1 /*
2  * This file contains functions used in USB interface module.
3  */
4 
5 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
6 
7 #include <linux/delay.h>
8 #include <linux/module.h>
9 #include <linux/firmware.h>
10 #include <linux/netdevice.h>
11 #include <linux/slab.h>
12 #include <linux/usb.h>
13 #include <linux/olpc-ec.h>
14 
15 #ifdef CONFIG_OLPC
16 #include <asm/olpc.h>
17 #endif
18 
19 #define DRV_NAME "usb8xxx"
20 
21 #include "host.h"
22 #include "decl.h"
23 #include "defs.h"
24 #include "dev.h"
25 #include "cmd.h"
26 #include "if_usb.h"
27 
28 #define INSANEDEBUG	0
29 #define lbs_deb_usb2(...) do { if (INSANEDEBUG) lbs_deb_usbd(__VA_ARGS__); } while (0)
30 
31 #define MESSAGE_HEADER_LEN	4
32 
33 MODULE_FIRMWARE("libertas/usb8388_v9.bin");
34 MODULE_FIRMWARE("libertas/usb8388_v5.bin");
35 MODULE_FIRMWARE("libertas/usb8388.bin");
36 MODULE_FIRMWARE("libertas/usb8682.bin");
37 MODULE_FIRMWARE("usb8388.bin");
38 
39 enum {
40 	MODEL_UNKNOWN = 0x0,
41 	MODEL_8388 = 0x1,
42 	MODEL_8682 = 0x2
43 };
44 
45 /* table of firmware file names */
46 static const struct lbs_fw_table fw_table[] = {
47 	{ MODEL_8388, "libertas/usb8388_olpc.bin", NULL },
48 	{ MODEL_8388, "libertas/usb8388_v9.bin", NULL },
49 	{ MODEL_8388, "libertas/usb8388_v5.bin", NULL },
50 	{ MODEL_8388, "libertas/usb8388.bin", NULL },
51 	{ MODEL_8388, "usb8388.bin", NULL },
52 	{ MODEL_8682, "libertas/usb8682.bin", NULL }
53 };
54 
55 static struct usb_device_id if_usb_table[] = {
56 	/* Enter the device signature inside */
57 	{ USB_DEVICE(0x1286, 0x2001), .driver_info = MODEL_8388 },
58 	{ USB_DEVICE(0x05a3, 0x8388), .driver_info = MODEL_8388 },
59 	{}	/* Terminating entry */
60 };
61 
62 MODULE_DEVICE_TABLE(usb, if_usb_table);
63 
64 static void if_usb_receive(struct urb *urb);
65 static void if_usb_receive_fwload(struct urb *urb);
66 static void if_usb_prog_firmware(struct lbs_private *priv, int ret,
67 				 const struct firmware *fw,
68 				 const struct firmware *unused);
69 static int if_usb_host_to_card(struct lbs_private *priv, uint8_t type,
70 			       uint8_t *payload, uint16_t nb);
71 static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload,
72 			uint16_t nb);
73 static void if_usb_free(struct if_usb_card *cardp);
74 static int if_usb_submit_rx_urb(struct if_usb_card *cardp);
75 static int if_usb_reset_device(struct if_usb_card *cardp);
76 
77 /**
78  * if_usb_write_bulk_callback - callback function to handle the status
79  * of the URB
80  * @urb:	pointer to &urb structure
81  * returns:	N/A
82  */
83 static void if_usb_write_bulk_callback(struct urb *urb)
84 {
85 	struct if_usb_card *cardp = (struct if_usb_card *) urb->context;
86 
87 	/* handle the transmission complete validations */
88 
89 	if (urb->status == 0) {
90 		struct lbs_private *priv = cardp->priv;
91 
92 		lbs_deb_usb2(&urb->dev->dev, "URB status is successful\n");
93 		lbs_deb_usb2(&urb->dev->dev, "Actual length transmitted %d\n",
94 			     urb->actual_length);
95 
96 		/* Boot commands such as UPDATE_FW and UPDATE_BOOT2 are not
97 		 * passed up to the lbs level.
98 		 */
99 		if (priv && priv->dnld_sent != DNLD_BOOTCMD_SENT)
100 			lbs_host_to_card_done(priv);
101 	} else {
102 		/* print the failure status number for debug */
103 		pr_info("URB in failure status: %d\n", urb->status);
104 	}
105 }
106 
107 /**
108  * if_usb_free - free tx/rx urb, skb and rx buffer
109  * @cardp:	pointer to &if_usb_card
110  * returns:	N/A
111  */
112 static void if_usb_free(struct if_usb_card *cardp)
113 {
114 	/* Unlink tx & rx urb */
115 	usb_kill_urb(cardp->tx_urb);
116 	usb_kill_urb(cardp->rx_urb);
117 
118 	usb_free_urb(cardp->tx_urb);
119 	cardp->tx_urb = NULL;
120 
121 	usb_free_urb(cardp->rx_urb);
122 	cardp->rx_urb = NULL;
123 
124 	kfree(cardp->ep_out_buf);
125 	cardp->ep_out_buf = NULL;
126 }
127 
128 static void if_usb_setup_firmware(struct lbs_private *priv)
129 {
130 	struct if_usb_card *cardp = priv->card;
131 	struct cmd_ds_set_boot2_ver b2_cmd;
132 	struct cmd_ds_802_11_fw_wake_method wake_method;
133 
134 	b2_cmd.hdr.size = cpu_to_le16(sizeof(b2_cmd));
135 	b2_cmd.action = 0;
136 	b2_cmd.version = cardp->boot2_version;
137 
138 	if (lbs_cmd_with_response(priv, CMD_SET_BOOT2_VER, &b2_cmd))
139 		lbs_deb_usb("Setting boot2 version failed\n");
140 
141 	priv->wol_gpio = 2; /* Wake via GPIO2... */
142 	priv->wol_gap = 20; /* ... after 20ms    */
143 	lbs_host_sleep_cfg(priv, EHS_WAKE_ON_UNICAST_DATA,
144 			(struct wol_config *) NULL);
145 
146 	wake_method.hdr.size = cpu_to_le16(sizeof(wake_method));
147 	wake_method.action = cpu_to_le16(CMD_ACT_GET);
148 	if (lbs_cmd_with_response(priv, CMD_802_11_FW_WAKE_METHOD, &wake_method)) {
149 		netdev_info(priv->dev, "Firmware does not seem to support PS mode\n");
150 		priv->fwcapinfo &= ~FW_CAPINFO_PS;
151 	} else {
152 		if (le16_to_cpu(wake_method.method) == CMD_WAKE_METHOD_COMMAND_INT) {
153 			lbs_deb_usb("Firmware seems to support PS with wake-via-command\n");
154 		} else {
155 			/* The versions which boot up this way don't seem to
156 			   work even if we set it to the command interrupt */
157 			priv->fwcapinfo &= ~FW_CAPINFO_PS;
158 			netdev_info(priv->dev,
159 				    "Firmware doesn't wake via command interrupt; disabling PS mode\n");
160 		}
161 	}
162 }
163 
164 static void if_usb_fw_timeo(unsigned long priv)
165 {
166 	struct if_usb_card *cardp = (void *)priv;
167 
168 	if (cardp->fwdnldover) {
169 		lbs_deb_usb("Download complete, no event. Assuming success\n");
170 	} else {
171 		pr_err("Download timed out\n");
172 		cardp->surprise_removed = 1;
173 	}
174 	wake_up(&cardp->fw_wq);
175 }
176 
177 #ifdef CONFIG_OLPC
178 static void if_usb_reset_olpc_card(struct lbs_private *priv)
179 {
180 	printk(KERN_CRIT "Resetting OLPC wireless via EC...\n");
181 	olpc_ec_cmd(0x25, NULL, 0, NULL, 0);
182 }
183 #endif
184 
185 /**
186  * if_usb_probe - sets the configuration values
187  * @intf:	&usb_interface pointer
188  * @id:	pointer to usb_device_id
189  * returns:	0 on success, error code on failure
190  */
191 static int if_usb_probe(struct usb_interface *intf,
192 			const struct usb_device_id *id)
193 {
194 	struct usb_device *udev;
195 	struct usb_host_interface *iface_desc;
196 	struct usb_endpoint_descriptor *endpoint;
197 	struct lbs_private *priv;
198 	struct if_usb_card *cardp;
199 	int r = -ENOMEM;
200 	int i;
201 
202 	udev = interface_to_usbdev(intf);
203 
204 	cardp = kzalloc(sizeof(struct if_usb_card), GFP_KERNEL);
205 	if (!cardp)
206 		goto error;
207 
208 	setup_timer(&cardp->fw_timeout, if_usb_fw_timeo, (unsigned long)cardp);
209 	init_waitqueue_head(&cardp->fw_wq);
210 
211 	cardp->udev = udev;
212 	cardp->model = (uint32_t) id->driver_info;
213 	iface_desc = intf->cur_altsetting;
214 
215 	lbs_deb_usbd(&udev->dev, "bcdUSB = 0x%X bDeviceClass = 0x%X"
216 		     " bDeviceSubClass = 0x%X, bDeviceProtocol = 0x%X\n",
217 		     le16_to_cpu(udev->descriptor.bcdUSB),
218 		     udev->descriptor.bDeviceClass,
219 		     udev->descriptor.bDeviceSubClass,
220 		     udev->descriptor.bDeviceProtocol);
221 
222 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
223 		endpoint = &iface_desc->endpoint[i].desc;
224 		if (usb_endpoint_is_bulk_in(endpoint)) {
225 			cardp->ep_in_size = le16_to_cpu(endpoint->wMaxPacketSize);
226 			cardp->ep_in = usb_endpoint_num(endpoint);
227 
228 			lbs_deb_usbd(&udev->dev, "in_endpoint = %d\n", cardp->ep_in);
229 			lbs_deb_usbd(&udev->dev, "Bulk in size is %d\n", cardp->ep_in_size);
230 
231 		} else if (usb_endpoint_is_bulk_out(endpoint)) {
232 			cardp->ep_out_size = le16_to_cpu(endpoint->wMaxPacketSize);
233 			cardp->ep_out = usb_endpoint_num(endpoint);
234 
235 			lbs_deb_usbd(&udev->dev, "out_endpoint = %d\n", cardp->ep_out);
236 			lbs_deb_usbd(&udev->dev, "Bulk out size is %d\n", cardp->ep_out_size);
237 		}
238 	}
239 	if (!cardp->ep_out_size || !cardp->ep_in_size) {
240 		lbs_deb_usbd(&udev->dev, "Endpoints not found\n");
241 		goto dealloc;
242 	}
243 	if (!(cardp->rx_urb = usb_alloc_urb(0, GFP_KERNEL))) {
244 		lbs_deb_usbd(&udev->dev, "Rx URB allocation failed\n");
245 		goto dealloc;
246 	}
247 	if (!(cardp->tx_urb = usb_alloc_urb(0, GFP_KERNEL))) {
248 		lbs_deb_usbd(&udev->dev, "Tx URB allocation failed\n");
249 		goto dealloc;
250 	}
251 	cardp->ep_out_buf = kmalloc(MRVDRV_ETH_TX_PACKET_BUFFER_SIZE, GFP_KERNEL);
252 	if (!cardp->ep_out_buf) {
253 		lbs_deb_usbd(&udev->dev, "Could not allocate buffer\n");
254 		goto dealloc;
255 	}
256 
257 	if (!(priv = lbs_add_card(cardp, &intf->dev)))
258 		goto err_add_card;
259 
260 	cardp->priv = priv;
261 
262 	priv->hw_host_to_card = if_usb_host_to_card;
263 	priv->enter_deep_sleep = NULL;
264 	priv->exit_deep_sleep = NULL;
265 	priv->reset_deep_sleep_wakeup = NULL;
266 	priv->is_polling = false;
267 #ifdef CONFIG_OLPC
268 	if (machine_is_olpc())
269 		priv->reset_card = if_usb_reset_olpc_card;
270 #endif
271 
272 	cardp->boot2_version = udev->descriptor.bcdDevice;
273 
274 	usb_get_dev(udev);
275 	usb_set_intfdata(intf, cardp);
276 
277 	r = lbs_get_firmware_async(priv, &udev->dev, cardp->model,
278 				   fw_table, if_usb_prog_firmware);
279 	if (r)
280 		goto err_get_fw;
281 
282 	return 0;
283 
284 err_get_fw:
285 	lbs_remove_card(priv);
286 err_add_card:
287 	if_usb_reset_device(cardp);
288 dealloc:
289 	if_usb_free(cardp);
290 
291 error:
292 	return r;
293 }
294 
295 /**
296  * if_usb_disconnect - free resource and cleanup
297  * @intf:	USB interface structure
298  * returns:	N/A
299  */
300 static void if_usb_disconnect(struct usb_interface *intf)
301 {
302 	struct if_usb_card *cardp = usb_get_intfdata(intf);
303 	struct lbs_private *priv = cardp->priv;
304 
305 	cardp->surprise_removed = 1;
306 
307 	if (priv) {
308 		lbs_stop_card(priv);
309 		lbs_remove_card(priv);
310 	}
311 
312 	/* Unlink and free urb */
313 	if_usb_free(cardp);
314 
315 	usb_set_intfdata(intf, NULL);
316 	usb_put_dev(interface_to_usbdev(intf));
317 }
318 
319 /**
320  * if_usb_send_fw_pkt - download FW
321  * @cardp:	pointer to &struct if_usb_card
322  * returns:	0
323  */
324 static int if_usb_send_fw_pkt(struct if_usb_card *cardp)
325 {
326 	struct fwdata *fwdata = cardp->ep_out_buf;
327 	const uint8_t *firmware = cardp->fw->data;
328 
329 	/* If we got a CRC failure on the last block, back
330 	   up and retry it */
331 	if (!cardp->CRC_OK) {
332 		cardp->totalbytes = cardp->fwlastblksent;
333 		cardp->fwseqnum--;
334 	}
335 
336 	lbs_deb_usb2(&cardp->udev->dev, "totalbytes = %d\n",
337 		     cardp->totalbytes);
338 
339 	/* struct fwdata (which we sent to the card) has an
340 	   extra __le32 field in between the header and the data,
341 	   which is not in the struct fwheader in the actual
342 	   firmware binary. Insert the seqnum in the middle... */
343 	memcpy(&fwdata->hdr, &firmware[cardp->totalbytes],
344 	       sizeof(struct fwheader));
345 
346 	cardp->fwlastblksent = cardp->totalbytes;
347 	cardp->totalbytes += sizeof(struct fwheader);
348 
349 	memcpy(fwdata->data, &firmware[cardp->totalbytes],
350 	       le32_to_cpu(fwdata->hdr.datalength));
351 
352 	lbs_deb_usb2(&cardp->udev->dev, "Data length = %d\n",
353 		     le32_to_cpu(fwdata->hdr.datalength));
354 
355 	fwdata->seqnum = cpu_to_le32(++cardp->fwseqnum);
356 	cardp->totalbytes += le32_to_cpu(fwdata->hdr.datalength);
357 
358 	usb_tx_block(cardp, cardp->ep_out_buf, sizeof(struct fwdata) +
359 		     le32_to_cpu(fwdata->hdr.datalength));
360 
361 	if (fwdata->hdr.dnldcmd == cpu_to_le32(FW_HAS_DATA_TO_RECV)) {
362 		lbs_deb_usb2(&cardp->udev->dev, "There are data to follow\n");
363 		lbs_deb_usb2(&cardp->udev->dev, "seqnum = %d totalbytes = %d\n",
364 			     cardp->fwseqnum, cardp->totalbytes);
365 	} else if (fwdata->hdr.dnldcmd == cpu_to_le32(FW_HAS_LAST_BLOCK)) {
366 		lbs_deb_usb2(&cardp->udev->dev, "Host has finished FW downloading\n");
367 		lbs_deb_usb2(&cardp->udev->dev, "Donwloading FW JUMP BLOCK\n");
368 
369 		cardp->fwfinalblk = 1;
370 	}
371 
372 	lbs_deb_usb2(&cardp->udev->dev, "Firmware download done; size %d\n",
373 		     cardp->totalbytes);
374 
375 	return 0;
376 }
377 
378 static int if_usb_reset_device(struct if_usb_card *cardp)
379 {
380 	struct cmd_header *cmd = cardp->ep_out_buf + 4;
381 	int ret;
382 
383 	*(__le32 *)cardp->ep_out_buf = cpu_to_le32(CMD_TYPE_REQUEST);
384 
385 	cmd->command = cpu_to_le16(CMD_802_11_RESET);
386 	cmd->size = cpu_to_le16(sizeof(cmd));
387 	cmd->result = cpu_to_le16(0);
388 	cmd->seqnum = cpu_to_le16(0x5a5a);
389 	usb_tx_block(cardp, cardp->ep_out_buf, 4 + sizeof(struct cmd_header));
390 
391 	msleep(100);
392 	ret = usb_reset_device(cardp->udev);
393 	msleep(100);
394 
395 #ifdef CONFIG_OLPC
396 	if (ret && machine_is_olpc())
397 		if_usb_reset_olpc_card(NULL);
398 #endif
399 
400 	return ret;
401 }
402 
403 /**
404  *  usb_tx_block - transfer the data to the device
405  *  @cardp: 	pointer to &struct if_usb_card
406  *  @payload:	pointer to payload data
407  *  @nb:	data length
408  *  returns:	0 for success or negative error code
409  */
410 static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb)
411 {
412 	int ret;
413 
414 	/* check if device is removed */
415 	if (cardp->surprise_removed) {
416 		lbs_deb_usbd(&cardp->udev->dev, "Device removed\n");
417 		ret = -ENODEV;
418 		goto tx_ret;
419 	}
420 
421 	usb_fill_bulk_urb(cardp->tx_urb, cardp->udev,
422 			  usb_sndbulkpipe(cardp->udev,
423 					  cardp->ep_out),
424 			  payload, nb, if_usb_write_bulk_callback, cardp);
425 
426 	cardp->tx_urb->transfer_flags |= URB_ZERO_PACKET;
427 
428 	if ((ret = usb_submit_urb(cardp->tx_urb, GFP_ATOMIC))) {
429 		lbs_deb_usbd(&cardp->udev->dev, "usb_submit_urb failed: %d\n", ret);
430 	} else {
431 		lbs_deb_usb2(&cardp->udev->dev, "usb_submit_urb success\n");
432 		ret = 0;
433 	}
434 
435 tx_ret:
436 	return ret;
437 }
438 
439 static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
440 				  void (*callbackfn)(struct urb *urb))
441 {
442 	struct sk_buff *skb;
443 	int ret = -1;
444 
445 	if (!(skb = dev_alloc_skb(MRVDRV_ETH_RX_PACKET_BUFFER_SIZE))) {
446 		pr_err("No free skb\n");
447 		goto rx_ret;
448 	}
449 
450 	cardp->rx_skb = skb;
451 
452 	/* Fill the receive configuration URB and initialise the Rx call back */
453 	usb_fill_bulk_urb(cardp->rx_urb, cardp->udev,
454 			  usb_rcvbulkpipe(cardp->udev, cardp->ep_in),
455 			  skb->data + IPFIELD_ALIGN_OFFSET,
456 			  MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn,
457 			  cardp);
458 
459 	cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET;
460 
461 	lbs_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n", cardp->rx_urb);
462 	if ((ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC))) {
463 		lbs_deb_usbd(&cardp->udev->dev, "Submit Rx URB failed: %d\n", ret);
464 		kfree_skb(skb);
465 		cardp->rx_skb = NULL;
466 		ret = -1;
467 	} else {
468 		lbs_deb_usb2(&cardp->udev->dev, "Submit Rx URB success\n");
469 		ret = 0;
470 	}
471 
472 rx_ret:
473 	return ret;
474 }
475 
476 static int if_usb_submit_rx_urb_fwload(struct if_usb_card *cardp)
477 {
478 	return __if_usb_submit_rx_urb(cardp, &if_usb_receive_fwload);
479 }
480 
481 static int if_usb_submit_rx_urb(struct if_usb_card *cardp)
482 {
483 	return __if_usb_submit_rx_urb(cardp, &if_usb_receive);
484 }
485 
486 static void if_usb_receive_fwload(struct urb *urb)
487 {
488 	struct if_usb_card *cardp = urb->context;
489 	struct sk_buff *skb = cardp->rx_skb;
490 	struct fwsyncheader *syncfwheader;
491 	struct bootcmdresp bootcmdresp;
492 
493 	if (urb->status) {
494 		lbs_deb_usbd(&cardp->udev->dev,
495 			     "URB status is failed during fw load\n");
496 		kfree_skb(skb);
497 		return;
498 	}
499 
500 	if (cardp->fwdnldover) {
501 		__le32 *tmp = (__le32 *)(skb->data + IPFIELD_ALIGN_OFFSET);
502 
503 		if (tmp[0] == cpu_to_le32(CMD_TYPE_INDICATION) &&
504 		    tmp[1] == cpu_to_le32(MACREG_INT_CODE_FIRMWARE_READY)) {
505 			pr_info("Firmware ready event received\n");
506 			wake_up(&cardp->fw_wq);
507 		} else {
508 			lbs_deb_usb("Waiting for confirmation; got %x %x\n",
509 				    le32_to_cpu(tmp[0]), le32_to_cpu(tmp[1]));
510 			if_usb_submit_rx_urb_fwload(cardp);
511 		}
512 		kfree_skb(skb);
513 		return;
514 	}
515 	if (cardp->bootcmdresp <= 0) {
516 		memcpy (&bootcmdresp, skb->data + IPFIELD_ALIGN_OFFSET,
517 			sizeof(bootcmdresp));
518 
519 		if (le16_to_cpu(cardp->udev->descriptor.bcdDevice) < 0x3106) {
520 			kfree_skb(skb);
521 			if_usb_submit_rx_urb_fwload(cardp);
522 			cardp->bootcmdresp = BOOT_CMD_RESP_OK;
523 			lbs_deb_usbd(&cardp->udev->dev,
524 				     "Received valid boot command response\n");
525 			return;
526 		}
527 		if (bootcmdresp.magic != cpu_to_le32(BOOT_CMD_MAGIC_NUMBER)) {
528 			if (bootcmdresp.magic == cpu_to_le32(CMD_TYPE_REQUEST) ||
529 			    bootcmdresp.magic == cpu_to_le32(CMD_TYPE_DATA) ||
530 			    bootcmdresp.magic == cpu_to_le32(CMD_TYPE_INDICATION)) {
531 				if (!cardp->bootcmdresp)
532 					pr_info("Firmware already seems alive; resetting\n");
533 				cardp->bootcmdresp = -1;
534 			} else {
535 				pr_info("boot cmd response wrong magic number (0x%x)\n",
536 					    le32_to_cpu(bootcmdresp.magic));
537 			}
538 		} else if ((bootcmdresp.cmd != BOOT_CMD_FW_BY_USB) &&
539 			   (bootcmdresp.cmd != BOOT_CMD_UPDATE_FW) &&
540 			   (bootcmdresp.cmd != BOOT_CMD_UPDATE_BOOT2)) {
541 			pr_info("boot cmd response cmd_tag error (%d)\n",
542 				bootcmdresp.cmd);
543 		} else if (bootcmdresp.result != BOOT_CMD_RESP_OK) {
544 			pr_info("boot cmd response result error (%d)\n",
545 				bootcmdresp.result);
546 		} else {
547 			cardp->bootcmdresp = 1;
548 			lbs_deb_usbd(&cardp->udev->dev,
549 				     "Received valid boot command response\n");
550 		}
551 		kfree_skb(skb);
552 		if_usb_submit_rx_urb_fwload(cardp);
553 		return;
554 	}
555 
556 	syncfwheader = kmemdup(skb->data + IPFIELD_ALIGN_OFFSET,
557 			       sizeof(struct fwsyncheader), GFP_ATOMIC);
558 	if (!syncfwheader) {
559 		lbs_deb_usbd(&cardp->udev->dev, "Failure to allocate syncfwheader\n");
560 		kfree_skb(skb);
561 		return;
562 	}
563 
564 	if (!syncfwheader->cmd) {
565 		lbs_deb_usb2(&cardp->udev->dev, "FW received Blk with correct CRC\n");
566 		lbs_deb_usb2(&cardp->udev->dev, "FW received Blk seqnum = %d\n",
567 			     le32_to_cpu(syncfwheader->seqnum));
568 		cardp->CRC_OK = 1;
569 	} else {
570 		lbs_deb_usbd(&cardp->udev->dev, "FW received Blk with CRC error\n");
571 		cardp->CRC_OK = 0;
572 	}
573 
574 	kfree_skb(skb);
575 
576 	/* Give device 5s to either write firmware to its RAM or eeprom */
577 	mod_timer(&cardp->fw_timeout, jiffies + (HZ*5));
578 
579 	if (cardp->fwfinalblk) {
580 		cardp->fwdnldover = 1;
581 		goto exit;
582 	}
583 
584 	if_usb_send_fw_pkt(cardp);
585 
586  exit:
587 	if_usb_submit_rx_urb_fwload(cardp);
588 
589 	kfree(syncfwheader);
590 }
591 
592 #define MRVDRV_MIN_PKT_LEN	30
593 
594 static inline void process_cmdtypedata(int recvlength, struct sk_buff *skb,
595 				       struct if_usb_card *cardp,
596 				       struct lbs_private *priv)
597 {
598 	if (recvlength > MRVDRV_ETH_RX_PACKET_BUFFER_SIZE + MESSAGE_HEADER_LEN
599 	    || recvlength < MRVDRV_MIN_PKT_LEN) {
600 		lbs_deb_usbd(&cardp->udev->dev, "Packet length is Invalid\n");
601 		kfree_skb(skb);
602 		return;
603 	}
604 
605 	skb_reserve(skb, IPFIELD_ALIGN_OFFSET);
606 	skb_put(skb, recvlength);
607 	skb_pull(skb, MESSAGE_HEADER_LEN);
608 
609 	lbs_process_rxed_packet(priv, skb);
610 }
611 
612 static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,
613 				      struct sk_buff *skb,
614 				      struct if_usb_card *cardp,
615 				      struct lbs_private *priv)
616 {
617 	u8 i;
618 
619 	if (recvlength > LBS_CMD_BUFFER_SIZE) {
620 		lbs_deb_usbd(&cardp->udev->dev,
621 			     "The receive buffer is too large\n");
622 		kfree_skb(skb);
623 		return;
624 	}
625 
626 	BUG_ON(!in_interrupt());
627 
628 	spin_lock(&priv->driver_lock);
629 
630 	i = (priv->resp_idx == 0) ? 1 : 0;
631 	BUG_ON(priv->resp_len[i]);
632 	priv->resp_len[i] = (recvlength - MESSAGE_HEADER_LEN);
633 	memcpy(priv->resp_buf[i], recvbuff + MESSAGE_HEADER_LEN,
634 		priv->resp_len[i]);
635 	kfree_skb(skb);
636 	lbs_notify_command_response(priv, i);
637 
638 	spin_unlock(&priv->driver_lock);
639 
640 	lbs_deb_usbd(&cardp->udev->dev,
641 		    "Wake up main thread to handle cmd response\n");
642 }
643 
644 /**
645  *  if_usb_receive - read the packet into the upload buffer,
646  *  wake up the main thread and initialise the Rx callack
647  *
648  *  @urb:	pointer to &struct urb
649  *  returns:	N/A
650  */
651 static void if_usb_receive(struct urb *urb)
652 {
653 	struct if_usb_card *cardp = urb->context;
654 	struct sk_buff *skb = cardp->rx_skb;
655 	struct lbs_private *priv = cardp->priv;
656 	int recvlength = urb->actual_length;
657 	uint8_t *recvbuff = NULL;
658 	uint32_t recvtype = 0;
659 	__le32 *pkt = (__le32 *)(skb->data + IPFIELD_ALIGN_OFFSET);
660 	uint32_t event;
661 
662 	if (recvlength) {
663 		if (urb->status) {
664 			lbs_deb_usbd(&cardp->udev->dev, "RX URB failed: %d\n",
665 				     urb->status);
666 			kfree_skb(skb);
667 			goto setup_for_next;
668 		}
669 
670 		recvbuff = skb->data + IPFIELD_ALIGN_OFFSET;
671 		recvtype = le32_to_cpu(pkt[0]);
672 		lbs_deb_usbd(&cardp->udev->dev,
673 			    "Recv length = 0x%x, Recv type = 0x%X\n",
674 			    recvlength, recvtype);
675 	} else if (urb->status) {
676 		kfree_skb(skb);
677 		return;
678 	}
679 
680 	switch (recvtype) {
681 	case CMD_TYPE_DATA:
682 		process_cmdtypedata(recvlength, skb, cardp, priv);
683 		break;
684 
685 	case CMD_TYPE_REQUEST:
686 		process_cmdrequest(recvlength, recvbuff, skb, cardp, priv);
687 		break;
688 
689 	case CMD_TYPE_INDICATION:
690 		/* Event handling */
691 		event = le32_to_cpu(pkt[1]);
692 		lbs_deb_usbd(&cardp->udev->dev, "**EVENT** 0x%X\n", event);
693 		kfree_skb(skb);
694 
695 		/* Icky undocumented magic special case */
696 		if (event & 0xffff0000) {
697 			u32 trycount = (event & 0xffff0000) >> 16;
698 
699 			lbs_send_tx_feedback(priv, trycount);
700 		} else
701 			lbs_queue_event(priv, event & 0xFF);
702 		break;
703 
704 	default:
705 		lbs_deb_usbd(&cardp->udev->dev, "Unknown command type 0x%X\n",
706 			     recvtype);
707 		kfree_skb(skb);
708 		break;
709 	}
710 
711 setup_for_next:
712 	if_usb_submit_rx_urb(cardp);
713 }
714 
715 /**
716  *  if_usb_host_to_card - downloads data to FW
717  *  @priv:	pointer to &struct lbs_private structure
718  *  @type:	type of data
719  *  @payload:	pointer to data buffer
720  *  @nb:	number of bytes
721  *  returns:	0 for success or negative error code
722  */
723 static int if_usb_host_to_card(struct lbs_private *priv, uint8_t type,
724 			       uint8_t *payload, uint16_t nb)
725 {
726 	struct if_usb_card *cardp = priv->card;
727 
728 	lbs_deb_usbd(&cardp->udev->dev,"*** type = %u\n", type);
729 	lbs_deb_usbd(&cardp->udev->dev,"size after = %d\n", nb);
730 
731 	if (type == MVMS_CMD) {
732 		*(__le32 *)cardp->ep_out_buf = cpu_to_le32(CMD_TYPE_REQUEST);
733 		priv->dnld_sent = DNLD_CMD_SENT;
734 	} else {
735 		*(__le32 *)cardp->ep_out_buf = cpu_to_le32(CMD_TYPE_DATA);
736 		priv->dnld_sent = DNLD_DATA_SENT;
737 	}
738 
739 	memcpy((cardp->ep_out_buf + MESSAGE_HEADER_LEN), payload, nb);
740 
741 	return usb_tx_block(cardp, cardp->ep_out_buf, nb + MESSAGE_HEADER_LEN);
742 }
743 
744 /**
745  *  if_usb_issue_boot_command - issues Boot command to the Boot2 code
746  *  @cardp:	pointer to &if_usb_card
747  *  @ivalue:	1:Boot from FW by USB-Download
748  *		2:Boot from FW in EEPROM
749  *  returns:	0 for success or negative error code
750  */
751 static int if_usb_issue_boot_command(struct if_usb_card *cardp, int ivalue)
752 {
753 	struct bootcmd *bootcmd = cardp->ep_out_buf;
754 
755 	/* Prepare command */
756 	bootcmd->magic = cpu_to_le32(BOOT_CMD_MAGIC_NUMBER);
757 	bootcmd->cmd = ivalue;
758 	memset(bootcmd->pad, 0, sizeof(bootcmd->pad));
759 
760 	/* Issue command */
761 	usb_tx_block(cardp, cardp->ep_out_buf, sizeof(*bootcmd));
762 
763 	return 0;
764 }
765 
766 
767 /**
768  *  check_fwfile_format - check the validity of Boot2/FW image
769  *
770  *  @data:	pointer to image
771  *  @totlen:	image length
772  *  returns:     0 (good) or 1 (failure)
773  */
774 static int check_fwfile_format(const uint8_t *data, uint32_t totlen)
775 {
776 	uint32_t bincmd, exit;
777 	uint32_t blksize, offset, len;
778 	int ret;
779 
780 	ret = 1;
781 	exit = len = 0;
782 
783 	do {
784 		struct fwheader *fwh = (void *)data;
785 
786 		bincmd = le32_to_cpu(fwh->dnldcmd);
787 		blksize = le32_to_cpu(fwh->datalength);
788 		switch (bincmd) {
789 		case FW_HAS_DATA_TO_RECV:
790 			offset = sizeof(struct fwheader) + blksize;
791 			data += offset;
792 			len += offset;
793 			if (len >= totlen)
794 				exit = 1;
795 			break;
796 		case FW_HAS_LAST_BLOCK:
797 			exit = 1;
798 			ret = 0;
799 			break;
800 		default:
801 			exit = 1;
802 			break;
803 		}
804 	} while (!exit);
805 
806 	if (ret)
807 		pr_err("firmware file format check FAIL\n");
808 	else
809 		lbs_deb_fw("firmware file format check PASS\n");
810 
811 	return ret;
812 }
813 
814 static void if_usb_prog_firmware(struct lbs_private *priv, int ret,
815 				 const struct firmware *fw,
816 				 const struct firmware *unused)
817 {
818 	struct if_usb_card *cardp = priv->card;
819 	int i = 0;
820 	static int reset_count = 10;
821 
822 	if (ret) {
823 		pr_err("failed to find firmware (%d)\n", ret);
824 		goto done;
825 	}
826 
827 	cardp->fw = fw;
828 	if (check_fwfile_format(cardp->fw->data, cardp->fw->size)) {
829 		ret = -EINVAL;
830 		goto done;
831 	}
832 
833 	/* Cancel any pending usb business */
834 	usb_kill_urb(cardp->rx_urb);
835 	usb_kill_urb(cardp->tx_urb);
836 
837 	cardp->fwlastblksent = 0;
838 	cardp->fwdnldover = 0;
839 	cardp->totalbytes = 0;
840 	cardp->fwfinalblk = 0;
841 	cardp->bootcmdresp = 0;
842 
843 restart:
844 	if (if_usb_submit_rx_urb_fwload(cardp) < 0) {
845 		lbs_deb_usbd(&cardp->udev->dev, "URB submission is failed\n");
846 		ret = -EIO;
847 		goto done;
848 	}
849 
850 	cardp->bootcmdresp = 0;
851 	do {
852 		int j = 0;
853 		i++;
854 		if_usb_issue_boot_command(cardp, BOOT_CMD_FW_BY_USB);
855 		/* wait for command response */
856 		do {
857 			j++;
858 			msleep_interruptible(100);
859 		} while (cardp->bootcmdresp == 0 && j < 10);
860 	} while (cardp->bootcmdresp == 0 && i < 5);
861 
862 	if (cardp->bootcmdresp == BOOT_CMD_RESP_NOT_SUPPORTED) {
863 		/* Return to normal operation */
864 		ret = -EOPNOTSUPP;
865 		usb_kill_urb(cardp->rx_urb);
866 		usb_kill_urb(cardp->tx_urb);
867 		if (if_usb_submit_rx_urb(cardp) < 0)
868 			ret = -EIO;
869 		goto done;
870 	} else if (cardp->bootcmdresp <= 0) {
871 		if (--reset_count >= 0) {
872 			if_usb_reset_device(cardp);
873 			goto restart;
874 		}
875 		ret = -EIO;
876 		goto done;
877 	}
878 
879 	i = 0;
880 
881 	cardp->totalbytes = 0;
882 	cardp->fwlastblksent = 0;
883 	cardp->CRC_OK = 1;
884 	cardp->fwdnldover = 0;
885 	cardp->fwseqnum = -1;
886 	cardp->totalbytes = 0;
887 	cardp->fwfinalblk = 0;
888 
889 	/* Send the first firmware packet... */
890 	if_usb_send_fw_pkt(cardp);
891 
892 	/* ... and wait for the process to complete */
893 	wait_event_interruptible(cardp->fw_wq, cardp->surprise_removed || cardp->fwdnldover);
894 
895 	del_timer_sync(&cardp->fw_timeout);
896 	usb_kill_urb(cardp->rx_urb);
897 
898 	if (!cardp->fwdnldover) {
899 		pr_info("failed to load fw, resetting device!\n");
900 		if (--reset_count >= 0) {
901 			if_usb_reset_device(cardp);
902 			goto restart;
903 		}
904 
905 		pr_info("FW download failure, time = %d ms\n", i * 100);
906 		ret = -EIO;
907 		goto done;
908 	}
909 
910 	cardp->priv->fw_ready = 1;
911 	if_usb_submit_rx_urb(cardp);
912 
913 	if (lbs_start_card(priv))
914 		goto done;
915 
916 	if_usb_setup_firmware(priv);
917 
918 	/*
919 	 * EHS_REMOVE_WAKEUP is not supported on all versions of the firmware.
920 	 */
921 	priv->wol_criteria = EHS_REMOVE_WAKEUP;
922 	if (lbs_host_sleep_cfg(priv, priv->wol_criteria, NULL))
923 		priv->ehs_remove_supported = false;
924 
925  done:
926 	cardp->fw = NULL;
927 }
928 
929 
930 #ifdef CONFIG_PM
931 static int if_usb_suspend(struct usb_interface *intf, pm_message_t message)
932 {
933 	struct if_usb_card *cardp = usb_get_intfdata(intf);
934 	struct lbs_private *priv = cardp->priv;
935 	int ret;
936 
937 	if (priv->psstate != PS_STATE_FULL_POWER) {
938 		ret = -1;
939 		goto out;
940 	}
941 
942 #ifdef CONFIG_OLPC
943 	if (machine_is_olpc()) {
944 		if (priv->wol_criteria == EHS_REMOVE_WAKEUP)
945 			olpc_ec_wakeup_clear(EC_SCI_SRC_WLAN);
946 		else
947 			olpc_ec_wakeup_set(EC_SCI_SRC_WLAN);
948 	}
949 #endif
950 
951 	ret = lbs_suspend(priv);
952 	if (ret)
953 		goto out;
954 
955 	/* Unlink tx & rx urb */
956 	usb_kill_urb(cardp->tx_urb);
957 	usb_kill_urb(cardp->rx_urb);
958 
959  out:
960 	return ret;
961 }
962 
963 static int if_usb_resume(struct usb_interface *intf)
964 {
965 	struct if_usb_card *cardp = usb_get_intfdata(intf);
966 	struct lbs_private *priv = cardp->priv;
967 
968 	if_usb_submit_rx_urb(cardp);
969 
970 	lbs_resume(priv);
971 
972 	return 0;
973 }
974 #else
975 #define if_usb_suspend NULL
976 #define if_usb_resume NULL
977 #endif
978 
979 static struct usb_driver if_usb_driver = {
980 	.name = DRV_NAME,
981 	.probe = if_usb_probe,
982 	.disconnect = if_usb_disconnect,
983 	.id_table = if_usb_table,
984 	.suspend = if_usb_suspend,
985 	.resume = if_usb_resume,
986 	.reset_resume = if_usb_resume,
987 	.disable_hub_initiated_lpm = 1,
988 };
989 
990 module_usb_driver(if_usb_driver);
991 
992 MODULE_DESCRIPTION("8388 USB WLAN Driver");
993 MODULE_AUTHOR("Marvell International Ltd. and Red Hat, Inc.");
994 MODULE_LICENSE("GPL");
995