1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * NXP Wireless LAN device driver: USB specific handling
4  *
5  * Copyright 2011-2020 NXP
6  */
7 
8 #include "main.h"
9 #include "usb.h"
10 
11 #define USB_VERSION	"1.0"
12 
13 static struct mwifiex_if_ops usb_ops;
14 
15 static const struct usb_device_id mwifiex_usb_table[] = {
16 	/* 8766 */
17 	{USB_DEVICE(USB8XXX_VID, USB8766_PID_1)},
18 	{USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8766_PID_2,
19 				       USB_CLASS_VENDOR_SPEC,
20 				       USB_SUBCLASS_VENDOR_SPEC, 0xff)},
21 	/* 8797 */
22 	{USB_DEVICE(USB8XXX_VID, USB8797_PID_1)},
23 	{USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8797_PID_2,
24 				       USB_CLASS_VENDOR_SPEC,
25 				       USB_SUBCLASS_VENDOR_SPEC, 0xff)},
26 	/* 8801 */
27 	{USB_DEVICE(USB8XXX_VID, USB8801_PID_1)},
28 	{USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8801_PID_2,
29 				       USB_CLASS_VENDOR_SPEC,
30 				       USB_SUBCLASS_VENDOR_SPEC, 0xff)},
31 	/* 8997 */
32 	{USB_DEVICE(USB8XXX_VID, USB8997_PID_1)},
33 	{USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8997_PID_2,
34 				       USB_CLASS_VENDOR_SPEC,
35 				       USB_SUBCLASS_VENDOR_SPEC, 0xff)},
36 	{ }	/* Terminating entry */
37 };
38 
39 MODULE_DEVICE_TABLE(usb, mwifiex_usb_table);
40 
41 static int mwifiex_usb_submit_rx_urb(struct urb_context *ctx, int size);
42 
43 /* This function handles received packet. Necessary action is taken based on
44  * cmd/event/data.
45  */
46 static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
47 			    struct sk_buff *skb, u8 ep)
48 {
49 	u32 recv_type;
50 	__le32 tmp;
51 	int ret;
52 
53 	if (adapter->hs_activated)
54 		mwifiex_process_hs_config(adapter);
55 
56 	if (skb->len < INTF_HEADER_LEN) {
57 		mwifiex_dbg(adapter, ERROR,
58 			    "%s: invalid skb->len\n", __func__);
59 		return -1;
60 	}
61 
62 	switch (ep) {
63 	case MWIFIEX_USB_EP_CMD_EVENT:
64 		mwifiex_dbg(adapter, EVENT,
65 			    "%s: EP_CMD_EVENT\n", __func__);
66 		skb_copy_from_linear_data(skb, &tmp, INTF_HEADER_LEN);
67 		recv_type = le32_to_cpu(tmp);
68 		skb_pull(skb, INTF_HEADER_LEN);
69 
70 		switch (recv_type) {
71 		case MWIFIEX_USB_TYPE_CMD:
72 			if (skb->len > MWIFIEX_SIZE_OF_CMD_BUFFER) {
73 				mwifiex_dbg(adapter, ERROR,
74 					    "CMD: skb->len too large\n");
75 				ret = -1;
76 				goto exit_restore_skb;
77 			} else if (!adapter->curr_cmd) {
78 				mwifiex_dbg(adapter, WARN, "CMD: no curr_cmd\n");
79 				if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
80 					mwifiex_process_sleep_confirm_resp(
81 							adapter, skb->data,
82 							skb->len);
83 					ret = 0;
84 					goto exit_restore_skb;
85 				}
86 				ret = -1;
87 				goto exit_restore_skb;
88 			}
89 
90 			adapter->curr_cmd->resp_skb = skb;
91 			adapter->cmd_resp_received = true;
92 			break;
93 		case MWIFIEX_USB_TYPE_EVENT:
94 			if (skb->len < sizeof(u32)) {
95 				mwifiex_dbg(adapter, ERROR,
96 					    "EVENT: skb->len too small\n");
97 				ret = -1;
98 				goto exit_restore_skb;
99 			}
100 			skb_copy_from_linear_data(skb, &tmp, sizeof(u32));
101 			adapter->event_cause = le32_to_cpu(tmp);
102 			mwifiex_dbg(adapter, EVENT,
103 				    "event_cause %#x\n", adapter->event_cause);
104 
105 			if (skb->len > MAX_EVENT_SIZE) {
106 				mwifiex_dbg(adapter, ERROR,
107 					    "EVENT: event body too large\n");
108 				ret = -1;
109 				goto exit_restore_skb;
110 			}
111 
112 			memcpy(adapter->event_body, skb->data +
113 			       MWIFIEX_EVENT_HEADER_LEN, skb->len);
114 
115 			adapter->event_received = true;
116 			adapter->event_skb = skb;
117 			break;
118 		default:
119 			mwifiex_dbg(adapter, ERROR,
120 				    "unknown recv_type %#x\n", recv_type);
121 			ret = -1;
122 			goto exit_restore_skb;
123 		}
124 		break;
125 	case MWIFIEX_USB_EP_DATA:
126 		mwifiex_dbg(adapter, DATA, "%s: EP_DATA\n", __func__);
127 		if (skb->len > MWIFIEX_RX_DATA_BUF_SIZE) {
128 			mwifiex_dbg(adapter, ERROR,
129 				    "DATA: skb->len too large\n");
130 			return -1;
131 		}
132 
133 		skb_queue_tail(&adapter->rx_data_q, skb);
134 		adapter->data_received = true;
135 		atomic_inc(&adapter->rx_pending);
136 		break;
137 	default:
138 		mwifiex_dbg(adapter, ERROR,
139 			    "%s: unknown endport %#x\n", __func__, ep);
140 		return -1;
141 	}
142 
143 	return -EINPROGRESS;
144 
145 exit_restore_skb:
146 	/* The buffer will be reused for further cmds/events */
147 	skb_push(skb, INTF_HEADER_LEN);
148 
149 	return ret;
150 }
151 
152 static void mwifiex_usb_rx_complete(struct urb *urb)
153 {
154 	struct urb_context *context = (struct urb_context *)urb->context;
155 	struct mwifiex_adapter *adapter = context->adapter;
156 	struct sk_buff *skb = context->skb;
157 	struct usb_card_rec *card;
158 	int recv_length = urb->actual_length;
159 	int size, status;
160 
161 	if (!adapter || !adapter->card) {
162 		pr_err("mwifiex adapter or card structure is not valid\n");
163 		return;
164 	}
165 
166 	card = (struct usb_card_rec *)adapter->card;
167 	if (card->rx_cmd_ep == context->ep)
168 		atomic_dec(&card->rx_cmd_urb_pending);
169 	else
170 		atomic_dec(&card->rx_data_urb_pending);
171 
172 	if (recv_length) {
173 		if (urb->status ||
174 		    test_bit(MWIFIEX_SURPRISE_REMOVED, &adapter->work_flags)) {
175 			mwifiex_dbg(adapter, ERROR,
176 				    "URB status is failed: %d\n", urb->status);
177 			/* Do not free skb in case of command ep */
178 			if (card->rx_cmd_ep != context->ep)
179 				dev_kfree_skb_any(skb);
180 			goto setup_for_next;
181 		}
182 		if (skb->len > recv_length)
183 			skb_trim(skb, recv_length);
184 		else
185 			skb_put(skb, recv_length - skb->len);
186 
187 		status = mwifiex_usb_recv(adapter, skb, context->ep);
188 
189 		mwifiex_dbg(adapter, INFO,
190 			    "info: recv_length=%d, status=%d\n",
191 			    recv_length, status);
192 		if (status == -EINPROGRESS) {
193 			mwifiex_queue_main_work(adapter);
194 
195 			/* urb for data_ep is re-submitted now;
196 			 * urb for cmd_ep will be re-submitted in callback
197 			 * mwifiex_usb_recv_complete
198 			 */
199 			if (card->rx_cmd_ep == context->ep)
200 				return;
201 		} else {
202 			if (status == -1)
203 				mwifiex_dbg(adapter, ERROR,
204 					    "received data processing failed!\n");
205 
206 			/* Do not free skb in case of command ep */
207 			if (card->rx_cmd_ep != context->ep)
208 				dev_kfree_skb_any(skb);
209 		}
210 	} else if (urb->status) {
211 		if (!test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
212 			mwifiex_dbg(adapter, FATAL,
213 				    "Card is removed: %d\n", urb->status);
214 			set_bit(MWIFIEX_SURPRISE_REMOVED, &adapter->work_flags);
215 		}
216 		dev_kfree_skb_any(skb);
217 		return;
218 	} else {
219 		/* Do not free skb in case of command ep */
220 		if (card->rx_cmd_ep != context->ep)
221 			dev_kfree_skb_any(skb);
222 
223 		/* fall through setup_for_next */
224 	}
225 
226 setup_for_next:
227 	if (card->rx_cmd_ep == context->ep)
228 		size = MWIFIEX_RX_CMD_BUF_SIZE;
229 	else
230 		size = MWIFIEX_RX_DATA_BUF_SIZE;
231 
232 	if (card->rx_cmd_ep == context->ep) {
233 		mwifiex_usb_submit_rx_urb(context, size);
234 	} else {
235 		if (atomic_read(&adapter->rx_pending) <= HIGH_RX_PENDING) {
236 			mwifiex_usb_submit_rx_urb(context, size);
237 		} else {
238 			context->skb = NULL;
239 		}
240 	}
241 
242 	return;
243 }
244 
245 static void mwifiex_usb_tx_complete(struct urb *urb)
246 {
247 	struct urb_context *context = (struct urb_context *)(urb->context);
248 	struct mwifiex_adapter *adapter = context->adapter;
249 	struct usb_card_rec *card = adapter->card;
250 	struct usb_tx_data_port *port;
251 	int i;
252 
253 	mwifiex_dbg(adapter, INFO,
254 		    "%s: status: %d\n", __func__, urb->status);
255 
256 	if (context->ep == card->tx_cmd_ep) {
257 		mwifiex_dbg(adapter, CMD,
258 			    "%s: CMD\n", __func__);
259 		atomic_dec(&card->tx_cmd_urb_pending);
260 		adapter->cmd_sent = false;
261 	} else {
262 		mwifiex_dbg(adapter, DATA,
263 			    "%s: DATA\n", __func__);
264 		mwifiex_write_data_complete(adapter, context->skb, 0,
265 					    urb->status ? -1 : 0);
266 		for (i = 0; i < MWIFIEX_TX_DATA_PORT; i++) {
267 			port = &card->port[i];
268 			if (context->ep == port->tx_data_ep) {
269 				atomic_dec(&port->tx_data_urb_pending);
270 				port->block_status = false;
271 				break;
272 			}
273 		}
274 		adapter->data_sent = false;
275 	}
276 
277 	if (card->mc_resync_flag)
278 		mwifiex_multi_chan_resync(adapter);
279 
280 	mwifiex_queue_main_work(adapter);
281 
282 	return;
283 }
284 
285 static int mwifiex_usb_submit_rx_urb(struct urb_context *ctx, int size)
286 {
287 	struct mwifiex_adapter *adapter = ctx->adapter;
288 	struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
289 
290 	if (test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
291 		if (card->rx_cmd_ep == ctx->ep) {
292 			mwifiex_dbg(adapter, INFO, "%s: free rx_cmd skb\n",
293 				    __func__);
294 			dev_kfree_skb_any(ctx->skb);
295 			ctx->skb = NULL;
296 		}
297 		mwifiex_dbg(adapter, ERROR,
298 			    "%s: card removed/suspended, EP %d rx_cmd URB submit skipped\n",
299 			    __func__, ctx->ep);
300 		return -1;
301 	}
302 
303 	if (card->rx_cmd_ep != ctx->ep) {
304 		ctx->skb = dev_alloc_skb(size);
305 		if (!ctx->skb) {
306 			mwifiex_dbg(adapter, ERROR,
307 				    "%s: dev_alloc_skb failed\n", __func__);
308 			return -ENOMEM;
309 		}
310 	}
311 
312 	if (card->rx_cmd_ep == ctx->ep &&
313 	    card->rx_cmd_ep_type == USB_ENDPOINT_XFER_INT)
314 		usb_fill_int_urb(ctx->urb, card->udev,
315 				 usb_rcvintpipe(card->udev, ctx->ep),
316 				 ctx->skb->data, size, mwifiex_usb_rx_complete,
317 				 (void *)ctx, card->rx_cmd_interval);
318 	else
319 		usb_fill_bulk_urb(ctx->urb, card->udev,
320 				  usb_rcvbulkpipe(card->udev, ctx->ep),
321 				  ctx->skb->data, size, mwifiex_usb_rx_complete,
322 				  (void *)ctx);
323 
324 	if (card->rx_cmd_ep == ctx->ep)
325 		atomic_inc(&card->rx_cmd_urb_pending);
326 	else
327 		atomic_inc(&card->rx_data_urb_pending);
328 
329 	if (usb_submit_urb(ctx->urb, GFP_ATOMIC)) {
330 		mwifiex_dbg(adapter, ERROR, "usb_submit_urb failed\n");
331 		dev_kfree_skb_any(ctx->skb);
332 		ctx->skb = NULL;
333 
334 		if (card->rx_cmd_ep == ctx->ep)
335 			atomic_dec(&card->rx_cmd_urb_pending);
336 		else
337 			atomic_dec(&card->rx_data_urb_pending);
338 
339 		return -1;
340 	}
341 
342 	return 0;
343 }
344 
345 static void mwifiex_usb_free(struct usb_card_rec *card)
346 {
347 	struct usb_tx_data_port *port;
348 	int i, j;
349 
350 	if (atomic_read(&card->rx_cmd_urb_pending) && card->rx_cmd.urb)
351 		usb_kill_urb(card->rx_cmd.urb);
352 
353 	usb_free_urb(card->rx_cmd.urb);
354 	card->rx_cmd.urb = NULL;
355 
356 	if (atomic_read(&card->rx_data_urb_pending))
357 		for (i = 0; i < MWIFIEX_RX_DATA_URB; i++)
358 			if (card->rx_data_list[i].urb)
359 				usb_kill_urb(card->rx_data_list[i].urb);
360 
361 	for (i = 0; i < MWIFIEX_RX_DATA_URB; i++) {
362 		usb_free_urb(card->rx_data_list[i].urb);
363 		card->rx_data_list[i].urb = NULL;
364 	}
365 
366 	for (i = 0; i < MWIFIEX_TX_DATA_PORT; i++) {
367 		port = &card->port[i];
368 		for (j = 0; j < MWIFIEX_TX_DATA_URB; j++) {
369 			usb_kill_urb(port->tx_data_list[j].urb);
370 			usb_free_urb(port->tx_data_list[j].urb);
371 			port->tx_data_list[j].urb = NULL;
372 		}
373 	}
374 
375 	usb_free_urb(card->tx_cmd.urb);
376 	card->tx_cmd.urb = NULL;
377 
378 	return;
379 }
380 
381 /* This function probes an mwifiex device and registers it. It allocates
382  * the card structure, initiates the device registration and initialization
383  * procedure by adding a logical interface.
384  */
385 static int mwifiex_usb_probe(struct usb_interface *intf,
386 			     const struct usb_device_id *id)
387 {
388 	struct usb_device *udev = interface_to_usbdev(intf);
389 	struct usb_host_interface *iface_desc = intf->cur_altsetting;
390 	struct usb_endpoint_descriptor *epd;
391 	int ret, i;
392 	struct usb_card_rec *card;
393 	u16 id_vendor, id_product, bcd_device;
394 
395 	card = devm_kzalloc(&intf->dev, sizeof(*card), GFP_KERNEL);
396 	if (!card)
397 		return -ENOMEM;
398 
399 	init_completion(&card->fw_done);
400 
401 	id_vendor = le16_to_cpu(udev->descriptor.idVendor);
402 	id_product = le16_to_cpu(udev->descriptor.idProduct);
403 	bcd_device = le16_to_cpu(udev->descriptor.bcdDevice);
404 	pr_debug("info: VID/PID = %X/%X, Boot2 version = %X\n",
405 		 id_vendor, id_product, bcd_device);
406 
407 	/* PID_1 is used for firmware downloading only */
408 	switch (id_product) {
409 	case USB8766_PID_1:
410 	case USB8797_PID_1:
411 	case USB8801_PID_1:
412 	case USB8997_PID_1:
413 		card->usb_boot_state = USB8XXX_FW_DNLD;
414 		break;
415 	case USB8766_PID_2:
416 	case USB8797_PID_2:
417 	case USB8801_PID_2:
418 	case USB8997_PID_2:
419 		card->usb_boot_state = USB8XXX_FW_READY;
420 		break;
421 	default:
422 		pr_warn("unknown id_product %#x\n", id_product);
423 		card->usb_boot_state = USB8XXX_FW_DNLD;
424 		break;
425 	}
426 
427 	card->udev = udev;
428 	card->intf = intf;
429 
430 	pr_debug("info: bcdUSB=%#x Device Class=%#x SubClass=%#x Protocol=%#x\n",
431 		 le16_to_cpu(udev->descriptor.bcdUSB),
432 		 udev->descriptor.bDeviceClass,
433 		 udev->descriptor.bDeviceSubClass,
434 		 udev->descriptor.bDeviceProtocol);
435 
436 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
437 		epd = &iface_desc->endpoint[i].desc;
438 		if (usb_endpoint_dir_in(epd) &&
439 		    usb_endpoint_num(epd) == MWIFIEX_USB_EP_CMD_EVENT &&
440 		    (usb_endpoint_xfer_bulk(epd) ||
441 		     usb_endpoint_xfer_int(epd))) {
442 			card->rx_cmd_ep_type = usb_endpoint_type(epd);
443 			card->rx_cmd_interval = epd->bInterval;
444 			pr_debug("info: Rx CMD/EVT:: max pkt size: %d, addr: %d, ep_type: %d\n",
445 				 le16_to_cpu(epd->wMaxPacketSize),
446 				 epd->bEndpointAddress, card->rx_cmd_ep_type);
447 			card->rx_cmd_ep = usb_endpoint_num(epd);
448 			atomic_set(&card->rx_cmd_urb_pending, 0);
449 		}
450 		if (usb_endpoint_dir_in(epd) &&
451 		    usb_endpoint_num(epd) == MWIFIEX_USB_EP_DATA &&
452 		    usb_endpoint_xfer_bulk(epd)) {
453 			pr_debug("info: bulk IN: max pkt size: %d, addr: %d\n",
454 				 le16_to_cpu(epd->wMaxPacketSize),
455 				 epd->bEndpointAddress);
456 			card->rx_data_ep = usb_endpoint_num(epd);
457 			atomic_set(&card->rx_data_urb_pending, 0);
458 		}
459 		if (usb_endpoint_dir_out(epd) &&
460 		    usb_endpoint_num(epd) == MWIFIEX_USB_EP_DATA &&
461 		    usb_endpoint_xfer_bulk(epd)) {
462 			pr_debug("info: bulk OUT: max pkt size: %d, addr: %d\n",
463 				 le16_to_cpu(epd->wMaxPacketSize),
464 				 epd->bEndpointAddress);
465 			card->port[0].tx_data_ep = usb_endpoint_num(epd);
466 			atomic_set(&card->port[0].tx_data_urb_pending, 0);
467 		}
468 		if (usb_endpoint_dir_out(epd) &&
469 		    usb_endpoint_num(epd) == MWIFIEX_USB_EP_DATA_CH2 &&
470 		    usb_endpoint_xfer_bulk(epd)) {
471 			pr_debug("info: bulk OUT chan2:\t"
472 				 "max pkt size: %d, addr: %d\n",
473 				 le16_to_cpu(epd->wMaxPacketSize),
474 				 epd->bEndpointAddress);
475 			card->port[1].tx_data_ep = usb_endpoint_num(epd);
476 			atomic_set(&card->port[1].tx_data_urb_pending, 0);
477 		}
478 		if (usb_endpoint_dir_out(epd) &&
479 		    usb_endpoint_num(epd) == MWIFIEX_USB_EP_CMD_EVENT &&
480 		    (usb_endpoint_xfer_bulk(epd) ||
481 		     usb_endpoint_xfer_int(epd))) {
482 			card->tx_cmd_ep_type = usb_endpoint_type(epd);
483 			card->tx_cmd_interval = epd->bInterval;
484 			pr_debug("info: bulk OUT: max pkt size: %d, addr: %d\n",
485 				 le16_to_cpu(epd->wMaxPacketSize),
486 				 epd->bEndpointAddress);
487 			pr_debug("info: Tx CMD:: max pkt size: %d, addr: %d, ep_type: %d\n",
488 				 le16_to_cpu(epd->wMaxPacketSize),
489 				 epd->bEndpointAddress, card->tx_cmd_ep_type);
490 			card->tx_cmd_ep = usb_endpoint_num(epd);
491 			atomic_set(&card->tx_cmd_urb_pending, 0);
492 			card->bulk_out_maxpktsize =
493 					le16_to_cpu(epd->wMaxPacketSize);
494 		}
495 	}
496 
497 	switch (card->usb_boot_state) {
498 	case USB8XXX_FW_DNLD:
499 		/* Reject broken descriptors. */
500 		if (!card->rx_cmd_ep || !card->tx_cmd_ep)
501 			return -ENODEV;
502 		if (card->bulk_out_maxpktsize == 0)
503 			return -ENODEV;
504 		break;
505 	case USB8XXX_FW_READY:
506 		/* Assume the driver can handle missing endpoints for now. */
507 		break;
508 	default:
509 		WARN_ON(1);
510 		return -ENODEV;
511 	}
512 
513 	usb_set_intfdata(intf, card);
514 
515 	ret = mwifiex_add_card(card, &card->fw_done, &usb_ops,
516 			       MWIFIEX_USB, &card->udev->dev);
517 	if (ret) {
518 		pr_err("%s: mwifiex_add_card failed: %d\n", __func__, ret);
519 		usb_reset_device(udev);
520 		return ret;
521 	}
522 
523 	usb_get_dev(udev);
524 
525 	return 0;
526 }
527 
528 /* Kernel needs to suspend all functions separately. Therefore all
529  * registered functions must have drivers with suspend and resume
530  * methods. Failing that the kernel simply removes the whole card.
531  *
532  * If already not suspended, this function allocates and sends a
533  * 'host sleep activate' request to the firmware and turns off the traffic.
534  */
535 static int mwifiex_usb_suspend(struct usb_interface *intf, pm_message_t message)
536 {
537 	struct usb_card_rec *card = usb_get_intfdata(intf);
538 	struct mwifiex_adapter *adapter;
539 	struct usb_tx_data_port *port;
540 	int i, j;
541 
542 	/* Might still be loading firmware */
543 	wait_for_completion(&card->fw_done);
544 
545 	adapter = card->adapter;
546 	if (!adapter) {
547 		dev_err(&intf->dev, "card is not valid\n");
548 		return 0;
549 	}
550 
551 	if (unlikely(test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)))
552 		mwifiex_dbg(adapter, WARN,
553 			    "Device already suspended\n");
554 
555 	/* Enable the Host Sleep */
556 	if (!mwifiex_enable_hs(adapter)) {
557 		mwifiex_dbg(adapter, ERROR,
558 			    "cmd: failed to suspend\n");
559 		clear_bit(MWIFIEX_IS_HS_ENABLING, &adapter->work_flags);
560 		return -EFAULT;
561 	}
562 
563 
564 	/* 'MWIFIEX_IS_SUSPENDED' bit indicates device is suspended.
565 	 * It must be set here before the usb_kill_urb() calls. Reason
566 	 * is in the complete handlers, urb->status(= -ENOENT) and
567 	 * this flag is used in combination to distinguish between a
568 	 * 'suspended' state and a 'disconnect' one.
569 	 */
570 	set_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags);
571 	clear_bit(MWIFIEX_IS_HS_ENABLING, &adapter->work_flags);
572 
573 	if (atomic_read(&card->rx_cmd_urb_pending) && card->rx_cmd.urb)
574 		usb_kill_urb(card->rx_cmd.urb);
575 
576 	if (atomic_read(&card->rx_data_urb_pending))
577 		for (i = 0; i < MWIFIEX_RX_DATA_URB; i++)
578 			if (card->rx_data_list[i].urb)
579 				usb_kill_urb(card->rx_data_list[i].urb);
580 
581 	for (i = 0; i < MWIFIEX_TX_DATA_PORT; i++) {
582 		port = &card->port[i];
583 		for (j = 0; j < MWIFIEX_TX_DATA_URB; j++) {
584 			if (port->tx_data_list[j].urb)
585 				usb_kill_urb(port->tx_data_list[j].urb);
586 		}
587 	}
588 
589 	if (card->tx_cmd.urb)
590 		usb_kill_urb(card->tx_cmd.urb);
591 
592 	return 0;
593 }
594 
595 /* Kernel needs to suspend all functions separately. Therefore all
596  * registered functions must have drivers with suspend and resume
597  * methods. Failing that the kernel simply removes the whole card.
598  *
599  * If already not resumed, this function turns on the traffic and
600  * sends a 'host sleep cancel' request to the firmware.
601  */
602 static int mwifiex_usb_resume(struct usb_interface *intf)
603 {
604 	struct usb_card_rec *card = usb_get_intfdata(intf);
605 	struct mwifiex_adapter *adapter;
606 	int i;
607 
608 	if (!card->adapter) {
609 		dev_err(&intf->dev, "%s: card->adapter is NULL\n",
610 			__func__);
611 		return 0;
612 	}
613 	adapter = card->adapter;
614 
615 	if (unlikely(!test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags))) {
616 		mwifiex_dbg(adapter, WARN,
617 			    "Device already resumed\n");
618 		return 0;
619 	}
620 
621 	/* Indicate device resumed. The netdev queue will be resumed only
622 	 * after the urbs have been re-submitted
623 	 */
624 	clear_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags);
625 
626 	if (!atomic_read(&card->rx_data_urb_pending))
627 		for (i = 0; i < MWIFIEX_RX_DATA_URB; i++)
628 			mwifiex_usb_submit_rx_urb(&card->rx_data_list[i],
629 						  MWIFIEX_RX_DATA_BUF_SIZE);
630 
631 	if (!atomic_read(&card->rx_cmd_urb_pending)) {
632 		card->rx_cmd.skb = dev_alloc_skb(MWIFIEX_RX_CMD_BUF_SIZE);
633 		if (card->rx_cmd.skb)
634 			mwifiex_usb_submit_rx_urb(&card->rx_cmd,
635 						  MWIFIEX_RX_CMD_BUF_SIZE);
636 	}
637 
638 	/* Disable Host Sleep */
639 	if (adapter->hs_activated)
640 		mwifiex_cancel_hs(mwifiex_get_priv(adapter,
641 						   MWIFIEX_BSS_ROLE_ANY),
642 				  MWIFIEX_ASYNC_CMD);
643 
644 	return 0;
645 }
646 
647 static void mwifiex_usb_disconnect(struct usb_interface *intf)
648 {
649 	struct usb_card_rec *card = usb_get_intfdata(intf);
650 	struct mwifiex_adapter *adapter;
651 
652 	wait_for_completion(&card->fw_done);
653 
654 	adapter = card->adapter;
655 	if (!adapter || !adapter->priv_num)
656 		return;
657 
658 	if (card->udev->state != USB_STATE_NOTATTACHED && !adapter->mfg_mode) {
659 		mwifiex_deauthenticate_all(adapter);
660 
661 		mwifiex_init_shutdown_fw(mwifiex_get_priv(adapter,
662 							  MWIFIEX_BSS_ROLE_ANY),
663 					 MWIFIEX_FUNC_SHUTDOWN);
664 	}
665 
666 	mwifiex_dbg(adapter, FATAL,
667 		    "%s: removing card\n", __func__);
668 	mwifiex_remove_card(adapter);
669 
670 	usb_put_dev(interface_to_usbdev(intf));
671 }
672 
673 static void mwifiex_usb_coredump(struct device *dev)
674 {
675 	struct usb_interface *intf = to_usb_interface(dev);
676 	struct usb_card_rec *card = usb_get_intfdata(intf);
677 
678 	mwifiex_fw_dump_event(mwifiex_get_priv(card->adapter,
679 					       MWIFIEX_BSS_ROLE_ANY));
680 }
681 
682 static struct usb_driver mwifiex_usb_driver = {
683 	.name = "mwifiex_usb",
684 	.probe = mwifiex_usb_probe,
685 	.disconnect = mwifiex_usb_disconnect,
686 	.id_table = mwifiex_usb_table,
687 	.suspend = mwifiex_usb_suspend,
688 	.resume = mwifiex_usb_resume,
689 	.soft_unbind = 1,
690 	.drvwrap.driver = {
691 		.coredump = mwifiex_usb_coredump,
692 	},
693 };
694 
695 static int mwifiex_write_data_sync(struct mwifiex_adapter *adapter, u8 *pbuf,
696 				   u32 *len, u8 ep, u32 timeout)
697 {
698 	struct usb_card_rec *card = adapter->card;
699 	int actual_length, ret;
700 
701 	if (!(*len % card->bulk_out_maxpktsize))
702 		(*len)++;
703 
704 	/* Send the data block */
705 	ret = usb_bulk_msg(card->udev, usb_sndbulkpipe(card->udev, ep), pbuf,
706 			   *len, &actual_length, timeout);
707 	if (ret) {
708 		mwifiex_dbg(adapter, ERROR,
709 			    "usb_bulk_msg for tx failed: %d\n", ret);
710 		return ret;
711 	}
712 
713 	*len = actual_length;
714 
715 	return ret;
716 }
717 
718 static int mwifiex_read_data_sync(struct mwifiex_adapter *adapter, u8 *pbuf,
719 				  u32 *len, u8 ep, u32 timeout)
720 {
721 	struct usb_card_rec *card = adapter->card;
722 	int actual_length, ret;
723 
724 	/* Receive the data response */
725 	ret = usb_bulk_msg(card->udev, usb_rcvbulkpipe(card->udev, ep), pbuf,
726 			   *len, &actual_length, timeout);
727 	if (ret) {
728 		mwifiex_dbg(adapter, ERROR,
729 			    "usb_bulk_msg for rx failed: %d\n", ret);
730 		return ret;
731 	}
732 
733 	*len = actual_length;
734 
735 	return ret;
736 }
737 
738 static void mwifiex_usb_port_resync(struct mwifiex_adapter *adapter)
739 {
740 	struct usb_card_rec *card = adapter->card;
741 	u8 active_port = MWIFIEX_USB_EP_DATA;
742 	struct mwifiex_private *priv = NULL;
743 	int i;
744 
745 	if (adapter->usb_mc_status) {
746 		for (i = 0; i < adapter->priv_num; i++) {
747 			priv = adapter->priv[i];
748 			if (!priv)
749 				continue;
750 			if ((priv->bss_role == MWIFIEX_BSS_ROLE_UAP &&
751 			     !priv->bss_started) ||
752 			    (priv->bss_role == MWIFIEX_BSS_ROLE_STA &&
753 			     !priv->media_connected))
754 				priv->usb_port = MWIFIEX_USB_EP_DATA;
755 		}
756 		for (i = 0; i < MWIFIEX_TX_DATA_PORT; i++)
757 			card->port[i].block_status = false;
758 	} else {
759 		for (i = 0; i < adapter->priv_num; i++) {
760 			priv = adapter->priv[i];
761 			if (!priv)
762 				continue;
763 			if ((priv->bss_role == MWIFIEX_BSS_ROLE_UAP &&
764 			     priv->bss_started) ||
765 			    (priv->bss_role == MWIFIEX_BSS_ROLE_STA &&
766 			     priv->media_connected)) {
767 				active_port = priv->usb_port;
768 				break;
769 			}
770 		}
771 		for (i = 0; i < adapter->priv_num; i++) {
772 			priv = adapter->priv[i];
773 			if (priv)
774 				priv->usb_port = active_port;
775 		}
776 		for (i = 0; i < MWIFIEX_TX_DATA_PORT; i++) {
777 			if (active_port == card->port[i].tx_data_ep)
778 				card->port[i].block_status = false;
779 			else
780 				card->port[i].block_status = true;
781 		}
782 	}
783 }
784 
785 static bool mwifiex_usb_is_port_ready(struct mwifiex_private *priv)
786 {
787 	struct usb_card_rec *card = priv->adapter->card;
788 	int idx;
789 
790 	for (idx = 0; idx < MWIFIEX_TX_DATA_PORT; idx++) {
791 		if (priv->usb_port == card->port[idx].tx_data_ep)
792 			return !card->port[idx].block_status;
793 	}
794 
795 	return false;
796 }
797 
798 static inline u8 mwifiex_usb_data_sent(struct mwifiex_adapter *adapter)
799 {
800 	struct usb_card_rec *card = adapter->card;
801 	int i;
802 
803 	for (i = 0; i < MWIFIEX_TX_DATA_PORT; i++)
804 		if (!card->port[i].block_status)
805 			return false;
806 
807 	return true;
808 }
809 
810 static int mwifiex_usb_construct_send_urb(struct mwifiex_adapter *adapter,
811 					  struct usb_tx_data_port *port, u8 ep,
812 					  struct urb_context *context,
813 					  struct sk_buff *skb_send)
814 {
815 	struct usb_card_rec *card = adapter->card;
816 	int ret = -EINPROGRESS;
817 	struct urb *tx_urb;
818 
819 	context->adapter = adapter;
820 	context->ep = ep;
821 	context->skb = skb_send;
822 	tx_urb = context->urb;
823 
824 	if (ep == card->tx_cmd_ep &&
825 	    card->tx_cmd_ep_type == USB_ENDPOINT_XFER_INT)
826 		usb_fill_int_urb(tx_urb, card->udev,
827 				 usb_sndintpipe(card->udev, ep), skb_send->data,
828 				 skb_send->len, mwifiex_usb_tx_complete,
829 				 (void *)context, card->tx_cmd_interval);
830 	else
831 		usb_fill_bulk_urb(tx_urb, card->udev,
832 				  usb_sndbulkpipe(card->udev, ep),
833 				  skb_send->data, skb_send->len,
834 				  mwifiex_usb_tx_complete, (void *)context);
835 
836 	tx_urb->transfer_flags |= URB_ZERO_PACKET;
837 
838 	if (ep == card->tx_cmd_ep)
839 		atomic_inc(&card->tx_cmd_urb_pending);
840 	else
841 		atomic_inc(&port->tx_data_urb_pending);
842 
843 	if (ep != card->tx_cmd_ep &&
844 	    atomic_read(&port->tx_data_urb_pending) ==
845 					MWIFIEX_TX_DATA_URB) {
846 		port->block_status = true;
847 		adapter->data_sent = mwifiex_usb_data_sent(adapter);
848 		ret = -ENOSR;
849 	}
850 
851 	if (usb_submit_urb(tx_urb, GFP_ATOMIC)) {
852 		mwifiex_dbg(adapter, ERROR,
853 			    "%s: usb_submit_urb failed\n", __func__);
854 		if (ep == card->tx_cmd_ep) {
855 			atomic_dec(&card->tx_cmd_urb_pending);
856 		} else {
857 			atomic_dec(&port->tx_data_urb_pending);
858 			port->block_status = false;
859 			adapter->data_sent = false;
860 			if (port->tx_data_ix)
861 				port->tx_data_ix--;
862 			else
863 				port->tx_data_ix = MWIFIEX_TX_DATA_URB;
864 		}
865 		ret = -1;
866 	}
867 
868 	return ret;
869 }
870 
871 static int mwifiex_usb_prepare_tx_aggr_skb(struct mwifiex_adapter *adapter,
872 					   struct usb_tx_data_port *port,
873 					   struct sk_buff **skb_send)
874 {
875 	struct sk_buff *skb_aggr, *skb_tmp;
876 	u8 *payload, pad;
877 	u16 align = adapter->bus_aggr.tx_aggr_align;
878 	struct mwifiex_txinfo *tx_info = NULL;
879 	bool is_txinfo_set = false;
880 
881 	/* Packets in aggr_list will be send in either skb_aggr or
882 	 * write complete, delete the tx_aggr timer
883 	 */
884 	if (port->tx_aggr.timer_cnxt.is_hold_timer_set) {
885 		del_timer(&port->tx_aggr.timer_cnxt.hold_timer);
886 		port->tx_aggr.timer_cnxt.is_hold_timer_set = false;
887 		port->tx_aggr.timer_cnxt.hold_tmo_msecs = 0;
888 	}
889 
890 	skb_aggr = mwifiex_alloc_dma_align_buf(port->tx_aggr.aggr_len,
891 					       GFP_ATOMIC);
892 	if (!skb_aggr) {
893 		mwifiex_dbg(adapter, ERROR,
894 			    "%s: alloc skb_aggr failed\n", __func__);
895 
896 		while ((skb_tmp = skb_dequeue(&port->tx_aggr.aggr_list)))
897 			mwifiex_write_data_complete(adapter, skb_tmp, 0, -1);
898 
899 		port->tx_aggr.aggr_num = 0;
900 		port->tx_aggr.aggr_len = 0;
901 		return -EBUSY;
902 	}
903 
904 	tx_info = MWIFIEX_SKB_TXCB(skb_aggr);
905 	memset(tx_info, 0, sizeof(*tx_info));
906 
907 	while ((skb_tmp = skb_dequeue(&port->tx_aggr.aggr_list))) {
908 		/* padding for aligning next packet header*/
909 		pad = (align - (skb_tmp->len & (align - 1))) % align;
910 		payload = skb_put(skb_aggr, skb_tmp->len + pad);
911 		memcpy(payload, skb_tmp->data, skb_tmp->len);
912 		if (skb_queue_empty(&port->tx_aggr.aggr_list)) {
913 			/* do not padding for last packet*/
914 			*(u16 *)payload = cpu_to_le16(skb_tmp->len);
915 			*(u16 *)&payload[2] =
916 				cpu_to_le16(MWIFIEX_TYPE_AGGR_DATA_V2 | 0x80);
917 			skb_trim(skb_aggr, skb_aggr->len - pad);
918 		} else {
919 			/* add aggregation interface header */
920 			*(u16 *)payload = cpu_to_le16(skb_tmp->len + pad);
921 			*(u16 *)&payload[2] =
922 				cpu_to_le16(MWIFIEX_TYPE_AGGR_DATA_V2);
923 		}
924 
925 		if (!is_txinfo_set) {
926 			tx_info->bss_num = MWIFIEX_SKB_TXCB(skb_tmp)->bss_num;
927 			tx_info->bss_type = MWIFIEX_SKB_TXCB(skb_tmp)->bss_type;
928 			is_txinfo_set = true;
929 		}
930 
931 		port->tx_aggr.aggr_num--;
932 		port->tx_aggr.aggr_len -= (skb_tmp->len + pad);
933 		mwifiex_write_data_complete(adapter, skb_tmp, 0, 0);
934 	}
935 
936 	tx_info->pkt_len = skb_aggr->len -
937 			(sizeof(struct txpd) + adapter->intf_hdr_len);
938 	tx_info->flags |= MWIFIEX_BUF_FLAG_AGGR_PKT;
939 
940 	port->tx_aggr.aggr_num = 0;
941 	port->tx_aggr.aggr_len = 0;
942 	*skb_send = skb_aggr;
943 
944 	return 0;
945 }
946 
947 /* This function prepare data packet to be send under usb tx aggregation
948  * protocol, check current usb aggregation status, link packet to aggrgation
949  * list if possible, work flow as below:
950  * (1) if only 1 packet available, add usb tx aggregation header and send.
951  * (2) if packet is able to aggregated, link it to current aggregation list.
952  * (3) if packet is not able to aggregated, aggregate and send exist packets
953  *     in aggrgation list. Then, link packet in the list if there is more
954  *     packet in transmit queue, otherwise try to transmit single packet.
955  */
956 static int mwifiex_usb_aggr_tx_data(struct mwifiex_adapter *adapter, u8 ep,
957 				    struct sk_buff *skb,
958 				    struct mwifiex_tx_param *tx_param,
959 				    struct usb_tx_data_port *port)
960 {
961 	u8 *payload, pad;
962 	u16 align = adapter->bus_aggr.tx_aggr_align;
963 	struct sk_buff *skb_send = NULL;
964 	struct urb_context *context = NULL;
965 	struct txpd *local_tx_pd =
966 		(struct txpd *)((u8 *)skb->data + adapter->intf_hdr_len);
967 	u8 f_send_aggr_buf = 0;
968 	u8 f_send_cur_buf = 0;
969 	u8 f_precopy_cur_buf = 0;
970 	u8 f_postcopy_cur_buf = 0;
971 	u32 timeout;
972 	int ret;
973 
974 	/* padding to ensure each packet alginment */
975 	pad = (align - (skb->len & (align - 1))) % align;
976 
977 	if (tx_param && tx_param->next_pkt_len) {
978 		/* next packet available in tx queue*/
979 		if (port->tx_aggr.aggr_len + skb->len + pad >
980 		    adapter->bus_aggr.tx_aggr_max_size) {
981 			f_send_aggr_buf = 1;
982 			f_postcopy_cur_buf = 1;
983 		} else {
984 			/* current packet could be aggregated*/
985 			f_precopy_cur_buf = 1;
986 
987 			if (port->tx_aggr.aggr_len + skb->len + pad +
988 			    tx_param->next_pkt_len >
989 			    adapter->bus_aggr.tx_aggr_max_size ||
990 			    port->tx_aggr.aggr_num + 2 >
991 			    adapter->bus_aggr.tx_aggr_max_num) {
992 			    /* next packet could not be aggregated
993 			     * send current aggregation buffer
994 			     */
995 				f_send_aggr_buf = 1;
996 			}
997 		}
998 	} else {
999 		/* last packet in tx queue */
1000 		if (port->tx_aggr.aggr_num > 0) {
1001 			/* pending packets in aggregation buffer*/
1002 			if (port->tx_aggr.aggr_len + skb->len + pad >
1003 			    adapter->bus_aggr.tx_aggr_max_size) {
1004 				/* current packet not be able to aggregated,
1005 				 * send aggr buffer first, then send packet.
1006 				 */
1007 				f_send_cur_buf = 1;
1008 			} else {
1009 				/* last packet, Aggregation and send */
1010 				f_precopy_cur_buf = 1;
1011 			}
1012 
1013 			f_send_aggr_buf = 1;
1014 		} else {
1015 			/* no pending packets in aggregation buffer,
1016 			 * send current packet immediately
1017 			 */
1018 			 f_send_cur_buf = 1;
1019 		}
1020 	}
1021 
1022 	if (local_tx_pd->flags & MWIFIEX_TxPD_POWER_MGMT_NULL_PACKET) {
1023 		/* Send NULL packet immediately*/
1024 		if (f_precopy_cur_buf) {
1025 			if (skb_queue_empty(&port->tx_aggr.aggr_list)) {
1026 				f_precopy_cur_buf = 0;
1027 				f_send_aggr_buf = 0;
1028 				f_send_cur_buf = 1;
1029 			} else {
1030 				f_send_aggr_buf = 1;
1031 			}
1032 		} else if (f_postcopy_cur_buf) {
1033 			f_send_cur_buf = 1;
1034 			f_postcopy_cur_buf = 0;
1035 		}
1036 	}
1037 
1038 	if (f_precopy_cur_buf) {
1039 		skb_queue_tail(&port->tx_aggr.aggr_list, skb);
1040 		port->tx_aggr.aggr_len += (skb->len + pad);
1041 		port->tx_aggr.aggr_num++;
1042 		if (f_send_aggr_buf)
1043 			goto send_aggr_buf;
1044 
1045 		/* packet will not been send immediately,
1046 		 * set a timer to make sure it will be sent under
1047 		 * strict time limit. Dynamically fit the timeout
1048 		 * value, according to packets number in aggr_list
1049 		 */
1050 		if (!port->tx_aggr.timer_cnxt.is_hold_timer_set) {
1051 			port->tx_aggr.timer_cnxt.hold_tmo_msecs =
1052 					MWIFIEX_USB_TX_AGGR_TMO_MIN;
1053 			timeout =
1054 				port->tx_aggr.timer_cnxt.hold_tmo_msecs;
1055 			mod_timer(&port->tx_aggr.timer_cnxt.hold_timer,
1056 				  jiffies + msecs_to_jiffies(timeout));
1057 			port->tx_aggr.timer_cnxt.is_hold_timer_set = true;
1058 		} else {
1059 			if (port->tx_aggr.timer_cnxt.hold_tmo_msecs <
1060 			    MWIFIEX_USB_TX_AGGR_TMO_MAX) {
1061 				/* Dyanmic fit timeout */
1062 				timeout =
1063 				++port->tx_aggr.timer_cnxt.hold_tmo_msecs;
1064 				mod_timer(&port->tx_aggr.timer_cnxt.hold_timer,
1065 					  jiffies + msecs_to_jiffies(timeout));
1066 			}
1067 		}
1068 	}
1069 
1070 send_aggr_buf:
1071 	if (f_send_aggr_buf) {
1072 		ret = mwifiex_usb_prepare_tx_aggr_skb(adapter, port, &skb_send);
1073 		if (!ret) {
1074 			context = &port->tx_data_list[port->tx_data_ix++];
1075 			ret = mwifiex_usb_construct_send_urb(adapter, port, ep,
1076 							     context, skb_send);
1077 			if (ret == -1)
1078 				mwifiex_write_data_complete(adapter, skb_send,
1079 							    0, -1);
1080 		}
1081 	}
1082 
1083 	if (f_send_cur_buf) {
1084 		if (f_send_aggr_buf) {
1085 			if (atomic_read(&port->tx_data_urb_pending) >=
1086 			    MWIFIEX_TX_DATA_URB) {
1087 				port->block_status = true;
1088 				adapter->data_sent =
1089 					mwifiex_usb_data_sent(adapter);
1090 				/* no available urb, postcopy packet*/
1091 				f_postcopy_cur_buf = 1;
1092 				goto postcopy_cur_buf;
1093 			}
1094 
1095 			if (port->tx_data_ix >= MWIFIEX_TX_DATA_URB)
1096 				port->tx_data_ix = 0;
1097 		}
1098 
1099 		payload = skb->data;
1100 		*(u16 *)&payload[2] =
1101 			cpu_to_le16(MWIFIEX_TYPE_AGGR_DATA_V2 | 0x80);
1102 		*(u16 *)payload = cpu_to_le16(skb->len);
1103 		skb_send = skb;
1104 		context = &port->tx_data_list[port->tx_data_ix++];
1105 		return mwifiex_usb_construct_send_urb(adapter, port, ep,
1106 						      context, skb_send);
1107 	}
1108 
1109 postcopy_cur_buf:
1110 	if (f_postcopy_cur_buf) {
1111 		skb_queue_tail(&port->tx_aggr.aggr_list, skb);
1112 		port->tx_aggr.aggr_len += (skb->len + pad);
1113 		port->tx_aggr.aggr_num++;
1114 		/* New aggregation begin, start timer */
1115 		if (!port->tx_aggr.timer_cnxt.is_hold_timer_set) {
1116 			port->tx_aggr.timer_cnxt.hold_tmo_msecs =
1117 					MWIFIEX_USB_TX_AGGR_TMO_MIN;
1118 			timeout = port->tx_aggr.timer_cnxt.hold_tmo_msecs;
1119 			mod_timer(&port->tx_aggr.timer_cnxt.hold_timer,
1120 				  jiffies + msecs_to_jiffies(timeout));
1121 			port->tx_aggr.timer_cnxt.is_hold_timer_set = true;
1122 		}
1123 	}
1124 
1125 	return -EINPROGRESS;
1126 }
1127 
1128 static void mwifiex_usb_tx_aggr_tmo(struct timer_list *t)
1129 {
1130 	struct urb_context *urb_cnxt = NULL;
1131 	struct sk_buff *skb_send = NULL;
1132 	struct tx_aggr_tmr_cnxt *timer_context =
1133 		from_timer(timer_context, t, hold_timer);
1134 	struct mwifiex_adapter *adapter = timer_context->adapter;
1135 	struct usb_tx_data_port *port = timer_context->port;
1136 	int err = 0;
1137 
1138 	spin_lock_bh(&port->tx_aggr_lock);
1139 	err = mwifiex_usb_prepare_tx_aggr_skb(adapter, port, &skb_send);
1140 	if (err) {
1141 		mwifiex_dbg(adapter, ERROR,
1142 			    "prepare tx aggr skb failed, err=%d\n", err);
1143 		goto unlock;
1144 	}
1145 
1146 	if (atomic_read(&port->tx_data_urb_pending) >=
1147 	    MWIFIEX_TX_DATA_URB) {
1148 		port->block_status = true;
1149 		adapter->data_sent =
1150 			mwifiex_usb_data_sent(adapter);
1151 		err = -1;
1152 		goto done;
1153 	}
1154 
1155 	if (port->tx_data_ix >= MWIFIEX_TX_DATA_URB)
1156 		port->tx_data_ix = 0;
1157 
1158 	urb_cnxt = &port->tx_data_list[port->tx_data_ix++];
1159 	err = mwifiex_usb_construct_send_urb(adapter, port, port->tx_data_ep,
1160 					     urb_cnxt, skb_send);
1161 done:
1162 	if (err == -1)
1163 		mwifiex_write_data_complete(adapter, skb_send, 0, -1);
1164 unlock:
1165 	spin_unlock_bh(&port->tx_aggr_lock);
1166 }
1167 
1168 /* This function write a command/data packet to card. */
1169 static int mwifiex_usb_host_to_card(struct mwifiex_adapter *adapter, u8 ep,
1170 				    struct sk_buff *skb,
1171 				    struct mwifiex_tx_param *tx_param)
1172 {
1173 	struct usb_card_rec *card = adapter->card;
1174 	struct urb_context *context = NULL;
1175 	struct usb_tx_data_port *port = NULL;
1176 	int idx, ret;
1177 
1178 	if (test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
1179 		mwifiex_dbg(adapter, ERROR,
1180 			    "%s: not allowed while suspended\n", __func__);
1181 		return -1;
1182 	}
1183 
1184 	if (test_bit(MWIFIEX_SURPRISE_REMOVED, &adapter->work_flags)) {
1185 		mwifiex_dbg(adapter, ERROR, "%s: device removed\n", __func__);
1186 		return -1;
1187 	}
1188 
1189 	mwifiex_dbg(adapter, INFO, "%s: ep=%d\n", __func__, ep);
1190 
1191 	if (ep == card->tx_cmd_ep) {
1192 		context = &card->tx_cmd;
1193 	} else {
1194 		/* get the data port structure for endpoint */
1195 		for (idx = 0; idx < MWIFIEX_TX_DATA_PORT; idx++) {
1196 			if (ep == card->port[idx].tx_data_ep) {
1197 				port = &card->port[idx];
1198 				if (atomic_read(&port->tx_data_urb_pending)
1199 				    >= MWIFIEX_TX_DATA_URB) {
1200 					port->block_status = true;
1201 					adapter->data_sent =
1202 						mwifiex_usb_data_sent(adapter);
1203 					return -EBUSY;
1204 				}
1205 				if (port->tx_data_ix >= MWIFIEX_TX_DATA_URB)
1206 					port->tx_data_ix = 0;
1207 				break;
1208 			}
1209 		}
1210 
1211 		if (!port) {
1212 			mwifiex_dbg(adapter, ERROR, "Wrong usb tx data port\n");
1213 			return -1;
1214 		}
1215 
1216 		if (adapter->bus_aggr.enable) {
1217 			spin_lock_bh(&port->tx_aggr_lock);
1218 			ret =  mwifiex_usb_aggr_tx_data(adapter, ep, skb,
1219 							tx_param, port);
1220 			spin_unlock_bh(&port->tx_aggr_lock);
1221 			return ret;
1222 		}
1223 
1224 		context = &port->tx_data_list[port->tx_data_ix++];
1225 	}
1226 
1227 	return mwifiex_usb_construct_send_urb(adapter, port, ep, context, skb);
1228 }
1229 
1230 static int mwifiex_usb_tx_init(struct mwifiex_adapter *adapter)
1231 {
1232 	struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
1233 	struct usb_tx_data_port *port;
1234 	int i, j;
1235 
1236 	card->tx_cmd.adapter = adapter;
1237 	card->tx_cmd.ep = card->tx_cmd_ep;
1238 
1239 	card->tx_cmd.urb = usb_alloc_urb(0, GFP_KERNEL);
1240 	if (!card->tx_cmd.urb)
1241 		return -ENOMEM;
1242 
1243 	for (i = 0; i < MWIFIEX_TX_DATA_PORT; i++) {
1244 		port = &card->port[i];
1245 		if (!port->tx_data_ep)
1246 			continue;
1247 		port->tx_data_ix = 0;
1248 		skb_queue_head_init(&port->tx_aggr.aggr_list);
1249 		if (port->tx_data_ep == MWIFIEX_USB_EP_DATA)
1250 			port->block_status = false;
1251 		else
1252 			port->block_status = true;
1253 		for (j = 0; j < MWIFIEX_TX_DATA_URB; j++) {
1254 			port->tx_data_list[j].adapter = adapter;
1255 			port->tx_data_list[j].ep = port->tx_data_ep;
1256 			port->tx_data_list[j].urb =
1257 					usb_alloc_urb(0, GFP_KERNEL);
1258 			if (!port->tx_data_list[j].urb)
1259 				return -ENOMEM;
1260 		}
1261 
1262 		port->tx_aggr.timer_cnxt.adapter = adapter;
1263 		port->tx_aggr.timer_cnxt.port = port;
1264 		port->tx_aggr.timer_cnxt.is_hold_timer_set = false;
1265 		port->tx_aggr.timer_cnxt.hold_tmo_msecs = 0;
1266 		timer_setup(&port->tx_aggr.timer_cnxt.hold_timer,
1267 			    mwifiex_usb_tx_aggr_tmo, 0);
1268 	}
1269 
1270 	return 0;
1271 }
1272 
1273 static int mwifiex_usb_rx_init(struct mwifiex_adapter *adapter)
1274 {
1275 	struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
1276 	int i;
1277 
1278 	card->rx_cmd.adapter = adapter;
1279 	card->rx_cmd.ep = card->rx_cmd_ep;
1280 
1281 	card->rx_cmd.urb = usb_alloc_urb(0, GFP_KERNEL);
1282 	if (!card->rx_cmd.urb)
1283 		return -ENOMEM;
1284 
1285 	card->rx_cmd.skb = dev_alloc_skb(MWIFIEX_RX_CMD_BUF_SIZE);
1286 	if (!card->rx_cmd.skb)
1287 		return -ENOMEM;
1288 
1289 	if (mwifiex_usb_submit_rx_urb(&card->rx_cmd, MWIFIEX_RX_CMD_BUF_SIZE))
1290 		return -1;
1291 
1292 	for (i = 0; i < MWIFIEX_RX_DATA_URB; i++) {
1293 		card->rx_data_list[i].adapter = adapter;
1294 		card->rx_data_list[i].ep = card->rx_data_ep;
1295 
1296 		card->rx_data_list[i].urb = usb_alloc_urb(0, GFP_KERNEL);
1297 		if (!card->rx_data_list[i].urb)
1298 			return -1;
1299 		if (mwifiex_usb_submit_rx_urb(&card->rx_data_list[i],
1300 					      MWIFIEX_RX_DATA_BUF_SIZE))
1301 			return -1;
1302 	}
1303 
1304 	return 0;
1305 }
1306 
1307 /* This function register usb device and initialize parameter. */
1308 static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
1309 {
1310 	struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
1311 
1312 	card->adapter = adapter;
1313 
1314 	switch (le16_to_cpu(card->udev->descriptor.idProduct)) {
1315 	case USB8997_PID_1:
1316 	case USB8997_PID_2:
1317 		adapter->tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_4K;
1318 		strcpy(adapter->fw_name, USB8997_DEFAULT_FW_NAME);
1319 		adapter->ext_scan = true;
1320 		break;
1321 	case USB8766_PID_1:
1322 	case USB8766_PID_2:
1323 		adapter->tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K;
1324 		strcpy(adapter->fw_name, USB8766_DEFAULT_FW_NAME);
1325 		adapter->ext_scan = true;
1326 		break;
1327 	case USB8801_PID_1:
1328 	case USB8801_PID_2:
1329 		adapter->tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K;
1330 		strcpy(adapter->fw_name, USB8801_DEFAULT_FW_NAME);
1331 		adapter->ext_scan = false;
1332 		break;
1333 	case USB8797_PID_1:
1334 	case USB8797_PID_2:
1335 	default:
1336 		adapter->tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K;
1337 		strcpy(adapter->fw_name, USB8797_DEFAULT_FW_NAME);
1338 		break;
1339 	}
1340 
1341 	adapter->usb_mc_status = false;
1342 	adapter->usb_mc_setup = false;
1343 
1344 	return 0;
1345 }
1346 
1347 static void mwifiex_usb_cleanup_tx_aggr(struct mwifiex_adapter *adapter)
1348 {
1349 	struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
1350 	struct usb_tx_data_port *port;
1351 	struct sk_buff *skb_tmp;
1352 	int idx;
1353 
1354 	for (idx = 0; idx < MWIFIEX_TX_DATA_PORT; idx++) {
1355 		port = &card->port[idx];
1356 		if (adapter->bus_aggr.enable)
1357 			while ((skb_tmp =
1358 				skb_dequeue(&port->tx_aggr.aggr_list)))
1359 				mwifiex_write_data_complete(adapter, skb_tmp,
1360 							    0, -1);
1361 		if (port->tx_aggr.timer_cnxt.hold_timer.function)
1362 			del_timer_sync(&port->tx_aggr.timer_cnxt.hold_timer);
1363 		port->tx_aggr.timer_cnxt.is_hold_timer_set = false;
1364 		port->tx_aggr.timer_cnxt.hold_tmo_msecs = 0;
1365 	}
1366 }
1367 
1368 static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
1369 {
1370 	struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
1371 
1372 	mwifiex_usb_free(card);
1373 
1374 	mwifiex_usb_cleanup_tx_aggr(adapter);
1375 
1376 	card->adapter = NULL;
1377 }
1378 
1379 static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
1380 				    struct mwifiex_fw_image *fw)
1381 {
1382 	int ret = 0;
1383 	u8 *firmware = fw->fw_buf, *recv_buff;
1384 	u32 retries = USB8XXX_FW_MAX_RETRY + 1;
1385 	u32 dlen;
1386 	u32 fw_seqnum = 0, tlen = 0, dnld_cmd = 0;
1387 	struct fw_data *fwdata;
1388 	struct fw_sync_header sync_fw;
1389 	u8 check_winner = 1;
1390 
1391 	if (!firmware) {
1392 		mwifiex_dbg(adapter, ERROR,
1393 			    "No firmware image found! Terminating download\n");
1394 		ret = -1;
1395 		goto fw_exit;
1396 	}
1397 
1398 	/* Allocate memory for transmit */
1399 	fwdata = kzalloc(FW_DNLD_TX_BUF_SIZE, GFP_KERNEL);
1400 	if (!fwdata) {
1401 		ret = -ENOMEM;
1402 		goto fw_exit;
1403 	}
1404 
1405 	/* Allocate memory for receive */
1406 	recv_buff = kzalloc(FW_DNLD_RX_BUF_SIZE, GFP_KERNEL);
1407 	if (!recv_buff) {
1408 		ret = -ENOMEM;
1409 		goto cleanup;
1410 	}
1411 
1412 	do {
1413 		/* Send pseudo data to check winner status first */
1414 		if (check_winner) {
1415 			memset(&fwdata->fw_hdr, 0, sizeof(struct fw_header));
1416 			dlen = 0;
1417 		} else {
1418 			/* copy the header of the fw_data to get the length */
1419 			memcpy(&fwdata->fw_hdr, &firmware[tlen],
1420 			       sizeof(struct fw_header));
1421 
1422 			dlen = le32_to_cpu(fwdata->fw_hdr.data_len);
1423 			dnld_cmd = le32_to_cpu(fwdata->fw_hdr.dnld_cmd);
1424 			tlen += sizeof(struct fw_header);
1425 
1426 			/* Command 7 doesn't have data length field */
1427 			if (dnld_cmd == FW_CMD_7)
1428 				dlen = 0;
1429 
1430 			memcpy(fwdata->data, &firmware[tlen], dlen);
1431 
1432 			fwdata->seq_num = cpu_to_le32(fw_seqnum);
1433 			tlen += dlen;
1434 		}
1435 
1436 		/* If the send/receive fails or CRC occurs then retry */
1437 		while (--retries) {
1438 			u8 *buf = (u8 *)fwdata;
1439 			u32 len = FW_DATA_XMIT_SIZE;
1440 
1441 			/* send the firmware block */
1442 			ret = mwifiex_write_data_sync(adapter, buf, &len,
1443 						MWIFIEX_USB_EP_CMD_EVENT,
1444 						MWIFIEX_USB_TIMEOUT);
1445 			if (ret) {
1446 				mwifiex_dbg(adapter, ERROR,
1447 					    "write_data_sync: failed: %d\n",
1448 					    ret);
1449 				continue;
1450 			}
1451 
1452 			buf = recv_buff;
1453 			len = FW_DNLD_RX_BUF_SIZE;
1454 
1455 			/* Receive the firmware block response */
1456 			ret = mwifiex_read_data_sync(adapter, buf, &len,
1457 						MWIFIEX_USB_EP_CMD_EVENT,
1458 						MWIFIEX_USB_TIMEOUT);
1459 			if (ret) {
1460 				mwifiex_dbg(adapter, ERROR,
1461 					    "read_data_sync: failed: %d\n",
1462 					    ret);
1463 				continue;
1464 			}
1465 
1466 			memcpy(&sync_fw, recv_buff,
1467 			       sizeof(struct fw_sync_header));
1468 
1469 			/* check 1st firmware block resp for highest bit set */
1470 			if (check_winner) {
1471 				if (le32_to_cpu(sync_fw.cmd) & 0x80000000) {
1472 					mwifiex_dbg(adapter, WARN,
1473 						    "USB is not the winner %#x\n",
1474 						    sync_fw.cmd);
1475 
1476 					/* returning success */
1477 					ret = 0;
1478 					goto cleanup;
1479 				}
1480 
1481 				mwifiex_dbg(adapter, MSG,
1482 					    "start to download FW...\n");
1483 
1484 				check_winner = 0;
1485 				break;
1486 			}
1487 
1488 			/* check the firmware block response for CRC errors */
1489 			if (sync_fw.cmd) {
1490 				mwifiex_dbg(adapter, ERROR,
1491 					    "FW received block with CRC %#x\n",
1492 					    sync_fw.cmd);
1493 				ret = -1;
1494 				continue;
1495 			}
1496 
1497 			retries = USB8XXX_FW_MAX_RETRY + 1;
1498 			break;
1499 		}
1500 		fw_seqnum++;
1501 	} while ((dnld_cmd != FW_HAS_LAST_BLOCK) && retries);
1502 
1503 cleanup:
1504 	mwifiex_dbg(adapter, MSG,
1505 		    "info: FW download over, size %d bytes\n", tlen);
1506 
1507 	kfree(recv_buff);
1508 	kfree(fwdata);
1509 
1510 	if (retries)
1511 		ret = 0;
1512 fw_exit:
1513 	return ret;
1514 }
1515 
1516 static int mwifiex_usb_dnld_fw(struct mwifiex_adapter *adapter,
1517 			struct mwifiex_fw_image *fw)
1518 {
1519 	int ret;
1520 	struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
1521 
1522 	if (card->usb_boot_state == USB8XXX_FW_DNLD) {
1523 		ret = mwifiex_prog_fw_w_helper(adapter, fw);
1524 		if (ret)
1525 			return -1;
1526 
1527 		/* Boot state changes after successful firmware download */
1528 		if (card->usb_boot_state == USB8XXX_FW_DNLD)
1529 			return -1;
1530 	}
1531 
1532 	ret = mwifiex_usb_rx_init(adapter);
1533 	if (!ret)
1534 		ret = mwifiex_usb_tx_init(adapter);
1535 
1536 	return ret;
1537 }
1538 
1539 static void mwifiex_submit_rx_urb(struct mwifiex_adapter *adapter, u8 ep)
1540 {
1541 	struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
1542 
1543 	skb_push(card->rx_cmd.skb, INTF_HEADER_LEN);
1544 	if ((ep == card->rx_cmd_ep) &&
1545 	    (!atomic_read(&card->rx_cmd_urb_pending)))
1546 		mwifiex_usb_submit_rx_urb(&card->rx_cmd,
1547 					  MWIFIEX_RX_CMD_BUF_SIZE);
1548 
1549 	return;
1550 }
1551 
1552 static int mwifiex_usb_cmd_event_complete(struct mwifiex_adapter *adapter,
1553 				       struct sk_buff *skb)
1554 {
1555 	mwifiex_submit_rx_urb(adapter, MWIFIEX_USB_EP_CMD_EVENT);
1556 
1557 	return 0;
1558 }
1559 
1560 /* This function wakes up the card. */
1561 static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
1562 {
1563 	/* Simulation of HS_AWAKE event */
1564 	adapter->pm_wakeup_fw_try = false;
1565 	del_timer(&adapter->wakeup_timer);
1566 	adapter->pm_wakeup_card_req = false;
1567 	adapter->ps_state = PS_STATE_AWAKE;
1568 
1569 	return 0;
1570 }
1571 
1572 static void mwifiex_usb_submit_rem_rx_urbs(struct mwifiex_adapter *adapter)
1573 {
1574 	struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
1575 	int i;
1576 	struct urb_context *ctx;
1577 
1578 	for (i = 0; i < MWIFIEX_RX_DATA_URB; i++) {
1579 		if (card->rx_data_list[i].skb)
1580 			continue;
1581 		ctx = &card->rx_data_list[i];
1582 		mwifiex_usb_submit_rx_urb(ctx, MWIFIEX_RX_DATA_BUF_SIZE);
1583 	}
1584 }
1585 
1586 /* This function is called after the card has woken up. */
1587 static inline int
1588 mwifiex_pm_wakeup_card_complete(struct mwifiex_adapter *adapter)
1589 {
1590 	return 0;
1591 }
1592 
1593 static struct mwifiex_if_ops usb_ops = {
1594 	.register_dev =		mwifiex_register_dev,
1595 	.unregister_dev =	mwifiex_unregister_dev,
1596 	.wakeup =		mwifiex_pm_wakeup_card,
1597 	.wakeup_complete =	mwifiex_pm_wakeup_card_complete,
1598 
1599 	/* USB specific */
1600 	.dnld_fw =		mwifiex_usb_dnld_fw,
1601 	.cmdrsp_complete =	mwifiex_usb_cmd_event_complete,
1602 	.event_complete =	mwifiex_usb_cmd_event_complete,
1603 	.host_to_card =		mwifiex_usb_host_to_card,
1604 	.submit_rem_rx_urbs =	mwifiex_usb_submit_rem_rx_urbs,
1605 	.multi_port_resync =	mwifiex_usb_port_resync,
1606 	.is_port_ready =	mwifiex_usb_is_port_ready,
1607 };
1608 
1609 module_usb_driver(mwifiex_usb_driver);
1610 
1611 MODULE_AUTHOR("Marvell International Ltd.");
1612 MODULE_DESCRIPTION("Marvell WiFi-Ex USB Driver version" USB_VERSION);
1613 MODULE_VERSION(USB_VERSION);
1614 MODULE_LICENSE("GPL v2");
1615 MODULE_FIRMWARE(USB8766_DEFAULT_FW_NAME);
1616 MODULE_FIRMWARE(USB8797_DEFAULT_FW_NAME);
1617 MODULE_FIRMWARE(USB8801_DEFAULT_FW_NAME);
1618 MODULE_FIRMWARE(USB8997_DEFAULT_FW_NAME);
1619