drivers/net/usb/qcusbnet/qmidevice.c

   1 /* qmidevice.c - gobi QMI device
   2  * Copyright (c) 2010, Code Aurora Forum. All rights reserved.
   3
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 and
   6  * only version 2 as published by the Free Software Foundation.
   7
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  11  * GNU General Public License for more details.
  12
  13  * You should have received a copy of the GNU General Public License
  14  * along with this program; if not, write to the Free Software
  15  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  16  * 02110-1301, USA.
  17  */
  18
  19 #include "qmidevice.h"
  20 #include "qcusbnet.h"
  21 #include <linux/poll.h>
  22
  23 struct readreq {
  24         struct list_head node;
  25         void *data;
  26         u16 tid;
  27         u16 size;
  28 };
  29
  30 struct notifyreq {
  31         struct list_head node;
  32         void (*func)(struct qcusbnet *, u16, void *);
  33         u16  tid;
  34         void *data;
  35 };
  36
  37 struct client {
  38         struct list_head node;
  39         u16 cid;
  40         struct list_head reads;
  41         struct list_head notifies;
  42         struct list_head urbs;
  43         wait_queue_head_t read_wait;
  44 };
  45
  46 struct urbsetup {
  47         u8 type;
  48         u8 code;
  49         u16 value;
  50         u16 index;
  51         u16 len;
  52 };
  53
  54 struct qmihandle {
  55         u16 cid;
  56         struct qcusbnet *dev;
  57 };
  58
  59 extern int debug;
  60 static int qcusbnet2k_fwdelay;
  61
  62 static bool device_valid(struct qcusbnet *dev);
  63 static struct client *client_bycid(struct qcusbnet *dev, u16 cid);
  64 static bool client_addread(struct qcusbnet *dev, u16 cid, u16 tid, void *data, u16 size);
  65 static bool client_delread(struct qcusbnet *dev, u16 cid, u16 tid, void **data, u16 *size);
  66 static bool client_addnotify(struct qcusbnet *dev, u16 cid, u16 tid,
  67                              void (*hook)(struct qcusbnet *, u16 cid, void *),
  68                              void *data);
  69 static bool client_notify(struct qcusbnet *dev, u16 cid, u16 tid);
  70 static bool client_addurb(struct qcusbnet *dev, u16 cid, struct urb *urb);
  71 static struct urb *client_delurb(struct qcusbnet *dev, u16 cid);
  72
  73 static int devqmi_open(struct inode *inode, struct file *file);
  74 static long devqmi_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
  75 static int devqmi_close(struct file *file, fl_owner_t ftable);
  76 static ssize_t devqmi_read(struct file *file, char __user *buf, size_t size,
  77                            loff_t *pos);
  78 static ssize_t devqmi_write(struct file *file, const char __user *buf,
  79                             size_t size, loff_t *pos);
  80 static unsigned int devqmi_poll(struct file *file, poll_table *wait);
  81
  82 static bool qmi_ready(struct qcusbnet *dev, u16 timeout);
  83 static void wds_callback(struct qcusbnet *dev, u16 cid, void *data);
  84 static int setup_wds_callback(struct qcusbnet *dev);
  85 static int qmidms_getmeid(struct qcusbnet *dev);
  86
  87 #define IOCTL_QMI_GET_SERVICE_FILE      (0x8BE0 + 1)
  88 #define IOCTL_QMI_GET_DEVICE_VIDPID     (0x8BE0 + 2)
  89 #define IOCTL_QMI_GET_DEVICE_MEID       (0x8BE0 + 3)
  90 #define CDC_GET_MASK                    0xFFFFll
  91 #define CDC_GET_ENCAPSULATED_RESPONSE   0x01A1ll
  92 #define CDC_CONNECTION_SPEED_CHANGE     0x08000000002AA1ll
  93
  94 static const struct file_operations devqmi_fops = {
  95         .owner = THIS_MODULE,
  96         .read  = devqmi_read,
  97         .write = devqmi_write,
  98         .unlocked_ioctl = devqmi_ioctl,
  99         .open  = devqmi_open,
 100         .flush = devqmi_close,
 101         .poll  = devqmi_poll,
 102 };
 103
 104 #ifdef CONFIG_SMP
 105 static inline void assert_locked(struct qcusbnet *dev)
 106 {
 107         BUG_ON(!spin_is_locked(&dev->qmi.clients_lock));
 108 }
 109 #else
 110 static inline void assert_locked(struct qcusbnet *dev)
 111 {
 112
 113 }
 114 #endif
 115
 116 static bool device_valid(struct qcusbnet *dev)
 117 {
 118         return dev && dev->valid;
 119 }
 120
 121 void qc_setdown(struct qcusbnet *dev, u8 reason)
 122 {
 123         set_bit(reason, &dev->down);
 124         netif_carrier_off(dev->usbnet->net);
 125 }
 126
 127 void qc_cleardown(struct qcusbnet *dev, u8 reason)
 128 {
 129         clear_bit(reason, &dev->down);
 130         if (!dev->down)
 131                 netif_carrier_on(dev->usbnet->net);
 132 }
 133
 134 bool qc_isdown(struct qcusbnet *dev, u8 reason)
 135 {
 136         return test_bit(reason, &dev->down);
 137 }
 138
 139 static void read_callback(struct urb *urb)
 140 {
 141         struct list_head *node;
 142         int result;
 143         u16 cid;
 144         struct client *client;
 145         void *data;
 146         void *copy;
 147         u16 size;
 148         struct qcusbnet *dev;
 149         unsigned long flags;
 150         u16 tid;
 151
 152         if (!urb) {
 153                 ERR("bad read URB\n");
 154                 return;
 155         }
 156
 157         dev = urb->context;
 158         if (!device_valid(dev)) {
 159                 ERR("Invalid device!\n");
 160                 return;
 161         }
 162
 163         if (urb->status) {
 164                 DBG("Read status = %d\n", urb->status);
 165                 return;
 166         }
 167
 168         DBG("Read %d bytes\n", urb->actual_length);
 169
 170         data = urb->transfer_buffer;
 171         size = urb->actual_length;
 172
 173         if (debug)
 174                 print_hex_dump(KERN_INFO, "QCUSBNet2k: ", DUMP_PREFIX_OFFSET,
 175                        16, 1, data, size, true);
 176
 177         result = qmux_parse(&cid, data, size);
 178         if (result < 0) {
 179                 ERR("Read error parsing QMUX %d\n", result);
 180                 return;
 181         }
 182
 183         if (size < result + 3) {
 184                 DBG("Data buffer too small to parse\n");
 185                 return;
 186         }
 187
 188         if (cid == QMICTL)
 189                 tid = *(u8 *)(data + result + 1);
 190         else
 191                 tid = *(u16 *)(data + result + 1);
 192         spin_lock_irqsave(&dev->qmi.clients_lock, flags);
 193
 194         list_for_each(node, &dev->qmi.clients) {
 195                 client = list_entry(node, struct client, node);
 196                 if (client->cid == cid || (client->cid | 0xff00) == cid) {
 197                         copy = kmalloc(size, GFP_ATOMIC);
 198                         if (!copy) {
 199                                 ERR("malloc failed\n");
 200                                 spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 201                                 return;
 202                         }
 203                         memcpy(copy, data, size);
 204                         if (!client_addread(dev, client->cid, tid, copy, size)) {
 205                                 ERR("Error allocating pReadMemListEntry "
 206                                           "read will be discarded\n");
 207                                 kfree(copy);
 208                                 spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 209                                 return;
 210                         }
 211
 212                         wake_up_interruptible(&client->read_wait);
 213
 214                         DBG("Creating new readListEntry for client 0x%04X, TID %x\n",
 215                             cid, tid);
 216
 217                         client_notify(dev, client->cid, tid);
 218
 219                         if (cid >> 8 != 0xff)
 220                                 break;
 221                 }
 222         }
 223
 224         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 225 }
 226
 227 static void int_callback(struct urb *urb)
 228 {
 229         int status;
 230         int interval;
 231         struct qcusbnet *dev = (struct qcusbnet *)urb->context;
 232
 233         if (!device_valid(dev)) {
 234                 ERR("Invalid device!\n");
 235                 return;
 236         }
 237
 238         if (urb->status) {
 239                 DBG("Int status = %d\n", urb->status);
 240                 if (urb->status != -EOVERFLOW)
 241                         return;
 242         } else {
 243                 if ((urb->actual_length == 8) &&
 244                     (*(u64 *)urb->transfer_buffer & CDC_GET_MASK) ==
 245                                         CDC_GET_ENCAPSULATED_RESPONSE) {
 246                         usb_fill_control_urb(dev->qmi.readurb, dev->usbnet->udev,
 247                                              usb_rcvctrlpipe(dev->usbnet->udev, 0),
 248                                              (unsigned char *)dev->qmi.readsetup,
 249                                              dev->qmi.readbuf,
 250                                              DEFAULT_READ_URB_LENGTH,
 251                                              read_callback, dev);
 252                         status = usb_submit_urb(dev->qmi.readurb, GFP_ATOMIC);
 253                         if (status) {
 254                                 ERR("Error submitting Read URB %d\n", status);
 255                                 return;
 256                         }
 257                 } else if ((urb->actual_length == 16) &&
 258                            (*(u64 *)urb->transfer_buffer == CDC_CONNECTION_SPEED_CHANGE)) {
 259                         /* if upstream or downstream is 0, stop traffic.
 260                          * Otherwise resume it */
 261                         if ((*(u32 *)(urb->transfer_buffer + 8) == 0) ||
 262                             (*(u32 *)(urb->transfer_buffer + 12) == 0)) {
 263                                 qc_setdown(dev, DOWN_CDC_CONNECTION_SPEED);
 264                                 DBG("traffic stopping due to CONNECTION_SPEED_CHANGE\n");
 265                         } else {
 266                                 qc_cleardown(dev, DOWN_CDC_CONNECTION_SPEED);
 267                                 DBG("resuming traffic due to CONNECTION_SPEED_CHANGE\n");
 268                         }
 269                 } else {
 270                         DBG("ignoring invalid interrupt in packet\n");
 271                         if (debug)
 272                                 print_hex_dump(KERN_INFO, "QCUSBNet2k: ",
 273                                        DUMP_PREFIX_OFFSET, 16, 1,
 274                                        urb->transfer_buffer,
 275                                        urb->actual_length, true);
 276                 }
 277         }
 278
 279         interval = (dev->usbnet->udev->speed == USB_SPEED_HIGH) ? 7 : 3;
 280
 281         usb_fill_int_urb(urb, urb->dev, urb->pipe, urb->transfer_buffer,
 282                          urb->transfer_buffer_length, urb->complete,
 283                          urb->context, interval);
 284         status = usb_submit_urb(urb, GFP_ATOMIC);
 285         if (status)
 286                 ERR("Error re-submitting Int URB %d\n", status);
 287         return;
 288 }
 289
 290 int qc_startread(struct qcusbnet *dev)
 291 {
 292         int interval;
 293         int numends;
 294         int i;
 295         struct usb_host_endpoint *endpoint = NULL;
 296
 297         if (!device_valid(dev)) {
 298                 ERR("Invalid device!\n");
 299                 return -ENXIO;
 300         }
 301
 302         dev->qmi.readurb = usb_alloc_urb(0, GFP_KERNEL);
 303         if (!dev->qmi.readurb) {
 304                 ERR("Error allocating read urb\n");
 305                 return -ENOMEM;
 306         }
 307
 308         dev->qmi.inturb = usb_alloc_urb(0, GFP_KERNEL);
 309         if (!dev->qmi.inturb) {
 310                 usb_free_urb(dev->qmi.readurb);
 311                 ERR("Error allocating int urb\n");
 312                 return -ENOMEM;
 313         }
 314
 315         dev->qmi.readbuf = kmalloc(DEFAULT_READ_URB_LENGTH, GFP_KERNEL);
 316         if (!dev->qmi.readbuf) {
 317                 usb_free_urb(dev->qmi.readurb);
 318                 usb_free_urb(dev->qmi.inturb);
 319                 ERR("Error allocating read buffer\n");
 320                 return -ENOMEM;
 321         }
 322
 323         dev->qmi.intbuf = kmalloc(DEFAULT_READ_URB_LENGTH, GFP_KERNEL);
 324         if (!dev->qmi.intbuf) {
 325                 usb_free_urb(dev->qmi.readurb);
 326                 usb_free_urb(dev->qmi.inturb);
 327                 kfree(dev->qmi.readbuf);
 328                 ERR("Error allocating int buffer\n");
 329                 return -ENOMEM;
 330         }
 331
 332         dev->qmi.readsetup = kmalloc(sizeof(*dev->qmi.readsetup), GFP_KERNEL);
 333         if (!dev->qmi.readsetup) {
 334                 usb_free_urb(dev->qmi.readurb);
 335                 usb_free_urb(dev->qmi.inturb);
 336                 kfree(dev->qmi.readbuf);
 337                 kfree(dev->qmi.intbuf);
 338                 ERR("Error allocating setup packet buffer\n");
 339                 return -ENOMEM;
 340         }
 341
 342         dev->qmi.readsetup->type = 0xA1;
 343         dev->qmi.readsetup->code = 1;
 344         dev->qmi.readsetup->value = 0;
 345         dev->qmi.readsetup->index = dev->iface->cur_altsetting->desc.bInterfaceNumber;
 346         dev->qmi.readsetup->len = DEFAULT_READ_URB_LENGTH;
 347
 348         interval = (dev->usbnet->udev->speed == USB_SPEED_HIGH) ? 7 : 3;
 349
 350         numends = dev->iface->cur_altsetting->desc.bNumEndpoints;
 351         for (i = 0; i < numends; i++) {
 352                 endpoint = dev->iface->cur_altsetting->endpoint + i;
 353                 if (!endpoint) {
 354                         ERR("invalid endpoint %u\n", i);
 355                         return -EINVAL;
 356                 }
 357
 358                 if (usb_endpoint_dir_in(&endpoint->desc)
 359                   && usb_endpoint_xfer_int(&endpoint->desc)) {
 360                         DBG("Interrupt endpoint is %x\n", endpoint->desc.bEndpointAddress);
 361                         break;
 362                 }
 363         }
 364
 365         usb_fill_int_urb(dev->qmi.inturb, dev->usbnet->udev,
 366                          usb_rcvintpipe(dev->usbnet->udev, endpoint->desc.bEndpointAddress),
 367                          dev->qmi.intbuf, DEFAULT_READ_URB_LENGTH,
 368                          int_callback, dev, interval);
 369
 370         return usb_submit_urb(dev->qmi.inturb, GFP_KERNEL);
 371 }
 372
 373 void qc_stopread(struct qcusbnet *dev)
 374 {
 375         if (dev->qmi.readurb) {
 376                 DBG("Killing read URB\n");
 377                 usb_kill_urb(dev->qmi.readurb);
 378         }
 379
 380         if (dev->qmi.inturb) {
 381                 DBG("Killing int URB\n");
 382                 usb_kill_urb(dev->qmi.inturb);
 383         }
 384
 385         kfree(dev->qmi.readsetup);
 386         dev->qmi.readsetup = NULL;
 387         kfree(dev->qmi.readbuf);
 388         dev->qmi.readbuf = NULL;
 389         kfree(dev->qmi.intbuf);
 390         dev->qmi.intbuf = NULL;
 391
 392         usb_free_urb(dev->qmi.readurb);
 393         dev->qmi.readurb = NULL;
 394         usb_free_urb(dev->qmi.inturb);
 395         dev->qmi.inturb = NULL;
 396 }
 397
 398 static int read_async(struct qcusbnet *dev, u16 cid, u16 tid,
 399                       void (*hook)(struct qcusbnet *, u16, void *),
 400                       void *data)
 401 {
 402         struct list_head *node;
 403         struct client *client;
 404         struct readreq *readreq;
 405
 406         unsigned long flags;
 407
 408         if (!device_valid(dev)) {
 409                 ERR("Invalid device!\n");
 410                 return -ENXIO;
 411         }
 412
 413         spin_lock_irqsave(&dev->qmi.clients_lock, flags);
 414
 415         client = client_bycid(dev, cid);
 416         if (!client) {
 417                 ERR("Could not find matching client ID 0x%04X\n", cid);
 418                 spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 419                 return -ENXIO;
 420         }
 421
 422         list_for_each(node, &client->reads) {
 423                 readreq = list_entry(node, struct readreq, node);
 424                 if (!tid || tid == readreq->tid) {
 425                         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 426                         hook(dev, cid, data);
 427                         return 0;
 428                 }
 429         }
 430
 431         if (!client_addnotify(dev, cid, tid, hook, data))
 432                 ERR("Unable to register for notification\n");
 433
 434         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 435         return 0;
 436 }
 437
 438 static void upsem(struct qcusbnet *dev, u16 cid, void *data)
 439 {
 440         DBG("0x%04X\n", cid);
 441         up((struct semaphore *)data);
 442 }
 443
 444 static int read_sync(struct qcusbnet *dev, void **buf, u16 cid, u16 tid)
 445 {
 446         struct list_head *node;
 447         int result;
 448         struct client *client;
 449         struct notifyreq *notify;
 450         struct semaphore sem;
 451         void *data;
 452         unsigned long flags;
 453         u16 size;
 454
 455         if (!device_valid(dev)) {
 456                 ERR("Invalid device!\n");
 457                 return -ENXIO;
 458         }
 459
 460         spin_lock_irqsave(&dev->qmi.clients_lock, flags);
 461
 462         client = client_bycid(dev, cid);
 463         if (!client) {
 464                 ERR("Could not find matching client ID 0x%04X\n", cid);
 465                 spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 466                 return -ENXIO;
 467         }
 468
 469         while (!client_delread(dev, cid, tid, &data, &size)) {
 470                 sema_init(&sem, 0);
 471                 if (!client_addnotify(dev, cid, tid, upsem, &sem)) {
 472                         ERR("unable to register for notification\n");
 473                         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 474                         return -EFAULT;
 475                 }
 476
 477                 spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 478
 479                 result = down_interruptible(&sem);
 480                 if (result) {
 481                         DBG("Interrupted %d\n", result);
 482                         spin_lock_irqsave(&dev->qmi.clients_lock, flags);
 483                         list_for_each(node, &client->notifies) {
 484                                 notify = list_entry(node, struct notifyreq, node);
 485                                 if (notify->data == &sem) {
 486                                         list_del(&notify->node);
 487                                         kfree(notify);
 488                                         break;
 489                                 }
 490                         }
 491
 492                         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 493                         return -EINTR;
 494                 }
 495
 496                 if (!device_valid(dev)) {
 497                         ERR("Invalid device!\n");
 498                         return -ENXIO;
 499                 }
 500
 501                 spin_lock_irqsave(&dev->qmi.clients_lock, flags);
 502         }
 503
 504         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 505         *buf = data;
 506         return size;
 507 }
 508
 509 static void write_callback(struct urb *urb)
 510 {
 511         if (!urb) {
 512                 ERR("null urb\n");
 513                 return;
 514         }
 515
 516         DBG("Write status/size %d/%d\n", urb->status, urb->actual_length);
 517         up((struct semaphore *)urb->context);
 518 }
 519
 520 static int write_sync(struct qcusbnet *dev, char *buf, int size, u16 cid)
 521 {
 522         int result;
 523         struct semaphore sem;
 524         struct urb *urb;
 525         struct urbsetup setup;
 526         unsigned long flags;
 527
 528         if (!device_valid(dev)) {
 529                 ERR("Invalid device!\n");
 530                 return -ENXIO;
 531         }
 532
 533         urb = usb_alloc_urb(0, GFP_KERNEL);
 534         if (!urb) {
 535                 ERR("URB mem error\n");
 536                 return -ENOMEM;
 537         }
 538
 539         result = qmux_fill(cid, buf, size);
 540         if (result < 0) {
 541                 usb_free_urb(urb);
 542                 return result;
 543         }
 544
 545         /* CDC Send Encapsulated Request packet */
 546         setup.type = 0x21;
 547         setup.code = 0;
 548         setup.value = 0;
 549         setup.index = dev->iface->cur_altsetting->desc.bInterfaceNumber;
 550         setup.len = 0;
 551         setup.len = size;
 552
 553         usb_fill_control_urb(urb, dev->usbnet->udev,
 554                              usb_sndctrlpipe(dev->usbnet->udev, 0),
 555                              (unsigned char *)&setup, (void *)buf, size,
 556                              NULL, dev);
 557
 558         DBG("Actual Write:\n");
 559         if (debug)
 560                 print_hex_dump(KERN_INFO,  "QCUSBNet2k: ", DUMP_PREFIX_OFFSET,
 561                        16, 1, buf, size, true);
 562
 563         sema_init(&sem, 0);
 564
 565         urb->complete = write_callback;
 566         urb->context = &sem;
 567
 568         result = usb_autopm_get_interface(dev->iface);
 569         if (result < 0) {
 570                 ERR("unable to resume interface: %d\n", result);
 571                 if (result == -EPERM)
 572                         qc_suspend(dev->iface, PMSG_SUSPEND);
 573
 574                 return result;
 575         }
 576
 577         spin_lock_irqsave(&dev->qmi.clients_lock, flags);
 578
 579         if (!client_addurb(dev, cid, urb)) {
 580                 usb_free_urb(urb);
 581                 spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 582                 usb_autopm_put_interface(dev->iface);
 583                 return -EINVAL;
 584         }
 585
 586         result = usb_submit_urb(urb, GFP_KERNEL);
 587         if (result < 0) {
 588                 ERR("submit URB error %d\n", result);
 589                 if (client_delurb(dev, cid) != urb)
 590                         ERR("Didn't get write URB back\n");
 591
 592                 usb_free_urb(urb);
 593
 594                 spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 595                 usb_autopm_put_interface(dev->iface);
 596                 return result;
 597         }
 598
 599         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 600         result = down_interruptible(&sem);
 601         if (!device_valid(dev)) {
 602                 ERR("Invalid device!\n");
 603                 return -ENXIO;
 604         }
 605
 606         usb_autopm_put_interface(dev->iface);
 607         spin_lock_irqsave(&dev->qmi.clients_lock, flags);
 608         if (client_delurb(dev, cid) != urb) {
 609                 ERR("Didn't get write URB back\n");
 610                 spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 611                 return -EINVAL;
 612         }
 613         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 614
 615         if (!result) {
 616                 if (!urb->status) {
 617                         result = size;
 618                 } else {
 619                         ERR("bad status = %d\n", urb->status);
 620                         result = urb->status;
 621                 }
 622         } else {
 623                 ERR("Interrupted %d !!!\n", result);
 624                 ERR("Device may be in bad state and need reset !!!\n");
 625                 usb_kill_urb(urb);
 626         }
 627
 628         usb_free_urb(urb);
 629         return result;
 630 }
 631
 632 static int client_alloc(struct qcusbnet *dev, u8 type)
 633 {
 634         u16 cid;
 635         struct client *client;
 636         int result;
 637         void *wbuf;
 638         size_t wbufsize;
 639         void *rbuf;
 640         u16 rbufsize;
 641         unsigned long flags;
 642         u8 tid;
 643
 644         if (!device_valid(dev)) {
 645                 ERR("Invalid device!\n");
 646                 return -ENXIO;
 647         }
 648
 649         if (type) {
 650                 tid = atomic_add_return(1, &dev->qmi.qmitid);
 651                 if (!tid)
 652                         atomic_add_return(1, &dev->qmi.qmitid);
 653                 wbuf = qmictl_new_getcid(tid, type, &wbufsize);
 654                 if (!wbuf)
 655                         return -ENOMEM;
 656                 result = write_sync(dev, wbuf, wbufsize, QMICTL);
 657                 kfree(wbuf);
 658
 659                 if (result < 0)
 660                         return result;
 661
 662                 result = read_sync(dev, &rbuf, QMICTL, tid);
 663                 if (result < 0) {
 664                         ERR("bad read data %d\n", result);
 665                         return result;
 666                 }
 667                 rbufsize = result;
 668
 669                 result = qmictl_alloccid_resp(rbuf, rbufsize, &cid);
 670                 kfree(rbuf);
 671
 672                 if (result < 0)
 673                         return result;
 674         } else {
 675                 cid = 0;
 676         }
 677
 678         spin_lock_irqsave(&dev->qmi.clients_lock, flags);
 679         if (client_bycid(dev, cid)) {
 680                 DBG("Client memory already exists\n");
 681                 spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 682                 return -ETOOMANYREFS;
 683         }
 684
 685         client = kmalloc(sizeof(*client), GFP_ATOMIC);
 686         if (!client) {
 687                 ERR("Error allocating read list\n");
 688                 spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 689                 return -ENOMEM;
 690         }
 691
 692         list_add_tail(&client->node, &dev->qmi.clients);
 693         client->cid = cid;
 694         INIT_LIST_HEAD(&client->reads);
 695         INIT_LIST_HEAD(&client->notifies);
 696         INIT_LIST_HEAD(&client->urbs);
 697         init_waitqueue_head(&client->read_wait);
 698         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 699         return cid;
 700 }
 701
 702 static void client_free(struct qcusbnet *dev, u16 cid)
 703 {
 704         struct list_head *node, *tmp;
 705         int result;
 706         struct client *client;
 707         struct urb *urb;
 708         void *data;
 709         u16 size;
 710         void *wbuf;
 711         size_t wbufsize;
 712         void *rbuf;
 713         u16 rbufsize;
 714         unsigned long flags;
 715         u8 tid;
 716
 717         if (!device_valid(dev)) {
 718                 ERR("invalid device\n");
 719                 return;
 720         }
 721
 722         DBG("releasing 0x%04X\n", cid);
 723
 724         if (cid != QMICTL) {
 725                 tid = atomic_add_return(1, &dev->qmi.qmitid);
 726                 if (!tid)
 727                         tid = atomic_add_return(1, &dev->qmi.qmitid);
 728                 wbuf = qmictl_new_releasecid(tid, cid, &wbufsize);
 729                 if (!wbuf) {
 730                         ERR("memory error\n");
 731                 } else {
 732                         result = write_sync(dev, wbuf, wbufsize, QMICTL);
 733                         kfree(wbuf);
 734
 735                         if (result < 0) {
 736                                 ERR("bad write status %d\n", result);
 737                         } else {
 738                                 result = read_sync(dev, &rbuf, QMICTL, tid);
 739                                 if (result < 0) {
 740                                         ERR("bad read status %d\n", result);
 741                                 } else {
 742                                         rbufsize = result;
 743                                         result = qmictl_freecid_resp(rbuf, rbufsize);
 744                                         kfree(rbuf);
 745                                         if (result < 0)
 746                                                 ERR("error %d parsing response\n", result);
 747                                 }
 748                         }
 749                 }
 750         }
 751
 752         spin_lock_irqsave(&dev->qmi.clients_lock, flags);
 753         list_for_each_safe(node, tmp, &dev->qmi.clients) {
 754                 client = list_entry(node, struct client, node);
 755                 if (client->cid == cid) {
 756                         while (client_notify(dev, cid, 0))
 757                                 ;
 758
 759                         urb = client_delurb(dev, cid);
 760                         while (urb != NULL) {
 761                                 usb_kill_urb(urb);
 762                                 usb_free_urb(urb);
 763                                 urb = client_delurb(dev, cid);
 764                         }
 765
 766                         while (client_delread(dev, cid, 0, &data, &size))
 767                                 kfree(data);
 768
 769                         list_del(&client->node);
 770                         kfree(client);
 771                 }
 772         }
 773
 774         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
 775 }
 776
 777 struct client *client_bycid(struct qcusbnet *dev, u16 cid)
 778 {
 779         struct list_head *node;
 780         struct client *client;
 781
 782         if (!device_valid(dev)) {
 783                 ERR("Invalid device\n");
 784                 return NULL;
 785         }
 786
 787         assert_locked(dev);
 788
 789         list_for_each(node, &dev->qmi.clients) {
 790                 client = list_entry(node, struct client, node);
 791                 if (client->cid == cid)
 792                         return client;
 793         }
 794
 795         DBG("Could not find client mem 0x%04X\n", cid);
 796         return NULL;
 797 }
 798
 799 static bool client_addread(struct qcusbnet *dev, u16 cid, u16 tid, void *data,
 800                            u16 size)
 801 {
 802         struct client *client;
 803         struct readreq *req;
 804
 805         assert_locked(dev);
 806
 807         client = client_bycid(dev, cid);
 808         if (!client) {
 809                 ERR("Could not find this client's memory 0x%04X\n", cid);
 810                 return false;
 811         }
 812
 813         req = kmalloc(sizeof(*req), GFP_ATOMIC);
 814         if (!req) {
 815                 ERR("Mem error\n");
 816                 return false;
 817         }
 818
 819         req->data = data;
 820         req->size = size;
 821         req->tid = tid;
 822
 823         list_add_tail(&req->node, &client->reads);
 824
 825         return true;
 826 }
 827
 828 static bool client_delread(struct qcusbnet *dev, u16 cid, u16 tid, void **data,
 829                            u16 *size)
 830 {
 831         struct client *client;
 832         struct readreq *req;
 833         struct list_head *node;
 834
 835         assert_locked(dev);
 836
 837         client = client_bycid(dev, cid);
 838         if (!client) {
 839                 ERR("Could not find this client's memory 0x%04X\n", cid);
 840                 return false;
 841         }
 842
 843         list_for_each(node, &client->reads) {
 844                 req = list_entry(node, struct readreq, node);
 845                 if (!tid || tid == req->tid) {
 846                         *data = req->data;
 847                         *size = req->size;
 848                         list_del(&req->node);
 849                         kfree(req);
 850                         return true;
 851                 }
 852
 853                 DBG("skipping 0x%04X data TID = %x\n", cid, req->tid);
 854         }
 855
 856         DBG("No read memory to pop, Client 0x%04X, TID = %x\n", cid, tid);
 857         return false;
 858 }
 859
 860 static bool client_addnotify(struct qcusbnet *dev, u16 cid, u16 tid,
 861                              void (*hook)(struct qcusbnet *, u16, void *),
 862                              void *data)
 863 {
 864         struct client *client;
 865         struct notifyreq *req;
 866
 867         assert_locked(dev);
 868
 869         client = client_bycid(dev, cid);
 870         if (!client) {
 871                 ERR("Could not find this client's memory 0x%04X\n", cid);
 872                 return false;
 873         }
 874
 875         req = kmalloc(sizeof(*req), GFP_ATOMIC);
 876         if (!req) {
 877                 ERR("Mem error\n");
 878                 return false;
 879         }
 880
 881         list_add_tail(&req->node, &client->notifies);
 882         req->func = hook;
 883         req->data = data;
 884         req->tid = tid;
 885
 886         return true;
 887 }
 888
 889 static bool client_notify(struct qcusbnet *dev, u16 cid, u16 tid)
 890 {
 891         struct client *client;
 892         struct notifyreq *delnotify, *notify;
 893         struct list_head *node;
 894
 895         assert_locked(dev);
 896
 897         client = client_bycid(dev, cid);
 898         if (!client) {
 899                 ERR("Could not find this client's memory 0x%04X\n", cid);
 900                 return false;
 901         }
 902
 903         delnotify = NULL;
 904
 905         list_for_each(node, &client->notifies) {
 906                 notify = list_entry(node, struct notifyreq, node);
 907                 if (!tid || !notify->tid || tid == notify->tid) {
 908                         delnotify = notify;
 909                         break;
 910                 }
 911
 912                 DBG("skipping data TID = %x\n", notify->tid);
 913         }
 914
 915         if (delnotify) {
 916                 list_del(&delnotify->node);
 917                 if (delnotify->func) {
 918                         spin_unlock(&dev->qmi.clients_lock);
 919                         delnotify->func(dev, cid, delnotify->data);
 920                         spin_lock(&dev->qmi.clients_lock);
 921                 }
 922                 kfree(delnotify);
 923                 return true;
 924         }
 925
 926         DBG("no one to notify for TID %x\n", tid);
 927         return false;
 928 }
 929
 930 static bool client_addurb(struct qcusbnet *dev, u16 cid, struct urb *urb)
 931 {
 932         struct client *client;
 933         struct urbreq *req;
 934
 935         assert_locked(dev);
 936
 937         client = client_bycid(dev, cid);
 938         if (!client) {
 939                 ERR("Could not find this client's memory 0x%04X\n", cid);
 940                 return false;
 941         }
 942
 943         req = kmalloc(sizeof(*req), GFP_ATOMIC);
 944         if (!req) {
 945                 ERR("Mem error\n");
 946                 return false;
 947         }
 948
 949         req->urb = urb;
 950         list_add_tail(&req->node, &client->urbs);
 951
 952         return true;
 953 }
 954
 955 static struct urb *client_delurb(struct qcusbnet *dev, u16 cid)
 956 {
 957         struct client *client;
 958         struct urbreq *req;
 959         struct urb *urb;
 960
 961         assert_locked(dev);
 962
 963         client = client_bycid(dev, cid);
 964         if (!client) {
 965                 ERR("Could not find this client's memory 0x%04X\n", cid);
 966                 return NULL;
 967         }
 968
 969         if (list_empty(&client->urbs)) {
 970                 DBG("No URB's to pop\n");
 971                 return NULL;
 972         }
 973
 974         req = list_first_entry(&client->urbs, struct urbreq, node);
 975         list_del(&req->node);
 976         urb = req->urb;
 977         kfree(req);
 978         return urb;
 979 }
 980
 981 static int devqmi_open(struct inode *inode, struct file *file)
 982 {
 983         struct qmihandle *handle;
 984         struct qmidev *qmidev = container_of(inode->i_cdev, struct qmidev, cdev);
 985         struct qcusbnet *dev = container_of(qmidev, struct qcusbnet, qmi);
 986
 987         if (!device_valid(dev)) {
 988                 ERR("Invalid device\n");
 989                 return -ENXIO;
 990         }
 991
 992         file->private_data = kmalloc(sizeof(struct qmihandle), GFP_KERNEL);
 993         if (!file->private_data) {
 994                 ERR("Mem error\n");
 995                 return -ENOMEM;
 996         }
 997
 998         handle = (struct qmihandle *)file->private_data;
 999         handle->cid = (u16)-1;
1000         handle->dev = dev;
1001
1002         return 0;
1003 }
1004
1005 static long devqmi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1006 {
1007         int result;
1008         u32 vidpid;
1009
1010         struct qmihandle *handle = (struct qmihandle *)file->private_data;
1011
1012         if (!handle) {
1013                 ERR("Bad file data\n");
1014                 return -EBADF;
1015         }
1016
1017         if (!device_valid(handle->dev)) {
1018                 ERR("Invalid device! Updating f_ops\n");
1019                 file->f_op = file->f_dentry->d_inode->i_fop;
1020                 return -ENXIO;
1021         }
1022
1023         switch (cmd) {
1024         case IOCTL_QMI_GET_SERVICE_FILE:
1025
1026                 DBG("Setting up QMI for service %lu\n", arg);
1027                 if (!(u8)arg) {
1028                         ERR("Cannot use QMICTL from userspace\n");
1029                         return -EINVAL;
1030                 }
1031
1032                 if (handle->cid != (u16)-1) {
1033                         ERR("Close the current connection before opening a new one\n");
1034                         return -EBADR;
1035                 }
1036
1037                 result = client_alloc(handle->dev, (u8)arg);
1038                 if (result < 0)
1039                         return result;
1040                 handle->cid = result;
1041
1042                 return 0;
1043                 break;
1044
1045
1046         case IOCTL_QMI_GET_DEVICE_VIDPID:
1047                 if (!arg) {
1048                         ERR("Bad VIDPID buffer\n");
1049                         return -EINVAL;
1050                 }
1051
1052                 if (!handle->dev->usbnet) {
1053                         ERR("Bad usbnet\n");
1054                         return -ENOMEM;
1055                 }
1056
1057                 if (!handle->dev->usbnet->udev) {
1058                         ERR("Bad udev\n");
1059                         return -ENOMEM;
1060                 }
1061
1062                 vidpid = ((le16_to_cpu(handle->dev->usbnet->udev->descriptor.idVendor) << 16)
1063                           + le16_to_cpu(handle->dev->usbnet->udev->descriptor.idProduct));
1064
1065                 result = copy_to_user((unsigned int *)arg, &vidpid, 4);
1066                 if (result)
1067                         ERR("Copy to userspace failure\n");
1068
1069                 return result;
1070                 break;
1071
1072         case IOCTL_QMI_GET_DEVICE_MEID:
1073                 if (!arg) {
1074                         ERR("Bad MEID buffer\n");
1075                         return -EINVAL;
1076                 }
1077
1078                 result = copy_to_user((unsigned int *)arg, &handle->dev->meid[0], 14);
1079                 if (result)
1080                         ERR("copy to userspace failure\n");
1081
1082                 return result;
1083                 break;
1084         default:
1085                 return -EBADRQC;
1086         }
1087 }
1088
1089 static int devqmi_close(struct file *file, fl_owner_t ftable)
1090 {
1091         struct qmihandle *handle = (struct qmihandle *)file->private_data;
1092         struct list_head *tasks;
1093         struct task_struct *task;
1094         struct fdtable *fdtable;
1095         int count = 0;
1096         int used = 0;
1097         unsigned long flags;
1098
1099         if (!handle) {
1100                 ERR("bad file data\n");
1101                 return -EBADF;
1102         }
1103
1104         if (file_count(file) != 1) {
1105                 /* XXX: This can't possibly be safe. We don't hold any sort of
1106                  * lock here, and we're walking a list of threads... */
1107                 list_for_each(tasks, &current->group_leader->tasks) {
1108                         task = container_of(tasks, struct task_struct, tasks);
1109                         if (!task || !task->files)
1110                                 continue;
1111                         spin_lock_irqsave(&task->files->file_lock, flags);
1112                         fdtable = files_fdtable(task->files);
1113                         for (count = 0; count < fdtable->max_fds; count++) {
1114                                 /* Before this function was called, this file was removed
1115                                  * from our task's file table so if we find it in a file
1116                                  * table then it is being used by another task
1117                                  */
1118                                 if (fdtable->fd[count] == file) {
1119                                         used++;
1120                                         break;
1121                                 }
1122                         }
1123                         spin_unlock_irqrestore(&task->files->file_lock, flags);
1124                 }
1125
1126                 if (used > 0) {
1127                         DBG("not closing, as this FD is open by %d other process\n", used);
1128                         return 0;
1129                 }
1130         }
1131
1132         if (!device_valid(handle->dev)) {
1133                 ERR("Invalid device! Updating f_ops\n");
1134                 file->f_op = file->f_dentry->d_inode->i_fop;
1135                 return -ENXIO;
1136         }
1137
1138         DBG("0x%04X\n", handle->cid);
1139
1140         file->private_data = NULL;
1141
1142         if (handle->cid != (u16)-1)
1143                 client_free(handle->dev, handle->cid);
1144
1145         kfree(handle);
1146         return 0;
1147 }
1148
1149 static ssize_t devqmi_read(struct file *file, char __user *buf, size_t size,
1150                            loff_t *pos)
1151 {
1152         int result;
1153         void *data = NULL;
1154         void *smalldata;
1155         struct qmihandle *handle = (struct qmihandle *)file->private_data;
1156
1157         if (!handle) {
1158                 ERR("Bad file data\n");
1159                 return -EBADF;
1160         }
1161
1162         if (!device_valid(handle->dev)) {
1163                 ERR("Invalid device! Updating f_ops\n");
1164                 file->f_op = file->f_dentry->d_inode->i_fop;
1165                 return -ENXIO;
1166         }
1167
1168         if (handle->cid == (u16)-1) {
1169                 ERR("Client ID must be set before reading 0x%04X\n",
1170                     handle->cid);
1171                 return -EBADR;
1172         }
1173
1174         result = read_sync(handle->dev, &data, handle->cid, 0);
1175         if (result <= 0)
1176                 return result;
1177
1178         result -= qmux_size;
1179         smalldata = data + qmux_size;
1180
1181         if (result > size) {
1182                 ERR("Read data is too large for amount user has requested\n");
1183                 kfree(data);
1184                 return -EOVERFLOW;
1185         }
1186
1187         if (copy_to_user(buf, smalldata, result)) {
1188                 ERR("Error copying read data to user\n");
1189                 result = -EFAULT;
1190         }
1191
1192         kfree(data);
1193         return result;
1194 }
1195
1196 static ssize_t devqmi_write(struct file *file, const char __user * buf,
1197                             size_t size, loff_t *pos)
1198 {
1199         int status;
1200         void *wbuf;
1201         struct qmihandle *handle = (struct qmihandle *)file->private_data;
1202
1203         if (!handle) {
1204                 ERR("Bad file data\n");
1205                 return -EBADF;
1206         }
1207
1208         if (!device_valid(handle->dev)) {
1209                 ERR("Invalid device! Updating f_ops\n");
1210                 file->f_op = file->f_dentry->d_inode->i_fop;
1211                 return -ENXIO;
1212         }
1213
1214         if (handle->cid == (u16)-1) {
1215                 ERR("Client ID must be set before writing 0x%04X\n",
1216                           handle->cid);
1217                 return -EBADR;
1218         }
1219
1220         wbuf = kmalloc(size + qmux_size, GFP_KERNEL);
1221         if (!wbuf)
1222                 return -ENOMEM;
1223         status = copy_from_user(wbuf + qmux_size, buf, size);
1224         if (status) {
1225                 ERR("Unable to copy data from userspace %d\n", status);
1226                 kfree(wbuf);
1227                 return status;
1228         }
1229
1230         status = write_sync(handle->dev, wbuf, size + qmux_size,
1231                             handle->cid);
1232
1233         kfree(wbuf);
1234         if (status == size + qmux_size)
1235                 return size;
1236         return status;
1237 }
1238
1239 static unsigned int devqmi_poll(struct file *file, poll_table *wait)
1240 {
1241         struct qmihandle *handle = (struct qmihandle *)file->private_data;
1242         struct client *client;
1243         unsigned int mask = 0;
1244         unsigned long flags;
1245
1246         if (!handle) {
1247                 ERR("Bad file data\n");
1248                 return -EBADF;
1249         }
1250
1251         if (!device_valid(handle->dev)) {
1252                 ERR("Invalid device! Updating f_ops\n");
1253                 file->f_op = file->f_dentry->d_inode->i_fop;
1254                 return -ENXIO;
1255         }
1256
1257         if (handle->cid == (u16)-1) {
1258                 ERR("Client ID must be set before polling 0x%04X\n",
1259                           handle->cid);
1260                 return -EBADR;
1261         }
1262
1263         spin_lock_irqsave(&handle->dev->qmi.clients_lock, flags);
1264
1265         client = client_bycid(handle->dev, handle->cid);
1266         if (!client) {
1267                 ERR("Could not find matching client ID 0x%04X\n", handle->cid);
1268                 spin_unlock_irqrestore(&handle->dev->qmi.clients_lock, flags);
1269                 return -ENXIO;
1270         }
1271
1272         poll_wait(file, &client->read_wait, wait);
1273
1274         if (!list_empty(&client->reads))
1275                 mask |= POLLIN | POLLRDNORM;
1276
1277         spin_unlock_irqrestore(&handle->dev->qmi.clients_lock, flags);
1278
1279         return mask;
1280 }
1281
1282 int qc_register(struct qcusbnet *dev)
1283 {
1284         int result;
1285         int qmiidx = 0;
1286         dev_t devno;
1287         char *name;
1288
1289         cdev_init(&dev->qmi.cdev, &devqmi_fops);
1290         dev->qmi.cdev.owner = THIS_MODULE;
1291         dev->valid = true;
1292
1293         result = client_alloc(dev, QMICTL);
1294         if (result) {
1295                 dev->valid = false;
1296                 return result;
1297         }
1298         atomic_set(&dev->qmi.qmitid, 1);
1299
1300         result = qc_startread(dev);
1301         if (result) {
1302                 dev->valid = false;
1303                 return result;
1304         }
1305
1306         if (!qmi_ready(dev, 30000)) {
1307                 ERR("Device unresponsive to QMI\n");
1308                 return -ETIMEDOUT;
1309         }
1310
1311         result = setup_wds_callback(dev);
1312         if (result) {
1313                 dev->valid = false;
1314                 return result;
1315         }
1316
1317         result = qmidms_getmeid(dev);
1318         if (result) {
1319                 dev->valid = false;
1320                 return result;
1321         }
1322
1323         result = alloc_chrdev_region(&devno, 0, 1, "qcqmi");
1324         if (result < 0)
1325                 return result;
1326
1327         result = cdev_add(&dev->qmi.cdev, devno, 1);
1328         if (result) {
1329                 ERR("error adding cdev\n");
1330                 return result;
1331         }
1332
1333         name = strstr(dev->usbnet->net->name, "qmi");
1334         if (!name) {
1335                 ERR("Bad net name: %s\n", dev->usbnet->net->name);
1336                 return -ENXIO;
1337         }
1338         name += strlen("qmi");
1339         qmiidx = simple_strtoul(name, NULL, 10);
1340         if (qmiidx < 0) {
1341                 ERR("Bad minor number\n");
1342                 return -ENXIO;
1343         }
1344
1345         printk(KERN_INFO "creating qcqmi%d\n", qmiidx);
1346         device_create(dev->qmi.devclass, NULL, devno, NULL, "qcqmi%d", qmiidx);
1347
1348         dev->qmi.devnum = devno;
1349         return 0;
1350 }
1351
1352 void qc_deregister(struct qcusbnet *dev)
1353 {
1354         struct list_head *node;
1355         struct list_head *next;
1356         struct client *client;
1357         struct inode *inode;
1358         struct list_head *inodes;
1359         struct list_head *tasks;
1360         struct task_struct *task;
1361         struct fdtable *fdtable;
1362         struct file *file;
1363         unsigned long flags;
1364         int count = 0;
1365
1366         if (!device_valid(dev)) {
1367                 ERR("wrong device\n");
1368                 return;
1369         }
1370
1371         list_for_each_safe(node, next, &dev->qmi.clients) {
1372                 client = list_entry(node, struct client, node);
1373                 DBG("release 0x%04X\n", client->cid);
1374                 client_free(dev, client->cid);
1375         }
1376
1377         qc_stopread(dev);
1378         dev->valid = false;
1379         list_for_each(inodes, &dev->qmi.cdev.list) {
1380                 inode = container_of(inodes, struct inode, i_devices);
1381                 if (inode != NULL && !IS_ERR(inode)) {
1382                         list_for_each(tasks, &current->group_leader->tasks) {
1383                                 task = container_of(tasks, struct task_struct, tasks);
1384                                 if (!task || !task->files)
1385                                         continue;
1386                                 spin_lock_irqsave(&task->files->file_lock, flags);
1387                                 fdtable = files_fdtable(task->files);
1388                                 for (count = 0; count < fdtable->max_fds; count++) {
1389                                         file = fdtable->fd[count];
1390                                         if (file != NULL &&  file->f_dentry != NULL) {
1391                                                 if (file->f_dentry->d_inode == inode) {
1392                                                         rcu_assign_pointer(fdtable->fd[count], NULL);
1393                                                         spin_unlock_irqrestore(&task->files->file_lock, flags);
1394                                                         DBG("forcing close of open file handle\n");
1395                                                         filp_close(file, task->files);
1396                                                         spin_lock_irqsave(&task->files->file_lock, flags);
1397                                                 }
1398                                         }
1399                                 }
1400                                 spin_unlock_irqrestore(&task->files->file_lock, flags);
1401                         }
1402                 }
1403         }
1404
1405         if (!IS_ERR(dev->qmi.devclass))
1406                 device_destroy(dev->qmi.devclass, dev->qmi.devnum);
1407         cdev_del(&dev->qmi.cdev);
1408         unregister_chrdev_region(dev->qmi.devnum, 1);
1409 }
1410
1411 static bool qmi_ready(struct qcusbnet *dev, u16 timeout)
1412 {
1413         int result;
1414         void *wbuf;
1415         size_t wbufsize;
1416         void *rbuf;
1417         u16 rbufsize;
1418         struct semaphore sem;
1419         u16 now;
1420         unsigned long flags;
1421         u8 tid;
1422
1423         if (!device_valid(dev)) {
1424                 ERR("Invalid device\n");
1425                 return -EFAULT;
1426         }
1427
1428
1429         for (now = 0; now < timeout; now += 100) {
1430                 sema_init(&sem, 0);
1431
1432                 tid = atomic_add_return(1, &dev->qmi.qmitid);
1433                 if (!tid)
1434                         tid = atomic_add_return(1, &dev->qmi.qmitid);
1435                 kfree(wbuf);
1436                 wbuf = qmictl_new_ready(tid, &wbufsize);
1437                 if (!wbuf)
1438                         return -ENOMEM;
1439
1440                 result = read_async(dev, QMICTL, tid, upsem, &sem);
1441                 if (result) {
1442                         kfree(wbuf);
1443                         return false;
1444                 }
1445
1446                 write_sync(dev, wbuf, wbufsize, QMICTL);
1447
1448                 msleep(100);
1449                 if (!down_trylock(&sem)) {
1450                         spin_lock_irqsave(&dev->qmi.clients_lock, flags);
1451                         if (client_delread(dev, QMICTL, tid, &rbuf, &rbufsize)) {
1452                                 spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
1453                                 kfree(rbuf);
1454                                 break;
1455                         }
1456                         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
1457                 } else {
1458                         spin_lock_irqsave(&dev->qmi.clients_lock, flags);
1459                         client_notify(dev, QMICTL, tid);
1460                         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
1461                 }
1462         }
1463
1464         kfree(wbuf);
1465
1466         if (now >= timeout)
1467                 return false;
1468
1469         DBG("QMI Ready after %u milliseconds\n", now);
1470
1471         /* 3580 and newer doesn't need a delay; older needs 5000ms */
1472         if (qcusbnet2k_fwdelay)
1473                 msleep(qcusbnet2k_fwdelay * 1000);
1474
1475         return true;
1476 }
1477
1478 static void wds_callback(struct qcusbnet *dev, u16 cid, void *data)
1479 {
1480         bool ret;
1481         int result;
1482         void *rbuf;
1483         u16 rbufsize;
1484
1485         struct net_device_stats *stats = &(dev->usbnet->net->stats);
1486
1487         struct qmiwds_stats dstats = {
1488                 .txok = (u32)-1,
1489                 .rxok = (u32)-1,
1490                 .txerr = (u32)-1,
1491                 .rxerr = (u32)-1,
1492                 .txofl = (u32)-1,
1493                 .rxofl = (u32)-1,
1494                 .txbytesok = (u64)-1,
1495                 .rxbytesok = (u64)-1,
1496         };
1497         unsigned long flags;
1498
1499         if (!device_valid(dev)) {
1500                 ERR("Invalid device\n");
1501                 return;
1502         }
1503
1504         spin_lock_irqsave(&dev->qmi.clients_lock, flags);
1505         ret = client_delread(dev, cid, 0, &rbuf, &rbufsize);
1506         spin_unlock_irqrestore(&dev->qmi.clients_lock, flags);
1507
1508         if (!ret) {
1509                 ERR("WDS callback failed to get data\n");
1510                 return;
1511         }
1512
1513         dstats.linkstate = !qc_isdown(dev, DOWN_NO_NDIS_CONNECTION);
1514         dstats.reconfigure = false;
1515
1516         result = qmiwds_event_resp(rbuf, rbufsize, &dstats);
1517         if (result < 0) {
1518                 ERR("bad WDS packet\n");
1519         } else {
1520                 if (dstats.txofl != (u32)-1)
1521                         stats->tx_fifo_errors = dstats.txofl;
1522
1523                 if (dstats.rxofl != (u32)-1)
1524                         stats->rx_fifo_errors = dstats.rxofl;
1525
1526                 if (dstats.txerr != (u32)-1)
1527                         stats->tx_errors = dstats.txerr;
1528
1529                 if (dstats.rxerr != (u32)-1)
1530                         stats->rx_errors = dstats.rxerr;
1531
1532                 if (dstats.txok != (u32)-1)
1533                         stats->tx_packets = dstats.txok + stats->tx_errors;
1534
1535                 if (dstats.rxok != (u32)-1)
1536                         stats->rx_packets = dstats.rxok + stats->rx_errors;
1537
1538                 if (dstats.txbytesok != (u64)-1)
1539                         stats->tx_bytes = dstats.txbytesok;
1540
1541                 if (dstats.rxbytesok != (u64)-1)
1542                         stats->rx_bytes = dstats.rxbytesok;
1543
1544                 if (dstats.reconfigure) {
1545                         DBG("Net device link reset\n");
1546                         qc_setdown(dev, DOWN_NO_NDIS_CONNECTION);
1547                         qc_cleardown(dev, DOWN_NO_NDIS_CONNECTION);
1548                 } else {
1549                         if (dstats.linkstate) {
1550                                 DBG("Net device link is connected\n");
1551                                 qc_cleardown(dev, DOWN_NO_NDIS_CONNECTION);
1552                         } else {
1553                                 DBG("Net device link is disconnected\n");
1554                                 qc_setdown(dev, DOWN_NO_NDIS_CONNECTION);
1555                         }
1556                 }
1557         }
1558
1559         kfree(rbuf);
1560
1561         result = read_async(dev, cid, 0, wds_callback, data);
1562         if (result != 0)
1563                 ERR("unable to setup next async read\n");
1564 }
1565
1566 static int setup_wds_callback(struct qcusbnet *dev)
1567 {
1568         int result;
1569         void *buf;
1570         size_t size;
1571         u16 cid;
1572
1573         if (!device_valid(dev)) {
1574                 ERR("Invalid device\n");
1575                 return -EFAULT;
1576         }
1577
1578         result = client_alloc(dev, QMIWDS);
1579         if (result < 0)
1580                 return result;
1581         cid = result;
1582
1583         buf = qmiwds_new_seteventreport(1, &size);
1584         if (!buf)
1585                 return -ENOMEM;
1586
1587         result = write_sync(dev, buf, size, cid);
1588         kfree(buf);
1589
1590         if (result < 0)
1591                 return result;
1592
1593         buf = qmiwds_new_getpkgsrvcstatus(2, &size);
1594         if (buf == NULL)
1595                 return -ENOMEM;
1596
1597         result = write_sync(dev, buf, size, cid);
1598         kfree(buf);
1599
1600         if (result < 0)
1601                 return result;
1602
1603         result = read_async(dev, cid, 0, wds_callback, NULL);
1604         if (result) {
1605                 ERR("unable to setup async read\n");
1606                 return result;
1607         }
1608
1609         result = usb_control_msg(dev->usbnet->udev,
1610                         usb_sndctrlpipe(dev->usbnet->udev, 0),
1611                         0x22, 0x21, 1,
1612                         dev->iface->cur_altsetting->desc.bInterfaceNumber,
1613                         NULL, 0, 100);
1614         if (result < 0) {
1615                 ERR("Bad SetControlLineState status %d\n", result);
1616                 return result;
1617         }
1618
1619         return 0;
1620 }
1621
1622 static int qmidms_getmeid(struct qcusbnet *dev)
1623 {
1624         int result;
1625         void *wbuf;
1626         size_t wbufsize;
1627         void *rbuf;
1628         u16 rbufsize;
1629         u16 cid;
1630
1631         if (!device_valid(dev)) {
1632                 ERR("Invalid device\n");
1633                 return -EFAULT;
1634         }
1635
1636         result = client_alloc(dev, QMIDMS);
1637         if (result < 0)
1638                 return result;
1639         cid = result;
1640
1641         wbuf = qmidms_new_getmeid(1, &wbufsize);
1642         if (!wbuf)
1643                 return -ENOMEM;
1644
1645         result = write_sync(dev, wbuf, wbufsize, cid);
1646         kfree(wbuf);
1647
1648         if (result < 0)
1649                 return result;
1650
1651         result = read_sync(dev, &rbuf, cid, 1);
1652         if (result < 0)
1653                 return result;
1654         rbufsize = result;
1655
1656         result = qmidms_meid_resp(rbuf, rbufsize, &dev->meid[0], 14);
1657         kfree(rbuf);
1658
1659         if (result < 0) {
1660                 ERR("bad get MEID resp\n");
1661                 memset(&dev->meid[0], '0', 14);
1662         }
1663
1664         client_free(dev, cid);
1665         return 0;
1666 }
1667
1668 module_param(qcusbnet2k_fwdelay, int, S_IRUGO | S_IWUSR);
1669 MODULE_PARM_DESC(qcusbnet2k_fwdelay, "Delay for old firmware");