xref: /linux/drivers/soc/qcom/smem.c (revision a1ff5a7d78a036d6c2178ee5acd6ba4946243800)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (c) 2015, Sony Mobile Communications AB.
4  * Copyright (c) 2012-2013, The Linux Foundation. All rights reserved.
5  */
6 
7 #include <linux/hwspinlock.h>
8 #include <linux/io.h>
9 #include <linux/module.h>
10 #include <linux/of.h>
11 #include <linux/of_address.h>
12 #include <linux/of_reserved_mem.h>
13 #include <linux/platform_device.h>
14 #include <linux/sizes.h>
15 #include <linux/slab.h>
16 #include <linux/soc/qcom/smem.h>
17 #include <linux/soc/qcom/socinfo.h>
18 
19 /*
20  * The Qualcomm shared memory system is a allocate only heap structure that
21  * consists of one of more memory areas that can be accessed by the processors
22  * in the SoC.
23  *
24  * All systems contains a global heap, accessible by all processors in the SoC,
25  * with a table of contents data structure (@smem_header) at the beginning of
26  * the main shared memory block.
27  *
28  * The global header contains meta data for allocations as well as a fixed list
29  * of 512 entries (@smem_global_entry) that can be initialized to reference
30  * parts of the shared memory space.
31  *
32  *
33  * In addition to this global heap a set of "private" heaps can be set up at
34  * boot time with access restrictions so that only certain processor pairs can
35  * access the data.
36  *
37  * These partitions are referenced from an optional partition table
38  * (@smem_ptable), that is found 4kB from the end of the main smem region. The
39  * partition table entries (@smem_ptable_entry) lists the involved processors
40  * (or hosts) and their location in the main shared memory region.
41  *
42  * Each partition starts with a header (@smem_partition_header) that identifies
43  * the partition and holds properties for the two internal memory regions. The
44  * two regions are cached and non-cached memory respectively. Each region
45  * contain a link list of allocation headers (@smem_private_entry) followed by
46  * their data.
47  *
48  * Items in the non-cached region are allocated from the start of the partition
49  * while items in the cached region are allocated from the end. The free area
50  * is hence the region between the cached and non-cached offsets. The header of
51  * cached items comes after the data.
52  *
53  * Version 12 (SMEM_GLOBAL_PART_VERSION) changes the item alloc/get procedure
54  * for the global heap. A new global partition is created from the global heap
55  * region with partition type (SMEM_GLOBAL_HOST) and the max smem item count is
56  * set by the bootloader.
57  *
58  * To synchronize allocations in the shared memory heaps a remote spinlock must
59  * be held - currently lock number 3 of the sfpb or tcsr is used for this on all
60  * platforms.
61  *
62  */
63 
64 /*
65  * The version member of the smem header contains an array of versions for the
66  * various software components in the SoC. We verify that the boot loader
67  * version is a valid version as a sanity check.
68  */
69 #define SMEM_MASTER_SBL_VERSION_INDEX	7
70 #define SMEM_GLOBAL_HEAP_VERSION	11
71 #define SMEM_GLOBAL_PART_VERSION	12
72 
73 /*
74  * The first 8 items are only to be allocated by the boot loader while
75  * initializing the heap.
76  */
77 #define SMEM_ITEM_LAST_FIXED	8
78 
79 /* Highest accepted item number, for both global and private heaps */
80 #define SMEM_ITEM_COUNT		512
81 
82 /* Processor/host identifier for the application processor */
83 #define SMEM_HOST_APPS		0
84 
85 /* Processor/host identifier for the global partition */
86 #define SMEM_GLOBAL_HOST	0xfffe
87 
88 /* Max number of processors/hosts in a system */
89 #define SMEM_HOST_COUNT		20
90 
91 /**
92   * struct smem_proc_comm - proc_comm communication struct (legacy)
93   * @command:	current command to be executed
94   * @status:	status of the currently requested command
95   * @params:	parameters to the command
96   */
97 struct smem_proc_comm {
98 	__le32 command;
99 	__le32 status;
100 	__le32 params[2];
101 };
102 
103 /**
104  * struct smem_global_entry - entry to reference smem items on the heap
105  * @allocated:	boolean to indicate if this entry is used
106  * @offset:	offset to the allocated space
107  * @size:	size of the allocated space, 8 byte aligned
108  * @aux_base:	base address for the memory region used by this unit, or 0 for
109  *		the default region. bits 0,1 are reserved
110  */
111 struct smem_global_entry {
112 	__le32 allocated;
113 	__le32 offset;
114 	__le32 size;
115 	__le32 aux_base; /* bits 1:0 reserved */
116 };
117 #define AUX_BASE_MASK		0xfffffffc
118 
119 /**
120  * struct smem_header - header found in beginning of primary smem region
121  * @proc_comm:		proc_comm communication interface (legacy)
122  * @version:		array of versions for the various subsystems
123  * @initialized:	boolean to indicate that smem is initialized
124  * @free_offset:	index of the first unallocated byte in smem
125  * @available:		number of bytes available for allocation
126  * @reserved:		reserved field, must be 0
127  * @toc:		array of references to items
128  */
129 struct smem_header {
130 	struct smem_proc_comm proc_comm[4];
131 	__le32 version[32];
132 	__le32 initialized;
133 	__le32 free_offset;
134 	__le32 available;
135 	__le32 reserved;
136 	struct smem_global_entry toc[SMEM_ITEM_COUNT];
137 };
138 
139 /**
140  * struct smem_ptable_entry - one entry in the @smem_ptable list
141  * @offset:	offset, within the main shared memory region, of the partition
142  * @size:	size of the partition
143  * @flags:	flags for the partition (currently unused)
144  * @host0:	first processor/host with access to this partition
145  * @host1:	second processor/host with access to this partition
146  * @cacheline:	alignment for "cached" entries
147  * @reserved:	reserved entries for later use
148  */
149 struct smem_ptable_entry {
150 	__le32 offset;
151 	__le32 size;
152 	__le32 flags;
153 	__le16 host0;
154 	__le16 host1;
155 	__le32 cacheline;
156 	__le32 reserved[7];
157 };
158 
159 /**
160  * struct smem_ptable - partition table for the private partitions
161  * @magic:	magic number, must be SMEM_PTABLE_MAGIC
162  * @version:	version of the partition table
163  * @num_entries: number of partitions in the table
164  * @reserved:	for now reserved entries
165  * @entry:	list of @smem_ptable_entry for the @num_entries partitions
166  */
167 struct smem_ptable {
168 	u8 magic[4];
169 	__le32 version;
170 	__le32 num_entries;
171 	__le32 reserved[5];
172 	struct smem_ptable_entry entry[];
173 };
174 
175 static const u8 SMEM_PTABLE_MAGIC[] = { 0x24, 0x54, 0x4f, 0x43 }; /* "$TOC" */
176 
177 /**
178  * struct smem_partition_header - header of the partitions
179  * @magic:	magic number, must be SMEM_PART_MAGIC
180  * @host0:	first processor/host with access to this partition
181  * @host1:	second processor/host with access to this partition
182  * @size:	size of the partition
183  * @offset_free_uncached: offset to the first free byte of uncached memory in
184  *		this partition
185  * @offset_free_cached: offset to the first free byte of cached memory in this
186  *		partition
187  * @reserved:	for now reserved entries
188  */
189 struct smem_partition_header {
190 	u8 magic[4];
191 	__le16 host0;
192 	__le16 host1;
193 	__le32 size;
194 	__le32 offset_free_uncached;
195 	__le32 offset_free_cached;
196 	__le32 reserved[3];
197 };
198 
199 /**
200  * struct smem_partition - describes smem partition
201  * @virt_base:	starting virtual address of partition
202  * @phys_base:	starting physical address of partition
203  * @cacheline:	alignment for "cached" entries
204  * @size:	size of partition
205  */
206 struct smem_partition {
207 	void __iomem *virt_base;
208 	phys_addr_t phys_base;
209 	size_t cacheline;
210 	size_t size;
211 };
212 
213 static const u8 SMEM_PART_MAGIC[] = { 0x24, 0x50, 0x52, 0x54 };
214 
215 /**
216  * struct smem_private_entry - header of each item in the private partition
217  * @canary:	magic number, must be SMEM_PRIVATE_CANARY
218  * @item:	identifying number of the smem item
219  * @size:	size of the data, including padding bytes
220  * @padding_data: number of bytes of padding of data
221  * @padding_hdr: number of bytes of padding between the header and the data
222  * @reserved:	for now reserved entry
223  */
224 struct smem_private_entry {
225 	u16 canary; /* bytes are the same so no swapping needed */
226 	__le16 item;
227 	__le32 size; /* includes padding bytes */
228 	__le16 padding_data;
229 	__le16 padding_hdr;
230 	__le32 reserved;
231 };
232 #define SMEM_PRIVATE_CANARY	0xa5a5
233 
234 /**
235  * struct smem_info - smem region info located after the table of contents
236  * @magic:	magic number, must be SMEM_INFO_MAGIC
237  * @size:	size of the smem region
238  * @base_addr:	base address of the smem region
239  * @reserved:	for now reserved entry
240  * @num_items:	highest accepted item number
241  */
242 struct smem_info {
243 	u8 magic[4];
244 	__le32 size;
245 	__le32 base_addr;
246 	__le32 reserved;
247 	__le16 num_items;
248 };
249 
250 static const u8 SMEM_INFO_MAGIC[] = { 0x53, 0x49, 0x49, 0x49 }; /* SIII */
251 
252 /**
253  * struct smem_region - representation of a chunk of memory used for smem
254  * @aux_base:	identifier of aux_mem base
255  * @virt_base:	virtual base address of memory with this aux_mem identifier
256  * @size:	size of the memory region
257  */
258 struct smem_region {
259 	phys_addr_t aux_base;
260 	void __iomem *virt_base;
261 	size_t size;
262 };
263 
264 /**
265  * struct qcom_smem - device data for the smem device
266  * @dev:	device pointer
267  * @hwlock:	reference to a hwspinlock
268  * @ptable: virtual base of partition table
269  * @global_partition: describes for global partition when in use
270  * @partitions: list of partitions of current processor/host
271  * @item_count: max accepted item number
272  * @socinfo:	platform device pointer
273  * @num_regions: number of @regions
274  * @regions:	list of the memory regions defining the shared memory
275  */
276 struct qcom_smem {
277 	struct device *dev;
278 
279 	struct hwspinlock *hwlock;
280 
281 	u32 item_count;
282 	struct platform_device *socinfo;
283 	struct smem_ptable *ptable;
284 	struct smem_partition global_partition;
285 	struct smem_partition partitions[SMEM_HOST_COUNT];
286 
287 	unsigned num_regions;
288 	struct smem_region regions[] __counted_by(num_regions);
289 };
290 
291 static void *
phdr_to_last_uncached_entry(struct smem_partition_header * phdr)292 phdr_to_last_uncached_entry(struct smem_partition_header *phdr)
293 {
294 	void *p = phdr;
295 
296 	return p + le32_to_cpu(phdr->offset_free_uncached);
297 }
298 
299 static struct smem_private_entry *
phdr_to_first_cached_entry(struct smem_partition_header * phdr,size_t cacheline)300 phdr_to_first_cached_entry(struct smem_partition_header *phdr,
301 					size_t cacheline)
302 {
303 	void *p = phdr;
304 	struct smem_private_entry *e;
305 
306 	return p + le32_to_cpu(phdr->size) - ALIGN(sizeof(*e), cacheline);
307 }
308 
309 static void *
phdr_to_last_cached_entry(struct smem_partition_header * phdr)310 phdr_to_last_cached_entry(struct smem_partition_header *phdr)
311 {
312 	void *p = phdr;
313 
314 	return p + le32_to_cpu(phdr->offset_free_cached);
315 }
316 
317 static struct smem_private_entry *
phdr_to_first_uncached_entry(struct smem_partition_header * phdr)318 phdr_to_first_uncached_entry(struct smem_partition_header *phdr)
319 {
320 	void *p = phdr;
321 
322 	return p + sizeof(*phdr);
323 }
324 
325 static struct smem_private_entry *
uncached_entry_next(struct smem_private_entry * e)326 uncached_entry_next(struct smem_private_entry *e)
327 {
328 	void *p = e;
329 
330 	return p + sizeof(*e) + le16_to_cpu(e->padding_hdr) +
331 	       le32_to_cpu(e->size);
332 }
333 
334 static struct smem_private_entry *
cached_entry_next(struct smem_private_entry * e,size_t cacheline)335 cached_entry_next(struct smem_private_entry *e, size_t cacheline)
336 {
337 	void *p = e;
338 
339 	return p - le32_to_cpu(e->size) - ALIGN(sizeof(*e), cacheline);
340 }
341 
uncached_entry_to_item(struct smem_private_entry * e)342 static void *uncached_entry_to_item(struct smem_private_entry *e)
343 {
344 	void *p = e;
345 
346 	return p + sizeof(*e) + le16_to_cpu(e->padding_hdr);
347 }
348 
cached_entry_to_item(struct smem_private_entry * e)349 static void *cached_entry_to_item(struct smem_private_entry *e)
350 {
351 	void *p = e;
352 
353 	return p - le32_to_cpu(e->size);
354 }
355 
356 /* Pointer to the one and only smem handle */
357 static struct qcom_smem *__smem;
358 
359 /* Timeout (ms) for the trylock of remote spinlocks */
360 #define HWSPINLOCK_TIMEOUT	1000
361 
362 /* The qcom hwspinlock id is always plus one from the smem host id */
363 #define SMEM_HOST_ID_TO_HWSPINLOCK_ID(__x) ((__x) + 1)
364 
365 /**
366  * qcom_smem_bust_hwspin_lock_by_host() - bust the smem hwspinlock for a host
367  * @host:	remote processor id
368  *
369  * Busts the hwspin_lock for the given smem host id. This helper is intended
370  * for remoteproc drivers that manage remoteprocs with an equivalent smem
371  * driver instance in the remote firmware. Drivers can force a release of the
372  * smem hwspin_lock if the rproc unexpectedly goes into a bad state.
373  *
374  * Context: Process context.
375  *
376  * Returns: 0 on success, otherwise negative errno.
377  */
qcom_smem_bust_hwspin_lock_by_host(unsigned int host)378 int qcom_smem_bust_hwspin_lock_by_host(unsigned int host)
379 {
380 	/* This function is for remote procs, so ignore SMEM_HOST_APPS */
381 	if (host == SMEM_HOST_APPS || host >= SMEM_HOST_COUNT)
382 		return -EINVAL;
383 
384 	return hwspin_lock_bust(__smem->hwlock, SMEM_HOST_ID_TO_HWSPINLOCK_ID(host));
385 }
386 EXPORT_SYMBOL_GPL(qcom_smem_bust_hwspin_lock_by_host);
387 
388 /**
389  * qcom_smem_is_available() - Check if SMEM is available
390  *
391  * Return: true if SMEM is available, false otherwise.
392  */
qcom_smem_is_available(void)393 bool qcom_smem_is_available(void)
394 {
395 	return !!__smem;
396 }
397 EXPORT_SYMBOL_GPL(qcom_smem_is_available);
398 
qcom_smem_alloc_private(struct qcom_smem * smem,struct smem_partition * part,unsigned item,size_t size)399 static int qcom_smem_alloc_private(struct qcom_smem *smem,
400 				   struct smem_partition *part,
401 				   unsigned item,
402 				   size_t size)
403 {
404 	struct smem_private_entry *hdr, *end;
405 	struct smem_partition_header *phdr;
406 	size_t alloc_size;
407 	void *cached;
408 	void *p_end;
409 
410 	phdr = (struct smem_partition_header __force *)part->virt_base;
411 	p_end = (void *)phdr + part->size;
412 
413 	hdr = phdr_to_first_uncached_entry(phdr);
414 	end = phdr_to_last_uncached_entry(phdr);
415 	cached = phdr_to_last_cached_entry(phdr);
416 
417 	if (WARN_ON((void *)end > p_end || cached > p_end))
418 		return -EINVAL;
419 
420 	while (hdr < end) {
421 		if (hdr->canary != SMEM_PRIVATE_CANARY)
422 			goto bad_canary;
423 		if (le16_to_cpu(hdr->item) == item)
424 			return -EEXIST;
425 
426 		hdr = uncached_entry_next(hdr);
427 	}
428 
429 	if (WARN_ON((void *)hdr > p_end))
430 		return -EINVAL;
431 
432 	/* Check that we don't grow into the cached region */
433 	alloc_size = sizeof(*hdr) + ALIGN(size, 8);
434 	if ((void *)hdr + alloc_size > cached) {
435 		dev_err(smem->dev, "Out of memory\n");
436 		return -ENOSPC;
437 	}
438 
439 	hdr->canary = SMEM_PRIVATE_CANARY;
440 	hdr->item = cpu_to_le16(item);
441 	hdr->size = cpu_to_le32(ALIGN(size, 8));
442 	hdr->padding_data = cpu_to_le16(le32_to_cpu(hdr->size) - size);
443 	hdr->padding_hdr = 0;
444 
445 	/*
446 	 * Ensure the header is written before we advance the free offset, so
447 	 * that remote processors that does not take the remote spinlock still
448 	 * gets a consistent view of the linked list.
449 	 */
450 	wmb();
451 	le32_add_cpu(&phdr->offset_free_uncached, alloc_size);
452 
453 	return 0;
454 bad_canary:
455 	dev_err(smem->dev, "Found invalid canary in hosts %hu:%hu partition\n",
456 		le16_to_cpu(phdr->host0), le16_to_cpu(phdr->host1));
457 
458 	return -EINVAL;
459 }
460 
qcom_smem_alloc_global(struct qcom_smem * smem,unsigned item,size_t size)461 static int qcom_smem_alloc_global(struct qcom_smem *smem,
462 				  unsigned item,
463 				  size_t size)
464 {
465 	struct smem_global_entry *entry;
466 	struct smem_header *header;
467 
468 	header = smem->regions[0].virt_base;
469 	entry = &header->toc[item];
470 	if (entry->allocated)
471 		return -EEXIST;
472 
473 	size = ALIGN(size, 8);
474 	if (WARN_ON(size > le32_to_cpu(header->available)))
475 		return -ENOMEM;
476 
477 	entry->offset = header->free_offset;
478 	entry->size = cpu_to_le32(size);
479 
480 	/*
481 	 * Ensure the header is consistent before we mark the item allocated,
482 	 * so that remote processors will get a consistent view of the item
483 	 * even though they do not take the spinlock on read.
484 	 */
485 	wmb();
486 	entry->allocated = cpu_to_le32(1);
487 
488 	le32_add_cpu(&header->free_offset, size);
489 	le32_add_cpu(&header->available, -size);
490 
491 	return 0;
492 }
493 
494 /**
495  * qcom_smem_alloc() - allocate space for a smem item
496  * @host:	remote processor id, or -1
497  * @item:	smem item handle
498  * @size:	number of bytes to be allocated
499  *
500  * Allocate space for a given smem item of size @size, given that the item is
501  * not yet allocated.
502  */
qcom_smem_alloc(unsigned host,unsigned item,size_t size)503 int qcom_smem_alloc(unsigned host, unsigned item, size_t size)
504 {
505 	struct smem_partition *part;
506 	unsigned long flags;
507 	int ret;
508 
509 	if (!__smem)
510 		return -EPROBE_DEFER;
511 
512 	if (item < SMEM_ITEM_LAST_FIXED) {
513 		dev_err(__smem->dev,
514 			"Rejecting allocation of static entry %d\n", item);
515 		return -EINVAL;
516 	}
517 
518 	if (WARN_ON(item >= __smem->item_count))
519 		return -EINVAL;
520 
521 	ret = hwspin_lock_timeout_irqsave(__smem->hwlock,
522 					  HWSPINLOCK_TIMEOUT,
523 					  &flags);
524 	if (ret)
525 		return ret;
526 
527 	if (host < SMEM_HOST_COUNT && __smem->partitions[host].virt_base) {
528 		part = &__smem->partitions[host];
529 		ret = qcom_smem_alloc_private(__smem, part, item, size);
530 	} else if (__smem->global_partition.virt_base) {
531 		part = &__smem->global_partition;
532 		ret = qcom_smem_alloc_private(__smem, part, item, size);
533 	} else {
534 		ret = qcom_smem_alloc_global(__smem, item, size);
535 	}
536 
537 	hwspin_unlock_irqrestore(__smem->hwlock, &flags);
538 
539 	return ret;
540 }
541 EXPORT_SYMBOL_GPL(qcom_smem_alloc);
542 
qcom_smem_get_global(struct qcom_smem * smem,unsigned item,size_t * size)543 static void *qcom_smem_get_global(struct qcom_smem *smem,
544 				  unsigned item,
545 				  size_t *size)
546 {
547 	struct smem_header *header;
548 	struct smem_region *region;
549 	struct smem_global_entry *entry;
550 	u64 entry_offset;
551 	u32 e_size;
552 	u32 aux_base;
553 	unsigned i;
554 
555 	header = smem->regions[0].virt_base;
556 	entry = &header->toc[item];
557 	if (!entry->allocated)
558 		return ERR_PTR(-ENXIO);
559 
560 	aux_base = le32_to_cpu(entry->aux_base) & AUX_BASE_MASK;
561 
562 	for (i = 0; i < smem->num_regions; i++) {
563 		region = &smem->regions[i];
564 
565 		if ((u32)region->aux_base == aux_base || !aux_base) {
566 			e_size = le32_to_cpu(entry->size);
567 			entry_offset = le32_to_cpu(entry->offset);
568 
569 			if (WARN_ON(e_size + entry_offset > region->size))
570 				return ERR_PTR(-EINVAL);
571 
572 			if (size != NULL)
573 				*size = e_size;
574 
575 			return region->virt_base + entry_offset;
576 		}
577 	}
578 
579 	return ERR_PTR(-ENOENT);
580 }
581 
qcom_smem_get_private(struct qcom_smem * smem,struct smem_partition * part,unsigned item,size_t * size)582 static void *qcom_smem_get_private(struct qcom_smem *smem,
583 				   struct smem_partition *part,
584 				   unsigned item,
585 				   size_t *size)
586 {
587 	struct smem_private_entry *e, *end;
588 	struct smem_partition_header *phdr;
589 	void *item_ptr, *p_end;
590 	u32 padding_data;
591 	u32 e_size;
592 
593 	phdr = (struct smem_partition_header __force *)part->virt_base;
594 	p_end = (void *)phdr + part->size;
595 
596 	e = phdr_to_first_uncached_entry(phdr);
597 	end = phdr_to_last_uncached_entry(phdr);
598 
599 	while (e < end) {
600 		if (e->canary != SMEM_PRIVATE_CANARY)
601 			goto invalid_canary;
602 
603 		if (le16_to_cpu(e->item) == item) {
604 			if (size != NULL) {
605 				e_size = le32_to_cpu(e->size);
606 				padding_data = le16_to_cpu(e->padding_data);
607 
608 				if (WARN_ON(e_size > part->size || padding_data > e_size))
609 					return ERR_PTR(-EINVAL);
610 
611 				*size = e_size - padding_data;
612 			}
613 
614 			item_ptr = uncached_entry_to_item(e);
615 			if (WARN_ON(item_ptr > p_end))
616 				return ERR_PTR(-EINVAL);
617 
618 			return item_ptr;
619 		}
620 
621 		e = uncached_entry_next(e);
622 	}
623 
624 	if (WARN_ON((void *)e > p_end))
625 		return ERR_PTR(-EINVAL);
626 
627 	/* Item was not found in the uncached list, search the cached list */
628 
629 	e = phdr_to_first_cached_entry(phdr, part->cacheline);
630 	end = phdr_to_last_cached_entry(phdr);
631 
632 	if (WARN_ON((void *)e < (void *)phdr || (void *)end > p_end))
633 		return ERR_PTR(-EINVAL);
634 
635 	while (e > end) {
636 		if (e->canary != SMEM_PRIVATE_CANARY)
637 			goto invalid_canary;
638 
639 		if (le16_to_cpu(e->item) == item) {
640 			if (size != NULL) {
641 				e_size = le32_to_cpu(e->size);
642 				padding_data = le16_to_cpu(e->padding_data);
643 
644 				if (WARN_ON(e_size > part->size || padding_data > e_size))
645 					return ERR_PTR(-EINVAL);
646 
647 				*size = e_size - padding_data;
648 			}
649 
650 			item_ptr = cached_entry_to_item(e);
651 			if (WARN_ON(item_ptr < (void *)phdr))
652 				return ERR_PTR(-EINVAL);
653 
654 			return item_ptr;
655 		}
656 
657 		e = cached_entry_next(e, part->cacheline);
658 	}
659 
660 	if (WARN_ON((void *)e < (void *)phdr))
661 		return ERR_PTR(-EINVAL);
662 
663 	return ERR_PTR(-ENOENT);
664 
665 invalid_canary:
666 	dev_err(smem->dev, "Found invalid canary in hosts %hu:%hu partition\n",
667 			le16_to_cpu(phdr->host0), le16_to_cpu(phdr->host1));
668 
669 	return ERR_PTR(-EINVAL);
670 }
671 
672 /**
673  * qcom_smem_get() - resolve ptr of size of a smem item
674  * @host:	the remote processor, or -1
675  * @item:	smem item handle
676  * @size:	pointer to be filled out with size of the item
677  *
678  * Looks up smem item and returns pointer to it. Size of smem
679  * item is returned in @size.
680  */
qcom_smem_get(unsigned host,unsigned item,size_t * size)681 void *qcom_smem_get(unsigned host, unsigned item, size_t *size)
682 {
683 	struct smem_partition *part;
684 	void *ptr = ERR_PTR(-EPROBE_DEFER);
685 
686 	if (!__smem)
687 		return ptr;
688 
689 	if (WARN_ON(item >= __smem->item_count))
690 		return ERR_PTR(-EINVAL);
691 
692 	if (host < SMEM_HOST_COUNT && __smem->partitions[host].virt_base) {
693 		part = &__smem->partitions[host];
694 		ptr = qcom_smem_get_private(__smem, part, item, size);
695 	} else if (__smem->global_partition.virt_base) {
696 		part = &__smem->global_partition;
697 		ptr = qcom_smem_get_private(__smem, part, item, size);
698 	} else {
699 		ptr = qcom_smem_get_global(__smem, item, size);
700 	}
701 
702 	return ptr;
703 }
704 EXPORT_SYMBOL_GPL(qcom_smem_get);
705 
706 /**
707  * qcom_smem_get_free_space() - retrieve amount of free space in a partition
708  * @host:	the remote processor identifying a partition, or -1
709  *
710  * To be used by smem clients as a quick way to determine if any new
711  * allocations has been made.
712  */
qcom_smem_get_free_space(unsigned host)713 int qcom_smem_get_free_space(unsigned host)
714 {
715 	struct smem_partition *part;
716 	struct smem_partition_header *phdr;
717 	struct smem_header *header;
718 	unsigned ret;
719 
720 	if (!__smem)
721 		return -EPROBE_DEFER;
722 
723 	if (host < SMEM_HOST_COUNT && __smem->partitions[host].virt_base) {
724 		part = &__smem->partitions[host];
725 		phdr = part->virt_base;
726 		ret = le32_to_cpu(phdr->offset_free_cached) -
727 		      le32_to_cpu(phdr->offset_free_uncached);
728 
729 		if (ret > le32_to_cpu(part->size))
730 			return -EINVAL;
731 	} else if (__smem->global_partition.virt_base) {
732 		part = &__smem->global_partition;
733 		phdr = part->virt_base;
734 		ret = le32_to_cpu(phdr->offset_free_cached) -
735 		      le32_to_cpu(phdr->offset_free_uncached);
736 
737 		if (ret > le32_to_cpu(part->size))
738 			return -EINVAL;
739 	} else {
740 		header = __smem->regions[0].virt_base;
741 		ret = le32_to_cpu(header->available);
742 
743 		if (ret > __smem->regions[0].size)
744 			return -EINVAL;
745 	}
746 
747 	return ret;
748 }
749 EXPORT_SYMBOL_GPL(qcom_smem_get_free_space);
750 
addr_in_range(void __iomem * base,size_t size,void * addr)751 static bool addr_in_range(void __iomem *base, size_t size, void *addr)
752 {
753 	return base && ((void __iomem *)addr >= base && (void __iomem *)addr < base + size);
754 }
755 
756 /**
757  * qcom_smem_virt_to_phys() - return the physical address associated
758  * with an smem item pointer (previously returned by qcom_smem_get()
759  * @p:	the virtual address to convert
760  *
761  * Returns 0 if the pointer provided is not within any smem region.
762  */
qcom_smem_virt_to_phys(void * p)763 phys_addr_t qcom_smem_virt_to_phys(void *p)
764 {
765 	struct smem_partition *part;
766 	struct smem_region *area;
767 	u64 offset;
768 	u32 i;
769 
770 	for (i = 0; i < SMEM_HOST_COUNT; i++) {
771 		part = &__smem->partitions[i];
772 
773 		if (addr_in_range(part->virt_base, part->size, p)) {
774 			offset = p - part->virt_base;
775 
776 			return (phys_addr_t)part->phys_base + offset;
777 		}
778 	}
779 
780 	part = &__smem->global_partition;
781 
782 	if (addr_in_range(part->virt_base, part->size, p)) {
783 		offset = p - part->virt_base;
784 
785 		return (phys_addr_t)part->phys_base + offset;
786 	}
787 
788 	for (i = 0; i < __smem->num_regions; i++) {
789 		area = &__smem->regions[i];
790 
791 		if (addr_in_range(area->virt_base, area->size, p)) {
792 			offset = p - area->virt_base;
793 
794 			return (phys_addr_t)area->aux_base + offset;
795 		}
796 	}
797 
798 	return 0;
799 }
800 EXPORT_SYMBOL_GPL(qcom_smem_virt_to_phys);
801 
802 /**
803  * qcom_smem_get_soc_id() - return the SoC ID
804  * @id:	On success, we return the SoC ID here.
805  *
806  * Look up SoC ID from HW/SW build ID and return it.
807  *
808  * Return: 0 on success, negative errno on failure.
809  */
qcom_smem_get_soc_id(u32 * id)810 int qcom_smem_get_soc_id(u32 *id)
811 {
812 	struct socinfo *info;
813 
814 	info = qcom_smem_get(QCOM_SMEM_HOST_ANY, SMEM_HW_SW_BUILD_ID, NULL);
815 	if (IS_ERR(info))
816 		return PTR_ERR(info);
817 
818 	*id = __le32_to_cpu(info->id);
819 
820 	return 0;
821 }
822 EXPORT_SYMBOL_GPL(qcom_smem_get_soc_id);
823 
824 /**
825  * qcom_smem_get_feature_code() - return the feature code
826  * @code: On success, return the feature code here.
827  *
828  * Look up the feature code identifier from SMEM and return it.
829  *
830  * Return: 0 on success, negative errno on failure.
831  */
qcom_smem_get_feature_code(u32 * code)832 int qcom_smem_get_feature_code(u32 *code)
833 {
834 	struct socinfo *info;
835 	u32 raw_code;
836 
837 	info = qcom_smem_get(QCOM_SMEM_HOST_ANY, SMEM_HW_SW_BUILD_ID, NULL);
838 	if (IS_ERR(info))
839 		return PTR_ERR(info);
840 
841 	/* This only makes sense for socinfo >= 16 */
842 	if (__le32_to_cpu(info->fmt) < SOCINFO_VERSION(0, 16))
843 		return -EOPNOTSUPP;
844 
845 	raw_code = __le32_to_cpu(info->feature_code);
846 
847 	/* Ensure the value makes sense */
848 	if (raw_code > SOCINFO_FC_INT_MAX)
849 		raw_code = SOCINFO_FC_UNKNOWN;
850 
851 	*code = raw_code;
852 
853 	return 0;
854 }
855 EXPORT_SYMBOL_GPL(qcom_smem_get_feature_code);
856 
qcom_smem_get_sbl_version(struct qcom_smem * smem)857 static int qcom_smem_get_sbl_version(struct qcom_smem *smem)
858 {
859 	struct smem_header *header;
860 	__le32 *versions;
861 
862 	header = smem->regions[0].virt_base;
863 	versions = header->version;
864 
865 	return le32_to_cpu(versions[SMEM_MASTER_SBL_VERSION_INDEX]);
866 }
867 
qcom_smem_get_ptable(struct qcom_smem * smem)868 static struct smem_ptable *qcom_smem_get_ptable(struct qcom_smem *smem)
869 {
870 	struct smem_ptable *ptable;
871 	u32 version;
872 
873 	ptable = smem->ptable;
874 	if (memcmp(ptable->magic, SMEM_PTABLE_MAGIC, sizeof(ptable->magic)))
875 		return ERR_PTR(-ENOENT);
876 
877 	version = le32_to_cpu(ptable->version);
878 	if (version != 1) {
879 		dev_err(smem->dev,
880 			"Unsupported partition header version %d\n", version);
881 		return ERR_PTR(-EINVAL);
882 	}
883 	return ptable;
884 }
885 
qcom_smem_get_item_count(struct qcom_smem * smem)886 static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
887 {
888 	struct smem_ptable *ptable;
889 	struct smem_info *info;
890 
891 	ptable = qcom_smem_get_ptable(smem);
892 	if (IS_ERR_OR_NULL(ptable))
893 		return SMEM_ITEM_COUNT;
894 
895 	info = (struct smem_info *)&ptable->entry[ptable->num_entries];
896 	if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
897 		return SMEM_ITEM_COUNT;
898 
899 	return le16_to_cpu(info->num_items);
900 }
901 
902 /*
903  * Validate the partition header for a partition whose partition
904  * table entry is supplied.  Returns a pointer to its header if
905  * valid, or a null pointer otherwise.
906  */
907 static struct smem_partition_header *
qcom_smem_partition_header(struct qcom_smem * smem,struct smem_ptable_entry * entry,u16 host0,u16 host1)908 qcom_smem_partition_header(struct qcom_smem *smem,
909 		struct smem_ptable_entry *entry, u16 host0, u16 host1)
910 {
911 	struct smem_partition_header *header;
912 	u32 phys_addr;
913 	u32 size;
914 
915 	phys_addr = smem->regions[0].aux_base + le32_to_cpu(entry->offset);
916 	header = devm_ioremap_wc(smem->dev, phys_addr, le32_to_cpu(entry->size));
917 
918 	if (!header)
919 		return NULL;
920 
921 	if (memcmp(header->magic, SMEM_PART_MAGIC, sizeof(header->magic))) {
922 		dev_err(smem->dev, "bad partition magic %4ph\n", header->magic);
923 		return NULL;
924 	}
925 
926 	if (host0 != le16_to_cpu(header->host0)) {
927 		dev_err(smem->dev, "bad host0 (%hu != %hu)\n",
928 				host0, le16_to_cpu(header->host0));
929 		return NULL;
930 	}
931 	if (host1 != le16_to_cpu(header->host1)) {
932 		dev_err(smem->dev, "bad host1 (%hu != %hu)\n",
933 				host1, le16_to_cpu(header->host1));
934 		return NULL;
935 	}
936 
937 	size = le32_to_cpu(header->size);
938 	if (size != le32_to_cpu(entry->size)) {
939 		dev_err(smem->dev, "bad partition size (%u != %u)\n",
940 			size, le32_to_cpu(entry->size));
941 		return NULL;
942 	}
943 
944 	if (le32_to_cpu(header->offset_free_uncached) > size) {
945 		dev_err(smem->dev, "bad partition free uncached (%u > %u)\n",
946 			le32_to_cpu(header->offset_free_uncached), size);
947 		return NULL;
948 	}
949 
950 	return header;
951 }
952 
qcom_smem_set_global_partition(struct qcom_smem * smem)953 static int qcom_smem_set_global_partition(struct qcom_smem *smem)
954 {
955 	struct smem_partition_header *header;
956 	struct smem_ptable_entry *entry;
957 	struct smem_ptable *ptable;
958 	bool found = false;
959 	int i;
960 
961 	if (smem->global_partition.virt_base) {
962 		dev_err(smem->dev, "Already found the global partition\n");
963 		return -EINVAL;
964 	}
965 
966 	ptable = qcom_smem_get_ptable(smem);
967 	if (IS_ERR(ptable))
968 		return PTR_ERR(ptable);
969 
970 	for (i = 0; i < le32_to_cpu(ptable->num_entries); i++) {
971 		entry = &ptable->entry[i];
972 		if (!le32_to_cpu(entry->offset))
973 			continue;
974 		if (!le32_to_cpu(entry->size))
975 			continue;
976 
977 		if (le16_to_cpu(entry->host0) != SMEM_GLOBAL_HOST)
978 			continue;
979 
980 		if (le16_to_cpu(entry->host1) == SMEM_GLOBAL_HOST) {
981 			found = true;
982 			break;
983 		}
984 	}
985 
986 	if (!found) {
987 		dev_err(smem->dev, "Missing entry for global partition\n");
988 		return -EINVAL;
989 	}
990 
991 	header = qcom_smem_partition_header(smem, entry,
992 				SMEM_GLOBAL_HOST, SMEM_GLOBAL_HOST);
993 	if (!header)
994 		return -EINVAL;
995 
996 	smem->global_partition.virt_base = (void __iomem *)header;
997 	smem->global_partition.phys_base = smem->regions[0].aux_base +
998 								le32_to_cpu(entry->offset);
999 	smem->global_partition.size = le32_to_cpu(entry->size);
1000 	smem->global_partition.cacheline = le32_to_cpu(entry->cacheline);
1001 
1002 	return 0;
1003 }
1004 
1005 static int
qcom_smem_enumerate_partitions(struct qcom_smem * smem,u16 local_host)1006 qcom_smem_enumerate_partitions(struct qcom_smem *smem, u16 local_host)
1007 {
1008 	struct smem_partition_header *header;
1009 	struct smem_ptable_entry *entry;
1010 	struct smem_ptable *ptable;
1011 	u16 remote_host;
1012 	u16 host0, host1;
1013 	int i;
1014 
1015 	ptable = qcom_smem_get_ptable(smem);
1016 	if (IS_ERR(ptable))
1017 		return PTR_ERR(ptable);
1018 
1019 	for (i = 0; i < le32_to_cpu(ptable->num_entries); i++) {
1020 		entry = &ptable->entry[i];
1021 		if (!le32_to_cpu(entry->offset))
1022 			continue;
1023 		if (!le32_to_cpu(entry->size))
1024 			continue;
1025 
1026 		host0 = le16_to_cpu(entry->host0);
1027 		host1 = le16_to_cpu(entry->host1);
1028 		if (host0 == local_host)
1029 			remote_host = host1;
1030 		else if (host1 == local_host)
1031 			remote_host = host0;
1032 		else
1033 			continue;
1034 
1035 		if (remote_host >= SMEM_HOST_COUNT) {
1036 			dev_err(smem->dev, "bad host %u\n", remote_host);
1037 			return -EINVAL;
1038 		}
1039 
1040 		if (smem->partitions[remote_host].virt_base) {
1041 			dev_err(smem->dev, "duplicate host %u\n", remote_host);
1042 			return -EINVAL;
1043 		}
1044 
1045 		header = qcom_smem_partition_header(smem, entry, host0, host1);
1046 		if (!header)
1047 			return -EINVAL;
1048 
1049 		smem->partitions[remote_host].virt_base = (void __iomem *)header;
1050 		smem->partitions[remote_host].phys_base = smem->regions[0].aux_base +
1051 										le32_to_cpu(entry->offset);
1052 		smem->partitions[remote_host].size = le32_to_cpu(entry->size);
1053 		smem->partitions[remote_host].cacheline = le32_to_cpu(entry->cacheline);
1054 	}
1055 
1056 	return 0;
1057 }
1058 
qcom_smem_map_toc(struct qcom_smem * smem,struct smem_region * region)1059 static int qcom_smem_map_toc(struct qcom_smem *smem, struct smem_region *region)
1060 {
1061 	u32 ptable_start;
1062 
1063 	/* map starting 4K for smem header */
1064 	region->virt_base = devm_ioremap_wc(smem->dev, region->aux_base, SZ_4K);
1065 	ptable_start = region->aux_base + region->size - SZ_4K;
1066 	/* map last 4k for toc */
1067 	smem->ptable = devm_ioremap_wc(smem->dev, ptable_start, SZ_4K);
1068 
1069 	if (!region->virt_base || !smem->ptable)
1070 		return -ENOMEM;
1071 
1072 	return 0;
1073 }
1074 
qcom_smem_map_global(struct qcom_smem * smem,u32 size)1075 static int qcom_smem_map_global(struct qcom_smem *smem, u32 size)
1076 {
1077 	u32 phys_addr;
1078 
1079 	phys_addr = smem->regions[0].aux_base;
1080 
1081 	smem->regions[0].size = size;
1082 	smem->regions[0].virt_base = devm_ioremap_wc(smem->dev, phys_addr, size);
1083 
1084 	if (!smem->regions[0].virt_base)
1085 		return -ENOMEM;
1086 
1087 	return 0;
1088 }
1089 
qcom_smem_resolve_mem(struct qcom_smem * smem,const char * name,struct smem_region * region)1090 static int qcom_smem_resolve_mem(struct qcom_smem *smem, const char *name,
1091 				 struct smem_region *region)
1092 {
1093 	struct device *dev = smem->dev;
1094 	struct device_node *np;
1095 	struct resource r;
1096 	int ret;
1097 
1098 	np = of_parse_phandle(dev->of_node, name, 0);
1099 	if (!np) {
1100 		dev_err(dev, "No %s specified\n", name);
1101 		return -EINVAL;
1102 	}
1103 
1104 	ret = of_address_to_resource(np, 0, &r);
1105 	of_node_put(np);
1106 	if (ret)
1107 		return ret;
1108 
1109 	region->aux_base = r.start;
1110 	region->size = resource_size(&r);
1111 
1112 	return 0;
1113 }
1114 
qcom_smem_probe(struct platform_device * pdev)1115 static int qcom_smem_probe(struct platform_device *pdev)
1116 {
1117 	struct smem_header *header;
1118 	struct reserved_mem *rmem;
1119 	struct qcom_smem *smem;
1120 	unsigned long flags;
1121 	int num_regions;
1122 	int hwlock_id;
1123 	u32 version;
1124 	u32 size;
1125 	int ret;
1126 	int i;
1127 
1128 	num_regions = 1;
1129 	if (of_property_present(pdev->dev.of_node, "qcom,rpm-msg-ram"))
1130 		num_regions++;
1131 
1132 	smem = devm_kzalloc(&pdev->dev, struct_size(smem, regions, num_regions),
1133 			    GFP_KERNEL);
1134 	if (!smem)
1135 		return -ENOMEM;
1136 
1137 	smem->dev = &pdev->dev;
1138 	smem->num_regions = num_regions;
1139 
1140 	rmem = of_reserved_mem_lookup(pdev->dev.of_node);
1141 	if (rmem) {
1142 		smem->regions[0].aux_base = rmem->base;
1143 		smem->regions[0].size = rmem->size;
1144 	} else {
1145 		/*
1146 		 * Fall back to the memory-region reference, if we're not a
1147 		 * reserved-memory node.
1148 		 */
1149 		ret = qcom_smem_resolve_mem(smem, "memory-region", &smem->regions[0]);
1150 		if (ret)
1151 			return ret;
1152 	}
1153 
1154 	if (num_regions > 1) {
1155 		ret = qcom_smem_resolve_mem(smem, "qcom,rpm-msg-ram", &smem->regions[1]);
1156 		if (ret)
1157 			return ret;
1158 	}
1159 
1160 
1161 	ret = qcom_smem_map_toc(smem, &smem->regions[0]);
1162 	if (ret)
1163 		return ret;
1164 
1165 	for (i = 1; i < num_regions; i++) {
1166 		smem->regions[i].virt_base = devm_ioremap_wc(&pdev->dev,
1167 							     smem->regions[i].aux_base,
1168 							     smem->regions[i].size);
1169 		if (!smem->regions[i].virt_base) {
1170 			dev_err(&pdev->dev, "failed to remap %pa\n", &smem->regions[i].aux_base);
1171 			return -ENOMEM;
1172 		}
1173 	}
1174 
1175 	header = smem->regions[0].virt_base;
1176 	if (le32_to_cpu(header->initialized) != 1 ||
1177 	    le32_to_cpu(header->reserved)) {
1178 		dev_err(&pdev->dev, "SMEM is not initialized by SBL\n");
1179 		return -EINVAL;
1180 	}
1181 
1182 	hwlock_id = of_hwspin_lock_get_id(pdev->dev.of_node, 0);
1183 	if (hwlock_id < 0) {
1184 		if (hwlock_id != -EPROBE_DEFER)
1185 			dev_err(&pdev->dev, "failed to retrieve hwlock\n");
1186 		return hwlock_id;
1187 	}
1188 
1189 	smem->hwlock = hwspin_lock_request_specific(hwlock_id);
1190 	if (!smem->hwlock)
1191 		return -ENXIO;
1192 
1193 	ret = hwspin_lock_timeout_irqsave(smem->hwlock, HWSPINLOCK_TIMEOUT, &flags);
1194 	if (ret)
1195 		return ret;
1196 	size = readl_relaxed(&header->available) + readl_relaxed(&header->free_offset);
1197 	hwspin_unlock_irqrestore(smem->hwlock, &flags);
1198 
1199 	version = qcom_smem_get_sbl_version(smem);
1200 	/*
1201 	 * smem header mapping is required only in heap version scheme, so unmap
1202 	 * it here. It will be remapped in qcom_smem_map_global() when whole
1203 	 * partition is mapped again.
1204 	 */
1205 	devm_iounmap(smem->dev, smem->regions[0].virt_base);
1206 	switch (version >> 16) {
1207 	case SMEM_GLOBAL_PART_VERSION:
1208 		ret = qcom_smem_set_global_partition(smem);
1209 		if (ret < 0)
1210 			return ret;
1211 		smem->item_count = qcom_smem_get_item_count(smem);
1212 		break;
1213 	case SMEM_GLOBAL_HEAP_VERSION:
1214 		qcom_smem_map_global(smem, size);
1215 		smem->item_count = SMEM_ITEM_COUNT;
1216 		break;
1217 	default:
1218 		dev_err(&pdev->dev, "Unsupported SMEM version 0x%x\n", version);
1219 		return -EINVAL;
1220 	}
1221 
1222 	BUILD_BUG_ON(SMEM_HOST_APPS >= SMEM_HOST_COUNT);
1223 	ret = qcom_smem_enumerate_partitions(smem, SMEM_HOST_APPS);
1224 	if (ret < 0 && ret != -ENOENT)
1225 		return ret;
1226 
1227 	__smem = smem;
1228 
1229 	smem->socinfo = platform_device_register_data(&pdev->dev, "qcom-socinfo",
1230 						      PLATFORM_DEVID_NONE, NULL,
1231 						      0);
1232 	if (IS_ERR(smem->socinfo))
1233 		dev_dbg(&pdev->dev, "failed to register socinfo device\n");
1234 
1235 	return 0;
1236 }
1237 
qcom_smem_remove(struct platform_device * pdev)1238 static void qcom_smem_remove(struct platform_device *pdev)
1239 {
1240 	platform_device_unregister(__smem->socinfo);
1241 
1242 	hwspin_lock_free(__smem->hwlock);
1243 	__smem = NULL;
1244 }
1245 
1246 static const struct of_device_id qcom_smem_of_match[] = {
1247 	{ .compatible = "qcom,smem" },
1248 	{}
1249 };
1250 MODULE_DEVICE_TABLE(of, qcom_smem_of_match);
1251 
1252 static struct platform_driver qcom_smem_driver = {
1253 	.probe = qcom_smem_probe,
1254 	.remove_new = qcom_smem_remove,
1255 	.driver  = {
1256 		.name = "qcom-smem",
1257 		.of_match_table = qcom_smem_of_match,
1258 		.suppress_bind_attrs = true,
1259 	},
1260 };
1261 
qcom_smem_init(void)1262 static int __init qcom_smem_init(void)
1263 {
1264 	return platform_driver_register(&qcom_smem_driver);
1265 }
1266 arch_initcall(qcom_smem_init);
1267 
qcom_smem_exit(void)1268 static void __exit qcom_smem_exit(void)
1269 {
1270 	platform_driver_unregister(&qcom_smem_driver);
1271 }
1272 module_exit(qcom_smem_exit)
1273 
1274 MODULE_AUTHOR("Bjorn Andersson <bjorn.andersson@sonymobile.com>");
1275 MODULE_DESCRIPTION("Qualcomm Shared Memory Manager");
1276 MODULE_LICENSE("GPL v2");
1277