drivers/bluetooth/hci_qca.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  Bluetooth Software UART Qualcomm protocol
   4  *
   5  *  HCI_IBS (HCI In-Band Sleep) is Qualcomm's power management
   6  *  protocol extension to H4.
   7  *
   8  *  Copyright (C) 2007 Texas Instruments, Inc.
   9  *  Copyright (c) 2010, 2012, 2018 The Linux Foundation. All rights reserved.
  10  *
  11  *  Acknowledgements:
  12  *  This file is based on hci_ll.c, which was...
  13  *  Written by Ohad Ben-Cohen <ohad@bencohen.org>
  14  *  which was in turn based on hci_h4.c, which was written
  15  *  by Maxim Krasnyansky and Marcel Holtmann.
  16  */
  17
  18 #include <linux/kernel.h>
  19 #include <linux/clk.h>
  20 #include <linux/completion.h>
  21 #include <linux/debugfs.h>
  22 #include <linux/delay.h>
  23 #include <linux/devcoredump.h>
  24 #include <linux/device.h>
  25 #include <linux/gpio/consumer.h>
  26 #include <linux/mod_devicetable.h>
  27 #include <linux/module.h>
  28 #include <linux/of_device.h>
  29 #include <linux/acpi.h>
  30 #include <linux/platform_device.h>
  31 #include <linux/regulator/consumer.h>
  32 #include <linux/serdev.h>
  33 #include <linux/mutex.h>
  34 #include <asm/unaligned.h>
  35
  36 #include <net/bluetooth/bluetooth.h>
  37 #include <net/bluetooth/hci_core.h>
  38
  39 #include "hci_uart.h"
  40 #include "btqca.h"
  41
  42 /* HCI_IBS protocol messages */
  43 #define HCI_IBS_SLEEP_IND       0xFE
  44 #define HCI_IBS_WAKE_IND        0xFD
  45 #define HCI_IBS_WAKE_ACK        0xFC
  46 #define HCI_MAX_IBS_SIZE        10
  47
  48 #define IBS_WAKE_RETRANS_TIMEOUT_MS     100
  49 #define IBS_BTSOC_TX_IDLE_TIMEOUT_MS    200
  50 #define IBS_HOST_TX_IDLE_TIMEOUT_MS     2000
  51 #define CMD_TRANS_TIMEOUT_MS            100
  52 #define MEMDUMP_TIMEOUT_MS              8000
  53 #define IBS_DISABLE_SSR_TIMEOUT_MS \
  54         (MEMDUMP_TIMEOUT_MS + FW_DOWNLOAD_TIMEOUT_MS)
  55 #define FW_DOWNLOAD_TIMEOUT_MS          3000
  56
  57 /* susclk rate */
  58 #define SUSCLK_RATE_32KHZ       32768
  59
  60 /* Controller debug log header */
  61 #define QCA_DEBUG_HANDLE        0x2EDC
  62
  63 /* max retry count when init fails */
  64 #define MAX_INIT_RETRIES 3
  65
  66 /* Controller dump header */
  67 #define QCA_SSR_DUMP_HANDLE             0x0108
  68 #define QCA_DUMP_PACKET_SIZE            255
  69 #define QCA_LAST_SEQUENCE_NUM           0xFFFF
  70 #define QCA_CRASHBYTE_PACKET_LEN        1096
  71 #define QCA_MEMDUMP_BYTE                0xFB
  72
  73 enum qca_flags {
  74         QCA_IBS_DISABLED,
  75         QCA_DROP_VENDOR_EVENT,
  76         QCA_SUSPENDING,
  77         QCA_MEMDUMP_COLLECTION,
  78         QCA_HW_ERROR_EVENT,
  79         QCA_SSR_TRIGGERED,
  80         QCA_BT_OFF,
  81         QCA_ROM_FW
  82 };
  83
  84 enum qca_capabilities {
  85         QCA_CAP_WIDEBAND_SPEECH = BIT(0),
  86         QCA_CAP_VALID_LE_STATES = BIT(1),
  87 };
  88
  89 /* HCI_IBS transmit side sleep protocol states */
  90 enum tx_ibs_states {
  91         HCI_IBS_TX_ASLEEP,
  92         HCI_IBS_TX_WAKING,
  93         HCI_IBS_TX_AWAKE,
  94 };
  95
  96 /* HCI_IBS receive side sleep protocol states */
  97 enum rx_states {
  98         HCI_IBS_RX_ASLEEP,
  99         HCI_IBS_RX_AWAKE,
 100 };
 101
 102 /* HCI_IBS transmit and receive side clock state vote */
 103 enum hci_ibs_clock_state_vote {
 104         HCI_IBS_VOTE_STATS_UPDATE,
 105         HCI_IBS_TX_VOTE_CLOCK_ON,
 106         HCI_IBS_TX_VOTE_CLOCK_OFF,
 107         HCI_IBS_RX_VOTE_CLOCK_ON,
 108         HCI_IBS_RX_VOTE_CLOCK_OFF,
 109 };
 110
 111 /* Controller memory dump states */
 112 enum qca_memdump_states {
 113         QCA_MEMDUMP_IDLE,
 114         QCA_MEMDUMP_COLLECTING,
 115         QCA_MEMDUMP_COLLECTED,
 116         QCA_MEMDUMP_TIMEOUT,
 117 };
 118
 119 struct qca_memdump_data {
 120         char *memdump_buf_head;
 121         char *memdump_buf_tail;
 122         u32 current_seq_no;
 123         u32 received_dump;
 124         u32 ram_dump_size;
 125 };
 126
 127 struct qca_memdump_event_hdr {
 128         __u8    evt;
 129         __u8    plen;
 130         __u16   opcode;
 131         __u16   seq_no;
 132         __u8    reserved;
 133 } __packed;
 134
 135
 136 struct qca_dump_size {
 137         u32 dump_size;
 138 } __packed;
 139
 140 struct qca_data {
 141         struct hci_uart *hu;
 142         struct sk_buff *rx_skb;
 143         struct sk_buff_head txq;
 144         struct sk_buff_head tx_wait_q;  /* HCI_IBS wait queue   */
 145         struct sk_buff_head rx_memdump_q;       /* Memdump wait queue   */
 146         spinlock_t hci_ibs_lock;        /* HCI_IBS state lock   */
 147         u8 tx_ibs_state;        /* HCI_IBS transmit side power state*/
 148         u8 rx_ibs_state;        /* HCI_IBS receive side power state */
 149         bool tx_vote;           /* Clock must be on for TX */
 150         bool rx_vote;           /* Clock must be on for RX */
 151         struct timer_list tx_idle_timer;
 152         u32 tx_idle_delay;
 153         struct timer_list wake_retrans_timer;
 154         u32 wake_retrans;
 155         struct workqueue_struct *workqueue;
 156         struct work_struct ws_awake_rx;
 157         struct work_struct ws_awake_device;
 158         struct work_struct ws_rx_vote_off;
 159         struct work_struct ws_tx_vote_off;
 160         struct work_struct ctrl_memdump_evt;
 161         struct delayed_work ctrl_memdump_timeout;
 162         struct qca_memdump_data *qca_memdump;
 163         unsigned long flags;
 164         struct completion drop_ev_comp;
 165         wait_queue_head_t suspend_wait_q;
 166         enum qca_memdump_states memdump_state;
 167         struct mutex hci_memdump_lock;
 168
 169         /* For debugging purpose */
 170         u64 ibs_sent_wacks;
 171         u64 ibs_sent_slps;
 172         u64 ibs_sent_wakes;
 173         u64 ibs_recv_wacks;
 174         u64 ibs_recv_slps;
 175         u64 ibs_recv_wakes;
 176         u64 vote_last_jif;
 177         u32 vote_on_ms;
 178         u32 vote_off_ms;
 179         u64 tx_votes_on;
 180         u64 rx_votes_on;
 181         u64 tx_votes_off;
 182         u64 rx_votes_off;
 183         u64 votes_on;
 184         u64 votes_off;
 185 };
 186
 187 enum qca_speed_type {
 188         QCA_INIT_SPEED = 1,
 189         QCA_OPER_SPEED
 190 };
 191
 192 /*
 193  * Voltage regulator information required for configuring the
 194  * QCA Bluetooth chipset
 195  */
 196 struct qca_vreg {
 197         const char *name;
 198         unsigned int load_uA;
 199 };
 200
 201 struct qca_device_data {
 202         enum qca_btsoc_type soc_type;
 203         struct qca_vreg *vregs;
 204         size_t num_vregs;
 205         uint32_t capabilities;
 206 };
 207
 208 /*
 209  * Platform data for the QCA Bluetooth power driver.
 210  */
 211 struct qca_power {
 212         struct device *dev;
 213         struct regulator_bulk_data *vreg_bulk;
 214         int num_vregs;
 215         bool vregs_on;
 216 };
 217
 218 struct qca_serdev {
 219         struct hci_uart  serdev_hu;
 220         struct gpio_desc *bt_en;
 221         struct gpio_desc *sw_ctrl;
 222         struct clk       *susclk;
 223         enum qca_btsoc_type btsoc_type;
 224         struct qca_power *bt_power;
 225         u32 init_speed;
 226         u32 oper_speed;
 227         const char *firmware_name;
 228 };
 229
 230 static int qca_regulator_enable(struct qca_serdev *qcadev);
 231 static void qca_regulator_disable(struct qca_serdev *qcadev);
 232 static void qca_power_shutdown(struct hci_uart *hu);
 233 static int qca_power_off(struct hci_dev *hdev);
 234 static void qca_controller_memdump(struct work_struct *work);
 235
 236 static enum qca_btsoc_type qca_soc_type(struct hci_uart *hu)
 237 {
 238         enum qca_btsoc_type soc_type;
 239
 240         if (hu->serdev) {
 241                 struct qca_serdev *qsd = serdev_device_get_drvdata(hu->serdev);
 242
 243                 soc_type = qsd->btsoc_type;
 244         } else {
 245                 soc_type = QCA_ROME;
 246         }
 247
 248         return soc_type;
 249 }
 250
 251 static const char *qca_get_firmware_name(struct hci_uart *hu)
 252 {
 253         if (hu->serdev) {
 254                 struct qca_serdev *qsd = serdev_device_get_drvdata(hu->serdev);
 255
 256                 return qsd->firmware_name;
 257         } else {
 258                 return NULL;
 259         }
 260 }
 261
 262 static void __serial_clock_on(struct tty_struct *tty)
 263 {
 264         /* TODO: Some chipset requires to enable UART clock on client
 265          * side to save power consumption or manual work is required.
 266          * Please put your code to control UART clock here if needed
 267          */
 268 }
 269
 270 static void __serial_clock_off(struct tty_struct *tty)
 271 {
 272         /* TODO: Some chipset requires to disable UART clock on client
 273          * side to save power consumption or manual work is required.
 274          * Please put your code to control UART clock off here if needed
 275          */
 276 }
 277
 278 /* serial_clock_vote needs to be called with the ibs lock held */
 279 static void serial_clock_vote(unsigned long vote, struct hci_uart *hu)
 280 {
 281         struct qca_data *qca = hu->priv;
 282         unsigned int diff;
 283
 284         bool old_vote = (qca->tx_vote | qca->rx_vote);
 285         bool new_vote;
 286
 287         switch (vote) {
 288         case HCI_IBS_VOTE_STATS_UPDATE:
 289                 diff = jiffies_to_msecs(jiffies - qca->vote_last_jif);
 290
 291                 if (old_vote)
 292                         qca->vote_off_ms += diff;
 293                 else
 294                         qca->vote_on_ms += diff;
 295                 return;
 296
 297         case HCI_IBS_TX_VOTE_CLOCK_ON:
 298                 qca->tx_vote = true;
 299                 qca->tx_votes_on++;
 300                 break;
 301
 302         case HCI_IBS_RX_VOTE_CLOCK_ON:
 303                 qca->rx_vote = true;
 304                 qca->rx_votes_on++;
 305                 break;
 306
 307         case HCI_IBS_TX_VOTE_CLOCK_OFF:
 308                 qca->tx_vote = false;
 309                 qca->tx_votes_off++;
 310                 break;
 311
 312         case HCI_IBS_RX_VOTE_CLOCK_OFF:
 313                 qca->rx_vote = false;
 314                 qca->rx_votes_off++;
 315                 break;
 316
 317         default:
 318                 BT_ERR("Voting irregularity");
 319                 return;
 320         }
 321
 322         new_vote = qca->rx_vote | qca->tx_vote;
 323
 324         if (new_vote != old_vote) {
 325                 if (new_vote)
 326                         __serial_clock_on(hu->tty);
 327                 else
 328                         __serial_clock_off(hu->tty);
 329
 330                 BT_DBG("Vote serial clock %s(%s)", new_vote ? "true" : "false",
 331                        vote ? "true" : "false");
 332
 333                 diff = jiffies_to_msecs(jiffies - qca->vote_last_jif);
 334
 335                 if (new_vote) {
 336                         qca->votes_on++;
 337                         qca->vote_off_ms += diff;
 338                 } else {
 339                         qca->votes_off++;
 340                         qca->vote_on_ms += diff;
 341                 }
 342                 qca->vote_last_jif = jiffies;
 343         }
 344 }
 345
 346 /* Builds and sends an HCI_IBS command packet.
 347  * These are very simple packets with only 1 cmd byte.
 348  */
 349 static int send_hci_ibs_cmd(u8 cmd, struct hci_uart *hu)
 350 {
 351         int err = 0;
 352         struct sk_buff *skb = NULL;
 353         struct qca_data *qca = hu->priv;
 354
 355         BT_DBG("hu %p send hci ibs cmd 0x%x", hu, cmd);
 356
 357         skb = bt_skb_alloc(1, GFP_ATOMIC);
 358         if (!skb) {
 359                 BT_ERR("Failed to allocate memory for HCI_IBS packet");
 360                 return -ENOMEM;
 361         }
 362
 363         /* Assign HCI_IBS type */
 364         skb_put_u8(skb, cmd);
 365
 366         skb_queue_tail(&qca->txq, skb);
 367
 368         return err;
 369 }
 370
 371 static void qca_wq_awake_device(struct work_struct *work)
 372 {
 373         struct qca_data *qca = container_of(work, struct qca_data,
 374                                             ws_awake_device);
 375         struct hci_uart *hu = qca->hu;
 376         unsigned long retrans_delay;
 377         unsigned long flags;
 378
 379         BT_DBG("hu %p wq awake device", hu);
 380
 381         /* Vote for serial clock */
 382         serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_ON, hu);
 383
 384         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 385
 386         /* Send wake indication to device */
 387         if (send_hci_ibs_cmd(HCI_IBS_WAKE_IND, hu) < 0)
 388                 BT_ERR("Failed to send WAKE to device");
 389
 390         qca->ibs_sent_wakes++;
 391
 392         /* Start retransmit timer */
 393         retrans_delay = msecs_to_jiffies(qca->wake_retrans);
 394         mod_timer(&qca->wake_retrans_timer, jiffies + retrans_delay);
 395
 396         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 397
 398         /* Actually send the packets */
 399         hci_uart_tx_wakeup(hu);
 400 }
 401
 402 static void qca_wq_awake_rx(struct work_struct *work)
 403 {
 404         struct qca_data *qca = container_of(work, struct qca_data,
 405                                             ws_awake_rx);
 406         struct hci_uart *hu = qca->hu;
 407         unsigned long flags;
 408
 409         BT_DBG("hu %p wq awake rx", hu);
 410
 411         serial_clock_vote(HCI_IBS_RX_VOTE_CLOCK_ON, hu);
 412
 413         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 414         qca->rx_ibs_state = HCI_IBS_RX_AWAKE;
 415
 416         /* Always acknowledge device wake up,
 417          * sending IBS message doesn't count as TX ON.
 418          */
 419         if (send_hci_ibs_cmd(HCI_IBS_WAKE_ACK, hu) < 0)
 420                 BT_ERR("Failed to acknowledge device wake up");
 421
 422         qca->ibs_sent_wacks++;
 423
 424         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 425
 426         /* Actually send the packets */
 427         hci_uart_tx_wakeup(hu);
 428 }
 429
 430 static void qca_wq_serial_rx_clock_vote_off(struct work_struct *work)
 431 {
 432         struct qca_data *qca = container_of(work, struct qca_data,
 433                                             ws_rx_vote_off);
 434         struct hci_uart *hu = qca->hu;
 435
 436         BT_DBG("hu %p rx clock vote off", hu);
 437
 438         serial_clock_vote(HCI_IBS_RX_VOTE_CLOCK_OFF, hu);
 439 }
 440
 441 static void qca_wq_serial_tx_clock_vote_off(struct work_struct *work)
 442 {
 443         struct qca_data *qca = container_of(work, struct qca_data,
 444                                             ws_tx_vote_off);
 445         struct hci_uart *hu = qca->hu;
 446
 447         BT_DBG("hu %p tx clock vote off", hu);
 448
 449         /* Run HCI tx handling unlocked */
 450         hci_uart_tx_wakeup(hu);
 451
 452         /* Now that message queued to tty driver, vote for tty clocks off.
 453          * It is up to the tty driver to pend the clocks off until tx done.
 454          */
 455         serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_OFF, hu);
 456 }
 457
 458 static void hci_ibs_tx_idle_timeout(struct timer_list *t)
 459 {
 460         struct qca_data *qca = from_timer(qca, t, tx_idle_timer);
 461         struct hci_uart *hu = qca->hu;
 462         unsigned long flags;
 463
 464         BT_DBG("hu %p idle timeout in %d state", hu, qca->tx_ibs_state);
 465
 466         spin_lock_irqsave_nested(&qca->hci_ibs_lock,
 467                                  flags, SINGLE_DEPTH_NESTING);
 468
 469         switch (qca->tx_ibs_state) {
 470         case HCI_IBS_TX_AWAKE:
 471                 /* TX_IDLE, go to SLEEP */
 472                 if (send_hci_ibs_cmd(HCI_IBS_SLEEP_IND, hu) < 0) {
 473                         BT_ERR("Failed to send SLEEP to device");
 474                         break;
 475                 }
 476                 qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
 477                 qca->ibs_sent_slps++;
 478                 queue_work(qca->workqueue, &qca->ws_tx_vote_off);
 479                 break;
 480
 481         case HCI_IBS_TX_ASLEEP:
 482         case HCI_IBS_TX_WAKING:
 483         default:
 484                 BT_ERR("Spurious timeout tx state %d", qca->tx_ibs_state);
 485                 break;
 486         }
 487
 488         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 489 }
 490
 491 static void hci_ibs_wake_retrans_timeout(struct timer_list *t)
 492 {
 493         struct qca_data *qca = from_timer(qca, t, wake_retrans_timer);
 494         struct hci_uart *hu = qca->hu;
 495         unsigned long flags, retrans_delay;
 496         bool retransmit = false;
 497
 498         BT_DBG("hu %p wake retransmit timeout in %d state",
 499                 hu, qca->tx_ibs_state);
 500
 501         spin_lock_irqsave_nested(&qca->hci_ibs_lock,
 502                                  flags, SINGLE_DEPTH_NESTING);
 503
 504         /* Don't retransmit the HCI_IBS_WAKE_IND when suspending. */
 505         if (test_bit(QCA_SUSPENDING, &qca->flags)) {
 506                 spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 507                 return;
 508         }
 509
 510         switch (qca->tx_ibs_state) {
 511         case HCI_IBS_TX_WAKING:
 512                 /* No WAKE_ACK, retransmit WAKE */
 513                 retransmit = true;
 514                 if (send_hci_ibs_cmd(HCI_IBS_WAKE_IND, hu) < 0) {
 515                         BT_ERR("Failed to acknowledge device wake up");
 516                         break;
 517                 }
 518                 qca->ibs_sent_wakes++;
 519                 retrans_delay = msecs_to_jiffies(qca->wake_retrans);
 520                 mod_timer(&qca->wake_retrans_timer, jiffies + retrans_delay);
 521                 break;
 522
 523         case HCI_IBS_TX_ASLEEP:
 524         case HCI_IBS_TX_AWAKE:
 525         default:
 526                 BT_ERR("Spurious timeout tx state %d", qca->tx_ibs_state);
 527                 break;
 528         }
 529
 530         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 531
 532         if (retransmit)
 533                 hci_uart_tx_wakeup(hu);
 534 }
 535
 536
 537 static void qca_controller_memdump_timeout(struct work_struct *work)
 538 {
 539         struct qca_data *qca = container_of(work, struct qca_data,
 540                                         ctrl_memdump_timeout.work);
 541         struct hci_uart *hu = qca->hu;
 542
 543         mutex_lock(&qca->hci_memdump_lock);
 544         if (test_bit(QCA_MEMDUMP_COLLECTION, &qca->flags)) {
 545                 qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
 546                 if (!test_bit(QCA_HW_ERROR_EVENT, &qca->flags)) {
 547                         /* Inject hw error event to reset the device
 548                          * and driver.
 549                          */
 550                         hci_reset_dev(hu->hdev);
 551                 }
 552         }
 553
 554         mutex_unlock(&qca->hci_memdump_lock);
 555 }
 556
 557
 558 /* Initialize protocol */
 559 static int qca_open(struct hci_uart *hu)
 560 {
 561         struct qca_serdev *qcadev;
 562         struct qca_data *qca;
 563
 564         BT_DBG("hu %p qca_open", hu);
 565
 566         if (!hci_uart_has_flow_control(hu))
 567                 return -EOPNOTSUPP;
 568
 569         qca = kzalloc(sizeof(struct qca_data), GFP_KERNEL);
 570         if (!qca)
 571                 return -ENOMEM;
 572
 573         skb_queue_head_init(&qca->txq);
 574         skb_queue_head_init(&qca->tx_wait_q);
 575         skb_queue_head_init(&qca->rx_memdump_q);
 576         spin_lock_init(&qca->hci_ibs_lock);
 577         mutex_init(&qca->hci_memdump_lock);
 578         qca->workqueue = alloc_ordered_workqueue("qca_wq", 0);
 579         if (!qca->workqueue) {
 580                 BT_ERR("QCA Workqueue not initialized properly");
 581                 kfree(qca);
 582                 return -ENOMEM;
 583         }
 584
 585         INIT_WORK(&qca->ws_awake_rx, qca_wq_awake_rx);
 586         INIT_WORK(&qca->ws_awake_device, qca_wq_awake_device);
 587         INIT_WORK(&qca->ws_rx_vote_off, qca_wq_serial_rx_clock_vote_off);
 588         INIT_WORK(&qca->ws_tx_vote_off, qca_wq_serial_tx_clock_vote_off);
 589         INIT_WORK(&qca->ctrl_memdump_evt, qca_controller_memdump);
 590         INIT_DELAYED_WORK(&qca->ctrl_memdump_timeout,
 591                           qca_controller_memdump_timeout);
 592         init_waitqueue_head(&qca->suspend_wait_q);
 593
 594         qca->hu = hu;
 595         init_completion(&qca->drop_ev_comp);
 596
 597         /* Assume we start with both sides asleep -- extra wakes OK */
 598         qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
 599         qca->rx_ibs_state = HCI_IBS_RX_ASLEEP;
 600
 601         qca->vote_last_jif = jiffies;
 602
 603         hu->priv = qca;
 604
 605         if (hu->serdev) {
 606                 qcadev = serdev_device_get_drvdata(hu->serdev);
 607
 608                 if (qca_is_wcn399x(qcadev->btsoc_type) ||
 609                     qca_is_wcn6750(qcadev->btsoc_type))
 610                         hu->init_speed = qcadev->init_speed;
 611
 612                 if (qcadev->oper_speed)
 613                         hu->oper_speed = qcadev->oper_speed;
 614         }
 615
 616         timer_setup(&qca->wake_retrans_timer, hci_ibs_wake_retrans_timeout, 0);
 617         qca->wake_retrans = IBS_WAKE_RETRANS_TIMEOUT_MS;
 618
 619         timer_setup(&qca->tx_idle_timer, hci_ibs_tx_idle_timeout, 0);
 620         qca->tx_idle_delay = IBS_HOST_TX_IDLE_TIMEOUT_MS;
 621
 622         BT_DBG("HCI_UART_QCA open, tx_idle_delay=%u, wake_retrans=%u",
 623                qca->tx_idle_delay, qca->wake_retrans);
 624
 625         return 0;
 626 }
 627
 628 static void qca_debugfs_init(struct hci_dev *hdev)
 629 {
 630         struct hci_uart *hu = hci_get_drvdata(hdev);
 631         struct qca_data *qca = hu->priv;
 632         struct dentry *ibs_dir;
 633         umode_t mode;
 634
 635         if (!hdev->debugfs)
 636                 return;
 637
 638         ibs_dir = debugfs_create_dir("ibs", hdev->debugfs);
 639
 640         /* read only */
 641         mode = 0444;
 642         debugfs_create_u8("tx_ibs_state", mode, ibs_dir, &qca->tx_ibs_state);
 643         debugfs_create_u8("rx_ibs_state", mode, ibs_dir, &qca->rx_ibs_state);
 644         debugfs_create_u64("ibs_sent_sleeps", mode, ibs_dir,
 645                            &qca->ibs_sent_slps);
 646         debugfs_create_u64("ibs_sent_wakes", mode, ibs_dir,
 647                            &qca->ibs_sent_wakes);
 648         debugfs_create_u64("ibs_sent_wake_acks", mode, ibs_dir,
 649                            &qca->ibs_sent_wacks);
 650         debugfs_create_u64("ibs_recv_sleeps", mode, ibs_dir,
 651                            &qca->ibs_recv_slps);
 652         debugfs_create_u64("ibs_recv_wakes", mode, ibs_dir,
 653                            &qca->ibs_recv_wakes);
 654         debugfs_create_u64("ibs_recv_wake_acks", mode, ibs_dir,
 655                            &qca->ibs_recv_wacks);
 656         debugfs_create_bool("tx_vote", mode, ibs_dir, &qca->tx_vote);
 657         debugfs_create_u64("tx_votes_on", mode, ibs_dir, &qca->tx_votes_on);
 658         debugfs_create_u64("tx_votes_off", mode, ibs_dir, &qca->tx_votes_off);
 659         debugfs_create_bool("rx_vote", mode, ibs_dir, &qca->rx_vote);
 660         debugfs_create_u64("rx_votes_on", mode, ibs_dir, &qca->rx_votes_on);
 661         debugfs_create_u64("rx_votes_off", mode, ibs_dir, &qca->rx_votes_off);
 662         debugfs_create_u64("votes_on", mode, ibs_dir, &qca->votes_on);
 663         debugfs_create_u64("votes_off", mode, ibs_dir, &qca->votes_off);
 664         debugfs_create_u32("vote_on_ms", mode, ibs_dir, &qca->vote_on_ms);
 665         debugfs_create_u32("vote_off_ms", mode, ibs_dir, &qca->vote_off_ms);
 666
 667         /* read/write */
 668         mode = 0644;
 669         debugfs_create_u32("wake_retrans", mode, ibs_dir, &qca->wake_retrans);
 670         debugfs_create_u32("tx_idle_delay", mode, ibs_dir,
 671                            &qca->tx_idle_delay);
 672 }
 673
 674 /* Flush protocol data */
 675 static int qca_flush(struct hci_uart *hu)
 676 {
 677         struct qca_data *qca = hu->priv;
 678
 679         BT_DBG("hu %p qca flush", hu);
 680
 681         skb_queue_purge(&qca->tx_wait_q);
 682         skb_queue_purge(&qca->txq);
 683
 684         return 0;
 685 }
 686
 687 /* Close protocol */
 688 static int qca_close(struct hci_uart *hu)
 689 {
 690         struct qca_data *qca = hu->priv;
 691
 692         BT_DBG("hu %p qca close", hu);
 693
 694         serial_clock_vote(HCI_IBS_VOTE_STATS_UPDATE, hu);
 695
 696         skb_queue_purge(&qca->tx_wait_q);
 697         skb_queue_purge(&qca->txq);
 698         skb_queue_purge(&qca->rx_memdump_q);
 699         /*
 700          * Shut the timers down so they can't be rearmed when
 701          * destroy_workqueue() drains pending work which in turn might try
 702          * to arm a timer.  After shutdown rearm attempts are silently
 703          * ignored by the timer core code.
 704          */
 705         timer_shutdown_sync(&qca->tx_idle_timer);
 706         timer_shutdown_sync(&qca->wake_retrans_timer);
 707         destroy_workqueue(qca->workqueue);
 708         qca->hu = NULL;
 709
 710         kfree_skb(qca->rx_skb);
 711
 712         hu->priv = NULL;
 713
 714         kfree(qca);
 715
 716         return 0;
 717 }
 718
 719 /* Called upon a wake-up-indication from the device.
 720  */
 721 static void device_want_to_wakeup(struct hci_uart *hu)
 722 {
 723         unsigned long flags;
 724         struct qca_data *qca = hu->priv;
 725
 726         BT_DBG("hu %p want to wake up", hu);
 727
 728         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 729
 730         qca->ibs_recv_wakes++;
 731
 732         /* Don't wake the rx up when suspending. */
 733         if (test_bit(QCA_SUSPENDING, &qca->flags)) {
 734                 spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 735                 return;
 736         }
 737
 738         switch (qca->rx_ibs_state) {
 739         case HCI_IBS_RX_ASLEEP:
 740                 /* Make sure clock is on - we may have turned clock off since
 741                  * receiving the wake up indicator awake rx clock.
 742                  */
 743                 queue_work(qca->workqueue, &qca->ws_awake_rx);
 744                 spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 745                 return;
 746
 747         case HCI_IBS_RX_AWAKE:
 748                 /* Always acknowledge device wake up,
 749                  * sending IBS message doesn't count as TX ON.
 750                  */
 751                 if (send_hci_ibs_cmd(HCI_IBS_WAKE_ACK, hu) < 0) {
 752                         BT_ERR("Failed to acknowledge device wake up");
 753                         break;
 754                 }
 755                 qca->ibs_sent_wacks++;
 756                 break;
 757
 758         default:
 759                 /* Any other state is illegal */
 760                 BT_ERR("Received HCI_IBS_WAKE_IND in rx state %d",
 761                        qca->rx_ibs_state);
 762                 break;
 763         }
 764
 765         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 766
 767         /* Actually send the packets */
 768         hci_uart_tx_wakeup(hu);
 769 }
 770
 771 /* Called upon a sleep-indication from the device.
 772  */
 773 static void device_want_to_sleep(struct hci_uart *hu)
 774 {
 775         unsigned long flags;
 776         struct qca_data *qca = hu->priv;
 777
 778         BT_DBG("hu %p want to sleep in %d state", hu, qca->rx_ibs_state);
 779
 780         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 781
 782         qca->ibs_recv_slps++;
 783
 784         switch (qca->rx_ibs_state) {
 785         case HCI_IBS_RX_AWAKE:
 786                 /* Update state */
 787                 qca->rx_ibs_state = HCI_IBS_RX_ASLEEP;
 788                 /* Vote off rx clock under workqueue */
 789                 queue_work(qca->workqueue, &qca->ws_rx_vote_off);
 790                 break;
 791
 792         case HCI_IBS_RX_ASLEEP:
 793                 break;
 794
 795         default:
 796                 /* Any other state is illegal */
 797                 BT_ERR("Received HCI_IBS_SLEEP_IND in rx state %d",
 798                        qca->rx_ibs_state);
 799                 break;
 800         }
 801
 802         wake_up_interruptible(&qca->suspend_wait_q);
 803
 804         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 805 }
 806
 807 /* Called upon wake-up-acknowledgement from the device
 808  */
 809 static void device_woke_up(struct hci_uart *hu)
 810 {
 811         unsigned long flags, idle_delay;
 812         struct qca_data *qca = hu->priv;
 813         struct sk_buff *skb = NULL;
 814
 815         BT_DBG("hu %p woke up", hu);
 816
 817         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 818
 819         qca->ibs_recv_wacks++;
 820
 821         /* Don't react to the wake-up-acknowledgment when suspending. */
 822         if (test_bit(QCA_SUSPENDING, &qca->flags)) {
 823                 spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 824                 return;
 825         }
 826
 827         switch (qca->tx_ibs_state) {
 828         case HCI_IBS_TX_AWAKE:
 829                 /* Expect one if we send 2 WAKEs */
 830                 BT_DBG("Received HCI_IBS_WAKE_ACK in tx state %d",
 831                        qca->tx_ibs_state);
 832                 break;
 833
 834         case HCI_IBS_TX_WAKING:
 835                 /* Send pending packets */
 836                 while ((skb = skb_dequeue(&qca->tx_wait_q)))
 837                         skb_queue_tail(&qca->txq, skb);
 838
 839                 /* Switch timers and change state to HCI_IBS_TX_AWAKE */
 840                 del_timer(&qca->wake_retrans_timer);
 841                 idle_delay = msecs_to_jiffies(qca->tx_idle_delay);
 842                 mod_timer(&qca->tx_idle_timer, jiffies + idle_delay);
 843                 qca->tx_ibs_state = HCI_IBS_TX_AWAKE;
 844                 break;
 845
 846         case HCI_IBS_TX_ASLEEP:
 847         default:
 848                 BT_ERR("Received HCI_IBS_WAKE_ACK in tx state %d",
 849                        qca->tx_ibs_state);
 850                 break;
 851         }
 852
 853         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 854
 855         /* Actually send the packets */
 856         hci_uart_tx_wakeup(hu);
 857 }
 858
 859 /* Enqueue frame for transmittion (padding, crc, etc) may be called from
 860  * two simultaneous tasklets.
 861  */
 862 static int qca_enqueue(struct hci_uart *hu, struct sk_buff *skb)
 863 {
 864         unsigned long flags = 0, idle_delay;
 865         struct qca_data *qca = hu->priv;
 866
 867         BT_DBG("hu %p qca enq skb %p tx_ibs_state %d", hu, skb,
 868                qca->tx_ibs_state);
 869
 870         if (test_bit(QCA_SSR_TRIGGERED, &qca->flags)) {
 871                 /* As SSR is in progress, ignore the packets */
 872                 bt_dev_dbg(hu->hdev, "SSR is in progress");
 873                 kfree_skb(skb);
 874                 return 0;
 875         }
 876
 877         /* Prepend skb with frame type */
 878         memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
 879
 880         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 881
 882         /* Don't go to sleep in middle of patch download or
 883          * Out-Of-Band(GPIOs control) sleep is selected.
 884          * Don't wake the device up when suspending.
 885          */
 886         if (test_bit(QCA_IBS_DISABLED, &qca->flags) ||
 887             test_bit(QCA_SUSPENDING, &qca->flags)) {
 888                 skb_queue_tail(&qca->txq, skb);
 889                 spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 890                 return 0;
 891         }
 892
 893         /* Act according to current state */
 894         switch (qca->tx_ibs_state) {
 895         case HCI_IBS_TX_AWAKE:
 896                 BT_DBG("Device awake, sending normally");
 897                 skb_queue_tail(&qca->txq, skb);
 898                 idle_delay = msecs_to_jiffies(qca->tx_idle_delay);
 899                 mod_timer(&qca->tx_idle_timer, jiffies + idle_delay);
 900                 break;
 901
 902         case HCI_IBS_TX_ASLEEP:
 903                 BT_DBG("Device asleep, waking up and queueing packet");
 904                 /* Save packet for later */
 905                 skb_queue_tail(&qca->tx_wait_q, skb);
 906
 907                 qca->tx_ibs_state = HCI_IBS_TX_WAKING;
 908                 /* Schedule a work queue to wake up device */
 909                 queue_work(qca->workqueue, &qca->ws_awake_device);
 910                 break;
 911
 912         case HCI_IBS_TX_WAKING:
 913                 BT_DBG("Device waking up, queueing packet");
 914                 /* Transient state; just keep packet for later */
 915                 skb_queue_tail(&qca->tx_wait_q, skb);
 916                 break;
 917
 918         default:
 919                 BT_ERR("Illegal tx state: %d (losing packet)",
 920                        qca->tx_ibs_state);
 921                 dev_kfree_skb_irq(skb);
 922                 break;
 923         }
 924
 925         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 926
 927         return 0;
 928 }
 929
 930 static int qca_ibs_sleep_ind(struct hci_dev *hdev, struct sk_buff *skb)
 931 {
 932         struct hci_uart *hu = hci_get_drvdata(hdev);
 933
 934         BT_DBG("hu %p recv hci ibs cmd 0x%x", hu, HCI_IBS_SLEEP_IND);
 935
 936         device_want_to_sleep(hu);
 937
 938         kfree_skb(skb);
 939         return 0;
 940 }
 941
 942 static int qca_ibs_wake_ind(struct hci_dev *hdev, struct sk_buff *skb)
 943 {
 944         struct hci_uart *hu = hci_get_drvdata(hdev);
 945
 946         BT_DBG("hu %p recv hci ibs cmd 0x%x", hu, HCI_IBS_WAKE_IND);
 947
 948         device_want_to_wakeup(hu);
 949
 950         kfree_skb(skb);
 951         return 0;
 952 }
 953
 954 static int qca_ibs_wake_ack(struct hci_dev *hdev, struct sk_buff *skb)
 955 {
 956         struct hci_uart *hu = hci_get_drvdata(hdev);
 957
 958         BT_DBG("hu %p recv hci ibs cmd 0x%x", hu, HCI_IBS_WAKE_ACK);
 959
 960         device_woke_up(hu);
 961
 962         kfree_skb(skb);
 963         return 0;
 964 }
 965
 966 static int qca_recv_acl_data(struct hci_dev *hdev, struct sk_buff *skb)
 967 {
 968         /* We receive debug logs from chip as an ACL packets.
 969          * Instead of sending the data to ACL to decode the
 970          * received data, we are pushing them to the above layers
 971          * as a diagnostic packet.
 972          */
 973         if (get_unaligned_le16(skb->data) == QCA_DEBUG_HANDLE)
 974                 return hci_recv_diag(hdev, skb);
 975
 976         return hci_recv_frame(hdev, skb);
 977 }
 978
 979 static void qca_controller_memdump(struct work_struct *work)
 980 {
 981         struct qca_data *qca = container_of(work, struct qca_data,
 982                                             ctrl_memdump_evt);
 983         struct hci_uart *hu = qca->hu;
 984         struct sk_buff *skb;
 985         struct qca_memdump_event_hdr *cmd_hdr;
 986         struct qca_memdump_data *qca_memdump = qca->qca_memdump;
 987         struct qca_dump_size *dump;
 988         char *memdump_buf;
 989         char nullBuff[QCA_DUMP_PACKET_SIZE] = { 0 };
 990         u16 seq_no;
 991         u32 dump_size;
 992         u32 rx_size;
 993         enum qca_btsoc_type soc_type = qca_soc_type(hu);
 994
 995         while ((skb = skb_dequeue(&qca->rx_memdump_q))) {
 996
 997                 mutex_lock(&qca->hci_memdump_lock);
 998                 /* Skip processing the received packets if timeout detected
 999                  * or memdump collection completed.
1000                  */
1001                 if (qca->memdump_state == QCA_MEMDUMP_TIMEOUT ||
1002                     qca->memdump_state == QCA_MEMDUMP_COLLECTED) {
1003                         mutex_unlock(&qca->hci_memdump_lock);
1004                         return;
1005                 }
1006
1007                 if (!qca_memdump) {
1008                         qca_memdump = kzalloc(sizeof(struct qca_memdump_data),
1009                                               GFP_ATOMIC);
1010                         if (!qca_memdump) {
1011                                 mutex_unlock(&qca->hci_memdump_lock);
1012                                 return;
1013                         }
1014
1015                         qca->qca_memdump = qca_memdump;
1016                 }
1017
1018                 qca->memdump_state = QCA_MEMDUMP_COLLECTING;
1019                 cmd_hdr = (void *) skb->data;
1020                 seq_no = __le16_to_cpu(cmd_hdr->seq_no);
1021                 skb_pull(skb, sizeof(struct qca_memdump_event_hdr));
1022
1023                 if (!seq_no) {
1024
1025                         /* This is the first frame of memdump packet from
1026                          * the controller, Disable IBS to recevie dump
1027                          * with out any interruption, ideally time required for
1028                          * the controller to send the dump is 8 seconds. let us
1029                          * start timer to handle this asynchronous activity.
1030                          */
1031                         set_bit(QCA_IBS_DISABLED, &qca->flags);
1032                         set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1033                         dump = (void *) skb->data;
1034                         dump_size = __le32_to_cpu(dump->dump_size);
1035                         if (!(dump_size)) {
1036                                 bt_dev_err(hu->hdev, "Rx invalid memdump size");
1037                                 kfree(qca_memdump);
1038                                 kfree_skb(skb);
1039                                 qca->qca_memdump = NULL;
1040                                 mutex_unlock(&qca->hci_memdump_lock);
1041                                 return;
1042                         }
1043
1044                         bt_dev_info(hu->hdev, "QCA collecting dump of size:%u",
1045                                     dump_size);
1046                         queue_delayed_work(qca->workqueue,
1047                                            &qca->ctrl_memdump_timeout,
1048                                            msecs_to_jiffies(MEMDUMP_TIMEOUT_MS)
1049                                           );
1050
1051                         skb_pull(skb, sizeof(dump_size));
1052                         memdump_buf = vmalloc(dump_size);
1053                         qca_memdump->ram_dump_size = dump_size;
1054                         qca_memdump->memdump_buf_head = memdump_buf;
1055                         qca_memdump->memdump_buf_tail = memdump_buf;
1056                 }
1057
1058                 memdump_buf = qca_memdump->memdump_buf_tail;
1059
1060                 /* If sequence no 0 is missed then there is no point in
1061                  * accepting the other sequences.
1062                  */
1063                 if (!memdump_buf) {
1064                         bt_dev_err(hu->hdev, "QCA: Discarding other packets");
1065                         kfree(qca_memdump);
1066                         kfree_skb(skb);
1067                         qca->qca_memdump = NULL;
1068                         mutex_unlock(&qca->hci_memdump_lock);
1069                         return;
1070                 }
1071
1072                 /* There could be chance of missing some packets from
1073                  * the controller. In such cases let us store the dummy
1074                  * packets in the buffer.
1075                  */
1076                 /* For QCA6390, controller does not lost packets but
1077                  * sequence number field of packet sometimes has error
1078                  * bits, so skip this checking for missing packet.
1079                  */
1080                 while ((seq_no > qca_memdump->current_seq_no + 1) &&
1081                        (soc_type != QCA_QCA6390) &&
1082                        seq_no != QCA_LAST_SEQUENCE_NUM) {
1083                         bt_dev_err(hu->hdev, "QCA controller missed packet:%d",
1084                                    qca_memdump->current_seq_no);
1085                         rx_size = qca_memdump->received_dump;
1086                         rx_size += QCA_DUMP_PACKET_SIZE;
1087                         if (rx_size > qca_memdump->ram_dump_size) {
1088                                 bt_dev_err(hu->hdev,
1089                                            "QCA memdump received %d, no space for missed packet",
1090                                            qca_memdump->received_dump);
1091                                 break;
1092                         }
1093                         memcpy(memdump_buf, nullBuff, QCA_DUMP_PACKET_SIZE);
1094                         memdump_buf = memdump_buf + QCA_DUMP_PACKET_SIZE;
1095                         qca_memdump->received_dump += QCA_DUMP_PACKET_SIZE;
1096                         qca_memdump->current_seq_no++;
1097                 }
1098
1099                 rx_size = qca_memdump->received_dump + skb->len;
1100                 if (rx_size <= qca_memdump->ram_dump_size) {
1101                         if ((seq_no != QCA_LAST_SEQUENCE_NUM) &&
1102                             (seq_no != qca_memdump->current_seq_no))
1103                                 bt_dev_err(hu->hdev,
1104                                            "QCA memdump unexpected packet %d",
1105                                            seq_no);
1106                         bt_dev_dbg(hu->hdev,
1107                                    "QCA memdump packet %d with length %d",
1108                                    seq_no, skb->len);
1109                         memcpy(memdump_buf, (unsigned char *)skb->data,
1110                                skb->len);
1111                         memdump_buf = memdump_buf + skb->len;
1112                         qca_memdump->memdump_buf_tail = memdump_buf;
1113                         qca_memdump->current_seq_no = seq_no + 1;
1114                         qca_memdump->received_dump += skb->len;
1115                 } else {
1116                         bt_dev_err(hu->hdev,
1117                                    "QCA memdump received %d, no space for packet %d",
1118                                    qca_memdump->received_dump, seq_no);
1119                 }
1120                 qca->qca_memdump = qca_memdump;
1121                 kfree_skb(skb);
1122                 if (seq_no == QCA_LAST_SEQUENCE_NUM) {
1123                         bt_dev_info(hu->hdev,
1124                                     "QCA memdump Done, received %d, total %d",
1125                                     qca_memdump->received_dump,
1126                                     qca_memdump->ram_dump_size);
1127                         memdump_buf = qca_memdump->memdump_buf_head;
1128                         dev_coredumpv(&hu->serdev->dev, memdump_buf,
1129                                       qca_memdump->received_dump, GFP_KERNEL);
1130                         cancel_delayed_work(&qca->ctrl_memdump_timeout);
1131                         kfree(qca->qca_memdump);
1132                         qca->qca_memdump = NULL;
1133                         qca->memdump_state = QCA_MEMDUMP_COLLECTED;
1134                         clear_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1135                 }
1136
1137                 mutex_unlock(&qca->hci_memdump_lock);
1138         }
1139
1140 }
1141
1142 static int qca_controller_memdump_event(struct hci_dev *hdev,
1143                                         struct sk_buff *skb)
1144 {
1145         struct hci_uart *hu = hci_get_drvdata(hdev);
1146         struct qca_data *qca = hu->priv;
1147
1148         set_bit(QCA_SSR_TRIGGERED, &qca->flags);
1149         skb_queue_tail(&qca->rx_memdump_q, skb);
1150         queue_work(qca->workqueue, &qca->ctrl_memdump_evt);
1151
1152         return 0;
1153 }
1154
1155 static int qca_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
1156 {
1157         struct hci_uart *hu = hci_get_drvdata(hdev);
1158         struct qca_data *qca = hu->priv;
1159
1160         if (test_bit(QCA_DROP_VENDOR_EVENT, &qca->flags)) {
1161                 struct hci_event_hdr *hdr = (void *)skb->data;
1162
1163                 /* For the WCN3990 the vendor command for a baudrate change
1164                  * isn't sent as synchronous HCI command, because the
1165                  * controller sends the corresponding vendor event with the
1166                  * new baudrate. The event is received and properly decoded
1167                  * after changing the baudrate of the host port. It needs to
1168                  * be dropped, otherwise it can be misinterpreted as
1169                  * response to a later firmware download command (also a
1170                  * vendor command).
1171                  */
1172
1173                 if (hdr->evt == HCI_EV_VENDOR)
1174                         complete(&qca->drop_ev_comp);
1175
1176                 kfree_skb(skb);
1177
1178                 return 0;
1179         }
1180         /* We receive chip memory dump as an event packet, With a dedicated
1181          * handler followed by a hardware error event. When this event is
1182          * received we store dump into a file before closing hci. This
1183          * dump will help in triaging the issues.
1184          */
1185         if ((skb->data[0] == HCI_VENDOR_PKT) &&
1186             (get_unaligned_be16(skb->data + 2) == QCA_SSR_DUMP_HANDLE))
1187                 return qca_controller_memdump_event(hdev, skb);
1188
1189         return hci_recv_frame(hdev, skb);
1190 }
1191
1192 #define QCA_IBS_SLEEP_IND_EVENT \
1193         .type = HCI_IBS_SLEEP_IND, \
1194         .hlen = 0, \
1195         .loff = 0, \
1196         .lsize = 0, \
1197         .maxlen = HCI_MAX_IBS_SIZE
1198
1199 #define QCA_IBS_WAKE_IND_EVENT \
1200         .type = HCI_IBS_WAKE_IND, \
1201         .hlen = 0, \
1202         .loff = 0, \
1203         .lsize = 0, \
1204         .maxlen = HCI_MAX_IBS_SIZE
1205
1206 #define QCA_IBS_WAKE_ACK_EVENT \
1207         .type = HCI_IBS_WAKE_ACK, \
1208         .hlen = 0, \
1209         .loff = 0, \
1210         .lsize = 0, \
1211         .maxlen = HCI_MAX_IBS_SIZE
1212
1213 static const struct h4_recv_pkt qca_recv_pkts[] = {
1214         { H4_RECV_ACL,             .recv = qca_recv_acl_data },
1215         { H4_RECV_SCO,             .recv = hci_recv_frame    },
1216         { H4_RECV_EVENT,           .recv = qca_recv_event    },
1217         { QCA_IBS_WAKE_IND_EVENT,  .recv = qca_ibs_wake_ind  },
1218         { QCA_IBS_WAKE_ACK_EVENT,  .recv = qca_ibs_wake_ack  },
1219         { QCA_IBS_SLEEP_IND_EVENT, .recv = qca_ibs_sleep_ind },
1220 };
1221
1222 static int qca_recv(struct hci_uart *hu, const void *data, int count)
1223 {
1224         struct qca_data *qca = hu->priv;
1225
1226         if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
1227                 return -EUNATCH;
1228
1229         qca->rx_skb = h4_recv_buf(hu->hdev, qca->rx_skb, data, count,
1230                                   qca_recv_pkts, ARRAY_SIZE(qca_recv_pkts));
1231         if (IS_ERR(qca->rx_skb)) {
1232                 int err = PTR_ERR(qca->rx_skb);
1233                 bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err);
1234                 qca->rx_skb = NULL;
1235                 return err;
1236         }
1237
1238         return count;
1239 }
1240
1241 static struct sk_buff *qca_dequeue(struct hci_uart *hu)
1242 {
1243         struct qca_data *qca = hu->priv;
1244
1245         return skb_dequeue(&qca->txq);
1246 }
1247
1248 static uint8_t qca_get_baudrate_value(int speed)
1249 {
1250         switch (speed) {
1251         case 9600:
1252                 return QCA_BAUDRATE_9600;
1253         case 19200:
1254                 return QCA_BAUDRATE_19200;
1255         case 38400:
1256                 return QCA_BAUDRATE_38400;
1257         case 57600:
1258                 return QCA_BAUDRATE_57600;
1259         case 115200:
1260                 return QCA_BAUDRATE_115200;
1261         case 230400:
1262                 return QCA_BAUDRATE_230400;
1263         case 460800:
1264                 return QCA_BAUDRATE_460800;
1265         case 500000:
1266                 return QCA_BAUDRATE_500000;
1267         case 921600:
1268                 return QCA_BAUDRATE_921600;
1269         case 1000000:
1270                 return QCA_BAUDRATE_1000000;
1271         case 2000000:
1272                 return QCA_BAUDRATE_2000000;
1273         case 3000000:
1274                 return QCA_BAUDRATE_3000000;
1275         case 3200000:
1276                 return QCA_BAUDRATE_3200000;
1277         case 3500000:
1278                 return QCA_BAUDRATE_3500000;
1279         default:
1280                 return QCA_BAUDRATE_115200;
1281         }
1282 }
1283
1284 static int qca_set_baudrate(struct hci_dev *hdev, uint8_t baudrate)
1285 {
1286         struct hci_uart *hu = hci_get_drvdata(hdev);
1287         struct qca_data *qca = hu->priv;
1288         struct sk_buff *skb;
1289         u8 cmd[] = { 0x01, 0x48, 0xFC, 0x01, 0x00 };
1290
1291         if (baudrate > QCA_BAUDRATE_3200000)
1292                 return -EINVAL;
1293
1294         cmd[4] = baudrate;
1295
1296         skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
1297         if (!skb) {
1298                 bt_dev_err(hdev, "Failed to allocate baudrate packet");
1299                 return -ENOMEM;
1300         }
1301
1302         /* Assign commands to change baudrate and packet type. */
1303         skb_put_data(skb, cmd, sizeof(cmd));
1304         hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
1305
1306         skb_queue_tail(&qca->txq, skb);
1307         hci_uart_tx_wakeup(hu);
1308
1309         /* Wait for the baudrate change request to be sent */
1310
1311         while (!skb_queue_empty(&qca->txq))
1312                 usleep_range(100, 200);
1313
1314         if (hu->serdev)
1315                 serdev_device_wait_until_sent(hu->serdev,
1316                       msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS));
1317
1318         /* Give the controller time to process the request */
1319         if (qca_is_wcn399x(qca_soc_type(hu)) ||
1320             qca_is_wcn6750(qca_soc_type(hu)))
1321                 usleep_range(1000, 10000);
1322         else
1323                 msleep(300);
1324
1325         return 0;
1326 }
1327
1328 static inline void host_set_baudrate(struct hci_uart *hu, unsigned int speed)
1329 {
1330         if (hu->serdev)
1331                 serdev_device_set_baudrate(hu->serdev, speed);
1332         else
1333                 hci_uart_set_baudrate(hu, speed);
1334 }
1335
1336 static int qca_send_power_pulse(struct hci_uart *hu, bool on)
1337 {
1338         int ret;
1339         int timeout = msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS);
1340         u8 cmd = on ? QCA_WCN3990_POWERON_PULSE : QCA_WCN3990_POWEROFF_PULSE;
1341
1342         /* These power pulses are single byte command which are sent
1343          * at required baudrate to wcn3990. On wcn3990, we have an external
1344          * circuit at Tx pin which decodes the pulse sent at specific baudrate.
1345          * For example, wcn3990 supports RF COEX antenna for both Wi-Fi/BT
1346          * and also we use the same power inputs to turn on and off for
1347          * Wi-Fi/BT. Powering up the power sources will not enable BT, until
1348          * we send a power on pulse at 115200 bps. This algorithm will help to
1349          * save power. Disabling hardware flow control is mandatory while
1350          * sending power pulses to SoC.
1351          */
1352         bt_dev_dbg(hu->hdev, "sending power pulse %02x to controller", cmd);
1353
1354         serdev_device_write_flush(hu->serdev);
1355         hci_uart_set_flow_control(hu, true);
1356         ret = serdev_device_write_buf(hu->serdev, &cmd, sizeof(cmd));
1357         if (ret < 0) {
1358                 bt_dev_err(hu->hdev, "failed to send power pulse %02x", cmd);
1359                 return ret;
1360         }
1361
1362         serdev_device_wait_until_sent(hu->serdev, timeout);
1363         hci_uart_set_flow_control(hu, false);
1364
1365         /* Give to controller time to boot/shutdown */
1366         if (on)
1367                 msleep(100);
1368         else
1369                 usleep_range(1000, 10000);
1370
1371         return 0;
1372 }
1373
1374 static unsigned int qca_get_speed(struct hci_uart *hu,
1375                                   enum qca_speed_type speed_type)
1376 {
1377         unsigned int speed = 0;
1378
1379         if (speed_type == QCA_INIT_SPEED) {
1380                 if (hu->init_speed)
1381                         speed = hu->init_speed;
1382                 else if (hu->proto->init_speed)
1383                         speed = hu->proto->init_speed;
1384         } else {
1385                 if (hu->oper_speed)
1386                         speed = hu->oper_speed;
1387                 else if (hu->proto->oper_speed)
1388                         speed = hu->proto->oper_speed;
1389         }
1390
1391         return speed;
1392 }
1393
1394 static int qca_check_speeds(struct hci_uart *hu)
1395 {
1396         if (qca_is_wcn399x(qca_soc_type(hu)) ||
1397             qca_is_wcn6750(qca_soc_type(hu))) {
1398                 if (!qca_get_speed(hu, QCA_INIT_SPEED) &&
1399                     !qca_get_speed(hu, QCA_OPER_SPEED))
1400                         return -EINVAL;
1401         } else {
1402                 if (!qca_get_speed(hu, QCA_INIT_SPEED) ||
1403                     !qca_get_speed(hu, QCA_OPER_SPEED))
1404                         return -EINVAL;
1405         }
1406
1407         return 0;
1408 }
1409
1410 static int qca_set_speed(struct hci_uart *hu, enum qca_speed_type speed_type)
1411 {
1412         unsigned int speed, qca_baudrate;
1413         struct qca_data *qca = hu->priv;
1414         int ret = 0;
1415
1416         if (speed_type == QCA_INIT_SPEED) {
1417                 speed = qca_get_speed(hu, QCA_INIT_SPEED);
1418                 if (speed)
1419                         host_set_baudrate(hu, speed);
1420         } else {
1421                 enum qca_btsoc_type soc_type = qca_soc_type(hu);
1422
1423                 speed = qca_get_speed(hu, QCA_OPER_SPEED);
1424                 if (!speed)
1425                         return 0;
1426
1427                 /* Disable flow control for wcn3990 to deassert RTS while
1428                  * changing the baudrate of chip and host.
1429                  */
1430                 if (qca_is_wcn399x(soc_type) ||
1431                     qca_is_wcn6750(soc_type))
1432                         hci_uart_set_flow_control(hu, true);
1433
1434                 if (soc_type == QCA_WCN3990) {
1435                         reinit_completion(&qca->drop_ev_comp);
1436                         set_bit(QCA_DROP_VENDOR_EVENT, &qca->flags);
1437                 }
1438
1439                 qca_baudrate = qca_get_baudrate_value(speed);
1440                 bt_dev_dbg(hu->hdev, "Set UART speed to %d", speed);
1441                 ret = qca_set_baudrate(hu->hdev, qca_baudrate);
1442                 if (ret)
1443                         goto error;
1444
1445                 host_set_baudrate(hu, speed);
1446
1447 error:
1448                 if (qca_is_wcn399x(soc_type) ||
1449                     qca_is_wcn6750(soc_type))
1450                         hci_uart_set_flow_control(hu, false);
1451
1452                 if (soc_type == QCA_WCN3990) {
1453                         /* Wait for the controller to send the vendor event
1454                          * for the baudrate change command.
1455                          */
1456                         if (!wait_for_completion_timeout(&qca->drop_ev_comp,
1457                                                  msecs_to_jiffies(100))) {
1458                                 bt_dev_err(hu->hdev,
1459                                            "Failed to change controller baudrate\n");
1460                                 ret = -ETIMEDOUT;
1461                         }
1462
1463                         clear_bit(QCA_DROP_VENDOR_EVENT, &qca->flags);
1464                 }
1465         }
1466
1467         return ret;
1468 }
1469
1470 static int qca_send_crashbuffer(struct hci_uart *hu)
1471 {
1472         struct qca_data *qca = hu->priv;
1473         struct sk_buff *skb;
1474
1475         skb = bt_skb_alloc(QCA_CRASHBYTE_PACKET_LEN, GFP_KERNEL);
1476         if (!skb) {
1477                 bt_dev_err(hu->hdev, "Failed to allocate memory for skb packet");
1478                 return -ENOMEM;
1479         }
1480
1481         /* We forcefully crash the controller, by sending 0xfb byte for
1482          * 1024 times. We also might have chance of losing data, To be
1483          * on safer side we send 1096 bytes to the SoC.
1484          */
1485         memset(skb_put(skb, QCA_CRASHBYTE_PACKET_LEN), QCA_MEMDUMP_BYTE,
1486                QCA_CRASHBYTE_PACKET_LEN);
1487         hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
1488         bt_dev_info(hu->hdev, "crash the soc to collect controller dump");
1489         skb_queue_tail(&qca->txq, skb);
1490         hci_uart_tx_wakeup(hu);
1491
1492         return 0;
1493 }
1494
1495 static void qca_wait_for_dump_collection(struct hci_dev *hdev)
1496 {
1497         struct hci_uart *hu = hci_get_drvdata(hdev);
1498         struct qca_data *qca = hu->priv;
1499
1500         wait_on_bit_timeout(&qca->flags, QCA_MEMDUMP_COLLECTION,
1501                             TASK_UNINTERRUPTIBLE, MEMDUMP_TIMEOUT_MS);
1502
1503         clear_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1504 }
1505
1506 static void qca_hw_error(struct hci_dev *hdev, u8 code)
1507 {
1508         struct hci_uart *hu = hci_get_drvdata(hdev);
1509         struct qca_data *qca = hu->priv;
1510
1511         set_bit(QCA_SSR_TRIGGERED, &qca->flags);
1512         set_bit(QCA_HW_ERROR_EVENT, &qca->flags);
1513         bt_dev_info(hdev, "mem_dump_status: %d", qca->memdump_state);
1514
1515         if (qca->memdump_state == QCA_MEMDUMP_IDLE) {
1516                 /* If hardware error event received for other than QCA
1517                  * soc memory dump event, then we need to crash the SOC
1518                  * and wait here for 8 seconds to get the dump packets.
1519                  * This will block main thread to be on hold until we
1520                  * collect dump.
1521                  */
1522                 set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1523                 qca_send_crashbuffer(hu);
1524                 qca_wait_for_dump_collection(hdev);
1525         } else if (qca->memdump_state == QCA_MEMDUMP_COLLECTING) {
1526                 /* Let us wait here until memory dump collected or
1527                  * memory dump timer expired.
1528                  */
1529                 bt_dev_info(hdev, "waiting for dump to complete");
1530                 qca_wait_for_dump_collection(hdev);
1531         }
1532
1533         mutex_lock(&qca->hci_memdump_lock);
1534         if (qca->memdump_state != QCA_MEMDUMP_COLLECTED) {
1535                 bt_dev_err(hu->hdev, "clearing allocated memory due to memdump timeout");
1536                 if (qca->qca_memdump) {
1537                         vfree(qca->qca_memdump->memdump_buf_head);
1538                         kfree(qca->qca_memdump);
1539                         qca->qca_memdump = NULL;
1540                 }
1541                 qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
1542                 cancel_delayed_work(&qca->ctrl_memdump_timeout);
1543         }
1544         mutex_unlock(&qca->hci_memdump_lock);
1545
1546         if (qca->memdump_state == QCA_MEMDUMP_TIMEOUT ||
1547             qca->memdump_state == QCA_MEMDUMP_COLLECTED) {
1548                 cancel_work_sync(&qca->ctrl_memdump_evt);
1549                 skb_queue_purge(&qca->rx_memdump_q);
1550         }
1551
1552         clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
1553 }
1554
1555 static void qca_cmd_timeout(struct hci_dev *hdev)
1556 {
1557         struct hci_uart *hu = hci_get_drvdata(hdev);
1558         struct qca_data *qca = hu->priv;
1559
1560         set_bit(QCA_SSR_TRIGGERED, &qca->flags);
1561         if (qca->memdump_state == QCA_MEMDUMP_IDLE) {
1562                 set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1563                 qca_send_crashbuffer(hu);
1564                 qca_wait_for_dump_collection(hdev);
1565         } else if (qca->memdump_state == QCA_MEMDUMP_COLLECTING) {
1566                 /* Let us wait here until memory dump collected or
1567                  * memory dump timer expired.
1568                  */
1569                 bt_dev_info(hdev, "waiting for dump to complete");
1570                 qca_wait_for_dump_collection(hdev);
1571         }
1572
1573         mutex_lock(&qca->hci_memdump_lock);
1574         if (qca->memdump_state != QCA_MEMDUMP_COLLECTED) {
1575                 qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
1576                 if (!test_bit(QCA_HW_ERROR_EVENT, &qca->flags)) {
1577                         /* Inject hw error event to reset the device
1578                          * and driver.
1579                          */
1580                         hci_reset_dev(hu->hdev);
1581                 }
1582         }
1583         mutex_unlock(&qca->hci_memdump_lock);
1584 }
1585
1586 static bool qca_wakeup(struct hci_dev *hdev)
1587 {
1588         struct hci_uart *hu = hci_get_drvdata(hdev);
1589         bool wakeup;
1590
1591         /* UART driver handles the interrupt from BT SoC.So we need to use
1592          * device handle of UART driver to get the status of device may wakeup.
1593          */
1594         wakeup = device_may_wakeup(hu->serdev->ctrl->dev.parent);
1595         bt_dev_dbg(hu->hdev, "wakeup status : %d", wakeup);
1596
1597         return wakeup;
1598 }
1599
1600 static int qca_regulator_init(struct hci_uart *hu)
1601 {
1602         enum qca_btsoc_type soc_type = qca_soc_type(hu);
1603         struct qca_serdev *qcadev;
1604         int ret;
1605         bool sw_ctrl_state;
1606
1607         /* Check for vregs status, may be hci down has turned
1608          * off the voltage regulator.
1609          */
1610         qcadev = serdev_device_get_drvdata(hu->serdev);
1611         if (!qcadev->bt_power->vregs_on) {
1612                 serdev_device_close(hu->serdev);
1613                 ret = qca_regulator_enable(qcadev);
1614                 if (ret)
1615                         return ret;
1616
1617                 ret = serdev_device_open(hu->serdev);
1618                 if (ret) {
1619                         bt_dev_err(hu->hdev, "failed to open port");
1620                         return ret;
1621                 }
1622         }
1623
1624         if (qca_is_wcn399x(soc_type)) {
1625                 /* Forcefully enable wcn399x to enter in to boot mode. */
1626                 host_set_baudrate(hu, 2400);
1627                 ret = qca_send_power_pulse(hu, false);
1628                 if (ret)
1629                         return ret;
1630         }
1631
1632         /* For wcn6750 need to enable gpio bt_en */
1633         if (qcadev->bt_en) {
1634                 gpiod_set_value_cansleep(qcadev->bt_en, 0);
1635                 msleep(50);
1636                 gpiod_set_value_cansleep(qcadev->bt_en, 1);
1637                 msleep(50);
1638                 if (qcadev->sw_ctrl) {
1639                         sw_ctrl_state = gpiod_get_value_cansleep(qcadev->sw_ctrl);
1640                         bt_dev_dbg(hu->hdev, "SW_CTRL is %d", sw_ctrl_state);
1641                 }
1642         }
1643
1644         qca_set_speed(hu, QCA_INIT_SPEED);
1645
1646         if (qca_is_wcn399x(soc_type)) {
1647                 ret = qca_send_power_pulse(hu, true);
1648                 if (ret)
1649                         return ret;
1650         }
1651
1652         /* Now the device is in ready state to communicate with host.
1653          * To sync host with device we need to reopen port.
1654          * Without this, we will have RTS and CTS synchronization
1655          * issues.
1656          */
1657         serdev_device_close(hu->serdev);
1658         ret = serdev_device_open(hu->serdev);
1659         if (ret) {
1660                 bt_dev_err(hu->hdev, "failed to open port");
1661                 return ret;
1662         }
1663
1664         hci_uart_set_flow_control(hu, false);
1665
1666         return 0;
1667 }
1668
1669 static int qca_power_on(struct hci_dev *hdev)
1670 {
1671         struct hci_uart *hu = hci_get_drvdata(hdev);
1672         enum qca_btsoc_type soc_type = qca_soc_type(hu);
1673         struct qca_serdev *qcadev;
1674         struct qca_data *qca = hu->priv;
1675         int ret = 0;
1676
1677         /* Non-serdev device usually is powered by external power
1678          * and don't need additional action in driver for power on
1679          */
1680         if (!hu->serdev)
1681                 return 0;
1682
1683         if (qca_is_wcn399x(soc_type) ||
1684             qca_is_wcn6750(soc_type)) {
1685                 ret = qca_regulator_init(hu);
1686         } else {
1687                 qcadev = serdev_device_get_drvdata(hu->serdev);
1688                 if (qcadev->bt_en) {
1689                         gpiod_set_value_cansleep(qcadev->bt_en, 1);
1690                         /* Controller needs time to bootup. */
1691                         msleep(150);
1692                 }
1693         }
1694
1695         clear_bit(QCA_BT_OFF, &qca->flags);
1696         return ret;
1697 }
1698
1699 static int qca_setup(struct hci_uart *hu)
1700 {
1701         struct hci_dev *hdev = hu->hdev;
1702         struct qca_data *qca = hu->priv;
1703         unsigned int speed, qca_baudrate = QCA_BAUDRATE_115200;
1704         unsigned int retries = 0;
1705         enum qca_btsoc_type soc_type = qca_soc_type(hu);
1706         const char *firmware_name = qca_get_firmware_name(hu);
1707         int ret;
1708         struct qca_btsoc_version ver;
1709
1710         ret = qca_check_speeds(hu);
1711         if (ret)
1712                 return ret;
1713
1714         clear_bit(QCA_ROM_FW, &qca->flags);
1715         /* Patch downloading has to be done without IBS mode */
1716         set_bit(QCA_IBS_DISABLED, &qca->flags);
1717
1718         /* Enable controller to do both LE scan and BR/EDR inquiry
1719          * simultaneously.
1720          */
1721         set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
1722
1723         bt_dev_info(hdev, "setting up %s",
1724                 qca_is_wcn399x(soc_type) ? "wcn399x" :
1725                 (soc_type == QCA_WCN6750) ? "wcn6750" : "ROME/QCA6390");
1726
1727         qca->memdump_state = QCA_MEMDUMP_IDLE;
1728
1729 retry:
1730         ret = qca_power_on(hdev);
1731         if (ret)
1732                 goto out;
1733
1734         clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
1735
1736         if (qca_is_wcn399x(soc_type) ||
1737             qca_is_wcn6750(soc_type)) {
1738                 set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
1739                 hci_set_aosp_capable(hdev);
1740
1741                 ret = qca_read_soc_version(hdev, &ver, soc_type);
1742                 if (ret)
1743                         goto out;
1744         } else {
1745                 qca_set_speed(hu, QCA_INIT_SPEED);
1746         }
1747
1748         /* Setup user speed if needed */
1749         speed = qca_get_speed(hu, QCA_OPER_SPEED);
1750         if (speed) {
1751                 ret = qca_set_speed(hu, QCA_OPER_SPEED);
1752                 if (ret)
1753                         goto out;
1754
1755                 qca_baudrate = qca_get_baudrate_value(speed);
1756         }
1757
1758         if (!(qca_is_wcn399x(soc_type) ||
1759              qca_is_wcn6750(soc_type))) {
1760                 /* Get QCA version information */
1761                 ret = qca_read_soc_version(hdev, &ver, soc_type);
1762                 if (ret)
1763                         goto out;
1764         }
1765
1766         /* Setup patch / NVM configurations */
1767         ret = qca_uart_setup(hdev, qca_baudrate, soc_type, ver,
1768                         firmware_name);
1769         if (!ret) {
1770                 clear_bit(QCA_IBS_DISABLED, &qca->flags);
1771                 qca_debugfs_init(hdev);
1772                 hu->hdev->hw_error = qca_hw_error;
1773                 hu->hdev->cmd_timeout = qca_cmd_timeout;
1774                 if (device_can_wakeup(hu->serdev->ctrl->dev.parent))
1775                         hu->hdev->wakeup = qca_wakeup;
1776         } else if (ret == -ENOENT) {
1777                 /* No patch/nvm-config found, run with original fw/config */
1778                 set_bit(QCA_ROM_FW, &qca->flags);
1779                 ret = 0;
1780         } else if (ret == -EAGAIN) {
1781                 /*
1782                  * Userspace firmware loader will return -EAGAIN in case no
1783                  * patch/nvm-config is found, so run with original fw/config.
1784                  */
1785                 set_bit(QCA_ROM_FW, &qca->flags);
1786                 ret = 0;
1787         }
1788
1789 out:
1790         if (ret && retries < MAX_INIT_RETRIES) {
1791                 bt_dev_warn(hdev, "Retry BT power ON:%d", retries);
1792                 qca_power_shutdown(hu);
1793                 if (hu->serdev) {
1794                         serdev_device_close(hu->serdev);
1795                         ret = serdev_device_open(hu->serdev);
1796                         if (ret) {
1797                                 bt_dev_err(hdev, "failed to open port");
1798                                 return ret;
1799                         }
1800                 }
1801                 retries++;
1802                 goto retry;
1803         }
1804
1805         /* Setup bdaddr */
1806         if (soc_type == QCA_ROME)
1807                 hu->hdev->set_bdaddr = qca_set_bdaddr_rome;
1808         else
1809                 hu->hdev->set_bdaddr = qca_set_bdaddr;
1810
1811         return ret;
1812 }
1813
1814 static const struct hci_uart_proto qca_proto = {
1815         .id             = HCI_UART_QCA,
1816         .name           = "QCA",
1817         .manufacturer   = 29,
1818         .init_speed     = 115200,
1819         .oper_speed     = 3000000,
1820         .open           = qca_open,
1821         .close          = qca_close,
1822         .flush          = qca_flush,
1823         .setup          = qca_setup,
1824         .recv           = qca_recv,
1825         .enqueue        = qca_enqueue,
1826         .dequeue        = qca_dequeue,
1827 };
1828
1829 static const struct qca_device_data qca_soc_data_wcn3990 = {
1830         .soc_type = QCA_WCN3990,
1831         .vregs = (struct qca_vreg []) {
1832                 { "vddio", 15000  },
1833                 { "vddxo", 80000  },
1834                 { "vddrf", 300000 },
1835                 { "vddch0", 450000 },
1836         },
1837         .num_vregs = 4,
1838 };
1839
1840 static const struct qca_device_data qca_soc_data_wcn3991 = {
1841         .soc_type = QCA_WCN3991,
1842         .vregs = (struct qca_vreg []) {
1843                 { "vddio", 15000  },
1844                 { "vddxo", 80000  },
1845                 { "vddrf", 300000 },
1846                 { "vddch0", 450000 },
1847         },
1848         .num_vregs = 4,
1849         .capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES,
1850 };
1851
1852 static const struct qca_device_data qca_soc_data_wcn3998 = {
1853         .soc_type = QCA_WCN3998,
1854         .vregs = (struct qca_vreg []) {
1855                 { "vddio", 10000  },
1856                 { "vddxo", 80000  },
1857                 { "vddrf", 300000 },
1858                 { "vddch0", 450000 },
1859         },
1860         .num_vregs = 4,
1861 };
1862
1863 static const struct qca_device_data qca_soc_data_qca6390 = {
1864         .soc_type = QCA_QCA6390,
1865         .num_vregs = 0,
1866 };
1867
1868 static const struct qca_device_data qca_soc_data_wcn6750 = {
1869         .soc_type = QCA_WCN6750,
1870         .vregs = (struct qca_vreg []) {
1871                 { "vddio", 5000 },
1872                 { "vddaon", 26000 },
1873                 { "vddbtcxmx", 126000 },
1874                 { "vddrfacmn", 12500 },
1875                 { "vddrfa0p8", 102000 },
1876                 { "vddrfa1p7", 302000 },
1877                 { "vddrfa1p2", 257000 },
1878                 { "vddrfa2p2", 1700000 },
1879                 { "vddasd", 200 },
1880         },
1881         .num_vregs = 9,
1882         .capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES,
1883 };
1884
1885 static void qca_power_shutdown(struct hci_uart *hu)
1886 {
1887         struct qca_serdev *qcadev;
1888         struct qca_data *qca = hu->priv;
1889         unsigned long flags;
1890         enum qca_btsoc_type soc_type = qca_soc_type(hu);
1891         bool sw_ctrl_state;
1892
1893         /* From this point we go into power off state. But serial port is
1894          * still open, stop queueing the IBS data and flush all the buffered
1895          * data in skb's.
1896          */
1897         spin_lock_irqsave(&qca->hci_ibs_lock, flags);
1898         set_bit(QCA_IBS_DISABLED, &qca->flags);
1899         qca_flush(hu);
1900         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
1901
1902         /* Non-serdev device usually is powered by external power
1903          * and don't need additional action in driver for power down
1904          */
1905         if (!hu->serdev)
1906                 return;
1907
1908         qcadev = serdev_device_get_drvdata(hu->serdev);
1909
1910         if (qca_is_wcn399x(soc_type)) {
1911                 host_set_baudrate(hu, 2400);
1912                 qca_send_power_pulse(hu, false);
1913                 qca_regulator_disable(qcadev);
1914         } else if (soc_type == QCA_WCN6750) {
1915                 gpiod_set_value_cansleep(qcadev->bt_en, 0);
1916                 msleep(100);
1917                 qca_regulator_disable(qcadev);
1918                 if (qcadev->sw_ctrl) {
1919                         sw_ctrl_state = gpiod_get_value_cansleep(qcadev->sw_ctrl);
1920                         bt_dev_dbg(hu->hdev, "SW_CTRL is %d", sw_ctrl_state);
1921                 }
1922         } else if (qcadev->bt_en) {
1923                 gpiod_set_value_cansleep(qcadev->bt_en, 0);
1924         }
1925
1926         set_bit(QCA_BT_OFF, &qca->flags);
1927 }
1928
1929 static int qca_power_off(struct hci_dev *hdev)
1930 {
1931         struct hci_uart *hu = hci_get_drvdata(hdev);
1932         struct qca_data *qca = hu->priv;
1933         enum qca_btsoc_type soc_type = qca_soc_type(hu);
1934
1935         hu->hdev->hw_error = NULL;
1936         hu->hdev->cmd_timeout = NULL;
1937
1938         del_timer_sync(&qca->wake_retrans_timer);
1939         del_timer_sync(&qca->tx_idle_timer);
1940
1941         /* Stop sending shutdown command if soc crashes. */
1942         if (soc_type != QCA_ROME
1943                 && qca->memdump_state == QCA_MEMDUMP_IDLE) {
1944                 qca_send_pre_shutdown_cmd(hdev);
1945                 usleep_range(8000, 10000);
1946         }
1947
1948         qca_power_shutdown(hu);
1949         return 0;
1950 }
1951
1952 static int qca_regulator_enable(struct qca_serdev *qcadev)
1953 {
1954         struct qca_power *power = qcadev->bt_power;
1955         int ret;
1956
1957         /* Already enabled */
1958         if (power->vregs_on)
1959                 return 0;
1960
1961         BT_DBG("enabling %d regulators)", power->num_vregs);
1962
1963         ret = regulator_bulk_enable(power->num_vregs, power->vreg_bulk);
1964         if (ret)
1965                 return ret;
1966
1967         power->vregs_on = true;
1968
1969         ret = clk_prepare_enable(qcadev->susclk);
1970         if (ret)
1971                 qca_regulator_disable(qcadev);
1972
1973         return ret;
1974 }
1975
1976 static void qca_regulator_disable(struct qca_serdev *qcadev)
1977 {
1978         struct qca_power *power;
1979
1980         if (!qcadev)
1981                 return;
1982
1983         power = qcadev->bt_power;
1984
1985         /* Already disabled? */
1986         if (!power->vregs_on)
1987                 return;
1988
1989         regulator_bulk_disable(power->num_vregs, power->vreg_bulk);
1990         power->vregs_on = false;
1991
1992         clk_disable_unprepare(qcadev->susclk);
1993 }
1994
1995 static int qca_init_regulators(struct qca_power *qca,
1996                                 const struct qca_vreg *vregs, size_t num_vregs)
1997 {
1998         struct regulator_bulk_data *bulk;
1999         int ret;
2000         int i;
2001
2002         bulk = devm_kcalloc(qca->dev, num_vregs, sizeof(*bulk), GFP_KERNEL);
2003         if (!bulk)
2004                 return -ENOMEM;
2005
2006         for (i = 0; i < num_vregs; i++)
2007                 bulk[i].supply = vregs[i].name;
2008
2009         ret = devm_regulator_bulk_get(qca->dev, num_vregs, bulk);
2010         if (ret < 0)
2011                 return ret;
2012
2013         for (i = 0; i < num_vregs; i++) {
2014                 ret = regulator_set_load(bulk[i].consumer, vregs[i].load_uA);
2015                 if (ret)
2016                         return ret;
2017         }
2018
2019         qca->vreg_bulk = bulk;
2020         qca->num_vregs = num_vregs;
2021
2022         return 0;
2023 }
2024
2025 static int qca_serdev_probe(struct serdev_device *serdev)
2026 {
2027         struct qca_serdev *qcadev;
2028         struct hci_dev *hdev;
2029         const struct qca_device_data *data;
2030         int err;
2031         bool power_ctrl_enabled = true;
2032
2033         qcadev = devm_kzalloc(&serdev->dev, sizeof(*qcadev), GFP_KERNEL);
2034         if (!qcadev)
2035                 return -ENOMEM;
2036
2037         qcadev->serdev_hu.serdev = serdev;
2038         data = device_get_match_data(&serdev->dev);
2039         serdev_device_set_drvdata(serdev, qcadev);
2040         device_property_read_string(&serdev->dev, "firmware-name",
2041                                          &qcadev->firmware_name);
2042         device_property_read_u32(&serdev->dev, "max-speed",
2043                                  &qcadev->oper_speed);
2044         if (!qcadev->oper_speed)
2045                 BT_DBG("UART will pick default operating speed");
2046
2047         if (data &&
2048             (qca_is_wcn399x(data->soc_type) ||
2049             qca_is_wcn6750(data->soc_type))) {
2050                 qcadev->btsoc_type = data->soc_type;
2051                 qcadev->bt_power = devm_kzalloc(&serdev->dev,
2052                                                 sizeof(struct qca_power),
2053                                                 GFP_KERNEL);
2054                 if (!qcadev->bt_power)
2055                         return -ENOMEM;
2056
2057                 qcadev->bt_power->dev = &serdev->dev;
2058                 err = qca_init_regulators(qcadev->bt_power, data->vregs,
2059                                           data->num_vregs);
2060                 if (err) {
2061                         BT_ERR("Failed to init regulators:%d", err);
2062                         return err;
2063                 }
2064
2065                 qcadev->bt_power->vregs_on = false;
2066
2067                 qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
2068                                                GPIOD_OUT_LOW);
2069                 if (IS_ERR_OR_NULL(qcadev->bt_en) && data->soc_type == QCA_WCN6750) {
2070                         dev_err(&serdev->dev, "failed to acquire BT_EN gpio\n");
2071                         power_ctrl_enabled = false;
2072                 }
2073
2074                 qcadev->sw_ctrl = devm_gpiod_get_optional(&serdev->dev, "swctrl",
2075                                                GPIOD_IN);
2076                 if (IS_ERR_OR_NULL(qcadev->sw_ctrl) && data->soc_type == QCA_WCN6750)
2077                         dev_warn(&serdev->dev, "failed to acquire SW_CTRL gpio\n");
2078
2079                 qcadev->susclk = devm_clk_get_optional(&serdev->dev, NULL);
2080                 if (IS_ERR(qcadev->susclk)) {
2081                         dev_err(&serdev->dev, "failed to acquire clk\n");
2082                         return PTR_ERR(qcadev->susclk);
2083                 }
2084
2085                 err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
2086                 if (err) {
2087                         BT_ERR("wcn3990 serdev registration failed");
2088                         return err;
2089                 }
2090         } else {
2091                 if (data)
2092                         qcadev->btsoc_type = data->soc_type;
2093                 else
2094                         qcadev->btsoc_type = QCA_ROME;
2095
2096                 qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
2097                                                GPIOD_OUT_LOW);
2098                 if (IS_ERR_OR_NULL(qcadev->bt_en)) {
2099                         dev_warn(&serdev->dev, "failed to acquire enable gpio\n");
2100                         power_ctrl_enabled = false;
2101                 }
2102
2103                 qcadev->susclk = devm_clk_get_optional(&serdev->dev, NULL);
2104                 if (IS_ERR(qcadev->susclk)) {
2105                         dev_warn(&serdev->dev, "failed to acquire clk\n");
2106                         return PTR_ERR(qcadev->susclk);
2107                 }
2108                 err = clk_set_rate(qcadev->susclk, SUSCLK_RATE_32KHZ);
2109                 if (err)
2110                         return err;
2111
2112                 err = clk_prepare_enable(qcadev->susclk);
2113                 if (err)
2114                         return err;
2115
2116                 err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
2117                 if (err) {
2118                         BT_ERR("Rome serdev registration failed");
2119                         clk_disable_unprepare(qcadev->susclk);
2120                         return err;
2121                 }
2122         }
2123
2124         hdev = qcadev->serdev_hu.hdev;
2125
2126         if (power_ctrl_enabled) {
2127                 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
2128                 hdev->shutdown = qca_power_off;
2129         }
2130
2131         if (data) {
2132                 /* Wideband speech support must be set per driver since it can't
2133                  * be queried via hci. Same with the valid le states quirk.
2134                  */
2135                 if (data->capabilities & QCA_CAP_WIDEBAND_SPEECH)
2136                         set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2137                                 &hdev->quirks);
2138
2139                 if (data->capabilities & QCA_CAP_VALID_LE_STATES)
2140                         set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
2141         }
2142
2143         return 0;
2144 }
2145
2146 static void qca_serdev_remove(struct serdev_device *serdev)
2147 {
2148         struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2149         struct qca_power *power = qcadev->bt_power;
2150
2151         if ((qca_is_wcn399x(qcadev->btsoc_type) ||
2152              qca_is_wcn6750(qcadev->btsoc_type)) &&
2153              power->vregs_on)
2154                 qca_power_shutdown(&qcadev->serdev_hu);
2155         else if (qcadev->susclk)
2156                 clk_disable_unprepare(qcadev->susclk);
2157
2158         hci_uart_unregister_device(&qcadev->serdev_hu);
2159 }
2160
2161 static void qca_serdev_shutdown(struct device *dev)
2162 {
2163         int ret;
2164         int timeout = msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS);
2165         struct serdev_device *serdev = to_serdev_device(dev);
2166         struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2167         struct hci_uart *hu = &qcadev->serdev_hu;
2168         struct hci_dev *hdev = hu->hdev;
2169         struct qca_data *qca = hu->priv;
2170         const u8 ibs_wake_cmd[] = { 0xFD };
2171         const u8 edl_reset_soc_cmd[] = { 0x01, 0x00, 0xFC, 0x01, 0x05 };
2172
2173         if (qcadev->btsoc_type == QCA_QCA6390) {
2174                 if (test_bit(QCA_BT_OFF, &qca->flags) ||
2175                     !test_bit(HCI_RUNNING, &hdev->flags))
2176                         return;
2177
2178                 serdev_device_write_flush(serdev);
2179                 ret = serdev_device_write_buf(serdev, ibs_wake_cmd,
2180                                               sizeof(ibs_wake_cmd));
2181                 if (ret < 0) {
2182                         BT_ERR("QCA send IBS_WAKE_IND error: %d", ret);
2183                         return;
2184                 }
2185                 serdev_device_wait_until_sent(serdev, timeout);
2186                 usleep_range(8000, 10000);
2187
2188                 serdev_device_write_flush(serdev);
2189                 ret = serdev_device_write_buf(serdev, edl_reset_soc_cmd,
2190                                               sizeof(edl_reset_soc_cmd));
2191                 if (ret < 0) {
2192                         BT_ERR("QCA send EDL_RESET_REQ error: %d", ret);
2193                         return;
2194                 }
2195                 serdev_device_wait_until_sent(serdev, timeout);
2196                 usleep_range(8000, 10000);
2197         }
2198 }
2199
2200 static int __maybe_unused qca_suspend(struct device *dev)
2201 {
2202         struct serdev_device *serdev = to_serdev_device(dev);
2203         struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2204         struct hci_uart *hu = &qcadev->serdev_hu;
2205         struct qca_data *qca = hu->priv;
2206         unsigned long flags;
2207         bool tx_pending = false;
2208         int ret = 0;
2209         u8 cmd;
2210         u32 wait_timeout = 0;
2211
2212         set_bit(QCA_SUSPENDING, &qca->flags);
2213
2214         /* if BT SoC is running with default firmware then it does not
2215          * support in-band sleep
2216          */
2217         if (test_bit(QCA_ROM_FW, &qca->flags))
2218                 return 0;
2219
2220         /* During SSR after memory dump collection, controller will be
2221          * powered off and then powered on.If controller is powered off
2222          * during SSR then we should wait until SSR is completed.
2223          */
2224         if (test_bit(QCA_BT_OFF, &qca->flags) &&
2225             !test_bit(QCA_SSR_TRIGGERED, &qca->flags))
2226                 return 0;
2227
2228         if (test_bit(QCA_IBS_DISABLED, &qca->flags) ||
2229             test_bit(QCA_SSR_TRIGGERED, &qca->flags)) {
2230                 wait_timeout = test_bit(QCA_SSR_TRIGGERED, &qca->flags) ?
2231                                         IBS_DISABLE_SSR_TIMEOUT_MS :
2232                                         FW_DOWNLOAD_TIMEOUT_MS;
2233
2234                 /* QCA_IBS_DISABLED flag is set to true, During FW download
2235                  * and during memory dump collection. It is reset to false,
2236                  * After FW download complete.
2237                  */
2238                 wait_on_bit_timeout(&qca->flags, QCA_IBS_DISABLED,
2239                             TASK_UNINTERRUPTIBLE, msecs_to_jiffies(wait_timeout));
2240
2241                 if (test_bit(QCA_IBS_DISABLED, &qca->flags)) {
2242                         bt_dev_err(hu->hdev, "SSR or FW download time out");
2243                         ret = -ETIMEDOUT;
2244                         goto error;
2245                 }
2246         }
2247
2248         cancel_work_sync(&qca->ws_awake_device);
2249         cancel_work_sync(&qca->ws_awake_rx);
2250
2251         spin_lock_irqsave_nested(&qca->hci_ibs_lock,
2252                                  flags, SINGLE_DEPTH_NESTING);
2253
2254         switch (qca->tx_ibs_state) {
2255         case HCI_IBS_TX_WAKING:
2256                 del_timer(&qca->wake_retrans_timer);
2257                 fallthrough;
2258         case HCI_IBS_TX_AWAKE:
2259                 del_timer(&qca->tx_idle_timer);
2260
2261                 serdev_device_write_flush(hu->serdev);
2262                 cmd = HCI_IBS_SLEEP_IND;
2263                 ret = serdev_device_write_buf(hu->serdev, &cmd, sizeof(cmd));
2264
2265                 if (ret < 0) {
2266                         BT_ERR("Failed to send SLEEP to device");
2267                         break;
2268                 }
2269
2270                 qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
2271                 qca->ibs_sent_slps++;
2272                 tx_pending = true;
2273                 break;
2274
2275         case HCI_IBS_TX_ASLEEP:
2276                 break;
2277
2278         default:
2279                 BT_ERR("Spurious tx state %d", qca->tx_ibs_state);
2280                 ret = -EINVAL;
2281                 break;
2282         }
2283
2284         spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
2285
2286         if (ret < 0)
2287                 goto error;
2288
2289         if (tx_pending) {
2290                 serdev_device_wait_until_sent(hu->serdev,
2291                                               msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS));
2292                 serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_OFF, hu);
2293         }
2294
2295         /* Wait for HCI_IBS_SLEEP_IND sent by device to indicate its Tx is going
2296          * to sleep, so that the packet does not wake the system later.
2297          */
2298         ret = wait_event_interruptible_timeout(qca->suspend_wait_q,
2299                         qca->rx_ibs_state == HCI_IBS_RX_ASLEEP,
2300                         msecs_to_jiffies(IBS_BTSOC_TX_IDLE_TIMEOUT_MS));
2301         if (ret == 0) {
2302                 ret = -ETIMEDOUT;
2303                 goto error;
2304         }
2305
2306         return 0;
2307
2308 error:
2309         clear_bit(QCA_SUSPENDING, &qca->flags);
2310
2311         return ret;
2312 }
2313
2314 static int __maybe_unused qca_resume(struct device *dev)
2315 {
2316         struct serdev_device *serdev = to_serdev_device(dev);
2317         struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2318         struct hci_uart *hu = &qcadev->serdev_hu;
2319         struct qca_data *qca = hu->priv;
2320
2321         clear_bit(QCA_SUSPENDING, &qca->flags);
2322
2323         return 0;
2324 }
2325
2326 static SIMPLE_DEV_PM_OPS(qca_pm_ops, qca_suspend, qca_resume);
2327
2328 #ifdef CONFIG_OF
2329 static const struct of_device_id qca_bluetooth_of_match[] = {
2330         { .compatible = "qcom,qca6174-bt" },
2331         { .compatible = "qcom,qca6390-bt", .data = &qca_soc_data_qca6390},
2332         { .compatible = "qcom,qca9377-bt" },
2333         { .compatible = "qcom,wcn3990-bt", .data = &qca_soc_data_wcn3990},
2334         { .compatible = "qcom,wcn3991-bt", .data = &qca_soc_data_wcn3991},
2335         { .compatible = "qcom,wcn3998-bt", .data = &qca_soc_data_wcn3998},
2336         { .compatible = "qcom,wcn6750-bt", .data = &qca_soc_data_wcn6750},
2337         { /* sentinel */ }
2338 };
2339 MODULE_DEVICE_TABLE(of, qca_bluetooth_of_match);
2340 #endif
2341
2342 #ifdef CONFIG_ACPI
2343 static const struct acpi_device_id qca_bluetooth_acpi_match[] = {
2344         { "QCOM6390", (kernel_ulong_t)&qca_soc_data_qca6390 },
2345         { "DLA16390", (kernel_ulong_t)&qca_soc_data_qca6390 },
2346         { "DLB16390", (kernel_ulong_t)&qca_soc_data_qca6390 },
2347         { "DLB26390", (kernel_ulong_t)&qca_soc_data_qca6390 },
2348         { },
2349 };
2350 MODULE_DEVICE_TABLE(acpi, qca_bluetooth_acpi_match);
2351 #endif
2352
2353
2354 static struct serdev_device_driver qca_serdev_driver = {
2355         .probe = qca_serdev_probe,
2356         .remove = qca_serdev_remove,
2357         .driver = {
2358                 .name = "hci_uart_qca",
2359                 .of_match_table = of_match_ptr(qca_bluetooth_of_match),
2360                 .acpi_match_table = ACPI_PTR(qca_bluetooth_acpi_match),
2361                 .shutdown = qca_serdev_shutdown,
2362                 .pm = &qca_pm_ops,
2363         },
2364 };
2365
2366 int __init qca_init(void)
2367 {
2368         serdev_device_driver_register(&qca_serdev_driver);
2369
2370         return hci_uart_register_proto(&qca_proto);
2371 }
2372
2373 int __exit qca_deinit(void)
2374 {
2375         serdev_device_driver_unregister(&qca_serdev_driver);
2376
2377         return hci_uart_unregister_proto(&qca_proto);
2378 }