1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 *  Bluetooth Software UART Qualcomm protocol
   4 *
   5 *  HCI_IBS (HCI In-Band Sleep) is Qualcomm's power management
   6 *  protocol extension to H4.
   7 *
   8 *  Copyright (C) 2007 Texas Instruments, Inc.
   9 *  Copyright (c) 2010, 2012, 2018 The Linux Foundation. All rights reserved.
  10 *
  11 *  Acknowledgements:
  12 *  This file is based on hci_ll.c, which was...
  13 *  Written by Ohad Ben-Cohen <ohad@bencohen.org>
  14 *  which was in turn based on hci_h4.c, which was written
  15 *  by Maxim Krasnyansky and Marcel Holtmann.
  16 */
  17
  18#include <linux/kernel.h>
  19#include <linux/clk.h>
  20#include <linux/completion.h>
  21#include <linux/debugfs.h>
  22#include <linux/delay.h>
  23#include <linux/devcoredump.h>
  24#include <linux/device.h>
  25#include <linux/gpio/consumer.h>
  26#include <linux/mod_devicetable.h>
  27#include <linux/module.h>
  28#include <linux/of_device.h>
  29#include <linux/acpi.h>
  30#include <linux/platform_device.h>
  31#include <linux/regulator/consumer.h>
  32#include <linux/serdev.h>
  33#include <linux/mutex.h>
  34#include <asm/unaligned.h>
  35
  36#include <net/bluetooth/bluetooth.h>
  37#include <net/bluetooth/hci_core.h>
  38
  39#include "hci_uart.h"
  40#include "btqca.h"
  41
  42/* HCI_IBS protocol messages */
  43#define HCI_IBS_SLEEP_IND	0xFE
  44#define HCI_IBS_WAKE_IND	0xFD
  45#define HCI_IBS_WAKE_ACK	0xFC
  46#define HCI_MAX_IBS_SIZE	10
  47
  48#define IBS_WAKE_RETRANS_TIMEOUT_MS	100
  49#define IBS_BTSOC_TX_IDLE_TIMEOUT_MS	200
  50#define IBS_HOST_TX_IDLE_TIMEOUT_MS	2000
  51#define CMD_TRANS_TIMEOUT_MS		100
  52#define MEMDUMP_TIMEOUT_MS		8000
  53#define IBS_DISABLE_SSR_TIMEOUT_MS \
  54	(MEMDUMP_TIMEOUT_MS + FW_DOWNLOAD_TIMEOUT_MS)
  55#define FW_DOWNLOAD_TIMEOUT_MS		3000
  56
  57/* susclk rate */
  58#define SUSCLK_RATE_32KHZ	32768
  59
  60/* Controller debug log header */
  61#define QCA_DEBUG_HANDLE	0x2EDC
  62
  63/* max retry count when init fails */
  64#define MAX_INIT_RETRIES 3
  65
  66/* Controller dump header */
  67#define QCA_SSR_DUMP_HANDLE		0x0108
  68#define QCA_DUMP_PACKET_SIZE		255
  69#define QCA_LAST_SEQUENCE_NUM		0xFFFF
  70#define QCA_CRASHBYTE_PACKET_LEN	1096
  71#define QCA_MEMDUMP_BYTE		0xFB
  72
  73enum qca_flags {
  74	QCA_IBS_DISABLED,
  75	QCA_DROP_VENDOR_EVENT,
  76	QCA_SUSPENDING,
  77	QCA_MEMDUMP_COLLECTION,
  78	QCA_HW_ERROR_EVENT,
  79	QCA_SSR_TRIGGERED,
  80	QCA_BT_OFF,
  81	QCA_ROM_FW
  82};
  83
  84enum qca_capabilities {
  85	QCA_CAP_WIDEBAND_SPEECH = BIT(0),
  86	QCA_CAP_VALID_LE_STATES = BIT(1),
  87};
  88
  89/* HCI_IBS transmit side sleep protocol states */
  90enum tx_ibs_states {
  91	HCI_IBS_TX_ASLEEP,
  92	HCI_IBS_TX_WAKING,
  93	HCI_IBS_TX_AWAKE,
  94};
  95
  96/* HCI_IBS receive side sleep protocol states */
  97enum rx_states {
  98	HCI_IBS_RX_ASLEEP,
  99	HCI_IBS_RX_AWAKE,
 100};
 101
 102/* HCI_IBS transmit and receive side clock state vote */
 103enum hci_ibs_clock_state_vote {
 104	HCI_IBS_VOTE_STATS_UPDATE,
 105	HCI_IBS_TX_VOTE_CLOCK_ON,
 106	HCI_IBS_TX_VOTE_CLOCK_OFF,
 107	HCI_IBS_RX_VOTE_CLOCK_ON,
 108	HCI_IBS_RX_VOTE_CLOCK_OFF,
 109};
 110
 111/* Controller memory dump states */
 112enum qca_memdump_states {
 113	QCA_MEMDUMP_IDLE,
 114	QCA_MEMDUMP_COLLECTING,
 115	QCA_MEMDUMP_COLLECTED,
 116	QCA_MEMDUMP_TIMEOUT,
 117};
 118
 119struct qca_memdump_data {
 120	char *memdump_buf_head;
 121	char *memdump_buf_tail;
 122	u32 current_seq_no;
 123	u32 received_dump;
 124	u32 ram_dump_size;
 125};
 126
 127struct qca_memdump_event_hdr {
 128	__u8    evt;
 129	__u8    plen;
 130	__u16   opcode;
 131	__u16   seq_no;
 132	__u8    reserved;
 133} __packed;
 134
 135
 136struct qca_dump_size {
 137	u32 dump_size;
 138} __packed;
 139
 140struct qca_data {
 141	struct hci_uart *hu;
 142	struct sk_buff *rx_skb;
 143	struct sk_buff_head txq;
 144	struct sk_buff_head tx_wait_q;	/* HCI_IBS wait queue	*/
 145	struct sk_buff_head rx_memdump_q;	/* Memdump wait queue	*/
 146	spinlock_t hci_ibs_lock;	/* HCI_IBS state lock	*/
 147	u8 tx_ibs_state;	/* HCI_IBS transmit side power state*/
 148	u8 rx_ibs_state;	/* HCI_IBS receive side power state */
 149	bool tx_vote;		/* Clock must be on for TX */
 150	bool rx_vote;		/* Clock must be on for RX */
 151	struct timer_list tx_idle_timer;
 152	u32 tx_idle_delay;
 153	struct timer_list wake_retrans_timer;
 154	u32 wake_retrans;
 155	struct workqueue_struct *workqueue;
 156	struct work_struct ws_awake_rx;
 157	struct work_struct ws_awake_device;
 158	struct work_struct ws_rx_vote_off;
 159	struct work_struct ws_tx_vote_off;
 160	struct work_struct ctrl_memdump_evt;
 161	struct delayed_work ctrl_memdump_timeout;
 162	struct qca_memdump_data *qca_memdump;
 163	unsigned long flags;
 164	struct completion drop_ev_comp;
 165	wait_queue_head_t suspend_wait_q;
 166	enum qca_memdump_states memdump_state;
 167	struct mutex hci_memdump_lock;
 168
 169	/* For debugging purpose */
 170	u64 ibs_sent_wacks;
 171	u64 ibs_sent_slps;
 172	u64 ibs_sent_wakes;
 173	u64 ibs_recv_wacks;
 174	u64 ibs_recv_slps;
 175	u64 ibs_recv_wakes;
 176	u64 vote_last_jif;
 177	u32 vote_on_ms;
 178	u32 vote_off_ms;
 179	u64 tx_votes_on;
 180	u64 rx_votes_on;
 181	u64 tx_votes_off;
 182	u64 rx_votes_off;
 183	u64 votes_on;
 184	u64 votes_off;
 185};
 186
 187enum qca_speed_type {
 188	QCA_INIT_SPEED = 1,
 189	QCA_OPER_SPEED
 190};
 191
 192/*
 193 * Voltage regulator information required for configuring the
 194 * QCA Bluetooth chipset
 195 */
 196struct qca_vreg {
 197	const char *name;
 198	unsigned int load_uA;
 199};
 200
 201struct qca_device_data {
 202	enum qca_btsoc_type soc_type;
 203	struct qca_vreg *vregs;
 204	size_t num_vregs;
 205	uint32_t capabilities;
 206};
 207
 208/*
 209 * Platform data for the QCA Bluetooth power driver.
 210 */
 211struct qca_power {
 212	struct device *dev;
 213	struct regulator_bulk_data *vreg_bulk;
 214	int num_vregs;
 215	bool vregs_on;
 216};
 217
 218struct qca_serdev {
 219	struct hci_uart	 serdev_hu;
 220	struct gpio_desc *bt_en;
 221	struct gpio_desc *sw_ctrl;
 222	struct clk	 *susclk;
 223	enum qca_btsoc_type btsoc_type;
 224	struct qca_power *bt_power;
 225	u32 init_speed;
 226	u32 oper_speed;
 227	const char *firmware_name;
 228};
 229
 230static int qca_regulator_enable(struct qca_serdev *qcadev);
 231static void qca_regulator_disable(struct qca_serdev *qcadev);
 232static void qca_power_shutdown(struct hci_uart *hu);
 233static int qca_power_off(struct hci_dev *hdev);
 234static void qca_controller_memdump(struct work_struct *work);
 235
 236static enum qca_btsoc_type qca_soc_type(struct hci_uart *hu)
 237{
 238	enum qca_btsoc_type soc_type;
 239
 240	if (hu->serdev) {
 241		struct qca_serdev *qsd = serdev_device_get_drvdata(hu->serdev);
 242
 243		soc_type = qsd->btsoc_type;
 244	} else {
 245		soc_type = QCA_ROME;
 246	}
 247
 248	return soc_type;
 249}
 250
 251static const char *qca_get_firmware_name(struct hci_uart *hu)
 252{
 253	if (hu->serdev) {
 254		struct qca_serdev *qsd = serdev_device_get_drvdata(hu->serdev);
 255
 256		return qsd->firmware_name;
 257	} else {
 258		return NULL;
 259	}
 260}
 261
 262static void __serial_clock_on(struct tty_struct *tty)
 263{
 264	/* TODO: Some chipset requires to enable UART clock on client
 265	 * side to save power consumption or manual work is required.
 266	 * Please put your code to control UART clock here if needed
 267	 */
 268}
 269
 270static void __serial_clock_off(struct tty_struct *tty)
 271{
 272	/* TODO: Some chipset requires to disable UART clock on client
 273	 * side to save power consumption or manual work is required.
 274	 * Please put your code to control UART clock off here if needed
 275	 */
 276}
 277
 278/* serial_clock_vote needs to be called with the ibs lock held */
 279static void serial_clock_vote(unsigned long vote, struct hci_uart *hu)
 280{
 281	struct qca_data *qca = hu->priv;
 282	unsigned int diff;
 283
 284	bool old_vote = (qca->tx_vote | qca->rx_vote);
 285	bool new_vote;
 286
 287	switch (vote) {
 288	case HCI_IBS_VOTE_STATS_UPDATE:
 289		diff = jiffies_to_msecs(jiffies - qca->vote_last_jif);
 290
 291		if (old_vote)
 292			qca->vote_off_ms += diff;
 293		else
 294			qca->vote_on_ms += diff;
 295		return;
 296
 297	case HCI_IBS_TX_VOTE_CLOCK_ON:
 298		qca->tx_vote = true;
 299		qca->tx_votes_on++;
 300		break;
 301
 302	case HCI_IBS_RX_VOTE_CLOCK_ON:
 303		qca->rx_vote = true;
 304		qca->rx_votes_on++;
 305		break;
 306
 307	case HCI_IBS_TX_VOTE_CLOCK_OFF:
 308		qca->tx_vote = false;
 309		qca->tx_votes_off++;
 310		break;
 311
 312	case HCI_IBS_RX_VOTE_CLOCK_OFF:
 313		qca->rx_vote = false;
 314		qca->rx_votes_off++;
 315		break;
 316
 317	default:
 318		BT_ERR("Voting irregularity");
 319		return;
 320	}
 321
 322	new_vote = qca->rx_vote | qca->tx_vote;
 323
 324	if (new_vote != old_vote) {
 325		if (new_vote)
 326			__serial_clock_on(hu->tty);
 327		else
 328			__serial_clock_off(hu->tty);
 329
 330		BT_DBG("Vote serial clock %s(%s)", new_vote ? "true" : "false",
 331		       vote ? "true" : "false");
 332
 333		diff = jiffies_to_msecs(jiffies - qca->vote_last_jif);
 334
 335		if (new_vote) {
 336			qca->votes_on++;
 337			qca->vote_off_ms += diff;
 338		} else {
 339			qca->votes_off++;
 340			qca->vote_on_ms += diff;
 341		}
 342		qca->vote_last_jif = jiffies;
 343	}
 344}
 345
 346/* Builds and sends an HCI_IBS command packet.
 347 * These are very simple packets with only 1 cmd byte.
 348 */
 349static int send_hci_ibs_cmd(u8 cmd, struct hci_uart *hu)
 350{
 351	int err = 0;
 352	struct sk_buff *skb = NULL;
 353	struct qca_data *qca = hu->priv;
 354
 355	BT_DBG("hu %p send hci ibs cmd 0x%x", hu, cmd);
 356
 357	skb = bt_skb_alloc(1, GFP_ATOMIC);
 358	if (!skb) {
 359		BT_ERR("Failed to allocate memory for HCI_IBS packet");
 360		return -ENOMEM;
 361	}
 362
 363	/* Assign HCI_IBS type */
 364	skb_put_u8(skb, cmd);
 365
 366	skb_queue_tail(&qca->txq, skb);
 367
 368	return err;
 369}
 370
 371static void qca_wq_awake_device(struct work_struct *work)
 372{
 373	struct qca_data *qca = container_of(work, struct qca_data,
 374					    ws_awake_device);
 375	struct hci_uart *hu = qca->hu;
 376	unsigned long retrans_delay;
 377	unsigned long flags;
 378
 379	BT_DBG("hu %p wq awake device", hu);
 380
 381	/* Vote for serial clock */
 382	serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_ON, hu);
 383
 384	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 385
 386	/* Send wake indication to device */
 387	if (send_hci_ibs_cmd(HCI_IBS_WAKE_IND, hu) < 0)
 388		BT_ERR("Failed to send WAKE to device");
 389
 390	qca->ibs_sent_wakes++;
 391
 392	/* Start retransmit timer */
 393	retrans_delay = msecs_to_jiffies(qca->wake_retrans);
 394	mod_timer(&qca->wake_retrans_timer, jiffies + retrans_delay);
 395
 396	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 397
 398	/* Actually send the packets */
 399	hci_uart_tx_wakeup(hu);
 400}
 401
 402static void qca_wq_awake_rx(struct work_struct *work)
 403{
 404	struct qca_data *qca = container_of(work, struct qca_data,
 405					    ws_awake_rx);
 406	struct hci_uart *hu = qca->hu;
 407	unsigned long flags;
 408
 409	BT_DBG("hu %p wq awake rx", hu);
 410
 411	serial_clock_vote(HCI_IBS_RX_VOTE_CLOCK_ON, hu);
 412
 413	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 414	qca->rx_ibs_state = HCI_IBS_RX_AWAKE;
 415
 416	/* Always acknowledge device wake up,
 417	 * sending IBS message doesn't count as TX ON.
 418	 */
 419	if (send_hci_ibs_cmd(HCI_IBS_WAKE_ACK, hu) < 0)
 420		BT_ERR("Failed to acknowledge device wake up");
 421
 422	qca->ibs_sent_wacks++;
 423
 424	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 425
 426	/* Actually send the packets */
 427	hci_uart_tx_wakeup(hu);
 428}
 429
 430static void qca_wq_serial_rx_clock_vote_off(struct work_struct *work)
 431{
 432	struct qca_data *qca = container_of(work, struct qca_data,
 433					    ws_rx_vote_off);
 434	struct hci_uart *hu = qca->hu;
 435
 436	BT_DBG("hu %p rx clock vote off", hu);
 437
 438	serial_clock_vote(HCI_IBS_RX_VOTE_CLOCK_OFF, hu);
 439}
 440
 441static void qca_wq_serial_tx_clock_vote_off(struct work_struct *work)
 442{
 443	struct qca_data *qca = container_of(work, struct qca_data,
 444					    ws_tx_vote_off);
 445	struct hci_uart *hu = qca->hu;
 446
 447	BT_DBG("hu %p tx clock vote off", hu);
 448
 449	/* Run HCI tx handling unlocked */
 450	hci_uart_tx_wakeup(hu);
 451
 452	/* Now that message queued to tty driver, vote for tty clocks off.
 453	 * It is up to the tty driver to pend the clocks off until tx done.
 454	 */
 455	serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_OFF, hu);
 456}
 457
 458static void hci_ibs_tx_idle_timeout(struct timer_list *t)
 459{
 460	struct qca_data *qca = from_timer(qca, t, tx_idle_timer);
 461	struct hci_uart *hu = qca->hu;
 462	unsigned long flags;
 463
 464	BT_DBG("hu %p idle timeout in %d state", hu, qca->tx_ibs_state);
 465
 466	spin_lock_irqsave_nested(&qca->hci_ibs_lock,
 467				 flags, SINGLE_DEPTH_NESTING);
 468
 469	switch (qca->tx_ibs_state) {
 470	case HCI_IBS_TX_AWAKE:
 471		/* TX_IDLE, go to SLEEP */
 472		if (send_hci_ibs_cmd(HCI_IBS_SLEEP_IND, hu) < 0) {
 473			BT_ERR("Failed to send SLEEP to device");
 474			break;
 475		}
 476		qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
 477		qca->ibs_sent_slps++;
 478		queue_work(qca->workqueue, &qca->ws_tx_vote_off);
 479		break;
 480
 481	case HCI_IBS_TX_ASLEEP:
 482	case HCI_IBS_TX_WAKING:
 483	default:
 484		BT_ERR("Spurious timeout tx state %d", qca->tx_ibs_state);
 485		break;
 486	}
 487
 488	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 489}
 490
 491static void hci_ibs_wake_retrans_timeout(struct timer_list *t)
 492{
 493	struct qca_data *qca = from_timer(qca, t, wake_retrans_timer);
 494	struct hci_uart *hu = qca->hu;
 495	unsigned long flags, retrans_delay;
 496	bool retransmit = false;
 497
 498	BT_DBG("hu %p wake retransmit timeout in %d state",
 499		hu, qca->tx_ibs_state);
 500
 501	spin_lock_irqsave_nested(&qca->hci_ibs_lock,
 502				 flags, SINGLE_DEPTH_NESTING);
 503
 504	/* Don't retransmit the HCI_IBS_WAKE_IND when suspending. */
 505	if (test_bit(QCA_SUSPENDING, &qca->flags)) {
 506		spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 507		return;
 508	}
 509
 510	switch (qca->tx_ibs_state) {
 511	case HCI_IBS_TX_WAKING:
 512		/* No WAKE_ACK, retransmit WAKE */
 513		retransmit = true;
 514		if (send_hci_ibs_cmd(HCI_IBS_WAKE_IND, hu) < 0) {
 515			BT_ERR("Failed to acknowledge device wake up");
 516			break;
 517		}
 518		qca->ibs_sent_wakes++;
 519		retrans_delay = msecs_to_jiffies(qca->wake_retrans);
 520		mod_timer(&qca->wake_retrans_timer, jiffies + retrans_delay);
 521		break;
 522
 523	case HCI_IBS_TX_ASLEEP:
 524	case HCI_IBS_TX_AWAKE:
 525	default:
 526		BT_ERR("Spurious timeout tx state %d", qca->tx_ibs_state);
 527		break;
 528	}
 529
 530	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 531
 532	if (retransmit)
 533		hci_uart_tx_wakeup(hu);
 534}
 535
 536
 537static void qca_controller_memdump_timeout(struct work_struct *work)
 538{
 539	struct qca_data *qca = container_of(work, struct qca_data,
 540					ctrl_memdump_timeout.work);
 541	struct hci_uart *hu = qca->hu;
 542
 543	mutex_lock(&qca->hci_memdump_lock);
 544	if (test_bit(QCA_MEMDUMP_COLLECTION, &qca->flags)) {
 545		qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
 546		if (!test_bit(QCA_HW_ERROR_EVENT, &qca->flags)) {
 547			/* Inject hw error event to reset the device
 548			 * and driver.
 549			 */
 550			hci_reset_dev(hu->hdev);
 551		}
 552	}
 553
 554	mutex_unlock(&qca->hci_memdump_lock);
 555}
 556
 557
 558/* Initialize protocol */
 559static int qca_open(struct hci_uart *hu)
 560{
 561	struct qca_serdev *qcadev;
 562	struct qca_data *qca;
 563
 564	BT_DBG("hu %p qca_open", hu);
 565
 566	if (!hci_uart_has_flow_control(hu))
 567		return -EOPNOTSUPP;
 568
 569	qca = kzalloc(sizeof(struct qca_data), GFP_KERNEL);
 570	if (!qca)
 571		return -ENOMEM;
 572
 573	skb_queue_head_init(&qca->txq);
 574	skb_queue_head_init(&qca->tx_wait_q);
 575	skb_queue_head_init(&qca->rx_memdump_q);
 576	spin_lock_init(&qca->hci_ibs_lock);
 577	mutex_init(&qca->hci_memdump_lock);
 578	qca->workqueue = alloc_ordered_workqueue("qca_wq", 0);
 579	if (!qca->workqueue) {
 580		BT_ERR("QCA Workqueue not initialized properly");
 581		kfree(qca);
 582		return -ENOMEM;
 583	}
 584
 585	INIT_WORK(&qca->ws_awake_rx, qca_wq_awake_rx);
 586	INIT_WORK(&qca->ws_awake_device, qca_wq_awake_device);
 587	INIT_WORK(&qca->ws_rx_vote_off, qca_wq_serial_rx_clock_vote_off);
 588	INIT_WORK(&qca->ws_tx_vote_off, qca_wq_serial_tx_clock_vote_off);
 589	INIT_WORK(&qca->ctrl_memdump_evt, qca_controller_memdump);
 590	INIT_DELAYED_WORK(&qca->ctrl_memdump_timeout,
 591			  qca_controller_memdump_timeout);
 592	init_waitqueue_head(&qca->suspend_wait_q);
 593
 594	qca->hu = hu;
 595	init_completion(&qca->drop_ev_comp);
 596
 597	/* Assume we start with both sides asleep -- extra wakes OK */
 598	qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
 599	qca->rx_ibs_state = HCI_IBS_RX_ASLEEP;
 600
 601	qca->vote_last_jif = jiffies;
 602
 603	hu->priv = qca;
 604
 605	if (hu->serdev) {
 606		qcadev = serdev_device_get_drvdata(hu->serdev);
 607
 608		if (qca_is_wcn399x(qcadev->btsoc_type) ||
 609		    qca_is_wcn6750(qcadev->btsoc_type))
 610			hu->init_speed = qcadev->init_speed;
 611
 612		if (qcadev->oper_speed)
 613			hu->oper_speed = qcadev->oper_speed;
 614	}
 615
 616	timer_setup(&qca->wake_retrans_timer, hci_ibs_wake_retrans_timeout, 0);
 617	qca->wake_retrans = IBS_WAKE_RETRANS_TIMEOUT_MS;
 618
 619	timer_setup(&qca->tx_idle_timer, hci_ibs_tx_idle_timeout, 0);
 620	qca->tx_idle_delay = IBS_HOST_TX_IDLE_TIMEOUT_MS;
 621
 622	BT_DBG("HCI_UART_QCA open, tx_idle_delay=%u, wake_retrans=%u",
 623	       qca->tx_idle_delay, qca->wake_retrans);
 624
 625	return 0;
 626}
 627
 628static void qca_debugfs_init(struct hci_dev *hdev)
 629{
 630	struct hci_uart *hu = hci_get_drvdata(hdev);
 631	struct qca_data *qca = hu->priv;
 632	struct dentry *ibs_dir;
 633	umode_t mode;
 634
 635	if (!hdev->debugfs)
 636		return;
 637
 638	ibs_dir = debugfs_create_dir("ibs", hdev->debugfs);
 639
 640	/* read only */
 641	mode = 0444;
 642	debugfs_create_u8("tx_ibs_state", mode, ibs_dir, &qca->tx_ibs_state);
 643	debugfs_create_u8("rx_ibs_state", mode, ibs_dir, &qca->rx_ibs_state);
 644	debugfs_create_u64("ibs_sent_sleeps", mode, ibs_dir,
 645			   &qca->ibs_sent_slps);
 646	debugfs_create_u64("ibs_sent_wakes", mode, ibs_dir,
 647			   &qca->ibs_sent_wakes);
 648	debugfs_create_u64("ibs_sent_wake_acks", mode, ibs_dir,
 649			   &qca->ibs_sent_wacks);
 650	debugfs_create_u64("ibs_recv_sleeps", mode, ibs_dir,
 651			   &qca->ibs_recv_slps);
 652	debugfs_create_u64("ibs_recv_wakes", mode, ibs_dir,
 653			   &qca->ibs_recv_wakes);
 654	debugfs_create_u64("ibs_recv_wake_acks", mode, ibs_dir,
 655			   &qca->ibs_recv_wacks);
 656	debugfs_create_bool("tx_vote", mode, ibs_dir, &qca->tx_vote);
 657	debugfs_create_u64("tx_votes_on", mode, ibs_dir, &qca->tx_votes_on);
 658	debugfs_create_u64("tx_votes_off", mode, ibs_dir, &qca->tx_votes_off);
 659	debugfs_create_bool("rx_vote", mode, ibs_dir, &qca->rx_vote);
 660	debugfs_create_u64("rx_votes_on", mode, ibs_dir, &qca->rx_votes_on);
 661	debugfs_create_u64("rx_votes_off", mode, ibs_dir, &qca->rx_votes_off);
 662	debugfs_create_u64("votes_on", mode, ibs_dir, &qca->votes_on);
 663	debugfs_create_u64("votes_off", mode, ibs_dir, &qca->votes_off);
 664	debugfs_create_u32("vote_on_ms", mode, ibs_dir, &qca->vote_on_ms);
 665	debugfs_create_u32("vote_off_ms", mode, ibs_dir, &qca->vote_off_ms);
 666
 667	/* read/write */
 668	mode = 0644;
 669	debugfs_create_u32("wake_retrans", mode, ibs_dir, &qca->wake_retrans);
 670	debugfs_create_u32("tx_idle_delay", mode, ibs_dir,
 671			   &qca->tx_idle_delay);
 672}
 673
 674/* Flush protocol data */
 675static int qca_flush(struct hci_uart *hu)
 676{
 677	struct qca_data *qca = hu->priv;
 678
 679	BT_DBG("hu %p qca flush", hu);
 680
 681	skb_queue_purge(&qca->tx_wait_q);
 682	skb_queue_purge(&qca->txq);
 683
 684	return 0;
 685}
 686
 687/* Close protocol */
 688static int qca_close(struct hci_uart *hu)
 689{
 690	struct qca_data *qca = hu->priv;
 691
 692	BT_DBG("hu %p qca close", hu);
 693
 694	serial_clock_vote(HCI_IBS_VOTE_STATS_UPDATE, hu);
 695
 696	skb_queue_purge(&qca->tx_wait_q);
 697	skb_queue_purge(&qca->txq);
 698	skb_queue_purge(&qca->rx_memdump_q);
 699	/*
 700	 * Shut the timers down so they can't be rearmed when
 701	 * destroy_workqueue() drains pending work which in turn might try
 702	 * to arm a timer.  After shutdown rearm attempts are silently
 703	 * ignored by the timer core code.
 704	 */
 705	timer_shutdown_sync(&qca->tx_idle_timer);
 706	timer_shutdown_sync(&qca->wake_retrans_timer);
 707	destroy_workqueue(qca->workqueue);
 708	qca->hu = NULL;
 709
 
 
 710	kfree_skb(qca->rx_skb);
 711
 712	hu->priv = NULL;
 713
 714	kfree(qca);
 715
 716	return 0;
 717}
 718
 719/* Called upon a wake-up-indication from the device.
 720 */
 721static void device_want_to_wakeup(struct hci_uart *hu)
 722{
 723	unsigned long flags;
 724	struct qca_data *qca = hu->priv;
 725
 726	BT_DBG("hu %p want to wake up", hu);
 727
 728	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 729
 730	qca->ibs_recv_wakes++;
 731
 732	/* Don't wake the rx up when suspending. */
 733	if (test_bit(QCA_SUSPENDING, &qca->flags)) {
 734		spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 735		return;
 736	}
 737
 738	switch (qca->rx_ibs_state) {
 739	case HCI_IBS_RX_ASLEEP:
 740		/* Make sure clock is on - we may have turned clock off since
 741		 * receiving the wake up indicator awake rx clock.
 742		 */
 743		queue_work(qca->workqueue, &qca->ws_awake_rx);
 744		spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 745		return;
 746
 747	case HCI_IBS_RX_AWAKE:
 748		/* Always acknowledge device wake up,
 749		 * sending IBS message doesn't count as TX ON.
 750		 */
 751		if (send_hci_ibs_cmd(HCI_IBS_WAKE_ACK, hu) < 0) {
 752			BT_ERR("Failed to acknowledge device wake up");
 753			break;
 754		}
 755		qca->ibs_sent_wacks++;
 756		break;
 757
 758	default:
 759		/* Any other state is illegal */
 760		BT_ERR("Received HCI_IBS_WAKE_IND in rx state %d",
 761		       qca->rx_ibs_state);
 762		break;
 763	}
 764
 765	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 766
 767	/* Actually send the packets */
 768	hci_uart_tx_wakeup(hu);
 769}
 770
 771/* Called upon a sleep-indication from the device.
 772 */
 773static void device_want_to_sleep(struct hci_uart *hu)
 774{
 775	unsigned long flags;
 776	struct qca_data *qca = hu->priv;
 777
 778	BT_DBG("hu %p want to sleep in %d state", hu, qca->rx_ibs_state);
 779
 780	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 781
 782	qca->ibs_recv_slps++;
 783
 784	switch (qca->rx_ibs_state) {
 785	case HCI_IBS_RX_AWAKE:
 786		/* Update state */
 787		qca->rx_ibs_state = HCI_IBS_RX_ASLEEP;
 788		/* Vote off rx clock under workqueue */
 789		queue_work(qca->workqueue, &qca->ws_rx_vote_off);
 790		break;
 791
 792	case HCI_IBS_RX_ASLEEP:
 793		break;
 794
 795	default:
 796		/* Any other state is illegal */
 797		BT_ERR("Received HCI_IBS_SLEEP_IND in rx state %d",
 798		       qca->rx_ibs_state);
 799		break;
 800	}
 801
 802	wake_up_interruptible(&qca->suspend_wait_q);
 803
 804	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 805}
 806
 807/* Called upon wake-up-acknowledgement from the device
 808 */
 809static void device_woke_up(struct hci_uart *hu)
 810{
 811	unsigned long flags, idle_delay;
 812	struct qca_data *qca = hu->priv;
 813	struct sk_buff *skb = NULL;
 814
 815	BT_DBG("hu %p woke up", hu);
 816
 817	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 818
 819	qca->ibs_recv_wacks++;
 820
 821	/* Don't react to the wake-up-acknowledgment when suspending. */
 822	if (test_bit(QCA_SUSPENDING, &qca->flags)) {
 823		spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 824		return;
 825	}
 826
 827	switch (qca->tx_ibs_state) {
 828	case HCI_IBS_TX_AWAKE:
 829		/* Expect one if we send 2 WAKEs */
 830		BT_DBG("Received HCI_IBS_WAKE_ACK in tx state %d",
 831		       qca->tx_ibs_state);
 832		break;
 833
 834	case HCI_IBS_TX_WAKING:
 835		/* Send pending packets */
 836		while ((skb = skb_dequeue(&qca->tx_wait_q)))
 837			skb_queue_tail(&qca->txq, skb);
 838
 839		/* Switch timers and change state to HCI_IBS_TX_AWAKE */
 840		del_timer(&qca->wake_retrans_timer);
 841		idle_delay = msecs_to_jiffies(qca->tx_idle_delay);
 842		mod_timer(&qca->tx_idle_timer, jiffies + idle_delay);
 843		qca->tx_ibs_state = HCI_IBS_TX_AWAKE;
 844		break;
 845
 846	case HCI_IBS_TX_ASLEEP:
 847	default:
 848		BT_ERR("Received HCI_IBS_WAKE_ACK in tx state %d",
 849		       qca->tx_ibs_state);
 850		break;
 851	}
 852
 853	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 854
 855	/* Actually send the packets */
 856	hci_uart_tx_wakeup(hu);
 857}
 858
 859/* Enqueue frame for transmittion (padding, crc, etc) may be called from
 860 * two simultaneous tasklets.
 861 */
 862static int qca_enqueue(struct hci_uart *hu, struct sk_buff *skb)
 863{
 864	unsigned long flags = 0, idle_delay;
 865	struct qca_data *qca = hu->priv;
 866
 867	BT_DBG("hu %p qca enq skb %p tx_ibs_state %d", hu, skb,
 868	       qca->tx_ibs_state);
 869
 870	if (test_bit(QCA_SSR_TRIGGERED, &qca->flags)) {
 871		/* As SSR is in progress, ignore the packets */
 872		bt_dev_dbg(hu->hdev, "SSR is in progress");
 873		kfree_skb(skb);
 874		return 0;
 875	}
 876
 877	/* Prepend skb with frame type */
 878	memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
 879
 880	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
 881
 882	/* Don't go to sleep in middle of patch download or
 883	 * Out-Of-Band(GPIOs control) sleep is selected.
 884	 * Don't wake the device up when suspending.
 885	 */
 886	if (test_bit(QCA_IBS_DISABLED, &qca->flags) ||
 887	    test_bit(QCA_SUSPENDING, &qca->flags)) {
 888		skb_queue_tail(&qca->txq, skb);
 889		spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 890		return 0;
 891	}
 892
 893	/* Act according to current state */
 894	switch (qca->tx_ibs_state) {
 895	case HCI_IBS_TX_AWAKE:
 896		BT_DBG("Device awake, sending normally");
 897		skb_queue_tail(&qca->txq, skb);
 898		idle_delay = msecs_to_jiffies(qca->tx_idle_delay);
 899		mod_timer(&qca->tx_idle_timer, jiffies + idle_delay);
 900		break;
 901
 902	case HCI_IBS_TX_ASLEEP:
 903		BT_DBG("Device asleep, waking up and queueing packet");
 904		/* Save packet for later */
 905		skb_queue_tail(&qca->tx_wait_q, skb);
 906
 907		qca->tx_ibs_state = HCI_IBS_TX_WAKING;
 908		/* Schedule a work queue to wake up device */
 909		queue_work(qca->workqueue, &qca->ws_awake_device);
 910		break;
 911
 912	case HCI_IBS_TX_WAKING:
 913		BT_DBG("Device waking up, queueing packet");
 914		/* Transient state; just keep packet for later */
 915		skb_queue_tail(&qca->tx_wait_q, skb);
 916		break;
 917
 918	default:
 919		BT_ERR("Illegal tx state: %d (losing packet)",
 920		       qca->tx_ibs_state);
 921		dev_kfree_skb_irq(skb);
 922		break;
 923	}
 924
 925	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
 926
 927	return 0;
 928}
 929
 930static int qca_ibs_sleep_ind(struct hci_dev *hdev, struct sk_buff *skb)
 931{
 932	struct hci_uart *hu = hci_get_drvdata(hdev);
 933
 934	BT_DBG("hu %p recv hci ibs cmd 0x%x", hu, HCI_IBS_SLEEP_IND);
 935
 936	device_want_to_sleep(hu);
 937
 938	kfree_skb(skb);
 939	return 0;
 940}
 941
 942static int qca_ibs_wake_ind(struct hci_dev *hdev, struct sk_buff *skb)
 943{
 944	struct hci_uart *hu = hci_get_drvdata(hdev);
 945
 946	BT_DBG("hu %p recv hci ibs cmd 0x%x", hu, HCI_IBS_WAKE_IND);
 947
 948	device_want_to_wakeup(hu);
 949
 950	kfree_skb(skb);
 951	return 0;
 952}
 953
 954static int qca_ibs_wake_ack(struct hci_dev *hdev, struct sk_buff *skb)
 955{
 956	struct hci_uart *hu = hci_get_drvdata(hdev);
 957
 958	BT_DBG("hu %p recv hci ibs cmd 0x%x", hu, HCI_IBS_WAKE_ACK);
 959
 960	device_woke_up(hu);
 961
 962	kfree_skb(skb);
 963	return 0;
 964}
 965
 966static int qca_recv_acl_data(struct hci_dev *hdev, struct sk_buff *skb)
 967{
 968	/* We receive debug logs from chip as an ACL packets.
 969	 * Instead of sending the data to ACL to decode the
 970	 * received data, we are pushing them to the above layers
 971	 * as a diagnostic packet.
 972	 */
 973	if (get_unaligned_le16(skb->data) == QCA_DEBUG_HANDLE)
 974		return hci_recv_diag(hdev, skb);
 975
 976	return hci_recv_frame(hdev, skb);
 977}
 978
 979static void qca_controller_memdump(struct work_struct *work)
 980{
 981	struct qca_data *qca = container_of(work, struct qca_data,
 982					    ctrl_memdump_evt);
 983	struct hci_uart *hu = qca->hu;
 984	struct sk_buff *skb;
 985	struct qca_memdump_event_hdr *cmd_hdr;
 986	struct qca_memdump_data *qca_memdump = qca->qca_memdump;
 987	struct qca_dump_size *dump;
 988	char *memdump_buf;
 989	char nullBuff[QCA_DUMP_PACKET_SIZE] = { 0 };
 990	u16 seq_no;
 991	u32 dump_size;
 992	u32 rx_size;
 993	enum qca_btsoc_type soc_type = qca_soc_type(hu);
 994
 995	while ((skb = skb_dequeue(&qca->rx_memdump_q))) {
 996
 997		mutex_lock(&qca->hci_memdump_lock);
 998		/* Skip processing the received packets if timeout detected
 999		 * or memdump collection completed.
1000		 */
1001		if (qca->memdump_state == QCA_MEMDUMP_TIMEOUT ||
1002		    qca->memdump_state == QCA_MEMDUMP_COLLECTED) {
1003			mutex_unlock(&qca->hci_memdump_lock);
1004			return;
1005		}
1006
1007		if (!qca_memdump) {
1008			qca_memdump = kzalloc(sizeof(struct qca_memdump_data),
1009					      GFP_ATOMIC);
1010			if (!qca_memdump) {
1011				mutex_unlock(&qca->hci_memdump_lock);
1012				return;
1013			}
1014
1015			qca->qca_memdump = qca_memdump;
1016		}
1017
1018		qca->memdump_state = QCA_MEMDUMP_COLLECTING;
1019		cmd_hdr = (void *) skb->data;
1020		seq_no = __le16_to_cpu(cmd_hdr->seq_no);
1021		skb_pull(skb, sizeof(struct qca_memdump_event_hdr));
1022
1023		if (!seq_no) {
1024
1025			/* This is the first frame of memdump packet from
1026			 * the controller, Disable IBS to recevie dump
1027			 * with out any interruption, ideally time required for
1028			 * the controller to send the dump is 8 seconds. let us
1029			 * start timer to handle this asynchronous activity.
1030			 */
1031			set_bit(QCA_IBS_DISABLED, &qca->flags);
1032			set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1033			dump = (void *) skb->data;
1034			dump_size = __le32_to_cpu(dump->dump_size);
1035			if (!(dump_size)) {
1036				bt_dev_err(hu->hdev, "Rx invalid memdump size");
1037				kfree(qca_memdump);
1038				kfree_skb(skb);
1039				qca->qca_memdump = NULL;
1040				mutex_unlock(&qca->hci_memdump_lock);
1041				return;
1042			}
1043
1044			bt_dev_info(hu->hdev, "QCA collecting dump of size:%u",
1045				    dump_size);
1046			queue_delayed_work(qca->workqueue,
1047					   &qca->ctrl_memdump_timeout,
1048					   msecs_to_jiffies(MEMDUMP_TIMEOUT_MS)
1049					  );
1050
1051			skb_pull(skb, sizeof(dump_size));
1052			memdump_buf = vmalloc(dump_size);
1053			qca_memdump->ram_dump_size = dump_size;
1054			qca_memdump->memdump_buf_head = memdump_buf;
1055			qca_memdump->memdump_buf_tail = memdump_buf;
1056		}
1057
1058		memdump_buf = qca_memdump->memdump_buf_tail;
1059
1060		/* If sequence no 0 is missed then there is no point in
1061		 * accepting the other sequences.
1062		 */
1063		if (!memdump_buf) {
1064			bt_dev_err(hu->hdev, "QCA: Discarding other packets");
1065			kfree(qca_memdump);
1066			kfree_skb(skb);
1067			qca->qca_memdump = NULL;
1068			mutex_unlock(&qca->hci_memdump_lock);
1069			return;
1070		}
1071
1072		/* There could be chance of missing some packets from
1073		 * the controller. In such cases let us store the dummy
1074		 * packets in the buffer.
1075		 */
1076		/* For QCA6390, controller does not lost packets but
1077		 * sequence number field of packet sometimes has error
1078		 * bits, so skip this checking for missing packet.
1079		 */
1080		while ((seq_no > qca_memdump->current_seq_no + 1) &&
1081		       (soc_type != QCA_QCA6390) &&
1082		       seq_no != QCA_LAST_SEQUENCE_NUM) {
1083			bt_dev_err(hu->hdev, "QCA controller missed packet:%d",
1084				   qca_memdump->current_seq_no);
1085			rx_size = qca_memdump->received_dump;
1086			rx_size += QCA_DUMP_PACKET_SIZE;
1087			if (rx_size > qca_memdump->ram_dump_size) {
1088				bt_dev_err(hu->hdev,
1089					   "QCA memdump received %d, no space for missed packet",
1090					   qca_memdump->received_dump);
1091				break;
1092			}
1093			memcpy(memdump_buf, nullBuff, QCA_DUMP_PACKET_SIZE);
1094			memdump_buf = memdump_buf + QCA_DUMP_PACKET_SIZE;
1095			qca_memdump->received_dump += QCA_DUMP_PACKET_SIZE;
1096			qca_memdump->current_seq_no++;
1097		}
1098
1099		rx_size = qca_memdump->received_dump + skb->len;
1100		if (rx_size <= qca_memdump->ram_dump_size) {
1101			if ((seq_no != QCA_LAST_SEQUENCE_NUM) &&
1102			    (seq_no != qca_memdump->current_seq_no))
1103				bt_dev_err(hu->hdev,
1104					   "QCA memdump unexpected packet %d",
1105					   seq_no);
1106			bt_dev_dbg(hu->hdev,
1107				   "QCA memdump packet %d with length %d",
1108				   seq_no, skb->len);
1109			memcpy(memdump_buf, (unsigned char *)skb->data,
1110			       skb->len);
1111			memdump_buf = memdump_buf + skb->len;
1112			qca_memdump->memdump_buf_tail = memdump_buf;
1113			qca_memdump->current_seq_no = seq_no + 1;
1114			qca_memdump->received_dump += skb->len;
1115		} else {
1116			bt_dev_err(hu->hdev,
1117				   "QCA memdump received %d, no space for packet %d",
1118				   qca_memdump->received_dump, seq_no);
1119		}
1120		qca->qca_memdump = qca_memdump;
1121		kfree_skb(skb);
1122		if (seq_no == QCA_LAST_SEQUENCE_NUM) {
1123			bt_dev_info(hu->hdev,
1124				    "QCA memdump Done, received %d, total %d",
1125				    qca_memdump->received_dump,
1126				    qca_memdump->ram_dump_size);
1127			memdump_buf = qca_memdump->memdump_buf_head;
1128			dev_coredumpv(&hu->serdev->dev, memdump_buf,
1129				      qca_memdump->received_dump, GFP_KERNEL);
1130			cancel_delayed_work(&qca->ctrl_memdump_timeout);
1131			kfree(qca->qca_memdump);
1132			qca->qca_memdump = NULL;
1133			qca->memdump_state = QCA_MEMDUMP_COLLECTED;
1134			clear_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1135		}
1136
1137		mutex_unlock(&qca->hci_memdump_lock);
1138	}
1139
1140}
1141
1142static int qca_controller_memdump_event(struct hci_dev *hdev,
1143					struct sk_buff *skb)
1144{
1145	struct hci_uart *hu = hci_get_drvdata(hdev);
1146	struct qca_data *qca = hu->priv;
1147
1148	set_bit(QCA_SSR_TRIGGERED, &qca->flags);
1149	skb_queue_tail(&qca->rx_memdump_q, skb);
1150	queue_work(qca->workqueue, &qca->ctrl_memdump_evt);
1151
1152	return 0;
1153}
1154
1155static int qca_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
1156{
1157	struct hci_uart *hu = hci_get_drvdata(hdev);
1158	struct qca_data *qca = hu->priv;
1159
1160	if (test_bit(QCA_DROP_VENDOR_EVENT, &qca->flags)) {
1161		struct hci_event_hdr *hdr = (void *)skb->data;
1162
1163		/* For the WCN3990 the vendor command for a baudrate change
1164		 * isn't sent as synchronous HCI command, because the
1165		 * controller sends the corresponding vendor event with the
1166		 * new baudrate. The event is received and properly decoded
1167		 * after changing the baudrate of the host port. It needs to
1168		 * be dropped, otherwise it can be misinterpreted as
1169		 * response to a later firmware download command (also a
1170		 * vendor command).
1171		 */
1172
1173		if (hdr->evt == HCI_EV_VENDOR)
1174			complete(&qca->drop_ev_comp);
1175
1176		kfree_skb(skb);
1177
1178		return 0;
1179	}
1180	/* We receive chip memory dump as an event packet, With a dedicated
1181	 * handler followed by a hardware error event. When this event is
1182	 * received we store dump into a file before closing hci. This
1183	 * dump will help in triaging the issues.
1184	 */
1185	if ((skb->data[0] == HCI_VENDOR_PKT) &&
1186	    (get_unaligned_be16(skb->data + 2) == QCA_SSR_DUMP_HANDLE))
1187		return qca_controller_memdump_event(hdev, skb);
1188
1189	return hci_recv_frame(hdev, skb);
1190}
1191
1192#define QCA_IBS_SLEEP_IND_EVENT \
1193	.type = HCI_IBS_SLEEP_IND, \
1194	.hlen = 0, \
1195	.loff = 0, \
1196	.lsize = 0, \
1197	.maxlen = HCI_MAX_IBS_SIZE
1198
1199#define QCA_IBS_WAKE_IND_EVENT \
1200	.type = HCI_IBS_WAKE_IND, \
1201	.hlen = 0, \
1202	.loff = 0, \
1203	.lsize = 0, \
1204	.maxlen = HCI_MAX_IBS_SIZE
1205
1206#define QCA_IBS_WAKE_ACK_EVENT \
1207	.type = HCI_IBS_WAKE_ACK, \
1208	.hlen = 0, \
1209	.loff = 0, \
1210	.lsize = 0, \
1211	.maxlen = HCI_MAX_IBS_SIZE
1212
1213static const struct h4_recv_pkt qca_recv_pkts[] = {
1214	{ H4_RECV_ACL,             .recv = qca_recv_acl_data },
1215	{ H4_RECV_SCO,             .recv = hci_recv_frame    },
1216	{ H4_RECV_EVENT,           .recv = qca_recv_event    },
1217	{ QCA_IBS_WAKE_IND_EVENT,  .recv = qca_ibs_wake_ind  },
1218	{ QCA_IBS_WAKE_ACK_EVENT,  .recv = qca_ibs_wake_ack  },
1219	{ QCA_IBS_SLEEP_IND_EVENT, .recv = qca_ibs_sleep_ind },
1220};
1221
1222static int qca_recv(struct hci_uart *hu, const void *data, int count)
1223{
1224	struct qca_data *qca = hu->priv;
1225
1226	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
1227		return -EUNATCH;
1228
1229	qca->rx_skb = h4_recv_buf(hu->hdev, qca->rx_skb, data, count,
1230				  qca_recv_pkts, ARRAY_SIZE(qca_recv_pkts));
1231	if (IS_ERR(qca->rx_skb)) {
1232		int err = PTR_ERR(qca->rx_skb);
1233		bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err);
1234		qca->rx_skb = NULL;
1235		return err;
1236	}
1237
1238	return count;
1239}
1240
1241static struct sk_buff *qca_dequeue(struct hci_uart *hu)
1242{
1243	struct qca_data *qca = hu->priv;
1244
1245	return skb_dequeue(&qca->txq);
1246}
1247
1248static uint8_t qca_get_baudrate_value(int speed)
1249{
1250	switch (speed) {
1251	case 9600:
1252		return QCA_BAUDRATE_9600;
1253	case 19200:
1254		return QCA_BAUDRATE_19200;
1255	case 38400:
1256		return QCA_BAUDRATE_38400;
1257	case 57600:
1258		return QCA_BAUDRATE_57600;
1259	case 115200:
1260		return QCA_BAUDRATE_115200;
1261	case 230400:
1262		return QCA_BAUDRATE_230400;
1263	case 460800:
1264		return QCA_BAUDRATE_460800;
1265	case 500000:
1266		return QCA_BAUDRATE_500000;
1267	case 921600:
1268		return QCA_BAUDRATE_921600;
1269	case 1000000:
1270		return QCA_BAUDRATE_1000000;
1271	case 2000000:
1272		return QCA_BAUDRATE_2000000;
1273	case 3000000:
1274		return QCA_BAUDRATE_3000000;
1275	case 3200000:
1276		return QCA_BAUDRATE_3200000;
1277	case 3500000:
1278		return QCA_BAUDRATE_3500000;
1279	default:
1280		return QCA_BAUDRATE_115200;
1281	}
1282}
1283
1284static int qca_set_baudrate(struct hci_dev *hdev, uint8_t baudrate)
1285{
1286	struct hci_uart *hu = hci_get_drvdata(hdev);
1287	struct qca_data *qca = hu->priv;
1288	struct sk_buff *skb;
1289	u8 cmd[] = { 0x01, 0x48, 0xFC, 0x01, 0x00 };
1290
1291	if (baudrate > QCA_BAUDRATE_3200000)
1292		return -EINVAL;
1293
1294	cmd[4] = baudrate;
1295
1296	skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
1297	if (!skb) {
1298		bt_dev_err(hdev, "Failed to allocate baudrate packet");
1299		return -ENOMEM;
1300	}
1301
1302	/* Assign commands to change baudrate and packet type. */
1303	skb_put_data(skb, cmd, sizeof(cmd));
1304	hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
1305
1306	skb_queue_tail(&qca->txq, skb);
1307	hci_uart_tx_wakeup(hu);
1308
1309	/* Wait for the baudrate change request to be sent */
1310
1311	while (!skb_queue_empty(&qca->txq))
1312		usleep_range(100, 200);
1313
1314	if (hu->serdev)
1315		serdev_device_wait_until_sent(hu->serdev,
1316		      msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS));
1317
1318	/* Give the controller time to process the request */
1319	if (qca_is_wcn399x(qca_soc_type(hu)) ||
1320	    qca_is_wcn6750(qca_soc_type(hu)))
1321		usleep_range(1000, 10000);
1322	else
1323		msleep(300);
1324
1325	return 0;
1326}
1327
1328static inline void host_set_baudrate(struct hci_uart *hu, unsigned int speed)
1329{
1330	if (hu->serdev)
1331		serdev_device_set_baudrate(hu->serdev, speed);
1332	else
1333		hci_uart_set_baudrate(hu, speed);
1334}
1335
1336static int qca_send_power_pulse(struct hci_uart *hu, bool on)
1337{
1338	int ret;
1339	int timeout = msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS);
1340	u8 cmd = on ? QCA_WCN3990_POWERON_PULSE : QCA_WCN3990_POWEROFF_PULSE;
1341
1342	/* These power pulses are single byte command which are sent
1343	 * at required baudrate to wcn3990. On wcn3990, we have an external
1344	 * circuit at Tx pin which decodes the pulse sent at specific baudrate.
1345	 * For example, wcn3990 supports RF COEX antenna for both Wi-Fi/BT
1346	 * and also we use the same power inputs to turn on and off for
1347	 * Wi-Fi/BT. Powering up the power sources will not enable BT, until
1348	 * we send a power on pulse at 115200 bps. This algorithm will help to
1349	 * save power. Disabling hardware flow control is mandatory while
1350	 * sending power pulses to SoC.
1351	 */
1352	bt_dev_dbg(hu->hdev, "sending power pulse %02x to controller", cmd);
1353
1354	serdev_device_write_flush(hu->serdev);
1355	hci_uart_set_flow_control(hu, true);
1356	ret = serdev_device_write_buf(hu->serdev, &cmd, sizeof(cmd));
1357	if (ret < 0) {
1358		bt_dev_err(hu->hdev, "failed to send power pulse %02x", cmd);
1359		return ret;
1360	}
1361
1362	serdev_device_wait_until_sent(hu->serdev, timeout);
1363	hci_uart_set_flow_control(hu, false);
1364
1365	/* Give to controller time to boot/shutdown */
1366	if (on)
1367		msleep(100);
1368	else
1369		usleep_range(1000, 10000);
1370
1371	return 0;
1372}
1373
1374static unsigned int qca_get_speed(struct hci_uart *hu,
1375				  enum qca_speed_type speed_type)
1376{
1377	unsigned int speed = 0;
1378
1379	if (speed_type == QCA_INIT_SPEED) {
1380		if (hu->init_speed)
1381			speed = hu->init_speed;
1382		else if (hu->proto->init_speed)
1383			speed = hu->proto->init_speed;
1384	} else {
1385		if (hu->oper_speed)
1386			speed = hu->oper_speed;
1387		else if (hu->proto->oper_speed)
1388			speed = hu->proto->oper_speed;
1389	}
1390
1391	return speed;
1392}
1393
1394static int qca_check_speeds(struct hci_uart *hu)
1395{
1396	if (qca_is_wcn399x(qca_soc_type(hu)) ||
1397	    qca_is_wcn6750(qca_soc_type(hu))) {
1398		if (!qca_get_speed(hu, QCA_INIT_SPEED) &&
1399		    !qca_get_speed(hu, QCA_OPER_SPEED))
1400			return -EINVAL;
1401	} else {
1402		if (!qca_get_speed(hu, QCA_INIT_SPEED) ||
1403		    !qca_get_speed(hu, QCA_OPER_SPEED))
1404			return -EINVAL;
1405	}
1406
1407	return 0;
1408}
1409
1410static int qca_set_speed(struct hci_uart *hu, enum qca_speed_type speed_type)
1411{
1412	unsigned int speed, qca_baudrate;
1413	struct qca_data *qca = hu->priv;
1414	int ret = 0;
1415
1416	if (speed_type == QCA_INIT_SPEED) {
1417		speed = qca_get_speed(hu, QCA_INIT_SPEED);
1418		if (speed)
1419			host_set_baudrate(hu, speed);
1420	} else {
1421		enum qca_btsoc_type soc_type = qca_soc_type(hu);
1422
1423		speed = qca_get_speed(hu, QCA_OPER_SPEED);
1424		if (!speed)
1425			return 0;
1426
1427		/* Disable flow control for wcn3990 to deassert RTS while
1428		 * changing the baudrate of chip and host.
1429		 */
1430		if (qca_is_wcn399x(soc_type) ||
1431		    qca_is_wcn6750(soc_type))
1432			hci_uart_set_flow_control(hu, true);
1433
1434		if (soc_type == QCA_WCN3990) {
1435			reinit_completion(&qca->drop_ev_comp);
1436			set_bit(QCA_DROP_VENDOR_EVENT, &qca->flags);
1437		}
1438
1439		qca_baudrate = qca_get_baudrate_value(speed);
1440		bt_dev_dbg(hu->hdev, "Set UART speed to %d", speed);
1441		ret = qca_set_baudrate(hu->hdev, qca_baudrate);
1442		if (ret)
1443			goto error;
1444
1445		host_set_baudrate(hu, speed);
1446
1447error:
1448		if (qca_is_wcn399x(soc_type) ||
1449		    qca_is_wcn6750(soc_type))
1450			hci_uart_set_flow_control(hu, false);
1451
1452		if (soc_type == QCA_WCN3990) {
1453			/* Wait for the controller to send the vendor event
1454			 * for the baudrate change command.
1455			 */
1456			if (!wait_for_completion_timeout(&qca->drop_ev_comp,
1457						 msecs_to_jiffies(100))) {
1458				bt_dev_err(hu->hdev,
1459					   "Failed to change controller baudrate\n");
1460				ret = -ETIMEDOUT;
1461			}
1462
1463			clear_bit(QCA_DROP_VENDOR_EVENT, &qca->flags);
1464		}
1465	}
1466
1467	return ret;
1468}
1469
1470static int qca_send_crashbuffer(struct hci_uart *hu)
1471{
1472	struct qca_data *qca = hu->priv;
1473	struct sk_buff *skb;
1474
1475	skb = bt_skb_alloc(QCA_CRASHBYTE_PACKET_LEN, GFP_KERNEL);
1476	if (!skb) {
1477		bt_dev_err(hu->hdev, "Failed to allocate memory for skb packet");
1478		return -ENOMEM;
1479	}
1480
1481	/* We forcefully crash the controller, by sending 0xfb byte for
1482	 * 1024 times. We also might have chance of losing data, To be
1483	 * on safer side we send 1096 bytes to the SoC.
1484	 */
1485	memset(skb_put(skb, QCA_CRASHBYTE_PACKET_LEN), QCA_MEMDUMP_BYTE,
1486	       QCA_CRASHBYTE_PACKET_LEN);
1487	hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
1488	bt_dev_info(hu->hdev, "crash the soc to collect controller dump");
1489	skb_queue_tail(&qca->txq, skb);
1490	hci_uart_tx_wakeup(hu);
1491
1492	return 0;
1493}
1494
1495static void qca_wait_for_dump_collection(struct hci_dev *hdev)
1496{
1497	struct hci_uart *hu = hci_get_drvdata(hdev);
1498	struct qca_data *qca = hu->priv;
1499
1500	wait_on_bit_timeout(&qca->flags, QCA_MEMDUMP_COLLECTION,
1501			    TASK_UNINTERRUPTIBLE, MEMDUMP_TIMEOUT_MS);
1502
1503	clear_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1504}
1505
1506static void qca_hw_error(struct hci_dev *hdev, u8 code)
1507{
1508	struct hci_uart *hu = hci_get_drvdata(hdev);
1509	struct qca_data *qca = hu->priv;
1510
1511	set_bit(QCA_SSR_TRIGGERED, &qca->flags);
1512	set_bit(QCA_HW_ERROR_EVENT, &qca->flags);
1513	bt_dev_info(hdev, "mem_dump_status: %d", qca->memdump_state);
1514
1515	if (qca->memdump_state == QCA_MEMDUMP_IDLE) {
1516		/* If hardware error event received for other than QCA
1517		 * soc memory dump event, then we need to crash the SOC
1518		 * and wait here for 8 seconds to get the dump packets.
1519		 * This will block main thread to be on hold until we
1520		 * collect dump.
1521		 */
1522		set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1523		qca_send_crashbuffer(hu);
1524		qca_wait_for_dump_collection(hdev);
1525	} else if (qca->memdump_state == QCA_MEMDUMP_COLLECTING) {
1526		/* Let us wait here until memory dump collected or
1527		 * memory dump timer expired.
1528		 */
1529		bt_dev_info(hdev, "waiting for dump to complete");
1530		qca_wait_for_dump_collection(hdev);
1531	}
1532
1533	mutex_lock(&qca->hci_memdump_lock);
1534	if (qca->memdump_state != QCA_MEMDUMP_COLLECTED) {
1535		bt_dev_err(hu->hdev, "clearing allocated memory due to memdump timeout");
1536		if (qca->qca_memdump) {
1537			vfree(qca->qca_memdump->memdump_buf_head);
1538			kfree(qca->qca_memdump);
1539			qca->qca_memdump = NULL;
1540		}
1541		qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
1542		cancel_delayed_work(&qca->ctrl_memdump_timeout);
1543	}
1544	mutex_unlock(&qca->hci_memdump_lock);
1545
1546	if (qca->memdump_state == QCA_MEMDUMP_TIMEOUT ||
1547	    qca->memdump_state == QCA_MEMDUMP_COLLECTED) {
1548		cancel_work_sync(&qca->ctrl_memdump_evt);
1549		skb_queue_purge(&qca->rx_memdump_q);
1550	}
1551
1552	clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
1553}
1554
1555static void qca_cmd_timeout(struct hci_dev *hdev)
1556{
1557	struct hci_uart *hu = hci_get_drvdata(hdev);
1558	struct qca_data *qca = hu->priv;
1559
1560	set_bit(QCA_SSR_TRIGGERED, &qca->flags);
1561	if (qca->memdump_state == QCA_MEMDUMP_IDLE) {
1562		set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1563		qca_send_crashbuffer(hu);
1564		qca_wait_for_dump_collection(hdev);
1565	} else if (qca->memdump_state == QCA_MEMDUMP_COLLECTING) {
1566		/* Let us wait here until memory dump collected or
1567		 * memory dump timer expired.
1568		 */
1569		bt_dev_info(hdev, "waiting for dump to complete");
1570		qca_wait_for_dump_collection(hdev);
1571	}
1572
1573	mutex_lock(&qca->hci_memdump_lock);
1574	if (qca->memdump_state != QCA_MEMDUMP_COLLECTED) {
1575		qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
1576		if (!test_bit(QCA_HW_ERROR_EVENT, &qca->flags)) {
1577			/* Inject hw error event to reset the device
1578			 * and driver.
1579			 */
1580			hci_reset_dev(hu->hdev);
1581		}
1582	}
1583	mutex_unlock(&qca->hci_memdump_lock);
1584}
1585
1586static bool qca_wakeup(struct hci_dev *hdev)
1587{
1588	struct hci_uart *hu = hci_get_drvdata(hdev);
1589	bool wakeup;
1590
1591	/* UART driver handles the interrupt from BT SoC.So we need to use
1592	 * device handle of UART driver to get the status of device may wakeup.
1593	 */
1594	wakeup = device_may_wakeup(hu->serdev->ctrl->dev.parent);
1595	bt_dev_dbg(hu->hdev, "wakeup status : %d", wakeup);
1596
1597	return wakeup;
1598}
1599
1600static int qca_regulator_init(struct hci_uart *hu)
1601{
1602	enum qca_btsoc_type soc_type = qca_soc_type(hu);
1603	struct qca_serdev *qcadev;
1604	int ret;
1605	bool sw_ctrl_state;
1606
1607	/* Check for vregs status, may be hci down has turned
1608	 * off the voltage regulator.
1609	 */
1610	qcadev = serdev_device_get_drvdata(hu->serdev);
1611	if (!qcadev->bt_power->vregs_on) {
1612		serdev_device_close(hu->serdev);
1613		ret = qca_regulator_enable(qcadev);
1614		if (ret)
1615			return ret;
1616
1617		ret = serdev_device_open(hu->serdev);
1618		if (ret) {
1619			bt_dev_err(hu->hdev, "failed to open port");
1620			return ret;
1621		}
1622	}
1623
1624	if (qca_is_wcn399x(soc_type)) {
1625		/* Forcefully enable wcn399x to enter in to boot mode. */
1626		host_set_baudrate(hu, 2400);
1627		ret = qca_send_power_pulse(hu, false);
1628		if (ret)
1629			return ret;
1630	}
1631
1632	/* For wcn6750 need to enable gpio bt_en */
1633	if (qcadev->bt_en) {
1634		gpiod_set_value_cansleep(qcadev->bt_en, 0);
1635		msleep(50);
1636		gpiod_set_value_cansleep(qcadev->bt_en, 1);
1637		msleep(50);
1638		if (qcadev->sw_ctrl) {
1639			sw_ctrl_state = gpiod_get_value_cansleep(qcadev->sw_ctrl);
1640			bt_dev_dbg(hu->hdev, "SW_CTRL is %d", sw_ctrl_state);
1641		}
1642	}
1643
1644	qca_set_speed(hu, QCA_INIT_SPEED);
1645
1646	if (qca_is_wcn399x(soc_type)) {
1647		ret = qca_send_power_pulse(hu, true);
1648		if (ret)
1649			return ret;
1650	}
1651
1652	/* Now the device is in ready state to communicate with host.
1653	 * To sync host with device we need to reopen port.
1654	 * Without this, we will have RTS and CTS synchronization
1655	 * issues.
1656	 */
1657	serdev_device_close(hu->serdev);
1658	ret = serdev_device_open(hu->serdev);
1659	if (ret) {
1660		bt_dev_err(hu->hdev, "failed to open port");
1661		return ret;
1662	}
1663
1664	hci_uart_set_flow_control(hu, false);
1665
1666	return 0;
1667}
1668
1669static int qca_power_on(struct hci_dev *hdev)
1670{
1671	struct hci_uart *hu = hci_get_drvdata(hdev);
1672	enum qca_btsoc_type soc_type = qca_soc_type(hu);
1673	struct qca_serdev *qcadev;
1674	struct qca_data *qca = hu->priv;
1675	int ret = 0;
1676
1677	/* Non-serdev device usually is powered by external power
1678	 * and don't need additional action in driver for power on
1679	 */
1680	if (!hu->serdev)
1681		return 0;
1682
1683	if (qca_is_wcn399x(soc_type) ||
1684	    qca_is_wcn6750(soc_type)) {
1685		ret = qca_regulator_init(hu);
1686	} else {
1687		qcadev = serdev_device_get_drvdata(hu->serdev);
1688		if (qcadev->bt_en) {
1689			gpiod_set_value_cansleep(qcadev->bt_en, 1);
1690			/* Controller needs time to bootup. */
1691			msleep(150);
1692		}
1693	}
1694
1695	clear_bit(QCA_BT_OFF, &qca->flags);
1696	return ret;
1697}
1698
1699static int qca_setup(struct hci_uart *hu)
1700{
1701	struct hci_dev *hdev = hu->hdev;
1702	struct qca_data *qca = hu->priv;
1703	unsigned int speed, qca_baudrate = QCA_BAUDRATE_115200;
1704	unsigned int retries = 0;
1705	enum qca_btsoc_type soc_type = qca_soc_type(hu);
1706	const char *firmware_name = qca_get_firmware_name(hu);
1707	int ret;
1708	struct qca_btsoc_version ver;
1709
1710	ret = qca_check_speeds(hu);
1711	if (ret)
1712		return ret;
1713
1714	clear_bit(QCA_ROM_FW, &qca->flags);
1715	/* Patch downloading has to be done without IBS mode */
1716	set_bit(QCA_IBS_DISABLED, &qca->flags);
1717
1718	/* Enable controller to do both LE scan and BR/EDR inquiry
1719	 * simultaneously.
1720	 */
1721	set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
1722
1723	bt_dev_info(hdev, "setting up %s",
1724		qca_is_wcn399x(soc_type) ? "wcn399x" :
1725		(soc_type == QCA_WCN6750) ? "wcn6750" : "ROME/QCA6390");
1726
1727	qca->memdump_state = QCA_MEMDUMP_IDLE;
1728
1729retry:
1730	ret = qca_power_on(hdev);
1731	if (ret)
1732		goto out;
1733
1734	clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
1735
1736	if (qca_is_wcn399x(soc_type) ||
1737	    qca_is_wcn6750(soc_type)) {
1738		set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
1739		hci_set_aosp_capable(hdev);
1740
1741		ret = qca_read_soc_version(hdev, &ver, soc_type);
1742		if (ret)
1743			goto out;
1744	} else {
1745		qca_set_speed(hu, QCA_INIT_SPEED);
1746	}
1747
1748	/* Setup user speed if needed */
1749	speed = qca_get_speed(hu, QCA_OPER_SPEED);
1750	if (speed) {
1751		ret = qca_set_speed(hu, QCA_OPER_SPEED);
1752		if (ret)
1753			goto out;
1754
1755		qca_baudrate = qca_get_baudrate_value(speed);
1756	}
1757
1758	if (!(qca_is_wcn399x(soc_type) ||
1759	     qca_is_wcn6750(soc_type))) {
1760		/* Get QCA version information */
1761		ret = qca_read_soc_version(hdev, &ver, soc_type);
1762		if (ret)
1763			goto out;
1764	}
1765
 
1766	/* Setup patch / NVM configurations */
1767	ret = qca_uart_setup(hdev, qca_baudrate, soc_type, ver,
1768			firmware_name);
1769	if (!ret) {
1770		clear_bit(QCA_IBS_DISABLED, &qca->flags);
1771		qca_debugfs_init(hdev);
1772		hu->hdev->hw_error = qca_hw_error;
1773		hu->hdev->cmd_timeout = qca_cmd_timeout;
1774		if (device_can_wakeup(hu->serdev->ctrl->dev.parent))
1775			hu->hdev->wakeup = qca_wakeup;
1776	} else if (ret == -ENOENT) {
1777		/* No patch/nvm-config found, run with original fw/config */
1778		set_bit(QCA_ROM_FW, &qca->flags);
1779		ret = 0;
1780	} else if (ret == -EAGAIN) {
1781		/*
1782		 * Userspace firmware loader will return -EAGAIN in case no
1783		 * patch/nvm-config is found, so run with original fw/config.
1784		 */
1785		set_bit(QCA_ROM_FW, &qca->flags);
1786		ret = 0;
1787	}
1788
1789out:
1790	if (ret && retries < MAX_INIT_RETRIES) {
1791		bt_dev_warn(hdev, "Retry BT power ON:%d", retries);
1792		qca_power_shutdown(hu);
1793		if (hu->serdev) {
1794			serdev_device_close(hu->serdev);
1795			ret = serdev_device_open(hu->serdev);
1796			if (ret) {
1797				bt_dev_err(hdev, "failed to open port");
1798				return ret;
1799			}
 
 
1800		}
1801		retries++;
1802		goto retry;
1803	}
1804
1805	/* Setup bdaddr */
1806	if (soc_type == QCA_ROME)
1807		hu->hdev->set_bdaddr = qca_set_bdaddr_rome;
1808	else
1809		hu->hdev->set_bdaddr = qca_set_bdaddr;
1810
1811	return ret;
1812}
1813
1814static const struct hci_uart_proto qca_proto = {
1815	.id		= HCI_UART_QCA,
1816	.name		= "QCA",
1817	.manufacturer	= 29,
1818	.init_speed	= 115200,
1819	.oper_speed	= 3000000,
1820	.open		= qca_open,
1821	.close		= qca_close,
1822	.flush		= qca_flush,
1823	.setup		= qca_setup,
1824	.recv		= qca_recv,
1825	.enqueue	= qca_enqueue,
1826	.dequeue	= qca_dequeue,
1827};
1828
1829static const struct qca_device_data qca_soc_data_wcn3990 = {
1830	.soc_type = QCA_WCN3990,
1831	.vregs = (struct qca_vreg []) {
1832		{ "vddio", 15000  },
1833		{ "vddxo", 80000  },
1834		{ "vddrf", 300000 },
1835		{ "vddch0", 450000 },
1836	},
1837	.num_vregs = 4,
1838};
1839
1840static const struct qca_device_data qca_soc_data_wcn3991 = {
1841	.soc_type = QCA_WCN3991,
1842	.vregs = (struct qca_vreg []) {
1843		{ "vddio", 15000  },
1844		{ "vddxo", 80000  },
1845		{ "vddrf", 300000 },
1846		{ "vddch0", 450000 },
1847	},
1848	.num_vregs = 4,
1849	.capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES,
1850};
1851
1852static const struct qca_device_data qca_soc_data_wcn3998 = {
1853	.soc_type = QCA_WCN3998,
1854	.vregs = (struct qca_vreg []) {
1855		{ "vddio", 10000  },
1856		{ "vddxo", 80000  },
1857		{ "vddrf", 300000 },
1858		{ "vddch0", 450000 },
1859	},
1860	.num_vregs = 4,
1861};
1862
1863static const struct qca_device_data qca_soc_data_qca6390 = {
1864	.soc_type = QCA_QCA6390,
1865	.num_vregs = 0,
1866};
1867
1868static const struct qca_device_data qca_soc_data_wcn6750 = {
1869	.soc_type = QCA_WCN6750,
1870	.vregs = (struct qca_vreg []) {
1871		{ "vddio", 5000 },
1872		{ "vddaon", 26000 },
1873		{ "vddbtcxmx", 126000 },
1874		{ "vddrfacmn", 12500 },
1875		{ "vddrfa0p8", 102000 },
1876		{ "vddrfa1p7", 302000 },
1877		{ "vddrfa1p2", 257000 },
1878		{ "vddrfa2p2", 1700000 },
1879		{ "vddasd", 200 },
1880	},
1881	.num_vregs = 9,
1882	.capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES,
1883};
1884
1885static void qca_power_shutdown(struct hci_uart *hu)
1886{
1887	struct qca_serdev *qcadev;
1888	struct qca_data *qca = hu->priv;
1889	unsigned long flags;
1890	enum qca_btsoc_type soc_type = qca_soc_type(hu);
1891	bool sw_ctrl_state;
 
1892
1893	/* From this point we go into power off state. But serial port is
1894	 * still open, stop queueing the IBS data and flush all the buffered
1895	 * data in skb's.
1896	 */
1897	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
1898	set_bit(QCA_IBS_DISABLED, &qca->flags);
1899	qca_flush(hu);
1900	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
1901
1902	/* Non-serdev device usually is powered by external power
1903	 * and don't need additional action in driver for power down
1904	 */
1905	if (!hu->serdev)
1906		return;
1907
1908	qcadev = serdev_device_get_drvdata(hu->serdev);
1909
1910	if (qca_is_wcn399x(soc_type)) {
1911		host_set_baudrate(hu, 2400);
1912		qca_send_power_pulse(hu, false);
1913		qca_regulator_disable(qcadev);
1914	} else if (soc_type == QCA_WCN6750) {
1915		gpiod_set_value_cansleep(qcadev->bt_en, 0);
1916		msleep(100);
1917		qca_regulator_disable(qcadev);
1918		if (qcadev->sw_ctrl) {
1919			sw_ctrl_state = gpiod_get_value_cansleep(qcadev->sw_ctrl);
1920			bt_dev_dbg(hu->hdev, "SW_CTRL is %d", sw_ctrl_state);
1921		}
1922	} else if (qcadev->bt_en) {
1923		gpiod_set_value_cansleep(qcadev->bt_en, 0);
1924	}
1925
1926	set_bit(QCA_BT_OFF, &qca->flags);
1927}
1928
1929static int qca_power_off(struct hci_dev *hdev)
1930{
1931	struct hci_uart *hu = hci_get_drvdata(hdev);
1932	struct qca_data *qca = hu->priv;
1933	enum qca_btsoc_type soc_type = qca_soc_type(hu);
1934
1935	hu->hdev->hw_error = NULL;
1936	hu->hdev->cmd_timeout = NULL;
1937
1938	del_timer_sync(&qca->wake_retrans_timer);
1939	del_timer_sync(&qca->tx_idle_timer);
1940
1941	/* Stop sending shutdown command if soc crashes. */
1942	if (soc_type != QCA_ROME
1943		&& qca->memdump_state == QCA_MEMDUMP_IDLE) {
1944		qca_send_pre_shutdown_cmd(hdev);
1945		usleep_range(8000, 10000);
1946	}
1947
1948	qca_power_shutdown(hu);
1949	return 0;
1950}
1951
1952static int qca_regulator_enable(struct qca_serdev *qcadev)
1953{
1954	struct qca_power *power = qcadev->bt_power;
1955	int ret;
1956
1957	/* Already enabled */
1958	if (power->vregs_on)
1959		return 0;
1960
1961	BT_DBG("enabling %d regulators)", power->num_vregs);
1962
1963	ret = regulator_bulk_enable(power->num_vregs, power->vreg_bulk);
1964	if (ret)
1965		return ret;
1966
1967	power->vregs_on = true;
1968
1969	ret = clk_prepare_enable(qcadev->susclk);
1970	if (ret)
1971		qca_regulator_disable(qcadev);
1972
1973	return ret;
1974}
1975
1976static void qca_regulator_disable(struct qca_serdev *qcadev)
1977{
1978	struct qca_power *power;
1979
1980	if (!qcadev)
1981		return;
1982
1983	power = qcadev->bt_power;
1984
1985	/* Already disabled? */
1986	if (!power->vregs_on)
1987		return;
1988
1989	regulator_bulk_disable(power->num_vregs, power->vreg_bulk);
1990	power->vregs_on = false;
1991
1992	clk_disable_unprepare(qcadev->susclk);
1993}
1994
1995static int qca_init_regulators(struct qca_power *qca,
1996				const struct qca_vreg *vregs, size_t num_vregs)
1997{
1998	struct regulator_bulk_data *bulk;
1999	int ret;
2000	int i;
2001
2002	bulk = devm_kcalloc(qca->dev, num_vregs, sizeof(*bulk), GFP_KERNEL);
2003	if (!bulk)
2004		return -ENOMEM;
2005
2006	for (i = 0; i < num_vregs; i++)
2007		bulk[i].supply = vregs[i].name;
2008
2009	ret = devm_regulator_bulk_get(qca->dev, num_vregs, bulk);
2010	if (ret < 0)
2011		return ret;
2012
2013	for (i = 0; i < num_vregs; i++) {
2014		ret = regulator_set_load(bulk[i].consumer, vregs[i].load_uA);
2015		if (ret)
2016			return ret;
2017	}
2018
2019	qca->vreg_bulk = bulk;
2020	qca->num_vregs = num_vregs;
2021
2022	return 0;
2023}
2024
2025static int qca_serdev_probe(struct serdev_device *serdev)
2026{
2027	struct qca_serdev *qcadev;
2028	struct hci_dev *hdev;
2029	const struct qca_device_data *data;
2030	int err;
2031	bool power_ctrl_enabled = true;
2032
2033	qcadev = devm_kzalloc(&serdev->dev, sizeof(*qcadev), GFP_KERNEL);
2034	if (!qcadev)
2035		return -ENOMEM;
2036
2037	qcadev->serdev_hu.serdev = serdev;
2038	data = device_get_match_data(&serdev->dev);
2039	serdev_device_set_drvdata(serdev, qcadev);
2040	device_property_read_string(&serdev->dev, "firmware-name",
2041					 &qcadev->firmware_name);
2042	device_property_read_u32(&serdev->dev, "max-speed",
2043				 &qcadev->oper_speed);
2044	if (!qcadev->oper_speed)
2045		BT_DBG("UART will pick default operating speed");
2046
2047	if (data &&
2048	    (qca_is_wcn399x(data->soc_type) ||
2049	    qca_is_wcn6750(data->soc_type))) {
2050		qcadev->btsoc_type = data->soc_type;
2051		qcadev->bt_power = devm_kzalloc(&serdev->dev,
2052						sizeof(struct qca_power),
2053						GFP_KERNEL);
2054		if (!qcadev->bt_power)
2055			return -ENOMEM;
2056
2057		qcadev->bt_power->dev = &serdev->dev;
2058		err = qca_init_regulators(qcadev->bt_power, data->vregs,
2059					  data->num_vregs);
2060		if (err) {
2061			BT_ERR("Failed to init regulators:%d", err);
2062			return err;
2063		}
2064
2065		qcadev->bt_power->vregs_on = false;
2066
2067		qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
2068					       GPIOD_OUT_LOW);
2069		if (IS_ERR_OR_NULL(qcadev->bt_en) && data->soc_type == QCA_WCN6750) {
2070			dev_err(&serdev->dev, "failed to acquire BT_EN gpio\n");
2071			power_ctrl_enabled = false;
2072		}
2073
2074		qcadev->sw_ctrl = devm_gpiod_get_optional(&serdev->dev, "swctrl",
2075					       GPIOD_IN);
2076		if (IS_ERR_OR_NULL(qcadev->sw_ctrl) && data->soc_type == QCA_WCN6750)
2077			dev_warn(&serdev->dev, "failed to acquire SW_CTRL gpio\n");
2078
2079		qcadev->susclk = devm_clk_get_optional(&serdev->dev, NULL);
2080		if (IS_ERR(qcadev->susclk)) {
2081			dev_err(&serdev->dev, "failed to acquire clk\n");
2082			return PTR_ERR(qcadev->susclk);
2083		}
2084
2085		err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
2086		if (err) {
2087			BT_ERR("wcn3990 serdev registration failed");
2088			return err;
2089		}
2090	} else {
2091		if (data)
2092			qcadev->btsoc_type = data->soc_type;
2093		else
2094			qcadev->btsoc_type = QCA_ROME;
2095
2096		qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
2097					       GPIOD_OUT_LOW);
2098		if (IS_ERR_OR_NULL(qcadev->bt_en)) {
2099			dev_warn(&serdev->dev, "failed to acquire enable gpio\n");
2100			power_ctrl_enabled = false;
2101		}
2102
2103		qcadev->susclk = devm_clk_get_optional(&serdev->dev, NULL);
2104		if (IS_ERR(qcadev->susclk)) {
2105			dev_warn(&serdev->dev, "failed to acquire clk\n");
2106			return PTR_ERR(qcadev->susclk);
2107		}
2108		err = clk_set_rate(qcadev->susclk, SUSCLK_RATE_32KHZ);
2109		if (err)
2110			return err;
2111
2112		err = clk_prepare_enable(qcadev->susclk);
2113		if (err)
2114			return err;
2115
2116		err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
2117		if (err) {
2118			BT_ERR("Rome serdev registration failed");
2119			clk_disable_unprepare(qcadev->susclk);
 
2120			return err;
2121		}
2122	}
2123
2124	hdev = qcadev->serdev_hu.hdev;
2125
2126	if (power_ctrl_enabled) {
2127		set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
2128		hdev->shutdown = qca_power_off;
2129	}
2130
2131	if (data) {
2132		/* Wideband speech support must be set per driver since it can't
2133		 * be queried via hci. Same with the valid le states quirk.
2134		 */
2135		if (data->capabilities & QCA_CAP_WIDEBAND_SPEECH)
2136			set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2137				&hdev->quirks);
2138
2139		if (data->capabilities & QCA_CAP_VALID_LE_STATES)
2140			set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
2141	}
2142
2143	return 0;
2144}
2145
2146static void qca_serdev_remove(struct serdev_device *serdev)
2147{
2148	struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2149	struct qca_power *power = qcadev->bt_power;
2150
2151	if ((qca_is_wcn399x(qcadev->btsoc_type) ||
2152	     qca_is_wcn6750(qcadev->btsoc_type)) &&
2153	     power->vregs_on)
2154		qca_power_shutdown(&qcadev->serdev_hu);
2155	else if (qcadev->susclk)
2156		clk_disable_unprepare(qcadev->susclk);
2157
2158	hci_uart_unregister_device(&qcadev->serdev_hu);
2159}
2160
2161static void qca_serdev_shutdown(struct device *dev)
2162{
2163	int ret;
2164	int timeout = msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS);
2165	struct serdev_device *serdev = to_serdev_device(dev);
2166	struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2167	struct hci_uart *hu = &qcadev->serdev_hu;
2168	struct hci_dev *hdev = hu->hdev;
2169	struct qca_data *qca = hu->priv;
2170	const u8 ibs_wake_cmd[] = { 0xFD };
2171	const u8 edl_reset_soc_cmd[] = { 0x01, 0x00, 0xFC, 0x01, 0x05 };
2172
2173	if (qcadev->btsoc_type == QCA_QCA6390) {
2174		if (test_bit(QCA_BT_OFF, &qca->flags) ||
2175		    !test_bit(HCI_RUNNING, &hdev->flags))
2176			return;
2177
2178		serdev_device_write_flush(serdev);
2179		ret = serdev_device_write_buf(serdev, ibs_wake_cmd,
2180					      sizeof(ibs_wake_cmd));
2181		if (ret < 0) {
2182			BT_ERR("QCA send IBS_WAKE_IND error: %d", ret);
2183			return;
2184		}
2185		serdev_device_wait_until_sent(serdev, timeout);
2186		usleep_range(8000, 10000);
2187
2188		serdev_device_write_flush(serdev);
2189		ret = serdev_device_write_buf(serdev, edl_reset_soc_cmd,
2190					      sizeof(edl_reset_soc_cmd));
2191		if (ret < 0) {
2192			BT_ERR("QCA send EDL_RESET_REQ error: %d", ret);
2193			return;
2194		}
2195		serdev_device_wait_until_sent(serdev, timeout);
2196		usleep_range(8000, 10000);
2197	}
2198}
2199
2200static int __maybe_unused qca_suspend(struct device *dev)
2201{
2202	struct serdev_device *serdev = to_serdev_device(dev);
2203	struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2204	struct hci_uart *hu = &qcadev->serdev_hu;
2205	struct qca_data *qca = hu->priv;
2206	unsigned long flags;
2207	bool tx_pending = false;
2208	int ret = 0;
2209	u8 cmd;
2210	u32 wait_timeout = 0;
2211
2212	set_bit(QCA_SUSPENDING, &qca->flags);
2213
2214	/* if BT SoC is running with default firmware then it does not
2215	 * support in-band sleep
2216	 */
2217	if (test_bit(QCA_ROM_FW, &qca->flags))
2218		return 0;
2219
2220	/* During SSR after memory dump collection, controller will be
2221	 * powered off and then powered on.If controller is powered off
2222	 * during SSR then we should wait until SSR is completed.
2223	 */
2224	if (test_bit(QCA_BT_OFF, &qca->flags) &&
2225	    !test_bit(QCA_SSR_TRIGGERED, &qca->flags))
2226		return 0;
2227
2228	if (test_bit(QCA_IBS_DISABLED, &qca->flags) ||
2229	    test_bit(QCA_SSR_TRIGGERED, &qca->flags)) {
2230		wait_timeout = test_bit(QCA_SSR_TRIGGERED, &qca->flags) ?
2231					IBS_DISABLE_SSR_TIMEOUT_MS :
2232					FW_DOWNLOAD_TIMEOUT_MS;
2233
2234		/* QCA_IBS_DISABLED flag is set to true, During FW download
2235		 * and during memory dump collection. It is reset to false,
2236		 * After FW download complete.
2237		 */
2238		wait_on_bit_timeout(&qca->flags, QCA_IBS_DISABLED,
2239			    TASK_UNINTERRUPTIBLE, msecs_to_jiffies(wait_timeout));
2240
2241		if (test_bit(QCA_IBS_DISABLED, &qca->flags)) {
2242			bt_dev_err(hu->hdev, "SSR or FW download time out");
2243			ret = -ETIMEDOUT;
2244			goto error;
2245		}
2246	}
2247
2248	cancel_work_sync(&qca->ws_awake_device);
2249	cancel_work_sync(&qca->ws_awake_rx);
2250
2251	spin_lock_irqsave_nested(&qca->hci_ibs_lock,
2252				 flags, SINGLE_DEPTH_NESTING);
2253
2254	switch (qca->tx_ibs_state) {
2255	case HCI_IBS_TX_WAKING:
2256		del_timer(&qca->wake_retrans_timer);
2257		fallthrough;
2258	case HCI_IBS_TX_AWAKE:
2259		del_timer(&qca->tx_idle_timer);
2260
2261		serdev_device_write_flush(hu->serdev);
2262		cmd = HCI_IBS_SLEEP_IND;
2263		ret = serdev_device_write_buf(hu->serdev, &cmd, sizeof(cmd));
2264
2265		if (ret < 0) {
2266			BT_ERR("Failed to send SLEEP to device");
2267			break;
2268		}
2269
2270		qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
2271		qca->ibs_sent_slps++;
2272		tx_pending = true;
2273		break;
2274
2275	case HCI_IBS_TX_ASLEEP:
2276		break;
2277
2278	default:
2279		BT_ERR("Spurious tx state %d", qca->tx_ibs_state);
2280		ret = -EINVAL;
2281		break;
2282	}
2283
2284	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
2285
2286	if (ret < 0)
2287		goto error;
2288
2289	if (tx_pending) {
2290		serdev_device_wait_until_sent(hu->serdev,
2291					      msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS));
2292		serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_OFF, hu);
2293	}
2294
2295	/* Wait for HCI_IBS_SLEEP_IND sent by device to indicate its Tx is going
2296	 * to sleep, so that the packet does not wake the system later.
2297	 */
2298	ret = wait_event_interruptible_timeout(qca->suspend_wait_q,
2299			qca->rx_ibs_state == HCI_IBS_RX_ASLEEP,
2300			msecs_to_jiffies(IBS_BTSOC_TX_IDLE_TIMEOUT_MS));
2301	if (ret == 0) {
2302		ret = -ETIMEDOUT;
2303		goto error;
2304	}
2305
2306	return 0;
2307
2308error:
2309	clear_bit(QCA_SUSPENDING, &qca->flags);
2310
2311	return ret;
2312}
2313
2314static int __maybe_unused qca_resume(struct device *dev)
2315{
2316	struct serdev_device *serdev = to_serdev_device(dev);
2317	struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
2318	struct hci_uart *hu = &qcadev->serdev_hu;
2319	struct qca_data *qca = hu->priv;
2320
2321	clear_bit(QCA_SUSPENDING, &qca->flags);
2322
2323	return 0;
2324}
2325
2326static SIMPLE_DEV_PM_OPS(qca_pm_ops, qca_suspend, qca_resume);
2327
2328#ifdef CONFIG_OF
2329static const struct of_device_id qca_bluetooth_of_match[] = {
2330	{ .compatible = "qcom,qca6174-bt" },
2331	{ .compatible = "qcom,qca6390-bt", .data = &qca_soc_data_qca6390},
2332	{ .compatible = "qcom,qca9377-bt" },
2333	{ .compatible = "qcom,wcn3990-bt", .data = &qca_soc_data_wcn3990},
2334	{ .compatible = "qcom,wcn3991-bt", .data = &qca_soc_data_wcn3991},
2335	{ .compatible = "qcom,wcn3998-bt", .data = &qca_soc_data_wcn3998},
2336	{ .compatible = "qcom,wcn6750-bt", .data = &qca_soc_data_wcn6750},
2337	{ /* sentinel */ }
2338};
2339MODULE_DEVICE_TABLE(of, qca_bluetooth_of_match);
2340#endif
2341
2342#ifdef CONFIG_ACPI
2343static const struct acpi_device_id qca_bluetooth_acpi_match[] = {
2344	{ "QCOM6390", (kernel_ulong_t)&qca_soc_data_qca6390 },
2345	{ "DLA16390", (kernel_ulong_t)&qca_soc_data_qca6390 },
2346	{ "DLB16390", (kernel_ulong_t)&qca_soc_data_qca6390 },
2347	{ "DLB26390", (kernel_ulong_t)&qca_soc_data_qca6390 },
2348	{ },
2349};
2350MODULE_DEVICE_TABLE(acpi, qca_bluetooth_acpi_match);
2351#endif
2352
2353
2354static struct serdev_device_driver qca_serdev_driver = {
2355	.probe = qca_serdev_probe,
2356	.remove = qca_serdev_remove,
2357	.driver = {
2358		.name = "hci_uart_qca",
2359		.of_match_table = of_match_ptr(qca_bluetooth_of_match),
2360		.acpi_match_table = ACPI_PTR(qca_bluetooth_acpi_match),
2361		.shutdown = qca_serdev_shutdown,
2362		.pm = &qca_pm_ops,
2363	},
2364};
2365
2366int __init qca_init(void)
2367{
2368	serdev_device_driver_register(&qca_serdev_driver);
2369
2370	return hci_uart_register_proto(&qca_proto);
2371}
2372
2373int __exit qca_deinit(void)
2374{
2375	serdev_device_driver_unregister(&qca_serdev_driver);
2376
2377	return hci_uart_unregister_proto(&qca_proto);
2378}