xref: /openbmc/linux/drivers/net/wireless/ath/carl9170/usb.c (revision baa7eb025ab14f3cba2e35c0a8648f9c9f01d24f)
1 /*
2  * Atheros CARL9170 driver
3  *
4  * USB - frontend
5  *
6  * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
7  * Copyright 2009, 2010, Christian Lamparter <chunkeey@googlemail.com>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License as published by
11  * the Free Software Foundation; either version 2 of the License, or
12  * (at your option) any later version.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License
20  * along with this program; see the file COPYING.  If not, see
21  * http://www.gnu.org/licenses/.
22  *
23  * This file incorporates work covered by the following copyright and
24  * permission notice:
25  *    Copyright (c) 2007-2008 Atheros Communications, Inc.
26  *
27  *    Permission to use, copy, modify, and/or distribute this software for any
28  *    purpose with or without fee is hereby granted, provided that the above
29  *    copyright notice and this permission notice appear in all copies.
30  *
31  *    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
32  *    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
33  *    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
34  *    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
35  *    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
36  *    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
37  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
38  */
39 
40 #include <linux/module.h>
41 #include <linux/slab.h>
42 #include <linux/usb.h>
43 #include <linux/firmware.h>
44 #include <linux/etherdevice.h>
45 #include <linux/device.h>
46 #include <net/mac80211.h>
47 #include "carl9170.h"
48 #include "cmd.h"
49 #include "hw.h"
50 #include "fwcmd.h"
51 
52 MODULE_AUTHOR("Johannes Berg <johannes@sipsolutions.net>");
53 MODULE_AUTHOR("Christian Lamparter <chunkeey@googlemail.com>");
54 MODULE_LICENSE("GPL");
55 MODULE_DESCRIPTION("Atheros AR9170 802.11n USB wireless");
56 MODULE_FIRMWARE(CARL9170FW_NAME);
57 MODULE_ALIAS("ar9170usb");
58 MODULE_ALIAS("arusb_lnx");
59 
60 /*
61  * Note:
62  *
63  * Always update our wiki's device list (located at:
64  * http://wireless.kernel.org/en/users/Drivers/ar9170/devices ),
65  * whenever you add a new device.
66  */
67 static struct usb_device_id carl9170_usb_ids[] = {
68 	/* Atheros 9170 */
69 	{ USB_DEVICE(0x0cf3, 0x9170) },
70 	/* Atheros TG121N */
71 	{ USB_DEVICE(0x0cf3, 0x1001) },
72 	/* TP-Link TL-WN821N v2 */
73 	{ USB_DEVICE(0x0cf3, 0x1002), .driver_info = CARL9170_WPS_BUTTON |
74 		 CARL9170_ONE_LED },
75 	/* 3Com Dual Band 802.11n USB Adapter */
76 	{ USB_DEVICE(0x0cf3, 0x1010) },
77 	/* H3C Dual Band 802.11n USB Adapter */
78 	{ USB_DEVICE(0x0cf3, 0x1011) },
79 	/* Cace Airpcap NX */
80 	{ USB_DEVICE(0xcace, 0x0300) },
81 	/* D-Link DWA 160 A1 */
82 	{ USB_DEVICE(0x07d1, 0x3c10) },
83 	/* D-Link DWA 160 A2 */
84 	{ USB_DEVICE(0x07d1, 0x3a09) },
85 	/* D-Link DWA 130 D */
86 	{ USB_DEVICE(0x07d1, 0x3a0f) },
87 	/* Netgear WNA1000 */
88 	{ USB_DEVICE(0x0846, 0x9040) },
89 	/* Netgear WNDA3100 (v1) */
90 	{ USB_DEVICE(0x0846, 0x9010) },
91 	/* Netgear WN111 v2 */
92 	{ USB_DEVICE(0x0846, 0x9001), .driver_info = CARL9170_ONE_LED },
93 	/* Zydas ZD1221 */
94 	{ USB_DEVICE(0x0ace, 0x1221) },
95 	/* Proxim ORiNOCO 802.11n USB */
96 	{ USB_DEVICE(0x1435, 0x0804) },
97 	/* WNC Generic 11n USB Dongle */
98 	{ USB_DEVICE(0x1435, 0x0326) },
99 	/* ZyXEL NWD271N */
100 	{ USB_DEVICE(0x0586, 0x3417) },
101 	/* Z-Com UB81 BG */
102 	{ USB_DEVICE(0x0cde, 0x0023) },
103 	/* Z-Com UB82 ABG */
104 	{ USB_DEVICE(0x0cde, 0x0026) },
105 	/* Sphairon Homelink 1202 */
106 	{ USB_DEVICE(0x0cde, 0x0027) },
107 	/* Arcadyan WN7512 */
108 	{ USB_DEVICE(0x083a, 0xf522) },
109 	/* Planex GWUS300 */
110 	{ USB_DEVICE(0x2019, 0x5304) },
111 	/* IO-Data WNGDNUS2 */
112 	{ USB_DEVICE(0x04bb, 0x093f) },
113 	/* NEC WL300NU-G */
114 	{ USB_DEVICE(0x0409, 0x0249) },
115 	/* AVM FRITZ!WLAN USB Stick N */
116 	{ USB_DEVICE(0x057c, 0x8401) },
117 	/* AVM FRITZ!WLAN USB Stick N 2.4 */
118 	{ USB_DEVICE(0x057c, 0x8402) },
119 	/* Qwest/Actiontec 802AIN Wireless N USB Network Adapter */
120 	{ USB_DEVICE(0x1668, 0x1200) },
121 
122 	/* terminate */
123 	{}
124 };
125 MODULE_DEVICE_TABLE(usb, carl9170_usb_ids);
126 
127 static void carl9170_usb_submit_data_urb(struct ar9170 *ar)
128 {
129 	struct urb *urb;
130 	int err;
131 
132 	if (atomic_inc_return(&ar->tx_anch_urbs) > AR9170_NUM_TX_URBS)
133 		goto err_acc;
134 
135 	urb = usb_get_from_anchor(&ar->tx_wait);
136 	if (!urb)
137 		goto err_acc;
138 
139 	usb_anchor_urb(urb, &ar->tx_anch);
140 
141 	err = usb_submit_urb(urb, GFP_ATOMIC);
142 	if (unlikely(err)) {
143 		if (net_ratelimit()) {
144 			dev_err(&ar->udev->dev, "tx submit failed (%d)\n",
145 				urb->status);
146 		}
147 
148 		usb_unanchor_urb(urb);
149 		usb_anchor_urb(urb, &ar->tx_err);
150 	}
151 
152 	usb_free_urb(urb);
153 
154 	if (likely(err == 0))
155 		return;
156 
157 err_acc:
158 	atomic_dec(&ar->tx_anch_urbs);
159 }
160 
161 static void carl9170_usb_tx_data_complete(struct urb *urb)
162 {
163 	struct ar9170 *ar = usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
164 
165 	if (WARN_ON_ONCE(!ar)) {
166 		dev_kfree_skb_irq(urb->context);
167 		return;
168 	}
169 
170 	atomic_dec(&ar->tx_anch_urbs);
171 
172 	switch (urb->status) {
173 	/* everything is fine */
174 	case 0:
175 		carl9170_tx_callback(ar, (void *)urb->context);
176 		break;
177 
178 	/* disconnect */
179 	case -ENOENT:
180 	case -ECONNRESET:
181 	case -ENODEV:
182 	case -ESHUTDOWN:
183 		/*
184 		 * Defer the frame clean-up to the tasklet worker.
185 		 * This is necessary, because carl9170_tx_drop
186 		 * does not work in an irqsave context.
187 		 */
188 		usb_anchor_urb(urb, &ar->tx_err);
189 		return;
190 
191 	/* a random transmission error has occurred? */
192 	default:
193 		if (net_ratelimit()) {
194 			dev_err(&ar->udev->dev, "tx failed (%d)\n",
195 				urb->status);
196 		}
197 
198 		usb_anchor_urb(urb, &ar->tx_err);
199 		break;
200 	}
201 
202 	if (likely(IS_STARTED(ar)))
203 		carl9170_usb_submit_data_urb(ar);
204 }
205 
206 static int carl9170_usb_submit_cmd_urb(struct ar9170 *ar)
207 {
208 	struct urb *urb;
209 	int err;
210 
211 	if (atomic_inc_return(&ar->tx_cmd_urbs) != 1) {
212 		atomic_dec(&ar->tx_cmd_urbs);
213 		return 0;
214 	}
215 
216 	urb = usb_get_from_anchor(&ar->tx_cmd);
217 	if (!urb) {
218 		atomic_dec(&ar->tx_cmd_urbs);
219 		return 0;
220 	}
221 
222 	usb_anchor_urb(urb, &ar->tx_anch);
223 	err = usb_submit_urb(urb, GFP_ATOMIC);
224 	if (unlikely(err)) {
225 		usb_unanchor_urb(urb);
226 		atomic_dec(&ar->tx_cmd_urbs);
227 	}
228 	usb_free_urb(urb);
229 
230 	return err;
231 }
232 
233 static void carl9170_usb_cmd_complete(struct urb *urb)
234 {
235 	struct ar9170 *ar = urb->context;
236 	int err = 0;
237 
238 	if (WARN_ON_ONCE(!ar))
239 		return;
240 
241 	atomic_dec(&ar->tx_cmd_urbs);
242 
243 	switch (urb->status) {
244 	/* everything is fine */
245 	case 0:
246 		break;
247 
248 	/* disconnect */
249 	case -ENOENT:
250 	case -ECONNRESET:
251 	case -ENODEV:
252 	case -ESHUTDOWN:
253 		return;
254 
255 	default:
256 		err = urb->status;
257 		break;
258 	}
259 
260 	if (!IS_INITIALIZED(ar))
261 		return;
262 
263 	if (err)
264 		dev_err(&ar->udev->dev, "submit cmd cb failed (%d).\n", err);
265 
266 	err = carl9170_usb_submit_cmd_urb(ar);
267 	if (err)
268 		dev_err(&ar->udev->dev, "submit cmd failed (%d).\n", err);
269 }
270 
271 static void carl9170_usb_rx_irq_complete(struct urb *urb)
272 {
273 	struct ar9170 *ar = urb->context;
274 
275 	if (WARN_ON_ONCE(!ar))
276 		return;
277 
278 	switch (urb->status) {
279 	/* everything is fine */
280 	case 0:
281 		break;
282 
283 	/* disconnect */
284 	case -ENOENT:
285 	case -ECONNRESET:
286 	case -ENODEV:
287 	case -ESHUTDOWN:
288 		return;
289 
290 	default:
291 		goto resubmit;
292 	}
293 
294 	carl9170_handle_command_response(ar, urb->transfer_buffer,
295 					 urb->actual_length);
296 
297 resubmit:
298 	usb_anchor_urb(urb, &ar->rx_anch);
299 	if (unlikely(usb_submit_urb(urb, GFP_ATOMIC)))
300 		usb_unanchor_urb(urb);
301 }
302 
303 static int carl9170_usb_submit_rx_urb(struct ar9170 *ar, gfp_t gfp)
304 {
305 	struct urb *urb;
306 	int err = 0, runs = 0;
307 
308 	while ((atomic_read(&ar->rx_anch_urbs) < AR9170_NUM_RX_URBS) &&
309 		(runs++ < AR9170_NUM_RX_URBS)) {
310 		err = -ENOSPC;
311 		urb = usb_get_from_anchor(&ar->rx_pool);
312 		if (urb) {
313 			usb_anchor_urb(urb, &ar->rx_anch);
314 			err = usb_submit_urb(urb, gfp);
315 			if (unlikely(err)) {
316 				usb_unanchor_urb(urb);
317 				usb_anchor_urb(urb, &ar->rx_pool);
318 			} else {
319 				atomic_dec(&ar->rx_pool_urbs);
320 				atomic_inc(&ar->rx_anch_urbs);
321 			}
322 			usb_free_urb(urb);
323 		}
324 	}
325 
326 	return err;
327 }
328 
329 static void carl9170_usb_rx_work(struct ar9170 *ar)
330 {
331 	struct urb *urb;
332 	int i;
333 
334 	for (i = 0; i < AR9170_NUM_RX_URBS_POOL; i++) {
335 		urb = usb_get_from_anchor(&ar->rx_work);
336 		if (!urb)
337 			break;
338 
339 		atomic_dec(&ar->rx_work_urbs);
340 		if (IS_INITIALIZED(ar)) {
341 			carl9170_rx(ar, urb->transfer_buffer,
342 				    urb->actual_length);
343 		}
344 
345 		usb_anchor_urb(urb, &ar->rx_pool);
346 		atomic_inc(&ar->rx_pool_urbs);
347 
348 		usb_free_urb(urb);
349 
350 		carl9170_usb_submit_rx_urb(ar, GFP_ATOMIC);
351 	}
352 }
353 
354 void carl9170_usb_handle_tx_err(struct ar9170 *ar)
355 {
356 	struct urb *urb;
357 
358 	while ((urb = usb_get_from_anchor(&ar->tx_err))) {
359 		struct sk_buff *skb = (void *)urb->context;
360 
361 		carl9170_tx_drop(ar, skb);
362 		carl9170_tx_callback(ar, skb);
363 		usb_free_urb(urb);
364 	}
365 }
366 
367 static void carl9170_usb_tasklet(unsigned long data)
368 {
369 	struct ar9170 *ar = (struct ar9170 *) data;
370 
371 	if (!IS_INITIALIZED(ar))
372 		return;
373 
374 	carl9170_usb_rx_work(ar);
375 
376 	/*
377 	 * Strictly speaking: The tx scheduler is not part of the USB system.
378 	 * But the rx worker returns frames back to the mac80211-stack and
379 	 * this is the _perfect_ place to generate the next transmissions.
380 	 */
381 	if (IS_STARTED(ar))
382 		carl9170_tx_scheduler(ar);
383 }
384 
385 static void carl9170_usb_rx_complete(struct urb *urb)
386 {
387 	struct ar9170 *ar = (struct ar9170 *)urb->context;
388 	int err;
389 
390 	if (WARN_ON_ONCE(!ar))
391 		return;
392 
393 	atomic_dec(&ar->rx_anch_urbs);
394 
395 	switch (urb->status) {
396 	case 0:
397 		/* rx path */
398 		usb_anchor_urb(urb, &ar->rx_work);
399 		atomic_inc(&ar->rx_work_urbs);
400 		break;
401 
402 	case -ENOENT:
403 	case -ECONNRESET:
404 	case -ENODEV:
405 	case -ESHUTDOWN:
406 		/* handle disconnect events*/
407 		return;
408 
409 	default:
410 		/* handle all other errors */
411 		usb_anchor_urb(urb, &ar->rx_pool);
412 		atomic_inc(&ar->rx_pool_urbs);
413 		break;
414 	}
415 
416 	err = carl9170_usb_submit_rx_urb(ar, GFP_ATOMIC);
417 	if (unlikely(err)) {
418 		/*
419 		 * usb_submit_rx_urb reported a problem.
420 		 * In case this is due to a rx buffer shortage,
421 		 * elevate the tasklet worker priority to
422 		 * the highest available level.
423 		 */
424 		tasklet_hi_schedule(&ar->usb_tasklet);
425 
426 		if (atomic_read(&ar->rx_anch_urbs) == 0) {
427 			/*
428 			 * The system is too slow to cope with
429 			 * the enormous workload. We have simply
430 			 * run out of active rx urbs and this
431 			 * unfortunatly leads to an unpredictable
432 			 * device.
433 			 */
434 
435 			ieee80211_queue_work(ar->hw, &ar->ping_work);
436 		}
437 	} else {
438 		/*
439 		 * Using anything less than _high_ priority absolutely
440 		 * kills the rx performance my UP-System...
441 		 */
442 		tasklet_hi_schedule(&ar->usb_tasklet);
443 	}
444 }
445 
446 static struct urb *carl9170_usb_alloc_rx_urb(struct ar9170 *ar, gfp_t gfp)
447 {
448 	struct urb *urb;
449 	void *buf;
450 
451 	buf = kmalloc(ar->fw.rx_size, gfp);
452 	if (!buf)
453 		return NULL;
454 
455 	urb = usb_alloc_urb(0, gfp);
456 	if (!urb) {
457 		kfree(buf);
458 		return NULL;
459 	}
460 
461 	usb_fill_bulk_urb(urb, ar->udev, usb_rcvbulkpipe(ar->udev,
462 			  AR9170_USB_EP_RX), buf, ar->fw.rx_size,
463 			  carl9170_usb_rx_complete, ar);
464 
465 	urb->transfer_flags |= URB_FREE_BUFFER;
466 
467 	return urb;
468 }
469 
470 static int carl9170_usb_send_rx_irq_urb(struct ar9170 *ar)
471 {
472 	struct urb *urb = NULL;
473 	void *ibuf;
474 	int err = -ENOMEM;
475 
476 	urb = usb_alloc_urb(0, GFP_KERNEL);
477 	if (!urb)
478 		goto out;
479 
480 	ibuf = kmalloc(AR9170_USB_EP_CTRL_MAX, GFP_KERNEL);
481 	if (!ibuf)
482 		goto out;
483 
484 	usb_fill_int_urb(urb, ar->udev, usb_rcvintpipe(ar->udev,
485 			 AR9170_USB_EP_IRQ), ibuf, AR9170_USB_EP_CTRL_MAX,
486 			 carl9170_usb_rx_irq_complete, ar, 1);
487 
488 	urb->transfer_flags |= URB_FREE_BUFFER;
489 
490 	usb_anchor_urb(urb, &ar->rx_anch);
491 	err = usb_submit_urb(urb, GFP_KERNEL);
492 	if (err)
493 		usb_unanchor_urb(urb);
494 
495 out:
496 	usb_free_urb(urb);
497 	return err;
498 }
499 
500 static int carl9170_usb_init_rx_bulk_urbs(struct ar9170 *ar)
501 {
502 	struct urb *urb;
503 	int i, err = -EINVAL;
504 
505 	/*
506 	 * The driver actively maintains a second shadow
507 	 * pool for inactive, but fully-prepared rx urbs.
508 	 *
509 	 * The pool should help the driver to master huge
510 	 * workload spikes without running the risk of
511 	 * undersupplying the hardware or wasting time by
512 	 * processing rx data (streams) inside the urb
513 	 * completion (hardirq context).
514 	 */
515 	for (i = 0; i < AR9170_NUM_RX_URBS_POOL; i++) {
516 		urb = carl9170_usb_alloc_rx_urb(ar, GFP_KERNEL);
517 		if (!urb) {
518 			err = -ENOMEM;
519 			goto err_out;
520 		}
521 
522 		usb_anchor_urb(urb, &ar->rx_pool);
523 		atomic_inc(&ar->rx_pool_urbs);
524 		usb_free_urb(urb);
525 	}
526 
527 	err = carl9170_usb_submit_rx_urb(ar, GFP_KERNEL);
528 	if (err)
529 		goto err_out;
530 
531 	/* the device now waiting for the firmware. */
532 	carl9170_set_state_when(ar, CARL9170_STOPPED, CARL9170_IDLE);
533 	return 0;
534 
535 err_out:
536 
537 	usb_scuttle_anchored_urbs(&ar->rx_pool);
538 	usb_scuttle_anchored_urbs(&ar->rx_work);
539 	usb_kill_anchored_urbs(&ar->rx_anch);
540 	return err;
541 }
542 
543 static int carl9170_usb_flush(struct ar9170 *ar)
544 {
545 	struct urb *urb;
546 	int ret, err = 0;
547 
548 	while ((urb = usb_get_from_anchor(&ar->tx_wait))) {
549 		struct sk_buff *skb = (void *)urb->context;
550 		carl9170_tx_drop(ar, skb);
551 		carl9170_tx_callback(ar, skb);
552 		usb_free_urb(urb);
553 	}
554 
555 	ret = usb_wait_anchor_empty_timeout(&ar->tx_cmd, 1000);
556 	if (ret == 0)
557 		err = -ETIMEDOUT;
558 
559 	/* lets wait a while until the tx - queues are dried out */
560 	ret = usb_wait_anchor_empty_timeout(&ar->tx_anch, 1000);
561 	if (ret == 0)
562 		err = -ETIMEDOUT;
563 
564 	usb_kill_anchored_urbs(&ar->tx_anch);
565 	carl9170_usb_handle_tx_err(ar);
566 
567 	return err;
568 }
569 
570 static void carl9170_usb_cancel_urbs(struct ar9170 *ar)
571 {
572 	int err;
573 
574 	carl9170_set_state(ar, CARL9170_UNKNOWN_STATE);
575 
576 	err = carl9170_usb_flush(ar);
577 	if (err)
578 		dev_err(&ar->udev->dev, "stuck tx urbs!\n");
579 
580 	usb_poison_anchored_urbs(&ar->tx_anch);
581 	carl9170_usb_handle_tx_err(ar);
582 	usb_poison_anchored_urbs(&ar->rx_anch);
583 
584 	tasklet_kill(&ar->usb_tasklet);
585 
586 	usb_scuttle_anchored_urbs(&ar->rx_work);
587 	usb_scuttle_anchored_urbs(&ar->rx_pool);
588 	usb_scuttle_anchored_urbs(&ar->tx_cmd);
589 }
590 
591 int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd,
592 			const bool free_buf)
593 {
594 	struct urb *urb;
595 	int err = 0;
596 
597 	if (!IS_INITIALIZED(ar)) {
598 		err = -EPERM;
599 		goto err_free;
600 	}
601 
602 	if (WARN_ON(cmd->hdr.len > CARL9170_MAX_CMD_LEN - 4)) {
603 		err = -EINVAL;
604 		goto err_free;
605 	}
606 
607 	urb = usb_alloc_urb(0, GFP_ATOMIC);
608 	if (!urb) {
609 		err = -ENOMEM;
610 		goto err_free;
611 	}
612 
613 	usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,
614 		AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
615 		carl9170_usb_cmd_complete, ar, 1);
616 
617 	if (free_buf)
618 		urb->transfer_flags |= URB_FREE_BUFFER;
619 
620 	usb_anchor_urb(urb, &ar->tx_cmd);
621 	usb_free_urb(urb);
622 
623 	return carl9170_usb_submit_cmd_urb(ar);
624 
625 err_free:
626 	if (free_buf)
627 		kfree(cmd);
628 
629 	return err;
630 }
631 
632 int carl9170_exec_cmd(struct ar9170 *ar, const enum carl9170_cmd_oids cmd,
633 	unsigned int plen, void *payload, unsigned int outlen, void *out)
634 {
635 	int err = -ENOMEM;
636 
637 	if (!IS_ACCEPTING_CMD(ar))
638 		return -EIO;
639 
640 	if (!(cmd & CARL9170_CMD_ASYNC_FLAG))
641 		might_sleep();
642 
643 	ar->cmd.hdr.len = plen;
644 	ar->cmd.hdr.cmd = cmd;
645 	/* writing multiple regs fills this buffer already */
646 	if (plen && payload != (u8 *)(ar->cmd.data))
647 		memcpy(ar->cmd.data, payload, plen);
648 
649 	spin_lock_bh(&ar->cmd_lock);
650 	ar->readbuf = (u8 *)out;
651 	ar->readlen = outlen;
652 	spin_unlock_bh(&ar->cmd_lock);
653 
654 	err = __carl9170_exec_cmd(ar, &ar->cmd, false);
655 
656 	if (!(cmd & CARL9170_CMD_ASYNC_FLAG)) {
657 		err = wait_for_completion_timeout(&ar->cmd_wait, HZ);
658 		if (err == 0) {
659 			err = -ETIMEDOUT;
660 			goto err_unbuf;
661 		}
662 
663 		if (ar->readlen != outlen) {
664 			err = -EMSGSIZE;
665 			goto err_unbuf;
666 		}
667 	}
668 
669 	return 0;
670 
671 err_unbuf:
672 	/* Maybe the device was removed in the moment we were waiting? */
673 	if (IS_STARTED(ar)) {
674 		dev_err(&ar->udev->dev, "no command feedback "
675 			"received (%d).\n", err);
676 
677 		/* provide some maybe useful debug information */
678 		print_hex_dump_bytes("carl9170 cmd: ", DUMP_PREFIX_NONE,
679 				     &ar->cmd, plen + 4);
680 
681 		carl9170_restart(ar, CARL9170_RR_COMMAND_TIMEOUT);
682 	}
683 
684 	/* invalidate to avoid completing the next command prematurely */
685 	spin_lock_bh(&ar->cmd_lock);
686 	ar->readbuf = NULL;
687 	ar->readlen = 0;
688 	spin_unlock_bh(&ar->cmd_lock);
689 
690 	return err;
691 }
692 
693 void carl9170_usb_tx(struct ar9170 *ar, struct sk_buff *skb)
694 {
695 	struct urb *urb;
696 	struct ar9170_stream *tx_stream;
697 	void *data;
698 	unsigned int len;
699 
700 	if (!IS_STARTED(ar))
701 		goto err_drop;
702 
703 	urb = usb_alloc_urb(0, GFP_ATOMIC);
704 	if (!urb)
705 		goto err_drop;
706 
707 	if (ar->fw.tx_stream) {
708 		tx_stream = (void *) (skb->data - sizeof(*tx_stream));
709 
710 		len = skb->len + sizeof(*tx_stream);
711 		tx_stream->length = cpu_to_le16(len);
712 		tx_stream->tag = cpu_to_le16(AR9170_TX_STREAM_TAG);
713 		data = tx_stream;
714 	} else {
715 		data = skb->data;
716 		len = skb->len;
717 	}
718 
719 	usb_fill_bulk_urb(urb, ar->udev, usb_sndbulkpipe(ar->udev,
720 		AR9170_USB_EP_TX), data, len,
721 		carl9170_usb_tx_data_complete, skb);
722 
723 	urb->transfer_flags |= URB_ZERO_PACKET;
724 
725 	usb_anchor_urb(urb, &ar->tx_wait);
726 
727 	usb_free_urb(urb);
728 
729 	carl9170_usb_submit_data_urb(ar);
730 	return;
731 
732 err_drop:
733 	carl9170_tx_drop(ar, skb);
734 	carl9170_tx_callback(ar, skb);
735 }
736 
737 static void carl9170_release_firmware(struct ar9170 *ar)
738 {
739 	if (ar->fw.fw) {
740 		release_firmware(ar->fw.fw);
741 		memset(&ar->fw, 0, sizeof(ar->fw));
742 	}
743 }
744 
745 void carl9170_usb_stop(struct ar9170 *ar)
746 {
747 	int ret;
748 
749 	carl9170_set_state_when(ar, CARL9170_IDLE, CARL9170_STOPPED);
750 
751 	ret = carl9170_usb_flush(ar);
752 	if (ret)
753 		dev_err(&ar->udev->dev, "kill pending tx urbs.\n");
754 
755 	usb_poison_anchored_urbs(&ar->tx_anch);
756 	carl9170_usb_handle_tx_err(ar);
757 
758 	/* kill any pending command */
759 	spin_lock_bh(&ar->cmd_lock);
760 	ar->readlen = 0;
761 	spin_unlock_bh(&ar->cmd_lock);
762 	complete_all(&ar->cmd_wait);
763 
764 	/* This is required to prevent an early completion on _start */
765 	INIT_COMPLETION(ar->cmd_wait);
766 
767 	/*
768 	 * Note:
769 	 * So far we freed all tx urbs, but we won't dare to touch any rx urbs.
770 	 * Else we would end up with a unresponsive device...
771 	 */
772 }
773 
774 int carl9170_usb_open(struct ar9170 *ar)
775 {
776 	usb_unpoison_anchored_urbs(&ar->tx_anch);
777 
778 	carl9170_set_state_when(ar, CARL9170_STOPPED, CARL9170_IDLE);
779 	return 0;
780 }
781 
782 static int carl9170_usb_load_firmware(struct ar9170 *ar)
783 {
784 	const u8 *data;
785 	u8 *buf;
786 	unsigned int transfer;
787 	size_t len;
788 	u32 addr;
789 	int err = 0;
790 
791 	buf = kmalloc(4096, GFP_KERNEL);
792 	if (!buf) {
793 		err = -ENOMEM;
794 		goto err_out;
795 	}
796 
797 	data = ar->fw.fw->data;
798 	len = ar->fw.fw->size;
799 	addr = ar->fw.address;
800 
801 	/* this removes the miniboot image */
802 	data += ar->fw.offset;
803 	len -= ar->fw.offset;
804 
805 	while (len) {
806 		transfer = min_t(unsigned int, len, 4096u);
807 		memcpy(buf, data, transfer);
808 
809 		err = usb_control_msg(ar->udev, usb_sndctrlpipe(ar->udev, 0),
810 				      0x30 /* FW DL */, 0x40 | USB_DIR_OUT,
811 				      addr >> 8, 0, buf, transfer, 100);
812 
813 		if (err < 0) {
814 			kfree(buf);
815 			goto err_out;
816 		}
817 
818 		len -= transfer;
819 		data += transfer;
820 		addr += transfer;
821 	}
822 	kfree(buf);
823 
824 	err = usb_control_msg(ar->udev, usb_sndctrlpipe(ar->udev, 0),
825 			      0x31 /* FW DL COMPLETE */,
826 			      0x40 | USB_DIR_OUT, 0, 0, NULL, 0, 200);
827 
828 	if (wait_for_completion_timeout(&ar->fw_boot_wait, HZ) == 0) {
829 		err = -ETIMEDOUT;
830 		goto err_out;
831 	}
832 
833 	err = carl9170_echo_test(ar, 0x4a110123);
834 	if (err)
835 		goto err_out;
836 
837 	/* now, start the command response counter */
838 	ar->cmd_seq = -1;
839 
840 	return 0;
841 
842 err_out:
843 	dev_err(&ar->udev->dev, "firmware upload failed (%d).\n", err);
844 	return err;
845 }
846 
847 int carl9170_usb_restart(struct ar9170 *ar)
848 {
849 	int err = 0;
850 
851 	if (ar->intf->condition != USB_INTERFACE_BOUND)
852 		return 0;
853 
854 	/*
855 	 * Disable the command response sequence counter check.
856 	 * We already know that the device/firmware is in a bad state.
857 	 * So, no extra points are awarded to anyone who reminds the
858 	 * driver about that.
859 	 */
860 	ar->cmd_seq = -2;
861 
862 	err = carl9170_reboot(ar);
863 
864 	carl9170_usb_stop(ar);
865 
866 	if (err)
867 		goto err_out;
868 
869 	tasklet_schedule(&ar->usb_tasklet);
870 
871 	/* The reboot procedure can take quite a while to complete. */
872 	msleep(1100);
873 
874 	err = carl9170_usb_open(ar);
875 	if (err)
876 		goto err_out;
877 
878 	err = carl9170_usb_load_firmware(ar);
879 	if (err)
880 		goto err_out;
881 
882 	return 0;
883 
884 err_out:
885 	carl9170_usb_cancel_urbs(ar);
886 	return err;
887 }
888 
889 void carl9170_usb_reset(struct ar9170 *ar)
890 {
891 	/*
892 	 * This is the last resort to get the device going again
893 	 * without any *user replugging action*.
894 	 *
895 	 * But there is a catch: usb_reset really is like a physical
896 	 * *reconnect*. The mac80211 state will be lost in the process.
897 	 * Therefore a userspace application, which is monitoring
898 	 * the link must step in.
899 	 */
900 	carl9170_usb_cancel_urbs(ar);
901 
902 	carl9170_usb_stop(ar);
903 
904 	usb_queue_reset_device(ar->intf);
905 }
906 
907 static int carl9170_usb_init_device(struct ar9170 *ar)
908 {
909 	int err;
910 
911 	/*
912 	 * The carl9170 firmware let's the driver know when it's
913 	 * ready for action. But we have to be prepared to gracefully
914 	 * handle all spurious [flushed] messages after each (re-)boot.
915 	 * Thus the command response counter remains disabled until it
916 	 * can be safely synchronized.
917 	 */
918 	ar->cmd_seq = -2;
919 
920 	err = carl9170_usb_send_rx_irq_urb(ar);
921 	if (err)
922 		goto err_out;
923 
924 	err = carl9170_usb_init_rx_bulk_urbs(ar);
925 	if (err)
926 		goto err_unrx;
927 
928 	err = carl9170_usb_open(ar);
929 	if (err)
930 		goto err_unrx;
931 
932 	mutex_lock(&ar->mutex);
933 	err = carl9170_usb_load_firmware(ar);
934 	mutex_unlock(&ar->mutex);
935 	if (err)
936 		goto err_stop;
937 
938 	return 0;
939 
940 err_stop:
941 	carl9170_usb_stop(ar);
942 
943 err_unrx:
944 	carl9170_usb_cancel_urbs(ar);
945 
946 err_out:
947 	return err;
948 }
949 
950 static void carl9170_usb_firmware_failed(struct ar9170 *ar)
951 {
952 	struct device *parent = ar->udev->dev.parent;
953 	struct usb_device *udev;
954 
955 	/*
956 	 * Store a copy of the usb_device pointer locally.
957 	 * This is because device_release_driver initiates
958 	 * carl9170_usb_disconnect, which in turn frees our
959 	 * driver context (ar).
960 	 */
961 	udev = ar->udev;
962 
963 	complete(&ar->fw_load_wait);
964 
965 	/* unbind anything failed */
966 	if (parent)
967 		device_lock(parent);
968 
969 	device_release_driver(&udev->dev);
970 	if (parent)
971 		device_unlock(parent);
972 
973 	usb_put_dev(udev);
974 }
975 
976 static void carl9170_usb_firmware_finish(struct ar9170 *ar)
977 {
978 	int err;
979 
980 	err = carl9170_parse_firmware(ar);
981 	if (err)
982 		goto err_freefw;
983 
984 	err = carl9170_usb_init_device(ar);
985 	if (err)
986 		goto err_freefw;
987 
988 	err = carl9170_register(ar);
989 
990 	carl9170_usb_stop(ar);
991 	if (err)
992 		goto err_unrx;
993 
994 	complete(&ar->fw_load_wait);
995 	usb_put_dev(ar->udev);
996 	return;
997 
998 err_unrx:
999 	carl9170_usb_cancel_urbs(ar);
1000 
1001 err_freefw:
1002 	carl9170_release_firmware(ar);
1003 	carl9170_usb_firmware_failed(ar);
1004 }
1005 
1006 static void carl9170_usb_firmware_step2(const struct firmware *fw,
1007 					void *context)
1008 {
1009 	struct ar9170 *ar = context;
1010 
1011 	if (fw) {
1012 		ar->fw.fw = fw;
1013 		carl9170_usb_firmware_finish(ar);
1014 		return;
1015 	}
1016 
1017 	dev_err(&ar->udev->dev, "firmware not found.\n");
1018 	carl9170_usb_firmware_failed(ar);
1019 }
1020 
1021 static int carl9170_usb_probe(struct usb_interface *intf,
1022 			      const struct usb_device_id *id)
1023 {
1024 	struct ar9170 *ar;
1025 	struct usb_device *udev;
1026 	int err;
1027 
1028 	err = usb_reset_device(interface_to_usbdev(intf));
1029 	if (err)
1030 		return err;
1031 
1032 	ar = carl9170_alloc(sizeof(*ar));
1033 	if (IS_ERR(ar))
1034 		return PTR_ERR(ar);
1035 
1036 	udev = interface_to_usbdev(intf);
1037 	usb_get_dev(udev);
1038 	ar->udev = udev;
1039 	ar->intf = intf;
1040 	ar->features = id->driver_info;
1041 
1042 	usb_set_intfdata(intf, ar);
1043 	SET_IEEE80211_DEV(ar->hw, &intf->dev);
1044 
1045 	init_usb_anchor(&ar->rx_anch);
1046 	init_usb_anchor(&ar->rx_pool);
1047 	init_usb_anchor(&ar->rx_work);
1048 	init_usb_anchor(&ar->tx_wait);
1049 	init_usb_anchor(&ar->tx_anch);
1050 	init_usb_anchor(&ar->tx_cmd);
1051 	init_usb_anchor(&ar->tx_err);
1052 	init_completion(&ar->cmd_wait);
1053 	init_completion(&ar->fw_boot_wait);
1054 	init_completion(&ar->fw_load_wait);
1055 	tasklet_init(&ar->usb_tasklet, carl9170_usb_tasklet,
1056 		     (unsigned long)ar);
1057 
1058 	atomic_set(&ar->tx_cmd_urbs, 0);
1059 	atomic_set(&ar->tx_anch_urbs, 0);
1060 	atomic_set(&ar->rx_work_urbs, 0);
1061 	atomic_set(&ar->rx_anch_urbs, 0);
1062 	atomic_set(&ar->rx_pool_urbs, 0);
1063 
1064 	usb_get_dev(ar->udev);
1065 
1066 	carl9170_set_state(ar, CARL9170_STOPPED);
1067 
1068 	return request_firmware_nowait(THIS_MODULE, 1, CARL9170FW_NAME,
1069 		&ar->udev->dev, GFP_KERNEL, ar, carl9170_usb_firmware_step2);
1070 }
1071 
1072 static void carl9170_usb_disconnect(struct usb_interface *intf)
1073 {
1074 	struct ar9170 *ar = usb_get_intfdata(intf);
1075 	struct usb_device *udev;
1076 
1077 	if (WARN_ON(!ar))
1078 		return;
1079 
1080 	udev = ar->udev;
1081 	wait_for_completion(&ar->fw_load_wait);
1082 
1083 	if (IS_INITIALIZED(ar)) {
1084 		carl9170_reboot(ar);
1085 		carl9170_usb_stop(ar);
1086 	}
1087 
1088 	carl9170_usb_cancel_urbs(ar);
1089 	carl9170_unregister(ar);
1090 
1091 	usb_set_intfdata(intf, NULL);
1092 
1093 	carl9170_release_firmware(ar);
1094 	carl9170_free(ar);
1095 	usb_put_dev(udev);
1096 }
1097 
1098 #ifdef CONFIG_PM
1099 static int carl9170_usb_suspend(struct usb_interface *intf,
1100 				pm_message_t message)
1101 {
1102 	struct ar9170 *ar = usb_get_intfdata(intf);
1103 
1104 	if (!ar)
1105 		return -ENODEV;
1106 
1107 	carl9170_usb_cancel_urbs(ar);
1108 
1109 	return 0;
1110 }
1111 
1112 static int carl9170_usb_resume(struct usb_interface *intf)
1113 {
1114 	struct ar9170 *ar = usb_get_intfdata(intf);
1115 	int err;
1116 
1117 	if (!ar)
1118 		return -ENODEV;
1119 
1120 	usb_unpoison_anchored_urbs(&ar->rx_anch);
1121 	carl9170_set_state(ar, CARL9170_STOPPED);
1122 
1123 	/*
1124 	 * The USB documentation demands that [for suspend] all traffic
1125 	 * to and from the device has to stop. This would be fine, but
1126 	 * there's a catch: the device[usb phy] does not come back.
1127 	 *
1128 	 * Upon resume the firmware will "kill" itself and the
1129 	 * boot-code sorts out the magic voodoo.
1130 	 * Not very nice, but there's not much what could go wrong.
1131 	 */
1132 	msleep(1100);
1133 
1134 	err = carl9170_usb_init_device(ar);
1135 	if (err)
1136 		goto err_unrx;
1137 
1138 	return 0;
1139 
1140 err_unrx:
1141 	carl9170_usb_cancel_urbs(ar);
1142 
1143 	return err;
1144 }
1145 #endif /* CONFIG_PM */
1146 
1147 static struct usb_driver carl9170_driver = {
1148 	.name = KBUILD_MODNAME,
1149 	.probe = carl9170_usb_probe,
1150 	.disconnect = carl9170_usb_disconnect,
1151 	.id_table = carl9170_usb_ids,
1152 	.soft_unbind = 1,
1153 #ifdef CONFIG_PM
1154 	.suspend = carl9170_usb_suspend,
1155 	.resume = carl9170_usb_resume,
1156 	.reset_resume = carl9170_usb_resume,
1157 #endif /* CONFIG_PM */
1158 };
1159 
1160 static int __init carl9170_usb_init(void)
1161 {
1162 	return usb_register(&carl9170_driver);
1163 }
1164 
1165 static void __exit carl9170_usb_exit(void)
1166 {
1167 	usb_deregister(&carl9170_driver);
1168 }
1169 
1170 module_init(carl9170_usb_init);
1171 module_exit(carl9170_usb_exit);
1172