cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

hif_usb.c (34881B)


      1/*
      2 * Copyright (c) 2010-2011 Atheros Communications Inc.
      3 *
      4 * Permission to use, copy, modify, and/or distribute this software for any
      5 * purpose with or without fee is hereby granted, provided that the above
      6 * copyright notice and this permission notice appear in all copies.
      7 *
      8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
      9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
     10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
     11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
     12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
     13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
     14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
     15 */
     16
     17#include <asm/unaligned.h>
     18#include "htc.h"
     19
     20MODULE_FIRMWARE(HTC_7010_MODULE_FW);
     21MODULE_FIRMWARE(HTC_9271_MODULE_FW);
     22
     23static const struct usb_device_id ath9k_hif_usb_ids[] = {
     24	{ USB_DEVICE(0x0cf3, 0x9271) }, /* Atheros */
     25	{ USB_DEVICE(0x0cf3, 0x1006) }, /* Atheros */
     26	{ USB_DEVICE(0x0846, 0x9030) }, /* Netgear N150 */
     27	{ USB_DEVICE(0x07b8, 0x9271) }, /* Altai WA1011N-GU */
     28	{ USB_DEVICE(0x07D1, 0x3A10) }, /* Dlink Wireless 150 */
     29	{ USB_DEVICE(0x13D3, 0x3327) }, /* Azurewave */
     30	{ USB_DEVICE(0x13D3, 0x3328) }, /* Azurewave */
     31	{ USB_DEVICE(0x13D3, 0x3346) }, /* IMC Networks */
     32	{ USB_DEVICE(0x13D3, 0x3348) }, /* Azurewave */
     33	{ USB_DEVICE(0x13D3, 0x3349) }, /* Azurewave */
     34	{ USB_DEVICE(0x13D3, 0x3350) }, /* Azurewave */
     35	{ USB_DEVICE(0x04CA, 0x4605) }, /* Liteon */
     36	{ USB_DEVICE(0x040D, 0x3801) }, /* VIA */
     37	{ USB_DEVICE(0x0cf3, 0xb003) }, /* Ubiquiti WifiStation Ext */
     38	{ USB_DEVICE(0x0cf3, 0xb002) }, /* Ubiquiti WifiStation */
     39	{ USB_DEVICE(0x057c, 0x8403) }, /* AVM FRITZ!WLAN 11N v2 USB */
     40	{ USB_DEVICE(0x0471, 0x209e) }, /* Philips (or NXP) PTA01 */
     41	{ USB_DEVICE(0x1eda, 0x2315) }, /* AirTies */
     42
     43	{ USB_DEVICE(0x0cf3, 0x7015),
     44	  .driver_info = AR9287_USB },  /* Atheros */
     45	{ USB_DEVICE(0x1668, 0x1200),
     46	  .driver_info = AR9287_USB },  /* Verizon */
     47
     48	{ USB_DEVICE(0x0cf3, 0x7010),
     49	  .driver_info = AR9280_USB },  /* Atheros */
     50	{ USB_DEVICE(0x0846, 0x9018),
     51	  .driver_info = AR9280_USB },  /* Netgear WNDA3200 */
     52	{ USB_DEVICE(0x083A, 0xA704),
     53	  .driver_info = AR9280_USB },  /* SMC Networks */
     54	{ USB_DEVICE(0x0411, 0x017f),
     55	  .driver_info = AR9280_USB },  /* Sony UWA-BR100 */
     56	{ USB_DEVICE(0x0411, 0x0197),
     57	  .driver_info = AR9280_USB },  /* Buffalo WLI-UV-AG300P */
     58	{ USB_DEVICE(0x04da, 0x3904),
     59	  .driver_info = AR9280_USB },
     60	{ USB_DEVICE(0x0930, 0x0a08),
     61	  .driver_info = AR9280_USB },  /* Toshiba WLM-20U2 and GN-1080 */
     62
     63	{ USB_DEVICE(0x0cf3, 0x20ff),
     64	  .driver_info = STORAGE_DEVICE },
     65
     66	{ },
     67};
     68
     69MODULE_DEVICE_TABLE(usb, ath9k_hif_usb_ids);
     70
     71static int __hif_usb_tx(struct hif_device_usb *hif_dev);
     72
     73static void hif_usb_regout_cb(struct urb *urb)
     74{
     75	struct cmd_buf *cmd = (struct cmd_buf *)urb->context;
     76
     77	switch (urb->status) {
     78	case 0:
     79		break;
     80	case -ENOENT:
     81	case -ECONNRESET:
     82	case -ENODEV:
     83	case -ESHUTDOWN:
     84		goto free;
     85	default:
     86		break;
     87	}
     88
     89	if (cmd) {
     90		ath9k_htc_txcompletion_cb(cmd->hif_dev->htc_handle,
     91					  cmd->skb, true);
     92		kfree(cmd);
     93	}
     94
     95	return;
     96free:
     97	kfree_skb(cmd->skb);
     98	kfree(cmd);
     99}
    100
    101static int hif_usb_send_regout(struct hif_device_usb *hif_dev,
    102			       struct sk_buff *skb)
    103{
    104	struct urb *urb;
    105	struct cmd_buf *cmd;
    106	int ret = 0;
    107
    108	urb = usb_alloc_urb(0, GFP_KERNEL);
    109	if (urb == NULL)
    110		return -ENOMEM;
    111
    112	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
    113	if (cmd == NULL) {
    114		usb_free_urb(urb);
    115		return -ENOMEM;
    116	}
    117
    118	cmd->skb = skb;
    119	cmd->hif_dev = hif_dev;
    120
    121	usb_fill_int_urb(urb, hif_dev->udev,
    122			 usb_sndintpipe(hif_dev->udev, USB_REG_OUT_PIPE),
    123			 skb->data, skb->len,
    124			 hif_usb_regout_cb, cmd, 1);
    125
    126	usb_anchor_urb(urb, &hif_dev->regout_submitted);
    127	ret = usb_submit_urb(urb, GFP_KERNEL);
    128	if (ret) {
    129		usb_unanchor_urb(urb);
    130		kfree(cmd);
    131	}
    132	usb_free_urb(urb);
    133
    134	return ret;
    135}
    136
    137static void hif_usb_mgmt_cb(struct urb *urb)
    138{
    139	struct cmd_buf *cmd = (struct cmd_buf *)urb->context;
    140	struct hif_device_usb *hif_dev;
    141	unsigned long flags;
    142	bool txok = true;
    143
    144	if (!cmd || !cmd->skb || !cmd->hif_dev)
    145		return;
    146
    147	hif_dev = cmd->hif_dev;
    148
    149	switch (urb->status) {
    150	case 0:
    151		break;
    152	case -ENOENT:
    153	case -ECONNRESET:
    154	case -ENODEV:
    155	case -ESHUTDOWN:
    156		txok = false;
    157
    158		/*
    159		 * If the URBs are being flushed, no need to complete
    160		 * this packet.
    161		 */
    162		spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    163		if (hif_dev->tx.flags & HIF_USB_TX_FLUSH) {
    164			spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    165			dev_kfree_skb_any(cmd->skb);
    166			kfree(cmd);
    167			return;
    168		}
    169		spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    170
    171		break;
    172	default:
    173		txok = false;
    174		break;
    175	}
    176
    177	skb_pull(cmd->skb, 4);
    178	ath9k_htc_txcompletion_cb(cmd->hif_dev->htc_handle,
    179				  cmd->skb, txok);
    180	kfree(cmd);
    181}
    182
    183static int hif_usb_send_mgmt(struct hif_device_usb *hif_dev,
    184			     struct sk_buff *skb)
    185{
    186	struct urb *urb;
    187	struct cmd_buf *cmd;
    188	int ret = 0;
    189	__le16 *hdr;
    190
    191	urb = usb_alloc_urb(0, GFP_ATOMIC);
    192	if (urb == NULL)
    193		return -ENOMEM;
    194
    195	cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
    196	if (cmd == NULL) {
    197		usb_free_urb(urb);
    198		return -ENOMEM;
    199	}
    200
    201	cmd->skb = skb;
    202	cmd->hif_dev = hif_dev;
    203
    204	hdr = skb_push(skb, 4);
    205	*hdr++ = cpu_to_le16(skb->len - 4);
    206	*hdr++ = cpu_to_le16(ATH_USB_TX_STREAM_MODE_TAG);
    207
    208	usb_fill_bulk_urb(urb, hif_dev->udev,
    209			 usb_sndbulkpipe(hif_dev->udev, USB_WLAN_TX_PIPE),
    210			 skb->data, skb->len,
    211			 hif_usb_mgmt_cb, cmd);
    212
    213	usb_anchor_urb(urb, &hif_dev->mgmt_submitted);
    214	ret = usb_submit_urb(urb, GFP_ATOMIC);
    215	if (ret) {
    216		usb_unanchor_urb(urb);
    217		kfree(cmd);
    218	}
    219	usb_free_urb(urb);
    220
    221	return ret;
    222}
    223
    224static inline void ath9k_skb_queue_purge(struct hif_device_usb *hif_dev,
    225					 struct sk_buff_head *list)
    226{
    227	struct sk_buff *skb;
    228
    229	while ((skb = __skb_dequeue(list)) != NULL) {
    230		dev_kfree_skb_any(skb);
    231	}
    232}
    233
    234static inline void ath9k_skb_queue_complete(struct hif_device_usb *hif_dev,
    235					    struct sk_buff_head *queue,
    236					    bool txok)
    237{
    238	struct sk_buff *skb;
    239
    240	while ((skb = __skb_dequeue(queue)) != NULL) {
    241#ifdef CONFIG_ATH9K_HTC_DEBUGFS
    242		int ln = skb->len;
    243#endif
    244		ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
    245					  skb, txok);
    246		if (txok) {
    247			TX_STAT_INC(skb_success);
    248			TX_STAT_ADD(skb_success_bytes, ln);
    249		}
    250		else
    251			TX_STAT_INC(skb_failed);
    252	}
    253}
    254
    255static void hif_usb_tx_cb(struct urb *urb)
    256{
    257	struct tx_buf *tx_buf = (struct tx_buf *) urb->context;
    258	struct hif_device_usb *hif_dev;
    259	bool txok = true;
    260
    261	if (!tx_buf || !tx_buf->hif_dev)
    262		return;
    263
    264	hif_dev = tx_buf->hif_dev;
    265
    266	switch (urb->status) {
    267	case 0:
    268		break;
    269	case -ENOENT:
    270	case -ECONNRESET:
    271	case -ENODEV:
    272	case -ESHUTDOWN:
    273		txok = false;
    274
    275		/*
    276		 * If the URBs are being flushed, no need to add this
    277		 * URB to the free list.
    278		 */
    279		spin_lock(&hif_dev->tx.tx_lock);
    280		if (hif_dev->tx.flags & HIF_USB_TX_FLUSH) {
    281			spin_unlock(&hif_dev->tx.tx_lock);
    282			ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
    283			return;
    284		}
    285		spin_unlock(&hif_dev->tx.tx_lock);
    286
    287		break;
    288	default:
    289		txok = false;
    290		break;
    291	}
    292
    293	ath9k_skb_queue_complete(hif_dev, &tx_buf->skb_queue, txok);
    294
    295	/* Re-initialize the SKB queue */
    296	tx_buf->len = tx_buf->offset = 0;
    297	__skb_queue_head_init(&tx_buf->skb_queue);
    298
    299	/* Add this TX buffer to the free list */
    300	spin_lock(&hif_dev->tx.tx_lock);
    301	list_move_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
    302	hif_dev->tx.tx_buf_cnt++;
    303	if (!(hif_dev->tx.flags & HIF_USB_TX_STOP))
    304		__hif_usb_tx(hif_dev); /* Check for pending SKBs */
    305	TX_STAT_INC(buf_completed);
    306	spin_unlock(&hif_dev->tx.tx_lock);
    307}
    308
    309/* TX lock has to be taken */
    310static int __hif_usb_tx(struct hif_device_usb *hif_dev)
    311{
    312	struct tx_buf *tx_buf = NULL;
    313	struct sk_buff *nskb = NULL;
    314	int ret = 0, i;
    315	u16 tx_skb_cnt = 0;
    316	u8 *buf;
    317	__le16 *hdr;
    318
    319	if (hif_dev->tx.tx_skb_cnt == 0)
    320		return 0;
    321
    322	/* Check if a free TX buffer is available */
    323	if (list_empty(&hif_dev->tx.tx_buf))
    324		return 0;
    325
    326	tx_buf = list_first_entry(&hif_dev->tx.tx_buf, struct tx_buf, list);
    327	list_move_tail(&tx_buf->list, &hif_dev->tx.tx_pending);
    328	hif_dev->tx.tx_buf_cnt--;
    329
    330	tx_skb_cnt = min_t(u16, hif_dev->tx.tx_skb_cnt, MAX_TX_AGGR_NUM);
    331
    332	for (i = 0; i < tx_skb_cnt; i++) {
    333		nskb = __skb_dequeue(&hif_dev->tx.tx_skb_queue);
    334
    335		/* Should never be NULL */
    336		BUG_ON(!nskb);
    337
    338		hif_dev->tx.tx_skb_cnt--;
    339
    340		buf = tx_buf->buf;
    341		buf += tx_buf->offset;
    342		hdr = (__le16 *)buf;
    343		*hdr++ = cpu_to_le16(nskb->len);
    344		*hdr++ = cpu_to_le16(ATH_USB_TX_STREAM_MODE_TAG);
    345		buf += 4;
    346		memcpy(buf, nskb->data, nskb->len);
    347		tx_buf->len = nskb->len + 4;
    348
    349		if (i < (tx_skb_cnt - 1))
    350			tx_buf->offset += (((tx_buf->len - 1) / 4) + 1) * 4;
    351
    352		if (i == (tx_skb_cnt - 1))
    353			tx_buf->len += tx_buf->offset;
    354
    355		__skb_queue_tail(&tx_buf->skb_queue, nskb);
    356		TX_STAT_INC(skb_queued);
    357	}
    358
    359	usb_fill_bulk_urb(tx_buf->urb, hif_dev->udev,
    360			  usb_sndbulkpipe(hif_dev->udev, USB_WLAN_TX_PIPE),
    361			  tx_buf->buf, tx_buf->len,
    362			  hif_usb_tx_cb, tx_buf);
    363
    364	ret = usb_submit_urb(tx_buf->urb, GFP_ATOMIC);
    365	if (ret) {
    366		tx_buf->len = tx_buf->offset = 0;
    367		ath9k_skb_queue_complete(hif_dev, &tx_buf->skb_queue, false);
    368		__skb_queue_head_init(&tx_buf->skb_queue);
    369		list_move_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
    370		hif_dev->tx.tx_buf_cnt++;
    371	} else {
    372		TX_STAT_INC(buf_queued);
    373	}
    374
    375	return ret;
    376}
    377
    378static int hif_usb_send_tx(struct hif_device_usb *hif_dev, struct sk_buff *skb)
    379{
    380	struct ath9k_htc_tx_ctl *tx_ctl;
    381	unsigned long flags;
    382	int ret = 0;
    383
    384	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    385
    386	if (hif_dev->tx.flags & HIF_USB_TX_STOP) {
    387		spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    388		return -ENODEV;
    389	}
    390
    391	/* Check if the max queue count has been reached */
    392	if (hif_dev->tx.tx_skb_cnt > MAX_TX_BUF_NUM) {
    393		spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    394		return -ENOMEM;
    395	}
    396
    397	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    398
    399	tx_ctl = HTC_SKB_CB(skb);
    400
    401	/* Mgmt/Beacon frames don't use the TX buffer pool */
    402	if ((tx_ctl->type == ATH9K_HTC_MGMT) ||
    403	    (tx_ctl->type == ATH9K_HTC_BEACON)) {
    404		ret = hif_usb_send_mgmt(hif_dev, skb);
    405	}
    406
    407	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    408
    409	if ((tx_ctl->type == ATH9K_HTC_NORMAL) ||
    410	    (tx_ctl->type == ATH9K_HTC_AMPDU)) {
    411		__skb_queue_tail(&hif_dev->tx.tx_skb_queue, skb);
    412		hif_dev->tx.tx_skb_cnt++;
    413	}
    414
    415	/* Check if AMPDUs have to be sent immediately */
    416	if ((hif_dev->tx.tx_buf_cnt == MAX_TX_URB_NUM) &&
    417	    (hif_dev->tx.tx_skb_cnt < 2)) {
    418		__hif_usb_tx(hif_dev);
    419	}
    420
    421	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    422
    423	return ret;
    424}
    425
    426static void hif_usb_start(void *hif_handle)
    427{
    428	struct hif_device_usb *hif_dev = hif_handle;
    429	unsigned long flags;
    430
    431	hif_dev->flags |= HIF_USB_START;
    432
    433	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    434	hif_dev->tx.flags &= ~HIF_USB_TX_STOP;
    435	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    436}
    437
    438static void hif_usb_stop(void *hif_handle)
    439{
    440	struct hif_device_usb *hif_dev = hif_handle;
    441	struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
    442	unsigned long flags;
    443
    444	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    445	ath9k_skb_queue_complete(hif_dev, &hif_dev->tx.tx_skb_queue, false);
    446	hif_dev->tx.tx_skb_cnt = 0;
    447	hif_dev->tx.flags |= HIF_USB_TX_STOP;
    448	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    449
    450	/* The pending URBs have to be canceled. */
    451	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    452	list_for_each_entry_safe(tx_buf, tx_buf_tmp,
    453				 &hif_dev->tx.tx_pending, list) {
    454		usb_get_urb(tx_buf->urb);
    455		spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    456		usb_kill_urb(tx_buf->urb);
    457		list_del(&tx_buf->list);
    458		usb_free_urb(tx_buf->urb);
    459		kfree(tx_buf->buf);
    460		kfree(tx_buf);
    461		spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    462	}
    463	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    464
    465	usb_kill_anchored_urbs(&hif_dev->mgmt_submitted);
    466}
    467
    468static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb)
    469{
    470	struct hif_device_usb *hif_dev = hif_handle;
    471	int ret = 0;
    472
    473	switch (pipe_id) {
    474	case USB_WLAN_TX_PIPE:
    475		ret = hif_usb_send_tx(hif_dev, skb);
    476		break;
    477	case USB_REG_OUT_PIPE:
    478		ret = hif_usb_send_regout(hif_dev, skb);
    479		break;
    480	default:
    481		dev_err(&hif_dev->udev->dev,
    482			"ath9k_htc: Invalid TX pipe: %d\n", pipe_id);
    483		ret = -EINVAL;
    484		break;
    485	}
    486
    487	return ret;
    488}
    489
    490static inline bool check_index(struct sk_buff *skb, u8 idx)
    491{
    492	struct ath9k_htc_tx_ctl *tx_ctl;
    493
    494	tx_ctl = HTC_SKB_CB(skb);
    495
    496	if ((tx_ctl->type == ATH9K_HTC_AMPDU) &&
    497	    (tx_ctl->sta_idx == idx))
    498		return true;
    499
    500	return false;
    501}
    502
    503static void hif_usb_sta_drain(void *hif_handle, u8 idx)
    504{
    505	struct hif_device_usb *hif_dev = hif_handle;
    506	struct sk_buff *skb, *tmp;
    507	unsigned long flags;
    508
    509	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    510
    511	skb_queue_walk_safe(&hif_dev->tx.tx_skb_queue, skb, tmp) {
    512		if (check_index(skb, idx)) {
    513			__skb_unlink(skb, &hif_dev->tx.tx_skb_queue);
    514			ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
    515						  skb, false);
    516			hif_dev->tx.tx_skb_cnt--;
    517			TX_STAT_INC(skb_failed);
    518		}
    519	}
    520
    521	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    522}
    523
    524static struct ath9k_htc_hif hif_usb = {
    525	.transport = ATH9K_HIF_USB,
    526	.name = "ath9k_hif_usb",
    527
    528	.control_ul_pipe = USB_REG_OUT_PIPE,
    529	.control_dl_pipe = USB_REG_IN_PIPE,
    530
    531	.start = hif_usb_start,
    532	.stop = hif_usb_stop,
    533	.sta_drain = hif_usb_sta_drain,
    534	.send = hif_usb_send,
    535};
    536
    537static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
    538				    struct sk_buff *skb)
    539{
    540	struct sk_buff *nskb, *skb_pool[MAX_PKT_NUM_IN_TRANSFER];
    541	int index = 0, i, len = skb->len;
    542	int rx_remain_len, rx_pkt_len;
    543	u16 pool_index = 0;
    544	u8 *ptr;
    545
    546	spin_lock(&hif_dev->rx_lock);
    547
    548	rx_remain_len = hif_dev->rx_remain_len;
    549	rx_pkt_len = hif_dev->rx_transfer_len;
    550
    551	if (rx_remain_len != 0) {
    552		struct sk_buff *remain_skb = hif_dev->remain_skb;
    553
    554		if (remain_skb) {
    555			ptr = (u8 *) remain_skb->data;
    556
    557			index = rx_remain_len;
    558			rx_remain_len -= hif_dev->rx_pad_len;
    559			ptr += rx_pkt_len;
    560
    561			memcpy(ptr, skb->data, rx_remain_len);
    562
    563			rx_pkt_len += rx_remain_len;
    564			hif_dev->rx_remain_len = 0;
    565			skb_put(remain_skb, rx_pkt_len);
    566
    567			skb_pool[pool_index++] = remain_skb;
    568
    569		} else {
    570			index = rx_remain_len;
    571		}
    572	}
    573
    574	spin_unlock(&hif_dev->rx_lock);
    575
    576	while (index < len) {
    577		u16 pkt_len;
    578		u16 pkt_tag;
    579		u16 pad_len;
    580		int chk_idx;
    581
    582		ptr = (u8 *) skb->data;
    583
    584		pkt_len = get_unaligned_le16(ptr + index);
    585		pkt_tag = get_unaligned_le16(ptr + index + 2);
    586
    587		if (pkt_tag != ATH_USB_RX_STREAM_MODE_TAG) {
    588			RX_STAT_INC(skb_dropped);
    589			return;
    590		}
    591
    592		if (pkt_len > 2 * MAX_RX_BUF_SIZE) {
    593			dev_err(&hif_dev->udev->dev,
    594				"ath9k_htc: invalid pkt_len (%x)\n", pkt_len);
    595			RX_STAT_INC(skb_dropped);
    596			return;
    597		}
    598
    599		pad_len = 4 - (pkt_len & 0x3);
    600		if (pad_len == 4)
    601			pad_len = 0;
    602
    603		chk_idx = index;
    604		index = index + 4 + pkt_len + pad_len;
    605
    606		if (index > MAX_RX_BUF_SIZE) {
    607			spin_lock(&hif_dev->rx_lock);
    608			hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE;
    609			hif_dev->rx_transfer_len =
    610				MAX_RX_BUF_SIZE - chk_idx - 4;
    611			hif_dev->rx_pad_len = pad_len;
    612
    613			nskb = __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC);
    614			if (!nskb) {
    615				dev_err(&hif_dev->udev->dev,
    616					"ath9k_htc: RX memory allocation error\n");
    617				spin_unlock(&hif_dev->rx_lock);
    618				goto err;
    619			}
    620			skb_reserve(nskb, 32);
    621			RX_STAT_INC(skb_allocated);
    622
    623			memcpy(nskb->data, &(skb->data[chk_idx+4]),
    624			       hif_dev->rx_transfer_len);
    625
    626			/* Record the buffer pointer */
    627			hif_dev->remain_skb = nskb;
    628			spin_unlock(&hif_dev->rx_lock);
    629		} else {
    630			if (pool_index == MAX_PKT_NUM_IN_TRANSFER) {
    631				dev_err(&hif_dev->udev->dev,
    632					"ath9k_htc: over RX MAX_PKT_NUM\n");
    633				goto err;
    634			}
    635			nskb = __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC);
    636			if (!nskb) {
    637				dev_err(&hif_dev->udev->dev,
    638					"ath9k_htc: RX memory allocation error\n");
    639				goto err;
    640			}
    641			skb_reserve(nskb, 32);
    642			RX_STAT_INC(skb_allocated);
    643
    644			memcpy(nskb->data, &(skb->data[chk_idx+4]), pkt_len);
    645			skb_put(nskb, pkt_len);
    646			skb_pool[pool_index++] = nskb;
    647		}
    648	}
    649
    650err:
    651	for (i = 0; i < pool_index; i++) {
    652		RX_STAT_ADD(skb_completed_bytes, skb_pool[i]->len);
    653		ath9k_htc_rx_msg(hif_dev->htc_handle, skb_pool[i],
    654				 skb_pool[i]->len, USB_WLAN_RX_PIPE);
    655		RX_STAT_INC(skb_completed);
    656	}
    657}
    658
    659static void ath9k_hif_usb_rx_cb(struct urb *urb)
    660{
    661	struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
    662	struct hif_device_usb *hif_dev = rx_buf->hif_dev;
    663	struct sk_buff *skb = rx_buf->skb;
    664	int ret;
    665
    666	if (!skb)
    667		return;
    668
    669	if (!hif_dev)
    670		goto free;
    671
    672	switch (urb->status) {
    673	case 0:
    674		break;
    675	case -ENOENT:
    676	case -ECONNRESET:
    677	case -ENODEV:
    678	case -ESHUTDOWN:
    679		goto free;
    680	default:
    681		goto resubmit;
    682	}
    683
    684	if (likely(urb->actual_length != 0)) {
    685		skb_put(skb, urb->actual_length);
    686		ath9k_hif_usb_rx_stream(hif_dev, skb);
    687	}
    688
    689resubmit:
    690	skb_reset_tail_pointer(skb);
    691	skb_trim(skb, 0);
    692
    693	usb_anchor_urb(urb, &hif_dev->rx_submitted);
    694	ret = usb_submit_urb(urb, GFP_ATOMIC);
    695	if (ret) {
    696		usb_unanchor_urb(urb);
    697		goto free;
    698	}
    699
    700	return;
    701free:
    702	kfree_skb(skb);
    703	kfree(rx_buf);
    704}
    705
    706static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
    707{
    708	struct rx_buf *rx_buf = (struct rx_buf *)urb->context;
    709	struct hif_device_usb *hif_dev = rx_buf->hif_dev;
    710	struct sk_buff *skb = rx_buf->skb;
    711	struct sk_buff *nskb;
    712	int ret;
    713
    714	if (!skb)
    715		return;
    716
    717	if (!hif_dev)
    718		goto free;
    719
    720	switch (urb->status) {
    721	case 0:
    722		break;
    723	case -ENOENT:
    724	case -ECONNRESET:
    725	case -ENODEV:
    726	case -ESHUTDOWN:
    727		goto free;
    728	default:
    729		skb_reset_tail_pointer(skb);
    730		skb_trim(skb, 0);
    731
    732		goto resubmit;
    733	}
    734
    735	if (likely(urb->actual_length != 0)) {
    736		skb_put(skb, urb->actual_length);
    737
    738		/* Process the command first */
    739		ath9k_htc_rx_msg(hif_dev->htc_handle, skb,
    740				 skb->len, USB_REG_IN_PIPE);
    741
    742
    743		nskb = alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_ATOMIC);
    744		if (!nskb) {
    745			dev_err(&hif_dev->udev->dev,
    746				"ath9k_htc: REG_IN memory allocation failure\n");
    747			urb->context = NULL;
    748			return;
    749		}
    750
    751		rx_buf->skb = nskb;
    752
    753		usb_fill_int_urb(urb, hif_dev->udev,
    754				 usb_rcvintpipe(hif_dev->udev,
    755						 USB_REG_IN_PIPE),
    756				 nskb->data, MAX_REG_IN_BUF_SIZE,
    757				 ath9k_hif_usb_reg_in_cb, rx_buf, 1);
    758	}
    759
    760resubmit:
    761	usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
    762	ret = usb_submit_urb(urb, GFP_ATOMIC);
    763	if (ret) {
    764		usb_unanchor_urb(urb);
    765		goto free;
    766	}
    767
    768	return;
    769free:
    770	kfree_skb(skb);
    771	kfree(rx_buf);
    772	urb->context = NULL;
    773}
    774
    775static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
    776{
    777	struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
    778	unsigned long flags;
    779
    780	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    781	list_for_each_entry_safe(tx_buf, tx_buf_tmp,
    782				 &hif_dev->tx.tx_buf, list) {
    783		usb_get_urb(tx_buf->urb);
    784		spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    785		usb_kill_urb(tx_buf->urb);
    786		list_del(&tx_buf->list);
    787		usb_free_urb(tx_buf->urb);
    788		kfree(tx_buf->buf);
    789		kfree(tx_buf);
    790		spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    791	}
    792	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    793
    794	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    795	hif_dev->tx.flags |= HIF_USB_TX_FLUSH;
    796	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    797
    798	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    799	list_for_each_entry_safe(tx_buf, tx_buf_tmp,
    800				 &hif_dev->tx.tx_pending, list) {
    801		usb_get_urb(tx_buf->urb);
    802		spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    803		usb_kill_urb(tx_buf->urb);
    804		list_del(&tx_buf->list);
    805		usb_free_urb(tx_buf->urb);
    806		kfree(tx_buf->buf);
    807		kfree(tx_buf);
    808		spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
    809	}
    810	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
    811
    812	usb_kill_anchored_urbs(&hif_dev->mgmt_submitted);
    813}
    814
    815static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
    816{
    817	struct tx_buf *tx_buf;
    818	int i;
    819
    820	INIT_LIST_HEAD(&hif_dev->tx.tx_buf);
    821	INIT_LIST_HEAD(&hif_dev->tx.tx_pending);
    822	spin_lock_init(&hif_dev->tx.tx_lock);
    823	__skb_queue_head_init(&hif_dev->tx.tx_skb_queue);
    824	init_usb_anchor(&hif_dev->mgmt_submitted);
    825
    826	for (i = 0; i < MAX_TX_URB_NUM; i++) {
    827		tx_buf = kzalloc(sizeof(*tx_buf), GFP_KERNEL);
    828		if (!tx_buf)
    829			goto err;
    830
    831		tx_buf->buf = kzalloc(MAX_TX_BUF_SIZE, GFP_KERNEL);
    832		if (!tx_buf->buf)
    833			goto err;
    834
    835		tx_buf->urb = usb_alloc_urb(0, GFP_KERNEL);
    836		if (!tx_buf->urb)
    837			goto err;
    838
    839		tx_buf->hif_dev = hif_dev;
    840		__skb_queue_head_init(&tx_buf->skb_queue);
    841
    842		list_add_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
    843	}
    844
    845	hif_dev->tx.tx_buf_cnt = MAX_TX_URB_NUM;
    846
    847	return 0;
    848err:
    849	if (tx_buf) {
    850		kfree(tx_buf->buf);
    851		kfree(tx_buf);
    852	}
    853	ath9k_hif_usb_dealloc_tx_urbs(hif_dev);
    854	return -ENOMEM;
    855}
    856
    857static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
    858{
    859	usb_kill_anchored_urbs(&hif_dev->rx_submitted);
    860}
    861
    862static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
    863{
    864	struct rx_buf *rx_buf = NULL;
    865	struct sk_buff *skb = NULL;
    866	struct urb *urb = NULL;
    867	int i, ret;
    868
    869	init_usb_anchor(&hif_dev->rx_submitted);
    870	spin_lock_init(&hif_dev->rx_lock);
    871
    872	for (i = 0; i < MAX_RX_URB_NUM; i++) {
    873
    874		rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
    875		if (!rx_buf) {
    876			ret = -ENOMEM;
    877			goto err_rxb;
    878		}
    879
    880		/* Allocate URB */
    881		urb = usb_alloc_urb(0, GFP_KERNEL);
    882		if (urb == NULL) {
    883			ret = -ENOMEM;
    884			goto err_urb;
    885		}
    886
    887		/* Allocate buffer */
    888		skb = alloc_skb(MAX_RX_BUF_SIZE, GFP_KERNEL);
    889		if (!skb) {
    890			ret = -ENOMEM;
    891			goto err_skb;
    892		}
    893
    894		rx_buf->hif_dev = hif_dev;
    895		rx_buf->skb = skb;
    896
    897		usb_fill_bulk_urb(urb, hif_dev->udev,
    898				  usb_rcvbulkpipe(hif_dev->udev,
    899						  USB_WLAN_RX_PIPE),
    900				  skb->data, MAX_RX_BUF_SIZE,
    901				  ath9k_hif_usb_rx_cb, rx_buf);
    902
    903		/* Anchor URB */
    904		usb_anchor_urb(urb, &hif_dev->rx_submitted);
    905
    906		/* Submit URB */
    907		ret = usb_submit_urb(urb, GFP_KERNEL);
    908		if (ret) {
    909			usb_unanchor_urb(urb);
    910			goto err_submit;
    911		}
    912
    913		/*
    914		 * Drop reference count.
    915		 * This ensures that the URB is freed when killing them.
    916		 */
    917		usb_free_urb(urb);
    918	}
    919
    920	return 0;
    921
    922err_submit:
    923	kfree_skb(skb);
    924err_skb:
    925	usb_free_urb(urb);
    926err_urb:
    927	kfree(rx_buf);
    928err_rxb:
    929	ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
    930	return ret;
    931}
    932
    933static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev)
    934{
    935	usb_kill_anchored_urbs(&hif_dev->reg_in_submitted);
    936}
    937
    938static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
    939{
    940	struct rx_buf *rx_buf = NULL;
    941	struct sk_buff *skb = NULL;
    942	struct urb *urb = NULL;
    943	int i, ret;
    944
    945	init_usb_anchor(&hif_dev->reg_in_submitted);
    946
    947	for (i = 0; i < MAX_REG_IN_URB_NUM; i++) {
    948
    949		rx_buf = kzalloc(sizeof(*rx_buf), GFP_KERNEL);
    950		if (!rx_buf) {
    951			ret = -ENOMEM;
    952			goto err_rxb;
    953		}
    954
    955		/* Allocate URB */
    956		urb = usb_alloc_urb(0, GFP_KERNEL);
    957		if (urb == NULL) {
    958			ret = -ENOMEM;
    959			goto err_urb;
    960		}
    961
    962		/* Allocate buffer */
    963		skb = alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_KERNEL);
    964		if (!skb) {
    965			ret = -ENOMEM;
    966			goto err_skb;
    967		}
    968
    969		rx_buf->hif_dev = hif_dev;
    970		rx_buf->skb = skb;
    971
    972		usb_fill_int_urb(urb, hif_dev->udev,
    973				  usb_rcvintpipe(hif_dev->udev,
    974						  USB_REG_IN_PIPE),
    975				  skb->data, MAX_REG_IN_BUF_SIZE,
    976				  ath9k_hif_usb_reg_in_cb, rx_buf, 1);
    977
    978		/* Anchor URB */
    979		usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
    980
    981		/* Submit URB */
    982		ret = usb_submit_urb(urb, GFP_KERNEL);
    983		if (ret) {
    984			usb_unanchor_urb(urb);
    985			goto err_submit;
    986		}
    987
    988		/*
    989		 * Drop reference count.
    990		 * This ensures that the URB is freed when killing them.
    991		 */
    992		usb_free_urb(urb);
    993	}
    994
    995	return 0;
    996
    997err_submit:
    998	kfree_skb(skb);
    999err_skb:
   1000	usb_free_urb(urb);
   1001err_urb:
   1002	kfree(rx_buf);
   1003err_rxb:
   1004	ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
   1005	return ret;
   1006}
   1007
   1008static int ath9k_hif_usb_alloc_urbs(struct hif_device_usb *hif_dev)
   1009{
   1010	/* Register Write */
   1011	init_usb_anchor(&hif_dev->regout_submitted);
   1012
   1013	/* TX */
   1014	if (ath9k_hif_usb_alloc_tx_urbs(hif_dev) < 0)
   1015		goto err;
   1016
   1017	/* RX */
   1018	if (ath9k_hif_usb_alloc_rx_urbs(hif_dev) < 0)
   1019		goto err_rx;
   1020
   1021	/* Register Read */
   1022	if (ath9k_hif_usb_alloc_reg_in_urbs(hif_dev) < 0)
   1023		goto err_reg;
   1024
   1025	return 0;
   1026err_reg:
   1027	ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
   1028err_rx:
   1029	ath9k_hif_usb_dealloc_tx_urbs(hif_dev);
   1030err:
   1031	return -ENOMEM;
   1032}
   1033
   1034void ath9k_hif_usb_dealloc_urbs(struct hif_device_usb *hif_dev)
   1035{
   1036	usb_kill_anchored_urbs(&hif_dev->regout_submitted);
   1037	ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
   1038	ath9k_hif_usb_dealloc_tx_urbs(hif_dev);
   1039	ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
   1040}
   1041
   1042static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
   1043{
   1044	int transfer, err;
   1045	const void *data = hif_dev->fw_data;
   1046	size_t len = hif_dev->fw_size;
   1047	u32 addr = AR9271_FIRMWARE;
   1048	u8 *buf = kzalloc(4096, GFP_KERNEL);
   1049	u32 firm_offset;
   1050
   1051	if (!buf)
   1052		return -ENOMEM;
   1053
   1054	while (len) {
   1055		transfer = min_t(size_t, len, 4096);
   1056		memcpy(buf, data, transfer);
   1057
   1058		err = usb_control_msg(hif_dev->udev,
   1059				      usb_sndctrlpipe(hif_dev->udev, 0),
   1060				      FIRMWARE_DOWNLOAD, 0x40 | USB_DIR_OUT,
   1061				      addr >> 8, 0, buf, transfer,
   1062				      USB_MSG_TIMEOUT);
   1063		if (err < 0) {
   1064			kfree(buf);
   1065			return err;
   1066		}
   1067
   1068		len -= transfer;
   1069		data += transfer;
   1070		addr += transfer;
   1071	}
   1072	kfree(buf);
   1073
   1074	if (IS_AR7010_DEVICE(hif_dev->usb_device_id->driver_info))
   1075		firm_offset = AR7010_FIRMWARE_TEXT;
   1076	else
   1077		firm_offset = AR9271_FIRMWARE_TEXT;
   1078
   1079	/*
   1080	 * Issue FW download complete command to firmware.
   1081	 */
   1082	err = usb_control_msg(hif_dev->udev, usb_sndctrlpipe(hif_dev->udev, 0),
   1083			      FIRMWARE_DOWNLOAD_COMP,
   1084			      0x40 | USB_DIR_OUT,
   1085			      firm_offset >> 8, 0, NULL, 0, USB_MSG_TIMEOUT);
   1086	if (err)
   1087		return -EIO;
   1088
   1089	dev_info(&hif_dev->udev->dev, "ath9k_htc: Transferred FW: %s, size: %ld\n",
   1090		 hif_dev->fw_name, (unsigned long) hif_dev->fw_size);
   1091
   1092	return 0;
   1093}
   1094
   1095static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
   1096{
   1097	int ret;
   1098
   1099	ret = ath9k_hif_usb_download_fw(hif_dev);
   1100	if (ret) {
   1101		dev_err(&hif_dev->udev->dev,
   1102			"ath9k_htc: Firmware - %s download failed\n",
   1103			hif_dev->fw_name);
   1104		return ret;
   1105	}
   1106
   1107	/* Alloc URBs */
   1108	ret = ath9k_hif_usb_alloc_urbs(hif_dev);
   1109	if (ret) {
   1110		dev_err(&hif_dev->udev->dev,
   1111			"ath9k_htc: Unable to allocate URBs\n");
   1112		return ret;
   1113	}
   1114
   1115	return 0;
   1116}
   1117
   1118static void ath9k_hif_usb_dev_deinit(struct hif_device_usb *hif_dev)
   1119{
   1120	ath9k_hif_usb_dealloc_urbs(hif_dev);
   1121}
   1122
   1123/*
   1124 * If initialization fails or the FW cannot be retrieved,
   1125 * detach the device.
   1126 */
   1127static void ath9k_hif_usb_firmware_fail(struct hif_device_usb *hif_dev)
   1128{
   1129	struct device *dev = &hif_dev->udev->dev;
   1130	struct device *parent = dev->parent;
   1131
   1132	complete_all(&hif_dev->fw_done);
   1133
   1134	if (parent)
   1135		device_lock(parent);
   1136
   1137	device_release_driver(dev);
   1138
   1139	if (parent)
   1140		device_unlock(parent);
   1141}
   1142
   1143static void ath9k_hif_usb_firmware_cb(const struct firmware *fw, void *context);
   1144
   1145/* taken from iwlwifi */
   1146static int ath9k_hif_request_firmware(struct hif_device_usb *hif_dev,
   1147				      bool first)
   1148{
   1149	char index[8], *chip;
   1150	int ret;
   1151
   1152	if (first) {
   1153		if (htc_use_dev_fw) {
   1154			hif_dev->fw_minor_index = FIRMWARE_MINOR_IDX_MAX + 1;
   1155			sprintf(index, "%s", "dev");
   1156		} else {
   1157			hif_dev->fw_minor_index = FIRMWARE_MINOR_IDX_MAX;
   1158			sprintf(index, "%d", hif_dev->fw_minor_index);
   1159		}
   1160	} else {
   1161		hif_dev->fw_minor_index--;
   1162		sprintf(index, "%d", hif_dev->fw_minor_index);
   1163	}
   1164
   1165	/* test for FW 1.3 */
   1166	if (MAJOR_VERSION_REQ == 1 && hif_dev->fw_minor_index == 3) {
   1167		const char *filename;
   1168
   1169		if (IS_AR7010_DEVICE(hif_dev->usb_device_id->driver_info))
   1170			filename = FIRMWARE_AR7010_1_1;
   1171		else
   1172			filename = FIRMWARE_AR9271;
   1173
   1174		/* expected fw locations:
   1175		 * - htc_9271.fw   (stable version 1.3, depricated)
   1176		 */
   1177		snprintf(hif_dev->fw_name, sizeof(hif_dev->fw_name),
   1178			 "%s", filename);
   1179
   1180	} else if (hif_dev->fw_minor_index < FIRMWARE_MINOR_IDX_MIN) {
   1181		dev_err(&hif_dev->udev->dev, "no suitable firmware found!\n");
   1182
   1183		return -ENOENT;
   1184	} else {
   1185		if (IS_AR7010_DEVICE(hif_dev->usb_device_id->driver_info))
   1186			chip = "7010";
   1187		else
   1188			chip = "9271";
   1189
   1190		/* expected fw locations:
   1191		 * - ath9k_htc/htc_9271-1.dev.0.fw (development version)
   1192		 * - ath9k_htc/htc_9271-1.4.0.fw   (stable version)
   1193		 */
   1194		snprintf(hif_dev->fw_name, sizeof(hif_dev->fw_name),
   1195			 "%s/htc_%s-%d.%s.0.fw", HTC_FW_PATH,
   1196			 chip, MAJOR_VERSION_REQ, index);
   1197	}
   1198
   1199	ret = request_firmware_nowait(THIS_MODULE, true, hif_dev->fw_name,
   1200				      &hif_dev->udev->dev, GFP_KERNEL,
   1201				      hif_dev, ath9k_hif_usb_firmware_cb);
   1202	if (ret) {
   1203		dev_err(&hif_dev->udev->dev,
   1204			"ath9k_htc: Async request for firmware %s failed\n",
   1205			hif_dev->fw_name);
   1206		return ret;
   1207	}
   1208
   1209	dev_info(&hif_dev->udev->dev, "ath9k_htc: Firmware %s requested\n",
   1210		 hif_dev->fw_name);
   1211
   1212	return ret;
   1213}
   1214
   1215static void ath9k_hif_usb_firmware_cb(const struct firmware *fw, void *context)
   1216{
   1217	struct hif_device_usb *hif_dev = context;
   1218	int ret;
   1219
   1220	if (!fw) {
   1221		ret = ath9k_hif_request_firmware(hif_dev, false);
   1222		if (!ret)
   1223			return;
   1224
   1225		dev_err(&hif_dev->udev->dev,
   1226			"ath9k_htc: Failed to get firmware %s\n",
   1227			hif_dev->fw_name);
   1228		goto err_fw;
   1229	}
   1230
   1231	hif_dev->htc_handle = ath9k_htc_hw_alloc(hif_dev, &hif_usb,
   1232						 &hif_dev->udev->dev);
   1233	if (hif_dev->htc_handle == NULL)
   1234		goto err_dev_alloc;
   1235
   1236	hif_dev->fw_data = fw->data;
   1237	hif_dev->fw_size = fw->size;
   1238
   1239	/* Proceed with initialization */
   1240
   1241	ret = ath9k_hif_usb_dev_init(hif_dev);
   1242	if (ret)
   1243		goto err_dev_init;
   1244
   1245	ret = ath9k_htc_hw_init(hif_dev->htc_handle,
   1246				&hif_dev->interface->dev,
   1247				hif_dev->usb_device_id->idProduct,
   1248				hif_dev->udev->product,
   1249				hif_dev->usb_device_id->driver_info);
   1250	if (ret) {
   1251		ret = -EINVAL;
   1252		goto err_htc_hw_init;
   1253	}
   1254
   1255	release_firmware(fw);
   1256	hif_dev->flags |= HIF_USB_READY;
   1257	complete_all(&hif_dev->fw_done);
   1258
   1259	return;
   1260
   1261err_htc_hw_init:
   1262	ath9k_hif_usb_dev_deinit(hif_dev);
   1263err_dev_init:
   1264	ath9k_htc_hw_free(hif_dev->htc_handle);
   1265err_dev_alloc:
   1266	release_firmware(fw);
   1267err_fw:
   1268	ath9k_hif_usb_firmware_fail(hif_dev);
   1269}
   1270
   1271/*
   1272 * An exact copy of the function from zd1211rw.
   1273 */
   1274static int send_eject_command(struct usb_interface *interface)
   1275{
   1276	struct usb_device *udev = interface_to_usbdev(interface);
   1277	struct usb_host_interface *iface_desc = interface->cur_altsetting;
   1278	struct usb_endpoint_descriptor *endpoint;
   1279	unsigned char *cmd;
   1280	u8 bulk_out_ep;
   1281	int r;
   1282
   1283	if (iface_desc->desc.bNumEndpoints < 2)
   1284		return -ENODEV;
   1285
   1286	/* Find bulk out endpoint */
   1287	for (r = 1; r >= 0; r--) {
   1288		endpoint = &iface_desc->endpoint[r].desc;
   1289		if (usb_endpoint_dir_out(endpoint) &&
   1290		    usb_endpoint_xfer_bulk(endpoint)) {
   1291			bulk_out_ep = endpoint->bEndpointAddress;
   1292			break;
   1293		}
   1294	}
   1295	if (r == -1) {
   1296		dev_err(&udev->dev,
   1297			"ath9k_htc: Could not find bulk out endpoint\n");
   1298		return -ENODEV;
   1299	}
   1300
   1301	cmd = kzalloc(31, GFP_KERNEL);
   1302	if (cmd == NULL)
   1303		return -ENODEV;
   1304
   1305	/* USB bulk command block */
   1306	cmd[0] = 0x55;	/* bulk command signature */
   1307	cmd[1] = 0x53;	/* bulk command signature */
   1308	cmd[2] = 0x42;	/* bulk command signature */
   1309	cmd[3] = 0x43;	/* bulk command signature */
   1310	cmd[14] = 6;	/* command length */
   1311
   1312	cmd[15] = 0x1b;	/* SCSI command: START STOP UNIT */
   1313	cmd[19] = 0x2;	/* eject disc */
   1314
   1315	dev_info(&udev->dev, "Ejecting storage device...\n");
   1316	r = usb_bulk_msg(udev, usb_sndbulkpipe(udev, bulk_out_ep),
   1317		cmd, 31, NULL, 2 * USB_MSG_TIMEOUT);
   1318	kfree(cmd);
   1319	if (r)
   1320		return r;
   1321
   1322	/* At this point, the device disconnects and reconnects with the real
   1323	 * ID numbers. */
   1324
   1325	usb_set_intfdata(interface, NULL);
   1326	return 0;
   1327}
   1328
   1329static int ath9k_hif_usb_probe(struct usb_interface *interface,
   1330			       const struct usb_device_id *id)
   1331{
   1332	struct usb_device *udev = interface_to_usbdev(interface);
   1333	struct hif_device_usb *hif_dev;
   1334	int ret = 0;
   1335
   1336	if (id->driver_info == STORAGE_DEVICE)
   1337		return send_eject_command(interface);
   1338
   1339	hif_dev = kzalloc(sizeof(struct hif_device_usb), GFP_KERNEL);
   1340	if (!hif_dev) {
   1341		ret = -ENOMEM;
   1342		goto err_alloc;
   1343	}
   1344
   1345	usb_get_dev(udev);
   1346
   1347	hif_dev->udev = udev;
   1348	hif_dev->interface = interface;
   1349	hif_dev->usb_device_id = id;
   1350#ifdef CONFIG_PM
   1351	udev->reset_resume = 1;
   1352#endif
   1353	usb_set_intfdata(interface, hif_dev);
   1354
   1355	init_completion(&hif_dev->fw_done);
   1356
   1357	ret = ath9k_hif_request_firmware(hif_dev, true);
   1358	if (ret)
   1359		goto err_fw_req;
   1360
   1361	return ret;
   1362
   1363err_fw_req:
   1364	usb_set_intfdata(interface, NULL);
   1365	kfree(hif_dev);
   1366	usb_put_dev(udev);
   1367err_alloc:
   1368	return ret;
   1369}
   1370
   1371static void ath9k_hif_usb_reboot(struct usb_device *udev)
   1372{
   1373	u32 reboot_cmd = 0xffffffff;
   1374	void *buf;
   1375	int ret;
   1376
   1377	buf = kmemdup(&reboot_cmd, 4, GFP_KERNEL);
   1378	if (!buf)
   1379		return;
   1380
   1381	ret = usb_interrupt_msg(udev, usb_sndintpipe(udev, USB_REG_OUT_PIPE),
   1382			   buf, 4, NULL, USB_MSG_TIMEOUT);
   1383	if (ret)
   1384		dev_err(&udev->dev, "ath9k_htc: USB reboot failed\n");
   1385
   1386	kfree(buf);
   1387}
   1388
   1389static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
   1390{
   1391	struct usb_device *udev = interface_to_usbdev(interface);
   1392	struct hif_device_usb *hif_dev = usb_get_intfdata(interface);
   1393	bool unplugged = (udev->state == USB_STATE_NOTATTACHED) ? true : false;
   1394
   1395	if (!hif_dev)
   1396		return;
   1397
   1398	wait_for_completion(&hif_dev->fw_done);
   1399
   1400	if (hif_dev->flags & HIF_USB_READY) {
   1401		ath9k_htc_hw_deinit(hif_dev->htc_handle, unplugged);
   1402		ath9k_hif_usb_dev_deinit(hif_dev);
   1403		ath9k_destroy_wmi(hif_dev->htc_handle->drv_priv);
   1404		ath9k_htc_hw_free(hif_dev->htc_handle);
   1405	}
   1406
   1407	usb_set_intfdata(interface, NULL);
   1408
   1409	/* If firmware was loaded we should drop it
   1410	 * go back to first stage bootloader. */
   1411	if (!unplugged && (hif_dev->flags & HIF_USB_READY))
   1412		ath9k_hif_usb_reboot(udev);
   1413
   1414	kfree(hif_dev);
   1415	dev_info(&udev->dev, "ath9k_htc: USB layer deinitialized\n");
   1416	usb_put_dev(udev);
   1417}
   1418
   1419#ifdef CONFIG_PM
   1420static int ath9k_hif_usb_suspend(struct usb_interface *interface,
   1421				 pm_message_t message)
   1422{
   1423	struct hif_device_usb *hif_dev = usb_get_intfdata(interface);
   1424
   1425	/*
   1426	 * The device has to be set to FULLSLEEP mode in case no
   1427	 * interface is up.
   1428	 */
   1429	if (!(hif_dev->flags & HIF_USB_START))
   1430		ath9k_htc_suspend(hif_dev->htc_handle);
   1431
   1432	wait_for_completion(&hif_dev->fw_done);
   1433
   1434	if (hif_dev->flags & HIF_USB_READY)
   1435		ath9k_hif_usb_dealloc_urbs(hif_dev);
   1436
   1437	return 0;
   1438}
   1439
   1440static int ath9k_hif_usb_resume(struct usb_interface *interface)
   1441{
   1442	struct hif_device_usb *hif_dev = usb_get_intfdata(interface);
   1443	struct htc_target *htc_handle = hif_dev->htc_handle;
   1444	int ret;
   1445	const struct firmware *fw;
   1446
   1447	ret = ath9k_hif_usb_alloc_urbs(hif_dev);
   1448	if (ret)
   1449		return ret;
   1450
   1451	if (hif_dev->flags & HIF_USB_READY) {
   1452		/* request cached firmware during suspend/resume cycle */
   1453		ret = request_firmware(&fw, hif_dev->fw_name,
   1454				       &hif_dev->udev->dev);
   1455		if (ret)
   1456			goto fail_resume;
   1457
   1458		hif_dev->fw_data = fw->data;
   1459		hif_dev->fw_size = fw->size;
   1460		ret = ath9k_hif_usb_download_fw(hif_dev);
   1461		release_firmware(fw);
   1462		if (ret)
   1463			goto fail_resume;
   1464	} else {
   1465		ath9k_hif_usb_dealloc_urbs(hif_dev);
   1466		return -EIO;
   1467	}
   1468
   1469	mdelay(100);
   1470
   1471	ret = ath9k_htc_resume(htc_handle);
   1472
   1473	if (ret)
   1474		goto fail_resume;
   1475
   1476	return 0;
   1477
   1478fail_resume:
   1479	ath9k_hif_usb_dealloc_urbs(hif_dev);
   1480
   1481	return ret;
   1482}
   1483#endif
   1484
   1485static struct usb_driver ath9k_hif_usb_driver = {
   1486	.name = KBUILD_MODNAME,
   1487	.probe = ath9k_hif_usb_probe,
   1488	.disconnect = ath9k_hif_usb_disconnect,
   1489#ifdef CONFIG_PM
   1490	.suspend = ath9k_hif_usb_suspend,
   1491	.resume = ath9k_hif_usb_resume,
   1492	.reset_resume = ath9k_hif_usb_resume,
   1493#endif
   1494	.id_table = ath9k_hif_usb_ids,
   1495	.soft_unbind = 1,
   1496	.disable_hub_initiated_lpm = 1,
   1497};
   1498
   1499int ath9k_hif_usb_init(void)
   1500{
   1501	return usb_register(&ath9k_hif_usb_driver);
   1502}
   1503
   1504void ath9k_hif_usb_exit(void)
   1505{
   1506	usb_deregister(&ath9k_hif_usb_driver);
   1507}