1 /* 2 * USB Orinoco driver 3 * 4 * Copyright (c) 2003 Manuel Estrada Sainz 5 * 6 * The contents of this file are subject to the Mozilla Public License 7 * Version 1.1 (the "License"); you may not use this file except in 8 * compliance with the License. You may obtain a copy of the License 9 * at http://www.mozilla.org/MPL/ 10 * 11 * Software distributed under the License is distributed on an "AS IS" 12 * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See 13 * the License for the specific language governing rights and 14 * limitations under the License. 15 * 16 * Alternatively, the contents of this file may be used under the 17 * terms of the GNU General Public License version 2 (the "GPL"), in 18 * which case the provisions of the GPL are applicable instead of the 19 * above. If you wish to allow the use of your version of this file 20 * only under the terms of the GPL and not to allow others to use your 21 * version of this file under the MPL, indicate your decision by 22 * deleting the provisions above and replace them with the notice and 23 * other provisions required by the GPL. If you do not delete the 24 * provisions above, a recipient may use your version of this file 25 * under either the MPL or the GPL. 26 * 27 * Queueing code based on linux-wlan-ng 0.2.1-pre5 28 * 29 * Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved. 30 * 31 * The license is the same as above. 32 * 33 * Initialy based on USB Skeleton driver - 0.7 34 * 35 * Copyright (c) 2001 Greg Kroah-Hartman (greg@kroah.com) 36 * 37 * This program is free software; you can redistribute it and/or 38 * modify it under the terms of the GNU General Public License as 39 * published by the Free Software Foundation; either version 2 of 40 * the License, or (at your option) any later version. 41 * 42 * NOTE: The original USB Skeleton driver is GPL, but all that code is 43 * gone so MPL/GPL applies. 44 */ 45 46 #define DRIVER_NAME "orinoco_usb" 47 #define PFX DRIVER_NAME ": " 48 49 #include <linux/module.h> 50 #include <linux/kernel.h> 51 #include <linux/sched.h> 52 #include <linux/signal.h> 53 #include <linux/errno.h> 54 #include <linux/poll.h> 55 #include <linux/slab.h> 56 #include <linux/fcntl.h> 57 #include <linux/spinlock.h> 58 #include <linux/list.h> 59 #include <linux/usb.h> 60 #include <linux/timer.h> 61 62 #include <linux/netdevice.h> 63 #include <linux/if_arp.h> 64 #include <linux/etherdevice.h> 65 #include <linux/wireless.h> 66 #include <linux/firmware.h> 67 #include <linux/refcount.h> 68 69 #include "mic.h" 70 #include "orinoco.h" 71 72 #ifndef URB_ASYNC_UNLINK 73 #define URB_ASYNC_UNLINK 0 74 #endif 75 76 /* 802.2 LLC/SNAP header used for Ethernet encapsulation over 802.11 */ 77 static const u8 encaps_hdr[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00}; 78 #define ENCAPS_OVERHEAD (sizeof(encaps_hdr) + 2) 79 80 struct header_struct { 81 /* 802.3 */ 82 u8 dest[ETH_ALEN]; 83 u8 src[ETH_ALEN]; 84 __be16 len; 85 /* 802.2 */ 86 u8 dsap; 87 u8 ssap; 88 u8 ctrl; 89 /* SNAP */ 90 u8 oui[3]; 91 __be16 ethertype; 92 } __packed; 93 94 struct ez_usb_fw { 95 u16 size; 96 const u8 *code; 97 }; 98 99 static struct ez_usb_fw firmware = { 100 .size = 0, 101 .code = NULL, 102 }; 103 104 /* Debugging macros */ 105 #undef err 106 #define err(format, arg...) \ 107 do { printk(KERN_ERR PFX format "\n", ## arg); } while (0) 108 109 MODULE_FIRMWARE("orinoco_ezusb_fw"); 110 111 /* 112 * Under some conditions, the card gets stuck and stops paying attention 113 * to the world (i.e. data communication stalls) until we do something to 114 * it. Sending an INQ_TALLIES command seems to be enough and should be 115 * harmless otherwise. This behaviour has been observed when using the 116 * driver on a systemimager client during installation. In the past a 117 * timer was used to send INQ_TALLIES commands when there was no other 118 * activity, but it was troublesome and was removed. 119 */ 120 121 #define USB_COMPAQ_VENDOR_ID 0x049f /* Compaq Computer Corp. */ 122 #define USB_COMPAQ_WL215_ID 0x001f /* Compaq WL215 USB Adapter */ 123 #define USB_COMPAQ_W200_ID 0x0076 /* Compaq W200 USB Adapter */ 124 #define USB_HP_WL215_ID 0x0082 /* Compaq WL215 USB Adapter */ 125 126 #define USB_MELCO_VENDOR_ID 0x0411 127 #define USB_BUFFALO_L11_ID 0x0006 /* BUFFALO WLI-USB-L11 */ 128 #define USB_BUFFALO_L11G_WR_ID 0x000B /* BUFFALO WLI-USB-L11G-WR */ 129 #define USB_BUFFALO_L11G_ID 0x000D /* BUFFALO WLI-USB-L11G */ 130 131 #define USB_LUCENT_VENDOR_ID 0x047E /* Lucent Technologies */ 132 #define USB_LUCENT_ORINOCO_ID 0x0300 /* Lucent/Agere Orinoco USB Client */ 133 134 #define USB_AVAYA8_VENDOR_ID 0x0D98 135 #define USB_AVAYAE_VENDOR_ID 0x0D9E 136 #define USB_AVAYA_WIRELESS_ID 0x0300 /* Avaya Wireless USB Card */ 137 138 #define USB_AGERE_VENDOR_ID 0x0D4E /* Agere Systems */ 139 #define USB_AGERE_MODEL0801_ID 0x1000 /* Wireless USB Card Model 0801 */ 140 #define USB_AGERE_MODEL0802_ID 0x1001 /* Wireless USB Card Model 0802 */ 141 #define USB_AGERE_REBRANDED_ID 0x047A /* WLAN USB Card */ 142 143 #define USB_ELSA_VENDOR_ID 0x05CC 144 #define USB_ELSA_AIRLANCER_ID 0x3100 /* ELSA AirLancer USB-11 */ 145 146 #define USB_LEGEND_VENDOR_ID 0x0E7C 147 #define USB_LEGEND_JOYNET_ID 0x0300 /* Joynet WLAN USB Card */ 148 149 #define USB_SAMSUNG_VENDOR_ID 0x04E8 150 #define USB_SAMSUNG_SEW2001U1_ID 0x5002 /* Samsung SEW-2001u Card */ 151 #define USB_SAMSUNG_SEW2001U2_ID 0x5B11 /* Samsung SEW-2001u Card */ 152 #define USB_SAMSUNG_SEW2003U_ID 0x7011 /* Samsung SEW-2003U Card */ 153 154 #define USB_IGATE_VENDOR_ID 0x0681 155 #define USB_IGATE_IGATE_11M_ID 0x0012 /* I-GATE 11M USB Card */ 156 157 #define USB_FUJITSU_VENDOR_ID 0x0BF8 158 #define USB_FUJITSU_E1100_ID 0x1002 /* connect2AIR WLAN E-1100 USB */ 159 160 #define USB_2WIRE_VENDOR_ID 0x1630 161 #define USB_2WIRE_WIRELESS_ID 0xff81 /* 2Wire Wireless USB adapter */ 162 163 164 #define EZUSB_REQUEST_FW_TRANS 0xA0 165 #define EZUSB_REQUEST_TRIGER 0xAA 166 #define EZUSB_REQUEST_TRIG_AC 0xAC 167 #define EZUSB_CPUCS_REG 0x7F92 168 169 #define EZUSB_RID_TX 0x0700 170 #define EZUSB_RID_RX 0x0701 171 #define EZUSB_RID_INIT1 0x0702 172 #define EZUSB_RID_ACK 0x0710 173 #define EZUSB_RID_READ_PDA 0x0800 174 #define EZUSB_RID_PROG_INIT 0x0852 175 #define EZUSB_RID_PROG_SET_ADDR 0x0853 176 #define EZUSB_RID_PROG_BYTES 0x0854 177 #define EZUSB_RID_PROG_END 0x0855 178 #define EZUSB_RID_DOCMD 0x0860 179 180 /* Recognize info frames */ 181 #define EZUSB_IS_INFO(id) ((id >= 0xF000) && (id <= 0xF2FF)) 182 183 #define EZUSB_MAGIC 0x0210 184 185 #define EZUSB_FRAME_DATA 1 186 #define EZUSB_FRAME_CONTROL 2 187 188 #define DEF_TIMEOUT (3 * HZ) 189 190 #define BULK_BUF_SIZE 2048 191 192 #define MAX_DL_SIZE (BULK_BUF_SIZE - sizeof(struct ezusb_packet)) 193 194 #define FW_BUF_SIZE 64 195 #define FW_VAR_OFFSET_PTR 0x359 196 #define FW_VAR_VALUE 0 197 #define FW_HOLE_START 0x100 198 #define FW_HOLE_END 0x300 199 200 struct ezusb_packet { 201 __le16 magic; /* 0x0210 */ 202 u8 req_reply_count; 203 u8 ans_reply_count; 204 __le16 frame_type; /* 0x01 for data frames, 0x02 otherwise */ 205 __le16 size; /* transport size */ 206 __le16 crc; /* CRC up to here */ 207 __le16 hermes_len; 208 __le16 hermes_rid; 209 u8 data[0]; 210 } __packed; 211 212 /* Table of devices that work or may work with this driver */ 213 static const struct usb_device_id ezusb_table[] = { 214 {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_COMPAQ_WL215_ID)}, 215 {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_HP_WL215_ID)}, 216 {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_COMPAQ_W200_ID)}, 217 {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11_ID)}, 218 {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11G_WR_ID)}, 219 {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11G_ID)}, 220 {USB_DEVICE(USB_LUCENT_VENDOR_ID, USB_LUCENT_ORINOCO_ID)}, 221 {USB_DEVICE(USB_AVAYA8_VENDOR_ID, USB_AVAYA_WIRELESS_ID)}, 222 {USB_DEVICE(USB_AVAYAE_VENDOR_ID, USB_AVAYA_WIRELESS_ID)}, 223 {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_MODEL0801_ID)}, 224 {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_MODEL0802_ID)}, 225 {USB_DEVICE(USB_ELSA_VENDOR_ID, USB_ELSA_AIRLANCER_ID)}, 226 {USB_DEVICE(USB_LEGEND_VENDOR_ID, USB_LEGEND_JOYNET_ID)}, 227 {USB_DEVICE_VER(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2001U1_ID, 228 0, 0)}, 229 {USB_DEVICE(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2001U2_ID)}, 230 {USB_DEVICE(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2003U_ID)}, 231 {USB_DEVICE(USB_IGATE_VENDOR_ID, USB_IGATE_IGATE_11M_ID)}, 232 {USB_DEVICE(USB_FUJITSU_VENDOR_ID, USB_FUJITSU_E1100_ID)}, 233 {USB_DEVICE(USB_2WIRE_VENDOR_ID, USB_2WIRE_WIRELESS_ID)}, 234 {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_REBRANDED_ID)}, 235 {} /* Terminating entry */ 236 }; 237 238 MODULE_DEVICE_TABLE(usb, ezusb_table); 239 240 /* Structure to hold all of our device specific stuff */ 241 struct ezusb_priv { 242 struct usb_device *udev; 243 struct net_device *dev; 244 struct mutex mtx; 245 spinlock_t req_lock; 246 struct list_head req_pending; 247 struct list_head req_active; 248 spinlock_t reply_count_lock; 249 u16 hermes_reg_fake[0x40]; 250 u8 *bap_buf; 251 struct urb *read_urb; 252 int read_pipe; 253 int write_pipe; 254 u8 reply_count; 255 }; 256 257 enum ezusb_state { 258 EZUSB_CTX_START, 259 EZUSB_CTX_QUEUED, 260 EZUSB_CTX_REQ_SUBMITTED, 261 EZUSB_CTX_REQ_COMPLETE, 262 EZUSB_CTX_RESP_RECEIVED, 263 EZUSB_CTX_REQ_TIMEOUT, 264 EZUSB_CTX_REQ_FAILED, 265 EZUSB_CTX_RESP_TIMEOUT, 266 EZUSB_CTX_REQSUBMIT_FAIL, 267 EZUSB_CTX_COMPLETE, 268 }; 269 270 struct request_context { 271 struct list_head list; 272 refcount_t refcount; 273 struct completion done; /* Signals that CTX is dead */ 274 int killed; 275 struct urb *outurb; /* OUT for req pkt */ 276 struct ezusb_priv *upriv; 277 struct ezusb_packet *buf; 278 int buf_length; 279 struct timer_list timer; /* Timeout handling */ 280 enum ezusb_state state; /* Current state */ 281 /* the RID that we will wait for */ 282 u16 out_rid; 283 u16 in_rid; 284 }; 285 286 287 /* Forward declarations */ 288 static void ezusb_ctx_complete(struct request_context *ctx); 289 static void ezusb_req_queue_run(struct ezusb_priv *upriv); 290 static void ezusb_bulk_in_callback(struct urb *urb); 291 292 static inline u8 ezusb_reply_inc(u8 count) 293 { 294 if (count < 0x7F) 295 return count + 1; 296 else 297 return 1; 298 } 299 300 static void ezusb_request_context_put(struct request_context *ctx) 301 { 302 if (!refcount_dec_and_test(&ctx->refcount)) 303 return; 304 305 WARN_ON(!ctx->done.done); 306 BUG_ON(ctx->outurb->status == -EINPROGRESS); 307 BUG_ON(timer_pending(&ctx->timer)); 308 usb_free_urb(ctx->outurb); 309 kfree(ctx->buf); 310 kfree(ctx); 311 } 312 313 static inline void ezusb_mod_timer(struct ezusb_priv *upriv, 314 struct timer_list *timer, 315 unsigned long expire) 316 { 317 if (!upriv->udev) 318 return; 319 mod_timer(timer, expire); 320 } 321 322 static void ezusb_request_timerfn(u_long _ctx) 323 { 324 struct request_context *ctx = (void *) _ctx; 325 326 ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK; 327 if (usb_unlink_urb(ctx->outurb) == -EINPROGRESS) { 328 ctx->state = EZUSB_CTX_REQ_TIMEOUT; 329 } else { 330 ctx->state = EZUSB_CTX_RESP_TIMEOUT; 331 dev_dbg(&ctx->outurb->dev->dev, "couldn't unlink\n"); 332 refcount_inc(&ctx->refcount); 333 ctx->killed = 1; 334 ezusb_ctx_complete(ctx); 335 ezusb_request_context_put(ctx); 336 } 337 }; 338 339 static struct request_context *ezusb_alloc_ctx(struct ezusb_priv *upriv, 340 u16 out_rid, u16 in_rid) 341 { 342 struct request_context *ctx; 343 344 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC); 345 if (!ctx) 346 return NULL; 347 348 ctx->buf = kmalloc(BULK_BUF_SIZE, GFP_ATOMIC); 349 if (!ctx->buf) { 350 kfree(ctx); 351 return NULL; 352 } 353 ctx->outurb = usb_alloc_urb(0, GFP_ATOMIC); 354 if (!ctx->outurb) { 355 kfree(ctx->buf); 356 kfree(ctx); 357 return NULL; 358 } 359 360 ctx->upriv = upriv; 361 ctx->state = EZUSB_CTX_START; 362 ctx->out_rid = out_rid; 363 ctx->in_rid = in_rid; 364 365 refcount_set(&ctx->refcount, 1); 366 init_completion(&ctx->done); 367 368 setup_timer(&ctx->timer, ezusb_request_timerfn, (u_long)ctx); 369 return ctx; 370 } 371 372 373 /* Hopefully the real complete_all will soon be exported, in the mean 374 * while this should work. */ 375 static inline void ezusb_complete_all(struct completion *comp) 376 { 377 complete(comp); 378 complete(comp); 379 complete(comp); 380 complete(comp); 381 } 382 383 static void ezusb_ctx_complete(struct request_context *ctx) 384 { 385 struct ezusb_priv *upriv = ctx->upriv; 386 unsigned long flags; 387 388 spin_lock_irqsave(&upriv->req_lock, flags); 389 390 list_del_init(&ctx->list); 391 if (upriv->udev) { 392 spin_unlock_irqrestore(&upriv->req_lock, flags); 393 ezusb_req_queue_run(upriv); 394 spin_lock_irqsave(&upriv->req_lock, flags); 395 } 396 397 switch (ctx->state) { 398 case EZUSB_CTX_COMPLETE: 399 case EZUSB_CTX_REQSUBMIT_FAIL: 400 case EZUSB_CTX_REQ_FAILED: 401 case EZUSB_CTX_REQ_TIMEOUT: 402 case EZUSB_CTX_RESP_TIMEOUT: 403 spin_unlock_irqrestore(&upriv->req_lock, flags); 404 405 if ((ctx->out_rid == EZUSB_RID_TX) && upriv->dev) { 406 struct net_device *dev = upriv->dev; 407 struct net_device_stats *stats = &dev->stats; 408 409 if (ctx->state != EZUSB_CTX_COMPLETE) 410 stats->tx_errors++; 411 else 412 stats->tx_packets++; 413 414 netif_wake_queue(dev); 415 } 416 ezusb_complete_all(&ctx->done); 417 ezusb_request_context_put(ctx); 418 break; 419 420 default: 421 spin_unlock_irqrestore(&upriv->req_lock, flags); 422 if (!upriv->udev) { 423 /* This is normal, as all request contexts get flushed 424 * when the device is disconnected */ 425 err("Called, CTX not terminating, but device gone"); 426 ezusb_complete_all(&ctx->done); 427 ezusb_request_context_put(ctx); 428 break; 429 } 430 431 err("Called, CTX not in terminating state."); 432 /* Things are really bad if this happens. Just leak 433 * the CTX because it may still be linked to the 434 * queue or the OUT urb may still be active. 435 * Just leaking at least prevents an Oops or Panic. 436 */ 437 break; 438 } 439 } 440 441 /** 442 * ezusb_req_queue_run: 443 * Description: 444 * Note: Only one active CTX at any one time, because there's no 445 * other (reliable) way to match the response URB to the correct 446 * CTX. 447 **/ 448 static void ezusb_req_queue_run(struct ezusb_priv *upriv) 449 { 450 unsigned long flags; 451 struct request_context *ctx; 452 int result; 453 454 spin_lock_irqsave(&upriv->req_lock, flags); 455 456 if (!list_empty(&upriv->req_active)) 457 goto unlock; 458 459 if (list_empty(&upriv->req_pending)) 460 goto unlock; 461 462 ctx = 463 list_entry(upriv->req_pending.next, struct request_context, 464 list); 465 466 if (!ctx->upriv->udev) 467 goto unlock; 468 469 /* We need to split this off to avoid a race condition */ 470 list_move_tail(&ctx->list, &upriv->req_active); 471 472 if (ctx->state == EZUSB_CTX_QUEUED) { 473 refcount_inc(&ctx->refcount); 474 result = usb_submit_urb(ctx->outurb, GFP_ATOMIC); 475 if (result) { 476 ctx->state = EZUSB_CTX_REQSUBMIT_FAIL; 477 478 spin_unlock_irqrestore(&upriv->req_lock, flags); 479 480 err("Fatal, failed to submit command urb." 481 " error=%d\n", result); 482 483 ezusb_ctx_complete(ctx); 484 ezusb_request_context_put(ctx); 485 goto done; 486 } 487 488 ctx->state = EZUSB_CTX_REQ_SUBMITTED; 489 ezusb_mod_timer(ctx->upriv, &ctx->timer, 490 jiffies + DEF_TIMEOUT); 491 } 492 493 unlock: 494 spin_unlock_irqrestore(&upriv->req_lock, flags); 495 496 done: 497 return; 498 } 499 500 static void ezusb_req_enqueue_run(struct ezusb_priv *upriv, 501 struct request_context *ctx) 502 { 503 unsigned long flags; 504 505 spin_lock_irqsave(&upriv->req_lock, flags); 506 507 if (!ctx->upriv->udev) { 508 spin_unlock_irqrestore(&upriv->req_lock, flags); 509 goto done; 510 } 511 refcount_inc(&ctx->refcount); 512 list_add_tail(&ctx->list, &upriv->req_pending); 513 spin_unlock_irqrestore(&upriv->req_lock, flags); 514 515 ctx->state = EZUSB_CTX_QUEUED; 516 ezusb_req_queue_run(upriv); 517 518 done: 519 return; 520 } 521 522 static void ezusb_request_out_callback(struct urb *urb) 523 { 524 unsigned long flags; 525 enum ezusb_state state; 526 struct request_context *ctx = urb->context; 527 struct ezusb_priv *upriv = ctx->upriv; 528 529 spin_lock_irqsave(&upriv->req_lock, flags); 530 531 del_timer(&ctx->timer); 532 533 if (ctx->killed) { 534 spin_unlock_irqrestore(&upriv->req_lock, flags); 535 pr_warn("interrupt called with dead ctx\n"); 536 goto out; 537 } 538 539 state = ctx->state; 540 541 if (urb->status == 0) { 542 switch (state) { 543 case EZUSB_CTX_REQ_SUBMITTED: 544 if (ctx->in_rid) { 545 ctx->state = EZUSB_CTX_REQ_COMPLETE; 546 /* reply URB still pending */ 547 ezusb_mod_timer(upriv, &ctx->timer, 548 jiffies + DEF_TIMEOUT); 549 spin_unlock_irqrestore(&upriv->req_lock, 550 flags); 551 break; 552 } 553 /* fall through */ 554 case EZUSB_CTX_RESP_RECEIVED: 555 /* IN already received before this OUT-ACK */ 556 ctx->state = EZUSB_CTX_COMPLETE; 557 spin_unlock_irqrestore(&upriv->req_lock, flags); 558 ezusb_ctx_complete(ctx); 559 break; 560 561 default: 562 spin_unlock_irqrestore(&upriv->req_lock, flags); 563 err("Unexpected state(0x%x, %d) in OUT URB", 564 state, urb->status); 565 break; 566 } 567 } else { 568 /* If someone cancels the OUT URB then its status 569 * should be either -ECONNRESET or -ENOENT. 570 */ 571 switch (state) { 572 case EZUSB_CTX_REQ_SUBMITTED: 573 case EZUSB_CTX_RESP_RECEIVED: 574 ctx->state = EZUSB_CTX_REQ_FAILED; 575 /* fall through */ 576 577 case EZUSB_CTX_REQ_FAILED: 578 case EZUSB_CTX_REQ_TIMEOUT: 579 spin_unlock_irqrestore(&upriv->req_lock, flags); 580 581 ezusb_ctx_complete(ctx); 582 break; 583 584 default: 585 spin_unlock_irqrestore(&upriv->req_lock, flags); 586 587 err("Unexpected state(0x%x, %d) in OUT URB", 588 state, urb->status); 589 break; 590 } 591 } 592 out: 593 ezusb_request_context_put(ctx); 594 } 595 596 static void ezusb_request_in_callback(struct ezusb_priv *upriv, 597 struct urb *urb) 598 { 599 struct ezusb_packet *ans = urb->transfer_buffer; 600 struct request_context *ctx = NULL; 601 enum ezusb_state state; 602 unsigned long flags; 603 604 /* Find the CTX on the active queue that requested this URB */ 605 spin_lock_irqsave(&upriv->req_lock, flags); 606 if (upriv->udev) { 607 struct list_head *item; 608 609 list_for_each(item, &upriv->req_active) { 610 struct request_context *c; 611 int reply_count; 612 613 c = list_entry(item, struct request_context, list); 614 reply_count = 615 ezusb_reply_inc(c->buf->req_reply_count); 616 if ((ans->ans_reply_count == reply_count) 617 && (le16_to_cpu(ans->hermes_rid) == c->in_rid)) { 618 ctx = c; 619 break; 620 } 621 netdev_dbg(upriv->dev, "Skipped (0x%x/0x%x) (%d/%d)\n", 622 le16_to_cpu(ans->hermes_rid), c->in_rid, 623 ans->ans_reply_count, reply_count); 624 } 625 } 626 627 if (ctx == NULL) { 628 spin_unlock_irqrestore(&upriv->req_lock, flags); 629 err("%s: got unexpected RID: 0x%04X", __func__, 630 le16_to_cpu(ans->hermes_rid)); 631 ezusb_req_queue_run(upriv); 632 return; 633 } 634 635 /* The data we want is in the in buffer, exchange */ 636 urb->transfer_buffer = ctx->buf; 637 ctx->buf = (void *) ans; 638 ctx->buf_length = urb->actual_length; 639 640 state = ctx->state; 641 switch (state) { 642 case EZUSB_CTX_REQ_SUBMITTED: 643 /* We have received our response URB before 644 * our request has been acknowledged. Do NOT 645 * destroy our CTX yet, because our OUT URB 646 * is still alive ... 647 */ 648 ctx->state = EZUSB_CTX_RESP_RECEIVED; 649 spin_unlock_irqrestore(&upriv->req_lock, flags); 650 651 /* Let the machine continue running. */ 652 break; 653 654 case EZUSB_CTX_REQ_COMPLETE: 655 /* This is the usual path: our request 656 * has already been acknowledged, and 657 * we have now received the reply. 658 */ 659 ctx->state = EZUSB_CTX_COMPLETE; 660 661 /* Stop the intimer */ 662 del_timer(&ctx->timer); 663 spin_unlock_irqrestore(&upriv->req_lock, flags); 664 665 /* Call the completion handler */ 666 ezusb_ctx_complete(ctx); 667 break; 668 669 default: 670 spin_unlock_irqrestore(&upriv->req_lock, flags); 671 672 pr_warn("Matched IN URB, unexpected context state(0x%x)\n", 673 state); 674 /* Throw this CTX away and try submitting another */ 675 del_timer(&ctx->timer); 676 ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK; 677 usb_unlink_urb(ctx->outurb); 678 ezusb_req_queue_run(upriv); 679 break; 680 } /* switch */ 681 } 682 683 684 static void ezusb_req_ctx_wait(struct ezusb_priv *upriv, 685 struct request_context *ctx) 686 { 687 switch (ctx->state) { 688 case EZUSB_CTX_QUEUED: 689 case EZUSB_CTX_REQ_SUBMITTED: 690 case EZUSB_CTX_REQ_COMPLETE: 691 case EZUSB_CTX_RESP_RECEIVED: 692 if (in_softirq()) { 693 /* If we get called from a timer, timeout timers don't 694 * get the chance to run themselves. So we make sure 695 * that we don't sleep for ever */ 696 int msecs = DEF_TIMEOUT * (1000 / HZ); 697 while (!ctx->done.done && msecs--) 698 udelay(1000); 699 } else { 700 wait_event_interruptible(ctx->done.wait, 701 ctx->done.done); 702 } 703 break; 704 default: 705 /* Done or failed - nothing to wait for */ 706 break; 707 } 708 } 709 710 static inline u16 build_crc(struct ezusb_packet *data) 711 { 712 u16 crc = 0; 713 u8 *bytes = (u8 *)data; 714 int i; 715 716 for (i = 0; i < 8; i++) 717 crc = (crc << 1) + bytes[i]; 718 719 return crc; 720 } 721 722 /** 723 * ezusb_fill_req: 724 * 725 * if data == NULL and length > 0 the data is assumed to be already in 726 * the target buffer and only the header is filled. 727 * 728 */ 729 static int ezusb_fill_req(struct ezusb_packet *req, u16 length, u16 rid, 730 const void *data, u16 frame_type, u8 reply_count) 731 { 732 int total_size = sizeof(*req) + length; 733 734 BUG_ON(total_size > BULK_BUF_SIZE); 735 736 req->magic = cpu_to_le16(EZUSB_MAGIC); 737 req->req_reply_count = reply_count; 738 req->ans_reply_count = 0; 739 req->frame_type = cpu_to_le16(frame_type); 740 req->size = cpu_to_le16(length + 4); 741 req->crc = cpu_to_le16(build_crc(req)); 742 req->hermes_len = cpu_to_le16(HERMES_BYTES_TO_RECLEN(length)); 743 req->hermes_rid = cpu_to_le16(rid); 744 if (data) 745 memcpy(req->data, data, length); 746 return total_size; 747 } 748 749 static int ezusb_submit_in_urb(struct ezusb_priv *upriv) 750 { 751 int retval = 0; 752 void *cur_buf = upriv->read_urb->transfer_buffer; 753 754 if (upriv->read_urb->status == -EINPROGRESS) { 755 netdev_dbg(upriv->dev, "urb busy, not resubmiting\n"); 756 retval = -EBUSY; 757 goto exit; 758 } 759 usb_fill_bulk_urb(upriv->read_urb, upriv->udev, upriv->read_pipe, 760 cur_buf, BULK_BUF_SIZE, 761 ezusb_bulk_in_callback, upriv); 762 upriv->read_urb->transfer_flags = 0; 763 retval = usb_submit_urb(upriv->read_urb, GFP_ATOMIC); 764 if (retval) 765 err("%s submit failed %d", __func__, retval); 766 767 exit: 768 return retval; 769 } 770 771 static inline int ezusb_8051_cpucs(struct ezusb_priv *upriv, int reset) 772 { 773 int ret; 774 u8 *res_val = NULL; 775 776 if (!upriv->udev) { 777 err("%s: !upriv->udev", __func__); 778 return -EFAULT; 779 } 780 781 res_val = kmalloc(sizeof(*res_val), GFP_KERNEL); 782 783 if (!res_val) 784 return -ENOMEM; 785 786 *res_val = reset; /* avoid argument promotion */ 787 788 ret = usb_control_msg(upriv->udev, 789 usb_sndctrlpipe(upriv->udev, 0), 790 EZUSB_REQUEST_FW_TRANS, 791 USB_TYPE_VENDOR | USB_RECIP_DEVICE | 792 USB_DIR_OUT, EZUSB_CPUCS_REG, 0, res_val, 793 sizeof(*res_val), DEF_TIMEOUT); 794 795 kfree(res_val); 796 797 return ret; 798 } 799 800 static int ezusb_firmware_download(struct ezusb_priv *upriv, 801 struct ez_usb_fw *fw) 802 { 803 u8 *fw_buffer; 804 int retval, addr; 805 int variant_offset; 806 807 fw_buffer = kmalloc(FW_BUF_SIZE, GFP_KERNEL); 808 if (!fw_buffer) { 809 printk(KERN_ERR PFX "Out of memory for firmware buffer.\n"); 810 return -ENOMEM; 811 } 812 /* 813 * This byte is 1 and should be replaced with 0. The offset is 814 * 0x10AD in version 0.0.6. The byte in question should follow 815 * the end of the code pointed to by the jump in the beginning 816 * of the firmware. Also, it is read by code located at 0x358. 817 */ 818 variant_offset = be16_to_cpup((__be16 *) &fw->code[FW_VAR_OFFSET_PTR]); 819 if (variant_offset >= fw->size) { 820 printk(KERN_ERR PFX "Invalid firmware variant offset: " 821 "0x%04x\n", variant_offset); 822 retval = -EINVAL; 823 goto fail; 824 } 825 826 retval = ezusb_8051_cpucs(upriv, 1); 827 if (retval < 0) 828 goto fail; 829 for (addr = 0; addr < fw->size; addr += FW_BUF_SIZE) { 830 /* 0x100-0x300 should be left alone, it contains card 831 * specific data, like USB enumeration information */ 832 if ((addr >= FW_HOLE_START) && (addr < FW_HOLE_END)) 833 continue; 834 835 memcpy(fw_buffer, &fw->code[addr], FW_BUF_SIZE); 836 if (variant_offset >= addr && 837 variant_offset < addr + FW_BUF_SIZE) { 838 netdev_dbg(upriv->dev, 839 "Patching card_variant byte at 0x%04X\n", 840 variant_offset); 841 fw_buffer[variant_offset - addr] = FW_VAR_VALUE; 842 } 843 retval = usb_control_msg(upriv->udev, 844 usb_sndctrlpipe(upriv->udev, 0), 845 EZUSB_REQUEST_FW_TRANS, 846 USB_TYPE_VENDOR | USB_RECIP_DEVICE 847 | USB_DIR_OUT, 848 addr, 0x0, 849 fw_buffer, FW_BUF_SIZE, 850 DEF_TIMEOUT); 851 852 if (retval < 0) 853 goto fail; 854 } 855 retval = ezusb_8051_cpucs(upriv, 0); 856 if (retval < 0) 857 goto fail; 858 859 goto exit; 860 fail: 861 printk(KERN_ERR PFX "Firmware download failed, error %d\n", 862 retval); 863 exit: 864 kfree(fw_buffer); 865 return retval; 866 } 867 868 static int ezusb_access_ltv(struct ezusb_priv *upriv, 869 struct request_context *ctx, 870 u16 length, const void *data, u16 frame_type, 871 void *ans_buff, unsigned ans_size, u16 *ans_length) 872 { 873 int req_size; 874 int retval = 0; 875 enum ezusb_state state; 876 877 BUG_ON(in_irq()); 878 879 if (!upriv->udev) { 880 retval = -ENODEV; 881 goto exit; 882 } 883 884 if (upriv->read_urb->status != -EINPROGRESS) 885 err("%s: in urb not pending", __func__); 886 887 /* protect upriv->reply_count, guarantee sequential numbers */ 888 spin_lock_bh(&upriv->reply_count_lock); 889 req_size = ezusb_fill_req(ctx->buf, length, ctx->out_rid, data, 890 frame_type, upriv->reply_count); 891 usb_fill_bulk_urb(ctx->outurb, upriv->udev, upriv->write_pipe, 892 ctx->buf, req_size, 893 ezusb_request_out_callback, ctx); 894 895 if (ctx->in_rid) 896 upriv->reply_count = ezusb_reply_inc(upriv->reply_count); 897 898 ezusb_req_enqueue_run(upriv, ctx); 899 900 spin_unlock_bh(&upriv->reply_count_lock); 901 902 if (ctx->in_rid) 903 ezusb_req_ctx_wait(upriv, ctx); 904 905 state = ctx->state; 906 switch (state) { 907 case EZUSB_CTX_COMPLETE: 908 retval = ctx->outurb->status; 909 break; 910 911 case EZUSB_CTX_QUEUED: 912 case EZUSB_CTX_REQ_SUBMITTED: 913 if (!ctx->in_rid) 914 break; 915 default: 916 err("%s: Unexpected context state %d", __func__, 917 state); 918 /* fall though */ 919 case EZUSB_CTX_REQ_TIMEOUT: 920 case EZUSB_CTX_REQ_FAILED: 921 case EZUSB_CTX_RESP_TIMEOUT: 922 case EZUSB_CTX_REQSUBMIT_FAIL: 923 printk(KERN_ERR PFX "Access failed, resetting (state %d," 924 " reply_count %d)\n", state, upriv->reply_count); 925 upriv->reply_count = 0; 926 if (state == EZUSB_CTX_REQ_TIMEOUT 927 || state == EZUSB_CTX_RESP_TIMEOUT) { 928 printk(KERN_ERR PFX "ctx timed out\n"); 929 retval = -ETIMEDOUT; 930 } else { 931 printk(KERN_ERR PFX "ctx failed\n"); 932 retval = -EFAULT; 933 } 934 goto exit; 935 } 936 if (ctx->in_rid) { 937 struct ezusb_packet *ans = ctx->buf; 938 unsigned exp_len; 939 940 if (ans->hermes_len != 0) 941 exp_len = le16_to_cpu(ans->hermes_len) * 2 + 12; 942 else 943 exp_len = 14; 944 945 if (exp_len != ctx->buf_length) { 946 err("%s: length mismatch for RID 0x%04x: " 947 "expected %d, got %d", __func__, 948 ctx->in_rid, exp_len, ctx->buf_length); 949 retval = -EIO; 950 goto exit; 951 } 952 953 if (ans_buff) 954 memcpy(ans_buff, ans->data, min(exp_len, ans_size)); 955 if (ans_length) 956 *ans_length = le16_to_cpu(ans->hermes_len); 957 } 958 exit: 959 ezusb_request_context_put(ctx); 960 return retval; 961 } 962 963 static int ezusb_write_ltv(struct hermes *hw, int bap, u16 rid, 964 u16 length, const void *data) 965 { 966 struct ezusb_priv *upriv = hw->priv; 967 u16 frame_type; 968 struct request_context *ctx; 969 970 if (length == 0) 971 return -EINVAL; 972 973 length = HERMES_RECLEN_TO_BYTES(length); 974 975 /* On memory mapped devices HERMES_RID_CNFGROUPADDRESSES can be 976 * set to be empty, but the USB bridge doesn't like it */ 977 if (length == 0) 978 return 0; 979 980 ctx = ezusb_alloc_ctx(upriv, rid, EZUSB_RID_ACK); 981 if (!ctx) 982 return -ENOMEM; 983 984 if (rid == EZUSB_RID_TX) 985 frame_type = EZUSB_FRAME_DATA; 986 else 987 frame_type = EZUSB_FRAME_CONTROL; 988 989 return ezusb_access_ltv(upriv, ctx, length, data, frame_type, 990 NULL, 0, NULL); 991 } 992 993 static int ezusb_read_ltv(struct hermes *hw, int bap, u16 rid, 994 unsigned bufsize, u16 *length, void *buf) 995 { 996 struct ezusb_priv *upriv = hw->priv; 997 struct request_context *ctx; 998 999 if (bufsize % 2) 1000 return -EINVAL; 1001 1002 ctx = ezusb_alloc_ctx(upriv, rid, rid); 1003 if (!ctx) 1004 return -ENOMEM; 1005 1006 return ezusb_access_ltv(upriv, ctx, 0, NULL, EZUSB_FRAME_CONTROL, 1007 buf, bufsize, length); 1008 } 1009 1010 static int ezusb_doicmd_wait(struct hermes *hw, u16 cmd, u16 parm0, u16 parm1, 1011 u16 parm2, struct hermes_response *resp) 1012 { 1013 struct ezusb_priv *upriv = hw->priv; 1014 struct request_context *ctx; 1015 1016 __le16 data[4] = { 1017 cpu_to_le16(cmd), 1018 cpu_to_le16(parm0), 1019 cpu_to_le16(parm1), 1020 cpu_to_le16(parm2), 1021 }; 1022 netdev_dbg(upriv->dev, 1023 "0x%04X, parm0 0x%04X, parm1 0x%04X, parm2 0x%04X\n", cmd, 1024 parm0, parm1, parm2); 1025 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_DOCMD, EZUSB_RID_ACK); 1026 if (!ctx) 1027 return -ENOMEM; 1028 1029 return ezusb_access_ltv(upriv, ctx, sizeof(data), &data, 1030 EZUSB_FRAME_CONTROL, NULL, 0, NULL); 1031 } 1032 1033 static int ezusb_docmd_wait(struct hermes *hw, u16 cmd, u16 parm0, 1034 struct hermes_response *resp) 1035 { 1036 struct ezusb_priv *upriv = hw->priv; 1037 struct request_context *ctx; 1038 1039 __le16 data[4] = { 1040 cpu_to_le16(cmd), 1041 cpu_to_le16(parm0), 1042 0, 1043 0, 1044 }; 1045 netdev_dbg(upriv->dev, "0x%04X, parm0 0x%04X\n", cmd, parm0); 1046 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_DOCMD, EZUSB_RID_ACK); 1047 if (!ctx) 1048 return -ENOMEM; 1049 1050 return ezusb_access_ltv(upriv, ctx, sizeof(data), &data, 1051 EZUSB_FRAME_CONTROL, NULL, 0, NULL); 1052 } 1053 1054 static int ezusb_bap_pread(struct hermes *hw, int bap, 1055 void *buf, int len, u16 id, u16 offset) 1056 { 1057 struct ezusb_priv *upriv = hw->priv; 1058 struct ezusb_packet *ans = (void *) upriv->read_urb->transfer_buffer; 1059 int actual_length = upriv->read_urb->actual_length; 1060 1061 if (id == EZUSB_RID_RX) { 1062 if ((sizeof(*ans) + offset + len) > actual_length) { 1063 printk(KERN_ERR PFX "BAP read beyond buffer end " 1064 "in rx frame\n"); 1065 return -EINVAL; 1066 } 1067 memcpy(buf, ans->data + offset, len); 1068 return 0; 1069 } 1070 1071 if (EZUSB_IS_INFO(id)) { 1072 /* Include 4 bytes for length/type */ 1073 if ((sizeof(*ans) + offset + len - 4) > actual_length) { 1074 printk(KERN_ERR PFX "BAP read beyond buffer end " 1075 "in info frame\n"); 1076 return -EFAULT; 1077 } 1078 memcpy(buf, ans->data + offset - 4, len); 1079 } else { 1080 printk(KERN_ERR PFX "Unexpected fid 0x%04x\n", id); 1081 return -EINVAL; 1082 } 1083 1084 return 0; 1085 } 1086 1087 static int ezusb_read_pda(struct hermes *hw, __le16 *pda, 1088 u32 pda_addr, u16 pda_len) 1089 { 1090 struct ezusb_priv *upriv = hw->priv; 1091 struct request_context *ctx; 1092 __le16 data[] = { 1093 cpu_to_le16(pda_addr & 0xffff), 1094 cpu_to_le16(pda_len - 4) 1095 }; 1096 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_READ_PDA, EZUSB_RID_READ_PDA); 1097 if (!ctx) 1098 return -ENOMEM; 1099 1100 /* wl_lkm does not include PDA size in the PDA area. 1101 * We will pad the information into pda, so other routines 1102 * don't have to be modified */ 1103 pda[0] = cpu_to_le16(pda_len - 2); 1104 /* Includes CFG_PROD_DATA but not itself */ 1105 pda[1] = cpu_to_le16(0x0800); /* CFG_PROD_DATA */ 1106 1107 return ezusb_access_ltv(upriv, ctx, sizeof(data), &data, 1108 EZUSB_FRAME_CONTROL, &pda[2], pda_len - 4, 1109 NULL); 1110 } 1111 1112 static int ezusb_program_init(struct hermes *hw, u32 entry_point) 1113 { 1114 struct ezusb_priv *upriv = hw->priv; 1115 struct request_context *ctx; 1116 __le32 data = cpu_to_le32(entry_point); 1117 1118 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_INIT, EZUSB_RID_ACK); 1119 if (!ctx) 1120 return -ENOMEM; 1121 1122 return ezusb_access_ltv(upriv, ctx, sizeof(data), &data, 1123 EZUSB_FRAME_CONTROL, NULL, 0, NULL); 1124 } 1125 1126 static int ezusb_program_end(struct hermes *hw) 1127 { 1128 struct ezusb_priv *upriv = hw->priv; 1129 struct request_context *ctx; 1130 1131 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_END, EZUSB_RID_ACK); 1132 if (!ctx) 1133 return -ENOMEM; 1134 1135 return ezusb_access_ltv(upriv, ctx, 0, NULL, 1136 EZUSB_FRAME_CONTROL, NULL, 0, NULL); 1137 } 1138 1139 static int ezusb_program_bytes(struct hermes *hw, const char *buf, 1140 u32 addr, u32 len) 1141 { 1142 struct ezusb_priv *upriv = hw->priv; 1143 struct request_context *ctx; 1144 __le32 data = cpu_to_le32(addr); 1145 int err; 1146 1147 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_SET_ADDR, EZUSB_RID_ACK); 1148 if (!ctx) 1149 return -ENOMEM; 1150 1151 err = ezusb_access_ltv(upriv, ctx, sizeof(data), &data, 1152 EZUSB_FRAME_CONTROL, NULL, 0, NULL); 1153 if (err) 1154 return err; 1155 1156 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_BYTES, EZUSB_RID_ACK); 1157 if (!ctx) 1158 return -ENOMEM; 1159 1160 return ezusb_access_ltv(upriv, ctx, len, buf, 1161 EZUSB_FRAME_CONTROL, NULL, 0, NULL); 1162 } 1163 1164 static int ezusb_program(struct hermes *hw, const char *buf, 1165 u32 addr, u32 len) 1166 { 1167 u32 ch_addr; 1168 u32 ch_len; 1169 int err = 0; 1170 1171 /* We can only send 2048 bytes out of the bulk xmit at a time, 1172 * so we have to split any programming into chunks of <2048 1173 * bytes. */ 1174 1175 ch_len = (len < MAX_DL_SIZE) ? len : MAX_DL_SIZE; 1176 ch_addr = addr; 1177 1178 while (ch_addr < (addr + len)) { 1179 pr_debug("Programming subblock of length %d " 1180 "to address 0x%08x. Data @ %p\n", 1181 ch_len, ch_addr, &buf[ch_addr - addr]); 1182 1183 err = ezusb_program_bytes(hw, &buf[ch_addr - addr], 1184 ch_addr, ch_len); 1185 if (err) 1186 break; 1187 1188 ch_addr += ch_len; 1189 ch_len = ((addr + len - ch_addr) < MAX_DL_SIZE) ? 1190 (addr + len - ch_addr) : MAX_DL_SIZE; 1191 } 1192 1193 return err; 1194 } 1195 1196 static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev) 1197 { 1198 struct orinoco_private *priv = ndev_priv(dev); 1199 struct net_device_stats *stats = &dev->stats; 1200 struct ezusb_priv *upriv = priv->card; 1201 u8 mic[MICHAEL_MIC_LEN + 1]; 1202 int err = 0; 1203 int tx_control; 1204 unsigned long flags; 1205 struct request_context *ctx; 1206 u8 *buf; 1207 int tx_size; 1208 1209 if (!netif_running(dev)) { 1210 printk(KERN_ERR "%s: Tx on stopped device!\n", 1211 dev->name); 1212 return NETDEV_TX_BUSY; 1213 } 1214 1215 if (netif_queue_stopped(dev)) { 1216 printk(KERN_DEBUG "%s: Tx while transmitter busy!\n", 1217 dev->name); 1218 return NETDEV_TX_BUSY; 1219 } 1220 1221 if (orinoco_lock(priv, &flags) != 0) { 1222 printk(KERN_ERR 1223 "%s: ezusb_xmit() called while hw_unavailable\n", 1224 dev->name); 1225 return NETDEV_TX_BUSY; 1226 } 1227 1228 if (!netif_carrier_ok(dev) || 1229 (priv->iw_mode == NL80211_IFTYPE_MONITOR)) { 1230 /* Oops, the firmware hasn't established a connection, 1231 silently drop the packet (this seems to be the 1232 safest approach). */ 1233 goto drop; 1234 } 1235 1236 /* Check packet length */ 1237 if (skb->len < ETH_HLEN) 1238 goto drop; 1239 1240 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0); 1241 if (!ctx) 1242 goto busy; 1243 1244 memset(ctx->buf, 0, BULK_BUF_SIZE); 1245 buf = ctx->buf->data; 1246 1247 tx_control = 0; 1248 1249 err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control, 1250 &mic[0]); 1251 if (err) 1252 goto drop; 1253 1254 { 1255 __le16 *tx_cntl = (__le16 *)buf; 1256 *tx_cntl = cpu_to_le16(tx_control); 1257 buf += sizeof(*tx_cntl); 1258 } 1259 1260 memcpy(buf, skb->data, skb->len); 1261 buf += skb->len; 1262 1263 if (tx_control & HERMES_TXCTRL_MIC) { 1264 u8 *m = mic; 1265 /* Mic has been offset so it can be copied to an even 1266 * address. We're copying eveything anyway, so we 1267 * don't need to copy that first byte. */ 1268 if (skb->len % 2) 1269 m++; 1270 memcpy(buf, m, MICHAEL_MIC_LEN); 1271 buf += MICHAEL_MIC_LEN; 1272 } 1273 1274 /* Finally, we actually initiate the send */ 1275 netif_stop_queue(dev); 1276 1277 /* The card may behave better if we send evenly sized usb transfers */ 1278 tx_size = ALIGN(buf - ctx->buf->data, 2); 1279 1280 err = ezusb_access_ltv(upriv, ctx, tx_size, NULL, 1281 EZUSB_FRAME_DATA, NULL, 0, NULL); 1282 1283 if (err) { 1284 netif_start_queue(dev); 1285 if (net_ratelimit()) 1286 printk(KERN_ERR "%s: Error %d transmitting packet\n", 1287 dev->name, err); 1288 goto busy; 1289 } 1290 1291 netif_trans_update(dev); 1292 stats->tx_bytes += skb->len; 1293 goto ok; 1294 1295 drop: 1296 stats->tx_errors++; 1297 stats->tx_dropped++; 1298 1299 ok: 1300 orinoco_unlock(priv, &flags); 1301 dev_kfree_skb(skb); 1302 return NETDEV_TX_OK; 1303 1304 busy: 1305 orinoco_unlock(priv, &flags); 1306 return NETDEV_TX_BUSY; 1307 } 1308 1309 static int ezusb_allocate(struct hermes *hw, u16 size, u16 *fid) 1310 { 1311 *fid = EZUSB_RID_TX; 1312 return 0; 1313 } 1314 1315 1316 static int ezusb_hard_reset(struct orinoco_private *priv) 1317 { 1318 struct ezusb_priv *upriv = priv->card; 1319 int retval = ezusb_8051_cpucs(upriv, 1); 1320 1321 if (retval < 0) { 1322 err("Failed to reset"); 1323 return retval; 1324 } 1325 1326 retval = ezusb_8051_cpucs(upriv, 0); 1327 if (retval < 0) { 1328 err("Failed to unreset"); 1329 return retval; 1330 } 1331 1332 netdev_dbg(upriv->dev, "sending control message\n"); 1333 retval = usb_control_msg(upriv->udev, 1334 usb_sndctrlpipe(upriv->udev, 0), 1335 EZUSB_REQUEST_TRIGER, 1336 USB_TYPE_VENDOR | USB_RECIP_DEVICE | 1337 USB_DIR_OUT, 0x0, 0x0, NULL, 0, 1338 DEF_TIMEOUT); 1339 if (retval < 0) { 1340 err("EZUSB_REQUEST_TRIGER failed retval %d", retval); 1341 return retval; 1342 } 1343 #if 0 1344 dbg("Sending EZUSB_REQUEST_TRIG_AC"); 1345 retval = usb_control_msg(upriv->udev, 1346 usb_sndctrlpipe(upriv->udev, 0), 1347 EZUSB_REQUEST_TRIG_AC, 1348 USB_TYPE_VENDOR | USB_RECIP_DEVICE | 1349 USB_DIR_OUT, 0x00FA, 0x0, NULL, 0, 1350 DEF_TIMEOUT); 1351 if (retval < 0) { 1352 err("EZUSB_REQUEST_TRIG_AC failed retval %d", retval); 1353 return retval; 1354 } 1355 #endif 1356 1357 return 0; 1358 } 1359 1360 1361 static int ezusb_init(struct hermes *hw) 1362 { 1363 struct ezusb_priv *upriv = hw->priv; 1364 int retval; 1365 1366 BUG_ON(in_interrupt()); 1367 BUG_ON(!upriv); 1368 1369 upriv->reply_count = 0; 1370 /* Write the MAGIC number on the simulated registers to keep 1371 * orinoco.c happy */ 1372 hermes_write_regn(hw, SWSUPPORT0, HERMES_MAGIC); 1373 hermes_write_regn(hw, RXFID, EZUSB_RID_RX); 1374 1375 usb_kill_urb(upriv->read_urb); 1376 ezusb_submit_in_urb(upriv); 1377 1378 retval = ezusb_write_ltv(hw, 0, EZUSB_RID_INIT1, 1379 HERMES_BYTES_TO_RECLEN(2), "\x10\x00"); 1380 if (retval < 0) { 1381 printk(KERN_ERR PFX "EZUSB_RID_INIT1 error %d\n", retval); 1382 return retval; 1383 } 1384 1385 retval = ezusb_docmd_wait(hw, HERMES_CMD_INIT, 0, NULL); 1386 if (retval < 0) { 1387 printk(KERN_ERR PFX "HERMES_CMD_INIT error %d\n", retval); 1388 return retval; 1389 } 1390 1391 return 0; 1392 } 1393 1394 static void ezusb_bulk_in_callback(struct urb *urb) 1395 { 1396 struct ezusb_priv *upriv = (struct ezusb_priv *) urb->context; 1397 struct ezusb_packet *ans = urb->transfer_buffer; 1398 u16 crc; 1399 u16 hermes_rid; 1400 1401 if (upriv->udev == NULL) 1402 return; 1403 1404 if (urb->status == -ETIMEDOUT) { 1405 /* When a device gets unplugged we get this every time 1406 * we resubmit, flooding the logs. Since we don't use 1407 * USB timeouts, it shouldn't happen any other time*/ 1408 pr_warn("%s: urb timed out, not resubmitting\n", __func__); 1409 return; 1410 } 1411 if (urb->status == -ECONNABORTED) { 1412 pr_warn("%s: connection abort, resubmitting urb\n", 1413 __func__); 1414 goto resubmit; 1415 } 1416 if ((urb->status == -EILSEQ) 1417 || (urb->status == -ENOENT) 1418 || (urb->status == -ECONNRESET)) { 1419 netdev_dbg(upriv->dev, "status %d, not resubmiting\n", 1420 urb->status); 1421 return; 1422 } 1423 if (urb->status) 1424 netdev_dbg(upriv->dev, "status: %d length: %d\n", 1425 urb->status, urb->actual_length); 1426 if (urb->actual_length < sizeof(*ans)) { 1427 err("%s: short read, ignoring", __func__); 1428 goto resubmit; 1429 } 1430 crc = build_crc(ans); 1431 if (le16_to_cpu(ans->crc) != crc) { 1432 err("CRC error, ignoring packet"); 1433 goto resubmit; 1434 } 1435 1436 hermes_rid = le16_to_cpu(ans->hermes_rid); 1437 if ((hermes_rid != EZUSB_RID_RX) && !EZUSB_IS_INFO(hermes_rid)) { 1438 ezusb_request_in_callback(upriv, urb); 1439 } else if (upriv->dev) { 1440 struct net_device *dev = upriv->dev; 1441 struct orinoco_private *priv = ndev_priv(dev); 1442 struct hermes *hw = &priv->hw; 1443 1444 if (hermes_rid == EZUSB_RID_RX) { 1445 __orinoco_ev_rx(dev, hw); 1446 } else { 1447 hermes_write_regn(hw, INFOFID, 1448 le16_to_cpu(ans->hermes_rid)); 1449 __orinoco_ev_info(dev, hw); 1450 } 1451 } 1452 1453 resubmit: 1454 if (upriv->udev) 1455 ezusb_submit_in_urb(upriv); 1456 } 1457 1458 static inline void ezusb_delete(struct ezusb_priv *upriv) 1459 { 1460 struct net_device *dev; 1461 struct list_head *item; 1462 struct list_head *tmp_item; 1463 unsigned long flags; 1464 1465 BUG_ON(in_interrupt()); 1466 BUG_ON(!upriv); 1467 1468 dev = upriv->dev; 1469 mutex_lock(&upriv->mtx); 1470 1471 upriv->udev = NULL; /* No timer will be rearmed from here */ 1472 1473 usb_kill_urb(upriv->read_urb); 1474 1475 spin_lock_irqsave(&upriv->req_lock, flags); 1476 list_for_each_safe(item, tmp_item, &upriv->req_active) { 1477 struct request_context *ctx; 1478 int err; 1479 1480 ctx = list_entry(item, struct request_context, list); 1481 refcount_inc(&ctx->refcount); 1482 1483 ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK; 1484 err = usb_unlink_urb(ctx->outurb); 1485 1486 spin_unlock_irqrestore(&upriv->req_lock, flags); 1487 if (err == -EINPROGRESS) 1488 wait_for_completion(&ctx->done); 1489 1490 del_timer_sync(&ctx->timer); 1491 /* FIXME: there is an slight chance for the irq handler to 1492 * be running */ 1493 if (!list_empty(&ctx->list)) 1494 ezusb_ctx_complete(ctx); 1495 1496 ezusb_request_context_put(ctx); 1497 spin_lock_irqsave(&upriv->req_lock, flags); 1498 } 1499 spin_unlock_irqrestore(&upriv->req_lock, flags); 1500 1501 list_for_each_safe(item, tmp_item, &upriv->req_pending) 1502 ezusb_ctx_complete(list_entry(item, 1503 struct request_context, list)); 1504 1505 if (upriv->read_urb && upriv->read_urb->status == -EINPROGRESS) 1506 printk(KERN_ERR PFX "Some URB in progress\n"); 1507 1508 mutex_unlock(&upriv->mtx); 1509 1510 if (upriv->read_urb) { 1511 kfree(upriv->read_urb->transfer_buffer); 1512 usb_free_urb(upriv->read_urb); 1513 } 1514 kfree(upriv->bap_buf); 1515 if (upriv->dev) { 1516 struct orinoco_private *priv = ndev_priv(upriv->dev); 1517 orinoco_if_del(priv); 1518 wiphy_unregister(priv_to_wiphy(upriv)); 1519 free_orinocodev(priv); 1520 } 1521 } 1522 1523 static void ezusb_lock_irqsave(spinlock_t *lock, 1524 unsigned long *flags) __acquires(lock) 1525 { 1526 spin_lock_bh(lock); 1527 } 1528 1529 static void ezusb_unlock_irqrestore(spinlock_t *lock, 1530 unsigned long *flags) __releases(lock) 1531 { 1532 spin_unlock_bh(lock); 1533 } 1534 1535 static void ezusb_lock_irq(spinlock_t *lock) __acquires(lock) 1536 { 1537 spin_lock_bh(lock); 1538 } 1539 1540 static void ezusb_unlock_irq(spinlock_t *lock) __releases(lock) 1541 { 1542 spin_unlock_bh(lock); 1543 } 1544 1545 static const struct hermes_ops ezusb_ops = { 1546 .init = ezusb_init, 1547 .cmd_wait = ezusb_docmd_wait, 1548 .init_cmd_wait = ezusb_doicmd_wait, 1549 .allocate = ezusb_allocate, 1550 .read_ltv = ezusb_read_ltv, 1551 .write_ltv = ezusb_write_ltv, 1552 .bap_pread = ezusb_bap_pread, 1553 .read_pda = ezusb_read_pda, 1554 .program_init = ezusb_program_init, 1555 .program_end = ezusb_program_end, 1556 .program = ezusb_program, 1557 .lock_irqsave = ezusb_lock_irqsave, 1558 .unlock_irqrestore = ezusb_unlock_irqrestore, 1559 .lock_irq = ezusb_lock_irq, 1560 .unlock_irq = ezusb_unlock_irq, 1561 }; 1562 1563 static const struct net_device_ops ezusb_netdev_ops = { 1564 .ndo_open = orinoco_open, 1565 .ndo_stop = orinoco_stop, 1566 .ndo_start_xmit = ezusb_xmit, 1567 .ndo_set_rx_mode = orinoco_set_multicast_list, 1568 .ndo_change_mtu = orinoco_change_mtu, 1569 .ndo_set_mac_address = eth_mac_addr, 1570 .ndo_validate_addr = eth_validate_addr, 1571 .ndo_tx_timeout = orinoco_tx_timeout, 1572 }; 1573 1574 static int ezusb_probe(struct usb_interface *interface, 1575 const struct usb_device_id *id) 1576 { 1577 struct usb_device *udev = interface_to_usbdev(interface); 1578 struct orinoco_private *priv; 1579 struct hermes *hw; 1580 struct ezusb_priv *upriv = NULL; 1581 struct usb_interface_descriptor *iface_desc; 1582 struct usb_endpoint_descriptor *ep; 1583 const struct firmware *fw_entry = NULL; 1584 int retval = 0; 1585 int i; 1586 1587 priv = alloc_orinocodev(sizeof(*upriv), &udev->dev, 1588 ezusb_hard_reset, NULL); 1589 if (!priv) { 1590 err("Couldn't allocate orinocodev"); 1591 retval = -ENOMEM; 1592 goto exit; 1593 } 1594 1595 hw = &priv->hw; 1596 1597 upriv = priv->card; 1598 1599 mutex_init(&upriv->mtx); 1600 spin_lock_init(&upriv->reply_count_lock); 1601 1602 spin_lock_init(&upriv->req_lock); 1603 INIT_LIST_HEAD(&upriv->req_pending); 1604 INIT_LIST_HEAD(&upriv->req_active); 1605 1606 upriv->udev = udev; 1607 1608 hw->iobase = (void __force __iomem *) &upriv->hermes_reg_fake; 1609 hw->reg_spacing = HERMES_16BIT_REGSPACING; 1610 hw->priv = upriv; 1611 hw->ops = &ezusb_ops; 1612 1613 /* set up the endpoint information */ 1614 /* check out the endpoints */ 1615 1616 iface_desc = &interface->altsetting[0].desc; 1617 for (i = 0; i < iface_desc->bNumEndpoints; ++i) { 1618 ep = &interface->altsetting[0].endpoint[i].desc; 1619 1620 if (usb_endpoint_is_bulk_in(ep)) { 1621 /* we found a bulk in endpoint */ 1622 if (upriv->read_urb != NULL) { 1623 pr_warn("Found a second bulk in ep, ignored\n"); 1624 continue; 1625 } 1626 1627 upriv->read_urb = usb_alloc_urb(0, GFP_KERNEL); 1628 if (!upriv->read_urb) 1629 goto error; 1630 if (le16_to_cpu(ep->wMaxPacketSize) != 64) 1631 pr_warn("bulk in: wMaxPacketSize!= 64\n"); 1632 if (ep->bEndpointAddress != (2 | USB_DIR_IN)) 1633 pr_warn("bulk in: bEndpointAddress: %d\n", 1634 ep->bEndpointAddress); 1635 upriv->read_pipe = usb_rcvbulkpipe(udev, 1636 ep-> 1637 bEndpointAddress); 1638 upriv->read_urb->transfer_buffer = 1639 kmalloc(BULK_BUF_SIZE, GFP_KERNEL); 1640 if (!upriv->read_urb->transfer_buffer) { 1641 err("Couldn't allocate IN buffer"); 1642 goto error; 1643 } 1644 } 1645 1646 if (usb_endpoint_is_bulk_out(ep)) { 1647 /* we found a bulk out endpoint */ 1648 if (upriv->bap_buf != NULL) { 1649 pr_warn("Found a second bulk out ep, ignored\n"); 1650 continue; 1651 } 1652 1653 if (le16_to_cpu(ep->wMaxPacketSize) != 64) 1654 pr_warn("bulk out: wMaxPacketSize != 64\n"); 1655 if (ep->bEndpointAddress != 2) 1656 pr_warn("bulk out: bEndpointAddress: %d\n", 1657 ep->bEndpointAddress); 1658 upriv->write_pipe = usb_sndbulkpipe(udev, 1659 ep-> 1660 bEndpointAddress); 1661 upriv->bap_buf = kmalloc(BULK_BUF_SIZE, GFP_KERNEL); 1662 if (!upriv->bap_buf) { 1663 err("Couldn't allocate bulk_out_buffer"); 1664 goto error; 1665 } 1666 } 1667 } 1668 if (!upriv->bap_buf || !upriv->read_urb) { 1669 err("Didn't find the required bulk endpoints"); 1670 goto error; 1671 } 1672 1673 if (request_firmware(&fw_entry, "orinoco_ezusb_fw", 1674 &interface->dev) == 0) { 1675 firmware.size = fw_entry->size; 1676 firmware.code = fw_entry->data; 1677 } 1678 if (firmware.size && firmware.code) { 1679 if (ezusb_firmware_download(upriv, &firmware) < 0) 1680 goto error; 1681 } else { 1682 err("No firmware to download"); 1683 goto error; 1684 } 1685 1686 if (ezusb_hard_reset(priv) < 0) { 1687 err("Cannot reset the device"); 1688 goto error; 1689 } 1690 1691 /* If the firmware is already downloaded orinoco.c will call 1692 * ezusb_init but if the firmware is not already there, that will make 1693 * the kernel very unstable, so we try initializing here and quit in 1694 * case of error */ 1695 if (ezusb_init(hw) < 0) { 1696 err("Couldn't initialize the device"); 1697 err("Firmware may not be downloaded or may be wrong."); 1698 goto error; 1699 } 1700 1701 /* Initialise the main driver */ 1702 if (orinoco_init(priv) != 0) { 1703 err("orinoco_init() failed\n"); 1704 goto error; 1705 } 1706 1707 if (orinoco_if_add(priv, 0, 0, &ezusb_netdev_ops) != 0) { 1708 upriv->dev = NULL; 1709 err("%s: orinoco_if_add() failed", __func__); 1710 wiphy_unregister(priv_to_wiphy(priv)); 1711 goto error; 1712 } 1713 upriv->dev = priv->ndev; 1714 1715 goto exit; 1716 1717 error: 1718 ezusb_delete(upriv); 1719 if (upriv->dev) { 1720 /* upriv->dev was 0, so ezusb_delete() didn't free it */ 1721 free_orinocodev(priv); 1722 } 1723 upriv = NULL; 1724 retval = -EFAULT; 1725 exit: 1726 if (fw_entry) { 1727 firmware.code = NULL; 1728 firmware.size = 0; 1729 release_firmware(fw_entry); 1730 } 1731 usb_set_intfdata(interface, upriv); 1732 return retval; 1733 } 1734 1735 1736 static void ezusb_disconnect(struct usb_interface *intf) 1737 { 1738 struct ezusb_priv *upriv = usb_get_intfdata(intf); 1739 usb_set_intfdata(intf, NULL); 1740 ezusb_delete(upriv); 1741 printk(KERN_INFO PFX "Disconnected\n"); 1742 } 1743 1744 1745 /* usb specific object needed to register this driver with the usb subsystem */ 1746 static struct usb_driver orinoco_driver = { 1747 .name = DRIVER_NAME, 1748 .probe = ezusb_probe, 1749 .disconnect = ezusb_disconnect, 1750 .id_table = ezusb_table, 1751 .disable_hub_initiated_lpm = 1, 1752 }; 1753 1754 module_usb_driver(orinoco_driver); 1755 1756 MODULE_AUTHOR("Manuel Estrada Sainz"); 1757 MODULE_DESCRIPTION("Driver for Orinoco wireless LAN cards using EZUSB bridge"); 1758 MODULE_LICENSE("Dual MPL/GPL"); 1759