1 // SPDX-License-Identifier: GPL-2.0-only OR MIT 2 /* 3 * Apple SMC (System Management Controller) MFD driver 4 * 5 * Copyright The Asahi Linux Contributors 6 */ 7 8 #include <linux/bitfield.h> 9 #include <linux/delay.h> 10 #include <linux/device.h> 11 #include <linux/io.h> 12 #include <linux/ioport.h> 13 #include <linux/math.h> 14 #include <linux/mfd/core.h> 15 #include <linux/mfd/macsmc.h> 16 #include <linux/notifier.h> 17 #include <linux/of.h> 18 #include <linux/of_platform.h> 19 #include <linux/overflow.h> 20 #include <linux/platform_device.h> 21 #include <linux/soc/apple/rtkit.h> 22 #include <linux/unaligned.h> 23 24 #define SMC_ENDPOINT 0x20 25 26 /* We don't actually know the true size here but this seem reasonable */ 27 #define SMC_SHMEM_SIZE 0x1000 28 #define SMC_MAX_SIZE 255 29 30 #define SMC_MSG_READ_KEY 0x10 31 #define SMC_MSG_WRITE_KEY 0x11 32 #define SMC_MSG_GET_KEY_BY_INDEX 0x12 33 #define SMC_MSG_GET_KEY_INFO 0x13 34 #define SMC_MSG_INITIALIZE 0x17 35 #define SMC_MSG_NOTIFICATION 0x18 36 #define SMC_MSG_RW_KEY 0x20 37 38 #define SMC_DATA GENMASK_ULL(63, 32) 39 #define SMC_WSIZE GENMASK_ULL(31, 24) 40 #define SMC_SIZE GENMASK_ULL(23, 16) 41 #define SMC_ID GENMASK_ULL(15, 12) 42 #define SMC_MSG GENMASK_ULL(7, 0) 43 #define SMC_RESULT SMC_MSG 44 45 #define SMC_TIMEOUT_MS 500 46 47 static const struct mfd_cell apple_smc_devs[] = { 48 MFD_CELL_NAME("macsmc-input"), 49 MFD_CELL_OF("macsmc-gpio", NULL, NULL, 0, 0, "apple,smc-gpio"), 50 MFD_CELL_OF("macsmc-hwmon", NULL, NULL, 0, 0, "apple,smc-hwmon"), 51 MFD_CELL_OF("macsmc-reboot", NULL, NULL, 0, 0, "apple,smc-reboot"), 52 MFD_CELL_OF("macsmc-rtc", NULL, NULL, 0, 0, "apple,smc-rtc"), 53 }; 54 55 static int apple_smc_cmd_locked(struct apple_smc *smc, u64 cmd, u64 arg, 56 u64 size, u64 wsize, u32 *ret_data) 57 { 58 u8 result; 59 int ret; 60 u64 msg; 61 62 lockdep_assert_held(&smc->mutex); 63 64 if (smc->boot_stage != APPLE_SMC_INITIALIZED) 65 return -EIO; 66 if (smc->atomic_mode) 67 return -EIO; 68 69 reinit_completion(&smc->cmd_done); 70 71 smc->msg_id = (smc->msg_id + 1) & 0xf; 72 msg = (FIELD_PREP(SMC_MSG, cmd) | 73 FIELD_PREP(SMC_SIZE, size) | 74 FIELD_PREP(SMC_WSIZE, wsize) | 75 FIELD_PREP(SMC_ID, smc->msg_id) | 76 FIELD_PREP(SMC_DATA, arg)); 77 78 ret = apple_rtkit_send_message(smc->rtk, SMC_ENDPOINT, msg, NULL, false); 79 if (ret) { 80 dev_err(smc->dev, "Failed to send command\n"); 81 return ret; 82 } 83 84 if (wait_for_completion_timeout(&smc->cmd_done, msecs_to_jiffies(SMC_TIMEOUT_MS)) <= 0) { 85 dev_err(smc->dev, "Command timed out (%llx)", msg); 86 return -ETIMEDOUT; 87 } 88 89 if (FIELD_GET(SMC_ID, smc->cmd_ret) != smc->msg_id) { 90 dev_err(smc->dev, "Command sequence mismatch (expected %d, got %d)\n", 91 smc->msg_id, (unsigned int)FIELD_GET(SMC_ID, smc->cmd_ret)); 92 return -EIO; 93 } 94 95 result = FIELD_GET(SMC_RESULT, smc->cmd_ret); 96 if (result) 97 return -EIO; 98 99 if (ret_data) 100 *ret_data = FIELD_GET(SMC_DATA, smc->cmd_ret); 101 102 return FIELD_GET(SMC_SIZE, smc->cmd_ret); 103 } 104 105 static int apple_smc_cmd(struct apple_smc *smc, u64 cmd, u64 arg, 106 u64 size, u64 wsize, u32 *ret_data) 107 { 108 guard(mutex)(&smc->mutex); 109 110 return apple_smc_cmd_locked(smc, cmd, arg, size, wsize, ret_data); 111 } 112 113 static int apple_smc_rw_locked(struct apple_smc *smc, smc_key key, 114 const void *wbuf, size_t wsize, 115 void *rbuf, size_t rsize) 116 { 117 u64 smc_size, smc_wsize; 118 u32 rdata; 119 int ret; 120 u64 cmd; 121 122 lockdep_assert_held(&smc->mutex); 123 124 if (rsize > SMC_MAX_SIZE) 125 return -EINVAL; 126 if (wsize > SMC_MAX_SIZE) 127 return -EINVAL; 128 129 if (rsize && wsize) { 130 cmd = SMC_MSG_RW_KEY; 131 memcpy_toio(smc->shmem.iomem, wbuf, wsize); 132 smc_size = rsize; 133 smc_wsize = wsize; 134 } else if (wsize && !rsize) { 135 cmd = SMC_MSG_WRITE_KEY; 136 memcpy_toio(smc->shmem.iomem, wbuf, wsize); 137 /* 138 * Setting size to the length we want to write and wsize to 0 139 * looks silly but that's how the SMC protocol works ¯\_(ツ)_/¯ 140 */ 141 smc_size = wsize; 142 smc_wsize = 0; 143 } else if (!wsize && rsize) { 144 cmd = SMC_MSG_READ_KEY; 145 smc_size = rsize; 146 smc_wsize = 0; 147 } else { 148 return -EINVAL; 149 } 150 151 ret = apple_smc_cmd_locked(smc, cmd, key, smc_size, smc_wsize, &rdata); 152 if (ret < 0) 153 return ret; 154 155 if (rsize) { 156 /* 157 * Small data <= 4 bytes is returned as part of the reply 158 * message which is sent over the mailbox FIFO. Everything 159 * bigger has to be copied from SRAM which is mapped as 160 * Device memory. 161 */ 162 if (rsize <= 4) 163 memcpy(rbuf, &rdata, rsize); 164 else 165 memcpy_fromio(rbuf, smc->shmem.iomem, rsize); 166 } 167 168 return ret; 169 } 170 171 int apple_smc_read(struct apple_smc *smc, smc_key key, void *buf, size_t size) 172 { 173 guard(mutex)(&smc->mutex); 174 175 return apple_smc_rw_locked(smc, key, NULL, 0, buf, size); 176 } 177 EXPORT_SYMBOL(apple_smc_read); 178 179 int apple_smc_write(struct apple_smc *smc, smc_key key, const void *buf, size_t size) 180 { 181 guard(mutex)(&smc->mutex); 182 183 return apple_smc_rw_locked(smc, key, buf, size, NULL, 0); 184 } 185 EXPORT_SYMBOL(apple_smc_write); 186 187 int apple_smc_rw(struct apple_smc *smc, smc_key key, const void *wbuf, size_t wsize, 188 void *rbuf, size_t rsize) 189 { 190 guard(mutex)(&smc->mutex); 191 192 return apple_smc_rw_locked(smc, key, wbuf, wsize, rbuf, rsize); 193 } 194 EXPORT_SYMBOL(apple_smc_rw); 195 196 int apple_smc_get_key_by_index(struct apple_smc *smc, int index, smc_key *key) 197 { 198 int ret; 199 200 ret = apple_smc_cmd(smc, SMC_MSG_GET_KEY_BY_INDEX, index, 0, 0, key); 201 202 *key = swab32(*key); 203 return ret; 204 } 205 EXPORT_SYMBOL(apple_smc_get_key_by_index); 206 207 int apple_smc_get_key_info(struct apple_smc *smc, smc_key key, struct apple_smc_key_info *info) 208 { 209 u8 key_info[6]; 210 int ret; 211 212 ret = apple_smc_cmd(smc, SMC_MSG_GET_KEY_INFO, key, 0, 0, NULL); 213 if (ret >= 0 && info) { 214 memcpy_fromio(key_info, smc->shmem.iomem, sizeof(key_info)); 215 info->size = key_info[0]; 216 info->type_code = get_unaligned_be32(&key_info[1]); 217 info->flags = key_info[5]; 218 } 219 return ret; 220 } 221 EXPORT_SYMBOL(apple_smc_get_key_info); 222 223 int apple_smc_enter_atomic(struct apple_smc *smc) 224 { 225 guard(mutex)(&smc->mutex); 226 227 /* 228 * Disable notifications since this is called before shutdown and no 229 * notification handler will be able to handle the notification 230 * using atomic operations only. Also ignore any failure here 231 * because we're about to shut down or reboot anyway. 232 * We can't use apple_smc_write_flag here since that would try to lock 233 * smc->mutex again. 234 */ 235 const u8 flag = 0; 236 237 apple_smc_rw_locked(smc, SMC_KEY(NTAP), &flag, sizeof(flag), NULL, 0); 238 239 smc->atomic_mode = true; 240 241 return 0; 242 } 243 EXPORT_SYMBOL(apple_smc_enter_atomic); 244 245 int apple_smc_write_atomic(struct apple_smc *smc, smc_key key, const void *buf, size_t size) 246 { 247 guard(spinlock_irqsave)(&smc->lock); 248 u8 result; 249 int ret; 250 u64 msg; 251 252 if (size > SMC_MAX_SIZE || size == 0) 253 return -EINVAL; 254 255 if (smc->boot_stage != APPLE_SMC_INITIALIZED) 256 return -EIO; 257 if (!smc->atomic_mode) 258 return -EIO; 259 260 memcpy_toio(smc->shmem.iomem, buf, size); 261 smc->msg_id = (smc->msg_id + 1) & 0xf; 262 msg = (FIELD_PREP(SMC_MSG, SMC_MSG_WRITE_KEY) | 263 FIELD_PREP(SMC_SIZE, size) | 264 FIELD_PREP(SMC_ID, smc->msg_id) | 265 FIELD_PREP(SMC_DATA, key)); 266 smc->atomic_pending = true; 267 268 ret = apple_rtkit_send_message(smc->rtk, SMC_ENDPOINT, msg, NULL, true); 269 if (ret < 0) { 270 dev_err(smc->dev, "Failed to send command (%d)\n", ret); 271 return ret; 272 } 273 274 while (smc->atomic_pending) { 275 ret = apple_rtkit_poll(smc->rtk); 276 if (ret < 0) { 277 dev_err(smc->dev, "RTKit poll failed (%llx)", msg); 278 return ret; 279 } 280 udelay(100); 281 } 282 283 if (FIELD_GET(SMC_ID, smc->cmd_ret) != smc->msg_id) { 284 dev_err(smc->dev, "Command sequence mismatch (expected %d, got %d)\n", 285 smc->msg_id, (unsigned int)FIELD_GET(SMC_ID, smc->cmd_ret)); 286 return -EIO; 287 } 288 289 result = FIELD_GET(SMC_RESULT, smc->cmd_ret); 290 if (result) 291 return -EIO; 292 293 return FIELD_GET(SMC_SIZE, smc->cmd_ret); 294 } 295 EXPORT_SYMBOL(apple_smc_write_atomic); 296 297 static void apple_smc_rtkit_crashed(void *cookie, const void *bfr, size_t bfr_len) 298 { 299 struct apple_smc *smc = cookie; 300 301 smc->boot_stage = APPLE_SMC_ERROR_CRASHED; 302 dev_err(smc->dev, "SMC crashed! Your system will reboot in a few seconds...\n"); 303 } 304 305 static int apple_smc_rtkit_shmem_setup(void *cookie, struct apple_rtkit_shmem *bfr) 306 { 307 struct apple_smc *smc = cookie; 308 size_t bfr_end; 309 310 if (!bfr->iova) { 311 dev_err(smc->dev, "RTKit wants a RAM buffer\n"); 312 return -EIO; 313 } 314 315 if (check_add_overflow(bfr->iova, bfr->size - 1, &bfr_end)) 316 return -EFAULT; 317 318 if (bfr->iova < smc->sram->start || bfr->iova > smc->sram->end || 319 bfr_end > smc->sram->end) { 320 dev_err(smc->dev, "RTKit buffer request outside SRAM region: [0x%llx, 0x%llx]\n", 321 (unsigned long long)bfr->iova, 322 (unsigned long long)bfr_end); 323 return -EFAULT; 324 } 325 326 bfr->iomem = smc->sram_base + (bfr->iova - smc->sram->start); 327 bfr->is_mapped = true; 328 329 return 0; 330 } 331 332 static bool apple_smc_rtkit_recv_early(void *cookie, u8 endpoint, u64 message) 333 { 334 struct apple_smc *smc = cookie; 335 336 if (endpoint != SMC_ENDPOINT) { 337 dev_warn(smc->dev, "Received message for unknown endpoint 0x%x\n", endpoint); 338 return false; 339 } 340 341 if (smc->boot_stage == APPLE_SMC_BOOTING) { 342 int ret; 343 344 smc->shmem.iova = message; 345 smc->shmem.size = SMC_SHMEM_SIZE; 346 ret = apple_smc_rtkit_shmem_setup(smc, &smc->shmem); 347 if (ret < 0) { 348 smc->boot_stage = APPLE_SMC_ERROR_NO_SHMEM; 349 dev_err(smc->dev, "Failed to initialize shared memory (%d)\n", ret); 350 } else { 351 smc->boot_stage = APPLE_SMC_INITIALIZED; 352 } 353 complete(&smc->init_done); 354 } else if (FIELD_GET(SMC_MSG, message) == SMC_MSG_NOTIFICATION) { 355 /* Handle these in the RTKit worker thread */ 356 return false; 357 } else { 358 smc->cmd_ret = message; 359 if (smc->atomic_pending) 360 smc->atomic_pending = false; 361 else 362 complete(&smc->cmd_done); 363 } 364 365 return true; 366 } 367 368 static void apple_smc_rtkit_recv(void *cookie, u8 endpoint, u64 message) 369 { 370 struct apple_smc *smc = cookie; 371 372 if (endpoint != SMC_ENDPOINT) { 373 dev_warn(smc->dev, "Received message for unknown endpoint 0x%x\n", endpoint); 374 return; 375 } 376 377 if (FIELD_GET(SMC_MSG, message) != SMC_MSG_NOTIFICATION) { 378 dev_warn(smc->dev, "Received unknown message from worker: 0x%llx\n", message); 379 return; 380 } 381 382 blocking_notifier_call_chain(&smc->event_handlers, FIELD_GET(SMC_DATA, message), NULL); 383 } 384 385 static const struct apple_rtkit_ops apple_smc_rtkit_ops = { 386 .crashed = apple_smc_rtkit_crashed, 387 .recv_message = apple_smc_rtkit_recv, 388 .recv_message_early = apple_smc_rtkit_recv_early, 389 .shmem_setup = apple_smc_rtkit_shmem_setup, 390 }; 391 392 static void apple_smc_rtkit_shutdown(void *data) 393 { 394 struct apple_smc *smc = data; 395 396 /* Shut down SMC firmware, if it's not completely wedged */ 397 if (apple_rtkit_is_running(smc->rtk)) 398 apple_rtkit_quiesce(smc->rtk); 399 } 400 401 static void apple_smc_disable_notifications(void *data) 402 { 403 struct apple_smc *smc = data; 404 405 apple_smc_write_flag(smc, SMC_KEY(NTAP), false); 406 } 407 408 static int apple_smc_probe(struct platform_device *pdev) 409 { 410 struct device *dev = &pdev->dev; 411 struct apple_smc *smc; 412 u32 count; 413 int ret; 414 415 smc = devm_kzalloc(dev, sizeof(*smc), GFP_KERNEL); 416 if (!smc) 417 return -ENOMEM; 418 419 mutex_init(&smc->mutex); 420 smc->dev = &pdev->dev; 421 smc->sram_base = devm_platform_get_and_ioremap_resource(pdev, 1, &smc->sram); 422 if (IS_ERR(smc->sram_base)) 423 return dev_err_probe(dev, PTR_ERR(smc->sram_base), "Failed to map SRAM region"); 424 425 smc->rtk = devm_apple_rtkit_init(dev, smc, NULL, 0, &apple_smc_rtkit_ops); 426 if (IS_ERR(smc->rtk)) 427 return dev_err_probe(dev, PTR_ERR(smc->rtk), "Failed to initialize RTKit"); 428 429 smc->boot_stage = APPLE_SMC_BOOTING; 430 ret = apple_rtkit_wake(smc->rtk); 431 if (ret) 432 return dev_err_probe(dev, ret, "Failed to wake up SMC"); 433 434 ret = devm_add_action_or_reset(dev, apple_smc_rtkit_shutdown, smc); 435 if (ret) 436 return ret; 437 438 ret = apple_rtkit_start_ep(smc->rtk, SMC_ENDPOINT); 439 if (ret) 440 return dev_err_probe(dev, ret, "Failed to start SMC endpoint"); 441 442 init_completion(&smc->init_done); 443 init_completion(&smc->cmd_done); 444 445 ret = apple_rtkit_send_message(smc->rtk, SMC_ENDPOINT, 446 FIELD_PREP(SMC_MSG, SMC_MSG_INITIALIZE), NULL, false); 447 if (ret) 448 return dev_err_probe(dev, ret, "Failed to send init message"); 449 450 if (wait_for_completion_timeout(&smc->init_done, msecs_to_jiffies(SMC_TIMEOUT_MS)) == 0) { 451 dev_err(dev, "Timed out initializing SMC"); 452 return -ETIMEDOUT; 453 } 454 455 if (smc->boot_stage != APPLE_SMC_INITIALIZED) { 456 dev_err(dev, "SMC failed to boot successfully, boot stage=%d\n", smc->boot_stage); 457 return -EIO; 458 } 459 460 dev_set_drvdata(&pdev->dev, smc); 461 BLOCKING_INIT_NOTIFIER_HEAD(&smc->event_handlers); 462 463 ret = apple_smc_read_u32(smc, SMC_KEY(#KEY), &count); 464 if (ret) 465 return dev_err_probe(smc->dev, ret, "Failed to get key count"); 466 smc->key_count = be32_to_cpu(count); 467 468 /* Enable notifications */ 469 apple_smc_write_flag(smc, SMC_KEY(NTAP), true); 470 ret = devm_add_action_or_reset(dev, apple_smc_disable_notifications, smc); 471 if (ret) 472 return ret; 473 474 ret = devm_mfd_add_devices(smc->dev, PLATFORM_DEVID_NONE, 475 apple_smc_devs, ARRAY_SIZE(apple_smc_devs), 476 NULL, 0, NULL); 477 if (ret) 478 return dev_err_probe(smc->dev, ret, "Failed to register sub-devices"); 479 480 481 return 0; 482 } 483 484 static const struct of_device_id apple_smc_of_match[] = { 485 { .compatible = "apple,t8103-smc" }, 486 { .compatible = "apple,smc" }, 487 {}, 488 }; 489 MODULE_DEVICE_TABLE(of, apple_smc_of_match); 490 491 static struct platform_driver apple_smc_driver = { 492 .driver = { 493 .name = "macsmc", 494 .of_match_table = apple_smc_of_match, 495 }, 496 .probe = apple_smc_probe, 497 }; 498 module_platform_driver(apple_smc_driver); 499 500 MODULE_AUTHOR("Hector Martin <marcan@marcan.st>"); 501 MODULE_AUTHOR("Sven Peter <sven@kernel.org>"); 502 MODULE_LICENSE("Dual MIT/GPL"); 503 MODULE_DESCRIPTION("Apple SMC driver"); 504