?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
OMAPDSS: VENC: fix NULL pointer dereference in DSS2 VENC sysfs debug attr on OMAP4
[zen-stable.git] / drivers / net / wireless / libertas_tf / if_usb.c
blobaff8b5743af0c1999159553e66bfd25d6afcf281
1 /*
2 * Copyright (C) 2008, cozybit Inc.
3 * Copyright (C) 2003-2006, Marvell International Ltd.
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or (at
8 * your option) any later version.
9 */
10 #define DRV_NAME "lbtf_usb"
11
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13
14 #include "libertas_tf.h"
15 #include "if_usb.h"
16
17 #include <linux/delay.h>
18 #include <linux/module.h>
19 #include <linux/firmware.h>
20 #include <linux/netdevice.h>
21 #include <linux/slab.h>
22 #include <linux/usb.h>
23
24 #define INSANEDEBUG 0
25 #define lbtf_deb_usb2(...) do { if (INSANEDEBUG) lbtf_deb_usbd(__VA_ARGS__); } while (0)
26
27 #define MESSAGE_HEADER_LEN 4
28
29 static char *lbtf_fw_name = "lbtf_usb.bin";
30 module_param_named(fw_name, lbtf_fw_name, charp, 0644);
31
32 MODULE_FIRMWARE("lbtf_usb.bin");
33
34 static struct usb_device_id if_usb_table[] = {
35 /* Enter the device signature inside */
36 { USB_DEVICE(0x1286, 0x2001) },
37 { USB_DEVICE(0x05a3, 0x8388) },
38 {} /* Terminating entry */
39 };
40
41 MODULE_DEVICE_TABLE(usb, if_usb_table);
42
43 static void if_usb_receive(struct urb *urb);
44 static void if_usb_receive_fwload(struct urb *urb);
45 static int if_usb_prog_firmware(struct if_usb_card *cardp);
46 static int if_usb_host_to_card(struct lbtf_private *priv, uint8_t type,
47 uint8_t *payload, uint16_t nb);
48 static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload,
49 uint16_t nb, u8 data);
50 static void if_usb_free(struct if_usb_card *cardp);
51 static int if_usb_submit_rx_urb(struct if_usb_card *cardp);
52 static int if_usb_reset_device(struct if_usb_card *cardp);
53
54 /**
55 * if_usb_wrike_bulk_callback - call back to handle URB status
56 *
57 * @param urb pointer to urb structure
58 */
59 static void if_usb_write_bulk_callback(struct urb *urb)
60 {
61 if (urb->status != 0) {
62 /* print the failure status number for debug */
63 pr_info("URB in failure status: %d\n", urb->status);
64 } else {
65 lbtf_deb_usb2(&urb->dev->dev, "URB status is successful\n");
66 lbtf_deb_usb2(&urb->dev->dev, "Actual length transmitted %d\n",
67 urb->actual_length);
68 }
69 }
70
71 /**
72 * if_usb_free - free tx/rx urb, skb and rx buffer
73 *
74 * @param cardp pointer if_usb_card
75 */
76 static void if_usb_free(struct if_usb_card *cardp)
77 {
78 lbtf_deb_enter(LBTF_DEB_USB);
79
80 /* Unlink tx & rx urb */
81 usb_kill_urb(cardp->tx_urb);
82 usb_kill_urb(cardp->rx_urb);
83 usb_kill_urb(cardp->cmd_urb);
84
85 usb_free_urb(cardp->tx_urb);
86 cardp->tx_urb = NULL;
87
88 usb_free_urb(cardp->rx_urb);
89 cardp->rx_urb = NULL;
90
91 usb_free_urb(cardp->cmd_urb);
92 cardp->cmd_urb = NULL;
93
94 kfree(cardp->ep_out_buf);
95 cardp->ep_out_buf = NULL;
96
97 lbtf_deb_leave(LBTF_DEB_USB);
98 }
99
100 static void if_usb_setup_firmware(struct lbtf_private *priv)
101 {
102 struct if_usb_card *cardp = priv->card;
103 struct cmd_ds_set_boot2_ver b2_cmd;
104
105 lbtf_deb_enter(LBTF_DEB_USB);
106
107 if_usb_submit_rx_urb(cardp);
108 b2_cmd.hdr.size = cpu_to_le16(sizeof(b2_cmd));
109 b2_cmd.action = 0;
110 b2_cmd.version = cardp->boot2_version;
111
112 if (lbtf_cmd_with_response(priv, CMD_SET_BOOT2_VER, &b2_cmd))
113 lbtf_deb_usb("Setting boot2 version failed\n");
114
115 lbtf_deb_leave(LBTF_DEB_USB);
116 }
117
118 static void if_usb_fw_timeo(unsigned long priv)
119 {
120 struct if_usb_card *cardp = (void *)priv;
121
122 lbtf_deb_enter(LBTF_DEB_USB);
123 if (!cardp->fwdnldover) {
124 /* Download timed out */
125 cardp->priv->surpriseremoved = 1;
126 pr_err("Download timed out\n");
127 } else {
128 lbtf_deb_usb("Download complete, no event. Assuming success\n");
129 }
130 wake_up(&cardp->fw_wq);
131 lbtf_deb_leave(LBTF_DEB_USB);
132 }
133
134 /**
135 * if_usb_probe - sets the configuration values
136 *
137 * @ifnum interface number
138 * @id pointer to usb_device_id
139 *
140 * Returns: 0 on success, error code on failure
141 */
142 static int if_usb_probe(struct usb_interface *intf,
143 const struct usb_device_id *id)
144 {
145 struct usb_device *udev;
146 struct usb_host_interface *iface_desc;
147 struct usb_endpoint_descriptor *endpoint;
148 struct lbtf_private *priv;
149 struct if_usb_card *cardp;
150 int i;
151
152 lbtf_deb_enter(LBTF_DEB_USB);
153 udev = interface_to_usbdev(intf);
154
155 cardp = kzalloc(sizeof(struct if_usb_card), GFP_KERNEL);
156 if (!cardp) {
157 pr_err("Out of memory allocating private data.\n");
158 goto error;
159 }
160
161 setup_timer(&cardp->fw_timeout, if_usb_fw_timeo, (unsigned long)cardp);
162 init_waitqueue_head(&cardp->fw_wq);
163
164 cardp->udev = udev;
165 iface_desc = intf->cur_altsetting;
166
167 lbtf_deb_usbd(&udev->dev, "bcdUSB = 0x%X bDeviceClass = 0x%X"
168 " bDeviceSubClass = 0x%X, bDeviceProtocol = 0x%X\n",
169 le16_to_cpu(udev->descriptor.bcdUSB),
170 udev->descriptor.bDeviceClass,
171 udev->descriptor.bDeviceSubClass,
172 udev->descriptor.bDeviceProtocol);
173
174 for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
175 endpoint = &iface_desc->endpoint[i].desc;
176 if (usb_endpoint_is_bulk_in(endpoint)) {
177 cardp->ep_in_size =
178 le16_to_cpu(endpoint->wMaxPacketSize);
179 cardp->ep_in = usb_endpoint_num(endpoint);
180
181 lbtf_deb_usbd(&udev->dev, "in_endpoint = %d\n",
182 cardp->ep_in);
183 lbtf_deb_usbd(&udev->dev, "Bulk in size is %d\n",
184 cardp->ep_in_size);
185 } else if (usb_endpoint_is_bulk_out(endpoint)) {
186 cardp->ep_out_size =
187 le16_to_cpu(endpoint->wMaxPacketSize);
188 cardp->ep_out = usb_endpoint_num(endpoint);
189
190 lbtf_deb_usbd(&udev->dev, "out_endpoint = %d\n",
191 cardp->ep_out);
192 lbtf_deb_usbd(&udev->dev, "Bulk out size is %d\n",
193 cardp->ep_out_size);
194 }
195 }
196 if (!cardp->ep_out_size || !cardp->ep_in_size) {
197 lbtf_deb_usbd(&udev->dev, "Endpoints not found\n");
198 /* Endpoints not found */
199 goto dealloc;
200 }
201
202 cardp->rx_urb = usb_alloc_urb(0, GFP_KERNEL);
203 if (!cardp->rx_urb) {
204 lbtf_deb_usbd(&udev->dev, "Rx URB allocation failed\n");
205 goto dealloc;
206 }
207
208 cardp->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
209 if (!cardp->tx_urb) {
210 lbtf_deb_usbd(&udev->dev, "Tx URB allocation failed\n");
211 goto dealloc;
212 }
213
214 cardp->cmd_urb = usb_alloc_urb(0, GFP_KERNEL);
215 if (!cardp->cmd_urb) {
216 lbtf_deb_usbd(&udev->dev, "Cmd URB allocation failed\n");
217 goto dealloc;
218 }
219
220 cardp->ep_out_buf = kmalloc(MRVDRV_ETH_TX_PACKET_BUFFER_SIZE,
221 GFP_KERNEL);
222 if (!cardp->ep_out_buf) {
223 lbtf_deb_usbd(&udev->dev, "Could not allocate buffer\n");
224 goto dealloc;
225 }
226
227 priv = lbtf_add_card(cardp, &udev->dev);
228 if (!priv)
229 goto dealloc;
230
231 cardp->priv = priv;
232
233 priv->hw_host_to_card = if_usb_host_to_card;
234 priv->hw_prog_firmware = if_usb_prog_firmware;
235 priv->hw_reset_device = if_usb_reset_device;
236 cardp->boot2_version = udev->descriptor.bcdDevice;
237
238 usb_get_dev(udev);
239 usb_set_intfdata(intf, cardp);
240
241 return 0;
242
243 dealloc:
244 if_usb_free(cardp);
245 error:
246 lbtf_deb_leave(LBTF_DEB_MAIN);
247 return -ENOMEM;
248 }
249
250 /**
251 * if_usb_disconnect - free resource and cleanup
252 *
253 * @intf USB interface structure
254 */
255 static void if_usb_disconnect(struct usb_interface *intf)
256 {
257 struct if_usb_card *cardp = usb_get_intfdata(intf);
258 struct lbtf_private *priv = (struct lbtf_private *) cardp->priv;
259
260 lbtf_deb_enter(LBTF_DEB_MAIN);
261
262 if_usb_reset_device(cardp);
263
264 if (priv)
265 lbtf_remove_card(priv);
266
267 /* Unlink and free urb */
268 if_usb_free(cardp);
269
270 usb_set_intfdata(intf, NULL);
271 usb_put_dev(interface_to_usbdev(intf));
272
273 lbtf_deb_leave(LBTF_DEB_MAIN);
274 }
275
276 /**
277 * if_usb_send_fw_pkt - This function downloads the FW
278 *
279 * @priv pointer to struct lbtf_private
280 *
281 * Returns: 0
282 */
283 static int if_usb_send_fw_pkt(struct if_usb_card *cardp)
284 {
285 struct fwdata *fwdata = cardp->ep_out_buf;
286 u8 *firmware = (u8 *) cardp->fw->data;
287
288 lbtf_deb_enter(LBTF_DEB_FW);
289
290 /* If we got a CRC failure on the last block, back
291 up and retry it */
292 if (!cardp->CRC_OK) {
293 cardp->totalbytes = cardp->fwlastblksent;
294 cardp->fwseqnum--;
295 }
296
297 lbtf_deb_usb2(&cardp->udev->dev, "totalbytes = %d\n",
298 cardp->totalbytes);
299
300 /* struct fwdata (which we sent to the card) has an
301 extra __le32 field in between the header and the data,
302 which is not in the struct fwheader in the actual
303 firmware binary. Insert the seqnum in the middle... */
304 memcpy(&fwdata->hdr, &firmware[cardp->totalbytes],
305 sizeof(struct fwheader));
306
307 cardp->fwlastblksent = cardp->totalbytes;
308 cardp->totalbytes += sizeof(struct fwheader);
309
310 memcpy(fwdata->data, &firmware[cardp->totalbytes],
311 le32_to_cpu(fwdata->hdr.datalength));
312
313 lbtf_deb_usb2(&cardp->udev->dev, "Data length = %d\n",
314 le32_to_cpu(fwdata->hdr.datalength));
315
316 fwdata->seqnum = cpu_to_le32(++cardp->fwseqnum);
317 cardp->totalbytes += le32_to_cpu(fwdata->hdr.datalength);
318
319 usb_tx_block(cardp, cardp->ep_out_buf, sizeof(struct fwdata) +
320 le32_to_cpu(fwdata->hdr.datalength), 0);
321
322 if (fwdata->hdr.dnldcmd == cpu_to_le32(FW_HAS_DATA_TO_RECV)) {
323 lbtf_deb_usb2(&cardp->udev->dev, "There are data to follow\n");
324 lbtf_deb_usb2(&cardp->udev->dev,
325 "seqnum = %d totalbytes = %d\n",
326 cardp->fwseqnum, cardp->totalbytes);
327 } else if (fwdata->hdr.dnldcmd == cpu_to_le32(FW_HAS_LAST_BLOCK)) {
328 lbtf_deb_usb2(&cardp->udev->dev,
329 "Host has finished FW downloading\n");
330 lbtf_deb_usb2(&cardp->udev->dev, "Donwloading FW JUMP BLOCK\n");
331
332 /* Host has finished FW downloading
333 * Donwloading FW JUMP BLOCK
334 */
335 cardp->fwfinalblk = 1;
336 }
337
338 lbtf_deb_usb2(&cardp->udev->dev, "Firmware download done; size %d\n",
339 cardp->totalbytes);
340
341 lbtf_deb_leave(LBTF_DEB_FW);
342 return 0;
343 }
344
345 static int if_usb_reset_device(struct if_usb_card *cardp)
346 {
347 struct cmd_ds_802_11_reset *cmd = cardp->ep_out_buf + 4;
348 int ret;
349
350 lbtf_deb_enter(LBTF_DEB_USB);
351
352 *(__le32 *)cardp->ep_out_buf = cpu_to_le32(CMD_TYPE_REQUEST);
353
354 cmd->hdr.command = cpu_to_le16(CMD_802_11_RESET);
355 cmd->hdr.size = cpu_to_le16(sizeof(struct cmd_ds_802_11_reset));
356 cmd->hdr.result = cpu_to_le16(0);
357 cmd->hdr.seqnum = cpu_to_le16(0x5a5a);
358 cmd->action = cpu_to_le16(CMD_ACT_HALT);
359 usb_tx_block(cardp, cardp->ep_out_buf,
360 4 + sizeof(struct cmd_ds_802_11_reset), 0);
361
362 msleep(100);
363 ret = usb_reset_device(cardp->udev);
364 msleep(100);
365
366 lbtf_deb_leave_args(LBTF_DEB_USB, "ret %d", ret);
367
368 return ret;
369 }
370 EXPORT_SYMBOL_GPL(if_usb_reset_device);
371
372 /**
373 * usb_tx_block - transfer data to the device
374 *
375 * @priv pointer to struct lbtf_private
376 * @payload pointer to payload data
377 * @nb data length
378 * @data non-zero for data, zero for commands
379 *
380 * Returns: 0 on success, nonzero otherwise.
381 */
382 static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload,
383 uint16_t nb, u8 data)
384 {
385 int ret = -1;
386 struct urb *urb;
387
388 lbtf_deb_enter(LBTF_DEB_USB);
389 /* check if device is removed */
390 if (cardp->priv->surpriseremoved) {
391 lbtf_deb_usbd(&cardp->udev->dev, "Device removed\n");
392 goto tx_ret;
393 }
394
395 if (data)
396 urb = cardp->tx_urb;
397 else
398 urb = cardp->cmd_urb;
399
400 usb_fill_bulk_urb(urb, cardp->udev,
401 usb_sndbulkpipe(cardp->udev,
402 cardp->ep_out),
403 payload, nb, if_usb_write_bulk_callback, cardp);
404
405 urb->transfer_flags |= URB_ZERO_PACKET;
406
407 if (usb_submit_urb(urb, GFP_ATOMIC)) {
408 lbtf_deb_usbd(&cardp->udev->dev,
409 "usb_submit_urb failed: %d\n", ret);
410 goto tx_ret;
411 }
412
413 lbtf_deb_usb2(&cardp->udev->dev, "usb_submit_urb success\n");
414
415 ret = 0;
416
417 tx_ret:
418 lbtf_deb_leave(LBTF_DEB_USB);
419 return ret;
420 }
421
422 static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
423 void (*callbackfn)(struct urb *urb))
424 {
425 struct sk_buff *skb;
426 int ret = -1;
427
428 lbtf_deb_enter(LBTF_DEB_USB);
429
430 skb = dev_alloc_skb(MRVDRV_ETH_RX_PACKET_BUFFER_SIZE);
431 if (!skb) {
432 pr_err("No free skb\n");
433 lbtf_deb_leave(LBTF_DEB_USB);
434 return -1;
435 }
436
437 cardp->rx_skb = skb;
438
439 /* Fill the receive configuration URB and initialise the Rx call back */
440 usb_fill_bulk_urb(cardp->rx_urb, cardp->udev,
441 usb_rcvbulkpipe(cardp->udev, cardp->ep_in),
442 skb_tail_pointer(skb),
443 MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn, cardp);
444
445 cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET;
446
447 lbtf_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n",
448 cardp->rx_urb);
449 ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC);
450 if (ret) {
451 lbtf_deb_usbd(&cardp->udev->dev,
452 "Submit Rx URB failed: %d\n", ret);
453 kfree_skb(skb);
454 cardp->rx_skb = NULL;
455 lbtf_deb_leave(LBTF_DEB_USB);
456 return -1;
457 } else {
458 lbtf_deb_usb2(&cardp->udev->dev, "Submit Rx URB success\n");
459 lbtf_deb_leave(LBTF_DEB_USB);
460 return 0;
461 }
462 }
463
464 static int if_usb_submit_rx_urb_fwload(struct if_usb_card *cardp)
465 {
466 return __if_usb_submit_rx_urb(cardp, &if_usb_receive_fwload);
467 }
468
469 static int if_usb_submit_rx_urb(struct if_usb_card *cardp)
470 {
471 return __if_usb_submit_rx_urb(cardp, &if_usb_receive);
472 }
473
474 static void if_usb_receive_fwload(struct urb *urb)
475 {
476 struct if_usb_card *cardp = urb->context;
477 struct sk_buff *skb = cardp->rx_skb;
478 struct fwsyncheader *syncfwheader;
479 struct bootcmdresp bcmdresp;
480
481 lbtf_deb_enter(LBTF_DEB_USB);
482 if (urb->status) {
483 lbtf_deb_usbd(&cardp->udev->dev,
484 "URB status is failed during fw load\n");
485 kfree_skb(skb);
486 lbtf_deb_leave(LBTF_DEB_USB);
487 return;
488 }
489
490 if (cardp->fwdnldover) {
491 __le32 *tmp = (__le32 *)(skb->data);
492
493 if (tmp[0] == cpu_to_le32(CMD_TYPE_INDICATION) &&
494 tmp[1] == cpu_to_le32(MACREG_INT_CODE_FIRMWARE_READY)) {
495 /* Firmware ready event received */
496 pr_info("Firmware ready event received\n");
497 wake_up(&cardp->fw_wq);
498 } else {
499 lbtf_deb_usb("Waiting for confirmation; got %x %x\n",
500 le32_to_cpu(tmp[0]), le32_to_cpu(tmp[1]));
501 if_usb_submit_rx_urb_fwload(cardp);
502 }
503 kfree_skb(skb);
504 lbtf_deb_leave(LBTF_DEB_USB);
505 return;
506 }
507 if (cardp->bootcmdresp <= 0) {
508 memcpy(&bcmdresp, skb->data, sizeof(bcmdresp));
509
510 if (le16_to_cpu(cardp->udev->descriptor.bcdDevice) < 0x3106) {
511 kfree_skb(skb);
512 if_usb_submit_rx_urb_fwload(cardp);
513 cardp->bootcmdresp = 1;
514 /* Received valid boot command response */
515 lbtf_deb_usbd(&cardp->udev->dev,
516 "Received valid boot command response\n");
517 lbtf_deb_leave(LBTF_DEB_USB);
518 return;
519 }
520 if (bcmdresp.magic != cpu_to_le32(BOOT_CMD_MAGIC_NUMBER)) {
521 if (bcmdresp.magic == cpu_to_le32(CMD_TYPE_REQUEST) ||
522 bcmdresp.magic == cpu_to_le32(CMD_TYPE_DATA) ||
523 bcmdresp.magic == cpu_to_le32(CMD_TYPE_INDICATION)) {
524 if (!cardp->bootcmdresp)
525 pr_info("Firmware already seems alive; resetting\n");
526 cardp->bootcmdresp = -1;
527 } else {
528 pr_info("boot cmd response wrong magic number (0x%x)\n",
529 le32_to_cpu(bcmdresp.magic));
530 }
531 } else if (bcmdresp.cmd != BOOT_CMD_FW_BY_USB) {
532 pr_info("boot cmd response cmd_tag error (%d)\n",
533 bcmdresp.cmd);
534 } else if (bcmdresp.result != BOOT_CMD_RESP_OK) {
535 pr_info("boot cmd response result error (%d)\n",
536 bcmdresp.result);
537 } else {
538 cardp->bootcmdresp = 1;
539 lbtf_deb_usbd(&cardp->udev->dev,
540 "Received valid boot command response\n");
541 }
542
543 kfree_skb(skb);
544 if_usb_submit_rx_urb_fwload(cardp);
545 lbtf_deb_leave(LBTF_DEB_USB);
546 return;
547 }
548
549 syncfwheader = kmemdup(skb->data, sizeof(struct fwsyncheader),
550 GFP_ATOMIC);
551 if (!syncfwheader) {
552 lbtf_deb_usbd(&cardp->udev->dev,
553 "Failure to allocate syncfwheader\n");
554 kfree_skb(skb);
555 lbtf_deb_leave(LBTF_DEB_USB);
556 return;
557 }
558
559 if (!syncfwheader->cmd) {
560 lbtf_deb_usb2(&cardp->udev->dev,
561 "FW received Blk with correct CRC\n");
562 lbtf_deb_usb2(&cardp->udev->dev,
563 "FW received Blk seqnum = %d\n",
564 le32_to_cpu(syncfwheader->seqnum));
565 cardp->CRC_OK = 1;
566 } else {
567 lbtf_deb_usbd(&cardp->udev->dev,
568 "FW received Blk with CRC error\n");
569 cardp->CRC_OK = 0;
570 }
571
572 kfree_skb(skb);
573
574 /* reschedule timer for 200ms hence */
575 mod_timer(&cardp->fw_timeout, jiffies + (HZ/5));
576
577 if (cardp->fwfinalblk) {
578 cardp->fwdnldover = 1;
579 goto exit;
580 }
581
582 if_usb_send_fw_pkt(cardp);
583
584 exit:
585 if_usb_submit_rx_urb_fwload(cardp);
586
587 kfree(syncfwheader);
588
589 lbtf_deb_leave(LBTF_DEB_USB);
590 }
591
592 #define MRVDRV_MIN_PKT_LEN 30
593
594 static inline void process_cmdtypedata(int recvlength, struct sk_buff *skb,
595 struct if_usb_card *cardp,
596 struct lbtf_private *priv)
597 {
598 if (recvlength > MRVDRV_ETH_RX_PACKET_BUFFER_SIZE + MESSAGE_HEADER_LEN
599 || recvlength < MRVDRV_MIN_PKT_LEN) {
600 lbtf_deb_usbd(&cardp->udev->dev, "Packet length is Invalid\n");
601 kfree_skb(skb);
602 return;
603 }
604
605 skb_put(skb, recvlength);
606 skb_pull(skb, MESSAGE_HEADER_LEN);
607 lbtf_rx(priv, skb);
608 }
609
610 static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,
611 struct sk_buff *skb,
612 struct if_usb_card *cardp,
613 struct lbtf_private *priv)
614 {
615 if (recvlength > LBS_CMD_BUFFER_SIZE) {
616 lbtf_deb_usbd(&cardp->udev->dev,
617 "The receive buffer is too large\n");
618 kfree_skb(skb);
619 return;
620 }
621
622 BUG_ON(!in_interrupt());
623
624 spin_lock(&priv->driver_lock);
625 memcpy(priv->cmd_resp_buff, recvbuff + MESSAGE_HEADER_LEN,
626 recvlength - MESSAGE_HEADER_LEN);
627 kfree_skb(skb);
628 lbtf_cmd_response_rx(priv);
629 spin_unlock(&priv->driver_lock);
630 }
631
632 /**
633 * if_usb_receive - read data received from the device.
634 *
635 * @urb pointer to struct urb
636 */
637 static void if_usb_receive(struct urb *urb)
638 {
639 struct if_usb_card *cardp = urb->context;
640 struct sk_buff *skb = cardp->rx_skb;
641 struct lbtf_private *priv = cardp->priv;
642 int recvlength = urb->actual_length;
643 uint8_t *recvbuff = NULL;
644 uint32_t recvtype = 0;
645 __le32 *pkt = (__le32 *) skb->data;
646
647 lbtf_deb_enter(LBTF_DEB_USB);
648
649 if (recvlength) {
650 if (urb->status) {
651 lbtf_deb_usbd(&cardp->udev->dev, "RX URB failed: %d\n",
652 urb->status);
653 kfree_skb(skb);
654 goto setup_for_next;
655 }
656
657 recvbuff = skb->data;
658 recvtype = le32_to_cpu(pkt[0]);
659 lbtf_deb_usbd(&cardp->udev->dev,
660 "Recv length = 0x%x, Recv type = 0x%X\n",
661 recvlength, recvtype);
662 } else if (urb->status) {
663 kfree_skb(skb);
664 lbtf_deb_leave(LBTF_DEB_USB);
665 return;
666 }
667
668 switch (recvtype) {
669 case CMD_TYPE_DATA:
670 process_cmdtypedata(recvlength, skb, cardp, priv);
671 break;
672
673 case CMD_TYPE_REQUEST:
674 process_cmdrequest(recvlength, recvbuff, skb, cardp, priv);
675 break;
676
677 case CMD_TYPE_INDICATION:
678 {
679 /* Event cause handling */
680 u32 event_cause = le32_to_cpu(pkt[1]);
681 lbtf_deb_usbd(&cardp->udev->dev, "**EVENT** 0x%X\n",
682 event_cause);
683
684 /* Icky undocumented magic special case */
685 if (event_cause & 0xffff0000) {
686 u16 tmp;
687 u8 retrycnt;
688 u8 failure;
689
690 tmp = event_cause >> 16;
691 retrycnt = tmp & 0x00ff;
692 failure = (tmp & 0xff00) >> 8;
693 lbtf_send_tx_feedback(priv, retrycnt, failure);
694 } else if (event_cause == LBTF_EVENT_BCN_SENT)
695 lbtf_bcn_sent(priv);
696 else
697 lbtf_deb_usbd(&cardp->udev->dev,
698 "Unsupported notification %d received\n",
699 event_cause);
700 kfree_skb(skb);
701 break;
702 }
703 default:
704 lbtf_deb_usbd(&cardp->udev->dev,
705 "libertastf: unknown command type 0x%X\n", recvtype);
706 kfree_skb(skb);
707 break;
708 }
709
710 setup_for_next:
711 if_usb_submit_rx_urb(cardp);
712 lbtf_deb_leave(LBTF_DEB_USB);
713 }
714
715 /**
716 * if_usb_host_to_card - Download data to the device
717 *
718 * @priv pointer to struct lbtf_private structure
719 * @type type of data
720 * @buf pointer to data buffer
721 * @len number of bytes
722 *
723 * Returns: 0 on success, nonzero otherwise
724 */
725 static int if_usb_host_to_card(struct lbtf_private *priv, uint8_t type,
726 uint8_t *payload, uint16_t nb)
727 {
728 struct if_usb_card *cardp = priv->card;
729 u8 data = 0;
730
731 lbtf_deb_usbd(&cardp->udev->dev, "*** type = %u\n", type);
732 lbtf_deb_usbd(&cardp->udev->dev, "size after = %d\n", nb);
733
734 if (type == MVMS_CMD) {
735 *(__le32 *)cardp->ep_out_buf = cpu_to_le32(CMD_TYPE_REQUEST);
736 } else {
737 *(__le32 *)cardp->ep_out_buf = cpu_to_le32(CMD_TYPE_DATA);
738 data = 1;
739 }
740
741 memcpy((cardp->ep_out_buf + MESSAGE_HEADER_LEN), payload, nb);
742
743 return usb_tx_block(cardp, cardp->ep_out_buf, nb + MESSAGE_HEADER_LEN,
744 data);
745 }
746
747 /**
748 * if_usb_issue_boot_command - Issue boot command to Boot2.
749 *
750 * @ivalue 1 boots from FW by USB-Download, 2 boots from FW in EEPROM.
751 *
752 * Returns: 0
753 */
754 static int if_usb_issue_boot_command(struct if_usb_card *cardp, int ivalue)
755 {
756 struct bootcmd *bootcmd = cardp->ep_out_buf;
757
758 /* Prepare command */
759 bootcmd->magic = cpu_to_le32(BOOT_CMD_MAGIC_NUMBER);
760 bootcmd->cmd = ivalue;
761 memset(bootcmd->pad, 0, sizeof(bootcmd->pad));
762
763 /* Issue command */
764 usb_tx_block(cardp, cardp->ep_out_buf, sizeof(*bootcmd), 0);
765
766 return 0;
767 }
768
769
770 /**
771 * check_fwfile_format - Check the validity of Boot2/FW image.
772 *
773 * @data pointer to image
774 * @totlen image length
775 *
776 * Returns: 0 if the image is valid, nonzero otherwise.
777 */
778 static int check_fwfile_format(const u8 *data, u32 totlen)
779 {
780 u32 bincmd, exit;
781 u32 blksize, offset, len;
782 int ret;
783
784 ret = 1;
785 exit = len = 0;
786
787 do {
788 struct fwheader *fwh = (void *) data;
789
790 bincmd = le32_to_cpu(fwh->dnldcmd);
791 blksize = le32_to_cpu(fwh->datalength);
792 switch (bincmd) {
793 case FW_HAS_DATA_TO_RECV:
794 offset = sizeof(struct fwheader) + blksize;
795 data += offset;
796 len += offset;
797 if (len >= totlen)
798 exit = 1;
799 break;
800 case FW_HAS_LAST_BLOCK:
801 exit = 1;
802 ret = 0;
803 break;
804 default:
805 exit = 1;
806 break;
807 }
808 } while (!exit);
809
810 if (ret)
811 pr_err("firmware file format check FAIL\n");
812 else
813 lbtf_deb_fw("firmware file format check PASS\n");
814
815 return ret;
816 }
817
818
819 static int if_usb_prog_firmware(struct if_usb_card *cardp)
820 {
821 int i = 0;
822 static int reset_count = 10;
823 int ret = 0;
824
825 lbtf_deb_enter(LBTF_DEB_USB);
826
827 kparam_block_sysfs_write(fw_name);
828 ret = request_firmware(&cardp->fw, lbtf_fw_name, &cardp->udev->dev);
829 if (ret < 0) {
830 pr_err("request_firmware() failed with %#x\n", ret);
831 pr_err("firmware %s not found\n", lbtf_fw_name);
832 kparam_unblock_sysfs_write(fw_name);
833 goto done;
834 }
835 kparam_unblock_sysfs_write(fw_name);
836
837 if (check_fwfile_format(cardp->fw->data, cardp->fw->size))
838 goto release_fw;
839
840 restart:
841 if (if_usb_submit_rx_urb_fwload(cardp) < 0) {
842 lbtf_deb_usbd(&cardp->udev->dev, "URB submission is failed\n");
843 ret = -1;
844 goto release_fw;
845 }
846
847 cardp->bootcmdresp = 0;
848 do {
849 int j = 0;
850 i++;
851 /* Issue Boot command = 1, Boot from Download-FW */
852 if_usb_issue_boot_command(cardp, BOOT_CMD_FW_BY_USB);
853 /* wait for command response */
854 do {
855 j++;
856 msleep_interruptible(100);
857 } while (cardp->bootcmdresp == 0 && j < 10);
858 } while (cardp->bootcmdresp == 0 && i < 5);
859
860 if (cardp->bootcmdresp <= 0) {
861 if (--reset_count >= 0) {
862 if_usb_reset_device(cardp);
863 goto restart;
864 }
865 return -1;
866 }
867
868 i = 0;
869
870 cardp->totalbytes = 0;
871 cardp->fwlastblksent = 0;
872 cardp->CRC_OK = 1;
873 cardp->fwdnldover = 0;
874 cardp->fwseqnum = -1;
875 cardp->totalbytes = 0;
876 cardp->fwfinalblk = 0;
877
878 /* Send the first firmware packet... */
879 if_usb_send_fw_pkt(cardp);
880
881 /* ... and wait for the process to complete */
882 wait_event_interruptible(cardp->fw_wq, cardp->priv->surpriseremoved ||
883 cardp->fwdnldover);
884
885 del_timer_sync(&cardp->fw_timeout);
886 usb_kill_urb(cardp->rx_urb);
887
888 if (!cardp->fwdnldover) {
889 pr_info("failed to load fw, resetting device!\n");
890 if (--reset_count >= 0) {
891 if_usb_reset_device(cardp);
892 goto restart;
893 }
894
895 pr_info("FW download failure, time = %d ms\n", i * 100);
896 ret = -1;
897 goto release_fw;
898 }
899
900 cardp->priv->fw_ready = 1;
901
902 release_fw:
903 release_firmware(cardp->fw);
904 cardp->fw = NULL;
905
906 if_usb_setup_firmware(cardp->priv);
907
908 done:
909 lbtf_deb_leave_args(LBTF_DEB_USB, "ret %d", ret);
910 return ret;
911 }
912 EXPORT_SYMBOL_GPL(if_usb_prog_firmware);
913
914
915 #define if_usb_suspend NULL
916 #define if_usb_resume NULL
917
918 static struct usb_driver if_usb_driver = {
919 .name = DRV_NAME,
920 .probe = if_usb_probe,
921 .disconnect = if_usb_disconnect,
922 .id_table = if_usb_table,
923 .suspend = if_usb_suspend,
924 .resume = if_usb_resume,
925 };
926
927 module_usb_driver(if_usb_driver);
928
929 MODULE_DESCRIPTION("8388 USB WLAN Thinfirm Driver");
930 MODULE_AUTHOR("Cozybit Inc.");
931 MODULE_LICENSE("GPL");