1/* 2 * Intel Wireless UWB Link 1480 3 * USB SKU firmware upload implementation 4 * 5 * Copyright (C) 2005-2006 Intel Corporation 6 * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com> 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License version 10 * 2 as published by the Free Software Foundation. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License 18 * along with this program; if not, write to the Free Software 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 20 * 02110-1301, USA. 21 * 22 * 23 * This driver will prepare the i1480 device to behave as a real 24 * Wireless USB HWA adaptor by uploading the firmware. 25 * 26 * When the device is connected or driver is loaded, i1480_usb_probe() 27 * is called--this will allocate and initialize the device structure, 28 * fill in the pointers to the common functions (read, write, 29 * wait_init_done and cmd for HWA command execution) and once that is 30 * done, call the common firmware uploading routine. Then clean up and 31 * return -ENODEV, as we don't attach to the device. 32 * 33 * The rest are the basic ops we implement that the fw upload code 34 * uses to do its job. All the ops in the common code are i1480->NAME, 35 * the functions are i1480_usb_NAME(). 36 */ 37#include <linux/module.h> 38#include <linux/usb.h> 39#include <linux/interrupt.h> 40#include <linux/slab.h> 41#include <linux/delay.h> 42#include <linux/uwb.h> 43#include <linux/usb/wusb.h> 44#include <linux/usb/wusb-wa.h> 45#include "i1480-dfu.h" 46 47struct i1480_usb { 48 struct i1480 i1480; 49 struct usb_device *usb_dev; 50 struct usb_interface *usb_iface; 51 struct urb *neep_urb; /* URB for reading from EP1 */ 52}; 53 54 55static 56void i1480_usb_init(struct i1480_usb *i1480_usb) 57{ 58 i1480_init(&i1480_usb->i1480); 59} 60 61 62static 63int i1480_usb_create(struct i1480_usb *i1480_usb, struct usb_interface *iface) 64{ 65 struct usb_device *usb_dev = interface_to_usbdev(iface); 66 int result = -ENOMEM; 67 68 i1480_usb->usb_dev = usb_get_dev(usb_dev); /* bind the USB device */ 69 i1480_usb->usb_iface = usb_get_intf(iface); 70 usb_set_intfdata(iface, i1480_usb); /* Bind the driver to iface0 */ 71 i1480_usb->neep_urb = usb_alloc_urb(0, GFP_KERNEL); 72 if (i1480_usb->neep_urb == NULL) 73 goto error; 74 return 0; 75 76error: 77 usb_set_intfdata(iface, NULL); 78 usb_put_intf(iface); 79 usb_put_dev(usb_dev); 80 return result; 81} 82 83 84static 85void i1480_usb_destroy(struct i1480_usb *i1480_usb) 86{ 87 usb_kill_urb(i1480_usb->neep_urb); 88 usb_free_urb(i1480_usb->neep_urb); 89 usb_set_intfdata(i1480_usb->usb_iface, NULL); 90 usb_put_intf(i1480_usb->usb_iface); 91 usb_put_dev(i1480_usb->usb_dev); 92} 93 94 95/** 96 * Write a buffer to a memory address in the i1480 device 97 * 98 * @i1480: i1480 instance 99 * @memory_address: 100 * Address where to write the data buffer to. 101 * @buffer: Buffer to the data 102 * @size: Size of the buffer [has to be < 512]. 103 * @returns: 0 if ok, < 0 errno code on error. 104 * 105 * Data buffers to USB cannot be on the stack or in vmalloc'ed areas, 106 * so we copy it to the local i1480 buffer before proceeding. In any 107 * case, we have a max size we can send. 108 */ 109static 110int i1480_usb_write(struct i1480 *i1480, u32 memory_address, 111 const void *buffer, size_t size) 112{ 113 int result = 0; 114 struct i1480_usb *i1480_usb = container_of(i1480, struct i1480_usb, i1480); 115 size_t buffer_size, itr = 0; 116 117 BUG_ON(size & 0x3); /* Needs to be a multiple of 4 */ 118 while (size > 0) { 119 buffer_size = size < i1480->buf_size ? size : i1480->buf_size; 120 memcpy(i1480->cmd_buf, buffer + itr, buffer_size); 121 result = usb_control_msg( 122 i1480_usb->usb_dev, usb_sndctrlpipe(i1480_usb->usb_dev, 0), 123 0xf0, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 124 memory_address, (memory_address >> 16), 125 i1480->cmd_buf, buffer_size, 100 /* FIXME: arbitrary */); 126 if (result < 0) 127 break; 128 itr += result; 129 memory_address += result; 130 size -= result; 131 } 132 return result; 133} 134 135 136/** 137 * Read a block [max size 512] of the device's memory to @i1480's buffer. 138 * 139 * @i1480: i1480 instance 140 * @memory_address: 141 * Address where to read from. 142 * @size: Size to read. Smaller than or equal to 512. 143 * @returns: >= 0 number of bytes written if ok, < 0 errno code on error. 144 * 145 * NOTE: if the memory address or block is incorrect, you might get a 146 * stall or a different memory read. Caller has to verify the 147 * memory address and size passed back in the @neh structure. 148 */ 149static 150int i1480_usb_read(struct i1480 *i1480, u32 addr, size_t size) 151{ 152 ssize_t result = 0, bytes = 0; 153 size_t itr, read_size = i1480->buf_size; 154 struct i1480_usb *i1480_usb = container_of(i1480, struct i1480_usb, i1480); 155 156 BUG_ON(size > i1480->buf_size); 157 BUG_ON(size & 0x3); /* Needs to be a multiple of 4 */ 158 BUG_ON(read_size > 512); 159 160 if (addr >= 0x8000d200 && addr < 0x8000d400) /* Yeah, HW quirk */ 161 read_size = 4; 162 163 for (itr = 0; itr < size; itr += read_size) { 164 size_t itr_addr = addr + itr; 165 size_t itr_size = min(read_size, size - itr); 166 result = usb_control_msg( 167 i1480_usb->usb_dev, usb_rcvctrlpipe(i1480_usb->usb_dev, 0), 168 0xf0, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 169 itr_addr, (itr_addr >> 16), 170 i1480->cmd_buf + itr, itr_size, 171 100 /* FIXME: arbitrary */); 172 if (result < 0) { 173 dev_err(i1480->dev, "%s: USB read error: %zd\n", 174 __func__, result); 175 goto out; 176 } 177 if (result != itr_size) { 178 result = -EIO; 179 dev_err(i1480->dev, 180 "%s: partial read got only %zu bytes vs %zu expected\n", 181 __func__, result, itr_size); 182 goto out; 183 } 184 bytes += result; 185 } 186 result = bytes; 187out: 188 return result; 189} 190 191 192/** 193 * Callback for reads on the notification/event endpoint 194 * 195 * Just enables the completion read handler. 196 */ 197static 198void i1480_usb_neep_cb(struct urb *urb) 199{ 200 struct i1480 *i1480 = urb->context; 201 struct device *dev = i1480->dev; 202 203 switch (urb->status) { 204 case 0: 205 break; 206 case -ECONNRESET: /* Not an error, but a controlled situation; */ 207 case -ENOENT: /* (we killed the URB)...so, no broadcast */ 208 dev_dbg(dev, "NEEP: reset/noent %d\n", urb->status); 209 break; 210 case -ESHUTDOWN: /* going away! */ 211 dev_dbg(dev, "NEEP: down %d\n", urb->status); 212 break; 213 default: 214 dev_err(dev, "NEEP: unknown status %d\n", urb->status); 215 break; 216 } 217 i1480->evt_result = urb->actual_length; 218 complete(&i1480->evt_complete); 219 return; 220} 221 222 223/** 224 * Wait for the MAC FW to initialize 225 * 226 * MAC FW sends a 0xfd/0101/00 notification to EP1 when done 227 * initializing. Get that notification into i1480->evt_buf; upper layer 228 * will verify it. 229 * 230 * Set i1480->evt_result with the result of getting the event or its 231 * size (if successful). 232 * 233 * Delivers the data directly to i1480->evt_buf 234 */ 235static 236int i1480_usb_wait_init_done(struct i1480 *i1480) 237{ 238 int result; 239 struct device *dev = i1480->dev; 240 struct i1480_usb *i1480_usb = container_of(i1480, struct i1480_usb, i1480); 241 struct usb_endpoint_descriptor *epd; 242 243 init_completion(&i1480->evt_complete); 244 i1480->evt_result = -EINPROGRESS; 245 epd = &i1480_usb->usb_iface->cur_altsetting->endpoint[0].desc; 246 usb_fill_int_urb(i1480_usb->neep_urb, i1480_usb->usb_dev, 247 usb_rcvintpipe(i1480_usb->usb_dev, epd->bEndpointAddress), 248 i1480->evt_buf, i1480->buf_size, 249 i1480_usb_neep_cb, i1480, epd->bInterval); 250 result = usb_submit_urb(i1480_usb->neep_urb, GFP_KERNEL); 251 if (result < 0) { 252 dev_err(dev, "init done: cannot submit NEEP read: %d\n", 253 result); 254 goto error_submit; 255 } 256 /* Wait for the USB callback to get the data */ 257 result = wait_for_completion_interruptible_timeout( 258 &i1480->evt_complete, HZ); 259 if (result <= 0) { 260 result = result == 0 ? -ETIMEDOUT : result; 261 goto error_wait; 262 } 263 usb_kill_urb(i1480_usb->neep_urb); 264 return 0; 265 266error_wait: 267 usb_kill_urb(i1480_usb->neep_urb); 268error_submit: 269 i1480->evt_result = result; 270 return result; 271} 272 273 274/** 275 * Generic function for issuing commands to the i1480 276 * 277 * @i1480: i1480 instance 278 * @cmd_name: Name of the command (for error messages) 279 * @cmd: Pointer to command buffer 280 * @cmd_size: Size of the command buffer 281 * @reply: Buffer for the reply event 282 * @reply_size: Expected size back (including RCEB); the reply buffer 283 * is assumed to be as big as this. 284 * @returns: >= 0 size of the returned event data if ok, 285 * < 0 errno code on error. 286 * 287 * Arms the NE handle, issues the command to the device and checks the 288 * basics of the reply event. 289 */ 290static 291int i1480_usb_cmd(struct i1480 *i1480, const char *cmd_name, size_t cmd_size) 292{ 293 int result; 294 struct device *dev = i1480->dev; 295 struct i1480_usb *i1480_usb = container_of(i1480, struct i1480_usb, i1480); 296 struct usb_endpoint_descriptor *epd; 297 struct uwb_rccb *cmd = i1480->cmd_buf; 298 u8 iface_no; 299 300 /* Post a read on the notification & event endpoint */ 301 iface_no = i1480_usb->usb_iface->cur_altsetting->desc.bInterfaceNumber; 302 epd = &i1480_usb->usb_iface->cur_altsetting->endpoint[0].desc; 303 usb_fill_int_urb( 304 i1480_usb->neep_urb, i1480_usb->usb_dev, 305 usb_rcvintpipe(i1480_usb->usb_dev, epd->bEndpointAddress), 306 i1480->evt_buf, i1480->buf_size, 307 i1480_usb_neep_cb, i1480, epd->bInterval); 308 result = usb_submit_urb(i1480_usb->neep_urb, GFP_KERNEL); 309 if (result < 0) { 310 dev_err(dev, "%s: cannot submit NEEP read: %d\n", 311 cmd_name, result); 312 goto error_submit_ep1; 313 } 314 /* Now post the command on EP0 */ 315 result = usb_control_msg( 316 i1480_usb->usb_dev, usb_sndctrlpipe(i1480_usb->usb_dev, 0), 317 WA_EXEC_RC_CMD, 318 USB_DIR_OUT | USB_RECIP_INTERFACE | USB_TYPE_CLASS, 319 0, iface_no, 320 cmd, cmd_size, 321 100 /* FIXME: this is totally arbitrary */); 322 if (result < 0) { 323 dev_err(dev, "%s: control request failed: %d\n", 324 cmd_name, result); 325 goto error_submit_ep0; 326 } 327 return result; 328 329error_submit_ep0: 330 usb_kill_urb(i1480_usb->neep_urb); 331error_submit_ep1: 332 return result; 333} 334 335 336/* 337 * Probe a i1480 device for uploading firmware. 338 * 339 * We attach only to interface #0, which is the radio control interface. 340 */ 341static 342int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id) 343{ 344 struct i1480_usb *i1480_usb; 345 struct i1480 *i1480; 346 struct device *dev = &iface->dev; 347 int result; 348 349 result = -ENODEV; 350 if (iface->cur_altsetting->desc.bInterfaceNumber != 0) { 351 dev_dbg(dev, "not attaching to iface %d\n", 352 iface->cur_altsetting->desc.bInterfaceNumber); 353 goto error; 354 } 355 if (iface->num_altsetting > 1 356 && interface_to_usbdev(iface)->descriptor.idProduct == 0xbabe) { 357 /* Need altsetting #1 [HW QUIRK] or EP1 won't work */ 358 result = usb_set_interface(interface_to_usbdev(iface), 0, 1); 359 if (result < 0) 360 dev_warn(dev, 361 "can't set altsetting 1 on iface 0: %d\n", 362 result); 363 } 364 365 result = -ENOMEM; 366 i1480_usb = kzalloc(sizeof(*i1480_usb), GFP_KERNEL); 367 if (i1480_usb == NULL) { 368 dev_err(dev, "Unable to allocate instance\n"); 369 goto error; 370 } 371 i1480_usb_init(i1480_usb); 372 373 i1480 = &i1480_usb->i1480; 374 i1480->buf_size = 512; 375 i1480->cmd_buf = kmalloc(2 * i1480->buf_size, GFP_KERNEL); 376 if (i1480->cmd_buf == NULL) { 377 dev_err(dev, "Cannot allocate transfer buffers\n"); 378 result = -ENOMEM; 379 goto error_buf_alloc; 380 } 381 i1480->evt_buf = i1480->cmd_buf + i1480->buf_size; 382 383 result = i1480_usb_create(i1480_usb, iface); 384 if (result < 0) { 385 dev_err(dev, "Cannot create instance: %d\n", result); 386 goto error_create; 387 } 388 389 /* setup the fops and upload the firmware */ 390 i1480->pre_fw_name = "i1480-pre-phy-0.0.bin"; 391 i1480->mac_fw_name = "i1480-usb-0.0.bin"; 392 i1480->mac_fw_name_deprecate = "ptc-0.0.bin"; 393 i1480->phy_fw_name = "i1480-phy-0.0.bin"; 394 i1480->dev = &iface->dev; 395 i1480->write = i1480_usb_write; 396 i1480->read = i1480_usb_read; 397 i1480->rc_setup = NULL; 398 i1480->wait_init_done = i1480_usb_wait_init_done; 399 i1480->cmd = i1480_usb_cmd; 400 401 result = i1480_fw_upload(&i1480_usb->i1480); /* the real thing */ 402 if (result >= 0) { 403 usb_reset_device(i1480_usb->usb_dev); 404 result = -ENODEV; /* we don't want to bind to the iface */ 405 } 406 i1480_usb_destroy(i1480_usb); 407error_create: 408 kfree(i1480->cmd_buf); 409error_buf_alloc: 410 kfree(i1480_usb); 411error: 412 return result; 413} 414 415MODULE_FIRMWARE("i1480-pre-phy-0.0.bin"); 416MODULE_FIRMWARE("i1480-usb-0.0.bin"); 417MODULE_FIRMWARE("i1480-phy-0.0.bin"); 418 419#define i1480_USB_DEV(v, p) \ 420{ \ 421 .match_flags = USB_DEVICE_ID_MATCH_DEVICE \ 422 | USB_DEVICE_ID_MATCH_DEV_INFO \ 423 | USB_DEVICE_ID_MATCH_INT_INFO, \ 424 .idVendor = (v), \ 425 .idProduct = (p), \ 426 .bDeviceClass = 0xff, \ 427 .bDeviceSubClass = 0xff, \ 428 .bDeviceProtocol = 0xff, \ 429 .bInterfaceClass = 0xff, \ 430 .bInterfaceSubClass = 0xff, \ 431 .bInterfaceProtocol = 0xff, \ 432} 433 434 435/** USB device ID's that we handle */ 436static const struct usb_device_id i1480_usb_id_table[] = { 437 i1480_USB_DEV(0x8086, 0xdf3b), 438 i1480_USB_DEV(0x15a9, 0x0005), 439 i1480_USB_DEV(0x07d1, 0x3802), 440 i1480_USB_DEV(0x050d, 0x305a), 441 i1480_USB_DEV(0x3495, 0x3007), 442 {}, 443}; 444MODULE_DEVICE_TABLE(usb, i1480_usb_id_table); 445 446 447static struct usb_driver i1480_dfu_driver = { 448 .name = "i1480-dfu-usb", 449 .id_table = i1480_usb_id_table, 450 .probe = i1480_usb_probe, 451 .disconnect = NULL, 452}; 453 454module_usb_driver(i1480_dfu_driver); 455 456MODULE_AUTHOR("Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>"); 457MODULE_DESCRIPTION("Intel Wireless UWB Link 1480 firmware uploader for USB"); 458MODULE_LICENSE("GPL"); 459