1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *  linux/drivers/net/wireless/libertas/if_sdio.c
4  *
5  *  Copyright 2007-2008 Pierre Ossman
6  *
7  * Inspired by if_cs.c, Copyright 2007 Holger Schurig
8  *
9  * This hardware has more or less no CMD53 support, so all registers
10  * must be accessed using sdio_readb()/sdio_writeb().
11  *
12  * Transfers must be in one transaction or the firmware goes bonkers.
13  * This means that the transfer must either be small enough to do a
14  * byte based transfer or it must be padded to a multiple of the
15  * current block size.
16  *
17  * As SDIO is still new to the kernel, it is unfortunately common with
18  * bugs in the host controllers related to that. One such bug is that
19  * controllers cannot do transfers that aren't a multiple of 4 bytes.
20  * If you don't have time to fix the host controller driver, you can
21  * work around the problem by modifying if_sdio_host_to_card() and
22  * if_sdio_card_to_host() to pad the data.
23  */
24 
25 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
26 
27 #include <linux/kernel.h>
28 #include <linux/module.h>
29 #include <linux/slab.h>
30 #include <linux/firmware.h>
31 #include <linux/netdevice.h>
32 #include <linux/delay.h>
33 #include <linux/mmc/card.h>
34 #include <linux/mmc/sdio_func.h>
35 #include <linux/mmc/sdio_ids.h>
36 #include <linux/mmc/sdio.h>
37 #include <linux/mmc/host.h>
38 #include <linux/pm_runtime.h>
39 
40 #include "host.h"
41 #include "decl.h"
42 #include "defs.h"
43 #include "dev.h"
44 #include "cmd.h"
45 #include "if_sdio.h"
46 
47 static void if_sdio_interrupt(struct sdio_func *func);
48 
49 /* The if_sdio_remove() callback function is called when
50  * user removes this module from kernel space or ejects
51  * the card from the slot. The driver handles these 2 cases
52  * differently for SD8688 combo chip.
53  * If the user is removing the module, the FUNC_SHUTDOWN
54  * command for SD8688 is sent to the firmware.
55  * If the card is removed, there is no need to send this command.
56  *
57  * The variable 'user_rmmod' is used to distinguish these two
58  * scenarios. This flag is initialized as FALSE in case the card
59  * is removed, and will be set to TRUE for module removal when
60  * module_exit function is called.
61  */
62 static u8 user_rmmod;
63 
64 static const struct sdio_device_id if_sdio_ids[] = {
65 	{ SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL,
66 			SDIO_DEVICE_ID_MARVELL_LIBERTAS) },
67 	{ SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL,
68 			SDIO_DEVICE_ID_MARVELL_8688_WLAN) },
69 	{ /* end: all zeroes */				},
70 };
71 
72 MODULE_DEVICE_TABLE(sdio, if_sdio_ids);
73 
74 #define MODEL_8385	0x04
75 #define MODEL_8686	0x0b
76 #define MODEL_8688	0x10
77 
78 static const struct lbs_fw_table fw_table[] = {
79 	{ MODEL_8385, "libertas/sd8385_helper.bin", "libertas/sd8385.bin" },
80 	{ MODEL_8385, "sd8385_helper.bin", "sd8385.bin" },
81 	{ MODEL_8686, "libertas/sd8686_v9_helper.bin", "libertas/sd8686_v9.bin" },
82 	{ MODEL_8686, "libertas/sd8686_v8_helper.bin", "libertas/sd8686_v8.bin" },
83 	{ MODEL_8686, "sd8686_helper.bin", "sd8686.bin" },
84 	{ MODEL_8688, "libertas/sd8688_helper.bin", "libertas/sd8688.bin" },
85 	{ MODEL_8688, "sd8688_helper.bin", "sd8688.bin" },
86 	{ 0, NULL, NULL }
87 };
88 MODULE_FIRMWARE("libertas/sd8385_helper.bin");
89 MODULE_FIRMWARE("libertas/sd8385.bin");
90 MODULE_FIRMWARE("sd8385_helper.bin");
91 MODULE_FIRMWARE("sd8385.bin");
92 MODULE_FIRMWARE("libertas/sd8686_v9_helper.bin");
93 MODULE_FIRMWARE("libertas/sd8686_v9.bin");
94 MODULE_FIRMWARE("libertas/sd8686_v8_helper.bin");
95 MODULE_FIRMWARE("libertas/sd8686_v8.bin");
96 MODULE_FIRMWARE("sd8686_helper.bin");
97 MODULE_FIRMWARE("sd8686.bin");
98 MODULE_FIRMWARE("libertas/sd8688_helper.bin");
99 MODULE_FIRMWARE("libertas/sd8688.bin");
100 MODULE_FIRMWARE("sd8688_helper.bin");
101 MODULE_FIRMWARE("sd8688.bin");
102 
103 struct if_sdio_packet {
104 	struct list_head	list;
105 	u16			nb;
106 	u8			buffer[] __aligned(4);
107 };
108 
109 struct if_sdio_card {
110 	struct sdio_func	*func;
111 	struct lbs_private	*priv;
112 
113 	int			model;
114 	unsigned long		ioport;
115 	unsigned int		scratch_reg;
116 	bool			started;
117 	wait_queue_head_t	pwron_waitq;
118 
119 	u8			buffer[65536] __attribute__((aligned(4)));
120 
121 	spinlock_t		lock;
122 	struct list_head	packets;
123 
124 	struct workqueue_struct	*workqueue;
125 	struct work_struct	packet_worker;
126 	struct work_struct	reset_worker;
127 
128 	u8			rx_unit;
129 };
130 
131 static void if_sdio_finish_power_on(struct if_sdio_card *card);
132 static int if_sdio_power_off(struct if_sdio_card *card);
133 
134 /********************************************************************/
135 /* I/O                                                              */
136 /********************************************************************/
137 
138 /*
139  *  For SD8385/SD8686, this function reads firmware status after
140  *  the image is downloaded, or reads RX packet length when
141  *  interrupt (with IF_SDIO_H_INT_UPLD bit set) is received.
142  *  For SD8688, this function reads firmware status only.
143  */
144 static u16 if_sdio_read_scratch(struct if_sdio_card *card, int *err)
145 {
146 	int ret;
147 	u16 scratch;
148 
149 	scratch = sdio_readb(card->func, card->scratch_reg, &ret);
150 	if (!ret)
151 		scratch |= sdio_readb(card->func, card->scratch_reg + 1,
152 					&ret) << 8;
153 
154 	if (err)
155 		*err = ret;
156 
157 	if (ret)
158 		return 0xffff;
159 
160 	return scratch;
161 }
162 
163 static u8 if_sdio_read_rx_unit(struct if_sdio_card *card)
164 {
165 	int ret;
166 	u8 rx_unit;
167 
168 	rx_unit = sdio_readb(card->func, IF_SDIO_RX_UNIT, &ret);
169 
170 	if (ret)
171 		rx_unit = 0;
172 
173 	return rx_unit;
174 }
175 
176 static u16 if_sdio_read_rx_len(struct if_sdio_card *card, int *err)
177 {
178 	int ret;
179 	u16 rx_len;
180 
181 	switch (card->model) {
182 	case MODEL_8385:
183 	case MODEL_8686:
184 		rx_len = if_sdio_read_scratch(card, &ret);
185 		break;
186 	case MODEL_8688:
187 	default: /* for newer chipsets */
188 		rx_len = sdio_readb(card->func, IF_SDIO_RX_LEN, &ret);
189 		if (!ret)
190 			rx_len <<= card->rx_unit;
191 		else
192 			rx_len = 0xffff;	/* invalid length */
193 
194 		break;
195 	}
196 
197 	if (err)
198 		*err = ret;
199 
200 	return rx_len;
201 }
202 
203 static int if_sdio_handle_cmd(struct if_sdio_card *card,
204 		u8 *buffer, unsigned size)
205 {
206 	struct lbs_private *priv = card->priv;
207 	int ret;
208 	unsigned long flags;
209 	u8 i;
210 
211 	if (size > LBS_CMD_BUFFER_SIZE) {
212 		lbs_deb_sdio("response packet too large (%d bytes)\n",
213 			(int)size);
214 		ret = -E2BIG;
215 		goto out;
216 	}
217 
218 	spin_lock_irqsave(&priv->driver_lock, flags);
219 
220 	i = (priv->resp_idx == 0) ? 1 : 0;
221 	BUG_ON(priv->resp_len[i]);
222 	priv->resp_len[i] = size;
223 	memcpy(priv->resp_buf[i], buffer, size);
224 	lbs_notify_command_response(priv, i);
225 
226 	spin_unlock_irqrestore(&priv->driver_lock, flags);
227 
228 	ret = 0;
229 
230 out:
231 	return ret;
232 }
233 
234 static int if_sdio_handle_data(struct if_sdio_card *card,
235 		u8 *buffer, unsigned size)
236 {
237 	int ret;
238 	struct sk_buff *skb;
239 
240 	if (size > MRVDRV_ETH_RX_PACKET_BUFFER_SIZE) {
241 		lbs_deb_sdio("response packet too large (%d bytes)\n",
242 			(int)size);
243 		ret = -E2BIG;
244 		goto out;
245 	}
246 
247 	skb = dev_alloc_skb(MRVDRV_ETH_RX_PACKET_BUFFER_SIZE + NET_IP_ALIGN);
248 	if (!skb) {
249 		ret = -ENOMEM;
250 		goto out;
251 	}
252 
253 	skb_reserve(skb, NET_IP_ALIGN);
254 
255 	skb_put_data(skb, buffer, size);
256 
257 	lbs_process_rxed_packet(card->priv, skb);
258 
259 	ret = 0;
260 
261 out:
262 	return ret;
263 }
264 
265 static int if_sdio_handle_event(struct if_sdio_card *card,
266 		u8 *buffer, unsigned size)
267 {
268 	int ret;
269 	u32 event;
270 
271 	if (card->model == MODEL_8385) {
272 		event = sdio_readb(card->func, IF_SDIO_EVENT, &ret);
273 		if (ret)
274 			goto out;
275 
276 		/* right shift 3 bits to get the event id */
277 		event >>= 3;
278 	} else {
279 		if (size < 4) {
280 			lbs_deb_sdio("event packet too small (%d bytes)\n",
281 				(int)size);
282 			ret = -EINVAL;
283 			goto out;
284 		}
285 		event = buffer[3] << 24;
286 		event |= buffer[2] << 16;
287 		event |= buffer[1] << 8;
288 		event |= buffer[0] << 0;
289 	}
290 
291 	lbs_queue_event(card->priv, event & 0xFF);
292 	ret = 0;
293 
294 out:
295 	return ret;
296 }
297 
298 static int if_sdio_wait_status(struct if_sdio_card *card, const u8 condition)
299 {
300 	u8 status;
301 	unsigned long timeout;
302 	int ret = 0;
303 
304 	timeout = jiffies + HZ;
305 	while (1) {
306 		status = sdio_readb(card->func, IF_SDIO_STATUS, &ret);
307 		if (ret)
308 			return ret;
309 		if ((status & condition) == condition)
310 			break;
311 		if (time_after(jiffies, timeout))
312 			return -ETIMEDOUT;
313 		mdelay(1);
314 	}
315 	return ret;
316 }
317 
318 static int if_sdio_card_to_host(struct if_sdio_card *card)
319 {
320 	int ret;
321 	u16 size, type, chunk;
322 
323 	size = if_sdio_read_rx_len(card, &ret);
324 	if (ret)
325 		goto out;
326 
327 	if (size < 4) {
328 		lbs_deb_sdio("invalid packet size (%d bytes) from firmware\n",
329 			(int)size);
330 		ret = -EINVAL;
331 		goto out;
332 	}
333 
334 	ret = if_sdio_wait_status(card, IF_SDIO_IO_RDY);
335 	if (ret)
336 		goto out;
337 
338 	/*
339 	 * The transfer must be in one transaction or the firmware
340 	 * goes suicidal. There's no way to guarantee that for all
341 	 * controllers, but we can at least try.
342 	 */
343 	chunk = sdio_align_size(card->func, size);
344 
345 	ret = sdio_readsb(card->func, card->buffer, card->ioport, chunk);
346 	if (ret)
347 		goto out;
348 
349 	chunk = card->buffer[0] | (card->buffer[1] << 8);
350 	type = card->buffer[2] | (card->buffer[3] << 8);
351 
352 	lbs_deb_sdio("packet of type %d and size %d bytes\n",
353 		(int)type, (int)chunk);
354 
355 	if (chunk > size) {
356 		lbs_deb_sdio("packet fragment (%d > %d)\n",
357 			(int)chunk, (int)size);
358 		ret = -EINVAL;
359 		goto out;
360 	}
361 
362 	if (chunk < size) {
363 		lbs_deb_sdio("packet fragment (%d < %d)\n",
364 			(int)chunk, (int)size);
365 	}
366 
367 	switch (type) {
368 	case MVMS_CMD:
369 		ret = if_sdio_handle_cmd(card, card->buffer + 4, chunk - 4);
370 		if (ret)
371 			goto out;
372 		break;
373 	case MVMS_DAT:
374 		ret = if_sdio_handle_data(card, card->buffer + 4, chunk - 4);
375 		if (ret)
376 			goto out;
377 		break;
378 	case MVMS_EVENT:
379 		ret = if_sdio_handle_event(card, card->buffer + 4, chunk - 4);
380 		if (ret)
381 			goto out;
382 		break;
383 	default:
384 		lbs_deb_sdio("invalid type (%d) from firmware\n",
385 				(int)type);
386 		ret = -EINVAL;
387 		goto out;
388 	}
389 
390 out:
391 	if (ret)
392 		pr_err("problem fetching packet from firmware\n");
393 
394 	return ret;
395 }
396 
397 static void if_sdio_host_to_card_worker(struct work_struct *work)
398 {
399 	struct if_sdio_card *card;
400 	struct if_sdio_packet *packet;
401 	int ret;
402 	unsigned long flags;
403 
404 	card = container_of(work, struct if_sdio_card, packet_worker);
405 
406 	while (1) {
407 		spin_lock_irqsave(&card->lock, flags);
408 		packet = list_first_entry_or_null(&card->packets,
409 						  struct if_sdio_packet, list);
410 		if (packet)
411 			list_del(&packet->list);
412 		spin_unlock_irqrestore(&card->lock, flags);
413 
414 		if (!packet)
415 			break;
416 
417 		sdio_claim_host(card->func);
418 
419 		ret = if_sdio_wait_status(card, IF_SDIO_IO_RDY);
420 		if (ret == 0) {
421 			ret = sdio_writesb(card->func, card->ioport,
422 					   packet->buffer, packet->nb);
423 		}
424 
425 		if (ret)
426 			pr_err("error %d sending packet to firmware\n", ret);
427 
428 		sdio_release_host(card->func);
429 
430 		kfree(packet);
431 	}
432 }
433 
434 /********************************************************************/
435 /* Firmware                                                         */
436 /********************************************************************/
437 
438 #define FW_DL_READY_STATUS (IF_SDIO_IO_RDY | IF_SDIO_DL_RDY)
439 
440 static int if_sdio_prog_helper(struct if_sdio_card *card,
441 				const struct firmware *fw)
442 {
443 	int ret;
444 	unsigned long timeout;
445 	u8 *chunk_buffer;
446 	u32 chunk_size;
447 	const u8 *firmware;
448 	size_t size;
449 
450 	chunk_buffer = kzalloc(64, GFP_KERNEL);
451 	if (!chunk_buffer) {
452 		ret = -ENOMEM;
453 		goto out;
454 	}
455 
456 	sdio_claim_host(card->func);
457 
458 	ret = sdio_set_block_size(card->func, 32);
459 	if (ret)
460 		goto release;
461 
462 	firmware = fw->data;
463 	size = fw->size;
464 
465 	while (size) {
466 		ret = if_sdio_wait_status(card, FW_DL_READY_STATUS);
467 		if (ret)
468 			goto release;
469 
470 		/* On some platforms (like Davinci) the chip needs more time
471 		 * between helper blocks.
472 		 */
473 		mdelay(2);
474 
475 		chunk_size = min_t(size_t, size, 60);
476 
477 		*((__le32*)chunk_buffer) = cpu_to_le32(chunk_size);
478 		memcpy(chunk_buffer + 4, firmware, chunk_size);
479 /*
480 		lbs_deb_sdio("sending %d bytes chunk\n", chunk_size);
481 */
482 		ret = sdio_writesb(card->func, card->ioport,
483 				chunk_buffer, 64);
484 		if (ret)
485 			goto release;
486 
487 		firmware += chunk_size;
488 		size -= chunk_size;
489 	}
490 
491 	/* an empty block marks the end of the transfer */
492 	memset(chunk_buffer, 0, 4);
493 	ret = sdio_writesb(card->func, card->ioport, chunk_buffer, 64);
494 	if (ret)
495 		goto release;
496 
497 	lbs_deb_sdio("waiting for helper to boot...\n");
498 
499 	/* wait for the helper to boot by looking at the size register */
500 	timeout = jiffies + HZ;
501 	while (1) {
502 		u16 req_size;
503 
504 		req_size = sdio_readb(card->func, IF_SDIO_RD_BASE, &ret);
505 		if (ret)
506 			goto release;
507 
508 		req_size |= sdio_readb(card->func, IF_SDIO_RD_BASE + 1, &ret) << 8;
509 		if (ret)
510 			goto release;
511 
512 		if (req_size != 0)
513 			break;
514 
515 		if (time_after(jiffies, timeout)) {
516 			ret = -ETIMEDOUT;
517 			goto release;
518 		}
519 
520 		msleep(10);
521 	}
522 
523 	ret = 0;
524 
525 release:
526 	sdio_release_host(card->func);
527 	kfree(chunk_buffer);
528 
529 out:
530 	if (ret)
531 		pr_err("failed to load helper firmware\n");
532 
533 	return ret;
534 }
535 
536 static int if_sdio_prog_real(struct if_sdio_card *card,
537 				const struct firmware *fw)
538 {
539 	int ret;
540 	unsigned long timeout;
541 	u8 *chunk_buffer;
542 	u32 chunk_size;
543 	const u8 *firmware;
544 	size_t size, req_size;
545 
546 	chunk_buffer = kzalloc(512, GFP_KERNEL);
547 	if (!chunk_buffer) {
548 		ret = -ENOMEM;
549 		goto out;
550 	}
551 
552 	sdio_claim_host(card->func);
553 
554 	ret = sdio_set_block_size(card->func, 32);
555 	if (ret)
556 		goto release;
557 
558 	firmware = fw->data;
559 	size = fw->size;
560 
561 	while (size) {
562 		timeout = jiffies + HZ;
563 		while (1) {
564 			ret = if_sdio_wait_status(card, FW_DL_READY_STATUS);
565 			if (ret)
566 				goto release;
567 
568 			req_size = sdio_readb(card->func, IF_SDIO_RD_BASE,
569 					&ret);
570 			if (ret)
571 				goto release;
572 
573 			req_size |= sdio_readb(card->func, IF_SDIO_RD_BASE + 1,
574 					&ret) << 8;
575 			if (ret)
576 				goto release;
577 
578 			/*
579 			 * For SD8688 wait until the length is not 0, 1 or 2
580 			 * before downloading the first FW block,
581 			 * since BOOT code writes the register to indicate the
582 			 * helper/FW download winner,
583 			 * the value could be 1 or 2 (Func1 or Func2).
584 			 */
585 			if ((size != fw->size) || (req_size > 2))
586 				break;
587 			if (time_after(jiffies, timeout)) {
588 				ret = -ETIMEDOUT;
589 				goto release;
590 			}
591 			mdelay(1);
592 		}
593 
594 /*
595 		lbs_deb_sdio("firmware wants %d bytes\n", (int)req_size);
596 */
597 		if (req_size == 0) {
598 			lbs_deb_sdio("firmware helper gave up early\n");
599 			ret = -EIO;
600 			goto release;
601 		}
602 
603 		if (req_size & 0x01) {
604 			lbs_deb_sdio("firmware helper signalled error\n");
605 			ret = -EIO;
606 			goto release;
607 		}
608 
609 		if (req_size > size)
610 			req_size = size;
611 
612 		while (req_size) {
613 			chunk_size = min_t(size_t, req_size, 512);
614 
615 			memcpy(chunk_buffer, firmware, chunk_size);
616 /*
617 			lbs_deb_sdio("sending %d bytes (%d bytes) chunk\n",
618 				chunk_size, (chunk_size + 31) / 32 * 32);
619 */
620 			ret = sdio_writesb(card->func, card->ioport,
621 				chunk_buffer, roundup(chunk_size, 32));
622 			if (ret)
623 				goto release;
624 
625 			firmware += chunk_size;
626 			size -= chunk_size;
627 			req_size -= chunk_size;
628 		}
629 	}
630 
631 	ret = 0;
632 
633 	lbs_deb_sdio("waiting for firmware to boot...\n");
634 
635 	/* wait for the firmware to boot */
636 	timeout = jiffies + HZ;
637 	while (1) {
638 		u16 scratch;
639 
640 		scratch = if_sdio_read_scratch(card, &ret);
641 		if (ret)
642 			goto release;
643 
644 		if (scratch == IF_SDIO_FIRMWARE_OK)
645 			break;
646 
647 		if (time_after(jiffies, timeout)) {
648 			ret = -ETIMEDOUT;
649 			goto release;
650 		}
651 
652 		msleep(10);
653 	}
654 
655 	ret = 0;
656 
657 release:
658 	sdio_release_host(card->func);
659 	kfree(chunk_buffer);
660 
661 out:
662 	if (ret)
663 		pr_err("failed to load firmware\n");
664 
665 	return ret;
666 }
667 
668 static void if_sdio_do_prog_firmware(struct lbs_private *priv, int ret,
669 				     const struct firmware *helper,
670 				     const struct firmware *mainfw)
671 {
672 	struct if_sdio_card *card = priv->card;
673 
674 	if (ret) {
675 		pr_err("failed to find firmware (%d)\n", ret);
676 		return;
677 	}
678 
679 	ret = if_sdio_prog_helper(card, helper);
680 	if (ret)
681 		return;
682 
683 	lbs_deb_sdio("Helper firmware loaded\n");
684 
685 	ret = if_sdio_prog_real(card, mainfw);
686 	if (ret)
687 		return;
688 
689 	lbs_deb_sdio("Firmware loaded\n");
690 	if_sdio_finish_power_on(card);
691 }
692 
693 static int if_sdio_prog_firmware(struct if_sdio_card *card)
694 {
695 	int ret;
696 	u16 scratch;
697 
698 	/*
699 	 * Disable interrupts
700 	 */
701 	sdio_claim_host(card->func);
702 	sdio_writeb(card->func, 0x00, IF_SDIO_H_INT_MASK, &ret);
703 	sdio_release_host(card->func);
704 
705 	sdio_claim_host(card->func);
706 	scratch = if_sdio_read_scratch(card, &ret);
707 	sdio_release_host(card->func);
708 
709 	lbs_deb_sdio("firmware status = %#x\n", scratch);
710 	lbs_deb_sdio("scratch ret = %d\n", ret);
711 
712 	if (ret)
713 		goto out;
714 
715 
716 	/*
717 	 * The manual clearly describes that FEDC is the right code to use
718 	 * to detect firmware presence, but for SD8686 it is not that simple.
719 	 * Scratch is also used to store the RX packet length, so we lose
720 	 * the FEDC value early on. So we use a non-zero check in order
721 	 * to validate firmware presence.
722 	 * Additionally, the SD8686 in the Gumstix always has the high scratch
723 	 * bit set, even when the firmware is not loaded. So we have to
724 	 * exclude that from the test.
725 	 */
726 	if (scratch == IF_SDIO_FIRMWARE_OK) {
727 		lbs_deb_sdio("firmware already loaded\n");
728 		if_sdio_finish_power_on(card);
729 		return 0;
730 	} else if ((card->model == MODEL_8686) && (scratch & 0x7fff)) {
731 		lbs_deb_sdio("firmware may be running\n");
732 		if_sdio_finish_power_on(card);
733 		return 0;
734 	}
735 
736 	ret = lbs_get_firmware_async(card->priv, &card->func->dev, card->model,
737 				     fw_table, if_sdio_do_prog_firmware);
738 
739 out:
740 	return ret;
741 }
742 
743 /********************************************************************/
744 /* Power management                                                 */
745 /********************************************************************/
746 
747 /* Finish power on sequence (after firmware is loaded) */
748 static void if_sdio_finish_power_on(struct if_sdio_card *card)
749 {
750 	struct sdio_func *func = card->func;
751 	struct lbs_private *priv = card->priv;
752 	int ret;
753 
754 	sdio_claim_host(func);
755 	sdio_set_block_size(card->func, IF_SDIO_BLOCK_SIZE);
756 
757 	/*
758 	 * Get rx_unit if the chip is SD8688 or newer.
759 	 * SD8385 & SD8686 do not have rx_unit.
760 	 */
761 	if ((card->model != MODEL_8385)
762 			&& (card->model != MODEL_8686))
763 		card->rx_unit = if_sdio_read_rx_unit(card);
764 	else
765 		card->rx_unit = 0;
766 
767 	/*
768 	 * Set up the interrupt handler late.
769 	 *
770 	 * If we set it up earlier, the (buggy) hardware generates a spurious
771 	 * interrupt, even before the interrupt has been enabled, with
772 	 * CCCR_INTx = 0.
773 	 *
774 	 * We register the interrupt handler late so that we can handle any
775 	 * spurious interrupts, and also to avoid generation of that known
776 	 * spurious interrupt in the first place.
777 	 */
778 	ret = sdio_claim_irq(func, if_sdio_interrupt);
779 	if (ret)
780 		goto release;
781 
782 	/*
783 	 * Enable interrupts now that everything is set up
784 	 */
785 	sdio_writeb(func, 0x0f, IF_SDIO_H_INT_MASK, &ret);
786 	if (ret)
787 		goto release_irq;
788 
789 	sdio_release_host(func);
790 
791 	/* Set fw_ready before queuing any commands so that
792 	 * lbs_thread won't block from sending them to firmware.
793 	 */
794 	priv->fw_ready = 1;
795 
796 	/*
797 	 * FUNC_INIT is required for SD8688 WLAN/BT multiple functions
798 	 */
799 	if (card->model == MODEL_8688) {
800 		struct cmd_header cmd;
801 
802 		memset(&cmd, 0, sizeof(cmd));
803 
804 		lbs_deb_sdio("send function INIT command\n");
805 		if (__lbs_cmd(priv, CMD_FUNC_INIT, &cmd, sizeof(cmd),
806 				lbs_cmd_copyback, (unsigned long) &cmd))
807 			netdev_alert(priv->dev, "CMD_FUNC_INIT cmd failed\n");
808 	}
809 
810 	wake_up(&card->pwron_waitq);
811 
812 	if (!card->started) {
813 		ret = lbs_start_card(priv);
814 		if_sdio_power_off(card);
815 		if (ret == 0) {
816 			card->started = true;
817 			/* Tell PM core that we don't need the card to be
818 			 * powered now */
819 			pm_runtime_put(&func->dev);
820 		}
821 	}
822 
823 	return;
824 
825 release_irq:
826 	sdio_release_irq(func);
827 release:
828 	sdio_release_host(func);
829 }
830 
831 static int if_sdio_power_on(struct if_sdio_card *card)
832 {
833 	struct sdio_func *func = card->func;
834 	struct mmc_host *host = func->card->host;
835 	int ret;
836 
837 	sdio_claim_host(func);
838 
839 	ret = sdio_enable_func(func);
840 	if (ret)
841 		goto release;
842 
843 	/* For 1-bit transfers to the 8686 model, we need to enable the
844 	 * interrupt flag in the CCCR register. Set the MMC_QUIRK_LENIENT_FN0
845 	 * bit to allow access to non-vendor registers. */
846 	if ((card->model == MODEL_8686) &&
847 	    (host->caps & MMC_CAP_SDIO_IRQ) &&
848 	    (host->ios.bus_width == MMC_BUS_WIDTH_1)) {
849 		u8 reg;
850 
851 		func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
852 		reg = sdio_f0_readb(func, SDIO_CCCR_IF, &ret);
853 		if (ret)
854 			goto disable;
855 
856 		reg |= SDIO_BUS_ECSI;
857 		sdio_f0_writeb(func, reg, SDIO_CCCR_IF, &ret);
858 		if (ret)
859 			goto disable;
860 	}
861 
862 	card->ioport = sdio_readb(func, IF_SDIO_IOPORT, &ret);
863 	if (ret)
864 		goto disable;
865 
866 	card->ioport |= sdio_readb(func, IF_SDIO_IOPORT + 1, &ret) << 8;
867 	if (ret)
868 		goto disable;
869 
870 	card->ioport |= sdio_readb(func, IF_SDIO_IOPORT + 2, &ret) << 16;
871 	if (ret)
872 		goto disable;
873 
874 	sdio_release_host(func);
875 	ret = if_sdio_prog_firmware(card);
876 	if (ret) {
877 		sdio_claim_host(func);
878 		goto disable;
879 	}
880 
881 	return 0;
882 
883 disable:
884 	sdio_disable_func(func);
885 release:
886 	sdio_release_host(func);
887 	return ret;
888 }
889 
890 static int if_sdio_power_off(struct if_sdio_card *card)
891 {
892 	struct sdio_func *func = card->func;
893 	struct lbs_private *priv = card->priv;
894 
895 	priv->fw_ready = 0;
896 
897 	sdio_claim_host(func);
898 	sdio_release_irq(func);
899 	sdio_disable_func(func);
900 	sdio_release_host(func);
901 	return 0;
902 }
903 
904 
905 /*******************************************************************/
906 /* Libertas callbacks                                              */
907 /*******************************************************************/
908 
909 static int if_sdio_host_to_card(struct lbs_private *priv,
910 		u8 type, u8 *buf, u16 nb)
911 {
912 	int ret;
913 	struct if_sdio_card *card;
914 	struct if_sdio_packet *packet;
915 	u16 size;
916 	unsigned long flags;
917 
918 	card = priv->card;
919 
920 	if (nb > (65536 - sizeof(struct if_sdio_packet) - 4)) {
921 		ret = -EINVAL;
922 		goto out;
923 	}
924 
925 	/*
926 	 * The transfer must be in one transaction or the firmware
927 	 * goes suicidal. There's no way to guarantee that for all
928 	 * controllers, but we can at least try.
929 	 */
930 	size = sdio_align_size(card->func, nb + 4);
931 
932 	packet = kzalloc(sizeof(struct if_sdio_packet) + size,
933 			GFP_ATOMIC);
934 	if (!packet) {
935 		ret = -ENOMEM;
936 		goto out;
937 	}
938 
939 	packet->nb = size;
940 
941 	/*
942 	 * SDIO specific header.
943 	 */
944 	packet->buffer[0] = (nb + 4) & 0xff;
945 	packet->buffer[1] = ((nb + 4) >> 8) & 0xff;
946 	packet->buffer[2] = type;
947 	packet->buffer[3] = 0;
948 
949 	memcpy(packet->buffer + 4, buf, nb);
950 
951 	spin_lock_irqsave(&card->lock, flags);
952 
953 	list_add_tail(&packet->list, &card->packets);
954 
955 	switch (type) {
956 	case MVMS_CMD:
957 		priv->dnld_sent = DNLD_CMD_SENT;
958 		break;
959 	case MVMS_DAT:
960 		priv->dnld_sent = DNLD_DATA_SENT;
961 		break;
962 	default:
963 		lbs_deb_sdio("unknown packet type %d\n", (int)type);
964 	}
965 
966 	spin_unlock_irqrestore(&card->lock, flags);
967 
968 	queue_work(card->workqueue, &card->packet_worker);
969 
970 	ret = 0;
971 
972 out:
973 	return ret;
974 }
975 
976 static int if_sdio_enter_deep_sleep(struct lbs_private *priv)
977 {
978 	int ret;
979 	struct cmd_header cmd;
980 
981 	memset(&cmd, 0, sizeof(cmd));
982 
983 	lbs_deb_sdio("send DEEP_SLEEP command\n");
984 	ret = __lbs_cmd(priv, CMD_802_11_DEEP_SLEEP, &cmd, sizeof(cmd),
985 			lbs_cmd_copyback, (unsigned long) &cmd);
986 	if (ret)
987 		netdev_err(priv->dev, "DEEP_SLEEP cmd failed\n");
988 
989 	mdelay(200);
990 	return ret;
991 }
992 
993 static int if_sdio_exit_deep_sleep(struct lbs_private *priv)
994 {
995 	struct if_sdio_card *card = priv->card;
996 	int ret = -1;
997 
998 	sdio_claim_host(card->func);
999 
1000 	sdio_writeb(card->func, HOST_POWER_UP, CONFIGURATION_REG, &ret);
1001 	if (ret)
1002 		netdev_err(priv->dev, "sdio_writeb failed!\n");
1003 
1004 	sdio_release_host(card->func);
1005 
1006 	return ret;
1007 }
1008 
1009 static int if_sdio_reset_deep_sleep_wakeup(struct lbs_private *priv)
1010 {
1011 	struct if_sdio_card *card = priv->card;
1012 	int ret = -1;
1013 
1014 	sdio_claim_host(card->func);
1015 
1016 	sdio_writeb(card->func, 0, CONFIGURATION_REG, &ret);
1017 	if (ret)
1018 		netdev_err(priv->dev, "sdio_writeb failed!\n");
1019 
1020 	sdio_release_host(card->func);
1021 
1022 	return ret;
1023 
1024 }
1025 
1026 static void if_sdio_reset_card_worker(struct work_struct *work)
1027 {
1028 	int ret;
1029 	const char *name;
1030 	struct device *dev;
1031 	struct if_sdio_card *card;
1032 	struct mmc_host *reset_host;
1033 
1034 	card = container_of(work, struct if_sdio_card, reset_worker);
1035 	reset_host = card->func->card->host;
1036 	name = card->priv->dev->name;
1037 	dev = &card->func->dev;
1038 
1039 	/*
1040 	 * The actual reset operation must be run outside of lbs_thread. This
1041 	 * is because mmc_remove_host() will cause the device to be instantly
1042 	 * destroyed, and the libertas driver then needs to end lbs_thread,
1043 	 * leading to a deadlock.
1044 	 *
1045 	 * We run it in a workqueue totally independent from the if_sdio_card
1046 	 * instance for that reason.
1047 	 */
1048 
1049 	dev_info(dev, "resetting card %s...", name);
1050 	mmc_remove_host(reset_host);
1051 	ret = mmc_add_host(reset_host);
1052 	if (ret)
1053 		dev_err(dev, "%s: can't add mmc host, error %d\n", name, ret);
1054 }
1055 
1056 static void if_sdio_reset_card(struct lbs_private *priv)
1057 {
1058 	struct if_sdio_card *card = priv->card;
1059 
1060 	if (!work_pending(&card->reset_worker))
1061 		schedule_work(&card->reset_worker);
1062 }
1063 
1064 static int if_sdio_power_save(struct lbs_private *priv)
1065 {
1066 	struct if_sdio_card *card = priv->card;
1067 	int ret;
1068 
1069 	flush_workqueue(card->workqueue);
1070 
1071 	ret = if_sdio_power_off(card);
1072 
1073 	/* Let runtime PM know the card is powered off */
1074 	pm_runtime_put_sync(&card->func->dev);
1075 
1076 	return ret;
1077 }
1078 
1079 static int if_sdio_power_restore(struct lbs_private *priv)
1080 {
1081 	struct if_sdio_card *card = priv->card;
1082 	int r;
1083 
1084 	/* Make sure the card will not be powered off by runtime PM */
1085 	pm_runtime_get_sync(&card->func->dev);
1086 
1087 	r = if_sdio_power_on(card);
1088 	if (r)
1089 		return r;
1090 
1091 	wait_event(card->pwron_waitq, priv->fw_ready);
1092 	return 0;
1093 }
1094 
1095 
1096 /*******************************************************************/
1097 /* SDIO callbacks                                                  */
1098 /*******************************************************************/
1099 
1100 static void if_sdio_interrupt(struct sdio_func *func)
1101 {
1102 	int ret;
1103 	struct if_sdio_card *card;
1104 	u8 cause;
1105 
1106 	card = sdio_get_drvdata(func);
1107 
1108 	cause = sdio_readb(card->func, IF_SDIO_H_INT_STATUS, &ret);
1109 	if (ret || !cause)
1110 		return;
1111 
1112 	lbs_deb_sdio("interrupt: 0x%X\n", (unsigned)cause);
1113 
1114 	sdio_writeb(card->func, ~cause, IF_SDIO_H_INT_STATUS, &ret);
1115 	if (ret)
1116 		return;
1117 
1118 	/*
1119 	 * Ignore the define name, this really means the card has
1120 	 * successfully received the command.
1121 	 */
1122 	card->priv->is_activity_detected = 1;
1123 	if (cause & IF_SDIO_H_INT_DNLD)
1124 		lbs_host_to_card_done(card->priv);
1125 
1126 
1127 	if (cause & IF_SDIO_H_INT_UPLD) {
1128 		ret = if_sdio_card_to_host(card);
1129 		if (ret)
1130 			return;
1131 	}
1132 }
1133 
1134 static int if_sdio_probe(struct sdio_func *func,
1135 		const struct sdio_device_id *id)
1136 {
1137 	struct if_sdio_card *card;
1138 	struct lbs_private *priv;
1139 	int ret, i;
1140 	unsigned int model;
1141 	struct if_sdio_packet *packet, *tmp;
1142 
1143 	for (i = 0;i < func->card->num_info;i++) {
1144 		if (sscanf(func->card->info[i],
1145 				"802.11 SDIO ID: %x", &model) == 1)
1146 			break;
1147 		if (sscanf(func->card->info[i],
1148 				"ID: %x", &model) == 1)
1149 			break;
1150 		if (!strcmp(func->card->info[i], "IBIS Wireless SDIO Card")) {
1151 			model = MODEL_8385;
1152 			break;
1153 		}
1154 	}
1155 
1156 	if (i == func->card->num_info) {
1157 		pr_err("unable to identify card model\n");
1158 		return -ENODEV;
1159 	}
1160 
1161 	card = kzalloc(sizeof(struct if_sdio_card), GFP_KERNEL);
1162 	if (!card)
1163 		return -ENOMEM;
1164 
1165 	card->func = func;
1166 	card->model = model;
1167 
1168 	switch (card->model) {
1169 	case MODEL_8385:
1170 		card->scratch_reg = IF_SDIO_SCRATCH_OLD;
1171 		break;
1172 	case MODEL_8686:
1173 		card->scratch_reg = IF_SDIO_SCRATCH;
1174 		break;
1175 	case MODEL_8688:
1176 	default: /* for newer chipsets */
1177 		card->scratch_reg = IF_SDIO_FW_STATUS;
1178 		break;
1179 	}
1180 
1181 	spin_lock_init(&card->lock);
1182 	INIT_LIST_HEAD(&card->packets);
1183 
1184 	card->workqueue = alloc_workqueue("libertas_sdio", WQ_MEM_RECLAIM, 0);
1185 	if (unlikely(!card->workqueue)) {
1186 		ret = -ENOMEM;
1187 		goto err_queue;
1188 	}
1189 
1190 	INIT_WORK(&card->reset_worker, if_sdio_reset_card_worker);
1191 	INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker);
1192 	init_waitqueue_head(&card->pwron_waitq);
1193 
1194 	/* Check if we support this card */
1195 	for (i = 0; i < ARRAY_SIZE(fw_table); i++) {
1196 		if (card->model == fw_table[i].model)
1197 			break;
1198 	}
1199 	if (i == ARRAY_SIZE(fw_table)) {
1200 		pr_err("unknown card model 0x%x\n", card->model);
1201 		ret = -ENODEV;
1202 		goto free;
1203 	}
1204 
1205 	sdio_set_drvdata(func, card);
1206 
1207 	lbs_deb_sdio("class = 0x%X, vendor = 0x%X, "
1208 			"device = 0x%X, model = 0x%X, ioport = 0x%X\n",
1209 			func->class, func->vendor, func->device,
1210 			model, (unsigned)card->ioport);
1211 
1212 
1213 	priv = lbs_add_card(card, &func->dev);
1214 	if (IS_ERR(priv)) {
1215 		ret = PTR_ERR(priv);
1216 		goto free;
1217 	}
1218 
1219 	card->priv = priv;
1220 
1221 	priv->card = card;
1222 	priv->hw_host_to_card = if_sdio_host_to_card;
1223 	priv->enter_deep_sleep = if_sdio_enter_deep_sleep;
1224 	priv->exit_deep_sleep = if_sdio_exit_deep_sleep;
1225 	priv->reset_deep_sleep_wakeup = if_sdio_reset_deep_sleep_wakeup;
1226 	priv->reset_card = if_sdio_reset_card;
1227 	priv->power_save = if_sdio_power_save;
1228 	priv->power_restore = if_sdio_power_restore;
1229 	priv->is_polling = !(func->card->host->caps & MMC_CAP_SDIO_IRQ);
1230 	ret = if_sdio_power_on(card);
1231 	if (ret)
1232 		goto err_activate_card;
1233 
1234 out:
1235 	return ret;
1236 
1237 err_activate_card:
1238 	flush_workqueue(card->workqueue);
1239 	lbs_remove_card(priv);
1240 free:
1241 	cancel_work_sync(&card->packet_worker);
1242 	cancel_work_sync(&card->reset_worker);
1243 	destroy_workqueue(card->workqueue);
1244 err_queue:
1245 	list_for_each_entry_safe(packet, tmp, &card->packets, list)
1246 		kfree(packet);
1247 
1248 	kfree(card);
1249 
1250 	goto out;
1251 }
1252 
1253 static void if_sdio_remove(struct sdio_func *func)
1254 {
1255 	struct if_sdio_card *card;
1256 	struct if_sdio_packet *packet, *tmp;
1257 
1258 	card = sdio_get_drvdata(func);
1259 
1260 	/* Undo decrement done above in if_sdio_probe */
1261 	pm_runtime_get_noresume(&func->dev);
1262 
1263 	if (user_rmmod && (card->model == MODEL_8688)) {
1264 		/*
1265 		 * FUNC_SHUTDOWN is required for SD8688 WLAN/BT
1266 		 * multiple functions
1267 		 */
1268 		struct cmd_header cmd;
1269 
1270 		memset(&cmd, 0, sizeof(cmd));
1271 
1272 		lbs_deb_sdio("send function SHUTDOWN command\n");
1273 		if (__lbs_cmd(card->priv, CMD_FUNC_SHUTDOWN,
1274 				&cmd, sizeof(cmd), lbs_cmd_copyback,
1275 				(unsigned long) &cmd))
1276 			pr_alert("CMD_FUNC_SHUTDOWN cmd failed\n");
1277 	}
1278 
1279 
1280 	lbs_deb_sdio("call remove card\n");
1281 	lbs_stop_card(card->priv);
1282 	lbs_remove_card(card->priv);
1283 
1284 	cancel_work_sync(&card->packet_worker);
1285 	cancel_work_sync(&card->reset_worker);
1286 	destroy_workqueue(card->workqueue);
1287 
1288 	list_for_each_entry_safe(packet, tmp, &card->packets, list)
1289 		kfree(packet);
1290 
1291 	kfree(card);
1292 }
1293 
1294 static int if_sdio_suspend(struct device *dev)
1295 {
1296 	struct sdio_func *func = dev_to_sdio_func(dev);
1297 	struct if_sdio_card *card = sdio_get_drvdata(func);
1298 	struct lbs_private *priv = card->priv;
1299 	int ret;
1300 
1301 	mmc_pm_flag_t flags = sdio_get_host_pm_caps(func);
1302 	priv->power_up_on_resume = false;
1303 
1304 	/* If we're powered off anyway, just let the mmc layer remove the
1305 	 * card. */
1306 	if (!lbs_iface_active(priv)) {
1307 		if (priv->fw_ready) {
1308 			priv->power_up_on_resume = true;
1309 			if_sdio_power_off(card);
1310 		}
1311 
1312 		return 0;
1313 	}
1314 
1315 	dev_info(dev, "%s: suspend: PM flags = 0x%x\n",
1316 		 sdio_func_id(func), flags);
1317 
1318 	/* If we aren't being asked to wake on anything, we should bail out
1319 	 * and let the SD stack power down the card.
1320 	 */
1321 	if (priv->wol_criteria == EHS_REMOVE_WAKEUP) {
1322 		dev_info(dev, "Suspend without wake params -- powering down card\n");
1323 		if (priv->fw_ready) {
1324 			ret = lbs_suspend(priv);
1325 			if (ret)
1326 				return ret;
1327 
1328 			priv->power_up_on_resume = true;
1329 			if_sdio_power_off(card);
1330 		}
1331 
1332 		return 0;
1333 	}
1334 
1335 	if (!(flags & MMC_PM_KEEP_POWER)) {
1336 		dev_err(dev, "%s: cannot remain alive while host is suspended\n",
1337 			sdio_func_id(func));
1338 		return -ENOSYS;
1339 	}
1340 
1341 	ret = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
1342 	if (ret)
1343 		return ret;
1344 
1345 	ret = lbs_suspend(priv);
1346 	if (ret)
1347 		return ret;
1348 
1349 	return sdio_set_host_pm_flags(func, MMC_PM_WAKE_SDIO_IRQ);
1350 }
1351 
1352 static int if_sdio_resume(struct device *dev)
1353 {
1354 	struct sdio_func *func = dev_to_sdio_func(dev);
1355 	struct if_sdio_card *card = sdio_get_drvdata(func);
1356 	int ret;
1357 
1358 	dev_info(dev, "%s: resume: we're back\n", sdio_func_id(func));
1359 
1360 	if (card->priv->power_up_on_resume) {
1361 		if_sdio_power_on(card);
1362 		wait_event(card->pwron_waitq, card->priv->fw_ready);
1363 	}
1364 
1365 	ret = lbs_resume(card->priv);
1366 
1367 	return ret;
1368 }
1369 
1370 static const struct dev_pm_ops if_sdio_pm_ops = {
1371 	.suspend	= if_sdio_suspend,
1372 	.resume		= if_sdio_resume,
1373 };
1374 
1375 static struct sdio_driver if_sdio_driver = {
1376 	.name		= "libertas_sdio",
1377 	.id_table	= if_sdio_ids,
1378 	.probe		= if_sdio_probe,
1379 	.remove		= if_sdio_remove,
1380 	.drv = {
1381 		.pm = &if_sdio_pm_ops,
1382 	},
1383 };
1384 
1385 /*******************************************************************/
1386 /* Module functions                                                */
1387 /*******************************************************************/
1388 
1389 static int __init if_sdio_init_module(void)
1390 {
1391 	int ret = 0;
1392 
1393 	printk(KERN_INFO "libertas_sdio: Libertas SDIO driver\n");
1394 	printk(KERN_INFO "libertas_sdio: Copyright Pierre Ossman\n");
1395 
1396 	ret = sdio_register_driver(&if_sdio_driver);
1397 
1398 	/* Clear the flag in case user removes the card. */
1399 	user_rmmod = 0;
1400 
1401 	return ret;
1402 }
1403 
1404 static void __exit if_sdio_exit_module(void)
1405 {
1406 	/* Set the flag as user is removing this module. */
1407 	user_rmmod = 1;
1408 
1409 	sdio_unregister_driver(&if_sdio_driver);
1410 }
1411 
1412 module_init(if_sdio_init_module);
1413 module_exit(if_sdio_exit_module);
1414 
1415 MODULE_DESCRIPTION("Libertas SDIO WLAN Driver");
1416 MODULE_AUTHOR("Pierre Ossman");
1417 MODULE_LICENSE("GPL");
1418