drivers/net/wireless/intersil/orinoco/orinoco

/* [<][>][^][v][top][bottom][index][help] */
This source file includes following definitions.
ezusb_reply_inc
ezusb_request_context_put
ezusb_mod_timer
ezusb_request_timerfn
ezusb_alloc_ctx
ezusb_complete_all
ezusb_ctx_complete
ezusb_req_queue_run
ezusb_req_enqueue_run
ezusb_request_out_callback
ezusb_request_in_callback
ezusb_req_ctx_wait
build_crc
ezusb_fill_req
ezusb_submit_in_urb
ezusb_8051_cpucs
ezusb_firmware_download
ezusb_access_ltv
ezusb_write_ltv
ezusb_read_ltv
ezusb_doicmd_wait
ezusb_docmd_wait
ezusb_bap_pread
ezusb_read_pda
ezusb_program_init
ezusb_program_end
ezusb_program_bytes
ezusb_program
ezusb_xmit
ezusb_allocate
ezusb_hard_reset
ezusb_init
ezusb_bulk_in_callback
ezusb_delete
ezusb_lock_irqsave
ezusb_unlock_irqrestore
ezusb_lock_irq
ezusb_unlock_irq
ezusb_probe
ezusb_disconnect
   1 /*
   2  * USB Orinoco driver
   3  *
   4  * Copyright (c) 2003 Manuel Estrada Sainz
   5  *
   6  * The contents of this file are subject to the Mozilla Public License
   7  * Version 1.1 (the "License"); you may not use this file except in
   8  * compliance with the License. You may obtain a copy of the License
   9  * at http://www.mozilla.org/MPL/
  10  *
  11  * Software distributed under the License is distributed on an "AS IS"
  12  * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
  13  * the License for the specific language governing rights and
  14  * limitations under the License.
  15  *
  16  * Alternatively, the contents of this file may be used under the
  17  * terms of the GNU General Public License version 2 (the "GPL"), in
  18  * which case the provisions of the GPL are applicable instead of the
  19  * above.  If you wish to allow the use of your version of this file
  20  * only under the terms of the GPL and not to allow others to use your
  21  * version of this file under the MPL, indicate your decision by
  22  * deleting the provisions above and replace them with the notice and
  23  * other provisions required by the GPL.  If you do not delete the
  24  * provisions above, a recipient may use your version of this file
  25  * under either the MPL or the GPL.
  26  *
  27  * Queueing code based on linux-wlan-ng 0.2.1-pre5
  28  *
  29  * Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
  30  *
  31  *      The license is the same as above.
  32  *
  33  * Initialy based on USB Skeleton driver - 0.7
  34  *
  35  * Copyright (c) 2001 Greg Kroah-Hartman (greg@kroah.com)
  36  *
  37  *      This program is free software; you can redistribute it and/or
  38  *      modify it under the terms of the GNU General Public License as
  39  *      published by the Free Software Foundation; either version 2 of
  40  *      the License, or (at your option) any later version.
  41  *
  42  * NOTE: The original USB Skeleton driver is GPL, but all that code is
  43  * gone so MPL/GPL applies.
  44  */
  45 
  46 #define DRIVER_NAME "orinoco_usb"
  47 #define PFX DRIVER_NAME ": "
  48 
  49 #include <linux/module.h>
  50 #include <linux/kernel.h>
  51 #include <linux/sched.h>
  52 #include <linux/signal.h>
  53 #include <linux/errno.h>
  54 #include <linux/poll.h>
  55 #include <linux/slab.h>
  56 #include <linux/fcntl.h>
  57 #include <linux/spinlock.h>
  58 #include <linux/list.h>
  59 #include <linux/usb.h>
  60 #include <linux/timer.h>
  61 
  62 #include <linux/netdevice.h>
  63 #include <linux/if_arp.h>
  64 #include <linux/etherdevice.h>
  65 #include <linux/wireless.h>
  66 #include <linux/firmware.h>
  67 #include <linux/refcount.h>
  68 
  69 #include "mic.h"
  70 #include "orinoco.h"
  71 
  72 #ifndef URB_ASYNC_UNLINK
  73 #define URB_ASYNC_UNLINK 0
  74 #endif
  75 
  76 struct header_struct {
  77         /* 802.3 */
  78         u8 dest[ETH_ALEN];
  79         u8 src[ETH_ALEN];
  80         __be16 len;
  81         /* 802.2 */
  82         u8 dsap;
  83         u8 ssap;
  84         u8 ctrl;
  85         /* SNAP */
  86         u8 oui[3];
  87         __be16 ethertype;
  88 } __packed;
  89 
  90 struct ez_usb_fw {
  91         u16 size;
  92         const u8 *code;
  93 };
  94 
  95 static struct ez_usb_fw firmware = {
  96         .size = 0,
  97         .code = NULL,
  98 };
  99 
 100 /* Debugging macros */
 101 #undef err
 102 #define err(format, arg...) \
 103         do { printk(KERN_ERR PFX format "\n", ## arg); } while (0)
 104 
 105 MODULE_FIRMWARE("orinoco_ezusb_fw");
 106 
 107 /*
 108  * Under some conditions, the card gets stuck and stops paying attention
 109  * to the world (i.e. data communication stalls) until we do something to
 110  * it.  Sending an INQ_TALLIES command seems to be enough and should be
 111  * harmless otherwise.  This behaviour has been observed when using the
 112  * driver on a systemimager client during installation.  In the past a
 113  * timer was used to send INQ_TALLIES commands when there was no other
 114  * activity, but it was troublesome and was removed.
 115  */
 116 
 117 #define USB_COMPAQ_VENDOR_ID     0x049f /* Compaq Computer Corp. */
 118 #define USB_COMPAQ_WL215_ID      0x001f /* Compaq WL215 USB Adapter */
 119 #define USB_COMPAQ_W200_ID       0x0076 /* Compaq W200 USB Adapter */
 120 #define USB_HP_WL215_ID          0x0082 /* Compaq WL215 USB Adapter */
 121 
 122 #define USB_MELCO_VENDOR_ID      0x0411
 123 #define USB_BUFFALO_L11_ID       0x0006 /* BUFFALO WLI-USB-L11 */
 124 #define USB_BUFFALO_L11G_WR_ID   0x000B /* BUFFALO WLI-USB-L11G-WR */
 125 #define USB_BUFFALO_L11G_ID      0x000D /* BUFFALO WLI-USB-L11G */
 126 
 127 #define USB_LUCENT_VENDOR_ID     0x047E /* Lucent Technologies */
 128 #define USB_LUCENT_ORINOCO_ID    0x0300 /* Lucent/Agere Orinoco USB Client */
 129 
 130 #define USB_AVAYA8_VENDOR_ID     0x0D98
 131 #define USB_AVAYAE_VENDOR_ID     0x0D9E
 132 #define USB_AVAYA_WIRELESS_ID    0x0300 /* Avaya Wireless USB Card */
 133 
 134 #define USB_AGERE_VENDOR_ID      0x0D4E /* Agere Systems */
 135 #define USB_AGERE_MODEL0801_ID   0x1000 /* Wireless USB Card Model 0801 */
 136 #define USB_AGERE_MODEL0802_ID   0x1001 /* Wireless USB Card Model 0802 */
 137 #define USB_AGERE_REBRANDED_ID   0x047A /* WLAN USB Card */
 138 
 139 #define USB_ELSA_VENDOR_ID       0x05CC
 140 #define USB_ELSA_AIRLANCER_ID    0x3100 /* ELSA AirLancer USB-11 */
 141 
 142 #define USB_LEGEND_VENDOR_ID     0x0E7C
 143 #define USB_LEGEND_JOYNET_ID     0x0300 /* Joynet WLAN USB Card */
 144 
 145 #define USB_SAMSUNG_VENDOR_ID    0x04E8
 146 #define USB_SAMSUNG_SEW2001U1_ID 0x5002 /* Samsung SEW-2001u Card */
 147 #define USB_SAMSUNG_SEW2001U2_ID 0x5B11 /* Samsung SEW-2001u Card */
 148 #define USB_SAMSUNG_SEW2003U_ID  0x7011 /* Samsung SEW-2003U Card */
 149 
 150 #define USB_IGATE_VENDOR_ID      0x0681
 151 #define USB_IGATE_IGATE_11M_ID   0x0012 /* I-GATE 11M USB Card */
 152 
 153 #define USB_FUJITSU_VENDOR_ID    0x0BF8
 154 #define USB_FUJITSU_E1100_ID     0x1002 /* connect2AIR WLAN E-1100 USB */
 155 
 156 #define USB_2WIRE_VENDOR_ID      0x1630
 157 #define USB_2WIRE_WIRELESS_ID    0xff81 /* 2Wire Wireless USB adapter */
 158 
 159 
 160 #define EZUSB_REQUEST_FW_TRANS          0xA0
 161 #define EZUSB_REQUEST_TRIGER            0xAA
 162 #define EZUSB_REQUEST_TRIG_AC           0xAC
 163 #define EZUSB_CPUCS_REG                 0x7F92
 164 
 165 #define EZUSB_RID_TX                    0x0700
 166 #define EZUSB_RID_RX                    0x0701
 167 #define EZUSB_RID_INIT1                 0x0702
 168 #define EZUSB_RID_ACK                   0x0710
 169 #define EZUSB_RID_READ_PDA              0x0800
 170 #define EZUSB_RID_PROG_INIT             0x0852
 171 #define EZUSB_RID_PROG_SET_ADDR         0x0853
 172 #define EZUSB_RID_PROG_BYTES            0x0854
 173 #define EZUSB_RID_PROG_END              0x0855
 174 #define EZUSB_RID_DOCMD                 0x0860
 175 
 176 /* Recognize info frames */
 177 #define EZUSB_IS_INFO(id)               ((id >= 0xF000) && (id <= 0xF2FF))
 178 
 179 #define EZUSB_MAGIC                     0x0210
 180 
 181 #define EZUSB_FRAME_DATA                1
 182 #define EZUSB_FRAME_CONTROL             2
 183 
 184 #define DEF_TIMEOUT                     (3 * HZ)
 185 
 186 #define BULK_BUF_SIZE                   2048
 187 
 188 #define MAX_DL_SIZE (BULK_BUF_SIZE - sizeof(struct ezusb_packet))
 189 
 190 #define FW_BUF_SIZE                     64
 191 #define FW_VAR_OFFSET_PTR               0x359
 192 #define FW_VAR_VALUE                    0
 193 #define FW_HOLE_START                   0x100
 194 #define FW_HOLE_END                     0x300
 195 
 196 struct ezusb_packet {
 197         __le16 magic;           /* 0x0210 */
 198         u8 req_reply_count;
 199         u8 ans_reply_count;
 200         __le16 frame_type;      /* 0x01 for data frames, 0x02 otherwise */
 201         __le16 size;            /* transport size */
 202         __le16 crc;             /* CRC up to here */
 203         __le16 hermes_len;
 204         __le16 hermes_rid;
 205         u8 data[0];
 206 } __packed;
 207 
 208 /* Table of devices that work or may work with this driver */
 209 static const struct usb_device_id ezusb_table[] = {
 210         {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_COMPAQ_WL215_ID)},
 211         {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_HP_WL215_ID)},
 212         {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_COMPAQ_W200_ID)},
 213         {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11_ID)},
 214         {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11G_WR_ID)},
 215         {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11G_ID)},
 216         {USB_DEVICE(USB_LUCENT_VENDOR_ID, USB_LUCENT_ORINOCO_ID)},
 217         {USB_DEVICE(USB_AVAYA8_VENDOR_ID, USB_AVAYA_WIRELESS_ID)},
 218         {USB_DEVICE(USB_AVAYAE_VENDOR_ID, USB_AVAYA_WIRELESS_ID)},
 219         {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_MODEL0801_ID)},
 220         {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_MODEL0802_ID)},
 221         {USB_DEVICE(USB_ELSA_VENDOR_ID, USB_ELSA_AIRLANCER_ID)},
 222         {USB_DEVICE(USB_LEGEND_VENDOR_ID, USB_LEGEND_JOYNET_ID)},
 223         {USB_DEVICE_VER(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2001U1_ID,
 224                         0, 0)},
 225         {USB_DEVICE(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2001U2_ID)},
 226         {USB_DEVICE(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2003U_ID)},
 227         {USB_DEVICE(USB_IGATE_VENDOR_ID, USB_IGATE_IGATE_11M_ID)},
 228         {USB_DEVICE(USB_FUJITSU_VENDOR_ID, USB_FUJITSU_E1100_ID)},
 229         {USB_DEVICE(USB_2WIRE_VENDOR_ID, USB_2WIRE_WIRELESS_ID)},
 230         {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_REBRANDED_ID)},
 231         {}                      /* Terminating entry */
 232 };
 233 
 234 MODULE_DEVICE_TABLE(usb, ezusb_table);
 235 
 236 /* Structure to hold all of our device specific stuff */
 237 struct ezusb_priv {
 238         struct usb_device *udev;
 239         struct net_device *dev;
 240         struct mutex mtx;
 241         spinlock_t req_lock;
 242         struct list_head req_pending;
 243         struct list_head req_active;
 244         spinlock_t reply_count_lock;
 245         u16 hermes_reg_fake[0x40];
 246         u8 *bap_buf;
 247         struct urb *read_urb;
 248         int read_pipe;
 249         int write_pipe;
 250         u8 reply_count;
 251 };
 252 
 253 enum ezusb_state {
 254         EZUSB_CTX_START,
 255         EZUSB_CTX_QUEUED,
 256         EZUSB_CTX_REQ_SUBMITTED,
 257         EZUSB_CTX_REQ_COMPLETE,
 258         EZUSB_CTX_RESP_RECEIVED,
 259         EZUSB_CTX_REQ_TIMEOUT,
 260         EZUSB_CTX_REQ_FAILED,
 261         EZUSB_CTX_RESP_TIMEOUT,
 262         EZUSB_CTX_REQSUBMIT_FAIL,
 263         EZUSB_CTX_COMPLETE,
 264 };
 265 
 266 struct request_context {
 267         struct list_head list;
 268         refcount_t refcount;
 269         struct completion done; /* Signals that CTX is dead */
 270         int killed;
 271         struct urb *outurb;     /* OUT for req pkt */
 272         struct ezusb_priv *upriv;
 273         struct ezusb_packet *buf;
 274         int buf_length;
 275         struct timer_list timer;        /* Timeout handling */
 276         enum ezusb_state state; /* Current state */
 277         /* the RID that we will wait for */
 278         u16 out_rid;
 279         u16 in_rid;
 280 };
 281 
 282 
 283 /* Forward declarations */
 284 static void ezusb_ctx_complete(struct request_context *ctx);
 285 static void ezusb_req_queue_run(struct ezusb_priv *upriv);
 286 static void ezusb_bulk_in_callback(struct urb *urb);
 287 
 288 static inline u8 ezusb_reply_inc(u8 count)
 289 {
 290         if (count < 0x7F)
 291                 return count + 1;
 292         else
 293                 return 1;
 294 }
 295 
 296 static void ezusb_request_context_put(struct request_context *ctx)
 297 {
 298         if (!refcount_dec_and_test(&ctx->refcount))
 299                 return;
 300 
 301         WARN_ON(!ctx->done.done);
 302         BUG_ON(ctx->outurb->status == -EINPROGRESS);
 303         BUG_ON(timer_pending(&ctx->timer));
 304         usb_free_urb(ctx->outurb);
 305         kfree(ctx->buf);
 306         kfree(ctx);
 307 }
 308 
 309 static inline void ezusb_mod_timer(struct ezusb_priv *upriv,
 310                                    struct timer_list *timer,
 311                                    unsigned long expire)
 312 {
 313         if (!upriv->udev)
 314                 return;
 315         mod_timer(timer, expire);
 316 }
 317 
 318 static void ezusb_request_timerfn(struct timer_list *t)
 319 {
 320         struct request_context *ctx = from_timer(ctx, t, timer);
 321 
 322         ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK;
 323         if (usb_unlink_urb(ctx->outurb) == -EINPROGRESS) {
 324                 ctx->state = EZUSB_CTX_REQ_TIMEOUT;
 325         } else {
 326                 ctx->state = EZUSB_CTX_RESP_TIMEOUT;
 327                 dev_dbg(&ctx->outurb->dev->dev, "couldn't unlink\n");
 328                 refcount_inc(&ctx->refcount);
 329                 ctx->killed = 1;
 330                 ezusb_ctx_complete(ctx);
 331                 ezusb_request_context_put(ctx);
 332         }
 333 };
 334 
 335 static struct request_context *ezusb_alloc_ctx(struct ezusb_priv *upriv,
 336                                                u16 out_rid, u16 in_rid)
 337 {
 338         struct request_context *ctx;
 339 
 340         ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
 341         if (!ctx)
 342                 return NULL;
 343 
 344         ctx->buf = kmalloc(BULK_BUF_SIZE, GFP_ATOMIC);
 345         if (!ctx->buf) {
 346                 kfree(ctx);
 347                 return NULL;
 348         }
 349         ctx->outurb = usb_alloc_urb(0, GFP_ATOMIC);
 350         if (!ctx->outurb) {
 351                 kfree(ctx->buf);
 352                 kfree(ctx);
 353                 return NULL;
 354         }
 355 
 356         ctx->upriv = upriv;
 357         ctx->state = EZUSB_CTX_START;
 358         ctx->out_rid = out_rid;
 359         ctx->in_rid = in_rid;
 360 
 361         refcount_set(&ctx->refcount, 1);
 362         init_completion(&ctx->done);
 363 
 364         timer_setup(&ctx->timer, ezusb_request_timerfn, 0);
 365         return ctx;
 366 }
 367 
 368 
 369 /* Hopefully the real complete_all will soon be exported, in the mean
 370  * while this should work. */
 371 static inline void ezusb_complete_all(struct completion *comp)
 372 {
 373         complete(comp);
 374         complete(comp);
 375         complete(comp);
 376         complete(comp);
 377 }
 378 
 379 static void ezusb_ctx_complete(struct request_context *ctx)
 380 {
 381         struct ezusb_priv *upriv = ctx->upriv;
 382         unsigned long flags;
 383 
 384         spin_lock_irqsave(&upriv->req_lock, flags);
 385 
 386         list_del_init(&ctx->list);
 387         if (upriv->udev) {
 388                 spin_unlock_irqrestore(&upriv->req_lock, flags);
 389                 ezusb_req_queue_run(upriv);
 390                 spin_lock_irqsave(&upriv->req_lock, flags);
 391         }
 392 
 393         switch (ctx->state) {
 394         case EZUSB_CTX_COMPLETE:
 395         case EZUSB_CTX_REQSUBMIT_FAIL:
 396         case EZUSB_CTX_REQ_FAILED:
 397         case EZUSB_CTX_REQ_TIMEOUT:
 398         case EZUSB_CTX_RESP_TIMEOUT:
 399                 spin_unlock_irqrestore(&upriv->req_lock, flags);
 400 
 401                 if ((ctx->out_rid == EZUSB_RID_TX) && upriv->dev) {
 402                         struct net_device *dev = upriv->dev;
 403                         struct net_device_stats *stats = &dev->stats;
 404 
 405                         if (ctx->state != EZUSB_CTX_COMPLETE)
 406                                 stats->tx_errors++;
 407                         else
 408                                 stats->tx_packets++;
 409 
 410                         netif_wake_queue(dev);
 411                 }
 412                 ezusb_complete_all(&ctx->done);
 413                 ezusb_request_context_put(ctx);
 414                 break;
 415 
 416         default:
 417                 spin_unlock_irqrestore(&upriv->req_lock, flags);
 418                 if (!upriv->udev) {
 419                         /* This is normal, as all request contexts get flushed
 420                          * when the device is disconnected */
 421                         err("Called, CTX not terminating, but device gone");
 422                         ezusb_complete_all(&ctx->done);
 423                         ezusb_request_context_put(ctx);
 424                         break;
 425                 }
 426 
 427                 err("Called, CTX not in terminating state.");
 428                 /* Things are really bad if this happens. Just leak
 429                  * the CTX because it may still be linked to the
 430                  * queue or the OUT urb may still be active.
 431                  * Just leaking at least prevents an Oops or Panic.
 432                  */
 433                 break;
 434         }
 435 }
 436 
 437 /**
 438  * ezusb_req_queue_run:
 439  * Description:
 440  *      Note: Only one active CTX at any one time, because there's no
 441  *      other (reliable) way to match the response URB to the correct
 442  *      CTX.
 443  **/
 444 static void ezusb_req_queue_run(struct ezusb_priv *upriv)
 445 {
 446         unsigned long flags;
 447         struct request_context *ctx;
 448         int result;
 449 
 450         spin_lock_irqsave(&upriv->req_lock, flags);
 451 
 452         if (!list_empty(&upriv->req_active))
 453                 goto unlock;
 454 
 455         if (list_empty(&upriv->req_pending))
 456                 goto unlock;
 457 
 458         ctx =
 459             list_entry(upriv->req_pending.next, struct request_context,
 460                        list);
 461 
 462         if (!ctx->upriv->udev)
 463                 goto unlock;
 464 
 465         /* We need to split this off to avoid a race condition */
 466         list_move_tail(&ctx->list, &upriv->req_active);
 467 
 468         if (ctx->state == EZUSB_CTX_QUEUED) {
 469                 refcount_inc(&ctx->refcount);
 470                 result = usb_submit_urb(ctx->outurb, GFP_ATOMIC);
 471                 if (result) {
 472                         ctx->state = EZUSB_CTX_REQSUBMIT_FAIL;
 473 
 474                         spin_unlock_irqrestore(&upriv->req_lock, flags);
 475 
 476                         err("Fatal, failed to submit command urb."
 477                             " error=%d\n", result);
 478 
 479                         ezusb_ctx_complete(ctx);
 480                         ezusb_request_context_put(ctx);
 481                         goto done;
 482                 }
 483 
 484                 ctx->state = EZUSB_CTX_REQ_SUBMITTED;
 485                 ezusb_mod_timer(ctx->upriv, &ctx->timer,
 486                                 jiffies + DEF_TIMEOUT);
 487         }
 488 
 489  unlock:
 490         spin_unlock_irqrestore(&upriv->req_lock, flags);
 491 
 492  done:
 493         return;
 494 }
 495 
 496 static void ezusb_req_enqueue_run(struct ezusb_priv *upriv,
 497                                   struct request_context *ctx)
 498 {
 499         unsigned long flags;
 500 
 501         spin_lock_irqsave(&upriv->req_lock, flags);
 502 
 503         if (!ctx->upriv->udev) {
 504                 spin_unlock_irqrestore(&upriv->req_lock, flags);
 505                 goto done;
 506         }
 507         refcount_inc(&ctx->refcount);
 508         list_add_tail(&ctx->list, &upriv->req_pending);
 509         spin_unlock_irqrestore(&upriv->req_lock, flags);
 510 
 511         ctx->state = EZUSB_CTX_QUEUED;
 512         ezusb_req_queue_run(upriv);
 513 
 514  done:
 515         return;
 516 }
 517 
 518 static void ezusb_request_out_callback(struct urb *urb)
 519 {
 520         unsigned long flags;
 521         enum ezusb_state state;
 522         struct request_context *ctx = urb->context;
 523         struct ezusb_priv *upriv = ctx->upriv;
 524 
 525         spin_lock_irqsave(&upriv->req_lock, flags);
 526 
 527         del_timer(&ctx->timer);
 528 
 529         if (ctx->killed) {
 530                 spin_unlock_irqrestore(&upriv->req_lock, flags);
 531                 pr_warn("interrupt called with dead ctx\n");
 532                 goto out;
 533         }
 534 
 535         state = ctx->state;
 536 
 537         if (urb->status == 0) {
 538                 switch (state) {
 539                 case EZUSB_CTX_REQ_SUBMITTED:
 540                         if (ctx->in_rid) {
 541                                 ctx->state = EZUSB_CTX_REQ_COMPLETE;
 542                                 /* reply URB still pending */
 543                                 ezusb_mod_timer(upriv, &ctx->timer,
 544                                                 jiffies + DEF_TIMEOUT);
 545                                 spin_unlock_irqrestore(&upriv->req_lock,
 546                                                        flags);
 547                                 break;
 548                         }
 549                         /* fall through */
 550                 case EZUSB_CTX_RESP_RECEIVED:
 551                         /* IN already received before this OUT-ACK */
 552                         ctx->state = EZUSB_CTX_COMPLETE;
 553                         spin_unlock_irqrestore(&upriv->req_lock, flags);
 554                         ezusb_ctx_complete(ctx);
 555                         break;
 556 
 557                 default:
 558                         spin_unlock_irqrestore(&upriv->req_lock, flags);
 559                         err("Unexpected state(0x%x, %d) in OUT URB",
 560                             state, urb->status);
 561                         break;
 562                 }
 563         } else {
 564                 /* If someone cancels the OUT URB then its status
 565                  * should be either -ECONNRESET or -ENOENT.
 566                  */
 567                 switch (state) {
 568                 case EZUSB_CTX_REQ_SUBMITTED:
 569                 case EZUSB_CTX_RESP_RECEIVED:
 570                         ctx->state = EZUSB_CTX_REQ_FAILED;
 571                         /* fall through */
 572 
 573                 case EZUSB_CTX_REQ_FAILED:
 574                 case EZUSB_CTX_REQ_TIMEOUT:
 575                         spin_unlock_irqrestore(&upriv->req_lock, flags);
 576 
 577                         ezusb_ctx_complete(ctx);
 578                         break;
 579 
 580                 default:
 581                         spin_unlock_irqrestore(&upriv->req_lock, flags);
 582 
 583                         err("Unexpected state(0x%x, %d) in OUT URB",
 584                             state, urb->status);
 585                         break;
 586                 }
 587         }
 588  out:
 589         ezusb_request_context_put(ctx);
 590 }
 591 
 592 static void ezusb_request_in_callback(struct ezusb_priv *upriv,
 593                                       struct urb *urb)
 594 {
 595         struct ezusb_packet *ans = urb->transfer_buffer;
 596         struct request_context *ctx = NULL;
 597         enum ezusb_state state;
 598         unsigned long flags;
 599 
 600         /* Find the CTX on the active queue that requested this URB */
 601         spin_lock_irqsave(&upriv->req_lock, flags);
 602         if (upriv->udev) {
 603                 struct list_head *item;
 604 
 605                 list_for_each(item, &upriv->req_active) {
 606                         struct request_context *c;
 607                         int reply_count;
 608 
 609                         c = list_entry(item, struct request_context, list);
 610                         reply_count =
 611                             ezusb_reply_inc(c->buf->req_reply_count);
 612                         if ((ans->ans_reply_count == reply_count)
 613                             && (le16_to_cpu(ans->hermes_rid) == c->in_rid)) {
 614                                 ctx = c;
 615                                 break;
 616                         }
 617                         netdev_dbg(upriv->dev, "Skipped (0x%x/0x%x) (%d/%d)\n",
 618                                    le16_to_cpu(ans->hermes_rid), c->in_rid,
 619                                    ans->ans_reply_count, reply_count);
 620                 }
 621         }
 622 
 623         if (ctx == NULL) {
 624                 spin_unlock_irqrestore(&upriv->req_lock, flags);
 625                 err("%s: got unexpected RID: 0x%04X", __func__,
 626                     le16_to_cpu(ans->hermes_rid));
 627                 ezusb_req_queue_run(upriv);
 628                 return;
 629         }
 630 
 631         /* The data we want is in the in buffer, exchange */
 632         urb->transfer_buffer = ctx->buf;
 633         ctx->buf = (void *) ans;
 634         ctx->buf_length = urb->actual_length;
 635 
 636         state = ctx->state;
 637         switch (state) {
 638         case EZUSB_CTX_REQ_SUBMITTED:
 639                 /* We have received our response URB before
 640                  * our request has been acknowledged. Do NOT
 641                  * destroy our CTX yet, because our OUT URB
 642                  * is still alive ...
 643                  */
 644                 ctx->state = EZUSB_CTX_RESP_RECEIVED;
 645                 spin_unlock_irqrestore(&upriv->req_lock, flags);
 646 
 647                 /* Let the machine continue running. */
 648                 break;
 649 
 650         case EZUSB_CTX_REQ_COMPLETE:
 651                 /* This is the usual path: our request
 652                  * has already been acknowledged, and
 653                  * we have now received the reply.
 654                  */
 655                 ctx->state = EZUSB_CTX_COMPLETE;
 656 
 657                 /* Stop the intimer */
 658                 del_timer(&ctx->timer);
 659                 spin_unlock_irqrestore(&upriv->req_lock, flags);
 660 
 661                 /* Call the completion handler */
 662                 ezusb_ctx_complete(ctx);
 663                 break;
 664 
 665         default:
 666                 spin_unlock_irqrestore(&upriv->req_lock, flags);
 667 
 668                 pr_warn("Matched IN URB, unexpected context state(0x%x)\n",
 669                         state);
 670                 /* Throw this CTX away and try submitting another */
 671                 del_timer(&ctx->timer);
 672                 ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK;
 673                 usb_unlink_urb(ctx->outurb);
 674                 ezusb_req_queue_run(upriv);
 675                 break;
 676         }                       /* switch */
 677 }
 678 
 679 
 680 static void ezusb_req_ctx_wait(struct ezusb_priv *upriv,
 681                                struct request_context *ctx)
 682 {
 683         switch (ctx->state) {
 684         case EZUSB_CTX_QUEUED:
 685         case EZUSB_CTX_REQ_SUBMITTED:
 686         case EZUSB_CTX_REQ_COMPLETE:
 687         case EZUSB_CTX_RESP_RECEIVED:
 688                 if (in_softirq()) {
 689                         /* If we get called from a timer, timeout timers don't
 690                          * get the chance to run themselves. So we make sure
 691                          * that we don't sleep for ever */
 692                         int msecs = DEF_TIMEOUT * (1000 / HZ);
 693                         while (!ctx->done.done && msecs--)
 694                                 udelay(1000);
 695                 } else {
 696                         wait_event_interruptible(ctx->done.wait,
 697                                                  ctx->done.done);
 698                 }
 699                 break;
 700         default:
 701                 /* Done or failed - nothing to wait for */
 702                 break;
 703         }
 704 }
 705 
 706 static inline u16 build_crc(struct ezusb_packet *data)
 707 {
 708         u16 crc = 0;
 709         u8 *bytes = (u8 *)data;
 710         int i;
 711 
 712         for (i = 0; i < 8; i++)
 713                 crc = (crc << 1) + bytes[i];
 714 
 715         return crc;
 716 }
 717 
 718 /**
 719  * ezusb_fill_req:
 720  *
 721  * if data == NULL and length > 0 the data is assumed to be already in
 722  * the target buffer and only the header is filled.
 723  *
 724  */
 725 static int ezusb_fill_req(struct ezusb_packet *req, u16 length, u16 rid,
 726                           const void *data, u16 frame_type, u8 reply_count)
 727 {
 728         int total_size = sizeof(*req) + length;
 729 
 730         BUG_ON(total_size > BULK_BUF_SIZE);
 731 
 732         req->magic = cpu_to_le16(EZUSB_MAGIC);
 733         req->req_reply_count = reply_count;
 734         req->ans_reply_count = 0;
 735         req->frame_type = cpu_to_le16(frame_type);
 736         req->size = cpu_to_le16(length + 4);
 737         req->crc = cpu_to_le16(build_crc(req));
 738         req->hermes_len = cpu_to_le16(HERMES_BYTES_TO_RECLEN(length));
 739         req->hermes_rid = cpu_to_le16(rid);
 740         if (data)
 741                 memcpy(req->data, data, length);
 742         return total_size;
 743 }
 744 
 745 static int ezusb_submit_in_urb(struct ezusb_priv *upriv)
 746 {
 747         int retval = 0;
 748         void *cur_buf = upriv->read_urb->transfer_buffer;
 749 
 750         if (upriv->read_urb->status == -EINPROGRESS) {
 751                 netdev_dbg(upriv->dev, "urb busy, not resubmiting\n");
 752                 retval = -EBUSY;
 753                 goto exit;
 754         }
 755         usb_fill_bulk_urb(upriv->read_urb, upriv->udev, upriv->read_pipe,
 756                           cur_buf, BULK_BUF_SIZE,
 757                           ezusb_bulk_in_callback, upriv);
 758         upriv->read_urb->transfer_flags = 0;
 759         retval = usb_submit_urb(upriv->read_urb, GFP_ATOMIC);
 760         if (retval)
 761                 err("%s submit failed %d", __func__, retval);
 762 
 763  exit:
 764         return retval;
 765 }
 766 
 767 static inline int ezusb_8051_cpucs(struct ezusb_priv *upriv, int reset)
 768 {
 769         int ret;
 770         u8 *res_val = NULL;
 771 
 772         if (!upriv->udev) {
 773                 err("%s: !upriv->udev", __func__);
 774                 return -EFAULT;
 775         }
 776 
 777         res_val = kmalloc(sizeof(*res_val), GFP_KERNEL);
 778 
 779         if (!res_val)
 780                 return -ENOMEM;
 781 
 782         *res_val = reset;       /* avoid argument promotion */
 783 
 784         ret =  usb_control_msg(upriv->udev,
 785                                usb_sndctrlpipe(upriv->udev, 0),
 786                                EZUSB_REQUEST_FW_TRANS,
 787                                USB_TYPE_VENDOR | USB_RECIP_DEVICE |
 788                                USB_DIR_OUT, EZUSB_CPUCS_REG, 0, res_val,
 789                                sizeof(*res_val), DEF_TIMEOUT);
 790 
 791         kfree(res_val);
 792 
 793         return ret;
 794 }
 795 
 796 static int ezusb_firmware_download(struct ezusb_priv *upriv,
 797                                    struct ez_usb_fw *fw)
 798 {
 799         u8 *fw_buffer;
 800         int retval, addr;
 801         int variant_offset;
 802 
 803         fw_buffer = kmalloc(FW_BUF_SIZE, GFP_KERNEL);
 804         if (!fw_buffer) {
 805                 printk(KERN_ERR PFX "Out of memory for firmware buffer.\n");
 806                 return -ENOMEM;
 807         }
 808         /*
 809          * This byte is 1 and should be replaced with 0.  The offset is
 810          * 0x10AD in version 0.0.6.  The byte in question should follow
 811          * the end of the code pointed to by the jump in the beginning
 812          * of the firmware.  Also, it is read by code located at 0x358.
 813          */
 814         variant_offset = be16_to_cpup((__be16 *) &fw->code[FW_VAR_OFFSET_PTR]);
 815         if (variant_offset >= fw->size) {
 816                 printk(KERN_ERR PFX "Invalid firmware variant offset: "
 817                        "0x%04x\n", variant_offset);
 818                 retval = -EINVAL;
 819                 goto fail;
 820         }
 821 
 822         retval = ezusb_8051_cpucs(upriv, 1);
 823         if (retval < 0)
 824                 goto fail;
 825         for (addr = 0; addr < fw->size; addr += FW_BUF_SIZE) {
 826                 /* 0x100-0x300 should be left alone, it contains card
 827                  * specific data, like USB enumeration information */
 828                 if ((addr >= FW_HOLE_START) && (addr < FW_HOLE_END))
 829                         continue;
 830 
 831                 memcpy(fw_buffer, &fw->code[addr], FW_BUF_SIZE);
 832                 if (variant_offset >= addr &&
 833                     variant_offset < addr + FW_BUF_SIZE) {
 834                         netdev_dbg(upriv->dev,
 835                                    "Patching card_variant byte at 0x%04X\n",
 836                                    variant_offset);
 837                         fw_buffer[variant_offset - addr] = FW_VAR_VALUE;
 838                 }
 839                 retval = usb_control_msg(upriv->udev,
 840                                          usb_sndctrlpipe(upriv->udev, 0),
 841                                          EZUSB_REQUEST_FW_TRANS,
 842                                          USB_TYPE_VENDOR | USB_RECIP_DEVICE
 843                                          | USB_DIR_OUT,
 844                                          addr, 0x0,
 845                                          fw_buffer, FW_BUF_SIZE,
 846                                          DEF_TIMEOUT);
 847 
 848                 if (retval < 0)
 849                         goto fail;
 850         }
 851         retval = ezusb_8051_cpucs(upriv, 0);
 852         if (retval < 0)
 853                 goto fail;
 854 
 855         goto exit;
 856  fail:
 857         printk(KERN_ERR PFX "Firmware download failed, error %d\n",
 858                retval);
 859  exit:
 860         kfree(fw_buffer);
 861         return retval;
 862 }
 863 
 864 static int ezusb_access_ltv(struct ezusb_priv *upriv,
 865                             struct request_context *ctx,
 866                             u16 length, const void *data, u16 frame_type,
 867                             void *ans_buff, unsigned ans_size, u16 *ans_length)
 868 {
 869         int req_size;
 870         int retval = 0;
 871         enum ezusb_state state;
 872 
 873         BUG_ON(in_irq());
 874 
 875         if (!upriv->udev) {
 876                 retval = -ENODEV;
 877                 goto exit;
 878         }
 879 
 880         if (upriv->read_urb->status != -EINPROGRESS)
 881                 err("%s: in urb not pending", __func__);
 882 
 883         /* protect upriv->reply_count, guarantee sequential numbers */
 884         spin_lock_bh(&upriv->reply_count_lock);
 885         req_size = ezusb_fill_req(ctx->buf, length, ctx->out_rid, data,
 886                                   frame_type, upriv->reply_count);
 887         usb_fill_bulk_urb(ctx->outurb, upriv->udev, upriv->write_pipe,
 888                           ctx->buf, req_size,
 889                           ezusb_request_out_callback, ctx);
 890 
 891         if (ctx->in_rid)
 892                 upriv->reply_count = ezusb_reply_inc(upriv->reply_count);
 893 
 894         ezusb_req_enqueue_run(upriv, ctx);
 895 
 896         spin_unlock_bh(&upriv->reply_count_lock);
 897 
 898         if (ctx->in_rid)
 899                 ezusb_req_ctx_wait(upriv, ctx);
 900 
 901         state = ctx->state;
 902         switch (state) {
 903         case EZUSB_CTX_COMPLETE:
 904                 retval = ctx->outurb->status;
 905                 break;
 906 
 907         case EZUSB_CTX_QUEUED:
 908         case EZUSB_CTX_REQ_SUBMITTED:
 909                 if (!ctx->in_rid)
 910                         break;
 911                 /* fall through */
 912         default:
 913                 err("%s: Unexpected context state %d", __func__,
 914                     state);
 915                 /* fall through */
 916         case EZUSB_CTX_REQ_TIMEOUT:
 917         case EZUSB_CTX_REQ_FAILED:
 918         case EZUSB_CTX_RESP_TIMEOUT:
 919         case EZUSB_CTX_REQSUBMIT_FAIL:
 920                 printk(KERN_ERR PFX "Access failed, resetting (state %d,"
 921                        " reply_count %d)\n", state, upriv->reply_count);
 922                 upriv->reply_count = 0;
 923                 if (state == EZUSB_CTX_REQ_TIMEOUT
 924                     || state == EZUSB_CTX_RESP_TIMEOUT) {
 925                         printk(KERN_ERR PFX "ctx timed out\n");
 926                         retval = -ETIMEDOUT;
 927                 } else {
 928                         printk(KERN_ERR PFX "ctx failed\n");
 929                         retval = -EFAULT;
 930                 }
 931                 goto exit;
 932         }
 933         if (ctx->in_rid) {
 934                 struct ezusb_packet *ans = ctx->buf;
 935                 unsigned exp_len;
 936 
 937                 if (ans->hermes_len != 0)
 938                         exp_len = le16_to_cpu(ans->hermes_len) * 2 + 12;
 939                 else
 940                         exp_len = 14;
 941 
 942                 if (exp_len != ctx->buf_length) {
 943                         err("%s: length mismatch for RID 0x%04x: "
 944                             "expected %d, got %d", __func__,
 945                             ctx->in_rid, exp_len, ctx->buf_length);
 946                         retval = -EIO;
 947                         goto exit;
 948                 }
 949 
 950                 if (ans_buff)
 951                         memcpy(ans_buff, ans->data, min(exp_len, ans_size));
 952                 if (ans_length)
 953                         *ans_length = le16_to_cpu(ans->hermes_len);
 954         }
 955  exit:
 956         ezusb_request_context_put(ctx);
 957         return retval;
 958 }
 959 
 960 static int ezusb_write_ltv(struct hermes *hw, int bap, u16 rid,
 961                            u16 length, const void *data)
 962 {
 963         struct ezusb_priv *upriv = hw->priv;
 964         u16 frame_type;
 965         struct request_context *ctx;
 966 
 967         if (length == 0)
 968                 return -EINVAL;
 969 
 970         length = HERMES_RECLEN_TO_BYTES(length);
 971 
 972         /* On memory mapped devices HERMES_RID_CNFGROUPADDRESSES can be
 973          * set to be empty, but the USB bridge doesn't like it */
 974         if (length == 0)
 975                 return 0;
 976 
 977         ctx = ezusb_alloc_ctx(upriv, rid, EZUSB_RID_ACK);
 978         if (!ctx)
 979                 return -ENOMEM;
 980 
 981         if (rid == EZUSB_RID_TX)
 982                 frame_type = EZUSB_FRAME_DATA;
 983         else
 984                 frame_type = EZUSB_FRAME_CONTROL;
 985 
 986         return ezusb_access_ltv(upriv, ctx, length, data, frame_type,
 987                                 NULL, 0, NULL);
 988 }
 989 
 990 static int ezusb_read_ltv(struct hermes *hw, int bap, u16 rid,
 991                           unsigned bufsize, u16 *length, void *buf)
 992 {
 993         struct ezusb_priv *upriv = hw->priv;
 994         struct request_context *ctx;
 995 
 996         if (bufsize % 2)
 997                 return -EINVAL;
 998 
 999         ctx = ezusb_alloc_ctx(upriv, rid, rid);
1000         if (!ctx)
1001                 return -ENOMEM;
1002 
1003         return ezusb_access_ltv(upriv, ctx, 0, NULL, EZUSB_FRAME_CONTROL,
1004                                 buf, bufsize, length);
1005 }
1006 
1007 static int ezusb_doicmd_wait(struct hermes *hw, u16 cmd, u16 parm0, u16 parm1,
1008                              u16 parm2, struct hermes_response *resp)
1009 {
1010         struct ezusb_priv *upriv = hw->priv;
1011         struct request_context *ctx;
1012 
1013         __le16 data[4] = {
1014                 cpu_to_le16(cmd),
1015                 cpu_to_le16(parm0),
1016                 cpu_to_le16(parm1),
1017                 cpu_to_le16(parm2),
1018         };
1019         netdev_dbg(upriv->dev,
1020                    "0x%04X, parm0 0x%04X, parm1 0x%04X, parm2 0x%04X\n", cmd,
1021                    parm0, parm1, parm2);
1022         ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_DOCMD, EZUSB_RID_ACK);
1023         if (!ctx)
1024                 return -ENOMEM;
1025 
1026         return ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
1027                                 EZUSB_FRAME_CONTROL, NULL, 0, NULL);
1028 }
1029 
1030 static int ezusb_docmd_wait(struct hermes *hw, u16 cmd, u16 parm0,
1031                             struct hermes_response *resp)
1032 {
1033         struct ezusb_priv *upriv = hw->priv;
1034         struct request_context *ctx;
1035 
1036         __le16 data[4] = {
1037                 cpu_to_le16(cmd),
1038                 cpu_to_le16(parm0),
1039                 0,
1040                 0,
1041         };
1042         netdev_dbg(upriv->dev, "0x%04X, parm0 0x%04X\n", cmd, parm0);
1043         ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_DOCMD, EZUSB_RID_ACK);
1044         if (!ctx)
1045                 return -ENOMEM;
1046 
1047         return ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
1048                                 EZUSB_FRAME_CONTROL, NULL, 0, NULL);
1049 }
1050 
1051 static int ezusb_bap_pread(struct hermes *hw, int bap,
1052                            void *buf, int len, u16 id, u16 offset)
1053 {
1054         struct ezusb_priv *upriv = hw->priv;
1055         struct ezusb_packet *ans = (void *) upriv->read_urb->transfer_buffer;
1056         int actual_length = upriv->read_urb->actual_length;
1057 
1058         if (id == EZUSB_RID_RX) {
1059                 if ((sizeof(*ans) + offset + len) > actual_length) {
1060                         printk(KERN_ERR PFX "BAP read beyond buffer end "
1061                                "in rx frame\n");
1062                         return -EINVAL;
1063                 }
1064                 memcpy(buf, ans->data + offset, len);
1065                 return 0;
1066         }
1067 
1068         if (EZUSB_IS_INFO(id)) {
1069                 /* Include 4 bytes for length/type */
1070                 if ((sizeof(*ans) + offset + len - 4) > actual_length) {
1071                         printk(KERN_ERR PFX "BAP read beyond buffer end "
1072                                "in info frame\n");
1073                         return -EFAULT;
1074                 }
1075                 memcpy(buf, ans->data + offset - 4, len);
1076         } else {
1077                 printk(KERN_ERR PFX "Unexpected fid 0x%04x\n", id);
1078                 return -EINVAL;
1079         }
1080 
1081         return 0;
1082 }
1083 
1084 static int ezusb_read_pda(struct hermes *hw, __le16 *pda,
1085                           u32 pda_addr, u16 pda_len)
1086 {
1087         struct ezusb_priv *upriv = hw->priv;
1088         struct request_context *ctx;
1089         __le16 data[] = {
1090                 cpu_to_le16(pda_addr & 0xffff),
1091                 cpu_to_le16(pda_len - 4)
1092         };
1093         ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_READ_PDA, EZUSB_RID_READ_PDA);
1094         if (!ctx)
1095                 return -ENOMEM;
1096 
1097         /* wl_lkm does not include PDA size in the PDA area.
1098          * We will pad the information into pda, so other routines
1099          * don't have to be modified */
1100         pda[0] = cpu_to_le16(pda_len - 2);
1101         /* Includes CFG_PROD_DATA but not itself */
1102         pda[1] = cpu_to_le16(0x0800); /* CFG_PROD_DATA */
1103 
1104         return ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
1105                                 EZUSB_FRAME_CONTROL, &pda[2], pda_len - 4,
1106                                 NULL);
1107 }
1108 
1109 static int ezusb_program_init(struct hermes *hw, u32 entry_point)
1110 {
1111         struct ezusb_priv *upriv = hw->priv;
1112         struct request_context *ctx;
1113         __le32 data = cpu_to_le32(entry_point);
1114 
1115         ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_INIT, EZUSB_RID_ACK);
1116         if (!ctx)
1117                 return -ENOMEM;
1118 
1119         return ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
1120                                 EZUSB_FRAME_CONTROL, NULL, 0, NULL);
1121 }
1122 
1123 static int ezusb_program_end(struct hermes *hw)
1124 {
1125         struct ezusb_priv *upriv = hw->priv;
1126         struct request_context *ctx;
1127 
1128         ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_END, EZUSB_RID_ACK);
1129         if (!ctx)
1130                 return -ENOMEM;
1131 
1132         return ezusb_access_ltv(upriv, ctx, 0, NULL,
1133                                 EZUSB_FRAME_CONTROL, NULL, 0, NULL);
1134 }
1135 
1136 static int ezusb_program_bytes(struct hermes *hw, const char *buf,
1137                                u32 addr, u32 len)
1138 {
1139         struct ezusb_priv *upriv = hw->priv;
1140         struct request_context *ctx;
1141         __le32 data = cpu_to_le32(addr);
1142         int err;
1143 
1144         ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_SET_ADDR, EZUSB_RID_ACK);
1145         if (!ctx)
1146                 return -ENOMEM;
1147 
1148         err = ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
1149                                EZUSB_FRAME_CONTROL, NULL, 0, NULL);
1150         if (err)
1151                 return err;
1152 
1153         ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_BYTES, EZUSB_RID_ACK);
1154         if (!ctx)
1155                 return -ENOMEM;
1156 
1157         return ezusb_access_ltv(upriv, ctx, len, buf,
1158                                 EZUSB_FRAME_CONTROL, NULL, 0, NULL);
1159 }
1160 
1161 static int ezusb_program(struct hermes *hw, const char *buf,
1162                          u32 addr, u32 len)
1163 {
1164         u32 ch_addr;
1165         u32 ch_len;
1166         int err = 0;
1167 
1168         /* We can only send 2048 bytes out of the bulk xmit at a time,
1169          * so we have to split any programming into chunks of <2048
1170          * bytes. */
1171 
1172         ch_len = (len < MAX_DL_SIZE) ? len : MAX_DL_SIZE;
1173         ch_addr = addr;
1174 
1175         while (ch_addr < (addr + len)) {
1176                 pr_debug("Programming subblock of length %d "
1177                          "to address 0x%08x. Data @ %p\n",
1178                          ch_len, ch_addr, &buf[ch_addr - addr]);
1179 
1180                 err = ezusb_program_bytes(hw, &buf[ch_addr - addr],
1181                                           ch_addr, ch_len);
1182                 if (err)
1183                         break;
1184 
1185                 ch_addr += ch_len;
1186                 ch_len = ((addr + len - ch_addr) < MAX_DL_SIZE) ?
1187                         (addr + len - ch_addr) : MAX_DL_SIZE;
1188         }
1189 
1190         return err;
1191 }
1192 
1193 static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
1194 {
1195         struct orinoco_private *priv = ndev_priv(dev);
1196         struct net_device_stats *stats = &dev->stats;
1197         struct ezusb_priv *upriv = priv->card;
1198         u8 mic[MICHAEL_MIC_LEN + 1];
1199         int err = 0;
1200         int tx_control;
1201         unsigned long flags;
1202         struct request_context *ctx;
1203         u8 *buf;
1204         int tx_size;
1205 
1206         if (!netif_running(dev)) {
1207                 printk(KERN_ERR "%s: Tx on stopped device!\n",
1208                        dev->name);
1209                 return NETDEV_TX_BUSY;
1210         }
1211 
1212         if (netif_queue_stopped(dev)) {
1213                 printk(KERN_DEBUG "%s: Tx while transmitter busy!\n",
1214                        dev->name);
1215                 return NETDEV_TX_BUSY;
1216         }
1217 
1218         if (orinoco_lock(priv, &flags) != 0) {
1219                 printk(KERN_ERR
1220                        "%s: ezusb_xmit() called while hw_unavailable\n",
1221                        dev->name);
1222                 return NETDEV_TX_BUSY;
1223         }
1224 
1225         if (!netif_carrier_ok(dev) ||
1226             (priv->iw_mode == NL80211_IFTYPE_MONITOR)) {
1227                 /* Oops, the firmware hasn't established a connection,
1228                    silently drop the packet (this seems to be the
1229                    safest approach). */
1230                 goto drop;
1231         }
1232 
1233         /* Check packet length */
1234         if (skb->len < ETH_HLEN)
1235                 goto drop;
1236 
1237         ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
1238         if (!ctx)
1239                 goto busy;
1240 
1241         memset(ctx->buf, 0, BULK_BUF_SIZE);
1242         buf = ctx->buf->data;
1243 
1244         tx_control = 0;
1245 
1246         err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
1247                                        &mic[0]);
1248         if (err)
1249                 goto drop;
1250 
1251         {
1252                 __le16 *tx_cntl = (__le16 *)buf;
1253                 *tx_cntl = cpu_to_le16(tx_control);
1254                 buf += sizeof(*tx_cntl);
1255         }
1256 
1257         memcpy(buf, skb->data, skb->len);
1258         buf += skb->len;
1259 
1260         if (tx_control & HERMES_TXCTRL_MIC) {
1261                 u8 *m = mic;
1262                 /* Mic has been offset so it can be copied to an even
1263                  * address. We're copying eveything anyway, so we
1264                  * don't need to copy that first byte. */
1265                 if (skb->len % 2)
1266                         m++;
1267                 memcpy(buf, m, MICHAEL_MIC_LEN);
1268                 buf += MICHAEL_MIC_LEN;
1269         }
1270 
1271         /* Finally, we actually initiate the send */
1272         netif_stop_queue(dev);
1273 
1274         /* The card may behave better if we send evenly sized usb transfers */
1275         tx_size = ALIGN(buf - ctx->buf->data, 2);
1276 
1277         err = ezusb_access_ltv(upriv, ctx, tx_size, NULL,
1278                                EZUSB_FRAME_DATA, NULL, 0, NULL);
1279 
1280         if (err) {
1281                 netif_start_queue(dev);
1282                 if (net_ratelimit())
1283                         printk(KERN_ERR "%s: Error %d transmitting packet\n",
1284                                 dev->name, err);
1285                 goto busy;
1286         }
1287 
1288         netif_trans_update(dev);
1289         stats->tx_bytes += skb->len;
1290         goto ok;
1291 
1292  drop:
1293         stats->tx_errors++;
1294         stats->tx_dropped++;
1295 
1296  ok:
1297         orinoco_unlock(priv, &flags);
1298         dev_kfree_skb(skb);
1299         return NETDEV_TX_OK;
1300 
1301  busy:
1302         orinoco_unlock(priv, &flags);
1303         return NETDEV_TX_BUSY;
1304 }
1305 
1306 static int ezusb_allocate(struct hermes *hw, u16 size, u16 *fid)
1307 {
1308         *fid = EZUSB_RID_TX;
1309         return 0;
1310 }
1311 
1312 
1313 static int ezusb_hard_reset(struct orinoco_private *priv)
1314 {
1315         struct ezusb_priv *upriv = priv->card;
1316         int retval = ezusb_8051_cpucs(upriv, 1);
1317 
1318         if (retval < 0) {
1319                 err("Failed to reset");
1320                 return retval;
1321         }
1322 
1323         retval = ezusb_8051_cpucs(upriv, 0);
1324         if (retval < 0) {
1325                 err("Failed to unreset");
1326                 return retval;
1327         }
1328 
1329         netdev_dbg(upriv->dev, "sending control message\n");
1330         retval = usb_control_msg(upriv->udev,
1331                                  usb_sndctrlpipe(upriv->udev, 0),
1332                                  EZUSB_REQUEST_TRIGER,
1333                                  USB_TYPE_VENDOR | USB_RECIP_DEVICE |
1334                                  USB_DIR_OUT, 0x0, 0x0, NULL, 0,
1335                                  DEF_TIMEOUT);
1336         if (retval < 0) {
1337                 err("EZUSB_REQUEST_TRIGER failed retval %d", retval);
1338                 return retval;
1339         }
1340 #if 0
1341         dbg("Sending EZUSB_REQUEST_TRIG_AC");
1342         retval = usb_control_msg(upriv->udev,
1343                                  usb_sndctrlpipe(upriv->udev, 0),
1344                                  EZUSB_REQUEST_TRIG_AC,
1345                                  USB_TYPE_VENDOR | USB_RECIP_DEVICE |
1346                                  USB_DIR_OUT, 0x00FA, 0x0, NULL, 0,
1347                                  DEF_TIMEOUT);
1348         if (retval < 0) {
1349                 err("EZUSB_REQUEST_TRIG_AC failed retval %d", retval);
1350                 return retval;
1351         }
1352 #endif
1353 
1354         return 0;
1355 }
1356 
1357 
1358 static int ezusb_init(struct hermes *hw)
1359 {
1360         struct ezusb_priv *upriv = hw->priv;
1361         int retval;
1362 
1363         BUG_ON(in_interrupt());
1364         if (!upriv)
1365                 return -EINVAL;
1366 
1367         upriv->reply_count = 0;
1368         /* Write the MAGIC number on the simulated registers to keep
1369          * orinoco.c happy */
1370         hermes_write_regn(hw, SWSUPPORT0, HERMES_MAGIC);
1371         hermes_write_regn(hw, RXFID, EZUSB_RID_RX);
1372 
1373         usb_kill_urb(upriv->read_urb);
1374         ezusb_submit_in_urb(upriv);
1375 
1376         retval = ezusb_write_ltv(hw, 0, EZUSB_RID_INIT1,
1377                                  HERMES_BYTES_TO_RECLEN(2), "\x10\x00");
1378         if (retval < 0) {
1379                 printk(KERN_ERR PFX "EZUSB_RID_INIT1 error %d\n", retval);
1380                 return retval;
1381         }
1382 
1383         retval = ezusb_docmd_wait(hw, HERMES_CMD_INIT, 0, NULL);
1384         if (retval < 0) {
1385                 printk(KERN_ERR PFX "HERMES_CMD_INIT error %d\n", retval);
1386                 return retval;
1387         }
1388 
1389         return 0;
1390 }
1391 
1392 static void ezusb_bulk_in_callback(struct urb *urb)
1393 {
1394         struct ezusb_priv *upriv = (struct ezusb_priv *) urb->context;
1395         struct ezusb_packet *ans = urb->transfer_buffer;
1396         u16 crc;
1397         u16 hermes_rid;
1398 
1399         if (upriv->udev == NULL)
1400                 return;
1401 
1402         if (urb->status == -ETIMEDOUT) {
1403                 /* When a device gets unplugged we get this every time
1404                  * we resubmit, flooding the logs.  Since we don't use
1405                  * USB timeouts, it shouldn't happen any other time*/
1406                 pr_warn("%s: urb timed out, not resubmitting\n", __func__);
1407                 return;
1408         }
1409         if (urb->status == -ECONNABORTED) {
1410                 pr_warn("%s: connection abort, resubmitting urb\n",
1411                         __func__);
1412                 goto resubmit;
1413         }
1414         if ((urb->status == -EILSEQ)
1415             || (urb->status == -ENOENT)
1416             || (urb->status == -ECONNRESET)) {
1417                 netdev_dbg(upriv->dev, "status %d, not resubmiting\n",
1418                            urb->status);
1419                 return;
1420         }
1421         if (urb->status)
1422                 netdev_dbg(upriv->dev, "status: %d length: %d\n",
1423                            urb->status, urb->actual_length);
1424         if (urb->actual_length < sizeof(*ans)) {
1425                 err("%s: short read, ignoring", __func__);
1426                 goto resubmit;
1427         }
1428         crc = build_crc(ans);
1429         if (le16_to_cpu(ans->crc) != crc) {
1430                 err("CRC error, ignoring packet");
1431                 goto resubmit;
1432         }
1433 
1434         hermes_rid = le16_to_cpu(ans->hermes_rid);
1435         if ((hermes_rid != EZUSB_RID_RX) && !EZUSB_IS_INFO(hermes_rid)) {
1436                 ezusb_request_in_callback(upriv, urb);
1437         } else if (upriv->dev) {
1438                 struct net_device *dev = upriv->dev;
1439                 struct orinoco_private *priv = ndev_priv(dev);
1440                 struct hermes *hw = &priv->hw;
1441 
1442                 if (hermes_rid == EZUSB_RID_RX) {
1443                         __orinoco_ev_rx(dev, hw);
1444                 } else {
1445                         hermes_write_regn(hw, INFOFID,
1446                                           le16_to_cpu(ans->hermes_rid));
1447                         __orinoco_ev_info(dev, hw);
1448                 }
1449         }
1450 
1451  resubmit:
1452         if (upriv->udev)
1453                 ezusb_submit_in_urb(upriv);
1454 }
1455 
1456 static inline void ezusb_delete(struct ezusb_priv *upriv)
1457 {
1458         struct list_head *item;
1459         struct list_head *tmp_item;
1460         unsigned long flags;
1461 
1462         BUG_ON(in_interrupt());
1463         BUG_ON(!upriv);
1464 
1465         mutex_lock(&upriv->mtx);
1466 
1467         upriv->udev = NULL;     /* No timer will be rearmed from here */
1468 
1469         usb_kill_urb(upriv->read_urb);
1470 
1471         spin_lock_irqsave(&upriv->req_lock, flags);
1472         list_for_each_safe(item, tmp_item, &upriv->req_active) {
1473                 struct request_context *ctx;
1474                 int err;
1475 
1476                 ctx = list_entry(item, struct request_context, list);
1477                 refcount_inc(&ctx->refcount);
1478 
1479                 ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK;
1480                 err = usb_unlink_urb(ctx->outurb);
1481 
1482                 spin_unlock_irqrestore(&upriv->req_lock, flags);
1483                 if (err == -EINPROGRESS)
1484                         wait_for_completion(&ctx->done);
1485 
1486                 del_timer_sync(&ctx->timer);
1487                 /* FIXME: there is an slight chance for the irq handler to
1488                  * be running */
1489                 if (!list_empty(&ctx->list))
1490                         ezusb_ctx_complete(ctx);
1491 
1492                 ezusb_request_context_put(ctx);
1493                 spin_lock_irqsave(&upriv->req_lock, flags);
1494         }
1495         spin_unlock_irqrestore(&upriv->req_lock, flags);
1496 
1497         list_for_each_safe(item, tmp_item, &upriv->req_pending)
1498             ezusb_ctx_complete(list_entry(item,
1499                                           struct request_context, list));
1500 
1501         if (upriv->read_urb && upriv->read_urb->status == -EINPROGRESS)
1502                 printk(KERN_ERR PFX "Some URB in progress\n");
1503 
1504         mutex_unlock(&upriv->mtx);
1505 
1506         if (upriv->read_urb) {
1507                 kfree(upriv->read_urb->transfer_buffer);
1508                 usb_free_urb(upriv->read_urb);
1509         }
1510         kfree(upriv->bap_buf);
1511         if (upriv->dev) {
1512                 struct orinoco_private *priv = ndev_priv(upriv->dev);
1513                 orinoco_if_del(priv);
1514                 wiphy_unregister(priv_to_wiphy(upriv));
1515                 free_orinocodev(priv);
1516         }
1517 }
1518 
1519 static void ezusb_lock_irqsave(spinlock_t *lock,
1520                                unsigned long *flags) __acquires(lock)
1521 {
1522         spin_lock_bh(lock);
1523 }
1524 
1525 static void ezusb_unlock_irqrestore(spinlock_t *lock,
1526                                     unsigned long *flags) __releases(lock)
1527 {
1528         spin_unlock_bh(lock);
1529 }
1530 
1531 static void ezusb_lock_irq(spinlock_t *lock) __acquires(lock)
1532 {
1533         spin_lock_bh(lock);
1534 }
1535 
1536 static void ezusb_unlock_irq(spinlock_t *lock) __releases(lock)
1537 {
1538         spin_unlock_bh(lock);
1539 }
1540 
1541 static const struct hermes_ops ezusb_ops = {
1542         .init = ezusb_init,
1543         .cmd_wait = ezusb_docmd_wait,
1544         .init_cmd_wait = ezusb_doicmd_wait,
1545         .allocate = ezusb_allocate,
1546         .read_ltv = ezusb_read_ltv,
1547         .write_ltv = ezusb_write_ltv,
1548         .bap_pread = ezusb_bap_pread,
1549         .read_pda = ezusb_read_pda,
1550         .program_init = ezusb_program_init,
1551         .program_end = ezusb_program_end,
1552         .program = ezusb_program,
1553         .lock_irqsave = ezusb_lock_irqsave,
1554         .unlock_irqrestore = ezusb_unlock_irqrestore,
1555         .lock_irq = ezusb_lock_irq,
1556         .unlock_irq = ezusb_unlock_irq,
1557 };
1558 
1559 static const struct net_device_ops ezusb_netdev_ops = {
1560         .ndo_open               = orinoco_open,
1561         .ndo_stop               = orinoco_stop,
1562         .ndo_start_xmit         = ezusb_xmit,
1563         .ndo_set_rx_mode        = orinoco_set_multicast_list,
1564         .ndo_change_mtu         = orinoco_change_mtu,
1565         .ndo_set_mac_address    = eth_mac_addr,
1566         .ndo_validate_addr      = eth_validate_addr,
1567         .ndo_tx_timeout         = orinoco_tx_timeout,
1568 };
1569 
1570 static int ezusb_probe(struct usb_interface *interface,
1571                        const struct usb_device_id *id)
1572 {
1573         struct usb_device *udev = interface_to_usbdev(interface);
1574         struct orinoco_private *priv;
1575         struct hermes *hw;
1576         struct ezusb_priv *upriv = NULL;
1577         struct usb_interface_descriptor *iface_desc;
1578         struct usb_endpoint_descriptor *ep;
1579         const struct firmware *fw_entry = NULL;
1580         int retval = 0;
1581         int i;
1582 
1583         priv = alloc_orinocodev(sizeof(*upriv), &udev->dev,
1584                                 ezusb_hard_reset, NULL);
1585         if (!priv) {
1586                 err("Couldn't allocate orinocodev");
1587                 retval = -ENOMEM;
1588                 goto exit;
1589         }
1590 
1591         hw = &priv->hw;
1592 
1593         upriv = priv->card;
1594 
1595         mutex_init(&upriv->mtx);
1596         spin_lock_init(&upriv->reply_count_lock);
1597 
1598         spin_lock_init(&upriv->req_lock);
1599         INIT_LIST_HEAD(&upriv->req_pending);
1600         INIT_LIST_HEAD(&upriv->req_active);
1601 
1602         upriv->udev = udev;
1603 
1604         hw->iobase = (void __force __iomem *) &upriv->hermes_reg_fake;
1605         hw->reg_spacing = HERMES_16BIT_REGSPACING;
1606         hw->priv = upriv;
1607         hw->ops = &ezusb_ops;
1608 
1609         /* set up the endpoint information */
1610         /* check out the endpoints */
1611 
1612         iface_desc = &interface->cur_altsetting->desc;
1613         for (i = 0; i < iface_desc->bNumEndpoints; ++i) {
1614                 ep = &interface->cur_altsetting->endpoint[i].desc;
1615 
1616                 if (usb_endpoint_is_bulk_in(ep)) {
1617                         /* we found a bulk in endpoint */
1618                         if (upriv->read_urb != NULL) {
1619                                 pr_warn("Found a second bulk in ep, ignored\n");
1620                                 continue;
1621                         }
1622 
1623                         upriv->read_urb = usb_alloc_urb(0, GFP_KERNEL);
1624                         if (!upriv->read_urb)
1625                                 goto error;
1626                         if (le16_to_cpu(ep->wMaxPacketSize) != 64)
1627                                 pr_warn("bulk in: wMaxPacketSize!= 64\n");
1628                         if (ep->bEndpointAddress != (2 | USB_DIR_IN))
1629                                 pr_warn("bulk in: bEndpointAddress: %d\n",
1630                                         ep->bEndpointAddress);
1631                         upriv->read_pipe = usb_rcvbulkpipe(udev,
1632                                                          ep->
1633                                                          bEndpointAddress);
1634                         upriv->read_urb->transfer_buffer =
1635                             kmalloc(BULK_BUF_SIZE, GFP_KERNEL);
1636                         if (!upriv->read_urb->transfer_buffer) {
1637                                 err("Couldn't allocate IN buffer");
1638                                 goto error;
1639                         }
1640                 }
1641 
1642                 if (usb_endpoint_is_bulk_out(ep)) {
1643                         /* we found a bulk out endpoint */
1644                         if (upriv->bap_buf != NULL) {
1645                                 pr_warn("Found a second bulk out ep, ignored\n");
1646                                 continue;
1647                         }
1648 
1649                         if (le16_to_cpu(ep->wMaxPacketSize) != 64)
1650                                 pr_warn("bulk out: wMaxPacketSize != 64\n");
1651                         if (ep->bEndpointAddress != 2)
1652                                 pr_warn("bulk out: bEndpointAddress: %d\n",
1653                                         ep->bEndpointAddress);
1654                         upriv->write_pipe = usb_sndbulkpipe(udev,
1655                                                           ep->
1656                                                           bEndpointAddress);
1657                         upriv->bap_buf = kmalloc(BULK_BUF_SIZE, GFP_KERNEL);
1658                         if (!upriv->bap_buf) {
1659                                 err("Couldn't allocate bulk_out_buffer");
1660                                 goto error;
1661                         }
1662                 }
1663         }
1664         if (!upriv->bap_buf || !upriv->read_urb) {
1665                 err("Didn't find the required bulk endpoints");
1666                 goto error;
1667         }
1668 
1669         if (request_firmware(&fw_entry, "orinoco_ezusb_fw",
1670                              &interface->dev) == 0) {
1671                 firmware.size = fw_entry->size;
1672                 firmware.code = fw_entry->data;
1673         }
1674         if (firmware.size && firmware.code) {
1675                 if (ezusb_firmware_download(upriv, &firmware) < 0)
1676                         goto error;
1677         } else {
1678                 err("No firmware to download");
1679                 goto error;
1680         }
1681 
1682         if (ezusb_hard_reset(priv) < 0) {
1683                 err("Cannot reset the device");
1684                 goto error;
1685         }
1686 
1687         /* If the firmware is already downloaded orinoco.c will call
1688          * ezusb_init but if the firmware is not already there, that will make
1689          * the kernel very unstable, so we try initializing here and quit in
1690          * case of error */
1691         if (ezusb_init(hw) < 0) {
1692                 err("Couldn't initialize the device");
1693                 err("Firmware may not be downloaded or may be wrong.");
1694                 goto error;
1695         }
1696 
1697         /* Initialise the main driver */
1698         if (orinoco_init(priv) != 0) {
1699                 err("orinoco_init() failed\n");
1700                 goto error;
1701         }
1702 
1703         if (orinoco_if_add(priv, 0, 0, &ezusb_netdev_ops) != 0) {
1704                 upriv->dev = NULL;
1705                 err("%s: orinoco_if_add() failed", __func__);
1706                 wiphy_unregister(priv_to_wiphy(priv));
1707                 goto error;
1708         }
1709         upriv->dev = priv->ndev;
1710 
1711         goto exit;
1712 
1713  error:
1714         ezusb_delete(upriv);
1715         if (upriv->dev) {
1716                 /* upriv->dev was 0, so ezusb_delete() didn't free it */
1717                 free_orinocodev(priv);
1718         }
1719         upriv = NULL;
1720         retval = -EFAULT;
1721  exit:
1722         if (fw_entry) {
1723                 firmware.code = NULL;
1724                 firmware.size = 0;
1725                 release_firmware(fw_entry);
1726         }
1727         usb_set_intfdata(interface, upriv);
1728         return retval;
1729 }
1730 
1731 
1732 static void ezusb_disconnect(struct usb_interface *intf)
1733 {
1734         struct ezusb_priv *upriv = usb_get_intfdata(intf);
1735         usb_set_intfdata(intf, NULL);
1736         ezusb_delete(upriv);
1737         printk(KERN_INFO PFX "Disconnected\n");
1738 }
1739 
1740 
1741 /* usb specific object needed to register this driver with the usb subsystem */
1742 static struct usb_driver orinoco_driver = {
1743         .name = DRIVER_NAME,
1744         .probe = ezusb_probe,
1745         .disconnect = ezusb_disconnect,
1746         .id_table = ezusb_table,
1747         .disable_hub_initiated_lpm = 1,
1748 };
1749 
1750 module_usb_driver(orinoco_driver);
1751 
1752 MODULE_AUTHOR("Manuel Estrada Sainz");
1753 MODULE_DESCRIPTION("Driver for Orinoco wireless LAN cards using EZUSB bridge");
1754 MODULE_LICENSE("Dual MPL/GPL");
/* [<][>][^][v][top][bottom][index][help] */
root/drivers/net/wireless/intersil/orinoco/orinoco_usb.c

DEFINITIONS
