1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46#define DRIVER_NAME "orinoco_usb"
47#define PFX DRIVER_NAME ": "
48
49#include <linux/module.h>
50#include <linux/kernel.h>
51#include <linux/sched.h>
52#include <linux/signal.h>
53#include <linux/errno.h>
54#include <linux/poll.h>
55#include <linux/slab.h>
56#include <linux/fcntl.h>
57#include <linux/spinlock.h>
58#include <linux/list.h>
59#include <linux/usb.h>
60#include <linux/timer.h>
61
62#include <linux/netdevice.h>
63#include <linux/if_arp.h>
64#include <linux/etherdevice.h>
65#include <linux/wireless.h>
66#include <linux/firmware.h>
67#include <linux/refcount.h>
68
69#include "mic.h"
70#include "orinoco.h"
71
72#ifndef URB_ASYNC_UNLINK
73#define URB_ASYNC_UNLINK 0
74#endif
75
76struct header_struct {
77
78 u8 dest[ETH_ALEN];
79 u8 src[ETH_ALEN];
80 __be16 len;
81
82 u8 dsap;
83 u8 ssap;
84 u8 ctrl;
85
86 u8 oui[3];
87 __be16 ethertype;
88} __packed;
89
90struct ez_usb_fw {
91 u16 size;
92 const u8 *code;
93};
94
95static struct ez_usb_fw firmware = {
96 .size = 0,
97 .code = NULL,
98};
99
100
101#undef err
102#define err(format, arg...) \
103 do { printk(KERN_ERR PFX format "\n", ## arg); } while (0)
104
105MODULE_FIRMWARE("orinoco_ezusb_fw");
106
107
108
109
110
111
112
113
114
115
116
117#define USB_COMPAQ_VENDOR_ID 0x049f
118#define USB_COMPAQ_WL215_ID 0x001f
119#define USB_COMPAQ_W200_ID 0x0076
120#define USB_HP_WL215_ID 0x0082
121
122#define USB_MELCO_VENDOR_ID 0x0411
123#define USB_BUFFALO_L11_ID 0x0006
124#define USB_BUFFALO_L11G_WR_ID 0x000B
125#define USB_BUFFALO_L11G_ID 0x000D
126
127#define USB_LUCENT_VENDOR_ID 0x047E
128#define USB_LUCENT_ORINOCO_ID 0x0300
129
130#define USB_AVAYA8_VENDOR_ID 0x0D98
131#define USB_AVAYAE_VENDOR_ID 0x0D9E
132#define USB_AVAYA_WIRELESS_ID 0x0300
133
134#define USB_AGERE_VENDOR_ID 0x0D4E
135#define USB_AGERE_MODEL0801_ID 0x1000
136#define USB_AGERE_MODEL0802_ID 0x1001
137#define USB_AGERE_REBRANDED_ID 0x047A
138
139#define USB_ELSA_VENDOR_ID 0x05CC
140#define USB_ELSA_AIRLANCER_ID 0x3100
141
142#define USB_LEGEND_VENDOR_ID 0x0E7C
143#define USB_LEGEND_JOYNET_ID 0x0300
144
145#define USB_SAMSUNG_VENDOR_ID 0x04E8
146#define USB_SAMSUNG_SEW2001U1_ID 0x5002
147#define USB_SAMSUNG_SEW2001U2_ID 0x5B11
148#define USB_SAMSUNG_SEW2003U_ID 0x7011
149
150#define USB_IGATE_VENDOR_ID 0x0681
151#define USB_IGATE_IGATE_11M_ID 0x0012
152
153#define USB_FUJITSU_VENDOR_ID 0x0BF8
154#define USB_FUJITSU_E1100_ID 0x1002
155
156#define USB_2WIRE_VENDOR_ID 0x1630
157#define USB_2WIRE_WIRELESS_ID 0xff81
158
159
160#define EZUSB_REQUEST_FW_TRANS 0xA0
161#define EZUSB_REQUEST_TRIGGER 0xAA
162#define EZUSB_REQUEST_TRIG_AC 0xAC
163#define EZUSB_CPUCS_REG 0x7F92
164
165#define EZUSB_RID_TX 0x0700
166#define EZUSB_RID_RX 0x0701
167#define EZUSB_RID_INIT1 0x0702
168#define EZUSB_RID_ACK 0x0710
169#define EZUSB_RID_READ_PDA 0x0800
170#define EZUSB_RID_PROG_INIT 0x0852
171#define EZUSB_RID_PROG_SET_ADDR 0x0853
172#define EZUSB_RID_PROG_BYTES 0x0854
173#define EZUSB_RID_PROG_END 0x0855
174#define EZUSB_RID_DOCMD 0x0860
175
176
177#define EZUSB_IS_INFO(id) ((id >= 0xF000) && (id <= 0xF2FF))
178
179#define EZUSB_MAGIC 0x0210
180
181#define EZUSB_FRAME_DATA 1
182#define EZUSB_FRAME_CONTROL 2
183
184#define DEF_TIMEOUT (3 * HZ)
185
186#define BULK_BUF_SIZE 2048
187
188#define MAX_DL_SIZE (BULK_BUF_SIZE - sizeof(struct ezusb_packet))
189
190#define FW_BUF_SIZE 64
191#define FW_VAR_OFFSET_PTR 0x359
192#define FW_VAR_VALUE 0
193#define FW_HOLE_START 0x100
194#define FW_HOLE_END 0x300
195
196struct ezusb_packet {
197 __le16 magic;
198 u8 req_reply_count;
199 u8 ans_reply_count;
200 __le16 frame_type;
201 __le16 size;
202 __le16 crc;
203 __le16 hermes_len;
204 __le16 hermes_rid;
205 u8 data[];
206} __packed;
207
208
209static const struct usb_device_id ezusb_table[] = {
210 {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_COMPAQ_WL215_ID)},
211 {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_HP_WL215_ID)},
212 {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_COMPAQ_W200_ID)},
213 {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11_ID)},
214 {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11G_WR_ID)},
215 {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11G_ID)},
216 {USB_DEVICE(USB_LUCENT_VENDOR_ID, USB_LUCENT_ORINOCO_ID)},
217 {USB_DEVICE(USB_AVAYA8_VENDOR_ID, USB_AVAYA_WIRELESS_ID)},
218 {USB_DEVICE(USB_AVAYAE_VENDOR_ID, USB_AVAYA_WIRELESS_ID)},
219 {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_MODEL0801_ID)},
220 {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_MODEL0802_ID)},
221 {USB_DEVICE(USB_ELSA_VENDOR_ID, USB_ELSA_AIRLANCER_ID)},
222 {USB_DEVICE(USB_LEGEND_VENDOR_ID, USB_LEGEND_JOYNET_ID)},
223 {USB_DEVICE_VER(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2001U1_ID,
224 0, 0)},
225 {USB_DEVICE(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2001U2_ID)},
226 {USB_DEVICE(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2003U_ID)},
227 {USB_DEVICE(USB_IGATE_VENDOR_ID, USB_IGATE_IGATE_11M_ID)},
228 {USB_DEVICE(USB_FUJITSU_VENDOR_ID, USB_FUJITSU_E1100_ID)},
229 {USB_DEVICE(USB_2WIRE_VENDOR_ID, USB_2WIRE_WIRELESS_ID)},
230 {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_REBRANDED_ID)},
231 {}
232};
233
234MODULE_DEVICE_TABLE(usb, ezusb_table);
235
236
237struct ezusb_priv {
238 struct usb_device *udev;
239 struct net_device *dev;
240 struct mutex mtx;
241 spinlock_t req_lock;
242 struct list_head req_pending;
243 struct list_head req_active;
244 spinlock_t reply_count_lock;
245 u16 hermes_reg_fake[0x40];
246 u8 *bap_buf;
247 struct urb *read_urb;
248 int read_pipe;
249 int write_pipe;
250 u8 reply_count;
251};
252
253enum ezusb_state {
254 EZUSB_CTX_START,
255 EZUSB_CTX_QUEUED,
256 EZUSB_CTX_REQ_SUBMITTED,
257 EZUSB_CTX_REQ_COMPLETE,
258 EZUSB_CTX_RESP_RECEIVED,
259 EZUSB_CTX_REQ_TIMEOUT,
260 EZUSB_CTX_REQ_FAILED,
261 EZUSB_CTX_RESP_TIMEOUT,
262 EZUSB_CTX_REQSUBMIT_FAIL,
263 EZUSB_CTX_COMPLETE,
264};
265
266struct request_context {
267 struct list_head list;
268 refcount_t refcount;
269 struct completion done;
270 int killed;
271 struct urb *outurb;
272 struct ezusb_priv *upriv;
273 struct ezusb_packet *buf;
274 int buf_length;
275 struct timer_list timer;
276 enum ezusb_state state;
277
278 u16 out_rid;
279 u16 in_rid;
280};
281
282
283
284static void ezusb_ctx_complete(struct request_context *ctx);
285static void ezusb_req_queue_run(struct ezusb_priv *upriv);
286static void ezusb_bulk_in_callback(struct urb *urb);
287
288static inline u8 ezusb_reply_inc(u8 count)
289{
290 if (count < 0x7F)
291 return count + 1;
292 else
293 return 1;
294}
295
296static void ezusb_request_context_put(struct request_context *ctx)
297{
298 if (!refcount_dec_and_test(&ctx->refcount))
299 return;
300
301 WARN_ON(!ctx->done.done);
302 BUG_ON(ctx->outurb->status == -EINPROGRESS);
303 BUG_ON(timer_pending(&ctx->timer));
304 usb_free_urb(ctx->outurb);
305 kfree(ctx->buf);
306 kfree(ctx);
307}
308
309static inline void ezusb_mod_timer(struct ezusb_priv *upriv,
310 struct timer_list *timer,
311 unsigned long expire)
312{
313 if (!upriv->udev)
314 return;
315 mod_timer(timer, expire);
316}
317
318static void ezusb_request_timerfn(struct timer_list *t)
319{
320 struct request_context *ctx = from_timer(ctx, t, timer);
321
322 ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK;
323 if (usb_unlink_urb(ctx->outurb) == -EINPROGRESS) {
324 ctx->state = EZUSB_CTX_REQ_TIMEOUT;
325 } else {
326 ctx->state = EZUSB_CTX_RESP_TIMEOUT;
327 dev_dbg(&ctx->outurb->dev->dev, "couldn't unlink\n");
328 refcount_inc(&ctx->refcount);
329 ctx->killed = 1;
330 ezusb_ctx_complete(ctx);
331 ezusb_request_context_put(ctx);
332 }
333};
334
335static struct request_context *ezusb_alloc_ctx(struct ezusb_priv *upriv,
336 u16 out_rid, u16 in_rid)
337{
338 struct request_context *ctx;
339
340 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
341 if (!ctx)
342 return NULL;
343
344 ctx->buf = kmalloc(BULK_BUF_SIZE, GFP_ATOMIC);
345 if (!ctx->buf) {
346 kfree(ctx);
347 return NULL;
348 }
349 ctx->outurb = usb_alloc_urb(0, GFP_ATOMIC);
350 if (!ctx->outurb) {
351 kfree(ctx->buf);
352 kfree(ctx);
353 return NULL;
354 }
355
356 ctx->upriv = upriv;
357 ctx->state = EZUSB_CTX_START;
358 ctx->out_rid = out_rid;
359 ctx->in_rid = in_rid;
360
361 refcount_set(&ctx->refcount, 1);
362 init_completion(&ctx->done);
363
364 timer_setup(&ctx->timer, ezusb_request_timerfn, 0);
365 return ctx;
366}
367
368static void ezusb_ctx_complete(struct request_context *ctx)
369{
370 struct ezusb_priv *upriv = ctx->upriv;
371 unsigned long flags;
372
373 spin_lock_irqsave(&upriv->req_lock, flags);
374
375 list_del_init(&ctx->list);
376 if (upriv->udev) {
377 spin_unlock_irqrestore(&upriv->req_lock, flags);
378 ezusb_req_queue_run(upriv);
379 spin_lock_irqsave(&upriv->req_lock, flags);
380 }
381
382 switch (ctx->state) {
383 case EZUSB_CTX_COMPLETE:
384 case EZUSB_CTX_REQSUBMIT_FAIL:
385 case EZUSB_CTX_REQ_FAILED:
386 case EZUSB_CTX_REQ_TIMEOUT:
387 case EZUSB_CTX_RESP_TIMEOUT:
388 spin_unlock_irqrestore(&upriv->req_lock, flags);
389
390 if ((ctx->out_rid == EZUSB_RID_TX) && upriv->dev) {
391 struct net_device *dev = upriv->dev;
392 struct net_device_stats *stats = &dev->stats;
393
394 if (ctx->state != EZUSB_CTX_COMPLETE)
395 stats->tx_errors++;
396 else
397 stats->tx_packets++;
398
399 netif_wake_queue(dev);
400 }
401 complete_all(&ctx->done);
402 ezusb_request_context_put(ctx);
403 break;
404
405 default:
406 spin_unlock_irqrestore(&upriv->req_lock, flags);
407 if (!upriv->udev) {
408
409
410 err("Called, CTX not terminating, but device gone");
411 complete_all(&ctx->done);
412 ezusb_request_context_put(ctx);
413 break;
414 }
415
416 err("Called, CTX not in terminating state.");
417
418
419
420
421
422 break;
423 }
424}
425
426
427
428
429
430
431
432
433static void ezusb_req_queue_run(struct ezusb_priv *upriv)
434{
435 unsigned long flags;
436 struct request_context *ctx;
437 int result;
438
439 spin_lock_irqsave(&upriv->req_lock, flags);
440
441 if (!list_empty(&upriv->req_active))
442 goto unlock;
443
444 if (list_empty(&upriv->req_pending))
445 goto unlock;
446
447 ctx =
448 list_entry(upriv->req_pending.next, struct request_context,
449 list);
450
451 if (!ctx->upriv->udev)
452 goto unlock;
453
454
455 list_move_tail(&ctx->list, &upriv->req_active);
456
457 if (ctx->state == EZUSB_CTX_QUEUED) {
458 refcount_inc(&ctx->refcount);
459 result = usb_submit_urb(ctx->outurb, GFP_ATOMIC);
460 if (result) {
461 ctx->state = EZUSB_CTX_REQSUBMIT_FAIL;
462
463 spin_unlock_irqrestore(&upriv->req_lock, flags);
464
465 err("Fatal, failed to submit command urb."
466 " error=%d\n", result);
467
468 ezusb_ctx_complete(ctx);
469 ezusb_request_context_put(ctx);
470 goto done;
471 }
472
473 ctx->state = EZUSB_CTX_REQ_SUBMITTED;
474 ezusb_mod_timer(ctx->upriv, &ctx->timer,
475 jiffies + DEF_TIMEOUT);
476 }
477
478 unlock:
479 spin_unlock_irqrestore(&upriv->req_lock, flags);
480
481 done:
482 return;
483}
484
485static void ezusb_req_enqueue_run(struct ezusb_priv *upriv,
486 struct request_context *ctx)
487{
488 unsigned long flags;
489
490 spin_lock_irqsave(&upriv->req_lock, flags);
491
492 if (!ctx->upriv->udev) {
493 spin_unlock_irqrestore(&upriv->req_lock, flags);
494 goto done;
495 }
496 refcount_inc(&ctx->refcount);
497 list_add_tail(&ctx->list, &upriv->req_pending);
498 spin_unlock_irqrestore(&upriv->req_lock, flags);
499
500 ctx->state = EZUSB_CTX_QUEUED;
501 ezusb_req_queue_run(upriv);
502
503 done:
504 return;
505}
506
507static void ezusb_request_out_callback(struct urb *urb)
508{
509 unsigned long flags;
510 enum ezusb_state state;
511 struct request_context *ctx = urb->context;
512 struct ezusb_priv *upriv = ctx->upriv;
513
514 spin_lock_irqsave(&upriv->req_lock, flags);
515
516 del_timer(&ctx->timer);
517
518 if (ctx->killed) {
519 spin_unlock_irqrestore(&upriv->req_lock, flags);
520 pr_warn("interrupt called with dead ctx\n");
521 goto out;
522 }
523
524 state = ctx->state;
525
526 if (urb->status == 0) {
527 switch (state) {
528 case EZUSB_CTX_REQ_SUBMITTED:
529 if (ctx->in_rid) {
530 ctx->state = EZUSB_CTX_REQ_COMPLETE;
531
532 ezusb_mod_timer(upriv, &ctx->timer,
533 jiffies + DEF_TIMEOUT);
534 spin_unlock_irqrestore(&upriv->req_lock,
535 flags);
536 break;
537 }
538 fallthrough;
539 case EZUSB_CTX_RESP_RECEIVED:
540
541 ctx->state = EZUSB_CTX_COMPLETE;
542 spin_unlock_irqrestore(&upriv->req_lock, flags);
543 ezusb_ctx_complete(ctx);
544 break;
545
546 default:
547 spin_unlock_irqrestore(&upriv->req_lock, flags);
548 err("Unexpected state(0x%x, %d) in OUT URB",
549 state, urb->status);
550 break;
551 }
552 } else {
553
554
555
556 switch (state) {
557 case EZUSB_CTX_REQ_SUBMITTED:
558 case EZUSB_CTX_RESP_RECEIVED:
559 ctx->state = EZUSB_CTX_REQ_FAILED;
560 fallthrough;
561
562 case EZUSB_CTX_REQ_FAILED:
563 case EZUSB_CTX_REQ_TIMEOUT:
564 spin_unlock_irqrestore(&upriv->req_lock, flags);
565
566 ezusb_ctx_complete(ctx);
567 break;
568
569 default:
570 spin_unlock_irqrestore(&upriv->req_lock, flags);
571
572 err("Unexpected state(0x%x, %d) in OUT URB",
573 state, urb->status);
574 break;
575 }
576 }
577 out:
578 ezusb_request_context_put(ctx);
579}
580
581static void ezusb_request_in_callback(struct ezusb_priv *upriv,
582 struct urb *urb)
583{
584 struct ezusb_packet *ans = urb->transfer_buffer;
585 struct request_context *ctx = NULL;
586 enum ezusb_state state;
587 unsigned long flags;
588
589
590 spin_lock_irqsave(&upriv->req_lock, flags);
591 if (upriv->udev) {
592 struct list_head *item;
593
594 list_for_each(item, &upriv->req_active) {
595 struct request_context *c;
596 int reply_count;
597
598 c = list_entry(item, struct request_context, list);
599 reply_count =
600 ezusb_reply_inc(c->buf->req_reply_count);
601 if ((ans->ans_reply_count == reply_count)
602 && (le16_to_cpu(ans->hermes_rid) == c->in_rid)) {
603 ctx = c;
604 break;
605 }
606 netdev_dbg(upriv->dev, "Skipped (0x%x/0x%x) (%d/%d)\n",
607 le16_to_cpu(ans->hermes_rid), c->in_rid,
608 ans->ans_reply_count, reply_count);
609 }
610 }
611
612 if (ctx == NULL) {
613 spin_unlock_irqrestore(&upriv->req_lock, flags);
614 err("%s: got unexpected RID: 0x%04X", __func__,
615 le16_to_cpu(ans->hermes_rid));
616 ezusb_req_queue_run(upriv);
617 return;
618 }
619
620
621 urb->transfer_buffer = ctx->buf;
622 ctx->buf = (void *) ans;
623 ctx->buf_length = urb->actual_length;
624
625 state = ctx->state;
626 switch (state) {
627 case EZUSB_CTX_REQ_SUBMITTED:
628
629
630
631
632
633 ctx->state = EZUSB_CTX_RESP_RECEIVED;
634 spin_unlock_irqrestore(&upriv->req_lock, flags);
635
636
637 break;
638
639 case EZUSB_CTX_REQ_COMPLETE:
640
641
642
643
644 ctx->state = EZUSB_CTX_COMPLETE;
645
646
647 del_timer(&ctx->timer);
648 spin_unlock_irqrestore(&upriv->req_lock, flags);
649
650
651 ezusb_ctx_complete(ctx);
652 break;
653
654 default:
655 spin_unlock_irqrestore(&upriv->req_lock, flags);
656
657 pr_warn("Matched IN URB, unexpected context state(0x%x)\n",
658 state);
659
660 del_timer(&ctx->timer);
661 ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK;
662 usb_unlink_urb(ctx->outurb);
663 ezusb_req_queue_run(upriv);
664 break;
665 }
666}
667
668
669static void ezusb_req_ctx_wait(struct ezusb_priv *upriv,
670 struct request_context *ctx)
671{
672 switch (ctx->state) {
673 case EZUSB_CTX_QUEUED:
674 case EZUSB_CTX_REQ_SUBMITTED:
675 case EZUSB_CTX_REQ_COMPLETE:
676 case EZUSB_CTX_RESP_RECEIVED:
677 if (in_softirq()) {
678
679
680
681 int msecs = DEF_TIMEOUT * (1000 / HZ);
682
683 while (!try_wait_for_completion(&ctx->done) && msecs--)
684 udelay(1000);
685 } else {
686 wait_for_completion(&ctx->done);
687 }
688 break;
689 default:
690
691 break;
692 }
693}
694
695static inline u16 build_crc(struct ezusb_packet *data)
696{
697 u16 crc = 0;
698 u8 *bytes = (u8 *)data;
699 int i;
700
701 for (i = 0; i < 8; i++)
702 crc = (crc << 1) + bytes[i];
703
704 return crc;
705}
706
707
708
709
710
711
712
713
714static int ezusb_fill_req(struct ezusb_packet *req, u16 length, u16 rid,
715 const void *data, u16 frame_type, u8 reply_count)
716{
717 int total_size = sizeof(*req) + length;
718
719 BUG_ON(total_size > BULK_BUF_SIZE);
720
721 req->magic = cpu_to_le16(EZUSB_MAGIC);
722 req->req_reply_count = reply_count;
723 req->ans_reply_count = 0;
724 req->frame_type = cpu_to_le16(frame_type);
725 req->size = cpu_to_le16(length + 4);
726 req->crc = cpu_to_le16(build_crc(req));
727 req->hermes_len = cpu_to_le16(HERMES_BYTES_TO_RECLEN(length));
728 req->hermes_rid = cpu_to_le16(rid);
729 if (data)
730 memcpy(req->data, data, length);
731 return total_size;
732}
733
734static int ezusb_submit_in_urb(struct ezusb_priv *upriv)
735{
736 int retval = 0;
737 void *cur_buf = upriv->read_urb->transfer_buffer;
738
739 if (upriv->read_urb->status == -EINPROGRESS) {
740 netdev_dbg(upriv->dev, "urb busy, not resubmiting\n");
741 retval = -EBUSY;
742 goto exit;
743 }
744 usb_fill_bulk_urb(upriv->read_urb, upriv->udev, upriv->read_pipe,
745 cur_buf, BULK_BUF_SIZE,
746 ezusb_bulk_in_callback, upriv);
747 upriv->read_urb->transfer_flags = 0;
748 retval = usb_submit_urb(upriv->read_urb, GFP_ATOMIC);
749 if (retval)
750 err("%s submit failed %d", __func__, retval);
751
752 exit:
753 return retval;
754}
755
756static inline int ezusb_8051_cpucs(struct ezusb_priv *upriv, int reset)
757{
758 int ret;
759 u8 *res_val = NULL;
760
761 if (!upriv->udev) {
762 err("%s: !upriv->udev", __func__);
763 return -EFAULT;
764 }
765
766 res_val = kmalloc(sizeof(*res_val), GFP_KERNEL);
767
768 if (!res_val)
769 return -ENOMEM;
770
771 *res_val = reset;
772
773 ret = usb_control_msg(upriv->udev,
774 usb_sndctrlpipe(upriv->udev, 0),
775 EZUSB_REQUEST_FW_TRANS,
776 USB_TYPE_VENDOR | USB_RECIP_DEVICE |
777 USB_DIR_OUT, EZUSB_CPUCS_REG, 0, res_val,
778 sizeof(*res_val), DEF_TIMEOUT);
779
780 kfree(res_val);
781
782 return ret;
783}
784
785static int ezusb_firmware_download(struct ezusb_priv *upriv,
786 struct ez_usb_fw *fw)
787{
788 u8 *fw_buffer;
789 int retval, addr;
790 int variant_offset;
791
792 fw_buffer = kmalloc(FW_BUF_SIZE, GFP_KERNEL);
793 if (!fw_buffer) {
794 printk(KERN_ERR PFX "Out of memory for firmware buffer.\n");
795 return -ENOMEM;
796 }
797
798
799
800
801
802
803 variant_offset = be16_to_cpup((__be16 *) &fw->code[FW_VAR_OFFSET_PTR]);
804 if (variant_offset >= fw->size) {
805 printk(KERN_ERR PFX "Invalid firmware variant offset: "
806 "0x%04x\n", variant_offset);
807 retval = -EINVAL;
808 goto fail;
809 }
810
811 retval = ezusb_8051_cpucs(upriv, 1);
812 if (retval < 0)
813 goto fail;
814 for (addr = 0; addr < fw->size; addr += FW_BUF_SIZE) {
815
816
817 if ((addr >= FW_HOLE_START) && (addr < FW_HOLE_END))
818 continue;
819
820 memcpy(fw_buffer, &fw->code[addr], FW_BUF_SIZE);
821 if (variant_offset >= addr &&
822 variant_offset < addr + FW_BUF_SIZE) {
823 netdev_dbg(upriv->dev,
824 "Patching card_variant byte at 0x%04X\n",
825 variant_offset);
826 fw_buffer[variant_offset - addr] = FW_VAR_VALUE;
827 }
828 retval = usb_control_msg(upriv->udev,
829 usb_sndctrlpipe(upriv->udev, 0),
830 EZUSB_REQUEST_FW_TRANS,
831 USB_TYPE_VENDOR | USB_RECIP_DEVICE
832 | USB_DIR_OUT,
833 addr, 0x0,
834 fw_buffer, FW_BUF_SIZE,
835 DEF_TIMEOUT);
836
837 if (retval < 0)
838 goto fail;
839 }
840 retval = ezusb_8051_cpucs(upriv, 0);
841 if (retval < 0)
842 goto fail;
843
844 goto exit;
845 fail:
846 printk(KERN_ERR PFX "Firmware download failed, error %d\n",
847 retval);
848 exit:
849 kfree(fw_buffer);
850 return retval;
851}
852
853static int ezusb_access_ltv(struct ezusb_priv *upriv,
854 struct request_context *ctx,
855 u16 length, const void *data, u16 frame_type,
856 void *ans_buff, unsigned ans_size, u16 *ans_length)
857{
858 int req_size;
859 int retval = 0;
860 enum ezusb_state state;
861
862 BUG_ON(in_irq());
863
864 if (!upriv->udev) {
865 retval = -ENODEV;
866 goto exit;
867 }
868
869 if (upriv->read_urb->status != -EINPROGRESS)
870 err("%s: in urb not pending", __func__);
871
872
873 spin_lock_bh(&upriv->reply_count_lock);
874 req_size = ezusb_fill_req(ctx->buf, length, ctx->out_rid, data,
875 frame_type, upriv->reply_count);
876 usb_fill_bulk_urb(ctx->outurb, upriv->udev, upriv->write_pipe,
877 ctx->buf, req_size,
878 ezusb_request_out_callback, ctx);
879
880 if (ctx->in_rid)
881 upriv->reply_count = ezusb_reply_inc(upriv->reply_count);
882
883 ezusb_req_enqueue_run(upriv, ctx);
884
885 spin_unlock_bh(&upriv->reply_count_lock);
886
887 if (ctx->in_rid)
888 ezusb_req_ctx_wait(upriv, ctx);
889
890 state = ctx->state;
891 switch (state) {
892 case EZUSB_CTX_COMPLETE:
893 retval = ctx->outurb->status;
894 break;
895
896 case EZUSB_CTX_QUEUED:
897 case EZUSB_CTX_REQ_SUBMITTED:
898 if (!ctx->in_rid)
899 break;
900 fallthrough;
901 default:
902 err("%s: Unexpected context state %d", __func__,
903 state);
904 fallthrough;
905 case EZUSB_CTX_REQ_TIMEOUT:
906 case EZUSB_CTX_REQ_FAILED:
907 case EZUSB_CTX_RESP_TIMEOUT:
908 case EZUSB_CTX_REQSUBMIT_FAIL:
909 printk(KERN_ERR PFX "Access failed, resetting (state %d,"
910 " reply_count %d)\n", state, upriv->reply_count);
911 upriv->reply_count = 0;
912 if (state == EZUSB_CTX_REQ_TIMEOUT
913 || state == EZUSB_CTX_RESP_TIMEOUT) {
914 printk(KERN_ERR PFX "ctx timed out\n");
915 retval = -ETIMEDOUT;
916 } else {
917 printk(KERN_ERR PFX "ctx failed\n");
918 retval = -EFAULT;
919 }
920 goto exit;
921 }
922 if (ctx->in_rid) {
923 struct ezusb_packet *ans = ctx->buf;
924 unsigned exp_len;
925
926 if (ans->hermes_len != 0)
927 exp_len = le16_to_cpu(ans->hermes_len) * 2 + 12;
928 else
929 exp_len = 14;
930
931 if (exp_len != ctx->buf_length) {
932 err("%s: length mismatch for RID 0x%04x: "
933 "expected %d, got %d", __func__,
934 ctx->in_rid, exp_len, ctx->buf_length);
935 retval = -EIO;
936 goto exit;
937 }
938
939 if (ans_buff)
940 memcpy(ans_buff, ans->data, min(exp_len, ans_size));
941 if (ans_length)
942 *ans_length = le16_to_cpu(ans->hermes_len);
943 }
944 exit:
945 ezusb_request_context_put(ctx);
946 return retval;
947}
948
949static int ezusb_write_ltv(struct hermes *hw, int bap, u16 rid,
950 u16 length, const void *data)
951{
952 struct ezusb_priv *upriv = hw->priv;
953 u16 frame_type;
954 struct request_context *ctx;
955
956 if (length == 0)
957 return -EINVAL;
958
959 length = HERMES_RECLEN_TO_BYTES(length);
960
961
962
963 if (length == 0)
964 return 0;
965
966 ctx = ezusb_alloc_ctx(upriv, rid, EZUSB_RID_ACK);
967 if (!ctx)
968 return -ENOMEM;
969
970 if (rid == EZUSB_RID_TX)
971 frame_type = EZUSB_FRAME_DATA;
972 else
973 frame_type = EZUSB_FRAME_CONTROL;
974
975 return ezusb_access_ltv(upriv, ctx, length, data, frame_type,
976 NULL, 0, NULL);
977}
978
979static int ezusb_read_ltv(struct hermes *hw, int bap, u16 rid,
980 unsigned bufsize, u16 *length, void *buf)
981{
982 struct ezusb_priv *upriv = hw->priv;
983 struct request_context *ctx;
984
985 if (bufsize % 2)
986 return -EINVAL;
987
988 ctx = ezusb_alloc_ctx(upriv, rid, rid);
989 if (!ctx)
990 return -ENOMEM;
991
992 return ezusb_access_ltv(upriv, ctx, 0, NULL, EZUSB_FRAME_CONTROL,
993 buf, bufsize, length);
994}
995
996static int ezusb_doicmd_wait(struct hermes *hw, u16 cmd, u16 parm0, u16 parm1,
997 u16 parm2, struct hermes_response *resp)
998{
999 struct ezusb_priv *upriv = hw->priv;
1000 struct request_context *ctx;
1001
1002 __le16 data[4] = {
1003 cpu_to_le16(cmd),
1004 cpu_to_le16(parm0),
1005 cpu_to_le16(parm1),
1006 cpu_to_le16(parm2),
1007 };
1008 netdev_dbg(upriv->dev,
1009 "0x%04X, parm0 0x%04X, parm1 0x%04X, parm2 0x%04X\n", cmd,
1010 parm0, parm1, parm2);
1011 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_DOCMD, EZUSB_RID_ACK);
1012 if (!ctx)
1013 return -ENOMEM;
1014
1015 return ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
1016 EZUSB_FRAME_CONTROL, NULL, 0, NULL);
1017}
1018
1019static int ezusb_docmd_wait(struct hermes *hw, u16 cmd, u16 parm0,
1020 struct hermes_response *resp)
1021{
1022 struct ezusb_priv *upriv = hw->priv;
1023 struct request_context *ctx;
1024
1025 __le16 data[4] = {
1026 cpu_to_le16(cmd),
1027 cpu_to_le16(parm0),
1028 0,
1029 0,
1030 };
1031 netdev_dbg(upriv->dev, "0x%04X, parm0 0x%04X\n", cmd, parm0);
1032 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_DOCMD, EZUSB_RID_ACK);
1033 if (!ctx)
1034 return -ENOMEM;
1035
1036 return ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
1037 EZUSB_FRAME_CONTROL, NULL, 0, NULL);
1038}
1039
1040static int ezusb_bap_pread(struct hermes *hw, int bap,
1041 void *buf, int len, u16 id, u16 offset)
1042{
1043 struct ezusb_priv *upriv = hw->priv;
1044 struct ezusb_packet *ans = (void *) upriv->read_urb->transfer_buffer;
1045 int actual_length = upriv->read_urb->actual_length;
1046
1047 if (id == EZUSB_RID_RX) {
1048 if ((sizeof(*ans) + offset + len) > actual_length) {
1049 printk(KERN_ERR PFX "BAP read beyond buffer end "
1050 "in rx frame\n");
1051 return -EINVAL;
1052 }
1053 memcpy(buf, ans->data + offset, len);
1054 return 0;
1055 }
1056
1057 if (EZUSB_IS_INFO(id)) {
1058
1059 if ((sizeof(*ans) + offset + len - 4) > actual_length) {
1060 printk(KERN_ERR PFX "BAP read beyond buffer end "
1061 "in info frame\n");
1062 return -EFAULT;
1063 }
1064 memcpy(buf, ans->data + offset - 4, len);
1065 } else {
1066 printk(KERN_ERR PFX "Unexpected fid 0x%04x\n", id);
1067 return -EINVAL;
1068 }
1069
1070 return 0;
1071}
1072
1073static int ezusb_read_pda(struct hermes *hw, __le16 *pda,
1074 u32 pda_addr, u16 pda_len)
1075{
1076 struct ezusb_priv *upriv = hw->priv;
1077 struct request_context *ctx;
1078 __le16 data[] = {
1079 cpu_to_le16(pda_addr & 0xffff),
1080 cpu_to_le16(pda_len - 4)
1081 };
1082 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_READ_PDA, EZUSB_RID_READ_PDA);
1083 if (!ctx)
1084 return -ENOMEM;
1085
1086
1087
1088
1089 pda[0] = cpu_to_le16(pda_len - 2);
1090
1091 pda[1] = cpu_to_le16(0x0800);
1092
1093 return ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
1094 EZUSB_FRAME_CONTROL, &pda[2], pda_len - 4,
1095 NULL);
1096}
1097
1098static int ezusb_program_init(struct hermes *hw, u32 entry_point)
1099{
1100 struct ezusb_priv *upriv = hw->priv;
1101 struct request_context *ctx;
1102 __le32 data = cpu_to_le32(entry_point);
1103
1104 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_INIT, EZUSB_RID_ACK);
1105 if (!ctx)
1106 return -ENOMEM;
1107
1108 return ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
1109 EZUSB_FRAME_CONTROL, NULL, 0, NULL);
1110}
1111
1112static int ezusb_program_end(struct hermes *hw)
1113{
1114 struct ezusb_priv *upriv = hw->priv;
1115 struct request_context *ctx;
1116
1117 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_END, EZUSB_RID_ACK);
1118 if (!ctx)
1119 return -ENOMEM;
1120
1121 return ezusb_access_ltv(upriv, ctx, 0, NULL,
1122 EZUSB_FRAME_CONTROL, NULL, 0, NULL);
1123}
1124
1125static int ezusb_program_bytes(struct hermes *hw, const char *buf,
1126 u32 addr, u32 len)
1127{
1128 struct ezusb_priv *upriv = hw->priv;
1129 struct request_context *ctx;
1130 __le32 data = cpu_to_le32(addr);
1131 int err;
1132
1133 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_SET_ADDR, EZUSB_RID_ACK);
1134 if (!ctx)
1135 return -ENOMEM;
1136
1137 err = ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
1138 EZUSB_FRAME_CONTROL, NULL, 0, NULL);
1139 if (err)
1140 return err;
1141
1142 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_BYTES, EZUSB_RID_ACK);
1143 if (!ctx)
1144 return -ENOMEM;
1145
1146 return ezusb_access_ltv(upriv, ctx, len, buf,
1147 EZUSB_FRAME_CONTROL, NULL, 0, NULL);
1148}
1149
1150static int ezusb_program(struct hermes *hw, const char *buf,
1151 u32 addr, u32 len)
1152{
1153 u32 ch_addr;
1154 u32 ch_len;
1155 int err = 0;
1156
1157
1158
1159
1160
1161 ch_len = (len < MAX_DL_SIZE) ? len : MAX_DL_SIZE;
1162 ch_addr = addr;
1163
1164 while (ch_addr < (addr + len)) {
1165 pr_debug("Programming subblock of length %d "
1166 "to address 0x%08x. Data @ %p\n",
1167 ch_len, ch_addr, &buf[ch_addr - addr]);
1168
1169 err = ezusb_program_bytes(hw, &buf[ch_addr - addr],
1170 ch_addr, ch_len);
1171 if (err)
1172 break;
1173
1174 ch_addr += ch_len;
1175 ch_len = ((addr + len - ch_addr) < MAX_DL_SIZE) ?
1176 (addr + len - ch_addr) : MAX_DL_SIZE;
1177 }
1178
1179 return err;
1180}
1181
1182static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
1183{
1184 struct orinoco_private *priv = ndev_priv(dev);
1185 struct net_device_stats *stats = &dev->stats;
1186 struct ezusb_priv *upriv = priv->card;
1187 u8 mic[MICHAEL_MIC_LEN + 1];
1188 int err = 0;
1189 int tx_control;
1190 unsigned long flags;
1191 struct request_context *ctx;
1192 u8 *buf;
1193 int tx_size;
1194
1195 if (!netif_running(dev)) {
1196 printk(KERN_ERR "%s: Tx on stopped device!\n",
1197 dev->name);
1198 return NETDEV_TX_BUSY;
1199 }
1200
1201 if (netif_queue_stopped(dev)) {
1202 printk(KERN_DEBUG "%s: Tx while transmitter busy!\n",
1203 dev->name);
1204 return NETDEV_TX_BUSY;
1205 }
1206
1207 if (orinoco_lock(priv, &flags) != 0) {
1208 printk(KERN_ERR
1209 "%s: ezusb_xmit() called while hw_unavailable\n",
1210 dev->name);
1211 return NETDEV_TX_BUSY;
1212 }
1213
1214 if (!netif_carrier_ok(dev) ||
1215 (priv->iw_mode == NL80211_IFTYPE_MONITOR)) {
1216
1217
1218
1219 goto drop;
1220 }
1221
1222
1223 if (skb->len < ETH_HLEN)
1224 goto drop;
1225
1226 ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
1227 if (!ctx)
1228 goto busy;
1229
1230 memset(ctx->buf, 0, BULK_BUF_SIZE);
1231 buf = ctx->buf->data;
1232
1233 tx_control = 0;
1234
1235 err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
1236 &mic[0]);
1237 if (err)
1238 goto drop;
1239
1240 {
1241 __le16 *tx_cntl = (__le16 *)buf;
1242 *tx_cntl = cpu_to_le16(tx_control);
1243 buf += sizeof(*tx_cntl);
1244 }
1245
1246 memcpy(buf, skb->data, skb->len);
1247 buf += skb->len;
1248
1249 if (tx_control & HERMES_TXCTRL_MIC) {
1250 u8 *m = mic;
1251
1252
1253
1254 if (skb->len % 2)
1255 m++;
1256 memcpy(buf, m, MICHAEL_MIC_LEN);
1257 buf += MICHAEL_MIC_LEN;
1258 }
1259
1260
1261 netif_stop_queue(dev);
1262
1263
1264 tx_size = ALIGN(buf - ctx->buf->data, 2);
1265
1266 err = ezusb_access_ltv(upriv, ctx, tx_size, NULL,
1267 EZUSB_FRAME_DATA, NULL, 0, NULL);
1268
1269 if (err) {
1270 netif_start_queue(dev);
1271 if (net_ratelimit())
1272 printk(KERN_ERR "%s: Error %d transmitting packet\n",
1273 dev->name, err);
1274 goto busy;
1275 }
1276
1277 netif_trans_update(dev);
1278 stats->tx_bytes += skb->len;
1279 goto ok;
1280
1281 drop:
1282 stats->tx_errors++;
1283 stats->tx_dropped++;
1284
1285 ok:
1286 orinoco_unlock(priv, &flags);
1287 dev_kfree_skb(skb);
1288 return NETDEV_TX_OK;
1289
1290 busy:
1291 orinoco_unlock(priv, &flags);
1292 return NETDEV_TX_BUSY;
1293}
1294
1295static int ezusb_allocate(struct hermes *hw, u16 size, u16 *fid)
1296{
1297 *fid = EZUSB_RID_TX;
1298 return 0;
1299}
1300
1301
1302static int ezusb_hard_reset(struct orinoco_private *priv)
1303{
1304 struct ezusb_priv *upriv = priv->card;
1305 int retval = ezusb_8051_cpucs(upriv, 1);
1306
1307 if (retval < 0) {
1308 err("Failed to reset");
1309 return retval;
1310 }
1311
1312 retval = ezusb_8051_cpucs(upriv, 0);
1313 if (retval < 0) {
1314 err("Failed to unreset");
1315 return retval;
1316 }
1317
1318 netdev_dbg(upriv->dev, "sending control message\n");
1319 retval = usb_control_msg(upriv->udev,
1320 usb_sndctrlpipe(upriv->udev, 0),
1321 EZUSB_REQUEST_TRIGGER,
1322 USB_TYPE_VENDOR | USB_RECIP_DEVICE |
1323 USB_DIR_OUT, 0x0, 0x0, NULL, 0,
1324 DEF_TIMEOUT);
1325 if (retval < 0) {
1326 err("EZUSB_REQUEST_TRIGGER failed retval %d", retval);
1327 return retval;
1328 }
1329#if 0
1330 dbg("Sending EZUSB_REQUEST_TRIG_AC");
1331 retval = usb_control_msg(upriv->udev,
1332 usb_sndctrlpipe(upriv->udev, 0),
1333 EZUSB_REQUEST_TRIG_AC,
1334 USB_TYPE_VENDOR | USB_RECIP_DEVICE |
1335 USB_DIR_OUT, 0x00FA, 0x0, NULL, 0,
1336 DEF_TIMEOUT);
1337 if (retval < 0) {
1338 err("EZUSB_REQUEST_TRIG_AC failed retval %d", retval);
1339 return retval;
1340 }
1341#endif
1342
1343 return 0;
1344}
1345
1346
1347static int ezusb_init(struct hermes *hw)
1348{
1349 struct ezusb_priv *upriv = hw->priv;
1350 int retval;
1351
1352 BUG_ON(in_interrupt());
1353 if (!upriv)
1354 return -EINVAL;
1355
1356 upriv->reply_count = 0;
1357
1358
1359 hermes_write_regn(hw, SWSUPPORT0, HERMES_MAGIC);
1360 hermes_write_regn(hw, RXFID, EZUSB_RID_RX);
1361
1362 usb_kill_urb(upriv->read_urb);
1363 ezusb_submit_in_urb(upriv);
1364
1365 retval = ezusb_write_ltv(hw, 0, EZUSB_RID_INIT1,
1366 HERMES_BYTES_TO_RECLEN(2), "\x10\x00");
1367 if (retval < 0) {
1368 printk(KERN_ERR PFX "EZUSB_RID_INIT1 error %d\n", retval);
1369 return retval;
1370 }
1371
1372 retval = ezusb_docmd_wait(hw, HERMES_CMD_INIT, 0, NULL);
1373 if (retval < 0) {
1374 printk(KERN_ERR PFX "HERMES_CMD_INIT error %d\n", retval);
1375 return retval;
1376 }
1377
1378 return 0;
1379}
1380
1381static void ezusb_bulk_in_callback(struct urb *urb)
1382{
1383 struct ezusb_priv *upriv = (struct ezusb_priv *) urb->context;
1384 struct ezusb_packet *ans = urb->transfer_buffer;
1385 u16 crc;
1386 u16 hermes_rid;
1387
1388 if (upriv->udev == NULL)
1389 return;
1390
1391 if (urb->status == -ETIMEDOUT) {
1392
1393
1394
1395 pr_warn("%s: urb timed out, not resubmitting\n", __func__);
1396 return;
1397 }
1398 if (urb->status == -ECONNABORTED) {
1399 pr_warn("%s: connection abort, resubmitting urb\n",
1400 __func__);
1401 goto resubmit;
1402 }
1403 if ((urb->status == -EILSEQ)
1404 || (urb->status == -ENOENT)
1405 || (urb->status == -ECONNRESET)) {
1406 netdev_dbg(upriv->dev, "status %d, not resubmiting\n",
1407 urb->status);
1408 return;
1409 }
1410 if (urb->status)
1411 netdev_dbg(upriv->dev, "status: %d length: %d\n",
1412 urb->status, urb->actual_length);
1413 if (urb->actual_length < sizeof(*ans)) {
1414 err("%s: short read, ignoring", __func__);
1415 goto resubmit;
1416 }
1417 crc = build_crc(ans);
1418 if (le16_to_cpu(ans->crc) != crc) {
1419 err("CRC error, ignoring packet");
1420 goto resubmit;
1421 }
1422
1423 hermes_rid = le16_to_cpu(ans->hermes_rid);
1424 if ((hermes_rid != EZUSB_RID_RX) && !EZUSB_IS_INFO(hermes_rid)) {
1425 ezusb_request_in_callback(upriv, urb);
1426 } else if (upriv->dev) {
1427 struct net_device *dev = upriv->dev;
1428 struct orinoco_private *priv = ndev_priv(dev);
1429 struct hermes *hw = &priv->hw;
1430
1431 if (hermes_rid == EZUSB_RID_RX) {
1432 __orinoco_ev_rx(dev, hw);
1433 } else {
1434 hermes_write_regn(hw, INFOFID,
1435 le16_to_cpu(ans->hermes_rid));
1436 __orinoco_ev_info(dev, hw);
1437 }
1438 }
1439
1440 resubmit:
1441 if (upriv->udev)
1442 ezusb_submit_in_urb(upriv);
1443}
1444
1445static inline void ezusb_delete(struct ezusb_priv *upriv)
1446{
1447 struct list_head *item;
1448 struct list_head *tmp_item;
1449 unsigned long flags;
1450
1451 BUG_ON(in_interrupt());
1452 BUG_ON(!upriv);
1453
1454 mutex_lock(&upriv->mtx);
1455
1456 upriv->udev = NULL;
1457
1458 usb_kill_urb(upriv->read_urb);
1459
1460 spin_lock_irqsave(&upriv->req_lock, flags);
1461 list_for_each_safe(item, tmp_item, &upriv->req_active) {
1462 struct request_context *ctx;
1463 int err;
1464
1465 ctx = list_entry(item, struct request_context, list);
1466 refcount_inc(&ctx->refcount);
1467
1468 ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK;
1469 err = usb_unlink_urb(ctx->outurb);
1470
1471 spin_unlock_irqrestore(&upriv->req_lock, flags);
1472 if (err == -EINPROGRESS)
1473 wait_for_completion(&ctx->done);
1474
1475 del_timer_sync(&ctx->timer);
1476
1477
1478 if (!list_empty(&ctx->list))
1479 ezusb_ctx_complete(ctx);
1480
1481 ezusb_request_context_put(ctx);
1482 spin_lock_irqsave(&upriv->req_lock, flags);
1483 }
1484 spin_unlock_irqrestore(&upriv->req_lock, flags);
1485
1486 list_for_each_safe(item, tmp_item, &upriv->req_pending)
1487 ezusb_ctx_complete(list_entry(item,
1488 struct request_context, list));
1489
1490 if (upriv->read_urb && upriv->read_urb->status == -EINPROGRESS)
1491 printk(KERN_ERR PFX "Some URB in progress\n");
1492
1493 mutex_unlock(&upriv->mtx);
1494
1495 if (upriv->read_urb) {
1496 kfree(upriv->read_urb->transfer_buffer);
1497 usb_free_urb(upriv->read_urb);
1498 }
1499 kfree(upriv->bap_buf);
1500 if (upriv->dev) {
1501 struct orinoco_private *priv = ndev_priv(upriv->dev);
1502 orinoco_if_del(priv);
1503 wiphy_unregister(priv_to_wiphy(upriv));
1504 free_orinocodev(priv);
1505 }
1506}
1507
1508static void ezusb_lock_irqsave(spinlock_t *lock,
1509 unsigned long *flags) __acquires(lock)
1510{
1511 spin_lock_bh(lock);
1512}
1513
1514static void ezusb_unlock_irqrestore(spinlock_t *lock,
1515 unsigned long *flags) __releases(lock)
1516{
1517 spin_unlock_bh(lock);
1518}
1519
1520static void ezusb_lock_irq(spinlock_t *lock) __acquires(lock)
1521{
1522 spin_lock_bh(lock);
1523}
1524
1525static void ezusb_unlock_irq(spinlock_t *lock) __releases(lock)
1526{
1527 spin_unlock_bh(lock);
1528}
1529
1530static const struct hermes_ops ezusb_ops = {
1531 .init = ezusb_init,
1532 .cmd_wait = ezusb_docmd_wait,
1533 .init_cmd_wait = ezusb_doicmd_wait,
1534 .allocate = ezusb_allocate,
1535 .read_ltv = ezusb_read_ltv,
1536 .write_ltv = ezusb_write_ltv,
1537 .bap_pread = ezusb_bap_pread,
1538 .read_pda = ezusb_read_pda,
1539 .program_init = ezusb_program_init,
1540 .program_end = ezusb_program_end,
1541 .program = ezusb_program,
1542 .lock_irqsave = ezusb_lock_irqsave,
1543 .unlock_irqrestore = ezusb_unlock_irqrestore,
1544 .lock_irq = ezusb_lock_irq,
1545 .unlock_irq = ezusb_unlock_irq,
1546};
1547
1548static const struct net_device_ops ezusb_netdev_ops = {
1549 .ndo_open = orinoco_open,
1550 .ndo_stop = orinoco_stop,
1551 .ndo_start_xmit = ezusb_xmit,
1552 .ndo_set_rx_mode = orinoco_set_multicast_list,
1553 .ndo_change_mtu = orinoco_change_mtu,
1554 .ndo_set_mac_address = eth_mac_addr,
1555 .ndo_validate_addr = eth_validate_addr,
1556 .ndo_tx_timeout = orinoco_tx_timeout,
1557};
1558
1559static int ezusb_probe(struct usb_interface *interface,
1560 const struct usb_device_id *id)
1561{
1562 struct usb_device *udev = interface_to_usbdev(interface);
1563 struct orinoco_private *priv;
1564 struct hermes *hw;
1565 struct ezusb_priv *upriv = NULL;
1566 struct usb_interface_descriptor *iface_desc;
1567 struct usb_endpoint_descriptor *ep;
1568 const struct firmware *fw_entry = NULL;
1569 int retval = 0;
1570 int i;
1571
1572 priv = alloc_orinocodev(sizeof(*upriv), &udev->dev,
1573 ezusb_hard_reset, NULL);
1574 if (!priv) {
1575 err("Couldn't allocate orinocodev");
1576 retval = -ENOMEM;
1577 goto exit;
1578 }
1579
1580 hw = &priv->hw;
1581
1582 upriv = priv->card;
1583
1584 mutex_init(&upriv->mtx);
1585 spin_lock_init(&upriv->reply_count_lock);
1586
1587 spin_lock_init(&upriv->req_lock);
1588 INIT_LIST_HEAD(&upriv->req_pending);
1589 INIT_LIST_HEAD(&upriv->req_active);
1590
1591 upriv->udev = udev;
1592
1593 hw->iobase = (void __force __iomem *) &upriv->hermes_reg_fake;
1594 hw->reg_spacing = HERMES_16BIT_REGSPACING;
1595 hw->priv = upriv;
1596 hw->ops = &ezusb_ops;
1597
1598
1599
1600
1601 iface_desc = &interface->cur_altsetting->desc;
1602 for (i = 0; i < iface_desc->bNumEndpoints; ++i) {
1603 ep = &interface->cur_altsetting->endpoint[i].desc;
1604
1605 if (usb_endpoint_is_bulk_in(ep)) {
1606
1607 if (upriv->read_urb != NULL) {
1608 pr_warn("Found a second bulk in ep, ignored\n");
1609 continue;
1610 }
1611
1612 upriv->read_urb = usb_alloc_urb(0, GFP_KERNEL);
1613 if (!upriv->read_urb)
1614 goto error;
1615 if (le16_to_cpu(ep->wMaxPacketSize) != 64)
1616 pr_warn("bulk in: wMaxPacketSize!= 64\n");
1617 if (ep->bEndpointAddress != (2 | USB_DIR_IN))
1618 pr_warn("bulk in: bEndpointAddress: %d\n",
1619 ep->bEndpointAddress);
1620 upriv->read_pipe = usb_rcvbulkpipe(udev,
1621 ep->
1622 bEndpointAddress);
1623 upriv->read_urb->transfer_buffer =
1624 kmalloc(BULK_BUF_SIZE, GFP_KERNEL);
1625 if (!upriv->read_urb->transfer_buffer) {
1626 err("Couldn't allocate IN buffer");
1627 goto error;
1628 }
1629 }
1630
1631 if (usb_endpoint_is_bulk_out(ep)) {
1632
1633 if (upriv->bap_buf != NULL) {
1634 pr_warn("Found a second bulk out ep, ignored\n");
1635 continue;
1636 }
1637
1638 if (le16_to_cpu(ep->wMaxPacketSize) != 64)
1639 pr_warn("bulk out: wMaxPacketSize != 64\n");
1640 if (ep->bEndpointAddress != 2)
1641 pr_warn("bulk out: bEndpointAddress: %d\n",
1642 ep->bEndpointAddress);
1643 upriv->write_pipe = usb_sndbulkpipe(udev,
1644 ep->
1645 bEndpointAddress);
1646 upriv->bap_buf = kmalloc(BULK_BUF_SIZE, GFP_KERNEL);
1647 if (!upriv->bap_buf) {
1648 err("Couldn't allocate bulk_out_buffer");
1649 goto error;
1650 }
1651 }
1652 }
1653 if (!upriv->bap_buf || !upriv->read_urb) {
1654 err("Didn't find the required bulk endpoints");
1655 goto error;
1656 }
1657
1658 if (request_firmware(&fw_entry, "orinoco_ezusb_fw",
1659 &interface->dev) == 0) {
1660 firmware.size = fw_entry->size;
1661 firmware.code = fw_entry->data;
1662 }
1663 if (firmware.size && firmware.code) {
1664 if (ezusb_firmware_download(upriv, &firmware) < 0)
1665 goto error;
1666 } else {
1667 err("No firmware to download");
1668 goto error;
1669 }
1670
1671 if (ezusb_hard_reset(priv) < 0) {
1672 err("Cannot reset the device");
1673 goto error;
1674 }
1675
1676
1677
1678
1679
1680 if (ezusb_init(hw) < 0) {
1681 err("Couldn't initialize the device");
1682 err("Firmware may not be downloaded or may be wrong.");
1683 goto error;
1684 }
1685
1686
1687 if (orinoco_init(priv) != 0) {
1688 err("orinoco_init() failed\n");
1689 goto error;
1690 }
1691
1692 if (orinoco_if_add(priv, 0, 0, &ezusb_netdev_ops) != 0) {
1693 upriv->dev = NULL;
1694 err("%s: orinoco_if_add() failed", __func__);
1695 wiphy_unregister(priv_to_wiphy(priv));
1696 goto error;
1697 }
1698 upriv->dev = priv->ndev;
1699
1700 goto exit;
1701
1702 error:
1703 ezusb_delete(upriv);
1704 if (upriv->dev) {
1705
1706 free_orinocodev(priv);
1707 }
1708 upriv = NULL;
1709 retval = -EFAULT;
1710 exit:
1711 if (fw_entry) {
1712 firmware.code = NULL;
1713 firmware.size = 0;
1714 release_firmware(fw_entry);
1715 }
1716 usb_set_intfdata(interface, upriv);
1717 return retval;
1718}
1719
1720
1721static void ezusb_disconnect(struct usb_interface *intf)
1722{
1723 struct ezusb_priv *upriv = usb_get_intfdata(intf);
1724 usb_set_intfdata(intf, NULL);
1725 ezusb_delete(upriv);
1726 printk(KERN_INFO PFX "Disconnected\n");
1727}
1728
1729
1730
1731static struct usb_driver orinoco_driver = {
1732 .name = DRIVER_NAME,
1733 .probe = ezusb_probe,
1734 .disconnect = ezusb_disconnect,
1735 .id_table = ezusb_table,
1736 .disable_hub_initiated_lpm = 1,
1737};
1738
1739module_usb_driver(orinoco_driver);
1740
1741MODULE_AUTHOR("Manuel Estrada Sainz");
1742MODULE_DESCRIPTION("Driver for Orinoco wireless LAN cards using EZUSB bridge");
1743MODULE_LICENSE("Dual MPL/GPL");
1744