drivers/net/wireless/ath/ath6kl/init.c

   1
   2 /*
   3  * Copyright (c) 2011 Atheros Communications Inc.
   4  * Copyright (c) 2011-2012 Qualcomm Atheros, Inc.
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  20
  21 #include <linux/moduleparam.h>
  22 #include <linux/errno.h>
  23 #include <linux/export.h>
  24 #include <linux/of.h>
  25 #include <linux/mmc/sdio_func.h>
  26 #include <linux/vmalloc.h>
  27
  28 #include "core.h"
  29 #include "cfg80211.h"
  30 #include "target.h"
  31 #include "debug.h"
  32 #include "hif-ops.h"
  33 #include "htc-ops.h"
  34
  35 static const struct ath6kl_hw hw_list[] = {
  36         {
  37                 .id                             = AR6003_HW_2_0_VERSION,
  38                 .name                           = "ar6003 hw 2.0",
  39                 .dataset_patch_addr             = 0x57e884,
  40                 .app_load_addr                  = 0x543180,
  41                 .board_ext_data_addr            = 0x57e500,
  42                 .reserved_ram_size              = 6912,
  43                 .refclk_hz                      = 26000000,
  44                 .uarttx_pin                     = 8,
  45
  46                 /* hw2.0 needs override address hardcoded */
  47                 .app_start_override_addr        = 0x944C00,
  48
  49                 .fw = {
  50                         .dir            = AR6003_HW_2_0_FW_DIR,
  51                         .otp            = AR6003_HW_2_0_OTP_FILE,
  52                         .fw             = AR6003_HW_2_0_FIRMWARE_FILE,
  53                         .tcmd           = AR6003_HW_2_0_TCMD_FIRMWARE_FILE,
  54                         .patch          = AR6003_HW_2_0_PATCH_FILE,
  55                 },
  56
  57                 .fw_board               = AR6003_HW_2_0_BOARD_DATA_FILE,
  58                 .fw_default_board       = AR6003_HW_2_0_DEFAULT_BOARD_DATA_FILE,
  59         },
  60         {
  61                 .id                             = AR6003_HW_2_1_1_VERSION,
  62                 .name                           = "ar6003 hw 2.1.1",
  63                 .dataset_patch_addr             = 0x57ff74,
  64                 .app_load_addr                  = 0x1234,
  65                 .board_ext_data_addr            = 0x542330,
  66                 .reserved_ram_size              = 512,
  67                 .refclk_hz                      = 26000000,
  68                 .uarttx_pin                     = 8,
  69                 .testscript_addr                = 0x57ef74,
  70
  71                 .fw = {
  72                         .dir            = AR6003_HW_2_1_1_FW_DIR,
  73                         .otp            = AR6003_HW_2_1_1_OTP_FILE,
  74                         .fw             = AR6003_HW_2_1_1_FIRMWARE_FILE,
  75                         .tcmd           = AR6003_HW_2_1_1_TCMD_FIRMWARE_FILE,
  76                         .patch          = AR6003_HW_2_1_1_PATCH_FILE,
  77                         .utf            = AR6003_HW_2_1_1_UTF_FIRMWARE_FILE,
  78                         .testscript     = AR6003_HW_2_1_1_TESTSCRIPT_FILE,
  79                 },
  80
  81                 .fw_board               = AR6003_HW_2_1_1_BOARD_DATA_FILE,
  82                 .fw_default_board = AR6003_HW_2_1_1_DEFAULT_BOARD_DATA_FILE,
  83         },
  84         {
  85                 .id                             = AR6004_HW_1_0_VERSION,
  86                 .name                           = "ar6004 hw 1.0",
  87                 .dataset_patch_addr             = 0x57e884,
  88                 .app_load_addr                  = 0x1234,
  89                 .board_ext_data_addr            = 0x437000,
  90                 .reserved_ram_size              = 19456,
  91                 .board_addr                     = 0x433900,
  92                 .refclk_hz                      = 26000000,
  93                 .uarttx_pin                     = 11,
  94
  95                 .fw = {
  96                         .dir            = AR6004_HW_1_0_FW_DIR,
  97                         .fw             = AR6004_HW_1_0_FIRMWARE_FILE,
  98                 },
  99
 100                 .fw_board               = AR6004_HW_1_0_BOARD_DATA_FILE,
 101                 .fw_default_board       = AR6004_HW_1_0_DEFAULT_BOARD_DATA_FILE,
 102         },
 103         {
 104                 .id                             = AR6004_HW_1_1_VERSION,
 105                 .name                           = "ar6004 hw 1.1",
 106                 .dataset_patch_addr             = 0x57e884,
 107                 .app_load_addr                  = 0x1234,
 108                 .board_ext_data_addr            = 0x437000,
 109                 .reserved_ram_size              = 11264,
 110                 .board_addr                     = 0x43d400,
 111                 .refclk_hz                      = 40000000,
 112                 .uarttx_pin                     = 11,
 113
 114                 .fw = {
 115                         .dir            = AR6004_HW_1_1_FW_DIR,
 116                         .fw             = AR6004_HW_1_1_FIRMWARE_FILE,
 117                 },
 118
 119                 .fw_board               = AR6004_HW_1_1_BOARD_DATA_FILE,
 120                 .fw_default_board       = AR6004_HW_1_1_DEFAULT_BOARD_DATA_FILE,
 121         },
 122         {
 123                 .id                             = AR6004_HW_1_2_VERSION,
 124                 .name                           = "ar6004 hw 1.2",
 125                 .dataset_patch_addr             = 0x436ecc,
 126                 .app_load_addr                  = 0x1234,
 127                 .board_ext_data_addr            = 0x437000,
 128                 .reserved_ram_size              = 9216,
 129                 .board_addr                     = 0x435c00,
 130                 .refclk_hz                      = 40000000,
 131                 .uarttx_pin                     = 11,
 132
 133                 .fw = {
 134                         .dir            = AR6004_HW_1_2_FW_DIR,
 135                         .fw             = AR6004_HW_1_2_FIRMWARE_FILE,
 136                 },
 137                 .fw_board               = AR6004_HW_1_2_BOARD_DATA_FILE,
 138                 .fw_default_board       = AR6004_HW_1_2_DEFAULT_BOARD_DATA_FILE,
 139         },
 140 };
 141
 142 /*
 143  * Include definitions here that can be used to tune the WLAN module
 144  * behavior. Different customers can tune the behavior as per their needs,
 145  * here.
 146  */
 147
 148 /*
 149  * This configuration item enable/disable keepalive support.
 150  * Keepalive support: In the absence of any data traffic to AP, null
 151  * frames will be sent to the AP at periodic interval, to keep the association
 152  * active. This configuration item defines the periodic interval.
 153  * Use value of zero to disable keepalive support
 154  * Default: 60 seconds
 155  */
 156 #define WLAN_CONFIG_KEEP_ALIVE_INTERVAL 60
 157
 158 /*
 159  * This configuration item sets the value of disconnect timeout
 160  * Firmware delays sending the disconnec event to the host for this
 161  * timeout after is gets disconnected from the current AP.
 162  * If the firmware successly roams within the disconnect timeout
 163  * it sends a new connect event
 164  */
 165 #define WLAN_CONFIG_DISCONNECT_TIMEOUT 10
 166
 167
 168 #define ATH6KL_DATA_OFFSET    64
 169 struct sk_buff *ath6kl_buf_alloc(int size)
 170 {
 171         struct sk_buff *skb;
 172         u16 reserved;
 173
 174         /* Add chacheline space at front and back of buffer */
 175         reserved = (2 * L1_CACHE_BYTES) + ATH6KL_DATA_OFFSET +
 176                    sizeof(struct htc_packet) + ATH6KL_HTC_ALIGN_BYTES;
 177         skb = dev_alloc_skb(size + reserved);
 178
 179         if (skb)
 180                 skb_reserve(skb, reserved - L1_CACHE_BYTES);
 181         return skb;
 182 }
 183
 184 void ath6kl_init_profile_info(struct ath6kl_vif *vif)
 185 {
 186         vif->ssid_len = 0;
 187         memset(vif->ssid, 0, sizeof(vif->ssid));
 188
 189         vif->dot11_auth_mode = OPEN_AUTH;
 190         vif->auth_mode = NONE_AUTH;
 191         vif->prwise_crypto = NONE_CRYPT;
 192         vif->prwise_crypto_len = 0;
 193         vif->grp_crypto = NONE_CRYPT;
 194         vif->grp_crypto_len = 0;
 195         memset(vif->wep_key_list, 0, sizeof(vif->wep_key_list));
 196         memset(vif->req_bssid, 0, sizeof(vif->req_bssid));
 197         memset(vif->bssid, 0, sizeof(vif->bssid));
 198         vif->bss_ch = 0;
 199 }
 200
 201 static int ath6kl_set_host_app_area(struct ath6kl *ar)
 202 {
 203         u32 address, data;
 204         struct host_app_area host_app_area;
 205
 206         /* Fetch the address of the host_app_area_s
 207          * instance in the host interest area */
 208         address = ath6kl_get_hi_item_addr(ar, HI_ITEM(hi_app_host_interest));
 209         address = TARG_VTOP(ar->target_type, address);
 210
 211         if (ath6kl_diag_read32(ar, address, &data))
 212                 return -EIO;
 213
 214         address = TARG_VTOP(ar->target_type, data);
 215         host_app_area.wmi_protocol_ver = cpu_to_le32(WMI_PROTOCOL_VERSION);
 216         if (ath6kl_diag_write(ar, address, (u8 *) &host_app_area,
 217                               sizeof(struct host_app_area)))
 218                 return -EIO;
 219
 220         return 0;
 221 }
 222
 223 static inline void set_ac2_ep_map(struct ath6kl *ar,
 224                                   u8 ac,
 225                                   enum htc_endpoint_id ep)
 226 {
 227         ar->ac2ep_map[ac] = ep;
 228         ar->ep2ac_map[ep] = ac;
 229 }
 230
 231 /* connect to a service */
 232 static int ath6kl_connectservice(struct ath6kl *ar,
 233                                  struct htc_service_connect_req  *con_req,
 234                                  char *desc)
 235 {
 236         int status;
 237         struct htc_service_connect_resp response;
 238
 239         memset(&response, 0, sizeof(response));
 240
 241         status = ath6kl_htc_conn_service(ar->htc_target, con_req, &response);
 242         if (status) {
 243                 ath6kl_err("failed to connect to %s service status:%d\n",
 244                            desc, status);
 245                 return status;
 246         }
 247
 248         switch (con_req->svc_id) {
 249         case WMI_CONTROL_SVC:
 250                 if (test_bit(WMI_ENABLED, &ar->flag))
 251                         ath6kl_wmi_set_control_ep(ar->wmi, response.endpoint);
 252                 ar->ctrl_ep = response.endpoint;
 253                 break;
 254         case WMI_DATA_BE_SVC:
 255                 set_ac2_ep_map(ar, WMM_AC_BE, response.endpoint);
 256                 break;
 257         case WMI_DATA_BK_SVC:
 258                 set_ac2_ep_map(ar, WMM_AC_BK, response.endpoint);
 259                 break;
 260         case WMI_DATA_VI_SVC:
 261                 set_ac2_ep_map(ar, WMM_AC_VI, response.endpoint);
 262                 break;
 263         case WMI_DATA_VO_SVC:
 264                 set_ac2_ep_map(ar, WMM_AC_VO, response.endpoint);
 265                 break;
 266         default:
 267                 ath6kl_err("service id is not mapped %d\n", con_req->svc_id);
 268                 return -EINVAL;
 269         }
 270
 271         return 0;
 272 }
 273
 274 static int ath6kl_init_service_ep(struct ath6kl *ar)
 275 {
 276         struct htc_service_connect_req connect;
 277
 278         memset(&connect, 0, sizeof(connect));
 279
 280         /* these fields are the same for all service endpoints */
 281         connect.ep_cb.tx_comp_multi = ath6kl_tx_complete;
 282         connect.ep_cb.rx = ath6kl_rx;
 283         connect.ep_cb.rx_refill = ath6kl_rx_refill;
 284         connect.ep_cb.tx_full = ath6kl_tx_queue_full;
 285
 286         /*
 287          * Set the max queue depth so that our ath6kl_tx_queue_full handler
 288          * gets called.
 289         */
 290         connect.max_txq_depth = MAX_DEFAULT_SEND_QUEUE_DEPTH;
 291         connect.ep_cb.rx_refill_thresh = ATH6KL_MAX_RX_BUFFERS / 4;
 292         if (!connect.ep_cb.rx_refill_thresh)
 293                 connect.ep_cb.rx_refill_thresh++;
 294
 295         /* connect to control service */
 296         connect.svc_id = WMI_CONTROL_SVC;
 297         if (ath6kl_connectservice(ar, &connect, "WMI CONTROL"))
 298                 return -EIO;
 299
 300         connect.flags |= HTC_FLGS_TX_BNDL_PAD_EN;
 301
 302         /*
 303          * Limit the HTC message size on the send path, although e can
 304          * receive A-MSDU frames of 4K, we will only send ethernet-sized
 305          * (802.3) frames on the send path.
 306          */
 307         connect.max_rxmsg_sz = WMI_MAX_TX_DATA_FRAME_LENGTH;
 308
 309         /*
 310          * To reduce the amount of committed memory for larger A_MSDU
 311          * frames, use the recv-alloc threshold mechanism for larger
 312          * packets.
 313          */
 314         connect.ep_cb.rx_alloc_thresh = ATH6KL_BUFFER_SIZE;
 315         connect.ep_cb.rx_allocthresh = ath6kl_alloc_amsdu_rxbuf;
 316
 317         /*
 318          * For the remaining data services set the connection flag to
 319          * reduce dribbling, if configured to do so.
 320          */
 321         connect.conn_flags |= HTC_CONN_FLGS_REDUCE_CRED_DRIB;
 322         connect.conn_flags &= ~HTC_CONN_FLGS_THRESH_MASK;
 323         connect.conn_flags |= HTC_CONN_FLGS_THRESH_LVL_HALF;
 324
 325         connect.svc_id = WMI_DATA_BE_SVC;
 326
 327         if (ath6kl_connectservice(ar, &connect, "WMI DATA BE"))
 328                 return -EIO;
 329
 330         /* connect to back-ground map this to WMI LOW_PRI */
 331         connect.svc_id = WMI_DATA_BK_SVC;
 332         if (ath6kl_connectservice(ar, &connect, "WMI DATA BK"))
 333                 return -EIO;
 334
 335         /* connect to Video service, map this to to HI PRI */
 336         connect.svc_id = WMI_DATA_VI_SVC;
 337         if (ath6kl_connectservice(ar, &connect, "WMI DATA VI"))
 338                 return -EIO;
 339
 340         /*
 341          * Connect to VO service, this is currently not mapped to a WMI
 342          * priority stream due to historical reasons. WMI originally
 343          * defined 3 priorities over 3 mailboxes We can change this when
 344          * WMI is reworked so that priorities are not dependent on
 345          * mailboxes.
 346          */
 347         connect.svc_id = WMI_DATA_VO_SVC;
 348         if (ath6kl_connectservice(ar, &connect, "WMI DATA VO"))
 349                 return -EIO;
 350
 351         return 0;
 352 }
 353
 354 void ath6kl_init_control_info(struct ath6kl_vif *vif)
 355 {
 356         ath6kl_init_profile_info(vif);
 357         vif->def_txkey_index = 0;
 358         memset(vif->wep_key_list, 0, sizeof(vif->wep_key_list));
 359         vif->ch_hint = 0;
 360 }
 361
 362 /*
 363  * Set HTC/Mbox operational parameters, this can only be called when the
 364  * target is in the BMI phase.
 365  */
 366 static int ath6kl_set_htc_params(struct ath6kl *ar, u32 mbox_isr_yield_val,
 367                                  u8 htc_ctrl_buf)
 368 {
 369         int status;
 370         u32 blk_size;
 371
 372         blk_size = ar->mbox_info.block_size;
 373
 374         if (htc_ctrl_buf)
 375                 blk_size |=  ((u32)htc_ctrl_buf) << 16;
 376
 377         /* set the host interest area for the block size */
 378         status = ath6kl_bmi_write_hi32(ar, hi_mbox_io_block_sz, blk_size);
 379         if (status) {
 380                 ath6kl_err("bmi_write_memory for IO block size failed\n");
 381                 goto out;
 382         }
 383
 384         ath6kl_dbg(ATH6KL_DBG_TRC, "block size set: %d (target addr:0x%X)\n",
 385                    blk_size,
 386                    ath6kl_get_hi_item_addr(ar, HI_ITEM(hi_mbox_io_block_sz)));
 387
 388         if (mbox_isr_yield_val) {
 389                 /* set the host interest area for the mbox ISR yield limit */
 390                 status = ath6kl_bmi_write_hi32(ar, hi_mbox_isr_yield_limit,
 391                                                mbox_isr_yield_val);
 392                 if (status) {
 393                         ath6kl_err("bmi_write_memory for yield limit failed\n");
 394                         goto out;
 395                 }
 396         }
 397
 398 out:
 399         return status;
 400 }
 401
 402 static int ath6kl_target_config_wlan_params(struct ath6kl *ar, int idx)
 403 {
 404         int ret;
 405
 406         /*
 407          * Configure the device for rx dot11 header rules. "0,0" are the
 408          * default values. Required if checksum offload is needed. Set
 409          * RxMetaVersion to 2.
 410          */
 411         ret = ath6kl_wmi_set_rx_frame_format_cmd(ar->wmi, idx,
 412                                                  ar->rx_meta_ver, 0, 0);
 413         if (ret) {
 414                 ath6kl_err("unable to set the rx frame format: %d\n", ret);
 415                 return ret;
 416         }
 417
 418         if (ar->conf_flags & ATH6KL_CONF_IGNORE_PS_FAIL_EVT_IN_SCAN) {
 419                 ret = ath6kl_wmi_pmparams_cmd(ar->wmi, idx, 0, 1, 0, 0, 1,
 420                                               IGNORE_PS_FAIL_DURING_SCAN);
 421                 if (ret) {
 422                         ath6kl_err("unable to set power save fail event policy: %d\n",
 423                                    ret);
 424                         return ret;
 425                 }
 426         }
 427
 428         if (!(ar->conf_flags & ATH6KL_CONF_IGNORE_ERP_BARKER)) {
 429                 ret = ath6kl_wmi_set_lpreamble_cmd(ar->wmi, idx, 0,
 430                                                    WMI_FOLLOW_BARKER_IN_ERP);
 431                 if (ret) {
 432                         ath6kl_err("unable to set barker preamble policy: %d\n",
 433                                    ret);
 434                         return ret;
 435                 }
 436         }
 437
 438         ret = ath6kl_wmi_set_keepalive_cmd(ar->wmi, idx,
 439                                            WLAN_CONFIG_KEEP_ALIVE_INTERVAL);
 440         if (ret) {
 441                 ath6kl_err("unable to set keep alive interval: %d\n", ret);
 442                 return ret;
 443         }
 444
 445         ret = ath6kl_wmi_disctimeout_cmd(ar->wmi, idx,
 446                                          WLAN_CONFIG_DISCONNECT_TIMEOUT);
 447         if (ret) {
 448                 ath6kl_err("unable to set disconnect timeout: %d\n", ret);
 449                 return ret;
 450         }
 451
 452         if (!(ar->conf_flags & ATH6KL_CONF_ENABLE_TX_BURST)) {
 453                 ret = ath6kl_wmi_set_wmm_txop(ar->wmi, idx, WMI_TXOP_DISABLED);
 454                 if (ret) {
 455                         ath6kl_err("unable to set txop bursting: %d\n", ret);
 456                         return ret;
 457                 }
 458         }
 459
 460         if (ar->p2p && (ar->vif_max == 1 || idx)) {
 461                 ret = ath6kl_wmi_info_req_cmd(ar->wmi, idx,
 462                                               P2P_FLAG_CAPABILITIES_REQ |
 463                                               P2P_FLAG_MACADDR_REQ |
 464                                               P2P_FLAG_HMODEL_REQ);
 465                 if (ret) {
 466                         ath6kl_dbg(ATH6KL_DBG_TRC,
 467                                    "failed to request P2P capabilities (%d) - assuming P2P not supported\n",
 468                                    ret);
 469                         ar->p2p = false;
 470                 }
 471         }
 472
 473         if (ar->p2p && (ar->vif_max == 1 || idx)) {
 474                 /* Enable Probe Request reporting for P2P */
 475                 ret = ath6kl_wmi_probe_report_req_cmd(ar->wmi, idx, true);
 476                 if (ret) {
 477                         ath6kl_dbg(ATH6KL_DBG_TRC,
 478                                    "failed to enable Probe Request reporting (%d)\n",
 479                                    ret);
 480                 }
 481         }
 482
 483         return ret;
 484 }
 485
 486 int ath6kl_configure_target(struct ath6kl *ar)
 487 {
 488         u32 param, ram_reserved_size;
 489         u8 fw_iftype, fw_mode = 0, fw_submode = 0;
 490         int i, status;
 491
 492         param = !!(ar->conf_flags & ATH6KL_CONF_UART_DEBUG);
 493         if (ath6kl_bmi_write_hi32(ar, hi_serial_enable, param)) {
 494                 ath6kl_err("bmi_write_memory for uart debug failed\n");
 495                 return -EIO;
 496         }
 497
 498         /*
 499          * Note: Even though the firmware interface type is
 500          * chosen as BSS_STA for all three interfaces, can
 501          * be configured to IBSS/AP as long as the fw submode
 502          * remains normal mode (0 - AP, STA and IBSS). But
 503          * due to an target assert in firmware only one interface is
 504          * configured for now.
 505          */
 506         fw_iftype = HI_OPTION_FW_MODE_BSS_STA;
 507
 508         for (i = 0; i < ar->vif_max; i++)
 509                 fw_mode |= fw_iftype << (i * HI_OPTION_FW_MODE_BITS);
 510
 511         /*
 512          * Submodes when fw does not support dynamic interface
 513          * switching:
 514          *              vif[0] - AP/STA/IBSS
 515          *              vif[1] - "P2P dev"/"P2P GO"/"P2P Client"
 516          *              vif[2] - "P2P dev"/"P2P GO"/"P2P Client"
 517          * Otherwise, All the interface are initialized to p2p dev.
 518          */
 519
 520         if (test_bit(ATH6KL_FW_CAPABILITY_STA_P2PDEV_DUPLEX,
 521                      ar->fw_capabilities)) {
 522                 for (i = 0; i < ar->vif_max; i++)
 523                         fw_submode |= HI_OPTION_FW_SUBMODE_P2PDEV <<
 524                                 (i * HI_OPTION_FW_SUBMODE_BITS);
 525         } else {
 526                 for (i = 0; i < ar->max_norm_iface; i++)
 527                         fw_submode |= HI_OPTION_FW_SUBMODE_NONE <<
 528                                 (i * HI_OPTION_FW_SUBMODE_BITS);
 529
 530                 for (i = ar->max_norm_iface; i < ar->vif_max; i++)
 531                         fw_submode |= HI_OPTION_FW_SUBMODE_P2PDEV <<
 532                                 (i * HI_OPTION_FW_SUBMODE_BITS);
 533
 534                 if (ar->p2p && ar->vif_max == 1)
 535                         fw_submode = HI_OPTION_FW_SUBMODE_P2PDEV;
 536         }
 537
 538         if (ath6kl_bmi_write_hi32(ar, hi_app_host_interest,
 539                                   HTC_PROTOCOL_VERSION) != 0) {
 540                 ath6kl_err("bmi_write_memory for htc version failed\n");
 541                 return -EIO;
 542         }
 543
 544         /* set the firmware mode to STA/IBSS/AP */
 545         param = 0;
 546
 547         if (ath6kl_bmi_read_hi32(ar, hi_option_flag, &param) != 0) {
 548                 ath6kl_err("bmi_read_memory for setting fwmode failed\n");
 549                 return -EIO;
 550         }
 551
 552         param |= (ar->vif_max << HI_OPTION_NUM_DEV_SHIFT);
 553         param |= fw_mode << HI_OPTION_FW_MODE_SHIFT;
 554         param |= fw_submode << HI_OPTION_FW_SUBMODE_SHIFT;
 555
 556         param |= (0 << HI_OPTION_MAC_ADDR_METHOD_SHIFT);
 557         param |= (0 << HI_OPTION_FW_BRIDGE_SHIFT);
 558
 559         if (ath6kl_bmi_write_hi32(ar, hi_option_flag, param) != 0) {
 560                 ath6kl_err("bmi_write_memory for setting fwmode failed\n");
 561                 return -EIO;
 562         }
 563
 564         ath6kl_dbg(ATH6KL_DBG_TRC, "firmware mode set\n");
 565
 566         /*
 567          * Hardcode the address use for the extended board data
 568          * Ideally this should be pre-allocate by the OS at boot time
 569          * But since it is a new feature and board data is loaded
 570          * at init time, we have to workaround this from host.
 571          * It is difficult to patch the firmware boot code,
 572          * but possible in theory.
 573          */
 574
 575         if (ar->target_type == TARGET_TYPE_AR6003) {
 576                 param = ar->hw.board_ext_data_addr;
 577                 ram_reserved_size = ar->hw.reserved_ram_size;
 578
 579                 if (ath6kl_bmi_write_hi32(ar, hi_board_ext_data, param) != 0) {
 580                         ath6kl_err("bmi_write_memory for hi_board_ext_data failed\n");
 581                         return -EIO;
 582                 }
 583
 584                 if (ath6kl_bmi_write_hi32(ar, hi_end_ram_reserve_sz,
 585                                           ram_reserved_size) != 0) {
 586                         ath6kl_err("bmi_write_memory for hi_end_ram_reserve_sz failed\n");
 587                         return -EIO;
 588                 }
 589         }
 590
 591         /* set the block size for the target */
 592         if (ath6kl_set_htc_params(ar, MBOX_YIELD_LIMIT, 0))
 593                 /* use default number of control buffers */
 594                 return -EIO;
 595
 596         /* Configure GPIO AR600x UART */
 597         status = ath6kl_bmi_write_hi32(ar, hi_dbg_uart_txpin,
 598                                        ar->hw.uarttx_pin);
 599         if (status)
 600                 return status;
 601
 602         /* Configure target refclk_hz */
 603         status = ath6kl_bmi_write_hi32(ar, hi_refclk_hz, ar->hw.refclk_hz);
 604         if (status)
 605                 return status;
 606
 607         return 0;
 608 }
 609
 610 /* firmware upload */
 611 static int ath6kl_get_fw(struct ath6kl *ar, const char *filename,
 612                          u8 **fw, size_t *fw_len)
 613 {
 614         const struct firmware *fw_entry;
 615         int ret;
 616
 617         ret = request_firmware(&fw_entry, filename, ar->dev);
 618         if (ret)
 619                 return ret;
 620
 621         *fw_len = fw_entry->size;
 622         *fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
 623
 624         if (*fw == NULL)
 625                 ret = -ENOMEM;
 626
 627         release_firmware(fw_entry);
 628
 629         return ret;
 630 }
 631
 632 #ifdef CONFIG_OF
 633 /*
 634  * Check the device tree for a board-id and use it to construct
 635  * the pathname to the firmware file.  Used (for now) to find a
 636  * fallback to the "bdata.bin" file--typically a symlink to the
 637  * appropriate board-specific file.
 638  */
 639 static bool check_device_tree(struct ath6kl *ar)
 640 {
 641         static const char *board_id_prop = "atheros,board-id";
 642         struct device_node *node;
 643         char board_filename[64];
 644         const char *board_id;
 645         int ret;
 646
 647         for_each_compatible_node(node, NULL, "atheros,ath6kl") {
 648                 board_id = of_get_property(node, board_id_prop, NULL);
 649                 if (board_id == NULL) {
 650                         ath6kl_warn("No \"%s\" property on %s node.\n",
 651                                     board_id_prop, node->name);
 652                         continue;
 653                 }
 654                 snprintf(board_filename, sizeof(board_filename),
 655                          "%s/bdata.%s.bin", ar->hw.fw.dir, board_id);
 656
 657                 ret = ath6kl_get_fw(ar, board_filename, &ar->fw_board,
 658                                     &ar->fw_board_len);
 659                 if (ret) {
 660                         ath6kl_err("Failed to get DT board file %s: %d\n",
 661                                    board_filename, ret);
 662                         continue;
 663                 }
 664                 return true;
 665         }
 666         return false;
 667 }
 668 #else
 669 static bool check_device_tree(struct ath6kl *ar)
 670 {
 671         return false;
 672 }
 673 #endif /* CONFIG_OF */
 674
 675 static int ath6kl_fetch_board_file(struct ath6kl *ar)
 676 {
 677         const char *filename;
 678         int ret;
 679
 680         if (ar->fw_board != NULL)
 681                 return 0;
 682
 683         if (WARN_ON(ar->hw.fw_board == NULL))
 684                 return -EINVAL;
 685
 686         filename = ar->hw.fw_board;
 687
 688         ret = ath6kl_get_fw(ar, filename, &ar->fw_board,
 689                             &ar->fw_board_len);
 690         if (ret == 0) {
 691                 /* managed to get proper board file */
 692                 return 0;
 693         }
 694
 695         if (check_device_tree(ar)) {
 696                 /* got board file from device tree */
 697                 return 0;
 698         }
 699
 700         /* there was no proper board file, try to use default instead */
 701         ath6kl_warn("Failed to get board file %s (%d), trying to find default board file.\n",
 702                     filename, ret);
 703
 704         filename = ar->hw.fw_default_board;
 705
 706         ret = ath6kl_get_fw(ar, filename, &ar->fw_board,
 707                             &ar->fw_board_len);
 708         if (ret) {
 709                 ath6kl_err("Failed to get default board file %s: %d\n",
 710                            filename, ret);
 711                 return ret;
 712         }
 713
 714         ath6kl_warn("WARNING! No proper board file was not found, instead using a default board file.\n");
 715         ath6kl_warn("Most likely your hardware won't work as specified. Install correct board file!\n");
 716
 717         return 0;
 718 }
 719
 720 static int ath6kl_fetch_otp_file(struct ath6kl *ar)
 721 {
 722         char filename[100];
 723         int ret;
 724
 725         if (ar->fw_otp != NULL)
 726                 return 0;
 727
 728         if (ar->hw.fw.otp == NULL) {
 729                 ath6kl_dbg(ATH6KL_DBG_BOOT,
 730                            "no OTP file configured for this hw\n");
 731                 return 0;
 732         }
 733
 734         snprintf(filename, sizeof(filename), "%s/%s",
 735                  ar->hw.fw.dir, ar->hw.fw.otp);
 736
 737         ret = ath6kl_get_fw(ar, filename, &ar->fw_otp,
 738                             &ar->fw_otp_len);
 739         if (ret) {
 740                 ath6kl_err("Failed to get OTP file %s: %d\n",
 741                            filename, ret);
 742                 return ret;
 743         }
 744
 745         return 0;
 746 }
 747
 748 static int ath6kl_fetch_testmode_file(struct ath6kl *ar)
 749 {
 750         char filename[100];
 751         int ret;
 752
 753         if (ar->testmode == 0)
 754                 return 0;
 755
 756         ath6kl_dbg(ATH6KL_DBG_BOOT, "testmode %d\n", ar->testmode);
 757
 758         if (ar->testmode == 2) {
 759                 if (ar->hw.fw.utf == NULL) {
 760                         ath6kl_warn("testmode 2 not supported\n");
 761                         return -EOPNOTSUPP;
 762                 }
 763
 764                 snprintf(filename, sizeof(filename), "%s/%s",
 765                          ar->hw.fw.dir, ar->hw.fw.utf);
 766         } else {
 767                 if (ar->hw.fw.tcmd == NULL) {
 768                         ath6kl_warn("testmode 1 not supported\n");
 769                         return -EOPNOTSUPP;
 770                 }
 771
 772                 snprintf(filename, sizeof(filename), "%s/%s",
 773                          ar->hw.fw.dir, ar->hw.fw.tcmd);
 774         }
 775
 776         set_bit(TESTMODE, &ar->flag);
 777
 778         ret = ath6kl_get_fw(ar, filename, &ar->fw, &ar->fw_len);
 779         if (ret) {
 780                 ath6kl_err("Failed to get testmode %d firmware file %s: %d\n",
 781                            ar->testmode, filename, ret);
 782                 return ret;
 783         }
 784
 785         return 0;
 786 }
 787
 788 static int ath6kl_fetch_fw_file(struct ath6kl *ar)
 789 {
 790         char filename[100];
 791         int ret;
 792
 793         if (ar->fw != NULL)
 794                 return 0;
 795
 796         /* FIXME: remove WARN_ON() as we won't support FW API 1 for long */
 797         if (WARN_ON(ar->hw.fw.fw == NULL))
 798                 return -EINVAL;
 799
 800         snprintf(filename, sizeof(filename), "%s/%s",
 801                  ar->hw.fw.dir, ar->hw.fw.fw);
 802
 803         ret = ath6kl_get_fw(ar, filename, &ar->fw, &ar->fw_len);
 804         if (ret) {
 805                 ath6kl_err("Failed to get firmware file %s: %d\n",
 806                            filename, ret);
 807                 return ret;
 808         }
 809
 810         return 0;
 811 }
 812
 813 static int ath6kl_fetch_patch_file(struct ath6kl *ar)
 814 {
 815         char filename[100];
 816         int ret;
 817
 818         if (ar->fw_patch != NULL)
 819                 return 0;
 820
 821         if (ar->hw.fw.patch == NULL)
 822                 return 0;
 823
 824         snprintf(filename, sizeof(filename), "%s/%s",
 825                  ar->hw.fw.dir, ar->hw.fw.patch);
 826
 827         ret = ath6kl_get_fw(ar, filename, &ar->fw_patch,
 828                             &ar->fw_patch_len);
 829         if (ret) {
 830                 ath6kl_err("Failed to get patch file %s: %d\n",
 831                            filename, ret);
 832                 return ret;
 833         }
 834
 835         return 0;
 836 }
 837
 838 static int ath6kl_fetch_testscript_file(struct ath6kl *ar)
 839 {
 840         char filename[100];
 841         int ret;
 842
 843         if (ar->testmode != 2)
 844                 return 0;
 845
 846         if (ar->fw_testscript != NULL)
 847                 return 0;
 848
 849         if (ar->hw.fw.testscript == NULL)
 850                 return 0;
 851
 852         snprintf(filename, sizeof(filename), "%s/%s",
 853                  ar->hw.fw.dir, ar->hw.fw.testscript);
 854
 855         ret = ath6kl_get_fw(ar, filename, &ar->fw_testscript,
 856                                 &ar->fw_testscript_len);
 857         if (ret) {
 858                 ath6kl_err("Failed to get testscript file %s: %d\n",
 859                            filename, ret);
 860                 return ret;
 861         }
 862
 863         return 0;
 864 }
 865
 866 static int ath6kl_fetch_fw_api1(struct ath6kl *ar)
 867 {
 868         int ret;
 869
 870         ret = ath6kl_fetch_otp_file(ar);
 871         if (ret)
 872                 return ret;
 873
 874         ret = ath6kl_fetch_fw_file(ar);
 875         if (ret)
 876                 return ret;
 877
 878         ret = ath6kl_fetch_patch_file(ar);
 879         if (ret)
 880                 return ret;
 881
 882         ret = ath6kl_fetch_testscript_file(ar);
 883         if (ret)
 884                 return ret;
 885
 886         return 0;
 887 }
 888
 889 static int ath6kl_fetch_fw_apin(struct ath6kl *ar, const char *name)
 890 {
 891         size_t magic_len, len, ie_len;
 892         const struct firmware *fw;
 893         struct ath6kl_fw_ie *hdr;
 894         char filename[100];
 895         const u8 *data;
 896         int ret, ie_id, i, index, bit;
 897         __le32 *val;
 898
 899         snprintf(filename, sizeof(filename), "%s/%s", ar->hw.fw.dir, name);
 900
 901         ret = request_firmware(&fw, filename, ar->dev);
 902         if (ret)
 903                 return ret;
 904
 905         data = fw->data;
 906         len = fw->size;
 907
 908         /* magic also includes the null byte, check that as well */
 909         magic_len = strlen(ATH6KL_FIRMWARE_MAGIC) + 1;
 910
 911         if (len < magic_len) {
 912                 ret = -EINVAL;
 913                 goto out;
 914         }
 915
 916         if (memcmp(data, ATH6KL_FIRMWARE_MAGIC, magic_len) != 0) {
 917                 ret = -EINVAL;
 918                 goto out;
 919         }
 920
 921         len -= magic_len;
 922         data += magic_len;
 923
 924         /* loop elements */
 925         while (len > sizeof(struct ath6kl_fw_ie)) {
 926                 /* hdr is unaligned! */
 927                 hdr = (struct ath6kl_fw_ie *) data;
 928
 929                 ie_id = le32_to_cpup(&hdr->id);
 930                 ie_len = le32_to_cpup(&hdr->len);
 931
 932                 len -= sizeof(*hdr);
 933                 data += sizeof(*hdr);
 934
 935                 if (len < ie_len) {
 936                         ret = -EINVAL;
 937                         goto out;
 938                 }
 939
 940                 switch (ie_id) {
 941                 case ATH6KL_FW_IE_OTP_IMAGE:
 942                         ath6kl_dbg(ATH6KL_DBG_BOOT, "found otp image ie (%zd B)\n",
 943                                    ie_len);
 944
 945                         ar->fw_otp = kmemdup(data, ie_len, GFP_KERNEL);
 946
 947                         if (ar->fw_otp == NULL) {
 948                                 ret = -ENOMEM;
 949                                 goto out;
 950                         }
 951
 952                         ar->fw_otp_len = ie_len;
 953                         break;
 954                 case ATH6KL_FW_IE_FW_IMAGE:
 955                         ath6kl_dbg(ATH6KL_DBG_BOOT, "found fw image ie (%zd B)\n",
 956                                    ie_len);
 957
 958                         /* in testmode we already might have a fw file */
 959                         if (ar->fw != NULL)
 960                                 break;
 961
 962                         ar->fw = vmalloc(ie_len);
 963
 964                         if (ar->fw == NULL) {
 965                                 ret = -ENOMEM;
 966                                 goto out;
 967                         }
 968
 969                         memcpy(ar->fw, data, ie_len);
 970                         ar->fw_len = ie_len;
 971                         break;
 972                 case ATH6KL_FW_IE_PATCH_IMAGE:
 973                         ath6kl_dbg(ATH6KL_DBG_BOOT, "found patch image ie (%zd B)\n",
 974                                    ie_len);
 975
 976                         ar->fw_patch = kmemdup(data, ie_len, GFP_KERNEL);
 977
 978                         if (ar->fw_patch == NULL) {
 979                                 ret = -ENOMEM;
 980                                 goto out;
 981                         }
 982
 983                         ar->fw_patch_len = ie_len;
 984                         break;
 985                 case ATH6KL_FW_IE_RESERVED_RAM_SIZE:
 986                         val = (__le32 *) data;
 987                         ar->hw.reserved_ram_size = le32_to_cpup(val);
 988
 989                         ath6kl_dbg(ATH6KL_DBG_BOOT,
 990                                    "found reserved ram size ie 0x%d\n",
 991                                    ar->hw.reserved_ram_size);
 992                         break;
 993                 case ATH6KL_FW_IE_CAPABILITIES:
 994                         if (ie_len < DIV_ROUND_UP(ATH6KL_FW_CAPABILITY_MAX, 8))
 995                                 break;
 996
 997                         ath6kl_dbg(ATH6KL_DBG_BOOT,
 998                                    "found firmware capabilities ie (%zd B)\n",
 999                                    ie_len);
1000
1001                         for (i = 0; i < ATH6KL_FW_CAPABILITY_MAX; i++) {
1002                                 index = i / 8;
1003                                 bit = i % 8;
1004
1005                                 if (data[index] & (1 << bit))
1006                                         __set_bit(i, ar->fw_capabilities);
1007                         }
1008
1009                         ath6kl_dbg_dump(ATH6KL_DBG_BOOT, "capabilities", "",
1010                                         ar->fw_capabilities,
1011                                         sizeof(ar->fw_capabilities));
1012                         break;
1013                 case ATH6KL_FW_IE_PATCH_ADDR:
1014                         if (ie_len != sizeof(*val))
1015                                 break;
1016
1017                         val = (__le32 *) data;
1018                         ar->hw.dataset_patch_addr = le32_to_cpup(val);
1019
1020                         ath6kl_dbg(ATH6KL_DBG_BOOT,
1021                                    "found patch address ie 0x%x\n",
1022                                    ar->hw.dataset_patch_addr);
1023                         break;
1024                 case ATH6KL_FW_IE_BOARD_ADDR:
1025                         if (ie_len != sizeof(*val))
1026                                 break;
1027
1028                         val = (__le32 *) data;
1029                         ar->hw.board_addr = le32_to_cpup(val);
1030
1031                         ath6kl_dbg(ATH6KL_DBG_BOOT,
1032                                    "found board address ie 0x%x\n",
1033                                    ar->hw.board_addr);
1034                         break;
1035                 case ATH6KL_FW_IE_VIF_MAX:
1036                         if (ie_len != sizeof(*val))
1037                                 break;
1038
1039                         val = (__le32 *) data;
1040                         ar->vif_max = min_t(unsigned int, le32_to_cpup(val),
1041                                             ATH6KL_VIF_MAX);
1042
1043                         if (ar->vif_max > 1 && !ar->p2p)
1044                                 ar->max_norm_iface = 2;
1045
1046                         ath6kl_dbg(ATH6KL_DBG_BOOT,
1047                                    "found vif max ie %d\n", ar->vif_max);
1048                         break;
1049                 default:
1050                         ath6kl_dbg(ATH6KL_DBG_BOOT, "Unknown fw ie: %u\n",
1051                                    le32_to_cpup(&hdr->id));
1052                         break;
1053                 }
1054
1055                 len -= ie_len;
1056                 data += ie_len;
1057         };
1058
1059         ret = 0;
1060 out:
1061         release_firmware(fw);
1062
1063         return ret;
1064 }
1065
1066 int ath6kl_init_fetch_firmwares(struct ath6kl *ar)
1067 {
1068         int ret;
1069
1070         ret = ath6kl_fetch_board_file(ar);
1071         if (ret)
1072                 return ret;
1073
1074         ret = ath6kl_fetch_testmode_file(ar);
1075         if (ret)
1076                 return ret;
1077
1078         ret = ath6kl_fetch_fw_apin(ar, ATH6KL_FW_API3_FILE);
1079         if (ret == 0) {
1080                 ar->fw_api = 3;
1081                 goto out;
1082         }
1083
1084         ret = ath6kl_fetch_fw_apin(ar, ATH6KL_FW_API2_FILE);
1085         if (ret == 0) {
1086                 ar->fw_api = 2;
1087                 goto out;
1088         }
1089
1090         ret = ath6kl_fetch_fw_api1(ar);
1091         if (ret)
1092                 return ret;
1093
1094         ar->fw_api = 1;
1095
1096 out:
1097         ath6kl_dbg(ATH6KL_DBG_BOOT, "using fw api %d\n", ar->fw_api);
1098
1099         return 0;
1100 }
1101
1102 static int ath6kl_upload_board_file(struct ath6kl *ar)
1103 {
1104         u32 board_address, board_ext_address, param;
1105         u32 board_data_size, board_ext_data_size;
1106         int ret;
1107
1108         if (WARN_ON(ar->fw_board == NULL))
1109                 return -ENOENT;
1110
1111         /*
1112          * Determine where in Target RAM to write Board Data.
1113          * For AR6004, host determine Target RAM address for
1114          * writing board data.
1115          */
1116         if (ar->hw.board_addr != 0) {
1117                 board_address = ar->hw.board_addr;
1118                 ath6kl_bmi_write_hi32(ar, hi_board_data,
1119                                       board_address);
1120         } else {
1121                 ath6kl_bmi_read_hi32(ar, hi_board_data, &board_address);
1122         }
1123
1124         /* determine where in target ram to write extended board data */
1125         ath6kl_bmi_read_hi32(ar, hi_board_ext_data, &board_ext_address);
1126
1127         if (ar->target_type == TARGET_TYPE_AR6003 &&
1128             board_ext_address == 0) {
1129                 ath6kl_err("Failed to get board file target address.\n");
1130                 return -EINVAL;
1131         }
1132
1133         switch (ar->target_type) {
1134         case TARGET_TYPE_AR6003:
1135                 board_data_size = AR6003_BOARD_DATA_SZ;
1136                 board_ext_data_size = AR6003_BOARD_EXT_DATA_SZ;
1137                 if (ar->fw_board_len > (board_data_size + board_ext_data_size))
1138                         board_ext_data_size = AR6003_BOARD_EXT_DATA_SZ_V2;
1139                 break;
1140         case TARGET_TYPE_AR6004:
1141                 board_data_size = AR6004_BOARD_DATA_SZ;
1142                 board_ext_data_size = AR6004_BOARD_EXT_DATA_SZ;
1143                 break;
1144         default:
1145                 WARN_ON(1);
1146                 return -EINVAL;
1147                 break;
1148         }
1149
1150         if (board_ext_address &&
1151             ar->fw_board_len == (board_data_size + board_ext_data_size)) {
1152
1153                 /* write extended board data */
1154                 ath6kl_dbg(ATH6KL_DBG_BOOT,
1155                            "writing extended board data to 0x%x (%d B)\n",
1156                            board_ext_address, board_ext_data_size);
1157
1158                 ret = ath6kl_bmi_write(ar, board_ext_address,
1159                                        ar->fw_board + board_data_size,
1160                                        board_ext_data_size);
1161                 if (ret) {
1162                         ath6kl_err("Failed to write extended board data: %d\n",
1163                                    ret);
1164                         return ret;
1165                 }
1166
1167                 /* record that extended board data is initialized */
1168                 param = (board_ext_data_size << 16) | 1;
1169
1170                 ath6kl_bmi_write_hi32(ar, hi_board_ext_data_config, param);
1171         }
1172
1173         if (ar->fw_board_len < board_data_size) {
1174                 ath6kl_err("Too small board file: %zu\n", ar->fw_board_len);
1175                 ret = -EINVAL;
1176                 return ret;
1177         }
1178
1179         ath6kl_dbg(ATH6KL_DBG_BOOT, "writing board file to 0x%x (%d B)\n",
1180                    board_address, board_data_size);
1181
1182         ret = ath6kl_bmi_write(ar, board_address, ar->fw_board,
1183                                board_data_size);
1184
1185         if (ret) {
1186                 ath6kl_err("Board file bmi write failed: %d\n", ret);
1187                 return ret;
1188         }
1189
1190         /* record the fact that Board Data IS initialized */
1191         ath6kl_bmi_write_hi32(ar, hi_board_data_initialized, 1);
1192
1193         return ret;
1194 }
1195
1196 static int ath6kl_upload_otp(struct ath6kl *ar)
1197 {
1198         u32 address, param;
1199         bool from_hw = false;
1200         int ret;
1201
1202         if (ar->fw_otp == NULL)
1203                 return 0;
1204
1205         address = ar->hw.app_load_addr;
1206
1207         ath6kl_dbg(ATH6KL_DBG_BOOT, "writing otp to 0x%x (%zd B)\n", address,
1208                    ar->fw_otp_len);
1209
1210         ret = ath6kl_bmi_fast_download(ar, address, ar->fw_otp,
1211                                        ar->fw_otp_len);
1212         if (ret) {
1213                 ath6kl_err("Failed to upload OTP file: %d\n", ret);
1214                 return ret;
1215         }
1216
1217         /* read firmware start address */
1218         ret = ath6kl_bmi_read_hi32(ar, hi_app_start, &address);
1219
1220         if (ret) {
1221                 ath6kl_err("Failed to read hi_app_start: %d\n", ret);
1222                 return ret;
1223         }
1224
1225         if (ar->hw.app_start_override_addr == 0) {
1226                 ar->hw.app_start_override_addr = address;
1227                 from_hw = true;
1228         }
1229
1230         ath6kl_dbg(ATH6KL_DBG_BOOT, "app_start_override_addr%s 0x%x\n",
1231                    from_hw ? " (from hw)" : "",
1232                    ar->hw.app_start_override_addr);
1233
1234         /* execute the OTP code */
1235         ath6kl_dbg(ATH6KL_DBG_BOOT, "executing OTP at 0x%x\n",
1236                    ar->hw.app_start_override_addr);
1237         param = 0;
1238         ath6kl_bmi_execute(ar, ar->hw.app_start_override_addr, &param);
1239
1240         return ret;
1241 }
1242
1243 static int ath6kl_upload_firmware(struct ath6kl *ar)
1244 {
1245         u32 address;
1246         int ret;
1247
1248         if (WARN_ON(ar->fw == NULL))
1249                 return 0;
1250
1251         address = ar->hw.app_load_addr;
1252
1253         ath6kl_dbg(ATH6KL_DBG_BOOT, "writing firmware to 0x%x (%zd B)\n",
1254                    address, ar->fw_len);
1255
1256         ret = ath6kl_bmi_fast_download(ar, address, ar->fw, ar->fw_len);
1257
1258         if (ret) {
1259                 ath6kl_err("Failed to write firmware: %d\n", ret);
1260                 return ret;
1261         }
1262
1263         /*
1264          * Set starting address for firmware
1265          * Don't need to setup app_start override addr on AR6004
1266          */
1267         if (ar->target_type != TARGET_TYPE_AR6004) {
1268                 address = ar->hw.app_start_override_addr;
1269                 ath6kl_bmi_set_app_start(ar, address);
1270         }
1271         return ret;
1272 }
1273
1274 static int ath6kl_upload_patch(struct ath6kl *ar)
1275 {
1276         u32 address;
1277         int ret;
1278
1279         if (ar->fw_patch == NULL)
1280                 return 0;
1281
1282         address = ar->hw.dataset_patch_addr;
1283
1284         ath6kl_dbg(ATH6KL_DBG_BOOT, "writing patch to 0x%x (%zd B)\n",
1285                    address, ar->fw_patch_len);
1286
1287         ret = ath6kl_bmi_write(ar, address, ar->fw_patch, ar->fw_patch_len);
1288         if (ret) {
1289                 ath6kl_err("Failed to write patch file: %d\n", ret);
1290                 return ret;
1291         }
1292
1293         ath6kl_bmi_write_hi32(ar, hi_dset_list_head, address);
1294
1295         return 0;
1296 }
1297
1298 static int ath6kl_upload_testscript(struct ath6kl *ar)
1299 {
1300         u32 address;
1301         int ret;
1302
1303         if (ar->testmode != 2)
1304                 return 0;
1305
1306         if (ar->fw_testscript == NULL)
1307                 return 0;
1308
1309         address = ar->hw.testscript_addr;
1310
1311         ath6kl_dbg(ATH6KL_DBG_BOOT, "writing testscript to 0x%x (%zd B)\n",
1312                    address, ar->fw_testscript_len);
1313
1314         ret = ath6kl_bmi_write(ar, address, ar->fw_testscript,
1315                 ar->fw_testscript_len);
1316         if (ret) {
1317                 ath6kl_err("Failed to write testscript file: %d\n", ret);
1318                 return ret;
1319         }
1320
1321         ath6kl_bmi_write_hi32(ar, hi_ota_testscript, address);
1322         ath6kl_bmi_write_hi32(ar, hi_end_ram_reserve_sz, 4096);
1323         ath6kl_bmi_write_hi32(ar, hi_test_apps_related, 1);
1324
1325         return 0;
1326 }
1327
1328 static int ath6kl_init_upload(struct ath6kl *ar)
1329 {
1330         u32 param, options, sleep, address;
1331         int status = 0;
1332
1333         if (ar->target_type != TARGET_TYPE_AR6003 &&
1334             ar->target_type != TARGET_TYPE_AR6004)
1335                 return -EINVAL;
1336
1337         /* temporarily disable system sleep */
1338         address = MBOX_BASE_ADDRESS + LOCAL_SCRATCH_ADDRESS;
1339         status = ath6kl_bmi_reg_read(ar, address, &param);
1340         if (status)
1341                 return status;
1342
1343         options = param;
1344
1345         param |= ATH6KL_OPTION_SLEEP_DISABLE;
1346         status = ath6kl_bmi_reg_write(ar, address, param);
1347         if (status)
1348                 return status;
1349
1350         address = RTC_BASE_ADDRESS + SYSTEM_SLEEP_ADDRESS;
1351         status = ath6kl_bmi_reg_read(ar, address, &param);
1352         if (status)
1353                 return status;
1354
1355         sleep = param;
1356
1357         param |= SM(SYSTEM_SLEEP_DISABLE, 1);
1358         status = ath6kl_bmi_reg_write(ar, address, param);
1359         if (status)
1360                 return status;
1361
1362         ath6kl_dbg(ATH6KL_DBG_TRC, "old options: %d, old sleep: %d\n",
1363                    options, sleep);
1364
1365         /* program analog PLL register */
1366         /* no need to control 40/44MHz clock on AR6004 */
1367         if (ar->target_type != TARGET_TYPE_AR6004) {
1368                 status = ath6kl_bmi_reg_write(ar, ATH6KL_ANALOG_PLL_REGISTER,
1369                                               0xF9104001);
1370
1371                 if (status)
1372                         return status;
1373
1374                 /* Run at 80/88MHz by default */
1375                 param = SM(CPU_CLOCK_STANDARD, 1);
1376
1377                 address = RTC_BASE_ADDRESS + CPU_CLOCK_ADDRESS;
1378                 status = ath6kl_bmi_reg_write(ar, address, param);
1379                 if (status)
1380                         return status;
1381         }
1382
1383         param = 0;
1384         address = RTC_BASE_ADDRESS + LPO_CAL_ADDRESS;
1385         param = SM(LPO_CAL_ENABLE, 1);
1386         status = ath6kl_bmi_reg_write(ar, address, param);
1387         if (status)
1388                 return status;
1389
1390         /* WAR to avoid SDIO CRC err */
1391         if (ar->version.target_ver == AR6003_HW_2_0_VERSION ||
1392             ar->version.target_ver == AR6003_HW_2_1_1_VERSION) {
1393                 ath6kl_err("temporary war to avoid sdio crc error\n");
1394
1395                 param = 0x20;
1396
1397                 address = GPIO_BASE_ADDRESS + GPIO_PIN10_ADDRESS;
1398                 status = ath6kl_bmi_reg_write(ar, address, param);
1399                 if (status)
1400                         return status;
1401
1402                 address = GPIO_BASE_ADDRESS + GPIO_PIN11_ADDRESS;
1403                 status = ath6kl_bmi_reg_write(ar, address, param);
1404                 if (status)
1405                         return status;
1406
1407                 address = GPIO_BASE_ADDRESS + GPIO_PIN12_ADDRESS;
1408                 status = ath6kl_bmi_reg_write(ar, address, param);
1409                 if (status)
1410                         return status;
1411
1412                 address = GPIO_BASE_ADDRESS + GPIO_PIN13_ADDRESS;
1413                 status = ath6kl_bmi_reg_write(ar, address, param);
1414                 if (status)
1415                         return status;
1416         }
1417
1418         /* write EEPROM data to Target RAM */
1419         status = ath6kl_upload_board_file(ar);
1420         if (status)
1421                 return status;
1422
1423         /* transfer One time Programmable data */
1424         status = ath6kl_upload_otp(ar);
1425         if (status)
1426                 return status;
1427
1428         /* Download Target firmware */
1429         status = ath6kl_upload_firmware(ar);
1430         if (status)
1431                 return status;
1432
1433         status = ath6kl_upload_patch(ar);
1434         if (status)
1435                 return status;
1436
1437         /* Download the test script */
1438         status = ath6kl_upload_testscript(ar);
1439         if (status)
1440                 return status;
1441
1442         /* Restore system sleep */
1443         address = RTC_BASE_ADDRESS + SYSTEM_SLEEP_ADDRESS;
1444         status = ath6kl_bmi_reg_write(ar, address, sleep);
1445         if (status)
1446                 return status;
1447
1448         address = MBOX_BASE_ADDRESS + LOCAL_SCRATCH_ADDRESS;
1449         param = options | 0x20;
1450         status = ath6kl_bmi_reg_write(ar, address, param);
1451         if (status)
1452                 return status;
1453
1454         return status;
1455 }
1456
1457 int ath6kl_init_hw_params(struct ath6kl *ar)
1458 {
1459         const struct ath6kl_hw *uninitialized_var(hw);
1460         int i;
1461
1462         for (i = 0; i < ARRAY_SIZE(hw_list); i++) {
1463                 hw = &hw_list[i];
1464
1465                 if (hw->id == ar->version.target_ver)
1466                         break;
1467         }
1468
1469         if (i == ARRAY_SIZE(hw_list)) {
1470                 ath6kl_err("Unsupported hardware version: 0x%x\n",
1471                            ar->version.target_ver);
1472                 return -EINVAL;
1473         }
1474
1475         ar->hw = *hw;
1476
1477         ath6kl_dbg(ATH6KL_DBG_BOOT,
1478                    "target_ver 0x%x target_type 0x%x dataset_patch 0x%x app_load_addr 0x%x\n",
1479                    ar->version.target_ver, ar->target_type,
1480                    ar->hw.dataset_patch_addr, ar->hw.app_load_addr);
1481         ath6kl_dbg(ATH6KL_DBG_BOOT,
1482                    "app_start_override_addr 0x%x board_ext_data_addr 0x%x reserved_ram_size 0x%x",
1483                    ar->hw.app_start_override_addr, ar->hw.board_ext_data_addr,
1484                    ar->hw.reserved_ram_size);
1485         ath6kl_dbg(ATH6KL_DBG_BOOT,
1486                    "refclk_hz %d uarttx_pin %d",
1487                    ar->hw.refclk_hz, ar->hw.uarttx_pin);
1488
1489         return 0;
1490 }
1491
1492 static const char *ath6kl_init_get_hif_name(enum ath6kl_hif_type type)
1493 {
1494         switch (type) {
1495         case ATH6KL_HIF_TYPE_SDIO:
1496                 return "sdio";
1497         case ATH6KL_HIF_TYPE_USB:
1498                 return "usb";
1499         }
1500
1501         return NULL;
1502 }
1503
1504 int ath6kl_init_hw_start(struct ath6kl *ar)
1505 {
1506         long timeleft;
1507         int ret, i;
1508
1509         ath6kl_dbg(ATH6KL_DBG_BOOT, "hw start\n");
1510
1511         ret = ath6kl_hif_power_on(ar);
1512         if (ret)
1513                 return ret;
1514
1515         ret = ath6kl_configure_target(ar);
1516         if (ret)
1517                 goto err_power_off;
1518
1519         ret = ath6kl_init_upload(ar);
1520         if (ret)
1521                 goto err_power_off;
1522
1523         /* Do we need to finish the BMI phase */
1524         /* FIXME: return error from ath6kl_bmi_done() */
1525         if (ath6kl_bmi_done(ar)) {
1526                 ret = -EIO;
1527                 goto err_power_off;
1528         }
1529
1530         /*
1531          * The reason we have to wait for the target here is that the
1532          * driver layer has to init BMI in order to set the host block
1533          * size.
1534          */
1535         if (ath6kl_htc_wait_target(ar->htc_target)) {
1536                 ret = -EIO;
1537                 goto err_power_off;
1538         }
1539
1540         if (ath6kl_init_service_ep(ar)) {
1541                 ret = -EIO;
1542                 goto err_cleanup_scatter;
1543         }
1544
1545         /* setup credit distribution */
1546         ath6kl_htc_credit_setup(ar->htc_target, &ar->credit_state_info);
1547
1548         /* start HTC */
1549         ret = ath6kl_htc_start(ar->htc_target);
1550         if (ret) {
1551                 /* FIXME: call this */
1552                 ath6kl_cookie_cleanup(ar);
1553                 goto err_cleanup_scatter;
1554         }
1555
1556         /* Wait for Wmi event to be ready */
1557         timeleft = wait_event_interruptible_timeout(ar->event_wq,
1558                                                     test_bit(WMI_READY,
1559                                                              &ar->flag),
1560                                                     WMI_TIMEOUT);
1561
1562         ath6kl_dbg(ATH6KL_DBG_BOOT, "firmware booted\n");
1563
1564
1565         if (test_and_clear_bit(FIRST_BOOT, &ar->flag)) {
1566                 ath6kl_info("%s %s fw %s api %d%s\n",
1567                             ar->hw.name,
1568                             ath6kl_init_get_hif_name(ar->hif_type),
1569                             ar->wiphy->fw_version,
1570                             ar->fw_api,
1571                             test_bit(TESTMODE, &ar->flag) ? " testmode" : "");
1572         }
1573
1574         if (ar->version.abi_ver != ATH6KL_ABI_VERSION) {
1575                 ath6kl_err("abi version mismatch: host(0x%x), target(0x%x)\n",
1576                            ATH6KL_ABI_VERSION, ar->version.abi_ver);
1577                 ret = -EIO;
1578                 goto err_htc_stop;
1579         }
1580
1581         if (!timeleft || signal_pending(current)) {
1582                 ath6kl_err("wmi is not ready or wait was interrupted\n");
1583                 ret = -EIO;
1584                 goto err_htc_stop;
1585         }
1586
1587         ath6kl_dbg(ATH6KL_DBG_TRC, "%s: wmi is ready\n", __func__);
1588
1589         /* communicate the wmi protocol verision to the target */
1590         /* FIXME: return error */
1591         if ((ath6kl_set_host_app_area(ar)) != 0)
1592                 ath6kl_err("unable to set the host app area\n");
1593
1594         for (i = 0; i < ar->vif_max; i++) {
1595                 ret = ath6kl_target_config_wlan_params(ar, i);
1596                 if (ret)
1597                         goto err_htc_stop;
1598         }
1599
1600         ar->state = ATH6KL_STATE_ON;
1601
1602         return 0;
1603
1604 err_htc_stop:
1605         ath6kl_htc_stop(ar->htc_target);
1606 err_cleanup_scatter:
1607         ath6kl_hif_cleanup_scatter(ar);
1608 err_power_off:
1609         ath6kl_hif_power_off(ar);
1610
1611         return ret;
1612 }
1613
1614 int ath6kl_init_hw_stop(struct ath6kl *ar)
1615 {
1616         int ret;
1617
1618         ath6kl_dbg(ATH6KL_DBG_BOOT, "hw stop\n");
1619
1620         ath6kl_htc_stop(ar->htc_target);
1621
1622         ath6kl_hif_stop(ar);
1623
1624         ath6kl_bmi_reset(ar);
1625
1626         ret = ath6kl_hif_power_off(ar);
1627         if (ret)
1628                 ath6kl_warn("failed to power off hif: %d\n", ret);
1629
1630         ar->state = ATH6KL_STATE_OFF;
1631
1632         return 0;
1633 }
1634
1635 /* FIXME: move this to cfg80211.c and rename to ath6kl_cfg80211_vif_stop() */
1636 void ath6kl_cleanup_vif(struct ath6kl_vif *vif, bool wmi_ready)
1637 {
1638         static u8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
1639         bool discon_issued;
1640
1641         netif_stop_queue(vif->ndev);
1642
1643         clear_bit(WLAN_ENABLED, &vif->flags);
1644
1645         if (wmi_ready) {
1646                 discon_issued = test_bit(CONNECTED, &vif->flags) ||
1647                                 test_bit(CONNECT_PEND, &vif->flags);
1648                 ath6kl_disconnect(vif);
1649                 del_timer(&vif->disconnect_timer);
1650
1651                 if (discon_issued)
1652                         ath6kl_disconnect_event(vif, DISCONNECT_CMD,
1653                                                 (vif->nw_type & AP_NETWORK) ?
1654                                                 bcast_mac : vif->bssid,
1655                                                 0, NULL, 0);
1656         }
1657
1658         if (vif->scan_req) {
1659                 cfg80211_scan_done(vif->scan_req, true);
1660                 vif->scan_req = NULL;
1661         }
1662 }
1663
1664 void ath6kl_stop_txrx(struct ath6kl *ar)
1665 {
1666         struct ath6kl_vif *vif, *tmp_vif;
1667         int i;
1668
1669         set_bit(DESTROY_IN_PROGRESS, &ar->flag);
1670
1671         if (down_interruptible(&ar->sem)) {
1672                 ath6kl_err("down_interruptible failed\n");
1673                 return;
1674         }
1675
1676         for (i = 0; i < AP_MAX_NUM_STA; i++)
1677                 aggr_reset_state(ar->sta_list[i].aggr_conn);
1678
1679         spin_lock_bh(&ar->list_lock);
1680         list_for_each_entry_safe(vif, tmp_vif, &ar->vif_list, list) {
1681                 list_del(&vif->list);
1682                 spin_unlock_bh(&ar->list_lock);
1683                 ath6kl_cleanup_vif(vif, test_bit(WMI_READY, &ar->flag));
1684                 rtnl_lock();
1685                 ath6kl_cfg80211_vif_cleanup(vif);
1686                 rtnl_unlock();
1687                 spin_lock_bh(&ar->list_lock);
1688         }
1689         spin_unlock_bh(&ar->list_lock);
1690
1691         clear_bit(WMI_READY, &ar->flag);
1692
1693         /*
1694          * After wmi_shudown all WMI events will be dropped. We
1695          * need to cleanup the buffers allocated in AP mode and
1696          * give disconnect notification to stack, which usually
1697          * happens in the disconnect_event. Simulate the disconnect
1698          * event by calling the function directly. Sometimes
1699          * disconnect_event will be received when the debug logs
1700          * are collected.
1701          */
1702         ath6kl_wmi_shutdown(ar->wmi);
1703
1704         clear_bit(WMI_ENABLED, &ar->flag);
1705         if (ar->htc_target) {
1706                 ath6kl_dbg(ATH6KL_DBG_TRC, "%s: shut down htc\n", __func__);
1707                 ath6kl_htc_stop(ar->htc_target);
1708         }
1709
1710         /*
1711          * Try to reset the device if we can. The driver may have been
1712          * configure NOT to reset the target during a debug session.
1713          */
1714         ath6kl_dbg(ATH6KL_DBG_TRC,
1715                    "attempting to reset target on instance destroy\n");
1716         ath6kl_reset_device(ar, ar->target_type, true, true);
1717
1718         clear_bit(WLAN_ENABLED, &ar->flag);
1719
1720         up(&ar->sem);
1721 }
1722 EXPORT_SYMBOL(ath6kl_stop_txrx);