drivers/net/wireless/brcm80211/brcmfmac/usb.c

   1 /*
   2  * Copyright (c) 2011 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/kernel.h>
  18 #include <linux/module.h>
  19 #include <linux/firmware.h>
  20 #include <linux/usb.h>
  21 #include <linux/vmalloc.h>
  22
  23 #include <brcmu_utils.h>
  24 #include <brcmu_wifi.h>
  25 #include <dhd_bus.h>
  26 #include <dhd_dbg.h>
  27
  28 #include "usb_rdl.h"
  29 #include "usb.h"
  30
  31 #define IOCTL_RESP_TIMEOUT  2000
  32
  33 #define BRCMF_USB_RESET_GETVER_SPINWAIT 100     /* in unit of ms */
  34 #define BRCMF_USB_RESET_GETVER_LOOP_CNT 10
  35
  36 #define BRCMF_POSTBOOT_ID               0xA123  /* ID to detect if dongle
  37                                                    has boot up */
  38 #define BRCMF_USB_NRXQ  50
  39 #define BRCMF_USB_NTXQ  50
  40
  41 #define CONFIGDESC(usb)         (&((usb)->actconfig)->desc)
  42 #define IFPTR(usb, idx)         ((usb)->actconfig->interface[(idx)])
  43 #define IFALTS(usb, idx)        (IFPTR((usb), (idx))->altsetting[0])
  44 #define IFDESC(usb, idx)        IFALTS((usb), (idx)).desc
  45 #define IFEPDESC(usb, idx, ep)  (IFALTS((usb), (idx)).endpoint[(ep)]).desc
  46
  47 #define CONTROL_IF              0
  48 #define BULK_IF                 0
  49
  50 #define BRCMF_USB_CBCTL_WRITE   0
  51 #define BRCMF_USB_CBCTL_READ    1
  52 #define BRCMF_USB_MAX_PKT_SIZE  1600
  53
  54 #define BRCMF_USB_43143_FW_NAME "brcm/brcmfmac43143.bin"
  55 #define BRCMF_USB_43236_FW_NAME "brcm/brcmfmac43236b.bin"
  56 #define BRCMF_USB_43242_FW_NAME "brcm/brcmfmac43242a.bin"
  57
  58 struct brcmf_usb_image {
  59         struct list_head list;
  60         s8 *fwname;
  61         u8 *image;
  62         int image_len;
  63 };
  64 static struct list_head fw_image_list;
  65
  66 struct intr_transfer_buf {
  67         u32 notification;
  68         u32 reserved;
  69 };
  70
  71 struct brcmf_usbdev_info {
  72         struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
  73         spinlock_t qlock;
  74         struct list_head rx_freeq;
  75         struct list_head rx_postq;
  76         struct list_head tx_freeq;
  77         struct list_head tx_postq;
  78         uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
  79
  80         int rx_low_watermark;
  81         int tx_low_watermark;
  82         int tx_high_watermark;
  83         int tx_freecount;
  84         bool tx_flowblock;
  85         spinlock_t tx_flowblock_lock;
  86
  87         struct brcmf_usbreq *tx_reqs;
  88         struct brcmf_usbreq *rx_reqs;
  89
  90         u8 *image;      /* buffer for combine fw and nvram */
  91         int image_len;
  92
  93         struct usb_device *usbdev;
  94         struct device *dev;
  95
  96         int ctl_in_pipe, ctl_out_pipe;
  97         struct urb *ctl_urb; /* URB for control endpoint */
  98         struct usb_ctrlrequest ctl_write;
  99         struct usb_ctrlrequest ctl_read;
 100         u32 ctl_urb_actual_length;
 101         int ctl_urb_status;
 102         int ctl_completed;
 103         wait_queue_head_t ioctl_resp_wait;
 104         ulong ctl_op;
 105
 106         struct urb *bulk_urb; /* used for FW download */
 107         struct urb *intr_urb; /* URB for interrupt endpoint */
 108         int intr_size;          /* Size of interrupt message */
 109         int interval;           /* Interrupt polling interval */
 110         struct intr_transfer_buf intr; /* Data buffer for interrupt endpoint */
 111 };
 112
 113 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 114                                 struct brcmf_usbreq  *req);
 115
 116 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
 117 {
 118         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
 119         return bus_if->bus_priv.usb;
 120 }
 121
 122 static struct brcmf_usbdev_info *brcmf_usb_get_businfo(struct device *dev)
 123 {
 124         return brcmf_usb_get_buspub(dev)->devinfo;
 125 }
 126
 127 static int brcmf_usb_ioctl_resp_wait(struct brcmf_usbdev_info *devinfo)
 128 {
 129         return wait_event_timeout(devinfo->ioctl_resp_wait,
 130                                   devinfo->ctl_completed,
 131                                   msecs_to_jiffies(IOCTL_RESP_TIMEOUT));
 132 }
 133
 134 static void brcmf_usb_ioctl_resp_wake(struct brcmf_usbdev_info *devinfo)
 135 {
 136         if (waitqueue_active(&devinfo->ioctl_resp_wait))
 137                 wake_up(&devinfo->ioctl_resp_wait);
 138 }
 139
 140 static void
 141 brcmf_usb_ctl_complete(struct brcmf_usbdev_info *devinfo, int type, int status)
 142 {
 143         brcmf_dbg(USB, "Enter, status=%d\n", status);
 144
 145         if (unlikely(devinfo == NULL))
 146                 return;
 147
 148         if (type == BRCMF_USB_CBCTL_READ) {
 149                 if (status == 0)
 150                         devinfo->bus_pub.stats.rx_ctlpkts++;
 151                 else
 152                         devinfo->bus_pub.stats.rx_ctlerrs++;
 153         } else if (type == BRCMF_USB_CBCTL_WRITE) {
 154                 if (status == 0)
 155                         devinfo->bus_pub.stats.tx_ctlpkts++;
 156                 else
 157                         devinfo->bus_pub.stats.tx_ctlerrs++;
 158         }
 159
 160         devinfo->ctl_urb_status = status;
 161         devinfo->ctl_completed = true;
 162         brcmf_usb_ioctl_resp_wake(devinfo);
 163 }
 164
 165 static void
 166 brcmf_usb_ctlread_complete(struct urb *urb)
 167 {
 168         struct brcmf_usbdev_info *devinfo =
 169                 (struct brcmf_usbdev_info *)urb->context;
 170
 171         brcmf_dbg(USB, "Enter\n");
 172         devinfo->ctl_urb_actual_length = urb->actual_length;
 173         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_READ,
 174                 urb->status);
 175 }
 176
 177 static void
 178 brcmf_usb_ctlwrite_complete(struct urb *urb)
 179 {
 180         struct brcmf_usbdev_info *devinfo =
 181                 (struct brcmf_usbdev_info *)urb->context;
 182
 183         brcmf_dbg(USB, "Enter\n");
 184         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_WRITE,
 185                 urb->status);
 186 }
 187
 188 static int
 189 brcmf_usb_send_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 190 {
 191         int ret;
 192         u16 size;
 193
 194         brcmf_dbg(USB, "Enter\n");
 195         if (devinfo == NULL || buf == NULL ||
 196             len == 0 || devinfo->ctl_urb == NULL)
 197                 return -EINVAL;
 198
 199         size = len;
 200         devinfo->ctl_write.wLength = cpu_to_le16p(&size);
 201         devinfo->ctl_urb->transfer_buffer_length = size;
 202         devinfo->ctl_urb_status = 0;
 203         devinfo->ctl_urb_actual_length = 0;
 204
 205         usb_fill_control_urb(devinfo->ctl_urb,
 206                 devinfo->usbdev,
 207                 devinfo->ctl_out_pipe,
 208                 (unsigned char *) &devinfo->ctl_write,
 209                 buf, size,
 210                 (usb_complete_t)brcmf_usb_ctlwrite_complete,
 211                 devinfo);
 212
 213         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 214         if (ret < 0)
 215                 brcmf_err("usb_submit_urb failed %d\n", ret);
 216
 217         return ret;
 218 }
 219
 220 static int
 221 brcmf_usb_recv_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 222 {
 223         int ret;
 224         u16 size;
 225
 226         brcmf_dbg(USB, "Enter\n");
 227         if ((devinfo == NULL) || (buf == NULL) || (len == 0)
 228                 || (devinfo->ctl_urb == NULL))
 229                 return -EINVAL;
 230
 231         size = len;
 232         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 233         devinfo->ctl_urb->transfer_buffer_length = size;
 234
 235         devinfo->ctl_read.bRequestType = USB_DIR_IN
 236                 | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 237         devinfo->ctl_read.bRequest = 1;
 238
 239         usb_fill_control_urb(devinfo->ctl_urb,
 240                 devinfo->usbdev,
 241                 devinfo->ctl_in_pipe,
 242                 (unsigned char *) &devinfo->ctl_read,
 243                 buf, size,
 244                 (usb_complete_t)brcmf_usb_ctlread_complete,
 245                 devinfo);
 246
 247         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 248         if (ret < 0)
 249                 brcmf_err("usb_submit_urb failed %d\n", ret);
 250
 251         return ret;
 252 }
 253
 254 static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 255 {
 256         int err = 0;
 257         int timeout = 0;
 258         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 259
 260         brcmf_dbg(USB, "Enter\n");
 261         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 262                 return -EIO;
 263
 264         if (test_and_set_bit(0, &devinfo->ctl_op))
 265                 return -EIO;
 266
 267         devinfo->ctl_completed = false;
 268         err = brcmf_usb_send_ctl(devinfo, buf, len);
 269         if (err) {
 270                 brcmf_err("fail %d bytes: %d\n", err, len);
 271                 clear_bit(0, &devinfo->ctl_op);
 272                 return err;
 273         }
 274         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 275         clear_bit(0, &devinfo->ctl_op);
 276         if (!timeout) {
 277                 brcmf_err("Txctl wait timed out\n");
 278                 err = -EIO;
 279         }
 280         return err;
 281 }
 282
 283 static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 284 {
 285         int err = 0;
 286         int timeout = 0;
 287         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 288
 289         brcmf_dbg(USB, "Enter\n");
 290         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 291                 return -EIO;
 292
 293         if (test_and_set_bit(0, &devinfo->ctl_op))
 294                 return -EIO;
 295
 296         devinfo->ctl_completed = false;
 297         err = brcmf_usb_recv_ctl(devinfo, buf, len);
 298         if (err) {
 299                 brcmf_err("fail %d bytes: %d\n", err, len);
 300                 clear_bit(0, &devinfo->ctl_op);
 301                 return err;
 302         }
 303         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 304         err = devinfo->ctl_urb_status;
 305         clear_bit(0, &devinfo->ctl_op);
 306         if (!timeout) {
 307                 brcmf_err("rxctl wait timed out\n");
 308                 err = -EIO;
 309         }
 310         if (!err)
 311                 return devinfo->ctl_urb_actual_length;
 312         else
 313                 return err;
 314 }
 315
 316 static struct brcmf_usbreq *brcmf_usb_deq(struct brcmf_usbdev_info *devinfo,
 317                                           struct list_head *q, int *counter)
 318 {
 319         unsigned long flags;
 320         struct brcmf_usbreq  *req;
 321         spin_lock_irqsave(&devinfo->qlock, flags);
 322         if (list_empty(q)) {
 323                 spin_unlock_irqrestore(&devinfo->qlock, flags);
 324                 return NULL;
 325         }
 326         req = list_entry(q->next, struct brcmf_usbreq, list);
 327         list_del_init(q->next);
 328         if (counter)
 329                 (*counter)--;
 330         spin_unlock_irqrestore(&devinfo->qlock, flags);
 331         return req;
 332
 333 }
 334
 335 static void brcmf_usb_enq(struct brcmf_usbdev_info *devinfo,
 336                           struct list_head *q, struct brcmf_usbreq *req,
 337                           int *counter)
 338 {
 339         unsigned long flags;
 340         spin_lock_irqsave(&devinfo->qlock, flags);
 341         list_add_tail(&req->list, q);
 342         if (counter)
 343                 (*counter)++;
 344         spin_unlock_irqrestore(&devinfo->qlock, flags);
 345 }
 346
 347 static struct brcmf_usbreq *
 348 brcmf_usbdev_qinit(struct list_head *q, int qsize)
 349 {
 350         int i;
 351         struct brcmf_usbreq *req, *reqs;
 352
 353         reqs = kcalloc(qsize, sizeof(struct brcmf_usbreq), GFP_ATOMIC);
 354         if (reqs == NULL)
 355                 return NULL;
 356
 357         req = reqs;
 358
 359         for (i = 0; i < qsize; i++) {
 360                 req->urb = usb_alloc_urb(0, GFP_ATOMIC);
 361                 if (!req->urb)
 362                         goto fail;
 363
 364                 INIT_LIST_HEAD(&req->list);
 365                 list_add_tail(&req->list, q);
 366                 req++;
 367         }
 368         return reqs;
 369 fail:
 370         brcmf_err("fail!\n");
 371         while (!list_empty(q)) {
 372                 req = list_entry(q->next, struct brcmf_usbreq, list);
 373                 if (req && req->urb)
 374                         usb_free_urb(req->urb);
 375                 list_del(q->next);
 376         }
 377         return NULL;
 378
 379 }
 380
 381 static void brcmf_usb_free_q(struct list_head *q, bool pending)
 382 {
 383         struct brcmf_usbreq *req, *next;
 384         int i = 0;
 385         list_for_each_entry_safe(req, next, q, list) {
 386                 if (!req->urb) {
 387                         brcmf_err("bad req\n");
 388                         break;
 389                 }
 390                 i++;
 391                 if (pending) {
 392                         usb_kill_urb(req->urb);
 393                 } else {
 394                         usb_free_urb(req->urb);
 395                         list_del_init(&req->list);
 396                 }
 397         }
 398 }
 399
 400 static void brcmf_usb_del_fromq(struct brcmf_usbdev_info *devinfo,
 401                                 struct brcmf_usbreq *req)
 402 {
 403         unsigned long flags;
 404
 405         spin_lock_irqsave(&devinfo->qlock, flags);
 406         list_del_init(&req->list);
 407         spin_unlock_irqrestore(&devinfo->qlock, flags);
 408 }
 409
 410
 411 static void brcmf_usb_tx_complete(struct urb *urb)
 412 {
 413         struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
 414         struct brcmf_usbdev_info *devinfo = req->devinfo;
 415         unsigned long flags;
 416
 417         brcmf_dbg(USB, "Enter, urb->status=%d, skb=%p\n", urb->status,
 418                   req->skb);
 419         brcmf_usb_del_fromq(devinfo, req);
 420
 421         brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
 422         req->skb = NULL;
 423         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req, &devinfo->tx_freecount);
 424         spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);
 425         if (devinfo->tx_freecount > devinfo->tx_high_watermark &&
 426                 devinfo->tx_flowblock) {
 427                 brcmf_txflowblock(devinfo->dev, false);
 428                 devinfo->tx_flowblock = false;
 429         }
 430         spin_unlock_irqrestore(&devinfo->tx_flowblock_lock, flags);
 431 }
 432
 433 static void brcmf_usb_rx_complete(struct urb *urb)
 434 {
 435         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
 436         struct brcmf_usbdev_info *devinfo = req->devinfo;
 437         struct sk_buff *skb;
 438         struct sk_buff_head skbq;
 439
 440         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 441         brcmf_usb_del_fromq(devinfo, req);
 442         skb = req->skb;
 443         req->skb = NULL;
 444
 445         /* zero lenght packets indicate usb "failure". Do not refill */
 446         if (urb->status != 0 || !urb->actual_length) {
 447                 brcmu_pkt_buf_free_skb(skb);
 448                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 449                 return;
 450         }
 451
 452         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 453                 skb_queue_head_init(&skbq);
 454                 skb_queue_tail(&skbq, skb);
 455                 skb_put(skb, urb->actual_length);
 456                 brcmf_rx_frames(devinfo->dev, &skbq);
 457                 brcmf_usb_rx_refill(devinfo, req);
 458         } else {
 459                 brcmu_pkt_buf_free_skb(skb);
 460                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 461         }
 462         return;
 463
 464 }
 465
 466 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 467                                 struct brcmf_usbreq  *req)
 468 {
 469         struct sk_buff *skb;
 470         int ret;
 471
 472         if (!req || !devinfo)
 473                 return;
 474
 475         skb = dev_alloc_skb(devinfo->bus_pub.bus_mtu);
 476         if (!skb) {
 477                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 478                 return;
 479         }
 480         req->skb = skb;
 481
 482         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
 483                           skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
 484                           req);
 485         req->devinfo = devinfo;
 486         brcmf_usb_enq(devinfo, &devinfo->rx_postq, req, NULL);
 487
 488         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 489         if (ret) {
 490                 brcmf_usb_del_fromq(devinfo, req);
 491                 brcmu_pkt_buf_free_skb(req->skb);
 492                 req->skb = NULL;
 493                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 494         }
 495         return;
 496 }
 497
 498 static void brcmf_usb_rx_fill_all(struct brcmf_usbdev_info *devinfo)
 499 {
 500         struct brcmf_usbreq *req;
 501
 502         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
 503                 brcmf_err("bus is not up=%d\n", devinfo->bus_pub.state);
 504                 return;
 505         }
 506         while ((req = brcmf_usb_deq(devinfo, &devinfo->rx_freeq, NULL)) != NULL)
 507                 brcmf_usb_rx_refill(devinfo, req);
 508 }
 509
 510 static void
 511 brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
 512 {
 513         struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
 514         int old_state;
 515
 516         brcmf_dbg(USB, "Enter, current state=%d, new state=%d\n",
 517                   devinfo->bus_pub.state, state);
 518
 519         if (devinfo->bus_pub.state == state)
 520                 return;
 521
 522         old_state = devinfo->bus_pub.state;
 523         devinfo->bus_pub.state = state;
 524
 525         /* update state of upper layer */
 526         if (state == BRCMFMAC_USB_STATE_DOWN) {
 527                 brcmf_dbg(USB, "DBUS is down\n");
 528                 bcmf_bus->state = BRCMF_BUS_DOWN;
 529         } else if (state == BRCMFMAC_USB_STATE_UP) {
 530                 brcmf_dbg(USB, "DBUS is up\n");
 531                 bcmf_bus->state = BRCMF_BUS_DATA;
 532         } else {
 533                 brcmf_dbg(USB, "DBUS current state=%d\n", state);
 534         }
 535 }
 536
 537 static void
 538 brcmf_usb_intr_complete(struct urb *urb)
 539 {
 540         struct brcmf_usbdev_info *devinfo =
 541                         (struct brcmf_usbdev_info *)urb->context;
 542         int err;
 543
 544         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 545
 546         if (devinfo == NULL)
 547                 return;
 548
 549         if (unlikely(urb->status)) {
 550                 if (urb->status == -ENOENT ||
 551                     urb->status == -ESHUTDOWN ||
 552                     urb->status == -ENODEV) {
 553                         brcmf_usb_state_change(devinfo,
 554                                                BRCMFMAC_USB_STATE_DOWN);
 555                 }
 556         }
 557
 558         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN) {
 559                 brcmf_err("intr cb when DBUS down, ignoring\n");
 560                 return;
 561         }
 562
 563         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 564                 err = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 565                 if (err)
 566                         brcmf_err("usb_submit_urb, err=%d\n", err);
 567         }
 568 }
 569
 570 static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 571 {
 572         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 573         struct brcmf_usbreq  *req;
 574         int ret;
 575         unsigned long flags;
 576
 577         brcmf_dbg(USB, "Enter, skb=%p\n", skb);
 578         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
 579                 ret = -EIO;
 580                 goto fail;
 581         }
 582
 583         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq,
 584                                         &devinfo->tx_freecount);
 585         if (!req) {
 586                 brcmf_err("no req to send\n");
 587                 ret = -ENOMEM;
 588                 goto fail;
 589         }
 590
 591         req->skb = skb;
 592         req->devinfo = devinfo;
 593         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
 594                           skb->data, skb->len, brcmf_usb_tx_complete, req);
 595         req->urb->transfer_flags |= URB_ZERO_PACKET;
 596         brcmf_usb_enq(devinfo, &devinfo->tx_postq, req, NULL);
 597         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 598         if (ret) {
 599                 brcmf_err("brcmf_usb_tx usb_submit_urb FAILED\n");
 600                 brcmf_usb_del_fromq(devinfo, req);
 601                 req->skb = NULL;
 602                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req,
 603                               &devinfo->tx_freecount);
 604                 goto fail;
 605         }
 606
 607         spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);
 608         if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
 609             !devinfo->tx_flowblock) {
 610                 brcmf_txflowblock(dev, true);
 611                 devinfo->tx_flowblock = true;
 612         }
 613         spin_unlock_irqrestore(&devinfo->tx_flowblock_lock, flags);
 614         return 0;
 615
 616 fail:
 617         return ret;
 618 }
 619
 620
 621 static int brcmf_usb_up(struct device *dev)
 622 {
 623         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 624         u16 ifnum;
 625         int ret;
 626
 627         brcmf_dbg(USB, "Enter\n");
 628         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP)
 629                 return 0;
 630
 631         /* Success, indicate devinfo is fully up */
 632         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_UP);
 633
 634         if (devinfo->intr_urb) {
 635                 usb_fill_int_urb(devinfo->intr_urb, devinfo->usbdev,
 636                         devinfo->intr_pipe,
 637                         &devinfo->intr,
 638                         devinfo->intr_size,
 639                         (usb_complete_t)brcmf_usb_intr_complete,
 640                         devinfo,
 641                         devinfo->interval);
 642
 643                 ret = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 644                 if (ret) {
 645                         brcmf_err("USB_SUBMIT_URB failed with status %d\n",
 646                                   ret);
 647                         return -EINVAL;
 648                 }
 649         }
 650
 651         if (devinfo->ctl_urb) {
 652                 devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
 653                 devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
 654
 655                 ifnum = IFDESC(devinfo->usbdev, CONTROL_IF).bInterfaceNumber;
 656
 657                 /* CTL Write */
 658                 devinfo->ctl_write.bRequestType =
 659                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 660                 devinfo->ctl_write.bRequest = 0;
 661                 devinfo->ctl_write.wValue = cpu_to_le16(0);
 662                 devinfo->ctl_write.wIndex = cpu_to_le16p(&ifnum);
 663
 664                 /* CTL Read */
 665                 devinfo->ctl_read.bRequestType =
 666                         USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 667                 devinfo->ctl_read.bRequest = 1;
 668                 devinfo->ctl_read.wValue = cpu_to_le16(0);
 669                 devinfo->ctl_read.wIndex = cpu_to_le16p(&ifnum);
 670         }
 671         brcmf_usb_rx_fill_all(devinfo);
 672         return 0;
 673 }
 674
 675 static void brcmf_usb_down(struct device *dev)
 676 {
 677         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 678
 679         brcmf_dbg(USB, "Enter\n");
 680         if (devinfo == NULL)
 681                 return;
 682
 683         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN)
 684                 return;
 685
 686         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_DOWN);
 687         if (devinfo->intr_urb)
 688                 usb_kill_urb(devinfo->intr_urb);
 689
 690         if (devinfo->ctl_urb)
 691                 usb_kill_urb(devinfo->ctl_urb);
 692
 693         if (devinfo->bulk_urb)
 694                 usb_kill_urb(devinfo->bulk_urb);
 695         brcmf_usb_free_q(&devinfo->tx_postq, true);
 696
 697         brcmf_usb_free_q(&devinfo->rx_postq, true);
 698 }
 699
 700 static void
 701 brcmf_usb_sync_complete(struct urb *urb)
 702 {
 703         struct brcmf_usbdev_info *devinfo =
 704                         (struct brcmf_usbdev_info *)urb->context;
 705
 706         devinfo->ctl_completed = true;
 707         brcmf_usb_ioctl_resp_wake(devinfo);
 708 }
 709
 710 static bool brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
 711                              void *buffer, int buflen)
 712 {
 713         int ret = 0;
 714         char *tmpbuf;
 715         u16 size;
 716
 717         if ((!devinfo) || (devinfo->ctl_urb == NULL))
 718                 return false;
 719
 720         tmpbuf = kmalloc(buflen, GFP_ATOMIC);
 721         if (!tmpbuf)
 722                 return false;
 723
 724         size = buflen;
 725         devinfo->ctl_urb->transfer_buffer_length = size;
 726
 727         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 728         devinfo->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
 729                 USB_RECIP_INTERFACE;
 730         devinfo->ctl_read.bRequest = cmd;
 731
 732         usb_fill_control_urb(devinfo->ctl_urb,
 733                 devinfo->usbdev,
 734                 usb_rcvctrlpipe(devinfo->usbdev, 0),
 735                 (unsigned char *) &devinfo->ctl_read,
 736                 (void *) tmpbuf, size,
 737                 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 738
 739         devinfo->ctl_completed = false;
 740         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 741         if (ret < 0) {
 742                 brcmf_err("usb_submit_urb failed %d\n", ret);
 743                 kfree(tmpbuf);
 744                 return false;
 745         }
 746
 747         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 748         memcpy(buffer, tmpbuf, buflen);
 749         kfree(tmpbuf);
 750
 751         return ret;
 752 }
 753
 754 static bool
 755 brcmf_usb_dlneeded(struct brcmf_usbdev_info *devinfo)
 756 {
 757         struct bootrom_id_le id;
 758         u32 chipid, chiprev;
 759
 760         brcmf_dbg(USB, "Enter\n");
 761
 762         if (devinfo == NULL)
 763                 return false;
 764
 765         /* Check if firmware downloaded already by querying runtime ID */
 766         id.chip = cpu_to_le32(0xDEAD);
 767         brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 768
 769         chipid = le32_to_cpu(id.chip);
 770         chiprev = le32_to_cpu(id.chiprev);
 771
 772         if ((chipid & 0x4300) == 0x4300)
 773                 brcmf_dbg(USB, "chip %x rev 0x%x\n", chipid, chiprev);
 774         else
 775                 brcmf_dbg(USB, "chip %d rev 0x%x\n", chipid, chiprev);
 776         if (chipid == BRCMF_POSTBOOT_ID) {
 777                 brcmf_dbg(USB, "firmware already downloaded\n");
 778                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 779                 return false;
 780         } else {
 781                 devinfo->bus_pub.devid = chipid;
 782                 devinfo->bus_pub.chiprev = chiprev;
 783         }
 784         return true;
 785 }
 786
 787 static int
 788 brcmf_usb_resetcfg(struct brcmf_usbdev_info *devinfo)
 789 {
 790         struct bootrom_id_le id;
 791         u32 loop_cnt;
 792
 793         brcmf_dbg(USB, "Enter\n");
 794
 795         loop_cnt = 0;
 796         do {
 797                 mdelay(BRCMF_USB_RESET_GETVER_SPINWAIT);
 798                 loop_cnt++;
 799                 id.chip = cpu_to_le32(0xDEAD);       /* Get the ID */
 800                 brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 801                 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID))
 802                         break;
 803         } while (loop_cnt < BRCMF_USB_RESET_GETVER_LOOP_CNT);
 804
 805         if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID)) {
 806                 brcmf_dbg(USB, "postboot chip 0x%x/rev 0x%x\n",
 807                           le32_to_cpu(id.chip), le32_to_cpu(id.chiprev));
 808
 809                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 810                 return 0;
 811         } else {
 812                 brcmf_err("Cannot talk to Dongle. Firmware is not UP, %d ms\n",
 813                           BRCMF_USB_RESET_GETVER_SPINWAIT * loop_cnt);
 814                 return -EINVAL;
 815         }
 816 }
 817
 818
 819 static int
 820 brcmf_usb_dl_send_bulk(struct brcmf_usbdev_info *devinfo, void *buffer, int len)
 821 {
 822         int ret;
 823
 824         if ((devinfo == NULL) || (devinfo->bulk_urb == NULL))
 825                 return -EINVAL;
 826
 827         /* Prepare the URB */
 828         usb_fill_bulk_urb(devinfo->bulk_urb, devinfo->usbdev,
 829                           devinfo->tx_pipe, buffer, len,
 830                           (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 831
 832         devinfo->bulk_urb->transfer_flags |= URB_ZERO_PACKET;
 833
 834         devinfo->ctl_completed = false;
 835         ret = usb_submit_urb(devinfo->bulk_urb, GFP_ATOMIC);
 836         if (ret) {
 837                 brcmf_err("usb_submit_urb failed %d\n", ret);
 838                 return ret;
 839         }
 840         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 841         return (ret == 0);
 842 }
 843
 844 static int
 845 brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
 846 {
 847         unsigned int sendlen, sent, dllen;
 848         char *bulkchunk = NULL, *dlpos;
 849         struct rdl_state_le state;
 850         u32 rdlstate, rdlbytes;
 851         int err = 0;
 852
 853         brcmf_dbg(USB, "Enter, fw %p, len %d\n", fw, fwlen);
 854
 855         bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
 856         if (bulkchunk == NULL) {
 857                 err = -ENOMEM;
 858                 goto fail;
 859         }
 860
 861         /* 1) Prepare USB boot loader for runtime image */
 862         brcmf_usb_dl_cmd(devinfo, DL_START, &state,
 863                          sizeof(struct rdl_state_le));
 864
 865         rdlstate = le32_to_cpu(state.state);
 866         rdlbytes = le32_to_cpu(state.bytes);
 867
 868         /* 2) Check we are in the Waiting state */
 869         if (rdlstate != DL_WAITING) {
 870                 brcmf_err("Failed to DL_START\n");
 871                 err = -EINVAL;
 872                 goto fail;
 873         }
 874         sent = 0;
 875         dlpos = fw;
 876         dllen = fwlen;
 877
 878         /* Get chip id and rev */
 879         while (rdlbytes != dllen) {
 880                 /* Wait until the usb device reports it received all
 881                  * the bytes we sent */
 882                 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
 883                         if ((dllen-sent) < RDL_CHUNK)
 884                                 sendlen = dllen-sent;
 885                         else
 886                                 sendlen = RDL_CHUNK;
 887
 888                         /* simply avoid having to send a ZLP by ensuring we
 889                          * never have an even
 890                          * multiple of 64
 891                          */
 892                         if (!(sendlen % 64))
 893                                 sendlen -= 4;
 894
 895                         /* send data */
 896                         memcpy(bulkchunk, dlpos, sendlen);
 897                         if (brcmf_usb_dl_send_bulk(devinfo, bulkchunk,
 898                                                    sendlen)) {
 899                                 brcmf_err("send_bulk failed\n");
 900                                 err = -EINVAL;
 901                                 goto fail;
 902                         }
 903
 904                         dlpos += sendlen;
 905                         sent += sendlen;
 906                 }
 907                 if (!brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 908                                       sizeof(struct rdl_state_le))) {
 909                         brcmf_err("DL_GETSTATE Failed xxxx\n");
 910                         err = -EINVAL;
 911                         goto fail;
 912                 }
 913
 914                 rdlstate = le32_to_cpu(state.state);
 915                 rdlbytes = le32_to_cpu(state.bytes);
 916
 917                 /* restart if an error is reported */
 918                 if (rdlstate == DL_BAD_HDR || rdlstate == DL_BAD_CRC) {
 919                         brcmf_err("Bad Hdr or Bad CRC state %d\n",
 920                                   rdlstate);
 921                         err = -EINVAL;
 922                         goto fail;
 923                 }
 924         }
 925
 926 fail:
 927         kfree(bulkchunk);
 928         brcmf_dbg(USB, "Exit, err=%d\n", err);
 929         return err;
 930 }
 931
 932 static int brcmf_usb_dlstart(struct brcmf_usbdev_info *devinfo, u8 *fw, int len)
 933 {
 934         int err;
 935
 936         brcmf_dbg(USB, "Enter\n");
 937
 938         if (devinfo == NULL)
 939                 return -EINVAL;
 940
 941         if (devinfo->bus_pub.devid == 0xDEAD)
 942                 return -EINVAL;
 943
 944         err = brcmf_usb_dl_writeimage(devinfo, fw, len);
 945         if (err == 0)
 946                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_DONE;
 947         else
 948                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_FAIL;
 949         brcmf_dbg(USB, "Exit, err=%d\n", err);
 950
 951         return err;
 952 }
 953
 954 static int brcmf_usb_dlrun(struct brcmf_usbdev_info *devinfo)
 955 {
 956         struct rdl_state_le state;
 957
 958         brcmf_dbg(USB, "Enter\n");
 959         if (!devinfo)
 960                 return -EINVAL;
 961
 962         if (devinfo->bus_pub.devid == 0xDEAD)
 963                 return -EINVAL;
 964
 965         /* Check we are runnable */
 966         brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 967                 sizeof(struct rdl_state_le));
 968
 969         /* Start the image */
 970         if (state.state == cpu_to_le32(DL_RUNNABLE)) {
 971                 if (!brcmf_usb_dl_cmd(devinfo, DL_GO, &state,
 972                         sizeof(struct rdl_state_le)))
 973                         return -ENODEV;
 974                 if (brcmf_usb_resetcfg(devinfo))
 975                         return -ENODEV;
 976                 /* The Dongle may go for re-enumeration. */
 977         } else {
 978                 brcmf_err("Dongle not runnable\n");
 979                 return -EINVAL;
 980         }
 981         brcmf_dbg(USB, "Exit\n");
 982         return 0;
 983 }
 984
 985 static bool brcmf_usb_chip_support(int chipid, int chiprev)
 986 {
 987         switch(chipid) {
 988         case 43143:
 989                 return true;
 990         case 43235:
 991         case 43236:
 992         case 43238:
 993                 return (chiprev == 3);
 994         case 43242:
 995                 return true;
 996         default:
 997                 break;
 998         }
 999         return false;
1000 }
1001
1002 static int
1003 brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
1004 {
1005         int devid, chiprev;
1006         int err;
1007
1008         brcmf_dbg(USB, "Enter\n");
1009         if (devinfo == NULL)
1010                 return -ENODEV;
1011
1012         devid = devinfo->bus_pub.devid;
1013         chiprev = devinfo->bus_pub.chiprev;
1014
1015         if (!brcmf_usb_chip_support(devid, chiprev)) {
1016                 brcmf_err("unsupported chip %d rev %d\n",
1017                           devid, chiprev);
1018                 return -EINVAL;
1019         }
1020
1021         if (!devinfo->image) {
1022                 brcmf_err("No firmware!\n");
1023                 return -ENOENT;
1024         }
1025
1026         err = brcmf_usb_dlstart(devinfo,
1027                 devinfo->image, devinfo->image_len);
1028         if (err == 0)
1029                 err = brcmf_usb_dlrun(devinfo);
1030         return err;
1031 }
1032
1033
1034 static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
1035 {
1036         brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
1037
1038         /* free the URBS */
1039         brcmf_usb_free_q(&devinfo->rx_freeq, false);
1040         brcmf_usb_free_q(&devinfo->tx_freeq, false);
1041
1042         usb_free_urb(devinfo->intr_urb);
1043         usb_free_urb(devinfo->ctl_urb);
1044         usb_free_urb(devinfo->bulk_urb);
1045
1046         kfree(devinfo->tx_reqs);
1047         kfree(devinfo->rx_reqs);
1048 }
1049
1050 #define TRX_MAGIC       0x30524448      /* "HDR0" */
1051 #define TRX_VERSION     1               /* Version 1 */
1052 #define TRX_MAX_LEN     0x3B0000        /* Max length */
1053 #define TRX_NO_HEADER   1               /* Do not write TRX header */
1054 #define TRX_MAX_OFFSET  3               /* Max number of individual files */
1055 #define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed image */
1056
1057 struct trx_header_le {
1058         __le32 magic;           /* "HDR0" */
1059         __le32 len;             /* Length of file including header */
1060         __le32 crc32;           /* CRC from flag_version to end of file */
1061         __le32 flag_version;    /* 0:15 flags, 16:31 version */
1062         __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
1063                                          * header */
1064 };
1065
1066 static int check_file(const u8 *headers)
1067 {
1068         struct trx_header_le *trx;
1069         int actual_len = -1;
1070
1071         brcmf_dbg(USB, "Enter\n");
1072         /* Extract trx header */
1073         trx = (struct trx_header_le *) headers;
1074         if (trx->magic != cpu_to_le32(TRX_MAGIC))
1075                 return -1;
1076
1077         headers += sizeof(struct trx_header_le);
1078
1079         if (le32_to_cpu(trx->flag_version) & TRX_UNCOMP_IMAGE) {
1080                 actual_len = le32_to_cpu(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]);
1081                 return actual_len + sizeof(struct trx_header_le);
1082         }
1083         return -1;
1084 }
1085
1086 static int brcmf_usb_get_fw(struct brcmf_usbdev_info *devinfo)
1087 {
1088         s8 *fwname;
1089         const struct firmware *fw;
1090         struct brcmf_usb_image *fw_image;
1091         int err;
1092
1093         brcmf_dbg(USB, "Enter\n");
1094         switch (devinfo->bus_pub.devid) {
1095         case 43143:
1096                 fwname = BRCMF_USB_43143_FW_NAME;
1097                 break;
1098         case 43235:
1099         case 43236:
1100         case 43238:
1101                 fwname = BRCMF_USB_43236_FW_NAME;
1102                 break;
1103         case 43242:
1104                 fwname = BRCMF_USB_43242_FW_NAME;
1105                 break;
1106         default:
1107                 return -EINVAL;
1108                 break;
1109         }
1110         brcmf_dbg(USB, "Loading FW %s\n", fwname);
1111         list_for_each_entry(fw_image, &fw_image_list, list) {
1112                 if (fw_image->fwname == fwname) {
1113                         devinfo->image = fw_image->image;
1114                         devinfo->image_len = fw_image->image_len;
1115                         return 0;
1116                 }
1117         }
1118         /* fw image not yet loaded. Load it now and add to list */
1119         err = request_firmware(&fw, fwname, devinfo->dev);
1120         if (!fw) {
1121                 brcmf_err("fail to request firmware %s\n", fwname);
1122                 return err;
1123         }
1124         if (check_file(fw->data) < 0) {
1125                 brcmf_err("invalid firmware %s\n", fwname);
1126                 return -EINVAL;
1127         }
1128
1129         fw_image = kzalloc(sizeof(*fw_image), GFP_ATOMIC);
1130         if (!fw_image)
1131                 return -ENOMEM;
1132         INIT_LIST_HEAD(&fw_image->list);
1133         list_add_tail(&fw_image->list, &fw_image_list);
1134         fw_image->fwname = fwname;
1135         fw_image->image = vmalloc(fw->size);
1136         if (!fw_image->image)
1137                 return -ENOMEM;
1138
1139         memcpy(fw_image->image, fw->data, fw->size);
1140         fw_image->image_len = fw->size;
1141
1142         release_firmware(fw);
1143
1144         devinfo->image = fw_image->image;
1145         devinfo->image_len = fw_image->image_len;
1146
1147         return 0;
1148 }
1149
1150
1151 static
1152 struct brcmf_usbdev *brcmf_usb_attach(struct brcmf_usbdev_info *devinfo,
1153                                       int nrxq, int ntxq)
1154 {
1155         brcmf_dbg(USB, "Enter\n");
1156
1157         devinfo->bus_pub.nrxq = nrxq;
1158         devinfo->rx_low_watermark = nrxq / 2;
1159         devinfo->bus_pub.devinfo = devinfo;
1160         devinfo->bus_pub.ntxq = ntxq;
1161         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DOWN;
1162
1163         /* flow control when too many tx urbs posted */
1164         devinfo->tx_low_watermark = ntxq / 4;
1165         devinfo->tx_high_watermark = devinfo->tx_low_watermark * 3;
1166         devinfo->bus_pub.bus_mtu = BRCMF_USB_MAX_PKT_SIZE;
1167
1168         /* Initialize other structure content */
1169         init_waitqueue_head(&devinfo->ioctl_resp_wait);
1170
1171         /* Initialize the spinlocks */
1172         spin_lock_init(&devinfo->qlock);
1173         spin_lock_init(&devinfo->tx_flowblock_lock);
1174
1175         INIT_LIST_HEAD(&devinfo->rx_freeq);
1176         INIT_LIST_HEAD(&devinfo->rx_postq);
1177
1178         INIT_LIST_HEAD(&devinfo->tx_freeq);
1179         INIT_LIST_HEAD(&devinfo->tx_postq);
1180
1181         devinfo->tx_flowblock = false;
1182
1183         devinfo->rx_reqs = brcmf_usbdev_qinit(&devinfo->rx_freeq, nrxq);
1184         if (!devinfo->rx_reqs)
1185                 goto error;
1186
1187         devinfo->tx_reqs = brcmf_usbdev_qinit(&devinfo->tx_freeq, ntxq);
1188         if (!devinfo->tx_reqs)
1189                 goto error;
1190         devinfo->tx_freecount = ntxq;
1191
1192         devinfo->intr_urb = usb_alloc_urb(0, GFP_ATOMIC);
1193         if (!devinfo->intr_urb) {
1194                 brcmf_err("usb_alloc_urb (intr) failed\n");
1195                 goto error;
1196         }
1197         devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
1198         if (!devinfo->ctl_urb) {
1199                 brcmf_err("usb_alloc_urb (ctl) failed\n");
1200                 goto error;
1201         }
1202         devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
1203         if (!devinfo->bulk_urb) {
1204                 brcmf_err("usb_alloc_urb (bulk) failed\n");
1205                 goto error;
1206         }
1207
1208         if (!brcmf_usb_dlneeded(devinfo))
1209                 return &devinfo->bus_pub;
1210
1211         brcmf_dbg(USB, "Start fw downloading\n");
1212         if (brcmf_usb_get_fw(devinfo))
1213                 goto error;
1214
1215         if (brcmf_usb_fw_download(devinfo))
1216                 goto error;
1217
1218         return &devinfo->bus_pub;
1219
1220 error:
1221         brcmf_err("failed!\n");
1222         brcmf_usb_detach(devinfo);
1223         return NULL;
1224 }
1225
1226 static struct brcmf_bus_ops brcmf_usb_bus_ops = {
1227         .txdata = brcmf_usb_tx,
1228         .init = brcmf_usb_up,
1229         .stop = brcmf_usb_down,
1230         .txctl = brcmf_usb_tx_ctlpkt,
1231         .rxctl = brcmf_usb_rx_ctlpkt,
1232 };
1233
1234 static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
1235 {
1236         struct brcmf_bus *bus = NULL;
1237         struct brcmf_usbdev *bus_pub = NULL;
1238         int ret;
1239         struct device *dev = devinfo->dev;
1240
1241         brcmf_dbg(USB, "Enter\n");
1242         bus_pub = brcmf_usb_attach(devinfo, BRCMF_USB_NRXQ, BRCMF_USB_NTXQ);
1243         if (!bus_pub)
1244                 return -ENODEV;
1245
1246         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
1247         if (!bus) {
1248                 ret = -ENOMEM;
1249                 goto fail;
1250         }
1251
1252         bus->dev = dev;
1253         bus_pub->bus = bus;
1254         bus->bus_priv.usb = bus_pub;
1255         dev_set_drvdata(dev, bus);
1256         bus->ops = &brcmf_usb_bus_ops;
1257         bus->chip = bus_pub->devid;
1258         bus->chiprev = bus_pub->chiprev;
1259
1260         /* Attach to the common driver interface */
1261         ret = brcmf_attach(0, dev);
1262         if (ret) {
1263                 brcmf_err("brcmf_attach failed\n");
1264                 goto fail;
1265         }
1266
1267         ret = brcmf_bus_start(dev);
1268         if (ret) {
1269                 brcmf_err("dongle is not responding\n");
1270                 brcmf_detach(dev);
1271                 goto fail;
1272         }
1273
1274         return 0;
1275 fail:
1276         /* Release resources in reverse order */
1277         kfree(bus);
1278         brcmf_usb_detach(devinfo);
1279         return ret;
1280 }
1281
1282 static void
1283 brcmf_usb_disconnect_cb(struct brcmf_usbdev_info *devinfo)
1284 {
1285         if (!devinfo)
1286                 return;
1287         brcmf_dbg(USB, "Enter, bus_pub %p\n", devinfo);
1288
1289         brcmf_detach(devinfo->dev);
1290         kfree(devinfo->bus_pub.bus);
1291         brcmf_usb_detach(devinfo);
1292 }
1293
1294 static int
1295 brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
1296 {
1297         int ep;
1298         struct usb_endpoint_descriptor *endpoint;
1299         int ret = 0;
1300         struct usb_device *usb = interface_to_usbdev(intf);
1301         int num_of_eps;
1302         u8 endpoint_num;
1303         struct brcmf_usbdev_info *devinfo;
1304
1305         brcmf_dbg(USB, "Enter\n");
1306
1307         devinfo = kzalloc(sizeof(*devinfo), GFP_ATOMIC);
1308         if (devinfo == NULL)
1309                 return -ENOMEM;
1310
1311         devinfo->usbdev = usb;
1312         devinfo->dev = &usb->dev;
1313
1314         usb_set_intfdata(intf, devinfo);
1315
1316         /* Check that the device supports only one configuration */
1317         if (usb->descriptor.bNumConfigurations != 1) {
1318                 ret = -1;
1319                 goto fail;
1320         }
1321
1322         if (usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
1323                 ret = -1;
1324                 goto fail;
1325         }
1326
1327         /*
1328          * Only the BDC interface configuration is supported:
1329          *      Device class: USB_CLASS_VENDOR_SPEC
1330          *      if0 class: USB_CLASS_VENDOR_SPEC
1331          *      if0/ep0: control
1332          *      if0/ep1: bulk in
1333          *      if0/ep2: bulk out (ok if swapped with bulk in)
1334          */
1335         if (CONFIGDESC(usb)->bNumInterfaces != 1) {
1336                 ret = -1;
1337                 goto fail;
1338         }
1339
1340         /* Check interface */
1341         if (IFDESC(usb, CONTROL_IF).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
1342             IFDESC(usb, CONTROL_IF).bInterfaceSubClass != 2 ||
1343             IFDESC(usb, CONTROL_IF).bInterfaceProtocol != 0xff) {
1344                 brcmf_err("invalid control interface: class %d, subclass %d, proto %d\n",
1345                           IFDESC(usb, CONTROL_IF).bInterfaceClass,
1346                           IFDESC(usb, CONTROL_IF).bInterfaceSubClass,
1347                           IFDESC(usb, CONTROL_IF).bInterfaceProtocol);
1348                 ret = -1;
1349                 goto fail;
1350         }
1351
1352         /* Check control endpoint */
1353         endpoint = &IFEPDESC(usb, CONTROL_IF, 0);
1354         if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
1355                 != USB_ENDPOINT_XFER_INT) {
1356                 brcmf_err("invalid control endpoint %d\n",
1357                           endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
1358                 ret = -1;
1359                 goto fail;
1360         }
1361
1362         endpoint_num = endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
1363         devinfo->intr_pipe = usb_rcvintpipe(usb, endpoint_num);
1364
1365         devinfo->rx_pipe = 0;
1366         devinfo->rx_pipe2 = 0;
1367         devinfo->tx_pipe = 0;
1368         num_of_eps = IFDESC(usb, BULK_IF).bNumEndpoints - 1;
1369
1370         /* Check data endpoints and get pipes */
1371         for (ep = 1; ep <= num_of_eps; ep++) {
1372                 endpoint = &IFEPDESC(usb, BULK_IF, ep);
1373                 if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
1374                     USB_ENDPOINT_XFER_BULK) {
1375                         brcmf_err("invalid data endpoint %d\n", ep);
1376                         ret = -1;
1377                         goto fail;
1378                 }
1379
1380                 endpoint_num = endpoint->bEndpointAddress &
1381                                USB_ENDPOINT_NUMBER_MASK;
1382                 if ((endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1383                         == USB_DIR_IN) {
1384                         if (!devinfo->rx_pipe) {
1385                                 devinfo->rx_pipe =
1386                                         usb_rcvbulkpipe(usb, endpoint_num);
1387                         } else {
1388                                 devinfo->rx_pipe2 =
1389                                         usb_rcvbulkpipe(usb, endpoint_num);
1390                         }
1391                 } else {
1392                         devinfo->tx_pipe = usb_sndbulkpipe(usb, endpoint_num);
1393                 }
1394         }
1395
1396         /* Allocate interrupt URB and data buffer */
1397         /* RNDIS says 8-byte intr, our old drivers used 4-byte */
1398         if (IFEPDESC(usb, CONTROL_IF, 0).wMaxPacketSize == cpu_to_le16(16))
1399                 devinfo->intr_size = 8;
1400         else
1401                 devinfo->intr_size = 4;
1402
1403         devinfo->interval = IFEPDESC(usb, CONTROL_IF, 0).bInterval;
1404
1405         if (usb->speed == USB_SPEED_HIGH)
1406                 brcmf_dbg(USB, "Broadcom high speed USB wireless device detected\n");
1407         else
1408                 brcmf_dbg(USB, "Broadcom full speed USB wireless device detected\n");
1409
1410         ret = brcmf_usb_probe_cb(devinfo);
1411         if (ret)
1412                 goto fail;
1413
1414         /* Success */
1415         return 0;
1416
1417 fail:
1418         brcmf_err("failed with errno %d\n", ret);
1419         kfree(devinfo);
1420         usb_set_intfdata(intf, NULL);
1421         return ret;
1422
1423 }
1424
1425 static void
1426 brcmf_usb_disconnect(struct usb_interface *intf)
1427 {
1428         struct brcmf_usbdev_info *devinfo;
1429
1430         brcmf_dbg(USB, "Enter\n");
1431         devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf);
1432         brcmf_usb_disconnect_cb(devinfo);
1433         kfree(devinfo);
1434         brcmf_dbg(USB, "Exit\n");
1435 }
1436
1437 /*
1438  * only need to signal the bus being down and update the state.
1439  */
1440 static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
1441 {
1442         struct usb_device *usb = interface_to_usbdev(intf);
1443         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1444
1445         brcmf_dbg(USB, "Enter\n");
1446         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_SLEEP;
1447         brcmf_detach(&usb->dev);
1448         return 0;
1449 }
1450
1451 /*
1452  * (re-) start the bus.
1453  */
1454 static int brcmf_usb_resume(struct usb_interface *intf)
1455 {
1456         struct usb_device *usb = interface_to_usbdev(intf);
1457         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1458
1459         brcmf_dbg(USB, "Enter\n");
1460         if (!brcmf_attach(0, devinfo->dev))
1461                 return brcmf_bus_start(&usb->dev);
1462
1463         return 0;
1464 }
1465
1466 static int brcmf_usb_reset_resume(struct usb_interface *intf)
1467 {
1468         struct usb_device *usb = interface_to_usbdev(intf);
1469         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1470
1471         brcmf_dbg(USB, "Enter\n");
1472
1473         if (!brcmf_usb_fw_download(devinfo))
1474                 return brcmf_usb_resume(intf);
1475
1476         return -EIO;
1477 }
1478
1479 #define BRCMF_USB_VENDOR_ID_BROADCOM    0x0a5c
1480 #define BRCMF_USB_DEVICE_ID_43143       0xbd1e
1481 #define BRCMF_USB_DEVICE_ID_43236       0xbd17
1482 #define BRCMF_USB_DEVICE_ID_43242       0xbd1f
1483 #define BRCMF_USB_DEVICE_ID_BCMFW       0x0bdc
1484
1485 static struct usb_device_id brcmf_usb_devid_table[] = {
1486         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43143) },
1487         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43236) },
1488         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43242) },
1489         /* special entry for device with firmware loaded and running */
1490         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
1491         { }
1492 };
1493
1494 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
1495 MODULE_FIRMWARE(BRCMF_USB_43143_FW_NAME);
1496 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
1497 MODULE_FIRMWARE(BRCMF_USB_43242_FW_NAME);
1498
1499 static struct usb_driver brcmf_usbdrvr = {
1500         .name = KBUILD_MODNAME,
1501         .probe = brcmf_usb_probe,
1502         .disconnect = brcmf_usb_disconnect,
1503         .id_table = brcmf_usb_devid_table,
1504         .suspend = brcmf_usb_suspend,
1505         .resume = brcmf_usb_resume,
1506         .reset_resume = brcmf_usb_reset_resume,
1507         .supports_autosuspend = 1,
1508         .disable_hub_initiated_lpm = 1,
1509 };
1510
1511 static void brcmf_release_fw(struct list_head *q)
1512 {
1513         struct brcmf_usb_image *fw_image, *next;
1514
1515         list_for_each_entry_safe(fw_image, next, q, list) {
1516                 vfree(fw_image->image);
1517                 list_del_init(&fw_image->list);
1518         }
1519 }
1520
1521 static int brcmf_usb_reset_device(struct device *dev, void *notused)
1522 {
1523         /* device past is the usb interface so we
1524          * need to use parent here.
1525          */
1526         brcmf_dev_reset(dev->parent);
1527         return 0;
1528 }
1529
1530 void brcmf_usb_exit(void)
1531 {
1532         struct device_driver *drv = &brcmf_usbdrvr.drvwrap.driver;
1533         int ret;
1534
1535         brcmf_dbg(USB, "Enter\n");
1536         ret = driver_for_each_device(drv, NULL, NULL,
1537                                      brcmf_usb_reset_device);
1538         usb_deregister(&brcmf_usbdrvr);
1539         brcmf_release_fw(&fw_image_list);
1540 }
1541
1542 void brcmf_usb_register(void)
1543 {
1544         brcmf_dbg(USB, "Enter\n");
1545         INIT_LIST_HEAD(&fw_image_list);
1546         usb_register(&brcmf_usbdrvr);
1547 }