drivers/net/wireless/brcm80211/brcmfmac/usb.c

   1 /*
   2  * Copyright (c) 2011 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/kernel.h>
  18 #include <linux/module.h>
  19 #include <linux/firmware.h>
  20 #include <linux/usb.h>
  21 #include <linux/vmalloc.h>
  22
  23 #include <brcmu_utils.h>
  24 #include <brcmu_wifi.h>
  25 #include <dhd_bus.h>
  26 #include <dhd_dbg.h>
  27
  28 #include "usb_rdl.h"
  29 #include "usb.h"
  30
  31 #define IOCTL_RESP_TIMEOUT  2000
  32
  33 #define BRCMF_USB_RESET_GETVER_SPINWAIT 100     /* in unit of ms */
  34 #define BRCMF_USB_RESET_GETVER_LOOP_CNT 10
  35
  36 #define BRCMF_POSTBOOT_ID               0xA123  /* ID to detect if dongle
  37                                                    has boot up */
  38 #define BRCMF_USB_NRXQ  50
  39 #define BRCMF_USB_NTXQ  50
  40
  41 #define CONFIGDESC(usb)         (&((usb)->actconfig)->desc)
  42 #define IFPTR(usb, idx)         ((usb)->actconfig->interface[(idx)])
  43 #define IFALTS(usb, idx)        (IFPTR((usb), (idx))->altsetting[0])
  44 #define IFDESC(usb, idx)        IFALTS((usb), (idx)).desc
  45 #define IFEPDESC(usb, idx, ep)  (IFALTS((usb), (idx)).endpoint[(ep)]).desc
  46
  47 #define CONTROL_IF              0
  48 #define BULK_IF                 0
  49
  50 #define BRCMF_USB_CBCTL_WRITE   0
  51 #define BRCMF_USB_CBCTL_READ    1
  52 #define BRCMF_USB_MAX_PKT_SIZE  1600
  53
  54 #define BRCMF_USB_43143_FW_NAME "brcm/brcmfmac43143.bin"
  55 #define BRCMF_USB_43236_FW_NAME "brcm/brcmfmac43236b.bin"
  56 #define BRCMF_USB_43242_FW_NAME "brcm/brcmfmac43242a.bin"
  57
  58 struct brcmf_usb_image {
  59         struct list_head list;
  60         s8 *fwname;
  61         u8 *image;
  62         int image_len;
  63 };
  64 static struct list_head fw_image_list;
  65
  66 struct intr_transfer_buf {
  67         u32 notification;
  68         u32 reserved;
  69 };
  70
  71 struct brcmf_usbdev_info {
  72         struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
  73         spinlock_t qlock;
  74         struct list_head rx_freeq;
  75         struct list_head rx_postq;
  76         struct list_head tx_freeq;
  77         struct list_head tx_postq;
  78         uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
  79
  80         int rx_low_watermark;
  81         int tx_low_watermark;
  82         int tx_high_watermark;
  83         int tx_freecount;
  84         bool tx_flowblock;
  85
  86         struct brcmf_usbreq *tx_reqs;
  87         struct brcmf_usbreq *rx_reqs;
  88
  89         u8 *image;      /* buffer for combine fw and nvram */
  90         int image_len;
  91
  92         struct usb_device *usbdev;
  93         struct device *dev;
  94
  95         int ctl_in_pipe, ctl_out_pipe;
  96         struct urb *ctl_urb; /* URB for control endpoint */
  97         struct usb_ctrlrequest ctl_write;
  98         struct usb_ctrlrequest ctl_read;
  99         u32 ctl_urb_actual_length;
 100         int ctl_urb_status;
 101         int ctl_completed;
 102         wait_queue_head_t ioctl_resp_wait;
 103         ulong ctl_op;
 104
 105         struct urb *bulk_urb; /* used for FW download */
 106         struct urb *intr_urb; /* URB for interrupt endpoint */
 107         int intr_size;          /* Size of interrupt message */
 108         int interval;           /* Interrupt polling interval */
 109         struct intr_transfer_buf intr; /* Data buffer for interrupt endpoint */
 110 };
 111
 112 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 113                                 struct brcmf_usbreq  *req);
 114
 115 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
 116 {
 117         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
 118         return bus_if->bus_priv.usb;
 119 }
 120
 121 static struct brcmf_usbdev_info *brcmf_usb_get_businfo(struct device *dev)
 122 {
 123         return brcmf_usb_get_buspub(dev)->devinfo;
 124 }
 125
 126 static int brcmf_usb_ioctl_resp_wait(struct brcmf_usbdev_info *devinfo)
 127 {
 128         return wait_event_timeout(devinfo->ioctl_resp_wait,
 129                                   devinfo->ctl_completed,
 130                                   msecs_to_jiffies(IOCTL_RESP_TIMEOUT));
 131 }
 132
 133 static void brcmf_usb_ioctl_resp_wake(struct brcmf_usbdev_info *devinfo)
 134 {
 135         if (waitqueue_active(&devinfo->ioctl_resp_wait))
 136                 wake_up(&devinfo->ioctl_resp_wait);
 137 }
 138
 139 static void
 140 brcmf_usb_ctl_complete(struct brcmf_usbdev_info *devinfo, int type, int status)
 141 {
 142         brcmf_dbg(USB, "Enter, status=%d\n", status);
 143
 144         if (unlikely(devinfo == NULL))
 145                 return;
 146
 147         if (type == BRCMF_USB_CBCTL_READ) {
 148                 if (status == 0)
 149                         devinfo->bus_pub.stats.rx_ctlpkts++;
 150                 else
 151                         devinfo->bus_pub.stats.rx_ctlerrs++;
 152         } else if (type == BRCMF_USB_CBCTL_WRITE) {
 153                 if (status == 0)
 154                         devinfo->bus_pub.stats.tx_ctlpkts++;
 155                 else
 156                         devinfo->bus_pub.stats.tx_ctlerrs++;
 157         }
 158
 159         devinfo->ctl_urb_status = status;
 160         devinfo->ctl_completed = true;
 161         brcmf_usb_ioctl_resp_wake(devinfo);
 162 }
 163
 164 static void
 165 brcmf_usb_ctlread_complete(struct urb *urb)
 166 {
 167         struct brcmf_usbdev_info *devinfo =
 168                 (struct brcmf_usbdev_info *)urb->context;
 169
 170         brcmf_dbg(USB, "Enter\n");
 171         devinfo->ctl_urb_actual_length = urb->actual_length;
 172         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_READ,
 173                 urb->status);
 174 }
 175
 176 static void
 177 brcmf_usb_ctlwrite_complete(struct urb *urb)
 178 {
 179         struct brcmf_usbdev_info *devinfo =
 180                 (struct brcmf_usbdev_info *)urb->context;
 181
 182         brcmf_dbg(USB, "Enter\n");
 183         brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_WRITE,
 184                 urb->status);
 185 }
 186
 187 static int
 188 brcmf_usb_send_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 189 {
 190         int ret;
 191         u16 size;
 192
 193         brcmf_dbg(USB, "Enter\n");
 194         if (devinfo == NULL || buf == NULL ||
 195             len == 0 || devinfo->ctl_urb == NULL)
 196                 return -EINVAL;
 197
 198         size = len;
 199         devinfo->ctl_write.wLength = cpu_to_le16p(&size);
 200         devinfo->ctl_urb->transfer_buffer_length = size;
 201         devinfo->ctl_urb_status = 0;
 202         devinfo->ctl_urb_actual_length = 0;
 203
 204         usb_fill_control_urb(devinfo->ctl_urb,
 205                 devinfo->usbdev,
 206                 devinfo->ctl_out_pipe,
 207                 (unsigned char *) &devinfo->ctl_write,
 208                 buf, size,
 209                 (usb_complete_t)brcmf_usb_ctlwrite_complete,
 210                 devinfo);
 211
 212         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 213         if (ret < 0)
 214                 brcmf_err("usb_submit_urb failed %d\n", ret);
 215
 216         return ret;
 217 }
 218
 219 static int
 220 brcmf_usb_recv_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
 221 {
 222         int ret;
 223         u16 size;
 224
 225         brcmf_dbg(USB, "Enter\n");
 226         if ((devinfo == NULL) || (buf == NULL) || (len == 0)
 227                 || (devinfo->ctl_urb == NULL))
 228                 return -EINVAL;
 229
 230         size = len;
 231         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 232         devinfo->ctl_urb->transfer_buffer_length = size;
 233
 234         devinfo->ctl_read.bRequestType = USB_DIR_IN
 235                 | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 236         devinfo->ctl_read.bRequest = 1;
 237
 238         usb_fill_control_urb(devinfo->ctl_urb,
 239                 devinfo->usbdev,
 240                 devinfo->ctl_in_pipe,
 241                 (unsigned char *) &devinfo->ctl_read,
 242                 buf, size,
 243                 (usb_complete_t)brcmf_usb_ctlread_complete,
 244                 devinfo);
 245
 246         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 247         if (ret < 0)
 248                 brcmf_err("usb_submit_urb failed %d\n", ret);
 249
 250         return ret;
 251 }
 252
 253 static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 254 {
 255         int err = 0;
 256         int timeout = 0;
 257         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 258
 259         brcmf_dbg(USB, "Enter\n");
 260         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 261                 return -EIO;
 262
 263         if (test_and_set_bit(0, &devinfo->ctl_op))
 264                 return -EIO;
 265
 266         devinfo->ctl_completed = false;
 267         err = brcmf_usb_send_ctl(devinfo, buf, len);
 268         if (err) {
 269                 brcmf_err("fail %d bytes: %d\n", err, len);
 270                 clear_bit(0, &devinfo->ctl_op);
 271                 return err;
 272         }
 273         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 274         clear_bit(0, &devinfo->ctl_op);
 275         if (!timeout) {
 276                 brcmf_err("Txctl wait timed out\n");
 277                 err = -EIO;
 278         }
 279         return err;
 280 }
 281
 282 static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
 283 {
 284         int err = 0;
 285         int timeout = 0;
 286         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 287
 288         brcmf_dbg(USB, "Enter\n");
 289         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
 290                 return -EIO;
 291
 292         if (test_and_set_bit(0, &devinfo->ctl_op))
 293                 return -EIO;
 294
 295         devinfo->ctl_completed = false;
 296         err = brcmf_usb_recv_ctl(devinfo, buf, len);
 297         if (err) {
 298                 brcmf_err("fail %d bytes: %d\n", err, len);
 299                 clear_bit(0, &devinfo->ctl_op);
 300                 return err;
 301         }
 302         timeout = brcmf_usb_ioctl_resp_wait(devinfo);
 303         err = devinfo->ctl_urb_status;
 304         clear_bit(0, &devinfo->ctl_op);
 305         if (!timeout) {
 306                 brcmf_err("rxctl wait timed out\n");
 307                 err = -EIO;
 308         }
 309         if (!err)
 310                 return devinfo->ctl_urb_actual_length;
 311         else
 312                 return err;
 313 }
 314
 315 static struct brcmf_usbreq *brcmf_usb_deq(struct brcmf_usbdev_info *devinfo,
 316                                           struct list_head *q, int *counter)
 317 {
 318         unsigned long flags;
 319         struct brcmf_usbreq  *req;
 320         spin_lock_irqsave(&devinfo->qlock, flags);
 321         if (list_empty(q)) {
 322                 spin_unlock_irqrestore(&devinfo->qlock, flags);
 323                 return NULL;
 324         }
 325         req = list_entry(q->next, struct brcmf_usbreq, list);
 326         list_del_init(q->next);
 327         if (counter)
 328                 (*counter)--;
 329         spin_unlock_irqrestore(&devinfo->qlock, flags);
 330         return req;
 331
 332 }
 333
 334 static void brcmf_usb_enq(struct brcmf_usbdev_info *devinfo,
 335                           struct list_head *q, struct brcmf_usbreq *req,
 336                           int *counter)
 337 {
 338         unsigned long flags;
 339         spin_lock_irqsave(&devinfo->qlock, flags);
 340         list_add_tail(&req->list, q);
 341         if (counter)
 342                 (*counter)++;
 343         spin_unlock_irqrestore(&devinfo->qlock, flags);
 344 }
 345
 346 static struct brcmf_usbreq *
 347 brcmf_usbdev_qinit(struct list_head *q, int qsize)
 348 {
 349         int i;
 350         struct brcmf_usbreq *req, *reqs;
 351
 352         reqs = kcalloc(qsize, sizeof(struct brcmf_usbreq), GFP_ATOMIC);
 353         if (reqs == NULL)
 354                 return NULL;
 355
 356         req = reqs;
 357
 358         for (i = 0; i < qsize; i++) {
 359                 req->urb = usb_alloc_urb(0, GFP_ATOMIC);
 360                 if (!req->urb)
 361                         goto fail;
 362
 363                 INIT_LIST_HEAD(&req->list);
 364                 list_add_tail(&req->list, q);
 365                 req++;
 366         }
 367         return reqs;
 368 fail:
 369         brcmf_err("fail!\n");
 370         while (!list_empty(q)) {
 371                 req = list_entry(q->next, struct brcmf_usbreq, list);
 372                 if (req && req->urb)
 373                         usb_free_urb(req->urb);
 374                 list_del(q->next);
 375         }
 376         return NULL;
 377
 378 }
 379
 380 static void brcmf_usb_free_q(struct list_head *q, bool pending)
 381 {
 382         struct brcmf_usbreq *req, *next;
 383         int i = 0;
 384         list_for_each_entry_safe(req, next, q, list) {
 385                 if (!req->urb) {
 386                         brcmf_err("bad req\n");
 387                         break;
 388                 }
 389                 i++;
 390                 if (pending) {
 391                         usb_kill_urb(req->urb);
 392                 } else {
 393                         usb_free_urb(req->urb);
 394                         list_del_init(&req->list);
 395                 }
 396         }
 397 }
 398
 399 static void brcmf_usb_del_fromq(struct brcmf_usbdev_info *devinfo,
 400                                 struct brcmf_usbreq *req)
 401 {
 402         unsigned long flags;
 403
 404         spin_lock_irqsave(&devinfo->qlock, flags);
 405         list_del_init(&req->list);
 406         spin_unlock_irqrestore(&devinfo->qlock, flags);
 407 }
 408
 409
 410 static void brcmf_usb_tx_complete(struct urb *urb)
 411 {
 412         struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
 413         struct brcmf_usbdev_info *devinfo = req->devinfo;
 414
 415         brcmf_dbg(USB, "Enter, urb->status=%d, skb=%p\n", urb->status,
 416                   req->skb);
 417         brcmf_usb_del_fromq(devinfo, req);
 418
 419         brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
 420         req->skb = NULL;
 421         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req, &devinfo->tx_freecount);
 422         if (devinfo->tx_freecount > devinfo->tx_high_watermark &&
 423                 devinfo->tx_flowblock) {
 424                 brcmf_txflowblock(devinfo->dev, false);
 425                 devinfo->tx_flowblock = false;
 426         }
 427 }
 428
 429 static void brcmf_usb_rx_complete(struct urb *urb)
 430 {
 431         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
 432         struct brcmf_usbdev_info *devinfo = req->devinfo;
 433         struct sk_buff *skb;
 434         struct sk_buff_head skbq;
 435
 436         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 437         brcmf_usb_del_fromq(devinfo, req);
 438         skb = req->skb;
 439         req->skb = NULL;
 440
 441         /* zero lenght packets indicate usb "failure". Do not refill */
 442         if (urb->status != 0 || !urb->actual_length) {
 443                 brcmu_pkt_buf_free_skb(skb);
 444                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 445                 return;
 446         }
 447
 448         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 449                 skb_queue_head_init(&skbq);
 450                 skb_queue_tail(&skbq, skb);
 451                 skb_put(skb, urb->actual_length);
 452                 brcmf_rx_frames(devinfo->dev, &skbq);
 453                 brcmf_usb_rx_refill(devinfo, req);
 454         } else {
 455                 brcmu_pkt_buf_free_skb(skb);
 456                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 457         }
 458         return;
 459
 460 }
 461
 462 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
 463                                 struct brcmf_usbreq  *req)
 464 {
 465         struct sk_buff *skb;
 466         int ret;
 467
 468         if (!req || !devinfo)
 469                 return;
 470
 471         skb = dev_alloc_skb(devinfo->bus_pub.bus_mtu);
 472         if (!skb) {
 473                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 474                 return;
 475         }
 476         req->skb = skb;
 477
 478         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
 479                           skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
 480                           req);
 481         req->devinfo = devinfo;
 482         brcmf_usb_enq(devinfo, &devinfo->rx_postq, req, NULL);
 483
 484         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 485         if (ret) {
 486                 brcmf_usb_del_fromq(devinfo, req);
 487                 brcmu_pkt_buf_free_skb(req->skb);
 488                 req->skb = NULL;
 489                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
 490         }
 491         return;
 492 }
 493
 494 static void brcmf_usb_rx_fill_all(struct brcmf_usbdev_info *devinfo)
 495 {
 496         struct brcmf_usbreq *req;
 497
 498         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
 499                 brcmf_err("bus is not up=%d\n", devinfo->bus_pub.state);
 500                 return;
 501         }
 502         while ((req = brcmf_usb_deq(devinfo, &devinfo->rx_freeq, NULL)) != NULL)
 503                 brcmf_usb_rx_refill(devinfo, req);
 504 }
 505
 506 static void
 507 brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
 508 {
 509         struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
 510         int old_state;
 511
 512         brcmf_dbg(USB, "Enter, current state=%d, new state=%d\n",
 513                   devinfo->bus_pub.state, state);
 514
 515         if (devinfo->bus_pub.state == state)
 516                 return;
 517
 518         old_state = devinfo->bus_pub.state;
 519         devinfo->bus_pub.state = state;
 520
 521         /* update state of upper layer */
 522         if (state == BRCMFMAC_USB_STATE_DOWN) {
 523                 brcmf_dbg(USB, "DBUS is down\n");
 524                 bcmf_bus->state = BRCMF_BUS_DOWN;
 525         } else if (state == BRCMFMAC_USB_STATE_UP) {
 526                 brcmf_dbg(USB, "DBUS is up\n");
 527                 bcmf_bus->state = BRCMF_BUS_DATA;
 528         } else {
 529                 brcmf_dbg(USB, "DBUS current state=%d\n", state);
 530         }
 531 }
 532
 533 static void
 534 brcmf_usb_intr_complete(struct urb *urb)
 535 {
 536         struct brcmf_usbdev_info *devinfo =
 537                         (struct brcmf_usbdev_info *)urb->context;
 538         int err;
 539
 540         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
 541
 542         if (devinfo == NULL)
 543                 return;
 544
 545         if (unlikely(urb->status)) {
 546                 if (urb->status == -ENOENT ||
 547                     urb->status == -ESHUTDOWN ||
 548                     urb->status == -ENODEV) {
 549                         brcmf_usb_state_change(devinfo,
 550                                                BRCMFMAC_USB_STATE_DOWN);
 551                 }
 552         }
 553
 554         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN) {
 555                 brcmf_err("intr cb when DBUS down, ignoring\n");
 556                 return;
 557         }
 558
 559         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
 560                 err = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 561                 if (err)
 562                         brcmf_err("usb_submit_urb, err=%d\n", err);
 563         }
 564 }
 565
 566 static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
 567 {
 568         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 569         struct brcmf_usbreq  *req;
 570         int ret;
 571
 572         brcmf_dbg(USB, "Enter, skb=%p\n", skb);
 573         if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
 574                 ret = -EIO;
 575                 goto fail;
 576         }
 577
 578         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq,
 579                                         &devinfo->tx_freecount);
 580         if (!req) {
 581                 brcmf_err("no req to send\n");
 582                 ret = -ENOMEM;
 583                 goto fail;
 584         }
 585
 586         req->skb = skb;
 587         req->devinfo = devinfo;
 588         usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
 589                           skb->data, skb->len, brcmf_usb_tx_complete, req);
 590         req->urb->transfer_flags |= URB_ZERO_PACKET;
 591         brcmf_usb_enq(devinfo, &devinfo->tx_postq, req, NULL);
 592         ret = usb_submit_urb(req->urb, GFP_ATOMIC);
 593         if (ret) {
 594                 brcmf_err("brcmf_usb_tx usb_submit_urb FAILED\n");
 595                 brcmf_usb_del_fromq(devinfo, req);
 596                 req->skb = NULL;
 597                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req,
 598                               &devinfo->tx_freecount);
 599                 goto fail;
 600         }
 601
 602         if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
 603             !devinfo->tx_flowblock) {
 604                 brcmf_txflowblock(dev, true);
 605                 devinfo->tx_flowblock = true;
 606         }
 607         return 0;
 608
 609 fail:
 610         brcmf_txcomplete(dev, skb, false);
 611         return ret;
 612 }
 613
 614
 615 static int brcmf_usb_up(struct device *dev)
 616 {
 617         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 618         u16 ifnum;
 619         int ret;
 620
 621         brcmf_dbg(USB, "Enter\n");
 622         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP)
 623                 return 0;
 624
 625         /* Success, indicate devinfo is fully up */
 626         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_UP);
 627
 628         if (devinfo->intr_urb) {
 629                 usb_fill_int_urb(devinfo->intr_urb, devinfo->usbdev,
 630                         devinfo->intr_pipe,
 631                         &devinfo->intr,
 632                         devinfo->intr_size,
 633                         (usb_complete_t)brcmf_usb_intr_complete,
 634                         devinfo,
 635                         devinfo->interval);
 636
 637                 ret = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
 638                 if (ret) {
 639                         brcmf_err("USB_SUBMIT_URB failed with status %d\n",
 640                                   ret);
 641                         return -EINVAL;
 642                 }
 643         }
 644
 645         if (devinfo->ctl_urb) {
 646                 devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
 647                 devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
 648
 649                 ifnum = IFDESC(devinfo->usbdev, CONTROL_IF).bInterfaceNumber;
 650
 651                 /* CTL Write */
 652                 devinfo->ctl_write.bRequestType =
 653                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 654                 devinfo->ctl_write.bRequest = 0;
 655                 devinfo->ctl_write.wValue = cpu_to_le16(0);
 656                 devinfo->ctl_write.wIndex = cpu_to_le16p(&ifnum);
 657
 658                 /* CTL Read */
 659                 devinfo->ctl_read.bRequestType =
 660                         USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
 661                 devinfo->ctl_read.bRequest = 1;
 662                 devinfo->ctl_read.wValue = cpu_to_le16(0);
 663                 devinfo->ctl_read.wIndex = cpu_to_le16p(&ifnum);
 664         }
 665         brcmf_usb_rx_fill_all(devinfo);
 666         return 0;
 667 }
 668
 669 static void brcmf_usb_down(struct device *dev)
 670 {
 671         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
 672
 673         brcmf_dbg(USB, "Enter\n");
 674         if (devinfo == NULL)
 675                 return;
 676
 677         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_DOWN)
 678                 return;
 679
 680         brcmf_usb_state_change(devinfo, BRCMFMAC_USB_STATE_DOWN);
 681         if (devinfo->intr_urb)
 682                 usb_kill_urb(devinfo->intr_urb);
 683
 684         if (devinfo->ctl_urb)
 685                 usb_kill_urb(devinfo->ctl_urb);
 686
 687         if (devinfo->bulk_urb)
 688                 usb_kill_urb(devinfo->bulk_urb);
 689         brcmf_usb_free_q(&devinfo->tx_postq, true);
 690
 691         brcmf_usb_free_q(&devinfo->rx_postq, true);
 692 }
 693
 694 static void
 695 brcmf_usb_sync_complete(struct urb *urb)
 696 {
 697         struct brcmf_usbdev_info *devinfo =
 698                         (struct brcmf_usbdev_info *)urb->context;
 699
 700         devinfo->ctl_completed = true;
 701         brcmf_usb_ioctl_resp_wake(devinfo);
 702 }
 703
 704 static bool brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
 705                              void *buffer, int buflen)
 706 {
 707         int ret = 0;
 708         char *tmpbuf;
 709         u16 size;
 710
 711         if ((!devinfo) || (devinfo->ctl_urb == NULL))
 712                 return false;
 713
 714         tmpbuf = kmalloc(buflen, GFP_ATOMIC);
 715         if (!tmpbuf)
 716                 return false;
 717
 718         size = buflen;
 719         devinfo->ctl_urb->transfer_buffer_length = size;
 720
 721         devinfo->ctl_read.wLength = cpu_to_le16p(&size);
 722         devinfo->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
 723                 USB_RECIP_INTERFACE;
 724         devinfo->ctl_read.bRequest = cmd;
 725
 726         usb_fill_control_urb(devinfo->ctl_urb,
 727                 devinfo->usbdev,
 728                 usb_rcvctrlpipe(devinfo->usbdev, 0),
 729                 (unsigned char *) &devinfo->ctl_read,
 730                 (void *) tmpbuf, size,
 731                 (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 732
 733         devinfo->ctl_completed = false;
 734         ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
 735         if (ret < 0) {
 736                 brcmf_err("usb_submit_urb failed %d\n", ret);
 737                 kfree(tmpbuf);
 738                 return false;
 739         }
 740
 741         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 742         memcpy(buffer, tmpbuf, buflen);
 743         kfree(tmpbuf);
 744
 745         return ret;
 746 }
 747
 748 static bool
 749 brcmf_usb_dlneeded(struct brcmf_usbdev_info *devinfo)
 750 {
 751         struct bootrom_id_le id;
 752         u32 chipid, chiprev;
 753
 754         brcmf_dbg(USB, "Enter\n");
 755
 756         if (devinfo == NULL)
 757                 return false;
 758
 759         /* Check if firmware downloaded already by querying runtime ID */
 760         id.chip = cpu_to_le32(0xDEAD);
 761         brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 762
 763         chipid = le32_to_cpu(id.chip);
 764         chiprev = le32_to_cpu(id.chiprev);
 765
 766         if ((chipid & 0x4300) == 0x4300)
 767                 brcmf_dbg(USB, "chip %x rev 0x%x\n", chipid, chiprev);
 768         else
 769                 brcmf_dbg(USB, "chip %d rev 0x%x\n", chipid, chiprev);
 770         if (chipid == BRCMF_POSTBOOT_ID) {
 771                 brcmf_dbg(USB, "firmware already downloaded\n");
 772                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 773                 return false;
 774         } else {
 775                 devinfo->bus_pub.devid = chipid;
 776                 devinfo->bus_pub.chiprev = chiprev;
 777         }
 778         return true;
 779 }
 780
 781 static int
 782 brcmf_usb_resetcfg(struct brcmf_usbdev_info *devinfo)
 783 {
 784         struct bootrom_id_le id;
 785         u32 loop_cnt;
 786
 787         brcmf_dbg(USB, "Enter\n");
 788
 789         loop_cnt = 0;
 790         do {
 791                 mdelay(BRCMF_USB_RESET_GETVER_SPINWAIT);
 792                 loop_cnt++;
 793                 id.chip = cpu_to_le32(0xDEAD);       /* Get the ID */
 794                 brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id, sizeof(id));
 795                 if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID))
 796                         break;
 797         } while (loop_cnt < BRCMF_USB_RESET_GETVER_LOOP_CNT);
 798
 799         if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID)) {
 800                 brcmf_dbg(USB, "postboot chip 0x%x/rev 0x%x\n",
 801                           le32_to_cpu(id.chip), le32_to_cpu(id.chiprev));
 802
 803                 brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id, sizeof(id));
 804                 return 0;
 805         } else {
 806                 brcmf_err("Cannot talk to Dongle. Firmware is not UP, %d ms\n",
 807                           BRCMF_USB_RESET_GETVER_SPINWAIT * loop_cnt);
 808                 return -EINVAL;
 809         }
 810 }
 811
 812
 813 static int
 814 brcmf_usb_dl_send_bulk(struct brcmf_usbdev_info *devinfo, void *buffer, int len)
 815 {
 816         int ret;
 817
 818         if ((devinfo == NULL) || (devinfo->bulk_urb == NULL))
 819                 return -EINVAL;
 820
 821         /* Prepare the URB */
 822         usb_fill_bulk_urb(devinfo->bulk_urb, devinfo->usbdev,
 823                           devinfo->tx_pipe, buffer, len,
 824                           (usb_complete_t)brcmf_usb_sync_complete, devinfo);
 825
 826         devinfo->bulk_urb->transfer_flags |= URB_ZERO_PACKET;
 827
 828         devinfo->ctl_completed = false;
 829         ret = usb_submit_urb(devinfo->bulk_urb, GFP_ATOMIC);
 830         if (ret) {
 831                 brcmf_err("usb_submit_urb failed %d\n", ret);
 832                 return ret;
 833         }
 834         ret = brcmf_usb_ioctl_resp_wait(devinfo);
 835         return (ret == 0);
 836 }
 837
 838 static int
 839 brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
 840 {
 841         unsigned int sendlen, sent, dllen;
 842         char *bulkchunk = NULL, *dlpos;
 843         struct rdl_state_le state;
 844         u32 rdlstate, rdlbytes;
 845         int err = 0;
 846
 847         brcmf_dbg(USB, "Enter, fw %p, len %d\n", fw, fwlen);
 848
 849         bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
 850         if (bulkchunk == NULL) {
 851                 err = -ENOMEM;
 852                 goto fail;
 853         }
 854
 855         /* 1) Prepare USB boot loader for runtime image */
 856         brcmf_usb_dl_cmd(devinfo, DL_START, &state,
 857                          sizeof(struct rdl_state_le));
 858
 859         rdlstate = le32_to_cpu(state.state);
 860         rdlbytes = le32_to_cpu(state.bytes);
 861
 862         /* 2) Check we are in the Waiting state */
 863         if (rdlstate != DL_WAITING) {
 864                 brcmf_err("Failed to DL_START\n");
 865                 err = -EINVAL;
 866                 goto fail;
 867         }
 868         sent = 0;
 869         dlpos = fw;
 870         dllen = fwlen;
 871
 872         /* Get chip id and rev */
 873         while (rdlbytes != dllen) {
 874                 /* Wait until the usb device reports it received all
 875                  * the bytes we sent */
 876                 if ((rdlbytes == sent) && (rdlbytes != dllen)) {
 877                         if ((dllen-sent) < RDL_CHUNK)
 878                                 sendlen = dllen-sent;
 879                         else
 880                                 sendlen = RDL_CHUNK;
 881
 882                         /* simply avoid having to send a ZLP by ensuring we
 883                          * never have an even
 884                          * multiple of 64
 885                          */
 886                         if (!(sendlen % 64))
 887                                 sendlen -= 4;
 888
 889                         /* send data */
 890                         memcpy(bulkchunk, dlpos, sendlen);
 891                         if (brcmf_usb_dl_send_bulk(devinfo, bulkchunk,
 892                                                    sendlen)) {
 893                                 brcmf_err("send_bulk failed\n");
 894                                 err = -EINVAL;
 895                                 goto fail;
 896                         }
 897
 898                         dlpos += sendlen;
 899                         sent += sendlen;
 900                 }
 901                 if (!brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 902                                       sizeof(struct rdl_state_le))) {
 903                         brcmf_err("DL_GETSTATE Failed xxxx\n");
 904                         err = -EINVAL;
 905                         goto fail;
 906                 }
 907
 908                 rdlstate = le32_to_cpu(state.state);
 909                 rdlbytes = le32_to_cpu(state.bytes);
 910
 911                 /* restart if an error is reported */
 912                 if (rdlstate == DL_BAD_HDR || rdlstate == DL_BAD_CRC) {
 913                         brcmf_err("Bad Hdr or Bad CRC state %d\n",
 914                                   rdlstate);
 915                         err = -EINVAL;
 916                         goto fail;
 917                 }
 918         }
 919
 920 fail:
 921         kfree(bulkchunk);
 922         brcmf_dbg(USB, "Exit, err=%d\n", err);
 923         return err;
 924 }
 925
 926 static int brcmf_usb_dlstart(struct brcmf_usbdev_info *devinfo, u8 *fw, int len)
 927 {
 928         int err;
 929
 930         brcmf_dbg(USB, "Enter\n");
 931
 932         if (devinfo == NULL)
 933                 return -EINVAL;
 934
 935         if (devinfo->bus_pub.devid == 0xDEAD)
 936                 return -EINVAL;
 937
 938         err = brcmf_usb_dl_writeimage(devinfo, fw, len);
 939         if (err == 0)
 940                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_DONE;
 941         else
 942                 devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DL_FAIL;
 943         brcmf_dbg(USB, "Exit, err=%d\n", err);
 944
 945         return err;
 946 }
 947
 948 static int brcmf_usb_dlrun(struct brcmf_usbdev_info *devinfo)
 949 {
 950         struct rdl_state_le state;
 951
 952         brcmf_dbg(USB, "Enter\n");
 953         if (!devinfo)
 954                 return -EINVAL;
 955
 956         if (devinfo->bus_pub.devid == 0xDEAD)
 957                 return -EINVAL;
 958
 959         /* Check we are runnable */
 960         brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
 961                 sizeof(struct rdl_state_le));
 962
 963         /* Start the image */
 964         if (state.state == cpu_to_le32(DL_RUNNABLE)) {
 965                 if (!brcmf_usb_dl_cmd(devinfo, DL_GO, &state,
 966                         sizeof(struct rdl_state_le)))
 967                         return -ENODEV;
 968                 if (brcmf_usb_resetcfg(devinfo))
 969                         return -ENODEV;
 970                 /* The Dongle may go for re-enumeration. */
 971         } else {
 972                 brcmf_err("Dongle not runnable\n");
 973                 return -EINVAL;
 974         }
 975         brcmf_dbg(USB, "Exit\n");
 976         return 0;
 977 }
 978
 979 static bool brcmf_usb_chip_support(int chipid, int chiprev)
 980 {
 981         switch(chipid) {
 982         case 43143:
 983                 return true;
 984         case 43235:
 985         case 43236:
 986         case 43238:
 987                 return (chiprev == 3);
 988         case 43242:
 989                 return true;
 990         default:
 991                 break;
 992         }
 993         return false;
 994 }
 995
 996 static int
 997 brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
 998 {
 999         int devid, chiprev;
1000         int err;
1001
1002         brcmf_dbg(USB, "Enter\n");
1003         if (devinfo == NULL)
1004                 return -ENODEV;
1005
1006         devid = devinfo->bus_pub.devid;
1007         chiprev = devinfo->bus_pub.chiprev;
1008
1009         if (!brcmf_usb_chip_support(devid, chiprev)) {
1010                 brcmf_err("unsupported chip %d rev %d\n",
1011                           devid, chiprev);
1012                 return -EINVAL;
1013         }
1014
1015         if (!devinfo->image) {
1016                 brcmf_err("No firmware!\n");
1017                 return -ENOENT;
1018         }
1019
1020         err = brcmf_usb_dlstart(devinfo,
1021                 devinfo->image, devinfo->image_len);
1022         if (err == 0)
1023                 err = brcmf_usb_dlrun(devinfo);
1024         return err;
1025 }
1026
1027
1028 static void brcmf_usb_detach(struct brcmf_usbdev_info *devinfo)
1029 {
1030         brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
1031
1032         /* free the URBS */
1033         brcmf_usb_free_q(&devinfo->rx_freeq, false);
1034         brcmf_usb_free_q(&devinfo->tx_freeq, false);
1035
1036         usb_free_urb(devinfo->intr_urb);
1037         usb_free_urb(devinfo->ctl_urb);
1038         usb_free_urb(devinfo->bulk_urb);
1039
1040         kfree(devinfo->tx_reqs);
1041         kfree(devinfo->rx_reqs);
1042 }
1043
1044 #define TRX_MAGIC       0x30524448      /* "HDR0" */
1045 #define TRX_VERSION     1               /* Version 1 */
1046 #define TRX_MAX_LEN     0x3B0000        /* Max length */
1047 #define TRX_NO_HEADER   1               /* Do not write TRX header */
1048 #define TRX_MAX_OFFSET  3               /* Max number of individual files */
1049 #define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed image */
1050
1051 struct trx_header_le {
1052         __le32 magic;           /* "HDR0" */
1053         __le32 len;             /* Length of file including header */
1054         __le32 crc32;           /* CRC from flag_version to end of file */
1055         __le32 flag_version;    /* 0:15 flags, 16:31 version */
1056         __le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
1057                                          * header */
1058 };
1059
1060 static int check_file(const u8 *headers)
1061 {
1062         struct trx_header_le *trx;
1063         int actual_len = -1;
1064
1065         brcmf_dbg(USB, "Enter\n");
1066         /* Extract trx header */
1067         trx = (struct trx_header_le *) headers;
1068         if (trx->magic != cpu_to_le32(TRX_MAGIC))
1069                 return -1;
1070
1071         headers += sizeof(struct trx_header_le);
1072
1073         if (le32_to_cpu(trx->flag_version) & TRX_UNCOMP_IMAGE) {
1074                 actual_len = le32_to_cpu(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]);
1075                 return actual_len + sizeof(struct trx_header_le);
1076         }
1077         return -1;
1078 }
1079
1080 static int brcmf_usb_get_fw(struct brcmf_usbdev_info *devinfo)
1081 {
1082         s8 *fwname;
1083         const struct firmware *fw;
1084         struct brcmf_usb_image *fw_image;
1085         int err;
1086
1087         brcmf_dbg(USB, "Enter\n");
1088         switch (devinfo->bus_pub.devid) {
1089         case 43143:
1090                 fwname = BRCMF_USB_43143_FW_NAME;
1091                 break;
1092         case 43235:
1093         case 43236:
1094         case 43238:
1095                 fwname = BRCMF_USB_43236_FW_NAME;
1096                 break;
1097         case 43242:
1098                 fwname = BRCMF_USB_43242_FW_NAME;
1099                 break;
1100         default:
1101                 return -EINVAL;
1102                 break;
1103         }
1104         brcmf_dbg(USB, "Loading FW %s\n", fwname);
1105         list_for_each_entry(fw_image, &fw_image_list, list) {
1106                 if (fw_image->fwname == fwname) {
1107                         devinfo->image = fw_image->image;
1108                         devinfo->image_len = fw_image->image_len;
1109                         return 0;
1110                 }
1111         }
1112         /* fw image not yet loaded. Load it now and add to list */
1113         err = request_firmware(&fw, fwname, devinfo->dev);
1114         if (!fw) {
1115                 brcmf_err("fail to request firmware %s\n", fwname);
1116                 return err;
1117         }
1118         if (check_file(fw->data) < 0) {
1119                 brcmf_err("invalid firmware %s\n", fwname);
1120                 return -EINVAL;
1121         }
1122
1123         fw_image = kzalloc(sizeof(*fw_image), GFP_ATOMIC);
1124         if (!fw_image)
1125                 return -ENOMEM;
1126         INIT_LIST_HEAD(&fw_image->list);
1127         list_add_tail(&fw_image->list, &fw_image_list);
1128         fw_image->fwname = fwname;
1129         fw_image->image = vmalloc(fw->size);
1130         if (!fw_image->image)
1131                 return -ENOMEM;
1132
1133         memcpy(fw_image->image, fw->data, fw->size);
1134         fw_image->image_len = fw->size;
1135
1136         release_firmware(fw);
1137
1138         devinfo->image = fw_image->image;
1139         devinfo->image_len = fw_image->image_len;
1140
1141         return 0;
1142 }
1143
1144
1145 static
1146 struct brcmf_usbdev *brcmf_usb_attach(struct brcmf_usbdev_info *devinfo,
1147                                       int nrxq, int ntxq)
1148 {
1149         brcmf_dbg(USB, "Enter\n");
1150
1151         devinfo->bus_pub.nrxq = nrxq;
1152         devinfo->rx_low_watermark = nrxq / 2;
1153         devinfo->bus_pub.devinfo = devinfo;
1154         devinfo->bus_pub.ntxq = ntxq;
1155         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_DOWN;
1156
1157         /* flow control when too many tx urbs posted */
1158         devinfo->tx_low_watermark = ntxq / 4;
1159         devinfo->tx_high_watermark = devinfo->tx_low_watermark * 3;
1160         devinfo->bus_pub.bus_mtu = BRCMF_USB_MAX_PKT_SIZE;
1161
1162         /* Initialize other structure content */
1163         init_waitqueue_head(&devinfo->ioctl_resp_wait);
1164
1165         /* Initialize the spinlocks */
1166         spin_lock_init(&devinfo->qlock);
1167
1168         INIT_LIST_HEAD(&devinfo->rx_freeq);
1169         INIT_LIST_HEAD(&devinfo->rx_postq);
1170
1171         INIT_LIST_HEAD(&devinfo->tx_freeq);
1172         INIT_LIST_HEAD(&devinfo->tx_postq);
1173
1174         devinfo->tx_flowblock = false;
1175
1176         devinfo->rx_reqs = brcmf_usbdev_qinit(&devinfo->rx_freeq, nrxq);
1177         if (!devinfo->rx_reqs)
1178                 goto error;
1179
1180         devinfo->tx_reqs = brcmf_usbdev_qinit(&devinfo->tx_freeq, ntxq);
1181         if (!devinfo->tx_reqs)
1182                 goto error;
1183         devinfo->tx_freecount = ntxq;
1184
1185         devinfo->intr_urb = usb_alloc_urb(0, GFP_ATOMIC);
1186         if (!devinfo->intr_urb) {
1187                 brcmf_err("usb_alloc_urb (intr) failed\n");
1188                 goto error;
1189         }
1190         devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
1191         if (!devinfo->ctl_urb) {
1192                 brcmf_err("usb_alloc_urb (ctl) failed\n");
1193                 goto error;
1194         }
1195         devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
1196         if (!devinfo->bulk_urb) {
1197                 brcmf_err("usb_alloc_urb (bulk) failed\n");
1198                 goto error;
1199         }
1200
1201         if (!brcmf_usb_dlneeded(devinfo))
1202                 return &devinfo->bus_pub;
1203
1204         brcmf_dbg(USB, "Start fw downloading\n");
1205         if (brcmf_usb_get_fw(devinfo))
1206                 goto error;
1207
1208         if (brcmf_usb_fw_download(devinfo))
1209                 goto error;
1210
1211         return &devinfo->bus_pub;
1212
1213 error:
1214         brcmf_err("failed!\n");
1215         brcmf_usb_detach(devinfo);
1216         return NULL;
1217 }
1218
1219 static struct brcmf_bus_ops brcmf_usb_bus_ops = {
1220         .txdata = brcmf_usb_tx,
1221         .init = brcmf_usb_up,
1222         .stop = brcmf_usb_down,
1223         .txctl = brcmf_usb_tx_ctlpkt,
1224         .rxctl = brcmf_usb_rx_ctlpkt,
1225 };
1226
1227 static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
1228 {
1229         struct brcmf_bus *bus = NULL;
1230         struct brcmf_usbdev *bus_pub = NULL;
1231         int ret;
1232         struct device *dev = devinfo->dev;
1233
1234         brcmf_dbg(USB, "Enter\n");
1235         bus_pub = brcmf_usb_attach(devinfo, BRCMF_USB_NRXQ, BRCMF_USB_NTXQ);
1236         if (!bus_pub)
1237                 return -ENODEV;
1238
1239         bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
1240         if (!bus) {
1241                 ret = -ENOMEM;
1242                 goto fail;
1243         }
1244
1245         bus->dev = dev;
1246         bus_pub->bus = bus;
1247         bus->bus_priv.usb = bus_pub;
1248         dev_set_drvdata(dev, bus);
1249         bus->ops = &brcmf_usb_bus_ops;
1250         bus->chip = bus_pub->devid;
1251         bus->chiprev = bus_pub->chiprev;
1252
1253         /* Attach to the common driver interface */
1254         ret = brcmf_attach(0, dev);
1255         if (ret) {
1256                 brcmf_err("brcmf_attach failed\n");
1257                 goto fail;
1258         }
1259
1260         ret = brcmf_bus_start(dev);
1261         if (ret) {
1262                 brcmf_err("dongle is not responding\n");
1263                 brcmf_detach(dev);
1264                 goto fail;
1265         }
1266
1267         return 0;
1268 fail:
1269         /* Release resources in reverse order */
1270         kfree(bus);
1271         brcmf_usb_detach(devinfo);
1272         return ret;
1273 }
1274
1275 static void
1276 brcmf_usb_disconnect_cb(struct brcmf_usbdev_info *devinfo)
1277 {
1278         if (!devinfo)
1279                 return;
1280         brcmf_dbg(USB, "Enter, bus_pub %p\n", devinfo);
1281
1282         brcmf_detach(devinfo->dev);
1283         kfree(devinfo->bus_pub.bus);
1284         brcmf_usb_detach(devinfo);
1285 }
1286
1287 static int
1288 brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
1289 {
1290         int ep;
1291         struct usb_endpoint_descriptor *endpoint;
1292         int ret = 0;
1293         struct usb_device *usb = interface_to_usbdev(intf);
1294         int num_of_eps;
1295         u8 endpoint_num;
1296         struct brcmf_usbdev_info *devinfo;
1297
1298         brcmf_dbg(USB, "Enter\n");
1299
1300         devinfo = kzalloc(sizeof(*devinfo), GFP_ATOMIC);
1301         if (devinfo == NULL)
1302                 return -ENOMEM;
1303
1304         devinfo->usbdev = usb;
1305         devinfo->dev = &usb->dev;
1306
1307         usb_set_intfdata(intf, devinfo);
1308
1309         /* Check that the device supports only one configuration */
1310         if (usb->descriptor.bNumConfigurations != 1) {
1311                 ret = -1;
1312                 goto fail;
1313         }
1314
1315         if (usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
1316                 ret = -1;
1317                 goto fail;
1318         }
1319
1320         /*
1321          * Only the BDC interface configuration is supported:
1322          *      Device class: USB_CLASS_VENDOR_SPEC
1323          *      if0 class: USB_CLASS_VENDOR_SPEC
1324          *      if0/ep0: control
1325          *      if0/ep1: bulk in
1326          *      if0/ep2: bulk out (ok if swapped with bulk in)
1327          */
1328         if (CONFIGDESC(usb)->bNumInterfaces != 1) {
1329                 ret = -1;
1330                 goto fail;
1331         }
1332
1333         /* Check interface */
1334         if (IFDESC(usb, CONTROL_IF).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
1335             IFDESC(usb, CONTROL_IF).bInterfaceSubClass != 2 ||
1336             IFDESC(usb, CONTROL_IF).bInterfaceProtocol != 0xff) {
1337                 brcmf_err("invalid control interface: class %d, subclass %d, proto %d\n",
1338                           IFDESC(usb, CONTROL_IF).bInterfaceClass,
1339                           IFDESC(usb, CONTROL_IF).bInterfaceSubClass,
1340                           IFDESC(usb, CONTROL_IF).bInterfaceProtocol);
1341                 ret = -1;
1342                 goto fail;
1343         }
1344
1345         /* Check control endpoint */
1346         endpoint = &IFEPDESC(usb, CONTROL_IF, 0);
1347         if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
1348                 != USB_ENDPOINT_XFER_INT) {
1349                 brcmf_err("invalid control endpoint %d\n",
1350                           endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
1351                 ret = -1;
1352                 goto fail;
1353         }
1354
1355         endpoint_num = endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
1356         devinfo->intr_pipe = usb_rcvintpipe(usb, endpoint_num);
1357
1358         devinfo->rx_pipe = 0;
1359         devinfo->rx_pipe2 = 0;
1360         devinfo->tx_pipe = 0;
1361         num_of_eps = IFDESC(usb, BULK_IF).bNumEndpoints - 1;
1362
1363         /* Check data endpoints and get pipes */
1364         for (ep = 1; ep <= num_of_eps; ep++) {
1365                 endpoint = &IFEPDESC(usb, BULK_IF, ep);
1366                 if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
1367                     USB_ENDPOINT_XFER_BULK) {
1368                         brcmf_err("invalid data endpoint %d\n", ep);
1369                         ret = -1;
1370                         goto fail;
1371                 }
1372
1373                 endpoint_num = endpoint->bEndpointAddress &
1374                                USB_ENDPOINT_NUMBER_MASK;
1375                 if ((endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
1376                         == USB_DIR_IN) {
1377                         if (!devinfo->rx_pipe) {
1378                                 devinfo->rx_pipe =
1379                                         usb_rcvbulkpipe(usb, endpoint_num);
1380                         } else {
1381                                 devinfo->rx_pipe2 =
1382                                         usb_rcvbulkpipe(usb, endpoint_num);
1383                         }
1384                 } else {
1385                         devinfo->tx_pipe = usb_sndbulkpipe(usb, endpoint_num);
1386                 }
1387         }
1388
1389         /* Allocate interrupt URB and data buffer */
1390         /* RNDIS says 8-byte intr, our old drivers used 4-byte */
1391         if (IFEPDESC(usb, CONTROL_IF, 0).wMaxPacketSize == cpu_to_le16(16))
1392                 devinfo->intr_size = 8;
1393         else
1394                 devinfo->intr_size = 4;
1395
1396         devinfo->interval = IFEPDESC(usb, CONTROL_IF, 0).bInterval;
1397
1398         if (usb->speed == USB_SPEED_HIGH)
1399                 brcmf_dbg(USB, "Broadcom high speed USB wireless device detected\n");
1400         else
1401                 brcmf_dbg(USB, "Broadcom full speed USB wireless device detected\n");
1402
1403         ret = brcmf_usb_probe_cb(devinfo);
1404         if (ret)
1405                 goto fail;
1406
1407         /* Success */
1408         return 0;
1409
1410 fail:
1411         brcmf_err("failed with errno %d\n", ret);
1412         kfree(devinfo);
1413         usb_set_intfdata(intf, NULL);
1414         return ret;
1415
1416 }
1417
1418 static void
1419 brcmf_usb_disconnect(struct usb_interface *intf)
1420 {
1421         struct brcmf_usbdev_info *devinfo;
1422
1423         brcmf_dbg(USB, "Enter\n");
1424         devinfo = (struct brcmf_usbdev_info *)usb_get_intfdata(intf);
1425         brcmf_usb_disconnect_cb(devinfo);
1426         kfree(devinfo);
1427         brcmf_dbg(USB, "Exit\n");
1428 }
1429
1430 /*
1431  * only need to signal the bus being down and update the state.
1432  */
1433 static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
1434 {
1435         struct usb_device *usb = interface_to_usbdev(intf);
1436         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1437
1438         brcmf_dbg(USB, "Enter\n");
1439         devinfo->bus_pub.state = BRCMFMAC_USB_STATE_SLEEP;
1440         brcmf_detach(&usb->dev);
1441         return 0;
1442 }
1443
1444 /*
1445  * (re-) start the bus.
1446  */
1447 static int brcmf_usb_resume(struct usb_interface *intf)
1448 {
1449         struct usb_device *usb = interface_to_usbdev(intf);
1450         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1451
1452         brcmf_dbg(USB, "Enter\n");
1453         if (!brcmf_attach(0, devinfo->dev))
1454                 return brcmf_bus_start(&usb->dev);
1455
1456         return 0;
1457 }
1458
1459 static int brcmf_usb_reset_resume(struct usb_interface *intf)
1460 {
1461         struct usb_device *usb = interface_to_usbdev(intf);
1462         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
1463
1464         brcmf_dbg(USB, "Enter\n");
1465
1466         if (!brcmf_usb_fw_download(devinfo))
1467                 return brcmf_usb_resume(intf);
1468
1469         return -EIO;
1470 }
1471
1472 #define BRCMF_USB_VENDOR_ID_BROADCOM    0x0a5c
1473 #define BRCMF_USB_DEVICE_ID_43143       0xbd1e
1474 #define BRCMF_USB_DEVICE_ID_43236       0xbd17
1475 #define BRCMF_USB_DEVICE_ID_43242       0xbd1f
1476 #define BRCMF_USB_DEVICE_ID_BCMFW       0x0bdc
1477
1478 static struct usb_device_id brcmf_usb_devid_table[] = {
1479         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43143) },
1480         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43236) },
1481         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43242) },
1482         /* special entry for device with firmware loaded and running */
1483         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
1484         { }
1485 };
1486
1487 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
1488 MODULE_FIRMWARE(BRCMF_USB_43143_FW_NAME);
1489 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
1490 MODULE_FIRMWARE(BRCMF_USB_43242_FW_NAME);
1491
1492 static struct usb_driver brcmf_usbdrvr = {
1493         .name = KBUILD_MODNAME,
1494         .probe = brcmf_usb_probe,
1495         .disconnect = brcmf_usb_disconnect,
1496         .id_table = brcmf_usb_devid_table,
1497         .suspend = brcmf_usb_suspend,
1498         .resume = brcmf_usb_resume,
1499         .reset_resume = brcmf_usb_reset_resume,
1500         .supports_autosuspend = 1,
1501         .disable_hub_initiated_lpm = 1,
1502 };
1503
1504 static void brcmf_release_fw(struct list_head *q)
1505 {
1506         struct brcmf_usb_image *fw_image, *next;
1507
1508         list_for_each_entry_safe(fw_image, next, q, list) {
1509                 vfree(fw_image->image);
1510                 list_del_init(&fw_image->list);
1511         }
1512 }
1513
1514 static int brcmf_usb_reset_device(struct device *dev, void *notused)
1515 {
1516         /* device past is the usb interface so we
1517          * need to use parent here.
1518          */
1519         brcmf_dev_reset(dev->parent);
1520         return 0;
1521 }
1522
1523 void brcmf_usb_exit(void)
1524 {
1525         struct device_driver *drv = &brcmf_usbdrvr.drvwrap.driver;
1526         int ret;
1527
1528         brcmf_dbg(USB, "Enter\n");
1529         ret = driver_for_each_device(drv, NULL, NULL,
1530                                      brcmf_usb_reset_device);
1531         usb_deregister(&brcmf_usbdrvr);
1532         brcmf_release_fw(&fw_image_list);
1533 }
1534
1535 void brcmf_usb_init(void)
1536 {
1537         brcmf_dbg(USB, "Enter\n");
1538         INIT_LIST_HEAD(&fw_image_list);
1539         usb_register(&brcmf_usbdrvr);
1540 }