forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2023-12-11 072de836f53be56a70cecf70b43ae43b7ce17376 
 kernel/drivers/platform/goldfish/goldfish_pipe.c
....@@ -1,3 +1,4 @@
1
+// SPDX-License-Identifier: GPL-2.0
12 /*
23  * Copyright (C) 2012 Intel, Inc.
34  * Copyright (C) 2013 Intel, Inc.
....@@ -46,7 +47,6 @@
4647  * exchange is properly mapped during a transfer.
4748  */
4849 
49
-
5050 #include <linux/module.h>
5151 #include <linux/mod_devicetable.h>
5252 #include <linux/interrupt.h>
....@@ -59,10 +59,11 @@
5959 #include <linux/bitops.h>
6060 #include <linux/slab.h>
6161 #include <linux/io.h>
62
-#include <linux/goldfish.h>
6362 #include <linux/dma-mapping.h>
6463 #include <linux/mm.h>
6564 #include <linux/acpi.h>
65
+#include <linux/bug.h>
66
+#include "goldfish_pipe_qemu.h"
6667 
6768 /*
6869  * Update this when something changes in the driver's behavior so the host
....@@ -73,71 +74,6 @@
7374 	PIPE_CURRENT_DEVICE_VERSION = 2
7475 };
7576 
76
-/*
77
- * IMPORTANT: The following constants must match the ones used and defined
78
- * in external/qemu/hw/goldfish_pipe.c in the Android source tree.
79
- */
80
-
81
-/* List of bitflags returned in status of CMD_POLL command */
82
-enum PipePollFlags {
83
-	PIPE_POLL_IN	= 1 << 0,
84
-	PIPE_POLL_OUT	= 1 << 1,
85
-	PIPE_POLL_HUP	= 1 << 2
86
-};
87
-
88
-/* Possible status values used to signal errors - see goldfish_pipe_error_convert */
89
-enum PipeErrors {
90
-	PIPE_ERROR_INVAL  = -1,
91
-	PIPE_ERROR_AGAIN  = -2,
92
-	PIPE_ERROR_NOMEM  = -3,
93
-	PIPE_ERROR_IO     = -4
94
-};
95
-
96
-/* Bit-flags used to signal events from the emulator */
97
-enum PipeWakeFlags {
98
-	PIPE_WAKE_CLOSED = 1 << 0,  /* emulator closed pipe */
99
-	PIPE_WAKE_READ   = 1 << 1,  /* pipe can now be read from */
100
-	PIPE_WAKE_WRITE  = 1 << 2  /* pipe can now be written to */
101
-};
102
-
103
-/* Bit flags for the 'flags' field */
104
-enum PipeFlagsBits {
105
-	BIT_CLOSED_ON_HOST = 0,  /* pipe closed by host */
106
-	BIT_WAKE_ON_WRITE  = 1,  /* want to be woken on writes */
107
-	BIT_WAKE_ON_READ   = 2,  /* want to be woken on reads */
108
-};
109
-
110
-enum PipeRegs {
111
-	PIPE_REG_CMD = 0,
112
-
113
-	PIPE_REG_SIGNAL_BUFFER_HIGH = 4,
114
-	PIPE_REG_SIGNAL_BUFFER = 8,
115
-	PIPE_REG_SIGNAL_BUFFER_COUNT = 12,
116
-
117
-	PIPE_REG_OPEN_BUFFER_HIGH = 20,
118
-	PIPE_REG_OPEN_BUFFER = 24,
119
-
120
-	PIPE_REG_VERSION = 36,
121
-
122
-	PIPE_REG_GET_SIGNALLED = 48,
123
-};
124
-
125
-enum PipeCmdCode {
126
-	PIPE_CMD_OPEN = 1,	/* to be used by the pipe device itself */
127
-	PIPE_CMD_CLOSE,
128
-	PIPE_CMD_POLL,
129
-	PIPE_CMD_WRITE,
130
-	PIPE_CMD_WAKE_ON_WRITE,
131
-	PIPE_CMD_READ,
132
-	PIPE_CMD_WAKE_ON_READ,
133
-
134
-	/*
135
-	 * TODO(zyy): implement a deferred read/write execution to allow
136
-	 * parallel processing of pipe operations on the host.
137
-	 */
138
-	PIPE_CMD_WAKE_ON_DONE_IO,
139
-};
140
-
14177 enum {
14278 	MAX_BUFFERS_PER_COMMAND = 336,
14379 	MAX_SIGNALLED_PIPES = 64,
....@@ -145,14 +81,12 @@
14581 };
14682 
14783 struct goldfish_pipe_dev;
148
-struct goldfish_pipe;
149
-struct goldfish_pipe_command;
15084 
15185 /* A per-pipe command structure, shared with the host */
15286 struct goldfish_pipe_command {
153
-	s32 cmd;		/* PipeCmdCode, guest -> host */
154
-	s32 id;			/* pipe id, guest -> host */
155
-	s32 status;		/* command execution status, host -> guest */
87
+	s32 cmd;	/* PipeCmdCode, guest -> host */
88
+	s32 id;		/* pipe id, guest -> host */
89
+	s32 status;	/* command execution status, host -> guest */
15690 	s32 reserved;	/* to pad to 64-bit boundary */
15791 	union {
15892 		/* Parameters for PIPE_CMD_{READ,WRITE} */
....@@ -184,19 +118,21 @@
184118 /* Device-level set of buffers shared with the host */
185119 struct goldfish_pipe_dev_buffers {
186120 	struct open_command_param open_command_params;
187
-	struct signalled_pipe_buffer signalled_pipe_buffers[
188
-		MAX_SIGNALLED_PIPES];
121
+	struct signalled_pipe_buffer
122
+		signalled_pipe_buffers[MAX_SIGNALLED_PIPES];
189123 };
190124 
191125 /* This data type models a given pipe instance */
192126 struct goldfish_pipe {
193127 	/* pipe ID - index into goldfish_pipe_dev::pipes array */
194128 	u32 id;
129
+
195130 	/* The wake flags pipe is waiting for
196131 	 * Note: not protected with any lock, uses atomic operations
197132 	 *  and barriers to make it thread-safe.
198133 	 */
199134 	unsigned long flags;
135
+
200136 	/* wake flags host have signalled,
201137 	 *  - protected by goldfish_pipe_dev::lock
202138 	 */
....@@ -220,8 +156,12 @@
220156 
221157 	/* A wake queue for sleeping until host signals an event */
222158 	wait_queue_head_t wake_queue;
159
+
223160 	/* Pointer to the parent goldfish_pipe_dev instance */
224161 	struct goldfish_pipe_dev *dev;
162
+
163
+	/* A buffer of pages, too large to fit into a stack frame */
164
+	struct page *pages[MAX_BUFFERS_PER_COMMAND];
225165 };
226166 
227167 /* The global driver data. Holds a reference to the i/o page used to
....@@ -229,6 +169,9 @@
229169  * waiting to be awoken.
230170  */
231171 struct goldfish_pipe_dev {
172
+	/* A magic number to check if this is an instance of this struct */
173
+	void *magic;
174
+
232175 	/*
233176 	 * Global device spinlock. Protects the following members:
234177 	 *  - pipes, pipes_capacity
....@@ -261,15 +204,22 @@
261204 	/* Head of a doubly linked list of signalled pipes */
262205 	struct goldfish_pipe *first_signalled_pipe;
263206 
207
+	/* ptr to platform device's device struct */
208
+	struct device *pdev_dev;
209
+
264210 	/* Some device-specific data */
265211 	int irq;
266212 	int version;
267213 	unsigned char __iomem *base;
214
+
215
+	/* an irq tasklet to run goldfish_interrupt_task */
216
+	struct tasklet_struct irq_tasklet;
217
+
218
+	struct miscdevice miscdev;
268219 };
269220 
270
-static struct goldfish_pipe_dev pipe_dev[1] = {};
271
-
272
-static int goldfish_cmd_locked(struct goldfish_pipe *pipe, enum PipeCmdCode cmd)
221
+static int goldfish_pipe_cmd_locked(struct goldfish_pipe *pipe,
222
+				    enum PipeCmdCode cmd)
273223 {
274224 	pipe->command_buffer->cmd = cmd;
275225 	/* failure by default */
....@@ -278,13 +228,13 @@
278228 	return pipe->command_buffer->status;
279229 }
280230 
281
-static int goldfish_cmd(struct goldfish_pipe *pipe, enum PipeCmdCode cmd)
231
+static int goldfish_pipe_cmd(struct goldfish_pipe *pipe, enum PipeCmdCode cmd)
282232 {
283233 	int status;
284234 
285235 	if (mutex_lock_interruptible(&pipe->lock))
286236 		return PIPE_ERROR_IO;
287
-	status = goldfish_cmd_locked(pipe, cmd);
237
+	status = goldfish_pipe_cmd_locked(pipe, cmd);
288238 	mutex_unlock(&pipe->lock);
289239 	return status;
290240 }
....@@ -307,10 +257,12 @@
307257 	}
308258 }
309259 
310
-static int pin_user_pages(unsigned long first_page, unsigned long last_page,
311
-	unsigned int last_page_size, int is_write,
312
-	struct page *pages[MAX_BUFFERS_PER_COMMAND],
313
-	unsigned int *iter_last_page_size)
260
+static int goldfish_pin_pages(unsigned long first_page,
261
+			      unsigned long last_page,
262
+			      unsigned int last_page_size,
263
+			      int is_write,
264
+			      struct page *pages[MAX_BUFFERS_PER_COMMAND],
265
+			      unsigned int *iter_last_page_size)
314266 {
315267 	int ret;
316268 	int requested_pages = ((last_page - first_page) >> PAGE_SHIFT) + 1;
....@@ -322,35 +274,27 @@
322274 		*iter_last_page_size = last_page_size;
323275 	}
324276 
325
-	ret = get_user_pages_fast(
326
-			first_page, requested_pages, !is_write, pages);
277
+	ret = pin_user_pages_fast(first_page, requested_pages,
278
+				  !is_write ? FOLL_WRITE : 0,
279
+				  pages);
327280 	if (ret <= 0)
328281 		return -EFAULT;
329282 	if (ret < requested_pages)
330283 		*iter_last_page_size = PAGE_SIZE;
284
+
331285 	return ret;
332
-
333
-}
334
-
335
-static void release_user_pages(struct page **pages, int pages_count,
336
-	int is_write, s32 consumed_size)
337
-{
338
-	int i;
339
-
340
-	for (i = 0; i < pages_count; i++) {
341
-		if (!is_write && consumed_size > 0)
342
-			set_page_dirty(pages[i]);
343
-		put_page(pages[i]);
344
-	}
345286 }
346287 
347288 /* Populate the call parameters, merging adjacent pages together */
348
-static void populate_rw_params(
349
-	struct page **pages, int pages_count,
350
-	unsigned long address, unsigned long address_end,
351
-	unsigned long first_page, unsigned long last_page,
352
-	unsigned int iter_last_page_size, int is_write,
353
-	struct goldfish_pipe_command *command)
289
+static void populate_rw_params(struct page **pages,
290
+			       int pages_count,
291
+			       unsigned long address,
292
+			       unsigned long address_end,
293
+			       unsigned long first_page,
294
+			       unsigned long last_page,
295
+			       unsigned int iter_last_page_size,
296
+			       int is_write,
297
+			       struct goldfish_pipe_command *command)
354298 {
355299 	/*
356300 	 * Process the first page separately - it's the only page that
....@@ -382,55 +326,60 @@
382326 }
383327 
384328 static int transfer_max_buffers(struct goldfish_pipe *pipe,
385
-	unsigned long address, unsigned long address_end, int is_write,
386
-	unsigned long last_page, unsigned int last_page_size,
387
-	s32 *consumed_size, int *status)
329
+				unsigned long address,
330
+				unsigned long address_end,
331
+				int is_write,
332
+				unsigned long last_page,
333
+				unsigned int last_page_size,
334
+				s32 *consumed_size,
335
+				int *status)
388336 {
389
-	static struct page *pages[MAX_BUFFERS_PER_COMMAND];
390337 	unsigned long first_page = address & PAGE_MASK;
391338 	unsigned int iter_last_page_size;
392
-	int pages_count = pin_user_pages(first_page, last_page,
393
-			last_page_size, is_write,
394
-			pages, &iter_last_page_size);
395
-
396
-	if (pages_count < 0)
397
-		return pages_count;
339
+	int pages_count;
398340 
399341 	/* Serialize access to the pipe command buffers */
400342 	if (mutex_lock_interruptible(&pipe->lock))
401343 		return -ERESTARTSYS;
402344 
403
-	populate_rw_params(pages, pages_count, address, address_end,
404
-		first_page, last_page, iter_last_page_size, is_write,
405
-		pipe->command_buffer);
345
+	pages_count = goldfish_pin_pages(first_page, last_page,
346
+					 last_page_size, is_write,
347
+					 pipe->pages, &iter_last_page_size);
348
+	if (pages_count < 0) {
349
+		mutex_unlock(&pipe->lock);
350
+		return pages_count;
351
+	}
352
+
353
+	populate_rw_params(pipe->pages, pages_count, address, address_end,
354
+			   first_page, last_page, iter_last_page_size, is_write,
355
+			   pipe->command_buffer);
406356 
407357 	/* Transfer the data */
408
-	*status = goldfish_cmd_locked(pipe,
358
+	*status = goldfish_pipe_cmd_locked(pipe,
409359 				is_write ? PIPE_CMD_WRITE : PIPE_CMD_READ);
410360 
411361 	*consumed_size = pipe->command_buffer->rw_params.consumed_size;
412362 
413
-	release_user_pages(pages, pages_count, is_write, *consumed_size);
363
+	unpin_user_pages_dirty_lock(pipe->pages, pages_count,
364
+				    !is_write && *consumed_size > 0);
414365 
415366 	mutex_unlock(&pipe->lock);
416
-
417367 	return 0;
418368 }
419369 
420370 static int wait_for_host_signal(struct goldfish_pipe *pipe, int is_write)
421371 {
422
-	u32 wakeBit = is_write ? BIT_WAKE_ON_WRITE : BIT_WAKE_ON_READ;
372
+	u32 wake_bit = is_write ? BIT_WAKE_ON_WRITE : BIT_WAKE_ON_READ;
423373 
424
-	set_bit(wakeBit, &pipe->flags);
374
+	set_bit(wake_bit, &pipe->flags);
425375 
426376 	/* Tell the emulator we're going to wait for a wake event */
427
-	(void)goldfish_cmd(pipe,
377
+	goldfish_pipe_cmd(pipe,
428378 		is_write ? PIPE_CMD_WAKE_ON_WRITE : PIPE_CMD_WAKE_ON_READ);
429379 
430
-	while (test_bit(wakeBit, &pipe->flags)) {
431
-		if (wait_event_interruptible(
432
-				pipe->wake_queue,
433
-				!test_bit(wakeBit, &pipe->flags)))
380
+	while (test_bit(wake_bit, &pipe->flags)) {
381
+		if (wait_event_interruptible(pipe->wake_queue,
382
+					     !test_bit(wake_bit, &pipe->flags)))
434383 			return -ERESTARTSYS;
435384 
436385 		if (test_bit(BIT_CLOSED_ON_HOST, &pipe->flags))
....@@ -441,7 +390,9 @@
441390 }
442391 
443392 static ssize_t goldfish_pipe_read_write(struct file *filp,
444
-	char __user *buffer, size_t bufflen, int is_write)
393
+					char __user *buffer,
394
+					size_t bufflen,
395
+					int is_write)
445396 {
446397 	struct goldfish_pipe *pipe = filp->private_data;
447398 	int count = 0, ret = -EINVAL;
....@@ -455,8 +406,7 @@
455406 	if (unlikely(bufflen == 0))
456407 		return 0;
457408 	/* Check the buffer range for access */
458
-	if (unlikely(!access_ok(is_write ? VERIFY_WRITE : VERIFY_READ,
459
-			buffer, bufflen)))
409
+	if (unlikely(!access_ok(buffer, bufflen)))
460410 		return -EFAULT;
461411 
462412 	address = (unsigned long)buffer;
....@@ -469,8 +419,8 @@
469419 		int status;
470420 
471421 		ret = transfer_max_buffers(pipe, address, address_end, is_write,
472
-				last_page, last_page_size, &consumed_size,
473
-				&status);
422
+					   last_page, last_page_size,
423
+					   &consumed_size, &status);
474424 		if (ret < 0)
475425 			break;
476426 
....@@ -496,7 +446,8 @@
496446 			 * err.
497447 			 */
498448 			if (status != PIPE_ERROR_AGAIN)
499
-				pr_info_ratelimited("goldfish_pipe: backend error %d on %s\n",
449
+				dev_err_ratelimited(pipe->dev->pdev_dev,
450
+					"backend error %d on %s\n",
500451 					status, is_write ? "write" : "read");
501452 			break;
502453 		}
....@@ -522,19 +473,21 @@
522473 }
523474 
524475 static ssize_t goldfish_pipe_read(struct file *filp, char __user *buffer,
525
-				size_t bufflen, loff_t *ppos)
476
+				  size_t bufflen, loff_t *ppos)
526477 {
527478 	return goldfish_pipe_read_write(filp, buffer, bufflen,
528
-			/* is_write */ 0);
479
+					/* is_write */ 0);
529480 }
530481 
531482 static ssize_t goldfish_pipe_write(struct file *filp,
532
-				const char __user *buffer, size_t bufflen,
533
-				loff_t *ppos)
483
+				   const char __user *buffer, size_t bufflen,
484
+				   loff_t *ppos)
534485 {
535
-	return goldfish_pipe_read_write(filp,
536
-			/* cast away the const */(char __user *)buffer, bufflen,
537
-			/* is_write */ 1);
486
+	/* cast away the const */
487
+	char __user *no_const_buffer = (char __user *)buffer;
488
+
489
+	return goldfish_pipe_read_write(filp, no_const_buffer, bufflen,
490
+					/* is_write */ 1);
538491 }
539492 
540493 static __poll_t goldfish_pipe_poll(struct file *filp, poll_table *wait)
....@@ -545,7 +498,7 @@
545498 
546499 	poll_wait(filp, &pipe->wake_queue, wait);
547500 
548
-	status = goldfish_cmd(pipe, PIPE_CMD_POLL);
501
+	status = goldfish_pipe_cmd(pipe, PIPE_CMD_POLL);
549502 	if (status < 0)
550503 		return -ERESTARTSYS;
551504 
....@@ -562,7 +515,7 @@
562515 }
563516 
564517 static void signalled_pipes_add_locked(struct goldfish_pipe_dev *dev,
565
-	u32 id, u32 flags)
518
+				       u32 id, u32 flags)
566519 {
567520 	struct goldfish_pipe *pipe;
568521 
....@@ -574,8 +527,8 @@
574527 		return;
575528 	pipe->signalled_flags |= flags;
576529 
577
-	if (pipe->prev_signalled || pipe->next_signalled
578
-		|| dev->first_signalled_pipe == pipe)
530
+	if (pipe->prev_signalled || pipe->next_signalled ||
531
+		dev->first_signalled_pipe == pipe)
579532 		return;	/* already in the list */
580533 	pipe->next_signalled = dev->first_signalled_pipe;
581534 	if (dev->first_signalled_pipe)
....@@ -584,7 +537,8 @@
584537 }
585538 
586539 static void signalled_pipes_remove_locked(struct goldfish_pipe_dev *dev,
587
-	struct goldfish_pipe *pipe) {
540
+					  struct goldfish_pipe *pipe)
541
+{
588542 	if (pipe->prev_signalled)
589543 		pipe->prev_signalled->next_signalled = pipe->next_signalled;
590544 	if (pipe->next_signalled)
....@@ -623,10 +577,10 @@
623577 	return pipe;
624578 }
625579 
626
-static void goldfish_interrupt_task(unsigned long unused)
580
+static void goldfish_interrupt_task(unsigned long dev_addr)
627581 {
628
-	struct goldfish_pipe_dev *dev = pipe_dev;
629582 	/* Iterate over the signalled pipes and wake them one by one */
583
+	struct goldfish_pipe_dev *dev = (struct goldfish_pipe_dev *)dev_addr;
630584 	struct goldfish_pipe *pipe;
631585 	int wakes;
632586 
....@@ -646,7 +600,9 @@
646600 		wake_up_interruptible(&pipe->wake_queue);
647601 	}
648602 }
649
-static DECLARE_TASKLET(goldfish_interrupt_tasklet, goldfish_interrupt_task, 0);
603
+
604
+static void goldfish_pipe_device_deinit(struct platform_device *pdev,
605
+					struct goldfish_pipe_dev *dev);
650606 
651607 /*
652608  * The general idea of the interrupt handling:
....@@ -668,7 +624,7 @@
668624 	unsigned long flags;
669625 	struct goldfish_pipe_dev *dev = dev_id;
670626 
671
-	if (dev != pipe_dev)
627
+	if (dev->magic != &goldfish_pipe_device_deinit)
672628 		return IRQ_NONE;
673629 
674630 	/* Request the signalled pipes from the device */
....@@ -689,7 +645,7 @@
689645 
690646 	spin_unlock_irqrestore(&dev->lock, flags);
691647 
692
-	tasklet_schedule(&goldfish_interrupt_tasklet);
648
+	tasklet_schedule(&dev->irq_tasklet);
693649 	return IRQ_HANDLED;
694650 }
695651 
....@@ -702,7 +658,10 @@
702658 			return id;
703659 
704660 	{
705
-		/* Reallocate the array */
661
+		/* Reallocate the array.
662
+		 * Since get_free_pipe_id_locked runs with interrupts disabled,
663
+		 * we don't want to make calls that could lead to sleep.
664
+		 */
706665 		u32 new_capacity = 2 * dev->pipes_capacity;
707666 		struct goldfish_pipe **pipes =
708667 			kcalloc(new_capacity, sizeof(*pipes), GFP_ATOMIC);
....@@ -715,6 +674,14 @@
715674 		dev->pipes_capacity = new_capacity;
716675 	}
717676 	return id;
677
+}
678
+
679
+/* A helper function to get the instance of goldfish_pipe_dev from file */
680
+static struct goldfish_pipe_dev *to_goldfish_pipe_dev(struct file *file)
681
+{
682
+	struct miscdevice *miscdev = file->private_data;
683
+
684
+	return container_of(miscdev, struct goldfish_pipe_dev, miscdev);
718685 }
719686 
720687 /**
....@@ -730,14 +697,15 @@
730697  */
731698 static int goldfish_pipe_open(struct inode *inode, struct file *file)
732699 {
733
-	struct goldfish_pipe_dev *dev = pipe_dev;
700
+	struct goldfish_pipe_dev *dev = to_goldfish_pipe_dev(file);
734701 	unsigned long flags;
735702 	int id;
736703 	int status;
737704 
738705 	/* Allocate new pipe kernel object */
739706 	struct goldfish_pipe *pipe = kzalloc(sizeof(*pipe), GFP_KERNEL);
740
-	if (pipe == NULL)
707
+
708
+	if (!pipe)
741709 		return -ENOMEM;
742710 
743711 	pipe->dev = dev;
....@@ -748,6 +716,7 @@
748716 	 * Command buffer needs to be allocated on its own page to make sure
749717 	 * it is physically contiguous in host's address space.
750718 	 */
719
+	BUILD_BUG_ON(sizeof(struct goldfish_pipe_command) > PAGE_SIZE);
751720 	pipe->command_buffer =
752721 		(struct goldfish_pipe_command *)__get_free_page(GFP_KERNEL);
753722 	if (!pipe->command_buffer) {
....@@ -772,7 +741,7 @@
772741 			MAX_BUFFERS_PER_COMMAND;
773742 	dev->buffers->open_command_params.command_buffer_ptr =
774743 			(u64)(unsigned long)__pa(pipe->command_buffer);
775
-	status = goldfish_cmd_locked(pipe, PIPE_CMD_OPEN);
744
+	status = goldfish_pipe_cmd_locked(pipe, PIPE_CMD_OPEN);
776745 	spin_unlock_irqrestore(&dev->lock, flags);
777746 	if (status < 0)
778747 		goto err_cmd;
....@@ -798,7 +767,7 @@
798767 	struct goldfish_pipe_dev *dev = pipe->dev;
799768 
800769 	/* The guest is closing the channel, so tell the emulator right now */
801
-	(void)goldfish_cmd(pipe, PIPE_CMD_CLOSE);
770
+	goldfish_pipe_cmd(pipe, PIPE_CMD_CLOSE);
802771 
803772 	spin_lock_irqsave(&dev->lock, flags);
804773 	dev->pipes[pipe->id] = NULL;
....@@ -820,36 +789,55 @@
820789 	.release = goldfish_pipe_release,
821790 };
822791 
823
-static struct miscdevice goldfish_pipe_dev = {
824
-	.minor = MISC_DYNAMIC_MINOR,
825
-	.name = "goldfish_pipe",
826
-	.fops = &goldfish_pipe_fops,
827
-};
828
-
829
-static int goldfish_pipe_device_init(struct platform_device *pdev)
792
+static void init_miscdevice(struct miscdevice *miscdev)
830793 {
831
-	char *page;
832
-	struct goldfish_pipe_dev *dev = pipe_dev;
833
-	int err = devm_request_irq(&pdev->dev, dev->irq,
834
-				goldfish_pipe_interrupt,
835
-				IRQF_SHARED, "goldfish_pipe", dev);
794
+	memset(miscdev, 0, sizeof(*miscdev));
795
+
796
+	miscdev->minor = MISC_DYNAMIC_MINOR;
797
+	miscdev->name = "goldfish_pipe";
798
+	miscdev->fops = &goldfish_pipe_fops;
799
+}
800
+
801
+static void write_pa_addr(void *addr, void __iomem *portl, void __iomem *porth)
802
+{
803
+	const unsigned long paddr = __pa(addr);
804
+
805
+	writel(upper_32_bits(paddr), porth);
806
+	writel(lower_32_bits(paddr), portl);
807
+}
808
+
809
+static int goldfish_pipe_device_init(struct platform_device *pdev,
810
+				     struct goldfish_pipe_dev *dev)
811
+{
812
+	int err;
813
+
814
+	tasklet_init(&dev->irq_tasklet, &goldfish_interrupt_task,
815
+		     (unsigned long)dev);
816
+
817
+	err = devm_request_irq(&pdev->dev, dev->irq,
818
+			       goldfish_pipe_interrupt,
819
+			       IRQF_SHARED, "goldfish_pipe", dev);
836820 	if (err) {
837821 		dev_err(&pdev->dev, "unable to allocate IRQ for v2\n");
838822 		return err;
839823 	}
840824 
841
-	err = misc_register(&goldfish_pipe_dev);
825
+	init_miscdevice(&dev->miscdev);
826
+	err = misc_register(&dev->miscdev);
842827 	if (err) {
843828 		dev_err(&pdev->dev, "unable to register v2 device\n");
844829 		return err;
845830 	}
846831 
832
+	dev->pdev_dev = &pdev->dev;
847833 	dev->first_signalled_pipe = NULL;
848834 	dev->pipes_capacity = INITIAL_PIPES_CAPACITY;
849835 	dev->pipes = kcalloc(dev->pipes_capacity, sizeof(*dev->pipes),
850
-					GFP_KERNEL);
851
-	if (!dev->pipes)
836
+			     GFP_KERNEL);
837
+	if (!dev->pipes) {
838
+		misc_deregister(&dev->miscdev);
852839 		return -ENOMEM;
840
+	}
853841 
854842 	/*
855843 	 * We're going to pass two buffers, open_command_params and
....@@ -857,75 +845,67 @@
857845 	 * needs to be contained in a single physical page. The easiest choice
858846 	 * is to just allocate a page and place the buffers in it.
859847 	 */
860
-	if (WARN_ON(sizeof(*dev->buffers) > PAGE_SIZE))
861
-		return -ENOMEM;
862
-
863
-	page = (char *)__get_free_page(GFP_KERNEL);
864
-	if (!page) {
848
+	BUILD_BUG_ON(sizeof(struct goldfish_pipe_dev_buffers) > PAGE_SIZE);
849
+	dev->buffers = (struct goldfish_pipe_dev_buffers *)
850
+		__get_free_page(GFP_KERNEL);
851
+	if (!dev->buffers) {
865852 		kfree(dev->pipes);
853
+		misc_deregister(&dev->miscdev);
866854 		return -ENOMEM;
867855 	}
868
-	dev->buffers = (struct goldfish_pipe_dev_buffers *)page;
869856 
870857 	/* Send the buffer addresses to the host */
871
-	{
872
-		u64 paddr = __pa(&dev->buffers->signalled_pipe_buffers);
858
+	write_pa_addr(&dev->buffers->signalled_pipe_buffers,
859
+		      dev->base + PIPE_REG_SIGNAL_BUFFER,
860
+		      dev->base + PIPE_REG_SIGNAL_BUFFER_HIGH);
873861 
874
-		writel((u32)(unsigned long)(paddr >> 32),
875
-			dev->base + PIPE_REG_SIGNAL_BUFFER_HIGH);
876
-		writel((u32)(unsigned long)paddr,
877
-			dev->base + PIPE_REG_SIGNAL_BUFFER);
878
-		writel((u32)MAX_SIGNALLED_PIPES,
879
-			dev->base + PIPE_REG_SIGNAL_BUFFER_COUNT);
862
+	writel(MAX_SIGNALLED_PIPES,
863
+	       dev->base + PIPE_REG_SIGNAL_BUFFER_COUNT);
880864 
881
-		paddr = __pa(&dev->buffers->open_command_params);
882
-		writel((u32)(unsigned long)(paddr >> 32),
883
-			dev->base + PIPE_REG_OPEN_BUFFER_HIGH);
884
-		writel((u32)(unsigned long)paddr,
885
-			dev->base + PIPE_REG_OPEN_BUFFER);
886
-	}
865
+	write_pa_addr(&dev->buffers->open_command_params,
866
+		      dev->base + PIPE_REG_OPEN_BUFFER,
867
+		      dev->base + PIPE_REG_OPEN_BUFFER_HIGH);
868
+
869
+	platform_set_drvdata(pdev, dev);
887870 	return 0;
888871 }
889872 
890
-static void goldfish_pipe_device_deinit(struct platform_device *pdev)
873
+static void goldfish_pipe_device_deinit(struct platform_device *pdev,
874
+					struct goldfish_pipe_dev *dev)
891875 {
892
-	struct goldfish_pipe_dev *dev = pipe_dev;
893
-
894
-	misc_deregister(&goldfish_pipe_dev);
876
+	misc_deregister(&dev->miscdev);
877
+	tasklet_kill(&dev->irq_tasklet);
895878 	kfree(dev->pipes);
896879 	free_page((unsigned long)dev->buffers);
897880 }
898881 
899882 static int goldfish_pipe_probe(struct platform_device *pdev)
900883 {
901
-	int err;
902884 	struct resource *r;
903
-	struct goldfish_pipe_dev *dev = pipe_dev;
885
+	struct goldfish_pipe_dev *dev;
904886 
905
-	if (WARN_ON(sizeof(struct goldfish_pipe_command) > PAGE_SIZE))
887
+	dev = devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL);
888
+	if (!dev)
906889 		return -ENOMEM;
907890 
908
-	/* not thread safe, but this should not happen */
909
-	WARN_ON(dev->base != NULL);
910
-
891
+	dev->magic = &goldfish_pipe_device_deinit;
911892 	spin_lock_init(&dev->lock);
912893 
913894 	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
914
-	if (r == NULL || resource_size(r) < PAGE_SIZE) {
895
+	if (!r || resource_size(r) < PAGE_SIZE) {
915896 		dev_err(&pdev->dev, "can't allocate i/o page\n");
916897 		return -EINVAL;
917898 	}
918899 	dev->base = devm_ioremap(&pdev->dev, r->start, PAGE_SIZE);
919
-	if (dev->base == NULL) {
900
+	if (!dev->base) {
920901 		dev_err(&pdev->dev, "ioremap failed\n");
921902 		return -EINVAL;
922903 	}
923904 
924905 	r = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
925
-	if (r == NULL) {
926
-		err = -EINVAL;
927
-		goto error;
928
-	}
906
+	if (!r)
907
+		return -EINVAL;
908
+
929909 	dev->irq = r->start;
930910 
931911 	/*
....@@ -935,25 +915,19 @@
935915 	 *  reading device version back: this allows the host implementation to
936916 	 *  detect the old driver (if there was no version write before read).
937917 	 */
938
-	writel((u32)PIPE_DRIVER_VERSION, dev->base + PIPE_REG_VERSION);
918
+	writel(PIPE_DRIVER_VERSION, dev->base + PIPE_REG_VERSION);
939919 	dev->version = readl(dev->base + PIPE_REG_VERSION);
940920 	if (WARN_ON(dev->version < PIPE_CURRENT_DEVICE_VERSION))
941921 		return -EINVAL;
942922 
943
-	err = goldfish_pipe_device_init(pdev);
944
-	if (!err)
945
-		return 0;
946
-
947
-error:
948
-	dev->base = NULL;
949
-	return err;
923
+	return goldfish_pipe_device_init(pdev, dev);
950924 }
951925 
952926 static int goldfish_pipe_remove(struct platform_device *pdev)
953927 {
954
-	struct goldfish_pipe_dev *dev = pipe_dev;
955
-	goldfish_pipe_device_deinit(pdev);
956
-	dev->base = NULL;
928
+	struct goldfish_pipe_dev *dev = platform_get_drvdata(pdev);
929
+
930
+	goldfish_pipe_device_deinit(pdev, dev);
957931 	return 0;
958932 }
959933 
....@@ -981,4 +955,4 @@
981955 
982956 module_platform_driver(goldfish_pipe_driver);
983957 MODULE_AUTHOR("David Turner <digit@google.com>");
984
-MODULE_LICENSE("GPL");
958
+MODULE_LICENSE("GPL v2");