1 // SPDX-License-Identifier: GPL-2.0
3 * Mediated virtual PCI display host device driver
5 * See mdpy-defs.h for device specs
7 * (c) Gerd Hoffmann <kraxel@redhat.com>
9 * based on mtty driver which is:
10 * Copyright (c) 2016, NVIDIA CORPORATION. All rights reserved.
11 * Author: Neo Jia <cjia@nvidia.com>
12 * Kirti Wankhede <kwankhede@nvidia.com>
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License version 2 as
16 * published by the Free Software Foundation.
18 #include <linux/init.h>
19 #include <linux/module.h>
20 #include <linux/device.h>
21 #include <linux/kernel.h>
22 #include <linux/slab.h>
23 #include <linux/vmalloc.h>
24 #include <linux/cdev.h>
25 #include <linux/vfio.h>
26 #include <linux/iommu.h>
27 #include <linux/sysfs.h>
28 #include <linux/mdev.h>
29 #include <linux/pci.h>
30 #include <drm/drm_fourcc.h>
31 #include "mdpy-defs.h"
33 #define MDPY_NAME "mdpy"
34 #define MDPY_CLASS_NAME "mdpy"
36 #define MDPY_CONFIG_SPACE_SIZE 0xff
37 #define MDPY_MEMORY_BAR_OFFSET PAGE_SIZE
38 #define MDPY_DISPLAY_REGION 16
40 #define STORE_LE16(addr, val) (*(u16 *)addr = val)
41 #define STORE_LE32(addr, val) (*(u32 *)addr = val)
44 MODULE_LICENSE("GPL v2");
46 static int max_devices = 4;
47 module_param_named(count, max_devices, int, 0444);
48 MODULE_PARM_DESC(count, "number of " MDPY_NAME " devices");
51 #define MDPY_TYPE_1 "vga"
52 #define MDPY_TYPE_2 "xga"
53 #define MDPY_TYPE_3 "hd"
55 static const struct mdpy_type {
63 .name = MDPY_CLASS_NAME "-" MDPY_TYPE_1,
64 .format = DRM_FORMAT_XRGB8888,
69 .name = MDPY_CLASS_NAME "-" MDPY_TYPE_2,
70 .format = DRM_FORMAT_XRGB8888,
75 .name = MDPY_CLASS_NAME "-" MDPY_TYPE_3,
76 .format = DRM_FORMAT_XRGB8888,
83 static dev_t mdpy_devt;
84 static struct class *mdpy_class;
85 static struct cdev mdpy_cdev;
86 static struct device mdpy_dev;
87 static u32 mdpy_count;
88 static const struct vfio_device_ops mdpy_dev_ops;
90 /* State of each mdev device */
92 struct vfio_device vdev;
95 struct mutex ops_lock;
96 struct mdev_device *mdev;
97 struct vfio_device_info dev_info;
99 const struct mdpy_type *type;
104 static void mdpy_create_config_space(struct mdev_state *mdev_state)
106 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_VENDOR_ID],
108 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_DEVICE_ID],
110 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_SUBSYSTEM_VENDOR_ID],
111 MDPY_PCI_SUBVENDOR_ID);
112 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_SUBSYSTEM_ID],
113 MDPY_PCI_SUBDEVICE_ID);
115 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_COMMAND],
116 PCI_COMMAND_IO | PCI_COMMAND_MEMORY);
117 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_STATUS],
118 PCI_STATUS_CAP_LIST);
119 STORE_LE16((u16 *) &mdev_state->vconfig[PCI_CLASS_DEVICE],
120 PCI_CLASS_DISPLAY_OTHER);
121 mdev_state->vconfig[PCI_CLASS_REVISION] = 0x01;
123 STORE_LE32((u32 *) &mdev_state->vconfig[PCI_BASE_ADDRESS_0],
124 PCI_BASE_ADDRESS_SPACE_MEMORY |
125 PCI_BASE_ADDRESS_MEM_TYPE_32 |
126 PCI_BASE_ADDRESS_MEM_PREFETCH);
127 mdev_state->bar_mask = ~(mdev_state->memsize) + 1;
129 /* vendor specific capability for the config registers */
130 mdev_state->vconfig[PCI_CAPABILITY_LIST] = MDPY_VENDORCAP_OFFSET;
131 mdev_state->vconfig[MDPY_VENDORCAP_OFFSET + 0] = 0x09; /* vendor cap */
132 mdev_state->vconfig[MDPY_VENDORCAP_OFFSET + 1] = 0x00; /* next ptr */
133 mdev_state->vconfig[MDPY_VENDORCAP_OFFSET + 2] = MDPY_VENDORCAP_SIZE;
134 STORE_LE32((u32 *) &mdev_state->vconfig[MDPY_FORMAT_OFFSET],
135 mdev_state->type->format);
136 STORE_LE32((u32 *) &mdev_state->vconfig[MDPY_WIDTH_OFFSET],
137 mdev_state->type->width);
138 STORE_LE32((u32 *) &mdev_state->vconfig[MDPY_HEIGHT_OFFSET],
139 mdev_state->type->height);
142 static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset,
143 char *buf, u32 count)
145 struct device *dev = mdev_dev(mdev_state->mdev);
149 case PCI_BASE_ADDRESS_0:
150 cfg_addr = *(u32 *)buf;
152 if (cfg_addr == 0xffffffff) {
153 cfg_addr = (cfg_addr & mdev_state->bar_mask);
155 cfg_addr &= PCI_BASE_ADDRESS_MEM_MASK;
157 dev_info(dev, "BAR0 @ 0x%x\n", cfg_addr);
160 cfg_addr |= (mdev_state->vconfig[offset] &
161 ~PCI_BASE_ADDRESS_MEM_MASK);
162 STORE_LE32(&mdev_state->vconfig[offset], cfg_addr);
167 static ssize_t mdev_access(struct mdev_state *mdev_state, char *buf,
168 size_t count, loff_t pos, bool is_write)
172 mutex_lock(&mdev_state->ops_lock);
174 if (pos < MDPY_CONFIG_SPACE_SIZE) {
176 handle_pci_cfg_write(mdev_state, pos, buf, count);
178 memcpy(buf, (mdev_state->vconfig + pos), count);
180 } else if ((pos >= MDPY_MEMORY_BAR_OFFSET) &&
182 MDPY_MEMORY_BAR_OFFSET + mdev_state->memsize)) {
183 pos -= MDPY_MEMORY_BAR_OFFSET;
185 memcpy(mdev_state->memblk, buf, count);
187 memcpy(buf, mdev_state->memblk, count);
190 dev_info(mdev_state->vdev.dev,
191 "%s: %s @0x%llx (unhandled)\n", __func__,
192 is_write ? "WR" : "RD", pos);
201 mutex_unlock(&mdev_state->ops_lock);
206 static int mdpy_reset(struct mdev_state *mdev_state)
210 /* initialize with gray gradient */
211 stride = mdev_state->type->width * mdev_state->type->bytepp;
212 for (i = 0; i < mdev_state->type->height; i++)
213 memset(mdev_state->memblk + i * stride,
214 i * 255 / mdev_state->type->height,
219 static int mdpy_probe(struct mdev_device *mdev)
221 const struct mdpy_type *type =
222 &mdpy_types[mdev_get_type_group_id(mdev)];
223 struct device *dev = mdev_dev(mdev);
224 struct mdev_state *mdev_state;
228 if (mdpy_count >= max_devices)
231 mdev_state = kzalloc(sizeof(struct mdev_state), GFP_KERNEL);
232 if (mdev_state == NULL)
234 vfio_init_group_dev(&mdev_state->vdev, &mdev->dev, &mdpy_dev_ops);
236 mdev_state->vconfig = kzalloc(MDPY_CONFIG_SPACE_SIZE, GFP_KERNEL);
237 if (mdev_state->vconfig == NULL) {
242 fbsize = roundup_pow_of_two(type->width * type->height * type->bytepp);
244 mdev_state->memblk = vmalloc_user(fbsize);
245 if (!mdev_state->memblk) {
249 dev_info(dev, "%s: %s (%dx%d)\n", __func__, type->name, type->width,
252 mutex_init(&mdev_state->ops_lock);
253 mdev_state->mdev = mdev;
254 mdev_state->type = type;
255 mdev_state->memsize = fbsize;
256 mdpy_create_config_space(mdev_state);
257 mdpy_reset(mdev_state);
261 ret = vfio_register_emulated_iommu_dev(&mdev_state->vdev);
264 dev_set_drvdata(&mdev->dev, mdev_state);
267 vfree(mdev_state->memblk);
269 kfree(mdev_state->vconfig);
271 vfio_uninit_group_dev(&mdev_state->vdev);
276 static void mdpy_remove(struct mdev_device *mdev)
278 struct mdev_state *mdev_state = dev_get_drvdata(&mdev->dev);
280 dev_info(&mdev->dev, "%s\n", __func__);
282 vfio_unregister_group_dev(&mdev_state->vdev);
283 vfree(mdev_state->memblk);
284 kfree(mdev_state->vconfig);
285 vfio_uninit_group_dev(&mdev_state->vdev);
291 static ssize_t mdpy_read(struct vfio_device *vdev, char __user *buf,
292 size_t count, loff_t *ppos)
294 struct mdev_state *mdev_state =
295 container_of(vdev, struct mdev_state, vdev);
296 unsigned int done = 0;
302 if (count >= 4 && !(*ppos % 4)) {
305 ret = mdev_access(mdev_state, (char *)&val, sizeof(val),
310 if (copy_to_user(buf, &val, sizeof(val)))
314 } else if (count >= 2 && !(*ppos % 2)) {
317 ret = mdev_access(mdev_state, (char *)&val, sizeof(val),
322 if (copy_to_user(buf, &val, sizeof(val)))
329 ret = mdev_access(mdev_state, (char *)&val, sizeof(val),
334 if (copy_to_user(buf, &val, sizeof(val)))
352 static ssize_t mdpy_write(struct vfio_device *vdev, const char __user *buf,
353 size_t count, loff_t *ppos)
355 struct mdev_state *mdev_state =
356 container_of(vdev, struct mdev_state, vdev);
357 unsigned int done = 0;
363 if (count >= 4 && !(*ppos % 4)) {
366 if (copy_from_user(&val, buf, sizeof(val)))
369 ret = mdev_access(mdev_state, (char *)&val, sizeof(val),
375 } else if (count >= 2 && !(*ppos % 2)) {
378 if (copy_from_user(&val, buf, sizeof(val)))
381 ret = mdev_access(mdev_state, (char *)&val, sizeof(val),
390 if (copy_from_user(&val, buf, sizeof(val)))
393 ret = mdev_access(mdev_state, (char *)&val, sizeof(val),
411 static int mdpy_mmap(struct vfio_device *vdev, struct vm_area_struct *vma)
413 struct mdev_state *mdev_state =
414 container_of(vdev, struct mdev_state, vdev);
416 if (vma->vm_pgoff != MDPY_MEMORY_BAR_OFFSET >> PAGE_SHIFT)
418 if (vma->vm_end < vma->vm_start)
420 if (vma->vm_end - vma->vm_start > mdev_state->memsize)
422 if ((vma->vm_flags & VM_SHARED) == 0)
425 return remap_vmalloc_range(vma, mdev_state->memblk, 0);
428 static int mdpy_get_region_info(struct mdev_state *mdev_state,
429 struct vfio_region_info *region_info,
430 u16 *cap_type_id, void **cap_type)
432 if (region_info->index >= VFIO_PCI_NUM_REGIONS &&
433 region_info->index != MDPY_DISPLAY_REGION)
436 switch (region_info->index) {
437 case VFIO_PCI_CONFIG_REGION_INDEX:
438 region_info->offset = 0;
439 region_info->size = MDPY_CONFIG_SPACE_SIZE;
440 region_info->flags = (VFIO_REGION_INFO_FLAG_READ |
441 VFIO_REGION_INFO_FLAG_WRITE);
443 case VFIO_PCI_BAR0_REGION_INDEX:
444 case MDPY_DISPLAY_REGION:
445 region_info->offset = MDPY_MEMORY_BAR_OFFSET;
446 region_info->size = mdev_state->memsize;
447 region_info->flags = (VFIO_REGION_INFO_FLAG_READ |
448 VFIO_REGION_INFO_FLAG_WRITE |
449 VFIO_REGION_INFO_FLAG_MMAP);
452 region_info->size = 0;
453 region_info->offset = 0;
454 region_info->flags = 0;
460 static int mdpy_get_irq_info(struct vfio_irq_info *irq_info)
466 static int mdpy_get_device_info(struct vfio_device_info *dev_info)
468 dev_info->flags = VFIO_DEVICE_FLAGS_PCI;
469 dev_info->num_regions = VFIO_PCI_NUM_REGIONS;
470 dev_info->num_irqs = VFIO_PCI_NUM_IRQS;
474 static int mdpy_query_gfx_plane(struct mdev_state *mdev_state,
475 struct vfio_device_gfx_plane_info *plane)
477 if (plane->flags & VFIO_GFX_PLANE_TYPE_PROBE) {
478 if (plane->flags == (VFIO_GFX_PLANE_TYPE_PROBE |
479 VFIO_GFX_PLANE_TYPE_REGION))
484 if (plane->flags != VFIO_GFX_PLANE_TYPE_REGION)
487 plane->drm_format = mdev_state->type->format;
488 plane->width = mdev_state->type->width;
489 plane->height = mdev_state->type->height;
490 plane->stride = (mdev_state->type->width *
491 mdev_state->type->bytepp);
492 plane->size = mdev_state->memsize;
493 plane->region_index = MDPY_DISPLAY_REGION;
496 plane->drm_format_mod = 0;
505 static long mdpy_ioctl(struct vfio_device *vdev, unsigned int cmd,
510 struct mdev_state *mdev_state =
511 container_of(vdev, struct mdev_state, vdev);
514 case VFIO_DEVICE_GET_INFO:
516 struct vfio_device_info info;
518 minsz = offsetofend(struct vfio_device_info, num_irqs);
520 if (copy_from_user(&info, (void __user *)arg, minsz))
523 if (info.argsz < minsz)
526 ret = mdpy_get_device_info(&info);
530 memcpy(&mdev_state->dev_info, &info, sizeof(info));
532 if (copy_to_user((void __user *)arg, &info, minsz))
537 case VFIO_DEVICE_GET_REGION_INFO:
539 struct vfio_region_info info;
541 void *cap_type = NULL;
543 minsz = offsetofend(struct vfio_region_info, offset);
545 if (copy_from_user(&info, (void __user *)arg, minsz))
548 if (info.argsz < minsz)
551 ret = mdpy_get_region_info(mdev_state, &info, &cap_type_id,
556 if (copy_to_user((void __user *)arg, &info, minsz))
562 case VFIO_DEVICE_GET_IRQ_INFO:
564 struct vfio_irq_info info;
566 minsz = offsetofend(struct vfio_irq_info, count);
568 if (copy_from_user(&info, (void __user *)arg, minsz))
571 if ((info.argsz < minsz) ||
572 (info.index >= mdev_state->dev_info.num_irqs))
575 ret = mdpy_get_irq_info(&info);
579 if (copy_to_user((void __user *)arg, &info, minsz))
585 case VFIO_DEVICE_QUERY_GFX_PLANE:
587 struct vfio_device_gfx_plane_info plane;
589 minsz = offsetofend(struct vfio_device_gfx_plane_info,
592 if (copy_from_user(&plane, (void __user *)arg, minsz))
595 if (plane.argsz < minsz)
598 ret = mdpy_query_gfx_plane(mdev_state, &plane);
602 if (copy_to_user((void __user *)arg, &plane, minsz))
608 case VFIO_DEVICE_SET_IRQS:
611 case VFIO_DEVICE_RESET:
612 return mdpy_reset(mdev_state);
618 resolution_show(struct device *dev, struct device_attribute *attr,
621 struct mdev_state *mdev_state = dev_get_drvdata(dev);
623 return sprintf(buf, "%dx%d\n",
624 mdev_state->type->width,
625 mdev_state->type->height);
627 static DEVICE_ATTR_RO(resolution);
629 static struct attribute *mdev_dev_attrs[] = {
630 &dev_attr_resolution.attr,
634 static const struct attribute_group mdev_dev_group = {
636 .attrs = mdev_dev_attrs,
639 static const struct attribute_group *mdev_dev_groups[] = {
644 static ssize_t name_show(struct mdev_type *mtype,
645 struct mdev_type_attribute *attr, char *buf)
647 const struct mdpy_type *type =
648 &mdpy_types[mtype_get_type_group_id(mtype)];
650 return sprintf(buf, "%s\n", type->name);
652 static MDEV_TYPE_ATTR_RO(name);
654 static ssize_t description_show(struct mdev_type *mtype,
655 struct mdev_type_attribute *attr, char *buf)
657 const struct mdpy_type *type =
658 &mdpy_types[mtype_get_type_group_id(mtype)];
660 return sprintf(buf, "virtual display, %dx%d framebuffer\n",
661 type->width, type->height);
663 static MDEV_TYPE_ATTR_RO(description);
665 static ssize_t available_instances_show(struct mdev_type *mtype,
666 struct mdev_type_attribute *attr,
669 return sprintf(buf, "%d\n", max_devices - mdpy_count);
671 static MDEV_TYPE_ATTR_RO(available_instances);
673 static ssize_t device_api_show(struct mdev_type *mtype,
674 struct mdev_type_attribute *attr, char *buf)
676 return sprintf(buf, "%s\n", VFIO_DEVICE_API_PCI_STRING);
678 static MDEV_TYPE_ATTR_RO(device_api);
680 static struct attribute *mdev_types_attrs[] = {
681 &mdev_type_attr_name.attr,
682 &mdev_type_attr_description.attr,
683 &mdev_type_attr_device_api.attr,
684 &mdev_type_attr_available_instances.attr,
688 static struct attribute_group mdev_type_group1 = {
690 .attrs = mdev_types_attrs,
693 static struct attribute_group mdev_type_group2 = {
695 .attrs = mdev_types_attrs,
698 static struct attribute_group mdev_type_group3 = {
700 .attrs = mdev_types_attrs,
703 static struct attribute_group *mdev_type_groups[] = {
710 static const struct vfio_device_ops mdpy_dev_ops = {
717 static struct mdev_driver mdpy_driver = {
720 .owner = THIS_MODULE,
721 .mod_name = KBUILD_MODNAME,
722 .dev_groups = mdev_dev_groups,
725 .remove = mdpy_remove,
726 .supported_type_groups = mdev_type_groups,
729 static const struct file_operations vd_fops = {
730 .owner = THIS_MODULE,
733 static void mdpy_device_release(struct device *dev)
738 static int __init mdpy_dev_init(void)
742 ret = alloc_chrdev_region(&mdpy_devt, 0, MINORMASK + 1, MDPY_NAME);
744 pr_err("Error: failed to register mdpy_dev, err: %d\n", ret);
747 cdev_init(&mdpy_cdev, &vd_fops);
748 cdev_add(&mdpy_cdev, mdpy_devt, MINORMASK + 1);
749 pr_info("%s: major %d\n", __func__, MAJOR(mdpy_devt));
751 ret = mdev_register_driver(&mdpy_driver);
755 mdpy_class = class_create(THIS_MODULE, MDPY_CLASS_NAME);
756 if (IS_ERR(mdpy_class)) {
757 pr_err("Error: failed to register mdpy_dev class\n");
758 ret = PTR_ERR(mdpy_class);
761 mdpy_dev.class = mdpy_class;
762 mdpy_dev.release = mdpy_device_release;
763 dev_set_name(&mdpy_dev, "%s", MDPY_NAME);
765 ret = device_register(&mdpy_dev);
769 ret = mdev_register_device(&mdpy_dev, &mdpy_driver);
776 device_unregister(&mdpy_dev);
778 class_destroy(mdpy_class);
780 mdev_unregister_driver(&mdpy_driver);
782 cdev_del(&mdpy_cdev);
783 unregister_chrdev_region(mdpy_devt, MINORMASK + 1);
787 static void __exit mdpy_dev_exit(void)
790 mdev_unregister_device(&mdpy_dev);
792 device_unregister(&mdpy_dev);
793 mdev_unregister_driver(&mdpy_driver);
794 cdev_del(&mdpy_cdev);
795 unregister_chrdev_region(mdpy_devt, MINORMASK + 1);
796 class_destroy(mdpy_class);
800 module_init(mdpy_dev_init)
801 module_exit(mdpy_dev_exit)