drivers/net/wireless/brcm80211/brcmfmac/usb.c

   1 /*
   2  * Copyright (c) 2011 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/kernel.h>
  18 #include <linux/module.h>
  19 #include <linux/firmware.h>
  20 #include <linux/usb.h>
  21 #include <linux/vmalloc.h>
  22
  23 #include <brcmu_utils.h>
  24 #include <brcmu_wifi.h>
  25 #include <dhd_bus.h>
  26 #include <dhd_dbg.h>
  27
  28 #include "usb_rdl.h"
  29 #include "usb.h"
  30
  31 #define IOCTL_RESP_TIMEOUT  2000
  32
  33 #define BRCMF_USB_RESET_GETVER_SPINWAIT 100     /* in unit of ms */
  34 #define BRCMF_USB_RESET_GETVER_LOOP_CNT 10
  35
  36 #define BRCMF_POSTBOOT_ID               0xA123  /* ID to detect if dongle
  37                                                    has boot up */
  38 #define BRCMF_USB_NRXQ  50
  39 #define BRCMF_USB_NTXQ  50
  40
  41 #define CONFIGDESC(usb)         (&((usb)->actconfig)->desc)
  42 #define IFPTR(usb, idx)         ((usb)->actconfig->interface[(idx)])
  43 #define IFALTS(usb, idx)        (IFPTR((usb), (idx))->altsetting[0])
  44 #define IFDESC(usb, idx)        IFALTS((usb), (idx)).desc
  45 #define IFEPDESC(usb, idx, ep)  (IFALTS((usb), (idx)).endpoint[(ep)]).desc
  46
  47 #define CONTROL_IF              0
  48 #define BULK_IF                 0
  49
  50 #define BRCMF_USB_CBCTL_WRITE   0
  51 #define BRCMF_USB_CBCTL_READ    1
  52 #define BRCMF_USB_MAX_PKT_SIZE  1600
  53
  54 #define BRCMF_USB_43143_FW_NAME "brcm/brcmfmac43143.bin"
  55 #define BRCMF_USB_43236_FW_NAME "brcm/brcmfmac43236b.bin"
  56 #define BRCMF_USB_43242_FW_NAME "brcm/brcmfmac43242a.bin"
  57
  58 struct brcmf_usb_image {
  59         struct list_head list;
  60         s8 *fwname;
  61         u8 *image;
  62         int image_len;
  63 };
  64 static struct list_head fw_image_list;
  65
  66 struct intr_transfer_buf {
  67         u32 notification;
  68         u32 reserved;
  69 };
  70
  71 struct brcmf_usbdev_info {
  72         struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
  73         spinlock_t qlock;
  74         struct list_head rx_freeq;
  75         struct list_head rx_postq;
  76         struct list_head tx_freeq;
  77         struct list_head tx_postq;
  78         uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
  79
  80         int rx_low_watermark;
  81         int tx_low_watermark;
  82         int tx_high_watermark;
  83         int tx_freecount;
  84         bool tx_flowblock;
  85         spinlock_t tx_flowblock_lock;
  86
  87         struct brcmf_usbreq *tx_reqs;
  88         struct brcmf_usbreq *rx_reqs;
  89
  90         u8 *image;      /* buffer for combine fw and nvram */
  91         int image_len;
  92
  93         struct usb_device *usbdev;
  94         struct device *dev;
  95
  96         int ctl_in_pipe, ctl_out_pipe;
  97         struct urb *ctl_urb; /* URB for control endpoint */
  98         struct usb_ctrlrequest ctl_write;
  99         struct usb_ctrlrequest ctl_read;
 100         u32 ctl_urb_actual_length;
 101         int ctl_urb_status;
 102         int ctl_completed;
 103         wait_queue_head_t ioctl_resp_wait;
 104         ulong ctl_op;
 105
 106         struct urb *bulk_urb; /* used for FW download */
 107         struct urb *intr_urb; /* URB for interrupt endpoint */
 108         int intr_size;          /* Size of interrupt message */
 109         int interval;           /* Interrupt polling interval */
 110         struct intr_transfer_buf intr; /* Data buffer for interrupt endpoint */
 111 };
 112
 113 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 114                                 struct brcmf_usbreq  *req);
 115
 116 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
 117 {
 118         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
 119         return bus_if->bus_priv.usb;
 120 }
 121
 122 static struct brcmf_usbdev_info *brcmf_usb_get_businfo(struct device *dev)
 123 {
 124         return brcmf_usb_get_buspub(dev)->devinfo;
 125 }
 126
 127 static int brcmf_usb_ioctl_resp_wait(struct brcmf_usbdev_info *devinfo)
 128 {
 129         return wait_event_timeout(devinfo->ioctl_resp_wait,
 130                                   devinfo->ctl_completed,
 131                                   msecs_to_jiffies(IOCTL_RESP_TIMEOUT));
 132 }
 133
 134 static void brcmf_usb_ioctl_resp_wake(struct brcmf_usbdev_info *devinfo)
 135 {
 136         if (waitqueue_active(&devinfo->ioctl_resp_wait))
 137                 wake_up(&devinfo->ioctl_resp_wait);
 138 }
 139
 140 static void
 141 brcmf_usb_ctl_complete(struct brcmf_usbdev_info *devinfo, int type, int status)
 142 {
 143         brcmf_dbg(USB, "Enter, status=%d\n", status);
 144
 145         if (unlikely(devinfo == NULL))
 146                 return;
 147
 148         if (type == BRCMF_USB_CBCTL_READ) {
 149                 if (status == 0)
 150                         devinfo->bus_pub.stats.rx_ctlpkts++;
 151                 else
 152                         devinfo->bus_pub.stats.rx_ctlerrs++;
 153         } else if (type == BRCMF_USB_CBCTL_WRITE) {
 154                 if (status == 0)
 155                         devinfo->bus_pub.stats.tx_ctlpkts++;
 156                 else
 157                         devinfo->bus_pub.stats.tx_ctlerrs++;
 158         }
 159
 160         devinfo->ctl_urb_status = status;
 161         devinfo->ctl_completed = true;
 162         brcmf_usb_ioctl_resp_wake(devinfo);
 163 }
 164
 165 static void
 166 brcmf_usb_ctlread_complete(struct urb *urb)
 167 {
 168         struct brcmf_usbdev_info *devinfo =
 169                 (struct brcmf_usbdev_info *)urb->context;
 170
 171         brcmf_dbg(USB, "Enter\n");
 172         devinfo->ctl_urb_actual_length = urb->actual_length;
 173         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_READ,
 174                 urb->status);
 175 }
 176
 177 static void
 178 brcmf_usb_ctlwrite_complete(struct urb *urb)
 179 {
 180         struct brcmf_usbdev_info *devinfo =
 181                 (struct brcmf_usbdev_info *)urb->context;
 182
 183         brcmf_dbg(USB, "Enter\n");
 184         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_WRITE,
 185                 urb->status);
 186 }
 187
 188 static int
 189 brcmf_usb_send_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 190 {
 191         int ret;
 192         u16 size;
 193
 194         brcmf_dbg(USB, "Enter\n");
 195         if (devinfo == NULL || buf == NULL ||
 196             len == 0 || devinfo->ctl_urb == NULL)
 197                 return -EINVAL;
 198
 199         size = len;
 200         devinfo->ctl_write.wLength = cpu_to_le16p(&size);
 201         devinfo->ctl_urb->transfer_buffer_length = size;
 202         devinfo->ctl_urb_status = 0;
 203         devinfo->ctl_urb_actual_length = 0;
 204
 205         usb_fill_control_urb(devinfo->ctl_urb,
 206                 devinfo->usbdev,
 207                 devinfo->ctl_out_pipe,
 208                 (unsigned char *) &devinfo->ctl_write,
 209                 buf, size,
 210                 (usb_complete_t)brcmf_usb_ctlwrite_complete,
 211                 devinfo);
 212
 213         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 214         if (ret < 0)
 215                 brcmf_err("usb_submit_urb failed %d\n", ret);
 216
 217         return ret;
 218 }
 219
 220 static int
 221 brcmf_usb_recv_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 222 {
 223         int ret;
 224         u16 size;
 225
 226         brcmf_dbg(USB, "Enter\n");
 227         if ((devinfo == NULL) || (buf == NULL) || (len == 0)
 228                 || (devinfo->ctl_urb == NULL))
 229                 return -EINVAL;
 230
 231         size = len;
 232         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 233         devinfo->ctl_urb->transfer_buffer_length = size;
 234
 235         devinfo->ctl_read.bRequestType = USB_DIR_IN
 236                 | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 237         devinfo->ctl_read.bRequest = 1;
 238
 239         usb_fill_control_urb(devinfo->ctl_urb,
 240                 devinfo->usbdev,
 241                 devinfo->ctl_in_pipe,
 242                 (unsigned char *) &devinfo->ctl_read,
 243                 buf, size,
 244                 (usb_complete_t)brcmf_usb_ctlread_complete,
 245                 devinfo);
 246
 247         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 248         if (ret < 0)
 249                 brcmf_err("usb_submit_urb failed %d\n", ret);
 250
 251         return ret;
 252 }
 253
 254 static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 255 {
 256         int err = 0;
 257         int timeout = 0;
 258         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 259
 260         brcmf_dbg(USB, "Enter\n");
 261         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 262                 return -EIO;
 263
 264         if (test_and_set_bit(0, &devinfo->ctl_op))
 265                 return -EIO;
 266
 267         devinfo->ctl_completed = false;
 268         err = brcmf_usb_send_ctl(devinfo, buf, len);
 269         if (err) {
 270                 brcmf_err("fail %d bytes: %d\n", err, len);
 271                 clear_bit(0, &devinfo->ctl_op);
 272                 return err;
 273         }
 274         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 275         clear_bit(0, &devinfo->ctl_op);
 276         if (!timeout) {
 277                 brcmf_err("Txctl wait timed out\n");
 278                 err = -EIO;
 279         }
 280         return err;
 281 }
 282
 283 static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 284 {
 285         int err = 0;
 286         int timeout = 0;
 287         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 288
 289         brcmf_dbg(USB, "Enter\n");
 290         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 291                 return -EIO;
 292
 293         if (test_and_set_bit(0, &devinfo->ctl_op))
 294                 return -EIO;
 295
 296         devinfo->ctl_completed = false;
 297         err = brcmf_usb_recv_ctl(devinfo, buf, len);
 298         if (err) {
 299                 brcmf_err("fail %d bytes: %d\n", err, len);
 300                 clear_bit(0, &devinfo->ctl_op);
 301                 return err;
 302         }
 303         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 304         err = devinfo->ctl_urb_status;
 305         clear_bit(0, &devinfo->ctl_op);
 306         if (!timeout) {
 307                 brcmf_err("rxctl wait timed out\n");
 308                 err = -EIO;
 309         }
 310         if (!err)
 311                 return devinfo->ctl_urb_actual_length;
 312         else
 313                 return err;
 314 }
 315
 316 static struct brcmf_usbreq *brcmf_usb_deq(struct brcmf_usbdev_info *devinfo,
 317                                           struct list_head *q, int *counter)
 318 {
 319         unsigned long flags;
 320         struct brcmf_usbreq  *req;
 321         spin_lock_irqsave(&devinfo->qlock, flags);
 322         if (list_empty(q)) {
 323                 spin_unlock_irqrestore(&devinfo->qlock, flags);
 324                 return NULL;
 325         }
 326         req = list_entry(q->next, struct brcmf_usbreq, list);
 327         list_del_init(q->next);
 328         if (counter)
 329                 (*counter)--;
 330         spin_unlock_irqrestore(&devinfo->qlock, flags);
 331         return req;
 332
 333 }
 334
 335 static void brcmf_usb_enq(struct brcmf_usbdev_info *devinfo,
 336                           struct list_head *q, struct brcmf_usbreq *req,
 337                           int *counter)
 338 {
 339         unsigned long flags;
 340         spin_lock_irqsave(&devinfo->qlock, flags);
 341         list_add_tail(&req->list, q);
 342         if (counter)
 343                 (*counter)++;
 344         spin_unlock_irqrestore(&devinfo->qlock, flags);
 345 }
 346
 347 static struct brcmf_usbreq *
 348 brcmf_usbdev_qinit(struct list_head *q, int qsize)
 349 {
 350         int i;
 351         struct brcmf_usbreq *req, *reqs;
 352
 353         reqs = kcalloc(qsize, sizeof(struct brcmf_usbreq), GFP_ATOMIC);
 354         if (reqs == NULL)
 355                 return NULL;
 356
 357         req = reqs;
 358
 359         for (i = 0; i < qsize; i++) {
 360                 req->urb = usb_alloc_urb(0, GFP_ATOMIC);
 361                 if (!req->urb)
 362                         goto fail;
 363
 364                 INIT_LIST_HEAD(&req->list);
 365                 list_add_tail(&req->list, q);
 366                 req++;
 367         }
 368         return reqs;
 369 fail:
 370         brcmf_err("fail!\n");
 371         while (!list_empty(q)) {
 372                 req = list_entry(q->next, struct brcmf_usbreq, list);
 373                 if (req && req->urb)
 374                         usb_free_urb(req->urb);
 375                 list_del(q->next);
 376         }
 377         return NULL;
 378
 379 }
 380
 381 static void brcmf_usb_free_q(struct list_head *q, bool pending)
 382 {
 383         struct brcmf_usbreq *req, *next;
 384         int i = 0;
 385         list_for_each_entry_safe(req, next, q, list) {
 386                 if (!req->urb) {
 387                         brcmf_err("bad req\n");
 388                         break;
 389                 }
 390                 i++;
 391                 if (pending) {
 392                         usb_kill_urb(req->urb);
 393                 } else {
 394                         usb_free_urb(req->urb);
 395                         list_del_init(&req->list);
 396                 }
 397         }
 398 }
 399
 400 static void brcmf_usb_del_fromq(struct brcmf_usbdev_info *devinfo,
 401                                 struct brcmf_usbreq *req)
 402 {
 403         unsigned long flags;
 404
 405         spin_lock_irqsave(&devinfo->qlock, flags);
 406         list_del_init(&req->list);
 407         spin_unlock_irqrestore(&devinfo->qlock, flags);
 408 }
 409
 410
 411 static void brcmf_usb_tx_complete(struct urb *urb)
 412 {
 413         struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
 414         struct brcmf_usbdev_info *devinfo = req->devinfo;
 415         unsigned long flags;
 416
 417         brcmf_dbg(USB, "Enter, urb->status=%d, skb=%p\n", urb->status,
 418                   req->skb);
 419         brcmf_usb_del_fromq(devinfo, req);
 420
 421         brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
 422         req->skb = NULL;
 423         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req, &devinfo->tx_freecount);
 424         spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);
 425         if (devinfo->tx_freecount > devinfo->tx_high_watermark &&
 426                 devinfo->tx_flowblock) {
 427                 brcmf_txflowblock(devinfo->dev, false);
 428                 devinfo->tx_flowblock = false;
 429         }
 430         spin_unlock_irqrestore(&devinfo->tx_flowblock_lock, flags);
 431 }
 432
 433 static void brcmf_usb_rx_complete(struct urb *urb)
 434 {
 435         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
 436         struct brcmf_usbdev_info *devinfo = req->devinfo;
 437         struct sk_buff *skb;
 438
 439         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 440         brcmf_usb_del_fromq(devinfo, req);
 441         skb = req->skb;
 442         req->skb = NULL;
 443
 444         /* zero lenght packets indicate usb "failure". Do not refill */
 445         if (urb->status != 0 || !urb->actual_length) {
 446                 brcmu_pkt_buf_free_skb(skb);
 447                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 448                 return;
 449         }
 450
 451         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 452                 skb_put(skb, urb->actual_length);
 453                 brcmf_rx_frame(devinfo->dev, skb);
 454                 brcmf_usb_rx_refill(devinfo, req);
 455         } else {
 456                 brcmu_pkt_buf_free_skb(skb);
 457                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 458         }
 459         return;
 460
 461 }
 462
 463 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 464                                 struct brcmf_usbreq  *req)
 465 {
 466         struct sk_buff *skb;
 467         int ret;
 468
 469         if (!req || !devinfo)
 470                 return;
 471
 472         skb = dev_alloc_skb(devinfo->bus_pub.bus_mtu);
 473         if (!skb) {
 474                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 475                 return;
 476         }
 477         req->skb = skb;
 478
 479         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
 480                           skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
 481                           req);
 482         req->devinfo = devinfo;
 483         brcmf_usb_enq(devinfo, &devinfo->rx_postq, req, NULL);
 484
 485         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 486         if (ret) {
 487                 brcmf_usb_del_fromq(devinfo, req);
 488                 brcmu_pkt_buf_free_skb(req->skb);
 489                 req->skb = NULL;
 490                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 491         }
 492         return;
 493 }
 494
 495 static void brcmf_usb_rx_fill_all(struct brcmf_usbdev_info *devinfo)
 496 {
 497         struct brcmf_usbreq *req;
 498
 499         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
 500                 brcmf_err("bus is not up=%d\n", devinfo->bus_pub.state);
 501                 return;
 502         }
 503         while ((req = brcmf_usb_deq(devinfo, &devinfo->rx_freeq, NULL)) != NULL)
 504                 brcmf_usb_rx_refill(devinfo, req);
 505 }
 506
 507 static void
 508 brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
 509 {
 510         struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
 511         int old_state;
 512
 513         brcmf_dbg(USB, "Enter, current state=%d, new state=%d\n",
 514                   devinfo->bus_pub.state, state);
 515
 516         if (devinfo->bus_pub.state == state)
 517                 return;
 518
 519         old_state = devinfo->bus_pub.state;
 520         devinfo->bus_pub.state = state;
 521
 522         /* update state of upper layer */
 523         if (state == BRCMFMAC_USB_STATE_DOWN) {
 524                 brcmf_dbg(USB, "DBUS is down\n");
 525                 bcmf_bus->state = BRCMF_BUS_DOWN;
 526         } else if (state == BRCMFMAC_USB_STATE_UP) {
 527                 brcmf_dbg(USB, "DBUS is up\n");
 528                 bcmf_bus->state = BRCMF_BUS_DATA;
 529         } else {
 530                 brcmf_dbg(USB, "DBUS current state=%d\n", state);
 531         }
 532 }
 533
 534 static void
 535 brcmf_usb_intr_complete(struct urb *urb)
 536 {
 537         struct brcmf_usbdev_info *devinfo =
 538                         (struct brcmf_usbdev_info *)urb->context;
 539         int err;
 540
 541         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 542
 543         if (devinfo == NULL)
 544                 return;
 545
 546         if (unlikely(urb->status)) {
 547                 if (urb->status == -ENOENT ||
 548                     urb->status == -ESHUTDOWN ||
 549                     urb->status == -ENODEV) {
 550                         brcmf_usb_state_change(devinfo,
 551                                                BRCMFMAC_USB_STATE_DOWN);
 552                 }
 553         }
 554
 555         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN) {
 556                 brcmf_err("intr cb when DBUS down, ignoring\n");
 557                 return;
 558         }
 559
 560         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 561                 err = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 562                 if (err)
 563                         brcmf_err("usb_submit_urb, err=%d\n", err);
 564         }
 565 }
 566
 567 static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 568 {
 569         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 570         struct brcmf_usbreq  *req;
 571         int ret;
 572         unsigned long flags;
 573
 574         brcmf_dbg(USB, "Enter, skb=%p\n", skb);
 575         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
 576                 ret = -EIO;
 577                 goto fail;
 578         }
 579
 580         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq,
 581                                         &devinfo->tx_freecount);
 582         if (!req) {
 583                 brcmf_err("no req to send\n");
 584                 ret = -ENOMEM;
 585                 goto fail;
 586         }
 587
 588         req->skb = skb;
 589         req->devinfo = devinfo;
 590         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
 591                           skb->data, skb->len, brcmf_usb_tx_complete, req);
 592         req->urb->transfer_flags |= URB_ZERO_PACKET;
 593         brcmf_usb_enq(devinfo, &devinfo->tx_postq, req, NULL);
 594         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 595         if (ret) {
 596                 brcmf_err("brcmf_usb_tx usb_submit_urb FAILED\n");
 597                 brcmf_usb_del_fromq(devinfo, req);
 598                 req->skb = NULL;
 599                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req,
 600                               &devinfo->tx_freecount);
 601                 goto fail;
 602         }
 603
 604         spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);
 605         if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
 606             !devinfo->tx_flowblock) {
 607                 brcmf_txflowblock(dev, true);
 608                 devinfo->tx_flowblock = true;
 609         }
 610         spin_unlock_irqrestore(&devinfo->tx_flowblock_lock, flags);
 611         return 0;
 612
 613 fail:
 614         return ret;
 615 }
 616
 617
 618 static int brcmf_usb_up(struct device *dev)
 619 {
 620         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 621         u16 ifnum;
 622         int ret;
 623
 624         brcmf_dbg(USB, "Enter\n");
 625         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP)
 626                 return 0;
 627
 628         /* Success, indicate devinfo is fully up */
 629         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_UP);
 630
 631         if (devinfo->intr_urb) {
 632                 usb_fill_int_urb(devinfo->intr_urb, devinfo->usbdev,
 633                         devinfo->intr_pipe,
 634                         &devinfo->intr,
 635                         devinfo->intr_size,
 636                         (usb_complete_t)brcmf_usb_intr_complete,
 637                         devinfo,
 638                         devinfo->interval);
 639
 640                 ret = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 641                 if (ret) {
 642                         brcmf_err("USB_SUBMIT_URB failed with status %d\n",
 643                                   ret);
 644                         return -EINVAL;
 645                 }
 646         }
 647
 648         if (devinfo->ctl_urb) {
 649                 devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
 650                 devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
 651
 652                 ifnum = IFDESC(devinfo->usbdev, CONTROL_IF).bInterfaceNumber;
 653
 654                 /* CTL Write */
 655                 devinfo->ctl_write.bRequestType =
 656                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 657                 devinfo->ctl_write.bRequest = 0;
 658                 devinfo->ctl_write.wValue = cpu_to_le16(0);
 659                 devinfo->ctl_write.wIndex = cpu_to_le16p(&ifnum);
 660
 661                 /* CTL Read */
 662                 devinfo->ctl_read.bRequestType =
 663                         USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 664                 devinfo->ctl_read.bRequest = 1;
 665                 devinfo->ctl_read.wValue = cpu_to_le16(0);
 666                 devinfo->ctl_read.wIndex = cpu_to_le16p(&ifnum);
 667         }
 668         brcmf_usb_rx_fill_all(devinfo);
 669         return 0;
 670 }
 671
 672 static void brcmf_usb_down(struct device *dev)
 673 {
 674         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 675
 676         brcmf_dbg(USB, "Enter\n");
 677         if (devinfo == NULL)
 678                 return;
 679
 680         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN)
 681                 return;
 682
 683         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_DOWN);
 684         if (devinfo->intr_urb)
 685                 usb_kill_urb(devinfo->intr_urb);
 686
 687         if (devinfo->ctl_urb)
 688                 usb_kill_urb(devinfo->ctl_urb);
 689
 690         if (devinfo->bulk_urb)
 691                 usb_kill_urb(devinfo->bulk_urb);
 692         brcmf_usb_free_q(&devinfo->tx_postq, true);
 693
 694         brcmf_usb_free_q(&devinfo->rx_postq, true);
 695 }
 696
 697 static void
 698 brcmf_usb_sync_complete(struct urb *urb)
 699 {
 700         struct brcmf_usbdev_info *devinfo =
 701                         (struct brcmf_usbdev_info *)urb->context;
 702
 703         devinfo->ctl_completed = true;
 704         brcmf_usb_ioctl_resp_wake(devinfo);
 705 }
 706
 707 static bool brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
 708                              void *buffer, int buflen)
 709 {
 710         int ret = 0;
 711         char *tmpbuf;
 712         u16 size;
 713
 714         if ((!devinfo) || (devinfo->ctl_urb == NULL))
 715                 return false;
 716
 717         tmpbuf = kmalloc(buflen, GFP_ATOMIC);
 718         if (!tmpbuf)
 719                 return false;
 720
 721         size = buflen;
 722         devinfo->ctl_urb->transfer_buffer_length = size;
 723
 724         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 725         devinfo->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
 726                 USB_RECIP_INTERFACE;
 727         devinfo->ctl_read.bRequest = cmd;
 728
 729         usb_fill_control_urb(devinfo->ctl_urb,
 730                 devinfo->usbdev,
 731                 usb_rcvctrlpipe(devinfo->usbdev, 0),
 732                 (unsigned char *) &devinfo->ctl_read,
 733                 (void *) tmpbuf, size,
 734                 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 735
 736         devinfo->ctl_completed = false;
 737         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 738         if (ret < 0) {
 739                 brcmf_err("usb_submit_urb failed %d\n", ret);
 740                 kfree(tmpbuf);
 741                 return false;
 742         }
 743
 744         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 745         memcpy(buffer, tmpbuf, buflen);
 746         kfree(tmpbuf);
 747
 748         return ret;
 749 }
 750
 751 static bool
 752 brcmf_usb_dlneeded(struct brcmf_usbdev_info *devinfo)
 753 {
 754         struct bootrom_id_le id;
 755         u32 chipid, chiprev;
 756
 757         brcmf_dbg(USB, "Enter\n");
 758
 759         if (devinfo == NULL)
 760                 return false;
 761
 762         /* Check if firmware downloaded already by querying runtime ID */
 763         id.chip = cpu_to_le32(0xDEAD);
 764         brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 765
 766         chipid = le32_to_cpu(id.chip);
 767         chiprev = le32_to_cpu(id.chiprev);
 768
 769         if ((chipid & 0x4300) == 0x4300)
 770                 brcmf_dbg(USB, "chip %x rev 0x%x\n", chipid, chiprev);
 771         else
 772                 brcmf_dbg(USB, "chip %d rev 0x%x\n", chipid, chiprev);
 773         if (chipid == BRCMF_POSTBOOT_ID) {
 774                 brcmf_dbg(USB, "firmware already downloaded\n");
 775                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 776                 return false;
 777         } else {
 778                 devinfo->bus_pub.devid = chipid;
 779                 devinfo->bus_pub.chiprev = chiprev;
 780         }
 781         return true;
 782 }
 783
 784 static int
 785 brcmf_usb_resetcfg(struct brcmf_usbdev_info *devinfo)
 786 {
 787         struct bootrom_id_le id;
 788         u32 loop_cnt;
 789
 790         brcmf_dbg(USB, "Enter\n");
 791
 792         loop_cnt = 0;
 793         do {
 794                 mdelay(BRCMF_USB_RESET_GETVER_SPINWAIT);
 795                 loop_cnt++;
 796                 id.chip = cpu_to_le32(0xDEAD);       /* Get the ID */
 797                 brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 798                 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID))
 799                         break;
 800         } while (loop_cnt < BRCMF_USB_RESET_GETVER_LOOP_CNT);
 801
 802         if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID)) {
 803                 brcmf_dbg(USB, "postboot chip 0x%x/rev 0x%x\n",
 804                           le32_to_cpu(id.chip), le32_to_cpu(id.chiprev));
 805
 806                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 807                 return 0;
 808         } else {
 809                 brcmf_err("Cannot talk to Dongle. Firmware is not UP, %d ms\n",
 810                           BRCMF_USB_RESET_GETVER_SPINWAIT * loop_cnt);
 811                 return -EINVAL;
 812         }
 813 }
 814
 815
 816 static int
 817 brcmf_usb_dl_send_bulk(struct brcmf_usbdev_info *devinfo, void *buffer, int len)
 818 {
 819         int ret;
 820
 821         if ((devinfo == NULL) || (devinfo->bulk_urb == NULL))
 822                 return -EINVAL;
 823
 824         /* Prepare the URB */
 825         usb_fill_bulk_urb(devinfo->bulk_urb, devinfo->usbdev,
 826                           devinfo->tx_pipe, buffer, len,
 827                           (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 828
 829         devinfo->bulk_urb->transfer_flags |= URB_ZERO_PACKET;
 830
 831         devinfo->ctl_completed = false;
 832         ret = usb_submit_urb(devinfo->bulk_urb, GFP_ATOMIC);
 833         if (ret) {
 834                 brcmf_err("usb_submit_urb failed %d\n", ret);
 835                 return ret;
 836         }
 837         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 838         return (ret == 0);
 839 }
 840
 841 static int
 842 brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
 843 {
 844         unsigned int sendlen, sent, dllen;
 845         char *bulkchunk = NULL, *dlpos;
 846         struct rdl_state_le state;
 847         u32 rdlstate, rdlbytes;
 848         int err = 0;
 849
 850         brcmf_dbg(USB, "Enter, fw %p, len %d\n", fw, fwlen);
 851
 852         bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
 853         if (bulkchunk == NULL) {
 854                 err = -ENOMEM;
 855                 goto fail;
 856         }
 857
 858         /* 1) Prepare USB boot loader for runtime image */
 859         brcmf_usb_dl_cmd(devinfo, DL_START, &state,
 860                          sizeof(struct rdl_state_le));
 861
 862         rdlstate = le32_to_cpu(state.state);
 863         rdlbytes = le32_to_cpu(state.bytes);
 864
 865         /* 2) Check we are in the Waiting state */
 866         if (rdlstate != DL_WAITING) {
 867                 brcmf_err("Failed to DL_START\n");
 868                 err = -EINVAL;
 869                 goto fail;
 870         }
 871         sent = 0;
 872         dlpos = fw;
 873         dllen = fwlen;
 874
 875         /* Get chip id and rev */
 876         while (rdlbytes != dllen) {
 877                 /* Wait until the usb device reports it received all
 878                  * the bytes we sent */
 879                 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
 880                         if ((dllen-sent) < RDL_CHUNK)
 881                                 sendlen = dllen-sent;
 882                         else
 883                                 sendlen = RDL_CHUNK;
 884
 885                         /* simply avoid having to send a ZLP by ensuring we
 886                          * never have an even
 887                          * multiple of 64
 888                          */
 889                         if (!(sendlen % 64))
 890                                 sendlen -= 4;
 891
 892                         /* send data */
 893                         memcpy(bulkchunk, dlpos, sendlen);
 894                         if (brcmf_usb_dl_send_bulk(devinfo, bulkchunk,
 895                                                    sendlen)) {
 896                                 brcmf_err("send_bulk failed\n");
 897                                 err = -EINVAL;
 898                                 goto fail;
 899                         }
 900
 901                         dlpos += sendlen;
 902                         sent += sendlen;
 903                 }
 904                 if (!brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 905                                       sizeof(struct rdl_state_le))) {
 906                         brcmf_err("DL_GETSTATE Failed xxxx\n");
 907                         err = -EINVAL;
 908                         goto fail;
 909                 }
 910
 911                 rdlstate = le32_to_cpu(state.state);
 912                 rdlbytes = le32_to_cpu(state.bytes);
 913
 914                 /* restart if an error is reported */
 915                 if (rdlstate == DL_BAD_HDR || rdlstate == DL_BAD_CRC) {
 916                         brcmf_err("Bad Hdr or Bad CRC state %d\n",
 917                                   rdlstate);
 918                         err = -EINVAL;
 919                         goto fail;
 920                 }
 921         }
 922
 923 fail:
 924         kfree(bulkchunk);
 925         brcmf_dbg(USB, "Exit, err=%d\n", err);
 926         return err;
 927 }
 928
 929 static int brcmf_usb_dlstart(struct brcmf_usbdev_info *devinfo, u8 *fw, int len)
 930 {
 931         int err;
 932
 933         brcmf_dbg(USB, "Enter\n");
 934
 935         if (devinfo == NULL)
 936                 return -EINVAL;
 937
 938         if (devinfo->bus_pub.devid == 0xDEAD)
 939                 return -EINVAL;
 940
 941         err = brcmf_usb_dl_writeimage(devinfo, fw, len);
 942         if (err == 0)
 943                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_DONE;
 944         else
 945                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_FAIL;
 946         brcmf_dbg(USB, "Exit, err=%d\n", err);
 947
 948         return err;
 949 }
 950
 951 static int brcmf_usb_dlrun(struct brcmf_usbdev_info *devinfo)
 952 {
 953         struct rdl_state_le state;
 954
 955         brcmf_dbg(USB, "Enter\n");
 956         if (!devinfo)
 957                 return -EINVAL;
 958
 959         if (devinfo->bus_pub.devid == 0xDEAD)
 960                 return -EINVAL;
 961
 962         /* Check we are runnable */
 963         brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 964                 sizeof(struct rdl_state_le));
 965
 966         /* Start the image */
 967         if (state.state == cpu_to_le32(DL_RUNNABLE)) {
 968                 if (!brcmf_usb_dl_cmd(devinfo, DL_GO, &state,
 969                         sizeof(struct rdl_state_le)))
 970                         return -ENODEV;
 971                 if (brcmf_usb_resetcfg(devinfo))
 972                         return -ENODEV;
 973                 /* The Dongle may go for re-enumeration. */
 974         } else {
 975                 brcmf_err("Dongle not runnable\n");
 976                 return -EINVAL;
 977         }
 978         brcmf_dbg(USB, "Exit\n");
 979         return 0;
 980 }
 981
 982 static bool brcmf_usb_chip_support(int chipid, int chiprev)
 983 {
 984         switch(chipid) {
 985         case 43143:
 986                 return true;
 987         case 43235:
 988         case 43236:
 989         case 43238:
 990                 return (chiprev == 3);
 991         case 43242:
 992                 return true;
 993         default:
 994                 break;
 995         }
 996         return false;
 997 }
 998
 999 static int
1000 brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
1001 {
1002         int devid, chiprev;
1003         int err;
1004
1005         brcmf_dbg(USB, "Enter\n");
1006         if (devinfo == NULL)
1007                 return -ENODEV;
1008
1009         devid = devinfo->bus_pub.devid;
1010         chiprev = devinfo->bus_pub.chiprev;
1011
1012         if (!brcmf_usb_chip_support(devid, chiprev)) {
1013                 brcmf_err("unsupported chip %d rev %d\n",
1014                           devid, chiprev);
1015                 return -EINVAL;
1016         }
1017
1018         if (!devinfo->image) {
1019                 brcmf_err("No firmware!\n");
1020                 return -ENOENT;
1021         }
1022
1023         err = brcmf_usb_dlstart(devinfo,
1024                 devinfo->image, devinfo->image_len);
1025         if (err == 0)
1026                 err = brcmf_usb_dlrun(devinfo);
1027         return err;
1028 }
1029
1030
1031 static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
1032 {
1033         brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
1034
1035         /* free the URBS */
1036         brcmf_usb_free_q(&devinfo->rx_freeq, false);
1037         brcmf_usb_free_q(&devinfo->tx_freeq, false);
1038
1039         usb_free_urb(devinfo->intr_urb);
1040         usb_free_urb(devinfo->ctl_urb);
1041         usb_free_urb(devinfo->bulk_urb);
1042
1043         kfree(devinfo->tx_reqs);
1044         kfree(devinfo->rx_reqs);
1045 }
1046
1047 #define TRX_MAGIC       0x30524448      /* "HDR0" */
1048 #define TRX_VERSION     1               /* Version 1 */
1049 #define TRX_MAX_LEN     0x3B0000        /* Max length */
1050 #define TRX_NO_HEADER   1               /* Do not write TRX header */
1051 #define TRX_MAX_OFFSET  3               /* Max number of individual files */
1052 #define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed image */
1053
1054 struct trx_header_le {
1055         __le32 magic;           /* "HDR0" */
1056         __le32 len;             /* Length of file including header */
1057         __le32 crc32;           /* CRC from flag_version to end of file */
1058         __le32 flag_version;    /* 0:15 flags, 16:31 version */
1059         __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
1060                                          * header */
1061 };
1062
1063 static int check_file(const u8 *headers)
1064 {
1065         struct trx_header_le *trx;
1066         int actual_len = -1;
1067
1068         brcmf_dbg(USB, "Enter\n");
1069         /* Extract trx header */
1070         trx = (struct trx_header_le *) headers;
1071         if (trx->magic != cpu_to_le32(TRX_MAGIC))
1072                 return -1;
1073
1074         headers += sizeof(struct trx_header_le);
1075
1076         if (le32_to_cpu(trx->flag_version) & TRX_UNCOMP_IMAGE) {
1077                 actual_len = le32_to_cpu(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]);
1078                 return actual_len + sizeof(struct trx_header_le);
1079         }
1080         return -1;
1081 }
1082
1083 static int brcmf_usb_get_fw(struct brcmf_usbdev_info *devinfo)
1084 {
1085         s8 *fwname;
1086         const struct firmware *fw;
1087         struct brcmf_usb_image *fw_image;
1088         int err;
1089
1090         brcmf_dbg(USB, "Enter\n");
1091         switch (devinfo->bus_pub.devid) {
1092         case 43143:
1093                 fwname = BRCMF_USB_43143_FW_NAME;
1094                 break;
1095         case 43235:
1096         case 43236:
1097         case 43238:
1098                 fwname = BRCMF_USB_43236_FW_NAME;
1099                 break;
1100         case 43242:
1101                 fwname = BRCMF_USB_43242_FW_NAME;
1102                 break;
1103         default:
1104                 return -EINVAL;
1105                 break;
1106         }
1107         brcmf_dbg(USB, "Loading FW %s\n", fwname);
1108         list_for_each_entry(fw_image, &fw_image_list, list) {
1109                 if (fw_image->fwname == fwname) {
1110                         devinfo->image = fw_image->image;
1111                         devinfo->image_len = fw_image->image_len;
1112                         return 0;
1113                 }
1114         }
1115         /* fw image not yet loaded. Load it now and add to list */
1116         err = request_firmware(&fw, fwname, devinfo->dev);
1117         if (!fw) {
1118                 brcmf_err("fail to request firmware %s\n", fwname);
1119                 return err;
1120         }
1121         if (check_file(fw->data) < 0) {
1122                 brcmf_err("invalid firmware %s\n", fwname);
1123                 return -EINVAL;
1124         }
1125
1126         fw_image = kzalloc(sizeof(*fw_image), GFP_ATOMIC);
1127         if (!fw_image)
1128                 return -ENOMEM;
1129         INIT_LIST_HEAD(&fw_image->list);
1130         list_add_tail(&fw_image->list, &fw_image_list);
1131         fw_image->fwname = fwname;
1132         fw_image->image = vmalloc(fw->size);
1133         if (!fw_image->image)
1134                 return -ENOMEM;
1135
1136         memcpy(fw_image->image, fw->data, fw->size);
1137         fw_image->image_len = fw->size;
1138
1139         release_firmware(fw);
1140
1141         devinfo->image = fw_image->image;
1142         devinfo->image_len = fw_image->image_len;
1143
1144         return 0;
1145 }
1146
1147
1148 static
1149 struct brcmf_usbdev *brcmf_usb_attach(struct brcmf_usbdev_info *devinfo,
1150                                       int nrxq, int ntxq)
1151 {
1152         brcmf_dbg(USB, "Enter\n");
1153
1154         devinfo->bus_pub.nrxq = nrxq;
1155         devinfo->rx_low_watermark = nrxq / 2;
1156         devinfo->bus_pub.devinfo = devinfo;
1157         devinfo->bus_pub.ntxq = ntxq;
1158         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DOWN;
1159
1160         /* flow control when too many tx urbs posted */
1161         devinfo->tx_low_watermark = ntxq / 4;
1162         devinfo->tx_high_watermark = devinfo->tx_low_watermark * 3;
1163         devinfo->bus_pub.bus_mtu = BRCMF_USB_MAX_PKT_SIZE;
1164
1165         /* Initialize other structure content */
1166         init_waitqueue_head(&devinfo->ioctl_resp_wait);
1167
1168         /* Initialize the spinlocks */
1169         spin_lock_init(&devinfo->qlock);
1170         spin_lock_init(&devinfo->tx_flowblock_lock);
1171
1172         INIT_LIST_HEAD(&devinfo->rx_freeq);
1173         INIT_LIST_HEAD(&devinfo->rx_postq);
1174
1175         INIT_LIST_HEAD(&devinfo->tx_freeq);
1176         INIT_LIST_HEAD(&devinfo->tx_postq);
1177
1178         devinfo->tx_flowblock = false;
1179
1180         devinfo->rx_reqs = brcmf_usbdev_qinit(&devinfo->rx_freeq, nrxq);
1181         if (!devinfo->rx_reqs)
1182                 goto error;
1183
1184         devinfo->tx_reqs = brcmf_usbdev_qinit(&devinfo->tx_freeq, ntxq);
1185         if (!devinfo->tx_reqs)
1186                 goto error;
1187         devinfo->tx_freecount = ntxq;
1188
1189         devinfo->intr_urb = usb_alloc_urb(0, GFP_ATOMIC);
1190         if (!devinfo->intr_urb) {
1191                 brcmf_err("usb_alloc_urb (intr) failed\n");
1192                 goto error;
1193         }
1194         devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
1195         if (!devinfo->ctl_urb) {
1196                 brcmf_err("usb_alloc_urb (ctl) failed\n");
1197                 goto error;
1198         }
1199         devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
1200         if (!devinfo->bulk_urb) {
1201                 brcmf_err("usb_alloc_urb (bulk) failed\n");
1202                 goto error;
1203         }
1204
1205         if (!brcmf_usb_dlneeded(devinfo))
1206                 return &devinfo->bus_pub;
1207
1208         brcmf_dbg(USB, "Start fw downloading\n");
1209         if (brcmf_usb_get_fw(devinfo))
1210                 goto error;
1211
1212         if (brcmf_usb_fw_download(devinfo))
1213                 goto error;
1214
1215         return &devinfo->bus_pub;
1216
1217 error:
1218         brcmf_err("failed!\n");
1219         brcmf_usb_detach(devinfo);
1220         return NULL;
1221 }
1222
1223 static struct brcmf_bus_ops brcmf_usb_bus_ops = {
1224         .txdata = brcmf_usb_tx,
1225         .init = brcmf_usb_up,
1226         .stop = brcmf_usb_down,
1227         .txctl = brcmf_usb_tx_ctlpkt,
1228         .rxctl = brcmf_usb_rx_ctlpkt,
1229 };
1230
1231 static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
1232 {
1233         struct brcmf_bus *bus = NULL;
1234         struct brcmf_usbdev *bus_pub = NULL;
1235         int ret;
1236         struct device *dev = devinfo->dev;
1237
1238         brcmf_dbg(USB, "Enter\n");
1239         bus_pub = brcmf_usb_attach(devinfo, BRCMF_USB_NRXQ, BRCMF_USB_NTXQ);
1240         if (!bus_pub)
1241                 return -ENODEV;
1242
1243         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
1244         if (!bus) {
1245                 ret = -ENOMEM;
1246                 goto fail;
1247         }
1248
1249         bus->dev = dev;
1250         bus_pub->bus = bus;
1251         bus->bus_priv.usb = bus_pub;
1252         dev_set_drvdata(dev, bus);
1253         bus->ops = &brcmf_usb_bus_ops;
1254         bus->chip = bus_pub->devid;
1255         bus->chiprev = bus_pub->chiprev;
1256
1257         /* Attach to the common driver interface */
1258         ret = brcmf_attach(0, dev);
1259         if (ret) {
1260                 brcmf_err("brcmf_attach failed\n");
1261                 goto fail;
1262         }
1263
1264         ret = brcmf_bus_start(dev);
1265         if (ret) {
1266                 brcmf_err("dongle is not responding\n");
1267                 brcmf_detach(dev);
1268                 goto fail;
1269         }
1270
1271         return 0;
1272 fail:
1273         /* Release resources in reverse order */
1274         kfree(bus);
1275         brcmf_usb_detach(devinfo);
1276         return ret;
1277 }
1278
1279 static void
1280 brcmf_usb_disconnect_cb(struct brcmf_usbdev_info *devinfo)
1281 {
1282         if (!devinfo)
1283                 return;
1284         brcmf_dbg(USB, "Enter, bus_pub %p\n", devinfo);
1285
1286         brcmf_detach(devinfo->dev);
1287         kfree(devinfo->bus_pub.bus);
1288         brcmf_usb_detach(devinfo);
1289 }
1290
1291 static int
1292 brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
1293 {
1294         int ep;
1295         struct usb_endpoint_descriptor *endpoint;
1296         int ret = 0;
1297         struct usb_device *usb = interface_to_usbdev(intf);
1298         int num_of_eps;
1299         u8 endpoint_num;
1300         struct brcmf_usbdev_info *devinfo;
1301
1302         brcmf_dbg(USB, "Enter\n");
1303
1304         devinfo = kzalloc(sizeof(*devinfo), GFP_ATOMIC);
1305         if (devinfo == NULL)
1306                 return -ENOMEM;
1307
1308         devinfo->usbdev = usb;
1309         devinfo->dev = &usb->dev;
1310
1311         usb_set_intfdata(intf, devinfo);
1312
1313         /* Check that the device supports only one configuration */
1314         if (usb->descriptor.bNumConfigurations != 1) {
1315                 ret = -1;
1316                 goto fail;
1317         }
1318
1319         if (usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
1320                 ret = -1;
1321                 goto fail;
1322         }
1323
1324         /*
1325          * Only the BDC interface configuration is supported:
1326          *      Device class: USB_CLASS_VENDOR_SPEC
1327          *      if0 class: USB_CLASS_VENDOR_SPEC
1328          *      if0/ep0: control
1329          *      if0/ep1: bulk in
1330          *      if0/ep2: bulk out (ok if swapped with bulk in)
1331          */
1332         if (CONFIGDESC(usb)->bNumInterfaces != 1) {
1333                 ret = -1;
1334                 goto fail;
1335         }
1336
1337         /* Check interface */
1338         if (IFDESC(usb, CONTROL_IF).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
1339             IFDESC(usb, CONTROL_IF).bInterfaceSubClass != 2 ||
1340             IFDESC(usb, CONTROL_IF).bInterfaceProtocol != 0xff) {
1341                 brcmf_err("invalid control interface: class %d, subclass %d, proto %d\n",
1342                           IFDESC(usb, CONTROL_IF).bInterfaceClass,
1343                           IFDESC(usb, CONTROL_IF).bInterfaceSubClass,
1344                           IFDESC(usb, CONTROL_IF).bInterfaceProtocol);
1345                 ret = -1;
1346                 goto fail;
1347         }
1348
1349         /* Check control endpoint */
1350         endpoint = &IFEPDESC(usb, CONTROL_IF, 0);
1351         if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
1352                 != USB_ENDPOINT_XFER_INT) {
1353                 brcmf_err("invalid control endpoint %d\n",
1354                           endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
1355                 ret = -1;
1356                 goto fail;
1357         }
1358
1359         endpoint_num = endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
1360         devinfo->intr_pipe = usb_rcvintpipe(usb, endpoint_num);
1361
1362         devinfo->rx_pipe = 0;
1363         devinfo->rx_pipe2 = 0;
1364         devinfo->tx_pipe = 0;
1365         num_of_eps = IFDESC(usb, BULK_IF).bNumEndpoints - 1;
1366
1367         /* Check data endpoints and get pipes */
1368         for (ep = 1; ep <= num_of_eps; ep++) {
1369                 endpoint = &IFEPDESC(usb, BULK_IF, ep);
1370                 if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
1371                     USB_ENDPOINT_XFER_BULK) {
1372                         brcmf_err("invalid data endpoint %d\n", ep);
1373                         ret = -1;
1374                         goto fail;
1375                 }
1376
1377                 endpoint_num = endpoint->bEndpointAddress &
1378                                USB_ENDPOINT_NUMBER_MASK;
1379                 if ((endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1380                         == USB_DIR_IN) {
1381                         if (!devinfo->rx_pipe) {
1382                                 devinfo->rx_pipe =
1383                                         usb_rcvbulkpipe(usb, endpoint_num);
1384                         } else {
1385                                 devinfo->rx_pipe2 =
1386                                         usb_rcvbulkpipe(usb, endpoint_num);
1387                         }
1388                 } else {
1389                         devinfo->tx_pipe = usb_sndbulkpipe(usb, endpoint_num);
1390                 }
1391         }
1392
1393         /* Allocate interrupt URB and data buffer */
1394         /* RNDIS says 8-byte intr, our old drivers used 4-byte */
1395         if (IFEPDESC(usb, CONTROL_IF, 0).wMaxPacketSize == cpu_to_le16(16))
1396                 devinfo->intr_size = 8;
1397         else
1398                 devinfo->intr_size = 4;
1399
1400         devinfo->interval = IFEPDESC(usb, CONTROL_IF, 0).bInterval;
1401
1402         if (usb->speed == USB_SPEED_HIGH)
1403                 brcmf_dbg(USB, "Broadcom high speed USB wireless device detected\n");
1404         else
1405                 brcmf_dbg(USB, "Broadcom full speed USB wireless device detected\n");
1406
1407         ret = brcmf_usb_probe_cb(devinfo);
1408         if (ret)
1409                 goto fail;
1410
1411         /* Success */
1412         return 0;
1413
1414 fail:
1415         brcmf_err("failed with errno %d\n", ret);
1416         kfree(devinfo);
1417         usb_set_intfdata(intf, NULL);
1418         return ret;
1419
1420 }
1421
1422 static void
1423 brcmf_usb_disconnect(struct usb_interface *intf)
1424 {
1425         struct brcmf_usbdev_info *devinfo;
1426
1427         brcmf_dbg(USB, "Enter\n");
1428         devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf);
1429         brcmf_usb_disconnect_cb(devinfo);
1430         kfree(devinfo);
1431         brcmf_dbg(USB, "Exit\n");
1432 }
1433
1434 /*
1435  * only need to signal the bus being down and update the state.
1436  */
1437 static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
1438 {
1439         struct usb_device *usb = interface_to_usbdev(intf);
1440         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1441
1442         brcmf_dbg(USB, "Enter\n");
1443         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_SLEEP;
1444         brcmf_detach(&usb->dev);
1445         return 0;
1446 }
1447
1448 /*
1449  * (re-) start the bus.
1450  */
1451 static int brcmf_usb_resume(struct usb_interface *intf)
1452 {
1453         struct usb_device *usb = interface_to_usbdev(intf);
1454         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1455
1456         brcmf_dbg(USB, "Enter\n");
1457         if (!brcmf_attach(0, devinfo->dev))
1458                 return brcmf_bus_start(&usb->dev);
1459
1460         return 0;
1461 }
1462
1463 static int brcmf_usb_reset_resume(struct usb_interface *intf)
1464 {
1465         struct usb_device *usb = interface_to_usbdev(intf);
1466         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1467
1468         brcmf_dbg(USB, "Enter\n");
1469
1470         if (!brcmf_usb_fw_download(devinfo))
1471                 return brcmf_usb_resume(intf);
1472
1473         return -EIO;
1474 }
1475
1476 #define BRCMF_USB_VENDOR_ID_BROADCOM    0x0a5c
1477 #define BRCMF_USB_DEVICE_ID_43143       0xbd1e
1478 #define BRCMF_USB_DEVICE_ID_43236       0xbd17
1479 #define BRCMF_USB_DEVICE_ID_43242       0xbd1f
1480 #define BRCMF_USB_DEVICE_ID_BCMFW       0x0bdc
1481
1482 static struct usb_device_id brcmf_usb_devid_table[] = {
1483         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43143) },
1484         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43236) },
1485         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43242) },
1486         /* special entry for device with firmware loaded and running */
1487         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
1488         { }
1489 };
1490
1491 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
1492 MODULE_FIRMWARE(BRCMF_USB_43143_FW_NAME);
1493 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
1494 MODULE_FIRMWARE(BRCMF_USB_43242_FW_NAME);
1495
1496 static struct usb_driver brcmf_usbdrvr = {
1497         .name = KBUILD_MODNAME,
1498         .probe = brcmf_usb_probe,
1499         .disconnect = brcmf_usb_disconnect,
1500         .id_table = brcmf_usb_devid_table,
1501         .suspend = brcmf_usb_suspend,
1502         .resume = brcmf_usb_resume,
1503         .reset_resume = brcmf_usb_reset_resume,
1504         .supports_autosuspend = 1,
1505         .disable_hub_initiated_lpm = 1,
1506 };
1507
1508 static void brcmf_release_fw(struct list_head *q)
1509 {
1510         struct brcmf_usb_image *fw_image, *next;
1511
1512         list_for_each_entry_safe(fw_image, next, q, list) {
1513                 vfree(fw_image->image);
1514                 list_del_init(&fw_image->list);
1515         }
1516 }
1517
1518 static int brcmf_usb_reset_device(struct device *dev, void *notused)
1519 {
1520         /* device past is the usb interface so we
1521          * need to use parent here.
1522          */
1523         brcmf_dev_reset(dev->parent);
1524         return 0;
1525 }
1526
1527 void brcmf_usb_exit(void)
1528 {
1529         struct device_driver *drv = &brcmf_usbdrvr.drvwrap.driver;
1530         int ret;
1531
1532         brcmf_dbg(USB, "Enter\n");
1533         ret = driver_for_each_device(drv, NULL, NULL,
1534                                      brcmf_usb_reset_device);
1535         usb_deregister(&brcmf_usbdrvr);
1536         brcmf_release_fw(&fw_image_list);
1537 }
1538
1539 void brcmf_usb_register(void)
1540 {
1541         brcmf_dbg(USB, "Enter\n");
1542         INIT_LIST_HEAD(&fw_image_list);
1543         usb_register(&brcmf_usbdrvr);
1544 }