drivers/net/wireless/brcm80211/brcmfmac/usb.c

   1 /*
   2  * Copyright (c) 2011 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/kernel.h>
  18 #include <linux/module.h>
  19 #include <linux/firmware.h>
  20 #include <linux/usb.h>
  21 #include <linux/vmalloc.h>
  22
  23 #include <brcmu_utils.h>
  24 #include <brcmu_wifi.h>
  25 #include <dhd_bus.h>
  26 #include <dhd_dbg.h>
  27
  28 #include "usb_rdl.h"
  29 #include "usb.h"
  30
  31 #define IOCTL_RESP_TIMEOUT  2000
  32
  33 #define BRCMF_USB_RESET_GETVER_SPINWAIT 100     /* in unit of ms */
  34 #define BRCMF_USB_RESET_GETVER_LOOP_CNT 10
  35
  36 #define BRCMF_POSTBOOT_ID               0xA123  /* ID to detect if dongle
  37                                                    has boot up */
  38 #define BRCMF_USB_NRXQ  50
  39 #define BRCMF_USB_NTXQ  50
  40
  41 #define CONFIGDESC(usb)         (&((usb)->actconfig)->desc)
  42 #define IFPTR(usb, idx)         ((usb)->actconfig->interface[(idx)])
  43 #define IFALTS(usb, idx)        (IFPTR((usb), (idx))->altsetting[0])
  44 #define IFDESC(usb, idx)        IFALTS((usb), (idx)).desc
  45 #define IFEPDESC(usb, idx, ep)  (IFALTS((usb), (idx)).endpoint[(ep)]).desc
  46
  47 #define CONTROL_IF              0
  48 #define BULK_IF                 0
  49
  50 #define BRCMF_USB_CBCTL_WRITE   0
  51 #define BRCMF_USB_CBCTL_READ    1
  52 #define BRCMF_USB_MAX_PKT_SIZE  1600
  53
  54 #define BRCMF_USB_43143_FW_NAME "brcm/brcmfmac43143.bin"
  55 #define BRCMF_USB_43236_FW_NAME "brcm/brcmfmac43236b.bin"
  56 #define BRCMF_USB_43242_FW_NAME "brcm/brcmfmac43242a.bin"
  57
  58 struct brcmf_usb_image {
  59         struct list_head list;
  60         s8 *fwname;
  61         u8 *image;
  62         int image_len;
  63 };
  64 static struct list_head fw_image_list;
  65
  66 struct intr_transfer_buf {
  67         u32 notification;
  68         u32 reserved;
  69 };
  70
  71 struct brcmf_usbdev_info {
  72         struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
  73         spinlock_t qlock;
  74         struct list_head rx_freeq;
  75         struct list_head rx_postq;
  76         struct list_head tx_freeq;
  77         struct list_head tx_postq;
  78         uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
  79
  80         int rx_low_watermark;
  81         int tx_low_watermark;
  82         int tx_high_watermark;
  83         int tx_freecount;
  84         bool tx_flowblock;
  85         spinlock_t tx_flowblock_lock;
  86
  87         struct brcmf_usbreq *tx_reqs;
  88         struct brcmf_usbreq *rx_reqs;
  89
  90         u8 *image;      /* buffer for combine fw and nvram */
  91         int image_len;
  92
  93         struct usb_device *usbdev;
  94         struct device *dev;
  95
  96         int ctl_in_pipe, ctl_out_pipe;
  97         struct urb *ctl_urb; /* URB for control endpoint */
  98         struct usb_ctrlrequest ctl_write;
  99         struct usb_ctrlrequest ctl_read;
 100         u32 ctl_urb_actual_length;
 101         int ctl_urb_status;
 102         int ctl_completed;
 103         wait_queue_head_t ioctl_resp_wait;
 104         ulong ctl_op;
 105
 106         struct urb *bulk_urb; /* used for FW download */
 107         struct urb *intr_urb; /* URB for interrupt endpoint */
 108         int intr_size;          /* Size of interrupt message */
 109         int interval;           /* Interrupt polling interval */
 110         struct intr_transfer_buf intr; /* Data buffer for interrupt endpoint */
 111 };
 112
 113 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 114                                 struct brcmf_usbreq  *req);
 115
 116 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
 117 {
 118         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
 119         return bus_if->bus_priv.usb;
 120 }
 121
 122 static struct brcmf_usbdev_info *brcmf_usb_get_businfo(struct device *dev)
 123 {
 124         return brcmf_usb_get_buspub(dev)->devinfo;
 125 }
 126
 127 static int brcmf_usb_ioctl_resp_wait(struct brcmf_usbdev_info *devinfo)
 128 {
 129         return wait_event_timeout(devinfo->ioctl_resp_wait,
 130                                   devinfo->ctl_completed,
 131                                   msecs_to_jiffies(IOCTL_RESP_TIMEOUT));
 132 }
 133
 134 static void brcmf_usb_ioctl_resp_wake(struct brcmf_usbdev_info *devinfo)
 135 {
 136         if (waitqueue_active(&devinfo->ioctl_resp_wait))
 137                 wake_up(&devinfo->ioctl_resp_wait);
 138 }
 139
 140 static void
 141 brcmf_usb_ctl_complete(struct brcmf_usbdev_info *devinfo, int type, int status)
 142 {
 143         brcmf_dbg(USB, "Enter, status=%d\n", status);
 144
 145         if (unlikely(devinfo == NULL))
 146                 return;
 147
 148         if (type == BRCMF_USB_CBCTL_READ) {
 149                 if (status == 0)
 150                         devinfo->bus_pub.stats.rx_ctlpkts++;
 151                 else
 152                         devinfo->bus_pub.stats.rx_ctlerrs++;
 153         } else if (type == BRCMF_USB_CBCTL_WRITE) {
 154                 if (status == 0)
 155                         devinfo->bus_pub.stats.tx_ctlpkts++;
 156                 else
 157                         devinfo->bus_pub.stats.tx_ctlerrs++;
 158         }
 159
 160         devinfo->ctl_urb_status = status;
 161         devinfo->ctl_completed = true;
 162         brcmf_usb_ioctl_resp_wake(devinfo);
 163 }
 164
 165 static void
 166 brcmf_usb_ctlread_complete(struct urb *urb)
 167 {
 168         struct brcmf_usbdev_info *devinfo =
 169                 (struct brcmf_usbdev_info *)urb->context;
 170
 171         brcmf_dbg(USB, "Enter\n");
 172         devinfo->ctl_urb_actual_length = urb->actual_length;
 173         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_READ,
 174                 urb->status);
 175 }
 176
 177 static void
 178 brcmf_usb_ctlwrite_complete(struct urb *urb)
 179 {
 180         struct brcmf_usbdev_info *devinfo =
 181                 (struct brcmf_usbdev_info *)urb->context;
 182
 183         brcmf_dbg(USB, "Enter\n");
 184         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_WRITE,
 185                 urb->status);
 186 }
 187
 188 static int
 189 brcmf_usb_send_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 190 {
 191         int ret;
 192         u16 size;
 193
 194         brcmf_dbg(USB, "Enter\n");
 195         if (devinfo == NULL || buf == NULL ||
 196             len == 0 || devinfo->ctl_urb == NULL)
 197                 return -EINVAL;
 198
 199         size = len;
 200         devinfo->ctl_write.wLength = cpu_to_le16p(&size);
 201         devinfo->ctl_urb->transfer_buffer_length = size;
 202         devinfo->ctl_urb_status = 0;
 203         devinfo->ctl_urb_actual_length = 0;
 204
 205         usb_fill_control_urb(devinfo->ctl_urb,
 206                 devinfo->usbdev,
 207                 devinfo->ctl_out_pipe,
 208                 (unsigned char *) &devinfo->ctl_write,
 209                 buf, size,
 210                 (usb_complete_t)brcmf_usb_ctlwrite_complete,
 211                 devinfo);
 212
 213         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 214         if (ret < 0)
 215                 brcmf_err("usb_submit_urb failed %d\n", ret);
 216
 217         return ret;
 218 }
 219
 220 static int
 221 brcmf_usb_recv_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 222 {
 223         int ret;
 224         u16 size;
 225
 226         brcmf_dbg(USB, "Enter\n");
 227         if ((devinfo == NULL) || (buf == NULL) || (len == 0)
 228                 || (devinfo->ctl_urb == NULL))
 229                 return -EINVAL;
 230
 231         size = len;
 232         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 233         devinfo->ctl_urb->transfer_buffer_length = size;
 234
 235         devinfo->ctl_read.bRequestType = USB_DIR_IN
 236                 | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 237         devinfo->ctl_read.bRequest = 1;
 238
 239         usb_fill_control_urb(devinfo->ctl_urb,
 240                 devinfo->usbdev,
 241                 devinfo->ctl_in_pipe,
 242                 (unsigned char *) &devinfo->ctl_read,
 243                 buf, size,
 244                 (usb_complete_t)brcmf_usb_ctlread_complete,
 245                 devinfo);
 246
 247         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 248         if (ret < 0)
 249                 brcmf_err("usb_submit_urb failed %d\n", ret);
 250
 251         return ret;
 252 }
 253
 254 static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 255 {
 256         int err = 0;
 257         int timeout = 0;
 258         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 259
 260         brcmf_dbg(USB, "Enter\n");
 261         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 262                 return -EIO;
 263
 264         if (test_and_set_bit(0, &devinfo->ctl_op))
 265                 return -EIO;
 266
 267         devinfo->ctl_completed = false;
 268         err = brcmf_usb_send_ctl(devinfo, buf, len);
 269         if (err) {
 270                 brcmf_err("fail %d bytes: %d\n", err, len);
 271                 clear_bit(0, &devinfo->ctl_op);
 272                 return err;
 273         }
 274         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 275         clear_bit(0, &devinfo->ctl_op);
 276         if (!timeout) {
 277                 brcmf_err("Txctl wait timed out\n");
 278                 err = -EIO;
 279         }
 280         return err;
 281 }
 282
 283 static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 284 {
 285         int err = 0;
 286         int timeout = 0;
 287         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 288
 289         brcmf_dbg(USB, "Enter\n");
 290         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 291                 return -EIO;
 292
 293         if (test_and_set_bit(0, &devinfo->ctl_op))
 294                 return -EIO;
 295
 296         devinfo->ctl_completed = false;
 297         err = brcmf_usb_recv_ctl(devinfo, buf, len);
 298         if (err) {
 299                 brcmf_err("fail %d bytes: %d\n", err, len);
 300                 clear_bit(0, &devinfo->ctl_op);
 301                 return err;
 302         }
 303         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 304         err = devinfo->ctl_urb_status;
 305         clear_bit(0, &devinfo->ctl_op);
 306         if (!timeout) {
 307                 brcmf_err("rxctl wait timed out\n");
 308                 err = -EIO;
 309         }
 310         if (!err)
 311                 return devinfo->ctl_urb_actual_length;
 312         else
 313                 return err;
 314 }
 315
 316 static struct brcmf_usbreq *brcmf_usb_deq(struct brcmf_usbdev_info *devinfo,
 317                                           struct list_head *q, int *counter)
 318 {
 319         unsigned long flags;
 320         struct brcmf_usbreq  *req;
 321         spin_lock_irqsave(&devinfo->qlock, flags);
 322         if (list_empty(q)) {
 323                 spin_unlock_irqrestore(&devinfo->qlock, flags);
 324                 return NULL;
 325         }
 326         req = list_entry(q->next, struct brcmf_usbreq, list);
 327         list_del_init(q->next);
 328         if (counter)
 329                 (*counter)--;
 330         spin_unlock_irqrestore(&devinfo->qlock, flags);
 331         return req;
 332
 333 }
 334
 335 static void brcmf_usb_enq(struct brcmf_usbdev_info *devinfo,
 336                           struct list_head *q, struct brcmf_usbreq *req,
 337                           int *counter)
 338 {
 339         unsigned long flags;
 340         spin_lock_irqsave(&devinfo->qlock, flags);
 341         list_add_tail(&req->list, q);
 342         if (counter)
 343                 (*counter)++;
 344         spin_unlock_irqrestore(&devinfo->qlock, flags);
 345 }
 346
 347 static struct brcmf_usbreq *
 348 brcmf_usbdev_qinit(struct list_head *q, int qsize)
 349 {
 350         int i;
 351         struct brcmf_usbreq *req, *reqs;
 352
 353         reqs = kcalloc(qsize, sizeof(struct brcmf_usbreq), GFP_ATOMIC);
 354         if (reqs == NULL)
 355                 return NULL;
 356
 357         req = reqs;
 358
 359         for (i = 0; i < qsize; i++) {
 360                 req->urb = usb_alloc_urb(0, GFP_ATOMIC);
 361                 if (!req->urb)
 362                         goto fail;
 363
 364                 INIT_LIST_HEAD(&req->list);
 365                 list_add_tail(&req->list, q);
 366                 req++;
 367         }
 368         return reqs;
 369 fail:
 370         brcmf_err("fail!\n");
 371         while (!list_empty(q)) {
 372                 req = list_entry(q->next, struct brcmf_usbreq, list);
 373                 if (req && req->urb)
 374                         usb_free_urb(req->urb);
 375                 list_del(q->next);
 376         }
 377         return NULL;
 378
 379 }
 380
 381 static void brcmf_usb_free_q(struct list_head *q, bool pending)
 382 {
 383         struct brcmf_usbreq *req, *next;
 384         int i = 0;
 385         list_for_each_entry_safe(req, next, q, list) {
 386                 if (!req->urb) {
 387                         brcmf_err("bad req\n");
 388                         break;
 389                 }
 390                 i++;
 391                 if (pending) {
 392                         usb_kill_urb(req->urb);
 393                 } else {
 394                         usb_free_urb(req->urb);
 395                         list_del_init(&req->list);
 396                 }
 397         }
 398 }
 399
 400 static void brcmf_usb_del_fromq(struct brcmf_usbdev_info *devinfo,
 401                                 struct brcmf_usbreq *req)
 402 {
 403         unsigned long flags;
 404
 405         spin_lock_irqsave(&devinfo->qlock, flags);
 406         list_del_init(&req->list);
 407         spin_unlock_irqrestore(&devinfo->qlock, flags);
 408 }
 409
 410
 411 static void brcmf_usb_tx_complete(struct urb *urb)
 412 {
 413         struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
 414         struct brcmf_usbdev_info *devinfo = req->devinfo;
 415         unsigned long flags;
 416
 417         brcmf_dbg(USB, "Enter, urb->status=%d, skb=%p\n", urb->status,
 418                   req->skb);
 419         brcmf_usb_del_fromq(devinfo, req);
 420
 421         brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
 422         req->skb = NULL;
 423         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req, &devinfo->tx_freecount);
 424         spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);
 425         if (devinfo->tx_freecount > devinfo->tx_high_watermark &&
 426                 devinfo->tx_flowblock) {
 427                 brcmf_txflowblock(devinfo->dev, false);
 428                 devinfo->tx_flowblock = false;
 429         }
 430         spin_unlock_irqrestore(&devinfo->tx_flowblock_lock, flags);
 431 }
 432
 433 static void brcmf_usb_rx_complete(struct urb *urb)
 434 {
 435         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
 436         struct brcmf_usbdev_info *devinfo = req->devinfo;
 437         struct sk_buff *skb;
 438         struct sk_buff_head skbq;
 439
 440         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 441         brcmf_usb_del_fromq(devinfo, req);
 442         skb = req->skb;
 443         req->skb = NULL;
 444
 445         /* zero lenght packets indicate usb "failure". Do not refill */
 446         if (urb->status != 0 || !urb->actual_length) {
 447                 brcmu_pkt_buf_free_skb(skb);
 448                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 449                 return;
 450         }
 451
 452         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 453                 skb_queue_head_init(&skbq);
 454                 skb_queue_tail(&skbq, skb);
 455                 skb_put(skb, urb->actual_length);
 456                 brcmf_rx_frames(devinfo->dev, &skbq);
 457                 brcmf_usb_rx_refill(devinfo, req);
 458         } else {
 459                 brcmu_pkt_buf_free_skb(skb);
 460                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 461         }
 462         return;
 463
 464 }
 465
 466 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 467                                 struct brcmf_usbreq  *req)
 468 {
 469         struct sk_buff *skb;
 470         int ret;
 471
 472         if (!req || !devinfo)
 473                 return;
 474
 475         skb = dev_alloc_skb(devinfo->bus_pub.bus_mtu);
 476         if (!skb) {
 477                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 478                 return;
 479         }
 480         req->skb = skb;
 481
 482         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
 483                           skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
 484                           req);
 485         req->devinfo = devinfo;
 486         brcmf_usb_enq(devinfo, &devinfo->rx_postq, req, NULL);
 487
 488         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 489         if (ret) {
 490                 brcmf_usb_del_fromq(devinfo, req);
 491                 brcmu_pkt_buf_free_skb(req->skb);
 492                 req->skb = NULL;
 493                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 494         }
 495         return;
 496 }
 497
 498 static void brcmf_usb_rx_fill_all(struct brcmf_usbdev_info *devinfo)
 499 {
 500         struct brcmf_usbreq *req;
 501
 502         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
 503                 brcmf_err("bus is not up=%d\n", devinfo->bus_pub.state);
 504                 return;
 505         }
 506         while ((req = brcmf_usb_deq(devinfo, &devinfo->rx_freeq, NULL)) != NULL)
 507                 brcmf_usb_rx_refill(devinfo, req);
 508 }
 509
 510 static void
 511 brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
 512 {
 513         struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
 514         int old_state;
 515
 516         brcmf_dbg(USB, "Enter, current state=%d, new state=%d\n",
 517                   devinfo->bus_pub.state, state);
 518
 519         if (devinfo->bus_pub.state == state)
 520                 return;
 521
 522         old_state = devinfo->bus_pub.state;
 523         devinfo->bus_pub.state = state;
 524
 525         /* update state of upper layer */
 526         if (state == BRCMFMAC_USB_STATE_DOWN) {
 527                 brcmf_dbg(USB, "DBUS is down\n");
 528                 bcmf_bus->state = BRCMF_BUS_DOWN;
 529         } else if (state == BRCMFMAC_USB_STATE_UP) {
 530                 brcmf_dbg(USB, "DBUS is up\n");
 531                 bcmf_bus->state = BRCMF_BUS_DATA;
 532         } else {
 533                 brcmf_dbg(USB, "DBUS current state=%d\n", state);
 534         }
 535 }
 536
 537 static void
 538 brcmf_usb_intr_complete(struct urb *urb)
 539 {
 540         struct brcmf_usbdev_info *devinfo =
 541                         (struct brcmf_usbdev_info *)urb->context;
 542         int err;
 543
 544         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 545
 546         if (devinfo == NULL)
 547                 return;
 548
 549         if (unlikely(urb->status)) {
 550                 if (urb->status == -ENOENT ||
 551                     urb->status == -ESHUTDOWN ||
 552                     urb->status == -ENODEV) {
 553                         brcmf_usb_state_change(devinfo,
 554                                                BRCMFMAC_USB_STATE_DOWN);
 555                 }
 556         }
 557
 558         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN) {
 559                 brcmf_err("intr cb when DBUS down, ignoring\n");
 560                 return;
 561         }
 562
 563         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 564                 err = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 565                 if (err)
 566                         brcmf_err("usb_submit_urb, err=%d\n", err);
 567         }
 568 }
 569
 570 static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 571 {
 572         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 573         struct brcmf_usbreq  *req;
 574         int ret;
 575         unsigned long flags;
 576
 577         brcmf_dbg(USB, "Enter, skb=%p\n", skb);
 578         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
 579                 ret = -EIO;
 580                 goto fail;
 581         }
 582
 583         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq,
 584                                         &devinfo->tx_freecount);
 585         if (!req) {
 586                 brcmf_err("no req to send\n");
 587                 ret = -ENOMEM;
 588                 goto fail;
 589         }
 590
 591         req->skb = skb;
 592         req->devinfo = devinfo;
 593         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
 594                           skb->data, skb->len, brcmf_usb_tx_complete, req);
 595         req->urb->transfer_flags |= URB_ZERO_PACKET;
 596         brcmf_usb_enq(devinfo, &devinfo->tx_postq, req, NULL);
 597         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 598         if (ret) {
 599                 brcmf_err("brcmf_usb_tx usb_submit_urb FAILED\n");
 600                 brcmf_usb_del_fromq(devinfo, req);
 601                 req->skb = NULL;
 602                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req,
 603                               &devinfo->tx_freecount);
 604                 goto fail;
 605         }
 606
 607         spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);
 608         if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
 609             !devinfo->tx_flowblock) {
 610                 brcmf_txflowblock(dev, true);
 611                 devinfo->tx_flowblock = true;
 612         }
 613         spin_unlock_irqrestore(&devinfo->tx_flowblock_lock, flags);
 614         return 0;
 615
 616 fail:
 617         brcmf_txcomplete(dev, skb, false);
 618         return ret;
 619 }
 620
 621
 622 static int brcmf_usb_up(struct device *dev)
 623 {
 624         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 625         u16 ifnum;
 626         int ret;
 627
 628         brcmf_dbg(USB, "Enter\n");
 629         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP)
 630                 return 0;
 631
 632         /* Success, indicate devinfo is fully up */
 633         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_UP);
 634
 635         if (devinfo->intr_urb) {
 636                 usb_fill_int_urb(devinfo->intr_urb, devinfo->usbdev,
 637                         devinfo->intr_pipe,
 638                         &devinfo->intr,
 639                         devinfo->intr_size,
 640                         (usb_complete_t)brcmf_usb_intr_complete,
 641                         devinfo,
 642                         devinfo->interval);
 643
 644                 ret = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 645                 if (ret) {
 646                         brcmf_err("USB_SUBMIT_URB failed with status %d\n",
 647                                   ret);
 648                         return -EINVAL;
 649                 }
 650         }
 651
 652         if (devinfo->ctl_urb) {
 653                 devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
 654                 devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
 655
 656                 ifnum = IFDESC(devinfo->usbdev, CONTROL_IF).bInterfaceNumber;
 657
 658                 /* CTL Write */
 659                 devinfo->ctl_write.bRequestType =
 660                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 661                 devinfo->ctl_write.bRequest = 0;
 662                 devinfo->ctl_write.wValue = cpu_to_le16(0);
 663                 devinfo->ctl_write.wIndex = cpu_to_le16p(&ifnum);
 664
 665                 /* CTL Read */
 666                 devinfo->ctl_read.bRequestType =
 667                         USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 668                 devinfo->ctl_read.bRequest = 1;
 669                 devinfo->ctl_read.wValue = cpu_to_le16(0);
 670                 devinfo->ctl_read.wIndex = cpu_to_le16p(&ifnum);
 671         }
 672         brcmf_usb_rx_fill_all(devinfo);
 673         return 0;
 674 }
 675
 676 static void brcmf_usb_down(struct device *dev)
 677 {
 678         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 679
 680         brcmf_dbg(USB, "Enter\n");
 681         if (devinfo == NULL)
 682                 return;
 683
 684         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN)
 685                 return;
 686
 687         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_DOWN);
 688         if (devinfo->intr_urb)
 689                 usb_kill_urb(devinfo->intr_urb);
 690
 691         if (devinfo->ctl_urb)
 692                 usb_kill_urb(devinfo->ctl_urb);
 693
 694         if (devinfo->bulk_urb)
 695                 usb_kill_urb(devinfo->bulk_urb);
 696         brcmf_usb_free_q(&devinfo->tx_postq, true);
 697
 698         brcmf_usb_free_q(&devinfo->rx_postq, true);
 699 }
 700
 701 static void
 702 brcmf_usb_sync_complete(struct urb *urb)
 703 {
 704         struct brcmf_usbdev_info *devinfo =
 705                         (struct brcmf_usbdev_info *)urb->context;
 706
 707         devinfo->ctl_completed = true;
 708         brcmf_usb_ioctl_resp_wake(devinfo);
 709 }
 710
 711 static bool brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
 712                              void *buffer, int buflen)
 713 {
 714         int ret = 0;
 715         char *tmpbuf;
 716         u16 size;
 717
 718         if ((!devinfo) || (devinfo->ctl_urb == NULL))
 719                 return false;
 720
 721         tmpbuf = kmalloc(buflen, GFP_ATOMIC);
 722         if (!tmpbuf)
 723                 return false;
 724
 725         size = buflen;
 726         devinfo->ctl_urb->transfer_buffer_length = size;
 727
 728         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 729         devinfo->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
 730                 USB_RECIP_INTERFACE;
 731         devinfo->ctl_read.bRequest = cmd;
 732
 733         usb_fill_control_urb(devinfo->ctl_urb,
 734                 devinfo->usbdev,
 735                 usb_rcvctrlpipe(devinfo->usbdev, 0),
 736                 (unsigned char *) &devinfo->ctl_read,
 737                 (void *) tmpbuf, size,
 738                 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 739
 740         devinfo->ctl_completed = false;
 741         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 742         if (ret < 0) {
 743                 brcmf_err("usb_submit_urb failed %d\n", ret);
 744                 kfree(tmpbuf);
 745                 return false;
 746         }
 747
 748         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 749         memcpy(buffer, tmpbuf, buflen);
 750         kfree(tmpbuf);
 751
 752         return ret;
 753 }
 754
 755 static bool
 756 brcmf_usb_dlneeded(struct brcmf_usbdev_info *devinfo)
 757 {
 758         struct bootrom_id_le id;
 759         u32 chipid, chiprev;
 760
 761         brcmf_dbg(USB, "Enter\n");
 762
 763         if (devinfo == NULL)
 764                 return false;
 765
 766         /* Check if firmware downloaded already by querying runtime ID */
 767         id.chip = cpu_to_le32(0xDEAD);
 768         brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 769
 770         chipid = le32_to_cpu(id.chip);
 771         chiprev = le32_to_cpu(id.chiprev);
 772
 773         if ((chipid & 0x4300) == 0x4300)
 774                 brcmf_dbg(USB, "chip %x rev 0x%x\n", chipid, chiprev);
 775         else
 776                 brcmf_dbg(USB, "chip %d rev 0x%x\n", chipid, chiprev);
 777         if (chipid == BRCMF_POSTBOOT_ID) {
 778                 brcmf_dbg(USB, "firmware already downloaded\n");
 779                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 780                 return false;
 781         } else {
 782                 devinfo->bus_pub.devid = chipid;
 783                 devinfo->bus_pub.chiprev = chiprev;
 784         }
 785         return true;
 786 }
 787
 788 static int
 789 brcmf_usb_resetcfg(struct brcmf_usbdev_info *devinfo)
 790 {
 791         struct bootrom_id_le id;
 792         u32 loop_cnt;
 793
 794         brcmf_dbg(USB, "Enter\n");
 795
 796         loop_cnt = 0;
 797         do {
 798                 mdelay(BRCMF_USB_RESET_GETVER_SPINWAIT);
 799                 loop_cnt++;
 800                 id.chip = cpu_to_le32(0xDEAD);       /* Get the ID */
 801                 brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 802                 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID))
 803                         break;
 804         } while (loop_cnt < BRCMF_USB_RESET_GETVER_LOOP_CNT);
 805
 806         if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID)) {
 807                 brcmf_dbg(USB, "postboot chip 0x%x/rev 0x%x\n",
 808                           le32_to_cpu(id.chip), le32_to_cpu(id.chiprev));
 809
 810                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 811                 return 0;
 812         } else {
 813                 brcmf_err("Cannot talk to Dongle. Firmware is not UP, %d ms\n",
 814                           BRCMF_USB_RESET_GETVER_SPINWAIT * loop_cnt);
 815                 return -EINVAL;
 816         }
 817 }
 818
 819
 820 static int
 821 brcmf_usb_dl_send_bulk(struct brcmf_usbdev_info *devinfo, void *buffer, int len)
 822 {
 823         int ret;
 824
 825         if ((devinfo == NULL) || (devinfo->bulk_urb == NULL))
 826                 return -EINVAL;
 827
 828         /* Prepare the URB */
 829         usb_fill_bulk_urb(devinfo->bulk_urb, devinfo->usbdev,
 830                           devinfo->tx_pipe, buffer, len,
 831                           (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 832
 833         devinfo->bulk_urb->transfer_flags |= URB_ZERO_PACKET;
 834
 835         devinfo->ctl_completed = false;
 836         ret = usb_submit_urb(devinfo->bulk_urb, GFP_ATOMIC);
 837         if (ret) {
 838                 brcmf_err("usb_submit_urb failed %d\n", ret);
 839                 return ret;
 840         }
 841         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 842         return (ret == 0);
 843 }
 844
 845 static int
 846 brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
 847 {
 848         unsigned int sendlen, sent, dllen;
 849         char *bulkchunk = NULL, *dlpos;
 850         struct rdl_state_le state;
 851         u32 rdlstate, rdlbytes;
 852         int err = 0;
 853
 854         brcmf_dbg(USB, "Enter, fw %p, len %d\n", fw, fwlen);
 855
 856         bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
 857         if (bulkchunk == NULL) {
 858                 err = -ENOMEM;
 859                 goto fail;
 860         }
 861
 862         /* 1) Prepare USB boot loader for runtime image */
 863         brcmf_usb_dl_cmd(devinfo, DL_START, &state,
 864                          sizeof(struct rdl_state_le));
 865
 866         rdlstate = le32_to_cpu(state.state);
 867         rdlbytes = le32_to_cpu(state.bytes);
 868
 869         /* 2) Check we are in the Waiting state */
 870         if (rdlstate != DL_WAITING) {
 871                 brcmf_err("Failed to DL_START\n");
 872                 err = -EINVAL;
 873                 goto fail;
 874         }
 875         sent = 0;
 876         dlpos = fw;
 877         dllen = fwlen;
 878
 879         /* Get chip id and rev */
 880         while (rdlbytes != dllen) {
 881                 /* Wait until the usb device reports it received all
 882                  * the bytes we sent */
 883                 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
 884                         if ((dllen-sent) < RDL_CHUNK)
 885                                 sendlen = dllen-sent;
 886                         else
 887                                 sendlen = RDL_CHUNK;
 888
 889                         /* simply avoid having to send a ZLP by ensuring we
 890                          * never have an even
 891                          * multiple of 64
 892                          */
 893                         if (!(sendlen % 64))
 894                                 sendlen -= 4;
 895
 896                         /* send data */
 897                         memcpy(bulkchunk, dlpos, sendlen);
 898                         if (brcmf_usb_dl_send_bulk(devinfo, bulkchunk,
 899                                                    sendlen)) {
 900                                 brcmf_err("send_bulk failed\n");
 901                                 err = -EINVAL;
 902                                 goto fail;
 903                         }
 904
 905                         dlpos += sendlen;
 906                         sent += sendlen;
 907                 }
 908                 if (!brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 909                                       sizeof(struct rdl_state_le))) {
 910                         brcmf_err("DL_GETSTATE Failed xxxx\n");
 911                         err = -EINVAL;
 912                         goto fail;
 913                 }
 914
 915                 rdlstate = le32_to_cpu(state.state);
 916                 rdlbytes = le32_to_cpu(state.bytes);
 917
 918                 /* restart if an error is reported */
 919                 if (rdlstate == DL_BAD_HDR || rdlstate == DL_BAD_CRC) {
 920                         brcmf_err("Bad Hdr or Bad CRC state %d\n",
 921                                   rdlstate);
 922                         err = -EINVAL;
 923                         goto fail;
 924                 }
 925         }
 926
 927 fail:
 928         kfree(bulkchunk);
 929         brcmf_dbg(USB, "Exit, err=%d\n", err);
 930         return err;
 931 }
 932
 933 static int brcmf_usb_dlstart(struct brcmf_usbdev_info *devinfo, u8 *fw, int len)
 934 {
 935         int err;
 936
 937         brcmf_dbg(USB, "Enter\n");
 938
 939         if (devinfo == NULL)
 940                 return -EINVAL;
 941
 942         if (devinfo->bus_pub.devid == 0xDEAD)
 943                 return -EINVAL;
 944
 945         err = brcmf_usb_dl_writeimage(devinfo, fw, len);
 946         if (err == 0)
 947                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_DONE;
 948         else
 949                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_FAIL;
 950         brcmf_dbg(USB, "Exit, err=%d\n", err);
 951
 952         return err;
 953 }
 954
 955 static int brcmf_usb_dlrun(struct brcmf_usbdev_info *devinfo)
 956 {
 957         struct rdl_state_le state;
 958
 959         brcmf_dbg(USB, "Enter\n");
 960         if (!devinfo)
 961                 return -EINVAL;
 962
 963         if (devinfo->bus_pub.devid == 0xDEAD)
 964                 return -EINVAL;
 965
 966         /* Check we are runnable */
 967         brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 968                 sizeof(struct rdl_state_le));
 969
 970         /* Start the image */
 971         if (state.state == cpu_to_le32(DL_RUNNABLE)) {
 972                 if (!brcmf_usb_dl_cmd(devinfo, DL_GO, &state,
 973                         sizeof(struct rdl_state_le)))
 974                         return -ENODEV;
 975                 if (brcmf_usb_resetcfg(devinfo))
 976                         return -ENODEV;
 977                 /* The Dongle may go for re-enumeration. */
 978         } else {
 979                 brcmf_err("Dongle not runnable\n");
 980                 return -EINVAL;
 981         }
 982         brcmf_dbg(USB, "Exit\n");
 983         return 0;
 984 }
 985
 986 static bool brcmf_usb_chip_support(int chipid, int chiprev)
 987 {
 988         switch(chipid) {
 989         case 43143:
 990                 return true;
 991         case 43235:
 992         case 43236:
 993         case 43238:
 994                 return (chiprev == 3);
 995         case 43242:
 996                 return true;
 997         default:
 998                 break;
 999         }
1000         return false;
1001 }
1002
1003 static int
1004 brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
1005 {
1006         int devid, chiprev;
1007         int err;
1008
1009         brcmf_dbg(USB, "Enter\n");
1010         if (devinfo == NULL)
1011                 return -ENODEV;
1012
1013         devid = devinfo->bus_pub.devid;
1014         chiprev = devinfo->bus_pub.chiprev;
1015
1016         if (!brcmf_usb_chip_support(devid, chiprev)) {
1017                 brcmf_err("unsupported chip %d rev %d\n",
1018                           devid, chiprev);
1019                 return -EINVAL;
1020         }
1021
1022         if (!devinfo->image) {
1023                 brcmf_err("No firmware!\n");
1024                 return -ENOENT;
1025         }
1026
1027         err = brcmf_usb_dlstart(devinfo,
1028                 devinfo->image, devinfo->image_len);
1029         if (err == 0)
1030                 err = brcmf_usb_dlrun(devinfo);
1031         return err;
1032 }
1033
1034
1035 static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
1036 {
1037         brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
1038
1039         /* free the URBS */
1040         brcmf_usb_free_q(&devinfo->rx_freeq, false);
1041         brcmf_usb_free_q(&devinfo->tx_freeq, false);
1042
1043         usb_free_urb(devinfo->intr_urb);
1044         usb_free_urb(devinfo->ctl_urb);
1045         usb_free_urb(devinfo->bulk_urb);
1046
1047         kfree(devinfo->tx_reqs);
1048         kfree(devinfo->rx_reqs);
1049 }
1050
1051 #define TRX_MAGIC       0x30524448      /* "HDR0" */
1052 #define TRX_VERSION     1               /* Version 1 */
1053 #define TRX_MAX_LEN     0x3B0000        /* Max length */
1054 #define TRX_NO_HEADER   1               /* Do not write TRX header */
1055 #define TRX_MAX_OFFSET  3               /* Max number of individual files */
1056 #define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed image */
1057
1058 struct trx_header_le {
1059         __le32 magic;           /* "HDR0" */
1060         __le32 len;             /* Length of file including header */
1061         __le32 crc32;           /* CRC from flag_version to end of file */
1062         __le32 flag_version;    /* 0:15 flags, 16:31 version */
1063         __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
1064                                          * header */
1065 };
1066
1067 static int check_file(const u8 *headers)
1068 {
1069         struct trx_header_le *trx;
1070         int actual_len = -1;
1071
1072         brcmf_dbg(USB, "Enter\n");
1073         /* Extract trx header */
1074         trx = (struct trx_header_le *) headers;
1075         if (trx->magic != cpu_to_le32(TRX_MAGIC))
1076                 return -1;
1077
1078         headers += sizeof(struct trx_header_le);
1079
1080         if (le32_to_cpu(trx->flag_version) & TRX_UNCOMP_IMAGE) {
1081                 actual_len = le32_to_cpu(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]);
1082                 return actual_len + sizeof(struct trx_header_le);
1083         }
1084         return -1;
1085 }
1086
1087 static int brcmf_usb_get_fw(struct brcmf_usbdev_info *devinfo)
1088 {
1089         s8 *fwname;
1090         const struct firmware *fw;
1091         struct brcmf_usb_image *fw_image;
1092         int err;
1093
1094         brcmf_dbg(USB, "Enter\n");
1095         switch (devinfo->bus_pub.devid) {
1096         case 43143:
1097                 fwname = BRCMF_USB_43143_FW_NAME;
1098                 break;
1099         case 43235:
1100         case 43236:
1101         case 43238:
1102                 fwname = BRCMF_USB_43236_FW_NAME;
1103                 break;
1104         case 43242:
1105                 fwname = BRCMF_USB_43242_FW_NAME;
1106                 break;
1107         default:
1108                 return -EINVAL;
1109                 break;
1110         }
1111         brcmf_dbg(USB, "Loading FW %s\n", fwname);
1112         list_for_each_entry(fw_image, &fw_image_list, list) {
1113                 if (fw_image->fwname == fwname) {
1114                         devinfo->image = fw_image->image;
1115                         devinfo->image_len = fw_image->image_len;
1116                         return 0;
1117                 }
1118         }
1119         /* fw image not yet loaded. Load it now and add to list */
1120         err = request_firmware(&fw, fwname, devinfo->dev);
1121         if (!fw) {
1122                 brcmf_err("fail to request firmware %s\n", fwname);
1123                 return err;
1124         }
1125         if (check_file(fw->data) < 0) {
1126                 brcmf_err("invalid firmware %s\n", fwname);
1127                 return -EINVAL;
1128         }
1129
1130         fw_image = kzalloc(sizeof(*fw_image), GFP_ATOMIC);
1131         if (!fw_image)
1132                 return -ENOMEM;
1133         INIT_LIST_HEAD(&fw_image->list);
1134         list_add_tail(&fw_image->list, &fw_image_list);
1135         fw_image->fwname = fwname;
1136         fw_image->image = vmalloc(fw->size);
1137         if (!fw_image->image)
1138                 return -ENOMEM;
1139
1140         memcpy(fw_image->image, fw->data, fw->size);
1141         fw_image->image_len = fw->size;
1142
1143         release_firmware(fw);
1144
1145         devinfo->image = fw_image->image;
1146         devinfo->image_len = fw_image->image_len;
1147
1148         return 0;
1149 }
1150
1151
1152 static
1153 struct brcmf_usbdev *brcmf_usb_attach(struct brcmf_usbdev_info *devinfo,
1154                                       int nrxq, int ntxq)
1155 {
1156         brcmf_dbg(USB, "Enter\n");
1157
1158         devinfo->bus_pub.nrxq = nrxq;
1159         devinfo->rx_low_watermark = nrxq / 2;
1160         devinfo->bus_pub.devinfo = devinfo;
1161         devinfo->bus_pub.ntxq = ntxq;
1162         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DOWN;
1163
1164         /* flow control when too many tx urbs posted */
1165         devinfo->tx_low_watermark = ntxq / 4;
1166         devinfo->tx_high_watermark = devinfo->tx_low_watermark * 3;
1167         devinfo->bus_pub.bus_mtu = BRCMF_USB_MAX_PKT_SIZE;
1168
1169         /* Initialize other structure content */
1170         init_waitqueue_head(&devinfo->ioctl_resp_wait);
1171
1172         /* Initialize the spinlocks */
1173         spin_lock_init(&devinfo->qlock);
1174         spin_lock_init(&devinfo->tx_flowblock_lock);
1175
1176         INIT_LIST_HEAD(&devinfo->rx_freeq);
1177         INIT_LIST_HEAD(&devinfo->rx_postq);
1178
1179         INIT_LIST_HEAD(&devinfo->tx_freeq);
1180         INIT_LIST_HEAD(&devinfo->tx_postq);
1181
1182         devinfo->tx_flowblock = false;
1183
1184         devinfo->rx_reqs = brcmf_usbdev_qinit(&devinfo->rx_freeq, nrxq);
1185         if (!devinfo->rx_reqs)
1186                 goto error;
1187
1188         devinfo->tx_reqs = brcmf_usbdev_qinit(&devinfo->tx_freeq, ntxq);
1189         if (!devinfo->tx_reqs)
1190                 goto error;
1191         devinfo->tx_freecount = ntxq;
1192
1193         devinfo->intr_urb = usb_alloc_urb(0, GFP_ATOMIC);
1194         if (!devinfo->intr_urb) {
1195                 brcmf_err("usb_alloc_urb (intr) failed\n");
1196                 goto error;
1197         }
1198         devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
1199         if (!devinfo->ctl_urb) {
1200                 brcmf_err("usb_alloc_urb (ctl) failed\n");
1201                 goto error;
1202         }
1203         devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
1204         if (!devinfo->bulk_urb) {
1205                 brcmf_err("usb_alloc_urb (bulk) failed\n");
1206                 goto error;
1207         }
1208
1209         if (!brcmf_usb_dlneeded(devinfo))
1210                 return &devinfo->bus_pub;
1211
1212         brcmf_dbg(USB, "Start fw downloading\n");
1213         if (brcmf_usb_get_fw(devinfo))
1214                 goto error;
1215
1216         if (brcmf_usb_fw_download(devinfo))
1217                 goto error;
1218
1219         return &devinfo->bus_pub;
1220
1221 error:
1222         brcmf_err("failed!\n");
1223         brcmf_usb_detach(devinfo);
1224         return NULL;
1225 }
1226
1227 static struct brcmf_bus_ops brcmf_usb_bus_ops = {
1228         .txdata = brcmf_usb_tx,
1229         .init = brcmf_usb_up,
1230         .stop = brcmf_usb_down,
1231         .txctl = brcmf_usb_tx_ctlpkt,
1232         .rxctl = brcmf_usb_rx_ctlpkt,
1233 };
1234
1235 static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
1236 {
1237         struct brcmf_bus *bus = NULL;
1238         struct brcmf_usbdev *bus_pub = NULL;
1239         int ret;
1240         struct device *dev = devinfo->dev;
1241
1242         brcmf_dbg(USB, "Enter\n");
1243         bus_pub = brcmf_usb_attach(devinfo, BRCMF_USB_NRXQ, BRCMF_USB_NTXQ);
1244         if (!bus_pub)
1245                 return -ENODEV;
1246
1247         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
1248         if (!bus) {
1249                 ret = -ENOMEM;
1250                 goto fail;
1251         }
1252
1253         bus->dev = dev;
1254         bus_pub->bus = bus;
1255         bus->bus_priv.usb = bus_pub;
1256         dev_set_drvdata(dev, bus);
1257         bus->ops = &brcmf_usb_bus_ops;
1258         bus->chip = bus_pub->devid;
1259         bus->chiprev = bus_pub->chiprev;
1260
1261         /* Attach to the common driver interface */
1262         ret = brcmf_attach(0, dev);
1263         if (ret) {
1264                 brcmf_err("brcmf_attach failed\n");
1265                 goto fail;
1266         }
1267
1268         ret = brcmf_bus_start(dev);
1269         if (ret) {
1270                 brcmf_err("dongle is not responding\n");
1271                 brcmf_detach(dev);
1272                 goto fail;
1273         }
1274
1275         return 0;
1276 fail:
1277         /* Release resources in reverse order */
1278         kfree(bus);
1279         brcmf_usb_detach(devinfo);
1280         return ret;
1281 }
1282
1283 static void
1284 brcmf_usb_disconnect_cb(struct brcmf_usbdev_info *devinfo)
1285 {
1286         if (!devinfo)
1287                 return;
1288         brcmf_dbg(USB, "Enter, bus_pub %p\n", devinfo);
1289
1290         brcmf_detach(devinfo->dev);
1291         kfree(devinfo->bus_pub.bus);
1292         brcmf_usb_detach(devinfo);
1293 }
1294
1295 static int
1296 brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
1297 {
1298         int ep;
1299         struct usb_endpoint_descriptor *endpoint;
1300         int ret = 0;
1301         struct usb_device *usb = interface_to_usbdev(intf);
1302         int num_of_eps;
1303         u8 endpoint_num;
1304         struct brcmf_usbdev_info *devinfo;
1305
1306         brcmf_dbg(USB, "Enter\n");
1307
1308         devinfo = kzalloc(sizeof(*devinfo), GFP_ATOMIC);
1309         if (devinfo == NULL)
1310                 return -ENOMEM;
1311
1312         devinfo->usbdev = usb;
1313         devinfo->dev = &usb->dev;
1314
1315         usb_set_intfdata(intf, devinfo);
1316
1317         /* Check that the device supports only one configuration */
1318         if (usb->descriptor.bNumConfigurations != 1) {
1319                 ret = -1;
1320                 goto fail;
1321         }
1322
1323         if (usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
1324                 ret = -1;
1325                 goto fail;
1326         }
1327
1328         /*
1329          * Only the BDC interface configuration is supported:
1330          *      Device class: USB_CLASS_VENDOR_SPEC
1331          *      if0 class: USB_CLASS_VENDOR_SPEC
1332          *      if0/ep0: control
1333          *      if0/ep1: bulk in
1334          *      if0/ep2: bulk out (ok if swapped with bulk in)
1335          */
1336         if (CONFIGDESC(usb)->bNumInterfaces != 1) {
1337                 ret = -1;
1338                 goto fail;
1339         }
1340
1341         /* Check interface */
1342         if (IFDESC(usb, CONTROL_IF).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
1343             IFDESC(usb, CONTROL_IF).bInterfaceSubClass != 2 ||
1344             IFDESC(usb, CONTROL_IF).bInterfaceProtocol != 0xff) {
1345                 brcmf_err("invalid control interface: class %d, subclass %d, proto %d\n",
1346                           IFDESC(usb, CONTROL_IF).bInterfaceClass,
1347                           IFDESC(usb, CONTROL_IF).bInterfaceSubClass,
1348                           IFDESC(usb, CONTROL_IF).bInterfaceProtocol);
1349                 ret = -1;
1350                 goto fail;
1351         }
1352
1353         /* Check control endpoint */
1354         endpoint = &IFEPDESC(usb, CONTROL_IF, 0);
1355         if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
1356                 != USB_ENDPOINT_XFER_INT) {
1357                 brcmf_err("invalid control endpoint %d\n",
1358                           endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
1359                 ret = -1;
1360                 goto fail;
1361         }
1362
1363         endpoint_num = endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
1364         devinfo->intr_pipe = usb_rcvintpipe(usb, endpoint_num);
1365
1366         devinfo->rx_pipe = 0;
1367         devinfo->rx_pipe2 = 0;
1368         devinfo->tx_pipe = 0;
1369         num_of_eps = IFDESC(usb, BULK_IF).bNumEndpoints - 1;
1370
1371         /* Check data endpoints and get pipes */
1372         for (ep = 1; ep <= num_of_eps; ep++) {
1373                 endpoint = &IFEPDESC(usb, BULK_IF, ep);
1374                 if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
1375                     USB_ENDPOINT_XFER_BULK) {
1376                         brcmf_err("invalid data endpoint %d\n", ep);
1377                         ret = -1;
1378                         goto fail;
1379                 }
1380
1381                 endpoint_num = endpoint->bEndpointAddress &
1382                                USB_ENDPOINT_NUMBER_MASK;
1383                 if ((endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1384                         == USB_DIR_IN) {
1385                         if (!devinfo->rx_pipe) {
1386                                 devinfo->rx_pipe =
1387                                         usb_rcvbulkpipe(usb, endpoint_num);
1388                         } else {
1389                                 devinfo->rx_pipe2 =
1390                                         usb_rcvbulkpipe(usb, endpoint_num);
1391                         }
1392                 } else {
1393                         devinfo->tx_pipe = usb_sndbulkpipe(usb, endpoint_num);
1394                 }
1395         }
1396
1397         /* Allocate interrupt URB and data buffer */
1398         /* RNDIS says 8-byte intr, our old drivers used 4-byte */
1399         if (IFEPDESC(usb, CONTROL_IF, 0).wMaxPacketSize == cpu_to_le16(16))
1400                 devinfo->intr_size = 8;
1401         else
1402                 devinfo->intr_size = 4;
1403
1404         devinfo->interval = IFEPDESC(usb, CONTROL_IF, 0).bInterval;
1405
1406         if (usb->speed == USB_SPEED_HIGH)
1407                 brcmf_dbg(USB, "Broadcom high speed USB wireless device detected\n");
1408         else
1409                 brcmf_dbg(USB, "Broadcom full speed USB wireless device detected\n");
1410
1411         ret = brcmf_usb_probe_cb(devinfo);
1412         if (ret)
1413                 goto fail;
1414
1415         /* Success */
1416         return 0;
1417
1418 fail:
1419         brcmf_err("failed with errno %d\n", ret);
1420         kfree(devinfo);
1421         usb_set_intfdata(intf, NULL);
1422         return ret;
1423
1424 }
1425
1426 static void
1427 brcmf_usb_disconnect(struct usb_interface *intf)
1428 {
1429         struct brcmf_usbdev_info *devinfo;
1430
1431         brcmf_dbg(USB, "Enter\n");
1432         devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf);
1433         brcmf_usb_disconnect_cb(devinfo);
1434         kfree(devinfo);
1435         brcmf_dbg(USB, "Exit\n");
1436 }
1437
1438 /*
1439  * only need to signal the bus being down and update the state.
1440  */
1441 static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
1442 {
1443         struct usb_device *usb = interface_to_usbdev(intf);
1444         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1445
1446         brcmf_dbg(USB, "Enter\n");
1447         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_SLEEP;
1448         brcmf_detach(&usb->dev);
1449         return 0;
1450 }
1451
1452 /*
1453  * (re-) start the bus.
1454  */
1455 static int brcmf_usb_resume(struct usb_interface *intf)
1456 {
1457         struct usb_device *usb = interface_to_usbdev(intf);
1458         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1459
1460         brcmf_dbg(USB, "Enter\n");
1461         if (!brcmf_attach(0, devinfo->dev))
1462                 return brcmf_bus_start(&usb->dev);
1463
1464         return 0;
1465 }
1466
1467 static int brcmf_usb_reset_resume(struct usb_interface *intf)
1468 {
1469         struct usb_device *usb = interface_to_usbdev(intf);
1470         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1471
1472         brcmf_dbg(USB, "Enter\n");
1473
1474         if (!brcmf_usb_fw_download(devinfo))
1475                 return brcmf_usb_resume(intf);
1476
1477         return -EIO;
1478 }
1479
1480 #define BRCMF_USB_VENDOR_ID_BROADCOM    0x0a5c
1481 #define BRCMF_USB_DEVICE_ID_43143       0xbd1e
1482 #define BRCMF_USB_DEVICE_ID_43236       0xbd17
1483 #define BRCMF_USB_DEVICE_ID_43242       0xbd1f
1484 #define BRCMF_USB_DEVICE_ID_BCMFW       0x0bdc
1485
1486 static struct usb_device_id brcmf_usb_devid_table[] = {
1487         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43143) },
1488         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43236) },
1489         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43242) },
1490         /* special entry for device with firmware loaded and running */
1491         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
1492         { }
1493 };
1494
1495 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
1496 MODULE_FIRMWARE(BRCMF_USB_43143_FW_NAME);
1497 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
1498 MODULE_FIRMWARE(BRCMF_USB_43242_FW_NAME);
1499
1500 static struct usb_driver brcmf_usbdrvr = {
1501         .name = KBUILD_MODNAME,
1502         .probe = brcmf_usb_probe,
1503         .disconnect = brcmf_usb_disconnect,
1504         .id_table = brcmf_usb_devid_table,
1505         .suspend = brcmf_usb_suspend,
1506         .resume = brcmf_usb_resume,
1507         .reset_resume = brcmf_usb_reset_resume,
1508         .supports_autosuspend = 1,
1509         .disable_hub_initiated_lpm = 1,
1510 };
1511
1512 static void brcmf_release_fw(struct list_head *q)
1513 {
1514         struct brcmf_usb_image *fw_image, *next;
1515
1516         list_for_each_entry_safe(fw_image, next, q, list) {
1517                 vfree(fw_image->image);
1518                 list_del_init(&fw_image->list);
1519         }
1520 }
1521
1522 static int brcmf_usb_reset_device(struct device *dev, void *notused)
1523 {
1524         /* device past is the usb interface so we
1525          * need to use parent here.
1526          */
1527         brcmf_dev_reset(dev->parent);
1528         return 0;
1529 }
1530
1531 void brcmf_usb_exit(void)
1532 {
1533         struct device_driver *drv = &brcmf_usbdrvr.drvwrap.driver;
1534         int ret;
1535
1536         brcmf_dbg(USB, "Enter\n");
1537         ret = driver_for_each_device(drv, NULL, NULL,
1538                                      brcmf_usb_reset_device);
1539         usb_deregister(&brcmf_usbdrvr);
1540         brcmf_release_fw(&fw_image_list);
1541 }
1542
1543 void brcmf_usb_init(void)
1544 {
1545         brcmf_dbg(USB, "Enter\n");
1546         INIT_LIST_HEAD(&fw_image_list);
1547         usb_register(&brcmf_usbdrvr);
1548 }