2 * Copyright (c) 2011 Broadcom Corporation
4 * Permission to use, copy, modify, and/or distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
11 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
13 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
14 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 #include <linux/kernel.h>
18 #include <linux/module.h>
19 #include <linux/firmware.h>
20 #include <linux/usb.h>
21 #include <linux/vmalloc.h>
23 #include <brcmu_utils.h>
24 #include <brcm_hw_ids.h>
25 #include <brcmu_wifi.h>
32 #define IOCTL_RESP_TIMEOUT 2000
34 #define BRCMF_USB_RESET_GETVER_SPINWAIT 100 /* in unit of ms */
35 #define BRCMF_USB_RESET_GETVER_LOOP_CNT 10
37 #define BRCMF_POSTBOOT_ID 0xA123 /* ID to detect if dongle
39 #define BRCMF_USB_NRXQ 50
40 #define BRCMF_USB_NTXQ 50
42 #define BRCMF_USB_CBCTL_WRITE 0
43 #define BRCMF_USB_CBCTL_READ 1
44 #define BRCMF_USB_MAX_PKT_SIZE 1600
46 #define BRCMF_USB_43143_FW_NAME "brcm/brcmfmac43143.bin"
47 #define BRCMF_USB_43236_FW_NAME "brcm/brcmfmac43236b.bin"
48 #define BRCMF_USB_43242_FW_NAME "brcm/brcmfmac43242a.bin"
49 #define BRCMF_USB_43569_FW_NAME "brcm/brcmfmac43569.bin"
51 #define TRX_MAGIC 0x30524448 /* "HDR0" */
52 #define TRX_MAX_OFFSET 3 /* Max number of file offsets */
53 #define TRX_UNCOMP_IMAGE 0x20 /* Trx holds uncompressed img */
54 #define TRX_RDL_CHUNK 1500 /* size of each dl transfer */
55 #define TRX_OFFSETS_DLFWLEN_IDX 0
57 /* Control messages: bRequest values */
58 #define DL_GETSTATE 0 /* returns the rdl_state_t struct */
59 #define DL_CHECK_CRC 1 /* currently unused */
60 #define DL_GO 2 /* execute downloaded image */
61 #define DL_START 3 /* initialize dl state */
62 #define DL_REBOOT 4 /* reboot the device in 2 seconds */
63 #define DL_GETVER 5 /* returns the bootrom_id_t struct */
64 #define DL_GO_PROTECTED 6 /* execute the downloaded code and set reset
65 * event to occur in 2 seconds. It is the
66 * responsibility of the downloaded code to
69 #define DL_EXEC 7 /* jump to a supplied address */
70 #define DL_RESETCFG 8 /* To support single enum on dongle
71 * - Not used by bootloader
73 #define DL_DEFER_RESP_OK 9 /* Potentially defer the response to setup
78 #define DL_WAITING 0 /* waiting to rx first pkt */
79 #define DL_READY 1 /* hdr was good, waiting for more of the
82 #define DL_BAD_HDR 2 /* hdr was corrupted */
83 #define DL_BAD_CRC 3 /* compressed image was corrupted */
84 #define DL_RUNNABLE 4 /* download was successful,waiting for go cmd */
85 #define DL_START_FAIL 5 /* failed to initialize correctly */
86 #define DL_NVRAM_TOOBIG 6 /* host specified nvram data exceeds DL_NVRAM
89 #define DL_IMAGE_TOOBIG 7 /* firmware image too big */
92 struct trx_header_le {
93 __le32 magic; /* "HDR0" */
94 __le32 len; /* Length of file including header */
95 __le32 crc32; /* CRC from flag_version to end of file */
96 __le32 flag_version; /* 0:15 flags, 16:31 version */
97 __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
102 struct rdl_state_le {
107 struct bootrom_id_le {
108 __le32 chip; /* Chip id */
109 __le32 chiprev; /* Chip rev */
110 __le32 ramsize; /* Size of RAM */
111 __le32 remapbase; /* Current remap base address */
112 __le32 boardtype; /* Type of board */
113 __le32 boardrev; /* Board revision */
116 struct brcmf_usb_image {
117 struct list_head list;
123 struct brcmf_usbdev_info {
124 struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
126 struct list_head rx_freeq;
127 struct list_head rx_postq;
128 struct list_head tx_freeq;
129 struct list_head tx_postq;
130 uint rx_pipe, tx_pipe;
132 int rx_low_watermark;
133 int tx_low_watermark;
134 int tx_high_watermark;
137 spinlock_t tx_flowblock_lock;
139 struct brcmf_usbreq *tx_reqs;
140 struct brcmf_usbreq *rx_reqs;
142 const u8 *image; /* buffer for combine fw and nvram */
145 struct usb_device *usbdev;
148 int ctl_in_pipe, ctl_out_pipe;
149 struct urb *ctl_urb; /* URB for control endpoint */
150 struct usb_ctrlrequest ctl_write;
151 struct usb_ctrlrequest ctl_read;
152 u32 ctl_urb_actual_length;
155 wait_queue_head_t ioctl_resp_wait;
159 struct urb *bulk_urb; /* used for FW download */
164 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
165 struct brcmf_usbreq *req);
167 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
169 struct brcmf_bus *bus_if = dev_get_drvdata(dev);
170 return bus_if->bus_priv.usb;
173 static struct brcmf_usbdev_info *brcmf_usb_get_businfo(struct device *dev)
175 return brcmf_usb_get_buspub(dev)->devinfo;
178 static int brcmf_usb_ioctl_resp_wait(struct brcmf_usbdev_info *devinfo)
180 return wait_event_timeout(devinfo->ioctl_resp_wait,
181 devinfo->ctl_completed,
182 msecs_to_jiffies(IOCTL_RESP_TIMEOUT));
185 static void brcmf_usb_ioctl_resp_wake(struct brcmf_usbdev_info *devinfo)
187 if (waitqueue_active(&devinfo->ioctl_resp_wait))
188 wake_up(&devinfo->ioctl_resp_wait);
192 brcmf_usb_ctl_complete(struct brcmf_usbdev_info *devinfo, int type, int status)
194 brcmf_dbg(USB, "Enter, status=%d\n", status);
196 if (unlikely(devinfo == NULL))
199 if (type == BRCMF_USB_CBCTL_READ) {
201 devinfo->bus_pub.stats.rx_ctlpkts++;
203 devinfo->bus_pub.stats.rx_ctlerrs++;
204 } else if (type == BRCMF_USB_CBCTL_WRITE) {
206 devinfo->bus_pub.stats.tx_ctlpkts++;
208 devinfo->bus_pub.stats.tx_ctlerrs++;
211 devinfo->ctl_urb_status = status;
212 devinfo->ctl_completed = true;
213 brcmf_usb_ioctl_resp_wake(devinfo);
217 brcmf_usb_ctlread_complete(struct urb *urb)
219 struct brcmf_usbdev_info *devinfo =
220 (struct brcmf_usbdev_info *)urb->context;
222 brcmf_dbg(USB, "Enter\n");
223 devinfo->ctl_urb_actual_length = urb->actual_length;
224 brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_READ,
229 brcmf_usb_ctlwrite_complete(struct urb *urb)
231 struct brcmf_usbdev_info *devinfo =
232 (struct brcmf_usbdev_info *)urb->context;
234 brcmf_dbg(USB, "Enter\n");
235 brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_WRITE,
240 brcmf_usb_send_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
245 brcmf_dbg(USB, "Enter\n");
246 if (devinfo == NULL || buf == NULL ||
247 len == 0 || devinfo->ctl_urb == NULL)
251 devinfo->ctl_write.wLength = cpu_to_le16p(&size);
252 devinfo->ctl_urb->transfer_buffer_length = size;
253 devinfo->ctl_urb_status = 0;
254 devinfo->ctl_urb_actual_length = 0;
256 usb_fill_control_urb(devinfo->ctl_urb,
258 devinfo->ctl_out_pipe,
259 (unsigned char *) &devinfo->ctl_write,
261 (usb_complete_t)brcmf_usb_ctlwrite_complete,
264 ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
266 brcmf_err("usb_submit_urb failed %d\n", ret);
272 brcmf_usb_recv_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
277 brcmf_dbg(USB, "Enter\n");
278 if ((devinfo == NULL) || (buf == NULL) || (len == 0)
279 || (devinfo->ctl_urb == NULL))
283 devinfo->ctl_read.wLength = cpu_to_le16p(&size);
284 devinfo->ctl_urb->transfer_buffer_length = size;
286 devinfo->ctl_read.bRequestType = USB_DIR_IN
287 | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
288 devinfo->ctl_read.bRequest = 1;
290 usb_fill_control_urb(devinfo->ctl_urb,
292 devinfo->ctl_in_pipe,
293 (unsigned char *) &devinfo->ctl_read,
295 (usb_complete_t)brcmf_usb_ctlread_complete,
298 ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
300 brcmf_err("usb_submit_urb failed %d\n", ret);
305 static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
309 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
311 brcmf_dbg(USB, "Enter\n");
312 if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
315 if (test_and_set_bit(0, &devinfo->ctl_op))
318 devinfo->ctl_completed = false;
319 err = brcmf_usb_send_ctl(devinfo, buf, len);
321 brcmf_err("fail %d bytes: %d\n", err, len);
322 clear_bit(0, &devinfo->ctl_op);
325 timeout = brcmf_usb_ioctl_resp_wait(devinfo);
326 clear_bit(0, &devinfo->ctl_op);
328 brcmf_err("Txctl wait timed out\n");
334 static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
338 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
340 brcmf_dbg(USB, "Enter\n");
341 if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
344 if (test_and_set_bit(0, &devinfo->ctl_op))
347 devinfo->ctl_completed = false;
348 err = brcmf_usb_recv_ctl(devinfo, buf, len);
350 brcmf_err("fail %d bytes: %d\n", err, len);
351 clear_bit(0, &devinfo->ctl_op);
354 timeout = brcmf_usb_ioctl_resp_wait(devinfo);
355 err = devinfo->ctl_urb_status;
356 clear_bit(0, &devinfo->ctl_op);
358 brcmf_err("rxctl wait timed out\n");
362 return devinfo->ctl_urb_actual_length;
367 static struct brcmf_usbreq *brcmf_usb_deq(struct brcmf_usbdev_info *devinfo,
368 struct list_head *q, int *counter)
371 struct brcmf_usbreq *req;
372 spin_lock_irqsave(&devinfo->qlock, flags);
374 spin_unlock_irqrestore(&devinfo->qlock, flags);
377 req = list_entry(q->next, struct brcmf_usbreq, list);
378 list_del_init(q->next);
381 spin_unlock_irqrestore(&devinfo->qlock, flags);
386 static void brcmf_usb_enq(struct brcmf_usbdev_info *devinfo,
387 struct list_head *q, struct brcmf_usbreq *req,
391 spin_lock_irqsave(&devinfo->qlock, flags);
392 list_add_tail(&req->list, q);
395 spin_unlock_irqrestore(&devinfo->qlock, flags);
398 static struct brcmf_usbreq *
399 brcmf_usbdev_qinit(struct list_head *q, int qsize)
402 struct brcmf_usbreq *req, *reqs;
404 reqs = kcalloc(qsize, sizeof(struct brcmf_usbreq), GFP_ATOMIC);
410 for (i = 0; i < qsize; i++) {
411 req->urb = usb_alloc_urb(0, GFP_ATOMIC);
415 INIT_LIST_HEAD(&req->list);
416 list_add_tail(&req->list, q);
421 brcmf_err("fail!\n");
422 while (!list_empty(q)) {
423 req = list_entry(q->next, struct brcmf_usbreq, list);
425 usb_free_urb(req->urb);
432 static void brcmf_usb_free_q(struct list_head *q, bool pending)
434 struct brcmf_usbreq *req, *next;
436 list_for_each_entry_safe(req, next, q, list) {
438 brcmf_err("bad req\n");
443 usb_kill_urb(req->urb);
445 usb_free_urb(req->urb);
446 list_del_init(&req->list);
451 static void brcmf_usb_del_fromq(struct brcmf_usbdev_info *devinfo,
452 struct brcmf_usbreq *req)
456 spin_lock_irqsave(&devinfo->qlock, flags);
457 list_del_init(&req->list);
458 spin_unlock_irqrestore(&devinfo->qlock, flags);
462 static void brcmf_usb_tx_complete(struct urb *urb)
464 struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
465 struct brcmf_usbdev_info *devinfo = req->devinfo;
468 brcmf_dbg(USB, "Enter, urb->status=%d, skb=%p\n", urb->status,
470 brcmf_usb_del_fromq(devinfo, req);
472 brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
474 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req, &devinfo->tx_freecount);
475 spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);
476 if (devinfo->tx_freecount > devinfo->tx_high_watermark &&
477 devinfo->tx_flowblock) {
478 brcmf_txflowblock(devinfo->dev, false);
479 devinfo->tx_flowblock = false;
481 spin_unlock_irqrestore(&devinfo->tx_flowblock_lock, flags);
484 static void brcmf_usb_rx_complete(struct urb *urb)
486 struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
487 struct brcmf_usbdev_info *devinfo = req->devinfo;
490 brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
491 brcmf_usb_del_fromq(devinfo, req);
495 /* zero lenght packets indicate usb "failure". Do not refill */
496 if (urb->status != 0 || !urb->actual_length) {
497 brcmu_pkt_buf_free_skb(skb);
498 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
502 if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
503 skb_put(skb, urb->actual_length);
504 brcmf_rx_frame(devinfo->dev, skb);
505 brcmf_usb_rx_refill(devinfo, req);
507 brcmu_pkt_buf_free_skb(skb);
508 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
514 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
515 struct brcmf_usbreq *req)
520 if (!req || !devinfo)
523 skb = dev_alloc_skb(devinfo->bus_pub.bus_mtu);
525 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
530 usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
531 skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
533 req->devinfo = devinfo;
534 brcmf_usb_enq(devinfo, &devinfo->rx_postq, req, NULL);
536 ret = usb_submit_urb(req->urb, GFP_ATOMIC);
538 brcmf_usb_del_fromq(devinfo, req);
539 brcmu_pkt_buf_free_skb(req->skb);
541 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
546 static void brcmf_usb_rx_fill_all(struct brcmf_usbdev_info *devinfo)
548 struct brcmf_usbreq *req;
550 if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
551 brcmf_err("bus is not up=%d\n", devinfo->bus_pub.state);
554 while ((req = brcmf_usb_deq(devinfo, &devinfo->rx_freeq, NULL)) != NULL)
555 brcmf_usb_rx_refill(devinfo, req);
559 brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
561 struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
564 brcmf_dbg(USB, "Enter, current state=%d, new state=%d\n",
565 devinfo->bus_pub.state, state);
567 if (devinfo->bus_pub.state == state)
570 old_state = devinfo->bus_pub.state;
571 devinfo->bus_pub.state = state;
573 /* update state of upper layer */
574 if (state == BRCMFMAC_USB_STATE_DOWN) {
575 brcmf_dbg(USB, "DBUS is down\n");
576 brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_DOWN);
577 } else if (state == BRCMFMAC_USB_STATE_UP) {
578 brcmf_dbg(USB, "DBUS is up\n");
579 brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_DATA);
581 brcmf_dbg(USB, "DBUS current state=%d\n", state);
585 static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
587 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
588 struct brcmf_usbreq *req;
592 brcmf_dbg(USB, "Enter, skb=%p\n", skb);
593 if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
598 req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq,
599 &devinfo->tx_freecount);
601 brcmf_err("no req to send\n");
607 req->devinfo = devinfo;
608 usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
609 skb->data, skb->len, brcmf_usb_tx_complete, req);
610 req->urb->transfer_flags |= URB_ZERO_PACKET;
611 brcmf_usb_enq(devinfo, &devinfo->tx_postq, req, NULL);
612 ret = usb_submit_urb(req->urb, GFP_ATOMIC);
614 brcmf_err("brcmf_usb_tx usb_submit_urb FAILED\n");
615 brcmf_usb_del_fromq(devinfo, req);
617 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req,
618 &devinfo->tx_freecount);
622 spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);
623 if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
624 !devinfo->tx_flowblock) {
625 brcmf_txflowblock(dev, true);
626 devinfo->tx_flowblock = true;
628 spin_unlock_irqrestore(&devinfo->tx_flowblock_lock, flags);
636 static int brcmf_usb_up(struct device *dev)
638 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
640 brcmf_dbg(USB, "Enter\n");
641 if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP)
644 /* Success, indicate devinfo is fully up */
645 brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_UP);
647 if (devinfo->ctl_urb) {
648 devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
649 devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
652 devinfo->ctl_write.bRequestType =
653 USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
654 devinfo->ctl_write.bRequest = 0;
655 devinfo->ctl_write.wValue = cpu_to_le16(0);
656 devinfo->ctl_write.wIndex = cpu_to_le16(devinfo->ifnum);
659 devinfo->ctl_read.bRequestType =
660 USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
661 devinfo->ctl_read.bRequest = 1;
662 devinfo->ctl_read.wValue = cpu_to_le16(0);
663 devinfo->ctl_read.wIndex = cpu_to_le16(devinfo->ifnum);
665 brcmf_usb_rx_fill_all(devinfo);
669 static void brcmf_cancel_all_urbs(struct brcmf_usbdev_info *devinfo)
671 if (devinfo->ctl_urb)
672 usb_kill_urb(devinfo->ctl_urb);
673 if (devinfo->bulk_urb)
674 usb_kill_urb(devinfo->bulk_urb);
675 brcmf_usb_free_q(&devinfo->tx_postq, true);
676 brcmf_usb_free_q(&devinfo->rx_postq, true);
679 static void brcmf_usb_down(struct device *dev)
681 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
683 brcmf_dbg(USB, "Enter\n");
687 if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN)
690 brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_DOWN);
692 brcmf_cancel_all_urbs(devinfo);
696 brcmf_usb_sync_complete(struct urb *urb)
698 struct brcmf_usbdev_info *devinfo =
699 (struct brcmf_usbdev_info *)urb->context;
701 devinfo->ctl_completed = true;
702 brcmf_usb_ioctl_resp_wake(devinfo);
705 static int brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
706 void *buffer, int buflen)
712 if ((!devinfo) || (devinfo->ctl_urb == NULL))
715 tmpbuf = kmalloc(buflen, GFP_ATOMIC);
720 devinfo->ctl_urb->transfer_buffer_length = size;
722 devinfo->ctl_read.wLength = cpu_to_le16p(&size);
723 devinfo->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
725 devinfo->ctl_read.bRequest = cmd;
727 usb_fill_control_urb(devinfo->ctl_urb,
729 usb_rcvctrlpipe(devinfo->usbdev, 0),
730 (unsigned char *) &devinfo->ctl_read,
731 (void *) tmpbuf, size,
732 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
734 devinfo->ctl_completed = false;
735 ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
737 brcmf_err("usb_submit_urb failed %d\n", ret);
741 if (!brcmf_usb_ioctl_resp_wait(devinfo)) {
742 usb_kill_urb(devinfo->ctl_urb);
745 memcpy(buffer, tmpbuf, buflen);
754 brcmf_usb_dlneeded(struct brcmf_usbdev_info *devinfo)
756 struct bootrom_id_le id;
759 brcmf_dbg(USB, "Enter\n");
764 /* Check if firmware downloaded already by querying runtime ID */
765 id.chip = cpu_to_le32(0xDEAD);
766 brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
768 chipid = le32_to_cpu(id.chip);
769 chiprev = le32_to_cpu(id.chiprev);
771 if ((chipid & 0x4300) == 0x4300)
772 brcmf_dbg(USB, "chip %x rev 0x%x\n", chipid, chiprev);
774 brcmf_dbg(USB, "chip %d rev 0x%x\n", chipid, chiprev);
775 if (chipid == BRCMF_POSTBOOT_ID) {
776 brcmf_dbg(USB, "firmware already downloaded\n");
777 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
780 devinfo->bus_pub.devid = chipid;
781 devinfo->bus_pub.chiprev = chiprev;
787 brcmf_usb_resetcfg(struct brcmf_usbdev_info *devinfo)
789 struct bootrom_id_le id;
793 brcmf_dbg(USB, "Enter\n");
797 mdelay(BRCMF_USB_RESET_GETVER_SPINWAIT);
799 id.chip = cpu_to_le32(0xDEAD); /* Get the ID */
800 err = brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
801 if ((err) && (err != -ETIMEDOUT))
803 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID))
805 } while (loop_cnt < BRCMF_USB_RESET_GETVER_LOOP_CNT);
807 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID)) {
808 brcmf_dbg(USB, "postboot chip 0x%x/rev 0x%x\n",
809 le32_to_cpu(id.chip), le32_to_cpu(id.chiprev));
811 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
814 brcmf_err("Cannot talk to Dongle. Firmware is not UP, %d ms\n",
815 BRCMF_USB_RESET_GETVER_SPINWAIT * loop_cnt);
822 brcmf_usb_dl_send_bulk(struct brcmf_usbdev_info *devinfo, void *buffer, int len)
826 if ((devinfo == NULL) || (devinfo->bulk_urb == NULL))
829 /* Prepare the URB */
830 usb_fill_bulk_urb(devinfo->bulk_urb, devinfo->usbdev,
831 devinfo->tx_pipe, buffer, len,
832 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
834 devinfo->bulk_urb->transfer_flags |= URB_ZERO_PACKET;
836 devinfo->ctl_completed = false;
837 ret = usb_submit_urb(devinfo->bulk_urb, GFP_ATOMIC);
839 brcmf_err("usb_submit_urb failed %d\n", ret);
842 ret = brcmf_usb_ioctl_resp_wait(devinfo);
847 brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
849 unsigned int sendlen, sent, dllen;
850 char *bulkchunk = NULL, *dlpos;
851 struct rdl_state_le state;
852 u32 rdlstate, rdlbytes;
855 brcmf_dbg(USB, "Enter, fw %p, len %d\n", fw, fwlen);
857 bulkchunk = kmalloc(TRX_RDL_CHUNK, GFP_ATOMIC);
858 if (bulkchunk == NULL) {
863 /* 1) Prepare USB boot loader for runtime image */
864 brcmf_usb_dl_cmd(devinfo, DL_START, &state, sizeof(state));
866 rdlstate = le32_to_cpu(state.state);
867 rdlbytes = le32_to_cpu(state.bytes);
869 /* 2) Check we are in the Waiting state */
870 if (rdlstate != DL_WAITING) {
871 brcmf_err("Failed to DL_START\n");
879 /* Get chip id and rev */
880 while (rdlbytes != dllen) {
881 /* Wait until the usb device reports it received all
882 * the bytes we sent */
883 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
884 if ((dllen-sent) < TRX_RDL_CHUNK)
885 sendlen = dllen-sent;
887 sendlen = TRX_RDL_CHUNK;
889 /* simply avoid having to send a ZLP by ensuring we
897 memcpy(bulkchunk, dlpos, sendlen);
898 if (brcmf_usb_dl_send_bulk(devinfo, bulkchunk,
900 brcmf_err("send_bulk failed\n");
908 err = brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
911 brcmf_err("DL_GETSTATE Failed\n");
915 rdlstate = le32_to_cpu(state.state);
916 rdlbytes = le32_to_cpu(state.bytes);
918 /* restart if an error is reported */
919 if (rdlstate == DL_BAD_HDR || rdlstate == DL_BAD_CRC) {
920 brcmf_err("Bad Hdr or Bad CRC state %d\n",
929 brcmf_dbg(USB, "Exit, err=%d\n", err);
933 static int brcmf_usb_dlstart(struct brcmf_usbdev_info *devinfo, u8 *fw, int len)
937 brcmf_dbg(USB, "Enter\n");
942 if (devinfo->bus_pub.devid == 0xDEAD)
945 err = brcmf_usb_dl_writeimage(devinfo, fw, len);
947 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_DONE;
949 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_FAIL;
950 brcmf_dbg(USB, "Exit, err=%d\n", err);
955 static int brcmf_usb_dlrun(struct brcmf_usbdev_info *devinfo)
957 struct rdl_state_le state;
959 brcmf_dbg(USB, "Enter\n");
963 if (devinfo->bus_pub.devid == 0xDEAD)
966 /* Check we are runnable */
968 brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state, sizeof(state));
970 /* Start the image */
971 if (state.state == cpu_to_le32(DL_RUNNABLE)) {
972 if (brcmf_usb_dl_cmd(devinfo, DL_GO, &state, sizeof(state)))
974 if (brcmf_usb_resetcfg(devinfo))
976 /* The Dongle may go for re-enumeration. */
978 brcmf_err("Dongle not runnable\n");
981 brcmf_dbg(USB, "Exit\n");
985 static bool brcmf_usb_chip_support(int chipid, int chiprev)
988 case BRCM_CC_43143_CHIP_ID:
990 case BRCM_CC_43235_CHIP_ID:
991 case BRCM_CC_43236_CHIP_ID:
992 case BRCM_CC_43238_CHIP_ID:
993 return (chiprev == 3);
994 case BRCM_CC_43242_CHIP_ID:
996 case BRCM_CC_43566_CHIP_ID:
997 case BRCM_CC_43569_CHIP_ID:
1006 brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
1011 brcmf_dbg(USB, "Enter\n");
1012 if (devinfo == NULL)
1015 devid = devinfo->bus_pub.devid;
1016 chiprev = devinfo->bus_pub.chiprev;
1018 if (!brcmf_usb_chip_support(devid, chiprev)) {
1019 brcmf_err("unsupported chip %d rev %d\n",
1024 if (!devinfo->image) {
1025 brcmf_err("No firmware!\n");
1029 err = brcmf_usb_dlstart(devinfo,
1030 (u8 *)devinfo->image, devinfo->image_len);
1032 err = brcmf_usb_dlrun(devinfo);
1037 static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
1039 brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
1042 brcmf_usb_free_q(&devinfo->rx_freeq, false);
1043 brcmf_usb_free_q(&devinfo->tx_freeq, false);
1045 usb_free_urb(devinfo->ctl_urb);
1046 usb_free_urb(devinfo->bulk_urb);
1048 kfree(devinfo->tx_reqs);
1049 kfree(devinfo->rx_reqs);
1053 static int check_file(const u8 *headers)
1055 struct trx_header_le *trx;
1056 int actual_len = -1;
1058 brcmf_dbg(USB, "Enter\n");
1059 /* Extract trx header */
1060 trx = (struct trx_header_le *) headers;
1061 if (trx->magic != cpu_to_le32(TRX_MAGIC))
1064 headers += sizeof(struct trx_header_le);
1066 if (le32_to_cpu(trx->flag_version) & TRX_UNCOMP_IMAGE) {
1067 actual_len = le32_to_cpu(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]);
1068 return actual_len + sizeof(struct trx_header_le);
1073 static const char *brcmf_usb_get_fwname(struct brcmf_usbdev_info *devinfo)
1075 switch (devinfo->bus_pub.devid) {
1076 case BRCM_CC_43143_CHIP_ID:
1077 return BRCMF_USB_43143_FW_NAME;
1078 case BRCM_CC_43235_CHIP_ID:
1079 case BRCM_CC_43236_CHIP_ID:
1080 case BRCM_CC_43238_CHIP_ID:
1081 return BRCMF_USB_43236_FW_NAME;
1082 case BRCM_CC_43242_CHIP_ID:
1083 return BRCMF_USB_43242_FW_NAME;
1084 case BRCM_CC_43566_CHIP_ID:
1085 case BRCM_CC_43569_CHIP_ID:
1086 return BRCMF_USB_43569_FW_NAME;
1094 struct brcmf_usbdev *brcmf_usb_attach(struct brcmf_usbdev_info *devinfo,
1097 brcmf_dbg(USB, "Enter\n");
1099 devinfo->bus_pub.nrxq = nrxq;
1100 devinfo->rx_low_watermark = nrxq / 2;
1101 devinfo->bus_pub.devinfo = devinfo;
1102 devinfo->bus_pub.ntxq = ntxq;
1103 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DOWN;
1105 /* flow control when too many tx urbs posted */
1106 devinfo->tx_low_watermark = ntxq / 4;
1107 devinfo->tx_high_watermark = devinfo->tx_low_watermark * 3;
1108 devinfo->bus_pub.bus_mtu = BRCMF_USB_MAX_PKT_SIZE;
1110 /* Initialize other structure content */
1111 init_waitqueue_head(&devinfo->ioctl_resp_wait);
1113 /* Initialize the spinlocks */
1114 spin_lock_init(&devinfo->qlock);
1115 spin_lock_init(&devinfo->tx_flowblock_lock);
1117 INIT_LIST_HEAD(&devinfo->rx_freeq);
1118 INIT_LIST_HEAD(&devinfo->rx_postq);
1120 INIT_LIST_HEAD(&devinfo->tx_freeq);
1121 INIT_LIST_HEAD(&devinfo->tx_postq);
1123 devinfo->tx_flowblock = false;
1125 devinfo->rx_reqs = brcmf_usbdev_qinit(&devinfo->rx_freeq, nrxq);
1126 if (!devinfo->rx_reqs)
1129 devinfo->tx_reqs = brcmf_usbdev_qinit(&devinfo->tx_freeq, ntxq);
1130 if (!devinfo->tx_reqs)
1132 devinfo->tx_freecount = ntxq;
1134 devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
1135 if (!devinfo->ctl_urb) {
1136 brcmf_err("usb_alloc_urb (ctl) failed\n");
1139 devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
1140 if (!devinfo->bulk_urb) {
1141 brcmf_err("usb_alloc_urb (bulk) failed\n");
1145 return &devinfo->bus_pub;
1148 brcmf_err("failed!\n");
1149 brcmf_usb_detach(devinfo);
1153 static void brcmf_usb_wowl_config(struct device *dev, bool enabled)
1155 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
1157 brcmf_dbg(USB, "Configuring WOWL, enabled=%d\n", enabled);
1158 devinfo->wowl_enabled = enabled;
1160 device_set_wakeup_enable(devinfo->dev, true);
1162 device_set_wakeup_enable(devinfo->dev, false);
1165 static struct brcmf_bus_ops brcmf_usb_bus_ops = {
1166 .txdata = brcmf_usb_tx,
1167 .stop = brcmf_usb_down,
1168 .txctl = brcmf_usb_tx_ctlpkt,
1169 .rxctl = brcmf_usb_rx_ctlpkt,
1170 .wowl_config = brcmf_usb_wowl_config,
1173 static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
1177 /* Attach to the common driver interface */
1178 ret = brcmf_attach(devinfo->dev);
1180 brcmf_err("brcmf_attach failed\n");
1184 ret = brcmf_usb_up(devinfo->dev);
1188 ret = brcmf_bus_start(devinfo->dev);
1194 brcmf_detach(devinfo->dev);
1198 static void brcmf_usb_probe_phase2(struct device *dev,
1199 const struct firmware *fw,
1200 void *nvram, u32 nvlen)
1202 struct brcmf_bus *bus = dev_get_drvdata(dev);
1203 struct brcmf_usbdev_info *devinfo;
1206 brcmf_dbg(USB, "Start fw downloading\n");
1207 ret = check_file(fw->data);
1209 brcmf_err("invalid firmware\n");
1210 release_firmware(fw);
1214 devinfo = bus->bus_priv.usb->devinfo;
1215 devinfo->image = fw->data;
1216 devinfo->image_len = fw->size;
1218 ret = brcmf_usb_fw_download(devinfo);
1219 release_firmware(fw);
1223 ret = brcmf_usb_bus_setup(devinfo);
1229 brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), ret);
1230 device_release_driver(dev);
1233 static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
1235 struct brcmf_bus *bus = NULL;
1236 struct brcmf_usbdev *bus_pub = NULL;
1237 struct device *dev = devinfo->dev;
1240 brcmf_dbg(USB, "Enter\n");
1241 bus_pub = brcmf_usb_attach(devinfo, BRCMF_USB_NRXQ, BRCMF_USB_NTXQ);
1245 bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
1253 bus->bus_priv.usb = bus_pub;
1254 dev_set_drvdata(dev, bus);
1255 bus->ops = &brcmf_usb_bus_ops;
1256 bus->proto_type = BRCMF_PROTO_BCDC;
1257 bus->always_use_fws_queue = true;
1259 bus->wowl_supported = true;
1262 if (!brcmf_usb_dlneeded(devinfo)) {
1263 ret = brcmf_usb_bus_setup(devinfo);
1267 bus->chip = bus_pub->devid;
1268 bus->chiprev = bus_pub->chiprev;
1270 /* request firmware here */
1271 brcmf_fw_get_firmwares(dev, 0, brcmf_usb_get_fwname(devinfo), NULL,
1272 brcmf_usb_probe_phase2);
1276 /* Release resources in reverse order */
1278 brcmf_usb_detach(devinfo);
1283 brcmf_usb_disconnect_cb(struct brcmf_usbdev_info *devinfo)
1287 brcmf_dbg(USB, "Enter, bus_pub %p\n", devinfo);
1289 brcmf_detach(devinfo->dev);
1290 kfree(devinfo->bus_pub.bus);
1291 brcmf_usb_detach(devinfo);
1295 brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
1297 struct usb_device *usb = interface_to_usbdev(intf);
1298 struct brcmf_usbdev_info *devinfo;
1299 struct usb_interface_descriptor *desc;
1300 struct usb_endpoint_descriptor *endpoint;
1303 u8 endpoint_num, ep;
1305 brcmf_dbg(USB, "Enter 0x%04x:0x%04x\n", id->idVendor, id->idProduct);
1307 devinfo = kzalloc(sizeof(*devinfo), GFP_ATOMIC);
1308 if (devinfo == NULL)
1311 devinfo->usbdev = usb;
1312 devinfo->dev = &usb->dev;
1313 usb_set_intfdata(intf, devinfo);
1315 /* Check that the device supports only one configuration */
1316 if (usb->descriptor.bNumConfigurations != 1) {
1317 brcmf_err("Number of configurations: %d not supported\n",
1318 usb->descriptor.bNumConfigurations);
1323 if ((usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) &&
1324 (usb->descriptor.bDeviceClass != USB_CLASS_MISC) &&
1325 (usb->descriptor.bDeviceClass != USB_CLASS_WIRELESS_CONTROLLER)) {
1326 brcmf_err("Device class: 0x%x not supported\n",
1327 usb->descriptor.bDeviceClass);
1332 desc = &intf->altsetting[0].desc;
1333 if ((desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) ||
1334 (desc->bInterfaceSubClass != 2) ||
1335 (desc->bInterfaceProtocol != 0xff)) {
1336 brcmf_err("non WLAN interface %d: 0x%x:0x%x:0x%x\n",
1337 desc->bInterfaceNumber, desc->bInterfaceClass,
1338 desc->bInterfaceSubClass, desc->bInterfaceProtocol);
1343 num_of_eps = desc->bNumEndpoints;
1344 for (ep = 0; ep < num_of_eps; ep++) {
1345 endpoint = &intf->altsetting[0].endpoint[ep].desc;
1346 endpoint_num = usb_endpoint_num(endpoint);
1347 if (!usb_endpoint_xfer_bulk(endpoint))
1349 if (usb_endpoint_dir_in(endpoint)) {
1350 if (!devinfo->rx_pipe)
1352 usb_rcvbulkpipe(usb, endpoint_num);
1354 if (!devinfo->tx_pipe)
1356 usb_sndbulkpipe(usb, endpoint_num);
1359 if (devinfo->rx_pipe == 0) {
1360 brcmf_err("No RX (in) Bulk EP found\n");
1364 if (devinfo->tx_pipe == 0) {
1365 brcmf_err("No TX (out) Bulk EP found\n");
1370 devinfo->ifnum = desc->bInterfaceNumber;
1372 if (usb->speed == USB_SPEED_SUPER)
1373 brcmf_dbg(USB, "Broadcom super speed USB WLAN interface detected\n");
1374 else if (usb->speed == USB_SPEED_HIGH)
1375 brcmf_dbg(USB, "Broadcom high speed USB WLAN interface detected\n");
1377 brcmf_dbg(USB, "Broadcom full speed USB WLAN interface detected\n");
1379 ret = brcmf_usb_probe_cb(devinfo);
1388 usb_set_intfdata(intf, NULL);
1393 brcmf_usb_disconnect(struct usb_interface *intf)
1395 struct brcmf_usbdev_info *devinfo;
1397 brcmf_dbg(USB, "Enter\n");
1398 devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf);
1399 brcmf_usb_disconnect_cb(devinfo);
1401 brcmf_dbg(USB, "Exit\n");
1405 * only need to signal the bus being down and update the state.
1407 static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
1409 struct usb_device *usb = interface_to_usbdev(intf);
1410 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1412 brcmf_dbg(USB, "Enter\n");
1413 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_SLEEP;
1414 if (devinfo->wowl_enabled)
1415 brcmf_cancel_all_urbs(devinfo);
1417 brcmf_detach(&usb->dev);
1422 * (re-) start the bus.
1424 static int brcmf_usb_resume(struct usb_interface *intf)
1426 struct usb_device *usb = interface_to_usbdev(intf);
1427 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1429 brcmf_dbg(USB, "Enter\n");
1430 if (!devinfo->wowl_enabled)
1431 return brcmf_usb_bus_setup(devinfo);
1433 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_UP;
1434 brcmf_usb_rx_fill_all(devinfo);
1438 static int brcmf_usb_reset_resume(struct usb_interface *intf)
1440 struct usb_device *usb = interface_to_usbdev(intf);
1441 struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1443 brcmf_dbg(USB, "Enter\n");
1445 return brcmf_fw_get_firmwares(&usb->dev, 0,
1446 brcmf_usb_get_fwname(devinfo), NULL,
1447 brcmf_usb_probe_phase2);
1450 #define BRCMF_USB_DEVICE(dev_id) \
1451 { USB_DEVICE(BRCM_USB_VENDOR_ID_BROADCOM, dev_id) }
1453 static struct usb_device_id brcmf_usb_devid_table[] = {
1454 BRCMF_USB_DEVICE(BRCM_USB_43143_DEVICE_ID),
1455 BRCMF_USB_DEVICE(BRCM_USB_43236_DEVICE_ID),
1456 BRCMF_USB_DEVICE(BRCM_USB_43242_DEVICE_ID),
1457 BRCMF_USB_DEVICE(BRCM_USB_43569_DEVICE_ID),
1458 /* special entry for device with firmware loaded and running */
1459 BRCMF_USB_DEVICE(BRCM_USB_BCMFW_DEVICE_ID),
1460 { /* end: all zeroes */ }
1463 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
1464 MODULE_FIRMWARE(BRCMF_USB_43143_FW_NAME);
1465 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
1466 MODULE_FIRMWARE(BRCMF_USB_43242_FW_NAME);
1467 MODULE_FIRMWARE(BRCMF_USB_43569_FW_NAME);
1469 static struct usb_driver brcmf_usbdrvr = {
1470 .name = KBUILD_MODNAME,
1471 .probe = brcmf_usb_probe,
1472 .disconnect = brcmf_usb_disconnect,
1473 .id_table = brcmf_usb_devid_table,
1474 .suspend = brcmf_usb_suspend,
1475 .resume = brcmf_usb_resume,
1476 .reset_resume = brcmf_usb_reset_resume,
1477 .supports_autosuspend = 1,
1478 .disable_hub_initiated_lpm = 1,
1481 static int brcmf_usb_reset_device(struct device *dev, void *notused)
1483 /* device past is the usb interface so we
1484 * need to use parent here.
1486 brcmf_dev_reset(dev->parent);
1490 void brcmf_usb_exit(void)
1492 struct device_driver *drv = &brcmf_usbdrvr.drvwrap.driver;
1495 brcmf_dbg(USB, "Enter\n");
1496 ret = driver_for_each_device(drv, NULL, NULL,
1497 brcmf_usb_reset_device);
1498 usb_deregister(&brcmf_usbdrvr);
1501 void brcmf_usb_register(void)
1503 brcmf_dbg(USB, "Enter\n");
1504 usb_register(&brcmf_usbdrvr);