1 /*
2  *   Driver for KeyStream, KS7010 based SDIO cards.
3  *
4  *   Copyright (C) 2006-2008 KeyStream Corp.
5  *   Copyright (C) 2009 Renesas Technology Corp.
6  *   Copyright (C) 2016 Sang Engineering, Wolfram Sang
7  *
8  *   This program is free software; you can redistribute it and/or modify
9  *   it under the terms of the GNU General Public License version 2 as
10  *   published by the Free Software Foundation.
11  */
12 
13 #include <linux/firmware.h>
14 #include <linux/mmc/card.h>
15 #include <linux/mmc/sdio_func.h>
16 #include <linux/workqueue.h>
17 #include <linux/atomic.h>
18 
19 #include "ks_wlan.h"
20 #include "ks_wlan_ioctl.h"
21 #include "ks_hostif.h"
22 #include "ks7010_sdio.h"
23 
24 #define KS7010_FUNC_NUM 1
25 #define KS7010_IO_BLOCK_SIZE 512
26 #define KS7010_MAX_CLOCK 25000000
27 
28 static const struct sdio_device_id ks7010_sdio_ids[] = {
29 	{SDIO_DEVICE(SDIO_VENDOR_ID_KS_CODE_A, SDIO_DEVICE_ID_KS_7010)},
30 	{SDIO_DEVICE(SDIO_VENDOR_ID_KS_CODE_B, SDIO_DEVICE_ID_KS_7010)},
31 	{ /* all zero */ }
32 };
33 MODULE_DEVICE_TABLE(sdio, ks7010_sdio_ids);
34 
35 #define inc_txqhead(priv) \
36 	(priv->tx_dev.qhead = (priv->tx_dev.qhead + 1) % TX_DEVICE_BUFF_SIZE)
37 #define inc_txqtail(priv) \
38 	(priv->tx_dev.qtail = (priv->tx_dev.qtail + 1) % TX_DEVICE_BUFF_SIZE)
39 #define cnt_txqbody(priv) \
40 	(((priv->tx_dev.qtail + TX_DEVICE_BUFF_SIZE) - (priv->tx_dev.qhead)) % TX_DEVICE_BUFF_SIZE)
41 
42 #define inc_rxqhead(priv) \
43 	(priv->rx_dev.qhead = (priv->rx_dev.qhead + 1) % RX_DEVICE_BUFF_SIZE)
44 #define inc_rxqtail(priv) \
45 	(priv->rx_dev.qtail = (priv->rx_dev.qtail + 1) % RX_DEVICE_BUFF_SIZE)
46 #define cnt_rxqbody(priv) \
47 	(((priv->rx_dev.qtail + RX_DEVICE_BUFF_SIZE) - (priv->rx_dev.qhead)) % RX_DEVICE_BUFF_SIZE)
48 
49 /* Read single byte from device address into byte (CMD52) */
50 static int ks7010_sdio_readb(struct ks_wlan_private *priv, unsigned int address,
51 			     unsigned char *byte)
52 {
53 	struct sdio_func *func = priv->ks_sdio_card->func;
54 	int ret;
55 
56 	*byte = sdio_readb(func, address, &ret);
57 
58 	return ret;
59 }
60 
61 /* Read length bytes from device address into buffer (CMD53) */
62 static int ks7010_sdio_read(struct ks_wlan_private *priv, unsigned int address,
63 			    unsigned char *buffer, int length)
64 {
65 	struct sdio_func *func = priv->ks_sdio_card->func;
66 
67 	return sdio_memcpy_fromio(func, buffer, address, length);
68 }
69 
70 /* Write single byte to device address (CMD52) */
71 static int ks7010_sdio_writeb(struct ks_wlan_private *priv,
72 			      unsigned int address, unsigned char byte)
73 {
74 	struct sdio_func *func = priv->ks_sdio_card->func;
75 	int ret;
76 
77 	sdio_writeb(func, byte, address, &ret);
78 
79 	return ret;
80 }
81 
82 /* Write length bytes to device address from buffer (CMD53) */
83 static int ks7010_sdio_write(struct ks_wlan_private *priv, unsigned int address,
84 			     unsigned char *buffer, int length)
85 {
86 	struct sdio_func *func = priv->ks_sdio_card->func;
87 
88 	return sdio_memcpy_toio(func, address, buffer, length);
89 }
90 
91 static void ks_wlan_hw_sleep_doze_request(struct ks_wlan_private *priv)
92 {
93 	int ret;
94 
95 	DPRINTK(4, "\n");
96 
97 	/* clear request */
98 	atomic_set(&priv->sleepstatus.doze_request, 0);
99 
100 	if (atomic_read(&priv->sleepstatus.status) == 0) {
101 		ret = ks7010_sdio_writeb(priv, GCR_B, GCR_B_DOZE);
102 		if (ret) {
103 			DPRINTK(1, " error : GCR_B\n");
104 			goto set_sleep_mode;
105 		}
106 		DPRINTK(3, "sleep_mode=SLP_SLEEP\n");
107 		atomic_set(&priv->sleepstatus.status, 1);
108 		priv->last_doze = jiffies;
109 	} else {
110 		DPRINTK(1, "sleep_mode=%d\n", priv->sleep_mode);
111 	}
112 
113 set_sleep_mode:
114 	priv->sleep_mode = atomic_read(&priv->sleepstatus.status);
115 }
116 
117 static void ks_wlan_hw_sleep_wakeup_request(struct ks_wlan_private *priv)
118 {
119 	int ret;
120 
121 	DPRINTK(4, "\n");
122 
123 	/* clear request */
124 	atomic_set(&priv->sleepstatus.wakeup_request, 0);
125 
126 	if (atomic_read(&priv->sleepstatus.status) == 1) {
127 		ret = ks7010_sdio_writeb(priv, WAKEUP, WAKEUP_REQ);
128 		if (ret) {
129 			DPRINTK(1, " error : WAKEUP\n");
130 			goto set_sleep_mode;
131 		}
132 		DPRINTK(4, "wake up : WAKEUP\n");
133 		atomic_set(&priv->sleepstatus.status, 0);
134 		priv->last_wakeup = jiffies;
135 		++priv->wakeup_count;
136 	} else {
137 		DPRINTK(1, "sleep_mode=%d\n", priv->sleep_mode);
138 	}
139 
140 set_sleep_mode:
141 	priv->sleep_mode = atomic_read(&priv->sleepstatus.status);
142 }
143 
144 void ks_wlan_hw_wakeup_request(struct ks_wlan_private *priv)
145 {
146 	int ret;
147 
148 	DPRINTK(4, "\n");
149 	if (atomic_read(&priv->psstatus.status) == PS_SNOOZE) {
150 		ret = ks7010_sdio_writeb(priv, WAKEUP, WAKEUP_REQ);
151 		if (ret)
152 			DPRINTK(1, " error : WAKEUP\n");
153 		else
154 			DPRINTK(4, "wake up : WAKEUP\n");
155 
156 		priv->last_wakeup = jiffies;
157 		++priv->wakeup_count;
158 	} else {
159 		DPRINTK(1, "psstatus=%d\n",
160 			atomic_read(&priv->psstatus.status));
161 	}
162 }
163 
164 static void _ks_wlan_hw_power_save(struct ks_wlan_private *priv)
165 {
166 	unsigned char byte;
167 	int ret;
168 
169 	if (priv->reg.power_mgmt == POWER_MGMT_ACTIVE)
170 		return;
171 
172 	if (priv->reg.operation_mode != MODE_INFRASTRUCTURE)
173 		return;
174 
175 	if (!is_connect_status(priv->connect_status))
176 		return;
177 
178 	if (priv->dev_state != DEVICE_STATE_SLEEP)
179 		return;
180 
181 	if (atomic_read(&priv->psstatus.status) == PS_SNOOZE)
182 		return;
183 
184 	DPRINTK(5, "\npsstatus.status=%d\npsstatus.confirm_wait=%d\npsstatus.snooze_guard=%d\ncnt_txqbody=%d\n",
185 		atomic_read(&priv->psstatus.status),
186 		atomic_read(&priv->psstatus.confirm_wait),
187 		atomic_read(&priv->psstatus.snooze_guard),
188 		cnt_txqbody(priv));
189 
190 	if (atomic_read(&priv->psstatus.confirm_wait) ||
191 	    atomic_read(&priv->psstatus.snooze_guard) ||
192 	    cnt_txqbody(priv)) {
193 		queue_delayed_work(priv->wq, &priv->rw_dwork, 0);
194 		return;
195 	}
196 
197 	ret = ks7010_sdio_readb(priv, INT_PENDING, &byte);
198 	if (ret) {
199 		DPRINTK(1, " error : INT_PENDING\n");
200 		goto queue_delayed_work;
201 	}
202 	if (byte)
203 		goto queue_delayed_work;
204 
205 	ret = ks7010_sdio_writeb(priv, GCR_B, GCR_B_DOZE);
206 	if (ret) {
207 		DPRINTK(1, " error : GCR_B\n");
208 		goto queue_delayed_work;
209 	}
210 	atomic_set(&priv->psstatus.status, PS_SNOOZE);
211 	DPRINTK(3, "psstatus.status=PS_SNOOZE\n");
212 
213 	return;
214 
215 queue_delayed_work:
216 	queue_delayed_work(priv->wq, &priv->rw_dwork, 1);
217 }
218 
219 int ks_wlan_hw_power_save(struct ks_wlan_private *priv)
220 {
221 	queue_delayed_work(priv->wq, &priv->rw_dwork, 1);
222 	return 0;
223 }
224 
225 static int enqueue_txdev(struct ks_wlan_private *priv, unsigned char *p,
226 			 unsigned long size,
227 			 void (*complete_handler)(struct ks_wlan_private *priv,
228 						  struct sk_buff *skb),
229 			 struct sk_buff *skb)
230 {
231 	struct tx_device_buffer *sp;
232 	int ret;
233 
234 	if (priv->dev_state < DEVICE_STATE_BOOT) {
235 		ret = -EPERM;
236 		goto err_complete;
237 	}
238 
239 	if ((TX_DEVICE_BUFF_SIZE - 1) <= cnt_txqbody(priv)) {
240 		DPRINTK(1, "tx buffer overflow\n");
241 		ret = -EOVERFLOW;
242 		goto err_complete;
243 	}
244 
245 	sp = &priv->tx_dev.tx_dev_buff[priv->tx_dev.qtail];
246 	sp->sendp = p;
247 	sp->size = size;
248 	sp->complete_handler = complete_handler;
249 	sp->skb = skb;
250 	inc_txqtail(priv);
251 
252 	return 0;
253 
254 err_complete:
255 	kfree(p);
256 	if (complete_handler)
257 		(*complete_handler)(priv, skb);
258 
259 	return ret;
260 }
261 
262 /* write data */
263 static int write_to_device(struct ks_wlan_private *priv, unsigned char *buffer,
264 			   unsigned long size)
265 {
266 	struct hostif_hdr *hdr;
267 	int ret;
268 
269 	hdr = (struct hostif_hdr *)buffer;
270 
271 	DPRINTK(4, "size=%d\n", hdr->size);
272 	if (le16_to_cpu(hdr->event) < HIF_DATA_REQ ||
273 	    le16_to_cpu(hdr->event) > HIF_REQ_MAX) {
274 		DPRINTK(1, "unknown event=%04X\n", hdr->event);
275 		return 0;
276 	}
277 
278 	ret = ks7010_sdio_write(priv, DATA_WINDOW, buffer, size);
279 	if (ret) {
280 		DPRINTK(1, " write error : retval=%d\n", ret);
281 		return ret;
282 	}
283 
284 	ret = ks7010_sdio_writeb(priv, WRITE_STATUS, REG_STATUS_BUSY);
285 	if (ret) {
286 		DPRINTK(1, " error : WRITE_STATUS\n");
287 		return ret;
288 	}
289 
290 	return 0;
291 }
292 
293 static void tx_device_task(struct ks_wlan_private *priv)
294 {
295 	struct tx_device_buffer *sp;
296 	int ret;
297 
298 	DPRINTK(4, "\n");
299 	if (cnt_txqbody(priv) <= 0 ||
300 	    atomic_read(&priv->psstatus.status) == PS_SNOOZE)
301 		return;
302 
303 	sp = &priv->tx_dev.tx_dev_buff[priv->tx_dev.qhead];
304 	if (priv->dev_state >= DEVICE_STATE_BOOT) {
305 		ret = write_to_device(priv, sp->sendp, sp->size);
306 		if (ret) {
307 			DPRINTK(1, "write_to_device error !!(%d)\n", ret);
308 			queue_delayed_work(priv->wq, &priv->rw_dwork, 1);
309 			return;
310 		}
311 	}
312 	kfree(sp->sendp);
313 	if (sp->complete_handler)	/* TX Complete */
314 		(*sp->complete_handler)(priv, sp->skb);
315 	inc_txqhead(priv);
316 
317 	if (cnt_txqbody(priv) > 0)
318 		queue_delayed_work(priv->wq, &priv->rw_dwork, 0);
319 }
320 
321 int ks_wlan_hw_tx(struct ks_wlan_private *priv, void *p, unsigned long size,
322 		  void (*complete_handler)(struct ks_wlan_private *priv,
323 					   struct sk_buff *skb),
324 		  struct sk_buff *skb)
325 {
326 	int result = 0;
327 	struct hostif_hdr *hdr;
328 
329 	hdr = (struct hostif_hdr *)p;
330 
331 	if (le16_to_cpu(hdr->event) < HIF_DATA_REQ ||
332 	    le16_to_cpu(hdr->event) > HIF_REQ_MAX) {
333 		DPRINTK(1, "unknown event=%04X\n", hdr->event);
334 		return 0;
335 	}
336 
337 	/* add event to hostt buffer */
338 	priv->hostt.buff[priv->hostt.qtail] = le16_to_cpu(hdr->event);
339 	priv->hostt.qtail = (priv->hostt.qtail + 1) % SME_EVENT_BUFF_SIZE;
340 
341 	DPRINTK(4, "event=%04X\n", hdr->event);
342 	spin_lock(&priv->tx_dev.tx_dev_lock);
343 	result = enqueue_txdev(priv, p, size, complete_handler, skb);
344 	spin_unlock(&priv->tx_dev.tx_dev_lock);
345 
346 	if (cnt_txqbody(priv) > 0)
347 		queue_delayed_work(priv->wq, &priv->rw_dwork, 0);
348 
349 	return result;
350 }
351 
352 static void rx_event_task(unsigned long dev)
353 {
354 	struct ks_wlan_private *priv = (struct ks_wlan_private *)dev;
355 	struct rx_device_buffer *rp;
356 
357 	DPRINTK(4, "\n");
358 
359 	if (cnt_rxqbody(priv) > 0 && priv->dev_state >= DEVICE_STATE_BOOT) {
360 		rp = &priv->rx_dev.rx_dev_buff[priv->rx_dev.qhead];
361 		hostif_receive(priv, rp->data, rp->size);
362 		inc_rxqhead(priv);
363 
364 		if (cnt_rxqbody(priv) > 0)
365 			tasklet_schedule(&priv->rx_bh_task);
366 	}
367 }
368 
369 static void ks_wlan_hw_rx(struct ks_wlan_private *priv, uint16_t size)
370 {
371 	int ret;
372 	struct rx_device_buffer *rx_buffer;
373 	struct hostif_hdr *hdr;
374 	unsigned short event = 0;
375 
376 	DPRINTK(4, "\n");
377 
378 	/* receive data */
379 	if (cnt_rxqbody(priv) >= (RX_DEVICE_BUFF_SIZE - 1)) {
380 		DPRINTK(1, "rx buffer overflow\n");
381 		return;
382 	}
383 	rx_buffer = &priv->rx_dev.rx_dev_buff[priv->rx_dev.qtail];
384 
385 	ret = ks7010_sdio_read(priv, DATA_WINDOW, &rx_buffer->data[0],
386 			       hif_align_size(size));
387 	if (ret)
388 		return;
389 
390 	/* length check */
391 	if (size > 2046 || size == 0) {
392 #ifdef KS_WLAN_DEBUG
393 		if (KS_WLAN_DEBUG > 5)
394 			print_hex_dump_bytes("INVALID DATA dump: ",
395 					     DUMP_PREFIX_OFFSET,
396 					     rx_buffer->data, 32);
397 #endif
398 		ret = ks7010_sdio_writeb(priv, READ_STATUS, REG_STATUS_IDLE);
399 		if (ret)
400 			DPRINTK(1, " error : READ_STATUS\n");
401 
402 		/* length check fail */
403 		return;
404 	}
405 
406 	hdr = (struct hostif_hdr *)&rx_buffer->data[0];
407 	rx_buffer->size = le16_to_cpu(hdr->size) + sizeof(hdr->size);
408 	event = le16_to_cpu(hdr->event);
409 	inc_rxqtail(priv);
410 
411 	ret = ks7010_sdio_writeb(priv, READ_STATUS, REG_STATUS_IDLE);
412 	if (ret)
413 		DPRINTK(1, " error : READ_STATUS\n");
414 
415 	if (atomic_read(&priv->psstatus.confirm_wait)) {
416 		if (IS_HIF_CONF(event)) {
417 			DPRINTK(4, "IS_HIF_CONF true !!\n");
418 			atomic_dec(&priv->psstatus.confirm_wait);
419 		}
420 	}
421 
422 	tasklet_schedule(&priv->rx_bh_task);
423 }
424 
425 static void ks7010_rw_function(struct work_struct *work)
426 {
427 	struct ks_wlan_private *priv;
428 	unsigned char byte;
429 	int ret;
430 
431 	priv = container_of(work, struct ks_wlan_private, rw_dwork.work);
432 
433 	DPRINTK(4, "\n");
434 
435 	/* wait after DOZE */
436 	if (time_after(priv->last_doze + ((30 * HZ) / 1000), jiffies)) {
437 		DPRINTK(4, "wait after DOZE\n");
438 		queue_delayed_work(priv->wq, &priv->rw_dwork, 1);
439 		return;
440 	}
441 
442 	/* wait after WAKEUP */
443 	while (time_after(priv->last_wakeup + ((30 * HZ) / 1000), jiffies)) {
444 		DPRINTK(4, "wait after WAKEUP\n");
445 		dev_info(&priv->ks_sdio_card->func->dev,
446 			 "wake: %lu %lu\n",
447 			 priv->last_wakeup + (30 * HZ) / 1000,
448 				jiffies);
449 		msleep(30);
450 	}
451 
452 	sdio_claim_host(priv->ks_sdio_card->func);
453 
454 	/* power save wakeup */
455 	if (atomic_read(&priv->psstatus.status) == PS_SNOOZE) {
456 		if (cnt_txqbody(priv) > 0) {
457 			ks_wlan_hw_wakeup_request(priv);
458 			queue_delayed_work(priv->wq, &priv->rw_dwork, 1);
459 		}
460 		goto release_host;
461 	}
462 
463 	/* sleep mode doze */
464 	if (atomic_read(&priv->sleepstatus.doze_request) == 1) {
465 		ks_wlan_hw_sleep_doze_request(priv);
466 		goto release_host;
467 	}
468 	/* sleep mode wakeup */
469 	if (atomic_read(&priv->sleepstatus.wakeup_request) == 1) {
470 		ks_wlan_hw_sleep_wakeup_request(priv);
471 		goto release_host;
472 	}
473 
474 	/* read (WriteStatus/ReadDataSize FN1:00_0014) */
475 	ret = ks7010_sdio_readb(priv, WSTATUS_RSIZE, &byte);
476 	if (ret) {
477 		DPRINTK(1, " error : WSTATUS_RSIZE psstatus=%d\n",
478 			atomic_read(&priv->psstatus.status));
479 		goto release_host;
480 	}
481 	DPRINTK(4, "WSTATUS_RSIZE=%02X\n", byte);
482 
483 	if (byte & RSIZE_MASK) {	/* Read schedule */
484 		ks_wlan_hw_rx(priv, (uint16_t)((byte & RSIZE_MASK) << 4));
485 	}
486 	if ((byte & WSTATUS_MASK))
487 		tx_device_task(priv);
488 
489 	_ks_wlan_hw_power_save(priv);
490 
491 release_host:
492 	sdio_release_host(priv->ks_sdio_card->func);
493 }
494 
495 static void ks_sdio_interrupt(struct sdio_func *func)
496 {
497 	int ret;
498 	struct ks_sdio_card *card;
499 	struct ks_wlan_private *priv;
500 	unsigned char status, rsize, byte;
501 
502 	card = sdio_get_drvdata(func);
503 	priv = card->priv;
504 	DPRINTK(4, "\n");
505 
506 	if (priv->dev_state < DEVICE_STATE_BOOT)
507 		goto queue_delayed_work;
508 
509 	ret = ks7010_sdio_readb(priv, INT_PENDING, &status);
510 	if (ret) {
511 		DPRINTK(1, "error : INT_PENDING\n");
512 		goto queue_delayed_work;
513 	}
514 	DPRINTK(4, "INT_PENDING=%02X\n", status);
515 
516 	/* schedule task for interrupt status */
517 	/* bit7 -> Write General Communication B register */
518 	/* read (General Communication B register) */
519 	/* bit5 -> Write Status Idle */
520 	/* bit2 -> Read Status Busy  */
521 	if (status & INT_GCR_B ||
522 	    atomic_read(&priv->psstatus.status) == PS_SNOOZE) {
523 		ret = ks7010_sdio_readb(priv, GCR_B, &byte);
524 		if (ret) {
525 			DPRINTK(1, " error : GCR_B\n");
526 			goto queue_delayed_work;
527 		}
528 		if (byte == GCR_B_ACTIVE) {
529 			if (atomic_read(&priv->psstatus.status) == PS_SNOOZE) {
530 				atomic_set(&priv->psstatus.status, PS_WAKEUP);
531 				priv->wakeup_count = 0;
532 			}
533 			complete(&priv->psstatus.wakeup_wait);
534 		}
535 	}
536 
537 	do {
538 		/* read (WriteStatus/ReadDataSize FN1:00_0014) */
539 		ret = ks7010_sdio_readb(priv, WSTATUS_RSIZE, &byte);
540 		if (ret) {
541 			DPRINTK(1, " error : WSTATUS_RSIZE\n");
542 			goto queue_delayed_work;
543 		}
544 		DPRINTK(4, "WSTATUS_RSIZE=%02X\n", byte);
545 		rsize = byte & RSIZE_MASK;
546 		if (rsize != 0)		/* Read schedule */
547 			ks_wlan_hw_rx(priv, (uint16_t)(rsize << 4));
548 
549 		if (byte & WSTATUS_MASK) {
550 			if (atomic_read(&priv->psstatus.status) == PS_SNOOZE) {
551 				if (cnt_txqbody(priv)) {
552 					ks_wlan_hw_wakeup_request(priv);
553 					queue_delayed_work(priv->wq, &priv->rw_dwork, 1);
554 					return;
555 				}
556 			} else {
557 				tx_device_task(priv);
558 			}
559 		}
560 	} while (rsize);
561 
562 queue_delayed_work:
563 	queue_delayed_work(priv->wq, &priv->rw_dwork, 0);
564 }
565 
566 static int trx_device_init(struct ks_wlan_private *priv)
567 {
568 	priv->tx_dev.qhead = 0;
569 	priv->tx_dev.qtail = 0;
570 
571 	priv->rx_dev.qhead = 0;
572 	priv->rx_dev.qtail = 0;
573 
574 	spin_lock_init(&priv->tx_dev.tx_dev_lock);
575 	spin_lock_init(&priv->rx_dev.rx_dev_lock);
576 
577 	tasklet_init(&priv->rx_bh_task, rx_event_task, (unsigned long)priv);
578 
579 	return 0;
580 }
581 
582 static void trx_device_exit(struct ks_wlan_private *priv)
583 {
584 	struct tx_device_buffer *sp;
585 
586 	/* tx buffer clear */
587 	while (cnt_txqbody(priv) > 0) {
588 		sp = &priv->tx_dev.tx_dev_buff[priv->tx_dev.qhead];
589 		kfree(sp->sendp);
590 		if (sp->complete_handler)	/* TX Complete */
591 			(*sp->complete_handler)(priv, sp->skb);
592 		inc_txqhead(priv);
593 	}
594 
595 	tasklet_kill(&priv->rx_bh_task);
596 }
597 
598 static int ks7010_sdio_update_index(struct ks_wlan_private *priv, u32 index)
599 {
600 	int ret;
601 	unsigned char *data_buf;
602 
603 	data_buf = kmalloc(sizeof(u32), GFP_KERNEL);
604 	if (!data_buf)
605 		return -ENOMEM;
606 
607 	memcpy(data_buf, &index, sizeof(index));
608 	ret = ks7010_sdio_write(priv, WRITE_INDEX, data_buf, sizeof(index));
609 	if (ret)
610 		goto err_free_data_buf;
611 
612 	ret = ks7010_sdio_write(priv, READ_INDEX, data_buf, sizeof(index));
613 	if (ret)
614 		goto err_free_data_buf;
615 
616 	return 0;
617 
618 err_free_data_buf:
619 	kfree(data_buf);
620 
621 	return ret;
622 }
623 
624 #define ROM_BUFF_SIZE (64 * 1024)
625 static int ks7010_sdio_data_compare(struct ks_wlan_private *priv, u32 address,
626 				    unsigned char *data, unsigned int size)
627 {
628 	int ret;
629 	unsigned char *read_buf;
630 
631 	read_buf = kmalloc(ROM_BUFF_SIZE, GFP_KERNEL);
632 	if (!read_buf)
633 		return -ENOMEM;
634 
635 	ret = ks7010_sdio_read(priv, address, read_buf, size);
636 	if (ret)
637 		goto err_free_read_buf;
638 
639 	if (memcmp(data, read_buf, size) != 0) {
640 		ret = -EIO;
641 		DPRINTK(0, "data compare error (%d)\n", ret);
642 		goto err_free_read_buf;
643 	}
644 
645 	return 0;
646 
647 err_free_read_buf:
648 	kfree(read_buf);
649 
650 	return ret;
651 }
652 
653 static int ks7010_upload_firmware(struct ks_sdio_card *card)
654 {
655 	struct ks_wlan_private *priv = card->priv;
656 	unsigned int size, offset, n = 0;
657 	unsigned char *rom_buf;
658 	unsigned char byte = 0;
659 	int ret;
660 	unsigned int length;
661 	const struct firmware *fw_entry = NULL;
662 
663 	rom_buf = kmalloc(ROM_BUFF_SIZE, GFP_KERNEL);
664 	if (!rom_buf)
665 		return -ENOMEM;
666 
667 	sdio_claim_host(card->func);
668 
669 	/* Firmware running ? */
670 	ret = ks7010_sdio_readb(priv, GCR_A, &byte);
671 	if (byte == GCR_A_RUN) {
672 		DPRINTK(0, "MAC firmware running ...\n");
673 		goto release_host_and_free;
674 	}
675 
676 	ret = request_firmware(&fw_entry, ROM_FILE,
677 			       &priv->ks_sdio_card->func->dev);
678 	if (ret)
679 		goto release_host_and_free;
680 
681 	length = fw_entry->size;
682 
683 	n = 0;
684 	do {
685 		if (length >= ROM_BUFF_SIZE) {
686 			size = ROM_BUFF_SIZE;
687 			length = length - ROM_BUFF_SIZE;
688 		} else {
689 			size = length;
690 			length = 0;
691 		}
692 		DPRINTK(4, "size = %d\n", size);
693 		if (size == 0)
694 			break;
695 		memcpy(rom_buf, fw_entry->data + n, size);
696 
697 		offset = n;
698 		ret = ks7010_sdio_update_index(priv, KS7010_IRAM_ADDRESS + offset);
699 		if (ret)
700 			goto release_firmware;
701 
702 		ret = ks7010_sdio_write(priv, DATA_WINDOW, rom_buf, size);
703 		if (ret)
704 			goto release_firmware;
705 
706 		ret = ks7010_sdio_data_compare(priv, DATA_WINDOW, rom_buf, size);
707 		if (ret)
708 			goto release_firmware;
709 
710 		n += size;
711 
712 	} while (size);
713 
714 	ret = ks7010_sdio_writeb(priv, GCR_A, GCR_A_REMAP);
715 	if (ret)
716 		goto release_firmware;
717 
718 	DPRINTK(4, " REMAP Request : GCR_A\n");
719 
720 	/* Firmware running check */
721 	for (n = 0; n < 50; ++n) {
722 		mdelay(10);	/* wait_ms(10); */
723 		ret = ks7010_sdio_readb(priv, GCR_A, &byte);
724 		if (ret)
725 			goto release_firmware;
726 
727 		if (byte == GCR_A_RUN)
728 			break;
729 	}
730 	DPRINTK(4, "firmware wakeup (%d)!!!!\n", n);
731 	if ((50) <= n) {
732 		DPRINTK(1, "firmware can't start\n");
733 		ret = -EIO;
734 		goto release_firmware;
735 	}
736 
737 	ret = 0;
738 
739  release_firmware:
740 	release_firmware(fw_entry);
741  release_host_and_free:
742 	sdio_release_host(card->func);
743 	kfree(rom_buf);
744 
745 	return ret;
746 }
747 
748 static void ks7010_card_init(struct ks_wlan_private *priv)
749 {
750 	DPRINTK(5, "\ncard_init_task()\n");
751 
752 	init_completion(&priv->confirm_wait);
753 
754 	DPRINTK(5, "init_completion()\n");
755 
756 	/* get mac address & firmware version */
757 	hostif_sme_enqueue(priv, SME_START);
758 
759 	DPRINTK(5, "hostif_sme_enqueu()\n");
760 
761 	if (!wait_for_completion_interruptible_timeout
762 	    (&priv->confirm_wait, 5 * HZ)) {
763 		DPRINTK(1, "wait time out!! SME_START\n");
764 	}
765 
766 	if (priv->mac_address_valid && priv->version_size != 0)
767 		priv->dev_state = DEVICE_STATE_PREINIT;
768 
769 	hostif_sme_enqueue(priv, SME_GET_EEPROM_CKSUM);
770 
771 	/* load initial wireless parameter */
772 	hostif_sme_enqueue(priv, SME_STOP_REQUEST);
773 
774 	hostif_sme_enqueue(priv, SME_RTS_THRESHOLD_REQUEST);
775 	hostif_sme_enqueue(priv, SME_FRAGMENTATION_THRESHOLD_REQUEST);
776 
777 	hostif_sme_enqueue(priv, SME_WEP_INDEX_REQUEST);
778 	hostif_sme_enqueue(priv, SME_WEP_KEY1_REQUEST);
779 	hostif_sme_enqueue(priv, SME_WEP_KEY2_REQUEST);
780 	hostif_sme_enqueue(priv, SME_WEP_KEY3_REQUEST);
781 	hostif_sme_enqueue(priv, SME_WEP_KEY4_REQUEST);
782 
783 	hostif_sme_enqueue(priv, SME_WEP_FLAG_REQUEST);
784 	hostif_sme_enqueue(priv, SME_RSN_ENABLED_REQUEST);
785 	hostif_sme_enqueue(priv, SME_MODE_SET_REQUEST);
786 	hostif_sme_enqueue(priv, SME_START_REQUEST);
787 
788 	if (!wait_for_completion_interruptible_timeout
789 	    (&priv->confirm_wait, 5 * HZ)) {
790 		DPRINTK(1, "wait time out!! wireless parameter set\n");
791 	}
792 
793 	if (priv->dev_state >= DEVICE_STATE_PREINIT) {
794 		DPRINTK(1, "DEVICE READY!!\n");
795 		priv->dev_state = DEVICE_STATE_READY;
796 	} else {
797 		DPRINTK(1, "dev_state=%d\n", priv->dev_state);
798 	}
799 }
800 
801 static void ks7010_init_defaults(struct ks_wlan_private *priv)
802 {
803 	priv->reg.tx_rate = TX_RATE_AUTO;
804 	priv->reg.preamble = LONG_PREAMBLE;
805 	priv->reg.power_mgmt = POWER_MGMT_ACTIVE;
806 	priv->reg.scan_type = ACTIVE_SCAN;
807 	priv->reg.beacon_lost_count = 20;
808 	priv->reg.rts = 2347UL;
809 	priv->reg.fragment = 2346UL;
810 	priv->reg.phy_type = D_11BG_COMPATIBLE_MODE;
811 	priv->reg.cts_mode = CTS_MODE_FALSE;
812 	priv->reg.rate_set.body[11] = TX_RATE_54M;
813 	priv->reg.rate_set.body[10] = TX_RATE_48M;
814 	priv->reg.rate_set.body[9] = TX_RATE_36M;
815 	priv->reg.rate_set.body[8] = TX_RATE_18M;
816 	priv->reg.rate_set.body[7] = TX_RATE_9M;
817 	priv->reg.rate_set.body[6] = TX_RATE_24M | BASIC_RATE;
818 	priv->reg.rate_set.body[5] = TX_RATE_12M | BASIC_RATE;
819 	priv->reg.rate_set.body[4] = TX_RATE_6M | BASIC_RATE;
820 	priv->reg.rate_set.body[3] = TX_RATE_11M | BASIC_RATE;
821 	priv->reg.rate_set.body[2] = TX_RATE_5M | BASIC_RATE;
822 	priv->reg.rate_set.body[1] = TX_RATE_2M | BASIC_RATE;
823 	priv->reg.rate_set.body[0] = TX_RATE_1M | BASIC_RATE;
824 	priv->reg.tx_rate = TX_RATE_FULL_AUTO;
825 	priv->reg.rate_set.size = 12;
826 }
827 
828 static int ks7010_sdio_probe(struct sdio_func *func,
829 			     const struct sdio_device_id *device)
830 {
831 	struct ks_wlan_private *priv;
832 	struct ks_sdio_card *card;
833 	struct net_device *netdev;
834 	unsigned char byte;
835 	int ret;
836 
837 	priv = NULL;
838 	netdev = NULL;
839 
840 	card = kzalloc(sizeof(*card), GFP_KERNEL);
841 	if (!card)
842 		return -ENOMEM;
843 
844 	card->func = func;
845 
846 	sdio_claim_host(func);
847 
848 	ret = sdio_set_block_size(func, KS7010_IO_BLOCK_SIZE);
849 	DPRINTK(5, "multi_block=%d sdio_set_block_size()=%d %d\n",
850 		func->card->cccr.multi_block, func->cur_blksize, ret);
851 
852 	ret = sdio_enable_func(func);
853 	DPRINTK(5, "sdio_enable_func() %d\n", ret);
854 	if (ret)
855 		goto err_free_card;
856 
857 	/* interrupt disable */
858 	sdio_writeb(func, 0, INT_ENABLE, &ret);
859 	if (ret)
860 		goto err_free_card;
861 	sdio_writeb(func, 0xff, INT_PENDING, &ret);
862 	if (ret)
863 		goto err_disable_func;
864 
865 	/* setup interrupt handler */
866 	ret = sdio_claim_irq(func, ks_sdio_interrupt);
867 	if (ret)
868 		goto err_disable_func;
869 
870 	sdio_release_host(func);
871 
872 	sdio_set_drvdata(func, card);
873 
874 	DPRINTK(5, "class = 0x%X, vendor = 0x%X, device = 0x%X\n",
875 		func->class, func->vendor, func->device);
876 
877 	/* private memory allocate */
878 	netdev = alloc_etherdev(sizeof(*priv));
879 	if (!netdev) {
880 		dev_err(&card->func->dev, "ks7010 : Unable to alloc new net device\n");
881 		goto err_release_irq;
882 	}
883 	if (dev_alloc_name(netdev, "wlan%d") < 0) {
884 		dev_err(&card->func->dev,
885 			"ks7010 :  Couldn't get name!\n");
886 		goto err_free_netdev;
887 	}
888 
889 	priv = netdev_priv(netdev);
890 
891 	card->priv = priv;
892 	SET_NETDEV_DEV(netdev, &card->func->dev);	/* for create sysfs symlinks */
893 
894 	/* private memory initialize */
895 	priv->ks_sdio_card = card;
896 
897 	priv->dev_state = DEVICE_STATE_PREBOOT;
898 	priv->net_dev = netdev;
899 	priv->firmware_version[0] = '\0';
900 	priv->version_size = 0;
901 	priv->last_doze = jiffies;
902 	priv->last_wakeup = jiffies;
903 	memset(&priv->nstats, 0, sizeof(priv->nstats));
904 	memset(&priv->wstats, 0, sizeof(priv->wstats));
905 
906 	/* sleep mode */
907 	atomic_set(&priv->sleepstatus.doze_request, 0);
908 	atomic_set(&priv->sleepstatus.wakeup_request, 0);
909 	atomic_set(&priv->sleepstatus.wakeup_request, 0);
910 
911 	trx_device_init(priv);
912 	hostif_init(priv);
913 	ks_wlan_net_start(netdev);
914 
915 	ks7010_init_defaults(priv);
916 
917 	ret = ks7010_upload_firmware(card);
918 	if (ret) {
919 		dev_err(&card->func->dev,
920 			"ks7010: firmware load failed !! return code = %d\n",
921 			 ret);
922 		goto err_free_netdev;
923 	}
924 
925 	/* interrupt setting */
926 	/* clear Interrupt status write (ARMtoSD_InterruptPending FN1:00_0024) */
927 	sdio_claim_host(func);
928 	ret = ks7010_sdio_writeb(priv, INT_PENDING, 0xff);
929 	sdio_release_host(func);
930 	if (ret)
931 		DPRINTK(1, " error : INT_PENDING\n");
932 
933 	/* enable ks7010sdio interrupt */
934 	byte = (INT_GCR_B | INT_READ_STATUS | INT_WRITE_STATUS);
935 	sdio_claim_host(func);
936 	ret = ks7010_sdio_writeb(priv, INT_ENABLE, byte);
937 	sdio_release_host(func);
938 	if (ret)
939 		DPRINTK(1, " err : INT_ENABLE\n");
940 
941 	DPRINTK(4, " enable Interrupt : INT_ENABLE=%02X\n", byte);
942 	priv->dev_state = DEVICE_STATE_BOOT;
943 
944 	priv->wq = create_workqueue("wq");
945 	if (!priv->wq) {
946 		DPRINTK(1, "create_workqueue failed !!\n");
947 		goto err_free_netdev;
948 	}
949 
950 	INIT_DELAYED_WORK(&priv->rw_dwork, ks7010_rw_function);
951 	ks7010_card_init(priv);
952 
953 	ret = register_netdev(priv->net_dev);
954 	if (ret)
955 		goto err_free_netdev;
956 
957 	return 0;
958 
959  err_free_netdev:
960 	free_netdev(priv->net_dev);
961 	card->priv = NULL;
962  err_release_irq:
963 	sdio_claim_host(func);
964 	sdio_release_irq(func);
965  err_disable_func:
966 	sdio_disable_func(func);
967  err_free_card:
968 	sdio_release_host(func);
969 	sdio_set_drvdata(func, NULL);
970 	kfree(card);
971 
972 	return -ENODEV;
973 }
974 
975 /* send stop request to MAC */
976 static int send_stop_request(struct sdio_func *func)
977 {
978 	struct hostif_stop_request_t *pp;
979 	struct ks_sdio_card *card;
980 	size_t size;
981 
982 	card = sdio_get_drvdata(func);
983 
984 	pp = kzalloc(hif_align_size(sizeof(*pp)), GFP_KERNEL);
985 	if (!pp) {
986 		DPRINTK(3, "allocate memory failed..\n");
987 		return -ENOMEM;
988 	}
989 
990 	size = sizeof(*pp) - sizeof(pp->header.size);
991 	pp->header.size = cpu_to_le16((uint16_t)size);
992 	pp->header.event = cpu_to_le16((uint16_t)HIF_STOP_REQ);
993 
994 	sdio_claim_host(func);
995 	write_to_device(card->priv, (unsigned char *)pp,
996 			hif_align_size(sizeof(*pp)));
997 	sdio_release_host(func);
998 
999 	kfree(pp);
1000 	return 0;
1001 }
1002 
1003 static void ks7010_sdio_remove(struct sdio_func *func)
1004 {
1005 	int ret;
1006 	struct ks_sdio_card *card;
1007 	struct ks_wlan_private *priv;
1008 
1009 	card = sdio_get_drvdata(func);
1010 
1011 	if (!card)
1012 		return;
1013 
1014 	DPRINTK(1, "priv = card->priv\n");
1015 	priv = card->priv;
1016 	if (priv) {
1017 		struct net_device *netdev = priv->net_dev;
1018 
1019 		ks_wlan_net_stop(netdev);
1020 		DPRINTK(1, "ks_wlan_net_stop\n");
1021 
1022 		/* interrupt disable */
1023 		sdio_claim_host(func);
1024 		sdio_writeb(func, 0, INT_ENABLE, &ret);
1025 		sdio_writeb(func, 0xff, INT_PENDING, &ret);
1026 		sdio_release_host(func);
1027 		DPRINTK(1, "interrupt disable\n");
1028 
1029 		ret = send_stop_request(func);
1030 		if (ret)	/* memory allocation failure */
1031 			return;
1032 
1033 		DPRINTK(1, "STOP Req\n");
1034 
1035 		if (priv->wq) {
1036 			flush_workqueue(priv->wq);
1037 			destroy_workqueue(priv->wq);
1038 		}
1039 		DPRINTK(1, "destroy_workqueue(priv->wq);\n");
1040 
1041 		hostif_exit(priv);
1042 		DPRINTK(1, "hostif_exit\n");
1043 
1044 		unregister_netdev(netdev);
1045 
1046 		trx_device_exit(priv);
1047 		free_netdev(priv->net_dev);
1048 		card->priv = NULL;
1049 	}
1050 
1051 	sdio_claim_host(func);
1052 	sdio_release_irq(func);
1053 	DPRINTK(1, "sdio_release_irq()\n");
1054 	sdio_disable_func(func);
1055 	DPRINTK(1, "sdio_disable_func()\n");
1056 	sdio_release_host(func);
1057 
1058 	sdio_set_drvdata(func, NULL);
1059 
1060 	kfree(card);
1061 	DPRINTK(1, "kfree()\n");
1062 
1063 	DPRINTK(5, " Bye !!\n");
1064 }
1065 
1066 static struct sdio_driver ks7010_sdio_driver = {
1067 	.name = "ks7010_sdio",
1068 	.id_table = ks7010_sdio_ids,
1069 	.probe = ks7010_sdio_probe,
1070 	.remove = ks7010_sdio_remove,
1071 };
1072 
1073 module_driver(ks7010_sdio_driver, sdio_register_driver, sdio_unregister_driver);
1074 MODULE_AUTHOR("Sang Engineering, Qi-Hardware, KeyStream");
1075 MODULE_DESCRIPTION("Driver for KeyStream KS7010 based SDIO cards");
1076 MODULE_LICENSE("GPL v2");
1077 MODULE_FIRMWARE(ROM_FILE);
1078