mic: vop: Fix use-after-free on remove
[linux/fpc-iii.git] / drivers / remoteproc / qcom_wcnss.c
blobb0e07e9f42d5698e64baa7897d75460c28a89690
1 /*
2 * Qualcomm Wireless Connectivity Subsystem Peripheral Image Loader
4 * Copyright (C) 2016 Linaro Ltd
5 * Copyright (C) 2014 Sony Mobile Communications AB
6 * Copyright (c) 2012-2013, The Linux Foundation. All rights reserved.
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * version 2 as published by the Free Software Foundation.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
18 #include <linux/clk.h>
19 #include <linux/delay.h>
20 #include <linux/firmware.h>
21 #include <linux/interrupt.h>
22 #include <linux/kernel.h>
23 #include <linux/module.h>
24 #include <linux/io.h>
25 #include <linux/of_address.h>
26 #include <linux/of_device.h>
27 #include <linux/platform_device.h>
28 #include <linux/qcom_scm.h>
29 #include <linux/regulator/consumer.h>
30 #include <linux/remoteproc.h>
31 #include <linux/soc/qcom/mdt_loader.h>
32 #include <linux/soc/qcom/smem.h>
33 #include <linux/soc/qcom/smem_state.h>
34 #include <linux/rpmsg/qcom_smd.h>
36 #include "qcom_common.h"
37 #include "remoteproc_internal.h"
38 #include "qcom_wcnss.h"
40 #define WCNSS_CRASH_REASON_SMEM 422
41 #define WCNSS_FIRMWARE_NAME "wcnss.mdt"
42 #define WCNSS_PAS_ID 6
43 #define WCNSS_SSCTL_ID 0x13
45 #define WCNSS_SPARE_NVBIN_DLND BIT(25)
47 #define WCNSS_PMU_IRIS_XO_CFG BIT(3)
48 #define WCNSS_PMU_IRIS_XO_EN BIT(4)
49 #define WCNSS_PMU_GC_BUS_MUX_SEL_TOP BIT(5)
50 #define WCNSS_PMU_IRIS_XO_CFG_STS BIT(6) /* 1: in progress, 0: done */
52 #define WCNSS_PMU_IRIS_RESET BIT(7)
53 #define WCNSS_PMU_IRIS_RESET_STS BIT(8) /* 1: in progress, 0: done */
54 #define WCNSS_PMU_IRIS_XO_READ BIT(9)
55 #define WCNSS_PMU_IRIS_XO_READ_STS BIT(10)
57 #define WCNSS_PMU_XO_MODE_MASK GENMASK(2, 1)
58 #define WCNSS_PMU_XO_MODE_19p2 0
59 #define WCNSS_PMU_XO_MODE_48 3
61 struct wcnss_data {
62 size_t pmu_offset;
63 size_t spare_offset;
65 const struct wcnss_vreg_info *vregs;
66 size_t num_vregs;
69 struct qcom_wcnss {
70 struct device *dev;
71 struct rproc *rproc;
73 void __iomem *pmu_cfg;
74 void __iomem *spare_out;
76 bool use_48mhz_xo;
78 int wdog_irq;
79 int fatal_irq;
80 int ready_irq;
81 int handover_irq;
82 int stop_ack_irq;
84 struct qcom_smem_state *state;
85 unsigned stop_bit;
87 struct mutex iris_lock;
88 struct qcom_iris *iris;
90 struct regulator_bulk_data *vregs;
91 size_t num_vregs;
93 struct completion start_done;
94 struct completion stop_done;
96 phys_addr_t mem_phys;
97 phys_addr_t mem_reloc;
98 void *mem_region;
99 size_t mem_size;
101 struct qcom_rproc_subdev smd_subdev;
102 struct qcom_sysmon *sysmon;
105 static const struct wcnss_data riva_data = {
106 .pmu_offset = 0x28,
107 .spare_offset = 0xb4,
109 .vregs = (struct wcnss_vreg_info[]) {
110 { "vddmx", 1050000, 1150000, 0 },
111 { "vddcx", 1050000, 1150000, 0 },
112 { "vddpx", 1800000, 1800000, 0 },
114 .num_vregs = 3,
117 static const struct wcnss_data pronto_v1_data = {
118 .pmu_offset = 0x1004,
119 .spare_offset = 0x1088,
121 .vregs = (struct wcnss_vreg_info[]) {
122 { "vddmx", 950000, 1150000, 0 },
123 { "vddcx", .super_turbo = true},
124 { "vddpx", 1800000, 1800000, 0 },
126 .num_vregs = 3,
129 static const struct wcnss_data pronto_v2_data = {
130 .pmu_offset = 0x1004,
131 .spare_offset = 0x1088,
133 .vregs = (struct wcnss_vreg_info[]) {
134 { "vddmx", 1287500, 1287500, 0 },
135 { "vddcx", .super_turbo = true },
136 { "vddpx", 1800000, 1800000, 0 },
138 .num_vregs = 3,
141 void qcom_wcnss_assign_iris(struct qcom_wcnss *wcnss,
142 struct qcom_iris *iris,
143 bool use_48mhz_xo)
145 mutex_lock(&wcnss->iris_lock);
147 wcnss->iris = iris;
148 wcnss->use_48mhz_xo = use_48mhz_xo;
150 mutex_unlock(&wcnss->iris_lock);
153 static int wcnss_load(struct rproc *rproc, const struct firmware *fw)
155 struct qcom_wcnss *wcnss = (struct qcom_wcnss *)rproc->priv;
157 return qcom_mdt_load(wcnss->dev, fw, rproc->firmware, WCNSS_PAS_ID,
158 wcnss->mem_region, wcnss->mem_phys,
159 wcnss->mem_size, &wcnss->mem_reloc);
162 static void wcnss_indicate_nv_download(struct qcom_wcnss *wcnss)
164 u32 val;
166 /* Indicate NV download capability */
167 val = readl(wcnss->spare_out);
168 val |= WCNSS_SPARE_NVBIN_DLND;
169 writel(val, wcnss->spare_out);
172 static void wcnss_configure_iris(struct qcom_wcnss *wcnss)
174 u32 val;
176 /* Clear PMU cfg register */
177 writel(0, wcnss->pmu_cfg);
179 val = WCNSS_PMU_GC_BUS_MUX_SEL_TOP | WCNSS_PMU_IRIS_XO_EN;
180 writel(val, wcnss->pmu_cfg);
182 /* Clear XO_MODE */
183 val &= ~WCNSS_PMU_XO_MODE_MASK;
184 if (wcnss->use_48mhz_xo)
185 val |= WCNSS_PMU_XO_MODE_48 << 1;
186 else
187 val |= WCNSS_PMU_XO_MODE_19p2 << 1;
188 writel(val, wcnss->pmu_cfg);
190 /* Reset IRIS */
191 val |= WCNSS_PMU_IRIS_RESET;
192 writel(val, wcnss->pmu_cfg);
194 /* Wait for PMU.iris_reg_reset_sts */
195 while (readl(wcnss->pmu_cfg) & WCNSS_PMU_IRIS_RESET_STS)
196 cpu_relax();
198 /* Clear IRIS reset */
199 val &= ~WCNSS_PMU_IRIS_RESET;
200 writel(val, wcnss->pmu_cfg);
202 /* Start IRIS XO configuration */
203 val |= WCNSS_PMU_IRIS_XO_CFG;
204 writel(val, wcnss->pmu_cfg);
206 /* Wait for XO configuration to finish */
207 while (readl(wcnss->pmu_cfg) & WCNSS_PMU_IRIS_XO_CFG_STS)
208 cpu_relax();
210 /* Stop IRIS XO configuration */
211 val &= ~WCNSS_PMU_GC_BUS_MUX_SEL_TOP;
212 val &= ~WCNSS_PMU_IRIS_XO_CFG;
213 writel(val, wcnss->pmu_cfg);
215 /* Add some delay for XO to settle */
216 msleep(20);
219 static int wcnss_start(struct rproc *rproc)
221 struct qcom_wcnss *wcnss = (struct qcom_wcnss *)rproc->priv;
222 int ret;
224 mutex_lock(&wcnss->iris_lock);
225 if (!wcnss->iris) {
226 dev_err(wcnss->dev, "no iris registered\n");
227 ret = -EINVAL;
228 goto release_iris_lock;
231 ret = regulator_bulk_enable(wcnss->num_vregs, wcnss->vregs);
232 if (ret)
233 goto release_iris_lock;
235 ret = qcom_iris_enable(wcnss->iris);
236 if (ret)
237 goto disable_regulators;
239 wcnss_indicate_nv_download(wcnss);
240 wcnss_configure_iris(wcnss);
242 ret = qcom_scm_pas_auth_and_reset(WCNSS_PAS_ID);
243 if (ret) {
244 dev_err(wcnss->dev,
245 "failed to authenticate image and release reset\n");
246 goto disable_iris;
249 ret = wait_for_completion_timeout(&wcnss->start_done,
250 msecs_to_jiffies(5000));
251 if (wcnss->ready_irq > 0 && ret == 0) {
252 /* We have a ready_irq, but it didn't fire in time. */
253 dev_err(wcnss->dev, "start timed out\n");
254 qcom_scm_pas_shutdown(WCNSS_PAS_ID);
255 ret = -ETIMEDOUT;
256 goto disable_iris;
259 ret = 0;
261 disable_iris:
262 qcom_iris_disable(wcnss->iris);
263 disable_regulators:
264 regulator_bulk_disable(wcnss->num_vregs, wcnss->vregs);
265 release_iris_lock:
266 mutex_unlock(&wcnss->iris_lock);
268 return ret;
271 static int wcnss_stop(struct rproc *rproc)
273 struct qcom_wcnss *wcnss = (struct qcom_wcnss *)rproc->priv;
274 int ret;
276 if (wcnss->state) {
277 qcom_smem_state_update_bits(wcnss->state,
278 BIT(wcnss->stop_bit),
279 BIT(wcnss->stop_bit));
281 ret = wait_for_completion_timeout(&wcnss->stop_done,
282 msecs_to_jiffies(5000));
283 if (ret == 0)
284 dev_err(wcnss->dev, "timed out on wait\n");
286 qcom_smem_state_update_bits(wcnss->state,
287 BIT(wcnss->stop_bit),
291 ret = qcom_scm_pas_shutdown(WCNSS_PAS_ID);
292 if (ret)
293 dev_err(wcnss->dev, "failed to shutdown: %d\n", ret);
295 return ret;
298 static void *wcnss_da_to_va(struct rproc *rproc, u64 da, int len)
300 struct qcom_wcnss *wcnss = (struct qcom_wcnss *)rproc->priv;
301 int offset;
303 offset = da - wcnss->mem_reloc;
304 if (offset < 0 || offset + len > wcnss->mem_size)
305 return NULL;
307 return wcnss->mem_region + offset;
310 static const struct rproc_ops wcnss_ops = {
311 .start = wcnss_start,
312 .stop = wcnss_stop,
313 .da_to_va = wcnss_da_to_va,
314 .parse_fw = qcom_register_dump_segments,
315 .load = wcnss_load,
318 static irqreturn_t wcnss_wdog_interrupt(int irq, void *dev)
320 struct qcom_wcnss *wcnss = dev;
322 rproc_report_crash(wcnss->rproc, RPROC_WATCHDOG);
324 return IRQ_HANDLED;
327 static irqreturn_t wcnss_fatal_interrupt(int irq, void *dev)
329 struct qcom_wcnss *wcnss = dev;
330 size_t len;
331 char *msg;
333 msg = qcom_smem_get(QCOM_SMEM_HOST_ANY, WCNSS_CRASH_REASON_SMEM, &len);
334 if (!IS_ERR(msg) && len > 0 && msg[0])
335 dev_err(wcnss->dev, "fatal error received: %s\n", msg);
337 rproc_report_crash(wcnss->rproc, RPROC_FATAL_ERROR);
339 return IRQ_HANDLED;
342 static irqreturn_t wcnss_ready_interrupt(int irq, void *dev)
344 struct qcom_wcnss *wcnss = dev;
346 complete(&wcnss->start_done);
348 return IRQ_HANDLED;
351 static irqreturn_t wcnss_handover_interrupt(int irq, void *dev)
354 * XXX: At this point we're supposed to release the resources that we
355 * have been holding on behalf of the WCNSS. Unfortunately this
356 * interrupt comes way before the other side seems to be done.
358 * So we're currently relying on the ready interrupt firing later then
359 * this and we just disable the resources at the end of wcnss_start().
362 return IRQ_HANDLED;
365 static irqreturn_t wcnss_stop_ack_interrupt(int irq, void *dev)
367 struct qcom_wcnss *wcnss = dev;
369 complete(&wcnss->stop_done);
371 return IRQ_HANDLED;
374 static int wcnss_init_regulators(struct qcom_wcnss *wcnss,
375 const struct wcnss_vreg_info *info,
376 int num_vregs)
378 struct regulator_bulk_data *bulk;
379 int ret;
380 int i;
382 bulk = devm_kcalloc(wcnss->dev,
383 num_vregs, sizeof(struct regulator_bulk_data),
384 GFP_KERNEL);
385 if (!bulk)
386 return -ENOMEM;
388 for (i = 0; i < num_vregs; i++)
389 bulk[i].supply = info[i].name;
391 ret = devm_regulator_bulk_get(wcnss->dev, num_vregs, bulk);
392 if (ret)
393 return ret;
395 for (i = 0; i < num_vregs; i++) {
396 if (info[i].max_voltage)
397 regulator_set_voltage(bulk[i].consumer,
398 info[i].min_voltage,
399 info[i].max_voltage);
401 if (info[i].load_uA)
402 regulator_set_load(bulk[i].consumer, info[i].load_uA);
405 wcnss->vregs = bulk;
406 wcnss->num_vregs = num_vregs;
408 return 0;
411 static int wcnss_request_irq(struct qcom_wcnss *wcnss,
412 struct platform_device *pdev,
413 const char *name,
414 bool optional,
415 irq_handler_t thread_fn)
417 int ret;
419 ret = platform_get_irq_byname(pdev, name);
420 if (ret < 0 && optional) {
421 dev_dbg(&pdev->dev, "no %s IRQ defined, ignoring\n", name);
422 return 0;
423 } else if (ret < 0) {
424 dev_err(&pdev->dev, "no %s IRQ defined\n", name);
425 return ret;
428 ret = devm_request_threaded_irq(&pdev->dev, ret,
429 NULL, thread_fn,
430 IRQF_TRIGGER_RISING | IRQF_ONESHOT,
431 "wcnss", wcnss);
432 if (ret)
433 dev_err(&pdev->dev, "request %s IRQ failed\n", name);
435 return ret;
438 static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss)
440 struct device_node *node;
441 struct resource r;
442 int ret;
444 node = of_parse_phandle(wcnss->dev->of_node, "memory-region", 0);
445 if (!node) {
446 dev_err(wcnss->dev, "no memory-region specified\n");
447 return -EINVAL;
450 ret = of_address_to_resource(node, 0, &r);
451 if (ret)
452 return ret;
454 wcnss->mem_phys = wcnss->mem_reloc = r.start;
455 wcnss->mem_size = resource_size(&r);
456 wcnss->mem_region = devm_ioremap_wc(wcnss->dev, wcnss->mem_phys, wcnss->mem_size);
457 if (!wcnss->mem_region) {
458 dev_err(wcnss->dev, "unable to map memory region: %pa+%zx\n",
459 &r.start, wcnss->mem_size);
460 return -EBUSY;
463 return 0;
466 static int wcnss_probe(struct platform_device *pdev)
468 const struct wcnss_data *data;
469 struct qcom_wcnss *wcnss;
470 struct resource *res;
471 struct rproc *rproc;
472 void __iomem *mmio;
473 int ret;
475 data = of_device_get_match_data(&pdev->dev);
477 if (!qcom_scm_is_available())
478 return -EPROBE_DEFER;
480 if (!qcom_scm_pas_supported(WCNSS_PAS_ID)) {
481 dev_err(&pdev->dev, "PAS is not available for WCNSS\n");
482 return -ENXIO;
485 rproc = rproc_alloc(&pdev->dev, pdev->name, &wcnss_ops,
486 WCNSS_FIRMWARE_NAME, sizeof(*wcnss));
487 if (!rproc) {
488 dev_err(&pdev->dev, "unable to allocate remoteproc\n");
489 return -ENOMEM;
492 wcnss = (struct qcom_wcnss *)rproc->priv;
493 wcnss->dev = &pdev->dev;
494 wcnss->rproc = rproc;
495 platform_set_drvdata(pdev, wcnss);
497 init_completion(&wcnss->start_done);
498 init_completion(&wcnss->stop_done);
500 mutex_init(&wcnss->iris_lock);
502 res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "pmu");
503 mmio = devm_ioremap_resource(&pdev->dev, res);
504 if (IS_ERR(mmio)) {
505 ret = PTR_ERR(mmio);
506 goto free_rproc;
509 ret = wcnss_alloc_memory_region(wcnss);
510 if (ret)
511 goto free_rproc;
513 wcnss->pmu_cfg = mmio + data->pmu_offset;
514 wcnss->spare_out = mmio + data->spare_offset;
516 ret = wcnss_init_regulators(wcnss, data->vregs, data->num_vregs);
517 if (ret)
518 goto free_rproc;
520 ret = wcnss_request_irq(wcnss, pdev, "wdog", false, wcnss_wdog_interrupt);
521 if (ret < 0)
522 goto free_rproc;
523 wcnss->wdog_irq = ret;
525 ret = wcnss_request_irq(wcnss, pdev, "fatal", false, wcnss_fatal_interrupt);
526 if (ret < 0)
527 goto free_rproc;
528 wcnss->fatal_irq = ret;
530 ret = wcnss_request_irq(wcnss, pdev, "ready", true, wcnss_ready_interrupt);
531 if (ret < 0)
532 goto free_rproc;
533 wcnss->ready_irq = ret;
535 ret = wcnss_request_irq(wcnss, pdev, "handover", true, wcnss_handover_interrupt);
536 if (ret < 0)
537 goto free_rproc;
538 wcnss->handover_irq = ret;
540 ret = wcnss_request_irq(wcnss, pdev, "stop-ack", true, wcnss_stop_ack_interrupt);
541 if (ret < 0)
542 goto free_rproc;
543 wcnss->stop_ack_irq = ret;
545 if (wcnss->stop_ack_irq) {
546 wcnss->state = qcom_smem_state_get(&pdev->dev, "stop",
547 &wcnss->stop_bit);
548 if (IS_ERR(wcnss->state)) {
549 ret = PTR_ERR(wcnss->state);
550 goto free_rproc;
554 qcom_add_smd_subdev(rproc, &wcnss->smd_subdev);
555 wcnss->sysmon = qcom_add_sysmon_subdev(rproc, "wcnss", WCNSS_SSCTL_ID);
557 ret = rproc_add(rproc);
558 if (ret)
559 goto free_rproc;
561 return of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev);
563 free_rproc:
564 rproc_free(rproc);
566 return ret;
569 static int wcnss_remove(struct platform_device *pdev)
571 struct qcom_wcnss *wcnss = platform_get_drvdata(pdev);
573 of_platform_depopulate(&pdev->dev);
575 qcom_smem_state_put(wcnss->state);
576 rproc_del(wcnss->rproc);
578 qcom_remove_sysmon_subdev(wcnss->sysmon);
579 qcom_remove_smd_subdev(wcnss->rproc, &wcnss->smd_subdev);
580 rproc_free(wcnss->rproc);
582 return 0;
585 static const struct of_device_id wcnss_of_match[] = {
586 { .compatible = "qcom,riva-pil", &riva_data },
587 { .compatible = "qcom,pronto-v1-pil", &pronto_v1_data },
588 { .compatible = "qcom,pronto-v2-pil", &pronto_v2_data },
589 { },
591 MODULE_DEVICE_TABLE(of, wcnss_of_match);
593 static struct platform_driver wcnss_driver = {
594 .probe = wcnss_probe,
595 .remove = wcnss_remove,
596 .driver = {
597 .name = "qcom-wcnss-pil",
598 .of_match_table = wcnss_of_match,
602 static int __init wcnss_init(void)
604 int ret;
606 ret = platform_driver_register(&wcnss_driver);
607 if (ret)
608 return ret;
610 ret = platform_driver_register(&qcom_iris_driver);
611 if (ret)
612 platform_driver_unregister(&wcnss_driver);
614 return ret;
616 module_init(wcnss_init);
618 static void __exit wcnss_exit(void)
620 platform_driver_unregister(&qcom_iris_driver);
621 platform_driver_unregister(&wcnss_driver);
623 module_exit(wcnss_exit);
625 MODULE_DESCRIPTION("Qualcomm Peripherial Image Loader for Wireless Subsystem");
626 MODULE_LICENSE("GPL v2");