xref: /openbsd-src/sys/dev/pci/if_qwx_pci.c (revision f2a19305cfc49ea4d1a5feb55cd6c283c6f1e031)
1 /*	$OpenBSD: if_qwx_pci.c,v 1.15 2024/04/13 23:44:11 jsg Exp $	*/
2 
3 /*
4  * Copyright 2023 Stefan Sperling <stsp@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 /*
20  * Copyright (c) 2021-2022, Qualcomm Innovation Center, Inc.
21  * Copyright (c) 2018-2021 The Linux Foundation.
22  * All rights reserved.
23  *
24  * Redistribution and use in source and binary forms, with or without
25  * modification, are permitted (subject to the limitations in the disclaimer
26  * below) provided that the following conditions are met:
27  *
28  *  * Redistributions of source code must retain the above copyright notice,
29  *    this list of conditions and the following disclaimer.
30  *
31  *  * Redistributions in binary form must reproduce the above copyright
32  *    notice, this list of conditions and the following disclaimer in the
33  *    documentation and/or other materials provided with the distribution.
34  *
35  *  * Neither the name of [Owner Organization] nor the names of its
36  *    contributors may be used to endorse or promote products derived from
37  *    this software without specific prior written permission.
38  *
39  * NO EXPRESS OR IMPLIED LICENSES TO ANY PARTY'S PATENT RIGHTS ARE GRANTED BY
40  * THIS LICENSE. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
41  * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT
42  * NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
43  * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER
44  * OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
45  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
46  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
47  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
48  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
49  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
50  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
51  */
52 
53 #include "bpfilter.h"
54 
55 #include <sys/param.h>
56 #include <sys/sockio.h>
57 #include <sys/mbuf.h>
58 #include <sys/kernel.h>
59 #include <sys/lock.h>
60 #include <sys/socket.h>
61 #include <sys/systm.h>
62 #include <sys/malloc.h>
63 #include <sys/conf.h>
64 #include <sys/device.h>
65 #include <sys/endian.h>
66 
67 #include <machine/bus.h>
68 #include <machine/intr.h>
69 
70 #include <net/if.h>
71 #include <net/if_media.h>
72 
73 #include <netinet/in.h>
74 #include <netinet/if_ether.h>
75 
76 #include <net80211/ieee80211_var.h>
77 #include <net80211/ieee80211_radiotap.h>
78 
79 #include <dev/pci/pcireg.h>
80 #include <dev/pci/pcivar.h>
81 #include <dev/pci/pcidevs.h>
82 
83 /* XXX linux porting goo */
84 #ifdef __LP64__
85 #define BITS_PER_LONG		64
86 #else
87 #define BITS_PER_LONG		32
88 #endif
89 #define GENMASK(h, l) (((~0UL) >> (BITS_PER_LONG - (h) - 1)) & ((~0UL) << (l)))
90 #define __bf_shf(x) (__builtin_ffsll(x) - 1)
91 #define FIELD_GET(_m, _v) ((typeof(_m))(((_v) & (_m)) >> __bf_shf(_m)))
92 #define BIT(x)               (1UL << (x))
93 #define test_bit(i, a)  ((a) & (1 << (i)))
94 #define clear_bit(i, a) ((a)) &= ~(1 << (i))
95 #define set_bit(i, a)   ((a)) |= (1 << (i))
96 
97 /* #define QWX_DEBUG */
98 
99 #include <dev/ic/qwxreg.h>
100 #include <dev/ic/qwxvar.h>
101 
102 /* Headers needed for RDDM dump */
103 #include <sys/namei.h>
104 #include <sys/pledge.h>
105 #include <sys/vnode.h>
106 #include <sys/fcntl.h>
107 #include <sys/stat.h>
108 #include <sys/proc.h>
109 
110 #define ATH11K_PCI_IRQ_CE0_OFFSET	3
111 #define ATH11K_PCI_IRQ_DP_OFFSET	14
112 
113 #define ATH11K_PCI_CE_WAKE_IRQ		2
114 
115 #define ATH11K_PCI_WINDOW_ENABLE_BIT	0x40000000
116 #define ATH11K_PCI_WINDOW_REG_ADDRESS	0x310c
117 #define ATH11K_PCI_WINDOW_VALUE_MASK	GENMASK(24, 19)
118 #define ATH11K_PCI_WINDOW_START		0x80000
119 #define ATH11K_PCI_WINDOW_RANGE_MASK	GENMASK(18, 0)
120 
121 /* BAR0 + 4k is always accessible, and no need to force wakeup. */
122 #define ATH11K_PCI_ACCESS_ALWAYS_OFF	0xFE0	/* 4K - 32 = 0xFE0 */
123 
124 #define TCSR_SOC_HW_VERSION		0x0224
125 #define TCSR_SOC_HW_VERSION_MAJOR_MASK	GENMASK(11, 8)
126 #define TCSR_SOC_HW_VERSION_MINOR_MASK	GENMASK(7, 0)
127 
128 /*
129  * pci.h
130  */
131 #define PCIE_SOC_GLOBAL_RESET			0x3008
132 #define PCIE_SOC_GLOBAL_RESET_V			1
133 
134 #define WLAON_WARM_SW_ENTRY			0x1f80504
135 #define WLAON_SOC_RESET_CAUSE_REG		0x01f8060c
136 
137 #define PCIE_Q6_COOKIE_ADDR			0x01f80500
138 #define PCIE_Q6_COOKIE_DATA			0xc0000000
139 
140 /* register to wake the UMAC from power collapse */
141 #define PCIE_SCRATCH_0_SOC_PCIE_REG		0x4040
142 
143 /* register used for handshake mechanism to validate UMAC is awake */
144 #define PCIE_SOC_WAKE_PCIE_LOCAL_REG		0x3004
145 
146 #define PCIE_PCIE_PARF_LTSSM			0x1e081b0
147 #define PARM_LTSSM_VALUE			0x111
148 
149 #define GCC_GCC_PCIE_HOT_RST			0x1e402bc
150 #define GCC_GCC_PCIE_HOT_RST_VAL		0x10
151 
152 #define PCIE_PCIE_INT_ALL_CLEAR			0x1e08228
153 #define PCIE_SMLH_REQ_RST_LINK_DOWN		0x2
154 #define PCIE_INT_CLEAR_ALL			0xffffffff
155 
156 #define PCIE_QSERDES_COM_SYSCLK_EN_SEL_REG(sc) \
157 		(sc->hw_params.regs->pcie_qserdes_sysclk_en_sel)
158 #define PCIE_QSERDES_COM_SYSCLK_EN_SEL_VAL	0x10
159 #define PCIE_QSERDES_COM_SYSCLK_EN_SEL_MSK	0xffffffff
160 #define PCIE_PCS_OSC_DTCT_CONFIG1_REG(sc) \
161 		(sc->hw_params.regs->pcie_pcs_osc_dtct_config_base)
162 #define PCIE_PCS_OSC_DTCT_CONFIG1_VAL		0x02
163 #define PCIE_PCS_OSC_DTCT_CONFIG2_REG(sc) \
164 		(sc->hw_params.regs->pcie_pcs_osc_dtct_config_base + 0x4)
165 #define PCIE_PCS_OSC_DTCT_CONFIG2_VAL		0x52
166 #define PCIE_PCS_OSC_DTCT_CONFIG4_REG(sc) \
167 		(sc->hw_params.regs->pcie_pcs_osc_dtct_config_base + 0xc)
168 #define PCIE_PCS_OSC_DTCT_CONFIG4_VAL		0xff
169 #define PCIE_PCS_OSC_DTCT_CONFIG_MSK		0x000000ff
170 
171 #define WLAON_QFPROM_PWR_CTRL_REG		0x01f8031c
172 #define QFPROM_PWR_CTRL_VDD4BLOW_MASK		0x4
173 
174 /*
175  * mhi.h
176  */
177 #define PCIE_TXVECDB				0x360
178 #define PCIE_TXVECSTATUS			0x368
179 #define PCIE_RXVECDB				0x394
180 #define PCIE_RXVECSTATUS			0x39C
181 
182 #define MHI_CHAN_CTX_CHSTATE_MASK		GENMASK(7, 0)
183 #define   MHI_CHAN_CTX_CHSTATE_DISABLED		0
184 #define   MHI_CHAN_CTX_CHSTATE_ENABLED		1
185 #define   MHI_CHAN_CTX_CHSTATE_RUNNING		2
186 #define   MHI_CHAN_CTX_CHSTATE_SUSPENDED	3
187 #define   MHI_CHAN_CTX_CHSTATE_STOP		4
188 #define   MHI_CHAN_CTX_CHSTATE_ERROR		5
189 #define MHI_CHAN_CTX_BRSTMODE_MASK		GENMASK(9, 8)
190 #define MHI_CHAN_CTX_BRSTMODE_SHFT		8
191 #define   MHI_CHAN_CTX_BRSTMODE_DISABLE		2
192 #define   MHI_CHAN_CTX_BRSTMODE_ENABLE		3
193 #define MHI_CHAN_CTX_POLLCFG_MASK		GENMASK(15, 10)
194 #define MHI_CHAN_CTX_RESERVED_MASK		GENMASK(31, 16)
195 
196 #define QWX_MHI_CONFIG_QCA6390_MAX_CHANNELS	128
197 #define QWX_MHI_CONFIG_QCA6390_TIMEOUT_MS	2000
198 #define QWX_MHI_CONFIG_QCA9074_MAX_CHANNELS	30
199 
200 #define MHI_CHAN_TYPE_INVALID		0
201 #define MHI_CHAN_TYPE_OUTBOUND		1 /* to device */
202 #define MHI_CHAN_TYPE_INBOUND		2 /* from device */
203 #define MHI_CHAN_TYPE_INBOUND_COALESCED	3
204 
205 #define MHI_EV_CTX_RESERVED_MASK	GENMASK(7, 0)
206 #define MHI_EV_CTX_INTMODC_MASK		GENMASK(15, 8)
207 #define MHI_EV_CTX_INTMODT_MASK		GENMASK(31, 16)
208 #define MHI_EV_CTX_INTMODT_SHFT		16
209 
210 #define MHI_ER_TYPE_INVALID	0
211 #define MHI_ER_TYPE_VALID	1
212 
213 #define MHI_ER_DATA	0
214 #define MHI_ER_CTRL	1
215 
216 #define MHI_CH_STATE_DISABLED	0
217 #define MHI_CH_STATE_ENABLED	1
218 #define MHI_CH_STATE_RUNNING	2
219 #define MHI_CH_STATE_SUSPENDED	3
220 #define MHI_CH_STATE_STOP	4
221 #define MHI_CH_STATE_ERROR	5
222 
223 #define QWX_NUM_EVENT_CTX	2
224 
225 /* Event context. Shared with device. */
226 struct qwx_mhi_event_ctxt {
227 	uint32_t intmod;
228 	uint32_t ertype;
229 	uint32_t msivec;
230 
231 	uint64_t rbase;
232 	uint64_t rlen;
233 	uint64_t rp;
234 	uint64_t wp;
235 } __packed;
236 
237 /* Channel context. Shared with device. */
238 struct qwx_mhi_chan_ctxt {
239 	uint32_t chcfg;
240 	uint32_t chtype;
241 	uint32_t erindex;
242 
243 	uint64_t rbase;
244 	uint64_t rlen;
245 	uint64_t rp;
246 	uint64_t wp;
247 } __packed;
248 
249 /* Command context. Shared with device. */
250 struct qwx_mhi_cmd_ctxt {
251 	uint32_t reserved0;
252 	uint32_t reserved1;
253 	uint32_t reserved2;
254 
255 	uint64_t rbase;
256 	uint64_t rlen;
257 	uint64_t rp;
258 	uint64_t wp;
259 } __packed;
260 
261 struct qwx_mhi_ring_element {
262 	uint64_t ptr;
263 	uint32_t dword[2];
264 };
265 
266 struct qwx_xfer_data {
267 	bus_dmamap_t	map;
268 	struct mbuf	*m;
269 };
270 
271 #define QWX_PCI_XFER_MAX_DATA_SIZE	0xffff
272 #define QWX_PCI_XFER_RING_MAX_ELEMENTS	64
273 
274 struct qwx_pci_xfer_ring {
275 	struct qwx_dmamem	*dmamem;
276 	bus_size_t		size;
277 	uint32_t		mhi_chan_id;
278 	uint32_t		mhi_chan_state;
279 	uint32_t		mhi_chan_direction;
280 	uint32_t		mhi_chan_event_ring_index;
281 	uint32_t		db_addr;
282 	uint32_t		cmd_status;
283 	int			num_elements;
284 	int			queued;
285 	struct qwx_xfer_data	data[QWX_PCI_XFER_RING_MAX_ELEMENTS];
286 	uint64_t		rp;
287 	uint64_t		wp;
288 	struct qwx_mhi_chan_ctxt *chan_ctxt;
289 };
290 
291 
292 #define QWX_PCI_EVENT_RING_MAX_ELEMENTS	256
293 
294 struct qwx_pci_event_ring {
295 	struct qwx_dmamem	*dmamem;
296 	bus_size_t		size;
297 	uint32_t		mhi_er_type;
298 	uint32_t		mhi_er_irq;
299 	uint32_t		mhi_er_irq_moderation_ms;
300 	uint32_t		db_addr;
301 	int			num_elements;
302 	uint64_t		rp;
303 	uint64_t		wp;
304 	struct qwx_mhi_event_ctxt *event_ctxt;
305 };
306 
307 struct qwx_cmd_data {
308 	bus_dmamap_t	map;
309 	struct mbuf	*m;
310 };
311 
312 #define QWX_PCI_CMD_RING_MAX_ELEMENTS	128
313 
314 struct qwx_pci_cmd_ring {
315 	struct qwx_dmamem	*dmamem;
316 	bus_size_t		size;
317 	uint64_t		rp;
318 	uint64_t		wp;
319 	int			num_elements;
320 	int			queued;
321 };
322 
323 struct qwx_pci_ops;
324 struct qwx_msi_config;
325 
326 #define QWX_NUM_MSI_VEC	32
327 
328 struct qwx_pci_softc {
329 	struct qwx_softc	sc_sc;
330 	pci_chipset_tag_t	sc_pc;
331 	pcitag_t		sc_tag;
332 	int			sc_cap_off;
333 	int			sc_msi_off;
334 	pcireg_t		sc_msi_cap;
335 	void			*sc_ih[QWX_NUM_MSI_VEC];
336 	char			sc_ivname[QWX_NUM_MSI_VEC][16];
337 	struct qwx_ext_irq_grp	ext_irq_grp[ATH11K_EXT_IRQ_GRP_NUM_MAX];
338 	int			mhi_irq[2];
339 	bus_space_tag_t		sc_st;
340 	bus_space_handle_t	sc_sh;
341 	bus_addr_t		sc_map;
342 	bus_size_t		sc_mapsize;
343 
344 	pcireg_t		sc_lcsr;
345 	uint32_t		sc_flags;
346 #define ATH11K_PCI_ASPM_RESTORE	1
347 
348 	uint32_t		register_window;
349 	const struct qwx_pci_ops *sc_pci_ops;
350 
351 	uint32_t		 bhi_off;
352 	uint32_t		 bhi_ee;
353 	uint32_t		 bhie_off;
354 	uint32_t		 mhi_state;
355 	uint32_t		 max_chan;
356 
357 	uint64_t		 wake_db;
358 
359 	/*
360 	 * DMA memory for AMSS.bin firmware image.
361 	 * This memory must remain available to the device until
362 	 * the device is powered down.
363 	 */
364 	struct qwx_dmamem	*amss_data;
365 	struct qwx_dmamem	*amss_vec;
366 
367 	struct qwx_dmamem	 *rddm_vec;
368 	struct qwx_dmamem	 *rddm_data;
369 	int			 rddm_triggered;
370 	struct task		 rddm_task;
371 #define	QWX_RDDM_DUMP_SIZE	0x420000
372 
373 	struct qwx_dmamem	*chan_ctxt;
374 	struct qwx_dmamem	*event_ctxt;
375 	struct qwx_dmamem	*cmd_ctxt;
376 
377 
378 	struct qwx_pci_xfer_ring xfer_rings[4];
379 #define QWX_PCI_XFER_RING_LOOPBACK_OUTBOUND	0
380 #define QWX_PCI_XFER_RING_LOOPBACK_INBOUND	1
381 #define QWX_PCI_XFER_RING_IPCR_OUTBOUND		2
382 #define QWX_PCI_XFER_RING_IPCR_INBOUND		3
383 	struct qwx_pci_event_ring event_rings[QWX_NUM_EVENT_CTX];
384 	struct qwx_pci_cmd_ring cmd_ring;
385 };
386 
387 int	qwx_pci_match(struct device *, void *, void *);
388 void	qwx_pci_attach(struct device *, struct device *, void *);
389 int	qwx_pci_detach(struct device *, int);
390 void	qwx_pci_attach_hook(struct device *);
391 void	qwx_pci_free_xfer_rings(struct qwx_pci_softc *);
392 int	qwx_pci_alloc_xfer_ring(struct qwx_softc *, struct qwx_pci_xfer_ring *,
393 	    uint32_t, uint32_t, uint32_t, size_t);
394 int	qwx_pci_alloc_xfer_rings_qca6390(struct qwx_pci_softc *);
395 int	qwx_pci_alloc_xfer_rings_qcn9074(struct qwx_pci_softc *);
396 void	qwx_pci_free_event_rings(struct qwx_pci_softc *);
397 int	qwx_pci_alloc_event_ring(struct qwx_softc *,
398 	    struct qwx_pci_event_ring *, uint32_t, uint32_t, uint32_t, size_t);
399 int	qwx_pci_alloc_event_rings(struct qwx_pci_softc *);
400 void	qwx_pci_free_cmd_ring(struct qwx_pci_softc *);
401 int	qwx_pci_init_cmd_ring(struct qwx_softc *, struct qwx_pci_cmd_ring *);
402 uint32_t qwx_pci_read(struct qwx_softc *, uint32_t);
403 void	qwx_pci_write(struct qwx_softc *, uint32_t, uint32_t);
404 
405 void	qwx_pci_read_hw_version(struct qwx_softc *, uint32_t *, uint32_t *);
406 uint32_t qwx_pcic_read32(struct qwx_softc *, uint32_t);
407 void	 qwx_pcic_write32(struct qwx_softc *, uint32_t, uint32_t);
408 
409 void	qwx_pcic_ext_irq_enable(struct qwx_softc *);
410 void	qwx_pcic_ext_irq_disable(struct qwx_softc *);
411 int	qwx_pcic_config_irq(struct qwx_softc *, struct pci_attach_args *);
412 
413 int	qwx_pci_start(struct qwx_softc *);
414 void	qwx_pci_stop(struct qwx_softc *);
415 void	qwx_pci_aspm_disable(struct qwx_softc *);
416 void	qwx_pci_aspm_restore(struct qwx_softc *);
417 int	qwx_pci_power_up(struct qwx_softc *);
418 void	qwx_pci_power_down(struct qwx_softc *);
419 
420 int	qwx_pci_bus_wake_up(struct qwx_softc *);
421 void	qwx_pci_bus_release(struct qwx_softc *);
422 void	qwx_pci_window_write32(struct qwx_softc *, uint32_t, uint32_t);
423 uint32_t qwx_pci_window_read32(struct qwx_softc *, uint32_t);
424 
425 int	qwx_mhi_register(struct qwx_softc *);
426 void	qwx_mhi_unregister(struct qwx_softc *);
427 void	qwx_mhi_ring_doorbell(struct qwx_softc *sc, uint64_t, uint64_t);
428 void	qwx_mhi_device_wake(struct qwx_softc *);
429 void	qwx_mhi_device_zzz(struct qwx_softc *);
430 int	qwx_mhi_wake_db_clear_valid(struct qwx_softc *);
431 void	qwx_mhi_init_xfer_rings(struct qwx_pci_softc *);
432 void	qwx_mhi_init_event_rings(struct qwx_pci_softc *);
433 void	qwx_mhi_init_cmd_ring(struct qwx_pci_softc *);
434 void	qwx_mhi_init_dev_ctxt(struct qwx_pci_softc *);
435 int	qwx_mhi_send_cmd(struct qwx_pci_softc *psc, uint32_t, uint32_t);
436 void *	qwx_pci_xfer_ring_get_elem(struct qwx_pci_xfer_ring *, uint64_t);
437 struct qwx_xfer_data *qwx_pci_xfer_ring_get_data(struct qwx_pci_xfer_ring *,
438 	    uint64_t);
439 int	qwx_mhi_submit_xfer(struct qwx_softc *sc, struct mbuf *m);
440 int	qwx_mhi_start_channel(struct qwx_pci_softc *,
441 	    struct qwx_pci_xfer_ring *);
442 int	qwx_mhi_start_channels(struct qwx_pci_softc *);
443 int	qwx_mhi_start(struct qwx_pci_softc *);
444 void	qwx_mhi_stop(struct qwx_softc *);
445 int	qwx_mhi_reset_device(struct qwx_softc *, int);
446 void	qwx_mhi_clear_vector(struct qwx_softc *);
447 int	qwx_mhi_fw_load_handler(struct qwx_pci_softc *);
448 int	qwx_mhi_await_device_reset(struct qwx_softc *);
449 int	qwx_mhi_await_device_ready(struct qwx_softc *);
450 void	qwx_mhi_ready_state_transition(struct qwx_pci_softc *);
451 void	qwx_mhi_mission_mode_state_transition(struct qwx_pci_softc *);
452 void	qwx_mhi_low_power_mode_state_transition(struct qwx_pci_softc *);
453 void	qwx_mhi_set_state(struct qwx_softc *, uint32_t);
454 void	qwx_mhi_init_mmio(struct qwx_pci_softc *);
455 int	qwx_mhi_fw_load_bhi(struct qwx_pci_softc *, uint8_t *, size_t);
456 int	qwx_mhi_fw_load_bhie(struct qwx_pci_softc *, uint8_t *, size_t);
457 void	qwx_rddm_prepare(struct qwx_pci_softc *);
458 void	qwx_rddm_task(void *);
459 void *	qwx_pci_event_ring_get_elem(struct qwx_pci_event_ring *, uint64_t);
460 void	qwx_pci_intr_ctrl_event_mhi(struct qwx_pci_softc *, uint32_t);
461 void	qwx_pci_intr_ctrl_event_ee(struct qwx_pci_softc *, uint32_t);
462 void	qwx_pci_intr_ctrl_event_cmd_complete(struct qwx_pci_softc *,
463 	    uint64_t, uint32_t);
464 int	qwx_pci_intr_ctrl_event(struct qwx_pci_softc *,
465 	    struct qwx_pci_event_ring *);
466 void	qwx_pci_intr_data_event_tx(struct qwx_pci_softc *,
467 	    struct qwx_mhi_ring_element *);
468 int	qwx_pci_intr_data_event(struct qwx_pci_softc *,
469 	    struct qwx_pci_event_ring *);
470 int	qwx_pci_intr_mhi_ctrl(void *);
471 int	qwx_pci_intr_mhi_data(void *);
472 int	qwx_pci_intr(void *);
473 
474 struct qwx_pci_ops {
475 	int	 (*wakeup)(struct qwx_softc *);
476 	void	 (*release)(struct qwx_softc *);
477 	int	 (*get_msi_irq)(struct qwx_softc *, unsigned int);
478 	void	 (*window_write32)(struct qwx_softc *, uint32_t, uint32_t);
479 	uint32_t (*window_read32)(struct qwx_softc *, uint32_t);
480 	int	 (*alloc_xfer_rings)(struct qwx_pci_softc *);
481 };
482 
483 
484 static const struct qwx_pci_ops qwx_pci_ops_qca6390 = {
485 	.wakeup = qwx_pci_bus_wake_up,
486 	.release = qwx_pci_bus_release,
487 #if notyet
488 	.get_msi_irq = qwx_pci_get_msi_irq,
489 #endif
490 	.window_write32 = qwx_pci_window_write32,
491 	.window_read32 = qwx_pci_window_read32,
492 	.alloc_xfer_rings = qwx_pci_alloc_xfer_rings_qca6390,
493 };
494 
495 static const struct qwx_pci_ops qwx_pci_ops_qcn9074 = {
496 	.wakeup = NULL,
497 	.release = NULL,
498 #if notyet
499 	.get_msi_irq = qwx_pci_get_msi_irq,
500 #endif
501 	.window_write32 = qwx_pci_window_write32,
502 	.window_read32 = qwx_pci_window_read32,
503 	.alloc_xfer_rings = qwx_pci_alloc_xfer_rings_qcn9074,
504 };
505 
506 const struct cfattach qwx_pci_ca = {
507 	sizeof(struct qwx_pci_softc),
508 	qwx_pci_match,
509 	qwx_pci_attach,
510 	qwx_pci_detach,
511 	qwx_activate
512 };
513 
514 /* XXX pcidev */
515 #define PCI_PRODUCT_QUALCOMM_QCA6390	0x1101
516 #define PCI_PRODUCT_QUALCOMM_QCN9074	0x1104
517 
518 static const struct pci_matchid qwx_pci_devices[] = {
519 #if notyet
520 	{ PCI_VENDOR_QUALCOMM, PCI_PRODUCT_QUALCOMM_QCA6390 },
521 	{ PCI_VENDOR_QUALCOMM, PCI_PRODUCT_QUALCOMM_QCN9074 },
522 #endif
523 	{ PCI_VENDOR_QUALCOMM, PCI_PRODUCT_QUALCOMM_QCNFA765 }
524 };
525 
526 int
527 qwx_pci_match(struct device *parent, void *match, void *aux)
528 {
529 	return pci_matchbyid(aux, qwx_pci_devices, nitems(qwx_pci_devices));
530 }
531 
532 void
533 qwx_pci_init_qmi_ce_config(struct qwx_softc *sc)
534 {
535 	struct qwx_qmi_ce_cfg *cfg = &sc->qmi_ce_cfg;
536 
537 	qwx_ce_get_shadow_config(sc, &cfg->shadow_reg_v2,
538 	    &cfg->shadow_reg_v2_len);
539 }
540 
541 const struct qwx_msi_config qwx_msi_config_one_msi = {
542 	.total_vectors = 1,
543 	.total_users = 4,
544 	.users = (struct qwx_msi_user[]) {
545 		{ .name = "MHI", .num_vectors = 1, .base_vector = 0 },
546 		{ .name = "CE", .num_vectors = 1, .base_vector = 0 },
547 		{ .name = "WAKE", .num_vectors = 1, .base_vector = 0 },
548 		{ .name = "DP", .num_vectors = 1, .base_vector = 0 },
549 	},
550 };
551 
552 const struct qwx_msi_config qwx_msi_config[] = {
553 	{
554 		.total_vectors = 32,
555 		.total_users = 4,
556 		.users = (struct qwx_msi_user[]) {
557 			{ .name = "MHI", .num_vectors = 3, .base_vector = 0 },
558 			{ .name = "CE", .num_vectors = 10, .base_vector = 3 },
559 			{ .name = "WAKE", .num_vectors = 1, .base_vector = 13 },
560 			{ .name = "DP", .num_vectors = 18, .base_vector = 14 },
561 		},
562 		.hw_rev = ATH11K_HW_QCA6390_HW20,
563 	},
564 	{
565 		.total_vectors = 16,
566 		.total_users = 3,
567 		.users = (struct qwx_msi_user[]) {
568 			{ .name = "MHI", .num_vectors = 3, .base_vector = 0 },
569 			{ .name = "CE", .num_vectors = 5, .base_vector = 3 },
570 			{ .name = "DP", .num_vectors = 8, .base_vector = 8 },
571 		},
572 		.hw_rev = ATH11K_HW_QCN9074_HW10,
573 	},
574 	{
575 		.total_vectors = 32,
576 		.total_users = 4,
577 		.users = (struct qwx_msi_user[]) {
578 			{ .name = "MHI", .num_vectors = 3, .base_vector = 0 },
579 			{ .name = "CE", .num_vectors = 10, .base_vector = 3 },
580 			{ .name = "WAKE", .num_vectors = 1, .base_vector = 13 },
581 			{ .name = "DP", .num_vectors = 18, .base_vector = 14 },
582 		},
583 		.hw_rev = ATH11K_HW_WCN6855_HW20,
584 	},
585 	{
586 		.total_vectors = 32,
587 		.total_users = 4,
588 		.users = (struct qwx_msi_user[]) {
589 			{ .name = "MHI", .num_vectors = 3, .base_vector = 0 },
590 			{ .name = "CE", .num_vectors = 10, .base_vector = 3 },
591 			{ .name = "WAKE", .num_vectors = 1, .base_vector = 13 },
592 			{ .name = "DP", .num_vectors = 18, .base_vector = 14 },
593 		},
594 		.hw_rev = ATH11K_HW_WCN6855_HW21,
595 	},
596 	{
597 		.total_vectors = 28,
598 		.total_users = 2,
599 		.users = (struct qwx_msi_user[]) {
600 			{ .name = "CE", .num_vectors = 10, .base_vector = 0 },
601 			{ .name = "DP", .num_vectors = 18, .base_vector = 10 },
602 		},
603 		.hw_rev = ATH11K_HW_WCN6750_HW10,
604 	},
605 };
606 
607 int
608 qwx_pcic_init_msi_config(struct qwx_softc *sc)
609 {
610 	const struct qwx_msi_config *msi_config;
611 	int i;
612 
613 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags)) {
614 		sc->msi_cfg = &qwx_msi_config_one_msi;
615 		return 0;
616 	}
617 	for (i = 0; i < nitems(qwx_msi_config); i++) {
618 		msi_config = &qwx_msi_config[i];
619 
620 		if (msi_config->hw_rev == sc->sc_hw_rev)
621 			break;
622 	}
623 
624 	if (i == nitems(qwx_msi_config)) {
625 		printf("%s: failed to fetch msi config, "
626 		    "unsupported hw version: 0x%x\n",
627 		    sc->sc_dev.dv_xname, sc->sc_hw_rev);
628 		return EINVAL;
629 	}
630 
631 	sc->msi_cfg = msi_config;
632 	return 0;
633 }
634 
635 int
636 qwx_pci_alloc_msi(struct qwx_softc *sc)
637 {
638 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
639 	uint64_t addr;
640 	pcireg_t data;
641 
642 	if (psc->sc_msi_cap & PCI_MSI_MC_C64) {
643 		uint64_t addr_hi;
644 		pcireg_t addr_lo;
645 
646 		addr_lo = pci_conf_read(psc->sc_pc, psc->sc_tag,
647 		    psc->sc_msi_off + PCI_MSI_MA);
648 		addr_hi = pci_conf_read(psc->sc_pc, psc->sc_tag,
649 		    psc->sc_msi_off + PCI_MSI_MAU32);
650 		addr = addr_hi << 32 | addr_lo;
651 		data = pci_conf_read(psc->sc_pc, psc->sc_tag,
652 		    psc->sc_msi_off + PCI_MSI_MD64);
653 	} else {
654 		addr = pci_conf_read(psc->sc_pc, psc->sc_tag,
655 		    psc->sc_msi_off + PCI_MSI_MA);
656 		data = pci_conf_read(psc->sc_pc, psc->sc_tag,
657 		    psc->sc_msi_off + PCI_MSI_MD32);
658 	}
659 
660 	sc->msi_addr_lo = addr & 0xffffffff;
661 	sc->msi_addr_hi = ((uint64_t)addr) >> 32;
662 	sc->msi_data_start = data;
663 
664 	DPRINTF("%s: MSI addr: 0x%llx MSI data: 0x%x\n", sc->sc_dev.dv_xname,
665 	    addr, data);
666 
667 	return 0;
668 }
669 
670 int
671 qwx_pcic_map_service_to_pipe(struct qwx_softc *sc, uint16_t service_id,
672     uint8_t *ul_pipe, uint8_t *dl_pipe)
673 {
674 	const struct service_to_pipe *entry;
675 	int ul_set = 0, dl_set = 0;
676 	int i;
677 
678 	for (i = 0; i < sc->hw_params.svc_to_ce_map_len; i++) {
679 		entry = &sc->hw_params.svc_to_ce_map[i];
680 
681 		if (le32toh(entry->service_id) != service_id)
682 			continue;
683 
684 		switch (le32toh(entry->pipedir)) {
685 		case PIPEDIR_NONE:
686 			break;
687 		case PIPEDIR_IN:
688 			*dl_pipe = le32toh(entry->pipenum);
689 			dl_set = 1;
690 			break;
691 		case PIPEDIR_OUT:
692 			*ul_pipe = le32toh(entry->pipenum);
693 			ul_set = 1;
694 			break;
695 		case PIPEDIR_INOUT:
696 			*dl_pipe = le32toh(entry->pipenum);
697 			*ul_pipe = le32toh(entry->pipenum);
698 			dl_set = 1;
699 			ul_set = 1;
700 			break;
701 		}
702 	}
703 
704 	if (!ul_set || !dl_set) {
705 		DPRINTF("%s: found no uplink and no downlink\n", __func__);
706 		return ENOENT;
707 	}
708 
709 	return 0;
710 }
711 
712 int
713 qwx_pcic_get_user_msi_vector(struct qwx_softc *sc, char *user_name,
714     int *num_vectors, uint32_t *user_base_data, uint32_t *base_vector)
715 {
716 	const struct qwx_msi_config *msi_config = sc->msi_cfg;
717 	int idx;
718 
719 	for (idx = 0; idx < msi_config->total_users; idx++) {
720 		if (strcmp(user_name, msi_config->users[idx].name) == 0) {
721 			*num_vectors = msi_config->users[idx].num_vectors;
722 			*base_vector =  msi_config->users[idx].base_vector;
723 			*user_base_data = *base_vector + sc->msi_data_start;
724 
725 			DPRINTF("%s: MSI assignment %s num_vectors %d "
726 			    "user_base_data %u base_vector %u\n", __func__,
727 			    user_name, *num_vectors, *user_base_data,
728 			    *base_vector);
729 			return 0;
730 		}
731 	}
732 
733 	DPRINTF("%s: Failed to find MSI assignment for %s\n",
734 	    sc->sc_dev.dv_xname, user_name);
735 
736 	return EINVAL;
737 }
738 
739 void
740 qwx_pci_attach(struct device *parent, struct device *self, void *aux)
741 {
742 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)self;
743 	struct qwx_softc *sc = &psc->sc_sc;
744 	struct ieee80211com *ic = &sc->sc_ic;
745 	struct ifnet *ifp = &ic->ic_if;
746 	uint32_t soc_hw_version_major, soc_hw_version_minor;
747 	const struct qwx_pci_ops *pci_ops;
748 	struct pci_attach_args *pa = aux;
749 	pci_intr_handle_t ih;
750 	pcireg_t memtype, reg;
751 	const char *intrstr;
752 	int error;
753 	pcireg_t sreg;
754 
755 	sc->sc_dmat = pa->pa_dmat;
756 	psc->sc_pc = pa->pa_pc;
757 	psc->sc_tag = pa->pa_tag;
758 
759 #ifdef __HAVE_FDT
760 	sc->sc_node = PCITAG_NODE(pa->pa_tag);
761 #endif
762 
763 	rw_init(&sc->ioctl_rwl, "qwxioctl");
764 
765 	sreg = pci_conf_read(psc->sc_pc, psc->sc_tag, PCI_SUBSYS_ID_REG);
766 	sc->id.bdf_search = ATH11K_BDF_SEARCH_DEFAULT;
767 	sc->id.vendor = PCI_VENDOR(pa->pa_id);
768 	sc->id.device = PCI_PRODUCT(pa->pa_id);
769 	sc->id.subsystem_vendor = PCI_VENDOR(sreg);
770 	sc->id.subsystem_device = PCI_PRODUCT(sreg);
771 
772 	strlcpy(sc->sc_bus_str, "pci", sizeof(sc->sc_bus_str));
773 
774 	sc->ops.read32 = qwx_pcic_read32;
775 	sc->ops.write32 = qwx_pcic_write32;
776 	sc->ops.start = qwx_pci_start;
777 	sc->ops.stop = qwx_pci_stop;
778 	sc->ops.power_up = qwx_pci_power_up;
779 	sc->ops.power_down = qwx_pci_power_down;
780 	sc->ops.submit_xfer = qwx_mhi_submit_xfer;
781 	sc->ops.irq_enable = qwx_pcic_ext_irq_enable;
782 	sc->ops.irq_disable = qwx_pcic_ext_irq_disable;
783 	sc->ops.map_service_to_pipe = qwx_pcic_map_service_to_pipe;
784 	sc->ops.get_user_msi_vector = qwx_pcic_get_user_msi_vector;
785 
786 	if (pci_get_capability(psc->sc_pc, psc->sc_tag, PCI_CAP_PCIEXPRESS,
787 	    &psc->sc_cap_off, NULL) == 0) {
788 		printf(": can't find PCIe capability structure\n");
789 		return;
790 	}
791 
792 	if (pci_get_capability(psc->sc_pc, psc->sc_tag, PCI_CAP_MSI,
793 	    &psc->sc_msi_off, &psc->sc_msi_cap) == 0) {
794 		printf(": can't find MSI capability structure\n");
795 		return;
796 	}
797 
798 	reg = pci_conf_read(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG);
799 	reg |= PCI_COMMAND_MASTER_ENABLE;
800 	pci_conf_write(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG, reg);
801 
802 	memtype = pci_mapreg_type(pa->pa_pc, pa->pa_tag, PCI_MAPREG_START);
803 	if (pci_mapreg_map(pa, PCI_MAPREG_START, memtype, 0,
804 	    &psc->sc_st, &psc->sc_sh, &psc->sc_map, &psc->sc_mapsize, 0)) {
805 		printf(": can't map mem space\n");
806 		return;
807 	}
808 
809 	sc->mem = psc->sc_map;
810 
811 	sc->num_msivec = 32;
812 	if (pci_intr_enable_msivec(pa, sc->num_msivec) != 0) {
813 		sc->num_msivec = 1;
814 		if (pci_intr_map_msi(pa, &ih) != 0) {
815 			printf(": can't map interrupt\n");
816 			return;
817 		}
818 		clear_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags);
819 	} else {
820 		if (pci_intr_map_msivec(pa, 0, &ih) != 0 &&
821 		    pci_intr_map_msi(pa, &ih) != 0) {
822 			printf(": can't map interrupt\n");
823 			return;
824 		}
825 		set_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags);
826 		psc->mhi_irq[MHI_ER_CTRL] = 1;
827 		psc->mhi_irq[MHI_ER_DATA] = 2;
828 	}
829 
830 	intrstr = pci_intr_string(psc->sc_pc, ih);
831 	snprintf(psc->sc_ivname[0], sizeof(psc->sc_ivname[0]), "%s:bhi",
832 	    sc->sc_dev.dv_xname);
833 	psc->sc_ih[0] = pci_intr_establish(psc->sc_pc, ih, IPL_NET,
834 	    qwx_pci_intr, psc, psc->sc_ivname[0]);
835 	if (psc->sc_ih[0] == NULL) {
836 		printf(": can't establish interrupt");
837 		if (intrstr != NULL)
838 			printf(" at %s", intrstr);
839 		printf("\n");
840 		return;
841 	}
842 	printf(": %s\n", intrstr);
843 
844 	if (test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags)) {
845 		int msivec;
846 
847 		msivec = psc->mhi_irq[MHI_ER_CTRL];
848 		if (pci_intr_map_msivec(pa, msivec, &ih) != 0 &&
849 		    pci_intr_map_msi(pa, &ih) != 0) {
850 			printf(": can't map interrupt\n");
851 			return;
852 		}
853 		snprintf(psc->sc_ivname[msivec],
854 		    sizeof(psc->sc_ivname[msivec]),
855 		    "%s:mhic", sc->sc_dev.dv_xname);
856 		psc->sc_ih[msivec] = pci_intr_establish(psc->sc_pc, ih,
857 		    IPL_NET, qwx_pci_intr_mhi_ctrl, psc,
858 		    psc->sc_ivname[msivec]);
859 		if (psc->sc_ih[msivec] == NULL) {
860 			printf("%s: can't establish interrupt\n",
861 			    sc->sc_dev.dv_xname);
862 			return;
863 		}
864 
865 		msivec = psc->mhi_irq[MHI_ER_DATA];
866 		if (pci_intr_map_msivec(pa, msivec, &ih) != 0 &&
867 		    pci_intr_map_msi(pa, &ih) != 0) {
868 			printf(": can't map interrupt\n");
869 			return;
870 		}
871 		snprintf(psc->sc_ivname[msivec],
872 		    sizeof(psc->sc_ivname[msivec]),
873 		    "%s:mhid", sc->sc_dev.dv_xname);
874 		psc->sc_ih[msivec] = pci_intr_establish(psc->sc_pc, ih,
875 		    IPL_NET, qwx_pci_intr_mhi_data, psc,
876 		    psc->sc_ivname[msivec]);
877 		if (psc->sc_ih[msivec] == NULL) {
878 			printf("%s: can't establish interrupt\n",
879 			    sc->sc_dev.dv_xname);
880 			return;
881 		}
882 	}
883 
884 	pci_set_powerstate(pa->pa_pc, pa->pa_tag, PCI_PMCSR_STATE_D0);
885 
886 	switch (PCI_PRODUCT(pa->pa_id)) {
887 	case PCI_PRODUCT_QUALCOMM_QCA6390:
888 		qwx_pci_read_hw_version(sc, &soc_hw_version_major,
889 		    &soc_hw_version_minor);
890 		switch (soc_hw_version_major) {
891 		case 2:
892 			sc->sc_hw_rev = ATH11K_HW_QCA6390_HW20;
893 			break;
894 		default:
895 			printf(": unsupported QCA6390 SOC version: %d %d\n",
896 				soc_hw_version_major, soc_hw_version_minor);
897 			return;
898 		}
899 
900 		pci_ops = &qwx_pci_ops_qca6390;
901 		psc->max_chan = QWX_MHI_CONFIG_QCA6390_MAX_CHANNELS;
902 		break;
903 	case PCI_PRODUCT_QUALCOMM_QCN9074:
904 		pci_ops = &qwx_pci_ops_qcn9074;
905 		sc->sc_hw_rev = ATH11K_HW_QCN9074_HW10;
906 		psc->max_chan = QWX_MHI_CONFIG_QCA9074_MAX_CHANNELS;
907 		break;
908 	case PCI_PRODUCT_QUALCOMM_QCNFA765:
909 		sc->id.bdf_search = ATH11K_BDF_SEARCH_BUS_AND_BOARD;
910 		qwx_pci_read_hw_version(sc, &soc_hw_version_major,
911 		    &soc_hw_version_minor);
912 		switch (soc_hw_version_major) {
913 		case 2:
914 			switch (soc_hw_version_minor) {
915 			case 0x00:
916 			case 0x01:
917 				sc->sc_hw_rev = ATH11K_HW_WCN6855_HW20;
918 				break;
919 			case 0x10:
920 			case 0x11:
921 				sc->sc_hw_rev = ATH11K_HW_WCN6855_HW21;
922 				break;
923 			default:
924 				goto unsupported_wcn6855_soc;
925 			}
926 			break;
927 		default:
928 unsupported_wcn6855_soc:
929 			printf(": unsupported WCN6855 SOC version: %d %d\n",
930 				soc_hw_version_major, soc_hw_version_minor);
931 			return;
932 		}
933 
934 		pci_ops = &qwx_pci_ops_qca6390;
935 		psc->max_chan = QWX_MHI_CONFIG_QCA6390_MAX_CHANNELS;
936 		break;
937 	default:
938 		printf(": unsupported chip\n");
939 		return;
940 	}
941 
942 	/* register PCI ops */
943 	psc->sc_pci_ops = pci_ops;
944 
945 	error = qwx_pcic_init_msi_config(sc);
946 	if (error)
947 		goto err_pci_free_region;
948 
949 	error = qwx_pci_alloc_msi(sc);
950 	if (error) {
951 		printf("%s: failed to enable msi: %d\n", sc->sc_dev.dv_xname,
952 		    error);
953 		goto err_pci_free_region;
954 	}
955 
956 	error = qwx_init_hw_params(sc);
957 	if (error)
958 		goto err_pci_disable_msi;
959 
960 	psc->chan_ctxt = qwx_dmamem_alloc(sc->sc_dmat,
961 	    sizeof(struct qwx_mhi_chan_ctxt) * psc->max_chan, 0);
962 	if (psc->chan_ctxt == NULL) {
963 		printf("%s: could not allocate channel context array\n",
964 		    sc->sc_dev.dv_xname);
965 		goto err_pci_disable_msi;
966 	}
967 
968 	if (psc->sc_pci_ops->alloc_xfer_rings(psc)) {
969 		printf("%s: could not allocate transfer rings\n",
970 		    sc->sc_dev.dv_xname);
971 		goto err_pci_free_chan_ctxt;
972 	}
973 
974 	psc->event_ctxt = qwx_dmamem_alloc(sc->sc_dmat,
975 	    sizeof(struct qwx_mhi_event_ctxt) * QWX_NUM_EVENT_CTX, 0);
976 	if (psc->event_ctxt == NULL) {
977 		printf("%s: could not allocate event context array\n",
978 		    sc->sc_dev.dv_xname);
979 		goto err_pci_free_xfer_rings;
980 	}
981 
982 	if (qwx_pci_alloc_event_rings(psc)) {
983 		printf("%s: could not allocate event rings\n",
984 		    sc->sc_dev.dv_xname);
985 		goto err_pci_free_event_ctxt;
986 	}
987 
988 	psc->cmd_ctxt = qwx_dmamem_alloc(sc->sc_dmat,
989 	    sizeof(struct qwx_mhi_cmd_ctxt), 0);
990 	if (psc->cmd_ctxt == NULL) {
991 		printf("%s: could not allocate command context array\n",
992 		    sc->sc_dev.dv_xname);
993 		goto err_pci_free_event_rings;
994 	}
995 
996 	if (qwx_pci_init_cmd_ring(sc, &psc->cmd_ring))  {
997 		printf("%s: could not allocate command ring\n",
998 		    sc->sc_dev.dv_xname);
999 		goto err_pci_free_cmd_ctxt;
1000 	}
1001 
1002 	error = qwx_mhi_register(sc);
1003 	if (error) {
1004 		printf(": failed to register mhi: %d\n", error);
1005 		goto err_pci_free_cmd_ring;
1006 	}
1007 
1008 	error = qwx_hal_srng_init(sc);
1009 	if (error)
1010 		goto err_mhi_unregister;
1011 
1012 	error = qwx_ce_alloc_pipes(sc);
1013 	if (error) {
1014 		printf(": failed to allocate ce pipes: %d\n", error);
1015 		goto err_hal_srng_deinit;
1016 	}
1017 
1018 	sc->sc_nswq = taskq_create("qwxns", 1, IPL_NET, 0);
1019 	if (sc->sc_nswq == NULL)
1020 		goto err_ce_free;
1021 
1022 	qwx_pci_init_qmi_ce_config(sc);
1023 
1024 	error = qwx_pcic_config_irq(sc, pa);
1025 	if (error) {
1026 		printf("%s: failed to config irq: %d\n",
1027 		    sc->sc_dev.dv_xname, error);
1028 		goto err_ce_free;
1029 	}
1030 #if notyet
1031 	ret = ath11k_pci_set_irq_affinity_hint(ab_pci, cpumask_of(0));
1032 	if (ret) {
1033 		ath11k_err(ab, "failed to set irq affinity %d\n", ret);
1034 		goto err_free_irq;
1035 	}
1036 
1037 	/* kernel may allocate a dummy vector before request_irq and
1038 	 * then allocate a real vector when request_irq is called.
1039 	 * So get msi_data here again to avoid spurious interrupt
1040 	 * as msi_data will configured to srngs.
1041 	 */
1042 	ret = ath11k_pci_config_msi_data(ab_pci);
1043 	if (ret) {
1044 		ath11k_err(ab, "failed to config msi_data: %d\n", ret);
1045 		goto err_irq_affinity_cleanup;
1046 	}
1047 #endif
1048 	task_set(&psc->rddm_task, qwx_rddm_task, psc);
1049 
1050 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
1051 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
1052 	ic->ic_state = IEEE80211_S_INIT;
1053 
1054 	/* Set device capabilities. */
1055 	ic->ic_caps =
1056 #if 0
1057 	    IEEE80211_C_QOS | IEEE80211_C_TX_AMPDU | /* A-MPDU */
1058 #endif
1059 	    IEEE80211_C_ADDBA_OFFLOAD | /* device sends ADDBA/DELBA frames */
1060 	    IEEE80211_C_WEP |		/* WEP */
1061 	    IEEE80211_C_RSN |		/* WPA/RSN */
1062 	    IEEE80211_C_SCANALL |	/* device scans all channels at once */
1063 	    IEEE80211_C_SCANALLBAND |	/* device scans all bands at once */
1064 #if 0
1065 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
1066 #endif
1067 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
1068 	    IEEE80211_C_SHPREAMBLE;	/* short preamble supported */
1069 
1070 	ic->ic_sup_rates[IEEE80211_MODE_11A] = ieee80211_std_rateset_11a;
1071 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
1072 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
1073 
1074 	/* IBSS channel undefined for now. */
1075 	ic->ic_ibss_chan = &ic->ic_channels[1];
1076 
1077 	ifp->if_softc = sc;
1078 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
1079 	ifp->if_ioctl = qwx_ioctl;
1080 	ifp->if_start = qwx_start;
1081 	ifp->if_watchdog = qwx_watchdog;
1082 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
1083 	if_attach(ifp);
1084 	ieee80211_ifattach(ifp);
1085 	ieee80211_media_init(ifp, qwx_media_change, ieee80211_media_status);
1086 
1087 	ic->ic_node_alloc = qwx_node_alloc;
1088 
1089 	/* Override 802.11 state transition machine. */
1090 	sc->sc_newstate = ic->ic_newstate;
1091 	ic->ic_newstate = qwx_newstate;
1092 #if 0
1093 	ic->ic_updatechan = qwx_updatechan;
1094 	ic->ic_updateprot = qwx_updateprot;
1095 	ic->ic_updateslot = qwx_updateslot;
1096 	ic->ic_updateedca = qwx_updateedca;
1097 	ic->ic_updatedtim = qwx_updatedtim;
1098 #endif
1099 	/*
1100 	 * We cannot read the MAC address without loading the
1101 	 * firmware from disk. Postpone until mountroot is done.
1102 	 */
1103 	config_mountroot(self, qwx_pci_attach_hook);
1104 	return;
1105 
1106 err_ce_free:
1107 	qwx_ce_free_pipes(sc);
1108 err_hal_srng_deinit:
1109 err_mhi_unregister:
1110 err_pci_free_cmd_ring:
1111 	qwx_pci_free_cmd_ring(psc);
1112 err_pci_free_cmd_ctxt:
1113 	qwx_dmamem_free(sc->sc_dmat, psc->cmd_ctxt);
1114 	psc->cmd_ctxt = NULL;
1115 err_pci_free_event_rings:
1116 	qwx_pci_free_event_rings(psc);
1117 err_pci_free_event_ctxt:
1118 	qwx_dmamem_free(sc->sc_dmat, psc->event_ctxt);
1119 	psc->event_ctxt = NULL;
1120 err_pci_free_xfer_rings:
1121 	qwx_pci_free_xfer_rings(psc);
1122 err_pci_free_chan_ctxt:
1123 	qwx_dmamem_free(sc->sc_dmat, psc->chan_ctxt);
1124 	psc->chan_ctxt = NULL;
1125 err_pci_disable_msi:
1126 err_pci_free_region:
1127 	pci_intr_disestablish(psc->sc_pc, psc->sc_ih[0]);
1128 	return;
1129 }
1130 
1131 int
1132 qwx_pci_detach(struct device *self, int flags)
1133 {
1134 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)self;
1135 	struct qwx_softc *sc = &psc->sc_sc;
1136 
1137 	if (psc->sc_ih[0]) {
1138 		pci_intr_disestablish(psc->sc_pc, psc->sc_ih[0]);
1139 		psc->sc_ih[0] = NULL;
1140 	}
1141 
1142 	qwx_detach(sc);
1143 
1144 	qwx_pci_free_event_rings(psc);
1145 	qwx_pci_free_xfer_rings(psc);
1146 	qwx_pci_free_cmd_ring(psc);
1147 
1148 	if (psc->event_ctxt) {
1149 		qwx_dmamem_free(sc->sc_dmat, psc->event_ctxt);
1150 		psc->event_ctxt = NULL;
1151 	}
1152 	if (psc->chan_ctxt) {
1153 		qwx_dmamem_free(sc->sc_dmat, psc->chan_ctxt);
1154 		psc->chan_ctxt = NULL;
1155 	}
1156 	if (psc->cmd_ctxt) {
1157 		qwx_dmamem_free(sc->sc_dmat, psc->cmd_ctxt);
1158 		psc->cmd_ctxt = NULL;
1159 	}
1160 
1161 	if (psc->amss_data) {
1162 		qwx_dmamem_free(sc->sc_dmat, psc->amss_data);
1163 		psc->amss_data = NULL;
1164 	}
1165 	if (psc->amss_vec) {
1166 		qwx_dmamem_free(sc->sc_dmat, psc->amss_vec);
1167 		psc->amss_vec = NULL;
1168 	}
1169 
1170 	return 0;
1171 }
1172 
1173 void
1174 qwx_pci_attach_hook(struct device *self)
1175 {
1176 	struct qwx_softc *sc = (void *)self;
1177 	int s = splnet();
1178 
1179 	qwx_attach(sc);
1180 
1181 	splx(s);
1182 }
1183 
1184 void
1185 qwx_pci_free_xfer_rings(struct qwx_pci_softc *psc)
1186 {
1187 	struct qwx_softc *sc = &psc->sc_sc;
1188 	int i;
1189 
1190 	for (i = 0; i < nitems(psc->xfer_rings); i++) {
1191 		struct qwx_pci_xfer_ring *ring = &psc->xfer_rings[i];
1192 		if (ring->dmamem) {
1193 			qwx_dmamem_free(sc->sc_dmat, ring->dmamem);
1194 			ring->dmamem = NULL;
1195 		}
1196 		memset(ring, 0, sizeof(*ring));
1197 	}
1198 }
1199 
1200 int
1201 qwx_pci_alloc_xfer_ring(struct qwx_softc *sc, struct qwx_pci_xfer_ring *ring,
1202     uint32_t id, uint32_t direction, uint32_t event_ring_index,
1203     size_t num_elements)
1204 {
1205 	bus_size_t size;
1206 	int i, err;
1207 
1208 	memset(ring, 0, sizeof(*ring));
1209 
1210 	size = sizeof(struct qwx_mhi_ring_element) * num_elements;
1211 	/* Hardware requires that rings are aligned to ring size. */
1212 	ring->dmamem = qwx_dmamem_alloc(sc->sc_dmat, size, size);
1213 	if (ring->dmamem == NULL)
1214 		return ENOMEM;
1215 
1216 	ring->size = size;
1217 	ring->mhi_chan_id = id;
1218 	ring->mhi_chan_state = MHI_CH_STATE_DISABLED;
1219 	ring->mhi_chan_direction = direction;
1220 	ring->mhi_chan_event_ring_index = event_ring_index;
1221 	ring->num_elements = num_elements;
1222 
1223 	memset(ring->data, 0, sizeof(ring->data));
1224 	for (i = 0; i < ring->num_elements; i++) {
1225 		struct qwx_xfer_data *xfer = &ring->data[i];
1226 
1227 		err = bus_dmamap_create(sc->sc_dmat, QWX_PCI_XFER_MAX_DATA_SIZE,
1228 		    1, QWX_PCI_XFER_MAX_DATA_SIZE, 0, BUS_DMA_NOWAIT,
1229 		    &xfer->map);
1230 		if (err) {
1231 			printf("%s: could not create xfer DMA map\n",
1232 			    sc->sc_dev.dv_xname);
1233 			goto fail;
1234 		}
1235 
1236 		if (direction == MHI_CHAN_TYPE_INBOUND) {
1237 			struct mbuf *m;
1238 
1239 			m = m_gethdr(M_DONTWAIT, MT_DATA);
1240 			if (m == NULL) {
1241 				err = ENOBUFS;
1242 				goto fail;
1243 			}
1244 
1245 			MCLGETL(m, M_DONTWAIT, QWX_PCI_XFER_MAX_DATA_SIZE);
1246 			if ((m->m_flags & M_EXT) == 0) {
1247 				m_freem(m);
1248 				err = ENOBUFS;
1249 				goto fail;
1250 			}
1251 
1252 			m->m_len = m->m_pkthdr.len = QWX_PCI_XFER_MAX_DATA_SIZE;
1253 			err = bus_dmamap_load_mbuf(sc->sc_dmat, xfer->map,
1254 			    m, BUS_DMA_READ | BUS_DMA_NOWAIT);
1255 			if (err) {
1256 				printf("%s: can't map mbuf (error %d)\n",
1257 				    sc->sc_dev.dv_xname, err);
1258 				m_freem(m);
1259 				goto fail;
1260 			}
1261 
1262 			bus_dmamap_sync(sc->sc_dmat, xfer->map, 0,
1263 			    QWX_PCI_XFER_MAX_DATA_SIZE, BUS_DMASYNC_PREREAD);
1264 			xfer->m = m;
1265 		}
1266 	}
1267 
1268 	return 0;
1269 fail:
1270 	for (i = 0; i < ring->num_elements; i++) {
1271 		struct qwx_xfer_data *xfer = &ring->data[i];
1272 
1273 		if (xfer->map) {
1274 			bus_dmamap_sync(sc->sc_dmat, xfer->map, 0,
1275 			    xfer->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
1276 			bus_dmamap_unload(sc->sc_dmat, xfer->map);
1277 			bus_dmamap_destroy(sc->sc_dmat, xfer->map);
1278 			xfer->map = NULL;
1279 		}
1280 
1281 		if (xfer->m) {
1282 			m_freem(xfer->m);
1283 			xfer->m = NULL;
1284 		}
1285 	}
1286 	return 1;
1287 }
1288 
1289 int
1290 qwx_pci_alloc_xfer_rings_qca6390(struct qwx_pci_softc *psc)
1291 {
1292 	struct qwx_softc *sc = &psc->sc_sc;
1293 	int ret;
1294 
1295 	ret = qwx_pci_alloc_xfer_ring(sc,
1296 	    &psc->xfer_rings[QWX_PCI_XFER_RING_LOOPBACK_OUTBOUND],
1297 	    0, MHI_CHAN_TYPE_OUTBOUND, 0, 32);
1298 	if (ret)
1299 		goto fail;
1300 
1301 	ret = qwx_pci_alloc_xfer_ring(sc,
1302 	    &psc->xfer_rings[QWX_PCI_XFER_RING_LOOPBACK_INBOUND],
1303 	    1, MHI_CHAN_TYPE_INBOUND, 0, 32);
1304 	if (ret)
1305 		goto fail;
1306 
1307 	ret = qwx_pci_alloc_xfer_ring(sc,
1308 	    &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_OUTBOUND],
1309 	    20, MHI_CHAN_TYPE_OUTBOUND, 1, 64);
1310 	if (ret)
1311 		goto fail;
1312 
1313 	ret = qwx_pci_alloc_xfer_ring(sc,
1314 	    &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_INBOUND],
1315 	    21, MHI_CHAN_TYPE_INBOUND, 1, 64);
1316 	if (ret)
1317 		goto fail;
1318 
1319 	return 0;
1320 fail:
1321 	qwx_pci_free_xfer_rings(psc);
1322 	return ret;
1323 }
1324 
1325 int
1326 qwx_pci_alloc_xfer_rings_qcn9074(struct qwx_pci_softc *psc)
1327 {
1328 	struct qwx_softc *sc = &psc->sc_sc;
1329 	int ret;
1330 
1331 	ret = qwx_pci_alloc_xfer_ring(sc,
1332 	    &psc->xfer_rings[QWX_PCI_XFER_RING_LOOPBACK_OUTBOUND],
1333 	    0, MHI_CHAN_TYPE_OUTBOUND, 1, 32);
1334 	if (ret)
1335 		goto fail;
1336 
1337 	ret = qwx_pci_alloc_xfer_ring(sc,
1338 	    &psc->xfer_rings[QWX_PCI_XFER_RING_LOOPBACK_INBOUND],
1339 	    1, MHI_CHAN_TYPE_INBOUND, 1, 32);
1340 	if (ret)
1341 		goto fail;
1342 
1343 	ret = qwx_pci_alloc_xfer_ring(sc,
1344 	    &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_OUTBOUND],
1345 	    20, MHI_CHAN_TYPE_OUTBOUND, 1, 32);
1346 	if (ret)
1347 		goto fail;
1348 
1349 	ret = qwx_pci_alloc_xfer_ring(sc,
1350 	    &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_INBOUND],
1351 	    21, MHI_CHAN_TYPE_INBOUND, 1, 32);
1352 	if (ret)
1353 		goto fail;
1354 
1355 	return 0;
1356 fail:
1357 	qwx_pci_free_xfer_rings(psc);
1358 	return ret;
1359 }
1360 
1361 void
1362 qwx_pci_free_event_rings(struct qwx_pci_softc *psc)
1363 {
1364 	struct qwx_softc *sc = &psc->sc_sc;
1365 	int i;
1366 
1367 	for (i = 0; i < nitems(psc->event_rings); i++) {
1368 		struct qwx_pci_event_ring *ring = &psc->event_rings[i];
1369 		if (ring->dmamem) {
1370 			qwx_dmamem_free(sc->sc_dmat, ring->dmamem);
1371 			ring->dmamem = NULL;
1372 		}
1373 		memset(ring, 0, sizeof(*ring));
1374 	}
1375 }
1376 
1377 int
1378 qwx_pci_alloc_event_ring(struct qwx_softc *sc, struct qwx_pci_event_ring *ring,
1379     uint32_t type, uint32_t irq, uint32_t intmod, size_t num_elements)
1380 {
1381 	bus_size_t size;
1382 
1383 	memset(ring, 0, sizeof(*ring));
1384 
1385 	size = sizeof(struct qwx_mhi_ring_element) * num_elements;
1386 	/* Hardware requires that rings are aligned to ring size. */
1387 	ring->dmamem = qwx_dmamem_alloc(sc->sc_dmat, size, size);
1388 	if (ring->dmamem == NULL)
1389 		return ENOMEM;
1390 
1391 	ring->size = size;
1392 	ring->mhi_er_type = type;
1393 	ring->mhi_er_irq = irq;
1394 	ring->mhi_er_irq_moderation_ms = intmod;
1395 	ring->num_elements = num_elements;
1396 	return 0;
1397 }
1398 
1399 int
1400 qwx_pci_alloc_event_rings(struct qwx_pci_softc *psc)
1401 {
1402 	struct qwx_softc *sc = &psc->sc_sc;
1403 	int ret;
1404 
1405 	ret = qwx_pci_alloc_event_ring(sc, &psc->event_rings[0],
1406 	    MHI_ER_CTRL, psc->mhi_irq[MHI_ER_CTRL], 0, 32);
1407 	if (ret)
1408 		goto fail;
1409 
1410 	ret = qwx_pci_alloc_event_ring(sc, &psc->event_rings[1],
1411 	    MHI_ER_DATA, psc->mhi_irq[MHI_ER_DATA], 1, 256);
1412 	if (ret)
1413 		goto fail;
1414 
1415 	return 0;
1416 fail:
1417 	qwx_pci_free_event_rings(psc);
1418 	return ret;
1419 }
1420 
1421 void
1422 qwx_pci_free_cmd_ring(struct qwx_pci_softc *psc)
1423 {
1424 	struct qwx_softc *sc = &psc->sc_sc;
1425 	struct qwx_pci_cmd_ring *ring = &psc->cmd_ring;
1426 
1427 	if (ring->dmamem)
1428 		qwx_dmamem_free(sc->sc_dmat, ring->dmamem);
1429 
1430 	memset(ring, 0, sizeof(*ring));
1431 }
1432 
1433 int
1434 qwx_pci_init_cmd_ring(struct qwx_softc *sc, struct qwx_pci_cmd_ring *ring)
1435 {
1436 	memset(ring, 0, sizeof(*ring));
1437 
1438 	ring->num_elements = QWX_PCI_CMD_RING_MAX_ELEMENTS;
1439 	ring->size = sizeof(struct qwx_mhi_ring_element) * ring->num_elements;
1440 
1441 	/* Hardware requires that rings are aligned to ring size. */
1442 	ring->dmamem = qwx_dmamem_alloc(sc->sc_dmat, ring->size, ring->size);
1443 	if (ring->dmamem == NULL)
1444 		return ENOMEM;
1445 
1446 	return 0;
1447 }
1448 
1449 uint32_t
1450 qwx_pci_read(struct qwx_softc *sc, uint32_t addr)
1451 {
1452 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1453 
1454 	return (bus_space_read_4(psc->sc_st, psc->sc_sh, addr));
1455 }
1456 
1457 void
1458 qwx_pci_write(struct qwx_softc *sc, uint32_t addr, uint32_t val)
1459 {
1460 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1461 
1462 	bus_space_write_4(psc->sc_st, psc->sc_sh, addr, val);
1463 }
1464 
1465 void
1466 qwx_pci_read_hw_version(struct qwx_softc *sc, uint32_t *major,
1467     uint32_t *minor)
1468 {
1469 	uint32_t soc_hw_version;
1470 
1471 	soc_hw_version = qwx_pcic_read32(sc, TCSR_SOC_HW_VERSION);
1472 	*major = FIELD_GET(TCSR_SOC_HW_VERSION_MAJOR_MASK, soc_hw_version);
1473 	*minor = FIELD_GET(TCSR_SOC_HW_VERSION_MINOR_MASK, soc_hw_version);
1474 	DPRINTF("%s: pci tcsr_soc_hw_version major %d minor %d\n",
1475 	    sc->sc_dev.dv_xname, *major, *minor);
1476 }
1477 
1478 uint32_t
1479 qwx_pcic_read32(struct qwx_softc *sc, uint32_t offset)
1480 {
1481 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1482 	int ret = 0;
1483 	uint32_t val;
1484 	bool wakeup_required;
1485 
1486 	/* for offset beyond BAR + 4K - 32, may
1487 	 * need to wakeup the device to access.
1488 	 */
1489 	wakeup_required = test_bit(ATH11K_FLAG_DEVICE_INIT_DONE, sc->sc_flags)
1490 	    && offset >= ATH11K_PCI_ACCESS_ALWAYS_OFF;
1491 	if (wakeup_required && psc->sc_pci_ops->wakeup)
1492 		ret = psc->sc_pci_ops->wakeup(sc);
1493 
1494 	if (offset < ATH11K_PCI_WINDOW_START)
1495 		val = qwx_pci_read(sc, offset);
1496 	else
1497 		val = psc->sc_pci_ops->window_read32(sc, offset);
1498 
1499 	if (wakeup_required && !ret && psc->sc_pci_ops->release)
1500 		psc->sc_pci_ops->release(sc);
1501 
1502 	return val;
1503 }
1504 
1505 void
1506 qwx_pcic_write32(struct qwx_softc *sc, uint32_t offset, uint32_t value)
1507 {
1508 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1509 	int ret = 0;
1510 	bool wakeup_required;
1511 
1512 	/* for offset beyond BAR + 4K - 32, may
1513 	 * need to wakeup the device to access.
1514 	 */
1515 	wakeup_required = test_bit(ATH11K_FLAG_DEVICE_INIT_DONE, sc->sc_flags)
1516 	    && offset >= ATH11K_PCI_ACCESS_ALWAYS_OFF;
1517 	if (wakeup_required && psc->sc_pci_ops->wakeup)
1518 		ret = psc->sc_pci_ops->wakeup(sc);
1519 
1520 	if (offset < ATH11K_PCI_WINDOW_START)
1521 		qwx_pci_write(sc, offset, value);
1522 	else
1523 		psc->sc_pci_ops->window_write32(sc, offset, value);
1524 
1525 	if (wakeup_required && !ret && psc->sc_pci_ops->release)
1526 		psc->sc_pci_ops->release(sc);
1527 }
1528 
1529 void
1530 qwx_pcic_ext_irq_disable(struct qwx_softc *sc)
1531 {
1532 	clear_bit(ATH11K_FLAG_EXT_IRQ_ENABLED, sc->sc_flags);
1533 
1534 	/* In case of one MSI vector, we handle irq enable/disable in a
1535 	 * uniform way since we only have one irq
1536 	 */
1537 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1538 		return;
1539 
1540 	DPRINTF("%s not implemented\n", __func__);
1541 }
1542 
1543 void
1544 qwx_pcic_ext_irq_enable(struct qwx_softc *sc)
1545 {
1546 	set_bit(ATH11K_FLAG_EXT_IRQ_ENABLED, sc->sc_flags);
1547 
1548 	/* In case of one MSI vector, we handle irq enable/disable in a
1549 	 * uniform way since we only have one irq
1550 	 */
1551 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1552 		return;
1553 
1554 	DPRINTF("%s not implemented\n", __func__);
1555 }
1556 
1557 void
1558 qwx_pcic_ce_irq_enable(struct qwx_softc *sc, uint16_t ce_id)
1559 {
1560 	/* In case of one MSI vector, we handle irq enable/disable in a
1561 	 * uniform way since we only have one irq
1562 	 */
1563 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1564 		return;
1565 
1566 	/* OpenBSD PCI stack does not yet implement MSI interrupt masking. */
1567 	sc->msi_ce_irqmask |= (1U << ce_id);
1568 }
1569 
1570 void
1571 qwx_pcic_ce_irq_disable(struct qwx_softc *sc, uint16_t ce_id)
1572 {
1573 	/* In case of one MSI vector, we handle irq enable/disable in a
1574 	 * uniform way since we only have one irq
1575 	 */
1576 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1577 		return;
1578 
1579 	/* OpenBSD PCI stack does not yet implement MSI interrupt masking. */
1580 	sc->msi_ce_irqmask &= ~(1U << ce_id);
1581 }
1582 
1583 void
1584 qwx_pcic_ext_grp_disable(struct qwx_ext_irq_grp *irq_grp)
1585 {
1586 	struct qwx_softc *sc = irq_grp->sc;
1587 
1588 	/* In case of one MSI vector, we handle irq enable/disable
1589 	 * in a uniform way since we only have one irq
1590 	 */
1591 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1592 		return;
1593 }
1594 
1595 int
1596 qwx_pcic_ext_irq_config(struct qwx_softc *sc, struct pci_attach_args *pa)
1597 {
1598 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1599 	int i, ret, num_vectors = 0;
1600 	uint32_t msi_data_start = 0;
1601 	uint32_t base_vector = 0;
1602 
1603 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1604 		return 0;
1605 
1606 	ret = qwx_pcic_get_user_msi_vector(sc, "DP", &num_vectors,
1607 	    &msi_data_start, &base_vector);
1608 	if (ret < 0)
1609 		return ret;
1610 
1611 	for (i = 0; i < nitems(sc->ext_irq_grp); i++) {
1612 		struct qwx_ext_irq_grp *irq_grp = &sc->ext_irq_grp[i];
1613 		uint32_t num_irq = 0;
1614 
1615 		irq_grp->sc = sc;
1616 		irq_grp->grp_id = i;
1617 #if 0
1618 		init_dummy_netdev(&irq_grp->napi_ndev);
1619 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
1620 			       ath11k_pcic_ext_grp_napi_poll);
1621 #endif
1622 		if (sc->hw_params.ring_mask->tx[i] ||
1623 		    sc->hw_params.ring_mask->rx[i] ||
1624 		    sc->hw_params.ring_mask->rx_err[i] ||
1625 		    sc->hw_params.ring_mask->rx_wbm_rel[i] ||
1626 		    sc->hw_params.ring_mask->reo_status[i] ||
1627 		    sc->hw_params.ring_mask->rxdma2host[i] ||
1628 		    sc->hw_params.ring_mask->host2rxdma[i] ||
1629 		    sc->hw_params.ring_mask->rx_mon_status[i]) {
1630 			num_irq = 1;
1631 		}
1632 
1633 		irq_grp->num_irq = num_irq;
1634 		irq_grp->irqs[0] = ATH11K_PCI_IRQ_DP_OFFSET + i;
1635 
1636 		if (num_irq) {
1637 			int irq_idx = irq_grp->irqs[0];
1638 			pci_intr_handle_t ih;
1639 
1640 			if (pci_intr_map_msivec(pa, irq_idx, &ih) != 0 &&
1641 			    pci_intr_map(pa, &ih) != 0) {
1642 				printf("%s: can't map interrupt\n",
1643 				    sc->sc_dev.dv_xname);
1644 				return EIO;
1645 			}
1646 
1647 			snprintf(psc->sc_ivname[irq_idx], sizeof(psc->sc_ivname[0]),
1648 			    "%s:ex%d", sc->sc_dev.dv_xname, i);
1649 			psc->sc_ih[irq_idx] = pci_intr_establish(psc->sc_pc, ih,
1650 			    IPL_NET, qwx_ext_intr, irq_grp, psc->sc_ivname[irq_idx]);
1651 			if (psc->sc_ih[irq_idx] == NULL) {
1652 				printf("%s: failed to request irq %d\n",
1653 				    sc->sc_dev.dv_xname, irq_idx);
1654 				return EIO;
1655 			}
1656 		}
1657 
1658 		qwx_pcic_ext_grp_disable(irq_grp);
1659 	}
1660 
1661 	return 0;
1662 }
1663 
1664 int
1665 qwx_pcic_config_irq(struct qwx_softc *sc, struct pci_attach_args *pa)
1666 {
1667 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1668 	struct qwx_ce_pipe *ce_pipe;
1669 	uint32_t msi_data_start;
1670 	uint32_t msi_data_count, msi_data_idx;
1671 	uint32_t msi_irq_start;
1672 	int i, ret, irq_idx;
1673 	pci_intr_handle_t ih;
1674 
1675 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1676 		return 0;
1677 
1678 	ret = qwx_pcic_get_user_msi_vector(sc, "CE", &msi_data_count,
1679 	    &msi_data_start, &msi_irq_start);
1680 	if (ret)
1681 		return ret;
1682 
1683 	/* Configure CE irqs */
1684 	for (i = 0, msi_data_idx = 0; i < sc->hw_params.ce_count; i++) {
1685 		if (qwx_ce_get_attr_flags(sc, i) & CE_ATTR_DIS_INTR)
1686 			continue;
1687 
1688 		ce_pipe = &sc->ce.ce_pipe[i];
1689 		irq_idx = ATH11K_PCI_IRQ_CE0_OFFSET + i;
1690 
1691 		if (pci_intr_map_msivec(pa, irq_idx, &ih) != 0 &&
1692 		    pci_intr_map(pa, &ih) != 0) {
1693 			printf("%s: can't map interrupt\n",
1694 			    sc->sc_dev.dv_xname);
1695 			return EIO;
1696 		}
1697 
1698 		snprintf(psc->sc_ivname[irq_idx], sizeof(psc->sc_ivname[0]),
1699 		    "%s:ce%d", sc->sc_dev.dv_xname, ce_pipe->pipe_num);
1700 		psc->sc_ih[irq_idx] = pci_intr_establish(psc->sc_pc, ih,
1701 		    IPL_NET, qwx_ce_intr, ce_pipe, psc->sc_ivname[irq_idx]);
1702 		if (psc->sc_ih[irq_idx] == NULL) {
1703 			printf("%s: failed to request irq %d\n",
1704 			    sc->sc_dev.dv_xname, irq_idx);
1705 			return EIO;
1706 		}
1707 
1708 		msi_data_idx++;
1709 
1710 		qwx_pcic_ce_irq_disable(sc, i);
1711 	}
1712 
1713 	ret = qwx_pcic_ext_irq_config(sc, pa);
1714 	if (ret)
1715 		return ret;
1716 
1717 	return 0;
1718 }
1719 
1720 void
1721 qwx_pcic_ce_irqs_enable(struct qwx_softc *sc)
1722 {
1723 	int i;
1724 
1725 	set_bit(ATH11K_FLAG_CE_IRQ_ENABLED, sc->sc_flags);
1726 
1727 	for (i = 0; i < sc->hw_params.ce_count; i++) {
1728 		if (qwx_ce_get_attr_flags(sc, i) & CE_ATTR_DIS_INTR)
1729 			continue;
1730 		qwx_pcic_ce_irq_enable(sc, i);
1731 	}
1732 }
1733 
1734 void
1735 qwx_pcic_ce_irqs_disable(struct qwx_softc *sc)
1736 {
1737 	int i;
1738 
1739 	clear_bit(ATH11K_FLAG_CE_IRQ_ENABLED, sc->sc_flags);
1740 
1741 	for (i = 0; i < sc->hw_params.ce_count; i++) {
1742 		if (qwx_ce_get_attr_flags(sc, i) & CE_ATTR_DIS_INTR)
1743 			continue;
1744 		qwx_pcic_ce_irq_disable(sc, i);
1745 	}
1746 }
1747 
1748 int
1749 qwx_pci_start(struct qwx_softc *sc)
1750 {
1751 	/* TODO: for now don't restore ASPM in case of single MSI
1752 	 * vector as MHI register reading in M2 causes system hang.
1753 	 */
1754 	if (test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1755 		qwx_pci_aspm_restore(sc);
1756 	else
1757 		DPRINTF("%s: leaving PCI ASPM disabled to avoid MHI M2 problems"
1758 		    "\n", sc->sc_dev.dv_xname);
1759 
1760 	set_bit(ATH11K_FLAG_DEVICE_INIT_DONE, sc->sc_flags);
1761 
1762 	qwx_ce_rx_post_buf(sc);
1763 	qwx_pcic_ce_irqs_enable(sc);
1764 
1765 	return 0;
1766 }
1767 
1768 void
1769 qwx_pcic_ce_irq_disable_sync(struct qwx_softc *sc)
1770 {
1771 	qwx_pcic_ce_irqs_disable(sc);
1772 #if 0
1773 	ath11k_pcic_sync_ce_irqs(ab);
1774 	ath11k_pcic_kill_tasklets(ab);
1775 #endif
1776 }
1777 
1778 void
1779 qwx_pci_stop(struct qwx_softc *sc)
1780 {
1781 	qwx_pcic_ce_irq_disable_sync(sc);
1782 	qwx_ce_cleanup_pipes(sc);
1783 }
1784 
1785 int
1786 qwx_pci_bus_wake_up(struct qwx_softc *sc)
1787 {
1788 	if (qwx_mhi_wake_db_clear_valid(sc))
1789 		qwx_mhi_device_wake(sc);
1790 
1791 	return 0;
1792 }
1793 
1794 void
1795 qwx_pci_bus_release(struct qwx_softc *sc)
1796 {
1797 	if (qwx_mhi_wake_db_clear_valid(sc))
1798 		qwx_mhi_device_zzz(sc);
1799 }
1800 
1801 uint32_t
1802 qwx_pci_get_window_start(struct qwx_softc *sc, uint32_t offset)
1803 {
1804 	if (!sc->hw_params.static_window_map)
1805 		return ATH11K_PCI_WINDOW_START;
1806 
1807 	if ((offset ^ HAL_SEQ_WCSS_UMAC_OFFSET) < ATH11K_PCI_WINDOW_RANGE_MASK)
1808 		/* if offset lies within DP register range, use 3rd window */
1809 		return 3 * ATH11K_PCI_WINDOW_START;
1810 	else if ((offset ^ HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(sc)) <
1811 		 ATH11K_PCI_WINDOW_RANGE_MASK)
1812 		 /* if offset lies within CE register range, use 2nd window */
1813 		return 2 * ATH11K_PCI_WINDOW_START;
1814 	else
1815 		return ATH11K_PCI_WINDOW_START;
1816 }
1817 
1818 void
1819 qwx_pci_select_window(struct qwx_softc *sc, uint32_t offset)
1820 {
1821 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
1822 	uint32_t window = FIELD_GET(ATH11K_PCI_WINDOW_VALUE_MASK, offset);
1823 
1824 #if notyet
1825 	lockdep_assert_held(&ab_pci->window_lock);
1826 #endif
1827 
1828 	if (window != psc->register_window) {
1829 		qwx_pci_write(sc, ATH11K_PCI_WINDOW_REG_ADDRESS,
1830 		    ATH11K_PCI_WINDOW_ENABLE_BIT | window);
1831 		(void) qwx_pci_read(sc, ATH11K_PCI_WINDOW_REG_ADDRESS);
1832 		psc->register_window = window;
1833 	}
1834 }
1835 
1836 void
1837 qwx_pci_window_write32(struct qwx_softc *sc, uint32_t offset, uint32_t value)
1838 {
1839 	uint32_t window_start;
1840 
1841 	window_start = qwx_pci_get_window_start(sc, offset);
1842 
1843 	if (window_start == ATH11K_PCI_WINDOW_START) {
1844 #if notyet
1845 		spin_lock_bh(&ab_pci->window_lock);
1846 #endif
1847 		qwx_pci_select_window(sc, offset);
1848 		qwx_pci_write(sc, window_start +
1849 		    (offset & ATH11K_PCI_WINDOW_RANGE_MASK), value);
1850 #if notyet
1851 		spin_unlock_bh(&ab_pci->window_lock);
1852 #endif
1853 	} else {
1854 		qwx_pci_write(sc, window_start +
1855 		    (offset & ATH11K_PCI_WINDOW_RANGE_MASK), value);
1856 	}
1857 }
1858 
1859 uint32_t
1860 qwx_pci_window_read32(struct qwx_softc *sc, uint32_t offset)
1861 {
1862 	uint32_t window_start, val;
1863 
1864 	window_start = qwx_pci_get_window_start(sc, offset);
1865 
1866 	if (window_start == ATH11K_PCI_WINDOW_START) {
1867 #if notyet
1868 		spin_lock_bh(&ab_pci->window_lock);
1869 #endif
1870 		qwx_pci_select_window(sc, offset);
1871 		val = qwx_pci_read(sc, window_start +
1872 		    (offset & ATH11K_PCI_WINDOW_RANGE_MASK));
1873 #if notyet
1874 		spin_unlock_bh(&ab_pci->window_lock);
1875 #endif
1876 	} else {
1877 		val = qwx_pci_read(sc, window_start +
1878 		    (offset & ATH11K_PCI_WINDOW_RANGE_MASK));
1879 	}
1880 
1881 	return val;
1882 }
1883 
1884 void
1885 qwx_pci_select_static_window(struct qwx_softc *sc)
1886 {
1887 	uint32_t umac_window;
1888 	uint32_t ce_window;
1889 	uint32_t window;
1890 
1891 	umac_window = FIELD_GET(ATH11K_PCI_WINDOW_VALUE_MASK, HAL_SEQ_WCSS_UMAC_OFFSET);
1892 	ce_window = FIELD_GET(ATH11K_PCI_WINDOW_VALUE_MASK, HAL_CE_WFSS_CE_REG_BASE);
1893 	window = (umac_window << 12) | (ce_window << 6);
1894 
1895 	qwx_pci_write(sc, ATH11K_PCI_WINDOW_REG_ADDRESS,
1896 	    ATH11K_PCI_WINDOW_ENABLE_BIT | window);
1897 }
1898 
1899 void
1900 qwx_pci_soc_global_reset(struct qwx_softc *sc)
1901 {
1902 	uint32_t val, msecs;
1903 
1904 	val = qwx_pcic_read32(sc, PCIE_SOC_GLOBAL_RESET);
1905 
1906 	val |= PCIE_SOC_GLOBAL_RESET_V;
1907 
1908 	qwx_pcic_write32(sc, PCIE_SOC_GLOBAL_RESET, val);
1909 
1910 	/* TODO: exact time to sleep is uncertain */
1911 	msecs = 10;
1912 	DELAY(msecs * 1000);
1913 
1914 	/* Need to toggle V bit back otherwise stuck in reset status */
1915 	val &= ~PCIE_SOC_GLOBAL_RESET_V;
1916 
1917 	qwx_pcic_write32(sc, PCIE_SOC_GLOBAL_RESET, val);
1918 
1919 	DELAY(msecs * 1000);
1920 
1921 	val = qwx_pcic_read32(sc, PCIE_SOC_GLOBAL_RESET);
1922 	if (val == 0xffffffff)
1923 		printf("%s: link down error during global reset\n",
1924 		    sc->sc_dev.dv_xname);
1925 }
1926 
1927 void
1928 qwx_pci_clear_dbg_registers(struct qwx_softc *sc)
1929 {
1930 	uint32_t val;
1931 
1932 	/* read cookie */
1933 	val = qwx_pcic_read32(sc, PCIE_Q6_COOKIE_ADDR);
1934 	DPRINTF("%s: cookie:0x%x\n", sc->sc_dev.dv_xname, val);
1935 
1936 	val = qwx_pcic_read32(sc, WLAON_WARM_SW_ENTRY);
1937 	DPRINTF("%s: WLAON_WARM_SW_ENTRY 0x%x\n", sc->sc_dev.dv_xname, val);
1938 
1939 	/* TODO: exact time to sleep is uncertain */
1940 	DELAY(10 * 1000);
1941 
1942 	/* write 0 to WLAON_WARM_SW_ENTRY to prevent Q6 from
1943 	 * continuing warm path and entering dead loop.
1944 	 */
1945 	qwx_pcic_write32(sc, WLAON_WARM_SW_ENTRY, 0);
1946 	DELAY(10 * 1000);
1947 
1948 	val = qwx_pcic_read32(sc, WLAON_WARM_SW_ENTRY);
1949 	DPRINTF("%s: WLAON_WARM_SW_ENTRY 0x%x\n", sc->sc_dev.dv_xname, val);
1950 
1951 	/* A read clear register. clear the register to prevent
1952 	 * Q6 from entering wrong code path.
1953 	 */
1954 	val = qwx_pcic_read32(sc, WLAON_SOC_RESET_CAUSE_REG);
1955 	DPRINTF("%s: soc reset cause:%d\n", sc->sc_dev.dv_xname, val);
1956 }
1957 
1958 int
1959 qwx_pci_set_link_reg(struct qwx_softc *sc, uint32_t offset, uint32_t value,
1960     uint32_t mask)
1961 {
1962 	uint32_t v;
1963 	int i;
1964 
1965 	v = qwx_pcic_read32(sc, offset);
1966 	if ((v & mask) == value)
1967 		return 0;
1968 
1969 	for (i = 0; i < 10; i++) {
1970 		qwx_pcic_write32(sc, offset, (v & ~mask) | value);
1971 
1972 		v = qwx_pcic_read32(sc, offset);
1973 		if ((v & mask) == value)
1974 			return 0;
1975 
1976 		delay((2 * 1000));
1977 	}
1978 
1979 	DPRINTF("failed to set pcie link register 0x%08x: 0x%08x != 0x%08x\n",
1980 	    offset, v & mask, value);
1981 
1982 	return ETIMEDOUT;
1983 }
1984 
1985 int
1986 qwx_pci_fix_l1ss(struct qwx_softc *sc)
1987 {
1988 	int ret;
1989 
1990 	ret = qwx_pci_set_link_reg(sc,
1991 				      PCIE_QSERDES_COM_SYSCLK_EN_SEL_REG(sc),
1992 				      PCIE_QSERDES_COM_SYSCLK_EN_SEL_VAL,
1993 				      PCIE_QSERDES_COM_SYSCLK_EN_SEL_MSK);
1994 	if (ret) {
1995 		DPRINTF("failed to set sysclk: %d\n", ret);
1996 		return ret;
1997 	}
1998 
1999 	ret = qwx_pci_set_link_reg(sc,
2000 				      PCIE_PCS_OSC_DTCT_CONFIG1_REG(sc),
2001 				      PCIE_PCS_OSC_DTCT_CONFIG1_VAL,
2002 				      PCIE_PCS_OSC_DTCT_CONFIG_MSK);
2003 	if (ret) {
2004 		DPRINTF("failed to set dtct config1 error: %d\n", ret);
2005 		return ret;
2006 	}
2007 
2008 	ret = qwx_pci_set_link_reg(sc,
2009 				      PCIE_PCS_OSC_DTCT_CONFIG2_REG(sc),
2010 				      PCIE_PCS_OSC_DTCT_CONFIG2_VAL,
2011 				      PCIE_PCS_OSC_DTCT_CONFIG_MSK);
2012 	if (ret) {
2013 		DPRINTF("failed to set dtct config2: %d\n", ret);
2014 		return ret;
2015 	}
2016 
2017 	ret = qwx_pci_set_link_reg(sc,
2018 				      PCIE_PCS_OSC_DTCT_CONFIG4_REG(sc),
2019 				      PCIE_PCS_OSC_DTCT_CONFIG4_VAL,
2020 				      PCIE_PCS_OSC_DTCT_CONFIG_MSK);
2021 	if (ret) {
2022 		DPRINTF("failed to set dtct config4: %d\n", ret);
2023 		return ret;
2024 	}
2025 
2026 	return 0;
2027 }
2028 
2029 void
2030 qwx_pci_enable_ltssm(struct qwx_softc *sc)
2031 {
2032 	uint32_t val;
2033 	int i;
2034 
2035 	val = qwx_pcic_read32(sc, PCIE_PCIE_PARF_LTSSM);
2036 
2037 	/* PCIE link seems very unstable after the Hot Reset*/
2038 	for (i = 0; val != PARM_LTSSM_VALUE && i < 5; i++) {
2039 		if (val == 0xffffffff)
2040 			DELAY(5 * 1000);
2041 
2042 		qwx_pcic_write32(sc, PCIE_PCIE_PARF_LTSSM, PARM_LTSSM_VALUE);
2043 		val = qwx_pcic_read32(sc, PCIE_PCIE_PARF_LTSSM);
2044 	}
2045 
2046 	DPRINTF("%s: pci ltssm 0x%x\n", sc->sc_dev.dv_xname, val);
2047 
2048 	val = qwx_pcic_read32(sc, GCC_GCC_PCIE_HOT_RST);
2049 	val |= GCC_GCC_PCIE_HOT_RST_VAL;
2050 	qwx_pcic_write32(sc, GCC_GCC_PCIE_HOT_RST, val);
2051 	val = qwx_pcic_read32(sc, GCC_GCC_PCIE_HOT_RST);
2052 
2053 	DPRINTF("%s: pci pcie_hot_rst 0x%x\n", sc->sc_dev.dv_xname, val);
2054 
2055 	DELAY(5 * 1000);
2056 }
2057 
2058 void
2059 qwx_pci_clear_all_intrs(struct qwx_softc *sc)
2060 {
2061 	/* This is a WAR for PCIE Hotreset.
2062 	 * When target receive Hotreset, but will set the interrupt.
2063 	 * So when download SBL again, SBL will open Interrupt and
2064 	 * receive it, and crash immediately.
2065 	 */
2066 	qwx_pcic_write32(sc, PCIE_PCIE_INT_ALL_CLEAR, PCIE_INT_CLEAR_ALL);
2067 }
2068 
2069 void
2070 qwx_pci_set_wlaon_pwr_ctrl(struct qwx_softc *sc)
2071 {
2072 	uint32_t val;
2073 
2074 	val = qwx_pcic_read32(sc, WLAON_QFPROM_PWR_CTRL_REG);
2075 	val &= ~QFPROM_PWR_CTRL_VDD4BLOW_MASK;
2076 	qwx_pcic_write32(sc, WLAON_QFPROM_PWR_CTRL_REG, val);
2077 }
2078 
2079 void
2080 qwx_pci_force_wake(struct qwx_softc *sc)
2081 {
2082 	qwx_pcic_write32(sc, PCIE_SOC_WAKE_PCIE_LOCAL_REG, 1);
2083 	DELAY(5 * 1000);
2084 }
2085 
2086 void
2087 qwx_pci_sw_reset(struct qwx_softc *sc, bool power_on)
2088 {
2089 	DELAY(100 * 1000); /* msecs */
2090 
2091 	if (power_on) {
2092 		qwx_pci_enable_ltssm(sc);
2093 		qwx_pci_clear_all_intrs(sc);
2094 		qwx_pci_set_wlaon_pwr_ctrl(sc);
2095 		if (sc->hw_params.fix_l1ss)
2096 			qwx_pci_fix_l1ss(sc);
2097 	}
2098 
2099 	qwx_mhi_clear_vector(sc);
2100 	qwx_pci_clear_dbg_registers(sc);
2101 	qwx_pci_soc_global_reset(sc);
2102 	qwx_mhi_reset_device(sc, 0);
2103 }
2104 
2105 void
2106 qwx_pci_msi_config(struct qwx_softc *sc, bool enable)
2107 {
2108 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2109 	uint32_t val;
2110 
2111 	val = pci_conf_read(psc->sc_pc, psc->sc_tag,
2112 	    psc->sc_msi_off + PCI_MSI_MC);
2113 
2114 	if (enable)
2115 		val |= PCI_MSI_MC_MSIE;
2116 	else
2117 		val &= ~PCI_MSI_MC_MSIE;
2118 
2119 	pci_conf_write(psc->sc_pc, psc->sc_tag,  psc->sc_msi_off + PCI_MSI_MC,
2120 	    val);
2121 }
2122 
2123 void
2124 qwx_pci_msi_enable(struct qwx_softc *sc)
2125 {
2126 	qwx_pci_msi_config(sc, true);
2127 }
2128 
2129 void
2130 qwx_pci_msi_disable(struct qwx_softc *sc)
2131 {
2132 	qwx_pci_msi_config(sc, false);
2133 }
2134 
2135 void
2136 qwx_pci_aspm_disable(struct qwx_softc *sc)
2137 {
2138 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2139 
2140 	psc->sc_lcsr = pci_conf_read(psc->sc_pc, psc->sc_tag,
2141 	    psc->sc_cap_off + PCI_PCIE_LCSR);
2142 
2143 	DPRINTF("%s: pci link_ctl 0x%04x L0s %d L1 %d\n", sc->sc_dev.dv_xname,
2144 	    (uint16_t)psc->sc_lcsr, (psc->sc_lcsr & PCI_PCIE_LCSR_ASPM_L0S),
2145 	    (psc->sc_lcsr & PCI_PCIE_LCSR_ASPM_L1));
2146 
2147 	/* disable L0s and L1 */
2148 	pci_conf_write(psc->sc_pc, psc->sc_tag, psc->sc_cap_off + PCI_PCIE_LCSR,
2149 	    psc->sc_lcsr & ~(PCI_PCIE_LCSR_ASPM_L0S | PCI_PCIE_LCSR_ASPM_L1));
2150 
2151 	psc->sc_flags |= ATH11K_PCI_ASPM_RESTORE;
2152 }
2153 
2154 void
2155 qwx_pci_aspm_restore(struct qwx_softc *sc)
2156 {
2157 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2158 
2159 	if (psc->sc_flags & ATH11K_PCI_ASPM_RESTORE) {
2160 		pci_conf_write(psc->sc_pc, psc->sc_tag,
2161 		    psc->sc_cap_off + PCI_PCIE_LCSR, psc->sc_lcsr);
2162 		psc->sc_flags &= ~ATH11K_PCI_ASPM_RESTORE;
2163 	}
2164 }
2165 
2166 int
2167 qwx_pci_power_up(struct qwx_softc *sc)
2168 {
2169 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2170 	int error;
2171 
2172 	psc->register_window = 0;
2173 	clear_bit(ATH11K_FLAG_DEVICE_INIT_DONE, sc->sc_flags);
2174 
2175 	qwx_pci_sw_reset(sc, true);
2176 
2177 	/* Disable ASPM during firmware download due to problems switching
2178 	 * to AMSS state.
2179 	 */
2180 	qwx_pci_aspm_disable(sc);
2181 
2182 	qwx_pci_msi_enable(sc);
2183 
2184 	error = qwx_mhi_start(psc);
2185 	if (error)
2186 		return error;
2187 
2188 	if (sc->hw_params.static_window_map)
2189 		qwx_pci_select_static_window(sc);
2190 
2191 	return 0;
2192 }
2193 
2194 void
2195 qwx_pci_power_down(struct qwx_softc *sc)
2196 {
2197 	/* restore aspm in case firmware bootup fails */
2198 	qwx_pci_aspm_restore(sc);
2199 
2200 	qwx_pci_force_wake(sc);
2201 
2202 	qwx_pci_msi_disable(sc);
2203 
2204 	qwx_mhi_stop(sc);
2205 	clear_bit(ATH11K_FLAG_DEVICE_INIT_DONE, sc->sc_flags);
2206 	qwx_pci_sw_reset(sc, false);
2207 }
2208 
2209 /*
2210  * MHI
2211  */
2212 int
2213 qwx_mhi_register(struct qwx_softc *sc)
2214 {
2215 	DNPRINTF(QWX_D_MHI, "%s: STUB %s()\n", sc->sc_dev.dv_xname, __func__);
2216 	return 0;
2217 }
2218 
2219 void
2220 qwx_mhi_unregister(struct qwx_softc *sc)
2221 {
2222 	DNPRINTF(QWX_D_MHI, "%s: STUB %s()\n", sc->sc_dev.dv_xname, __func__);
2223 }
2224 
2225 // XXX MHI is GPLd - we provide a compatible bare-bones implementation
2226 #define MHI_CFG				0x10
2227 #define   MHI_CFG_NHWER_MASK		GENMASK(31, 24)
2228 #define   MHI_CFG_NHWER_SHFT		24
2229 #define   MHI_CFG_NER_MASK		GENMASK(23, 16)
2230 #define   MHI_CFG_NER_SHFT		16
2231 #define   MHI_CFG_NHWCH_MASK		GENMASK(15, 8)
2232 #define   MHI_CFG_NHWCH_SHFT		8
2233 #define   MHI_CFG_NCH_MASK		GENMASK(7, 0)
2234 #define MHI_CHDBOFF			0x18
2235 #define MHI_DEV_WAKE_DB			127
2236 #define MHI_ERDBOFF			0x20
2237 #define MHI_BHI_OFFSET			0x28
2238 #define   MHI_BHI_IMGADDR_LOW			0x08
2239 #define   MHI_BHI_IMGADDR_HIGH			0x0c
2240 #define   MHI_BHI_IMGSIZE			0x10
2241 #define   MHI_BHI_IMGTXDB			0x18
2242 #define   MHI_BHI_INTVEC			0x20
2243 #define   MHI_BHI_EXECENV			0x28
2244 #define   MHI_BHI_STATUS			0x2c
2245 #define	  MHI_BHI_SERIALNU			0x40
2246 #define MHI_BHIE_OFFSET			0x2c
2247 #define   MHI_BHIE_TXVECADDR_LOW_OFFS		0x2c
2248 #define   MHI_BHIE_TXVECADDR_HIGH_OFFS		0x30
2249 #define   MHI_BHIE_TXVECSIZE_OFFS		0x34
2250 #define   MHI_BHIE_TXVECDB_OFFS			0x3c
2251 #define   MHI_BHIE_TXVECSTATUS_OFFS		0x44
2252 #define   MHI_BHIE_RXVECADDR_LOW_OFFS		0x60
2253 #define   MHI_BHIE_RXVECSTATUS_OFFS		0x78
2254 #define MHI_CTRL			0x38
2255 #define    MHI_CTRL_READY_MASK			0x1
2256 #define    MHI_CTRL_RESET_MASK			0x2
2257 #define    MHI_CTRL_MHISTATE_MASK		GENMASK(15, 8)
2258 #define    MHI_CTRL_MHISTATE_SHFT		8
2259 #define MHI_STATUS			0x48
2260 #define    MHI_STATUS_MHISTATE_MASK		GENMASK(15, 8)
2261 #define    MHI_STATUS_MHISTATE_SHFT		8
2262 #define        MHI_STATE_RESET			0x0
2263 #define        MHI_STATE_READY			0x1
2264 #define        MHI_STATE_M0			0x2
2265 #define        MHI_STATE_M1			0x3
2266 #define        MHI_STATE_M2			0x4
2267 #define        MHI_STATE_M3			0x5
2268 #define        MHI_STATE_M3_FAST		0x6
2269 #define        MHI_STATE_BHI			0x7
2270 #define        MHI_STATE_SYS_ERR		0xff
2271 #define    MHI_STATUS_READY_MASK		0x1
2272 #define    MHI_STATUS_SYSERR_MASK		0x4
2273 #define MHI_CCABAP_LOWER		0x58
2274 #define MHI_CCABAP_HIGHER		0x5c
2275 #define MHI_ECABAP_LOWER		0x60
2276 #define MHI_ECABAP_HIGHER		0x64
2277 #define MHI_CRCBAP_LOWER		0x68
2278 #define MHI_CRCBAP_HIGHER		0x6c
2279 #define MHI_CRDB_LOWER			0x70
2280 #define MHI_CRDB_HIGHER			0x74
2281 #define MHI_CTRLBASE_LOWER		0x80
2282 #define MHI_CTRLBASE_HIGHER		0x84
2283 #define MHI_CTRLLIMIT_LOWER		0x88
2284 #define MHI_CTRLLIMIT_HIGHER		0x8c
2285 #define MHI_DATABASE_LOWER		0x98
2286 #define MHI_DATABASE_HIGHER		0x9c
2287 #define MHI_DATALIMIT_LOWER		0xa0
2288 #define MHI_DATALIMIT_HIGHER		0xa4
2289 
2290 #define MHI_EE_PBL	0x0	/* Primary Bootloader */
2291 #define MHI_EE_SBL	0x1	/* Secondary Bootloader */
2292 #define MHI_EE_AMSS	0x2	/* Modem, aka the primary runtime EE */
2293 #define MHI_EE_RDDM	0x3	/* Ram dump download mode */
2294 #define MHI_EE_WFW	0x4	/* WLAN firmware mode */
2295 #define MHI_EE_PTHRU	0x5	/* Passthrough */
2296 #define MHI_EE_EDL	0x6	/* Embedded downloader */
2297 #define MHI_EE_FP	0x7	/* Flash Programmer Environment */
2298 
2299 #define MHI_IN_PBL(e) (e == MHI_EE_PBL || e == MHI_EE_PTHRU || e == MHI_EE_EDL)
2300 #define MHI_POWER_UP_CAPABLE(e) (MHI_IN_PBL(e) || e == MHI_EE_AMSS)
2301 #define MHI_IN_MISSION_MODE(e) \
2302 	(e == MHI_EE_AMSS || e == MHI_EE_WFW || e == MHI_EE_FP)
2303 
2304 /* BHI register bits */
2305 #define MHI_BHI_TXDB_SEQNUM_BMSK	GENMASK(29, 0)
2306 #define MHI_BHI_TXDB_SEQNUM_SHFT	0
2307 #define MHI_BHI_STATUS_MASK		GENMASK(31, 30)
2308 #define MHI_BHI_STATUS_SHFT		30
2309 #define MHI_BHI_STATUS_ERROR		0x03
2310 #define MHI_BHI_STATUS_SUCCESS		0x02
2311 #define MHI_BHI_STATUS_RESET		0x00
2312 
2313 /* MHI BHIE registers */
2314 #define MHI_BHIE_MSMSOCID_OFFS		0x00
2315 #define MHI_BHIE_RXVECADDR_LOW_OFFS	0x60
2316 #define MHI_BHIE_RXVECADDR_HIGH_OFFS	0x64
2317 #define MHI_BHIE_RXVECSIZE_OFFS		0x68
2318 #define MHI_BHIE_RXVECDB_OFFS		0x70
2319 #define MHI_BHIE_RXVECSTATUS_OFFS	0x78
2320 
2321 /* BHIE register bits */
2322 #define MHI_BHIE_TXVECDB_SEQNUM_BMSK		GENMASK(29, 0)
2323 #define MHI_BHIE_TXVECDB_SEQNUM_SHFT		0
2324 #define MHI_BHIE_TXVECSTATUS_SEQNUM_BMSK	GENMASK(29, 0)
2325 #define MHI_BHIE_TXVECSTATUS_SEQNUM_SHFT	0
2326 #define MHI_BHIE_TXVECSTATUS_STATUS_BMSK	GENMASK(31, 30)
2327 #define MHI_BHIE_TXVECSTATUS_STATUS_SHFT	30
2328 #define MHI_BHIE_TXVECSTATUS_STATUS_RESET	0x00
2329 #define MHI_BHIE_TXVECSTATUS_STATUS_XFER_COMPL	0x02
2330 #define MHI_BHIE_TXVECSTATUS_STATUS_ERROR	0x03
2331 #define MHI_BHIE_RXVECDB_SEQNUM_BMSK		GENMASK(29, 0)
2332 #define MHI_BHIE_RXVECDB_SEQNUM_SHFT		0
2333 #define MHI_BHIE_RXVECSTATUS_SEQNUM_BMSK	GENMASK(29, 0)
2334 #define MHI_BHIE_RXVECSTATUS_SEQNUM_SHFT	0
2335 #define MHI_BHIE_RXVECSTATUS_STATUS_BMSK	GENMASK(31, 30)
2336 #define MHI_BHIE_RXVECSTATUS_STATUS_SHFT	30
2337 #define MHI_BHIE_RXVECSTATUS_STATUS_RESET	0x00
2338 #define MHI_BHIE_RXVECSTATUS_STATUS_XFER_COMPL	0x02
2339 #define MHI_BHIE_RXVECSTATUS_STATUS_ERROR	0x03
2340 
2341 #define MHI_EV_CC_INVALID	0x0
2342 #define MHI_EV_CC_SUCCESS	0x1
2343 #define MHI_EV_CC_EOT		0x2
2344 #define MHI_EV_CC_OVERFLOW	0x3
2345 #define MHI_EV_CC_EOB		0x4
2346 #define MHI_EV_CC_OOB		0x5
2347 #define MHI_EV_CC_DB_MODE	0x6
2348 #define MHI_EV_CC_UNDEFINED_ERR	0x10
2349 #define MHI_EV_CC_BAD_TRE	0x11
2350 
2351 #define MHI_CMD_NOP		01
2352 #define MHI_CMD_RESET_CHAN	16
2353 #define MHI_CMD_STOP_CHAN	17
2354 #define MHI_CMD_START_CHAN	18
2355 
2356 #define MHI_TRE_CMD_CHID_MASK	GENMASK(31, 24)
2357 #define MHI_TRE_CMD_CHID_SHFT	24
2358 #define MHI_TRE_CMD_CMDID_MASK	GENMASK(23, 16)
2359 #define MHI_TRE_CMD_CMDID_SHFT	16
2360 
2361 #define MHI_TRE0_EV_LEN_MASK	GENMASK(15, 0)
2362 #define MHI_TRE0_EV_LEN_SHFT	0
2363 #define MHI_TRE0_EV_CODE_MASK	GENMASK(31, 24)
2364 #define MHI_TRE0_EV_CODE_SHFT	24
2365 #define MHI_TRE1_EV_TYPE_MASK	GENMASK(23, 16)
2366 #define MHI_TRE1_EV_TYPE_SHFT	16
2367 #define MHI_TRE1_EV_CHID_MASK	GENMASK(31, 24)
2368 #define MHI_TRE1_EV_CHID_SHFT	24
2369 
2370 #define MHI_TRE0_DATA_LEN_MASK	GENMASK(15, 0)
2371 #define MHI_TRE0_DATA_LEN_SHFT	0
2372 #define MHI_TRE1_DATA_CHAIN	(1 << 0)
2373 #define MHI_TRE1_DATA_IEOB	(1 << 8)
2374 #define MHI_TRE1_DATA_IEOT	(1 << 9)
2375 #define MHI_TRE1_DATA_BEI	(1 << 10)
2376 #define MHI_TRE1_DATA_TYPE_MASK		GENMASK(23, 16)
2377 #define MHI_TRE1_DATA_TYPE_SHIFT	16
2378 #define MHI_TRE1_DATA_TYPE_TRANSFER	0x2
2379 
2380 #define MHI_PKT_TYPE_INVALID			0x00
2381 #define MHI_PKT_TYPE_NOOP_CMD			0x01
2382 #define MHI_PKT_TYPE_TRANSFER			0x02
2383 #define MHI_PKT_TYPE_COALESCING			0x08
2384 #define MHI_PKT_TYPE_RESET_CHAN_CMD		0x10
2385 #define MHI_PKT_TYPE_STOP_CHAN_CMD		0x11
2386 #define MHI_PKT_TYPE_START_CHAN_CMD		0x12
2387 #define MHI_PKT_TYPE_STATE_CHANGE_EVENT		0x20
2388 #define MHI_PKT_TYPE_CMD_COMPLETION_EVENT	0x21
2389 #define MHI_PKT_TYPE_TX_EVENT			0x22
2390 #define MHI_PKT_TYPE_RSC_TX_EVENT		0x28
2391 #define MHI_PKT_TYPE_EE_EVENT			0x40
2392 #define MHI_PKT_TYPE_TSYNC_EVENT		0x48
2393 #define MHI_PKT_TYPE_BW_REQ_EVENT		0x50
2394 
2395 
2396 #define MHI_DMA_VEC_CHUNK_SIZE			524288 /* 512 KB */
2397 struct qwx_dma_vec_entry {
2398 	uint64_t paddr;
2399 	uint64_t size;
2400 };
2401 
2402 void
2403 qwx_mhi_ring_doorbell(struct qwx_softc *sc, uint64_t db_addr, uint64_t val)
2404 {
2405 	qwx_pci_write(sc, db_addr + 4, val >> 32);
2406 	qwx_pci_write(sc, db_addr, val & 0xffffffff);
2407 }
2408 
2409 void
2410 qwx_mhi_device_wake(struct qwx_softc *sc)
2411 {
2412 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2413 
2414 	/*
2415 	 * Device wake is async only for now because we do not
2416 	 * keep track of PM state in software.
2417 	 */
2418 	qwx_mhi_ring_doorbell(sc, psc->wake_db, 1);
2419 }
2420 
2421 void
2422 qwx_mhi_device_zzz(struct qwx_softc *sc)
2423 {
2424 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2425 
2426 	qwx_mhi_ring_doorbell(sc, psc->wake_db, 0);
2427 }
2428 
2429 int
2430 qwx_mhi_wake_db_clear_valid(struct qwx_softc *sc)
2431 {
2432 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2433 
2434 	return (psc->mhi_state == MHI_STATE_M0); /* TODO other states? */
2435 }
2436 
2437 void
2438 qwx_mhi_init_xfer_rings(struct qwx_pci_softc *psc)
2439 {
2440 	struct qwx_softc *sc = &psc->sc_sc;
2441 	int i;
2442 	uint32_t chcfg;
2443 	struct qwx_pci_xfer_ring *ring;
2444 	struct qwx_mhi_chan_ctxt *cbase, *c;
2445 
2446 	cbase = (struct qwx_mhi_chan_ctxt *)QWX_DMA_KVA(psc->chan_ctxt);
2447 	for (i = 0; i < psc->max_chan; i++) {
2448 		c = &cbase[i];
2449 		chcfg = le32toh(c->chcfg);
2450 		chcfg &= ~(MHI_CHAN_CTX_CHSTATE_MASK |
2451 		    MHI_CHAN_CTX_BRSTMODE_MASK |
2452 		    MHI_CHAN_CTX_POLLCFG_MASK);
2453 		chcfg |= (MHI_CHAN_CTX_CHSTATE_DISABLED |
2454 		    (MHI_CHAN_CTX_BRSTMODE_DISABLE <<
2455 		    MHI_CHAN_CTX_BRSTMODE_SHFT));
2456 		c->chcfg = htole32(chcfg);
2457 		c->chtype = htole32(MHI_CHAN_TYPE_INVALID);
2458 		c->erindex = 0;
2459 	}
2460 
2461 	for (i = 0; i < nitems(psc->xfer_rings); i++) {
2462 		ring = &psc->xfer_rings[i];
2463 		KASSERT(ring->mhi_chan_id < psc->max_chan);
2464 		c = &cbase[ring->mhi_chan_id];
2465 		c->chtype = htole32(ring->mhi_chan_direction);
2466 		c->erindex = htole32(ring->mhi_chan_event_ring_index);
2467 		ring->chan_ctxt = c;
2468 	}
2469 
2470 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->chan_ctxt), 0,
2471 	    QWX_DMA_LEN(psc->chan_ctxt), BUS_DMASYNC_PREWRITE);
2472 }
2473 
2474 void
2475 qwx_mhi_init_event_rings(struct qwx_pci_softc *psc)
2476 {
2477 	struct qwx_softc *sc = &psc->sc_sc;
2478 	int i;
2479 	uint32_t intmod;
2480 	uint64_t paddr, len;
2481 	struct qwx_pci_event_ring *ring;
2482 	struct qwx_mhi_event_ctxt *c;
2483 
2484 	c = (struct qwx_mhi_event_ctxt *)QWX_DMA_KVA(psc->event_ctxt);
2485 	for (i = 0; i < nitems(psc->event_rings); i++, c++) {
2486 		ring = &psc->event_rings[i];
2487 
2488 		ring->event_ctxt = c;
2489 
2490 		intmod = le32toh(c->intmod);
2491 		intmod &= ~(MHI_EV_CTX_INTMODC_MASK | MHI_EV_CTX_INTMODT_MASK);
2492 		intmod |= (ring->mhi_er_irq_moderation_ms <<
2493 		    MHI_EV_CTX_INTMODT_SHFT) & MHI_EV_CTX_INTMODT_MASK;
2494 		c->intmod = htole32(intmod);
2495 
2496 		c->ertype = htole32(MHI_ER_TYPE_VALID);
2497 		c->msivec = htole32(ring->mhi_er_irq);
2498 
2499 		paddr = QWX_DMA_DVA(ring->dmamem);
2500 		ring->rp = paddr;
2501 		ring->wp = paddr + ring->size -
2502 		    sizeof(struct qwx_mhi_ring_element);
2503 		c->rbase = htole64(paddr);
2504 		c->rp = htole64(ring->rp);
2505 		c->wp = htole64(ring->wp);
2506 
2507 		len = sizeof(struct qwx_mhi_ring_element) * ring->num_elements;
2508 		c->rlen = htole64(len);
2509 	}
2510 
2511 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->event_ctxt), 0,
2512 	    QWX_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_PREWRITE);
2513 }
2514 
2515 void
2516 qwx_mhi_init_cmd_ring(struct qwx_pci_softc *psc)
2517 {
2518 	struct qwx_softc *sc = &psc->sc_sc;
2519 	struct qwx_pci_cmd_ring *ring = &psc->cmd_ring;
2520 	struct qwx_mhi_cmd_ctxt *c;
2521 	uint64_t paddr, len;
2522 
2523 	paddr = QWX_DMA_DVA(ring->dmamem);
2524 	len = ring->size;
2525 
2526 	ring->rp = ring->wp = paddr;
2527 
2528 	c = (struct qwx_mhi_cmd_ctxt *)QWX_DMA_KVA(psc->cmd_ctxt);
2529 	c->rbase = htole64(paddr);
2530 	c->rp = htole64(paddr);
2531 	c->wp = htole64(paddr);
2532 	c->rlen = htole64(len);
2533 
2534 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->cmd_ctxt), 0,
2535 	    QWX_DMA_LEN(psc->cmd_ctxt), BUS_DMASYNC_PREWRITE);
2536 }
2537 
2538 void
2539 qwx_mhi_init_dev_ctxt(struct qwx_pci_softc *psc)
2540 {
2541 	qwx_mhi_init_xfer_rings(psc);
2542 	qwx_mhi_init_event_rings(psc);
2543 	qwx_mhi_init_cmd_ring(psc);
2544 }
2545 
2546 void *
2547 qwx_pci_cmd_ring_get_elem(struct qwx_pci_cmd_ring *ring, uint64_t ptr)
2548 {
2549 	uint64_t base = QWX_DMA_DVA(ring->dmamem), offset;
2550 
2551 	if (ptr < base || ptr >= base + ring->size)
2552 		return NULL;
2553 
2554 	offset = ptr - base;
2555 	if (offset >= ring->size)
2556 		return NULL;
2557 
2558 	return QWX_DMA_KVA(ring->dmamem) + offset;
2559 }
2560 
2561 int
2562 qwx_mhi_cmd_ring_submit(struct qwx_pci_softc *psc,
2563     struct qwx_pci_cmd_ring *ring)
2564 {
2565 	struct qwx_softc *sc = &psc->sc_sc;
2566 	uint64_t base = QWX_DMA_DVA(ring->dmamem);
2567 	struct qwx_mhi_cmd_ctxt *c;
2568 
2569 	if (ring->queued >= ring->num_elements)
2570 		return 1;
2571 
2572 	if (ring->wp + sizeof(struct qwx_mhi_ring_element) >= base + ring->size)
2573 		ring->wp = base;
2574 	else
2575 		ring->wp += sizeof(struct qwx_mhi_ring_element);
2576 
2577 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->cmd_ctxt), 0,
2578 	    QWX_DMA_LEN(psc->cmd_ctxt), BUS_DMASYNC_POSTREAD);
2579 
2580 	c = (struct qwx_mhi_cmd_ctxt *)QWX_DMA_KVA(psc->cmd_ctxt);
2581 	c->wp = htole64(ring->wp);
2582 
2583 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->cmd_ctxt), 0,
2584 	    QWX_DMA_LEN(psc->cmd_ctxt), BUS_DMASYNC_PREWRITE);
2585 
2586 	ring->queued++;
2587 	qwx_mhi_ring_doorbell(sc, MHI_CRDB_LOWER, ring->wp);
2588 	return 0;
2589 }
2590 
2591 int
2592 qwx_mhi_send_cmd(struct qwx_pci_softc *psc, uint32_t cmd, uint32_t chan)
2593 {
2594 	struct qwx_softc *sc = &psc->sc_sc;
2595 	struct qwx_pci_cmd_ring	*ring = &psc->cmd_ring;
2596 	struct qwx_mhi_ring_element *e;
2597 
2598 	if (ring->queued >= ring->num_elements) {
2599 		printf("%s: command ring overflow\n", sc->sc_dev.dv_xname);
2600 		return 1;
2601 	}
2602 
2603 	e = qwx_pci_cmd_ring_get_elem(ring, ring->wp);
2604 	if (e == NULL)
2605 		return 1;
2606 
2607 	e->ptr = 0ULL;
2608 	e->dword[0] = 0;
2609 	e->dword[1] = htole32(
2610 	    ((chan << MHI_TRE_CMD_CHID_SHFT) & MHI_TRE_CMD_CHID_MASK) |
2611 	    ((cmd << MHI_TRE_CMD_CMDID_SHFT) & MHI_TRE_CMD_CMDID_MASK));
2612 
2613 	return qwx_mhi_cmd_ring_submit(psc, ring);
2614 }
2615 
2616 void *
2617 qwx_pci_xfer_ring_get_elem(struct qwx_pci_xfer_ring *ring, uint64_t wp)
2618 {
2619 	uint64_t base = QWX_DMA_DVA(ring->dmamem), offset;
2620 	void *addr = QWX_DMA_KVA(ring->dmamem);
2621 
2622 	if (wp < base)
2623 		return NULL;
2624 
2625 	offset = wp - base;
2626 	if (offset >= ring->size)
2627 		return NULL;
2628 
2629 	return addr + offset;
2630 }
2631 
2632 struct qwx_xfer_data *
2633 qwx_pci_xfer_ring_get_data(struct qwx_pci_xfer_ring *ring, uint64_t wp)
2634 {
2635 	uint64_t base = QWX_DMA_DVA(ring->dmamem), offset;
2636 
2637 	if (wp < base)
2638 		return NULL;
2639 
2640 	offset = wp - base;
2641 	if (offset >= ring->size)
2642 		return NULL;
2643 
2644 	return &ring->data[offset / sizeof(ring->data[0])];
2645 }
2646 
2647 int
2648 qwx_mhi_submit_xfer(struct qwx_softc *sc, struct mbuf *m)
2649 {
2650 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2651 	struct qwx_pci_xfer_ring *ring;
2652 	struct qwx_mhi_ring_element *e;
2653 	struct qwx_xfer_data *xfer;
2654 	uint64_t paddr, base;
2655 	int err;
2656 
2657 	ring = &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_OUTBOUND];
2658 
2659 	if (ring->queued >= ring->num_elements)
2660 		return 1;
2661 
2662 	if (m->m_pkthdr.len > QWX_PCI_XFER_MAX_DATA_SIZE) {
2663 		/* TODO: chunk xfers */
2664 		printf("%s: xfer too large: %d bytes\n", __func__, m->m_pkthdr.len);
2665 		return 1;
2666 
2667 	}
2668 
2669 	e = qwx_pci_xfer_ring_get_elem(ring, ring->wp);
2670 	if (e == NULL)
2671 		return 1;
2672 
2673 	xfer = qwx_pci_xfer_ring_get_data(ring, ring->wp);
2674 	if (xfer == NULL || xfer->m != NULL)
2675 		return 1;
2676 
2677 	err = bus_dmamap_load_mbuf(sc->sc_dmat, xfer->map, m,
2678 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
2679 	if (err && err != EFBIG) {
2680 		printf("%s: can't map mbuf (error %d)\n",
2681 		    sc->sc_dev.dv_xname, err);
2682 		return err;
2683 	}
2684 	if (err) {
2685 		/* Too many DMA segments, linearize mbuf. */
2686 		if (m_defrag(m, M_DONTWAIT))
2687 			return ENOBUFS;
2688 		err = bus_dmamap_load_mbuf(sc->sc_dmat, xfer->map, m,
2689 		    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
2690 		if (err) {
2691 			printf("%s: can't map mbuf (error %d)\n",
2692 			    sc->sc_dev.dv_xname, err);
2693 			return err;
2694 		}
2695 	}
2696 
2697 	bus_dmamap_sync(sc->sc_dmat, xfer->map, 0, m->m_pkthdr.len,
2698 	    BUS_DMASYNC_PREWRITE);
2699 
2700 	xfer->m = m;
2701 	paddr = xfer->map->dm_segs[0].ds_addr;
2702 
2703 	e->ptr = htole64(paddr);
2704 	e->dword[0] = htole32((m->m_pkthdr.len << MHI_TRE0_DATA_LEN_SHFT) &
2705 	    MHI_TRE0_DATA_LEN_MASK);
2706 	e->dword[1] = htole32(MHI_TRE1_DATA_IEOT |
2707 	    MHI_TRE1_DATA_TYPE_TRANSFER << MHI_TRE1_DATA_TYPE_SHIFT);
2708 
2709 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(ring->dmamem),
2710 	    0, QWX_DMA_LEN(ring->dmamem), BUS_DMASYNC_PREWRITE);
2711 
2712 	base = QWX_DMA_DVA(ring->dmamem);
2713 	if (ring->wp + sizeof(struct qwx_mhi_ring_element) >= base + ring->size)
2714 		ring->wp = base;
2715 	else
2716 		ring->wp += sizeof(struct qwx_mhi_ring_element);
2717 	ring->queued++;
2718 
2719 	ring->chan_ctxt->wp = htole64(ring->wp);
2720 
2721 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->chan_ctxt), 0,
2722 	    QWX_DMA_LEN(psc->chan_ctxt), BUS_DMASYNC_PREWRITE);
2723 
2724 	qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
2725 	return 0;
2726 }
2727 
2728 int
2729 qwx_mhi_start_channel(struct qwx_pci_softc *psc,
2730 	struct qwx_pci_xfer_ring *ring)
2731 {
2732 	struct qwx_softc *sc = &psc->sc_sc;
2733 	struct qwx_mhi_chan_ctxt *c;
2734 	int ret = 0;
2735 	uint32_t chcfg;
2736 	uint64_t paddr, len;
2737 
2738 	DNPRINTF(QWX_D_MHI, "%s: start MHI channel %d in state %d\n", __func__,
2739 	    ring->mhi_chan_id, ring->mhi_chan_state);
2740 
2741 	c = ring->chan_ctxt;
2742 
2743 	chcfg = le32toh(c->chcfg);
2744 	chcfg &= ~MHI_CHAN_CTX_CHSTATE_MASK;
2745 	chcfg |= MHI_CHAN_CTX_CHSTATE_ENABLED;
2746 	c->chcfg = htole32(chcfg);
2747 
2748 	paddr = QWX_DMA_DVA(ring->dmamem);
2749 	ring->rp = ring->wp = paddr;
2750 	c->rbase = htole64(paddr);
2751 	c->rp = htole64(ring->rp);
2752 	c->wp = htole64(ring->wp);
2753 	len = sizeof(struct qwx_mhi_ring_element) * ring->num_elements;
2754 	c->rlen = htole64(len);
2755 
2756 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->chan_ctxt), 0,
2757 	    QWX_DMA_LEN(psc->chan_ctxt), BUS_DMASYNC_PREWRITE);
2758 
2759 	ring->cmd_status = MHI_EV_CC_INVALID;
2760 	if (qwx_mhi_send_cmd(psc, MHI_CMD_START_CHAN, ring->mhi_chan_id))
2761 		return 1;
2762 
2763 	while (ring->cmd_status != MHI_EV_CC_SUCCESS) {
2764 		ret = tsleep_nsec(&ring->cmd_status, 0, "qwxcmd",
2765 		    SEC_TO_NSEC(5));
2766 		if (ret)
2767 			break;
2768 	}
2769 
2770 	if (ret) {
2771 		printf("%s: could not start MHI channel %d in state %d: status 0x%x\n",
2772 		    sc->sc_dev.dv_xname, ring->mhi_chan_id,
2773 		    ring->mhi_chan_state, ring->cmd_status);
2774 		return 1;
2775 	}
2776 
2777 	if (ring->mhi_chan_direction == MHI_CHAN_TYPE_INBOUND) {
2778 		uint64_t wp = QWX_DMA_DVA(ring->dmamem);
2779 		int i;
2780 
2781 		for (i = 0; i < ring->num_elements; i++) {
2782 			struct qwx_mhi_ring_element *e;
2783 			struct qwx_xfer_data *xfer;
2784 			uint64_t paddr;
2785 
2786 			e = qwx_pci_xfer_ring_get_elem(ring, wp);
2787 			xfer = qwx_pci_xfer_ring_get_data(ring, wp);
2788 			paddr = xfer->map->dm_segs[0].ds_addr;
2789 
2790 			e->ptr = htole64(paddr);
2791 			e->dword[0] = htole32((QWX_PCI_XFER_MAX_DATA_SIZE <<
2792 			    MHI_TRE0_DATA_LEN_SHFT) &
2793 			    MHI_TRE0_DATA_LEN_MASK);
2794 			e->dword[1] = htole32(MHI_TRE1_DATA_IEOT |
2795 			    MHI_TRE1_DATA_BEI |
2796 			    MHI_TRE1_DATA_TYPE_TRANSFER <<
2797 			    MHI_TRE1_DATA_TYPE_SHIFT);
2798 
2799 			ring->wp = wp;
2800 			wp += sizeof(*e);
2801 		}
2802 
2803 		bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(ring->dmamem), 0,
2804 		    QWX_DMA_LEN(ring->dmamem), BUS_DMASYNC_PREWRITE);
2805 
2806 		qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
2807 	}
2808 
2809 	return 0;
2810 }
2811 
2812 int
2813 qwx_mhi_start_channels(struct qwx_pci_softc *psc)
2814 {
2815 	struct qwx_pci_xfer_ring *ring;
2816 	int ret = 0;
2817 
2818 	qwx_mhi_device_wake(&psc->sc_sc);
2819 
2820 	ring = &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_OUTBOUND];
2821 	if (qwx_mhi_start_channel(psc, ring)) {
2822 		ret = 1;
2823 		goto done;
2824 	}
2825 
2826 	ring = &psc->xfer_rings[QWX_PCI_XFER_RING_IPCR_INBOUND];
2827 	if (qwx_mhi_start_channel(psc, ring))
2828 		ret = 1;
2829 done:
2830 	qwx_mhi_device_zzz(&psc->sc_sc);
2831 	return ret;
2832 }
2833 
2834 int
2835 qwx_mhi_start(struct qwx_pci_softc *psc)
2836 {
2837 	struct qwx_softc *sc = &psc->sc_sc;
2838 	uint32_t off;
2839 	uint32_t ee, state;
2840 	int ret;
2841 
2842 	qwx_mhi_init_dev_ctxt(psc);
2843 
2844 	psc->bhi_off = qwx_pci_read(sc, MHI_BHI_OFFSET);
2845 	DNPRINTF(QWX_D_MHI, "%s: BHI offset 0x%x\n", __func__, psc->bhi_off);
2846 
2847 	psc->bhie_off = qwx_pci_read(sc, MHI_BHIE_OFFSET);
2848 	DNPRINTF(QWX_D_MHI, "%s: BHIE offset 0x%x\n", __func__, psc->bhie_off);
2849 
2850 	/* Clean BHIE RX registers */
2851 	for (off = MHI_BHIE_RXVECADDR_LOW_OFFS;
2852 	     off < (MHI_BHIE_RXVECSTATUS_OFFS - 4);
2853 	     off += 4)
2854 	     	qwx_pci_write(sc, psc->bhie_off + off, 0x0);
2855 
2856 	qwx_rddm_prepare(psc);
2857 
2858 	/* Program BHI INTVEC */
2859 	qwx_pci_write(sc, psc->bhi_off + MHI_BHI_INTVEC, 0x00);
2860 
2861 	/*
2862 	 * Get BHI execution environment and confirm that it is valid
2863 	 * for power on.
2864 	 */
2865 	ee = qwx_pci_read(sc, psc->bhi_off + MHI_BHI_EXECENV);
2866 	if (!MHI_POWER_UP_CAPABLE(ee)) {
2867 		printf("%s: invalid EE for power on: 0x%x\n",
2868 		     sc->sc_dev.dv_xname, ee);
2869 		return 1;
2870 	}
2871 
2872 	/*
2873 	 * Get MHI state of the device and reset it if it is in system
2874 	 * error.
2875 	 */
2876 	state = qwx_pci_read(sc, MHI_STATUS);
2877 	DNPRINTF(QWX_D_MHI, "%s: MHI power on with EE: 0x%x, status: 0x%x\n",
2878 	     sc->sc_dev.dv_xname, ee, state);
2879 	state = (state & MHI_STATUS_MHISTATE_MASK) >> MHI_STATUS_MHISTATE_SHFT;
2880 	if (state == MHI_STATE_SYS_ERR) {
2881 		if (qwx_mhi_reset_device(sc, 0))
2882 			return 1;
2883 		state = qwx_pci_read(sc, MHI_STATUS);
2884 		DNPRINTF(QWX_D_MHI, "%s: MHI state after reset: 0x%x\n",
2885 		    sc->sc_dev.dv_xname, state);
2886 		state = (state & MHI_STATUS_MHISTATE_MASK) >>
2887 		    MHI_STATUS_MHISTATE_SHFT;
2888 		if (state == MHI_STATE_SYS_ERR) {
2889 			printf("%s: MHI stuck in system error state\n",
2890 			    sc->sc_dev.dv_xname);
2891 			return 1;
2892 		}
2893 	}
2894 
2895 	psc->bhi_ee = ee;
2896 	psc->mhi_state = state;
2897 
2898 #if notyet
2899 	/* Enable IRQs */
2900 	//  XXX todo?
2901 #endif
2902 
2903 	/* Transition to primary runtime. */
2904 	if (MHI_IN_PBL(ee)) {
2905 		ret = qwx_mhi_fw_load_handler(psc);
2906 		if (ret)
2907 			return ret;
2908 
2909 		/* XXX without this delay starting the channels may fail */
2910 		delay(1000);
2911 		qwx_mhi_start_channels(psc);
2912 	} else {
2913 		/* XXX Handle partially initialized device...?!? */
2914 		ee = qwx_pci_read(sc, psc->bhi_off + MHI_BHI_EXECENV);
2915 		if (!MHI_IN_MISSION_MODE(ee)) {
2916 			printf("%s: failed to power up MHI, ee=0x%x\n",
2917 			    sc->sc_dev.dv_xname, ee);
2918 			return EIO;
2919 		}
2920 	}
2921 
2922 	return 0;
2923 }
2924 
2925 void
2926 qwx_mhi_stop(struct qwx_softc *sc)
2927 {
2928 	qwx_mhi_reset_device(sc, 1);
2929 }
2930 
2931 int
2932 qwx_mhi_reset_device(struct qwx_softc *sc, int force)
2933 {
2934 	struct qwx_pci_softc *psc = (struct qwx_pci_softc *)sc;
2935 	uint32_t reg;
2936 	int ret = 0;
2937 
2938 	reg = qwx_pcic_read32(sc, MHI_STATUS);
2939 
2940 	DNPRINTF(QWX_D_MHI, "%s: MHISTATUS 0x%x\n", sc->sc_dev.dv_xname, reg);
2941 	/*
2942 	 * Observed on QCA6390 that after SOC_GLOBAL_RESET, MHISTATUS
2943 	 * has SYSERR bit set and thus need to set MHICTRL_RESET
2944 	 * to clear SYSERR.
2945 	 */
2946 	if (force || (reg & MHI_STATUS_SYSERR_MASK)) {
2947 		/* Trigger MHI Reset in device. */
2948 		qwx_pcic_write32(sc, MHI_CTRL, MHI_CTRL_RESET_MASK);
2949 
2950 		/* Wait for the reset bit to be cleared by the device. */
2951 		ret = qwx_mhi_await_device_reset(sc);
2952 		if (ret)
2953 			return ret;
2954 
2955 		if (psc->bhi_off == 0)
2956 			psc->bhi_off = qwx_pci_read(sc, MHI_BHI_OFFSET);
2957 
2958 		/* Device clear BHI INTVEC so re-program it. */
2959 		qwx_pci_write(sc, psc->bhi_off + MHI_BHI_INTVEC, 0x00);
2960 	}
2961 
2962 	return 0;
2963 }
2964 
2965 static inline void
2966 qwx_mhi_reset_txvecdb(struct qwx_softc *sc)
2967 {
2968 	qwx_pcic_write32(sc, PCIE_TXVECDB, 0);
2969 }
2970 
2971 static inline void
2972 qwx_mhi_reset_txvecstatus(struct qwx_softc *sc)
2973 {
2974 	qwx_pcic_write32(sc, PCIE_TXVECSTATUS, 0);
2975 }
2976 
2977 static inline void
2978 qwx_mhi_reset_rxvecdb(struct qwx_softc *sc)
2979 {
2980 	qwx_pcic_write32(sc, PCIE_RXVECDB, 0);
2981 }
2982 
2983 static inline void
2984 qwx_mhi_reset_rxvecstatus(struct qwx_softc *sc)
2985 {
2986 	qwx_pcic_write32(sc, PCIE_RXVECSTATUS, 0);
2987 }
2988 
2989 void
2990 qwx_mhi_clear_vector(struct qwx_softc *sc)
2991 {
2992 	qwx_mhi_reset_txvecdb(sc);
2993 	qwx_mhi_reset_txvecstatus(sc);
2994 	qwx_mhi_reset_rxvecdb(sc);
2995 	qwx_mhi_reset_rxvecstatus(sc);
2996 }
2997 
2998 int
2999 qwx_mhi_fw_load_handler(struct qwx_pci_softc *psc)
3000 {
3001 	struct qwx_softc *sc = &psc->sc_sc;
3002 	int ret;
3003 	char amss_path[PATH_MAX];
3004 	u_char *data;
3005 	size_t len;
3006 
3007 	if (sc->fw_img[QWX_FW_AMSS].data) {
3008 		data = sc->fw_img[QWX_FW_AMSS].data;
3009 		len = sc->fw_img[QWX_FW_AMSS].size;
3010 	} else {
3011 		ret = snprintf(amss_path, sizeof(amss_path), "%s-%s-%s",
3012 		    ATH11K_FW_DIR, sc->hw_params.fw.dir, ATH11K_AMSS_FILE);
3013 		if (ret < 0 || ret >= sizeof(amss_path))
3014 			return ENOSPC;
3015 
3016 		ret = loadfirmware(amss_path, &data, &len);
3017 		if (ret) {
3018 			printf("%s: could not read %s (error %d)\n",
3019 			    sc->sc_dev.dv_xname, amss_path, ret);
3020 			return ret;
3021 		}
3022 
3023 		if (len < MHI_DMA_VEC_CHUNK_SIZE) {
3024 			printf("%s: %s is too short, have only %zu bytes\n",
3025 			    sc->sc_dev.dv_xname, amss_path, len);
3026 			free(data, M_DEVBUF, len);
3027 			return EINVAL;
3028 		}
3029 
3030 		sc->fw_img[QWX_FW_AMSS].data = data;
3031 		sc->fw_img[QWX_FW_AMSS].size = len;
3032 	}
3033 
3034 	/* Second-stage boot loader sits in the first 512 KB of image. */
3035 	ret = qwx_mhi_fw_load_bhi(psc, data, MHI_DMA_VEC_CHUNK_SIZE);
3036 	if (ret != 0) {
3037 		printf("%s: could not load firmware %s\n",
3038 		    sc->sc_dev.dv_xname, amss_path);
3039 		return ret;
3040 	}
3041 
3042 	/* Now load the full image. */
3043 	ret = qwx_mhi_fw_load_bhie(psc, data, len);
3044 	if (ret != 0) {
3045 		printf("%s: could not load firmware %s\n",
3046 		    sc->sc_dev.dv_xname, amss_path);
3047 		return ret;
3048 	}
3049 
3050 	while (psc->bhi_ee < MHI_EE_AMSS) {
3051 		ret = tsleep_nsec(&psc->bhi_ee, 0, "qwxamss",
3052 		    SEC_TO_NSEC(5));
3053 		if (ret)
3054 			break;
3055 	}
3056 	if (ret != 0) {
3057 		printf("%s: device failed to enter AMSS EE\n",
3058 		    sc->sc_dev.dv_xname);
3059 	}
3060 
3061 	return ret;
3062 }
3063 
3064 int
3065 qwx_mhi_await_device_reset(struct qwx_softc *sc)
3066 {
3067 	const uint32_t msecs = 24, retries = 2;
3068 	uint32_t reg;
3069 	int timeout;
3070 
3071 	/* Poll for CTRL RESET to clear. */
3072 	timeout = retries;
3073 	while (timeout > 0) {
3074 		reg = qwx_pci_read(sc, MHI_CTRL);
3075 		DNPRINTF(QWX_D_MHI, "%s: MHI_CTRL is 0x%x\n", __func__, reg);
3076 		if ((reg & MHI_CTRL_RESET_MASK) == 0)
3077 			break;
3078 		DELAY((msecs / retries) * 1000);
3079 		timeout--;
3080 	}
3081 	if (timeout == 0) {
3082 		DNPRINTF(QWX_D_MHI, "%s: MHI reset failed\n", __func__);
3083 		return ETIMEDOUT;
3084 	}
3085 
3086 	return 0;
3087 }
3088 
3089 int
3090 qwx_mhi_await_device_ready(struct qwx_softc *sc)
3091 {
3092 	uint32_t reg;
3093 	int timeout;
3094 	const uint32_t msecs = 2000, retries = 4;
3095 
3096 
3097 	/* Poll for READY to be set. */
3098 	timeout = retries;
3099 	while (timeout > 0) {
3100 		reg = qwx_pci_read(sc, MHI_STATUS);
3101 		DNPRINTF(QWX_D_MHI, "%s: MHI_STATUS is 0x%x\n", __func__, reg);
3102 		if (reg & MHI_STATUS_READY_MASK) {
3103 			reg &= ~MHI_STATUS_READY_MASK;
3104 			qwx_pci_write(sc, MHI_STATUS, reg);
3105 			break;
3106 		}
3107 		DELAY((msecs / retries) * 1000);
3108 		timeout--;
3109 	}
3110 	if (timeout == 0) {
3111 		printf("%s: MHI not ready\n", sc->sc_dev.dv_xname);
3112 		return ETIMEDOUT;
3113 	}
3114 
3115 	return 0;
3116 }
3117 
3118 void
3119 qwx_mhi_ready_state_transition(struct qwx_pci_softc *psc)
3120 {
3121 	struct qwx_softc *sc = &psc->sc_sc;
3122 	int ret, i;
3123 
3124 	ret = qwx_mhi_await_device_reset(sc);
3125 	if (ret)
3126 		return;
3127 
3128 	ret = qwx_mhi_await_device_ready(sc);
3129 	if (ret)
3130 		return;
3131 
3132 	/* Set up memory-mapped IO for channels, events, etc. */
3133 	qwx_mhi_init_mmio(psc);
3134 
3135 	/* Notify event rings. */
3136 	for (i = 0; i < nitems(psc->event_rings); i++) {
3137 		struct qwx_pci_event_ring *ring = &psc->event_rings[i];
3138 		qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
3139 	}
3140 
3141 	/*
3142 	 * Set the device into M0 state. The device will transition
3143 	 * into M0 and the execution environment will switch to SBL.
3144 	 */
3145 	qwx_mhi_set_state(sc, MHI_STATE_M0);
3146 }
3147 
3148 void
3149 qwx_mhi_mission_mode_state_transition(struct qwx_pci_softc *psc)
3150 {
3151 	struct qwx_softc *sc = &psc->sc_sc;
3152 	int i;
3153 
3154 	qwx_mhi_device_wake(sc);
3155 
3156 	/* Notify event rings. */
3157 	for (i = 0; i < nitems(psc->event_rings); i++) {
3158 		struct qwx_pci_event_ring *ring = &psc->event_rings[i];
3159 		qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
3160 	}
3161 
3162 	/* TODO: Notify transfer/command rings? */
3163 
3164 	qwx_mhi_device_zzz(sc);
3165 }
3166 
3167 void
3168 qwx_mhi_low_power_mode_state_transition(struct qwx_pci_softc *psc)
3169 {
3170 	struct qwx_softc *sc = &psc->sc_sc;
3171 
3172 	qwx_mhi_set_state(sc, MHI_STATE_M2);
3173 }
3174 
3175 void
3176 qwx_mhi_set_state(struct qwx_softc *sc, uint32_t state)
3177 {
3178 	uint32_t reg;
3179 
3180 	reg = qwx_pci_read(sc, MHI_CTRL);
3181 
3182 	if (state != MHI_STATE_RESET) {
3183 		reg &= ~MHI_CTRL_MHISTATE_MASK;
3184 		reg |= (state << MHI_CTRL_MHISTATE_SHFT) & MHI_CTRL_MHISTATE_MASK;
3185 	} else
3186 		reg |= MHI_CTRL_RESET_MASK;
3187 
3188 	qwx_pci_write(sc, MHI_CTRL, reg);
3189 }
3190 
3191 void
3192 qwx_mhi_init_mmio(struct qwx_pci_softc *psc)
3193 {
3194 	struct qwx_softc *sc = &psc->sc_sc;
3195 	uint64_t paddr;
3196 	uint32_t reg;
3197 	int i;
3198 
3199 	reg = qwx_pci_read(sc, MHI_CHDBOFF);
3200 
3201 	/* Set device wake doorbell address. */
3202 	psc->wake_db = reg + 8 * MHI_DEV_WAKE_DB;
3203 
3204 	/* Set doorbell address for each transfer ring. */
3205 	for (i = 0; i < nitems(psc->xfer_rings); i++) {
3206 		struct qwx_pci_xfer_ring *ring = &psc->xfer_rings[i];
3207 		ring->db_addr = reg + (8 * ring->mhi_chan_id);
3208 	}
3209 
3210 	reg = qwx_pci_read(sc, MHI_ERDBOFF);
3211 	/* Set doorbell address for each event ring. */
3212 	for (i = 0; i < nitems(psc->event_rings); i++) {
3213 		struct qwx_pci_event_ring *ring = &psc->event_rings[i];
3214 		ring->db_addr = reg + (8 * i);
3215 	}
3216 
3217 	paddr = QWX_DMA_DVA(psc->chan_ctxt);
3218 	qwx_pci_write(sc, MHI_CCABAP_HIGHER, paddr >> 32);
3219 	qwx_pci_write(sc, MHI_CCABAP_LOWER, paddr & 0xffffffff);
3220 
3221 	paddr = QWX_DMA_DVA(psc->event_ctxt);
3222 	qwx_pci_write(sc, MHI_ECABAP_HIGHER, paddr >> 32);
3223 	qwx_pci_write(sc, MHI_ECABAP_LOWER, paddr & 0xffffffff);
3224 
3225 	paddr = QWX_DMA_DVA(psc->cmd_ctxt);
3226 	qwx_pci_write(sc, MHI_CRCBAP_HIGHER, paddr >> 32);
3227 	qwx_pci_write(sc, MHI_CRCBAP_LOWER, paddr & 0xffffffff);
3228 
3229 	/* Not (yet?) using fixed memory space from a device-tree. */
3230 	qwx_pci_write(sc, MHI_CTRLBASE_HIGHER, 0);
3231 	qwx_pci_write(sc, MHI_CTRLBASE_LOWER, 0);
3232 	qwx_pci_write(sc, MHI_DATABASE_HIGHER, 0);
3233 	qwx_pci_write(sc, MHI_DATABASE_LOWER, 0);
3234 	qwx_pci_write(sc, MHI_CTRLLIMIT_HIGHER, 0x0);
3235 	qwx_pci_write(sc, MHI_CTRLLIMIT_LOWER, 0xffffffff);
3236 	qwx_pci_write(sc, MHI_DATALIMIT_HIGHER, 0x0);
3237 	qwx_pci_write(sc, MHI_DATALIMIT_LOWER, 0xffffffff);
3238 
3239 	reg = qwx_pci_read(sc, MHI_CFG);
3240 	reg &= ~(MHI_CFG_NER_MASK | MHI_CFG_NHWER_MASK);
3241 	reg |= QWX_NUM_EVENT_CTX << MHI_CFG_NER_SHFT;
3242 	qwx_pci_write(sc, MHI_CFG, reg);
3243 }
3244 
3245 int
3246 qwx_mhi_fw_load_bhi(struct qwx_pci_softc *psc, uint8_t *data, size_t len)
3247 {
3248 	struct qwx_softc *sc = &psc->sc_sc;
3249 	struct qwx_dmamem *data_adm;
3250 	uint32_t seq, reg, status = MHI_BHI_STATUS_RESET;
3251 	uint64_t paddr;
3252 	int ret;
3253 
3254 	data_adm = qwx_dmamem_alloc(sc->sc_dmat, len, 0);
3255 	if (data_adm == NULL) {
3256 		printf("%s: could not allocate BHI DMA data buffer\n",
3257 		    sc->sc_dev.dv_xname);
3258 		return 1;
3259 	}
3260 
3261 	/* Copy firmware image to DMA memory. */
3262 	memcpy(QWX_DMA_KVA(data_adm), data, len);
3263 
3264 	qwx_pci_write(sc, psc->bhi_off + MHI_BHI_STATUS, 0);
3265 
3266 	/* Set data physical address and length. */
3267 	paddr = QWX_DMA_DVA(data_adm);
3268 	qwx_pci_write(sc, psc->bhi_off + MHI_BHI_IMGADDR_HIGH, paddr >> 32);
3269 	qwx_pci_write(sc, psc->bhi_off + MHI_BHI_IMGADDR_LOW,
3270 	    paddr & 0xffffffff);
3271 	qwx_pci_write(sc, psc->bhi_off + MHI_BHI_IMGSIZE, len);
3272 
3273 	/* Set a random transaction sequence number. */
3274 	do {
3275 		seq = arc4random_uniform(MHI_BHI_TXDB_SEQNUM_BMSK);
3276 	} while (seq == 0);
3277 	qwx_pci_write(sc, psc->bhi_off + MHI_BHI_IMGTXDB, seq);
3278 
3279 	/* Wait for completion. */
3280 	ret = 0;
3281 	while (status != MHI_BHI_STATUS_SUCCESS && psc->bhi_ee < MHI_EE_SBL) {
3282 		ret = tsleep_nsec(&psc->bhi_ee, 0, "qwxbhi", SEC_TO_NSEC(5));
3283 		if (ret)
3284 			break;
3285 		reg = qwx_pci_read(sc, psc->bhi_off + MHI_BHI_STATUS);
3286 		status = (reg & MHI_BHI_STATUS_MASK) >> MHI_BHI_STATUS_SHFT;
3287 	}
3288 
3289 	if (ret) {
3290 		printf("%s: BHI load timeout\n", sc->sc_dev.dv_xname);
3291 		reg = qwx_pci_read(sc, psc->bhi_off + MHI_BHI_STATUS);
3292 		status = (reg & MHI_BHI_STATUS_MASK) >> MHI_BHI_STATUS_SHFT;
3293 		DNPRINTF(QWX_D_MHI, "%s: BHI status is 0x%x EE is 0x%x\n",
3294 		    __func__, status, psc->bhi_ee);
3295 	}
3296 
3297 	qwx_dmamem_free(sc->sc_dmat, data_adm);
3298 	return ret;
3299 }
3300 
3301 int
3302 qwx_mhi_fw_load_bhie(struct qwx_pci_softc *psc, uint8_t *data, size_t len)
3303 {
3304 	struct qwx_softc *sc = &psc->sc_sc;
3305 	struct qwx_dma_vec_entry *vec;
3306 	uint32_t seq, reg, state = MHI_BHIE_TXVECSTATUS_STATUS_RESET;
3307 	uint64_t paddr;
3308 	const size_t chunk_size = MHI_DMA_VEC_CHUNK_SIZE;
3309 	size_t nseg, remain, vec_size;
3310 	int i, ret;
3311 
3312 	nseg = howmany(len, chunk_size);
3313 	if (nseg == 0) {
3314 		printf("%s: BHIE data too short, have only %zu bytes\n",
3315 		    sc->sc_dev.dv_xname, len);
3316 		return 1;
3317 	}
3318 
3319 	if (psc->amss_data == NULL || QWX_DMA_LEN(psc->amss_data) < len) {
3320 		if (psc->amss_data)
3321 			qwx_dmamem_free(sc->sc_dmat, psc->amss_data);
3322 		psc->amss_data = qwx_dmamem_alloc(sc->sc_dmat, len, 0);
3323 		if (psc->amss_data == NULL) {
3324 			printf("%s: could not allocate BHIE DMA data buffer\n",
3325 			    sc->sc_dev.dv_xname);
3326 			return 1;
3327 		}
3328 	}
3329 
3330 	vec_size = nseg * sizeof(*vec);
3331 	if (psc->amss_vec == NULL || QWX_DMA_LEN(psc->amss_vec) < vec_size) {
3332 		if (psc->amss_vec)
3333 			qwx_dmamem_free(sc->sc_dmat, psc->amss_vec);
3334 		psc->amss_vec = qwx_dmamem_alloc(sc->sc_dmat, vec_size, 0);
3335 		if (psc->amss_vec == NULL) {
3336 			printf("%s: could not allocate BHIE DMA vec buffer\n",
3337 			    sc->sc_dev.dv_xname);
3338 			qwx_dmamem_free(sc->sc_dmat, psc->amss_data);
3339 			psc->amss_data = NULL;
3340 			return 1;
3341 		}
3342 	}
3343 
3344 	/* Copy firmware image to DMA memory. */
3345 	memcpy(QWX_DMA_KVA(psc->amss_data), data, len);
3346 
3347 	/* Create vector which controls chunk-wise DMA copy in hardware. */
3348 	paddr = QWX_DMA_DVA(psc->amss_data);
3349 	vec = QWX_DMA_KVA(psc->amss_vec);
3350 	remain = len;
3351 	for (i = 0; i < nseg; i++) {
3352 		vec[i].paddr = paddr;
3353 		if (remain >= chunk_size) {
3354 			vec[i].size = chunk_size;
3355 			remain -= chunk_size;
3356 			paddr += chunk_size;
3357 		} else
3358 			vec[i].size = remain;
3359 	}
3360 
3361 	/* Set vector physical address and length. */
3362 	paddr = QWX_DMA_DVA(psc->amss_vec);
3363 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_TXVECADDR_HIGH_OFFS,
3364 	    paddr >> 32);
3365 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_TXVECADDR_LOW_OFFS,
3366 	    paddr & 0xffffffff);
3367 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_TXVECSIZE_OFFS, vec_size);
3368 
3369 	/* Set a random transaction sequence number. */
3370 	do {
3371 		seq = arc4random_uniform(MHI_BHIE_TXVECSTATUS_SEQNUM_BMSK);
3372 	} while (seq == 0);
3373 	reg = qwx_pci_read(sc, psc->bhie_off + MHI_BHIE_TXVECDB_OFFS);
3374 	reg &= ~MHI_BHIE_TXVECDB_SEQNUM_BMSK;
3375 	reg |= seq << MHI_BHIE_TXVECDB_SEQNUM_SHFT;
3376 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_TXVECDB_OFFS, reg);
3377 
3378 	/* Wait for completion. */
3379 	ret = 0;
3380 	while (state != MHI_BHIE_TXVECSTATUS_STATUS_XFER_COMPL) {
3381 		ret = tsleep_nsec(&psc->bhie_off, 0, "qwxbhie",
3382 		    SEC_TO_NSEC(5));
3383 		if (ret)
3384 			break;
3385 		reg = qwx_pci_read(sc,
3386 		    psc->bhie_off + MHI_BHIE_TXVECSTATUS_OFFS);
3387 		state = (reg & MHI_BHIE_TXVECSTATUS_STATUS_BMSK) >>
3388 		    MHI_BHIE_TXVECSTATUS_STATUS_SHFT;
3389 		DNPRINTF(QWX_D_MHI, "%s: txvec state is 0x%x\n", __func__,
3390 		    state);
3391 	}
3392 
3393 	if (ret) {
3394 		printf("%s: BHIE load timeout\n", sc->sc_dev.dv_xname);
3395 		return ret;
3396 	}
3397 	return 0;
3398 }
3399 
3400 void
3401 qwx_rddm_prepare(struct qwx_pci_softc *psc)
3402 {
3403 	struct qwx_softc *sc = &psc->sc_sc;
3404 	struct qwx_dma_vec_entry *vec;
3405 	struct qwx_dmamem *data_adm, *vec_adm;
3406 	uint32_t seq, reg;
3407 	uint64_t paddr;
3408 	const size_t len = QWX_RDDM_DUMP_SIZE;
3409 	const size_t chunk_size = MHI_DMA_VEC_CHUNK_SIZE;
3410 	size_t nseg, remain, vec_size;
3411 	int i;
3412 
3413 	nseg = howmany(len, chunk_size);
3414 	if (nseg == 0) {
3415 		printf("%s: RDDM data too short, have only %zu bytes\n",
3416 		    sc->sc_dev.dv_xname, len);
3417 		return;
3418 	}
3419 
3420 	data_adm = qwx_dmamem_alloc(sc->sc_dmat, len, 0);
3421 	if (data_adm == NULL) {
3422 		printf("%s: could not allocate BHIE DMA data buffer\n",
3423 		    sc->sc_dev.dv_xname);
3424 		return;
3425 	}
3426 
3427 	vec_size = nseg * sizeof(*vec);
3428 	vec_adm = qwx_dmamem_alloc(sc->sc_dmat, vec_size, 0);
3429 	if (vec_adm == NULL) {
3430 		printf("%s: could not allocate BHIE DMA vector buffer\n",
3431 		    sc->sc_dev.dv_xname);
3432 		qwx_dmamem_free(sc->sc_dmat, data_adm);
3433 		return;
3434 	}
3435 
3436 	/* Create vector which controls chunk-wise DMA copy from hardware. */
3437 	paddr = QWX_DMA_DVA(data_adm);
3438 	vec = QWX_DMA_KVA(vec_adm);
3439 	remain = len;
3440 	for (i = 0; i < nseg; i++) {
3441 		vec[i].paddr = paddr;
3442 		if (remain >= chunk_size) {
3443 			vec[i].size = chunk_size;
3444 			remain -= chunk_size;
3445 			paddr += chunk_size;
3446 		} else
3447 			vec[i].size = remain;
3448 	}
3449 
3450 	/* Set vector physical address and length. */
3451 	paddr = QWX_DMA_DVA(vec_adm);
3452 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_RXVECADDR_HIGH_OFFS,
3453 	    paddr >> 32);
3454 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_RXVECADDR_LOW_OFFS,
3455 	    paddr & 0xffffffff);
3456 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_RXVECSIZE_OFFS, vec_size);
3457 
3458 	/* Set a random transaction sequence number. */
3459 	do {
3460 		seq = arc4random_uniform(MHI_BHIE_RXVECSTATUS_SEQNUM_BMSK);
3461 	} while (seq == 0);
3462 
3463 	reg = qwx_pci_read(sc, psc->bhie_off + MHI_BHIE_RXVECDB_OFFS);
3464 	reg &= ~MHI_BHIE_RXVECDB_SEQNUM_BMSK;
3465 	reg |= seq << MHI_BHIE_RXVECDB_SEQNUM_SHFT;
3466 	qwx_pci_write(sc, psc->bhie_off + MHI_BHIE_RXVECDB_OFFS, reg);
3467 
3468 	psc->rddm_data = data_adm;
3469 	psc->rddm_vec = vec_adm;
3470 }
3471 
3472 void
3473 qwx_rddm_task(void *arg)
3474 {
3475 	struct qwx_pci_softc *psc = arg;
3476 	struct qwx_softc *sc = &psc->sc_sc;
3477 	uint32_t reg, state = MHI_BHIE_RXVECSTATUS_STATUS_RESET;
3478 	const size_t len = QWX_RDDM_DUMP_SIZE;
3479 	int i, timeout;
3480 	const uint32_t msecs = 100, retries = 20;
3481 	uint8_t *rddm;
3482 	struct nameidata nd;
3483 	struct vnode *vp = NULL;
3484 	struct iovec iov[3];
3485 	struct uio uio;
3486 	char path[PATH_MAX];
3487 	int error = 0;
3488 
3489 	if (psc->rddm_data == NULL) {
3490 		DPRINTF("%s: RDDM not prepared\n", __func__);
3491 		return;
3492 	}
3493 
3494 	/* Poll for completion */
3495 	timeout = retries;
3496 	while (timeout > 0 && state != MHI_BHIE_RXVECSTATUS_STATUS_XFER_COMPL) {
3497 		reg = qwx_pci_read(sc,
3498 		    psc->bhie_off + MHI_BHIE_RXVECSTATUS_OFFS);
3499 		state = (reg & MHI_BHIE_RXVECSTATUS_STATUS_BMSK) >>
3500 		    MHI_BHIE_RXVECSTATUS_STATUS_SHFT;
3501 		DPRINTF("%s: txvec state is 0x%x\n", __func__, state);
3502 		DELAY((msecs / retries) * 1000);
3503 		timeout--;
3504 	}
3505 
3506 	if (timeout == 0) {
3507 		DPRINTF("%s: RDDM dump failed\n", sc->sc_dev.dv_xname);
3508 		return;
3509 	}
3510 
3511 	rddm = QWX_DMA_KVA(psc->rddm_data);
3512 	DPRINTF("%s: RDDM snippet:\n", __func__);
3513 	for (i = 0; i < MIN(64, len); i++) {
3514 		DPRINTF("%s %.2x", i % 16 == 0 ? "\n" : "", rddm[i]);
3515 	}
3516 	DPRINTF("\n");
3517 
3518 	DPRINTF("%s: sleeping for 30 seconds to allow userland to boot\n", __func__);
3519 	tsleep_nsec(&psc->rddm_data, 0, "qwxrddm", SEC_TO_NSEC(30));
3520 
3521 	snprintf(path, sizeof(path), "/root/%s-rddm.bin", sc->sc_dev.dv_xname);
3522 	DPRINTF("%s: saving RDDM to %s\n", __func__, path);
3523 	NDINIT(&nd, 0, 0, UIO_SYSSPACE, path, curproc);
3524 	nd.ni_pledge = PLEDGE_CPATH | PLEDGE_WPATH;
3525 	nd.ni_unveil = UNVEIL_CREATE | UNVEIL_WRITE;
3526 	error = vn_open(&nd, FWRITE | O_CREAT | O_NOFOLLOW | O_TRUNC,
3527 	    S_IRUSR | S_IWUSR);
3528 	if (error) {
3529 		DPRINTF("%s: vn_open: error %d\n", __func__, error);
3530 		goto done;
3531 	}
3532 	vp = nd.ni_vp;
3533 	VOP_UNLOCK(vp);
3534 
3535 	iov[0].iov_base = (void *)rddm;
3536 	iov[0].iov_len = len;
3537 	iov[1].iov_len = 0;
3538 	uio.uio_iov = &iov[0];
3539 	uio.uio_offset = 0;
3540 	uio.uio_segflg = UIO_SYSSPACE;
3541 	uio.uio_rw = UIO_WRITE;
3542 	uio.uio_resid = len;
3543 	uio.uio_iovcnt = 1;
3544 	uio.uio_procp = curproc;
3545 	error = vget(vp, LK_EXCLUSIVE | LK_RETRY);
3546 	if (error) {
3547 		DPRINTF("%s: vget: error %d\n", __func__, error);
3548 		goto done;
3549 	}
3550 	error = VOP_WRITE(vp, &uio, IO_UNIT|IO_APPEND, curproc->p_ucred);
3551 	vput(vp);
3552 	if (error)
3553 		DPRINTF("%s: VOP_WRITE: error %d\n", __func__, error);
3554 	#if 0
3555 	error = vn_close(vp, FWRITE, curproc->p_ucred, curproc);
3556 	if (error)
3557 		DPRINTF("%s: vn_close: error %d\n", __func__, error);
3558 	#endif
3559 done:
3560 	qwx_dmamem_free(sc->sc_dmat, psc->rddm_data);
3561 	qwx_dmamem_free(sc->sc_dmat, psc->rddm_vec);
3562 	psc->rddm_data = NULL;
3563 	psc->rddm_vec = NULL;
3564 	DPRINTF("%s: done, error %d\n", __func__, error);
3565 }
3566 
3567 void *
3568 qwx_pci_event_ring_get_elem(struct qwx_pci_event_ring *ring, uint64_t rp)
3569 {
3570 	uint64_t base = QWX_DMA_DVA(ring->dmamem), offset;
3571 	void *addr = QWX_DMA_KVA(ring->dmamem);
3572 
3573 	if (rp < base)
3574 		return NULL;
3575 
3576 	offset = rp - base;
3577 	if (offset >= ring->size)
3578 		return NULL;
3579 
3580 	return addr + offset;
3581 }
3582 
3583 void
3584 qwx_mhi_state_change(struct qwx_pci_softc *psc, int ee, int mhi_state)
3585 {
3586 	struct qwx_softc *sc = &psc->sc_sc;
3587 	uint32_t old_ee = psc->bhi_ee;
3588 	uint32_t old_mhi_state = psc->mhi_state;
3589 
3590 	if (ee != -1 && psc->bhi_ee != ee) {
3591 		switch (ee) {
3592 		case MHI_EE_PBL:
3593 			DNPRINTF(QWX_D_MHI, "%s: new EE PBL\n",
3594 			    sc->sc_dev.dv_xname);
3595 			psc->bhi_ee = ee;
3596 			break;
3597 		case MHI_EE_SBL:
3598 			psc->bhi_ee = ee;
3599 			DNPRINTF(QWX_D_MHI, "%s: new EE SBL\n",
3600 			    sc->sc_dev.dv_xname);
3601 			break;
3602 		case MHI_EE_AMSS:
3603 			DNPRINTF(QWX_D_MHI, "%s: new EE AMSS\n",
3604 			    sc->sc_dev.dv_xname);
3605 			psc->bhi_ee = ee;
3606 			/* Wake thread loading the full AMSS image. */
3607 			wakeup(&psc->bhie_off);
3608 			break;
3609 		case MHI_EE_WFW:
3610 			DNPRINTF(QWX_D_MHI, "%s: new EE WFW\n",
3611 			    sc->sc_dev.dv_xname);
3612 			psc->bhi_ee = ee;
3613 			break;
3614 		default:
3615 			printf("%s: unhandled EE change to %x\n",
3616 			    sc->sc_dev.dv_xname, ee);
3617 			break;
3618 		}
3619 	}
3620 
3621 	if (mhi_state != -1 && psc->mhi_state != mhi_state) {
3622 		switch (mhi_state) {
3623 		case -1:
3624 			break;
3625 		case MHI_STATE_RESET:
3626 			DNPRINTF(QWX_D_MHI, "%s: new MHI state RESET\n",
3627 			    sc->sc_dev.dv_xname);
3628 			psc->mhi_state = mhi_state;
3629 			break;
3630 		case MHI_STATE_READY:
3631 			DNPRINTF(QWX_D_MHI, "%s: new MHI state READY\n",
3632 			    sc->sc_dev.dv_xname);
3633 			psc->mhi_state = mhi_state;
3634 			qwx_mhi_ready_state_transition(psc);
3635 			break;
3636 		case MHI_STATE_M0:
3637 			DNPRINTF(QWX_D_MHI, "%s: new MHI state M0\n",
3638 			    sc->sc_dev.dv_xname);
3639 			psc->mhi_state = mhi_state;
3640 			qwx_mhi_mission_mode_state_transition(psc);
3641 			break;
3642 		case MHI_STATE_M1:
3643 			DNPRINTF(QWX_D_MHI, "%s: new MHI state M1\n",
3644 			    sc->sc_dev.dv_xname);
3645 			psc->mhi_state = mhi_state;
3646 			qwx_mhi_low_power_mode_state_transition(psc);
3647 			break;
3648 		case MHI_STATE_SYS_ERR:
3649 			DNPRINTF(QWX_D_MHI,
3650 			    "%s: new MHI state SYS ERR\n",
3651 			    sc->sc_dev.dv_xname);
3652 			psc->mhi_state = mhi_state;
3653 			break;
3654 		default:
3655 			printf("%s: unhandled MHI state change to %x\n",
3656 			    sc->sc_dev.dv_xname, mhi_state);
3657 			break;
3658 		}
3659 	}
3660 
3661 	if (old_ee != psc->bhi_ee)
3662 		wakeup(&psc->bhi_ee);
3663 	if (old_mhi_state != psc->mhi_state)
3664 		wakeup(&psc->mhi_state);
3665 }
3666 
3667 void
3668 qwx_pci_intr_ctrl_event_mhi(struct qwx_pci_softc *psc, uint32_t mhi_state)
3669 {
3670 	DNPRINTF(QWX_D_MHI, "%s: MHI state change 0x%x -> 0x%x\n", __func__,
3671 	    psc->mhi_state, mhi_state);
3672 
3673 	if (psc->mhi_state != mhi_state)
3674 		qwx_mhi_state_change(psc, -1, mhi_state);
3675 }
3676 
3677 void
3678 qwx_pci_intr_ctrl_event_ee(struct qwx_pci_softc *psc, uint32_t ee)
3679 {
3680 	DNPRINTF(QWX_D_MHI, "%s: EE change 0x%x to 0x%x\n", __func__,
3681 	    psc->bhi_ee, ee);
3682 
3683 	if (psc->bhi_ee != ee)
3684 		qwx_mhi_state_change(psc, ee, -1);
3685 }
3686 
3687 void
3688 qwx_pci_intr_ctrl_event_cmd_complete(struct qwx_pci_softc *psc,
3689     uint64_t ptr, uint32_t cmd_status)
3690 {
3691 	struct qwx_pci_cmd_ring	*cmd_ring = &psc->cmd_ring;
3692 	uint64_t base = QWX_DMA_DVA(cmd_ring->dmamem);
3693 	struct qwx_pci_xfer_ring *xfer_ring = NULL;
3694 	struct qwx_mhi_ring_element *e;
3695 	uint32_t tre1, chid;
3696 	size_t i;
3697 
3698 	e = qwx_pci_cmd_ring_get_elem(cmd_ring, ptr);
3699 	if (e == NULL)
3700 		return;
3701 
3702 	tre1 = le32toh(e->dword[1]);
3703 	chid = (tre1 & MHI_TRE1_EV_CHID_MASK) >> MHI_TRE1_EV_CHID_SHFT;
3704 
3705 	for (i = 0; i < nitems(psc->xfer_rings); i++) {
3706 		if (psc->xfer_rings[i].mhi_chan_id == chid) {
3707 			xfer_ring = &psc->xfer_rings[i];
3708 			break;
3709 		}
3710 	}
3711 	if (xfer_ring == NULL) {
3712 		printf("%s: no transfer ring found for command completion "
3713 		    "on channel %u\n", __func__, chid);
3714 		return;
3715 	}
3716 
3717 	xfer_ring->cmd_status = cmd_status;
3718 	wakeup(&xfer_ring->cmd_status);
3719 
3720 	if (cmd_ring->rp + sizeof(*e) >= base + cmd_ring->size)
3721 		cmd_ring->rp = base;
3722 	else
3723 		cmd_ring->rp += sizeof(*e);
3724 }
3725 
3726 int
3727 qwx_pci_intr_ctrl_event(struct qwx_pci_softc *psc, struct qwx_pci_event_ring *ring)
3728 {
3729 	struct qwx_softc *sc = &psc->sc_sc;
3730 	struct qwx_mhi_event_ctxt *c;
3731 	uint64_t rp, wp, base;
3732 	struct qwx_mhi_ring_element *e;
3733 	uint32_t tre0, tre1, type, code, chid, len;
3734 
3735 	c = ring->event_ctxt;
3736 	if (c == NULL) {
3737 		/*
3738 		 * Interrupts can trigger before mhi_init_event_rings()
3739 		 * if the device is still active after a warm reboot.
3740 		 */
3741 		return 0;
3742 	}
3743 
3744 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->event_ctxt), 0,
3745 	    QWX_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_POSTREAD);
3746 
3747 	rp = le64toh(c->rp);
3748 	wp = le64toh(c->wp);
3749 
3750 	DNPRINTF(QWX_D_MHI, "%s: kernel rp=0x%llx\n", __func__, ring->rp);
3751 	DNPRINTF(QWX_D_MHI, "%s: device rp=0x%llx\n", __func__, rp);
3752 	DNPRINTF(QWX_D_MHI, "%s: kernel wp=0x%llx\n", __func__, ring->wp);
3753 	DNPRINTF(QWX_D_MHI, "%s: device wp=0x%llx\n", __func__, wp);
3754 
3755 	base = QWX_DMA_DVA(ring->dmamem);
3756 	if (ring->rp == rp || rp < base || rp >= base + ring->size)
3757 		return 0;
3758 	if (wp < base || wp >= base + ring->size)
3759 		return 0;
3760 
3761 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(ring->dmamem),
3762 	    0, QWX_DMA_LEN(ring->dmamem), BUS_DMASYNC_POSTREAD);
3763 
3764 	while (ring->rp != rp) {
3765 		e = qwx_pci_event_ring_get_elem(ring, ring->rp);
3766 		if (e == NULL)
3767 			return 0;
3768 
3769 		tre0 = le32toh(e->dword[0]);
3770 		tre1 = le32toh(e->dword[1]);
3771 
3772 		len = (tre0 & MHI_TRE0_EV_LEN_MASK) >> MHI_TRE0_EV_LEN_SHFT;
3773 		code = (tre0 & MHI_TRE0_EV_CODE_MASK) >> MHI_TRE0_EV_CODE_SHFT;
3774 		type = (tre1 & MHI_TRE1_EV_TYPE_MASK) >> MHI_TRE1_EV_TYPE_SHFT;
3775 		chid = (tre1 & MHI_TRE1_EV_CHID_MASK) >> MHI_TRE1_EV_CHID_SHFT;
3776 		DNPRINTF(QWX_D_MHI, "%s: len=%u code=0x%x type=0x%x chid=%d\n",
3777 		    __func__, len, code, type, chid);
3778 
3779 		switch (type) {
3780 		case MHI_PKT_TYPE_STATE_CHANGE_EVENT:
3781 			qwx_pci_intr_ctrl_event_mhi(psc, code);
3782 			break;
3783 		case MHI_PKT_TYPE_EE_EVENT:
3784 			qwx_pci_intr_ctrl_event_ee(psc, code);
3785 			break;
3786 		case MHI_PKT_TYPE_CMD_COMPLETION_EVENT:
3787 			qwx_pci_intr_ctrl_event_cmd_complete(psc,
3788 			    le64toh(e->ptr), code);
3789 			break;
3790 		default:
3791 			printf("%s: unhandled event type 0x%x\n",
3792 			    __func__, type);
3793 			break;
3794 		}
3795 
3796 		if (ring->rp + sizeof(*e) >= base + ring->size)
3797 			ring->rp = base;
3798 		else
3799 			ring->rp += sizeof(*e);
3800 
3801 		if (ring->wp + sizeof(*e) >= base + ring->size)
3802 			ring->wp = base;
3803 		else
3804 			ring->wp += sizeof(*e);
3805 	}
3806 
3807 	c->wp = htole64(ring->wp);
3808 
3809 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->event_ctxt), 0,
3810 	    QWX_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_PREWRITE);
3811 
3812 	qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
3813 	return 1;
3814 }
3815 
3816 void
3817 qwx_pci_intr_data_event_tx(struct qwx_pci_softc *psc, struct qwx_mhi_ring_element *e)
3818 {
3819 	struct qwx_softc *sc = &psc->sc_sc;
3820 	struct qwx_pci_xfer_ring *ring;
3821 	struct qwx_xfer_data *xfer;
3822 	uint64_t rp, evrp, base, paddr;
3823 	uint32_t tre0, tre1, code, chid, evlen, len;
3824 	int i;
3825 
3826 	tre0 = le32toh(e->dword[0]);
3827 	tre1 = le32toh(e->dword[1]);
3828 
3829 	evlen = (tre0 & MHI_TRE0_EV_LEN_MASK) >> MHI_TRE0_EV_LEN_SHFT;
3830 	code = (tre0 & MHI_TRE0_EV_CODE_MASK) >> MHI_TRE0_EV_CODE_SHFT;
3831 	chid = (tre1 & MHI_TRE1_EV_CHID_MASK) >> MHI_TRE1_EV_CHID_SHFT;
3832 
3833 	switch (code) {
3834 	case MHI_EV_CC_EOT:
3835 		for (i = 0; i < nitems(psc->xfer_rings); i++) {
3836 			ring = &psc->xfer_rings[i];
3837 			if (ring->mhi_chan_id == chid)
3838 				break;
3839 		}
3840 		if (i == nitems(psc->xfer_rings)) {
3841 			printf("%s: unhandled channel 0x%x\n",
3842 			    __func__, chid);
3843 			break;
3844 		}
3845 		base = QWX_DMA_DVA(ring->dmamem);
3846 		/* PTR contains the entry that was last written */
3847 		evrp = letoh64(e->ptr);
3848 		rp = evrp;
3849 		if (rp < base || rp >= base + ring->size) {
3850 			printf("%s: invalid ptr 0x%llx\n",
3851 			    __func__, rp);
3852 			break;
3853 		}
3854 		/* Point rp to next empty slot */
3855 		if (rp + sizeof(*e) >= base + ring->size)
3856 			rp = base;
3857 		else
3858 			rp += sizeof(*e);
3859 		/* Parse until next empty slot */
3860 		while (ring->rp != rp) {
3861 			DNPRINTF(QWX_D_MHI, "%s:%d: ring->rp 0x%llx "
3862 			    "ring->wp 0x%llx rp 0x%llx\n", __func__,
3863 			    __LINE__, ring->rp, ring->wp, rp);
3864 			e = qwx_pci_xfer_ring_get_elem(ring, ring->rp);
3865 			xfer = qwx_pci_xfer_ring_get_data(ring, ring->rp);
3866 
3867 			if (ring->rp == evrp)
3868 				len = evlen;
3869 			else
3870 				len = xfer->m->m_pkthdr.len;
3871 
3872 			bus_dmamap_sync(sc->sc_dmat, xfer->map, 0,
3873 			    xfer->m->m_pkthdr.len, BUS_DMASYNC_POSTREAD);
3874 #ifdef QWX_DEBUG
3875 			{
3876 			int i;
3877 			DNPRINTF(QWX_D_MHI, "%s: chan %u data (len %u): ",
3878 			    __func__,
3879 			    ring->mhi_chan_id, len);
3880 			for (i = 0; i < MIN(32, len); i++) {
3881 				DNPRINTF(QWX_D_MHI, "%02x ",
3882 				    (unsigned char)mtod(xfer->m, caddr_t)[i]);
3883 			}
3884 			if (i < len)
3885 				DNPRINTF(QWX_D_MHI, "...");
3886 			DNPRINTF(QWX_D_MHI, "\n");
3887 			}
3888 #endif
3889 			if (ring->mhi_chan_direction == MHI_CHAN_TYPE_INBOUND) {
3890 				/* Save m_data as upper layers use m_adj(9) */
3891 				void *o_data = xfer->m->m_data;
3892 
3893 				/* Pass mbuf to upper layers */
3894 				qwx_qrtr_recv_msg(sc, xfer->m);
3895 
3896 				/* Reset RX mbuf instead of free/alloc */
3897 				KASSERT(xfer->m->m_next == NULL);
3898 				xfer->m->m_data = o_data;
3899 				xfer->m->m_len = xfer->m->m_pkthdr.len =
3900 				    QWX_PCI_XFER_MAX_DATA_SIZE;
3901 
3902 				paddr = xfer->map->dm_segs[0].ds_addr;
3903 
3904 				e->ptr = htole64(paddr);
3905 				e->dword[0] = htole32((
3906 				    QWX_PCI_XFER_MAX_DATA_SIZE <<
3907 				    MHI_TRE0_DATA_LEN_SHFT) &
3908 				    MHI_TRE0_DATA_LEN_MASK);
3909 				e->dword[1] = htole32(MHI_TRE1_DATA_IEOT |
3910 				    MHI_TRE1_DATA_BEI |
3911 				    MHI_TRE1_DATA_TYPE_TRANSFER <<
3912 				    MHI_TRE1_DATA_TYPE_SHIFT);
3913 
3914 				if (ring->wp + sizeof(*e) >= base + ring->size)
3915 					ring->wp = base;
3916 				else
3917 					ring->wp += sizeof(*e);
3918 			} else {
3919 				/* Unload and free TX mbuf */
3920 				bus_dmamap_unload(sc->sc_dmat, xfer->map);
3921 				m_freem(xfer->m);
3922 				xfer->m = NULL;
3923 				ring->queued--;
3924 			}
3925 
3926 			if (ring->rp + sizeof(*e) >= base + ring->size)
3927 				ring->rp = base;
3928 			else
3929 				ring->rp += sizeof(*e);
3930 		}
3931 
3932 		if (ring->mhi_chan_direction == MHI_CHAN_TYPE_INBOUND) {
3933 			ring->chan_ctxt->wp = htole64(ring->wp);
3934 
3935 			bus_dmamap_sync(sc->sc_dmat,
3936 			    QWX_DMA_MAP(psc->chan_ctxt), 0,
3937 			    QWX_DMA_LEN(psc->chan_ctxt),
3938 			    BUS_DMASYNC_PREWRITE);
3939 
3940 			qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
3941 		}
3942 		break;
3943 	default:
3944 		printf("%s: unhandled event code 0x%x\n",
3945 		    __func__, code);
3946 	}
3947 }
3948 
3949 int
3950 qwx_pci_intr_data_event(struct qwx_pci_softc *psc, struct qwx_pci_event_ring *ring)
3951 {
3952 	struct qwx_softc *sc = &psc->sc_sc;
3953 	struct qwx_mhi_event_ctxt *c;
3954 	uint64_t rp, wp, base;
3955 	struct qwx_mhi_ring_element *e;
3956 	uint32_t tre0, tre1, type, code, chid, len;
3957 
3958 	c = ring->event_ctxt;
3959 	if (c == NULL) {
3960 		/*
3961 		 * Interrupts can trigger before mhi_init_event_rings()
3962 		 * if the device is still active after a warm reboot.
3963 		 */
3964 		return 0;
3965 	}
3966 
3967 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->event_ctxt), 0,
3968 	    QWX_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_POSTREAD);
3969 
3970 	rp = le64toh(c->rp);
3971 	wp = le64toh(c->wp);
3972 
3973 	DNPRINTF(QWX_D_MHI, "%s: kernel rp=0x%llx\n", __func__, ring->rp);
3974 	DNPRINTF(QWX_D_MHI, "%s: device rp=0x%llx\n", __func__, rp);
3975 	DNPRINTF(QWX_D_MHI, "%s: kernel wp=0x%llx\n", __func__, ring->wp);
3976 	DNPRINTF(QWX_D_MHI, "%s: device wp=0x%llx\n", __func__, wp);
3977 
3978 	base = QWX_DMA_DVA(ring->dmamem);
3979 	if (ring->rp == rp || rp < base || rp >= base + ring->size)
3980 		return 0;
3981 
3982 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(ring->dmamem),
3983 	    0, QWX_DMA_LEN(ring->dmamem), BUS_DMASYNC_POSTREAD);
3984 
3985 	while (ring->rp != rp) {
3986 		e = qwx_pci_event_ring_get_elem(ring, ring->rp);
3987 		if (e == NULL)
3988 			return 0;
3989 
3990 		tre0 = le32toh(e->dword[0]);
3991 		tre1 = le32toh(e->dword[1]);
3992 
3993 		len = (tre0 & MHI_TRE0_EV_LEN_MASK) >> MHI_TRE0_EV_LEN_SHFT;
3994 		code = (tre0 & MHI_TRE0_EV_CODE_MASK) >> MHI_TRE0_EV_CODE_SHFT;
3995 		type = (tre1 & MHI_TRE1_EV_TYPE_MASK) >> MHI_TRE1_EV_TYPE_SHFT;
3996 		chid = (tre1 & MHI_TRE1_EV_CHID_MASK) >> MHI_TRE1_EV_CHID_SHFT;
3997 		DNPRINTF(QWX_D_MHI, "%s: len=%u code=0x%x type=0x%x chid=%d\n",
3998 		    __func__, len, code, type, chid);
3999 
4000 		switch (type) {
4001 		case MHI_PKT_TYPE_TX_EVENT:
4002 			qwx_pci_intr_data_event_tx(psc, e);
4003 			break;
4004 		default:
4005 			printf("%s: unhandled event type 0x%x\n",
4006 			    __func__, type);
4007 			break;
4008 		}
4009 
4010 		if (ring->rp + sizeof(*e) >= base + ring->size)
4011 			ring->rp = base;
4012 		else
4013 			ring->rp += sizeof(*e);
4014 
4015 		if (ring->wp + sizeof(*e) >= base + ring->size)
4016 			ring->wp = base;
4017 		else
4018 			ring->wp += sizeof(*e);
4019 	}
4020 
4021 	c->wp = htole64(ring->wp);
4022 
4023 	bus_dmamap_sync(sc->sc_dmat, QWX_DMA_MAP(psc->event_ctxt), 0,
4024 	    QWX_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_PREWRITE);
4025 
4026 	qwx_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
4027 	return 1;
4028 }
4029 
4030 int
4031 qwx_pci_intr_mhi_ctrl(void *arg)
4032 {
4033 	struct qwx_pci_softc *psc = arg;
4034 
4035 	if (qwx_pci_intr_ctrl_event(psc, &psc->event_rings[0]))
4036 		return 1;
4037 
4038 	return 0;
4039 }
4040 
4041 int
4042 qwx_pci_intr_mhi_data(void *arg)
4043 {
4044 	struct qwx_pci_softc *psc = arg;
4045 
4046 	if (qwx_pci_intr_data_event(psc, &psc->event_rings[1]))
4047 		return 1;
4048 
4049 	return 0;
4050 }
4051 
4052 int
4053 qwx_pci_intr(void *arg)
4054 {
4055 	struct qwx_pci_softc *psc = arg;
4056 	struct qwx_softc *sc = (void *)psc;
4057 	uint32_t ee, state;
4058 	int ret = 0;
4059 
4060 	/*
4061 	 * Interrupts can trigger before mhi_start() during boot if the device
4062 	 * is still active after a warm reboot.
4063 	 */
4064 	if (psc->bhi_off == 0)
4065 		psc->bhi_off = qwx_pci_read(sc, MHI_BHI_OFFSET);
4066 
4067 	ee = qwx_pci_read(sc, psc->bhi_off + MHI_BHI_EXECENV);
4068 	state = qwx_pci_read(sc, MHI_STATUS);
4069 	state = (state & MHI_STATUS_MHISTATE_MASK) >>
4070 	    MHI_STATUS_MHISTATE_SHFT;
4071 
4072 	DNPRINTF(QWX_D_MHI,
4073 	    "%s: BHI interrupt with EE: 0x%x -> 0x%x state: 0x%x -> 0x%x\n",
4074 	     sc->sc_dev.dv_xname, psc->bhi_ee, ee, psc->mhi_state, state);
4075 
4076 	if (ee == MHI_EE_RDDM) {
4077 		psc->bhi_ee = ee;
4078 		if (!psc->rddm_triggered) {
4079 			task_add(systq, &psc->rddm_task);
4080 			psc->rddm_triggered = 1;
4081 		}
4082 		return 1;
4083 	} else if (psc->bhi_ee == MHI_EE_PBL || psc->bhi_ee == MHI_EE_SBL) {
4084 		int new_ee = -1, new_mhi_state = -1;
4085 
4086 		if (psc->bhi_ee != ee)
4087 			new_ee = ee;
4088 
4089 		if (psc->mhi_state != state)
4090 			new_mhi_state = state;
4091 
4092 		if (new_ee != -1 || new_mhi_state != -1)
4093 			qwx_mhi_state_change(psc, new_ee, new_mhi_state);
4094 
4095 		ret = 1;
4096 	}
4097 
4098 	if (!test_bit(ATH11K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags)) {
4099 		int i;
4100 
4101 		if (qwx_pci_intr_ctrl_event(psc, &psc->event_rings[0]))
4102 			ret = 1;
4103 		if (qwx_pci_intr_data_event(psc, &psc->event_rings[1]))
4104 			ret = 1;
4105 
4106 		for (i = 0; i < sc->hw_params.ce_count; i++) {
4107 			struct qwx_ce_pipe *ce_pipe = &sc->ce.ce_pipe[i];
4108 
4109 			if (qwx_ce_intr(ce_pipe))
4110 				ret = 1;
4111 		}
4112 
4113 		for (i = 0; i < nitems(sc->ext_irq_grp); i++) {
4114 			if (qwx_dp_service_srng(sc, i))
4115 				ret = 1;
4116 		}
4117 	}
4118 
4119 	return ret;
4120 }
4121