Home | History | Annotate | Line # | Download | only in acpi
      1 /*	$NetBSD: acpi_ec.c,v 1.108 2023/07/18 10:17:12 riastradh Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2007 Joerg Sonnenberger <joerg (at) NetBSD.org>.
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  *
     11  * 1. Redistributions of source code must retain the above copyright
     12  *    notice, this list of conditions and the following disclaimer.
     13  * 2. Redistributions in binary form must reproduce the above copyright
     14  *    notice, this list of conditions and the following disclaimer in
     15  *    the documentation and/or other materials provided with the
     16  *    distribution.
     17  *
     18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
     19  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
     20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
     21  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
     22  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
     23  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
     24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
     26  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
     27  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
     28  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     29  * SUCH DAMAGE.
     30  */
     31 
     32 /*
     33  * The ACPI Embedded Controller (EC) driver serves two different purposes:
     34  * - read and write access from ASL, e.g. to read battery state
     35  * - notification of ASL of System Control Interrupts.
     36  *
     37  * Lock order:
     38  *	sc_access_mtx (serializes EC transactions -- read, write, or SCI)
     39  *	-> ACPI global lock (excludes other ACPI access during EC transaction)
     40  *	-> sc_mtx (serializes state machine transitions and waits)
     41  *
     42  * SCIs are processed in a kernel thread.
     43  *
     44  * Read and write requests spin around for a short time as many requests
     45  * can be handled instantly by the EC.  During normal processing interrupt
     46  * mode is used exclusively.  At boot and resume time interrupts are not
     47  * working and the handlers just busy loop.
     48  *
     49  * A callout is scheduled to compensate for missing interrupts on some
     50  * hardware.  If the EC doesn't process a request for 5s, it is most likely
     51  * in a wedged state.  No method to reset the EC is currently known.
     52  *
     53  * Special care has to be taken to not poll the EC in a busy loop without
     54  * delay.  This can prevent processing of Power Button events. At least some
     55  * Lenovo Thinkpads seem to be implement the Power Button Override in the EC
     56  * and the only option to recover on those models is to cut off all power.
     57  */
     58 
     59 #include <sys/cdefs.h>
     60 __KERNEL_RCSID(0, "$NetBSD: acpi_ec.c,v 1.108 2023/07/18 10:17:12 riastradh Exp $");
     61 
     62 #ifdef _KERNEL_OPT
     63 #include "opt_acpi_ec.h"
     64 #endif
     65 
     66 #include <sys/param.h>
     67 #include <sys/callout.h>
     68 #include <sys/condvar.h>
     69 #include <sys/device.h>
     70 #include <sys/kernel.h>
     71 #include <sys/kthread.h>
     72 #include <sys/mutex.h>
     73 #include <sys/systm.h>
     74 
     75 #include <dev/acpi/acpireg.h>
     76 #include <dev/acpi/acpivar.h>
     77 #include <dev/acpi/acpi_ecvar.h>
     78 
     79 #define _COMPONENT          ACPI_EC_COMPONENT
     80 ACPI_MODULE_NAME            ("acpi_ec")
     81 
     82 /* Maximum time to wait for global ACPI lock in ms */
     83 #define	EC_LOCK_TIMEOUT		5
     84 
     85 /* Maximum time to poll for completion of a command  in ms */
     86 #define	EC_POLL_TIMEOUT		5
     87 
     88 /* Maximum time to give a single EC command in s */
     89 #define EC_CMD_TIMEOUT		10
     90 
     91 /* From ACPI 3.0b, chapter 12.3 */
     92 #define EC_COMMAND_READ		0x80
     93 #define	EC_COMMAND_WRITE	0x81
     94 #define	EC_COMMAND_BURST_EN	0x82
     95 #define	EC_COMMAND_BURST_DIS	0x83
     96 #define	EC_COMMAND_QUERY	0x84
     97 
     98 /* From ACPI 3.0b, chapter 12.2.1 */
     99 #define	EC_STATUS_OBF		0x01
    100 #define	EC_STATUS_IBF		0x02
    101 #define	EC_STATUS_CMD		0x08
    102 #define	EC_STATUS_BURST		0x10
    103 #define	EC_STATUS_SCI		0x20
    104 #define	EC_STATUS_SMI		0x40
    105 
    106 #define	EC_STATUS_FMT							      \
    107 	"\x10\10IGN7\7SMI\6SCI\5BURST\4CMD\3IGN2\2IBF\1OBF"
    108 
    109 static const struct device_compatible_entry compat_data[] = {
    110 	{ .compat = "PNP0C09" },
    111 	DEVICE_COMPAT_EOL
    112 };
    113 
    114 #define	EC_STATE_ENUM(F)						      \
    115 	F(EC_STATE_QUERY, "QUERY")					      \
    116 	F(EC_STATE_QUERY_VAL, "QUERY_VAL")				      \
    117 	F(EC_STATE_READ, "READ")					      \
    118 	F(EC_STATE_READ_ADDR, "READ_ADDR")				      \
    119 	F(EC_STATE_READ_VAL, "READ_VAL")				      \
    120 	F(EC_STATE_WRITE, "WRITE")					      \
    121 	F(EC_STATE_WRITE_ADDR, "WRITE_ADDR")				      \
    122 	F(EC_STATE_WRITE_VAL, "WRITE_VAL")				      \
    123 	F(EC_STATE_FREE, "FREE")					      \
    124 
    125 enum ec_state_t {
    126 #define	F(N, S)	N,
    127 	EC_STATE_ENUM(F)
    128 #undef F
    129 };
    130 
    131 #ifdef ACPIEC_DEBUG
    132 static const char *const acpiec_state_names[] = {
    133 #define F(N, S)	[N] = S,
    134 	EC_STATE_ENUM(F)
    135 #undef F
    136 };
    137 #endif
    138 
    139 struct acpiec_softc {
    140 	device_t sc_dev;
    141 
    142 	ACPI_HANDLE sc_ech;
    143 
    144 	ACPI_HANDLE sc_gpeh;
    145 	uint8_t sc_gpebit;
    146 
    147 	bus_space_tag_t sc_data_st;
    148 	bus_space_handle_t sc_data_sh;
    149 
    150 	bus_space_tag_t sc_csr_st;
    151 	bus_space_handle_t sc_csr_sh;
    152 
    153 	bool sc_need_global_lock;
    154 	uint32_t sc_global_lock;
    155 
    156 	kmutex_t sc_mtx, sc_access_mtx;
    157 	kcondvar_t sc_cv, sc_cv_sci;
    158 	enum ec_state_t sc_state;
    159 	bool sc_got_sci;
    160 	callout_t sc_pseudo_intr;
    161 
    162 	uint8_t sc_cur_addr, sc_cur_val;
    163 };
    164 
    165 #ifdef ACPIEC_DEBUG
    166 
    167 #define	ACPIEC_DEBUG_ENUM(F)						      \
    168 	F(ACPIEC_DEBUG_REG, "REG")					      \
    169 	F(ACPIEC_DEBUG_RW, "RW")					      \
    170 	F(ACPIEC_DEBUG_QUERY, "QUERY")					      \
    171 	F(ACPIEC_DEBUG_TRANSITION, "TRANSITION")			      \
    172 	F(ACPIEC_DEBUG_INTR, "INTR")					      \
    173 
    174 enum {
    175 #define	F(N, S)	N,
    176 	ACPIEC_DEBUG_ENUM(F)
    177 #undef F
    178 };
    179 
    180 static const char *const acpiec_debug_names[] = {
    181 #define	F(N, S)	[N] = S,
    182 	ACPIEC_DEBUG_ENUM(F)
    183 #undef F
    184 };
    185 
    186 int acpiec_debug = ACPIEC_DEBUG;
    187 
    188 #define	DPRINTF(n, sc, fmt, ...) do					      \
    189 {									      \
    190 	if (acpiec_debug & __BIT(n)) {					      \
    191 		char dprintbuf[16];					      \
    192 		const char *state;					      \
    193 									      \
    194 		/* paranoia */						      \
    195 		if ((sc)->sc_state < __arraycount(acpiec_state_names)) {      \
    196 			state = acpiec_state_names[(sc)->sc_state];	      \
    197 		} else {						      \
    198 			snprintf(dprintbuf, sizeof(dprintbuf), "0x%x",	      \
    199 			    (sc)->sc_state);				      \
    200 			state = dprintbuf;				      \
    201 		}							      \
    202 									      \
    203 		device_printf((sc)->sc_dev, "(%s) [%s] "fmt,		      \
    204 		    acpiec_debug_names[n], state, ##__VA_ARGS__);	      \
    205 	}								      \
    206 } while (0)
    207 
    208 #else
    209 
    210 #define	DPRINTF(n, sc, fmt, ...)	__nothing
    211 
    212 #endif
    213 
    214 static int acpiecdt_match(device_t, cfdata_t, void *);
    215 static void acpiecdt_attach(device_t, device_t, void *);
    216 
    217 static int acpiec_match(device_t, cfdata_t, void *);
    218 static void acpiec_attach(device_t, device_t, void *);
    219 
    220 static void acpiec_common_attach(device_t, device_t, ACPI_HANDLE,
    221     bus_space_tag_t, bus_addr_t, bus_space_tag_t, bus_addr_t,
    222     ACPI_HANDLE, uint8_t);
    223 
    224 static bool acpiec_suspend(device_t, const pmf_qual_t *);
    225 static bool acpiec_resume(device_t, const pmf_qual_t *);
    226 static bool acpiec_shutdown(device_t, int);
    227 
    228 static bool acpiec_parse_gpe_package(device_t, ACPI_HANDLE,
    229     ACPI_HANDLE *, uint8_t *);
    230 
    231 static void acpiec_callout(void *);
    232 static void acpiec_gpe_query(void *);
    233 static uint32_t acpiec_gpe_handler(ACPI_HANDLE, uint32_t, void *);
    234 static ACPI_STATUS acpiec_space_setup(ACPI_HANDLE, uint32_t, void *, void **);
    235 static ACPI_STATUS acpiec_space_handler(uint32_t, ACPI_PHYSICAL_ADDRESS,
    236     uint32_t, ACPI_INTEGER *, void *, void *);
    237 
    238 static void acpiec_gpe_state_machine(struct acpiec_softc *);
    239 
    240 CFATTACH_DECL_NEW(acpiec, sizeof(struct acpiec_softc),
    241     acpiec_match, acpiec_attach, NULL, NULL);
    242 
    243 CFATTACH_DECL_NEW(acpiecdt, sizeof(struct acpiec_softc),
    244     acpiecdt_match, acpiecdt_attach, NULL, NULL);
    245 
    246 static device_t ec_singleton = NULL;
    247 static bool acpiec_cold = false;
    248 
    249 static bool
    250 acpiecdt_find(device_t parent, ACPI_HANDLE *ec_handle,
    251     bus_addr_t *cmd_reg, bus_addr_t *data_reg, uint8_t *gpebit)
    252 {
    253 	ACPI_TABLE_ECDT *ecdt;
    254 	ACPI_STATUS rv;
    255 
    256 	rv = AcpiGetTable(ACPI_SIG_ECDT, 1, (ACPI_TABLE_HEADER **)&ecdt);
    257 	if (ACPI_FAILURE(rv))
    258 		return false;
    259 
    260 	if (ecdt->Control.BitWidth != 8 || ecdt->Data.BitWidth != 8) {
    261 		aprint_error_dev(parent,
    262 		    "ECDT register width invalid (%u/%u)\n",
    263 		    ecdt->Control.BitWidth, ecdt->Data.BitWidth);
    264 		return false;
    265 	}
    266 
    267 	rv = AcpiGetHandle(ACPI_ROOT_OBJECT, ecdt->Id, ec_handle);
    268 	if (ACPI_FAILURE(rv)) {
    269 		aprint_error_dev(parent,
    270 		    "failed to look up EC object %s: %s\n",
    271 		    ecdt->Id, AcpiFormatException(rv));
    272 		return false;
    273 	}
    274 
    275 	*cmd_reg = ecdt->Control.Address;
    276 	*data_reg = ecdt->Data.Address;
    277 	*gpebit = ecdt->Gpe;
    278 
    279 	return true;
    280 }
    281 
    282 static int
    283 acpiecdt_match(device_t parent, cfdata_t match, void *aux)
    284 {
    285 	ACPI_HANDLE ec_handle;
    286 	bus_addr_t cmd_reg, data_reg;
    287 	uint8_t gpebit;
    288 
    289 	if (acpiecdt_find(parent, &ec_handle, &cmd_reg, &data_reg, &gpebit))
    290 		return 1;
    291 	else
    292 		return 0;
    293 }
    294 
    295 static void
    296 acpiecdt_attach(device_t parent, device_t self, void *aux)
    297 {
    298 	struct acpibus_attach_args *aa = aux;
    299 	ACPI_HANDLE ec_handle;
    300 	bus_addr_t cmd_reg, data_reg;
    301 	uint8_t gpebit;
    302 
    303 	if (!acpiecdt_find(parent, &ec_handle, &cmd_reg, &data_reg, &gpebit))
    304 		panic("ECDT disappeared");
    305 
    306 	aprint_naive("\n");
    307 	aprint_normal(": ACPI Embedded Controller via ECDT\n");
    308 
    309 	acpiec_common_attach(parent, self, ec_handle, aa->aa_iot, cmd_reg,
    310 	    aa->aa_iot, data_reg, NULL, gpebit);
    311 }
    312 
    313 static int
    314 acpiec_match(device_t parent, cfdata_t match, void *aux)
    315 {
    316 	struct acpi_attach_args *aa = aux;
    317 
    318 	return acpi_compatible_match(aa, compat_data);
    319 }
    320 
    321 static void
    322 acpiec_attach(device_t parent, device_t self, void *aux)
    323 {
    324 	struct acpi_attach_args *aa = aux;
    325 	struct acpi_resources ec_res;
    326 	struct acpi_io *io0, *io1;
    327 	ACPI_HANDLE gpe_handle;
    328 	uint8_t gpebit;
    329 	ACPI_STATUS rv;
    330 
    331 	if (ec_singleton != NULL) {
    332 		aprint_naive(": using %s\n", device_xname(ec_singleton));
    333 		aprint_normal(": using %s\n", device_xname(ec_singleton));
    334 		goto fail0;
    335 	}
    336 
    337 	if (!acpi_device_present(aa->aa_node->ad_handle)) {
    338 		aprint_normal(": not present\n");
    339 		goto fail0;
    340 	}
    341 
    342 	if (!acpiec_parse_gpe_package(self, aa->aa_node->ad_handle,
    343 				      &gpe_handle, &gpebit))
    344 		goto fail0;
    345 
    346 	rv = acpi_resource_parse(self, aa->aa_node->ad_handle, "_CRS",
    347 	    &ec_res, &acpi_resource_parse_ops_default);
    348 	if (rv != AE_OK) {
    349 		aprint_error_dev(self, "resource parsing failed: %s\n",
    350 		    AcpiFormatException(rv));
    351 		goto fail0;
    352 	}
    353 
    354 	if ((io0 = acpi_res_io(&ec_res, 0)) == NULL) {
    355 		aprint_error_dev(self, "no data register resource\n");
    356 		goto fail1;
    357 	}
    358 	if ((io1 = acpi_res_io(&ec_res, 1)) == NULL) {
    359 		aprint_error_dev(self, "no CSR register resource\n");
    360 		goto fail1;
    361 	}
    362 
    363 	acpiec_common_attach(parent, self, aa->aa_node->ad_handle,
    364 	    aa->aa_iot, io1->ar_base, aa->aa_iot, io0->ar_base,
    365 	    gpe_handle, gpebit);
    366 
    367 	acpi_resource_cleanup(&ec_res);
    368 	return;
    369 
    370 fail1:	acpi_resource_cleanup(&ec_res);
    371 fail0:	if (!pmf_device_register(self, NULL, NULL))
    372 		aprint_error_dev(self, "couldn't establish power handler\n");
    373 }
    374 
    375 static void
    376 acpiec_common_attach(device_t parent, device_t self,
    377     ACPI_HANDLE ec_handle, bus_space_tag_t cmdt, bus_addr_t cmd_reg,
    378     bus_space_tag_t datat, bus_addr_t data_reg,
    379     ACPI_HANDLE gpe_handle, uint8_t gpebit)
    380 {
    381 	struct acpiec_softc *sc = device_private(self);
    382 	ACPI_STATUS rv;
    383 	ACPI_INTEGER val;
    384 
    385 	sc->sc_dev = self;
    386 
    387 	sc->sc_csr_st = cmdt;
    388 	sc->sc_data_st = datat;
    389 
    390 	sc->sc_ech = ec_handle;
    391 	sc->sc_gpeh = gpe_handle;
    392 	sc->sc_gpebit = gpebit;
    393 
    394 	sc->sc_state = EC_STATE_FREE;
    395 	mutex_init(&sc->sc_mtx, MUTEX_DRIVER, IPL_TTY);
    396 	mutex_init(&sc->sc_access_mtx, MUTEX_DEFAULT, IPL_NONE);
    397 	cv_init(&sc->sc_cv, "eccv");
    398 	cv_init(&sc->sc_cv_sci, "ecsci");
    399 
    400 	if (bus_space_map(sc->sc_data_st, data_reg, 1, 0,
    401 	    &sc->sc_data_sh) != 0) {
    402 		aprint_error_dev(self, "unable to map data register\n");
    403 		return;
    404 	}
    405 
    406 	if (bus_space_map(sc->sc_csr_st, cmd_reg, 1, 0, &sc->sc_csr_sh) != 0) {
    407 		aprint_error_dev(self, "unable to map CSR register\n");
    408 		goto post_data_map;
    409 	}
    410 
    411 	rv = acpi_eval_integer(sc->sc_ech, "_GLK", &val);
    412 	if (rv == AE_OK) {
    413 		sc->sc_need_global_lock = val != 0;
    414 	} else if (rv != AE_NOT_FOUND) {
    415 		aprint_error_dev(self, "unable to evaluate _GLK: %s\n",
    416 		    AcpiFormatException(rv));
    417 		goto post_csr_map;
    418 	} else {
    419 		sc->sc_need_global_lock = false;
    420 	}
    421 	if (sc->sc_need_global_lock)
    422 		aprint_normal_dev(self, "using global ACPI lock\n");
    423 
    424 	callout_init(&sc->sc_pseudo_intr, CALLOUT_MPSAFE);
    425 	callout_setfunc(&sc->sc_pseudo_intr, acpiec_callout, sc);
    426 
    427 	rv = AcpiInstallAddressSpaceHandler(sc->sc_ech, ACPI_ADR_SPACE_EC,
    428 	    acpiec_space_handler, acpiec_space_setup, sc);
    429 	if (rv != AE_OK) {
    430 		aprint_error_dev(self,
    431 		    "unable to install address space handler: %s\n",
    432 		    AcpiFormatException(rv));
    433 		goto post_csr_map;
    434 	}
    435 
    436 	rv = AcpiInstallGpeHandler(sc->sc_gpeh, sc->sc_gpebit,
    437 	    ACPI_GPE_EDGE_TRIGGERED, acpiec_gpe_handler, sc);
    438 	if (rv != AE_OK) {
    439 		aprint_error_dev(self, "unable to install GPE handler: %s\n",
    440 		    AcpiFormatException(rv));
    441 		goto post_csr_map;
    442 	}
    443 
    444 	rv = AcpiEnableGpe(sc->sc_gpeh, sc->sc_gpebit);
    445 	if (rv != AE_OK) {
    446 		aprint_error_dev(self, "unable to enable GPE: %s\n",
    447 		    AcpiFormatException(rv));
    448 		goto post_csr_map;
    449 	}
    450 
    451 	if (kthread_create(PRI_NONE, KTHREAD_MPSAFE, NULL, acpiec_gpe_query,
    452 		sc, NULL, "acpiec sci thread")) {
    453 		aprint_error_dev(self, "unable to create query kthread\n");
    454 		goto post_csr_map;
    455 	}
    456 
    457 	ec_singleton = self;
    458 
    459 	if (!pmf_device_register1(self, acpiec_suspend, acpiec_resume,
    460 	    acpiec_shutdown))
    461 		aprint_error_dev(self, "couldn't establish power handler\n");
    462 
    463 	return;
    464 
    465 post_csr_map:
    466 	(void)AcpiRemoveGpeHandler(sc->sc_gpeh, sc->sc_gpebit,
    467 	    acpiec_gpe_handler);
    468 	(void)AcpiRemoveAddressSpaceHandler(sc->sc_ech,
    469 	    ACPI_ADR_SPACE_EC, acpiec_space_handler);
    470 	bus_space_unmap(sc->sc_csr_st, sc->sc_csr_sh, 1);
    471 post_data_map:
    472 	bus_space_unmap(sc->sc_data_st, sc->sc_data_sh, 1);
    473 	if (!pmf_device_register(self, NULL, NULL))
    474 		aprint_error_dev(self, "couldn't establish power handler\n");
    475 }
    476 
    477 static bool
    478 acpiec_suspend(device_t dv, const pmf_qual_t *qual)
    479 {
    480 	struct acpiec_softc *sc = device_private(dv);
    481 
    482 	/*
    483 	 * XXX This looks bad because acpiec_cold is global and
    484 	 * sc->sc_mtx doesn't look like it's global, but we can have
    485 	 * only one acpiec(4) device anyway.  Maybe acpiec_cold should
    486 	 * live in the softc to make this look less bad?
    487 	 *
    488 	 * XXX Should this block read/write/query transactions until
    489 	 * resume?
    490 	 *
    491 	 * XXX Should this interrupt existing transactions to make them
    492 	 * fail promptly or restart on resume?
    493 	 */
    494 	mutex_enter(&sc->sc_mtx);
    495 	acpiec_cold = true;
    496 	mutex_exit(&sc->sc_mtx);
    497 
    498 	return true;
    499 }
    500 
    501 static bool
    502 acpiec_resume(device_t dv, const pmf_qual_t *qual)
    503 {
    504 	struct acpiec_softc *sc = device_private(dv);
    505 
    506 	mutex_enter(&sc->sc_mtx);
    507 	acpiec_cold = false;
    508 	mutex_exit(&sc->sc_mtx);
    509 
    510 	return true;
    511 }
    512 
    513 static bool
    514 acpiec_shutdown(device_t dv, int how)
    515 {
    516 	struct acpiec_softc *sc = device_private(dv);
    517 
    518 	mutex_enter(&sc->sc_mtx);
    519 	acpiec_cold = true;
    520 	mutex_exit(&sc->sc_mtx);
    521 
    522 	return true;
    523 }
    524 
    525 static bool
    526 acpiec_parse_gpe_package(device_t self, ACPI_HANDLE ec_handle,
    527     ACPI_HANDLE *gpe_handle, uint8_t *gpebit)
    528 {
    529 	ACPI_BUFFER buf;
    530 	ACPI_OBJECT *p, *c;
    531 	ACPI_STATUS rv;
    532 
    533 	rv = acpi_eval_struct(ec_handle, "_GPE", &buf);
    534 	if (rv != AE_OK) {
    535 		aprint_error_dev(self, "unable to evaluate _GPE: %s\n",
    536 		    AcpiFormatException(rv));
    537 		return false;
    538 	}
    539 
    540 	p = buf.Pointer;
    541 
    542 	if (p->Type == ACPI_TYPE_INTEGER) {
    543 		*gpe_handle = NULL;
    544 		*gpebit = p->Integer.Value;
    545 		ACPI_FREE(p);
    546 		return true;
    547 	}
    548 
    549 	if (p->Type != ACPI_TYPE_PACKAGE) {
    550 		aprint_error_dev(self, "_GPE is neither integer nor package\n");
    551 		ACPI_FREE(p);
    552 		return false;
    553 	}
    554 
    555 	if (p->Package.Count != 2) {
    556 		aprint_error_dev(self,
    557 		    "_GPE package does not contain 2 elements\n");
    558 		ACPI_FREE(p);
    559 		return false;
    560 	}
    561 
    562 	c = &p->Package.Elements[0];
    563 	rv = acpi_eval_reference_handle(c, gpe_handle);
    564 
    565 	if (ACPI_FAILURE(rv)) {
    566 		aprint_error_dev(self, "failed to evaluate _GPE handle\n");
    567 		ACPI_FREE(p);
    568 		return false;
    569 	}
    570 
    571 	c = &p->Package.Elements[1];
    572 
    573 	if (c->Type != ACPI_TYPE_INTEGER) {
    574 		aprint_error_dev(self,
    575 		    "_GPE package needs integer as 2nd field\n");
    576 		ACPI_FREE(p);
    577 		return false;
    578 	}
    579 	*gpebit = c->Integer.Value;
    580 	ACPI_FREE(p);
    581 	return true;
    582 }
    583 
    584 static uint8_t
    585 acpiec_read_data(struct acpiec_softc *sc)
    586 {
    587 	uint8_t x;
    588 
    589 	KASSERT(mutex_owned(&sc->sc_mtx));
    590 
    591 	x = bus_space_read_1(sc->sc_data_st, sc->sc_data_sh, 0);
    592 	DPRINTF(ACPIEC_DEBUG_REG, sc, "read data=0x%"PRIx8"\n", x);
    593 
    594 	return x;
    595 }
    596 
    597 static void
    598 acpiec_write_data(struct acpiec_softc *sc, uint8_t val)
    599 {
    600 
    601 	KASSERT(mutex_owned(&sc->sc_mtx));
    602 
    603 	DPRINTF(ACPIEC_DEBUG_REG, sc, "write data=0x%"PRIx8"\n", val);
    604 	bus_space_write_1(sc->sc_data_st, sc->sc_data_sh, 0, val);
    605 }
    606 
    607 static uint8_t
    608 acpiec_read_status(struct acpiec_softc *sc)
    609 {
    610 	uint8_t x;
    611 
    612 	KASSERT(mutex_owned(&sc->sc_mtx));
    613 
    614 	x = bus_space_read_1(sc->sc_csr_st, sc->sc_csr_sh, 0);
    615 	DPRINTF(ACPIEC_DEBUG_REG, sc, "read status=0x%"PRIx8"\n", x);
    616 
    617 	return x;
    618 }
    619 
    620 static void
    621 acpiec_write_command(struct acpiec_softc *sc, uint8_t cmd)
    622 {
    623 
    624 	KASSERT(mutex_owned(&sc->sc_mtx));
    625 
    626 	DPRINTF(ACPIEC_DEBUG_REG, sc, "write command=0x%"PRIx8"\n", cmd);
    627 	bus_space_write_1(sc->sc_csr_st, sc->sc_csr_sh, 0, cmd);
    628 }
    629 
    630 static ACPI_STATUS
    631 acpiec_space_setup(ACPI_HANDLE region, uint32_t func, void *arg,
    632     void **region_arg)
    633 {
    634 
    635 	if (func == ACPI_REGION_DEACTIVATE)
    636 		*region_arg = NULL;
    637 	else
    638 		*region_arg = arg;
    639 
    640 	return AE_OK;
    641 }
    642 
    643 static void
    644 acpiec_lock(struct acpiec_softc *sc)
    645 {
    646 	ACPI_STATUS rv;
    647 
    648 	mutex_enter(&sc->sc_access_mtx);
    649 
    650 	if (sc->sc_need_global_lock) {
    651 		rv = AcpiAcquireGlobalLock(EC_LOCK_TIMEOUT,
    652 		    &sc->sc_global_lock);
    653 		if (rv != AE_OK) {
    654 			aprint_error_dev(sc->sc_dev,
    655 			    "failed to acquire global lock: %s\n",
    656 			    AcpiFormatException(rv));
    657 			return;
    658 		}
    659 	}
    660 }
    661 
    662 static void
    663 acpiec_unlock(struct acpiec_softc *sc)
    664 {
    665 	ACPI_STATUS rv;
    666 
    667 	if (sc->sc_need_global_lock) {
    668 		rv = AcpiReleaseGlobalLock(sc->sc_global_lock);
    669 		if (rv != AE_OK) {
    670 			aprint_error_dev(sc->sc_dev,
    671 			    "failed to release global lock: %s\n",
    672 			    AcpiFormatException(rv));
    673 		}
    674 	}
    675 	mutex_exit(&sc->sc_access_mtx);
    676 }
    677 
    678 static ACPI_STATUS
    679 acpiec_wait_timeout(struct acpiec_softc *sc)
    680 {
    681 	device_t dv = sc->sc_dev;
    682 	int i;
    683 
    684 	for (i = 0; i < EC_POLL_TIMEOUT; ++i) {
    685 		acpiec_gpe_state_machine(sc);
    686 		if (sc->sc_state == EC_STATE_FREE)
    687 			return AE_OK;
    688 		delay(1);
    689 	}
    690 
    691 	DPRINTF(ACPIEC_DEBUG_RW, sc, "SCI polling timeout\n");
    692 	if (cold || acpiec_cold) {
    693 		int timeo = 1000 * EC_CMD_TIMEOUT;
    694 
    695 		while (sc->sc_state != EC_STATE_FREE && timeo-- > 0) {
    696 			delay(1000);
    697 			acpiec_gpe_state_machine(sc);
    698 		}
    699 		if (sc->sc_state != EC_STATE_FREE) {
    700 			aprint_error_dev(dv, "command timed out, state %d\n",
    701 			    sc->sc_state);
    702 			return AE_ERROR;
    703 		}
    704 	} else {
    705 		const unsigned deadline = getticks() + EC_CMD_TIMEOUT*hz;
    706 		unsigned delta;
    707 
    708 		while (sc->sc_state != EC_STATE_FREE &&
    709 		    (delta = deadline - getticks()) < INT_MAX)
    710 			(void)cv_timedwait(&sc->sc_cv, &sc->sc_mtx, delta);
    711 		if (sc->sc_state != EC_STATE_FREE) {
    712 			aprint_error_dev(dv,
    713 			    "command takes over %d sec...\n",
    714 			    EC_CMD_TIMEOUT);
    715 			return AE_ERROR;
    716 		}
    717 	}
    718 
    719 	return AE_OK;
    720 }
    721 
    722 static ACPI_STATUS
    723 acpiec_read(struct acpiec_softc *sc, uint8_t addr, uint8_t *val)
    724 {
    725 	ACPI_STATUS rv;
    726 
    727 	acpiec_lock(sc);
    728 	mutex_enter(&sc->sc_mtx);
    729 
    730 	DPRINTF(ACPIEC_DEBUG_RW, sc,
    731 	    "pid %ld %s, lid %ld%s%s: read addr 0x%"PRIx8"\n",
    732 	    (long)curproc->p_pid, curproc->p_comm,
    733 	    (long)curlwp->l_lid, curlwp->l_name ? " " : "",
    734 	    curlwp->l_name ? curlwp->l_name : "",
    735 	    addr);
    736 
    737 	KASSERT(sc->sc_state == EC_STATE_FREE);
    738 
    739 	sc->sc_cur_addr = addr;
    740 	sc->sc_state = EC_STATE_READ;
    741 
    742 	rv = acpiec_wait_timeout(sc);
    743 	if (ACPI_FAILURE(rv))
    744 		goto out;
    745 
    746 	DPRINTF(ACPIEC_DEBUG_RW, sc,
    747 	    "pid %ld %s, lid %ld%s%s: read addr 0x%"PRIx8": 0x%"PRIx8"\n",
    748 	    (long)curproc->p_pid, curproc->p_comm,
    749 	    (long)curlwp->l_lid, curlwp->l_name ? " " : "",
    750 	    curlwp->l_name ? curlwp->l_name : "",
    751 	    addr, sc->sc_cur_val);
    752 
    753 	*val = sc->sc_cur_val;
    754 
    755 out:	mutex_exit(&sc->sc_mtx);
    756 	acpiec_unlock(sc);
    757 	return rv;
    758 }
    759 
    760 static ACPI_STATUS
    761 acpiec_write(struct acpiec_softc *sc, uint8_t addr, uint8_t val)
    762 {
    763 	ACPI_STATUS rv;
    764 
    765 	acpiec_lock(sc);
    766 	mutex_enter(&sc->sc_mtx);
    767 
    768 	DPRINTF(ACPIEC_DEBUG_RW, sc,
    769 	    "pid %ld %s, lid %ld%s%s write addr 0x%"PRIx8": 0x%"PRIx8"\n",
    770 	    (long)curproc->p_pid, curproc->p_comm,
    771 	    (long)curlwp->l_lid, curlwp->l_name ? " " : "",
    772 	    curlwp->l_name ? curlwp->l_name : "",
    773 	    addr, val);
    774 
    775 	KASSERT(sc->sc_state == EC_STATE_FREE);
    776 
    777 	sc->sc_cur_addr = addr;
    778 	sc->sc_cur_val = val;
    779 	sc->sc_state = EC_STATE_WRITE;
    780 
    781 	rv = acpiec_wait_timeout(sc);
    782 	if (ACPI_FAILURE(rv))
    783 		goto out;
    784 
    785 	DPRINTF(ACPIEC_DEBUG_RW, sc,
    786 	    "pid %ld %s, lid %ld%s%s: write addr 0x%"PRIx8": 0x%"PRIx8
    787 	    " done\n",
    788 	    (long)curproc->p_pid, curproc->p_comm,
    789 	    (long)curlwp->l_lid, curlwp->l_name ? " " : "",
    790 	    curlwp->l_name ? curlwp->l_name : "",
    791 	    addr, val);
    792 
    793 out:	mutex_exit(&sc->sc_mtx);
    794 	acpiec_unlock(sc);
    795 	return rv;
    796 }
    797 
    798 /*
    799  * acpiec_space_handler(func, paddr, bitwidth, value, arg, region_arg)
    800  *
    801  *	Transfer bitwidth/8 bytes of data between paddr and *value:
    802  *	from paddr to *value when func is ACPI_READ, and the other way
    803  *	when func is ACPI_WRITE.  arg is the acpiec_softc pointer.
    804  *	region_arg is ignored (XXX why? determined by
    805  *	acpiec_space_setup but never used by anything that I can see).
    806  *
    807  *	The caller always provides storage at *value large enough for
    808  *	an ACPI_INTEGER object, i.e., a 64-bit integer.  However,
    809  *	bitwidth may be larger; in this case the caller provides larger
    810  *	storage at *value, e.g. 128 bits as documented in
    811  *	<https://gnats.netbsd.org/55206>.
    812  *
    813  *	On reads, this fully initializes one ACPI_INTEGER's worth of
    814  *	data at *value, even if bitwidth < 64.  The integer is
    815  *	interpreted in host byte order; in other words, bytes of data
    816  *	are transferred in order between paddr and (uint8_t *)value.
    817  *	The transfer is not atomic; it may go byte-by-byte.
    818  *
    819  *	XXX This only really makes sense on little-endian systems.
    820  *	E.g., thinkpad_acpi.c assumes that a single byte is transferred
    821  *	in the low-order bits of the result.  A big-endian system could
    822  *	read a 64-bit integer in big-endian (and it did for a while!),
    823  *	but what should it do for larger reads?  Unclear!
    824  *
    825  *	XXX It's not clear whether the object at *value is always
    826  *	_aligned_ adequately for an ACPI_INTEGER object.  Currently it
    827  *	always is as long as malloc, used by AcpiOsAllocate, returns
    828  *	64-bit-aligned data.
    829  */
    830 static ACPI_STATUS
    831 acpiec_space_handler(uint32_t func, ACPI_PHYSICAL_ADDRESS paddr,
    832     uint32_t width, ACPI_INTEGER *value, void *arg, void *region_arg)
    833 {
    834 	struct acpiec_softc *sc = arg;
    835 	ACPI_STATUS rv;
    836 	uint8_t addr, *buf;
    837 	unsigned int i;
    838 
    839 	if (paddr > 0xff || width % 8 != 0 ||
    840 	    value == NULL || arg == NULL || paddr + width / 8 > 0x100)
    841 		return AE_BAD_PARAMETER;
    842 
    843 	addr = paddr;
    844 	buf = (uint8_t *)value;
    845 
    846 	rv = AE_OK;
    847 
    848 	switch (func) {
    849 	case ACPI_READ:
    850 		for (i = 0; i < width; i += 8, ++addr, ++buf) {
    851 			rv = acpiec_read(sc, addr, buf);
    852 			if (rv != AE_OK)
    853 				break;
    854 		}
    855 		/*
    856 		 * Make sure to fully initialize at least an
    857 		 * ACPI_INTEGER-sized object.
    858 		 */
    859 		for (; i < sizeof(*value)*8; i += 8, ++buf)
    860 			*buf = 0;
    861 		break;
    862 	case ACPI_WRITE:
    863 		for (i = 0; i < width; i += 8, ++addr, ++buf) {
    864 			rv = acpiec_write(sc, addr, *buf);
    865 			if (rv != AE_OK)
    866 				break;
    867 		}
    868 		break;
    869 	default:
    870 		aprint_error_dev(sc->sc_dev,
    871 		    "invalid Address Space function called: %x\n",
    872 		    (unsigned int)func);
    873 		return AE_BAD_PARAMETER;
    874 	}
    875 
    876 	return rv;
    877 }
    878 
    879 static void
    880 acpiec_wait(struct acpiec_softc *sc)
    881 {
    882 	int i;
    883 
    884 	/*
    885 	 * First, attempt to get the query by polling.
    886 	 */
    887 	for (i = 0; i < EC_POLL_TIMEOUT; ++i) {
    888 		acpiec_gpe_state_machine(sc);
    889 		if (sc->sc_state == EC_STATE_FREE)
    890 			return;
    891 		delay(1);
    892 	}
    893 
    894 	/*
    895 	 * Polling timed out.  Try waiting for interrupts -- either GPE
    896 	 * interrupts, or periodic callouts in case GPE interrupts are
    897 	 * broken.
    898 	 */
    899 	DPRINTF(ACPIEC_DEBUG_QUERY, sc, "SCI polling timeout\n");
    900 	while (sc->sc_state != EC_STATE_FREE)
    901 		cv_wait(&sc->sc_cv, &sc->sc_mtx);
    902 }
    903 
    904 static void
    905 acpiec_gpe_query(void *arg)
    906 {
    907 	struct acpiec_softc *sc = arg;
    908 	uint8_t reg;
    909 	char qxx[5];
    910 	ACPI_STATUS rv;
    911 
    912 loop:
    913 	/*
    914 	 * Wait until the EC sends an SCI requesting a query.
    915 	 */
    916 	mutex_enter(&sc->sc_mtx);
    917 	while (!sc->sc_got_sci)
    918 		cv_wait(&sc->sc_cv_sci, &sc->sc_mtx);
    919 	DPRINTF(ACPIEC_DEBUG_QUERY, sc, "SCI query requested\n");
    920 	mutex_exit(&sc->sc_mtx);
    921 
    922 	/*
    923 	 * EC wants to submit a query to us.  Exclude concurrent reads
    924 	 * and writes while we handle it.
    925 	 */
    926 	acpiec_lock(sc);
    927 	mutex_enter(&sc->sc_mtx);
    928 
    929 	DPRINTF(ACPIEC_DEBUG_QUERY, sc, "SCI query\n");
    930 
    931 	KASSERT(sc->sc_state == EC_STATE_FREE);
    932 
    933 	/* The Query command can always be issued, so be defensive here. */
    934 	KASSERT(sc->sc_got_sci);
    935 	sc->sc_got_sci = false;
    936 	sc->sc_state = EC_STATE_QUERY;
    937 
    938 	acpiec_wait(sc);
    939 
    940 	reg = sc->sc_cur_val;
    941 	DPRINTF(ACPIEC_DEBUG_QUERY, sc, "SCI query: 0x%"PRIx8"\n", reg);
    942 
    943 	mutex_exit(&sc->sc_mtx);
    944 	acpiec_unlock(sc);
    945 
    946 	if (reg == 0)
    947 		goto loop; /* Spurious query result */
    948 
    949 	/*
    950 	 * Evaluate _Qxx to respond to the controller.
    951 	 */
    952 	snprintf(qxx, sizeof(qxx), "_Q%02X", (unsigned int)reg);
    953 	rv = AcpiEvaluateObject(sc->sc_ech, qxx, NULL, NULL);
    954 	if (rv != AE_OK && rv != AE_NOT_FOUND) {
    955 		aprint_error_dev(sc->sc_dev, "GPE query method %s failed: %s",
    956 		    qxx, AcpiFormatException(rv));
    957 	}
    958 
    959 	goto loop;
    960 }
    961 
    962 static void
    963 acpiec_gpe_state_machine(struct acpiec_softc *sc)
    964 {
    965 	uint8_t reg;
    966 
    967 	KASSERT(mutex_owned(&sc->sc_mtx));
    968 
    969 	reg = acpiec_read_status(sc);
    970 
    971 #ifdef ACPIEC_DEBUG
    972 	if (acpiec_debug & __BIT(ACPIEC_DEBUG_TRANSITION)) {
    973 		char buf[128];
    974 
    975 		snprintb(buf, sizeof(buf), EC_STATUS_FMT, reg);
    976 		DPRINTF(ACPIEC_DEBUG_TRANSITION, sc, "%s\n", buf);
    977 	}
    978 #endif
    979 
    980 	switch (sc->sc_state) {
    981 	case EC_STATE_QUERY:
    982 		if ((reg & EC_STATUS_IBF) != 0)
    983 			break; /* Nothing of interest here. */
    984 		acpiec_write_command(sc, EC_COMMAND_QUERY);
    985 		sc->sc_state = EC_STATE_QUERY_VAL;
    986 		break;
    987 
    988 	case EC_STATE_QUERY_VAL:
    989 		if ((reg & EC_STATUS_OBF) == 0)
    990 			break; /* Nothing of interest here. */
    991 		sc->sc_cur_val = acpiec_read_data(sc);
    992 		sc->sc_state = EC_STATE_FREE;
    993 		break;
    994 
    995 	case EC_STATE_READ:
    996 		if ((reg & EC_STATUS_IBF) != 0)
    997 			break; /* Nothing of interest here. */
    998 		acpiec_write_command(sc, EC_COMMAND_READ);
    999 		sc->sc_state = EC_STATE_READ_ADDR;
   1000 		break;
   1001 
   1002 	case EC_STATE_READ_ADDR:
   1003 		if ((reg & EC_STATUS_IBF) != 0)
   1004 			break; /* Nothing of interest here. */
   1005 		acpiec_write_data(sc, sc->sc_cur_addr);
   1006 		sc->sc_state = EC_STATE_READ_VAL;
   1007 		break;
   1008 
   1009 	case EC_STATE_READ_VAL:
   1010 		if ((reg & EC_STATUS_OBF) == 0)
   1011 			break; /* Nothing of interest here. */
   1012 		sc->sc_cur_val = acpiec_read_data(sc);
   1013 		sc->sc_state = EC_STATE_FREE;
   1014 		break;
   1015 
   1016 	case EC_STATE_WRITE:
   1017 		if ((reg & EC_STATUS_IBF) != 0)
   1018 			break; /* Nothing of interest here. */
   1019 		acpiec_write_command(sc, EC_COMMAND_WRITE);
   1020 		sc->sc_state = EC_STATE_WRITE_ADDR;
   1021 		break;
   1022 
   1023 	case EC_STATE_WRITE_ADDR:
   1024 		if ((reg & EC_STATUS_IBF) != 0)
   1025 			break; /* Nothing of interest here. */
   1026 		acpiec_write_data(sc, sc->sc_cur_addr);
   1027 		sc->sc_state = EC_STATE_WRITE_VAL;
   1028 		break;
   1029 
   1030 	case EC_STATE_WRITE_VAL:
   1031 		if ((reg & EC_STATUS_IBF) != 0)
   1032 			break; /* Nothing of interest here. */
   1033 		acpiec_write_data(sc, sc->sc_cur_val);
   1034 		sc->sc_state = EC_STATE_FREE;
   1035 		break;
   1036 
   1037 	case EC_STATE_FREE:
   1038 		break;
   1039 
   1040 	default:
   1041 		panic("invalid state");
   1042 	}
   1043 
   1044 	/*
   1045 	 * If we are not in a transaction, wake anyone waiting to start
   1046 	 * one.  If an SCI was requested, notify the SCI thread that it
   1047 	 * needs to handle the SCI.
   1048 	 */
   1049 	if (sc->sc_state == EC_STATE_FREE) {
   1050 		cv_signal(&sc->sc_cv);
   1051 		if (reg & EC_STATUS_SCI) {
   1052 			DPRINTF(ACPIEC_DEBUG_TRANSITION, sc,
   1053 			    "wake SCI thread\n");
   1054 			sc->sc_got_sci = true;
   1055 			cv_signal(&sc->sc_cv_sci);
   1056 		}
   1057 	}
   1058 
   1059 	/*
   1060 	 * In case GPE interrupts are broken, poll once per tick for EC
   1061 	 * status updates while a transaction is still pending.
   1062 	 */
   1063 	if (sc->sc_state != EC_STATE_FREE) {
   1064 		DPRINTF(ACPIEC_DEBUG_INTR, sc, "schedule callout\n");
   1065 		callout_schedule(&sc->sc_pseudo_intr, 1);
   1066 	}
   1067 
   1068 	DPRINTF(ACPIEC_DEBUG_TRANSITION, sc, "return\n");
   1069 }
   1070 
   1071 static void
   1072 acpiec_callout(void *arg)
   1073 {
   1074 	struct acpiec_softc *sc = arg;
   1075 
   1076 	mutex_enter(&sc->sc_mtx);
   1077 	DPRINTF(ACPIEC_DEBUG_INTR, sc, "callout\n");
   1078 	acpiec_gpe_state_machine(sc);
   1079 	mutex_exit(&sc->sc_mtx);
   1080 }
   1081 
   1082 static uint32_t
   1083 acpiec_gpe_handler(ACPI_HANDLE hdl, uint32_t gpebit, void *arg)
   1084 {
   1085 	struct acpiec_softc *sc = arg;
   1086 
   1087 	mutex_enter(&sc->sc_mtx);
   1088 	DPRINTF(ACPIEC_DEBUG_INTR, sc, "GPE\n");
   1089 	acpiec_gpe_state_machine(sc);
   1090 	mutex_exit(&sc->sc_mtx);
   1091 
   1092 	return ACPI_INTERRUPT_HANDLED | ACPI_REENABLE_GPE;
   1093 }
   1094 
   1095 ACPI_STATUS
   1096 acpiec_bus_read(device_t dv, u_int addr, ACPI_INTEGER *val, int width)
   1097 {
   1098 	struct acpiec_softc *sc = device_private(dv);
   1099 
   1100 	return acpiec_space_handler(ACPI_READ, addr, width * 8, val, sc, NULL);
   1101 }
   1102 
   1103 ACPI_STATUS
   1104 acpiec_bus_write(device_t dv, u_int addr, ACPI_INTEGER val, int width)
   1105 {
   1106 	struct acpiec_softc *sc = device_private(dv);
   1107 
   1108 	return acpiec_space_handler(ACPI_WRITE, addr, width * 8, &val, sc,
   1109 	    NULL);
   1110 }
   1111 
   1112 ACPI_HANDLE
   1113 acpiec_get_handle(device_t dv)
   1114 {
   1115 	struct acpiec_softc *sc = device_private(dv);
   1116 
   1117 	return sc->sc_ech;
   1118 }
   1119