drivers/net/wireless/brcm80211/brcmfmac/usb.c

   1 /*
   2  * Copyright (c) 2011 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/kernel.h>
  18 #include <linux/module.h>
  19 #include <linux/firmware.h>
  20 #include <linux/usb.h>
  21 #include <linux/vmalloc.h>
  22
  23 #include <brcmu_utils.h>
  24 #include <brcmu_wifi.h>
  25 #include <dhd_bus.h>
  26 #include <dhd_dbg.h>
  27
  28 #include "usb_rdl.h"
  29 #include "usb.h"
  30
  31 #define IOCTL_RESP_TIMEOUT  2000
  32
  33 #define BRCMF_USB_RESET_GETVER_SPINWAIT 100     /* in unit of ms */
  34 #define BRCMF_USB_RESET_GETVER_LOOP_CNT 10
  35
  36 #define BRCMF_POSTBOOT_ID               0xA123  /* ID to detect if dongle
  37                                                    has boot up */
  38 #define BRCMF_USB_NRXQ  50
  39 #define BRCMF_USB_NTXQ  50
  40
  41 #define CONFIGDESC(usb)         (&((usb)->actconfig)->desc)
  42 #define IFPTR(usb, idx)         ((usb)->actconfig->interface[(idx)])
  43 #define IFALTS(usb, idx)        (IFPTR((usb), (idx))->altsetting[0])
  44 #define IFDESC(usb, idx)        IFALTS((usb), (idx)).desc
  45 #define IFEPDESC(usb, idx, ep)  (IFALTS((usb), (idx)).endpoint[(ep)]).desc
  46
  47 #define CONTROL_IF              0
  48 #define BULK_IF                 0
  49
  50 #define BRCMF_USB_CBCTL_WRITE   0
  51 #define BRCMF_USB_CBCTL_READ    1
  52 #define BRCMF_USB_MAX_PKT_SIZE  1600
  53
  54 #define BRCMF_USB_43143_FW_NAME "brcm/brcmfmac43143.bin"
  55 #define BRCMF_USB_43236_FW_NAME "brcm/brcmfmac43236b.bin"
  56 #define BRCMF_USB_43242_FW_NAME "brcm/brcmfmac43242a.bin"
  57
  58 struct brcmf_usb_image {
  59         struct list_head list;
  60         s8 *fwname;
  61         u8 *image;
  62         int image_len;
  63 };
  64 static struct list_head fw_image_list;
  65
  66 struct intr_transfer_buf {
  67         u32 notification;
  68         u32 reserved;
  69 };
  70
  71 struct brcmf_usbdev_info {
  72         struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
  73         spinlock_t qlock;
  74         struct list_head rx_freeq;
  75         struct list_head rx_postq;
  76         struct list_head tx_freeq;
  77         struct list_head tx_postq;
  78         uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
  79
  80         int rx_low_watermark;
  81         int tx_low_watermark;
  82         int tx_high_watermark;
  83         int tx_freecount;
  84         bool tx_flowblock;
  85
  86         struct brcmf_usbreq *tx_reqs;
  87         struct brcmf_usbreq *rx_reqs;
  88
  89         u8 *image;      /* buffer for combine fw and nvram */
  90         int image_len;
  91
  92         struct usb_device *usbdev;
  93         struct device *dev;
  94
  95         int ctl_in_pipe, ctl_out_pipe;
  96         struct urb *ctl_urb; /* URB for control endpoint */
  97         struct usb_ctrlrequest ctl_write;
  98         struct usb_ctrlrequest ctl_read;
  99         u32 ctl_urb_actual_length;
 100         int ctl_urb_status;
 101         int ctl_completed;
 102         wait_queue_head_t ioctl_resp_wait;
 103         ulong ctl_op;
 104
 105         struct urb *bulk_urb; /* used for FW download */
 106         struct urb *intr_urb; /* URB for interrupt endpoint */
 107         int intr_size;          /* Size of interrupt message */
 108         int interval;           /* Interrupt polling interval */
 109         struct intr_transfer_buf intr; /* Data buffer for interrupt endpoint */
 110 };
 111
 112 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 113                                 struct brcmf_usbreq  *req);
 114
 115 MODULE_AUTHOR("Broadcom Corporation");
 116 MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN fullmac usb driver.");
 117 MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN fullmac usb cards");
 118 MODULE_LICENSE("Dual BSD/GPL");
 119
 120 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
 121 {
 122         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
 123         return bus_if->bus_priv.usb;
 124 }
 125
 126 static struct brcmf_usbdev_info *brcmf_usb_get_businfo(struct device *dev)
 127 {
 128         return brcmf_usb_get_buspub(dev)->devinfo;
 129 }
 130
 131 static int brcmf_usb_ioctl_resp_wait(struct brcmf_usbdev_info *devinfo)
 132 {
 133         return wait_event_timeout(devinfo->ioctl_resp_wait,
 134                                   devinfo->ctl_completed,
 135                                   msecs_to_jiffies(IOCTL_RESP_TIMEOUT));
 136 }
 137
 138 static void brcmf_usb_ioctl_resp_wake(struct brcmf_usbdev_info *devinfo)
 139 {
 140         if (waitqueue_active(&devinfo->ioctl_resp_wait))
 141                 wake_up(&devinfo->ioctl_resp_wait);
 142 }
 143
 144 static void
 145 brcmf_usb_ctl_complete(struct brcmf_usbdev_info *devinfo, int type, int status)
 146 {
 147         brcmf_dbg(USB, "Enter, status=%d\n", status);
 148
 149         if (unlikely(devinfo == NULL))
 150                 return;
 151
 152         if (type == BRCMF_USB_CBCTL_READ) {
 153                 if (status == 0)
 154                         devinfo->bus_pub.stats.rx_ctlpkts++;
 155                 else
 156                         devinfo->bus_pub.stats.rx_ctlerrs++;
 157         } else if (type == BRCMF_USB_CBCTL_WRITE) {
 158                 if (status == 0)
 159                         devinfo->bus_pub.stats.tx_ctlpkts++;
 160                 else
 161                         devinfo->bus_pub.stats.tx_ctlerrs++;
 162         }
 163
 164         devinfo->ctl_urb_status = status;
 165         devinfo->ctl_completed = true;
 166         brcmf_usb_ioctl_resp_wake(devinfo);
 167 }
 168
 169 static void
 170 brcmf_usb_ctlread_complete(struct urb *urb)
 171 {
 172         struct brcmf_usbdev_info *devinfo =
 173                 (struct brcmf_usbdev_info *)urb->context;
 174
 175         brcmf_dbg(USB, "Enter\n");
 176         devinfo->ctl_urb_actual_length = urb->actual_length;
 177         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_READ,
 178                 urb->status);
 179 }
 180
 181 static void
 182 brcmf_usb_ctlwrite_complete(struct urb *urb)
 183 {
 184         struct brcmf_usbdev_info *devinfo =
 185                 (struct brcmf_usbdev_info *)urb->context;
 186
 187         brcmf_dbg(USB, "Enter\n");
 188         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_WRITE,
 189                 urb->status);
 190 }
 191
 192 static int
 193 brcmf_usb_send_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 194 {
 195         int ret;
 196         u16 size;
 197
 198         brcmf_dbg(USB, "Enter\n");
 199         if (devinfo == NULL || buf == NULL ||
 200             len == 0 || devinfo->ctl_urb == NULL)
 201                 return -EINVAL;
 202
 203         size = len;
 204         devinfo->ctl_write.wLength = cpu_to_le16p(&size);
 205         devinfo->ctl_urb->transfer_buffer_length = size;
 206         devinfo->ctl_urb_status = 0;
 207         devinfo->ctl_urb_actual_length = 0;
 208
 209         usb_fill_control_urb(devinfo->ctl_urb,
 210                 devinfo->usbdev,
 211                 devinfo->ctl_out_pipe,
 212                 (unsigned char *) &devinfo->ctl_write,
 213                 buf, size,
 214                 (usb_complete_t)brcmf_usb_ctlwrite_complete,
 215                 devinfo);
 216
 217         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 218         if (ret < 0)
 219                 brcmf_err("usb_submit_urb failed %d\n", ret);
 220
 221         return ret;
 222 }
 223
 224 static int
 225 brcmf_usb_recv_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 226 {
 227         int ret;
 228         u16 size;
 229
 230         brcmf_dbg(USB, "Enter\n");
 231         if ((devinfo == NULL) || (buf == NULL) || (len == 0)
 232                 || (devinfo->ctl_urb == NULL))
 233                 return -EINVAL;
 234
 235         size = len;
 236         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 237         devinfo->ctl_urb->transfer_buffer_length = size;
 238
 239         devinfo->ctl_read.bRequestType = USB_DIR_IN
 240                 | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 241         devinfo->ctl_read.bRequest = 1;
 242
 243         usb_fill_control_urb(devinfo->ctl_urb,
 244                 devinfo->usbdev,
 245                 devinfo->ctl_in_pipe,
 246                 (unsigned char *) &devinfo->ctl_read,
 247                 buf, size,
 248                 (usb_complete_t)brcmf_usb_ctlread_complete,
 249                 devinfo);
 250
 251         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 252         if (ret < 0)
 253                 brcmf_err("usb_submit_urb failed %d\n", ret);
 254
 255         return ret;
 256 }
 257
 258 static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 259 {
 260         int err = 0;
 261         int timeout = 0;
 262         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 263
 264         brcmf_dbg(USB, "Enter\n");
 265         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 266                 return -EIO;
 267
 268         if (test_and_set_bit(0, &devinfo->ctl_op))
 269                 return -EIO;
 270
 271         devinfo->ctl_completed = false;
 272         err = brcmf_usb_send_ctl(devinfo, buf, len);
 273         if (err) {
 274                 brcmf_err("fail %d bytes: %d\n", err, len);
 275                 clear_bit(0, &devinfo->ctl_op);
 276                 return err;
 277         }
 278         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 279         clear_bit(0, &devinfo->ctl_op);
 280         if (!timeout) {
 281                 brcmf_err("Txctl wait timed out\n");
 282                 err = -EIO;
 283         }
 284         return err;
 285 }
 286
 287 static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 288 {
 289         int err = 0;
 290         int timeout = 0;
 291         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 292
 293         brcmf_dbg(USB, "Enter\n");
 294         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 295                 return -EIO;
 296
 297         if (test_and_set_bit(0, &devinfo->ctl_op))
 298                 return -EIO;
 299
 300         devinfo->ctl_completed = false;
 301         err = brcmf_usb_recv_ctl(devinfo, buf, len);
 302         if (err) {
 303                 brcmf_err("fail %d bytes: %d\n", err, len);
 304                 clear_bit(0, &devinfo->ctl_op);
 305                 return err;
 306         }
 307         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 308         err = devinfo->ctl_urb_status;
 309         clear_bit(0, &devinfo->ctl_op);
 310         if (!timeout) {
 311                 brcmf_err("rxctl wait timed out\n");
 312                 err = -EIO;
 313         }
 314         if (!err)
 315                 return devinfo->ctl_urb_actual_length;
 316         else
 317                 return err;
 318 }
 319
 320 static struct brcmf_usbreq *brcmf_usb_deq(struct brcmf_usbdev_info *devinfo,
 321                                           struct list_head *q, int *counter)
 322 {
 323         unsigned long flags;
 324         struct brcmf_usbreq  *req;
 325         spin_lock_irqsave(&devinfo->qlock, flags);
 326         if (list_empty(q)) {
 327                 spin_unlock_irqrestore(&devinfo->qlock, flags);
 328                 return NULL;
 329         }
 330         req = list_entry(q->next, struct brcmf_usbreq, list);
 331         list_del_init(q->next);
 332         if (counter)
 333                 (*counter)--;
 334         spin_unlock_irqrestore(&devinfo->qlock, flags);
 335         return req;
 336
 337 }
 338
 339 static void brcmf_usb_enq(struct brcmf_usbdev_info *devinfo,
 340                           struct list_head *q, struct brcmf_usbreq *req,
 341                           int *counter)
 342 {
 343         unsigned long flags;
 344         spin_lock_irqsave(&devinfo->qlock, flags);
 345         list_add_tail(&req->list, q);
 346         if (counter)
 347                 (*counter)++;
 348         spin_unlock_irqrestore(&devinfo->qlock, flags);
 349 }
 350
 351 static struct brcmf_usbreq *
 352 brcmf_usbdev_qinit(struct list_head *q, int qsize)
 353 {
 354         int i;
 355         struct brcmf_usbreq *req, *reqs;
 356
 357         reqs = kzalloc(sizeof(struct brcmf_usbreq) * qsize, GFP_ATOMIC);
 358         if (reqs == NULL) {
 359                 brcmf_err("fail to allocate memory!\n");
 360                 return NULL;
 361         }
 362         req = reqs;
 363
 364         for (i = 0; i < qsize; i++) {
 365                 req->urb = usb_alloc_urb(0, GFP_ATOMIC);
 366                 if (!req->urb)
 367                         goto fail;
 368
 369                 INIT_LIST_HEAD(&req->list);
 370                 list_add_tail(&req->list, q);
 371                 req++;
 372         }
 373         return reqs;
 374 fail:
 375         brcmf_err("fail!\n");
 376         while (!list_empty(q)) {
 377                 req = list_entry(q->next, struct brcmf_usbreq, list);
 378                 if (req && req->urb)
 379                         usb_free_urb(req->urb);
 380                 list_del(q->next);
 381         }
 382         return NULL;
 383
 384 }
 385
 386 static void brcmf_usb_free_q(struct list_head *q, bool pending)
 387 {
 388         struct brcmf_usbreq *req, *next;
 389         int i = 0;
 390         list_for_each_entry_safe(req, next, q, list) {
 391                 if (!req->urb) {
 392                         brcmf_err("bad req\n");
 393                         break;
 394                 }
 395                 i++;
 396                 if (pending) {
 397                         usb_kill_urb(req->urb);
 398                 } else {
 399                         usb_free_urb(req->urb);
 400                         list_del_init(&req->list);
 401                 }
 402         }
 403 }
 404
 405 static void brcmf_usb_del_fromq(struct brcmf_usbdev_info *devinfo,
 406                                 struct brcmf_usbreq *req)
 407 {
 408         unsigned long flags;
 409
 410         spin_lock_irqsave(&devinfo->qlock, flags);
 411         list_del_init(&req->list);
 412         spin_unlock_irqrestore(&devinfo->qlock, flags);
 413 }
 414
 415
 416 static void brcmf_usb_tx_complete(struct urb *urb)
 417 {
 418         struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
 419         struct brcmf_usbdev_info *devinfo = req->devinfo;
 420
 421         brcmf_dbg(USB, "Enter, urb->status=%d, skb=%p\n", urb->status,
 422                   req->skb);
 423         brcmf_usb_del_fromq(devinfo, req);
 424         if (urb->status == 0)
 425                 devinfo->bus_pub.bus->dstats.tx_packets++;
 426         else
 427                 devinfo->bus_pub.bus->dstats.tx_errors++;
 428
 429         brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
 430
 431         brcmu_pkt_buf_free_skb(req->skb);
 432         req->skb = NULL;
 433         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req, &devinfo->tx_freecount);
 434         if (devinfo->tx_freecount > devinfo->tx_high_watermark &&
 435                 devinfo->tx_flowblock) {
 436                 brcmf_txflowblock(devinfo->dev, false);
 437                 devinfo->tx_flowblock = false;
 438         }
 439 }
 440
 441 static void brcmf_usb_rx_complete(struct urb *urb)
 442 {
 443         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
 444         struct brcmf_usbdev_info *devinfo = req->devinfo;
 445         struct sk_buff *skb;
 446         int ifidx = 0;
 447
 448         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 449         brcmf_usb_del_fromq(devinfo, req);
 450         skb = req->skb;
 451         req->skb = NULL;
 452
 453         if (urb->status == 0) {
 454                 devinfo->bus_pub.bus->dstats.rx_packets++;
 455         } else {
 456                 devinfo->bus_pub.bus->dstats.rx_errors++;
 457                 brcmu_pkt_buf_free_skb(skb);
 458                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 459                 return;
 460         }
 461
 462         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 463                 skb_put(skb, urb->actual_length);
 464                 if (brcmf_proto_hdrpull(devinfo->dev, &ifidx, skb) != 0) {
 465                         brcmf_err("rx protocol error\n");
 466                         brcmu_pkt_buf_free_skb(skb);
 467                         devinfo->bus_pub.bus->dstats.rx_errors++;
 468                 } else
 469                         brcmf_rx_packet(devinfo->dev, ifidx, skb);
 470                 brcmf_usb_rx_refill(devinfo, req);
 471         } else {
 472                 brcmu_pkt_buf_free_skb(skb);
 473                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 474         }
 475         return;
 476
 477 }
 478
 479 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 480                                 struct brcmf_usbreq  *req)
 481 {
 482         struct sk_buff *skb;
 483         int ret;
 484
 485         if (!req || !devinfo)
 486                 return;
 487
 488         skb = dev_alloc_skb(devinfo->bus_pub.bus_mtu);
 489         if (!skb) {
 490                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 491                 return;
 492         }
 493         req->skb = skb;
 494
 495         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
 496                           skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
 497                           req);
 498         req->devinfo = devinfo;
 499         brcmf_usb_enq(devinfo, &devinfo->rx_postq, req, NULL);
 500
 501         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 502         if (ret) {
 503                 brcmf_usb_del_fromq(devinfo, req);
 504                 brcmu_pkt_buf_free_skb(req->skb);
 505                 req->skb = NULL;
 506                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 507         }
 508         return;
 509 }
 510
 511 static void brcmf_usb_rx_fill_all(struct brcmf_usbdev_info *devinfo)
 512 {
 513         struct brcmf_usbreq *req;
 514
 515         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
 516                 brcmf_err("bus is not up=%d\n", devinfo->bus_pub.state);
 517                 return;
 518         }
 519         while ((req = brcmf_usb_deq(devinfo, &devinfo->rx_freeq, NULL)) != NULL)
 520                 brcmf_usb_rx_refill(devinfo, req);
 521 }
 522
 523 static void
 524 brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
 525 {
 526         struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
 527         int old_state;
 528
 529         brcmf_dbg(USB, "Enter, current state=%d, new state=%d\n",
 530                   devinfo->bus_pub.state, state);
 531
 532         if (devinfo->bus_pub.state == state)
 533                 return;
 534
 535         old_state = devinfo->bus_pub.state;
 536         devinfo->bus_pub.state = state;
 537
 538         /* update state of upper layer */
 539         if (state == BRCMFMAC_USB_STATE_DOWN) {
 540                 brcmf_dbg(USB, "DBUS is down\n");
 541                 bcmf_bus->state = BRCMF_BUS_DOWN;
 542         } else if (state == BRCMFMAC_USB_STATE_UP) {
 543                 brcmf_dbg(USB, "DBUS is up\n");
 544                 bcmf_bus->state = BRCMF_BUS_DATA;
 545         } else {
 546                 brcmf_dbg(USB, "DBUS current state=%d\n", state);
 547         }
 548 }
 549
 550 static void
 551 brcmf_usb_intr_complete(struct urb *urb)
 552 {
 553         struct brcmf_usbdev_info *devinfo =
 554                         (struct brcmf_usbdev_info *)urb->context;
 555         int err;
 556
 557         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 558
 559         if (devinfo == NULL)
 560                 return;
 561
 562         if (unlikely(urb->status)) {
 563                 if (urb->status == -ENOENT ||
 564                     urb->status == -ESHUTDOWN ||
 565                     urb->status == -ENODEV) {
 566                         brcmf_usb_state_change(devinfo,
 567                                                BRCMFMAC_USB_STATE_DOWN);
 568                 }
 569         }
 570
 571         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN) {
 572                 brcmf_err("intr cb when DBUS down, ignoring\n");
 573                 return;
 574         }
 575
 576         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 577                 err = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 578                 if (err)
 579                         brcmf_err("usb_submit_urb, err=%d\n", err);
 580         }
 581 }
 582
 583 static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 584 {
 585         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 586         struct brcmf_usbreq  *req;
 587         int ret;
 588
 589         brcmf_dbg(USB, "Enter, skb=%p\n", skb);
 590         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 591                 return -EIO;
 592
 593         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq,
 594                                         &devinfo->tx_freecount);
 595         if (!req) {
 596                 brcmu_pkt_buf_free_skb(skb);
 597                 brcmf_err("no req to send\n");
 598                 return -ENOMEM;
 599         }
 600
 601         req->skb = skb;
 602         req->devinfo = devinfo;
 603         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
 604                           skb->data, skb->len, brcmf_usb_tx_complete, req);
 605         req->urb->transfer_flags |= URB_ZERO_PACKET;
 606         brcmf_usb_enq(devinfo, &devinfo->tx_postq, req, NULL);
 607         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 608         if (ret) {
 609                 brcmf_err("brcmf_usb_tx usb_submit_urb FAILED\n");
 610                 brcmf_usb_del_fromq(devinfo, req);
 611                 brcmu_pkt_buf_free_skb(req->skb);
 612                 req->skb = NULL;
 613                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req,
 614                                                 &devinfo->tx_freecount);
 615         } else {
 616                 if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
 617                         !devinfo->tx_flowblock) {
 618                         brcmf_txflowblock(dev, true);
 619                         devinfo->tx_flowblock = true;
 620                 }
 621         }
 622
 623         return ret;
 624 }
 625
 626
 627 static int brcmf_usb_up(struct device *dev)
 628 {
 629         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 630         u16 ifnum;
 631         int ret;
 632
 633         brcmf_dbg(USB, "Enter\n");
 634         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP)
 635                 return 0;
 636
 637         /* Success, indicate devinfo is fully up */
 638         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_UP);
 639
 640         if (devinfo->intr_urb) {
 641                 usb_fill_int_urb(devinfo->intr_urb, devinfo->usbdev,
 642                         devinfo->intr_pipe,
 643                         &devinfo->intr,
 644                         devinfo->intr_size,
 645                         (usb_complete_t)brcmf_usb_intr_complete,
 646                         devinfo,
 647                         devinfo->interval);
 648
 649                 ret = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 650                 if (ret) {
 651                         brcmf_err("USB_SUBMIT_URB failed with status %d\n",
 652                                   ret);
 653                         return -EINVAL;
 654                 }
 655         }
 656
 657         if (devinfo->ctl_urb) {
 658                 devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
 659                 devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
 660
 661                 ifnum = IFDESC(devinfo->usbdev, CONTROL_IF).bInterfaceNumber;
 662
 663                 /* CTL Write */
 664                 devinfo->ctl_write.bRequestType =
 665                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 666                 devinfo->ctl_write.bRequest = 0;
 667                 devinfo->ctl_write.wValue = cpu_to_le16(0);
 668                 devinfo->ctl_write.wIndex = cpu_to_le16p(&ifnum);
 669
 670                 /* CTL Read */
 671                 devinfo->ctl_read.bRequestType =
 672                         USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 673                 devinfo->ctl_read.bRequest = 1;
 674                 devinfo->ctl_read.wValue = cpu_to_le16(0);
 675                 devinfo->ctl_read.wIndex = cpu_to_le16p(&ifnum);
 676         }
 677         brcmf_usb_rx_fill_all(devinfo);
 678         return 0;
 679 }
 680
 681 static void brcmf_usb_down(struct device *dev)
 682 {
 683         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 684
 685         brcmf_dbg(USB, "Enter\n");
 686         if (devinfo == NULL)
 687                 return;
 688
 689         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN)
 690                 return;
 691
 692         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_DOWN);
 693         if (devinfo->intr_urb)
 694                 usb_kill_urb(devinfo->intr_urb);
 695
 696         if (devinfo->ctl_urb)
 697                 usb_kill_urb(devinfo->ctl_urb);
 698
 699         if (devinfo->bulk_urb)
 700                 usb_kill_urb(devinfo->bulk_urb);
 701         brcmf_usb_free_q(&devinfo->tx_postq, true);
 702
 703         brcmf_usb_free_q(&devinfo->rx_postq, true);
 704 }
 705
 706 static void
 707 brcmf_usb_sync_complete(struct urb *urb)
 708 {
 709         struct brcmf_usbdev_info *devinfo =
 710                         (struct brcmf_usbdev_info *)urb->context;
 711
 712         devinfo->ctl_completed = true;
 713         brcmf_usb_ioctl_resp_wake(devinfo);
 714 }
 715
 716 static bool brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
 717                              void *buffer, int buflen)
 718 {
 719         int ret = 0;
 720         char *tmpbuf;
 721         u16 size;
 722
 723         if ((!devinfo) || (devinfo->ctl_urb == NULL))
 724                 return false;
 725
 726         tmpbuf = kmalloc(buflen, GFP_ATOMIC);
 727         if (!tmpbuf)
 728                 return false;
 729
 730         size = buflen;
 731         devinfo->ctl_urb->transfer_buffer_length = size;
 732
 733         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 734         devinfo->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
 735                 USB_RECIP_INTERFACE;
 736         devinfo->ctl_read.bRequest = cmd;
 737
 738         usb_fill_control_urb(devinfo->ctl_urb,
 739                 devinfo->usbdev,
 740                 usb_rcvctrlpipe(devinfo->usbdev, 0),
 741                 (unsigned char *) &devinfo->ctl_read,
 742                 (void *) tmpbuf, size,
 743                 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 744
 745         devinfo->ctl_completed = false;
 746         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 747         if (ret < 0) {
 748                 brcmf_err("usb_submit_urb failed %d\n", ret);
 749                 kfree(tmpbuf);
 750                 return false;
 751         }
 752
 753         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 754         memcpy(buffer, tmpbuf, buflen);
 755         kfree(tmpbuf);
 756
 757         return ret;
 758 }
 759
 760 static bool
 761 brcmf_usb_dlneeded(struct brcmf_usbdev_info *devinfo)
 762 {
 763         struct bootrom_id_le id;
 764         u32 chipid, chiprev;
 765
 766         brcmf_dbg(USB, "Enter\n");
 767
 768         if (devinfo == NULL)
 769                 return false;
 770
 771         /* Check if firmware downloaded already by querying runtime ID */
 772         id.chip = cpu_to_le32(0xDEAD);
 773         brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 774
 775         chipid = le32_to_cpu(id.chip);
 776         chiprev = le32_to_cpu(id.chiprev);
 777
 778         if ((chipid & 0x4300) == 0x4300)
 779                 brcmf_dbg(USB, "chip %x rev 0x%x\n", chipid, chiprev);
 780         else
 781                 brcmf_dbg(USB, "chip %d rev 0x%x\n", chipid, chiprev);
 782         if (chipid == BRCMF_POSTBOOT_ID) {
 783                 brcmf_dbg(USB, "firmware already downloaded\n");
 784                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 785                 return false;
 786         } else {
 787                 devinfo->bus_pub.devid = chipid;
 788                 devinfo->bus_pub.chiprev = chiprev;
 789         }
 790         return true;
 791 }
 792
 793 static int
 794 brcmf_usb_resetcfg(struct brcmf_usbdev_info *devinfo)
 795 {
 796         struct bootrom_id_le id;
 797         u32 loop_cnt;
 798
 799         brcmf_dbg(USB, "Enter\n");
 800
 801         loop_cnt = 0;
 802         do {
 803                 mdelay(BRCMF_USB_RESET_GETVER_SPINWAIT);
 804                 loop_cnt++;
 805                 id.chip = cpu_to_le32(0xDEAD);       /* Get the ID */
 806                 brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 807                 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID))
 808                         break;
 809         } while (loop_cnt < BRCMF_USB_RESET_GETVER_LOOP_CNT);
 810
 811         if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID)) {
 812                 brcmf_dbg(USB, "postboot chip 0x%x/rev 0x%x\n",
 813                           le32_to_cpu(id.chip), le32_to_cpu(id.chiprev));
 814
 815                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 816                 return 0;
 817         } else {
 818                 brcmf_err("Cannot talk to Dongle. Firmware is not UP, %d ms\n",
 819                           BRCMF_USB_RESET_GETVER_SPINWAIT * loop_cnt);
 820                 return -EINVAL;
 821         }
 822 }
 823
 824
 825 static int
 826 brcmf_usb_dl_send_bulk(struct brcmf_usbdev_info *devinfo, void *buffer, int len)
 827 {
 828         int ret;
 829
 830         if ((devinfo == NULL) || (devinfo->bulk_urb == NULL))
 831                 return -EINVAL;
 832
 833         /* Prepare the URB */
 834         usb_fill_bulk_urb(devinfo->bulk_urb, devinfo->usbdev,
 835                           devinfo->tx_pipe, buffer, len,
 836                           (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 837
 838         devinfo->bulk_urb->transfer_flags |= URB_ZERO_PACKET;
 839
 840         devinfo->ctl_completed = false;
 841         ret = usb_submit_urb(devinfo->bulk_urb, GFP_ATOMIC);
 842         if (ret) {
 843                 brcmf_err("usb_submit_urb failed %d\n", ret);
 844                 return ret;
 845         }
 846         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 847         return (ret == 0);
 848 }
 849
 850 static int
 851 brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
 852 {
 853         unsigned int sendlen, sent, dllen;
 854         char *bulkchunk = NULL, *dlpos;
 855         struct rdl_state_le state;
 856         u32 rdlstate, rdlbytes;
 857         int err = 0;
 858
 859         brcmf_dbg(USB, "Enter, fw %p, len %d\n", fw, fwlen);
 860
 861         bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
 862         if (bulkchunk == NULL) {
 863                 err = -ENOMEM;
 864                 goto fail;
 865         }
 866
 867         /* 1) Prepare USB boot loader for runtime image */
 868         brcmf_usb_dl_cmd(devinfo, DL_START, &state,
 869                          sizeof(struct rdl_state_le));
 870
 871         rdlstate = le32_to_cpu(state.state);
 872         rdlbytes = le32_to_cpu(state.bytes);
 873
 874         /* 2) Check we are in the Waiting state */
 875         if (rdlstate != DL_WAITING) {
 876                 brcmf_err("Failed to DL_START\n");
 877                 err = -EINVAL;
 878                 goto fail;
 879         }
 880         sent = 0;
 881         dlpos = fw;
 882         dllen = fwlen;
 883
 884         /* Get chip id and rev */
 885         while (rdlbytes != dllen) {
 886                 /* Wait until the usb device reports it received all
 887                  * the bytes we sent */
 888                 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
 889                         if ((dllen-sent) < RDL_CHUNK)
 890                                 sendlen = dllen-sent;
 891                         else
 892                                 sendlen = RDL_CHUNK;
 893
 894                         /* simply avoid having to send a ZLP by ensuring we
 895                          * never have an even
 896                          * multiple of 64
 897                          */
 898                         if (!(sendlen % 64))
 899                                 sendlen -= 4;
 900
 901                         /* send data */
 902                         memcpy(bulkchunk, dlpos, sendlen);
 903                         if (brcmf_usb_dl_send_bulk(devinfo, bulkchunk,
 904                                                    sendlen)) {
 905                                 brcmf_err("send_bulk failed\n");
 906                                 err = -EINVAL;
 907                                 goto fail;
 908                         }
 909
 910                         dlpos += sendlen;
 911                         sent += sendlen;
 912                 }
 913                 if (!brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 914                                       sizeof(struct rdl_state_le))) {
 915                         brcmf_err("DL_GETSTATE Failed xxxx\n");
 916                         err = -EINVAL;
 917                         goto fail;
 918                 }
 919
 920                 rdlstate = le32_to_cpu(state.state);
 921                 rdlbytes = le32_to_cpu(state.bytes);
 922
 923                 /* restart if an error is reported */
 924                 if (rdlstate == DL_BAD_HDR || rdlstate == DL_BAD_CRC) {
 925                         brcmf_err("Bad Hdr or Bad CRC state %d\n",
 926                                   rdlstate);
 927                         err = -EINVAL;
 928                         goto fail;
 929                 }
 930         }
 931
 932 fail:
 933         kfree(bulkchunk);
 934         brcmf_dbg(USB, "Exit, err=%d\n", err);
 935         return err;
 936 }
 937
 938 static int brcmf_usb_dlstart(struct brcmf_usbdev_info *devinfo, u8 *fw, int len)
 939 {
 940         int err;
 941
 942         brcmf_dbg(USB, "Enter\n");
 943
 944         if (devinfo == NULL)
 945                 return -EINVAL;
 946
 947         if (devinfo->bus_pub.devid == 0xDEAD)
 948                 return -EINVAL;
 949
 950         err = brcmf_usb_dl_writeimage(devinfo, fw, len);
 951         if (err == 0)
 952                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_DONE;
 953         else
 954                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_FAIL;
 955         brcmf_dbg(USB, "Exit, err=%d\n", err);
 956
 957         return err;
 958 }
 959
 960 static int brcmf_usb_dlrun(struct brcmf_usbdev_info *devinfo)
 961 {
 962         struct rdl_state_le state;
 963
 964         brcmf_dbg(USB, "Enter\n");
 965         if (!devinfo)
 966                 return -EINVAL;
 967
 968         if (devinfo->bus_pub.devid == 0xDEAD)
 969                 return -EINVAL;
 970
 971         /* Check we are runnable */
 972         brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 973                 sizeof(struct rdl_state_le));
 974
 975         /* Start the image */
 976         if (state.state == cpu_to_le32(DL_RUNNABLE)) {
 977                 if (!brcmf_usb_dl_cmd(devinfo, DL_GO, &state,
 978                         sizeof(struct rdl_state_le)))
 979                         return -ENODEV;
 980                 if (brcmf_usb_resetcfg(devinfo))
 981                         return -ENODEV;
 982                 /* The Dongle may go for re-enumeration. */
 983         } else {
 984                 brcmf_err("Dongle not runnable\n");
 985                 return -EINVAL;
 986         }
 987         brcmf_dbg(USB, "Exit\n");
 988         return 0;
 989 }
 990
 991 static bool brcmf_usb_chip_support(int chipid, int chiprev)
 992 {
 993         switch(chipid) {
 994         case 43143:
 995                 return true;
 996         case 43235:
 997         case 43236:
 998         case 43238:
 999                 return (chiprev == 3);
1000         case 43242:
1001                 return true;
1002         default:
1003                 break;
1004         }
1005         return false;
1006 }
1007
1008 static int
1009 brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
1010 {
1011         int devid, chiprev;
1012         int err;
1013
1014         brcmf_dbg(USB, "Enter\n");
1015         if (devinfo == NULL)
1016                 return -ENODEV;
1017
1018         devid = devinfo->bus_pub.devid;
1019         chiprev = devinfo->bus_pub.chiprev;
1020
1021         if (!brcmf_usb_chip_support(devid, chiprev)) {
1022                 brcmf_err("unsupported chip %d rev %d\n",
1023                           devid, chiprev);
1024                 return -EINVAL;
1025         }
1026
1027         if (!devinfo->image) {
1028                 brcmf_err("No firmware!\n");
1029                 return -ENOENT;
1030         }
1031
1032         err = brcmf_usb_dlstart(devinfo,
1033                 devinfo->image, devinfo->image_len);
1034         if (err == 0)
1035                 err = brcmf_usb_dlrun(devinfo);
1036         return err;
1037 }
1038
1039
1040 static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
1041 {
1042         brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
1043
1044         /* free the URBS */
1045         brcmf_usb_free_q(&devinfo->rx_freeq, false);
1046         brcmf_usb_free_q(&devinfo->tx_freeq, false);
1047
1048         usb_free_urb(devinfo->intr_urb);
1049         usb_free_urb(devinfo->ctl_urb);
1050         usb_free_urb(devinfo->bulk_urb);
1051
1052         kfree(devinfo->tx_reqs);
1053         kfree(devinfo->rx_reqs);
1054 }
1055
1056 #define TRX_MAGIC       0x30524448      /* "HDR0" */
1057 #define TRX_VERSION     1               /* Version 1 */
1058 #define TRX_MAX_LEN     0x3B0000        /* Max length */
1059 #define TRX_NO_HEADER   1               /* Do not write TRX header */
1060 #define TRX_MAX_OFFSET  3               /* Max number of individual files */
1061 #define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed image */
1062
1063 struct trx_header_le {
1064         __le32 magic;           /* "HDR0" */
1065         __le32 len;             /* Length of file including header */
1066         __le32 crc32;           /* CRC from flag_version to end of file */
1067         __le32 flag_version;    /* 0:15 flags, 16:31 version */
1068         __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
1069                                          * header */
1070 };
1071
1072 static int check_file(const u8 *headers)
1073 {
1074         struct trx_header_le *trx;
1075         int actual_len = -1;
1076
1077         brcmf_dbg(USB, "Enter\n");
1078         /* Extract trx header */
1079         trx = (struct trx_header_le *) headers;
1080         if (trx->magic != cpu_to_le32(TRX_MAGIC))
1081                 return -1;
1082
1083         headers += sizeof(struct trx_header_le);
1084
1085         if (le32_to_cpu(trx->flag_version) & TRX_UNCOMP_IMAGE) {
1086                 actual_len = le32_to_cpu(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]);
1087                 return actual_len + sizeof(struct trx_header_le);
1088         }
1089         return -1;
1090 }
1091
1092 static int brcmf_usb_get_fw(struct brcmf_usbdev_info *devinfo)
1093 {
1094         s8 *fwname;
1095         const struct firmware *fw;
1096         struct brcmf_usb_image *fw_image;
1097         int err;
1098
1099         brcmf_dbg(USB, "Enter\n");
1100         switch (devinfo->bus_pub.devid) {
1101         case 43143:
1102                 fwname = BRCMF_USB_43143_FW_NAME;
1103                 break;
1104         case 43235:
1105         case 43236:
1106         case 43238:
1107                 fwname = BRCMF_USB_43236_FW_NAME;
1108                 break;
1109         case 43242:
1110                 fwname = BRCMF_USB_43242_FW_NAME;
1111                 break;
1112         default:
1113                 return -EINVAL;
1114                 break;
1115         }
1116         brcmf_dbg(USB, "Loading FW %s\n", fwname);
1117         list_for_each_entry(fw_image, &fw_image_list, list) {
1118                 if (fw_image->fwname == fwname) {
1119                         devinfo->image = fw_image->image;
1120                         devinfo->image_len = fw_image->image_len;
1121                         return 0;
1122                 }
1123         }
1124         /* fw image not yet loaded. Load it now and add to list */
1125         err = request_firmware(&fw, fwname, devinfo->dev);
1126         if (!fw) {
1127                 brcmf_err("fail to request firmware %s\n", fwname);
1128                 return err;
1129         }
1130         if (check_file(fw->data) < 0) {
1131                 brcmf_err("invalid firmware %s\n", fwname);
1132                 return -EINVAL;
1133         }
1134
1135         fw_image = kzalloc(sizeof(*fw_image), GFP_ATOMIC);
1136         if (!fw_image)
1137                 return -ENOMEM;
1138         INIT_LIST_HEAD(&fw_image->list);
1139         list_add_tail(&fw_image->list, &fw_image_list);
1140         fw_image->fwname = fwname;
1141         fw_image->image = vmalloc(fw->size);
1142         if (!fw_image->image)
1143                 return -ENOMEM;
1144
1145         memcpy(fw_image->image, fw->data, fw->size);
1146         fw_image->image_len = fw->size;
1147
1148         release_firmware(fw);
1149
1150         devinfo->image = fw_image->image;
1151         devinfo->image_len = fw_image->image_len;
1152
1153         return 0;
1154 }
1155
1156
1157 static
1158 struct brcmf_usbdev *brcmf_usb_attach(struct brcmf_usbdev_info *devinfo,
1159                                       int nrxq, int ntxq)
1160 {
1161         brcmf_dbg(USB, "Enter\n");
1162
1163         devinfo->bus_pub.nrxq = nrxq;
1164         devinfo->rx_low_watermark = nrxq / 2;
1165         devinfo->bus_pub.devinfo = devinfo;
1166         devinfo->bus_pub.ntxq = ntxq;
1167         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DOWN;
1168
1169         /* flow control when too many tx urbs posted */
1170         devinfo->tx_low_watermark = ntxq / 4;
1171         devinfo->tx_high_watermark = devinfo->tx_low_watermark * 3;
1172         devinfo->bus_pub.bus_mtu = BRCMF_USB_MAX_PKT_SIZE;
1173
1174         /* Initialize other structure content */
1175         init_waitqueue_head(&devinfo->ioctl_resp_wait);
1176
1177         /* Initialize the spinlocks */
1178         spin_lock_init(&devinfo->qlock);
1179
1180         INIT_LIST_HEAD(&devinfo->rx_freeq);
1181         INIT_LIST_HEAD(&devinfo->rx_postq);
1182
1183         INIT_LIST_HEAD(&devinfo->tx_freeq);
1184         INIT_LIST_HEAD(&devinfo->tx_postq);
1185
1186         devinfo->tx_flowblock = false;
1187
1188         devinfo->rx_reqs = brcmf_usbdev_qinit(&devinfo->rx_freeq, nrxq);
1189         if (!devinfo->rx_reqs)
1190                 goto error;
1191
1192         devinfo->tx_reqs = brcmf_usbdev_qinit(&devinfo->tx_freeq, ntxq);
1193         if (!devinfo->tx_reqs)
1194                 goto error;
1195         devinfo->tx_freecount = ntxq;
1196
1197         devinfo->intr_urb = usb_alloc_urb(0, GFP_ATOMIC);
1198         if (!devinfo->intr_urb) {
1199                 brcmf_err("usb_alloc_urb (intr) failed\n");
1200                 goto error;
1201         }
1202         devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
1203         if (!devinfo->ctl_urb) {
1204                 brcmf_err("usb_alloc_urb (ctl) failed\n");
1205                 goto error;
1206         }
1207         devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
1208         if (!devinfo->bulk_urb) {
1209                 brcmf_err("usb_alloc_urb (bulk) failed\n");
1210                 goto error;
1211         }
1212
1213         if (!brcmf_usb_dlneeded(devinfo))
1214                 return &devinfo->bus_pub;
1215
1216         brcmf_dbg(USB, "Start fw downloading\n");
1217         if (brcmf_usb_get_fw(devinfo))
1218                 goto error;
1219
1220         if (brcmf_usb_fw_download(devinfo))
1221                 goto error;
1222
1223         return &devinfo->bus_pub;
1224
1225 error:
1226         brcmf_err("failed!\n");
1227         brcmf_usb_detach(devinfo);
1228         return NULL;
1229 }
1230
1231 static struct brcmf_bus_ops brcmf_usb_bus_ops = {
1232         .txdata = brcmf_usb_tx,
1233         .init = brcmf_usb_up,
1234         .stop = brcmf_usb_down,
1235         .txctl = brcmf_usb_tx_ctlpkt,
1236         .rxctl = brcmf_usb_rx_ctlpkt,
1237 };
1238
1239 static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
1240 {
1241         struct brcmf_bus *bus = NULL;
1242         struct brcmf_usbdev *bus_pub = NULL;
1243         int ret;
1244         struct device *dev = devinfo->dev;
1245
1246         brcmf_dbg(USB, "Enter\n");
1247         bus_pub = brcmf_usb_attach(devinfo, BRCMF_USB_NRXQ, BRCMF_USB_NTXQ);
1248         if (!bus_pub)
1249                 return -ENODEV;
1250
1251         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
1252         if (!bus) {
1253                 ret = -ENOMEM;
1254                 goto fail;
1255         }
1256
1257         bus->dev = dev;
1258         bus_pub->bus = bus;
1259         bus->bus_priv.usb = bus_pub;
1260         dev_set_drvdata(dev, bus);
1261         bus->ops = &brcmf_usb_bus_ops;
1262
1263         /* Attach to the common driver interface */
1264         ret = brcmf_attach(0, dev);
1265         if (ret) {
1266                 brcmf_err("brcmf_attach failed\n");
1267                 goto fail;
1268         }
1269
1270         ret = brcmf_bus_start(dev);
1271         if (ret) {
1272                 brcmf_err("dongle is not responding\n");
1273                 brcmf_detach(dev);
1274                 goto fail;
1275         }
1276
1277         return 0;
1278 fail:
1279         /* Release resources in reverse order */
1280         kfree(bus);
1281         brcmf_usb_detach(devinfo);
1282         return ret;
1283 }
1284
1285 static void
1286 brcmf_usb_disconnect_cb(struct brcmf_usbdev_info *devinfo)
1287 {
1288         if (!devinfo)
1289                 return;
1290         brcmf_dbg(USB, "Enter, bus_pub %p\n", devinfo);
1291
1292         brcmf_detach(devinfo->dev);
1293         kfree(devinfo->bus_pub.bus);
1294         brcmf_usb_detach(devinfo);
1295 }
1296
1297 static int
1298 brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
1299 {
1300         int ep;
1301         struct usb_endpoint_descriptor *endpoint;
1302         int ret = 0;
1303         struct usb_device *usb = interface_to_usbdev(intf);
1304         int num_of_eps;
1305         u8 endpoint_num;
1306         struct brcmf_usbdev_info *devinfo;
1307
1308         brcmf_dbg(USB, "Enter\n");
1309
1310         devinfo = kzalloc(sizeof(*devinfo), GFP_ATOMIC);
1311         if (devinfo == NULL)
1312                 return -ENOMEM;
1313
1314         devinfo->usbdev = usb;
1315         devinfo->dev = &usb->dev;
1316
1317         usb_set_intfdata(intf, devinfo);
1318
1319         /* Check that the device supports only one configuration */
1320         if (usb->descriptor.bNumConfigurations != 1) {
1321                 ret = -1;
1322                 goto fail;
1323         }
1324
1325         if (usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
1326                 ret = -1;
1327                 goto fail;
1328         }
1329
1330         /*
1331          * Only the BDC interface configuration is supported:
1332          *      Device class: USB_CLASS_VENDOR_SPEC
1333          *      if0 class: USB_CLASS_VENDOR_SPEC
1334          *      if0/ep0: control
1335          *      if0/ep1: bulk in
1336          *      if0/ep2: bulk out (ok if swapped with bulk in)
1337          */
1338         if (CONFIGDESC(usb)->bNumInterfaces != 1) {
1339                 ret = -1;
1340                 goto fail;
1341         }
1342
1343         /* Check interface */
1344         if (IFDESC(usb, CONTROL_IF).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
1345             IFDESC(usb, CONTROL_IF).bInterfaceSubClass != 2 ||
1346             IFDESC(usb, CONTROL_IF).bInterfaceProtocol != 0xff) {
1347                 brcmf_err("invalid control interface: class %d, subclass %d, proto %d\n",
1348                           IFDESC(usb, CONTROL_IF).bInterfaceClass,
1349                           IFDESC(usb, CONTROL_IF).bInterfaceSubClass,
1350                           IFDESC(usb, CONTROL_IF).bInterfaceProtocol);
1351                 ret = -1;
1352                 goto fail;
1353         }
1354
1355         /* Check control endpoint */
1356         endpoint = &IFEPDESC(usb, CONTROL_IF, 0);
1357         if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
1358                 != USB_ENDPOINT_XFER_INT) {
1359                 brcmf_err("invalid control endpoint %d\n",
1360                           endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
1361                 ret = -1;
1362                 goto fail;
1363         }
1364
1365         endpoint_num = endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
1366         devinfo->intr_pipe = usb_rcvintpipe(usb, endpoint_num);
1367
1368         devinfo->rx_pipe = 0;
1369         devinfo->rx_pipe2 = 0;
1370         devinfo->tx_pipe = 0;
1371         num_of_eps = IFDESC(usb, BULK_IF).bNumEndpoints - 1;
1372
1373         /* Check data endpoints and get pipes */
1374         for (ep = 1; ep <= num_of_eps; ep++) {
1375                 endpoint = &IFEPDESC(usb, BULK_IF, ep);
1376                 if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
1377                     USB_ENDPOINT_XFER_BULK) {
1378                         brcmf_err("invalid data endpoint %d\n", ep);
1379                         ret = -1;
1380                         goto fail;
1381                 }
1382
1383                 endpoint_num = endpoint->bEndpointAddress &
1384                                USB_ENDPOINT_NUMBER_MASK;
1385                 if ((endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1386                         == USB_DIR_IN) {
1387                         if (!devinfo->rx_pipe) {
1388                                 devinfo->rx_pipe =
1389                                         usb_rcvbulkpipe(usb, endpoint_num);
1390                         } else {
1391                                 devinfo->rx_pipe2 =
1392                                         usb_rcvbulkpipe(usb, endpoint_num);
1393                         }
1394                 } else {
1395                         devinfo->tx_pipe = usb_sndbulkpipe(usb, endpoint_num);
1396                 }
1397         }
1398
1399         /* Allocate interrupt URB and data buffer */
1400         /* RNDIS says 8-byte intr, our old drivers used 4-byte */
1401         if (IFEPDESC(usb, CONTROL_IF, 0).wMaxPacketSize == cpu_to_le16(16))
1402                 devinfo->intr_size = 8;
1403         else
1404                 devinfo->intr_size = 4;
1405
1406         devinfo->interval = IFEPDESC(usb, CONTROL_IF, 0).bInterval;
1407
1408         if (usb->speed == USB_SPEED_HIGH)
1409                 brcmf_dbg(USB, "Broadcom high speed USB wireless device detected\n");
1410         else
1411                 brcmf_dbg(USB, "Broadcom full speed USB wireless device detected\n");
1412
1413         ret = brcmf_usb_probe_cb(devinfo);
1414         if (ret)
1415                 goto fail;
1416
1417         /* Success */
1418         return 0;
1419
1420 fail:
1421         brcmf_err("failed with errno %d\n", ret);
1422         kfree(devinfo);
1423         usb_set_intfdata(intf, NULL);
1424         return ret;
1425
1426 }
1427
1428 static void
1429 brcmf_usb_disconnect(struct usb_interface *intf)
1430 {
1431         struct brcmf_usbdev_info *devinfo;
1432
1433         brcmf_dbg(USB, "Enter\n");
1434         devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf);
1435         brcmf_usb_disconnect_cb(devinfo);
1436         kfree(devinfo);
1437         brcmf_dbg(USB, "Exit\n");
1438 }
1439
1440 /*
1441  * only need to signal the bus being down and update the state.
1442  */
1443 static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
1444 {
1445         struct usb_device *usb = interface_to_usbdev(intf);
1446         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1447
1448         brcmf_dbg(USB, "Enter\n");
1449         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_SLEEP;
1450         brcmf_detach(&usb->dev);
1451         return 0;
1452 }
1453
1454 /*
1455  * (re-) start the bus.
1456  */
1457 static int brcmf_usb_resume(struct usb_interface *intf)
1458 {
1459         struct usb_device *usb = interface_to_usbdev(intf);
1460         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1461
1462         brcmf_dbg(USB, "Enter\n");
1463         if (!brcmf_attach(0, devinfo->dev))
1464                 return brcmf_bus_start(&usb->dev);
1465
1466         return 0;
1467 }
1468
1469 static int brcmf_usb_reset_resume(struct usb_interface *intf)
1470 {
1471         struct usb_device *usb = interface_to_usbdev(intf);
1472         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1473
1474         brcmf_dbg(USB, "Enter\n");
1475
1476         if (!brcmf_usb_fw_download(devinfo))
1477                 return brcmf_usb_resume(intf);
1478
1479         return -EIO;
1480 }
1481
1482 #define BRCMF_USB_VENDOR_ID_BROADCOM    0x0a5c
1483 #define BRCMF_USB_DEVICE_ID_43143       0xbd1e
1484 #define BRCMF_USB_DEVICE_ID_43236       0xbd17
1485 #define BRCMF_USB_DEVICE_ID_43242       0xbd1f
1486 #define BRCMF_USB_DEVICE_ID_BCMFW       0x0bdc
1487
1488 static struct usb_device_id brcmf_usb_devid_table[] = {
1489         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43143) },
1490         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43236) },
1491         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43242) },
1492         /* special entry for device with firmware loaded and running */
1493         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
1494         { }
1495 };
1496 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
1497 MODULE_FIRMWARE(BRCMF_USB_43143_FW_NAME);
1498 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
1499 MODULE_FIRMWARE(BRCMF_USB_43242_FW_NAME);
1500
1501 static struct usb_driver brcmf_usbdrvr = {
1502         .name = KBUILD_MODNAME,
1503         .probe = brcmf_usb_probe,
1504         .disconnect = brcmf_usb_disconnect,
1505         .id_table = brcmf_usb_devid_table,
1506         .suspend = brcmf_usb_suspend,
1507         .resume = brcmf_usb_resume,
1508         .reset_resume = brcmf_usb_reset_resume,
1509         .supports_autosuspend = 1,
1510         .disable_hub_initiated_lpm = 1,
1511 };
1512
1513 static void brcmf_release_fw(struct list_head *q)
1514 {
1515         struct brcmf_usb_image *fw_image, *next;
1516
1517         list_for_each_entry_safe(fw_image, next, q, list) {
1518                 vfree(fw_image->image);
1519                 list_del_init(&fw_image->list);
1520         }
1521 }
1522
1523
1524 void brcmf_usb_exit(void)
1525 {
1526         brcmf_dbg(USB, "Enter\n");
1527         usb_deregister(&brcmf_usbdrvr);
1528         brcmf_release_fw(&fw_image_list);
1529 }
1530
1531 void brcmf_usb_init(void)
1532 {
1533         brcmf_dbg(USB, "Enter\n");
1534         INIT_LIST_HEAD(&fw_image_list);
1535         usb_register(&brcmf_usbdrvr);
1536 }