Warm reboot can not reset controller qca6390 due to
lack of controllable power supply, so causes firmware
download failure during enable.

Fixed by sending VSC EDL_SOC_RESET to reset qca6390
within added device shutdown implementation.
Signed-off-by: NZijun Hu <zijuhu@codeaurora.org>
Tested-by: NZijun Hu <zijuhu@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

@dev parameter of qca_suspend()/qca_resume() represents
serdev_device, but it is mistook for hci_dev and causes
succedent unexpected memory access.

Fix by taking @dev as serdev_device.

Fixes: 41d5b25f ("Bluetooth: hci_qca: add PM support")
Signed-off-by: NZijun Hu <zijuhu@codeaurora.org>
Reviewed-by: NMatthias Kaehlcke <mka@chromium.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

hdev is always allocated and not only when power control is required.
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NAbhishek Pandit-Subedi <abhishekpandit@chromium.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

WCN3991 supports transparent WBS (host encoded mSBC). Add a flag to the
device match data to show WBS is supported.

This requires the matching firmware for WCN3991 in linux-firmware:
        1a8b0dc00f77 (qca: Enable transparent WBS for WCN3991)
Signed-off-by: NAbhishek Pandit-Subedi <abhishekpandit@chromium.org>
Reviewed-by: NMatthias Kaehlcke <mka@chromium.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Move the read of max-speed from device-tree out of the qca_is_wcn399x
if block so oper_speed can be set for QCA9377 devices as well.
Suggested-by: NAbhishek Pandit-Subedi <abhishekpandit@chromium.org>
Signed-off-by: NChristian Hewitt <christianshewitt@gmail.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Add a compatible so QCA9377 devices can be defined in device-tree.
Signed-off-by: NChristian Hewitt <christianshewitt@gmail.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

This patch adds support for QCA6390, including the devicetree and acpi
compatible hwid matching, and patch/nvm downloading.
Signed-off-by: NRocky Liao <rjliao@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

This patch replaces devm_gpiod_get() with devm_gpiod_get_optional() to get
bt_en and replaces devm_clk_get() with devm_clk_get_optional() to get
susclk. It also uses NULL check to determine whether the resource is
available or not.

Fixes: 8a208b24 ("Bluetooth: hci_qca: Make bt_en and susclk not mandatory for QCA Rome")
Signed-off-by: NRocky Liao <rjliao@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

On some platforms the bt_en pin and susclk are default on and there
is no exposed resource to control them. This patch makes the bt_en
and susclk not mandatory to have BT work. It also will not set the
HCI_QUIRK_NON_PERSISTENT_SETUP and shutdown() callback if bt_en is
not available.
Signed-off-by: NRocky Liao <rjliao@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

QCA Rome doesn't support the pre-shutdown vendor hci command, this patch
will check the soc type in qca_power_off() and only send this command
for wcn399x.

Fixes: ae563183 ("Bluetooth: hci_qca: Enable power off/on support during hci down/up for QCA Rome")
Signed-off-by: NRocky Liao <rjliao@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

This patch will fix the below issues
 1. Discarding memory dump events if memdump state is moved to
    MEMDUMP_TIMEOUT.
 2. Fixed race conditions between qca_hw_error() and qca_controller_memdump
    while free memory dump buffers using mutex lock
 3. Moved timeout timer to delayed work queue
 4. Injecting HW error event in a case when dumps failed to receive and HW
    error event is not yet received.
 5. Clearing hw error and command timeout function callbacks before
    sending pre shutdown command.

 Collecting memory dump will follow any of the below sequence.

 Sequence 1:
   Receiving Memory dump events from the controller
   Received entire dump in stipulated time
   Received HW error event from the controller
   Controller Reset from HOST

 Sequence 2:
   Receiving Memory dump events from the controller
   Failed to Receive entire dump in stipulated time
   A Timeout schedules and if no HW error event received a fake HW
     error event will be injected.
   Controller Reset from HOST.

 Sequence 3:
   Received HW error event
   HOST trigger SSR by sending crash packet to controller.
   Received entire dump in stipulated time
   Controller Reset from HOST

Fixes: d841502c ("Bluetooth: hci_qca: Collect controller memory dump during SSR")
Reported-by: NAbhishek Pandit-Subedi <abhishekpandit@chromium.org>
Signed-off-by: NVenkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
Reviewed-by: NAbhishek Pandit-Subedi <abhishekpandit@chromium.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

* Directly passing clock pointer to clock code without checking for NULL
  as clock code takes care of it
* Removed the comment which was not necessary
* Updated code for return in qca_regulator_enable()
Signed-off-by: NVenkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Instead of relying on other subsytem to turn ON clocks
required for BT SoC to operate, voting them from the driver.
Signed-off-by: NVenkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

This patch registers hdev->shutdown() callback and also sets
HCI_QUIRK_NON_PERSISTENT_SETUP for QCA Rome. It will power-off the BT chip
during hci down and power-on/initialize the chip again during hci up. As
wcn399x already enabled this, this patch also removed the callback register
and QUIRK setting in qca_setup() for wcn399x and uniformly do this in the
probe() routine.
Signed-off-by: NRocky Liao <rjliao@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

This patch adds the retry of btsoc initialization when it fails. There are
reports that the btsoc initialization may fail on some platforms but the
repro ratio is very low. The symptoms is the firmware downloading failed
due to the UART write timed out. The failure may be caused by UART,
platform HW or the btsoc itself but it's very difficlut to root cause,
given the repro ratio is very low. Add a retry for the btsoc initialization
can work around most of the failures and make Bluetooth finally works.
Signed-off-by: NRocky Liao <rjliao@codeaurora.org>
Reviewed-by: NMatthias Kaehlcke <mka@chromium.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Current qca_power_shutdown() only supports wcn399x, this patch adds Rome
power off support to it. For Rome it just needs to pull down the bt_en
GPIO to power off it. This patch also replaces all the power off operation
in qca_close() with the unified qca_power_shutdown() call.
Signed-off-by: NRocky Liao <rjliao@codeaurora.org>
Reviewed-by: NMatthias Kaehlcke <mka@chromium.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

This patch adds a unified API qca_power_on() to support both wcn399x and
Rome power on. For wcn399x it calls the qca_wcn3990_init() to init the
regulators, and for Rome it pulls up the bt_en GPIO to power up the btsoc.
It also moves all the power up operation from hdev->open() to
hdev->setup().
Signed-off-by: NRocky Liao <rjliao@codeaurora.org>
Reviewed-by: NMatthias Kaehlcke <mka@chromium.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Fixes gcc '-Wunused-but-set-variable' warning:

drivers/bluetooth/hci_qca.c: In function 'qca_controller_memdump':
drivers/bluetooth/hci_qca.c:980:6: warning:
 variable 'opcode' set but not used [-Wunused-but-set-variable]

It is never used since commit d841502c ("Bluetooth: hci_qca: Collect
controller memory dump during SSR"), so remove it.
Reported-by: NHulk Robot <hulkci@huawei.com>
Signed-off-by: NYueHaibing <yuehaibing@huawei.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Use vfree() instead of kfree() to free vmalloc()
allocated data.

Fixes: d841502c ("Bluetooth: hci_qca: Collect controller memory dump during SSR")
Signed-off-by: NWei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: NBalakrishna Godavarthi <bgodavar@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

We will collect the ramdump of BT controller when hardware error event
received before rebooting the HCI layer. Before restarting a subsystem
or a process running on a subsystem, it is often required to request
either a subsystem or a process to perform proper cache dump and
software failure reason into a memory buffer which application
processor can retrieve afterwards. SW developers can often provide
initial investigation by looking into that debugging information.
Signed-off-by: NBalakrishna Godavarthi <bgodavar@codeaurora.org>
Signed-off-by: NVenkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Replace of_device_get_match_data with device_get_match_data to make driver
work across platforms.
Signed-off-by: NRocky Liao <rjliao@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

This patch add support for WCN3991 i.e. current values and fw download
support.
Signed-off-by: NBalakrishna Godavarthi <bgodavar@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Add PM suspend/resume callbacks for hci_qca driver.

BT host will make sure both Rx and Tx go into sleep state in
qca_suspend. Without this, Tx may still remain in awake state, which
prevents BTSOC from entering deep sleep. For example, BlueZ will send
Set Event Mask to device when suspending and this will wake the device
Rx up. However, the Tx idle timeout on the host side is 2000 ms. If the
host is suspended before its Tx idle times out, it won't send
HCI_IBS_SLEEP_IND to the device and the device Rx will remain awake.

We implement this by canceling relevant work in workqueue, sending
HCI_IBS_SLEEP_IND to the device and then waiting HCI_IBS_SLEEP_IND sent
by the device.

In order to prevent the device from being awaken again after qca_suspend
is called, we introduce QCA_SUSPEND flag. QCA_SUSPEND is set in the
beginning of qca_suspend to indicate system is suspending and that we'd
like to ignore any further wake events.

With QCA_SUSPEND and spinlock, we can avoid race condition, e.g. if
qca_enqueue acquires qca->hci_ibs_lock before qca_suspend calls
cancel_work_sync and then qca_enqueue adds a new qca->ws_awake_device
work after the previous one is cancelled.

If BTSOC wants to wake the whole system up after qca_suspend is called,
it will keep sending HCI_IBS_WAKE_IND and uart driver will take care of
waking the system. For example, uart driver will reconfigure its Rx pin
to a normal GPIO pin and enable irq wake on that pin when suspending.
Once host detects Rx falling, the system will begin resuming. Then, the
BT host clears QCA_SUSPEND flag in qca_resume and begins dealing with
normal HCI packets. By doing so, only a few HCI_IBS_WAKE_IND packets are
lost and there is no data packet loss.
Signed-off-by: NClaire Chang <tientzu@chromium.org>
Reviewed-by: NBalakrishna Godavarthi <bgodavar@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

This reverts commit cde9dde6.

The frame reassembly errors were root caused to a transient gpio issue.
The missing response was root caused to an issue with properly managing
RFR in the uart driver.  Addressing those root causes occurs outside of
hci_qca and eliminates the need for the 50ms delay, so remove it.
Signed-off-by: NJeffrey Hugo <jeffrey.l.hugo@gmail.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Split and rename qca_power_setup() in order to simplify each code path
and to clarify that it is unrelated to qca_power_off() and
qca_power_setup().
Signed-off-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

With the regulator_set_load() and regulator_set_voltage() out of the
enable/disable code paths the code can now use the standard
regulator bulk enable/disable API.

By cloning num_vregs into struct qca_power there's no need to lug around
a reference to the struct qca_vreg_data, which further simplifies
qca_power_setup().
Signed-off-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Devices with specific voltage requirements should not request voltage
from the driver, but instead rely on the system configuration to define
appropriate voltages for each rail.

This ensures that PMIC and board variations are accounted for, something
that the 0.1V range in the hci_qca driver currently tries to address.
But on the Lenovo Yoga C630 (with wcn3990) vddch0 is 3.1V, which means
the driver will fail to set the voltage.
Signed-off-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Since the introduction of '5451781d ("regulator: core: Only count
load for enabled consumers")' in v5.0, the requested load of a regulator
consumer is only accounted for when said consumer is voted enabled.

So there's no need to vote for load ever time the regulator is
enabled or disabled.
Signed-off-by: NBjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

On the msm8998 mtp, the response to the baudrate change command is never
received.  On the Lenovo Miix 630, the response to the baudrate change
command is corrupted - "Frame reassembly failed (-84)".

Adding a 50ms delay before re-enabling flow to receive the baudrate change
command response from the wcn3990 addesses both issues, and allows
bluetooth to become functional.
Signed-off-by: NJeffrey Hugo <jeffrey.l.hugo@gmail.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

When SoC receives pre shut down command, it share the same
with other COEX shared clients. So SoC needs a short time
after sending VS pre shutdown command before turning off
the regulators and sending the power off pulse. Along with
short delay, needs to wait for command complete event for
Pre shutdown VS command
Signed-off-by: NHarish Bandi <c-hbandi@codeaurora.org>
Reviewed-by: NBalakrishna Godavarthi <bgodavar@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

QCA UART Bluetooth controllers can do both LE scan and BR/EDR inquiry
at once, need to set HCI_QUIRK_SIMULTANEOUS_DISCOVERY quirk.
Signed-off-by: NRocky Liao <rjliao@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Static structure qca_proto, of type hci_uart_proto, is used four times:
as the last argument in function hci_uart_register_device(), and as the
only argument to functions hci_uart_register_proto() and
hci_uart_unregister_proto(). In all three of these functions, the
parameter corresponding to qca_proto is declared as constant. Therefore,
make qca_proto itself constant as well in order to protect it from
unintended modification.
Issue found with Coccinelle.
Signed-off-by: NNishka Dasgupta <nishkadg.linux@gmail.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

The qca_data structure is allocated with kzalloc() and hence
zero-initialized. Remove a bunch of unnecessary explicit
initializations of struct members to zero.
Signed-off-by: NMatthias Kaehlcke <mka@chromium.org>
Reviewed-by: NBalakrishna Godavarthi <bgodavar@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Looks like Deadlock is observed in hci_qca while performing
stress and stability tests. Since same lock is getting
acquired from qca_wq_awake_rx and hci_ibs_tx_idle_timeout
seeing spinlock recursion, irqs should be disable while
acquiring the spinlock always.
Signed-off-by: NHarish Bandi <c-hbandi@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Don't fall through to print error message when receive sleep indication
in HCI_IBS_RX_ASLEEP state, this is allowed behavior.
Signed-off-by: NRocky Liao <rjliao@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

WCN399x chips are coex chips, it needs a VS pre shutdown
command while turning off the BT. So that chip can inform
BT is OFF to other active clients.
Signed-off-by: NHarish Bandi <c-hbandi@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Use kfree_skb() instead of kfree() to free sk_buff.

Fixes: 2faa3f15 ("Bluetooth: hci_qca: wcn3990: Drop baudrate change vendor event")
Signed-off-by: NWei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: NMatthias Kaehlcke <mka@chromium.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset()
functions which are called by the certain HCI UART protocols (hci_ath,
hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control()
or directly. This leads to an execution at NULL and can be triggered by
an unprivileged user. Fix this by adding a helper function and a check
for the missing tty operations in the protocols code.

This fixes CVE-2019-10207. The Fixes: lines list commits where calls to
tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART
protocols.

Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50
Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org # v2.6.36+
Fixes: b3190df6 ("Bluetooth: Support for Atheros AR300x serial chip")
Fixes: 118612fb ("Bluetooth: hci_bcm: Add suspend/resume PM functions")
Fixes: ff289559 ("Bluetooth: hci_intel: Add Intel baudrate configuration support")
Fixes: 162f812f ("Bluetooth: hci_uart: Add Marvell support")
Fixes: fa9ad876 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990")
Signed-off-by: NVladis Dronov <vdronov@redhat.com>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>
Reviewed-by: NYu-Chen, Cho <acho@suse.com>
Tested-by: NYu-Chen, Cho <acho@suse.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

QCA BTSOC NVM is a customized firmware file and different vendors may
want to have different BTSOC configuration (e.g. Configure SCO over PCM
or I2S, Setting Tx power, etc.) via this file. This patch will allow
vendors to download different NVM firmware file by reading a device
property "firmware-name".
Signed-off-by: NRocky Liao <rjliao@codeaurora.org>
Tested-by: NHarish Bandi <c-hbandi@codeaurora.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>

Firmware download to the WCN3990 often fails with a 'TLV response size
mismatch' error:

[  133.064659] Bluetooth: hci0: setting up wcn3990
[  133.489150] Bluetooth: hci0: QCA controller version 0x02140201
[  133.495245] Bluetooth: hci0: QCA Downloading qca/crbtfw21.tlv
[  133.507214] Bluetooth: hci0: QCA TLV response size mismatch
[  133.513265] Bluetooth: hci0: QCA Failed to download patch (-84)

This is caused by a vendor event that corresponds to an earlier command
to change the baudrate. The event is not processed in the context of the
baudrate change and is later interpreted as response to the firmware
download command (which is also a vendor command), but the driver detects
that the event doesn't have the expected amount of associated data.

More details:

For the WCN3990 the vendor command for a baudrate change isn't sent as
synchronous HCI command, because the controller sends the corresponding
vendor event with the new baudrate. The event is received and decoded
after the baudrate change of the host port.

Identify the 'unused' event when it is received and don't add it to
the queue of RX frames.
Signed-off-by: NMatthias Kaehlcke <mka@chromium.org>
Signed-off-by: NMarcel Holtmann <marcel@holtmann.org>