Back to home page

OSCL-LXR

 
 

    


0001 // SPDX-License-Identifier: GPL-2.0
0002 /*
0003  * Copyright (c) 2015, Sony Mobile Communications AB.
0004  * Copyright (c) 2012-2013, The Linux Foundation. All rights reserved.
0005  */
0006 
0007 #include <linux/interrupt.h>
0008 #include <linux/io.h>
0009 #include <linux/mailbox_client.h>
0010 #include <linux/mfd/syscon.h>
0011 #include <linux/module.h>
0012 #include <linux/of_irq.h>
0013 #include <linux/of_platform.h>
0014 #include <linux/platform_device.h>
0015 #include <linux/regmap.h>
0016 #include <linux/sched.h>
0017 #include <linux/sizes.h>
0018 #include <linux/slab.h>
0019 #include <linux/soc/qcom/smem.h>
0020 #include <linux/wait.h>
0021 #include <linux/rpmsg.h>
0022 #include <linux/rpmsg/qcom_smd.h>
0023 
0024 #include "rpmsg_internal.h"
0025 
0026 /*
0027  * The Qualcomm Shared Memory communication solution provides point-to-point
0028  * channels for clients to send and receive streaming or packet based data.
0029  *
0030  * Each channel consists of a control item (channel info) and a ring buffer
0031  * pair. The channel info carry information related to channel state, flow
0032  * control and the offsets within the ring buffer.
0033  *
0034  * All allocated channels are listed in an allocation table, identifying the
0035  * pair of items by name, type and remote processor.
0036  *
0037  * Upon creating a new channel the remote processor allocates channel info and
0038  * ring buffer items from the smem heap and populate the allocation table. An
0039  * interrupt is sent to the other end of the channel and a scan for new
0040  * channels should be done. A channel never goes away, it will only change
0041  * state.
0042  *
0043  * The remote processor signals it intent for bring up the communication
0044  * channel by setting the state of its end of the channel to "opening" and
0045  * sends out an interrupt. We detect this change and register a smd device to
0046  * consume the channel. Upon finding a consumer we finish the handshake and the
0047  * channel is up.
0048  *
0049  * Upon closing a channel, the remote processor will update the state of its
0050  * end of the channel and signal us, we will then unregister any attached
0051  * device and close our end of the channel.
0052  *
0053  * Devices attached to a channel can use the qcom_smd_send function to push
0054  * data to the channel, this is done by copying the data into the tx ring
0055  * buffer, updating the pointers in the channel info and signaling the remote
0056  * processor.
0057  *
0058  * The remote processor does the equivalent when it transfer data and upon
0059  * receiving the interrupt we check the channel info for new data and delivers
0060  * this to the attached device. If the device is not ready to receive the data
0061  * we leave it in the ring buffer for now.
0062  */
0063 
0064 struct smd_channel_info;
0065 struct smd_channel_info_pair;
0066 struct smd_channel_info_word;
0067 struct smd_channel_info_word_pair;
0068 
0069 static const struct rpmsg_endpoint_ops qcom_smd_endpoint_ops;
0070 
0071 #define SMD_ALLOC_TBL_COUNT 2
0072 #define SMD_ALLOC_TBL_SIZE  64
0073 
0074 /*
0075  * This lists the various smem heap items relevant for the allocation table and
0076  * smd channel entries.
0077  */
0078 static const struct {
0079     unsigned alloc_tbl_id;
0080     unsigned info_base_id;
0081     unsigned fifo_base_id;
0082 } smem_items[SMD_ALLOC_TBL_COUNT] = {
0083     {
0084         .alloc_tbl_id = 13,
0085         .info_base_id = 14,
0086         .fifo_base_id = 338
0087     },
0088     {
0089         .alloc_tbl_id = 266,
0090         .info_base_id = 138,
0091         .fifo_base_id = 202,
0092     },
0093 };
0094 
0095 /**
0096  * struct qcom_smd_edge - representing a remote processor
0097  * @dev:        device associated with this edge
0098  * @name:       name of this edge
0099  * @of_node:        of_node handle for information related to this edge
0100  * @edge_id:        identifier of this edge
0101  * @remote_pid:     identifier of remote processor
0102  * @irq:        interrupt for signals on this edge
0103  * @ipc_regmap:     regmap handle holding the outgoing ipc register
0104  * @ipc_offset:     offset within @ipc_regmap of the register for ipc
0105  * @ipc_bit:        bit in the register at @ipc_offset of @ipc_regmap
0106  * @mbox_client:    mailbox client handle
0107  * @mbox_chan:      apcs ipc mailbox channel handle
0108  * @channels:       list of all channels detected on this edge
0109  * @channels_lock:  guard for modifications of @channels
0110  * @allocated:      array of bitmaps representing already allocated channels
0111  * @smem_available: last available amount of smem triggering a channel scan
0112  * @new_channel_event:  wait queue for new channel events
0113  * @scan_work:      work item for discovering new channels
0114  * @state_work:     work item for edge state changes
0115  */
0116 struct qcom_smd_edge {
0117     struct device dev;
0118 
0119     const char *name;
0120 
0121     struct device_node *of_node;
0122     unsigned edge_id;
0123     unsigned remote_pid;
0124 
0125     int irq;
0126 
0127     struct regmap *ipc_regmap;
0128     int ipc_offset;
0129     int ipc_bit;
0130 
0131     struct mbox_client mbox_client;
0132     struct mbox_chan *mbox_chan;
0133 
0134     struct list_head channels;
0135     spinlock_t channels_lock;
0136 
0137     DECLARE_BITMAP(allocated[SMD_ALLOC_TBL_COUNT], SMD_ALLOC_TBL_SIZE);
0138 
0139     unsigned smem_available;
0140 
0141     wait_queue_head_t new_channel_event;
0142 
0143     struct work_struct scan_work;
0144     struct work_struct state_work;
0145 };
0146 
0147 /*
0148  * SMD channel states.
0149  */
0150 enum smd_channel_state {
0151     SMD_CHANNEL_CLOSED,
0152     SMD_CHANNEL_OPENING,
0153     SMD_CHANNEL_OPENED,
0154     SMD_CHANNEL_FLUSHING,
0155     SMD_CHANNEL_CLOSING,
0156     SMD_CHANNEL_RESET,
0157     SMD_CHANNEL_RESET_OPENING
0158 };
0159 
0160 struct qcom_smd_device {
0161     struct rpmsg_device rpdev;
0162 
0163     struct qcom_smd_edge *edge;
0164 };
0165 
0166 struct qcom_smd_endpoint {
0167     struct rpmsg_endpoint ept;
0168 
0169     struct qcom_smd_channel *qsch;
0170 };
0171 
0172 #define to_smd_device(r)    container_of(r, struct qcom_smd_device, rpdev)
0173 #define to_smd_edge(d)      container_of(d, struct qcom_smd_edge, dev)
0174 #define to_smd_endpoint(e)  container_of(e, struct qcom_smd_endpoint, ept)
0175 
0176 /**
0177  * struct qcom_smd_channel - smd channel struct
0178  * @edge:       qcom_smd_edge this channel is living on
0179  * @qsept:      reference to a associated smd endpoint
0180  * @registered:     flag to indicate if the channel is registered
0181  * @name:       name of the channel
0182  * @state:      local state of the channel
0183  * @remote_state:   remote state of the channel
0184  * @state_change_event: state change event
0185  * @info:       byte aligned outgoing/incoming channel info
0186  * @info_word:      word aligned outgoing/incoming channel info
0187  * @tx_lock:        lock to make writes to the channel mutually exclusive
0188  * @fblockread_event:   wakeup event tied to tx fBLOCKREADINTR
0189  * @tx_fifo:        pointer to the outgoing ring buffer
0190  * @rx_fifo:        pointer to the incoming ring buffer
0191  * @fifo_size:      size of each ring buffer
0192  * @bounce_buffer:  bounce buffer for reading wrapped packets
0193  * @cb:         callback function registered for this channel
0194  * @recv_lock:      guard for rx info modifications and cb pointer
0195  * @pkt_size:       size of the currently handled packet
0196  * @drvdata:        driver private data
0197  * @list:       lite entry for @channels in qcom_smd_edge
0198  */
0199 struct qcom_smd_channel {
0200     struct qcom_smd_edge *edge;
0201 
0202     struct qcom_smd_endpoint *qsept;
0203     bool registered;
0204 
0205     char *name;
0206     enum smd_channel_state state;
0207     enum smd_channel_state remote_state;
0208     wait_queue_head_t state_change_event;
0209 
0210     struct smd_channel_info_pair *info;
0211     struct smd_channel_info_word_pair *info_word;
0212 
0213     spinlock_t tx_lock;
0214     wait_queue_head_t fblockread_event;
0215 
0216     void *tx_fifo;
0217     void *rx_fifo;
0218     int fifo_size;
0219 
0220     void *bounce_buffer;
0221 
0222     spinlock_t recv_lock;
0223 
0224     int pkt_size;
0225 
0226     void *drvdata;
0227 
0228     struct list_head list;
0229 };
0230 
0231 /*
0232  * Format of the smd_info smem items, for byte aligned channels.
0233  */
0234 struct smd_channel_info {
0235     __le32 state;
0236     u8  fDSR;
0237     u8  fCTS;
0238     u8  fCD;
0239     u8  fRI;
0240     u8  fHEAD;
0241     u8  fTAIL;
0242     u8  fSTATE;
0243     u8  fBLOCKREADINTR;
0244     __le32 tail;
0245     __le32 head;
0246 };
0247 
0248 struct smd_channel_info_pair {
0249     struct smd_channel_info tx;
0250     struct smd_channel_info rx;
0251 };
0252 
0253 /*
0254  * Format of the smd_info smem items, for word aligned channels.
0255  */
0256 struct smd_channel_info_word {
0257     __le32 state;
0258     __le32 fDSR;
0259     __le32 fCTS;
0260     __le32 fCD;
0261     __le32 fRI;
0262     __le32 fHEAD;
0263     __le32 fTAIL;
0264     __le32 fSTATE;
0265     __le32 fBLOCKREADINTR;
0266     __le32 tail;
0267     __le32 head;
0268 };
0269 
0270 struct smd_channel_info_word_pair {
0271     struct smd_channel_info_word tx;
0272     struct smd_channel_info_word rx;
0273 };
0274 
0275 #define GET_RX_CHANNEL_FLAG(channel, param)                  \
0276     ({                                   \
0277         BUILD_BUG_ON(sizeof(channel->info->rx.param) != sizeof(u8)); \
0278         channel->info_word ?                         \
0279             le32_to_cpu(channel->info_word->rx.param) :      \
0280             channel->info->rx.param;                 \
0281     })
0282 
0283 #define GET_RX_CHANNEL_INFO(channel, param)                   \
0284     ({                                    \
0285         BUILD_BUG_ON(sizeof(channel->info->rx.param) != sizeof(u32)); \
0286         le32_to_cpu(channel->info_word ?                  \
0287             channel->info_word->rx.param :                \
0288             channel->info->rx.param);                 \
0289     })
0290 
0291 #define SET_RX_CHANNEL_FLAG(channel, param, value)               \
0292     ({                                   \
0293         BUILD_BUG_ON(sizeof(channel->info->rx.param) != sizeof(u8)); \
0294         if (channel->info_word)                      \
0295             channel->info_word->rx.param = cpu_to_le32(value);   \
0296         else                                 \
0297             channel->info->rx.param = value;             \
0298     })
0299 
0300 #define SET_RX_CHANNEL_INFO(channel, param, value)                \
0301     ({                                    \
0302         BUILD_BUG_ON(sizeof(channel->info->rx.param) != sizeof(u32)); \
0303         if (channel->info_word)                       \
0304             channel->info_word->rx.param = cpu_to_le32(value);    \
0305         else                                  \
0306             channel->info->rx.param = cpu_to_le32(value);         \
0307     })
0308 
0309 #define GET_TX_CHANNEL_FLAG(channel, param)                  \
0310     ({                                   \
0311         BUILD_BUG_ON(sizeof(channel->info->tx.param) != sizeof(u8)); \
0312         channel->info_word ?                         \
0313             le32_to_cpu(channel->info_word->tx.param) :          \
0314             channel->info->tx.param;                 \
0315     })
0316 
0317 #define GET_TX_CHANNEL_INFO(channel, param)                   \
0318     ({                                    \
0319         BUILD_BUG_ON(sizeof(channel->info->tx.param) != sizeof(u32)); \
0320         le32_to_cpu(channel->info_word ?                  \
0321             channel->info_word->tx.param :                \
0322             channel->info->tx.param);                 \
0323     })
0324 
0325 #define SET_TX_CHANNEL_FLAG(channel, param, value)               \
0326     ({                                   \
0327         BUILD_BUG_ON(sizeof(channel->info->tx.param) != sizeof(u8)); \
0328         if (channel->info_word)                      \
0329             channel->info_word->tx.param = cpu_to_le32(value);   \
0330         else                                 \
0331             channel->info->tx.param = value;             \
0332     })
0333 
0334 #define SET_TX_CHANNEL_INFO(channel, param, value)                \
0335     ({                                    \
0336         BUILD_BUG_ON(sizeof(channel->info->tx.param) != sizeof(u32)); \
0337         if (channel->info_word)                       \
0338             channel->info_word->tx.param = cpu_to_le32(value);   \
0339         else                                  \
0340             channel->info->tx.param = cpu_to_le32(value);         \
0341     })
0342 
0343 /**
0344  * struct qcom_smd_alloc_entry - channel allocation entry
0345  * @name:   channel name
0346  * @cid:    channel index
0347  * @flags:  channel flags and edge id
0348  * @ref_count:  reference count of the channel
0349  */
0350 struct qcom_smd_alloc_entry {
0351     u8 name[20];
0352     __le32 cid;
0353     __le32 flags;
0354     __le32 ref_count;
0355 } __packed;
0356 
0357 #define SMD_CHANNEL_FLAGS_EDGE_MASK 0xff
0358 #define SMD_CHANNEL_FLAGS_STREAM    BIT(8)
0359 #define SMD_CHANNEL_FLAGS_PACKET    BIT(9)
0360 
0361 /*
0362  * Each smd packet contains a 20 byte header, with the first 4 being the length
0363  * of the packet.
0364  */
0365 #define SMD_PACKET_HEADER_LEN   20
0366 
0367 /*
0368  * Signal the remote processor associated with 'channel'.
0369  */
0370 static void qcom_smd_signal_channel(struct qcom_smd_channel *channel)
0371 {
0372     struct qcom_smd_edge *edge = channel->edge;
0373 
0374     if (edge->mbox_chan) {
0375         /*
0376          * We can ignore a failing mbox_send_message() as the only
0377          * possible cause is that the FIFO in the framework is full of
0378          * other writes to the same bit.
0379          */
0380         mbox_send_message(edge->mbox_chan, NULL);
0381         mbox_client_txdone(edge->mbox_chan, 0);
0382     } else {
0383         regmap_write(edge->ipc_regmap, edge->ipc_offset, BIT(edge->ipc_bit));
0384     }
0385 }
0386 
0387 /*
0388  * Initialize the tx channel info
0389  */
0390 static void qcom_smd_channel_reset(struct qcom_smd_channel *channel)
0391 {
0392     SET_TX_CHANNEL_INFO(channel, state, SMD_CHANNEL_CLOSED);
0393     SET_TX_CHANNEL_FLAG(channel, fDSR, 0);
0394     SET_TX_CHANNEL_FLAG(channel, fCTS, 0);
0395     SET_TX_CHANNEL_FLAG(channel, fCD, 0);
0396     SET_TX_CHANNEL_FLAG(channel, fRI, 0);
0397     SET_TX_CHANNEL_FLAG(channel, fHEAD, 0);
0398     SET_TX_CHANNEL_FLAG(channel, fTAIL, 0);
0399     SET_TX_CHANNEL_FLAG(channel, fSTATE, 1);
0400     SET_TX_CHANNEL_FLAG(channel, fBLOCKREADINTR, 1);
0401     SET_TX_CHANNEL_INFO(channel, head, 0);
0402     SET_RX_CHANNEL_INFO(channel, tail, 0);
0403 
0404     qcom_smd_signal_channel(channel);
0405 
0406     channel->state = SMD_CHANNEL_CLOSED;
0407     channel->pkt_size = 0;
0408 }
0409 
0410 /*
0411  * Set the callback for a channel, with appropriate locking
0412  */
0413 static void qcom_smd_channel_set_callback(struct qcom_smd_channel *channel,
0414                       rpmsg_rx_cb_t cb)
0415 {
0416     struct rpmsg_endpoint *ept = &channel->qsept->ept;
0417     unsigned long flags;
0418 
0419     spin_lock_irqsave(&channel->recv_lock, flags);
0420     ept->cb = cb;
0421     spin_unlock_irqrestore(&channel->recv_lock, flags);
0422 };
0423 
0424 /*
0425  * Calculate the amount of data available in the rx fifo
0426  */
0427 static size_t qcom_smd_channel_get_rx_avail(struct qcom_smd_channel *channel)
0428 {
0429     unsigned head;
0430     unsigned tail;
0431 
0432     head = GET_RX_CHANNEL_INFO(channel, head);
0433     tail = GET_RX_CHANNEL_INFO(channel, tail);
0434 
0435     return (head - tail) & (channel->fifo_size - 1);
0436 }
0437 
0438 /*
0439  * Set tx channel state and inform the remote processor
0440  */
0441 static void qcom_smd_channel_set_state(struct qcom_smd_channel *channel,
0442                        int state)
0443 {
0444     struct qcom_smd_edge *edge = channel->edge;
0445     bool is_open = state == SMD_CHANNEL_OPENED;
0446 
0447     if (channel->state == state)
0448         return;
0449 
0450     dev_dbg(&edge->dev, "set_state(%s, %d)\n", channel->name, state);
0451 
0452     SET_TX_CHANNEL_FLAG(channel, fDSR, is_open);
0453     SET_TX_CHANNEL_FLAG(channel, fCTS, is_open);
0454     SET_TX_CHANNEL_FLAG(channel, fCD, is_open);
0455 
0456     SET_TX_CHANNEL_INFO(channel, state, state);
0457     SET_TX_CHANNEL_FLAG(channel, fSTATE, 1);
0458 
0459     channel->state = state;
0460     qcom_smd_signal_channel(channel);
0461 }
0462 
0463 /*
0464  * Copy count bytes of data using 32bit accesses, if that's required.
0465  */
0466 static void smd_copy_to_fifo(void __iomem *dst,
0467                  const void *src,
0468                  size_t count,
0469                  bool word_aligned)
0470 {
0471     if (word_aligned) {
0472         __iowrite32_copy(dst, src, count / sizeof(u32));
0473     } else {
0474         memcpy_toio(dst, src, count);
0475     }
0476 }
0477 
0478 /*
0479  * Copy count bytes of data using 32bit accesses, if that is required.
0480  */
0481 static void smd_copy_from_fifo(void *dst,
0482                    const void __iomem *src,
0483                    size_t count,
0484                    bool word_aligned)
0485 {
0486     if (word_aligned) {
0487         __ioread32_copy(dst, src, count / sizeof(u32));
0488     } else {
0489         memcpy_fromio(dst, src, count);
0490     }
0491 }
0492 
0493 /*
0494  * Read count bytes of data from the rx fifo into buf, but don't advance the
0495  * tail.
0496  */
0497 static size_t qcom_smd_channel_peek(struct qcom_smd_channel *channel,
0498                     void *buf, size_t count)
0499 {
0500     bool word_aligned;
0501     unsigned tail;
0502     size_t len;
0503 
0504     word_aligned = channel->info_word;
0505     tail = GET_RX_CHANNEL_INFO(channel, tail);
0506 
0507     len = min_t(size_t, count, channel->fifo_size - tail);
0508     if (len) {
0509         smd_copy_from_fifo(buf,
0510                    channel->rx_fifo + tail,
0511                    len,
0512                    word_aligned);
0513     }
0514 
0515     if (len != count) {
0516         smd_copy_from_fifo(buf + len,
0517                    channel->rx_fifo,
0518                    count - len,
0519                    word_aligned);
0520     }
0521 
0522     return count;
0523 }
0524 
0525 /*
0526  * Advance the rx tail by count bytes.
0527  */
0528 static void qcom_smd_channel_advance(struct qcom_smd_channel *channel,
0529                      size_t count)
0530 {
0531     unsigned tail;
0532 
0533     tail = GET_RX_CHANNEL_INFO(channel, tail);
0534     tail += count;
0535     tail &= (channel->fifo_size - 1);
0536     SET_RX_CHANNEL_INFO(channel, tail, tail);
0537 }
0538 
0539 /*
0540  * Read out a single packet from the rx fifo and deliver it to the device
0541  */
0542 static int qcom_smd_channel_recv_single(struct qcom_smd_channel *channel)
0543 {
0544     struct rpmsg_endpoint *ept = &channel->qsept->ept;
0545     unsigned tail;
0546     size_t len;
0547     void *ptr;
0548     int ret;
0549 
0550     tail = GET_RX_CHANNEL_INFO(channel, tail);
0551 
0552     /* Use bounce buffer if the data wraps */
0553     if (tail + channel->pkt_size >= channel->fifo_size) {
0554         ptr = channel->bounce_buffer;
0555         len = qcom_smd_channel_peek(channel, ptr, channel->pkt_size);
0556     } else {
0557         ptr = channel->rx_fifo + tail;
0558         len = channel->pkt_size;
0559     }
0560 
0561     ret = ept->cb(ept->rpdev, ptr, len, ept->priv, RPMSG_ADDR_ANY);
0562     if (ret < 0)
0563         return ret;
0564 
0565     /* Only forward the tail if the client consumed the data */
0566     qcom_smd_channel_advance(channel, len);
0567 
0568     channel->pkt_size = 0;
0569 
0570     return 0;
0571 }
0572 
0573 /*
0574  * Per channel interrupt handling
0575  */
0576 static bool qcom_smd_channel_intr(struct qcom_smd_channel *channel)
0577 {
0578     bool need_state_scan = false;
0579     int remote_state;
0580     __le32 pktlen;
0581     int avail;
0582     int ret;
0583 
0584     /* Handle state changes */
0585     remote_state = GET_RX_CHANNEL_INFO(channel, state);
0586     if (remote_state != channel->remote_state) {
0587         channel->remote_state = remote_state;
0588         need_state_scan = true;
0589 
0590         wake_up_interruptible_all(&channel->state_change_event);
0591     }
0592     /* Indicate that we have seen any state change */
0593     SET_RX_CHANNEL_FLAG(channel, fSTATE, 0);
0594 
0595     /* Signal waiting qcom_smd_send() about the interrupt */
0596     if (!GET_TX_CHANNEL_FLAG(channel, fBLOCKREADINTR))
0597         wake_up_interruptible_all(&channel->fblockread_event);
0598 
0599     /* Don't consume any data until we've opened the channel */
0600     if (channel->state != SMD_CHANNEL_OPENED)
0601         goto out;
0602 
0603     /* Indicate that we've seen the new data */
0604     SET_RX_CHANNEL_FLAG(channel, fHEAD, 0);
0605 
0606     /* Consume data */
0607     for (;;) {
0608         avail = qcom_smd_channel_get_rx_avail(channel);
0609 
0610         if (!channel->pkt_size && avail >= SMD_PACKET_HEADER_LEN) {
0611             qcom_smd_channel_peek(channel, &pktlen, sizeof(pktlen));
0612             qcom_smd_channel_advance(channel, SMD_PACKET_HEADER_LEN);
0613             channel->pkt_size = le32_to_cpu(pktlen);
0614         } else if (channel->pkt_size && avail >= channel->pkt_size) {
0615             ret = qcom_smd_channel_recv_single(channel);
0616             if (ret)
0617                 break;
0618         } else {
0619             break;
0620         }
0621     }
0622 
0623     /* Indicate that we have seen and updated tail */
0624     SET_RX_CHANNEL_FLAG(channel, fTAIL, 1);
0625 
0626     /* Signal the remote that we've consumed the data (if requested) */
0627     if (!GET_RX_CHANNEL_FLAG(channel, fBLOCKREADINTR)) {
0628         /* Ensure ordering of channel info updates */
0629         wmb();
0630 
0631         qcom_smd_signal_channel(channel);
0632     }
0633 
0634 out:
0635     return need_state_scan;
0636 }
0637 
0638 /*
0639  * The edge interrupts are triggered by the remote processor on state changes,
0640  * channel info updates or when new channels are created.
0641  */
0642 static irqreturn_t qcom_smd_edge_intr(int irq, void *data)
0643 {
0644     struct qcom_smd_edge *edge = data;
0645     struct qcom_smd_channel *channel;
0646     unsigned available;
0647     bool kick_scanner = false;
0648     bool kick_state = false;
0649 
0650     /*
0651      * Handle state changes or data on each of the channels on this edge
0652      */
0653     spin_lock(&edge->channels_lock);
0654     list_for_each_entry(channel, &edge->channels, list) {
0655         spin_lock(&channel->recv_lock);
0656         kick_state |= qcom_smd_channel_intr(channel);
0657         spin_unlock(&channel->recv_lock);
0658     }
0659     spin_unlock(&edge->channels_lock);
0660 
0661     /*
0662      * Creating a new channel requires allocating an smem entry, so we only
0663      * have to scan if the amount of available space in smem have changed
0664      * since last scan.
0665      */
0666     available = qcom_smem_get_free_space(edge->remote_pid);
0667     if (available != edge->smem_available) {
0668         edge->smem_available = available;
0669         kick_scanner = true;
0670     }
0671 
0672     if (kick_scanner)
0673         schedule_work(&edge->scan_work);
0674     if (kick_state)
0675         schedule_work(&edge->state_work);
0676 
0677     return IRQ_HANDLED;
0678 }
0679 
0680 /*
0681  * Calculate how much space is available in the tx fifo.
0682  */
0683 static size_t qcom_smd_get_tx_avail(struct qcom_smd_channel *channel)
0684 {
0685     unsigned head;
0686     unsigned tail;
0687     unsigned mask = channel->fifo_size - 1;
0688 
0689     head = GET_TX_CHANNEL_INFO(channel, head);
0690     tail = GET_TX_CHANNEL_INFO(channel, tail);
0691 
0692     return mask - ((head - tail) & mask);
0693 }
0694 
0695 /*
0696  * Write count bytes of data into channel, possibly wrapping in the ring buffer
0697  */
0698 static int qcom_smd_write_fifo(struct qcom_smd_channel *channel,
0699                    const void *data,
0700                    size_t count)
0701 {
0702     bool word_aligned;
0703     unsigned head;
0704     size_t len;
0705 
0706     word_aligned = channel->info_word;
0707     head = GET_TX_CHANNEL_INFO(channel, head);
0708 
0709     len = min_t(size_t, count, channel->fifo_size - head);
0710     if (len) {
0711         smd_copy_to_fifo(channel->tx_fifo + head,
0712                  data,
0713                  len,
0714                  word_aligned);
0715     }
0716 
0717     if (len != count) {
0718         smd_copy_to_fifo(channel->tx_fifo,
0719                  data + len,
0720                  count - len,
0721                  word_aligned);
0722     }
0723 
0724     head += count;
0725     head &= (channel->fifo_size - 1);
0726     SET_TX_CHANNEL_INFO(channel, head, head);
0727 
0728     return count;
0729 }
0730 
0731 /**
0732  * __qcom_smd_send - write data to smd channel
0733  * @channel:    channel handle
0734  * @data:   buffer of data to write
0735  * @len:    number of bytes to write
0736  * @wait:   flag to indicate if write can wait
0737  *
0738  * This is a blocking write of len bytes into the channel's tx ring buffer and
0739  * signal the remote end. It will sleep until there is enough space available
0740  * in the tx buffer, utilizing the fBLOCKREADINTR signaling mechanism to avoid
0741  * polling.
0742  */
0743 static int __qcom_smd_send(struct qcom_smd_channel *channel, const void *data,
0744                int len, bool wait)
0745 {
0746     __le32 hdr[5] = { cpu_to_le32(len), };
0747     int tlen = sizeof(hdr) + len;
0748     unsigned long flags;
0749     int ret;
0750 
0751     /* Word aligned channels only accept word size aligned data */
0752     if (channel->info_word && len % 4)
0753         return -EINVAL;
0754 
0755     /* Reject packets that are too big */
0756     if (tlen >= channel->fifo_size)
0757         return -EINVAL;
0758 
0759     /* Highlight the fact that if we enter the loop below we might sleep */
0760     if (wait)
0761         might_sleep();
0762 
0763     spin_lock_irqsave(&channel->tx_lock, flags);
0764 
0765     while (qcom_smd_get_tx_avail(channel) < tlen &&
0766            channel->state == SMD_CHANNEL_OPENED) {
0767         if (!wait) {
0768             ret = -EAGAIN;
0769             goto out_unlock;
0770         }
0771 
0772         SET_TX_CHANNEL_FLAG(channel, fBLOCKREADINTR, 0);
0773 
0774         /* Wait without holding the tx_lock */
0775         spin_unlock_irqrestore(&channel->tx_lock, flags);
0776 
0777         ret = wait_event_interruptible(channel->fblockread_event,
0778                        qcom_smd_get_tx_avail(channel) >= tlen ||
0779                        channel->state != SMD_CHANNEL_OPENED);
0780         if (ret)
0781             return ret;
0782 
0783         spin_lock_irqsave(&channel->tx_lock, flags);
0784 
0785         SET_TX_CHANNEL_FLAG(channel, fBLOCKREADINTR, 1);
0786     }
0787 
0788     /* Fail if the channel was closed */
0789     if (channel->state != SMD_CHANNEL_OPENED) {
0790         ret = -EPIPE;
0791         goto out_unlock;
0792     }
0793 
0794     SET_TX_CHANNEL_FLAG(channel, fTAIL, 0);
0795 
0796     qcom_smd_write_fifo(channel, hdr, sizeof(hdr));
0797     qcom_smd_write_fifo(channel, data, len);
0798 
0799     SET_TX_CHANNEL_FLAG(channel, fHEAD, 1);
0800 
0801     /* Ensure ordering of channel info updates */
0802     wmb();
0803 
0804     qcom_smd_signal_channel(channel);
0805 
0806 out_unlock:
0807     spin_unlock_irqrestore(&channel->tx_lock, flags);
0808 
0809     return ret;
0810 }
0811 
0812 /*
0813  * Helper for opening a channel
0814  */
0815 static int qcom_smd_channel_open(struct qcom_smd_channel *channel,
0816                  rpmsg_rx_cb_t cb)
0817 {
0818     struct qcom_smd_edge *edge = channel->edge;
0819     size_t bb_size;
0820     int ret;
0821 
0822     /*
0823      * Packets are maximum 4k, but reduce if the fifo is smaller
0824      */
0825     bb_size = min(channel->fifo_size, SZ_4K);
0826     channel->bounce_buffer = kmalloc(bb_size, GFP_KERNEL);
0827     if (!channel->bounce_buffer)
0828         return -ENOMEM;
0829 
0830     qcom_smd_channel_set_callback(channel, cb);
0831     qcom_smd_channel_set_state(channel, SMD_CHANNEL_OPENING);
0832 
0833     /* Wait for remote to enter opening or opened */
0834     ret = wait_event_interruptible_timeout(channel->state_change_event,
0835             channel->remote_state == SMD_CHANNEL_OPENING ||
0836             channel->remote_state == SMD_CHANNEL_OPENED,
0837             HZ);
0838     if (!ret) {
0839         dev_err(&edge->dev, "remote side did not enter opening state\n");
0840         goto out_close_timeout;
0841     }
0842 
0843     qcom_smd_channel_set_state(channel, SMD_CHANNEL_OPENED);
0844 
0845     /* Wait for remote to enter opened */
0846     ret = wait_event_interruptible_timeout(channel->state_change_event,
0847             channel->remote_state == SMD_CHANNEL_OPENED,
0848             HZ);
0849     if (!ret) {
0850         dev_err(&edge->dev, "remote side did not enter open state\n");
0851         goto out_close_timeout;
0852     }
0853 
0854     return 0;
0855 
0856 out_close_timeout:
0857     qcom_smd_channel_set_state(channel, SMD_CHANNEL_CLOSED);
0858     return -ETIMEDOUT;
0859 }
0860 
0861 /*
0862  * Helper for closing and resetting a channel
0863  */
0864 static void qcom_smd_channel_close(struct qcom_smd_channel *channel)
0865 {
0866     qcom_smd_channel_set_callback(channel, NULL);
0867 
0868     kfree(channel->bounce_buffer);
0869     channel->bounce_buffer = NULL;
0870 
0871     qcom_smd_channel_set_state(channel, SMD_CHANNEL_CLOSED);
0872     qcom_smd_channel_reset(channel);
0873 }
0874 
0875 static struct qcom_smd_channel *
0876 qcom_smd_find_channel(struct qcom_smd_edge *edge, const char *name)
0877 {
0878     struct qcom_smd_channel *channel;
0879     struct qcom_smd_channel *ret = NULL;
0880     unsigned long flags;
0881 
0882     spin_lock_irqsave(&edge->channels_lock, flags);
0883     list_for_each_entry(channel, &edge->channels, list) {
0884         if (!strcmp(channel->name, name)) {
0885             ret = channel;
0886             break;
0887         }
0888     }
0889     spin_unlock_irqrestore(&edge->channels_lock, flags);
0890 
0891     return ret;
0892 }
0893 
0894 static void __ept_release(struct kref *kref)
0895 {
0896     struct rpmsg_endpoint *ept = container_of(kref, struct rpmsg_endpoint,
0897                           refcount);
0898     kfree(to_smd_endpoint(ept));
0899 }
0900 
0901 static struct rpmsg_endpoint *qcom_smd_create_ept(struct rpmsg_device *rpdev,
0902                           rpmsg_rx_cb_t cb, void *priv,
0903                           struct rpmsg_channel_info chinfo)
0904 {
0905     struct qcom_smd_endpoint *qsept;
0906     struct qcom_smd_channel *channel;
0907     struct qcom_smd_device *qsdev = to_smd_device(rpdev);
0908     struct qcom_smd_edge *edge = qsdev->edge;
0909     struct rpmsg_endpoint *ept;
0910     const char *name = chinfo.name;
0911     int ret;
0912 
0913     /* Wait up to HZ for the channel to appear */
0914     ret = wait_event_interruptible_timeout(edge->new_channel_event,
0915             (channel = qcom_smd_find_channel(edge, name)) != NULL,
0916             HZ);
0917     if (!ret)
0918         return NULL;
0919 
0920     if (channel->state != SMD_CHANNEL_CLOSED) {
0921         dev_err(&rpdev->dev, "channel %s is busy\n", channel->name);
0922         return NULL;
0923     }
0924 
0925     qsept = kzalloc(sizeof(*qsept), GFP_KERNEL);
0926     if (!qsept)
0927         return NULL;
0928 
0929     ept = &qsept->ept;
0930 
0931     kref_init(&ept->refcount);
0932 
0933     ept->rpdev = rpdev;
0934     ept->cb = cb;
0935     ept->priv = priv;
0936     ept->ops = &qcom_smd_endpoint_ops;
0937 
0938     channel->qsept = qsept;
0939     qsept->qsch = channel;
0940 
0941     ret = qcom_smd_channel_open(channel, cb);
0942     if (ret)
0943         goto free_ept;
0944 
0945     return ept;
0946 
0947 free_ept:
0948     channel->qsept = NULL;
0949     kref_put(&ept->refcount, __ept_release);
0950     return NULL;
0951 }
0952 
0953 static void qcom_smd_destroy_ept(struct rpmsg_endpoint *ept)
0954 {
0955     struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
0956     struct qcom_smd_channel *ch = qsept->qsch;
0957 
0958     qcom_smd_channel_close(ch);
0959     ch->qsept = NULL;
0960     kref_put(&ept->refcount, __ept_release);
0961 }
0962 
0963 static int qcom_smd_send(struct rpmsg_endpoint *ept, void *data, int len)
0964 {
0965     struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
0966 
0967     return __qcom_smd_send(qsept->qsch, data, len, true);
0968 }
0969 
0970 static int qcom_smd_trysend(struct rpmsg_endpoint *ept, void *data, int len)
0971 {
0972     struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
0973 
0974     return __qcom_smd_send(qsept->qsch, data, len, false);
0975 }
0976 
0977 static int qcom_smd_sendto(struct rpmsg_endpoint *ept, void *data, int len, u32 dst)
0978 {
0979     struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
0980 
0981     return __qcom_smd_send(qsept->qsch, data, len, true);
0982 }
0983 
0984 static int qcom_smd_trysendto(struct rpmsg_endpoint *ept, void *data, int len, u32 dst)
0985 {
0986     struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
0987 
0988     return __qcom_smd_send(qsept->qsch, data, len, false);
0989 }
0990 
0991 static __poll_t qcom_smd_poll(struct rpmsg_endpoint *ept,
0992                   struct file *filp, poll_table *wait)
0993 {
0994     struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
0995     struct qcom_smd_channel *channel = qsept->qsch;
0996     __poll_t mask = 0;
0997 
0998     poll_wait(filp, &channel->fblockread_event, wait);
0999 
1000     if (qcom_smd_get_tx_avail(channel) > 20)
1001         mask |= EPOLLOUT | EPOLLWRNORM;
1002 
1003     return mask;
1004 }
1005 
1006 /*
1007  * Finds the device_node for the smd child interested in this channel.
1008  */
1009 static struct device_node *qcom_smd_match_channel(struct device_node *edge_node,
1010                           const char *channel)
1011 {
1012     struct device_node *child;
1013     const char *name;
1014     const char *key;
1015     int ret;
1016 
1017     for_each_available_child_of_node(edge_node, child) {
1018         key = "qcom,smd-channels";
1019         ret = of_property_read_string(child, key, &name);
1020         if (ret)
1021             continue;
1022 
1023         if (strcmp(name, channel) == 0)
1024             return child;
1025     }
1026 
1027     return NULL;
1028 }
1029 
1030 static int qcom_smd_announce_create(struct rpmsg_device *rpdev)
1031 {
1032     struct qcom_smd_endpoint *qept = to_smd_endpoint(rpdev->ept);
1033     struct qcom_smd_channel *channel = qept->qsch;
1034     unsigned long flags;
1035     bool kick_state;
1036 
1037     spin_lock_irqsave(&channel->recv_lock, flags);
1038     kick_state = qcom_smd_channel_intr(channel);
1039     spin_unlock_irqrestore(&channel->recv_lock, flags);
1040 
1041     if (kick_state)
1042         schedule_work(&channel->edge->state_work);
1043 
1044     return 0;
1045 }
1046 
1047 static const struct rpmsg_device_ops qcom_smd_device_ops = {
1048     .create_ept = qcom_smd_create_ept,
1049     .announce_create = qcom_smd_announce_create,
1050 };
1051 
1052 static const struct rpmsg_endpoint_ops qcom_smd_endpoint_ops = {
1053     .destroy_ept = qcom_smd_destroy_ept,
1054     .send = qcom_smd_send,
1055     .sendto = qcom_smd_sendto,
1056     .trysend = qcom_smd_trysend,
1057     .trysendto = qcom_smd_trysendto,
1058     .poll = qcom_smd_poll,
1059 };
1060 
1061 static void qcom_smd_release_device(struct device *dev)
1062 {
1063     struct rpmsg_device *rpdev = to_rpmsg_device(dev);
1064     struct qcom_smd_device *qsdev = to_smd_device(rpdev);
1065 
1066     kfree(qsdev);
1067 }
1068 
1069 /*
1070  * Create a smd client device for channel that is being opened.
1071  */
1072 static int qcom_smd_create_device(struct qcom_smd_channel *channel)
1073 {
1074     struct qcom_smd_device *qsdev;
1075     struct rpmsg_device *rpdev;
1076     struct qcom_smd_edge *edge = channel->edge;
1077 
1078     dev_dbg(&edge->dev, "registering '%s'\n", channel->name);
1079 
1080     qsdev = kzalloc(sizeof(*qsdev), GFP_KERNEL);
1081     if (!qsdev)
1082         return -ENOMEM;
1083 
1084     /* Link qsdev to our SMD edge */
1085     qsdev->edge = edge;
1086 
1087     /* Assign callbacks for rpmsg_device */
1088     qsdev->rpdev.ops = &qcom_smd_device_ops;
1089 
1090     /* Assign public information to the rpmsg_device */
1091     rpdev = &qsdev->rpdev;
1092     strscpy_pad(rpdev->id.name, channel->name, RPMSG_NAME_SIZE);
1093     rpdev->src = RPMSG_ADDR_ANY;
1094     rpdev->dst = RPMSG_ADDR_ANY;
1095 
1096     rpdev->dev.of_node = qcom_smd_match_channel(edge->of_node, channel->name);
1097     rpdev->dev.parent = &edge->dev;
1098     rpdev->dev.release = qcom_smd_release_device;
1099 
1100     return rpmsg_register_device(rpdev);
1101 }
1102 
1103 static int qcom_smd_create_chrdev(struct qcom_smd_edge *edge)
1104 {
1105     struct qcom_smd_device *qsdev;
1106 
1107     qsdev = kzalloc(sizeof(*qsdev), GFP_KERNEL);
1108     if (!qsdev)
1109         return -ENOMEM;
1110 
1111     qsdev->edge = edge;
1112     qsdev->rpdev.ops = &qcom_smd_device_ops;
1113     qsdev->rpdev.dev.parent = &edge->dev;
1114     qsdev->rpdev.dev.release = qcom_smd_release_device;
1115 
1116     return rpmsg_ctrldev_register_device(&qsdev->rpdev);
1117 }
1118 
1119 /*
1120  * Allocate the qcom_smd_channel object for a newly found smd channel,
1121  * retrieving and validating the smem items involved.
1122  */
1123 static struct qcom_smd_channel *qcom_smd_create_channel(struct qcom_smd_edge *edge,
1124                             unsigned smem_info_item,
1125                             unsigned smem_fifo_item,
1126                             char *name)
1127 {
1128     struct qcom_smd_channel *channel;
1129     size_t fifo_size;
1130     size_t info_size;
1131     void *fifo_base;
1132     void *info;
1133     int ret;
1134 
1135     channel = kzalloc(sizeof(*channel), GFP_KERNEL);
1136     if (!channel)
1137         return ERR_PTR(-ENOMEM);
1138 
1139     channel->edge = edge;
1140     channel->name = kstrdup(name, GFP_KERNEL);
1141     if (!channel->name) {
1142         ret = -ENOMEM;
1143         goto free_channel;
1144     }
1145 
1146     spin_lock_init(&channel->tx_lock);
1147     spin_lock_init(&channel->recv_lock);
1148     init_waitqueue_head(&channel->fblockread_event);
1149     init_waitqueue_head(&channel->state_change_event);
1150 
1151     info = qcom_smem_get(edge->remote_pid, smem_info_item, &info_size);
1152     if (IS_ERR(info)) {
1153         ret = PTR_ERR(info);
1154         goto free_name_and_channel;
1155     }
1156 
1157     /*
1158      * Use the size of the item to figure out which channel info struct to
1159      * use.
1160      */
1161     if (info_size == 2 * sizeof(struct smd_channel_info_word)) {
1162         channel->info_word = info;
1163     } else if (info_size == 2 * sizeof(struct smd_channel_info)) {
1164         channel->info = info;
1165     } else {
1166         dev_err(&edge->dev,
1167             "channel info of size %zu not supported\n", info_size);
1168         ret = -EINVAL;
1169         goto free_name_and_channel;
1170     }
1171 
1172     fifo_base = qcom_smem_get(edge->remote_pid, smem_fifo_item, &fifo_size);
1173     if (IS_ERR(fifo_base)) {
1174         ret =  PTR_ERR(fifo_base);
1175         goto free_name_and_channel;
1176     }
1177 
1178     /* The channel consist of a rx and tx fifo of equal size */
1179     fifo_size /= 2;
1180 
1181     dev_dbg(&edge->dev, "new channel '%s' info-size: %zu fifo-size: %zu\n",
1182               name, info_size, fifo_size);
1183 
1184     channel->tx_fifo = fifo_base;
1185     channel->rx_fifo = fifo_base + fifo_size;
1186     channel->fifo_size = fifo_size;
1187 
1188     qcom_smd_channel_reset(channel);
1189 
1190     return channel;
1191 
1192 free_name_and_channel:
1193     kfree(channel->name);
1194 free_channel:
1195     kfree(channel);
1196 
1197     return ERR_PTR(ret);
1198 }
1199 
1200 /*
1201  * Scans the allocation table for any newly allocated channels, calls
1202  * qcom_smd_create_channel() to create representations of these and add
1203  * them to the edge's list of channels.
1204  */
1205 static void qcom_channel_scan_worker(struct work_struct *work)
1206 {
1207     struct qcom_smd_edge *edge = container_of(work, struct qcom_smd_edge, scan_work);
1208     struct qcom_smd_alloc_entry *alloc_tbl;
1209     struct qcom_smd_alloc_entry *entry;
1210     struct qcom_smd_channel *channel;
1211     unsigned long flags;
1212     unsigned fifo_id;
1213     unsigned info_id;
1214     int tbl;
1215     int i;
1216     u32 eflags, cid;
1217 
1218     for (tbl = 0; tbl < SMD_ALLOC_TBL_COUNT; tbl++) {
1219         alloc_tbl = qcom_smem_get(edge->remote_pid,
1220                     smem_items[tbl].alloc_tbl_id, NULL);
1221         if (IS_ERR(alloc_tbl))
1222             continue;
1223 
1224         for (i = 0; i < SMD_ALLOC_TBL_SIZE; i++) {
1225             entry = &alloc_tbl[i];
1226             eflags = le32_to_cpu(entry->flags);
1227             if (test_bit(i, edge->allocated[tbl]))
1228                 continue;
1229 
1230             if (entry->ref_count == 0)
1231                 continue;
1232 
1233             if (!entry->name[0])
1234                 continue;
1235 
1236             if (!(eflags & SMD_CHANNEL_FLAGS_PACKET))
1237                 continue;
1238 
1239             if ((eflags & SMD_CHANNEL_FLAGS_EDGE_MASK) != edge->edge_id)
1240                 continue;
1241 
1242             cid = le32_to_cpu(entry->cid);
1243             info_id = smem_items[tbl].info_base_id + cid;
1244             fifo_id = smem_items[tbl].fifo_base_id + cid;
1245 
1246             channel = qcom_smd_create_channel(edge, info_id, fifo_id, entry->name);
1247             if (IS_ERR(channel))
1248                 continue;
1249 
1250             spin_lock_irqsave(&edge->channels_lock, flags);
1251             list_add(&channel->list, &edge->channels);
1252             spin_unlock_irqrestore(&edge->channels_lock, flags);
1253 
1254             dev_dbg(&edge->dev, "new channel found: '%s'\n", channel->name);
1255             set_bit(i, edge->allocated[tbl]);
1256 
1257             wake_up_interruptible_all(&edge->new_channel_event);
1258         }
1259     }
1260 
1261     schedule_work(&edge->state_work);
1262 }
1263 
1264 /*
1265  * This per edge worker scans smem for any new channels and register these. It
1266  * then scans all registered channels for state changes that should be handled
1267  * by creating or destroying smd client devices for the registered channels.
1268  *
1269  * LOCKING: edge->channels_lock only needs to cover the list operations, as the
1270  * worker is killed before any channels are deallocated
1271  */
1272 static void qcom_channel_state_worker(struct work_struct *work)
1273 {
1274     struct qcom_smd_channel *channel;
1275     struct qcom_smd_edge *edge = container_of(work,
1276                           struct qcom_smd_edge,
1277                           state_work);
1278     struct rpmsg_channel_info chinfo;
1279     unsigned remote_state;
1280     unsigned long flags;
1281 
1282     /*
1283      * Register a device for any closed channel where the remote processor
1284      * is showing interest in opening the channel.
1285      */
1286     spin_lock_irqsave(&edge->channels_lock, flags);
1287     list_for_each_entry(channel, &edge->channels, list) {
1288         if (channel->state != SMD_CHANNEL_CLOSED)
1289             continue;
1290 
1291         /*
1292          * Always open rpm_requests, even when already opened which is
1293          * required on some SoCs like msm8953.
1294          */
1295         remote_state = GET_RX_CHANNEL_INFO(channel, state);
1296         if (remote_state != SMD_CHANNEL_OPENING &&
1297             remote_state != SMD_CHANNEL_OPENED &&
1298             strcmp(channel->name, "rpm_requests"))
1299             continue;
1300 
1301         if (channel->registered)
1302             continue;
1303 
1304         spin_unlock_irqrestore(&edge->channels_lock, flags);
1305         qcom_smd_create_device(channel);
1306         spin_lock_irqsave(&edge->channels_lock, flags);
1307         channel->registered = true;
1308     }
1309 
1310     /*
1311      * Unregister the device for any channel that is opened where the
1312      * remote processor is closing the channel.
1313      */
1314     list_for_each_entry(channel, &edge->channels, list) {
1315         if (channel->state != SMD_CHANNEL_OPENING &&
1316             channel->state != SMD_CHANNEL_OPENED)
1317             continue;
1318 
1319         remote_state = GET_RX_CHANNEL_INFO(channel, state);
1320         if (remote_state == SMD_CHANNEL_OPENING ||
1321             remote_state == SMD_CHANNEL_OPENED)
1322             continue;
1323 
1324         spin_unlock_irqrestore(&edge->channels_lock, flags);
1325 
1326         strscpy_pad(chinfo.name, channel->name, sizeof(chinfo.name));
1327         chinfo.src = RPMSG_ADDR_ANY;
1328         chinfo.dst = RPMSG_ADDR_ANY;
1329         rpmsg_unregister_device(&edge->dev, &chinfo);
1330         channel->registered = false;
1331         spin_lock_irqsave(&edge->channels_lock, flags);
1332     }
1333     spin_unlock_irqrestore(&edge->channels_lock, flags);
1334 }
1335 
1336 /*
1337  * Parses an of_node describing an edge.
1338  */
1339 static int qcom_smd_parse_edge(struct device *dev,
1340                    struct device_node *node,
1341                    struct qcom_smd_edge *edge)
1342 {
1343     struct device_node *syscon_np;
1344     const char *key;
1345     int irq;
1346     int ret;
1347 
1348     INIT_LIST_HEAD(&edge->channels);
1349     spin_lock_init(&edge->channels_lock);
1350 
1351     INIT_WORK(&edge->scan_work, qcom_channel_scan_worker);
1352     INIT_WORK(&edge->state_work, qcom_channel_state_worker);
1353 
1354     edge->of_node = of_node_get(node);
1355 
1356     key = "qcom,smd-edge";
1357     ret = of_property_read_u32(node, key, &edge->edge_id);
1358     if (ret) {
1359         dev_err(dev, "edge missing %s property\n", key);
1360         goto put_node;
1361     }
1362 
1363     edge->remote_pid = QCOM_SMEM_HOST_ANY;
1364     key = "qcom,remote-pid";
1365     of_property_read_u32(node, key, &edge->remote_pid);
1366 
1367     edge->mbox_client.dev = dev;
1368     edge->mbox_client.knows_txdone = true;
1369     edge->mbox_chan = mbox_request_channel(&edge->mbox_client, 0);
1370     if (IS_ERR(edge->mbox_chan)) {
1371         if (PTR_ERR(edge->mbox_chan) != -ENODEV) {
1372             ret = PTR_ERR(edge->mbox_chan);
1373             goto put_node;
1374         }
1375 
1376         edge->mbox_chan = NULL;
1377 
1378         syscon_np = of_parse_phandle(node, "qcom,ipc", 0);
1379         if (!syscon_np) {
1380             dev_err(dev, "no qcom,ipc node\n");
1381             ret = -ENODEV;
1382             goto put_node;
1383         }
1384 
1385         edge->ipc_regmap = syscon_node_to_regmap(syscon_np);
1386         of_node_put(syscon_np);
1387         if (IS_ERR(edge->ipc_regmap)) {
1388             ret = PTR_ERR(edge->ipc_regmap);
1389             goto put_node;
1390         }
1391 
1392         key = "qcom,ipc";
1393         ret = of_property_read_u32_index(node, key, 1, &edge->ipc_offset);
1394         if (ret < 0) {
1395             dev_err(dev, "no offset in %s\n", key);
1396             goto put_node;
1397         }
1398 
1399         ret = of_property_read_u32_index(node, key, 2, &edge->ipc_bit);
1400         if (ret < 0) {
1401             dev_err(dev, "no bit in %s\n", key);
1402             goto put_node;
1403         }
1404     }
1405 
1406     ret = of_property_read_string(node, "label", &edge->name);
1407     if (ret < 0)
1408         edge->name = node->name;
1409 
1410     irq = irq_of_parse_and_map(node, 0);
1411     if (!irq) {
1412         dev_err(dev, "required smd interrupt missing\n");
1413         ret = -EINVAL;
1414         goto put_node;
1415     }
1416 
1417     ret = devm_request_irq(dev, irq,
1418                    qcom_smd_edge_intr, IRQF_TRIGGER_RISING,
1419                    node->name, edge);
1420     if (ret) {
1421         dev_err(dev, "failed to request smd irq\n");
1422         goto put_node;
1423     }
1424 
1425     edge->irq = irq;
1426 
1427     return 0;
1428 
1429 put_node:
1430     of_node_put(node);
1431     edge->of_node = NULL;
1432 
1433     return ret;
1434 }
1435 
1436 /*
1437  * Release function for an edge.
1438   * Reset the state of each associated channel and free the edge context.
1439  */
1440 static void qcom_smd_edge_release(struct device *dev)
1441 {
1442     struct qcom_smd_channel *channel, *tmp;
1443     struct qcom_smd_edge *edge = to_smd_edge(dev);
1444 
1445     list_for_each_entry_safe(channel, tmp, &edge->channels, list) {
1446         list_del(&channel->list);
1447         kfree(channel->name);
1448         kfree(channel);
1449     }
1450 
1451     kfree(edge);
1452 }
1453 
1454 static ssize_t rpmsg_name_show(struct device *dev,
1455                    struct device_attribute *attr, char *buf)
1456 {
1457     struct qcom_smd_edge *edge = to_smd_edge(dev);
1458 
1459     return sprintf(buf, "%s\n", edge->name);
1460 }
1461 static DEVICE_ATTR_RO(rpmsg_name);
1462 
1463 static struct attribute *qcom_smd_edge_attrs[] = {
1464     &dev_attr_rpmsg_name.attr,
1465     NULL
1466 };
1467 ATTRIBUTE_GROUPS(qcom_smd_edge);
1468 
1469 /**
1470  * qcom_smd_register_edge() - register an edge based on an device_node
1471  * @parent:    parent device for the edge
1472  * @node:      device_node describing the edge
1473  *
1474  * Return: an edge reference, or negative ERR_PTR() on failure.
1475  */
1476 struct qcom_smd_edge *qcom_smd_register_edge(struct device *parent,
1477                          struct device_node *node)
1478 {
1479     struct qcom_smd_edge *edge;
1480     int ret;
1481 
1482     edge = kzalloc(sizeof(*edge), GFP_KERNEL);
1483     if (!edge)
1484         return ERR_PTR(-ENOMEM);
1485 
1486     init_waitqueue_head(&edge->new_channel_event);
1487 
1488     edge->dev.parent = parent;
1489     edge->dev.release = qcom_smd_edge_release;
1490     edge->dev.of_node = node;
1491     edge->dev.groups = qcom_smd_edge_groups;
1492     dev_set_name(&edge->dev, "%s:%pOFn", dev_name(parent), node);
1493     ret = device_register(&edge->dev);
1494     if (ret) {
1495         pr_err("failed to register smd edge\n");
1496         put_device(&edge->dev);
1497         return ERR_PTR(ret);
1498     }
1499 
1500     ret = qcom_smd_parse_edge(&edge->dev, node, edge);
1501     if (ret) {
1502         dev_err(&edge->dev, "failed to parse smd edge\n");
1503         goto unregister_dev;
1504     }
1505 
1506     ret = qcom_smd_create_chrdev(edge);
1507     if (ret) {
1508         dev_err(&edge->dev, "failed to register chrdev for edge\n");
1509         goto unregister_dev;
1510     }
1511 
1512     schedule_work(&edge->scan_work);
1513 
1514     return edge;
1515 
1516 unregister_dev:
1517     if (!IS_ERR_OR_NULL(edge->mbox_chan))
1518         mbox_free_channel(edge->mbox_chan);
1519 
1520     device_unregister(&edge->dev);
1521     return ERR_PTR(ret);
1522 }
1523 EXPORT_SYMBOL(qcom_smd_register_edge);
1524 
1525 static int qcom_smd_remove_device(struct device *dev, void *data)
1526 {
1527     device_unregister(dev);
1528 
1529     return 0;
1530 }
1531 
1532 /**
1533  * qcom_smd_unregister_edge() - release an edge and its children
1534  * @edge:      edge reference acquired from qcom_smd_register_edge
1535  */
1536 int qcom_smd_unregister_edge(struct qcom_smd_edge *edge)
1537 {
1538     int ret;
1539 
1540     disable_irq(edge->irq);
1541     cancel_work_sync(&edge->scan_work);
1542     cancel_work_sync(&edge->state_work);
1543 
1544     ret = device_for_each_child(&edge->dev, NULL, qcom_smd_remove_device);
1545     if (ret)
1546         dev_warn(&edge->dev, "can't remove smd device: %d\n", ret);
1547 
1548     mbox_free_channel(edge->mbox_chan);
1549     device_unregister(&edge->dev);
1550 
1551     return 0;
1552 }
1553 EXPORT_SYMBOL(qcom_smd_unregister_edge);
1554 
1555 static int qcom_smd_probe(struct platform_device *pdev)
1556 {
1557     struct device_node *node;
1558     void *p;
1559 
1560     /* Wait for smem */
1561     p = qcom_smem_get(QCOM_SMEM_HOST_ANY, smem_items[0].alloc_tbl_id, NULL);
1562     if (PTR_ERR(p) == -EPROBE_DEFER)
1563         return PTR_ERR(p);
1564 
1565     for_each_available_child_of_node(pdev->dev.of_node, node)
1566         qcom_smd_register_edge(&pdev->dev, node);
1567 
1568     return 0;
1569 }
1570 
1571 static int qcom_smd_remove_edge(struct device *dev, void *data)
1572 {
1573     struct qcom_smd_edge *edge = to_smd_edge(dev);
1574 
1575     return qcom_smd_unregister_edge(edge);
1576 }
1577 
1578 /*
1579  * Shut down all smd clients by making sure that each edge stops processing
1580  * events and scanning for new channels, then call destroy on the devices.
1581  */
1582 static int qcom_smd_remove(struct platform_device *pdev)
1583 {
1584     int ret;
1585 
1586     ret = device_for_each_child(&pdev->dev, NULL, qcom_smd_remove_edge);
1587     if (ret)
1588         dev_warn(&pdev->dev, "can't remove smd device: %d\n", ret);
1589 
1590     return ret;
1591 }
1592 
1593 static const struct of_device_id qcom_smd_of_match[] = {
1594     { .compatible = "qcom,smd" },
1595     {}
1596 };
1597 MODULE_DEVICE_TABLE(of, qcom_smd_of_match);
1598 
1599 static struct platform_driver qcom_smd_driver = {
1600     .probe = qcom_smd_probe,
1601     .remove = qcom_smd_remove,
1602     .driver = {
1603         .name = "qcom-smd",
1604         .of_match_table = qcom_smd_of_match,
1605     },
1606 };
1607 
1608 static int __init qcom_smd_init(void)
1609 {
1610     return platform_driver_register(&qcom_smd_driver);
1611 }
1612 arch_initcall(qcom_smd_init);
1613 
1614 static void __exit qcom_smd_exit(void)
1615 {
1616     platform_driver_unregister(&qcom_smd_driver);
1617 }
1618 module_exit(qcom_smd_exit);
1619 
1620 MODULE_AUTHOR("Bjorn Andersson <bjorn.andersson@sonymobile.com>");
1621 MODULE_DESCRIPTION("Qualcomm Shared Memory Driver");
1622 MODULE_LICENSE("GPL v2");