drivers/net/wireless/brcm80211/brcmfmac/usb.c

   1 /*
   2  * Copyright (c) 2011 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/kernel.h>
  18 #include <linux/module.h>
  19 #include <linux/firmware.h>
  20 #include <linux/usb.h>
  21 #include <linux/vmalloc.h>
  22
  23 #include <brcmu_utils.h>
  24 #include <brcmu_wifi.h>
  25 #include <dhd_bus.h>
  26 #include <dhd_dbg.h>
  27
  28 #include "usb_rdl.h"
  29 #include "usb.h"
  30
  31 #define IOCTL_RESP_TIMEOUT  2000
  32
  33 #define BRCMF_USB_RESET_GETVER_SPINWAIT 100     /* in unit of ms */
  34 #define BRCMF_USB_RESET_GETVER_LOOP_CNT 10
  35
  36 #define BRCMF_POSTBOOT_ID               0xA123  /* ID to detect if dongle
  37                                                    has boot up */
  38 #define BRCMF_USB_NRXQ  50
  39 #define BRCMF_USB_NTXQ  50
  40
  41 #define CONFIGDESC(usb)         (&((usb)->actconfig)->desc)
  42 #define IFPTR(usb, idx)         ((usb)->actconfig->interface[(idx)])
  43 #define IFALTS(usb, idx)        (IFPTR((usb), (idx))->altsetting[0])
  44 #define IFDESC(usb, idx)        IFALTS((usb), (idx)).desc
  45 #define IFEPDESC(usb, idx, ep)  (IFALTS((usb), (idx)).endpoint[(ep)]).desc
  46
  47 #define CONTROL_IF              0
  48 #define BULK_IF                 0
  49
  50 #define BRCMF_USB_CBCTL_WRITE   0
  51 #define BRCMF_USB_CBCTL_READ    1
  52 #define BRCMF_USB_MAX_PKT_SIZE  1600
  53
  54 #define BRCMF_USB_43143_FW_NAME "brcm/brcmfmac43143.bin"
  55 #define BRCMF_USB_43236_FW_NAME "brcm/brcmfmac43236b.bin"
  56 #define BRCMF_USB_43242_FW_NAME "brcm/brcmfmac43242a.bin"
  57
  58 struct brcmf_usb_image {
  59         struct list_head list;
  60         s8 *fwname;
  61         u8 *image;
  62         int image_len;
  63 };
  64 static struct list_head fw_image_list;
  65
  66 struct intr_transfer_buf {
  67         u32 notification;
  68         u32 reserved;
  69 };
  70
  71 struct brcmf_usbdev_info {
  72         struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
  73         spinlock_t qlock;
  74         struct list_head rx_freeq;
  75         struct list_head rx_postq;
  76         struct list_head tx_freeq;
  77         struct list_head tx_postq;
  78         uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
  79
  80         int rx_low_watermark;
  81         int tx_low_watermark;
  82         int tx_high_watermark;
  83         int tx_freecount;
  84         bool tx_flowblock;
  85
  86         struct brcmf_usbreq *tx_reqs;
  87         struct brcmf_usbreq *rx_reqs;
  88
  89         u8 *image;      /* buffer for combine fw and nvram */
  90         int image_len;
  91
  92         struct usb_device *usbdev;
  93         struct device *dev;
  94
  95         int ctl_in_pipe, ctl_out_pipe;
  96         struct urb *ctl_urb; /* URB for control endpoint */
  97         struct usb_ctrlrequest ctl_write;
  98         struct usb_ctrlrequest ctl_read;
  99         u32 ctl_urb_actual_length;
 100         int ctl_urb_status;
 101         int ctl_completed;
 102         wait_queue_head_t ioctl_resp_wait;
 103         ulong ctl_op;
 104
 105         struct urb *bulk_urb; /* used for FW download */
 106         struct urb *intr_urb; /* URB for interrupt endpoint */
 107         int intr_size;          /* Size of interrupt message */
 108         int interval;           /* Interrupt polling interval */
 109         struct intr_transfer_buf intr; /* Data buffer for interrupt endpoint */
 110 };
 111
 112 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 113                                 struct brcmf_usbreq  *req);
 114
 115 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
 116 {
 117         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
 118         return bus_if->bus_priv.usb;
 119 }
 120
 121 static struct brcmf_usbdev_info *brcmf_usb_get_businfo(struct device *dev)
 122 {
 123         return brcmf_usb_get_buspub(dev)->devinfo;
 124 }
 125
 126 static int brcmf_usb_ioctl_resp_wait(struct brcmf_usbdev_info *devinfo)
 127 {
 128         return wait_event_timeout(devinfo->ioctl_resp_wait,
 129                                   devinfo->ctl_completed,
 130                                   msecs_to_jiffies(IOCTL_RESP_TIMEOUT));
 131 }
 132
 133 static void brcmf_usb_ioctl_resp_wake(struct brcmf_usbdev_info *devinfo)
 134 {
 135         if (waitqueue_active(&devinfo->ioctl_resp_wait))
 136                 wake_up(&devinfo->ioctl_resp_wait);
 137 }
 138
 139 static void
 140 brcmf_usb_ctl_complete(struct brcmf_usbdev_info *devinfo, int type, int status)
 141 {
 142         brcmf_dbg(USB, "Enter, status=%d\n", status);
 143
 144         if (unlikely(devinfo == NULL))
 145                 return;
 146
 147         if (type == BRCMF_USB_CBCTL_READ) {
 148                 if (status == 0)
 149                         devinfo->bus_pub.stats.rx_ctlpkts++;
 150                 else
 151                         devinfo->bus_pub.stats.rx_ctlerrs++;
 152         } else if (type == BRCMF_USB_CBCTL_WRITE) {
 153                 if (status == 0)
 154                         devinfo->bus_pub.stats.tx_ctlpkts++;
 155                 else
 156                         devinfo->bus_pub.stats.tx_ctlerrs++;
 157         }
 158
 159         devinfo->ctl_urb_status = status;
 160         devinfo->ctl_completed = true;
 161         brcmf_usb_ioctl_resp_wake(devinfo);
 162 }
 163
 164 static void
 165 brcmf_usb_ctlread_complete(struct urb *urb)
 166 {
 167         struct brcmf_usbdev_info *devinfo =
 168                 (struct brcmf_usbdev_info *)urb->context;
 169
 170         brcmf_dbg(USB, "Enter\n");
 171         devinfo->ctl_urb_actual_length = urb->actual_length;
 172         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_READ,
 173                 urb->status);
 174 }
 175
 176 static void
 177 brcmf_usb_ctlwrite_complete(struct urb *urb)
 178 {
 179         struct brcmf_usbdev_info *devinfo =
 180                 (struct brcmf_usbdev_info *)urb->context;
 181
 182         brcmf_dbg(USB, "Enter\n");
 183         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_WRITE,
 184                 urb->status);
 185 }
 186
 187 static int
 188 brcmf_usb_send_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 189 {
 190         int ret;
 191         u16 size;
 192
 193         brcmf_dbg(USB, "Enter\n");
 194         if (devinfo == NULL || buf == NULL ||
 195             len == 0 || devinfo->ctl_urb == NULL)
 196                 return -EINVAL;
 197
 198         size = len;
 199         devinfo->ctl_write.wLength = cpu_to_le16p(&size);
 200         devinfo->ctl_urb->transfer_buffer_length = size;
 201         devinfo->ctl_urb_status = 0;
 202         devinfo->ctl_urb_actual_length = 0;
 203
 204         usb_fill_control_urb(devinfo->ctl_urb,
 205                 devinfo->usbdev,
 206                 devinfo->ctl_out_pipe,
 207                 (unsigned char *) &devinfo->ctl_write,
 208                 buf, size,
 209                 (usb_complete_t)brcmf_usb_ctlwrite_complete,
 210                 devinfo);
 211
 212         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 213         if (ret < 0)
 214                 brcmf_err("usb_submit_urb failed %d\n", ret);
 215
 216         return ret;
 217 }
 218
 219 static int
 220 brcmf_usb_recv_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 221 {
 222         int ret;
 223         u16 size;
 224
 225         brcmf_dbg(USB, "Enter\n");
 226         if ((devinfo == NULL) || (buf == NULL) || (len == 0)
 227                 || (devinfo->ctl_urb == NULL))
 228                 return -EINVAL;
 229
 230         size = len;
 231         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 232         devinfo->ctl_urb->transfer_buffer_length = size;
 233
 234         devinfo->ctl_read.bRequestType = USB_DIR_IN
 235                 | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 236         devinfo->ctl_read.bRequest = 1;
 237
 238         usb_fill_control_urb(devinfo->ctl_urb,
 239                 devinfo->usbdev,
 240                 devinfo->ctl_in_pipe,
 241                 (unsigned char *) &devinfo->ctl_read,
 242                 buf, size,
 243                 (usb_complete_t)brcmf_usb_ctlread_complete,
 244                 devinfo);
 245
 246         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 247         if (ret < 0)
 248                 brcmf_err("usb_submit_urb failed %d\n", ret);
 249
 250         return ret;
 251 }
 252
 253 static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 254 {
 255         int err = 0;
 256         int timeout = 0;
 257         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 258
 259         brcmf_dbg(USB, "Enter\n");
 260         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 261                 return -EIO;
 262
 263         if (test_and_set_bit(0, &devinfo->ctl_op))
 264                 return -EIO;
 265
 266         devinfo->ctl_completed = false;
 267         err = brcmf_usb_send_ctl(devinfo, buf, len);
 268         if (err) {
 269                 brcmf_err("fail %d bytes: %d\n", err, len);
 270                 clear_bit(0, &devinfo->ctl_op);
 271                 return err;
 272         }
 273         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 274         clear_bit(0, &devinfo->ctl_op);
 275         if (!timeout) {
 276                 brcmf_err("Txctl wait timed out\n");
 277                 err = -EIO;
 278         }
 279         return err;
 280 }
 281
 282 static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 283 {
 284         int err = 0;
 285         int timeout = 0;
 286         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 287
 288         brcmf_dbg(USB, "Enter\n");
 289         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 290                 return -EIO;
 291
 292         if (test_and_set_bit(0, &devinfo->ctl_op))
 293                 return -EIO;
 294
 295         devinfo->ctl_completed = false;
 296         err = brcmf_usb_recv_ctl(devinfo, buf, len);
 297         if (err) {
 298                 brcmf_err("fail %d bytes: %d\n", err, len);
 299                 clear_bit(0, &devinfo->ctl_op);
 300                 return err;
 301         }
 302         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 303         err = devinfo->ctl_urb_status;
 304         clear_bit(0, &devinfo->ctl_op);
 305         if (!timeout) {
 306                 brcmf_err("rxctl wait timed out\n");
 307                 err = -EIO;
 308         }
 309         if (!err)
 310                 return devinfo->ctl_urb_actual_length;
 311         else
 312                 return err;
 313 }
 314
 315 static struct brcmf_usbreq *brcmf_usb_deq(struct brcmf_usbdev_info *devinfo,
 316                                           struct list_head *q, int *counter)
 317 {
 318         unsigned long flags;
 319         struct brcmf_usbreq  *req;
 320         spin_lock_irqsave(&devinfo->qlock, flags);
 321         if (list_empty(q)) {
 322                 spin_unlock_irqrestore(&devinfo->qlock, flags);
 323                 return NULL;
 324         }
 325         req = list_entry(q->next, struct brcmf_usbreq, list);
 326         list_del_init(q->next);
 327         if (counter)
 328                 (*counter)--;
 329         spin_unlock_irqrestore(&devinfo->qlock, flags);
 330         return req;
 331
 332 }
 333
 334 static void brcmf_usb_enq(struct brcmf_usbdev_info *devinfo,
 335                           struct list_head *q, struct brcmf_usbreq *req,
 336                           int *counter)
 337 {
 338         unsigned long flags;
 339         spin_lock_irqsave(&devinfo->qlock, flags);
 340         list_add_tail(&req->list, q);
 341         if (counter)
 342                 (*counter)++;
 343         spin_unlock_irqrestore(&devinfo->qlock, flags);
 344 }
 345
 346 static struct brcmf_usbreq *
 347 brcmf_usbdev_qinit(struct list_head *q, int qsize)
 348 {
 349         int i;
 350         struct brcmf_usbreq *req, *reqs;
 351
 352         reqs = kcalloc(qsize, sizeof(struct brcmf_usbreq), GFP_ATOMIC);
 353         if (reqs == NULL)
 354                 return NULL;
 355
 356         req = reqs;
 357
 358         for (i = 0; i < qsize; i++) {
 359                 req->urb = usb_alloc_urb(0, GFP_ATOMIC);
 360                 if (!req->urb)
 361                         goto fail;
 362
 363                 INIT_LIST_HEAD(&req->list);
 364                 list_add_tail(&req->list, q);
 365                 req++;
 366         }
 367         return reqs;
 368 fail:
 369         brcmf_err("fail!\n");
 370         while (!list_empty(q)) {
 371                 req = list_entry(q->next, struct brcmf_usbreq, list);
 372                 if (req && req->urb)
 373                         usb_free_urb(req->urb);
 374                 list_del(q->next);
 375         }
 376         return NULL;
 377
 378 }
 379
 380 static void brcmf_usb_free_q(struct list_head *q, bool pending)
 381 {
 382         struct brcmf_usbreq *req, *next;
 383         int i = 0;
 384         list_for_each_entry_safe(req, next, q, list) {
 385                 if (!req->urb) {
 386                         brcmf_err("bad req\n");
 387                         break;
 388                 }
 389                 i++;
 390                 if (pending) {
 391                         usb_kill_urb(req->urb);
 392                 } else {
 393                         usb_free_urb(req->urb);
 394                         list_del_init(&req->list);
 395                 }
 396         }
 397 }
 398
 399 static void brcmf_usb_del_fromq(struct brcmf_usbdev_info *devinfo,
 400                                 struct brcmf_usbreq *req)
 401 {
 402         unsigned long flags;
 403
 404         spin_lock_irqsave(&devinfo->qlock, flags);
 405         list_del_init(&req->list);
 406         spin_unlock_irqrestore(&devinfo->qlock, flags);
 407 }
 408
 409
 410 static void brcmf_usb_tx_complete(struct urb *urb)
 411 {
 412         struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
 413         struct brcmf_usbdev_info *devinfo = req->devinfo;
 414
 415         brcmf_dbg(USB, "Enter, urb->status=%d, skb=%p\n", urb->status,
 416                   req->skb);
 417         brcmf_usb_del_fromq(devinfo, req);
 418
 419         brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
 420         req->skb = NULL;
 421         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req, &devinfo->tx_freecount);
 422         if (devinfo->tx_freecount > devinfo->tx_high_watermark &&
 423                 devinfo->tx_flowblock) {
 424                 brcmf_txflowblock(devinfo->dev, false);
 425                 devinfo->tx_flowblock = false;
 426         }
 427 }
 428
 429 static void brcmf_usb_rx_complete(struct urb *urb)
 430 {
 431         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
 432         struct brcmf_usbdev_info *devinfo = req->devinfo;
 433         struct sk_buff *skb;
 434         struct sk_buff_head skbq;
 435
 436         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 437         brcmf_usb_del_fromq(devinfo, req);
 438         skb = req->skb;
 439         req->skb = NULL;
 440
 441         /* zero lenght packets indicate usb "failure". Do not refill */
 442         if (urb->status != 0 || !urb->actual_length) {
 443                 brcmu_pkt_buf_free_skb(skb);
 444                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 445                 return;
 446         }
 447
 448         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 449                 skb_queue_head_init(&skbq);
 450                 skb_queue_tail(&skbq, skb);
 451                 skb_put(skb, urb->actual_length);
 452                 brcmf_rx_frames(devinfo->dev, &skbq);
 453                 brcmf_usb_rx_refill(devinfo, req);
 454         } else {
 455                 brcmu_pkt_buf_free_skb(skb);
 456                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 457         }
 458         return;
 459
 460 }
 461
 462 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 463                                 struct brcmf_usbreq  *req)
 464 {
 465         struct sk_buff *skb;
 466         int ret;
 467
 468         if (!req || !devinfo)
 469                 return;
 470
 471         skb = dev_alloc_skb(devinfo->bus_pub.bus_mtu);
 472         if (!skb) {
 473                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 474                 return;
 475         }
 476         req->skb = skb;
 477
 478         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
 479                           skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
 480                           req);
 481         req->devinfo = devinfo;
 482         brcmf_usb_enq(devinfo, &devinfo->rx_postq, req, NULL);
 483
 484         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 485         if (ret) {
 486                 brcmf_usb_del_fromq(devinfo, req);
 487                 brcmu_pkt_buf_free_skb(req->skb);
 488                 req->skb = NULL;
 489                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 490         }
 491         return;
 492 }
 493
 494 static void brcmf_usb_rx_fill_all(struct brcmf_usbdev_info *devinfo)
 495 {
 496         struct brcmf_usbreq *req;
 497
 498         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
 499                 brcmf_err("bus is not up=%d\n", devinfo->bus_pub.state);
 500                 return;
 501         }
 502         while ((req = brcmf_usb_deq(devinfo, &devinfo->rx_freeq, NULL)) != NULL)
 503                 brcmf_usb_rx_refill(devinfo, req);
 504 }
 505
 506 static void
 507 brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
 508 {
 509         struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
 510         int old_state;
 511
 512         brcmf_dbg(USB, "Enter, current state=%d, new state=%d\n",
 513                   devinfo->bus_pub.state, state);
 514
 515         if (devinfo->bus_pub.state == state)
 516                 return;
 517
 518         old_state = devinfo->bus_pub.state;
 519         devinfo->bus_pub.state = state;
 520
 521         /* update state of upper layer */
 522         if (state == BRCMFMAC_USB_STATE_DOWN) {
 523                 brcmf_dbg(USB, "DBUS is down\n");
 524                 bcmf_bus->state = BRCMF_BUS_DOWN;
 525         } else if (state == BRCMFMAC_USB_STATE_UP) {
 526                 brcmf_dbg(USB, "DBUS is up\n");
 527                 bcmf_bus->state = BRCMF_BUS_DATA;
 528         } else {
 529                 brcmf_dbg(USB, "DBUS current state=%d\n", state);
 530         }
 531 }
 532
 533 static void
 534 brcmf_usb_intr_complete(struct urb *urb)
 535 {
 536         struct brcmf_usbdev_info *devinfo =
 537                         (struct brcmf_usbdev_info *)urb->context;
 538         int err;
 539
 540         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 541
 542         if (devinfo == NULL)
 543                 return;
 544
 545         if (unlikely(urb->status)) {
 546                 if (urb->status == -ENOENT ||
 547                     urb->status == -ESHUTDOWN ||
 548                     urb->status == -ENODEV) {
 549                         brcmf_usb_state_change(devinfo,
 550                                                BRCMFMAC_USB_STATE_DOWN);
 551                 }
 552         }
 553
 554         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN) {
 555                 brcmf_err("intr cb when DBUS down, ignoring\n");
 556                 return;
 557         }
 558
 559         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 560                 err = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 561                 if (err)
 562                         brcmf_err("usb_submit_urb, err=%d\n", err);
 563         }
 564 }
 565
 566 static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 567 {
 568         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 569         struct brcmf_usbreq  *req;
 570         int ret;
 571
 572         brcmf_dbg(USB, "Enter, skb=%p\n", skb);
 573         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 574                 return -EIO;
 575
 576         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq,
 577                                         &devinfo->tx_freecount);
 578         if (!req) {
 579                 brcmu_pkt_buf_free_skb(skb);
 580                 brcmf_err("no req to send\n");
 581                 return -ENOMEM;
 582         }
 583
 584         req->skb = skb;
 585         req->devinfo = devinfo;
 586         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
 587                           skb->data, skb->len, brcmf_usb_tx_complete, req);
 588         req->urb->transfer_flags |= URB_ZERO_PACKET;
 589         brcmf_usb_enq(devinfo, &devinfo->tx_postq, req, NULL);
 590         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 591         if (ret) {
 592                 brcmf_err("brcmf_usb_tx usb_submit_urb FAILED\n");
 593                 brcmf_usb_del_fromq(devinfo, req);
 594                 brcmu_pkt_buf_free_skb(req->skb);
 595                 req->skb = NULL;
 596                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req,
 597                                                 &devinfo->tx_freecount);
 598         } else {
 599                 if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
 600                         !devinfo->tx_flowblock) {
 601                         brcmf_txflowblock(dev, true);
 602                         devinfo->tx_flowblock = true;
 603                 }
 604         }
 605
 606         return ret;
 607 }
 608
 609
 610 static int brcmf_usb_up(struct device *dev)
 611 {
 612         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 613         u16 ifnum;
 614         int ret;
 615
 616         brcmf_dbg(USB, "Enter\n");
 617         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP)
 618                 return 0;
 619
 620         /* Success, indicate devinfo is fully up */
 621         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_UP);
 622
 623         if (devinfo->intr_urb) {
 624                 usb_fill_int_urb(devinfo->intr_urb, devinfo->usbdev,
 625                         devinfo->intr_pipe,
 626                         &devinfo->intr,
 627                         devinfo->intr_size,
 628                         (usb_complete_t)brcmf_usb_intr_complete,
 629                         devinfo,
 630                         devinfo->interval);
 631
 632                 ret = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 633                 if (ret) {
 634                         brcmf_err("USB_SUBMIT_URB failed with status %d\n",
 635                                   ret);
 636                         return -EINVAL;
 637                 }
 638         }
 639
 640         if (devinfo->ctl_urb) {
 641                 devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
 642                 devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
 643
 644                 ifnum = IFDESC(devinfo->usbdev, CONTROL_IF).bInterfaceNumber;
 645
 646                 /* CTL Write */
 647                 devinfo->ctl_write.bRequestType =
 648                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 649                 devinfo->ctl_write.bRequest = 0;
 650                 devinfo->ctl_write.wValue = cpu_to_le16(0);
 651                 devinfo->ctl_write.wIndex = cpu_to_le16p(&ifnum);
 652
 653                 /* CTL Read */
 654                 devinfo->ctl_read.bRequestType =
 655                         USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 656                 devinfo->ctl_read.bRequest = 1;
 657                 devinfo->ctl_read.wValue = cpu_to_le16(0);
 658                 devinfo->ctl_read.wIndex = cpu_to_le16p(&ifnum);
 659         }
 660         brcmf_usb_rx_fill_all(devinfo);
 661         return 0;
 662 }
 663
 664 static void brcmf_usb_down(struct device *dev)
 665 {
 666         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 667
 668         brcmf_dbg(USB, "Enter\n");
 669         if (devinfo == NULL)
 670                 return;
 671
 672         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN)
 673                 return;
 674
 675         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_DOWN);
 676         if (devinfo->intr_urb)
 677                 usb_kill_urb(devinfo->intr_urb);
 678
 679         if (devinfo->ctl_urb)
 680                 usb_kill_urb(devinfo->ctl_urb);
 681
 682         if (devinfo->bulk_urb)
 683                 usb_kill_urb(devinfo->bulk_urb);
 684         brcmf_usb_free_q(&devinfo->tx_postq, true);
 685
 686         brcmf_usb_free_q(&devinfo->rx_postq, true);
 687 }
 688
 689 static void
 690 brcmf_usb_sync_complete(struct urb *urb)
 691 {
 692         struct brcmf_usbdev_info *devinfo =
 693                         (struct brcmf_usbdev_info *)urb->context;
 694
 695         devinfo->ctl_completed = true;
 696         brcmf_usb_ioctl_resp_wake(devinfo);
 697 }
 698
 699 static bool brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
 700                              void *buffer, int buflen)
 701 {
 702         int ret = 0;
 703         char *tmpbuf;
 704         u16 size;
 705
 706         if ((!devinfo) || (devinfo->ctl_urb == NULL))
 707                 return false;
 708
 709         tmpbuf = kmalloc(buflen, GFP_ATOMIC);
 710         if (!tmpbuf)
 711                 return false;
 712
 713         size = buflen;
 714         devinfo->ctl_urb->transfer_buffer_length = size;
 715
 716         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 717         devinfo->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
 718                 USB_RECIP_INTERFACE;
 719         devinfo->ctl_read.bRequest = cmd;
 720
 721         usb_fill_control_urb(devinfo->ctl_urb,
 722                 devinfo->usbdev,
 723                 usb_rcvctrlpipe(devinfo->usbdev, 0),
 724                 (unsigned char *) &devinfo->ctl_read,
 725                 (void *) tmpbuf, size,
 726                 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 727
 728         devinfo->ctl_completed = false;
 729         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 730         if (ret < 0) {
 731                 brcmf_err("usb_submit_urb failed %d\n", ret);
 732                 kfree(tmpbuf);
 733                 return false;
 734         }
 735
 736         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 737         memcpy(buffer, tmpbuf, buflen);
 738         kfree(tmpbuf);
 739
 740         return ret;
 741 }
 742
 743 static bool
 744 brcmf_usb_dlneeded(struct brcmf_usbdev_info *devinfo)
 745 {
 746         struct bootrom_id_le id;
 747         u32 chipid, chiprev;
 748
 749         brcmf_dbg(USB, "Enter\n");
 750
 751         if (devinfo == NULL)
 752                 return false;
 753
 754         /* Check if firmware downloaded already by querying runtime ID */
 755         id.chip = cpu_to_le32(0xDEAD);
 756         brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 757
 758         chipid = le32_to_cpu(id.chip);
 759         chiprev = le32_to_cpu(id.chiprev);
 760
 761         if ((chipid & 0x4300) == 0x4300)
 762                 brcmf_dbg(USB, "chip %x rev 0x%x\n", chipid, chiprev);
 763         else
 764                 brcmf_dbg(USB, "chip %d rev 0x%x\n", chipid, chiprev);
 765         if (chipid == BRCMF_POSTBOOT_ID) {
 766                 brcmf_dbg(USB, "firmware already downloaded\n");
 767                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 768                 return false;
 769         } else {
 770                 devinfo->bus_pub.devid = chipid;
 771                 devinfo->bus_pub.chiprev = chiprev;
 772         }
 773         return true;
 774 }
 775
 776 static int
 777 brcmf_usb_resetcfg(struct brcmf_usbdev_info *devinfo)
 778 {
 779         struct bootrom_id_le id;
 780         u32 loop_cnt;
 781
 782         brcmf_dbg(USB, "Enter\n");
 783
 784         loop_cnt = 0;
 785         do {
 786                 mdelay(BRCMF_USB_RESET_GETVER_SPINWAIT);
 787                 loop_cnt++;
 788                 id.chip = cpu_to_le32(0xDEAD);       /* Get the ID */
 789                 brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 790                 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID))
 791                         break;
 792         } while (loop_cnt < BRCMF_USB_RESET_GETVER_LOOP_CNT);
 793
 794         if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID)) {
 795                 brcmf_dbg(USB, "postboot chip 0x%x/rev 0x%x\n",
 796                           le32_to_cpu(id.chip), le32_to_cpu(id.chiprev));
 797
 798                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 799                 return 0;
 800         } else {
 801                 brcmf_err("Cannot talk to Dongle. Firmware is not UP, %d ms\n",
 802                           BRCMF_USB_RESET_GETVER_SPINWAIT * loop_cnt);
 803                 return -EINVAL;
 804         }
 805 }
 806
 807
 808 static int
 809 brcmf_usb_dl_send_bulk(struct brcmf_usbdev_info *devinfo, void *buffer, int len)
 810 {
 811         int ret;
 812
 813         if ((devinfo == NULL) || (devinfo->bulk_urb == NULL))
 814                 return -EINVAL;
 815
 816         /* Prepare the URB */
 817         usb_fill_bulk_urb(devinfo->bulk_urb, devinfo->usbdev,
 818                           devinfo->tx_pipe, buffer, len,
 819                           (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 820
 821         devinfo->bulk_urb->transfer_flags |= URB_ZERO_PACKET;
 822
 823         devinfo->ctl_completed = false;
 824         ret = usb_submit_urb(devinfo->bulk_urb, GFP_ATOMIC);
 825         if (ret) {
 826                 brcmf_err("usb_submit_urb failed %d\n", ret);
 827                 return ret;
 828         }
 829         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 830         return (ret == 0);
 831 }
 832
 833 static int
 834 brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
 835 {
 836         unsigned int sendlen, sent, dllen;
 837         char *bulkchunk = NULL, *dlpos;
 838         struct rdl_state_le state;
 839         u32 rdlstate, rdlbytes;
 840         int err = 0;
 841
 842         brcmf_dbg(USB, "Enter, fw %p, len %d\n", fw, fwlen);
 843
 844         bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
 845         if (bulkchunk == NULL) {
 846                 err = -ENOMEM;
 847                 goto fail;
 848         }
 849
 850         /* 1) Prepare USB boot loader for runtime image */
 851         brcmf_usb_dl_cmd(devinfo, DL_START, &state,
 852                          sizeof(struct rdl_state_le));
 853
 854         rdlstate = le32_to_cpu(state.state);
 855         rdlbytes = le32_to_cpu(state.bytes);
 856
 857         /* 2) Check we are in the Waiting state */
 858         if (rdlstate != DL_WAITING) {
 859                 brcmf_err("Failed to DL_START\n");
 860                 err = -EINVAL;
 861                 goto fail;
 862         }
 863         sent = 0;
 864         dlpos = fw;
 865         dllen = fwlen;
 866
 867         /* Get chip id and rev */
 868         while (rdlbytes != dllen) {
 869                 /* Wait until the usb device reports it received all
 870                  * the bytes we sent */
 871                 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
 872                         if ((dllen-sent) < RDL_CHUNK)
 873                                 sendlen = dllen-sent;
 874                         else
 875                                 sendlen = RDL_CHUNK;
 876
 877                         /* simply avoid having to send a ZLP by ensuring we
 878                          * never have an even
 879                          * multiple of 64
 880                          */
 881                         if (!(sendlen % 64))
 882                                 sendlen -= 4;
 883
 884                         /* send data */
 885                         memcpy(bulkchunk, dlpos, sendlen);
 886                         if (brcmf_usb_dl_send_bulk(devinfo, bulkchunk,
 887                                                    sendlen)) {
 888                                 brcmf_err("send_bulk failed\n");
 889                                 err = -EINVAL;
 890                                 goto fail;
 891                         }
 892
 893                         dlpos += sendlen;
 894                         sent += sendlen;
 895                 }
 896                 if (!brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 897                                       sizeof(struct rdl_state_le))) {
 898                         brcmf_err("DL_GETSTATE Failed xxxx\n");
 899                         err = -EINVAL;
 900                         goto fail;
 901                 }
 902
 903                 rdlstate = le32_to_cpu(state.state);
 904                 rdlbytes = le32_to_cpu(state.bytes);
 905
 906                 /* restart if an error is reported */
 907                 if (rdlstate == DL_BAD_HDR || rdlstate == DL_BAD_CRC) {
 908                         brcmf_err("Bad Hdr or Bad CRC state %d\n",
 909                                   rdlstate);
 910                         err = -EINVAL;
 911                         goto fail;
 912                 }
 913         }
 914
 915 fail:
 916         kfree(bulkchunk);
 917         brcmf_dbg(USB, "Exit, err=%d\n", err);
 918         return err;
 919 }
 920
 921 static int brcmf_usb_dlstart(struct brcmf_usbdev_info *devinfo, u8 *fw, int len)
 922 {
 923         int err;
 924
 925         brcmf_dbg(USB, "Enter\n");
 926
 927         if (devinfo == NULL)
 928                 return -EINVAL;
 929
 930         if (devinfo->bus_pub.devid == 0xDEAD)
 931                 return -EINVAL;
 932
 933         err = brcmf_usb_dl_writeimage(devinfo, fw, len);
 934         if (err == 0)
 935                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_DONE;
 936         else
 937                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_FAIL;
 938         brcmf_dbg(USB, "Exit, err=%d\n", err);
 939
 940         return err;
 941 }
 942
 943 static int brcmf_usb_dlrun(struct brcmf_usbdev_info *devinfo)
 944 {
 945         struct rdl_state_le state;
 946
 947         brcmf_dbg(USB, "Enter\n");
 948         if (!devinfo)
 949                 return -EINVAL;
 950
 951         if (devinfo->bus_pub.devid == 0xDEAD)
 952                 return -EINVAL;
 953
 954         /* Check we are runnable */
 955         brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 956                 sizeof(struct rdl_state_le));
 957
 958         /* Start the image */
 959         if (state.state == cpu_to_le32(DL_RUNNABLE)) {
 960                 if (!brcmf_usb_dl_cmd(devinfo, DL_GO, &state,
 961                         sizeof(struct rdl_state_le)))
 962                         return -ENODEV;
 963                 if (brcmf_usb_resetcfg(devinfo))
 964                         return -ENODEV;
 965                 /* The Dongle may go for re-enumeration. */
 966         } else {
 967                 brcmf_err("Dongle not runnable\n");
 968                 return -EINVAL;
 969         }
 970         brcmf_dbg(USB, "Exit\n");
 971         return 0;
 972 }
 973
 974 static bool brcmf_usb_chip_support(int chipid, int chiprev)
 975 {
 976         switch(chipid) {
 977         case 43143:
 978                 return true;
 979         case 43235:
 980         case 43236:
 981         case 43238:
 982                 return (chiprev == 3);
 983         case 43242:
 984                 return true;
 985         default:
 986                 break;
 987         }
 988         return false;
 989 }
 990
 991 static int
 992 brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
 993 {
 994         int devid, chiprev;
 995         int err;
 996
 997         brcmf_dbg(USB, "Enter\n");
 998         if (devinfo == NULL)
 999                 return -ENODEV;
1000
1001         devid = devinfo->bus_pub.devid;
1002         chiprev = devinfo->bus_pub.chiprev;
1003
1004         if (!brcmf_usb_chip_support(devid, chiprev)) {
1005                 brcmf_err("unsupported chip %d rev %d\n",
1006                           devid, chiprev);
1007                 return -EINVAL;
1008         }
1009
1010         if (!devinfo->image) {
1011                 brcmf_err("No firmware!\n");
1012                 return -ENOENT;
1013         }
1014
1015         err = brcmf_usb_dlstart(devinfo,
1016                 devinfo->image, devinfo->image_len);
1017         if (err == 0)
1018                 err = brcmf_usb_dlrun(devinfo);
1019         return err;
1020 }
1021
1022
1023 static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
1024 {
1025         brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
1026
1027         /* free the URBS */
1028         brcmf_usb_free_q(&devinfo->rx_freeq, false);
1029         brcmf_usb_free_q(&devinfo->tx_freeq, false);
1030
1031         usb_free_urb(devinfo->intr_urb);
1032         usb_free_urb(devinfo->ctl_urb);
1033         usb_free_urb(devinfo->bulk_urb);
1034
1035         kfree(devinfo->tx_reqs);
1036         kfree(devinfo->rx_reqs);
1037 }
1038
1039 #define TRX_MAGIC       0x30524448      /* "HDR0" */
1040 #define TRX_VERSION     1               /* Version 1 */
1041 #define TRX_MAX_LEN     0x3B0000        /* Max length */
1042 #define TRX_NO_HEADER   1               /* Do not write TRX header */
1043 #define TRX_MAX_OFFSET  3               /* Max number of individual files */
1044 #define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed image */
1045
1046 struct trx_header_le {
1047         __le32 magic;           /* "HDR0" */
1048         __le32 len;             /* Length of file including header */
1049         __le32 crc32;           /* CRC from flag_version to end of file */
1050         __le32 flag_version;    /* 0:15 flags, 16:31 version */
1051         __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
1052                                          * header */
1053 };
1054
1055 static int check_file(const u8 *headers)
1056 {
1057         struct trx_header_le *trx;
1058         int actual_len = -1;
1059
1060         brcmf_dbg(USB, "Enter\n");
1061         /* Extract trx header */
1062         trx = (struct trx_header_le *) headers;
1063         if (trx->magic != cpu_to_le32(TRX_MAGIC))
1064                 return -1;
1065
1066         headers += sizeof(struct trx_header_le);
1067
1068         if (le32_to_cpu(trx->flag_version) & TRX_UNCOMP_IMAGE) {
1069                 actual_len = le32_to_cpu(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]);
1070                 return actual_len + sizeof(struct trx_header_le);
1071         }
1072         return -1;
1073 }
1074
1075 static int brcmf_usb_get_fw(struct brcmf_usbdev_info *devinfo)
1076 {
1077         s8 *fwname;
1078         const struct firmware *fw;
1079         struct brcmf_usb_image *fw_image;
1080         int err;
1081
1082         brcmf_dbg(USB, "Enter\n");
1083         switch (devinfo->bus_pub.devid) {
1084         case 43143:
1085                 fwname = BRCMF_USB_43143_FW_NAME;
1086                 break;
1087         case 43235:
1088         case 43236:
1089         case 43238:
1090                 fwname = BRCMF_USB_43236_FW_NAME;
1091                 break;
1092         case 43242:
1093                 fwname = BRCMF_USB_43242_FW_NAME;
1094                 break;
1095         default:
1096                 return -EINVAL;
1097                 break;
1098         }
1099         brcmf_dbg(USB, "Loading FW %s\n", fwname);
1100         list_for_each_entry(fw_image, &fw_image_list, list) {
1101                 if (fw_image->fwname == fwname) {
1102                         devinfo->image = fw_image->image;
1103                         devinfo->image_len = fw_image->image_len;
1104                         return 0;
1105                 }
1106         }
1107         /* fw image not yet loaded. Load it now and add to list */
1108         err = request_firmware(&fw, fwname, devinfo->dev);
1109         if (!fw) {
1110                 brcmf_err("fail to request firmware %s\n", fwname);
1111                 return err;
1112         }
1113         if (check_file(fw->data) < 0) {
1114                 brcmf_err("invalid firmware %s\n", fwname);
1115                 return -EINVAL;
1116         }
1117
1118         fw_image = kzalloc(sizeof(*fw_image), GFP_ATOMIC);
1119         if (!fw_image)
1120                 return -ENOMEM;
1121         INIT_LIST_HEAD(&fw_image->list);
1122         list_add_tail(&fw_image->list, &fw_image_list);
1123         fw_image->fwname = fwname;
1124         fw_image->image = vmalloc(fw->size);
1125         if (!fw_image->image)
1126                 return -ENOMEM;
1127
1128         memcpy(fw_image->image, fw->data, fw->size);
1129         fw_image->image_len = fw->size;
1130
1131         release_firmware(fw);
1132
1133         devinfo->image = fw_image->image;
1134         devinfo->image_len = fw_image->image_len;
1135
1136         return 0;
1137 }
1138
1139
1140 static
1141 struct brcmf_usbdev *brcmf_usb_attach(struct brcmf_usbdev_info *devinfo,
1142                                       int nrxq, int ntxq)
1143 {
1144         brcmf_dbg(USB, "Enter\n");
1145
1146         devinfo->bus_pub.nrxq = nrxq;
1147         devinfo->rx_low_watermark = nrxq / 2;
1148         devinfo->bus_pub.devinfo = devinfo;
1149         devinfo->bus_pub.ntxq = ntxq;
1150         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DOWN;
1151
1152         /* flow control when too many tx urbs posted */
1153         devinfo->tx_low_watermark = ntxq / 4;
1154         devinfo->tx_high_watermark = devinfo->tx_low_watermark * 3;
1155         devinfo->bus_pub.bus_mtu = BRCMF_USB_MAX_PKT_SIZE;
1156
1157         /* Initialize other structure content */
1158         init_waitqueue_head(&devinfo->ioctl_resp_wait);
1159
1160         /* Initialize the spinlocks */
1161         spin_lock_init(&devinfo->qlock);
1162
1163         INIT_LIST_HEAD(&devinfo->rx_freeq);
1164         INIT_LIST_HEAD(&devinfo->rx_postq);
1165
1166         INIT_LIST_HEAD(&devinfo->tx_freeq);
1167         INIT_LIST_HEAD(&devinfo->tx_postq);
1168
1169         devinfo->tx_flowblock = false;
1170
1171         devinfo->rx_reqs = brcmf_usbdev_qinit(&devinfo->rx_freeq, nrxq);
1172         if (!devinfo->rx_reqs)
1173                 goto error;
1174
1175         devinfo->tx_reqs = brcmf_usbdev_qinit(&devinfo->tx_freeq, ntxq);
1176         if (!devinfo->tx_reqs)
1177                 goto error;
1178         devinfo->tx_freecount = ntxq;
1179
1180         devinfo->intr_urb = usb_alloc_urb(0, GFP_ATOMIC);
1181         if (!devinfo->intr_urb) {
1182                 brcmf_err("usb_alloc_urb (intr) failed\n");
1183                 goto error;
1184         }
1185         devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
1186         if (!devinfo->ctl_urb) {
1187                 brcmf_err("usb_alloc_urb (ctl) failed\n");
1188                 goto error;
1189         }
1190         devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
1191         if (!devinfo->bulk_urb) {
1192                 brcmf_err("usb_alloc_urb (bulk) failed\n");
1193                 goto error;
1194         }
1195
1196         if (!brcmf_usb_dlneeded(devinfo))
1197                 return &devinfo->bus_pub;
1198
1199         brcmf_dbg(USB, "Start fw downloading\n");
1200         if (brcmf_usb_get_fw(devinfo))
1201                 goto error;
1202
1203         if (brcmf_usb_fw_download(devinfo))
1204                 goto error;
1205
1206         return &devinfo->bus_pub;
1207
1208 error:
1209         brcmf_err("failed!\n");
1210         brcmf_usb_detach(devinfo);
1211         return NULL;
1212 }
1213
1214 static struct brcmf_bus_ops brcmf_usb_bus_ops = {
1215         .txdata = brcmf_usb_tx,
1216         .init = brcmf_usb_up,
1217         .stop = brcmf_usb_down,
1218         .txctl = brcmf_usb_tx_ctlpkt,
1219         .rxctl = brcmf_usb_rx_ctlpkt,
1220 };
1221
1222 static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
1223 {
1224         struct brcmf_bus *bus = NULL;
1225         struct brcmf_usbdev *bus_pub = NULL;
1226         int ret;
1227         struct device *dev = devinfo->dev;
1228
1229         brcmf_dbg(USB, "Enter\n");
1230         bus_pub = brcmf_usb_attach(devinfo, BRCMF_USB_NRXQ, BRCMF_USB_NTXQ);
1231         if (!bus_pub)
1232                 return -ENODEV;
1233
1234         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
1235         if (!bus) {
1236                 ret = -ENOMEM;
1237                 goto fail;
1238         }
1239
1240         bus->dev = dev;
1241         bus_pub->bus = bus;
1242         bus->bus_priv.usb = bus_pub;
1243         dev_set_drvdata(dev, bus);
1244         bus->ops = &brcmf_usb_bus_ops;
1245         bus->chip = bus_pub->devid;
1246         bus->chiprev = bus_pub->chiprev;
1247
1248         /* Attach to the common driver interface */
1249         ret = brcmf_attach(0, dev);
1250         if (ret) {
1251                 brcmf_err("brcmf_attach failed\n");
1252                 goto fail;
1253         }
1254
1255         ret = brcmf_bus_start(dev);
1256         if (ret) {
1257                 brcmf_err("dongle is not responding\n");
1258                 brcmf_detach(dev);
1259                 goto fail;
1260         }
1261
1262         return 0;
1263 fail:
1264         /* Release resources in reverse order */
1265         kfree(bus);
1266         brcmf_usb_detach(devinfo);
1267         return ret;
1268 }
1269
1270 static void
1271 brcmf_usb_disconnect_cb(struct brcmf_usbdev_info *devinfo)
1272 {
1273         if (!devinfo)
1274                 return;
1275         brcmf_dbg(USB, "Enter, bus_pub %p\n", devinfo);
1276
1277         brcmf_detach(devinfo->dev);
1278         kfree(devinfo->bus_pub.bus);
1279         brcmf_usb_detach(devinfo);
1280 }
1281
1282 static int
1283 brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
1284 {
1285         int ep;
1286         struct usb_endpoint_descriptor *endpoint;
1287         int ret = 0;
1288         struct usb_device *usb = interface_to_usbdev(intf);
1289         int num_of_eps;
1290         u8 endpoint_num;
1291         struct brcmf_usbdev_info *devinfo;
1292
1293         brcmf_dbg(USB, "Enter\n");
1294
1295         devinfo = kzalloc(sizeof(*devinfo), GFP_ATOMIC);
1296         if (devinfo == NULL)
1297                 return -ENOMEM;
1298
1299         devinfo->usbdev = usb;
1300         devinfo->dev = &usb->dev;
1301
1302         usb_set_intfdata(intf, devinfo);
1303
1304         /* Check that the device supports only one configuration */
1305         if (usb->descriptor.bNumConfigurations != 1) {
1306                 ret = -1;
1307                 goto fail;
1308         }
1309
1310         if (usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
1311                 ret = -1;
1312                 goto fail;
1313         }
1314
1315         /*
1316          * Only the BDC interface configuration is supported:
1317          *      Device class: USB_CLASS_VENDOR_SPEC
1318          *      if0 class: USB_CLASS_VENDOR_SPEC
1319          *      if0/ep0: control
1320          *      if0/ep1: bulk in
1321          *      if0/ep2: bulk out (ok if swapped with bulk in)
1322          */
1323         if (CONFIGDESC(usb)->bNumInterfaces != 1) {
1324                 ret = -1;
1325                 goto fail;
1326         }
1327
1328         /* Check interface */
1329         if (IFDESC(usb, CONTROL_IF).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
1330             IFDESC(usb, CONTROL_IF).bInterfaceSubClass != 2 ||
1331             IFDESC(usb, CONTROL_IF).bInterfaceProtocol != 0xff) {
1332                 brcmf_err("invalid control interface: class %d, subclass %d, proto %d\n",
1333                           IFDESC(usb, CONTROL_IF).bInterfaceClass,
1334                           IFDESC(usb, CONTROL_IF).bInterfaceSubClass,
1335                           IFDESC(usb, CONTROL_IF).bInterfaceProtocol);
1336                 ret = -1;
1337                 goto fail;
1338         }
1339
1340         /* Check control endpoint */
1341         endpoint = &IFEPDESC(usb, CONTROL_IF, 0);
1342         if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
1343                 != USB_ENDPOINT_XFER_INT) {
1344                 brcmf_err("invalid control endpoint %d\n",
1345                           endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
1346                 ret = -1;
1347                 goto fail;
1348         }
1349
1350         endpoint_num = endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
1351         devinfo->intr_pipe = usb_rcvintpipe(usb, endpoint_num);
1352
1353         devinfo->rx_pipe = 0;
1354         devinfo->rx_pipe2 = 0;
1355         devinfo->tx_pipe = 0;
1356         num_of_eps = IFDESC(usb, BULK_IF).bNumEndpoints - 1;
1357
1358         /* Check data endpoints and get pipes */
1359         for (ep = 1; ep <= num_of_eps; ep++) {
1360                 endpoint = &IFEPDESC(usb, BULK_IF, ep);
1361                 if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
1362                     USB_ENDPOINT_XFER_BULK) {
1363                         brcmf_err("invalid data endpoint %d\n", ep);
1364                         ret = -1;
1365                         goto fail;
1366                 }
1367
1368                 endpoint_num = endpoint->bEndpointAddress &
1369                                USB_ENDPOINT_NUMBER_MASK;
1370                 if ((endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1371                         == USB_DIR_IN) {
1372                         if (!devinfo->rx_pipe) {
1373                                 devinfo->rx_pipe =
1374                                         usb_rcvbulkpipe(usb, endpoint_num);
1375                         } else {
1376                                 devinfo->rx_pipe2 =
1377                                         usb_rcvbulkpipe(usb, endpoint_num);
1378                         }
1379                 } else {
1380                         devinfo->tx_pipe = usb_sndbulkpipe(usb, endpoint_num);
1381                 }
1382         }
1383
1384         /* Allocate interrupt URB and data buffer */
1385         /* RNDIS says 8-byte intr, our old drivers used 4-byte */
1386         if (IFEPDESC(usb, CONTROL_IF, 0).wMaxPacketSize == cpu_to_le16(16))
1387                 devinfo->intr_size = 8;
1388         else
1389                 devinfo->intr_size = 4;
1390
1391         devinfo->interval = IFEPDESC(usb, CONTROL_IF, 0).bInterval;
1392
1393         if (usb->speed == USB_SPEED_HIGH)
1394                 brcmf_dbg(USB, "Broadcom high speed USB wireless device detected\n");
1395         else
1396                 brcmf_dbg(USB, "Broadcom full speed USB wireless device detected\n");
1397
1398         ret = brcmf_usb_probe_cb(devinfo);
1399         if (ret)
1400                 goto fail;
1401
1402         /* Success */
1403         return 0;
1404
1405 fail:
1406         brcmf_err("failed with errno %d\n", ret);
1407         kfree(devinfo);
1408         usb_set_intfdata(intf, NULL);
1409         return ret;
1410
1411 }
1412
1413 static void
1414 brcmf_usb_disconnect(struct usb_interface *intf)
1415 {
1416         struct brcmf_usbdev_info *devinfo;
1417
1418         brcmf_dbg(USB, "Enter\n");
1419         devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf);
1420         brcmf_usb_disconnect_cb(devinfo);
1421         kfree(devinfo);
1422         brcmf_dbg(USB, "Exit\n");
1423 }
1424
1425 /*
1426  * only need to signal the bus being down and update the state.
1427  */
1428 static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
1429 {
1430         struct usb_device *usb = interface_to_usbdev(intf);
1431         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1432
1433         brcmf_dbg(USB, "Enter\n");
1434         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_SLEEP;
1435         brcmf_detach(&usb->dev);
1436         return 0;
1437 }
1438
1439 /*
1440  * (re-) start the bus.
1441  */
1442 static int brcmf_usb_resume(struct usb_interface *intf)
1443 {
1444         struct usb_device *usb = interface_to_usbdev(intf);
1445         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1446
1447         brcmf_dbg(USB, "Enter\n");
1448         if (!brcmf_attach(0, devinfo->dev))
1449                 return brcmf_bus_start(&usb->dev);
1450
1451         return 0;
1452 }
1453
1454 static int brcmf_usb_reset_resume(struct usb_interface *intf)
1455 {
1456         struct usb_device *usb = interface_to_usbdev(intf);
1457         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1458
1459         brcmf_dbg(USB, "Enter\n");
1460
1461         if (!brcmf_usb_fw_download(devinfo))
1462                 return brcmf_usb_resume(intf);
1463
1464         return -EIO;
1465 }
1466
1467 #define BRCMF_USB_VENDOR_ID_BROADCOM    0x0a5c
1468 #define BRCMF_USB_DEVICE_ID_43143       0xbd1e
1469 #define BRCMF_USB_DEVICE_ID_43236       0xbd17
1470 #define BRCMF_USB_DEVICE_ID_43242       0xbd1f
1471 #define BRCMF_USB_DEVICE_ID_BCMFW       0x0bdc
1472
1473 static struct usb_device_id brcmf_usb_devid_table[] = {
1474         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43143) },
1475         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43236) },
1476         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43242) },
1477         /* special entry for device with firmware loaded and running */
1478         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
1479         { }
1480 };
1481
1482 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
1483 MODULE_FIRMWARE(BRCMF_USB_43143_FW_NAME);
1484 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
1485 MODULE_FIRMWARE(BRCMF_USB_43242_FW_NAME);
1486
1487 static struct usb_driver brcmf_usbdrvr = {
1488         .name = KBUILD_MODNAME,
1489         .probe = brcmf_usb_probe,
1490         .disconnect = brcmf_usb_disconnect,
1491         .id_table = brcmf_usb_devid_table,
1492         .suspend = brcmf_usb_suspend,
1493         .resume = brcmf_usb_resume,
1494         .reset_resume = brcmf_usb_reset_resume,
1495         .supports_autosuspend = 1,
1496         .disable_hub_initiated_lpm = 1,
1497 };
1498
1499 static void brcmf_release_fw(struct list_head *q)
1500 {
1501         struct brcmf_usb_image *fw_image, *next;
1502
1503         list_for_each_entry_safe(fw_image, next, q, list) {
1504                 vfree(fw_image->image);
1505                 list_del_init(&fw_image->list);
1506         }
1507 }
1508
1509 static int brcmf_usb_reset_device(struct device *dev, void *notused)
1510 {
1511         /* device past is the usb interface so we
1512          * need to use parent here.
1513          */
1514         brcmf_dev_reset(dev->parent);
1515         return 0;
1516 }
1517
1518 void brcmf_usb_exit(void)
1519 {
1520         struct device_driver *drv = &brcmf_usbdrvr.drvwrap.driver;
1521         int ret;
1522
1523         brcmf_dbg(USB, "Enter\n");
1524         ret = driver_for_each_device(drv, NULL, NULL,
1525                                      brcmf_usb_reset_device);
1526         usb_deregister(&brcmf_usbdrvr);
1527         brcmf_release_fw(&fw_image_list);
1528 }
1529
1530 void brcmf_usb_init(void)
1531 {
1532         brcmf_dbg(USB, "Enter\n");
1533         INIT_LIST_HEAD(&fw_image_list);
1534         usb_register(&brcmf_usbdrvr);
1535 }