1 /*
2  * Atheros CARL9170 driver
3  *
4  * USB - frontend
5  *
6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
7  * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License as published by
11  * the Free Software Foundation; either version 2 of the License, or
12  * (at your option) any later version.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License
20  * along with this program; see the file COPYING.  If not, see
21  * http://www.gnu.org/licenses/.
22  *
23  * This file incorporates work covered by the following copyright and
24  * permission notice:
25  *    Copyright (c) 2007-2008 Atheros Communications, Inc.
26  *
27  *    Permission to use, copy, modify, and/or distribute this software for any
28  *    purpose with or without fee is hereby granted, provided that the above
29  *    copyright notice and this permission notice appear in all copies.
30  *
31  *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
32  *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
33  *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
34  *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
35  *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
36  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
37  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
38  */
39 
40 #include <linux/module.h>
41 #include <linux/slab.h>
42 #include <linux/usb.h>
43 #include <linux/firmware.h>
44 #include <linux/etherdevice.h>
45 #include <linux/device.h>
46 #include <net/mac80211.h>
47 #include "carl9170.h"
48 #include "cmd.h"
49 #include "hw.h"
50 #include "fwcmd.h"
51 
52 MODULE_AUTHOR("Johannes Berg <johannes@sipsolutions.net>");
53 MODULE_AUTHOR("Christian Lamparter <chunkeey@googlemail.com>");
54 MODULE_LICENSE("GPL");
55 MODULE_DESCRIPTION("Atheros AR9170 802.11n USB wireless");
56 MODULE_FIRMWARE(CARL9170FW_NAME);
57 MODULE_ALIAS("ar9170usb");
58 MODULE_ALIAS("arusb_lnx");
59 
60 /*
61  * Note:
62  *
63  * Always update our wiki's device list (located at:
64  * http://wireless.kernel.org/en/users/Drivers/ar9170/devices ),
65  * whenever you add a new device.
66  */
67 static struct usb_device_id carl9170_usb_ids[] = {
68 	/* Atheros 9170 */
69 	{ USB_DEVICE(0x0cf3, 0x9170) },
70 	/* Atheros TG121N */
71 	{ USB_DEVICE(0x0cf3, 0x1001) },
72 	/* TP-Link TL-WN821N v2 */
73 	{ USB_DEVICE(0x0cf3, 0x1002), .driver_info = CARL9170_WPS_BUTTON |
74 		 CARL9170_ONE_LED },
75 	/* 3Com Dual Band 802.11n USB Adapter */
76 	{ USB_DEVICE(0x0cf3, 0x1010) },
77 	/* H3C Dual Band 802.11n USB Adapter */
78 	{ USB_DEVICE(0x0cf3, 0x1011) },
79 	/* Cace Airpcap NX */
80 	{ USB_DEVICE(0xcace, 0x0300) },
81 	/* D-Link DWA 160 A1 */
82 	{ USB_DEVICE(0x07d1, 0x3c10) },
83 	/* D-Link DWA 160 A2 */
84 	{ USB_DEVICE(0x07d1, 0x3a09) },
85 	/* D-Link DWA 130 D */
86 	{ USB_DEVICE(0x07d1, 0x3a0f) },
87 	/* Netgear WNA1000 */
88 	{ USB_DEVICE(0x0846, 0x9040) },
89 	/* Netgear WNDA3100 (v1) */
90 	{ USB_DEVICE(0x0846, 0x9010) },
91 	/* Netgear WN111 v2 */
92 	{ USB_DEVICE(0x0846, 0x9001), .driver_info = CARL9170_ONE_LED },
93 	/* Zydas ZD1221 */
94 	{ USB_DEVICE(0x0ace, 0x1221) },
95 	/* Proxim ORiNOCO 802.11n USB */
96 	{ USB_DEVICE(0x1435, 0x0804) },
97 	/* WNC Generic 11n USB Dongle */
98 	{ USB_DEVICE(0x1435, 0x0326) },
99 	/* ZyXEL NWD271N */
100 	{ USB_DEVICE(0x0586, 0x3417) },
101 	/* Z-Com UB81 BG */
102 	{ USB_DEVICE(0x0cde, 0x0023) },
103 	/* Z-Com UB82 ABG */
104 	{ USB_DEVICE(0x0cde, 0x0026) },
105 	/* Sphairon Homelink 1202 */
106 	{ USB_DEVICE(0x0cde, 0x0027) },
107 	/* Arcadyan WN7512 */
108 	{ USB_DEVICE(0x083a, 0xf522) },
109 	/* Planex GWUS300 */
110 	{ USB_DEVICE(0x2019, 0x5304) },
111 	/* IO-Data WNGDNUS2 */
112 	{ USB_DEVICE(0x04bb, 0x093f) },
113 	/* NEC WL300NU-G */
114 	{ USB_DEVICE(0x0409, 0x0249) },
115 	/* AVM FRITZ!WLAN USB Stick N */
116 	{ USB_DEVICE(0x057c, 0x8401) },
117 	/* AVM FRITZ!WLAN USB Stick N 2.4 */
118 	{ USB_DEVICE(0x057c, 0x8402) },
119 	/* Qwest/Actiontec 802AIN Wireless N USB Network Adapter */
120 	{ USB_DEVICE(0x1668, 0x1200) },
121 	/* Airlive X.USB a/b/g/n */
122 	{ USB_DEVICE(0x1b75, 0x9170) },
123 
124 	/* terminate */
125 	{}
126 };
127 MODULE_DEVICE_TABLE(usb, carl9170_usb_ids);
128 
129 static void carl9170_usb_submit_data_urb(struct ar9170 *ar)
130 {
131 	struct urb *urb;
132 	int err;
133 
134 	if (atomic_inc_return(&ar->tx_anch_urbs) > AR9170_NUM_TX_URBS)
135 		goto err_acc;
136 
137 	urb = usb_get_from_anchor(&ar->tx_wait);
138 	if (!urb)
139 		goto err_acc;
140 
141 	usb_anchor_urb(urb, &ar->tx_anch);
142 
143 	err = usb_submit_urb(urb, GFP_ATOMIC);
144 	if (unlikely(err)) {
145 		if (net_ratelimit()) {
146 			dev_err(&ar->udev->dev, "tx submit failed (%d)\n",
147 				urb->status);
148 		}
149 
150 		usb_unanchor_urb(urb);
151 		usb_anchor_urb(urb, &ar->tx_err);
152 	}
153 
154 	usb_free_urb(urb);
155 
156 	if (likely(err == 0))
157 		return;
158 
159 err_acc:
160 	atomic_dec(&ar->tx_anch_urbs);
161 }
162 
163 static void carl9170_usb_tx_data_complete(struct urb *urb)
164 {
165 	struct ar9170 *ar = usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
166 
167 	if (WARN_ON_ONCE(!ar)) {
168 		dev_kfree_skb_irq(urb->context);
169 		return;
170 	}
171 
172 	atomic_dec(&ar->tx_anch_urbs);
173 
174 	switch (urb->status) {
175 	/* everything is fine */
176 	case 0:
177 		carl9170_tx_callback(ar, (void *)urb->context);
178 		break;
179 
180 	/* disconnect */
181 	case -ENOENT:
182 	case -ECONNRESET:
183 	case -ENODEV:
184 	case -ESHUTDOWN:
185 		/*
186 		 * Defer the frame clean-up to the tasklet worker.
187 		 * This is necessary, because carl9170_tx_drop
188 		 * does not work in an irqsave context.
189 		 */
190 		usb_anchor_urb(urb, &ar->tx_err);
191 		return;
192 
193 	/* a random transmission error has occurred? */
194 	default:
195 		if (net_ratelimit()) {
196 			dev_err(&ar->udev->dev, "tx failed (%d)\n",
197 				urb->status);
198 		}
199 
200 		usb_anchor_urb(urb, &ar->tx_err);
201 		break;
202 	}
203 
204 	if (likely(IS_STARTED(ar)))
205 		carl9170_usb_submit_data_urb(ar);
206 }
207 
208 static int carl9170_usb_submit_cmd_urb(struct ar9170 *ar)
209 {
210 	struct urb *urb;
211 	int err;
212 
213 	if (atomic_inc_return(&ar->tx_cmd_urbs) != 1) {
214 		atomic_dec(&ar->tx_cmd_urbs);
215 		return 0;
216 	}
217 
218 	urb = usb_get_from_anchor(&ar->tx_cmd);
219 	if (!urb) {
220 		atomic_dec(&ar->tx_cmd_urbs);
221 		return 0;
222 	}
223 
224 	usb_anchor_urb(urb, &ar->tx_anch);
225 	err = usb_submit_urb(urb, GFP_ATOMIC);
226 	if (unlikely(err)) {
227 		usb_unanchor_urb(urb);
228 		atomic_dec(&ar->tx_cmd_urbs);
229 	}
230 	usb_free_urb(urb);
231 
232 	return err;
233 }
234 
235 static void carl9170_usb_cmd_complete(struct urb *urb)
236 {
237 	struct ar9170 *ar = urb->context;
238 	int err = 0;
239 
240 	if (WARN_ON_ONCE(!ar))
241 		return;
242 
243 	atomic_dec(&ar->tx_cmd_urbs);
244 
245 	switch (urb->status) {
246 	/* everything is fine */
247 	case 0:
248 		break;
249 
250 	/* disconnect */
251 	case -ENOENT:
252 	case -ECONNRESET:
253 	case -ENODEV:
254 	case -ESHUTDOWN:
255 		return;
256 
257 	default:
258 		err = urb->status;
259 		break;
260 	}
261 
262 	if (!IS_INITIALIZED(ar))
263 		return;
264 
265 	if (err)
266 		dev_err(&ar->udev->dev, "submit cmd cb failed (%d).\n", err);
267 
268 	err = carl9170_usb_submit_cmd_urb(ar);
269 	if (err)
270 		dev_err(&ar->udev->dev, "submit cmd failed (%d).\n", err);
271 }
272 
273 static void carl9170_usb_rx_irq_complete(struct urb *urb)
274 {
275 	struct ar9170 *ar = urb->context;
276 
277 	if (WARN_ON_ONCE(!ar))
278 		return;
279 
280 	switch (urb->status) {
281 	/* everything is fine */
282 	case 0:
283 		break;
284 
285 	/* disconnect */
286 	case -ENOENT:
287 	case -ECONNRESET:
288 	case -ENODEV:
289 	case -ESHUTDOWN:
290 		return;
291 
292 	default:
293 		goto resubmit;
294 	}
295 
296 	carl9170_handle_command_response(ar, urb->transfer_buffer,
297 					 urb->actual_length);
298 
299 resubmit:
300 	usb_anchor_urb(urb, &ar->rx_anch);
301 	if (unlikely(usb_submit_urb(urb, GFP_ATOMIC)))
302 		usb_unanchor_urb(urb);
303 }
304 
305 static int carl9170_usb_submit_rx_urb(struct ar9170 *ar, gfp_t gfp)
306 {
307 	struct urb *urb;
308 	int err = 0, runs = 0;
309 
310 	while ((atomic_read(&ar->rx_anch_urbs) < AR9170_NUM_RX_URBS) &&
311 		(runs++ < AR9170_NUM_RX_URBS)) {
312 		err = -ENOSPC;
313 		urb = usb_get_from_anchor(&ar->rx_pool);
314 		if (urb) {
315 			usb_anchor_urb(urb, &ar->rx_anch);
316 			err = usb_submit_urb(urb, gfp);
317 			if (unlikely(err)) {
318 				usb_unanchor_urb(urb);
319 				usb_anchor_urb(urb, &ar->rx_pool);
320 			} else {
321 				atomic_dec(&ar->rx_pool_urbs);
322 				atomic_inc(&ar->rx_anch_urbs);
323 			}
324 			usb_free_urb(urb);
325 		}
326 	}
327 
328 	return err;
329 }
330 
331 static void carl9170_usb_rx_work(struct ar9170 *ar)
332 {
333 	struct urb *urb;
334 	int i;
335 
336 	for (i = 0; i < AR9170_NUM_RX_URBS_POOL; i++) {
337 		urb = usb_get_from_anchor(&ar->rx_work);
338 		if (!urb)
339 			break;
340 
341 		atomic_dec(&ar->rx_work_urbs);
342 		if (IS_INITIALIZED(ar)) {
343 			carl9170_rx(ar, urb->transfer_buffer,
344 				    urb->actual_length);
345 		}
346 
347 		usb_anchor_urb(urb, &ar->rx_pool);
348 		atomic_inc(&ar->rx_pool_urbs);
349 
350 		usb_free_urb(urb);
351 
352 		carl9170_usb_submit_rx_urb(ar, GFP_ATOMIC);
353 	}
354 }
355 
356 void carl9170_usb_handle_tx_err(struct ar9170 *ar)
357 {
358 	struct urb *urb;
359 
360 	while ((urb = usb_get_from_anchor(&ar->tx_err))) {
361 		struct sk_buff *skb = (void *)urb->context;
362 
363 		carl9170_tx_drop(ar, skb);
364 		carl9170_tx_callback(ar, skb);
365 		usb_free_urb(urb);
366 	}
367 }
368 
369 static void carl9170_usb_tasklet(unsigned long data)
370 {
371 	struct ar9170 *ar = (struct ar9170 *) data;
372 
373 	if (!IS_INITIALIZED(ar))
374 		return;
375 
376 	carl9170_usb_rx_work(ar);
377 
378 	/*
379 	 * Strictly speaking: The tx scheduler is not part of the USB system.
380 	 * But the rx worker returns frames back to the mac80211-stack and
381 	 * this is the _perfect_ place to generate the next transmissions.
382 	 */
383 	if (IS_STARTED(ar))
384 		carl9170_tx_scheduler(ar);
385 }
386 
387 static void carl9170_usb_rx_complete(struct urb *urb)
388 {
389 	struct ar9170 *ar = (struct ar9170 *)urb->context;
390 	int err;
391 
392 	if (WARN_ON_ONCE(!ar))
393 		return;
394 
395 	atomic_dec(&ar->rx_anch_urbs);
396 
397 	switch (urb->status) {
398 	case 0:
399 		/* rx path */
400 		usb_anchor_urb(urb, &ar->rx_work);
401 		atomic_inc(&ar->rx_work_urbs);
402 		break;
403 
404 	case -ENOENT:
405 	case -ECONNRESET:
406 	case -ENODEV:
407 	case -ESHUTDOWN:
408 		/* handle disconnect events*/
409 		return;
410 
411 	default:
412 		/* handle all other errors */
413 		usb_anchor_urb(urb, &ar->rx_pool);
414 		atomic_inc(&ar->rx_pool_urbs);
415 		break;
416 	}
417 
418 	err = carl9170_usb_submit_rx_urb(ar, GFP_ATOMIC);
419 	if (unlikely(err)) {
420 		/*
421 		 * usb_submit_rx_urb reported a problem.
422 		 * In case this is due to a rx buffer shortage,
423 		 * elevate the tasklet worker priority to
424 		 * the highest available level.
425 		 */
426 		tasklet_hi_schedule(&ar->usb_tasklet);
427 
428 		if (atomic_read(&ar->rx_anch_urbs) == 0) {
429 			/*
430 			 * The system is too slow to cope with
431 			 * the enormous workload. We have simply
432 			 * run out of active rx urbs and this
433 			 * unfortunatly leads to an unpredictable
434 			 * device.
435 			 */
436 
437 			ieee80211_queue_work(ar->hw, &ar->ping_work);
438 		}
439 	} else {
440 		/*
441 		 * Using anything less than _high_ priority absolutely
442 		 * kills the rx performance my UP-System...
443 		 */
444 		tasklet_hi_schedule(&ar->usb_tasklet);
445 	}
446 }
447 
448 static struct urb *carl9170_usb_alloc_rx_urb(struct ar9170 *ar, gfp_t gfp)
449 {
450 	struct urb *urb;
451 	void *buf;
452 
453 	buf = kmalloc(ar->fw.rx_size, gfp);
454 	if (!buf)
455 		return NULL;
456 
457 	urb = usb_alloc_urb(0, gfp);
458 	if (!urb) {
459 		kfree(buf);
460 		return NULL;
461 	}
462 
463 	usb_fill_bulk_urb(urb, ar->udev, usb_rcvbulkpipe(ar->udev,
464 			  AR9170_USB_EP_RX), buf, ar->fw.rx_size,
465 			  carl9170_usb_rx_complete, ar);
466 
467 	urb->transfer_flags |= URB_FREE_BUFFER;
468 
469 	return urb;
470 }
471 
472 static int carl9170_usb_send_rx_irq_urb(struct ar9170 *ar)
473 {
474 	struct urb *urb = NULL;
475 	void *ibuf;
476 	int err = -ENOMEM;
477 
478 	urb = usb_alloc_urb(0, GFP_KERNEL);
479 	if (!urb)
480 		goto out;
481 
482 	ibuf = kmalloc(AR9170_USB_EP_CTRL_MAX, GFP_KERNEL);
483 	if (!ibuf)
484 		goto out;
485 
486 	usb_fill_int_urb(urb, ar->udev, usb_rcvintpipe(ar->udev,
487 			 AR9170_USB_EP_IRQ), ibuf, AR9170_USB_EP_CTRL_MAX,
488 			 carl9170_usb_rx_irq_complete, ar, 1);
489 
490 	urb->transfer_flags |= URB_FREE_BUFFER;
491 
492 	usb_anchor_urb(urb, &ar->rx_anch);
493 	err = usb_submit_urb(urb, GFP_KERNEL);
494 	if (err)
495 		usb_unanchor_urb(urb);
496 
497 out:
498 	usb_free_urb(urb);
499 	return err;
500 }
501 
502 static int carl9170_usb_init_rx_bulk_urbs(struct ar9170 *ar)
503 {
504 	struct urb *urb;
505 	int i, err = -EINVAL;
506 
507 	/*
508 	 * The driver actively maintains a second shadow
509 	 * pool for inactive, but fully-prepared rx urbs.
510 	 *
511 	 * The pool should help the driver to master huge
512 	 * workload spikes without running the risk of
513 	 * undersupplying the hardware or wasting time by
514 	 * processing rx data (streams) inside the urb
515 	 * completion (hardirq context).
516 	 */
517 	for (i = 0; i < AR9170_NUM_RX_URBS_POOL; i++) {
518 		urb = carl9170_usb_alloc_rx_urb(ar, GFP_KERNEL);
519 		if (!urb) {
520 			err = -ENOMEM;
521 			goto err_out;
522 		}
523 
524 		usb_anchor_urb(urb, &ar->rx_pool);
525 		atomic_inc(&ar->rx_pool_urbs);
526 		usb_free_urb(urb);
527 	}
528 
529 	err = carl9170_usb_submit_rx_urb(ar, GFP_KERNEL);
530 	if (err)
531 		goto err_out;
532 
533 	/* the device now waiting for the firmware. */
534 	carl9170_set_state_when(ar, CARL9170_STOPPED, CARL9170_IDLE);
535 	return 0;
536 
537 err_out:
538 
539 	usb_scuttle_anchored_urbs(&ar->rx_pool);
540 	usb_scuttle_anchored_urbs(&ar->rx_work);
541 	usb_kill_anchored_urbs(&ar->rx_anch);
542 	return err;
543 }
544 
545 static int carl9170_usb_flush(struct ar9170 *ar)
546 {
547 	struct urb *urb;
548 	int ret, err = 0;
549 
550 	while ((urb = usb_get_from_anchor(&ar->tx_wait))) {
551 		struct sk_buff *skb = (void *)urb->context;
552 		carl9170_tx_drop(ar, skb);
553 		carl9170_tx_callback(ar, skb);
554 		usb_free_urb(urb);
555 	}
556 
557 	ret = usb_wait_anchor_empty_timeout(&ar->tx_cmd, 1000);
558 	if (ret == 0)
559 		err = -ETIMEDOUT;
560 
561 	/* lets wait a while until the tx - queues are dried out */
562 	ret = usb_wait_anchor_empty_timeout(&ar->tx_anch, 1000);
563 	if (ret == 0)
564 		err = -ETIMEDOUT;
565 
566 	usb_kill_anchored_urbs(&ar->tx_anch);
567 	carl9170_usb_handle_tx_err(ar);
568 
569 	return err;
570 }
571 
572 static void carl9170_usb_cancel_urbs(struct ar9170 *ar)
573 {
574 	int err;
575 
576 	carl9170_set_state(ar, CARL9170_UNKNOWN_STATE);
577 
578 	err = carl9170_usb_flush(ar);
579 	if (err)
580 		dev_err(&ar->udev->dev, "stuck tx urbs!\n");
581 
582 	usb_poison_anchored_urbs(&ar->tx_anch);
583 	carl9170_usb_handle_tx_err(ar);
584 	usb_poison_anchored_urbs(&ar->rx_anch);
585 
586 	tasklet_kill(&ar->usb_tasklet);
587 
588 	usb_scuttle_anchored_urbs(&ar->rx_work);
589 	usb_scuttle_anchored_urbs(&ar->rx_pool);
590 	usb_scuttle_anchored_urbs(&ar->tx_cmd);
591 }
592 
593 int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd,
594 			const bool free_buf)
595 {
596 	struct urb *urb;
597 	int err = 0;
598 
599 	if (!IS_INITIALIZED(ar)) {
600 		err = -EPERM;
601 		goto err_free;
602 	}
603 
604 	if (WARN_ON(cmd->hdr.len > CARL9170_MAX_CMD_LEN - 4)) {
605 		err = -EINVAL;
606 		goto err_free;
607 	}
608 
609 	urb = usb_alloc_urb(0, GFP_ATOMIC);
610 	if (!urb) {
611 		err = -ENOMEM;
612 		goto err_free;
613 	}
614 
615 	usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,
616 		AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
617 		carl9170_usb_cmd_complete, ar, 1);
618 
619 	if (free_buf)
620 		urb->transfer_flags |= URB_FREE_BUFFER;
621 
622 	usb_anchor_urb(urb, &ar->tx_cmd);
623 	usb_free_urb(urb);
624 
625 	return carl9170_usb_submit_cmd_urb(ar);
626 
627 err_free:
628 	if (free_buf)
629 		kfree(cmd);
630 
631 	return err;
632 }
633 
634 int carl9170_exec_cmd(struct ar9170 *ar, const enum carl9170_cmd_oids cmd,
635 	unsigned int plen, void *payload, unsigned int outlen, void *out)
636 {
637 	int err = -ENOMEM;
638 
639 	if (!IS_ACCEPTING_CMD(ar))
640 		return -EIO;
641 
642 	if (!(cmd & CARL9170_CMD_ASYNC_FLAG))
643 		might_sleep();
644 
645 	ar->cmd.hdr.len = plen;
646 	ar->cmd.hdr.cmd = cmd;
647 	/* writing multiple regs fills this buffer already */
648 	if (plen && payload != (u8 *)(ar->cmd.data))
649 		memcpy(ar->cmd.data, payload, plen);
650 
651 	spin_lock_bh(&ar->cmd_lock);
652 	ar->readbuf = (u8 *)out;
653 	ar->readlen = outlen;
654 	spin_unlock_bh(&ar->cmd_lock);
655 
656 	err = __carl9170_exec_cmd(ar, &ar->cmd, false);
657 
658 	if (!(cmd & CARL9170_CMD_ASYNC_FLAG)) {
659 		err = wait_for_completion_timeout(&ar->cmd_wait, HZ);
660 		if (err == 0) {
661 			err = -ETIMEDOUT;
662 			goto err_unbuf;
663 		}
664 
665 		if (ar->readlen != outlen) {
666 			err = -EMSGSIZE;
667 			goto err_unbuf;
668 		}
669 	}
670 
671 	return 0;
672 
673 err_unbuf:
674 	/* Maybe the device was removed in the moment we were waiting? */
675 	if (IS_STARTED(ar)) {
676 		dev_err(&ar->udev->dev, "no command feedback "
677 			"received (%d).\n", err);
678 
679 		/* provide some maybe useful debug information */
680 		print_hex_dump_bytes("carl9170 cmd: ", DUMP_PREFIX_NONE,
681 				     &ar->cmd, plen + 4);
682 
683 		carl9170_restart(ar, CARL9170_RR_COMMAND_TIMEOUT);
684 	}
685 
686 	/* invalidate to avoid completing the next command prematurely */
687 	spin_lock_bh(&ar->cmd_lock);
688 	ar->readbuf = NULL;
689 	ar->readlen = 0;
690 	spin_unlock_bh(&ar->cmd_lock);
691 
692 	return err;
693 }
694 
695 void carl9170_usb_tx(struct ar9170 *ar, struct sk_buff *skb)
696 {
697 	struct urb *urb;
698 	struct ar9170_stream *tx_stream;
699 	void *data;
700 	unsigned int len;
701 
702 	if (!IS_STARTED(ar))
703 		goto err_drop;
704 
705 	urb = usb_alloc_urb(0, GFP_ATOMIC);
706 	if (!urb)
707 		goto err_drop;
708 
709 	if (ar->fw.tx_stream) {
710 		tx_stream = (void *) (skb->data - sizeof(*tx_stream));
711 
712 		len = skb->len + sizeof(*tx_stream);
713 		tx_stream->length = cpu_to_le16(len);
714 		tx_stream->tag = cpu_to_le16(AR9170_TX_STREAM_TAG);
715 		data = tx_stream;
716 	} else {
717 		data = skb->data;
718 		len = skb->len;
719 	}
720 
721 	usb_fill_bulk_urb(urb, ar->udev, usb_sndbulkpipe(ar->udev,
722 		AR9170_USB_EP_TX), data, len,
723 		carl9170_usb_tx_data_complete, skb);
724 
725 	urb->transfer_flags |= URB_ZERO_PACKET;
726 
727 	usb_anchor_urb(urb, &ar->tx_wait);
728 
729 	usb_free_urb(urb);
730 
731 	carl9170_usb_submit_data_urb(ar);
732 	return;
733 
734 err_drop:
735 	carl9170_tx_drop(ar, skb);
736 	carl9170_tx_callback(ar, skb);
737 }
738 
739 static void carl9170_release_firmware(struct ar9170 *ar)
740 {
741 	if (ar->fw.fw) {
742 		release_firmware(ar->fw.fw);
743 		memset(&ar->fw, 0, sizeof(ar->fw));
744 	}
745 }
746 
747 void carl9170_usb_stop(struct ar9170 *ar)
748 {
749 	int ret;
750 
751 	carl9170_set_state_when(ar, CARL9170_IDLE, CARL9170_STOPPED);
752 
753 	ret = carl9170_usb_flush(ar);
754 	if (ret)
755 		dev_err(&ar->udev->dev, "kill pending tx urbs.\n");
756 
757 	usb_poison_anchored_urbs(&ar->tx_anch);
758 	carl9170_usb_handle_tx_err(ar);
759 
760 	/* kill any pending command */
761 	spin_lock_bh(&ar->cmd_lock);
762 	ar->readlen = 0;
763 	spin_unlock_bh(&ar->cmd_lock);
764 	complete_all(&ar->cmd_wait);
765 
766 	/* This is required to prevent an early completion on _start */
767 	INIT_COMPLETION(ar->cmd_wait);
768 
769 	/*
770 	 * Note:
771 	 * So far we freed all tx urbs, but we won't dare to touch any rx urbs.
772 	 * Else we would end up with a unresponsive device...
773 	 */
774 }
775 
776 int carl9170_usb_open(struct ar9170 *ar)
777 {
778 	usb_unpoison_anchored_urbs(&ar->tx_anch);
779 
780 	carl9170_set_state_when(ar, CARL9170_STOPPED, CARL9170_IDLE);
781 	return 0;
782 }
783 
784 static int carl9170_usb_load_firmware(struct ar9170 *ar)
785 {
786 	const u8 *data;
787 	u8 *buf;
788 	unsigned int transfer;
789 	size_t len;
790 	u32 addr;
791 	int err = 0;
792 
793 	buf = kmalloc(4096, GFP_KERNEL);
794 	if (!buf) {
795 		err = -ENOMEM;
796 		goto err_out;
797 	}
798 
799 	data = ar->fw.fw->data;
800 	len = ar->fw.fw->size;
801 	addr = ar->fw.address;
802 
803 	/* this removes the miniboot image */
804 	data += ar->fw.offset;
805 	len -= ar->fw.offset;
806 
807 	while (len) {
808 		transfer = min_t(unsigned int, len, 4096u);
809 		memcpy(buf, data, transfer);
810 
811 		err = usb_control_msg(ar->udev, usb_sndctrlpipe(ar->udev, 0),
812 				      0x30 /* FW DL */, 0x40 | USB_DIR_OUT,
813 				      addr >> 8, 0, buf, transfer, 100);
814 
815 		if (err < 0) {
816 			kfree(buf);
817 			goto err_out;
818 		}
819 
820 		len -= transfer;
821 		data += transfer;
822 		addr += transfer;
823 	}
824 	kfree(buf);
825 
826 	err = usb_control_msg(ar->udev, usb_sndctrlpipe(ar->udev, 0),
827 			      0x31 /* FW DL COMPLETE */,
828 			      0x40 | USB_DIR_OUT, 0, 0, NULL, 0, 200);
829 
830 	if (wait_for_completion_timeout(&ar->fw_boot_wait, HZ) == 0) {
831 		err = -ETIMEDOUT;
832 		goto err_out;
833 	}
834 
835 	err = carl9170_echo_test(ar, 0x4a110123);
836 	if (err)
837 		goto err_out;
838 
839 	/* now, start the command response counter */
840 	ar->cmd_seq = -1;
841 
842 	return 0;
843 
844 err_out:
845 	dev_err(&ar->udev->dev, "firmware upload failed (%d).\n", err);
846 	return err;
847 }
848 
849 int carl9170_usb_restart(struct ar9170 *ar)
850 {
851 	int err = 0;
852 
853 	if (ar->intf->condition != USB_INTERFACE_BOUND)
854 		return 0;
855 
856 	/*
857 	 * Disable the command response sequence counter check.
858 	 * We already know that the device/firmware is in a bad state.
859 	 * So, no extra points are awarded to anyone who reminds the
860 	 * driver about that.
861 	 */
862 	ar->cmd_seq = -2;
863 
864 	err = carl9170_reboot(ar);
865 
866 	carl9170_usb_stop(ar);
867 
868 	if (err)
869 		goto err_out;
870 
871 	tasklet_schedule(&ar->usb_tasklet);
872 
873 	/* The reboot procedure can take quite a while to complete. */
874 	msleep(1100);
875 
876 	err = carl9170_usb_open(ar);
877 	if (err)
878 		goto err_out;
879 
880 	err = carl9170_usb_load_firmware(ar);
881 	if (err)
882 		goto err_out;
883 
884 	return 0;
885 
886 err_out:
887 	carl9170_usb_cancel_urbs(ar);
888 	return err;
889 }
890 
891 void carl9170_usb_reset(struct ar9170 *ar)
892 {
893 	/*
894 	 * This is the last resort to get the device going again
895 	 * without any *user replugging action*.
896 	 *
897 	 * But there is a catch: usb_reset really is like a physical
898 	 * *reconnect*. The mac80211 state will be lost in the process.
899 	 * Therefore a userspace application, which is monitoring
900 	 * the link must step in.
901 	 */
902 	carl9170_usb_cancel_urbs(ar);
903 
904 	carl9170_usb_stop(ar);
905 
906 	usb_queue_reset_device(ar->intf);
907 }
908 
909 static int carl9170_usb_init_device(struct ar9170 *ar)
910 {
911 	int err;
912 
913 	/*
914 	 * The carl9170 firmware let's the driver know when it's
915 	 * ready for action. But we have to be prepared to gracefully
916 	 * handle all spurious [flushed] messages after each (re-)boot.
917 	 * Thus the command response counter remains disabled until it
918 	 * can be safely synchronized.
919 	 */
920 	ar->cmd_seq = -2;
921 
922 	err = carl9170_usb_send_rx_irq_urb(ar);
923 	if (err)
924 		goto err_out;
925 
926 	err = carl9170_usb_init_rx_bulk_urbs(ar);
927 	if (err)
928 		goto err_unrx;
929 
930 	err = carl9170_usb_open(ar);
931 	if (err)
932 		goto err_unrx;
933 
934 	mutex_lock(&ar->mutex);
935 	err = carl9170_usb_load_firmware(ar);
936 	mutex_unlock(&ar->mutex);
937 	if (err)
938 		goto err_stop;
939 
940 	return 0;
941 
942 err_stop:
943 	carl9170_usb_stop(ar);
944 
945 err_unrx:
946 	carl9170_usb_cancel_urbs(ar);
947 
948 err_out:
949 	return err;
950 }
951 
952 static void carl9170_usb_firmware_failed(struct ar9170 *ar)
953 {
954 	struct device *parent = ar->udev->dev.parent;
955 	struct usb_device *udev;
956 
957 	/*
958 	 * Store a copy of the usb_device pointer locally.
959 	 * This is because device_release_driver initiates
960 	 * carl9170_usb_disconnect, which in turn frees our
961 	 * driver context (ar).
962 	 */
963 	udev = ar->udev;
964 
965 	complete(&ar->fw_load_wait);
966 
967 	/* unbind anything failed */
968 	if (parent)
969 		device_lock(parent);
970 
971 	device_release_driver(&udev->dev);
972 	if (parent)
973 		device_unlock(parent);
974 
975 	usb_put_dev(udev);
976 }
977 
978 static void carl9170_usb_firmware_finish(struct ar9170 *ar)
979 {
980 	int err;
981 
982 	err = carl9170_parse_firmware(ar);
983 	if (err)
984 		goto err_freefw;
985 
986 	err = carl9170_usb_init_device(ar);
987 	if (err)
988 		goto err_freefw;
989 
990 	err = carl9170_register(ar);
991 
992 	carl9170_usb_stop(ar);
993 	if (err)
994 		goto err_unrx;
995 
996 	complete(&ar->fw_load_wait);
997 	usb_put_dev(ar->udev);
998 	return;
999 
1000 err_unrx:
1001 	carl9170_usb_cancel_urbs(ar);
1002 
1003 err_freefw:
1004 	carl9170_release_firmware(ar);
1005 	carl9170_usb_firmware_failed(ar);
1006 }
1007 
1008 static void carl9170_usb_firmware_step2(const struct firmware *fw,
1009 					void *context)
1010 {
1011 	struct ar9170 *ar = context;
1012 
1013 	if (fw) {
1014 		ar->fw.fw = fw;
1015 		carl9170_usb_firmware_finish(ar);
1016 		return;
1017 	}
1018 
1019 	dev_err(&ar->udev->dev, "firmware not found.\n");
1020 	carl9170_usb_firmware_failed(ar);
1021 }
1022 
1023 static int carl9170_usb_probe(struct usb_interface *intf,
1024 			      const struct usb_device_id *id)
1025 {
1026 	struct ar9170 *ar;
1027 	struct usb_device *udev;
1028 	int err;
1029 
1030 	err = usb_reset_device(interface_to_usbdev(intf));
1031 	if (err)
1032 		return err;
1033 
1034 	ar = carl9170_alloc(sizeof(*ar));
1035 	if (IS_ERR(ar))
1036 		return PTR_ERR(ar);
1037 
1038 	udev = interface_to_usbdev(intf);
1039 	usb_get_dev(udev);
1040 	ar->udev = udev;
1041 	ar->intf = intf;
1042 	ar->features = id->driver_info;
1043 
1044 	usb_set_intfdata(intf, ar);
1045 	SET_IEEE80211_DEV(ar->hw, &intf->dev);
1046 
1047 	init_usb_anchor(&ar->rx_anch);
1048 	init_usb_anchor(&ar->rx_pool);
1049 	init_usb_anchor(&ar->rx_work);
1050 	init_usb_anchor(&ar->tx_wait);
1051 	init_usb_anchor(&ar->tx_anch);
1052 	init_usb_anchor(&ar->tx_cmd);
1053 	init_usb_anchor(&ar->tx_err);
1054 	init_completion(&ar->cmd_wait);
1055 	init_completion(&ar->fw_boot_wait);
1056 	init_completion(&ar->fw_load_wait);
1057 	tasklet_init(&ar->usb_tasklet, carl9170_usb_tasklet,
1058 		     (unsigned long)ar);
1059 
1060 	atomic_set(&ar->tx_cmd_urbs, 0);
1061 	atomic_set(&ar->tx_anch_urbs, 0);
1062 	atomic_set(&ar->rx_work_urbs, 0);
1063 	atomic_set(&ar->rx_anch_urbs, 0);
1064 	atomic_set(&ar->rx_pool_urbs, 0);
1065 
1066 	usb_get_dev(ar->udev);
1067 
1068 	carl9170_set_state(ar, CARL9170_STOPPED);
1069 
1070 	return request_firmware_nowait(THIS_MODULE, 1, CARL9170FW_NAME,
1071 		&ar->udev->dev, GFP_KERNEL, ar, carl9170_usb_firmware_step2);
1072 }
1073 
1074 static void carl9170_usb_disconnect(struct usb_interface *intf)
1075 {
1076 	struct ar9170 *ar = usb_get_intfdata(intf);
1077 	struct usb_device *udev;
1078 
1079 	if (WARN_ON(!ar))
1080 		return;
1081 
1082 	udev = ar->udev;
1083 	wait_for_completion(&ar->fw_load_wait);
1084 
1085 	if (IS_INITIALIZED(ar)) {
1086 		carl9170_reboot(ar);
1087 		carl9170_usb_stop(ar);
1088 	}
1089 
1090 	carl9170_usb_cancel_urbs(ar);
1091 	carl9170_unregister(ar);
1092 
1093 	usb_set_intfdata(intf, NULL);
1094 
1095 	carl9170_release_firmware(ar);
1096 	carl9170_free(ar);
1097 	usb_put_dev(udev);
1098 }
1099 
1100 #ifdef CONFIG_PM
1101 static int carl9170_usb_suspend(struct usb_interface *intf,
1102 				pm_message_t message)
1103 {
1104 	struct ar9170 *ar = usb_get_intfdata(intf);
1105 
1106 	if (!ar)
1107 		return -ENODEV;
1108 
1109 	carl9170_usb_cancel_urbs(ar);
1110 
1111 	return 0;
1112 }
1113 
1114 static int carl9170_usb_resume(struct usb_interface *intf)
1115 {
1116 	struct ar9170 *ar = usb_get_intfdata(intf);
1117 	int err;
1118 
1119 	if (!ar)
1120 		return -ENODEV;
1121 
1122 	usb_unpoison_anchored_urbs(&ar->rx_anch);
1123 	carl9170_set_state(ar, CARL9170_STOPPED);
1124 
1125 	/*
1126 	 * The USB documentation demands that [for suspend] all traffic
1127 	 * to and from the device has to stop. This would be fine, but
1128 	 * there's a catch: the device[usb phy] does not come back.
1129 	 *
1130 	 * Upon resume the firmware will "kill" itself and the
1131 	 * boot-code sorts out the magic voodoo.
1132 	 * Not very nice, but there's not much what could go wrong.
1133 	 */
1134 	msleep(1100);
1135 
1136 	err = carl9170_usb_init_device(ar);
1137 	if (err)
1138 		goto err_unrx;
1139 
1140 	return 0;
1141 
1142 err_unrx:
1143 	carl9170_usb_cancel_urbs(ar);
1144 
1145 	return err;
1146 }
1147 #endif /* CONFIG_PM */
1148 
1149 static struct usb_driver carl9170_driver = {
1150 	.name = KBUILD_MODNAME,
1151 	.probe = carl9170_usb_probe,
1152 	.disconnect = carl9170_usb_disconnect,
1153 	.id_table = carl9170_usb_ids,
1154 	.soft_unbind = 1,
1155 #ifdef CONFIG_PM
1156 	.suspend = carl9170_usb_suspend,
1157 	.resume = carl9170_usb_resume,
1158 	.reset_resume = carl9170_usb_resume,
1159 #endif /* CONFIG_PM */
1160 };
1161 
1162 static int __init carl9170_usb_init(void)
1163 {
1164 	return usb_register(&carl9170_driver);
1165 }
1166 
1167 static void __exit carl9170_usb_exit(void)
1168 {
1169 	usb_deregister(&carl9170_driver);
1170 }
1171 
1172 module_init(carl9170_usb_init);
1173 module_exit(carl9170_usb_exit);
1174