drivers/net/wireless/brcm80211/brcmfmac/usb.c

   1 /*
   2  * Copyright (c) 2011 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/init.h>
  18 #include <linux/kernel.h>
  19 #include <linux/module.h>
  20 #include <linux/kthread.h>
  21 #include <linux/slab.h>
  22 #include <linux/skbuff.h>
  23 #include <linux/netdevice.h>
  24 #include <linux/spinlock.h>
  25 #include <linux/ethtool.h>
  26 #include <linux/fcntl.h>
  27 #include <linux/fs.h>
  28 #include <linux/uaccess.h>
  29 #include <linux/firmware.h>
  30 #include <linux/usb.h>
  31 #include <linux/vmalloc.h>
  32 #include <net/cfg80211.h>
  33
  34 #include <defs.h>
  35 #include <brcmu_utils.h>
  36 #include <brcmu_wifi.h>
  37 #include <dhd_bus.h>
  38 #include <dhd_dbg.h>
  39
  40 #include "usb_rdl.h"
  41 #include "usb.h"
  42
  43 #define IOCTL_RESP_TIMEOUT  2000
  44
  45 #define BRCMF_USB_SYNC_TIMEOUT          300     /* ms */
  46 #define BRCMF_USB_DLIMAGE_SPINWAIT      100     /* in unit of ms */
  47 #define BRCMF_USB_DLIMAGE_LIMIT         500     /* spinwait limit (ms) */
  48
  49 #define BRCMF_POSTBOOT_ID               0xA123  /* ID to detect if dongle
  50                                                    has boot up */
  51 #define BRCMF_USB_RESETCFG_SPINWAIT     1       /* wait after resetcfg (ms) */
  52
  53 #define BRCMF_USB_NRXQ  50
  54 #define BRCMF_USB_NTXQ  50
  55
  56 #define CONFIGDESC(usb)         (&((usb)->actconfig)->desc)
  57 #define IFPTR(usb, idx)         ((usb)->actconfig->interface[(idx)])
  58 #define IFALTS(usb, idx)        (IFPTR((usb), (idx))->altsetting[0])
  59 #define IFDESC(usb, idx)        IFALTS((usb), (idx)).desc
  60 #define IFEPDESC(usb, idx, ep)  (IFALTS((usb), (idx)).endpoint[(ep)]).desc
  61
  62 #define CONTROL_IF              0
  63 #define BULK_IF                 0
  64
  65 #define BRCMF_USB_CBCTL_WRITE   0
  66 #define BRCMF_USB_CBCTL_READ    1
  67 #define BRCMF_USB_MAX_PKT_SIZE  1600
  68
  69 #define BRCMF_USB_43236_FW_NAME "brcm/brcmfmac43236b.bin"
  70
  71 enum usbdev_suspend_state {
  72         USBOS_SUSPEND_STATE_DEVICE_ACTIVE = 0, /* Device is busy, won't allow
  73                                                   suspend */
  74         USBOS_SUSPEND_STATE_SUSPEND_PENDING,    /* Device is idle, can be
  75                                                  * suspended. Wating PM to
  76                                                  * suspend the device
  77                                                  */
  78         USBOS_SUSPEND_STATE_SUSPENDED   /* Device suspended */
  79 };
  80
  81 struct brcmf_usb_probe_info {
  82         void *usbdev_info;
  83         struct usb_device *usb; /* USB device pointer from OS */
  84         uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
  85         int intr_size; /* Size of interrupt message */
  86         int interval;  /* Interrupt polling interval */
  87         int vid;
  88         int pid;
  89         enum usb_device_speed device_speed;
  90         enum usbdev_suspend_state suspend_state;
  91         struct usb_interface *intf;
  92 };
  93 static struct brcmf_usb_probe_info usbdev_probe_info;
  94
  95 struct brcmf_usb_image {
  96         void *data;
  97         u32 len;
  98 };
  99 static struct brcmf_usb_image g_image = { NULL, 0 };
 100
 101 struct intr_transfer_buf {
 102         u32 notification;
 103         u32 reserved;
 104 };
 105
 106 struct brcmf_usbdev_info {
 107         struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
 108         spinlock_t qlock;
 109         struct list_head rx_freeq;
 110         struct list_head rx_postq;
 111         struct list_head tx_freeq;
 112         struct list_head tx_postq;
 113         enum usbdev_suspend_state suspend_state;
 114         uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
 115
 116         bool activity;
 117         int rx_low_watermark;
 118         int tx_low_watermark;
 119         int tx_high_watermark;
 120         bool txoff;
 121         bool rxoff;
 122         bool txoverride;
 123
 124         struct brcmf_usbreq *tx_reqs;
 125         struct brcmf_usbreq *rx_reqs;
 126
 127         u8 *image;      /* buffer for combine fw and nvram */
 128         int image_len;
 129
 130         wait_queue_head_t wait;
 131         bool waitdone;
 132         int sync_urb_status;
 133
 134         struct usb_device *usbdev;
 135         struct device *dev;
 136         enum usb_device_speed  device_speed;
 137
 138         int ctl_in_pipe, ctl_out_pipe;
 139         struct urb *ctl_urb; /* URB for control endpoint */
 140         struct usb_ctrlrequest ctl_write;
 141         struct usb_ctrlrequest ctl_read;
 142         u32 ctl_urb_actual_length;
 143         int ctl_urb_status;
 144         int ctl_completed;
 145         wait_queue_head_t ioctl_resp_wait;
 146         wait_queue_head_t ctrl_wait;
 147         ulong ctl_op;
 148
 149         bool rxctl_deferrespok;
 150
 151         struct urb *bulk_urb; /* used for FW download */
 152         struct urb *intr_urb; /* URB for interrupt endpoint */
 153         int intr_size;          /* Size of interrupt message */
 154         int interval;           /* Interrupt polling interval */
 155         struct intr_transfer_buf intr; /* Data buffer for interrupt endpoint */
 156
 157         struct brcmf_usb_probe_info probe_info;
 158
 159 };
 160
 161 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 162                                 struct brcmf_usbreq  *req);
 163
 164 MODULE_AUTHOR("Broadcom Corporation");
 165 MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN fullmac usb driver.");
 166 MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN fullmac usb cards");
 167 MODULE_LICENSE("Dual BSD/GPL");
 168
 169 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
 170 {
 171         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
 172         return bus_if->bus_priv.usb;
 173 }
 174
 175 static struct brcmf_usbdev_info *brcmf_usb_get_businfo(struct device *dev)
 176 {
 177         return brcmf_usb_get_buspub(dev)->devinfo;
 178 }
 179
 180 #if 0
 181 static void
 182 brcmf_usb_txflowcontrol(struct brcmf_usbdev_info *devinfo, bool onoff)
 183 {
 184         dhd_txflowcontrol(devinfo->bus_pub.netdev, 0, onoff);
 185 }
 186 #endif
 187
 188 static int brcmf_usb_ioctl_resp_wait(struct brcmf_usbdev_info *devinfo,
 189          uint *condition, bool *pending)
 190 {
 191         DECLARE_WAITQUEUE(wait, current);
 192         int timeout = IOCTL_RESP_TIMEOUT;
 193
 194         /* Convert timeout in millsecond to jiffies */
 195         timeout = msecs_to_jiffies(timeout);
 196         /* Wait until control frame is available */
 197         add_wait_queue(&devinfo->ioctl_resp_wait, &wait);
 198         set_current_state(TASK_INTERRUPTIBLE);
 199
 200         smp_mb();
 201         while (!(*condition) && (!signal_pending(current) && timeout)) {
 202                 timeout = schedule_timeout(timeout);
 203                 /* Wait until control frame is available */
 204                 smp_mb();
 205         }
 206
 207         if (signal_pending(current))
 208                 *pending = true;
 209
 210         set_current_state(TASK_RUNNING);
 211         remove_wait_queue(&devinfo->ioctl_resp_wait, &wait);
 212
 213         return timeout;
 214 }
 215
 216 static int brcmf_usb_ioctl_resp_wake(struct brcmf_usbdev_info *devinfo)
 217 {
 218         if (waitqueue_active(&devinfo->ioctl_resp_wait))
 219                 wake_up_interruptible(&devinfo->ioctl_resp_wait);
 220
 221         return 0;
 222 }
 223
 224 static void
 225 brcmf_usb_ctl_complete(struct brcmf_usbdev_info *devinfo, int type, int status)
 226 {
 227
 228         if (unlikely(devinfo == NULL))
 229                 return;
 230
 231         if (type == BRCMF_USB_CBCTL_READ) {
 232                 if (status == 0)
 233                         devinfo->bus_pub.stats.rx_ctlpkts++;
 234                 else
 235                         devinfo->bus_pub.stats.rx_ctlerrs++;
 236         } else if (type == BRCMF_USB_CBCTL_WRITE) {
 237                 if (status == 0)
 238                         devinfo->bus_pub.stats.tx_ctlpkts++;
 239                 else
 240                         devinfo->bus_pub.stats.tx_ctlerrs++;
 241         }
 242
 243         devinfo->ctl_urb_status = status;
 244         devinfo->ctl_completed = true;
 245         brcmf_usb_ioctl_resp_wake(devinfo);
 246 }
 247
 248 static void
 249 brcmf_usb_ctlread_complete(struct urb *urb)
 250 {
 251         struct brcmf_usbdev_info *devinfo =
 252                 (struct brcmf_usbdev_info *)urb->context;
 253
 254         devinfo->ctl_urb_actual_length = urb->actual_length;
 255         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_READ,
 256                 urb->status);
 257 }
 258
 259 static void
 260 brcmf_usb_ctlwrite_complete(struct urb *urb)
 261 {
 262         struct brcmf_usbdev_info *devinfo =
 263                 (struct brcmf_usbdev_info *)urb->context;
 264
 265         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_WRITE,
 266                 urb->status);
 267 }
 268
 269 static int brcmf_usb_pnp(struct brcmf_usbdev_info *devinfo, uint state)
 270 {
 271         return 0;
 272 }
 273
 274 static int
 275 brcmf_usb_send_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 276 {
 277         int ret;
 278         u16 size;
 279
 280         if (devinfo == NULL || buf == NULL ||
 281             len == 0 || devinfo->ctl_urb == NULL)
 282                 return -EINVAL;
 283
 284         /* If the USB/HSIC bus in sleep state, wake it up */
 285         if (devinfo->suspend_state == USBOS_SUSPEND_STATE_SUSPENDED)
 286                 if (brcmf_usb_pnp(devinfo, BCMFMAC_USB_PNP_RESUME) != 0) {
 287                         brcmf_dbg(ERROR, "Could not Resume the bus!\n");
 288                         return -EIO;
 289                 }
 290
 291         devinfo->activity = true;
 292         size = len;
 293         devinfo->ctl_write.wLength = cpu_to_le16p(&size);
 294         devinfo->ctl_urb->transfer_buffer_length = size;
 295         devinfo->ctl_urb_status = 0;
 296         devinfo->ctl_urb_actual_length = 0;
 297
 298         usb_fill_control_urb(devinfo->ctl_urb,
 299                 devinfo->usbdev,
 300                 devinfo->ctl_out_pipe,
 301                 (unsigned char *) &devinfo->ctl_write,
 302                 buf, size,
 303                 (usb_complete_t)brcmf_usb_ctlwrite_complete,
 304                 devinfo);
 305
 306         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 307         if (ret < 0)
 308                 brcmf_dbg(ERROR, "usb_submit_urb failed %d\n", ret);
 309
 310         return ret;
 311 }
 312
 313 static int
 314 brcmf_usb_recv_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 315 {
 316         int ret;
 317         u16 size;
 318
 319         if ((devinfo == NULL) || (buf == NULL) || (len == 0)
 320                 || (devinfo->ctl_urb == NULL))
 321                 return -EINVAL;
 322
 323         size = len;
 324         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 325         devinfo->ctl_urb->transfer_buffer_length = size;
 326
 327         if (devinfo->rxctl_deferrespok) {
 328                 /* BMAC model */
 329                 devinfo->ctl_read.bRequestType = USB_DIR_IN
 330                         | USB_TYPE_VENDOR | USB_RECIP_INTERFACE;
 331                 devinfo->ctl_read.bRequest = DL_DEFER_RESP_OK;
 332         } else {
 333                 /* full dongle model */
 334                 devinfo->ctl_read.bRequestType = USB_DIR_IN
 335                         | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 336                 devinfo->ctl_read.bRequest = 1;
 337         }
 338
 339         usb_fill_control_urb(devinfo->ctl_urb,
 340                 devinfo->usbdev,
 341                 devinfo->ctl_in_pipe,
 342                 (unsigned char *) &devinfo->ctl_read,
 343                 buf, size,
 344                 (usb_complete_t)brcmf_usb_ctlread_complete,
 345                 devinfo);
 346
 347         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 348         if (ret < 0)
 349                 brcmf_dbg(ERROR, "usb_submit_urb failed %d\n", ret);
 350
 351         return ret;
 352 }
 353
 354 static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 355 {
 356         int err = 0;
 357         int timeout = 0;
 358         bool pending;
 359         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 360
 361         if (devinfo->bus_pub.state != BCMFMAC_USB_STATE_UP) {
 362                 /* TODO: handle suspend/resume */
 363                 return -EIO;
 364         }
 365
 366         if (test_and_set_bit(0, &devinfo->ctl_op))
 367                 return -EIO;
 368
 369         err = brcmf_usb_send_ctl(devinfo, buf, len);
 370         if (err) {
 371                 brcmf_dbg(ERROR, "fail %d bytes: %d\n", err, len);
 372                 return err;
 373         }
 374
 375         devinfo->ctl_completed = false;
 376         timeout = brcmf_usb_ioctl_resp_wait(devinfo, &devinfo->ctl_completed,
 377                                             &pending);
 378         clear_bit(0, &devinfo->ctl_op);
 379         if (!timeout) {
 380                 brcmf_dbg(ERROR, "Txctl wait timed out\n");
 381                 err = -EIO;
 382         }
 383         return err;
 384 }
 385
 386 static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 387 {
 388         int err = 0;
 389         int timeout = 0;
 390         bool pending;
 391         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 392
 393         if (devinfo->bus_pub.state != BCMFMAC_USB_STATE_UP) {
 394                 /* TODO: handle suspend/resume */
 395                 return -EIO;
 396         }
 397         if (test_and_set_bit(0, &devinfo->ctl_op))
 398                 return -EIO;
 399
 400         err = brcmf_usb_recv_ctl(devinfo, buf, len);
 401         if (err) {
 402                 brcmf_dbg(ERROR, "fail %d bytes: %d\n", err, len);
 403                 return err;
 404         }
 405         devinfo->ctl_completed = false;
 406         timeout = brcmf_usb_ioctl_resp_wait(devinfo, &devinfo->ctl_completed,
 407                                             &pending);
 408         err = devinfo->ctl_urb_status;
 409         clear_bit(0, &devinfo->ctl_op);
 410         if (!timeout) {
 411                 brcmf_dbg(ERROR, "rxctl wait timed out\n");
 412                 err = -EIO;
 413         }
 414         if (!err)
 415                 return devinfo->ctl_urb_actual_length;
 416         else
 417                 return err;
 418 }
 419
 420 static struct brcmf_usbreq *brcmf_usb_deq(struct brcmf_usbdev_info *devinfo,
 421                                           struct list_head *q)
 422 {
 423         unsigned long flags;
 424         struct brcmf_usbreq  *req;
 425         spin_lock_irqsave(&devinfo->qlock, flags);
 426         if (list_empty(q)) {
 427                 spin_unlock_irqrestore(&devinfo->qlock, flags);
 428                 return NULL;
 429         }
 430         req = list_entry(q->next, struct brcmf_usbreq, list);
 431         list_del_init(q->next);
 432         spin_unlock_irqrestore(&devinfo->qlock, flags);
 433         return req;
 434
 435 }
 436
 437 static void brcmf_usb_enq(struct brcmf_usbdev_info *devinfo,
 438                           struct list_head *q, struct brcmf_usbreq *req)
 439 {
 440         unsigned long flags;
 441         spin_lock_irqsave(&devinfo->qlock, flags);
 442         list_add_tail(&req->list, q);
 443         spin_unlock_irqrestore(&devinfo->qlock, flags);
 444 }
 445
 446 static struct brcmf_usbreq *
 447 brcmf_usbdev_qinit(struct list_head *q, int qsize)
 448 {
 449         int i;
 450         struct brcmf_usbreq *req, *reqs;
 451
 452         reqs = kzalloc(sizeof(struct brcmf_usbreq) * qsize, GFP_ATOMIC);
 453         if (reqs == NULL) {
 454                 brcmf_dbg(ERROR, "fail to allocate memory!\n");
 455                 return NULL;
 456         }
 457         req = reqs;
 458
 459         for (i = 0; i < qsize; i++) {
 460                 req->urb = usb_alloc_urb(0, GFP_ATOMIC);
 461                 if (!req->urb)
 462                         goto fail;
 463
 464                 INIT_LIST_HEAD(&req->list);
 465                 list_add_tail(&req->list, q);
 466                 req++;
 467         }
 468         return reqs;
 469 fail:
 470         brcmf_dbg(ERROR, "fail!\n");
 471         while (!list_empty(q)) {
 472                 req = list_entry(q->next, struct brcmf_usbreq, list);
 473                 if (req && req->urb)
 474                         usb_free_urb(req->urb);
 475                 list_del(q->next);
 476         }
 477         return NULL;
 478
 479 }
 480
 481 static void brcmf_usb_free_q(struct list_head *q, bool pending)
 482 {
 483         struct brcmf_usbreq *req, *next;
 484         int i = 0;
 485         list_for_each_entry_safe(req, next, q, list) {
 486                 if (!req->urb) {
 487                         brcmf_dbg(ERROR, "bad req\n");
 488                         break;
 489                 }
 490                 i++;
 491                 if (pending) {
 492                         usb_kill_urb(req->urb);
 493                 } else {
 494                         usb_free_urb(req->urb);
 495                         list_del_init(&req->list);
 496                 }
 497         }
 498 }
 499
 500 static void brcmf_usb_del_fromq(struct brcmf_usbdev_info *devinfo,
 501                                 struct brcmf_usbreq *req)
 502 {
 503         unsigned long flags;
 504
 505         spin_lock_irqsave(&devinfo->qlock, flags);
 506         list_del_init(&req->list);
 507         spin_unlock_irqrestore(&devinfo->qlock, flags);
 508 }
 509
 510
 511 static void brcmf_usb_tx_complete(struct urb *urb)
 512 {
 513         struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
 514         struct brcmf_usbdev_info *devinfo = req->devinfo;
 515
 516         brcmf_usb_del_fromq(devinfo, req);
 517         if (urb->status == 0)
 518                 devinfo->bus_pub.bus->dstats.tx_packets++;
 519         else
 520                 devinfo->bus_pub.bus->dstats.tx_errors++;
 521
 522         dev_kfree_skb(req->skb);
 523         req->skb = NULL;
 524         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
 525
 526 }
 527
 528 static void brcmf_usb_rx_complete(struct urb *urb)
 529 {
 530         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
 531         struct brcmf_usbdev_info *devinfo = req->devinfo;
 532         struct sk_buff *skb;
 533         int ifidx = 0;
 534
 535         brcmf_usb_del_fromq(devinfo, req);
 536         skb = req->skb;
 537         req->skb = NULL;
 538
 539         if (urb->status == 0) {
 540                 devinfo->bus_pub.bus->dstats.rx_packets++;
 541         } else {
 542                 devinfo->bus_pub.bus->dstats.rx_errors++;
 543                 dev_kfree_skb(skb);
 544                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
 545                 return;
 546         }
 547
 548         if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_UP) {
 549                 skb_put(skb, urb->actual_length);
 550                 if (brcmf_proto_hdrpull(devinfo->dev, &ifidx, skb) != 0) {
 551                         brcmf_dbg(ERROR, "rx protocol error\n");
 552                         brcmu_pkt_buf_free_skb(skb);
 553                         devinfo->bus_pub.bus->dstats.rx_errors++;
 554                 } else {
 555                         brcmf_rx_packet(devinfo->dev, ifidx, skb);
 556                         brcmf_usb_rx_refill(devinfo, req);
 557                 }
 558         } else {
 559                 dev_kfree_skb(skb);
 560         }
 561         return;
 562
 563 }
 564
 565 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 566                                 struct brcmf_usbreq  *req)
 567 {
 568         struct sk_buff *skb;
 569         int ret;
 570
 571         if (!req || !devinfo)
 572                 return;
 573
 574         skb = dev_alloc_skb(devinfo->bus_pub.bus_mtu);
 575         if (!skb) {
 576                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
 577                 return;
 578         }
 579         req->skb = skb;
 580
 581         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
 582                           skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
 583                           req);
 584         req->urb->transfer_flags |= URB_ZERO_PACKET;
 585         req->devinfo = devinfo;
 586
 587         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 588         if (ret == 0) {
 589                 brcmf_usb_enq(devinfo, &devinfo->rx_postq, req);
 590         } else {
 591                 dev_kfree_skb(req->skb);
 592                 req->skb = NULL;
 593                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
 594         }
 595         return;
 596 }
 597
 598 static void brcmf_usb_rx_fill_all(struct brcmf_usbdev_info *devinfo)
 599 {
 600         struct brcmf_usbreq *req;
 601
 602         if (devinfo->bus_pub.state != BCMFMAC_USB_STATE_UP) {
 603                 brcmf_dbg(ERROR, "bus is not up\n");
 604                 return;
 605         }
 606         while ((req = brcmf_usb_deq(devinfo, &devinfo->rx_freeq)) != NULL)
 607                 brcmf_usb_rx_refill(devinfo, req);
 608 }
 609
 610 static void
 611 brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
 612 {
 613         struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
 614         int old_state;
 615
 616
 617         if (devinfo->bus_pub.state == state)
 618                 return;
 619
 620         old_state = devinfo->bus_pub.state;
 621         brcmf_dbg(TRACE, "dbus state change from %d to to %d\n",
 622                   old_state, state);
 623
 624         /* Don't update state if it's PnP firmware re-download */
 625         if (state != BCMFMAC_USB_STATE_PNP_FWDL) /* TODO */
 626                 devinfo->bus_pub.state = state;
 627
 628         if ((old_state  == BCMFMAC_USB_STATE_SLEEP)
 629                 && (state == BCMFMAC_USB_STATE_UP)) {
 630                 brcmf_usb_rx_fill_all(devinfo);
 631         }
 632
 633         /* update state of upper layer */
 634         if (state == BCMFMAC_USB_STATE_DOWN) {
 635                 brcmf_dbg(INFO, "DBUS is down\n");
 636                 bcmf_bus->state = BRCMF_BUS_DOWN;
 637         } else {
 638                 brcmf_dbg(INFO, "DBUS current state=%d\n", state);
 639         }
 640 }
 641
 642 static void
 643 brcmf_usb_intr_complete(struct urb *urb)
 644 {
 645         struct brcmf_usbdev_info *devinfo =
 646                         (struct brcmf_usbdev_info *)urb->context;
 647         bool killed;
 648
 649         if (devinfo == NULL)
 650                 return;
 651
 652         if (unlikely(urb->status)) {
 653                 if (devinfo->suspend_state ==
 654                         USBOS_SUSPEND_STATE_SUSPEND_PENDING)
 655                         killed = true;
 656
 657                 if ((urb->status == -ENOENT && (!killed))
 658                         || urb->status == -ESHUTDOWN ||
 659                         urb->status == -ENODEV) {
 660                         brcmf_usb_state_change(devinfo, BCMFMAC_USB_STATE_DOWN);
 661                 }
 662         }
 663
 664         if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_DOWN) {
 665                 brcmf_dbg(ERROR, "intr cb when DBUS down, ignoring\n");
 666                 return;
 667         }
 668
 669         if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_UP)
 670                 usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 671 }
 672
 673 static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 674 {
 675         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 676         struct brcmf_usbreq  *req;
 677         int ret;
 678
 679         if (devinfo->bus_pub.state != BCMFMAC_USB_STATE_UP) {
 680                 /* TODO: handle suspend/resume */
 681                 return -EIO;
 682         }
 683
 684         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq);
 685         if (!req) {
 686                 brcmf_dbg(ERROR, "no req to send\n");
 687                 return -ENOMEM;
 688         }
 689         if (!req->urb) {
 690                 brcmf_dbg(ERROR, "no urb for req %p\n", req);
 691                 return -ENOBUFS;
 692         }
 693
 694         req->skb = skb;
 695         req->devinfo = devinfo;
 696         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
 697                           skb->data, skb->len, brcmf_usb_tx_complete, req);
 698         req->urb->transfer_flags |= URB_ZERO_PACKET;
 699         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 700         if (!ret) {
 701                 brcmf_usb_enq(devinfo, &devinfo->tx_postq, req);
 702         } else {
 703                 req->skb = NULL;
 704                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
 705         }
 706
 707         return ret;
 708 }
 709
 710
 711 static int brcmf_usb_up(struct device *dev)
 712 {
 713         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 714         u16 ifnum;
 715
 716         if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_UP)
 717                 return 0;
 718
 719         /* If the USB/HSIC bus in sleep state, wake it up */
 720         if (devinfo->suspend_state == USBOS_SUSPEND_STATE_SUSPENDED) {
 721                 if (brcmf_usb_pnp(devinfo, BCMFMAC_USB_PNP_RESUME) != 0) {
 722                         brcmf_dbg(ERROR, "Could not Resume the bus!\n");
 723                         return -EIO;
 724                 }
 725         }
 726         devinfo->activity = true;
 727
 728         /* Success, indicate devinfo is fully up */
 729         brcmf_usb_state_change(devinfo, BCMFMAC_USB_STATE_UP);
 730
 731         if (devinfo->intr_urb) {
 732                 int ret;
 733
 734                 usb_fill_int_urb(devinfo->intr_urb, devinfo->usbdev,
 735                         devinfo->intr_pipe,
 736                         &devinfo->intr,
 737                         devinfo->intr_size,
 738                         (usb_complete_t)brcmf_usb_intr_complete,
 739                         devinfo,
 740                         devinfo->interval);
 741
 742                 ret = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 743                 if (ret) {
 744                         brcmf_dbg(ERROR, "USB_SUBMIT_URB failed with status %d\n",
 745                                   ret);
 746                         return -EINVAL;
 747                 }
 748         }
 749
 750         if (devinfo->ctl_urb) {
 751                 devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
 752                 devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
 753
 754                 ifnum = IFDESC(devinfo->usbdev, CONTROL_IF).bInterfaceNumber;
 755
 756                 /* CTL Write */
 757                 devinfo->ctl_write.bRequestType =
 758                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 759                 devinfo->ctl_write.bRequest = 0;
 760                 devinfo->ctl_write.wValue = cpu_to_le16(0);
 761                 devinfo->ctl_write.wIndex = cpu_to_le16p(&ifnum);
 762
 763                 /* CTL Read */
 764                 devinfo->ctl_read.bRequestType =
 765                         USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 766                 devinfo->ctl_read.bRequest = 1;
 767                 devinfo->ctl_read.wValue = cpu_to_le16(0);
 768                 devinfo->ctl_read.wIndex = cpu_to_le16p(&ifnum);
 769         }
 770         brcmf_usb_rx_fill_all(devinfo);
 771         return 0;
 772 }
 773
 774 static void brcmf_usb_down(struct device *dev)
 775 {
 776         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 777
 778         if (devinfo == NULL)
 779                 return;
 780
 781         brcmf_dbg(TRACE, "enter\n");
 782         if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_DOWN)
 783                 return;
 784
 785         brcmf_usb_state_change(devinfo, BCMFMAC_USB_STATE_DOWN);
 786         if (devinfo->intr_urb)
 787                 usb_kill_urb(devinfo->intr_urb);
 788
 789         if (devinfo->ctl_urb)
 790                 usb_kill_urb(devinfo->ctl_urb);
 791
 792         if (devinfo->bulk_urb)
 793                 usb_kill_urb(devinfo->bulk_urb);
 794         brcmf_usb_free_q(&devinfo->tx_postq, true);
 795
 796         brcmf_usb_free_q(&devinfo->rx_postq, true);
 797 }
 798
 799 static int
 800 brcmf_usb_sync_wait(struct brcmf_usbdev_info *devinfo, u16 time)
 801 {
 802         int ret;
 803         int err = 0;
 804         int ms = time;
 805
 806         ret = wait_event_interruptible_timeout(devinfo->wait,
 807                 devinfo->waitdone == true, (ms * HZ / 1000));
 808
 809         if ((devinfo->waitdone == false) || (devinfo->sync_urb_status)) {
 810                 brcmf_dbg(ERROR, "timeout(%d) or urb err=%d\n",
 811                           ret, devinfo->sync_urb_status);
 812                 err = -EINVAL;
 813         }
 814         devinfo->waitdone = false;
 815         return err;
 816 }
 817
 818 static void
 819 brcmf_usb_sync_complete(struct urb *urb)
 820 {
 821         struct brcmf_usbdev_info *devinfo =
 822                         (struct brcmf_usbdev_info *)urb->context;
 823
 824         devinfo->waitdone = true;
 825         wake_up_interruptible(&devinfo->wait);
 826         devinfo->sync_urb_status = urb->status;
 827 }
 828
 829 static bool brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
 830                              void *buffer, int buflen)
 831 {
 832         int ret = 0;
 833         char *tmpbuf;
 834         u16 size;
 835
 836         if ((!devinfo) || (devinfo->ctl_urb == NULL))
 837                 return false;
 838
 839         tmpbuf = kmalloc(buflen, GFP_ATOMIC);
 840         if (!tmpbuf)
 841                 return false;
 842
 843         size = buflen;
 844         devinfo->ctl_urb->transfer_buffer_length = size;
 845
 846         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 847         devinfo->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
 848                 USB_RECIP_INTERFACE;
 849         devinfo->ctl_read.bRequest = cmd;
 850
 851         usb_fill_control_urb(devinfo->ctl_urb,
 852                 devinfo->usbdev,
 853                 usb_rcvctrlpipe(devinfo->usbdev, 0),
 854                 (unsigned char *) &devinfo->ctl_read,
 855                 (void *) tmpbuf, size,
 856                 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 857
 858         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 859         if (ret < 0) {
 860                 brcmf_dbg(ERROR, "usb_submit_urb failed %d\n", ret);
 861                 kfree(tmpbuf);
 862                 return false;
 863         }
 864
 865         ret = brcmf_usb_sync_wait(devinfo, BRCMF_USB_SYNC_TIMEOUT);
 866         memcpy(buffer, tmpbuf, buflen);
 867         kfree(tmpbuf);
 868
 869         return (ret == 0);
 870 }
 871
 872 static bool
 873 brcmf_usb_dlneeded(struct brcmf_usbdev_info *devinfo)
 874 {
 875         struct bootrom_id_le id;
 876         u32 chipid, chiprev;
 877
 878         brcmf_dbg(TRACE, "enter\n");
 879
 880         if (devinfo == NULL)
 881                 return false;
 882
 883         /* Check if firmware downloaded already by querying runtime ID */
 884         id.chip = cpu_to_le32(0xDEAD);
 885         brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id,
 886                 sizeof(struct bootrom_id_le));
 887
 888         chipid = le32_to_cpu(id.chip);
 889         chiprev = le32_to_cpu(id.chiprev);
 890
 891         if ((chipid & 0x4300) == 0x4300)
 892                 brcmf_dbg(INFO, "chip %x rev 0x%x\n", chipid, chiprev);
 893         else
 894                 brcmf_dbg(INFO, "chip %d rev 0x%x\n", chipid, chiprev);
 895         if (chipid == BRCMF_POSTBOOT_ID) {
 896                 brcmf_dbg(INFO, "firmware already downloaded\n");
 897                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id,
 898                         sizeof(struct bootrom_id_le));
 899                 return false;
 900         } else {
 901                 devinfo->bus_pub.devid = chipid;
 902                 devinfo->bus_pub.chiprev = chiprev;
 903         }
 904         return true;
 905 }
 906
 907 static int
 908 brcmf_usb_resetcfg(struct brcmf_usbdev_info *devinfo)
 909 {
 910         struct bootrom_id_le id;
 911         u16 wait = 0, wait_time;
 912
 913         brcmf_dbg(TRACE, "enter\n");
 914
 915         if (devinfo == NULL)
 916                 return -EINVAL;
 917
 918         /* Give dongle chance to boot */
 919         wait_time = BRCMF_USB_DLIMAGE_SPINWAIT;
 920         while (wait < BRCMF_USB_DLIMAGE_LIMIT) {
 921                 mdelay(wait_time);
 922                 wait += wait_time;
 923                 id.chip = cpu_to_le32(0xDEAD);       /* Get the ID */
 924                 brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id,
 925                         sizeof(struct bootrom_id_le));
 926                 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID))
 927                         break;
 928         }
 929
 930         if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID)) {
 931                 brcmf_dbg(INFO, "download done %d ms postboot chip 0x%x/rev 0x%x\n",
 932                           wait, le32_to_cpu(id.chip), le32_to_cpu(id.chiprev));
 933
 934                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id,
 935                         sizeof(struct bootrom_id_le));
 936
 937                 /* XXX this wait may not be necessary */
 938                 mdelay(BRCMF_USB_RESETCFG_SPINWAIT);
 939                 return 0;
 940         } else {
 941                 brcmf_dbg(ERROR, "Cannot talk to Dongle. Firmware is not UP, %d ms\n",
 942                           wait);
 943                 return -EINVAL;
 944         }
 945 }
 946
 947
 948 static int
 949 brcmf_usb_dl_send_bulk(struct brcmf_usbdev_info *devinfo, void *buffer, int len)
 950 {
 951         int ret;
 952
 953         if ((devinfo == NULL) || (devinfo->bulk_urb == NULL))
 954                 return -EINVAL;
 955
 956         /* Prepare the URB */
 957         usb_fill_bulk_urb(devinfo->bulk_urb, devinfo->usbdev,
 958                           devinfo->tx_pipe, buffer, len,
 959                           (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 960
 961         devinfo->bulk_urb->transfer_flags |= URB_ZERO_PACKET;
 962
 963         ret = usb_submit_urb(devinfo->bulk_urb, GFP_ATOMIC);
 964         if (ret) {
 965                 brcmf_dbg(ERROR, "usb_submit_urb failed %d\n", ret);
 966                 return ret;
 967         }
 968         ret = brcmf_usb_sync_wait(devinfo, BRCMF_USB_SYNC_TIMEOUT);
 969         return ret;
 970 }
 971
 972 static int
 973 brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
 974 {
 975         unsigned int sendlen, sent, dllen;
 976         char *bulkchunk = NULL, *dlpos;
 977         struct rdl_state_le state;
 978         u32 rdlstate, rdlbytes;
 979         int err = 0;
 980         brcmf_dbg(TRACE, "fw %p, len %d\n", fw, fwlen);
 981
 982         bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
 983         if (bulkchunk == NULL) {
 984                 err = -ENOMEM;
 985                 goto fail;
 986         }
 987
 988         /* 1) Prepare USB boot loader for runtime image */
 989         brcmf_usb_dl_cmd(devinfo, DL_START, &state,
 990                          sizeof(struct rdl_state_le));
 991
 992         rdlstate = le32_to_cpu(state.state);
 993         rdlbytes = le32_to_cpu(state.bytes);
 994
 995         /* 2) Check we are in the Waiting state */
 996         if (rdlstate != DL_WAITING) {
 997                 brcmf_dbg(ERROR, "Failed to DL_START\n");
 998                 err = -EINVAL;
 999                 goto fail;
1000         }
1001         sent = 0;
1002         dlpos = fw;
1003         dllen = fwlen;
1004
1005         /* Get chip id and rev */
1006         while (rdlbytes != dllen) {
1007                 /* Wait until the usb device reports it received all
1008                  * the bytes we sent */
1009                 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
1010                         if ((dllen-sent) < RDL_CHUNK)
1011                                 sendlen = dllen-sent;
1012                         else
1013                                 sendlen = RDL_CHUNK;
1014
1015                         /* simply avoid having to send a ZLP by ensuring we
1016                          * never have an even
1017                          * multiple of 64
1018                          */
1019                         if (!(sendlen % 64))
1020                                 sendlen -= 4;
1021
1022                         /* send data */
1023                         memcpy(bulkchunk, dlpos, sendlen);
1024                         if (brcmf_usb_dl_send_bulk(devinfo, bulkchunk,
1025                                                    sendlen)) {
1026                                 brcmf_dbg(ERROR, "send_bulk failed\n");
1027                                 err = -EINVAL;
1028                                 goto fail;
1029                         }
1030
1031                         dlpos += sendlen;
1032                         sent += sendlen;
1033                 }
1034                 if (!brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
1035                                       sizeof(struct rdl_state_le))) {
1036                         brcmf_dbg(ERROR, "DL_GETSTATE Failed xxxx\n");
1037                         err = -EINVAL;
1038                         goto fail;
1039                 }
1040
1041                 rdlstate = le32_to_cpu(state.state);
1042                 rdlbytes = le32_to_cpu(state.bytes);
1043
1044                 /* restart if an error is reported */
1045                 if (rdlstate == DL_BAD_HDR || rdlstate == DL_BAD_CRC) {
1046                         brcmf_dbg(ERROR, "Bad Hdr or Bad CRC state %d\n",
1047                                   rdlstate);
1048                         err = -EINVAL;
1049                         goto fail;
1050                 }
1051         }
1052
1053 fail:
1054         kfree(bulkchunk);
1055         brcmf_dbg(TRACE, "err=%d\n", err);
1056         return err;
1057 }
1058
1059 static int brcmf_usb_dlstart(struct brcmf_usbdev_info *devinfo, u8 *fw, int len)
1060 {
1061         int err;
1062
1063         brcmf_dbg(TRACE, "enter\n");
1064
1065         if (devinfo == NULL)
1066                 return -EINVAL;
1067
1068         if (devinfo->bus_pub.devid == 0xDEAD)
1069                 return -EINVAL;
1070
1071         err = brcmf_usb_dl_writeimage(devinfo, fw, len);
1072         if (err == 0)
1073                 devinfo->bus_pub.state = BCMFMAC_USB_STATE_DL_DONE;
1074         else
1075                 devinfo->bus_pub.state = BCMFMAC_USB_STATE_DL_PENDING;
1076         brcmf_dbg(TRACE, "exit: err=%d\n", err);
1077
1078         return err;
1079 }
1080
1081 static int brcmf_usb_dlrun(struct brcmf_usbdev_info *devinfo)
1082 {
1083         struct rdl_state_le state;
1084
1085         brcmf_dbg(TRACE, "enter\n");
1086         if (!devinfo)
1087                 return -EINVAL;
1088
1089         if (devinfo->bus_pub.devid == 0xDEAD)
1090                 return -EINVAL;
1091
1092         /* Check we are runnable */
1093         brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
1094                 sizeof(struct rdl_state_le));
1095
1096         /* Start the image */
1097         if (state.state == cpu_to_le32(DL_RUNNABLE)) {
1098                 if (!brcmf_usb_dl_cmd(devinfo, DL_GO, &state,
1099                         sizeof(struct rdl_state_le)))
1100                         return -ENODEV;
1101                 if (brcmf_usb_resetcfg(devinfo))
1102                         return -ENODEV;
1103                 /* The Dongle may go for re-enumeration. */
1104         } else {
1105                 brcmf_dbg(ERROR, "Dongle not runnable\n");
1106                 return -EINVAL;
1107         }
1108         brcmf_dbg(TRACE, "exit\n");
1109         return 0;
1110 }
1111
1112 static bool brcmf_usb_chip_support(int chipid, int chiprev)
1113 {
1114         switch(chipid) {
1115         case 43235:
1116         case 43236:
1117         case 43238:
1118                 return (chiprev == 3);
1119         default:
1120                 break;
1121         }
1122         return false;
1123 }
1124
1125 static int
1126 brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
1127 {
1128         int devid, chiprev;
1129         int err;
1130
1131         brcmf_dbg(TRACE, "enter\n");
1132         if (devinfo == NULL)
1133                 return -ENODEV;
1134
1135         devid = devinfo->bus_pub.devid;
1136         chiprev = devinfo->bus_pub.chiprev;
1137
1138         if (!brcmf_usb_chip_support(devid, chiprev)) {
1139                 brcmf_dbg(ERROR, "unsupported chip %d rev %d\n",
1140                           devid, chiprev);
1141                 return -EINVAL;
1142         }
1143
1144         if (!devinfo->image) {
1145                 brcmf_dbg(ERROR, "No firmware!\n");
1146                 return -ENOENT;
1147         }
1148
1149         err = brcmf_usb_dlstart(devinfo,
1150                 devinfo->image, devinfo->image_len);
1151         if (err == 0)
1152                 err = brcmf_usb_dlrun(devinfo);
1153         return err;
1154 }
1155
1156
1157 static void brcmf_usb_detach(const struct brcmf_usbdev *bus_pub)
1158 {
1159         struct brcmf_usbdev_info *devinfo =
1160                 (struct brcmf_usbdev_info *)bus_pub;
1161
1162         brcmf_dbg(TRACE, "devinfo %p\n", devinfo);
1163
1164         /* store the image globally */
1165         g_image.data = devinfo->image;
1166         g_image.len = devinfo->image_len;
1167
1168         /* free the URBS */
1169         brcmf_usb_free_q(&devinfo->rx_freeq, false);
1170         brcmf_usb_free_q(&devinfo->tx_freeq, false);
1171
1172         usb_free_urb(devinfo->intr_urb);
1173         usb_free_urb(devinfo->ctl_urb);
1174         usb_free_urb(devinfo->bulk_urb);
1175
1176         kfree(devinfo->tx_reqs);
1177         kfree(devinfo->rx_reqs);
1178         kfree(devinfo);
1179 }
1180
1181 #define TRX_MAGIC       0x30524448      /* "HDR0" */
1182 #define TRX_VERSION     1               /* Version 1 */
1183 #define TRX_MAX_LEN     0x3B0000        /* Max length */
1184 #define TRX_NO_HEADER   1               /* Do not write TRX header */
1185 #define TRX_MAX_OFFSET  3               /* Max number of individual files */
1186 #define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed image */
1187
1188 struct trx_header_le {
1189         __le32 magic;           /* "HDR0" */
1190         __le32 len;             /* Length of file including header */
1191         __le32 crc32;           /* CRC from flag_version to end of file */
1192         __le32 flag_version;    /* 0:15 flags, 16:31 version */
1193         __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
1194                                          * header */
1195 };
1196
1197 static int check_file(const u8 *headers)
1198 {
1199         struct trx_header_le *trx;
1200         int actual_len = -1;
1201
1202         /* Extract trx header */
1203         trx = (struct trx_header_le *) headers;
1204         if (trx->magic != cpu_to_le32(TRX_MAGIC))
1205                 return -1;
1206
1207         headers += sizeof(struct trx_header_le);
1208
1209         if (le32_to_cpu(trx->flag_version) & TRX_UNCOMP_IMAGE) {
1210                 actual_len = le32_to_cpu(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]);
1211                 return actual_len + sizeof(struct trx_header_le);
1212         }
1213         return -1;
1214 }
1215
1216 static int brcmf_usb_get_fw(struct brcmf_usbdev_info *devinfo)
1217 {
1218         s8 *fwname;
1219         const struct firmware *fw;
1220         int err;
1221
1222         devinfo->image = g_image.data;
1223         devinfo->image_len = g_image.len;
1224
1225         /*
1226          * if we have an image we can leave here.
1227          */
1228         if (devinfo->image)
1229                 return 0;
1230
1231         fwname = BRCMF_USB_43236_FW_NAME;
1232
1233         err = request_firmware(&fw, fwname, devinfo->dev);
1234         if (!fw) {
1235                 brcmf_dbg(ERROR, "fail to request firmware %s\n", fwname);
1236                 return err;
1237         }
1238         if (check_file(fw->data) < 0) {
1239                 brcmf_dbg(ERROR, "invalid firmware %s\n", fwname);
1240                 return -EINVAL;
1241         }
1242
1243         devinfo->image = vmalloc(fw->size); /* plus nvram */
1244         if (!devinfo->image)
1245                 return -ENOMEM;
1246
1247         memcpy(devinfo->image, fw->data, fw->size);
1248         devinfo->image_len = fw->size;
1249
1250         release_firmware(fw);
1251         return 0;
1252 }
1253
1254
1255 static
1256 struct brcmf_usbdev *brcmf_usb_attach(int nrxq, int ntxq, struct device *dev)
1257 {
1258         struct brcmf_usbdev_info *devinfo;
1259
1260         devinfo = kzalloc(sizeof(struct brcmf_usbdev_info), GFP_ATOMIC);
1261         if (devinfo == NULL)
1262                 return NULL;
1263
1264         devinfo->bus_pub.nrxq = nrxq;
1265         devinfo->rx_low_watermark = nrxq / 2;
1266         devinfo->bus_pub.devinfo = devinfo;
1267         devinfo->bus_pub.ntxq = ntxq;
1268
1269         /* flow control when too many tx urbs posted */
1270         devinfo->tx_low_watermark = ntxq / 4;
1271         devinfo->tx_high_watermark = devinfo->tx_low_watermark * 3;
1272         devinfo->dev = dev;
1273         devinfo->usbdev = usbdev_probe_info.usb;
1274         devinfo->tx_pipe = usbdev_probe_info.tx_pipe;
1275         devinfo->rx_pipe = usbdev_probe_info.rx_pipe;
1276         devinfo->rx_pipe2 = usbdev_probe_info.rx_pipe2;
1277         devinfo->intr_pipe = usbdev_probe_info.intr_pipe;
1278
1279         devinfo->interval = usbdev_probe_info.interval;
1280         devinfo->intr_size = usbdev_probe_info.intr_size;
1281
1282         memcpy(&devinfo->probe_info, &usbdev_probe_info,
1283                 sizeof(struct brcmf_usb_probe_info));
1284         devinfo->bus_pub.bus_mtu = BRCMF_USB_MAX_PKT_SIZE;
1285
1286         /* Initialize other structure content */
1287         init_waitqueue_head(&devinfo->ioctl_resp_wait);
1288
1289         /* Initialize the spinlocks */
1290         spin_lock_init(&devinfo->qlock);
1291
1292         INIT_LIST_HEAD(&devinfo->rx_freeq);
1293         INIT_LIST_HEAD(&devinfo->rx_postq);
1294
1295         INIT_LIST_HEAD(&devinfo->tx_freeq);
1296         INIT_LIST_HEAD(&devinfo->tx_postq);
1297
1298         devinfo->rx_reqs = brcmf_usbdev_qinit(&devinfo->rx_freeq, nrxq);
1299         if (!devinfo->rx_reqs)
1300                 goto error;
1301
1302         devinfo->tx_reqs = brcmf_usbdev_qinit(&devinfo->tx_freeq, ntxq);
1303         if (!devinfo->tx_reqs)
1304                 goto error;
1305
1306         devinfo->intr_urb = usb_alloc_urb(0, GFP_ATOMIC);
1307         if (!devinfo->intr_urb) {
1308                 brcmf_dbg(ERROR, "usb_alloc_urb (intr) failed\n");
1309                 goto error;
1310         }
1311         devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
1312         if (!devinfo->ctl_urb) {
1313                 brcmf_dbg(ERROR, "usb_alloc_urb (ctl) failed\n");
1314                 goto error;
1315         }
1316         devinfo->rxctl_deferrespok = 0;
1317
1318         devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
1319         if (!devinfo->bulk_urb) {
1320                 brcmf_dbg(ERROR, "usb_alloc_urb (bulk) failed\n");
1321                 goto error;
1322         }
1323
1324         init_waitqueue_head(&devinfo->wait);
1325         if (!brcmf_usb_dlneeded(devinfo))
1326                 return &devinfo->bus_pub;
1327
1328         brcmf_dbg(TRACE, "start fw downloading\n");
1329         if (brcmf_usb_get_fw(devinfo))
1330                 goto error;
1331
1332         if (brcmf_usb_fw_download(devinfo))
1333                 goto error;
1334
1335         return &devinfo->bus_pub;
1336
1337 error:
1338         brcmf_dbg(ERROR, "failed!\n");
1339         brcmf_usb_detach(&devinfo->bus_pub);
1340         return NULL;
1341 }
1342
1343 static int brcmf_usb_probe_cb(struct device *dev, const char *desc,
1344                                 u32 bustype, u32 hdrlen)
1345 {
1346         struct brcmf_bus *bus = NULL;
1347         struct brcmf_usbdev *bus_pub = NULL;
1348         int ret;
1349
1350
1351         bus_pub = brcmf_usb_attach(BRCMF_USB_NRXQ, BRCMF_USB_NTXQ, dev);
1352         if (!bus_pub) {
1353                 ret = -ENODEV;
1354                 goto fail;
1355         }
1356
1357         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
1358         if (!bus) {
1359                 ret = -ENOMEM;
1360                 goto fail;
1361         }
1362
1363         bus_pub->bus = bus;
1364         bus->brcmf_bus_txdata = brcmf_usb_tx;
1365         bus->brcmf_bus_init = brcmf_usb_up;
1366         bus->brcmf_bus_stop = brcmf_usb_down;
1367         bus->brcmf_bus_txctl = brcmf_usb_tx_ctlpkt;
1368         bus->brcmf_bus_rxctl = brcmf_usb_rx_ctlpkt;
1369         bus->type = bustype;
1370         bus->bus_priv.usb = bus_pub;
1371         dev_set_drvdata(dev, bus);
1372
1373         /* Attach to the common driver interface */
1374         ret = brcmf_attach(hdrlen, dev);
1375         if (ret) {
1376                 brcmf_dbg(ERROR, "dhd_attach failed\n");
1377                 goto fail;
1378         }
1379
1380         ret = brcmf_bus_start(dev);
1381         if (ret == -ENOLINK) {
1382                 brcmf_dbg(ERROR, "dongle is not responding\n");
1383                 brcmf_detach(dev);
1384                 goto fail;
1385         }
1386
1387         return 0;
1388 fail:
1389         /* Release resources in reverse order */
1390         if (bus_pub)
1391                 brcmf_usb_detach(bus_pub);
1392         kfree(bus);
1393         return ret;
1394 }
1395
1396 static void
1397 brcmf_usb_disconnect_cb(struct brcmf_usbdev *bus_pub)
1398 {
1399         if (!bus_pub)
1400                 return;
1401         brcmf_dbg(TRACE, "enter: bus_pub %p\n", bus_pub);
1402
1403         brcmf_detach(bus_pub->devinfo->dev);
1404         kfree(bus_pub->bus);
1405         brcmf_usb_detach(bus_pub);
1406
1407 }
1408
1409 static int
1410 brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
1411 {
1412         int ep;
1413         struct usb_endpoint_descriptor *endpoint;
1414         int ret = 0;
1415         struct usb_device *usb = interface_to_usbdev(intf);
1416         int num_of_eps;
1417         u8 endpoint_num;
1418
1419         brcmf_dbg(TRACE, "enter\n");
1420
1421         usbdev_probe_info.usb = usb;
1422         usbdev_probe_info.intf = intf;
1423
1424         if (id != NULL) {
1425                 usbdev_probe_info.vid = id->idVendor;
1426                 usbdev_probe_info.pid = id->idProduct;
1427         }
1428
1429         usb_set_intfdata(intf, &usbdev_probe_info);
1430
1431         /* Check that the device supports only one configuration */
1432         if (usb->descriptor.bNumConfigurations != 1) {
1433                 ret = -1;
1434                 goto fail;
1435         }
1436
1437         if (usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
1438                 ret = -1;
1439                 goto fail;
1440         }
1441
1442         /*
1443          * Only the BDC interface configuration is supported:
1444          *      Device class: USB_CLASS_VENDOR_SPEC
1445          *      if0 class: USB_CLASS_VENDOR_SPEC
1446          *      if0/ep0: control
1447          *      if0/ep1: bulk in
1448          *      if0/ep2: bulk out (ok if swapped with bulk in)
1449          */
1450         if (CONFIGDESC(usb)->bNumInterfaces != 1) {
1451                 ret = -1;
1452                 goto fail;
1453         }
1454
1455         /* Check interface */
1456         if (IFDESC(usb, CONTROL_IF).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
1457             IFDESC(usb, CONTROL_IF).bInterfaceSubClass != 2 ||
1458             IFDESC(usb, CONTROL_IF).bInterfaceProtocol != 0xff) {
1459                 brcmf_dbg(ERROR, "invalid control interface: class %d, subclass %d, proto %d\n",
1460                           IFDESC(usb, CONTROL_IF).bInterfaceClass,
1461                           IFDESC(usb, CONTROL_IF).bInterfaceSubClass,
1462                           IFDESC(usb, CONTROL_IF).bInterfaceProtocol);
1463                 ret = -1;
1464                 goto fail;
1465         }
1466
1467         /* Check control endpoint */
1468         endpoint = &IFEPDESC(usb, CONTROL_IF, 0);
1469         if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
1470                 != USB_ENDPOINT_XFER_INT) {
1471                 brcmf_dbg(ERROR, "invalid control endpoint %d\n",
1472                           endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
1473                 ret = -1;
1474                 goto fail;
1475         }
1476
1477         endpoint_num = endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
1478         usbdev_probe_info.intr_pipe = usb_rcvintpipe(usb, endpoint_num);
1479
1480         usbdev_probe_info.rx_pipe = 0;
1481         usbdev_probe_info.rx_pipe2 = 0;
1482         usbdev_probe_info.tx_pipe = 0;
1483         num_of_eps = IFDESC(usb, BULK_IF).bNumEndpoints - 1;
1484
1485         /* Check data endpoints and get pipes */
1486         for (ep = 1; ep <= num_of_eps; ep++) {
1487                 endpoint = &IFEPDESC(usb, BULK_IF, ep);
1488                 if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
1489                     USB_ENDPOINT_XFER_BULK) {
1490                         brcmf_dbg(ERROR, "invalid data endpoint %d\n", ep);
1491                         ret = -1;
1492                         goto fail;
1493                 }
1494
1495                 endpoint_num = endpoint->bEndpointAddress &
1496                                USB_ENDPOINT_NUMBER_MASK;
1497                 if ((endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1498                         == USB_DIR_IN) {
1499                         if (!usbdev_probe_info.rx_pipe) {
1500                                 usbdev_probe_info.rx_pipe =
1501                                         usb_rcvbulkpipe(usb, endpoint_num);
1502                         } else {
1503                                 usbdev_probe_info.rx_pipe2 =
1504                                         usb_rcvbulkpipe(usb, endpoint_num);
1505                         }
1506                 } else {
1507                         usbdev_probe_info.tx_pipe =
1508                                         usb_sndbulkpipe(usb, endpoint_num);
1509                 }
1510         }
1511
1512         /* Allocate interrupt URB and data buffer */
1513         /* RNDIS says 8-byte intr, our old drivers used 4-byte */
1514         if (IFEPDESC(usb, CONTROL_IF, 0).wMaxPacketSize == cpu_to_le16(16))
1515                 usbdev_probe_info.intr_size = 8;
1516         else
1517                 usbdev_probe_info.intr_size = 4;
1518
1519         usbdev_probe_info.interval = IFEPDESC(usb, CONTROL_IF, 0).bInterval;
1520
1521         usbdev_probe_info.device_speed = usb->speed;
1522         if (usb->speed == USB_SPEED_HIGH)
1523                 brcmf_dbg(INFO, "Broadcom high speed USB wireless device detected\n");
1524         else
1525                 brcmf_dbg(INFO, "Broadcom full speed USB wireless device detected\n");
1526
1527         ret = brcmf_usb_probe_cb(&usb->dev, "", USB_BUS, 0);
1528         if (ret)
1529                 goto fail;
1530
1531         /* Success */
1532         return 0;
1533
1534 fail:
1535         brcmf_dbg(ERROR, "failed with errno %d\n", ret);
1536         usb_set_intfdata(intf, NULL);
1537         return ret;
1538
1539 }
1540
1541 static void
1542 brcmf_usb_disconnect(struct usb_interface *intf)
1543 {
1544         struct usb_device *usb = interface_to_usbdev(intf);
1545
1546         brcmf_dbg(TRACE, "enter\n");
1547         brcmf_usb_disconnect_cb(brcmf_usb_get_buspub(&usb->dev));
1548         usb_set_intfdata(intf, NULL);
1549 }
1550
1551 /*
1552  *      only need to signal the bus being down and update the suspend state.
1553  */
1554 static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
1555 {
1556         struct usb_device *usb = interface_to_usbdev(intf);
1557         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1558
1559         brcmf_dbg(TRACE, "enter\n");
1560         devinfo->bus_pub.state = BCMFMAC_USB_STATE_DOWN;
1561         devinfo->suspend_state = USBOS_SUSPEND_STATE_SUSPENDED;
1562         return 0;
1563 }
1564
1565 /*
1566  *      mark suspend state active and crank up the bus.
1567  */
1568 static int brcmf_usb_resume(struct usb_interface *intf)
1569 {
1570         struct usb_device *usb = interface_to_usbdev(intf);
1571         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1572
1573         brcmf_dbg(TRACE, "enter\n");
1574         devinfo->suspend_state = USBOS_SUSPEND_STATE_DEVICE_ACTIVE;
1575         brcmf_bus_start(&usb->dev);
1576         return 0;
1577 }
1578
1579 #define BRCMF_USB_VENDOR_ID_BROADCOM    0x0a5c
1580 #define BRCMF_USB_DEVICE_ID_43236       0xbd17
1581 #define BRCMF_USB_DEVICE_ID_BCMFW       0x0bdc
1582
1583 static struct usb_device_id brcmf_usb_devid_table[] = {
1584         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43236) },
1585         /* special entry for device with firmware loaded and running */
1586         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
1587         { }
1588 };
1589 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
1590 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
1591
1592 /* TODO: suspend and resume entries */
1593 static struct usb_driver brcmf_usbdrvr = {
1594         .name = KBUILD_MODNAME,
1595         .probe = brcmf_usb_probe,
1596         .disconnect = brcmf_usb_disconnect,
1597         .id_table = brcmf_usb_devid_table,
1598         .suspend = brcmf_usb_suspend,
1599         .resume = brcmf_usb_resume,
1600         .supports_autosuspend = 1,
1601         .disable_hub_initiated_lpm = 1,
1602 };
1603
1604 void brcmf_usb_exit(void)
1605 {
1606         usb_deregister(&brcmf_usbdrvr);
1607         vfree(g_image.data);
1608         g_image.data = NULL;
1609         g_image.len = 0;
1610 }
1611
1612 void brcmf_usb_init(void)
1613 {
1614         usb_register(&brcmf_usbdrvr);
1615 }