wl12xx: Check buffer bound when processing nvs data
[pandora-kernel.git] / drivers / net / wireless / wl12xx / boot.c
1 /*
2  * This file is part of wl1271
3  *
4  * Copyright (C) 2008-2010 Nokia Corporation
5  *
6  * Contact: Luciano Coelho <luciano.coelho@nokia.com>
7  *
8  * This program is free software; you can redistribute it and/or
9  * modify it under the terms of the GNU General Public License
10  * version 2 as published by the Free Software Foundation.
11  *
12  * This program is distributed in the hope that it will be useful, but
13  * WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program; if not, write to the Free Software
19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
20  * 02110-1301 USA
21  *
22  */
23
24 #include <linux/slab.h>
25 #include <linux/wl12xx.h>
26 #include <linux/export.h>
27
28 #include "acx.h"
29 #include "reg.h"
30 #include "boot.h"
31 #include "io.h"
32 #include "event.h"
33 #include "rx.h"
34
35 static struct wl1271_partition_set part_table[PART_TABLE_LEN] = {
36         [PART_DOWN] = {
37                 .mem = {
38                         .start = 0x00000000,
39                         .size  = 0x000177c0
40                 },
41                 .reg = {
42                         .start = REGISTERS_BASE,
43                         .size  = 0x00008800
44                 },
45                 .mem2 = {
46                         .start = 0x00000000,
47                         .size  = 0x00000000
48                 },
49                 .mem3 = {
50                         .start = 0x00000000,
51                         .size  = 0x00000000
52                 },
53         },
54
55         [PART_WORK] = {
56                 .mem = {
57                         .start = 0x00040000,
58                         .size  = 0x00014fc0
59                 },
60                 .reg = {
61                         .start = REGISTERS_BASE,
62                         .size  = 0x0000a000
63                 },
64                 .mem2 = {
65                         .start = 0x003004f8,
66                         .size  = 0x00000004
67                 },
68                 .mem3 = {
69                         .start = 0x00040404,
70                         .size  = 0x00000000
71                 },
72         },
73
74         [PART_DRPW] = {
75                 .mem = {
76                         .start = 0x00040000,
77                         .size  = 0x00014fc0
78                 },
79                 .reg = {
80                         .start = DRPW_BASE,
81                         .size  = 0x00006000
82                 },
83                 .mem2 = {
84                         .start = 0x00000000,
85                         .size  = 0x00000000
86                 },
87                 .mem3 = {
88                         .start = 0x00000000,
89                         .size  = 0x00000000
90                 }
91         }
92 };
93
94 static void wl1271_boot_set_ecpu_ctrl(struct wl1271 *wl, u32 flag)
95 {
96         u32 cpu_ctrl;
97
98         /* 10.5.0 run the firmware (I) */
99         cpu_ctrl = wl1271_read32(wl, ACX_REG_ECPU_CONTROL);
100
101         /* 10.5.1 run the firmware (II) */
102         cpu_ctrl |= flag;
103         wl1271_write32(wl, ACX_REG_ECPU_CONTROL, cpu_ctrl);
104 }
105
106 static unsigned int wl12xx_get_fw_ver_quirks(struct wl1271 *wl)
107 {
108         unsigned int quirks = 0;
109         unsigned int *fw_ver = wl->chip.fw_ver;
110
111         /* Only new station firmwares support routing fw logs to the host */
112         if ((fw_ver[FW_VER_IF_TYPE] == FW_VER_IF_TYPE_STA) &&
113             (fw_ver[FW_VER_MINOR] < FW_VER_MINOR_FWLOG_STA_MIN))
114                 quirks |= WL12XX_QUIRK_FWLOG_NOT_IMPLEMENTED;
115
116         /* This feature is not yet supported for AP mode */
117         if (fw_ver[FW_VER_IF_TYPE] == FW_VER_IF_TYPE_AP)
118                 quirks |= WL12XX_QUIRK_FWLOG_NOT_IMPLEMENTED;
119
120         return quirks;
121 }
122
123 static void wl1271_parse_fw_ver(struct wl1271 *wl)
124 {
125         int ret;
126
127         ret = sscanf(wl->chip.fw_ver_str + 4, "%u.%u.%u.%u.%u",
128                      &wl->chip.fw_ver[0], &wl->chip.fw_ver[1],
129                      &wl->chip.fw_ver[2], &wl->chip.fw_ver[3],
130                      &wl->chip.fw_ver[4]);
131
132         if (ret != 5) {
133                 wl1271_warning("fw version incorrect value");
134                 memset(wl->chip.fw_ver, 0, sizeof(wl->chip.fw_ver));
135                 return;
136         }
137
138         /* Check if any quirks are needed with older fw versions */
139         wl->quirks |= wl12xx_get_fw_ver_quirks(wl);
140 }
141
142 static void wl1271_boot_fw_version(struct wl1271 *wl)
143 {
144         struct wl1271_static_data static_data;
145
146         wl1271_read(wl, wl->cmd_box_addr, &static_data, sizeof(static_data),
147                     false);
148
149         strncpy(wl->chip.fw_ver_str, static_data.fw_version,
150                 sizeof(wl->chip.fw_ver_str));
151
152         /* make sure the string is NULL-terminated */
153         wl->chip.fw_ver_str[sizeof(wl->chip.fw_ver_str) - 1] = '\0';
154
155         wl1271_parse_fw_ver(wl);
156 }
157
158 static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
159                                              size_t fw_data_len, u32 dest)
160 {
161         struct wl1271_partition_set partition;
162         int addr, chunk_num, partition_limit;
163         u8 *p, *chunk;
164
165         /* whal_FwCtrl_LoadFwImageSm() */
166
167         wl1271_debug(DEBUG_BOOT, "starting firmware upload");
168
169         wl1271_debug(DEBUG_BOOT, "fw_data_len %zd chunk_size %d",
170                      fw_data_len, CHUNK_SIZE);
171
172         if ((fw_data_len % 4) != 0) {
173                 wl1271_error("firmware length not multiple of four");
174                 return -EIO;
175         }
176
177         chunk = kmalloc(CHUNK_SIZE, GFP_KERNEL);
178         if (!chunk) {
179                 wl1271_error("allocation for firmware upload chunk failed");
180                 return -ENOMEM;
181         }
182
183         memcpy(&partition, &part_table[PART_DOWN], sizeof(partition));
184         partition.mem.start = dest;
185         wl1271_set_partition(wl, &partition);
186
187         /* 10.1 set partition limit and chunk num */
188         chunk_num = 0;
189         partition_limit = part_table[PART_DOWN].mem.size;
190
191         while (chunk_num < fw_data_len / CHUNK_SIZE) {
192                 /* 10.2 update partition, if needed */
193                 addr = dest + (chunk_num + 2) * CHUNK_SIZE;
194                 if (addr > partition_limit) {
195                         addr = dest + chunk_num * CHUNK_SIZE;
196                         partition_limit = chunk_num * CHUNK_SIZE +
197                                 part_table[PART_DOWN].mem.size;
198                         partition.mem.start = addr;
199                         wl1271_set_partition(wl, &partition);
200                 }
201
202                 /* 10.3 upload the chunk */
203                 addr = dest + chunk_num * CHUNK_SIZE;
204                 p = buf + chunk_num * CHUNK_SIZE;
205                 memcpy(chunk, p, CHUNK_SIZE);
206                 wl1271_debug(DEBUG_BOOT, "uploading fw chunk 0x%p to 0x%x",
207                              p, addr);
208                 wl1271_write(wl, addr, chunk, CHUNK_SIZE, false);
209
210                 chunk_num++;
211         }
212
213         /* 10.4 upload the last chunk */
214         addr = dest + chunk_num * CHUNK_SIZE;
215         p = buf + chunk_num * CHUNK_SIZE;
216         memcpy(chunk, p, fw_data_len % CHUNK_SIZE);
217         wl1271_debug(DEBUG_BOOT, "uploading fw last chunk (%zd B) 0x%p to 0x%x",
218                      fw_data_len % CHUNK_SIZE, p, addr);
219         wl1271_write(wl, addr, chunk, fw_data_len % CHUNK_SIZE, false);
220
221         kfree(chunk);
222         return 0;
223 }
224
225 static int wl1271_boot_upload_firmware(struct wl1271 *wl)
226 {
227         u32 chunks, addr, len;
228         int ret = 0;
229         u8 *fw;
230
231         fw = wl->fw;
232         chunks = be32_to_cpup((__be32 *) fw);
233         fw += sizeof(u32);
234
235         wl1271_debug(DEBUG_BOOT, "firmware chunks to be uploaded: %u", chunks);
236
237         while (chunks--) {
238                 addr = be32_to_cpup((__be32 *) fw);
239                 fw += sizeof(u32);
240                 len = be32_to_cpup((__be32 *) fw);
241                 fw += sizeof(u32);
242
243                 if (len > 300000) {
244                         wl1271_info("firmware chunk too long: %u", len);
245                         return -EINVAL;
246                 }
247                 wl1271_debug(DEBUG_BOOT, "chunk %d addr 0x%x len %u",
248                              chunks, addr, len);
249                 ret = wl1271_boot_upload_firmware_chunk(wl, fw, len, addr);
250                 if (ret != 0)
251                         break;
252                 fw += len;
253         }
254
255         return ret;
256 }
257
258 static int wl1271_boot_upload_nvs(struct wl1271 *wl)
259 {
260         size_t nvs_len, burst_len;
261         int i;
262         u32 dest_addr, val;
263         u8 *nvs_ptr, *nvs_aligned;
264
265         if (wl->nvs == NULL)
266                 return -ENODEV;
267
268         if (wl->chip.id == CHIP_ID_1283_PG20) {
269                 struct wl128x_nvs_file *nvs = (struct wl128x_nvs_file *)wl->nvs;
270
271                 if (wl->nvs_len == sizeof(struct wl128x_nvs_file)) {
272                         if (nvs->general_params.dual_mode_select)
273                                 wl->enable_11a = true;
274                 } else {
275                         wl1271_error("nvs size is not as expected: %zu != %zu",
276                                      wl->nvs_len,
277                                      sizeof(struct wl128x_nvs_file));
278                         kfree(wl->nvs);
279                         wl->nvs = NULL;
280                         wl->nvs_len = 0;
281                         return -EILSEQ;
282                 }
283
284                 /* only the first part of the NVS needs to be uploaded */
285                 nvs_len = sizeof(nvs->nvs);
286                 nvs_ptr = (u8 *)nvs->nvs;
287
288         } else {
289                 struct wl1271_nvs_file *nvs =
290                         (struct wl1271_nvs_file *)wl->nvs;
291                 /*
292                  * FIXME: the LEGACY NVS image support (NVS's missing the 5GHz
293                  * band configurations) can be removed when those NVS files stop
294                  * floating around.
295                  */
296                 if (wl->nvs_len == sizeof(struct wl1271_nvs_file) ||
297                     wl->nvs_len == WL1271_INI_LEGACY_NVS_FILE_SIZE) {
298                         if (nvs->general_params.dual_mode_select)
299                                 wl->enable_11a = true;
300                 }
301
302                 if (wl->nvs_len != sizeof(struct wl1271_nvs_file) &&
303                     (wl->nvs_len != WL1271_INI_LEGACY_NVS_FILE_SIZE ||
304                      wl->enable_11a)) {
305                         wl1271_error("nvs size is not as expected: %zu != %zu",
306                                 wl->nvs_len, sizeof(struct wl1271_nvs_file));
307                         kfree(wl->nvs);
308                         wl->nvs = NULL;
309                         wl->nvs_len = 0;
310                         return -EILSEQ;
311                 }
312
313                 /* only the first part of the NVS needs to be uploaded */
314                 nvs_len = sizeof(nvs->nvs);
315                 nvs_ptr = (u8 *) nvs->nvs;
316         }
317
318         /* update current MAC address to NVS */
319         nvs_ptr[11] = wl->mac_addr[0];
320         nvs_ptr[10] = wl->mac_addr[1];
321         nvs_ptr[6] = wl->mac_addr[2];
322         nvs_ptr[5] = wl->mac_addr[3];
323         nvs_ptr[4] = wl->mac_addr[4];
324         nvs_ptr[3] = wl->mac_addr[5];
325
326         /*
327          * Layout before the actual NVS tables:
328          * 1 byte : burst length.
329          * 2 bytes: destination address.
330          * n bytes: data to burst copy.
331          *
332          * This is ended by a 0 length, then the NVS tables.
333          */
334
335         /* FIXME: Do we need to check here whether the LSB is 1? */
336         while (nvs_ptr[0]) {
337                 burst_len = nvs_ptr[0];
338                 dest_addr = (nvs_ptr[1] & 0xfe) | ((u32)(nvs_ptr[2] << 8));
339
340                 /*
341                  * Due to our new wl1271_translate_reg_addr function,
342                  * we need to add the REGISTER_BASE to the destination
343                  */
344                 dest_addr += REGISTERS_BASE;
345
346                 /* We move our pointer to the data */
347                 nvs_ptr += 3;
348
349                 for (i = 0; i < burst_len; i++) {
350                         if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
351                                 goto out_badnvs;
352
353                         val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
354                                | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
355
356                         wl1271_debug(DEBUG_BOOT,
357                                      "nvs burst write 0x%x: 0x%x",
358                                      dest_addr, val);
359                         wl1271_write32(wl, dest_addr, val);
360
361                         nvs_ptr += 4;
362                         dest_addr += 4;
363                 }
364
365                 if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
366                         goto out_badnvs;
367         }
368
369         /*
370          * We've reached the first zero length, the first NVS table
371          * is located at an aligned offset which is at least 7 bytes further.
372          * NOTE: The wl->nvs->nvs element must be first, in order to
373          * simplify the casting, we assume it is at the beginning of
374          * the wl->nvs structure.
375          */
376         nvs_ptr = (u8 *)wl->nvs +
377                         ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
378
379         if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
380                 goto out_badnvs;
381
382         nvs_len -= nvs_ptr - (u8 *)wl->nvs;
383
384         /* Now we must set the partition correctly */
385         wl1271_set_partition(wl, &part_table[PART_WORK]);
386
387         /* Copy the NVS tables to a new block to ensure alignment */
388         nvs_aligned = kmemdup(nvs_ptr, nvs_len, GFP_KERNEL);
389         if (!nvs_aligned)
390                 return -ENOMEM;
391
392         /* And finally we upload the NVS tables */
393         wl1271_write(wl, CMD_MBOX_ADDRESS, nvs_aligned, nvs_len, false);
394
395         kfree(nvs_aligned);
396         return 0;
397
398 out_badnvs:
399         wl1271_error("nvs data is malformed");
400         return -EILSEQ;
401 }
402
403 static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
404 {
405         wl1271_enable_interrupts(wl);
406         wl1271_write32(wl, ACX_REG_INTERRUPT_MASK,
407                        WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
408         wl1271_write32(wl, HI_CFG, HI_CFG_DEF_VAL);
409 }
410
411 static int wl1271_boot_soft_reset(struct wl1271 *wl)
412 {
413         unsigned long timeout;
414         u32 boot_data;
415
416         /* perform soft reset */
417         wl1271_write32(wl, ACX_REG_SLV_SOFT_RESET, ACX_SLV_SOFT_RESET_BIT);
418
419         /* SOFT_RESET is self clearing */
420         timeout = jiffies + usecs_to_jiffies(SOFT_RESET_MAX_TIME);
421         while (1) {
422                 boot_data = wl1271_read32(wl, ACX_REG_SLV_SOFT_RESET);
423                 wl1271_debug(DEBUG_BOOT, "soft reset bootdata 0x%x", boot_data);
424                 if ((boot_data & ACX_SLV_SOFT_RESET_BIT) == 0)
425                         break;
426
427                 if (time_after(jiffies, timeout)) {
428                         /* 1.2 check pWhalBus->uSelfClearTime if the
429                          * timeout was reached */
430                         wl1271_error("soft reset timeout");
431                         return -1;
432                 }
433
434                 udelay(SOFT_RESET_STALL_TIME);
435         }
436
437         /* disable Rx/Tx */
438         wl1271_write32(wl, ENABLE, 0x0);
439
440         /* disable auto calibration on start*/
441         wl1271_write32(wl, SPARE_A2, 0xffff);
442
443         return 0;
444 }
445
446 static int wl1271_boot_run_firmware(struct wl1271 *wl)
447 {
448         int loop, ret;
449         u32 chip_id, intr;
450
451         wl1271_boot_set_ecpu_ctrl(wl, ECPU_CONTROL_HALT);
452
453         chip_id = wl1271_read32(wl, CHIP_ID_B);
454
455         wl1271_debug(DEBUG_BOOT, "chip id after firmware boot: 0x%x", chip_id);
456
457         if (chip_id != wl->chip.id) {
458                 wl1271_error("chip id doesn't match after firmware boot");
459                 return -EIO;
460         }
461
462         /* wait for init to complete */
463         loop = 0;
464         while (loop++ < INIT_LOOP) {
465                 udelay(INIT_LOOP_DELAY);
466                 intr = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
467
468                 if (intr == 0xffffffff) {
469                         wl1271_error("error reading hardware complete "
470                                      "init indication");
471                         return -EIO;
472                 }
473                 /* check that ACX_INTR_INIT_COMPLETE is enabled */
474                 else if (intr & WL1271_ACX_INTR_INIT_COMPLETE) {
475                         wl1271_write32(wl, ACX_REG_INTERRUPT_ACK,
476                                        WL1271_ACX_INTR_INIT_COMPLETE);
477                         break;
478                 }
479         }
480
481         if (loop > INIT_LOOP) {
482                 wl1271_error("timeout waiting for the hardware to "
483                              "complete initialization");
484                 return -EIO;
485         }
486
487         /* get hardware config command mail box */
488         wl->cmd_box_addr = wl1271_read32(wl, REG_COMMAND_MAILBOX_PTR);
489
490         /* get hardware config event mail box */
491         wl->event_box_addr = wl1271_read32(wl, REG_EVENT_MAILBOX_PTR);
492
493         /* set the working partition to its "running" mode offset */
494         wl1271_set_partition(wl, &part_table[PART_WORK]);
495
496         wl1271_debug(DEBUG_MAILBOX, "cmd_box_addr 0x%x event_box_addr 0x%x",
497                      wl->cmd_box_addr, wl->event_box_addr);
498
499         wl1271_boot_fw_version(wl);
500
501         /*
502          * in case of full asynchronous mode the firmware event must be
503          * ready to receive event from the command mailbox
504          */
505
506         /* unmask required mbox events  */
507         wl->event_mask = BSS_LOSE_EVENT_ID |
508                 SCAN_COMPLETE_EVENT_ID |
509                 PS_REPORT_EVENT_ID |
510                 DISCONNECT_EVENT_COMPLETE_ID |
511                 RSSI_SNR_TRIGGER_0_EVENT_ID |
512                 PSPOLL_DELIVERY_FAILURE_EVENT_ID |
513                 SOFT_GEMINI_SENSE_EVENT_ID |
514                 PERIODIC_SCAN_REPORT_EVENT_ID |
515                 PERIODIC_SCAN_COMPLETE_EVENT_ID |
516                 DUMMY_PACKET_EVENT_ID |
517                 PEER_REMOVE_COMPLETE_EVENT_ID |
518                 BA_SESSION_RX_CONSTRAINT_EVENT_ID |
519                 REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID |
520                 INACTIVE_STA_EVENT_ID |
521                 MAX_TX_RETRY_EVENT_ID |
522                 CHANNEL_SWITCH_COMPLETE_EVENT_ID;
523
524         ret = wl1271_event_unmask(wl);
525         if (ret < 0) {
526                 wl1271_error("EVENT mask setting failed");
527                 return ret;
528         }
529
530         wl1271_event_mbox_config(wl);
531
532         /* firmware startup completed */
533         return 0;
534 }
535
536 static int wl1271_boot_write_irq_polarity(struct wl1271 *wl)
537 {
538         u32 polarity;
539
540         polarity = wl1271_top_reg_read(wl, OCP_REG_POLARITY);
541
542         /* We use HIGH polarity, so unset the LOW bit */
543         polarity &= ~POLARITY_LOW;
544         wl1271_top_reg_write(wl, OCP_REG_POLARITY, polarity);
545
546         return 0;
547 }
548
549 static void wl1271_boot_hw_version(struct wl1271 *wl)
550 {
551         u32 fuse;
552
553         if (wl->chip.id == CHIP_ID_1283_PG20)
554                 fuse = wl1271_top_reg_read(wl, WL128X_REG_FUSE_DATA_2_1);
555         else
556                 fuse = wl1271_top_reg_read(wl, WL127X_REG_FUSE_DATA_2_1);
557         fuse = (fuse & PG_VER_MASK) >> PG_VER_OFFSET;
558
559         wl->hw_pg_ver = (s8)fuse;
560 }
561
562 static int wl128x_switch_tcxo_to_fref(struct wl1271 *wl)
563 {
564         u16 spare_reg;
565
566         /* Mask bits [2] & [8:4] in the sys_clk_cfg register */
567         spare_reg = wl1271_top_reg_read(wl, WL_SPARE_REG);
568         if (spare_reg == 0xFFFF)
569                 return -EFAULT;
570         spare_reg |= (BIT(3) | BIT(5) | BIT(6));
571         wl1271_top_reg_write(wl, WL_SPARE_REG, spare_reg);
572
573         /* Enable FREF_CLK_REQ & mux MCS and coex PLLs to FREF */
574         wl1271_top_reg_write(wl, SYS_CLK_CFG_REG,
575                              WL_CLK_REQ_TYPE_PG2 | MCS_PLL_CLK_SEL_FREF);
576
577         /* Delay execution for 15msec, to let the HW settle */
578         mdelay(15);
579
580         return 0;
581 }
582
583 static bool wl128x_is_tcxo_valid(struct wl1271 *wl)
584 {
585         u16 tcxo_detection;
586
587         tcxo_detection = wl1271_top_reg_read(wl, TCXO_CLK_DETECT_REG);
588         if (tcxo_detection & TCXO_DET_FAILED)
589                 return false;
590
591         return true;
592 }
593
594 static bool wl128x_is_fref_valid(struct wl1271 *wl)
595 {
596         u16 fref_detection;
597
598         fref_detection = wl1271_top_reg_read(wl, FREF_CLK_DETECT_REG);
599         if (fref_detection & FREF_CLK_DETECT_FAIL)
600                 return false;
601
602         return true;
603 }
604
605 static int wl128x_manually_configure_mcs_pll(struct wl1271 *wl)
606 {
607         wl1271_top_reg_write(wl, MCS_PLL_M_REG, MCS_PLL_M_REG_VAL);
608         wl1271_top_reg_write(wl, MCS_PLL_N_REG, MCS_PLL_N_REG_VAL);
609         wl1271_top_reg_write(wl, MCS_PLL_CONFIG_REG, MCS_PLL_CONFIG_REG_VAL);
610
611         return 0;
612 }
613
614 static int wl128x_configure_mcs_pll(struct wl1271 *wl, int clk)
615 {
616         u16 spare_reg;
617         u16 pll_config;
618         u8 input_freq;
619
620         /* Mask bits [3:1] in the sys_clk_cfg register */
621         spare_reg = wl1271_top_reg_read(wl, WL_SPARE_REG);
622         if (spare_reg == 0xFFFF)
623                 return -EFAULT;
624         spare_reg |= BIT(2);
625         wl1271_top_reg_write(wl, WL_SPARE_REG, spare_reg);
626
627         /* Handle special cases of the TCXO clock */
628         if (wl->tcxo_clock == WL12XX_TCXOCLOCK_16_8 ||
629             wl->tcxo_clock == WL12XX_TCXOCLOCK_33_6)
630                 return wl128x_manually_configure_mcs_pll(wl);
631
632         /* Set the input frequency according to the selected clock source */
633         input_freq = (clk & 1) + 1;
634
635         pll_config = wl1271_top_reg_read(wl, MCS_PLL_CONFIG_REG);
636         if (pll_config == 0xFFFF)
637                 return -EFAULT;
638         pll_config |= (input_freq << MCS_SEL_IN_FREQ_SHIFT);
639         pll_config |= MCS_PLL_ENABLE_HP;
640         wl1271_top_reg_write(wl, MCS_PLL_CONFIG_REG, pll_config);
641
642         return 0;
643 }
644
645 /*
646  * WL128x has two clocks input - TCXO and FREF.
647  * TCXO is the main clock of the device, while FREF is used to sync
648  * between the GPS and the cellular modem.
649  * In cases where TCXO is 32.736MHz or 16.368MHz, the FREF will be used
650  * as the WLAN/BT main clock.
651  */
652 static int wl128x_boot_clk(struct wl1271 *wl, int *selected_clock)
653 {
654         u16 sys_clk_cfg;
655
656         /* For XTAL-only modes, FREF will be used after switching from TCXO */
657         if (wl->ref_clock == WL12XX_REFCLOCK_26_XTAL ||
658             wl->ref_clock == WL12XX_REFCLOCK_38_XTAL) {
659                 if (!wl128x_switch_tcxo_to_fref(wl))
660                         return -EINVAL;
661                 goto fref_clk;
662         }
663
664         /* Query the HW, to determine which clock source we should use */
665         sys_clk_cfg = wl1271_top_reg_read(wl, SYS_CLK_CFG_REG);
666         if (sys_clk_cfg == 0xFFFF)
667                 return -EINVAL;
668         if (sys_clk_cfg & PRCM_CM_EN_MUX_WLAN_FREF)
669                 goto fref_clk;
670
671         /* If TCXO is either 32.736MHz or 16.368MHz, switch to FREF */
672         if (wl->tcxo_clock == WL12XX_TCXOCLOCK_16_368 ||
673             wl->tcxo_clock == WL12XX_TCXOCLOCK_32_736) {
674                 if (!wl128x_switch_tcxo_to_fref(wl))
675                         return -EINVAL;
676                 goto fref_clk;
677         }
678
679         /* TCXO clock is selected */
680         if (!wl128x_is_tcxo_valid(wl))
681                 return -EINVAL;
682         *selected_clock = wl->tcxo_clock;
683         goto config_mcs_pll;
684
685 fref_clk:
686         /* FREF clock is selected */
687         if (!wl128x_is_fref_valid(wl))
688                 return -EINVAL;
689         *selected_clock = wl->ref_clock;
690
691 config_mcs_pll:
692         return wl128x_configure_mcs_pll(wl, *selected_clock);
693 }
694
695 static int wl127x_boot_clk(struct wl1271 *wl)
696 {
697         u32 pause;
698         u32 clk;
699
700         if (((wl->hw_pg_ver & PG_MAJOR_VER_MASK) >> PG_MAJOR_VER_OFFSET) < 3)
701                 wl->quirks |= WL12XX_QUIRK_END_OF_TRANSACTION;
702
703         if (wl->ref_clock == CONF_REF_CLK_19_2_E ||
704             wl->ref_clock == CONF_REF_CLK_38_4_E ||
705             wl->ref_clock == CONF_REF_CLK_38_4_M_XTAL)
706                 /* ref clk: 19.2/38.4/38.4-XTAL */
707                 clk = 0x3;
708         else if (wl->ref_clock == CONF_REF_CLK_26_E ||
709                  wl->ref_clock == CONF_REF_CLK_52_E)
710                 /* ref clk: 26/52 */
711                 clk = 0x5;
712         else
713                 return -EINVAL;
714
715         if (wl->ref_clock != CONF_REF_CLK_19_2_E) {
716                 u16 val;
717                 /* Set clock type (open drain) */
718                 val = wl1271_top_reg_read(wl, OCP_REG_CLK_TYPE);
719                 val &= FREF_CLK_TYPE_BITS;
720                 wl1271_top_reg_write(wl, OCP_REG_CLK_TYPE, val);
721
722                 /* Set clock pull mode (no pull) */
723                 val = wl1271_top_reg_read(wl, OCP_REG_CLK_PULL);
724                 val |= NO_PULL;
725                 wl1271_top_reg_write(wl, OCP_REG_CLK_PULL, val);
726         } else {
727                 u16 val;
728                 /* Set clock polarity */
729                 val = wl1271_top_reg_read(wl, OCP_REG_CLK_POLARITY);
730                 val &= FREF_CLK_POLARITY_BITS;
731                 val |= CLK_REQ_OUTN_SEL;
732                 wl1271_top_reg_write(wl, OCP_REG_CLK_POLARITY, val);
733         }
734
735         wl1271_write32(wl, PLL_PARAMETERS, clk);
736
737         pause = wl1271_read32(wl, PLL_PARAMETERS);
738
739         wl1271_debug(DEBUG_BOOT, "pause1 0x%x", pause);
740
741         pause &= ~(WU_COUNTER_PAUSE_VAL);
742         pause |= WU_COUNTER_PAUSE_VAL;
743         wl1271_write32(wl, WU_COUNTER_PAUSE, pause);
744
745         return 0;
746 }
747
748 /* uploads NVS and firmware */
749 int wl1271_load_firmware(struct wl1271 *wl)
750 {
751         int ret = 0;
752         u32 tmp, clk;
753         int selected_clock = -1;
754
755         wl1271_boot_hw_version(wl);
756
757         if (wl->chip.id == CHIP_ID_1283_PG20) {
758                 ret = wl128x_boot_clk(wl, &selected_clock);
759                 if (ret < 0)
760                         goto out;
761         } else {
762                 ret = wl127x_boot_clk(wl);
763                 if (ret < 0)
764                         goto out;
765         }
766
767         /* Continue the ELP wake up sequence */
768         wl1271_write32(wl, WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL);
769         udelay(500);
770
771         wl1271_set_partition(wl, &part_table[PART_DRPW]);
772
773         /* Read-modify-write DRPW_SCRATCH_START register (see next state)
774            to be used by DRPw FW. The RTRIM value will be added by the FW
775            before taking DRPw out of reset */
776
777         wl1271_debug(DEBUG_BOOT, "DRPW_SCRATCH_START %08x", DRPW_SCRATCH_START);
778         clk = wl1271_read32(wl, DRPW_SCRATCH_START);
779
780         wl1271_debug(DEBUG_BOOT, "clk2 0x%x", clk);
781
782         if (wl->chip.id == CHIP_ID_1283_PG20) {
783                 clk |= ((selected_clock & 0x3) << 1) << 4;
784         } else {
785                 clk |= (wl->ref_clock << 1) << 4;
786         }
787
788         wl1271_write32(wl, DRPW_SCRATCH_START, clk);
789
790         wl1271_set_partition(wl, &part_table[PART_WORK]);
791
792         /* Disable interrupts */
793         wl1271_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
794
795         ret = wl1271_boot_soft_reset(wl);
796         if (ret < 0)
797                 goto out;
798
799         /* 2. start processing NVS file */
800         ret = wl1271_boot_upload_nvs(wl);
801         if (ret < 0)
802                 goto out;
803
804         /* write firmware's last address (ie. it's length) to
805          * ACX_EEPROMLESS_IND_REG */
806         wl1271_debug(DEBUG_BOOT, "ACX_EEPROMLESS_IND_REG");
807
808         wl1271_write32(wl, ACX_EEPROMLESS_IND_REG, ACX_EEPROMLESS_IND_REG);
809
810         tmp = wl1271_read32(wl, CHIP_ID_B);
811
812         wl1271_debug(DEBUG_BOOT, "chip id 0x%x", tmp);
813
814         /* 6. read the EEPROM parameters */
815         tmp = wl1271_read32(wl, SCR_PAD2);
816
817         /* WL1271: The reference driver skips steps 7 to 10 (jumps directly
818          * to upload_fw) */
819
820         if (wl->chip.id == CHIP_ID_1283_PG20)
821                 wl1271_top_reg_write(wl, SDIO_IO_DS, wl->conf.hci_io_ds);
822
823         ret = wl1271_boot_upload_firmware(wl);
824         if (ret < 0)
825                 goto out;
826
827 out:
828         return ret;
829 }
830 EXPORT_SYMBOL_GPL(wl1271_load_firmware);
831
832 int wl1271_boot(struct wl1271 *wl)
833 {
834         int ret;
835
836         /* upload NVS and firmware */
837         ret = wl1271_load_firmware(wl);
838         if (ret)
839                 return ret;
840
841         /* 10.5 start firmware */
842         ret = wl1271_boot_run_firmware(wl);
843         if (ret < 0)
844                 goto out;
845
846         ret = wl1271_boot_write_irq_polarity(wl);
847         if (ret < 0)
848                 goto out;
849
850         wl1271_write32(wl, ACX_REG_INTERRUPT_MASK,
851                        WL1271_ACX_ALL_EVENTS_VECTOR);
852
853         /* Enable firmware interrupts now */
854         wl1271_boot_enable_interrupts(wl);
855
856         wl1271_event_mbox_config(wl);
857
858 out:
859         return ret;
860 }