projects/linux·blob master · refs

1451 lines · 35.5 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Mediated virtual PCI display host device driver
4 *
5 * Emulate enough of qemu stdvga to make bochs-drm.ko happy. That is
6 * basically the vram memory bar and the bochs dispi interface vbe
7 * registers in the mmio register bar. Specifically it does *not*
8 * include any legacy vga stuff. Device looks a lot like "qemu -device
9 * secondary-vga".
10 *
11 * (c) Gerd Hoffmann <[email protected]>
12 *
13 * based on mtty driver which is:
14 * Copyright (c) 2016, NVIDIA CORPORATION. All rights reserved.
15 * Author: Neo Jia <[email protected]>
16 * Kirti Wankhede <[email protected]>
17 *
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License version 2 as
20 * published by the Free Software Foundation.
21 */
22#include <linux/init.h>
23#include <linux/module.h>
24#include <linux/kernel.h>
25#include <linux/slab.h>
26#include <linux/vmalloc.h>
27#include <linux/cdev.h>
28#include <linux/vfio.h>
29#include <linux/iommu.h>
30#include <linux/sysfs.h>
31#include <linux/mdev.h>
32#include <linux/pci.h>
33#include <linux/dma-buf.h>
34#include <linux/highmem.h>
35#include <drm/drm_fourcc.h>
36#include <drm/drm_rect.h>
37#include <drm/drm_modeset_lock.h>
38#include <drm/drm_property.h>
39#include <drm/drm_plane.h>
40
41
42#define VBE_DISPI_INDEX_ID 0x0
43#define VBE_DISPI_INDEX_XRES 0x1
44#define VBE_DISPI_INDEX_YRES 0x2
45#define VBE_DISPI_INDEX_BPP 0x3
46#define VBE_DISPI_INDEX_ENABLE 0x4
47#define VBE_DISPI_INDEX_BANK 0x5
48#define VBE_DISPI_INDEX_VIRT_WIDTH 0x6
49#define VBE_DISPI_INDEX_VIRT_HEIGHT 0x7
50#define VBE_DISPI_INDEX_X_OFFSET 0x8
51#define VBE_DISPI_INDEX_Y_OFFSET 0x9
52#define VBE_DISPI_INDEX_VIDEO_MEMORY_64K 0xa
53#define VBE_DISPI_INDEX_COUNT 0xb
54
55#define VBE_DISPI_ID0 0xB0C0
56#define VBE_DISPI_ID1 0xB0C1
57#define VBE_DISPI_ID2 0xB0C2
58#define VBE_DISPI_ID3 0xB0C3
59#define VBE_DISPI_ID4 0xB0C4
60#define VBE_DISPI_ID5 0xB0C5
61
62#define VBE_DISPI_DISABLED 0x00
63#define VBE_DISPI_ENABLED 0x01
64#define VBE_DISPI_GETCAPS 0x02
65#define VBE_DISPI_8BIT_DAC 0x20
66#define VBE_DISPI_LFB_ENABLED 0x40
67#define VBE_DISPI_NOCLEARMEM 0x80
68
69
70#define MBOCHS_NAME "mbochs"
71#define MBOCHS_CLASS_NAME "mbochs"
72
73#define MBOCHS_EDID_REGION_INDEX VFIO_PCI_NUM_REGIONS
74#define MBOCHS_NUM_REGIONS (MBOCHS_EDID_REGION_INDEX+1)
75
76#define MBOCHS_CONFIG_SPACE_SIZE 0xff
77#define MBOCHS_MMIO_BAR_OFFSET PAGE_SIZE
78#define MBOCHS_MMIO_BAR_SIZE PAGE_SIZE
79#define MBOCHS_EDID_OFFSET (MBOCHS_MMIO_BAR_OFFSET + \
80 MBOCHS_MMIO_BAR_SIZE)
81#define MBOCHS_EDID_SIZE PAGE_SIZE
82#define MBOCHS_MEMORY_BAR_OFFSET (MBOCHS_EDID_OFFSET + \
83 MBOCHS_EDID_SIZE)
84
85#define MBOCHS_EDID_BLOB_OFFSET (MBOCHS_EDID_SIZE/2)
86
87#define STORE_LE16(addr, val) (*(u16 *)addr = val)
88#define STORE_LE32(addr, val) (*(u32 *)addr = val)
89
90
91MODULE_DESCRIPTION("Mediated virtual PCI display host device driver");
92MODULE_LICENSE("GPL v2");
93
94static int max_mbytes = 256;
95module_param_named(count, max_mbytes, int, 0444);
96MODULE_PARM_DESC(mem, "megabytes available to " MBOCHS_NAME " devices");
97
98
99#define MBOCHS_TYPE_1 "small"
100#define MBOCHS_TYPE_2 "medium"
101#define MBOCHS_TYPE_3 "large"
102
103static struct mbochs_type {
104 struct mdev_type type;
105 u32 mbytes;
106 u32 max_x;
107 u32 max_y;
108} mbochs_types[] = {
109 {
110 .type.sysfs_name = MBOCHS_TYPE_1,
111 .type.pretty_name = MBOCHS_CLASS_NAME "-" MBOCHS_TYPE_1,
112 .mbytes = 4,
113 .max_x = 800,
114 .max_y = 600,
115 }, {
116 .type.sysfs_name = MBOCHS_TYPE_2,
117 .type.pretty_name = MBOCHS_CLASS_NAME "-" MBOCHS_TYPE_2,
118 .mbytes = 16,
119 .max_x = 1920,
120 .max_y = 1440,
121 }, {
122 .type.sysfs_name = MBOCHS_TYPE_3,
123 .type.pretty_name = MBOCHS_CLASS_NAME "-" MBOCHS_TYPE_3,
124 .mbytes = 64,
125 .max_x = 0,
126 .max_y = 0,
127 },
128};
129
130static struct mdev_type *mbochs_mdev_types[] = {
131 &mbochs_types[0].type,
132 &mbochs_types[1].type,
133 &mbochs_types[2].type,
134};
135
136static dev_t mbochs_devt;
137static const struct class mbochs_class = {
138 .name = MBOCHS_CLASS_NAME,
139};
140static struct cdev mbochs_cdev;
141static struct device mbochs_dev;
142static struct mdev_parent mbochs_parent;
143static atomic_t mbochs_avail_mbytes;
144static const struct vfio_device_ops mbochs_dev_ops;
145
146struct mbochs_mode {
147 u32 drm_format;
148 u32 bytepp;
149 u32 width;
150 u32 height;
151 u32 stride;
152 u32 __pad;
153 u64 offset;
154 u64 size;
155};
156
157struct mbochs_dmabuf {
158 struct mbochs_mode mode;
159 u32 id;
160 struct page **pages;
161 pgoff_t pagecount;
162 struct dma_buf *buf;
163 struct mdev_state *mdev_state;
164 struct list_head next;
165 bool unlinked;
166};
167
168/* State of each mdev device */
169struct mdev_state {
170 struct vfio_device vdev;
171 u8 *vconfig;
172 u64 bar_mask[3];
173 u32 memory_bar_mask;
174 struct mutex ops_lock;
175 struct mdev_device *mdev;
176
177 const struct mbochs_type *type;
178 u16 vbe[VBE_DISPI_INDEX_COUNT];
179 u64 memsize;
180 struct page **pages;
181 pgoff_t pagecount;
182 struct vfio_region_gfx_edid edid_regs;
183 u8 edid_blob[0x400];
184
185 struct list_head dmabufs;
186 u32 active_id;
187 u32 next_id;
188};
189
190static const char *vbe_name_list[VBE_DISPI_INDEX_COUNT] = {
191 [VBE_DISPI_INDEX_ID] = "id",
192 [VBE_DISPI_INDEX_XRES] = "xres",
193 [VBE_DISPI_INDEX_YRES] = "yres",
194 [VBE_DISPI_INDEX_BPP] = "bpp",
195 [VBE_DISPI_INDEX_ENABLE] = "enable",
196 [VBE_DISPI_INDEX_BANK] = "bank",
197 [VBE_DISPI_INDEX_VIRT_WIDTH] = "virt-width",
198 [VBE_DISPI_INDEX_VIRT_HEIGHT] = "virt-height",
199 [VBE_DISPI_INDEX_X_OFFSET] = "x-offset",
200 [VBE_DISPI_INDEX_Y_OFFSET] = "y-offset",
201 [VBE_DISPI_INDEX_VIDEO_MEMORY_64K] = "video-mem",
202};
203
204static const char *vbe_name(u32 index)
205{
206 if (index < ARRAY_SIZE(vbe_name_list))
207 return vbe_name_list[index];
208 return "(invalid)";
209}
210
211static struct page *__mbochs_get_page(struct mdev_state *mdev_state,
212 pgoff_t pgoff);
213static struct page *mbochs_get_page(struct mdev_state *mdev_state,
214 pgoff_t pgoff);
215
216static void mbochs_create_config_space(struct mdev_state *mdev_state)
217{
218 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_VENDOR_ID],
219 0x1234);
220 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_DEVICE_ID],
221 0x1111);
222 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_SUBSYSTEM_VENDOR_ID],
223 PCI_SUBVENDOR_ID_REDHAT_QUMRANET);
224 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_SUBSYSTEM_ID],
225 PCI_SUBDEVICE_ID_QEMU);
226
227 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_COMMAND],
228 PCI_COMMAND_IO | PCI_COMMAND_MEMORY);
229 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_CLASS_DEVICE],
230 PCI_CLASS_DISPLAY_OTHER);
231 mdev_state->vconfig[PCI_CLASS_REVISION] = 0x01;
232
233 STORE_LE32((u32 *) &mdev_state->vconfig[PCI_BASE_ADDRESS_0],
234 PCI_BASE_ADDRESS_SPACE_MEMORY |
235 PCI_BASE_ADDRESS_MEM_TYPE_32 |
236 PCI_BASE_ADDRESS_MEM_PREFETCH);
237 mdev_state->bar_mask[0] = ~(mdev_state->memsize) + 1;
238
239 STORE_LE32((u32 *) &mdev_state->vconfig[PCI_BASE_ADDRESS_2],
240 PCI_BASE_ADDRESS_SPACE_MEMORY |
241 PCI_BASE_ADDRESS_MEM_TYPE_32);
242 mdev_state->bar_mask[2] = ~(MBOCHS_MMIO_BAR_SIZE) + 1;
243}
244
245static int mbochs_check_framebuffer(struct mdev_state *mdev_state,
246 struct mbochs_mode *mode)
247{
248 struct device *dev = mdev_dev(mdev_state->mdev);
249 u16 *vbe = mdev_state->vbe;
250 u32 virt_width;
251
252 WARN_ON(!mutex_is_locked(&mdev_state->ops_lock));
253
254 if (!(vbe[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED))
255 goto nofb;
256
257 memset(mode, 0, sizeof(*mode));
258 switch (vbe[VBE_DISPI_INDEX_BPP]) {
259 case 32:
260 mode->drm_format = DRM_FORMAT_XRGB8888;
261 mode->bytepp = 4;
262 break;
263 default:
264 dev_info_ratelimited(dev, "%s: bpp %d not supported\n",
265 __func__, vbe[VBE_DISPI_INDEX_BPP]);
266 goto nofb;
267 }
268
269 mode->width = vbe[VBE_DISPI_INDEX_XRES];
270 mode->height = vbe[VBE_DISPI_INDEX_YRES];
271 virt_width = vbe[VBE_DISPI_INDEX_VIRT_WIDTH];
272 if (virt_width < mode->width)
273 virt_width = mode->width;
274 mode->stride = virt_width * mode->bytepp;
275 mode->size = (u64)mode->stride * mode->height;
276 mode->offset = ((u64)vbe[VBE_DISPI_INDEX_X_OFFSET] * mode->bytepp +
277 (u64)vbe[VBE_DISPI_INDEX_Y_OFFSET] * mode->stride);
278
279 if (mode->width < 64 || mode->height < 64) {
280 dev_info_ratelimited(dev, "%s: invalid resolution %dx%d\n",
281 __func__, mode->width, mode->height);
282 goto nofb;
283 }
284 if (mode->offset + mode->size > mdev_state->memsize) {
285 dev_info_ratelimited(dev, "%s: framebuffer memory overflow\n",
286 __func__);
287 goto nofb;
288 }
289
290 return 0;
291
292nofb:
293 memset(mode, 0, sizeof(*mode));
294 return -EINVAL;
295}
296
297static bool mbochs_modes_equal(struct mbochs_mode *mode1,
298 struct mbochs_mode *mode2)
299{
300 return memcmp(mode1, mode2, sizeof(struct mbochs_mode)) == 0;
301}
302
303static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset,
304 char *buf, u32 count)
305{
306 struct device *dev = mdev_dev(mdev_state->mdev);
307 int index = (offset - PCI_BASE_ADDRESS_0) / 0x04;
308 u32 cfg_addr;
309
310 switch (offset) {
311 case PCI_BASE_ADDRESS_0:
312 case PCI_BASE_ADDRESS_2:
313 cfg_addr = *(u32 *)buf;
314
315 if (cfg_addr == 0xffffffff) {
316 cfg_addr = (cfg_addr & mdev_state->bar_mask[index]);
317 } else {
318 cfg_addr &= PCI_BASE_ADDRESS_MEM_MASK;
319 if (cfg_addr)
320 dev_info(dev, "BAR #%d @ 0x%x\n",
321 index, cfg_addr);
322 }
323
324 cfg_addr |= (mdev_state->vconfig[offset] &
325 ~PCI_BASE_ADDRESS_MEM_MASK);
326 STORE_LE32(&mdev_state->vconfig[offset], cfg_addr);
327 break;
328 }
329}
330
331static void handle_mmio_write(struct mdev_state *mdev_state, u16 offset,
332 char *buf, u32 count)
333{
334 struct device *dev = mdev_dev(mdev_state->mdev);
335 int index;
336 u16 reg16;
337
338 switch (offset) {
339 case 0x400 ... 0x41f: /* vga ioports remapped */
340 goto unhandled;
341 case 0x500 ... 0x515: /* bochs dispi interface */
342 if (count != 2)
343 goto unhandled;
344 index = (offset - 0x500) / 2;
345 reg16 = *(u16 *)buf;
346 if (index < ARRAY_SIZE(mdev_state->vbe))
347 mdev_state->vbe[index] = reg16;
348 dev_dbg(dev, "%s: vbe write %d = %d (%s)\n",
349 __func__, index, reg16, vbe_name(index));
350 break;
351 case 0x600 ... 0x607: /* qemu extended regs */
352 goto unhandled;
353 default:
354unhandled:
355 dev_dbg(dev, "%s: @0x%03x, count %d (unhandled)\n",
356 __func__, offset, count);
357 break;
358 }
359}
360
361static void handle_mmio_read(struct mdev_state *mdev_state, u16 offset,
362 char *buf, u32 count)
363{
364 struct device *dev = mdev_dev(mdev_state->mdev);
365 struct vfio_region_gfx_edid *edid;
366 u16 reg16 = 0;
367 int index;
368
369 switch (offset) {
370 case 0x000 ... 0x3ff: /* edid block */
371 edid = &mdev_state->edid_regs;
372 if (edid->link_state != VFIO_DEVICE_GFX_LINK_STATE_UP ||
373 offset >= edid->edid_size) {
374 memset(buf, 0, count);
375 break;
376 }
377 memcpy(buf, mdev_state->edid_blob + offset, count);
378 break;
379 case 0x500 ... 0x515: /* bochs dispi interface */
380 if (count != 2)
381 goto unhandled;
382 index = (offset - 0x500) / 2;
383 if (index < ARRAY_SIZE(mdev_state->vbe))
384 reg16 = mdev_state->vbe[index];
385 dev_dbg(dev, "%s: vbe read %d = %d (%s)\n",
386 __func__, index, reg16, vbe_name(index));
387 *(u16 *)buf = reg16;
388 break;
389 default:
390unhandled:
391 dev_dbg(dev, "%s: @0x%03x, count %d (unhandled)\n",
392 __func__, offset, count);
393 memset(buf, 0, count);
394 break;
395 }
396}
397
398static void handle_edid_regs(struct mdev_state *mdev_state, u16 offset,
399 char *buf, u32 count, bool is_write)
400{
401 char *regs = (void *)&mdev_state->edid_regs;
402
403 if (offset + count > sizeof(mdev_state->edid_regs))
404 return;
405 if (count != 4)
406 return;
407 if (offset % 4)
408 return;
409
410 if (is_write) {
411 switch (offset) {
412 case offsetof(struct vfio_region_gfx_edid, link_state):
413 case offsetof(struct vfio_region_gfx_edid, edid_size):
414 memcpy(regs + offset, buf, count);
415 break;
416 default:
417 /* read-only regs */
418 break;
419 }
420 } else {
421 memcpy(buf, regs + offset, count);
422 }
423}
424
425static void handle_edid_blob(struct mdev_state *mdev_state, u16 offset,
426 char *buf, u32 count, bool is_write)
427{
428 if (offset + count > mdev_state->edid_regs.edid_max_size)
429 return;
430 if (is_write)
431 memcpy(mdev_state->edid_blob + offset, buf, count);
432 else
433 memcpy(buf, mdev_state->edid_blob + offset, count);
434}
435
436static ssize_t mdev_access(struct mdev_state *mdev_state, char *buf,
437 size_t count, loff_t pos, bool is_write)
438{
439 struct page *pg;
440 loff_t poff;
441 char *map;
442 int ret = 0;
443
444 mutex_lock(&mdev_state->ops_lock);
445
446 if (pos < MBOCHS_CONFIG_SPACE_SIZE) {
447 if (is_write)
448 handle_pci_cfg_write(mdev_state, pos, buf, count);
449 else
450 memcpy(buf, (mdev_state->vconfig + pos), count);
451
452 } else if (pos >= MBOCHS_MMIO_BAR_OFFSET &&
453 pos + count <= (MBOCHS_MMIO_BAR_OFFSET +
454 MBOCHS_MMIO_BAR_SIZE)) {
455 pos -= MBOCHS_MMIO_BAR_OFFSET;
456 if (is_write)
457 handle_mmio_write(mdev_state, pos, buf, count);
458 else
459 handle_mmio_read(mdev_state, pos, buf, count);
460
461 } else if (pos >= MBOCHS_EDID_OFFSET &&
462 pos + count <= (MBOCHS_EDID_OFFSET +
463 MBOCHS_EDID_SIZE)) {
464 pos -= MBOCHS_EDID_OFFSET;
465 if (pos < MBOCHS_EDID_BLOB_OFFSET) {
466 handle_edid_regs(mdev_state, pos, buf, count, is_write);
467 } else {
468 pos -= MBOCHS_EDID_BLOB_OFFSET;
469 handle_edid_blob(mdev_state, pos, buf, count, is_write);
470 }
471
472 } else if (pos >= MBOCHS_MEMORY_BAR_OFFSET &&
473 pos + count <=
474 MBOCHS_MEMORY_BAR_OFFSET + mdev_state->memsize) {
475 pos -= MBOCHS_MMIO_BAR_OFFSET;
476 poff = pos & ~PAGE_MASK;
477 pg = __mbochs_get_page(mdev_state, pos >> PAGE_SHIFT);
478 map = kmap(pg);
479 if (is_write)
480 memcpy(map + poff, buf, count);
481 else
482 memcpy(buf, map + poff, count);
483 kunmap(pg);
484 put_page(pg);
485
486 } else {
487 dev_dbg(mdev_state->vdev.dev, "%s: %s @0x%llx (unhandled)\n",
488 __func__, is_write ? "WR" : "RD", pos);
489 ret = -1;
490 goto accessfailed;
491 }
492
493 ret = count;
494
495
496accessfailed:
497 mutex_unlock(&mdev_state->ops_lock);
498
499 return ret;
500}
501
502static int mbochs_reset(struct mdev_state *mdev_state)
503{
504 u32 size64k = mdev_state->memsize / (64 * 1024);
505 int i;
506
507 for (i = 0; i < ARRAY_SIZE(mdev_state->vbe); i++)
508 mdev_state->vbe[i] = 0;
509 mdev_state->vbe[VBE_DISPI_INDEX_ID] = VBE_DISPI_ID5;
510 mdev_state->vbe[VBE_DISPI_INDEX_VIDEO_MEMORY_64K] = size64k;
511 return 0;
512}
513
514static int mbochs_init_dev(struct vfio_device *vdev)
515{
516 struct mdev_state *mdev_state =
517 container_of(vdev, struct mdev_state, vdev);
518 struct mdev_device *mdev = to_mdev_device(vdev->dev);
519 struct mbochs_type *type =
520 container_of(mdev->type, struct mbochs_type, type);
521 int avail_mbytes = atomic_read(&mbochs_avail_mbytes);
522 int ret = -ENOMEM;
523
524 do {
525 if (avail_mbytes < type->mbytes)
526 return -ENOSPC;
527 } while (!atomic_try_cmpxchg(&mbochs_avail_mbytes, &avail_mbytes,
528 avail_mbytes - type->mbytes));
529
530 mdev_state->vconfig = kzalloc(MBOCHS_CONFIG_SPACE_SIZE, GFP_KERNEL);
531 if (!mdev_state->vconfig)
532 goto err_avail;
533
534 mdev_state->memsize = type->mbytes * 1024 * 1024;
535 mdev_state->pagecount = mdev_state->memsize >> PAGE_SHIFT;
536 mdev_state->pages = kcalloc(mdev_state->pagecount,
537 sizeof(struct page *),
538 GFP_KERNEL);
539 if (!mdev_state->pages)
540 goto err_vconfig;
541
542 mutex_init(&mdev_state->ops_lock);
543 mdev_state->mdev = mdev;
544 INIT_LIST_HEAD(&mdev_state->dmabufs);
545 mdev_state->next_id = 1;
546
547 mdev_state->type = type;
548 mdev_state->edid_regs.max_xres = type->max_x;
549 mdev_state->edid_regs.max_yres = type->max_y;
550 mdev_state->edid_regs.edid_offset = MBOCHS_EDID_BLOB_OFFSET;
551 mdev_state->edid_regs.edid_max_size = sizeof(mdev_state->edid_blob);
552 mbochs_create_config_space(mdev_state);
553 mbochs_reset(mdev_state);
554
555 dev_info(vdev->dev, "%s: %s, %d MB, %ld pages\n", __func__,
556 type->type.pretty_name, type->mbytes, mdev_state->pagecount);
557 return 0;
558
559err_vconfig:
560 kfree(mdev_state->vconfig);
561err_avail:
562 atomic_add(type->mbytes, &mbochs_avail_mbytes);
563 return ret;
564}
565
566static int mbochs_probe(struct mdev_device *mdev)
567{
568 struct mdev_state *mdev_state;
569 int ret = -ENOMEM;
570
571 mdev_state = vfio_alloc_device(mdev_state, vdev, &mdev->dev,
572 &mbochs_dev_ops);
573 if (IS_ERR(mdev_state))
574 return PTR_ERR(mdev_state);
575
576 ret = vfio_register_emulated_iommu_dev(&mdev_state->vdev);
577 if (ret)
578 goto err_put_vdev;
579 dev_set_drvdata(&mdev->dev, mdev_state);
580 return 0;
581
582err_put_vdev:
583 vfio_put_device(&mdev_state->vdev);
584 return ret;
585}
586
587static void mbochs_release_dev(struct vfio_device *vdev)
588{
589 struct mdev_state *mdev_state =
590 container_of(vdev, struct mdev_state, vdev);
591
592 atomic_add(mdev_state->type->mbytes, &mbochs_avail_mbytes);
593 kfree(mdev_state->pages);
594 kfree(mdev_state->vconfig);
595}
596
597static void mbochs_remove(struct mdev_device *mdev)
598{
599 struct mdev_state *mdev_state = dev_get_drvdata(&mdev->dev);
600
601 vfio_unregister_group_dev(&mdev_state->vdev);
602 vfio_put_device(&mdev_state->vdev);
603}
604
605static ssize_t mbochs_read(struct vfio_device *vdev, char __user *buf,
606 size_t count, loff_t *ppos)
607{
608 struct mdev_state *mdev_state =
609 container_of(vdev, struct mdev_state, vdev);
610 unsigned int done = 0;
611 int ret;
612
613 while (count) {
614 size_t filled;
615
616 if (count >= 4 && !(*ppos % 4)) {
617 u32 val;
618
619 ret = mdev_access(mdev_state, (char *)&val, sizeof(val),
620 *ppos, false);
621 if (ret <= 0)
622 goto read_err;
623
624 if (copy_to_user(buf, &val, sizeof(val)))
625 goto read_err;
626
627 filled = 4;
628 } else if (count >= 2 && !(*ppos % 2)) {
629 u16 val;
630
631 ret = mdev_access(mdev_state, (char *)&val, sizeof(val),
632 *ppos, false);
633 if (ret <= 0)
634 goto read_err;
635
636 if (copy_to_user(buf, &val, sizeof(val)))
637 goto read_err;
638
639 filled = 2;
640 } else {
641 u8 val;
642
643 ret = mdev_access(mdev_state, (char *)&val, sizeof(val),
644 *ppos, false);
645 if (ret <= 0)
646 goto read_err;
647
648 if (copy_to_user(buf, &val, sizeof(val)))
649 goto read_err;
650
651 filled = 1;
652 }
653
654 count -= filled;
655 done += filled;
656 *ppos += filled;
657 buf += filled;
658 }
659
660 return done;
661
662read_err:
663 return -EFAULT;
664}
665
666static ssize_t mbochs_write(struct vfio_device *vdev, const char __user *buf,
667 size_t count, loff_t *ppos)
668{
669 struct mdev_state *mdev_state =
670 container_of(vdev, struct mdev_state, vdev);
671 unsigned int done = 0;
672 int ret;
673
674 while (count) {
675 size_t filled;
676
677 if (count >= 4 && !(*ppos % 4)) {
678 u32 val;
679
680 if (copy_from_user(&val, buf, sizeof(val)))
681 goto write_err;
682
683 ret = mdev_access(mdev_state, (char *)&val, sizeof(val),
684 *ppos, true);
685 if (ret <= 0)
686 goto write_err;
687
688 filled = 4;
689 } else if (count >= 2 && !(*ppos % 2)) {
690 u16 val;
691
692 if (copy_from_user(&val, buf, sizeof(val)))
693 goto write_err;
694
695 ret = mdev_access(mdev_state, (char *)&val, sizeof(val),
696 *ppos, true);
697 if (ret <= 0)
698 goto write_err;
699
700 filled = 2;
701 } else {
702 u8 val;
703
704 if (copy_from_user(&val, buf, sizeof(val)))
705 goto write_err;
706
707 ret = mdev_access(mdev_state, (char *)&val, sizeof(val),
708 *ppos, true);
709 if (ret <= 0)
710 goto write_err;
711
712 filled = 1;
713 }
714 count -= filled;
715 done += filled;
716 *ppos += filled;
717 buf += filled;
718 }
719
720 return done;
721write_err:
722 return -EFAULT;
723}
724
725static struct page *__mbochs_get_page(struct mdev_state *mdev_state,
726 pgoff_t pgoff)
727{
728 WARN_ON(!mutex_is_locked(&mdev_state->ops_lock));
729
730 if (!mdev_state->pages[pgoff]) {
731 mdev_state->pages[pgoff] =
732 alloc_pages(GFP_HIGHUSER | __GFP_ZERO, 0);
733 if (!mdev_state->pages[pgoff])
734 return NULL;
735 }
736
737 get_page(mdev_state->pages[pgoff]);
738 return mdev_state->pages[pgoff];
739}
740
741static struct page *mbochs_get_page(struct mdev_state *mdev_state,
742 pgoff_t pgoff)
743{
744 struct page *page;
745
746 if (WARN_ON(pgoff >= mdev_state->pagecount))
747 return NULL;
748
749 mutex_lock(&mdev_state->ops_lock);
750 page = __mbochs_get_page(mdev_state, pgoff);
751 mutex_unlock(&mdev_state->ops_lock);
752
753 return page;
754}
755
756static void mbochs_put_pages(struct mdev_state *mdev_state)
757{
758 struct device *dev = mdev_dev(mdev_state->mdev);
759 int i, count = 0;
760
761 WARN_ON(!mutex_is_locked(&mdev_state->ops_lock));
762
763 for (i = 0; i < mdev_state->pagecount; i++) {
764 if (!mdev_state->pages[i])
765 continue;
766 put_page(mdev_state->pages[i]);
767 mdev_state->pages[i] = NULL;
768 count++;
769 }
770 dev_dbg(dev, "%s: %d pages released\n", __func__, count);
771}
772
773static vm_fault_t mbochs_region_vm_fault(struct vm_fault *vmf)
774{
775 struct vm_area_struct *vma = vmf->vma;
776 struct mdev_state *mdev_state = vma->vm_private_data;
777 pgoff_t page_offset = (vmf->address - vma->vm_start) >> PAGE_SHIFT;
778
779 if (page_offset >= mdev_state->pagecount)
780 return VM_FAULT_SIGBUS;
781
782 vmf->page = mbochs_get_page(mdev_state, page_offset);
783 if (!vmf->page)
784 return VM_FAULT_SIGBUS;
785
786 return 0;
787}
788
789static const struct vm_operations_struct mbochs_region_vm_ops = {
790 .fault = mbochs_region_vm_fault,
791};
792
793static int mbochs_mmap(struct vfio_device *vdev, struct vm_area_struct *vma)
794{
795 struct mdev_state *mdev_state =
796 container_of(vdev, struct mdev_state, vdev);
797
798 if (vma->vm_pgoff != MBOCHS_MEMORY_BAR_OFFSET >> PAGE_SHIFT)
799 return -EINVAL;
800 if (vma->vm_end < vma->vm_start)
801 return -EINVAL;
802 if (vma->vm_end - vma->vm_start > mdev_state->memsize)
803 return -EINVAL;
804 if ((vma->vm_flags & VM_SHARED) == 0)
805 return -EINVAL;
806
807 vma->vm_ops = &mbochs_region_vm_ops;
808 vma->vm_private_data = mdev_state;
809 return 0;
810}
811
812static vm_fault_t mbochs_dmabuf_vm_fault(struct vm_fault *vmf)
813{
814 struct vm_area_struct *vma = vmf->vma;
815 struct mbochs_dmabuf *dmabuf = vma->vm_private_data;
816
817 if (WARN_ON(vmf->pgoff >= dmabuf->pagecount))
818 return VM_FAULT_SIGBUS;
819
820 vmf->page = dmabuf->pages[vmf->pgoff];
821 get_page(vmf->page);
822 return 0;
823}
824
825static const struct vm_operations_struct mbochs_dmabuf_vm_ops = {
826 .fault = mbochs_dmabuf_vm_fault,
827};
828
829static int mbochs_mmap_dmabuf(struct dma_buf *buf, struct vm_area_struct *vma)
830{
831 struct mbochs_dmabuf *dmabuf = buf->priv;
832 struct device *dev = mdev_dev(dmabuf->mdev_state->mdev);
833
834 dev_dbg(dev, "%s: %d\n", __func__, dmabuf->id);
835
836 if ((vma->vm_flags & VM_SHARED) == 0)
837 return -EINVAL;
838
839 vma->vm_ops = &mbochs_dmabuf_vm_ops;
840 vma->vm_private_data = dmabuf;
841 return 0;
842}
843
844static void mbochs_print_dmabuf(struct mbochs_dmabuf *dmabuf,
845 const char *prefix)
846{
847 struct device *dev = mdev_dev(dmabuf->mdev_state->mdev);
848 u32 fourcc = dmabuf->mode.drm_format;
849
850 dev_dbg(dev, "%s/%d: %c%c%c%c, %dx%d, stride %d, off 0x%llx, size 0x%llx, pages %ld\n",
851 prefix, dmabuf->id,
852 fourcc ? ((fourcc >> 0) & 0xff) : '-',
853 fourcc ? ((fourcc >> 8) & 0xff) : '-',
854 fourcc ? ((fourcc >> 16) & 0xff) : '-',
855 fourcc ? ((fourcc >> 24) & 0xff) : '-',
856 dmabuf->mode.width, dmabuf->mode.height, dmabuf->mode.stride,
857 dmabuf->mode.offset, dmabuf->mode.size, dmabuf->pagecount);
858}
859
860static struct sg_table *mbochs_map_dmabuf(struct dma_buf_attachment *at,
861 enum dma_data_direction direction)
862{
863 struct mbochs_dmabuf *dmabuf = at->dmabuf->priv;
864 struct device *dev = mdev_dev(dmabuf->mdev_state->mdev);
865 struct sg_table *sg;
866
867 dev_dbg(dev, "%s: %d\n", __func__, dmabuf->id);
868
869 sg = kzalloc(sizeof(*sg), GFP_KERNEL);
870 if (!sg)
871 goto err1;
872 if (sg_alloc_table_from_pages(sg, dmabuf->pages, dmabuf->pagecount,
873 0, dmabuf->mode.size, GFP_KERNEL) < 0)
874 goto err2;
875 if (dma_map_sgtable(at->dev, sg, direction, 0))
876 goto err3;
877
878 return sg;
879
880err3:
881 sg_free_table(sg);
882err2:
883 kfree(sg);
884err1:
885 return ERR_PTR(-ENOMEM);
886}
887
888static void mbochs_unmap_dmabuf(struct dma_buf_attachment *at,
889 struct sg_table *sg,
890 enum dma_data_direction direction)
891{
892 struct mbochs_dmabuf *dmabuf = at->dmabuf->priv;
893 struct device *dev = mdev_dev(dmabuf->mdev_state->mdev);
894
895 dev_dbg(dev, "%s: %d\n", __func__, dmabuf->id);
896
897 dma_unmap_sgtable(at->dev, sg, direction, 0);
898 sg_free_table(sg);
899 kfree(sg);
900}
901
902static void mbochs_release_dmabuf(struct dma_buf *buf)
903{
904 struct mbochs_dmabuf *dmabuf = buf->priv;
905 struct mdev_state *mdev_state = dmabuf->mdev_state;
906 struct device *dev = mdev_dev(mdev_state->mdev);
907 pgoff_t pg;
908
909 dev_dbg(dev, "%s: %d\n", __func__, dmabuf->id);
910
911 for (pg = 0; pg < dmabuf->pagecount; pg++)
912 put_page(dmabuf->pages[pg]);
913
914 mutex_lock(&mdev_state->ops_lock);
915 dmabuf->buf = NULL;
916 if (dmabuf->unlinked)
917 kfree(dmabuf);
918 mutex_unlock(&mdev_state->ops_lock);
919}
920
921static struct dma_buf_ops mbochs_dmabuf_ops = {
922 .map_dma_buf = mbochs_map_dmabuf,
923 .unmap_dma_buf = mbochs_unmap_dmabuf,
924 .release = mbochs_release_dmabuf,
925 .mmap = mbochs_mmap_dmabuf,
926};
927
928static struct mbochs_dmabuf *mbochs_dmabuf_alloc(struct mdev_state *mdev_state,
929 struct mbochs_mode *mode)
930{
931 struct mbochs_dmabuf *dmabuf;
932 pgoff_t page_offset, pg;
933
934 WARN_ON(!mutex_is_locked(&mdev_state->ops_lock));
935
936 dmabuf = kzalloc(sizeof(struct mbochs_dmabuf), GFP_KERNEL);
937 if (!dmabuf)
938 return NULL;
939
940 dmabuf->mode = *mode;
941 dmabuf->id = mdev_state->next_id++;
942 dmabuf->pagecount = DIV_ROUND_UP(mode->size, PAGE_SIZE);
943 dmabuf->pages = kcalloc(dmabuf->pagecount, sizeof(struct page *),
944 GFP_KERNEL);
945 if (!dmabuf->pages)
946 goto err_free_dmabuf;
947
948 page_offset = dmabuf->mode.offset >> PAGE_SHIFT;
949 for (pg = 0; pg < dmabuf->pagecount; pg++) {
950 dmabuf->pages[pg] = __mbochs_get_page(mdev_state,
951 page_offset + pg);
952 if (!dmabuf->pages[pg])
953 goto err_free_pages;
954 }
955
956 dmabuf->mdev_state = mdev_state;
957 list_add(&dmabuf->next, &mdev_state->dmabufs);
958
959 mbochs_print_dmabuf(dmabuf, __func__);
960 return dmabuf;
961
962err_free_pages:
963 while (pg > 0)
964 put_page(dmabuf->pages[--pg]);
965 kfree(dmabuf->pages);
966err_free_dmabuf:
967 kfree(dmabuf);
968 return NULL;
969}
970
971static struct mbochs_dmabuf *
972mbochs_dmabuf_find_by_mode(struct mdev_state *mdev_state,
973 struct mbochs_mode *mode)
974{
975 struct mbochs_dmabuf *dmabuf;
976
977 WARN_ON(!mutex_is_locked(&mdev_state->ops_lock));
978
979 list_for_each_entry(dmabuf, &mdev_state->dmabufs, next)
980 if (mbochs_modes_equal(&dmabuf->mode, mode))
981 return dmabuf;
982
983 return NULL;
984}
985
986static struct mbochs_dmabuf *
987mbochs_dmabuf_find_by_id(struct mdev_state *mdev_state, u32 id)
988{
989 struct mbochs_dmabuf *dmabuf;
990
991 WARN_ON(!mutex_is_locked(&mdev_state->ops_lock));
992
993 list_for_each_entry(dmabuf, &mdev_state->dmabufs, next)
994 if (dmabuf->id == id)
995 return dmabuf;
996
997 return NULL;
998}
999
1000static int mbochs_dmabuf_export(struct mbochs_dmabuf *dmabuf)
1001{
1002 struct mdev_state *mdev_state = dmabuf->mdev_state;
1003 struct device *dev = mdev_state->vdev.dev;
1004 DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
1005 struct dma_buf *buf;
1006
1007 WARN_ON(!mutex_is_locked(&mdev_state->ops_lock));
1008
1009 if (!IS_ALIGNED(dmabuf->mode.offset, PAGE_SIZE)) {
1010 dev_info_ratelimited(dev, "%s: framebuffer not page-aligned\n",
1011 __func__);
1012 return -EINVAL;
1013 }
1014
1015 exp_info.ops = &mbochs_dmabuf_ops;
1016 exp_info.size = dmabuf->mode.size;
1017 exp_info.priv = dmabuf;
1018
1019 buf = dma_buf_export(&exp_info);
1020 if (IS_ERR(buf)) {
1021 dev_info_ratelimited(dev, "%s: dma_buf_export failed: %ld\n",
1022 __func__, PTR_ERR(buf));
1023 return PTR_ERR(buf);
1024 }
1025
1026 dmabuf->buf = buf;
1027 dev_dbg(dev, "%s: %d\n", __func__, dmabuf->id);
1028 return 0;
1029}
1030
1031static int mbochs_ioctl_get_region_info(struct vfio_device *vdev,
1032 struct vfio_region_info *region_info,
1033 struct vfio_info_cap *caps)
1034{
1035 struct mdev_state *mdev_state =
1036 container_of(vdev, struct mdev_state, vdev);
1037
1038 if (region_info->index >= MBOCHS_NUM_REGIONS)
1039 return -EINVAL;
1040
1041 switch (region_info->index) {
1042 case VFIO_PCI_CONFIG_REGION_INDEX:
1043 region_info->offset = 0;
1044 region_info->size = MBOCHS_CONFIG_SPACE_SIZE;
1045 region_info->flags = (VFIO_REGION_INFO_FLAG_READ |
1046 VFIO_REGION_INFO_FLAG_WRITE);
1047 break;
1048 case VFIO_PCI_BAR0_REGION_INDEX:
1049 region_info->offset = MBOCHS_MEMORY_BAR_OFFSET;
1050 region_info->size = mdev_state->memsize;
1051 region_info->flags = (VFIO_REGION_INFO_FLAG_READ |
1052 VFIO_REGION_INFO_FLAG_WRITE |
1053 VFIO_REGION_INFO_FLAG_MMAP);
1054 break;
1055 case VFIO_PCI_BAR2_REGION_INDEX:
1056 region_info->offset = MBOCHS_MMIO_BAR_OFFSET;
1057 region_info->size = MBOCHS_MMIO_BAR_SIZE;
1058 region_info->flags = (VFIO_REGION_INFO_FLAG_READ |
1059 VFIO_REGION_INFO_FLAG_WRITE);
1060 break;
1061 case MBOCHS_EDID_REGION_INDEX: {
1062 struct vfio_region_info_cap_type cap_type = {
1063 .header.id = VFIO_REGION_INFO_CAP_TYPE,
1064 .header.version = 1,
1065 .type = VFIO_REGION_TYPE_GFX,
1066 .subtype = VFIO_REGION_SUBTYPE_GFX_EDID,
1067 };
1068
1069 region_info->offset = MBOCHS_EDID_OFFSET;
1070 region_info->size = MBOCHS_EDID_SIZE;
1071 region_info->flags = (VFIO_REGION_INFO_FLAG_READ |
1072 VFIO_REGION_INFO_FLAG_WRITE |
1073 VFIO_REGION_INFO_FLAG_CAPS);
1074
1075 return vfio_info_add_capability(caps, &cap_type.header,
1076 sizeof(cap_type));
1077 }
1078 default:
1079 region_info->size = 0;
1080 region_info->offset = 0;
1081 region_info->flags = 0;
1082 }
1083
1084 return 0;
1085}
1086
1087static int mbochs_get_irq_info(struct vfio_irq_info *irq_info)
1088{
1089 irq_info->count = 0;
1090 return 0;
1091}
1092
1093static int mbochs_get_device_info(struct vfio_device_info *dev_info)
1094{
1095 dev_info->flags = VFIO_DEVICE_FLAGS_PCI;
1096 dev_info->num_regions = MBOCHS_NUM_REGIONS;
1097 dev_info->num_irqs = VFIO_PCI_NUM_IRQS;
1098 return 0;
1099}
1100
1101static int mbochs_query_gfx_plane(struct mdev_state *mdev_state,
1102 struct vfio_device_gfx_plane_info *plane)
1103{
1104 struct mbochs_dmabuf *dmabuf;
1105 struct mbochs_mode mode;
1106 int ret;
1107
1108 if (plane->flags & VFIO_GFX_PLANE_TYPE_PROBE) {
1109 if (plane->flags == (VFIO_GFX_PLANE_TYPE_PROBE |
1110 VFIO_GFX_PLANE_TYPE_DMABUF))
1111 return 0;
1112 return -EINVAL;
1113 }
1114
1115 if (plane->flags != VFIO_GFX_PLANE_TYPE_DMABUF)
1116 return -EINVAL;
1117
1118 plane->drm_format_mod = 0;
1119 plane->x_pos = 0;
1120 plane->y_pos = 0;
1121 plane->x_hot = 0;
1122 plane->y_hot = 0;
1123
1124 mutex_lock(&mdev_state->ops_lock);
1125
1126 ret = -EINVAL;
1127 if (plane->drm_plane_type == DRM_PLANE_TYPE_PRIMARY)
1128 ret = mbochs_check_framebuffer(mdev_state, &mode);
1129 if (ret < 0) {
1130 plane->drm_format = 0;
1131 plane->width = 0;
1132 plane->height = 0;
1133 plane->stride = 0;
1134 plane->size = 0;
1135 plane->dmabuf_id = 0;
1136 goto done;
1137 }
1138
1139 dmabuf = mbochs_dmabuf_find_by_mode(mdev_state, &mode);
1140 if (!dmabuf)
1141 mbochs_dmabuf_alloc(mdev_state, &mode);
1142 if (!dmabuf) {
1143 mutex_unlock(&mdev_state->ops_lock);
1144 return -ENOMEM;
1145 }
1146
1147 plane->drm_format = dmabuf->mode.drm_format;
1148 plane->width = dmabuf->mode.width;
1149 plane->height = dmabuf->mode.height;
1150 plane->stride = dmabuf->mode.stride;
1151 plane->size = dmabuf->mode.size;
1152 plane->dmabuf_id = dmabuf->id;
1153
1154done:
1155 if (plane->drm_plane_type == DRM_PLANE_TYPE_PRIMARY &&
1156 mdev_state->active_id != plane->dmabuf_id) {
1157 dev_dbg(mdev_state->vdev.dev, "%s: primary: %d => %d\n",
1158 __func__, mdev_state->active_id, plane->dmabuf_id);
1159 mdev_state->active_id = plane->dmabuf_id;
1160 }
1161 mutex_unlock(&mdev_state->ops_lock);
1162 return 0;
1163}
1164
1165static int mbochs_get_gfx_dmabuf(struct mdev_state *mdev_state, u32 id)
1166{
1167 struct mbochs_dmabuf *dmabuf;
1168
1169 mutex_lock(&mdev_state->ops_lock);
1170
1171 dmabuf = mbochs_dmabuf_find_by_id(mdev_state, id);
1172 if (!dmabuf) {
1173 mutex_unlock(&mdev_state->ops_lock);
1174 return -ENOENT;
1175 }
1176
1177 if (!dmabuf->buf)
1178 mbochs_dmabuf_export(dmabuf);
1179
1180 mutex_unlock(&mdev_state->ops_lock);
1181
1182 if (!dmabuf->buf)
1183 return -EINVAL;
1184
1185 return dma_buf_fd(dmabuf->buf, 0);
1186}
1187
1188static long mbochs_ioctl(struct vfio_device *vdev, unsigned int cmd,
1189 unsigned long arg)
1190{
1191 struct mdev_state *mdev_state =
1192 container_of(vdev, struct mdev_state, vdev);
1193 int ret = 0;
1194 unsigned long minsz;
1195
1196 switch (cmd) {
1197 case VFIO_DEVICE_GET_INFO:
1198 {
1199 struct vfio_device_info info;
1200
1201 minsz = offsetofend(struct vfio_device_info, num_irqs);
1202
1203 if (copy_from_user(&info, (void __user *)arg, minsz))
1204 return -EFAULT;
1205
1206 if (info.argsz < minsz)
1207 return -EINVAL;
1208
1209 ret = mbochs_get_device_info(&info);
1210 if (ret)
1211 return ret;
1212
1213 if (copy_to_user((void __user *)arg, &info, minsz))
1214 return -EFAULT;
1215
1216 return 0;
1217 }
1218
1219 case VFIO_DEVICE_GET_IRQ_INFO:
1220 {
1221 struct vfio_irq_info info;
1222
1223 minsz = offsetofend(struct vfio_irq_info, count);
1224
1225 if (copy_from_user(&info, (void __user *)arg, minsz))
1226 return -EFAULT;
1227
1228 if ((info.argsz < minsz) ||
1229 (info.index >= VFIO_PCI_NUM_IRQS))
1230 return -EINVAL;
1231
1232 ret = mbochs_get_irq_info(&info);
1233 if (ret)
1234 return ret;
1235
1236 if (copy_to_user((void __user *)arg, &info, minsz))
1237 return -EFAULT;
1238
1239 return 0;
1240 }
1241
1242 case VFIO_DEVICE_QUERY_GFX_PLANE:
1243 {
1244 struct vfio_device_gfx_plane_info plane = {};
1245
1246 minsz = offsetofend(struct vfio_device_gfx_plane_info,
1247 region_index);
1248
1249 if (copy_from_user(&plane, (void __user *)arg, minsz))
1250 return -EFAULT;
1251
1252 if (plane.argsz < minsz)
1253 return -EINVAL;
1254
1255 ret = mbochs_query_gfx_plane(mdev_state, &plane);
1256 if (ret)
1257 return ret;
1258
1259 if (copy_to_user((void __user *)arg, &plane, minsz))
1260 return -EFAULT;
1261
1262 return 0;
1263 }
1264
1265 case VFIO_DEVICE_GET_GFX_DMABUF:
1266 {
1267 u32 dmabuf_id;
1268
1269 if (get_user(dmabuf_id, (__u32 __user *)arg))
1270 return -EFAULT;
1271
1272 return mbochs_get_gfx_dmabuf(mdev_state, dmabuf_id);
1273 }
1274
1275 case VFIO_DEVICE_SET_IRQS:
1276 return -EINVAL;
1277
1278 case VFIO_DEVICE_RESET:
1279 return mbochs_reset(mdev_state);
1280 }
1281 return -ENOTTY;
1282}
1283
1284static void mbochs_close_device(struct vfio_device *vdev)
1285{
1286 struct mdev_state *mdev_state =
1287 container_of(vdev, struct mdev_state, vdev);
1288 struct mbochs_dmabuf *dmabuf, *tmp;
1289
1290 mutex_lock(&mdev_state->ops_lock);
1291
1292 list_for_each_entry_safe(dmabuf, tmp, &mdev_state->dmabufs, next) {
1293 list_del(&dmabuf->next);
1294 if (dmabuf->buf) {
1295 /* free in mbochs_release_dmabuf() */
1296 dmabuf->unlinked = true;
1297 } else {
1298 kfree(dmabuf);
1299 }
1300 }
1301 mbochs_put_pages(mdev_state);
1302
1303 mutex_unlock(&mdev_state->ops_lock);
1304}
1305
1306static ssize_t
1307memory_show(struct device *dev, struct device_attribute *attr,
1308 char *buf)
1309{
1310 struct mdev_state *mdev_state = dev_get_drvdata(dev);
1311
1312 return sprintf(buf, "%d MB\n", mdev_state->type->mbytes);
1313}
1314static DEVICE_ATTR_RO(memory);
1315
1316static struct attribute *mdev_dev_attrs[] = {
1317 &dev_attr_memory.attr,
1318 NULL,
1319};
1320
1321static const struct attribute_group mdev_dev_group = {
1322 .name = "vendor",
1323 .attrs = mdev_dev_attrs,
1324};
1325
1326static const struct attribute_group *mdev_dev_groups[] = {
1327 &mdev_dev_group,
1328 NULL,
1329};
1330
1331static ssize_t mbochs_show_description(struct mdev_type *mtype, char *buf)
1332{
1333 struct mbochs_type *type =
1334 container_of(mtype, struct mbochs_type, type);
1335
1336 return sprintf(buf, "virtual display, %d MB video memory\n",
1337 type ? type->mbytes : 0);
1338}
1339
1340static unsigned int mbochs_get_available(struct mdev_type *mtype)
1341{
1342 struct mbochs_type *type =
1343 container_of(mtype, struct mbochs_type, type);
1344
1345 return atomic_read(&mbochs_avail_mbytes) / type->mbytes;
1346}
1347
1348static const struct vfio_device_ops mbochs_dev_ops = {
1349 .close_device = mbochs_close_device,
1350 .init = mbochs_init_dev,
1351 .release = mbochs_release_dev,
1352 .read = mbochs_read,
1353 .write = mbochs_write,
1354 .ioctl = mbochs_ioctl,
1355 .get_region_info_caps = mbochs_ioctl_get_region_info,
1356 .mmap = mbochs_mmap,
1357 .bind_iommufd = vfio_iommufd_emulated_bind,
1358 .unbind_iommufd = vfio_iommufd_emulated_unbind,
1359 .attach_ioas = vfio_iommufd_emulated_attach_ioas,
1360 .detach_ioas = vfio_iommufd_emulated_detach_ioas,
1361};
1362
1363static struct mdev_driver mbochs_driver = {
1364 .device_api = VFIO_DEVICE_API_PCI_STRING,
1365 .driver = {
1366 .name = "mbochs",
1367 .owner = THIS_MODULE,
1368 .mod_name = KBUILD_MODNAME,
1369 .dev_groups = mdev_dev_groups,
1370 },
1371 .probe = mbochs_probe,
1372 .remove = mbochs_remove,
1373 .get_available = mbochs_get_available,
1374 .show_description = mbochs_show_description,
1375};
1376
1377static const struct file_operations vd_fops = {
1378 .owner = THIS_MODULE,
1379};
1380
1381static void mbochs_device_release(struct device *dev)
1382{
1383 /* nothing */
1384}
1385
1386static int __init mbochs_dev_init(void)
1387{
1388 int ret = 0;
1389
1390 atomic_set(&mbochs_avail_mbytes, max_mbytes);
1391
1392 ret = alloc_chrdev_region(&mbochs_devt, 0, MINORMASK + 1, MBOCHS_NAME);
1393 if (ret < 0) {
1394 pr_err("Error: failed to register mbochs_dev, err: %d\n", ret);
1395 return ret;
1396 }
1397 cdev_init(&mbochs_cdev, &vd_fops);
1398 cdev_add(&mbochs_cdev, mbochs_devt, MINORMASK + 1);
1399 pr_info("%s: major %d\n", __func__, MAJOR(mbochs_devt));
1400
1401 ret = mdev_register_driver(&mbochs_driver);
1402 if (ret)
1403 goto err_cdev;
1404
1405 ret = class_register(&mbochs_class);
1406 if (ret)
1407 goto err_driver;
1408 mbochs_dev.class = &mbochs_class;
1409 mbochs_dev.release = mbochs_device_release;
1410 dev_set_name(&mbochs_dev, "%s", MBOCHS_NAME);
1411
1412 ret = device_register(&mbochs_dev);
1413 if (ret)
1414 goto err_put;
1415
1416 ret = mdev_register_parent(&mbochs_parent, &mbochs_dev, &mbochs_driver,
1417 mbochs_mdev_types,
1418 ARRAY_SIZE(mbochs_mdev_types));
1419 if (ret)
1420 goto err_device;
1421
1422 return 0;
1423
1424err_device:
1425 device_del(&mbochs_dev);
1426err_put:
1427 put_device(&mbochs_dev);
1428 class_unregister(&mbochs_class);
1429err_driver:
1430 mdev_unregister_driver(&mbochs_driver);
1431err_cdev:
1432 cdev_del(&mbochs_cdev);
1433 unregister_chrdev_region(mbochs_devt, MINORMASK + 1);
1434 return ret;
1435}
1436
1437static void __exit mbochs_dev_exit(void)
1438{
1439 mbochs_dev.bus = NULL;
1440 mdev_unregister_parent(&mbochs_parent);
1441
1442 device_unregister(&mbochs_dev);
1443 mdev_unregister_driver(&mbochs_driver);
1444 cdev_del(&mbochs_cdev);
1445 unregister_chrdev_region(mbochs_devt, MINORMASK + 1);
1446 class_unregister(&mbochs_class);
1447}
1448
1449MODULE_IMPORT_NS("DMA_BUF");
1450module_init(mbochs_dev_init)
1451module_exit(mbochs_dev_exit)