cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

cxacru.c (39279B)


      1// SPDX-License-Identifier: GPL-2.0+
      2/******************************************************************************
      3 *  cxacru.c  -  driver for USB ADSL modems based on
      4 *               Conexant AccessRunner chipset
      5 *
      6 *  Copyright (C) 2004 David Woodhouse, Duncan Sands, Roman Kagan
      7 *  Copyright (C) 2005 Duncan Sands, Roman Kagan (rkagan % mail ! ru)
      8 *  Copyright (C) 2007 Simon Arlott
      9 *  Copyright (C) 2009 Simon Arlott
     10 ******************************************************************************/
     11
     12/*
     13 *  Credit is due for Josep Comas, who created the original patch to speedtch.c
     14 *  to support the different padding used by the AccessRunner (now generalized
     15 *  into usbatm), and the userspace firmware loading utility.
     16 */
     17
     18#include <linux/module.h>
     19#include <linux/moduleparam.h>
     20#include <linux/kernel.h>
     21#include <linux/timer.h>
     22#include <linux/errno.h>
     23#include <linux/slab.h>
     24#include <linux/device.h>
     25#include <linux/firmware.h>
     26#include <linux/mutex.h>
     27#include <asm/unaligned.h>
     28
     29#include "usbatm.h"
     30
     31#define DRIVER_AUTHOR	"Roman Kagan, David Woodhouse, Duncan Sands, Simon Arlott"
     32#define DRIVER_DESC	"Conexant AccessRunner ADSL USB modem driver"
     33
     34static const char cxacru_driver_name[] = "cxacru";
     35
     36#define CXACRU_EP_CMD		0x01	/* Bulk/interrupt in/out */
     37#define CXACRU_EP_DATA		0x02	/* Bulk in/out */
     38
     39#define CMD_PACKET_SIZE		64	/* Should be maxpacket(ep)? */
     40#define CMD_MAX_CONFIG		((CMD_PACKET_SIZE / 4 - 1) / 2)
     41
     42/* Addresses */
     43#define PLLFCLK_ADDR	0x00350068
     44#define PLLBCLK_ADDR	0x0035006c
     45#define SDRAMEN_ADDR	0x00350010
     46#define FW_ADDR		0x00801000
     47#define BR_ADDR		0x00180600
     48#define SIG_ADDR	0x00180500
     49#define BR_STACK_ADDR	0x00187f10
     50
     51/* Values */
     52#define SDRAM_ENA	0x1
     53
     54#define CMD_TIMEOUT	2000	/* msecs */
     55#define POLL_INTERVAL	1	/* secs */
     56
     57/* commands for interaction with the modem through the control channel before
     58 * firmware is loaded  */
     59enum cxacru_fw_request {
     60	FW_CMD_ERR,
     61	FW_GET_VER,
     62	FW_READ_MEM,
     63	FW_WRITE_MEM,
     64	FW_RMW_MEM,
     65	FW_CHECKSUM_MEM,
     66	FW_GOTO_MEM,
     67};
     68
     69/* commands for interaction with the modem through the control channel once
     70 * firmware is loaded  */
     71enum cxacru_cm_request {
     72	CM_REQUEST_UNDEFINED = 0x80,
     73	CM_REQUEST_TEST,
     74	CM_REQUEST_CHIP_GET_MAC_ADDRESS,
     75	CM_REQUEST_CHIP_GET_DP_VERSIONS,
     76	CM_REQUEST_CHIP_ADSL_LINE_START,
     77	CM_REQUEST_CHIP_ADSL_LINE_STOP,
     78	CM_REQUEST_CHIP_ADSL_LINE_GET_STATUS,
     79	CM_REQUEST_CHIP_ADSL_LINE_GET_SPEED,
     80	CM_REQUEST_CARD_INFO_GET,
     81	CM_REQUEST_CARD_DATA_GET,
     82	CM_REQUEST_CARD_DATA_SET,
     83	CM_REQUEST_COMMAND_HW_IO,
     84	CM_REQUEST_INTERFACE_HW_IO,
     85	CM_REQUEST_CARD_SERIAL_DATA_PATH_GET,
     86	CM_REQUEST_CARD_SERIAL_DATA_PATH_SET,
     87	CM_REQUEST_CARD_CONTROLLER_VERSION_GET,
     88	CM_REQUEST_CARD_GET_STATUS,
     89	CM_REQUEST_CARD_GET_MAC_ADDRESS,
     90	CM_REQUEST_CARD_GET_DATA_LINK_STATUS,
     91	CM_REQUEST_MAX,
     92};
     93
     94/* commands for interaction with the flash memory
     95 *
     96 * read:  response is the contents of the first 60 bytes of flash memory
     97 * write: request contains the 60 bytes of data to write to flash memory
     98 *        response is the contents of the first 60 bytes of flash memory
     99 *
    100 * layout: PP PP VV VV  MM MM MM MM  MM MM ?? ??  SS SS SS SS  SS SS SS SS
    101 *         SS SS SS SS  SS SS SS SS  00 00 00 00  00 00 00 00  00 00 00 00
    102 *         00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00
    103 *
    104 *   P: le16  USB Product ID
    105 *   V: le16  USB Vendor ID
    106 *   M: be48  MAC Address
    107 *   S: le16  ASCII Serial Number
    108 */
    109enum cxacru_cm_flash {
    110	CM_FLASH_READ = 0xa1,
    111	CM_FLASH_WRITE = 0xa2
    112};
    113
    114/* reply codes to the commands above */
    115enum cxacru_cm_status {
    116	CM_STATUS_UNDEFINED,
    117	CM_STATUS_SUCCESS,
    118	CM_STATUS_ERROR,
    119	CM_STATUS_UNSUPPORTED,
    120	CM_STATUS_UNIMPLEMENTED,
    121	CM_STATUS_PARAMETER_ERROR,
    122	CM_STATUS_DBG_LOOPBACK,
    123	CM_STATUS_MAX,
    124};
    125
    126/* indices into CARD_INFO_GET return array */
    127enum cxacru_info_idx {
    128	CXINF_DOWNSTREAM_RATE,
    129	CXINF_UPSTREAM_RATE,
    130	CXINF_LINK_STATUS,
    131	CXINF_LINE_STATUS,
    132	CXINF_MAC_ADDRESS_HIGH,
    133	CXINF_MAC_ADDRESS_LOW,
    134	CXINF_UPSTREAM_SNR_MARGIN,
    135	CXINF_DOWNSTREAM_SNR_MARGIN,
    136	CXINF_UPSTREAM_ATTENUATION,
    137	CXINF_DOWNSTREAM_ATTENUATION,
    138	CXINF_TRANSMITTER_POWER,
    139	CXINF_UPSTREAM_BITS_PER_FRAME,
    140	CXINF_DOWNSTREAM_BITS_PER_FRAME,
    141	CXINF_STARTUP_ATTEMPTS,
    142	CXINF_UPSTREAM_CRC_ERRORS,
    143	CXINF_DOWNSTREAM_CRC_ERRORS,
    144	CXINF_UPSTREAM_FEC_ERRORS,
    145	CXINF_DOWNSTREAM_FEC_ERRORS,
    146	CXINF_UPSTREAM_HEC_ERRORS,
    147	CXINF_DOWNSTREAM_HEC_ERRORS,
    148	CXINF_LINE_STARTABLE,
    149	CXINF_MODULATION,
    150	CXINF_ADSL_HEADEND,
    151	CXINF_ADSL_HEADEND_ENVIRONMENT,
    152	CXINF_CONTROLLER_VERSION,
    153	/* dunno what the missing two mean */
    154	CXINF_MAX = 0x1c,
    155};
    156
    157enum cxacru_poll_state {
    158	CXPOLL_STOPPING,
    159	CXPOLL_STOPPED,
    160	CXPOLL_POLLING,
    161	CXPOLL_SHUTDOWN
    162};
    163
    164struct cxacru_modem_type {
    165	u32 pll_f_clk;
    166	u32 pll_b_clk;
    167	int boot_rom_patch;
    168};
    169
    170struct cxacru_data {
    171	struct usbatm_data *usbatm;
    172
    173	const struct cxacru_modem_type *modem_type;
    174
    175	int line_status;
    176	struct mutex adsl_state_serialize;
    177	int adsl_status;
    178	struct delayed_work poll_work;
    179	u32 card_info[CXINF_MAX];
    180	struct mutex poll_state_serialize;
    181	enum cxacru_poll_state poll_state;
    182
    183	/* control handles */
    184	struct mutex cm_serialize;
    185	u8 *rcv_buf;
    186	u8 *snd_buf;
    187	struct urb *rcv_urb;
    188	struct urb *snd_urb;
    189	struct completion rcv_done;
    190	struct completion snd_done;
    191};
    192
    193static int cxacru_cm(struct cxacru_data *instance, enum cxacru_cm_request cm,
    194	u8 *wdata, int wsize, u8 *rdata, int rsize);
    195static void cxacru_poll_status(struct work_struct *work);
    196
    197/* Card info exported through sysfs */
    198#define CXACRU__ATTR_INIT(_name) \
    199static DEVICE_ATTR_RO(_name)
    200
    201#define CXACRU_CMD_INIT(_name) \
    202static DEVICE_ATTR_RW(_name)
    203
    204#define CXACRU_SET_INIT(_name) \
    205static DEVICE_ATTR_WO(_name)
    206
    207#define CXACRU_ATTR_INIT(_value, _type, _name) \
    208static ssize_t _name##_show(struct device *dev, \
    209	struct device_attribute *attr, char *buf) \
    210{ \
    211	struct cxacru_data *instance = to_usbatm_driver_data(\
    212		to_usb_interface(dev)); \
    213\
    214	if (instance == NULL) \
    215		return -ENODEV; \
    216\
    217	return cxacru_sysfs_showattr_##_type(instance->card_info[_value], buf); \
    218} \
    219CXACRU__ATTR_INIT(_name)
    220
    221#define CXACRU_ATTR_CREATE(_v, _t, _name) CXACRU_DEVICE_CREATE_FILE(_name)
    222#define CXACRU_CMD_CREATE(_name)          CXACRU_DEVICE_CREATE_FILE(_name)
    223#define CXACRU_SET_CREATE(_name)          CXACRU_DEVICE_CREATE_FILE(_name)
    224#define CXACRU__ATTR_CREATE(_name)        CXACRU_DEVICE_CREATE_FILE(_name)
    225
    226#define CXACRU_ATTR_REMOVE(_v, _t, _name) CXACRU_DEVICE_REMOVE_FILE(_name)
    227#define CXACRU_CMD_REMOVE(_name)          CXACRU_DEVICE_REMOVE_FILE(_name)
    228#define CXACRU_SET_REMOVE(_name)          CXACRU_DEVICE_REMOVE_FILE(_name)
    229#define CXACRU__ATTR_REMOVE(_name)        CXACRU_DEVICE_REMOVE_FILE(_name)
    230
    231static ssize_t cxacru_sysfs_showattr_u32(u32 value, char *buf)
    232{
    233	return sprintf(buf, "%u\n", value);
    234}
    235
    236static ssize_t cxacru_sysfs_showattr_s8(s8 value, char *buf)
    237{
    238	return sprintf(buf, "%d\n", value);
    239}
    240
    241static ssize_t cxacru_sysfs_showattr_dB(s16 value, char *buf)
    242{
    243	if (likely(value >= 0)) {
    244		return snprintf(buf, PAGE_SIZE, "%u.%02u\n",
    245					value / 100, value % 100);
    246	} else {
    247		value = -value;
    248		return snprintf(buf, PAGE_SIZE, "-%u.%02u\n",
    249					value / 100, value % 100);
    250	}
    251}
    252
    253static ssize_t cxacru_sysfs_showattr_bool(u32 value, char *buf)
    254{
    255	static char *str[] = { "no", "yes" };
    256
    257	if (unlikely(value >= ARRAY_SIZE(str)))
    258		return sprintf(buf, "%u\n", value);
    259	return sprintf(buf, "%s\n", str[value]);
    260}
    261
    262static ssize_t cxacru_sysfs_showattr_LINK(u32 value, char *buf)
    263{
    264	static char *str[] = { NULL, "not connected", "connected", "lost" };
    265
    266	if (unlikely(value >= ARRAY_SIZE(str) || str[value] == NULL))
    267		return sprintf(buf, "%u\n", value);
    268	return sprintf(buf, "%s\n", str[value]);
    269}
    270
    271static ssize_t cxacru_sysfs_showattr_LINE(u32 value, char *buf)
    272{
    273	static char *str[] = { "down", "attempting to activate",
    274		"training", "channel analysis", "exchange", "up",
    275		"waiting", "initialising"
    276	};
    277	if (unlikely(value >= ARRAY_SIZE(str)))
    278		return sprintf(buf, "%u\n", value);
    279	return sprintf(buf, "%s\n", str[value]);
    280}
    281
    282static ssize_t cxacru_sysfs_showattr_MODU(u32 value, char *buf)
    283{
    284	static char *str[] = {
    285			"",
    286			"ANSI T1.413",
    287			"ITU-T G.992.1 (G.DMT)",
    288			"ITU-T G.992.2 (G.LITE)"
    289	};
    290	if (unlikely(value >= ARRAY_SIZE(str)))
    291		return sprintf(buf, "%u\n", value);
    292	return sprintf(buf, "%s\n", str[value]);
    293}
    294
    295/*
    296 * This could use MAC_ADDRESS_HIGH and MAC_ADDRESS_LOW, but since
    297 * this data is already in atm_dev there's no point.
    298 *
    299 * MAC_ADDRESS_HIGH = 0x????5544
    300 * MAC_ADDRESS_LOW  = 0x33221100
    301 * Where 00-55 are bytes 0-5 of the MAC.
    302 */
    303static ssize_t mac_address_show(struct device *dev,
    304	struct device_attribute *attr, char *buf)
    305{
    306	struct cxacru_data *instance = to_usbatm_driver_data(
    307			to_usb_interface(dev));
    308
    309	if (instance == NULL || instance->usbatm->atm_dev == NULL)
    310		return -ENODEV;
    311
    312	return sprintf(buf, "%pM\n", instance->usbatm->atm_dev->esi);
    313}
    314
    315static ssize_t adsl_state_show(struct device *dev,
    316	struct device_attribute *attr, char *buf)
    317{
    318	static char *str[] = { "running", "stopped" };
    319	struct cxacru_data *instance = to_usbatm_driver_data(
    320			to_usb_interface(dev));
    321	u32 value;
    322
    323	if (instance == NULL)
    324		return -ENODEV;
    325
    326	value = instance->card_info[CXINF_LINE_STARTABLE];
    327	if (unlikely(value >= ARRAY_SIZE(str)))
    328		return sprintf(buf, "%u\n", value);
    329	return sprintf(buf, "%s\n", str[value]);
    330}
    331
    332static ssize_t adsl_state_store(struct device *dev,
    333	struct device_attribute *attr, const char *buf, size_t count)
    334{
    335	struct cxacru_data *instance = to_usbatm_driver_data(
    336			to_usb_interface(dev));
    337	int ret;
    338	int poll = -1;
    339	char str_cmd[8];
    340	int len = strlen(buf);
    341
    342	if (!capable(CAP_NET_ADMIN))
    343		return -EACCES;
    344
    345	ret = sscanf(buf, "%7s", str_cmd);
    346	if (ret != 1)
    347		return -EINVAL;
    348	ret = 0;
    349
    350	if (instance == NULL)
    351		return -ENODEV;
    352
    353	if (mutex_lock_interruptible(&instance->adsl_state_serialize))
    354		return -ERESTARTSYS;
    355
    356	if (!strcmp(str_cmd, "stop") || !strcmp(str_cmd, "restart")) {
    357		ret = cxacru_cm(instance, CM_REQUEST_CHIP_ADSL_LINE_STOP, NULL, 0, NULL, 0);
    358		if (ret < 0) {
    359			atm_err(instance->usbatm, "change adsl state:"
    360				" CHIP_ADSL_LINE_STOP returned %d\n", ret);
    361
    362			ret = -EIO;
    363		} else {
    364			ret = len;
    365			poll = CXPOLL_STOPPED;
    366		}
    367	}
    368
    369	/* Line status is only updated every second
    370	 * and the device appears to only react to
    371	 * START/STOP every second too. Wait 1.5s to
    372	 * be sure that restart will have an effect. */
    373	if (!strcmp(str_cmd, "restart"))
    374		msleep(1500);
    375
    376	if (!strcmp(str_cmd, "start") || !strcmp(str_cmd, "restart")) {
    377		ret = cxacru_cm(instance, CM_REQUEST_CHIP_ADSL_LINE_START, NULL, 0, NULL, 0);
    378		if (ret < 0) {
    379			atm_err(instance->usbatm, "change adsl state:"
    380				" CHIP_ADSL_LINE_START returned %d\n", ret);
    381
    382			ret = -EIO;
    383		} else {
    384			ret = len;
    385			poll = CXPOLL_POLLING;
    386		}
    387	}
    388
    389	if (!strcmp(str_cmd, "poll")) {
    390		ret = len;
    391		poll = CXPOLL_POLLING;
    392	}
    393
    394	if (ret == 0) {
    395		ret = -EINVAL;
    396		poll = -1;
    397	}
    398
    399	if (poll == CXPOLL_POLLING) {
    400		mutex_lock(&instance->poll_state_serialize);
    401		switch (instance->poll_state) {
    402		case CXPOLL_STOPPED:
    403			/* start polling */
    404			instance->poll_state = CXPOLL_POLLING;
    405			break;
    406
    407		case CXPOLL_STOPPING:
    408			/* abort stop request */
    409			instance->poll_state = CXPOLL_POLLING;
    410			fallthrough;
    411		case CXPOLL_POLLING:
    412		case CXPOLL_SHUTDOWN:
    413			/* don't start polling */
    414			poll = -1;
    415		}
    416		mutex_unlock(&instance->poll_state_serialize);
    417	} else if (poll == CXPOLL_STOPPED) {
    418		mutex_lock(&instance->poll_state_serialize);
    419		/* request stop */
    420		if (instance->poll_state == CXPOLL_POLLING)
    421			instance->poll_state = CXPOLL_STOPPING;
    422		mutex_unlock(&instance->poll_state_serialize);
    423	}
    424
    425	mutex_unlock(&instance->adsl_state_serialize);
    426
    427	if (poll == CXPOLL_POLLING)
    428		cxacru_poll_status(&instance->poll_work.work);
    429
    430	return ret;
    431}
    432
    433/* CM_REQUEST_CARD_DATA_GET times out, so no show attribute */
    434
    435static ssize_t adsl_config_store(struct device *dev,
    436	struct device_attribute *attr, const char *buf, size_t count)
    437{
    438	struct cxacru_data *instance = to_usbatm_driver_data(
    439			to_usb_interface(dev));
    440	int len = strlen(buf);
    441	int ret, pos, num;
    442	__le32 data[CMD_PACKET_SIZE / 4];
    443
    444	if (!capable(CAP_NET_ADMIN))
    445		return -EACCES;
    446
    447	if (instance == NULL)
    448		return -ENODEV;
    449
    450	pos = 0;
    451	num = 0;
    452	while (pos < len) {
    453		int tmp;
    454		u32 index;
    455		u32 value;
    456
    457		ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
    458		if (ret < 2)
    459			return -EINVAL;
    460		if (index > 0x7f)
    461			return -EINVAL;
    462		if (tmp < 0 || tmp > len - pos)
    463			return -EINVAL;
    464		pos += tmp;
    465
    466		/* skip trailing newline */
    467		if (buf[pos] == '\n' && pos == len-1)
    468			pos++;
    469
    470		data[num * 2 + 1] = cpu_to_le32(index);
    471		data[num * 2 + 2] = cpu_to_le32(value);
    472		num++;
    473
    474		/* send config values when data buffer is full
    475		 * or no more data
    476		 */
    477		if (pos >= len || num >= CMD_MAX_CONFIG) {
    478			char log[CMD_MAX_CONFIG * 12 + 1]; /* %02x=%08x */
    479
    480			data[0] = cpu_to_le32(num);
    481			ret = cxacru_cm(instance, CM_REQUEST_CARD_DATA_SET,
    482				(u8 *) data, 4 + num * 8, NULL, 0);
    483			if (ret < 0) {
    484				atm_err(instance->usbatm,
    485					"set card data returned %d\n", ret);
    486				return -EIO;
    487			}
    488
    489			for (tmp = 0; tmp < num; tmp++)
    490				snprintf(log + tmp*12, 13, " %02x=%08x",
    491					le32_to_cpu(data[tmp * 2 + 1]),
    492					le32_to_cpu(data[tmp * 2 + 2]));
    493			atm_info(instance->usbatm, "config%s\n", log);
    494			num = 0;
    495		}
    496	}
    497
    498	return len;
    499}
    500
    501/*
    502 * All device attributes are included in CXACRU_ALL_FILES
    503 * so that the same list can be used multiple times:
    504 *     INIT   (define the device attributes)
    505 *     CREATE (create all the device files)
    506 *     REMOVE (remove all the device files)
    507 *
    508 * With the last two being defined as needed in the functions
    509 * they are used in before calling CXACRU_ALL_FILES()
    510 */
    511#define CXACRU_ALL_FILES(_action) \
    512CXACRU_ATTR_##_action(CXINF_DOWNSTREAM_RATE,           u32,  downstream_rate); \
    513CXACRU_ATTR_##_action(CXINF_UPSTREAM_RATE,             u32,  upstream_rate); \
    514CXACRU_ATTR_##_action(CXINF_LINK_STATUS,               LINK, link_status); \
    515CXACRU_ATTR_##_action(CXINF_LINE_STATUS,               LINE, line_status); \
    516CXACRU__ATTR_##_action(                                      mac_address); \
    517CXACRU_ATTR_##_action(CXINF_UPSTREAM_SNR_MARGIN,       dB,   upstream_snr_margin); \
    518CXACRU_ATTR_##_action(CXINF_DOWNSTREAM_SNR_MARGIN,     dB,   downstream_snr_margin); \
    519CXACRU_ATTR_##_action(CXINF_UPSTREAM_ATTENUATION,      dB,   upstream_attenuation); \
    520CXACRU_ATTR_##_action(CXINF_DOWNSTREAM_ATTENUATION,    dB,   downstream_attenuation); \
    521CXACRU_ATTR_##_action(CXINF_TRANSMITTER_POWER,         s8,   transmitter_power); \
    522CXACRU_ATTR_##_action(CXINF_UPSTREAM_BITS_PER_FRAME,   u32,  upstream_bits_per_frame); \
    523CXACRU_ATTR_##_action(CXINF_DOWNSTREAM_BITS_PER_FRAME, u32,  downstream_bits_per_frame); \
    524CXACRU_ATTR_##_action(CXINF_STARTUP_ATTEMPTS,          u32,  startup_attempts); \
    525CXACRU_ATTR_##_action(CXINF_UPSTREAM_CRC_ERRORS,       u32,  upstream_crc_errors); \
    526CXACRU_ATTR_##_action(CXINF_DOWNSTREAM_CRC_ERRORS,     u32,  downstream_crc_errors); \
    527CXACRU_ATTR_##_action(CXINF_UPSTREAM_FEC_ERRORS,       u32,  upstream_fec_errors); \
    528CXACRU_ATTR_##_action(CXINF_DOWNSTREAM_FEC_ERRORS,     u32,  downstream_fec_errors); \
    529CXACRU_ATTR_##_action(CXINF_UPSTREAM_HEC_ERRORS,       u32,  upstream_hec_errors); \
    530CXACRU_ATTR_##_action(CXINF_DOWNSTREAM_HEC_ERRORS,     u32,  downstream_hec_errors); \
    531CXACRU_ATTR_##_action(CXINF_LINE_STARTABLE,            bool, line_startable); \
    532CXACRU_ATTR_##_action(CXINF_MODULATION,                MODU, modulation); \
    533CXACRU_ATTR_##_action(CXINF_ADSL_HEADEND,              u32,  adsl_headend); \
    534CXACRU_ATTR_##_action(CXINF_ADSL_HEADEND_ENVIRONMENT,  u32,  adsl_headend_environment); \
    535CXACRU_ATTR_##_action(CXINF_CONTROLLER_VERSION,        u32,  adsl_controller_version); \
    536CXACRU_CMD_##_action(                                        adsl_state); \
    537CXACRU_SET_##_action(                                        adsl_config);
    538
    539CXACRU_ALL_FILES(INIT);
    540
    541static struct attribute *cxacru_attrs[] = {
    542	&dev_attr_adsl_config.attr,
    543	&dev_attr_adsl_state.attr,
    544	&dev_attr_adsl_controller_version.attr,
    545	&dev_attr_adsl_headend_environment.attr,
    546	&dev_attr_adsl_headend.attr,
    547	&dev_attr_modulation.attr,
    548	&dev_attr_line_startable.attr,
    549	&dev_attr_downstream_hec_errors.attr,
    550	&dev_attr_upstream_hec_errors.attr,
    551	&dev_attr_downstream_fec_errors.attr,
    552	&dev_attr_upstream_fec_errors.attr,
    553	&dev_attr_downstream_crc_errors.attr,
    554	&dev_attr_upstream_crc_errors.attr,
    555	&dev_attr_startup_attempts.attr,
    556	&dev_attr_downstream_bits_per_frame.attr,
    557	&dev_attr_upstream_bits_per_frame.attr,
    558	&dev_attr_transmitter_power.attr,
    559	&dev_attr_downstream_attenuation.attr,
    560	&dev_attr_upstream_attenuation.attr,
    561	&dev_attr_downstream_snr_margin.attr,
    562	&dev_attr_upstream_snr_margin.attr,
    563	&dev_attr_mac_address.attr,
    564	&dev_attr_line_status.attr,
    565	&dev_attr_link_status.attr,
    566	&dev_attr_upstream_rate.attr,
    567	&dev_attr_downstream_rate.attr,
    568	NULL,
    569};
    570ATTRIBUTE_GROUPS(cxacru);
    571
    572/* the following three functions are stolen from drivers/usb/core/message.c */
    573static void cxacru_blocking_completion(struct urb *urb)
    574{
    575	complete(urb->context);
    576}
    577
    578struct cxacru_timer {
    579	struct timer_list timer;
    580	struct urb *urb;
    581};
    582
    583static void cxacru_timeout_kill(struct timer_list *t)
    584{
    585	struct cxacru_timer *timer = from_timer(timer, t, timer);
    586
    587	usb_unlink_urb(timer->urb);
    588}
    589
    590static int cxacru_start_wait_urb(struct urb *urb, struct completion *done,
    591				 int *actual_length)
    592{
    593	struct cxacru_timer timer = {
    594		.urb = urb,
    595	};
    596
    597	timer_setup_on_stack(&timer.timer, cxacru_timeout_kill, 0);
    598	mod_timer(&timer.timer, jiffies + msecs_to_jiffies(CMD_TIMEOUT));
    599	wait_for_completion(done);
    600	del_timer_sync(&timer.timer);
    601	destroy_timer_on_stack(&timer.timer);
    602
    603	if (actual_length)
    604		*actual_length = urb->actual_length;
    605	return urb->status; /* must read status after completion */
    606}
    607
    608static int cxacru_cm(struct cxacru_data *instance, enum cxacru_cm_request cm,
    609		     u8 *wdata, int wsize, u8 *rdata, int rsize)
    610{
    611	int ret, actlen;
    612	int offb, offd;
    613	const int stride = CMD_PACKET_SIZE - 4;
    614	u8 *wbuf = instance->snd_buf;
    615	u8 *rbuf = instance->rcv_buf;
    616	int wbuflen = ((wsize - 1) / stride + 1) * CMD_PACKET_SIZE;
    617	int rbuflen = ((rsize - 1) / stride + 1) * CMD_PACKET_SIZE;
    618
    619	if (wbuflen > PAGE_SIZE || rbuflen > PAGE_SIZE) {
    620		if (printk_ratelimit())
    621			usb_err(instance->usbatm, "requested transfer size too large (%d, %d)\n",
    622				wbuflen, rbuflen);
    623		ret = -ENOMEM;
    624		goto err;
    625	}
    626
    627	mutex_lock(&instance->cm_serialize);
    628
    629	/* submit reading urb before the writing one */
    630	init_completion(&instance->rcv_done);
    631	ret = usb_submit_urb(instance->rcv_urb, GFP_KERNEL);
    632	if (ret < 0) {
    633		if (printk_ratelimit())
    634			usb_err(instance->usbatm, "submit of read urb for cm %#x failed (%d)\n",
    635				cm, ret);
    636		goto fail;
    637	}
    638
    639	memset(wbuf, 0, wbuflen);
    640	/* handle wsize == 0 */
    641	wbuf[0] = cm;
    642	for (offb = offd = 0; offd < wsize; offd += stride, offb += CMD_PACKET_SIZE) {
    643		wbuf[offb] = cm;
    644		memcpy(wbuf + offb + 4, wdata + offd, min_t(int, stride, wsize - offd));
    645	}
    646
    647	instance->snd_urb->transfer_buffer_length = wbuflen;
    648	init_completion(&instance->snd_done);
    649	ret = usb_submit_urb(instance->snd_urb, GFP_KERNEL);
    650	if (ret < 0) {
    651		if (printk_ratelimit())
    652			usb_err(instance->usbatm, "submit of write urb for cm %#x failed (%d)\n",
    653				cm, ret);
    654		goto fail;
    655	}
    656
    657	ret = cxacru_start_wait_urb(instance->snd_urb, &instance->snd_done, NULL);
    658	if (ret < 0) {
    659		if (printk_ratelimit())
    660			usb_err(instance->usbatm, "send of cm %#x failed (%d)\n", cm, ret);
    661		goto fail;
    662	}
    663
    664	ret = cxacru_start_wait_urb(instance->rcv_urb, &instance->rcv_done, &actlen);
    665	if (ret < 0) {
    666		if (printk_ratelimit())
    667			usb_err(instance->usbatm, "receive of cm %#x failed (%d)\n", cm, ret);
    668		goto fail;
    669	}
    670	if (actlen % CMD_PACKET_SIZE || !actlen) {
    671		if (printk_ratelimit())
    672			usb_err(instance->usbatm, "invalid response length to cm %#x: %d\n",
    673				cm, actlen);
    674		ret = -EIO;
    675		goto fail;
    676	}
    677
    678	/* check the return status and copy the data to the output buffer, if needed */
    679	for (offb = offd = 0; offd < rsize && offb < actlen; offb += CMD_PACKET_SIZE) {
    680		if (rbuf[offb] != cm) {
    681			if (printk_ratelimit())
    682				usb_err(instance->usbatm, "wrong cm %#x in response to cm %#x\n",
    683					rbuf[offb], cm);
    684			ret = -EIO;
    685			goto fail;
    686		}
    687		if (rbuf[offb + 1] != CM_STATUS_SUCCESS) {
    688			if (printk_ratelimit())
    689				usb_err(instance->usbatm, "response to cm %#x failed: %#x\n",
    690					cm, rbuf[offb + 1]);
    691			ret = -EIO;
    692			goto fail;
    693		}
    694		if (offd >= rsize)
    695			break;
    696		memcpy(rdata + offd, rbuf + offb + 4, min_t(int, stride, rsize - offd));
    697		offd += stride;
    698	}
    699
    700	ret = offd;
    701	usb_dbg(instance->usbatm, "cm %#x\n", cm);
    702fail:
    703	mutex_unlock(&instance->cm_serialize);
    704err:
    705	return ret;
    706}
    707
    708static int cxacru_cm_get_array(struct cxacru_data *instance, enum cxacru_cm_request cm,
    709			       u32 *data, int size)
    710{
    711	int ret, len;
    712	__le32 *buf;
    713	int offb;
    714	unsigned int offd;
    715	const int stride = CMD_PACKET_SIZE / (4 * 2) - 1;
    716	int buflen =  ((size - 1) / stride + 1 + size * 2) * 4;
    717
    718	buf = kmalloc(buflen, GFP_KERNEL);
    719	if (!buf)
    720		return -ENOMEM;
    721
    722	ret = cxacru_cm(instance, cm, NULL, 0, (u8 *) buf, buflen);
    723	if (ret < 0)
    724		goto cleanup;
    725
    726	/* len > 0 && len % 4 == 0 guaranteed by cxacru_cm() */
    727	len = ret / 4;
    728	for (offb = 0; offb < len; ) {
    729		int l = le32_to_cpu(buf[offb++]);
    730
    731		if (l < 0 || l > stride || l > (len - offb) / 2) {
    732			if (printk_ratelimit())
    733				usb_err(instance->usbatm, "invalid data length from cm %#x: %d\n",
    734					cm, l);
    735			ret = -EIO;
    736			goto cleanup;
    737		}
    738		while (l--) {
    739			offd = le32_to_cpu(buf[offb++]);
    740			if (offd >= size) {
    741				if (printk_ratelimit())
    742					usb_err(instance->usbatm, "wrong index %#x in response to cm %#x\n",
    743						offd, cm);
    744				ret = -EIO;
    745				goto cleanup;
    746			}
    747			data[offd] = le32_to_cpu(buf[offb++]);
    748		}
    749	}
    750
    751	ret = 0;
    752
    753cleanup:
    754	kfree(buf);
    755	return ret;
    756}
    757
    758static int cxacru_card_status(struct cxacru_data *instance)
    759{
    760	int ret = cxacru_cm(instance, CM_REQUEST_CARD_GET_STATUS, NULL, 0, NULL, 0);
    761
    762	if (ret < 0) {		/* firmware not loaded */
    763		usb_dbg(instance->usbatm, "cxacru_adsl_start: CARD_GET_STATUS returned %d\n", ret);
    764		return ret;
    765	}
    766	return 0;
    767}
    768
    769static int cxacru_atm_start(struct usbatm_data *usbatm_instance,
    770		struct atm_dev *atm_dev)
    771{
    772	struct cxacru_data *instance = usbatm_instance->driver_data;
    773	struct usb_interface *intf = usbatm_instance->usb_intf;
    774	int ret;
    775	int start_polling = 1;
    776
    777	dev_dbg(&intf->dev, "%s\n", __func__);
    778
    779	/* Read MAC address */
    780	ret = cxacru_cm(instance, CM_REQUEST_CARD_GET_MAC_ADDRESS, NULL, 0,
    781			atm_dev->esi, sizeof(atm_dev->esi));
    782	if (ret < 0) {
    783		atm_err(usbatm_instance, "cxacru_atm_start: CARD_GET_MAC_ADDRESS returned %d\n", ret);
    784		return ret;
    785	}
    786
    787	/* start ADSL */
    788	mutex_lock(&instance->adsl_state_serialize);
    789	ret = cxacru_cm(instance, CM_REQUEST_CHIP_ADSL_LINE_START, NULL, 0, NULL, 0);
    790	if (ret < 0)
    791		atm_err(usbatm_instance, "cxacru_atm_start: CHIP_ADSL_LINE_START returned %d\n", ret);
    792
    793	/* Start status polling */
    794	mutex_lock(&instance->poll_state_serialize);
    795	switch (instance->poll_state) {
    796	case CXPOLL_STOPPED:
    797		/* start polling */
    798		instance->poll_state = CXPOLL_POLLING;
    799		break;
    800
    801	case CXPOLL_STOPPING:
    802		/* abort stop request */
    803		instance->poll_state = CXPOLL_POLLING;
    804		fallthrough;
    805	case CXPOLL_POLLING:
    806	case CXPOLL_SHUTDOWN:
    807		/* don't start polling */
    808		start_polling = 0;
    809	}
    810	mutex_unlock(&instance->poll_state_serialize);
    811	mutex_unlock(&instance->adsl_state_serialize);
    812
    813	if (start_polling)
    814		cxacru_poll_status(&instance->poll_work.work);
    815	return 0;
    816}
    817
    818static void cxacru_poll_status(struct work_struct *work)
    819{
    820	struct cxacru_data *instance =
    821		container_of(work, struct cxacru_data, poll_work.work);
    822	u32 buf[CXINF_MAX] = {};
    823	struct usbatm_data *usbatm = instance->usbatm;
    824	struct atm_dev *atm_dev = usbatm->atm_dev;
    825	int keep_polling = 1;
    826	int ret;
    827
    828	ret = cxacru_cm_get_array(instance, CM_REQUEST_CARD_INFO_GET, buf, CXINF_MAX);
    829	if (ret < 0) {
    830		if (ret != -ESHUTDOWN)
    831			atm_warn(usbatm, "poll status: error %d\n", ret);
    832
    833		mutex_lock(&instance->poll_state_serialize);
    834		if (instance->poll_state != CXPOLL_SHUTDOWN) {
    835			instance->poll_state = CXPOLL_STOPPED;
    836
    837			if (ret != -ESHUTDOWN)
    838				atm_warn(usbatm, "polling disabled, set adsl_state"
    839						" to 'start' or 'poll' to resume\n");
    840		}
    841		mutex_unlock(&instance->poll_state_serialize);
    842		goto reschedule;
    843	}
    844
    845	memcpy(instance->card_info, buf, sizeof(instance->card_info));
    846
    847	if (instance->adsl_status != buf[CXINF_LINE_STARTABLE]) {
    848		instance->adsl_status = buf[CXINF_LINE_STARTABLE];
    849
    850		switch (instance->adsl_status) {
    851		case 0:
    852			atm_info(usbatm, "ADSL state: running\n");
    853			break;
    854
    855		case 1:
    856			atm_info(usbatm, "ADSL state: stopped\n");
    857			break;
    858
    859		default:
    860			atm_info(usbatm, "Unknown adsl status %02x\n", instance->adsl_status);
    861			break;
    862		}
    863	}
    864
    865	if (instance->line_status == buf[CXINF_LINE_STATUS])
    866		goto reschedule;
    867
    868	instance->line_status = buf[CXINF_LINE_STATUS];
    869	switch (instance->line_status) {
    870	case 0:
    871		atm_dev_signal_change(atm_dev, ATM_PHY_SIG_LOST);
    872		atm_info(usbatm, "ADSL line: down\n");
    873		break;
    874
    875	case 1:
    876		atm_dev_signal_change(atm_dev, ATM_PHY_SIG_LOST);
    877		atm_info(usbatm, "ADSL line: attempting to activate\n");
    878		break;
    879
    880	case 2:
    881		atm_dev_signal_change(atm_dev, ATM_PHY_SIG_LOST);
    882		atm_info(usbatm, "ADSL line: training\n");
    883		break;
    884
    885	case 3:
    886		atm_dev_signal_change(atm_dev, ATM_PHY_SIG_LOST);
    887		atm_info(usbatm, "ADSL line: channel analysis\n");
    888		break;
    889
    890	case 4:
    891		atm_dev_signal_change(atm_dev, ATM_PHY_SIG_LOST);
    892		atm_info(usbatm, "ADSL line: exchange\n");
    893		break;
    894
    895	case 5:
    896		atm_dev->link_rate = buf[CXINF_DOWNSTREAM_RATE] * 1000 / 424;
    897		atm_dev_signal_change(atm_dev, ATM_PHY_SIG_FOUND);
    898
    899		atm_info(usbatm, "ADSL line: up (%d kb/s down | %d kb/s up)\n",
    900		     buf[CXINF_DOWNSTREAM_RATE], buf[CXINF_UPSTREAM_RATE]);
    901		break;
    902
    903	case 6:
    904		atm_dev_signal_change(atm_dev, ATM_PHY_SIG_LOST);
    905		atm_info(usbatm, "ADSL line: waiting\n");
    906		break;
    907
    908	case 7:
    909		atm_dev_signal_change(atm_dev, ATM_PHY_SIG_LOST);
    910		atm_info(usbatm, "ADSL line: initializing\n");
    911		break;
    912
    913	default:
    914		atm_dev_signal_change(atm_dev, ATM_PHY_SIG_UNKNOWN);
    915		atm_info(usbatm, "Unknown line state %02x\n", instance->line_status);
    916		break;
    917	}
    918reschedule:
    919
    920	mutex_lock(&instance->poll_state_serialize);
    921	if (instance->poll_state == CXPOLL_STOPPING &&
    922				instance->adsl_status == 1 && /* stopped */
    923				instance->line_status == 0) /* down */
    924		instance->poll_state = CXPOLL_STOPPED;
    925
    926	if (instance->poll_state == CXPOLL_STOPPED)
    927		keep_polling = 0;
    928	mutex_unlock(&instance->poll_state_serialize);
    929
    930	if (keep_polling)
    931		schedule_delayed_work(&instance->poll_work,
    932				round_jiffies_relative(POLL_INTERVAL*HZ));
    933}
    934
    935static int cxacru_fw(struct usb_device *usb_dev, enum cxacru_fw_request fw,
    936		     u8 code1, u8 code2, u32 addr, const u8 *data, int size)
    937{
    938	int ret;
    939	u8 *buf;
    940	int offd, offb;
    941	const int stride = CMD_PACKET_SIZE - 8;
    942
    943	buf = (u8 *) __get_free_page(GFP_KERNEL);
    944	if (!buf)
    945		return -ENOMEM;
    946
    947	offb = offd = 0;
    948	do {
    949		int l = min_t(int, stride, size - offd);
    950
    951		buf[offb++] = fw;
    952		buf[offb++] = l;
    953		buf[offb++] = code1;
    954		buf[offb++] = code2;
    955		put_unaligned(cpu_to_le32(addr), (__le32 *)(buf + offb));
    956		offb += 4;
    957		addr += l;
    958		if (l)
    959			memcpy(buf + offb, data + offd, l);
    960		if (l < stride)
    961			memset(buf + offb + l, 0, stride - l);
    962		offb += stride;
    963		offd += stride;
    964		if ((offb >= PAGE_SIZE) || (offd >= size)) {
    965			ret = usb_bulk_msg(usb_dev, usb_sndbulkpipe(usb_dev, CXACRU_EP_CMD),
    966					   buf, offb, NULL, CMD_TIMEOUT);
    967			if (ret < 0) {
    968				dev_dbg(&usb_dev->dev, "sending fw %#x failed\n", fw);
    969				goto cleanup;
    970			}
    971			offb = 0;
    972		}
    973	} while (offd < size);
    974	dev_dbg(&usb_dev->dev, "sent fw %#x\n", fw);
    975
    976	ret = 0;
    977
    978cleanup:
    979	free_page((unsigned long) buf);
    980	return ret;
    981}
    982
    983static void cxacru_upload_firmware(struct cxacru_data *instance,
    984				   const struct firmware *fw,
    985				   const struct firmware *bp)
    986{
    987	int ret;
    988	struct usbatm_data *usbatm = instance->usbatm;
    989	struct usb_device *usb_dev = usbatm->usb_dev;
    990	__le16 signature[] = { usb_dev->descriptor.idVendor,
    991			       usb_dev->descriptor.idProduct };
    992	__le32 val;
    993
    994	usb_dbg(usbatm, "%s\n", __func__);
    995
    996	/* FirmwarePllFClkValue */
    997	val = cpu_to_le32(instance->modem_type->pll_f_clk);
    998	ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLFCLK_ADDR, (u8 *) &val, 4);
    999	if (ret) {
   1000		usb_err(usbatm, "FirmwarePllFClkValue failed: %d\n", ret);
   1001		return;
   1002	}
   1003
   1004	/* FirmwarePllBClkValue */
   1005	val = cpu_to_le32(instance->modem_type->pll_b_clk);
   1006	ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, PLLBCLK_ADDR, (u8 *) &val, 4);
   1007	if (ret) {
   1008		usb_err(usbatm, "FirmwarePllBClkValue failed: %d\n", ret);
   1009		return;
   1010	}
   1011
   1012	/* Enable SDRAM */
   1013	val = cpu_to_le32(SDRAM_ENA);
   1014	ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SDRAMEN_ADDR, (u8 *) &val, 4);
   1015	if (ret) {
   1016		usb_err(usbatm, "Enable SDRAM failed: %d\n", ret);
   1017		return;
   1018	}
   1019
   1020	/* Firmware */
   1021	usb_info(usbatm, "loading firmware\n");
   1022	ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, FW_ADDR, fw->data, fw->size);
   1023	if (ret) {
   1024		usb_err(usbatm, "Firmware upload failed: %d\n", ret);
   1025		return;
   1026	}
   1027
   1028	/* Boot ROM patch */
   1029	if (instance->modem_type->boot_rom_patch) {
   1030		usb_info(usbatm, "loading boot ROM patch\n");
   1031		ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, BR_ADDR, bp->data, bp->size);
   1032		if (ret) {
   1033			usb_err(usbatm, "Boot ROM patching failed: %d\n", ret);
   1034			return;
   1035		}
   1036	}
   1037
   1038	/* Signature */
   1039	ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, SIG_ADDR, (u8 *) signature, 4);
   1040	if (ret) {
   1041		usb_err(usbatm, "Signature storing failed: %d\n", ret);
   1042		return;
   1043	}
   1044
   1045	usb_info(usbatm, "starting device\n");
   1046	if (instance->modem_type->boot_rom_patch) {
   1047		val = cpu_to_le32(BR_ADDR);
   1048		ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, BR_STACK_ADDR, (u8 *) &val, 4);
   1049	} else {
   1050		ret = cxacru_fw(usb_dev, FW_GOTO_MEM, 0x0, 0x0, FW_ADDR, NULL, 0);
   1051	}
   1052	if (ret) {
   1053		usb_err(usbatm, "Passing control to firmware failed: %d\n", ret);
   1054		return;
   1055	}
   1056
   1057	/* Delay to allow firmware to start up. */
   1058	msleep_interruptible(1000);
   1059
   1060	usb_clear_halt(usb_dev, usb_sndbulkpipe(usb_dev, CXACRU_EP_CMD));
   1061	usb_clear_halt(usb_dev, usb_rcvbulkpipe(usb_dev, CXACRU_EP_CMD));
   1062	usb_clear_halt(usb_dev, usb_sndbulkpipe(usb_dev, CXACRU_EP_DATA));
   1063	usb_clear_halt(usb_dev, usb_rcvbulkpipe(usb_dev, CXACRU_EP_DATA));
   1064
   1065	ret = cxacru_cm(instance, CM_REQUEST_CARD_GET_STATUS, NULL, 0, NULL, 0);
   1066	if (ret < 0) {
   1067		usb_err(usbatm, "modem failed to initialize: %d\n", ret);
   1068		return;
   1069	}
   1070}
   1071
   1072static int cxacru_find_firmware(struct cxacru_data *instance,
   1073				char *phase, const struct firmware **fw_p)
   1074{
   1075	struct usbatm_data *usbatm = instance->usbatm;
   1076	struct device *dev = &usbatm->usb_intf->dev;
   1077	char buf[16];
   1078
   1079	sprintf(buf, "cxacru-%s.bin", phase);
   1080	usb_dbg(usbatm, "cxacru_find_firmware: looking for %s\n", buf);
   1081
   1082	if (request_firmware(fw_p, buf, dev)) {
   1083		usb_dbg(usbatm, "no stage %s firmware found\n", phase);
   1084		return -ENOENT;
   1085	}
   1086
   1087	usb_info(usbatm, "found firmware %s\n", buf);
   1088
   1089	return 0;
   1090}
   1091
   1092static int cxacru_heavy_init(struct usbatm_data *usbatm_instance,
   1093			     struct usb_interface *usb_intf)
   1094{
   1095	const struct firmware *fw, *bp;
   1096	struct cxacru_data *instance = usbatm_instance->driver_data;
   1097	int ret = cxacru_find_firmware(instance, "fw", &fw);
   1098
   1099	if (ret) {
   1100		usb_warn(usbatm_instance, "firmware (cxacru-fw.bin) unavailable (system misconfigured?)\n");
   1101		return ret;
   1102	}
   1103
   1104	if (instance->modem_type->boot_rom_patch) {
   1105		ret = cxacru_find_firmware(instance, "bp", &bp);
   1106		if (ret) {
   1107			usb_warn(usbatm_instance, "boot ROM patch (cxacru-bp.bin) unavailable (system misconfigured?)\n");
   1108			release_firmware(fw);
   1109			return ret;
   1110		}
   1111	}
   1112
   1113	cxacru_upload_firmware(instance, fw, bp);
   1114
   1115	if (instance->modem_type->boot_rom_patch)
   1116		release_firmware(bp);
   1117	release_firmware(fw);
   1118
   1119	ret = cxacru_card_status(instance);
   1120	if (ret)
   1121		usb_dbg(usbatm_instance, "modem initialisation failed\n");
   1122	else
   1123		usb_dbg(usbatm_instance, "done setting up the modem\n");
   1124
   1125	return ret;
   1126}
   1127
   1128static int cxacru_bind(struct usbatm_data *usbatm_instance,
   1129		       struct usb_interface *intf, const struct usb_device_id *id)
   1130{
   1131	struct cxacru_data *instance;
   1132	struct usb_device *usb_dev = interface_to_usbdev(intf);
   1133	struct usb_host_endpoint *cmd_ep = usb_dev->ep_in[CXACRU_EP_CMD];
   1134	int ret;
   1135
   1136	/* instance init */
   1137	instance = kzalloc(sizeof(*instance), GFP_KERNEL);
   1138	if (!instance)
   1139		return -ENOMEM;
   1140
   1141	instance->usbatm = usbatm_instance;
   1142	instance->modem_type = (struct cxacru_modem_type *) id->driver_info;
   1143
   1144	mutex_init(&instance->poll_state_serialize);
   1145	instance->poll_state = CXPOLL_STOPPED;
   1146	instance->line_status = -1;
   1147	instance->adsl_status = -1;
   1148
   1149	mutex_init(&instance->adsl_state_serialize);
   1150
   1151	instance->rcv_buf = (u8 *) __get_free_page(GFP_KERNEL);
   1152	if (!instance->rcv_buf) {
   1153		usb_dbg(usbatm_instance, "cxacru_bind: no memory for rcv_buf\n");
   1154		ret = -ENOMEM;
   1155		goto fail;
   1156	}
   1157	instance->snd_buf = (u8 *) __get_free_page(GFP_KERNEL);
   1158	if (!instance->snd_buf) {
   1159		usb_dbg(usbatm_instance, "cxacru_bind: no memory for snd_buf\n");
   1160		ret = -ENOMEM;
   1161		goto fail;
   1162	}
   1163	instance->rcv_urb = usb_alloc_urb(0, GFP_KERNEL);
   1164	if (!instance->rcv_urb) {
   1165		ret = -ENOMEM;
   1166		goto fail;
   1167	}
   1168	instance->snd_urb = usb_alloc_urb(0, GFP_KERNEL);
   1169	if (!instance->snd_urb) {
   1170		ret = -ENOMEM;
   1171		goto fail;
   1172	}
   1173
   1174	if (!cmd_ep) {
   1175		usb_dbg(usbatm_instance, "cxacru_bind: no command endpoint\n");
   1176		ret = -ENODEV;
   1177		goto fail;
   1178	}
   1179
   1180	if ((cmd_ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
   1181			== USB_ENDPOINT_XFER_INT) {
   1182		usb_fill_int_urb(instance->rcv_urb,
   1183			usb_dev, usb_rcvintpipe(usb_dev, CXACRU_EP_CMD),
   1184			instance->rcv_buf, PAGE_SIZE,
   1185			cxacru_blocking_completion, &instance->rcv_done, 1);
   1186
   1187		usb_fill_int_urb(instance->snd_urb,
   1188			usb_dev, usb_sndintpipe(usb_dev, CXACRU_EP_CMD),
   1189			instance->snd_buf, PAGE_SIZE,
   1190			cxacru_blocking_completion, &instance->snd_done, 4);
   1191	} else {
   1192		usb_fill_bulk_urb(instance->rcv_urb,
   1193			usb_dev, usb_rcvbulkpipe(usb_dev, CXACRU_EP_CMD),
   1194			instance->rcv_buf, PAGE_SIZE,
   1195			cxacru_blocking_completion, &instance->rcv_done);
   1196
   1197		usb_fill_bulk_urb(instance->snd_urb,
   1198			usb_dev, usb_sndbulkpipe(usb_dev, CXACRU_EP_CMD),
   1199			instance->snd_buf, PAGE_SIZE,
   1200			cxacru_blocking_completion, &instance->snd_done);
   1201	}
   1202
   1203	mutex_init(&instance->cm_serialize);
   1204
   1205	INIT_DELAYED_WORK(&instance->poll_work, cxacru_poll_status);
   1206
   1207	usbatm_instance->driver_data = instance;
   1208
   1209	usbatm_instance->flags = (cxacru_card_status(instance) ? 0 : UDSL_SKIP_HEAVY_INIT);
   1210
   1211	return 0;
   1212
   1213 fail:
   1214	free_page((unsigned long) instance->snd_buf);
   1215	free_page((unsigned long) instance->rcv_buf);
   1216	usb_free_urb(instance->snd_urb);
   1217	usb_free_urb(instance->rcv_urb);
   1218	kfree(instance);
   1219
   1220	return ret;
   1221}
   1222
   1223static void cxacru_unbind(struct usbatm_data *usbatm_instance,
   1224		struct usb_interface *intf)
   1225{
   1226	struct cxacru_data *instance = usbatm_instance->driver_data;
   1227	int is_polling = 1;
   1228
   1229	usb_dbg(usbatm_instance, "cxacru_unbind entered\n");
   1230
   1231	if (!instance) {
   1232		usb_dbg(usbatm_instance, "cxacru_unbind: NULL instance!\n");
   1233		return;
   1234	}
   1235
   1236	mutex_lock(&instance->poll_state_serialize);
   1237	BUG_ON(instance->poll_state == CXPOLL_SHUTDOWN);
   1238
   1239	/* ensure that status polling continues unless
   1240	 * it has already stopped */
   1241	if (instance->poll_state == CXPOLL_STOPPED)
   1242		is_polling = 0;
   1243
   1244	/* stop polling from being stopped or started */
   1245	instance->poll_state = CXPOLL_SHUTDOWN;
   1246	mutex_unlock(&instance->poll_state_serialize);
   1247
   1248	if (is_polling)
   1249		cancel_delayed_work_sync(&instance->poll_work);
   1250
   1251	usb_kill_urb(instance->snd_urb);
   1252	usb_kill_urb(instance->rcv_urb);
   1253	usb_free_urb(instance->snd_urb);
   1254	usb_free_urb(instance->rcv_urb);
   1255
   1256	free_page((unsigned long) instance->snd_buf);
   1257	free_page((unsigned long) instance->rcv_buf);
   1258
   1259	kfree(instance);
   1260
   1261	usbatm_instance->driver_data = NULL;
   1262}
   1263
   1264static const struct cxacru_modem_type cxacru_cafe = {
   1265	.pll_f_clk = 0x02d874df,
   1266	.pll_b_clk = 0x0196a51a,
   1267	.boot_rom_patch = 1,
   1268};
   1269
   1270static const struct cxacru_modem_type cxacru_cb00 = {
   1271	.pll_f_clk = 0x5,
   1272	.pll_b_clk = 0x3,
   1273	.boot_rom_patch = 0,
   1274};
   1275
   1276static const struct usb_device_id cxacru_usb_ids[] = {
   1277	{ /* V = Conexant			P = ADSL modem (Euphrates project)	*/
   1278		USB_DEVICE(0x0572, 0xcafe),	.driver_info = (unsigned long) &cxacru_cafe
   1279	},
   1280	{ /* V = Conexant			P = ADSL modem (Hasbani project)	*/
   1281		USB_DEVICE(0x0572, 0xcb00),	.driver_info = (unsigned long) &cxacru_cb00
   1282	},
   1283	{ /* V = Conexant			P = ADSL modem				*/
   1284		USB_DEVICE(0x0572, 0xcb01),	.driver_info = (unsigned long) &cxacru_cb00
   1285	},
   1286	{ /* V = Conexant			P = ADSL modem (Well PTI-800) */
   1287		USB_DEVICE(0x0572, 0xcb02),	.driver_info = (unsigned long) &cxacru_cb00
   1288	},
   1289	{ /* V = Conexant			P = ADSL modem				*/
   1290		USB_DEVICE(0x0572, 0xcb06),	.driver_info = (unsigned long) &cxacru_cb00
   1291	},
   1292	{ /* V = Conexant			P = ADSL modem (ZTE ZXDSL 852)		*/
   1293		USB_DEVICE(0x0572, 0xcb07),	.driver_info = (unsigned long) &cxacru_cb00
   1294	},
   1295	{ /* V = Olitec				P = ADSL modem version 2		*/
   1296		USB_DEVICE(0x08e3, 0x0100),	.driver_info = (unsigned long) &cxacru_cafe
   1297	},
   1298	{ /* V = Olitec				P = ADSL modem version 3		*/
   1299		USB_DEVICE(0x08e3, 0x0102),	.driver_info = (unsigned long) &cxacru_cb00
   1300	},
   1301	{ /* V = Trust/Amigo Technology Co.	P = AMX-CA86U				*/
   1302		USB_DEVICE(0x0eb0, 0x3457),	.driver_info = (unsigned long) &cxacru_cafe
   1303	},
   1304	{ /* V = Zoom				P = 5510				*/
   1305		USB_DEVICE(0x1803, 0x5510),	.driver_info = (unsigned long) &cxacru_cb00
   1306	},
   1307	{ /* V = Draytek			P = Vigor 318				*/
   1308		USB_DEVICE(0x0675, 0x0200),	.driver_info = (unsigned long) &cxacru_cb00
   1309	},
   1310	{ /* V = Zyxel				P = 630-C1 aka OMNI ADSL USB (Annex A)	*/
   1311		USB_DEVICE(0x0586, 0x330a),	.driver_info = (unsigned long) &cxacru_cb00
   1312	},
   1313	{ /* V = Zyxel				P = 630-C3 aka OMNI ADSL USB (Annex B)	*/
   1314		USB_DEVICE(0x0586, 0x330b),	.driver_info = (unsigned long) &cxacru_cb00
   1315	},
   1316	{ /* V = Aethra				P = Starmodem UM1020			*/
   1317		USB_DEVICE(0x0659, 0x0020),	.driver_info = (unsigned long) &cxacru_cb00
   1318	},
   1319	{ /* V = Aztech Systems			P = ? AKA Pirelli AUA-010		*/
   1320		USB_DEVICE(0x0509, 0x0812),	.driver_info = (unsigned long) &cxacru_cb00
   1321	},
   1322	{ /* V = Netopia			P = Cayman 3341(Annex A)/3351(Annex B)	*/
   1323		USB_DEVICE(0x100d, 0xcb01),	.driver_info = (unsigned long) &cxacru_cb00
   1324	},
   1325	{ /* V = Netopia			P = Cayman 3342(Annex A)/3352(Annex B)	*/
   1326		USB_DEVICE(0x100d, 0x3342),	.driver_info = (unsigned long) &cxacru_cb00
   1327	},
   1328	{}
   1329};
   1330
   1331MODULE_DEVICE_TABLE(usb, cxacru_usb_ids);
   1332
   1333static struct usbatm_driver cxacru_driver = {
   1334	.driver_name	= cxacru_driver_name,
   1335	.bind		= cxacru_bind,
   1336	.heavy_init	= cxacru_heavy_init,
   1337	.unbind		= cxacru_unbind,
   1338	.atm_start	= cxacru_atm_start,
   1339	.bulk_in	= CXACRU_EP_DATA,
   1340	.bulk_out	= CXACRU_EP_DATA,
   1341	.rx_padding	= 3,
   1342	.tx_padding	= 11,
   1343};
   1344
   1345static int cxacru_usb_probe(struct usb_interface *intf,
   1346		const struct usb_device_id *id)
   1347{
   1348	struct usb_device *usb_dev = interface_to_usbdev(intf);
   1349	char buf[15];
   1350
   1351	/* Avoid ADSL routers (cx82310_eth).
   1352	 * Abort if bDeviceClass is 0xff and iProduct is "USB NET CARD".
   1353	 */
   1354	if (usb_dev->descriptor.bDeviceClass == USB_CLASS_VENDOR_SPEC
   1355			&& usb_string(usb_dev, usb_dev->descriptor.iProduct,
   1356				buf, sizeof(buf)) > 0) {
   1357		if (!strcmp(buf, "USB NET CARD")) {
   1358			dev_info(&intf->dev, "ignoring cx82310_eth device\n");
   1359			return -ENODEV;
   1360		}
   1361	}
   1362
   1363	return usbatm_usb_probe(intf, id, &cxacru_driver);
   1364}
   1365
   1366static struct usb_driver cxacru_usb_driver = {
   1367	.name		= cxacru_driver_name,
   1368	.probe		= cxacru_usb_probe,
   1369	.disconnect	= usbatm_usb_disconnect,
   1370	.id_table	= cxacru_usb_ids,
   1371	.dev_groups	= cxacru_groups,
   1372};
   1373
   1374module_usb_driver(cxacru_usb_driver);
   1375
   1376MODULE_AUTHOR(DRIVER_AUTHOR);
   1377MODULE_DESCRIPTION(DRIVER_DESC);
   1378MODULE_LICENSE("GPL");