xref: /openbsd-src/sys/dev/pci/if_qwx_pci.c (revision 68dd5bb1859285b71cb62a10bf107b8ad54064d9)
1 /*	$OpenBSD: if_qwx_pci.c,v 1.4 2024/01/25 17:00:21 stsp Exp $	*/
2 
3 /*
4  * Copyright 2023 Stefan Sperling <stsp@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 /*
20  * Copyright (c) 2021-2022, Qualcomm Innovation Center, Inc.
21  * Copyright (c) 2018-2021 The Linux Foundation.
22  * All rights reserved.
23  *
24  * Redistribution and use in source and binary forms, with or without
25  * modification, are permitted (subject to the limitations in the disclaimer
26  * below) provided that the following conditions are met:
27  *
28  *  * Redistributions of source code must retain the above copyright notice,
29  *    this list of conditions and the following disclaimer.
30  *
31  *  * Redistributions in binary form must reproduce the above copyright
32  *    notice, this list of conditions and the following disclaimer in the
33  *    documentation and/or other materials provided with the distribution.
34  *
35  *  * Neither the name of [Owner Organization] nor the names of its
36  *    contributors may be used to endorse or promote products derived from
37  *    this software without specific prior written permission.
38  *
39  * NO EXPRESS OR IMPLIED LICENSES TO ANY PARTY'S PATENT RIGHTS ARE GRANTED BY
40  * THIS LICENSE. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
41  * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT
42  * NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
43  * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER
44  * OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
45  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
46  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
47  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
48  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
49  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
50  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
51  */
52 
53 #include <sys/param.h>
54 #include <sys/sockio.h>
55 #include <sys/mbuf.h>
56 #include <sys/kernel.h>
57 #include <sys/socket.h>
58 #include <sys/systm.h>
59 #include <sys/malloc.h>
60 #include <sys/conf.h>
61 #include <sys/device.h>
62 #include <sys/endian.h>
63 
64 #include <machine/bus.h>
65 #include <machine/intr.h>
66 
67 #include <net/if.h>
68 #include <net/if_media.h>
69 
70 #include <netinet/in.h>
71 #include <netinet/if_ether.h>
72 
73 #include <net80211/ieee80211_var.h>
74 #include <net80211/ieee80211_radiotap.h>
75 
76 #include <dev/pci/pcireg.h>
77 #include <dev/pci/pcivar.h>
78 #include <dev/pci/pcidevs.h>
79 
80 /* XXX linux porting goo */
81 #ifdef __LP64__
82 #define BITS_PER_LONG		64
83 #else
84 #define BITS_PER_LONG		32
85 #endif
86 #define GENMASK(h, l) (((~0UL) >> (BITS_PER_LONG - (h) - 1)) & ((~0UL) << (l)))
87 #define __bf_shf(x) (__builtin_ffsll(x) - 1)
88 #define FIELD_GET(_m, _v) ((typeof(_m))(((_v) & (_m)) >> __bf_shf(_m)))
89 #define BIT(x)               (1UL << (x))
90 #define test_bit(i, a)  ((a) & (1 << (i)))
91 #define clear_bit(i, a) ((a)) &= ~(1 << (i))
92 #define set_bit(i, a)   ((a)) |= (1 << (i))
93 
94 /* #define QWX_DEBUG */
95 
96 #include <dev/ic/qwxreg.h>
97 #include <dev/ic/qwxvar.h>
98 
99 /* Headers needed for RDDM dump */
100 #include <sys/namei.h>
101 #include <sys/pledge.h>
102 #include <sys/vnode.h>
103 #include <sys/fcntl.h>
104 #include <sys/stat.h>
105 #include <sys/proc.h>
106 
107 #define ATH11K_PCI_IRQ_CE0_OFFSET	3
108 #define ATH11K_PCI_IRQ_DP_OFFSET	14
109 
110 #define ATH11K_PCI_CE_WAKE_IRQ		2
111 
112 #define ATH11K_PCI_WINDOW_ENABLE_BIT	0x40000000
113 #define ATH11K_PCI_WINDOW_REG_ADDRESS	0x310c
114 #define ATH11K_PCI_WINDOW_VALUE_MASK	GENMASK(24, 19)
115 #define ATH11K_PCI_WINDOW_START		0x80000
116 #define ATH11K_PCI_WINDOW_RANGE_MASK	GENMASK(18, 0)
117 
118 /* BAR0 + 4k is always accessible, and no need to force wakeup. */
119 #define ATH11K_PCI_ACCESS_ALWAYS_OFF	0xFE0	/* 4K - 32 = 0xFE0 */
120 
121 #define TCSR_SOC_HW_VERSION		0x0224
122 #define TCSR_SOC_HW_VERSION_MAJOR_MASK	GENMASK(11, 8)
123 #define TCSR_SOC_HW_VERSION_MINOR_MASK	GENMASK(7, 0)
124 
125 /*
126  * pci.h
127  */
128 #define PCIE_SOC_GLOBAL_RESET			0x3008
129 #define PCIE_SOC_GLOBAL_RESET_V			1
130 
131 #define WLAON_WARM_SW_ENTRY			0x1f80504
132 #define WLAON_SOC_RESET_CAUSE_REG		0x01f8060c
133 
134 #define PCIE_Q6_COOKIE_ADDR			0x01f80500
135 #define PCIE_Q6_COOKIE_DATA			0xc0000000
136 
137 /* register to wake the UMAC from power collapse */
138 #define PCIE_SCRATCH_0_SOC_PCIE_REG		0x4040
139 
140 /* register used for handshake mechanism to validate UMAC is awake */
141 #define PCIE_SOC_WAKE_PCIE_LOCAL_REG		0x3004
142 
143 #define PCIE_PCIE_PARF_LTSSM			0x1e081b0
144 #define PARM_LTSSM_VALUE			0x111
145 
146 #define GCC_GCC_PCIE_HOT_RST			0x1e402bc
147 #define GCC_GCC_PCIE_HOT_RST_VAL		0x10
148 
149 #define PCIE_PCIE_INT_ALL_CLEAR			0x1e08228
150 #define PCIE_SMLH_REQ_RST_LINK_DOWN		0x2
151 #define PCIE_INT_CLEAR_ALL			0xffffffff
152 
153 #define PCIE_QSERDES_COM_SYSCLK_EN_SEL_REG(sc) \
154 		(sc->hw_params.regs->pcie_qserdes_sysclk_en_sel)
155 #define PCIE_QSERDES_COM_SYSCLK_EN_SEL_VAL	0x10
156 #define PCIE_QSERDES_COM_SYSCLK_EN_SEL_MSK	0xffffffff
157 #define PCIE_PCS_OSC_DTCT_CONFIG1_REG(sc) \
158 		(sc->hw_params.regs->pcie_pcs_osc_dtct_config_base)
159 #define PCIE_PCS_OSC_DTCT_CONFIG1_VAL		0x02
160 #define PCIE_PCS_OSC_DTCT_CONFIG2_REG(sc) \
161 		(sc->hw_params.regs->pcie_pcs_osc_dtct_config_base + 0x4)
162 #define PCIE_PCS_OSC_DTCT_CONFIG2_VAL		0x52
163 #define PCIE_PCS_OSC_DTCT_CONFIG4_REG(sc) \
164 		(sc->hw_params.regs->pcie_pcs_osc_dtct_config_base + 0xc)
165 #define PCIE_PCS_OSC_DTCT_CONFIG4_VAL		0xff
166 #define PCIE_PCS_OSC_DTCT_CONFIG_MSK		0x000000ff
167 
168 #define WLAON_QFPROM_PWR_CTRL_REG		0x01f8031c
169 #define QFPROM_PWR_CTRL_VDD4BLOW_MASK		0x4
170 
171 /*
172  * mhi.h
173  */
174 #define PCIE_TXVECDB				0x360
175 #define PCIE_TXVECSTATUS			0x368
176 #define PCIE_RXVECDB				0x394
177 #define PCIE_RXVECSTATUS			0x39C
178 
179 #define MHI_CHAN_CTX_CHSTATE_MASK		GENMASK(7, 0)
180 #define   MHI_CHAN_CTX_CHSTATE_DISABLED		0
181 #define   MHI_CHAN_CTX_CHSTATE_ENABLED		1
182 #define   MHI_CHAN_CTX_CHSTATE_RUNNING		2
183 #define   MHI_CHAN_CTX_CHSTATE_SUSPENDED	3
184 #define   MHI_CHAN_CTX_CHSTATE_STOP		4
185 #define   MHI_CHAN_CTX_CHSTATE_ERROR		5
186 #define MHI_CHAN_CTX_BRSTMODE_MASK		GENMASK(9, 8)
187 #define MHI_CHAN_CTX_BRSTMODE_SHFT		8
188 #define   MHI_CHAN_CTX_BRSTMODE_DISABLE		2
189 #define   MHI_CHAN_CTX_BRSTMODE_ENABLE		3
190 #define MHI_CHAN_CTX_POLLCFG_MASK		GENMASK(15, 10)
191 #define MHI_CHAN_CTX_RESERVED_MASK		GENMASK(31, 16)
192 
193 #define QWX_MHI_CONFIG_QCA6390_MAX_CHANNELS	128
194 #define QWX_MHI_CONFIG_QCA6390_TIMEOUT_MS	2000
195 #define QWX_MHI_CONFIG_QCA9074_MAX_CHANNELS	30
196 
197 #define MHI_CHAN_TYPE_INVALID		0
198 #define MHI_CHAN_TYPE_OUTBOUND		1 /* to device */
199 #define MHI_CHAN_TYPE_INBOUND		2 /* from device */
200 #define MHI_CHAN_TYPE_INBOUND_COALESCED	3
201 
202 #define MHI_EV_CTX_RESERVED_MASK	GENMASK(7, 0)
203 #define MHI_EV_CTX_INTMODC_MASK		GENMASK(15, 8)
204 #define MHI_EV_CTX_INTMODT_MASK		GENMASK(31, 16)
205 #define MHI_EV_CTX_INTMODT_SHFT		16
206 
207 #define MHI_ER_TYPE_INVALID	0
208 #define MHI_ER_TYPE_VALID	1
209 
210 #define MHI_ER_DATA	0
211 #define MHI_ER_CTRL	1
212 
213 #define MHI_CH_STATE_DISABLED	0
214 #define MHI_CH_STATE_ENABLED	1
215 #define MHI_CH_STATE_RUNNING	2
216 #define MHI_CH_STATE_SUSPENDED	3
217 #define MHI_CH_STATE_STOP	4
218 #define MHI_CH_STATE_ERROR	5
219 
220 #define QWX_NUM_EVENT_CTX	2
221 
222 /* Event context. Shared with device. */
223 struct qwx_mhi_event_ctxt {
224 	uint32_t intmod;
225 	uint32_t ertype;
226 	uint32_t msivec;
227 
228 	uint64_t rbase;
229 	uint64_t rlen;
230 	uint64_t rp;
231 	uint64_t wp;
232 } __packed;
233 
234 /* Channel context. Shared with device. */
235 struct qwx_mhi_chan_ctxt {
236 	uint32_t chcfg;
237 	uint32_t chtype;
238 	uint32_t erindex;
239 
240 	uint64_t rbase;
241 	uint64_t rlen;
242 	uint64_t rp;
243 	uint64_t wp;
244 } __packed;
245 
246 /* Command context. Shared with device. */
247 struct qwx_mhi_cmd_ctxt {
248 	uint32_t reserved0;
249 	uint32_t reserved1;
250 	uint32_t reserved2;
251 
252 	uint64_t rbase;
253 	uint64_t rlen;
254 	uint64_t rp;
255 	uint64_t wp;
256 } __packed;
257 
258 struct qwx_mhi_ring_element {
259 	uint64_t ptr;
260 	uint32_t dword[2];
261 };
262 
263 struct qwx_xfer_data {
264 	bus_dmamap_t	map;
265 	struct mbuf	*m;
266 };
267 
268 #define QWX_PCI_XFER_MAX_DATA_SIZE	0xffff
269 #define QWX_PCI_XFER_RING_MAX_ELEMENTS	64
270 
271 struct qwx_pci_xfer_ring {
272 	struct qwx_dmamem	*dmamem;
273 	bus_size_t		size;
274 	uint32_t		mhi_chan_id;
275 	uint32_t		mhi_chan_state;
276 	uint32_t		mhi_chan_direction;
277 	uint32_t		mhi_chan_event_ring_index;
278 	uint32_t		db_addr;
279 	uint32_t		cmd_status;
280 	int			num_elements;
281 	int			queued;
282 	struct qwx_xfer_data	data[QWX_PCI_XFER_RING_MAX_ELEMENTS];
283 	uint64_t		rp;
284 	uint64_t		wp;
285 	struct qwx_mhi_chan_ctxt *chan_ctxt;
286 };
287 
288 
289 #define QWX_PCI_EVENT_RING_MAX_ELEMENTS	256
290 
291 struct qwx_pci_event_ring {
292 	struct qwx_dmamem	*dmamem;
293 	bus_size_t		size;
294 	uint32_t		mhi_er_type;
295 	uint32_t		mhi_er_irq;
296 	uint32_t		mhi_er_irq_moderation_ms;
297 	uint32_t		db_addr;
298 	int			num_elements;
299 	uint64_t		rp;
300 	uint64_t		wp;
301 	struct qwx_mhi_event_ctxt *event_ctxt;
302 };
303 
304 struct qwx_cmd_data {
305 	bus_dmamap_t	map;
306 	struct mbuf	*m;
307 };
308 
309 #define QWX_PCI_CMD_RING_MAX_ELEMENTS	128
310 
311 struct qwx_pci_cmd_ring {
312 	struct qwx_dmamem	*dmamem;
313 	bus_size_t		size;
314 	uint64_t		rp;
315 	uint64_t		wp;
316 	int			num_elements;
317 	int			queued;
318 };
319 
320 struct qwx_pci_ops;
321 struct qwx_msi_config;
322 
323 struct qwx_mhi_newstate {
324 	struct {
325 		int mhi_state;
326 		int ee;
327 	} queue[4];
328 	int cur;
329 	int tail;
330 	int queued;
331 };
332 
333 #define QWX_NUM_MSI_VEC	32
334 
335 struct qwx_pci_softc {
336 	struct qwx_softc	sc_sc;
337 	pci_chipset_tag_t	sc_pc;
338 	pcitag_t		sc_tag;
339 	int			sc_cap_off;
340 	int			sc_msi_off;
341 	pcireg_t		sc_msi_cap;
342 	void			*sc_ih[QWX_NUM_MSI_VEC];
343 	char			sc_ivname[QWX_NUM_MSI_VEC][16];
344 	struct qwx_ext_irq_grp	ext_irq_grp[ATH11K_EXT_IRQ_GRP_NUM_MAX];
345 	int			mhi_irq[2];
346 	bus_space_tag_t		sc_st;
347 	bus_space_handle_t	sc_sh;
348 	bus_addr_t		sc_map;
349 	bus_size_t		sc_mapsize;
350 
351 	pcireg_t		sc_lcsr;
352 	uint32_t		sc_flags;
353 #define ATH11K_PCI_ASPM_RESTORE	1
354 
355 	uint32_t		register_window;
356 	const struct qwx_pci_ops *sc_pci_ops;
357 
358 	uint32_t		 bhi_off;
359 	uint32_t		 bhi_ee;
360 	uint32_t		 bhie_off;
361 	uint32_t		 mhi_state;
362 	uint32_t		 max_chan;
363 
364 	uint64_t		 wake_db;
365 
366 	struct qwx_mhi_newstate	 mhi_newstate;
367 	struct task		 mhi_newstate_task;
368 
369 	/*
370 	 * DMA memory for AMMS.bin firmware image.
371 	 * This memory must remain available to the device until
372 	 * the device is powered down.
373 	 */
374 	struct qwx_dmamem	*amss_data;
375 	struct qwx_dmamem	*amss_vec;
376 
377 	struct qwx_dmamem	 *rddm_vec;
378 	struct qwx_dmamem	 *rddm_data;
379 	int			 rddm_triggered;
380 	struct task		 rddm_task;
381 #define	QWX_RDDM_DUMP_SIZE	0x420000
382 
383 	struct qwx_dmamem	*chan_ctxt;
384 	struct qwx_dmamem	*event_ctxt;
385 	struct qwx_dmamem	*cmd_ctxt;
386 
387 
388 	struct qwx_pci_xfer_ring xfer_rings[4];
389 #define QWX_PCI_XFER_RING_LOOPBACK_OUTBOUND	0
390 #define QWX_PCI_XFER_RING_LOOPBACK_INBOUND	1
391 #define QWX_PCI_XFER_RING_IPCR_OUTBOUND		2
392 #define QWX_PCI_XFER_RING_IPCR_INBOUND		3
393 	struct qwx_pci_event_ring event_rings[QWX_NUM_EVENT_CTX];
394 	struct qwx_pci_cmd_ring cmd_ring;
395 };
396 
397 int	qwx_pci_match(struct device *, void *, void *);
398 void	qwx_pci_attach(struct device *, struct device *, void *);
399 int	qwx_pci_detach(struct device *, int);
400 void	qwx_pci_attach_hook(struct device *);
401 int	qwx_pci_activate(struct device *, int);
402 void	qwx_pci_free_xfer_rings(struct qwx_pci_softc *);
403 int	qwx_pci_alloc_xfer_ring(struct qwx_softc *, struct qwx_pci_xfer_ring *,
404 	    uint32_t, uint32_t, uint32_t, size_t);
405 int	qwx_pci_alloc_xfer_rings_qca6390(struct qwx_pci_softc *);
406 int	qwx_pci_alloc_xfer_rings_qcn9074(struct qwx_pci_softc *);
407 void	qwx_pci_free_event_rings(struct qwx_pci_softc *);
408 int	qwx_pci_alloc_event_ring(struct qwx_softc *,
409 	    struct qwx_pci_event_ring *, uint32_t, uint32_t, uint32_t, size_t);
410 int	qwx_pci_alloc_event_rings(struct qwx_pci_softc *);
411 void	qwx_pci_free_cmd_ring(struct qwx_pci_softc *);
412 int	qwx_pci_init_cmd_ring(struct qwx_softc *, struct qwx_pci_cmd_ring *);
413 uint32_t qwx_pci_read(struct qwx_softc *, uint32_t);
414 void	qwx_pci_write(struct qwx_softc *, uint32_t, uint32_t);
415 
416 void	qwx_pci_read_hw_version(struct qwx_softc *, uint32_t *, uint32_t *);
417 uint32_t qwx_pcic_read32(struct qwx_softc *, uint32_t);
418 void	 qwx_pcic_write32(struct qwx_softc *, uint32_t, uint32_t);
419 
420 void	qwx_pcic_ext_irq_enable(struct qwx_softc *);
421 void	qwx_pcic_ext_irq_disable(struct qwx_softc *);
422 int	qwx_pcic_config_irq(struct qwx_softc *, struct pci_attach_args *);
423 
424 int	qwx_pci_start(struct qwx_softc *);
425 void	qwx_pci_stop(struct qwx_softc *);
426 void	qwx_pci_aspm_disable(struct qwx_softc *);
427 void	qwx_pci_aspm_restore(struct qwx_softc *);
428 int	qwx_pci_power_up(struct qwx_softc *);
429 void	qwx_pci_power_down(struct qwx_softc *);
430 
431 int	qwx_pci_bus_wake_up(struct qwx_softc *);
432 void	qwx_pci_bus_release(struct qwx_softc *);
433 void	qwx_pci_window_write32(struct qwx_softc *, uint32_t, uint32_t);
434 uint32_t qwx_pci_window_read32(struct qwx_softc *, uint32_t);
435 
436 int	qwx_mhi_register(struct qwx_softc *);
437 void	qwx_mhi_unregister(struct qwx_softc *);
438 void	qwx_mhi_ring_doorbell(struct qwx_softc *sc, uint64_t, uint64_t);
439 void	qwx_mhi_device_wake(struct qwx_softc *);
440 void	qwx_mhi_device_zzz(struct qwx_softc *);
441 int	qwx_mhi_wake_db_clear_valid(struct qwx_softc *);
442 void	qwx_mhi_init_xfer_rings(struct qwx_pci_softc *);
443 void	qwx_mhi_init_event_rings(struct qwx_pci_softc *);
444 void	qwx_mhi_init_cmd_ring(struct qwx_pci_softc *);
445 void	qwx_mhi_init_dev_ctxt(struct qwx_pci_softc *);
446 int	qwx_mhi_send_cmd(struct qwx_pci_softc *psc, uint32_t, uint32_t);
447 void *	qwx_pci_xfer_ring_get_elem(struct qwx_pci_xfer_ring *, uint64_t);
448 struct qwx_xfer_data *qwx_pci_xfer_ring_get_data(struct qwx_pci_xfer_ring *,
449 	    uint64_t);
450 int	qwx_mhi_submit_xfer(struct qwx_softc *sc, struct mbuf *m);
451 int	qwx_mhi_start_channel(struct qwx_pci_softc *,
452 	    struct qwx_pci_xfer_ring *);
453 int	qwx_mhi_start_channels(struct qwx_pci_softc *);
454 int	qwx_mhi_start(struct qwx_pci_softc *);
455 void	qwx_mhi_stop(struct qwx_softc *);
456 int	qwx_mhi_reset_device(struct qwx_softc *, int);
457 void	qwx_mhi_clear_vector(struct qwx_softc *);
458 int	qwx_mhi_fw_load_handler(struct qwx_pci_softc *);
459 int	qwx_mhi_await_device_reset(struct qwx_softc *);
460 int	qwx_mhi_await_device_ready(struct qwx_softc *);
461 void	qwx_mhi_ready_state_transition(struct qwx_pci_softc *);
462 void	qwx_mhi_ee_amss_state_transition(struct qwx_pci_softc *);
463 void	qwx_mhi_mission_mode_state_transition(struct qwx_pci_softc *);
464 void	qwx_mhi_low_power_mode_state_transition(struct qwx_pci_softc *);
465 void	qwx_mhi_set_state(struct qwx_softc *, uint32_t);
466 void	qwx_mhi_init_mmio(struct qwx_pci_softc *);
467 int	qwx_mhi_fw_load_bhi(struct qwx_pci_softc *, uint8_t *, size_t);
468 int	qwx_mhi_fw_load_bhie(struct qwx_pci_softc *, uint8_t *, size_t);
469 void	qwx_rddm_prepare(struct qwx_pci_softc *);
470 void	qwx_rddm_task(void *);
471 void *	qwx_pci_event_ring_get_elem(struct qwx_pci_event_ring *, uint64_t);
472 void	qwx_mhi_queue_state_change(struct qwx_pci_softc *, int, int);
473 void	qwx_mhi_state_change(void *);
474 void	qwx_pci_intr_ctrl_event_mhi(struct qwx_pci_softc *, uint32_t);
475 void	qwx_pci_intr_ctrl_event_ee(struct qwx_pci_softc *, uint32_t);
476 void	qwx_pci_intr_ctrl_event_cmd_complete(struct qwx_pci_softc *,
477 	    uint64_t, uint32_t);
478 int	qwx_pci_intr_ctrl_event(struct qwx_pci_softc *,
479 	    struct qwx_pci_event_ring *);
480 void	qwx_pci_intr_data_event_tx(struct qwx_pci_softc *,
481 	    struct qwx_mhi_ring_element *);
482 int	qwx_pci_intr_data_event(struct qwx_pci_softc *,
483 	    struct qwx_pci_event_ring *);
484 int	qwx_pci_intr_mhi_ctrl(void *);
485 int	qwx_pci_intr_mhi_data(void *);
486 int	qwx_pci_intr(void *);
487 
488 struct qwx_pci_ops {
489 	int	 (*wakeup)(struct qwx_softc *);
490 	void	 (*release)(struct qwx_softc *);
491 	int	 (*get_msi_irq)(struct qwx_softc *, unsigned int);
492 	void	 (*window_write32)(struct qwx_softc *, uint32_t, uint32_t);
493 	uint32_t (*window_read32)(struct qwx_softc *, uint32_t);
494 	int	 (*alloc_xfer_rings)(struct qwx_pci_softc *);
495 };
496 
497 
498 static const struct qwx_pci_ops qwx_pci_ops_qca6390 = {
499 	.wakeup = qwx_pci_bus_wake_up,
500 	.release = qwx_pci_bus_release,
501 #if notyet
502 	.get_msi_irq = qwx_pci_get_msi_irq,
503 #endif
504 	.window_write32 = qwx_pci_window_write32,
505 	.window_read32 = qwx_pci_window_read32,
506 	.alloc_xfer_rings = qwx_pci_alloc_xfer_rings_qca6390,
507 };
508 
509 static const struct qwx_pci_ops qwx_pci_ops_qcn9074 = {
510 	.wakeup = NULL,
511 	.release = NULL,
512 #if notyet
513 	.get_msi_irq = qwx_pci_get_msi_irq,
514 #endif
515 	.window_write32 = qwx_pci_window_write32,
516 	.window_read32 = qwx_pci_window_read32,
517 	.alloc_xfer_rings = qwx_pci_alloc_xfer_rings_qcn9074,
518 };
519 
520 const struct cfattach qwx_pci_ca = {
521 	sizeof(struct qwx_pci_softc),
522 	qwx_pci_match,
523 	qwx_pci_attach,
524 	qwx_pci_detach,
525 	qwx_pci_activate
526 };
527 
528 /* XXX pcidev */
529 #define PCI_PRODUCT_QUALCOMM_QCA6390	0x1101
530 #define PCI_PRODUCT_QUALCOMM_QCN9074	0x1104
531 
532 static const struct pci_matchid qwx_pci_devices[] = {
533 #if notyet
534 	{ PCI_VENDOR_QUALCOMM, PCI_PRODUCT_QUALCOMM_QCA6390 },
535 	{ PCI_VENDOR_QUALCOMM, PCI_PRODUCT_QUALCOMM_QCN9074 },
536 #endif
537 	{ PCI_VENDOR_QUALCOMM, PCI_PRODUCT_QUALCOMM_QCNFA765 }
538 };
539 
540 int
541 qwx_pci_match(struct device *parent, void *match, void *aux)
542 {
543 	return pci_matchbyid(aux, qwx_pci_devices, nitems(qwx_pci_devices));
544 }
545 
546 void
547 qwx_pci_init_qmi_ce_config(struct qwx_softc *sc)
548 {
549 	struct qwx_qmi_ce_cfg *cfg = &sc->qmi_ce_cfg;
550 
551 	qwx_ce_get_shadow_config(sc, &cfg->shadow_reg_v2,
552 	    &cfg->shadow_reg_v2_len);
553 }
554 
555 const struct qwx_msi_config qwx_msi_config_one_msi = {
556 	.total_vectors = 1,
557 	.total_users = 4,
558 	.users = (struct qwx_msi_user[]) {
559 		{ .name = "MHI", .num_vectors = 1, .base_vector = 0 },
560 		{ .name = "CE", .num_vectors = 1, .base_vector = 0 },
561 		{ .name = "WAKE", .num_vectors = 1, .base_vector = 0 },
562 		{ .name = "DP", .num_vectors = 1, .base_vector = 0 },
563 	},
564 };
565 
566 const struct qwx_msi_config qwx_msi_config[] = {
567 	{
568 		.total_vectors = 32,
569 		.total_users = 4,
570 		.users = (struct qwx_msi_user[]) {
571 			{ .name = "MHI", .num_vectors = 3, .base_vector = 0 },
572 			{ .name = "CE", .num_vectors = 10, .base_vector = 3 },
573 			{ .name = "WAKE", .num_vectors = 1, .base_vector = 13 },
574 			{ .name = "DP", .num_vectors = 18, .base_vector = 14 },
575 		},
576 		.hw_rev = ATH11K_HW_QCA6390_HW20,
577 	},
578 	{
579 		.total_vectors = 16,
580 		.total_users = 3,
581 		.users = (struct qwx_msi_user[]) {
582 			{ .name = "MHI", .num_vectors = 3, .base_vector = 0 },
583 			{ .name = "CE", .num_vectors = 5, .base_vector = 3 },
584 			{ .name = "DP", .num_vectors = 8, .base_vector = 8 },
585 		},
586 		.hw_rev = ATH11K_HW_QCN9074_HW10,
587 	},
588 	{
589 		.total_vectors = 32,
590 		.total_users = 4,
591 		.users = (struct qwx_msi_user[]) {
592 			{ .name = "MHI", .num_vectors = 3, .base_vector = 0 },
593 			{ .name = "CE", .num_vectors = 10, .base_vector = 3 },
594 			{ .name = "WAKE", .num_vectors = 1, .base_vector = 13 },
595 			{ .name = "DP", .num_vectors = 18, .base_vector = 14 },
596 		},
597 		.hw_rev = ATH11K_HW_WCN6855_HW20,
598 	},
599 	{
600 		.total_vectors = 32,
601 		.total_users = 4,
602 		.users = (struct qwx_msi_user[]) {
603 			{ .name = "MHI", .num_vectors = 3, .base_vector = 0 },
604 			{ .name = "CE", .num_vectors = 10, .base_vector = 3 },
605 			{ .name = "WAKE", .num_vectors = 1, .base_vector = 13 },
606 			{ .name = "DP", .num_vectors = 18, .base_vector = 14 },
607 		},
608 		.hw_rev = ATH11K_HW_WCN6855_HW21,
609 	},
610 	{
611 		.total_vectors = 28,
612 		.total_users = 2,
613 		.users = (struct qwx_msi_user[]) {
614 			{ .name = "CE", .num_vectors = 10, .base_vector = 0 },
615 			{ .name = "DP", .num_vectors = 18, .base_vector = 10 },
616 		},
617 		.hw_rev = ATH11K_HW_WCN6750_HW10,
618 	},
619 };
620 
621 int
622 qwx_pcic_init_msi_config(struct qwx_softc *sc)
623 {
624 	const struct qwx_msi_config *msi_config;
625 	int i;
626 
627 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags)) {
628 		sc->msi_cfg = &qwx_msi_config_one_msi;
629 		return 0;
630 	}
631 	for (i = 0; i < nitems(qwx_msi_config); i++) {
632 		msi_config = &qwx_msi_config[i];
633 
634 		if (msi_config->hw_rev == sc->sc_hw_rev)
635 			break;
636 	}
637 
638 	if (i == nitems(qwx_msi_config)) {
639 		printf("%s: failed to fetch msi config, "
640 		    "unsupported hw version: 0x%x\n",
641 		    sc->sc_dev.dv_xname, sc->sc_hw_rev);
642 		return EINVAL;
643 	}
644 
645 	sc->msi_cfg = msi_config;
646 	return 0;
647 }
648 
649 int
650 qwx_pci_alloc_msi(struct qwx_softc *sc)
651 {
652 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
653 	uint64_t addr;
654 	pcireg_t data;
655 
656 	if (psc->sc_msi_cap & PCI_MSI_MC_C64) {
657 		uint64_t addr_hi;
658 		pcireg_t addr_lo;
659 
660 		addr_lo = pci_conf_read(psc->sc_pc, psc->sc_tag,
661 		    psc->sc_msi_off + PCI_MSI_MA);
662 		addr_hi = pci_conf_read(psc->sc_pc, psc->sc_tag,
663 		    psc->sc_msi_off + PCI_MSI_MAU32);
664 		addr = addr_hi << 32 | addr_lo;
665 		data = pci_conf_read(psc->sc_pc, psc->sc_tag,
666 		    psc->sc_msi_off + PCI_MSI_MD64);
667 	} else {
668 		addr = pci_conf_read(psc->sc_pc, psc->sc_tag,
669 		    psc->sc_msi_off + PCI_MSI_MA);
670 		data = pci_conf_read(psc->sc_pc, psc->sc_tag,
671 		    psc->sc_msi_off + PCI_MSI_MD32);
672 	}
673 
674 	sc->msi_addr_lo = addr & 0xffffffff;
675 	sc->msi_addr_hi = ((uint64_t)addr) >> 32;
676 	sc->msi_data_start = data;
677 
678 	DPRINTF("%s: MSI addr: 0x%llx MSI data: 0x%x\n", sc->sc_dev.dv_xname,
679 	    addr, data);
680 
681 	return 0;
682 }
683 
684 int
685 qwx_pcic_map_service_to_pipe(struct qwx_softc *sc, uint16_t service_id,
686     uint8_t *ul_pipe, uint8_t *dl_pipe)
687 {
688 	const struct service_to_pipe *entry;
689 	int ul_set = 0, dl_set = 0;
690 	int i;
691 
692 	for (i = 0; i < sc->hw_params.svc_to_ce_map_len; i++) {
693 		entry = &sc->hw_params.svc_to_ce_map[i];
694 
695 		if (le32toh(entry->service_id) != service_id)
696 			continue;
697 
698 		switch (le32toh(entry->pipedir)) {
699 		case PIPEDIR_NONE:
700 			break;
701 		case PIPEDIR_IN:
702 			*dl_pipe = le32toh(entry->pipenum);
703 			dl_set = 1;
704 			break;
705 		case PIPEDIR_OUT:
706 			*ul_pipe = le32toh(entry->pipenum);
707 			ul_set = 1;
708 			break;
709 		case PIPEDIR_INOUT:
710 			*dl_pipe = le32toh(entry->pipenum);
711 			*ul_pipe = le32toh(entry->pipenum);
712 			dl_set = 1;
713 			ul_set = 1;
714 			break;
715 		}
716 	}
717 
718 	if (!ul_set || !dl_set) {
719 		DPRINTF("%s: found no uplink and no downlink\n", __func__);
720 		return ENOENT;
721 	}
722 
723 	return 0;
724 }
725 
726 int
727 qwx_pcic_get_user_msi_vector(struct qwx_softc *sc, char *user_name,
728     int *num_vectors, uint32_t *user_base_data, uint32_t *base_vector)
729 {
730 	const struct qwx_msi_config *msi_config = sc->msi_cfg;
731 	int idx;
732 
733 	for (idx = 0; idx < msi_config->total_users; idx++) {
734 		if (strcmp(user_name, msi_config->users[idx].name) == 0) {
735 			*num_vectors = msi_config->users[idx].num_vectors;
736 			*base_vector =  msi_config->users[idx].base_vector;
737 			*user_base_data = *base_vector + sc->msi_data_start;
738 
739 			DPRINTF("%s: MSI assignment %s num_vectors %d "
740 			    "user_base_data %u base_vector %u\n", __func__,
741 			    user_name, *num_vectors, *user_base_data,
742 			    *base_vector);
743 			return 0;
744 		}
745 	}
746 
747 	DPRINTF("%s: Failed to find MSI assignment for %s\n",
748 	    sc->sc_dev.dv_xname, user_name);
749 
750 	return EINVAL;
751 }
752 
753 void
754 qwx_pci_attach(struct device *parent, struct device *self, void *aux)
755 {
756 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)self;
757 	struct qwx_softc *sc = &psc->sc_sc;
758 	struct ieee80211com *ic = &sc->sc_ic;
759 	struct ifnet *ifp = &ic->ic_if;
760 	uint32_t soc_hw_version_major, soc_hw_version_minor;
761 	const struct qwx_pci_ops *pci_ops;
762 	struct pci_attach_args *pa = aux;
763 	pci_intr_handle_t ih;
764 	pcireg_t memtype, reg;
765 	const char *intrstr;
766 	int error;
767 	pcireg_t sreg;
768 
769 	sc->sc_dmat = pa->pa_dmat;
770 	psc->sc_pc = pa->pa_pc;
771 	psc->sc_tag = pa->pa_tag;
772 
773 	rw_init(&sc->ioctl_rwl, "qwxioctl");
774 
775 	sreg = pci_conf_read(psc->sc_pc, psc->sc_tag, PCI_SUBSYS_ID_REG);
776 	sc->id.bdf_search = ATH11K_BDF_SEARCH_DEFAULT;
777 	sc->id.vendor = PCI_VENDOR(pa->pa_id);
778 	sc->id.device = PCI_PRODUCT(pa->pa_id);
779 	sc->id.subsystem_vendor = PCI_VENDOR(sreg);
780 	sc->id.subsystem_device = PCI_PRODUCT(sreg);
781 
782 	strlcpy(sc->sc_bus_str, "pci", sizeof(sc->sc_bus_str));
783 
784 	sc->ops.read32 = qwx_pcic_read32;
785 	sc->ops.write32 = qwx_pcic_write32;
786 	sc->ops.start = qwx_pci_start;
787 	sc->ops.stop = qwx_pci_stop;
788 	sc->ops.power_up = qwx_pci_power_up;
789 	sc->ops.power_down = qwx_pci_power_down;
790 	sc->ops.submit_xfer = qwx_mhi_submit_xfer;
791 	sc->ops.irq_enable = qwx_pcic_ext_irq_enable;
792 	sc->ops.irq_disable = qwx_pcic_ext_irq_disable;
793 	sc->ops.map_service_to_pipe = qwx_pcic_map_service_to_pipe;
794 	sc->ops.get_user_msi_vector = qwx_pcic_get_user_msi_vector;
795 
796 	if (pci_get_capability(psc->sc_pc, psc->sc_tag, PCI_CAP_PCIEXPRESS,
797 	    &psc->sc_cap_off, NULL) == 0) {
798 		printf(": can't find PCIe capability structure\n");
799 		return;
800 	}
801 
802 	if (pci_get_capability(psc->sc_pc, psc->sc_tag, PCI_CAP_MSI,
803 	    &psc->sc_msi_off, &psc->sc_msi_cap) == 0) {
804 		printf(": can't find MSI capability structure\n");
805 		return;
806 	}
807 
808 	reg = pci_conf_read(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG);
809 	reg |= PCI_COMMAND_MASTER_ENABLE;
810 	pci_conf_write(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG, reg);
811 
812 	memtype = pci_mapreg_type(pa->pa_pc, pa->pa_tag, PCI_MAPREG_START);
813 	if (pci_mapreg_map(pa, PCI_MAPREG_START, memtype, 0,
814 	    &psc->sc_st, &psc->sc_sh, &psc->sc_map, &psc->sc_mapsize, 0)) {
815 		printf(": can't map mem space\n");
816 		return;
817 	}
818 
819 	sc->mem = psc->sc_map;
820 
821 	sc->num_msivec = 32;
822 	if (pci_intr_enable_msivec(pa, sc->num_msivec) != 0) {
823 		sc->num_msivec = 1;
824 		if (pci_intr_map_msi(pa, &ih) != 0) {
825 			printf(": can't map interrupt\n");
826 			return;
827 		}
828 		clear_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags);
829 	} else {
830 		if (pci_intr_map_msivec(pa, 0, &ih) != 0 &&
831 		    pci_intr_map_msi(pa, &ih) != 0) {
832 			printf(": can't map interrupt\n");
833 			return;
834 		}
835 		set_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags);
836 		psc->mhi_irq[MHI_ER_CTRL] = 1;
837 		psc->mhi_irq[MHI_ER_DATA] = 2;
838 	}
839 
840 	intrstr = pci_intr_string(psc->sc_pc, ih);
841 	snprintf(psc->sc_ivname[0], sizeof(psc->sc_ivname[0]), "%s:bhi",
842 	    sc->sc_dev.dv_xname);
843 	psc->sc_ih[0] = pci_intr_establish(psc->sc_pc, ih, IPL_NET,
844 	    qwx_pci_intr, psc, psc->sc_ivname[0]);
845 	if (psc->sc_ih[0] == NULL) {
846 		printf(": can't establish interrupt");
847 		if (intrstr != NULL)
848 			printf(" at %s", intrstr);
849 		printf("\n");
850 		return;
851 	}
852 	printf(": %s\n", intrstr);
853 
854 	if (test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags)) {
855 		int msivec;
856 
857 		msivec = psc->mhi_irq[MHI_ER_CTRL];
858 		if (pci_intr_map_msivec(pa, msivec, &ih) != 0 &&
859 		    pci_intr_map_msi(pa, &ih) != 0) {
860 			printf(": can't map interrupt\n");
861 			return;
862 		}
863 		snprintf(psc->sc_ivname[msivec],
864 		    sizeof(psc->sc_ivname[msivec]),
865 		    "%s:mhic", sc->sc_dev.dv_xname);
866 		psc->sc_ih[msivec] = pci_intr_establish(psc->sc_pc, ih,
867 		    IPL_NET, qwx_pci_intr_mhi_ctrl, psc,
868 		    psc->sc_ivname[msivec]);
869 		if (psc->sc_ih[msivec] == NULL) {
870 			printf("%s: can't establish interrupt\n",
871 			    sc->sc_dev.dv_xname);
872 			return;
873 		}
874 
875 		msivec = psc->mhi_irq[MHI_ER_DATA];
876 		if (pci_intr_map_msivec(pa, msivec, &ih) != 0 &&
877 		    pci_intr_map_msi(pa, &ih) != 0) {
878 			printf(": can't map interrupt\n");
879 			return;
880 		}
881 		snprintf(psc->sc_ivname[msivec],
882 		    sizeof(psc->sc_ivname[msivec]),
883 		    "%s:mhid", sc->sc_dev.dv_xname);
884 		psc->sc_ih[msivec] = pci_intr_establish(psc->sc_pc, ih,
885 		    IPL_NET, qwx_pci_intr_mhi_data, psc,
886 		    psc->sc_ivname[msivec]);
887 		if (psc->sc_ih[msivec] == NULL) {
888 			printf("%s: can't establish interrupt\n",
889 			    sc->sc_dev.dv_xname);
890 			return;
891 		}
892 	}
893 
894 	pci_set_powerstate(pa->pa_pc, pa->pa_tag, PCI_PMCSR_STATE_D0);
895 
896 	switch (PCI_PRODUCT(pa->pa_id)) {
897 	case PCI_PRODUCT_QUALCOMM_QCA6390:
898 		qwx_pci_read_hw_version(sc, &soc_hw_version_major,
899 		    &soc_hw_version_minor);
900 		switch (soc_hw_version_major) {
901 		case 2:
902 			sc->sc_hw_rev = ATH11K_HW_QCA6390_HW20;
903 			break;
904 		default:
905 			printf(": unsupported QCA6390 SOC version: %d %d\n",
906 				soc_hw_version_major, soc_hw_version_minor);
907 			return;
908 		}
909 
910 		pci_ops = &qwx_pci_ops_qca6390;
911 		psc->max_chan = QWX_MHI_CONFIG_QCA6390_MAX_CHANNELS;
912 		break;
913 	case PCI_PRODUCT_QUALCOMM_QCN9074:
914 		pci_ops = &qwx_pci_ops_qcn9074;
915 		sc->sc_hw_rev = ATH11K_HW_QCN9074_HW10;
916 		psc->max_chan = QWX_MHI_CONFIG_QCA9074_MAX_CHANNELS;
917 		break;
918 	case PCI_PRODUCT_QUALCOMM_QCNFA765:
919 		sc->id.bdf_search = ATH11K_BDF_SEARCH_BUS_AND_BOARD;
920 		qwx_pci_read_hw_version(sc, &soc_hw_version_major,
921 		    &soc_hw_version_minor);
922 		switch (soc_hw_version_major) {
923 		case 2:
924 			switch (soc_hw_version_minor) {
925 			case 0x00:
926 			case 0x01:
927 				sc->sc_hw_rev = ATH11K_HW_WCN6855_HW20;
928 				break;
929 			case 0x10:
930 			case 0x11:
931 				sc->sc_hw_rev = ATH11K_HW_WCN6855_HW21;
932 				break;
933 			default:
934 				goto unsupported_wcn6855_soc;
935 			}
936 			break;
937 		default:
938 unsupported_wcn6855_soc:
939 			printf(": unsupported WCN6855 SOC version: %d %d\n",
940 				soc_hw_version_major, soc_hw_version_minor);
941 			return;
942 		}
943 
944 		pci_ops = &qwx_pci_ops_qca6390;
945 		psc->max_chan = QWX_MHI_CONFIG_QCA6390_MAX_CHANNELS;
946 		break;
947 	default:
948 		printf(": unsupported chip\n");
949 		return;
950 	}
951 
952 	/* register PCI ops */
953 	psc->sc_pci_ops = pci_ops;
954 
955 	error = qwx_pcic_init_msi_config(sc);
956 	if (error)
957 		goto err_pci_free_region;
958 
959 	error = qwx_pci_alloc_msi(sc);
960 	if (error) {
961 		printf("%s: failed to enable msi: %d\n", sc->sc_dev.dv_xname,
962 		    error);
963 		goto err_pci_free_region;
964 	}
965 
966 	error = qwx_init_hw_params(sc);
967 	if (error)
968 		goto err_pci_disable_msi;
969 
970 	psc->chan_ctxt = qwx_dmamem_alloc(sc->sc_dmat,
971 	    sizeof(struct qwx_mhi_chan_ctxt) * psc->max_chan, 0);
972 	if (psc->chan_ctxt == NULL) {
973 		printf("%s: could not allocate channel context array\n",
974 		    sc->sc_dev.dv_xname);
975 		goto err_pci_disable_msi;
976 	}
977 
978 	if (psc->sc_pci_ops->alloc_xfer_rings(psc)) {
979 		printf("%s: could not allocate transfer rings\n",
980 		    sc->sc_dev.dv_xname);
981 		goto err_pci_free_chan_ctxt;
982 	}
983 
984 	psc->event_ctxt = qwx_dmamem_alloc(sc->sc_dmat,
985 	    sizeof(struct qwx_mhi_event_ctxt) * QWX_NUM_EVENT_CTX, 0);
986 	if (psc->event_ctxt == NULL) {
987 		printf("%s: could not allocate event context array\n",
988 		    sc->sc_dev.dv_xname);
989 		goto err_pci_free_xfer_rings;
990 	}
991 
992 	if (qwx_pci_alloc_event_rings(psc)) {
993 		printf("%s: could not allocate event rings\n",
994 		    sc->sc_dev.dv_xname);
995 		goto err_pci_free_event_ctxt;
996 	}
997 
998 	psc->cmd_ctxt = qwx_dmamem_alloc(sc->sc_dmat,
999 	    sizeof(struct qwx_mhi_cmd_ctxt), 0);
1000 	if (psc->cmd_ctxt == NULL) {
1001 		printf("%s: could not allocate command context array\n",
1002 		    sc->sc_dev.dv_xname);
1003 		goto err_pci_free_event_rings;
1004 	}
1005 
1006 	if (qwx_pci_init_cmd_ring(sc, &psc->cmd_ring))  {
1007 		printf("%s: could not allocate command ring\n",
1008 		    sc->sc_dev.dv_xname);
1009 		goto err_pci_free_cmd_ctxt;
1010 	}
1011 
1012 	error = qwx_mhi_register(sc);
1013 	if (error) {
1014 		printf(": failed to register mhi: %d\n", error);
1015 		goto err_pci_free_cmd_ring;
1016 	}
1017 
1018 	error = qwx_hal_srng_init(sc);
1019 	if (error)
1020 		goto err_mhi_unregister;
1021 
1022 	error = qwx_ce_alloc_pipes(sc);
1023 	if (error) {
1024 		printf(": failed to allocate ce pipes: %d\n", error);
1025 		goto err_hal_srng_deinit;
1026 	}
1027 
1028 	sc->sc_nswq = taskq_create("qwxns", 1, IPL_NET, 0);
1029 	if (sc->sc_nswq == NULL)
1030 		goto err_ce_free;
1031 
1032 	qwx_pci_init_qmi_ce_config(sc);
1033 
1034 	error = qwx_pcic_config_irq(sc, pa);
1035 	if (error) {
1036 		printf("%s: failed to config irq: %d\n",
1037 		    sc->sc_dev.dv_xname, error);
1038 		goto err_ce_free;
1039 	}
1040 #if notyet
1041 	ret = ath11k_pci_set_irq_affinity_hint(ab_pci, cpumask_of(0));
1042 	if (ret) {
1043 		ath11k_err(ab, "failed to set irq affinity %d\n", ret);
1044 		goto err_free_irq;
1045 	}
1046 
1047 	/* kernel may allocate a dummy vector before request_irq and
1048 	 * then allocate a real vector when request_irq is called.
1049 	 * So get msi_data here again to avoid spurious interrupt
1050 	 * as msi_data will configured to srngs.
1051 	 */
1052 	ret = ath11k_pci_config_msi_data(ab_pci);
1053 	if (ret) {
1054 		ath11k_err(ab, "failed to config msi_data: %d\n", ret);
1055 		goto err_irq_affinity_cleanup;
1056 	}
1057 #endif
1058 	task_set(&psc->mhi_newstate_task, qwx_mhi_state_change, psc);
1059 	task_set(&psc->rddm_task, qwx_rddm_task, psc);
1060 
1061 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
1062 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
1063 	ic->ic_state = IEEE80211_S_INIT;
1064 
1065 	/* Set device capabilities. */
1066 	ic->ic_caps =
1067 #if 0
1068 	    IEEE80211_C_QOS | IEEE80211_C_TX_AMPDU | /* A-MPDU */
1069 #endif
1070 	    IEEE80211_C_ADDBA_OFFLOAD | /* device sends ADDBA/DELBA frames */
1071 	    IEEE80211_C_WEP |		/* WEP */
1072 	    IEEE80211_C_RSN |		/* WPA/RSN */
1073 	    IEEE80211_C_SCANALL |	/* device scans all channels at once */
1074 	    IEEE80211_C_SCANALLBAND |	/* device scans all bands at once */
1075 #if 0
1076 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
1077 #endif
1078 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
1079 	    IEEE80211_C_SHPREAMBLE;	/* short preamble supported */
1080 
1081 	ic->ic_sup_rates[IEEE80211_MODE_11A] = ieee80211_std_rateset_11a;
1082 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
1083 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
1084 
1085 	/* IBSS channel undefined for now. */
1086 	ic->ic_ibss_chan = &ic->ic_channels[1];
1087 
1088 	ifp->if_softc = sc;
1089 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
1090 	ifp->if_ioctl = qwx_ioctl;
1091 	ifp->if_start = qwx_start;
1092 	ifp->if_watchdog = qwx_watchdog;
1093 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
1094 	if_attach(ifp);
1095 	ieee80211_ifattach(ifp);
1096 	ieee80211_media_init(ifp, qwx_media_change, ieee80211_media_status);
1097 
1098 	ic->ic_node_alloc = qwx_node_alloc;
1099 
1100 	/* Override 802.11 state transition machine. */
1101 	sc->sc_newstate = ic->ic_newstate;
1102 	ic->ic_newstate = qwx_newstate;
1103 #if 0
1104 	ic->ic_updatechan = qwx_updatechan;
1105 	ic->ic_updateprot = qwx_updateprot;
1106 	ic->ic_updateslot = qwx_updateslot;
1107 	ic->ic_updateedca = qwx_updateedca;
1108 	ic->ic_updatedtim = qwx_updatedtim;
1109 #endif
1110 	/*
1111 	 * We cannot read the MAC address without loading the
1112 	 * firmware from disk. Postpone until mountroot is done.
1113 	 */
1114 	config_mountroot(self, qwx_pci_attach_hook);
1115 	return;
1116 
1117 err_ce_free:
1118 	qwx_ce_free_pipes(sc);
1119 err_hal_srng_deinit:
1120 err_mhi_unregister:
1121 err_pci_free_cmd_ring:
1122 	qwx_pci_free_cmd_ring(psc);
1123 err_pci_free_cmd_ctxt:
1124 	qwx_dmamem_free(sc->sc_dmat, psc->cmd_ctxt);
1125 	psc->cmd_ctxt = NULL;
1126 err_pci_free_event_rings:
1127 	qwx_pci_free_event_rings(psc);
1128 err_pci_free_event_ctxt:
1129 	qwx_dmamem_free(sc->sc_dmat, psc->event_ctxt);
1130 	psc->event_ctxt = NULL;
1131 err_pci_free_xfer_rings:
1132 	qwx_pci_free_xfer_rings(psc);
1133 err_pci_free_chan_ctxt:
1134 	qwx_dmamem_free(sc->sc_dmat, psc->chan_ctxt);
1135 	psc->chan_ctxt = NULL;
1136 err_pci_disable_msi:
1137 err_pci_free_region:
1138 	pci_intr_disestablish(psc->sc_pc, psc->sc_ih[0]);
1139 	return;
1140 }
1141 
1142 int
1143 qwx_pci_detach(struct device *self, int flags)
1144 {
1145 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)self;
1146 	struct qwx_softc *sc = &psc->sc_sc;
1147 
1148 	if (psc->sc_ih[0]) {
1149 		pci_intr_disestablish(psc->sc_pc, psc->sc_ih[0]);
1150 		psc->sc_ih[0] = NULL;
1151 	}
1152 
1153 	qwx_detach(sc);
1154 
1155 	qwx_pci_free_event_rings(psc);
1156 	qwx_pci_free_xfer_rings(psc);
1157 	qwx_pci_free_cmd_ring(psc);
1158 
1159 	if (psc->event_ctxt) {
1160 		qwx_dmamem_free(sc->sc_dmat, psc->event_ctxt);
1161 		psc->event_ctxt = NULL;
1162 	}
1163 	if (psc->chan_ctxt) {
1164 		qwx_dmamem_free(sc->sc_dmat, psc->chan_ctxt);
1165 		psc->chan_ctxt = NULL;
1166 	}
1167 	if (psc->cmd_ctxt) {
1168 		qwx_dmamem_free(sc->sc_dmat, psc->cmd_ctxt);
1169 		psc->cmd_ctxt = NULL;
1170 	}
1171 
1172 	if (psc->amss_data) {
1173 		qwx_dmamem_free(sc->sc_dmat, psc->amss_data);
1174 		psc->amss_data = NULL;
1175 	}
1176 	if (psc->amss_vec) {
1177 		qwx_dmamem_free(sc->sc_dmat, psc->amss_vec);
1178 		psc->amss_vec = NULL;
1179 	}
1180 
1181 	return 0;
1182 }
1183 
1184 void
1185 qwx_pci_attach_hook(struct device *self)
1186 {
1187 	struct qwx_softc *sc = (void *)self;
1188 	int s = splnet();
1189 
1190 	qwx_attach(sc);
1191 
1192 	splx(s);
1193 }
1194 
1195 int
1196 qwx_pci_activate(struct device *self, int act)
1197 {
1198 	switch (act) {
1199 	case DVACT_SUSPEND:
1200 		break;
1201 	case DVACT_WAKEUP:
1202 		break;
1203 	}
1204 
1205 	return 0;
1206 }
1207 
1208 void
1209 qwx_pci_free_xfer_rings(struct qwx_pci_softc *psc)
1210 {
1211 	struct qwx_softc *sc = &psc->sc_sc;
1212 	int i;
1213 
1214 	for (i = 0; i < nitems(psc->xfer_rings); i++) {
1215 		struct qwx_pci_xfer_ring *ring = &psc->xfer_rings[i];
1216 		if (ring->dmamem) {
1217 			qwx_dmamem_free(sc->sc_dmat, ring->dmamem);
1218 			ring->dmamem = NULL;
1219 		}
1220 		memset(ring, 0, sizeof(*ring));
1221 	}
1222 }
1223 
1224 int
1225 qwx_pci_alloc_xfer_ring(struct qwx_softc *sc, struct qwx_pci_xfer_ring *ring,
1226     uint32_t id, uint32_t direction, uint32_t event_ring_index,
1227     size_t num_elements)
1228 {
1229 	bus_size_t size;
1230 	int i, err;
1231 
1232 	memset(ring, 0, sizeof(*ring));
1233 
1234 	size = sizeof(struct qwx_mhi_ring_element) * num_elements;
1235 	/* Hardware requires that rings are aligned to ring size. */
1236 	ring->dmamem = qwx_dmamem_alloc(sc->sc_dmat, size, size);
1237 	if (ring->dmamem == NULL)
1238 		return ENOMEM;
1239 
1240 	ring->size = size;
1241 	ring->mhi_chan_id = id;
1242 	ring->mhi_chan_state = MHI_CH_STATE_DISABLED;
1243 	ring->mhi_chan_direction = direction;
1244 	ring->mhi_chan_event_ring_index = event_ring_index;
1245 	ring->num_elements = num_elements;
1246 
1247 	memset(ring->data, 0, sizeof(ring->data));
1248 	for (i = 0; i < ring->num_elements; i++) {
1249 		struct qwx_xfer_data *xfer = &ring->data[i];
1250 
1251 		err = bus_dmamap_create(sc->sc_dmat, QWX_PCI_XFER_MAX_DATA_SIZE,
1252 		    1, QWX_PCI_XFER_MAX_DATA_SIZE, 0, BUS_DMA_NOWAIT,
1253 		    &xfer->map);
1254 		if (err) {
1255 			printf("%s: could not create xfer DMA map\n",
1256 			    sc->sc_dev.dv_xname);
1257 			goto fail;
1258 		}
1259 
1260 		if (direction == MHI_CHAN_TYPE_INBOUND) {
1261 			struct mbuf *m;
1262 
1263 			m = m_gethdr(M_DONTWAIT, MT_DATA);
1264 			if (m == NULL) {
1265 				err = ENOBUFS;
1266 				goto fail;
1267 			}
1268 
1269 			MCLGETL(m, M_DONTWAIT, QWX_PCI_XFER_MAX_DATA_SIZE);
1270 			if ((m->m_flags & M_EXT) == 0) {
1271 				m_freem(m);
1272 				err = ENOBUFS;
1273 				goto fail;
1274 			}
1275 
1276 			m->m_len = m->m_pkthdr.len = QWX_PCI_XFER_MAX_DATA_SIZE;
1277 			err = bus_dmamap_load_mbuf(sc->sc_dmat, xfer->map,
1278 			    m, BUS_DMA_READ | BUS_DMA_NOWAIT);
1279 			if (err) {
1280 				printf("%s: can't map mbuf (error %d)\n",
1281 				    sc->sc_dev.dv_xname, err);
1282 				m_freem(m);
1283 				goto fail;
1284 			}
1285 
1286 			bus_dmamap_sync(sc->sc_dmat, xfer->map, 0,
1287 			    QWX_PCI_XFER_MAX_DATA_SIZE, BUS_DMASYNC_PREREAD);
1288 			xfer->m = m;
1289 		}
1290 	}
1291 
1292 	return 0;
1293 fail:
1294 	for (i = 0; i < ring->num_elements; i++) {
1295 		struct qwx_xfer_data *xfer = &ring->data[i];
1296 
1297 		if (xfer->map) {
1298 			bus_dmamap_sync(sc->sc_dmat, xfer->map, 0,
1299 			    xfer->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
1300 			bus_dmamap_unload(sc->sc_dmat, xfer->map);
1301 			bus_dmamap_destroy(sc->sc_dmat, xfer->map);
1302 			xfer->map = NULL;
1303 		}
1304 
1305 		if (xfer->m) {
1306 			m_freem(xfer->m);
1307 			xfer->m = NULL;
1308 		}
1309 	}
1310 	return 1;
1311 }
1312 
1313 int
1314 qwx_pci_alloc_xfer_rings_qca6390(struct qwx_pci_softc *psc)
1315 {
1316 	struct qwx_softc *sc = &psc->sc_sc;
1317 	int ret;
1318 
1319 	ret = qwx_pci_alloc_xfer_ring(sc,
1320 	    &psc->xfer_rings[QWX_PCI_XFER_RING_LOOPBACK_OUTBOUND],
1321 	    0, MHI_CHAN_TYPE_OUTBOUND, 0, 32);
1322 	if (ret)
1323 		goto fail;
1324 
1325 	ret = qwx_pci_alloc_xfer_ring(sc,
1326 	    &psc->xfer_rings[QWX_PCI_XFER_RING_LOOPBACK_INBOUND],
1327 	    1, MHI_CHAN_TYPE_INBOUND, 0, 32);
1328 	if (ret)
1329 		goto fail;
1330 
1331 	ret = qwx_pci_alloc_xfer_ring(sc,
1332 	    &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_OUTBOUND],
1333 	    20, MHI_CHAN_TYPE_OUTBOUND, 1, 64);
1334 	if (ret)
1335 		goto fail;
1336 
1337 	ret = qwx_pci_alloc_xfer_ring(sc,
1338 	    &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_INBOUND],
1339 	    21, MHI_CHAN_TYPE_INBOUND, 1, 64);
1340 	if (ret)
1341 		goto fail;
1342 
1343 	return 0;
1344 fail:
1345 	qwx_pci_free_xfer_rings(psc);
1346 	return ret;
1347 }
1348 
1349 int
1350 qwx_pci_alloc_xfer_rings_qcn9074(struct qwx_pci_softc *psc)
1351 {
1352 	struct qwx_softc *sc = &psc->sc_sc;
1353 	int ret;
1354 
1355 	ret = qwx_pci_alloc_xfer_ring(sc,
1356 	    &psc->xfer_rings[QWX_PCI_XFER_RING_LOOPBACK_OUTBOUND],
1357 	    0, MHI_CHAN_TYPE_OUTBOUND, 1, 32);
1358 	if (ret)
1359 		goto fail;
1360 
1361 	ret = qwx_pci_alloc_xfer_ring(sc,
1362 	    &psc->xfer_rings[QWX_PCI_XFER_RING_LOOPBACK_INBOUND],
1363 	    1, MHI_CHAN_TYPE_INBOUND, 1, 32);
1364 	if (ret)
1365 		goto fail;
1366 
1367 	ret = qwx_pci_alloc_xfer_ring(sc,
1368 	    &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_OUTBOUND],
1369 	    20, MHI_CHAN_TYPE_OUTBOUND, 1, 32);
1370 	if (ret)
1371 		goto fail;
1372 
1373 	ret = qwx_pci_alloc_xfer_ring(sc,
1374 	    &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_INBOUND],
1375 	    21, MHI_CHAN_TYPE_INBOUND, 1, 32);
1376 	if (ret)
1377 		goto fail;
1378 
1379 	return 0;
1380 fail:
1381 	qwx_pci_free_xfer_rings(psc);
1382 	return ret;
1383 }
1384 
1385 void
1386 qwx_pci_free_event_rings(struct qwx_pci_softc *psc)
1387 {
1388 	struct qwx_softc *sc = &psc->sc_sc;
1389 	int i;
1390 
1391 	for (i = 0; i < nitems(psc->event_rings); i++) {
1392 		struct qwx_pci_event_ring *ring = &psc->event_rings[i];
1393 		if (ring->dmamem) {
1394 			qwx_dmamem_free(sc->sc_dmat, ring->dmamem);
1395 			ring->dmamem = NULL;
1396 		}
1397 		memset(ring, 0, sizeof(*ring));
1398 	}
1399 }
1400 
1401 int
1402 qwx_pci_alloc_event_ring(struct qwx_softc *sc, struct qwx_pci_event_ring *ring,
1403     uint32_t type, uint32_t irq, uint32_t intmod, size_t num_elements)
1404 {
1405 	bus_size_t size;
1406 
1407 	memset(ring, 0, sizeof(*ring));
1408 
1409 	size = sizeof(struct qwx_mhi_ring_element) * num_elements;
1410 	/* Hardware requires that rings are aligned to ring size. */
1411 	ring->dmamem = qwx_dmamem_alloc(sc->sc_dmat, size, size);
1412 	if (ring->dmamem == NULL)
1413 		return ENOMEM;
1414 
1415 	ring->size = size;
1416 	ring->mhi_er_type = type;
1417 	ring->mhi_er_irq = irq;
1418 	ring->mhi_er_irq_moderation_ms = intmod;
1419 	ring->num_elements = num_elements;
1420 	return 0;
1421 }
1422 
1423 int
1424 qwx_pci_alloc_event_rings(struct qwx_pci_softc *psc)
1425 {
1426 	struct qwx_softc *sc = &psc->sc_sc;
1427 	int ret;
1428 
1429 	ret = qwx_pci_alloc_event_ring(sc, &psc->event_rings[0],
1430 	    MHI_ER_CTRL, psc->mhi_irq[MHI_ER_CTRL], 0, 32);
1431 	if (ret)
1432 		goto fail;
1433 
1434 	ret = qwx_pci_alloc_event_ring(sc, &psc->event_rings[1],
1435 	    MHI_ER_DATA, psc->mhi_irq[MHI_ER_DATA], 1, 256);
1436 	if (ret)
1437 		goto fail;
1438 
1439 	return 0;
1440 fail:
1441 	qwx_pci_free_event_rings(psc);
1442 	return ret;
1443 }
1444 
1445 void
1446 qwx_pci_free_cmd_ring(struct qwx_pci_softc *psc)
1447 {
1448 	struct qwx_softc *sc = &psc->sc_sc;
1449 	struct qwx_pci_cmd_ring *ring = &psc->cmd_ring;
1450 
1451 	if (ring->dmamem)
1452 		qwx_dmamem_free(sc->sc_dmat, ring->dmamem);
1453 
1454 	memset(ring, 0, sizeof(*ring));
1455 }
1456 
1457 int
1458 qwx_pci_init_cmd_ring(struct qwx_softc *sc, struct qwx_pci_cmd_ring *ring)
1459 {
1460 	memset(ring, 0, sizeof(*ring));
1461 
1462 	ring->num_elements = QWX_PCI_CMD_RING_MAX_ELEMENTS;
1463 	ring->size = sizeof(struct qwx_mhi_ring_element) * ring->num_elements;
1464 
1465 	/* Hardware requires that rings are aligned to ring size. */
1466 	ring->dmamem = qwx_dmamem_alloc(sc->sc_dmat, ring->size, ring->size);
1467 	if (ring->dmamem == NULL)
1468 		return ENOMEM;
1469 
1470 	return 0;
1471 }
1472 
1473 uint32_t
1474 qwx_pci_read(struct qwx_softc *sc, uint32_t addr)
1475 {
1476 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1477 
1478 	return (bus_space_read_4(psc->sc_st, psc->sc_sh, addr));
1479 }
1480 
1481 void
1482 qwx_pci_write(struct qwx_softc *sc, uint32_t addr, uint32_t val)
1483 {
1484 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1485 
1486 	bus_space_write_4(psc->sc_st, psc->sc_sh, addr, val);
1487 }
1488 
1489 void
1490 qwx_pci_read_hw_version(struct qwx_softc *sc, uint32_t *major,
1491     uint32_t *minor)
1492 {
1493 	uint32_t soc_hw_version;
1494 
1495 	soc_hw_version = qwx_pcic_read32(sc, TCSR_SOC_HW_VERSION);
1496 	*major = FIELD_GET(TCSR_SOC_HW_VERSION_MAJOR_MASK, soc_hw_version);
1497 	*minor = FIELD_GET(TCSR_SOC_HW_VERSION_MINOR_MASK, soc_hw_version);
1498 	DPRINTF("%s: pci tcsr_soc_hw_version major %d minor %d\n",
1499 	    sc->sc_dev.dv_xname, *major, *minor);
1500 }
1501 
1502 uint32_t
1503 qwx_pcic_read32(struct qwx_softc *sc, uint32_t offset)
1504 {
1505 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1506 	int ret = 0;
1507 	uint32_t val;
1508 	bool wakeup_required;
1509 
1510 	/* for offset beyond BAR + 4K - 32, may
1511 	 * need to wakeup the device to access.
1512 	 */
1513 	wakeup_required = test_bit(ATH11K_FLAG_DEVICE_INIT_DONE, sc->sc_flags)
1514 	    && offset >= ATH11K_PCI_ACCESS_ALWAYS_OFF;
1515 	if (wakeup_required && psc->sc_pci_ops->wakeup)
1516 		ret = psc->sc_pci_ops->wakeup(sc);
1517 
1518 	if (offset < ATH11K_PCI_WINDOW_START)
1519 		val = qwx_pci_read(sc, offset);
1520 	else
1521 		val = psc->sc_pci_ops->window_read32(sc, offset);
1522 
1523 	if (wakeup_required && !ret && psc->sc_pci_ops->release)
1524 		psc->sc_pci_ops->release(sc);
1525 
1526 	return val;
1527 }
1528 
1529 void
1530 qwx_pcic_write32(struct qwx_softc *sc, uint32_t offset, uint32_t value)
1531 {
1532 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1533 	int ret = 0;
1534 	bool wakeup_required;
1535 
1536 	/* for offset beyond BAR + 4K - 32, may
1537 	 * need to wakeup the device to access.
1538 	 */
1539 	wakeup_required = test_bit(ATH11K_FLAG_DEVICE_INIT_DONE, sc->sc_flags)
1540 	    && offset >= ATH11K_PCI_ACCESS_ALWAYS_OFF;
1541 	if (wakeup_required && psc->sc_pci_ops->wakeup)
1542 		ret = psc->sc_pci_ops->wakeup(sc);
1543 
1544 	if (offset < ATH11K_PCI_WINDOW_START)
1545 		qwx_pci_write(sc, offset, value);
1546 	else
1547 		psc->sc_pci_ops->window_write32(sc, offset, value);
1548 
1549 	if (wakeup_required && !ret && psc->sc_pci_ops->release)
1550 		psc->sc_pci_ops->release(sc);
1551 }
1552 
1553 void
1554 qwx_pcic_ext_irq_disable(struct qwx_softc *sc)
1555 {
1556 	clear_bit(ATH11K_FLAG_EXT_IRQ_ENABLED, sc->sc_flags);
1557 
1558 	/* In case of one MSI vector, we handle irq enable/disable in a
1559 	 * uniform way since we only have one irq
1560 	 */
1561 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1562 		return;
1563 
1564 	printf("%s not implemented\n", __func__);
1565 }
1566 
1567 void
1568 qwx_pcic_ext_irq_enable(struct qwx_softc *sc)
1569 {
1570 	set_bit(ATH11K_FLAG_EXT_IRQ_ENABLED, sc->sc_flags);
1571 
1572 	/* In case of one MSI vector, we handle irq enable/disable in a
1573 	 * uniform way since we only have one irq
1574 	 */
1575 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1576 		return;
1577 
1578 	printf("%s not implemented\n", __func__);
1579 }
1580 
1581 void
1582 qwx_pcic_ce_irq_enable(struct qwx_softc *sc, uint16_t ce_id)
1583 {
1584 	/* In case of one MSI vector, we handle irq enable/disable in a
1585 	 * uniform way since we only have one irq
1586 	 */
1587 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1588 		return;
1589 
1590 	/* OpenBSD PCI stack does not yet implement MSI interrupt masking. */
1591 	sc->msi_ce_irqmask |= (1U << ce_id);
1592 }
1593 
1594 void
1595 qwx_pcic_ce_irq_disable(struct qwx_softc *sc, uint16_t ce_id)
1596 {
1597 	/* In case of one MSI vector, we handle irq enable/disable in a
1598 	 * uniform way since we only have one irq
1599 	 */
1600 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1601 		return;
1602 
1603 	/* OpenBSD PCI stack does not yet implement MSI interrupt masking. */
1604 	sc->msi_ce_irqmask &= ~(1U << ce_id);
1605 }
1606 
1607 void
1608 qwx_pcic_ext_grp_disable(struct qwx_ext_irq_grp *irq_grp)
1609 {
1610 	struct qwx_softc *sc = irq_grp->sc;
1611 
1612 	/* In case of one MSI vector, we handle irq enable/disable
1613 	 * in a uniform way since we only have one irq
1614 	 */
1615 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1616 		return;
1617 }
1618 
1619 int
1620 qwx_pcic_ext_irq_config(struct qwx_softc *sc, struct pci_attach_args *pa)
1621 {
1622 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1623 	int i, ret, num_vectors = 0;
1624 	uint32_t msi_data_start = 0;
1625 	uint32_t base_vector = 0;
1626 
1627 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1628 		return 0;
1629 
1630 	ret = qwx_pcic_get_user_msi_vector(sc, "DP", &num_vectors,
1631 	    &msi_data_start, &base_vector);
1632 	if (ret < 0)
1633 		return ret;
1634 
1635 	for (i = 0; i < nitems(sc->ext_irq_grp); i++) {
1636 		struct qwx_ext_irq_grp *irq_grp = &sc->ext_irq_grp[i];
1637 		uint32_t num_irq = 0;
1638 
1639 		irq_grp->sc = sc;
1640 		irq_grp->grp_id = i;
1641 #if 0
1642 		init_dummy_netdev(&irq_grp->napi_ndev);
1643 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
1644 			       ath11k_pcic_ext_grp_napi_poll);
1645 #endif
1646 		if (sc->hw_params.ring_mask->tx[i] ||
1647 		    sc->hw_params.ring_mask->rx[i] ||
1648 		    sc->hw_params.ring_mask->rx_err[i] ||
1649 		    sc->hw_params.ring_mask->rx_wbm_rel[i] ||
1650 		    sc->hw_params.ring_mask->reo_status[i] ||
1651 		    sc->hw_params.ring_mask->rxdma2host[i] ||
1652 		    sc->hw_params.ring_mask->host2rxdma[i] ||
1653 		    sc->hw_params.ring_mask->rx_mon_status[i]) {
1654 			num_irq = 1;
1655 		}
1656 
1657 		irq_grp->num_irq = num_irq;
1658 		irq_grp->irqs[0] = ATH11K_PCI_IRQ_DP_OFFSET + i;
1659 
1660 		if (num_irq) {
1661 			int irq_idx = irq_grp->irqs[0];
1662 			pci_intr_handle_t ih;
1663 
1664 			if (pci_intr_map_msivec(pa, irq_idx, &ih) != 0 &&
1665 			    pci_intr_map(pa, &ih) != 0) {
1666 				printf("%s: can't map interrupt\n",
1667 				    sc->sc_dev.dv_xname);
1668 				return EIO;
1669 			}
1670 
1671 			snprintf(psc->sc_ivname[irq_idx], sizeof(psc->sc_ivname[0]),
1672 			    "%s:ex%d", sc->sc_dev.dv_xname, i);
1673 			psc->sc_ih[irq_idx] = pci_intr_establish(psc->sc_pc, ih,
1674 			    IPL_NET, qwx_ext_intr, irq_grp, psc->sc_ivname[irq_idx]);
1675 			if (psc->sc_ih[irq_idx] == NULL) {
1676 				printf("%s: failed to request irq %d\n",
1677 				    sc->sc_dev.dv_xname, irq_idx);
1678 				return EIO;
1679 			}
1680 		}
1681 
1682 		qwx_pcic_ext_grp_disable(irq_grp);
1683 	}
1684 
1685 	return 0;
1686 }
1687 
1688 int
1689 qwx_pcic_config_irq(struct qwx_softc *sc, struct pci_attach_args *pa)
1690 {
1691 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1692 	struct qwx_ce_pipe *ce_pipe;
1693 	uint32_t msi_data_start;
1694 	uint32_t msi_data_count, msi_data_idx;
1695 	uint32_t msi_irq_start;
1696 	int i, ret, irq_idx;
1697 	pci_intr_handle_t ih;
1698 
1699 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1700 		return 0;
1701 
1702 	ret = qwx_pcic_get_user_msi_vector(sc, "CE", &msi_data_count,
1703 	    &msi_data_start, &msi_irq_start);
1704 	if (ret)
1705 		return ret;
1706 
1707 	/* Configure CE irqs */
1708 	for (i = 0, msi_data_idx = 0; i < sc->hw_params.ce_count; i++) {
1709 		if (qwx_ce_get_attr_flags(sc, i) & CE_ATTR_DIS_INTR)
1710 			continue;
1711 
1712 		ce_pipe = &sc->ce.ce_pipe[i];
1713 		irq_idx = ATH11K_PCI_IRQ_CE0_OFFSET + i;
1714 
1715 		if (pci_intr_map_msivec(pa, irq_idx, &ih) != 0 &&
1716 		    pci_intr_map(pa, &ih) != 0) {
1717 			printf("%s: can't map interrupt\n",
1718 			    sc->sc_dev.dv_xname);
1719 			return EIO;
1720 		}
1721 
1722 		snprintf(psc->sc_ivname[irq_idx], sizeof(psc->sc_ivname[0]),
1723 		    "%s:ce%d", sc->sc_dev.dv_xname, ce_pipe->pipe_num);
1724 		psc->sc_ih[irq_idx] = pci_intr_establish(psc->sc_pc, ih,
1725 		    IPL_NET, qwx_ce_intr, ce_pipe, psc->sc_ivname[irq_idx]);
1726 		if (psc->sc_ih[irq_idx] == NULL) {
1727 			printf("%s: failed to request irq %d\n",
1728 			    sc->sc_dev.dv_xname, irq_idx);
1729 			return EIO;
1730 		}
1731 
1732 		msi_data_idx++;
1733 
1734 		qwx_pcic_ce_irq_disable(sc, i);
1735 	}
1736 
1737 	ret = qwx_pcic_ext_irq_config(sc, pa);
1738 	if (ret)
1739 		return ret;
1740 
1741 	return 0;
1742 }
1743 
1744 void
1745 qwx_pcic_ce_irqs_enable(struct qwx_softc *sc)
1746 {
1747 	int i;
1748 
1749 	set_bit(ATH11K_FLAG_CE_IRQ_ENABLED, sc->sc_flags);
1750 
1751 	for (i = 0; i < sc->hw_params.ce_count; i++) {
1752 		if (qwx_ce_get_attr_flags(sc, i) & CE_ATTR_DIS_INTR)
1753 			continue;
1754 		qwx_pcic_ce_irq_enable(sc, i);
1755 	}
1756 }
1757 
1758 void
1759 qwx_pcic_ce_irqs_disable(struct qwx_softc *sc)
1760 {
1761 	int i;
1762 
1763 	clear_bit(ATH11K_FLAG_CE_IRQ_ENABLED, sc->sc_flags);
1764 
1765 	for (i = 0; i < sc->hw_params.ce_count; i++) {
1766 		if (qwx_ce_get_attr_flags(sc, i) & CE_ATTR_DIS_INTR)
1767 			continue;
1768 		qwx_pcic_ce_irq_disable(sc, i);
1769 	}
1770 }
1771 
1772 int
1773 qwx_pci_start(struct qwx_softc *sc)
1774 {
1775 	/* TODO: for now don't restore ASPM in case of single MSI
1776 	 * vector as MHI register reading in M2 causes system hang.
1777 	 */
1778 	if (test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1779 		qwx_pci_aspm_restore(sc);
1780 	else
1781 		DPRINTF("%s: leaving PCI ASPM disabled to avoid MHI M2 problems"
1782 		    "\n", sc->sc_dev.dv_xname);
1783 
1784 	set_bit(ATH11K_FLAG_DEVICE_INIT_DONE, sc->sc_flags);
1785 
1786 	qwx_ce_rx_post_buf(sc);
1787 	qwx_pcic_ce_irqs_enable(sc);
1788 
1789 	return 0;
1790 }
1791 
1792 void
1793 qwx_pcic_ce_irq_disable_sync(struct qwx_softc *sc)
1794 {
1795 	qwx_pcic_ce_irqs_disable(sc);
1796 #if 0
1797 	ath11k_pcic_sync_ce_irqs(ab);
1798 	ath11k_pcic_kill_tasklets(ab);
1799 #endif
1800 }
1801 
1802 void
1803 qwx_pci_stop(struct qwx_softc *sc)
1804 {
1805 	qwx_pcic_ce_irq_disable_sync(sc);
1806 	qwx_ce_cleanup_pipes(sc);
1807 }
1808 
1809 int
1810 qwx_pci_bus_wake_up(struct qwx_softc *sc)
1811 {
1812 	if (qwx_mhi_wake_db_clear_valid(sc))
1813 		qwx_mhi_device_wake(sc);
1814 
1815 	return 0;
1816 }
1817 
1818 void
1819 qwx_pci_bus_release(struct qwx_softc *sc)
1820 {
1821 	if (qwx_mhi_wake_db_clear_valid(sc))
1822 		qwx_mhi_device_zzz(sc);
1823 }
1824 
1825 uint32_t
1826 qwx_pci_get_window_start(struct qwx_softc *sc, uint32_t offset)
1827 {
1828 	if (!sc->hw_params.static_window_map)
1829 		return ATH11K_PCI_WINDOW_START;
1830 
1831 	if ((offset ^ HAL_SEQ_WCSS_UMAC_OFFSET) < ATH11K_PCI_WINDOW_RANGE_MASK)
1832 		/* if offset lies within DP register range, use 3rd window */
1833 		return 3 * ATH11K_PCI_WINDOW_START;
1834 	else if ((offset ^ HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(sc)) <
1835 		 ATH11K_PCI_WINDOW_RANGE_MASK)
1836 		 /* if offset lies within CE register range, use 2nd window */
1837 		return 2 * ATH11K_PCI_WINDOW_START;
1838 	else
1839 		return ATH11K_PCI_WINDOW_START;
1840 }
1841 
1842 void
1843 qwx_pci_select_window(struct qwx_softc *sc, uint32_t offset)
1844 {
1845 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1846 	uint32_t window = FIELD_GET(ATH11K_PCI_WINDOW_VALUE_MASK, offset);
1847 
1848 #if notyet
1849 	lockdep_assert_held(&ab_pci->window_lock);
1850 #endif
1851 
1852 	if (window != psc->register_window) {
1853 		qwx_pci_write(sc, ATH11K_PCI_WINDOW_REG_ADDRESS,
1854 		    ATH11K_PCI_WINDOW_ENABLE_BIT | window);
1855 		(void) qwx_pci_read(sc, ATH11K_PCI_WINDOW_REG_ADDRESS);
1856 		psc->register_window = window;
1857 	}
1858 }
1859 
1860 void
1861 qwx_pci_window_write32(struct qwx_softc *sc, uint32_t offset, uint32_t value)
1862 {
1863 	uint32_t window_start;
1864 
1865 	window_start = qwx_pci_get_window_start(sc, offset);
1866 
1867 	if (window_start == ATH11K_PCI_WINDOW_START) {
1868 #if notyet
1869 		spin_lock_bh(&ab_pci->window_lock);
1870 #endif
1871 		qwx_pci_select_window(sc, offset);
1872 		qwx_pci_write(sc, window_start +
1873 		    (offset & ATH11K_PCI_WINDOW_RANGE_MASK), value);
1874 #if notyet
1875 		spin_unlock_bh(&ab_pci->window_lock);
1876 #endif
1877 	} else {
1878 		qwx_pci_write(sc, window_start +
1879 		    (offset & ATH11K_PCI_WINDOW_RANGE_MASK), value);
1880 	}
1881 }
1882 
1883 uint32_t
1884 qwx_pci_window_read32(struct qwx_softc *sc, uint32_t offset)
1885 {
1886 	uint32_t window_start, val;
1887 
1888 	window_start = qwx_pci_get_window_start(sc, offset);
1889 
1890 	if (window_start == ATH11K_PCI_WINDOW_START) {
1891 #if notyet
1892 		spin_lock_bh(&ab_pci->window_lock);
1893 #endif
1894 		qwx_pci_select_window(sc, offset);
1895 		val = qwx_pci_read(sc, window_start +
1896 		    (offset & ATH11K_PCI_WINDOW_RANGE_MASK));
1897 #if notyet
1898 		spin_unlock_bh(&ab_pci->window_lock);
1899 #endif
1900 	} else {
1901 		val = qwx_pci_read(sc, window_start +
1902 		    (offset & ATH11K_PCI_WINDOW_RANGE_MASK));
1903 	}
1904 
1905 	return val;
1906 }
1907 
1908 void
1909 qwx_pci_select_static_window(struct qwx_softc *sc)
1910 {
1911 	uint32_t umac_window;
1912 	uint32_t ce_window;
1913 	uint32_t window;
1914 
1915 	umac_window = FIELD_GET(ATH11K_PCI_WINDOW_VALUE_MASK, HAL_SEQ_WCSS_UMAC_OFFSET);
1916 	ce_window = FIELD_GET(ATH11K_PCI_WINDOW_VALUE_MASK, HAL_CE_WFSS_CE_REG_BASE);
1917 	window = (umac_window << 12) | (ce_window << 6);
1918 
1919 	qwx_pci_write(sc, ATH11K_PCI_WINDOW_REG_ADDRESS,
1920 	    ATH11K_PCI_WINDOW_ENABLE_BIT | window);
1921 }
1922 
1923 void
1924 qwx_pci_soc_global_reset(struct qwx_softc *sc)
1925 {
1926 	uint32_t val, msecs;
1927 
1928 	val = qwx_pcic_read32(sc, PCIE_SOC_GLOBAL_RESET);
1929 
1930 	val |= PCIE_SOC_GLOBAL_RESET_V;
1931 
1932 	qwx_pcic_write32(sc, PCIE_SOC_GLOBAL_RESET, val);
1933 
1934 	/* TODO: exact time to sleep is uncertain */
1935 	msecs = 10;
1936 	DELAY(msecs * 1000);
1937 
1938 	/* Need to toggle V bit back otherwise stuck in reset status */
1939 	val &= ~PCIE_SOC_GLOBAL_RESET_V;
1940 
1941 	qwx_pcic_write32(sc, PCIE_SOC_GLOBAL_RESET, val);
1942 
1943 	DELAY(msecs * 1000);
1944 
1945 	val = qwx_pcic_read32(sc, PCIE_SOC_GLOBAL_RESET);
1946 	if (val == 0xffffffff)
1947 		printf("%s: link down error during global reset\n",
1948 		    sc->sc_dev.dv_xname);
1949 }
1950 
1951 void
1952 qwx_pci_clear_dbg_registers(struct qwx_softc *sc)
1953 {
1954 	uint32_t val;
1955 
1956 	/* read cookie */
1957 	val = qwx_pcic_read32(sc, PCIE_Q6_COOKIE_ADDR);
1958 	DPRINTF("%s: cookie:0x%x\n", sc->sc_dev.dv_xname, val);
1959 
1960 	val = qwx_pcic_read32(sc, WLAON_WARM_SW_ENTRY);
1961 	DPRINTF("%s: WLAON_WARM_SW_ENTRY 0x%x\n", sc->sc_dev.dv_xname, val);
1962 
1963 	/* TODO: exact time to sleep is uncertain */
1964 	DELAY(10 * 1000);
1965 
1966 	/* write 0 to WLAON_WARM_SW_ENTRY to prevent Q6 from
1967 	 * continuing warm path and entering dead loop.
1968 	 */
1969 	qwx_pcic_write32(sc, WLAON_WARM_SW_ENTRY, 0);
1970 	DELAY(10 * 1000);
1971 
1972 	val = qwx_pcic_read32(sc, WLAON_WARM_SW_ENTRY);
1973 	DPRINTF("%s: WLAON_WARM_SW_ENTRY 0x%x\n", sc->sc_dev.dv_xname, val);
1974 
1975 	/* A read clear register. clear the register to prevent
1976 	 * Q6 from entering wrong code path.
1977 	 */
1978 	val = qwx_pcic_read32(sc, WLAON_SOC_RESET_CAUSE_REG);
1979 	DPRINTF("%s: soc reset cause:%d\n", sc->sc_dev.dv_xname, val);
1980 }
1981 
1982 int
1983 qwx_pci_set_link_reg(struct qwx_softc *sc, uint32_t offset, uint32_t value,
1984     uint32_t mask)
1985 {
1986 	uint32_t v;
1987 	int i;
1988 
1989 	v = qwx_pcic_read32(sc, offset);
1990 	if ((v & mask) == value)
1991 		return 0;
1992 
1993 	for (i = 0; i < 10; i++) {
1994 		qwx_pcic_write32(sc, offset, (v & ~mask) | value);
1995 
1996 		v = qwx_pcic_read32(sc, offset);
1997 		if ((v & mask) == value)
1998 			return 0;
1999 
2000 		delay((2 * 1000));
2001 	}
2002 
2003 	DPRINTF("failed to set pcie link register 0x%08x: 0x%08x != 0x%08x\n",
2004 	    offset, v & mask, value);
2005 
2006 	return ETIMEDOUT;
2007 }
2008 
2009 int
2010 qwx_pci_fix_l1ss(struct qwx_softc *sc)
2011 {
2012 	int ret;
2013 
2014 	ret = qwx_pci_set_link_reg(sc,
2015 				      PCIE_QSERDES_COM_SYSCLK_EN_SEL_REG(sc),
2016 				      PCIE_QSERDES_COM_SYSCLK_EN_SEL_VAL,
2017 				      PCIE_QSERDES_COM_SYSCLK_EN_SEL_MSK);
2018 	if (ret) {
2019 		DPRINTF("failed to set sysclk: %d\n", ret);
2020 		return ret;
2021 	}
2022 
2023 	ret = qwx_pci_set_link_reg(sc,
2024 				      PCIE_PCS_OSC_DTCT_CONFIG1_REG(sc),
2025 				      PCIE_PCS_OSC_DTCT_CONFIG1_VAL,
2026 				      PCIE_PCS_OSC_DTCT_CONFIG_MSK);
2027 	if (ret) {
2028 		DPRINTF("failed to set dtct config1 error: %d\n", ret);
2029 		return ret;
2030 	}
2031 
2032 	ret = qwx_pci_set_link_reg(sc,
2033 				      PCIE_PCS_OSC_DTCT_CONFIG2_REG(sc),
2034 				      PCIE_PCS_OSC_DTCT_CONFIG2_VAL,
2035 				      PCIE_PCS_OSC_DTCT_CONFIG_MSK);
2036 	if (ret) {
2037 		DPRINTF("failed to set dtct config2: %d\n", ret);
2038 		return ret;
2039 	}
2040 
2041 	ret = qwx_pci_set_link_reg(sc,
2042 				      PCIE_PCS_OSC_DTCT_CONFIG4_REG(sc),
2043 				      PCIE_PCS_OSC_DTCT_CONFIG4_VAL,
2044 				      PCIE_PCS_OSC_DTCT_CONFIG_MSK);
2045 	if (ret) {
2046 		DPRINTF("failed to set dtct config4: %d\n", ret);
2047 		return ret;
2048 	}
2049 
2050 	return 0;
2051 }
2052 
2053 void
2054 qwx_pci_enable_ltssm(struct qwx_softc *sc)
2055 {
2056 	uint32_t val;
2057 	int i;
2058 
2059 	val = qwx_pcic_read32(sc, PCIE_PCIE_PARF_LTSSM);
2060 
2061 	/* PCIE link seems very unstable after the Hot Reset*/
2062 	for (i = 0; val != PARM_LTSSM_VALUE && i < 5; i++) {
2063 		if (val == 0xffffffff)
2064 			DELAY(5 * 1000);
2065 
2066 		qwx_pcic_write32(sc, PCIE_PCIE_PARF_LTSSM, PARM_LTSSM_VALUE);
2067 		val = qwx_pcic_read32(sc, PCIE_PCIE_PARF_LTSSM);
2068 	}
2069 
2070 	DPRINTF("%s: pci ltssm 0x%x\n", sc->sc_dev.dv_xname, val);
2071 
2072 	val = qwx_pcic_read32(sc, GCC_GCC_PCIE_HOT_RST);
2073 	val |= GCC_GCC_PCIE_HOT_RST_VAL;
2074 	qwx_pcic_write32(sc, GCC_GCC_PCIE_HOT_RST, val);
2075 	val = qwx_pcic_read32(sc, GCC_GCC_PCIE_HOT_RST);
2076 
2077 	DPRINTF("%s: pci pcie_hot_rst 0x%x\n", sc->sc_dev.dv_xname, val);
2078 
2079 	DELAY(5 * 1000);
2080 }
2081 
2082 void
2083 qwx_pci_clear_all_intrs(struct qwx_softc *sc)
2084 {
2085 	/* This is a WAR for PCIE Hotreset.
2086 	 * When target receive Hotreset, but will set the interrupt.
2087 	 * So when download SBL again, SBL will open Interrupt and
2088 	 * receive it, and crash immediately.
2089 	 */
2090 	qwx_pcic_write32(sc, PCIE_PCIE_INT_ALL_CLEAR, PCIE_INT_CLEAR_ALL);
2091 }
2092 
2093 void
2094 qwx_pci_set_wlaon_pwr_ctrl(struct qwx_softc *sc)
2095 {
2096 	uint32_t val;
2097 
2098 	val = qwx_pcic_read32(sc, WLAON_QFPROM_PWR_CTRL_REG);
2099 	val &= ~QFPROM_PWR_CTRL_VDD4BLOW_MASK;
2100 	qwx_pcic_write32(sc, WLAON_QFPROM_PWR_CTRL_REG, val);
2101 }
2102 
2103 void
2104 qwx_pci_force_wake(struct qwx_softc *sc)
2105 {
2106 	qwx_pcic_write32(sc, PCIE_SOC_WAKE_PCIE_LOCAL_REG, 1);
2107 	DELAY(5 * 1000);
2108 }
2109 
2110 void
2111 qwx_pci_sw_reset(struct qwx_softc *sc, bool power_on)
2112 {
2113 	DELAY(100 * 1000); /* msecs */
2114 
2115 	if (power_on) {
2116 		qwx_pci_enable_ltssm(sc);
2117 		qwx_pci_clear_all_intrs(sc);
2118 		qwx_pci_set_wlaon_pwr_ctrl(sc);
2119 		if (sc->hw_params.fix_l1ss)
2120 			qwx_pci_fix_l1ss(sc);
2121 	}
2122 
2123 	qwx_mhi_clear_vector(sc);
2124 	qwx_pci_clear_dbg_registers(sc);
2125 	qwx_pci_soc_global_reset(sc);
2126 	qwx_mhi_reset_device(sc, 0);
2127 }
2128 
2129 void
2130 qwx_pci_msi_config(struct qwx_softc *sc, bool enable)
2131 {
2132 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2133 	uint32_t val;
2134 
2135 	val = pci_conf_read(psc->sc_pc, psc->sc_tag,
2136 	    psc->sc_msi_off + PCI_MSI_MC);
2137 
2138 	if (enable)
2139 		val |= PCI_MSI_MC_MSIE;
2140 	else
2141 		val &= ~PCI_MSI_MC_MSIE;
2142 
2143 	pci_conf_write(psc->sc_pc, psc->sc_tag,  psc->sc_msi_off + PCI_MSI_MC,
2144 	    val);
2145 }
2146 
2147 void
2148 qwx_pci_msi_enable(struct qwx_softc *sc)
2149 {
2150 	qwx_pci_msi_config(sc, true);
2151 }
2152 
2153 void
2154 qwx_pci_msi_disable(struct qwx_softc *sc)
2155 {
2156 	qwx_pci_msi_config(sc, false);
2157 }
2158 
2159 void
2160 qwx_pci_aspm_disable(struct qwx_softc *sc)
2161 {
2162 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2163 
2164 	psc->sc_lcsr = pci_conf_read(psc->sc_pc, psc->sc_tag,
2165 	    psc->sc_cap_off + PCI_PCIE_LCSR);
2166 
2167 	DPRINTF("%s: pci link_ctl 0x%04x L0s %d L1 %d\n", sc->sc_dev.dv_xname,
2168 	    (uint16_t)psc->sc_lcsr, (psc->sc_lcsr & PCI_PCIE_LCSR_ASPM_L0S),
2169 	    (psc->sc_lcsr & PCI_PCIE_LCSR_ASPM_L1));
2170 
2171 	/* disable L0s and L1 */
2172 	pci_conf_write(psc->sc_pc, psc->sc_tag, psc->sc_cap_off + PCI_PCIE_LCSR,
2173 	    psc->sc_lcsr & ~(PCI_PCIE_LCSR_ASPM_L0S | PCI_PCIE_LCSR_ASPM_L1));
2174 
2175 	psc->sc_flags |= ATH11K_PCI_ASPM_RESTORE;
2176 }
2177 
2178 void
2179 qwx_pci_aspm_restore(struct qwx_softc *sc)
2180 {
2181 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2182 
2183 	if (psc->sc_flags & ATH11K_PCI_ASPM_RESTORE) {
2184 		pci_conf_write(psc->sc_pc, psc->sc_tag,
2185 		    psc->sc_cap_off + PCI_PCIE_LCSR, psc->sc_lcsr);
2186 		psc->sc_flags &= ~ATH11K_PCI_ASPM_RESTORE;
2187 	}
2188 }
2189 
2190 int
2191 qwx_pci_power_up(struct qwx_softc *sc)
2192 {
2193 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2194 	int error;
2195 
2196 	psc->register_window = 0;
2197 	clear_bit(ATH11K_FLAG_DEVICE_INIT_DONE, sc->sc_flags);
2198 
2199 	qwx_pci_sw_reset(sc, true);
2200 
2201 	/* Disable ASPM during firmware download due to problems switching
2202 	 * to AMSS state.
2203 	 */
2204 	qwx_pci_aspm_disable(sc);
2205 
2206 	qwx_pci_msi_enable(sc);
2207 
2208 	error = qwx_mhi_start(psc);
2209 	if (error)
2210 		return error;
2211 
2212 	if (sc->hw_params.static_window_map)
2213 		qwx_pci_select_static_window(sc);
2214 
2215 	return 0;
2216 }
2217 
2218 void
2219 qwx_pci_power_down(struct qwx_softc *sc)
2220 {
2221 	/* restore aspm in case firmware bootup fails */
2222 	qwx_pci_aspm_restore(sc);
2223 
2224 	qwx_pci_force_wake(sc);
2225 
2226 	qwx_pci_msi_disable(sc);
2227 
2228 	qwx_mhi_stop(sc);
2229 	clear_bit(ATH11K_FLAG_DEVICE_INIT_DONE, sc->sc_flags);
2230 	qwx_pci_sw_reset(sc, false);
2231 }
2232 
2233 /*
2234  * MHI
2235  */
2236 int
2237 qwx_mhi_register(struct qwx_softc *sc)
2238 {
2239 	DNPRINTF(QWX_D_MHI, "%s: STUB %s()\n", sc->sc_dev.dv_xname, __func__);
2240 	return 0;
2241 }
2242 
2243 void
2244 qwx_mhi_unregister(struct qwx_softc *sc)
2245 {
2246 	DNPRINTF(QWX_D_MHI, "%s: STUB %s()\n", sc->sc_dev.dv_xname, __func__);
2247 }
2248 
2249 // XXX MHI is GPLd - we provide a compatible bare-bones implementation
2250 #define MHI_CFG				0x10
2251 #define   MHI_CFG_NHWER_MASK		GENMASK(31, 24)
2252 #define   MHI_CFG_NHWER_SHFT		24
2253 #define   MHI_CFG_NER_MASK		GENMASK(23, 16)
2254 #define   MHI_CFG_NER_SHFT		16
2255 #define   MHI_CFG_NHWCH_MASK		GENMASK(15, 8)
2256 #define   MHI_CFG_NHWCH_SHFT		8
2257 #define   MHI_CFG_NCH_MASK		GENMASK(7, 0)
2258 #define MHI_CHDBOFF			0x18
2259 #define MHI_DEV_WAKE_DB			127
2260 #define MHI_ERDBOFF			0x20
2261 #define MHI_BHI_OFFSET			0x28
2262 #define   MHI_BHI_IMGADDR_LOW			0x08
2263 #define   MHI_BHI_IMGADDR_HIGH			0x0c
2264 #define   MHI_BHI_IMGSIZE			0x10
2265 #define   MHI_BHI_IMGTXDB			0x18
2266 #define   MHI_BHI_INTVEC			0x20
2267 #define   MHI_BHI_EXECENV			0x28
2268 #define   MHI_BHI_STATUS			0x2c
2269 #define	  MHI_BHI_SERIALNU			0x40
2270 #define MHI_BHIE_OFFSET			0x2c
2271 #define   MHI_BHIE_TXVECADDR_LOW_OFFS		0x2c
2272 #define   MHI_BHIE_TXVECADDR_HIGH_OFFS		0x30
2273 #define   MHI_BHIE_TXVECSIZE_OFFS		0x34
2274 #define   MHI_BHIE_TXVECDB_OFFS			0x3c
2275 #define   MHI_BHIE_TXVECSTATUS_OFFS		0x44
2276 #define   MHI_BHIE_RXVECADDR_LOW_OFFS		0x60
2277 #define   MHI_BHIE_RXVECSTATUS_OFFS		0x78
2278 #define MHI_CTRL			0x38
2279 #define    MHI_CTRL_READY_MASK			0x1
2280 #define    MHI_CTRL_RESET_MASK			0x2
2281 #define    MHI_CTRL_MHISTATE_MASK		GENMASK(15, 8)
2282 #define    MHI_CTRL_MHISTATE_SHFT		8
2283 #define MHI_STATUS			0x48
2284 #define    MHI_STATUS_MHISTATE_MASK		GENMASK(15, 8)
2285 #define    MHI_STATUS_MHISTATE_SHFT		8
2286 #define        MHI_STATE_RESET			0x0
2287 #define        MHI_STATE_READY			0x1
2288 #define        MHI_STATE_M0			0x2
2289 #define        MHI_STATE_M1			0x3
2290 #define        MHI_STATE_M2			0x4
2291 #define        MHI_STATE_M3			0x5
2292 #define        MHI_STATE_M3_FAST		0x6
2293 #define        MHI_STATE_BHI			0x7
2294 #define        MHI_STATE_SYS_ERR		0xff
2295 #define    MHI_STATUS_READY_MASK		0x1
2296 #define    MHI_STATUS_SYSERR_MASK		0x4
2297 #define MHI_CCABAP_LOWER		0x58
2298 #define MHI_CCABAP_HIGHER		0x5c
2299 #define MHI_ECABAP_LOWER		0x60
2300 #define MHI_ECABAP_HIGHER		0x64
2301 #define MHI_CRCBAP_LOWER		0x68
2302 #define MHI_CRCBAP_HIGHER		0x6c
2303 #define MHI_CRDB_LOWER			0x70
2304 #define MHI_CRDB_HIGHER			0x74
2305 #define MHI_CTRLBASE_LOWER		0x80
2306 #define MHI_CTRLBASE_HIGHER		0x84
2307 #define MHI_CTRLLIMIT_LOWER		0x88
2308 #define MHI_CTRLLIMIT_HIGHER		0x8c
2309 #define MHI_DATABASE_LOWER		0x98
2310 #define MHI_DATABASE_HIGHER		0x9c
2311 #define MHI_DATALIMIT_LOWER		0xa0
2312 #define MHI_DATALIMIT_HIGHER		0xa4
2313 
2314 #define MHI_EE_PBL	0x0	/* Primary Bootloader */
2315 #define MHI_EE_SBL	0x1	/* Secondary Bootloader */
2316 #define MHI_EE_AMSS	0x2	/* Modem, aka the primary runtime EE */
2317 #define MHI_EE_RDDM	0x3	/* Ram dump download mode */
2318 #define MHI_EE_WFW	0x4	/* WLAN firmware mode */
2319 #define MHI_EE_PTHRU	0x5	/* Passthrough */
2320 #define MHI_EE_EDL	0x6	/* Embedded downloader */
2321 #define MHI_EE_FP	0x7	/* Flash Programmer Environment */
2322 
2323 #define MHI_IN_PBL(e) (e == MHI_EE_PBL || e == MHI_EE_PTHRU || e == MHI_EE_EDL)
2324 #define MHI_POWER_UP_CAPABLE(e) (MHI_IN_PBL(e) || e == MHI_EE_AMSS)
2325 #define MHI_IN_MISSION_MODE(e) \
2326 	(e == MHI_EE_AMSS || e == MHI_EE_WFW || e == MHI_EE_FP)
2327 
2328 /* BHI register bits */
2329 #define MHI_BHI_TXDB_SEQNUM_BMSK	GENMASK(29, 0)
2330 #define MHI_BHI_TXDB_SEQNUM_SHFT	0
2331 #define MHI_BHI_STATUS_MASK		GENMASK(31, 30)
2332 #define MHI_BHI_STATUS_SHFT		30
2333 #define MHI_BHI_STATUS_ERROR		0x03
2334 #define MHI_BHI_STATUS_SUCCESS		0x02
2335 #define MHI_BHI_STATUS_RESET		0x00
2336 
2337 /* MHI BHIE registers */
2338 #define MHI_BHIE_MSMSOCID_OFFS		0x00
2339 #define MHI_BHIE_RXVECADDR_LOW_OFFS	0x60
2340 #define MHI_BHIE_RXVECADDR_HIGH_OFFS	0x64
2341 #define MHI_BHIE_RXVECSIZE_OFFS		0x68
2342 #define MHI_BHIE_RXVECDB_OFFS		0x70
2343 #define MHI_BHIE_RXVECSTATUS_OFFS	0x78
2344 
2345 /* BHIE register bits */
2346 #define MHI_BHIE_TXVECDB_SEQNUM_BMSK		GENMASK(29, 0)
2347 #define MHI_BHIE_TXVECDB_SEQNUM_SHFT		0
2348 #define MHI_BHIE_TXVECSTATUS_SEQNUM_BMSK	GENMASK(29, 0)
2349 #define MHI_BHIE_TXVECSTATUS_SEQNUM_SHFT	0
2350 #define MHI_BHIE_TXVECSTATUS_STATUS_BMSK	GENMASK(31, 30)
2351 #define MHI_BHIE_TXVECSTATUS_STATUS_SHFT	30
2352 #define MHI_BHIE_TXVECSTATUS_STATUS_RESET	0x00
2353 #define MHI_BHIE_TXVECSTATUS_STATUS_XFER_COMPL	0x02
2354 #define MHI_BHIE_TXVECSTATUS_STATUS_ERROR	0x03
2355 #define MHI_BHIE_RXVECDB_SEQNUM_BMSK		GENMASK(29, 0)
2356 #define MHI_BHIE_RXVECDB_SEQNUM_SHFT		0
2357 #define MHI_BHIE_RXVECSTATUS_SEQNUM_BMSK	GENMASK(29, 0)
2358 #define MHI_BHIE_RXVECSTATUS_SEQNUM_SHFT	0
2359 #define MHI_BHIE_RXVECSTATUS_STATUS_BMSK	GENMASK(31, 30)
2360 #define MHI_BHIE_RXVECSTATUS_STATUS_SHFT	30
2361 #define MHI_BHIE_RXVECSTATUS_STATUS_RESET	0x00
2362 #define MHI_BHIE_RXVECSTATUS_STATUS_XFER_COMPL	0x02
2363 #define MHI_BHIE_RXVECSTATUS_STATUS_ERROR	0x03
2364 
2365 #define MHI_EV_CC_INVALID	0x0
2366 #define MHI_EV_CC_SUCCESS	0x1
2367 #define MHI_EV_CC_EOT		0x2
2368 #define MHI_EV_CC_OVERFLOW	0x3
2369 #define MHI_EV_CC_EOB		0x4
2370 #define MHI_EV_CC_OOB		0x5
2371 #define MHI_EV_CC_DB_MODE	0x6
2372 #define MHI_EV_CC_UNDEFINED_ERR	0x10
2373 #define MHI_EV_CC_BAD_TRE	0x11
2374 
2375 #define MHI_CMD_NOP		01
2376 #define MHI_CMD_RESET_CHAN	16
2377 #define MHI_CMD_STOP_CHAN	17
2378 #define MHI_CMD_START_CHAN	18
2379 
2380 #define MHI_TRE_CMD_CHID_MASK	GENMASK(31, 24)
2381 #define MHI_TRE_CMD_CHID_SHFT	24
2382 #define MHI_TRE_CMD_CMDID_MASK	GENMASK(23, 16)
2383 #define MHI_TRE_CMD_CMDID_SHFT	16
2384 
2385 #define MHI_TRE0_EV_LEN_MASK	GENMASK(15, 0)
2386 #define MHI_TRE0_EV_LEN_SHFT	0
2387 #define MHI_TRE0_EV_CODE_MASK	GENMASK(31, 24)
2388 #define MHI_TRE0_EV_CODE_SHFT	24
2389 #define MHI_TRE1_EV_TYPE_MASK	GENMASK(23, 16)
2390 #define MHI_TRE1_EV_TYPE_SHFT	16
2391 #define MHI_TRE1_EV_CHID_MASK	GENMASK(31, 24)
2392 #define MHI_TRE1_EV_CHID_SHFT	24
2393 
2394 #define MHI_TRE0_DATA_LEN_MASK	GENMASK(15, 0)
2395 #define MHI_TRE0_DATA_LEN_SHFT	0
2396 #define MHI_TRE1_DATA_CHAIN	(1 << 0)
2397 #define MHI_TRE1_DATA_IEOB	(1 << 8)
2398 #define MHI_TRE1_DATA_IEOT	(1 << 9)
2399 #define MHI_TRE1_DATA_BEI	(1 << 10)
2400 #define MHI_TRE1_DATA_TYPE_MASK		GENMASK(23, 16)
2401 #define MHI_TRE1_DATA_TYPE_SHIFT	16
2402 #define MHI_TRE1_DATA_TYPE_TRANSFER	0x2
2403 
2404 #define MHI_PKT_TYPE_INVALID			0x00
2405 #define MHI_PKT_TYPE_NOOP_CMD			0x01
2406 #define MHI_PKT_TYPE_TRANSFER			0x02
2407 #define MHI_PKT_TYPE_COALESCING			0x08
2408 #define MHI_PKT_TYPE_RESET_CHAN_CMD		0x10
2409 #define MHI_PKT_TYPE_STOP_CHAN_CMD		0x11
2410 #define MHI_PKT_TYPE_START_CHAN_CMD		0x12
2411 #define MHI_PKT_TYPE_STATE_CHANGE_EVENT		0x20
2412 #define MHI_PKT_TYPE_CMD_COMPLETION_EVENT	0x21
2413 #define MHI_PKT_TYPE_TX_EVENT			0x22
2414 #define MHI_PKT_TYPE_RSC_TX_EVENT		0x28
2415 #define MHI_PKT_TYPE_EE_EVENT			0x40
2416 #define MHI_PKT_TYPE_TSYNC_EVENT		0x48
2417 #define MHI_PKT_TYPE_BW_REQ_EVENT		0x50
2418 
2419 
2420 #define MHI_DMA_VEC_CHUNK_SIZE			524288 /* 512 KB */
2421 struct qwx_dma_vec_entry {
2422 	uint64_t paddr;
2423 	uint64_t size;
2424 };
2425 
2426 void
2427 qwx_mhi_ring_doorbell(struct qwx_softc *sc, uint64_t db_addr, uint64_t val)
2428 {
2429 	qwx_pci_write(sc, db_addr + 4, val >> 32);
2430 	qwx_pci_write(sc, db_addr, val & 0xffffffff);
2431 }
2432 
2433 void
2434 qwx_mhi_device_wake(struct qwx_softc *sc)
2435 {
2436 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2437 
2438 	/*
2439 	 * Device wake is async only for now because we do not
2440 	 * keep track of PM state in software.
2441 	 */
2442 	qwx_mhi_ring_doorbell(sc, psc->wake_db, 1);
2443 }
2444 
2445 void
2446 qwx_mhi_device_zzz(struct qwx_softc *sc)
2447 {
2448 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2449 
2450 	qwx_mhi_ring_doorbell(sc, psc->wake_db, 0);
2451 }
2452 
2453 int
2454 qwx_mhi_wake_db_clear_valid(struct qwx_softc *sc)
2455 {
2456 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2457 
2458 	return (psc->mhi_state == MHI_STATE_M0); /* TODO other states? */
2459 }
2460 
2461 void
2462 qwx_mhi_init_xfer_rings(struct qwx_pci_softc *psc)
2463 {
2464 	struct qwx_softc *sc = &psc->sc_sc;
2465 	int i;
2466 	uint32_t chcfg;
2467 	struct qwx_pci_xfer_ring *ring;
2468 	struct qwx_mhi_chan_ctxt *cbase, *c;
2469 
2470 	cbase = (struct qwx_mhi_chan_ctxt *)QWX_DMA_KVA(psc->chan_ctxt);
2471 	for (i = 0; i < psc->max_chan; i++) {
2472 		c = &cbase[i];
2473 		chcfg = le32toh(c->chcfg);
2474 		chcfg &= ~(MHI_CHAN_CTX_CHSTATE_MASK |
2475 		    MHI_CHAN_CTX_BRSTMODE_MASK |
2476 		    MHI_CHAN_CTX_POLLCFG_MASK);
2477 		chcfg |= (MHI_CHAN_CTX_CHSTATE_DISABLED |
2478 		    (MHI_CHAN_CTX_BRSTMODE_DISABLE <<
2479 		    MHI_CHAN_CTX_BRSTMODE_SHFT));
2480 		c->chcfg = htole32(chcfg);
2481 		c->chtype = htole32(MHI_CHAN_TYPE_INVALID);
2482 		c->erindex = 0;
2483 	}
2484 
2485 	for (i = 0; i < nitems(psc->xfer_rings); i++) {
2486 		ring = &psc->xfer_rings[i];
2487 		KASSERT(ring->mhi_chan_id < psc->max_chan);
2488 		c = &cbase[ring->mhi_chan_id];
2489 		c->chtype = htole32(ring->mhi_chan_direction);
2490 		c->erindex = htole32(ring->mhi_chan_event_ring_index);
2491 		ring->chan_ctxt = c;
2492 	}
2493 
2494 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->chan_ctxt), 0,
2495 	    QWX_DMA_LEN(psc->chan_ctxt), BUS_DMASYNC_PREWRITE);
2496 }
2497 
2498 void
2499 qwx_mhi_init_event_rings(struct qwx_pci_softc *psc)
2500 {
2501 	struct qwx_softc *sc = &psc->sc_sc;
2502 	int i;
2503 	uint32_t intmod;
2504 	uint64_t paddr, len;
2505 	struct qwx_pci_event_ring *ring;
2506 	struct qwx_mhi_event_ctxt *c;
2507 
2508 	c = (struct qwx_mhi_event_ctxt *)QWX_DMA_KVA(psc->event_ctxt);
2509 	for (i = 0; i < nitems(psc->event_rings); i++, c++) {
2510 		ring = &psc->event_rings[i];
2511 
2512 		ring->event_ctxt = c;
2513 
2514 		intmod = le32toh(c->intmod);
2515 		intmod &= ~(MHI_EV_CTX_INTMODC_MASK | MHI_EV_CTX_INTMODT_MASK);
2516 		intmod |= (ring->mhi_er_irq_moderation_ms <<
2517 		    MHI_EV_CTX_INTMODT_SHFT) & MHI_EV_CTX_INTMODT_MASK;
2518 		c->intmod = htole32(intmod);
2519 
2520 		c->ertype = htole32(MHI_ER_TYPE_VALID);
2521 		c->msivec = htole32(ring->mhi_er_irq);
2522 
2523 		paddr = QWX_DMA_DVA(ring->dmamem);
2524 		ring->rp = paddr;
2525 		ring->wp = paddr + ring->size -
2526 		    sizeof(struct qwx_mhi_ring_element);
2527 		c->rbase = htole64(paddr);
2528 		c->rp = htole64(ring->rp);
2529 		c->wp = htole64(ring->wp);
2530 
2531 		len = sizeof(struct qwx_mhi_ring_element) * ring->num_elements;
2532 		c->rlen = htole64(len);
2533 	}
2534 
2535 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->event_ctxt), 0,
2536 	    QWX_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_PREWRITE);
2537 }
2538 
2539 void
2540 qwx_mhi_init_cmd_ring(struct qwx_pci_softc *psc)
2541 {
2542 	struct qwx_softc *sc = &psc->sc_sc;
2543 	struct qwx_pci_cmd_ring *ring = &psc->cmd_ring;
2544 	struct qwx_mhi_cmd_ctxt *c;
2545 	uint64_t paddr, len;
2546 
2547 	paddr = QWX_DMA_DVA(ring->dmamem);
2548 	len = ring->size;
2549 
2550 	ring->rp = ring->wp = paddr;
2551 
2552 	c = (struct qwx_mhi_cmd_ctxt *)QWX_DMA_KVA(psc->cmd_ctxt);
2553 	c->rbase = htole64(paddr);
2554 	c->rp = htole64(paddr);
2555 	c->wp = htole64(paddr);
2556 	c->rlen = htole64(len);
2557 
2558 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->cmd_ctxt), 0,
2559 	    QWX_DMA_LEN(psc->cmd_ctxt), BUS_DMASYNC_PREWRITE);
2560 }
2561 
2562 void
2563 qwx_mhi_init_dev_ctxt(struct qwx_pci_softc *psc)
2564 {
2565 	qwx_mhi_init_xfer_rings(psc);
2566 	qwx_mhi_init_event_rings(psc);
2567 	qwx_mhi_init_cmd_ring(psc);
2568 }
2569 
2570 void *
2571 qwx_pci_cmd_ring_get_elem(struct qwx_pci_cmd_ring *ring, uint64_t ptr)
2572 {
2573 	uint64_t base = QWX_DMA_DVA(ring->dmamem), offset;
2574 
2575 	if (ptr < base || ptr >= base + ring->size)
2576 		return NULL;
2577 
2578 	offset = ptr - base;
2579 	if (offset >= ring->size)
2580 		return NULL;
2581 
2582 	return QWX_DMA_KVA(ring->dmamem) + offset;
2583 }
2584 
2585 int
2586 qwx_mhi_cmd_ring_submit(struct qwx_pci_softc *psc,
2587     struct qwx_pci_cmd_ring *ring)
2588 {
2589 	struct qwx_softc *sc = &psc->sc_sc;
2590 	uint64_t base = QWX_DMA_DVA(ring->dmamem);
2591 	struct qwx_mhi_cmd_ctxt *c;
2592 
2593 	if (ring->queued >= ring->num_elements)
2594 		return 1;
2595 
2596 	if (ring->wp + sizeof(struct qwx_mhi_ring_element) >= base + ring->size)
2597 		ring->wp = base;
2598 	else
2599 		ring->wp += sizeof(struct qwx_mhi_ring_element);
2600 
2601 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->cmd_ctxt), 0,
2602 	    QWX_DMA_LEN(psc->cmd_ctxt), BUS_DMASYNC_POSTREAD);
2603 
2604 	c = (struct qwx_mhi_cmd_ctxt *)QWX_DMA_KVA(psc->cmd_ctxt);
2605 	c->wp = htole64(ring->wp);
2606 
2607 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->cmd_ctxt), 0,
2608 	    QWX_DMA_LEN(psc->cmd_ctxt), BUS_DMASYNC_PREWRITE);
2609 
2610 	ring->queued++;
2611 	qwx_mhi_ring_doorbell(sc, MHI_CRDB_LOWER, ring->wp);
2612 	return 0;
2613 }
2614 
2615 int
2616 qwx_mhi_send_cmd(struct qwx_pci_softc *psc, uint32_t cmd, uint32_t chan)
2617 {
2618 	struct qwx_softc *sc = &psc->sc_sc;
2619 	struct qwx_pci_cmd_ring	*ring = &psc->cmd_ring;
2620 	struct qwx_mhi_ring_element *e;
2621 
2622 	if (ring->queued >= ring->num_elements) {
2623 		printf("%s: command ring overflow\n", sc->sc_dev.dv_xname);
2624 		return 1;
2625 	}
2626 
2627 	e = qwx_pci_cmd_ring_get_elem(ring, ring->wp);
2628 	if (e == NULL)
2629 		return 1;
2630 
2631 	e->ptr = 0ULL;
2632 	e->dword[0] = 0;
2633 	e->dword[1] = htole32(
2634 	    ((chan << MHI_TRE_CMD_CHID_SHFT) & MHI_TRE_CMD_CHID_MASK) |
2635 	    ((cmd << MHI_TRE_CMD_CMDID_SHFT) & MHI_TRE_CMD_CMDID_MASK));
2636 
2637 	return qwx_mhi_cmd_ring_submit(psc, ring);
2638 }
2639 
2640 void *
2641 qwx_pci_xfer_ring_get_elem(struct qwx_pci_xfer_ring *ring, uint64_t wp)
2642 {
2643 	uint64_t base = QWX_DMA_DVA(ring->dmamem), offset;
2644 	void *addr = QWX_DMA_KVA(ring->dmamem);
2645 
2646 	if (wp < base)
2647 		return NULL;
2648 
2649 	offset = wp - base;
2650 	if (offset >= ring->size)
2651 		return NULL;
2652 
2653 	return addr + offset;
2654 }
2655 
2656 struct qwx_xfer_data *
2657 qwx_pci_xfer_ring_get_data(struct qwx_pci_xfer_ring *ring, uint64_t wp)
2658 {
2659 	uint64_t base = QWX_DMA_DVA(ring->dmamem), offset;
2660 
2661 	if (wp < base)
2662 		return NULL;
2663 
2664 	offset = wp - base;
2665 	if (offset >= ring->size)
2666 		return NULL;
2667 
2668 	return &ring->data[offset / sizeof(ring->data[0])];
2669 }
2670 
2671 int
2672 qwx_mhi_submit_xfer(struct qwx_softc *sc, struct mbuf *m)
2673 {
2674 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2675 	struct qwx_pci_xfer_ring *ring;
2676 	struct qwx_mhi_ring_element *e;
2677 	struct qwx_xfer_data *xfer;
2678 	uint64_t paddr, base;
2679 	int err;
2680 
2681 	ring = &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_OUTBOUND];
2682 
2683 	if (ring->queued >= ring->num_elements)
2684 		return 1;
2685 
2686 	if (m->m_pkthdr.len > QWX_PCI_XFER_MAX_DATA_SIZE) {
2687 		/* TODO: chunk xfers */
2688 		printf("%s: xfer too large: %d bytes\n", __func__, m->m_pkthdr.len);
2689 		return 1;
2690 
2691 	}
2692 
2693 	e = qwx_pci_xfer_ring_get_elem(ring, ring->wp);
2694 	if (e == NULL)
2695 		return 1;
2696 
2697 	xfer = qwx_pci_xfer_ring_get_data(ring, ring->wp);
2698 	if (xfer == NULL || xfer->m != NULL)
2699 		return 1;
2700 
2701 	err = bus_dmamap_load_mbuf(sc->sc_dmat, xfer->map, m,
2702 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
2703 	if (err && err != EFBIG) {
2704 		printf("%s: can't map mbuf (error %d)\n",
2705 		    sc->sc_dev.dv_xname, err);
2706 		return err;
2707 	}
2708 	if (err) {
2709 		/* Too many DMA segments, linearize mbuf. */
2710 		if (m_defrag(m, M_DONTWAIT))
2711 			return ENOBUFS;
2712 		err = bus_dmamap_load_mbuf(sc->sc_dmat, xfer->map, m,
2713 		    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
2714 		if (err) {
2715 			printf("%s: can't map mbuf (error %d)\n",
2716 			    sc->sc_dev.dv_xname, err);
2717 			return err;
2718 		}
2719 	}
2720 
2721 	bus_dmamap_sync(sc->sc_dmat, xfer->map, 0, m->m_pkthdr.len,
2722 	    BUS_DMASYNC_PREWRITE);
2723 
2724 	xfer->m = m;
2725 	paddr = xfer->map->dm_segs[0].ds_addr;
2726 
2727 	e->ptr = htole64(paddr);
2728 	e->dword[0] = htole32((m->m_pkthdr.len << MHI_TRE0_DATA_LEN_SHFT) &
2729 	    MHI_TRE0_DATA_LEN_MASK);
2730 	e->dword[1] = htole32(MHI_TRE1_DATA_IEOT |
2731 	    MHI_TRE1_DATA_TYPE_TRANSFER << MHI_TRE1_DATA_TYPE_SHIFT);
2732 
2733 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(ring->dmamem),
2734 	    0, QWX_DMA_LEN(ring->dmamem), BUS_DMASYNC_PREWRITE);
2735 
2736 	base = QWX_DMA_DVA(ring->dmamem);
2737 	if (ring->wp + sizeof(struct qwx_mhi_ring_element) >= base + ring->size)
2738 		ring->wp = base;
2739 	else
2740 		ring->wp += sizeof(struct qwx_mhi_ring_element);
2741 	ring->queued++;
2742 
2743 	ring->chan_ctxt->wp = htole64(ring->wp);
2744 
2745 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->chan_ctxt), 0,
2746 	    QWX_DMA_LEN(psc->chan_ctxt), BUS_DMASYNC_PREWRITE);
2747 
2748 	qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
2749 	return 0;
2750 }
2751 
2752 int
2753 qwx_mhi_start_channel(struct qwx_pci_softc *psc,
2754 	struct qwx_pci_xfer_ring *ring)
2755 {
2756 	struct qwx_softc *sc = &psc->sc_sc;
2757 	struct qwx_mhi_chan_ctxt *c;
2758 	int ret = 0;
2759 	uint32_t chcfg;
2760 	uint64_t paddr, len;
2761 
2762 	DNPRINTF(QWX_D_MHI, "%s: start MHI channel %d in state %d\n", __func__,
2763 	    ring->mhi_chan_id, ring->mhi_chan_state);
2764 
2765 	c = ring->chan_ctxt;
2766 
2767 	chcfg = le32toh(c->chcfg);
2768 	chcfg &= ~MHI_CHAN_CTX_CHSTATE_MASK;
2769 	chcfg |= MHI_CHAN_CTX_CHSTATE_ENABLED;
2770 	c->chcfg = htole32(chcfg);
2771 
2772 	paddr = QWX_DMA_DVA(ring->dmamem);
2773 	ring->rp = ring->wp = paddr;
2774 	c->rbase = htole64(paddr);
2775 	c->rp = htole64(ring->rp);
2776 	c->wp = htole64(ring->wp);
2777 	len = sizeof(struct qwx_mhi_ring_element) * ring->num_elements;
2778 	c->rlen = htole64(len);
2779 
2780 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->chan_ctxt), 0,
2781 	    QWX_DMA_LEN(psc->chan_ctxt), BUS_DMASYNC_PREWRITE);
2782 
2783 	ring->cmd_status = MHI_EV_CC_INVALID;
2784 	if (qwx_mhi_send_cmd(psc, MHI_CMD_START_CHAN, ring->mhi_chan_id))
2785 		return 1;
2786 
2787 	while (ring->cmd_status != MHI_EV_CC_SUCCESS) {
2788 		ret = tsleep_nsec(&ring->cmd_status, 0, "qwxcmd",
2789 		    SEC_TO_NSEC(5));
2790 		if (ret)
2791 			break;
2792 	}
2793 
2794 	if (ret) {
2795 		printf("%s: could not start MHI channel %d in state %d: status 0x%x\n",
2796 		    sc->sc_dev.dv_xname, ring->mhi_chan_id,
2797 		    ring->mhi_chan_state, ring->cmd_status);
2798 		return 1;
2799 	}
2800 
2801 	if (ring->mhi_chan_direction == MHI_CHAN_TYPE_INBOUND) {
2802 		uint64_t wp = QWX_DMA_DVA(ring->dmamem);
2803 		int i;
2804 
2805 		for (i = 0; i < ring->num_elements; i++) {
2806 			struct qwx_mhi_ring_element *e;
2807 			struct qwx_xfer_data *xfer;
2808 			uint64_t paddr;
2809 
2810 			e = qwx_pci_xfer_ring_get_elem(ring, wp);
2811 			xfer = qwx_pci_xfer_ring_get_data(ring, wp);
2812 			paddr = xfer->map->dm_segs[0].ds_addr;
2813 
2814 			e->ptr = htole64(paddr);
2815 			e->dword[0] = htole32((QWX_PCI_XFER_MAX_DATA_SIZE <<
2816 			    MHI_TRE0_DATA_LEN_SHFT) &
2817 			    MHI_TRE0_DATA_LEN_MASK);
2818 			e->dword[1] = htole32(MHI_TRE1_DATA_IEOT |
2819 			    MHI_TRE1_DATA_BEI |
2820 			    MHI_TRE1_DATA_TYPE_TRANSFER <<
2821 			    MHI_TRE1_DATA_TYPE_SHIFT);
2822 
2823 			ring->wp = wp;
2824 			wp += sizeof(*e);
2825 		}
2826 
2827 		bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(ring->dmamem), 0,
2828 		    QWX_DMA_LEN(ring->dmamem), BUS_DMASYNC_PREWRITE);
2829 
2830 		qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
2831 	}
2832 
2833 	return 0;
2834 }
2835 
2836 int
2837 qwx_mhi_start_channels(struct qwx_pci_softc *psc)
2838 {
2839 	struct qwx_pci_xfer_ring *ring;
2840 	int ret = 0;
2841 
2842 	qwx_mhi_device_wake(&psc->sc_sc);
2843 
2844 	ring = &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_OUTBOUND];
2845 	if (qwx_mhi_start_channel(psc, ring)) {
2846 		ret = 1;
2847 		goto done;
2848 	}
2849 
2850 	ring = &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_INBOUND];
2851 	if (qwx_mhi_start_channel(psc, ring))
2852 		ret = 1;
2853 done:
2854 	qwx_mhi_device_zzz(&psc->sc_sc);
2855 	return ret;
2856 }
2857 
2858 int
2859 qwx_mhi_start(struct qwx_pci_softc *psc)
2860 {
2861 	struct qwx_softc *sc = &psc->sc_sc;
2862 	uint32_t off;
2863 	uint32_t ee, state;
2864 	int ret;
2865 
2866 	qwx_mhi_init_dev_ctxt(psc);
2867 
2868 	psc->bhi_off = qwx_pci_read(sc, MHI_BHI_OFFSET);
2869 	DNPRINTF(QWX_D_MHI, "%s: BHI offset 0x%x\n", __func__, psc->bhi_off);
2870 
2871 	psc->bhie_off = qwx_pci_read(sc, MHI_BHIE_OFFSET);
2872 	DNPRINTF(QWX_D_MHI, "%s: BHIE offset 0x%x\n", __func__, psc->bhie_off);
2873 
2874 	/* Clean BHIE RX registers */
2875 	for (off = MHI_BHIE_RXVECADDR_LOW_OFFS;
2876 	     off < (MHI_BHIE_RXVECSTATUS_OFFS - 4);
2877 	     off += 4)
2878 	     	qwx_pci_write(sc, psc->bhie_off + off, 0x0);
2879 
2880 	qwx_rddm_prepare(psc);
2881 
2882 	/* Program BHI INTVEC */
2883 	qwx_pci_write(sc, psc->bhi_off + MHI_BHI_INTVEC, 0x00);
2884 
2885 	/*
2886 	 * Get BHI execution environment and confirm that it is valid
2887 	 * for power on.
2888 	 */
2889 	ee = qwx_pci_read(sc, psc->bhi_off + MHI_BHI_EXECENV);
2890 	if (!MHI_POWER_UP_CAPABLE(ee)) {
2891 		printf("%s: invalid EE for power on: 0x%x\n",
2892 		     sc->sc_dev.dv_xname, ee);
2893 		return 1;
2894 	}
2895 
2896 	/*
2897 	 * Get MHI state of the device and reset it if it is in system
2898 	 * error.
2899 	 */
2900 	state = qwx_pci_read(sc, MHI_STATUS);
2901 	DNPRINTF(QWX_D_MHI, "%s: MHI power on with EE: 0x%x, status: 0x%x\n",
2902 	     sc->sc_dev.dv_xname, ee, state);
2903 	state = (state & MHI_STATUS_MHISTATE_MASK) >> MHI_STATUS_MHISTATE_SHFT;
2904 	if (state == MHI_STATE_SYS_ERR) {
2905 		if (qwx_mhi_reset_device(sc, 0))
2906 			return 1;
2907 		state = qwx_pci_read(sc, MHI_STATUS);
2908 		DNPRINTF(QWX_D_MHI, "%s: MHI state after reset: 0x%x\n",
2909 		    sc->sc_dev.dv_xname, state);
2910 		state = (state & MHI_STATUS_MHISTATE_MASK) >>
2911 		    MHI_STATUS_MHISTATE_SHFT;
2912 		if (state == MHI_STATE_SYS_ERR) {
2913 			printf("%s: MHI stuck in system error state\n",
2914 			    sc->sc_dev.dv_xname);
2915 			return 1;
2916 		}
2917 	}
2918 
2919 	psc->bhi_ee = ee;
2920 	psc->mhi_state = state;
2921 
2922 #if notyet
2923 	/* Enable IRQs */
2924 	//  XXX todo?
2925 #endif
2926 
2927 	/* Transition to primary runtime. */
2928 	 if (MHI_IN_PBL(ee)) {
2929 		ret = qwx_mhi_fw_load_handler(psc);
2930 		if (ret)
2931 			return ret;
2932 	} else {
2933 		/* XXX Handle partially initialized device...?!? */
2934 		ee = qwx_pci_read(sc, psc->bhi_off + MHI_BHI_EXECENV);
2935 		if (!MHI_IN_MISSION_MODE(ee)) {
2936 			printf("%s: failed to power up MHI, ee=0x%x\n",
2937 			    sc->sc_dev.dv_xname, ee);
2938 			return EIO;
2939 		}
2940 	}
2941 
2942 	return 0;
2943 }
2944 
2945 void
2946 qwx_mhi_stop(struct qwx_softc *sc)
2947 {
2948 	qwx_mhi_reset_device(sc, 1);
2949 }
2950 
2951 int
2952 qwx_mhi_reset_device(struct qwx_softc *sc, int force)
2953 {
2954 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2955 	uint32_t reg;
2956 	int ret = 0;
2957 
2958 	reg = qwx_pcic_read32(sc, MHI_STATUS);
2959 
2960 	DNPRINTF(QWX_D_MHI, "%s: MHISTATUS 0x%x\n", sc->sc_dev.dv_xname, reg);
2961 	/*
2962 	 * Observed on QCA6390 that after SOC_GLOBAL_RESET, MHISTATUS
2963 	 * has SYSERR bit set and thus need to set MHICTRL_RESET
2964 	 * to clear SYSERR.
2965 	 */
2966 	if (force || (reg & MHI_STATUS_SYSERR_MASK)) {
2967 		/* Trigger MHI Reset in device. */
2968 		qwx_pcic_write32(sc, MHI_CTRL, MHI_CTRL_RESET_MASK);
2969 
2970 		/* Wait for the reset bit to be cleared by the device. */
2971 		ret = qwx_mhi_await_device_reset(sc);
2972 		if (ret)
2973 			return ret;
2974 
2975 		if (psc->bhi_off == 0)
2976 			psc->bhi_off = qwx_pci_read(sc, MHI_BHI_OFFSET);
2977 
2978 		/* Device clear BHI INTVEC so re-program it. */
2979 		qwx_pci_write(sc, psc->bhi_off + MHI_BHI_INTVEC, 0x00);
2980 	}
2981 
2982 	return 0;
2983 }
2984 
2985 static inline void
2986 qwx_mhi_reset_txvecdb(struct qwx_softc *sc)
2987 {
2988 	qwx_pcic_write32(sc, PCIE_TXVECDB, 0);
2989 }
2990 
2991 static inline void
2992 qwx_mhi_reset_txvecstatus(struct qwx_softc *sc)
2993 {
2994 	qwx_pcic_write32(sc, PCIE_TXVECSTATUS, 0);
2995 }
2996 
2997 static inline void
2998 qwx_mhi_reset_rxvecdb(struct qwx_softc *sc)
2999 {
3000 	qwx_pcic_write32(sc, PCIE_RXVECDB, 0);
3001 }
3002 
3003 static inline void
3004 qwx_mhi_reset_rxvecstatus(struct qwx_softc *sc)
3005 {
3006 	qwx_pcic_write32(sc, PCIE_RXVECSTATUS, 0);
3007 }
3008 
3009 void
3010 qwx_mhi_clear_vector(struct qwx_softc *sc)
3011 {
3012 	qwx_mhi_reset_txvecdb(sc);
3013 	qwx_mhi_reset_txvecstatus(sc);
3014 	qwx_mhi_reset_rxvecdb(sc);
3015 	qwx_mhi_reset_rxvecstatus(sc);
3016 }
3017 
3018 int
3019 qwx_mhi_fw_load_handler(struct qwx_pci_softc *psc)
3020 {
3021 	struct qwx_softc *sc = &psc->sc_sc;
3022 	int ret;
3023 	char amss_path[PATH_MAX];
3024 	u_char *data;
3025 	size_t len;
3026 
3027 	ret = snprintf(amss_path, sizeof(amss_path), "%s-%s-%s",
3028 	    ATH11K_FW_DIR, sc->hw_params.fw.dir, ATH11K_AMSS_FILE);
3029 	if (ret < 0 || ret >= sizeof(amss_path))
3030 		return ENOSPC;
3031 
3032 	ret = loadfirmware(amss_path, &data, &len);
3033 	if (ret) {
3034 		printf("%s: could not read %s (error %d)\n",
3035 		    sc->sc_dev.dv_xname, amss_path, ret);
3036 		return ret;
3037 	}
3038 
3039 	if (len < MHI_DMA_VEC_CHUNK_SIZE) {
3040 		printf("%s: %s is too short, have only %zu bytes\n",
3041 		    sc->sc_dev.dv_xname, amss_path, len);
3042 		free(data, M_DEVBUF, len);
3043 		return EINVAL;
3044 	}
3045 
3046 	/* Second-stage boot loader sits in the first 512 KB of image. */
3047 	ret = qwx_mhi_fw_load_bhi(psc, data, MHI_DMA_VEC_CHUNK_SIZE);
3048 	if (ret != 0) {
3049 		printf("%s: could not load firmware %s\n",
3050 		    sc->sc_dev.dv_xname, amss_path);
3051 		free(data, M_DEVBUF, len);
3052 		return ret;
3053 	}
3054 
3055 	while (psc->bhi_ee < MHI_EE_SBL) {
3056 		ret = tsleep_nsec(&psc->bhi_ee, 0, "qwxsbl",
3057 		    SEC_TO_NSEC(2));
3058 		if (ret)
3059 			break;
3060 	}
3061 	if (ret != 0) {
3062 		printf("%s: device failed to start secondary bootloader\n",
3063 		    sc->sc_dev.dv_xname);
3064 		free(data, M_DEVBUF, len);
3065 		return ret;
3066 	}
3067 
3068 	/* Now load the full image. */
3069 	ret = qwx_mhi_fw_load_bhie(psc, data, len);
3070 	if (ret != 0) {
3071 		printf("%s: could not load firmware %s\n",
3072 		    sc->sc_dev.dv_xname, amss_path);
3073 	}
3074 
3075 	while (psc->bhi_ee < MHI_EE_AMSS) {
3076 		ret = tsleep_nsec(&psc->bhi_ee, 0, "qwxamss",
3077 		    SEC_TO_NSEC(5));
3078 		if (ret)
3079 			break;
3080 	}
3081 	if (ret != 0) {
3082 		printf("%s: device failed to enter AMSS EE\n",
3083 		    sc->sc_dev.dv_xname);
3084 		free(data, M_DEVBUF, len);
3085 		return ret;
3086 	}
3087 
3088 	free(data, M_DEVBUF, len);
3089 	return ret;
3090 }
3091 
3092 int
3093 qwx_mhi_await_device_reset(struct qwx_softc *sc)
3094 {
3095 	const uint32_t msecs = 24, retries = 2;
3096 	uint32_t reg;
3097 	int timeout;
3098 
3099 	/* Poll for CTRL RESET to clear. */
3100 	timeout = retries;
3101 	while (timeout > 0) {
3102 		reg = qwx_pci_read(sc, MHI_CTRL);
3103 		DNPRINTF(QWX_D_MHI, "%s: MHI_CTRL is 0x%x\n", __func__, reg);
3104 		if ((reg & MHI_CTRL_RESET_MASK) == 0)
3105 			break;
3106 		DELAY((msecs / retries) * 1000);
3107 		timeout--;
3108 	}
3109 	if (timeout == 0) {
3110 		DNPRINTF(QWX_D_MHI, "%s: MHI reset failed\n", __func__);
3111 		return ETIMEDOUT;
3112 	}
3113 
3114 	return 0;
3115 }
3116 
3117 int
3118 qwx_mhi_await_device_ready(struct qwx_softc *sc)
3119 {
3120 	uint32_t reg;
3121 	int timeout;
3122 	const uint32_t msecs = 2000, retries = 4;
3123 
3124 
3125 	/* Poll for READY to be set. */
3126 	timeout = retries;
3127 	while (timeout > 0) {
3128 		reg = qwx_pci_read(sc, MHI_STATUS);
3129 		DNPRINTF(QWX_D_MHI, "%s: MHI_STATUS is 0x%x\n", __func__, reg);
3130 		if (reg & MHI_STATUS_READY_MASK) {
3131 			reg &= ~MHI_STATUS_READY_MASK;
3132 			qwx_pci_write(sc, MHI_STATUS, reg);
3133 			break;
3134 		}
3135 		DELAY((msecs / retries) * 1000);
3136 		timeout--;
3137 	}
3138 	if (timeout == 0) {
3139 		printf("%s: MHI not ready\n", sc->sc_dev.dv_xname);
3140 		return ETIMEDOUT;
3141 	}
3142 
3143 	return 0;
3144 }
3145 
3146 void
3147 qwx_mhi_ready_state_transition(struct qwx_pci_softc *psc)
3148 {
3149 	struct qwx_softc *sc = &psc->sc_sc;
3150 	int ret, i;
3151 
3152 	ret = qwx_mhi_await_device_reset(sc);
3153 	if (ret)
3154 		return;
3155 
3156 	ret = qwx_mhi_await_device_ready(sc);
3157 	if (ret)
3158 		return;
3159 
3160 	/* Set up memory-mapped IO for channels, events, etc. */
3161 	qwx_mhi_init_mmio(psc);
3162 
3163 	/* Notify event rings. */
3164 	for (i = 0; i < nitems(psc->event_rings); i++) {
3165 		struct qwx_pci_event_ring *ring = &psc->event_rings[i];
3166 		qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
3167 	}
3168 
3169 	/*
3170 	 * Set the device into M0 state. The device will transition
3171 	 * into M0 and the execution environment will switch to SBL.
3172 	 */
3173 	qwx_mhi_set_state(sc, MHI_STATE_M0);
3174 }
3175 
3176 void
3177 qwx_mhi_ee_amss_state_transition(struct qwx_pci_softc *psc)
3178 {
3179 	qwx_mhi_start_channels(psc);
3180 }
3181 
3182 void
3183 qwx_mhi_mission_mode_state_transition(struct qwx_pci_softc *psc)
3184 {
3185 	struct qwx_softc *sc = &psc->sc_sc;
3186 	int i;
3187 
3188 	qwx_mhi_device_wake(sc);
3189 
3190 	/* Notify event rings. */
3191 	for (i = 0; i < nitems(psc->event_rings); i++) {
3192 		struct qwx_pci_event_ring *ring = &psc->event_rings[i];
3193 		qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
3194 	}
3195 
3196 	/* TODO: Notify transfer/command rings? */
3197 
3198 	qwx_mhi_device_zzz(sc);
3199 }
3200 
3201 void
3202 qwx_mhi_low_power_mode_state_transition(struct qwx_pci_softc *psc)
3203 {
3204 	struct qwx_softc *sc = &psc->sc_sc;
3205 
3206 	qwx_mhi_set_state(sc, MHI_STATE_M2);
3207 }
3208 
3209 void
3210 qwx_mhi_set_state(struct qwx_softc *sc, uint32_t state)
3211 {
3212 	uint32_t reg;
3213 
3214 	reg = qwx_pci_read(sc, MHI_CTRL);
3215 
3216 	if (state != MHI_STATE_RESET) {
3217 		reg &= ~MHI_CTRL_MHISTATE_MASK;
3218 		reg |= (state << MHI_CTRL_MHISTATE_SHFT) & MHI_CTRL_MHISTATE_MASK;
3219 	} else
3220 		reg |= MHI_CTRL_RESET_MASK;
3221 
3222 	qwx_pci_write(sc, MHI_CTRL, reg);
3223 }
3224 
3225 void
3226 qwx_mhi_init_mmio(struct qwx_pci_softc *psc)
3227 {
3228 	struct qwx_softc *sc = &psc->sc_sc;
3229 	uint64_t paddr;
3230 	uint32_t reg;
3231 	int i;
3232 
3233 	reg = qwx_pci_read(sc, MHI_CHDBOFF);
3234 
3235 	/* Set device wake doorbell address. */
3236 	psc->wake_db = reg + 8 * MHI_DEV_WAKE_DB;
3237 
3238 	/* Set doorbell address for each transfer ring. */
3239 	for (i = 0; i < nitems(psc->xfer_rings); i++) {
3240 		struct qwx_pci_xfer_ring *ring = &psc->xfer_rings[i];
3241 		ring->db_addr = reg + (8 * ring->mhi_chan_id);
3242 	}
3243 
3244 	reg = qwx_pci_read(sc, MHI_ERDBOFF);
3245 	/* Set doorbell address for each event ring. */
3246 	for (i = 0; i < nitems(psc->event_rings); i++) {
3247 		struct qwx_pci_event_ring *ring = &psc->event_rings[i];
3248 		ring->db_addr = reg + (8 * i);
3249 	}
3250 
3251 	paddr = QWX_DMA_DVA(psc->chan_ctxt);
3252 	qwx_pci_write(sc, MHI_CCABAP_HIGHER, paddr >> 32);
3253 	qwx_pci_write(sc, MHI_CCABAP_LOWER, paddr & 0xffffffff);
3254 
3255 	paddr = QWX_DMA_DVA(psc->event_ctxt);
3256 	qwx_pci_write(sc, MHI_ECABAP_HIGHER, paddr >> 32);
3257 	qwx_pci_write(sc, MHI_ECABAP_LOWER, paddr & 0xffffffff);
3258 
3259 	paddr = QWX_DMA_DVA(psc->cmd_ctxt);
3260 	qwx_pci_write(sc, MHI_CRCBAP_HIGHER, paddr >> 32);
3261 	qwx_pci_write(sc, MHI_CRCBAP_LOWER, paddr & 0xffffffff);
3262 
3263 	/* Not (yet?) using fixed memory space from a device-tree. */
3264 	qwx_pci_write(sc, MHI_CTRLBASE_HIGHER, 0);
3265 	qwx_pci_write(sc, MHI_CTRLBASE_LOWER, 0);
3266 	qwx_pci_write(sc, MHI_DATABASE_HIGHER, 0);
3267 	qwx_pci_write(sc, MHI_DATABASE_LOWER, 0);
3268 	qwx_pci_write(sc, MHI_CTRLLIMIT_HIGHER, 0x0);
3269 	qwx_pci_write(sc, MHI_CTRLLIMIT_LOWER, 0xffffffff);
3270 	qwx_pci_write(sc, MHI_DATALIMIT_HIGHER, 0x0);
3271 	qwx_pci_write(sc, MHI_DATALIMIT_LOWER, 0xffffffff);
3272 
3273 	reg = qwx_pci_read(sc, MHI_CFG);
3274 	reg &= ~(MHI_CFG_NER_MASK | MHI_CFG_NHWER_MASK);
3275 	reg |= QWX_NUM_EVENT_CTX << MHI_CFG_NER_SHFT;
3276 	qwx_pci_write(sc, MHI_CFG, reg);
3277 }
3278 
3279 int
3280 qwx_mhi_fw_load_bhi(struct qwx_pci_softc *psc, uint8_t *data, size_t len)
3281 {
3282 	struct qwx_softc *sc = &psc->sc_sc;
3283 	struct qwx_dmamem *data_adm;
3284 	uint32_t seq, reg, status = MHI_BHI_STATUS_RESET;
3285 	uint64_t paddr;
3286 	int ret;
3287 
3288 	data_adm = qwx_dmamem_alloc(sc->sc_dmat, len, 0);
3289 	if (data_adm == NULL) {
3290 		printf("%s: could not allocate BHI DMA data buffer\n",
3291 		    sc->sc_dev.dv_xname);
3292 		return 1;
3293 	}
3294 
3295 	/* Copy firmware image to DMA memory. */
3296 	memcpy(QWX_DMA_KVA(data_adm), data, len);
3297 
3298 	qwx_pci_write(sc, psc->bhi_off + MHI_BHI_STATUS, 0);
3299 
3300 	/* Set data physical address and length. */
3301 	paddr = QWX_DMA_DVA(data_adm);
3302 	qwx_pci_write(sc, psc->bhi_off + MHI_BHI_IMGADDR_HIGH, paddr >> 32);
3303 	qwx_pci_write(sc, psc->bhi_off + MHI_BHI_IMGADDR_LOW,
3304 	    paddr & 0xffffffff);
3305 	qwx_pci_write(sc, psc->bhi_off + MHI_BHI_IMGSIZE, len);
3306 
3307 	/* Set a random transaction sequence number. */
3308 	do {
3309 		seq = arc4random_uniform(MHI_BHI_TXDB_SEQNUM_BMSK);
3310 	} while (seq == 0);
3311 	qwx_pci_write(sc, psc->bhi_off + MHI_BHI_IMGTXDB, seq);
3312 
3313 	/* Wait for completion. */
3314 	ret = 0;
3315 	while (status != MHI_BHI_STATUS_SUCCESS) {
3316 		ret = tsleep_nsec(&psc->bhi_off, 0, "qwxbhi",
3317 		    SEC_TO_NSEC(1));
3318 		if (ret)
3319 			break;
3320 
3321 		reg = qwx_pci_read(sc, psc->bhi_off + MHI_BHI_STATUS);
3322 		status = (reg & MHI_BHI_STATUS_MASK) >> MHI_BHI_STATUS_SHFT;
3323 		DNPRINTF(QWX_D_MHI, "%s: BHI status is 0x%x\n",
3324 		    __func__, status);
3325 	}
3326 
3327 	qwx_dmamem_free(sc->sc_dmat, data_adm);
3328 
3329 	if (ret) {
3330 		printf("%s: BHI load timeout\n", sc->sc_dev.dv_xname);
3331 		return ret;
3332 	}
3333 	return 0;
3334 }
3335 
3336 int
3337 qwx_mhi_fw_load_bhie(struct qwx_pci_softc *psc, uint8_t *data, size_t len)
3338 {
3339 	struct qwx_softc *sc = &psc->sc_sc;
3340 	struct qwx_dma_vec_entry *vec;
3341 	uint32_t seq, reg, state = MHI_BHIE_TXVECSTATUS_STATUS_RESET;
3342 	uint64_t paddr;
3343 	const size_t chunk_size = MHI_DMA_VEC_CHUNK_SIZE;
3344 	size_t nseg, remain, vec_size;
3345 	int i, ret;
3346 
3347 	nseg = howmany(len, chunk_size);
3348 	if (nseg == 0) {
3349 		printf("%s: BHIE data too short, have only %zu bytes\n",
3350 		    sc->sc_dev.dv_xname, len);
3351 		return 1;
3352 	}
3353 
3354 	if (psc->amss_data == NULL || QWX_DMA_LEN(psc->amss_data) < len) {
3355 		if (psc->amss_data)
3356 			qwx_dmamem_free(sc->sc_dmat, psc->amss_data);
3357 		psc->amss_data = qwx_dmamem_alloc(sc->sc_dmat, len, 0);
3358 		if (psc->amss_data == NULL) {
3359 			printf("%s: could not allocate BHIE DMA data buffer\n",
3360 			    sc->sc_dev.dv_xname);
3361 			return 1;
3362 		}
3363 	}
3364 
3365 	vec_size = nseg * sizeof(*vec);
3366 	if (psc->amss_vec == NULL || QWX_DMA_LEN(psc->amss_vec) < vec_size) {
3367 		if (psc->amss_vec)
3368 			qwx_dmamem_free(sc->sc_dmat, psc->amss_vec);
3369 		psc->amss_vec = qwx_dmamem_alloc(sc->sc_dmat, vec_size, 0);
3370 		if (psc->amss_vec == NULL) {
3371 			printf("%s: could not allocate BHIE DMA vec buffer\n",
3372 			    sc->sc_dev.dv_xname);
3373 			qwx_dmamem_free(sc->sc_dmat, psc->amss_data);
3374 			psc->amss_data = NULL;
3375 			return 1;
3376 		}
3377 	}
3378 
3379 	/* Copy firmware image to DMA memory. */
3380 	memcpy(QWX_DMA_KVA(psc->amss_data), data, len);
3381 
3382 	/* Create vector which controls chunk-wise DMA copy in hardware. */
3383 	paddr = QWX_DMA_DVA(psc->amss_data);
3384 	vec = QWX_DMA_KVA(psc->amss_vec);
3385 	remain = len;
3386 	for (i = 0; i < nseg; i++) {
3387 		vec[i].paddr = paddr;
3388 		if (remain >= chunk_size) {
3389 			vec[i].size = chunk_size;
3390 			remain -= chunk_size;
3391 			paddr += chunk_size;
3392 		} else
3393 			vec[i].size = remain;
3394 	}
3395 
3396 	/* Set vector physical address and length. */
3397 	paddr = QWX_DMA_DVA(psc->amss_vec);
3398 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_TXVECADDR_HIGH_OFFS,
3399 	    paddr >> 32);
3400 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_TXVECADDR_LOW_OFFS,
3401 	    paddr & 0xffffffff);
3402 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_TXVECSIZE_OFFS, vec_size);
3403 
3404 	/* Set a random transaction sequence number. */
3405 	do {
3406 		seq = arc4random_uniform(MHI_BHIE_TXVECSTATUS_SEQNUM_BMSK);
3407 	} while (seq == 0);
3408 	reg = qwx_pci_read(sc, psc->bhie_off + MHI_BHIE_TXVECDB_OFFS);
3409 	reg &= ~MHI_BHIE_TXVECDB_SEQNUM_BMSK;
3410 	reg |= seq << MHI_BHIE_TXVECDB_SEQNUM_SHFT;
3411 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_TXVECDB_OFFS, reg);
3412 
3413 	/* Wait for completion. */
3414 	ret = 0;
3415 	while (state != MHI_BHIE_TXVECSTATUS_STATUS_XFER_COMPL) {
3416 		ret = tsleep_nsec(&psc->bhie_off, 0, "qwxbhie",
3417 		    SEC_TO_NSEC(5));
3418 		if (ret)
3419 			break;
3420 		reg = qwx_pci_read(sc,
3421 		    psc->bhie_off + MHI_BHIE_TXVECSTATUS_OFFS);
3422 		state = (reg & MHI_BHIE_TXVECSTATUS_STATUS_BMSK) >>
3423 		    MHI_BHIE_TXVECSTATUS_STATUS_SHFT;
3424 		DNPRINTF(QWX_D_MHI, "%s: txvec state is 0x%x\n", __func__,
3425 		    state);
3426 	}
3427 
3428 	if (ret) {
3429 		printf("%s: BHIE load timeout\n", sc->sc_dev.dv_xname);
3430 		return ret;
3431 	}
3432 	return 0;
3433 }
3434 
3435 void
3436 qwx_rddm_prepare(struct qwx_pci_softc *psc)
3437 {
3438 	struct qwx_softc *sc = &psc->sc_sc;
3439 	struct qwx_dma_vec_entry *vec;
3440 	struct qwx_dmamem *data_adm, *vec_adm;
3441 	uint32_t seq, reg;
3442 	uint64_t paddr;
3443 	const size_t len = QWX_RDDM_DUMP_SIZE;
3444 	const size_t chunk_size = MHI_DMA_VEC_CHUNK_SIZE;
3445 	size_t nseg, remain, vec_size;
3446 	int i;
3447 
3448 	nseg = howmany(len, chunk_size);
3449 	if (nseg == 0) {
3450 		printf("%s: RDDM data too short, have only %zu bytes\n",
3451 		    sc->sc_dev.dv_xname, len);
3452 		return;
3453 	}
3454 
3455 	data_adm = qwx_dmamem_alloc(sc->sc_dmat, len, 0);
3456 	if (data_adm == NULL) {
3457 		printf("%s: could not allocate BHIE DMA data buffer\n",
3458 		    sc->sc_dev.dv_xname);
3459 		return;
3460 	}
3461 
3462 	vec_size = nseg * sizeof(*vec);
3463 	vec_adm = qwx_dmamem_alloc(sc->sc_dmat, vec_size, 0);
3464 	if (vec_adm == NULL) {
3465 		printf("%s: could not allocate BHIE DMA vector buffer\n",
3466 		    sc->sc_dev.dv_xname);
3467 		qwx_dmamem_free(sc->sc_dmat, data_adm);
3468 		return;
3469 	}
3470 
3471 	/* Create vector which controls chunk-wise DMA copy from hardware. */
3472 	paddr = QWX_DMA_DVA(data_adm);
3473 	vec = QWX_DMA_KVA(vec_adm);
3474 	remain = len;
3475 	for (i = 0; i < nseg; i++) {
3476 		vec[i].paddr = paddr;
3477 		if (remain >= chunk_size) {
3478 			vec[i].size = chunk_size;
3479 			remain -= chunk_size;
3480 			paddr += chunk_size;
3481 		} else
3482 			vec[i].size = remain;
3483 	}
3484 
3485 	/* Set vector physical address and length. */
3486 	paddr = QWX_DMA_DVA(vec_adm);
3487 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_RXVECADDR_HIGH_OFFS,
3488 	    paddr >> 32);
3489 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_RXVECADDR_LOW_OFFS,
3490 	    paddr & 0xffffffff);
3491 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_RXVECSIZE_OFFS, vec_size);
3492 
3493 	/* Set a random transaction sequence number. */
3494 	do {
3495 		seq = arc4random_uniform(MHI_BHIE_RXVECSTATUS_SEQNUM_BMSK);
3496 	} while (seq == 0);
3497 
3498 	reg = qwx_pci_read(sc, psc->bhie_off + MHI_BHIE_RXVECDB_OFFS);
3499 	reg &= ~MHI_BHIE_RXVECDB_SEQNUM_BMSK;
3500 	reg |= seq << MHI_BHIE_RXVECDB_SEQNUM_SHFT;
3501 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_RXVECDB_OFFS, reg);
3502 
3503 	psc->rddm_data = data_adm;
3504 	psc->rddm_vec = vec_adm;
3505 }
3506 
3507 void
3508 qwx_rddm_task(void *arg)
3509 {
3510 	struct qwx_pci_softc *psc = arg;
3511 	struct qwx_softc *sc = &psc->sc_sc;
3512 	uint32_t reg, state = MHI_BHIE_RXVECSTATUS_STATUS_RESET;
3513 	const size_t len = QWX_RDDM_DUMP_SIZE;
3514 	int i, timeout;
3515 	const uint32_t msecs = 100, retries = 20;
3516 	uint8_t *rddm;
3517 	struct nameidata nd;
3518 	struct vnode *vp = NULL;
3519 	struct iovec iov[3];
3520 	struct uio uio;
3521 	char path[PATH_MAX];
3522 	int error = 0;
3523 
3524 	if (psc->rddm_data == NULL) {
3525 		DPRINTF("%s: RDDM not prepared\n", __func__);
3526 		return;
3527 	}
3528 
3529 	/* Poll for completion */
3530 	timeout = retries;
3531 	while (timeout > 0 && state != MHI_BHIE_RXVECSTATUS_STATUS_XFER_COMPL) {
3532 		reg = qwx_pci_read(sc,
3533 		    psc->bhie_off + MHI_BHIE_RXVECSTATUS_OFFS);
3534 		state = (reg & MHI_BHIE_RXVECSTATUS_STATUS_BMSK) >>
3535 		    MHI_BHIE_RXVECSTATUS_STATUS_SHFT;
3536 		DPRINTF("%s: txvec state is 0x%x\n", __func__, state);
3537 		DELAY((msecs / retries) * 1000);
3538 		timeout--;
3539 	}
3540 
3541 	if (timeout == 0) {
3542 		DPRINTF("%s: RDDM dump failed\n", sc->sc_dev.dv_xname);
3543 		return;
3544 	}
3545 
3546 	rddm = QWX_DMA_KVA(psc->rddm_data);
3547 	DPRINTF("%s: RDDM snippet:\n", __func__);
3548 	for (i = 0; i < MIN(64, len); i++) {
3549 		DPRINTF("%s %.2x", i % 16 == 0 ? "\n" : "", rddm[i]);
3550 	}
3551 	DPRINTF("\n");
3552 
3553 	DPRINTF("%s: sleeping for 30 seconds to allow userland to boot\n", __func__);
3554 	tsleep_nsec(&psc->rddm_data, 0, "qwxrddm", SEC_TO_NSEC(30));
3555 
3556 	snprintf(path, sizeof(path), "/root/%s-rddm.bin", sc->sc_dev.dv_xname);
3557 	DPRINTF("%s: saving RDDM to %s\n", __func__, path);
3558 	NDINIT(&nd, 0, 0, UIO_SYSSPACE, path, curproc);
3559 	nd.ni_pledge = PLEDGE_CPATH | PLEDGE_WPATH;
3560 	nd.ni_unveil = UNVEIL_CREATE | UNVEIL_WRITE;
3561 	error = vn_open(&nd, FWRITE | O_CREAT | O_NOFOLLOW | O_TRUNC,
3562 	    S_IRUSR | S_IWUSR);
3563 	if (error) {
3564 		DPRINTF("%s: vn_open: error %d\n", __func__, error);
3565 		goto done;
3566 	}
3567 	vp = nd.ni_vp;
3568 	VOP_UNLOCK(vp);
3569 
3570 	iov[0].iov_base = (void *)rddm;
3571 	iov[0].iov_len = len;
3572 	iov[1].iov_len = 0;
3573 	uio.uio_iov = &iov[0];
3574 	uio.uio_offset = 0;
3575 	uio.uio_segflg = UIO_SYSSPACE;
3576 	uio.uio_rw = UIO_WRITE;
3577 	uio.uio_resid = len;
3578 	uio.uio_iovcnt = 1;
3579 	uio.uio_procp = curproc;
3580 	error = vget(vp, LK_EXCLUSIVE | LK_RETRY);
3581 	if (error) {
3582 		DPRINTF("%s: vget: error %d\n", __func__, error);
3583 		goto done;
3584 	}
3585 	error = VOP_WRITE(vp, &uio, IO_UNIT|IO_APPEND, curproc->p_ucred);
3586 	vput(vp);
3587 	if (error)
3588 		DPRINTF("%s: VOP_WRITE: error %d\n", __func__, error);
3589 	#if 0
3590 	error = vn_close(vp, FWRITE, curproc->p_ucred, curproc);
3591 	if (error)
3592 		DPRINTF("%s: vn_close: error %d\n", __func__, error);
3593 	#endif
3594 done:
3595 	qwx_dmamem_free(sc->sc_dmat, psc->rddm_data);
3596 	qwx_dmamem_free(sc->sc_dmat, psc->rddm_vec);
3597 	psc->rddm_data = NULL;
3598 	psc->rddm_vec = NULL;
3599 	DPRINTF("%s: done, error %d\n", __func__, error);
3600 }
3601 
3602 void *
3603 qwx_pci_event_ring_get_elem(struct qwx_pci_event_ring *ring, uint64_t rp)
3604 {
3605 	uint64_t base = QWX_DMA_DVA(ring->dmamem), offset;
3606 	void *addr = QWX_DMA_KVA(ring->dmamem);
3607 
3608 	if (rp < base)
3609 		return NULL;
3610 
3611 	offset = rp - base;
3612 	if (offset >= ring->size)
3613 		return NULL;
3614 
3615 	return addr + offset;
3616 }
3617 
3618 void
3619 qwx_mhi_state_change(void *arg)
3620 {
3621 	struct qwx_pci_softc *psc = arg;
3622 	struct qwx_softc *sc = &psc->sc_sc;
3623 	struct qwx_mhi_newstate *ns = &psc->mhi_newstate;
3624 
3625 	while (ns->tail != ns->cur) {
3626 		int mhi_state = ns->queue[ns->tail].mhi_state;
3627 		int ee = ns->queue[ns->tail].ee;
3628 		uint32_t old_ee = psc->bhi_ee;
3629 		uint32_t old_mhi_state = psc->mhi_state;
3630 
3631 		KASSERT(ns->queued > 0);
3632 
3633 		if (ee != -1 && psc->bhi_ee != ee) {
3634 			switch (ee) {
3635 			case MHI_EE_PBL:
3636 				DNPRINTF(QWX_D_MHI, "%s: new EE PBL\n",
3637 				    sc->sc_dev.dv_xname);
3638 				psc->bhi_ee = ee;
3639 				break;
3640 			case MHI_EE_SBL:
3641 				psc->bhi_ee = ee;
3642 				DNPRINTF(QWX_D_MHI, "%s: new EE SBL\n",
3643 				    sc->sc_dev.dv_xname);
3644 				break;
3645 			case MHI_EE_AMSS:
3646 				DNPRINTF(QWX_D_MHI, "%s: new EE AMSS\n",
3647 				    sc->sc_dev.dv_xname);
3648 				psc->bhi_ee = ee;
3649 				qwx_mhi_ee_amss_state_transition(psc);
3650 				/* Wake thread loading the full AMSS image. */
3651 				wakeup(&psc->bhie_off);
3652 				break;
3653 			case MHI_EE_WFW:
3654 				DNPRINTF(QWX_D_MHI, "%s: new EE WFW\n",
3655 				    sc->sc_dev.dv_xname);
3656 				psc->bhi_ee = ee;
3657 				break;
3658 			default:
3659 				printf("%s: unhandled EE change to %x\n",
3660 				    sc->sc_dev.dv_xname, ee);
3661 				break;
3662 			}
3663 		}
3664 
3665 		if (mhi_state != -1 && psc->mhi_state != mhi_state) {
3666 			switch (mhi_state) {
3667 			case -1:
3668 				break;
3669 			case MHI_STATE_RESET:
3670 				DNPRINTF(QWX_D_MHI, "%s: new MHI state RESET\n",
3671 				    sc->sc_dev.dv_xname);
3672 				psc->mhi_state = mhi_state;
3673 				break;
3674 			case MHI_STATE_READY:
3675 				DNPRINTF(QWX_D_MHI, "%s: new MHI state READY\n",
3676 				    sc->sc_dev.dv_xname);
3677 				psc->mhi_state = mhi_state;
3678 				qwx_mhi_ready_state_transition(psc);
3679 				break;
3680 			case MHI_STATE_M0:
3681 				DNPRINTF(QWX_D_MHI, "%s: new MHI state M0\n",
3682 				    sc->sc_dev.dv_xname);
3683 				psc->mhi_state = mhi_state;
3684 				qwx_mhi_mission_mode_state_transition(psc);
3685 				break;
3686 			case MHI_STATE_M1:
3687 				DNPRINTF(QWX_D_MHI, "%s: new MHI state M1\n",
3688 				    sc->sc_dev.dv_xname);
3689 				psc->mhi_state = mhi_state;
3690 				qwx_mhi_low_power_mode_state_transition(psc);
3691 				break;
3692 			case MHI_STATE_SYS_ERR:
3693 				DNPRINTF(QWX_D_MHI,
3694 				    "%s: new MHI state SYS ERR\n",
3695 				    sc->sc_dev.dv_xname);
3696 				psc->mhi_state = mhi_state;
3697 				break;
3698 			default:
3699 				printf("%s: unhandled MHI state change to %x\n",
3700 				    sc->sc_dev.dv_xname, mhi_state);
3701 				break;
3702 			}
3703 		}
3704 
3705 		if (old_ee != psc->bhi_ee)
3706 			wakeup(&psc->bhi_ee);
3707 		if (old_mhi_state != psc->mhi_state)
3708 			wakeup(&psc->mhi_state);
3709 
3710 		ns->tail = (ns->tail + 1) % nitems(ns->queue);
3711 		ns->queued--;
3712 	}
3713 }
3714 
3715 void
3716 qwx_mhi_queue_state_change(struct qwx_pci_softc *psc, int ee, int mhi_state)
3717 {
3718 	struct qwx_mhi_newstate *ns = &psc->mhi_newstate;
3719 
3720 	if (ns->queued >= nitems(ns->queue)) {
3721 		printf("%s: event queue full, dropping event\n", __func__);
3722 		return;
3723 	}
3724 
3725 	ns->queue[ns->cur].ee = ee;
3726 	ns->queue[ns->cur].mhi_state = mhi_state;
3727 	ns->queued++;
3728 	ns->cur = (ns->cur + 1) % nitems(ns->queue);
3729 	task_add(systq, &psc->mhi_newstate_task);
3730 }
3731 
3732 void
3733 qwx_pci_intr_ctrl_event_mhi(struct qwx_pci_softc *psc, uint32_t mhi_state)
3734 {
3735 	DNPRINTF(QWX_D_MHI, "%s: MHI state change 0x%x -> 0x%x\n", __func__,
3736 	    psc->mhi_state, mhi_state);
3737 
3738 	qwx_mhi_queue_state_change(psc, -1, mhi_state);
3739 }
3740 
3741 void
3742 qwx_pci_intr_ctrl_event_ee(struct qwx_pci_softc *psc, uint32_t ee)
3743 {
3744 	DNPRINTF(QWX_D_MHI, "%s: EE change 0x%x to 0x%x\n", __func__,
3745 	    psc->bhi_ee, ee);
3746 
3747 	qwx_mhi_queue_state_change(psc, ee, -1);
3748 }
3749 
3750 void
3751 qwx_pci_intr_ctrl_event_cmd_complete(struct qwx_pci_softc *psc,
3752     uint64_t ptr, uint32_t cmd_status)
3753 {
3754 	struct qwx_pci_cmd_ring	*cmd_ring = &psc->cmd_ring;
3755 	uint64_t base = QWX_DMA_DVA(cmd_ring->dmamem);
3756 	struct qwx_pci_xfer_ring *xfer_ring = NULL;
3757 	struct qwx_mhi_ring_element *e;
3758 	uint32_t tre1, chid;
3759 	size_t i;
3760 
3761 	e = qwx_pci_cmd_ring_get_elem(cmd_ring, ptr);
3762 	if (e == NULL)
3763 		return;
3764 
3765 	tre1 = le32toh(e->dword[1]);
3766 	chid = (tre1 & MHI_TRE1_EV_CHID_MASK) >> MHI_TRE1_EV_CHID_SHFT;
3767 
3768 	for (i = 0; i < nitems(psc->xfer_rings); i++) {
3769 		if (psc->xfer_rings[i].mhi_chan_id == chid) {
3770 			xfer_ring = &psc->xfer_rings[i];
3771 			break;
3772 		}
3773 	}
3774 	if (xfer_ring == NULL) {
3775 		printf("%s: no transfer ring found for command completion "
3776 		    "on channel %u\n", __func__, chid);
3777 		return;
3778 	}
3779 
3780 	xfer_ring->cmd_status = cmd_status;
3781 	wakeup(&xfer_ring->cmd_status);
3782 
3783 	if (cmd_ring->rp + sizeof(*e) >= base + cmd_ring->size)
3784 		cmd_ring->rp = base;
3785 	else
3786 		cmd_ring->rp += sizeof(*e);
3787 }
3788 
3789 int
3790 qwx_pci_intr_ctrl_event(struct qwx_pci_softc *psc, struct qwx_pci_event_ring *ring)
3791 {
3792 	struct qwx_softc *sc = &psc->sc_sc;
3793 	struct qwx_mhi_event_ctxt *c;
3794 	uint64_t rp, wp, base;
3795 	struct qwx_mhi_ring_element *e;
3796 	uint32_t tre0, tre1, type, code, chid, len;
3797 
3798 	c = ring->event_ctxt;
3799 	if (c == NULL) {
3800 		/*
3801 		 * Interrupts can trigger before mhi_init_event_rings()
3802 		 * if the device is still active after a warm reboot.
3803 		 */
3804 		return 0;
3805 	}
3806 
3807 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->event_ctxt), 0,
3808 	    QWX_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_POSTREAD);
3809 
3810 	rp = le64toh(c->rp);
3811 	wp = le64toh(c->wp);
3812 
3813 	DNPRINTF(QWX_D_MHI, "%s: kernel rp=0x%llx\n", __func__, ring->rp);
3814 	DNPRINTF(QWX_D_MHI, "%s: device rp=0x%llx\n", __func__, rp);
3815 	DNPRINTF(QWX_D_MHI, "%s: kernel wp=0x%llx\n", __func__, ring->wp);
3816 	DNPRINTF(QWX_D_MHI, "%s: device wp=0x%llx\n", __func__, wp);
3817 
3818 	base = QWX_DMA_DVA(ring->dmamem);
3819 	if (ring->rp == rp || rp < base || rp >= base + ring->size)
3820 		return 0;
3821 	if (wp < base || wp >= base + ring->size)
3822 		return 0;
3823 
3824 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(ring->dmamem),
3825 	    0, QWX_DMA_LEN(ring->dmamem), BUS_DMASYNC_POSTREAD);
3826 
3827 	while (ring->rp != rp) {
3828 		e = qwx_pci_event_ring_get_elem(ring, ring->rp);
3829 		if (e == NULL)
3830 			return 0;
3831 
3832 		tre0 = le32toh(e->dword[0]);
3833 		tre1 = le32toh(e->dword[1]);
3834 
3835 		len = (tre0 & MHI_TRE0_EV_LEN_MASK) >> MHI_TRE0_EV_LEN_SHFT;
3836 		code = (tre0 & MHI_TRE0_EV_CODE_MASK) >> MHI_TRE0_EV_CODE_SHFT;
3837 		type = (tre1 & MHI_TRE1_EV_TYPE_MASK) >> MHI_TRE1_EV_TYPE_SHFT;
3838 		chid = (tre1 & MHI_TRE1_EV_CHID_MASK) >> MHI_TRE1_EV_CHID_SHFT;
3839 		DNPRINTF(QWX_D_MHI, "%s: len=%u code=0x%x type=0x%x chid=%d\n",
3840 		    __func__, len, code, type, chid);
3841 
3842 		switch (type) {
3843 		case MHI_PKT_TYPE_STATE_CHANGE_EVENT:
3844 			qwx_pci_intr_ctrl_event_mhi(psc, code);
3845 			break;
3846 		case MHI_PKT_TYPE_EE_EVENT:
3847 			qwx_pci_intr_ctrl_event_ee(psc, code);
3848 			break;
3849 		case MHI_PKT_TYPE_CMD_COMPLETION_EVENT:
3850 			qwx_pci_intr_ctrl_event_cmd_complete(psc,
3851 			    le64toh(e->ptr), code);
3852 			break;
3853 		default:
3854 			printf("%s: unhandled event type 0x%x\n",
3855 			    __func__, type);
3856 			break;
3857 		}
3858 
3859 		if (ring->rp + sizeof(*e) >= base + ring->size)
3860 			ring->rp = base;
3861 		else
3862 			ring->rp += sizeof(*e);
3863 
3864 		if (ring->wp + sizeof(*e) >= base + ring->size)
3865 			ring->wp = base;
3866 		else
3867 			ring->wp += sizeof(*e);
3868 	}
3869 
3870 	c->wp = htole64(ring->wp);
3871 
3872 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->event_ctxt), 0,
3873 	    QWX_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_PREWRITE);
3874 
3875 	qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
3876 	return 1;
3877 }
3878 
3879 void
3880 qwx_pci_intr_data_event_tx(struct qwx_pci_softc *psc, struct qwx_mhi_ring_element *e)
3881 {
3882 	struct qwx_softc *sc = &psc->sc_sc;
3883 	struct qwx_pci_xfer_ring *ring;
3884 	struct qwx_xfer_data *xfer;
3885 	uint64_t rp, evrp, base, paddr;
3886 	uint32_t tre0, tre1, code, chid, evlen, len;
3887 	int i;
3888 
3889 	tre0 = le32toh(e->dword[0]);
3890 	tre1 = le32toh(e->dword[1]);
3891 
3892 	evlen = (tre0 & MHI_TRE0_EV_LEN_MASK) >> MHI_TRE0_EV_LEN_SHFT;
3893 	code = (tre0 & MHI_TRE0_EV_CODE_MASK) >> MHI_TRE0_EV_CODE_SHFT;
3894 	chid = (tre1 & MHI_TRE1_EV_CHID_MASK) >> MHI_TRE1_EV_CHID_SHFT;
3895 
3896 	switch (code) {
3897 	case MHI_EV_CC_EOT:
3898 		for (i = 0; i < nitems(psc->xfer_rings); i++) {
3899 			ring = &psc->xfer_rings[i];
3900 			if (ring->mhi_chan_id == chid)
3901 				break;
3902 		}
3903 		if (i == nitems(psc->xfer_rings)) {
3904 			printf("%s: unhandled channel 0x%x\n",
3905 			    __func__, chid);
3906 			break;
3907 		}
3908 		base = QWX_DMA_DVA(ring->dmamem);
3909 		/* PTR contains the entry that was last written */
3910 		evrp = letoh64(e->ptr);
3911 		rp = evrp;
3912 		if (rp < base || rp >= base + ring->size) {
3913 			printf("%s: invalid ptr 0x%llx\n",
3914 			    __func__, rp);
3915 			break;
3916 		}
3917 		/* Point rp to next empty slot */
3918 		if (rp + sizeof(*e) >= base + ring->size)
3919 			rp = base;
3920 		else
3921 			rp += sizeof(*e);
3922 		/* Parse until next empty slot */
3923 		while (ring->rp != rp) {
3924 			DNPRINTF(QWX_D_MHI, "%s:%d: ring->rp 0x%llx "
3925 			    "ring->wp 0x%llx rp 0x%llx\n", __func__,
3926 			    __LINE__, ring->rp, ring->wp, rp);
3927 			e = qwx_pci_xfer_ring_get_elem(ring, ring->rp);
3928 			xfer = qwx_pci_xfer_ring_get_data(ring, ring->rp);
3929 
3930 			if (ring->rp == evrp)
3931 				len = evlen;
3932 			else
3933 				len = xfer->m->m_pkthdr.len;
3934 
3935 			bus_dmamap_sync(sc->sc_dmat, xfer->map, 0,
3936 			    xfer->m->m_pkthdr.len, BUS_DMASYNC_POSTREAD);
3937 #ifdef QWX_DEBUG
3938 			{
3939 			int i;
3940 			DNPRINTF(QWX_D_MHI, "%s: chan %u data (len %u): ",
3941 			    __func__,
3942 			    ring->mhi_chan_id, len);
3943 			for (i = 0; i < MIN(32, len); i++) {
3944 				DNPRINTF(QWX_D_MHI, "%02x ",
3945 				    (unsigned char)mtod(xfer->m, caddr_t)[i]);
3946 			}
3947 			if (i < len)
3948 				DNPRINTF(QWX_D_MHI, "...");
3949 			DNPRINTF(QWX_D_MHI, "\n");
3950 			}
3951 #endif
3952 			if (ring->mhi_chan_direction == MHI_CHAN_TYPE_INBOUND) {
3953 				/* Save m_data as upper layers use m_adj(9) */
3954 				void *o_data = xfer->m->m_data;
3955 
3956 				/* Pass mbuf to upper layers */
3957 				qwx_qrtr_recv_msg(sc, xfer->m);
3958 
3959 				/* Reset RX mbuf instead of free/alloc */
3960 				KASSERT(xfer->m->m_next == NULL);
3961 				xfer->m->m_data = o_data;
3962 				xfer->m->m_len = xfer->m->m_pkthdr.len =
3963 				    QWX_PCI_XFER_MAX_DATA_SIZE;
3964 
3965 				paddr = xfer->map->dm_segs[0].ds_addr;
3966 
3967 				e->ptr = htole64(paddr);
3968 				e->dword[0] = htole32((
3969 				    QWX_PCI_XFER_MAX_DATA_SIZE <<
3970 				    MHI_TRE0_DATA_LEN_SHFT) &
3971 				    MHI_TRE0_DATA_LEN_MASK);
3972 				e->dword[1] = htole32(MHI_TRE1_DATA_IEOT |
3973 				    MHI_TRE1_DATA_BEI |
3974 				    MHI_TRE1_DATA_TYPE_TRANSFER <<
3975 				    MHI_TRE1_DATA_TYPE_SHIFT);
3976 
3977 				if (ring->wp + sizeof(*e) >= base + ring->size)
3978 					ring->wp = base;
3979 				else
3980 					ring->wp += sizeof(*e);
3981 			} else {
3982 				/* Unload and free TX mbuf */
3983 				bus_dmamap_unload(sc->sc_dmat, xfer->map);
3984 				m_freem(xfer->m);
3985 				xfer->m = NULL;
3986 				ring->queued--;
3987 			}
3988 
3989 			if (ring->rp + sizeof(*e) >= base + ring->size)
3990 				ring->rp = base;
3991 			else
3992 				ring->rp += sizeof(*e);
3993 		}
3994 
3995 		if (ring->mhi_chan_direction == MHI_CHAN_TYPE_INBOUND) {
3996 			ring->chan_ctxt->wp = htole64(ring->wp);
3997 
3998 			bus_dmamap_sync(sc->sc_dmat,
3999 			    QWX_DMA_MAP(psc->chan_ctxt), 0,
4000 			    QWX_DMA_LEN(psc->chan_ctxt),
4001 			    BUS_DMASYNC_PREWRITE);
4002 
4003 			qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
4004 		}
4005 		break;
4006 	default:
4007 		printf("%s: unhandled event code 0x%x\n",
4008 		    __func__, code);
4009 	}
4010 }
4011 
4012 int
4013 qwx_pci_intr_data_event(struct qwx_pci_softc *psc, struct qwx_pci_event_ring *ring)
4014 {
4015 	struct qwx_softc *sc = &psc->sc_sc;
4016 	struct qwx_mhi_event_ctxt *c;
4017 	uint64_t rp, wp, base;
4018 	struct qwx_mhi_ring_element *e;
4019 	uint32_t tre0, tre1, type, code, chid, len;
4020 
4021 	c = ring->event_ctxt;
4022 	if (c == NULL) {
4023 		/*
4024 		 * Interrupts can trigger before mhi_init_event_rings()
4025 		 * if the device is still active after a warm reboot.
4026 		 */
4027 		return 0;
4028 	}
4029 
4030 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->event_ctxt), 0,
4031 	    QWX_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_POSTREAD);
4032 
4033 	rp = le64toh(c->rp);
4034 	wp = le64toh(c->wp);
4035 
4036 	DNPRINTF(QWX_D_MHI, "%s: kernel rp=0x%llx\n", __func__, ring->rp);
4037 	DNPRINTF(QWX_D_MHI, "%s: device rp=0x%llx\n", __func__, rp);
4038 	DNPRINTF(QWX_D_MHI, "%s: kernel wp=0x%llx\n", __func__, ring->wp);
4039 	DNPRINTF(QWX_D_MHI, "%s: device wp=0x%llx\n", __func__, wp);
4040 
4041 	base = QWX_DMA_DVA(ring->dmamem);
4042 	if (ring->rp == rp || rp < base || rp >= base + ring->size)
4043 		return 0;
4044 
4045 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(ring->dmamem),
4046 	    0, QWX_DMA_LEN(ring->dmamem), BUS_DMASYNC_POSTREAD);
4047 
4048 	while (ring->rp != rp) {
4049 		e = qwx_pci_event_ring_get_elem(ring, ring->rp);
4050 		if (e == NULL)
4051 			return 0;
4052 
4053 		tre0 = le32toh(e->dword[0]);
4054 		tre1 = le32toh(e->dword[1]);
4055 
4056 		len = (tre0 & MHI_TRE0_EV_LEN_MASK) >> MHI_TRE0_EV_LEN_SHFT;
4057 		code = (tre0 & MHI_TRE0_EV_CODE_MASK) >> MHI_TRE0_EV_CODE_SHFT;
4058 		type = (tre1 & MHI_TRE1_EV_TYPE_MASK) >> MHI_TRE1_EV_TYPE_SHFT;
4059 		chid = (tre1 & MHI_TRE1_EV_CHID_MASK) >> MHI_TRE1_EV_CHID_SHFT;
4060 		DNPRINTF(QWX_D_MHI, "%s: len=%u code=0x%x type=0x%x chid=%d\n",
4061 		    __func__, len, code, type, chid);
4062 
4063 		switch (type) {
4064 		case MHI_PKT_TYPE_TX_EVENT:
4065 			qwx_pci_intr_data_event_tx(psc, e);
4066 			break;
4067 		default:
4068 			printf("%s: unhandled event type 0x%x\n",
4069 			    __func__, type);
4070 			break;
4071 		}
4072 
4073 		if (ring->rp + sizeof(*e) >= base + ring->size)
4074 			ring->rp = base;
4075 		else
4076 			ring->rp += sizeof(*e);
4077 
4078 		if (ring->wp + sizeof(*e) >= base + ring->size)
4079 			ring->wp = base;
4080 		else
4081 			ring->wp += sizeof(*e);
4082 	}
4083 
4084 	c->wp = htole64(ring->wp);
4085 
4086 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->event_ctxt), 0,
4087 	    QWX_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_PREWRITE);
4088 
4089 	qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
4090 	return 1;
4091 }
4092 
4093 int
4094 qwx_pci_intr_mhi_ctrl(void *arg)
4095 {
4096 	struct qwx_pci_softc *psc = arg;
4097 
4098 	if (qwx_pci_intr_ctrl_event(psc, &psc->event_rings[0]))
4099 		return 1;
4100 
4101 	return 0;
4102 }
4103 
4104 int
4105 qwx_pci_intr_mhi_data(void *arg)
4106 {
4107 	struct qwx_pci_softc *psc = arg;
4108 
4109 	if (qwx_pci_intr_data_event(psc, &psc->event_rings[1]))
4110 		return 1;
4111 
4112 	return 0;
4113 }
4114 
4115 int
4116 qwx_pci_intr(void *arg)
4117 {
4118 	struct qwx_pci_softc *psc = arg;
4119 	struct qwx_softc *sc = (void *)psc;
4120 	uint32_t ee, state;
4121 	int ret = 0;
4122 
4123 	/*
4124 	 * Interrupts can trigger before mhi_start() during boot if the device
4125 	 * is still active after a warm reboot.
4126 	 */
4127 	if (psc->bhi_off == 0)
4128 		psc->bhi_off = qwx_pci_read(sc, MHI_BHI_OFFSET);
4129 
4130 	ee = qwx_pci_read(sc, psc->bhi_off + MHI_BHI_EXECENV);
4131 	state = qwx_pci_read(sc, MHI_STATUS);
4132 	state = (state & MHI_STATUS_MHISTATE_MASK) >>
4133 	    MHI_STATUS_MHISTATE_SHFT;
4134 
4135 	DNPRINTF(QWX_D_MHI,
4136 	    "%s: BHI interrupt with EE: 0x%x -> 0x%x state: 0x%x -> 0x%x\n",
4137 	     sc->sc_dev.dv_xname, psc->bhi_ee, ee, psc->mhi_state, state);
4138 
4139 	if (ee == MHI_EE_RDDM) {
4140 		psc->bhi_ee = ee;
4141 		if (!psc->rddm_triggered) {
4142 			task_add(systq, &psc->rddm_task);
4143 			psc->rddm_triggered = 1;
4144 		}
4145 		return 1;
4146 	} else if (psc->bhi_ee == MHI_EE_PBL || psc->bhi_ee == MHI_EE_SBL) {
4147 		int new_ee = -1, new_mhi_state = -1;
4148 
4149 		if (psc->bhi_ee != ee)
4150 			new_ee = ee;
4151 		if (state < MHI_STATE_M0 && psc->mhi_state != state)
4152 			new_mhi_state = state;
4153 
4154 		if (new_ee != -1 || new_mhi_state != -1)
4155 			qwx_mhi_queue_state_change(psc, new_ee, new_mhi_state);
4156 
4157 		/* Wake thread loading second stage bootloader. */
4158 		wakeup(&psc->bhi_off);
4159 		ret = 1;
4160 	}
4161 
4162 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags)) {
4163 		int i;
4164 
4165 		if (qwx_pci_intr_ctrl_event(psc, &psc->event_rings[0]))
4166 			ret = 1;
4167 		if (qwx_pci_intr_data_event(psc, &psc->event_rings[1]))
4168 			ret = 1;
4169 
4170 		for (i = 0; i < sc->hw_params.ce_count; i++) {
4171 			struct qwx_ce_pipe *ce_pipe = &sc->ce.ce_pipe[i];
4172 
4173 			if (qwx_ce_intr(ce_pipe))
4174 				ret = 1;
4175 		}
4176 
4177 		for (i = 0; i < nitems(sc->ext_irq_grp); i++) {
4178 			if (qwx_dp_service_srng(sc, i))
4179 				ret = 1;
4180 		}
4181 	}
4182 
4183 	return ret;
4184 }
4185