xref: /openbsd-src/sys/dev/pci/if_qwz_pci.c (revision 7c0ec4b8992567abb1e1536622dc789a9a39d9f1)
1 /*	$OpenBSD: if_qwz_pci.c,v 1.4 2024/08/20 21:24:15 patrick Exp $	*/
2 
3 /*
4  * Copyright 2023 Stefan Sperling <stsp@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 /*
20  * Copyright (c) 2021-2022, Qualcomm Innovation Center, Inc.
21  * Copyright (c) 2018-2021 The Linux Foundation.
22  * All rights reserved.
23  *
24  * Redistribution and use in source and binary forms, with or without
25  * modification, are permitted (subject to the limitations in the disclaimer
26  * below) provided that the following conditions are met:
27  *
28  *  * Redistributions of source code must retain the above copyright notice,
29  *    this list of conditions and the following disclaimer.
30  *
31  *  * Redistributions in binary form must reproduce the above copyright
32  *    notice, this list of conditions and the following disclaimer in the
33  *    documentation and/or other materials provided with the distribution.
34  *
35  *  * Neither the name of [Owner Organization] nor the names of its
36  *    contributors may be used to endorse or promote products derived from
37  *    this software without specific prior written permission.
38  *
39  * NO EXPRESS OR IMPLIED LICENSES TO ANY PARTY'S PATENT RIGHTS ARE GRANTED BY
40  * THIS LICENSE. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
41  * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT
42  * NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
43  * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER
44  * OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
45  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
46  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
47  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
48  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
49  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
50  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
51  */
52 
53 #include "bpfilter.h"
54 
55 #include <sys/param.h>
56 #include <sys/mbuf.h>
57 #include <sys/lock.h>
58 #include <sys/socket.h>
59 #include <sys/systm.h>
60 #include <sys/malloc.h>
61 #include <sys/device.h>
62 #include <sys/endian.h>
63 
64 #include <machine/bus.h>
65 #include <machine/intr.h>
66 
67 #include <net/if.h>
68 #include <net/if_media.h>
69 
70 #include <netinet/in.h>
71 #include <netinet/if_ether.h>
72 
73 #include <net80211/ieee80211_var.h>
74 #include <net80211/ieee80211_radiotap.h>
75 
76 #include <dev/pci/pcireg.h>
77 #include <dev/pci/pcivar.h>
78 #include <dev/pci/pcidevs.h>
79 
80 /* XXX linux porting goo */
81 #ifdef __LP64__
82 #define BITS_PER_LONG		64
83 #else
84 #define BITS_PER_LONG		32
85 #endif
86 #define GENMASK(h, l) (((~0UL) >> (BITS_PER_LONG - (h) - 1)) & ((~0UL) << (l)))
87 #define __bf_shf(x) (__builtin_ffsll(x) - 1)
88 #define FIELD_GET(_m, _v) ((typeof(_m))(((_v) & (_m)) >> __bf_shf(_m)))
89 #define BIT(x)               (1UL << (x))
90 #define test_bit(i, a)  ((a) & (1 << (i)))
91 #define clear_bit(i, a) ((a)) &= ~(1 << (i))
92 #define set_bit(i, a)   ((a)) |= (1 << (i))
93 
94 /* #define QWZ_DEBUG */
95 
96 #include <dev/ic/qwzreg.h>
97 #include <dev/ic/qwzvar.h>
98 
99 #ifdef QWZ_DEBUG
100 /* Headers needed for RDDM dump */
101 #include <sys/namei.h>
102 #include <sys/pledge.h>
103 #include <sys/vnode.h>
104 #include <sys/fcntl.h>
105 #include <sys/stat.h>
106 #include <sys/proc.h>
107 #endif
108 
109 #define ATH12K_PCI_IRQ_CE0_OFFSET	3
110 #define ATH12K_PCI_IRQ_DP_OFFSET	14
111 
112 #define ATH12K_PCI_CE_WAKE_IRQ		2
113 
114 #define ATH12K_PCI_WINDOW_ENABLE_BIT	0x40000000
115 #define ATH12K_PCI_WINDOW_REG_ADDRESS	0x310c
116 #define ATH12K_PCI_WINDOW_VALUE_MASK	GENMASK(24, 19)
117 #define ATH12K_PCI_WINDOW_START		0x80000
118 #define ATH12K_PCI_WINDOW_RANGE_MASK	GENMASK(18, 0)
119 #define ATH12K_PCI_WINDOW_STATIC_MASK	GENMASK(31, 6)
120 
121 /* BAR0 + 4k is always accessible, and no need to force wakeup. */
122 #define ATH12K_PCI_ACCESS_ALWAYS_OFF	0xFE0	/* 4K - 32 = 0xFE0 */
123 
124 #define TCSR_SOC_HW_VERSION		0x1b00000
125 #define TCSR_SOC_HW_VERSION_MAJOR_MASK	GENMASK(11, 8)
126 #define TCSR_SOC_HW_VERSION_MINOR_MASK	GENMASK(7, 0)
127 
128 /*
129  * pci.h
130  */
131 #define PCIE_SOC_GLOBAL_RESET			0x3008
132 #define PCIE_SOC_GLOBAL_RESET_V			1
133 
134 #define WLAON_WARM_SW_ENTRY			0x1f80504
135 #define WLAON_SOC_RESET_CAUSE_REG		0x01f8060c
136 
137 #define PCIE_Q6_COOKIE_ADDR			0x01f80500
138 #define PCIE_Q6_COOKIE_DATA			0xc0000000
139 
140 /* register to wake the UMAC from power collapse */
141 #define PCIE_SCRATCH_0_SOC_PCIE_REG		0x4040
142 
143 /* register used for handshake mechanism to validate UMAC is awake */
144 #define PCIE_SOC_WAKE_PCIE_LOCAL_REG		0x3004
145 
146 #define PCIE_PCIE_PARF_LTSSM			0x1e081b0
147 #define PARM_LTSSM_VALUE			0x111
148 
149 #define GCC_GCC_PCIE_HOT_RST			0x1e38338
150 #define GCC_GCC_PCIE_HOT_RST_VAL		0x10
151 
152 #define PCIE_PCIE_INT_ALL_CLEAR			0x1e08228
153 #define PCIE_SMLH_REQ_RST_LINK_DOWN		0x2
154 #define PCIE_INT_CLEAR_ALL			0xffffffff
155 
156 #define PCIE_QSERDES_COM_SYSCLK_EN_SEL_REG(sc) \
157 		(sc->hw_params.regs->pcie_qserdes_sysclk_en_sel)
158 #define PCIE_QSERDES_COM_SYSCLK_EN_SEL_VAL	0x10
159 #define PCIE_QSERDES_COM_SYSCLK_EN_SEL_MSK	0xffffffff
160 #define PCIE_PCS_OSC_DTCT_CONFIG1_REG(sc) \
161 		(sc->hw_params.regs->pcie_pcs_osc_dtct_config_base)
162 #define PCIE_PCS_OSC_DTCT_CONFIG1_VAL		0x02
163 #define PCIE_PCS_OSC_DTCT_CONFIG2_REG(sc) \
164 		(sc->hw_params.regs->pcie_pcs_osc_dtct_config_base + 0x4)
165 #define PCIE_PCS_OSC_DTCT_CONFIG2_VAL		0x52
166 #define PCIE_PCS_OSC_DTCT_CONFIG4_REG(sc) \
167 		(sc->hw_params.regs->pcie_pcs_osc_dtct_config_base + 0xc)
168 #define PCIE_PCS_OSC_DTCT_CONFIG4_VAL		0xff
169 #define PCIE_PCS_OSC_DTCT_CONFIG_MSK		0x000000ff
170 
171 #define WLAON_QFPROM_PWR_CTRL_REG		0x01f8031c
172 #define QFPROM_PWR_CTRL_VDD4BLOW_MASK		0x4
173 
174 #define PCI_MHIREGLEN_REG			0x1e0e100
175 #define PCI_MHI_REGION_END			0x1e0effc
176 
177 /*
178  * mhi.h
179  */
180 #define PCIE_TXVECDB				0x360
181 #define PCIE_TXVECSTATUS			0x368
182 #define PCIE_RXVECDB				0x394
183 #define PCIE_RXVECSTATUS			0x39C
184 
185 #define MHI_CHAN_CTX_CHSTATE_MASK		GENMASK(7, 0)
186 #define   MHI_CHAN_CTX_CHSTATE_DISABLED		0
187 #define   MHI_CHAN_CTX_CHSTATE_ENABLED		1
188 #define   MHI_CHAN_CTX_CHSTATE_RUNNING		2
189 #define   MHI_CHAN_CTX_CHSTATE_SUSPENDED	3
190 #define   MHI_CHAN_CTX_CHSTATE_STOP		4
191 #define   MHI_CHAN_CTX_CHSTATE_ERROR		5
192 #define MHI_CHAN_CTX_BRSTMODE_MASK		GENMASK(9, 8)
193 #define MHI_CHAN_CTX_BRSTMODE_SHFT		8
194 #define   MHI_CHAN_CTX_BRSTMODE_DISABLE		2
195 #define   MHI_CHAN_CTX_BRSTMODE_ENABLE		3
196 #define MHI_CHAN_CTX_POLLCFG_MASK		GENMASK(15, 10)
197 #define MHI_CHAN_CTX_RESERVED_MASK		GENMASK(31, 16)
198 
199 #define QWZ_MHI_CONFIG_QCA6390_MAX_CHANNELS	128
200 #define QWZ_MHI_CONFIG_QCA6390_TIMEOUT_MS	2000
201 #define QWZ_MHI_CONFIG_QCA9074_MAX_CHANNELS	30
202 
203 #define MHI_CHAN_TYPE_INVALID		0
204 #define MHI_CHAN_TYPE_OUTBOUND		1 /* to device */
205 #define MHI_CHAN_TYPE_INBOUND		2 /* from device */
206 #define MHI_CHAN_TYPE_INBOUND_COALESCED	3
207 
208 #define MHI_EV_CTX_RESERVED_MASK	GENMASK(7, 0)
209 #define MHI_EV_CTX_INTMODC_MASK		GENMASK(15, 8)
210 #define MHI_EV_CTX_INTMODT_MASK		GENMASK(31, 16)
211 #define MHI_EV_CTX_INTMODT_SHFT		16
212 
213 #define MHI_ER_TYPE_INVALID	0
214 #define MHI_ER_TYPE_VALID	1
215 
216 #define MHI_ER_DATA	0
217 #define MHI_ER_CTRL	1
218 
219 #define MHI_CH_STATE_DISABLED	0
220 #define MHI_CH_STATE_ENABLED	1
221 #define MHI_CH_STATE_RUNNING	2
222 #define MHI_CH_STATE_SUSPENDED	3
223 #define MHI_CH_STATE_STOP	4
224 #define MHI_CH_STATE_ERROR	5
225 
226 #define QWZ_NUM_EVENT_CTX	2
227 
228 /* Event context. Shared with device. */
229 struct qwz_mhi_event_ctxt {
230 	uint32_t intmod;
231 	uint32_t ertype;
232 	uint32_t msivec;
233 
234 	uint64_t rbase;
235 	uint64_t rlen;
236 	uint64_t rp;
237 	uint64_t wp;
238 } __packed;
239 
240 /* Channel context. Shared with device. */
241 struct qwz_mhi_chan_ctxt {
242 	uint32_t chcfg;
243 	uint32_t chtype;
244 	uint32_t erindex;
245 
246 	uint64_t rbase;
247 	uint64_t rlen;
248 	uint64_t rp;
249 	uint64_t wp;
250 } __packed;
251 
252 /* Command context. Shared with device. */
253 struct qwz_mhi_cmd_ctxt {
254 	uint32_t reserved0;
255 	uint32_t reserved1;
256 	uint32_t reserved2;
257 
258 	uint64_t rbase;
259 	uint64_t rlen;
260 	uint64_t rp;
261 	uint64_t wp;
262 } __packed;
263 
264 struct qwz_mhi_ring_element {
265 	uint64_t ptr;
266 	uint32_t dword[2];
267 };
268 
269 struct qwz_xfer_data {
270 	bus_dmamap_t	map;
271 	struct mbuf	*m;
272 };
273 
274 #define QWZ_PCI_XFER_MAX_DATA_SIZE	0xffff
275 #define QWZ_PCI_XFER_RING_MAX_ELEMENTS	64
276 
277 struct qwz_pci_xfer_ring {
278 	struct qwz_dmamem	*dmamem;
279 	bus_size_t		size;
280 	uint32_t		mhi_chan_id;
281 	uint32_t		mhi_chan_state;
282 	uint32_t		mhi_chan_direction;
283 	uint32_t		mhi_chan_event_ring_index;
284 	uint32_t		db_addr;
285 	uint32_t		cmd_status;
286 	int			num_elements;
287 	int			queued;
288 	struct qwz_xfer_data	data[QWZ_PCI_XFER_RING_MAX_ELEMENTS];
289 	uint64_t		rp;
290 	uint64_t		wp;
291 	struct qwz_mhi_chan_ctxt *chan_ctxt;
292 };
293 
294 
295 #define QWZ_PCI_EVENT_RING_MAX_ELEMENTS	256
296 
297 struct qwz_pci_event_ring {
298 	struct qwz_dmamem	*dmamem;
299 	bus_size_t		size;
300 	uint32_t		mhi_er_type;
301 	uint32_t		mhi_er_irq;
302 	uint32_t		mhi_er_irq_moderation_ms;
303 	uint32_t		db_addr;
304 	int			num_elements;
305 	uint64_t		rp;
306 	uint64_t		wp;
307 	struct qwz_mhi_event_ctxt *event_ctxt;
308 };
309 
310 struct qwz_cmd_data {
311 	bus_dmamap_t	map;
312 	struct mbuf	*m;
313 };
314 
315 #define QWZ_PCI_CMD_RING_MAX_ELEMENTS	128
316 
317 struct qwz_pci_cmd_ring {
318 	struct qwz_dmamem	*dmamem;
319 	bus_size_t		size;
320 	uint64_t		rp;
321 	uint64_t		wp;
322 	int			num_elements;
323 	int			queued;
324 };
325 
326 struct qwz_pci_ops;
327 struct qwz_msi_config;
328 
329 #define QWZ_NUM_MSI_VEC	32
330 
331 struct qwz_pci_softc {
332 	struct qwz_softc	sc_sc;
333 	pci_chipset_tag_t	sc_pc;
334 	pcitag_t		sc_tag;
335 	int			sc_cap_off;
336 	int			sc_msi_off;
337 	pcireg_t		sc_msi_cap;
338 	void			*sc_ih[QWZ_NUM_MSI_VEC];
339 	char			sc_ivname[QWZ_NUM_MSI_VEC][16];
340 	struct qwz_ext_irq_grp	ext_irq_grp[ATH12K_EXT_IRQ_GRP_NUM_MAX];
341 	int			mhi_irq[2];
342 	bus_space_tag_t		sc_st;
343 	bus_space_handle_t	sc_sh;
344 	bus_addr_t		sc_map;
345 	bus_size_t		sc_mapsize;
346 
347 	pcireg_t		sc_lcsr;
348 	uint32_t		sc_flags;
349 #define ATH12K_PCI_ASPM_RESTORE	1
350 
351 	uint32_t		register_window;
352 	const struct qwz_pci_ops *sc_pci_ops;
353 
354 	uint32_t		 bhi_off;
355 	uint32_t		 bhi_ee;
356 	uint32_t		 bhie_off;
357 	uint32_t		 mhi_state;
358 	uint32_t		 max_chan;
359 
360 	uint64_t		 wake_db;
361 
362 	/*
363 	 * DMA memory for AMSS.bin firmware image.
364 	 * This memory must remain available to the device until
365 	 * the device is powered down.
366 	 */
367 	struct qwz_dmamem	*amss_data;
368 	struct qwz_dmamem	*amss_vec;
369 
370 	struct qwz_dmamem	 *rddm_vec;
371 	struct qwz_dmamem	 *rddm_data;
372 	int			 rddm_triggered;
373 	struct task		 rddm_task;
374 #define	QWZ_RDDM_DUMP_SIZE	0x420000
375 
376 	struct qwz_dmamem	*chan_ctxt;
377 	struct qwz_dmamem	*event_ctxt;
378 	struct qwz_dmamem	*cmd_ctxt;
379 
380 
381 	struct qwz_pci_xfer_ring xfer_rings[2];
382 #define QWZ_PCI_XFER_RING_IPCR_OUTBOUND		0
383 #define QWZ_PCI_XFER_RING_IPCR_INBOUND		1
384 	struct qwz_pci_event_ring event_rings[QWZ_NUM_EVENT_CTX];
385 	struct qwz_pci_cmd_ring cmd_ring;
386 };
387 
388 int	qwz_pci_match(struct device *, void *, void *);
389 void	qwz_pci_attach(struct device *, struct device *, void *);
390 int	qwz_pci_detach(struct device *, int);
391 void	qwz_pci_attach_hook(struct device *);
392 void	qwz_pci_free_xfer_rings(struct qwz_pci_softc *);
393 int	qwz_pci_alloc_xfer_ring(struct qwz_softc *, struct qwz_pci_xfer_ring *,
394 	    uint32_t, uint32_t, uint32_t, size_t);
395 int	qwz_pci_alloc_xfer_rings_qca6390(struct qwz_pci_softc *);
396 int	qwz_pci_alloc_xfer_rings_qcn9074(struct qwz_pci_softc *);
397 void	qwz_pci_free_event_rings(struct qwz_pci_softc *);
398 int	qwz_pci_alloc_event_ring(struct qwz_softc *,
399 	    struct qwz_pci_event_ring *, uint32_t, uint32_t, uint32_t, size_t);
400 int	qwz_pci_alloc_event_rings(struct qwz_pci_softc *);
401 void	qwz_pci_free_cmd_ring(struct qwz_pci_softc *);
402 int	qwz_pci_init_cmd_ring(struct qwz_softc *, struct qwz_pci_cmd_ring *);
403 uint32_t qwz_pci_read(struct qwz_softc *, uint32_t);
404 void	qwz_pci_write(struct qwz_softc *, uint32_t, uint32_t);
405 
406 void	qwz_pci_read_hw_version(struct qwz_softc *, uint32_t *, uint32_t *);
407 uint32_t qwz_pcic_read32(struct qwz_softc *, uint32_t);
408 void	 qwz_pcic_write32(struct qwz_softc *, uint32_t, uint32_t);
409 
410 void	qwz_pcic_ext_irq_enable(struct qwz_softc *);
411 void	qwz_pcic_ext_irq_disable(struct qwz_softc *);
412 int	qwz_pcic_config_irq(struct qwz_softc *, struct pci_attach_args *);
413 
414 int	qwz_pci_start(struct qwz_softc *);
415 void	qwz_pci_stop(struct qwz_softc *);
416 void	qwz_pci_aspm_disable(struct qwz_softc *);
417 void	qwz_pci_aspm_restore(struct qwz_softc *);
418 int	qwz_pci_power_up(struct qwz_softc *);
419 void	qwz_pci_power_down(struct qwz_softc *);
420 
421 int	qwz_pci_bus_wake_up(struct qwz_softc *);
422 void	qwz_pci_bus_release(struct qwz_softc *);
423 void	qwz_pci_window_write32(struct qwz_softc *, uint32_t, uint32_t);
424 uint32_t qwz_pci_window_read32(struct qwz_softc *, uint32_t);
425 
426 int	qwz_mhi_register(struct qwz_softc *);
427 void	qwz_mhi_unregister(struct qwz_softc *);
428 void	qwz_mhi_ring_doorbell(struct qwz_softc *sc, uint64_t, uint64_t);
429 void	qwz_mhi_device_wake(struct qwz_softc *);
430 void	qwz_mhi_device_zzz(struct qwz_softc *);
431 int	qwz_mhi_wake_db_clear_valid(struct qwz_softc *);
432 void	qwz_mhi_init_xfer_rings(struct qwz_pci_softc *);
433 void	qwz_mhi_init_event_rings(struct qwz_pci_softc *);
434 void	qwz_mhi_init_cmd_ring(struct qwz_pci_softc *);
435 void	qwz_mhi_init_dev_ctxt(struct qwz_pci_softc *);
436 int	qwz_mhi_send_cmd(struct qwz_pci_softc *psc, uint32_t, uint32_t);
437 void *	qwz_pci_xfer_ring_get_elem(struct qwz_pci_xfer_ring *, uint64_t);
438 struct qwz_xfer_data *qwz_pci_xfer_ring_get_data(struct qwz_pci_xfer_ring *,
439 	    uint64_t);
440 int	qwz_mhi_submit_xfer(struct qwz_softc *sc, struct mbuf *m);
441 int	qwz_mhi_start_channel(struct qwz_pci_softc *,
442 	    struct qwz_pci_xfer_ring *);
443 int	qwz_mhi_start_channels(struct qwz_pci_softc *);
444 int	qwz_mhi_start(struct qwz_pci_softc *);
445 void	qwz_mhi_stop(struct qwz_softc *);
446 int	qwz_mhi_reset_device(struct qwz_softc *, int);
447 void	qwz_mhi_clear_vector(struct qwz_softc *);
448 int	qwz_mhi_fw_load_handler(struct qwz_pci_softc *);
449 int	qwz_mhi_await_device_reset(struct qwz_softc *);
450 int	qwz_mhi_await_device_ready(struct qwz_softc *);
451 void	qwz_mhi_ready_state_transition(struct qwz_pci_softc *);
452 void	qwz_mhi_mission_mode_state_transition(struct qwz_pci_softc *);
453 void	qwz_mhi_low_power_mode_state_transition(struct qwz_pci_softc *);
454 void	qwz_mhi_set_state(struct qwz_softc *, uint32_t);
455 void	qwz_mhi_init_mmio(struct qwz_pci_softc *);
456 int	qwz_mhi_fw_load_bhi(struct qwz_pci_softc *, uint8_t *, size_t);
457 int	qwz_mhi_fw_load_bhie(struct qwz_pci_softc *, uint8_t *, size_t);
458 void	qwz_rddm_prepare(struct qwz_pci_softc *);
459 #ifdef QWZ_DEBUG
460 void	qwz_rddm_task(void *);
461 #endif
462 void *	qwz_pci_event_ring_get_elem(struct qwz_pci_event_ring *, uint64_t);
463 void	qwz_pci_intr_ctrl_event_mhi(struct qwz_pci_softc *, uint32_t);
464 void	qwz_pci_intr_ctrl_event_ee(struct qwz_pci_softc *, uint32_t);
465 void	qwz_pci_intr_ctrl_event_cmd_complete(struct qwz_pci_softc *,
466 	    uint64_t, uint32_t);
467 int	qwz_pci_intr_ctrl_event(struct qwz_pci_softc *,
468 	    struct qwz_pci_event_ring *);
469 void	qwz_pci_intr_data_event_tx(struct qwz_pci_softc *,
470 	    struct qwz_mhi_ring_element *);
471 int	qwz_pci_intr_data_event(struct qwz_pci_softc *,
472 	    struct qwz_pci_event_ring *);
473 int	qwz_pci_intr_mhi_ctrl(void *);
474 int	qwz_pci_intr_mhi_data(void *);
475 int	qwz_pci_intr(void *);
476 
477 struct qwz_pci_ops {
478 	int	 (*wakeup)(struct qwz_softc *);
479 	void	 (*release)(struct qwz_softc *);
480 	int	 (*get_msi_irq)(struct qwz_softc *, unsigned int);
481 	void	 (*window_write32)(struct qwz_softc *, uint32_t, uint32_t);
482 	uint32_t (*window_read32)(struct qwz_softc *, uint32_t);
483 	int	 (*alloc_xfer_rings)(struct qwz_pci_softc *);
484 };
485 
486 
487 static const struct qwz_pci_ops qwz_pci_ops_wcn7850 = {
488 	.wakeup = qwz_pci_bus_wake_up,
489 	.release = qwz_pci_bus_release,
490 	.window_write32 = qwz_pci_window_write32,
491 	.window_read32 = qwz_pci_window_read32,
492 	.alloc_xfer_rings = qwz_pci_alloc_xfer_rings_qca6390,
493 };
494 
495 const struct cfattach qwz_pci_ca = {
496 	sizeof(struct qwz_pci_softc),
497 	qwz_pci_match,
498 	qwz_pci_attach,
499 	qwz_pci_detach,
500 	qwz_activate
501 };
502 
503 static const struct pci_matchid qwz_pci_devices[] = {
504 	{ PCI_VENDOR_QUALCOMM, PCI_PRODUCT_QUALCOMM_WCN7850 }
505 };
506 
507 int
508 qwz_pci_match(struct device *parent, void *match, void *aux)
509 {
510 	return pci_matchbyid(aux, qwz_pci_devices, nitems(qwz_pci_devices));
511 }
512 
513 void
514 qwz_pci_init_qmi_ce_config(struct qwz_softc *sc)
515 {
516 	struct qwz_qmi_ce_cfg *cfg = &sc->qmi_ce_cfg;
517 
518 	qwz_ce_get_shadow_config(sc, &cfg->shadow_reg_v3,
519 	    &cfg->shadow_reg_v3_len);
520 }
521 
522 const struct qwz_msi_config qwz_msi_config_one_msi = {
523 	.total_vectors = 1,
524 	.total_users = 4,
525 	.users = (struct qwz_msi_user[]) {
526 		{ .name = "MHI", .num_vectors = 1, .base_vector = 0 },
527 		{ .name = "CE", .num_vectors = 1, .base_vector = 0 },
528 		{ .name = "WAKE", .num_vectors = 1, .base_vector = 0 },
529 		{ .name = "DP", .num_vectors = 1, .base_vector = 0 },
530 	},
531 };
532 
533 const struct qwz_msi_config qwz_msi_config[] = {
534 	{
535 		.total_vectors = 16,
536 		.total_users = 3,
537 		.users = (struct qwz_msi_user[]) {
538 			{ .name = "MHI", .num_vectors = 3, .base_vector = 0 },
539 			{ .name = "CE", .num_vectors = 5, .base_vector = 3 },
540 			{ .name = "DP", .num_vectors = 8, .base_vector = 8 },
541 		},
542 		.hw_rev = ATH12K_HW_WCN7850_HW20,
543 	},
544 };
545 
546 int
547 qwz_pcic_init_msi_config(struct qwz_softc *sc)
548 {
549 	const struct qwz_msi_config *msi_config;
550 	int i;
551 
552 	if (!test_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags)) {
553 		sc->msi_cfg = &qwz_msi_config_one_msi;
554 		return 0;
555 	}
556 	for (i = 0; i < nitems(qwz_msi_config); i++) {
557 		msi_config = &qwz_msi_config[i];
558 
559 		if (msi_config->hw_rev == sc->sc_hw_rev)
560 			break;
561 	}
562 
563 	if (i == nitems(qwz_msi_config)) {
564 		printf("%s: failed to fetch msi config, "
565 		    "unsupported hw version: 0x%x\n",
566 		    sc->sc_dev.dv_xname, sc->sc_hw_rev);
567 		return EINVAL;
568 	}
569 
570 	sc->msi_cfg = msi_config;
571 	return 0;
572 }
573 
574 int
575 qwz_pci_alloc_msi(struct qwz_softc *sc)
576 {
577 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
578 	uint64_t addr;
579 	pcireg_t data;
580 
581 	if (psc->sc_msi_cap & PCI_MSI_MC_C64) {
582 		uint64_t addr_hi;
583 		pcireg_t addr_lo;
584 
585 		addr_lo = pci_conf_read(psc->sc_pc, psc->sc_tag,
586 		    psc->sc_msi_off + PCI_MSI_MA);
587 		addr_hi = pci_conf_read(psc->sc_pc, psc->sc_tag,
588 		    psc->sc_msi_off + PCI_MSI_MAU32);
589 		addr = addr_hi << 32 | addr_lo;
590 		data = pci_conf_read(psc->sc_pc, psc->sc_tag,
591 		    psc->sc_msi_off + PCI_MSI_MD64);
592 	} else {
593 		addr = pci_conf_read(psc->sc_pc, psc->sc_tag,
594 		    psc->sc_msi_off + PCI_MSI_MA);
595 		data = pci_conf_read(psc->sc_pc, psc->sc_tag,
596 		    psc->sc_msi_off + PCI_MSI_MD32);
597 	}
598 
599 	sc->msi_addr_lo = addr & 0xffffffff;
600 	sc->msi_addr_hi = ((uint64_t)addr) >> 32;
601 	sc->msi_data_start = data;
602 
603 	DPRINTF("%s: MSI addr: 0x%llx MSI data: 0x%x\n", sc->sc_dev.dv_xname,
604 	    addr, data);
605 
606 	return 0;
607 }
608 
609 int
610 qwz_pcic_map_service_to_pipe(struct qwz_softc *sc, uint16_t service_id,
611     uint8_t *ul_pipe, uint8_t *dl_pipe)
612 {
613 	const struct service_to_pipe *entry;
614 	int ul_set = 0, dl_set = 0;
615 	int i;
616 
617 	for (i = 0; i < sc->hw_params.svc_to_ce_map_len; i++) {
618 		entry = &sc->hw_params.svc_to_ce_map[i];
619 
620 		if (le32toh(entry->service_id) != service_id)
621 			continue;
622 
623 		switch (le32toh(entry->pipedir)) {
624 		case PIPEDIR_NONE:
625 			break;
626 		case PIPEDIR_IN:
627 			*dl_pipe = le32toh(entry->pipenum);
628 			dl_set = 1;
629 			break;
630 		case PIPEDIR_OUT:
631 			*ul_pipe = le32toh(entry->pipenum);
632 			ul_set = 1;
633 			break;
634 		case PIPEDIR_INOUT:
635 			*dl_pipe = le32toh(entry->pipenum);
636 			*ul_pipe = le32toh(entry->pipenum);
637 			dl_set = 1;
638 			ul_set = 1;
639 			break;
640 		}
641 	}
642 
643 	if (!ul_set || !dl_set) {
644 		DPRINTF("%s: found no uplink and no downlink\n", __func__);
645 		return ENOENT;
646 	}
647 
648 	return 0;
649 }
650 
651 int
652 qwz_pcic_get_user_msi_vector(struct qwz_softc *sc, char *user_name,
653     int *num_vectors, uint32_t *user_base_data, uint32_t *base_vector)
654 {
655 	const struct qwz_msi_config *msi_config = sc->msi_cfg;
656 	int idx;
657 
658 	for (idx = 0; idx < msi_config->total_users; idx++) {
659 		if (strcmp(user_name, msi_config->users[idx].name) == 0) {
660 			*num_vectors = msi_config->users[idx].num_vectors;
661 			*base_vector =  msi_config->users[idx].base_vector;
662 			*user_base_data = *base_vector + sc->msi_data_start;
663 
664 			DPRINTF("%s: MSI assignment %s num_vectors %d "
665 			    "user_base_data %u base_vector %u\n", __func__,
666 			    user_name, *num_vectors, *user_base_data,
667 			    *base_vector);
668 			return 0;
669 		}
670 	}
671 
672 	DPRINTF("%s: Failed to find MSI assignment for %s\n",
673 	    sc->sc_dev.dv_xname, user_name);
674 
675 	return EINVAL;
676 }
677 
678 void
679 qwz_pci_attach(struct device *parent, struct device *self, void *aux)
680 {
681 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)self;
682 	struct qwz_softc *sc = &psc->sc_sc;
683 	struct ieee80211com *ic = &sc->sc_ic;
684 	struct ifnet *ifp = &ic->ic_if;
685 	uint32_t soc_hw_version_major, soc_hw_version_minor;
686 	struct pci_attach_args *pa = aux;
687 	pci_intr_handle_t ih;
688 	pcireg_t memtype, reg;
689 	const char *intrstr;
690 	int error;
691 	pcireg_t sreg;
692 
693 	sc->sc_dmat = pa->pa_dmat;
694 	psc->sc_pc = pa->pa_pc;
695 	psc->sc_tag = pa->pa_tag;
696 
697 #ifdef __HAVE_FDT
698 	sc->sc_node = PCITAG_NODE(pa->pa_tag);
699 #endif
700 
701 	rw_init(&sc->ioctl_rwl, "qwzioctl");
702 
703 	sreg = pci_conf_read(psc->sc_pc, psc->sc_tag, PCI_SUBSYS_ID_REG);
704 	sc->id.bdf_search = ATH12K_BDF_SEARCH_DEFAULT;
705 	sc->id.vendor = PCI_VENDOR(pa->pa_id);
706 	sc->id.device = PCI_PRODUCT(pa->pa_id);
707 	sc->id.subsystem_vendor = PCI_VENDOR(sreg);
708 	sc->id.subsystem_device = PCI_PRODUCT(sreg);
709 
710 	strlcpy(sc->sc_bus_str, "pci", sizeof(sc->sc_bus_str));
711 
712 	sc->ops.read32 = qwz_pcic_read32;
713 	sc->ops.write32 = qwz_pcic_write32;
714 	sc->ops.start = qwz_pci_start;
715 	sc->ops.stop = qwz_pci_stop;
716 	sc->ops.power_up = qwz_pci_power_up;
717 	sc->ops.power_down = qwz_pci_power_down;
718 	sc->ops.submit_xfer = qwz_mhi_submit_xfer;
719 	sc->ops.irq_enable = qwz_pcic_ext_irq_enable;
720 	sc->ops.irq_disable = qwz_pcic_ext_irq_disable;
721 	sc->ops.map_service_to_pipe = qwz_pcic_map_service_to_pipe;
722 	sc->ops.get_user_msi_vector = qwz_pcic_get_user_msi_vector;
723 
724 	if (pci_get_capability(psc->sc_pc, psc->sc_tag, PCI_CAP_PCIEXPRESS,
725 	    &psc->sc_cap_off, NULL) == 0) {
726 		printf(": can't find PCIe capability structure\n");
727 		return;
728 	}
729 
730 	if (pci_get_capability(psc->sc_pc, psc->sc_tag, PCI_CAP_MSI,
731 	    &psc->sc_msi_off, &psc->sc_msi_cap) == 0) {
732 		printf(": can't find MSI capability structure\n");
733 		return;
734 	}
735 
736 	reg = pci_conf_read(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG);
737 	reg |= PCI_COMMAND_MASTER_ENABLE;
738 	pci_conf_write(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG, reg);
739 
740 	memtype = pci_mapreg_type(pa->pa_pc, pa->pa_tag, PCI_MAPREG_START);
741 	if (pci_mapreg_map(pa, PCI_MAPREG_START, memtype, 0,
742 	    &psc->sc_st, &psc->sc_sh, &psc->sc_map, &psc->sc_mapsize, 0)) {
743 		printf(": can't map mem space\n");
744 		return;
745 	}
746 
747 	sc->mem = psc->sc_map;
748 
749 	sc->num_msivec = 32;
750 	if (pci_intr_enable_msivec(pa, sc->num_msivec) != 0) {
751 		sc->num_msivec = 1;
752 		if (pci_intr_map_msi(pa, &ih) != 0) {
753 			printf(": can't map interrupt\n");
754 			return;
755 		}
756 		clear_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags);
757 	} else {
758 		if (pci_intr_map_msivec(pa, 0, &ih) != 0 &&
759 		    pci_intr_map_msi(pa, &ih) != 0) {
760 			printf(": can't map interrupt\n");
761 			return;
762 		}
763 		set_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags);
764 		psc->mhi_irq[MHI_ER_CTRL] = 1;
765 		psc->mhi_irq[MHI_ER_DATA] = 2;
766 	}
767 
768 	intrstr = pci_intr_string(psc->sc_pc, ih);
769 	snprintf(psc->sc_ivname[0], sizeof(psc->sc_ivname[0]), "%s:bhi",
770 	    sc->sc_dev.dv_xname);
771 	psc->sc_ih[0] = pci_intr_establish(psc->sc_pc, ih, IPL_NET,
772 	    qwz_pci_intr, psc, psc->sc_ivname[0]);
773 	if (psc->sc_ih[0] == NULL) {
774 		printf(": can't establish interrupt");
775 		if (intrstr != NULL)
776 			printf(" at %s", intrstr);
777 		printf("\n");
778 		return;
779 	}
780 	printf(": %s\n", intrstr);
781 
782 	if (test_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags)) {
783 		int msivec;
784 
785 		msivec = psc->mhi_irq[MHI_ER_CTRL];
786 		if (pci_intr_map_msivec(pa, msivec, &ih) != 0 &&
787 		    pci_intr_map_msi(pa, &ih) != 0) {
788 			printf(": can't map interrupt\n");
789 			return;
790 		}
791 		snprintf(psc->sc_ivname[msivec],
792 		    sizeof(psc->sc_ivname[msivec]),
793 		    "%s:mhic", sc->sc_dev.dv_xname);
794 		psc->sc_ih[msivec] = pci_intr_establish(psc->sc_pc, ih,
795 		    IPL_NET, qwz_pci_intr_mhi_ctrl, psc,
796 		    psc->sc_ivname[msivec]);
797 		if (psc->sc_ih[msivec] == NULL) {
798 			printf("%s: can't establish interrupt\n",
799 			    sc->sc_dev.dv_xname);
800 			return;
801 		}
802 
803 		msivec = psc->mhi_irq[MHI_ER_DATA];
804 		if (pci_intr_map_msivec(pa, msivec, &ih) != 0 &&
805 		    pci_intr_map_msi(pa, &ih) != 0) {
806 			printf(": can't map interrupt\n");
807 			return;
808 		}
809 		snprintf(psc->sc_ivname[msivec],
810 		    sizeof(psc->sc_ivname[msivec]),
811 		    "%s:mhid", sc->sc_dev.dv_xname);
812 		psc->sc_ih[msivec] = pci_intr_establish(psc->sc_pc, ih,
813 		    IPL_NET, qwz_pci_intr_mhi_data, psc,
814 		    psc->sc_ivname[msivec]);
815 		if (psc->sc_ih[msivec] == NULL) {
816 			printf("%s: can't establish interrupt\n",
817 			    sc->sc_dev.dv_xname);
818 			return;
819 		}
820 	}
821 
822 	pci_set_powerstate(pa->pa_pc, pa->pa_tag, PCI_PMCSR_STATE_D0);
823 
824 	switch (PCI_PRODUCT(pa->pa_id)) {
825 	case PCI_PRODUCT_QUALCOMM_WCN7850:
826 		sc->static_window_map = 0;
827 		psc->sc_pci_ops = &qwz_pci_ops_wcn7850;
828 		sc->id.bdf_search = ATH12K_BDF_SEARCH_BUS_AND_BOARD;
829 		qwz_pci_read_hw_version(sc, &soc_hw_version_major,
830 		    &soc_hw_version_minor);
831 		switch (soc_hw_version_major) {
832 		case 2:
833 			sc->sc_hw_rev = ATH12K_HW_WCN7850_HW20;
834 			break;
835 		default:
836 			printf(": unknown hardware version found for WCN785: "
837 			    "%d\n", soc_hw_version_major);
838 			return;
839 		}
840 
841 		psc->max_chan = QWZ_MHI_CONFIG_QCA6390_MAX_CHANNELS;
842 		break;
843 	default:
844 		printf(": unsupported chip\n");
845 		return;
846 	}
847 
848 	error = qwz_pcic_init_msi_config(sc);
849 	if (error)
850 		goto err_pci_free_region;
851 
852 	error = qwz_pci_alloc_msi(sc);
853 	if (error) {
854 		printf("%s: failed to enable msi: %d\n", sc->sc_dev.dv_xname,
855 		    error);
856 		goto err_pci_free_region;
857 	}
858 
859 	error = qwz_init_hw_params(sc);
860 	if (error)
861 		goto err_pci_disable_msi;
862 
863 	psc->chan_ctxt = qwz_dmamem_alloc(sc->sc_dmat,
864 	    sizeof(struct qwz_mhi_chan_ctxt) * psc->max_chan, 0);
865 	if (psc->chan_ctxt == NULL) {
866 		printf("%s: could not allocate channel context array\n",
867 		    sc->sc_dev.dv_xname);
868 		goto err_pci_disable_msi;
869 	}
870 
871 	if (psc->sc_pci_ops->alloc_xfer_rings(psc)) {
872 		printf("%s: could not allocate transfer rings\n",
873 		    sc->sc_dev.dv_xname);
874 		goto err_pci_free_chan_ctxt;
875 	}
876 
877 	psc->event_ctxt = qwz_dmamem_alloc(sc->sc_dmat,
878 	    sizeof(struct qwz_mhi_event_ctxt) * QWZ_NUM_EVENT_CTX, 0);
879 	if (psc->event_ctxt == NULL) {
880 		printf("%s: could not allocate event context array\n",
881 		    sc->sc_dev.dv_xname);
882 		goto err_pci_free_xfer_rings;
883 	}
884 
885 	if (qwz_pci_alloc_event_rings(psc)) {
886 		printf("%s: could not allocate event rings\n",
887 		    sc->sc_dev.dv_xname);
888 		goto err_pci_free_event_ctxt;
889 	}
890 
891 	psc->cmd_ctxt = qwz_dmamem_alloc(sc->sc_dmat,
892 	    sizeof(struct qwz_mhi_cmd_ctxt), 0);
893 	if (psc->cmd_ctxt == NULL) {
894 		printf("%s: could not allocate command context array\n",
895 		    sc->sc_dev.dv_xname);
896 		goto err_pci_free_event_rings;
897 	}
898 
899 	if (qwz_pci_init_cmd_ring(sc, &psc->cmd_ring))  {
900 		printf("%s: could not allocate command ring\n",
901 		    sc->sc_dev.dv_xname);
902 		goto err_pci_free_cmd_ctxt;
903 	}
904 
905 	error = qwz_mhi_register(sc);
906 	if (error) {
907 		printf(": failed to register mhi: %d\n", error);
908 		goto err_pci_free_cmd_ring;
909 	}
910 
911 	error = qwz_hal_srng_init(sc);
912 	if (error)
913 		goto err_mhi_unregister;
914 
915 	error = qwz_ce_alloc_pipes(sc);
916 	if (error) {
917 		printf(": failed to allocate ce pipes: %d\n", error);
918 		goto err_hal_srng_deinit;
919 	}
920 
921 	sc->sc_nswq = taskq_create("qwzns", 1, IPL_NET, 0);
922 	if (sc->sc_nswq == NULL)
923 		goto err_ce_free;
924 
925 	error = qwz_pcic_config_irq(sc, pa);
926 	if (error) {
927 		printf("%s: failed to config irq: %d\n",
928 		    sc->sc_dev.dv_xname, error);
929 		goto err_ce_free;
930 	}
931 #if notyet
932 	ret = ath12k_pci_set_irq_affinity_hint(ab_pci, cpumask_of(0));
933 	if (ret) {
934 		ath12k_err(ab, "failed to set irq affinity %d\n", ret);
935 		goto err_free_irq;
936 	}
937 
938 	/* kernel may allocate a dummy vector before request_irq and
939 	 * then allocate a real vector when request_irq is called.
940 	 * So get msi_data here again to avoid spurious interrupt
941 	 * as msi_data will configured to srngs.
942 	 */
943 	ret = ath12k_pci_config_msi_data(ab_pci);
944 	if (ret) {
945 		ath12k_err(ab, "failed to config msi_data: %d\n", ret);
946 		goto err_irq_affinity_cleanup;
947 	}
948 #endif
949 #ifdef QWZ_DEBUG
950 	task_set(&psc->rddm_task, qwz_rddm_task, psc);
951 #endif
952 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
953 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
954 	ic->ic_state = IEEE80211_S_INIT;
955 
956 	/* Set device capabilities. */
957 	ic->ic_caps =
958 #if 0
959 	    IEEE80211_C_QOS | IEEE80211_C_TX_AMPDU | /* A-MPDU */
960 #endif
961 	    IEEE80211_C_ADDBA_OFFLOAD | /* device sends ADDBA/DELBA frames */
962 	    IEEE80211_C_WEP |		/* WEP */
963 	    IEEE80211_C_RSN |		/* WPA/RSN */
964 	    IEEE80211_C_SCANALL |	/* device scans all channels at once */
965 	    IEEE80211_C_SCANALLBAND |	/* device scans all bands at once */
966 #if 0
967 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
968 #endif
969 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
970 	    IEEE80211_C_SHPREAMBLE;	/* short preamble supported */
971 
972 	ic->ic_sup_rates[IEEE80211_MODE_11A] = ieee80211_std_rateset_11a;
973 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
974 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
975 
976 	/* IBSS channel undefined for now. */
977 	ic->ic_ibss_chan = &ic->ic_channels[1];
978 
979 	ifp->if_softc = sc;
980 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
981 	ifp->if_ioctl = qwz_ioctl;
982 	ifp->if_start = qwz_start;
983 	ifp->if_watchdog = qwz_watchdog;
984 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
985 	if_attach(ifp);
986 	ieee80211_ifattach(ifp);
987 	ieee80211_media_init(ifp, qwz_media_change, ieee80211_media_status);
988 
989 	ic->ic_node_alloc = qwz_node_alloc;
990 
991 	/* Override 802.11 state transition machine. */
992 	sc->sc_newstate = ic->ic_newstate;
993 	ic->ic_newstate = qwz_newstate;
994 	ic->ic_set_key = qwz_set_key;
995 	ic->ic_delete_key = qwz_delete_key;
996 #if 0
997 	ic->ic_updatechan = qwz_updatechan;
998 	ic->ic_updateprot = qwz_updateprot;
999 	ic->ic_updateslot = qwz_updateslot;
1000 	ic->ic_updateedca = qwz_updateedca;
1001 	ic->ic_updatedtim = qwz_updatedtim;
1002 #endif
1003 	/*
1004 	 * We cannot read the MAC address without loading the
1005 	 * firmware from disk. Postpone until mountroot is done.
1006 	 */
1007 	config_mountroot(self, qwz_pci_attach_hook);
1008 	return;
1009 
1010 err_ce_free:
1011 	qwz_ce_free_pipes(sc);
1012 err_hal_srng_deinit:
1013 err_mhi_unregister:
1014 err_pci_free_cmd_ring:
1015 	qwz_pci_free_cmd_ring(psc);
1016 err_pci_free_cmd_ctxt:
1017 	qwz_dmamem_free(sc->sc_dmat, psc->cmd_ctxt);
1018 	psc->cmd_ctxt = NULL;
1019 err_pci_free_event_rings:
1020 	qwz_pci_free_event_rings(psc);
1021 err_pci_free_event_ctxt:
1022 	qwz_dmamem_free(sc->sc_dmat, psc->event_ctxt);
1023 	psc->event_ctxt = NULL;
1024 err_pci_free_xfer_rings:
1025 	qwz_pci_free_xfer_rings(psc);
1026 err_pci_free_chan_ctxt:
1027 	qwz_dmamem_free(sc->sc_dmat, psc->chan_ctxt);
1028 	psc->chan_ctxt = NULL;
1029 err_pci_disable_msi:
1030 err_pci_free_region:
1031 	pci_intr_disestablish(psc->sc_pc, psc->sc_ih[0]);
1032 	return;
1033 }
1034 
1035 int
1036 qwz_pci_detach(struct device *self, int flags)
1037 {
1038 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)self;
1039 	struct qwz_softc *sc = &psc->sc_sc;
1040 
1041 	if (psc->sc_ih[0]) {
1042 		pci_intr_disestablish(psc->sc_pc, psc->sc_ih[0]);
1043 		psc->sc_ih[0] = NULL;
1044 	}
1045 
1046 	qwz_detach(sc);
1047 
1048 	qwz_pci_free_event_rings(psc);
1049 	qwz_pci_free_xfer_rings(psc);
1050 	qwz_pci_free_cmd_ring(psc);
1051 
1052 	if (psc->event_ctxt) {
1053 		qwz_dmamem_free(sc->sc_dmat, psc->event_ctxt);
1054 		psc->event_ctxt = NULL;
1055 	}
1056 	if (psc->chan_ctxt) {
1057 		qwz_dmamem_free(sc->sc_dmat, psc->chan_ctxt);
1058 		psc->chan_ctxt = NULL;
1059 	}
1060 	if (psc->cmd_ctxt) {
1061 		qwz_dmamem_free(sc->sc_dmat, psc->cmd_ctxt);
1062 		psc->cmd_ctxt = NULL;
1063 	}
1064 
1065 	if (psc->amss_data) {
1066 		qwz_dmamem_free(sc->sc_dmat, psc->amss_data);
1067 		psc->amss_data = NULL;
1068 	}
1069 	if (psc->amss_vec) {
1070 		qwz_dmamem_free(sc->sc_dmat, psc->amss_vec);
1071 		psc->amss_vec = NULL;
1072 	}
1073 
1074 	return 0;
1075 }
1076 
1077 void
1078 qwz_pci_attach_hook(struct device *self)
1079 {
1080 	struct qwz_softc *sc = (void *)self;
1081 	int s = splnet();
1082 
1083 	qwz_attach(sc);
1084 
1085 	splx(s);
1086 }
1087 
1088 void
1089 qwz_pci_free_xfer_rings(struct qwz_pci_softc *psc)
1090 {
1091 	struct qwz_softc *sc = &psc->sc_sc;
1092 	int i;
1093 
1094 	for (i = 0; i < nitems(psc->xfer_rings); i++) {
1095 		struct qwz_pci_xfer_ring *ring = &psc->xfer_rings[i];
1096 		if (ring->dmamem) {
1097 			qwz_dmamem_free(sc->sc_dmat, ring->dmamem);
1098 			ring->dmamem = NULL;
1099 		}
1100 		memset(ring, 0, sizeof(*ring));
1101 	}
1102 }
1103 
1104 int
1105 qwz_pci_alloc_xfer_ring(struct qwz_softc *sc, struct qwz_pci_xfer_ring *ring,
1106     uint32_t id, uint32_t direction, uint32_t event_ring_index,
1107     size_t num_elements)
1108 {
1109 	bus_size_t size;
1110 	int i, err;
1111 
1112 	memset(ring, 0, sizeof(*ring));
1113 
1114 	size = sizeof(struct qwz_mhi_ring_element) * num_elements;
1115 	/* Hardware requires that rings are aligned to ring size. */
1116 	ring->dmamem = qwz_dmamem_alloc(sc->sc_dmat, size, size);
1117 	if (ring->dmamem == NULL)
1118 		return ENOMEM;
1119 
1120 	ring->size = size;
1121 	ring->mhi_chan_id = id;
1122 	ring->mhi_chan_state = MHI_CH_STATE_DISABLED;
1123 	ring->mhi_chan_direction = direction;
1124 	ring->mhi_chan_event_ring_index = event_ring_index;
1125 	ring->num_elements = num_elements;
1126 
1127 	memset(ring->data, 0, sizeof(ring->data));
1128 	for (i = 0; i < ring->num_elements; i++) {
1129 		struct qwz_xfer_data *xfer = &ring->data[i];
1130 
1131 		err = bus_dmamap_create(sc->sc_dmat, QWZ_PCI_XFER_MAX_DATA_SIZE,
1132 		    1, QWZ_PCI_XFER_MAX_DATA_SIZE, 0, BUS_DMA_NOWAIT,
1133 		    &xfer->map);
1134 		if (err) {
1135 			printf("%s: could not create xfer DMA map\n",
1136 			    sc->sc_dev.dv_xname);
1137 			goto fail;
1138 		}
1139 
1140 		if (direction == MHI_CHAN_TYPE_INBOUND) {
1141 			struct mbuf *m;
1142 
1143 			m = m_gethdr(M_DONTWAIT, MT_DATA);
1144 			if (m == NULL) {
1145 				err = ENOBUFS;
1146 				goto fail;
1147 			}
1148 
1149 			MCLGETL(m, M_DONTWAIT, QWZ_PCI_XFER_MAX_DATA_SIZE);
1150 			if ((m->m_flags & M_EXT) == 0) {
1151 				m_freem(m);
1152 				err = ENOBUFS;
1153 				goto fail;
1154 			}
1155 
1156 			m->m_len = m->m_pkthdr.len = QWZ_PCI_XFER_MAX_DATA_SIZE;
1157 			err = bus_dmamap_load_mbuf(sc->sc_dmat, xfer->map,
1158 			    m, BUS_DMA_READ | BUS_DMA_NOWAIT);
1159 			if (err) {
1160 				printf("%s: can't map mbuf (error %d)\n",
1161 				    sc->sc_dev.dv_xname, err);
1162 				m_freem(m);
1163 				goto fail;
1164 			}
1165 
1166 			bus_dmamap_sync(sc->sc_dmat, xfer->map, 0,
1167 			    QWZ_PCI_XFER_MAX_DATA_SIZE, BUS_DMASYNC_PREREAD);
1168 			xfer->m = m;
1169 		}
1170 	}
1171 
1172 	return 0;
1173 fail:
1174 	for (i = 0; i < ring->num_elements; i++) {
1175 		struct qwz_xfer_data *xfer = &ring->data[i];
1176 
1177 		if (xfer->map) {
1178 			bus_dmamap_sync(sc->sc_dmat, xfer->map, 0,
1179 			    xfer->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
1180 			bus_dmamap_unload(sc->sc_dmat, xfer->map);
1181 			bus_dmamap_destroy(sc->sc_dmat, xfer->map);
1182 			xfer->map = NULL;
1183 		}
1184 
1185 		if (xfer->m) {
1186 			m_freem(xfer->m);
1187 			xfer->m = NULL;
1188 		}
1189 	}
1190 	return 1;
1191 }
1192 
1193 int
1194 qwz_pci_alloc_xfer_rings_qca6390(struct qwz_pci_softc *psc)
1195 {
1196 	struct qwz_softc *sc = &psc->sc_sc;
1197 	int ret;
1198 
1199 	ret = qwz_pci_alloc_xfer_ring(sc,
1200 	    &psc->xfer_rings[QWZ_PCI_XFER_RING_IPCR_OUTBOUND],
1201 	    20, MHI_CHAN_TYPE_OUTBOUND, 1, 64);
1202 	if (ret)
1203 		goto fail;
1204 
1205 	ret = qwz_pci_alloc_xfer_ring(sc,
1206 	    &psc->xfer_rings[QWZ_PCI_XFER_RING_IPCR_INBOUND],
1207 	    21, MHI_CHAN_TYPE_INBOUND, 1, 64);
1208 	if (ret)
1209 		goto fail;
1210 
1211 	return 0;
1212 fail:
1213 	qwz_pci_free_xfer_rings(psc);
1214 	return ret;
1215 }
1216 
1217 int
1218 qwz_pci_alloc_xfer_rings_qcn9074(struct qwz_pci_softc *psc)
1219 {
1220 	struct qwz_softc *sc = &psc->sc_sc;
1221 	int ret;
1222 
1223 	ret = qwz_pci_alloc_xfer_ring(sc,
1224 	    &psc->xfer_rings[QWZ_PCI_XFER_RING_IPCR_OUTBOUND],
1225 	    20, MHI_CHAN_TYPE_OUTBOUND, 1, 32);
1226 	if (ret)
1227 		goto fail;
1228 
1229 	ret = qwz_pci_alloc_xfer_ring(sc,
1230 	    &psc->xfer_rings[QWZ_PCI_XFER_RING_IPCR_INBOUND],
1231 	    21, MHI_CHAN_TYPE_INBOUND, 1, 32);
1232 	if (ret)
1233 		goto fail;
1234 
1235 	return 0;
1236 fail:
1237 	qwz_pci_free_xfer_rings(psc);
1238 	return ret;
1239 }
1240 
1241 void
1242 qwz_pci_free_event_rings(struct qwz_pci_softc *psc)
1243 {
1244 	struct qwz_softc *sc = &psc->sc_sc;
1245 	int i;
1246 
1247 	for (i = 0; i < nitems(psc->event_rings); i++) {
1248 		struct qwz_pci_event_ring *ring = &psc->event_rings[i];
1249 		if (ring->dmamem) {
1250 			qwz_dmamem_free(sc->sc_dmat, ring->dmamem);
1251 			ring->dmamem = NULL;
1252 		}
1253 		memset(ring, 0, sizeof(*ring));
1254 	}
1255 }
1256 
1257 int
1258 qwz_pci_alloc_event_ring(struct qwz_softc *sc, struct qwz_pci_event_ring *ring,
1259     uint32_t type, uint32_t irq, uint32_t intmod, size_t num_elements)
1260 {
1261 	bus_size_t size;
1262 
1263 	memset(ring, 0, sizeof(*ring));
1264 
1265 	size = sizeof(struct qwz_mhi_ring_element) * num_elements;
1266 	/* Hardware requires that rings are aligned to ring size. */
1267 	ring->dmamem = qwz_dmamem_alloc(sc->sc_dmat, size, size);
1268 	if (ring->dmamem == NULL)
1269 		return ENOMEM;
1270 
1271 	ring->size = size;
1272 	ring->mhi_er_type = type;
1273 	ring->mhi_er_irq = irq;
1274 	ring->mhi_er_irq_moderation_ms = intmod;
1275 	ring->num_elements = num_elements;
1276 	return 0;
1277 }
1278 
1279 int
1280 qwz_pci_alloc_event_rings(struct qwz_pci_softc *psc)
1281 {
1282 	struct qwz_softc *sc = &psc->sc_sc;
1283 	int ret;
1284 
1285 	ret = qwz_pci_alloc_event_ring(sc, &psc->event_rings[0],
1286 	    MHI_ER_CTRL, psc->mhi_irq[MHI_ER_CTRL], 0, 32);
1287 	if (ret)
1288 		goto fail;
1289 
1290 	ret = qwz_pci_alloc_event_ring(sc, &psc->event_rings[1],
1291 	    MHI_ER_DATA, psc->mhi_irq[MHI_ER_DATA], 1, 256);
1292 	if (ret)
1293 		goto fail;
1294 
1295 	return 0;
1296 fail:
1297 	qwz_pci_free_event_rings(psc);
1298 	return ret;
1299 }
1300 
1301 void
1302 qwz_pci_free_cmd_ring(struct qwz_pci_softc *psc)
1303 {
1304 	struct qwz_softc *sc = &psc->sc_sc;
1305 	struct qwz_pci_cmd_ring *ring = &psc->cmd_ring;
1306 
1307 	if (ring->dmamem)
1308 		qwz_dmamem_free(sc->sc_dmat, ring->dmamem);
1309 
1310 	memset(ring, 0, sizeof(*ring));
1311 }
1312 
1313 int
1314 qwz_pci_init_cmd_ring(struct qwz_softc *sc, struct qwz_pci_cmd_ring *ring)
1315 {
1316 	memset(ring, 0, sizeof(*ring));
1317 
1318 	ring->num_elements = QWZ_PCI_CMD_RING_MAX_ELEMENTS;
1319 	ring->size = sizeof(struct qwz_mhi_ring_element) * ring->num_elements;
1320 
1321 	/* Hardware requires that rings are aligned to ring size. */
1322 	ring->dmamem = qwz_dmamem_alloc(sc->sc_dmat, ring->size, ring->size);
1323 	if (ring->dmamem == NULL)
1324 		return ENOMEM;
1325 
1326 	return 0;
1327 }
1328 
1329 uint32_t
1330 qwz_pci_read(struct qwz_softc *sc, uint32_t addr)
1331 {
1332 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
1333 
1334 	return (bus_space_read_4(psc->sc_st, psc->sc_sh, addr));
1335 }
1336 
1337 void
1338 qwz_pci_write(struct qwz_softc *sc, uint32_t addr, uint32_t val)
1339 {
1340 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
1341 
1342 	bus_space_write_4(psc->sc_st, psc->sc_sh, addr, val);
1343 }
1344 
1345 void
1346 qwz_pci_read_hw_version(struct qwz_softc *sc, uint32_t *major,
1347     uint32_t *minor)
1348 {
1349 	uint32_t soc_hw_version;
1350 
1351 	soc_hw_version = qwz_pcic_read32(sc, TCSR_SOC_HW_VERSION);
1352 	*major = FIELD_GET(TCSR_SOC_HW_VERSION_MAJOR_MASK, soc_hw_version);
1353 	*minor = FIELD_GET(TCSR_SOC_HW_VERSION_MINOR_MASK, soc_hw_version);
1354 	DPRINTF("%s: pci tcsr_soc_hw_version major %d minor %d\n",
1355 	    sc->sc_dev.dv_xname, *major, *minor);
1356 }
1357 
1358 uint32_t
1359 qwz_pcic_read32(struct qwz_softc *sc, uint32_t offset)
1360 {
1361 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
1362 	int ret = 0;
1363 	uint32_t val;
1364 	bool wakeup_required;
1365 
1366 	/* for offset beyond BAR + 4K - 32, may
1367 	 * need to wakeup the device to access.
1368 	 */
1369 	wakeup_required = test_bit(ATH12K_FLAG_DEVICE_INIT_DONE, sc->sc_flags)
1370 	    && offset >= ATH12K_PCI_ACCESS_ALWAYS_OFF;
1371 	if (wakeup_required && psc->sc_pci_ops->wakeup)
1372 		ret = psc->sc_pci_ops->wakeup(sc);
1373 
1374 	if (offset < ATH12K_PCI_WINDOW_START)
1375 		val = qwz_pci_read(sc, offset);
1376 	else
1377 		val = psc->sc_pci_ops->window_read32(sc, offset);
1378 
1379 	if (wakeup_required && !ret && psc->sc_pci_ops->release)
1380 		psc->sc_pci_ops->release(sc);
1381 
1382 	return val;
1383 }
1384 
1385 void
1386 qwz_pcic_write32(struct qwz_softc *sc, uint32_t offset, uint32_t value)
1387 {
1388 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
1389 	int ret = 0;
1390 	bool wakeup_required;
1391 
1392 	/* for offset beyond BAR + 4K - 32, may
1393 	 * need to wakeup the device to access.
1394 	 */
1395 	wakeup_required = test_bit(ATH12K_FLAG_DEVICE_INIT_DONE, sc->sc_flags)
1396 	    && offset >= ATH12K_PCI_ACCESS_ALWAYS_OFF;
1397 	if (wakeup_required && psc->sc_pci_ops->wakeup)
1398 		ret = psc->sc_pci_ops->wakeup(sc);
1399 
1400 	if (offset < ATH12K_PCI_WINDOW_START)
1401 		qwz_pci_write(sc, offset, value);
1402 	else
1403 		psc->sc_pci_ops->window_write32(sc, offset, value);
1404 
1405 	if (wakeup_required && !ret && psc->sc_pci_ops->release)
1406 		psc->sc_pci_ops->release(sc);
1407 }
1408 
1409 void
1410 qwz_pcic_ext_irq_disable(struct qwz_softc *sc)
1411 {
1412 	clear_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, sc->sc_flags);
1413 
1414 	/* In case of one MSI vector, we handle irq enable/disable in a
1415 	 * uniform way since we only have one irq
1416 	 */
1417 	if (!test_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1418 		return;
1419 
1420 	DPRINTF("%s not implemented\n", __func__);
1421 }
1422 
1423 void
1424 qwz_pcic_ext_irq_enable(struct qwz_softc *sc)
1425 {
1426 	set_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, sc->sc_flags);
1427 
1428 	/* In case of one MSI vector, we handle irq enable/disable in a
1429 	 * uniform way since we only have one irq
1430 	 */
1431 	if (!test_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1432 		return;
1433 
1434 	DPRINTF("%s not implemented\n", __func__);
1435 }
1436 
1437 void
1438 qwz_pcic_ce_irq_enable(struct qwz_softc *sc, uint16_t ce_id)
1439 {
1440 	/* In case of one MSI vector, we handle irq enable/disable in a
1441 	 * uniform way since we only have one irq
1442 	 */
1443 	if (!test_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1444 		return;
1445 
1446 	/* OpenBSD PCI stack does not yet implement MSI interrupt masking. */
1447 	sc->msi_ce_irqmask |= (1U << ce_id);
1448 }
1449 
1450 void
1451 qwz_pcic_ce_irq_disable(struct qwz_softc *sc, uint16_t ce_id)
1452 {
1453 	/* In case of one MSI vector, we handle irq enable/disable in a
1454 	 * uniform way since we only have one irq
1455 	 */
1456 	if (!test_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1457 		return;
1458 
1459 	/* OpenBSD PCI stack does not yet implement MSI interrupt masking. */
1460 	sc->msi_ce_irqmask &= ~(1U << ce_id);
1461 }
1462 
1463 void
1464 qwz_pcic_ext_grp_disable(struct qwz_ext_irq_grp *irq_grp)
1465 {
1466 	struct qwz_softc *sc = irq_grp->sc;
1467 
1468 	/* In case of one MSI vector, we handle irq enable/disable
1469 	 * in a uniform way since we only have one irq
1470 	 */
1471 	if (!test_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1472 		return;
1473 }
1474 
1475 int
1476 qwz_pcic_ext_irq_config(struct qwz_softc *sc, struct pci_attach_args *pa)
1477 {
1478 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
1479 	int i, ret, num_vectors = 0;
1480 	uint32_t msi_data_start = 0;
1481 	uint32_t base_idx, base_vector = 0;
1482 
1483 	if (!test_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1484 		return 0;
1485 
1486 	base_idx = ATH12K_PCI_IRQ_CE0_OFFSET + CE_COUNT_MAX;
1487 
1488 	ret = qwz_pcic_get_user_msi_vector(sc, "DP", &num_vectors,
1489 	    &msi_data_start, &base_vector);
1490 	if (ret < 0)
1491 		return ret;
1492 
1493 	for (i = 0; i < nitems(sc->ext_irq_grp); i++) {
1494 		struct qwz_ext_irq_grp *irq_grp = &sc->ext_irq_grp[i];
1495 		uint32_t num_irq = 0;
1496 
1497 		irq_grp->sc = sc;
1498 		irq_grp->grp_id = i;
1499 #if 0
1500 		init_dummy_netdev(&irq_grp->napi_ndev);
1501 		netif_napi_add(&irq_grp->napi_ndev, &irq_grp->napi,
1502 			       ath12k_pcic_ext_grp_napi_poll);
1503 #endif
1504 		if (sc->hw_params.ring_mask->tx[i] ||
1505 		    sc->hw_params.ring_mask->rx[i] ||
1506 		    sc->hw_params.ring_mask->rx_err[i] ||
1507 		    sc->hw_params.ring_mask->rx_wbm_rel[i] ||
1508 		    sc->hw_params.ring_mask->reo_status[i] ||
1509 		    sc->hw_params.ring_mask->host2rxdma[i] ||
1510 		    sc->hw_params.ring_mask->rx_mon_dest[i]) {
1511 			num_irq = 1;
1512 		}
1513 
1514 		irq_grp->num_irq = num_irq;
1515 		irq_grp->irqs[0] = base_idx + i;
1516 
1517 		if (num_irq) {
1518 			int irq_idx = irq_grp->irqs[0];
1519 			pci_intr_handle_t ih;
1520 
1521 			if (pci_intr_map_msivec(pa, irq_idx, &ih) != 0 &&
1522 			    pci_intr_map(pa, &ih) != 0) {
1523 				printf("%s: can't map interrupt\n",
1524 				    sc->sc_dev.dv_xname);
1525 				return EIO;
1526 			}
1527 
1528 			snprintf(psc->sc_ivname[irq_idx], sizeof(psc->sc_ivname[0]),
1529 			    "%s:ex%d", sc->sc_dev.dv_xname, i);
1530 			psc->sc_ih[irq_idx] = pci_intr_establish(psc->sc_pc, ih,
1531 			    IPL_NET, qwz_ext_intr, irq_grp, psc->sc_ivname[irq_idx]);
1532 			if (psc->sc_ih[irq_idx] == NULL) {
1533 				printf("%s: failed to request irq %d\n",
1534 				    sc->sc_dev.dv_xname, irq_idx);
1535 				return EIO;
1536 			}
1537 		}
1538 
1539 		qwz_pcic_ext_grp_disable(irq_grp);
1540 	}
1541 
1542 	return 0;
1543 }
1544 
1545 int
1546 qwz_pcic_config_irq(struct qwz_softc *sc, struct pci_attach_args *pa)
1547 {
1548 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
1549 	struct qwz_ce_pipe *ce_pipe;
1550 	uint32_t msi_data_start;
1551 	uint32_t msi_data_count, msi_data_idx;
1552 	uint32_t msi_irq_start;
1553 	int i, ret, irq_idx;
1554 	pci_intr_handle_t ih;
1555 
1556 	if (!test_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1557 		return 0;
1558 
1559 	ret = qwz_pcic_get_user_msi_vector(sc, "CE", &msi_data_count,
1560 	    &msi_data_start, &msi_irq_start);
1561 	if (ret)
1562 		return ret;
1563 
1564 	/* Configure CE irqs */
1565 	for (i = 0, msi_data_idx = 0; i < sc->hw_params.ce_count; i++) {
1566 		if (qwz_ce_get_attr_flags(sc, i) & CE_ATTR_DIS_INTR)
1567 			continue;
1568 
1569 		ce_pipe = &sc->ce.ce_pipe[i];
1570 		irq_idx = ATH12K_PCI_IRQ_CE0_OFFSET + i;
1571 
1572 		if (pci_intr_map_msivec(pa, irq_idx, &ih) != 0 &&
1573 		    pci_intr_map(pa, &ih) != 0) {
1574 			printf("%s: can't map interrupt\n",
1575 			    sc->sc_dev.dv_xname);
1576 			return EIO;
1577 		}
1578 
1579 		snprintf(psc->sc_ivname[irq_idx], sizeof(psc->sc_ivname[0]),
1580 		    "%s:ce%d", sc->sc_dev.dv_xname, ce_pipe->pipe_num);
1581 		psc->sc_ih[irq_idx] = pci_intr_establish(psc->sc_pc, ih,
1582 		    IPL_NET, qwz_ce_intr, ce_pipe, psc->sc_ivname[irq_idx]);
1583 		if (psc->sc_ih[irq_idx] == NULL) {
1584 			printf("%s: failed to request irq %d\n",
1585 			    sc->sc_dev.dv_xname, irq_idx);
1586 			return EIO;
1587 		}
1588 
1589 		msi_data_idx++;
1590 
1591 		qwz_pcic_ce_irq_disable(sc, i);
1592 	}
1593 
1594 	ret = qwz_pcic_ext_irq_config(sc, pa);
1595 	if (ret)
1596 		return ret;
1597 
1598 	return 0;
1599 }
1600 
1601 void
1602 qwz_pcic_ce_irqs_enable(struct qwz_softc *sc)
1603 {
1604 	int i;
1605 
1606 	set_bit(ATH12K_FLAG_CE_IRQ_ENABLED, sc->sc_flags);
1607 
1608 	for (i = 0; i < sc->hw_params.ce_count; i++) {
1609 		if (qwz_ce_get_attr_flags(sc, i) & CE_ATTR_DIS_INTR)
1610 			continue;
1611 		qwz_pcic_ce_irq_enable(sc, i);
1612 	}
1613 }
1614 
1615 void
1616 qwz_pcic_ce_irqs_disable(struct qwz_softc *sc)
1617 {
1618 	int i;
1619 
1620 	clear_bit(ATH12K_FLAG_CE_IRQ_ENABLED, sc->sc_flags);
1621 
1622 	for (i = 0; i < sc->hw_params.ce_count; i++) {
1623 		if (qwz_ce_get_attr_flags(sc, i) & CE_ATTR_DIS_INTR)
1624 			continue;
1625 		qwz_pcic_ce_irq_disable(sc, i);
1626 	}
1627 }
1628 
1629 int
1630 qwz_pci_start(struct qwz_softc *sc)
1631 {
1632 	/* TODO: for now don't restore ASPM in case of single MSI
1633 	 * vector as MHI register reading in M2 causes system hang.
1634 	 */
1635 	if (test_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags))
1636 		qwz_pci_aspm_restore(sc);
1637 	else
1638 		DPRINTF("%s: leaving PCI ASPM disabled to avoid MHI M2 problems"
1639 		    "\n", sc->sc_dev.dv_xname);
1640 
1641 	set_bit(ATH12K_FLAG_DEVICE_INIT_DONE, sc->sc_flags);
1642 
1643 	qwz_ce_rx_post_buf(sc);
1644 	qwz_pcic_ce_irqs_enable(sc);
1645 
1646 	return 0;
1647 }
1648 
1649 void
1650 qwz_pcic_ce_irq_disable_sync(struct qwz_softc *sc)
1651 {
1652 	qwz_pcic_ce_irqs_disable(sc);
1653 #if 0
1654 	ath12k_pcic_sync_ce_irqs(ab);
1655 	ath12k_pcic_kill_tasklets(ab);
1656 #endif
1657 }
1658 
1659 void
1660 qwz_pci_stop(struct qwz_softc *sc)
1661 {
1662 	qwz_pcic_ce_irq_disable_sync(sc);
1663 	qwz_ce_cleanup_pipes(sc);
1664 }
1665 
1666 int
1667 qwz_pci_bus_wake_up(struct qwz_softc *sc)
1668 {
1669 	if (qwz_mhi_wake_db_clear_valid(sc))
1670 		qwz_mhi_device_wake(sc);
1671 
1672 	return 0;
1673 }
1674 
1675 void
1676 qwz_pci_bus_release(struct qwz_softc *sc)
1677 {
1678 	if (qwz_mhi_wake_db_clear_valid(sc))
1679 		qwz_mhi_device_zzz(sc);
1680 }
1681 
1682 uint32_t
1683 qwz_pci_get_window_start(struct qwz_softc *sc, uint32_t offset)
1684 {
1685 	if (!sc->static_window_map)
1686 		return ATH12K_PCI_WINDOW_START;
1687 
1688 	if ((offset ^ HAL_SEQ_WCSS_UMAC_OFFSET) < ATH12K_PCI_WINDOW_RANGE_MASK)
1689 		/* if offset lies within DP register range, use 3rd window */
1690 		return 3 * ATH12K_PCI_WINDOW_START;
1691 	else if ((offset ^ HAL_SEQ_WCSS_UMAC_CE0_SRC_REG) <
1692 		 ATH12K_PCI_WINDOW_RANGE_MASK)
1693 		 /* if offset lies within CE register range, use 2nd window */
1694 		return 2 * ATH12K_PCI_WINDOW_START;
1695 	else
1696 		return ATH12K_PCI_WINDOW_START;
1697 }
1698 
1699 void
1700 qwz_pci_select_window(struct qwz_softc *sc, uint32_t offset)
1701 {
1702 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
1703 	uint32_t window = FIELD_GET(ATH12K_PCI_WINDOW_VALUE_MASK, offset);
1704 
1705 #if notyet
1706 	lockdep_assert_held(&ab_pci->window_lock);
1707 #endif
1708 
1709 	/*
1710 	 * Preserve the static window configuration and reset only
1711 	 * dynamic window.
1712 	 */
1713 	window |= psc->register_window & ATH12K_PCI_WINDOW_STATIC_MASK;
1714 
1715 	if (window != psc->register_window) {
1716 		qwz_pci_write(sc, ATH12K_PCI_WINDOW_REG_ADDRESS,
1717 		    ATH12K_PCI_WINDOW_ENABLE_BIT | window);
1718 		(void) qwz_pci_read(sc, ATH12K_PCI_WINDOW_REG_ADDRESS);
1719 		psc->register_window = window;
1720 	}
1721 }
1722 
1723 static inline bool
1724 qwz_pci_is_offset_within_mhi_region(uint32_t offset)
1725 {
1726 	return (offset >= PCI_MHIREGLEN_REG && offset <= PCI_MHI_REGION_END);
1727 }
1728 
1729 void
1730 qwz_pci_window_write32(struct qwz_softc *sc, uint32_t offset, uint32_t value)
1731 {
1732 	uint32_t window_start;
1733 
1734 	window_start = qwz_pci_get_window_start(sc, offset);
1735 
1736 	if (window_start == ATH12K_PCI_WINDOW_START) {
1737 #if notyet
1738 		spin_lock_bh(&ab_pci->window_lock);
1739 #endif
1740 		qwz_pci_select_window(sc, offset);
1741 
1742 		if (qwz_pci_is_offset_within_mhi_region(offset)) {
1743 			offset = offset - PCI_MHIREGLEN_REG;
1744 			qwz_pci_write(sc, offset & ATH12K_PCI_WINDOW_RANGE_MASK,
1745 			    value);
1746 		} else {
1747 			qwz_pci_write(sc, window_start +
1748 			    (offset & ATH12K_PCI_WINDOW_RANGE_MASK), value);
1749 		}
1750 #if notyet
1751 		spin_unlock_bh(&ab_pci->window_lock);
1752 #endif
1753 	} else {
1754 		qwz_pci_write(sc, window_start +
1755 		    (offset & ATH12K_PCI_WINDOW_RANGE_MASK), value);
1756 	}
1757 }
1758 
1759 uint32_t
1760 qwz_pci_window_read32(struct qwz_softc *sc, uint32_t offset)
1761 {
1762 	uint32_t window_start, val;
1763 
1764 	window_start = qwz_pci_get_window_start(sc, offset);
1765 
1766 	if (window_start == ATH12K_PCI_WINDOW_START) {
1767 #if notyet
1768 		spin_lock_bh(&ab_pci->window_lock);
1769 #endif
1770 		qwz_pci_select_window(sc, offset);
1771 
1772 		if (qwz_pci_is_offset_within_mhi_region(offset)) {
1773 			offset = offset - PCI_MHIREGLEN_REG;
1774 			val = qwz_pci_read(sc,
1775 			    offset & ATH12K_PCI_WINDOW_RANGE_MASK);
1776 		} else {
1777 			val = qwz_pci_read(sc, window_start +
1778 			    (offset & ATH12K_PCI_WINDOW_RANGE_MASK));
1779 		}
1780 #if notyet
1781 		spin_unlock_bh(&ab_pci->window_lock);
1782 #endif
1783 	} else {
1784 		val = qwz_pci_read(sc, window_start +
1785 		    (offset & ATH12K_PCI_WINDOW_RANGE_MASK));
1786 	}
1787 
1788 	return val;
1789 }
1790 
1791 void
1792 qwz_pci_select_static_window(struct qwz_softc *sc)
1793 {
1794 	uint32_t umac_window;
1795 	uint32_t ce_window;
1796 	uint32_t window;
1797 
1798 	umac_window = FIELD_GET(ATH12K_PCI_WINDOW_VALUE_MASK, HAL_SEQ_WCSS_UMAC_OFFSET);
1799 	ce_window = FIELD_GET(ATH12K_PCI_WINDOW_VALUE_MASK, HAL_CE_WFSS_CE_REG_BASE);
1800 	window = (umac_window << 12) | (ce_window << 6);
1801 
1802 	qwz_pci_write(sc, ATH12K_PCI_WINDOW_REG_ADDRESS,
1803 	    ATH12K_PCI_WINDOW_ENABLE_BIT | window);
1804 }
1805 
1806 void
1807 qwz_pci_soc_global_reset(struct qwz_softc *sc)
1808 {
1809 	uint32_t val, msecs;
1810 
1811 	val = qwz_pcic_read32(sc, PCIE_SOC_GLOBAL_RESET);
1812 
1813 	val |= PCIE_SOC_GLOBAL_RESET_V;
1814 
1815 	qwz_pcic_write32(sc, PCIE_SOC_GLOBAL_RESET, val);
1816 
1817 	/* TODO: exact time to sleep is uncertain */
1818 	msecs = 10;
1819 	DELAY(msecs * 1000);
1820 
1821 	/* Need to toggle V bit back otherwise stuck in reset status */
1822 	val &= ~PCIE_SOC_GLOBAL_RESET_V;
1823 
1824 	qwz_pcic_write32(sc, PCIE_SOC_GLOBAL_RESET, val);
1825 
1826 	DELAY(msecs * 1000);
1827 
1828 	val = qwz_pcic_read32(sc, PCIE_SOC_GLOBAL_RESET);
1829 	if (val == 0xffffffff)
1830 		printf("%s: link down error during global reset\n",
1831 		    sc->sc_dev.dv_xname);
1832 }
1833 
1834 void
1835 qwz_pci_clear_dbg_registers(struct qwz_softc *sc)
1836 {
1837 	uint32_t val;
1838 
1839 	/* read cookie */
1840 	val = qwz_pcic_read32(sc, PCIE_Q6_COOKIE_ADDR);
1841 	DPRINTF("%s: cookie:0x%x\n", sc->sc_dev.dv_xname, val);
1842 
1843 	val = qwz_pcic_read32(sc, WLAON_WARM_SW_ENTRY);
1844 	DPRINTF("%s: WLAON_WARM_SW_ENTRY 0x%x\n", sc->sc_dev.dv_xname, val);
1845 
1846 	/* TODO: exact time to sleep is uncertain */
1847 	DELAY(10 * 1000);
1848 
1849 	/* write 0 to WLAON_WARM_SW_ENTRY to prevent Q6 from
1850 	 * continuing warm path and entering dead loop.
1851 	 */
1852 	qwz_pcic_write32(sc, WLAON_WARM_SW_ENTRY, 0);
1853 	DELAY(10 * 1000);
1854 
1855 	val = qwz_pcic_read32(sc, WLAON_WARM_SW_ENTRY);
1856 	DPRINTF("%s: WLAON_WARM_SW_ENTRY 0x%x\n", sc->sc_dev.dv_xname, val);
1857 
1858 	/* A read clear register. clear the register to prevent
1859 	 * Q6 from entering wrong code path.
1860 	 */
1861 	val = qwz_pcic_read32(sc, WLAON_SOC_RESET_CAUSE_REG);
1862 	DPRINTF("%s: soc reset cause:%d\n", sc->sc_dev.dv_xname, val);
1863 }
1864 
1865 int
1866 qwz_pci_set_link_reg(struct qwz_softc *sc, uint32_t offset, uint32_t value,
1867     uint32_t mask)
1868 {
1869 	uint32_t v;
1870 	int i;
1871 
1872 	v = qwz_pcic_read32(sc, offset);
1873 	if ((v & mask) == value)
1874 		return 0;
1875 
1876 	for (i = 0; i < 10; i++) {
1877 		qwz_pcic_write32(sc, offset, (v & ~mask) | value);
1878 
1879 		v = qwz_pcic_read32(sc, offset);
1880 		if ((v & mask) == value)
1881 			return 0;
1882 
1883 		delay((2 * 1000));
1884 	}
1885 
1886 	DPRINTF("failed to set pcie link register 0x%08x: 0x%08x != 0x%08x\n",
1887 	    offset, v & mask, value);
1888 
1889 	return ETIMEDOUT;
1890 }
1891 
1892 int
1893 qwz_pci_fix_l1ss(struct qwz_softc *sc)
1894 {
1895 	int ret;
1896 
1897 	ret = qwz_pci_set_link_reg(sc,
1898 				      PCIE_QSERDES_COM_SYSCLK_EN_SEL_REG(sc),
1899 				      PCIE_QSERDES_COM_SYSCLK_EN_SEL_VAL,
1900 				      PCIE_QSERDES_COM_SYSCLK_EN_SEL_MSK);
1901 	if (ret) {
1902 		DPRINTF("failed to set sysclk: %d\n", ret);
1903 		return ret;
1904 	}
1905 
1906 	ret = qwz_pci_set_link_reg(sc,
1907 				      PCIE_PCS_OSC_DTCT_CONFIG1_REG(sc),
1908 				      PCIE_PCS_OSC_DTCT_CONFIG1_VAL,
1909 				      PCIE_PCS_OSC_DTCT_CONFIG_MSK);
1910 	if (ret) {
1911 		DPRINTF("failed to set dtct config1 error: %d\n", ret);
1912 		return ret;
1913 	}
1914 
1915 	ret = qwz_pci_set_link_reg(sc,
1916 				      PCIE_PCS_OSC_DTCT_CONFIG2_REG(sc),
1917 				      PCIE_PCS_OSC_DTCT_CONFIG2_VAL,
1918 				      PCIE_PCS_OSC_DTCT_CONFIG_MSK);
1919 	if (ret) {
1920 		DPRINTF("failed to set dtct config2: %d\n", ret);
1921 		return ret;
1922 	}
1923 
1924 	ret = qwz_pci_set_link_reg(sc,
1925 				      PCIE_PCS_OSC_DTCT_CONFIG4_REG(sc),
1926 				      PCIE_PCS_OSC_DTCT_CONFIG4_VAL,
1927 				      PCIE_PCS_OSC_DTCT_CONFIG_MSK);
1928 	if (ret) {
1929 		DPRINTF("failed to set dtct config4: %d\n", ret);
1930 		return ret;
1931 	}
1932 
1933 	return 0;
1934 }
1935 
1936 void
1937 qwz_pci_enable_ltssm(struct qwz_softc *sc)
1938 {
1939 	uint32_t val;
1940 	int i;
1941 
1942 	val = qwz_pcic_read32(sc, PCIE_PCIE_PARF_LTSSM);
1943 
1944 	/* PCIE link seems very unstable after the Hot Reset*/
1945 	for (i = 0; val != PARM_LTSSM_VALUE && i < 5; i++) {
1946 		if (val == 0xffffffff)
1947 			DELAY(5 * 1000);
1948 
1949 		qwz_pcic_write32(sc, PCIE_PCIE_PARF_LTSSM, PARM_LTSSM_VALUE);
1950 		val = qwz_pcic_read32(sc, PCIE_PCIE_PARF_LTSSM);
1951 	}
1952 
1953 	DPRINTF("%s: pci ltssm 0x%x\n", sc->sc_dev.dv_xname, val);
1954 
1955 	val = qwz_pcic_read32(sc, GCC_GCC_PCIE_HOT_RST);
1956 	val |= GCC_GCC_PCIE_HOT_RST_VAL;
1957 	qwz_pcic_write32(sc, GCC_GCC_PCIE_HOT_RST, val);
1958 	val = qwz_pcic_read32(sc, GCC_GCC_PCIE_HOT_RST);
1959 
1960 	DPRINTF("%s: pci pcie_hot_rst 0x%x\n", sc->sc_dev.dv_xname, val);
1961 
1962 	DELAY(5 * 1000);
1963 }
1964 
1965 void
1966 qwz_pci_clear_all_intrs(struct qwz_softc *sc)
1967 {
1968 	/* This is a WAR for PCIE Hotreset.
1969 	 * When target receive Hotreset, but will set the interrupt.
1970 	 * So when download SBL again, SBL will open Interrupt and
1971 	 * receive it, and crash immediately.
1972 	 */
1973 	qwz_pcic_write32(sc, PCIE_PCIE_INT_ALL_CLEAR, PCIE_INT_CLEAR_ALL);
1974 }
1975 
1976 void
1977 qwz_pci_set_wlaon_pwr_ctrl(struct qwz_softc *sc)
1978 {
1979 	uint32_t val;
1980 
1981 	val = qwz_pcic_read32(sc, WLAON_QFPROM_PWR_CTRL_REG);
1982 	val &= ~QFPROM_PWR_CTRL_VDD4BLOW_MASK;
1983 	qwz_pcic_write32(sc, WLAON_QFPROM_PWR_CTRL_REG, val);
1984 }
1985 
1986 void
1987 qwz_pci_force_wake(struct qwz_softc *sc)
1988 {
1989 	qwz_pcic_write32(sc, PCIE_SOC_WAKE_PCIE_LOCAL_REG, 1);
1990 	DELAY(5 * 1000);
1991 }
1992 
1993 void
1994 qwz_pci_sw_reset(struct qwz_softc *sc, bool power_on)
1995 {
1996 	DELAY(100 * 1000); /* msecs */
1997 
1998 	if (power_on) {
1999 		qwz_pci_enable_ltssm(sc);
2000 		qwz_pci_clear_all_intrs(sc);
2001 		qwz_pci_set_wlaon_pwr_ctrl(sc);
2002 		if (sc->hw_params.fix_l1ss)
2003 			qwz_pci_fix_l1ss(sc);
2004 	}
2005 
2006 	qwz_mhi_clear_vector(sc);
2007 	qwz_pci_clear_dbg_registers(sc);
2008 	qwz_pci_soc_global_reset(sc);
2009 	qwz_mhi_reset_device(sc, 0);
2010 }
2011 
2012 void
2013 qwz_pci_msi_config(struct qwz_softc *sc, bool enable)
2014 {
2015 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
2016 	uint32_t val;
2017 
2018 	val = pci_conf_read(psc->sc_pc, psc->sc_tag,
2019 	    psc->sc_msi_off + PCI_MSI_MC);
2020 
2021 	if (enable)
2022 		val |= PCI_MSI_MC_MSIE;
2023 	else
2024 		val &= ~PCI_MSI_MC_MSIE;
2025 
2026 	pci_conf_write(psc->sc_pc, psc->sc_tag, psc->sc_msi_off + PCI_MSI_MC,
2027 	    val);
2028 }
2029 
2030 void
2031 qwz_pci_msi_enable(struct qwz_softc *sc)
2032 {
2033 	qwz_pci_msi_config(sc, true);
2034 }
2035 
2036 void
2037 qwz_pci_msi_disable(struct qwz_softc *sc)
2038 {
2039 	qwz_pci_msi_config(sc, false);
2040 }
2041 
2042 void
2043 qwz_pci_aspm_disable(struct qwz_softc *sc)
2044 {
2045 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
2046 
2047 	psc->sc_lcsr = pci_conf_read(psc->sc_pc, psc->sc_tag,
2048 	    psc->sc_cap_off + PCI_PCIE_LCSR);
2049 
2050 	DPRINTF("%s: pci link_ctl 0x%04x L0s %d L1 %d\n", sc->sc_dev.dv_xname,
2051 	    (uint16_t)psc->sc_lcsr, (psc->sc_lcsr & PCI_PCIE_LCSR_ASPM_L0S),
2052 	    (psc->sc_lcsr & PCI_PCIE_LCSR_ASPM_L1));
2053 
2054 	/* disable L0s and L1 */
2055 	pci_conf_write(psc->sc_pc, psc->sc_tag, psc->sc_cap_off + PCI_PCIE_LCSR,
2056 	    psc->sc_lcsr & ~(PCI_PCIE_LCSR_ASPM_L0S | PCI_PCIE_LCSR_ASPM_L1));
2057 
2058 	psc->sc_flags |= ATH12K_PCI_ASPM_RESTORE;
2059 }
2060 
2061 void
2062 qwz_pci_aspm_restore(struct qwz_softc *sc)
2063 {
2064 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
2065 
2066 	if (psc->sc_flags & ATH12K_PCI_ASPM_RESTORE) {
2067 		pci_conf_write(psc->sc_pc, psc->sc_tag,
2068 		    psc->sc_cap_off + PCI_PCIE_LCSR, psc->sc_lcsr);
2069 		psc->sc_flags &= ~ATH12K_PCI_ASPM_RESTORE;
2070 	}
2071 }
2072 
2073 int
2074 qwz_pci_power_up(struct qwz_softc *sc)
2075 {
2076 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
2077 	int error;
2078 
2079 	psc->register_window = 0;
2080 	clear_bit(ATH12K_FLAG_DEVICE_INIT_DONE, sc->sc_flags);
2081 
2082 	qwz_pci_sw_reset(sc, true);
2083 
2084 	/* Disable ASPM during firmware download due to problems switching
2085 	 * to AMSS state.
2086 	 */
2087 	qwz_pci_aspm_disable(sc);
2088 
2089 	qwz_pci_msi_enable(sc);
2090 
2091 	error = qwz_mhi_start(psc);
2092 	if (error)
2093 		return error;
2094 
2095 	if (sc->static_window_map)
2096 		qwz_pci_select_static_window(sc);
2097 
2098 	return 0;
2099 }
2100 
2101 void
2102 qwz_pci_power_down(struct qwz_softc *sc)
2103 {
2104 	/* restore aspm in case firmware bootup fails */
2105 	qwz_pci_aspm_restore(sc);
2106 
2107 	qwz_pci_force_wake(sc);
2108 
2109 	qwz_pci_msi_disable(sc);
2110 
2111 	qwz_mhi_stop(sc);
2112 	clear_bit(ATH12K_FLAG_DEVICE_INIT_DONE, sc->sc_flags);
2113 	qwz_pci_sw_reset(sc, false);
2114 }
2115 
2116 /*
2117  * MHI
2118  */
2119 int
2120 qwz_mhi_register(struct qwz_softc *sc)
2121 {
2122 	DNPRINTF(QWZ_D_MHI, "%s: STUB %s()\n", sc->sc_dev.dv_xname, __func__);
2123 	return 0;
2124 }
2125 
2126 void
2127 qwz_mhi_unregister(struct qwz_softc *sc)
2128 {
2129 	DNPRINTF(QWZ_D_MHI, "%s: STUB %s()\n", sc->sc_dev.dv_xname, __func__);
2130 }
2131 
2132 // XXX MHI is GPLd - we provide a compatible bare-bones implementation
2133 #define MHI_CFG				0x10
2134 #define   MHI_CFG_NHWER_MASK		GENMASK(31, 24)
2135 #define   MHI_CFG_NHWER_SHFT		24
2136 #define   MHI_CFG_NER_MASK		GENMASK(23, 16)
2137 #define   MHI_CFG_NER_SHFT		16
2138 #define   MHI_CFG_NHWCH_MASK		GENMASK(15, 8)
2139 #define   MHI_CFG_NHWCH_SHFT		8
2140 #define   MHI_CFG_NCH_MASK		GENMASK(7, 0)
2141 #define MHI_CHDBOFF			0x18
2142 #define MHI_DEV_WAKE_DB			127
2143 #define MHI_ERDBOFF			0x20
2144 #define MHI_BHI_OFFSET			0x28
2145 #define   MHI_BHI_IMGADDR_LOW			0x08
2146 #define   MHI_BHI_IMGADDR_HIGH			0x0c
2147 #define   MHI_BHI_IMGSIZE			0x10
2148 #define   MHI_BHI_IMGTXDB			0x18
2149 #define   MHI_BHI_INTVEC			0x20
2150 #define   MHI_BHI_EXECENV			0x28
2151 #define   MHI_BHI_STATUS			0x2c
2152 #define	  MHI_BHI_SERIALNU			0x40
2153 #define MHI_BHIE_OFFSET			0x2c
2154 #define   MHI_BHIE_TXVECADDR_LOW_OFFS		0x2c
2155 #define   MHI_BHIE_TXVECADDR_HIGH_OFFS		0x30
2156 #define   MHI_BHIE_TXVECSIZE_OFFS		0x34
2157 #define   MHI_BHIE_TXVECDB_OFFS			0x3c
2158 #define   MHI_BHIE_TXVECSTATUS_OFFS		0x44
2159 #define   MHI_BHIE_RXVECADDR_LOW_OFFS		0x60
2160 #define   MHI_BHIE_RXVECSTATUS_OFFS		0x78
2161 #define MHI_CTRL			0x38
2162 #define    MHI_CTRL_READY_MASK			0x1
2163 #define    MHI_CTRL_RESET_MASK			0x2
2164 #define    MHI_CTRL_MHISTATE_MASK		GENMASK(15, 8)
2165 #define    MHI_CTRL_MHISTATE_SHFT		8
2166 #define MHI_STATUS			0x48
2167 #define    MHI_STATUS_MHISTATE_MASK		GENMASK(15, 8)
2168 #define    MHI_STATUS_MHISTATE_SHFT		8
2169 #define        MHI_STATE_RESET			0x0
2170 #define        MHI_STATE_READY			0x1
2171 #define        MHI_STATE_M0			0x2
2172 #define        MHI_STATE_M1			0x3
2173 #define        MHI_STATE_M2			0x4
2174 #define        MHI_STATE_M3			0x5
2175 #define        MHI_STATE_M3_FAST		0x6
2176 #define        MHI_STATE_BHI			0x7
2177 #define        MHI_STATE_SYS_ERR		0xff
2178 #define    MHI_STATUS_READY_MASK		0x1
2179 #define    MHI_STATUS_SYSERR_MASK		0x4
2180 #define MHI_CCABAP_LOWER		0x58
2181 #define MHI_CCABAP_HIGHER		0x5c
2182 #define MHI_ECABAP_LOWER		0x60
2183 #define MHI_ECABAP_HIGHER		0x64
2184 #define MHI_CRCBAP_LOWER		0x68
2185 #define MHI_CRCBAP_HIGHER		0x6c
2186 #define MHI_CRDB_LOWER			0x70
2187 #define MHI_CRDB_HIGHER			0x74
2188 #define MHI_CTRLBASE_LOWER		0x80
2189 #define MHI_CTRLBASE_HIGHER		0x84
2190 #define MHI_CTRLLIMIT_LOWER		0x88
2191 #define MHI_CTRLLIMIT_HIGHER		0x8c
2192 #define MHI_DATABASE_LOWER		0x98
2193 #define MHI_DATABASE_HIGHER		0x9c
2194 #define MHI_DATALIMIT_LOWER		0xa0
2195 #define MHI_DATALIMIT_HIGHER		0xa4
2196 
2197 #define MHI_EE_PBL	0x0	/* Primary Bootloader */
2198 #define MHI_EE_SBL	0x1	/* Secondary Bootloader */
2199 #define MHI_EE_AMSS	0x2	/* Modem, aka the primary runtime EE */
2200 #define MHI_EE_RDDM	0x3	/* Ram dump download mode */
2201 #define MHI_EE_WFW	0x4	/* WLAN firmware mode */
2202 #define MHI_EE_PTHRU	0x5	/* Passthrough */
2203 #define MHI_EE_EDL	0x6	/* Embedded downloader */
2204 #define MHI_EE_FP	0x7	/* Flash Programmer Environment */
2205 
2206 #define MHI_IN_PBL(e) (e == MHI_EE_PBL || e == MHI_EE_PTHRU || e == MHI_EE_EDL)
2207 #define MHI_POWER_UP_CAPABLE(e) (MHI_IN_PBL(e) || e == MHI_EE_AMSS)
2208 #define MHI_IN_MISSION_MODE(e) \
2209 	(e == MHI_EE_AMSS || e == MHI_EE_WFW || e == MHI_EE_FP)
2210 
2211 /* BHI register bits */
2212 #define MHI_BHI_TXDB_SEQNUM_BMSK	GENMASK(29, 0)
2213 #define MHI_BHI_TXDB_SEQNUM_SHFT	0
2214 #define MHI_BHI_STATUS_MASK		GENMASK(31, 30)
2215 #define MHI_BHI_STATUS_SHFT		30
2216 #define MHI_BHI_STATUS_ERROR		0x03
2217 #define MHI_BHI_STATUS_SUCCESS		0x02
2218 #define MHI_BHI_STATUS_RESET		0x00
2219 
2220 /* MHI BHIE registers */
2221 #define MHI_BHIE_MSMSOCID_OFFS		0x00
2222 #define MHI_BHIE_RXVECADDR_LOW_OFFS	0x60
2223 #define MHI_BHIE_RXVECADDR_HIGH_OFFS	0x64
2224 #define MHI_BHIE_RXVECSIZE_OFFS		0x68
2225 #define MHI_BHIE_RXVECDB_OFFS		0x70
2226 #define MHI_BHIE_RXVECSTATUS_OFFS	0x78
2227 
2228 /* BHIE register bits */
2229 #define MHI_BHIE_TXVECDB_SEQNUM_BMSK		GENMASK(29, 0)
2230 #define MHI_BHIE_TXVECDB_SEQNUM_SHFT		0
2231 #define MHI_BHIE_TXVECSTATUS_SEQNUM_BMSK	GENMASK(29, 0)
2232 #define MHI_BHIE_TXVECSTATUS_SEQNUM_SHFT	0
2233 #define MHI_BHIE_TXVECSTATUS_STATUS_BMSK	GENMASK(31, 30)
2234 #define MHI_BHIE_TXVECSTATUS_STATUS_SHFT	30
2235 #define MHI_BHIE_TXVECSTATUS_STATUS_RESET	0x00
2236 #define MHI_BHIE_TXVECSTATUS_STATUS_XFER_COMPL	0x02
2237 #define MHI_BHIE_TXVECSTATUS_STATUS_ERROR	0x03
2238 #define MHI_BHIE_RXVECDB_SEQNUM_BMSK		GENMASK(29, 0)
2239 #define MHI_BHIE_RXVECDB_SEQNUM_SHFT		0
2240 #define MHI_BHIE_RXVECSTATUS_SEQNUM_BMSK	GENMASK(29, 0)
2241 #define MHI_BHIE_RXVECSTATUS_SEQNUM_SHFT	0
2242 #define MHI_BHIE_RXVECSTATUS_STATUS_BMSK	GENMASK(31, 30)
2243 #define MHI_BHIE_RXVECSTATUS_STATUS_SHFT	30
2244 #define MHI_BHIE_RXVECSTATUS_STATUS_RESET	0x00
2245 #define MHI_BHIE_RXVECSTATUS_STATUS_XFER_COMPL	0x02
2246 #define MHI_BHIE_RXVECSTATUS_STATUS_ERROR	0x03
2247 
2248 #define MHI_EV_CC_INVALID	0x0
2249 #define MHI_EV_CC_SUCCESS	0x1
2250 #define MHI_EV_CC_EOT		0x2
2251 #define MHI_EV_CC_OVERFLOW	0x3
2252 #define MHI_EV_CC_EOB		0x4
2253 #define MHI_EV_CC_OOB		0x5
2254 #define MHI_EV_CC_DB_MODE	0x6
2255 #define MHI_EV_CC_UNDEFINED_ERR	0x10
2256 #define MHI_EV_CC_BAD_TRE	0x11
2257 
2258 #define MHI_CMD_NOP		01
2259 #define MHI_CMD_RESET_CHAN	16
2260 #define MHI_CMD_STOP_CHAN	17
2261 #define MHI_CMD_START_CHAN	18
2262 
2263 #define MHI_TRE_CMD_CHID_MASK	GENMASK(31, 24)
2264 #define MHI_TRE_CMD_CHID_SHFT	24
2265 #define MHI_TRE_CMD_CMDID_MASK	GENMASK(23, 16)
2266 #define MHI_TRE_CMD_CMDID_SHFT	16
2267 
2268 #define MHI_TRE0_EV_LEN_MASK	GENMASK(15, 0)
2269 #define MHI_TRE0_EV_LEN_SHFT	0
2270 #define MHI_TRE0_EV_CODE_MASK	GENMASK(31, 24)
2271 #define MHI_TRE0_EV_CODE_SHFT	24
2272 #define MHI_TRE1_EV_TYPE_MASK	GENMASK(23, 16)
2273 #define MHI_TRE1_EV_TYPE_SHFT	16
2274 #define MHI_TRE1_EV_CHID_MASK	GENMASK(31, 24)
2275 #define MHI_TRE1_EV_CHID_SHFT	24
2276 
2277 #define MHI_TRE0_DATA_LEN_MASK	GENMASK(15, 0)
2278 #define MHI_TRE0_DATA_LEN_SHFT	0
2279 #define MHI_TRE1_DATA_CHAIN	(1 << 0)
2280 #define MHI_TRE1_DATA_IEOB	(1 << 8)
2281 #define MHI_TRE1_DATA_IEOT	(1 << 9)
2282 #define MHI_TRE1_DATA_BEI	(1 << 10)
2283 #define MHI_TRE1_DATA_TYPE_MASK		GENMASK(23, 16)
2284 #define MHI_TRE1_DATA_TYPE_SHIFT	16
2285 #define MHI_TRE1_DATA_TYPE_TRANSFER	0x2
2286 
2287 #define MHI_PKT_TYPE_INVALID			0x00
2288 #define MHI_PKT_TYPE_NOOP_CMD			0x01
2289 #define MHI_PKT_TYPE_TRANSFER			0x02
2290 #define MHI_PKT_TYPE_COALESCING			0x08
2291 #define MHI_PKT_TYPE_RESET_CHAN_CMD		0x10
2292 #define MHI_PKT_TYPE_STOP_CHAN_CMD		0x11
2293 #define MHI_PKT_TYPE_START_CHAN_CMD		0x12
2294 #define MHI_PKT_TYPE_STATE_CHANGE_EVENT		0x20
2295 #define MHI_PKT_TYPE_CMD_COMPLETION_EVENT	0x21
2296 #define MHI_PKT_TYPE_TX_EVENT			0x22
2297 #define MHI_PKT_TYPE_RSC_TX_EVENT		0x28
2298 #define MHI_PKT_TYPE_EE_EVENT			0x40
2299 #define MHI_PKT_TYPE_TSYNC_EVENT		0x48
2300 #define MHI_PKT_TYPE_BW_REQ_EVENT		0x50
2301 
2302 
2303 #define MHI_DMA_VEC_CHUNK_SIZE			524288 /* 512 KB */
2304 struct qwz_dma_vec_entry {
2305 	uint64_t paddr;
2306 	uint64_t size;
2307 };
2308 
2309 void
2310 qwz_mhi_ring_doorbell(struct qwz_softc *sc, uint64_t db_addr, uint64_t val)
2311 {
2312 	qwz_pci_write(sc, db_addr + 4, val >> 32);
2313 	qwz_pci_write(sc, db_addr, val & 0xffffffff);
2314 }
2315 
2316 void
2317 qwz_mhi_device_wake(struct qwz_softc *sc)
2318 {
2319 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
2320 
2321 	/*
2322 	 * Device wake is async only for now because we do not
2323 	 * keep track of PM state in software.
2324 	 */
2325 	qwz_mhi_ring_doorbell(sc, psc->wake_db, 1);
2326 }
2327 
2328 void
2329 qwz_mhi_device_zzz(struct qwz_softc *sc)
2330 {
2331 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
2332 
2333 	qwz_mhi_ring_doorbell(sc, psc->wake_db, 0);
2334 }
2335 
2336 int
2337 qwz_mhi_wake_db_clear_valid(struct qwz_softc *sc)
2338 {
2339 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
2340 
2341 	return (psc->mhi_state == MHI_STATE_M0); /* TODO other states? */
2342 }
2343 
2344 void
2345 qwz_mhi_init_xfer_rings(struct qwz_pci_softc *psc)
2346 {
2347 	struct qwz_softc *sc = &psc->sc_sc;
2348 	int i;
2349 	uint32_t chcfg;
2350 	struct qwz_pci_xfer_ring *ring;
2351 	struct qwz_mhi_chan_ctxt *cbase, *c;
2352 
2353 	cbase = (struct qwz_mhi_chan_ctxt *)QWZ_DMA_KVA(psc->chan_ctxt);
2354 	for (i = 0; i < psc->max_chan; i++) {
2355 		c = &cbase[i];
2356 		chcfg = le32toh(c->chcfg);
2357 		chcfg &= ~(MHI_CHAN_CTX_CHSTATE_MASK |
2358 		    MHI_CHAN_CTX_BRSTMODE_MASK |
2359 		    MHI_CHAN_CTX_POLLCFG_MASK);
2360 		chcfg |= (MHI_CHAN_CTX_CHSTATE_DISABLED |
2361 		    (MHI_CHAN_CTX_BRSTMODE_DISABLE <<
2362 		    MHI_CHAN_CTX_BRSTMODE_SHFT));
2363 		c->chcfg = htole32(chcfg);
2364 		c->chtype = htole32(MHI_CHAN_TYPE_INVALID);
2365 		c->erindex = 0;
2366 	}
2367 
2368 	for (i = 0; i < nitems(psc->xfer_rings); i++) {
2369 		ring = &psc->xfer_rings[i];
2370 		KASSERT(ring->mhi_chan_id < psc->max_chan);
2371 		c = &cbase[ring->mhi_chan_id];
2372 		c->chtype = htole32(ring->mhi_chan_direction);
2373 		c->erindex = htole32(ring->mhi_chan_event_ring_index);
2374 		ring->chan_ctxt = c;
2375 	}
2376 
2377 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(psc->chan_ctxt), 0,
2378 	    QWZ_DMA_LEN(psc->chan_ctxt), BUS_DMASYNC_PREWRITE);
2379 }
2380 
2381 void
2382 qwz_mhi_init_event_rings(struct qwz_pci_softc *psc)
2383 {
2384 	struct qwz_softc *sc = &psc->sc_sc;
2385 	int i;
2386 	uint32_t intmod;
2387 	uint64_t paddr, len;
2388 	struct qwz_pci_event_ring *ring;
2389 	struct qwz_mhi_event_ctxt *c;
2390 
2391 	c = (struct qwz_mhi_event_ctxt *)QWZ_DMA_KVA(psc->event_ctxt);
2392 	for (i = 0; i < nitems(psc->event_rings); i++, c++) {
2393 		ring = &psc->event_rings[i];
2394 
2395 		ring->event_ctxt = c;
2396 
2397 		intmod = le32toh(c->intmod);
2398 		intmod &= ~(MHI_EV_CTX_INTMODC_MASK | MHI_EV_CTX_INTMODT_MASK);
2399 		intmod |= (ring->mhi_er_irq_moderation_ms <<
2400 		    MHI_EV_CTX_INTMODT_SHFT) & MHI_EV_CTX_INTMODT_MASK;
2401 		c->intmod = htole32(intmod);
2402 
2403 		c->ertype = htole32(MHI_ER_TYPE_VALID);
2404 		c->msivec = htole32(ring->mhi_er_irq);
2405 
2406 		paddr = QWZ_DMA_DVA(ring->dmamem);
2407 		ring->rp = paddr;
2408 		ring->wp = paddr + ring->size -
2409 		    sizeof(struct qwz_mhi_ring_element);
2410 		c->rbase = htole64(paddr);
2411 		c->rp = htole64(ring->rp);
2412 		c->wp = htole64(ring->wp);
2413 
2414 		len = sizeof(struct qwz_mhi_ring_element) * ring->num_elements;
2415 		c->rlen = htole64(len);
2416 	}
2417 
2418 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(psc->event_ctxt), 0,
2419 	    QWZ_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_PREWRITE);
2420 }
2421 
2422 void
2423 qwz_mhi_init_cmd_ring(struct qwz_pci_softc *psc)
2424 {
2425 	struct qwz_softc *sc = &psc->sc_sc;
2426 	struct qwz_pci_cmd_ring *ring = &psc->cmd_ring;
2427 	struct qwz_mhi_cmd_ctxt *c;
2428 	uint64_t paddr, len;
2429 
2430 	paddr = QWZ_DMA_DVA(ring->dmamem);
2431 	len = ring->size;
2432 
2433 	ring->rp = ring->wp = paddr;
2434 
2435 	c = (struct qwz_mhi_cmd_ctxt *)QWZ_DMA_KVA(psc->cmd_ctxt);
2436 	c->rbase = htole64(paddr);
2437 	c->rp = htole64(paddr);
2438 	c->wp = htole64(paddr);
2439 	c->rlen = htole64(len);
2440 
2441 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(psc->cmd_ctxt), 0,
2442 	    QWZ_DMA_LEN(psc->cmd_ctxt), BUS_DMASYNC_PREWRITE);
2443 }
2444 
2445 void
2446 qwz_mhi_init_dev_ctxt(struct qwz_pci_softc *psc)
2447 {
2448 	qwz_mhi_init_xfer_rings(psc);
2449 	qwz_mhi_init_event_rings(psc);
2450 	qwz_mhi_init_cmd_ring(psc);
2451 }
2452 
2453 void *
2454 qwz_pci_cmd_ring_get_elem(struct qwz_pci_cmd_ring *ring, uint64_t ptr)
2455 {
2456 	uint64_t base = QWZ_DMA_DVA(ring->dmamem), offset;
2457 
2458 	if (ptr < base || ptr >= base + ring->size)
2459 		return NULL;
2460 
2461 	offset = ptr - base;
2462 	if (offset >= ring->size)
2463 		return NULL;
2464 
2465 	return QWZ_DMA_KVA(ring->dmamem) + offset;
2466 }
2467 
2468 int
2469 qwz_mhi_cmd_ring_submit(struct qwz_pci_softc *psc,
2470     struct qwz_pci_cmd_ring *ring)
2471 {
2472 	struct qwz_softc *sc = &psc->sc_sc;
2473 	uint64_t base = QWZ_DMA_DVA(ring->dmamem);
2474 	struct qwz_mhi_cmd_ctxt *c;
2475 
2476 	if (ring->queued >= ring->num_elements)
2477 		return 1;
2478 
2479 	if (ring->wp + sizeof(struct qwz_mhi_ring_element) >= base + ring->size)
2480 		ring->wp = base;
2481 	else
2482 		ring->wp += sizeof(struct qwz_mhi_ring_element);
2483 
2484 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(psc->cmd_ctxt), 0,
2485 	    QWZ_DMA_LEN(psc->cmd_ctxt), BUS_DMASYNC_POSTREAD);
2486 
2487 	c = (struct qwz_mhi_cmd_ctxt *)QWZ_DMA_KVA(psc->cmd_ctxt);
2488 	c->wp = htole64(ring->wp);
2489 
2490 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(psc->cmd_ctxt), 0,
2491 	    QWZ_DMA_LEN(psc->cmd_ctxt), BUS_DMASYNC_PREWRITE);
2492 
2493 	ring->queued++;
2494 	qwz_mhi_ring_doorbell(sc, MHI_CRDB_LOWER, ring->wp);
2495 	return 0;
2496 }
2497 
2498 int
2499 qwz_mhi_send_cmd(struct qwz_pci_softc *psc, uint32_t cmd, uint32_t chan)
2500 {
2501 	struct qwz_softc *sc = &psc->sc_sc;
2502 	struct qwz_pci_cmd_ring	*ring = &psc->cmd_ring;
2503 	struct qwz_mhi_ring_element *e;
2504 
2505 	if (ring->queued >= ring->num_elements) {
2506 		printf("%s: command ring overflow\n", sc->sc_dev.dv_xname);
2507 		return 1;
2508 	}
2509 
2510 	e = qwz_pci_cmd_ring_get_elem(ring, ring->wp);
2511 	if (e == NULL)
2512 		return 1;
2513 
2514 	e->ptr = 0ULL;
2515 	e->dword[0] = 0;
2516 	e->dword[1] = htole32(
2517 	    ((chan << MHI_TRE_CMD_CHID_SHFT) & MHI_TRE_CMD_CHID_MASK) |
2518 	    ((cmd << MHI_TRE_CMD_CMDID_SHFT) & MHI_TRE_CMD_CMDID_MASK));
2519 
2520 	return qwz_mhi_cmd_ring_submit(psc, ring);
2521 }
2522 
2523 void *
2524 qwz_pci_xfer_ring_get_elem(struct qwz_pci_xfer_ring *ring, uint64_t wp)
2525 {
2526 	uint64_t base = QWZ_DMA_DVA(ring->dmamem), offset;
2527 	void *addr = QWZ_DMA_KVA(ring->dmamem);
2528 
2529 	if (wp < base)
2530 		return NULL;
2531 
2532 	offset = wp - base;
2533 	if (offset >= ring->size)
2534 		return NULL;
2535 
2536 	return addr + offset;
2537 }
2538 
2539 struct qwz_xfer_data *
2540 qwz_pci_xfer_ring_get_data(struct qwz_pci_xfer_ring *ring, uint64_t wp)
2541 {
2542 	uint64_t base = QWZ_DMA_DVA(ring->dmamem), offset;
2543 
2544 	if (wp < base)
2545 		return NULL;
2546 
2547 	offset = wp - base;
2548 	if (offset >= ring->size)
2549 		return NULL;
2550 
2551 	return &ring->data[offset / sizeof(ring->data[0])];
2552 }
2553 
2554 int
2555 qwz_mhi_submit_xfer(struct qwz_softc *sc, struct mbuf *m)
2556 {
2557 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
2558 	struct qwz_pci_xfer_ring *ring;
2559 	struct qwz_mhi_ring_element *e;
2560 	struct qwz_xfer_data *xfer;
2561 	uint64_t paddr, base;
2562 	int err;
2563 
2564 	ring = &psc->xfer_rings[QWZ_PCI_XFER_RING_IPCR_OUTBOUND];
2565 
2566 	if (ring->queued >= ring->num_elements)
2567 		return 1;
2568 
2569 	if (m->m_pkthdr.len > QWZ_PCI_XFER_MAX_DATA_SIZE) {
2570 		/* TODO: chunk xfers */
2571 		printf("%s: xfer too large: %d bytes\n", __func__, m->m_pkthdr.len);
2572 		return 1;
2573 
2574 	}
2575 
2576 	e = qwz_pci_xfer_ring_get_elem(ring, ring->wp);
2577 	if (e == NULL)
2578 		return 1;
2579 
2580 	xfer = qwz_pci_xfer_ring_get_data(ring, ring->wp);
2581 	if (xfer == NULL || xfer->m != NULL)
2582 		return 1;
2583 
2584 	err = bus_dmamap_load_mbuf(sc->sc_dmat, xfer->map, m,
2585 	    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
2586 	if (err && err != EFBIG) {
2587 		printf("%s: can't map mbuf (error %d)\n",
2588 		    sc->sc_dev.dv_xname, err);
2589 		return err;
2590 	}
2591 	if (err) {
2592 		/* Too many DMA segments, linearize mbuf. */
2593 		if (m_defrag(m, M_DONTWAIT))
2594 			return ENOBUFS;
2595 		err = bus_dmamap_load_mbuf(sc->sc_dmat, xfer->map, m,
2596 		    BUS_DMA_NOWAIT | BUS_DMA_WRITE);
2597 		if (err) {
2598 			printf("%s: can't map mbuf (error %d)\n",
2599 			    sc->sc_dev.dv_xname, err);
2600 			return err;
2601 		}
2602 	}
2603 
2604 	bus_dmamap_sync(sc->sc_dmat, xfer->map, 0, m->m_pkthdr.len,
2605 	    BUS_DMASYNC_PREWRITE);
2606 
2607 	xfer->m = m;
2608 	paddr = xfer->map->dm_segs[0].ds_addr;
2609 
2610 	e->ptr = htole64(paddr);
2611 	e->dword[0] = htole32((m->m_pkthdr.len << MHI_TRE0_DATA_LEN_SHFT) &
2612 	    MHI_TRE0_DATA_LEN_MASK);
2613 	e->dword[1] = htole32(MHI_TRE1_DATA_IEOT |
2614 	    MHI_TRE1_DATA_TYPE_TRANSFER << MHI_TRE1_DATA_TYPE_SHIFT);
2615 
2616 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(ring->dmamem),
2617 	    0, QWZ_DMA_LEN(ring->dmamem), BUS_DMASYNC_PREWRITE);
2618 
2619 	base = QWZ_DMA_DVA(ring->dmamem);
2620 	if (ring->wp + sizeof(struct qwz_mhi_ring_element) >= base + ring->size)
2621 		ring->wp = base;
2622 	else
2623 		ring->wp += sizeof(struct qwz_mhi_ring_element);
2624 	ring->queued++;
2625 
2626 	ring->chan_ctxt->wp = htole64(ring->wp);
2627 
2628 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(psc->chan_ctxt), 0,
2629 	    QWZ_DMA_LEN(psc->chan_ctxt), BUS_DMASYNC_PREWRITE);
2630 
2631 	qwz_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
2632 	return 0;
2633 }
2634 
2635 int
2636 qwz_mhi_start_channel(struct qwz_pci_softc *psc,
2637 	struct qwz_pci_xfer_ring *ring)
2638 {
2639 	struct qwz_softc *sc = &psc->sc_sc;
2640 	struct qwz_mhi_chan_ctxt *c;
2641 	int ret = 0;
2642 	uint32_t chcfg;
2643 	uint64_t paddr, len;
2644 
2645 	DNPRINTF(QWZ_D_MHI, "%s: start MHI channel %d in state %d\n", __func__,
2646 	    ring->mhi_chan_id, ring->mhi_chan_state);
2647 
2648 	c = ring->chan_ctxt;
2649 
2650 	chcfg = le32toh(c->chcfg);
2651 	chcfg &= ~MHI_CHAN_CTX_CHSTATE_MASK;
2652 	chcfg |= MHI_CHAN_CTX_CHSTATE_ENABLED;
2653 	c->chcfg = htole32(chcfg);
2654 
2655 	paddr = QWZ_DMA_DVA(ring->dmamem);
2656 	ring->rp = ring->wp = paddr;
2657 	c->rbase = htole64(paddr);
2658 	c->rp = htole64(ring->rp);
2659 	c->wp = htole64(ring->wp);
2660 	len = sizeof(struct qwz_mhi_ring_element) * ring->num_elements;
2661 	c->rlen = htole64(len);
2662 
2663 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(psc->chan_ctxt), 0,
2664 	    QWZ_DMA_LEN(psc->chan_ctxt), BUS_DMASYNC_PREWRITE);
2665 
2666 	ring->cmd_status = MHI_EV_CC_INVALID;
2667 	if (qwz_mhi_send_cmd(psc, MHI_CMD_START_CHAN, ring->mhi_chan_id))
2668 		return 1;
2669 
2670 	while (ring->cmd_status != MHI_EV_CC_SUCCESS) {
2671 		ret = tsleep_nsec(&ring->cmd_status, 0, "qwzcmd",
2672 		    SEC_TO_NSEC(5));
2673 		if (ret)
2674 			break;
2675 	}
2676 
2677 	if (ret) {
2678 		printf("%s: could not start MHI channel %d in state %d: status 0x%x\n",
2679 		    sc->sc_dev.dv_xname, ring->mhi_chan_id,
2680 		    ring->mhi_chan_state, ring->cmd_status);
2681 		return 1;
2682 	}
2683 
2684 	if (ring->mhi_chan_direction == MHI_CHAN_TYPE_INBOUND) {
2685 		uint64_t wp = QWZ_DMA_DVA(ring->dmamem);
2686 		int i;
2687 
2688 		for (i = 0; i < ring->num_elements; i++) {
2689 			struct qwz_mhi_ring_element *e;
2690 			struct qwz_xfer_data *xfer;
2691 			uint64_t paddr;
2692 
2693 			e = qwz_pci_xfer_ring_get_elem(ring, wp);
2694 			xfer = qwz_pci_xfer_ring_get_data(ring, wp);
2695 			paddr = xfer->map->dm_segs[0].ds_addr;
2696 
2697 			e->ptr = htole64(paddr);
2698 			e->dword[0] = htole32((QWZ_PCI_XFER_MAX_DATA_SIZE <<
2699 			    MHI_TRE0_DATA_LEN_SHFT) &
2700 			    MHI_TRE0_DATA_LEN_MASK);
2701 			e->dword[1] = htole32(MHI_TRE1_DATA_IEOT |
2702 			    MHI_TRE1_DATA_BEI |
2703 			    MHI_TRE1_DATA_TYPE_TRANSFER <<
2704 			    MHI_TRE1_DATA_TYPE_SHIFT);
2705 
2706 			ring->wp = wp;
2707 			wp += sizeof(*e);
2708 		}
2709 
2710 		bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(ring->dmamem), 0,
2711 		    QWZ_DMA_LEN(ring->dmamem), BUS_DMASYNC_PREWRITE);
2712 
2713 		qwz_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
2714 	}
2715 
2716 	return 0;
2717 }
2718 
2719 int
2720 qwz_mhi_start_channels(struct qwz_pci_softc *psc)
2721 {
2722 	struct qwz_pci_xfer_ring *ring;
2723 	int ret = 0;
2724 
2725 	qwz_mhi_device_wake(&psc->sc_sc);
2726 
2727 	ring = &psc->xfer_rings[QWZ_PCI_XFER_RING_IPCR_OUTBOUND];
2728 	if (qwz_mhi_start_channel(psc, ring)) {
2729 		ret = 1;
2730 		goto done;
2731 	}
2732 
2733 	ring = &psc->xfer_rings[QWZ_PCI_XFER_RING_IPCR_INBOUND];
2734 	if (qwz_mhi_start_channel(psc, ring))
2735 		ret = 1;
2736 done:
2737 	qwz_mhi_device_zzz(&psc->sc_sc);
2738 	return ret;
2739 }
2740 
2741 int
2742 qwz_mhi_start(struct qwz_pci_softc *psc)
2743 {
2744 	struct qwz_softc *sc = &psc->sc_sc;
2745 	uint32_t off;
2746 	uint32_t ee, state;
2747 	int ret;
2748 
2749 	qwz_mhi_init_dev_ctxt(psc);
2750 
2751 	psc->bhi_off = qwz_pci_read(sc, MHI_BHI_OFFSET);
2752 	DNPRINTF(QWZ_D_MHI, "%s: BHI offset 0x%x\n", __func__, psc->bhi_off);
2753 
2754 	psc->bhie_off = qwz_pci_read(sc, MHI_BHIE_OFFSET);
2755 	DNPRINTF(QWZ_D_MHI, "%s: BHIE offset 0x%x\n", __func__, psc->bhie_off);
2756 
2757 	/* Clean BHIE RX registers */
2758 	for (off = MHI_BHIE_RXVECADDR_LOW_OFFS;
2759 	     off < (MHI_BHIE_RXVECSTATUS_OFFS - 4);
2760 	     off += 4)
2761 	     	qwz_pci_write(sc, psc->bhie_off + off, 0x0);
2762 
2763 	qwz_rddm_prepare(psc);
2764 
2765 	/* Program BHI INTVEC */
2766 	qwz_pci_write(sc, psc->bhi_off + MHI_BHI_INTVEC, 0x00);
2767 
2768 	/*
2769 	 * Get BHI execution environment and confirm that it is valid
2770 	 * for power on.
2771 	 */
2772 	ee = qwz_pci_read(sc, psc->bhi_off + MHI_BHI_EXECENV);
2773 	if (!MHI_POWER_UP_CAPABLE(ee)) {
2774 		printf("%s: invalid EE for power on: 0x%x\n",
2775 		     sc->sc_dev.dv_xname, ee);
2776 		return 1;
2777 	}
2778 
2779 	/*
2780 	 * Get MHI state of the device and reset it if it is in system
2781 	 * error.
2782 	 */
2783 	state = qwz_pci_read(sc, MHI_STATUS);
2784 	DNPRINTF(QWZ_D_MHI, "%s: MHI power on with EE: 0x%x, status: 0x%x\n",
2785 	     sc->sc_dev.dv_xname, ee, state);
2786 	state = (state & MHI_STATUS_MHISTATE_MASK) >> MHI_STATUS_MHISTATE_SHFT;
2787 	if (state == MHI_STATE_SYS_ERR) {
2788 		if (qwz_mhi_reset_device(sc, 0))
2789 			return 1;
2790 		state = qwz_pci_read(sc, MHI_STATUS);
2791 		DNPRINTF(QWZ_D_MHI, "%s: MHI state after reset: 0x%x\n",
2792 		    sc->sc_dev.dv_xname, state);
2793 		state = (state & MHI_STATUS_MHISTATE_MASK) >>
2794 		    MHI_STATUS_MHISTATE_SHFT;
2795 		if (state == MHI_STATE_SYS_ERR) {
2796 			printf("%s: MHI stuck in system error state\n",
2797 			    sc->sc_dev.dv_xname);
2798 			return 1;
2799 		}
2800 	}
2801 
2802 	psc->bhi_ee = ee;
2803 	psc->mhi_state = state;
2804 
2805 #if notyet
2806 	/* Enable IRQs */
2807 	//  XXX todo?
2808 #endif
2809 
2810 	/* Transition to primary runtime. */
2811 	if (MHI_IN_PBL(ee)) {
2812 		ret = qwz_mhi_fw_load_handler(psc);
2813 		if (ret)
2814 			return ret;
2815 
2816 		/* XXX without this delay starting the channels may fail */
2817 		delay(1000);
2818 		qwz_mhi_start_channels(psc);
2819 	} else {
2820 		/* XXX Handle partially initialized device...?!? */
2821 		ee = qwz_pci_read(sc, psc->bhi_off + MHI_BHI_EXECENV);
2822 		if (!MHI_IN_MISSION_MODE(ee)) {
2823 			printf("%s: failed to power up MHI, ee=0x%x\n",
2824 			    sc->sc_dev.dv_xname, ee);
2825 			return EIO;
2826 		}
2827 	}
2828 
2829 	return 0;
2830 }
2831 
2832 void
2833 qwz_mhi_stop(struct qwz_softc *sc)
2834 {
2835 	qwz_mhi_reset_device(sc, 1);
2836 }
2837 
2838 int
2839 qwz_mhi_reset_device(struct qwz_softc *sc, int force)
2840 {
2841 	struct qwz_pci_softc *psc = (struct qwz_pci_softc *)sc;
2842 	uint32_t reg;
2843 	int ret = 0;
2844 
2845 	reg = qwz_pcic_read32(sc, MHI_STATUS);
2846 
2847 	DNPRINTF(QWZ_D_MHI, "%s: MHISTATUS 0x%x\n", sc->sc_dev.dv_xname, reg);
2848 	/*
2849 	 * Observed on QCA6390 that after SOC_GLOBAL_RESET, MHISTATUS
2850 	 * has SYSERR bit set and thus need to set MHICTRL_RESET
2851 	 * to clear SYSERR.
2852 	 */
2853 	if (force || (reg & MHI_STATUS_SYSERR_MASK)) {
2854 		/* Trigger MHI Reset in device. */
2855 		qwz_pcic_write32(sc, MHI_CTRL, MHI_CTRL_RESET_MASK);
2856 
2857 		/* Wait for the reset bit to be cleared by the device. */
2858 		ret = qwz_mhi_await_device_reset(sc);
2859 		if (ret)
2860 			return ret;
2861 
2862 		if (psc->bhi_off == 0)
2863 			psc->bhi_off = qwz_pci_read(sc, MHI_BHI_OFFSET);
2864 
2865 		/* Device clear BHI INTVEC so re-program it. */
2866 		qwz_pci_write(sc, psc->bhi_off + MHI_BHI_INTVEC, 0x00);
2867 	}
2868 
2869 	return 0;
2870 }
2871 
2872 static inline void
2873 qwz_mhi_reset_txvecdb(struct qwz_softc *sc)
2874 {
2875 	qwz_pcic_write32(sc, PCIE_TXVECDB, 0);
2876 }
2877 
2878 static inline void
2879 qwz_mhi_reset_txvecstatus(struct qwz_softc *sc)
2880 {
2881 	qwz_pcic_write32(sc, PCIE_TXVECSTATUS, 0);
2882 }
2883 
2884 static inline void
2885 qwz_mhi_reset_rxvecdb(struct qwz_softc *sc)
2886 {
2887 	qwz_pcic_write32(sc, PCIE_RXVECDB, 0);
2888 }
2889 
2890 static inline void
2891 qwz_mhi_reset_rxvecstatus(struct qwz_softc *sc)
2892 {
2893 	qwz_pcic_write32(sc, PCIE_RXVECSTATUS, 0);
2894 }
2895 
2896 void
2897 qwz_mhi_clear_vector(struct qwz_softc *sc)
2898 {
2899 	qwz_mhi_reset_txvecdb(sc);
2900 	qwz_mhi_reset_txvecstatus(sc);
2901 	qwz_mhi_reset_rxvecdb(sc);
2902 	qwz_mhi_reset_rxvecstatus(sc);
2903 }
2904 
2905 int
2906 qwz_mhi_fw_load_handler(struct qwz_pci_softc *psc)
2907 {
2908 	struct qwz_softc *sc = &psc->sc_sc;
2909 	int ret;
2910 	char amss_path[PATH_MAX];
2911 	u_char *data;
2912 	size_t len;
2913 
2914 	if (sc->fw_img[QWZ_FW_AMSS].data) {
2915 		data = sc->fw_img[QWZ_FW_AMSS].data;
2916 		len = sc->fw_img[QWZ_FW_AMSS].size;
2917 	} else {
2918 		ret = snprintf(amss_path, sizeof(amss_path), "%s-%s-%s",
2919 		    ATH12K_FW_DIR, sc->hw_params.fw.dir, ATH12K_AMSS_FILE);
2920 		if (ret < 0 || ret >= sizeof(amss_path))
2921 			return ENOSPC;
2922 
2923 		ret = loadfirmware(amss_path, &data, &len);
2924 		if (ret) {
2925 			printf("%s: could not read %s (error %d)\n",
2926 			    sc->sc_dev.dv_xname, amss_path, ret);
2927 			return ret;
2928 		}
2929 
2930 		if (len < MHI_DMA_VEC_CHUNK_SIZE) {
2931 			printf("%s: %s is too short, have only %zu bytes\n",
2932 			    sc->sc_dev.dv_xname, amss_path, len);
2933 			free(data, M_DEVBUF, len);
2934 			return EINVAL;
2935 		}
2936 
2937 		sc->fw_img[QWZ_FW_AMSS].data = data;
2938 		sc->fw_img[QWZ_FW_AMSS].size = len;
2939 	}
2940 
2941 	/* Second-stage boot loader sits in the first 512 KB of image. */
2942 	ret = qwz_mhi_fw_load_bhi(psc, data, MHI_DMA_VEC_CHUNK_SIZE);
2943 	if (ret != 0) {
2944 		printf("%s: could not load firmware %s\n",
2945 		    sc->sc_dev.dv_xname, amss_path);
2946 		return ret;
2947 	}
2948 
2949 	/* Now load the full image. */
2950 	ret = qwz_mhi_fw_load_bhie(psc, data, len);
2951 	if (ret != 0) {
2952 		printf("%s: could not load firmware %s\n",
2953 		    sc->sc_dev.dv_xname, amss_path);
2954 		return ret;
2955 	}
2956 
2957 	while (psc->bhi_ee < MHI_EE_AMSS) {
2958 		ret = tsleep_nsec(&psc->bhi_ee, 0, "qwzamss",
2959 		    SEC_TO_NSEC(5));
2960 		if (ret)
2961 			break;
2962 	}
2963 	if (ret != 0) {
2964 		printf("%s: device failed to enter AMSS EE\n",
2965 		    sc->sc_dev.dv_xname);
2966 	}
2967 
2968 	return ret;
2969 }
2970 
2971 int
2972 qwz_mhi_await_device_reset(struct qwz_softc *sc)
2973 {
2974 	const uint32_t msecs = 24, retries = 2;
2975 	uint32_t reg;
2976 	int timeout;
2977 
2978 	/* Poll for CTRL RESET to clear. */
2979 	timeout = retries;
2980 	while (timeout > 0) {
2981 		reg = qwz_pci_read(sc, MHI_CTRL);
2982 		DNPRINTF(QWZ_D_MHI, "%s: MHI_CTRL is 0x%x\n", __func__, reg);
2983 		if ((reg & MHI_CTRL_RESET_MASK) == 0)
2984 			break;
2985 		DELAY((msecs / retries) * 1000);
2986 		timeout--;
2987 	}
2988 	if (timeout == 0) {
2989 		DNPRINTF(QWZ_D_MHI, "%s: MHI reset failed\n", __func__);
2990 		return ETIMEDOUT;
2991 	}
2992 
2993 	return 0;
2994 }
2995 
2996 int
2997 qwz_mhi_await_device_ready(struct qwz_softc *sc)
2998 {
2999 	uint32_t reg;
3000 	int timeout;
3001 	const uint32_t msecs = 2000, retries = 4;
3002 
3003 
3004 	/* Poll for READY to be set. */
3005 	timeout = retries;
3006 	while (timeout > 0) {
3007 		reg = qwz_pci_read(sc, MHI_STATUS);
3008 		DNPRINTF(QWZ_D_MHI, "%s: MHI_STATUS is 0x%x\n", __func__, reg);
3009 		if (reg & MHI_STATUS_READY_MASK) {
3010 			reg &= ~MHI_STATUS_READY_MASK;
3011 			qwz_pci_write(sc, MHI_STATUS, reg);
3012 			break;
3013 		}
3014 		DELAY((msecs / retries) * 1000);
3015 		timeout--;
3016 	}
3017 	if (timeout == 0) {
3018 		printf("%s: MHI not ready\n", sc->sc_dev.dv_xname);
3019 		return ETIMEDOUT;
3020 	}
3021 
3022 	return 0;
3023 }
3024 
3025 void
3026 qwz_mhi_ready_state_transition(struct qwz_pci_softc *psc)
3027 {
3028 	struct qwz_softc *sc = &psc->sc_sc;
3029 	int ret, i;
3030 
3031 	ret = qwz_mhi_await_device_reset(sc);
3032 	if (ret)
3033 		return;
3034 
3035 	ret = qwz_mhi_await_device_ready(sc);
3036 	if (ret)
3037 		return;
3038 
3039 	/* Set up memory-mapped IO for channels, events, etc. */
3040 	qwz_mhi_init_mmio(psc);
3041 
3042 	/* Notify event rings. */
3043 	for (i = 0; i < nitems(psc->event_rings); i++) {
3044 		struct qwz_pci_event_ring *ring = &psc->event_rings[i];
3045 		qwz_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
3046 	}
3047 
3048 	/*
3049 	 * Set the device into M0 state. The device will transition
3050 	 * into M0 and the execution environment will switch to SBL.
3051 	 */
3052 	qwz_mhi_set_state(sc, MHI_STATE_M0);
3053 }
3054 
3055 void
3056 qwz_mhi_mission_mode_state_transition(struct qwz_pci_softc *psc)
3057 {
3058 	struct qwz_softc *sc = &psc->sc_sc;
3059 	int i;
3060 
3061 	qwz_mhi_device_wake(sc);
3062 
3063 	/* Notify event rings. */
3064 	for (i = 0; i < nitems(psc->event_rings); i++) {
3065 		struct qwz_pci_event_ring *ring = &psc->event_rings[i];
3066 		qwz_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
3067 	}
3068 
3069 	/* TODO: Notify transfer/command rings? */
3070 
3071 	qwz_mhi_device_zzz(sc);
3072 }
3073 
3074 void
3075 qwz_mhi_low_power_mode_state_transition(struct qwz_pci_softc *psc)
3076 {
3077 	struct qwz_softc *sc = &psc->sc_sc;
3078 
3079 	qwz_mhi_set_state(sc, MHI_STATE_M2);
3080 }
3081 
3082 void
3083 qwz_mhi_set_state(struct qwz_softc *sc, uint32_t state)
3084 {
3085 	uint32_t reg;
3086 
3087 	reg = qwz_pci_read(sc, MHI_CTRL);
3088 
3089 	if (state != MHI_STATE_RESET) {
3090 		reg &= ~MHI_CTRL_MHISTATE_MASK;
3091 		reg |= (state << MHI_CTRL_MHISTATE_SHFT) & MHI_CTRL_MHISTATE_MASK;
3092 	} else
3093 		reg |= MHI_CTRL_RESET_MASK;
3094 
3095 	qwz_pci_write(sc, MHI_CTRL, reg);
3096 }
3097 
3098 void
3099 qwz_mhi_init_mmio(struct qwz_pci_softc *psc)
3100 {
3101 	struct qwz_softc *sc = &psc->sc_sc;
3102 	uint64_t paddr;
3103 	uint32_t reg;
3104 	int i;
3105 
3106 	reg = qwz_pci_read(sc, MHI_CHDBOFF);
3107 
3108 	/* Set device wake doorbell address. */
3109 	psc->wake_db = reg + 8 * MHI_DEV_WAKE_DB;
3110 
3111 	/* Set doorbell address for each transfer ring. */
3112 	for (i = 0; i < nitems(psc->xfer_rings); i++) {
3113 		struct qwz_pci_xfer_ring *ring = &psc->xfer_rings[i];
3114 		ring->db_addr = reg + (8 * ring->mhi_chan_id);
3115 	}
3116 
3117 	reg = qwz_pci_read(sc, MHI_ERDBOFF);
3118 	/* Set doorbell address for each event ring. */
3119 	for (i = 0; i < nitems(psc->event_rings); i++) {
3120 		struct qwz_pci_event_ring *ring = &psc->event_rings[i];
3121 		ring->db_addr = reg + (8 * i);
3122 	}
3123 
3124 	paddr = QWZ_DMA_DVA(psc->chan_ctxt);
3125 	qwz_pci_write(sc, MHI_CCABAP_HIGHER, paddr >> 32);
3126 	qwz_pci_write(sc, MHI_CCABAP_LOWER, paddr & 0xffffffff);
3127 
3128 	paddr = QWZ_DMA_DVA(psc->event_ctxt);
3129 	qwz_pci_write(sc, MHI_ECABAP_HIGHER, paddr >> 32);
3130 	qwz_pci_write(sc, MHI_ECABAP_LOWER, paddr & 0xffffffff);
3131 
3132 	paddr = QWZ_DMA_DVA(psc->cmd_ctxt);
3133 	qwz_pci_write(sc, MHI_CRCBAP_HIGHER, paddr >> 32);
3134 	qwz_pci_write(sc, MHI_CRCBAP_LOWER, paddr & 0xffffffff);
3135 
3136 	/* Not (yet?) using fixed memory space from a device-tree. */
3137 	qwz_pci_write(sc, MHI_CTRLBASE_HIGHER, 0);
3138 	qwz_pci_write(sc, MHI_CTRLBASE_LOWER, 0);
3139 	qwz_pci_write(sc, MHI_DATABASE_HIGHER, 0);
3140 	qwz_pci_write(sc, MHI_DATABASE_LOWER, 0);
3141 	qwz_pci_write(sc, MHI_CTRLLIMIT_HIGHER, 0x0);
3142 	qwz_pci_write(sc, MHI_CTRLLIMIT_LOWER, 0xffffffff);
3143 	qwz_pci_write(sc, MHI_DATALIMIT_HIGHER, 0x0);
3144 	qwz_pci_write(sc, MHI_DATALIMIT_LOWER, 0xffffffff);
3145 
3146 	reg = qwz_pci_read(sc, MHI_CFG);
3147 	reg &= ~(MHI_CFG_NER_MASK | MHI_CFG_NHWER_MASK);
3148 	reg |= QWZ_NUM_EVENT_CTX << MHI_CFG_NER_SHFT;
3149 	qwz_pci_write(sc, MHI_CFG, reg);
3150 }
3151 
3152 int
3153 qwz_mhi_fw_load_bhi(struct qwz_pci_softc *psc, uint8_t *data, size_t len)
3154 {
3155 	struct qwz_softc *sc = &psc->sc_sc;
3156 	struct qwz_dmamem *data_adm;
3157 	uint32_t seq, reg, status = MHI_BHI_STATUS_RESET;
3158 	uint64_t paddr;
3159 	int ret;
3160 
3161 	data_adm = qwz_dmamem_alloc(sc->sc_dmat, len, 0);
3162 	if (data_adm == NULL) {
3163 		printf("%s: could not allocate BHI DMA data buffer\n",
3164 		    sc->sc_dev.dv_xname);
3165 		return 1;
3166 	}
3167 
3168 	/* Copy firmware image to DMA memory. */
3169 	memcpy(QWZ_DMA_KVA(data_adm), data, len);
3170 
3171 	qwz_pci_write(sc, psc->bhi_off + MHI_BHI_STATUS, 0);
3172 
3173 	/* Set data physical address and length. */
3174 	paddr = QWZ_DMA_DVA(data_adm);
3175 	qwz_pci_write(sc, psc->bhi_off + MHI_BHI_IMGADDR_HIGH, paddr >> 32);
3176 	qwz_pci_write(sc, psc->bhi_off + MHI_BHI_IMGADDR_LOW,
3177 	    paddr & 0xffffffff);
3178 	qwz_pci_write(sc, psc->bhi_off + MHI_BHI_IMGSIZE, len);
3179 
3180 	/* Set a random transaction sequence number. */
3181 	do {
3182 		seq = arc4random_uniform(MHI_BHI_TXDB_SEQNUM_BMSK);
3183 	} while (seq == 0);
3184 	qwz_pci_write(sc, psc->bhi_off + MHI_BHI_IMGTXDB, seq);
3185 
3186 	/* Wait for completion. */
3187 	ret = 0;
3188 	while (status != MHI_BHI_STATUS_SUCCESS && psc->bhi_ee < MHI_EE_SBL) {
3189 		ret = tsleep_nsec(&psc->bhi_ee, 0, "qwzbhi", SEC_TO_NSEC(5));
3190 		if (ret)
3191 			break;
3192 		reg = qwz_pci_read(sc, psc->bhi_off + MHI_BHI_STATUS);
3193 		status = (reg & MHI_BHI_STATUS_MASK) >> MHI_BHI_STATUS_SHFT;
3194 	}
3195 
3196 	if (ret) {
3197 		printf("%s: BHI load timeout\n", sc->sc_dev.dv_xname);
3198 		reg = qwz_pci_read(sc, psc->bhi_off + MHI_BHI_STATUS);
3199 		status = (reg & MHI_BHI_STATUS_MASK) >> MHI_BHI_STATUS_SHFT;
3200 		DNPRINTF(QWZ_D_MHI, "%s: BHI status is 0x%x EE is 0x%x\n",
3201 		    __func__, status, psc->bhi_ee);
3202 	}
3203 
3204 	qwz_dmamem_free(sc->sc_dmat, data_adm);
3205 	return ret;
3206 }
3207 
3208 int
3209 qwz_mhi_fw_load_bhie(struct qwz_pci_softc *psc, uint8_t *data, size_t len)
3210 {
3211 	struct qwz_softc *sc = &psc->sc_sc;
3212 	struct qwz_dma_vec_entry *vec;
3213 	uint32_t seq, reg, state = MHI_BHIE_TXVECSTATUS_STATUS_RESET;
3214 	uint64_t paddr;
3215 	const size_t chunk_size = MHI_DMA_VEC_CHUNK_SIZE;
3216 	size_t nseg, remain, vec_size;
3217 	int i, ret;
3218 
3219 	nseg = howmany(len, chunk_size);
3220 	if (nseg == 0) {
3221 		printf("%s: BHIE data too short, have only %zu bytes\n",
3222 		    sc->sc_dev.dv_xname, len);
3223 		return 1;
3224 	}
3225 
3226 	if (psc->amss_data == NULL || QWZ_DMA_LEN(psc->amss_data) < len) {
3227 		if (psc->amss_data)
3228 			qwz_dmamem_free(sc->sc_dmat, psc->amss_data);
3229 		psc->amss_data = qwz_dmamem_alloc(sc->sc_dmat, len, 0);
3230 		if (psc->amss_data == NULL) {
3231 			printf("%s: could not allocate BHIE DMA data buffer\n",
3232 			    sc->sc_dev.dv_xname);
3233 			return 1;
3234 		}
3235 	}
3236 
3237 	vec_size = nseg * sizeof(*vec);
3238 	if (psc->amss_vec == NULL || QWZ_DMA_LEN(psc->amss_vec) < vec_size) {
3239 		if (psc->amss_vec)
3240 			qwz_dmamem_free(sc->sc_dmat, psc->amss_vec);
3241 		psc->amss_vec = qwz_dmamem_alloc(sc->sc_dmat, vec_size, 0);
3242 		if (psc->amss_vec == NULL) {
3243 			printf("%s: could not allocate BHIE DMA vec buffer\n",
3244 			    sc->sc_dev.dv_xname);
3245 			qwz_dmamem_free(sc->sc_dmat, psc->amss_data);
3246 			psc->amss_data = NULL;
3247 			return 1;
3248 		}
3249 	}
3250 
3251 	/* Copy firmware image to DMA memory. */
3252 	memcpy(QWZ_DMA_KVA(psc->amss_data), data, len);
3253 
3254 	/* Create vector which controls chunk-wise DMA copy in hardware. */
3255 	paddr = QWZ_DMA_DVA(psc->amss_data);
3256 	vec = QWZ_DMA_KVA(psc->amss_vec);
3257 	remain = len;
3258 	for (i = 0; i < nseg; i++) {
3259 		vec[i].paddr = paddr;
3260 		if (remain >= chunk_size) {
3261 			vec[i].size = chunk_size;
3262 			remain -= chunk_size;
3263 			paddr += chunk_size;
3264 		} else
3265 			vec[i].size = remain;
3266 	}
3267 
3268 	/* Set vector physical address and length. */
3269 	paddr = QWZ_DMA_DVA(psc->amss_vec);
3270 	qwz_pci_write(sc, psc->bhie_off + MHI_BHIE_TXVECADDR_HIGH_OFFS,
3271 	    paddr >> 32);
3272 	qwz_pci_write(sc, psc->bhie_off + MHI_BHIE_TXVECADDR_LOW_OFFS,
3273 	    paddr & 0xffffffff);
3274 	qwz_pci_write(sc, psc->bhie_off + MHI_BHIE_TXVECSIZE_OFFS, vec_size);
3275 
3276 	/* Set a random transaction sequence number. */
3277 	do {
3278 		seq = arc4random_uniform(MHI_BHIE_TXVECSTATUS_SEQNUM_BMSK);
3279 	} while (seq == 0);
3280 	reg = qwz_pci_read(sc, psc->bhie_off + MHI_BHIE_TXVECDB_OFFS);
3281 	reg &= ~MHI_BHIE_TXVECDB_SEQNUM_BMSK;
3282 	reg |= seq << MHI_BHIE_TXVECDB_SEQNUM_SHFT;
3283 	qwz_pci_write(sc, psc->bhie_off + MHI_BHIE_TXVECDB_OFFS, reg);
3284 
3285 	/* Wait for completion. */
3286 	ret = 0;
3287 	while (state != MHI_BHIE_TXVECSTATUS_STATUS_XFER_COMPL) {
3288 		ret = tsleep_nsec(&psc->bhie_off, 0, "qwzbhie",
3289 		    SEC_TO_NSEC(5));
3290 		if (ret)
3291 			break;
3292 		reg = qwz_pci_read(sc,
3293 		    psc->bhie_off + MHI_BHIE_TXVECSTATUS_OFFS);
3294 		state = (reg & MHI_BHIE_TXVECSTATUS_STATUS_BMSK) >>
3295 		    MHI_BHIE_TXVECSTATUS_STATUS_SHFT;
3296 		DNPRINTF(QWZ_D_MHI, "%s: txvec state is 0x%x\n", __func__,
3297 		    state);
3298 	}
3299 
3300 	if (ret) {
3301 		printf("%s: BHIE load timeout\n", sc->sc_dev.dv_xname);
3302 		return ret;
3303 	}
3304 	return 0;
3305 }
3306 
3307 void
3308 qwz_rddm_prepare(struct qwz_pci_softc *psc)
3309 {
3310 	struct qwz_softc *sc = &psc->sc_sc;
3311 	struct qwz_dma_vec_entry *vec;
3312 	struct qwz_dmamem *data_adm, *vec_adm;
3313 	uint32_t seq, reg;
3314 	uint64_t paddr;
3315 	const size_t len = QWZ_RDDM_DUMP_SIZE;
3316 	const size_t chunk_size = MHI_DMA_VEC_CHUNK_SIZE;
3317 	size_t nseg, remain, vec_size;
3318 	int i;
3319 
3320 	nseg = howmany(len, chunk_size);
3321 	if (nseg == 0) {
3322 		printf("%s: RDDM data too short, have only %zu bytes\n",
3323 		    sc->sc_dev.dv_xname, len);
3324 		return;
3325 	}
3326 
3327 	data_adm = qwz_dmamem_alloc(sc->sc_dmat, len, 0);
3328 	if (data_adm == NULL) {
3329 		printf("%s: could not allocate BHIE DMA data buffer\n",
3330 		    sc->sc_dev.dv_xname);
3331 		return;
3332 	}
3333 
3334 	vec_size = nseg * sizeof(*vec);
3335 	vec_adm = qwz_dmamem_alloc(sc->sc_dmat, vec_size, 0);
3336 	if (vec_adm == NULL) {
3337 		printf("%s: could not allocate BHIE DMA vector buffer\n",
3338 		    sc->sc_dev.dv_xname);
3339 		qwz_dmamem_free(sc->sc_dmat, data_adm);
3340 		return;
3341 	}
3342 
3343 	/* Create vector which controls chunk-wise DMA copy from hardware. */
3344 	paddr = QWZ_DMA_DVA(data_adm);
3345 	vec = QWZ_DMA_KVA(vec_adm);
3346 	remain = len;
3347 	for (i = 0; i < nseg; i++) {
3348 		vec[i].paddr = paddr;
3349 		if (remain >= chunk_size) {
3350 			vec[i].size = chunk_size;
3351 			remain -= chunk_size;
3352 			paddr += chunk_size;
3353 		} else
3354 			vec[i].size = remain;
3355 	}
3356 
3357 	/* Set vector physical address and length. */
3358 	paddr = QWZ_DMA_DVA(vec_adm);
3359 	qwz_pci_write(sc, psc->bhie_off + MHI_BHIE_RXVECADDR_HIGH_OFFS,
3360 	    paddr >> 32);
3361 	qwz_pci_write(sc, psc->bhie_off + MHI_BHIE_RXVECADDR_LOW_OFFS,
3362 	    paddr & 0xffffffff);
3363 	qwz_pci_write(sc, psc->bhie_off + MHI_BHIE_RXVECSIZE_OFFS, vec_size);
3364 
3365 	/* Set a random transaction sequence number. */
3366 	do {
3367 		seq = arc4random_uniform(MHI_BHIE_RXVECSTATUS_SEQNUM_BMSK);
3368 	} while (seq == 0);
3369 
3370 	reg = qwz_pci_read(sc, psc->bhie_off + MHI_BHIE_RXVECDB_OFFS);
3371 	reg &= ~MHI_BHIE_RXVECDB_SEQNUM_BMSK;
3372 	reg |= seq << MHI_BHIE_RXVECDB_SEQNUM_SHFT;
3373 	qwz_pci_write(sc, psc->bhie_off + MHI_BHIE_RXVECDB_OFFS, reg);
3374 
3375 	psc->rddm_data = data_adm;
3376 	psc->rddm_vec = vec_adm;
3377 }
3378 
3379 #ifdef QWZ_DEBUG
3380 void
3381 qwz_rddm_task(void *arg)
3382 {
3383 	struct qwz_pci_softc *psc = arg;
3384 	struct qwz_softc *sc = &psc->sc_sc;
3385 	uint32_t reg, state = MHI_BHIE_RXVECSTATUS_STATUS_RESET;
3386 	const size_t len = QWZ_RDDM_DUMP_SIZE;
3387 	int i, timeout;
3388 	const uint32_t msecs = 100, retries = 20;
3389 	uint8_t *rddm;
3390 	struct nameidata nd;
3391 	struct vnode *vp = NULL;
3392 	struct iovec iov[3];
3393 	struct uio uio;
3394 	char path[PATH_MAX];
3395 	int error = 0;
3396 
3397 	if (psc->rddm_data == NULL) {
3398 		DPRINTF("%s: RDDM not prepared\n", __func__);
3399 		return;
3400 	}
3401 
3402 	/* Poll for completion */
3403 	timeout = retries;
3404 	while (timeout > 0 && state != MHI_BHIE_RXVECSTATUS_STATUS_XFER_COMPL) {
3405 		reg = qwz_pci_read(sc,
3406 		    psc->bhie_off + MHI_BHIE_RXVECSTATUS_OFFS);
3407 		state = (reg & MHI_BHIE_RXVECSTATUS_STATUS_BMSK) >>
3408 		    MHI_BHIE_RXVECSTATUS_STATUS_SHFT;
3409 		DPRINTF("%s: txvec state is 0x%x\n", __func__, state);
3410 		DELAY((msecs / retries) * 1000);
3411 		timeout--;
3412 	}
3413 
3414 	if (timeout == 0) {
3415 		DPRINTF("%s: RDDM dump failed\n", sc->sc_dev.dv_xname);
3416 		return;
3417 	}
3418 
3419 	rddm = QWZ_DMA_KVA(psc->rddm_data);
3420 	DPRINTF("%s: RDDM snippet:\n", __func__);
3421 	for (i = 0; i < MIN(64, len); i++) {
3422 		DPRINTF("%s %.2x", i % 16 == 0 ? "\n" : "", rddm[i]);
3423 	}
3424 	DPRINTF("\n");
3425 
3426 	DPRINTF("%s: sleeping for 30 seconds to allow userland to boot\n", __func__);
3427 	tsleep_nsec(&psc->rddm_data, 0, "qwzrddm", SEC_TO_NSEC(30));
3428 
3429 	snprintf(path, sizeof(path), "/root/%s-rddm.bin", sc->sc_dev.dv_xname);
3430 	DPRINTF("%s: saving RDDM to %s\n", __func__, path);
3431 	NDINIT(&nd, 0, 0, UIO_SYSSPACE, path, curproc);
3432 	nd.ni_pledge = PLEDGE_CPATH | PLEDGE_WPATH;
3433 	nd.ni_unveil = UNVEIL_CREATE | UNVEIL_WRITE;
3434 	error = vn_open(&nd, FWRITE | O_CREAT | O_NOFOLLOW | O_TRUNC,
3435 	    S_IRUSR | S_IWUSR);
3436 	if (error) {
3437 		DPRINTF("%s: vn_open: error %d\n", __func__, error);
3438 		goto done;
3439 	}
3440 	vp = nd.ni_vp;
3441 	VOP_UNLOCK(vp);
3442 
3443 	iov[0].iov_base = (void *)rddm;
3444 	iov[0].iov_len = len;
3445 	iov[1].iov_len = 0;
3446 	uio.uio_iov = &iov[0];
3447 	uio.uio_offset = 0;
3448 	uio.uio_segflg = UIO_SYSSPACE;
3449 	uio.uio_rw = UIO_WRITE;
3450 	uio.uio_resid = len;
3451 	uio.uio_iovcnt = 1;
3452 	uio.uio_procp = curproc;
3453 	error = vget(vp, LK_EXCLUSIVE | LK_RETRY);
3454 	if (error) {
3455 		DPRINTF("%s: vget: error %d\n", __func__, error);
3456 		goto done;
3457 	}
3458 	error = VOP_WRITE(vp, &uio, IO_UNIT|IO_APPEND, curproc->p_ucred);
3459 	vput(vp);
3460 	if (error)
3461 		DPRINTF("%s: VOP_WRITE: error %d\n", __func__, error);
3462 	#if 0
3463 	error = vn_close(vp, FWRITE, curproc->p_ucred, curproc);
3464 	if (error)
3465 		DPRINTF("%s: vn_close: error %d\n", __func__, error);
3466 	#endif
3467 done:
3468 	qwz_dmamem_free(sc->sc_dmat, psc->rddm_data);
3469 	qwz_dmamem_free(sc->sc_dmat, psc->rddm_vec);
3470 	psc->rddm_data = NULL;
3471 	psc->rddm_vec = NULL;
3472 	DPRINTF("%s: done, error %d\n", __func__, error);
3473 }
3474 #endif
3475 
3476 void *
3477 qwz_pci_event_ring_get_elem(struct qwz_pci_event_ring *ring, uint64_t rp)
3478 {
3479 	uint64_t base = QWZ_DMA_DVA(ring->dmamem), offset;
3480 	void *addr = QWZ_DMA_KVA(ring->dmamem);
3481 
3482 	if (rp < base)
3483 		return NULL;
3484 
3485 	offset = rp - base;
3486 	if (offset >= ring->size)
3487 		return NULL;
3488 
3489 	return addr + offset;
3490 }
3491 
3492 void
3493 qwz_mhi_state_change(struct qwz_pci_softc *psc, int ee, int mhi_state)
3494 {
3495 	struct qwz_softc *sc = &psc->sc_sc;
3496 	uint32_t old_ee = psc->bhi_ee;
3497 	uint32_t old_mhi_state = psc->mhi_state;
3498 
3499 	if (ee != -1 && psc->bhi_ee != ee) {
3500 		switch (ee) {
3501 		case MHI_EE_PBL:
3502 			DNPRINTF(QWZ_D_MHI, "%s: new EE PBL\n",
3503 			    sc->sc_dev.dv_xname);
3504 			psc->bhi_ee = ee;
3505 			break;
3506 		case MHI_EE_SBL:
3507 			psc->bhi_ee = ee;
3508 			DNPRINTF(QWZ_D_MHI, "%s: new EE SBL\n",
3509 			    sc->sc_dev.dv_xname);
3510 			break;
3511 		case MHI_EE_AMSS:
3512 			DNPRINTF(QWZ_D_MHI, "%s: new EE AMSS\n",
3513 			    sc->sc_dev.dv_xname);
3514 			psc->bhi_ee = ee;
3515 			/* Wake thread loading the full AMSS image. */
3516 			wakeup(&psc->bhie_off);
3517 			break;
3518 		case MHI_EE_WFW:
3519 			DNPRINTF(QWZ_D_MHI, "%s: new EE WFW\n",
3520 			    sc->sc_dev.dv_xname);
3521 			psc->bhi_ee = ee;
3522 			break;
3523 		default:
3524 			printf("%s: unhandled EE change to %x\n",
3525 			    sc->sc_dev.dv_xname, ee);
3526 			break;
3527 		}
3528 	}
3529 
3530 	if (mhi_state != -1 && psc->mhi_state != mhi_state) {
3531 		switch (mhi_state) {
3532 		case -1:
3533 			break;
3534 		case MHI_STATE_RESET:
3535 			DNPRINTF(QWZ_D_MHI, "%s: new MHI state RESET\n",
3536 			    sc->sc_dev.dv_xname);
3537 			psc->mhi_state = mhi_state;
3538 			break;
3539 		case MHI_STATE_READY:
3540 			DNPRINTF(QWZ_D_MHI, "%s: new MHI state READY\n",
3541 			    sc->sc_dev.dv_xname);
3542 			psc->mhi_state = mhi_state;
3543 			qwz_mhi_ready_state_transition(psc);
3544 			break;
3545 		case MHI_STATE_M0:
3546 			DNPRINTF(QWZ_D_MHI, "%s: new MHI state M0\n",
3547 			    sc->sc_dev.dv_xname);
3548 			psc->mhi_state = mhi_state;
3549 			qwz_mhi_mission_mode_state_transition(psc);
3550 			break;
3551 		case MHI_STATE_M1:
3552 			DNPRINTF(QWZ_D_MHI, "%s: new MHI state M1\n",
3553 			    sc->sc_dev.dv_xname);
3554 			psc->mhi_state = mhi_state;
3555 			qwz_mhi_low_power_mode_state_transition(psc);
3556 			break;
3557 		case MHI_STATE_SYS_ERR:
3558 			DNPRINTF(QWZ_D_MHI,
3559 			    "%s: new MHI state SYS ERR\n",
3560 			    sc->sc_dev.dv_xname);
3561 			psc->mhi_state = mhi_state;
3562 			break;
3563 		default:
3564 			printf("%s: unhandled MHI state change to %x\n",
3565 			    sc->sc_dev.dv_xname, mhi_state);
3566 			break;
3567 		}
3568 	}
3569 
3570 	if (old_ee != psc->bhi_ee)
3571 		wakeup(&psc->bhi_ee);
3572 	if (old_mhi_state != psc->mhi_state)
3573 		wakeup(&psc->mhi_state);
3574 }
3575 
3576 void
3577 qwz_pci_intr_ctrl_event_mhi(struct qwz_pci_softc *psc, uint32_t mhi_state)
3578 {
3579 	DNPRINTF(QWZ_D_MHI, "%s: MHI state change 0x%x -> 0x%x\n", __func__,
3580 	    psc->mhi_state, mhi_state);
3581 
3582 	if (psc->mhi_state != mhi_state)
3583 		qwz_mhi_state_change(psc, -1, mhi_state);
3584 }
3585 
3586 void
3587 qwz_pci_intr_ctrl_event_ee(struct qwz_pci_softc *psc, uint32_t ee)
3588 {
3589 	DNPRINTF(QWZ_D_MHI, "%s: EE change 0x%x to 0x%x\n", __func__,
3590 	    psc->bhi_ee, ee);
3591 
3592 	if (psc->bhi_ee != ee)
3593 		qwz_mhi_state_change(psc, ee, -1);
3594 }
3595 
3596 void
3597 qwz_pci_intr_ctrl_event_cmd_complete(struct qwz_pci_softc *psc,
3598     uint64_t ptr, uint32_t cmd_status)
3599 {
3600 	struct qwz_pci_cmd_ring	*cmd_ring = &psc->cmd_ring;
3601 	uint64_t base = QWZ_DMA_DVA(cmd_ring->dmamem);
3602 	struct qwz_pci_xfer_ring *xfer_ring = NULL;
3603 	struct qwz_mhi_ring_element *e;
3604 	uint32_t tre1, chid;
3605 	size_t i;
3606 
3607 	e = qwz_pci_cmd_ring_get_elem(cmd_ring, ptr);
3608 	if (e == NULL)
3609 		return;
3610 
3611 	tre1 = le32toh(e->dword[1]);
3612 	chid = (tre1 & MHI_TRE1_EV_CHID_MASK) >> MHI_TRE1_EV_CHID_SHFT;
3613 
3614 	for (i = 0; i < nitems(psc->xfer_rings); i++) {
3615 		if (psc->xfer_rings[i].mhi_chan_id == chid) {
3616 			xfer_ring = &psc->xfer_rings[i];
3617 			break;
3618 		}
3619 	}
3620 	if (xfer_ring == NULL) {
3621 		printf("%s: no transfer ring found for command completion "
3622 		    "on channel %u\n", __func__, chid);
3623 		return;
3624 	}
3625 
3626 	xfer_ring->cmd_status = cmd_status;
3627 	wakeup(&xfer_ring->cmd_status);
3628 
3629 	if (cmd_ring->rp + sizeof(*e) >= base + cmd_ring->size)
3630 		cmd_ring->rp = base;
3631 	else
3632 		cmd_ring->rp += sizeof(*e);
3633 }
3634 
3635 int
3636 qwz_pci_intr_ctrl_event(struct qwz_pci_softc *psc, struct qwz_pci_event_ring *ring)
3637 {
3638 	struct qwz_softc *sc = &psc->sc_sc;
3639 	struct qwz_mhi_event_ctxt *c;
3640 	uint64_t rp, wp, base;
3641 	struct qwz_mhi_ring_element *e;
3642 	uint32_t tre0, tre1, type, code, chid, len;
3643 
3644 	c = ring->event_ctxt;
3645 	if (c == NULL) {
3646 		/*
3647 		 * Interrupts can trigger before mhi_init_event_rings()
3648 		 * if the device is still active after a warm reboot.
3649 		 */
3650 		return 0;
3651 	}
3652 
3653 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(psc->event_ctxt), 0,
3654 	    QWZ_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_POSTREAD);
3655 
3656 	rp = le64toh(c->rp);
3657 	wp = le64toh(c->wp);
3658 
3659 	DNPRINTF(QWZ_D_MHI, "%s: kernel rp=0x%llx\n", __func__, ring->rp);
3660 	DNPRINTF(QWZ_D_MHI, "%s: device rp=0x%llx\n", __func__, rp);
3661 	DNPRINTF(QWZ_D_MHI, "%s: kernel wp=0x%llx\n", __func__, ring->wp);
3662 	DNPRINTF(QWZ_D_MHI, "%s: device wp=0x%llx\n", __func__, wp);
3663 
3664 	base = QWZ_DMA_DVA(ring->dmamem);
3665 	if (ring->rp == rp || rp < base || rp >= base + ring->size)
3666 		return 0;
3667 	if (wp < base || wp >= base + ring->size)
3668 		return 0;
3669 
3670 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(ring->dmamem),
3671 	    0, QWZ_DMA_LEN(ring->dmamem), BUS_DMASYNC_POSTREAD);
3672 
3673 	while (ring->rp != rp) {
3674 		e = qwz_pci_event_ring_get_elem(ring, ring->rp);
3675 		if (e == NULL)
3676 			return 0;
3677 
3678 		tre0 = le32toh(e->dword[0]);
3679 		tre1 = le32toh(e->dword[1]);
3680 
3681 		len = (tre0 & MHI_TRE0_EV_LEN_MASK) >> MHI_TRE0_EV_LEN_SHFT;
3682 		code = (tre0 & MHI_TRE0_EV_CODE_MASK) >> MHI_TRE0_EV_CODE_SHFT;
3683 		type = (tre1 & MHI_TRE1_EV_TYPE_MASK) >> MHI_TRE1_EV_TYPE_SHFT;
3684 		chid = (tre1 & MHI_TRE1_EV_CHID_MASK) >> MHI_TRE1_EV_CHID_SHFT;
3685 		DNPRINTF(QWZ_D_MHI, "%s: len=%u code=0x%x type=0x%x chid=%d\n",
3686 		    __func__, len, code, type, chid);
3687 
3688 		switch (type) {
3689 		case MHI_PKT_TYPE_STATE_CHANGE_EVENT:
3690 			qwz_pci_intr_ctrl_event_mhi(psc, code);
3691 			break;
3692 		case MHI_PKT_TYPE_EE_EVENT:
3693 			qwz_pci_intr_ctrl_event_ee(psc, code);
3694 			break;
3695 		case MHI_PKT_TYPE_CMD_COMPLETION_EVENT:
3696 			qwz_pci_intr_ctrl_event_cmd_complete(psc,
3697 			    le64toh(e->ptr), code);
3698 			break;
3699 		default:
3700 			printf("%s: unhandled event type 0x%x\n",
3701 			    __func__, type);
3702 			break;
3703 		}
3704 
3705 		if (ring->rp + sizeof(*e) >= base + ring->size)
3706 			ring->rp = base;
3707 		else
3708 			ring->rp += sizeof(*e);
3709 
3710 		if (ring->wp + sizeof(*e) >= base + ring->size)
3711 			ring->wp = base;
3712 		else
3713 			ring->wp += sizeof(*e);
3714 	}
3715 
3716 	c->wp = htole64(ring->wp);
3717 
3718 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(psc->event_ctxt), 0,
3719 	    QWZ_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_PREWRITE);
3720 
3721 	qwz_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
3722 	return 1;
3723 }
3724 
3725 void
3726 qwz_pci_intr_data_event_tx(struct qwz_pci_softc *psc, struct qwz_mhi_ring_element *e)
3727 {
3728 	struct qwz_softc *sc = &psc->sc_sc;
3729 	struct qwz_pci_xfer_ring *ring;
3730 	struct qwz_xfer_data *xfer;
3731 	uint64_t rp, evrp, base, paddr;
3732 	uint32_t tre0, tre1, code, chid, evlen, len;
3733 	int i;
3734 
3735 	tre0 = le32toh(e->dword[0]);
3736 	tre1 = le32toh(e->dword[1]);
3737 
3738 	evlen = (tre0 & MHI_TRE0_EV_LEN_MASK) >> MHI_TRE0_EV_LEN_SHFT;
3739 	code = (tre0 & MHI_TRE0_EV_CODE_MASK) >> MHI_TRE0_EV_CODE_SHFT;
3740 	chid = (tre1 & MHI_TRE1_EV_CHID_MASK) >> MHI_TRE1_EV_CHID_SHFT;
3741 
3742 	switch (code) {
3743 	case MHI_EV_CC_EOT:
3744 		for (i = 0; i < nitems(psc->xfer_rings); i++) {
3745 			ring = &psc->xfer_rings[i];
3746 			if (ring->mhi_chan_id == chid)
3747 				break;
3748 		}
3749 		if (i == nitems(psc->xfer_rings)) {
3750 			printf("%s: unhandled channel 0x%x\n",
3751 			    __func__, chid);
3752 			break;
3753 		}
3754 		base = QWZ_DMA_DVA(ring->dmamem);
3755 		/* PTR contains the entry that was last written */
3756 		evrp = letoh64(e->ptr);
3757 		rp = evrp;
3758 		if (rp < base || rp >= base + ring->size) {
3759 			printf("%s: invalid ptr 0x%llx\n",
3760 			    __func__, rp);
3761 			break;
3762 		}
3763 		/* Point rp to next empty slot */
3764 		if (rp + sizeof(*e) >= base + ring->size)
3765 			rp = base;
3766 		else
3767 			rp += sizeof(*e);
3768 		/* Parse until next empty slot */
3769 		while (ring->rp != rp) {
3770 			DNPRINTF(QWZ_D_MHI, "%s:%d: ring->rp 0x%llx "
3771 			    "ring->wp 0x%llx rp 0x%llx\n", __func__,
3772 			    __LINE__, ring->rp, ring->wp, rp);
3773 			e = qwz_pci_xfer_ring_get_elem(ring, ring->rp);
3774 			xfer = qwz_pci_xfer_ring_get_data(ring, ring->rp);
3775 
3776 			if (ring->rp == evrp)
3777 				len = evlen;
3778 			else
3779 				len = xfer->m->m_pkthdr.len;
3780 
3781 			bus_dmamap_sync(sc->sc_dmat, xfer->map, 0,
3782 			    xfer->m->m_pkthdr.len, BUS_DMASYNC_POSTREAD);
3783 #ifdef QWZ_DEBUG
3784 			{
3785 			int i;
3786 			DNPRINTF(QWZ_D_MHI, "%s: chan %u data (len %u): ",
3787 			    __func__,
3788 			    ring->mhi_chan_id, len);
3789 			for (i = 0; i < MIN(32, len); i++) {
3790 				DNPRINTF(QWZ_D_MHI, "%02x ",
3791 				    (unsigned char)mtod(xfer->m, caddr_t)[i]);
3792 			}
3793 			if (i < len)
3794 				DNPRINTF(QWZ_D_MHI, "...");
3795 			DNPRINTF(QWZ_D_MHI, "\n");
3796 			}
3797 #endif
3798 			if (ring->mhi_chan_direction == MHI_CHAN_TYPE_INBOUND) {
3799 				/* Save m_data as upper layers use m_adj(9) */
3800 				void *o_data = xfer->m->m_data;
3801 
3802 				/* Pass mbuf to upper layers */
3803 				qwz_qrtr_recv_msg(sc, xfer->m);
3804 
3805 				/* Reset RX mbuf instead of free/alloc */
3806 				KASSERT(xfer->m->m_next == NULL);
3807 				xfer->m->m_data = o_data;
3808 				xfer->m->m_len = xfer->m->m_pkthdr.len =
3809 				    QWZ_PCI_XFER_MAX_DATA_SIZE;
3810 
3811 				paddr = xfer->map->dm_segs[0].ds_addr;
3812 
3813 				e->ptr = htole64(paddr);
3814 				e->dword[0] = htole32((
3815 				    QWZ_PCI_XFER_MAX_DATA_SIZE <<
3816 				    MHI_TRE0_DATA_LEN_SHFT) &
3817 				    MHI_TRE0_DATA_LEN_MASK);
3818 				e->dword[1] = htole32(MHI_TRE1_DATA_IEOT |
3819 				    MHI_TRE1_DATA_BEI |
3820 				    MHI_TRE1_DATA_TYPE_TRANSFER <<
3821 				    MHI_TRE1_DATA_TYPE_SHIFT);
3822 
3823 				if (ring->wp + sizeof(*e) >= base + ring->size)
3824 					ring->wp = base;
3825 				else
3826 					ring->wp += sizeof(*e);
3827 			} else {
3828 				/* Unload and free TX mbuf */
3829 				bus_dmamap_unload(sc->sc_dmat, xfer->map);
3830 				m_freem(xfer->m);
3831 				xfer->m = NULL;
3832 				ring->queued--;
3833 			}
3834 
3835 			if (ring->rp + sizeof(*e) >= base + ring->size)
3836 				ring->rp = base;
3837 			else
3838 				ring->rp += sizeof(*e);
3839 		}
3840 
3841 		if (ring->mhi_chan_direction == MHI_CHAN_TYPE_INBOUND) {
3842 			ring->chan_ctxt->wp = htole64(ring->wp);
3843 
3844 			bus_dmamap_sync(sc->sc_dmat,
3845 			    QWZ_DMA_MAP(psc->chan_ctxt), 0,
3846 			    QWZ_DMA_LEN(psc->chan_ctxt),
3847 			    BUS_DMASYNC_PREWRITE);
3848 
3849 			qwz_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
3850 		}
3851 		break;
3852 	default:
3853 		printf("%s: unhandled event code 0x%x\n",
3854 		    __func__, code);
3855 	}
3856 }
3857 
3858 int
3859 qwz_pci_intr_data_event(struct qwz_pci_softc *psc, struct qwz_pci_event_ring *ring)
3860 {
3861 	struct qwz_softc *sc = &psc->sc_sc;
3862 	struct qwz_mhi_event_ctxt *c;
3863 	uint64_t rp, wp, base;
3864 	struct qwz_mhi_ring_element *e;
3865 	uint32_t tre0, tre1, type, code, chid, len;
3866 
3867 	c = ring->event_ctxt;
3868 	if (c == NULL) {
3869 		/*
3870 		 * Interrupts can trigger before mhi_init_event_rings()
3871 		 * if the device is still active after a warm reboot.
3872 		 */
3873 		return 0;
3874 	}
3875 
3876 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(psc->event_ctxt), 0,
3877 	    QWZ_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_POSTREAD);
3878 
3879 	rp = le64toh(c->rp);
3880 	wp = le64toh(c->wp);
3881 
3882 	DNPRINTF(QWZ_D_MHI, "%s: kernel rp=0x%llx\n", __func__, ring->rp);
3883 	DNPRINTF(QWZ_D_MHI, "%s: device rp=0x%llx\n", __func__, rp);
3884 	DNPRINTF(QWZ_D_MHI, "%s: kernel wp=0x%llx\n", __func__, ring->wp);
3885 	DNPRINTF(QWZ_D_MHI, "%s: device wp=0x%llx\n", __func__, wp);
3886 
3887 	base = QWZ_DMA_DVA(ring->dmamem);
3888 	if (ring->rp == rp || rp < base || rp >= base + ring->size)
3889 		return 0;
3890 
3891 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(ring->dmamem),
3892 	    0, QWZ_DMA_LEN(ring->dmamem), BUS_DMASYNC_POSTREAD);
3893 
3894 	while (ring->rp != rp) {
3895 		e = qwz_pci_event_ring_get_elem(ring, ring->rp);
3896 		if (e == NULL)
3897 			return 0;
3898 
3899 		tre0 = le32toh(e->dword[0]);
3900 		tre1 = le32toh(e->dword[1]);
3901 
3902 		len = (tre0 & MHI_TRE0_EV_LEN_MASK) >> MHI_TRE0_EV_LEN_SHFT;
3903 		code = (tre0 & MHI_TRE0_EV_CODE_MASK) >> MHI_TRE0_EV_CODE_SHFT;
3904 		type = (tre1 & MHI_TRE1_EV_TYPE_MASK) >> MHI_TRE1_EV_TYPE_SHFT;
3905 		chid = (tre1 & MHI_TRE1_EV_CHID_MASK) >> MHI_TRE1_EV_CHID_SHFT;
3906 		DNPRINTF(QWZ_D_MHI, "%s: len=%u code=0x%x type=0x%x chid=%d\n",
3907 		    __func__, len, code, type, chid);
3908 
3909 		switch (type) {
3910 		case MHI_PKT_TYPE_TX_EVENT:
3911 			qwz_pci_intr_data_event_tx(psc, e);
3912 			break;
3913 		default:
3914 			printf("%s: unhandled event type 0x%x\n",
3915 			    __func__, type);
3916 			break;
3917 		}
3918 
3919 		if (ring->rp + sizeof(*e) >= base + ring->size)
3920 			ring->rp = base;
3921 		else
3922 			ring->rp += sizeof(*e);
3923 
3924 		if (ring->wp + sizeof(*e) >= base + ring->size)
3925 			ring->wp = base;
3926 		else
3927 			ring->wp += sizeof(*e);
3928 	}
3929 
3930 	c->wp = htole64(ring->wp);
3931 
3932 	bus_dmamap_sync(sc->sc_dmat, QWZ_DMA_MAP(psc->event_ctxt), 0,
3933 	    QWZ_DMA_LEN(psc->event_ctxt), BUS_DMASYNC_PREWRITE);
3934 
3935 	qwz_mhi_ring_doorbell(sc, ring->db_addr, ring->wp);
3936 	return 1;
3937 }
3938 
3939 int
3940 qwz_pci_intr_mhi_ctrl(void *arg)
3941 {
3942 	struct qwz_pci_softc *psc = arg;
3943 
3944 	if (qwz_pci_intr_ctrl_event(psc, &psc->event_rings[0]))
3945 		return 1;
3946 
3947 	return 0;
3948 }
3949 
3950 int
3951 qwz_pci_intr_mhi_data(void *arg)
3952 {
3953 	struct qwz_pci_softc *psc = arg;
3954 
3955 	if (qwz_pci_intr_data_event(psc, &psc->event_rings[1]))
3956 		return 1;
3957 
3958 	return 0;
3959 }
3960 
3961 int
3962 qwz_pci_intr(void *arg)
3963 {
3964 	struct qwz_pci_softc *psc = arg;
3965 	struct qwz_softc *sc = (void *)psc;
3966 	uint32_t ee, state;
3967 	int ret = 0;
3968 
3969 	/*
3970 	 * Interrupts can trigger before mhi_start() during boot if the device
3971 	 * is still active after a warm reboot.
3972 	 */
3973 	if (psc->bhi_off == 0)
3974 		psc->bhi_off = qwz_pci_read(sc, MHI_BHI_OFFSET);
3975 
3976 	ee = qwz_pci_read(sc, psc->bhi_off + MHI_BHI_EXECENV);
3977 	state = qwz_pci_read(sc, MHI_STATUS);
3978 	state = (state & MHI_STATUS_MHISTATE_MASK) >>
3979 	    MHI_STATUS_MHISTATE_SHFT;
3980 
3981 	DNPRINTF(QWZ_D_MHI,
3982 	    "%s: BHI interrupt with EE: 0x%x -> 0x%x state: 0x%x -> 0x%x\n",
3983 	     sc->sc_dev.dv_xname, psc->bhi_ee, ee, psc->mhi_state, state);
3984 
3985 	if (ee == MHI_EE_RDDM) {
3986 		/* Firmware crash, e.g. due to invalid DMA memory access. */
3987 		psc->bhi_ee = ee;
3988 #ifdef QWZ_DEBUG
3989 		if (!psc->rddm_triggered) {
3990 			/* Write fw memory dump to root's home directory. */
3991 			task_add(systq, &psc->rddm_task);
3992 			psc->rddm_triggered = 1;
3993 		}
3994 #else
3995 		printf("%s: fatal firmware error\n",
3996 		   sc->sc_dev.dv_xname);
3997 		if (!test_bit(ATH12K_FLAG_CRASH_FLUSH, sc->sc_flags) &&
3998 		    (sc->sc_ic.ic_if.if_flags & (IFF_UP | IFF_RUNNING)) ==
3999 		    (IFF_UP | IFF_RUNNING)) {
4000 			/* Try to reset the device. */
4001 			set_bit(ATH12K_FLAG_CRASH_FLUSH, sc->sc_flags);
4002 			task_add(systq, &sc->init_task);
4003 		}
4004 #endif
4005 		return 1;
4006 	} else if (psc->bhi_ee == MHI_EE_PBL || psc->bhi_ee == MHI_EE_SBL) {
4007 		int new_ee = -1, new_mhi_state = -1;
4008 
4009 		if (psc->bhi_ee != ee)
4010 			new_ee = ee;
4011 
4012 		if (psc->mhi_state != state)
4013 			new_mhi_state = state;
4014 
4015 		if (new_ee != -1 || new_mhi_state != -1)
4016 			qwz_mhi_state_change(psc, new_ee, new_mhi_state);
4017 
4018 		ret = 1;
4019 	}
4020 
4021 	if (!test_bit(ATH12K_FLAG_MULTI_MSI_VECTORS, sc->sc_flags)) {
4022 		int i;
4023 
4024 		if (qwz_pci_intr_ctrl_event(psc, &psc->event_rings[0]))
4025 			ret = 1;
4026 		if (qwz_pci_intr_data_event(psc, &psc->event_rings[1]))
4027 			ret = 1;
4028 
4029 		for (i = 0; i < sc->hw_params.ce_count; i++) {
4030 			struct qwz_ce_pipe *ce_pipe = &sc->ce.ce_pipe[i];
4031 
4032 			if (qwz_ce_intr(ce_pipe))
4033 				ret = 1;
4034 		}
4035 
4036 		if (test_bit(ATH12K_FLAG_EXT_IRQ_ENABLED, sc->sc_flags)) {
4037 			for (i = 0; i < nitems(sc->ext_irq_grp); i++) {
4038 				if (qwz_dp_service_srng(sc, i))
4039 					ret = 1;
4040 			}
4041 		}
4042 	}
4043 
4044 	return ret;
4045 }
4046