1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Defines interfaces for interacting wtih the Raspberry Pi firmware's
4  * property channel.
5  *
6  * Copyright © 2015 Broadcom
7  */
8 
9 #include <linux/dma-mapping.h>
10 #include <linux/mailbox_client.h>
11 #include <linux/module.h>
12 #include <linux/of_platform.h>
13 #include <linux/platform_device.h>
14 #include <linux/slab.h>
15 #include <linux/pci.h>
16 #include <linux/delay.h>
17 #include <soc/bcm2835/raspberrypi-firmware.h>
18 
19 #define MBOX_MSG(chan, data28)		(((data28) & ~0xf) | ((chan) & 0xf))
20 #define MBOX_CHAN(msg)			((msg) & 0xf)
21 #define MBOX_DATA28(msg)		((msg) & ~0xf)
22 #define MBOX_CHAN_PROPERTY		8
23 
24 #define VL805_PCI_CONFIG_VERSION_OFFSET		0x50
25 
26 static struct platform_device *rpi_hwmon;
27 static struct platform_device *rpi_clk;
28 
29 struct rpi_firmware {
30 	struct mbox_client cl;
31 	struct mbox_chan *chan; /* The property channel. */
32 	struct completion c;
33 	u32 enabled;
34 };
35 
36 static DEFINE_MUTEX(transaction_lock);
37 
38 static void response_callback(struct mbox_client *cl, void *msg)
39 {
40 	struct rpi_firmware *fw = container_of(cl, struct rpi_firmware, cl);
41 	complete(&fw->c);
42 }
43 
44 /*
45  * Sends a request to the firmware through the BCM2835 mailbox driver,
46  * and synchronously waits for the reply.
47  */
48 static int
49 rpi_firmware_transaction(struct rpi_firmware *fw, u32 chan, u32 data)
50 {
51 	u32 message = MBOX_MSG(chan, data);
52 	int ret;
53 
54 	WARN_ON(data & 0xf);
55 
56 	mutex_lock(&transaction_lock);
57 	reinit_completion(&fw->c);
58 	ret = mbox_send_message(fw->chan, &message);
59 	if (ret >= 0) {
60 		if (wait_for_completion_timeout(&fw->c, HZ)) {
61 			ret = 0;
62 		} else {
63 			ret = -ETIMEDOUT;
64 			WARN_ONCE(1, "Firmware transaction timeout");
65 		}
66 	} else {
67 		dev_err(fw->cl.dev, "mbox_send_message returned %d\n", ret);
68 	}
69 	mutex_unlock(&transaction_lock);
70 
71 	return ret;
72 }
73 
74 /**
75  * rpi_firmware_property_list - Submit firmware property list
76  * @fw:		Pointer to firmware structure from rpi_firmware_get().
77  * @data:	Buffer holding tags.
78  * @tag_size:	Size of tags buffer.
79  *
80  * Submits a set of concatenated tags to the VPU firmware through the
81  * mailbox property interface.
82  *
83  * The buffer header and the ending tag are added by this function and
84  * don't need to be supplied, just the actual tags for your operation.
85  * See struct rpi_firmware_property_tag_header for the per-tag
86  * structure.
87  */
88 int rpi_firmware_property_list(struct rpi_firmware *fw,
89 			       void *data, size_t tag_size)
90 {
91 	size_t size = tag_size + 12;
92 	u32 *buf;
93 	dma_addr_t bus_addr;
94 	int ret;
95 
96 	/* Packets are processed a dword at a time. */
97 	if (size & 3)
98 		return -EINVAL;
99 
100 	buf = dma_alloc_coherent(fw->cl.dev, PAGE_ALIGN(size), &bus_addr,
101 				 GFP_ATOMIC);
102 	if (!buf)
103 		return -ENOMEM;
104 
105 	/* The firmware will error out without parsing in this case. */
106 	WARN_ON(size >= 1024 * 1024);
107 
108 	buf[0] = size;
109 	buf[1] = RPI_FIRMWARE_STATUS_REQUEST;
110 	memcpy(&buf[2], data, tag_size);
111 	buf[size / 4 - 1] = RPI_FIRMWARE_PROPERTY_END;
112 	wmb();
113 
114 	ret = rpi_firmware_transaction(fw, MBOX_CHAN_PROPERTY, bus_addr);
115 
116 	rmb();
117 	memcpy(data, &buf[2], tag_size);
118 	if (ret == 0 && buf[1] != RPI_FIRMWARE_STATUS_SUCCESS) {
119 		/*
120 		 * The tag name here might not be the one causing the
121 		 * error, if there were multiple tags in the request.
122 		 * But single-tag is the most common, so go with it.
123 		 */
124 		dev_err(fw->cl.dev, "Request 0x%08x returned status 0x%08x\n",
125 			buf[2], buf[1]);
126 		ret = -EINVAL;
127 	}
128 
129 	dma_free_coherent(fw->cl.dev, PAGE_ALIGN(size), buf, bus_addr);
130 
131 	return ret;
132 }
133 EXPORT_SYMBOL_GPL(rpi_firmware_property_list);
134 
135 /**
136  * rpi_firmware_property - Submit single firmware property
137  * @fw:		Pointer to firmware structure from rpi_firmware_get().
138  * @tag:	One of enum_mbox_property_tag.
139  * @tag_data:	Tag data buffer.
140  * @buf_size:	Buffer size.
141  *
142  * Submits a single tag to the VPU firmware through the mailbox
143  * property interface.
144  *
145  * This is a convenience wrapper around
146  * rpi_firmware_property_list() to avoid some of the
147  * boilerplate in property calls.
148  */
149 int rpi_firmware_property(struct rpi_firmware *fw,
150 			  u32 tag, void *tag_data, size_t buf_size)
151 {
152 	struct rpi_firmware_property_tag_header *header;
153 	int ret;
154 
155 	/* Some mailboxes can use over 1k bytes. Rather than checking
156 	 * size and using stack or kmalloc depending on requirements,
157 	 * just use kmalloc. Mailboxes don't get called enough to worry
158 	 * too much about the time taken in the allocation.
159 	 */
160 	void *data = kmalloc(sizeof(*header) + buf_size, GFP_KERNEL);
161 
162 	if (!data)
163 		return -ENOMEM;
164 
165 	header = data;
166 	header->tag = tag;
167 	header->buf_size = buf_size;
168 	header->req_resp_size = 0;
169 	memcpy(data + sizeof(*header), tag_data, buf_size);
170 
171 	ret = rpi_firmware_property_list(fw, data, buf_size + sizeof(*header));
172 
173 	memcpy(tag_data, data + sizeof(*header), buf_size);
174 
175 	kfree(data);
176 
177 	return ret;
178 }
179 EXPORT_SYMBOL_GPL(rpi_firmware_property);
180 
181 static void
182 rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
183 {
184 	u32 packet;
185 	int ret = rpi_firmware_property(fw,
186 					RPI_FIRMWARE_GET_FIRMWARE_REVISION,
187 					&packet, sizeof(packet));
188 
189 	if (ret)
190 		return;
191 
192 	dev_info(fw->cl.dev, "Attached to firmware from %ptT\n", &packet);
193 }
194 
195 static void
196 rpi_register_hwmon_driver(struct device *dev, struct rpi_firmware *fw)
197 {
198 	u32 packet;
199 	int ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_THROTTLED,
200 					&packet, sizeof(packet));
201 
202 	if (ret)
203 		return;
204 
205 	rpi_hwmon = platform_device_register_data(dev, "raspberrypi-hwmon",
206 						  -1, NULL, 0);
207 }
208 
209 static void rpi_register_clk_driver(struct device *dev)
210 {
211 	rpi_clk = platform_device_register_data(dev, "raspberrypi-clk",
212 						-1, NULL, 0);
213 }
214 
215 static int rpi_firmware_probe(struct platform_device *pdev)
216 {
217 	struct device *dev = &pdev->dev;
218 	struct rpi_firmware *fw;
219 
220 	fw = devm_kzalloc(dev, sizeof(*fw), GFP_KERNEL);
221 	if (!fw)
222 		return -ENOMEM;
223 
224 	fw->cl.dev = dev;
225 	fw->cl.rx_callback = response_callback;
226 	fw->cl.tx_block = true;
227 
228 	fw->chan = mbox_request_channel(&fw->cl, 0);
229 	if (IS_ERR(fw->chan)) {
230 		int ret = PTR_ERR(fw->chan);
231 		if (ret != -EPROBE_DEFER)
232 			dev_err(dev, "Failed to get mbox channel: %d\n", ret);
233 		return ret;
234 	}
235 
236 	init_completion(&fw->c);
237 
238 	platform_set_drvdata(pdev, fw);
239 
240 	rpi_firmware_print_firmware_revision(fw);
241 	rpi_register_hwmon_driver(dev, fw);
242 	rpi_register_clk_driver(dev);
243 
244 	return 0;
245 }
246 
247 static void rpi_firmware_shutdown(struct platform_device *pdev)
248 {
249 	struct rpi_firmware *fw = platform_get_drvdata(pdev);
250 
251 	if (!fw)
252 		return;
253 
254 	rpi_firmware_property(fw, RPI_FIRMWARE_NOTIFY_REBOOT, NULL, 0);
255 }
256 
257 static int rpi_firmware_remove(struct platform_device *pdev)
258 {
259 	struct rpi_firmware *fw = platform_get_drvdata(pdev);
260 
261 	platform_device_unregister(rpi_hwmon);
262 	rpi_hwmon = NULL;
263 	platform_device_unregister(rpi_clk);
264 	rpi_clk = NULL;
265 	mbox_free_channel(fw->chan);
266 
267 	return 0;
268 }
269 
270 /**
271  * rpi_firmware_get - Get pointer to rpi_firmware structure.
272  * @firmware_node:    Pointer to the firmware Device Tree node.
273  *
274  * Returns NULL is the firmware device is not ready.
275  */
276 struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
277 {
278 	struct platform_device *pdev = of_find_device_by_node(firmware_node);
279 
280 	if (!pdev)
281 		return NULL;
282 
283 	return platform_get_drvdata(pdev);
284 }
285 EXPORT_SYMBOL_GPL(rpi_firmware_get);
286 
287 /*
288  * The Raspberry Pi 4 gets its USB functionality from VL805, a PCIe chip that
289  * implements xHCI. After a PCI reset, VL805's firmware may either be loaded
290  * directly from an EEPROM or, if not present, by the SoC's co-processor,
291  * VideoCore. RPi4's VideoCore OS contains both the non public firmware load
292  * logic and the VL805 firmware blob. This function triggers the aforementioned
293  * process.
294  */
295 int rpi_firmware_init_vl805(struct pci_dev *pdev)
296 {
297 	struct device_node *fw_np;
298 	struct rpi_firmware *fw;
299 	u32 dev_addr, version;
300 	int ret;
301 
302 	fw_np = of_find_compatible_node(NULL, NULL,
303 					"raspberrypi,bcm2835-firmware");
304 	if (!fw_np)
305 		return 0;
306 
307 	fw = rpi_firmware_get(fw_np);
308 	of_node_put(fw_np);
309 	if (!fw)
310 		return -ENODEV;
311 
312 	/*
313 	 * Make sure we don't trigger a firmware load unnecessarily.
314 	 *
315 	 * If something went wrong with PCI, this whole exercise would be
316 	 * futile as VideoCore expects from us a configured PCI bus. Just take
317 	 * the faulty version (likely ~0) and let xHCI's registration fail
318 	 * further down the line.
319 	 */
320 	pci_read_config_dword(pdev, VL805_PCI_CONFIG_VERSION_OFFSET, &version);
321 	if (version)
322 		goto exit;
323 
324 	dev_addr = pdev->bus->number << 20 | PCI_SLOT(pdev->devfn) << 15 |
325 		   PCI_FUNC(pdev->devfn) << 12;
326 
327 	ret = rpi_firmware_property(fw, RPI_FIRMWARE_NOTIFY_XHCI_RESET,
328 				    &dev_addr, sizeof(dev_addr));
329 	if (ret)
330 		return ret;
331 
332 	/* Wait for vl805 to startup */
333 	usleep_range(200, 1000);
334 
335 	pci_read_config_dword(pdev, VL805_PCI_CONFIG_VERSION_OFFSET,
336 			      &version);
337 exit:
338 	pci_info(pdev, "VL805 firmware version %08x\n", version);
339 
340 	return 0;
341 }
342 EXPORT_SYMBOL_GPL(rpi_firmware_init_vl805);
343 
344 static const struct of_device_id rpi_firmware_of_match[] = {
345 	{ .compatible = "raspberrypi,bcm2835-firmware", },
346 	{},
347 };
348 MODULE_DEVICE_TABLE(of, rpi_firmware_of_match);
349 
350 static struct platform_driver rpi_firmware_driver = {
351 	.driver = {
352 		.name = "raspberrypi-firmware",
353 		.of_match_table = rpi_firmware_of_match,
354 	},
355 	.probe		= rpi_firmware_probe,
356 	.shutdown	= rpi_firmware_shutdown,
357 	.remove		= rpi_firmware_remove,
358 };
359 module_platform_driver(rpi_firmware_driver);
360 
361 MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
362 MODULE_DESCRIPTION("Raspberry Pi firmware driver");
363 MODULE_LICENSE("GPL v2");
364