drivers/bluetooth/hci_qca.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  Bluetooth Software UART Qualcomm protocol
   4  *
   5  *  HCI_IBS (HCI In-Band Sleep) is Qualcomm's power management
   6  *  protocol extension to H4.
   7  *
   8  *  Copyright (C) 2007 Texas Instruments, Inc.
   9  *  Copyright (c) 2010, 2012, 2018 The Linux Foundation. All rights reserved.
  10  *
  11  *  Acknowledgements:
  12  *  This file is based on hci_ll.c, which was...
  13  *  Written by Ohad Ben-Cohen <ohad@bencohen.org>
  14  *  which was in turn based on hci_h4.c, which was written
  15  *  by Maxim Krasnyansky and Marcel Holtmann.
  16  */
  17
  18 #include <linux/kernel.h>
  19 #include <linux/clk.h>
  20 #include <linux/completion.h>
  21 #include <linux/debugfs.h>
  22 #include <linux/delay.h>
  23 #include <linux/devcoredump.h>
  24 #include <linux/device.h>
  25 #include <linux/gpio/consumer.h>
  26 #include <linux/mod_devicetable.h>
  27 #include <linux/module.h>
  28 #include <linux/of.h>
  29 #include <linux/acpi.h>
  30 #include <linux/platform_device.h>
  31 #include <linux/pwrseq/consumer.h>
  32 #include <linux/regulator/consumer.h>
  33 #include <linux/serdev.h>
  34 #include <linux/string_choices.h>
  35 #include <linux/mutex.h>
  36 #include <linux/unaligned.h>
  37
  38 #include <net/bluetooth/bluetooth.h>
  39 #include <net/bluetooth/hci_core.h>
  40
  41 #include "hci_uart.h"
  42 #include "btqca.h"
  43
  44 /* HCI_IBS protocol messages */
  45 #define HCI_IBS_SLEEP_IND       0xFE
  46 #define HCI_IBS_WAKE_IND        0xFD
  47 #define HCI_IBS_WAKE_ACK        0xFC
  48 #define HCI_MAX_IBS_SIZE        10
  49
  50 #define IBS_WAKE_RETRANS_TIMEOUT_MS     100
  51 #define IBS_BTSOC_TX_IDLE_TIMEOUT_MS    200
  52 #define IBS_HOST_TX_IDLE_TIMEOUT_MS     2000
  53 #define CMD_TRANS_TIMEOUT_MS            100
  54 #define MEMDUMP_TIMEOUT_MS              8000
  55 #define IBS_DISABLE_SSR_TIMEOUT_MS \
  56         (MEMDUMP_TIMEOUT_MS + FW_DOWNLOAD_TIMEOUT_MS)
  57 #define FW_DOWNLOAD_TIMEOUT_MS          3000
  58
  59 /* susclk rate */
  60 #define SUSCLK_RATE_32KHZ       32768
  61
  62 /* Controller debug log header */
  63 #define QCA_DEBUG_HANDLE        0x2EDC
  64
  65 /* max retry count when init fails */
  66 #define MAX_INIT_RETRIES 3
  67
  68 /* Controller dump header */
  69 #define QCA_SSR_DUMP_HANDLE             0x0108
  70 #define QCA_DUMP_PACKET_SIZE            255
  71 #define QCA_LAST_SEQUENCE_NUM           0xFFFF
  72 #define QCA_CRASHBYTE_PACKET_LEN        1096
  73 #define QCA_MEMDUMP_BYTE                0xFB
  74
  75 enum qca_flags {
  76         QCA_IBS_DISABLED,
  77         QCA_DROP_VENDOR_EVENT,
  78         QCA_SUSPENDING,
  79         QCA_MEMDUMP_COLLECTION,
  80         QCA_HW_ERROR_EVENT,
  81         QCA_SSR_TRIGGERED,
  82         QCA_BT_OFF,
  83         QCA_ROM_FW,
  84         QCA_DEBUGFS_CREATED,
  85 };
  86
  87 enum qca_capabilities {
  88         QCA_CAP_WIDEBAND_SPEECH = BIT(0),
  89         QCA_CAP_VALID_LE_STATES = BIT(1),
  90 };
  91
  92 /* HCI_IBS transmit side sleep protocol states */
  93 enum tx_ibs_states {
  94         HCI_IBS_TX_ASLEEP,
  95         HCI_IBS_TX_WAKING,
  96         HCI_IBS_TX_AWAKE,
  97 };
  98
  99 /* HCI_IBS receive side sleep protocol states */
 100 enum rx_states {
 101         HCI_IBS_RX_ASLEEP,
 102         HCI_IBS_RX_AWAKE,
 103 };
 104
 105 /* HCI_IBS transmit and receive side clock state vote */
 106 enum hci_ibs_clock_state_vote {
 107         HCI_IBS_VOTE_STATS_UPDATE,
 108         HCI_IBS_TX_VOTE_CLOCK_ON,
 109         HCI_IBS_TX_VOTE_CLOCK_OFF,
 110         HCI_IBS_RX_VOTE_CLOCK_ON,
 111         HCI_IBS_RX_VOTE_CLOCK_OFF,
 112 };
 113
 114 /* Controller memory dump states */
 115 enum qca_memdump_states {
 116         QCA_MEMDUMP_IDLE,
 117         QCA_MEMDUMP_COLLECTING,
 118         QCA_MEMDUMP_COLLECTED,
 119         QCA_MEMDUMP_TIMEOUT,
 120 };
 121
 122 struct qca_memdump_info {
 123         u32 current_seq_no;
 124         u32 received_dump;
 125         u32 ram_dump_size;
 126 };
 127
 128 struct qca_memdump_event_hdr {
 129         __u8    evt;
 130         __u8    plen;
 131         __u16   opcode;
 132         __le16   seq_no;
 133         __u8    reserved;
 134 } __packed;
 135
 136
 137 struct qca_dump_size {
 138         __le32 dump_size;
 139 } __packed;
 140
 141 struct qca_data {
 142         struct hci_uart *hu;
 143         struct sk_buff *rx_skb;
 144         struct sk_buff_head txq;
 145         struct sk_buff_head tx_wait_q;  /* HCI_IBS wait queue   */
 146         struct sk_buff_head rx_memdump_q;       /* Memdump wait queue   */
 147         spinlock_t hci_ibs_lock;        /* HCI_IBS state lock   */
 148         u8 tx_ibs_state;        /* HCI_IBS transmit side power state*/
 149         u8 rx_ibs_state;        /* HCI_IBS receive side power state */
 150         bool tx_vote;           /* Clock must be on for TX */
 151         bool rx_vote;           /* Clock must be on for RX */
 152         struct timer_list tx_idle_timer;
 153         u32 tx_idle_delay;
 154         struct timer_list wake_retrans_timer;
 155         u32 wake_retrans;
 156         struct workqueue_struct *workqueue;
 157         struct work_struct ws_awake_rx;
 158         struct work_struct ws_awake_device;
 159         struct work_struct ws_rx_vote_off;
 160         struct work_struct ws_tx_vote_off;
 161         struct work_struct ctrl_memdump_evt;
 162         struct delayed_work ctrl_memdump_timeout;
 163         struct qca_memdump_info *qca_memdump;
 164         unsigned long flags;
 165         struct completion drop_ev_comp;
 166         wait_queue_head_t suspend_wait_q;
 167         enum qca_memdump_states memdump_state;
 168         struct mutex hci_memdump_lock;
 169
 170         u16 fw_version;
 171         u16 controller_id;
 172         /* For debugging purpose */
 173         u64 ibs_sent_wacks;
 174         u64 ibs_sent_slps;
 175         u64 ibs_sent_wakes;
 176         u64 ibs_recv_wacks;
 177         u64 ibs_recv_slps;
 178         u64 ibs_recv_wakes;
 179         u64 vote_last_jif;
 180         u32 vote_on_ms;
 181         u32 vote_off_ms;
 182         u64 tx_votes_on;
 183         u64 rx_votes_on;
 184         u64 tx_votes_off;
 185         u64 rx_votes_off;
 186         u64 votes_on;
 187         u64 votes_off;
 188 };
 189
 190 enum qca_speed_type {
 191         QCA_INIT_SPEED = 1,
 192         QCA_OPER_SPEED
 193 };
 194
 195 /*
 196  * Voltage regulator information required for configuring the
 197  * QCA Bluetooth chipset
 198  */
 199 struct qca_vreg {
 200         const char *name;
 201         unsigned int load_uA;
 202 };
 203
 204 struct qca_device_data {
 205         enum qca_btsoc_type soc_type;
 206         struct qca_vreg *vregs;
 207         size_t num_vregs;
 208         uint32_t capabilities;
 209 };
 210
 211 /*
 212  * Platform data for the QCA Bluetooth power driver.
 213  */
 214 struct qca_power {
 215         struct device *dev;
 216         struct regulator_bulk_data *vreg_bulk;
 217         int num_vregs;
 218         bool vregs_on;
 219         struct pwrseq_desc *pwrseq;
 220 };
 221
 222 struct qca_serdev {
 223         struct hci_uart  serdev_hu;
 224         struct gpio_desc *bt_en;
 225         struct gpio_desc *sw_ctrl;
 226         struct clk       *susclk;
 227         enum qca_btsoc_type btsoc_type;
 228         struct qca_power *bt_power;
 229         u32 init_speed;
 230         u32 oper_speed;
 231         bool bdaddr_property_broken;
 232         const char *firmware_name[2];
 233 };
 234
 235 static int qca_regulator_enable(struct qca_serdev *qcadev);
 236 static void qca_regulator_disable(struct qca_serdev *qcadev);
 237 static void qca_power_shutdown(struct hci_uart *hu);
 238 static int qca_power_off(struct hci_dev *hdev);
 239 static void qca_controller_memdump(struct work_struct *work);
 240 static void qca_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb);
 241
 242 static enum qca_btsoc_type qca_soc_type(struct hci_uart *hu)
 243 {
 244         enum qca_btsoc_type soc_type;
 245
 246         if (hu->serdev) {
 247                 struct qca_serdev *qsd = serdev_device_get_drvdata(hu->serdev);
 248
 249                 soc_type = qsd->btsoc_type;
 250         } else {
 251                 soc_type = QCA_ROME;
 252         }
 253
 254         return soc_type;
 255 }
 256
 257 static const char *qca_get_firmware_name(struct hci_uart *hu)
 258 {
 259         if (hu->serdev) {
 260                 struct qca_serdev *qsd = serdev_device_get_drvdata(hu->serdev);
 261
 262                 return qsd->firmware_name[0];
 263         } else {
 264                 return NULL;
 265         }
 266 }
 267
 268 static const char *qca_get_rampatch_name(struct hci_uart *hu)
 269 {
 270         if (hu->serdev) {
 271                 struct qca_serdev *qsd = serdev_device_get_drvdata(hu->serdev);
 272
 273                 return qsd->firmware_name[1];
 274         } else {
 275                 return NULL;
 276         }
 277 }
 278
 279 static void __serial_clock_on(struct tty_struct *tty)
 280 {
 281         /* TODO: Some chipset requires to enable UART clock on client
 282          * side to save power consumption or manual work is required.
 283          * Please put your code to control UART clock here if needed
 284          */
 285 }
 286
 287 static void __serial_clock_off(struct tty_struct *tty)
 288 {
 289         /* TODO: Some chipset requires to disable UART clock on client
 290          * side to save power consumption or manual work is required.
 291          * Please put your code to control UART clock off here if needed
 292          */
 293 }
 294
 295 /* serial_clock_vote needs to be called with the ibs lock held */
 296 static void serial_clock_vote(unsigned long vote, struct hci_uart *hu)
 297 {
 298         struct qca_data *qca = hu->priv;
 299         unsigned int diff;
 300
 301         bool old_vote = (qca->tx_vote | qca->rx_vote);
 302         bool new_vote;
 303
 304         switch (vote) {
 305         case HCI_IBS_VOTE_STATS_UPDATE:
 306                 diff = jiffies_to_msecs(jiffies - qca->vote_last_jif);
 307
 308                 if (old_vote)
 309                         qca->vote_off_ms += diff;
 310                 else
 311                         qca->vote_on_ms += diff;
 312                 return;
 313
 314         case HCI_IBS_TX_VOTE_CLOCK_ON:
 315                 qca->tx_vote = true;
 316                 qca->tx_votes_on++;
 317                 break;
 318
 319         case HCI_IBS_RX_VOTE_CLOCK_ON:
 320                 qca->rx_vote = true;
 321                 qca->rx_votes_on++;
 322                 break;
 323
 324         case HCI_IBS_TX_VOTE_CLOCK_OFF:
 325                 qca->tx_vote = false;
 326                 qca->tx_votes_off++;
 327                 break;
 328
 329         case HCI_IBS_RX_VOTE_CLOCK_OFF:
 330                 qca->rx_vote = false;
 331                 qca->rx_votes_off++;
 332                 break;
 333
 334         default:
 335                 BT_ERR("Voting irregularity");
 336                 return;
 337         }
 338
 339         new_vote = qca->rx_vote | qca->tx_vote;
 340
 341         if (new_vote != old_vote) {
 342                 if (new_vote)
 343                         __serial_clock_on(hu->tty);
 344                 else
 345                         __serial_clock_off(hu->tty);
 346
 347                 BT_DBG("Vote serial clock %s(%s)", str_true_false(new_vote),
 348                        str_true_false(vote));
 349
 350                 diff = jiffies_to_msecs(jiffies - qca->vote_last_jif);
 351
 352                 if (new_vote) {
 353                         qca->votes_on++;
 354                         qca->vote_off_ms += diff;
 355                 } else {
 356                         qca->votes_off++;
 357                         qca->vote_on_ms += diff;
 358                 }
 359                 qca->vote_last_jif = jiffies;
 360         }
 361 }
 362
 363 /* Builds and sends an HCI_IBS command packet.
 364  * These are very simple packets with only 1 cmd byte.
 365  */
 366 static int send_hci_ibs_cmd(u8 cmd, struct hci_uart *hu)
 367 {
 368         int err = 0;
 369         struct sk_buff *skb = NULL;
 370         struct qca_data *qca = hu->priv;
 371
 372         BT_DBG("hu %p send hci ibs cmd 0x%x", hu, cmd);
 373
 374         skb = bt_skb_alloc(1, GFP_ATOMIC);
 375         if (!skb) {
 376                 BT_ERR("Failed to allocate memory for HCI_IBS packet");
 377                 return -ENOMEM;
 378         }
 379
 380         /* Assign HCI_IBS type */
 381         skb_put_u8(skb, cmd);
 382
 383         skb_queue_tail(&qca->txq, skb);
 384
 385         return err;
 386 }
 387
 388 static void qca_wq_awake_device(struct work_struct *work)
 389 {
 390         struct qca_data *qca = container_of(work, struct qca_data,
 391                                             ws_awake_device);
 392         struct hci_uart *hu = qca->hu;
 393         unsigned long retrans_delay;
 394         unsigned long flags;
 395
 396         BT_DBG("hu %p wq awake device", hu);
 397
 398         /* Vote for serial clock */
 399         serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_ON, hu);
 400
 401         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 402
 403         /* Send wake indication to device */
 404         if (send_hci_ibs_cmd(HCI_IBS_WAKE_IND, hu) < 0)
 405                 BT_ERR("Failed to send WAKE to device");
 406
 407         qca->ibs_sent_wakes++;
 408
 409         /* Start retransmit timer */
 410         retrans_delay = msecs_to_jiffies(qca->wake_retrans);
 411         mod_timer(&qca->wake_retrans_timer, jiffies + retrans_delay);
 412
 413         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 414
 415         /* Actually send the packets */
 416         hci_uart_tx_wakeup(hu);
 417 }
 418
 419 static void qca_wq_awake_rx(struct work_struct *work)
 420 {
 421         struct qca_data *qca = container_of(work, struct qca_data,
 422                                             ws_awake_rx);
 423         struct hci_uart *hu = qca->hu;
 424         unsigned long flags;
 425
 426         BT_DBG("hu %p wq awake rx", hu);
 427
 428         serial_clock_vote(HCI_IBS_RX_VOTE_CLOCK_ON, hu);
 429
 430         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 431         qca->rx_ibs_state = HCI_IBS_RX_AWAKE;
 432
 433         /* Always acknowledge device wake up,
 434          * sending IBS message doesn't count as TX ON.
 435          */
 436         if (send_hci_ibs_cmd(HCI_IBS_WAKE_ACK, hu) < 0)
 437                 BT_ERR("Failed to acknowledge device wake up");
 438
 439         qca->ibs_sent_wacks++;
 440
 441         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 442
 443         /* Actually send the packets */
 444         hci_uart_tx_wakeup(hu);
 445 }
 446
 447 static void qca_wq_serial_rx_clock_vote_off(struct work_struct *work)
 448 {
 449         struct qca_data *qca = container_of(work, struct qca_data,
 450                                             ws_rx_vote_off);
 451         struct hci_uart *hu = qca->hu;
 452
 453         BT_DBG("hu %p rx clock vote off", hu);
 454
 455         serial_clock_vote(HCI_IBS_RX_VOTE_CLOCK_OFF, hu);
 456 }
 457
 458 static void qca_wq_serial_tx_clock_vote_off(struct work_struct *work)
 459 {
 460         struct qca_data *qca = container_of(work, struct qca_data,
 461                                             ws_tx_vote_off);
 462         struct hci_uart *hu = qca->hu;
 463
 464         BT_DBG("hu %p tx clock vote off", hu);
 465
 466         /* Run HCI tx handling unlocked */
 467         hci_uart_tx_wakeup(hu);
 468
 469         /* Now that message queued to tty driver, vote for tty clocks off.
 470          * It is up to the tty driver to pend the clocks off until tx done.
 471          */
 472         serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_OFF, hu);
 473 }
 474
 475 static void hci_ibs_tx_idle_timeout(struct timer_list *t)
 476 {
 477         struct qca_data *qca = timer_container_of(qca, t, tx_idle_timer);
 478         struct hci_uart *hu = qca->hu;
 479         unsigned long flags;
 480
 481         BT_DBG("hu %p idle timeout in %d state", hu, qca->tx_ibs_state);
 482
 483         spin_lock_irqsave_nested(&qca->hci_ibs_lock,
 484                                  flags, SINGLE_DEPTH_NESTING);
 485
 486         switch (qca->tx_ibs_state) {
 487         case HCI_IBS_TX_AWAKE:
 488                 /* TX_IDLE, go to SLEEP */
 489                 if (send_hci_ibs_cmd(HCI_IBS_SLEEP_IND, hu) < 0) {
 490                         BT_ERR("Failed to send SLEEP to device");
 491                         break;
 492                 }
 493                 qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
 494                 qca->ibs_sent_slps++;
 495                 queue_work(qca->workqueue, &qca->ws_tx_vote_off);
 496                 break;
 497
 498         case HCI_IBS_TX_ASLEEP:
 499         case HCI_IBS_TX_WAKING:
 500         default:
 501                 BT_ERR("Spurious timeout tx state %d", qca->tx_ibs_state);
 502                 break;
 503         }
 504
 505         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 506 }
 507
 508 static void hci_ibs_wake_retrans_timeout(struct timer_list *t)
 509 {
 510         struct qca_data *qca = timer_container_of(qca, t, wake_retrans_timer);
 511         struct hci_uart *hu = qca->hu;
 512         unsigned long flags, retrans_delay;
 513         bool retransmit = false;
 514
 515         BT_DBG("hu %p wake retransmit timeout in %d state",
 516                 hu, qca->tx_ibs_state);
 517
 518         spin_lock_irqsave_nested(&qca->hci_ibs_lock,
 519                                  flags, SINGLE_DEPTH_NESTING);
 520
 521         /* Don't retransmit the HCI_IBS_WAKE_IND when suspending. */
 522         if (test_bit(QCA_SUSPENDING, &qca->flags)) {
 523                 spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 524                 return;
 525         }
 526
 527         switch (qca->tx_ibs_state) {
 528         case HCI_IBS_TX_WAKING:
 529                 /* No WAKE_ACK, retransmit WAKE */
 530                 retransmit = true;
 531                 if (send_hci_ibs_cmd(HCI_IBS_WAKE_IND, hu) < 0) {
 532                         BT_ERR("Failed to acknowledge device wake up");
 533                         break;
 534                 }
 535                 qca->ibs_sent_wakes++;
 536                 retrans_delay = msecs_to_jiffies(qca->wake_retrans);
 537                 mod_timer(&qca->wake_retrans_timer, jiffies + retrans_delay);
 538                 break;
 539
 540         case HCI_IBS_TX_ASLEEP:
 541         case HCI_IBS_TX_AWAKE:
 542         default:
 543                 BT_ERR("Spurious timeout tx state %d", qca->tx_ibs_state);
 544                 break;
 545         }
 546
 547         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 548
 549         if (retransmit)
 550                 hci_uart_tx_wakeup(hu);
 551 }
 552
 553
 554 static void qca_controller_memdump_timeout(struct work_struct *work)
 555 {
 556         struct qca_data *qca = container_of(work, struct qca_data,
 557                                         ctrl_memdump_timeout.work);
 558         struct hci_uart *hu = qca->hu;
 559
 560         mutex_lock(&qca->hci_memdump_lock);
 561         if (test_bit(QCA_MEMDUMP_COLLECTION, &qca->flags)) {
 562                 qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
 563                 if (!test_bit(QCA_HW_ERROR_EVENT, &qca->flags)) {
 564                         /* Inject hw error event to reset the device
 565                          * and driver.
 566                          */
 567                         hci_reset_dev(hu->hdev);
 568                 }
 569         }
 570
 571         mutex_unlock(&qca->hci_memdump_lock);
 572 }
 573
 574
 575 /* Initialize protocol */
 576 static int qca_open(struct hci_uart *hu)
 577 {
 578         struct qca_serdev *qcadev;
 579         struct qca_data *qca;
 580
 581         BT_DBG("hu %p qca_open", hu);
 582
 583         if (!hci_uart_has_flow_control(hu))
 584                 return -EOPNOTSUPP;
 585
 586         qca = kzalloc(sizeof(*qca), GFP_KERNEL);
 587         if (!qca)
 588                 return -ENOMEM;
 589
 590         skb_queue_head_init(&qca->txq);
 591         skb_queue_head_init(&qca->tx_wait_q);
 592         skb_queue_head_init(&qca->rx_memdump_q);
 593         spin_lock_init(&qca->hci_ibs_lock);
 594         mutex_init(&qca->hci_memdump_lock);
 595         qca->workqueue = alloc_ordered_workqueue("qca_wq", 0);
 596         if (!qca->workqueue) {
 597                 BT_ERR("QCA Workqueue not initialized properly");
 598                 kfree(qca);
 599                 return -ENOMEM;
 600         }
 601
 602         INIT_WORK(&qca->ws_awake_rx, qca_wq_awake_rx);
 603         INIT_WORK(&qca->ws_awake_device, qca_wq_awake_device);
 604         INIT_WORK(&qca->ws_rx_vote_off, qca_wq_serial_rx_clock_vote_off);
 605         INIT_WORK(&qca->ws_tx_vote_off, qca_wq_serial_tx_clock_vote_off);
 606         INIT_WORK(&qca->ctrl_memdump_evt, qca_controller_memdump);
 607         INIT_DELAYED_WORK(&qca->ctrl_memdump_timeout,
 608                           qca_controller_memdump_timeout);
 609         init_waitqueue_head(&qca->suspend_wait_q);
 610
 611         qca->hu = hu;
 612         init_completion(&qca->drop_ev_comp);
 613
 614         /* Assume we start with both sides asleep -- extra wakes OK */
 615         qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
 616         qca->rx_ibs_state = HCI_IBS_RX_ASLEEP;
 617
 618         qca->vote_last_jif = jiffies;
 619
 620         hu->priv = qca;
 621
 622         if (hu->serdev) {
 623                 qcadev = serdev_device_get_drvdata(hu->serdev);
 624
 625                 switch (qcadev->btsoc_type) {
 626                 case QCA_WCN3950:
 627                 case QCA_WCN3988:
 628                 case QCA_WCN3990:
 629                 case QCA_WCN3991:
 630                 case QCA_WCN3998:
 631                 case QCA_WCN6750:
 632                         hu->init_speed = qcadev->init_speed;
 633                         break;
 634
 635                 default:
 636                         break;
 637                 }
 638
 639                 if (qcadev->oper_speed)
 640                         hu->oper_speed = qcadev->oper_speed;
 641         }
 642
 643         timer_setup(&qca->wake_retrans_timer, hci_ibs_wake_retrans_timeout, 0);
 644         qca->wake_retrans = IBS_WAKE_RETRANS_TIMEOUT_MS;
 645
 646         timer_setup(&qca->tx_idle_timer, hci_ibs_tx_idle_timeout, 0);
 647         qca->tx_idle_delay = IBS_HOST_TX_IDLE_TIMEOUT_MS;
 648
 649         BT_DBG("HCI_UART_QCA open, tx_idle_delay=%u, wake_retrans=%u",
 650                qca->tx_idle_delay, qca->wake_retrans);
 651
 652         return 0;
 653 }
 654
 655 static void qca_debugfs_init(struct hci_dev *hdev)
 656 {
 657         struct hci_uart *hu = hci_get_drvdata(hdev);
 658         struct qca_data *qca = hu->priv;
 659         struct dentry *ibs_dir;
 660         umode_t mode;
 661
 662         if (!hdev->debugfs)
 663                 return;
 664
 665         if (test_and_set_bit(QCA_DEBUGFS_CREATED, &qca->flags))
 666                 return;
 667
 668         ibs_dir = debugfs_create_dir("ibs", hdev->debugfs);
 669
 670         /* read only */
 671         mode = 0444;
 672         debugfs_create_u8("tx_ibs_state", mode, ibs_dir, &qca->tx_ibs_state);
 673         debugfs_create_u8("rx_ibs_state", mode, ibs_dir, &qca->rx_ibs_state);
 674         debugfs_create_u64("ibs_sent_sleeps", mode, ibs_dir,
 675                            &qca->ibs_sent_slps);
 676         debugfs_create_u64("ibs_sent_wakes", mode, ibs_dir,
 677                            &qca->ibs_sent_wakes);
 678         debugfs_create_u64("ibs_sent_wake_acks", mode, ibs_dir,
 679                            &qca->ibs_sent_wacks);
 680         debugfs_create_u64("ibs_recv_sleeps", mode, ibs_dir,
 681                            &qca->ibs_recv_slps);
 682         debugfs_create_u64("ibs_recv_wakes", mode, ibs_dir,
 683                            &qca->ibs_recv_wakes);
 684         debugfs_create_u64("ibs_recv_wake_acks", mode, ibs_dir,
 685                            &qca->ibs_recv_wacks);
 686         debugfs_create_bool("tx_vote", mode, ibs_dir, &qca->tx_vote);
 687         debugfs_create_u64("tx_votes_on", mode, ibs_dir, &qca->tx_votes_on);
 688         debugfs_create_u64("tx_votes_off", mode, ibs_dir, &qca->tx_votes_off);
 689         debugfs_create_bool("rx_vote", mode, ibs_dir, &qca->rx_vote);
 690         debugfs_create_u64("rx_votes_on", mode, ibs_dir, &qca->rx_votes_on);
 691         debugfs_create_u64("rx_votes_off", mode, ibs_dir, &qca->rx_votes_off);
 692         debugfs_create_u64("votes_on", mode, ibs_dir, &qca->votes_on);
 693         debugfs_create_u64("votes_off", mode, ibs_dir, &qca->votes_off);
 694         debugfs_create_u32("vote_on_ms", mode, ibs_dir, &qca->vote_on_ms);
 695         debugfs_create_u32("vote_off_ms", mode, ibs_dir, &qca->vote_off_ms);
 696
 697         /* read/write */
 698         mode = 0644;
 699         debugfs_create_u32("wake_retrans", mode, ibs_dir, &qca->wake_retrans);
 700         debugfs_create_u32("tx_idle_delay", mode, ibs_dir,
 701                            &qca->tx_idle_delay);
 702 }
 703
 704 /* Flush protocol data */
 705 static int qca_flush(struct hci_uart *hu)
 706 {
 707         struct qca_data *qca = hu->priv;
 708
 709         BT_DBG("hu %p qca flush", hu);
 710
 711         skb_queue_purge(&qca->tx_wait_q);
 712         skb_queue_purge(&qca->txq);
 713
 714         return 0;
 715 }
 716
 717 /* Close protocol */
 718 static int qca_close(struct hci_uart *hu)
 719 {
 720         struct qca_data *qca = hu->priv;
 721
 722         BT_DBG("hu %p qca close", hu);
 723
 724         serial_clock_vote(HCI_IBS_VOTE_STATS_UPDATE, hu);
 725
 726         skb_queue_purge(&qca->tx_wait_q);
 727         skb_queue_purge(&qca->txq);
 728         skb_queue_purge(&qca->rx_memdump_q);
 729         /*
 730          * Shut the timers down so they can't be rearmed when
 731          * destroy_workqueue() drains pending work which in turn might try
 732          * to arm a timer.  After shutdown rearm attempts are silently
 733          * ignored by the timer core code.
 734          */
 735         timer_shutdown_sync(&qca->tx_idle_timer);
 736         timer_shutdown_sync(&qca->wake_retrans_timer);
 737         destroy_workqueue(qca->workqueue);
 738         qca->hu = NULL;
 739
 740         kfree_skb(qca->rx_skb);
 741
 742         hu->priv = NULL;
 743
 744         kfree(qca);
 745
 746         return 0;
 747 }
 748
 749 /* Called upon a wake-up-indication from the device.
 750  */
 751 static void device_want_to_wakeup(struct hci_uart *hu)
 752 {
 753         unsigned long flags;
 754         struct qca_data *qca = hu->priv;
 755
 756         BT_DBG("hu %p want to wake up", hu);
 757
 758         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 759
 760         qca->ibs_recv_wakes++;
 761
 762         /* Don't wake the rx up when suspending. */
 763         if (test_bit(QCA_SUSPENDING, &qca->flags)) {
 764                 spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 765                 return;
 766         }
 767
 768         switch (qca->rx_ibs_state) {
 769         case HCI_IBS_RX_ASLEEP:
 770                 /* Make sure clock is on - we may have turned clock off since
 771                  * receiving the wake up indicator awake rx clock.
 772                  */
 773                 queue_work(qca->workqueue, &qca->ws_awake_rx);
 774                 spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 775                 return;
 776
 777         case HCI_IBS_RX_AWAKE:
 778                 /* Always acknowledge device wake up,
 779                  * sending IBS message doesn't count as TX ON.
 780                  */
 781                 if (send_hci_ibs_cmd(HCI_IBS_WAKE_ACK, hu) < 0) {
 782                         BT_ERR("Failed to acknowledge device wake up");
 783                         break;
 784                 }
 785                 qca->ibs_sent_wacks++;
 786                 break;
 787
 788         default:
 789                 /* Any other state is illegal */
 790                 BT_ERR("Received HCI_IBS_WAKE_IND in rx state %d",
 791                        qca->rx_ibs_state);
 792                 break;
 793         }
 794
 795         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 796
 797         /* Actually send the packets */
 798         hci_uart_tx_wakeup(hu);
 799 }
 800
 801 /* Called upon a sleep-indication from the device.
 802  */
 803 static void device_want_to_sleep(struct hci_uart *hu)
 804 {
 805         unsigned long flags;
 806         struct qca_data *qca = hu->priv;
 807
 808         BT_DBG("hu %p want to sleep in %d state", hu, qca->rx_ibs_state);
 809
 810         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 811
 812         qca->ibs_recv_slps++;
 813
 814         switch (qca->rx_ibs_state) {
 815         case HCI_IBS_RX_AWAKE:
 816                 /* Update state */
 817                 qca->rx_ibs_state = HCI_IBS_RX_ASLEEP;
 818                 /* Vote off rx clock under workqueue */
 819                 queue_work(qca->workqueue, &qca->ws_rx_vote_off);
 820                 break;
 821
 822         case HCI_IBS_RX_ASLEEP:
 823                 break;
 824
 825         default:
 826                 /* Any other state is illegal */
 827                 BT_ERR("Received HCI_IBS_SLEEP_IND in rx state %d",
 828                        qca->rx_ibs_state);
 829                 break;
 830         }
 831
 832         wake_up_interruptible(&qca->suspend_wait_q);
 833
 834         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 835 }
 836
 837 /* Called upon wake-up-acknowledgement from the device
 838  */
 839 static void device_woke_up(struct hci_uart *hu)
 840 {
 841         unsigned long flags, idle_delay;
 842         struct qca_data *qca = hu->priv;
 843         struct sk_buff *skb = NULL;
 844
 845         BT_DBG("hu %p woke up", hu);
 846
 847         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 848
 849         qca->ibs_recv_wacks++;
 850
 851         /* Don't react to the wake-up-acknowledgment when suspending. */
 852         if (test_bit(QCA_SUSPENDING, &qca->flags)) {
 853                 spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 854                 return;
 855         }
 856
 857         switch (qca->tx_ibs_state) {
 858         case HCI_IBS_TX_AWAKE:
 859                 /* Expect one if we send 2 WAKEs */
 860                 BT_DBG("Received HCI_IBS_WAKE_ACK in tx state %d",
 861                        qca->tx_ibs_state);
 862                 break;
 863
 864         case HCI_IBS_TX_WAKING:
 865                 /* Send pending packets */
 866                 while ((skb = skb_dequeue(&qca->tx_wait_q)))
 867                         skb_queue_tail(&qca->txq, skb);
 868
 869                 /* Switch timers and change state to HCI_IBS_TX_AWAKE */
 870                 timer_delete(&qca->wake_retrans_timer);
 871                 idle_delay = msecs_to_jiffies(qca->tx_idle_delay);
 872                 mod_timer(&qca->tx_idle_timer, jiffies + idle_delay);
 873                 qca->tx_ibs_state = HCI_IBS_TX_AWAKE;
 874                 break;
 875
 876         case HCI_IBS_TX_ASLEEP:
 877         default:
 878                 BT_ERR("Received HCI_IBS_WAKE_ACK in tx state %d",
 879                        qca->tx_ibs_state);
 880                 break;
 881         }
 882
 883         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 884
 885         /* Actually send the packets */
 886         hci_uart_tx_wakeup(hu);
 887 }
 888
 889 /* Enqueue frame for transmission (padding, crc, etc) may be called from
 890  * two simultaneous tasklets.
 891  */
 892 static int qca_enqueue(struct hci_uart *hu, struct sk_buff *skb)
 893 {
 894         unsigned long flags = 0, idle_delay;
 895         struct qca_data *qca = hu->priv;
 896
 897         BT_DBG("hu %p qca enq skb %p tx_ibs_state %d", hu, skb,
 898                qca->tx_ibs_state);
 899
 900         if (test_bit(QCA_SSR_TRIGGERED, &qca->flags)) {
 901                 /* As SSR is in progress, ignore the packets */
 902                 bt_dev_dbg(hu->hdev, "SSR is in progress");
 903                 kfree_skb(skb);
 904                 return 0;
 905         }
 906
 907         /* Prepend skb with frame type */
 908         memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
 909
 910         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 911
 912         /* Don't go to sleep in middle of patch download or
 913          * Out-Of-Band(GPIOs control) sleep is selected.
 914          * Don't wake the device up when suspending.
 915          */
 916         if (test_bit(QCA_IBS_DISABLED, &qca->flags) ||
 917             test_bit(QCA_SUSPENDING, &qca->flags)) {
 918                 skb_queue_tail(&qca->txq, skb);
 919                 spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 920                 return 0;
 921         }
 922
 923         /* Act according to current state */
 924         switch (qca->tx_ibs_state) {
 925         case HCI_IBS_TX_AWAKE:
 926                 BT_DBG("Device awake, sending normally");
 927                 skb_queue_tail(&qca->txq, skb);
 928                 idle_delay = msecs_to_jiffies(qca->tx_idle_delay);
 929                 mod_timer(&qca->tx_idle_timer, jiffies + idle_delay);
 930                 break;
 931
 932         case HCI_IBS_TX_ASLEEP:
 933                 BT_DBG("Device asleep, waking up and queueing packet");
 934                 /* Save packet for later */
 935                 skb_queue_tail(&qca->tx_wait_q, skb);
 936
 937                 qca->tx_ibs_state = HCI_IBS_TX_WAKING;
 938                 /* Schedule a work queue to wake up device */
 939                 queue_work(qca->workqueue, &qca->ws_awake_device);
 940                 break;
 941
 942         case HCI_IBS_TX_WAKING:
 943                 BT_DBG("Device waking up, queueing packet");
 944                 /* Transient state; just keep packet for later */
 945                 skb_queue_tail(&qca->tx_wait_q, skb);
 946                 break;
 947
 948         default:
 949                 BT_ERR("Illegal tx state: %d (losing packet)",
 950                        qca->tx_ibs_state);
 951                 dev_kfree_skb_irq(skb);
 952                 break;
 953         }
 954
 955         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 956
 957         return 0;
 958 }
 959
 960 static int qca_ibs_sleep_ind(struct hci_dev *hdev, struct sk_buff *skb)
 961 {
 962         struct hci_uart *hu = hci_get_drvdata(hdev);
 963
 964         BT_DBG("hu %p recv hci ibs cmd 0x%x", hu, HCI_IBS_SLEEP_IND);
 965
 966         device_want_to_sleep(hu);
 967
 968         kfree_skb(skb);
 969         return 0;
 970 }
 971
 972 static int qca_ibs_wake_ind(struct hci_dev *hdev, struct sk_buff *skb)
 973 {
 974         struct hci_uart *hu = hci_get_drvdata(hdev);
 975
 976         BT_DBG("hu %p recv hci ibs cmd 0x%x", hu, HCI_IBS_WAKE_IND);
 977
 978         device_want_to_wakeup(hu);
 979
 980         kfree_skb(skb);
 981         return 0;
 982 }
 983
 984 static int qca_ibs_wake_ack(struct hci_dev *hdev, struct sk_buff *skb)
 985 {
 986         struct hci_uart *hu = hci_get_drvdata(hdev);
 987
 988         BT_DBG("hu %p recv hci ibs cmd 0x%x", hu, HCI_IBS_WAKE_ACK);
 989
 990         device_woke_up(hu);
 991
 992         kfree_skb(skb);
 993         return 0;
 994 }
 995
 996 static int qca_recv_acl_data(struct hci_dev *hdev, struct sk_buff *skb)
 997 {
 998         /* We receive debug logs from chip as an ACL packets.
 999          * Instead of sending the data to ACL to decode the
1000          * received data, we are pushing them to the above layers
1001          * as a diagnostic packet.
1002          */
1003         if (get_unaligned_le16(skb->data) == QCA_DEBUG_HANDLE)
1004                 return hci_recv_diag(hdev, skb);
1005
1006         return hci_recv_frame(hdev, skb);
1007 }
1008
1009 static void qca_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb)
1010 {
1011         struct hci_uart *hu = hci_get_drvdata(hdev);
1012         struct qca_data *qca = hu->priv;
1013         char buf[80];
1014
1015         snprintf(buf, sizeof(buf), "Controller Name: 0x%x\n",
1016                 qca->controller_id);
1017         skb_put_data(skb, buf, strlen(buf));
1018
1019         snprintf(buf, sizeof(buf), "Firmware Version: 0x%x\n",
1020                 qca->fw_version);
1021         skb_put_data(skb, buf, strlen(buf));
1022
1023         snprintf(buf, sizeof(buf), "Vendor:Qualcomm\n");
1024         skb_put_data(skb, buf, strlen(buf));
1025
1026         snprintf(buf, sizeof(buf), "Driver: %s\n",
1027                 hu->serdev->dev.driver->name);
1028         skb_put_data(skb, buf, strlen(buf));
1029 }
1030
1031 static void qca_controller_memdump(struct work_struct *work)
1032 {
1033         struct qca_data *qca = container_of(work, struct qca_data,
1034                                             ctrl_memdump_evt);
1035         struct hci_uart *hu = qca->hu;
1036         struct sk_buff *skb;
1037         struct qca_memdump_event_hdr *cmd_hdr;
1038         struct qca_memdump_info *qca_memdump = qca->qca_memdump;
1039         struct qca_dump_size *dump;
1040         u16 seq_no;
1041         u32 rx_size;
1042         int ret = 0;
1043         enum qca_btsoc_type soc_type = qca_soc_type(hu);
1044
1045         while ((skb = skb_dequeue(&qca->rx_memdump_q))) {
1046
1047                 mutex_lock(&qca->hci_memdump_lock);
1048                 /* Skip processing the received packets if timeout detected
1049                  * or memdump collection completed.
1050                  */
1051                 if (qca->memdump_state == QCA_MEMDUMP_TIMEOUT ||
1052                     qca->memdump_state == QCA_MEMDUMP_COLLECTED) {
1053                         mutex_unlock(&qca->hci_memdump_lock);
1054                         return;
1055                 }
1056
1057                 if (!qca_memdump) {
1058                         qca_memdump = kzalloc(sizeof(*qca_memdump), GFP_ATOMIC);
1059                         if (!qca_memdump) {
1060                                 mutex_unlock(&qca->hci_memdump_lock);
1061                                 return;
1062                         }
1063
1064                         qca->qca_memdump = qca_memdump;
1065                 }
1066
1067                 qca->memdump_state = QCA_MEMDUMP_COLLECTING;
1068                 cmd_hdr = (void *) skb->data;
1069                 seq_no = __le16_to_cpu(cmd_hdr->seq_no);
1070                 skb_pull(skb, sizeof(struct qca_memdump_event_hdr));
1071
1072                 if (!seq_no) {
1073
1074                         /* This is the first frame of memdump packet from
1075                          * the controller, Disable IBS to receive dump
1076                          * with out any interruption, ideally time required for
1077                          * the controller to send the dump is 8 seconds. let us
1078                          * start timer to handle this asynchronous activity.
1079                          */
1080                         set_bit(QCA_IBS_DISABLED, &qca->flags);
1081                         set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1082                         dump = (void *) skb->data;
1083                         qca_memdump->ram_dump_size = __le32_to_cpu(dump->dump_size);
1084                         if (!(qca_memdump->ram_dump_size)) {
1085                                 bt_dev_err(hu->hdev, "Rx invalid memdump size");
1086                                 kfree(qca_memdump);
1087                                 kfree_skb(skb);
1088                                 mutex_unlock(&qca->hci_memdump_lock);
1089                                 return;
1090                         }
1091
1092                         queue_delayed_work(qca->workqueue,
1093                                            &qca->ctrl_memdump_timeout,
1094                                            msecs_to_jiffies(MEMDUMP_TIMEOUT_MS));
1095                         skb_pull(skb, sizeof(qca_memdump->ram_dump_size));
1096                         qca_memdump->current_seq_no = 0;
1097                         qca_memdump->received_dump = 0;
1098                         ret = hci_devcd_init(hu->hdev, qca_memdump->ram_dump_size);
1099                         bt_dev_info(hu->hdev, "hci_devcd_init Return:%d",
1100                                     ret);
1101                         if (ret < 0) {
1102                                 kfree(qca->qca_memdump);
1103                                 qca->qca_memdump = NULL;
1104                                 qca->memdump_state = QCA_MEMDUMP_COLLECTED;
1105                                 cancel_delayed_work(&qca->ctrl_memdump_timeout);
1106                                 clear_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1107                                 clear_bit(QCA_IBS_DISABLED, &qca->flags);
1108                                 mutex_unlock(&qca->hci_memdump_lock);
1109                                 return;
1110                         }
1111
1112                         bt_dev_info(hu->hdev, "QCA collecting dump of size:%u",
1113                                     qca_memdump->ram_dump_size);
1114
1115                 }
1116
1117                 /* If sequence no 0 is missed then there is no point in
1118                  * accepting the other sequences.
1119                  */
1120                 if (!test_bit(QCA_MEMDUMP_COLLECTION, &qca->flags)) {
1121                         bt_dev_err(hu->hdev, "QCA: Discarding other packets");
1122                         kfree(qca_memdump);
1123                         kfree_skb(skb);
1124                         mutex_unlock(&qca->hci_memdump_lock);
1125                         return;
1126                 }
1127                 /* There could be chance of missing some packets from
1128                  * the controller. In such cases let us store the dummy
1129                  * packets in the buffer.
1130                  */
1131                 /* For QCA6390, controller does not lost packets but
1132                  * sequence number field of packet sometimes has error
1133                  * bits, so skip this checking for missing packet.
1134                  */
1135                 while ((seq_no > qca_memdump->current_seq_no + 1) &&
1136                         (soc_type != QCA_QCA6390) &&
1137                         seq_no != QCA_LAST_SEQUENCE_NUM) {
1138                         bt_dev_err(hu->hdev, "QCA controller missed packet:%d",
1139                                    qca_memdump->current_seq_no);
1140                         rx_size = qca_memdump->received_dump;
1141                         rx_size += QCA_DUMP_PACKET_SIZE;
1142                         if (rx_size > qca_memdump->ram_dump_size) {
1143                                 bt_dev_err(hu->hdev,
1144                                            "QCA memdump received %d, no space for missed packet",
1145                                            qca_memdump->received_dump);
1146                                 break;
1147                         }
1148                         hci_devcd_append_pattern(hu->hdev, 0x00,
1149                                 QCA_DUMP_PACKET_SIZE);
1150                         qca_memdump->received_dump += QCA_DUMP_PACKET_SIZE;
1151                         qca_memdump->current_seq_no++;
1152                 }
1153
1154                 rx_size = qca_memdump->received_dump  + skb->len;
1155                 if (rx_size <= qca_memdump->ram_dump_size) {
1156                         if ((seq_no != QCA_LAST_SEQUENCE_NUM) &&
1157                             (seq_no != qca_memdump->current_seq_no)) {
1158                                 bt_dev_err(hu->hdev,
1159                                            "QCA memdump unexpected packet %d",
1160                                            seq_no);
1161                         }
1162                         bt_dev_dbg(hu->hdev,
1163                                    "QCA memdump packet %d with length %d",
1164                                    seq_no, skb->len);
1165                         hci_devcd_append(hu->hdev, skb);
1166                         qca_memdump->current_seq_no += 1;
1167                         qca_memdump->received_dump = rx_size;
1168                 } else {
1169                         bt_dev_err(hu->hdev,
1170                                    "QCA memdump received no space for packet %d",
1171                                     qca_memdump->current_seq_no);
1172                 }
1173
1174                 if (seq_no == QCA_LAST_SEQUENCE_NUM) {
1175                         bt_dev_info(hu->hdev,
1176                                 "QCA memdump Done, received %d, total %d",
1177                                 qca_memdump->received_dump,
1178                                 qca_memdump->ram_dump_size);
1179                         hci_devcd_complete(hu->hdev);
1180                         cancel_delayed_work(&qca->ctrl_memdump_timeout);
1181                         kfree(qca->qca_memdump);
1182                         qca->qca_memdump = NULL;
1183                         qca->memdump_state = QCA_MEMDUMP_COLLECTED;
1184                         clear_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1185                 }
1186
1187                 mutex_unlock(&qca->hci_memdump_lock);
1188         }
1189
1190 }
1191
1192 static int qca_controller_memdump_event(struct hci_dev *hdev,
1193                                         struct sk_buff *skb)
1194 {
1195         struct hci_uart *hu = hci_get_drvdata(hdev);
1196         struct qca_data *qca = hu->priv;
1197
1198         set_bit(QCA_SSR_TRIGGERED, &qca->flags);
1199         skb_queue_tail(&qca->rx_memdump_q, skb);
1200         queue_work(qca->workqueue, &qca->ctrl_memdump_evt);
1201
1202         return 0;
1203 }
1204
1205 static int qca_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
1206 {
1207         struct hci_uart *hu = hci_get_drvdata(hdev);
1208         struct qca_data *qca = hu->priv;
1209
1210         if (test_bit(QCA_DROP_VENDOR_EVENT, &qca->flags)) {
1211                 struct hci_event_hdr *hdr = (void *)skb->data;
1212
1213                 /* For the WCN3990 the vendor command for a baudrate change
1214                  * isn't sent as synchronous HCI command, because the
1215                  * controller sends the corresponding vendor event with the
1216                  * new baudrate. The event is received and properly decoded
1217                  * after changing the baudrate of the host port. It needs to
1218                  * be dropped, otherwise it can be misinterpreted as
1219                  * response to a later firmware download command (also a
1220                  * vendor command).
1221                  */
1222
1223                 if (hdr->evt == HCI_EV_VENDOR)
1224                         complete(&qca->drop_ev_comp);
1225
1226                 kfree_skb(skb);
1227
1228                 return 0;
1229         }
1230         /* We receive chip memory dump as an event packet, With a dedicated
1231          * handler followed by a hardware error event. When this event is
1232          * received we store dump into a file before closing hci. This
1233          * dump will help in triaging the issues.
1234          */
1235         if ((skb->data[0] == HCI_VENDOR_PKT) &&
1236             (get_unaligned_be16(skb->data + 2) == QCA_SSR_DUMP_HANDLE))
1237                 return qca_controller_memdump_event(hdev, skb);
1238
1239         return hci_recv_frame(hdev, skb);
1240 }
1241
1242 #define QCA_IBS_SLEEP_IND_EVENT \
1243         .type = HCI_IBS_SLEEP_IND, \
1244         .hlen = 0, \
1245         .loff = 0, \
1246         .lsize = 0, \
1247         .maxlen = HCI_MAX_IBS_SIZE
1248
1249 #define QCA_IBS_WAKE_IND_EVENT \
1250         .type = HCI_IBS_WAKE_IND, \
1251         .hlen = 0, \
1252         .loff = 0, \
1253         .lsize = 0, \
1254         .maxlen = HCI_MAX_IBS_SIZE
1255
1256 #define QCA_IBS_WAKE_ACK_EVENT \
1257         .type = HCI_IBS_WAKE_ACK, \
1258         .hlen = 0, \
1259         .loff = 0, \
1260         .lsize = 0, \
1261         .maxlen = HCI_MAX_IBS_SIZE
1262
1263 static const struct h4_recv_pkt qca_recv_pkts[] = {
1264         { H4_RECV_ACL,             .recv = qca_recv_acl_data },
1265         { H4_RECV_SCO,             .recv = hci_recv_frame    },
1266         { H4_RECV_EVENT,           .recv = qca_recv_event    },
1267         { QCA_IBS_WAKE_IND_EVENT,  .recv = qca_ibs_wake_ind  },
1268         { QCA_IBS_WAKE_ACK_EVENT,  .recv = qca_ibs_wake_ack  },
1269         { QCA_IBS_SLEEP_IND_EVENT, .recv = qca_ibs_sleep_ind },
1270 };
1271
1272 static int qca_recv(struct hci_uart *hu, const void *data, int count)
1273 {
1274         struct qca_data *qca = hu->priv;
1275
1276         if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
1277                 return -EUNATCH;
1278
1279         qca->rx_skb = h4_recv_buf(hu->hdev, qca->rx_skb, data, count,
1280                                   qca_recv_pkts, ARRAY_SIZE(qca_recv_pkts));
1281         if (IS_ERR(qca->rx_skb)) {
1282                 int err = PTR_ERR(qca->rx_skb);
1283                 bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err);
1284                 qca->rx_skb = NULL;
1285                 return err;
1286         }
1287
1288         return count;
1289 }
1290
1291 static struct sk_buff *qca_dequeue(struct hci_uart *hu)
1292 {
1293         struct qca_data *qca = hu->priv;
1294
1295         return skb_dequeue(&qca->txq);
1296 }
1297
1298 static uint8_t qca_get_baudrate_value(int speed)
1299 {
1300         switch (speed) {
1301         case 9600:
1302                 return QCA_BAUDRATE_9600;
1303         case 19200:
1304                 return QCA_BAUDRATE_19200;
1305         case 38400:
1306                 return QCA_BAUDRATE_38400;
1307         case 57600:
1308                 return QCA_BAUDRATE_57600;
1309         case 115200:
1310                 return QCA_BAUDRATE_115200;
1311         case 230400:
1312                 return QCA_BAUDRATE_230400;
1313         case 460800:
1314                 return QCA_BAUDRATE_460800;
1315         case 500000:
1316                 return QCA_BAUDRATE_500000;
1317         case 921600:
1318                 return QCA_BAUDRATE_921600;
1319         case 1000000:
1320                 return QCA_BAUDRATE_1000000;
1321         case 2000000:
1322                 return QCA_BAUDRATE_2000000;
1323         case 3000000:
1324                 return QCA_BAUDRATE_3000000;
1325         case 3200000:
1326                 return QCA_BAUDRATE_3200000;
1327         case 3500000:
1328                 return QCA_BAUDRATE_3500000;
1329         default:
1330                 return QCA_BAUDRATE_115200;
1331         }
1332 }
1333
1334 static int qca_set_baudrate(struct hci_dev *hdev, uint8_t baudrate)
1335 {
1336         struct hci_uart *hu = hci_get_drvdata(hdev);
1337         struct qca_data *qca = hu->priv;
1338         struct sk_buff *skb;
1339         u8 cmd[] = { 0x01, 0x48, 0xFC, 0x01, 0x00 };
1340
1341         if (baudrate > QCA_BAUDRATE_3200000)
1342                 return -EINVAL;
1343
1344         cmd[4] = baudrate;
1345
1346         skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
1347         if (!skb) {
1348                 bt_dev_err(hdev, "Failed to allocate baudrate packet");
1349                 return -ENOMEM;
1350         }
1351
1352         /* Assign commands to change baudrate and packet type. */
1353         skb_put_data(skb, cmd, sizeof(cmd));
1354         hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
1355
1356         skb_queue_tail(&qca->txq, skb);
1357         hci_uart_tx_wakeup(hu);
1358
1359         /* Wait for the baudrate change request to be sent */
1360
1361         while (!skb_queue_empty(&qca->txq))
1362                 usleep_range(100, 200);
1363
1364         if (hu->serdev)
1365                 serdev_device_wait_until_sent(hu->serdev,
1366                       msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS));
1367
1368         /* Give the controller time to process the request */
1369         switch (qca_soc_type(hu)) {
1370         case QCA_WCN3950:
1371         case QCA_WCN3988:
1372         case QCA_WCN3990:
1373         case QCA_WCN3991:
1374         case QCA_WCN3998:
1375         case QCA_WCN6750:
1376         case QCA_WCN6855:
1377         case QCA_WCN7850:
1378                 usleep_range(1000, 10000);
1379                 break;
1380
1381         default:
1382                 msleep(300);
1383         }
1384
1385         return 0;
1386 }
1387
1388 static inline void host_set_baudrate(struct hci_uart *hu, unsigned int speed)
1389 {
1390         if (hu->serdev)
1391                 serdev_device_set_baudrate(hu->serdev, speed);
1392         else
1393                 hci_uart_set_baudrate(hu, speed);
1394 }
1395
1396 static int qca_send_power_pulse(struct hci_uart *hu, bool on)
1397 {
1398         int ret;
1399         int timeout = msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS);
1400         u8 cmd = on ? QCA_WCN3990_POWERON_PULSE : QCA_WCN3990_POWEROFF_PULSE;
1401
1402         /* These power pulses are single byte command which are sent
1403          * at required baudrate to wcn3990. On wcn3990, we have an external
1404          * circuit at Tx pin which decodes the pulse sent at specific baudrate.
1405          * For example, wcn3990 supports RF COEX antenna for both Wi-Fi/BT
1406          * and also we use the same power inputs to turn on and off for
1407          * Wi-Fi/BT. Powering up the power sources will not enable BT, until
1408          * we send a power on pulse at 115200 bps. This algorithm will help to
1409          * save power. Disabling hardware flow control is mandatory while
1410          * sending power pulses to SoC.
1411          */
1412         bt_dev_dbg(hu->hdev, "sending power pulse %02x to controller", cmd);
1413
1414         serdev_device_write_flush(hu->serdev);
1415         hci_uart_set_flow_control(hu, true);
1416         ret = serdev_device_write_buf(hu->serdev, &cmd, sizeof(cmd));
1417         if (ret < 0) {
1418                 bt_dev_err(hu->hdev, "failed to send power pulse %02x", cmd);
1419                 return ret;
1420         }
1421
1422         serdev_device_wait_until_sent(hu->serdev, timeout);
1423         hci_uart_set_flow_control(hu, false);
1424
1425         /* Give to controller time to boot/shutdown */
1426         if (on)
1427                 msleep(100);
1428         else
1429                 usleep_range(1000, 10000);
1430
1431         return 0;
1432 }
1433
1434 static unsigned int qca_get_speed(struct hci_uart *hu,
1435                                   enum qca_speed_type speed_type)
1436 {
1437         unsigned int speed = 0;
1438
1439         if (speed_type == QCA_INIT_SPEED) {
1440                 if (hu->init_speed)
1441                         speed = hu->init_speed;
1442                 else if (hu->proto->init_speed)
1443                         speed = hu->proto->init_speed;
1444         } else {
1445                 if (hu->oper_speed)
1446                         speed = hu->oper_speed;
1447                 else if (hu->proto->oper_speed)
1448                         speed = hu->proto->oper_speed;
1449         }
1450
1451         return speed;
1452 }
1453
1454 static int qca_check_speeds(struct hci_uart *hu)
1455 {
1456         switch (qca_soc_type(hu)) {
1457         case QCA_WCN3950:
1458         case QCA_WCN3988:
1459         case QCA_WCN3990:
1460         case QCA_WCN3991:
1461         case QCA_WCN3998:
1462         case QCA_WCN6750:
1463         case QCA_WCN6855:
1464         case QCA_WCN7850:
1465                 if (!qca_get_speed(hu, QCA_INIT_SPEED) &&
1466                     !qca_get_speed(hu, QCA_OPER_SPEED))
1467                         return -EINVAL;
1468                 break;
1469
1470         default:
1471                 if (!qca_get_speed(hu, QCA_INIT_SPEED) ||
1472                     !qca_get_speed(hu, QCA_OPER_SPEED))
1473                         return -EINVAL;
1474         }
1475
1476         return 0;
1477 }
1478
1479 static int qca_set_speed(struct hci_uart *hu, enum qca_speed_type speed_type)
1480 {
1481         unsigned int speed, qca_baudrate;
1482         struct qca_data *qca = hu->priv;
1483         int ret = 0;
1484
1485         if (speed_type == QCA_INIT_SPEED) {
1486                 speed = qca_get_speed(hu, QCA_INIT_SPEED);
1487                 if (speed)
1488                         host_set_baudrate(hu, speed);
1489         } else {
1490                 enum qca_btsoc_type soc_type = qca_soc_type(hu);
1491
1492                 speed = qca_get_speed(hu, QCA_OPER_SPEED);
1493                 if (!speed)
1494                         return 0;
1495
1496                 /* Disable flow control for wcn3990 to deassert RTS while
1497                  * changing the baudrate of chip and host.
1498                  */
1499                 switch (soc_type) {
1500                 case QCA_WCN3950:
1501                 case QCA_WCN3988:
1502                 case QCA_WCN3990:
1503                 case QCA_WCN3991:
1504                 case QCA_WCN3998:
1505                 case QCA_WCN6750:
1506                 case QCA_WCN6855:
1507                 case QCA_WCN7850:
1508                         hci_uart_set_flow_control(hu, true);
1509                         break;
1510
1511                 default:
1512                         break;
1513                 }
1514
1515                 switch (soc_type) {
1516                 case QCA_WCN3990:
1517                         reinit_completion(&qca->drop_ev_comp);
1518                         set_bit(QCA_DROP_VENDOR_EVENT, &qca->flags);
1519                         break;
1520
1521                 default:
1522                         break;
1523                 }
1524
1525                 qca_baudrate = qca_get_baudrate_value(speed);
1526                 bt_dev_dbg(hu->hdev, "Set UART speed to %d", speed);
1527                 ret = qca_set_baudrate(hu->hdev, qca_baudrate);
1528                 if (ret)
1529                         goto error;
1530
1531                 host_set_baudrate(hu, speed);
1532
1533 error:
1534                 switch (soc_type) {
1535                 case QCA_WCN3950:
1536                 case QCA_WCN3988:
1537                 case QCA_WCN3990:
1538                 case QCA_WCN3991:
1539                 case QCA_WCN3998:
1540                 case QCA_WCN6750:
1541                 case QCA_WCN6855:
1542                 case QCA_WCN7850:
1543                         hci_uart_set_flow_control(hu, false);
1544                         break;
1545
1546                 default:
1547                         break;
1548                 }
1549
1550                 switch (soc_type) {
1551                 case QCA_WCN3990:
1552                         /* Wait for the controller to send the vendor event
1553                          * for the baudrate change command.
1554                          */
1555                         if (!wait_for_completion_timeout(&qca->drop_ev_comp,
1556                                                  msecs_to_jiffies(100))) {
1557                                 bt_dev_err(hu->hdev,
1558                                            "Failed to change controller baudrate\n");
1559                                 ret = -ETIMEDOUT;
1560                         }
1561
1562                         clear_bit(QCA_DROP_VENDOR_EVENT, &qca->flags);
1563                         break;
1564
1565                 default:
1566                         break;
1567                 }
1568         }
1569
1570         return ret;
1571 }
1572
1573 static int qca_send_crashbuffer(struct hci_uart *hu)
1574 {
1575         struct qca_data *qca = hu->priv;
1576         struct sk_buff *skb;
1577
1578         skb = bt_skb_alloc(QCA_CRASHBYTE_PACKET_LEN, GFP_KERNEL);
1579         if (!skb) {
1580                 bt_dev_err(hu->hdev, "Failed to allocate memory for skb packet");
1581                 return -ENOMEM;
1582         }
1583
1584         /* We forcefully crash the controller, by sending 0xfb byte for
1585          * 1024 times. We also might have chance of losing data, To be
1586          * on safer side we send 1096 bytes to the SoC.
1587          */
1588         memset(skb_put(skb, QCA_CRASHBYTE_PACKET_LEN), QCA_MEMDUMP_BYTE,
1589                QCA_CRASHBYTE_PACKET_LEN);
1590         hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
1591         bt_dev_info(hu->hdev, "crash the soc to collect controller dump");
1592         skb_queue_tail(&qca->txq, skb);
1593         hci_uart_tx_wakeup(hu);
1594
1595         return 0;
1596 }
1597
1598 static void qca_wait_for_dump_collection(struct hci_dev *hdev)
1599 {
1600         struct hci_uart *hu = hci_get_drvdata(hdev);
1601         struct qca_data *qca = hu->priv;
1602
1603         wait_on_bit_timeout(&qca->flags, QCA_MEMDUMP_COLLECTION,
1604                             TASK_UNINTERRUPTIBLE, MEMDUMP_TIMEOUT_MS);
1605
1606         clear_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1607 }
1608
1609 static void qca_hw_error(struct hci_dev *hdev, u8 code)
1610 {
1611         struct hci_uart *hu = hci_get_drvdata(hdev);
1612         struct qca_data *qca = hu->priv;
1613
1614         set_bit(QCA_SSR_TRIGGERED, &qca->flags);
1615         set_bit(QCA_HW_ERROR_EVENT, &qca->flags);
1616         bt_dev_info(hdev, "mem_dump_status: %d", qca->memdump_state);
1617
1618         if (qca->memdump_state == QCA_MEMDUMP_IDLE) {
1619                 /* If hardware error event received for other than QCA
1620                  * soc memory dump event, then we need to crash the SOC
1621                  * and wait here for 8 seconds to get the dump packets.
1622                  * This will block main thread to be on hold until we
1623                  * collect dump.
1624                  */
1625                 set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1626                 qca_send_crashbuffer(hu);
1627                 qca_wait_for_dump_collection(hdev);
1628         } else if (qca->memdump_state == QCA_MEMDUMP_COLLECTING) {
1629                 /* Let us wait here until memory dump collected or
1630                  * memory dump timer expired.
1631                  */
1632                 bt_dev_info(hdev, "waiting for dump to complete");
1633                 qca_wait_for_dump_collection(hdev);
1634         }
1635
1636         mutex_lock(&qca->hci_memdump_lock);
1637         if (qca->memdump_state != QCA_MEMDUMP_COLLECTED) {
1638                 bt_dev_err(hu->hdev, "clearing allocated memory due to memdump timeout");
1639                 hci_devcd_abort(hu->hdev);
1640                 if (qca->qca_memdump) {
1641                         kfree(qca->qca_memdump);
1642                         qca->qca_memdump = NULL;
1643                 }
1644                 qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
1645                 cancel_delayed_work(&qca->ctrl_memdump_timeout);
1646         }
1647         mutex_unlock(&qca->hci_memdump_lock);
1648
1649         if (qca->memdump_state == QCA_MEMDUMP_TIMEOUT ||
1650             qca->memdump_state == QCA_MEMDUMP_COLLECTED) {
1651                 cancel_work_sync(&qca->ctrl_memdump_evt);
1652                 skb_queue_purge(&qca->rx_memdump_q);
1653         }
1654
1655         clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
1656 }
1657
1658 static void qca_reset(struct hci_dev *hdev)
1659 {
1660         struct hci_uart *hu = hci_get_drvdata(hdev);
1661         struct qca_data *qca = hu->priv;
1662
1663         set_bit(QCA_SSR_TRIGGERED, &qca->flags);
1664         if (qca->memdump_state == QCA_MEMDUMP_IDLE) {
1665                 set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1666                 qca_send_crashbuffer(hu);
1667                 qca_wait_for_dump_collection(hdev);
1668         } else if (qca->memdump_state == QCA_MEMDUMP_COLLECTING) {
1669                 /* Let us wait here until memory dump collected or
1670                  * memory dump timer expired.
1671                  */
1672                 bt_dev_info(hdev, "waiting for dump to complete");
1673                 qca_wait_for_dump_collection(hdev);
1674         }
1675
1676         mutex_lock(&qca->hci_memdump_lock);
1677         if (qca->memdump_state != QCA_MEMDUMP_COLLECTED) {
1678                 qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
1679                 if (!test_bit(QCA_HW_ERROR_EVENT, &qca->flags)) {
1680                         /* Inject hw error event to reset the device
1681                          * and driver.
1682                          */
1683                         hci_reset_dev(hu->hdev);
1684                 }
1685         }
1686         mutex_unlock(&qca->hci_memdump_lock);
1687 }
1688
1689 static bool qca_wakeup(struct hci_dev *hdev)
1690 {
1691         struct hci_uart *hu = hci_get_drvdata(hdev);
1692         bool wakeup;
1693
1694         if (!hu->serdev)
1695                 return true;
1696
1697         /* BT SoC attached through the serial bus is handled by the serdev driver.
1698          * So we need to use the device handle of the serdev driver to get the
1699          * status of device may wakeup.
1700          */
1701         wakeup = device_may_wakeup(&hu->serdev->ctrl->dev);
1702         bt_dev_dbg(hu->hdev, "wakeup status : %d", wakeup);
1703
1704         return wakeup;
1705 }
1706
1707 static int qca_port_reopen(struct hci_uart *hu)
1708 {
1709         int ret;
1710
1711         /* Now the device is in ready state to communicate with host.
1712          * To sync host with device we need to reopen port.
1713          * Without this, we will have RTS and CTS synchronization
1714          * issues.
1715          */
1716         serdev_device_close(hu->serdev);
1717         ret = serdev_device_open(hu->serdev);
1718         if (ret) {
1719                 bt_dev_err(hu->hdev, "failed to open port");
1720                 return ret;
1721         }
1722
1723         hci_uart_set_flow_control(hu, false);
1724
1725         return 0;
1726 }
1727
1728 static int qca_regulator_init(struct hci_uart *hu)
1729 {
1730         enum qca_btsoc_type soc_type = qca_soc_type(hu);
1731         struct qca_serdev *qcadev;
1732         int ret;
1733         bool sw_ctrl_state;
1734
1735         /* Check for vregs status, may be hci down has turned
1736          * off the voltage regulator.
1737          */
1738         qcadev = serdev_device_get_drvdata(hu->serdev);
1739
1740         if (!qcadev->bt_power->vregs_on) {
1741                 serdev_device_close(hu->serdev);
1742                 ret = qca_regulator_enable(qcadev);
1743                 if (ret)
1744                         return ret;
1745
1746                 ret = serdev_device_open(hu->serdev);
1747                 if (ret) {
1748                         bt_dev_err(hu->hdev, "failed to open port");
1749                         return ret;
1750                 }
1751         }
1752
1753         switch (soc_type) {
1754         case QCA_WCN3950:
1755         case QCA_WCN3988:
1756         case QCA_WCN3990:
1757         case QCA_WCN3991:
1758         case QCA_WCN3998:
1759                 /* Forcefully enable wcn399x to enter in to boot mode. */
1760                 host_set_baudrate(hu, 2400);
1761                 ret = qca_send_power_pulse(hu, false);
1762                 if (ret)
1763                         return ret;
1764                 break;
1765
1766         default:
1767                 break;
1768         }
1769
1770         /* For wcn6750 need to enable gpio bt_en */
1771         if (qcadev->bt_en) {
1772                 gpiod_set_value_cansleep(qcadev->bt_en, 0);
1773                 msleep(50);
1774                 gpiod_set_value_cansleep(qcadev->bt_en, 1);
1775                 msleep(50);
1776                 if (qcadev->sw_ctrl) {
1777                         sw_ctrl_state = gpiod_get_value_cansleep(qcadev->sw_ctrl);
1778                         bt_dev_dbg(hu->hdev, "SW_CTRL is %d", sw_ctrl_state);
1779                 }
1780         }
1781
1782         qca_set_speed(hu, QCA_INIT_SPEED);
1783
1784         switch (soc_type) {
1785         case QCA_WCN3950:
1786         case QCA_WCN3988:
1787         case QCA_WCN3990:
1788         case QCA_WCN3991:
1789         case QCA_WCN3998:
1790                 ret = qca_send_power_pulse(hu, true);
1791                 if (ret)
1792                         return ret;
1793                 break;
1794
1795         default:
1796                 break;
1797         }
1798
1799         return qca_port_reopen(hu);
1800 }
1801
1802 static int qca_power_on(struct hci_dev *hdev)
1803 {
1804         struct hci_uart *hu = hci_get_drvdata(hdev);
1805         enum qca_btsoc_type soc_type = qca_soc_type(hu);
1806         struct qca_serdev *qcadev;
1807         struct qca_data *qca = hu->priv;
1808         int ret = 0;
1809
1810         /* Non-serdev device usually is powered by external power
1811          * and don't need additional action in driver for power on
1812          */
1813         if (!hu->serdev)
1814                 return 0;
1815
1816         switch (soc_type) {
1817         case QCA_WCN3950:
1818         case QCA_WCN3988:
1819         case QCA_WCN3990:
1820         case QCA_WCN3991:
1821         case QCA_WCN3998:
1822         case QCA_WCN6750:
1823         case QCA_WCN6855:
1824         case QCA_WCN7850:
1825         case QCA_QCA6390:
1826                 ret = qca_regulator_init(hu);
1827                 break;
1828
1829         default:
1830                 qcadev = serdev_device_get_drvdata(hu->serdev);
1831                 if (qcadev->bt_en) {
1832                         gpiod_set_value_cansleep(qcadev->bt_en, 1);
1833                         /* Controller needs time to bootup. */
1834                         msleep(150);
1835                 }
1836         }
1837
1838         clear_bit(QCA_BT_OFF, &qca->flags);
1839         return ret;
1840 }
1841
1842 static void hci_coredump_qca(struct hci_dev *hdev)
1843 {
1844         int err;
1845         static const u8 param[] = { 0x26 };
1846
1847         err = __hci_cmd_send(hdev, 0xfc0c, 1, param);
1848         if (err < 0)
1849                 bt_dev_err(hdev, "%s: trigger crash failed (%d)", __func__, err);
1850 }
1851
1852 static int qca_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id)
1853 {
1854         /* QCA uses 1 as non-HCI data path id for HFP */
1855         *data_path_id = 1;
1856         return 0;
1857 }
1858
1859 static int qca_configure_hfp_offload(struct hci_dev *hdev)
1860 {
1861         bt_dev_info(hdev, "HFP non-HCI data transport is supported");
1862         hdev->get_data_path_id = qca_get_data_path_id;
1863         /* Do not need to send HCI_Configure_Data_Path to configure non-HCI
1864          * data transport path for QCA controllers, so set below field as NULL.
1865          */
1866         hdev->get_codec_config_data = NULL;
1867         return 0;
1868 }
1869
1870 static int qca_setup(struct hci_uart *hu)
1871 {
1872         struct hci_dev *hdev = hu->hdev;
1873         struct qca_data *qca = hu->priv;
1874         unsigned int speed, qca_baudrate = QCA_BAUDRATE_115200;
1875         unsigned int retries = 0;
1876         enum qca_btsoc_type soc_type = qca_soc_type(hu);
1877         const char *firmware_name = qca_get_firmware_name(hu);
1878         const char *rampatch_name = qca_get_rampatch_name(hu);
1879         int ret;
1880         struct qca_btsoc_version ver;
1881         struct qca_serdev *qcadev;
1882         const char *soc_name;
1883
1884         ret = qca_check_speeds(hu);
1885         if (ret)
1886                 return ret;
1887
1888         clear_bit(QCA_ROM_FW, &qca->flags);
1889         /* Patch downloading has to be done without IBS mode */
1890         set_bit(QCA_IBS_DISABLED, &qca->flags);
1891
1892         /* Enable controller to do both LE scan and BR/EDR inquiry
1893          * simultaneously.
1894          */
1895         set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
1896
1897         switch (soc_type) {
1898         case QCA_QCA2066:
1899                 soc_name = "qca2066";
1900                 break;
1901
1902         case QCA_WCN3950:
1903         case QCA_WCN3988:
1904         case QCA_WCN3990:
1905         case QCA_WCN3991:
1906         case QCA_WCN3998:
1907                 soc_name = "wcn399x";
1908                 break;
1909
1910         case QCA_WCN6750:
1911                 soc_name = "wcn6750";
1912                 break;
1913
1914         case QCA_WCN6855:
1915                 soc_name = "wcn6855";
1916                 break;
1917
1918         case QCA_WCN7850:
1919                 soc_name = "wcn7850";
1920                 break;
1921
1922         default:
1923                 soc_name = "ROME/QCA6390";
1924         }
1925         bt_dev_info(hdev, "setting up %s", soc_name);
1926
1927         qca->memdump_state = QCA_MEMDUMP_IDLE;
1928
1929 retry:
1930         ret = qca_power_on(hdev);
1931         if (ret)
1932                 goto out;
1933
1934         clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
1935
1936         switch (soc_type) {
1937         case QCA_WCN3950:
1938         case QCA_WCN3988:
1939         case QCA_WCN3990:
1940         case QCA_WCN3991:
1941         case QCA_WCN3998:
1942         case QCA_WCN6750:
1943         case QCA_WCN6855:
1944         case QCA_WCN7850:
1945                 qcadev = serdev_device_get_drvdata(hu->serdev);
1946                 if (qcadev->bdaddr_property_broken)
1947                         set_bit(HCI_QUIRK_BDADDR_PROPERTY_BROKEN, &hdev->quirks);
1948
1949                 hci_set_aosp_capable(hdev);
1950
1951                 ret = qca_read_soc_version(hdev, &ver, soc_type);
1952                 if (ret)
1953                         goto out;
1954                 break;
1955
1956         default:
1957                 qca_set_speed(hu, QCA_INIT_SPEED);
1958         }
1959
1960         /* Setup user speed if needed */
1961         speed = qca_get_speed(hu, QCA_OPER_SPEED);
1962         if (speed) {
1963                 ret = qca_set_speed(hu, QCA_OPER_SPEED);
1964                 if (ret)
1965                         goto out;
1966
1967                 qca_baudrate = qca_get_baudrate_value(speed);
1968         }
1969
1970         switch (soc_type) {
1971         case QCA_WCN3950:
1972         case QCA_WCN3988:
1973         case QCA_WCN3990:
1974         case QCA_WCN3991:
1975         case QCA_WCN3998:
1976         case QCA_WCN6750:
1977         case QCA_WCN6855:
1978         case QCA_WCN7850:
1979                 break;
1980
1981         default:
1982                 /* Get QCA version information */
1983                 ret = qca_read_soc_version(hdev, &ver, soc_type);
1984                 if (ret)
1985                         goto out;
1986         }
1987
1988         /* Setup patch / NVM configurations */
1989         ret = qca_uart_setup(hdev, qca_baudrate, soc_type, ver,
1990                         firmware_name, rampatch_name);
1991         if (!ret) {
1992                 clear_bit(QCA_IBS_DISABLED, &qca->flags);
1993                 qca_debugfs_init(hdev);
1994                 hu->hdev->hw_error = qca_hw_error;
1995                 hu->hdev->reset = qca_reset;
1996                 if (hu->serdev) {
1997                         if (device_can_wakeup(hu->serdev->ctrl->dev.parent))
1998                                 hu->hdev->wakeup = qca_wakeup;
1999                 }
2000         } else if (ret == -ENOENT) {
2001                 /* No patch/nvm-config found, run with original fw/config */
2002                 set_bit(QCA_ROM_FW, &qca->flags);
2003                 ret = 0;
2004         } else if (ret == -EAGAIN) {
2005                 /*
2006                  * Userspace firmware loader will return -EAGAIN in case no
2007                  * patch/nvm-config is found, so run with original fw/config.
2008                  */
2009                 set_bit(QCA_ROM_FW, &qca->flags);
2010                 ret = 0;
2011         }
2012
2013 out:
2014         if (ret && retries < MAX_INIT_RETRIES) {
2015                 bt_dev_warn(hdev, "Retry BT power ON:%d", retries);
2016                 qca_power_shutdown(hu);
2017                 if (hu->serdev) {
2018                         serdev_device_close(hu->serdev);
2019                         ret = serdev_device_open(hu->serdev);
2020                         if (ret) {
2021                                 bt_dev_err(hdev, "failed to open port");
2022                                 return ret;
2023                         }
2024                 }
2025                 retries++;
2026                 goto retry;
2027         }
2028
2029         /* Setup bdaddr */
2030         if (soc_type == QCA_ROME)
2031                 hu->hdev->set_bdaddr = qca_set_bdaddr_rome;
2032         else
2033                 hu->hdev->set_bdaddr = qca_set_bdaddr;
2034
2035         if (soc_type == QCA_QCA2066)
2036                 qca_configure_hfp_offload(hdev);
2037
2038         qca->fw_version = le16_to_cpu(ver.patch_ver);
2039         qca->controller_id = le16_to_cpu(ver.rom_ver);
2040         hci_devcd_register(hdev, hci_coredump_qca, qca_dmp_hdr, NULL);
2041
2042         return ret;
2043 }
2044
2045 static const struct hci_uart_proto qca_proto = {
2046         .id             = HCI_UART_QCA,
2047         .name           = "QCA",
2048         .manufacturer   = 29,
2049         .init_speed     = 115200,
2050         .oper_speed     = 3000000,
2051         .open           = qca_open,
2052         .close          = qca_close,
2053         .flush          = qca_flush,
2054         .setup          = qca_setup,
2055         .recv           = qca_recv,
2056         .enqueue        = qca_enqueue,
2057         .dequeue        = qca_dequeue,
2058 };
2059
2060 static const struct qca_device_data qca_soc_data_wcn3950 __maybe_unused = {
2061         .soc_type = QCA_WCN3950,
2062         .vregs = (struct qca_vreg []) {
2063                 { "vddio", 15000  },
2064                 { "vddxo", 60000  },
2065                 { "vddrf", 155000 },
2066                 { "vddch0", 585000 },
2067         },
2068         .num_vregs = 4,
2069 };
2070
2071 static const struct qca_device_data qca_soc_data_wcn3988 __maybe_unused = {
2072         .soc_type = QCA_WCN3988,
2073         .vregs = (struct qca_vreg []) {
2074                 { "vddio", 15000  },
2075                 { "vddxo", 80000  },
2076                 { "vddrf", 300000 },
2077                 { "vddch0", 450000 },
2078         },
2079         .num_vregs = 4,
2080 };
2081
2082 static const struct qca_device_data qca_soc_data_wcn3990 __maybe_unused = {
2083         .soc_type = QCA_WCN3990,
2084         .vregs = (struct qca_vreg []) {
2085                 { "vddio", 15000  },
2086                 { "vddxo", 80000  },
2087                 { "vddrf", 300000 },
2088                 { "vddch0", 450000 },
2089         },
2090         .num_vregs = 4,
2091 };
2092
2093 static const struct qca_device_data qca_soc_data_wcn3991 __maybe_unused = {
2094         .soc_type = QCA_WCN3991,
2095         .vregs = (struct qca_vreg []) {
2096                 { "vddio", 15000  },
2097                 { "vddxo", 80000  },
2098                 { "vddrf", 300000 },
2099                 { "vddch0", 450000 },
2100         },
2101         .num_vregs = 4,
2102         .capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES,
2103 };
2104
2105 static const struct qca_device_data qca_soc_data_wcn3998 __maybe_unused = {
2106         .soc_type = QCA_WCN3998,
2107         .vregs = (struct qca_vreg []) {
2108                 { "vddio", 10000  },
2109                 { "vddxo", 80000  },
2110                 { "vddrf", 300000 },
2111                 { "vddch0", 450000 },
2112         },
2113         .num_vregs = 4,
2114 };
2115
2116 static const struct qca_device_data qca_soc_data_qca2066 __maybe_unused = {
2117         .soc_type = QCA_QCA2066,
2118         .num_vregs = 0,
2119         .capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES,
2120 };
2121
2122 static const struct qca_device_data qca_soc_data_qca6390 __maybe_unused = {
2123         .soc_type = QCA_QCA6390,
2124         .num_vregs = 0,
2125 };
2126
2127 static const struct qca_device_data qca_soc_data_wcn6750 __maybe_unused = {
2128         .soc_type = QCA_WCN6750,
2129         .vregs = (struct qca_vreg []) {
2130                 { "vddio", 5000 },
2131                 { "vddaon", 26000 },
2132                 { "vddbtcxmx", 126000 },
2133                 { "vddrfacmn", 12500 },
2134                 { "vddrfa0p8", 102000 },
2135                 { "vddrfa1p7", 302000 },
2136                 { "vddrfa1p2", 257000 },
2137                 { "vddrfa2p2", 1700000 },
2138                 { "vddasd", 200 },
2139         },
2140         .num_vregs = 9,
2141         .capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES,
2142 };
2143
2144 static const struct qca_device_data qca_soc_data_wcn6855 __maybe_unused = {
2145         .soc_type = QCA_WCN6855,
2146         .vregs = (struct qca_vreg []) {
2147                 { "vddio", 5000 },
2148                 { "vddbtcxmx", 126000 },
2149                 { "vddrfacmn", 12500 },
2150                 { "vddrfa0p8", 102000 },
2151                 { "vddrfa1p7", 302000 },
2152                 { "vddrfa1p2", 257000 },
2153         },
2154         .num_vregs = 6,
2155         .capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES,
2156 };
2157
2158 static const struct qca_device_data qca_soc_data_wcn7850 __maybe_unused = {
2159         .soc_type = QCA_WCN7850,
2160         .vregs = (struct qca_vreg []) {
2161                 { "vddio", 5000 },
2162                 { "vddaon", 26000 },
2163                 { "vdddig", 126000 },
2164                 { "vddrfa0p8", 102000 },
2165                 { "vddrfa1p2", 257000 },
2166                 { "vddrfa1p9", 302000 },
2167         },
2168         .num_vregs = 6,
2169         .capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES,
2170 };
2171
2172 static void qca_power_shutdown(struct hci_uart *hu)
2173 {
2174         struct qca_serdev *qcadev;
2175         struct qca_data *qca = hu->priv;
2176         unsigned long flags;
2177         enum qca_btsoc_type soc_type = qca_soc_type(hu);
2178         bool sw_ctrl_state;
2179         struct qca_power *power;
2180
2181         /* From this point we go into power off state. But serial port is
2182          * still open, stop queueing the IBS data and flush all the buffered
2183          * data in skb's.
2184          */
2185         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
2186         set_bit(QCA_IBS_DISABLED, &qca->flags);
2187         qca_flush(hu);
2188         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
2189
2190         /* Non-serdev device usually is powered by external power
2191          * and don't need additional action in driver for power down
2192          */
2193         if (!hu->serdev)
2194                 return;
2195
2196         qcadev = serdev_device_get_drvdata(hu->serdev);
2197         power = qcadev->bt_power;
2198
2199         if (power && power->pwrseq) {
2200                 pwrseq_power_off(power->pwrseq);
2201                 set_bit(QCA_BT_OFF, &qca->flags);
2202                 return;
2203         }
2204
2205         switch (soc_type) {
2206         case QCA_WCN3988:
2207         case QCA_WCN3990:
2208         case QCA_WCN3991:
2209         case QCA_WCN3998:
2210                 host_set_baudrate(hu, 2400);
2211                 qca_send_power_pulse(hu, false);
2212                 qca_regulator_disable(qcadev);
2213                 break;
2214
2215         case QCA_WCN6750:
2216         case QCA_WCN6855:
2217                 gpiod_set_value_cansleep(qcadev->bt_en, 0);
2218                 msleep(100);
2219                 qca_regulator_disable(qcadev);
2220                 if (qcadev->sw_ctrl) {
2221                         sw_ctrl_state = gpiod_get_value_cansleep(qcadev->sw_ctrl);
2222                         bt_dev_dbg(hu->hdev, "SW_CTRL is %d", sw_ctrl_state);
2223                 }
2224                 break;
2225
2226         default:
2227                 gpiod_set_value_cansleep(qcadev->bt_en, 0);
2228         }
2229
2230         set_bit(QCA_BT_OFF, &qca->flags);
2231 }
2232
2233 static int qca_power_off(struct hci_dev *hdev)
2234 {
2235         struct hci_uart *hu = hci_get_drvdata(hdev);
2236         struct qca_data *qca = hu->priv;
2237         enum qca_btsoc_type soc_type = qca_soc_type(hu);
2238
2239         hu->hdev->hw_error = NULL;
2240         hu->hdev->reset = NULL;
2241
2242         timer_delete_sync(&qca->wake_retrans_timer);
2243         timer_delete_sync(&qca->tx_idle_timer);
2244
2245         /* Stop sending shutdown command if soc crashes. */
2246         if (soc_type != QCA_ROME
2247                 && qca->memdump_state == QCA_MEMDUMP_IDLE) {
2248                 qca_send_pre_shutdown_cmd(hdev);
2249                 usleep_range(8000, 10000);
2250         }
2251
2252         qca_power_shutdown(hu);
2253         return 0;
2254 }
2255
2256 static int qca_regulator_enable(struct qca_serdev *qcadev)
2257 {
2258         struct qca_power *power = qcadev->bt_power;
2259         int ret;
2260
2261         if (power->pwrseq)
2262                 return pwrseq_power_on(power->pwrseq);
2263
2264         /* Already enabled */
2265         if (power->vregs_on)
2266                 return 0;
2267
2268         BT_DBG("enabling %d regulators)", power->num_vregs);
2269
2270         ret = regulator_bulk_enable(power->num_vregs, power->vreg_bulk);
2271         if (ret)
2272                 return ret;
2273
2274         power->vregs_on = true;
2275
2276         ret = clk_prepare_enable(qcadev->susclk);
2277         if (ret)
2278                 qca_regulator_disable(qcadev);
2279
2280         return ret;
2281 }
2282
2283 static void qca_regulator_disable(struct qca_serdev *qcadev)
2284 {
2285         struct qca_power *power;
2286
2287         if (!qcadev)
2288                 return;
2289
2290         power = qcadev->bt_power;
2291
2292         /* Already disabled? */
2293         if (!power->vregs_on)
2294                 return;
2295
2296         regulator_bulk_disable(power->num_vregs, power->vreg_bulk);
2297         power->vregs_on = false;
2298
2299         clk_disable_unprepare(qcadev->susclk);
2300 }
2301
2302 static int qca_init_regulators(struct qca_power *qca,
2303                                 const struct qca_vreg *vregs, size_t num_vregs)
2304 {
2305         struct regulator_bulk_data *bulk;
2306         int ret;
2307         int i;
2308
2309         bulk = devm_kcalloc(qca->dev, num_vregs, sizeof(*bulk), GFP_KERNEL);
2310         if (!bulk)
2311                 return -ENOMEM;
2312
2313         for (i = 0; i < num_vregs; i++)
2314                 bulk[i].supply = vregs[i].name;
2315
2316         ret = devm_regulator_bulk_get(qca->dev, num_vregs, bulk);
2317         if (ret < 0)
2318                 return ret;
2319
2320         for (i = 0; i < num_vregs; i++) {
2321                 ret = regulator_set_load(bulk[i].consumer, vregs[i].load_uA);
2322                 if (ret)
2323                         return ret;
2324         }
2325
2326         qca->vreg_bulk = bulk;
2327         qca->num_vregs = num_vregs;
2328
2329         return 0;
2330 }
2331
2332 static int qca_serdev_probe(struct serdev_device *serdev)
2333 {
2334         struct qca_serdev *qcadev;
2335         struct hci_dev *hdev;
2336         const struct qca_device_data *data;
2337         int err;
2338         bool power_ctrl_enabled = true;
2339
2340         qcadev = devm_kzalloc(&serdev->dev, sizeof(*qcadev), GFP_KERNEL);
2341         if (!qcadev)
2342                 return -ENOMEM;
2343
2344         qcadev->serdev_hu.serdev = serdev;
2345         data = device_get_match_data(&serdev->dev);
2346         serdev_device_set_drvdata(serdev, qcadev);
2347         device_property_read_string_array(&serdev->dev, "firmware-name",
2348                                          qcadev->firmware_name, ARRAY_SIZE(qcadev->firmware_name));
2349         device_property_read_u32(&serdev->dev, "max-speed",
2350                                  &qcadev->oper_speed);
2351         if (!qcadev->oper_speed)
2352                 BT_DBG("UART will pick default operating speed");
2353
2354         qcadev->bdaddr_property_broken = device_property_read_bool(&serdev->dev,
2355                         "qcom,local-bd-address-broken");
2356
2357         if (data)
2358                 qcadev->btsoc_type = data->soc_type;
2359         else
2360                 qcadev->btsoc_type = QCA_ROME;
2361
2362         switch (qcadev->btsoc_type) {
2363         case QCA_WCN3950:
2364         case QCA_WCN3988:
2365         case QCA_WCN3990:
2366         case QCA_WCN3991:
2367         case QCA_WCN3998:
2368         case QCA_WCN6750:
2369         case QCA_WCN6855:
2370         case QCA_WCN7850:
2371         case QCA_QCA6390:
2372                 qcadev->bt_power = devm_kzalloc(&serdev->dev,
2373                                                 sizeof(struct qca_power),
2374                                                 GFP_KERNEL);
2375                 if (!qcadev->bt_power)
2376                         return -ENOMEM;
2377                 break;
2378         default:
2379                 break;
2380         }
2381
2382         switch (qcadev->btsoc_type) {
2383         case QCA_WCN6855:
2384         case QCA_WCN7850:
2385         case QCA_WCN6750:
2386                 if (!device_property_present(&serdev->dev, "enable-gpios")) {
2387                         /*
2388                          * Backward compatibility with old DT sources. If the
2389                          * node doesn't have the 'enable-gpios' property then
2390                          * let's use the power sequencer. Otherwise, let's
2391                          * drive everything ourselves.
2392                          */
2393                         qcadev->bt_power->pwrseq = devm_pwrseq_get(&serdev->dev,
2394                                                                    "bluetooth");
2395
2396                         /*
2397                          * Some modules have BT_EN enabled via a hardware pull-up,
2398                          * meaning it is not defined in the DTS and is not controlled
2399                          * through the power sequence. In such cases, fall through
2400                          * to follow the legacy flow.
2401                          */
2402                         if (IS_ERR(qcadev->bt_power->pwrseq))
2403                                 qcadev->bt_power->pwrseq = NULL;
2404                         else
2405                                 break;
2406                 }
2407                 fallthrough;
2408         case QCA_WCN3950:
2409         case QCA_WCN3988:
2410         case QCA_WCN3990:
2411         case QCA_WCN3991:
2412         case QCA_WCN3998:
2413                 qcadev->bt_power->dev = &serdev->dev;
2414                 err = qca_init_regulators(qcadev->bt_power, data->vregs,
2415                                           data->num_vregs);
2416                 if (err) {
2417                         BT_ERR("Failed to init regulators:%d", err);
2418                         return err;
2419                 }
2420
2421                 qcadev->bt_power->vregs_on = false;
2422
2423                 qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
2424                                                GPIOD_OUT_LOW);
2425                 if (IS_ERR(qcadev->bt_en))
2426                         return dev_err_probe(&serdev->dev,
2427                                              PTR_ERR(qcadev->bt_en),
2428                                              "failed to acquire BT_EN gpio\n");
2429
2430                 if (!qcadev->bt_en &&
2431                     (data->soc_type == QCA_WCN6750 ||
2432                      data->soc_type == QCA_WCN6855))
2433                         power_ctrl_enabled = false;
2434
2435                 qcadev->sw_ctrl = devm_gpiod_get_optional(&serdev->dev, "swctrl",
2436                                                GPIOD_IN);
2437                 if (IS_ERR(qcadev->sw_ctrl) &&
2438                     (data->soc_type == QCA_WCN6750 ||
2439                      data->soc_type == QCA_WCN6855 ||
2440                      data->soc_type == QCA_WCN7850)) {
2441                         dev_err(&serdev->dev, "failed to acquire SW_CTRL gpio\n");
2442                         return PTR_ERR(qcadev->sw_ctrl);
2443                 }
2444
2445                 qcadev->susclk = devm_clk_get_optional(&serdev->dev, NULL);
2446                 if (IS_ERR(qcadev->susclk)) {
2447                         dev_err(&serdev->dev, "failed to acquire clk\n");
2448                         return PTR_ERR(qcadev->susclk);
2449                 }
2450                 break;
2451
2452         case QCA_QCA6390:
2453                 if (dev_of_node(&serdev->dev)) {
2454                         qcadev->bt_power->pwrseq = devm_pwrseq_get(&serdev->dev,
2455                                                                    "bluetooth");
2456                         if (IS_ERR(qcadev->bt_power->pwrseq))
2457                                 return PTR_ERR(qcadev->bt_power->pwrseq);
2458                         break;
2459                 }
2460                 fallthrough;
2461
2462         default:
2463                 qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
2464                                                GPIOD_OUT_LOW);
2465                 if (IS_ERR(qcadev->bt_en)) {
2466                         dev_err(&serdev->dev, "failed to acquire enable gpio\n");
2467                         return PTR_ERR(qcadev->bt_en);
2468                 }
2469
2470                 if (!qcadev->bt_en)
2471                         power_ctrl_enabled = false;
2472
2473                 qcadev->susclk = devm_clk_get_optional_enabled_with_rate(
2474                                         &serdev->dev, NULL, SUSCLK_RATE_32KHZ);
2475                 if (IS_ERR(qcadev->susclk)) {
2476                         dev_warn(&serdev->dev, "failed to acquire clk\n");
2477                         return PTR_ERR(qcadev->susclk);
2478                 }
2479         }
2480
2481         err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
2482         if (err) {
2483                 BT_ERR("serdev registration failed");
2484                 return err;
2485         }
2486
2487         hdev = qcadev->serdev_hu.hdev;
2488
2489         if (power_ctrl_enabled) {
2490                 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
2491                 hdev->shutdown = qca_power_off;
2492         }
2493
2494         if (data) {
2495                 /* Wideband speech support must be set per driver since it can't
2496                  * be queried via hci. Same with the valid le states quirk.
2497                  */
2498                 if (data->capabilities & QCA_CAP_WIDEBAND_SPEECH)
2499                         set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2500                                 &hdev->quirks);
2501
2502                 if (!(data->capabilities & QCA_CAP_VALID_LE_STATES))
2503                         set_bit(HCI_QUIRK_BROKEN_LE_STATES, &hdev->quirks);
2504         }
2505
2506         return 0;
2507 }
2508
2509 static void qca_serdev_remove(struct serdev_device *serdev)
2510 {
2511         struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2512         struct qca_power *power = qcadev->bt_power;
2513
2514         switch (qcadev->btsoc_type) {
2515         case QCA_WCN3988:
2516         case QCA_WCN3990:
2517         case QCA_WCN3991:
2518         case QCA_WCN3998:
2519         case QCA_WCN6750:
2520         case QCA_WCN6855:
2521         case QCA_WCN7850:
2522                 if (power->vregs_on)
2523                         qca_power_shutdown(&qcadev->serdev_hu);
2524                 break;
2525         default:
2526                 break;
2527         }
2528
2529         hci_uart_unregister_device(&qcadev->serdev_hu);
2530 }
2531
2532 static void qca_serdev_shutdown(struct device *dev)
2533 {
2534         int ret;
2535         int timeout = msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS);
2536         struct serdev_device *serdev = to_serdev_device(dev);
2537         struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2538         struct hci_uart *hu = &qcadev->serdev_hu;
2539         struct hci_dev *hdev = hu->hdev;
2540         const u8 ibs_wake_cmd[] = { 0xFD };
2541         const u8 edl_reset_soc_cmd[] = { 0x01, 0x00, 0xFC, 0x01, 0x05 };
2542
2543         if (qcadev->btsoc_type == QCA_QCA6390) {
2544                 /* The purpose of sending the VSC is to reset SOC into a initial
2545                  * state and the state will ensure next hdev->setup() success.
2546                  * if HCI_QUIRK_NON_PERSISTENT_SETUP is set, it means that
2547                  * hdev->setup() can do its job regardless of SoC state, so
2548                  * don't need to send the VSC.
2549                  * if HCI_SETUP is set, it means that hdev->setup() was never
2550                  * invoked and the SOC is already in the initial state, so
2551                  * don't also need to send the VSC.
2552                  */
2553                 if (test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks) ||
2554                     hci_dev_test_flag(hdev, HCI_SETUP))
2555                         return;
2556
2557                 /* The serdev must be in open state when control logic arrives
2558                  * here, so also fix the use-after-free issue caused by that
2559                  * the serdev is flushed or wrote after it is closed.
2560                  */
2561                 serdev_device_write_flush(serdev);
2562                 ret = serdev_device_write_buf(serdev, ibs_wake_cmd,
2563                                               sizeof(ibs_wake_cmd));
2564                 if (ret < 0) {
2565                         BT_ERR("QCA send IBS_WAKE_IND error: %d", ret);
2566                         return;
2567                 }
2568                 serdev_device_wait_until_sent(serdev, timeout);
2569                 usleep_range(8000, 10000);
2570
2571                 serdev_device_write_flush(serdev);
2572                 ret = serdev_device_write_buf(serdev, edl_reset_soc_cmd,
2573                                               sizeof(edl_reset_soc_cmd));
2574                 if (ret < 0) {
2575                         BT_ERR("QCA send EDL_RESET_REQ error: %d", ret);
2576                         return;
2577                 }
2578                 serdev_device_wait_until_sent(serdev, timeout);
2579                 usleep_range(8000, 10000);
2580         }
2581 }
2582
2583 static int __maybe_unused qca_suspend(struct device *dev)
2584 {
2585         struct serdev_device *serdev = to_serdev_device(dev);
2586         struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2587         struct hci_uart *hu = &qcadev->serdev_hu;
2588         struct qca_data *qca = hu->priv;
2589         unsigned long flags;
2590         bool tx_pending = false;
2591         int ret = 0;
2592         u8 cmd;
2593         u32 wait_timeout = 0;
2594
2595         set_bit(QCA_SUSPENDING, &qca->flags);
2596
2597         /* if BT SoC is running with default firmware then it does not
2598          * support in-band sleep
2599          */
2600         if (test_bit(QCA_ROM_FW, &qca->flags))
2601                 return 0;
2602
2603         /* During SSR after memory dump collection, controller will be
2604          * powered off and then powered on.If controller is powered off
2605          * during SSR then we should wait until SSR is completed.
2606          */
2607         if (test_bit(QCA_BT_OFF, &qca->flags) &&
2608             !test_bit(QCA_SSR_TRIGGERED, &qca->flags))
2609                 return 0;
2610
2611         if (test_bit(QCA_IBS_DISABLED, &qca->flags) ||
2612             test_bit(QCA_SSR_TRIGGERED, &qca->flags)) {
2613                 wait_timeout = test_bit(QCA_SSR_TRIGGERED, &qca->flags) ?
2614                                         IBS_DISABLE_SSR_TIMEOUT_MS :
2615                                         FW_DOWNLOAD_TIMEOUT_MS;
2616
2617                 /* QCA_IBS_DISABLED flag is set to true, During FW download
2618                  * and during memory dump collection. It is reset to false,
2619                  * After FW download complete.
2620                  */
2621                 wait_on_bit_timeout(&qca->flags, QCA_IBS_DISABLED,
2622                             TASK_UNINTERRUPTIBLE, msecs_to_jiffies(wait_timeout));
2623
2624                 if (test_bit(QCA_IBS_DISABLED, &qca->flags)) {
2625                         bt_dev_err(hu->hdev, "SSR or FW download time out");
2626                         ret = -ETIMEDOUT;
2627                         goto error;
2628                 }
2629         }
2630
2631         cancel_work_sync(&qca->ws_awake_device);
2632         cancel_work_sync(&qca->ws_awake_rx);
2633
2634         spin_lock_irqsave_nested(&qca->hci_ibs_lock,
2635                                  flags, SINGLE_DEPTH_NESTING);
2636
2637         switch (qca->tx_ibs_state) {
2638         case HCI_IBS_TX_WAKING:
2639                 timer_delete(&qca->wake_retrans_timer);
2640                 fallthrough;
2641         case HCI_IBS_TX_AWAKE:
2642                 timer_delete(&qca->tx_idle_timer);
2643
2644                 serdev_device_write_flush(hu->serdev);
2645                 cmd = HCI_IBS_SLEEP_IND;
2646                 ret = serdev_device_write_buf(hu->serdev, &cmd, sizeof(cmd));
2647
2648                 if (ret < 0) {
2649                         BT_ERR("Failed to send SLEEP to device");
2650                         break;
2651                 }
2652
2653                 qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
2654                 qca->ibs_sent_slps++;
2655                 tx_pending = true;
2656                 break;
2657
2658         case HCI_IBS_TX_ASLEEP:
2659                 break;
2660
2661         default:
2662                 BT_ERR("Spurious tx state %d", qca->tx_ibs_state);
2663                 ret = -EINVAL;
2664                 break;
2665         }
2666
2667         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
2668
2669         if (ret < 0)
2670                 goto error;
2671
2672         if (tx_pending) {
2673                 serdev_device_wait_until_sent(hu->serdev,
2674                                               msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS));
2675                 serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_OFF, hu);
2676         }
2677
2678         /* Wait for HCI_IBS_SLEEP_IND sent by device to indicate its Tx is going
2679          * to sleep, so that the packet does not wake the system later.
2680          */
2681         ret = wait_event_interruptible_timeout(qca->suspend_wait_q,
2682                         qca->rx_ibs_state == HCI_IBS_RX_ASLEEP,
2683                         msecs_to_jiffies(IBS_BTSOC_TX_IDLE_TIMEOUT_MS));
2684         if (ret == 0) {
2685                 ret = -ETIMEDOUT;
2686                 goto error;
2687         }
2688
2689         return 0;
2690
2691 error:
2692         clear_bit(QCA_SUSPENDING, &qca->flags);
2693
2694         return ret;
2695 }
2696
2697 static int __maybe_unused qca_resume(struct device *dev)
2698 {
2699         struct serdev_device *serdev = to_serdev_device(dev);
2700         struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2701         struct hci_uart *hu = &qcadev->serdev_hu;
2702         struct qca_data *qca = hu->priv;
2703
2704         clear_bit(QCA_SUSPENDING, &qca->flags);
2705
2706         return 0;
2707 }
2708
2709 static SIMPLE_DEV_PM_OPS(qca_pm_ops, qca_suspend, qca_resume);
2710
2711 #ifdef CONFIG_OF
2712 static const struct of_device_id qca_bluetooth_of_match[] = {
2713         { .compatible = "qcom,qca2066-bt", .data = &qca_soc_data_qca2066},
2714         { .compatible = "qcom,qca6174-bt" },
2715         { .compatible = "qcom,qca6390-bt", .data = &qca_soc_data_qca6390},
2716         { .compatible = "qcom,qca9377-bt" },
2717         { .compatible = "qcom,wcn3950-bt", .data = &qca_soc_data_wcn3950},
2718         { .compatible = "qcom,wcn3988-bt", .data = &qca_soc_data_wcn3988},
2719         { .compatible = "qcom,wcn3990-bt", .data = &qca_soc_data_wcn3990},
2720         { .compatible = "qcom,wcn3991-bt", .data = &qca_soc_data_wcn3991},
2721         { .compatible = "qcom,wcn3998-bt", .data = &qca_soc_data_wcn3998},
2722         { .compatible = "qcom,wcn6750-bt", .data = &qca_soc_data_wcn6750},
2723         { .compatible = "qcom,wcn6855-bt", .data = &qca_soc_data_wcn6855},
2724         { .compatible = "qcom,wcn7850-bt", .data = &qca_soc_data_wcn7850},
2725         { /* sentinel */ }
2726 };
2727 MODULE_DEVICE_TABLE(of, qca_bluetooth_of_match);
2728 #endif
2729
2730 #ifdef CONFIG_ACPI
2731 static const struct acpi_device_id qca_bluetooth_acpi_match[] = {
2732         { "QCOM2066", (kernel_ulong_t)&qca_soc_data_qca2066 },
2733         { "QCOM6390", (kernel_ulong_t)&qca_soc_data_qca6390 },
2734         { "DLA16390", (kernel_ulong_t)&qca_soc_data_qca6390 },
2735         { "DLB16390", (kernel_ulong_t)&qca_soc_data_qca6390 },
2736         { "DLB26390", (kernel_ulong_t)&qca_soc_data_qca6390 },
2737         { },
2738 };
2739 MODULE_DEVICE_TABLE(acpi, qca_bluetooth_acpi_match);
2740 #endif
2741
2742 #ifdef CONFIG_DEV_COREDUMP
2743 static void hciqca_coredump(struct device *dev)
2744 {
2745         struct serdev_device *serdev = to_serdev_device(dev);
2746         struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2747         struct hci_uart *hu = &qcadev->serdev_hu;
2748         struct hci_dev  *hdev = hu->hdev;
2749
2750         if (hdev->dump.coredump)
2751                 hdev->dump.coredump(hdev);
2752 }
2753 #endif
2754
2755 static struct serdev_device_driver qca_serdev_driver = {
2756         .probe = qca_serdev_probe,
2757         .remove = qca_serdev_remove,
2758         .driver = {
2759                 .name = "hci_uart_qca",
2760                 .of_match_table = of_match_ptr(qca_bluetooth_of_match),
2761                 .acpi_match_table = ACPI_PTR(qca_bluetooth_acpi_match),
2762                 .shutdown = qca_serdev_shutdown,
2763                 .pm = &qca_pm_ops,
2764 #ifdef CONFIG_DEV_COREDUMP
2765                 .coredump = hciqca_coredump,
2766 #endif
2767         },
2768 };
2769
2770 int __init qca_init(void)
2771 {
2772         serdev_device_driver_register(&qca_serdev_driver);
2773
2774         return hci_uart_register_proto(&qca_proto);
2775 }
2776
2777 int __exit qca_deinit(void)
2778 {
2779         serdev_device_driver_unregister(&qca_serdev_driver);
2780
2781         return hci_uart_unregister_proto(&qca_proto);
2782 }