1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (c) 2016, Linaro Ltd. 4 * Copyright (c) 2012, Michal Simek <monstr@monstr.eu> 5 * Copyright (c) 2012, PetaLogix 6 * Copyright (c) 2011, Texas Instruments, Inc. 7 * Copyright (c) 2011, Google, Inc. 8 * 9 * Based on rpmsg performance statistics driver by Michal Simek, which in turn 10 * was based on TI & Google OMX rpmsg driver. 11 */ 12 #include <linux/cdev.h> 13 #include <linux/device.h> 14 #include <linux/fs.h> 15 #include <linux/idr.h> 16 #include <linux/kernel.h> 17 #include <linux/module.h> 18 #include <linux/poll.h> 19 #include <linux/rpmsg.h> 20 #include <linux/skbuff.h> 21 #include <linux/slab.h> 22 #include <linux/uaccess.h> 23 #include <uapi/linux/rpmsg.h> 24 25 #include "rpmsg_internal.h" 26 27 #define RPMSG_DEV_MAX (MINORMASK + 1) 28 29 static dev_t rpmsg_major; 30 static struct class *rpmsg_class; 31 32 static DEFINE_IDA(rpmsg_ctrl_ida); 33 static DEFINE_IDA(rpmsg_ept_ida); 34 static DEFINE_IDA(rpmsg_minor_ida); 35 36 #define dev_to_eptdev(dev) container_of(dev, struct rpmsg_eptdev, dev) 37 #define cdev_to_eptdev(i_cdev) container_of(i_cdev, struct rpmsg_eptdev, cdev) 38 39 #define dev_to_ctrldev(dev) container_of(dev, struct rpmsg_ctrldev, dev) 40 #define cdev_to_ctrldev(i_cdev) container_of(i_cdev, struct rpmsg_ctrldev, cdev) 41 42 /** 43 * struct rpmsg_ctrldev - control device for instantiating endpoint devices 44 * @rpdev: underlaying rpmsg device 45 * @cdev: cdev for the ctrl device 46 * @dev: device for the ctrl device 47 */ 48 struct rpmsg_ctrldev { 49 struct rpmsg_device *rpdev; 50 struct cdev cdev; 51 struct device dev; 52 }; 53 54 /** 55 * struct rpmsg_eptdev - endpoint device context 56 * @dev: endpoint device 57 * @cdev: cdev for the endpoint device 58 * @rpdev: underlaying rpmsg device 59 * @chinfo: info used to open the endpoint 60 * @ept_lock: synchronization of @ept modifications 61 * @ept: rpmsg endpoint reference, when open 62 * @queue_lock: synchronization of @queue operations 63 * @queue: incoming message queue 64 * @readq: wait object for incoming queue 65 */ 66 struct rpmsg_eptdev { 67 struct device dev; 68 struct cdev cdev; 69 70 struct rpmsg_device *rpdev; 71 struct rpmsg_channel_info chinfo; 72 73 struct mutex ept_lock; 74 struct rpmsg_endpoint *ept; 75 76 spinlock_t queue_lock; 77 struct sk_buff_head queue; 78 wait_queue_head_t readq; 79 }; 80 81 static int rpmsg_eptdev_destroy(struct device *dev, void *data) 82 { 83 struct rpmsg_eptdev *eptdev = dev_to_eptdev(dev); 84 85 mutex_lock(&eptdev->ept_lock); 86 if (eptdev->ept) { 87 rpmsg_destroy_ept(eptdev->ept); 88 eptdev->ept = NULL; 89 } 90 mutex_unlock(&eptdev->ept_lock); 91 92 /* wake up any blocked readers */ 93 wake_up_interruptible(&eptdev->readq); 94 95 device_del(&eptdev->dev); 96 put_device(&eptdev->dev); 97 98 return 0; 99 } 100 101 static int rpmsg_ept_cb(struct rpmsg_device *rpdev, void *buf, int len, 102 void *priv, u32 addr) 103 { 104 struct rpmsg_eptdev *eptdev = priv; 105 struct sk_buff *skb; 106 107 skb = alloc_skb(len, GFP_ATOMIC); 108 if (!skb) 109 return -ENOMEM; 110 111 skb_put_data(skb, buf, len); 112 113 spin_lock(&eptdev->queue_lock); 114 skb_queue_tail(&eptdev->queue, skb); 115 spin_unlock(&eptdev->queue_lock); 116 117 /* wake up any blocking processes, waiting for new data */ 118 wake_up_interruptible(&eptdev->readq); 119 120 return 0; 121 } 122 123 static int rpmsg_eptdev_open(struct inode *inode, struct file *filp) 124 { 125 struct rpmsg_eptdev *eptdev = cdev_to_eptdev(inode->i_cdev); 126 struct rpmsg_endpoint *ept; 127 struct rpmsg_device *rpdev = eptdev->rpdev; 128 struct device *dev = &eptdev->dev; 129 130 get_device(dev); 131 132 ept = rpmsg_create_ept(rpdev, rpmsg_ept_cb, eptdev, eptdev->chinfo); 133 if (!ept) { 134 dev_err(dev, "failed to open %s\n", eptdev->chinfo.name); 135 put_device(dev); 136 return -EINVAL; 137 } 138 139 eptdev->ept = ept; 140 filp->private_data = eptdev; 141 142 return 0; 143 } 144 145 static int rpmsg_eptdev_release(struct inode *inode, struct file *filp) 146 { 147 struct rpmsg_eptdev *eptdev = cdev_to_eptdev(inode->i_cdev); 148 struct device *dev = &eptdev->dev; 149 struct sk_buff *skb; 150 151 /* Close the endpoint, if it's not already destroyed by the parent */ 152 mutex_lock(&eptdev->ept_lock); 153 if (eptdev->ept) { 154 rpmsg_destroy_ept(eptdev->ept); 155 eptdev->ept = NULL; 156 } 157 mutex_unlock(&eptdev->ept_lock); 158 159 /* Discard all SKBs */ 160 while (!skb_queue_empty(&eptdev->queue)) { 161 skb = skb_dequeue(&eptdev->queue); 162 kfree_skb(skb); 163 } 164 165 put_device(dev); 166 167 return 0; 168 } 169 170 static ssize_t rpmsg_eptdev_read_iter(struct kiocb *iocb, struct iov_iter *to) 171 { 172 struct file *filp = iocb->ki_filp; 173 struct rpmsg_eptdev *eptdev = filp->private_data; 174 unsigned long flags; 175 struct sk_buff *skb; 176 int use; 177 178 if (!eptdev->ept) 179 return -EPIPE; 180 181 spin_lock_irqsave(&eptdev->queue_lock, flags); 182 183 /* Wait for data in the queue */ 184 if (skb_queue_empty(&eptdev->queue)) { 185 spin_unlock_irqrestore(&eptdev->queue_lock, flags); 186 187 if (filp->f_flags & O_NONBLOCK) 188 return -EAGAIN; 189 190 /* Wait until we get data or the endpoint goes away */ 191 if (wait_event_interruptible(eptdev->readq, 192 !skb_queue_empty(&eptdev->queue) || 193 !eptdev->ept)) 194 return -ERESTARTSYS; 195 196 /* We lost the endpoint while waiting */ 197 if (!eptdev->ept) 198 return -EPIPE; 199 200 spin_lock_irqsave(&eptdev->queue_lock, flags); 201 } 202 203 skb = skb_dequeue(&eptdev->queue); 204 spin_unlock_irqrestore(&eptdev->queue_lock, flags); 205 if (!skb) 206 return -EFAULT; 207 208 use = min_t(size_t, iov_iter_count(to), skb->len); 209 if (copy_to_iter(skb->data, use, to) != use) 210 use = -EFAULT; 211 212 kfree_skb(skb); 213 214 return use; 215 } 216 217 static ssize_t rpmsg_eptdev_write_iter(struct kiocb *iocb, 218 struct iov_iter *from) 219 { 220 struct file *filp = iocb->ki_filp; 221 struct rpmsg_eptdev *eptdev = filp->private_data; 222 size_t len = iov_iter_count(from); 223 void *kbuf; 224 int ret; 225 226 kbuf = kzalloc(len, GFP_KERNEL); 227 if (!kbuf) 228 return -ENOMEM; 229 230 if (!copy_from_iter_full(kbuf, len, from)) 231 return -EFAULT; 232 233 if (mutex_lock_interruptible(&eptdev->ept_lock)) { 234 ret = -ERESTARTSYS; 235 goto free_kbuf; 236 } 237 238 if (!eptdev->ept) { 239 ret = -EPIPE; 240 goto unlock_eptdev; 241 } 242 243 if (filp->f_flags & O_NONBLOCK) 244 ret = rpmsg_trysend(eptdev->ept, kbuf, len); 245 else 246 ret = rpmsg_send(eptdev->ept, kbuf, len); 247 248 unlock_eptdev: 249 mutex_unlock(&eptdev->ept_lock); 250 251 free_kbuf: 252 kfree(kbuf); 253 return ret < 0 ? ret : len; 254 } 255 256 static __poll_t rpmsg_eptdev_poll(struct file *filp, poll_table *wait) 257 { 258 struct rpmsg_eptdev *eptdev = filp->private_data; 259 __poll_t mask = 0; 260 261 if (!eptdev->ept) 262 return EPOLLERR; 263 264 poll_wait(filp, &eptdev->readq, wait); 265 266 if (!skb_queue_empty(&eptdev->queue)) 267 mask |= EPOLLIN | EPOLLRDNORM; 268 269 mask |= rpmsg_poll(eptdev->ept, filp, wait); 270 271 return mask; 272 } 273 274 static long rpmsg_eptdev_ioctl(struct file *fp, unsigned int cmd, 275 unsigned long arg) 276 { 277 struct rpmsg_eptdev *eptdev = fp->private_data; 278 279 if (cmd != RPMSG_DESTROY_EPT_IOCTL) 280 return -EINVAL; 281 282 return rpmsg_eptdev_destroy(&eptdev->dev, NULL); 283 } 284 285 static const struct file_operations rpmsg_eptdev_fops = { 286 .owner = THIS_MODULE, 287 .open = rpmsg_eptdev_open, 288 .release = rpmsg_eptdev_release, 289 .read_iter = rpmsg_eptdev_read_iter, 290 .write_iter = rpmsg_eptdev_write_iter, 291 .poll = rpmsg_eptdev_poll, 292 .unlocked_ioctl = rpmsg_eptdev_ioctl, 293 .compat_ioctl = rpmsg_eptdev_ioctl, 294 }; 295 296 static ssize_t name_show(struct device *dev, struct device_attribute *attr, 297 char *buf) 298 { 299 struct rpmsg_eptdev *eptdev = dev_get_drvdata(dev); 300 301 return sprintf(buf, "%s\n", eptdev->chinfo.name); 302 } 303 static DEVICE_ATTR_RO(name); 304 305 static ssize_t src_show(struct device *dev, struct device_attribute *attr, 306 char *buf) 307 { 308 struct rpmsg_eptdev *eptdev = dev_get_drvdata(dev); 309 310 return sprintf(buf, "%d\n", eptdev->chinfo.src); 311 } 312 static DEVICE_ATTR_RO(src); 313 314 static ssize_t dst_show(struct device *dev, struct device_attribute *attr, 315 char *buf) 316 { 317 struct rpmsg_eptdev *eptdev = dev_get_drvdata(dev); 318 319 return sprintf(buf, "%d\n", eptdev->chinfo.dst); 320 } 321 static DEVICE_ATTR_RO(dst); 322 323 static struct attribute *rpmsg_eptdev_attrs[] = { 324 &dev_attr_name.attr, 325 &dev_attr_src.attr, 326 &dev_attr_dst.attr, 327 NULL 328 }; 329 ATTRIBUTE_GROUPS(rpmsg_eptdev); 330 331 static void rpmsg_eptdev_release_device(struct device *dev) 332 { 333 struct rpmsg_eptdev *eptdev = dev_to_eptdev(dev); 334 335 ida_simple_remove(&rpmsg_ept_ida, dev->id); 336 ida_simple_remove(&rpmsg_minor_ida, MINOR(eptdev->dev.devt)); 337 cdev_del(&eptdev->cdev); 338 kfree(eptdev); 339 } 340 341 static int rpmsg_eptdev_create(struct rpmsg_ctrldev *ctrldev, 342 struct rpmsg_channel_info chinfo) 343 { 344 struct rpmsg_device *rpdev = ctrldev->rpdev; 345 struct rpmsg_eptdev *eptdev; 346 struct device *dev; 347 int ret; 348 349 eptdev = kzalloc(sizeof(*eptdev), GFP_KERNEL); 350 if (!eptdev) 351 return -ENOMEM; 352 353 dev = &eptdev->dev; 354 eptdev->rpdev = rpdev; 355 eptdev->chinfo = chinfo; 356 357 mutex_init(&eptdev->ept_lock); 358 spin_lock_init(&eptdev->queue_lock); 359 skb_queue_head_init(&eptdev->queue); 360 init_waitqueue_head(&eptdev->readq); 361 362 device_initialize(dev); 363 dev->class = rpmsg_class; 364 dev->parent = &ctrldev->dev; 365 dev->groups = rpmsg_eptdev_groups; 366 dev_set_drvdata(dev, eptdev); 367 368 cdev_init(&eptdev->cdev, &rpmsg_eptdev_fops); 369 eptdev->cdev.owner = THIS_MODULE; 370 371 ret = ida_simple_get(&rpmsg_minor_ida, 0, RPMSG_DEV_MAX, GFP_KERNEL); 372 if (ret < 0) 373 goto free_eptdev; 374 dev->devt = MKDEV(MAJOR(rpmsg_major), ret); 375 376 ret = ida_simple_get(&rpmsg_ept_ida, 0, 0, GFP_KERNEL); 377 if (ret < 0) 378 goto free_minor_ida; 379 dev->id = ret; 380 dev_set_name(dev, "rpmsg%d", ret); 381 382 ret = cdev_add(&eptdev->cdev, dev->devt, 1); 383 if (ret) 384 goto free_ept_ida; 385 386 /* We can now rely on the release function for cleanup */ 387 dev->release = rpmsg_eptdev_release_device; 388 389 ret = device_add(dev); 390 if (ret) { 391 dev_err(dev, "device_add failed: %d\n", ret); 392 put_device(dev); 393 } 394 395 return ret; 396 397 free_ept_ida: 398 ida_simple_remove(&rpmsg_ept_ida, dev->id); 399 free_minor_ida: 400 ida_simple_remove(&rpmsg_minor_ida, MINOR(dev->devt)); 401 free_eptdev: 402 put_device(dev); 403 kfree(eptdev); 404 405 return ret; 406 } 407 408 static int rpmsg_ctrldev_open(struct inode *inode, struct file *filp) 409 { 410 struct rpmsg_ctrldev *ctrldev = cdev_to_ctrldev(inode->i_cdev); 411 412 get_device(&ctrldev->dev); 413 filp->private_data = ctrldev; 414 415 return 0; 416 } 417 418 static int rpmsg_ctrldev_release(struct inode *inode, struct file *filp) 419 { 420 struct rpmsg_ctrldev *ctrldev = cdev_to_ctrldev(inode->i_cdev); 421 422 put_device(&ctrldev->dev); 423 424 return 0; 425 } 426 427 static long rpmsg_ctrldev_ioctl(struct file *fp, unsigned int cmd, 428 unsigned long arg) 429 { 430 struct rpmsg_ctrldev *ctrldev = fp->private_data; 431 void __user *argp = (void __user *)arg; 432 struct rpmsg_endpoint_info eptinfo; 433 struct rpmsg_channel_info chinfo; 434 435 if (cmd != RPMSG_CREATE_EPT_IOCTL) 436 return -EINVAL; 437 438 if (copy_from_user(&eptinfo, argp, sizeof(eptinfo))) 439 return -EFAULT; 440 441 memcpy(chinfo.name, eptinfo.name, RPMSG_NAME_SIZE); 442 chinfo.name[RPMSG_NAME_SIZE-1] = '\0'; 443 chinfo.src = eptinfo.src; 444 chinfo.dst = eptinfo.dst; 445 446 return rpmsg_eptdev_create(ctrldev, chinfo); 447 }; 448 449 static const struct file_operations rpmsg_ctrldev_fops = { 450 .owner = THIS_MODULE, 451 .open = rpmsg_ctrldev_open, 452 .release = rpmsg_ctrldev_release, 453 .unlocked_ioctl = rpmsg_ctrldev_ioctl, 454 .compat_ioctl = rpmsg_ctrldev_ioctl, 455 }; 456 457 static void rpmsg_ctrldev_release_device(struct device *dev) 458 { 459 struct rpmsg_ctrldev *ctrldev = dev_to_ctrldev(dev); 460 461 ida_simple_remove(&rpmsg_ctrl_ida, dev->id); 462 ida_simple_remove(&rpmsg_minor_ida, MINOR(dev->devt)); 463 cdev_del(&ctrldev->cdev); 464 kfree(ctrldev); 465 } 466 467 static int rpmsg_chrdev_probe(struct rpmsg_device *rpdev) 468 { 469 struct rpmsg_ctrldev *ctrldev; 470 struct device *dev; 471 int ret; 472 473 ctrldev = kzalloc(sizeof(*ctrldev), GFP_KERNEL); 474 if (!ctrldev) 475 return -ENOMEM; 476 477 ctrldev->rpdev = rpdev; 478 479 dev = &ctrldev->dev; 480 device_initialize(dev); 481 dev->parent = &rpdev->dev; 482 dev->class = rpmsg_class; 483 484 cdev_init(&ctrldev->cdev, &rpmsg_ctrldev_fops); 485 ctrldev->cdev.owner = THIS_MODULE; 486 487 ret = ida_simple_get(&rpmsg_minor_ida, 0, RPMSG_DEV_MAX, GFP_KERNEL); 488 if (ret < 0) 489 goto free_ctrldev; 490 dev->devt = MKDEV(MAJOR(rpmsg_major), ret); 491 492 ret = ida_simple_get(&rpmsg_ctrl_ida, 0, 0, GFP_KERNEL); 493 if (ret < 0) 494 goto free_minor_ida; 495 dev->id = ret; 496 dev_set_name(&ctrldev->dev, "rpmsg_ctrl%d", ret); 497 498 ret = cdev_add(&ctrldev->cdev, dev->devt, 1); 499 if (ret) 500 goto free_ctrl_ida; 501 502 /* We can now rely on the release function for cleanup */ 503 dev->release = rpmsg_ctrldev_release_device; 504 505 ret = device_add(dev); 506 if (ret) { 507 dev_err(&rpdev->dev, "device_add failed: %d\n", ret); 508 put_device(dev); 509 } 510 511 dev_set_drvdata(&rpdev->dev, ctrldev); 512 513 return ret; 514 515 free_ctrl_ida: 516 ida_simple_remove(&rpmsg_ctrl_ida, dev->id); 517 free_minor_ida: 518 ida_simple_remove(&rpmsg_minor_ida, MINOR(dev->devt)); 519 free_ctrldev: 520 put_device(dev); 521 kfree(ctrldev); 522 523 return ret; 524 } 525 526 static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev) 527 { 528 struct rpmsg_ctrldev *ctrldev = dev_get_drvdata(&rpdev->dev); 529 int ret; 530 531 /* Destroy all endpoints */ 532 ret = device_for_each_child(&ctrldev->dev, NULL, rpmsg_eptdev_destroy); 533 if (ret) 534 dev_warn(&rpdev->dev, "failed to nuke endpoints: %d\n", ret); 535 536 device_del(&ctrldev->dev); 537 put_device(&ctrldev->dev); 538 } 539 540 static struct rpmsg_driver rpmsg_chrdev_driver = { 541 .probe = rpmsg_chrdev_probe, 542 .remove = rpmsg_chrdev_remove, 543 .drv = { 544 .name = "rpmsg_chrdev", 545 }, 546 }; 547 548 static int rpmsg_char_init(void) 549 { 550 int ret; 551 552 ret = alloc_chrdev_region(&rpmsg_major, 0, RPMSG_DEV_MAX, "rpmsg"); 553 if (ret < 0) { 554 pr_err("rpmsg: failed to allocate char dev region\n"); 555 return ret; 556 } 557 558 rpmsg_class = class_create(THIS_MODULE, "rpmsg"); 559 if (IS_ERR(rpmsg_class)) { 560 pr_err("failed to create rpmsg class\n"); 561 unregister_chrdev_region(rpmsg_major, RPMSG_DEV_MAX); 562 return PTR_ERR(rpmsg_class); 563 } 564 565 ret = register_rpmsg_driver(&rpmsg_chrdev_driver); 566 if (ret < 0) { 567 pr_err("rpmsgchr: failed to register rpmsg driver\n"); 568 class_destroy(rpmsg_class); 569 unregister_chrdev_region(rpmsg_major, RPMSG_DEV_MAX); 570 } 571 572 return ret; 573 } 574 postcore_initcall(rpmsg_char_init); 575 576 static void rpmsg_chrdev_exit(void) 577 { 578 unregister_rpmsg_driver(&rpmsg_chrdev_driver); 579 class_destroy(rpmsg_class); 580 unregister_chrdev_region(rpmsg_major, RPMSG_DEV_MAX); 581 } 582 module_exit(rpmsg_chrdev_exit); 583 584 MODULE_ALIAS("rpmsg:rpmsg_chrdev"); 585 MODULE_LICENSE("GPL v2"); 586