drivers/rpmsg/qcom_smd.c

   1 /*
   2  * Copyright (c) 2015, Sony Mobile Communications AB.
   3  * Copyright (c) 2012-2013, The Linux Foundation. All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 and
   7  * only version 2 as published by the Free Software Foundation.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  */
  14
  15 #include <linux/interrupt.h>
  16 #include <linux/io.h>
  17 #include <linux/mfd/syscon.h>
  18 #include <linux/module.h>
  19 #include <linux/of_irq.h>
  20 #include <linux/of_platform.h>
  21 #include <linux/platform_device.h>
  22 #include <linux/regmap.h>
  23 #include <linux/sched.h>
  24 #include <linux/slab.h>
  25 #include <linux/soc/qcom/smem.h>
  26 #include <linux/wait.h>
  27 #include <linux/rpmsg.h>
  28 #include <linux/rpmsg/qcom_smd.h>
  29
  30 #include "rpmsg_internal.h"
  31
  32 /*
  33  * The Qualcomm Shared Memory communication solution provides point-to-point
  34  * channels for clients to send and receive streaming or packet based data.
  35  *
  36  * Each channel consists of a control item (channel info) and a ring buffer
  37  * pair. The channel info carry information related to channel state, flow
  38  * control and the offsets within the ring buffer.
  39  *
  40  * All allocated channels are listed in an allocation table, identifying the
  41  * pair of items by name, type and remote processor.
  42  *
  43  * Upon creating a new channel the remote processor allocates channel info and
  44  * ring buffer items from the smem heap and populate the allocation table. An
  45  * interrupt is sent to the other end of the channel and a scan for new
  46  * channels should be done. A channel never goes away, it will only change
  47  * state.
  48  *
  49  * The remote processor signals it intent for bring up the communication
  50  * channel by setting the state of its end of the channel to "opening" and
  51  * sends out an interrupt. We detect this change and register a smd device to
  52  * consume the channel. Upon finding a consumer we finish the handshake and the
  53  * channel is up.
  54  *
  55  * Upon closing a channel, the remote processor will update the state of its
  56  * end of the channel and signal us, we will then unregister any attached
  57  * device and close our end of the channel.
  58  *
  59  * Devices attached to a channel can use the qcom_smd_send function to push
  60  * data to the channel, this is done by copying the data into the tx ring
  61  * buffer, updating the pointers in the channel info and signaling the remote
  62  * processor.
  63  *
  64  * The remote processor does the equivalent when it transfer data and upon
  65  * receiving the interrupt we check the channel info for new data and delivers
  66  * this to the attached device. If the device is not ready to receive the data
  67  * we leave it in the ring buffer for now.
  68  */
  69
  70 struct smd_channel_info;
  71 struct smd_channel_info_pair;
  72 struct smd_channel_info_word;
  73 struct smd_channel_info_word_pair;
  74
  75 static const struct rpmsg_endpoint_ops qcom_smd_endpoint_ops;
  76
  77 #define SMD_ALLOC_TBL_COUNT     2
  78 #define SMD_ALLOC_TBL_SIZE      64
  79
  80 /*
  81  * This lists the various smem heap items relevant for the allocation table and
  82  * smd channel entries.
  83  */
  84 static const struct {
  85         unsigned alloc_tbl_id;
  86         unsigned info_base_id;
  87         unsigned fifo_base_id;
  88 } smem_items[SMD_ALLOC_TBL_COUNT] = {
  89         {
  90                 .alloc_tbl_id = 13,
  91                 .info_base_id = 14,
  92                 .fifo_base_id = 338
  93         },
  94         {
  95                 .alloc_tbl_id = 266,
  96                 .info_base_id = 138,
  97                 .fifo_base_id = 202,
  98         },
  99 };
 100
 101 /**
 102  * struct qcom_smd_edge - representing a remote processor
 103  * @of_node:            of_node handle for information related to this edge
 104  * @edge_id:            identifier of this edge
 105  * @remote_pid:         identifier of remote processor
 106  * @irq:                interrupt for signals on this edge
 107  * @ipc_regmap:         regmap handle holding the outgoing ipc register
 108  * @ipc_offset:         offset within @ipc_regmap of the register for ipc
 109  * @ipc_bit:            bit in the register at @ipc_offset of @ipc_regmap
 110  * @channels:           list of all channels detected on this edge
 111  * @channels_lock:      guard for modifications of @channels
 112  * @allocated:          array of bitmaps representing already allocated channels
 113  * @smem_available:     last available amount of smem triggering a channel scan
 114  * @scan_work:          work item for discovering new channels
 115  * @state_work:         work item for edge state changes
 116  */
 117 struct qcom_smd_edge {
 118         struct device dev;
 119
 120         const char *name;
 121
 122         struct device_node *of_node;
 123         unsigned edge_id;
 124         unsigned remote_pid;
 125
 126         int irq;
 127
 128         struct regmap *ipc_regmap;
 129         int ipc_offset;
 130         int ipc_bit;
 131
 132         struct list_head channels;
 133         spinlock_t channels_lock;
 134
 135         DECLARE_BITMAP(allocated[SMD_ALLOC_TBL_COUNT], SMD_ALLOC_TBL_SIZE);
 136
 137         unsigned smem_available;
 138
 139         wait_queue_head_t new_channel_event;
 140
 141         struct work_struct scan_work;
 142         struct work_struct state_work;
 143 };
 144
 145 /*
 146  * SMD channel states.
 147  */
 148 enum smd_channel_state {
 149         SMD_CHANNEL_CLOSED,
 150         SMD_CHANNEL_OPENING,
 151         SMD_CHANNEL_OPENED,
 152         SMD_CHANNEL_FLUSHING,
 153         SMD_CHANNEL_CLOSING,
 154         SMD_CHANNEL_RESET,
 155         SMD_CHANNEL_RESET_OPENING
 156 };
 157
 158 struct qcom_smd_device {
 159         struct rpmsg_device rpdev;
 160
 161         struct qcom_smd_edge *edge;
 162 };
 163
 164 struct qcom_smd_endpoint {
 165         struct rpmsg_endpoint ept;
 166
 167         struct qcom_smd_channel *qsch;
 168 };
 169
 170 #define to_smd_device(_rpdev)   container_of(_rpdev, struct qcom_smd_device, rpdev)
 171 #define to_smd_edge(d)          container_of(d, struct qcom_smd_edge, dev)
 172 #define to_smd_endpoint(ept)    container_of(ept, struct qcom_smd_endpoint, ept)
 173
 174 /**
 175  * struct qcom_smd_channel - smd channel struct
 176  * @edge:               qcom_smd_edge this channel is living on
 177  * @qsdev:              reference to a associated smd client device
 178  * @name:               name of the channel
 179  * @state:              local state of the channel
 180  * @remote_state:       remote state of the channel
 181  * @info:               byte aligned outgoing/incoming channel info
 182  * @info_word:          word aligned outgoing/incoming channel info
 183  * @tx_lock:            lock to make writes to the channel mutually exclusive
 184  * @fblockread_event:   wakeup event tied to tx fBLOCKREADINTR
 185  * @tx_fifo:            pointer to the outgoing ring buffer
 186  * @rx_fifo:            pointer to the incoming ring buffer
 187  * @fifo_size:          size of each ring buffer
 188  * @bounce_buffer:      bounce buffer for reading wrapped packets
 189  * @cb:                 callback function registered for this channel
 190  * @recv_lock:          guard for rx info modifications and cb pointer
 191  * @pkt_size:           size of the currently handled packet
 192  * @list:               lite entry for @channels in qcom_smd_edge
 193  */
 194 struct qcom_smd_channel {
 195         struct qcom_smd_edge *edge;
 196
 197         struct qcom_smd_endpoint *qsept;
 198         bool registered;
 199
 200         char *name;
 201         enum smd_channel_state state;
 202         enum smd_channel_state remote_state;
 203
 204         struct smd_channel_info_pair *info;
 205         struct smd_channel_info_word_pair *info_word;
 206
 207         struct mutex tx_lock;
 208         wait_queue_head_t fblockread_event;
 209
 210         void *tx_fifo;
 211         void *rx_fifo;
 212         int fifo_size;
 213
 214         void *bounce_buffer;
 215
 216         spinlock_t recv_lock;
 217
 218         int pkt_size;
 219
 220         void *drvdata;
 221
 222         struct list_head list;
 223 };
 224
 225 /*
 226  * Format of the smd_info smem items, for byte aligned channels.
 227  */
 228 struct smd_channel_info {
 229         __le32 state;
 230         u8  fDSR;
 231         u8  fCTS;
 232         u8  fCD;
 233         u8  fRI;
 234         u8  fHEAD;
 235         u8  fTAIL;
 236         u8  fSTATE;
 237         u8  fBLOCKREADINTR;
 238         __le32 tail;
 239         __le32 head;
 240 };
 241
 242 struct smd_channel_info_pair {
 243         struct smd_channel_info tx;
 244         struct smd_channel_info rx;
 245 };
 246
 247 /*
 248  * Format of the smd_info smem items, for word aligned channels.
 249  */
 250 struct smd_channel_info_word {
 251         __le32 state;
 252         __le32 fDSR;
 253         __le32 fCTS;
 254         __le32 fCD;
 255         __le32 fRI;
 256         __le32 fHEAD;
 257         __le32 fTAIL;
 258         __le32 fSTATE;
 259         __le32 fBLOCKREADINTR;
 260         __le32 tail;
 261         __le32 head;
 262 };
 263
 264 struct smd_channel_info_word_pair {
 265         struct smd_channel_info_word tx;
 266         struct smd_channel_info_word rx;
 267 };
 268
 269 #define GET_RX_CHANNEL_FLAG(channel, param)                                  \
 270         ({                                                                   \
 271                 BUILD_BUG_ON(sizeof(channel->info->rx.param) != sizeof(u8)); \
 272                 channel->info_word ?                                         \
 273                         le32_to_cpu(channel->info_word->rx.param) :          \
 274                         channel->info->rx.param;                             \
 275         })
 276
 277 #define GET_RX_CHANNEL_INFO(channel, param)                                   \
 278         ({                                                                    \
 279                 BUILD_BUG_ON(sizeof(channel->info->rx.param) != sizeof(u32)); \
 280                 le32_to_cpu(channel->info_word ?                              \
 281                         channel->info_word->rx.param :                        \
 282                         channel->info->rx.param);                             \
 283         })
 284
 285 #define SET_RX_CHANNEL_FLAG(channel, param, value)                           \
 286         ({                                                                   \
 287                 BUILD_BUG_ON(sizeof(channel->info->rx.param) != sizeof(u8)); \
 288                 if (channel->info_word)                                      \
 289                         channel->info_word->rx.param = cpu_to_le32(value);   \
 290                 else                                                         \
 291                         channel->info->rx.param = value;                     \
 292         })
 293
 294 #define SET_RX_CHANNEL_INFO(channel, param, value)                            \
 295         ({                                                                    \
 296                 BUILD_BUG_ON(sizeof(channel->info->rx.param) != sizeof(u32)); \
 297                 if (channel->info_word)                                       \
 298                         channel->info_word->rx.param = cpu_to_le32(value);    \
 299                 else                                                          \
 300                         channel->info->rx.param = cpu_to_le32(value);         \
 301         })
 302
 303 #define GET_TX_CHANNEL_FLAG(channel, param)                                  \
 304         ({                                                                   \
 305                 BUILD_BUG_ON(sizeof(channel->info->tx.param) != sizeof(u8)); \
 306                 channel->info_word ?                                         \
 307                         le32_to_cpu(channel->info_word->tx.param) :          \
 308                         channel->info->tx.param;                             \
 309         })
 310
 311 #define GET_TX_CHANNEL_INFO(channel, param)                                   \
 312         ({                                                                    \
 313                 BUILD_BUG_ON(sizeof(channel->info->tx.param) != sizeof(u32)); \
 314                 le32_to_cpu(channel->info_word ?                              \
 315                         channel->info_word->tx.param :                        \
 316                         channel->info->tx.param);                             \
 317         })
 318
 319 #define SET_TX_CHANNEL_FLAG(channel, param, value)                           \
 320         ({                                                                   \
 321                 BUILD_BUG_ON(sizeof(channel->info->tx.param) != sizeof(u8)); \
 322                 if (channel->info_word)                                      \
 323                         channel->info_word->tx.param = cpu_to_le32(value);   \
 324                 else                                                         \
 325                         channel->info->tx.param = value;                     \
 326         })
 327
 328 #define SET_TX_CHANNEL_INFO(channel, param, value)                            \
 329         ({                                                                    \
 330                 BUILD_BUG_ON(sizeof(channel->info->tx.param) != sizeof(u32)); \
 331                 if (channel->info_word)                                       \
 332                         channel->info_word->tx.param = cpu_to_le32(value);   \
 333                 else                                                          \
 334                         channel->info->tx.param = cpu_to_le32(value);         \
 335         })
 336
 337 /**
 338  * struct qcom_smd_alloc_entry - channel allocation entry
 339  * @name:       channel name
 340  * @cid:        channel index
 341  * @flags:      channel flags and edge id
 342  * @ref_count:  reference count of the channel
 343  */
 344 struct qcom_smd_alloc_entry {
 345         u8 name[20];
 346         __le32 cid;
 347         __le32 flags;
 348         __le32 ref_count;
 349 } __packed;
 350
 351 #define SMD_CHANNEL_FLAGS_EDGE_MASK     0xff
 352 #define SMD_CHANNEL_FLAGS_STREAM        BIT(8)
 353 #define SMD_CHANNEL_FLAGS_PACKET        BIT(9)
 354
 355 /*
 356  * Each smd packet contains a 20 byte header, with the first 4 being the length
 357  * of the packet.
 358  */
 359 #define SMD_PACKET_HEADER_LEN   20
 360
 361 /*
 362  * Signal the remote processor associated with 'channel'.
 363  */
 364 static void qcom_smd_signal_channel(struct qcom_smd_channel *channel)
 365 {
 366         struct qcom_smd_edge *edge = channel->edge;
 367
 368         regmap_write(edge->ipc_regmap, edge->ipc_offset, BIT(edge->ipc_bit));
 369 }
 370
 371 /*
 372  * Initialize the tx channel info
 373  */
 374 static void qcom_smd_channel_reset(struct qcom_smd_channel *channel)
 375 {
 376         SET_TX_CHANNEL_INFO(channel, state, SMD_CHANNEL_CLOSED);
 377         SET_TX_CHANNEL_FLAG(channel, fDSR, 0);
 378         SET_TX_CHANNEL_FLAG(channel, fCTS, 0);
 379         SET_TX_CHANNEL_FLAG(channel, fCD, 0);
 380         SET_TX_CHANNEL_FLAG(channel, fRI, 0);
 381         SET_TX_CHANNEL_FLAG(channel, fHEAD, 0);
 382         SET_TX_CHANNEL_FLAG(channel, fTAIL, 0);
 383         SET_TX_CHANNEL_FLAG(channel, fSTATE, 1);
 384         SET_TX_CHANNEL_FLAG(channel, fBLOCKREADINTR, 1);
 385         SET_TX_CHANNEL_INFO(channel, head, 0);
 386         SET_RX_CHANNEL_INFO(channel, tail, 0);
 387
 388         qcom_smd_signal_channel(channel);
 389
 390         channel->state = SMD_CHANNEL_CLOSED;
 391         channel->pkt_size = 0;
 392 }
 393
 394 /*
 395  * Set the callback for a channel, with appropriate locking
 396  */
 397 static void qcom_smd_channel_set_callback(struct qcom_smd_channel *channel,
 398                                           rpmsg_rx_cb_t cb)
 399 {
 400         struct rpmsg_endpoint *ept = &channel->qsept->ept;
 401         unsigned long flags;
 402
 403         spin_lock_irqsave(&channel->recv_lock, flags);
 404         ept->cb = cb;
 405         spin_unlock_irqrestore(&channel->recv_lock, flags);
 406 };
 407
 408 /*
 409  * Calculate the amount of data available in the rx fifo
 410  */
 411 static size_t qcom_smd_channel_get_rx_avail(struct qcom_smd_channel *channel)
 412 {
 413         unsigned head;
 414         unsigned tail;
 415
 416         head = GET_RX_CHANNEL_INFO(channel, head);
 417         tail = GET_RX_CHANNEL_INFO(channel, tail);
 418
 419         return (head - tail) & (channel->fifo_size - 1);
 420 }
 421
 422 /*
 423  * Set tx channel state and inform the remote processor
 424  */
 425 static void qcom_smd_channel_set_state(struct qcom_smd_channel *channel,
 426                                        int state)
 427 {
 428         struct qcom_smd_edge *edge = channel->edge;
 429         bool is_open = state == SMD_CHANNEL_OPENED;
 430
 431         if (channel->state == state)
 432                 return;
 433
 434         dev_dbg(&edge->dev, "set_state(%s, %d)\n", channel->name, state);
 435
 436         SET_TX_CHANNEL_FLAG(channel, fDSR, is_open);
 437         SET_TX_CHANNEL_FLAG(channel, fCTS, is_open);
 438         SET_TX_CHANNEL_FLAG(channel, fCD, is_open);
 439
 440         SET_TX_CHANNEL_INFO(channel, state, state);
 441         SET_TX_CHANNEL_FLAG(channel, fSTATE, 1);
 442
 443         channel->state = state;
 444         qcom_smd_signal_channel(channel);
 445 }
 446
 447 /*
 448  * Copy count bytes of data using 32bit accesses, if that's required.
 449  */
 450 static void smd_copy_to_fifo(void __iomem *dst,
 451                              const void *src,
 452                              size_t count,
 453                              bool word_aligned)
 454 {
 455         if (word_aligned) {
 456                 __iowrite32_copy(dst, src, count / sizeof(u32));
 457         } else {
 458                 memcpy_toio(dst, src, count);
 459         }
 460 }
 461
 462 /*
 463  * Copy count bytes of data using 32bit accesses, if that is required.
 464  */
 465 static void smd_copy_from_fifo(void *dst,
 466                                const void __iomem *src,
 467                                size_t count,
 468                                bool word_aligned)
 469 {
 470         if (word_aligned) {
 471                 __ioread32_copy(dst, src, count / sizeof(u32));
 472         } else {
 473                 memcpy_fromio(dst, src, count);
 474         }
 475 }
 476
 477 /*
 478  * Read count bytes of data from the rx fifo into buf, but don't advance the
 479  * tail.
 480  */
 481 static size_t qcom_smd_channel_peek(struct qcom_smd_channel *channel,
 482                                     void *buf, size_t count)
 483 {
 484         bool word_aligned;
 485         unsigned tail;
 486         size_t len;
 487
 488         word_aligned = channel->info_word;
 489         tail = GET_RX_CHANNEL_INFO(channel, tail);
 490
 491         len = min_t(size_t, count, channel->fifo_size - tail);
 492         if (len) {
 493                 smd_copy_from_fifo(buf,
 494                                    channel->rx_fifo + tail,
 495                                    len,
 496                                    word_aligned);
 497         }
 498
 499         if (len != count) {
 500                 smd_copy_from_fifo(buf + len,
 501                                    channel->rx_fifo,
 502                                    count - len,
 503                                    word_aligned);
 504         }
 505
 506         return count;
 507 }
 508
 509 /*
 510  * Advance the rx tail by count bytes.
 511  */
 512 static void qcom_smd_channel_advance(struct qcom_smd_channel *channel,
 513                                      size_t count)
 514 {
 515         unsigned tail;
 516
 517         tail = GET_RX_CHANNEL_INFO(channel, tail);
 518         tail += count;
 519         tail &= (channel->fifo_size - 1);
 520         SET_RX_CHANNEL_INFO(channel, tail, tail);
 521 }
 522
 523 /*
 524  * Read out a single packet from the rx fifo and deliver it to the device
 525  */
 526 static int qcom_smd_channel_recv_single(struct qcom_smd_channel *channel)
 527 {
 528         struct rpmsg_endpoint *ept = &channel->qsept->ept;
 529         unsigned tail;
 530         size_t len;
 531         void *ptr;
 532         int ret;
 533
 534         tail = GET_RX_CHANNEL_INFO(channel, tail);
 535
 536         /* Use bounce buffer if the data wraps */
 537         if (tail + channel->pkt_size >= channel->fifo_size) {
 538                 ptr = channel->bounce_buffer;
 539                 len = qcom_smd_channel_peek(channel, ptr, channel->pkt_size);
 540         } else {
 541                 ptr = channel->rx_fifo + tail;
 542                 len = channel->pkt_size;
 543         }
 544
 545         ret = ept->cb(ept->rpdev, ptr, len, ept->priv, RPMSG_ADDR_ANY);
 546         if (ret < 0)
 547                 return ret;
 548
 549         /* Only forward the tail if the client consumed the data */
 550         qcom_smd_channel_advance(channel, len);
 551
 552         channel->pkt_size = 0;
 553
 554         return 0;
 555 }
 556
 557 /*
 558  * Per channel interrupt handling
 559  */
 560 static bool qcom_smd_channel_intr(struct qcom_smd_channel *channel)
 561 {
 562         bool need_state_scan = false;
 563         int remote_state;
 564         __le32 pktlen;
 565         int avail;
 566         int ret;
 567
 568         /* Handle state changes */
 569         remote_state = GET_RX_CHANNEL_INFO(channel, state);
 570         if (remote_state != channel->remote_state) {
 571                 channel->remote_state = remote_state;
 572                 need_state_scan = true;
 573         }
 574         /* Indicate that we have seen any state change */
 575         SET_RX_CHANNEL_FLAG(channel, fSTATE, 0);
 576
 577         /* Signal waiting qcom_smd_send() about the interrupt */
 578         if (!GET_TX_CHANNEL_FLAG(channel, fBLOCKREADINTR))
 579                 wake_up_interruptible(&channel->fblockread_event);
 580
 581         /* Don't consume any data until we've opened the channel */
 582         if (channel->state != SMD_CHANNEL_OPENED)
 583                 goto out;
 584
 585         /* Indicate that we've seen the new data */
 586         SET_RX_CHANNEL_FLAG(channel, fHEAD, 0);
 587
 588         /* Consume data */
 589         for (;;) {
 590                 avail = qcom_smd_channel_get_rx_avail(channel);
 591
 592                 if (!channel->pkt_size && avail >= SMD_PACKET_HEADER_LEN) {
 593                         qcom_smd_channel_peek(channel, &pktlen, sizeof(pktlen));
 594                         qcom_smd_channel_advance(channel, SMD_PACKET_HEADER_LEN);
 595                         channel->pkt_size = le32_to_cpu(pktlen);
 596                 } else if (channel->pkt_size && avail >= channel->pkt_size) {
 597                         ret = qcom_smd_channel_recv_single(channel);
 598                         if (ret)
 599                                 break;
 600                 } else {
 601                         break;
 602                 }
 603         }
 604
 605         /* Indicate that we have seen and updated tail */
 606         SET_RX_CHANNEL_FLAG(channel, fTAIL, 1);
 607
 608         /* Signal the remote that we've consumed the data (if requested) */
 609         if (!GET_RX_CHANNEL_FLAG(channel, fBLOCKREADINTR)) {
 610                 /* Ensure ordering of channel info updates */
 611                 wmb();
 612
 613                 qcom_smd_signal_channel(channel);
 614         }
 615
 616 out:
 617         return need_state_scan;
 618 }
 619
 620 /*
 621  * The edge interrupts are triggered by the remote processor on state changes,
 622  * channel info updates or when new channels are created.
 623  */
 624 static irqreturn_t qcom_smd_edge_intr(int irq, void *data)
 625 {
 626         struct qcom_smd_edge *edge = data;
 627         struct qcom_smd_channel *channel;
 628         unsigned available;
 629         bool kick_scanner = false;
 630         bool kick_state = false;
 631
 632         /*
 633          * Handle state changes or data on each of the channels on this edge
 634          */
 635         spin_lock(&edge->channels_lock);
 636         list_for_each_entry(channel, &edge->channels, list) {
 637                 spin_lock(&channel->recv_lock);
 638                 kick_state |= qcom_smd_channel_intr(channel);
 639                 spin_unlock(&channel->recv_lock);
 640         }
 641         spin_unlock(&edge->channels_lock);
 642
 643         /*
 644          * Creating a new channel requires allocating an smem entry, so we only
 645          * have to scan if the amount of available space in smem have changed
 646          * since last scan.
 647          */
 648         available = qcom_smem_get_free_space(edge->remote_pid);
 649         if (available != edge->smem_available) {
 650                 edge->smem_available = available;
 651                 kick_scanner = true;
 652         }
 653
 654         if (kick_scanner)
 655                 schedule_work(&edge->scan_work);
 656         if (kick_state)
 657                 schedule_work(&edge->state_work);
 658
 659         return IRQ_HANDLED;
 660 }
 661
 662 /*
 663  * Calculate how much space is available in the tx fifo.
 664  */
 665 static size_t qcom_smd_get_tx_avail(struct qcom_smd_channel *channel)
 666 {
 667         unsigned head;
 668         unsigned tail;
 669         unsigned mask = channel->fifo_size - 1;
 670
 671         head = GET_TX_CHANNEL_INFO(channel, head);
 672         tail = GET_TX_CHANNEL_INFO(channel, tail);
 673
 674         return mask - ((head - tail) & mask);
 675 }
 676
 677 /*
 678  * Write count bytes of data into channel, possibly wrapping in the ring buffer
 679  */
 680 static int qcom_smd_write_fifo(struct qcom_smd_channel *channel,
 681                                const void *data,
 682                                size_t count)
 683 {
 684         bool word_aligned;
 685         unsigned head;
 686         size_t len;
 687
 688         word_aligned = channel->info_word;
 689         head = GET_TX_CHANNEL_INFO(channel, head);
 690
 691         len = min_t(size_t, count, channel->fifo_size - head);
 692         if (len) {
 693                 smd_copy_to_fifo(channel->tx_fifo + head,
 694                                  data,
 695                                  len,
 696                                  word_aligned);
 697         }
 698
 699         if (len != count) {
 700                 smd_copy_to_fifo(channel->tx_fifo,
 701                                  data + len,
 702                                  count - len,
 703                                  word_aligned);
 704         }
 705
 706         head += count;
 707         head &= (channel->fifo_size - 1);
 708         SET_TX_CHANNEL_INFO(channel, head, head);
 709
 710         return count;
 711 }
 712
 713 /**
 714  * qcom_smd_send - write data to smd channel
 715  * @channel:    channel handle
 716  * @data:       buffer of data to write
 717  * @len:        number of bytes to write
 718  *
 719  * This is a blocking write of len bytes into the channel's tx ring buffer and
 720  * signal the remote end. It will sleep until there is enough space available
 721  * in the tx buffer, utilizing the fBLOCKREADINTR signaling mechanism to avoid
 722  * polling.
 723  */
 724 static int __qcom_smd_send(struct qcom_smd_channel *channel, const void *data,
 725                            int len, bool wait)
 726 {
 727         __le32 hdr[5] = { cpu_to_le32(len), };
 728         int tlen = sizeof(hdr) + len;
 729         int ret;
 730
 731         /* Word aligned channels only accept word size aligned data */
 732         if (channel->info_word && len % 4)
 733                 return -EINVAL;
 734
 735         /* Reject packets that are too big */
 736         if (tlen >= channel->fifo_size)
 737                 return -EINVAL;
 738
 739         ret = mutex_lock_interruptible(&channel->tx_lock);
 740         if (ret)
 741                 return ret;
 742
 743         while (qcom_smd_get_tx_avail(channel) < tlen) {
 744                 if (!wait) {
 745                         ret = -EAGAIN;
 746                         goto out;
 747                 }
 748
 749                 if (channel->state != SMD_CHANNEL_OPENED) {
 750                         ret = -EPIPE;
 751                         goto out;
 752                 }
 753
 754                 SET_TX_CHANNEL_FLAG(channel, fBLOCKREADINTR, 0);
 755
 756                 ret = wait_event_interruptible(channel->fblockread_event,
 757                                        qcom_smd_get_tx_avail(channel) >= tlen ||
 758                                        channel->state != SMD_CHANNEL_OPENED);
 759                 if (ret)
 760                         goto out;
 761
 762                 SET_TX_CHANNEL_FLAG(channel, fBLOCKREADINTR, 1);
 763         }
 764
 765         SET_TX_CHANNEL_FLAG(channel, fTAIL, 0);
 766
 767         qcom_smd_write_fifo(channel, hdr, sizeof(hdr));
 768         qcom_smd_write_fifo(channel, data, len);
 769
 770         SET_TX_CHANNEL_FLAG(channel, fHEAD, 1);
 771
 772         /* Ensure ordering of channel info updates */
 773         wmb();
 774
 775         qcom_smd_signal_channel(channel);
 776
 777 out:
 778         mutex_unlock(&channel->tx_lock);
 779
 780         return ret;
 781 }
 782
 783 /*
 784  * Helper for opening a channel
 785  */
 786 static int qcom_smd_channel_open(struct qcom_smd_channel *channel,
 787                                  rpmsg_rx_cb_t cb)
 788 {
 789         size_t bb_size;
 790
 791         /*
 792          * Packets are maximum 4k, but reduce if the fifo is smaller
 793          */
 794         bb_size = min(channel->fifo_size, SZ_4K);
 795         channel->bounce_buffer = kmalloc(bb_size, GFP_KERNEL);
 796         if (!channel->bounce_buffer)
 797                 return -ENOMEM;
 798
 799         qcom_smd_channel_set_callback(channel, cb);
 800         qcom_smd_channel_set_state(channel, SMD_CHANNEL_OPENING);
 801         qcom_smd_channel_set_state(channel, SMD_CHANNEL_OPENED);
 802
 803         return 0;
 804 }
 805
 806 /*
 807  * Helper for closing and resetting a channel
 808  */
 809 static void qcom_smd_channel_close(struct qcom_smd_channel *channel)
 810 {
 811         qcom_smd_channel_set_callback(channel, NULL);
 812
 813         kfree(channel->bounce_buffer);
 814         channel->bounce_buffer = NULL;
 815
 816         qcom_smd_channel_set_state(channel, SMD_CHANNEL_CLOSED);
 817         qcom_smd_channel_reset(channel);
 818 }
 819
 820 static struct qcom_smd_channel *
 821 qcom_smd_find_channel(struct qcom_smd_edge *edge, const char *name)
 822 {
 823         struct qcom_smd_channel *channel;
 824         struct qcom_smd_channel *ret = NULL;
 825         unsigned long flags;
 826
 827         spin_lock_irqsave(&edge->channels_lock, flags);
 828         list_for_each_entry(channel, &edge->channels, list) {
 829                 if (!strcmp(channel->name, name)) {
 830                         ret = channel;
 831                         break;
 832                 }
 833         }
 834         spin_unlock_irqrestore(&edge->channels_lock, flags);
 835
 836         return ret;
 837 }
 838
 839 static void __ept_release(struct kref *kref)
 840 {
 841         struct rpmsg_endpoint *ept = container_of(kref, struct rpmsg_endpoint,
 842                                                   refcount);
 843         kfree(to_smd_endpoint(ept));
 844 }
 845
 846 static struct rpmsg_endpoint *qcom_smd_create_ept(struct rpmsg_device *rpdev,
 847                                                   rpmsg_rx_cb_t cb, void *priv,
 848                                                   struct rpmsg_channel_info chinfo)
 849 {
 850         struct qcom_smd_endpoint *qsept;
 851         struct qcom_smd_channel *channel;
 852         struct qcom_smd_device *qsdev = to_smd_device(rpdev);
 853         struct qcom_smd_edge *edge = qsdev->edge;
 854         struct rpmsg_endpoint *ept;
 855         const char *name = chinfo.name;
 856         int ret;
 857
 858         /* Wait up to HZ for the channel to appear */
 859         ret = wait_event_interruptible_timeout(edge->new_channel_event,
 860                         (channel = qcom_smd_find_channel(edge, name)) != NULL,
 861                         HZ);
 862         if (!ret)
 863                 return NULL;
 864
 865         if (channel->state != SMD_CHANNEL_CLOSED) {
 866                 dev_err(&rpdev->dev, "channel %s is busy\n", channel->name);
 867                 return NULL;
 868         }
 869
 870         qsept = kzalloc(sizeof(*qsept), GFP_KERNEL);
 871         if (!qsept)
 872                 return NULL;
 873
 874         ept = &qsept->ept;
 875
 876         kref_init(&ept->refcount);
 877
 878         ept->rpdev = rpdev;
 879         ept->cb = cb;
 880         ept->priv = priv;
 881         ept->ops = &qcom_smd_endpoint_ops;
 882
 883         channel->qsept = qsept;
 884         qsept->qsch = channel;
 885
 886         ret = qcom_smd_channel_open(channel, cb);
 887         if (ret)
 888                 goto free_ept;
 889
 890         return ept;
 891
 892 free_ept:
 893         channel->qsept = NULL;
 894         kref_put(&ept->refcount, __ept_release);
 895         return NULL;
 896 }
 897
 898 static void qcom_smd_destroy_ept(struct rpmsg_endpoint *ept)
 899 {
 900         struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
 901         struct qcom_smd_channel *ch = qsept->qsch;
 902
 903         qcom_smd_channel_close(ch);
 904         ch->qsept = NULL;
 905         kref_put(&ept->refcount, __ept_release);
 906 }
 907
 908 static int qcom_smd_send(struct rpmsg_endpoint *ept, void *data, int len)
 909 {
 910         struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
 911
 912         return __qcom_smd_send(qsept->qsch, data, len, true);
 913 }
 914
 915 static int qcom_smd_trysend(struct rpmsg_endpoint *ept, void *data, int len)
 916 {
 917         struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
 918
 919         return __qcom_smd_send(qsept->qsch, data, len, false);
 920 }
 921
 922 static __poll_t qcom_smd_poll(struct rpmsg_endpoint *ept,
 923                                   struct file *filp, poll_table *wait)
 924 {
 925         struct qcom_smd_endpoint *qsept = to_smd_endpoint(ept);
 926         struct qcom_smd_channel *channel = qsept->qsch;
 927         __poll_t mask = 0;
 928
 929         poll_wait(filp, &channel->fblockread_event, wait);
 930
 931         if (qcom_smd_get_tx_avail(channel) > 20)
 932                 mask |= POLLOUT | POLLWRNORM;
 933
 934         return mask;
 935 }
 936
 937 /*
 938  * Finds the device_node for the smd child interested in this channel.
 939  */
 940 static struct device_node *qcom_smd_match_channel(struct device_node *edge_node,
 941                                                   const char *channel)
 942 {
 943         struct device_node *child;
 944         const char *name;
 945         const char *key;
 946         int ret;
 947
 948         for_each_available_child_of_node(edge_node, child) {
 949                 key = "qcom,smd-channels";
 950                 ret = of_property_read_string(child, key, &name);
 951                 if (ret)
 952                         continue;
 953
 954                 if (strcmp(name, channel) == 0)
 955                         return child;
 956         }
 957
 958         return NULL;
 959 }
 960
 961 static const struct rpmsg_device_ops qcom_smd_device_ops = {
 962         .create_ept = qcom_smd_create_ept,
 963 };
 964
 965 static const struct rpmsg_endpoint_ops qcom_smd_endpoint_ops = {
 966         .destroy_ept = qcom_smd_destroy_ept,
 967         .send = qcom_smd_send,
 968         .trysend = qcom_smd_trysend,
 969         .poll = qcom_smd_poll,
 970 };
 971
 972 static void qcom_smd_release_device(struct device *dev)
 973 {
 974         struct rpmsg_device *rpdev = to_rpmsg_device(dev);
 975         struct qcom_smd_device *qsdev = to_smd_device(rpdev);
 976
 977         kfree(qsdev);
 978 }
 979
 980 /*
 981  * Create a smd client device for channel that is being opened.
 982  */
 983 static int qcom_smd_create_device(struct qcom_smd_channel *channel)
 984 {
 985         struct qcom_smd_device *qsdev;
 986         struct rpmsg_device *rpdev;
 987         struct qcom_smd_edge *edge = channel->edge;
 988
 989         dev_dbg(&edge->dev, "registering '%s'\n", channel->name);
 990
 991         qsdev = kzalloc(sizeof(*qsdev), GFP_KERNEL);
 992         if (!qsdev)
 993                 return -ENOMEM;
 994
 995         /* Link qsdev to our SMD edge */
 996         qsdev->edge = edge;
 997
 998         /* Assign callbacks for rpmsg_device */
 999         qsdev->rpdev.ops = &qcom_smd_device_ops;
1000
1001         /* Assign public information to the rpmsg_device */
1002         rpdev = &qsdev->rpdev;
1003         strncpy(rpdev->id.name, channel->name, RPMSG_NAME_SIZE);
1004         rpdev->src = RPMSG_ADDR_ANY;
1005         rpdev->dst = RPMSG_ADDR_ANY;
1006
1007         rpdev->dev.of_node = qcom_smd_match_channel(edge->of_node, channel->name);
1008         rpdev->dev.parent = &edge->dev;
1009         rpdev->dev.release = qcom_smd_release_device;
1010
1011         return rpmsg_register_device(rpdev);
1012 }
1013
1014 static int qcom_smd_create_chrdev(struct qcom_smd_edge *edge)
1015 {
1016         struct qcom_smd_device *qsdev;
1017
1018         qsdev = kzalloc(sizeof(*qsdev), GFP_KERNEL);
1019         if (!qsdev)
1020                 return -ENOMEM;
1021
1022         qsdev->edge = edge;
1023         qsdev->rpdev.ops = &qcom_smd_device_ops;
1024         qsdev->rpdev.dev.parent = &edge->dev;
1025         qsdev->rpdev.dev.release = qcom_smd_release_device;
1026
1027         return rpmsg_chrdev_register_device(&qsdev->rpdev);
1028 }
1029
1030 /*
1031  * Allocate the qcom_smd_channel object for a newly found smd channel,
1032  * retrieving and validating the smem items involved.
1033  */
1034 static struct qcom_smd_channel *qcom_smd_create_channel(struct qcom_smd_edge *edge,
1035                                                         unsigned smem_info_item,
1036                                                         unsigned smem_fifo_item,
1037                                                         char *name)
1038 {
1039         struct qcom_smd_channel *channel;
1040         size_t fifo_size;
1041         size_t info_size;
1042         void *fifo_base;
1043         void *info;
1044         int ret;
1045
1046         channel = devm_kzalloc(&edge->dev, sizeof(*channel), GFP_KERNEL);
1047         if (!channel)
1048                 return ERR_PTR(-ENOMEM);
1049
1050         channel->edge = edge;
1051         channel->name = devm_kstrdup(&edge->dev, name, GFP_KERNEL);
1052         if (!channel->name)
1053                 return ERR_PTR(-ENOMEM);
1054
1055         mutex_init(&channel->tx_lock);
1056         spin_lock_init(&channel->recv_lock);
1057         init_waitqueue_head(&channel->fblockread_event);
1058
1059         info = qcom_smem_get(edge->remote_pid, smem_info_item, &info_size);
1060         if (IS_ERR(info)) {
1061                 ret = PTR_ERR(info);
1062                 goto free_name_and_channel;
1063         }
1064
1065         /*
1066          * Use the size of the item to figure out which channel info struct to
1067          * use.
1068          */
1069         if (info_size == 2 * sizeof(struct smd_channel_info_word)) {
1070                 channel->info_word = info;
1071         } else if (info_size == 2 * sizeof(struct smd_channel_info)) {
1072                 channel->info = info;
1073         } else {
1074                 dev_err(&edge->dev,
1075                         "channel info of size %zu not supported\n", info_size);
1076                 ret = -EINVAL;
1077                 goto free_name_and_channel;
1078         }
1079
1080         fifo_base = qcom_smem_get(edge->remote_pid, smem_fifo_item, &fifo_size);
1081         if (IS_ERR(fifo_base)) {
1082                 ret =  PTR_ERR(fifo_base);
1083                 goto free_name_and_channel;
1084         }
1085
1086         /* The channel consist of a rx and tx fifo of equal size */
1087         fifo_size /= 2;
1088
1089         dev_dbg(&edge->dev, "new channel '%s' info-size: %zu fifo-size: %zu\n",
1090                           name, info_size, fifo_size);
1091
1092         channel->tx_fifo = fifo_base;
1093         channel->rx_fifo = fifo_base + fifo_size;
1094         channel->fifo_size = fifo_size;
1095
1096         qcom_smd_channel_reset(channel);
1097
1098         return channel;
1099
1100 free_name_and_channel:
1101         devm_kfree(&edge->dev, channel->name);
1102         devm_kfree(&edge->dev, channel);
1103
1104         return ERR_PTR(ret);
1105 }
1106
1107 /*
1108  * Scans the allocation table for any newly allocated channels, calls
1109  * qcom_smd_create_channel() to create representations of these and add
1110  * them to the edge's list of channels.
1111  */
1112 static void qcom_channel_scan_worker(struct work_struct *work)
1113 {
1114         struct qcom_smd_edge *edge = container_of(work, struct qcom_smd_edge, scan_work);
1115         struct qcom_smd_alloc_entry *alloc_tbl;
1116         struct qcom_smd_alloc_entry *entry;
1117         struct qcom_smd_channel *channel;
1118         unsigned long flags;
1119         unsigned fifo_id;
1120         unsigned info_id;
1121         int tbl;
1122         int i;
1123         u32 eflags, cid;
1124
1125         for (tbl = 0; tbl < SMD_ALLOC_TBL_COUNT; tbl++) {
1126                 alloc_tbl = qcom_smem_get(edge->remote_pid,
1127                                     smem_items[tbl].alloc_tbl_id, NULL);
1128                 if (IS_ERR(alloc_tbl))
1129                         continue;
1130
1131                 for (i = 0; i < SMD_ALLOC_TBL_SIZE; i++) {
1132                         entry = &alloc_tbl[i];
1133                         eflags = le32_to_cpu(entry->flags);
1134                         if (test_bit(i, edge->allocated[tbl]))
1135                                 continue;
1136
1137                         if (entry->ref_count == 0)
1138                                 continue;
1139
1140                         if (!entry->name[0])
1141                                 continue;
1142
1143                         if (!(eflags & SMD_CHANNEL_FLAGS_PACKET))
1144                                 continue;
1145
1146                         if ((eflags & SMD_CHANNEL_FLAGS_EDGE_MASK) != edge->edge_id)
1147                                 continue;
1148
1149                         cid = le32_to_cpu(entry->cid);
1150                         info_id = smem_items[tbl].info_base_id + cid;
1151                         fifo_id = smem_items[tbl].fifo_base_id + cid;
1152
1153                         channel = qcom_smd_create_channel(edge, info_id, fifo_id, entry->name);
1154                         if (IS_ERR(channel))
1155                                 continue;
1156
1157                         spin_lock_irqsave(&edge->channels_lock, flags);
1158                         list_add(&channel->list, &edge->channels);
1159                         spin_unlock_irqrestore(&edge->channels_lock, flags);
1160
1161                         dev_dbg(&edge->dev, "new channel found: '%s'\n", channel->name);
1162                         set_bit(i, edge->allocated[tbl]);
1163
1164                         wake_up_interruptible(&edge->new_channel_event);
1165                 }
1166         }
1167
1168         schedule_work(&edge->state_work);
1169 }
1170
1171 /*
1172  * This per edge worker scans smem for any new channels and register these. It
1173  * then scans all registered channels for state changes that should be handled
1174  * by creating or destroying smd client devices for the registered channels.
1175  *
1176  * LOCKING: edge->channels_lock only needs to cover the list operations, as the
1177  * worker is killed before any channels are deallocated
1178  */
1179 static void qcom_channel_state_worker(struct work_struct *work)
1180 {
1181         struct qcom_smd_channel *channel;
1182         struct qcom_smd_edge *edge = container_of(work,
1183                                                   struct qcom_smd_edge,
1184                                                   state_work);
1185         struct rpmsg_channel_info chinfo;
1186         unsigned remote_state;
1187         unsigned long flags;
1188
1189         /*
1190          * Register a device for any closed channel where the remote processor
1191          * is showing interest in opening the channel.
1192          */
1193         spin_lock_irqsave(&edge->channels_lock, flags);
1194         list_for_each_entry(channel, &edge->channels, list) {
1195                 if (channel->state != SMD_CHANNEL_CLOSED)
1196                         continue;
1197
1198                 remote_state = GET_RX_CHANNEL_INFO(channel, state);
1199                 if (remote_state != SMD_CHANNEL_OPENING &&
1200                     remote_state != SMD_CHANNEL_OPENED)
1201                         continue;
1202
1203                 if (channel->registered)
1204                         continue;
1205
1206                 spin_unlock_irqrestore(&edge->channels_lock, flags);
1207                 qcom_smd_create_device(channel);
1208                 channel->registered = true;
1209                 spin_lock_irqsave(&edge->channels_lock, flags);
1210
1211                 channel->registered = true;
1212         }
1213
1214         /*
1215          * Unregister the device for any channel that is opened where the
1216          * remote processor is closing the channel.
1217          */
1218         list_for_each_entry(channel, &edge->channels, list) {
1219                 if (channel->state != SMD_CHANNEL_OPENING &&
1220                     channel->state != SMD_CHANNEL_OPENED)
1221                         continue;
1222
1223                 remote_state = GET_RX_CHANNEL_INFO(channel, state);
1224                 if (remote_state == SMD_CHANNEL_OPENING ||
1225                     remote_state == SMD_CHANNEL_OPENED)
1226                         continue;
1227
1228                 spin_unlock_irqrestore(&edge->channels_lock, flags);
1229
1230                 strncpy(chinfo.name, channel->name, sizeof(chinfo.name));
1231                 chinfo.src = RPMSG_ADDR_ANY;
1232                 chinfo.dst = RPMSG_ADDR_ANY;
1233                 rpmsg_unregister_device(&edge->dev, &chinfo);
1234                 channel->registered = false;
1235                 spin_lock_irqsave(&edge->channels_lock, flags);
1236         }
1237         spin_unlock_irqrestore(&edge->channels_lock, flags);
1238 }
1239
1240 /*
1241  * Parses an of_node describing an edge.
1242  */
1243 static int qcom_smd_parse_edge(struct device *dev,
1244                                struct device_node *node,
1245                                struct qcom_smd_edge *edge)
1246 {
1247         struct device_node *syscon_np;
1248         const char *key;
1249         int irq;
1250         int ret;
1251
1252         INIT_LIST_HEAD(&edge->channels);
1253         spin_lock_init(&edge->channels_lock);
1254
1255         INIT_WORK(&edge->scan_work, qcom_channel_scan_worker);
1256         INIT_WORK(&edge->state_work, qcom_channel_state_worker);
1257
1258         edge->of_node = of_node_get(node);
1259
1260         key = "qcom,smd-edge";
1261         ret = of_property_read_u32(node, key, &edge->edge_id);
1262         if (ret) {
1263                 dev_err(dev, "edge missing %s property\n", key);
1264                 return -EINVAL;
1265         }
1266
1267         edge->remote_pid = QCOM_SMEM_HOST_ANY;
1268         key = "qcom,remote-pid";
1269         of_property_read_u32(node, key, &edge->remote_pid);
1270
1271         syscon_np = of_parse_phandle(node, "qcom,ipc", 0);
1272         if (!syscon_np) {
1273                 dev_err(dev, "no qcom,ipc node\n");
1274                 return -ENODEV;
1275         }
1276
1277         edge->ipc_regmap = syscon_node_to_regmap(syscon_np);
1278         if (IS_ERR(edge->ipc_regmap))
1279                 return PTR_ERR(edge->ipc_regmap);
1280
1281         key = "qcom,ipc";
1282         ret = of_property_read_u32_index(node, key, 1, &edge->ipc_offset);
1283         if (ret < 0) {
1284                 dev_err(dev, "no offset in %s\n", key);
1285                 return -EINVAL;
1286         }
1287
1288         ret = of_property_read_u32_index(node, key, 2, &edge->ipc_bit);
1289         if (ret < 0) {
1290                 dev_err(dev, "no bit in %s\n", key);
1291                 return -EINVAL;
1292         }
1293
1294         ret = of_property_read_string(node, "label", &edge->name);
1295         if (ret < 0)
1296                 edge->name = node->name;
1297
1298         irq = irq_of_parse_and_map(node, 0);
1299         if (irq < 0) {
1300                 dev_err(dev, "required smd interrupt missing\n");
1301                 return -EINVAL;
1302         }
1303
1304         ret = devm_request_irq(dev, irq,
1305                                qcom_smd_edge_intr, IRQF_TRIGGER_RISING,
1306                                node->name, edge);
1307         if (ret) {
1308                 dev_err(dev, "failed to request smd irq\n");
1309                 return ret;
1310         }
1311
1312         edge->irq = irq;
1313
1314         return 0;
1315 }
1316
1317 /*
1318  * Release function for an edge.
1319   * Reset the state of each associated channel and free the edge context.
1320  */
1321 static void qcom_smd_edge_release(struct device *dev)
1322 {
1323         struct qcom_smd_channel *channel;
1324         struct qcom_smd_edge *edge = to_smd_edge(dev);
1325
1326         list_for_each_entry(channel, &edge->channels, list) {
1327                 SET_RX_CHANNEL_INFO(channel, state, SMD_CHANNEL_CLOSED);
1328                 SET_RX_CHANNEL_INFO(channel, head, 0);
1329                 SET_RX_CHANNEL_INFO(channel, tail, 0);
1330         }
1331
1332         kfree(edge);
1333 }
1334
1335 static ssize_t rpmsg_name_show(struct device *dev,
1336                                struct device_attribute *attr, char *buf)
1337 {
1338         struct qcom_smd_edge *edge = to_smd_edge(dev);
1339
1340         return sprintf(buf, "%s\n", edge->name);
1341 }
1342 static DEVICE_ATTR_RO(rpmsg_name);
1343
1344 static struct attribute *qcom_smd_edge_attrs[] = {
1345         &dev_attr_rpmsg_name.attr,
1346         NULL
1347 };
1348 ATTRIBUTE_GROUPS(qcom_smd_edge);
1349
1350 /**
1351  * qcom_smd_register_edge() - register an edge based on an device_node
1352  * @parent:    parent device for the edge
1353  * @node:      device_node describing the edge
1354  *
1355  * Returns an edge reference, or negative ERR_PTR() on failure.
1356  */
1357 struct qcom_smd_edge *qcom_smd_register_edge(struct device *parent,
1358                                              struct device_node *node)
1359 {
1360         struct qcom_smd_edge *edge;
1361         int ret;
1362
1363         edge = kzalloc(sizeof(*edge), GFP_KERNEL);
1364         if (!edge)
1365                 return ERR_PTR(-ENOMEM);
1366
1367         init_waitqueue_head(&edge->new_channel_event);
1368
1369         edge->dev.parent = parent;
1370         edge->dev.release = qcom_smd_edge_release;
1371         edge->dev.of_node = node;
1372         edge->dev.groups = qcom_smd_edge_groups;
1373         dev_set_name(&edge->dev, "%s:%s", dev_name(parent), node->name);
1374         ret = device_register(&edge->dev);
1375         if (ret) {
1376                 pr_err("failed to register smd edge\n");
1377                 return ERR_PTR(ret);
1378         }
1379
1380         ret = qcom_smd_parse_edge(&edge->dev, node, edge);
1381         if (ret) {
1382                 dev_err(&edge->dev, "failed to parse smd edge\n");
1383                 goto unregister_dev;
1384         }
1385
1386         ret = qcom_smd_create_chrdev(edge);
1387         if (ret) {
1388                 dev_err(&edge->dev, "failed to register chrdev for edge\n");
1389                 goto unregister_dev;
1390         }
1391
1392         schedule_work(&edge->scan_work);
1393
1394         return edge;
1395
1396 unregister_dev:
1397         put_device(&edge->dev);
1398         return ERR_PTR(ret);
1399 }
1400 EXPORT_SYMBOL(qcom_smd_register_edge);
1401
1402 static int qcom_smd_remove_device(struct device *dev, void *data)
1403 {
1404         device_unregister(dev);
1405
1406         return 0;
1407 }
1408
1409 /**
1410  * qcom_smd_unregister_edge() - release an edge and its children
1411  * @edge:      edge reference acquired from qcom_smd_register_edge
1412  */
1413 int qcom_smd_unregister_edge(struct qcom_smd_edge *edge)
1414 {
1415         int ret;
1416
1417         disable_irq(edge->irq);
1418         cancel_work_sync(&edge->scan_work);
1419         cancel_work_sync(&edge->state_work);
1420
1421         ret = device_for_each_child(&edge->dev, NULL, qcom_smd_remove_device);
1422         if (ret)
1423                 dev_warn(&edge->dev, "can't remove smd device: %d\n", ret);
1424
1425         device_unregister(&edge->dev);
1426
1427         return 0;
1428 }
1429 EXPORT_SYMBOL(qcom_smd_unregister_edge);
1430
1431 static int qcom_smd_probe(struct platform_device *pdev)
1432 {
1433         struct device_node *node;
1434         void *p;
1435
1436         /* Wait for smem */
1437         p = qcom_smem_get(QCOM_SMEM_HOST_ANY, smem_items[0].alloc_tbl_id, NULL);
1438         if (PTR_ERR(p) == -EPROBE_DEFER)
1439                 return PTR_ERR(p);
1440
1441         for_each_available_child_of_node(pdev->dev.of_node, node)
1442                 qcom_smd_register_edge(&pdev->dev, node);
1443
1444         return 0;
1445 }
1446
1447 static int qcom_smd_remove_edge(struct device *dev, void *data)
1448 {
1449         struct qcom_smd_edge *edge = to_smd_edge(dev);
1450
1451         return qcom_smd_unregister_edge(edge);
1452 }
1453
1454 /*
1455  * Shut down all smd clients by making sure that each edge stops processing
1456  * events and scanning for new channels, then call destroy on the devices.
1457  */
1458 static int qcom_smd_remove(struct platform_device *pdev)
1459 {
1460         int ret;
1461
1462         ret = device_for_each_child(&pdev->dev, NULL, qcom_smd_remove_edge);
1463         if (ret)
1464                 dev_warn(&pdev->dev, "can't remove smd device: %d\n", ret);
1465
1466         return ret;
1467 }
1468
1469 static const struct of_device_id qcom_smd_of_match[] = {
1470         { .compatible = "qcom,smd" },
1471         {}
1472 };
1473 MODULE_DEVICE_TABLE(of, qcom_smd_of_match);
1474
1475 static struct platform_driver qcom_smd_driver = {
1476         .probe = qcom_smd_probe,
1477         .remove = qcom_smd_remove,
1478         .driver = {
1479                 .name = "qcom-smd",
1480                 .of_match_table = qcom_smd_of_match,
1481         },
1482 };
1483
1484 static int __init qcom_smd_init(void)
1485 {
1486         return platform_driver_register(&qcom_smd_driver);
1487 }
1488 subsys_initcall(qcom_smd_init);
1489
1490 static void __exit qcom_smd_exit(void)
1491 {
1492         platform_driver_unregister(&qcom_smd_driver);
1493 }
1494 module_exit(qcom_smd_exit);
1495
1496 MODULE_AUTHOR("Bjorn Andersson <bjorn.andersson@sonymobile.com>");
1497 MODULE_DESCRIPTION("Qualcomm Shared Memory Driver");
1498 MODULE_LICENSE("GPL v2");