAULT,
+}v4l2_cid_private_iris_t_copy;
+typedef enum
+{
+  /* Total no. of PS names that can be transmitted       : 12
+     Width of each transmitted PS name is                : 8
+     Total no. of PS characters  that can be transmitted : (12*8 = 96)
+  */
+  MAX_TX_PS_LEN         = 96,
+  MAX_TX_PS_RPT_CNT     = 15,
+}FmTxPSFeatures;
+
+/* FTM FM command IDs */
+typedef enum
+{
+#ifdef FEATURE_FTM_FM_DEBUG
+  FTM_FM_RX_SET_POWER_MODE         = 13,
+  FTM_FM_RX_SET_SIGNAL_THRESHOLD   = 14,
+  FTM_FM_RX_GET_RSSI_LIMIT         = 16,
+  FTM_FM_RX_GET_PS_INFO            = 17,
+  FTM_FM_RX_GET_RT_INFO            = 18,
+  FTM_FM_RX_GET_AF_INFO            = 19,
+  FTM_FM_RX_SEARCH_STATIONS        = 20,
+  FTM_FM_RX_SEARCH_RDS_STATIONS    = 21,
+  FTM_FM_RX_SEARCH_STATIONS_LIST   = 22,
+  FTM_FM_RX_CANCEL_SEARCH          = 23,
+  FTM_FM_RX_RDS_GROUP_PROC_OPTIONS = 25,
+  FTM_FM_RX_RDS_PI_MATCH_OPTIONS   = 26,
+  FTM_FM_TX_GET_PS_FEATURES        = 36,
+  FTM_FM_TX_TX_PS_INFO             = 38,
+  FTM_FM_TX_STOP_PS_INFO_TX        = 39,
+  FTM_FM_TX_TX_RT_INFO             = 40,
+  FTM_FM_TX_STOP_RT_INFO_TX        = 41,
+  FTM_FM_RX_GET_SIGNAL_THRESHOLD   = 46,
+  FTM_FM_FMWAN_REG_RD              = 51,
+  FTM_FM_RX_GET_DEFAULTS           = 62,
+  FTM_FM_RX_SET_DEFAULTS           = 63,
+  FTM_FM_RX_GET_SINR_SAMPLES       = 64,
+  FTM_FM_RX_SET_SINR_SAMPLES       = 65,
+  FTM_FM_RX_GET_SINR_THRESHOLD     = 66,
+  FTM_FM_RX_SET_SINR_THRESHOLD     = 67,
+  FTM_FM_RX_GET_ONCHANNEL_TH       = 68,
+  FTM_FM_RX_SET_ONCHANNEL_TH       = 69,
+  FTM_FM_RX_GET_OFFCHANNEL_TH      = 70,
+  FTM_FM_RX_SET_OFFCHANNEL_TH      = 71,
+  FTM_FM_TX_PWR_LVL_CFG            = 72,
+#endif /* FEATURE_FTM_FM_DEBUG */
+
+  FTM_FM_RX_ENABLE_RECEIVER        = 7,
+  FTM_FM_RX_DISABLE_RECEIVER       = 8,
+  FTM_FM_RX_CONFIGURE_RECEIVER     = 9,
+  FTM_FM_RX_SET_MUTE_MODE          = 10,
+  FTM_FM_RX_SET_STEREO_MODE        = 11,
+  FTM_FM_RX_SET_STATION            = 12,
+  FTM_FM_RX_GET_STATION_PARAMETERS = 15,
+  FTM_FM_RX_RDS_GROUP_OPTIONS      = 24,
+  FTM_FM_TX_ENABLE_TRANSMITTER     = 33,
+  FTM_FM_TX_DISABLE_TRANSMITTER    = 34,
+  FTM_FM_TX_CONFIGURE_TRANSMITTER  = 35,
+  FTM_FM_TX_SET_STATION            = 37,
+  FTM_FM_TX_TX_RDS_GROUPS          = 42,
+  FTM_FM_TX_TX_CONT_RDS_GROUPS     = 43,
+  FTM_FM_TX_TX_RDS_CTRL            = 44,
+  FTM_FM_TX_GET_RDS_GROUP_BUF_SIZE = 45,
+  FTM_FM_BUS_WRITE                 = 47,
+  FTM_FM_BUS_READ                  = 48,
+  FTM_FM_NOTIFY_WAN                = 49,
+  FTM_FM_NOTIFY_FM                 = 50,
+  FTM_FM_ROUTE_AUDIO               = 52,
+  FTM_FM_RX_SET_AF_THRESHOLD       = 53,
+  FTM_FM_RX_SET_RSSI_CHECK_TIMER   = 54,
+  FTM_FM_RX_SET_RDS_PI_TIMER       = 55,
+  FTM_FM_RX_GET_AF_THRESHOLD       = 56,
+  FTM_FM_RX_GET_RSSI_CHECK_TIMER   = 57,
+  FTM_FM_RX_GET_RDS_PI_TIMER       = 58,
+  FTM_FM_RX_GET_RDS_ERR_COUNT      = 59,
+  FTM_FM_RX_RESET_RDS_ERR_COUNT    = 60,
+  FTM_FM_TX_SEARCH_STATIONS        = 61,
+  FTM_FM_SET_HLSI                  = 100,
+  FTM_FM_SET_SOFT_MUTE             = 101,
+  FTM_FM_SET_ANTENNA               = 102,
+  FTM_FM_SET_NOTCH_FILTER          = 103,
+  FTM_FM_READ_RDS_GRP_CNTRS        = 104,
+  FTM_FM_SET_TONE_GENERATION       = 105,
+  FTM_FM_PEEK_SSBI                 = 106,
+  FTM_FM_POKE_SSBI                 = 107,
+  FTM_FM_PEEK_RIVA_WORD            = 108,
+  FTM_FM_POKE_RIVA_WORD            = 109,
+  FTM_FM_ENABLE_AUDIO              = 111,
+  FTM_FM_DISABLE_AUDIO             = 112,
+  FTM_FM_VOLUME_SETTING            = 113,
+  FTM_FM_READ_RDS_GRP_CNTRS_EXT    = 114,
+  FTM_FM_SET_GET_RESET_AGC         = 115,
+  FTM_FM_MAX
+} ftm_fm_sub_cmd_type;
+
+#define XFR_CTRL_OFFSET 0x1F
+/* Wait time for ensuring XFR is generated */
+#define WAIT_ON_ISR_DELAY 15000 //15 ms
+#define AFTH_OFFSET 0x2E
+#define CHCOND_OFFSET 0x22
+#define RDSTIMEOUT_OFFSET 0x25
+#define FM_SLAVE_ADDR 0x2A
+#define RDSERR_OFFSET 0x24
+#define RDSRESET_OFFSET 0x20
+#define BLOCKS_PER_GROUP 0x04
+#define FTM_FM_RDS_COUNT 0x11
+
+
+#define MAX_RIVA_DATA_LEN  245
+#define MAX_RIVA_PEEK_RSP_SIZE 251
+#define SSBI_PEEK_DATA_SIZE 1
+
+#define IRIS_BUF_PEEK  6
+#define IRIS_BUF_SSBI_PEEK IRIS_BUF_PEEK+1
+#define IRIS_BUF_RDS_CNTRS  IRIS_BUF_SSBI_PEEK+1
+#define IRIS_BUF_RD_DEFAULT IRIS_BUF_RDS_CNTRS+1
+#ifdef FM_SOC_TYPE_CHEROKEE
+#define RDS_GRP_CNTRS_SIZE 48
+#else
+#define RDS_GRP_CNTRS_SIZE 36
+#endif
+/* Generic result, used for any command that only returns an error code */
+typedef enum
+{
+  FTM_FM_SUCCESS,
+  FTM_FAIL,
+  FTM_FILE_DOES_NOT_EXIST,
+  FTM_MMC_ERROR,
+  FTM_FM_UNRECOGNIZED_CMD,
+  FTM_NO_RESOURCES,
+  FTM_FM_PENDING,
+  FTM_INVALID_PARAM,
+  FTM_FM_DISALLOWED,
+  FTM_TEST_NOT_IMPLEMENTED,
+  FTM_CUST_HW_ID_UNKNOWN,
+  FTM_FM_BUS_WRITE_ERROR,
+  FTM_FM_BUS_READ_ERROR,
+  FTM_FM_CLIENT_MAX,
+
+} ftm_fm_api_result_type;
+
+/* FM power state enum */
+typedef enum
+{
+  FM_POWER_OFF,
+  FM_POWER_TRANSITION,
+  FM_RX_ON,
+  FM_TX_ON
+}fm_power_state;
+
+/* FM command status enum */
+typedef enum
+{
+  FM_CMD_SUCCESS,
+  FM_CMD_PENDING,
+  FM_CMD_NO_RESOURCES,
+  FM_CMD_INVALID_PARAM,
+  FM_CMD_DISALLOWED,
+  FM_CMD_UNRECOGNIZED_CMD,
+  FM_CMD_FAILURE
+}fm_cmd_status_type;
+
+/**
+*  FM event result.
+*/
+typedef enum
+{
+   FM_EV_SUCCESS  = 0,
+   /**<  Event indicates success. */
+
+   FM_EV_FAILURE  = 1,
+   /**<  Event is a response to a command that failed */
+
+   FM_EV_CMD_DISALLOWED = 2,
+   /**<  Event is a response to a command that was disallowed. */
+
+   FM_EV_CMD_INVALID_PARAM = 3
+   /**<  Event is a response to a command that contained an invalid parameter. */
+
+} FmEvResultType;
+
+/**
+*  FM Receiver event names.
+*/
+typedef enum
+{
+   /* -----------------------------------------------
+         1 -> FM Receiver initialization events
+      ----------------------------------------------- */
+
+   FM_RX_EV_ENABLE_RECEIVER = 0,
+
+   FM_RX_EV_DISABLE_RECEIVER,
+
+   FM_RX_EV_CFG_RECEIVER,
+
+   /* -----------------------------------------------
+         2 ->       FM receiver control events
+      ----------------------------------------------- */
+
+   FM_RX_EV_MUTE_MODE_SET,
+
+   FM_RX_EV_STEREO_MODE_SET,
+
+   FM_RX_EV_RADIO_STATION_SET,
+
+   FM_RX_EV_PWR_MODE_SET,
+
+   FM_RX_EV_SET_SIGNAL_THRESHOLD,
+
+   /* -----------------------------------------------
+         3 ->       FM receiver status events
+      ----------------------------------------------- */
+
+   FM_RX_EV_RADIO_TUNE_STATUS,
+
+   FM_RX_EV_STATION_PARAMETERS,
+
+   FM_RX_EV_RDS_LOCK_STATUS,
+
+   FM_RX_EV_STEREO_STATUS,
+
+   FM_RX_EV_SERVICE_AVAILABLE,
+
+   FM_RX_EV_GET_SIGNAL_THRESHOLD,
+
+   /* -----------------------------------------------
+         4 ->       FM search status events
+      ----------------------------------------------- */
+
+   FM_RX_EV_SEARCH_IN_PROGRESS,
+
+   FM_RX_EV_SEARCH_RDS_IN_PROGRESS,
+
+   FM_RX_EV_SEARCH_LIST_IN_PROGRESS,
+
+   FM_RX_EV_SEARCH_COMPLETE,
+
+   FM_RX_EV_SEARCH_RDS_COMPLETE,
+
+   FM_RX_EV_SEARCH_LIST_COMPLETE,
+
+   FM_RX_EV_SEARCH_CANCELLED,
+
+   /* -----------------------------------------------
+         5 ->       FM RDS status events
+      ----------------------------------------------- */
+
+   FM_RX_EV_RDS_GROUP_DATA,
+
+   FM_RX_EV_RDS_PS_INFO,
+
+   FM_RX_EV_RDS_RT_INFO,
+
+   FM_RX_EV_RDS_AF_INFO,
+
+   FM_RX_EV_RDS_PI_MATCH_AVAILABLE,
+
+   /* -----------------------------------------------
+         6 ->   FM RDS control events
+      ----------------------------------------------- */
+
+   FM_RX_EV_RDS_GROUP_OPTIONS_SET,
+
+   FM_RX_EV_RDS_PROC_REG_DONE,
+
+   FM_RX_EV_RDS_PI_MATCH_REG_DONE,
+
+   FM_RX_EV_MAX_EVENT
+
+} FmRxEventType;
+
+typedef enum radio_band_type
+{
+  FM_US_EU = 0x0,
+  FM_JAPAN_STANDARD = 0x1,
+  FM_JAPAN_WIDE = 0x2,
+  FM_USER_DEFINED = 0x4
+}radio_band_type;
+
+typedef enum emphasis_type
+{
+  FM_RX_EMP75 = 0x0,
+  FM_RX_EMP50 = 0x1
+}emphasis_type;
+
+typedef enum channel_space_type
+{
+  FM_RX_SPACE_200KHZ = 0x0,
+  FM_RX_SPACE_100KHZ = 0x1,
+  FM_RX_SPACE_50KHZ = 0x2
+}channel_space_type;
+
+typedef enum rds_system_type
+{
+ FM_RX_RDBS_SYSTEM = 0x0,
+ FM_RX_RDS_SYSTEM = 0x1,
+ FM_RX_NO_RDS_SYSTEM = 0x2
+}rds_sytem_type;
+
+typedef struct band_limit_freq
+{
+  uint32 lower_limit;
+  uint32 upper_limit;
+}band_limit_freq;
+
+
+typedef enum rds_sync_type
+{
+ FM_RDS_NOT_SYNCED = 0x0,
+ FM_RDS_SYNCED = 0x1
+}rds_sync_type;
+
+typedef enum stereo_type
+{
+ FM_RX_MONO = 0x0,
+ FM_RX_STEREO = 0x1
+}stereo_type;
+
+typedef enum fm_service_available
+{
+  FM_SERVICE_NOT_AVAILABLE = 0x0,
+  FM_SERVICE_AVAILABLE = 0x1
+}fm_service_available;
+
+typedef enum mute_type
+{
+  FM_RX_NO_MUTE = 0x00,
+  FM_RX_MUTE_RIGHT = 0x01,
+  FM_RX_MUTE_LEFT = 0x02,
+  FM_RX_MUTE_BOTH = 0x03
+}mute_type;
+
+typedef enum antenna_type
+{
+  WIRED_HS,
+  PWB_ANT
+}antenna_type;
+
+typedef enum audio_output
+{
+  HEADSET,
+  SPEAKER,
+} audio_output;
+/**
+*  RDS/RBDS Program Type type.
+*/
+typedef uint8  fm_prgm_type;
+
+/**
+*   RDS/RBDS Program Identification type.
+*/
+typedef uint16 fm_prgmid_type;
+/**
+*  RDS/RBDS Program Services type.
+*/
+typedef char fm_prm_services;
+/**
+*  RDS/RBDS Radio Text type.
+*/
+/*
+* FM RX RIVA peek request
+*/
+typedef  struct fm_riva_peek_word
+{
+  uint8   subOpcode;
+  uint32 startaddress;
+  uint8 payload_length;/*In Bytes*/
+  uint8 data[MAX_RIVA_DATA_LEN];
+}__attribute__((packed))fm_riva_peek_word;
+
+/*
+* FM RX RIVA poke request
+*/
+typedef struct fm_riva_poke_word
+{
+ uint8   subOpcode;
+ uint32 startaddress;
+ uint8 payload_length;/*In Bytes*/
+ uint8 data[MAX_RIVA_DATA_LEN];
+}__attribute__((packed))fm_riva_poke_word ;
+
+
+/*
+* FM RX SSBI peek/poke request
+*/
+typedef struct fm_ssbi_poke_reg
+{
+  uint16 startaddress;
+  uint8 data;
+}__attribute__((packed))fm_ssbi_poke_reg;
+
+/*
+* fm Set Get Reset AGC request
+*/
+typedef struct fm_set_get_reset_agc_req
+{
+  uint8 ucCtrl;
+  uint8 ucGainState;
+}__attribute__((packed))fm_set_get_reset_agc_req;
+
+typedef struct fm_set_get_reset_agc_params
+{
+  uint8 ucCurrentGainState;
+  uint8 ucGainStateChange1;
+  uint8 ucGainStateChange2;
+  uint8 ucGainStateChange3;
+}__attribute__((packed))fm_set_get_reset_agc_params;
+
+typedef PACKED struct
+{
+  uint8  status ;
+  uint8  data_length ;
+  uint8  data[DEFAULT_DATA_SIZE];
+}__attribute__((packed)) readDefaults_data;
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  uint8  status ;
+  uint8  data_length ;
+  uint8  data[DEFAULT_DATA_SIZE];
+}__attribute__((packed)) default_read_rsp;
+
+/*RDS Group counters*/
+typedef  struct fm_rds_grp_cntrsparams
+{
+  uint32 totalRdsSBlockErrors;
+  uint32 totalRdsGroups;
+  uint32 totalRdsGroup0;
+  uint32 totalRdsGroup2;
+  uint32 totalRdsBlockB;
+  uint32 totalRdsProcessedGroup0;
+  uint32 totalRdsProcessedGroup2;
+  uint32 totalRdsGroupFiltered;
+  uint32 totalRdsChangeFiltered;
+}__attribute__((packed)) fm_rds_grp_cntrsparams;
+
+/*RDS Group counters extended */
+typedef  struct fm_rds_grpcntrs_extendedparams
+{
+  uint32 totalRdsSyncLoss;
+  uint32 totalRdsNotSync;
+  uint32 totalRdsSyncInt;
+}__attribute__((packed)) fm_rds_grpcntrs_extendedparams;
+
+typedef char fm_radiotext_info;
+/**
+*  FM Global Paramaters struct.
+*/
+typedef struct
+{
+  uint32  current_station_freq;/*a frequency in kHz the band range*/
+  uint8 service_available;
+  uint8 rssi; /* rssi range from 0-100*/
+  uint8 stype;
+  uint8 rds_sync_status;
+  uint8 mute_status;
+  uint8 ssbi_peek_data;
+  fm_prgmid_type pgm_id; /* Program Id */
+  fm_prgm_type pgm_type; /* Program type */
+  fm_prm_services  pgm_services[MAX_RDS_PS_LENGTH];
+  fm_radiotext_info  radio_text[MAX_RDS_RT_LENGTH];/* RT maximum is 64 bytes */
+  fm_riva_poke_word  riva_data_access_params;
+  fm_set_get_reset_agc_params set_get_reset_agc_params;
+  fm_rds_grp_cntrsparams rds_group_counters;
+  fm_rds_grpcntrs_extendedparams rds_group_counters_extended;
+  readDefaults_data  default_read_data;
+  uint8 fm_ps_length;
+  uint8 fm_rt_length;
+  uint8 sinr_samples;
+  char sinr_threshold;
+  uint8 On_channel_threshold;
+  uint8 Off_channel_threshold;
+}fm_station_params_available;
+/**
+*  FM Config Request structure.
+*/
+typedef struct fm_config_data
+{
+  uint8 band;
+  uint8 emphasis;
+  uint8 spacing;
+  uint8 rds_system;
+  band_limit_freq bandlimits;
+  uint8 is_fm_tx_on;
+}fm_config_data;
+
+/*
+* FM RDS Options Config Request
+*/
+typedef struct fm_rds_options
+{
+  uint32 rds_group_mask;
+  uint32 rds_group_buffer_size;
+  uint8 rds_change_filter;
+}fm_rds_options;
+/*
+* FM RX Search stations request
+*/
+typedef struct fm_search_stations
+{
+  uint8 search_mode;
+  uint8 dwell_period;
+  uint8 search_dir;
+}fm_search_stations;
+
+/*
+* FM RX Search DDS stations request
+*/
+typedef struct fm_search_rds_stations
+{
+  uint8 search_mode;
+  uint8 dwell_period;
+  uint8 search_dir;
+  uint8 program_type;
+  uint16 program_id;
+}fm_search_rds_stations;
+
+/*
+* FM RX Search station lists request
+*/
+typedef struct fm_search_list_stations
+{
+  uint8 search_mode;
+  uint8 search_dir;
+  uint32 srch_list_max;
+  /**< Maximum number of stations that can be returned from a search. */
+  uint8 program_type;
+}fm_search_list_stations;
+
+/*
+* FM RX I2C request
+*/
+typedef struct fm_i2c_params
+{
+  uint8 slaveaddress;
+  uint8 offset;
+  uint8 payload_length;
+  uint8 data[64];
+}fm_i2c_params;
+
+/* Structure containing the RDS PS Info to be transmitted */
+typedef struct _tsFtmFmRdsTxPsType
+{
+  uint32                ulPSStrLen;
+  /**< The size of the cTxPSStrPtr buffer.
+  */
+
+  uint32                ucTxPSRptCnt;
+  /**< The number of times each 8 character string is repeated before the next
+       string is transmitted.
+  */
+
+  uint16                tusTxPi;
+  /**< RDS/RBDS Program Identification to use for Program Service transmissions.
+  */
+
+  uint8                 tucTxPSPty;
+  /**< The RDS/RBDS Program Type to transmit.
+  */
+
+  const char            cTxPSStrPtr[108];
+  /**< A pointer to a buffer containing the Program Service string to transmit
+       (must be null terminated).
+  */
+
+} tsFtmFmRdsTxPsType;
+
+typedef struct _tsFtmFmRdsTxRtType
+{
+  uint32                ulRTStrLen;
+  /**< The size of the cTxRTStrPtr buffer.
+  */
+
+  uint16                tusTxPi;
+  /**< RDS/RBDS Program Identification to use for RadioText transmissions.
+  */
+
+  uint8                 tucTxRTPty;
+  /**< The RDS/RBDS Program Type to transmit.
+  */
+
+  const char            cTxRTStrPtr[65];
+  /**< A pointer to a buffer containing the RadioText string to transmit
+       (must be null terminated).
+   */
+
+} tsFtmFmRdsTxRtType;
+
+typedef struct _ftm_def_data_rd_req
+{
+  uint8    mode;
+  uint8    length;
+  uint8    param_len;
+  uint8    param;
+} __attribute__((packed))ftm_fm_def_data_rd_req;
+
+typedef struct _ftm_def_data_wr_req
+{
+  uint8    mode;
+  uint8    length;
+  uint8    data[DEFAULT_DATA_SIZE];
+} __attribute__((packed))ftm_fm_def_data_wr_req;
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  char                        result ;/* result */
+  uint8                       length; /*RDS PS string length*/
+  uint8                       string[MAX_RDS_PS_LENGTH]; /* RDS string */
+}__attribute__((packed)) fmrdsps_response;
+
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  char                        result ;/* result */
+  uint8                       length; /*RDS PS string length*/
+  uint8                       string[MAX_RDS_RT_LENGTH]; /* RDS string */
+}__attribute__((packed)) fmrdsrt_response;
+
+
+/**
+*  FM All Request Union type.
+*/
+typedef union fm_cfg_request
+{
+  fm_config_data cfg_param;
+  uint8 mute_param;
+  uint8 stereo_param;
+  uint32 freq;
+  fm_rds_options rds_options;
+  uint8 power_mode;
+  uint8 signal_threshold;
+  fm_search_stations search_stations_options;
+  fm_search_rds_stations search_rds_stations_options;
+  fm_search_list_stations search_list_stations_options;
+  fm_i2c_params i2c_params;
+  uint32 rds_group_options;
+  uint16 rx_af_threshold;
+  uint8 rx_rssi_checktimer;
+  uint rx_rds_pi_timer;
+  tsFtmFmRdsTxPsType tuFmPSParams;
+  tsFtmFmRdsTxRtType tuFmRTParams;
+  uint8 soft_mute_param;
+  uint8 antenna_type;
+  uint8 tx_tone_param;
+  uint8 rds_grp_counters;
+  uint8 rds_grp_counters_ext;
+  uint8 hlsi;
+  uint8 sinr_samples;
+  char sinr_threshold;
+  uint8 On_channel_threshold;
+  uint8 Off_channel_threshold;
+  uint8 notch;
+  fm_riva_peek_word riva_peek_params;
+  fm_riva_poke_word riva_data_access_params;
+  fm_ssbi_poke_reg ssbi_access_params;
+  fm_set_get_reset_agc_req set_get_agc_req_parameters;
+  ftm_fm_def_data_rd_req rd_default;
+  ftm_fm_def_data_wr_req wr_default;
+  uint8 tx_pwr_cfg;
+  uint8 audio_output;
+  uint8 audio_vlm;
+}fm_cfg_request;
+
+/* FTM FM request type */
+typedef PACKED struct
+{
+  diagpkt_cmd_code_type              cmd_code;
+  diagpkt_subsys_id_type             subsys_id;
+  diagpkt_subsys_cmd_code_type       subsys_cmd_code;
+  uint16                             cmd_id; /* command id (required) */
+  uint16                             cmd_data_len;
+  uint16                             cmd_rsp_pkt_size;
+  byte                               data[1];
+}__attribute__((packed))ftm_fm_pkt_type;
+
+/* Set MuteMode Response */
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  char                        result ;/* result */
+  uint8                       mutemode;
+}__attribute__((packed)) mutemode_response;
+
+/* Set StereoMode Response */
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  char                        result ;/* result */
+  uint8                       stereomode;
+}__attribute__((packed)) stereomode_response;
+
+/* I2C Response */
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  char                        result ;/* result */
+  uint32                      length; /*length of data read */
+  uint8                       data[64]; /* I2C read dat buffer */
+}__attribute__((packed)) fmbusread_response;
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  char                        result ;/* result */
+  uint8                       sub_opcode;
+  uint32                      start_address;
+  uint8                       length; /*length of data read */
+  uint8                       data[MAX_RIVA_DATA_LEN]; /* read dat buffer */
+}__attribute__((packed)) rivaData_response;
+
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  char                        result ;/* result */
+  uint8                       data;
+}__attribute__((packed)) ssbiPeek_response;
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  char                        result ;/* result */
+  uint8                       uccurrentgainstate;
+  uint8                       ucgainstatechange1;
+  uint8                       ucgainstatechange2;
+  uint8                       ucgainstatechange3;
+}__attribute__((packed)) set_get_reset_agc_response;
+
+/*Read RDS Group counters responce*/
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  char                        result ;/* result */
+  fm_rds_grp_cntrsparams  read_rds_cntrs;
+}__attribute__((packed)) ReadRDSCntrs_responce;
+
+/*Read RDS Group counters response*/
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  char                        result ;/* result */
+  fm_rds_grpcntrs_extendedparams  read_rds_cntrs_ext;
+}__attribute__((packed)) ReadRDSCntrs_ext_response;
+
+
+/* Generic Response */
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  char                        result ;/* result */
+}__attribute__((packed)) generic_response;
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ;
+  char	                      result ;
+  uint16                      afthreshold;
+}  fmrxsetafthreshold_response;
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ;
+  char                        result ;
+  uint8                       sinr_sample;
+}  getsinrsamples_response;
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ;
+  char                        result ;
+  char                        sinr_threshold;
+}  getsinrthreshold_response;
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ;
+  char                        result ;
+  uint8                       sinr_on_th;
+}  getonchannelthreshold_response;
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ;
+  char                        result ;
+  uint8                       sinr_off_th;
+}  getoffchannelthreshold_response;
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ;
+  char                        result ;
+  uint8                       rssitimer;
+}  fmrxsetrssichecktimer_response;
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ;
+  char                        result ;
+  uint8                       rdspitimer;
+}  fmrxsetrdspitimer_response;
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ;
+  char                        result ;
+  uint8                       threshold;
+}  threshold_response;
+
+typedef PACKED struct
+{
+  diagpkt_subsys_header_type  header ;
+  char                        result ;
+  uint32                      rdserrcount;
+  uint32                      numofblocks;
+}  rds_err_count_response;
+
+/* Custom response for Get station parameters request */
+struct fm_rx_get_station_parameters_response_t
+{
+  diagpkt_subsys_header_type  header ; /*Diag header*/
+  char                        result ;/* result */
+  uint32                      stationFreq;
+  /* The currently tuned frequency in kHz (Example: 96500 -> 96.5Mhz)*/
+  uint8                       servAvble;
+  /* The current service available indicator for the current station */
+  uint8                       rssi;
+  /* The current signal strength level (0-100 range). */
+  uint8                       stereoProgram;
+  /* The current mono/stereo indicator for this station */
+  uint8                       rdsSyncStatus;
+  /* The current RDS/RBDS synchronization status */
+  uint8                       muteMode;
+  /* The current FM mute mode */
+}__attribute__((packed));
+
+/* FTM Log Packet - Used to send back the event of a HCI Command */
+typedef PACKED struct
+{
+  log_hdr_type hdr;
+  byte         EvName;
+   /* Event ID indicates which event is being returned. */
+  byte         EvResult;
+  byte         data[1];         /* Variable length payload,
+                                  look at FTM log id for contents */
+} ftm_fm_log_pkt_type;
+#define FTM_FM_LOG_HEADER_SIZE (sizeof (ftm_fm_log_pkt_type) - 1)
+
+typedef struct fm_rx_get_station_parameters_response_t fm_rx_get_station_parameters_response;
+/*===========================================================================
+FUNCTION   ftm_fm_dispatch
+
+DESCRIPTION
+  Dispatch routine for the various FM Rx/Tx commands. Copies the data into
+  a global union data structure before calling the processing routine
+
+DEPENDENCIES
+  NIL
+
+RETURN VALUE
+  A Packed structre pointer including the response to the FTM FM packet
+
+SIDE EFFECTS
+  None
+
+===========================================================================*/
+
+void * ftm_fm_dispatch(ftm_fm_pkt_type *ftm_fm_pkt, uint16 length );
+
+
+/*===========================================================================
+
+FUNCTION      ftm_fm_enable_audio
+
+DESCRIPTION
+  This function is used to take the audio output mode from QRCT.
+
+DEPENDENCIES
+  none
+
+===========================================================================*/
+PACKED void* ftm_fm_enable_audio( void );
+PACKED void* ftm_fm_disable_audio( void );
+PACKED void* ftm_fm_setting_volume(void);
+
+#endif /* CONFIG_FTM_FM */

feeds/ipq95xx/ftm/src/ftm_iot.c

@@ -0,0 +1,549 @@
+/*
+*Copyright (c) 2018-2020, 2022 Qualcomm Technologies, Inc.
+*
+*All Rights Reserved.
+*Confidential and Proprietary - Qualcomm Technologies, Inc.
+*/
+
+/* IPQ-QCA402X specific file */
+
+#ifdef IPQ_AP_HOST_IOT
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+#include <sys/ioctl.h>
+#include <mtd/mtd-user.h>
+#include "comdef.h"
+#include "diagcmd.h"
+#include "ftm_wlan.h"
+#include "ftm_dbg.h"
+#include "ftm_iot.h"
+#ifdef IPQ_AP_HOST_IOT_QCA402X
+#include "diag_api.h"
+#endif /* IPQ_AP_HOST_IOT_QCA402X */
+#ifdef IPQ_AP_HOST_IOT_IPQ
+#include "btdaemon.h"
+#endif /* IPQ50XX, IPQ95XX */
+
+#define NHDLC_TERM 126
+#define NHDLC_VERSION 1
+#define NHDLC_TERM_SIZE 1
+#define FLASH_CMD_ID_POS 1
+#define MAX_BUF_SIZE 2048
+#define WAIT_TIME_MS 100
+#define SUBSYS_CMD_ID_POS 2
+#define RESERVED_CMD_ID 0
+#define DUT_INTERFACE_SELECT 1
+#define DUT_INTERFACE_ID_POS 4
+#define DUT_INTERFACE_SELECT_POS 10
+#define DIAG_HDR_LEN (sizeof(diag_nonhdlc_hdr_t) + NHDLC_TERM_SIZE)
+#define FTM_IOT_LOG_HEADER_SIZE  sizeof(ftm_iot_log_pkt_type)
+
+#define MEMSET_RESET_VALUE 0
+#define DIAG_HEADER_SIZE 12
+
+extern void diagpkt_free(void *pkt);
+
+void print_array(uint8_t *addr, int len)
+{
+    int i;
+    int line = 1;
+    for (i = 0; i < len; i++) {
+        if (i == (line * 80)) {
+           DPRINTF(FTM_DBG_TRACE, "\n");
+           line++;
+        }
+        DPRINTF(FTM_DBG_TRACE, "%02X ", addr[i]);
+    }
+    DPRINTF(FTM_DBG_TRACE, "\n");
+}
+#ifdef IPQ_AP_HOST_IOT_QCA402X
+/*===========================================================================
+  FUNCTION iot_thr_func_qca402x
+
+  DESCRIPTION
+  Continously polls QCA402X for asynchronous data responses and
+  logs receievd asynchronous data responses to Diag module using
+  log-submit()
+
+  DEPENDENCIES
+  NIL
+
+  RETURN VALUE
+  Returns NULL on failure. Function also exits with NULL return value
+  when main indicates that this thread should be stopped
+
+  SIDE EFFECTS
+  NONE
+
+  ===========================================================================*/
+void *iot_thr_func_qca402x(void *hdl)
+{
+    int bytes = 0;
+    void *rsp2 = NULL;
+    int diag_hdr_len = DIAG_HDR_LEN ;
+    void *new_iot_ftm_rsp2_pkt = NULL;
+
+    if (!hdl) {
+        DPRINTF(FTM_DBG_ERROR, "Invalid iotd handle\n");
+        return NULL;
+    }
+
+    new_iot_ftm_rsp2_pkt = malloc(MAX_BUF_SIZE);
+    if (!new_iot_ftm_rsp2_pkt) {
+        DPRINTF(FTM_DBG_ERROR, "Could not allocate response packet \n");
+        return NULL;
+    }
+
+    while(1) {
+
+        if (thread_stop == 1) {
+            DPRINTF(FTM_DBG_TRACE, "FTMd: Exiting thread.\n");
+            break;
+        }
+
+        memset(new_iot_ftm_rsp2_pkt, MEMSET_RESET_VALUE, MAX_BUF_SIZE);
+        sem_wait(&iot_sem);
+
+        /*If we recieve a response from QCA402X, allocate a buffer using diag alloc with correct
+          subsystem code and length */
+        while ((bytes = diag_recv(hdl, (uint8_t *)new_iot_ftm_rsp2_pkt,
+                                                      MAX_BUF_SIZE,
+                                                      WAIT_TIME_MS)) >= 0) {
+            if (bytes > MAX_BUF_SIZE || bytes <= diag_hdr_len) {
+                DPRINTF(FTM_DBG_ERROR, "Could not allocate async log response packet\n");
+                free (new_iot_ftm_rsp2_pkt);
+                return NULL;
+            }
+
+            rsp2 = diagpkt_subsys_alloc(DIAG_SUBSYS_FTM, ftm_iot_cmd_code, (bytes - diag_hdr_len));
+            if (!rsp2) {
+                DPRINTF(FTM_DBG_ERROR, "Could not allocate async log response packet\n");
+                free (new_iot_ftm_rsp2_pkt);
+                return NULL;
+            }
+
+            /* Remove NHDLC header from recieved packet and store contents in
+               buffer allocated above */
+            memcpy(rsp2, (new_iot_ftm_rsp2_pkt + diag_hdr_len - NHDLC_TERM_SIZE),
+                                                         (bytes - diag_hdr_len));
+
+            DPRINTF(FTM_DBG_TRACE, "FTMd: Asynchronous Data response has been sent.\n");
+            print_array((uint8_t *)rsp2, (bytes - diag_hdr_len) );
+
+            /*Remove an additional 4 bytes of header and log packet to diag module
+              asynchronously for further processing*/
+            log_submit(rsp2 + diag_hdr_len - NHDLC_TERM_SIZE);
+            diagpkt_free (rsp2);
+            memset(new_iot_ftm_rsp2_pkt, MEMSET_RESET_VALUE, MAX_BUF_SIZE);
+        }
+
+	sem_post(&iot_sem_async);
+    }
+
+    free (new_iot_ftm_rsp2_pkt);
+    diagpkt_free (rsp2);
+    pthread_exit(NULL);
+}
+
+/*===========================================================================
+  FUNCTION ftm_iot_dispatch_qca402x
+
+  DESCRIPTION
+  Function processes WIN IOT specific requests and relays to
+  QCA402x FTM layer for further processing. Recieves response
+  buffer from QCA402x and returns buffer meant for diag call back
+
+  This function handles NHDLC to HDLC translation and vice-versa
+  before sending and receivng buffers to QCA402X FTM layer
+
+  DEPENDENCIES
+  NIL
+
+  RETURN VALUE
+  Returns back buffer that is meant for diag callback
+
+  SIDE EFFECTS
+  NONE
+
+  ===========================================================================*/
+
+void *ftm_iot_dispatch_qca402x(void *iot_ftm_pkt, int pkt_len, void *hdl)
+{
+    int diag_hdr_len = DIAG_HDR_LEN;
+    int ret = 0;
+    byte *payload_ptr = NULL;
+    void *rsp1 = NULL;
+    ftm_iot_req_pkt_type *new_iot_ftm_pkt = NULL;
+    void *new_iot_ftm_rsp_pkt = NULL;
+    char command[50] = {'\0'};
+    uint16_t *ftm_iot_flash_ptr = NULL;
+    uint16 ftm_iot_flash_cmd_code = 0;
+    /* The new packet length will be length of original request packet
+       + size of NHDLC header + 1 byte of termination character */
+    int new_pkt_len = pkt_len + diag_hdr_len;
+
+    if (!iot_ftm_pkt || !pkt_len || !hdl) {
+        DPRINTF(FTM_DBG_ERROR, "Invalid ftm iot request packet or iotd handle\n");
+        return NULL;
+    }
+
+    new_iot_ftm_pkt = malloc(sizeof(ftm_iot_req_pkt_type) + pkt_len + NHDLC_TERM_SIZE);
+    if (!new_iot_ftm_pkt) {
+        DPRINTF(FTM_DBG_ERROR, "Could not create new ftm iot request packet\n");
+        return NULL;
+    }
+    memset(new_iot_ftm_pkt, MEMSET_RESET_VALUE, (sizeof(ftm_iot_req_pkt_type) + pkt_len + NHDLC_TERM_SIZE));
+
+    new_iot_ftm_rsp_pkt = malloc(MAX_BUF_SIZE);
+    if (!new_iot_ftm_rsp_pkt) {
+        DPRINTF(FTM_DBG_ERROR, "Could not create new ftm iot response packet\n");
+        free (new_iot_ftm_pkt);
+        return NULL;
+    }
+    memset(new_iot_ftm_rsp_pkt, MEMSET_RESET_VALUE, MAX_BUF_SIZE);
+
+    /* Add Non-HDLC header to request packet
+       and populate NHDLC header*/
+    new_iot_ftm_pkt->hdr.start = NHDLC_TERM;
+    new_iot_ftm_pkt->hdr.version = NHDLC_VERSION;
+    new_iot_ftm_pkt->hdr.length = pkt_len;
+    memcpy(&(new_iot_ftm_pkt->payload), iot_ftm_pkt, pkt_len);
+    payload_ptr = (byte *) &(new_iot_ftm_pkt->payload);
+    *( payload_ptr + pkt_len) = NHDLC_TERM;
+    ftm_iot_cmd_code = *(payload_ptr + SUBSYS_CMD_ID_POS);
+    ftm_iot_dut_interface_code = *(payload_ptr + DUT_INTERFACE_ID_POS);
+    ftm_iot_reserved_code = *(payload_ptr + SUBSYS_CMD_ID_POS + 1);
+    ftm_iot_flash_ptr = (uint16_t *) &(new_iot_ftm_pkt->payload);
+    ftm_iot_flash_cmd_code = *(ftm_iot_flash_ptr + FLASH_CMD_ID_POS);
+    /*Print packet after adding headers */
+    DPRINTF(FTM_DBG_TRACE, "FTMd: Request Packet of size %d bytes sent:\n", new_pkt_len);
+    print_array((uint8_t *)new_iot_ftm_pkt, new_pkt_len);
+
+    /*If the request packet it a DUT interface selection command,
+      update interface number and return a response packet that
+      is an encho of the request packet. ( In the case of multiple
+      QCA402x DUT attaches on IPQ platforms) */
+    if (((ftm_iot_cmd_code == MFG_CMD_ID_BLE_HCI) || (ftm_iot_cmd_code == MFG_CMD_ID_I15P4_HMI))
+                                          && (ftm_iot_dut_interface_code == DUT_INTERFACE_SELECT)
+                                          && (ftm_iot_reserved_code == RESERVED_CMD_ID)){
+        interface = *(payload_ptr + DUT_INTERFACE_SELECT_POS) - 1;
+        if (interface < 0) {
+            DPRINTF(FTM_DBG_ERROR, "Invalid DUT interface selection command\n");
+            free (new_iot_ftm_pkt);
+            free (new_iot_ftm_rsp_pkt);
+            return NULL;
+         }
+        rsp1 = diagpkt_subsys_alloc(DIAG_SUBSYS_FTM, ftm_iot_cmd_code, pkt_len);
+        if (!rsp1){
+            DPRINTF(FTM_DBG_ERROR, "Could not allocate response packet for interface selection\n");
+            free (new_iot_ftm_pkt);
+            free (new_iot_ftm_rsp_pkt);
+            return NULL;
+        }
+
+        memcpy(rsp1, iot_ftm_pkt, pkt_len);
+
+        DPRINTF(FTM_DBG_TRACE, "FTMd: The DUT interface selected is %d \n",interface);
+        DPRINTF(FTM_DBG_TRACE, "FTMd: DUT interface resp packet of size %d bytes sent:\n",pkt_len);
+        print_array((uint8_t *)rsp1, pkt_len);
+
+        free (new_iot_ftm_pkt);
+        free (new_iot_ftm_rsp_pkt);
+
+        /*This resp pointer will be freed by diag later*/
+        return rsp1;
+    }
+
+    /*If the request packet is a MFG PROG command,
+      launch flash script and return a response packet that indicates
+      flashing mode of QCA402x is enabled or disabled */
+    if ((ftm_iot_flash_cmd_code == MFG_CMD_ID_MISC_PROG_MODE)){
+
+        if (ftm_iot_dut_interface_code == MFG_FLASH_ON){
+            strlcpy(command, "/usr/bin/qca402x_flash.sh flash on", sizeof(command));
+        }
+
+        if (ftm_iot_dut_interface_code == MFG_FLASH_OFF){
+            strlcpy(command, "/usr/bin/qca402x_flash.sh flash off", sizeof(command));
+        }
+
+        if (ftm_iot_dut_interface_code == MFG_USB_OFF){
+            strlcpy(command, "/usr/bin/qca402x_flash.sh usb-select off", sizeof(command));
+        }
+
+        if (ftm_iot_dut_interface_code == MFG_USB_ON){
+           strlcpy(command, "/usr/bin/qca402x_flash.sh usb-select on", sizeof(command));
+        }
+
+        if (ftm_iot_dut_interface_code == MFG_EDL_OFF){
+           strlcpy(command, "/usr/bin/qca402x_flash.sh edl off", sizeof(command));
+        }
+
+        if (ftm_iot_dut_interface_code == MFG_EDL_ON){
+           strlcpy(command, "/usr/bin/qca402x_flash.sh edl on", sizeof(command));
+        }
+
+        /*Return with NULL if string is empty or packet length is less than
+          10 for a DUT interface selection command to make sure there will be
+          no out of bound access */
+        if ( (command[0] == '\0') || (pkt_len <= DUT_INTERFACE_ID_POS) ) {
+            DPRINTF(FTM_DBG_ERROR, "Error: Invalid MFG Program command\n");
+            free (new_iot_ftm_pkt);
+            free (new_iot_ftm_rsp_pkt);
+            return NULL;
+        }
+
+        system(command);
+        DPRINTF(FTM_DBG_TRACE, "\n FTMd: Sent system command: %s \n", command);
+
+        /* Check of size for packet pointed to by payload_ptr has been done above
+           using pkt_len to make sure there is no out of bound access */
+
+        *(payload_ptr + DUT_INTERFACE_ID_POS) = MFG_PROG_RESP;
+
+        rsp1 = diagpkt_subsys_alloc(DIAG_SUBSYS_FTM, ftm_iot_cmd_code, pkt_len);
+        if (!rsp1){
+            DPRINTF(FTM_DBG_ERROR, "Could not allocate response packet for MFG flash commands\n");
+            free (new_iot_ftm_pkt);
+            free (new_iot_ftm_rsp_pkt);
+            return NULL;
+        }
+
+        memcpy(rsp1, payload_ptr, pkt_len);
+
+        DPRINTF(FTM_DBG_TRACE, "FTMd: MFG Flash resp packet of size %d bytes sent:\n",pkt_len);
+        print_array((uint8_t *)rsp1, pkt_len);
+
+        free (new_iot_ftm_pkt);
+        free (new_iot_ftm_rsp_pkt);
+
+        /*This resp pointer will be freed by diag later*/
+        return rsp1;
+    }
+
+    sem_wait(&iot_sem_async);
+    /* Call IPQ-QCA402x diag APIs */
+    ret = diag_send(hdl, interface, (uint8_t *)new_iot_ftm_pkt, new_pkt_len);
+    if ((ret < 0) || (ret > MAX_BUF_SIZE)) {
+        DPRINTF(FTM_DBG_ERROR, "Could not send the request packet to QCA402x \n");
+        free (new_iot_ftm_pkt);
+        free (new_iot_ftm_rsp_pkt);
+        return NULL;
+    }
+
+    ret = diag_recv(hdl, (uint8_t *)new_iot_ftm_rsp_pkt, MAX_BUF_SIZE, WAIT_TIME_MS);
+    if ((ret < 0) || (ret > MAX_BUF_SIZE) || (ret <= diag_hdr_len)) {
+        DPRINTF(FTM_DBG_ERROR, "Could not recieve packet from QCA402x\n");
+        free (new_iot_ftm_pkt);
+        free (new_iot_ftm_rsp_pkt);
+        return NULL;
+    }
+
+    DPRINTF(FTM_DBG_TRACE,"Received Command Response of %d bytes\n",ret);
+    print_array((uint8_t *)new_iot_ftm_rsp_pkt, ret);
+
+    rsp1 = diagpkt_subsys_alloc(DIAG_SUBSYS_FTM, ftm_iot_cmd_code, (ret - diag_hdr_len));
+    if (!rsp1){
+        DPRINTF(FTM_DBG_ERROR, "Could not allocate response packet\n");
+        free (new_iot_ftm_pkt);
+        free (new_iot_ftm_rsp_pkt);
+        return NULL;
+    }
+
+    memcpy(rsp1, (new_iot_ftm_rsp_pkt + diag_hdr_len - NHDLC_TERM_SIZE), (ret - diag_hdr_len));
+
+    free (new_iot_ftm_pkt);
+    free (new_iot_ftm_rsp_pkt);
+    sem_post(&iot_sem);
+
+    /*This resp pointer will be freed by diag module later*/
+    return (void *)rsp1;
+}
+#endif /* IPQ_AP_HOST_IOT_QCA402X */
+
+#ifdef IPQ_AP_HOST_IOT_IPQ
+/*===========================================================================
+ FUNCTION iot_thr_func_ipq
+
+ DESCRIPTION
+ Continously polls IPQ BTSS for asynchronous data responses and
+ logs received asynchronous data responses to Diag module using
+ log-submit()
+
+ DEPENDENCIES
+ NIL
+
+ RETURN VALUE
+ Returns NULL on failure. Function also exits with NULL return value
+ when main indicates that this thread should be stopped
+
+ SIDE EFFECTS
+ NONE
+
+===========================================================================*/
+
+void *iot_thr_func_ipq(void *hdl)
+{
+    int bytes_read = 0, handle = 0;
+    void *buffer = NULL;
+    void *rsp = NULL;
+    struct timespec ts;
+    ftm_bt_rsp_pkt_type *ftm_async_pkt;
+
+    buffer = malloc(MAX_BUF_SIZE);
+    if (!buffer)
+    {
+        DPRINTF(FTM_DBG_ERROR, "Could not allocate memory to the buffer \n");
+        return NULL;
+    }
+
+    memset(buffer, MEMSET_RESET_VALUE, MAX_BUF_SIZE);
+
+    if(hdl == NULL || *((int*)hdl) < 0)
+    {
+        DPRINTF(FTM_DBG_ERROR, "\n Invalid Handle received from BTSS \n");
+        free(buffer);
+        return NULL;
+    }
+
+    handle = *((int*)hdl);
+    while(1)
+    {
+        if (thread_stop == 1) {
+            DPRINTF(FTM_DBG_TRACE, "FTMd: Exiting thread.\n");
+            break;
+        }
+
+        if (clock_gettime(CLOCK_REALTIME, &ts) == -1)
+        {
+            DPRINTF(FTM_DBG_ERROR, "clock_gettime");
+            free(buffer);
+            return NULL;
+        }
+        ts.tv_sec += user_sem_wait_timeout;
+        sem_timedwait(&iot_sem, &ts);
+        while((bytes_read = bt_daemon_receive(handle, &buffer)) > 0)
+        {
+            /*
+             * Checking for log status on the packets received
+             * ignore the received packets incase of disabled logging
+             */
+            if(log_status(LOG_BT_HCI_EV_C))
+            {
+                rsp = log_alloc(LOG_BT_HCI_EV_C, (DIAG_HEADER_SIZE + bytes_read));
+                if (!rsp)
+                {
+                    DPRINTF(FTM_DBG_ERROR, "Could not allocate rsp packet \n");
+                    free(buffer);
+                    return NULL;
+                }
+
+                ftm_async_pkt = (ftm_bt_rsp_pkt_type*)rsp;
+                memcpy(ftm_async_pkt->buf, buffer, bytes_read);
+                DPRINTF(FTM_DBG_TRACE, "\n Printing the Async Packet sent to QDART\n");
+                print_array((uint8_t *)rsp, (DIAG_HEADER_SIZE + bytes_read));
+
+                log_submit(rsp);
+                log_free(rsp);
+                memset(buffer, MEMSET_RESET_VALUE, MAX_BUF_SIZE);
+            }
+        }
+        sem_post(&iot_sem_async);
+    }
+    free(buffer);
+    pthread_exit(NULL);
+}
+/*===========================================================================
+  FUNCTION ftm_iot_dispatch_ipq
+
+  DESCRIPTION
+  Function processes WIN IOT specific requests and relays to
+  BTSS for further processing. Constructs response packet
+  and returns buffer meant for callback.
+
+  DEPENDENCIES
+  NIL
+
+  RETURN VALUE
+  Returns back buffer that is meant for diag callback
+
+  SIDE EFFECTS
+  NONE
+
+  ===========================================================================*/
+
+void *ftm_iot_dispatch_ipq(void *iot_ftm_pkt, int pkt_len, int *hdl)
+{
+    void *rsp = NULL;
+    struct timespec ts;
+    int bytes_sent = -1;
+
+    if(hdl == NULL || *hdl < 0)
+    {
+        DPRINTF(FTM_DBG_ERROR, "\n Invalid Handle received from BTSS \n");
+        return NULL;
+    }
+
+    if (!iot_ftm_pkt)
+    {
+        DPRINTF(FTM_DBG_ERROR, "Invalid iot_ftm_pkt received \n");
+        return NULL;
+    }
+
+    if (clock_gettime(CLOCK_REALTIME, &ts) == -1)
+    {
+        perror("clock_gettime");
+        return NULL;
+    }
+    ts.tv_sec += user_sem_wait_timeout;
+    sem_timedwait(&iot_sem_async, &ts);
+
+    DPRINTF(FTM_DBG_TRACE, "\n Request Packet received for IPQ BT\n");
+    print_array((uint8_t *)iot_ftm_pkt, pkt_len);
+
+    bytes_sent = bt_daemon_send(*hdl, iot_ftm_pkt);
+    if(bytes_sent < 0)
+    {
+        perror("Unable to send Request Packet to IPQ BT");
+        return NULL;
+    }
+
+    /* Constructing ACK Packet */
+    rsp = diagpkt_subsys_alloc(DIAG_SUBSYS_FTM, ftm_iot_cmd_code, pkt_len);
+    if (!rsp)
+    {
+        DPRINTF(FTM_DBG_ERROR, "\n Unable to allocate diag response packet \n");
+        return NULL;
+    }
+
+    memcpy(rsp, iot_ftm_pkt, pkt_len);
+
+    DPRINTF(FTM_DBG_TRACE, "\n ACK Packet constructed in FTM layer\n");
+    print_array((uint8_t *)rsp, pkt_len);
+
+    sem_post(&iot_sem);
+
+    /*This rsp pointer will be freed by diag later */
+    return rsp;
+}
+#endif /* IPQ50XX, IPQ95XX */
+
+void *ftm_iot_dispatch(void *iot_ftm_pkt, int pkt_len, void *hdl)
+{
+    void* retValue = NULL;
+#ifdef IPQ_AP_HOST_IOT_QCA402X
+    retValue = ftm_iot_dispatch_qca402x(iot_ftm_pkt, pkt_len ,hdl);
+#endif
+#ifdef IPQ_AP_HOST_IOT_IPQ
+    retValue = ftm_iot_dispatch_ipq(iot_ftm_pkt, pkt_len ,(int *)hdl);
+#endif /* IPQ50XX, IPQ95XX */
+    return retValue;
+}
+
+#endif /*ifdef IPQ_AP_HOST_IOT*/

feeds/ipq95xx/ftm/src/ftm_iot.h

@@ -0,0 +1,132 @@
+/*
+ *Copyright (c) 2018-2020, 2022 Qualcomm Technologies, Inc.
+ *
+ *All Rights Reserved.
+ *Confidential and Proprietary - Qualcomm Technologies, Inc.
+ */
+
+/* IPQ-QCA402X specific file */
+#ifdef IPQ_AP_HOST_IOT
+
+#include <semaphore.h>
+#include <time.h>
+#include "diagpkt.h"
+#include "log.h"
+
+#define MFG_CMD_ID_BLE_HCI 4
+#define MFG_CMD_ID_I15P4_HMI 5
+#define MFG_CMD_ID_OTP_INVALID 256
+#define MFG_CMD_ID_OTP_SET_BITS 257
+#define MFG_CMD_ID_OTP_WRITE_BYTE 258
+#define MFG_CMD_ID_OTP_READ_BYTE 259
+#define MFG_CMD_ID_OTP_TLV_INIT 260
+#define MFG_CMD_ID_OTP_TLV_READ 261
+#define MFG_CMD_ID_OTP_TLV_WRITE 262
+#define MFG_CMD_ID_OTP_TLV_STATUS 263
+#define MFG_CMD_ID_OTP_TLV_DELETE 264
+
+#define MFG_CMD_ID_RAWFLASH_INVALID 288
+#define MFG_CMD_ID_RAWFLASH_CLEAR_BITS 289
+#define MFG_CMD_ID_RAWFLASH_WRITE 290
+#define MFG_CMD_ID_RAWFLASH_READ  291
+#define MFG_CMD_ID_RAWFLASH_ERASE 292
+#define MFG_CMD_ID_RAWFLASH_DISABLE_MFG 293
+
+#define MFG_CMD_ID_FS_INVALID 304
+#define MFG_CMD_ID_FS_READ 305
+#define MFG_CMD_ID_FS_WRITE 306
+#define MFG_CMD_ID_FS_DELETE 307
+#define MFG_CMD_ID_FS_LIST_SETUP 308
+#define MFG_CMD_ID_FS_LIST_NEXT 309
+#define MFG_CMD_ID_FS_MOUNT 310
+#define MFG_CMD_ID_FS_UNMOUNT 311
+
+/* Add more MFG tool commands for QCA402x. These
+command are interpreted internally within QCA402x */
+#define MFG_CMD_ID_MISC_REBOOT 352
+#define MFG_CMD_ID_MISC_ADDR_READ 353
+#define MFG_CMD_ID_MISC_ADDR_WRITE 354
+#define MFG_CMD_ID_MISC_HWSS_DONE 355
+#define MFG_CMD_ID_MISC_XTAL_CAP_SET 356
+#define MFG_CMD_ID_MISC_PART_SZ_GET 357
+
+/* Add MFG tool command to enable flashing of QCA402x
+by putting QCA402x in EDL mode and selecting USB mux
+select option to tie USB port 81 on IPQ402x to QCA402x */
+#define MFG_CMD_ID_MISC_PROG_MODE 358
+
+/*Command to invalidate specified QCA402x Imageset */
+#define MFG_CMD_ID_MISC_FWUP 359
+/* Add MFG tool PROG_MODE subcommands to enable flashing
+of QCA402x on IPQ807x. Interpretation of sub-commands is as
+follows:
+
+MFG_FLASH_ON - Put QCA402x into reset state, Put QCA402x in
+EDL mode and enable USB port to be tied to QCA402x
+
+MFG_FLASH_OFF - Pull QCA402x out of EDL mode and Pull QCA402x
+out of reset
+
+MFG_EDL_ON - Put QCA402x in EDL mode
+
+MFG_FLASH_OFF - Pull QCA402x out of EDL mode
+
+MFG_USB_ON - Enable USB port to be tied to QCA402x
+
+MFG_USB_OFF - Enable USB port to be tied to IPQ807x
+
+MFG_PROG_RESP - Expected response field
+*/
+
+enum flash_state {
+    MFG_PROG_RESP,
+    MFG_FLASH_ON,
+    MFG_FLASH_OFF,
+    MFG_EDL_ON,
+    MFG_EDL_OFF,
+    MFG_USB_ON,
+    MFG_USB_OFF
+};
+
+typedef struct
+{
+    uint8 start;
+    uint8 version;
+    uint16 length;
+} PACKED_STRUCT diag_nonhdlc_hdr_t;
+
+typedef struct
+{
+    diag_nonhdlc_hdr_t hdr;
+    byte payload[0];
+} PACKED_STRUCT ftm_iot_req_pkt_type;
+
+typedef struct
+{
+    log_hdr_type hdr;
+    byte buf[1];
+} PACKED_STRUCT ftm_bt_rsp_pkt_type;
+
+/* Two semaphores are used to handle sequencing of requests, ack responses
+and multiple asynchronous data responses from QCA402x */
+
+sem_t iot_sem;
+sem_t iot_sem_async;
+
+int ftm_iot_cmd_code;
+int ftm_iot_dut_interface_code;
+int ftm_iot_reserved_code;
+int interface;
+int thread_stop;
+extern int user_sem_wait_timeout;
+
+void *ftm_iot_dispatch(void *iot_ftm_pkt, int pkt_len, void *hdl);
+#ifdef IPQ_AP_HOST_IOT_QCA402X
+void *ftm_iot_dispatch_qca402x(void *iot_ftm_pkt, int pkt_len, void *hdl);
+void *iot_thr_func_qca402x(void *hdl);
+#endif
+#ifdef IPQ_AP_HOST_IOT_IPQ
+void *ftm_iot_dispatch_ipq(void *iot_ftm_pkt, int pkt_len, int *hdl);
+void *iot_thr_func_ipq(void *hdl);
+#endif /* IPQ50XX, IPQ95XX */
+#endif /*ifdef IPQ_AP_HOST_IOT*/

feeds/ipq95xx/ftm/src/ftm_nfc.c

@@ -0,0 +1,108 @@
+/*=========================================================================
+                       NFC FTM C File
+Description
+   This file contains the definitions of the function used to check
+   which chip is present on the device.
+
+Copyright (c) 2013-2015 Qualcomm Technologies, Inc.
+All Rights Reserved.
+Confidential and Proprietary - Qualcomm Technologies, Inc.
+
+===========================================================================*/
+/*===========================================================================
+                         Edit History
+when        who              what,              where,     why
+--------   ---     ----------------------------------------------------------
+===========================================================================*/
+
+#include "ftm_nfc.h"
+
+CHIP_TYPE chipType = UNDEFINED_CHIP_TYPE;
+
+/*=========================================================================
+FUNCTION   checkChip
+
+DESCRIPTION
+  Checks whether it can open the NQ Kernel, if not, it means
+  the device has a QTI chip.
+
+PARAMETERS
+  None
+
+RETURN VALUE
+  void
+
+===========================================================================*/
+void checkChip( void )
+{
+    int ret = 0;
+
+    ret = ftm_nq_nfc_open( );                   // can you open the NQ Kernel?
+
+    if( ret > 0 )                               // yes
+    {
+        printf( "%s: NQ CHIP \n", __func__ );
+        chipType = NQ_CHIP;                     // so it's an NQ Chip
+
+        ret = ftm_nq_nfc_close( );              // close the handle
+        if( ret != 0 )                          // not successful?
+        {
+            printf( "%s: Could not close the File Handle for NQ Chip \n", __func__ );
+            chipType = CHIP_ERROR;              // something is wrong
+        }
+    }
+    else
+    {
+        printf( "%s: QTI CHIP \n", __func__ );
+        chipType = QTI_CHIP;
+    }
+}
+
+/*=========================================================================
+FUNCTION   ftm_nfc_dispatch
+
+DESCRIPTION
+  Dispatches QRCT commands and Chip Replies/Notifications/Data
+  to the required FTM NFC Chip Handler
+
+PARAMETERS
+  ftm_nfc_pkt_type *nfc_ftm_pkt - FTM Packet
+  uint16            pkt_len     - FTM Packet Length
+
+RETURN VALUE
+  void *
+
+===========================================================================*/
+void* ftm_nfc_dispatch( ftm_nfc_pkt_type *nfc_ftm_pkt, uint16 pkt_len )
+{
+    ftm_nfc_pkt_type *reply = NULL;
+
+    if( UNDEFINED_CHIP_TYPE == chipType )
+    {
+        printf( "%s: Checking Chip Type \n", __func__ );
+        checkChip( );
+    }
+
+    switch( chipType )
+    {
+        case NQ_CHIP:
+            if( nfc_ftm_pkt->ftm_nfc_hdr.nfc_cmd_id == FTM_NFC_REQ_CHIP_TYPE )
+                reply = PrepareRsp( nfc_ftm_pkt );
+            else
+                reply = ftm_nfc_dispatch_nq( nfc_ftm_pkt, pkt_len );
+            break;
+
+        case QTI_CHIP:
+            if( nfc_ftm_pkt->ftm_nfc_hdr.nfc_cmd_id == FTM_NFC_REQ_CHIP_TYPE )
+                reply = PrepareRsp( nfc_ftm_pkt );
+            else
+                reply = ftm_nfc_dispatch_qti( nfc_ftm_pkt, pkt_len );
+            break;
+
+        default:
+            printf( "%s: ERROR - THIS SHOULD HAVE NEVER BEEN REACHED, CHIP TYPE %d", __func__, chipType );
+            break;
+    }
+
+    return reply;
+}

feeds/ipq95xx/ftm/src/ftm_nfc.h

@@ -0,0 +1,37 @@
+/*=========================================================================
+                       NFC FTM HEADER File
+Description
+   This file contains the definitions of the function used to check
+   which chip is present on the device.
+
+Copyright (c) 2013-2016 Qualcomm Technologies, Inc.
+All Rights Reserved.
+Confidential and Proprietary - Qualcomm Technologies, Inc.
+
+===========================================================================*/
+
+#ifndef _FTM_NFC
+#define _FTM_NFC
+
+#include "ftm_nfcnq.h"
+
+#define NFC_QCA1990                 // Defnition to enable the NFC FTM inclusion
+
+typedef enum _CHIP_TYPE{
+    UNDEFINED_CHIP_TYPE     = 0,
+    QTI_CHIP                = 1,
+    NQ_CHIP                 = 2,
+    CHIP_ERROR              = 3,
+    MAXIMUM_CHIP_TYPE       = 4,
+} CHIP_TYPE;
+
+extern CHIP_TYPE chipType;
+
+void* ftm_nfc_dispatch(ftm_nfc_pkt_type *ftm_nfc_pkt, uint16 pkt_len);
+
+void* ftm_nfc_dispatch_qti(ftm_nfc_pkt_type *ftm_nfc_pkt, uint16 pkt_len);
+
+void ftm_nfc_dispatch_nq_fwdl();
+
+void ftm_nfc_dispatch_nq_test(int argc, char **argv);
+#endif // _FTM_NFC

feeds/ipq95xx/ftm/src/ftm_nfcnq.c

@@ -0,0 +1,807 @@
+/*=========================================================================
+                       NQ NFC FTM C File
+Description
+   This file contains the definitions of the functions
+   used to communicate with the NQ Chip.
+
+Copyright (c) 2015-2016 Qualcomm Technologies, Inc.
+All Rights Reserved.
+Confidential and Proprietary - Qualcomm Technologies, Inc.
+
+===========================================================================*/
+/*===========================================================================
+                         Edit History
+when        who              what,              where,     why
+--------   ---     ----------------------------------------------------------
+===========================================================================*/
+
+#include "ftm_nfcnq.h"
+#include "ftm_nfc.h"
+#include "ftm_nfcnq_fwdl.h"
+
+/* Global variables */
+pthread_t           clientThread;
+PNCI_MESSAGE        pNCIMessage;
+sem_t               sRspReady;
+int                 fdNfc                   = 0;
+uint8_t             nciReplyMessage[ 255 ]  = { 0 };
+NQ_CHIP_TYPE        whatNQChip              = UNKNOWN_NQ_CHIP_TYPE;
+uint8_t RFdeactivateCmd[ ] = { 0x21, 0x06, 0x01, 0x03};
+uint8_t EseDataRsp[ ] = { 0x03, 0x00, 0x21, 0x99, 0x50, 0xFE};
+
+/*=========================================================================
+FUNCTION   ftm_nq_nfc_close
+
+DESCRIPTION
+  Close the kernel driver for the NQ Chip
+
+PARAMETERS
+  None
+
+RETURN VALUE
+  int
+
+===========================================================================*/
+int ftm_nq_nfc_close( void )
+{
+    fdNfc = close( fdNfc );                         // close the file descriptor
+
+    LOG_MESSAGE( "%s : Exit with fdNfc = %d \n", __func__, fdNfc );
+
+    return fdNfc;                                   // return the result
+}
+
+/*=========================================================================
+FUNCTION   ftm_nq_nfc_open
+
+DESCRIPTION
+  Open the kernel driver for the NQ Chip
+
+PARAMETERS
+  None
+
+RETURN VALUE
+  int
+
+===========================================================================*/
+int ftm_nq_nfc_open( void )
+{
+    fdNfc = open( "/dev/nq-nci",                    // try to open /dev/nq-nci
+               O_RDWR );
+
+    LOG_MESSAGE( "%s : Exit with fdNfc = %d \n", __func__, fdNfc );
+
+    return fdNfc;                                   // return the result
+}
+
+/*=========================================================================
+FUNCTION   ftm_nfc_hw_reset
+
+DESCRIPTION
+  Resets the NQ Chip
+
+PARAMETERS
+  None
+
+RETURN VALUE
+  int
+
+===========================================================================*/
+int ftm_nfc_hw_reset( void )
+{
+
+    int ret = -1;                                                   // return value
+
+    do
+    {
+        if( fdNfc < 0 )                                             // fdNfc valid?
+            break;
+
+        ret = ioctl( fdNfc, NFC_SET_PWR, POWER_ON );                // turn the chip on
+        if( ret != 0 )                                              // successful?
+        {
+            LOG_ERROR( "%s ioctl( fdNfc, NFC_SET_PWR, POWER_ON ) returned %d", __func__, ret );
+            ret = -2;
+            break;
+        }
+        usleep( 1000 );                                             // wait
+
+        ret = ioctl( fdNfc, NFC_SET_PWR, POWER_OFF );               // turn the chip off
+        if( ret != 0 )                                              // successful?
+        {
+            LOG_ERROR( "%s ioctl( fdNfc, NFC_SET_PWR, POWER_OFF ) returned %d", __func__, ret );
+            ret = -3;
+            break;
+        }
+        usleep( 1000 );                                             // wait
+
+        ret = ioctl( fdNfc, NFC_SET_PWR, POWER_ON );                // turn the chip back on
+        if( ret != 0 )                                              // successful?
+        {
+            LOG_ERROR( "%s ioctl( fdNfc, NFC_SET_PWR, POWER_ON ) returned %d", __func__, ret );
+            ret = -4;
+            break;
+        }
+
+    }while( 0 );
+
+    return ret;
+}
+
+/*=========================================================================
+FUNCTION   PrintBytes
+
+DESCRIPTION
+  Print bytes from an array
+
+PARAMETERS
+  uint8_t *buf - Byte array to print
+  uint8_t  len - Length of the array
+RETURN VALUE
+  void
+
+===========================================================================*/
+void PrintBytes( uint8_t *buf, uint8_t len)
+{
+#ifdef NFC_FTM_DEBUG
+    int idx;
+
+    LOG_INFORMATION( "%s: Length: %d bytes \n", __func__, len );    // print the number of bytes
+    for( idx = 0; idx < len; idx++ )                            // print every byte
+    {
+        LOG_INFORMATION( "%02x ", buf[idx] );
+    }
+    LOG_INFORMATION( "\n" );
+#else
+    UNUSED_PARAMETER( buf );
+    UNUSED_PARAMETER( len );
+#endif
+}
+
+/*=========================================================================
+FUNCTION   ftm_nfc_send
+
+DESCRIPTION
+  Sends a message to the chip
+
+PARAMETERS
+  uint8_t *buf - buffer to be sent
+  int      len - the length of the buffer
+
+RETURN VALUE
+  int      ret - Status
+
+===========================================================================*/
+int ftm_nfc_send( uint8_t* buf )
+{
+    int             ret     = -1;                   // return value
+    int             retries = 15;                   // number of retries
+    int             i;
+    uint16_t        nciSendMessageLength;
+    PNCI_MESSAGE    pMessageToSend = ( PNCI_MESSAGE ) buf;
+    pfirmware_download_packet_t pFirmwarePacketsToSend =
+                                ( pfirmware_download_packet_t ) buf;
+
+
+    do
+    {
+        if( fdNfc < 0 )                             // fdNfc valid?
+            break;
+
+        if( NULL == buf )                           // is the buffer valid?
+        {
+            ret = -2;
+            LOG_ERROR( "%s: buf == NULL Invalid Buffer", __func__ );
+            break;
+        }
+
+        if( ( pFirmwarePacketsToSend->fFragmentedPacket == FIRMWARE_DOWNLOAD_PACKET_FRAG_FLAG_NONE ) ||
+            ( pFirmwarePacketsToSend->fFragmentedPacket == FIRMWARE_DOWNLOAD_PACKET_FRAG_FLAG_SET ) )
+            nciSendMessageLength = pFirmwarePacketsToSend->payloadLen +
+                                   FIRMWARE_DOWNLOAD_PACKET_HEADER_LEN +
+                                   FIRMWARE_DOWNLOAD_PACKET_CRC16_LEN;
+        else
+            nciSendMessageLength = pMessageToSend->len + offsetof( NCI_MESSAGE, buf );
+
+        PrintBytes( buf, nciSendMessageLength );
+
+        do
+        {
+            retries--;                              // retries left
+            ret = write( fdNfc,
+                         buf,
+                         nciSendMessageLength );    // try to write
+
+            if( ret < nciSendMessageLength )        // did you write the length?
+            {
+                LOG_MESSAGE( "%s: %d = write( fdNfc, buf, nciSendMessageLength ), errno = %d, tries left = %d \n", __func__, ret, errno, retries );
+                continue;                           // try again
+            }
+            else
+                break;                              // done
+
+        } while( retries > 0 );
+    } while( 0 );
+
+    return  ret;
+}
+
+/*=========================================================================
+FUNCTION   ProcessCommand
+
+DESCRIPTION
+  Processes a Command for the NQ Chip
+
+PARAMETERS
+  uint8_t *nci_data - NCI Data to send
+
+RETURN VALUE
+  int ret - 0 if successfully received a reply
+
+===========================================================================*/
+int ProcessCommand( uint8_t *nci_data )
+{
+    int              ret = -1;                              // return value
+    struct timespec  time_sec;
+
+    do
+    {
+        LOG_MESSAGE( "%s: FTM_NFC_SEND_DATA \n", __func__ );
+
+        ret = ftm_nfc_send( nci_data );                     // send the message
+
+        LOG_MESSAGE( "%s: Wait for response \n", __func__ );
+
+        ret = clock_gettime( CLOCK_REALTIME, &time_sec );
+
+        if( ret == -1 )
+        {                                                   // didn't get the time?
+            LOG_ERROR( "%s: clock_gettime for nci_data error \n", __func__ );
+            break;
+        }
+
+        time_sec.tv_sec += FTM_NFC_CMD_CMPL_TIMEOUT;        // maximum wait
+        ret = sem_timedwait( &sRspReady,                    // start waiting
+                             &time_sec );
+
+        if( ret == -1 )                                     // wait finished, not signalled?
+        {
+            if(!ese_dwp_test)
+                LOG_ERROR( "%s: nfc ftm command timed out \n", __func__ );
+            break;
+        }
+    } while( 0 );
+
+    return ret;
+}
+/*=========================================================================
+FUNCTION   ftm_nfc_read
+
+DESCRIPTION
+  Reads a message from the chip
+
+PARAMETERS
+  int      len - the length of the buffer
+
+RETURN VALUE
+  int      ret - Number of bytes read
+
+===========================================================================*/
+int ftm_nfc_read( uint8_t* buf, int len )
+{
+    int ret = -1;
+
+    do
+    {
+        if( fdNfc < 0 )                                // fdNfc valid?
+            break;
+
+        ret = read( fdNfc, buf, len );                 // try to read
+
+    } while( 0 );
+
+    return ret;
+}
+
+/*==========================================================================
+FUNCTION
+  CommitLog
+
+DESCRIPTION
+  This commits the log to Diag
+
+PARAMETERS
+  NCI_MESSAGE pReadNCIMessage - Pointer to the read NCI Message
+
+RETURN VALUE
+  void
+==========================================================================*/
+void CommitLog( PNCI_MESSAGE pReadNCIMessage )
+{
+    pftm_nfc_log_pkt_type         pLogBuff;
+
+    do
+    {
+        pLogBuff = ( ftm_nfc_log_pkt_type * ) log_alloc( LOG_NFC_FTM,        // allocate a buffer for the log
+                                                         pReadNCIMessage->len + offsetof( NCI_MESSAGE, buf ) + LOG_HEADER_LENGTH );
+        if( NULL == pLogBuff )
+        {
+            LOG_ERROR( "%s: log_alloc returned NULL \n", __func__ );
+            break;
+        }
+
+        memcpy( pLogBuff->data,                                             // fill the buffer
+                pReadNCIMessage,
+                pReadNCIMessage->len + offsetof( NCI_MESSAGE, buf ) );
+
+        log_commit( pLogBuff );                                             // commit the log
+    } while ( 0 );
+
+}
+
+/*=============================================================================
+FUNCTION
+  ProcessReturnedMessage
+
+DESCRIPTION
+  Routine that processes an NCI Message that was returned and
+  will decide if the message is a notification or a response.
+
+PARAMETERS
+  PNCI_MESSAGE pReadNCIMessage - Pointer to the read message
+
+RETURN VALUE
+  void
+==============================================================================*/
+void ProcessReturnedMessage( PNCI_MESSAGE pReadNCIMessage )
+{
+
+    switch( pReadNCIMessage->gid & NCIMT_NTF )      // check the first byte
+    {
+    case NCIMT_RSP:                                 // reply?
+        sem_post( &sRspReady );                     // notify the dispatch function
+        break;
+
+    case NCIMT_NTF:                                 // notification?
+        if (pReadNCIMessage->oid == 0x05)
+        {
+            LOG_INFORMATION("\n << ...TAG DETECTED... >> \n");
+            printTecnologyDetails(pReadNCIMessage->buf[3],pReadNCIMessage->buf[2]);
+            sem_post( &sRfNtf );
+            ProcessCommand( RFdeactivateCmd );
+        }
+    case NCIMT_DATA:                                // data?
+        if (ese_dwp_test)
+        {
+            if( memcmp( EseDataRsp, nciReplyMessage, sizeof( EseDataRsp ) ) == 0 )
+            {
+                LOG_INFORMATION("\n << ESE detected over DWP >> \n\n");
+            }
+        }
+        if( log_status( LOG_NFC_FTM ) )             // logging enabled?
+        {
+            CommitLog( pReadNCIMessage );
+        }
+        break;
+
+    default:
+        LOG_ERROR( "%s: ERROR - SHOULD NOT HAVE REACHED THIS POINT", __func__ );
+        break;
+    }
+
+}
+
+/*=========================================================================
+FUNCTION   nfc_read_thread
+
+DESCRIPTION
+  Thread that constantly looks for messages from the chip
+
+PARAMETERS
+  void
+
+RETURN VALUE
+  void
+
+===========================================================================*/
+void *nfc_read_thread( void *arg )
+{
+    uint8_t  readLength = 0;
+    int      i;
+    uint8_t  readNCIUpToLength = offsetof( NCI_MESSAGE, buf );
+
+    UNUSED_PARAMETER( arg );
+
+    for( ; ; )                                                                          // keep reading
+    {
+        readLength = ftm_nfc_read( nciReplyMessage, readNCIUpToLength );                // read the first 3 bytes
+
+        if( readLength == readNCIUpToLength )                                           // read the message up to NCI Len?
+        {
+            readLength = ftm_nfc_read( pNCIMessage->buf,                                // go and get the rest
+                                       pNCIMessage->len  );
+
+            if( readLength == pNCIMessage->len )                                        // successful?
+            {
+                PrintBytes( nciReplyMessage, pNCIMessage->len + readNCIUpToLength );
+
+                ProcessReturnedMessage( pNCIMessage );                                  // Process the read message
+
+            }
+        }
+    }
+
+}
+
+/*==========================================================================
+FUNCTION    PrepareRsp
+
+DESCRIPTION
+  Routine to prepare a response for diag.
+
+PARAMETERS
+  ftm_nfc_pkt_type *nfc_ftm_pkt - FTM Packet
+
+RETURN VALUE
+  void *
+==========================================================================*/
+void *PrepareRsp( ftm_nfc_pkt_type *nfc_ftm_pkt )
+{
+    void *response = NULL;
+    switch( nfc_ftm_pkt->ftm_nfc_hdr.nfc_cmd_id )
+    {
+        case FTM_NFC_NFCC_COMMAND:
+        {
+            ftm_nfc_pkt_type *nfc_nci_rsp = ( ftm_nfc_pkt_type* ) diagpkt_subsys_alloc( DIAG_SUBSYS_FTM,
+                                                      FTM_NFC_CMD_CODE,
+                                              sizeof( ftm_nfc_pkt_type ) );                                 // get a Response Buffer for NFCC Command
+
+            if( NULL == nfc_nci_rsp )
+            {
+                LOG_ERROR( "%s: diagpkt_subsys_alloc( DIAG_SUBSYS_FTM, FTM_NFC_CMD_CODE, sizeof( ftm_nfc_pkt_type ) ) returned NULL \n", __func__ );
+            }
+            else
+            {
+                nfc_nci_rsp->ftm_nfc_hdr.nfc_cmd_id  = FTM_NFC_NFCC_COMMAND;
+                nfc_nci_rsp->ftm_nfc_hdr.nfc_cmd_len = offsetof( ftm_nfc_cmd_header, nfc_cmd_len ) + offsetof( NCI_MESSAGE, buf ) + pNCIMessage->len ;
+                nfc_nci_rsp->nfc_nci_pkt_len         = offsetof( NCI_MESSAGE, buf ) + pNCIMessage->len;
+
+                memcpy( nfc_nci_rsp->nci_data,
+                        pNCIMessage,
+                        nfc_nci_rsp->nfc_nci_pkt_len );
+
+                response = ( void* ) nfc_nci_rsp;
+            }
+            break;
+        }
+
+        case FTM_NFC_REQ_CHIP_TYPE:
+        {
+            // change from a NCI packet type to a request chip type packet type
+            ftm_nfc_chip_type_pkt_type  *nfc_chip_type_rsp = ( ftm_nfc_chip_type_pkt_type* ) diagpkt_subsys_alloc( DIAG_SUBSYS_FTM,
+                                                                        FTM_NFC_CMD_CODE,
+                                                                sizeof( ftm_nfc_chip_type_pkt_type ) );     // get a Response Buffer for Request Chip Type Command
+            if( NULL == nfc_chip_type_rsp )
+            {
+                LOG_ERROR( "%s: diagpkt_subsys_alloc( DIAG_SUBSYS_FTM, FTM_NFC_CMD_CODE, sizeof( ftm_nfc_chip_type_pkt_type ) ) returned NULL \n", __func__ );
+            }
+            else
+            {
+                nfc_chip_type_rsp->nfc_chip_type_cmd_id = FTM_NFC_REQ_CHIP_TYPE;
+                nfc_chip_type_rsp->nfc_chip_type_pkt_len = 1;                           // only 1 byte for response packet data
+                if( chipType == 1 )                                                     // 1 for QTI, 2 for NQ
+                    nfc_chip_type_rsp->nfc_chip_type_pkt_data = FTM_NFC_QTI_CHIP;
+                else
+                    nfc_chip_type_rsp->nfc_chip_type_pkt_data = FTM_NFC_NQ_CHIP;
+
+                response = ( void* ) nfc_chip_type_rsp;
+            }
+            break;
+        }
+
+        case FTM_NFC_FWPIN_CTRL:
+        {
+            // change from a NCI packet type to a firmware download packet type
+            ftm_nfc_fwdl_pkt_type       *nfc_fwdl_rsp = ( ftm_nfc_fwdl_pkt_type* ) diagpkt_subsys_alloc( DIAG_SUBSYS_FTM,
+                                                          FTM_NFC_CMD_CODE,
+                                                  sizeof( ftm_nfc_fwdl_pkt_type ) );                        // get a Response Buffer for Firmware Download Pin Command
+            if( NULL == nfc_fwdl_rsp )
+            {
+                LOG_ERROR( "%s: diagpkt_subsys_alloc( DIAG_SUBSYS_FTM, FTM_NFC_CMD_CODE, sizeof( ftm_nfc_fwdl_pkt_type ) ) returned NULL \n", __func__ );
+            }
+            else
+            {
+                nfc_fwdl_rsp->nfc_fwdl_cmd_id = FTM_NFC_FWPIN_CTRL;
+                nfc_fwdl_rsp->nfc_fwdl_pkt_len = 1;                                     // only 1 byte for response packet data
+                nfc_fwdl_rsp->nfc_fwdl_pkt_data = FTM_NFC_FWDL_SUCCESS;                 // 0 for fail, 1 for success
+
+                response = ( void* ) nfc_fwdl_rsp;
+            }
+            break;
+        }
+
+        default :
+
+            LOG_ERROR( "%s: ERROR - SHOULD NOT HAVE ENDED UP HERE: default case \n", __func__ );
+            break;
+    }
+
+    return response;
+
+}
+
+/*=========================================================================
+FUNCTION   ftm_nfc_nq_vs_nxp
+
+DESCRIPTION
+  Check whether the chip is an NQ Chip
+
+PARAMETERS
+  None
+
+RETURN VALUE
+  int
+
+===========================================================================*/
+int ftm_nfc_nq_vs_nxp( void )
+{
+    int         ret = 0;
+    uint8_t     coreResetCmd[ ] = { 0x20, 0x00, 0x01, 0x00 };
+    uint8_t     coreResetRsp[ ] = { 0x40, 0x00, 0x03, 0x00, 0x11, 0x00 };
+    uint8_t     coreInitCmd[  ] = { 0x20, 0x01, 0x00 };
+
+    do
+    {
+        ret = ProcessCommand( coreResetCmd );           // send a Core Reset CMD
+
+        if( ret == -1 )                                 // wait finished, not signalled?
+        {
+            LOG_ERROR( "%s: ProcessCommand( coreResetCmd ) error %d \n", __func__, ret );
+            break;
+        }
+
+        if( memcmp( coreResetRsp, nciReplyMessage, sizeof( coreResetRsp ) ) )
+        {                                                // not a good reply?
+            coreResetRsp[4] = 0x10;
+            if( memcmp( coreResetRsp, nciReplyMessage, sizeof( coreResetRsp ) ) )
+            {                                            // check if NCI version is 1.0
+                ret = -1;
+                LOG_ERROR( "%s: bad reply for coreResetRsp", __func__ );
+                break;
+            }
+        }
+
+        ret = ProcessCommand( coreInitCmd );             // send the message
+
+        if( ret == -1 )                                  // wait finished, not signalled?
+        {
+            LOG_ERROR( "%s: ProcessCommand( coreInitCmd ) error %d \n", __func__, ret );
+            break;
+        }
+
+        switch( nciReplyMessage[ CHIP_ID ] )             // what type of chip is it?
+        {
+        case 0x48:
+            whatNQChip = NQ_210;
+            LOG_INFORMATION( "Connected to NQ210 \n" );
+            break;
+
+        case 0x58:
+            whatNQChip = NQ_220;
+            LOG_INFORMATION( "Connected to NQ220 \n" );
+            break;
+
+        case 0x40:
+        case 0x41:
+            whatNQChip = NQ_310;
+            LOG_INFORMATION( "Connected to NQ310 \n" );
+            break;
+
+        case 0x50:
+        case 0x51:
+            whatNQChip = NQ_330;
+            LOG_INFORMATION( "Connected to NQ330 \n" );
+            break;
+
+        default:
+            whatNQChip = UNKNOWN_NQ_CHIP_TYPE;
+            ret     = -1;
+            LOG_INFORMATION( "ERROR Connected to an unknown NQ Chip \n" );
+            break;
+        }
+    }while( 0 );
+
+    return ret;
+}
+
+/*=========================================================================
+FUNCTION   ftm_nfc_set_fwdl_pin
+
+DESCRIPTION
+  Sets or resets the firmware download pin high or low
+
+PARAMETERS
+  ftm_nfc_pkt_type *nfc_ftm_pkt - FTM Packet
+
+RETURN VALUE
+  void
+
+===========================================================================*/
+void ftm_nfc_set_fwdl_pin( ftm_nfc_pkt_type *nfc_ftm_pkt )
+{
+    int                         ret = 0;
+    // change from a NCI packet type to a firmware download packet type
+    pftm_nfc_fwdl_pkt_type      pnfc_fwdl_pkt = ( pftm_nfc_fwdl_pkt_type ) nfc_ftm_pkt;
+
+    switch ( pnfc_fwdl_pkt->nfc_fwdl_pkt_data )
+    {
+        case 0:
+
+            ret = ftm_nfc_hw_reset( );                          // Can you reset the hardware?
+            if( ret < 0 )                                       // successful?
+            {
+                LOG_ERROR( "%s: ftm_nfc_hw_reset() failed with ret = %d \n", __func__, ret );
+                break;
+            }
+
+            LOG_MESSAGE( "%s: Firmware download pin set LOW\n", __func__ );
+            break;
+
+
+        case 1:
+
+            ret = ioctl( fdNfc, NFC_SET_PWR, FIRMWARE_MODE );
+            if( ret != 0 )                                      // successful?
+            {
+                LOG_ERROR( "%s ioctl( fdNfc, NFC_SET_PWR, FIRMWARE_MODE ) returned %d", __func__, ret );
+                break;
+            }
+
+            LOG_MESSAGE( "%s: Firmware download pin set HIGH\n", __func__ );
+            break;
+
+        default :
+
+            LOG_ERROR( "%s: ERROR - SHOULD NOT HAVE ENDED UP HERE: default case \n", __func__ );
+            break;
+    }
+
+    ret = ftm_nq_nfc_close( );                                  // close the handle
+    if( ret != 0 )                                              // not successful?
+    {
+        LOG_ERROR( "\n\t %s: ftm_nq_nfc_close() failed with ret = %d \n", __func__, ret );
+    }
+
+    ret = ftm_nq_nfc_open( );                                   // open the kernel driver
+    if( ret < 0 )                                               // successful?
+    {
+        LOG_ERROR( "\n\t %s: ftm_nq_nfc_open() failed with ret = %d \n", __func__, ret );
+    }
+}
+
+/*=========================================================================
+FUNCTION   ftm_nfc_dispatch_nq
+
+DESCRIPTION
+  Dispatches QRCT commands and Chip Replies/Notifications/Data
+
+PARAMETERS
+  ftm_nfc_pkt_type *nfc_ftm_pkt - FTM Packet
+  uint16            pkt_len     - FTM Packet Length
+
+RETURN VALUE
+  void *
+
+===========================================================================*/
+void* ftm_nfc_dispatch_nq( ftm_nfc_pkt_type *nfc_ftm_pkt, uint16 pkt_len )
+{
+    int                 ret = 0;
+    int                 len = 0;
+    struct timespec     time_sec;
+    char               *SkipNQHardwareCheck = NULL;
+
+    void *rsp             = NULL;
+    UNUSED_PARAMETER( pkt_len );
+
+    do
+    {
+        if( !fdNfc )                                               // Already initialized?
+        {
+            ret = ftm_nq_nfc_open( );                           // open the kernel driver
+            if( ret < 0 )                                       // successful?
+            {
+                LOG_ERROR( "\n\t %s: ftm_nq_nfc_open() failed with ret = %d \n", __func__, ret );
+                break;
+            }
+
+            ret = ftm_nfc_hw_reset( );                          // Can you reset the hardware?
+            if( ret < 0 )                                       // successful?
+            {
+                LOG_ERROR( "%s: ftm_nfc_hw_reset() failed with ret = %d \n", __func__, ret );
+                break;
+            }
+
+            pNCIMessage     = ( PNCI_MESSAGE ) nciReplyMessage;
+
+            ret = pthread_create( &clientThread,                // Start the Read Thread
+                                   NULL,
+                                  &nfc_read_thread,
+                                   NULL );
+            if( ret != 0 )                                      // successful?
+            {
+                LOG_MESSAGE( "%s: pthread_create( nfc_read_thread ) failed with ret = %d \n", __func__, ret );
+                break;
+            }
+
+            SkipNQHardwareCheck = getenv( SKIP_NQ_HARDWARE_CHECK );
+            LOG_MESSAGE( "%s: SkipNQHardwareCheck = %s \n", __func__, SkipNQHardwareCheck );
+
+            if(  NULL == SkipNQHardwareCheck )                  // no value so check for NQ Chip?
+            {
+                ret = ftm_nfc_nq_vs_nxp( );
+                if( ret < 0 )                                   // Not an NQ Chip?
+                {
+                    LOG_ERROR( "ERROR NOT A KNOWN NQ Chip \n" );
+                    break;
+                }
+            }
+            else
+            {
+                LOG_INFORMATION( " Skipping NQ Chip Check \n" );
+                whatNQChip = SKIP_CHIP_CHECK;
+            }
+
+            LOG_INFORMATION( "FTM for NFC SUCCESSFULLY STARTED \n" );
+        }
+
+        if( UNKNOWN_NQ_CHIP_TYPE == whatNQChip )
+        {
+            LOG_ERROR( "ERROR This version of the chip is not accepted" );
+            break;
+        }
+
+        if( NULL == nfc_ftm_pkt )                               // valid packet?
+        {
+            LOG_ERROR( "%s: Error : nfc_ftm_pkt is NULL \n", __func__ );
+            break;
+        }
+
+        if( offsetof( ftm_nfc_pkt_type, ftm_nfc_hdr ) < MIN_CMD_PKT_LEN )
+        {                                                       // packet contains anything?
+            LOG_ERROR( "%s: Error : Invalid FTM Packet \n", __func__ );
+            break;
+        }
+
+        switch( nfc_ftm_pkt->ftm_nfc_hdr.nfc_cmd_id )           // what type of packet is it?
+        {
+
+        case FTM_NFC_NFCC_COMMAND:                              // NFC Command?
+        case FTM_NFC_SEND_DATA:                                 // NFC Data?
+
+            ret = ProcessCommand( nfc_ftm_pkt->nci_data );
+            if( ret == -1 )                                     // wait finished, not signalled?
+            {
+                LOG_ERROR( "%s: ProcessCommand( nfc_ftm_pkt->nci_data ) error %d \n", __func__, ret );
+                break;
+            }
+            rsp = PrepareRsp( nfc_ftm_pkt );                    // Prepare the response for Diag
+
+            break;
+
+        case FTM_NFC_REQ_CHIP_TYPE:
+        case FTM_NFC_FWPIN_CTRL:
+
+            ftm_nfc_set_fwdl_pin( nfc_ftm_pkt );
+
+            rsp = PrepareRsp( nfc_ftm_pkt );                    // Prepare the response for Diag
+            break;
+
+        default :
+            LOG_ERROR( "%s: ERROR - SHOULD NOT HAVE ENDED UP HERE: default case \n", __func__ );
+            break;
+
+        }
+    } while( 0 );
+
+    return rsp;
+}

feeds/ipq95xx/ftm/src/ftm_nfcnq.h

@@ -0,0 +1,168 @@
+/*=========================================================================
+                       NQ NFC FTM Header File
+Description
+   This file contains the declarations of the functions
+   used to communicate with the NQ Chip and various definitions.
+
+Copyright (c) 2015-2017 Qualcomm Technologies, Inc.
+All Rights Reserved.
+Confidential and Proprietary - Qualcomm Technologies, Inc.
+
+===========================================================================*/
+/*===========================================================================
+                         Edit History
+when        who              what,              where,     why
+--------   ---     ----------------------------------------------------------
+===========================================================================*/
+
+#ifndef _FTM_NFCNQ
+#define _FTM_NFCNQ
+
+#include "msg.h"
+#include "diagpkt.h"
+#include "diagcmd.h"
+#include "errno.h"
+#include <linux/ioctl.h>
+#include <pthread.h>
+#include <semaphore.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "log.h"
+
+#define LOG_ERROR( ... )             printf( __VA_ARGS__ )
+#define LOG_INFORMATION( ... )       printf( __VA_ARGS__ )
+
+#ifdef NFC_FTM_DEBUG
+#define LOG_MESSAGE( ... )           printf( __VA_ARGS__ )
+#else
+#define LOG_MESSAGE( ... )           do{ } while ( FALSE )
+#endif
+
+typedef PACKED struct _ftm_nfc_cmd_header{
+    uint16                          nfc_cmd_id;
+    uint16                          nfc_cmd_len;
+} ftm_nfc_cmd_header, *pftm_nfc_cmd_header;
+
+typedef PACKED struct{
+    diagpkt_subsys_header_type      diag_hdr;
+    ftm_nfc_cmd_header              ftm_nfc_hdr;
+    uint16                          nfc_nci_pkt_len;
+    byte                            nci_data[258];
+}ftm_nfc_pkt_type, *pftm_nfc_pkt_type;
+
+typedef PACKED struct{
+    diagpkt_subsys_header_type      diag_hdr;
+    uint16                          nfc_fwdl_cmd_id;
+    byte                            nfc_fwdl_pkt_len;
+    byte                            nfc_fwdl_pkt_data;
+}ftm_nfc_fwdl_pkt_type, *pftm_nfc_fwdl_pkt_type;
+
+typedef PACKED struct{
+    diagpkt_subsys_header_type      diag_hdr;
+    uint16                          nfc_chip_type_cmd_id;
+    byte                            nfc_chip_type_pkt_len;
+    byte                            nfc_chip_type_pkt_data;
+}ftm_nfc_chip_type_pkt_type, *pftm_nfc_chip_type_pkt_type;
+
+typedef PACKED struct{
+    log_hdr_type                    hdr;
+    byte                            data[1];
+} ftm_nfc_log_pkt_type, *pftm_nfc_log_pkt_type;
+
+typedef PACKED struct _NCI_MESSAGE
+{
+            byte                    gid;            // Group ID
+            byte                    oid;            // Operation ID
+            byte                    len;            // payload length in bytes
+            byte                    buf[ 252 ];     // Payload Buffer
+} NCI_MESSAGE, *PNCI_MESSAGE;
+
+typedef enum
+{
+  NCIMT_DATA                      = 0x00, /**< DATA packet. */
+  NCIMT_CMD                       = 0x20, /**< Control packet - Command. */
+  NCIMT_RSP                       = 0x40, /**< Control packet - Response. */
+  NCIMT_NTF                       = 0x60, /**< Control packet - Notification. */
+
+  NCIMT_INVALID_VALUE             = 0xFF, /**< Invalid packet type. */
+
+  NCIMT_BITMASK                   = 0xE0, /**< Most significant three bits. */
+  NCIMT_BITSHIFT                  = 5
+
+} NCIMT;
+
+typedef enum
+{
+    UNKNOWN_NQ_CHIP_TYPE =  0,
+    SKIP_CHIP_CHECK      =  1,
+    NQ_110               = 11,
+    NQ_120               = 12,
+    NQ_210               = 21,
+    NQ_220               = 22,
+    NQ_310               = 31,
+    NQ_330               = 33,
+    MAXIMUM_NQ_CHIP_TYPE
+} NQ_CHIP_TYPE;
+
+struct nqx_devinfo
+{
+    unsigned char chip_type;
+    unsigned char rom_version;
+    unsigned char fw_major;
+    unsigned char fw_minor;
+};
+
+union nqx_uinfo
+{
+    unsigned int i;
+    struct nqx_devinfo info;
+};
+
+int     ftm_nq_nfc_open( void );
+int     ftm_nq_nfc_close( void );
+int     ftm_nfc_hw_reset( void );
+int     ProcessCommand( uint8_t *nci_data );
+void   *PrepareRsp( ftm_nfc_pkt_type *nfc_ftm_pkt );
+void   *ftm_nfc_dispatch_nq( ftm_nfc_pkt_type *nfc_ftm_pkt, uint16 pkt_len);
+void   *nfc_read_thread( void *arg );
+extern sem_t               sRfNtf;
+extern int          ese_dwp_test;
+extern void printTecnologyDetails(char technology, char protocol);
+
+#define FTM_NFC_CMD_CODE                            55
+#define FTM_NFC_NFCC_COMMAND                        0x02
+#define FTM_NFC_SEND_DATA                           0x03
+#define FTM_NFC_REQ_CHIP_TYPE                       0x04
+#define FTM_NFC_FWPIN_CTRL                          0x05
+#define FTM_NFC_CMD_CMPL_TIMEOUT                    3
+
+#define FTM_NFC_QTI_CHIP                            0x00
+#define FTM_NFC_NQ_CHIP                             0x01
+#define FTM_NFC_FWDL_SUCCESS                        0x01
+
+#define MIN_CMD_PKT_LEN                             4           // Minimum length for a valid FTM packet, 2 bytes for Diag header, 2 bytes for command ID
+
+#define LOG_NFC_FTM                                 0x1802
+#define LOG_HEADER_LENGTH                           12
+
+#define NFC_SET_PWR                                _IOW(0xE9, 0x01, unsigned int)
+#define NFCC_GET_INFO                              _IOW(0xE9, 0x09, unsigned int)
+#define POWER_OFF                                    0
+#define POWER_ON                                     1
+#define FIRMWARE_MODE                                2
+
+#define EXPECTED_CORE_INIT_RSP_LEN                  29
+#define CHIP_ID                                     24
+
+#define SKIP_NQ_HARDWARE_CHECK                      "SkipNQHardwareCheck"
+#define HARDWARE_TYPE_TIMEOUT                        2
+
+#define UNUSED_PARAMETER( x )      ( void )( x )
+
+#endif // _FTM_NFCNQ

feeds/ipq95xx/ftm/src/ftm_nfcnq_fwdl.c

@@ -0,0 +1,664 @@
+/*
+ * Copyright (c) 2016-2017 Qualcomm Technologies, Inc.
+ * All Rights Reserved.
+ * Confidential and Proprietary - Qualcomm Technologies, Inc.
+ *
+ * Not a Contribution.
+ * Apache license notifications and license are retained
+ * for attribution purposes only.
+ */
+
+/*
+ * Copyright (C) 2015 NXP Semiconductors
+ * The original Work has been changed by NXP Semiconductors.
+ *
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*=========================================================================
+  FTM NFC NQ Firmware Download Source File
+  Description
+  This file contains the definitions of the functions
+  used to download firmware onto the NQ Chip.
+===========================================================================*/
+
+#include "ftm_nfcnq_fwdl.h"
+#include "ftm_nfcnq.h"
+
+unsigned int chip_version           = 0x00;
+
+/* lookup table for CRC-16-CCITT calculation */
+static uint16_t const crcTable[ 256 ] =
+    { 0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50a5, 0x60c6, 0x70e7, 0x8108, 0x9129, 0xa14a, 0xb16b, 0xc18c, 0xd1ad,
+    0xe1ce, 0xf1ef, 0x1231, 0x0210, 0x3273, 0x2252, 0x52b5, 0x4294, 0x72f7, 0x62d6, 0x9339, 0x8318, 0xb37b,
+    0xa35a, 0xd3bd, 0xc39c, 0xf3ff, 0xe3de, 0x2462, 0x3443, 0x0420, 0x1401, 0x64e6, 0x74c7, 0x44a4, 0x5485,
+    0xa56a, 0xb54b, 0x8528, 0x9509, 0xe5ee, 0xf5cf, 0xc5ac, 0xd58d, 0x3653, 0x2672, 0x1611, 0x0630, 0x76d7,
+    0x66f6, 0x5695, 0x46b4, 0xb75b, 0xa77a, 0x9719, 0x8738, 0xf7df, 0xe7fe, 0xd79d, 0xc7bc, 0x48c4, 0x58e5,
+    0x6886, 0x78a7, 0x0840, 0x1861, 0x2802, 0x3823, 0xc9cc, 0xd9ed, 0xe98e, 0xf9af, 0x8948, 0x9969, 0xa90a,
+    0xb92b, 0x5af5, 0x4ad4, 0x7ab7, 0x6a96, 0x1a71, 0x0a50, 0x3a33, 0x2a12, 0xdbfd, 0xcbdc, 0xfbbf, 0xeb9e,
+    0x9b79, 0x8b58, 0xbb3b, 0xab1a, 0x6ca6, 0x7c87, 0x4ce4, 0x5cc5, 0x2c22, 0x3c03, 0x0c60, 0x1c41, 0xedae,
+    0xfd8f, 0xcdec, 0xddcd, 0xad2a, 0xbd0b, 0x8d68, 0x9d49, 0x7e97, 0x6eb6, 0x5ed5, 0x4ef4, 0x3e13, 0x2e32,
+    0x1e51, 0x0e70, 0xff9f, 0xefbe, 0xdfdd, 0xcffc, 0xbf1b, 0xaf3a, 0x9f59, 0x8f78, 0x9188, 0x81a9, 0xb1ca,
+    0xa1eb, 0xd10c, 0xc12d, 0xf14e, 0xe16f, 0x1080, 0x00a1, 0x30c2, 0x20e3, 0x5004, 0x4025, 0x7046, 0x6067,
+    0x83b9, 0x9398, 0xa3fb, 0xb3da, 0xc33d, 0xd31c, 0xe37f, 0xf35e, 0x02b1, 0x1290, 0x22f3, 0x32d2, 0x4235,
+    0x5214, 0x6277, 0x7256, 0xb5ea, 0xa5cb, 0x95a8, 0x8589, 0xf56e, 0xe54f, 0xd52c, 0xc50d, 0x34e2, 0x24c3,
+    0x14a0, 0x0481, 0x7466, 0x6447, 0x5424, 0x4405, 0xa7db, 0xb7fa, 0x8799, 0x97b8, 0xe75f, 0xf77e, 0xc71d,
+    0xd73c, 0x26d3, 0x36f2, 0x0691, 0x16b0, 0x6657, 0x7676, 0x4615, 0x5634, 0xd94c, 0xc96d, 0xf90e, 0xe92f,
+    0x99c8, 0x89e9, 0xb98a, 0xa9ab, 0x5844, 0x4865, 0x7806, 0x6827, 0x18c0, 0x08e1, 0x3882, 0x28a3, 0xcb7d,
+    0xdb5c, 0xeb3f, 0xfb1e, 0x8bf9, 0x9bd8, 0xabbb, 0xbb9a, 0x4a75, 0x5a54, 0x6a37, 0x7a16, 0x0af1, 0x1ad0,
+    0x2ab3, 0x3a92, 0xfd2e, 0xed0f, 0xdd6c, 0xcd4d, 0xbdaa, 0xad8b, 0x9de8, 0x8dc9, 0x7c26, 0x6c07, 0x5c64,
+    0x4c45, 0x3ca2, 0x2c83, 0x1ce0, 0x0cc1, 0xef1f, 0xff3e, 0xcf5d, 0xdf7c, 0xaf9b, 0xbfba, 0x8fd9, 0x9ff8,
+    0x6e17, 0x7e36, 0x4e55, 0x5e74, 0x2e93, 0x3eb2, 0x0ed1, 0x1ef0 };
+
+
+/*==========================================================================================================
+FUNCTION
+    load_firmware_from_library
+
+DESCRIPTION
+    gets a pointer to the firmware image and the length of the image
+
+PARAMETERS
+    const char      *pathToLib          - path to the firmware image library
+    uint8_t        **ppFirmwareImage    - pointer to the pointer to the firmware image
+    uint16_t        *pFirmwareImageLen  - pointer to the firmware image length
+
+RETURN VALUE
+    void
+
+==========================================================================================================*/
+static void load_firmware_from_library( const char *pathToLib, uint8_t **ppFirmwareImage,
+                                        uint16_t   *pFirmwareImageLen )
+{
+    void    *pFirmwareLibHandle     = NULL;
+    void    *pTempFirmwareImage     = NULL;
+    void    *pTempFirmwareImageLen  = NULL;
+    int      status                 = -1;
+
+    do
+    {
+        if( NULL == pathToLib )
+        {
+            if(chip_version == 0x51 || chip_version == 0x50 || chip_version == 0x41 || chip_version == 0x40 )
+                pathToLib = "/system/vendor/firmware/libpn553_fw.so";                               // set the path to pn553 firmware library
+            else
+                pathToLib = "/system/vendor/firmware/libpn548ad_fw.so";                             // set the default path to pn548ad firmware library
+        }
+
+        if( NULL != pFirmwareLibHandle )
+        {
+            status = dlclose( pFirmwareLibHandle );                                                 // if the firmware library handle is not NULL, release the handle
+            pFirmwareLibHandle = NULL;
+
+            dlerror( );                                                                             // clear existing errors
+            if( 0 != status )
+            {
+                LOG_ERROR( "%s: dlclose() failed with status = %d \n", __FUNCTION__, status );
+                break;
+            }
+        }
+
+        pFirmwareLibHandle = dlopen( pathToLib, RTLD_LAZY );                                        // get a handle to firmware library
+        LOG_MESSAGE( "Opening library handle from %s\n", pathToLib );
+
+        if( NULL == pFirmwareLibHandle )
+        {
+            LOG_ERROR( "%s: dlopen() failed  \n", __FUNCTION__ );
+            break;
+        }
+        dlerror( );                                                                                 // clear existing errors
+
+        pTempFirmwareImage = ( void * )dlsym( pFirmwareLibHandle, "gphDnldNfc_DlSeq" );             // get a pointer to the firmware library
+
+        if( dlerror( ) || ( NULL == pTempFirmwareImage ) )
+        {
+            LOG_ERROR( "%s: dlsym() failed, failed to load gphDnldNfc_DlSeq symbol \n", __FUNCTION__ );
+            break;
+        }
+        *ppFirmwareImage = *( uint8_t ** )pTempFirmwareImage;                                       // the returned pointer is a pointer to an uint8_t array
+
+        pTempFirmwareImageLen = ( void * ) dlsym( pFirmwareLibHandle, "gphDnldNfc_DlSeqSz" );       // get a pointer to the firmware library length
+
+        if( dlerror( ) || ( NULL == pTempFirmwareImageLen ) )
+        {
+            LOG_ERROR( "%s: dlsym() failed, failed to load gphDnldNfc_DlSeqSz symbol \n", __FUNCTION__ );
+            break;
+        }
+        *pFirmwareImageLen = ( uint16_t )( *( ( uint16_t * )pTempFirmwareImageLen ) );              // the returned pointer is a pointer to the length of the image
+
+    } while( FALSE );
+}
+
+/*==========================================================================================================
+FUNCTION
+    send_packet_packet_to_chip
+
+DESCRIPTION
+    sends the constructed packets to the NFC chip by calling ProcessCommand() from ftm_nfcnq.c
+
+PARAMETERS
+    pfirmware_download_context_t pDownloadContext - pointer to structure containing all the
+                                                    information required
+
+RETURN VALUE
+    void
+
+==========================================================================================================*/
+static void send_packet_packet_to_chip( pfirmware_download_context_t pDownloadContext )
+{
+    int status = -1;
+
+    status = ProcessCommand( &pDownloadContext->packetToSend );                                     // call ProcessCommand() from ftm_nfcnq.c
+    if( 0 != status )
+    {
+        LOG_ERROR( "%s: ProcessCommand() failed with status = %d \n", __FUNCTION__, status );
+    }
+}
+
+/*==========================================================================================================
+FUNCTION
+    calculate_crc16
+
+DESCRIPTION
+    calculates CRC-16-CCITT of a given buffer with a given length with seed value of 0xffff(Hex)
+
+PARAMETERS
+    uint8_t *pBuff      - buffer for CRC-16-CCITT calculation
+    uint16_t buffLen    - length of buffer for CRC-16-CCITT calculation
+
+RETURN VALUE
+    uint16_t            - calculated CRC-16-CCITT value of buffer
+
+==========================================================================================================*/
+static uint16_t calculate_crc16( uint8_t *pBuff, uint16_t buffLen )
+{
+    uint16_t temp   = 0;
+    uint16_t value  = 0;
+    uint16_t crc    = 0xffff;                                                                       // seed value
+    uint32_t i      = 0;
+
+    if ( ( NULL == pBuff ) || ( 0 == buffLen ) )
+    {
+        LOG_ERROR( "%s: Invalid parameters \n", __FUNCTION__ );
+    }
+    else
+    {
+        for( i = 0; i < buffLen; i++ )
+        {
+            value   = 0x00ffU & ( uint16_t )pBuff[ i ];
+            temp    = ( crc >> 8U ) ^ value;
+            crc     = ( crc << 8U ) ^ crcTable[ temp ];
+        }
+    }
+
+    return crc;
+}
+
+/*==========================================================================================================
+FUNCTION
+    insert_crc16
+
+DESCRIPTION
+    inserts the calculated CRC-16-CCITT value into the end of the buffer
+
+PARAMETERS
+    pfirmware_download_context_t pDownloadContext - pointer to structure containing all the
+                                                    information required
+
+RETURN VALUE
+    void
+
+==========================================================================================================*/
+static void insert_crc16( pfirmware_download_context_t pDownloadContext )
+{
+    uint16_t    crcValueToWrite = 0;
+    uint8_t    *crcValueInBytes = NULL;
+
+    /* get CRC-16-CCITT value of packet and convert it into 2 bytes */
+    crcValueToWrite = calculate_crc16( &pDownloadContext->packetToSend,
+                                        pDownloadContext->headerPlusPayloadLen );
+    crcValueInBytes = ( uint8_t * )&crcValueToWrite;
+
+    /* insert crc value into last 2 bytes of the packet */
+    if( pDownloadContext->packetToSend.payloadLen < ( FIRMWARE_DOWNLOAD_PACKET_MAX_PAYLOAD_LEN + FIRMWARE_DOWNLOAD_PACKET_CRC16_LEN - 1 ))
+    {
+        pDownloadContext->packetToSend.payloadBuff[ pDownloadContext->packetToSend.payloadLen ]     = crcValueInBytes[ 1 ];
+        pDownloadContext->packetToSend.payloadBuff[ pDownloadContext->packetToSend.payloadLen + 1 ] = crcValueInBytes[ 0 ];
+    }
+    else
+    {
+        LOG_ERROR( "%s: Packet to send payloadLen more than maximum payloadBuff size \n", __FUNCTION__ );
+    }
+}
+
+/*==========================================================================================================
+FUNCTION
+    read_response_from_chip
+
+DESCRIPTION
+    reader thread that constantly checks for responses from NFC chip, checks the integrity of the
+    response packets by matching the CRC-16-CCITT values and signals the semaphore held by
+    the call to ProcessCommand()
+
+PARAMETERS
+    pfirmware_download_context_t pDownloadContext - pointer to structure containing all the
+                                                    information required
+
+RETURN VALUE
+    void
+
+==========================================================================================================*/
+static void read_response_from_chip( pfirmware_download_context_t pDownloadContext )
+{
+    uint8_t     lenRead                 = 0;
+    uint8_t    *pPacketReceived         = NULL;
+    uint16_t    calculatedCrcValue      = 0;
+    uint16_t    crcValueFromResponse    = 0;
+
+    do
+    {
+        if( fdNfc < 0 )
+        {
+            LOG_ERROR( "%s: Invalid handle \n", __FUNCTION__ );
+            break;
+        }
+
+        lenRead = read( fdNfc, &pDownloadContext->packetReceived,                               // get the response packet header
+                        FIRMWARE_DOWNLOAD_PACKET_HEADER_LEN );
+
+        if( 0 == lenRead )
+        {
+            LOG_ERROR( "%s: Error reading response packet header \n", __FUNCTION__ );
+            break;
+        }
+        else
+        {
+            pDownloadContext->totalPacketLen = lenRead;
+        }
+
+        lenRead = read( fdNfc, &pDownloadContext->packetReceived.payloadBuff,                   // get the rest fo the response packet
+                      ( pDownloadContext->packetReceived.payloadLen +
+                        FIRMWARE_DOWNLOAD_PACKET_CRC16_LEN ) );
+
+        if( 0 == lenRead )
+        {
+            LOG_ERROR( "%s: Error reading response packet payload \n", __FUNCTION__ );
+            break;
+        }
+        else
+        {
+            pDownloadContext->totalPacketLen += lenRead;                                        // update the total length of the received packet
+        }
+
+        calculatedCrcValue = calculate_crc16( &pDownloadContext->packetReceived,                // calculate the CRC-16-CCITT value of the received packet
+                                             ( pDownloadContext->packetReceived.payloadLen +
+                                               FIRMWARE_DOWNLOAD_PACKET_HEADER_LEN ) );
+
+        /* convert crc value from the response packet to an uint16_t */
+        if( pDownloadContext->packetReceived.payloadLen < ( FIRMWARE_DOWNLOAD_PACKET_MAX_PAYLOAD_LEN + FIRMWARE_DOWNLOAD_PACKET_CRC16_LEN - 1 ))
+        {
+            crcValueFromResponse   = pDownloadContext->packetReceived.payloadBuff[ pDownloadContext->packetReceived.payloadLen ];
+            crcValueFromResponse <<= 8;
+            crcValueFromResponse  |= pDownloadContext->packetReceived.payloadBuff[ pDownloadContext->packetReceived.payloadLen + 1 ];
+        }
+        else
+        {
+            LOG_ERROR( "%s: Packet received payloadLen more than maximum payloadBuff size \n", __FUNCTION__ );
+        }
+
+        if( calculatedCrcValue != crcValueFromResponse )                                        // compare the CRC-16-CCITT values
+        {
+            LOG_ERROR( "%s: CRC-16-CCITT values do not match, discarding packet \n", __FUNCTION__ );
+            break;
+        }
+        else
+        {
+            sem_post( &sRspReady );                                                             // signal the semaphore for subsequent packets to be sent
+        }
+
+    } while( FALSE == pDownloadContext->fExitReadThread );                                      // exit only when the flag is set
+}
+
+/*==========================================================================================================
+FUNCTION
+    get_device_firmware_version
+
+DESCRIPTION
+    sends the get-firmware-version command (0xF1) to the device and outputs the firmware version of
+    the device
+
+PARAMETERS
+    pfirmware_download_context_t pDownloadContext - pointer to structure containing all the
+                                                    information required
+
+RETURN VALUE
+    void
+
+==========================================================================================================*/
+static void get_device_firmware_version( pfirmware_download_context_t pDownloadContext )
+{
+    uint8_t getFirmwareVersionCommand[ ]    = { 0x00, 0x04, 0xF1, 0x00, 0x00, 0x00 };           // command to get firmware version on device
+    uint8_t firmwareMajorVersion            = 0;
+    uint8_t firmwareMinorVersion            = 0;
+
+    pDownloadContext->headerPlusPayloadLen =
+              sizeof( getFirmwareVersionCommand ) / sizeof( getFirmwareVersionCommand[ 0 ] );
+
+    memcpy( &pDownloadContext->packetToSend, &getFirmwareVersionCommand,                        // construct the command packet
+           ( pDownloadContext->headerPlusPayloadLen ) );
+
+    insert_crc16( pDownloadContext );                                                           // insert the CRC-16-CCITT value
+
+    send_packet_packet_to_chip( pDownloadContext );                                             // send the command packet to NFC chip
+
+    /* continues from here once the reader thread reads the response and flags the semaphore,
+       the last 2 bytes of the get version response payload contains the firmware version currently on the device */
+    firmwareMajorVersion = pDownloadContext->packetReceived.payloadBuff[ pDownloadContext->packetReceived.payloadLen - 1 ];
+    firmwareMinorVersion = pDownloadContext->packetReceived.payloadBuff[ pDownloadContext->packetReceived.payloadLen - 2 ];
+
+    if(chip_version == 0x51 || chip_version == 0x50 || chip_version == 0x41 || chip_version == 0x40 )
+        LOG_INFORMATION( "Firmware version: 11.%02X.%02X\n", firmwareMajorVersion, firmwareMinorVersion );
+    else
+        LOG_INFORMATION( "Firmware version: 10.%02X.%02X\n", firmwareMajorVersion, firmwareMinorVersion );
+}
+
+/*==========================================================================================================
+FUNCTION
+    build_first_packet
+
+DESCRIPTION
+    constructs the first packet to be sent to the NFC chip
+
+PARAMETERS
+    pfirmware_download_context_t pDownloadContext - pointer to structure containing all the
+                                                    information required
+
+RETURN VALUE
+    void
+
+==========================================================================================================*/
+static void build_first_packet( pfirmware_download_context_t pDownloadContext )
+{
+    memset( pDownloadContext->packetToSend.payloadBuff, 0,                                      // initialise the payload buffer to zero
+            FIRMWARE_DOWNLOAD_PACKET_MAX_PAYLOAD_LEN );
+
+    memcpy( &pDownloadContext->packetToSend,                                                    // copy the first chunk from the firmware library to the packet
+             pDownloadContext->pFirmwareImage,
+             pDownloadContext->headerPlusPayloadLen );
+
+    insert_crc16( pDownloadContext );                                                           // insert the CRC-16-CCITT value
+}
+
+/*==========================================================================================================
+FUNCTION
+    build_next_packet
+
+DESCRIPTION
+    constructs subsequent packets required to be sent to the NFC chip
+
+PARAMETERS
+    pfirmware_download_context_t pDownloadContext - pointer to structure containing all the
+                                                    information required
+
+RETURN VALUE
+    void
+
+==========================================================================================================*/
+static void build_next_packet( pfirmware_download_context_t pDownloadContext )
+{
+    /* for chunks from library that are larger than 256 bytes, the packets have to be fragmented */
+    if( pDownloadContext->bytesLeftToSend > FIRMWARE_DOWNLOAD_PACKET_MAX_PAYLOAD_LEN )
+    {
+        pDownloadContext->headerPlusPayloadLen = FIRMWARE_DOWNLOAD_PACKET_MAX_PAYLOAD_LEN +         // length of header plus the payload for CRC-16-CCITT calculation
+                                                 FIRMWARE_DOWNLOAD_PACKET_HEADER_LEN;
+
+        pDownloadContext->totalPacketLen = FIRMWARE_DOWNLOAD_MAX_PACKET_LEN;                        // length of the entire packet to be sent
+
+        pDownloadContext->packetToSend.fFragmentedPacket = FIRMWARE_DOWNLOAD_PACKET_FRAG_FLAG_SET;  // set the fragment flag as the first byte
+
+        pDownloadContext->packetToSend.payloadLen = FIRMWARE_DOWNLOAD_PACKET_MAX_PAYLOAD_LEN;       // insert the payload length in the second byte
+
+        memcpy( ( &pDownloadContext->packetToSend.payloadBuff ),                                    // copy payload from firmware library
+                  &pDownloadContext->pFirmwareImage[ pDownloadContext->readIndexFromLib ],
+                   FIRMWARE_DOWNLOAD_PACKET_MAX_PAYLOAD_LEN );
+
+        pDownloadContext->readIndexFromLib += FIRMWARE_DOWNLOAD_PACKET_MAX_PAYLOAD_LEN;             // update the buffer index used to read from firmware library
+
+        pDownloadContext->bytesLeftToSend -= FIRMWARE_DOWNLOAD_PACKET_MAX_PAYLOAD_LEN;              // update the number of bytes left to send from the chunk
+    }
+
+    /* for chunks from library that are smaller than 256 bytes, no fragmentation needed */
+    else
+    {
+        pDownloadContext->headerPlusPayloadLen = pDownloadContext->bytesLeftToSend +                // length of header plus the payload for CRC-16-CCITT calculation
+                                                 FIRMWARE_DOWNLOAD_PACKET_HEADER_LEN;
+
+        pDownloadContext->totalPacketLen = pDownloadContext->bytesLeftToSend +                      // length of the entire packet to be sent
+                                           FIRMWARE_DOWNLOAD_PACKET_HEADER_LEN +
+                                           FIRMWARE_DOWNLOAD_PACKET_CRC16_LEN;
+
+        pDownloadContext->packetToSend.fFragmentedPacket = FIRMWARE_DOWNLOAD_PACKET_FRAG_FLAG_NONE; // set the fragment flag to none as the first byte
+
+        pDownloadContext->packetToSend.payloadLen = pDownloadContext->bytesLeftToSend;              // insert the payload length in the second byte
+
+        memcpy( ( &pDownloadContext->packetToSend.payloadBuff ),                                    // copy payload from firmware library
+                  &pDownloadContext->pFirmwareImage[ pDownloadContext->readIndexFromLib ],
+                   pDownloadContext->bytesLeftToSend );
+
+        pDownloadContext->readIndexFromLib += pDownloadContext->bytesLeftToSend;                    // update the buffer index used to read from firmware library
+
+        pDownloadContext->bytesLeftToSend = 0;                                                      // most likely the last fragment from the chunk
+    }
+
+    insert_crc16( pDownloadContext );
+}
+
+/*==========================================================================================================
+FUNCTION
+    process_packets_to_send
+
+DESCRIPTION
+    determines if the incoming packet is the first one or any subsequent ones and process them
+    accordingly
+
+PARAMETERS
+    pfirmware_download_context_t pDownloadContext - pointer to structure containing all the
+                                                    information required
+
+RETURN VALUE
+    void
+
+==========================================================================================================*/
+static void process_packets_to_send( pfirmware_download_context_t pDownloadContext )
+{
+    uint8_t     firstChunkLenFromLib    = 0;
+    uint16_t    nextChunkLenFromLib     = 0;
+    uint16_t    buffIndex               = pDownloadContext->readIndexFromLib;
+
+    if( TRUE == pDownloadContext->fFirstPacket )
+    {
+        pDownloadContext->fFirstPacket = FALSE;                                         // indicates that the first packet has been processed
+
+        firstChunkLenFromLib = pDownloadContext->pFirmwareImage[ 1 ] +                  // length of the first chunk read from firmware library
+                               FIRMWARE_DOWNLOAD_PACKET_HEADER_LEN;
+
+        pDownloadContext->totalPacketLen = firstChunkLenFromLib +                       // length of the entire packet to send
+                                           FIRMWARE_DOWNLOAD_PACKET_CRC16_LEN;
+
+        pDownloadContext->readIndexFromLib += firstChunkLenFromLib;                     // update the buffer index used to read from firmware library
+
+        pDownloadContext->headerPlusPayloadLen = firstChunkLenFromLib;                  // length of header plus the payload for CRC-16-CCITT calculation
+
+        build_first_packet( pDownloadContext );                                         // build the first packet
+
+        send_packet_packet_to_chip( pDownloadContext );                                 // send the packet to the NFC chip
+    }
+    else if( FALSE == pDownloadContext->fFirstPacket )
+    {
+        nextChunkLenFromLib = pDownloadContext->pFirmwareImage[ buffIndex ];            // length of next chunk read from the firmware library
+
+        /* length of next chunk is stored in 2 bytes in the firmware library */
+        nextChunkLenFromLib <<= 8;
+        nextChunkLenFromLib  |= pDownloadContext->pFirmwareImage[ buffIndex + 1 ];
+
+        buffIndex += 2;                                                                 // add 2 bytes to the buffer index after length of next chunk is read
+
+        pDownloadContext->readIndexFromLib = buffIndex;                                 // update the buffer index used to read from firmware library
+
+        pDownloadContext->bytesLeftToSend = nextChunkLenFromLib;                        // number of bytes left on the chunk to be sent to the chip
+
+        while( pDownloadContext->bytesLeftToSend > 0 )                                  // constructs and sends packets as long as there are bytes left in the chunk
+        {
+            build_next_packet( pDownloadContext );
+            send_packet_packet_to_chip( pDownloadContext );
+        }
+    }
+    else
+    {
+        LOG_ERROR( "%s: Should not reach this point \n", __FUNCTION__ );
+    }
+}
+
+/*==========================================================================================================
+FUNCTION
+    ftm_nfc_dispatch_nq_fwdl
+
+DESCRIPTION
+    called by main() in ftm_main.c to start the firmware download routine
+
+PARAMETERS
+    none
+
+RETURN VALUE
+    void
+
+==========================================================================================================*/
+void ftm_nfc_dispatch_nq_fwdl( void )
+{
+    int          status                 = 0;
+
+    char        *pathToLib              = NULL;
+    uint8_t     *pFirmwareImage         = NULL;
+    uint16_t     firmwareImageLen       = 0;
+
+    uint8_t     *pNextChunkFromLib      = NULL;
+    uint16_t     nextChunkLenFromLib    = 0;
+    uint16_t     totalBytesReadFromLib  = 0;
+    uint16_t     readIndexFromLib       = 0;
+    union        nqx_uinfo           nqx_info;
+    pthread_t                       readerThread;
+
+    firmware_download_context_t     downloadContext     = { 0 };
+    pfirmware_download_context_t    pDownloadContext    = &downloadContext;
+    pDownloadContext->fFirstPacket                      = TRUE;
+
+
+    do
+    {
+        if( !fdNfc )
+        {
+            status = ftm_nq_nfc_open( );                                                // get a handle to the kernel driver
+            if( status < 0 )
+            {
+                LOG_ERROR( "\n%s: ftm_nq_nfc_open() failed with status = %d \n", __FUNCTION__, status );
+                break;
+            }
+
+            status = ftm_nfc_hw_reset( );                                               // reset NFC hardware
+            if( status < 0 )
+            {
+                LOG_ERROR( "%s: ftm_nq_nfc_reset() failed with status = %d \n", __FUNCTION__, status );
+                break;
+            }
+
+            nqx_info.i = ioctl( fdNfc, NFCC_GET_INFO, 0 );
+            if( nqx_info.i < 0 )
+            {
+                LOG_ERROR( "%s: nqnfcinfo not enabled, info  = %d \n", __FUNCTION__, nqx_info.i );
+            }
+            chip_version = nqx_info.info.chip_type;
+            LOG_INFORMATION( "\n NQ Chip ID : %x\n", chip_version);
+        }
+
+        status = pthread_create( &readerThread, NULL,                                   // create a reader thread
+                                 &read_response_from_chip, pDownloadContext );
+        if( 0 != status )
+        {
+            LOG_ERROR( "%s: pthread_create() failed with status = %d \n", __FUNCTION__, status );
+            break;
+        }
+
+        load_firmware_from_library( pathToLib, &pFirmwareImage, &firmwareImageLen );    // get a pointer to firmware library image and get its length
+        if( ( NULL == pFirmwareImage ) || ( 0 == firmwareImageLen ) )
+        {
+            LOG_ERROR( "%s: Firmware library image extraction failed\n", __FUNCTION__ );
+            break;
+        }
+
+        LOG_MESSAGE( "Firmware major version number: %02X\n",   pFirmwareImage[ 5 ] );
+        LOG_MESSAGE( "Firmware minor version number: %02X\n",   pFirmwareImage[ 4 ] );
+        LOG_MESSAGE( "Firmware library image length: %d\n",     firmwareImageLen );
+        LOG_MESSAGE( "Firmware library image pointer: %X\n",  ( uintptr_t )pFirmwareImage );
+
+        pDownloadContext->pFirmwareImage     = pFirmwareImage;
+        pDownloadContext->firmwareImageLen   = firmwareImageLen;
+
+        status = ioctl( fdNfc, NFC_SET_PWR, FIRMWARE_MODE );                            // set NFCC to firmware download mode
+        if( 0 != status )
+        {
+            LOG_ERROR( "%s: Failed to set firmware pin high.\n", __FUNCTION__ );
+            break;
+        }
+
+        LOG_INFORMATION( "\nBefore firmware update...\n" );
+        get_device_firmware_version( pDownloadContext );                                // get device version before loading firmware
+
+        LOG_INFORMATION( "\nSending firmware packets... Please wait\n" );
+        while( pDownloadContext->readIndexFromLib < pDownloadContext->firmwareImageLen )
+        {
+            process_packets_to_send( pDownloadContext );                                // build and send download packets with payload from the firmware library image
+        }
+
+        LOG_INFORMATION( "All packets sent!\n\n" );
+
+        pDownloadContext->fExitReadThread = TRUE;                                       // set flag to indicate that reader thread is safe to exit
+
+        LOG_INFORMATION( "After firmware update...\n" );
+        get_device_firmware_version( pDownloadContext );                                // get device version number after loading firmware
+
+        LOG_MESSAGE( "Waiting for reader thread to terminate...\n" );
+        pthread_join( readerThread, NULL );                                             // wait for reader thread to terminate
+        LOG_MESSAGE( "Reader thread terminated!\n" );
+
+        LOG_MESSAGE( "Resetting NFCC...\n" );
+
+        status = ftm_nfc_hw_reset( );                                                   // reset the NFC hardware which resets the firmware pin as well
+        if( status < 0 )
+        {
+            LOG_ERROR( "%s: ftm_nfc_hw_reset() failed with status = %d \n", __FUNCTION__, status );
+            break;
+        }
+
+        status = ftm_nq_nfc_close( );                                                   // release the handle to the kernel driver
+        if( 0 != status )
+        {
+            LOG_ERROR( "%s: ftm_nq_nfc_close() failed with status = %d \n", __FUNCTION__, status );
+        }
+
+        LOG_INFORMATION( "All done!\n\n" );
+
+    } while( FALSE );
+
+}

feeds/ipq95xx/ftm/src/ftm_nfcnq_fwdl.h

@@ -0,0 +1,111 @@
+/*
+ * Copyright (c) 2016 Qualcomm Technologies, Inc.
+ * All Rights Reserved.
+ * Confidential and Proprietary - Qualcomm Technologies, Inc.
+ *
+ * Not a Contribution.
+ * Apache license notifications and license are retained
+ * for attribution purposes only.
+ */
+
+/*
+ * Copyright (C) 2015 NXP Semiconductors
+ * The original Work has been changed by NXP Semiconductors.
+ *
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*=========================================================================
+  FTM NFC NQ Firmware Download Header File
+  Description
+  This file contains the declarations of the functions and various
+  definitions used to download firmware onto the NQ Chip.
+===========================================================================*/
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <dlfcn.h>
+#include <semaphore.h>
+#include <pthread.h>
+
+#define FALSE   ( 0 )
+#define TRUE    ( !FALSE )
+
+#define FIRMWARE_DOWNLOAD_MAX_PACKET_LEN            ( 0x100U )      // maximum length for a download packet
+#define FIRMWARE_DOWNLOAD_PACKET_HEADER_LEN         ( 0x02U )       // length of the header
+#define FIRMWARE_DOWNLOAD_PACKET_CRC16_LEN          ( 0x02U )       // length of CRC-16-CCITT value
+#define FIRMWARE_DOWNLOAD_PACKET_MAX_PAYLOAD_LEN     FIRMWARE_DOWNLOAD_MAX_PACKET_LEN - \
+                                                     FIRMWARE_DOWNLOAD_PACKET_HEADER_LEN - \
+                                                     FIRMWARE_DOWNLOAD_PACKET_CRC16_LEN
+
+/*  Values for the first byte of each packet, indicates if the packet is fragmented */
+#define FIRMWARE_DOWNLOAD_PACKET_FRAG_FLAG_NONE     ( 0x00U )       // not fragmented
+#define FIRMWARE_DOWNLOAD_PACKET_FRAG_FLAG_SET      ( 0x04U )       // fragmented packet, next packet is a part of this one
+
+extern sem_t        sRspReady;                                      // semaphore used by reader thread
+extern int          fdNfc;                                          // a handle to the kernel driver
+
+typedef uint8_t     bool_t;
+
+/* structure of the packet to be sent or received */
+typedef struct firmware_download_packet
+{
+    uint8_t     fFragmentedPacket;                                          // flag to indicate if the packet is fragmented
+    uint8_t     payloadLen;                                                 // length of payload
+    uint8_t     payloadBuff[ FIRMWARE_DOWNLOAD_PACKET_MAX_PAYLOAD_LEN +
+                             FIRMWARE_DOWNLOAD_PACKET_CRC16_LEN ];          // buffer containing the payload and CRC-16-CCITT value
+} firmware_download_packet_t, *pfirmware_download_packet_t;
+
+/* structure that contains all the other information about the packets */
+typedef struct firmware_download_context
+{
+    const uint8_t              *pFirmwareImage;                     // pointer to the firmware image library
+    uint16_t                    firmwareImageLen;                   // length of the firmware image
+
+    uint8_t                     headerPlusPayloadLen;               // header and payload length of a packet for CRC calculation
+    uint16_t                    readIndexFromLib;                   // index used to read from the firmware library
+    uint16_t                    bytesLeftToSend;                    // number of bytes left to send when the chunk read is fragmented
+    uint16_t                    totalPacketLen;                     // total length of packet to be sent or received
+    bool_t                      fFirstPacket;                       // flag to indicate if it is the first packet
+    bool_t                      fExitReadThread;                    // flag to indicate if reader thread is safe to exit
+    firmware_download_packet_t  packetToSend;                       // contains information about packet to be sent
+    firmware_download_packet_t  packetReceived;                     // contains information about packet from response received
+} firmware_download_context_t, *pfirmware_download_context_t;
+
+
+
+/**
+
+    Firmware download packet format
+
+    -----------------------------------------------------------------------------------------------------
+    |               Header                  |           Payload                 |   CRC-16-CCITT value  |
+    -----------------------------------------------------------------------------------------------------
+    |   Fragment flag   |   Payload length  |   Command/Response    |   Data    |   CRC-16-CCITT value  |
+    -----------------------------------------------------------------------------------------------------
+    |       1 byte      |       1 byte      |         1 byte        |  n bytes  |         2 bytes       |
+    -----------------------------------------------------------------------------------------------------
+
+
+    Firmware library image format
+
+    ---------------------------------------------------------------------------------          ----------------------------------
+    |   0x00    | First chunk length | First chunk | Next chunk length | Next chunk |    ...   | Last chunk length | Last chunk |
+    ---------------------------------------------------------------------------------          ----------------------------------
+    |  1 byte   |      1 byte        |   n bytes   |      2 bytes      |   n bytes  |    ...   |      2 bytes      |   n bytes  |
+    ---------------------------------------------------------------------------------          ----------------------------------
+
+*/

feeds/ipq95xx/ftm/src/ftm_nfcnq_test.c

@@ -0,0 +1,461 @@
+/*
+ * Copyright (c) 2017 Qualcomm Technologies, Inc.
+ * All Rights Reserved.
+ * Confidential and Proprietary - Qualcomm Technologies, Inc.
+ */
+
+#include <libgen.h>
+#include "ftm_nfcnq.h"
+#include "ftm_nfcnq_test.h"
+
+/* Global variables */
+pthread_t           clientThread;
+PNCI_MESSAGE        pNCIMessage;
+char                *progname;
+
+/*==============================================================================
+FUNCTION
+    eseSpiTest
+
+DESCRIPTION
+    Send APDU for eSE SPI HLOS test
+
+PARAMETERS
+    int argc - argument count
+    char **argv - argument vector
+
+RETURN VALUE
+    void
+
+=============================================================================*/
+void eseSpiTest(int argc, char **argv )
+{
+    int ret = 0;
+    int test_mode = 0;
+    unsigned char i = 0;
+    int fp = 0;
+    int choice = 0;
+    unsigned char send_APDU[] = {0x5A,0x00,0x05,0x00,0xA4,0x04,0x00,0x00,0xA5};
+    int size_APDU = 0;
+    unsigned char recv_response[259] = {0};
+    progname = basename(argv[2]);
+    test_mode = getopt(argc, argv, "01");
+    size_APDU = sizeof(send_APDU);
+
+    LOG_INFORMATION("\n### eSE SPI test ###\n");
+
+    if(test_mode == '0')
+    {
+        choice = 0;
+        LOG_INFORMATION("\nInterrupt Mode test\n");
+    }
+    else
+    {
+        choice = 1;
+        LOG_INFORMATION("\nPoll Mode test(default)\n");
+    }
+
+    do
+    {
+        //open module
+        if ((ret = (fp = open("/dev/ese", O_RDWR))) < 0)
+        {
+            LOG_INFORMATION("eSE open error retcode = %d, errno = %d\n", ret, errno);
+            LOG_INFORMATION("\n... eSE SPI Test requires modified boot and TZ image ...");
+            break;
+        }
+        LOG_INFORMATION("eSE open : Ret = %2d\n", ret);
+
+        //enable the logs
+        ioctl(fp, ESE_SET_DBG, 1);
+        //hardware reset
+        ioctl(fp, ESE_SET_PWR, 1);
+
+        ioctl(fp, ESE_SET_MODE, choice);
+
+        //write one APDU
+        ret = write(fp, send_APDU, sizeof(send_APDU));
+        if (ret < 0)
+        {
+            LOG_INFORMATION("ese write error retcode = %d, errno = %d\n", ret, errno);
+            break;
+        }
+        LOG_INFORMATION("ese Write : Ret = %.2X \n", ret);
+        LOG_INFORMATION("APDU sent to eSE: ");
+        for (i=0; i<size_APDU; i++)
+        {
+            LOG_INFORMATION("%.2X ", send_APDU[i]);
+        }
+        sleep(1);
+
+        if ((ret = (read(fp, &recv_response[0], READ_SAMPLE_SIZE)), 0) < 0)
+        {
+            LOG_INFORMATION("\neSE read error retcode = %d, errno = %d", ret, errno);
+        }
+        else
+        {
+            LOG_INFORMATION("\nResponse from eSE: ");
+            for (i=0;i<(recv_response[2]+1);i++)
+            {
+              LOG_INFORMATION("%.2X ", recv_response[i]);
+            }
+            LOG_INFORMATION("\n");
+        }
+    } while(0);
+
+    close(fp);
+}
+
+/*==============================================================================
+FUNCTION
+    eseDwpTest
+
+DESCRIPTION
+    Send NCI commands to NFCC for eSE DWP detection
+
+PARAMETERS
+
+RETURN VALUE
+    void
+
+=============================================================================*/
+void eseDwpTest()
+{
+    int cmds;
+    cmds = sizeof(NQ330_ESE_DWP) / sizeof(NQ330_ESE_DWP[0]);
+    LOG_INFORMATION( "\n### ese DWP Test ###\n" );
+    if(whatNQChip == NQ_220 || whatNQChip == NQ_330)
+        sendcmds(NQ330_ESE_DWP, cmds);
+    else
+        LOG_INFORMATION( "\nNQ Chipset in use doesn't support eSE\n" );
+}
+
+/*==============================================================================
+FUNCTION
+    printTecnologyDetails
+
+DESCRIPTION
+    Print the technology supported and protocols details
+
+PARAMETERS
+    char technology - technology supported identifier
+    char protocol - protocol identifier
+
+RETURN VALUE
+    void
+
+=============================================================================*/
+void printTecnologyDetails(char technology, char protocol)
+{
+    switch (protocol)
+    {
+      case NFC_PROTOCOL_ISO_DEP:
+          LOG_INFORMATION( "ISO-DEP Protocol");
+          break;
+
+      case NFC_PROTOCOL_NFC_DEP:
+          LOG_INFORMATION( "NFC-DEP Protocol");
+          break;
+
+      case NFC_PROTOCOL_T1T:
+          LOG_INFORMATION( "T1T Protocol");
+          break;
+
+      case NFC_PROTOCOL_T2T:
+          LOG_INFORMATION( "T2T Protocol");
+          break;
+
+      case NFC_PROTOCOL_T3T:
+          LOG_INFORMATION( "T3T Protocol");
+          break;
+
+      case NFC_PROTOCOL_UNKNOWN:
+          LOG_INFORMATION( "unknown Protocol");
+          break;
+
+      default:
+          break;
+    }
+
+    switch (technology)
+    {
+      case NFC_NFCA_Poll:
+          LOG_INFORMATION("\nNFC A POLL MODE TECHNOLOGY\n");
+          break;
+      case NFC_NFCB_Poll:
+          LOG_INFORMATION("\nNFC B POLL MODE TECHNOLOGY\n");
+          break;
+      case NFC_NFCF_Poll:
+          LOG_INFORMATION("\nNFC F POLL MODE TECHNOLOGY\n");
+          break;
+      case NFC_NFCA_Listen:
+          LOG_INFORMATION("\nNFC A LISTEN MODE TECHNOLOGY\n");
+          break;
+      case NFC_NFCB_Listen:
+          LOG_INFORMATION("\nNFC B LISTEN MODE TECHNOLOGY\n");
+          break;
+      case NFC_NFCF_Listen:
+          LOG_INFORMATION("\nNFC F LISTEN MODE TECHNOLOGY\n");
+          break;
+      case NFC_NFCISO15693_Poll:
+          LOG_INFORMATION("\nNFC ISO15693 POLL MODE TECHNOLOGY\n");
+          break;
+      default:
+          LOG_INFORMATION("\nother TECHNOLOGY\n");
+          break;
+    }
+
+}
+
+/*==============================================================================
+FUNCTION
+    sendcmds
+
+DESCRIPTION
+    Send sequence of commands to NFCC
+
+PARAMETERS
+    uint8_t buffer[] - Command buffer array
+    int no_of_cmds - Number of commands to be sent
+
+RETURN VALUE
+    void
+
+=============================================================================*/
+void sendcmds(uint8_t buffer[][MAX_CMD_LEN], int no_of_cmds)
+{
+    int rows=0,payloadlen=0;
+    int ret = 0;
+    ftm_nfc_pkt_type *nfc_pkt  = (ftm_nfc_pkt_type *)malloc(no_of_cmds*255);
+
+    LOG_INFORMATION("\nTotal cmds to be sent = %d\n",no_of_cmds);
+    LOG_INFORMATION("Wait for Commands to be sent... \n\n");
+
+    for(rows = 0; rows < no_of_cmds; rows++)
+    {
+#ifdef NFC_FTM_DEBUG
+        LOG_INFORMATION ("Number of cmds sent = %d \n",rows+1);
+#endif
+        payloadlen = 0;
+        payloadlen = 3 + buffer[rows][2];
+        memset(nfc_pkt->nci_data, -1, MAX_CMD_LEN);
+        memcpy(nfc_pkt->nci_data, &buffer[rows], payloadlen);
+        ret = ProcessCommand( nfc_pkt->nci_data );
+        if( ret == -1 )                                  // wait finished, not signalled?
+        {
+            LOG_ERROR( "Waited for NCI NTF/DATA timeout\n" );
+        }
+    }
+}
+
+/*==============================================================================
+FUNCTION
+    usage
+
+DESCRIPTION
+    Print usage information for test
+
+PARAMETERS
+
+RETURN VALUE
+    void
+
+=============================================================================*/
+void usage()
+{
+    LOG_INFORMATION("\nUsage:");
+    LOG_INFORMATION(" %s [-n] [-e] [-d] [h] \n", progname);
+    LOG_INFORMATION(" %s -n ..for NFC test only\n", progname);
+    LOG_INFORMATION(" %s -e ..for eSE SPI test only\n \t-0 ..Interrupt Mode\n \t-1 ..Poll Mode\n", progname);
+    LOG_INFORMATION(" %s -d ..for eSE DWP test only\n", progname);
+    LOG_INFORMATION(" %s -h HELP\n", progname);
+    LOG_INFORMATION(" %s default NFC test only\n", progname);
+}
+
+/*==============================================================================
+FUNCTION
+    nfc_ese_pwr
+
+DESCRIPTION
+    Set ESE power using NFC driver
+
+PARAMETERS
+
+RETURN VALUE
+    void
+
+=============================================================================*/
+void nfc_ese_pwr()
+{
+    int ret;
+    ret = ioctl( fdNfc, NFC_ESE_SET_PWR, POWER_ON );                // turn the chip on
+    if( ret != 0 )
+    {
+        LOG_INFORMATION("Can't find ESE GPIO in NFC driver: ");
+        LOG_INFORMATION("ret=%d\n",ret);
+    }
+}
+
+
+
+/*==============================================================================
+FUNCTION
+    ftm_nfc_dispatch_nq_test
+
+DESCRIPTION
+    called by main() in ftm_main.c to start the nfc test routine
+
+PARAMETERS
+    int argc - argument count
+    char **argv - argument vector
+
+RETURN VALUE
+    void
+
+=============================================================================*/
+void ftm_nfc_dispatch_nq_test( int argc, char **argv )
+{
+    int cmds = 0;
+    unsigned int chip_version = 0x00;
+    unsigned int major_version = 0x00;
+    unsigned int minor_version = 0x00;
+    unsigned int rom_version = 0x00;
+    char firmware_version[10];
+    struct timespec  time_sec;
+    int type_of_test = 0;
+    int default_test = 0;
+    int          status                 = 0;
+
+    union        nqx_uinfo           nqx_info;
+    pthread_t                       readerThread;
+
+    do
+    {
+        if( !fdNfc )
+        {
+            status = ftm_nq_nfc_open( );                                                // get a handle to the kernel driver
+            if( status < 0 )
+            {
+                LOG_ERROR( "\n%s: ftm_nq_nfc_open() failed with status = %d \n", __FUNCTION__, status );
+                break;
+            }
+
+            status = ftm_nfc_hw_reset( );                                               // reset NFC hardware
+            if( status < 0 )
+            {
+                LOG_ERROR( "%s: ftm_nq_nfc_reset() failed with status = %d \n", __FUNCTION__, status );
+                break;
+            }
+
+            nqx_info.i = ioctl( fdNfc, NFCC_GET_INFO, 0 );
+            if( nqx_info.i < 0 )
+            {
+                LOG_ERROR( "%s: nqnfcinfo not enabled, info  = %d \n", __FUNCTION__, nqx_info.i );
+            }
+
+            chip_version = nqx_info.info.chip_type;
+            rom_version = nqx_info.info.rom_version;
+            major_version = nqx_info.info.fw_major;
+            minor_version = nqx_info.info.fw_minor;
+
+            LOG_INFORMATION( "\n NQ Chip ID : %x\n", chip_version);
+            snprintf(firmware_version, 10, "%02x.%02x.%02x", rom_version, major_version, minor_version);
+            LOG_INFORMATION(" Firmware version : %s\n\n", firmware_version);
+
+
+            if(sem_init(&sRspReady, 0, 0) != 0)
+            {
+                    LOG_ERROR("NFC FTM :semaphore_halcmd_complete creation failed \n");
+                    break;
+            }
+            if(sem_init(&sRfNtf, 0, 0) != 0)
+            {
+                    LOG_ERROR("NFC FTM :semaphore_halcmd_complete creation failed \n");
+                    break;
+            }
+
+            pNCIMessage     = ( PNCI_MESSAGE ) nciReplyMessage;
+            status = pthread_create( &clientThread, NULL, &nfc_read_thread, NULL );            // Start the Read Thread
+
+            if( status != 0 )                                      // successful?
+            {
+                 LOG_ERROR("nqnfc %s: pthread_create( nfc_read_thread ) failed with ret = %d \n", __func__, status );
+                 break;
+            }
+
+            status = ftm_nfc_nq_vs_nxp( );
+            if( status < 0 )                                   // Not an NQ Chip?
+            {
+                LOG_ERROR("ERROR NOT A KNOWN NQ Chip \n"  );
+            }
+        }
+
+        progname = basename(argv[1]);
+        type_of_test = getopt(argc, argv, "nedhf");
+
+        switch (type_of_test) {
+        case 'n':
+            LOG_INFORMATION("NFC test only\n");
+            break;
+        case 'e':
+            LOG_INFORMATION("eSE SPI test only\n");
+            nfc_ese_pwr();
+            ese_spi_test = 1;
+            eseSpiTest(argc, argv);
+            break;
+        case 'd':
+            LOG_INFORMATION("eSE DWP test only\n");
+            ese_dwp_test = 1;
+            eseDwpTest();
+            break;
+        case 'h':
+            usage();
+            break;
+        default:
+            usage();
+            default_test = 1;
+            LOG_INFORMATION("\nDefault NFC test only\n");
+        }
+
+        if(ese_dwp_test || ese_spi_test)
+            break;
+
+        if(type_of_test == 'n' || default_test)
+        {
+            switch(whatNQChip)
+            {
+                case NQ_210:
+                case NQ_220:
+                    cmds = sizeof(NQ220_cmds) / sizeof(NQ220_cmds[0]);
+                    sendcmds(NQ220_cmds, cmds);
+                    break;
+                case NQ_310:
+                case NQ_330:
+                    cmds = sizeof(NQ330_cmds) / sizeof(NQ330_cmds[0]);
+                    sendcmds(NQ330_cmds, cmds);
+                    break;
+                default:
+                    LOG_INFORMATION( "Chip not supported, taking NQ330 as default\n ");
+                    cmds = sizeof(NQ330_cmds) / sizeof(NQ330_cmds[0]);
+                    sendcmds(NQ330_cmds, cmds);
+                    break;
+            }
+
+            LOG_INFORMATION("\n<<>> Waiting for TAG detect or 20sec timeout <<>> ...\n");
+            status = clock_gettime( CLOCK_REALTIME, &time_sec );
+            time_sec.tv_sec += NFC_NTF_TIMEOUT;
+            status = sem_timedwait( &sRfNtf, &time_sec );  //start waiting
+            if (status <0) {
+                   LOG_INFORMATION("\n No NFC Tag detected, continue ...\n");
+            }
+        }
+
+        status = ftm_nq_nfc_close( );                                                   // release the handle to the kernel driver
+        if( 0 != status )
+        {
+            LOG_ERROR( "%s: ftm_nq_nfc_close() failed with status = %d \n", __FUNCTION__, status );
+        }
+
+    } while( FALSE );
+
+}

feeds/ipq95xx/ftm/src/ftm_nfcnq_test.h

@@ -0,0 +1,202 @@
+/*
+ * Copyright (c) 2017 Qualcomm Technologies, Inc.
+ * All Rights Reserved.
+ * Confidential and Proprietary - Qualcomm Technologies, Inc.
+ *
+ * Not a Contribution.
+ * Apache license notifications and license are retained
+ * for attribution purposes only.
+ *
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define ESE_MAGIC 0xEA
+#define ESE_SET_PWR                         _IOW(ESE_MAGIC, 0x01, unsigned int)
+#define ESE_SET_DBG                         _IOW(ESE_MAGIC, 0x02, unsigned int)
+#define ESE_SET_MODE                        _IOW(ESE_MAGIC, 0x03, unsigned int)
+#define NFC_ESE_SET_PWR                     _IOW(0xE9, 0x02, unsigned int)
+#define NFC_ESE_GET_PWR                     _IOR(0xE9, 0x03, unsigned int)
+#define NFC_NTF_TIMEOUT                     20
+
+/* Supported Protocols */
+#define NFC_PROTOCOL_UNKNOWN    0x00 /* Unknown */
+#define NFC_PROTOCOL_T1T        0x01 /* Type1Tag    - NFC-A            */
+#define NFC_PROTOCOL_T2T        0x02 /* Type2Tag    - NFC-A            */
+#define NFC_PROTOCOL_T3T        0x03 /* Type3Tag    - NFC-F            */
+#define NFC_PROTOCOL_ISO_DEP    0x04 /* Type 4A,4B  - NFC-A or NFC-B   */
+#define NFC_PROTOCOL_NFC_DEP    0x05 /* NFCDEP/LLCP - NFC-A or NFC-F       */
+
+#define MAX_CMD_LEN             255
+#define READ_SAMPLE_SIZE        258
+extern int                      fdNfc;           // a handle to the kernel driver
+extern uint8_t                  nciReplyMessage[ 255 ];
+extern NQ_CHIP_TYPE             whatNQChip;
+extern sem_t                    sRspReady;
+extern int ftm_nfc_nq_vs_nxp( void );
+int ese_dwp_test = 0;
+int ese_spi_test = 0;
+void sendcmds(uint8_t buffer[][255], int no_of_cmds);
+void printTecnologyDetails(char technology, char protocol);
+sem_t               sRfNtf;
+
+struct ese_spi_platform_data
+{
+    unsigned int use_pwr_req;
+    unsigned int pwr_req;
+    unsigned int ese_intr;
+};
+
+/*
+ * Enum definition contains RF technology modes supported.
+ * This information is a part of RF_DISCOVER_NTF or RF_INTF_ACTIVATED_NTF.
+ */
+typedef enum
+{
+    NFC_NFCA_Poll                 = 0x00, /* Nfc A Technology in Poll Mode */
+    NFC_NFCB_Poll                 = 0x01, /* Nfc B Technology in Poll Mode */
+    NFC_NFCF_Poll                 = 0x02, /* Nfc F Technology in Poll Mode */
+    NFC_NFCA_Active_Poll          = 0x03, /* Nfc A Technology in Active Poll Mode */
+    NFC_NFCF_Active_Poll          = 0x05, /* Nfc F Technology in Active Poll Mode */
+    NFC_NFCISO15693_Poll          = 0x06, /* Nfc ISO15693 Technology in Poll Mode */
+    NFC_NxpProp_NFCHID_Poll       = 0x70, /* Nfc Hid Technology in Poll Mode */
+    NFC_NxpProp_NFCEPFGEN2_Poll   = 0x71, /* Nfc EpcGen2 Technology in Poll Mode */
+    NFC_NxpProp_NFCKOVIO_Poll     = 0x72, /* Nfc Kovio Technology in Poll Mode */
+    NFC_NFCA_Listen               = 0x80, /* Nfc A Technology in Listen Mode */
+    NFC_NFCB_Listen               = 0x81, /* Nfc B Technology in Listen Mode */
+    NFC_NFCF_Listen               = 0x82, /* Nfc F Technology in Listen Mode */
+    NFC_NFCA_Active_Listen        = 0x83, /* Nfc A Technology in Active Listen Mode */
+    NFC_NFCF_Active_Listen        = 0x85, /* Nfc F Technology in Active Listen Mode */
+    NFC_NFCISO15693_Active_Listen = 0x86  /* Nfc ISO15693 Technology in Listen Mode */
+} NFC_RfTechMode_t;
+
+uint8_t NQ330_cmds[][255] =
+{
+{ 0x20,0x00,0x01,0x00 },
+{ 0x20,0x01,0x00},
+{ 0x2F,0x02,0x00 },
+{ 0x20,0x03,0x03,0x01,0xA0,0x0F },
+{ 0x20,0x03,0x03,0x01,0xA0,0xFC },
+{ 0x20,0x03,0x03,0x01,0xA0,0xF2 },
+{ 0x20,0x03,0x03,0x01,0xA0,0xD7 },
+{ 0x20,0x03,0x07,0x03,0xA0,0x02,0xA0,0x03,0xA0,0x04 },
+{ 0x20,0x02,0x09,0x02,0xA0,0x03,0x01,0x01,0xA0,0x04,0x01,0x06 },
+{ 0x20,0x02,0x0F,0x01,0xA0,0x0E,0x0B,0x11,0x01,0xC2,0xB2,0x00,0xB2,0x1E,0x1F,0x00,0xD0,0x0C },
+{ 0x20,0x02,0x05,0x01,0xA0,0xF2,0x01,0x01 },
+{ 0x20,0x03,0x03,0x01,0xA0,0xEC },
+{ 0x20,0x03,0x03,0x01,0xA0,0xD4 },
+{ 0x20,0x03,0x03,0x01,0xA0,0x14 },
+{ 0x20,0x02,0x2E,0x0E,0x28,0x01,0x00,0x21,0x01,0x00,0x30,0x01,0x08,0x31,0x01,0x03,0x32,0x01,0x60,0x38,0x01,0x01,0x33,0x04,0x01,0x02,0x03,0x04,0x54,0x01,0x06,0x50,0x01,0x02,0x5B,0x01,0x00,0x80,0x01,0x01,0x81,0x01,0x01,0x82,0x01,0x0E,0x18,0x01,0x01 },
+{ 0x20,0x02,0x05,0x01,0xA0,0x62,0x01,0x01 },
+{ 0x20,0x02,0x06,0x01,0xA0,0xF3,0x02,0x10,0x27 },
+{ 0x20,0x03,0x03,0x01,0xA0,0x85 },
+{ 0x21,0x01,0x07,0x00,0x01,0x01,0x03,0x00,0x01,0x05 },
+{ 0x20,0x02,0x05,0x01,0xA0,0xF1,0x01,0x00 },
+{ 0x20,0x03,0x03,0x01,0xA0,0x0F },
+{ 0x20,0x03,0x03,0x01,0xA0,0xEB },
+{ 0x20,0x00,0x01,0x00 },
+{ 0x20,0x01,0x00},
+{ 0x20,0x03,0x02,0x01,0x00 },
+{ 0x20,0x03,0x02,0x01,0x29 },
+{ 0x20,0x03,0x02,0x01,0x61 },
+{ 0x20,0x03,0x02,0x01,0x60 },
+{ 0x20,0x02,0x0F,0x01,0xA0,0x0E,0x0B,0x11,0x01,0xC2,0xB2,0x00,0xB2,0x1E,0x1F,0x00,0xD0,0x0C },
+{ 0x21,0x00,0x0D,0x04,0x04,0x03,0x02,0x05,0x03,0x03,0x03,0x02,0x01,0x80,0x01,0x80 },
+{ 0x20,0x03,0x07,0x03,0xA0,0xEC,0xA0,0xED,0xA0,0xD4 },
+{ 0x20,0x03,0x03,0x01,0xA0,0xEB },
+{ 0x20,0x03,0x03,0x01,0xA0,0xF0 },
+{ 0x22,0x01,0x02,0xC0,0x01 },
+{ 0x22,0x03,0x02,0xC0,0x00 },
+{ 0x20,0x03,0x03,0x01,0xA0,0x14 },
+{ 0x20,0x03,0x03,0x01,0xA0,0xEB },
+{ 0x20,0x03,0x03,0x01,0xA0,0x07 },
+{ 0x20,0x03,0x02,0x01,0x52 },
+{ 0x2F,0x15,0x01,0x02 },
+{ 0x21,0x03,0x07,0x03,0x80,0x01,0x81,0x01,0x82,0x01 },
+{ 0x21,0x06,0x01,0x00 },
+{ 0x2F,0x15,0x01,0x00 },
+{ 0x20,0x02,0x07,0x02,0x32,0x01,0x60,0x38,0x01,0x01 },
+{ 0x21,0x01,0x1B,0x00,0x05,0x01,0x03,0x00,0x01,0x03,0x01,0x03,0x00,0x41,0x04,0x01,0x03,0x00,0x41,0xA0,0x01,0x03,0x00,0x01,0x05,0x00,0x03,0xC0,0xC3,0x02 },
+{ 0x20,0x02,0x07,0x02,0x32,0x01,0x60,0x38,0x01,0x01},
+{ 0x21,0x03,0x19,0x0C,0x00,0x01,0x01,0x01,0x02,0x01,0x03,0x01,0x05,0x01,0x80,0x01,0x81,0x01,0x82,0x01,0x83,0x01,0x85,0x01,0x06,0x01,0x70,0x01}
+};
+
+uint8_t NQ330_ESE_DWP[][255] =
+{
+{ 0x20,0x00,0x01,0x00 },
+{ 0x20,0x01,0x00},
+{ 0x20,0x02,0x05,0x01,0xA0,0xF2,0x01,0x01 },
+{ 0x22,0x00,0x01,0x01 },
+{ 0x22,0x01,0x2,0x01,0x01 },
+{ 0x20,0x04,0x06,0x03,0x01,0x01,0x02,0x01,0x01 },
+{ 0x03,0x00,0x03,0x81,0x02,0x01 },
+{ 0x03,0x00,0x03,0x81,0x02,0x04 },
+{ 0x03,0x00,0x03,0x81,0x02,0x07 },
+{ 0x21,0x01,0x1B,0x00,0x05,0x01,0x03,0x00,0x01,0x03,0x01,0x03,0x00,0x41,0x04,0x01,0x03,0x00,0x41,0xA0,0x01,0x03,0x00,0x01,0x05,0x00,0x03,0xC0,0xC3,0x02 },
+{ 0x21,0x03,0x19,0x0C,0x00,0x01,0x01,0x01,0x02,0x01,0x03,0x01,0x05,0x01,0x80,0x01,0x81,0x01,0x82,0x01,0x83,0x01,0x85,0x01,0x06,0x01,0x70,0x01},
+{ 0x03,0x00,0x07,0x99,0x50,0x00,0x70,0x00,0x00,0x01},
+{ 0x03,0x00,0x09,0x99,0x50,0x80,0xCA,0x00,0xFE,0x02,0xDF,0x21  }
+};
+
+uint8_t NQ220_cmds[][255] =
+{
+ { 0x20,0x00,0x01,0x00 },
+ { 0x20,0x01,0x00 },
+ { 0x2F,0x02,0x00 },
+ { 0x20,0x03,0x03,0x01,0xA0,0x0F },
+ { 0x20,0x03,0x07,0x03,0xA0,0x02,0xA0,0x03,0xA0,0x04 },
+ { 0x20,0x02,0x05,0x01,0xA0,0x44,0x01,0x00 },
+ { 0x20,0x02,0x0B,0x02,0xA0,0x66,0x01,0x00,0xA0,0x0E,0x03,0x02,0x09,0x00 },
+ { 0x20,0x02,0x26,0x09,0xA0,0xEC,0x01,0x01,0xA0,0xED,0x01,0x03,0xA0,0x5E,0x01,0x01,0xA0,0x12,0x01,0x02,0xA0,0x40,0x01,0x01,0xA0,0xDD,0x01,0x2D,0xA0,0xF2,0x01,0x01,0xA0,0x96,0x01,0x01,0xA0,0x9F,0x02,0x08,0x08 },
+ { 0x20,0x03,0x03,0x01,0xA0,0xEC },
+ { 0x20,0x03,0x03,0x01,0xA0,0x14 },
+ { 0x20,0x02,0x2E,0x0E,0x28,0x01,0x00,0x21,0x01,0x00,0x30,0x01,0x08,0x31,0x01,0x03,0x32,0x01,0x60,0x38,0x01,0x01,0x33,0x04,0x01,0x02,0x03,0x04,0x54,0x01,0x06,0x50,0x01,0x02,0x5B,0x01,0x00,0x80,0x01,0x01,0x81,0x01,0x01,0x82,0x01,0x0E,0x18,0x01,0x01 },
+ { 0x20,0x02,0x05,0x01,0xA0,0x62,0x01,0x01 },
+ { 0x20,0x02,0x06,0x01,0xA0,0xF3,0x02,0x10,0x27 },
+ { 0x20,0x03,0x03,0x01,0xA0,0x85 },
+ { 0x21,0x01,0x07,0x00,0x01,0x01,0x03,0x00,0x01,0x05 },
+ { 0x20,0x02,0x05,0x01,0xA0,0xF1,0x01,0x00 },
+ { 0x20,0x02,0x05,0x01,0xA0,0x91,0x01,0x01 },
+ { 0x20,0x03,0x03,0x01,0xA0,0x0F },
+ { 0x20,0x03,0x03,0x01,0xA0,0xEB },
+ { 0x20,0x00,0x01,0x00 },
+ { 0x20,0x01,0x00 },
+ { 0x20,0x03,0x02,0x01,0x00 },
+ { 0x20,0x03,0x02,0x01,0x29 },
+ { 0x20,0x03,0x02,0x01,0x61 },
+ { 0x20,0x03,0x02,0x01,0x60 },
+ { 0x21,0x00,0x0D,0x04,0x04,0x03,0x02,0x05,0x03,0x03,0x03,0x02,0x01,0x80,0x01,0x80 },
+ { 0x22,0x00,0x01,0x01 },
+ { 0x20,0x04,0x06,0x03,0x01,0x01,0x02,0x01,0x01 },
+ { 0x03,0x00,0x05,0x81,0x01,0x03,0x02,0xC0 },
+ { 0x03,0x00,0x05,0x81,0x01,0x06,0x01,0x00 },
+ { 0x03,0x00,0x03,0x81,0x02,0x01 },
+ { 0x03,0x00,0x03,0x81,0x02,0x04 },
+ { 0x20,0x03,0x05,0x02,0xA0,0xEC,0xA0,0xED },
+ { 0x20,0x03,0x03,0x01,0xA0,0xEB },
+ { 0x20,0x03,0x03,0x01,0xA0,0xF0 },
+ { 0x20,0x03,0x05,0x02,0xA0,0xEC,0xA0,0xED },
+ { 0x20,0x03,0x03,0x01,0xA0,0x14 },
+ { 0x20,0x03,0x03,0x01,0xA0,0xEB },
+ { 0x20,0x03,0x03,0x01,0xA0,0x07 },
+ { 0x20,0x02,0x05,0x01,0xA0,0x07,0x01,0x03 },
+ { 0x20,0x03,0x02,0x01,0x52 },
+ { 0x21,0x01,0x16,0x00,0x04,0x01,0x03,0x00,0x01,0x03,0x01,0x03,0x00,0x41,0x04,0x01,0x03,0x00,0x41,0xA0,0x01,0x03,0x00,0x01,0x05 },
+ { 0x20,0x02,0x0A,0x03,0x32,0x01,0x20,0x38,0x01,0x01,0x50,0x01,0x00 },
+ { 0x21,0x03,0x07,0x03,0x80,0x01,0x81,0x01,0x82,0x01 },
+ { 0x21,0x06,0x01,0x00 },
+ { 0x20,0x02,0x17,0x01,0x61,0x14,0x46,0x66,0x6D,0x01,0x01,0x12,0x02,0x02,0x07,0xFF,0x03,0x02,0x00,0x13,0x04,0x01,0x64,0x07,0x01,0x03 },
+ { 0x20,0x02,0x0A,0x03,0x32,0x01,0x60,0x38,0x01,0x01,0x50,0x01,0x02 },
+ { 0x21,0x03,0x19,0x0C,0x00,0x01,0x01,0x01,0x02,0x01,0x03,0x01,0x05,0x01,0x80,0x01,0x81,0x01,0x82,0x01,0x83,0x01,0x85,0x01,0x06,0x01,0x70,0x01 }
+};

feeds/ipq95xx/ftm/src/ftm_nfcqti.c

@@ -0,0 +1,724 @@
+/*=========================================================================
+                        NFC FTM Source File
+Description
+   This file contains the routines to communicate with the NFCC in FTM mode.
+
+Copyright (c) 2015 Qualcomm Technologies, Inc.
+All Rights Reserved.
+Confidential and Proprietary - Qualcomm Technologies, Inc.
+===========================================================================*/
+/*===========================================================================
+                         Edit History
+when        who              what,              where,     why
+--------   ---     ----------------------------------------------------------
+===========================================================================*/
+/*==========================================================================*
+*                             INCLUDE FILES                                *
+*==========================================================================*/
+#include "ftm_nfcqti.h"
+
+#define UNUSED(x) (void)(x)
+
+/*=========================================================================*
+*                            file scope local defnitions                   *
+*==========================================================================*/
+const hw_module_t* hw_module = NULL;
+nfc_nci_device_t* dev = NULL;
+uint8 hal_state = NCI_HAL_INIT, nfc_ftmthread = FALSE;
+uint8 *nfc_cmd_buff = NULL, len = 0;
+uint16 res_len = 0, async_msg_cnt = 0;
+uint8  *response_buff = NULL;
+static uint8 hal_opened = FALSE, wait_rsp = FALSE;
+static uint8 async_msg_available = FALSE, ftm_data_rsp_pending = FALSE;
+asyncdata *buff = NULL;
+asyncdata *start = NULL;
+/*I2C read/write*/
+static uint8 i2c_cmd_cnt = 0;
+uint8 i2c_status=0,i2c_req_write = FALSE, i2c_req_read = FALSE;
+uint8 i2c_num_of_reg_to_read = 0, i2c_reg_read_data[40]={0}, ii = 0;
+pthread_mutex_t nfcftm_mutex = PTHREAD_MUTEX_INITIALIZER;
+/*===================================================================================*
+*                             Function Defnitions                                    *
+*===================================================================================*/
+/*====================================================================================
+FUNCTION   nfc_ftm_hal_cback
+DESCRIPTION
+  This is the call back function which will indicate if the nfc hal open is successful
+  or failed.
+DEPENDENCIES
+  NIL
+RETURN VALUE
+none
+SIDE EFFECTS
+  NONE
+=====================================================================================*/
+static void nfc_ftm_cback(uint8 event, uint8 status)
+{
+    switch(event)
+    {
+        case HAL_NFC_OPEN_CPLT_EVT:
+             if(status == HAL_NFC_STATUS_OK)
+             {
+                 /* Release semaphore to indicate that hal open is done
+                 and change the state to write.*/
+                 hal_state = NCI_HAL_WRITE;
+                 hal_opened = TRUE;
+                 printf("HAL Open Success..state changed to Write  \n");
+             }
+             else
+             {
+                 printf("HAL Open Failed \n");
+                 hal_state = NCI_HAL_ERROR;
+                 hal_opened = FALSE;
+             }
+             sem_post(&semaphore_halcmd_complete);
+             break;
+        case HAL_NFC_CLOSE_CPLT_EVT:
+             printf("HAL_NFC_CLOSE_CPLT_EVT recieved..\n");
+             break;
+        default:
+             printf ("nfc_ftm_hal_cback unhandled event %x \n", event);
+             break;
+    }
+}
+/*==========================================================================================
+FUNCTION   fill_async_data
+DESCRIPTION
+This function will store all the incoming async msgs( like ntfs and data from QCA1990)
+in to a list to be committed further.
+DEPENDENCIES
+  NIL
+RETURN VALUE
+  NONE
+SIDE EFFECTS
+  NONE
+==============================================================================================*/
+void fill_async_data(uint16 data_len, uint8 *p_data)
+{
+    uint16 i = 0;
+    asyncdata *next_node = NULL;
+    printf("fill_async_data() function \n");
+    /* Initialize a list which will store all async message untill they are sent*/
+    if(buff == NULL)
+    {
+        /* first node creation*/
+        buff = (asyncdata*)malloc(sizeof(asyncdata));
+        if(buff)
+        {
+            start = buff;
+            buff->response_buff = (uint8*)malloc(data_len);
+            if(buff->response_buff)
+            {
+                memcpy(buff->response_buff, p_data, data_len);
+                buff->async_datalen = data_len;
+                buff->next = NULL;
+                async_msg_cnt = 0;
+                async_msg_cnt++;
+            }
+            else
+            {
+              printf("mem allocation failed while storing asysnc msg \n");
+            }
+        }
+        else
+        {
+            printf("mem allocation failed while trying to make the async list \n");
+        }
+    }
+    else
+    {
+        /* this is the case when some data is already present in the list which has not been sent yet*/
+        next_node = (asyncdata*)malloc(sizeof(asyncdata));
+        if(next_node)
+        {
+            next_node->response_buff = (uint8*)malloc(data_len);
+            if(next_node->response_buff)
+            {
+                memcpy(next_node->response_buff, p_data,data_len);
+                next_node->async_datalen = data_len;
+                next_node->next = NULL;
+                async_msg_cnt++;
+                while(buff->next != NULL)
+                {
+                   buff = buff->next;
+                }
+                buff->next = next_node;
+            }
+            else
+            {
+                printf("mem allocation failed while storing asysnc msg \n");
+            }
+        }
+        else
+        {
+           printf("mem allocation failed while trying to make the async list \n");
+        }
+    }
+}
+/*======================================================================================================
+FUNCTION   nfc_ftm_data_cback
+DESCRIPTION
+  This is the call back function which will provide back incoming data from the QCA1990
+  to nfc ftm.
+DEPENDENCIES
+  NIL
+RETURN VALUE
+  NONE
+SIDE EFFECTS
+  NONE
+========================================================================================================*/
+static void nfc_ftm_data_cback(uint16 data_len, uint8 *p_data)
+{
+    uint8 i = 0;
+    if(hal_opened == FALSE)
+    {
+        /* Reject data call backs untill HAL in initialized */
+        return;
+    }
+    if((data_len == 0x00) || (p_data == NULL))
+    {
+        printf("Error case : wrong data lentgh or buffer revcieved \n");
+        return;
+    }
+    if((i2c_req_write == TRUE) || (i2c_req_read == TRUE))
+    {
+        if(i2c_req_write)
+        {
+            /*check the incoming status*/
+            if(p_data[0] != 0x00) /* 0x00 = Command executed successfully*/
+            {
+                /* some error has occured in I2C write.Send the status code back now to pc app*/
+                i2c_status = p_data[0];
+                printf("Error occured in I2C write .. reporting to application..Error Code = %X \n", i2c_status);
+                hal_state = NCI_HAL_READ;
+                sem_post(&semaphore_halcmd_complete);
+            }
+            else
+            {
+                /*status is fine. Complete further requests as ftmdaemon is writing one by one*/
+                if(len)
+                {
+                    /*send further addr and value pair*/
+                    printf("I2C write status correct..sending next..\n");
+                    hal_state = NCI_HAL_WRITE;
+                }
+                else
+                {
+                    /*All I2C write completed .Send final status to app*/
+                     i2c_status = p_data[0];
+                     printf(" All I2C write completed i2c_status = %X \n", i2c_status);
+                     hal_state = NCI_HAL_READ;
+                }
+                sem_post(&semaphore_halcmd_complete);
+            }
+        }
+        else
+        {
+            /*I2C read rsp arrived . fill it in buffer if correct or report error if wrong*/
+            if(p_data[0] != 0x00)
+            {
+                /* some error has occured in I2C read.Send the status code to app*/
+                i2c_status = p_data[0];
+                printf("Error occured in I2C read .. reporting to application..Error Code = %X \n", i2c_status);
+                hal_state = NCI_HAL_READ;
+                memset(nfc_cmd_buff, 0, len);
+                sem_post(&semaphore_halcmd_complete);
+            }
+            else
+            {
+                if(len)
+                {
+                    /*send further addr to read*/
+                    i2c_status = p_data[0];
+                    i2c_reg_read_data[ii++] = p_data[1];
+                    hal_state = NCI_HAL_WRITE;
+                }
+                else
+                {
+                    /*All I2C read completed .Send the read data back to pc app*/
+                    i2c_status = p_data[0];
+                    i2c_reg_read_data[ii++] = p_data[1];
+                    hal_state = NCI_HAL_READ;
+                    ii = 0;
+                 }
+                 sem_post(&semaphore_halcmd_complete);
+             }
+        }
+    }
+    else
+    {
+        if(((p_data[0] & 0xF0) == 0x60 /*ntf packets*/) || ((p_data[0] & 0xF0) == 0x00)/*data packet rsps*/)
+        {
+            async_msg_available = TRUE;
+            pthread_mutex_lock(&nfcftm_mutex);
+            fill_async_data(data_len, p_data);
+            pthread_mutex_unlock(&nfcftm_mutex);
+            if(ftm_data_rsp_pending == TRUE)
+            {
+                printf("Sending data rsp \n");
+                hal_state = NCI_HAL_READ;
+                sem_post(&semaphore_halcmd_complete);
+                ftm_data_rsp_pending = FALSE;
+            }
+            else
+            {
+                if((wait_rsp == FALSE) || ((p_data[0] == 0x60) && (p_data[1] == 0x00)))
+                {
+                    /*This is the case when ntf receieved after rsp is logged to pc app*/
+                    printf("Sending async msg to logging subsystem \n");
+                    hal_state = NCI_HAL_ASYNC_LOG;
+                    sem_post(&semaphore_halcmd_complete);
+                }
+            }
+        }
+        else
+        {
+            if(response_buff || res_len)
+            {
+                printf("nfc_ftm_data_cback : response_buff = %p, res_len = %d", response_buff, res_len);
+                return;
+            }
+            response_buff = (uint8*)malloc(data_len);
+            if(response_buff)
+            {
+                memcpy(response_buff, p_data, data_len);
+                res_len = data_len;
+                printf("nfc_ftm_data_cback: res_len=%d data_len=%d  response_buff= %X %X %X %X %X %X  \n", res_len,data_len, \
+                         response_buff[0],response_buff[1],response_buff[2],response_buff[3],response_buff[4],response_buff[5]);
+                hal_state = NCI_HAL_READ;
+                sem_post(&semaphore_halcmd_complete);
+            }
+            else
+            {
+                printf("Mem allocation failed in nfc_ftm_data_cback \n");
+            }
+        }
+    }
+}
+/*===========================================================================
+FUNCTION   ftm_nfc_hal_open
+DESCRIPTION
+   This function will open the nfc hal for ftm nfc command processing.
+DEPENDENCIES
+  NIL
+RETURN VALUE
+  void
+SIDE EFFECTS
+  NONE
+===============================================================================*/
+uint8 ftm_nfc_hal_open(void)
+{
+    uint8 ret = 0;
+    ret = hw_get_module(NFC_NCI_HARDWARE_MODULE, &hw_module);
+    if(ret == 0)
+    {
+        dev = (nfc_nci_device_t*)malloc(sizeof(nfc_nci_device_t));
+        if(!dev)
+        {
+            printf("NFC FTM : mem allocation failed \n");
+            return FALSE;
+        }
+        else
+        {
+            ret = nfc_nci_open (hw_module, &dev);
+            if(ret != 0)
+            {
+                printf("NFC FTM : nfc_nci_open fail \n");
+                free(dev);
+                return FALSE;
+            }
+            else
+            {
+                printf("NFC FTM : opening NCI HAL \n");
+                dev->common.reserved[0] = FTM_MODE;
+                dev->open (dev, nfc_ftm_cback, nfc_ftm_data_cback);
+                sem_wait(&semaphore_halcmd_complete);
+            }
+        }
+    }
+    else
+    {
+       printf("NFC FTM : hw_get_module() call failed \n");
+       return FALSE;
+    }
+    return TRUE;
+}
+/*=================================================================================================
+FUNCTION   ftm_nfc_log_send_msg
+DESCRIPTION
+This function will log the asynchronous messages(NTFs and data packets) to the logging subsystem
+ of DIAG.
+DEPENDENCIES
+RETURN VALUE
+TRUE if data logged successfully and FALSE if failed.
+SIDE EFFECTS
+  None
+==================================================================================================*/
+int ftm_nfc_log_send_msg(void)
+{
+    uint16 i = 0;
+    ftm_nfc_log_pkt_type* ftm_nfc_log_pkt_ptr = NULL;
+    asyncdata* node = NULL;
+    uint8 arr[1]= {'\n'};
+    if(log_status(LOG_NFC_FTM))
+    {
+        buff = start;
+        if(buff != NULL)
+        {
+            do{
+                  printf("buff->async_datalen : %d \n", buff->async_datalen);
+                  ftm_nfc_log_pkt_ptr = (ftm_nfc_log_pkt_type *)log_alloc(LOG_NFC_FTM, (FTM_NFC_LOG_HEADER_SIZE + (buff->async_datalen)));
+                  if(ftm_nfc_log_pkt_ptr)
+                  {
+                      memcpy((void *)ftm_nfc_log_pkt_ptr->data, (void *)buff->response_buff, buff->async_datalen);
+                      printf("Async msg is = ");
+                      for(i=0; i<buff->async_datalen; i++)
+                      {
+                          printf("%X ", ftm_nfc_log_pkt_ptr->data[i]);
+                      }
+                      printf("%c",arr[0]);
+                      node = buff;
+                      buff = buff->next;
+                      free(node);
+                      printf("Commiting the log message(async msg) \n");
+                      log_commit(ftm_nfc_log_pkt_ptr);
+                  }
+                  else
+                  {
+                      printf("\nmem alloc failed in log_alloc \n");
+                      return FALSE;
+                  }
+              }while(buff != NULL);
+              printf("all msgs committed \n");
+              async_msg_available = FALSE;
+              return TRUE;
+          }
+          else
+          {
+              printf("No async message left to be logged \n");
+          }
+     }
+     else
+     {
+         printf("LOG_NFC_FTM code is not enabled in logging subsystem \n");
+     }
+     return FALSE;
+}
+/*===========================================================================
+FUNCTION   nfc_ftm_readerthread
+DESCRIPTION
+  Thread Routine to perfom asynchrounous handling of events coming from
+  NFCC. It will perform read and write for all type of commands/data.
+DEPENDENCIES
+RETURN VALUE
+  RETURN NIL
+SIDE EFFECTS
+  None
+===========================================================================*/
+void* nfc_ftm_thread(void *ptr)
+{
+    uint8 i2c_buff[3] = {0};
+
+    UNUSED(ptr);
+
+    while(1)
+    {
+       printf("Waiting for Cmd/Rsp \n");
+       sem_wait (&semaphore_halcmd_complete);
+       switch(hal_state)
+       {
+           case NCI_HAL_INIT:
+                printf("NFC FTM : HAL Open request recieved..\n");
+                if(ftm_nfc_hal_open() == FALSE)
+                {
+                    hal_state = NCI_HAL_ERROR;
+                    hal_opened = FALSE;
+                }
+                else
+                {
+                    break;
+                }
+           case NCI_HAL_ERROR:
+                /* HAL open failed.Post sem and handle error case*/
+                sem_post(&semaphore_nfcftmcmd_complete);
+                break;
+           case NCI_HAL_WRITE:
+                if(dev != NULL)
+                {
+                    printf("NFC FTM : Cmd recieved for nfc ftm..sending.\n");
+                    if((!i2c_req_write) && (!i2c_req_read))
+                    {
+                        /* send data to the NFCC*/
+                        if(nfc_cmd_buff[0] == 0x00 /*data req*/)
+                        {
+                            printf("Data send request arrived \n");
+                            ftm_data_rsp_pending = TRUE;
+                        }
+                        else
+                        {
+                            printf("cmd request arrived \n");
+                            wait_rsp = TRUE;
+                        }
+                        dev->write(dev, len, nfc_cmd_buff);
+                    }
+                    else
+                    {
+                        if(i2c_req_write)
+                        {
+                            i2c_buff[0] = 0xFF;
+                            i2c_buff[1] = nfc_cmd_buff[i2c_cmd_cnt++]; /* addr*/
+                            i2c_buff[2] = nfc_cmd_buff[i2c_cmd_cnt++]; /*value*/
+                            len -=2;
+                            dev->write(dev, 3, i2c_buff);
+                        }
+                        else
+                        {
+                            /* I2c Read req*/
+                            i2c_buff[0] = 0xFF;
+                            i2c_buff[1] = nfc_cmd_buff[i2c_cmd_cnt++]; /* I2C addr to read*/
+                            i2c_reg_read_data[ii++] = i2c_buff[1]; /* store address to send in response.*/
+                            len -= 1;
+                            dev->write(dev, 2, i2c_buff);
+                        }
+                    }
+                }
+                else
+                {
+                    printf("dev is null \n");
+                }
+                break;
+           case NCI_HAL_READ:
+                /* indicate to ftm that response is avilable now*/
+                sem_post(&semaphore_nfcftmcmd_complete);
+                 printf("NFC FTM : State changed to READ  i2c_req_read: %d\n",i2c_req_read);
+                break;
+           case NCI_HAL_ASYNC_LOG:
+                /* indicate to ftm that response is avilable now*/
+                printf("NFC FTM : State changed to NCI_HAL_ASYNC_LOG.Logging aysnc message \n");
+                pthread_mutex_lock(&nfcftm_mutex);
+                if(ftm_nfc_log_send_msg())
+                {
+                    printf("async msgs commited to the log system..changing HAL state to write \n");
+                }
+                else
+                {
+                   printf("async msgs commit failed..changing HAL state to write \n");
+                }
+                hal_state = NCI_HAL_WRITE;
+                pthread_mutex_unlock(&nfcftm_mutex);
+                break;
+           default:
+                break;
+       }
+    }
+}
+/*===========================================================================
+FUNCTION   ftm_nfc_dispatch
+DESCRIPTION
+This is the function which will be called by the NFC FTM layer callback function
+registered with the DIAG service./
+DEPENDENCIES
+RETURN VALUE
+  RETURN rsp pointer(containing the NFCC rsp packets) to the callback function
+  (subsequently for DIAG service)
+SIDE EFFECTS
+  None
+===========================================================================*/
+void* ftm_nfc_dispatch_qti(ftm_nfc_pkt_type *nfc_ftm_pkt, uint16 pkt_len)
+{
+    ftm_nfc_i2c_write_rsp_pkt_type *i2c_write_rsp = NULL;
+    ftm_nfc_i2c_read_rsp_pkt_type *i2c_read_rsp = NULL;
+    ftm_nfc_pkt_type *rsp = NULL;
+    ftm_nfc_data_rsp_pkt_type *nfc_data_rsp = NULL;
+    struct timespec time_sec;
+    int sem_status;
+
+    UNUSED(pkt_len);
+
+    printf("NFC FTM : nfc ftm mode requested \n");
+    if(nfc_ftm_pkt == NULL)
+    {
+        printf("Error : NULL packet recieved from DIAG \n");
+        goto error_case;
+    }
+    /* Start nfc_ftm_thread which will process all requests as per
+       state machine flow. By Default First state will be NCI_HAL_INIT*/
+    if(!nfc_ftmthread)
+    {
+        if(sem_init(&semaphore_halcmd_complete, 0, 1) != 0)
+        {
+            printf("NFC FTM :semaphore_halcmd_complete creation failed \n");
+            goto error_case;
+        }
+        if(sem_init(&semaphore_nfcftmcmd_complete, 0, 0) != 0)
+        {
+            printf("NFC FTM :semaphore_nfcftmcmd_complete creation failed \n");
+            goto error_case;
+        }
+        printf("NFC FTM : nfc ftm thread is being started \n");
+        pthread_create(&nfc_thread_handle, NULL, nfc_ftm_thread, NULL);
+        nfc_ftmthread = TRUE;
+    }
+    /* parse the diag packet to identify the NFC FTM command which needs to be sent
+       to QCA 1990*/
+    if(nfc_ftm_pkt->ftm_nfc_hdr.nfc_cmd_len > 2)
+    {
+        len = nfc_ftm_pkt->ftm_nfc_hdr.nfc_cmd_len-2;
+    }
+    else
+    {
+        /*Wrong nfc ftm packet*/
+        goto error_case;
+    }
+    switch(nfc_ftm_pkt->ftm_nfc_hdr.nfc_cmd_id)
+    {
+        case FTM_NFC_I2C_SLAVE_WRITE:
+             i2c_req_write = TRUE;
+             break;
+        case FTM_NFC_I2C_SLAVE_READ:
+             i2c_num_of_reg_to_read = len;
+             i2c_req_read = TRUE;
+             break;
+        case FTM_NFC_NFCC_COMMAND:
+        case FTM_NFC_SEND_DATA:
+             break;
+        default :
+             goto error_case;
+             break;
+    }
+    /*copy command to send it further to QCA1990*/
+    nfc_cmd_buff = (uint8 *)malloc(len+1);
+    if(nfc_cmd_buff)
+    {
+        memcpy(nfc_cmd_buff, nfc_ftm_pkt->nci_data, len);
+    }
+    else
+    {
+        printf("Mem allocation failed for cmd storage");
+        goto error_case;
+    }
+    /*send the command */
+    sem_post(&semaphore_halcmd_complete);
+    printf("\nwaiting for nfc ftm response \n");
+    if (clock_gettime(CLOCK_REALTIME, &time_sec) == -1)
+    {
+        printf("get clock_gettime error");
+    }
+    time_sec.tv_sec += FTM_NFC_CMD_CMPL_TIMEOUT;
+    sem_status = sem_timedwait(&semaphore_nfcftmcmd_complete,&time_sec);
+    if(sem_status == -1)
+    {
+        printf("nfc ftm command timed out\n");
+        goto error_case;
+    }
+    if(!hal_opened)
+    {
+        /*Hal open is failed */
+        free(nfc_cmd_buff);
+        hal_state = NCI_HAL_INIT;
+        goto error_case;
+    }
+    printf("\n\n *****Framing the response to send back to Diag service******** \n\n");
+    /* Frame the response as per the cmd request*/
+    switch(nfc_ftm_pkt->ftm_nfc_hdr.nfc_cmd_id)
+    {
+        case FTM_NFC_I2C_SLAVE_WRITE:
+             printf("Framing the response for FTM_NFC_I2C_SLAVE_WRITE cmd \n");
+             i2c_write_rsp = (ftm_nfc_i2c_write_rsp_pkt_type*)diagpkt_subsys_alloc(DIAG_SUBSYS_FTM,
+                                                                                   FTM_NFC_CMD_CODE,
+                                                                                   sizeof(ftm_nfc_i2c_write_rsp_pkt_type));
+             if(i2c_write_rsp)
+             {
+                 i2c_write_rsp->nfc_i2c_slave_status = i2c_status;
+                 i2c_status = 0;
+                 i2c_cmd_cnt = 0;
+                 i2c_req_write = FALSE;
+             }
+             break;
+       case  FTM_NFC_I2C_SLAVE_READ:
+             printf("Framing the response for FTM_NFC_I2C_SLAVE_READ cmd \n");
+             i2c_read_rsp = (ftm_nfc_i2c_read_rsp_pkt_type*)diagpkt_subsys_alloc(DIAG_SUBSYS_FTM,
+                                                                                 FTM_NFC_CMD_CODE,
+                                                                                 sizeof(ftm_nfc_i2c_read_rsp_pkt_type));
+             if(i2c_read_rsp)
+             {
+                 i2c_read_rsp->ftm_nfc_hdr.nfc_cmd_id = FTM_NFC_I2C_SLAVE_READ;
+                 i2c_read_rsp->ftm_nfc_hdr.nfc_cmd_len = 2+(2*i2c_num_of_reg_to_read);
+                 i2c_read_rsp->nfc_i2c_slave_status = i2c_status;
+                 if(i2c_status == 0x00)
+                 {
+                     i2c_read_rsp->nfc_nb_reg_reads = i2c_num_of_reg_to_read;
+                 }
+                 else
+                 {
+                     i2c_read_rsp->nfc_nb_reg_reads = 0x00; // error case so return num of read as 0x00.
+                 }
+                 memcpy(i2c_read_rsp->i2c_reg_read_rsp, i2c_reg_read_data, (i2c_num_of_reg_to_read*2));
+                 i2c_cmd_cnt = 0;
+             }
+             break;
+        case FTM_NFC_NFCC_COMMAND:
+             printf("Framing the response for FTM_NFC_NFCC_COMMAND cmd \n");
+             if(response_buff && res_len)
+             {
+                 rsp = (ftm_nfc_pkt_type*)diagpkt_subsys_alloc(DIAG_SUBSYS_FTM,
+                                                               FTM_NFC_CMD_CODE,
+                                                               sizeof(ftm_nfc_pkt_type));
+                 if(rsp)
+                 {
+                     rsp->ftm_nfc_hdr.nfc_cmd_id = FTM_NFC_NFCC_COMMAND;
+                     rsp->ftm_nfc_hdr.nfc_cmd_len = 2+res_len;
+                     rsp->nfc_nci_pkt_len = res_len;
+                     memcpy(rsp->nci_data, response_buff, res_len);
+                     free(response_buff);
+                     response_buff = 0;
+                     res_len = 0;
+                 }
+             }
+             else
+                 printf("ftm_nfc_dispatch : response_buff = %p, res_len = %d", response_buff, res_len);
+             break;
+        case FTM_NFC_SEND_DATA:
+             printf("Framing the response for FTM_NFC_SEND_DATA cmd \n");
+             nfc_data_rsp = (ftm_nfc_data_rsp_pkt_type*)diagpkt_subsys_alloc(DIAG_SUBSYS_FTM,
+                                                                             FTM_NFC_CMD_CODE,
+                                                                             sizeof(ftm_nfc_data_rsp_pkt_type));
+             if(nfc_data_rsp)
+             {
+                 nfc_data_rsp->ftm_nfc_hdr.nfc_cmd_id = FTM_NFC_SEND_DATA;
+                 nfc_data_rsp->ftm_nfc_hdr.nfc_cmd_len = 0;/*Rsp as per the NFC FTM data rsp req*/
+             }
+             break;
+        default:
+             goto error_case;
+             break;
+    }
+    free(nfc_cmd_buff);
+    hal_state = NCI_HAL_WRITE;
+    if(async_msg_available)
+    {
+        printf(" Some async message available.. committing now.\n");
+        hal_state = NCI_HAL_ASYNC_LOG;
+        sem_post(&semaphore_halcmd_complete);
+    }
+    wait_rsp = FALSE;
+    if(nfc_ftm_pkt->ftm_nfc_hdr.nfc_cmd_id == FTM_NFC_I2C_SLAVE_WRITE)
+    {
+        return(void*)i2c_write_rsp;
+    }
+    else if(nfc_ftm_pkt->ftm_nfc_hdr.nfc_cmd_id == FTM_NFC_I2C_SLAVE_READ)
+    {
+        i2c_req_read = FALSE;
+        return(void*)i2c_read_rsp;
+    }
+    else if(nfc_ftm_pkt->ftm_nfc_hdr.nfc_cmd_id == FTM_NFC_NFCC_COMMAND)
+    {
+        return(void*)rsp;
+    }
+    else
+    {
+        return(void*)nfc_data_rsp;
+    }
+error_case:
+    return NULL;
+}

feeds/ipq95xx/ftm/src/ftm_nfcqti.h

@@ -0,0 +1,141 @@
+#ifndef FTM_NFCQTI_H_
+#define FTM_NFCQTI_H_
+/*==========================================================================
+
+                     nfc FTM header File
+
+Description
+   This file contains the decalarations used by ftm_nfc.c
+
+Copyright (c) 2015 Qualcomm Technologies, Inc.
+All Rights Reserved.
+Confidential and Proprietary - Qualcomm Technologies, Inc.
+
+===========================================================================*/
+
+/*===========================================================================
+
+                         Edit History
+
+
+when        who              what,              where,     why
+--------   ---     ----------------------------------------------------------
+08/06/13                     NFC FTM layer
+===========================================================================*/
+
+#ifdef CONFIG_FTM_NFC
+
+#include "stdio.h"
+#include <pthread.h>
+#include <semaphore.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <hardware/nfc.h>
+#include <hardware/hardware.h>
+#include <malloc.h>
+#include <string.h>
+#include "msg.h"
+#include "log.h"
+
+#include "diag_lsm.h"
+#include "diagpkt.h"
+#include "diagcmd.h"
+#include "diag.h"
+#include "termios.h"
+
+/*==========================================================================*
+*                             Defnitions                                  *
+*==========================================================================*/
+#define FTM_MODE 1
+#define TRUE                      1
+#define FALSE                     0
+#define FTM_MODE                  1
+#define FTM_NFC_CMD_CODE          55
+#define LOG_NFC_FTM               0x1802
+#define FTM_NFC_LOG_HEADER_SIZE   12
+
+#define FTM_NFC_I2C_SLAVE_WRITE   0x00
+#define FTM_NFC_I2C_SLAVE_READ    0x01
+#define FTM_NFC_NFCC_COMMAND      0x02
+#define FTM_NFC_SEND_DATA         0x03
+
+#define FTM_NFC_CMD_CMPL_TIMEOUT  15
+
+#ifdef  ANDROID_M
+#define NFC_NCI_HARDWARE_MODULE "nfc_nci.qc199x"
+#else
+#define NFC_NCI_HARDWARE_MODULE "nfc_nci"
+#endif
+
+enum
+{
+    NCI_HAL_INIT,
+    NCI_HAL_WRITE,
+    NCI_HAL_READ,
+    NCI_HAL_DEINIT,
+    NCI_HAL_ASYNC_LOG,
+    NCI_HAL_ERROR
+};
+/*==========================================================================*
+*                             Declarations                                  *
+*==========================================================================*/
+/* Reader thread handle */
+pthread_t nfc_thread_handle;
+sem_t semaphore_halcmd_complete;
+sem_t semaphore_nfcftmcmd_complete;
+
+/* structure that contains nfc cmd id and len
+   part of the packet recieved from DIAG*/
+PACKED struct ftm_nfc_cmd_header_type{
+    uint16 nfc_cmd_id;
+    uint16 nfc_cmd_len;
+};
+
+/* nfc FTM packet(for NCI cmd/rsp messages)*/
+typedef PACKED struct{
+    diagpkt_subsys_header_type diag_hdr;
+    struct ftm_nfc_cmd_header_type ftm_nfc_hdr;
+    uint16 nfc_nci_pkt_len;
+    byte nci_data[258];
+}ftm_nfc_pkt_type;
+
+/* nfc FTM packet (for I2C write messgaes)*/
+typedef PACKED struct{
+    diagpkt_subsys_header_type diag_hdr;
+    uint8 nfc_i2c_slave_status;
+}ftm_nfc_i2c_write_rsp_pkt_type;
+
+/* nfc FTM packet (for I2C read messgaes)*/
+typedef PACKED struct{
+    diagpkt_subsys_header_type diag_hdr;
+    struct ftm_nfc_cmd_header_type ftm_nfc_hdr;
+    uint8 nfc_i2c_slave_status;
+    uint8 nfc_nb_reg_reads;
+    byte i2c_reg_read_rsp[30];
+}ftm_nfc_i2c_read_rsp_pkt_type;
+
+
+typedef PACKED struct{
+    diagpkt_subsys_header_type diag_hdr;
+    struct ftm_nfc_cmd_header_type ftm_nfc_hdr;
+}ftm_nfc_data_rsp_pkt_type;
+
+typedef PACKED struct{
+    log_hdr_type hdr;
+    byte data[1];
+}ftm_nfc_log_pkt_type;
+
+/*Data buffer linked list*/
+typedef struct asyncdata {
+    uint8 *response_buff;
+    uint8 async_datalen;
+    struct asyncdata *next;
+}asyncdata;
+
+typedef void (tHAL_NFC_CBACK) (uint8 event, uint8 status);
+typedef void (tHAL_NFC_DATA_CBACK) (uint16 data_len, uint8 *p_data);
+
+void* ftm_nfc_dispatch_qti(ftm_nfc_pkt_type *ftm_nfc_pkt, uint16 pkt_len);
+
+#endif /* CONFIG_FTM_NFC */
+#endif /* FTM_NFCQTI_H_ */