GNU Linux-libre 5.10.219-gnu1
[releases.git] / drivers / rpmsg / qcom_smd.c
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Copyright (c) 2015, Sony Mobile Communications AB.
4  * Copyright (c) 2012-2013, The Linux Foundation. All rights reserved.
5  */
6
7 #include <linux/interrupt.h>
8 #include <linux/io.h>
9 #include <linux/mailbox_client.h>
10 #include <linux/mfd/syscon.h>
11 #include <linux/module.h>
12 #include <linux/of_irq.h>
13 #include <linux/of_platform.h>
14 #include <linux/platform_device.h>
15 #include <linux/regmap.h>
16 #include <linux/sched.h>
17 #include <linux/sizes.h>
18 #include <linux/slab.h>
19 #include <linux/soc/qcom/smem.h>
20 #include <linux/wait.h>
21 #include <linux/rpmsg.h>
22 #include <linux/rpmsg/qcom_smd.h>
23
24 #include "rpmsg_internal.h"
25
26 /*
27  * The Qualcomm Shared Memory communication solution provides point-to-point
28  * channels for clients to send and receive streaming or packet based data.
29  *
30  * Each channel consists of a control item (channel info) and a ring buffer
31  * pair. The channel info carry information related to channel state, flow
32  * control and the offsets within the ring buffer.
33  *
34  * All allocated channels are listed in an allocation table, identifying the
35  * pair of items by name, type and remote processor.
36  *
37  * Upon creating a new channel the remote processor allocates channel info and
38  * ring buffer items from the smem heap and populate the allocation table. An
39  * interrupt is sent to the other end of the channel and a scan for new
40  * channels should be done. A channel never goes away, it will only change
41  * state.
42  *
43  * The remote processor signals it intent for bring up the communication
44  * channel by setting the state of its end of the channel to "opening" and
45  * sends out an interrupt. We detect this change and register a smd device to
46  * consume the channel. Upon finding a consumer we finish the handshake and the
47  * channel is up.
48  *
49  * Upon closing a channel, the remote processor will update the state of its
50  * end of the channel and signal us, we will then unregister any attached
51  * device and close our end of the channel.
52  *
53  * Devices attached to a channel can use the qcom_smd_send function to push
54  * data to the channel, this is done by copying the data into the tx ring
55  * buffer, updating the pointers in the channel info and signaling the remote
56  * processor.
57  *
58  * The remote processor does the equivalent when it transfer data and upon
59  * receiving the interrupt we check the channel info for new data and delivers
60  * this to the attached device. If the device is not ready to receive the data
61  * we leave it in the ring buffer for now.
62  */
63
64 struct smd_channel_info;
65 struct smd_channel_info_pair;
66 struct smd_channel_info_word;
67 struct smd_channel_info_word_pair;
68
69 static const struct rpmsg_endpoint_ops qcom_smd_endpoint_ops;
70
71 #define SMD_ALLOC_TBL_COUNT     2
72 #define SMD_ALLOC_TBL_SIZE      64
73
74 /*
75  * This lists the various smem heap items relevant for the allocation table and
76  * smd channel entries.
77  */
78 static const struct {
79         unsigned alloc_tbl_id;
80         unsigned info_base_id;
81         unsigned fifo_base_id;
82 } smem_items[SMD_ALLOC_TBL_COUNT] = {
83         {
84                 .alloc_tbl_id = 13,
85                 .info_base_id = 14,
86                 .fifo_base_id = 338
87         },
88         {
89                 .alloc_tbl_id = 266,
90                 .info_base_id = 138,
91                 .fifo_base_id = 202,
92         },
93 };
94
95 /**
96  * struct qcom_smd_edge - representing a remote processor
97  * @dev:                device associated with this edge
98  * @name:               name of this edge
99  * @of_node:            of_node handle for information related to this edge
100  * @edge_id:            identifier of this edge
101  * @remote_pid:         identifier of remote processor
102  * @irq:                interrupt for signals on this edge
103  * @ipc_regmap:         regmap handle holding the outgoing ipc register
104  * @ipc_offset:         offset within @ipc_regmap of the register for ipc
105  * @ipc_bit:            bit in the register at @ipc_offset of @ipc_regmap
106  * @mbox_client:        mailbox client handle
107  * @mbox_chan:          apcs ipc mailbox channel handle
108  * @channels:           list of all channels detected on this edge
109  * @channels_lock:      guard for modifications of @channels
110  * @allocated:          array of bitmaps representing already allocated channels
111  * @smem_available:     last available amount of smem triggering a channel scan
112  * @new_channel_event:  wait queue for new channel events
113  * @scan_work:          work item for discovering new channels
114  * @state_work:         work item for edge state changes
115  */
116 struct qcom_smd_edge {
117         struct device dev;
118
119         const char *name;
120
121         struct device_node *of_node;
122         unsigned edge_id;
123         unsigned remote_pid;
124
125         int irq;
126
127         struct regmap *ipc_regmap;
128         int ipc_offset;
129         int ipc_bit;
130
131         struct mbox_client mbox_client;
132         struct mbox_chan *mbox_chan;
133
134         struct list_head channels;
135         spinlock_t channels_lock;
136
137         DECLARE_BITMAP(allocated[SMD_ALLOC_TBL_COUNT], SMD_ALLOC_TBL_SIZE);
138
139         unsigned smem_available;
140
141         wait_queue_head_t new_channel_event;
142
143         struct work_struct scan_work;
144         struct work_struct state_work;
145 };
146
147 /*
148  * SMD channel states.
149  */
150 enum smd_channel_state {
151         SMD_CHANNEL_CLOSED,
152         SMD_CHANNEL_OPENING,
153         SMD_CHANNEL_OPENED,
154         SMD_CHANNEL_FLUSHING,
155         SMD_CHANNEL_CLOSING,
156         SMD_CHANNEL_RESET,
157         SMD_CHANNEL_RESET_OPENING
158 };
159
160 struct qcom_smd_device {
161         struct rpmsg_device rpdev;
162
163         struct qcom_smd_edge *edge;
164 };
165
166 struct qcom_smd_endpoint {
167         struct rpmsg_endpoint ept;
168
169         struct qcom_smd_channel *qsch;
170 };
171
172 #define to_smd_device(r)        container_of(r, struct qcom_smd_device, rpdev)
173 #define to_smd_edge(d)          container_of(d, struct qcom_smd_edge, dev)
174 #define to_smd_endpoint(e)      container_of(e, struct qcom_smd_endpoint, ept)
175
176 /**
177  * struct qcom_smd_channel - smd channel struct
178  * @edge:               qcom_smd_edge this channel is living on
179  * @qsept:              reference to a associated smd endpoint
180  * @registered:         flag to indicate if the channel is registered
181  * @name:               name of the channel
182  * @state:              local state of the channel
183  * @remote_state:       remote state of the channel
184  * @state_change_event: state change event
185  * @info:               byte aligned outgoing/incoming channel info
186  * @info_word:          word aligned outgoing/incoming channel info
187  * @tx_lock:            lock to make writes to the channel mutually exclusive
188  * @fblockread_event:   wakeup event tied to tx fBLOCKREADINTR
189  * @tx_fifo:            pointer to the outgoing ring buffer
190  * @rx_fifo:            pointer to the incoming ring buffer
191  * @fifo_size:          size of each ring buffer
192  * @bounce_buffer:      bounce buffer for reading wrapped packets
193  * @cb:                 callback function registered for this channel
194  * @recv_lock:          guard for rx info modifications and cb pointer
195  * @pkt_size:           size of the currently handled packet
196  * @drvdata:            driver private data
197  * @list:               lite entry for @channels in qcom_smd_edge
198  */
199 struct qcom_smd_channel {
200         struct qcom_smd_edge *edge;
201
202         struct qcom_smd_endpoint *qsept;
203         bool registered;
204
205         char *name;
206         enum smd_channel_state state;
207         enum smd_channel_state remote_state;
208         wait_queue_head_t state_change_event;
209
210         struct smd_channel_info_pair *info;
211         struct smd_channel_info_word_pair *info_word;
212
213         spinlock_t tx_lock;
214         wait_queue_head_t fblockread_event;
215
216         void *tx_fifo;
217         void *rx_fifo;
218         int fifo_size;
219
220         void *bounce_buffer;
221
222         spinlock_t recv_lock;
223
224         int pkt_size;
225
226         void *drvdata;
227
228         struct list_head list;
229 };
230
231 /*
232  * Format of the smd_info smem items, for byte aligned channels.
233  */
234 struct smd_channel_info {
235         __le32 state;
236         u8  fDSR;
237         u8  fCTS;
238         u8  fCD;
239         u8  fRI;
240         u8  fHEAD;
241         u8  fTAIL;
242         u8  fSTATE;
243         u8  fBLOCKREADINTR;
244         __le32 tail;
245         __le32 head;
246 };
247
248 struct smd_channel_info_pair {
249         struct smd_channel_info tx;
250         struct smd_channel_info rx;
251 };
252
253 /*
254  * Format of the smd_info smem items, for word aligned channels.
255  */
256 struct smd_channel_info_word {
257         __le32 state;
258         __le32 fDSR;
259         __le32 fCTS;
260         __le32 fCD;
261         __le32 fRI;
262         __le32 fHEAD;
263         __le32 fTAIL;
264         __le32 fSTATE;
265         __le32 fBLOCKREADINTR;
266         __le32 tail;
267         __le32 head;
268 };
269
270 struct smd_channel_info_word_pair {
271         struct smd_channel_info_word tx;
272         struct smd_channel_info_word rx;
273 };
274
275 #define GET_RX_CHANNEL_FLAG(channel, param)                                  \
276         ({                                                                   \
277                 BUILD_BUG_ON(sizeof(channel->info->rx.param) != sizeof(u8)); \
278                 channel->info_word ?                                         \
279                         le32_to_cpu(channel->info_word->rx.param) :          \
280                         channel->info->rx.param;                             \
281         })
282
283 #define GET_RX_CHANNEL_INFO(channel, param)                                   \
284         ({                                                                    \
285                 BUILD_BUG_ON(sizeof(channel->info->rx.param) != sizeof(u32)); \
286                 le32_to_cpu(channel->info_word ?                              \
287                         channel->info_word->rx.param :                        \
288                         channel->info->rx.param);                             \
289         })
290
291 #define SET_RX_CHANNEL_FLAG(channel, param, value)                           \
292         ({                                                                   \
293                 BUILD_BUG_ON(sizeof(channel->info->rx.param) != sizeof(u8)); \
294                 if (channel->info_word)                                      \
295                         channel->info_word->rx.param = cpu_to_le32(value);   \
296                 else                                                         \
297                         channel->info->rx.param = value;                     \
298         })
299
300 #define SET_RX_CHANNEL_INFO(channel, param, value)                            \
301         ({                                                                    \
302                 BUILD_BUG_ON(sizeof(channel->info->rx.param) != sizeof(u32)); \
303                 if (channel->info_word)                                       \
304                         channel->info_word->rx.param = cpu_to_le32(value);    \
305                 else                                                          \
306                         channel->info->rx.param = cpu_to_le32(value);         \
307         })
308
309 #define GET_TX_CHANNEL_FLAG(channel, param)                                  \
310         ({                                                                   \
311                 BUILD_BUG_ON(sizeof(channel->info->tx.param) != sizeof(u8)); \
312                 channel->info_word ?                                         \
313                         le32_to_cpu(channel->info_word->tx.param) :          \
314                         channel->info->tx.param;                             \
315         })
316
317 #define GET_TX_CHANNEL_INFO(channel, param)                                   \
318         ({                                                                    \
319                 BUILD_BUG_ON(sizeof(channel->info->tx.param) != sizeof(u32)); \
320                 le32_to_cpu(channel->info_word ?                              \
321                         channel->info_word->tx.param :                        \
322                         channel->info->tx.param);                             \
323         })
324
325 #define SET_TX_CHANNEL_FLAG(channel, param, value)                           \
326         ({                                                                   \
327                 BUILD_BUG_ON(sizeof(channel->info->tx.param) != sizeof(u8)); \
328                 if (channel->info_word)                                      \
329                         channel->info_word->tx.param = cpu_to_le32(value);   \
330                 else                                                         \
331                         channel->info->tx.param = value;                     \
332         })
333
334 #define SET_TX_CHANNEL_INFO(channel, param, value)                            \
335         ({                                                                    \
336                 BUILD_BUG_ON(sizeof(channel->info->tx.param) != sizeof(u32)); \
337                 if (channel->info_word)                                       \
338                         channel->info_word->tx.param = cpu_to_le32(value);   \
339                 else                                                          \
340                         channel->info->tx.param = cpu_to_le32(value);         \
341         })
342
343 /**
344  * struct qcom_smd_alloc_entry - channel allocation entry
345  * @name:       channel name
346  * @cid:        channel index
347  * @flags:      channel flags and edge id
348  * @ref_count:  reference count of the channel
349  */
350 struct qcom_smd_alloc_entry {
351         u8 name[20];
352         __le32 cid;
353         __le32 flags;
354         __le32 ref_count;
355 } __packed;
356
357 #define SMD_CHANNEL_FLAGS_EDGE_MASK     0xff
358 #define SMD_CHANNEL_FLAGS_STREAM        BIT(8)
359 #define SMD_CHANNEL_FLAGS_PACKET        BIT(9)
360
361 /*
362  * Each smd packet contains a 20 byte header, with the first 4 being the length
363  * of the packet.
364  */
365 #define SMD_PACKET_HEADER_LEN   20
366
367 /*
368  * Signal the remote processor associated with 'channel'.
369  */
370 static void qcom_smd_signal_channel(struct qcom_smd_channel *channel)
371 {
372         struct qcom_smd_edge *edge = channel->edge;
373
374         if (edge->mbox_chan) {
375                 /*
376                  * We can ignore a failing mbox_send_message() as the only
377                  * possible cause is that the FIFO in the framework is full of
378                  * other writes to the same bit.
379                  */
380                 mbox_send_message(edge->mbox_chan, NULL);
381                 mbox_client_txdone(edge->mbox_chan, 0);
382         } else {
383                 regmap_write(edge->ipc_regmap, edge->ipc_offset, BIT(edge->ipc_bit));
384         }
385 }
386
387 /*
388  * Initialize the tx channel info
389  */
390 static void qcom_smd_channel_reset(struct qcom_smd_channel *channel)
391 {
392         SET_TX_CHANNEL_INFO(channel, state, SMD_CHANNEL_CLOSED);
393         SET_TX_CHANNEL_FLAG(channel, fDSR, 0);
394         SET_TX_CHANNEL_FLAG(channel, fCTS, 0);
395         SET_TX_CHANNEL_FLAG(channel, fCD, 0);
396         SET_TX_CHANNEL_FLAG(channel, fRI, 0);
397         SET_TX_CHANNEL_FLAG(channel, fHEAD, 0);
398         SET_TX_CHANNEL_FLAG(channel, fTAIL, 0);
399         SET_TX_CHANNEL_FLAG(channel, fSTATE, 1);
400         SET_TX_CHANNEL_FLAG(channel, fBLOCKREADINTR, 1);
401         SET_TX_CHANNEL_INFO(channel, head, 0);
402         SET_RX_CHANNEL_INFO(channel, tail, 0);
403
404         qcom_smd_signal_channel(channel);
405
406         channel->state = SMD_CHANNEL_CLOSED;
407         channel->pkt_size = 0;
408 }
409
410 /*
411  * Set the callback for a channel, with appropriate locking
412  */
413 static void qcom_smd_channel_set_callback(struct qcom_smd_channel *channel,
414                                           rpmsg_rx_cb_t cb)
415 {
416         struct rpmsg_endpoint *ept = &channel->qsept->ept;
417         unsigned long flags;
418
419         spin_lock_irqsave(&channel->recv_lock, flags);
420         ept->cb = cb;
421         spin_unlock_irqrestore(&channel->recv_lock, flags);
422 };
423
424 /*
425  * Calculate the amount of data available in the rx fifo
426  */
427 static size_t qcom_smd_channel_get_rx_avail(struct qcom_smd_channel *channel)
428 {
429         unsigned head;
430         unsigned tail;
431
432         head = GET_RX_CHANNEL_INFO(channel, head);
433         tail = GET_RX_CHANNEL_INFO(channel, tail);
434
435         return (head - tail) & (channel->fifo_size - 1);
436 }
437
438 /*
439  * Set tx channel state and inform the remote processor
440  */
441 static void qcom_smd_channel_set_state(struct qcom_smd_channel *channel,
442                                        int state)
443 {
444         struct qcom_smd_edge *edge = channel->edge;
445         bool is_open = state == SMD_CHANNEL_OPENED;
446
447         if (channel->state == state)
448                 return;
449
450         dev_dbg(&edge->dev, "set_state(%s, %d)\n", channel->name, state);
451
452         SET_TX_CHANNEL_FLAG(channel, fDSR, is_open);
453         SET_TX_CHANNEL_FLAG(channel, fCTS, is_open);
454         SET_TX_CHANNEL_FLAG(channel, fCD, is_open);
455
456         SET_TX_CHANNEL_INFO(channel, state, state);
457         SET_TX_CHANNEL_FLAG(channel, fSTATE, 1);
458
459         channel->state = state;
460         qcom_smd_signal_channel(channel);
461 }
462
463 /*
464  * Copy count bytes of data using 32bit accesses, if that's required.
465  */
466 static void smd_copy_to_fifo(void __iomem *dst,
467                              const void *src,
468                              size_t count,
469                              bool word_aligned)
470 {
471         if (word_aligned) {
472                 __iowrite32_copy(dst, src, count / sizeof(u32));
473         } else {
474                 memcpy_toio(dst, src, count);
475         }
476 }
477
478 /*
479  * Copy count bytes of data using 32bit accesses, if that is required.
480  */
481 static void smd_copy_from_fifo(void *dst,
482                                const void __iomem *src,
483                                size_t count,
484                                bool word_aligned)
485 {
486         if (word_aligned) {
487                 __ioread32_copy(dst, src, count / sizeof(u32));
488         } else {
489                 memcpy_fromio(dst, src, count);
490         }
491 }
492
493 /*
494  * Read count bytes of data from the rx fifo into buf, but don't advance the
495  * tail.
496  */
497 static size_t qcom_smd_channel_peek(struct qcom_smd_channel *channel,
498                                     void *buf, size_t count)
499 {
500         bool word_aligned;
501         unsigned tail;
502         size_t len;
503
504         word_aligned = channel->info_word;
505         tail = GET_RX_CHANNEL_INFO(channel, tail);
506
507         len = min_t(size_t, count, channel->fifo_size - tail);
508         if (len) {
509                 smd_copy_from_fifo(buf,
510                                    channel->rx_fifo + tail,
511                                    len,
512                                    word_aligned);
513         }
514
515         if (len != count) {
516                 smd_copy_from_fifo(buf + len,
517                                    channel->rx_fifo,
518                                    count - len,
519                                    word_aligned);
520         }
521
522         return count;
523 }
524
525 /*
526  * Advance the rx tail by count bytes.
527  */
528 static void qcom_smd_channel_advance(struct qcom_smd_channel *channel,
529                                      size_t count)
530 {
531         unsigned tail;
532
533         tail = GET_RX_CHANNEL_INFO(channel, tail);
534         tail += count;
535         tail &= (channel->fifo_size - 1);
536         SET_RX_CHANNEL_INFO(channel, tail, tail);
537 }
538
539 /*
540  * Read out a single packet from the rx fifo and deliver it to the device
541  */
542 static int qcom_smd_channel_recv_single(struct qcom_smd_channel *channel)
543 {
544         struct rpmsg_endpoint *ept = &channel->qsept->ept;
545         unsigned tail;
546         size_t len;
547         void *ptr;
548         int ret;
549
550         tail = GET_RX_CHANNEL_INFO(channel, tail);
551
552         /* Use bounce buffer if the data wraps */
553         if (tail + channel->pkt_size >= channel->fifo_size) {
554                 ptr = channel->bounce_buffer;
555                 len = qcom_smd_channel_peek(channel, ptr, channel->pkt_size);
556         } else {
557                 ptr = channel->rx_fifo + tail;
558                 len = channel->pkt_size;
559         }
560
561         ret = ept->cb(ept->rpdev, ptr, len, ept->priv, RPMSG_ADDR_ANY);
562         if (ret < 0)
563                 return ret;
564
565         /* Only forward the tail if the client consumed the data */
566         qcom_smd_channel_advance(channel, len);
567
568         channel->pkt_size = 0;
569
570         return 0;
571 }
572
573 /*
574  * Per channel interrupt handling
575  */
576 static bool qcom_smd_channel_intr(struct qcom_smd_channel *channel)
577 {
578         bool need_state_scan = false;
579         int remote_state;
580         __le32 pktlen;
581         int avail;
582         int ret;
583
584         /* Handle state changes */
585         remote_state = GET_RX_CHANNEL_INFO(channel, state);
586         if (remote_state != channel->remote_state) {
587                 channel->remote_state = remote_state;
588                 need_state_scan = true;
589
590                 wake_up_interruptible_all(&channel->state_change_event);
591         }
592         /* Indicate that we have seen any state change */
593         SET_RX_CHANNEL_FLAG(channel, fSTATE, 0);
594
595         /* Signal waiting qcom_smd_send() about the interrupt */
596         if (!GET_TX_CHANNEL_FLAG(channel, fBLOCKREADINTR))
597                 wake_up_interruptible_all(&channel->fblockread_event);
598
599         /* Don't consume any data until we've opened the channel */
600         if (channel->state != SMD_CHANNEL_OPENED)
601                 goto out;
602
603         /* Indicate that we've seen the new data */
604         SET_RX_CHANNEL_FLAG(channel, fHEAD, 0);
605
606         /* Consume data */
607         for (;;) {
608                 avail = qcom_smd_channel_get_rx_avail(channel);
609
610                 if (!channel->pkt_size && avail >= SMD_PACKET_HEADER_LEN) {
611                         qcom_smd_channel_peek(channel, &pktlen, sizeof(pktlen));
612                         qcom_smd_channel_advance(channel, SMD_PACKET_HEADER_LEN);
613                         channel->pkt_size = le32_to_cpu(pktlen);
614                 } else if (channel->pkt_size && avail >= channel->pkt_size) {
615                         ret = qcom_smd_channel_recv_single(channel);
616                         if (ret)
617                                 break;
618                 } else {
619                         break;
620                 }
621         }
622
623         /* Indicate that we have seen and updated tail */
624         SET_RX_CHANNEL_FLAG(channel, fTAIL, 1);
625
626         /* Signal the remote that we've consumed the data (if requested) */
627         if (!GET_RX_CHANNEL_FLAG(channel, fBLOCKREADINTR)) {
628                 /* Ensure ordering of channel info updates */
629                 wmb();
630
631                 qcom_smd_signal_channel(channel);
632         }
633
634 out:
635         return need_state_scan;
636 }
637
638 /*
639  * The edge interrupts are triggered by the remote processor on state changes,
640  * channel info updates or when new channels are created.
641  */
642 static irqreturn_t qcom_smd_edge_intr(int irq, void *data)
643 {
644         struct qcom_smd_edge *edge = data;
645         struct qcom_smd_channel *channel;
646         unsigned available;
647         bool kick_scanner = false;
648         bool kick_state = false;
649
650         /*
651          * Handle state changes or data on each of the channels on this edge
652          */
653         spin_lock(&edge->channels_lock);
654         list_for_each_entry(channel, &edge->channels, list) {
655                 spin_lock(&channel->recv_lock);
656                 kick_state |= qcom_smd_channel_intr(channel);
657                 spin_unlock(&channel->recv_lock);
658         }
659         spin_unlock(&edge->channels_lock);
660
661         /*
662          * Creating a new channel requires allocating an smem entry, so we only
663          * have to scan if the amount of available space in smem have changed
664          * since last scan.
665          */
666         available = qcom_smem_get_free_space(edge->remote_pid);
667         if (available != edge->smem_available) {
668                 edge->smem_available = available;
669                 kick_scanner = true;
670         }
671
672         if (kick_scanner)
673                 schedule_work(&edge->scan_work);
674         if (kick_state)
675                 schedule_work(&edge->state_work);
676
677         return IRQ_HANDLED;
678 }
679
680 /*
681  * Calculate how much space is available in the tx fifo.
682  */
683 static size_t qcom_smd_get_tx_avail(struct qcom_smd_channel *channel)
684 {
685         unsigned head;
686         unsigned tail;
687         unsigned mask = channel->fifo_size - 1;
688
689         head = GET_TX_CHANNEL_INFO(channel, head);
690         tail = GET_TX_CHANNEL_INFO(channel, tail);
691
692         return mask - ((head - tail) & mask);
693 }
694
695 /*
696  * Write count bytes of data into channel, possibly wrapping in the ring buffer
697  */
698 static int qcom_smd_write_fifo(struct qcom_smd_channel *channel,
699                                const void *data,
700                                size_t count)
701 {
702         bool word_aligned;
703         unsigned head;
704         size_t len;
705
706         word_aligned = channel->info_word;
707         head = GET_TX_CHANNEL_INFO(channel, head);
708
709         len = min_t(size_t, count, channel->fifo_size - head);
710         if (len) {
711                 smd_copy_to_fifo(channel->tx_fifo + head,
712                                  data,
713                                  len,
714                                  word_aligned);
715         }
716
717         if (len != count) {
718                 smd_copy_to_fifo(channel->tx_fifo,
719                                  data + len,
720                                  count - len,
721                                  word_aligned);
722         }
723
724         head += count;
725         head &= (channel->fifo_size - 1);
726         SET_TX_CHANNEL_INFO(channel, head, head);
727
728         return count;
729 }
730
731 /**
732  * qcom_smd_send - write data to smd channel
733  * @channel:    channel handle
734  * @data:       buffer of data to write
735  * @len:        number of bytes to write
736  * @wait:       flag to indicate if write has ca wait
737  *
738  * This is a blocking write of len bytes into the channel's tx ring buffer and
739  * signal the remote end. It will sleep until there is enough space available
740  * in the tx buffer, utilizing the fBLOCKREADINTR signaling mechanism to avoid
741  * polling.
742  */
743 static int __qcom_smd_send(struct qcom_smd_channel *channel, const void *data,
744                            int len, bool wait)
745 {
746         __le32 hdr[5] = { cpu_to_le32(len), };
747         int tlen = sizeof(hdr) + len;
748         unsigned long flags;
749         int ret;
750
751         /* Word aligned channels only accept word size aligned data */
752         if (channel->info_word && len % 4)
753                 return -EINVAL;
754
755         /* Reject packets that are too big */
756         if (tlen >= channel->fifo_size)
757                 return -EINVAL;
758
759         /* Highlight the fact that if we enter the loop below we might sleep */
760         if (wait)
761                 might_sleep();
762
763         spin_lock_irqsave(&channel->tx_lock, flags);
764
765         while (qcom_smd_get_tx_avail(channel) < tlen &&
766                channel->state == SMD_CHANNEL_OPENED) {
767                 if (!wait) {
768                         ret = -EAGAIN;
769                         goto out_unlock;
770                 }
771
772                 SET_TX_CHANNEL_FLAG(channel, fBLOCKREADINTR, 0);
773
774                 /* Wait without holding the tx_lock */
775                 spin_unlock_irqrestore(&channel->tx_lock, flags);
776
777                 ret = wait_event_interruptible(channel->fblockread_event,
778                                        qcom_smd_get_tx_avail(channel) >= tlen ||
779                                        channel->state != SMD_CHANNEL_OPENED);
780                 if (ret)
781                         return ret;
782
783                 spin_lock_irqsave(&channel->tx_lock, flags);
784
785                 SET_TX_CHANNEL_FLAG(channel, fBLOCKREADINTR, 1);
786         }
787
788         /* Fail if the channel was closed */
789         if (channel->state != SMD_CHANNEL_OPENED) {
790                 ret = -EPIPE;
791                 goto out_unlock;
792         }
793
794         SET_TX_CHANNEL_FLAG(channel, fTAIL, 0);
795
796         qcom_smd_write_fifo(channel, hdr, sizeof(hdr));
797         qcom_smd_write_fifo(channel, data, len);
798
799         SET_TX_CHANNEL_FLAG(channel, fHEAD, 1);
800
801         /* Ensure ordering of channel info updates */
802         wmb();
803
804         qcom_smd_signal_channel(channel);
805
806 out_unlock:
807         spin_unlock_irqrestore(&channel->tx_lock, flags);
808
809         return ret;
810 }
811
812 /*
813  * Helper for opening a channel
814  */
815 static int qcom_smd_channel_open(struct qcom_smd_channel *channel,
816                                  rpmsg_rx_cb_t cb)
817 {
818         struct qcom_smd_edge *edge = channel->edge;
819         size_t bb_size;
820         int ret;
821
822         /*
823          * Packets are maximum 4k, but reduce if the fifo is smaller
824          */
825         bb_size = min(channel->fifo_size, SZ_4K);
826         channel->bounce_buffer = kmalloc(bb_size, GFP_KERNEL);
827         if (!channel->bounce_buffer)
828                 return -ENOMEM;
829
830         qcom_smd_channel_set_callback(channel, cb);
831         qcom_smd_channel_set_state(channel, SMD_CHANNEL_OPENING);
832
833         /* Wait for remote to enter opening or opened */
834         ret = wait_event_interruptible_timeout(channel->state_change_event,
835                         channel->remote_state == SMD_CHANNEL_OPENING ||
836                         channel->remote_state == SMD_CHANNEL_OPENED,
837                         HZ);
838         if (!ret) {
839                 dev_err(&edge->dev, "remote side did not enter opening state\n");
840                 goto out_close_timeout;
841         }
842
843         qcom_smd_channel_set_state(channel, SMD_CHANNEL_OPENED);
844
845         /* Wait for remote to enter opened */
846         ret = wait_event_interruptible_timeout(channel->state_change_event,
847                         channel->remote_state == SMD_CHANNEL_OPENED,
848                         HZ);
849         if (!ret) {
850                 dev_err(&edge->dev, "remote side did not enter open state\n");
851                 goto out_close_timeout;
852         }
853
854         return 0;
855
856 out_close_timeout:
857         qcom_smd_channel_set_state(channel, SMD_CHANNEL_CLOSED);
858         return -ETIMEDOUT;
859 }
860
861 /*
862  * Helper for closing and resetting a channel
863  */
864 static void qcom_smd_channel_close(struct qcom_smd_channel *channel)
865 {
866         qcom_smd_channel_set_callback(channel, NULL);
867
868         kfree(channel->bounce_buffer);
869         channel->bounce_buffer = NULL;
870
871         qcom_smd_channel_set_state(channel, SMD_CHANNEL_CLOSED);
872         qcom_smd_channel_reset(channel);
873 }
874
875 static struct qcom_smd_channel *
876 qcom_smd_find_channel(struct qcom_smd_edge *edge, const char *name)
877 {
878         struct qcom_smd_channel *channel;
879         struct qcom_smd_channel *ret = NULL;
880         unsigned long flags;
881
882         spin_lock_irqsave(&edge->channels_lock, flags);
883         list_for_each_entry(channel, &edge->channels, list) {
884                 if (!strcmp(channel->name, name)) {
885                         ret = channel;
886                         break;
887                 }
888         }
889         spin_unlock_irqrestore(&edge->channels_lock, flags);
890
891         return ret;
892 }
893
894 static void __ept_release(struct kref *kref)
895 {
896         struct rpmsg_endpoint *ept = container_of(kref, struct rpmsg_endpoint,
897                                                   refcount);
898         kfree(to_smd_endpoint(ept));
899 }
900
901 static struct rpmsg_endpoint *qcom_smd_create_ept(struct rpmsg_device *rpdev,
902                                                   rpmsg_rx_cb_t cb, void *priv,
903                                                   struct rpmsg_channel_info chinfo)
904 {
905         struct qcom_smd_endpoint *qsept;
906         struct qcom_smd_channel *channel;
907         struct qcom_smd_device *qsdev = to_smd_device(rpdev);
908         struct qcom_smd_edge *edge = qsdev->edge;
909         struct rpmsg_endpoint *ept;
910         const char *name = chinfo.name;
911         int ret;
912
913         /* Wait up to HZ for the channel to appear */
914         ret = wait_event_interruptible_timeout(edge->new_channel_event,
915                         (channel = qcom_smd_find_channel(edge, name)) != NULL,
916                         HZ);
917         if (!ret)
918                 return NULL;
919
920         if (channel->state != SMD_CHANNEL_CLOSED) {
921                 dev_err(&rpdev->dev, "channel %s is busy\n", channel->name);
922                 return NULL;
923         }
924
925         qsept = kzalloc(sizeof(*qsept), GFP_KERNEL);
926         if (!qsept)
927                 return NULL;
928
929         ept = &qsept->ept;
930
931         kref_init(&ept->refcount);
932
933         ept->rpdev = rpdev;
934         ept->cb = cb;
935         ept->priv = priv;
936         ept->ops = &qcom_smd_endpoint_ops;
937
938         channel->qsept = qsept;
939         qsept->qsch = channel;
940
941         ret = qcom_smd_channel_open(channel, cb);
942         if (ret)
943                 goto free_ept;
944
945         return ept;
946
947 free_ept:
948         channel->qsept = NULL;
949         kref_put(&ept->refcount, __ept_release);
950         return NULL;
951 }
952
953 static void qcom_smd_destroy_ept(struct rpmsg_endpoint *ept)
954 {
955         struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
956         struct qcom_smd_channel *ch = qsept->qsch;
957
958         qcom_smd_channel_close(ch);
959         ch->qsept = NULL;
960         kref_put(&ept->refcount, __ept_release);
961 }
962
963 static int qcom_smd_send(struct rpmsg_endpoint *ept, void *data, int len)
964 {
965         struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
966
967         return __qcom_smd_send(qsept->qsch, data, len, true);
968 }
969
970 static int qcom_smd_trysend(struct rpmsg_endpoint *ept, void *data, int len)
971 {
972         struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
973
974         return __qcom_smd_send(qsept->qsch, data, len, false);
975 }
976
977 static __poll_t qcom_smd_poll(struct rpmsg_endpoint *ept,
978                                   struct file *filp, poll_table *wait)
979 {
980         struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
981         struct qcom_smd_channel *channel = qsept->qsch;
982         __poll_t mask = 0;
983
984         poll_wait(filp, &channel->fblockread_event, wait);
985
986         if (qcom_smd_get_tx_avail(channel) > 20)
987                 mask |= EPOLLOUT | EPOLLWRNORM;
988
989         return mask;
990 }
991
992 /*
993  * Finds the device_node for the smd child interested in this channel.
994  */
995 static struct device_node *qcom_smd_match_channel(struct device_node *edge_node,
996                                                   const char *channel)
997 {
998         struct device_node *child;
999         const char *name;
1000         const char *key;
1001         int ret;
1002
1003         for_each_available_child_of_node(edge_node, child) {
1004                 key = "qcom,smd-channels";
1005                 ret = of_property_read_string(child, key, &name);
1006                 if (ret)
1007                         continue;
1008
1009                 if (strcmp(name, channel) == 0)
1010                         return child;
1011         }
1012
1013         return NULL;
1014 }
1015
1016 static int qcom_smd_announce_create(struct rpmsg_device *rpdev)
1017 {
1018         struct qcom_smd_endpoint *qept = to_smd_endpoint(rpdev->ept);
1019         struct qcom_smd_channel *channel = qept->qsch;
1020         unsigned long flags;
1021         bool kick_state;
1022
1023         spin_lock_irqsave(&channel->recv_lock, flags);
1024         kick_state = qcom_smd_channel_intr(channel);
1025         spin_unlock_irqrestore(&channel->recv_lock, flags);
1026
1027         if (kick_state)
1028                 schedule_work(&channel->edge->state_work);
1029
1030         return 0;
1031 }
1032
1033 static const struct rpmsg_device_ops qcom_smd_device_ops = {
1034         .create_ept = qcom_smd_create_ept,
1035         .announce_create = qcom_smd_announce_create,
1036 };
1037
1038 static const struct rpmsg_endpoint_ops qcom_smd_endpoint_ops = {
1039         .destroy_ept = qcom_smd_destroy_ept,
1040         .send = qcom_smd_send,
1041         .trysend = qcom_smd_trysend,
1042         .poll = qcom_smd_poll,
1043 };
1044
1045 static void qcom_smd_release_device(struct device *dev)
1046 {
1047         struct rpmsg_device *rpdev = to_rpmsg_device(dev);
1048         struct qcom_smd_device *qsdev = to_smd_device(rpdev);
1049
1050         kfree(qsdev);
1051 }
1052
1053 /*
1054  * Create a smd client device for channel that is being opened.
1055  */
1056 static int qcom_smd_create_device(struct qcom_smd_channel *channel)
1057 {
1058         struct qcom_smd_device *qsdev;
1059         struct rpmsg_device *rpdev;
1060         struct qcom_smd_edge *edge = channel->edge;
1061
1062         dev_dbg(&edge->dev, "registering '%s'\n", channel->name);
1063
1064         qsdev = kzalloc(sizeof(*qsdev), GFP_KERNEL);
1065         if (!qsdev)
1066                 return -ENOMEM;
1067
1068         /* Link qsdev to our SMD edge */
1069         qsdev->edge = edge;
1070
1071         /* Assign callbacks for rpmsg_device */
1072         qsdev->rpdev.ops = &qcom_smd_device_ops;
1073
1074         /* Assign public information to the rpmsg_device */
1075         rpdev = &qsdev->rpdev;
1076         strscpy_pad(rpdev->id.name, channel->name, RPMSG_NAME_SIZE);
1077         rpdev->src = RPMSG_ADDR_ANY;
1078         rpdev->dst = RPMSG_ADDR_ANY;
1079
1080         rpdev->dev.of_node = qcom_smd_match_channel(edge->of_node, channel->name);
1081         rpdev->dev.parent = &edge->dev;
1082         rpdev->dev.release = qcom_smd_release_device;
1083
1084         return rpmsg_register_device(rpdev);
1085 }
1086
1087 static int qcom_smd_create_chrdev(struct qcom_smd_edge *edge)
1088 {
1089         struct qcom_smd_device *qsdev;
1090
1091         qsdev = kzalloc(sizeof(*qsdev), GFP_KERNEL);
1092         if (!qsdev)
1093                 return -ENOMEM;
1094
1095         qsdev->edge = edge;
1096         qsdev->rpdev.ops = &qcom_smd_device_ops;
1097         qsdev->rpdev.dev.parent = &edge->dev;
1098         qsdev->rpdev.dev.release = qcom_smd_release_device;
1099
1100         return rpmsg_chrdev_register_device(&qsdev->rpdev);
1101 }
1102
1103 /*
1104  * Allocate the qcom_smd_channel object for a newly found smd channel,
1105  * retrieving and validating the smem items involved.
1106  */
1107 static struct qcom_smd_channel *qcom_smd_create_channel(struct qcom_smd_edge *edge,
1108                                                         unsigned smem_info_item,
1109                                                         unsigned smem_fifo_item,
1110                                                         char *name)
1111 {
1112         struct qcom_smd_channel *channel;
1113         size_t fifo_size;
1114         size_t info_size;
1115         void *fifo_base;
1116         void *info;
1117         int ret;
1118
1119         channel = kzalloc(sizeof(*channel), GFP_KERNEL);
1120         if (!channel)
1121                 return ERR_PTR(-ENOMEM);
1122
1123         channel->edge = edge;
1124         channel->name = kstrdup(name, GFP_KERNEL);
1125         if (!channel->name) {
1126                 ret = -ENOMEM;
1127                 goto free_channel;
1128         }
1129
1130         spin_lock_init(&channel->tx_lock);
1131         spin_lock_init(&channel->recv_lock);
1132         init_waitqueue_head(&channel->fblockread_event);
1133         init_waitqueue_head(&channel->state_change_event);
1134
1135         info = qcom_smem_get(edge->remote_pid, smem_info_item, &info_size);
1136         if (IS_ERR(info)) {
1137                 ret = PTR_ERR(info);
1138                 goto free_name_and_channel;
1139         }
1140
1141         /*
1142          * Use the size of the item to figure out which channel info struct to
1143          * use.
1144          */
1145         if (info_size == 2 * sizeof(struct smd_channel_info_word)) {
1146                 channel->info_word = info;
1147         } else if (info_size == 2 * sizeof(struct smd_channel_info)) {
1148                 channel->info = info;
1149         } else {
1150                 dev_err(&edge->dev,
1151                         "channel info of size %zu not supported\n", info_size);
1152                 ret = -EINVAL;
1153                 goto free_name_and_channel;
1154         }
1155
1156         fifo_base = qcom_smem_get(edge->remote_pid, smem_fifo_item, &fifo_size);
1157         if (IS_ERR(fifo_base)) {
1158                 ret =  PTR_ERR(fifo_base);
1159                 goto free_name_and_channel;
1160         }
1161
1162         /* The channel consist of a rx and tx fifo of equal size */
1163         fifo_size /= 2;
1164
1165         dev_dbg(&edge->dev, "new channel '%s' info-size: %zu fifo-size: %zu\n",
1166                           name, info_size, fifo_size);
1167
1168         channel->tx_fifo = fifo_base;
1169         channel->rx_fifo = fifo_base + fifo_size;
1170         channel->fifo_size = fifo_size;
1171
1172         qcom_smd_channel_reset(channel);
1173
1174         return channel;
1175
1176 free_name_and_channel:
1177         kfree(channel->name);
1178 free_channel:
1179         kfree(channel);
1180
1181         return ERR_PTR(ret);
1182 }
1183
1184 /*
1185  * Scans the allocation table for any newly allocated channels, calls
1186  * qcom_smd_create_channel() to create representations of these and add
1187  * them to the edge's list of channels.
1188  */
1189 static void qcom_channel_scan_worker(struct work_struct *work)
1190 {
1191         struct qcom_smd_edge *edge = container_of(work, struct qcom_smd_edge, scan_work);
1192         struct qcom_smd_alloc_entry *alloc_tbl;
1193         struct qcom_smd_alloc_entry *entry;
1194         struct qcom_smd_channel *channel;
1195         unsigned long flags;
1196         unsigned fifo_id;
1197         unsigned info_id;
1198         int tbl;
1199         int i;
1200         u32 eflags, cid;
1201
1202         for (tbl = 0; tbl < SMD_ALLOC_TBL_COUNT; tbl++) {
1203                 alloc_tbl = qcom_smem_get(edge->remote_pid,
1204                                     smem_items[tbl].alloc_tbl_id, NULL);
1205                 if (IS_ERR(alloc_tbl))
1206                         continue;
1207
1208                 for (i = 0; i < SMD_ALLOC_TBL_SIZE; i++) {
1209                         entry = &alloc_tbl[i];
1210                         eflags = le32_to_cpu(entry->flags);
1211                         if (test_bit(i, edge->allocated[tbl]))
1212                                 continue;
1213
1214                         if (entry->ref_count == 0)
1215                                 continue;
1216
1217                         if (!entry->name[0])
1218                                 continue;
1219
1220                         if (!(eflags & SMD_CHANNEL_FLAGS_PACKET))
1221                                 continue;
1222
1223                         if ((eflags & SMD_CHANNEL_FLAGS_EDGE_MASK) != edge->edge_id)
1224                                 continue;
1225
1226                         cid = le32_to_cpu(entry->cid);
1227                         info_id = smem_items[tbl].info_base_id + cid;
1228                         fifo_id = smem_items[tbl].fifo_base_id + cid;
1229
1230                         channel = qcom_smd_create_channel(edge, info_id, fifo_id, entry->name);
1231                         if (IS_ERR(channel))
1232                                 continue;
1233
1234                         spin_lock_irqsave(&edge->channels_lock, flags);
1235                         list_add(&channel->list, &edge->channels);
1236                         spin_unlock_irqrestore(&edge->channels_lock, flags);
1237
1238                         dev_dbg(&edge->dev, "new channel found: '%s'\n", channel->name);
1239                         set_bit(i, edge->allocated[tbl]);
1240
1241                         wake_up_interruptible_all(&edge->new_channel_event);
1242                 }
1243         }
1244
1245         schedule_work(&edge->state_work);
1246 }
1247
1248 /*
1249  * This per edge worker scans smem for any new channels and register these. It
1250  * then scans all registered channels for state changes that should be handled
1251  * by creating or destroying smd client devices for the registered channels.
1252  *
1253  * LOCKING: edge->channels_lock only needs to cover the list operations, as the
1254  * worker is killed before any channels are deallocated
1255  */
1256 static void qcom_channel_state_worker(struct work_struct *work)
1257 {
1258         struct qcom_smd_channel *channel;
1259         struct qcom_smd_edge *edge = container_of(work,
1260                                                   struct qcom_smd_edge,
1261                                                   state_work);
1262         struct rpmsg_channel_info chinfo;
1263         unsigned remote_state;
1264         unsigned long flags;
1265
1266         /*
1267          * Register a device for any closed channel where the remote processor
1268          * is showing interest in opening the channel.
1269          */
1270         spin_lock_irqsave(&edge->channels_lock, flags);
1271         list_for_each_entry(channel, &edge->channels, list) {
1272                 if (channel->state != SMD_CHANNEL_CLOSED)
1273                         continue;
1274
1275                 remote_state = GET_RX_CHANNEL_INFO(channel, state);
1276                 if (remote_state != SMD_CHANNEL_OPENING &&
1277                     remote_state != SMD_CHANNEL_OPENED)
1278                         continue;
1279
1280                 if (channel->registered)
1281                         continue;
1282
1283                 spin_unlock_irqrestore(&edge->channels_lock, flags);
1284                 qcom_smd_create_device(channel);
1285                 channel->registered = true;
1286                 spin_lock_irqsave(&edge->channels_lock, flags);
1287
1288                 channel->registered = true;
1289         }
1290
1291         /*
1292          * Unregister the device for any channel that is opened where the
1293          * remote processor is closing the channel.
1294          */
1295         list_for_each_entry(channel, &edge->channels, list) {
1296                 if (channel->state != SMD_CHANNEL_OPENING &&
1297                     channel->state != SMD_CHANNEL_OPENED)
1298                         continue;
1299
1300                 remote_state = GET_RX_CHANNEL_INFO(channel, state);
1301                 if (remote_state == SMD_CHANNEL_OPENING ||
1302                     remote_state == SMD_CHANNEL_OPENED)
1303                         continue;
1304
1305                 spin_unlock_irqrestore(&edge->channels_lock, flags);
1306
1307                 strscpy_pad(chinfo.name, channel->name, sizeof(chinfo.name));
1308                 chinfo.src = RPMSG_ADDR_ANY;
1309                 chinfo.dst = RPMSG_ADDR_ANY;
1310                 rpmsg_unregister_device(&edge->dev, &chinfo);
1311                 channel->registered = false;
1312                 spin_lock_irqsave(&edge->channels_lock, flags);
1313         }
1314         spin_unlock_irqrestore(&edge->channels_lock, flags);
1315 }
1316
1317 /*
1318  * Parses an of_node describing an edge.
1319  */
1320 static int qcom_smd_parse_edge(struct device *dev,
1321                                struct device_node *node,
1322                                struct qcom_smd_edge *edge)
1323 {
1324         struct device_node *syscon_np;
1325         const char *key;
1326         int irq;
1327         int ret;
1328
1329         INIT_LIST_HEAD(&edge->channels);
1330         spin_lock_init(&edge->channels_lock);
1331
1332         INIT_WORK(&edge->scan_work, qcom_channel_scan_worker);
1333         INIT_WORK(&edge->state_work, qcom_channel_state_worker);
1334
1335         edge->of_node = of_node_get(node);
1336
1337         key = "qcom,smd-edge";
1338         ret = of_property_read_u32(node, key, &edge->edge_id);
1339         if (ret) {
1340                 dev_err(dev, "edge missing %s property\n", key);
1341                 goto put_node;
1342         }
1343
1344         edge->remote_pid = QCOM_SMEM_HOST_ANY;
1345         key = "qcom,remote-pid";
1346         of_property_read_u32(node, key, &edge->remote_pid);
1347
1348         edge->mbox_client.dev = dev;
1349         edge->mbox_client.knows_txdone = true;
1350         edge->mbox_chan = mbox_request_channel(&edge->mbox_client, 0);
1351         if (IS_ERR(edge->mbox_chan)) {
1352                 if (PTR_ERR(edge->mbox_chan) != -ENODEV) {
1353                         ret = PTR_ERR(edge->mbox_chan);
1354                         goto put_node;
1355                 }
1356
1357                 edge->mbox_chan = NULL;
1358
1359                 syscon_np = of_parse_phandle(node, "qcom,ipc", 0);
1360                 if (!syscon_np) {
1361                         dev_err(dev, "no qcom,ipc node\n");
1362                         ret = -ENODEV;
1363                         goto put_node;
1364                 }
1365
1366                 edge->ipc_regmap = syscon_node_to_regmap(syscon_np);
1367                 of_node_put(syscon_np);
1368                 if (IS_ERR(edge->ipc_regmap)) {
1369                         ret = PTR_ERR(edge->ipc_regmap);
1370                         goto put_node;
1371                 }
1372
1373                 key = "qcom,ipc";
1374                 ret = of_property_read_u32_index(node, key, 1, &edge->ipc_offset);
1375                 if (ret < 0) {
1376                         dev_err(dev, "no offset in %s\n", key);
1377                         goto put_node;
1378                 }
1379
1380                 ret = of_property_read_u32_index(node, key, 2, &edge->ipc_bit);
1381                 if (ret < 0) {
1382                         dev_err(dev, "no bit in %s\n", key);
1383                         goto put_node;
1384                 }
1385         }
1386
1387         ret = of_property_read_string(node, "label", &edge->name);
1388         if (ret < 0)
1389                 edge->name = node->name;
1390
1391         irq = irq_of_parse_and_map(node, 0);
1392         if (!irq) {
1393                 dev_err(dev, "required smd interrupt missing\n");
1394                 ret = -EINVAL;
1395                 goto put_node;
1396         }
1397
1398         ret = devm_request_irq(dev, irq,
1399                                qcom_smd_edge_intr, IRQF_TRIGGER_RISING,
1400                                node->name, edge);
1401         if (ret) {
1402                 dev_err(dev, "failed to request smd irq\n");
1403                 goto put_node;
1404         }
1405
1406         edge->irq = irq;
1407
1408         return 0;
1409
1410 put_node:
1411         of_node_put(node);
1412         edge->of_node = NULL;
1413
1414         return ret;
1415 }
1416
1417 /*
1418  * Release function for an edge.
1419   * Reset the state of each associated channel and free the edge context.
1420  */
1421 static void qcom_smd_edge_release(struct device *dev)
1422 {
1423         struct qcom_smd_channel *channel, *tmp;
1424         struct qcom_smd_edge *edge = to_smd_edge(dev);
1425
1426         list_for_each_entry_safe(channel, tmp, &edge->channels, list) {
1427                 list_del(&channel->list);
1428                 kfree(channel->name);
1429                 kfree(channel);
1430         }
1431
1432         kfree(edge);
1433 }
1434
1435 static ssize_t rpmsg_name_show(struct device *dev,
1436                                struct device_attribute *attr, char *buf)
1437 {
1438         struct qcom_smd_edge *edge = to_smd_edge(dev);
1439
1440         return sprintf(buf, "%s\n", edge->name);
1441 }
1442 static DEVICE_ATTR_RO(rpmsg_name);
1443
1444 static struct attribute *qcom_smd_edge_attrs[] = {
1445         &dev_attr_rpmsg_name.attr,
1446         NULL
1447 };
1448 ATTRIBUTE_GROUPS(qcom_smd_edge);
1449
1450 /**
1451  * qcom_smd_register_edge() - register an edge based on an device_node
1452  * @parent:    parent device for the edge
1453  * @node:      device_node describing the edge
1454  *
1455  * Returns an edge reference, or negative ERR_PTR() on failure.
1456  */
1457 struct qcom_smd_edge *qcom_smd_register_edge(struct device *parent,
1458                                              struct device_node *node)
1459 {
1460         struct qcom_smd_edge *edge;
1461         int ret;
1462
1463         edge = kzalloc(sizeof(*edge), GFP_KERNEL);
1464         if (!edge)
1465                 return ERR_PTR(-ENOMEM);
1466
1467         init_waitqueue_head(&edge->new_channel_event);
1468
1469         edge->dev.parent = parent;
1470         edge->dev.release = qcom_smd_edge_release;
1471         edge->dev.of_node = node;
1472         edge->dev.groups = qcom_smd_edge_groups;
1473         dev_set_name(&edge->dev, "%s:%pOFn", dev_name(parent), node);
1474         ret = device_register(&edge->dev);
1475         if (ret) {
1476                 pr_err("failed to register smd edge\n");
1477                 put_device(&edge->dev);
1478                 return ERR_PTR(ret);
1479         }
1480
1481         ret = qcom_smd_parse_edge(&edge->dev, node, edge);
1482         if (ret) {
1483                 dev_err(&edge->dev, "failed to parse smd edge\n");
1484                 goto unregister_dev;
1485         }
1486
1487         ret = qcom_smd_create_chrdev(edge);
1488         if (ret) {
1489                 dev_err(&edge->dev, "failed to register chrdev for edge\n");
1490                 goto unregister_dev;
1491         }
1492
1493         schedule_work(&edge->scan_work);
1494
1495         return edge;
1496
1497 unregister_dev:
1498         if (!IS_ERR_OR_NULL(edge->mbox_chan))
1499                 mbox_free_channel(edge->mbox_chan);
1500
1501         device_unregister(&edge->dev);
1502         return ERR_PTR(ret);
1503 }
1504 EXPORT_SYMBOL(qcom_smd_register_edge);
1505
1506 static int qcom_smd_remove_device(struct device *dev, void *data)
1507 {
1508         device_unregister(dev);
1509
1510         return 0;
1511 }
1512
1513 /**
1514  * qcom_smd_unregister_edge() - release an edge and its children
1515  * @edge:      edge reference acquired from qcom_smd_register_edge
1516  */
1517 int qcom_smd_unregister_edge(struct qcom_smd_edge *edge)
1518 {
1519         int ret;
1520
1521         disable_irq(edge->irq);
1522         cancel_work_sync(&edge->scan_work);
1523         cancel_work_sync(&edge->state_work);
1524
1525         ret = device_for_each_child(&edge->dev, NULL, qcom_smd_remove_device);
1526         if (ret)
1527                 dev_warn(&edge->dev, "can't remove smd device: %d\n", ret);
1528
1529         mbox_free_channel(edge->mbox_chan);
1530         device_unregister(&edge->dev);
1531
1532         return 0;
1533 }
1534 EXPORT_SYMBOL(qcom_smd_unregister_edge);
1535
1536 static int qcom_smd_probe(struct platform_device *pdev)
1537 {
1538         struct device_node *node;
1539         void *p;
1540
1541         /* Wait for smem */
1542         p = qcom_smem_get(QCOM_SMEM_HOST_ANY, smem_items[0].alloc_tbl_id, NULL);
1543         if (PTR_ERR(p) == -EPROBE_DEFER)
1544                 return PTR_ERR(p);
1545
1546         for_each_available_child_of_node(pdev->dev.of_node, node)
1547                 qcom_smd_register_edge(&pdev->dev, node);
1548
1549         return 0;
1550 }
1551
1552 static int qcom_smd_remove_edge(struct device *dev, void *data)
1553 {
1554         struct qcom_smd_edge *edge = to_smd_edge(dev);
1555
1556         return qcom_smd_unregister_edge(edge);
1557 }
1558
1559 /*
1560  * Shut down all smd clients by making sure that each edge stops processing
1561  * events and scanning for new channels, then call destroy on the devices.
1562  */
1563 static int qcom_smd_remove(struct platform_device *pdev)
1564 {
1565         int ret;
1566
1567         ret = device_for_each_child(&pdev->dev, NULL, qcom_smd_remove_edge);
1568         if (ret)
1569                 dev_warn(&pdev->dev, "can't remove smd device: %d\n", ret);
1570
1571         return ret;
1572 }
1573
1574 static const struct of_device_id qcom_smd_of_match[] = {
1575         { .compatible = "qcom,smd" },
1576         {}
1577 };
1578 MODULE_DEVICE_TABLE(of, qcom_smd_of_match);
1579
1580 static struct platform_driver qcom_smd_driver = {
1581         .probe = qcom_smd_probe,
1582         .remove = qcom_smd_remove,
1583         .driver = {
1584                 .name = "qcom-smd",
1585                 .of_match_table = qcom_smd_of_match,
1586         },
1587 };
1588
1589 static int __init qcom_smd_init(void)
1590 {
1591         return platform_driver_register(&qcom_smd_driver);
1592 }
1593 subsys_initcall(qcom_smd_init);
1594
1595 static void __exit qcom_smd_exit(void)
1596 {
1597         platform_driver_unregister(&qcom_smd_driver);
1598 }
1599 module_exit(qcom_smd_exit);
1600
1601 MODULE_AUTHOR("Bjorn Andersson <bjorn.andersson@sonymobile.com>");
1602 MODULE_DESCRIPTION("Qualcomm Shared Memory Driver");
1603 MODULE_LICENSE("GPL v2");