drivers/net/wireless/brcm80211/brcmfmac/usb.c

   1 /*
   2  * Copyright (c) 2011 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/init.h>
  18 #include <linux/kernel.h>
  19 #include <linux/module.h>
  20 #include <linux/kthread.h>
  21 #include <linux/slab.h>
  22 #include <linux/skbuff.h>
  23 #include <linux/netdevice.h>
  24 #include <linux/spinlock.h>
  25 #include <linux/ethtool.h>
  26 #include <linux/fcntl.h>
  27 #include <linux/fs.h>
  28 #include <linux/uaccess.h>
  29 #include <linux/firmware.h>
  30 #include <linux/usb.h>
  31 #include <net/cfg80211.h>
  32
  33 #include <defs.h>
  34 #include <brcmu_utils.h>
  35 #include <brcmu_wifi.h>
  36 #include <dhd_bus.h>
  37 #include <dhd_dbg.h>
  38
  39 #include "usb_rdl.h"
  40 #include "usb.h"
  41
  42 #define IOCTL_RESP_TIMEOUT  2000
  43
  44 #define BRCMF_USB_SYNC_TIMEOUT          300     /* ms */
  45 #define BRCMF_USB_DLIMAGE_SPINWAIT      100     /* in unit of ms */
  46 #define BRCMF_USB_DLIMAGE_LIMIT         500     /* spinwait limit (ms) */
  47
  48 #define BRCMF_POSTBOOT_ID               0xA123  /* ID to detect if dongle
  49                                                    has boot up */
  50 #define BRCMF_USB_RESETCFG_SPINWAIT     1       /* wait after resetcfg (ms) */
  51
  52 #define BRCMF_USB_NRXQ  50
  53 #define BRCMF_USB_NTXQ  50
  54
  55 #define CONFIGDESC(usb)         (&((usb)->actconfig)->desc)
  56 #define IFPTR(usb, idx)         ((usb)->actconfig->interface[(idx)])
  57 #define IFALTS(usb, idx)        (IFPTR((usb), (idx))->altsetting[0])
  58 #define IFDESC(usb, idx)        IFALTS((usb), (idx)).desc
  59 #define IFEPDESC(usb, idx, ep)  (IFALTS((usb), (idx)).endpoint[(ep)]).desc
  60
  61 #define CONTROL_IF              0
  62 #define BULK_IF                 0
  63
  64 #define BRCMF_USB_CBCTL_WRITE   0
  65 #define BRCMF_USB_CBCTL_READ    1
  66 #define BRCMF_USB_MAX_PKT_SIZE  1600
  67
  68 #define BRCMF_USB_43236_FW_NAME "brcm/brcmfmac43236b.bin"
  69
  70 enum usbdev_suspend_state {
  71         USBOS_SUSPEND_STATE_DEVICE_ACTIVE = 0, /* Device is busy, won't allow
  72                                                   suspend */
  73         USBOS_SUSPEND_STATE_SUSPEND_PENDING,    /* Device is idle, can be
  74                                                  * suspended. Wating PM to
  75                                                  * suspend the device
  76                                                  */
  77         USBOS_SUSPEND_STATE_SUSPENDED   /* Device suspended */
  78 };
  79
  80 struct brcmf_usb_probe_info {
  81         void *usbdev_info;
  82         struct usb_device *usb; /* USB device pointer from OS */
  83         uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
  84         int intr_size; /* Size of interrupt message */
  85         int interval;  /* Interrupt polling interval */
  86         int vid;
  87         int pid;
  88         enum usb_device_speed device_speed;
  89         enum usbdev_suspend_state suspend_state;
  90         struct usb_interface *intf;
  91 };
  92 static struct brcmf_usb_probe_info usbdev_probe_info;
  93
  94 struct brcmf_usb_image {
  95         void *data;
  96         u32 len;
  97 };
  98 static struct brcmf_usb_image g_image = { NULL, 0 };
  99
 100 struct intr_transfer_buf {
 101         u32 notification;
 102         u32 reserved;
 103 };
 104
 105 struct brcmf_usbdev_info {
 106         struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
 107         spinlock_t qlock;
 108         struct list_head rx_freeq;
 109         struct list_head rx_postq;
 110         struct list_head tx_freeq;
 111         struct list_head tx_postq;
 112         enum usbdev_suspend_state suspend_state;
 113         uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
 114
 115         bool activity;
 116         int rx_low_watermark;
 117         int tx_low_watermark;
 118         int tx_high_watermark;
 119         bool txoff;
 120         bool rxoff;
 121         bool txoverride;
 122
 123         struct brcmf_usbreq *tx_reqs;
 124         struct brcmf_usbreq *rx_reqs;
 125
 126         u8 *image;      /* buffer for combine fw and nvram */
 127         int image_len;
 128
 129         wait_queue_head_t wait;
 130         bool waitdone;
 131         int sync_urb_status;
 132
 133         struct usb_device *usbdev;
 134         struct device *dev;
 135         enum usb_device_speed  device_speed;
 136
 137         int ctl_in_pipe, ctl_out_pipe;
 138         struct urb *ctl_urb; /* URB for control endpoint */
 139         struct usb_ctrlrequest ctl_write;
 140         struct usb_ctrlrequest ctl_read;
 141         u32 ctl_urb_actual_length;
 142         int ctl_urb_status;
 143         int ctl_completed;
 144         wait_queue_head_t ioctl_resp_wait;
 145         wait_queue_head_t ctrl_wait;
 146         ulong ctl_op;
 147
 148         bool rxctl_deferrespok;
 149
 150         struct urb *bulk_urb; /* used for FW download */
 151         struct urb *intr_urb; /* URB for interrupt endpoint */
 152         int intr_size;          /* Size of interrupt message */
 153         int interval;           /* Interrupt polling interval */
 154         struct intr_transfer_buf intr; /* Data buffer for interrupt endpoint */
 155
 156         struct brcmf_usb_probe_info probe_info;
 157
 158 };
 159
 160 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 161                                 struct brcmf_usbreq  *req);
 162
 163 MODULE_AUTHOR("Broadcom Corporation");
 164 MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN fullmac usb driver.");
 165 MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN fullmac usb cards");
 166 MODULE_LICENSE("Dual BSD/GPL");
 167
 168 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
 169 {
 170         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
 171         return bus_if->bus_priv.usb;
 172 }
 173
 174 static struct brcmf_usbdev_info *brcmf_usb_get_businfo(struct device *dev)
 175 {
 176         return brcmf_usb_get_buspub(dev)->devinfo;
 177 }
 178
 179 #if 0
 180 static void
 181 brcmf_usb_txflowcontrol(struct brcmf_usbdev_info *devinfo, bool onoff)
 182 {
 183         dhd_txflowcontrol(devinfo->bus_pub.netdev, 0, onoff);
 184 }
 185 #endif
 186
 187 static int brcmf_usb_ioctl_resp_wait(struct brcmf_usbdev_info *devinfo,
 188          uint *condition, bool *pending)
 189 {
 190         DECLARE_WAITQUEUE(wait, current);
 191         int timeout = IOCTL_RESP_TIMEOUT;
 192
 193         /* Convert timeout in millsecond to jiffies */
 194         timeout = msecs_to_jiffies(timeout);
 195         /* Wait until control frame is available */
 196         add_wait_queue(&devinfo->ioctl_resp_wait, &wait);
 197         set_current_state(TASK_INTERRUPTIBLE);
 198
 199         smp_mb();
 200         while (!(*condition) && (!signal_pending(current) && timeout)) {
 201                 timeout = schedule_timeout(timeout);
 202                 /* Wait until control frame is available */
 203                 smp_mb();
 204         }
 205
 206         if (signal_pending(current))
 207                 *pending = true;
 208
 209         set_current_state(TASK_RUNNING);
 210         remove_wait_queue(&devinfo->ioctl_resp_wait, &wait);
 211
 212         return timeout;
 213 }
 214
 215 static int brcmf_usb_ioctl_resp_wake(struct brcmf_usbdev_info *devinfo)
 216 {
 217         if (waitqueue_active(&devinfo->ioctl_resp_wait))
 218                 wake_up_interruptible(&devinfo->ioctl_resp_wait);
 219
 220         return 0;
 221 }
 222
 223 static void
 224 brcmf_usb_ctl_complete(struct brcmf_usbdev_info *devinfo, int type, int status)
 225 {
 226
 227         if (unlikely(devinfo == NULL))
 228                 return;
 229
 230         if (type == BRCMF_USB_CBCTL_READ) {
 231                 if (status == 0)
 232                         devinfo->bus_pub.stats.rx_ctlpkts++;
 233                 else
 234                         devinfo->bus_pub.stats.rx_ctlerrs++;
 235         } else if (type == BRCMF_USB_CBCTL_WRITE) {
 236                 if (status == 0)
 237                         devinfo->bus_pub.stats.tx_ctlpkts++;
 238                 else
 239                         devinfo->bus_pub.stats.tx_ctlerrs++;
 240         }
 241
 242         devinfo->ctl_urb_status = status;
 243         devinfo->ctl_completed = true;
 244         brcmf_usb_ioctl_resp_wake(devinfo);
 245 }
 246
 247 static void
 248 brcmf_usb_ctlread_complete(struct urb *urb)
 249 {
 250         struct brcmf_usbdev_info *devinfo =
 251                 (struct brcmf_usbdev_info *)urb->context;
 252
 253         devinfo->ctl_urb_actual_length = urb->actual_length;
 254         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_READ,
 255                 urb->status);
 256 }
 257
 258 static void
 259 brcmf_usb_ctlwrite_complete(struct urb *urb)
 260 {
 261         struct brcmf_usbdev_info *devinfo =
 262                 (struct brcmf_usbdev_info *)urb->context;
 263
 264         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_WRITE,
 265                 urb->status);
 266 }
 267
 268 static int brcmf_usb_pnp(struct brcmf_usbdev_info *devinfo, uint state)
 269 {
 270         return 0;
 271 }
 272
 273 static int
 274 brcmf_usb_send_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 275 {
 276         int ret;
 277         u16 size;
 278
 279         if (devinfo == NULL || buf == NULL ||
 280             len == 0 || devinfo->ctl_urb == NULL)
 281                 return -EINVAL;
 282
 283         /* If the USB/HSIC bus in sleep state, wake it up */
 284         if (devinfo->suspend_state == USBOS_SUSPEND_STATE_SUSPENDED)
 285                 if (brcmf_usb_pnp(devinfo, BCMFMAC_USB_PNP_RESUME) != 0) {
 286                         brcmf_dbg(ERROR, "Could not Resume the bus!\n");
 287                         return -EIO;
 288                 }
 289
 290         devinfo->activity = true;
 291         size = len;
 292         devinfo->ctl_write.wLength = cpu_to_le16p(&size);
 293         devinfo->ctl_urb->transfer_buffer_length = size;
 294         devinfo->ctl_urb_status = 0;
 295         devinfo->ctl_urb_actual_length = 0;
 296
 297         usb_fill_control_urb(devinfo->ctl_urb,
 298                 devinfo->usbdev,
 299                 devinfo->ctl_out_pipe,
 300                 (unsigned char *) &devinfo->ctl_write,
 301                 buf, size,
 302                 (usb_complete_t)brcmf_usb_ctlwrite_complete,
 303                 devinfo);
 304
 305         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 306         if (ret < 0)
 307                 brcmf_dbg(ERROR, "usb_submit_urb failed %d\n", ret);
 308
 309         return ret;
 310 }
 311
 312 static int
 313 brcmf_usb_recv_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 314 {
 315         int ret;
 316         u16 size;
 317
 318         if ((devinfo == NULL) || (buf == NULL) || (len == 0)
 319                 || (devinfo->ctl_urb == NULL))
 320                 return -EINVAL;
 321
 322         size = len;
 323         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 324         devinfo->ctl_urb->transfer_buffer_length = size;
 325
 326         if (devinfo->rxctl_deferrespok) {
 327                 /* BMAC model */
 328                 devinfo->ctl_read.bRequestType = USB_DIR_IN
 329                         | USB_TYPE_VENDOR | USB_RECIP_INTERFACE;
 330                 devinfo->ctl_read.bRequest = DL_DEFER_RESP_OK;
 331         } else {
 332                 /* full dongle model */
 333                 devinfo->ctl_read.bRequestType = USB_DIR_IN
 334                         | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 335                 devinfo->ctl_read.bRequest = 1;
 336         }
 337
 338         usb_fill_control_urb(devinfo->ctl_urb,
 339                 devinfo->usbdev,
 340                 devinfo->ctl_in_pipe,
 341                 (unsigned char *) &devinfo->ctl_read,
 342                 buf, size,
 343                 (usb_complete_t)brcmf_usb_ctlread_complete,
 344                 devinfo);
 345
 346         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 347         if (ret < 0)
 348                 brcmf_dbg(ERROR, "usb_submit_urb failed %d\n", ret);
 349
 350         return ret;
 351 }
 352
 353 static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 354 {
 355         int err = 0;
 356         int timeout = 0;
 357         bool pending;
 358         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 359
 360         if (devinfo->bus_pub.state != BCMFMAC_USB_STATE_UP) {
 361                 /* TODO: handle suspend/resume */
 362                 return -EIO;
 363         }
 364
 365         if (test_and_set_bit(0, &devinfo->ctl_op))
 366                 return -EIO;
 367
 368         err = brcmf_usb_send_ctl(devinfo, buf, len);
 369         if (err) {
 370                 brcmf_dbg(ERROR, "fail %d bytes: %d\n", err, len);
 371                 return err;
 372         }
 373
 374         devinfo->ctl_completed = false;
 375         timeout = brcmf_usb_ioctl_resp_wait(devinfo, &devinfo->ctl_completed,
 376                                             &pending);
 377         clear_bit(0, &devinfo->ctl_op);
 378         if (!timeout) {
 379                 brcmf_dbg(ERROR, "Txctl wait timed out\n");
 380                 err = -EIO;
 381         }
 382         return err;
 383 }
 384
 385 static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 386 {
 387         int err = 0;
 388         int timeout = 0;
 389         bool pending;
 390         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 391
 392         if (devinfo->bus_pub.state != BCMFMAC_USB_STATE_UP) {
 393                 /* TODO: handle suspend/resume */
 394                 return -EIO;
 395         }
 396         if (test_and_set_bit(0, &devinfo->ctl_op))
 397                 return -EIO;
 398
 399         err = brcmf_usb_recv_ctl(devinfo, buf, len);
 400         if (err) {
 401                 brcmf_dbg(ERROR, "fail %d bytes: %d\n", err, len);
 402                 return err;
 403         }
 404         devinfo->ctl_completed = false;
 405         timeout = brcmf_usb_ioctl_resp_wait(devinfo, &devinfo->ctl_completed,
 406                                             &pending);
 407         err = devinfo->ctl_urb_status;
 408         clear_bit(0, &devinfo->ctl_op);
 409         if (!timeout) {
 410                 brcmf_dbg(ERROR, "rxctl wait timed out\n");
 411                 err = -EIO;
 412         }
 413         if (!err)
 414                 return devinfo->ctl_urb_actual_length;
 415         else
 416                 return err;
 417 }
 418
 419 static struct brcmf_usbreq *brcmf_usb_deq(struct brcmf_usbdev_info *devinfo,
 420                                           struct list_head *q)
 421 {
 422         unsigned long flags;
 423         struct brcmf_usbreq  *req;
 424         spin_lock_irqsave(&devinfo->qlock, flags);
 425         if (list_empty(q)) {
 426                 spin_unlock_irqrestore(&devinfo->qlock, flags);
 427                 return NULL;
 428         }
 429         req = list_entry(q->next, struct brcmf_usbreq, list);
 430         list_del_init(q->next);
 431         spin_unlock_irqrestore(&devinfo->qlock, flags);
 432         return req;
 433
 434 }
 435
 436 static void brcmf_usb_enq(struct brcmf_usbdev_info *devinfo,
 437                           struct list_head *q, struct brcmf_usbreq *req)
 438 {
 439         unsigned long flags;
 440         spin_lock_irqsave(&devinfo->qlock, flags);
 441         list_add_tail(&req->list, q);
 442         spin_unlock_irqrestore(&devinfo->qlock, flags);
 443 }
 444
 445 static struct brcmf_usbreq *
 446 brcmf_usbdev_qinit(struct list_head *q, int qsize)
 447 {
 448         int i;
 449         struct brcmf_usbreq *req, *reqs;
 450
 451         reqs = kzalloc(sizeof(struct brcmf_usbreq) * qsize, GFP_ATOMIC);
 452         if (reqs == NULL) {
 453                 brcmf_dbg(ERROR, "fail to allocate memory!\n");
 454                 return NULL;
 455         }
 456         req = reqs;
 457
 458         for (i = 0; i < qsize; i++) {
 459                 req->urb = usb_alloc_urb(0, GFP_ATOMIC);
 460                 if (!req->urb)
 461                         goto fail;
 462
 463                 INIT_LIST_HEAD(&req->list);
 464                 list_add_tail(&req->list, q);
 465                 req++;
 466         }
 467         return reqs;
 468 fail:
 469         brcmf_dbg(ERROR, "fail!\n");
 470         while (!list_empty(q)) {
 471                 req = list_entry(q->next, struct brcmf_usbreq, list);
 472                 if (req && req->urb)
 473                         usb_free_urb(req->urb);
 474                 list_del(q->next);
 475         }
 476         return NULL;
 477
 478 }
 479
 480 static void brcmf_usb_free_q(struct list_head *q, bool pending)
 481 {
 482         struct brcmf_usbreq *req, *next;
 483         int i = 0;
 484         list_for_each_entry_safe(req, next, q, list) {
 485                 if (!req->urb) {
 486                         brcmf_dbg(ERROR, "bad req\n");
 487                         break;
 488                 }
 489                 i++;
 490                 if (pending) {
 491                         usb_kill_urb(req->urb);
 492                 } else {
 493                         usb_free_urb(req->urb);
 494                         list_del_init(&req->list);
 495                 }
 496         }
 497 }
 498
 499 static void brcmf_usb_del_fromq(struct brcmf_usbdev_info *devinfo,
 500                                 struct brcmf_usbreq *req)
 501 {
 502         unsigned long flags;
 503
 504         spin_lock_irqsave(&devinfo->qlock, flags);
 505         list_del_init(&req->list);
 506         spin_unlock_irqrestore(&devinfo->qlock, flags);
 507 }
 508
 509
 510 static void brcmf_usb_tx_complete(struct urb *urb)
 511 {
 512         struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
 513         struct brcmf_usbdev_info *devinfo = req->devinfo;
 514
 515         brcmf_usb_del_fromq(devinfo, req);
 516         if (urb->status == 0)
 517                 devinfo->bus_pub.bus->dstats.tx_packets++;
 518         else
 519                 devinfo->bus_pub.bus->dstats.tx_errors++;
 520
 521         dev_kfree_skb(req->skb);
 522         req->skb = NULL;
 523         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
 524
 525 }
 526
 527 static void brcmf_usb_rx_complete(struct urb *urb)
 528 {
 529         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
 530         struct brcmf_usbdev_info *devinfo = req->devinfo;
 531         struct sk_buff *skb;
 532         int ifidx = 0;
 533
 534         brcmf_usb_del_fromq(devinfo, req);
 535         skb = req->skb;
 536         req->skb = NULL;
 537
 538         if (urb->status == 0) {
 539                 devinfo->bus_pub.bus->dstats.rx_packets++;
 540         } else {
 541                 devinfo->bus_pub.bus->dstats.rx_errors++;
 542                 dev_kfree_skb(skb);
 543                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
 544                 return;
 545         }
 546
 547         if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_UP) {
 548                 skb_put(skb, urb->actual_length);
 549                 if (brcmf_proto_hdrpull(devinfo->dev, &ifidx, skb) != 0) {
 550                         brcmf_dbg(ERROR, "rx protocol error\n");
 551                         brcmu_pkt_buf_free_skb(skb);
 552                         devinfo->bus_pub.bus->dstats.rx_errors++;
 553                 } else {
 554                         brcmf_rx_packet(devinfo->dev, ifidx, skb);
 555                         brcmf_usb_rx_refill(devinfo, req);
 556                 }
 557         } else {
 558                 dev_kfree_skb(skb);
 559         }
 560         return;
 561
 562 }
 563
 564 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 565                                 struct brcmf_usbreq  *req)
 566 {
 567         struct sk_buff *skb;
 568         int ret;
 569
 570         if (!req || !devinfo)
 571                 return;
 572
 573         skb = dev_alloc_skb(devinfo->bus_pub.bus_mtu);
 574         if (!skb) {
 575                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
 576                 return;
 577         }
 578         req->skb = skb;
 579
 580         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
 581                           skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
 582                           req);
 583         req->urb->transfer_flags |= URB_ZERO_PACKET;
 584         req->devinfo = devinfo;
 585
 586         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 587         if (ret == 0) {
 588                 brcmf_usb_enq(devinfo, &devinfo->rx_postq, req);
 589         } else {
 590                 dev_kfree_skb(req->skb);
 591                 req->skb = NULL;
 592                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
 593         }
 594         return;
 595 }
 596
 597 static void brcmf_usb_rx_fill_all(struct brcmf_usbdev_info *devinfo)
 598 {
 599         struct brcmf_usbreq *req;
 600
 601         if (devinfo->bus_pub.state != BCMFMAC_USB_STATE_UP) {
 602                 brcmf_dbg(ERROR, "bus is not up\n");
 603                 return;
 604         }
 605         while ((req = brcmf_usb_deq(devinfo, &devinfo->rx_freeq)) != NULL)
 606                 brcmf_usb_rx_refill(devinfo, req);
 607 }
 608
 609 static void
 610 brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
 611 {
 612         struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
 613         int old_state;
 614
 615
 616         if (devinfo->bus_pub.state == state)
 617                 return;
 618
 619         old_state = devinfo->bus_pub.state;
 620         brcmf_dbg(TRACE, "dbus state change from %d to to %d\n",
 621                   old_state, state);
 622
 623         /* Don't update state if it's PnP firmware re-download */
 624         if (state != BCMFMAC_USB_STATE_PNP_FWDL) /* TODO */
 625                 devinfo->bus_pub.state = state;
 626
 627         if ((old_state  == BCMFMAC_USB_STATE_SLEEP)
 628                 && (state == BCMFMAC_USB_STATE_UP)) {
 629                 brcmf_usb_rx_fill_all(devinfo);
 630         }
 631
 632         /* update state of upper layer */
 633         if (state == BCMFMAC_USB_STATE_DOWN) {
 634                 brcmf_dbg(INFO, "DBUS is down\n");
 635                 bcmf_bus->state = BRCMF_BUS_DOWN;
 636         } else {
 637                 brcmf_dbg(INFO, "DBUS current state=%d\n", state);
 638         }
 639 }
 640
 641 static void
 642 brcmf_usb_intr_complete(struct urb *urb)
 643 {
 644         struct brcmf_usbdev_info *devinfo =
 645                         (struct brcmf_usbdev_info *)urb->context;
 646         bool killed;
 647
 648         if (devinfo == NULL)
 649                 return;
 650
 651         if (unlikely(urb->status)) {
 652                 if (devinfo->suspend_state ==
 653                         USBOS_SUSPEND_STATE_SUSPEND_PENDING)
 654                         killed = true;
 655
 656                 if ((urb->status == -ENOENT && (!killed))
 657                         || urb->status == -ESHUTDOWN ||
 658                         urb->status == -ENODEV) {
 659                         brcmf_usb_state_change(devinfo, BCMFMAC_USB_STATE_DOWN);
 660                 }
 661         }
 662
 663         if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_DOWN) {
 664                 brcmf_dbg(ERROR, "intr cb when DBUS down, ignoring\n");
 665                 return;
 666         }
 667
 668         if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_UP)
 669                 usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 670 }
 671
 672 static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 673 {
 674         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 675         struct brcmf_usbreq  *req;
 676         int ret;
 677
 678         if (devinfo->bus_pub.state != BCMFMAC_USB_STATE_UP) {
 679                 /* TODO: handle suspend/resume */
 680                 return -EIO;
 681         }
 682
 683         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq);
 684         if (!req) {
 685                 brcmf_dbg(ERROR, "no req to send\n");
 686                 return -ENOMEM;
 687         }
 688         if (!req->urb) {
 689                 brcmf_dbg(ERROR, "no urb for req %p\n", req);
 690                 return -ENOBUFS;
 691         }
 692
 693         req->skb = skb;
 694         req->devinfo = devinfo;
 695         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
 696                           skb->data, skb->len, brcmf_usb_tx_complete, req);
 697         req->urb->transfer_flags |= URB_ZERO_PACKET;
 698         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 699         if (!ret) {
 700                 brcmf_usb_enq(devinfo, &devinfo->tx_postq, req);
 701         } else {
 702                 req->skb = NULL;
 703                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
 704         }
 705
 706         return ret;
 707 }
 708
 709
 710 static int brcmf_usb_up(struct device *dev)
 711 {
 712         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 713         u16 ifnum;
 714
 715         if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_UP)
 716                 return 0;
 717
 718         /* If the USB/HSIC bus in sleep state, wake it up */
 719         if (devinfo->suspend_state == USBOS_SUSPEND_STATE_SUSPENDED) {
 720                 if (brcmf_usb_pnp(devinfo, BCMFMAC_USB_PNP_RESUME) != 0) {
 721                         brcmf_dbg(ERROR, "Could not Resume the bus!\n");
 722                         return -EIO;
 723                 }
 724         }
 725         devinfo->activity = true;
 726
 727         /* Success, indicate devinfo is fully up */
 728         brcmf_usb_state_change(devinfo, BCMFMAC_USB_STATE_UP);
 729
 730         if (devinfo->intr_urb) {
 731                 int ret;
 732
 733                 usb_fill_int_urb(devinfo->intr_urb, devinfo->usbdev,
 734                         devinfo->intr_pipe,
 735                         &devinfo->intr,
 736                         devinfo->intr_size,
 737                         (usb_complete_t)brcmf_usb_intr_complete,
 738                         devinfo,
 739                         devinfo->interval);
 740
 741                 ret = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 742                 if (ret) {
 743                         brcmf_dbg(ERROR, "USB_SUBMIT_URB failed with status %d\n",
 744                                   ret);
 745                         return -EINVAL;
 746                 }
 747         }
 748
 749         if (devinfo->ctl_urb) {
 750                 devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
 751                 devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
 752
 753                 ifnum = IFDESC(devinfo->usbdev, CONTROL_IF).bInterfaceNumber;
 754
 755                 /* CTL Write */
 756                 devinfo->ctl_write.bRequestType =
 757                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 758                 devinfo->ctl_write.bRequest = 0;
 759                 devinfo->ctl_write.wValue = cpu_to_le16(0);
 760                 devinfo->ctl_write.wIndex = cpu_to_le16p(&ifnum);
 761
 762                 /* CTL Read */
 763                 devinfo->ctl_read.bRequestType =
 764                         USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 765                 devinfo->ctl_read.bRequest = 1;
 766                 devinfo->ctl_read.wValue = cpu_to_le16(0);
 767                 devinfo->ctl_read.wIndex = cpu_to_le16p(&ifnum);
 768         }
 769         brcmf_usb_rx_fill_all(devinfo);
 770         return 0;
 771 }
 772
 773 static void brcmf_usb_down(struct device *dev)
 774 {
 775         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 776
 777         if (devinfo == NULL)
 778                 return;
 779
 780         brcmf_dbg(TRACE, "enter\n");
 781         if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_DOWN)
 782                 return;
 783
 784         brcmf_usb_state_change(devinfo, BCMFMAC_USB_STATE_DOWN);
 785         if (devinfo->intr_urb)
 786                 usb_kill_urb(devinfo->intr_urb);
 787
 788         if (devinfo->ctl_urb)
 789                 usb_kill_urb(devinfo->ctl_urb);
 790
 791         if (devinfo->bulk_urb)
 792                 usb_kill_urb(devinfo->bulk_urb);
 793         brcmf_usb_free_q(&devinfo->tx_postq, true);
 794
 795         brcmf_usb_free_q(&devinfo->rx_postq, true);
 796 }
 797
 798 static int
 799 brcmf_usb_sync_wait(struct brcmf_usbdev_info *devinfo, u16 time)
 800 {
 801         int ret;
 802         int err = 0;
 803         int ms = time;
 804
 805         ret = wait_event_interruptible_timeout(devinfo->wait,
 806                 devinfo->waitdone == true, (ms * HZ / 1000));
 807
 808         if ((devinfo->waitdone == false) || (devinfo->sync_urb_status)) {
 809                 brcmf_dbg(ERROR, "timeout(%d) or urb err=%d\n",
 810                           ret, devinfo->sync_urb_status);
 811                 err = -EINVAL;
 812         }
 813         devinfo->waitdone = false;
 814         return err;
 815 }
 816
 817 static void
 818 brcmf_usb_sync_complete(struct urb *urb)
 819 {
 820         struct brcmf_usbdev_info *devinfo =
 821                         (struct brcmf_usbdev_info *)urb->context;
 822
 823         devinfo->waitdone = true;
 824         wake_up_interruptible(&devinfo->wait);
 825         devinfo->sync_urb_status = urb->status;
 826 }
 827
 828 static bool brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
 829                              void *buffer, int buflen)
 830 {
 831         int ret = 0;
 832         char *tmpbuf;
 833         u16 size;
 834
 835         if ((!devinfo) || (devinfo->ctl_urb == NULL))
 836                 return false;
 837
 838         tmpbuf = kmalloc(buflen, GFP_ATOMIC);
 839         if (!tmpbuf)
 840                 return false;
 841
 842         size = buflen;
 843         devinfo->ctl_urb->transfer_buffer_length = size;
 844
 845         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 846         devinfo->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
 847                 USB_RECIP_INTERFACE;
 848         devinfo->ctl_read.bRequest = cmd;
 849
 850         usb_fill_control_urb(devinfo->ctl_urb,
 851                 devinfo->usbdev,
 852                 usb_rcvctrlpipe(devinfo->usbdev, 0),
 853                 (unsigned char *) &devinfo->ctl_read,
 854                 (void *) tmpbuf, size,
 855                 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 856
 857         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 858         if (ret < 0) {
 859                 brcmf_dbg(ERROR, "usb_submit_urb failed %d\n", ret);
 860                 kfree(tmpbuf);
 861                 return false;
 862         }
 863
 864         ret = brcmf_usb_sync_wait(devinfo, BRCMF_USB_SYNC_TIMEOUT);
 865         memcpy(buffer, tmpbuf, buflen);
 866         kfree(tmpbuf);
 867
 868         return (ret == 0);
 869 }
 870
 871 static bool
 872 brcmf_usb_dlneeded(struct brcmf_usbdev_info *devinfo)
 873 {
 874         struct bootrom_id_le id;
 875         u32 chipid, chiprev;
 876
 877         brcmf_dbg(TRACE, "enter\n");
 878
 879         if (devinfo == NULL)
 880                 return false;
 881
 882         /* Check if firmware downloaded already by querying runtime ID */
 883         id.chip = cpu_to_le32(0xDEAD);
 884         brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id,
 885                 sizeof(struct bootrom_id_le));
 886
 887         chipid = le32_to_cpu(id.chip);
 888         chiprev = le32_to_cpu(id.chiprev);
 889
 890         if ((chipid & 0x4300) == 0x4300)
 891                 brcmf_dbg(INFO, "chip %x rev 0x%x\n", chipid, chiprev);
 892         else
 893                 brcmf_dbg(INFO, "chip %d rev 0x%x\n", chipid, chiprev);
 894         if (chipid == BRCMF_POSTBOOT_ID) {
 895                 brcmf_dbg(INFO, "firmware already downloaded\n");
 896                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id,
 897                         sizeof(struct bootrom_id_le));
 898                 return false;
 899         } else {
 900                 devinfo->bus_pub.devid = chipid;
 901                 devinfo->bus_pub.chiprev = chiprev;
 902         }
 903         return true;
 904 }
 905
 906 static int
 907 brcmf_usb_resetcfg(struct brcmf_usbdev_info *devinfo)
 908 {
 909         struct bootrom_id_le id;
 910         u16 wait = 0, wait_time;
 911
 912         brcmf_dbg(TRACE, "enter\n");
 913
 914         if (devinfo == NULL)
 915                 return -EINVAL;
 916
 917         /* Give dongle chance to boot */
 918         wait_time = BRCMF_USB_DLIMAGE_SPINWAIT;
 919         while (wait < BRCMF_USB_DLIMAGE_LIMIT) {
 920                 mdelay(wait_time);
 921                 wait += wait_time;
 922                 id.chip = cpu_to_le32(0xDEAD);       /* Get the ID */
 923                 brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id,
 924                         sizeof(struct bootrom_id_le));
 925                 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID))
 926                         break;
 927         }
 928
 929         if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID)) {
 930                 brcmf_dbg(INFO, "download done %d ms postboot chip 0x%x/rev 0x%x\n",
 931                           wait, le32_to_cpu(id.chip), le32_to_cpu(id.chiprev));
 932
 933                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id,
 934                         sizeof(struct bootrom_id_le));
 935
 936                 /* XXX this wait may not be necessary */
 937                 mdelay(BRCMF_USB_RESETCFG_SPINWAIT);
 938                 return 0;
 939         } else {
 940                 brcmf_dbg(ERROR, "Cannot talk to Dongle. Firmware is not UP, %d ms\n",
 941                           wait);
 942                 return -EINVAL;
 943         }
 944 }
 945
 946
 947 static int
 948 brcmf_usb_dl_send_bulk(struct brcmf_usbdev_info *devinfo, void *buffer, int len)
 949 {
 950         int ret;
 951
 952         if ((devinfo == NULL) || (devinfo->bulk_urb == NULL))
 953                 return -EINVAL;
 954
 955         /* Prepare the URB */
 956         usb_fill_bulk_urb(devinfo->bulk_urb, devinfo->usbdev,
 957                           devinfo->tx_pipe, buffer, len,
 958                           (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 959
 960         devinfo->bulk_urb->transfer_flags |= URB_ZERO_PACKET;
 961
 962         ret = usb_submit_urb(devinfo->bulk_urb, GFP_ATOMIC);
 963         if (ret) {
 964                 brcmf_dbg(ERROR, "usb_submit_urb failed %d\n", ret);
 965                 return ret;
 966         }
 967         ret = brcmf_usb_sync_wait(devinfo, BRCMF_USB_SYNC_TIMEOUT);
 968         return ret;
 969 }
 970
 971 static int
 972 brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
 973 {
 974         unsigned int sendlen, sent, dllen;
 975         char *bulkchunk = NULL, *dlpos;
 976         struct rdl_state_le state;
 977         u32 rdlstate, rdlbytes;
 978         int err = 0;
 979         brcmf_dbg(TRACE, "fw %p, len %d\n", fw, fwlen);
 980
 981         bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
 982         if (bulkchunk == NULL) {
 983                 err = -ENOMEM;
 984                 goto fail;
 985         }
 986
 987         /* 1) Prepare USB boot loader for runtime image */
 988         brcmf_usb_dl_cmd(devinfo, DL_START, &state,
 989                          sizeof(struct rdl_state_le));
 990
 991         rdlstate = le32_to_cpu(state.state);
 992         rdlbytes = le32_to_cpu(state.bytes);
 993
 994         /* 2) Check we are in the Waiting state */
 995         if (rdlstate != DL_WAITING) {
 996                 brcmf_dbg(ERROR, "Failed to DL_START\n");
 997                 err = -EINVAL;
 998                 goto fail;
 999         }
1000         sent = 0;
1001         dlpos = fw;
1002         dllen = fwlen;
1003
1004         /* Get chip id and rev */
1005         while (rdlbytes != dllen) {
1006                 /* Wait until the usb device reports it received all
1007                  * the bytes we sent */
1008                 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
1009                         if ((dllen-sent) < RDL_CHUNK)
1010                                 sendlen = dllen-sent;
1011                         else
1012                                 sendlen = RDL_CHUNK;
1013
1014                         /* simply avoid having to send a ZLP by ensuring we
1015                          * never have an even
1016                          * multiple of 64
1017                          */
1018                         if (!(sendlen % 64))
1019                                 sendlen -= 4;
1020
1021                         /* send data */
1022                         memcpy(bulkchunk, dlpos, sendlen);
1023                         if (brcmf_usb_dl_send_bulk(devinfo, bulkchunk,
1024                                                    sendlen)) {
1025                                 brcmf_dbg(ERROR, "send_bulk failed\n");
1026                                 err = -EINVAL;
1027                                 goto fail;
1028                         }
1029
1030                         dlpos += sendlen;
1031                         sent += sendlen;
1032                 }
1033                 if (!brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
1034                                       sizeof(struct rdl_state_le))) {
1035                         brcmf_dbg(ERROR, "DL_GETSTATE Failed xxxx\n");
1036                         err = -EINVAL;
1037                         goto fail;
1038                 }
1039
1040                 rdlstate = le32_to_cpu(state.state);
1041                 rdlbytes = le32_to_cpu(state.bytes);
1042
1043                 /* restart if an error is reported */
1044                 if (rdlstate == DL_BAD_HDR || rdlstate == DL_BAD_CRC) {
1045                         brcmf_dbg(ERROR, "Bad Hdr or Bad CRC state %d\n",
1046                                   rdlstate);
1047                         err = -EINVAL;
1048                         goto fail;
1049                 }
1050         }
1051
1052 fail:
1053         kfree(bulkchunk);
1054         brcmf_dbg(TRACE, "err=%d\n", err);
1055         return err;
1056 }
1057
1058 static int brcmf_usb_dlstart(struct brcmf_usbdev_info *devinfo, u8 *fw, int len)
1059 {
1060         int err;
1061
1062         brcmf_dbg(TRACE, "enter\n");
1063
1064         if (devinfo == NULL)
1065                 return -EINVAL;
1066
1067         if (devinfo->bus_pub.devid == 0xDEAD)
1068                 return -EINVAL;
1069
1070         err = brcmf_usb_dl_writeimage(devinfo, fw, len);
1071         if (err == 0)
1072                 devinfo->bus_pub.state = BCMFMAC_USB_STATE_DL_DONE;
1073         else
1074                 devinfo->bus_pub.state = BCMFMAC_USB_STATE_DL_PENDING;
1075         brcmf_dbg(TRACE, "exit: err=%d\n", err);
1076
1077         return err;
1078 }
1079
1080 static int brcmf_usb_dlrun(struct brcmf_usbdev_info *devinfo)
1081 {
1082         struct rdl_state_le state;
1083
1084         brcmf_dbg(TRACE, "enter\n");
1085         if (!devinfo)
1086                 return -EINVAL;
1087
1088         if (devinfo->bus_pub.devid == 0xDEAD)
1089                 return -EINVAL;
1090
1091         /* Check we are runnable */
1092         brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
1093                 sizeof(struct rdl_state_le));
1094
1095         /* Start the image */
1096         if (state.state == cpu_to_le32(DL_RUNNABLE)) {
1097                 if (!brcmf_usb_dl_cmd(devinfo, DL_GO, &state,
1098                         sizeof(struct rdl_state_le)))
1099                         return -ENODEV;
1100                 if (brcmf_usb_resetcfg(devinfo))
1101                         return -ENODEV;
1102                 /* The Dongle may go for re-enumeration. */
1103         } else {
1104                 brcmf_dbg(ERROR, "Dongle not runnable\n");
1105                 return -EINVAL;
1106         }
1107         brcmf_dbg(TRACE, "exit\n");
1108         return 0;
1109 }
1110
1111 static bool brcmf_usb_chip_support(int chipid, int chiprev)
1112 {
1113         switch(chipid) {
1114         case 43235:
1115         case 43236:
1116         case 43238:
1117                 return (chiprev == 3);
1118         default:
1119                 break;
1120         }
1121         return false;
1122 }
1123
1124 static int
1125 brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
1126 {
1127         int devid, chiprev;
1128         int err;
1129
1130         brcmf_dbg(TRACE, "enter\n");
1131         if (devinfo == NULL)
1132                 return -ENODEV;
1133
1134         devid = devinfo->bus_pub.devid;
1135         chiprev = devinfo->bus_pub.chiprev;
1136
1137         if (!brcmf_usb_chip_support(devid, chiprev)) {
1138                 brcmf_dbg(ERROR, "unsupported chip %d rev %d\n",
1139                           devid, chiprev);
1140                 return -EINVAL;
1141         }
1142
1143         if (!devinfo->image) {
1144                 brcmf_dbg(ERROR, "No firmware!\n");
1145                 return -ENOENT;
1146         }
1147
1148         err = brcmf_usb_dlstart(devinfo,
1149                 devinfo->image, devinfo->image_len);
1150         if (err == 0)
1151                 err = brcmf_usb_dlrun(devinfo);
1152         return err;
1153 }
1154
1155
1156 static void brcmf_usb_detach(const struct brcmf_usbdev *bus_pub)
1157 {
1158         struct brcmf_usbdev_info *devinfo =
1159                 (struct brcmf_usbdev_info *)bus_pub;
1160
1161         brcmf_dbg(TRACE, "devinfo %p\n", devinfo);
1162
1163         /* store the image globally */
1164         g_image.data = devinfo->image;
1165         g_image.len = devinfo->image_len;
1166
1167         /* free the URBS */
1168         brcmf_usb_free_q(&devinfo->rx_freeq, false);
1169         brcmf_usb_free_q(&devinfo->tx_freeq, false);
1170
1171         usb_free_urb(devinfo->intr_urb);
1172         usb_free_urb(devinfo->ctl_urb);
1173         usb_free_urb(devinfo->bulk_urb);
1174
1175         kfree(devinfo->tx_reqs);
1176         kfree(devinfo->rx_reqs);
1177         kfree(devinfo);
1178 }
1179
1180 #define TRX_MAGIC       0x30524448      /* "HDR0" */
1181 #define TRX_VERSION     1               /* Version 1 */
1182 #define TRX_MAX_LEN     0x3B0000        /* Max length */
1183 #define TRX_NO_HEADER   1               /* Do not write TRX header */
1184 #define TRX_MAX_OFFSET  3               /* Max number of individual files */
1185 #define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed image */
1186
1187 struct trx_header_le {
1188         __le32 magic;           /* "HDR0" */
1189         __le32 len;             /* Length of file including header */
1190         __le32 crc32;           /* CRC from flag_version to end of file */
1191         __le32 flag_version;    /* 0:15 flags, 16:31 version */
1192         __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
1193                                          * header */
1194 };
1195
1196 static int check_file(const u8 *headers)
1197 {
1198         struct trx_header_le *trx;
1199         int actual_len = -1;
1200
1201         /* Extract trx header */
1202         trx = (struct trx_header_le *) headers;
1203         if (trx->magic != cpu_to_le32(TRX_MAGIC))
1204                 return -1;
1205
1206         headers += sizeof(struct trx_header_le);
1207
1208         if (le32_to_cpu(trx->flag_version) & TRX_UNCOMP_IMAGE) {
1209                 actual_len = le32_to_cpu(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]);
1210                 return actual_len + sizeof(struct trx_header_le);
1211         }
1212         return -1;
1213 }
1214
1215 static int brcmf_usb_get_fw(struct brcmf_usbdev_info *devinfo)
1216 {
1217         s8 *fwname;
1218         const struct firmware *fw;
1219         int err;
1220
1221         devinfo->image = g_image.data;
1222         devinfo->image_len = g_image.len;
1223
1224         /*
1225          * if we have an image we can leave here.
1226          */
1227         if (devinfo->image)
1228                 return 0;
1229
1230         fwname = BRCMF_USB_43236_FW_NAME;
1231
1232         err = request_firmware(&fw, fwname, devinfo->dev);
1233         if (!fw) {
1234                 brcmf_dbg(ERROR, "fail to request firmware %s\n", fwname);
1235                 return err;
1236         }
1237         if (check_file(fw->data) < 0) {
1238                 brcmf_dbg(ERROR, "invalid firmware %s\n", fwname);
1239                 return -EINVAL;
1240         }
1241
1242         devinfo->image = kmalloc(fw->size, GFP_ATOMIC); /* plus nvram */
1243         if (!devinfo->image)
1244                 return -ENOMEM;
1245
1246         memcpy(devinfo->image, fw->data, fw->size);
1247         devinfo->image_len = fw->size;
1248
1249         release_firmware(fw);
1250         return 0;
1251 }
1252
1253
1254 static
1255 struct brcmf_usbdev *brcmf_usb_attach(int nrxq, int ntxq, struct device *dev)
1256 {
1257         struct brcmf_usbdev_info *devinfo;
1258
1259         devinfo = kzalloc(sizeof(struct brcmf_usbdev_info), GFP_ATOMIC);
1260         if (devinfo == NULL)
1261                 return NULL;
1262
1263         devinfo->bus_pub.nrxq = nrxq;
1264         devinfo->rx_low_watermark = nrxq / 2;
1265         devinfo->bus_pub.devinfo = devinfo;
1266         devinfo->bus_pub.ntxq = ntxq;
1267
1268         /* flow control when too many tx urbs posted */
1269         devinfo->tx_low_watermark = ntxq / 4;
1270         devinfo->tx_high_watermark = devinfo->tx_low_watermark * 3;
1271         devinfo->dev = dev;
1272         devinfo->usbdev = usbdev_probe_info.usb;
1273         devinfo->tx_pipe = usbdev_probe_info.tx_pipe;
1274         devinfo->rx_pipe = usbdev_probe_info.rx_pipe;
1275         devinfo->rx_pipe2 = usbdev_probe_info.rx_pipe2;
1276         devinfo->intr_pipe = usbdev_probe_info.intr_pipe;
1277
1278         devinfo->interval = usbdev_probe_info.interval;
1279         devinfo->intr_size = usbdev_probe_info.intr_size;
1280
1281         memcpy(&devinfo->probe_info, &usbdev_probe_info,
1282                 sizeof(struct brcmf_usb_probe_info));
1283         devinfo->bus_pub.bus_mtu = BRCMF_USB_MAX_PKT_SIZE;
1284
1285         /* Initialize other structure content */
1286         init_waitqueue_head(&devinfo->ioctl_resp_wait);
1287
1288         /* Initialize the spinlocks */
1289         spin_lock_init(&devinfo->qlock);
1290
1291         INIT_LIST_HEAD(&devinfo->rx_freeq);
1292         INIT_LIST_HEAD(&devinfo->rx_postq);
1293
1294         INIT_LIST_HEAD(&devinfo->tx_freeq);
1295         INIT_LIST_HEAD(&devinfo->tx_postq);
1296
1297         devinfo->rx_reqs = brcmf_usbdev_qinit(&devinfo->rx_freeq, nrxq);
1298         if (!devinfo->rx_reqs)
1299                 goto error;
1300
1301         devinfo->tx_reqs = brcmf_usbdev_qinit(&devinfo->tx_freeq, ntxq);
1302         if (!devinfo->tx_reqs)
1303                 goto error;
1304
1305         devinfo->intr_urb = usb_alloc_urb(0, GFP_ATOMIC);
1306         if (!devinfo->intr_urb) {
1307                 brcmf_dbg(ERROR, "usb_alloc_urb (intr) failed\n");
1308                 goto error;
1309         }
1310         devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
1311         if (!devinfo->ctl_urb) {
1312                 brcmf_dbg(ERROR, "usb_alloc_urb (ctl) failed\n");
1313                 goto error;
1314         }
1315         devinfo->rxctl_deferrespok = 0;
1316
1317         devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
1318         if (!devinfo->bulk_urb) {
1319                 brcmf_dbg(ERROR, "usb_alloc_urb (bulk) failed\n");
1320                 goto error;
1321         }
1322
1323         init_waitqueue_head(&devinfo->wait);
1324         if (!brcmf_usb_dlneeded(devinfo))
1325                 return &devinfo->bus_pub;
1326
1327         brcmf_dbg(TRACE, "start fw downloading\n");
1328         if (brcmf_usb_get_fw(devinfo))
1329                 goto error;
1330
1331         if (brcmf_usb_fw_download(devinfo))
1332                 goto error;
1333
1334         return &devinfo->bus_pub;
1335
1336 error:
1337         brcmf_dbg(ERROR, "failed!\n");
1338         brcmf_usb_detach(&devinfo->bus_pub);
1339         return NULL;
1340 }
1341
1342 static int brcmf_usb_probe_cb(struct device *dev, const char *desc,
1343                                 u32 bustype, u32 hdrlen)
1344 {
1345         struct brcmf_bus *bus = NULL;
1346         struct brcmf_usbdev *bus_pub = NULL;
1347         int ret;
1348
1349
1350         bus_pub = brcmf_usb_attach(BRCMF_USB_NRXQ, BRCMF_USB_NTXQ, dev);
1351         if (!bus_pub) {
1352                 ret = -ENODEV;
1353                 goto fail;
1354         }
1355
1356         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
1357         if (!bus) {
1358                 ret = -ENOMEM;
1359                 goto fail;
1360         }
1361
1362         bus_pub->bus = bus;
1363         bus->brcmf_bus_txdata = brcmf_usb_tx;
1364         bus->brcmf_bus_init = brcmf_usb_up;
1365         bus->brcmf_bus_stop = brcmf_usb_down;
1366         bus->brcmf_bus_txctl = brcmf_usb_tx_ctlpkt;
1367         bus->brcmf_bus_rxctl = brcmf_usb_rx_ctlpkt;
1368         bus->type = bustype;
1369         bus->bus_priv.usb = bus_pub;
1370         dev_set_drvdata(dev, bus);
1371
1372         /* Attach to the common driver interface */
1373         ret = brcmf_attach(hdrlen, dev);
1374         if (ret) {
1375                 brcmf_dbg(ERROR, "dhd_attach failed\n");
1376                 goto fail;
1377         }
1378
1379         ret = brcmf_bus_start(dev);
1380         if (ret == -ENOLINK) {
1381                 brcmf_dbg(ERROR, "dongle is not responding\n");
1382                 brcmf_detach(dev);
1383                 goto fail;
1384         }
1385
1386         /* add interface and open for business */
1387         ret = brcmf_add_if(dev, 0, "wlan%d", NULL);
1388         if (ret) {
1389                 brcmf_dbg(ERROR, "Add primary net device interface failed!!\n");
1390                 brcmf_detach(dev);
1391                 goto fail;
1392         }
1393
1394         return 0;
1395 fail:
1396         /* Release resources in reverse order */
1397         if (bus_pub)
1398                 brcmf_usb_detach(bus_pub);
1399         kfree(bus);
1400         return ret;
1401 }
1402
1403 static void
1404 brcmf_usb_disconnect_cb(struct brcmf_usbdev *bus_pub)
1405 {
1406         if (!bus_pub)
1407                 return;
1408         brcmf_dbg(TRACE, "enter: bus_pub %p\n", bus_pub);
1409
1410         brcmf_detach(bus_pub->devinfo->dev);
1411         kfree(bus_pub->bus);
1412         brcmf_usb_detach(bus_pub);
1413
1414 }
1415
1416 static int
1417 brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
1418 {
1419         int ep;
1420         struct usb_endpoint_descriptor *endpoint;
1421         int ret = 0;
1422         struct usb_device *usb = interface_to_usbdev(intf);
1423         int num_of_eps;
1424         u8 endpoint_num;
1425
1426         brcmf_dbg(TRACE, "enter\n");
1427
1428         usbdev_probe_info.usb = usb;
1429         usbdev_probe_info.intf = intf;
1430
1431         if (id != NULL) {
1432                 usbdev_probe_info.vid = id->idVendor;
1433                 usbdev_probe_info.pid = id->idProduct;
1434         }
1435
1436         usb_set_intfdata(intf, &usbdev_probe_info);
1437
1438         /* Check that the device supports only one configuration */
1439         if (usb->descriptor.bNumConfigurations != 1) {
1440                 ret = -1;
1441                 goto fail;
1442         }
1443
1444         if (usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
1445                 ret = -1;
1446                 goto fail;
1447         }
1448
1449         /*
1450          * Only the BDC interface configuration is supported:
1451          *      Device class: USB_CLASS_VENDOR_SPEC
1452          *      if0 class: USB_CLASS_VENDOR_SPEC
1453          *      if0/ep0: control
1454          *      if0/ep1: bulk in
1455          *      if0/ep2: bulk out (ok if swapped with bulk in)
1456          */
1457         if (CONFIGDESC(usb)->bNumInterfaces != 1) {
1458                 ret = -1;
1459                 goto fail;
1460         }
1461
1462         /* Check interface */
1463         if (IFDESC(usb, CONTROL_IF).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
1464             IFDESC(usb, CONTROL_IF).bInterfaceSubClass != 2 ||
1465             IFDESC(usb, CONTROL_IF).bInterfaceProtocol != 0xff) {
1466                 brcmf_dbg(ERROR, "invalid control interface: class %d, subclass %d, proto %d\n",
1467                           IFDESC(usb, CONTROL_IF).bInterfaceClass,
1468                           IFDESC(usb, CONTROL_IF).bInterfaceSubClass,
1469                           IFDESC(usb, CONTROL_IF).bInterfaceProtocol);
1470                 ret = -1;
1471                 goto fail;
1472         }
1473
1474         /* Check control endpoint */
1475         endpoint = &IFEPDESC(usb, CONTROL_IF, 0);
1476         if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
1477                 != USB_ENDPOINT_XFER_INT) {
1478                 brcmf_dbg(ERROR, "invalid control endpoint %d\n",
1479                           endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
1480                 ret = -1;
1481                 goto fail;
1482         }
1483
1484         endpoint_num = endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
1485         usbdev_probe_info.intr_pipe = usb_rcvintpipe(usb, endpoint_num);
1486
1487         usbdev_probe_info.rx_pipe = 0;
1488         usbdev_probe_info.rx_pipe2 = 0;
1489         usbdev_probe_info.tx_pipe = 0;
1490         num_of_eps = IFDESC(usb, BULK_IF).bNumEndpoints - 1;
1491
1492         /* Check data endpoints and get pipes */
1493         for (ep = 1; ep <= num_of_eps; ep++) {
1494                 endpoint = &IFEPDESC(usb, BULK_IF, ep);
1495                 if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
1496                     USB_ENDPOINT_XFER_BULK) {
1497                         brcmf_dbg(ERROR, "invalid data endpoint %d\n", ep);
1498                         ret = -1;
1499                         goto fail;
1500                 }
1501
1502                 endpoint_num = endpoint->bEndpointAddress &
1503                                USB_ENDPOINT_NUMBER_MASK;
1504                 if ((endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1505                         == USB_DIR_IN) {
1506                         if (!usbdev_probe_info.rx_pipe) {
1507                                 usbdev_probe_info.rx_pipe =
1508                                         usb_rcvbulkpipe(usb, endpoint_num);
1509                         } else {
1510                                 usbdev_probe_info.rx_pipe2 =
1511                                         usb_rcvbulkpipe(usb, endpoint_num);
1512                         }
1513                 } else {
1514                         usbdev_probe_info.tx_pipe =
1515                                         usb_sndbulkpipe(usb, endpoint_num);
1516                 }
1517         }
1518
1519         /* Allocate interrupt URB and data buffer */
1520         /* RNDIS says 8-byte intr, our old drivers used 4-byte */
1521         if (IFEPDESC(usb, CONTROL_IF, 0).wMaxPacketSize == cpu_to_le16(16))
1522                 usbdev_probe_info.intr_size = 8;
1523         else
1524                 usbdev_probe_info.intr_size = 4;
1525
1526         usbdev_probe_info.interval = IFEPDESC(usb, CONTROL_IF, 0).bInterval;
1527
1528         usbdev_probe_info.device_speed = usb->speed;
1529         if (usb->speed == USB_SPEED_HIGH)
1530                 brcmf_dbg(INFO, "Broadcom high speed USB wireless device detected\n");
1531         else
1532                 brcmf_dbg(INFO, "Broadcom full speed USB wireless device detected\n");
1533
1534         ret = brcmf_usb_probe_cb(&usb->dev, "", USB_BUS, 0);
1535         if (ret)
1536                 goto fail;
1537
1538         /* Success */
1539         return 0;
1540
1541 fail:
1542         brcmf_dbg(ERROR, "failed with errno %d\n", ret);
1543         usb_set_intfdata(intf, NULL);
1544         return ret;
1545
1546 }
1547
1548 static void
1549 brcmf_usb_disconnect(struct usb_interface *intf)
1550 {
1551         struct usb_device *usb = interface_to_usbdev(intf);
1552
1553         brcmf_dbg(TRACE, "enter\n");
1554         brcmf_usb_disconnect_cb(brcmf_usb_get_buspub(&usb->dev));
1555         usb_set_intfdata(intf, NULL);
1556 }
1557
1558 /*
1559  *      only need to signal the bus being down and update the suspend state.
1560  */
1561 static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
1562 {
1563         struct usb_device *usb = interface_to_usbdev(intf);
1564         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1565
1566         brcmf_dbg(TRACE, "enter\n");
1567         devinfo->bus_pub.state = BCMFMAC_USB_STATE_DOWN;
1568         devinfo->suspend_state = USBOS_SUSPEND_STATE_SUSPENDED;
1569         return 0;
1570 }
1571
1572 /*
1573  *      mark suspend state active and crank up the bus.
1574  */
1575 static int brcmf_usb_resume(struct usb_interface *intf)
1576 {
1577         struct usb_device *usb = interface_to_usbdev(intf);
1578         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1579
1580         brcmf_dbg(TRACE, "enter\n");
1581         devinfo->suspend_state = USBOS_SUSPEND_STATE_DEVICE_ACTIVE;
1582         brcmf_bus_start(&usb->dev);
1583         return 0;
1584 }
1585
1586 #define BRCMF_USB_VENDOR_ID_BROADCOM    0x0a5c
1587 #define BRCMF_USB_DEVICE_ID_43236       0xbd17
1588 #define BRCMF_USB_DEVICE_ID_BCMFW       0x0bdc
1589
1590 static struct usb_device_id brcmf_usb_devid_table[] = {
1591         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43236) },
1592         /* special entry for device with firmware loaded and running */
1593         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
1594         { }
1595 };
1596 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
1597 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
1598
1599 /* TODO: suspend and resume entries */
1600 static struct usb_driver brcmf_usbdrvr = {
1601         .name = KBUILD_MODNAME,
1602         .probe = brcmf_usb_probe,
1603         .disconnect = brcmf_usb_disconnect,
1604         .id_table = brcmf_usb_devid_table,
1605         .suspend = brcmf_usb_suspend,
1606         .resume = brcmf_usb_resume,
1607         .supports_autosuspend = 1
1608 };
1609
1610 void brcmf_usb_exit(void)
1611 {
1612         usb_deregister(&brcmf_usbdrvr);
1613         kfree(g_image.data);
1614         g_image.data = NULL;
1615         g_image.len = 0;
1616 }
1617
1618 void brcmf_usb_init(void)
1619 {
1620         usb_register(&brcmf_usbdrvr);
1621 }