1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 *  linux/drivers/net/wireless/libertas/if_sdio.c
4 *
5 *  Copyright 2007-2008 Pierre Ossman
6 *
7 * Inspired by if_cs.c, Copyright 2007 Holger Schurig
8 *
9 * This hardware has more or less no CMD53 support, so all registers
10 * must be accessed using sdio_readb()/sdio_writeb().
11 *
12 * Transfers must be in one transaction or the firmware goes bonkers.
13 * This means that the transfer must either be small enough to do a
14 * byte based transfer or it must be padded to a multiple of the
15 * current block size.
16 *
17 * As SDIO is still new to the kernel, it is unfortunately common with
18 * bugs in the host controllers related to that. One such bug is that
19 * controllers cannot do transfers that aren't a multiple of 4 bytes.
20 * If you don't have time to fix the host controller driver, you can
21 * work around the problem by modifying if_sdio_host_to_card() and
22 * if_sdio_card_to_host() to pad the data.
23 */
24
25#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
26
27#include <linux/kernel.h>
28#include <linux/module.h>
29#include <linux/slab.h>
30#include <linux/firmware.h>
31#include <linux/netdevice.h>
32#include <linux/delay.h>
33#include <linux/mmc/card.h>
34#include <linux/mmc/sdio_func.h>
35#include <linux/mmc/sdio_ids.h>
36#include <linux/mmc/sdio.h>
37#include <linux/mmc/host.h>
38#include <linux/pm_runtime.h>
39
40#include "host.h"
41#include "decl.h"
42#include "defs.h"
43#include "dev.h"
44#include "cmd.h"
45#include "if_sdio.h"
46
47static void if_sdio_interrupt(struct sdio_func *func);
48
49/* The if_sdio_remove() callback function is called when
50 * user removes this module from kernel space or ejects
51 * the card from the slot. The driver handles these 2 cases
52 * differently for SD8688 combo chip.
53 * If the user is removing the module, the FUNC_SHUTDOWN
54 * command for SD8688 is sent to the firmware.
55 * If the card is removed, there is no need to send this command.
56 *
57 * The variable 'user_rmmod' is used to distinguish these two
58 * scenarios. This flag is initialized as FALSE in case the card
59 * is removed, and will be set to TRUE for module removal when
60 * module_exit function is called.
61 */
62static u8 user_rmmod;
63
64static const struct sdio_device_id if_sdio_ids[] = {
65	{ SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL,
66			SDIO_DEVICE_ID_MARVELL_LIBERTAS) },
67	{ SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL,
68			SDIO_DEVICE_ID_MARVELL_8688_WLAN) },
69	{ /* end: all zeroes */				},
70};
71
72MODULE_DEVICE_TABLE(sdio, if_sdio_ids);
73
74#define MODEL_8385	0x04
75#define MODEL_8686	0x0b
76#define MODEL_8688	0x10
77
78static const struct lbs_fw_table fw_table[] = {
79	{ MODEL_8385, "libertas/sd8385_helper.bin", "libertas/sd8385.bin" },
80	{ MODEL_8385, "sd8385_helper.bin", "sd8385.bin" },
81	{ MODEL_8686, "libertas/sd8686_v9_helper.bin", "libertas/sd8686_v9.bin" },
82	{ MODEL_8686, "libertas/sd8686_v8_helper.bin", "libertas/sd8686_v8.bin" },
83	{ MODEL_8686, "sd8686_helper.bin", "sd8686.bin" },
84	{ MODEL_8688, "libertas/sd8688_helper.bin", "libertas/sd8688.bin" },
85	{ MODEL_8688, "sd8688_helper.bin", "sd8688.bin" },
86	{ 0, NULL, NULL }
87};
88MODULE_FIRMWARE("libertas/sd8385_helper.bin");
89MODULE_FIRMWARE("libertas/sd8385.bin");
90MODULE_FIRMWARE("sd8385_helper.bin");
91MODULE_FIRMWARE("sd8385.bin");
92MODULE_FIRMWARE("libertas/sd8686_v9_helper.bin");
93MODULE_FIRMWARE("libertas/sd8686_v9.bin");
94MODULE_FIRMWARE("libertas/sd8686_v8_helper.bin");
95MODULE_FIRMWARE("libertas/sd8686_v8.bin");
96MODULE_FIRMWARE("sd8686_helper.bin");
97MODULE_FIRMWARE("sd8686.bin");
98MODULE_FIRMWARE("libertas/sd8688_helper.bin");
99MODULE_FIRMWARE("libertas/sd8688.bin");
100MODULE_FIRMWARE("sd8688_helper.bin");
101MODULE_FIRMWARE("sd8688.bin");
102
103struct if_sdio_packet {
104	struct list_head	list;
105	u16			nb;
106	u8			buffer[] __aligned(4);
107};
108
109struct if_sdio_card {
110	struct sdio_func	*func;
111	struct lbs_private	*priv;
112
113	int			model;
114	unsigned long		ioport;
115	unsigned int		scratch_reg;
116	bool			started;
117	wait_queue_head_t	pwron_waitq;
118
119	u8			buffer[65536] __attribute__((aligned(4)));
120
121	spinlock_t		lock;
122	struct list_head	packets;
123
124	struct workqueue_struct	*workqueue;
125	struct work_struct	packet_worker;
126	struct work_struct	reset_worker;
127
128	u8			rx_unit;
129};
130
131static void if_sdio_finish_power_on(struct if_sdio_card *card);
132static int if_sdio_power_off(struct if_sdio_card *card);
133
134/********************************************************************/
135/* I/O                                                              */
136/********************************************************************/
137
138/*
139 *  For SD8385/SD8686, this function reads firmware status after
140 *  the image is downloaded, or reads RX packet length when
141 *  interrupt (with IF_SDIO_H_INT_UPLD bit set) is received.
142 *  For SD8688, this function reads firmware status only.
143 */
144static u16 if_sdio_read_scratch(struct if_sdio_card *card, int *err)
145{
146	int ret;
147	u16 scratch;
148
149	scratch = sdio_readb(card->func, card->scratch_reg, &ret);
150	if (!ret)
151		scratch |= sdio_readb(card->func, card->scratch_reg + 1,
152					&ret) << 8;
153
154	if (err)
155		*err = ret;
156
157	if (ret)
158		return 0xffff;
159
160	return scratch;
161}
162
163static u8 if_sdio_read_rx_unit(struct if_sdio_card *card)
164{
165	int ret;
166	u8 rx_unit;
167
168	rx_unit = sdio_readb(card->func, IF_SDIO_RX_UNIT, &ret);
169
170	if (ret)
171		rx_unit = 0;
172
173	return rx_unit;
174}
175
176static u16 if_sdio_read_rx_len(struct if_sdio_card *card, int *err)
177{
178	int ret;
179	u16 rx_len;
180
181	switch (card->model) {
182	case MODEL_8385:
183	case MODEL_8686:
184		rx_len = if_sdio_read_scratch(card, &ret);
185		break;
186	case MODEL_8688:
187	default: /* for newer chipsets */
188		rx_len = sdio_readb(card->func, IF_SDIO_RX_LEN, &ret);
189		if (!ret)
190			rx_len <<= card->rx_unit;
191		else
192			rx_len = 0xffff;	/* invalid length */
193
194		break;
195	}
196
197	if (err)
198		*err = ret;
199
200	return rx_len;
201}
202
203static int if_sdio_handle_cmd(struct if_sdio_card *card,
204		u8 *buffer, unsigned size)
205{
206	struct lbs_private *priv = card->priv;
207	int ret;
208	unsigned long flags;
209	u8 i;
210
211	if (size > LBS_CMD_BUFFER_SIZE) {
212		lbs_deb_sdio("response packet too large (%d bytes)\n",
213			(int)size);
214		ret = -E2BIG;
215		goto out;
216	}
217
218	spin_lock_irqsave(&priv->driver_lock, flags);
219
220	i = (priv->resp_idx == 0) ? 1 : 0;
221	BUG_ON(priv->resp_len[i]);
222	priv->resp_len[i] = size;
223	memcpy(priv->resp_buf[i], buffer, size);
224	lbs_notify_command_response(priv, i);
225
226	spin_unlock_irqrestore(&priv->driver_lock, flags);
227
228	ret = 0;
229
230out:
231	return ret;
232}
233
234static int if_sdio_handle_data(struct if_sdio_card *card,
235		u8 *buffer, unsigned size)
236{
237	int ret;
238	struct sk_buff *skb;
239
240	if (size > MRVDRV_ETH_RX_PACKET_BUFFER_SIZE) {
241		lbs_deb_sdio("response packet too large (%d bytes)\n",
242			(int)size);
243		ret = -E2BIG;
244		goto out;
245	}
246
247	skb = dev_alloc_skb(MRVDRV_ETH_RX_PACKET_BUFFER_SIZE + NET_IP_ALIGN);
248	if (!skb) {
249		ret = -ENOMEM;
250		goto out;
251	}
252
253	skb_reserve(skb, NET_IP_ALIGN);
254
255	skb_put_data(skb, buffer, size);
256
257	lbs_process_rxed_packet(card->priv, skb);
258
259	ret = 0;
260
261out:
262	return ret;
263}
264
265static int if_sdio_handle_event(struct if_sdio_card *card,
266		u8 *buffer, unsigned size)
267{
268	int ret;
269	u32 event;
270
271	if (card->model == MODEL_8385) {
272		event = sdio_readb(card->func, IF_SDIO_EVENT, &ret);
273		if (ret)
274			goto out;
275
276		/* right shift 3 bits to get the event id */
277		event >>= 3;
278	} else {
279		if (size < 4) {
280			lbs_deb_sdio("event packet too small (%d bytes)\n",
281				(int)size);
282			ret = -EINVAL;
283			goto out;
284		}
285		event = buffer[3] << 24;
286		event |= buffer[2] << 16;
287		event |= buffer[1] << 8;
288		event |= buffer[0] << 0;
289	}
290
291	lbs_queue_event(card->priv, event & 0xFF);
292	ret = 0;
293
294out:
295	return ret;
296}
297
298static int if_sdio_wait_status(struct if_sdio_card *card, const u8 condition)
299{
300	u8 status;
301	unsigned long timeout;
302	int ret = 0;
303
304	timeout = jiffies + HZ;
305	while (1) {
306		status = sdio_readb(card->func, IF_SDIO_STATUS, &ret);
307		if (ret)
308			return ret;
309		if ((status & condition) == condition)
310			break;
311		if (time_after(jiffies, timeout))
312			return -ETIMEDOUT;
313		mdelay(1);
314	}
315	return ret;
316}
317
318static int if_sdio_card_to_host(struct if_sdio_card *card)
319{
320	int ret;
321	u16 size, type, chunk;
322
323	size = if_sdio_read_rx_len(card, &ret);
324	if (ret)
325		goto out;
326
327	if (size < 4) {
328		lbs_deb_sdio("invalid packet size (%d bytes) from firmware\n",
329			(int)size);
330		ret = -EINVAL;
331		goto out;
332	}
333
334	ret = if_sdio_wait_status(card, IF_SDIO_IO_RDY);
335	if (ret)
336		goto out;
337
338	/*
339	 * The transfer must be in one transaction or the firmware
340	 * goes suicidal. There's no way to guarantee that for all
341	 * controllers, but we can at least try.
342	 */
343	chunk = sdio_align_size(card->func, size);
344
345	ret = sdio_readsb(card->func, card->buffer, card->ioport, chunk);
346	if (ret)
347		goto out;
348
349	chunk = card->buffer[0] | (card->buffer[1] << 8);
350	type = card->buffer[2] | (card->buffer[3] << 8);
351
352	lbs_deb_sdio("packet of type %d and size %d bytes\n",
353		(int)type, (int)chunk);
354
355	if (chunk > size) {
356		lbs_deb_sdio("packet fragment (%d > %d)\n",
357			(int)chunk, (int)size);
358		ret = -EINVAL;
359		goto out;
360	}
361
362	if (chunk < size) {
363		lbs_deb_sdio("packet fragment (%d < %d)\n",
364			(int)chunk, (int)size);
365	}
366
367	switch (type) {
368	case MVMS_CMD:
369		ret = if_sdio_handle_cmd(card, card->buffer + 4, chunk - 4);
370		if (ret)
371			goto out;
372		break;
373	case MVMS_DAT:
374		ret = if_sdio_handle_data(card, card->buffer + 4, chunk - 4);
375		if (ret)
376			goto out;
377		break;
378	case MVMS_EVENT:
379		ret = if_sdio_handle_event(card, card->buffer + 4, chunk - 4);
380		if (ret)
381			goto out;
382		break;
383	default:
384		lbs_deb_sdio("invalid type (%d) from firmware\n",
385				(int)type);
386		ret = -EINVAL;
387		goto out;
388	}
389
390out:
391	if (ret)
392		pr_err("problem fetching packet from firmware\n");
393
394	return ret;
395}
396
397static void if_sdio_host_to_card_worker(struct work_struct *work)
398{
399	struct if_sdio_card *card;
400	struct if_sdio_packet *packet;
401	int ret;
402	unsigned long flags;
403
404	card = container_of(work, struct if_sdio_card, packet_worker);
405
406	while (1) {
407		spin_lock_irqsave(&card->lock, flags);
408		packet = list_first_entry_or_null(&card->packets,
409						  struct if_sdio_packet, list);
410		if (packet)
411			list_del(&packet->list);
412		spin_unlock_irqrestore(&card->lock, flags);
413
414		if (!packet)
415			break;
416
417		sdio_claim_host(card->func);
418
419		ret = if_sdio_wait_status(card, IF_SDIO_IO_RDY);
420		if (ret == 0) {
421			ret = sdio_writesb(card->func, card->ioport,
422					   packet->buffer, packet->nb);
423		}
424
425		if (ret)
426			pr_err("error %d sending packet to firmware\n", ret);
427
428		sdio_release_host(card->func);
429
430		kfree(packet);
431	}
432}
433
434/********************************************************************/
435/* Firmware                                                         */
436/********************************************************************/
437
438#define FW_DL_READY_STATUS (IF_SDIO_IO_RDY | IF_SDIO_DL_RDY)
439
440static int if_sdio_prog_helper(struct if_sdio_card *card,
441				const struct firmware *fw)
442{
443	int ret;
444	unsigned long timeout;
445	u8 *chunk_buffer;
446	u32 chunk_size;
447	const u8 *firmware;
448	size_t size;
449
450	chunk_buffer = kzalloc(64, GFP_KERNEL);
451	if (!chunk_buffer) {
452		ret = -ENOMEM;
453		goto out;
454	}
455
456	sdio_claim_host(card->func);
457
458	ret = sdio_set_block_size(card->func, 32);
459	if (ret)
460		goto release;
461
462	firmware = fw->data;
463	size = fw->size;
464
465	while (size) {
466		ret = if_sdio_wait_status(card, FW_DL_READY_STATUS);
467		if (ret)
468			goto release;
469
470		/* On some platforms (like Davinci) the chip needs more time
471		 * between helper blocks.
472		 */
473		mdelay(2);
474
475		chunk_size = min_t(size_t, size, 60);
476
477		*((__le32*)chunk_buffer) = cpu_to_le32(chunk_size);
478		memcpy(chunk_buffer + 4, firmware, chunk_size);
479/*
480		lbs_deb_sdio("sending %d bytes chunk\n", chunk_size);
481*/
482		ret = sdio_writesb(card->func, card->ioport,
483				chunk_buffer, 64);
484		if (ret)
485			goto release;
486
487		firmware += chunk_size;
488		size -= chunk_size;
489	}
490
491	/* an empty block marks the end of the transfer */
492	memset(chunk_buffer, 0, 4);
493	ret = sdio_writesb(card->func, card->ioport, chunk_buffer, 64);
494	if (ret)
495		goto release;
496
497	lbs_deb_sdio("waiting for helper to boot...\n");
498
499	/* wait for the helper to boot by looking at the size register */
500	timeout = jiffies + HZ;
501	while (1) {
502		u16 req_size;
503
504		req_size = sdio_readb(card->func, IF_SDIO_RD_BASE, &ret);
505		if (ret)
506			goto release;
507
508		req_size |= sdio_readb(card->func, IF_SDIO_RD_BASE + 1, &ret) << 8;
509		if (ret)
510			goto release;
511
512		if (req_size != 0)
513			break;
514
515		if (time_after(jiffies, timeout)) {
516			ret = -ETIMEDOUT;
517			goto release;
518		}
519
520		msleep(10);
521	}
522
523	ret = 0;
524
525release:
526	sdio_release_host(card->func);
527	kfree(chunk_buffer);
528
529out:
530	if (ret)
531		pr_err("failed to load helper firmware\n");
532
533	return ret;
534}
535
536static int if_sdio_prog_real(struct if_sdio_card *card,
537				const struct firmware *fw)
538{
539	int ret;
540	unsigned long timeout;
541	u8 *chunk_buffer;
542	u32 chunk_size;
543	const u8 *firmware;
544	size_t size, req_size;
545
546	chunk_buffer = kzalloc(512, GFP_KERNEL);
547	if (!chunk_buffer) {
548		ret = -ENOMEM;
549		goto out;
550	}
551
552	sdio_claim_host(card->func);
553
554	ret = sdio_set_block_size(card->func, 32);
555	if (ret)
556		goto release;
557
558	firmware = fw->data;
559	size = fw->size;
560
561	while (size) {
562		timeout = jiffies + HZ;
563		while (1) {
564			ret = if_sdio_wait_status(card, FW_DL_READY_STATUS);
565			if (ret)
566				goto release;
567
568			req_size = sdio_readb(card->func, IF_SDIO_RD_BASE,
569					&ret);
570			if (ret)
571				goto release;
572
573			req_size |= sdio_readb(card->func, IF_SDIO_RD_BASE + 1,
574					&ret) << 8;
575			if (ret)
576				goto release;
577
578			/*
579			 * For SD8688 wait until the length is not 0, 1 or 2
580			 * before downloading the first FW block,
581			 * since BOOT code writes the register to indicate the
582			 * helper/FW download winner,
583			 * the value could be 1 or 2 (Func1 or Func2).
584			 */
585			if ((size != fw->size) || (req_size > 2))
586				break;
587			if (time_after(jiffies, timeout)) {
588				ret = -ETIMEDOUT;
589				goto release;
590			}
591			mdelay(1);
592		}
593
594/*
595		lbs_deb_sdio("firmware wants %d bytes\n", (int)req_size);
596*/
597		if (req_size == 0) {
598			lbs_deb_sdio("firmware helper gave up early\n");
599			ret = -EIO;
600			goto release;
601		}
602
603		if (req_size & 0x01) {
604			lbs_deb_sdio("firmware helper signalled error\n");
605			ret = -EIO;
606			goto release;
607		}
608
609		if (req_size > size)
610			req_size = size;
611
612		while (req_size) {
613			chunk_size = min_t(size_t, req_size, 512);
614
615			memcpy(chunk_buffer, firmware, chunk_size);
616/*
617			lbs_deb_sdio("sending %d bytes (%d bytes) chunk\n",
618				chunk_size, (chunk_size + 31) / 32 * 32);
619*/
620			ret = sdio_writesb(card->func, card->ioport,
621				chunk_buffer, roundup(chunk_size, 32));
622			if (ret)
623				goto release;
624
625			firmware += chunk_size;
626			size -= chunk_size;
627			req_size -= chunk_size;
628		}
629	}
630
631	ret = 0;
632
633	lbs_deb_sdio("waiting for firmware to boot...\n");
634
635	/* wait for the firmware to boot */
636	timeout = jiffies + HZ;
637	while (1) {
638		u16 scratch;
639
640		scratch = if_sdio_read_scratch(card, &ret);
641		if (ret)
642			goto release;
643
644		if (scratch == IF_SDIO_FIRMWARE_OK)
645			break;
646
647		if (time_after(jiffies, timeout)) {
648			ret = -ETIMEDOUT;
649			goto release;
650		}
651
652		msleep(10);
653	}
654
655	ret = 0;
656
657release:
658	sdio_release_host(card->func);
659	kfree(chunk_buffer);
660
661out:
662	if (ret)
663		pr_err("failed to load firmware\n");
664
665	return ret;
666}
667
668static void if_sdio_do_prog_firmware(struct lbs_private *priv, int ret,
669				     const struct firmware *helper,
670				     const struct firmware *mainfw)
671{
672	struct if_sdio_card *card = priv->card;
673
674	if (ret) {
675		pr_err("failed to find firmware (%d)\n", ret);
676		return;
677	}
678
679	ret = if_sdio_prog_helper(card, helper);
680	if (ret)
681		return;
682
683	lbs_deb_sdio("Helper firmware loaded\n");
684
685	ret = if_sdio_prog_real(card, mainfw);
686	if (ret)
687		return;
688
689	lbs_deb_sdio("Firmware loaded\n");
690	if_sdio_finish_power_on(card);
691}
692
693static int if_sdio_prog_firmware(struct if_sdio_card *card)
694{
695	int ret;
696	u16 scratch;
697
698	/*
699	 * Disable interrupts
700	 */
701	sdio_claim_host(card->func);
702	sdio_writeb(card->func, 0x00, IF_SDIO_H_INT_MASK, &ret);
703	sdio_release_host(card->func);
704
705	sdio_claim_host(card->func);
706	scratch = if_sdio_read_scratch(card, &ret);
707	sdio_release_host(card->func);
708
709	lbs_deb_sdio("firmware status = %#x\n", scratch);
710	lbs_deb_sdio("scratch ret = %d\n", ret);
711
712	if (ret)
713		goto out;
714
715
716	/*
717	 * The manual clearly describes that FEDC is the right code to use
718	 * to detect firmware presence, but for SD8686 it is not that simple.
719	 * Scratch is also used to store the RX packet length, so we lose
720	 * the FEDC value early on. So we use a non-zero check in order
721	 * to validate firmware presence.
722	 * Additionally, the SD8686 in the Gumstix always has the high scratch
723	 * bit set, even when the firmware is not loaded. So we have to
724	 * exclude that from the test.
725	 */
726	if (scratch == IF_SDIO_FIRMWARE_OK) {
727		lbs_deb_sdio("firmware already loaded\n");
728		if_sdio_finish_power_on(card);
729		return 0;
730	} else if ((card->model == MODEL_8686) && (scratch & 0x7fff)) {
731		lbs_deb_sdio("firmware may be running\n");
732		if_sdio_finish_power_on(card);
733		return 0;
734	}
735
736	ret = lbs_get_firmware_async(card->priv, &card->func->dev, card->model,
737				     fw_table, if_sdio_do_prog_firmware);
738
739out:
740	return ret;
741}
742
743/********************************************************************/
744/* Power management                                                 */
745/********************************************************************/
746
747/* Finish power on sequence (after firmware is loaded) */
748static void if_sdio_finish_power_on(struct if_sdio_card *card)
749{
750	struct sdio_func *func = card->func;
751	struct lbs_private *priv = card->priv;
752	int ret;
753
754	sdio_claim_host(func);
755	sdio_set_block_size(card->func, IF_SDIO_BLOCK_SIZE);
756
757	/*
758	 * Get rx_unit if the chip is SD8688 or newer.
759	 * SD8385 & SD8686 do not have rx_unit.
760	 */
761	if ((card->model != MODEL_8385)
762			&& (card->model != MODEL_8686))
763		card->rx_unit = if_sdio_read_rx_unit(card);
764	else
765		card->rx_unit = 0;
766
767	/*
768	 * Set up the interrupt handler late.
769	 *
770	 * If we set it up earlier, the (buggy) hardware generates a spurious
771	 * interrupt, even before the interrupt has been enabled, with
772	 * CCCR_INTx = 0.
773	 *
774	 * We register the interrupt handler late so that we can handle any
775	 * spurious interrupts, and also to avoid generation of that known
776	 * spurious interrupt in the first place.
777	 */
778	ret = sdio_claim_irq(func, if_sdio_interrupt);
779	if (ret)
780		goto release;
781
782	/*
783	 * Enable interrupts now that everything is set up
784	 */
785	sdio_writeb(func, 0x0f, IF_SDIO_H_INT_MASK, &ret);
786	if (ret)
787		goto release_irq;
788
789	sdio_release_host(func);
790
791	/* Set fw_ready before queuing any commands so that
792	 * lbs_thread won't block from sending them to firmware.
793	 */
794	priv->fw_ready = 1;
795
796	/*
797	 * FUNC_INIT is required for SD8688 WLAN/BT multiple functions
798	 */
799	if (card->model == MODEL_8688) {
800		struct cmd_header cmd;
801
802		memset(&cmd, 0, sizeof(cmd));
803
804		lbs_deb_sdio("send function INIT command\n");
805		if (__lbs_cmd(priv, CMD_FUNC_INIT, &cmd, sizeof(cmd),
806				lbs_cmd_copyback, (unsigned long) &cmd))
807			netdev_alert(priv->dev, "CMD_FUNC_INIT cmd failed\n");
808	}
809
810	wake_up(&card->pwron_waitq);
811
812	if (!card->started) {
813		ret = lbs_start_card(priv);
814		if_sdio_power_off(card);
815		if (ret == 0) {
816			card->started = true;
817			/* Tell PM core that we don't need the card to be
818			 * powered now */
819			pm_runtime_put(&func->dev);
820		}
821	}
822
823	return;
824
825release_irq:
826	sdio_release_irq(func);
827release:
828	sdio_release_host(func);
829}
830
831static int if_sdio_power_on(struct if_sdio_card *card)
832{
833	struct sdio_func *func = card->func;
834	struct mmc_host *host = func->card->host;
835	int ret;
836
837	sdio_claim_host(func);
838
839	ret = sdio_enable_func(func);
840	if (ret)
841		goto release;
842
843	/* For 1-bit transfers to the 8686 model, we need to enable the
844	 * interrupt flag in the CCCR register. Set the MMC_QUIRK_LENIENT_FN0
845	 * bit to allow access to non-vendor registers. */
846	if ((card->model == MODEL_8686) &&
847	    (host->caps & MMC_CAP_SDIO_IRQ) &&
848	    (host->ios.bus_width == MMC_BUS_WIDTH_1)) {
849		u8 reg;
850
851		func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
852		reg = sdio_f0_readb(func, SDIO_CCCR_IF, &ret);
853		if (ret)
854			goto disable;
855
856		reg |= SDIO_BUS_ECSI;
857		sdio_f0_writeb(func, reg, SDIO_CCCR_IF, &ret);
858		if (ret)
859			goto disable;
860	}
861
862	card->ioport = sdio_readb(func, IF_SDIO_IOPORT, &ret);
863	if (ret)
864		goto disable;
865
866	card->ioport |= sdio_readb(func, IF_SDIO_IOPORT + 1, &ret) << 8;
867	if (ret)
868		goto disable;
869
870	card->ioport |= sdio_readb(func, IF_SDIO_IOPORT + 2, &ret) << 16;
871	if (ret)
872		goto disable;
873
874	sdio_release_host(func);
875	ret = if_sdio_prog_firmware(card);
876	if (ret) {
877		sdio_claim_host(func);
878		goto disable;
879	}
880
881	return 0;
882
883disable:
884	sdio_disable_func(func);
885release:
886	sdio_release_host(func);
887	return ret;
888}
889
890static int if_sdio_power_off(struct if_sdio_card *card)
891{
892	struct sdio_func *func = card->func;
893	struct lbs_private *priv = card->priv;
894
895	priv->fw_ready = 0;
896
897	sdio_claim_host(func);
898	sdio_release_irq(func);
899	sdio_disable_func(func);
900	sdio_release_host(func);
901	return 0;
902}
903
904
905/*******************************************************************/
906/* Libertas callbacks                                              */
907/*******************************************************************/
908
909static int if_sdio_host_to_card(struct lbs_private *priv,
910		u8 type, u8 *buf, u16 nb)
911{
912	int ret;
913	struct if_sdio_card *card;
914	struct if_sdio_packet *packet;
915	u16 size;
916	unsigned long flags;
917
918	card = priv->card;
919
920	if (nb > (65536 - sizeof(struct if_sdio_packet) - 4)) {
921		ret = -EINVAL;
922		goto out;
923	}
924
925	/*
926	 * The transfer must be in one transaction or the firmware
927	 * goes suicidal. There's no way to guarantee that for all
928	 * controllers, but we can at least try.
929	 */
930	size = sdio_align_size(card->func, nb + 4);
931
932	packet = kzalloc(sizeof(struct if_sdio_packet) + size,
933			GFP_ATOMIC);
934	if (!packet) {
935		ret = -ENOMEM;
936		goto out;
937	}
938
939	packet->nb = size;
940
941	/*
942	 * SDIO specific header.
943	 */
944	packet->buffer[0] = (nb + 4) & 0xff;
945	packet->buffer[1] = ((nb + 4) >> 8) & 0xff;
946	packet->buffer[2] = type;
947	packet->buffer[3] = 0;
948
949	memcpy(packet->buffer + 4, buf, nb);
950
951	spin_lock_irqsave(&card->lock, flags);
952
953	list_add_tail(&packet->list, &card->packets);
954
955	switch (type) {
956	case MVMS_CMD:
957		priv->dnld_sent = DNLD_CMD_SENT;
958		break;
959	case MVMS_DAT:
960		priv->dnld_sent = DNLD_DATA_SENT;
961		break;
962	default:
963		lbs_deb_sdio("unknown packet type %d\n", (int)type);
964	}
965
966	spin_unlock_irqrestore(&card->lock, flags);
967
968	queue_work(card->workqueue, &card->packet_worker);
969
970	ret = 0;
971
972out:
973	return ret;
974}
975
976static int if_sdio_enter_deep_sleep(struct lbs_private *priv)
977{
978	int ret;
979	struct cmd_header cmd;
980
981	memset(&cmd, 0, sizeof(cmd));
982
983	lbs_deb_sdio("send DEEP_SLEEP command\n");
984	ret = __lbs_cmd(priv, CMD_802_11_DEEP_SLEEP, &cmd, sizeof(cmd),
985			lbs_cmd_copyback, (unsigned long) &cmd);
986	if (ret)
987		netdev_err(priv->dev, "DEEP_SLEEP cmd failed\n");
988
989	mdelay(200);
990	return ret;
991}
992
993static int if_sdio_exit_deep_sleep(struct lbs_private *priv)
994{
995	struct if_sdio_card *card = priv->card;
996	int ret = -1;
997
998	sdio_claim_host(card->func);
999
1000	sdio_writeb(card->func, HOST_POWER_UP, CONFIGURATION_REG, &ret);
1001	if (ret)
1002		netdev_err(priv->dev, "sdio_writeb failed!\n");
1003
1004	sdio_release_host(card->func);
1005
1006	return ret;
1007}
1008
1009static int if_sdio_reset_deep_sleep_wakeup(struct lbs_private *priv)
1010{
1011	struct if_sdio_card *card = priv->card;
1012	int ret = -1;
1013
1014	sdio_claim_host(card->func);
1015
1016	sdio_writeb(card->func, 0, CONFIGURATION_REG, &ret);
1017	if (ret)
1018		netdev_err(priv->dev, "sdio_writeb failed!\n");
1019
1020	sdio_release_host(card->func);
1021
1022	return ret;
1023
1024}
1025
1026static void if_sdio_reset_card_worker(struct work_struct *work)
1027{
1028	int ret;
1029	const char *name;
1030	struct device *dev;
1031	struct if_sdio_card *card;
1032	struct mmc_host *reset_host;
1033
1034	card = container_of(work, struct if_sdio_card, reset_worker);
1035	reset_host = card->func->card->host;
1036	name = card->priv->dev->name;
1037	dev = &card->func->dev;
1038
1039	/*
1040	 * The actual reset operation must be run outside of lbs_thread. This
1041	 * is because mmc_remove_host() will cause the device to be instantly
1042	 * destroyed, and the libertas driver then needs to end lbs_thread,
1043	 * leading to a deadlock.
1044	 *
1045	 * We run it in a workqueue totally independent from the if_sdio_card
1046	 * instance for that reason.
1047	 */
1048
1049	dev_info(dev, "resetting card %s...", name);
1050	mmc_remove_host(reset_host);
1051	ret = mmc_add_host(reset_host);
1052	if (ret)
1053		dev_err(dev, "%s: can't add mmc host, error %d\n", name, ret);
1054}
1055
1056static void if_sdio_reset_card(struct lbs_private *priv)
1057{
1058	struct if_sdio_card *card = priv->card;
1059
1060	if (!work_pending(&card->reset_worker))
1061		schedule_work(&card->reset_worker);
1062}
1063
1064static int if_sdio_power_save(struct lbs_private *priv)
1065{
1066	struct if_sdio_card *card = priv->card;
1067	int ret;
1068
1069	flush_workqueue(card->workqueue);
1070
1071	ret = if_sdio_power_off(card);
1072
1073	/* Let runtime PM know the card is powered off */
1074	pm_runtime_put_sync(&card->func->dev);
1075
1076	return ret;
1077}
1078
1079static int if_sdio_power_restore(struct lbs_private *priv)
1080{
1081	struct if_sdio_card *card = priv->card;
1082	int r;
1083
1084	/* Make sure the card will not be powered off by runtime PM */
1085	pm_runtime_get_sync(&card->func->dev);
1086
1087	r = if_sdio_power_on(card);
1088	if (r)
1089		return r;
1090
1091	wait_event(card->pwron_waitq, priv->fw_ready);
1092	return 0;
1093}
1094
1095
1096/*******************************************************************/
1097/* SDIO callbacks                                                  */
1098/*******************************************************************/
1099
1100static void if_sdio_interrupt(struct sdio_func *func)
1101{
1102	int ret;
1103	struct if_sdio_card *card;
1104	u8 cause;
1105
1106	card = sdio_get_drvdata(func);
1107
1108	cause = sdio_readb(card->func, IF_SDIO_H_INT_STATUS, &ret);
1109	if (ret || !cause)
1110		return;
1111
1112	lbs_deb_sdio("interrupt: 0x%X\n", (unsigned)cause);
1113
1114	sdio_writeb(card->func, ~cause, IF_SDIO_H_INT_STATUS, &ret);
1115	if (ret)
1116		return;
1117
1118	/*
1119	 * Ignore the define name, this really means the card has
1120	 * successfully received the command.
1121	 */
1122	card->priv->is_activity_detected = 1;
1123	if (cause & IF_SDIO_H_INT_DNLD)
1124		lbs_host_to_card_done(card->priv);
1125
1126
1127	if (cause & IF_SDIO_H_INT_UPLD) {
1128		ret = if_sdio_card_to_host(card);
1129		if (ret)
1130			return;
1131	}
1132}
1133
1134static int if_sdio_probe(struct sdio_func *func,
1135		const struct sdio_device_id *id)
1136{
1137	struct if_sdio_card *card;
1138	struct lbs_private *priv;
1139	int ret, i;
1140	unsigned int model;
1141	struct if_sdio_packet *packet, *tmp;
1142
1143	for (i = 0;i < func->card->num_info;i++) {
1144		if (sscanf(func->card->info[i],
1145				"802.11 SDIO ID: %x", &model) == 1)
1146			break;
1147		if (sscanf(func->card->info[i],
1148				"ID: %x", &model) == 1)
1149			break;
1150		if (!strcmp(func->card->info[i], "IBIS Wireless SDIO Card")) {
1151			model = MODEL_8385;
1152			break;
1153		}
1154	}
1155
1156	if (i == func->card->num_info) {
1157		pr_err("unable to identify card model\n");
1158		return -ENODEV;
1159	}
1160
1161	card = kzalloc(sizeof(struct if_sdio_card), GFP_KERNEL);
1162	if (!card)
1163		return -ENOMEM;
1164
1165	card->func = func;
1166	card->model = model;
1167
1168	switch (card->model) {
1169	case MODEL_8385:
1170		card->scratch_reg = IF_SDIO_SCRATCH_OLD;
1171		break;
1172	case MODEL_8686:
1173		card->scratch_reg = IF_SDIO_SCRATCH;
1174		break;
1175	case MODEL_8688:
1176	default: /* for newer chipsets */
1177		card->scratch_reg = IF_SDIO_FW_STATUS;
1178		break;
1179	}
1180
1181	spin_lock_init(&card->lock);
1182	INIT_LIST_HEAD(&card->packets);
1183
1184	card->workqueue = alloc_workqueue("libertas_sdio", WQ_MEM_RECLAIM, 0);
1185	if (unlikely(!card->workqueue)) {
1186		ret = -ENOMEM;
1187		goto err_queue;
1188	}
1189
1190	INIT_WORK(&card->reset_worker, if_sdio_reset_card_worker);
1191	INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker);
1192	init_waitqueue_head(&card->pwron_waitq);
1193
1194	/* Check if we support this card */
1195	for (i = 0; i < ARRAY_SIZE(fw_table); i++) {
1196		if (card->model == fw_table[i].model)
1197			break;
1198	}
1199	if (i == ARRAY_SIZE(fw_table)) {
1200		pr_err("unknown card model 0x%x\n", card->model);
1201		ret = -ENODEV;
1202		goto free;
1203	}
1204
1205	sdio_set_drvdata(func, card);
1206
1207	lbs_deb_sdio("class = 0x%X, vendor = 0x%X, "
1208			"device = 0x%X, model = 0x%X, ioport = 0x%X\n",
1209			func->class, func->vendor, func->device,
1210			model, (unsigned)card->ioport);
1211
1212
1213	priv = lbs_add_card(card, &func->dev);
1214	if (IS_ERR(priv)) {
1215		ret = PTR_ERR(priv);
1216		goto free;
1217	}
1218
1219	card->priv = priv;
1220
1221	priv->card = card;
1222	priv->hw_host_to_card = if_sdio_host_to_card;
1223	priv->enter_deep_sleep = if_sdio_enter_deep_sleep;
1224	priv->exit_deep_sleep = if_sdio_exit_deep_sleep;
1225	priv->reset_deep_sleep_wakeup = if_sdio_reset_deep_sleep_wakeup;
1226	priv->reset_card = if_sdio_reset_card;
1227	priv->power_save = if_sdio_power_save;
1228	priv->power_restore = if_sdio_power_restore;
1229	priv->is_polling = !(func->card->host->caps & MMC_CAP_SDIO_IRQ);
1230	ret = if_sdio_power_on(card);
1231	if (ret)
1232		goto err_activate_card;
1233
1234out:
1235	return ret;
1236
1237err_activate_card:
1238	flush_workqueue(card->workqueue);
1239	lbs_remove_card(priv);
1240free:
1241	cancel_work_sync(&card->packet_worker);
1242	cancel_work_sync(&card->reset_worker);
1243	destroy_workqueue(card->workqueue);
1244err_queue:
1245	list_for_each_entry_safe(packet, tmp, &card->packets, list)
1246		kfree(packet);
1247
1248	kfree(card);
1249
1250	goto out;
1251}
1252
1253static void if_sdio_remove(struct sdio_func *func)
1254{
1255	struct if_sdio_card *card;
1256	struct if_sdio_packet *packet, *tmp;
1257
1258	card = sdio_get_drvdata(func);
1259
1260	/* Undo decrement done above in if_sdio_probe */
1261	pm_runtime_get_noresume(&func->dev);
1262
1263	if (user_rmmod && (card->model == MODEL_8688)) {
1264		/*
1265		 * FUNC_SHUTDOWN is required for SD8688 WLAN/BT
1266		 * multiple functions
1267		 */
1268		struct cmd_header cmd;
1269
1270		memset(&cmd, 0, sizeof(cmd));
1271
1272		lbs_deb_sdio("send function SHUTDOWN command\n");
1273		if (__lbs_cmd(card->priv, CMD_FUNC_SHUTDOWN,
1274				&cmd, sizeof(cmd), lbs_cmd_copyback,
1275				(unsigned long) &cmd))
1276			pr_alert("CMD_FUNC_SHUTDOWN cmd failed\n");
1277	}
1278
1279
1280	lbs_deb_sdio("call remove card\n");
1281	lbs_stop_card(card->priv);
1282	lbs_remove_card(card->priv);
1283
1284	cancel_work_sync(&card->packet_worker);
1285	cancel_work_sync(&card->reset_worker);
1286	destroy_workqueue(card->workqueue);
1287
1288	list_for_each_entry_safe(packet, tmp, &card->packets, list)
1289		kfree(packet);
1290
1291	kfree(card);
1292}
1293
1294static int if_sdio_suspend(struct device *dev)
1295{
1296	struct sdio_func *func = dev_to_sdio_func(dev);
1297	struct if_sdio_card *card = sdio_get_drvdata(func);
1298	struct lbs_private *priv = card->priv;
1299	int ret;
1300
1301	mmc_pm_flag_t flags = sdio_get_host_pm_caps(func);
1302	priv->power_up_on_resume = false;
1303
1304	/* If we're powered off anyway, just let the mmc layer remove the
1305	 * card. */
1306	if (!lbs_iface_active(priv)) {
1307		if (priv->fw_ready) {
1308			priv->power_up_on_resume = true;
1309			if_sdio_power_off(card);
1310		}
1311
1312		return 0;
1313	}
1314
1315	dev_info(dev, "%s: suspend: PM flags = 0x%x\n",
1316		 sdio_func_id(func), flags);
1317
1318	/* If we aren't being asked to wake on anything, we should bail out
1319	 * and let the SD stack power down the card.
1320	 */
1321	if (priv->wol_criteria == EHS_REMOVE_WAKEUP) {
1322		dev_info(dev, "Suspend without wake params -- powering down card\n");
1323		if (priv->fw_ready) {
1324			ret = lbs_suspend(priv);
1325			if (ret)
1326				return ret;
1327
1328			priv->power_up_on_resume = true;
1329			if_sdio_power_off(card);
1330		}
1331
1332		return 0;
1333	}
1334
1335	if (!(flags & MMC_PM_KEEP_POWER)) {
1336		dev_err(dev, "%s: cannot remain alive while host is suspended\n",
1337			sdio_func_id(func));
1338		return -ENOSYS;
1339	}
1340
1341	ret = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
1342	if (ret)
1343		return ret;
1344
1345	ret = lbs_suspend(priv);
1346	if (ret)
1347		return ret;
1348
1349	return sdio_set_host_pm_flags(func, MMC_PM_WAKE_SDIO_IRQ);
1350}
1351
1352static int if_sdio_resume(struct device *dev)
1353{
1354	struct sdio_func *func = dev_to_sdio_func(dev);
1355	struct if_sdio_card *card = sdio_get_drvdata(func);
1356	int ret;
1357
1358	dev_info(dev, "%s: resume: we're back\n", sdio_func_id(func));
1359
1360	if (card->priv->power_up_on_resume) {
1361		if_sdio_power_on(card);
1362		wait_event(card->pwron_waitq, card->priv->fw_ready);
1363	}
1364
1365	ret = lbs_resume(card->priv);
1366
1367	return ret;
1368}
1369
1370static const struct dev_pm_ops if_sdio_pm_ops = {
1371	.suspend	= if_sdio_suspend,
1372	.resume		= if_sdio_resume,
1373};
1374
1375static struct sdio_driver if_sdio_driver = {
1376	.name		= "libertas_sdio",
1377	.id_table	= if_sdio_ids,
1378	.probe		= if_sdio_probe,
1379	.remove		= if_sdio_remove,
1380	.drv = {
1381		.pm = &if_sdio_pm_ops,
1382	},
1383};
1384
1385/*******************************************************************/
1386/* Module functions                                                */
1387/*******************************************************************/
1388
1389static int __init if_sdio_init_module(void)
1390{
1391	int ret = 0;
1392
1393	printk(KERN_INFO "libertas_sdio: Libertas SDIO driver\n");
1394	printk(KERN_INFO "libertas_sdio: Copyright Pierre Ossman\n");
1395
1396	ret = sdio_register_driver(&if_sdio_driver);
1397
1398	/* Clear the flag in case user removes the card. */
1399	user_rmmod = 0;
1400
1401	return ret;
1402}
1403
1404static void __exit if_sdio_exit_module(void)
1405{
1406	/* Set the flag as user is removing this module. */
1407	user_rmmod = 1;
1408
1409	sdio_unregister_driver(&if_sdio_driver);
1410}
1411
1412module_init(if_sdio_init_module);
1413module_exit(if_sdio_exit_module);
1414
1415MODULE_DESCRIPTION("Libertas SDIO WLAN Driver");
1416MODULE_AUTHOR("Pierre Ossman");
1417MODULE_LICENSE("GPL");
1418