Add support for transport of RPMI messages over shared memory as
described in the RPMI spec [1]. This uses two or four ring buffers
composed of a fixed number of "slots" to pass messages between the AP
and the PuC. U-Boot is the Application processor (AP) and sends messages
through the a2p-req queue and receives response though the p2a-ack
queue. There is no support for platform microcontroller (PuC) initiated
requests nor notifications.

This transport can be used in M or S mode U-Boot, but in the S-mode
case, one must make sure that the supervisor software isn't already
using the AP side of the shared memory.

[1]: https://github.com/riscv-non-isa/riscv-rpmi (chapter 2)

Signed-off-by: Charles Perry <[email protected]>
---
Changes in v2: (from Yao Zi review)
 - Reorder headers
 - Don't null check pointers before free()
---
 drivers/firmware/rpmi/Kconfig      |   8 +
 drivers/firmware/rpmi/Makefile     |   1 +
 drivers/firmware/rpmi/rpmi-shmem.c | 473 +++++++++++++++++++++++++++++
 include/rpmi_proto.h               |  23 ++
 4 files changed, 505 insertions(+)
 create mode 100644 drivers/firmware/rpmi/rpmi-shmem.c

diff --git a/drivers/firmware/rpmi/Kconfig b/drivers/firmware/rpmi/Kconfig
index 708d931263ff..421a1fa9deba 100644
--- a/drivers/firmware/rpmi/Kconfig
+++ b/drivers/firmware/rpmi/Kconfig
@@ -16,3 +16,11 @@ config RPMI_SBI_MPXY
          (MPXY) extension of the supervisor binary interface (SBI). The
          specification for the MPXY extension is available at:
          https://github.com/riscv-non-isa/riscv-sbi-doc (chapter 20)
+
+config RPMI_SHMEM
+       bool "RPMI over shared memory transport"
+       depends on RPMI_FIRMWARE
+       help
+         Enable support for transport of RPMI messages over shared memory as
+         described in chapter 2 of the RPMI specification, available at:
+         https://github.com/riscv-non-isa/riscv-rpmi
diff --git a/drivers/firmware/rpmi/Makefile b/drivers/firmware/rpmi/Makefile
index 71c4aeaed910..4f4bcb929db4 100644
--- a/drivers/firmware/rpmi/Makefile
+++ b/drivers/firmware/rpmi/Makefile
@@ -1,2 +1,3 @@
 obj-y  += rpmi-uclass.o
 obj-$(CONFIG_RPMI_SBI_MPXY) += rpmi-sbi-mpxy.o
+obj-$(CONFIG_RPMI_SHMEM) += rpmi-shmem.o
diff --git a/drivers/firmware/rpmi/rpmi-shmem.c 
b/drivers/firmware/rpmi/rpmi-shmem.c
new file mode 100644
index 000000000000..8014e86d336f
--- /dev/null
+++ b/drivers/firmware/rpmi/rpmi-shmem.c
@@ -0,0 +1,473 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2026 Microchip Technology Inc. All rights reserved.
+ */
+
+#define LOG_CATEGORY UCLASS_RPMI
+
+#include <asm/barrier.h>
+#include <asm/io.h>
+#include <asm/types.h>
+#include <dm.h>
+#include <dm/device_compat.h>
+#include <linux/delay.h>
+#include <log.h>
+#include <malloc.h>
+#include <rpmi-uclass.h>
+
+#define RPMI_SLOT_SIZE_MIN 64
+
+enum rpmi_queue_idx {
+       RPMI_QUEUE_IDX_A2P_REQ = 0,
+       RPMI_QUEUE_IDX_P2A_ACK = 1,
+       RPMI_QUEUE_IDX_P2A_REQ = 2,
+       RPMI_QUEUE_IDX_A2P_ACK = 3,
+       RPMI_QUEUE_IDX_MAX_COUNT = 4,
+       RPMI_A2P_DOORBELL = 5,
+};
+
+struct shmem_queue {
+       u32 num_slot;
+       __le32 *headptr;
+       __le32 *tailptr;
+       void *buffer;
+};
+
+struct rpmi_shmem {
+       struct udevice *dev;
+       struct shmem_queue a2p_req;
+       struct shmem_queue p2a_ack;
+       int slot_size;
+       int rx_timeout_ms;
+       u32 token;
+       void *doorbell;
+       u32 doorbell_value;
+       u32 spec_version;
+       u32 impl_version;
+       u32 impl_id;
+};
+
+struct rpmi_shmem_chan_priv {
+       struct rpmi_shmem *priv;
+       u32 servicegroup_id;
+       u32 servicegroup_version;
+};
+
+static int rpmi_shmem_queue_idx(const char *name)
+{
+       static const struct {
+               int id;
+               const char *name;
+       } id_names[] = {
+               { RPMI_QUEUE_IDX_A2P_REQ, "a2p-req" },
+               { RPMI_QUEUE_IDX_P2A_ACK, "p2a-ack" },
+               { RPMI_QUEUE_IDX_P2A_REQ, "p2a-req" },
+               { RPMI_QUEUE_IDX_A2P_ACK, "a2p-ack" },
+               { RPMI_A2P_DOORBELL, "a2p-doorbell" },
+       };
+
+       for (int i = 0; i < ARRAY_SIZE(id_names); i++) {
+               if (strcmp(name, id_names[i].name) == 0)
+                       return id_names[i].id;
+       }
+
+       return -ENODEV;
+}
+
+static bool rpmi_smq_queue_full(struct shmem_queue *qctx)
+{
+       return ((le32_to_cpu(*qctx->tailptr) + 1) % qctx->num_slot ==
+               le32_to_cpu(*qctx->headptr));
+}
+
+/* 31                                            0
+ * +---------------------+-----------------------+
+ * | FLAGS | SERVICE_ID  |   SERVICEGROUP_ID     |
+ * +---------------------+-----------------------+
+ * |        TOKEN        |     DATA LENGTH       |
+ * +---------------------+-----------------------+
+ * |                 DATA/PAYLOAD                |
+ * +---------------------------------------------+
+ */
+struct rpmi_message_header {
+       __le16 servicegroup_id;
+       u8 service_id;
+       u8 flags;
+       __le16 datalen;
+       __le16 token;
+} __packed;
+
+static int rpmi_smq_rx(struct rpmi_shmem *priv, struct shmem_queue *qctx,
+                      u32 service_group_id, u32 service_id, u16 token,
+                      void *response, unsigned long max_response_len,
+                      unsigned long *out_response_len)
+{
+       struct rpmi_message_header *msg;
+       u32 dlen, headidx, tailidx;
+       int rxretry = 0;
+       void *src;
+
+       headidx = le32_to_cpu(*qctx->headptr);
+
+       /* Wait for the Rx message with matching token, discard any other
+        * messages received in the mean time
+        */
+       while (true) {
+               tailidx = le32_to_cpu(*qctx->tailptr);
+
+               if (headidx != tailidx) {
+                       msg = (void *)qctx->buffer +
+                             (headidx * priv->slot_size);
+                       if (le16_to_cpu(msg->token) == token)
+                               break;
+
+                       headidx = (headidx + 1) % qctx->num_slot;
+               }
+
+               mdelay(1);
+               rxretry += 1;
+               if (rxretry > priv->rx_timeout_ms)
+                       return -ETIMEDOUT;
+       }
+
+       /* Extract data from the message */
+       if (response) {
+               dlen = le16_to_cpu(msg->datalen);
+               if (dlen > max_response_len)
+                       dlen = max_response_len;
+               if (out_response_len)
+                       *out_response_len = dlen;
+               src = (void *)msg + sizeof(struct rpmi_message_header);
+               memcpy(response, src, dlen);
+       }
+
+       /* Update the head index */
+       headidx = (headidx + 1) % qctx->num_slot;
+       *qctx->headptr = cpu_to_le32(headidx);
+
+       return 0;
+}
+
+static int rpmi_smq_tx(struct rpmi_shmem *priv, struct shmem_queue *qctx,
+                      u32 service_group_id, u32 service_id,
+                      enum rpmi_message_type type, u16 token,
+                      const void *request, unsigned long request_len)
+{
+       struct rpmi_message_header header = { 0 };
+       u32 tailidx;
+       void *dst;
+
+       /* Tx sanity checks */
+       if (request_len >
+           (priv->slot_size - sizeof(struct rpmi_message_header)))
+               return -EINVAL;
+
+       if (rpmi_smq_queue_full(qctx))
+               return -ENOMEM;
+
+       tailidx = le32_to_cpu(*qctx->tailptr);
+
+       /* Prepare the header to be written into the slot */
+       header.servicegroup_id = cpu_to_le16(service_group_id);
+       header.service_id = service_id;
+       header.flags = type;
+       header.datalen = cpu_to_le16(request_len);
+       header.token = cpu_to_le16(token);
+
+       /* Write header into the slot */
+       dst = (char *)qctx->buffer + (tailidx * priv->slot_size);
+       memcpy(dst, &header, sizeof(header));
+       dst += sizeof(header);
+
+       /* Write data into the slot */
+       if (request)
+               memcpy(dst, request, request_len);
+
+       /* Make sure queue chanages are visible to PuC before updating tail */
+       wmb();
+
+       /* Update the tail/write index */
+       tailidx = (tailidx + 1) % qctx->num_slot;
+       *qctx->tailptr = cpu_to_le32(tailidx);
+
+       /* Ring the RPMI doorbell if present */
+       if (priv->doorbell)
+               writel(priv->doorbell_value, priv->doorbell);
+
+       return 0;
+}
+
+static int rpmi_shmem_request_priv(struct rpmi_shmem *priv, u32 
servicegroup_id,
+                                  u32 service_id, const void *request,
+                                  unsigned long request_len, void *response,
+                                  unsigned long max_response_len,
+                                  unsigned long *out_response_len)
+{
+       enum rpmi_message_type type = response ? RPMI_MSG_NORMAL_REQUEST :
+                                                RPMI_MSG_POSTED_REQUEST;
+       int err;
+
+       if (!request && request_len)
+               return -EINVAL;
+
+       err = rpmi_smq_tx(priv, &priv->a2p_req, servicegroup_id, service_id,
+                         type, priv->token, request, request_len);
+       if (err) {
+               dev_err(priv->dev, "tx failed %i\n", err);
+               goto out;
+       }
+
+       if (response) {
+               err = rpmi_smq_rx(priv, &priv->p2a_ack, servicegroup_id,
+                                 service_id, priv->token, response,
+                                 max_response_len, out_response_len);
+               if (err) {
+                       dev_err(priv->dev, "rx failed %i\n", err);
+                       goto out;
+               }
+       }
+
+out:
+       priv->token++;
+       return err;
+}
+
+static int rpmi_shmem_request(struct rpmi_chan *chan, u32 service_id,
+                             const void *request, unsigned long request_len,
+                             void *response, unsigned long max_response_len,
+                             unsigned long *out_response_len)
+{
+       struct rpmi_shmem *priv = dev_get_priv(chan->dev);
+       struct rpmi_shmem_chan_priv *chan_priv = chan->con_priv;
+
+       return rpmi_shmem_request_priv(priv, chan_priv->servicegroup_id,
+                                      service_id, request, request_len,
+                                      response, max_response_len,
+                                      out_response_len);
+}
+
+static int rpmi_shmem_get_attr(struct rpmi_chan *chan,
+                              enum rpmi_attribute_id id, u32 *data)
+{
+       struct rpmi_shmem *priv = dev_get_priv(chan->dev);
+       struct rpmi_shmem_chan_priv *chan_priv = chan->con_priv;
+
+       switch (id) {
+       case RPMI_ATTR_SPEC_VERSION:
+               *data = priv->spec_version;
+               break;
+       case RPMI_ATTR_MAX_MSG_DATA_SIZE:
+               *data = priv->slot_size - sizeof(struct rpmi_message_header);
+               break;
+       case RPMI_ATTR_SERVICEGROUP_ID:
+               *data = chan_priv->servicegroup_id;
+               break;
+       case RPMI_ATTR_SERVICEGROUP_VERSION:
+               *data = chan_priv->servicegroup_version;
+               break;
+       case RPMI_ATTR_IMPL_ID:
+               *data = priv->impl_id;
+               break;
+       case RPMI_ATTR_IMPL_VERSION:
+               *data = priv->impl_version;
+               break;
+       default:
+               return -EOPNOTSUPP;
+       }
+
+       return 0;
+}
+
+static int rpmi_shmem_base_service_req(struct rpmi_shmem *priv, u32 service_id,
+                                      const u32 *arg_in, u32 *arg_out)
+{
+       int len = 0;
+       u32 rx[2];
+       u32 tx[1];
+       int ret;
+
+       if (arg_in) {
+               tx[0] = cpu_to_le32(*arg_in);
+               len = sizeof(*arg_in);
+       }
+
+       ret = rpmi_shmem_request_priv(priv, RPMI_SRVGRP_BASE, service_id, tx,
+                                     len, rx, sizeof(rx), NULL);
+       if (ret) {
+               dev_err(priv->dev, "BASE service %i failed (%i)\n", service_id,
+                       ret);
+               return ret;
+       }
+
+       if (rx[0]) {
+               ret = rpmi_to_linux_error(le32_to_cpu(rx[0]));
+               dev_err(priv->dev, "BASE service %i returned code %i\n",
+                       service_id, ret);
+               return ret;
+       }
+
+       if (arg_out)
+               *arg_out = le32_to_cpu(rx[1]);
+
+       return 0;
+}
+
+static int rpmi_shmem_of_xlate(struct rpmi_chan *chan,
+                              struct ofnode_phandle_args *args)
+{
+       if (args->args_count != 1)
+               return -EINVAL;
+
+       // args[0] is the servicegroup id.
+       chan->id = args->args[0];
+
+       return 0;
+}
+
+static int rpmi_shmem_open(struct rpmi_chan *chan)
+{
+       struct rpmi_shmem *priv = dev_get_priv(chan->dev);
+       u32 servicegroup_id, servicegroup_version;
+       struct rpmi_shmem_chan_priv *chan_priv;
+       int ret;
+
+       servicegroup_id = chan->id;
+
+       ret = rpmi_shmem_base_service_req(priv,
+                                         RPMI_BASE_SRV_PROBE_SERVICE_GROUP,
+                                         &servicegroup_id,
+                                         &servicegroup_version);
+       if (ret)
+               return ret;
+
+       chan_priv = malloc(sizeof(*chan_priv));
+       if (!chan_priv)
+               return -ENOMEM;
+
+       chan->con_priv = chan_priv;
+
+       chan_priv->priv = priv;
+       chan_priv->servicegroup_id = servicegroup_id;
+       chan_priv->servicegroup_version = servicegroup_version;
+
+       return 0;
+}
+
+static void rpmi_shmem_close(struct rpmi_chan *chan)
+{
+       free(chan->con_priv);
+}
+
+static int rpmi_shmem_probe(struct udevice *dev)
+{
+       struct rpmi_shmem *priv = dev_get_priv(dev);
+       int i, ret, qidx, qcount, qslotcnt;
+       struct shmem_queue *queue;
+       u32 arg_in, arg_out;
+       const char *qname;
+       fdt_size_t qsize;
+       void *start;
+
+       priv->dev = dev;
+       priv->rx_timeout_ms = 20;
+
+       priv->slot_size = dev_read_u32_default(dev, "riscv,slot-size", 0);
+       if (priv->slot_size < RPMI_SLOT_SIZE_MIN)
+               return -EINVAL;
+
+       priv->doorbell_value =
+               dev_read_u32_default(dev, "riscv,a2p-doorbell-value", 0);
+
+       qcount = dev_read_string_count(dev, "reg-names");
+       if (qcount < 0 || qcount > 5)
+               return -EINVAL;
+
+       for (i = 0; i < qcount; i++) {
+               ret = dev_read_string_index(dev, "reg-names", i, &qname);
+               if (ret)
+                       continue;
+
+               qidx = rpmi_shmem_queue_idx(qname);
+               if (qidx < 0)
+                       continue;
+
+               start = dev_read_addr_size_index_ptr(dev, i, &qsize);
+               if (!start)
+                       continue;
+
+               if (qidx == RPMI_A2P_DOORBELL) {
+                       priv->doorbell = start;
+               } else {
+                       qslotcnt = qsize / priv->slot_size;
+                       if (qslotcnt < 4)
+                               continue;
+
+                       if (qidx == RPMI_QUEUE_IDX_A2P_REQ)
+                               queue = &priv->a2p_req;
+                       else if (qidx == RPMI_QUEUE_IDX_P2A_ACK)
+                               queue = &priv->p2a_ack;
+                       else
+                               continue;
+
+                       queue->headptr = start;
+                       queue->tailptr = start + priv->slot_size;
+                       queue->buffer = start + (2 * priv->slot_size);
+                       queue->num_slot = qslotcnt - 2;
+               }
+       }
+
+       if (!priv->a2p_req.num_slot || !priv->p2a_ack.num_slot)
+               return -EINVAL;
+
+       arg_in = RPMI_SRVGRP_BASE;
+       ret = rpmi_shmem_base_service_req(
+               priv, RPMI_BASE_SRV_PROBE_SERVICE_GROUP, &arg_in, &arg_out);
+       if (ret)
+               return ret;
+
+       if (arg_out < RPMI_MKVER(1, 0))
+               return -EINVAL;
+
+       ret = rpmi_shmem_base_service_req(
+               priv, RPMI_BASE_SRV_GET_IMPLEMENTATION_VERSION, NULL, &arg_out);
+       if (ret)
+               return ret;
+       priv->impl_version = arg_out;
+
+       ret = rpmi_shmem_base_service_req(
+               priv, RPMI_BASE_SRV_GET_IMPLEMENTATION_IDN, NULL, &arg_out);
+       if (ret)
+               return ret;
+       priv->impl_id = arg_out;
+
+       ret = rpmi_shmem_base_service_req(priv, RPMI_BASE_SRV_GET_SPEC_VERSION,
+                                         NULL, &arg_out);
+       if (ret)
+               return ret;
+       priv->spec_version = arg_out;
+
+       return 0;
+}
+
+static const struct udevice_id rpmi_shmem_ids[] = {
+       { .compatible = "riscv,rpmi-shmem-mbox" },
+       {}
+};
+
+static const struct rpmi_transport_ops rpmi_shmem_ops = {
+       .of_xlate = rpmi_shmem_of_xlate,
+       .get_attr = rpmi_shmem_get_attr,
+       .request = rpmi_shmem_request,
+       .open = rpmi_shmem_open,
+       .close = rpmi_shmem_close,
+};
+
+U_BOOT_DRIVER(rpmi_shmem) = {
+       .name = "rpmi-shmem",
+       .id = UCLASS_RPMI,
+       .of_match = rpmi_shmem_ids,
+       .probe = rpmi_shmem_probe,
+       .priv_auto = sizeof(struct rpmi_shmem),
+       .ops = &rpmi_shmem_ops,
+       .flags = DM_FLAG_PRE_RELOC,
+};
diff --git a/include/rpmi_proto.h b/include/rpmi_proto.h
index 012ae93d7317..4b557bfeedf5 100644
--- a/include/rpmi_proto.h
+++ b/include/rpmi_proto.h
@@ -60,4 +60,27 @@ enum rpmi_servicegroup_id {
        RPMI_SRVGRP_VENDOR_END          = 0xFFFF,
 };
 
+/** RPMI Base ServiceGroup Service IDs */
+enum rpmi_base_service_id {
+       RPMI_BASE_SRV_ENABLE_NOTIFICATION = 0x01,
+       RPMI_BASE_SRV_GET_IMPLEMENTATION_VERSION = 0x02,
+       RPMI_BASE_SRV_GET_IMPLEMENTATION_IDN = 0x03,
+       RPMI_BASE_SRV_GET_SPEC_VERSION = 0x04,
+       RPMI_BASE_SRV_GET_PLATFORM_INFO = 0x05,
+       RPMI_BASE_SRV_PROBE_SERVICE_GROUP = 0x06,
+       RPMI_BASE_SRV_GET_ATTRIBUTES = 0x07,
+};
+
+/** RPMI Messages Types */
+enum rpmi_message_type {
+       /* Normal request backed with ack */
+       RPMI_MSG_NORMAL_REQUEST = 0x0,
+       /* Request without any ack */
+       RPMI_MSG_POSTED_REQUEST = 0x1,
+       /* Acknowledgment for normal request message */
+       RPMI_MSG_ACKNOWLDGEMENT = 0x2,
+       /* Notification message */
+       RPMI_MSG_NOTIFICATION = 0x3,
+};
+
 #endif
-- 
2.47.3

Reply via email to