2 * Copyright (c) 2007-2011 Atheros Communications Inc.
3 * Copyright (c) 2011-2012 Qualcomm Atheros, Inc.
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 #include <linux/export.h>
26 #define MAILBOX_FOR_BLOCK_SIZE 1
28 #define ATH6KL_TIME_QUANTUM 10 /* in ms */
30 static int ath6kl_hif_cp_scat_dma_buf(struct hif_scatter_req *req,
36 buf = req->virt_dma_buf;
38 for (i = 0; i < req->scat_entries; i++) {
41 memcpy(req->scat_list[i].buf, buf,
42 req->scat_list[i].len);
44 memcpy(buf, req->scat_list[i].buf,
45 req->scat_list[i].len);
47 buf += req->scat_list[i].len;
53 int ath6kl_hif_rw_comp_handler(void *context, int status)
55 struct htc_packet *packet = context;
57 ath6kl_dbg(ATH6KL_DBG_HIF, "hif rw completion pkt 0x%p status %d\n",
60 packet->status = status;
61 packet->completion(packet->context, packet);
65 EXPORT_SYMBOL(ath6kl_hif_rw_comp_handler);
67 #define REG_DUMP_COUNT_AR6003 60
68 #define REGISTER_DUMP_LEN_MAX 60
70 static void ath6kl_hif_dump_fw_crash(struct ath6kl *ar)
72 __le32 regdump_val[REGISTER_DUMP_LEN_MAX];
73 u32 i, address, regdump_addr = 0;
76 if (ar->target_type != TARGET_TYPE_AR6003)
79 /* the reg dump pointer is copied to the host interest area */
80 address = ath6kl_get_hi_item_addr(ar, HI_ITEM(hi_failure_state));
81 address = TARG_VTOP(ar->target_type, address);
83 /* read RAM location through diagnostic window */
84 ret = ath6kl_diag_read32(ar, address, ®dump_addr);
86 if (ret || !regdump_addr) {
87 ath6kl_warn("failed to get ptr to register dump area: %d\n",
92 ath6kl_dbg(ATH6KL_DBG_IRQ, "register dump data address 0x%x\n",
94 regdump_addr = TARG_VTOP(ar->target_type, regdump_addr);
96 /* fetch register dump data */
97 ret = ath6kl_diag_read(ar, regdump_addr, (u8 *)®dump_val[0],
98 REG_DUMP_COUNT_AR6003 * (sizeof(u32)));
100 ath6kl_warn("failed to get register dump: %d\n", ret);
104 ath6kl_info("crash dump:\n");
105 ath6kl_info("hw 0x%x fw %s\n", ar->wiphy->hw_version,
106 ar->wiphy->fw_version);
108 BUILD_BUG_ON(REG_DUMP_COUNT_AR6003 % 4);
110 for (i = 0; i < REG_DUMP_COUNT_AR6003; i += 4) {
111 ath6kl_info("%d: 0x%8.8x 0x%8.8x 0x%8.8x 0x%8.8x\n",
113 le32_to_cpu(regdump_val[i]),
114 le32_to_cpu(regdump_val[i + 1]),
115 le32_to_cpu(regdump_val[i + 2]),
116 le32_to_cpu(regdump_val[i + 3]));
121 static int ath6kl_hif_proc_dbg_intr(struct ath6kl_device *dev)
126 ath6kl_warn("firmware crashed\n");
129 * read counter to clear the interrupt, the debug error interrupt is
132 ret = hif_read_write_sync(dev->ar, COUNT_DEC_ADDRESS,
133 (u8 *)&dummy, 4, HIF_RD_SYNC_BYTE_INC);
135 ath6kl_warn("Failed to clear debug interrupt: %d\n", ret);
137 ath6kl_hif_dump_fw_crash(dev->ar);
138 ath6kl_read_fwlogs(dev->ar);
139 ath6kl_recovery_err_notify(dev->ar, ATH6KL_FW_ASSERT);
144 /* mailbox recv message polling */
145 int ath6kl_hif_poll_mboxmsg_rx(struct ath6kl_device *dev, u32 *lk_ahd,
148 struct ath6kl_irq_proc_registers *rg;
150 u8 htc_mbox = 1 << HTC_MAILBOX;
152 for (i = timeout / ATH6KL_TIME_QUANTUM; i > 0; i--) {
153 /* this is the standard HIF way, load the reg table */
154 status = hif_read_write_sync(dev->ar, HOST_INT_STATUS_ADDRESS,
155 (u8 *) &dev->irq_proc_reg,
156 sizeof(dev->irq_proc_reg),
157 HIF_RD_SYNC_BYTE_INC);
160 ath6kl_err("failed to read reg table\n");
164 /* check for MBOX data and valid lookahead */
165 if (dev->irq_proc_reg.host_int_status & htc_mbox) {
166 if (dev->irq_proc_reg.rx_lkahd_valid &
169 * Mailbox has a message and the look ahead
172 rg = &dev->irq_proc_reg;
174 le32_to_cpu(rg->rx_lkahd[HTC_MAILBOX]);
180 mdelay(ATH6KL_TIME_QUANTUM);
181 ath6kl_dbg(ATH6KL_DBG_HIF, "hif retry mbox poll try %d\n", i);
185 ath6kl_err("timeout waiting for recv message\n");
187 /* check if the target asserted */
188 if (dev->irq_proc_reg.counter_int_status &
189 ATH6KL_TARGET_DEBUG_INTR_MASK)
191 * Target failure handler will be called in case of
194 ath6kl_hif_proc_dbg_intr(dev);
201 * Disable packet reception (used in case the host runs out of buffers)
202 * using the interrupt enable registers through the host I/F
204 int ath6kl_hif_rx_control(struct ath6kl_device *dev, bool enable_rx)
206 struct ath6kl_irq_enable_reg regs;
209 ath6kl_dbg(ATH6KL_DBG_HIF, "hif rx %s\n",
210 enable_rx ? "enable" : "disable");
212 /* take the lock to protect interrupt enable shadows */
213 spin_lock_bh(&dev->lock);
216 dev->irq_en_reg.int_status_en |=
217 SM(INT_STATUS_ENABLE_MBOX_DATA, 0x01);
219 dev->irq_en_reg.int_status_en &=
220 ~SM(INT_STATUS_ENABLE_MBOX_DATA, 0x01);
222 memcpy(®s, &dev->irq_en_reg, sizeof(regs));
224 spin_unlock_bh(&dev->lock);
226 status = hif_read_write_sync(dev->ar, INT_STATUS_ENABLE_ADDRESS,
228 sizeof(struct ath6kl_irq_enable_reg),
229 HIF_WR_SYNC_BYTE_INC);
234 int ath6kl_hif_submit_scat_req(struct ath6kl_device *dev,
235 struct hif_scatter_req *scat_req, bool read)
240 scat_req->req = HIF_RD_SYNC_BLOCK_FIX;
241 scat_req->addr = dev->ar->mbox_info.htc_addr;
243 scat_req->req = HIF_WR_ASYNC_BLOCK_INC;
246 (scat_req->len > HIF_MBOX_WIDTH) ?
247 dev->ar->mbox_info.htc_ext_addr :
248 dev->ar->mbox_info.htc_addr;
251 ath6kl_dbg(ATH6KL_DBG_HIF,
252 "hif submit scatter request entries %d len %d mbox 0x%x %s %s\n",
253 scat_req->scat_entries, scat_req->len,
254 scat_req->addr, !read ? "async" : "sync",
255 (read) ? "rd" : "wr");
257 if (!read && scat_req->virt_scat) {
258 status = ath6kl_hif_cp_scat_dma_buf(scat_req, false);
260 scat_req->status = status;
261 scat_req->complete(dev->ar->htc_target, scat_req);
266 status = ath6kl_hif_scat_req_rw(dev->ar, scat_req);
269 /* in sync mode, we can touch the scatter request */
270 scat_req->status = status;
271 if (!status && scat_req->virt_scat)
273 ath6kl_hif_cp_scat_dma_buf(scat_req, true);
279 static int ath6kl_hif_proc_counter_intr(struct ath6kl_device *dev)
281 u8 counter_int_status;
283 ath6kl_dbg(ATH6KL_DBG_IRQ, "counter interrupt\n");
285 counter_int_status = dev->irq_proc_reg.counter_int_status &
286 dev->irq_en_reg.cntr_int_status_en;
288 ath6kl_dbg(ATH6KL_DBG_IRQ,
289 "valid interrupt source(s) in COUNTER_INT_STATUS: 0x%x\n",
293 * NOTE: other modules like GMBOX may use the counter interrupt for
294 * credit flow control on other counters, we only need to check for
295 * the debug assertion counter interrupt.
297 if (counter_int_status & ATH6KL_TARGET_DEBUG_INTR_MASK)
298 return ath6kl_hif_proc_dbg_intr(dev);
303 static int ath6kl_hif_proc_err_intr(struct ath6kl_device *dev)
309 ath6kl_dbg(ATH6KL_DBG_IRQ, "error interrupt\n");
311 error_int_status = dev->irq_proc_reg.error_int_status & 0x0F;
312 if (!error_int_status) {
317 ath6kl_dbg(ATH6KL_DBG_IRQ,
318 "valid interrupt source(s) in ERROR_INT_STATUS: 0x%x\n",
321 if (MS(ERROR_INT_STATUS_WAKEUP, error_int_status))
322 ath6kl_dbg(ATH6KL_DBG_IRQ, "error : wakeup\n");
324 if (MS(ERROR_INT_STATUS_RX_UNDERFLOW, error_int_status))
325 ath6kl_err("rx underflow\n");
327 if (MS(ERROR_INT_STATUS_TX_OVERFLOW, error_int_status))
328 ath6kl_err("tx overflow\n");
330 /* Clear the interrupt */
331 dev->irq_proc_reg.error_int_status &= ~error_int_status;
333 /* set W1C value to clear the interrupt, this hits the register first */
334 reg_buf[0] = error_int_status;
339 status = hif_read_write_sync(dev->ar, ERROR_INT_STATUS_ADDRESS,
340 reg_buf, 4, HIF_WR_SYNC_BYTE_FIX);
347 static int ath6kl_hif_proc_cpu_intr(struct ath6kl_device *dev)
353 ath6kl_dbg(ATH6KL_DBG_IRQ, "cpu interrupt\n");
355 cpu_int_status = dev->irq_proc_reg.cpu_int_status &
356 dev->irq_en_reg.cpu_int_status_en;
357 if (!cpu_int_status) {
362 ath6kl_dbg(ATH6KL_DBG_IRQ,
363 "valid interrupt source(s) in CPU_INT_STATUS: 0x%x\n",
366 /* Clear the interrupt */
367 dev->irq_proc_reg.cpu_int_status &= ~cpu_int_status;
370 * Set up the register transfer buffer to hit the register 4 times ,
371 * this is done to make the access 4-byte aligned to mitigate issues
372 * with host bus interconnects that restrict bus transfer lengths to
373 * be a multiple of 4-bytes.
376 /* set W1C value to clear the interrupt, this hits the register first */
377 reg_buf[0] = cpu_int_status;
378 /* the remaining are set to zero which have no-effect */
383 status = hif_read_write_sync(dev->ar, CPU_INT_STATUS_ADDRESS,
384 reg_buf, 4, HIF_WR_SYNC_BYTE_FIX);
391 /* process pending interrupts synchronously */
392 static int proc_pending_irqs(struct ath6kl_device *dev, bool *done)
394 struct ath6kl_irq_proc_registers *rg;
396 u8 host_int_status = 0;
398 u8 htc_mbox = 1 << HTC_MAILBOX;
400 ath6kl_dbg(ATH6KL_DBG_IRQ, "proc_pending_irqs: (dev: 0x%p)\n", dev);
403 * NOTE: HIF implementation guarantees that the context of this
404 * call allows us to perform SYNCHRONOUS I/O, that is we can block,
405 * sleep or call any API that can block or switch thread/task
406 * contexts. This is a fully schedulable context.
410 * Process pending intr only when int_status_en is clear, it may
411 * result in unnecessary bus transaction otherwise. Target may be
412 * unresponsive at the time.
414 if (dev->irq_en_reg.int_status_en) {
416 * Read the first 28 bytes of the HTC register table. This
417 * will yield us the value of different int status
418 * registers and the lookahead registers.
420 * length = sizeof(int_status) + sizeof(cpu_int_status)
421 * + sizeof(error_int_status) +
422 * sizeof(counter_int_status) +
423 * sizeof(mbox_frame) + sizeof(rx_lkahd_valid)
424 * + sizeof(hole) + sizeof(rx_lkahd) +
425 * sizeof(int_status_en) +
426 * sizeof(cpu_int_status_en) +
427 * sizeof(err_int_status_en) +
428 * sizeof(cntr_int_status_en);
430 status = hif_read_write_sync(dev->ar, HOST_INT_STATUS_ADDRESS,
431 (u8 *) &dev->irq_proc_reg,
432 sizeof(dev->irq_proc_reg),
433 HIF_RD_SYNC_BYTE_INC);
437 ath6kl_dump_registers(dev, &dev->irq_proc_reg,
440 /* Update only those registers that are enabled */
441 host_int_status = dev->irq_proc_reg.host_int_status &
442 dev->irq_en_reg.int_status_en;
444 /* Look at mbox status */
445 if (host_int_status & htc_mbox) {
447 * Mask out pending mbox value, we use "lookAhead as
448 * the real flag for mbox processing.
450 host_int_status &= ~htc_mbox;
451 if (dev->irq_proc_reg.rx_lkahd_valid &
453 rg = &dev->irq_proc_reg;
454 lk_ahd = le32_to_cpu(rg->rx_lkahd[HTC_MAILBOX]);
456 ath6kl_err("lookAhead is zero!\n");
461 if (!host_int_status && !lk_ahd) {
469 ath6kl_dbg(ATH6KL_DBG_IRQ,
470 "pending mailbox msg, lk_ahd: 0x%X\n", lk_ahd);
472 * Mailbox Interrupt, the HTC layer may issue async
473 * requests to empty the mailbox. When emptying the recv
474 * mailbox we use the async handler above called from the
475 * completion routine of the callers read request. This can
476 * improve performance by reducing context switching when
477 * we rapidly pull packets.
479 status = ath6kl_htc_rxmsg_pending_handler(dev->htc_cnxt,
486 * HTC could not pull any messages out due to lack
489 dev->htc_cnxt->chk_irq_status_cnt = 0;
492 /* now handle the rest of them */
493 ath6kl_dbg(ATH6KL_DBG_IRQ,
494 "valid interrupt source(s) for other interrupts: 0x%x\n",
497 if (MS(HOST_INT_STATUS_CPU, host_int_status)) {
499 status = ath6kl_hif_proc_cpu_intr(dev);
504 if (MS(HOST_INT_STATUS_ERROR, host_int_status)) {
505 /* Error Interrupt */
506 status = ath6kl_hif_proc_err_intr(dev);
511 if (MS(HOST_INT_STATUS_COUNTER, host_int_status))
512 /* Counter Interrupt */
513 status = ath6kl_hif_proc_counter_intr(dev);
517 * An optimization to bypass reading the IRQ status registers
518 * unecessarily which can re-wake the target, if upper layers
519 * determine that we are in a low-throughput mode, we can rely on
520 * taking another interrupt rather than re-checking the status
521 * registers which can re-wake the target.
523 * NOTE : for host interfaces that makes use of detecting pending
524 * mbox messages at hif can not use this optimization due to
525 * possible side effects, SPI requires the host to drain all
526 * messages from the mailbox before exiting the ISR routine.
529 ath6kl_dbg(ATH6KL_DBG_IRQ,
530 "bypassing irq status re-check, forcing done\n");
532 if (!dev->htc_cnxt->chk_irq_status_cnt)
535 ath6kl_dbg(ATH6KL_DBG_IRQ,
536 "proc_pending_irqs: (done:%d, status=%d\n", *done, status);
541 /* interrupt handler, kicks off all interrupt processing */
542 int ath6kl_hif_intr_bh_handler(struct ath6kl *ar)
544 struct ath6kl_device *dev = ar->htc_target->dev;
545 unsigned long timeout;
550 * Reset counter used to flag a re-scan of IRQ status registers on
553 dev->htc_cnxt->chk_irq_status_cnt = 0;
556 * IRQ processing is synchronous, interrupt status registers can be
559 timeout = jiffies + msecs_to_jiffies(ATH6KL_HIF_COMMUNICATION_TIMEOUT);
560 while (time_before(jiffies, timeout) && !done) {
561 status = proc_pending_irqs(dev, &done);
568 EXPORT_SYMBOL(ath6kl_hif_intr_bh_handler);
570 static int ath6kl_hif_enable_intrs(struct ath6kl_device *dev)
572 struct ath6kl_irq_enable_reg regs;
575 spin_lock_bh(&dev->lock);
577 /* Enable all but ATH6KL CPU interrupts */
578 dev->irq_en_reg.int_status_en =
579 SM(INT_STATUS_ENABLE_ERROR, 0x01) |
580 SM(INT_STATUS_ENABLE_CPU, 0x01) |
581 SM(INT_STATUS_ENABLE_COUNTER, 0x01);
584 * NOTE: There are some cases where HIF can do detection of
585 * pending mbox messages which is disabled now.
587 dev->irq_en_reg.int_status_en |= SM(INT_STATUS_ENABLE_MBOX_DATA, 0x01);
589 /* Set up the CPU Interrupt status Register */
590 dev->irq_en_reg.cpu_int_status_en = 0;
592 /* Set up the Error Interrupt status Register */
593 dev->irq_en_reg.err_int_status_en =
594 SM(ERROR_STATUS_ENABLE_RX_UNDERFLOW, 0x01) |
595 SM(ERROR_STATUS_ENABLE_TX_OVERFLOW, 0x1);
598 * Enable Counter interrupt status register to get fatal errors for
601 dev->irq_en_reg.cntr_int_status_en = SM(COUNTER_INT_STATUS_ENABLE_BIT,
602 ATH6KL_TARGET_DEBUG_INTR_MASK);
603 memcpy(®s, &dev->irq_en_reg, sizeof(regs));
605 spin_unlock_bh(&dev->lock);
607 status = hif_read_write_sync(dev->ar, INT_STATUS_ENABLE_ADDRESS,
608 ®s.int_status_en, sizeof(regs),
609 HIF_WR_SYNC_BYTE_INC);
612 ath6kl_err("failed to update interrupt ctl reg err: %d\n",
618 int ath6kl_hif_disable_intrs(struct ath6kl_device *dev)
620 struct ath6kl_irq_enable_reg regs;
622 spin_lock_bh(&dev->lock);
623 /* Disable all interrupts */
624 dev->irq_en_reg.int_status_en = 0;
625 dev->irq_en_reg.cpu_int_status_en = 0;
626 dev->irq_en_reg.err_int_status_en = 0;
627 dev->irq_en_reg.cntr_int_status_en = 0;
628 memcpy(®s, &dev->irq_en_reg, sizeof(regs));
629 spin_unlock_bh(&dev->lock);
631 return hif_read_write_sync(dev->ar, INT_STATUS_ENABLE_ADDRESS,
632 ®s.int_status_en, sizeof(regs),
633 HIF_WR_SYNC_BYTE_INC);
636 /* enable device interrupts */
637 int ath6kl_hif_unmask_intrs(struct ath6kl_device *dev)
642 * Make sure interrupt are disabled before unmasking at the HIF
643 * layer. The rationale here is that between device insertion
644 * (where we clear the interrupts the first time) and when HTC
645 * is finally ready to handle interrupts, other software can perform
646 * target "soft" resets. The ATH6KL interrupt enables reset back to an
647 * "enabled" state when this happens.
649 ath6kl_hif_disable_intrs(dev);
651 /* unmask the host controller interrupts */
652 ath6kl_hif_irq_enable(dev->ar);
653 status = ath6kl_hif_enable_intrs(dev);
658 /* disable all device interrupts */
659 int ath6kl_hif_mask_intrs(struct ath6kl_device *dev)
662 * Mask the interrupt at the HIF layer to avoid any stray interrupt
663 * taken while we zero out our shadow registers in
664 * ath6kl_hif_disable_intrs().
666 ath6kl_hif_irq_disable(dev->ar);
668 return ath6kl_hif_disable_intrs(dev);
671 int ath6kl_hif_setup(struct ath6kl_device *dev)
675 spin_lock_init(&dev->lock);
678 * NOTE: we actually get the block size of a mailbox other than 0,
679 * for SDIO the block size on mailbox 0 is artificially set to 1.
680 * So we use the block size that is set for the other 3 mailboxes.
682 dev->htc_cnxt->block_sz = dev->ar->mbox_info.block_size;
684 /* must be a power of 2 */
685 if ((dev->htc_cnxt->block_sz & (dev->htc_cnxt->block_sz - 1)) != 0) {
691 /* assemble mask, used for padding to a block */
692 dev->htc_cnxt->block_mask = dev->htc_cnxt->block_sz - 1;
694 ath6kl_dbg(ATH6KL_DBG_HIF, "hif block size %d mbox addr 0x%x\n",
695 dev->htc_cnxt->block_sz, dev->ar->mbox_info.htc_addr);
697 status = ath6kl_hif_disable_intrs(dev);