drivers/net/wireless/brcm80211/brcmfmac/usb.c

   1 /*
   2  * Copyright (c) 2011 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/kernel.h>
  18 #include <linux/module.h>
  19 #include <linux/firmware.h>
  20 #include <linux/usb.h>
  21 #include <linux/vmalloc.h>
  22
  23 #include <brcmu_utils.h>
  24 #include <brcmu_wifi.h>
  25 #include <dhd_bus.h>
  26 #include <dhd_dbg.h>
  27
  28 #include "usb_rdl.h"
  29 #include "usb.h"
  30
  31 #define IOCTL_RESP_TIMEOUT  2000
  32
  33 #define BRCMF_USB_RESET_GETVER_SPINWAIT 100     /* in unit of ms */
  34 #define BRCMF_USB_RESET_GETVER_LOOP_CNT 10
  35
  36 #define BRCMF_POSTBOOT_ID               0xA123  /* ID to detect if dongle
  37                                                    has boot up */
  38 #define BRCMF_USB_NRXQ  50
  39 #define BRCMF_USB_NTXQ  50
  40
  41 #define CONFIGDESC(usb)         (&((usb)->actconfig)->desc)
  42 #define IFPTR(usb, idx)         ((usb)->actconfig->interface[(idx)])
  43 #define IFALTS(usb, idx)        (IFPTR((usb), (idx))->altsetting[0])
  44 #define IFDESC(usb, idx)        IFALTS((usb), (idx)).desc
  45 #define IFEPDESC(usb, idx, ep)  (IFALTS((usb), (idx)).endpoint[(ep)]).desc
  46
  47 #define CONTROL_IF              0
  48 #define BULK_IF                 0
  49
  50 #define BRCMF_USB_CBCTL_WRITE   0
  51 #define BRCMF_USB_CBCTL_READ    1
  52 #define BRCMF_USB_MAX_PKT_SIZE  1600
  53
  54 #define BRCMF_USB_43143_FW_NAME "brcm/brcmfmac43143.bin"
  55 #define BRCMF_USB_43236_FW_NAME "brcm/brcmfmac43236b.bin"
  56 #define BRCMF_USB_43242_FW_NAME "brcm/brcmfmac43242a.bin"
  57
  58 struct brcmf_usb_image {
  59         struct list_head list;
  60         s8 *fwname;
  61         u8 *image;
  62         int image_len;
  63 };
  64 static struct list_head fw_image_list;
  65
  66 struct intr_transfer_buf {
  67         u32 notification;
  68         u32 reserved;
  69 };
  70
  71 struct brcmf_usbdev_info {
  72         struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
  73         spinlock_t qlock;
  74         struct list_head rx_freeq;
  75         struct list_head rx_postq;
  76         struct list_head tx_freeq;
  77         struct list_head tx_postq;
  78         uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
  79
  80         int rx_low_watermark;
  81         int tx_low_watermark;
  82         int tx_high_watermark;
  83         int tx_freecount;
  84         bool tx_flowblock;
  85
  86         struct brcmf_usbreq *tx_reqs;
  87         struct brcmf_usbreq *rx_reqs;
  88
  89         u8 *image;      /* buffer for combine fw and nvram */
  90         int image_len;
  91
  92         struct usb_device *usbdev;
  93         struct device *dev;
  94
  95         int ctl_in_pipe, ctl_out_pipe;
  96         struct urb *ctl_urb; /* URB for control endpoint */
  97         struct usb_ctrlrequest ctl_write;
  98         struct usb_ctrlrequest ctl_read;
  99         u32 ctl_urb_actual_length;
 100         int ctl_urb_status;
 101         int ctl_completed;
 102         wait_queue_head_t ioctl_resp_wait;
 103         ulong ctl_op;
 104
 105         struct urb *bulk_urb; /* used for FW download */
 106         struct urb *intr_urb; /* URB for interrupt endpoint */
 107         int intr_size;          /* Size of interrupt message */
 108         int interval;           /* Interrupt polling interval */
 109         struct intr_transfer_buf intr; /* Data buffer for interrupt endpoint */
 110 };
 111
 112 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 113                                 struct brcmf_usbreq  *req);
 114
 115 MODULE_AUTHOR("Broadcom Corporation");
 116 MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN fullmac usb driver.");
 117 MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN fullmac usb cards");
 118 MODULE_LICENSE("Dual BSD/GPL");
 119
 120 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
 121 {
 122         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
 123         return bus_if->bus_priv.usb;
 124 }
 125
 126 static struct brcmf_usbdev_info *brcmf_usb_get_businfo(struct device *dev)
 127 {
 128         return brcmf_usb_get_buspub(dev)->devinfo;
 129 }
 130
 131 static int brcmf_usb_ioctl_resp_wait(struct brcmf_usbdev_info *devinfo)
 132 {
 133         return wait_event_timeout(devinfo->ioctl_resp_wait,
 134                                   devinfo->ctl_completed,
 135                                   msecs_to_jiffies(IOCTL_RESP_TIMEOUT));
 136 }
 137
 138 static void brcmf_usb_ioctl_resp_wake(struct brcmf_usbdev_info *devinfo)
 139 {
 140         if (waitqueue_active(&devinfo->ioctl_resp_wait))
 141                 wake_up(&devinfo->ioctl_resp_wait);
 142 }
 143
 144 static void
 145 brcmf_usb_ctl_complete(struct brcmf_usbdev_info *devinfo, int type, int status)
 146 {
 147         brcmf_dbg(USB, "Enter, status=%d\n", status);
 148
 149         if (unlikely(devinfo == NULL))
 150                 return;
 151
 152         if (type == BRCMF_USB_CBCTL_READ) {
 153                 if (status == 0)
 154                         devinfo->bus_pub.stats.rx_ctlpkts++;
 155                 else
 156                         devinfo->bus_pub.stats.rx_ctlerrs++;
 157         } else if (type == BRCMF_USB_CBCTL_WRITE) {
 158                 if (status == 0)
 159                         devinfo->bus_pub.stats.tx_ctlpkts++;
 160                 else
 161                         devinfo->bus_pub.stats.tx_ctlerrs++;
 162         }
 163
 164         devinfo->ctl_urb_status = status;
 165         devinfo->ctl_completed = true;
 166         brcmf_usb_ioctl_resp_wake(devinfo);
 167 }
 168
 169 static void
 170 brcmf_usb_ctlread_complete(struct urb *urb)
 171 {
 172         struct brcmf_usbdev_info *devinfo =
 173                 (struct brcmf_usbdev_info *)urb->context;
 174
 175         brcmf_dbg(USB, "Enter\n");
 176         devinfo->ctl_urb_actual_length = urb->actual_length;
 177         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_READ,
 178                 urb->status);
 179 }
 180
 181 static void
 182 brcmf_usb_ctlwrite_complete(struct urb *urb)
 183 {
 184         struct brcmf_usbdev_info *devinfo =
 185                 (struct brcmf_usbdev_info *)urb->context;
 186
 187         brcmf_dbg(USB, "Enter\n");
 188         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_WRITE,
 189                 urb->status);
 190 }
 191
 192 static int
 193 brcmf_usb_send_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 194 {
 195         int ret;
 196         u16 size;
 197
 198         brcmf_dbg(USB, "Enter\n");
 199         if (devinfo == NULL || buf == NULL ||
 200             len == 0 || devinfo->ctl_urb == NULL)
 201                 return -EINVAL;
 202
 203         size = len;
 204         devinfo->ctl_write.wLength = cpu_to_le16p(&size);
 205         devinfo->ctl_urb->transfer_buffer_length = size;
 206         devinfo->ctl_urb_status = 0;
 207         devinfo->ctl_urb_actual_length = 0;
 208
 209         usb_fill_control_urb(devinfo->ctl_urb,
 210                 devinfo->usbdev,
 211                 devinfo->ctl_out_pipe,
 212                 (unsigned char *) &devinfo->ctl_write,
 213                 buf, size,
 214                 (usb_complete_t)brcmf_usb_ctlwrite_complete,
 215                 devinfo);
 216
 217         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 218         if (ret < 0)
 219                 brcmf_err("usb_submit_urb failed %d\n", ret);
 220
 221         return ret;
 222 }
 223
 224 static int
 225 brcmf_usb_recv_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 226 {
 227         int ret;
 228         u16 size;
 229
 230         brcmf_dbg(USB, "Enter\n");
 231         if ((devinfo == NULL) || (buf == NULL) || (len == 0)
 232                 || (devinfo->ctl_urb == NULL))
 233                 return -EINVAL;
 234
 235         size = len;
 236         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 237         devinfo->ctl_urb->transfer_buffer_length = size;
 238
 239         devinfo->ctl_read.bRequestType = USB_DIR_IN
 240                 | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 241         devinfo->ctl_read.bRequest = 1;
 242
 243         usb_fill_control_urb(devinfo->ctl_urb,
 244                 devinfo->usbdev,
 245                 devinfo->ctl_in_pipe,
 246                 (unsigned char *) &devinfo->ctl_read,
 247                 buf, size,
 248                 (usb_complete_t)brcmf_usb_ctlread_complete,
 249                 devinfo);
 250
 251         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 252         if (ret < 0)
 253                 brcmf_err("usb_submit_urb failed %d\n", ret);
 254
 255         return ret;
 256 }
 257
 258 static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 259 {
 260         int err = 0;
 261         int timeout = 0;
 262         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 263
 264         brcmf_dbg(USB, "Enter\n");
 265         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 266                 return -EIO;
 267
 268         if (test_and_set_bit(0, &devinfo->ctl_op))
 269                 return -EIO;
 270
 271         devinfo->ctl_completed = false;
 272         err = brcmf_usb_send_ctl(devinfo, buf, len);
 273         if (err) {
 274                 brcmf_err("fail %d bytes: %d\n", err, len);
 275                 clear_bit(0, &devinfo->ctl_op);
 276                 return err;
 277         }
 278         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 279         clear_bit(0, &devinfo->ctl_op);
 280         if (!timeout) {
 281                 brcmf_err("Txctl wait timed out\n");
 282                 err = -EIO;
 283         }
 284         return err;
 285 }
 286
 287 static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 288 {
 289         int err = 0;
 290         int timeout = 0;
 291         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 292
 293         brcmf_dbg(USB, "Enter\n");
 294         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 295                 return -EIO;
 296
 297         if (test_and_set_bit(0, &devinfo->ctl_op))
 298                 return -EIO;
 299
 300         devinfo->ctl_completed = false;
 301         err = brcmf_usb_recv_ctl(devinfo, buf, len);
 302         if (err) {
 303                 brcmf_err("fail %d bytes: %d\n", err, len);
 304                 clear_bit(0, &devinfo->ctl_op);
 305                 return err;
 306         }
 307         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 308         err = devinfo->ctl_urb_status;
 309         clear_bit(0, &devinfo->ctl_op);
 310         if (!timeout) {
 311                 brcmf_err("rxctl wait timed out\n");
 312                 err = -EIO;
 313         }
 314         if (!err)
 315                 return devinfo->ctl_urb_actual_length;
 316         else
 317                 return err;
 318 }
 319
 320 static struct brcmf_usbreq *brcmf_usb_deq(struct brcmf_usbdev_info *devinfo,
 321                                           struct list_head *q, int *counter)
 322 {
 323         unsigned long flags;
 324         struct brcmf_usbreq  *req;
 325         spin_lock_irqsave(&devinfo->qlock, flags);
 326         if (list_empty(q)) {
 327                 spin_unlock_irqrestore(&devinfo->qlock, flags);
 328                 return NULL;
 329         }
 330         req = list_entry(q->next, struct brcmf_usbreq, list);
 331         list_del_init(q->next);
 332         if (counter)
 333                 (*counter)--;
 334         spin_unlock_irqrestore(&devinfo->qlock, flags);
 335         return req;
 336
 337 }
 338
 339 static void brcmf_usb_enq(struct brcmf_usbdev_info *devinfo,
 340                           struct list_head *q, struct brcmf_usbreq *req,
 341                           int *counter)
 342 {
 343         unsigned long flags;
 344         spin_lock_irqsave(&devinfo->qlock, flags);
 345         list_add_tail(&req->list, q);
 346         if (counter)
 347                 (*counter)++;
 348         spin_unlock_irqrestore(&devinfo->qlock, flags);
 349 }
 350
 351 static struct brcmf_usbreq *
 352 brcmf_usbdev_qinit(struct list_head *q, int qsize)
 353 {
 354         int i;
 355         struct brcmf_usbreq *req, *reqs;
 356
 357         reqs = kcalloc(qsize, sizeof(struct brcmf_usbreq), GFP_ATOMIC);
 358         if (reqs == NULL)
 359                 return NULL;
 360
 361         req = reqs;
 362
 363         for (i = 0; i < qsize; i++) {
 364                 req->urb = usb_alloc_urb(0, GFP_ATOMIC);
 365                 if (!req->urb)
 366                         goto fail;
 367
 368                 INIT_LIST_HEAD(&req->list);
 369                 list_add_tail(&req->list, q);
 370                 req++;
 371         }
 372         return reqs;
 373 fail:
 374         brcmf_err("fail!\n");
 375         while (!list_empty(q)) {
 376                 req = list_entry(q->next, struct brcmf_usbreq, list);
 377                 if (req && req->urb)
 378                         usb_free_urb(req->urb);
 379                 list_del(q->next);
 380         }
 381         return NULL;
 382
 383 }
 384
 385 static void brcmf_usb_free_q(struct list_head *q, bool pending)
 386 {
 387         struct brcmf_usbreq *req, *next;
 388         int i = 0;
 389         list_for_each_entry_safe(req, next, q, list) {
 390                 if (!req->urb) {
 391                         brcmf_err("bad req\n");
 392                         break;
 393                 }
 394                 i++;
 395                 if (pending) {
 396                         usb_kill_urb(req->urb);
 397                 } else {
 398                         usb_free_urb(req->urb);
 399                         list_del_init(&req->list);
 400                 }
 401         }
 402 }
 403
 404 static void brcmf_usb_del_fromq(struct brcmf_usbdev_info *devinfo,
 405                                 struct brcmf_usbreq *req)
 406 {
 407         unsigned long flags;
 408
 409         spin_lock_irqsave(&devinfo->qlock, flags);
 410         list_del_init(&req->list);
 411         spin_unlock_irqrestore(&devinfo->qlock, flags);
 412 }
 413
 414
 415 static void brcmf_usb_tx_complete(struct urb *urb)
 416 {
 417         struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
 418         struct brcmf_usbdev_info *devinfo = req->devinfo;
 419
 420         brcmf_dbg(USB, "Enter, urb->status=%d, skb=%p\n", urb->status,
 421                   req->skb);
 422         brcmf_usb_del_fromq(devinfo, req);
 423
 424         brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
 425
 426         brcmu_pkt_buf_free_skb(req->skb);
 427         req->skb = NULL;
 428         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req, &devinfo->tx_freecount);
 429         if (devinfo->tx_freecount > devinfo->tx_high_watermark &&
 430                 devinfo->tx_flowblock) {
 431                 brcmf_txflowblock(devinfo->dev, false);
 432                 devinfo->tx_flowblock = false;
 433         }
 434 }
 435
 436 static void brcmf_usb_rx_complete(struct urb *urb)
 437 {
 438         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
 439         struct brcmf_usbdev_info *devinfo = req->devinfo;
 440         struct sk_buff *skb;
 441         struct sk_buff_head skbq;
 442
 443         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 444         brcmf_usb_del_fromq(devinfo, req);
 445         skb = req->skb;
 446         req->skb = NULL;
 447
 448         /* zero lenght packets indicate usb "failure". Do not refill */
 449         if (urb->status != 0 || !urb->actual_length) {
 450                 brcmu_pkt_buf_free_skb(skb);
 451                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 452                 return;
 453         }
 454
 455         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 456                 skb_queue_head_init(&skbq);
 457                 skb_queue_tail(&skbq, skb);
 458                 skb_put(skb, urb->actual_length);
 459                 brcmf_rx_frames(devinfo->dev, &skbq);
 460                 brcmf_usb_rx_refill(devinfo, req);
 461         } else {
 462                 brcmu_pkt_buf_free_skb(skb);
 463                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 464         }
 465         return;
 466
 467 }
 468
 469 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 470                                 struct brcmf_usbreq  *req)
 471 {
 472         struct sk_buff *skb;
 473         int ret;
 474
 475         if (!req || !devinfo)
 476                 return;
 477
 478         skb = dev_alloc_skb(devinfo->bus_pub.bus_mtu);
 479         if (!skb) {
 480                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 481                 return;
 482         }
 483         req->skb = skb;
 484
 485         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
 486                           skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
 487                           req);
 488         req->devinfo = devinfo;
 489         brcmf_usb_enq(devinfo, &devinfo->rx_postq, req, NULL);
 490
 491         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 492         if (ret) {
 493                 brcmf_usb_del_fromq(devinfo, req);
 494                 brcmu_pkt_buf_free_skb(req->skb);
 495                 req->skb = NULL;
 496                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 497         }
 498         return;
 499 }
 500
 501 static void brcmf_usb_rx_fill_all(struct brcmf_usbdev_info *devinfo)
 502 {
 503         struct brcmf_usbreq *req;
 504
 505         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
 506                 brcmf_err("bus is not up=%d\n", devinfo->bus_pub.state);
 507                 return;
 508         }
 509         while ((req = brcmf_usb_deq(devinfo, &devinfo->rx_freeq, NULL)) != NULL)
 510                 brcmf_usb_rx_refill(devinfo, req);
 511 }
 512
 513 static void
 514 brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
 515 {
 516         struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
 517         int old_state;
 518
 519         brcmf_dbg(USB, "Enter, current state=%d, new state=%d\n",
 520                   devinfo->bus_pub.state, state);
 521
 522         if (devinfo->bus_pub.state == state)
 523                 return;
 524
 525         old_state = devinfo->bus_pub.state;
 526         devinfo->bus_pub.state = state;
 527
 528         /* update state of upper layer */
 529         if (state == BRCMFMAC_USB_STATE_DOWN) {
 530                 brcmf_dbg(USB, "DBUS is down\n");
 531                 bcmf_bus->state = BRCMF_BUS_DOWN;
 532         } else if (state == BRCMFMAC_USB_STATE_UP) {
 533                 brcmf_dbg(USB, "DBUS is up\n");
 534                 bcmf_bus->state = BRCMF_BUS_DATA;
 535         } else {
 536                 brcmf_dbg(USB, "DBUS current state=%d\n", state);
 537         }
 538 }
 539
 540 static void
 541 brcmf_usb_intr_complete(struct urb *urb)
 542 {
 543         struct brcmf_usbdev_info *devinfo =
 544                         (struct brcmf_usbdev_info *)urb->context;
 545         int err;
 546
 547         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 548
 549         if (devinfo == NULL)
 550                 return;
 551
 552         if (unlikely(urb->status)) {
 553                 if (urb->status == -ENOENT ||
 554                     urb->status == -ESHUTDOWN ||
 555                     urb->status == -ENODEV) {
 556                         brcmf_usb_state_change(devinfo,
 557                                                BRCMFMAC_USB_STATE_DOWN);
 558                 }
 559         }
 560
 561         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN) {
 562                 brcmf_err("intr cb when DBUS down, ignoring\n");
 563                 return;
 564         }
 565
 566         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 567                 err = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 568                 if (err)
 569                         brcmf_err("usb_submit_urb, err=%d\n", err);
 570         }
 571 }
 572
 573 static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 574 {
 575         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 576         struct brcmf_usbreq  *req;
 577         int ret;
 578
 579         brcmf_dbg(USB, "Enter, skb=%p\n", skb);
 580         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 581                 return -EIO;
 582
 583         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq,
 584                                         &devinfo->tx_freecount);
 585         if (!req) {
 586                 brcmu_pkt_buf_free_skb(skb);
 587                 brcmf_err("no req to send\n");
 588                 return -ENOMEM;
 589         }
 590
 591         req->skb = skb;
 592         req->devinfo = devinfo;
 593         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
 594                           skb->data, skb->len, brcmf_usb_tx_complete, req);
 595         req->urb->transfer_flags |= URB_ZERO_PACKET;
 596         brcmf_usb_enq(devinfo, &devinfo->tx_postq, req, NULL);
 597         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 598         if (ret) {
 599                 brcmf_err("brcmf_usb_tx usb_submit_urb FAILED\n");
 600                 brcmf_usb_del_fromq(devinfo, req);
 601                 brcmu_pkt_buf_free_skb(req->skb);
 602                 req->skb = NULL;
 603                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req,
 604                                                 &devinfo->tx_freecount);
 605         } else {
 606                 if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
 607                         !devinfo->tx_flowblock) {
 608                         brcmf_txflowblock(dev, true);
 609                         devinfo->tx_flowblock = true;
 610                 }
 611         }
 612
 613         return ret;
 614 }
 615
 616
 617 static int brcmf_usb_up(struct device *dev)
 618 {
 619         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 620         u16 ifnum;
 621         int ret;
 622
 623         brcmf_dbg(USB, "Enter\n");
 624         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP)
 625                 return 0;
 626
 627         /* Success, indicate devinfo is fully up */
 628         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_UP);
 629
 630         if (devinfo->intr_urb) {
 631                 usb_fill_int_urb(devinfo->intr_urb, devinfo->usbdev,
 632                         devinfo->intr_pipe,
 633                         &devinfo->intr,
 634                         devinfo->intr_size,
 635                         (usb_complete_t)brcmf_usb_intr_complete,
 636                         devinfo,
 637                         devinfo->interval);
 638
 639                 ret = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 640                 if (ret) {
 641                         brcmf_err("USB_SUBMIT_URB failed with status %d\n",
 642                                   ret);
 643                         return -EINVAL;
 644                 }
 645         }
 646
 647         if (devinfo->ctl_urb) {
 648                 devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
 649                 devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
 650
 651                 ifnum = IFDESC(devinfo->usbdev, CONTROL_IF).bInterfaceNumber;
 652
 653                 /* CTL Write */
 654                 devinfo->ctl_write.bRequestType =
 655                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 656                 devinfo->ctl_write.bRequest = 0;
 657                 devinfo->ctl_write.wValue = cpu_to_le16(0);
 658                 devinfo->ctl_write.wIndex = cpu_to_le16p(&ifnum);
 659
 660                 /* CTL Read */
 661                 devinfo->ctl_read.bRequestType =
 662                         USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 663                 devinfo->ctl_read.bRequest = 1;
 664                 devinfo->ctl_read.wValue = cpu_to_le16(0);
 665                 devinfo->ctl_read.wIndex = cpu_to_le16p(&ifnum);
 666         }
 667         brcmf_usb_rx_fill_all(devinfo);
 668         return 0;
 669 }
 670
 671 static void brcmf_usb_down(struct device *dev)
 672 {
 673         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 674
 675         brcmf_dbg(USB, "Enter\n");
 676         if (devinfo == NULL)
 677                 return;
 678
 679         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN)
 680                 return;
 681
 682         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_DOWN);
 683         if (devinfo->intr_urb)
 684                 usb_kill_urb(devinfo->intr_urb);
 685
 686         if (devinfo->ctl_urb)
 687                 usb_kill_urb(devinfo->ctl_urb);
 688
 689         if (devinfo->bulk_urb)
 690                 usb_kill_urb(devinfo->bulk_urb);
 691         brcmf_usb_free_q(&devinfo->tx_postq, true);
 692
 693         brcmf_usb_free_q(&devinfo->rx_postq, true);
 694 }
 695
 696 static void
 697 brcmf_usb_sync_complete(struct urb *urb)
 698 {
 699         struct brcmf_usbdev_info *devinfo =
 700                         (struct brcmf_usbdev_info *)urb->context;
 701
 702         devinfo->ctl_completed = true;
 703         brcmf_usb_ioctl_resp_wake(devinfo);
 704 }
 705
 706 static bool brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
 707                              void *buffer, int buflen)
 708 {
 709         int ret = 0;
 710         char *tmpbuf;
 711         u16 size;
 712
 713         if ((!devinfo) || (devinfo->ctl_urb == NULL))
 714                 return false;
 715
 716         tmpbuf = kmalloc(buflen, GFP_ATOMIC);
 717         if (!tmpbuf)
 718                 return false;
 719
 720         size = buflen;
 721         devinfo->ctl_urb->transfer_buffer_length = size;
 722
 723         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 724         devinfo->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
 725                 USB_RECIP_INTERFACE;
 726         devinfo->ctl_read.bRequest = cmd;
 727
 728         usb_fill_control_urb(devinfo->ctl_urb,
 729                 devinfo->usbdev,
 730                 usb_rcvctrlpipe(devinfo->usbdev, 0),
 731                 (unsigned char *) &devinfo->ctl_read,
 732                 (void *) tmpbuf, size,
 733                 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 734
 735         devinfo->ctl_completed = false;
 736         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 737         if (ret < 0) {
 738                 brcmf_err("usb_submit_urb failed %d\n", ret);
 739                 kfree(tmpbuf);
 740                 return false;
 741         }
 742
 743         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 744         memcpy(buffer, tmpbuf, buflen);
 745         kfree(tmpbuf);
 746
 747         return ret;
 748 }
 749
 750 static bool
 751 brcmf_usb_dlneeded(struct brcmf_usbdev_info *devinfo)
 752 {
 753         struct bootrom_id_le id;
 754         u32 chipid, chiprev;
 755
 756         brcmf_dbg(USB, "Enter\n");
 757
 758         if (devinfo == NULL)
 759                 return false;
 760
 761         /* Check if firmware downloaded already by querying runtime ID */
 762         id.chip = cpu_to_le32(0xDEAD);
 763         brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 764
 765         chipid = le32_to_cpu(id.chip);
 766         chiprev = le32_to_cpu(id.chiprev);
 767
 768         if ((chipid & 0x4300) == 0x4300)
 769                 brcmf_dbg(USB, "chip %x rev 0x%x\n", chipid, chiprev);
 770         else
 771                 brcmf_dbg(USB, "chip %d rev 0x%x\n", chipid, chiprev);
 772         if (chipid == BRCMF_POSTBOOT_ID) {
 773                 brcmf_dbg(USB, "firmware already downloaded\n");
 774                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 775                 return false;
 776         } else {
 777                 devinfo->bus_pub.devid = chipid;
 778                 devinfo->bus_pub.chiprev = chiprev;
 779         }
 780         return true;
 781 }
 782
 783 static int
 784 brcmf_usb_resetcfg(struct brcmf_usbdev_info *devinfo)
 785 {
 786         struct bootrom_id_le id;
 787         u32 loop_cnt;
 788
 789         brcmf_dbg(USB, "Enter\n");
 790
 791         loop_cnt = 0;
 792         do {
 793                 mdelay(BRCMF_USB_RESET_GETVER_SPINWAIT);
 794                 loop_cnt++;
 795                 id.chip = cpu_to_le32(0xDEAD);       /* Get the ID */
 796                 brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 797                 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID))
 798                         break;
 799         } while (loop_cnt < BRCMF_USB_RESET_GETVER_LOOP_CNT);
 800
 801         if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID)) {
 802                 brcmf_dbg(USB, "postboot chip 0x%x/rev 0x%x\n",
 803                           le32_to_cpu(id.chip), le32_to_cpu(id.chiprev));
 804
 805                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 806                 return 0;
 807         } else {
 808                 brcmf_err("Cannot talk to Dongle. Firmware is not UP, %d ms\n",
 809                           BRCMF_USB_RESET_GETVER_SPINWAIT * loop_cnt);
 810                 return -EINVAL;
 811         }
 812 }
 813
 814
 815 static int
 816 brcmf_usb_dl_send_bulk(struct brcmf_usbdev_info *devinfo, void *buffer, int len)
 817 {
 818         int ret;
 819
 820         if ((devinfo == NULL) || (devinfo->bulk_urb == NULL))
 821                 return -EINVAL;
 822
 823         /* Prepare the URB */
 824         usb_fill_bulk_urb(devinfo->bulk_urb, devinfo->usbdev,
 825                           devinfo->tx_pipe, buffer, len,
 826                           (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 827
 828         devinfo->bulk_urb->transfer_flags |= URB_ZERO_PACKET;
 829
 830         devinfo->ctl_completed = false;
 831         ret = usb_submit_urb(devinfo->bulk_urb, GFP_ATOMIC);
 832         if (ret) {
 833                 brcmf_err("usb_submit_urb failed %d\n", ret);
 834                 return ret;
 835         }
 836         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 837         return (ret == 0);
 838 }
 839
 840 static int
 841 brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
 842 {
 843         unsigned int sendlen, sent, dllen;
 844         char *bulkchunk = NULL, *dlpos;
 845         struct rdl_state_le state;
 846         u32 rdlstate, rdlbytes;
 847         int err = 0;
 848
 849         brcmf_dbg(USB, "Enter, fw %p, len %d\n", fw, fwlen);
 850
 851         bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
 852         if (bulkchunk == NULL) {
 853                 err = -ENOMEM;
 854                 goto fail;
 855         }
 856
 857         /* 1) Prepare USB boot loader for runtime image */
 858         brcmf_usb_dl_cmd(devinfo, DL_START, &state,
 859                          sizeof(struct rdl_state_le));
 860
 861         rdlstate = le32_to_cpu(state.state);
 862         rdlbytes = le32_to_cpu(state.bytes);
 863
 864         /* 2) Check we are in the Waiting state */
 865         if (rdlstate != DL_WAITING) {
 866                 brcmf_err("Failed to DL_START\n");
 867                 err = -EINVAL;
 868                 goto fail;
 869         }
 870         sent = 0;
 871         dlpos = fw;
 872         dllen = fwlen;
 873
 874         /* Get chip id and rev */
 875         while (rdlbytes != dllen) {
 876                 /* Wait until the usb device reports it received all
 877                  * the bytes we sent */
 878                 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
 879                         if ((dllen-sent) < RDL_CHUNK)
 880                                 sendlen = dllen-sent;
 881                         else
 882                                 sendlen = RDL_CHUNK;
 883
 884                         /* simply avoid having to send a ZLP by ensuring we
 885                          * never have an even
 886                          * multiple of 64
 887                          */
 888                         if (!(sendlen % 64))
 889                                 sendlen -= 4;
 890
 891                         /* send data */
 892                         memcpy(bulkchunk, dlpos, sendlen);
 893                         if (brcmf_usb_dl_send_bulk(devinfo, bulkchunk,
 894                                                    sendlen)) {
 895                                 brcmf_err("send_bulk failed\n");
 896                                 err = -EINVAL;
 897                                 goto fail;
 898                         }
 899
 900                         dlpos += sendlen;
 901                         sent += sendlen;
 902                 }
 903                 if (!brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 904                                       sizeof(struct rdl_state_le))) {
 905                         brcmf_err("DL_GETSTATE Failed xxxx\n");
 906                         err = -EINVAL;
 907                         goto fail;
 908                 }
 909
 910                 rdlstate = le32_to_cpu(state.state);
 911                 rdlbytes = le32_to_cpu(state.bytes);
 912
 913                 /* restart if an error is reported */
 914                 if (rdlstate == DL_BAD_HDR || rdlstate == DL_BAD_CRC) {
 915                         brcmf_err("Bad Hdr or Bad CRC state %d\n",
 916                                   rdlstate);
 917                         err = -EINVAL;
 918                         goto fail;
 919                 }
 920         }
 921
 922 fail:
 923         kfree(bulkchunk);
 924         brcmf_dbg(USB, "Exit, err=%d\n", err);
 925         return err;
 926 }
 927
 928 static int brcmf_usb_dlstart(struct brcmf_usbdev_info *devinfo, u8 *fw, int len)
 929 {
 930         int err;
 931
 932         brcmf_dbg(USB, "Enter\n");
 933
 934         if (devinfo == NULL)
 935                 return -EINVAL;
 936
 937         if (devinfo->bus_pub.devid == 0xDEAD)
 938                 return -EINVAL;
 939
 940         err = brcmf_usb_dl_writeimage(devinfo, fw, len);
 941         if (err == 0)
 942                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_DONE;
 943         else
 944                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_FAIL;
 945         brcmf_dbg(USB, "Exit, err=%d\n", err);
 946
 947         return err;
 948 }
 949
 950 static int brcmf_usb_dlrun(struct brcmf_usbdev_info *devinfo)
 951 {
 952         struct rdl_state_le state;
 953
 954         brcmf_dbg(USB, "Enter\n");
 955         if (!devinfo)
 956                 return -EINVAL;
 957
 958         if (devinfo->bus_pub.devid == 0xDEAD)
 959                 return -EINVAL;
 960
 961         /* Check we are runnable */
 962         brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 963                 sizeof(struct rdl_state_le));
 964
 965         /* Start the image */
 966         if (state.state == cpu_to_le32(DL_RUNNABLE)) {
 967                 if (!brcmf_usb_dl_cmd(devinfo, DL_GO, &state,
 968                         sizeof(struct rdl_state_le)))
 969                         return -ENODEV;
 970                 if (brcmf_usb_resetcfg(devinfo))
 971                         return -ENODEV;
 972                 /* The Dongle may go for re-enumeration. */
 973         } else {
 974                 brcmf_err("Dongle not runnable\n");
 975                 return -EINVAL;
 976         }
 977         brcmf_dbg(USB, "Exit\n");
 978         return 0;
 979 }
 980
 981 static bool brcmf_usb_chip_support(int chipid, int chiprev)
 982 {
 983         switch(chipid) {
 984         case 43143:
 985                 return true;
 986         case 43235:
 987         case 43236:
 988         case 43238:
 989                 return (chiprev == 3);
 990         case 43242:
 991                 return true;
 992         default:
 993                 break;
 994         }
 995         return false;
 996 }
 997
 998 static int
 999 brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
1000 {
1001         int devid, chiprev;
1002         int err;
1003
1004         brcmf_dbg(USB, "Enter\n");
1005         if (devinfo == NULL)
1006                 return -ENODEV;
1007
1008         devid = devinfo->bus_pub.devid;
1009         chiprev = devinfo->bus_pub.chiprev;
1010
1011         if (!brcmf_usb_chip_support(devid, chiprev)) {
1012                 brcmf_err("unsupported chip %d rev %d\n",
1013                           devid, chiprev);
1014                 return -EINVAL;
1015         }
1016
1017         if (!devinfo->image) {
1018                 brcmf_err("No firmware!\n");
1019                 return -ENOENT;
1020         }
1021
1022         err = brcmf_usb_dlstart(devinfo,
1023                 devinfo->image, devinfo->image_len);
1024         if (err == 0)
1025                 err = brcmf_usb_dlrun(devinfo);
1026         return err;
1027 }
1028
1029
1030 static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
1031 {
1032         brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
1033
1034         /* free the URBS */
1035         brcmf_usb_free_q(&devinfo->rx_freeq, false);
1036         brcmf_usb_free_q(&devinfo->tx_freeq, false);
1037
1038         usb_free_urb(devinfo->intr_urb);
1039         usb_free_urb(devinfo->ctl_urb);
1040         usb_free_urb(devinfo->bulk_urb);
1041
1042         kfree(devinfo->tx_reqs);
1043         kfree(devinfo->rx_reqs);
1044 }
1045
1046 #define TRX_MAGIC       0x30524448      /* "HDR0" */
1047 #define TRX_VERSION     1               /* Version 1 */
1048 #define TRX_MAX_LEN     0x3B0000        /* Max length */
1049 #define TRX_NO_HEADER   1               /* Do not write TRX header */
1050 #define TRX_MAX_OFFSET  3               /* Max number of individual files */
1051 #define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed image */
1052
1053 struct trx_header_le {
1054         __le32 magic;           /* "HDR0" */
1055         __le32 len;             /* Length of file including header */
1056         __le32 crc32;           /* CRC from flag_version to end of file */
1057         __le32 flag_version;    /* 0:15 flags, 16:31 version */
1058         __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
1059                                          * header */
1060 };
1061
1062 static int check_file(const u8 *headers)
1063 {
1064         struct trx_header_le *trx;
1065         int actual_len = -1;
1066
1067         brcmf_dbg(USB, "Enter\n");
1068         /* Extract trx header */
1069         trx = (struct trx_header_le *) headers;
1070         if (trx->magic != cpu_to_le32(TRX_MAGIC))
1071                 return -1;
1072
1073         headers += sizeof(struct trx_header_le);
1074
1075         if (le32_to_cpu(trx->flag_version) & TRX_UNCOMP_IMAGE) {
1076                 actual_len = le32_to_cpu(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]);
1077                 return actual_len + sizeof(struct trx_header_le);
1078         }
1079         return -1;
1080 }
1081
1082 static int brcmf_usb_get_fw(struct brcmf_usbdev_info *devinfo)
1083 {
1084         s8 *fwname;
1085         const struct firmware *fw;
1086         struct brcmf_usb_image *fw_image;
1087         int err;
1088
1089         brcmf_dbg(USB, "Enter\n");
1090         switch (devinfo->bus_pub.devid) {
1091         case 43143:
1092                 fwname = BRCMF_USB_43143_FW_NAME;
1093                 break;
1094         case 43235:
1095         case 43236:
1096         case 43238:
1097                 fwname = BRCMF_USB_43236_FW_NAME;
1098                 break;
1099         case 43242:
1100                 fwname = BRCMF_USB_43242_FW_NAME;
1101                 break;
1102         default:
1103                 return -EINVAL;
1104                 break;
1105         }
1106         brcmf_dbg(USB, "Loading FW %s\n", fwname);
1107         list_for_each_entry(fw_image, &fw_image_list, list) {
1108                 if (fw_image->fwname == fwname) {
1109                         devinfo->image = fw_image->image;
1110                         devinfo->image_len = fw_image->image_len;
1111                         return 0;
1112                 }
1113         }
1114         /* fw image not yet loaded. Load it now and add to list */
1115         err = request_firmware(&fw, fwname, devinfo->dev);
1116         if (!fw) {
1117                 brcmf_err("fail to request firmware %s\n", fwname);
1118                 return err;
1119         }
1120         if (check_file(fw->data) < 0) {
1121                 brcmf_err("invalid firmware %s\n", fwname);
1122                 return -EINVAL;
1123         }
1124
1125         fw_image = kzalloc(sizeof(*fw_image), GFP_ATOMIC);
1126         if (!fw_image)
1127                 return -ENOMEM;
1128         INIT_LIST_HEAD(&fw_image->list);
1129         list_add_tail(&fw_image->list, &fw_image_list);
1130         fw_image->fwname = fwname;
1131         fw_image->image = vmalloc(fw->size);
1132         if (!fw_image->image)
1133                 return -ENOMEM;
1134
1135         memcpy(fw_image->image, fw->data, fw->size);
1136         fw_image->image_len = fw->size;
1137
1138         release_firmware(fw);
1139
1140         devinfo->image = fw_image->image;
1141         devinfo->image_len = fw_image->image_len;
1142
1143         return 0;
1144 }
1145
1146
1147 static
1148 struct brcmf_usbdev *brcmf_usb_attach(struct brcmf_usbdev_info *devinfo,
1149                                       int nrxq, int ntxq)
1150 {
1151         brcmf_dbg(USB, "Enter\n");
1152
1153         devinfo->bus_pub.nrxq = nrxq;
1154         devinfo->rx_low_watermark = nrxq / 2;
1155         devinfo->bus_pub.devinfo = devinfo;
1156         devinfo->bus_pub.ntxq = ntxq;
1157         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DOWN;
1158
1159         /* flow control when too many tx urbs posted */
1160         devinfo->tx_low_watermark = ntxq / 4;
1161         devinfo->tx_high_watermark = devinfo->tx_low_watermark * 3;
1162         devinfo->bus_pub.bus_mtu = BRCMF_USB_MAX_PKT_SIZE;
1163
1164         /* Initialize other structure content */
1165         init_waitqueue_head(&devinfo->ioctl_resp_wait);
1166
1167         /* Initialize the spinlocks */
1168         spin_lock_init(&devinfo->qlock);
1169
1170         INIT_LIST_HEAD(&devinfo->rx_freeq);
1171         INIT_LIST_HEAD(&devinfo->rx_postq);
1172
1173         INIT_LIST_HEAD(&devinfo->tx_freeq);
1174         INIT_LIST_HEAD(&devinfo->tx_postq);
1175
1176         devinfo->tx_flowblock = false;
1177
1178         devinfo->rx_reqs = brcmf_usbdev_qinit(&devinfo->rx_freeq, nrxq);
1179         if (!devinfo->rx_reqs)
1180                 goto error;
1181
1182         devinfo->tx_reqs = brcmf_usbdev_qinit(&devinfo->tx_freeq, ntxq);
1183         if (!devinfo->tx_reqs)
1184                 goto error;
1185         devinfo->tx_freecount = ntxq;
1186
1187         devinfo->intr_urb = usb_alloc_urb(0, GFP_ATOMIC);
1188         if (!devinfo->intr_urb) {
1189                 brcmf_err("usb_alloc_urb (intr) failed\n");
1190                 goto error;
1191         }
1192         devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
1193         if (!devinfo->ctl_urb) {
1194                 brcmf_err("usb_alloc_urb (ctl) failed\n");
1195                 goto error;
1196         }
1197         devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
1198         if (!devinfo->bulk_urb) {
1199                 brcmf_err("usb_alloc_urb (bulk) failed\n");
1200                 goto error;
1201         }
1202
1203         if (!brcmf_usb_dlneeded(devinfo))
1204                 return &devinfo->bus_pub;
1205
1206         brcmf_dbg(USB, "Start fw downloading\n");
1207         if (brcmf_usb_get_fw(devinfo))
1208                 goto error;
1209
1210         if (brcmf_usb_fw_download(devinfo))
1211                 goto error;
1212
1213         return &devinfo->bus_pub;
1214
1215 error:
1216         brcmf_err("failed!\n");
1217         brcmf_usb_detach(devinfo);
1218         return NULL;
1219 }
1220
1221 static struct brcmf_bus_ops brcmf_usb_bus_ops = {
1222         .txdata = brcmf_usb_tx,
1223         .init = brcmf_usb_up,
1224         .stop = brcmf_usb_down,
1225         .txctl = brcmf_usb_tx_ctlpkt,
1226         .rxctl = brcmf_usb_rx_ctlpkt,
1227 };
1228
1229 static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
1230 {
1231         struct brcmf_bus *bus = NULL;
1232         struct brcmf_usbdev *bus_pub = NULL;
1233         int ret;
1234         struct device *dev = devinfo->dev;
1235
1236         brcmf_dbg(USB, "Enter\n");
1237         bus_pub = brcmf_usb_attach(devinfo, BRCMF_USB_NRXQ, BRCMF_USB_NTXQ);
1238         if (!bus_pub)
1239                 return -ENODEV;
1240
1241         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
1242         if (!bus) {
1243                 ret = -ENOMEM;
1244                 goto fail;
1245         }
1246
1247         bus->dev = dev;
1248         bus_pub->bus = bus;
1249         bus->bus_priv.usb = bus_pub;
1250         dev_set_drvdata(dev, bus);
1251         bus->ops = &brcmf_usb_bus_ops;
1252         bus->chip = bus_pub->devid;
1253         bus->chiprev = bus_pub->chiprev;
1254
1255         /* Attach to the common driver interface */
1256         ret = brcmf_attach(0, dev);
1257         if (ret) {
1258                 brcmf_err("brcmf_attach failed\n");
1259                 goto fail;
1260         }
1261
1262         ret = brcmf_bus_start(dev);
1263         if (ret) {
1264                 brcmf_err("dongle is not responding\n");
1265                 brcmf_detach(dev);
1266                 goto fail;
1267         }
1268
1269         return 0;
1270 fail:
1271         /* Release resources in reverse order */
1272         kfree(bus);
1273         brcmf_usb_detach(devinfo);
1274         return ret;
1275 }
1276
1277 static void
1278 brcmf_usb_disconnect_cb(struct brcmf_usbdev_info *devinfo)
1279 {
1280         if (!devinfo)
1281                 return;
1282         brcmf_dbg(USB, "Enter, bus_pub %p\n", devinfo);
1283
1284         brcmf_detach(devinfo->dev);
1285         kfree(devinfo->bus_pub.bus);
1286         brcmf_usb_detach(devinfo);
1287 }
1288
1289 static int
1290 brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
1291 {
1292         int ep;
1293         struct usb_endpoint_descriptor *endpoint;
1294         int ret = 0;
1295         struct usb_device *usb = interface_to_usbdev(intf);
1296         int num_of_eps;
1297         u8 endpoint_num;
1298         struct brcmf_usbdev_info *devinfo;
1299
1300         brcmf_dbg(USB, "Enter\n");
1301
1302         devinfo = kzalloc(sizeof(*devinfo), GFP_ATOMIC);
1303         if (devinfo == NULL)
1304                 return -ENOMEM;
1305
1306         devinfo->usbdev = usb;
1307         devinfo->dev = &usb->dev;
1308
1309         usb_set_intfdata(intf, devinfo);
1310
1311         /* Check that the device supports only one configuration */
1312         if (usb->descriptor.bNumConfigurations != 1) {
1313                 ret = -1;
1314                 goto fail;
1315         }
1316
1317         if (usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
1318                 ret = -1;
1319                 goto fail;
1320         }
1321
1322         /*
1323          * Only the BDC interface configuration is supported:
1324          *      Device class: USB_CLASS_VENDOR_SPEC
1325          *      if0 class: USB_CLASS_VENDOR_SPEC
1326          *      if0/ep0: control
1327          *      if0/ep1: bulk in
1328          *      if0/ep2: bulk out (ok if swapped with bulk in)
1329          */
1330         if (CONFIGDESC(usb)->bNumInterfaces != 1) {
1331                 ret = -1;
1332                 goto fail;
1333         }
1334
1335         /* Check interface */
1336         if (IFDESC(usb, CONTROL_IF).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
1337             IFDESC(usb, CONTROL_IF).bInterfaceSubClass != 2 ||
1338             IFDESC(usb, CONTROL_IF).bInterfaceProtocol != 0xff) {
1339                 brcmf_err("invalid control interface: class %d, subclass %d, proto %d\n",
1340                           IFDESC(usb, CONTROL_IF).bInterfaceClass,
1341                           IFDESC(usb, CONTROL_IF).bInterfaceSubClass,
1342                           IFDESC(usb, CONTROL_IF).bInterfaceProtocol);
1343                 ret = -1;
1344                 goto fail;
1345         }
1346
1347         /* Check control endpoint */
1348         endpoint = &IFEPDESC(usb, CONTROL_IF, 0);
1349         if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
1350                 != USB_ENDPOINT_XFER_INT) {
1351                 brcmf_err("invalid control endpoint %d\n",
1352                           endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
1353                 ret = -1;
1354                 goto fail;
1355         }
1356
1357         endpoint_num = endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
1358         devinfo->intr_pipe = usb_rcvintpipe(usb, endpoint_num);
1359
1360         devinfo->rx_pipe = 0;
1361         devinfo->rx_pipe2 = 0;
1362         devinfo->tx_pipe = 0;
1363         num_of_eps = IFDESC(usb, BULK_IF).bNumEndpoints - 1;
1364
1365         /* Check data endpoints and get pipes */
1366         for (ep = 1; ep <= num_of_eps; ep++) {
1367                 endpoint = &IFEPDESC(usb, BULK_IF, ep);
1368                 if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
1369                     USB_ENDPOINT_XFER_BULK) {
1370                         brcmf_err("invalid data endpoint %d\n", ep);
1371                         ret = -1;
1372                         goto fail;
1373                 }
1374
1375                 endpoint_num = endpoint->bEndpointAddress &
1376                                USB_ENDPOINT_NUMBER_MASK;
1377                 if ((endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1378                         == USB_DIR_IN) {
1379                         if (!devinfo->rx_pipe) {
1380                                 devinfo->rx_pipe =
1381                                         usb_rcvbulkpipe(usb, endpoint_num);
1382                         } else {
1383                                 devinfo->rx_pipe2 =
1384                                         usb_rcvbulkpipe(usb, endpoint_num);
1385                         }
1386                 } else {
1387                         devinfo->tx_pipe = usb_sndbulkpipe(usb, endpoint_num);
1388                 }
1389         }
1390
1391         /* Allocate interrupt URB and data buffer */
1392         /* RNDIS says 8-byte intr, our old drivers used 4-byte */
1393         if (IFEPDESC(usb, CONTROL_IF, 0).wMaxPacketSize == cpu_to_le16(16))
1394                 devinfo->intr_size = 8;
1395         else
1396                 devinfo->intr_size = 4;
1397
1398         devinfo->interval = IFEPDESC(usb, CONTROL_IF, 0).bInterval;
1399
1400         if (usb->speed == USB_SPEED_HIGH)
1401                 brcmf_dbg(USB, "Broadcom high speed USB wireless device detected\n");
1402         else
1403                 brcmf_dbg(USB, "Broadcom full speed USB wireless device detected\n");
1404
1405         ret = brcmf_usb_probe_cb(devinfo);
1406         if (ret)
1407                 goto fail;
1408
1409         /* Success */
1410         return 0;
1411
1412 fail:
1413         brcmf_err("failed with errno %d\n", ret);
1414         kfree(devinfo);
1415         usb_set_intfdata(intf, NULL);
1416         return ret;
1417
1418 }
1419
1420 static void
1421 brcmf_usb_disconnect(struct usb_interface *intf)
1422 {
1423         struct brcmf_usbdev_info *devinfo;
1424
1425         brcmf_dbg(USB, "Enter\n");
1426         devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf);
1427         brcmf_usb_disconnect_cb(devinfo);
1428         kfree(devinfo);
1429         brcmf_dbg(USB, "Exit\n");
1430 }
1431
1432 /*
1433  * only need to signal the bus being down and update the state.
1434  */
1435 static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
1436 {
1437         struct usb_device *usb = interface_to_usbdev(intf);
1438         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1439
1440         brcmf_dbg(USB, "Enter\n");
1441         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_SLEEP;
1442         brcmf_detach(&usb->dev);
1443         return 0;
1444 }
1445
1446 /*
1447  * (re-) start the bus.
1448  */
1449 static int brcmf_usb_resume(struct usb_interface *intf)
1450 {
1451         struct usb_device *usb = interface_to_usbdev(intf);
1452         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1453
1454         brcmf_dbg(USB, "Enter\n");
1455         if (!brcmf_attach(0, devinfo->dev))
1456                 return brcmf_bus_start(&usb->dev);
1457
1458         return 0;
1459 }
1460
1461 static int brcmf_usb_reset_resume(struct usb_interface *intf)
1462 {
1463         struct usb_device *usb = interface_to_usbdev(intf);
1464         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1465
1466         brcmf_dbg(USB, "Enter\n");
1467
1468         if (!brcmf_usb_fw_download(devinfo))
1469                 return brcmf_usb_resume(intf);
1470
1471         return -EIO;
1472 }
1473
1474 #define BRCMF_USB_VENDOR_ID_BROADCOM    0x0a5c
1475 #define BRCMF_USB_DEVICE_ID_43143       0xbd1e
1476 #define BRCMF_USB_DEVICE_ID_43236       0xbd17
1477 #define BRCMF_USB_DEVICE_ID_43242       0xbd1f
1478 #define BRCMF_USB_DEVICE_ID_BCMFW       0x0bdc
1479
1480 static struct usb_device_id brcmf_usb_devid_table[] = {
1481         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43143) },
1482         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43236) },
1483         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43242) },
1484         /* special entry for device with firmware loaded and running */
1485         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
1486         { }
1487 };
1488 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
1489 MODULE_FIRMWARE(BRCMF_USB_43143_FW_NAME);
1490 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
1491 MODULE_FIRMWARE(BRCMF_USB_43242_FW_NAME);
1492
1493 static struct usb_driver brcmf_usbdrvr = {
1494         .name = KBUILD_MODNAME,
1495         .probe = brcmf_usb_probe,
1496         .disconnect = brcmf_usb_disconnect,
1497         .id_table = brcmf_usb_devid_table,
1498         .suspend = brcmf_usb_suspend,
1499         .resume = brcmf_usb_resume,
1500         .reset_resume = brcmf_usb_reset_resume,
1501         .supports_autosuspend = 1,
1502         .disable_hub_initiated_lpm = 1,
1503 };
1504
1505 static void brcmf_release_fw(struct list_head *q)
1506 {
1507         struct brcmf_usb_image *fw_image, *next;
1508
1509         list_for_each_entry_safe(fw_image, next, q, list) {
1510                 vfree(fw_image->image);
1511                 list_del_init(&fw_image->list);
1512         }
1513 }
1514
1515 static int brcmf_usb_reset_device(struct device *dev, void *notused)
1516 {
1517         /* device past is the usb interface so we
1518          * need to use parent here.
1519          */
1520         brcmf_dev_reset(dev->parent);
1521         return 0;
1522 }
1523
1524 void brcmf_usb_exit(void)
1525 {
1526         struct device_driver *drv = &brcmf_usbdrvr.drvwrap.driver;
1527         int ret;
1528
1529         brcmf_dbg(USB, "Enter\n");
1530         ret = driver_for_each_device(drv, NULL, NULL,
1531                                      brcmf_usb_reset_device);
1532         usb_deregister(&brcmf_usbdrvr);
1533         brcmf_release_fw(&fw_image_list);
1534 }
1535
1536 void brcmf_usb_init(void)
1537 {
1538         brcmf_dbg(USB, "Enter\n");
1539         INIT_LIST_HEAD(&fw_image_list);
1540         usb_register(&brcmf_usbdrvr);
1541 }