2 * Copyright (c) 2011 Broadcom Corporation
4 * Permission to use, copy, modify, and/or distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
11 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
13 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
14 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 #include <linux/kernel.h>
18 #include <linux/module.h>
19 #include <linux/firmware.h>
20 #include <linux/usb.h>
21 #include <linux/vmalloc.h>
23 #include <brcmu_utils.h>
24 #include <brcmu_wifi.h>
32 #define IOCTL_RESP_TIMEOUT 2000
34 #define BRCMF_USB_RESET_GETVER_SPINWAIT 100 /* in unit of ms */
35 #define BRCMF_USB_RESET_GETVER_LOOP_CNT 10
37 #define BRCMF_POSTBOOT_ID 0xA123 /* ID to detect if dongle
39 #define BRCMF_USB_NRXQ 50
40 #define BRCMF_USB_NTXQ 50
42 #define CONFIGDESC(usb) (&((usb)->actconfig)->desc)
43 #define IFPTR(usb, idx) ((usb)->actconfig->interface[(idx)])
44 #define IFALTS(usb, idx) (IFPTR((usb), (idx))->altsetting[0])
45 #define IFDESC(usb, idx) IFALTS((usb), (idx)).desc
46 #define IFEPDESC(usb, idx, ep) (IFALTS((usb), (idx)).endpoint[(ep)]).desc
51 #define BRCMF_USB_CBCTL_WRITE 0
52 #define BRCMF_USB_CBCTL_READ 1
53 #define BRCMF_USB_MAX_PKT_SIZE 1600
55 #define BRCMF_USB_43143_FW_NAME "brcm/brcmfmac43143.bin"
56 #define BRCMF_USB_43236_FW_NAME "brcm/brcmfmac43236b.bin"
57 #define BRCMF_USB_43242_FW_NAME "brcm/brcmfmac43242a.bin"
59 struct brcmf_usb_image {
60 struct list_head list;
66 struct brcmf_usbdev_info {
67 struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
69 struct list_head rx_freeq;
70 struct list_head rx_postq;
71 struct list_head tx_freeq;
72 struct list_head tx_postq;
73 uint rx_pipe, tx_pipe, rx_pipe2;
77 int tx_high_watermark;
80 spinlock_t tx_flowblock_lock;
82 struct brcmf_usbreq *tx_reqs;
83 struct brcmf_usbreq *rx_reqs;
85 const u8 *image; /* buffer for combine fw and nvram */
88 struct usb_device *usbdev;
91 int ctl_in_pipe, ctl_out_pipe;
92 struct urb *ctl_urb; /* URB for control endpoint */
93 struct usb_ctrlrequest ctl_write;
94 struct usb_ctrlrequest ctl_read;
95 u32 ctl_urb_actual_length;
98 wait_queue_head_t ioctl_resp_wait;
101 struct urb *bulk_urb; /* used for FW download */
104 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
105 struct brcmf_usbreq *req);
107 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
109 struct brcmf_bus *bus_if = dev_get_drvdata(dev);
110 return bus_if->bus_priv.usb;
113 static struct brcmf_usbdev_info *brcmf_usb_get_businfo(struct device *dev)
115 return brcmf_usb_get_buspub(dev)->devinfo;
118 static int brcmf_usb_ioctl_resp_wait(struct brcmf_usbdev_info *devinfo)
120 return wait_event_timeout(devinfo->ioctl_resp_wait,
121 devinfo->ctl_completed,
122 msecs_to_jiffies(IOCTL_RESP_TIMEOUT));
125 static void brcmf_usb_ioctl_resp_wake(struct brcmf_usbdev_info *devinfo)
127 if (waitqueue_active(&devinfo->ioctl_resp_wait))
128 wake_up(&devinfo->ioctl_resp_wait);
132 brcmf_usb_ctl_complete(struct brcmf_usbdev_info *devinfo, int type, int status)
134 brcmf_dbg(USB, "Enter, status=%d\n", status);
136 if (unlikely(devinfo == NULL))
139 if (type == BRCMF_USB_CBCTL_READ) {
141 devinfo->bus_pub.stats.rx_ctlpkts++;
143 devinfo->bus_pub.stats.rx_ctlerrs++;
144 } else if (type == BRCMF_USB_CBCTL_WRITE) {
146 devinfo->bus_pub.stats.tx_ctlpkts++;
148 devinfo->bus_pub.stats.tx_ctlerrs++;
151 devinfo->ctl_urb_status = status;
152 devinfo->ctl_completed = true;
153 brcmf_usb_ioctl_resp_wake(devinfo);
157 brcmf_usb_ctlread_complete(struct urb *urb)
159 struct brcmf_usbdev_info *devinfo =
160 (struct brcmf_usbdev_info *)urb->context;
162 brcmf_dbg(USB, "Enter\n");
163 devinfo->ctl_urb_actual_length = urb->actual_length;
164 brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_READ,
169 brcmf_usb_ctlwrite_complete(struct urb *urb)
171 struct brcmf_usbdev_info *devinfo =
172 (struct brcmf_usbdev_info *)urb->context;
174 brcmf_dbg(USB, "Enter\n");
175 brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_WRITE,
180 brcmf_usb_send_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
185 brcmf_dbg(USB, "Enter\n");
186 if (devinfo == NULL || buf == NULL ||
187 len == 0 || devinfo->ctl_urb == NULL)
191 devinfo->ctl_write.wLength = cpu_to_le16p(&size);
192 devinfo->ctl_urb->transfer_buffer_length = size;
193 devinfo->ctl_urb_status = 0;
194 devinfo->ctl_urb_actual_length = 0;
196 usb_fill_control_urb(devinfo->ctl_urb,
198 devinfo->ctl_out_pipe,
199 (unsigned char *) &devinfo->ctl_write,
201 (usb_complete_t)brcmf_usb_ctlwrite_complete,
204 ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
206 brcmf_err("usb_submit_urb failed %d\n", ret);
212 brcmf_usb_recv_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
217 brcmf_dbg(USB, "Enter\n");
218 if ((devinfo == NULL) || (buf == NULL) || (len == 0)
219 || (devinfo->ctl_urb == NULL))
223 devinfo->ctl_read.wLength = cpu_to_le16p(&size);
224 devinfo->ctl_urb->transfer_buffer_length = size;
226 devinfo->ctl_read.bRequestType = USB_DIR_IN
227 | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
228 devinfo->ctl_read.bRequest = 1;
230 usb_fill_control_urb(devinfo->ctl_urb,
232 devinfo->ctl_in_pipe,
233 (unsigned char *) &devinfo->ctl_read,
235 (usb_complete_t)brcmf_usb_ctlread_complete,
238 ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
240 brcmf_err("usb_submit_urb failed %d\n", ret);
245 static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
249 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
251 brcmf_dbg(USB, "Enter\n");
252 if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
255 if (test_and_set_bit(0, &devinfo->ctl_op))
258 devinfo->ctl_completed = false;
259 err = brcmf_usb_send_ctl(devinfo, buf, len);
261 brcmf_err("fail %d bytes: %d\n", err, len);
262 clear_bit(0, &devinfo->ctl_op);
265 timeout = brcmf_usb_ioctl_resp_wait(devinfo);
266 clear_bit(0, &devinfo->ctl_op);
268 brcmf_err("Txctl wait timed out\n");
274 static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
278 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
280 brcmf_dbg(USB, "Enter\n");
281 if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
284 if (test_and_set_bit(0, &devinfo->ctl_op))
287 devinfo->ctl_completed = false;
288 err = brcmf_usb_recv_ctl(devinfo, buf, len);
290 brcmf_err("fail %d bytes: %d\n", err, len);
291 clear_bit(0, &devinfo->ctl_op);
294 timeout = brcmf_usb_ioctl_resp_wait(devinfo);
295 err = devinfo->ctl_urb_status;
296 clear_bit(0, &devinfo->ctl_op);
298 brcmf_err("rxctl wait timed out\n");
302 return devinfo->ctl_urb_actual_length;
307 static struct brcmf_usbreq *brcmf_usb_deq(struct brcmf_usbdev_info *devinfo,
308 struct list_head *q, int *counter)
311 struct brcmf_usbreq *req;
312 spin_lock_irqsave(&devinfo->qlock, flags);
314 spin_unlock_irqrestore(&devinfo->qlock, flags);
317 req = list_entry(q->next, struct brcmf_usbreq, list);
318 list_del_init(q->next);
321 spin_unlock_irqrestore(&devinfo->qlock, flags);
326 static void brcmf_usb_enq(struct brcmf_usbdev_info *devinfo,
327 struct list_head *q, struct brcmf_usbreq *req,
331 spin_lock_irqsave(&devinfo->qlock, flags);
332 list_add_tail(&req->list, q);
335 spin_unlock_irqrestore(&devinfo->qlock, flags);
338 static struct brcmf_usbreq *
339 brcmf_usbdev_qinit(struct list_head *q, int qsize)
342 struct brcmf_usbreq *req, *reqs;
344 reqs = kcalloc(qsize, sizeof(struct brcmf_usbreq), GFP_ATOMIC);
350 for (i = 0; i < qsize; i++) {
351 req->urb = usb_alloc_urb(0, GFP_ATOMIC);
355 INIT_LIST_HEAD(&req->list);
356 list_add_tail(&req->list, q);
361 brcmf_err("fail!\n");
362 while (!list_empty(q)) {
363 req = list_entry(q->next, struct brcmf_usbreq, list);
365 usb_free_urb(req->urb);
372 static void brcmf_usb_free_q(struct list_head *q, bool pending)
374 struct brcmf_usbreq *req, *next;
376 list_for_each_entry_safe(req, next, q, list) {
378 brcmf_err("bad req\n");
383 usb_kill_urb(req->urb);
385 usb_free_urb(req->urb);
386 list_del_init(&req->list);
391 static void brcmf_usb_del_fromq(struct brcmf_usbdev_info *devinfo,
392 struct brcmf_usbreq *req)
396 spin_lock_irqsave(&devinfo->qlock, flags);
397 list_del_init(&req->list);
398 spin_unlock_irqrestore(&devinfo->qlock, flags);
402 static void brcmf_usb_tx_complete(struct urb *urb)
404 struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
405 struct brcmf_usbdev_info *devinfo = req->devinfo;
408 brcmf_dbg(USB, "Enter, urb->status=%d, skb=%p\n", urb->status,
410 brcmf_usb_del_fromq(devinfo, req);
412 brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
414 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req, &devinfo->tx_freecount);
415 spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);
416 if (devinfo->tx_freecount > devinfo->tx_high_watermark &&
417 devinfo->tx_flowblock) {
418 brcmf_txflowblock(devinfo->dev, false);
419 devinfo->tx_flowblock = false;
421 spin_unlock_irqrestore(&devinfo->tx_flowblock_lock, flags);
424 static void brcmf_usb_rx_complete(struct urb *urb)
426 struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
427 struct brcmf_usbdev_info *devinfo = req->devinfo;
430 brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
431 brcmf_usb_del_fromq(devinfo, req);
435 /* zero lenght packets indicate usb "failure". Do not refill */
436 if (urb->status != 0 || !urb->actual_length) {
437 brcmu_pkt_buf_free_skb(skb);
438 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
442 if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
443 skb_put(skb, urb->actual_length);
444 brcmf_rx_frame(devinfo->dev, skb);
445 brcmf_usb_rx_refill(devinfo, req);
447 brcmu_pkt_buf_free_skb(skb);
448 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
454 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
455 struct brcmf_usbreq *req)
460 if (!req || !devinfo)
463 skb = dev_alloc_skb(devinfo->bus_pub.bus_mtu);
465 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
470 usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
471 skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
473 req->devinfo = devinfo;
474 brcmf_usb_enq(devinfo, &devinfo->rx_postq, req, NULL);
476 ret = usb_submit_urb(req->urb, GFP_ATOMIC);
478 brcmf_usb_del_fromq(devinfo, req);
479 brcmu_pkt_buf_free_skb(req->skb);
481 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
486 static void brcmf_usb_rx_fill_all(struct brcmf_usbdev_info *devinfo)
488 struct brcmf_usbreq *req;
490 if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
491 brcmf_err("bus is not up=%d\n", devinfo->bus_pub.state);
494 while ((req = brcmf_usb_deq(devinfo, &devinfo->rx_freeq, NULL)) != NULL)
495 brcmf_usb_rx_refill(devinfo, req);
499 brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
501 struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
504 brcmf_dbg(USB, "Enter, current state=%d, new state=%d\n",
505 devinfo->bus_pub.state, state);
507 if (devinfo->bus_pub.state == state)
510 old_state = devinfo->bus_pub.state;
511 devinfo->bus_pub.state = state;
513 /* update state of upper layer */
514 if (state == BRCMFMAC_USB_STATE_DOWN) {
515 brcmf_dbg(USB, "DBUS is down\n");
516 brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_DOWN);
517 } else if (state == BRCMFMAC_USB_STATE_UP) {
518 brcmf_dbg(USB, "DBUS is up\n");
519 brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_DATA);
521 brcmf_dbg(USB, "DBUS current state=%d\n", state);
525 static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
527 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
528 struct brcmf_usbreq *req;
532 brcmf_dbg(USB, "Enter, skb=%p\n", skb);
533 if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
538 req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq,
539 &devinfo->tx_freecount);
541 brcmf_err("no req to send\n");
547 req->devinfo = devinfo;
548 usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
549 skb->data, skb->len, brcmf_usb_tx_complete, req);
550 req->urb->transfer_flags |= URB_ZERO_PACKET;
551 brcmf_usb_enq(devinfo, &devinfo->tx_postq, req, NULL);
552 ret = usb_submit_urb(req->urb, GFP_ATOMIC);
554 brcmf_err("brcmf_usb_tx usb_submit_urb FAILED\n");
555 brcmf_usb_del_fromq(devinfo, req);
557 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req,
558 &devinfo->tx_freecount);
562 spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);
563 if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
564 !devinfo->tx_flowblock) {
565 brcmf_txflowblock(dev, true);
566 devinfo->tx_flowblock = true;
568 spin_unlock_irqrestore(&devinfo->tx_flowblock_lock, flags);
576 static int brcmf_usb_up(struct device *dev)
578 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
581 brcmf_dbg(USB, "Enter\n");
582 if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP)
585 /* Success, indicate devinfo is fully up */
586 brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_UP);
588 if (devinfo->ctl_urb) {
589 devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
590 devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
592 ifnum = IFDESC(devinfo->usbdev, CONTROL_IF).bInterfaceNumber;
595 devinfo->ctl_write.bRequestType =
596 USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
597 devinfo->ctl_write.bRequest = 0;
598 devinfo->ctl_write.wValue = cpu_to_le16(0);
599 devinfo->ctl_write.wIndex = cpu_to_le16p(&ifnum);
602 devinfo->ctl_read.bRequestType =
603 USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
604 devinfo->ctl_read.bRequest = 1;
605 devinfo->ctl_read.wValue = cpu_to_le16(0);
606 devinfo->ctl_read.wIndex = cpu_to_le16p(&ifnum);
608 brcmf_usb_rx_fill_all(devinfo);
612 static void brcmf_usb_down(struct device *dev)
614 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
616 brcmf_dbg(USB, "Enter\n");
620 if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN)
623 brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_DOWN);
625 if (devinfo->ctl_urb)
626 usb_kill_urb(devinfo->ctl_urb);
628 if (devinfo->bulk_urb)
629 usb_kill_urb(devinfo->bulk_urb);
630 brcmf_usb_free_q(&devinfo->tx_postq, true);
632 brcmf_usb_free_q(&devinfo->rx_postq, true);
636 brcmf_usb_sync_complete(struct urb *urb)
638 struct brcmf_usbdev_info *devinfo =
639 (struct brcmf_usbdev_info *)urb->context;
641 devinfo->ctl_completed = true;
642 brcmf_usb_ioctl_resp_wake(devinfo);
645 static bool brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
646 void *buffer, int buflen)
652 if ((!devinfo) || (devinfo->ctl_urb == NULL))
655 tmpbuf = kmalloc(buflen, GFP_ATOMIC);
660 devinfo->ctl_urb->transfer_buffer_length = size;
662 devinfo->ctl_read.wLength = cpu_to_le16p(&size);
663 devinfo->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
665 devinfo->ctl_read.bRequest = cmd;
667 usb_fill_control_urb(devinfo->ctl_urb,
669 usb_rcvctrlpipe(devinfo->usbdev, 0),
670 (unsigned char *) &devinfo->ctl_read,
671 (void *) tmpbuf, size,
672 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
674 devinfo->ctl_completed = false;
675 ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
677 brcmf_err("usb_submit_urb failed %d\n", ret);
682 ret = brcmf_usb_ioctl_resp_wait(devinfo);
683 memcpy(buffer, tmpbuf, buflen);
690 brcmf_usb_dlneeded(struct brcmf_usbdev_info *devinfo)
692 struct bootrom_id_le id;
695 brcmf_dbg(USB, "Enter\n");
700 /* Check if firmware downloaded already by querying runtime ID */
701 id.chip = cpu_to_le32(0xDEAD);
702 brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
704 chipid = le32_to_cpu(id.chip);
705 chiprev = le32_to_cpu(id.chiprev);
707 if ((chipid & 0x4300) == 0x4300)
708 brcmf_dbg(USB, "chip %x rev 0x%x\n", chipid, chiprev);
710 brcmf_dbg(USB, "chip %d rev 0x%x\n", chipid, chiprev);
711 if (chipid == BRCMF_POSTBOOT_ID) {
712 brcmf_dbg(USB, "firmware already downloaded\n");
713 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
716 devinfo->bus_pub.devid = chipid;
717 devinfo->bus_pub.chiprev = chiprev;
723 brcmf_usb_resetcfg(struct brcmf_usbdev_info *devinfo)
725 struct bootrom_id_le id;
728 brcmf_dbg(USB, "Enter\n");
732 mdelay(BRCMF_USB_RESET_GETVER_SPINWAIT);
734 id.chip = cpu_to_le32(0xDEAD); /* Get the ID */
735 brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
736 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID))
738 } while (loop_cnt < BRCMF_USB_RESET_GETVER_LOOP_CNT);
740 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID)) {
741 brcmf_dbg(USB, "postboot chip 0x%x/rev 0x%x\n",
742 le32_to_cpu(id.chip), le32_to_cpu(id.chiprev));
744 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
747 brcmf_err("Cannot talk to Dongle. Firmware is not UP, %d ms\n",
748 BRCMF_USB_RESET_GETVER_SPINWAIT * loop_cnt);
755 brcmf_usb_dl_send_bulk(struct brcmf_usbdev_info *devinfo, void *buffer, int len)
759 if ((devinfo == NULL) || (devinfo->bulk_urb == NULL))
762 /* Prepare the URB */
763 usb_fill_bulk_urb(devinfo->bulk_urb, devinfo->usbdev,
764 devinfo->tx_pipe, buffer, len,
765 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
767 devinfo->bulk_urb->transfer_flags |= URB_ZERO_PACKET;
769 devinfo->ctl_completed = false;
770 ret = usb_submit_urb(devinfo->bulk_urb, GFP_ATOMIC);
772 brcmf_err("usb_submit_urb failed %d\n", ret);
775 ret = brcmf_usb_ioctl_resp_wait(devinfo);
780 brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
782 unsigned int sendlen, sent, dllen;
783 char *bulkchunk = NULL, *dlpos;
784 struct rdl_state_le state;
785 u32 rdlstate, rdlbytes;
788 brcmf_dbg(USB, "Enter, fw %p, len %d\n", fw, fwlen);
790 bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
791 if (bulkchunk == NULL) {
796 /* 1) Prepare USB boot loader for runtime image */
797 brcmf_usb_dl_cmd(devinfo, DL_START, &state,
798 sizeof(struct rdl_state_le));
800 rdlstate = le32_to_cpu(state.state);
801 rdlbytes = le32_to_cpu(state.bytes);
803 /* 2) Check we are in the Waiting state */
804 if (rdlstate != DL_WAITING) {
805 brcmf_err("Failed to DL_START\n");
813 /* Get chip id and rev */
814 while (rdlbytes != dllen) {
815 /* Wait until the usb device reports it received all
816 * the bytes we sent */
817 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
818 if ((dllen-sent) < RDL_CHUNK)
819 sendlen = dllen-sent;
823 /* simply avoid having to send a ZLP by ensuring we
831 memcpy(bulkchunk, dlpos, sendlen);
832 if (brcmf_usb_dl_send_bulk(devinfo, bulkchunk,
834 brcmf_err("send_bulk failed\n");
842 if (!brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
843 sizeof(struct rdl_state_le))) {
844 brcmf_err("DL_GETSTATE Failed xxxx\n");
849 rdlstate = le32_to_cpu(state.state);
850 rdlbytes = le32_to_cpu(state.bytes);
852 /* restart if an error is reported */
853 if (rdlstate == DL_BAD_HDR || rdlstate == DL_BAD_CRC) {
854 brcmf_err("Bad Hdr or Bad CRC state %d\n",
863 brcmf_dbg(USB, "Exit, err=%d\n", err);
867 static int brcmf_usb_dlstart(struct brcmf_usbdev_info *devinfo, u8 *fw, int len)
871 brcmf_dbg(USB, "Enter\n");
876 if (devinfo->bus_pub.devid == 0xDEAD)
879 err = brcmf_usb_dl_writeimage(devinfo, fw, len);
881 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_DONE;
883 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_FAIL;
884 brcmf_dbg(USB, "Exit, err=%d\n", err);
889 static int brcmf_usb_dlrun(struct brcmf_usbdev_info *devinfo)
891 struct rdl_state_le state;
893 brcmf_dbg(USB, "Enter\n");
897 if (devinfo->bus_pub.devid == 0xDEAD)
900 /* Check we are runnable */
901 brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
902 sizeof(struct rdl_state_le));
904 /* Start the image */
905 if (state.state == cpu_to_le32(DL_RUNNABLE)) {
906 if (!brcmf_usb_dl_cmd(devinfo, DL_GO, &state,
907 sizeof(struct rdl_state_le)))
909 if (brcmf_usb_resetcfg(devinfo))
911 /* The Dongle may go for re-enumeration. */
913 brcmf_err("Dongle not runnable\n");
916 brcmf_dbg(USB, "Exit\n");
920 static bool brcmf_usb_chip_support(int chipid, int chiprev)
928 return (chiprev == 3);
938 brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
943 brcmf_dbg(USB, "Enter\n");
947 devid = devinfo->bus_pub.devid;
948 chiprev = devinfo->bus_pub.chiprev;
950 if (!brcmf_usb_chip_support(devid, chiprev)) {
951 brcmf_err("unsupported chip %d rev %d\n",
956 if (!devinfo->image) {
957 brcmf_err("No firmware!\n");
961 err = brcmf_usb_dlstart(devinfo,
962 (u8 *)devinfo->image, devinfo->image_len);
964 err = brcmf_usb_dlrun(devinfo);
969 static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
971 brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
974 brcmf_usb_free_q(&devinfo->rx_freeq, false);
975 brcmf_usb_free_q(&devinfo->tx_freeq, false);
977 usb_free_urb(devinfo->ctl_urb);
978 usb_free_urb(devinfo->bulk_urb);
980 kfree(devinfo->tx_reqs);
981 kfree(devinfo->rx_reqs);
984 #define TRX_MAGIC 0x30524448 /* "HDR0" */
985 #define TRX_VERSION 1 /* Version 1 */
986 #define TRX_MAX_LEN 0x3B0000 /* Max length */
987 #define TRX_NO_HEADER 1 /* Do not write TRX header */
988 #define TRX_MAX_OFFSET 3 /* Max number of individual files */
989 #define TRX_UNCOMP_IMAGE 0x20 /* Trx contains uncompressed image */
991 struct trx_header_le {
992 __le32 magic; /* "HDR0" */
993 __le32 len; /* Length of file including header */
994 __le32 crc32; /* CRC from flag_version to end of file */
995 __le32 flag_version; /* 0:15 flags, 16:31 version */
996 __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
1000 static int check_file(const u8 *headers)
1002 struct trx_header_le *trx;
1003 int actual_len = -1;
1005 brcmf_dbg(USB, "Enter\n");
1006 /* Extract trx header */
1007 trx = (struct trx_header_le *) headers;
1008 if (trx->magic != cpu_to_le32(TRX_MAGIC))
1011 headers += sizeof(struct trx_header_le);
1013 if (le32_to_cpu(trx->flag_version) & TRX_UNCOMP_IMAGE) {
1014 actual_len = le32_to_cpu(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]);
1015 return actual_len + sizeof(struct trx_header_le);
1020 static const char *brcmf_usb_get_fwname(struct brcmf_usbdev_info *devinfo)
1022 switch (devinfo->bus_pub.devid) {
1024 return BRCMF_USB_43143_FW_NAME;
1028 return BRCMF_USB_43236_FW_NAME;
1030 return BRCMF_USB_43242_FW_NAME;
1038 struct brcmf_usbdev *brcmf_usb_attach(struct brcmf_usbdev_info *devinfo,
1041 brcmf_dbg(USB, "Enter\n");
1043 devinfo->bus_pub.nrxq = nrxq;
1044 devinfo->rx_low_watermark = nrxq / 2;
1045 devinfo->bus_pub.devinfo = devinfo;
1046 devinfo->bus_pub.ntxq = ntxq;
1047 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DOWN;
1049 /* flow control when too many tx urbs posted */
1050 devinfo->tx_low_watermark = ntxq / 4;
1051 devinfo->tx_high_watermark = devinfo->tx_low_watermark * 3;
1052 devinfo->bus_pub.bus_mtu = BRCMF_USB_MAX_PKT_SIZE;
1054 /* Initialize other structure content */
1055 init_waitqueue_head(&devinfo->ioctl_resp_wait);
1057 /* Initialize the spinlocks */
1058 spin_lock_init(&devinfo->qlock);
1059 spin_lock_init(&devinfo->tx_flowblock_lock);
1061 INIT_LIST_HEAD(&devinfo->rx_freeq);
1062 INIT_LIST_HEAD(&devinfo->rx_postq);
1064 INIT_LIST_HEAD(&devinfo->tx_freeq);
1065 INIT_LIST_HEAD(&devinfo->tx_postq);
1067 devinfo->tx_flowblock = false;
1069 devinfo->rx_reqs = brcmf_usbdev_qinit(&devinfo->rx_freeq, nrxq);
1070 if (!devinfo->rx_reqs)
1073 devinfo->tx_reqs = brcmf_usbdev_qinit(&devinfo->tx_freeq, ntxq);
1074 if (!devinfo->tx_reqs)
1076 devinfo->tx_freecount = ntxq;
1078 devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
1079 if (!devinfo->ctl_urb) {
1080 brcmf_err("usb_alloc_urb (ctl) failed\n");
1083 devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
1084 if (!devinfo->bulk_urb) {
1085 brcmf_err("usb_alloc_urb (bulk) failed\n");
1089 return &devinfo->bus_pub;
1092 brcmf_err("failed!\n");
1093 brcmf_usb_detach(devinfo);
1097 static struct brcmf_bus_ops brcmf_usb_bus_ops = {
1098 .txdata = brcmf_usb_tx,
1099 .stop = brcmf_usb_down,
1100 .txctl = brcmf_usb_tx_ctlpkt,
1101 .rxctl = brcmf_usb_rx_ctlpkt,
1104 static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
1108 /* Attach to the common driver interface */
1109 ret = brcmf_attach(devinfo->dev);
1111 brcmf_err("brcmf_attach failed\n");
1115 ret = brcmf_usb_up(devinfo->dev);
1119 ret = brcmf_bus_start(devinfo->dev);
1125 brcmf_detach(devinfo->dev);
1129 static void brcmf_usb_probe_phase2(struct device *dev,
1130 const struct firmware *fw,
1131 void *nvram, u32 nvlen)
1133 struct brcmf_bus *bus = dev_get_drvdata(dev);
1134 struct brcmf_usbdev_info *devinfo;
1137 brcmf_dbg(USB, "Start fw downloading\n");
1138 ret = check_file(fw->data);
1140 brcmf_err("invalid firmware\n");
1141 release_firmware(fw);
1145 devinfo = bus->bus_priv.usb->devinfo;
1146 devinfo->image = fw->data;
1147 devinfo->image_len = fw->size;
1149 ret = brcmf_usb_fw_download(devinfo);
1150 release_firmware(fw);
1154 ret = brcmf_usb_bus_setup(devinfo);
1160 brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), ret);
1161 device_release_driver(dev);
1164 static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
1166 struct brcmf_bus *bus = NULL;
1167 struct brcmf_usbdev *bus_pub = NULL;
1168 struct device *dev = devinfo->dev;
1171 brcmf_dbg(USB, "Enter\n");
1172 bus_pub = brcmf_usb_attach(devinfo, BRCMF_USB_NRXQ, BRCMF_USB_NTXQ);
1176 bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
1184 bus->bus_priv.usb = bus_pub;
1185 dev_set_drvdata(dev, bus);
1186 bus->ops = &brcmf_usb_bus_ops;
1187 bus->chip = bus_pub->devid;
1188 bus->chiprev = bus_pub->chiprev;
1189 bus->proto_type = BRCMF_PROTO_BCDC;
1190 bus->always_use_fws_queue = true;
1192 if (!brcmf_usb_dlneeded(devinfo)) {
1193 ret = brcmf_usb_bus_setup(devinfo);
1197 /* request firmware here */
1198 brcmf_fw_get_firmwares(dev, 0, brcmf_usb_get_fwname(devinfo), NULL,
1199 brcmf_usb_probe_phase2);
1203 /* Release resources in reverse order */
1205 brcmf_usb_detach(devinfo);
1210 brcmf_usb_disconnect_cb(struct brcmf_usbdev_info *devinfo)
1214 brcmf_dbg(USB, "Enter, bus_pub %p\n", devinfo);
1216 brcmf_detach(devinfo->dev);
1217 kfree(devinfo->bus_pub.bus);
1218 brcmf_usb_detach(devinfo);
1222 brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
1225 struct usb_endpoint_descriptor *endpoint;
1227 struct usb_device *usb = interface_to_usbdev(intf);
1230 struct brcmf_usbdev_info *devinfo;
1232 brcmf_dbg(USB, "Enter\n");
1234 devinfo = kzalloc(sizeof(*devinfo), GFP_ATOMIC);
1235 if (devinfo == NULL)
1238 devinfo->usbdev = usb;
1239 devinfo->dev = &usb->dev;
1241 usb_set_intfdata(intf, devinfo);
1243 /* Check that the device supports only one configuration */
1244 if (usb->descriptor.bNumConfigurations != 1) {
1249 if (usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
1255 * Only the BDC interface configuration is supported:
1256 * Device class: USB_CLASS_VENDOR_SPEC
1257 * if0 class: USB_CLASS_VENDOR_SPEC
1260 * if0/ep2: bulk out (ok if swapped with bulk in)
1262 if (CONFIGDESC(usb)->bNumInterfaces != 1) {
1267 /* Check interface */
1268 if (IFDESC(usb, CONTROL_IF).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
1269 IFDESC(usb, CONTROL_IF).bInterfaceSubClass != 2 ||
1270 IFDESC(usb, CONTROL_IF).bInterfaceProtocol != 0xff) {
1271 brcmf_err("invalid control interface: class %d, subclass %d, proto %d\n",
1272 IFDESC(usb, CONTROL_IF).bInterfaceClass,
1273 IFDESC(usb, CONTROL_IF).bInterfaceSubClass,
1274 IFDESC(usb, CONTROL_IF).bInterfaceProtocol);
1279 /* Check control endpoint */
1280 endpoint = &IFEPDESC(usb, CONTROL_IF, 0);
1281 if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
1282 != USB_ENDPOINT_XFER_INT) {
1283 brcmf_err("invalid control endpoint %d\n",
1284 endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
1289 devinfo->rx_pipe = 0;
1290 devinfo->rx_pipe2 = 0;
1291 devinfo->tx_pipe = 0;
1292 num_of_eps = IFDESC(usb, BULK_IF).bNumEndpoints - 1;
1294 /* Check data endpoints and get pipes */
1295 for (ep = 1; ep <= num_of_eps; ep++) {
1296 endpoint = &IFEPDESC(usb, BULK_IF, ep);
1297 if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
1298 USB_ENDPOINT_XFER_BULK) {
1299 brcmf_err("invalid data endpoint %d\n", ep);
1304 endpoint_num = endpoint->bEndpointAddress &
1305 USB_ENDPOINT_NUMBER_MASK;
1306 if ((endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1308 if (!devinfo->rx_pipe) {
1310 usb_rcvbulkpipe(usb, endpoint_num);
1313 usb_rcvbulkpipe(usb, endpoint_num);
1316 devinfo->tx_pipe = usb_sndbulkpipe(usb, endpoint_num);
1320 if (usb->speed == USB_SPEED_SUPER)
1321 brcmf_dbg(USB, "Broadcom super speed USB wireless device detected\n");
1322 else if (usb->speed == USB_SPEED_HIGH)
1323 brcmf_dbg(USB, "Broadcom high speed USB wireless device detected\n");
1325 brcmf_dbg(USB, "Broadcom full speed USB wireless device detected\n");
1327 ret = brcmf_usb_probe_cb(devinfo);
1335 brcmf_err("failed with errno %d\n", ret);
1337 usb_set_intfdata(intf, NULL);
1343 brcmf_usb_disconnect(struct usb_interface *intf)
1345 struct brcmf_usbdev_info *devinfo;
1347 brcmf_dbg(USB, "Enter\n");
1348 devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf);
1349 brcmf_usb_disconnect_cb(devinfo);
1351 brcmf_dbg(USB, "Exit\n");
1355 * only need to signal the bus being down and update the state.
1357 static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
1359 struct usb_device *usb = interface_to_usbdev(intf);
1360 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1362 brcmf_dbg(USB, "Enter\n");
1363 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_SLEEP;
1364 brcmf_detach(&usb->dev);
1369 * (re-) start the bus.
1371 static int brcmf_usb_resume(struct usb_interface *intf)
1373 struct usb_device *usb = interface_to_usbdev(intf);
1374 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1376 brcmf_dbg(USB, "Enter\n");
1377 return brcmf_usb_bus_setup(devinfo);
1380 static int brcmf_usb_reset_resume(struct usb_interface *intf)
1382 struct usb_device *usb = interface_to_usbdev(intf);
1383 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1384 brcmf_dbg(USB, "Enter\n");
1386 return brcmf_fw_get_firmwares(&usb->dev, 0,
1387 brcmf_usb_get_fwname(devinfo), NULL,
1388 brcmf_usb_probe_phase2);
1391 #define BRCMF_USB_VENDOR_ID_BROADCOM 0x0a5c
1392 #define BRCMF_USB_DEVICE_ID_43143 0xbd1e
1393 #define BRCMF_USB_DEVICE_ID_43236 0xbd17
1394 #define BRCMF_USB_DEVICE_ID_43242 0xbd1f
1395 #define BRCMF_USB_DEVICE_ID_BCMFW 0x0bdc
1397 static struct usb_device_id brcmf_usb_devid_table[] = {
1398 { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43143) },
1399 { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43236) },
1400 { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43242) },
1401 /* special entry for device with firmware loaded and running */
1402 { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
1406 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
1407 MODULE_FIRMWARE(BRCMF_USB_43143_FW_NAME);
1408 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
1409 MODULE_FIRMWARE(BRCMF_USB_43242_FW_NAME);
1411 static struct usb_driver brcmf_usbdrvr = {
1412 .name = KBUILD_MODNAME,
1413 .probe = brcmf_usb_probe,
1414 .disconnect = brcmf_usb_disconnect,
1415 .id_table = brcmf_usb_devid_table,
1416 .suspend = brcmf_usb_suspend,
1417 .resume = brcmf_usb_resume,
1418 .reset_resume = brcmf_usb_reset_resume,
1419 .supports_autosuspend = 1,
1420 .disable_hub_initiated_lpm = 1,
1423 static int brcmf_usb_reset_device(struct device *dev, void *notused)
1425 /* device past is the usb interface so we
1426 * need to use parent here.
1428 brcmf_dev_reset(dev->parent);
1432 void brcmf_usb_exit(void)
1434 struct device_driver *drv = &brcmf_usbdrvr.drvwrap.driver;
1437 brcmf_dbg(USB, "Enter\n");
1438 ret = driver_for_each_device(drv, NULL, NULL,
1439 brcmf_usb_reset_device);
1440 usb_deregister(&brcmf_usbdrvr);
1443 void brcmf_usb_register(void)
1445 brcmf_dbg(USB, "Enter\n");
1446 usb_register(&brcmf_usbdrvr);