1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 *  linux/drivers/net/wireless/libertas/if_sdio.c
4 *
5 *  Copyright 2007-2008 Pierre Ossman
6 *
7 * Inspired by if_cs.c, Copyright 2007 Holger Schurig
8 *
9 * This hardware has more or less no CMD53 support, so all registers
10 * must be accessed using sdio_readb()/sdio_writeb().
11 *
12 * Transfers must be in one transaction or the firmware goes bonkers.
13 * This means that the transfer must either be small enough to do a
14 * byte based transfer or it must be padded to a multiple of the
15 * current block size.
16 *
17 * As SDIO is still new to the kernel, it is unfortunately common with
18 * bugs in the host controllers related to that. One such bug is that
19 * controllers cannot do transfers that aren't a multiple of 4 bytes.
20 * If you don't have time to fix the host controller driver, you can
21 * work around the problem by modifying if_sdio_host_to_card() and
22 * if_sdio_card_to_host() to pad the data.
23 */
24
25#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
26
27#include <linux/kernel.h>
28#include <linux/module.h>
29#include <linux/slab.h>
30#include <linux/firmware.h>
31#include <linux/netdevice.h>
32#include <linux/delay.h>
33#include <linux/mmc/card.h>
34#include <linux/mmc/sdio_func.h>
35#include <linux/mmc/sdio_ids.h>
36#include <linux/mmc/sdio.h>
37#include <linux/mmc/host.h>
38#include <linux/pm_runtime.h>
39
40#include "host.h"
41#include "decl.h"
42#include "defs.h"
43#include "dev.h"
44#include "cmd.h"
45#include "if_sdio.h"
46
47static void if_sdio_interrupt(struct sdio_func *func);
48
49/* The if_sdio_remove() callback function is called when
50 * user removes this module from kernel space or ejects
51 * the card from the slot. The driver handles these 2 cases
52 * differently for SD8688 combo chip.
53 * If the user is removing the module, the FUNC_SHUTDOWN
54 * command for SD8688 is sent to the firmware.
55 * If the card is removed, there is no need to send this command.
56 *
57 * The variable 'user_rmmod' is used to distinguish these two
58 * scenarios. This flag is initialized as FALSE in case the card
59 * is removed, and will be set to TRUE for module removal when
60 * module_exit function is called.
61 */
62static u8 user_rmmod;
63
64static const struct sdio_device_id if_sdio_ids[] = {
65	{ SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL,
66			SDIO_DEVICE_ID_MARVELL_LIBERTAS) },
67	{ SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL,
68			SDIO_DEVICE_ID_MARVELL_8688_WLAN) },
69	{ /* end: all zeroes */				},
70};
71
72MODULE_DEVICE_TABLE(sdio, if_sdio_ids);
73
74#define MODEL_8385	0x04
75#define MODEL_8686	0x0b
76#define MODEL_8688	0x10
77
78static const struct lbs_fw_table fw_table[] = {
79	{ MODEL_8385, "libertas/sd8385_helper.bin", "libertas/sd8385.bin" },
80	{ MODEL_8385, "sd8385_helper.bin", "sd8385.bin" },
81	{ MODEL_8686, "libertas/sd8686_v9_helper.bin", "libertas/sd8686_v9.bin" },
82	{ MODEL_8686, "libertas/sd8686_v8_helper.bin", "libertas/sd8686_v8.bin" },
83	{ MODEL_8686, "sd8686_helper.bin", "sd8686.bin" },
84	{ MODEL_8688, "libertas/sd8688_helper.bin", "libertas/sd8688.bin" },
85	{ MODEL_8688, "sd8688_helper.bin", "sd8688.bin" },
86	{ 0, NULL, NULL }
87};
88MODULE_FIRMWARE("libertas/sd8385_helper.bin");
89MODULE_FIRMWARE("libertas/sd8385.bin");
90MODULE_FIRMWARE("sd8385_helper.bin");
91MODULE_FIRMWARE("sd8385.bin");
92MODULE_FIRMWARE("libertas/sd8686_v9_helper.bin");
93MODULE_FIRMWARE("libertas/sd8686_v9.bin");
94MODULE_FIRMWARE("libertas/sd8686_v8_helper.bin");
95MODULE_FIRMWARE("libertas/sd8686_v8.bin");
96MODULE_FIRMWARE("sd8686_helper.bin");
97MODULE_FIRMWARE("sd8686.bin");
98MODULE_FIRMWARE("libertas/sd8688_helper.bin");
99MODULE_FIRMWARE("libertas/sd8688.bin");
100MODULE_FIRMWARE("sd8688_helper.bin");
101MODULE_FIRMWARE("sd8688.bin");
102
103struct if_sdio_packet {
104	struct if_sdio_packet	*next;
105	u16			nb;
106	u8			buffer[] __aligned(4);
107};
108
109struct if_sdio_card {
110	struct sdio_func	*func;
111	struct lbs_private	*priv;
112
113	int			model;
114	unsigned long		ioport;
115	unsigned int		scratch_reg;
116	bool			started;
117	wait_queue_head_t	pwron_waitq;
118
119	u8			buffer[65536] __attribute__((aligned(4)));
120
121	spinlock_t		lock;
122	struct if_sdio_packet	*packets;
123
124	struct workqueue_struct	*workqueue;
125	struct work_struct	packet_worker;
126
127	u8			rx_unit;
128};
129
130static void if_sdio_finish_power_on(struct if_sdio_card *card);
131static int if_sdio_power_off(struct if_sdio_card *card);
132
133/********************************************************************/
134/* I/O                                                              */
135/********************************************************************/
136
137/*
138 *  For SD8385/SD8686, this function reads firmware status after
139 *  the image is downloaded, or reads RX packet length when
140 *  interrupt (with IF_SDIO_H_INT_UPLD bit set) is received.
141 *  For SD8688, this function reads firmware status only.
142 */
143static u16 if_sdio_read_scratch(struct if_sdio_card *card, int *err)
144{
145	int ret;
146	u16 scratch;
147
148	scratch = sdio_readb(card->func, card->scratch_reg, &ret);
149	if (!ret)
150		scratch |= sdio_readb(card->func, card->scratch_reg + 1,
151					&ret) << 8;
152
153	if (err)
154		*err = ret;
155
156	if (ret)
157		return 0xffff;
158
159	return scratch;
160}
161
162static u8 if_sdio_read_rx_unit(struct if_sdio_card *card)
163{
164	int ret;
165	u8 rx_unit;
166
167	rx_unit = sdio_readb(card->func, IF_SDIO_RX_UNIT, &ret);
168
169	if (ret)
170		rx_unit = 0;
171
172	return rx_unit;
173}
174
175static u16 if_sdio_read_rx_len(struct if_sdio_card *card, int *err)
176{
177	int ret;
178	u16 rx_len;
179
180	switch (card->model) {
181	case MODEL_8385:
182	case MODEL_8686:
183		rx_len = if_sdio_read_scratch(card, &ret);
184		break;
185	case MODEL_8688:
186	default: /* for newer chipsets */
187		rx_len = sdio_readb(card->func, IF_SDIO_RX_LEN, &ret);
188		if (!ret)
189			rx_len <<= card->rx_unit;
190		else
191			rx_len = 0xffff;	/* invalid length */
192
193		break;
194	}
195
196	if (err)
197		*err = ret;
198
199	return rx_len;
200}
201
202static int if_sdio_handle_cmd(struct if_sdio_card *card,
203		u8 *buffer, unsigned size)
204{
205	struct lbs_private *priv = card->priv;
206	int ret;
207	unsigned long flags;
208	u8 i;
209
210	if (size > LBS_CMD_BUFFER_SIZE) {
211		lbs_deb_sdio("response packet too large (%d bytes)\n",
212			(int)size);
213		ret = -E2BIG;
214		goto out;
215	}
216
217	spin_lock_irqsave(&priv->driver_lock, flags);
218
219	i = (priv->resp_idx == 0) ? 1 : 0;
220	BUG_ON(priv->resp_len[i]);
221	priv->resp_len[i] = size;
222	memcpy(priv->resp_buf[i], buffer, size);
223	lbs_notify_command_response(priv, i);
224
225	spin_unlock_irqrestore(&priv->driver_lock, flags);
226
227	ret = 0;
228
229out:
230	return ret;
231}
232
233static int if_sdio_handle_data(struct if_sdio_card *card,
234		u8 *buffer, unsigned size)
235{
236	int ret;
237	struct sk_buff *skb;
238
239	if (size > MRVDRV_ETH_RX_PACKET_BUFFER_SIZE) {
240		lbs_deb_sdio("response packet too large (%d bytes)\n",
241			(int)size);
242		ret = -E2BIG;
243		goto out;
244	}
245
246	skb = dev_alloc_skb(MRVDRV_ETH_RX_PACKET_BUFFER_SIZE + NET_IP_ALIGN);
247	if (!skb) {
248		ret = -ENOMEM;
249		goto out;
250	}
251
252	skb_reserve(skb, NET_IP_ALIGN);
253
254	skb_put_data(skb, buffer, size);
255
256	lbs_process_rxed_packet(card->priv, skb);
257
258	ret = 0;
259
260out:
261	return ret;
262}
263
264static int if_sdio_handle_event(struct if_sdio_card *card,
265		u8 *buffer, unsigned size)
266{
267	int ret;
268	u32 event;
269
270	if (card->model == MODEL_8385) {
271		event = sdio_readb(card->func, IF_SDIO_EVENT, &ret);
272		if (ret)
273			goto out;
274
275		/* right shift 3 bits to get the event id */
276		event >>= 3;
277	} else {
278		if (size < 4) {
279			lbs_deb_sdio("event packet too small (%d bytes)\n",
280				(int)size);
281			ret = -EINVAL;
282			goto out;
283		}
284		event = buffer[3] << 24;
285		event |= buffer[2] << 16;
286		event |= buffer[1] << 8;
287		event |= buffer[0] << 0;
288	}
289
290	lbs_queue_event(card->priv, event & 0xFF);
291	ret = 0;
292
293out:
294	return ret;
295}
296
297static int if_sdio_wait_status(struct if_sdio_card *card, const u8 condition)
298{
299	u8 status;
300	unsigned long timeout;
301	int ret = 0;
302
303	timeout = jiffies + HZ;
304	while (1) {
305		status = sdio_readb(card->func, IF_SDIO_STATUS, &ret);
306		if (ret)
307			return ret;
308		if ((status & condition) == condition)
309			break;
310		if (time_after(jiffies, timeout))
311			return -ETIMEDOUT;
312		mdelay(1);
313	}
314	return ret;
315}
316
317static int if_sdio_card_to_host(struct if_sdio_card *card)
318{
319	int ret;
320	u16 size, type, chunk;
321
322	size = if_sdio_read_rx_len(card, &ret);
323	if (ret)
324		goto out;
325
326	if (size < 4) {
327		lbs_deb_sdio("invalid packet size (%d bytes) from firmware\n",
328			(int)size);
329		ret = -EINVAL;
330		goto out;
331	}
332
333	ret = if_sdio_wait_status(card, IF_SDIO_IO_RDY);
334	if (ret)
335		goto out;
336
337	/*
338	 * The transfer must be in one transaction or the firmware
339	 * goes suicidal. There's no way to guarantee that for all
340	 * controllers, but we can at least try.
341	 */
342	chunk = sdio_align_size(card->func, size);
343
344	ret = sdio_readsb(card->func, card->buffer, card->ioport, chunk);
345	if (ret)
346		goto out;
347
348	chunk = card->buffer[0] | (card->buffer[1] << 8);
349	type = card->buffer[2] | (card->buffer[3] << 8);
350
351	lbs_deb_sdio("packet of type %d and size %d bytes\n",
352		(int)type, (int)chunk);
353
354	if (chunk > size) {
355		lbs_deb_sdio("packet fragment (%d > %d)\n",
356			(int)chunk, (int)size);
357		ret = -EINVAL;
358		goto out;
359	}
360
361	if (chunk < size) {
362		lbs_deb_sdio("packet fragment (%d < %d)\n",
363			(int)chunk, (int)size);
364	}
365
366	switch (type) {
367	case MVMS_CMD:
368		ret = if_sdio_handle_cmd(card, card->buffer + 4, chunk - 4);
369		if (ret)
370			goto out;
371		break;
372	case MVMS_DAT:
373		ret = if_sdio_handle_data(card, card->buffer + 4, chunk - 4);
374		if (ret)
375			goto out;
376		break;
377	case MVMS_EVENT:
378		ret = if_sdio_handle_event(card, card->buffer + 4, chunk - 4);
379		if (ret)
380			goto out;
381		break;
382	default:
383		lbs_deb_sdio("invalid type (%d) from firmware\n",
384				(int)type);
385		ret = -EINVAL;
386		goto out;
387	}
388
389out:
390	if (ret)
391		pr_err("problem fetching packet from firmware\n");
392
393	return ret;
394}
395
396static void if_sdio_host_to_card_worker(struct work_struct *work)
397{
398	struct if_sdio_card *card;
399	struct if_sdio_packet *packet;
400	int ret;
401	unsigned long flags;
402
403	card = container_of(work, struct if_sdio_card, packet_worker);
404
405	while (1) {
406		spin_lock_irqsave(&card->lock, flags);
407		packet = card->packets;
408		if (packet)
409			card->packets = packet->next;
410		spin_unlock_irqrestore(&card->lock, flags);
411
412		if (!packet)
413			break;
414
415		sdio_claim_host(card->func);
416
417		ret = if_sdio_wait_status(card, IF_SDIO_IO_RDY);
418		if (ret == 0) {
419			ret = sdio_writesb(card->func, card->ioport,
420					   packet->buffer, packet->nb);
421		}
422
423		if (ret)
424			pr_err("error %d sending packet to firmware\n", ret);
425
426		sdio_release_host(card->func);
427
428		kfree(packet);
429	}
430}
431
432/********************************************************************/
433/* Firmware                                                         */
434/********************************************************************/
435
436#define FW_DL_READY_STATUS (IF_SDIO_IO_RDY | IF_SDIO_DL_RDY)
437
438static int if_sdio_prog_helper(struct if_sdio_card *card,
439				const struct firmware *fw)
440{
441	int ret;
442	unsigned long timeout;
443	u8 *chunk_buffer;
444	u32 chunk_size;
445	const u8 *firmware;
446	size_t size;
447
448	chunk_buffer = kzalloc(64, GFP_KERNEL);
449	if (!chunk_buffer) {
450		ret = -ENOMEM;
451		goto out;
452	}
453
454	sdio_claim_host(card->func);
455
456	ret = sdio_set_block_size(card->func, 32);
457	if (ret)
458		goto release;
459
460	firmware = fw->data;
461	size = fw->size;
462
463	while (size) {
464		ret = if_sdio_wait_status(card, FW_DL_READY_STATUS);
465		if (ret)
466			goto release;
467
468		/* On some platforms (like Davinci) the chip needs more time
469		 * between helper blocks.
470		 */
471		mdelay(2);
472
473		chunk_size = min_t(size_t, size, 60);
474
475		*((__le32*)chunk_buffer) = cpu_to_le32(chunk_size);
476		memcpy(chunk_buffer + 4, firmware, chunk_size);
477/*
478		lbs_deb_sdio("sending %d bytes chunk\n", chunk_size);
479*/
480		ret = sdio_writesb(card->func, card->ioport,
481				chunk_buffer, 64);
482		if (ret)
483			goto release;
484
485		firmware += chunk_size;
486		size -= chunk_size;
487	}
488
489	/* an empty block marks the end of the transfer */
490	memset(chunk_buffer, 0, 4);
491	ret = sdio_writesb(card->func, card->ioport, chunk_buffer, 64);
492	if (ret)
493		goto release;
494
495	lbs_deb_sdio("waiting for helper to boot...\n");
496
497	/* wait for the helper to boot by looking at the size register */
498	timeout = jiffies + HZ;
499	while (1) {
500		u16 req_size;
501
502		req_size = sdio_readb(card->func, IF_SDIO_RD_BASE, &ret);
503		if (ret)
504			goto release;
505
506		req_size |= sdio_readb(card->func, IF_SDIO_RD_BASE + 1, &ret) << 8;
507		if (ret)
508			goto release;
509
510		if (req_size != 0)
511			break;
512
513		if (time_after(jiffies, timeout)) {
514			ret = -ETIMEDOUT;
515			goto release;
516		}
517
518		msleep(10);
519	}
520
521	ret = 0;
522
523release:
524	sdio_release_host(card->func);
525	kfree(chunk_buffer);
526
527out:
528	if (ret)
529		pr_err("failed to load helper firmware\n");
530
531	return ret;
532}
533
534static int if_sdio_prog_real(struct if_sdio_card *card,
535				const struct firmware *fw)
536{
537	int ret;
538	unsigned long timeout;
539	u8 *chunk_buffer;
540	u32 chunk_size;
541	const u8 *firmware;
542	size_t size, req_size;
543
544	chunk_buffer = kzalloc(512, GFP_KERNEL);
545	if (!chunk_buffer) {
546		ret = -ENOMEM;
547		goto out;
548	}
549
550	sdio_claim_host(card->func);
551
552	ret = sdio_set_block_size(card->func, 32);
553	if (ret)
554		goto release;
555
556	firmware = fw->data;
557	size = fw->size;
558
559	while (size) {
560		timeout = jiffies + HZ;
561		while (1) {
562			ret = if_sdio_wait_status(card, FW_DL_READY_STATUS);
563			if (ret)
564				goto release;
565
566			req_size = sdio_readb(card->func, IF_SDIO_RD_BASE,
567					&ret);
568			if (ret)
569				goto release;
570
571			req_size |= sdio_readb(card->func, IF_SDIO_RD_BASE + 1,
572					&ret) << 8;
573			if (ret)
574				goto release;
575
576			/*
577			 * For SD8688 wait until the length is not 0, 1 or 2
578			 * before downloading the first FW block,
579			 * since BOOT code writes the register to indicate the
580			 * helper/FW download winner,
581			 * the value could be 1 or 2 (Func1 or Func2).
582			 */
583			if ((size != fw->size) || (req_size > 2))
584				break;
585			if (time_after(jiffies, timeout)) {
586				ret = -ETIMEDOUT;
587				goto release;
588			}
589			mdelay(1);
590		}
591
592/*
593		lbs_deb_sdio("firmware wants %d bytes\n", (int)req_size);
594*/
595		if (req_size == 0) {
596			lbs_deb_sdio("firmware helper gave up early\n");
597			ret = -EIO;
598			goto release;
599		}
600
601		if (req_size & 0x01) {
602			lbs_deb_sdio("firmware helper signalled error\n");
603			ret = -EIO;
604			goto release;
605		}
606
607		if (req_size > size)
608			req_size = size;
609
610		while (req_size) {
611			chunk_size = min_t(size_t, req_size, 512);
612
613			memcpy(chunk_buffer, firmware, chunk_size);
614/*
615			lbs_deb_sdio("sending %d bytes (%d bytes) chunk\n",
616				chunk_size, (chunk_size + 31) / 32 * 32);
617*/
618			ret = sdio_writesb(card->func, card->ioport,
619				chunk_buffer, roundup(chunk_size, 32));
620			if (ret)
621				goto release;
622
623			firmware += chunk_size;
624			size -= chunk_size;
625			req_size -= chunk_size;
626		}
627	}
628
629	ret = 0;
630
631	lbs_deb_sdio("waiting for firmware to boot...\n");
632
633	/* wait for the firmware to boot */
634	timeout = jiffies + HZ;
635	while (1) {
636		u16 scratch;
637
638		scratch = if_sdio_read_scratch(card, &ret);
639		if (ret)
640			goto release;
641
642		if (scratch == IF_SDIO_FIRMWARE_OK)
643			break;
644
645		if (time_after(jiffies, timeout)) {
646			ret = -ETIMEDOUT;
647			goto release;
648		}
649
650		msleep(10);
651	}
652
653	ret = 0;
654
655release:
656	sdio_release_host(card->func);
657	kfree(chunk_buffer);
658
659out:
660	if (ret)
661		pr_err("failed to load firmware\n");
662
663	return ret;
664}
665
666static void if_sdio_do_prog_firmware(struct lbs_private *priv, int ret,
667				     const struct firmware *helper,
668				     const struct firmware *mainfw)
669{
670	struct if_sdio_card *card = priv->card;
671
672	if (ret) {
673		pr_err("failed to find firmware (%d)\n", ret);
674		return;
675	}
676
677	ret = if_sdio_prog_helper(card, helper);
678	if (ret)
679		return;
680
681	lbs_deb_sdio("Helper firmware loaded\n");
682
683	ret = if_sdio_prog_real(card, mainfw);
684	if (ret)
685		return;
686
687	lbs_deb_sdio("Firmware loaded\n");
688	if_sdio_finish_power_on(card);
689}
690
691static int if_sdio_prog_firmware(struct if_sdio_card *card)
692{
693	int ret;
694	u16 scratch;
695
696	/*
697	 * Disable interrupts
698	 */
699	sdio_claim_host(card->func);
700	sdio_writeb(card->func, 0x00, IF_SDIO_H_INT_MASK, &ret);
701	sdio_release_host(card->func);
702
703	sdio_claim_host(card->func);
704	scratch = if_sdio_read_scratch(card, &ret);
705	sdio_release_host(card->func);
706
707	lbs_deb_sdio("firmware status = %#x\n", scratch);
708	lbs_deb_sdio("scratch ret = %d\n", ret);
709
710	if (ret)
711		goto out;
712
713
714	/*
715	 * The manual clearly describes that FEDC is the right code to use
716	 * to detect firmware presence, but for SD8686 it is not that simple.
717	 * Scratch is also used to store the RX packet length, so we lose
718	 * the FEDC value early on. So we use a non-zero check in order
719	 * to validate firmware presence.
720	 * Additionally, the SD8686 in the Gumstix always has the high scratch
721	 * bit set, even when the firmware is not loaded. So we have to
722	 * exclude that from the test.
723	 */
724	if (scratch == IF_SDIO_FIRMWARE_OK) {
725		lbs_deb_sdio("firmware already loaded\n");
726		if_sdio_finish_power_on(card);
727		return 0;
728	} else if ((card->model == MODEL_8686) && (scratch & 0x7fff)) {
729		lbs_deb_sdio("firmware may be running\n");
730		if_sdio_finish_power_on(card);
731		return 0;
732	}
733
734	ret = lbs_get_firmware_async(card->priv, &card->func->dev, card->model,
735				     fw_table, if_sdio_do_prog_firmware);
736
737out:
738	return ret;
739}
740
741/********************************************************************/
742/* Power management                                                 */
743/********************************************************************/
744
745/* Finish power on sequence (after firmware is loaded) */
746static void if_sdio_finish_power_on(struct if_sdio_card *card)
747{
748	struct sdio_func *func = card->func;
749	struct lbs_private *priv = card->priv;
750	int ret;
751
752	sdio_claim_host(func);
753	sdio_set_block_size(card->func, IF_SDIO_BLOCK_SIZE);
754
755	/*
756	 * Get rx_unit if the chip is SD8688 or newer.
757	 * SD8385 & SD8686 do not have rx_unit.
758	 */
759	if ((card->model != MODEL_8385)
760			&& (card->model != MODEL_8686))
761		card->rx_unit = if_sdio_read_rx_unit(card);
762	else
763		card->rx_unit = 0;
764
765	/*
766	 * Set up the interrupt handler late.
767	 *
768	 * If we set it up earlier, the (buggy) hardware generates a spurious
769	 * interrupt, even before the interrupt has been enabled, with
770	 * CCCR_INTx = 0.
771	 *
772	 * We register the interrupt handler late so that we can handle any
773	 * spurious interrupts, and also to avoid generation of that known
774	 * spurious interrupt in the first place.
775	 */
776	ret = sdio_claim_irq(func, if_sdio_interrupt);
777	if (ret)
778		goto release;
779
780	/*
781	 * Enable interrupts now that everything is set up
782	 */
783	sdio_writeb(func, 0x0f, IF_SDIO_H_INT_MASK, &ret);
784	if (ret)
785		goto release_irq;
786
787	sdio_release_host(func);
788
789	/* Set fw_ready before queuing any commands so that
790	 * lbs_thread won't block from sending them to firmware.
791	 */
792	priv->fw_ready = 1;
793
794	/*
795	 * FUNC_INIT is required for SD8688 WLAN/BT multiple functions
796	 */
797	if (card->model == MODEL_8688) {
798		struct cmd_header cmd;
799
800		memset(&cmd, 0, sizeof(cmd));
801
802		lbs_deb_sdio("send function INIT command\n");
803		if (__lbs_cmd(priv, CMD_FUNC_INIT, &cmd, sizeof(cmd),
804				lbs_cmd_copyback, (unsigned long) &cmd))
805			netdev_alert(priv->dev, "CMD_FUNC_INIT cmd failed\n");
806	}
807
808	wake_up(&card->pwron_waitq);
809
810	if (!card->started) {
811		ret = lbs_start_card(priv);
812		if_sdio_power_off(card);
813		if (ret == 0) {
814			card->started = true;
815			/* Tell PM core that we don't need the card to be
816			 * powered now */
817			pm_runtime_put(&func->dev);
818		}
819	}
820
821	return;
822
823release_irq:
824	sdio_release_irq(func);
825release:
826	sdio_release_host(func);
827}
828
829static int if_sdio_power_on(struct if_sdio_card *card)
830{
831	struct sdio_func *func = card->func;
832	struct mmc_host *host = func->card->host;
833	int ret;
834
835	sdio_claim_host(func);
836
837	ret = sdio_enable_func(func);
838	if (ret)
839		goto release;
840
841	/* For 1-bit transfers to the 8686 model, we need to enable the
842	 * interrupt flag in the CCCR register. Set the MMC_QUIRK_LENIENT_FN0
843	 * bit to allow access to non-vendor registers. */
844	if ((card->model == MODEL_8686) &&
845	    (host->caps & MMC_CAP_SDIO_IRQ) &&
846	    (host->ios.bus_width == MMC_BUS_WIDTH_1)) {
847		u8 reg;
848
849		func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
850		reg = sdio_f0_readb(func, SDIO_CCCR_IF, &ret);
851		if (ret)
852			goto disable;
853
854		reg |= SDIO_BUS_ECSI;
855		sdio_f0_writeb(func, reg, SDIO_CCCR_IF, &ret);
856		if (ret)
857			goto disable;
858	}
859
860	card->ioport = sdio_readb(func, IF_SDIO_IOPORT, &ret);
861	if (ret)
862		goto disable;
863
864	card->ioport |= sdio_readb(func, IF_SDIO_IOPORT + 1, &ret) << 8;
865	if (ret)
866		goto disable;
867
868	card->ioport |= sdio_readb(func, IF_SDIO_IOPORT + 2, &ret) << 16;
869	if (ret)
870		goto disable;
871
872	sdio_release_host(func);
873	ret = if_sdio_prog_firmware(card);
874	if (ret) {
875		sdio_claim_host(func);
876		goto disable;
877	}
878
879	return 0;
880
881disable:
882	sdio_disable_func(func);
883release:
884	sdio_release_host(func);
885	return ret;
886}
887
888static int if_sdio_power_off(struct if_sdio_card *card)
889{
890	struct sdio_func *func = card->func;
891	struct lbs_private *priv = card->priv;
892
893	priv->fw_ready = 0;
894
895	sdio_claim_host(func);
896	sdio_release_irq(func);
897	sdio_disable_func(func);
898	sdio_release_host(func);
899	return 0;
900}
901
902
903/*******************************************************************/
904/* Libertas callbacks                                              */
905/*******************************************************************/
906
907static int if_sdio_host_to_card(struct lbs_private *priv,
908		u8 type, u8 *buf, u16 nb)
909{
910	int ret;
911	struct if_sdio_card *card;
912	struct if_sdio_packet *packet, *cur;
913	u16 size;
914	unsigned long flags;
915
916	card = priv->card;
917
918	if (nb > (65536 - sizeof(struct if_sdio_packet) - 4)) {
919		ret = -EINVAL;
920		goto out;
921	}
922
923	/*
924	 * The transfer must be in one transaction or the firmware
925	 * goes suicidal. There's no way to guarantee that for all
926	 * controllers, but we can at least try.
927	 */
928	size = sdio_align_size(card->func, nb + 4);
929
930	packet = kzalloc(sizeof(struct if_sdio_packet) + size,
931			GFP_ATOMIC);
932	if (!packet) {
933		ret = -ENOMEM;
934		goto out;
935	}
936
937	packet->next = NULL;
938	packet->nb = size;
939
940	/*
941	 * SDIO specific header.
942	 */
943	packet->buffer[0] = (nb + 4) & 0xff;
944	packet->buffer[1] = ((nb + 4) >> 8) & 0xff;
945	packet->buffer[2] = type;
946	packet->buffer[3] = 0;
947
948	memcpy(packet->buffer + 4, buf, nb);
949
950	spin_lock_irqsave(&card->lock, flags);
951
952	if (!card->packets)
953		card->packets = packet;
954	else {
955		cur = card->packets;
956		while (cur->next)
957			cur = cur->next;
958		cur->next = packet;
959	}
960
961	switch (type) {
962	case MVMS_CMD:
963		priv->dnld_sent = DNLD_CMD_SENT;
964		break;
965	case MVMS_DAT:
966		priv->dnld_sent = DNLD_DATA_SENT;
967		break;
968	default:
969		lbs_deb_sdio("unknown packet type %d\n", (int)type);
970	}
971
972	spin_unlock_irqrestore(&card->lock, flags);
973
974	queue_work(card->workqueue, &card->packet_worker);
975
976	ret = 0;
977
978out:
979	return ret;
980}
981
982static int if_sdio_enter_deep_sleep(struct lbs_private *priv)
983{
984	int ret = -1;
985	struct cmd_header cmd;
986
987	memset(&cmd, 0, sizeof(cmd));
988
989	lbs_deb_sdio("send DEEP_SLEEP command\n");
990	ret = __lbs_cmd(priv, CMD_802_11_DEEP_SLEEP, &cmd, sizeof(cmd),
991			lbs_cmd_copyback, (unsigned long) &cmd);
992	if (ret)
993		netdev_err(priv->dev, "DEEP_SLEEP cmd failed\n");
994
995	mdelay(200);
996	return ret;
997}
998
999static int if_sdio_exit_deep_sleep(struct lbs_private *priv)
1000{
1001	struct if_sdio_card *card = priv->card;
1002	int ret = -1;
1003
1004	sdio_claim_host(card->func);
1005
1006	sdio_writeb(card->func, HOST_POWER_UP, CONFIGURATION_REG, &ret);
1007	if (ret)
1008		netdev_err(priv->dev, "sdio_writeb failed!\n");
1009
1010	sdio_release_host(card->func);
1011
1012	return ret;
1013}
1014
1015static int if_sdio_reset_deep_sleep_wakeup(struct lbs_private *priv)
1016{
1017	struct if_sdio_card *card = priv->card;
1018	int ret = -1;
1019
1020	sdio_claim_host(card->func);
1021
1022	sdio_writeb(card->func, 0, CONFIGURATION_REG, &ret);
1023	if (ret)
1024		netdev_err(priv->dev, "sdio_writeb failed!\n");
1025
1026	sdio_release_host(card->func);
1027
1028	return ret;
1029
1030}
1031
1032static struct mmc_host *reset_host;
1033
1034static void if_sdio_reset_card_worker(struct work_struct *work)
1035{
1036	/*
1037	 * The actual reset operation must be run outside of lbs_thread. This
1038	 * is because mmc_remove_host() will cause the device to be instantly
1039	 * destroyed, and the libertas driver then needs to end lbs_thread,
1040	 * leading to a deadlock.
1041	 *
1042	 * We run it in a workqueue totally independent from the if_sdio_card
1043	 * instance for that reason.
1044	 */
1045
1046	pr_info("Resetting card...");
1047	mmc_remove_host(reset_host);
1048	mmc_add_host(reset_host);
1049}
1050static DECLARE_WORK(card_reset_work, if_sdio_reset_card_worker);
1051
1052static void if_sdio_reset_card(struct lbs_private *priv)
1053{
1054	struct if_sdio_card *card = priv->card;
1055
1056	if (work_pending(&card_reset_work))
1057		return;
1058
1059	reset_host = card->func->card->host;
1060	schedule_work(&card_reset_work);
1061}
1062
1063static int if_sdio_power_save(struct lbs_private *priv)
1064{
1065	struct if_sdio_card *card = priv->card;
1066	int ret;
1067
1068	flush_workqueue(card->workqueue);
1069
1070	ret = if_sdio_power_off(card);
1071
1072	/* Let runtime PM know the card is powered off */
1073	pm_runtime_put_sync(&card->func->dev);
1074
1075	return ret;
1076}
1077
1078static int if_sdio_power_restore(struct lbs_private *priv)
1079{
1080	struct if_sdio_card *card = priv->card;
1081	int r;
1082
1083	/* Make sure the card will not be powered off by runtime PM */
1084	pm_runtime_get_sync(&card->func->dev);
1085
1086	r = if_sdio_power_on(card);
1087	if (r)
1088		return r;
1089
1090	wait_event(card->pwron_waitq, priv->fw_ready);
1091	return 0;
1092}
1093
1094
1095/*******************************************************************/
1096/* SDIO callbacks                                                  */
1097/*******************************************************************/
1098
1099static void if_sdio_interrupt(struct sdio_func *func)
1100{
1101	int ret;
1102	struct if_sdio_card *card;
1103	u8 cause;
1104
1105	card = sdio_get_drvdata(func);
1106
1107	cause = sdio_readb(card->func, IF_SDIO_H_INT_STATUS, &ret);
1108	if (ret || !cause)
1109		return;
1110
1111	lbs_deb_sdio("interrupt: 0x%X\n", (unsigned)cause);
1112
1113	sdio_writeb(card->func, ~cause, IF_SDIO_H_INT_STATUS, &ret);
1114	if (ret)
1115		return;
1116
1117	/*
1118	 * Ignore the define name, this really means the card has
1119	 * successfully received the command.
1120	 */
1121	card->priv->is_activity_detected = 1;
1122	if (cause & IF_SDIO_H_INT_DNLD)
1123		lbs_host_to_card_done(card->priv);
1124
1125
1126	if (cause & IF_SDIO_H_INT_UPLD) {
1127		ret = if_sdio_card_to_host(card);
1128		if (ret)
1129			return;
1130	}
1131}
1132
1133static int if_sdio_probe(struct sdio_func *func,
1134		const struct sdio_device_id *id)
1135{
1136	struct if_sdio_card *card;
1137	struct lbs_private *priv;
1138	int ret, i;
1139	unsigned int model;
1140	struct if_sdio_packet *packet;
1141
1142	for (i = 0;i < func->card->num_info;i++) {
1143		if (sscanf(func->card->info[i],
1144				"802.11 SDIO ID: %x", &model) == 1)
1145			break;
1146		if (sscanf(func->card->info[i],
1147				"ID: %x", &model) == 1)
1148			break;
1149		if (!strcmp(func->card->info[i], "IBIS Wireless SDIO Card")) {
1150			model = MODEL_8385;
1151			break;
1152		}
1153	}
1154
1155	if (i == func->card->num_info) {
1156		pr_err("unable to identify card model\n");
1157		return -ENODEV;
1158	}
1159
1160	card = kzalloc(sizeof(struct if_sdio_card), GFP_KERNEL);
1161	if (!card)
1162		return -ENOMEM;
1163
1164	card->func = func;
1165	card->model = model;
1166
1167	switch (card->model) {
1168	case MODEL_8385:
1169		card->scratch_reg = IF_SDIO_SCRATCH_OLD;
1170		break;
1171	case MODEL_8686:
1172		card->scratch_reg = IF_SDIO_SCRATCH;
1173		break;
1174	case MODEL_8688:
1175	default: /* for newer chipsets */
1176		card->scratch_reg = IF_SDIO_FW_STATUS;
1177		break;
1178	}
1179
1180	spin_lock_init(&card->lock);
1181	card->workqueue = alloc_workqueue("libertas_sdio", WQ_MEM_RECLAIM, 0);
1182	if (unlikely(!card->workqueue)) {
1183		ret = -ENOMEM;
1184		goto err_queue;
1185	}
1186	INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker);
1187	init_waitqueue_head(&card->pwron_waitq);
1188
1189	/* Check if we support this card */
1190	for (i = 0; i < ARRAY_SIZE(fw_table); i++) {
1191		if (card->model == fw_table[i].model)
1192			break;
1193	}
1194	if (i == ARRAY_SIZE(fw_table)) {
1195		pr_err("unknown card model 0x%x\n", card->model);
1196		ret = -ENODEV;
1197		goto free;
1198	}
1199
1200	sdio_set_drvdata(func, card);
1201
1202	lbs_deb_sdio("class = 0x%X, vendor = 0x%X, "
1203			"device = 0x%X, model = 0x%X, ioport = 0x%X\n",
1204			func->class, func->vendor, func->device,
1205			model, (unsigned)card->ioport);
1206
1207
1208	priv = lbs_add_card(card, &func->dev);
1209	if (IS_ERR(priv)) {
1210		ret = PTR_ERR(priv);
1211		goto free;
1212	}
1213
1214	card->priv = priv;
1215
1216	priv->card = card;
1217	priv->hw_host_to_card = if_sdio_host_to_card;
1218	priv->enter_deep_sleep = if_sdio_enter_deep_sleep;
1219	priv->exit_deep_sleep = if_sdio_exit_deep_sleep;
1220	priv->reset_deep_sleep_wakeup = if_sdio_reset_deep_sleep_wakeup;
1221	priv->reset_card = if_sdio_reset_card;
1222	priv->power_save = if_sdio_power_save;
1223	priv->power_restore = if_sdio_power_restore;
1224	priv->is_polling = !(func->card->host->caps & MMC_CAP_SDIO_IRQ);
1225	ret = if_sdio_power_on(card);
1226	if (ret)
1227		goto err_activate_card;
1228
1229out:
1230	return ret;
1231
1232err_activate_card:
1233	flush_workqueue(card->workqueue);
1234	lbs_remove_card(priv);
1235free:
1236	destroy_workqueue(card->workqueue);
1237err_queue:
1238	while (card->packets) {
1239		packet = card->packets;
1240		card->packets = card->packets->next;
1241		kfree(packet);
1242	}
1243
1244	kfree(card);
1245
1246	goto out;
1247}
1248
1249static void if_sdio_remove(struct sdio_func *func)
1250{
1251	struct if_sdio_card *card;
1252	struct if_sdio_packet *packet;
1253
1254	card = sdio_get_drvdata(func);
1255
1256	/* Undo decrement done above in if_sdio_probe */
1257	pm_runtime_get_noresume(&func->dev);
1258
1259	if (user_rmmod && (card->model == MODEL_8688)) {
1260		/*
1261		 * FUNC_SHUTDOWN is required for SD8688 WLAN/BT
1262		 * multiple functions
1263		 */
1264		struct cmd_header cmd;
1265
1266		memset(&cmd, 0, sizeof(cmd));
1267
1268		lbs_deb_sdio("send function SHUTDOWN command\n");
1269		if (__lbs_cmd(card->priv, CMD_FUNC_SHUTDOWN,
1270				&cmd, sizeof(cmd), lbs_cmd_copyback,
1271				(unsigned long) &cmd))
1272			pr_alert("CMD_FUNC_SHUTDOWN cmd failed\n");
1273	}
1274
1275
1276	lbs_deb_sdio("call remove card\n");
1277	lbs_stop_card(card->priv);
1278	lbs_remove_card(card->priv);
1279
1280	destroy_workqueue(card->workqueue);
1281
1282	while (card->packets) {
1283		packet = card->packets;
1284		card->packets = card->packets->next;
1285		kfree(packet);
1286	}
1287
1288	kfree(card);
1289}
1290
1291static int if_sdio_suspend(struct device *dev)
1292{
1293	struct sdio_func *func = dev_to_sdio_func(dev);
1294	struct if_sdio_card *card = sdio_get_drvdata(func);
1295	struct lbs_private *priv = card->priv;
1296	int ret;
1297
1298	mmc_pm_flag_t flags = sdio_get_host_pm_caps(func);
1299	priv->power_up_on_resume = false;
1300
1301	/* If we're powered off anyway, just let the mmc layer remove the
1302	 * card. */
1303	if (!lbs_iface_active(priv)) {
1304		if (priv->fw_ready) {
1305			priv->power_up_on_resume = true;
1306			if_sdio_power_off(card);
1307		}
1308
1309		return 0;
1310	}
1311
1312	dev_info(dev, "%s: suspend: PM flags = 0x%x\n",
1313		 sdio_func_id(func), flags);
1314
1315	/* If we aren't being asked to wake on anything, we should bail out
1316	 * and let the SD stack power down the card.
1317	 */
1318	if (priv->wol_criteria == EHS_REMOVE_WAKEUP) {
1319		dev_info(dev, "Suspend without wake params -- powering down card\n");
1320		if (priv->fw_ready) {
1321			ret = lbs_suspend(priv);
1322			if (ret)
1323				return ret;
1324
1325			priv->power_up_on_resume = true;
1326			if_sdio_power_off(card);
1327		}
1328
1329		return 0;
1330	}
1331
1332	if (!(flags & MMC_PM_KEEP_POWER)) {
1333		dev_err(dev, "%s: cannot remain alive while host is suspended\n",
1334			sdio_func_id(func));
1335		return -ENOSYS;
1336	}
1337
1338	ret = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
1339	if (ret)
1340		return ret;
1341
1342	ret = lbs_suspend(priv);
1343	if (ret)
1344		return ret;
1345
1346	return sdio_set_host_pm_flags(func, MMC_PM_WAKE_SDIO_IRQ);
1347}
1348
1349static int if_sdio_resume(struct device *dev)
1350{
1351	struct sdio_func *func = dev_to_sdio_func(dev);
1352	struct if_sdio_card *card = sdio_get_drvdata(func);
1353	int ret;
1354
1355	dev_info(dev, "%s: resume: we're back\n", sdio_func_id(func));
1356
1357	if (card->priv->power_up_on_resume) {
1358		if_sdio_power_on(card);
1359		wait_event(card->pwron_waitq, card->priv->fw_ready);
1360	}
1361
1362	ret = lbs_resume(card->priv);
1363
1364	return ret;
1365}
1366
1367static const struct dev_pm_ops if_sdio_pm_ops = {
1368	.suspend	= if_sdio_suspend,
1369	.resume		= if_sdio_resume,
1370};
1371
1372static struct sdio_driver if_sdio_driver = {
1373	.name		= "libertas_sdio",
1374	.id_table	= if_sdio_ids,
1375	.probe		= if_sdio_probe,
1376	.remove		= if_sdio_remove,
1377	.drv = {
1378		.pm = &if_sdio_pm_ops,
1379	},
1380};
1381
1382/*******************************************************************/
1383/* Module functions                                                */
1384/*******************************************************************/
1385
1386static int __init if_sdio_init_module(void)
1387{
1388	int ret = 0;
1389
1390	printk(KERN_INFO "libertas_sdio: Libertas SDIO driver\n");
1391	printk(KERN_INFO "libertas_sdio: Copyright Pierre Ossman\n");
1392
1393	ret = sdio_register_driver(&if_sdio_driver);
1394
1395	/* Clear the flag in case user removes the card. */
1396	user_rmmod = 0;
1397
1398	return ret;
1399}
1400
1401static void __exit if_sdio_exit_module(void)
1402{
1403	/* Set the flag as user is removing this module. */
1404	user_rmmod = 1;
1405
1406	cancel_work_sync(&card_reset_work);
1407
1408	sdio_unregister_driver(&if_sdio_driver);
1409}
1410
1411module_init(if_sdio_init_module);
1412module_exit(if_sdio_exit_module);
1413
1414MODULE_DESCRIPTION("Libertas SDIO WLAN Driver");
1415MODULE_AUTHOR("Pierre Ossman");
1416MODULE_LICENSE("GPL");
1417