xref: /linux/drivers/bluetooth/hci_qca.c (revision f86fd32d)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  Bluetooth Software UART Qualcomm protocol
4  *
5  *  HCI_IBS (HCI In-Band Sleep) is Qualcomm's power management
6  *  protocol extension to H4.
7  *
8  *  Copyright (C) 2007 Texas Instruments, Inc.
9  *  Copyright (c) 2010, 2012, 2018 The Linux Foundation. All rights reserved.
10  *
11  *  Acknowledgements:
12  *  This file is based on hci_ll.c, which was...
13  *  Written by Ohad Ben-Cohen <ohad@bencohen.org>
14  *  which was in turn based on hci_h4.c, which was written
15  *  by Maxim Krasnyansky and Marcel Holtmann.
16  */
17 
18 #include <linux/kernel.h>
19 #include <linux/clk.h>
20 #include <linux/completion.h>
21 #include <linux/debugfs.h>
22 #include <linux/delay.h>
23 #include <linux/devcoredump.h>
24 #include <linux/device.h>
25 #include <linux/gpio/consumer.h>
26 #include <linux/mod_devicetable.h>
27 #include <linux/module.h>
28 #include <linux/of_device.h>
29 #include <linux/platform_device.h>
30 #include <linux/regulator/consumer.h>
31 #include <linux/serdev.h>
32 #include <asm/unaligned.h>
33 
34 #include <net/bluetooth/bluetooth.h>
35 #include <net/bluetooth/hci_core.h>
36 
37 #include "hci_uart.h"
38 #include "btqca.h"
39 
40 /* HCI_IBS protocol messages */
41 #define HCI_IBS_SLEEP_IND	0xFE
42 #define HCI_IBS_WAKE_IND	0xFD
43 #define HCI_IBS_WAKE_ACK	0xFC
44 #define HCI_MAX_IBS_SIZE	10
45 
46 #define IBS_WAKE_RETRANS_TIMEOUT_MS	100
47 #define IBS_BTSOC_TX_IDLE_TIMEOUT_MS	40
48 #define IBS_HOST_TX_IDLE_TIMEOUT_MS	2000
49 #define CMD_TRANS_TIMEOUT_MS		100
50 #define MEMDUMP_TIMEOUT_MS		8000
51 
52 /* susclk rate */
53 #define SUSCLK_RATE_32KHZ	32768
54 
55 /* Controller debug log header */
56 #define QCA_DEBUG_HANDLE	0x2EDC
57 
58 /* max retry count when init fails */
59 #define MAX_INIT_RETRIES 3
60 
61 /* Controller dump header */
62 #define QCA_SSR_DUMP_HANDLE		0x0108
63 #define QCA_DUMP_PACKET_SIZE		255
64 #define QCA_LAST_SEQUENCE_NUM		0xFFFF
65 #define QCA_CRASHBYTE_PACKET_LEN	1096
66 #define QCA_MEMDUMP_BYTE		0xFB
67 
68 enum qca_flags {
69 	QCA_IBS_ENABLED,
70 	QCA_DROP_VENDOR_EVENT,
71 	QCA_SUSPENDING,
72 	QCA_MEMDUMP_COLLECTION
73 };
74 
75 
76 /* HCI_IBS transmit side sleep protocol states */
77 enum tx_ibs_states {
78 	HCI_IBS_TX_ASLEEP,
79 	HCI_IBS_TX_WAKING,
80 	HCI_IBS_TX_AWAKE,
81 };
82 
83 /* HCI_IBS receive side sleep protocol states */
84 enum rx_states {
85 	HCI_IBS_RX_ASLEEP,
86 	HCI_IBS_RX_AWAKE,
87 };
88 
89 /* HCI_IBS transmit and receive side clock state vote */
90 enum hci_ibs_clock_state_vote {
91 	HCI_IBS_VOTE_STATS_UPDATE,
92 	HCI_IBS_TX_VOTE_CLOCK_ON,
93 	HCI_IBS_TX_VOTE_CLOCK_OFF,
94 	HCI_IBS_RX_VOTE_CLOCK_ON,
95 	HCI_IBS_RX_VOTE_CLOCK_OFF,
96 };
97 
98 /* Controller memory dump states */
99 enum qca_memdump_states {
100 	QCA_MEMDUMP_IDLE,
101 	QCA_MEMDUMP_COLLECTING,
102 	QCA_MEMDUMP_COLLECTED,
103 	QCA_MEMDUMP_TIMEOUT,
104 };
105 
106 struct qca_memdump_data {
107 	char *memdump_buf_head;
108 	char *memdump_buf_tail;
109 	u32 current_seq_no;
110 	u32 received_dump;
111 };
112 
113 struct qca_memdump_event_hdr {
114 	__u8    evt;
115 	__u8    plen;
116 	__u16   opcode;
117 	__u16   seq_no;
118 	__u8    reserved;
119 } __packed;
120 
121 
122 struct qca_dump_size {
123 	u32 dump_size;
124 } __packed;
125 
126 struct qca_data {
127 	struct hci_uart *hu;
128 	struct sk_buff *rx_skb;
129 	struct sk_buff_head txq;
130 	struct sk_buff_head tx_wait_q;	/* HCI_IBS wait queue	*/
131 	struct sk_buff_head rx_memdump_q;	/* Memdump wait queue	*/
132 	spinlock_t hci_ibs_lock;	/* HCI_IBS state lock	*/
133 	u8 tx_ibs_state;	/* HCI_IBS transmit side power state*/
134 	u8 rx_ibs_state;	/* HCI_IBS receive side power state */
135 	bool tx_vote;		/* Clock must be on for TX */
136 	bool rx_vote;		/* Clock must be on for RX */
137 	struct timer_list tx_idle_timer;
138 	u32 tx_idle_delay;
139 	struct timer_list wake_retrans_timer;
140 	u32 wake_retrans;
141 	struct timer_list memdump_timer;
142 	struct workqueue_struct *workqueue;
143 	struct work_struct ws_awake_rx;
144 	struct work_struct ws_awake_device;
145 	struct work_struct ws_rx_vote_off;
146 	struct work_struct ws_tx_vote_off;
147 	struct work_struct ctrl_memdump_evt;
148 	struct qca_memdump_data *qca_memdump;
149 	unsigned long flags;
150 	struct completion drop_ev_comp;
151 	wait_queue_head_t suspend_wait_q;
152 	enum qca_memdump_states memdump_state;
153 
154 	/* For debugging purpose */
155 	u64 ibs_sent_wacks;
156 	u64 ibs_sent_slps;
157 	u64 ibs_sent_wakes;
158 	u64 ibs_recv_wacks;
159 	u64 ibs_recv_slps;
160 	u64 ibs_recv_wakes;
161 	u64 vote_last_jif;
162 	u32 vote_on_ms;
163 	u32 vote_off_ms;
164 	u64 tx_votes_on;
165 	u64 rx_votes_on;
166 	u64 tx_votes_off;
167 	u64 rx_votes_off;
168 	u64 votes_on;
169 	u64 votes_off;
170 };
171 
172 enum qca_speed_type {
173 	QCA_INIT_SPEED = 1,
174 	QCA_OPER_SPEED
175 };
176 
177 /*
178  * Voltage regulator information required for configuring the
179  * QCA Bluetooth chipset
180  */
181 struct qca_vreg {
182 	const char *name;
183 	unsigned int load_uA;
184 };
185 
186 struct qca_vreg_data {
187 	enum qca_btsoc_type soc_type;
188 	struct qca_vreg *vregs;
189 	size_t num_vregs;
190 };
191 
192 /*
193  * Platform data for the QCA Bluetooth power driver.
194  */
195 struct qca_power {
196 	struct device *dev;
197 	struct regulator_bulk_data *vreg_bulk;
198 	int num_vregs;
199 	bool vregs_on;
200 };
201 
202 struct qca_serdev {
203 	struct hci_uart	 serdev_hu;
204 	struct gpio_desc *bt_en;
205 	struct clk	 *susclk;
206 	enum qca_btsoc_type btsoc_type;
207 	struct qca_power *bt_power;
208 	u32 init_speed;
209 	u32 oper_speed;
210 	const char *firmware_name;
211 };
212 
213 static int qca_regulator_enable(struct qca_serdev *qcadev);
214 static void qca_regulator_disable(struct qca_serdev *qcadev);
215 static void qca_power_shutdown(struct hci_uart *hu);
216 static int qca_power_off(struct hci_dev *hdev);
217 static void qca_controller_memdump(struct work_struct *work);
218 
219 static enum qca_btsoc_type qca_soc_type(struct hci_uart *hu)
220 {
221 	enum qca_btsoc_type soc_type;
222 
223 	if (hu->serdev) {
224 		struct qca_serdev *qsd = serdev_device_get_drvdata(hu->serdev);
225 
226 		soc_type = qsd->btsoc_type;
227 	} else {
228 		soc_type = QCA_ROME;
229 	}
230 
231 	return soc_type;
232 }
233 
234 static const char *qca_get_firmware_name(struct hci_uart *hu)
235 {
236 	if (hu->serdev) {
237 		struct qca_serdev *qsd = serdev_device_get_drvdata(hu->serdev);
238 
239 		return qsd->firmware_name;
240 	} else {
241 		return NULL;
242 	}
243 }
244 
245 static void __serial_clock_on(struct tty_struct *tty)
246 {
247 	/* TODO: Some chipset requires to enable UART clock on client
248 	 * side to save power consumption or manual work is required.
249 	 * Please put your code to control UART clock here if needed
250 	 */
251 }
252 
253 static void __serial_clock_off(struct tty_struct *tty)
254 {
255 	/* TODO: Some chipset requires to disable UART clock on client
256 	 * side to save power consumption or manual work is required.
257 	 * Please put your code to control UART clock off here if needed
258 	 */
259 }
260 
261 /* serial_clock_vote needs to be called with the ibs lock held */
262 static void serial_clock_vote(unsigned long vote, struct hci_uart *hu)
263 {
264 	struct qca_data *qca = hu->priv;
265 	unsigned int diff;
266 
267 	bool old_vote = (qca->tx_vote | qca->rx_vote);
268 	bool new_vote;
269 
270 	switch (vote) {
271 	case HCI_IBS_VOTE_STATS_UPDATE:
272 		diff = jiffies_to_msecs(jiffies - qca->vote_last_jif);
273 
274 		if (old_vote)
275 			qca->vote_off_ms += diff;
276 		else
277 			qca->vote_on_ms += diff;
278 		return;
279 
280 	case HCI_IBS_TX_VOTE_CLOCK_ON:
281 		qca->tx_vote = true;
282 		qca->tx_votes_on++;
283 		new_vote = true;
284 		break;
285 
286 	case HCI_IBS_RX_VOTE_CLOCK_ON:
287 		qca->rx_vote = true;
288 		qca->rx_votes_on++;
289 		new_vote = true;
290 		break;
291 
292 	case HCI_IBS_TX_VOTE_CLOCK_OFF:
293 		qca->tx_vote = false;
294 		qca->tx_votes_off++;
295 		new_vote = qca->rx_vote | qca->tx_vote;
296 		break;
297 
298 	case HCI_IBS_RX_VOTE_CLOCK_OFF:
299 		qca->rx_vote = false;
300 		qca->rx_votes_off++;
301 		new_vote = qca->rx_vote | qca->tx_vote;
302 		break;
303 
304 	default:
305 		BT_ERR("Voting irregularity");
306 		return;
307 	}
308 
309 	if (new_vote != old_vote) {
310 		if (new_vote)
311 			__serial_clock_on(hu->tty);
312 		else
313 			__serial_clock_off(hu->tty);
314 
315 		BT_DBG("Vote serial clock %s(%s)", new_vote ? "true" : "false",
316 		       vote ? "true" : "false");
317 
318 		diff = jiffies_to_msecs(jiffies - qca->vote_last_jif);
319 
320 		if (new_vote) {
321 			qca->votes_on++;
322 			qca->vote_off_ms += diff;
323 		} else {
324 			qca->votes_off++;
325 			qca->vote_on_ms += diff;
326 		}
327 		qca->vote_last_jif = jiffies;
328 	}
329 }
330 
331 /* Builds and sends an HCI_IBS command packet.
332  * These are very simple packets with only 1 cmd byte.
333  */
334 static int send_hci_ibs_cmd(u8 cmd, struct hci_uart *hu)
335 {
336 	int err = 0;
337 	struct sk_buff *skb = NULL;
338 	struct qca_data *qca = hu->priv;
339 
340 	BT_DBG("hu %p send hci ibs cmd 0x%x", hu, cmd);
341 
342 	skb = bt_skb_alloc(1, GFP_ATOMIC);
343 	if (!skb) {
344 		BT_ERR("Failed to allocate memory for HCI_IBS packet");
345 		return -ENOMEM;
346 	}
347 
348 	/* Assign HCI_IBS type */
349 	skb_put_u8(skb, cmd);
350 
351 	skb_queue_tail(&qca->txq, skb);
352 
353 	return err;
354 }
355 
356 static void qca_wq_awake_device(struct work_struct *work)
357 {
358 	struct qca_data *qca = container_of(work, struct qca_data,
359 					    ws_awake_device);
360 	struct hci_uart *hu = qca->hu;
361 	unsigned long retrans_delay;
362 	unsigned long flags;
363 
364 	BT_DBG("hu %p wq awake device", hu);
365 
366 	/* Vote for serial clock */
367 	serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_ON, hu);
368 
369 	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
370 
371 	/* Send wake indication to device */
372 	if (send_hci_ibs_cmd(HCI_IBS_WAKE_IND, hu) < 0)
373 		BT_ERR("Failed to send WAKE to device");
374 
375 	qca->ibs_sent_wakes++;
376 
377 	/* Start retransmit timer */
378 	retrans_delay = msecs_to_jiffies(qca->wake_retrans);
379 	mod_timer(&qca->wake_retrans_timer, jiffies + retrans_delay);
380 
381 	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
382 
383 	/* Actually send the packets */
384 	hci_uart_tx_wakeup(hu);
385 }
386 
387 static void qca_wq_awake_rx(struct work_struct *work)
388 {
389 	struct qca_data *qca = container_of(work, struct qca_data,
390 					    ws_awake_rx);
391 	struct hci_uart *hu = qca->hu;
392 	unsigned long flags;
393 
394 	BT_DBG("hu %p wq awake rx", hu);
395 
396 	serial_clock_vote(HCI_IBS_RX_VOTE_CLOCK_ON, hu);
397 
398 	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
399 	qca->rx_ibs_state = HCI_IBS_RX_AWAKE;
400 
401 	/* Always acknowledge device wake up,
402 	 * sending IBS message doesn't count as TX ON.
403 	 */
404 	if (send_hci_ibs_cmd(HCI_IBS_WAKE_ACK, hu) < 0)
405 		BT_ERR("Failed to acknowledge device wake up");
406 
407 	qca->ibs_sent_wacks++;
408 
409 	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
410 
411 	/* Actually send the packets */
412 	hci_uart_tx_wakeup(hu);
413 }
414 
415 static void qca_wq_serial_rx_clock_vote_off(struct work_struct *work)
416 {
417 	struct qca_data *qca = container_of(work, struct qca_data,
418 					    ws_rx_vote_off);
419 	struct hci_uart *hu = qca->hu;
420 
421 	BT_DBG("hu %p rx clock vote off", hu);
422 
423 	serial_clock_vote(HCI_IBS_RX_VOTE_CLOCK_OFF, hu);
424 }
425 
426 static void qca_wq_serial_tx_clock_vote_off(struct work_struct *work)
427 {
428 	struct qca_data *qca = container_of(work, struct qca_data,
429 					    ws_tx_vote_off);
430 	struct hci_uart *hu = qca->hu;
431 
432 	BT_DBG("hu %p tx clock vote off", hu);
433 
434 	/* Run HCI tx handling unlocked */
435 	hci_uart_tx_wakeup(hu);
436 
437 	/* Now that message queued to tty driver, vote for tty clocks off.
438 	 * It is up to the tty driver to pend the clocks off until tx done.
439 	 */
440 	serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_OFF, hu);
441 }
442 
443 static void hci_ibs_tx_idle_timeout(struct timer_list *t)
444 {
445 	struct qca_data *qca = from_timer(qca, t, tx_idle_timer);
446 	struct hci_uart *hu = qca->hu;
447 	unsigned long flags;
448 
449 	BT_DBG("hu %p idle timeout in %d state", hu, qca->tx_ibs_state);
450 
451 	spin_lock_irqsave_nested(&qca->hci_ibs_lock,
452 				 flags, SINGLE_DEPTH_NESTING);
453 
454 	switch (qca->tx_ibs_state) {
455 	case HCI_IBS_TX_AWAKE:
456 		/* TX_IDLE, go to SLEEP */
457 		if (send_hci_ibs_cmd(HCI_IBS_SLEEP_IND, hu) < 0) {
458 			BT_ERR("Failed to send SLEEP to device");
459 			break;
460 		}
461 		qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
462 		qca->ibs_sent_slps++;
463 		queue_work(qca->workqueue, &qca->ws_tx_vote_off);
464 		break;
465 
466 	case HCI_IBS_TX_ASLEEP:
467 	case HCI_IBS_TX_WAKING:
468 		/* Fall through */
469 
470 	default:
471 		BT_ERR("Spurious timeout tx state %d", qca->tx_ibs_state);
472 		break;
473 	}
474 
475 	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
476 }
477 
478 static void hci_ibs_wake_retrans_timeout(struct timer_list *t)
479 {
480 	struct qca_data *qca = from_timer(qca, t, wake_retrans_timer);
481 	struct hci_uart *hu = qca->hu;
482 	unsigned long flags, retrans_delay;
483 	bool retransmit = false;
484 
485 	BT_DBG("hu %p wake retransmit timeout in %d state",
486 		hu, qca->tx_ibs_state);
487 
488 	spin_lock_irqsave_nested(&qca->hci_ibs_lock,
489 				 flags, SINGLE_DEPTH_NESTING);
490 
491 	/* Don't retransmit the HCI_IBS_WAKE_IND when suspending. */
492 	if (test_bit(QCA_SUSPENDING, &qca->flags)) {
493 		spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
494 		return;
495 	}
496 
497 	switch (qca->tx_ibs_state) {
498 	case HCI_IBS_TX_WAKING:
499 		/* No WAKE_ACK, retransmit WAKE */
500 		retransmit = true;
501 		if (send_hci_ibs_cmd(HCI_IBS_WAKE_IND, hu) < 0) {
502 			BT_ERR("Failed to acknowledge device wake up");
503 			break;
504 		}
505 		qca->ibs_sent_wakes++;
506 		retrans_delay = msecs_to_jiffies(qca->wake_retrans);
507 		mod_timer(&qca->wake_retrans_timer, jiffies + retrans_delay);
508 		break;
509 
510 	case HCI_IBS_TX_ASLEEP:
511 	case HCI_IBS_TX_AWAKE:
512 		/* Fall through */
513 
514 	default:
515 		BT_ERR("Spurious timeout tx state %d", qca->tx_ibs_state);
516 		break;
517 	}
518 
519 	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
520 
521 	if (retransmit)
522 		hci_uart_tx_wakeup(hu);
523 }
524 
525 static void hci_memdump_timeout(struct timer_list *t)
526 {
527 	struct qca_data *qca = from_timer(qca, t, tx_idle_timer);
528 	struct hci_uart *hu = qca->hu;
529 	struct qca_memdump_data *qca_memdump = qca->qca_memdump;
530 	char *memdump_buf = qca_memdump->memdump_buf_tail;
531 
532 	bt_dev_err(hu->hdev, "clearing allocated memory due to memdump timeout");
533 	/* Inject hw error event to reset the device and driver. */
534 	hci_reset_dev(hu->hdev);
535 	vfree(memdump_buf);
536 	kfree(qca_memdump);
537 	qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
538 	del_timer(&qca->memdump_timer);
539 	cancel_work_sync(&qca->ctrl_memdump_evt);
540 }
541 
542 /* Initialize protocol */
543 static int qca_open(struct hci_uart *hu)
544 {
545 	struct qca_serdev *qcadev;
546 	struct qca_data *qca;
547 
548 	BT_DBG("hu %p qca_open", hu);
549 
550 	if (!hci_uart_has_flow_control(hu))
551 		return -EOPNOTSUPP;
552 
553 	qca = kzalloc(sizeof(struct qca_data), GFP_KERNEL);
554 	if (!qca)
555 		return -ENOMEM;
556 
557 	skb_queue_head_init(&qca->txq);
558 	skb_queue_head_init(&qca->tx_wait_q);
559 	skb_queue_head_init(&qca->rx_memdump_q);
560 	spin_lock_init(&qca->hci_ibs_lock);
561 	qca->workqueue = alloc_ordered_workqueue("qca_wq", 0);
562 	if (!qca->workqueue) {
563 		BT_ERR("QCA Workqueue not initialized properly");
564 		kfree(qca);
565 		return -ENOMEM;
566 	}
567 
568 	INIT_WORK(&qca->ws_awake_rx, qca_wq_awake_rx);
569 	INIT_WORK(&qca->ws_awake_device, qca_wq_awake_device);
570 	INIT_WORK(&qca->ws_rx_vote_off, qca_wq_serial_rx_clock_vote_off);
571 	INIT_WORK(&qca->ws_tx_vote_off, qca_wq_serial_tx_clock_vote_off);
572 	INIT_WORK(&qca->ctrl_memdump_evt, qca_controller_memdump);
573 	init_waitqueue_head(&qca->suspend_wait_q);
574 
575 	qca->hu = hu;
576 	init_completion(&qca->drop_ev_comp);
577 
578 	/* Assume we start with both sides asleep -- extra wakes OK */
579 	qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
580 	qca->rx_ibs_state = HCI_IBS_RX_ASLEEP;
581 
582 	qca->vote_last_jif = jiffies;
583 
584 	hu->priv = qca;
585 
586 	if (hu->serdev) {
587 		qcadev = serdev_device_get_drvdata(hu->serdev);
588 		if (qca_is_wcn399x(qcadev->btsoc_type)) {
589 			hu->init_speed = qcadev->init_speed;
590 			hu->oper_speed = qcadev->oper_speed;
591 		}
592 	}
593 
594 	timer_setup(&qca->wake_retrans_timer, hci_ibs_wake_retrans_timeout, 0);
595 	qca->wake_retrans = IBS_WAKE_RETRANS_TIMEOUT_MS;
596 
597 	timer_setup(&qca->tx_idle_timer, hci_ibs_tx_idle_timeout, 0);
598 	qca->tx_idle_delay = IBS_HOST_TX_IDLE_TIMEOUT_MS;
599 	timer_setup(&qca->memdump_timer, hci_memdump_timeout, 0);
600 
601 	BT_DBG("HCI_UART_QCA open, tx_idle_delay=%u, wake_retrans=%u",
602 	       qca->tx_idle_delay, qca->wake_retrans);
603 
604 	return 0;
605 }
606 
607 static void qca_debugfs_init(struct hci_dev *hdev)
608 {
609 	struct hci_uart *hu = hci_get_drvdata(hdev);
610 	struct qca_data *qca = hu->priv;
611 	struct dentry *ibs_dir;
612 	umode_t mode;
613 
614 	if (!hdev->debugfs)
615 		return;
616 
617 	ibs_dir = debugfs_create_dir("ibs", hdev->debugfs);
618 
619 	/* read only */
620 	mode = S_IRUGO;
621 	debugfs_create_u8("tx_ibs_state", mode, ibs_dir, &qca->tx_ibs_state);
622 	debugfs_create_u8("rx_ibs_state", mode, ibs_dir, &qca->rx_ibs_state);
623 	debugfs_create_u64("ibs_sent_sleeps", mode, ibs_dir,
624 			   &qca->ibs_sent_slps);
625 	debugfs_create_u64("ibs_sent_wakes", mode, ibs_dir,
626 			   &qca->ibs_sent_wakes);
627 	debugfs_create_u64("ibs_sent_wake_acks", mode, ibs_dir,
628 			   &qca->ibs_sent_wacks);
629 	debugfs_create_u64("ibs_recv_sleeps", mode, ibs_dir,
630 			   &qca->ibs_recv_slps);
631 	debugfs_create_u64("ibs_recv_wakes", mode, ibs_dir,
632 			   &qca->ibs_recv_wakes);
633 	debugfs_create_u64("ibs_recv_wake_acks", mode, ibs_dir,
634 			   &qca->ibs_recv_wacks);
635 	debugfs_create_bool("tx_vote", mode, ibs_dir, &qca->tx_vote);
636 	debugfs_create_u64("tx_votes_on", mode, ibs_dir, &qca->tx_votes_on);
637 	debugfs_create_u64("tx_votes_off", mode, ibs_dir, &qca->tx_votes_off);
638 	debugfs_create_bool("rx_vote", mode, ibs_dir, &qca->rx_vote);
639 	debugfs_create_u64("rx_votes_on", mode, ibs_dir, &qca->rx_votes_on);
640 	debugfs_create_u64("rx_votes_off", mode, ibs_dir, &qca->rx_votes_off);
641 	debugfs_create_u64("votes_on", mode, ibs_dir, &qca->votes_on);
642 	debugfs_create_u64("votes_off", mode, ibs_dir, &qca->votes_off);
643 	debugfs_create_u32("vote_on_ms", mode, ibs_dir, &qca->vote_on_ms);
644 	debugfs_create_u32("vote_off_ms", mode, ibs_dir, &qca->vote_off_ms);
645 
646 	/* read/write */
647 	mode = S_IRUGO | S_IWUSR;
648 	debugfs_create_u32("wake_retrans", mode, ibs_dir, &qca->wake_retrans);
649 	debugfs_create_u32("tx_idle_delay", mode, ibs_dir,
650 			   &qca->tx_idle_delay);
651 }
652 
653 /* Flush protocol data */
654 static int qca_flush(struct hci_uart *hu)
655 {
656 	struct qca_data *qca = hu->priv;
657 
658 	BT_DBG("hu %p qca flush", hu);
659 
660 	skb_queue_purge(&qca->tx_wait_q);
661 	skb_queue_purge(&qca->txq);
662 
663 	return 0;
664 }
665 
666 /* Close protocol */
667 static int qca_close(struct hci_uart *hu)
668 {
669 	struct qca_data *qca = hu->priv;
670 
671 	BT_DBG("hu %p qca close", hu);
672 
673 	serial_clock_vote(HCI_IBS_VOTE_STATS_UPDATE, hu);
674 
675 	skb_queue_purge(&qca->tx_wait_q);
676 	skb_queue_purge(&qca->txq);
677 	skb_queue_purge(&qca->rx_memdump_q);
678 	del_timer(&qca->tx_idle_timer);
679 	del_timer(&qca->wake_retrans_timer);
680 	del_timer(&qca->memdump_timer);
681 	destroy_workqueue(qca->workqueue);
682 	qca->hu = NULL;
683 
684 	qca_power_shutdown(hu);
685 
686 	kfree_skb(qca->rx_skb);
687 
688 	hu->priv = NULL;
689 
690 	kfree(qca);
691 
692 	return 0;
693 }
694 
695 /* Called upon a wake-up-indication from the device.
696  */
697 static void device_want_to_wakeup(struct hci_uart *hu)
698 {
699 	unsigned long flags;
700 	struct qca_data *qca = hu->priv;
701 
702 	BT_DBG("hu %p want to wake up", hu);
703 
704 	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
705 
706 	qca->ibs_recv_wakes++;
707 
708 	/* Don't wake the rx up when suspending. */
709 	if (test_bit(QCA_SUSPENDING, &qca->flags)) {
710 		spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
711 		return;
712 	}
713 
714 	switch (qca->rx_ibs_state) {
715 	case HCI_IBS_RX_ASLEEP:
716 		/* Make sure clock is on - we may have turned clock off since
717 		 * receiving the wake up indicator awake rx clock.
718 		 */
719 		queue_work(qca->workqueue, &qca->ws_awake_rx);
720 		spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
721 		return;
722 
723 	case HCI_IBS_RX_AWAKE:
724 		/* Always acknowledge device wake up,
725 		 * sending IBS message doesn't count as TX ON.
726 		 */
727 		if (send_hci_ibs_cmd(HCI_IBS_WAKE_ACK, hu) < 0) {
728 			BT_ERR("Failed to acknowledge device wake up");
729 			break;
730 		}
731 		qca->ibs_sent_wacks++;
732 		break;
733 
734 	default:
735 		/* Any other state is illegal */
736 		BT_ERR("Received HCI_IBS_WAKE_IND in rx state %d",
737 		       qca->rx_ibs_state);
738 		break;
739 	}
740 
741 	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
742 
743 	/* Actually send the packets */
744 	hci_uart_tx_wakeup(hu);
745 }
746 
747 /* Called upon a sleep-indication from the device.
748  */
749 static void device_want_to_sleep(struct hci_uart *hu)
750 {
751 	unsigned long flags;
752 	struct qca_data *qca = hu->priv;
753 
754 	BT_DBG("hu %p want to sleep in %d state", hu, qca->rx_ibs_state);
755 
756 	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
757 
758 	qca->ibs_recv_slps++;
759 
760 	switch (qca->rx_ibs_state) {
761 	case HCI_IBS_RX_AWAKE:
762 		/* Update state */
763 		qca->rx_ibs_state = HCI_IBS_RX_ASLEEP;
764 		/* Vote off rx clock under workqueue */
765 		queue_work(qca->workqueue, &qca->ws_rx_vote_off);
766 		break;
767 
768 	case HCI_IBS_RX_ASLEEP:
769 		break;
770 
771 	default:
772 		/* Any other state is illegal */
773 		BT_ERR("Received HCI_IBS_SLEEP_IND in rx state %d",
774 		       qca->rx_ibs_state);
775 		break;
776 	}
777 
778 	wake_up_interruptible(&qca->suspend_wait_q);
779 
780 	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
781 }
782 
783 /* Called upon wake-up-acknowledgement from the device
784  */
785 static void device_woke_up(struct hci_uart *hu)
786 {
787 	unsigned long flags, idle_delay;
788 	struct qca_data *qca = hu->priv;
789 	struct sk_buff *skb = NULL;
790 
791 	BT_DBG("hu %p woke up", hu);
792 
793 	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
794 
795 	qca->ibs_recv_wacks++;
796 
797 	/* Don't react to the wake-up-acknowledgment when suspending. */
798 	if (test_bit(QCA_SUSPENDING, &qca->flags)) {
799 		spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
800 		return;
801 	}
802 
803 	switch (qca->tx_ibs_state) {
804 	case HCI_IBS_TX_AWAKE:
805 		/* Expect one if we send 2 WAKEs */
806 		BT_DBG("Received HCI_IBS_WAKE_ACK in tx state %d",
807 		       qca->tx_ibs_state);
808 		break;
809 
810 	case HCI_IBS_TX_WAKING:
811 		/* Send pending packets */
812 		while ((skb = skb_dequeue(&qca->tx_wait_q)))
813 			skb_queue_tail(&qca->txq, skb);
814 
815 		/* Switch timers and change state to HCI_IBS_TX_AWAKE */
816 		del_timer(&qca->wake_retrans_timer);
817 		idle_delay = msecs_to_jiffies(qca->tx_idle_delay);
818 		mod_timer(&qca->tx_idle_timer, jiffies + idle_delay);
819 		qca->tx_ibs_state = HCI_IBS_TX_AWAKE;
820 		break;
821 
822 	case HCI_IBS_TX_ASLEEP:
823 		/* Fall through */
824 
825 	default:
826 		BT_ERR("Received HCI_IBS_WAKE_ACK in tx state %d",
827 		       qca->tx_ibs_state);
828 		break;
829 	}
830 
831 	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
832 
833 	/* Actually send the packets */
834 	hci_uart_tx_wakeup(hu);
835 }
836 
837 /* Enqueue frame for transmittion (padding, crc, etc) may be called from
838  * two simultaneous tasklets.
839  */
840 static int qca_enqueue(struct hci_uart *hu, struct sk_buff *skb)
841 {
842 	unsigned long flags = 0, idle_delay;
843 	struct qca_data *qca = hu->priv;
844 
845 	BT_DBG("hu %p qca enq skb %p tx_ibs_state %d", hu, skb,
846 	       qca->tx_ibs_state);
847 
848 	/* Prepend skb with frame type */
849 	memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
850 
851 	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
852 
853 	/* Don't go to sleep in middle of patch download or
854 	 * Out-Of-Band(GPIOs control) sleep is selected.
855 	 * Don't wake the device up when suspending.
856 	 */
857 	if (!test_bit(QCA_IBS_ENABLED, &qca->flags) ||
858 	    test_bit(QCA_SUSPENDING, &qca->flags)) {
859 		skb_queue_tail(&qca->txq, skb);
860 		spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
861 		return 0;
862 	}
863 
864 	/* Act according to current state */
865 	switch (qca->tx_ibs_state) {
866 	case HCI_IBS_TX_AWAKE:
867 		BT_DBG("Device awake, sending normally");
868 		skb_queue_tail(&qca->txq, skb);
869 		idle_delay = msecs_to_jiffies(qca->tx_idle_delay);
870 		mod_timer(&qca->tx_idle_timer, jiffies + idle_delay);
871 		break;
872 
873 	case HCI_IBS_TX_ASLEEP:
874 		BT_DBG("Device asleep, waking up and queueing packet");
875 		/* Save packet for later */
876 		skb_queue_tail(&qca->tx_wait_q, skb);
877 
878 		qca->tx_ibs_state = HCI_IBS_TX_WAKING;
879 		/* Schedule a work queue to wake up device */
880 		queue_work(qca->workqueue, &qca->ws_awake_device);
881 		break;
882 
883 	case HCI_IBS_TX_WAKING:
884 		BT_DBG("Device waking up, queueing packet");
885 		/* Transient state; just keep packet for later */
886 		skb_queue_tail(&qca->tx_wait_q, skb);
887 		break;
888 
889 	default:
890 		BT_ERR("Illegal tx state: %d (losing packet)",
891 		       qca->tx_ibs_state);
892 		kfree_skb(skb);
893 		break;
894 	}
895 
896 	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
897 
898 	return 0;
899 }
900 
901 static int qca_ibs_sleep_ind(struct hci_dev *hdev, struct sk_buff *skb)
902 {
903 	struct hci_uart *hu = hci_get_drvdata(hdev);
904 
905 	BT_DBG("hu %p recv hci ibs cmd 0x%x", hu, HCI_IBS_SLEEP_IND);
906 
907 	device_want_to_sleep(hu);
908 
909 	kfree_skb(skb);
910 	return 0;
911 }
912 
913 static int qca_ibs_wake_ind(struct hci_dev *hdev, struct sk_buff *skb)
914 {
915 	struct hci_uart *hu = hci_get_drvdata(hdev);
916 
917 	BT_DBG("hu %p recv hci ibs cmd 0x%x", hu, HCI_IBS_WAKE_IND);
918 
919 	device_want_to_wakeup(hu);
920 
921 	kfree_skb(skb);
922 	return 0;
923 }
924 
925 static int qca_ibs_wake_ack(struct hci_dev *hdev, struct sk_buff *skb)
926 {
927 	struct hci_uart *hu = hci_get_drvdata(hdev);
928 
929 	BT_DBG("hu %p recv hci ibs cmd 0x%x", hu, HCI_IBS_WAKE_ACK);
930 
931 	device_woke_up(hu);
932 
933 	kfree_skb(skb);
934 	return 0;
935 }
936 
937 static int qca_recv_acl_data(struct hci_dev *hdev, struct sk_buff *skb)
938 {
939 	/* We receive debug logs from chip as an ACL packets.
940 	 * Instead of sending the data to ACL to decode the
941 	 * received data, we are pushing them to the above layers
942 	 * as a diagnostic packet.
943 	 */
944 	if (get_unaligned_le16(skb->data) == QCA_DEBUG_HANDLE)
945 		return hci_recv_diag(hdev, skb);
946 
947 	return hci_recv_frame(hdev, skb);
948 }
949 
950 static void qca_controller_memdump(struct work_struct *work)
951 {
952 	struct qca_data *qca = container_of(work, struct qca_data,
953 					    ctrl_memdump_evt);
954 	struct hci_uart *hu = qca->hu;
955 	struct sk_buff *skb;
956 	struct qca_memdump_event_hdr *cmd_hdr;
957 	struct qca_memdump_data *qca_memdump = qca->qca_memdump;
958 	struct qca_dump_size *dump;
959 	char *memdump_buf;
960 	char nullBuff[QCA_DUMP_PACKET_SIZE] = { 0 };
961 	u16 seq_no;
962 	u32 dump_size;
963 
964 	while ((skb = skb_dequeue(&qca->rx_memdump_q))) {
965 
966 		if (!qca_memdump) {
967 			qca_memdump = kzalloc(sizeof(struct qca_memdump_data),
968 					      GFP_ATOMIC);
969 			if (!qca_memdump)
970 				return;
971 
972 			qca->qca_memdump = qca_memdump;
973 		}
974 
975 		qca->memdump_state = QCA_MEMDUMP_COLLECTING;
976 		cmd_hdr = (void *) skb->data;
977 		seq_no = __le16_to_cpu(cmd_hdr->seq_no);
978 		skb_pull(skb, sizeof(struct qca_memdump_event_hdr));
979 
980 		if (!seq_no) {
981 
982 			/* This is the first frame of memdump packet from
983 			 * the controller, Disable IBS to recevie dump
984 			 * with out any interruption, ideally time required for
985 			 * the controller to send the dump is 8 seconds. let us
986 			 * start timer to handle this asynchronous activity.
987 			 */
988 			clear_bit(QCA_IBS_ENABLED, &qca->flags);
989 			set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
990 			dump = (void *) skb->data;
991 			dump_size = __le32_to_cpu(dump->dump_size);
992 			if (!(dump_size)) {
993 				bt_dev_err(hu->hdev, "Rx invalid memdump size");
994 				kfree_skb(skb);
995 				return;
996 			}
997 
998 			bt_dev_info(hu->hdev, "QCA collecting dump of size:%u",
999 				    dump_size);
1000 			mod_timer(&qca->memdump_timer, (jiffies +
1001 				  msecs_to_jiffies(MEMDUMP_TIMEOUT_MS)));
1002 
1003 			skb_pull(skb, sizeof(dump_size));
1004 			memdump_buf = vmalloc(dump_size);
1005 			qca_memdump->memdump_buf_head = memdump_buf;
1006 			qca_memdump->memdump_buf_tail = memdump_buf;
1007 		}
1008 
1009 		memdump_buf = qca_memdump->memdump_buf_tail;
1010 
1011 		/* If sequence no 0 is missed then there is no point in
1012 		 * accepting the other sequences.
1013 		 */
1014 		if (!memdump_buf) {
1015 			bt_dev_err(hu->hdev, "QCA: Discarding other packets");
1016 			kfree(qca_memdump);
1017 			kfree_skb(skb);
1018 			qca->qca_memdump = NULL;
1019 			return;
1020 		}
1021 
1022 		/* There could be chance of missing some packets from
1023 		 * the controller. In such cases let us store the dummy
1024 		 * packets in the buffer.
1025 		 */
1026 		while ((seq_no > qca_memdump->current_seq_no + 1) &&
1027 			seq_no != QCA_LAST_SEQUENCE_NUM) {
1028 			bt_dev_err(hu->hdev, "QCA controller missed packet:%d",
1029 				   qca_memdump->current_seq_no);
1030 			memcpy(memdump_buf, nullBuff, QCA_DUMP_PACKET_SIZE);
1031 			memdump_buf = memdump_buf + QCA_DUMP_PACKET_SIZE;
1032 			qca_memdump->received_dump += QCA_DUMP_PACKET_SIZE;
1033 			qca_memdump->current_seq_no++;
1034 		}
1035 
1036 		memcpy(memdump_buf, (unsigned char *) skb->data, skb->len);
1037 		memdump_buf = memdump_buf + skb->len;
1038 		qca_memdump->memdump_buf_tail = memdump_buf;
1039 		qca_memdump->current_seq_no = seq_no + 1;
1040 		qca_memdump->received_dump += skb->len;
1041 		qca->qca_memdump = qca_memdump;
1042 		kfree_skb(skb);
1043 		if (seq_no == QCA_LAST_SEQUENCE_NUM) {
1044 			bt_dev_info(hu->hdev, "QCA writing crash dump of size %d bytes",
1045 				   qca_memdump->received_dump);
1046 			memdump_buf = qca_memdump->memdump_buf_head;
1047 			dev_coredumpv(&hu->serdev->dev, memdump_buf,
1048 				      qca_memdump->received_dump, GFP_KERNEL);
1049 			del_timer(&qca->memdump_timer);
1050 			kfree(qca->qca_memdump);
1051 			qca->qca_memdump = NULL;
1052 			qca->memdump_state = QCA_MEMDUMP_COLLECTED;
1053 		}
1054 	}
1055 
1056 }
1057 
1058 int qca_controller_memdump_event(struct hci_dev *hdev, struct sk_buff *skb)
1059 {
1060 	struct hci_uart *hu = hci_get_drvdata(hdev);
1061 	struct qca_data *qca = hu->priv;
1062 
1063 	skb_queue_tail(&qca->rx_memdump_q, skb);
1064 	queue_work(qca->workqueue, &qca->ctrl_memdump_evt);
1065 
1066 	return 0;
1067 }
1068 
1069 static int qca_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
1070 {
1071 	struct hci_uart *hu = hci_get_drvdata(hdev);
1072 	struct qca_data *qca = hu->priv;
1073 
1074 	if (test_bit(QCA_DROP_VENDOR_EVENT, &qca->flags)) {
1075 		struct hci_event_hdr *hdr = (void *)skb->data;
1076 
1077 		/* For the WCN3990 the vendor command for a baudrate change
1078 		 * isn't sent as synchronous HCI command, because the
1079 		 * controller sends the corresponding vendor event with the
1080 		 * new baudrate. The event is received and properly decoded
1081 		 * after changing the baudrate of the host port. It needs to
1082 		 * be dropped, otherwise it can be misinterpreted as
1083 		 * response to a later firmware download command (also a
1084 		 * vendor command).
1085 		 */
1086 
1087 		if (hdr->evt == HCI_EV_VENDOR)
1088 			complete(&qca->drop_ev_comp);
1089 
1090 		kfree_skb(skb);
1091 
1092 		return 0;
1093 	}
1094 	/* We receive chip memory dump as an event packet, With a dedicated
1095 	 * handler followed by a hardware error event. When this event is
1096 	 * received we store dump into a file before closing hci. This
1097 	 * dump will help in triaging the issues.
1098 	 */
1099 	if ((skb->data[0] == HCI_VENDOR_PKT) &&
1100 	    (get_unaligned_be16(skb->data + 2) == QCA_SSR_DUMP_HANDLE))
1101 		return qca_controller_memdump_event(hdev, skb);
1102 
1103 	return hci_recv_frame(hdev, skb);
1104 }
1105 
1106 #define QCA_IBS_SLEEP_IND_EVENT \
1107 	.type = HCI_IBS_SLEEP_IND, \
1108 	.hlen = 0, \
1109 	.loff = 0, \
1110 	.lsize = 0, \
1111 	.maxlen = HCI_MAX_IBS_SIZE
1112 
1113 #define QCA_IBS_WAKE_IND_EVENT \
1114 	.type = HCI_IBS_WAKE_IND, \
1115 	.hlen = 0, \
1116 	.loff = 0, \
1117 	.lsize = 0, \
1118 	.maxlen = HCI_MAX_IBS_SIZE
1119 
1120 #define QCA_IBS_WAKE_ACK_EVENT \
1121 	.type = HCI_IBS_WAKE_ACK, \
1122 	.hlen = 0, \
1123 	.loff = 0, \
1124 	.lsize = 0, \
1125 	.maxlen = HCI_MAX_IBS_SIZE
1126 
1127 static const struct h4_recv_pkt qca_recv_pkts[] = {
1128 	{ H4_RECV_ACL,             .recv = qca_recv_acl_data },
1129 	{ H4_RECV_SCO,             .recv = hci_recv_frame    },
1130 	{ H4_RECV_EVENT,           .recv = qca_recv_event    },
1131 	{ QCA_IBS_WAKE_IND_EVENT,  .recv = qca_ibs_wake_ind  },
1132 	{ QCA_IBS_WAKE_ACK_EVENT,  .recv = qca_ibs_wake_ack  },
1133 	{ QCA_IBS_SLEEP_IND_EVENT, .recv = qca_ibs_sleep_ind },
1134 };
1135 
1136 static int qca_recv(struct hci_uart *hu, const void *data, int count)
1137 {
1138 	struct qca_data *qca = hu->priv;
1139 
1140 	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
1141 		return -EUNATCH;
1142 
1143 	qca->rx_skb = h4_recv_buf(hu->hdev, qca->rx_skb, data, count,
1144 				  qca_recv_pkts, ARRAY_SIZE(qca_recv_pkts));
1145 	if (IS_ERR(qca->rx_skb)) {
1146 		int err = PTR_ERR(qca->rx_skb);
1147 		bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err);
1148 		qca->rx_skb = NULL;
1149 		return err;
1150 	}
1151 
1152 	return count;
1153 }
1154 
1155 static struct sk_buff *qca_dequeue(struct hci_uart *hu)
1156 {
1157 	struct qca_data *qca = hu->priv;
1158 
1159 	return skb_dequeue(&qca->txq);
1160 }
1161 
1162 static uint8_t qca_get_baudrate_value(int speed)
1163 {
1164 	switch (speed) {
1165 	case 9600:
1166 		return QCA_BAUDRATE_9600;
1167 	case 19200:
1168 		return QCA_BAUDRATE_19200;
1169 	case 38400:
1170 		return QCA_BAUDRATE_38400;
1171 	case 57600:
1172 		return QCA_BAUDRATE_57600;
1173 	case 115200:
1174 		return QCA_BAUDRATE_115200;
1175 	case 230400:
1176 		return QCA_BAUDRATE_230400;
1177 	case 460800:
1178 		return QCA_BAUDRATE_460800;
1179 	case 500000:
1180 		return QCA_BAUDRATE_500000;
1181 	case 921600:
1182 		return QCA_BAUDRATE_921600;
1183 	case 1000000:
1184 		return QCA_BAUDRATE_1000000;
1185 	case 2000000:
1186 		return QCA_BAUDRATE_2000000;
1187 	case 3000000:
1188 		return QCA_BAUDRATE_3000000;
1189 	case 3200000:
1190 		return QCA_BAUDRATE_3200000;
1191 	case 3500000:
1192 		return QCA_BAUDRATE_3500000;
1193 	default:
1194 		return QCA_BAUDRATE_115200;
1195 	}
1196 }
1197 
1198 static int qca_set_baudrate(struct hci_dev *hdev, uint8_t baudrate)
1199 {
1200 	struct hci_uart *hu = hci_get_drvdata(hdev);
1201 	struct qca_data *qca = hu->priv;
1202 	struct sk_buff *skb;
1203 	u8 cmd[] = { 0x01, 0x48, 0xFC, 0x01, 0x00 };
1204 
1205 	if (baudrate > QCA_BAUDRATE_3200000)
1206 		return -EINVAL;
1207 
1208 	cmd[4] = baudrate;
1209 
1210 	skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
1211 	if (!skb) {
1212 		bt_dev_err(hdev, "Failed to allocate baudrate packet");
1213 		return -ENOMEM;
1214 	}
1215 
1216 	/* Assign commands to change baudrate and packet type. */
1217 	skb_put_data(skb, cmd, sizeof(cmd));
1218 	hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
1219 
1220 	skb_queue_tail(&qca->txq, skb);
1221 	hci_uart_tx_wakeup(hu);
1222 
1223 	/* Wait for the baudrate change request to be sent */
1224 
1225 	while (!skb_queue_empty(&qca->txq))
1226 		usleep_range(100, 200);
1227 
1228 	if (hu->serdev)
1229 		serdev_device_wait_until_sent(hu->serdev,
1230 		      msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS));
1231 
1232 	/* Give the controller time to process the request */
1233 	if (qca_is_wcn399x(qca_soc_type(hu)))
1234 		msleep(10);
1235 	else
1236 		msleep(300);
1237 
1238 	return 0;
1239 }
1240 
1241 static inline void host_set_baudrate(struct hci_uart *hu, unsigned int speed)
1242 {
1243 	if (hu->serdev)
1244 		serdev_device_set_baudrate(hu->serdev, speed);
1245 	else
1246 		hci_uart_set_baudrate(hu, speed);
1247 }
1248 
1249 static int qca_send_power_pulse(struct hci_uart *hu, bool on)
1250 {
1251 	int ret;
1252 	int timeout = msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS);
1253 	u8 cmd = on ? QCA_WCN3990_POWERON_PULSE : QCA_WCN3990_POWEROFF_PULSE;
1254 
1255 	/* These power pulses are single byte command which are sent
1256 	 * at required baudrate to wcn3990. On wcn3990, we have an external
1257 	 * circuit at Tx pin which decodes the pulse sent at specific baudrate.
1258 	 * For example, wcn3990 supports RF COEX antenna for both Wi-Fi/BT
1259 	 * and also we use the same power inputs to turn on and off for
1260 	 * Wi-Fi/BT. Powering up the power sources will not enable BT, until
1261 	 * we send a power on pulse at 115200 bps. This algorithm will help to
1262 	 * save power. Disabling hardware flow control is mandatory while
1263 	 * sending power pulses to SoC.
1264 	 */
1265 	bt_dev_dbg(hu->hdev, "sending power pulse %02x to controller", cmd);
1266 
1267 	serdev_device_write_flush(hu->serdev);
1268 	hci_uart_set_flow_control(hu, true);
1269 	ret = serdev_device_write_buf(hu->serdev, &cmd, sizeof(cmd));
1270 	if (ret < 0) {
1271 		bt_dev_err(hu->hdev, "failed to send power pulse %02x", cmd);
1272 		return ret;
1273 	}
1274 
1275 	serdev_device_wait_until_sent(hu->serdev, timeout);
1276 	hci_uart_set_flow_control(hu, false);
1277 
1278 	/* Give to controller time to boot/shutdown */
1279 	if (on)
1280 		msleep(100);
1281 	else
1282 		msleep(10);
1283 
1284 	return 0;
1285 }
1286 
1287 static unsigned int qca_get_speed(struct hci_uart *hu,
1288 				  enum qca_speed_type speed_type)
1289 {
1290 	unsigned int speed = 0;
1291 
1292 	if (speed_type == QCA_INIT_SPEED) {
1293 		if (hu->init_speed)
1294 			speed = hu->init_speed;
1295 		else if (hu->proto->init_speed)
1296 			speed = hu->proto->init_speed;
1297 	} else {
1298 		if (hu->oper_speed)
1299 			speed = hu->oper_speed;
1300 		else if (hu->proto->oper_speed)
1301 			speed = hu->proto->oper_speed;
1302 	}
1303 
1304 	return speed;
1305 }
1306 
1307 static int qca_check_speeds(struct hci_uart *hu)
1308 {
1309 	if (qca_is_wcn399x(qca_soc_type(hu))) {
1310 		if (!qca_get_speed(hu, QCA_INIT_SPEED) &&
1311 		    !qca_get_speed(hu, QCA_OPER_SPEED))
1312 			return -EINVAL;
1313 	} else {
1314 		if (!qca_get_speed(hu, QCA_INIT_SPEED) ||
1315 		    !qca_get_speed(hu, QCA_OPER_SPEED))
1316 			return -EINVAL;
1317 	}
1318 
1319 	return 0;
1320 }
1321 
1322 static int qca_set_speed(struct hci_uart *hu, enum qca_speed_type speed_type)
1323 {
1324 	unsigned int speed, qca_baudrate;
1325 	struct qca_data *qca = hu->priv;
1326 	int ret = 0;
1327 
1328 	if (speed_type == QCA_INIT_SPEED) {
1329 		speed = qca_get_speed(hu, QCA_INIT_SPEED);
1330 		if (speed)
1331 			host_set_baudrate(hu, speed);
1332 	} else {
1333 		enum qca_btsoc_type soc_type = qca_soc_type(hu);
1334 
1335 		speed = qca_get_speed(hu, QCA_OPER_SPEED);
1336 		if (!speed)
1337 			return 0;
1338 
1339 		/* Disable flow control for wcn3990 to deassert RTS while
1340 		 * changing the baudrate of chip and host.
1341 		 */
1342 		if (qca_is_wcn399x(soc_type))
1343 			hci_uart_set_flow_control(hu, true);
1344 
1345 		if (soc_type == QCA_WCN3990) {
1346 			reinit_completion(&qca->drop_ev_comp);
1347 			set_bit(QCA_DROP_VENDOR_EVENT, &qca->flags);
1348 		}
1349 
1350 		qca_baudrate = qca_get_baudrate_value(speed);
1351 		bt_dev_dbg(hu->hdev, "Set UART speed to %d", speed);
1352 		ret = qca_set_baudrate(hu->hdev, qca_baudrate);
1353 		if (ret)
1354 			goto error;
1355 
1356 		host_set_baudrate(hu, speed);
1357 
1358 error:
1359 		if (qca_is_wcn399x(soc_type))
1360 			hci_uart_set_flow_control(hu, false);
1361 
1362 		if (soc_type == QCA_WCN3990) {
1363 			/* Wait for the controller to send the vendor event
1364 			 * for the baudrate change command.
1365 			 */
1366 			if (!wait_for_completion_timeout(&qca->drop_ev_comp,
1367 						 msecs_to_jiffies(100))) {
1368 				bt_dev_err(hu->hdev,
1369 					   "Failed to change controller baudrate\n");
1370 				ret = -ETIMEDOUT;
1371 			}
1372 
1373 			clear_bit(QCA_DROP_VENDOR_EVENT, &qca->flags);
1374 		}
1375 	}
1376 
1377 	return ret;
1378 }
1379 
1380 static int qca_send_crashbuffer(struct hci_uart *hu)
1381 {
1382 	struct qca_data *qca = hu->priv;
1383 	struct sk_buff *skb;
1384 
1385 	skb = bt_skb_alloc(QCA_CRASHBYTE_PACKET_LEN, GFP_KERNEL);
1386 	if (!skb) {
1387 		bt_dev_err(hu->hdev, "Failed to allocate memory for skb packet");
1388 		return -ENOMEM;
1389 	}
1390 
1391 	/* We forcefully crash the controller, by sending 0xfb byte for
1392 	 * 1024 times. We also might have chance of losing data, To be
1393 	 * on safer side we send 1096 bytes to the SoC.
1394 	 */
1395 	memset(skb_put(skb, QCA_CRASHBYTE_PACKET_LEN), QCA_MEMDUMP_BYTE,
1396 	       QCA_CRASHBYTE_PACKET_LEN);
1397 	hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
1398 	bt_dev_info(hu->hdev, "crash the soc to collect controller dump");
1399 	skb_queue_tail(&qca->txq, skb);
1400 	hci_uart_tx_wakeup(hu);
1401 
1402 	return 0;
1403 }
1404 
1405 static void qca_wait_for_dump_collection(struct hci_dev *hdev)
1406 {
1407 	struct hci_uart *hu = hci_get_drvdata(hdev);
1408 	struct qca_data *qca = hu->priv;
1409 	struct qca_memdump_data *qca_memdump = qca->qca_memdump;
1410 	char *memdump_buf = NULL;
1411 
1412 	wait_on_bit_timeout(&qca->flags, QCA_MEMDUMP_COLLECTION,
1413 			    TASK_UNINTERRUPTIBLE, MEMDUMP_TIMEOUT_MS);
1414 
1415 	clear_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1416 	if (qca->memdump_state == QCA_MEMDUMP_IDLE) {
1417 		bt_dev_err(hu->hdev, "Clearing the buffers due to timeout");
1418 		if (qca_memdump)
1419 			memdump_buf = qca_memdump->memdump_buf_tail;
1420 		vfree(memdump_buf);
1421 		kfree(qca_memdump);
1422 		qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
1423 		del_timer(&qca->memdump_timer);
1424 		cancel_work_sync(&qca->ctrl_memdump_evt);
1425 	}
1426 }
1427 
1428 static void qca_hw_error(struct hci_dev *hdev, u8 code)
1429 {
1430 	struct hci_uart *hu = hci_get_drvdata(hdev);
1431 	struct qca_data *qca = hu->priv;
1432 
1433 	bt_dev_info(hdev, "mem_dump_status: %d", qca->memdump_state);
1434 
1435 	if (qca->memdump_state == QCA_MEMDUMP_IDLE) {
1436 		/* If hardware error event received for other than QCA
1437 		 * soc memory dump event, then we need to crash the SOC
1438 		 * and wait here for 8 seconds to get the dump packets.
1439 		 * This will block main thread to be on hold until we
1440 		 * collect dump.
1441 		 */
1442 		set_bit(QCA_MEMDUMP_COLLECTION, &qca->flags);
1443 		qca_send_crashbuffer(hu);
1444 		qca_wait_for_dump_collection(hdev);
1445 	} else if (qca->memdump_state == QCA_MEMDUMP_COLLECTING) {
1446 		/* Let us wait here until memory dump collected or
1447 		 * memory dump timer expired.
1448 		 */
1449 		bt_dev_info(hdev, "waiting for dump to complete");
1450 		qca_wait_for_dump_collection(hdev);
1451 	}
1452 }
1453 
1454 static void qca_cmd_timeout(struct hci_dev *hdev)
1455 {
1456 	struct hci_uart *hu = hci_get_drvdata(hdev);
1457 	struct qca_data *qca = hu->priv;
1458 
1459 	if (qca->memdump_state == QCA_MEMDUMP_IDLE)
1460 		qca_send_crashbuffer(hu);
1461 	else
1462 		bt_dev_info(hdev, "Dump collection is in process");
1463 }
1464 
1465 static int qca_wcn3990_init(struct hci_uart *hu)
1466 {
1467 	struct qca_serdev *qcadev;
1468 	int ret;
1469 
1470 	/* Check for vregs status, may be hci down has turned
1471 	 * off the voltage regulator.
1472 	 */
1473 	qcadev = serdev_device_get_drvdata(hu->serdev);
1474 	if (!qcadev->bt_power->vregs_on) {
1475 		serdev_device_close(hu->serdev);
1476 		ret = qca_regulator_enable(qcadev);
1477 		if (ret)
1478 			return ret;
1479 
1480 		ret = serdev_device_open(hu->serdev);
1481 		if (ret) {
1482 			bt_dev_err(hu->hdev, "failed to open port");
1483 			return ret;
1484 		}
1485 	}
1486 
1487 	/* Forcefully enable wcn3990 to enter in to boot mode. */
1488 	host_set_baudrate(hu, 2400);
1489 	ret = qca_send_power_pulse(hu, false);
1490 	if (ret)
1491 		return ret;
1492 
1493 	qca_set_speed(hu, QCA_INIT_SPEED);
1494 	ret = qca_send_power_pulse(hu, true);
1495 	if (ret)
1496 		return ret;
1497 
1498 	/* Now the device is in ready state to communicate with host.
1499 	 * To sync host with device we need to reopen port.
1500 	 * Without this, we will have RTS and CTS synchronization
1501 	 * issues.
1502 	 */
1503 	serdev_device_close(hu->serdev);
1504 	ret = serdev_device_open(hu->serdev);
1505 	if (ret) {
1506 		bt_dev_err(hu->hdev, "failed to open port");
1507 		return ret;
1508 	}
1509 
1510 	hci_uart_set_flow_control(hu, false);
1511 
1512 	return 0;
1513 }
1514 
1515 static int qca_power_on(struct hci_dev *hdev)
1516 {
1517 	struct hci_uart *hu = hci_get_drvdata(hdev);
1518 	enum qca_btsoc_type soc_type = qca_soc_type(hu);
1519 	struct qca_serdev *qcadev;
1520 	int ret = 0;
1521 
1522 	/* Non-serdev device usually is powered by external power
1523 	 * and don't need additional action in driver for power on
1524 	 */
1525 	if (!hu->serdev)
1526 		return 0;
1527 
1528 	if (qca_is_wcn399x(soc_type)) {
1529 		ret = qca_wcn3990_init(hu);
1530 	} else {
1531 		qcadev = serdev_device_get_drvdata(hu->serdev);
1532 		gpiod_set_value_cansleep(qcadev->bt_en, 1);
1533 		/* Controller needs time to bootup. */
1534 		msleep(150);
1535 	}
1536 
1537 	return ret;
1538 }
1539 
1540 static int qca_setup(struct hci_uart *hu)
1541 {
1542 	struct hci_dev *hdev = hu->hdev;
1543 	struct qca_data *qca = hu->priv;
1544 	unsigned int speed, qca_baudrate = QCA_BAUDRATE_115200;
1545 	unsigned int retries = 0;
1546 	enum qca_btsoc_type soc_type = qca_soc_type(hu);
1547 	const char *firmware_name = qca_get_firmware_name(hu);
1548 	int ret;
1549 	int soc_ver = 0;
1550 
1551 	ret = qca_check_speeds(hu);
1552 	if (ret)
1553 		return ret;
1554 
1555 	/* Patch downloading has to be done without IBS mode */
1556 	clear_bit(QCA_IBS_ENABLED, &qca->flags);
1557 
1558 	/* Enable controller to do both LE scan and BR/EDR inquiry
1559 	 * simultaneously.
1560 	 */
1561 	set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
1562 
1563 	bt_dev_info(hdev, "setting up %s",
1564 		qca_is_wcn399x(soc_type) ? "wcn399x" : "ROME");
1565 
1566 retry:
1567 	ret = qca_power_on(hdev);
1568 	if (ret)
1569 		return ret;
1570 
1571 	if (qca_is_wcn399x(soc_type)) {
1572 		set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
1573 
1574 		ret = qca_read_soc_version(hdev, &soc_ver, soc_type);
1575 		if (ret)
1576 			return ret;
1577 	} else {
1578 		qca_set_speed(hu, QCA_INIT_SPEED);
1579 	}
1580 
1581 	/* Setup user speed if needed */
1582 	speed = qca_get_speed(hu, QCA_OPER_SPEED);
1583 	if (speed) {
1584 		ret = qca_set_speed(hu, QCA_OPER_SPEED);
1585 		if (ret)
1586 			return ret;
1587 
1588 		qca_baudrate = qca_get_baudrate_value(speed);
1589 	}
1590 
1591 	if (!qca_is_wcn399x(soc_type)) {
1592 		/* Get QCA version information */
1593 		ret = qca_read_soc_version(hdev, &soc_ver, soc_type);
1594 		if (ret)
1595 			return ret;
1596 	}
1597 
1598 	bt_dev_info(hdev, "QCA controller version 0x%08x", soc_ver);
1599 	/* Setup patch / NVM configurations */
1600 	ret = qca_uart_setup(hdev, qca_baudrate, soc_type, soc_ver,
1601 			firmware_name);
1602 	if (!ret) {
1603 		set_bit(QCA_IBS_ENABLED, &qca->flags);
1604 		qca_debugfs_init(hdev);
1605 		hu->hdev->hw_error = qca_hw_error;
1606 		hu->hdev->cmd_timeout = qca_cmd_timeout;
1607 	} else if (ret == -ENOENT) {
1608 		/* No patch/nvm-config found, run with original fw/config */
1609 		ret = 0;
1610 	} else if (ret == -EAGAIN) {
1611 		/*
1612 		 * Userspace firmware loader will return -EAGAIN in case no
1613 		 * patch/nvm-config is found, so run with original fw/config.
1614 		 */
1615 		ret = 0;
1616 	} else {
1617 		if (retries < MAX_INIT_RETRIES) {
1618 			qca_power_shutdown(hu);
1619 			if (hu->serdev) {
1620 				serdev_device_close(hu->serdev);
1621 				ret = serdev_device_open(hu->serdev);
1622 				if (ret) {
1623 					bt_dev_err(hdev, "failed to open port");
1624 					return ret;
1625 				}
1626 			}
1627 			retries++;
1628 			goto retry;
1629 		}
1630 	}
1631 
1632 	/* Setup bdaddr */
1633 	if (qca_is_wcn399x(soc_type))
1634 		hu->hdev->set_bdaddr = qca_set_bdaddr;
1635 	else
1636 		hu->hdev->set_bdaddr = qca_set_bdaddr_rome;
1637 
1638 	return ret;
1639 }
1640 
1641 static const struct hci_uart_proto qca_proto = {
1642 	.id		= HCI_UART_QCA,
1643 	.name		= "QCA",
1644 	.manufacturer	= 29,
1645 	.init_speed	= 115200,
1646 	.oper_speed	= 3000000,
1647 	.open		= qca_open,
1648 	.close		= qca_close,
1649 	.flush		= qca_flush,
1650 	.setup		= qca_setup,
1651 	.recv		= qca_recv,
1652 	.enqueue	= qca_enqueue,
1653 	.dequeue	= qca_dequeue,
1654 };
1655 
1656 static const struct qca_vreg_data qca_soc_data_wcn3990 = {
1657 	.soc_type = QCA_WCN3990,
1658 	.vregs = (struct qca_vreg []) {
1659 		{ "vddio", 15000  },
1660 		{ "vddxo", 80000  },
1661 		{ "vddrf", 300000 },
1662 		{ "vddch0", 450000 },
1663 	},
1664 	.num_vregs = 4,
1665 };
1666 
1667 static const struct qca_vreg_data qca_soc_data_wcn3991 = {
1668 	.soc_type = QCA_WCN3991,
1669 	.vregs = (struct qca_vreg []) {
1670 		{ "vddio", 15000  },
1671 		{ "vddxo", 80000  },
1672 		{ "vddrf", 300000 },
1673 		{ "vddch0", 450000 },
1674 	},
1675 	.num_vregs = 4,
1676 };
1677 
1678 static const struct qca_vreg_data qca_soc_data_wcn3998 = {
1679 	.soc_type = QCA_WCN3998,
1680 	.vregs = (struct qca_vreg []) {
1681 		{ "vddio", 10000  },
1682 		{ "vddxo", 80000  },
1683 		{ "vddrf", 300000 },
1684 		{ "vddch0", 450000 },
1685 	},
1686 	.num_vregs = 4,
1687 };
1688 
1689 static void qca_power_shutdown(struct hci_uart *hu)
1690 {
1691 	struct qca_serdev *qcadev;
1692 	struct qca_data *qca = hu->priv;
1693 	unsigned long flags;
1694 	enum qca_btsoc_type soc_type = qca_soc_type(hu);
1695 
1696 	qcadev = serdev_device_get_drvdata(hu->serdev);
1697 
1698 	/* From this point we go into power off state. But serial port is
1699 	 * still open, stop queueing the IBS data and flush all the buffered
1700 	 * data in skb's.
1701 	 */
1702 	spin_lock_irqsave(&qca->hci_ibs_lock, flags);
1703 	clear_bit(QCA_IBS_ENABLED, &qca->flags);
1704 	qca_flush(hu);
1705 	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
1706 
1707 	hu->hdev->hw_error = NULL;
1708 	hu->hdev->cmd_timeout = NULL;
1709 
1710 	/* Non-serdev device usually is powered by external power
1711 	 * and don't need additional action in driver for power down
1712 	 */
1713 	if (!hu->serdev)
1714 		return;
1715 
1716 	if (qca_is_wcn399x(soc_type)) {
1717 		host_set_baudrate(hu, 2400);
1718 		qca_send_power_pulse(hu, false);
1719 		qca_regulator_disable(qcadev);
1720 	} else {
1721 		gpiod_set_value_cansleep(qcadev->bt_en, 0);
1722 	}
1723 }
1724 
1725 static int qca_power_off(struct hci_dev *hdev)
1726 {
1727 	struct hci_uart *hu = hci_get_drvdata(hdev);
1728 	struct qca_data *qca = hu->priv;
1729 
1730 	/* Stop sending shutdown command if soc crashes. */
1731 	if (qca->memdump_state == QCA_MEMDUMP_IDLE) {
1732 		qca_send_pre_shutdown_cmd(hdev);
1733 		usleep_range(8000, 10000);
1734 	}
1735 
1736 	qca->memdump_state = QCA_MEMDUMP_IDLE;
1737 	qca_power_shutdown(hu);
1738 	return 0;
1739 }
1740 
1741 static int qca_regulator_enable(struct qca_serdev *qcadev)
1742 {
1743 	struct qca_power *power = qcadev->bt_power;
1744 	int ret;
1745 
1746 	/* Already enabled */
1747 	if (power->vregs_on)
1748 		return 0;
1749 
1750 	BT_DBG("enabling %d regulators)", power->num_vregs);
1751 
1752 	ret = regulator_bulk_enable(power->num_vregs, power->vreg_bulk);
1753 	if (ret)
1754 		return ret;
1755 
1756 	power->vregs_on = true;
1757 
1758 	return 0;
1759 }
1760 
1761 static void qca_regulator_disable(struct qca_serdev *qcadev)
1762 {
1763 	struct qca_power *power;
1764 
1765 	if (!qcadev)
1766 		return;
1767 
1768 	power = qcadev->bt_power;
1769 
1770 	/* Already disabled? */
1771 	if (!power->vregs_on)
1772 		return;
1773 
1774 	regulator_bulk_disable(power->num_vregs, power->vreg_bulk);
1775 	power->vregs_on = false;
1776 }
1777 
1778 static int qca_init_regulators(struct qca_power *qca,
1779 				const struct qca_vreg *vregs, size_t num_vregs)
1780 {
1781 	struct regulator_bulk_data *bulk;
1782 	int ret;
1783 	int i;
1784 
1785 	bulk = devm_kcalloc(qca->dev, num_vregs, sizeof(*bulk), GFP_KERNEL);
1786 	if (!bulk)
1787 		return -ENOMEM;
1788 
1789 	for (i = 0; i < num_vregs; i++)
1790 		bulk[i].supply = vregs[i].name;
1791 
1792 	ret = devm_regulator_bulk_get(qca->dev, num_vregs, bulk);
1793 	if (ret < 0)
1794 		return ret;
1795 
1796 	for (i = 0; i < num_vregs; i++) {
1797 		ret = regulator_set_load(bulk[i].consumer, vregs[i].load_uA);
1798 		if (ret)
1799 			return ret;
1800 	}
1801 
1802 	qca->vreg_bulk = bulk;
1803 	qca->num_vregs = num_vregs;
1804 
1805 	return 0;
1806 }
1807 
1808 static int qca_serdev_probe(struct serdev_device *serdev)
1809 {
1810 	struct qca_serdev *qcadev;
1811 	struct hci_dev *hdev;
1812 	const struct qca_vreg_data *data;
1813 	int err;
1814 
1815 	qcadev = devm_kzalloc(&serdev->dev, sizeof(*qcadev), GFP_KERNEL);
1816 	if (!qcadev)
1817 		return -ENOMEM;
1818 
1819 	qcadev->serdev_hu.serdev = serdev;
1820 	data = device_get_match_data(&serdev->dev);
1821 	serdev_device_set_drvdata(serdev, qcadev);
1822 	device_property_read_string(&serdev->dev, "firmware-name",
1823 					 &qcadev->firmware_name);
1824 	if (data && qca_is_wcn399x(data->soc_type)) {
1825 		qcadev->btsoc_type = data->soc_type;
1826 		qcadev->bt_power = devm_kzalloc(&serdev->dev,
1827 						sizeof(struct qca_power),
1828 						GFP_KERNEL);
1829 		if (!qcadev->bt_power)
1830 			return -ENOMEM;
1831 
1832 		qcadev->bt_power->dev = &serdev->dev;
1833 		err = qca_init_regulators(qcadev->bt_power, data->vregs,
1834 					  data->num_vregs);
1835 		if (err) {
1836 			BT_ERR("Failed to init regulators:%d", err);
1837 			return err;
1838 		}
1839 
1840 		qcadev->bt_power->vregs_on = false;
1841 
1842 		device_property_read_u32(&serdev->dev, "max-speed",
1843 					 &qcadev->oper_speed);
1844 		if (!qcadev->oper_speed)
1845 			BT_DBG("UART will pick default operating speed");
1846 
1847 		err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
1848 		if (err) {
1849 			BT_ERR("wcn3990 serdev registration failed");
1850 			return err;
1851 		}
1852 	} else {
1853 		qcadev->btsoc_type = QCA_ROME;
1854 		qcadev->bt_en = devm_gpiod_get(&serdev->dev, "enable",
1855 					       GPIOD_OUT_LOW);
1856 		if (IS_ERR(qcadev->bt_en)) {
1857 			dev_err(&serdev->dev, "failed to acquire enable gpio\n");
1858 			return PTR_ERR(qcadev->bt_en);
1859 		}
1860 
1861 		qcadev->susclk = devm_clk_get(&serdev->dev, NULL);
1862 		if (IS_ERR(qcadev->susclk)) {
1863 			dev_err(&serdev->dev, "failed to acquire clk\n");
1864 			return PTR_ERR(qcadev->susclk);
1865 		}
1866 
1867 		err = clk_set_rate(qcadev->susclk, SUSCLK_RATE_32KHZ);
1868 		if (err)
1869 			return err;
1870 
1871 		err = clk_prepare_enable(qcadev->susclk);
1872 		if (err)
1873 			return err;
1874 
1875 		err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
1876 		if (err) {
1877 			BT_ERR("Rome serdev registration failed");
1878 			clk_disable_unprepare(qcadev->susclk);
1879 			return err;
1880 		}
1881 	}
1882 
1883 	hdev = qcadev->serdev_hu.hdev;
1884 	set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
1885 	hdev->shutdown = qca_power_off;
1886 
1887 	return 0;
1888 }
1889 
1890 static void qca_serdev_remove(struct serdev_device *serdev)
1891 {
1892 	struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev);
1893 
1894 	if (qca_is_wcn399x(qcadev->btsoc_type))
1895 		qca_power_shutdown(&qcadev->serdev_hu);
1896 	else
1897 		clk_disable_unprepare(qcadev->susclk);
1898 
1899 	hci_uart_unregister_device(&qcadev->serdev_hu);
1900 }
1901 
1902 static int __maybe_unused qca_suspend(struct device *dev)
1903 {
1904 	struct hci_dev *hdev = container_of(dev, struct hci_dev, dev);
1905 	struct hci_uart *hu = hci_get_drvdata(hdev);
1906 	struct qca_data *qca = hu->priv;
1907 	unsigned long flags;
1908 	int ret = 0;
1909 	u8 cmd;
1910 
1911 	set_bit(QCA_SUSPENDING, &qca->flags);
1912 
1913 	/* Device is downloading patch or doesn't support in-band sleep. */
1914 	if (!test_bit(QCA_IBS_ENABLED, &qca->flags))
1915 		return 0;
1916 
1917 	cancel_work_sync(&qca->ws_awake_device);
1918 	cancel_work_sync(&qca->ws_awake_rx);
1919 
1920 	spin_lock_irqsave_nested(&qca->hci_ibs_lock,
1921 				 flags, SINGLE_DEPTH_NESTING);
1922 
1923 	switch (qca->tx_ibs_state) {
1924 	case HCI_IBS_TX_WAKING:
1925 		del_timer(&qca->wake_retrans_timer);
1926 		/* Fall through */
1927 	case HCI_IBS_TX_AWAKE:
1928 		del_timer(&qca->tx_idle_timer);
1929 
1930 		serdev_device_write_flush(hu->serdev);
1931 		cmd = HCI_IBS_SLEEP_IND;
1932 		ret = serdev_device_write_buf(hu->serdev, &cmd, sizeof(cmd));
1933 
1934 		if (ret < 0) {
1935 			BT_ERR("Failed to send SLEEP to device");
1936 			break;
1937 		}
1938 
1939 		qca->tx_ibs_state = HCI_IBS_TX_ASLEEP;
1940 		qca->ibs_sent_slps++;
1941 
1942 		qca_wq_serial_tx_clock_vote_off(&qca->ws_tx_vote_off);
1943 		break;
1944 
1945 	case HCI_IBS_TX_ASLEEP:
1946 		break;
1947 
1948 	default:
1949 		BT_ERR("Spurious tx state %d", qca->tx_ibs_state);
1950 		ret = -EINVAL;
1951 		break;
1952 	}
1953 
1954 	spin_unlock_irqrestore(&qca->hci_ibs_lock, flags);
1955 
1956 	if (ret < 0)
1957 		goto error;
1958 
1959 	serdev_device_wait_until_sent(hu->serdev,
1960 				      msecs_to_jiffies(CMD_TRANS_TIMEOUT_MS));
1961 
1962 	/* Wait for HCI_IBS_SLEEP_IND sent by device to indicate its Tx is going
1963 	 * to sleep, so that the packet does not wake the system later.
1964 	 */
1965 
1966 	ret = wait_event_interruptible_timeout(qca->suspend_wait_q,
1967 			qca->rx_ibs_state == HCI_IBS_RX_ASLEEP,
1968 			msecs_to_jiffies(IBS_BTSOC_TX_IDLE_TIMEOUT_MS));
1969 
1970 	if (ret > 0)
1971 		return 0;
1972 
1973 	if (ret == 0)
1974 		ret = -ETIMEDOUT;
1975 
1976 error:
1977 	clear_bit(QCA_SUSPENDING, &qca->flags);
1978 
1979 	return ret;
1980 }
1981 
1982 static int __maybe_unused qca_resume(struct device *dev)
1983 {
1984 	struct hci_dev *hdev = container_of(dev, struct hci_dev, dev);
1985 	struct hci_uart *hu = hci_get_drvdata(hdev);
1986 	struct qca_data *qca = hu->priv;
1987 
1988 	clear_bit(QCA_SUSPENDING, &qca->flags);
1989 
1990 	return 0;
1991 }
1992 
1993 static SIMPLE_DEV_PM_OPS(qca_pm_ops, qca_suspend, qca_resume);
1994 
1995 static const struct of_device_id qca_bluetooth_of_match[] = {
1996 	{ .compatible = "qcom,qca6174-bt" },
1997 	{ .compatible = "qcom,wcn3990-bt", .data = &qca_soc_data_wcn3990},
1998 	{ .compatible = "qcom,wcn3991-bt", .data = &qca_soc_data_wcn3991},
1999 	{ .compatible = "qcom,wcn3998-bt", .data = &qca_soc_data_wcn3998},
2000 	{ /* sentinel */ }
2001 };
2002 MODULE_DEVICE_TABLE(of, qca_bluetooth_of_match);
2003 
2004 static struct serdev_device_driver qca_serdev_driver = {
2005 	.probe = qca_serdev_probe,
2006 	.remove = qca_serdev_remove,
2007 	.driver = {
2008 		.name = "hci_uart_qca",
2009 		.of_match_table = qca_bluetooth_of_match,
2010 		.pm = &qca_pm_ops,
2011 	},
2012 };
2013 
2014 int __init qca_init(void)
2015 {
2016 	serdev_device_driver_register(&qca_serdev_driver);
2017 
2018 	return hci_uart_register_proto(&qca_proto);
2019 }
2020 
2021 int __exit qca_deinit(void)
2022 {
2023 	serdev_device_driver_unregister(&qca_serdev_driver);
2024 
2025 	return hci_uart_unregister_proto(&qca_proto);
2026 }
2027