1 /*
2  *  Copyright (C) 2008, cozybit Inc.
3  *  Copyright (C) 2003-2006, Marvell International Ltd.
4  *
5  *  This program is free software; you can redistribute it and/or modify
6  *  it under the terms of the GNU General Public License as published by
7  *  the Free Software Foundation; either version 2 of the License, or (at
8  *  your option) any later version.
9  */
10 #define DRV_NAME "lbtf_usb"
11 
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 
14 #include "libertas_tf.h"
15 #include "if_usb.h"
16 
17 #include <linux/delay.h>
18 #include <linux/module.h>
19 #include <linux/firmware.h>
20 #include <linux/netdevice.h>
21 #include <linux/slab.h>
22 #include <linux/usb.h>
23 
24 #define INSANEDEBUG	0
25 #define lbtf_deb_usb2(...) do { if (INSANEDEBUG) lbtf_deb_usbd(__VA_ARGS__); } while (0)
26 
27 #define MESSAGE_HEADER_LEN	4
28 
29 static char *lbtf_fw_name = "lbtf_usb.bin";
30 module_param_named(fw_name, lbtf_fw_name, charp, 0644);
31 
32 MODULE_FIRMWARE("lbtf_usb.bin");
33 
34 static const struct usb_device_id if_usb_table[] = {
35 	/* Enter the device signature inside */
36 	{ USB_DEVICE(0x1286, 0x2001) },
37 	{ USB_DEVICE(0x05a3, 0x8388) },
38 	{}	/* Terminating entry */
39 };
40 
41 MODULE_DEVICE_TABLE(usb, if_usb_table);
42 
43 static void if_usb_receive(struct urb *urb);
44 static void if_usb_receive_fwload(struct urb *urb);
45 static int if_usb_prog_firmware(struct if_usb_card *cardp);
46 static int if_usb_host_to_card(struct lbtf_private *priv, uint8_t type,
47 			       uint8_t *payload, uint16_t nb);
48 static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload,
49 			uint16_t nb, u8 data);
50 static void if_usb_free(struct if_usb_card *cardp);
51 static int if_usb_submit_rx_urb(struct if_usb_card *cardp);
52 static int if_usb_reset_device(struct if_usb_card *cardp);
53 
54 /**
55  *  if_usb_wrike_bulk_callback -  call back to handle URB status
56  *
57  *  @param urb		pointer to urb structure
58  */
59 static void if_usb_write_bulk_callback(struct urb *urb)
60 {
61 	if (urb->status != 0) {
62 		/* print the failure status number for debug */
63 		pr_info("URB in failure status: %d\n", urb->status);
64 	} else {
65 		lbtf_deb_usb2(&urb->dev->dev, "URB status is successful\n");
66 		lbtf_deb_usb2(&urb->dev->dev, "Actual length transmitted %d\n",
67 			     urb->actual_length);
68 	}
69 }
70 
71 /**
72  *  if_usb_free - free tx/rx urb, skb and rx buffer
73  *
74  *  @param cardp	pointer if_usb_card
75  */
76 static void if_usb_free(struct if_usb_card *cardp)
77 {
78 	lbtf_deb_enter(LBTF_DEB_USB);
79 
80 	/* Unlink tx & rx urb */
81 	usb_kill_urb(cardp->tx_urb);
82 	usb_kill_urb(cardp->rx_urb);
83 	usb_kill_urb(cardp->cmd_urb);
84 
85 	usb_free_urb(cardp->tx_urb);
86 	cardp->tx_urb = NULL;
87 
88 	usb_free_urb(cardp->rx_urb);
89 	cardp->rx_urb = NULL;
90 
91 	usb_free_urb(cardp->cmd_urb);
92 	cardp->cmd_urb = NULL;
93 
94 	kfree(cardp->ep_out_buf);
95 	cardp->ep_out_buf = NULL;
96 
97 	lbtf_deb_leave(LBTF_DEB_USB);
98 }
99 
100 static void if_usb_setup_firmware(struct lbtf_private *priv)
101 {
102 	struct if_usb_card *cardp = priv->card;
103 	struct cmd_ds_set_boot2_ver b2_cmd;
104 
105 	lbtf_deb_enter(LBTF_DEB_USB);
106 
107 	if_usb_submit_rx_urb(cardp);
108 	b2_cmd.hdr.size = cpu_to_le16(sizeof(b2_cmd));
109 	b2_cmd.action = 0;
110 	b2_cmd.version = cardp->boot2_version;
111 
112 	if (lbtf_cmd_with_response(priv, CMD_SET_BOOT2_VER, &b2_cmd))
113 		lbtf_deb_usb("Setting boot2 version failed\n");
114 
115 	lbtf_deb_leave(LBTF_DEB_USB);
116 }
117 
118 static void if_usb_fw_timeo(struct timer_list *t)
119 {
120 	struct if_usb_card *cardp = from_timer(cardp, t, fw_timeout);
121 
122 	lbtf_deb_enter(LBTF_DEB_USB);
123 	if (!cardp->fwdnldover) {
124 		/* Download timed out */
125 		cardp->priv->surpriseremoved = 1;
126 		pr_err("Download timed out\n");
127 	} else {
128 		lbtf_deb_usb("Download complete, no event. Assuming success\n");
129 	}
130 	wake_up(&cardp->fw_wq);
131 	lbtf_deb_leave(LBTF_DEB_USB);
132 }
133 
134 /**
135  *  if_usb_probe - sets the configuration values
136  *
137  *  @ifnum	interface number
138  *  @id		pointer to usb_device_id
139  *
140  *  Returns: 0 on success, error code on failure
141  */
142 static int if_usb_probe(struct usb_interface *intf,
143 			const struct usb_device_id *id)
144 {
145 	struct usb_device *udev;
146 	struct usb_host_interface *iface_desc;
147 	struct usb_endpoint_descriptor *endpoint;
148 	struct lbtf_private *priv;
149 	struct if_usb_card *cardp;
150 	int i;
151 
152 	lbtf_deb_enter(LBTF_DEB_USB);
153 	udev = interface_to_usbdev(intf);
154 
155 	cardp = kzalloc(sizeof(struct if_usb_card), GFP_KERNEL);
156 	if (!cardp)
157 		goto error;
158 
159 	timer_setup(&cardp->fw_timeout, if_usb_fw_timeo, 0);
160 	init_waitqueue_head(&cardp->fw_wq);
161 
162 	cardp->udev = udev;
163 	iface_desc = intf->cur_altsetting;
164 
165 	lbtf_deb_usbd(&udev->dev, "bcdUSB = 0x%X bDeviceClass = 0x%X"
166 		     " bDeviceSubClass = 0x%X, bDeviceProtocol = 0x%X\n",
167 		     le16_to_cpu(udev->descriptor.bcdUSB),
168 		     udev->descriptor.bDeviceClass,
169 		     udev->descriptor.bDeviceSubClass,
170 		     udev->descriptor.bDeviceProtocol);
171 
172 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
173 		endpoint = &iface_desc->endpoint[i].desc;
174 		if (usb_endpoint_is_bulk_in(endpoint)) {
175 			cardp->ep_in_size =
176 				le16_to_cpu(endpoint->wMaxPacketSize);
177 			cardp->ep_in = usb_endpoint_num(endpoint);
178 
179 			lbtf_deb_usbd(&udev->dev, "in_endpoint = %d\n",
180 				cardp->ep_in);
181 			lbtf_deb_usbd(&udev->dev, "Bulk in size is %d\n",
182 				cardp->ep_in_size);
183 		} else if (usb_endpoint_is_bulk_out(endpoint)) {
184 			cardp->ep_out_size =
185 				le16_to_cpu(endpoint->wMaxPacketSize);
186 			cardp->ep_out = usb_endpoint_num(endpoint);
187 
188 			lbtf_deb_usbd(&udev->dev, "out_endpoint = %d\n",
189 				cardp->ep_out);
190 			lbtf_deb_usbd(&udev->dev, "Bulk out size is %d\n",
191 				cardp->ep_out_size);
192 		}
193 	}
194 	if (!cardp->ep_out_size || !cardp->ep_in_size) {
195 		lbtf_deb_usbd(&udev->dev, "Endpoints not found\n");
196 		/* Endpoints not found */
197 		goto dealloc;
198 	}
199 
200 	cardp->rx_urb = usb_alloc_urb(0, GFP_KERNEL);
201 	if (!cardp->rx_urb)
202 		goto dealloc;
203 
204 	cardp->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
205 	if (!cardp->tx_urb)
206 		goto dealloc;
207 
208 	cardp->cmd_urb = usb_alloc_urb(0, GFP_KERNEL);
209 	if (!cardp->cmd_urb)
210 		goto dealloc;
211 
212 	cardp->ep_out_buf = kmalloc(MRVDRV_ETH_TX_PACKET_BUFFER_SIZE,
213 				    GFP_KERNEL);
214 	if (!cardp->ep_out_buf) {
215 		lbtf_deb_usbd(&udev->dev, "Could not allocate buffer\n");
216 		goto dealloc;
217 	}
218 
219 	priv = lbtf_add_card(cardp, &udev->dev);
220 	if (!priv)
221 		goto dealloc;
222 
223 	cardp->priv = priv;
224 
225 	priv->hw_host_to_card = if_usb_host_to_card;
226 	priv->hw_prog_firmware = if_usb_prog_firmware;
227 	priv->hw_reset_device = if_usb_reset_device;
228 	cardp->boot2_version = udev->descriptor.bcdDevice;
229 
230 	usb_get_dev(udev);
231 	usb_set_intfdata(intf, cardp);
232 
233 	return 0;
234 
235 dealloc:
236 	if_usb_free(cardp);
237 error:
238 lbtf_deb_leave(LBTF_DEB_MAIN);
239 	return -ENOMEM;
240 }
241 
242 /**
243  *  if_usb_disconnect -  free resource and cleanup
244  *
245  *  @intf	USB interface structure
246  */
247 static void if_usb_disconnect(struct usb_interface *intf)
248 {
249 	struct if_usb_card *cardp = usb_get_intfdata(intf);
250 	struct lbtf_private *priv = cardp->priv;
251 
252 	lbtf_deb_enter(LBTF_DEB_MAIN);
253 
254 	if_usb_reset_device(cardp);
255 
256 	if (priv)
257 		lbtf_remove_card(priv);
258 
259 	/* Unlink and free urb */
260 	if_usb_free(cardp);
261 
262 	usb_set_intfdata(intf, NULL);
263 	usb_put_dev(interface_to_usbdev(intf));
264 
265 	lbtf_deb_leave(LBTF_DEB_MAIN);
266 }
267 
268 /**
269  *  if_usb_send_fw_pkt -  This function downloads the FW
270  *
271  *  @priv	pointer to struct lbtf_private
272  *
273  *  Returns: 0
274  */
275 static int if_usb_send_fw_pkt(struct if_usb_card *cardp)
276 {
277 	struct fwdata *fwdata = cardp->ep_out_buf;
278 	u8 *firmware = (u8 *) cardp->fw->data;
279 
280 	lbtf_deb_enter(LBTF_DEB_FW);
281 
282 	/* If we got a CRC failure on the last block, back
283 	   up and retry it */
284 	if (!cardp->CRC_OK) {
285 		cardp->totalbytes = cardp->fwlastblksent;
286 		cardp->fwseqnum--;
287 	}
288 
289 	lbtf_deb_usb2(&cardp->udev->dev, "totalbytes = %d\n",
290 		     cardp->totalbytes);
291 
292 	/* struct fwdata (which we sent to the card) has an
293 	   extra __le32 field in between the header and the data,
294 	   which is not in the struct fwheader in the actual
295 	   firmware binary. Insert the seqnum in the middle... */
296 	memcpy(&fwdata->hdr, &firmware[cardp->totalbytes],
297 	       sizeof(struct fwheader));
298 
299 	cardp->fwlastblksent = cardp->totalbytes;
300 	cardp->totalbytes += sizeof(struct fwheader);
301 
302 	memcpy(fwdata->data, &firmware[cardp->totalbytes],
303 	       le32_to_cpu(fwdata->hdr.datalength));
304 
305 	lbtf_deb_usb2(&cardp->udev->dev, "Data length = %d\n",
306 		     le32_to_cpu(fwdata->hdr.datalength));
307 
308 	fwdata->seqnum = cpu_to_le32(++cardp->fwseqnum);
309 	cardp->totalbytes += le32_to_cpu(fwdata->hdr.datalength);
310 
311 	usb_tx_block(cardp, cardp->ep_out_buf, sizeof(struct fwdata) +
312 		     le32_to_cpu(fwdata->hdr.datalength), 0);
313 
314 	if (fwdata->hdr.dnldcmd == cpu_to_le32(FW_HAS_DATA_TO_RECV)) {
315 		lbtf_deb_usb2(&cardp->udev->dev, "There are data to follow\n");
316 		lbtf_deb_usb2(&cardp->udev->dev,
317 			"seqnum = %d totalbytes = %d\n",
318 			cardp->fwseqnum, cardp->totalbytes);
319 	} else if (fwdata->hdr.dnldcmd == cpu_to_le32(FW_HAS_LAST_BLOCK)) {
320 		lbtf_deb_usb2(&cardp->udev->dev,
321 			"Host has finished FW downloading\n");
322 		lbtf_deb_usb2(&cardp->udev->dev, "Donwloading FW JUMP BLOCK\n");
323 
324 		/* Host has finished FW downloading
325 		 * Donwloading FW JUMP BLOCK
326 		 */
327 		cardp->fwfinalblk = 1;
328 	}
329 
330 	lbtf_deb_usb2(&cardp->udev->dev, "Firmware download done; size %d\n",
331 		     cardp->totalbytes);
332 
333 	lbtf_deb_leave(LBTF_DEB_FW);
334 	return 0;
335 }
336 
337 static int if_usb_reset_device(struct if_usb_card *cardp)
338 {
339 	struct cmd_ds_802_11_reset *cmd = cardp->ep_out_buf + 4;
340 	int ret;
341 
342 	lbtf_deb_enter(LBTF_DEB_USB);
343 
344 	*(__le32 *)cardp->ep_out_buf = cpu_to_le32(CMD_TYPE_REQUEST);
345 
346 	cmd->hdr.command = cpu_to_le16(CMD_802_11_RESET);
347 	cmd->hdr.size = cpu_to_le16(sizeof(struct cmd_ds_802_11_reset));
348 	cmd->hdr.result = cpu_to_le16(0);
349 	cmd->hdr.seqnum = cpu_to_le16(0x5a5a);
350 	cmd->action = cpu_to_le16(CMD_ACT_HALT);
351 	usb_tx_block(cardp, cardp->ep_out_buf,
352 		     4 + sizeof(struct cmd_ds_802_11_reset), 0);
353 
354 	msleep(100);
355 	ret = usb_reset_device(cardp->udev);
356 	msleep(100);
357 
358 	lbtf_deb_leave_args(LBTF_DEB_USB, "ret %d", ret);
359 
360 	return ret;
361 }
362 
363 /**
364  *  usb_tx_block - transfer data to the device
365  *
366  *  @priv	pointer to struct lbtf_private
367  *  @payload	pointer to payload data
368  *  @nb		data length
369  *  @data	non-zero for data, zero for commands
370  *
371  *  Returns: 0 on success, nonzero otherwise.
372  */
373 static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload,
374 			uint16_t nb, u8 data)
375 {
376 	int ret = -1;
377 	struct urb *urb;
378 
379 	lbtf_deb_enter(LBTF_DEB_USB);
380 	/* check if device is removed */
381 	if (cardp->priv->surpriseremoved) {
382 		lbtf_deb_usbd(&cardp->udev->dev, "Device removed\n");
383 		goto tx_ret;
384 	}
385 
386 	if (data)
387 		urb = cardp->tx_urb;
388 	else
389 		urb = cardp->cmd_urb;
390 
391 	usb_fill_bulk_urb(urb, cardp->udev,
392 			  usb_sndbulkpipe(cardp->udev,
393 					  cardp->ep_out),
394 			  payload, nb, if_usb_write_bulk_callback, cardp);
395 
396 	urb->transfer_flags |= URB_ZERO_PACKET;
397 
398 	if (usb_submit_urb(urb, GFP_ATOMIC)) {
399 		lbtf_deb_usbd(&cardp->udev->dev,
400 			"usb_submit_urb failed: %d\n", ret);
401 		goto tx_ret;
402 	}
403 
404 	lbtf_deb_usb2(&cardp->udev->dev, "usb_submit_urb success\n");
405 
406 	ret = 0;
407 
408 tx_ret:
409 	lbtf_deb_leave(LBTF_DEB_USB);
410 	return ret;
411 }
412 
413 static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
414 				  void (*callbackfn)(struct urb *urb))
415 {
416 	struct sk_buff *skb;
417 	int ret = -1;
418 
419 	lbtf_deb_enter(LBTF_DEB_USB);
420 
421 	skb = dev_alloc_skb(MRVDRV_ETH_RX_PACKET_BUFFER_SIZE);
422 	if (!skb) {
423 		pr_err("No free skb\n");
424 		lbtf_deb_leave(LBTF_DEB_USB);
425 		return -1;
426 	}
427 
428 	cardp->rx_skb = skb;
429 
430 	/* Fill the receive configuration URB and initialise the Rx call back */
431 	usb_fill_bulk_urb(cardp->rx_urb, cardp->udev,
432 			  usb_rcvbulkpipe(cardp->udev, cardp->ep_in),
433 			  skb_tail_pointer(skb),
434 			  MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn, cardp);
435 
436 	cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET;
437 
438 	lbtf_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n",
439 		cardp->rx_urb);
440 	ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC);
441 	if (ret) {
442 		lbtf_deb_usbd(&cardp->udev->dev,
443 			"Submit Rx URB failed: %d\n", ret);
444 		kfree_skb(skb);
445 		cardp->rx_skb = NULL;
446 		lbtf_deb_leave(LBTF_DEB_USB);
447 		return -1;
448 	} else {
449 		lbtf_deb_usb2(&cardp->udev->dev, "Submit Rx URB success\n");
450 		lbtf_deb_leave(LBTF_DEB_USB);
451 		return 0;
452 	}
453 }
454 
455 static int if_usb_submit_rx_urb_fwload(struct if_usb_card *cardp)
456 {
457 	return __if_usb_submit_rx_urb(cardp, &if_usb_receive_fwload);
458 }
459 
460 static int if_usb_submit_rx_urb(struct if_usb_card *cardp)
461 {
462 	return __if_usb_submit_rx_urb(cardp, &if_usb_receive);
463 }
464 
465 static void if_usb_receive_fwload(struct urb *urb)
466 {
467 	struct if_usb_card *cardp = urb->context;
468 	struct sk_buff *skb = cardp->rx_skb;
469 	struct fwsyncheader *syncfwheader;
470 	struct bootcmdresp bcmdresp;
471 
472 	lbtf_deb_enter(LBTF_DEB_USB);
473 	if (urb->status) {
474 		lbtf_deb_usbd(&cardp->udev->dev,
475 			     "URB status is failed during fw load\n");
476 		kfree_skb(skb);
477 		lbtf_deb_leave(LBTF_DEB_USB);
478 		return;
479 	}
480 
481 	if (cardp->fwdnldover) {
482 		__le32 *tmp = (__le32 *)(skb->data);
483 
484 		if (tmp[0] == cpu_to_le32(CMD_TYPE_INDICATION) &&
485 		    tmp[1] == cpu_to_le32(MACREG_INT_CODE_FIRMWARE_READY)) {
486 			/* Firmware ready event received */
487 			pr_info("Firmware ready event received\n");
488 			wake_up(&cardp->fw_wq);
489 		} else {
490 			lbtf_deb_usb("Waiting for confirmation; got %x %x\n",
491 				    le32_to_cpu(tmp[0]), le32_to_cpu(tmp[1]));
492 			if_usb_submit_rx_urb_fwload(cardp);
493 		}
494 		kfree_skb(skb);
495 		lbtf_deb_leave(LBTF_DEB_USB);
496 		return;
497 	}
498 	if (cardp->bootcmdresp <= 0) {
499 		memcpy(&bcmdresp, skb->data, sizeof(bcmdresp));
500 
501 		if (le16_to_cpu(cardp->udev->descriptor.bcdDevice) < 0x3106) {
502 			kfree_skb(skb);
503 			if_usb_submit_rx_urb_fwload(cardp);
504 			cardp->bootcmdresp = 1;
505 			/* Received valid boot command response */
506 			lbtf_deb_usbd(&cardp->udev->dev,
507 				     "Received valid boot command response\n");
508 			lbtf_deb_leave(LBTF_DEB_USB);
509 			return;
510 		}
511 		if (bcmdresp.magic != cpu_to_le32(BOOT_CMD_MAGIC_NUMBER)) {
512 			if (bcmdresp.magic == cpu_to_le32(CMD_TYPE_REQUEST) ||
513 			    bcmdresp.magic == cpu_to_le32(CMD_TYPE_DATA) ||
514 			    bcmdresp.magic == cpu_to_le32(CMD_TYPE_INDICATION)) {
515 				if (!cardp->bootcmdresp)
516 					pr_info("Firmware already seems alive; resetting\n");
517 				cardp->bootcmdresp = -1;
518 			} else {
519 				pr_info("boot cmd response wrong magic number (0x%x)\n",
520 					    le32_to_cpu(bcmdresp.magic));
521 			}
522 		} else if (bcmdresp.cmd != BOOT_CMD_FW_BY_USB) {
523 			pr_info("boot cmd response cmd_tag error (%d)\n",
524 				bcmdresp.cmd);
525 		} else if (bcmdresp.result != BOOT_CMD_RESP_OK) {
526 			pr_info("boot cmd response result error (%d)\n",
527 				bcmdresp.result);
528 		} else {
529 			cardp->bootcmdresp = 1;
530 			lbtf_deb_usbd(&cardp->udev->dev,
531 				"Received valid boot command response\n");
532 		}
533 
534 		kfree_skb(skb);
535 		if_usb_submit_rx_urb_fwload(cardp);
536 		lbtf_deb_leave(LBTF_DEB_USB);
537 		return;
538 	}
539 
540 	syncfwheader = kmemdup(skb->data, sizeof(struct fwsyncheader),
541 			       GFP_ATOMIC);
542 	if (!syncfwheader) {
543 		lbtf_deb_usbd(&cardp->udev->dev,
544 			"Failure to allocate syncfwheader\n");
545 		kfree_skb(skb);
546 		lbtf_deb_leave(LBTF_DEB_USB);
547 		return;
548 	}
549 
550 	if (!syncfwheader->cmd) {
551 		lbtf_deb_usb2(&cardp->udev->dev,
552 			"FW received Blk with correct CRC\n");
553 		lbtf_deb_usb2(&cardp->udev->dev,
554 			"FW received Blk seqnum = %d\n",
555 			le32_to_cpu(syncfwheader->seqnum));
556 		cardp->CRC_OK = 1;
557 	} else {
558 		lbtf_deb_usbd(&cardp->udev->dev,
559 			"FW received Blk with CRC error\n");
560 		cardp->CRC_OK = 0;
561 	}
562 
563 	kfree_skb(skb);
564 
565 	/* reschedule timer for 200ms hence */
566 	mod_timer(&cardp->fw_timeout, jiffies + (HZ/5));
567 
568 	if (cardp->fwfinalblk) {
569 		cardp->fwdnldover = 1;
570 		goto exit;
571 	}
572 
573 	if_usb_send_fw_pkt(cardp);
574 
575  exit:
576 	if_usb_submit_rx_urb_fwload(cardp);
577 
578 	kfree(syncfwheader);
579 
580 	lbtf_deb_leave(LBTF_DEB_USB);
581 }
582 
583 #define MRVDRV_MIN_PKT_LEN	30
584 
585 static inline void process_cmdtypedata(int recvlength, struct sk_buff *skb,
586 				       struct if_usb_card *cardp,
587 				       struct lbtf_private *priv)
588 {
589 	if (recvlength > MRVDRV_ETH_RX_PACKET_BUFFER_SIZE + MESSAGE_HEADER_LEN
590 	    || recvlength < MRVDRV_MIN_PKT_LEN) {
591 		lbtf_deb_usbd(&cardp->udev->dev, "Packet length is Invalid\n");
592 		kfree_skb(skb);
593 		return;
594 	}
595 
596 	skb_put(skb, recvlength);
597 	skb_pull(skb, MESSAGE_HEADER_LEN);
598 	lbtf_rx(priv, skb);
599 }
600 
601 static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,
602 				      struct sk_buff *skb,
603 				      struct if_usb_card *cardp,
604 				      struct lbtf_private *priv)
605 {
606 	unsigned long flags;
607 
608 	if (recvlength < MESSAGE_HEADER_LEN ||
609 	    recvlength > LBS_CMD_BUFFER_SIZE) {
610 		lbtf_deb_usbd(&cardp->udev->dev,
611 			     "The receive buffer is invalid: %d\n", recvlength);
612 		kfree_skb(skb);
613 		return;
614 	}
615 
616 	spin_lock_irqsave(&priv->driver_lock, flags);
617 	memcpy(priv->cmd_resp_buff, recvbuff + MESSAGE_HEADER_LEN,
618 	       recvlength - MESSAGE_HEADER_LEN);
619 	kfree_skb(skb);
620 	lbtf_cmd_response_rx(priv);
621 	spin_unlock_irqrestore(&priv->driver_lock, flags);
622 }
623 
624 /**
625  *  if_usb_receive - read data received from the device.
626  *
627  *  @urb		pointer to struct urb
628  */
629 static void if_usb_receive(struct urb *urb)
630 {
631 	struct if_usb_card *cardp = urb->context;
632 	struct sk_buff *skb = cardp->rx_skb;
633 	struct lbtf_private *priv = cardp->priv;
634 	int recvlength = urb->actual_length;
635 	uint8_t *recvbuff = NULL;
636 	uint32_t recvtype = 0;
637 	__le32 *pkt = (__le32 *) skb->data;
638 
639 	lbtf_deb_enter(LBTF_DEB_USB);
640 
641 	if (recvlength) {
642 		if (urb->status) {
643 			lbtf_deb_usbd(&cardp->udev->dev, "RX URB failed: %d\n",
644 				     urb->status);
645 			kfree_skb(skb);
646 			goto setup_for_next;
647 		}
648 
649 		recvbuff = skb->data;
650 		recvtype = le32_to_cpu(pkt[0]);
651 		lbtf_deb_usbd(&cardp->udev->dev,
652 			    "Recv length = 0x%x, Recv type = 0x%X\n",
653 			    recvlength, recvtype);
654 	} else if (urb->status) {
655 		kfree_skb(skb);
656 		lbtf_deb_leave(LBTF_DEB_USB);
657 		return;
658 	}
659 
660 	switch (recvtype) {
661 	case CMD_TYPE_DATA:
662 		process_cmdtypedata(recvlength, skb, cardp, priv);
663 		break;
664 
665 	case CMD_TYPE_REQUEST:
666 		process_cmdrequest(recvlength, recvbuff, skb, cardp, priv);
667 		break;
668 
669 	case CMD_TYPE_INDICATION:
670 	{
671 		/* Event cause handling */
672 		u32 event_cause = le32_to_cpu(pkt[1]);
673 		lbtf_deb_usbd(&cardp->udev->dev, "**EVENT** 0x%X\n",
674 			event_cause);
675 
676 		/* Icky undocumented magic special case */
677 		if (event_cause & 0xffff0000) {
678 			u16 tmp;
679 			u8 retrycnt;
680 			u8 failure;
681 
682 			tmp = event_cause >> 16;
683 			retrycnt = tmp & 0x00ff;
684 			failure = (tmp & 0xff00) >> 8;
685 			lbtf_send_tx_feedback(priv, retrycnt, failure);
686 		} else if (event_cause == LBTF_EVENT_BCN_SENT)
687 			lbtf_bcn_sent(priv);
688 		else
689 			lbtf_deb_usbd(&cardp->udev->dev,
690 			       "Unsupported notification %d received\n",
691 			       event_cause);
692 		kfree_skb(skb);
693 		break;
694 	}
695 	default:
696 		lbtf_deb_usbd(&cardp->udev->dev,
697 			"libertastf: unknown command type 0x%X\n", recvtype);
698 		kfree_skb(skb);
699 		break;
700 	}
701 
702 setup_for_next:
703 	if_usb_submit_rx_urb(cardp);
704 	lbtf_deb_leave(LBTF_DEB_USB);
705 }
706 
707 /**
708  *  if_usb_host_to_card -  Download data to the device
709  *
710  *  @priv		pointer to struct lbtf_private structure
711  *  @type		type of data
712  *  @buf		pointer to data buffer
713  *  @len		number of bytes
714  *
715  *  Returns: 0 on success, nonzero otherwise
716  */
717 static int if_usb_host_to_card(struct lbtf_private *priv, uint8_t type,
718 			       uint8_t *payload, uint16_t nb)
719 {
720 	struct if_usb_card *cardp = priv->card;
721 	u8 data = 0;
722 
723 	lbtf_deb_usbd(&cardp->udev->dev, "*** type = %u\n", type);
724 	lbtf_deb_usbd(&cardp->udev->dev, "size after = %d\n", nb);
725 
726 	if (type == MVMS_CMD) {
727 		*(__le32 *)cardp->ep_out_buf = cpu_to_le32(CMD_TYPE_REQUEST);
728 	} else {
729 		*(__le32 *)cardp->ep_out_buf = cpu_to_le32(CMD_TYPE_DATA);
730 		data = 1;
731 	}
732 
733 	memcpy((cardp->ep_out_buf + MESSAGE_HEADER_LEN), payload, nb);
734 
735 	return usb_tx_block(cardp, cardp->ep_out_buf, nb + MESSAGE_HEADER_LEN,
736 			    data);
737 }
738 
739 /**
740  *  if_usb_issue_boot_command - Issue boot command to Boot2.
741  *
742  *  @ivalue   1 boots from FW by USB-Download, 2 boots from FW in EEPROM.
743  *
744  *  Returns: 0
745  */
746 static int if_usb_issue_boot_command(struct if_usb_card *cardp, int ivalue)
747 {
748 	struct bootcmd *bootcmd = cardp->ep_out_buf;
749 
750 	/* Prepare command */
751 	bootcmd->magic = cpu_to_le32(BOOT_CMD_MAGIC_NUMBER);
752 	bootcmd->cmd = ivalue;
753 	memset(bootcmd->pad, 0, sizeof(bootcmd->pad));
754 
755 	/* Issue command */
756 	usb_tx_block(cardp, cardp->ep_out_buf, sizeof(*bootcmd), 0);
757 
758 	return 0;
759 }
760 
761 
762 /**
763  *  check_fwfile_format - Check the validity of Boot2/FW image.
764  *
765  *  @data	pointer to image
766  *  @totlen	image length
767  *
768  *  Returns: 0 if the image is valid, nonzero otherwise.
769  */
770 static int check_fwfile_format(const u8 *data, u32 totlen)
771 {
772 	u32 bincmd, exit;
773 	u32 blksize, offset, len;
774 	int ret;
775 
776 	ret = 1;
777 	exit = len = 0;
778 
779 	do {
780 		struct fwheader *fwh = (void *) data;
781 
782 		bincmd = le32_to_cpu(fwh->dnldcmd);
783 		blksize = le32_to_cpu(fwh->datalength);
784 		switch (bincmd) {
785 		case FW_HAS_DATA_TO_RECV:
786 			offset = sizeof(struct fwheader) + blksize;
787 			data += offset;
788 			len += offset;
789 			if (len >= totlen)
790 				exit = 1;
791 			break;
792 		case FW_HAS_LAST_BLOCK:
793 			exit = 1;
794 			ret = 0;
795 			break;
796 		default:
797 			exit = 1;
798 			break;
799 		}
800 	} while (!exit);
801 
802 	if (ret)
803 		pr_err("firmware file format check FAIL\n");
804 	else
805 		lbtf_deb_fw("firmware file format check PASS\n");
806 
807 	return ret;
808 }
809 
810 
811 static int if_usb_prog_firmware(struct if_usb_card *cardp)
812 {
813 	int i = 0;
814 	static int reset_count = 10;
815 	int ret = 0;
816 
817 	lbtf_deb_enter(LBTF_DEB_USB);
818 
819 	kernel_param_lock(THIS_MODULE);
820 	ret = request_firmware(&cardp->fw, lbtf_fw_name, &cardp->udev->dev);
821 	if (ret < 0) {
822 		pr_err("request_firmware() failed with %#x\n", ret);
823 		pr_err("firmware %s not found\n", lbtf_fw_name);
824 		kernel_param_unlock(THIS_MODULE);
825 		goto done;
826 	}
827 	kernel_param_unlock(THIS_MODULE);
828 
829 	if (check_fwfile_format(cardp->fw->data, cardp->fw->size))
830 		goto release_fw;
831 
832 restart:
833 	if (if_usb_submit_rx_urb_fwload(cardp) < 0) {
834 		lbtf_deb_usbd(&cardp->udev->dev, "URB submission is failed\n");
835 		ret = -1;
836 		goto release_fw;
837 	}
838 
839 	cardp->bootcmdresp = 0;
840 	do {
841 		int j = 0;
842 		i++;
843 		/* Issue Boot command = 1, Boot from Download-FW */
844 		if_usb_issue_boot_command(cardp, BOOT_CMD_FW_BY_USB);
845 		/* wait for command response */
846 		do {
847 			j++;
848 			msleep_interruptible(100);
849 		} while (cardp->bootcmdresp == 0 && j < 10);
850 	} while (cardp->bootcmdresp == 0 && i < 5);
851 
852 	if (cardp->bootcmdresp <= 0) {
853 		if (--reset_count >= 0) {
854 			if_usb_reset_device(cardp);
855 			goto restart;
856 		}
857 		return -1;
858 	}
859 
860 	i = 0;
861 
862 	cardp->totalbytes = 0;
863 	cardp->fwlastblksent = 0;
864 	cardp->CRC_OK = 1;
865 	cardp->fwdnldover = 0;
866 	cardp->fwseqnum = -1;
867 	cardp->totalbytes = 0;
868 	cardp->fwfinalblk = 0;
869 
870 	/* Send the first firmware packet... */
871 	if_usb_send_fw_pkt(cardp);
872 
873 	/* ... and wait for the process to complete */
874 	wait_event_interruptible(cardp->fw_wq, cardp->priv->surpriseremoved ||
875 					       cardp->fwdnldover);
876 
877 	del_timer_sync(&cardp->fw_timeout);
878 	usb_kill_urb(cardp->rx_urb);
879 
880 	if (!cardp->fwdnldover) {
881 		pr_info("failed to load fw, resetting device!\n");
882 		if (--reset_count >= 0) {
883 			if_usb_reset_device(cardp);
884 			goto restart;
885 		}
886 
887 		pr_info("FW download failure, time = %d ms\n", i * 100);
888 		ret = -1;
889 		goto release_fw;
890 	}
891 
892 	cardp->priv->fw_ready = 1;
893 
894  release_fw:
895 	release_firmware(cardp->fw);
896 	cardp->fw = NULL;
897 
898 	if_usb_setup_firmware(cardp->priv);
899 
900  done:
901 	lbtf_deb_leave_args(LBTF_DEB_USB, "ret %d", ret);
902 	return ret;
903 }
904 
905 
906 #define if_usb_suspend NULL
907 #define if_usb_resume NULL
908 
909 static struct usb_driver if_usb_driver = {
910 	.name = DRV_NAME,
911 	.probe = if_usb_probe,
912 	.disconnect = if_usb_disconnect,
913 	.id_table = if_usb_table,
914 	.suspend = if_usb_suspend,
915 	.resume = if_usb_resume,
916 	.disable_hub_initiated_lpm = 1,
917 };
918 
919 module_usb_driver(if_usb_driver);
920 
921 MODULE_DESCRIPTION("8388 USB WLAN Thinfirm Driver");
922 MODULE_AUTHOR("Cozybit Inc.");
923 MODULE_LICENSE("GPL");
924