]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blob - drivers/firmware/raspberrypi.c
firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()'
[mirror_ubuntu-jammy-kernel.git] / drivers / firmware / raspberrypi.c
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Defines interfaces for interacting with the Raspberry Pi firmware's
4 * property channel.
5 *
6 * Copyright © 2015 Broadcom
7 */
8
9 #include <linux/dma-mapping.h>
10 #include <linux/kref.h>
11 #include <linux/mailbox_client.h>
12 #include <linux/module.h>
13 #include <linux/of_platform.h>
14 #include <linux/platform_device.h>
15 #include <linux/slab.h>
16 #include <soc/bcm2835/raspberrypi-firmware.h>
17
18 #define MBOX_MSG(chan, data28) (((data28) & ~0xf) | ((chan) & 0xf))
19 #define MBOX_CHAN(msg) ((msg) & 0xf)
20 #define MBOX_DATA28(msg) ((msg) & ~0xf)
21 #define MBOX_CHAN_PROPERTY 8
22
23 static struct platform_device *rpi_hwmon;
24 static struct platform_device *rpi_clk;
25
26 struct rpi_firmware {
27 struct mbox_client cl;
28 struct mbox_chan *chan; /* The property channel. */
29 struct completion c;
30 u32 enabled;
31
32 struct kref consumers;
33 };
34
35 static DEFINE_MUTEX(transaction_lock);
36
37 static void response_callback(struct mbox_client *cl, void *msg)
38 {
39 struct rpi_firmware *fw = container_of(cl, struct rpi_firmware, cl);
40 complete(&fw->c);
41 }
42
43 /*
44 * Sends a request to the firmware through the BCM2835 mailbox driver,
45 * and synchronously waits for the reply.
46 */
47 static int
48 rpi_firmware_transaction(struct rpi_firmware *fw, u32 chan, u32 data)
49 {
50 u32 message = MBOX_MSG(chan, data);
51 int ret;
52
53 WARN_ON(data & 0xf);
54
55 mutex_lock(&transaction_lock);
56 reinit_completion(&fw->c);
57 ret = mbox_send_message(fw->chan, &message);
58 if (ret >= 0) {
59 if (wait_for_completion_timeout(&fw->c, HZ)) {
60 ret = 0;
61 } else {
62 ret = -ETIMEDOUT;
63 WARN_ONCE(1, "Firmware transaction timeout");
64 }
65 } else {
66 dev_err(fw->cl.dev, "mbox_send_message returned %d\n", ret);
67 }
68 mutex_unlock(&transaction_lock);
69
70 return ret;
71 }
72
73 /**
74 * rpi_firmware_property_list - Submit firmware property list
75 * @fw: Pointer to firmware structure from rpi_firmware_get().
76 * @data: Buffer holding tags.
77 * @tag_size: Size of tags buffer.
78 *
79 * Submits a set of concatenated tags to the VPU firmware through the
80 * mailbox property interface.
81 *
82 * The buffer header and the ending tag are added by this function and
83 * don't need to be supplied, just the actual tags for your operation.
84 * See struct rpi_firmware_property_tag_header for the per-tag
85 * structure.
86 */
87 int rpi_firmware_property_list(struct rpi_firmware *fw,
88 void *data, size_t tag_size)
89 {
90 size_t size = tag_size + 12;
91 u32 *buf;
92 dma_addr_t bus_addr;
93 int ret;
94
95 /* Packets are processed a dword at a time. */
96 if (size & 3)
97 return -EINVAL;
98
99 buf = dma_alloc_coherent(fw->cl.dev, PAGE_ALIGN(size), &bus_addr,
100 GFP_ATOMIC);
101 if (!buf)
102 return -ENOMEM;
103
104 /* The firmware will error out without parsing in this case. */
105 WARN_ON(size >= 1024 * 1024);
106
107 buf[0] = size;
108 buf[1] = RPI_FIRMWARE_STATUS_REQUEST;
109 memcpy(&buf[2], data, tag_size);
110 buf[size / 4 - 1] = RPI_FIRMWARE_PROPERTY_END;
111 wmb();
112
113 ret = rpi_firmware_transaction(fw, MBOX_CHAN_PROPERTY, bus_addr);
114
115 rmb();
116 memcpy(data, &buf[2], tag_size);
117 if (ret == 0 && buf[1] != RPI_FIRMWARE_STATUS_SUCCESS) {
118 /*
119 * The tag name here might not be the one causing the
120 * error, if there were multiple tags in the request.
121 * But single-tag is the most common, so go with it.
122 */
123 dev_err(fw->cl.dev, "Request 0x%08x returned status 0x%08x\n",
124 buf[2], buf[1]);
125 ret = -EINVAL;
126 }
127
128 dma_free_coherent(fw->cl.dev, PAGE_ALIGN(size), buf, bus_addr);
129
130 return ret;
131 }
132 EXPORT_SYMBOL_GPL(rpi_firmware_property_list);
133
134 /**
135 * rpi_firmware_property - Submit single firmware property
136 * @fw: Pointer to firmware structure from rpi_firmware_get().
137 * @tag: One of enum_mbox_property_tag.
138 * @tag_data: Tag data buffer.
139 * @buf_size: Buffer size.
140 *
141 * Submits a single tag to the VPU firmware through the mailbox
142 * property interface.
143 *
144 * This is a convenience wrapper around
145 * rpi_firmware_property_list() to avoid some of the
146 * boilerplate in property calls.
147 */
148 int rpi_firmware_property(struct rpi_firmware *fw,
149 u32 tag, void *tag_data, size_t buf_size)
150 {
151 struct rpi_firmware_property_tag_header *header;
152 int ret;
153
154 /* Some mailboxes can use over 1k bytes. Rather than checking
155 * size and using stack or kmalloc depending on requirements,
156 * just use kmalloc. Mailboxes don't get called enough to worry
157 * too much about the time taken in the allocation.
158 */
159 void *data = kmalloc(sizeof(*header) + buf_size, GFP_KERNEL);
160
161 if (!data)
162 return -ENOMEM;
163
164 header = data;
165 header->tag = tag;
166 header->buf_size = buf_size;
167 header->req_resp_size = 0;
168 memcpy(data + sizeof(*header), tag_data, buf_size);
169
170 ret = rpi_firmware_property_list(fw, data, buf_size + sizeof(*header));
171
172 memcpy(tag_data, data + sizeof(*header), buf_size);
173
174 kfree(data);
175
176 return ret;
177 }
178 EXPORT_SYMBOL_GPL(rpi_firmware_property);
179
180 static void
181 rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
182 {
183 time64_t date_and_time;
184 u32 packet;
185 int ret = rpi_firmware_property(fw,
186 RPI_FIRMWARE_GET_FIRMWARE_REVISION,
187 &packet, sizeof(packet));
188
189 if (ret)
190 return;
191
192 /* This is not compatible with y2038 */
193 date_and_time = packet;
194 dev_info(fw->cl.dev, "Attached to firmware from %ptT\n", &date_and_time);
195 }
196
197 static void
198 rpi_register_hwmon_driver(struct device *dev, struct rpi_firmware *fw)
199 {
200 u32 packet;
201 int ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_THROTTLED,
202 &packet, sizeof(packet));
203
204 if (ret)
205 return;
206
207 rpi_hwmon = platform_device_register_data(dev, "raspberrypi-hwmon",
208 -1, NULL, 0);
209 }
210
211 static void rpi_register_clk_driver(struct device *dev)
212 {
213 struct device_node *firmware;
214
215 /*
216 * Earlier DTs don't have a node for the firmware clocks but
217 * rely on us creating a platform device by hand. If we do
218 * have a node for the firmware clocks, just bail out here.
219 */
220 firmware = of_get_compatible_child(dev->of_node,
221 "raspberrypi,firmware-clocks");
222 if (firmware) {
223 of_node_put(firmware);
224 return;
225 }
226
227 rpi_clk = platform_device_register_data(dev, "raspberrypi-clk",
228 -1, NULL, 0);
229 }
230
231 static void rpi_firmware_delete(struct kref *kref)
232 {
233 struct rpi_firmware *fw = container_of(kref, struct rpi_firmware,
234 consumers);
235
236 mbox_free_channel(fw->chan);
237 kfree(fw);
238 }
239
240 void rpi_firmware_put(struct rpi_firmware *fw)
241 {
242 kref_put(&fw->consumers, rpi_firmware_delete);
243 }
244 EXPORT_SYMBOL_GPL(rpi_firmware_put);
245
246 static void devm_rpi_firmware_put(void *data)
247 {
248 struct rpi_firmware *fw = data;
249
250 rpi_firmware_put(fw);
251 }
252
253 static int rpi_firmware_probe(struct platform_device *pdev)
254 {
255 struct device *dev = &pdev->dev;
256 struct rpi_firmware *fw;
257
258 /*
259 * Memory will be freed by rpi_firmware_delete() once all users have
260 * released their firmware handles. Don't use devm_kzalloc() here.
261 */
262 fw = kzalloc(sizeof(*fw), GFP_KERNEL);
263 if (!fw)
264 return -ENOMEM;
265
266 fw->cl.dev = dev;
267 fw->cl.rx_callback = response_callback;
268 fw->cl.tx_block = true;
269
270 fw->chan = mbox_request_channel(&fw->cl, 0);
271 if (IS_ERR(fw->chan)) {
272 int ret = PTR_ERR(fw->chan);
273 if (ret != -EPROBE_DEFER)
274 dev_err(dev, "Failed to get mbox channel: %d\n", ret);
275 return ret;
276 }
277
278 init_completion(&fw->c);
279 kref_init(&fw->consumers);
280
281 platform_set_drvdata(pdev, fw);
282
283 rpi_firmware_print_firmware_revision(fw);
284 rpi_register_hwmon_driver(dev, fw);
285 rpi_register_clk_driver(dev);
286
287 return 0;
288 }
289
290 static void rpi_firmware_shutdown(struct platform_device *pdev)
291 {
292 struct rpi_firmware *fw = platform_get_drvdata(pdev);
293
294 if (!fw)
295 return;
296
297 rpi_firmware_property(fw, RPI_FIRMWARE_NOTIFY_REBOOT, NULL, 0);
298 }
299
300 static int rpi_firmware_remove(struct platform_device *pdev)
301 {
302 struct rpi_firmware *fw = platform_get_drvdata(pdev);
303
304 platform_device_unregister(rpi_hwmon);
305 rpi_hwmon = NULL;
306 platform_device_unregister(rpi_clk);
307 rpi_clk = NULL;
308
309 rpi_firmware_put(fw);
310
311 return 0;
312 }
313
314 /**
315 * rpi_firmware_get - Get pointer to rpi_firmware structure.
316 * @firmware_node: Pointer to the firmware Device Tree node.
317 *
318 * The reference to rpi_firmware has to be released with rpi_firmware_put().
319 *
320 * Returns NULL is the firmware device is not ready.
321 */
322 struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
323 {
324 struct platform_device *pdev = of_find_device_by_node(firmware_node);
325 struct rpi_firmware *fw;
326
327 if (!pdev)
328 return NULL;
329
330 fw = platform_get_drvdata(pdev);
331 if (!fw)
332 goto err_put_device;
333
334 if (!kref_get_unless_zero(&fw->consumers))
335 goto err_put_device;
336
337 put_device(&pdev->dev);
338
339 return fw;
340
341 err_put_device:
342 put_device(&pdev->dev);
343 return NULL;
344 }
345 EXPORT_SYMBOL_GPL(rpi_firmware_get);
346
347 /**
348 * devm_rpi_firmware_get - Get pointer to rpi_firmware structure.
349 * @firmware_node: Pointer to the firmware Device Tree node.
350 *
351 * Returns NULL is the firmware device is not ready.
352 */
353 struct rpi_firmware *devm_rpi_firmware_get(struct device *dev,
354 struct device_node *firmware_node)
355 {
356 struct rpi_firmware *fw;
357
358 fw = rpi_firmware_get(firmware_node);
359 if (!fw)
360 return NULL;
361
362 if (devm_add_action_or_reset(dev, devm_rpi_firmware_put, fw))
363 return NULL;
364
365 return fw;
366 }
367 EXPORT_SYMBOL_GPL(devm_rpi_firmware_get);
368
369 static const struct of_device_id rpi_firmware_of_match[] = {
370 { .compatible = "raspberrypi,bcm2835-firmware", },
371 {},
372 };
373 MODULE_DEVICE_TABLE(of, rpi_firmware_of_match);
374
375 static struct platform_driver rpi_firmware_driver = {
376 .driver = {
377 .name = "raspberrypi-firmware",
378 .of_match_table = rpi_firmware_of_match,
379 },
380 .probe = rpi_firmware_probe,
381 .shutdown = rpi_firmware_shutdown,
382 .remove = rpi_firmware_remove,
383 };
384 module_platform_driver(rpi_firmware_driver);
385
386 MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
387 MODULE_DESCRIPTION("Raspberry Pi firmware driver");
388 MODULE_LICENSE("GPL v2");