1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Intel Wireless UWB Link 1480
4 * USB SKU firmware upload implementation
5 *
6 * Copyright (C) 2005-2006 Intel Corporation
7 * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
8 *
9 * This driver will prepare the i1480 device to behave as a real
10 * Wireless USB HWA adaptor by uploading the firmware.
11 *
12 * When the device is connected or driver is loaded, i1480_usb_probe()
13 * is called--this will allocate and initialize the device structure,
14 * fill in the pointers to the common functions (read, write,
15 * wait_init_done and cmd for HWA command execution) and once that is
16 * done, call the common firmware uploading routine. Then clean up and
17 * return -ENODEV, as we don't attach to the device.
18 *
19 * The rest are the basic ops we implement that the fw upload code
20 * uses to do its job. All the ops in the common code are i1480->NAME,
21 * the functions are i1480_usb_NAME().
22 */
23 #include <linux/module.h>
24 #include <linux/usb.h>
25 #include <linux/interrupt.h>
26 #include <linux/slab.h>
27 #include <linux/delay.h>
28 #include "../../uwb.h"
29 #include "../../../wusbcore/include/wusb.h"
30 #include "../../../wusbcore/include/wusb-wa.h"
31 #include "i1480-dfu.h"
32
33 struct i1480_usb {
34 struct i1480 i1480;
35 struct usb_device *usb_dev;
36 struct usb_interface *usb_iface;
37 struct urb *neep_urb; /* URB for reading from EP1 */
38 };
39
40
41 static
i1480_usb_init(struct i1480_usb * i1480_usb)42 void i1480_usb_init(struct i1480_usb *i1480_usb)
43 {
44 i1480_init(&i1480_usb->i1480);
45 }
46
47
48 static
i1480_usb_create(struct i1480_usb * i1480_usb,struct usb_interface * iface)49 int i1480_usb_create(struct i1480_usb *i1480_usb, struct usb_interface *iface)
50 {
51 struct usb_device *usb_dev = interface_to_usbdev(iface);
52 int result = -ENOMEM;
53
54 i1480_usb->usb_dev = usb_get_dev(usb_dev); /* bind the USB device */
55 i1480_usb->usb_iface = usb_get_intf(iface);
56 usb_set_intfdata(iface, i1480_usb); /* Bind the driver to iface0 */
57 i1480_usb->neep_urb = usb_alloc_urb(0, GFP_KERNEL);
58 if (i1480_usb->neep_urb == NULL)
59 goto error;
60 return 0;
61
62 error:
63 usb_set_intfdata(iface, NULL);
64 usb_put_intf(iface);
65 usb_put_dev(usb_dev);
66 return result;
67 }
68
69
70 static
i1480_usb_destroy(struct i1480_usb * i1480_usb)71 void i1480_usb_destroy(struct i1480_usb *i1480_usb)
72 {
73 usb_kill_urb(i1480_usb->neep_urb);
74 usb_free_urb(i1480_usb->neep_urb);
75 usb_set_intfdata(i1480_usb->usb_iface, NULL);
76 usb_put_intf(i1480_usb->usb_iface);
77 usb_put_dev(i1480_usb->usb_dev);
78 }
79
80
81 /**
82 * Write a buffer to a memory address in the i1480 device
83 *
84 * @i1480: i1480 instance
85 * @memory_address:
86 * Address where to write the data buffer to.
87 * @buffer: Buffer to the data
88 * @size: Size of the buffer [has to be < 512].
89 * @returns: 0 if ok, < 0 errno code on error.
90 *
91 * Data buffers to USB cannot be on the stack or in vmalloc'ed areas,
92 * so we copy it to the local i1480 buffer before proceeding. In any
93 * case, we have a max size we can send.
94 */
95 static
i1480_usb_write(struct i1480 * i1480,u32 memory_address,const void * buffer,size_t size)96 int i1480_usb_write(struct i1480 *i1480, u32 memory_address,
97 const void *buffer, size_t size)
98 {
99 int result = 0;
100 struct i1480_usb *i1480_usb = container_of(i1480, struct i1480_usb, i1480);
101 size_t buffer_size, itr = 0;
102
103 BUG_ON(size & 0x3); /* Needs to be a multiple of 4 */
104 while (size > 0) {
105 buffer_size = size < i1480->buf_size ? size : i1480->buf_size;
106 memcpy(i1480->cmd_buf, buffer + itr, buffer_size);
107 result = usb_control_msg(
108 i1480_usb->usb_dev, usb_sndctrlpipe(i1480_usb->usb_dev, 0),
109 0xf0, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
110 memory_address, (memory_address >> 16),
111 i1480->cmd_buf, buffer_size, 100 /* FIXME: arbitrary */);
112 if (result < 0)
113 break;
114 itr += result;
115 memory_address += result;
116 size -= result;
117 }
118 return result;
119 }
120
121
122 /**
123 * Read a block [max size 512] of the device's memory to @i1480's buffer.
124 *
125 * @i1480: i1480 instance
126 * @memory_address:
127 * Address where to read from.
128 * @size: Size to read. Smaller than or equal to 512.
129 * @returns: >= 0 number of bytes written if ok, < 0 errno code on error.
130 *
131 * NOTE: if the memory address or block is incorrect, you might get a
132 * stall or a different memory read. Caller has to verify the
133 * memory address and size passed back in the @neh structure.
134 */
135 static
i1480_usb_read(struct i1480 * i1480,u32 addr,size_t size)136 int i1480_usb_read(struct i1480 *i1480, u32 addr, size_t size)
137 {
138 ssize_t result = 0, bytes = 0;
139 size_t itr, read_size = i1480->buf_size;
140 struct i1480_usb *i1480_usb = container_of(i1480, struct i1480_usb, i1480);
141
142 BUG_ON(size > i1480->buf_size);
143 BUG_ON(size & 0x3); /* Needs to be a multiple of 4 */
144 BUG_ON(read_size > 512);
145
146 if (addr >= 0x8000d200 && addr < 0x8000d400) /* Yeah, HW quirk */
147 read_size = 4;
148
149 for (itr = 0; itr < size; itr += read_size) {
150 size_t itr_addr = addr + itr;
151 size_t itr_size = min(read_size, size - itr);
152 result = usb_control_msg(
153 i1480_usb->usb_dev, usb_rcvctrlpipe(i1480_usb->usb_dev, 0),
154 0xf0, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
155 itr_addr, (itr_addr >> 16),
156 i1480->cmd_buf + itr, itr_size,
157 100 /* FIXME: arbitrary */);
158 if (result < 0) {
159 dev_err(i1480->dev, "%s: USB read error: %zd\n",
160 __func__, result);
161 goto out;
162 }
163 if (result != itr_size) {
164 result = -EIO;
165 dev_err(i1480->dev,
166 "%s: partial read got only %zu bytes vs %zu expected\n",
167 __func__, result, itr_size);
168 goto out;
169 }
170 bytes += result;
171 }
172 result = bytes;
173 out:
174 return result;
175 }
176
177
178 /**
179 * Callback for reads on the notification/event endpoint
180 *
181 * Just enables the completion read handler.
182 */
183 static
i1480_usb_neep_cb(struct urb * urb)184 void i1480_usb_neep_cb(struct urb *urb)
185 {
186 struct i1480 *i1480 = urb->context;
187 struct device *dev = i1480->dev;
188
189 switch (urb->status) {
190 case 0:
191 break;
192 case -ECONNRESET: /* Not an error, but a controlled situation; */
193 case -ENOENT: /* (we killed the URB)...so, no broadcast */
194 dev_dbg(dev, "NEEP: reset/noent %d\n", urb->status);
195 break;
196 case -ESHUTDOWN: /* going away! */
197 dev_dbg(dev, "NEEP: down %d\n", urb->status);
198 break;
199 default:
200 dev_err(dev, "NEEP: unknown status %d\n", urb->status);
201 break;
202 }
203 i1480->evt_result = urb->actual_length;
204 complete(&i1480->evt_complete);
205 return;
206 }
207
208
209 /**
210 * Wait for the MAC FW to initialize
211 *
212 * MAC FW sends a 0xfd/0101/00 notification to EP1 when done
213 * initializing. Get that notification into i1480->evt_buf; upper layer
214 * will verify it.
215 *
216 * Set i1480->evt_result with the result of getting the event or its
217 * size (if successful).
218 *
219 * Delivers the data directly to i1480->evt_buf
220 */
221 static
i1480_usb_wait_init_done(struct i1480 * i1480)222 int i1480_usb_wait_init_done(struct i1480 *i1480)
223 {
224 int result;
225 struct device *dev = i1480->dev;
226 struct i1480_usb *i1480_usb = container_of(i1480, struct i1480_usb, i1480);
227 struct usb_endpoint_descriptor *epd;
228
229 init_completion(&i1480->evt_complete);
230 i1480->evt_result = -EINPROGRESS;
231 epd = &i1480_usb->usb_iface->cur_altsetting->endpoint[0].desc;
232 usb_fill_int_urb(i1480_usb->neep_urb, i1480_usb->usb_dev,
233 usb_rcvintpipe(i1480_usb->usb_dev, epd->bEndpointAddress),
234 i1480->evt_buf, i1480->buf_size,
235 i1480_usb_neep_cb, i1480, epd->bInterval);
236 result = usb_submit_urb(i1480_usb->neep_urb, GFP_KERNEL);
237 if (result < 0) {
238 dev_err(dev, "init done: cannot submit NEEP read: %d\n",
239 result);
240 goto error_submit;
241 }
242 /* Wait for the USB callback to get the data */
243 result = wait_for_completion_interruptible_timeout(
244 &i1480->evt_complete, HZ);
245 if (result <= 0) {
246 result = result == 0 ? -ETIMEDOUT : result;
247 goto error_wait;
248 }
249 usb_kill_urb(i1480_usb->neep_urb);
250 return 0;
251
252 error_wait:
253 usb_kill_urb(i1480_usb->neep_urb);
254 error_submit:
255 i1480->evt_result = result;
256 return result;
257 }
258
259
260 /**
261 * Generic function for issuing commands to the i1480
262 *
263 * @i1480: i1480 instance
264 * @cmd_name: Name of the command (for error messages)
265 * @cmd: Pointer to command buffer
266 * @cmd_size: Size of the command buffer
267 * @reply: Buffer for the reply event
268 * @reply_size: Expected size back (including RCEB); the reply buffer
269 * is assumed to be as big as this.
270 * @returns: >= 0 size of the returned event data if ok,
271 * < 0 errno code on error.
272 *
273 * Arms the NE handle, issues the command to the device and checks the
274 * basics of the reply event.
275 */
276 static
i1480_usb_cmd(struct i1480 * i1480,const char * cmd_name,size_t cmd_size)277 int i1480_usb_cmd(struct i1480 *i1480, const char *cmd_name, size_t cmd_size)
278 {
279 int result;
280 struct device *dev = i1480->dev;
281 struct i1480_usb *i1480_usb = container_of(i1480, struct i1480_usb, i1480);
282 struct usb_endpoint_descriptor *epd;
283 struct uwb_rccb *cmd = i1480->cmd_buf;
284 u8 iface_no;
285
286 /* Post a read on the notification & event endpoint */
287 iface_no = i1480_usb->usb_iface->cur_altsetting->desc.bInterfaceNumber;
288 epd = &i1480_usb->usb_iface->cur_altsetting->endpoint[0].desc;
289 usb_fill_int_urb(
290 i1480_usb->neep_urb, i1480_usb->usb_dev,
291 usb_rcvintpipe(i1480_usb->usb_dev, epd->bEndpointAddress),
292 i1480->evt_buf, i1480->buf_size,
293 i1480_usb_neep_cb, i1480, epd->bInterval);
294 result = usb_submit_urb(i1480_usb->neep_urb, GFP_KERNEL);
295 if (result < 0) {
296 dev_err(dev, "%s: cannot submit NEEP read: %d\n",
297 cmd_name, result);
298 goto error_submit_ep1;
299 }
300 /* Now post the command on EP0 */
301 result = usb_control_msg(
302 i1480_usb->usb_dev, usb_sndctrlpipe(i1480_usb->usb_dev, 0),
303 WA_EXEC_RC_CMD,
304 USB_DIR_OUT | USB_RECIP_INTERFACE | USB_TYPE_CLASS,
305 0, iface_no,
306 cmd, cmd_size,
307 100 /* FIXME: this is totally arbitrary */);
308 if (result < 0) {
309 dev_err(dev, "%s: control request failed: %d\n",
310 cmd_name, result);
311 goto error_submit_ep0;
312 }
313 return result;
314
315 error_submit_ep0:
316 usb_kill_urb(i1480_usb->neep_urb);
317 error_submit_ep1:
318 return result;
319 }
320
321
322 /*
323 * Probe a i1480 device for uploading firmware.
324 *
325 * We attach only to interface #0, which is the radio control interface.
326 */
327 static
i1480_usb_probe(struct usb_interface * iface,const struct usb_device_id * id)328 int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
329 {
330 struct usb_device *udev = interface_to_usbdev(iface);
331 struct i1480_usb *i1480_usb;
332 struct i1480 *i1480;
333 struct device *dev = &iface->dev;
334 int result;
335
336 result = -ENODEV;
337 if (iface->cur_altsetting->desc.bInterfaceNumber != 0) {
338 dev_dbg(dev, "not attaching to iface %d\n",
339 iface->cur_altsetting->desc.bInterfaceNumber);
340 goto error;
341 }
342 if (iface->num_altsetting > 1 &&
343 le16_to_cpu(udev->descriptor.idProduct) == 0xbabe) {
344 /* Need altsetting #1 [HW QUIRK] or EP1 won't work */
345 result = usb_set_interface(interface_to_usbdev(iface), 0, 1);
346 if (result < 0)
347 dev_warn(dev,
348 "can't set altsetting 1 on iface 0: %d\n",
349 result);
350 }
351
352 if (iface->cur_altsetting->desc.bNumEndpoints < 1)
353 return -ENODEV;
354
355 result = -ENOMEM;
356 i1480_usb = kzalloc(sizeof(*i1480_usb), GFP_KERNEL);
357 if (i1480_usb == NULL) {
358 dev_err(dev, "Unable to allocate instance\n");
359 goto error;
360 }
361 i1480_usb_init(i1480_usb);
362
363 i1480 = &i1480_usb->i1480;
364 i1480->buf_size = 512;
365 i1480->cmd_buf = kmalloc_array(2, i1480->buf_size, GFP_KERNEL);
366 if (i1480->cmd_buf == NULL) {
367 dev_err(dev, "Cannot allocate transfer buffers\n");
368 result = -ENOMEM;
369 goto error_buf_alloc;
370 }
371 i1480->evt_buf = i1480->cmd_buf + i1480->buf_size;
372
373 result = i1480_usb_create(i1480_usb, iface);
374 if (result < 0) {
375 dev_err(dev, "Cannot create instance: %d\n", result);
376 goto error_create;
377 }
378
379 /* setup the fops and upload the firmware */
380 i1480->pre_fw_name = "i1480-pre-phy-0.0.bin";
381 i1480->mac_fw_name = "i1480-usb-0.0.bin";
382 i1480->mac_fw_name_deprecate = "ptc-0.0.bin";
383 i1480->phy_fw_name = "i1480-phy-0.0.bin";
384 i1480->dev = &iface->dev;
385 i1480->write = i1480_usb_write;
386 i1480->read = i1480_usb_read;
387 i1480->rc_setup = NULL;
388 i1480->wait_init_done = i1480_usb_wait_init_done;
389 i1480->cmd = i1480_usb_cmd;
390
391 result = i1480_fw_upload(&i1480_usb->i1480); /* the real thing */
392 if (result >= 0) {
393 usb_reset_device(i1480_usb->usb_dev);
394 result = -ENODEV; /* we don't want to bind to the iface */
395 }
396 i1480_usb_destroy(i1480_usb);
397 error_create:
398 kfree(i1480->cmd_buf);
399 error_buf_alloc:
400 kfree(i1480_usb);
401 error:
402 return result;
403 }
404
405 MODULE_FIRMWARE("i1480-pre-phy-0.0.bin");
406 MODULE_FIRMWARE("i1480-usb-0.0.bin");
407 MODULE_FIRMWARE("i1480-phy-0.0.bin");
408
409 #define i1480_USB_DEV(v, p) \
410 { \
411 .match_flags = USB_DEVICE_ID_MATCH_DEVICE \
412 | USB_DEVICE_ID_MATCH_DEV_INFO \
413 | USB_DEVICE_ID_MATCH_INT_INFO, \
414 .idVendor = (v), \
415 .idProduct = (p), \
416 .bDeviceClass = 0xff, \
417 .bDeviceSubClass = 0xff, \
418 .bDeviceProtocol = 0xff, \
419 .bInterfaceClass = 0xff, \
420 .bInterfaceSubClass = 0xff, \
421 .bInterfaceProtocol = 0xff, \
422 }
423
424
425 /** USB device ID's that we handle */
426 static const struct usb_device_id i1480_usb_id_table[] = {
427 i1480_USB_DEV(0x8086, 0xdf3b),
428 i1480_USB_DEV(0x15a9, 0x0005),
429 i1480_USB_DEV(0x07d1, 0x3802),
430 i1480_USB_DEV(0x050d, 0x305a),
431 i1480_USB_DEV(0x3495, 0x3007),
432 {},
433 };
434 MODULE_DEVICE_TABLE(usb, i1480_usb_id_table);
435
436
437 static struct usb_driver i1480_dfu_driver = {
438 .name = "i1480-dfu-usb",
439 .id_table = i1480_usb_id_table,
440 .probe = i1480_usb_probe,
441 .disconnect = NULL,
442 };
443
444 module_usb_driver(i1480_dfu_driver);
445
446 MODULE_AUTHOR("Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>");
447 MODULE_DESCRIPTION("Intel Wireless UWB Link 1480 firmware uploader for USB");
448 MODULE_LICENSE("GPL");
449