1 /* 2 * Copyright (C) 2011 Google, Inc. 3 * Copyright (C) 2012 Intel, Inc. 4 * Copyright (C) 2013 Intel, Inc. 5 * 6 * This software is licensed under the terms of the GNU General Public 7 * License version 2, as published by the Free Software Foundation, and 8 * may be copied, distributed, and modified under those terms. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 */ 16 17 /* This source file contains the implementation of a special device driver 18 * that intends to provide a *very* fast communication channel between the 19 * guest system and the QEMU emulator. 20 * 21 * Usage from the guest is simply the following (error handling simplified): 22 * 23 * int fd = open("/dev/qemu_pipe",O_RDWR); 24 * .... write() or read() through the pipe. 25 * 26 * This driver doesn't deal with the exact protocol used during the session. 27 * It is intended to be as simple as something like: 28 * 29 * // do this _just_ after opening the fd to connect to a specific 30 * // emulator service. 31 * const char* msg = "<pipename>"; 32 * if (write(fd, msg, strlen(msg)+1) < 0) { 33 * ... could not connect to <pipename> service 34 * close(fd); 35 * } 36 * 37 * // after this, simply read() and write() to communicate with the 38 * // service. Exact protocol details left as an exercise to the reader. 39 * 40 * This driver is very fast because it doesn't copy any data through 41 * intermediate buffers, since the emulator is capable of translating 42 * guest user addresses into host ones. 43 * 44 * Note that we must however ensure that each user page involved in the 45 * exchange is properly mapped during a transfer. 46 */ 47 48 #include <linux/module.h> 49 #include <linux/interrupt.h> 50 #include <linux/kernel.h> 51 #include <linux/spinlock.h> 52 #include <linux/miscdevice.h> 53 #include <linux/platform_device.h> 54 #include <linux/poll.h> 55 #include <linux/sched.h> 56 #include <linux/bitops.h> 57 #include <linux/slab.h> 58 #include <linux/io.h> 59 #include <linux/goldfish.h> 60 61 /* 62 * IMPORTANT: The following constants must match the ones used and defined 63 * in external/qemu/hw/goldfish_pipe.c in the Android source tree. 64 */ 65 66 /* pipe device registers */ 67 #define PIPE_REG_COMMAND 0x00 /* write: value = command */ 68 #define PIPE_REG_STATUS 0x04 /* read */ 69 #define PIPE_REG_CHANNEL 0x08 /* read/write: channel id */ 70 #define PIPE_REG_CHANNEL_HIGH 0x30 /* read/write: channel id */ 71 #define PIPE_REG_SIZE 0x0c /* read/write: buffer size */ 72 #define PIPE_REG_ADDRESS 0x10 /* write: physical address */ 73 #define PIPE_REG_ADDRESS_HIGH 0x34 /* write: physical address */ 74 #define PIPE_REG_WAKES 0x14 /* read: wake flags */ 75 #define PIPE_REG_PARAMS_ADDR_LOW 0x18 /* read/write: batch data address */ 76 #define PIPE_REG_PARAMS_ADDR_HIGH 0x1c /* read/write: batch data address */ 77 #define PIPE_REG_ACCESS_PARAMS 0x20 /* write: batch access */ 78 79 /* list of commands for PIPE_REG_COMMAND */ 80 #define CMD_OPEN 1 /* open new channel */ 81 #define CMD_CLOSE 2 /* close channel (from guest) */ 82 #define CMD_POLL 3 /* poll read/write status */ 83 84 /* List of bitflags returned in status of CMD_POLL command */ 85 #define PIPE_POLL_IN (1 << 0) 86 #define PIPE_POLL_OUT (1 << 1) 87 #define PIPE_POLL_HUP (1 << 2) 88 89 /* The following commands are related to write operations */ 90 #define CMD_WRITE_BUFFER 4 /* send a user buffer to the emulator */ 91 #define CMD_WAKE_ON_WRITE 5 /* tell the emulator to wake us when writing 92 is possible */ 93 94 /* The following commands are related to read operations, they must be 95 * listed in the same order than the corresponding write ones, since we 96 * will use (CMD_READ_BUFFER - CMD_WRITE_BUFFER) as a special offset 97 * in goldfish_pipe_read_write() below. 98 */ 99 #define CMD_READ_BUFFER 6 /* receive a user buffer from the emulator */ 100 #define CMD_WAKE_ON_READ 7 /* tell the emulator to wake us when reading 101 * is possible */ 102 103 /* Possible status values used to signal errors - see goldfish_pipe_error_convert */ 104 #define PIPE_ERROR_INVAL -1 105 #define PIPE_ERROR_AGAIN -2 106 #define PIPE_ERROR_NOMEM -3 107 #define PIPE_ERROR_IO -4 108 109 /* Bit-flags used to signal events from the emulator */ 110 #define PIPE_WAKE_CLOSED (1 << 0) /* emulator closed pipe */ 111 #define PIPE_WAKE_READ (1 << 1) /* pipe can now be read from */ 112 #define PIPE_WAKE_WRITE (1 << 2) /* pipe can now be written to */ 113 114 struct access_params { 115 unsigned long channel; 116 u32 size; 117 unsigned long address; 118 u32 cmd; 119 u32 result; 120 /* reserved for future extension */ 121 u32 flags; 122 }; 123 124 /* The global driver data. Holds a reference to the i/o page used to 125 * communicate with the emulator, and a wake queue for blocked tasks 126 * waiting to be awoken. 127 */ 128 struct goldfish_pipe_dev { 129 spinlock_t lock; 130 unsigned char __iomem *base; 131 struct access_params *aps; 132 int irq; 133 }; 134 135 static struct goldfish_pipe_dev pipe_dev[1]; 136 137 /* This data type models a given pipe instance */ 138 struct goldfish_pipe { 139 struct goldfish_pipe_dev *dev; 140 struct mutex lock; 141 unsigned long flags; 142 wait_queue_head_t wake_queue; 143 }; 144 145 146 /* Bit flags for the 'flags' field */ 147 enum { 148 BIT_CLOSED_ON_HOST = 0, /* pipe closed by host */ 149 BIT_WAKE_ON_WRITE = 1, /* want to be woken on writes */ 150 BIT_WAKE_ON_READ = 2, /* want to be woken on reads */ 151 }; 152 153 154 static u32 goldfish_cmd_status(struct goldfish_pipe *pipe, u32 cmd) 155 { 156 unsigned long flags; 157 u32 status; 158 struct goldfish_pipe_dev *dev = pipe->dev; 159 160 spin_lock_irqsave(&dev->lock, flags); 161 gf_write64((u64)(unsigned long)pipe, dev->base + PIPE_REG_CHANNEL, 162 dev->base + PIPE_REG_CHANNEL_HIGH); 163 writel(cmd, dev->base + PIPE_REG_COMMAND); 164 status = readl(dev->base + PIPE_REG_STATUS); 165 spin_unlock_irqrestore(&dev->lock, flags); 166 return status; 167 } 168 169 static void goldfish_cmd(struct goldfish_pipe *pipe, u32 cmd) 170 { 171 unsigned long flags; 172 struct goldfish_pipe_dev *dev = pipe->dev; 173 174 spin_lock_irqsave(&dev->lock, flags); 175 gf_write64((u64)(unsigned long)pipe, dev->base + PIPE_REG_CHANNEL, 176 dev->base + PIPE_REG_CHANNEL_HIGH); 177 writel(cmd, dev->base + PIPE_REG_COMMAND); 178 spin_unlock_irqrestore(&dev->lock, flags); 179 } 180 181 /* This function converts an error code returned by the emulator through 182 * the PIPE_REG_STATUS i/o register into a valid negative errno value. 183 */ 184 static int goldfish_pipe_error_convert(int status) 185 { 186 switch (status) { 187 case PIPE_ERROR_AGAIN: 188 return -EAGAIN; 189 case PIPE_ERROR_NOMEM: 190 return -ENOMEM; 191 case PIPE_ERROR_IO: 192 return -EIO; 193 default: 194 return -EINVAL; 195 } 196 } 197 198 /* 199 * Notice: QEMU will return 0 for un-known register access, indicating 200 * param_acess is supported or not 201 */ 202 static int valid_batchbuffer_addr(struct goldfish_pipe_dev *dev, 203 struct access_params *aps) 204 { 205 u32 aph, apl; 206 u64 paddr; 207 aph = readl(dev->base + PIPE_REG_PARAMS_ADDR_HIGH); 208 apl = readl(dev->base + PIPE_REG_PARAMS_ADDR_LOW); 209 210 paddr = ((u64)aph << 32) | apl; 211 if (paddr != (__pa(aps))) 212 return 0; 213 return 1; 214 } 215 216 /* 0 on success */ 217 static int setup_access_params_addr(struct platform_device *pdev, 218 struct goldfish_pipe_dev *dev) 219 { 220 u64 paddr; 221 struct access_params *aps; 222 223 aps = devm_kzalloc(&pdev->dev, sizeof(struct access_params), GFP_KERNEL); 224 if (!aps) 225 return -1; 226 227 /* FIXME */ 228 paddr = __pa(aps); 229 writel((u32)(paddr >> 32), dev->base + PIPE_REG_PARAMS_ADDR_HIGH); 230 writel((u32)paddr, dev->base + PIPE_REG_PARAMS_ADDR_LOW); 231 232 if (valid_batchbuffer_addr(dev, aps)) { 233 dev->aps = aps; 234 return 0; 235 } else 236 return -1; 237 } 238 239 /* A value that will not be set by qemu emulator */ 240 #define INITIAL_BATCH_RESULT (0xdeadbeaf) 241 static int access_with_param(struct goldfish_pipe_dev *dev, const int cmd, 242 unsigned long address, unsigned long avail, 243 struct goldfish_pipe *pipe, int *status) 244 { 245 struct access_params *aps = dev->aps; 246 247 if (aps == NULL) 248 return -1; 249 250 aps->result = INITIAL_BATCH_RESULT; 251 aps->channel = (unsigned long)pipe; 252 aps->size = avail; 253 aps->address = address; 254 aps->cmd = cmd; 255 writel(cmd, dev->base + PIPE_REG_ACCESS_PARAMS); 256 /* 257 * If the aps->result has not changed, that means 258 * that the batch command failed 259 */ 260 if (aps->result == INITIAL_BATCH_RESULT) 261 return -1; 262 *status = aps->result; 263 return 0; 264 } 265 266 /* This function is used for both reading from and writing to a given 267 * pipe. 268 */ 269 static ssize_t goldfish_pipe_read_write(struct file *filp, char __user *buffer, 270 size_t bufflen, int is_write) 271 { 272 unsigned long irq_flags; 273 struct goldfish_pipe *pipe = filp->private_data; 274 struct goldfish_pipe_dev *dev = pipe->dev; 275 const int cmd_offset = is_write ? 0 276 : (CMD_READ_BUFFER - CMD_WRITE_BUFFER); 277 unsigned long address, address_end; 278 int ret = 0; 279 280 /* If the emulator already closed the pipe, no need to go further */ 281 if (test_bit(BIT_CLOSED_ON_HOST, &pipe->flags)) 282 return -EIO; 283 284 /* Null reads or writes succeeds */ 285 if (unlikely(bufflen) == 0) 286 return 0; 287 288 /* Check the buffer range for access */ 289 if (!access_ok(is_write ? VERIFY_WRITE : VERIFY_READ, 290 buffer, bufflen)) 291 return -EFAULT; 292 293 /* Serialize access to the pipe */ 294 if (mutex_lock_interruptible(&pipe->lock)) 295 return -ERESTARTSYS; 296 297 address = (unsigned long)(void *)buffer; 298 address_end = address + bufflen; 299 300 while (address < address_end) { 301 unsigned long page_end = (address & PAGE_MASK) + PAGE_SIZE; 302 unsigned long next = page_end < address_end ? page_end 303 : address_end; 304 unsigned long avail = next - address; 305 int status, wakeBit; 306 307 /* Ensure that the corresponding page is properly mapped */ 308 /* FIXME: this isn't safe or sufficient - use get_user_pages */ 309 if (is_write) { 310 char c; 311 /* Ensure that the page is mapped and readable */ 312 if (__get_user(c, (char __user *)address)) { 313 if (!ret) 314 ret = -EFAULT; 315 break; 316 } 317 } else { 318 /* Ensure that the page is mapped and writable */ 319 if (__put_user(0, (char __user *)address)) { 320 if (!ret) 321 ret = -EFAULT; 322 break; 323 } 324 } 325 326 /* Now, try to transfer the bytes in the current page */ 327 spin_lock_irqsave(&dev->lock, irq_flags); 328 if (access_with_param(dev, CMD_WRITE_BUFFER + cmd_offset, 329 address, avail, pipe, &status)) { 330 gf_write64((u64)(unsigned long)pipe, 331 dev->base + PIPE_REG_CHANNEL, 332 dev->base + PIPE_REG_CHANNEL_HIGH); 333 writel(avail, dev->base + PIPE_REG_SIZE); 334 gf_write64(address, dev->base + PIPE_REG_ADDRESS, 335 dev->base + PIPE_REG_ADDRESS_HIGH); 336 writel(CMD_WRITE_BUFFER + cmd_offset, 337 dev->base + PIPE_REG_COMMAND); 338 status = readl(dev->base + PIPE_REG_STATUS); 339 } 340 spin_unlock_irqrestore(&dev->lock, irq_flags); 341 342 if (status > 0) { /* Correct transfer */ 343 ret += status; 344 address += status; 345 continue; 346 } 347 348 if (status == 0) /* EOF */ 349 break; 350 351 /* An error occured. If we already transfered stuff, just 352 * return with its count. We expect the next call to return 353 * an error code */ 354 if (ret > 0) 355 break; 356 357 /* If the error is not PIPE_ERROR_AGAIN, or if we are not in 358 * non-blocking mode, just return the error code. 359 */ 360 if (status != PIPE_ERROR_AGAIN || 361 (filp->f_flags & O_NONBLOCK) != 0) { 362 ret = goldfish_pipe_error_convert(status); 363 break; 364 } 365 366 /* We will have to wait until more data/space is available. 367 * First, mark the pipe as waiting for a specific wake signal. 368 */ 369 wakeBit = is_write ? BIT_WAKE_ON_WRITE : BIT_WAKE_ON_READ; 370 set_bit(wakeBit, &pipe->flags); 371 372 /* Tell the emulator we're going to wait for a wake event */ 373 goldfish_cmd(pipe, CMD_WAKE_ON_WRITE + cmd_offset); 374 375 /* Unlock the pipe, then wait for the wake signal */ 376 mutex_unlock(&pipe->lock); 377 378 while (test_bit(wakeBit, &pipe->flags)) { 379 if (wait_event_interruptible( 380 pipe->wake_queue, 381 !test_bit(wakeBit, &pipe->flags))) 382 return -ERESTARTSYS; 383 384 if (test_bit(BIT_CLOSED_ON_HOST, &pipe->flags)) 385 return -EIO; 386 } 387 388 /* Try to re-acquire the lock */ 389 if (mutex_lock_interruptible(&pipe->lock)) 390 return -ERESTARTSYS; 391 392 /* Try the transfer again */ 393 continue; 394 } 395 mutex_unlock(&pipe->lock); 396 return ret; 397 } 398 399 static ssize_t goldfish_pipe_read(struct file *filp, char __user *buffer, 400 size_t bufflen, loff_t *ppos) 401 { 402 return goldfish_pipe_read_write(filp, buffer, bufflen, 0); 403 } 404 405 static ssize_t goldfish_pipe_write(struct file *filp, 406 const char __user *buffer, size_t bufflen, 407 loff_t *ppos) 408 { 409 return goldfish_pipe_read_write(filp, (char __user *)buffer, 410 bufflen, 1); 411 } 412 413 414 static unsigned int goldfish_pipe_poll(struct file *filp, poll_table *wait) 415 { 416 struct goldfish_pipe *pipe = filp->private_data; 417 unsigned int mask = 0; 418 int status; 419 420 mutex_lock(&pipe->lock); 421 422 poll_wait(filp, &pipe->wake_queue, wait); 423 424 status = goldfish_cmd_status(pipe, CMD_POLL); 425 426 mutex_unlock(&pipe->lock); 427 428 if (status & PIPE_POLL_IN) 429 mask |= POLLIN | POLLRDNORM; 430 431 if (status & PIPE_POLL_OUT) 432 mask |= POLLOUT | POLLWRNORM; 433 434 if (status & PIPE_POLL_HUP) 435 mask |= POLLHUP; 436 437 if (test_bit(BIT_CLOSED_ON_HOST, &pipe->flags)) 438 mask |= POLLERR; 439 440 return mask; 441 } 442 443 static irqreturn_t goldfish_pipe_interrupt(int irq, void *dev_id) 444 { 445 struct goldfish_pipe_dev *dev = dev_id; 446 unsigned long irq_flags; 447 int count = 0; 448 449 /* We're going to read from the emulator a list of (channel,flags) 450 * pairs corresponding to the wake events that occured on each 451 * blocked pipe (i.e. channel). 452 */ 453 spin_lock_irqsave(&dev->lock, irq_flags); 454 for (;;) { 455 /* First read the channel, 0 means the end of the list */ 456 struct goldfish_pipe *pipe; 457 unsigned long wakes; 458 unsigned long channel = 0; 459 460 #ifdef CONFIG_64BIT 461 channel = (u64)readl(dev->base + PIPE_REG_CHANNEL_HIGH) << 32; 462 463 if (channel == 0) 464 break; 465 #endif 466 channel |= readl(dev->base + PIPE_REG_CHANNEL); 467 468 if (channel == 0) 469 break; 470 471 /* Convert channel to struct pipe pointer + read wake flags */ 472 wakes = readl(dev->base + PIPE_REG_WAKES); 473 pipe = (struct goldfish_pipe *)(ptrdiff_t)channel; 474 475 /* Did the emulator just closed a pipe? */ 476 if (wakes & PIPE_WAKE_CLOSED) { 477 set_bit(BIT_CLOSED_ON_HOST, &pipe->flags); 478 wakes |= PIPE_WAKE_READ | PIPE_WAKE_WRITE; 479 } 480 if (wakes & PIPE_WAKE_READ) 481 clear_bit(BIT_WAKE_ON_READ, &pipe->flags); 482 if (wakes & PIPE_WAKE_WRITE) 483 clear_bit(BIT_WAKE_ON_WRITE, &pipe->flags); 484 485 wake_up_interruptible(&pipe->wake_queue); 486 count++; 487 } 488 spin_unlock_irqrestore(&dev->lock, irq_flags); 489 490 return (count == 0) ? IRQ_NONE : IRQ_HANDLED; 491 } 492 493 /** 494 * goldfish_pipe_open - open a channel to the AVD 495 * @inode: inode of device 496 * @file: file struct of opener 497 * 498 * Create a new pipe link between the emulator and the use application. 499 * Each new request produces a new pipe. 500 * 501 * Note: we use the pipe ID as a mux. All goldfish emulations are 32bit 502 * right now so this is fine. A move to 64bit will need this addressing 503 */ 504 static int goldfish_pipe_open(struct inode *inode, struct file *file) 505 { 506 struct goldfish_pipe *pipe; 507 struct goldfish_pipe_dev *dev = pipe_dev; 508 int32_t status; 509 510 /* Allocate new pipe kernel object */ 511 pipe = kzalloc(sizeof(*pipe), GFP_KERNEL); 512 if (pipe == NULL) 513 return -ENOMEM; 514 515 pipe->dev = dev; 516 mutex_init(&pipe->lock); 517 init_waitqueue_head(&pipe->wake_queue); 518 519 /* 520 * Now, tell the emulator we're opening a new pipe. We use the 521 * pipe object's address as the channel identifier for simplicity. 522 */ 523 524 status = goldfish_cmd_status(pipe, CMD_OPEN); 525 if (status < 0) { 526 kfree(pipe); 527 return status; 528 } 529 530 /* All is done, save the pipe into the file's private data field */ 531 file->private_data = pipe; 532 return 0; 533 } 534 535 static int goldfish_pipe_release(struct inode *inode, struct file *filp) 536 { 537 struct goldfish_pipe *pipe = filp->private_data; 538 539 /* The guest is closing the channel, so tell the emulator right now */ 540 goldfish_cmd(pipe, CMD_CLOSE); 541 kfree(pipe); 542 filp->private_data = NULL; 543 return 0; 544 } 545 546 static const struct file_operations goldfish_pipe_fops = { 547 .owner = THIS_MODULE, 548 .read = goldfish_pipe_read, 549 .write = goldfish_pipe_write, 550 .poll = goldfish_pipe_poll, 551 .open = goldfish_pipe_open, 552 .release = goldfish_pipe_release, 553 }; 554 555 static struct miscdevice goldfish_pipe_device = { 556 .minor = MISC_DYNAMIC_MINOR, 557 .name = "goldfish_pipe", 558 .fops = &goldfish_pipe_fops, 559 }; 560 561 static int goldfish_pipe_probe(struct platform_device *pdev) 562 { 563 int err; 564 struct resource *r; 565 struct goldfish_pipe_dev *dev = pipe_dev; 566 567 /* not thread safe, but this should not happen */ 568 WARN_ON(dev->base != NULL); 569 570 spin_lock_init(&dev->lock); 571 572 r = platform_get_resource(pdev, IORESOURCE_MEM, 0); 573 if (r == NULL || resource_size(r) < PAGE_SIZE) { 574 dev_err(&pdev->dev, "can't allocate i/o page\n"); 575 return -EINVAL; 576 } 577 dev->base = devm_ioremap(&pdev->dev, r->start, PAGE_SIZE); 578 if (dev->base == NULL) { 579 dev_err(&pdev->dev, "ioremap failed\n"); 580 return -EINVAL; 581 } 582 583 r = platform_get_resource(pdev, IORESOURCE_IRQ, 0); 584 if (r == NULL) { 585 err = -EINVAL; 586 goto error; 587 } 588 dev->irq = r->start; 589 590 err = devm_request_irq(&pdev->dev, dev->irq, goldfish_pipe_interrupt, 591 IRQF_SHARED, "goldfish_pipe", dev); 592 if (err) { 593 dev_err(&pdev->dev, "unable to allocate IRQ\n"); 594 goto error; 595 } 596 597 err = misc_register(&goldfish_pipe_device); 598 if (err) { 599 dev_err(&pdev->dev, "unable to register device\n"); 600 goto error; 601 } 602 setup_access_params_addr(pdev, dev); 603 return 0; 604 605 error: 606 dev->base = NULL; 607 return err; 608 } 609 610 static int goldfish_pipe_remove(struct platform_device *pdev) 611 { 612 struct goldfish_pipe_dev *dev = pipe_dev; 613 misc_deregister(&goldfish_pipe_device); 614 dev->base = NULL; 615 return 0; 616 } 617 618 static struct platform_driver goldfish_pipe = { 619 .probe = goldfish_pipe_probe, 620 .remove = goldfish_pipe_remove, 621 .driver = { 622 .name = "goldfish_pipe" 623 } 624 }; 625 626 module_platform_driver(goldfish_pipe); 627 MODULE_AUTHOR("David Turner <digit@google.com>"); 628 MODULE_LICENSE("GPL"); 629