1 /* Copyright (C) 2007-2008 The Android Open Source Project
2 **
3 ** This software is licensed under the terms of the GNU General Public
4 ** License version 2, as published by the Free Software Foundation, and
5 ** may be copied, distributed, and modified under those terms.
6 **
7 ** This program is distributed in the hope that it will be useful,
8 ** but WITHOUT ANY WARRANTY; without even the implied warranty of
9 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 ** GNU General Public License for more details.
11 */
12 #include "android/hw-qemud.h"
13 #include "android/utils/debug.h"
14 #include "android/utils/misc.h"
15 #include "android/utils/system.h"
16 #include "android/utils/bufprint.h"
17 #include "android/looper.h"
18 #include "hw/hw.h"
19 #include "hw/goldfish_pipe.h"
20 #include "qemu-char.h"
21 #include "charpipe.h"
22 #include "cbuffer.h"
23 #include "utils/panic.h"
24
25 #define D(...) VERBOSE_PRINT(qemud,__VA_ARGS__)
26 #define D_ACTIVE VERBOSE_CHECK(qemud)
27
28 /* the T(...) macro is used to dump traffic */
29 #define T_ACTIVE 0
30
31 #if T_ACTIVE
32 #define T(...) VERBOSE_PRINT(qemud,__VA_ARGS__)
33 #else
34 #define T(...) ((void)0)
35 #endif
36
37 /* max serial MTU. Don't change this without modifying
38 * development/emulator/qemud/qemud.c as well.
39 */
40 #define MAX_SERIAL_PAYLOAD 4000
41
42 /* max framed data payload. Must be < (1 << 16)
43 */
44 #define MAX_FRAME_PAYLOAD 65535
45
46 /* Version number of snapshots code. Increment whenever the data saved
47 * or the layout in which it is saved is changed.
48 */
49 #define QEMUD_SAVE_VERSION 2
50
51 #define min(a, b) (((a) < (b)) ? (a) : (b))
52
53
54 /* define SUPPORT_LEGACY_QEMUD to 1 if you want to support
55 * talking to a legacy qemud daemon. See docs/ANDROID-QEMUD.TXT
56 * for details.
57 */
58 #ifdef TARGET_ARM
59 #define SUPPORT_LEGACY_QEMUD 1
60 #endif
61 #ifdef TARGET_I386
62 #define SUPPORT_LEGACY_QEMUD 0 /* no legacy support */
63 #endif
64 #if SUPPORT_LEGACY_QEMUD
65 #include "telephony/android_modem.h"
66 #include "telephony/modem_driver.h"
67 #endif
68
69 /*
70 * This implements support for the 'qemud' multiplexing communication
71 * channel between clients running in the emulated system and 'services'
72 * provided by the emulator.
73 *
74 * For additional details, please read docs/ANDROID-QEMUD.TXT
75 *
76 */
77
78 /*
79 * IMPLEMENTATION DETAILS:
80 *
81 * We use one charpipe to connect the emulated serial port to the 'QemudSerial'
82 * object. This object is used to receive data from the serial port, and
83 * unframe messages (i.e. extract payload length + channel id from header,
84 * then the payload itself), before sending them to a generic receiver.
85 *
86 * The QemudSerial object can also be used to send messages to the daemon
87 * through the serial port (see qemud_serial_send())
88 *
89 * The multiplexer is connected to one or more 'service' objects.
90 * are themselves connected through a charpipe to an emulated device or
91 * control sub-module in the emulator.
92 *
93 * tty <==charpipe==> QemudSerial ---> QemudMultiplexer ----> QemudClient
94 * ^ |
95 * | |
96 * +--------------------------------------+
97 *
98 */
99
100 /** HANDLING INCOMING DATA FRAMES
101 **/
102
103 /* A QemudSink is just a handly data structure that is used to
104 * read a fixed amount of bytes into a buffer
105 */
106 typedef struct QemudSink {
107 int used; /* number of bytes already used */
108 int size; /* total number of bytes in buff */
109 uint8_t* buff;
110 } QemudSink;
111
112 /* save the state of a QemudSink to a snapshot.
113 *
114 * The buffer pointer is not saved, since it usually points to buffer
115 * fields in other structs, which have save functions themselves. It
116 * is up to the caller to make sure the buffer is correctly saved and
117 * restored.
118 */
119 static void
qemud_sink_save(QEMUFile * f,QemudSink * s)120 qemud_sink_save(QEMUFile* f, QemudSink* s)
121 {
122 qemu_put_be32(f, s->used);
123 qemu_put_be32(f, s->size);
124 }
125
126 /* load the state of a QemudSink from a snapshot.
127 */
128 static int
qemud_sink_load(QEMUFile * f,QemudSink * s)129 qemud_sink_load(QEMUFile* f, QemudSink* s)
130 {
131 s->used = qemu_get_be32(f);
132 s->size = qemu_get_be32(f);
133 return 0;
134 }
135
136
137 /* reset a QemudSink, i.e. provide a new destination buffer address
138 * and its size in bytes.
139 */
140 static void
qemud_sink_reset(QemudSink * ss,int size,uint8_t * buffer)141 qemud_sink_reset( QemudSink* ss, int size, uint8_t* buffer )
142 {
143 ss->used = 0;
144 ss->size = size;
145 ss->buff = buffer;
146 }
147
148 /* try to fill the sink by reading bytes from the source buffer
149 * '*pmsg' which contains '*plen' bytes
150 *
151 * this functions updates '*pmsg' and '*plen', and returns
152 * 1 if the sink's destination buffer is full, or 0 otherwise.
153 */
154 static int
qemud_sink_fill(QemudSink * ss,const uint8_t ** pmsg,int * plen)155 qemud_sink_fill( QemudSink* ss, const uint8_t* *pmsg, int *plen)
156 {
157 int avail = ss->size - ss->used;
158
159 if (avail <= 0)
160 return 1;
161
162 if (avail > *plen)
163 avail = *plen;
164
165 memcpy(ss->buff + ss->used, *pmsg, avail);
166 *pmsg += avail;
167 *plen -= avail;
168 ss->used += avail;
169
170 return (ss->used == ss->size);
171 }
172
173 /* returns the number of bytes needed to fill a sink's destination
174 * buffer.
175 */
176 static int
qemud_sink_needed(QemudSink * ss)177 qemud_sink_needed( QemudSink* ss )
178 {
179 return ss->size - ss->used;
180 }
181
182 /** HANDLING SERIAL PORT CONNECTION
183 **/
184
185 /* The QemudSerial object receives data from the serial port charpipe.
186 * It parses the header to extract the channel id and payload length,
187 * then the message itself.
188 *
189 * Incoming messages are sent to a generic receiver identified by
190 * the 'recv_opaque' and 'recv_func' parameters to qemud_serial_init()
191 *
192 * It also provides qemud_serial_send() which can be used to send
193 * messages back through the serial port.
194 */
195
196 #define HEADER_SIZE 6
197
198 #define LENGTH_OFFSET 2
199 #define LENGTH_SIZE 4
200
201 #define CHANNEL_OFFSET 0
202 #define CHANNEL_SIZE 2
203
204 #if SUPPORT_LEGACY_QEMUD
205 typedef enum {
206 QEMUD_VERSION_UNKNOWN,
207 QEMUD_VERSION_LEGACY,
208 QEMUD_VERSION_NORMAL
209 } QemudVersion;
210
211 # define LEGACY_LENGTH_OFFSET 0
212 # define LEGACY_CHANNEL_OFFSET 4
213 #endif
214
215 /* length of the framed header */
216 #define FRAME_HEADER_SIZE 4
217
218 #define BUFFER_SIZE MAX_SERIAL_PAYLOAD
219
220 /* out of convenience, the incoming message is zero-terminated
221 * and can be modified by the receiver (e.g. for tokenization).
222 */
223 typedef void (*QemudSerialReceive)( void* opaque, int channel, uint8_t* msg, int msglen);
224
225 typedef struct QemudSerial {
226 CharDriverState* cs; /* serial charpipe endpoint */
227
228 /* managing incoming packets from the serial port */
229 ABool need_header;
230 int overflow;
231 int in_size;
232 int in_channel;
233 #if SUPPORT_LEGACY_QEMUD
234 QemudVersion version;
235 #endif
236 QemudSink header[1];
237 QemudSink payload[1];
238 uint8_t data0[MAX_SERIAL_PAYLOAD+1];
239
240 /* receiver */
241 QemudSerialReceive recv_func; /* receiver callback */
242 void* recv_opaque; /* receiver user-specific data */
243 } QemudSerial;
244
245
246 /* Save the state of a QemudSerial to a snapshot file.
247 */
248 static void
qemud_serial_save(QEMUFile * f,QemudSerial * s)249 qemud_serial_save(QEMUFile* f, QemudSerial* s)
250 {
251 /* cs, recv_func and recv_opaque are not saved, as these are assigned only
252 * during emulator init. A load within a session can re-use the values
253 * already assigned, a newly launched emulator has freshly assigned values.
254 */
255
256 /* state of incoming packets from the serial port */
257 qemu_put_be32(f, s->need_header);
258 qemu_put_be32(f, s->overflow);
259 qemu_put_be32(f, s->in_size);
260 qemu_put_be32(f, s->in_channel);
261 #if SUPPORT_LEGACY_QEMUD
262 qemu_put_be32(f, s->version);
263 #endif
264 qemud_sink_save(f, s->header);
265 qemud_sink_save(f, s->payload);
266 qemu_put_be32(f, MAX_SERIAL_PAYLOAD+1);
267 qemu_put_buffer(f, s->data0, MAX_SERIAL_PAYLOAD+1);
268 }
269
270 /* Load the state of a QemudSerial from a snapshot file.
271 */
272 static int
qemud_serial_load(QEMUFile * f,QemudSerial * s)273 qemud_serial_load(QEMUFile* f, QemudSerial* s)
274 {
275 /* state of incoming packets from the serial port */
276 s->need_header = qemu_get_be32(f);
277 s->overflow = qemu_get_be32(f);
278 s->in_size = qemu_get_be32(f);
279 s->in_channel = qemu_get_be32(f);
280 #if SUPPORT_LEGACY_QEMUD
281 s->version = qemu_get_be32(f);
282 #endif
283 qemud_sink_load(f, s->header);
284 qemud_sink_load(f, s->payload);
285
286 /* s->header and s->payload are only ever connected to s->data0 */
287 s->header->buff = s->payload->buff = s->data0;
288
289 int len = qemu_get_be32(f);
290 if (len - 1 > MAX_SERIAL_PAYLOAD) {
291 D("%s: load failed: size of saved payload buffer (%d) exceeds "
292 "current maximum (%d)\n",
293 __FUNCTION__, len - 1, MAX_SERIAL_PAYLOAD);
294 return -EIO;
295 }
296 int ret;
297 if ((ret = qemu_get_buffer(f, s->data0, len)) != len) {
298 D("%s: failed to load serial buffer contents (tried reading %d bytes, got %d)\n",
299 __FUNCTION__, len, ret);
300 return -EIO;
301 }
302
303 return 0;
304 }
305
306 /* called by the charpipe to see how much bytes can be
307 * read from the serial port.
308 */
309 static int
qemud_serial_can_read(void * opaque)310 qemud_serial_can_read( void* opaque )
311 {
312 QemudSerial* s = opaque;
313
314 if (s->overflow > 0) {
315 return s->overflow;
316 }
317
318 /* if in_size is 0, we're reading the header */
319 if (s->need_header)
320 return qemud_sink_needed(s->header);
321
322 /* otherwise, we're reading the payload */
323 return qemud_sink_needed(s->payload);
324 }
325
326 /* called by the charpipe to read data from the serial
327 * port. 'len' cannot be more than the value returned
328 * by 'qemud_serial_can_read'.
329 */
330 static void
qemud_serial_read(void * opaque,const uint8_t * from,int len)331 qemud_serial_read( void* opaque, const uint8_t* from, int len )
332 {
333 QemudSerial* s = opaque;
334
335 T("%s: received %3d bytes: '%s'", __FUNCTION__, len, quote_bytes((const void*)from, len));
336
337 while (len > 0) {
338 int avail;
339
340 /* skip overflow bytes */
341 if (s->overflow > 0) {
342 avail = s->overflow;
343 if (avail > len)
344 avail = len;
345
346 from += avail;
347 len -= avail;
348 continue;
349 }
350
351 /* read header if needed */
352 if (s->need_header) {
353 if (!qemud_sink_fill(s->header, (const uint8_t**)&from, &len))
354 break;
355
356 #if SUPPORT_LEGACY_QEMUD
357 if (s->version == QEMUD_VERSION_UNKNOWN) {
358 /* if we receive "001200" as the first header, then we
359 * detected a legacy qemud daemon. See the comments
360 * in qemud_serial_send_legacy_probe() for details.
361 */
362 if ( !memcmp(s->data0, "001200", 6) ) {
363 D("%s: legacy qemud detected.", __FUNCTION__);
364 s->version = QEMUD_VERSION_LEGACY;
365 /* tell the modem to use legacy emulation mode */
366 amodem_set_legacy(android_modem);
367 } else {
368 D("%s: normal qemud detected.", __FUNCTION__);
369 s->version = QEMUD_VERSION_NORMAL;
370 }
371 }
372
373 if (s->version == QEMUD_VERSION_LEGACY) {
374 s->in_size = hex2int( s->data0 + LEGACY_LENGTH_OFFSET, LENGTH_SIZE );
375 s->in_channel = hex2int( s->data0 + LEGACY_CHANNEL_OFFSET, CHANNEL_SIZE );
376 } else {
377 s->in_size = hex2int( s->data0 + LENGTH_OFFSET, LENGTH_SIZE );
378 s->in_channel = hex2int( s->data0 + CHANNEL_OFFSET, CHANNEL_SIZE );
379 }
380 #else
381 /* extract payload length + channel id */
382 s->in_size = hex2int( s->data0 + LENGTH_OFFSET, LENGTH_SIZE );
383 s->in_channel = hex2int( s->data0 + CHANNEL_OFFSET, CHANNEL_SIZE );
384 #endif
385 s->header->used = 0;
386
387 if (s->in_size <= 0 || s->in_channel < 0) {
388 D("%s: bad header: '%.*s'", __FUNCTION__, HEADER_SIZE, s->data0);
389 continue;
390 }
391
392 if (s->in_size > MAX_SERIAL_PAYLOAD) {
393 D("%s: ignoring huge serial packet: length=%d channel=%1",
394 __FUNCTION__, s->in_size, s->in_channel);
395 s->overflow = s->in_size;
396 continue;
397 }
398
399 /* prepare 'in_data' for payload */
400 s->need_header = 0;
401 qemud_sink_reset(s->payload, s->in_size, s->data0);
402 }
403
404 /* read payload bytes */
405 if (!qemud_sink_fill(s->payload, &from, &len))
406 break;
407
408 /* zero-terminate payload, then send it to receiver */
409 s->payload->buff[s->payload->size] = 0;
410 D("%s: channel=%2d len=%3d '%s'", __FUNCTION__,
411 s->in_channel, s->payload->size,
412 quote_bytes((const void*)s->payload->buff, s->payload->size));
413
414 s->recv_func( s->recv_opaque, s->in_channel, s->payload->buff, s->payload->size );
415
416 /* prepare for new header */
417 s->need_header = 1;
418 }
419 }
420
421
422 #if SUPPORT_LEGACY_QEMUD
423 static void
qemud_serial_send_legacy_probe(QemudSerial * s)424 qemud_serial_send_legacy_probe( QemudSerial* s )
425 {
426 /* we're going to send a specially crafted packet to the qemud
427 * daemon, this will help us determine whether we're talking
428 * to a legacy or a normal daemon.
429 *
430 * the trick is to known that a legacy daemon uses the following
431 * header:
432 *
433 * <length><channel><payload>
434 *
435 * while the normal one uses:
436 *
437 * <channel><length><payload>
438 *
439 * where <channel> is a 2-hexchar string, and <length> a 4-hexchar
440 * string.
441 *
442 * if we send a header of "000100", it is interpreted:
443 *
444 * - as the header of a 1-byte payload by the legacy daemon
445 * - as the header of a 256-byte payload by the normal one.
446 *
447 * we're going to send something that looks like:
448 *
449 * "000100" + "X" +
450 * "000b00" + "connect:gsm" +
451 * "000b00" + "connect:gps" +
452 * "000f00" + "connect:control" +
453 * "00c210" + "0"*194
454 *
455 * the normal daemon will interpret this as a 256-byte payload
456 * for channel 0, with garbage content ("X000b00conn...") which
457 * will be silently ignored.
458 *
459 * on the other hand, the legacy daemon will see it as a
460 * series of packets:
461 *
462 * one message "X" on channel 0, which will force the daemon
463 * to send back "001200ko:unknown command" as its first answer.
464 *
465 * three "connect:<xxx>" messages used to receive the channel
466 * numbers of the three legacy services implemented by the daemon.
467 *
468 * a garbage packet of 194 zeroes for channel 16, which will be
469 * silently ignored.
470 */
471 uint8_t tab[194];
472
473 memset(tab, 0, sizeof(tab));
474 qemu_chr_write(s->cs, (uint8_t*)"000100X", 7);
475 qemu_chr_write(s->cs, (uint8_t*)"000b00connect:gsm", 17);
476 qemu_chr_write(s->cs, (uint8_t*)"000b00connect:gps", 17);
477 qemu_chr_write(s->cs, (uint8_t*)"000f00connect:control", 21);
478 qemu_chr_write(s->cs, (uint8_t*)"00c210", 6);
479 qemu_chr_write(s->cs, tab, sizeof(tab));
480 }
481 #endif /* SUPPORT_LEGACY_QEMUD */
482
483 /* intialize a QemudSerial object with a charpipe endpoint
484 * and a receiver.
485 */
486 static void
qemud_serial_init(QemudSerial * s,CharDriverState * cs,QemudSerialReceive recv_func,void * recv_opaque)487 qemud_serial_init( QemudSerial* s,
488 CharDriverState* cs,
489 QemudSerialReceive recv_func,
490 void* recv_opaque )
491 {
492 s->cs = cs;
493 s->recv_func = recv_func;
494 s->recv_opaque = recv_opaque;
495 s->need_header = 1;
496 s->overflow = 0;
497
498 qemud_sink_reset( s->header, HEADER_SIZE, s->data0 );
499 s->in_size = 0;
500 s->in_channel = -1;
501
502 #if SUPPORT_LEGACY_QEMUD
503 s->version = QEMUD_VERSION_UNKNOWN;
504 qemud_serial_send_legacy_probe(s);
505 #endif
506
507 qemu_chr_add_handlers( cs,
508 qemud_serial_can_read,
509 qemud_serial_read,
510 NULL,
511 s );
512 }
513
514 /* send a message to the serial port. This will add the necessary
515 * header.
516 */
517 static void
qemud_serial_send(QemudSerial * s,int channel,ABool framing,const uint8_t * msg,int msglen)518 qemud_serial_send( QemudSerial* s,
519 int channel,
520 ABool framing,
521 const uint8_t* msg,
522 int msglen )
523 {
524 uint8_t header[HEADER_SIZE];
525 uint8_t frame[FRAME_HEADER_SIZE];
526 int avail, len = msglen;
527
528 if (msglen <= 0 || channel < 0)
529 return;
530
531 D("%s: channel=%2d len=%3d '%s'",
532 __FUNCTION__, channel, msglen,
533 quote_bytes((const void*)msg, msglen));
534
535 if (framing) {
536 len += FRAME_HEADER_SIZE;
537 }
538
539 /* packetize the payload for the serial MTU */
540 while (len > 0)
541 {
542 avail = len;
543 if (avail > MAX_SERIAL_PAYLOAD)
544 avail = MAX_SERIAL_PAYLOAD;
545
546 /* write this packet's header */
547 #if SUPPORT_LEGACY_QEMUD
548 if (s->version == QEMUD_VERSION_LEGACY) {
549 int2hex(header + LEGACY_LENGTH_OFFSET, LENGTH_SIZE, avail);
550 int2hex(header + LEGACY_CHANNEL_OFFSET, CHANNEL_SIZE, channel);
551 } else {
552 int2hex(header + LENGTH_OFFSET, LENGTH_SIZE, avail);
553 int2hex(header + CHANNEL_OFFSET, CHANNEL_SIZE, channel);
554 }
555 #else
556 int2hex(header + LENGTH_OFFSET, LENGTH_SIZE, avail);
557 int2hex(header + CHANNEL_OFFSET, CHANNEL_SIZE, channel);
558 #endif
559 T("%s: '%.*s'", __FUNCTION__, HEADER_SIZE, header);
560 qemu_chr_write(s->cs, header, HEADER_SIZE);
561
562 /* insert frame header when needed */
563 if (framing) {
564 int2hex(frame, FRAME_HEADER_SIZE, msglen);
565 T("%s: '%.*s'", __FUNCTION__, FRAME_HEADER_SIZE, frame);
566 qemu_chr_write(s->cs, frame, FRAME_HEADER_SIZE);
567 avail -= FRAME_HEADER_SIZE;
568 len -= FRAME_HEADER_SIZE;
569 framing = 0;
570 }
571
572 /* write message content */
573 T("%s: '%.*s'", __FUNCTION__, avail, msg);
574 qemu_chr_write(s->cs, msg, avail);
575 msg += avail;
576 len -= avail;
577 }
578 }
579
580 /** CLIENTS
581 **/
582
583 /* Descriptor for a data buffer pending to be sent to a qemud pipe client.
584 *
585 * When a service decides to send data to the client, there could be cases when
586 * client is not ready to read them. In this case there is no GoldfishPipeBuffer
587 * available to write service's data to, So, we need to cache that data into the
588 * client descriptor, and "send" them over to the client in _qemudPipe_recvBuffers
589 * callback. Pending service data is stored in the client descriptor as a list
590 * of QemudPipeMessage instances.
591 */
592 typedef struct QemudPipeMessage QemudPipeMessage;
593 struct QemudPipeMessage {
594 /* Message to send. */
595 uint8_t* message;
596 /* Message size. */
597 size_t size;
598 /* Offset in the message buffer of the chunk, that has not been sent
599 * to the pipe yet. */
600 size_t offset;
601 /* Links next message in the client. */
602 QemudPipeMessage* next;
603 };
604
605
606 /* A QemudClient models a single client as seen by the emulator.
607 * Each client has its own channel id (for the serial qemud), or pipe descriptor
608 * (for the pipe based qemud), and belongs to a given QemudService (see below).
609 *
610 * There is a global list of serial clients used to multiplex incoming
611 * messages from the channel id (see qemud_multiplexer_serial_recv()). Pipe
612 * clients don't need multiplexing, because they are communicated via qemud pipes
613 * that are unique for each client.
614 *
615 */
616
617 /* Defines type of the client: pipe, or serial.
618 */
619 typedef enum QemudProtocol {
620 /* Client is communicating via pipe. */
621 QEMUD_PROTOCOL_PIPE,
622 /* Client is communicating via serial port. */
623 QEMUD_PROTOCOL_SERIAL
624 } QemudProtocol;
625
626 /* Descriptor for a QEMUD pipe connection.
627 *
628 * Every time a client connects to the QEMUD via pipe, an instance of this
629 * structure is created to represent a connection used by new pipe client.
630 */
631 typedef struct QemudPipe {
632 /* Pipe descriptor. */
633 void* hwpipe;
634 /* Looper used for I/O */
635 void* looper;
636 /* Service for this pipe. */
637 QemudService* service;
638 /* Client for this pipe. */
639 QemudClient* client;
640 } QemudPipe;
641
642 struct QemudClient {
643 /* Defines protocol, used by the client. */
644 QemudProtocol protocol;
645
646 /* Fields that are common for all protocols. */
647 char* param;
648 void* clie_opaque;
649 QemudClientRecv clie_recv;
650 QemudClientClose clie_close;
651 QemudClientSave clie_save;
652 QemudClientLoad clie_load;
653 QemudService* service;
654 QemudClient* next_serv; /* next in same service */
655 QemudClient* next;
656 QemudClient** pref;
657
658 /* framing support */
659 int framing;
660 ABool need_header;
661 ABool closing;
662 QemudSink header[1];
663 uint8_t header0[FRAME_HEADER_SIZE];
664 QemudSink payload[1];
665
666 /* Fields that are protocol-specific. */
667 union {
668 /* Serial-specific fields. */
669 struct {
670 int channel;
671 QemudSerial* serial;
672 } Serial;
673 /* Pipe-specific fields. */
674 struct {
675 QemudPipe* qemud_pipe;
676 QemudPipeMessage* messages;
677 } Pipe;
678 } ProtocolSelector;
679 };
680
681 static ABool
_is_pipe_client(QemudClient * client)682 _is_pipe_client(QemudClient* client)
683 {
684 return (client-> protocol == QEMUD_PROTOCOL_PIPE) ? true : false;
685 }
686
687 static void qemud_service_remove_client( QemudService* service,
688 QemudClient* client );
689
690 /* remove a QemudClient from global list */
691 static void
qemud_client_remove(QemudClient * c)692 qemud_client_remove( QemudClient* c )
693 {
694 c->pref[0] = c->next;
695 if (c->next)
696 c->next->pref = c->pref;
697
698 c->next = NULL;
699 c->pref = &c->next;
700 }
701
702 /* add a QemudClient to global list */
703 static void
qemud_client_prepend(QemudClient * c,QemudClient ** plist)704 qemud_client_prepend( QemudClient* c, QemudClient** plist )
705 {
706 c->next = *plist;
707 c->pref = plist;
708 *plist = c;
709 if (c->next)
710 c->next->pref = &c->next;
711 }
712
713 /* receive a new message from a client, and dispatch it to
714 * the real service implementation.
715 */
716 static void
qemud_client_recv(void * opaque,uint8_t * msg,int msglen)717 qemud_client_recv( void* opaque, uint8_t* msg, int msglen )
718 {
719 QemudClient* c = opaque;
720
721 /* no framing, things are simple */
722 if (!c->framing) {
723 if (c->clie_recv)
724 c->clie_recv( c->clie_opaque, msg, msglen, c );
725 return;
726 }
727
728 /* framing */
729
730 #if 1
731 /* special case, in 99% of cases, everything is in
732 * the incoming message, and we can do all we need
733 * directly without dynamic allocation.
734 */
735 if (msglen > FRAME_HEADER_SIZE &&
736 c->need_header == 1 &&
737 qemud_sink_needed(c->header) == 0)
738 {
739 int len = hex2int( msg, FRAME_HEADER_SIZE );
740
741 if (len >= 0 && msglen == len + FRAME_HEADER_SIZE) {
742 if (c->clie_recv)
743 c->clie_recv( c->clie_opaque,
744 msg+FRAME_HEADER_SIZE,
745 msglen-FRAME_HEADER_SIZE, c );
746 return;
747 }
748 }
749 #endif
750
751 while (msglen > 0) {
752 uint8_t *data;
753
754 /* read the header */
755 if (c->need_header) {
756 int frame_size;
757 uint8_t* data;
758
759 if (!qemud_sink_fill(c->header, (const uint8_t**)&msg, &msglen))
760 break;
761
762 frame_size = hex2int(c->header0, 4);
763 if (frame_size == 0) {
764 D("%s: ignoring empty frame", __FUNCTION__);
765 continue;
766 }
767 if (frame_size < 0) {
768 D("%s: ignoring corrupted frame header '.*s'",
769 __FUNCTION__, FRAME_HEADER_SIZE, c->header0 );
770 continue;
771 }
772
773 AARRAY_NEW(data, frame_size+1); /* +1 for terminating zero */
774 qemud_sink_reset(c->payload, frame_size, data);
775 c->need_header = 0;
776 c->header->used = 0;
777 }
778
779 /* read the payload */
780 if (!qemud_sink_fill(c->payload, (const uint8_t**)&msg, &msglen))
781 break;
782
783 c->payload->buff[c->payload->size] = 0;
784 c->need_header = 1;
785 data = c->payload->buff;
786
787 /* Technically, calling 'clie_recv' can destroy client object 'c'
788 * if it decides to close the connection, so ensure we don't
789 * use/dereference it after the call. */
790 if (c->clie_recv)
791 c->clie_recv( c->clie_opaque, c->payload->buff, c->payload->size, c );
792
793 AFREE(data);
794 }
795 }
796
797 /* Sends data to a pipe-based client.
798 */
799 static void
800 _qemud_pipe_send(QemudClient* client, const uint8_t* msg, int msglen);
801
802 /* Frees memory allocated for the qemud client.
803 */
804 static void
_qemud_client_free(QemudClient * c)805 _qemud_client_free(QemudClient* c)
806 {
807 if ( c != NULL) {
808 if (_is_pipe_client(c)) {
809 /* Free outstanding messages. */
810 QemudPipeMessage** msg_list = &c->ProtocolSelector.Pipe.messages;
811 while (*msg_list != NULL) {
812 QemudPipeMessage* to_free = *msg_list;
813 *msg_list = to_free->next;
814 free(to_free);
815 }
816 }
817 if (c->param != NULL) {
818 free(c->param);
819 }
820 AFREE(c);
821 }
822 }
823
824 /* disconnect a client. this automatically frees the QemudClient.
825 * note that this also removes the client from the global list
826 * and from its service's list, if any.
827 * Param:
828 * opaque - QemuClient instance
829 * guest_close - For pipe clients control whether or not the disconnect is
830 * caused by guest closing the pipe handle (in which case 1 is passed in
831 * this parameter). For serial clients this parameter is ignored.
832 */
833 static void
qemud_client_disconnect(void * opaque,int guest_close)834 qemud_client_disconnect( void* opaque, int guest_close )
835 {
836 QemudClient* c = opaque;
837
838 if (c->closing) { /* recursive call, exit immediately */
839 return;
840 }
841
842 if (_is_pipe_client(c) && !guest_close) {
843 /* This is emulator component (rather than the guest) closing a pipe
844 * client. Since pipe clients are controlled strictly by the guest, we
845 * don't actually close the client here, but notify the guest about the
846 * client being disconnected. Then we will do the real client close when
847 * the guest explicitly closes the pipe, in which case this routine will
848 * be called from the _qemudPipe_closeFromGuest callback with guest_close
849 * set to 1. */
850 char tmp[128], *p=tmp, *end=p+sizeof(tmp);
851 p = bufprint(tmp, end, "disconnect:00");
852 _qemud_pipe_send(c, (uint8_t*)tmp, p-tmp);
853 return;
854 }
855
856 c->closing = 1;
857
858 /* remove from current list */
859 qemud_client_remove(c);
860
861 if (_is_pipe_client(c)) {
862 /* We must NULL the client reference in the QemuPipe for this connection,
863 * so if a sudden receive request comes after client has been closed, we
864 * don't blow up. */
865 c->ProtocolSelector.Pipe.qemud_pipe->client = NULL;
866 } else if (c->ProtocolSelector.Serial.channel > 0) {
867 /* send a disconnect command to the daemon */
868 char tmp[128], *p=tmp, *end=p+sizeof(tmp);
869 p = bufprint(tmp, end, "disconnect:%02x",
870 c->ProtocolSelector.Serial.channel);
871 qemud_serial_send(c->ProtocolSelector.Serial.serial, 0, 0, (uint8_t*)tmp, p-tmp);
872 }
873
874 /* call the client close callback */
875 if (c->clie_close) {
876 c->clie_close(c->clie_opaque);
877 c->clie_close = NULL;
878 }
879 c->clie_recv = NULL;
880
881 /* remove from service list, if any */
882 if (c->service) {
883 qemud_service_remove_client(c->service, c);
884 c->service = NULL;
885 }
886
887 _qemud_client_free(c);
888 }
889
890 /* allocate a new QemudClient object
891 * NOTE: channel_id valie is used as a selector between serial and pipe clients.
892 * Since channel_id < 0 is an invalid value for a serial client, it would
893 * indicate that creating client is a pipe client. */
894 static QemudClient*
qemud_client_alloc(int channel_id,const char * client_param,void * clie_opaque,QemudClientRecv clie_recv,QemudClientClose clie_close,QemudClientSave clie_save,QemudClientLoad clie_load,QemudSerial * serial,QemudClient ** pclients)895 qemud_client_alloc( int channel_id,
896 const char* client_param,
897 void* clie_opaque,
898 QemudClientRecv clie_recv,
899 QemudClientClose clie_close,
900 QemudClientSave clie_save,
901 QemudClientLoad clie_load,
902 QemudSerial* serial,
903 QemudClient** pclients )
904 {
905 QemudClient* c;
906
907 ANEW0(c);
908
909 if (channel_id < 0) {
910 /* Allocating a pipe client. */
911 c->protocol = QEMUD_PROTOCOL_PIPE;
912 c->ProtocolSelector.Pipe.messages = NULL;
913 c->ProtocolSelector.Pipe.qemud_pipe = NULL;
914 } else {
915 /* Allocating a serial client. */
916 c->protocol = QEMUD_PROTOCOL_SERIAL;
917 c->ProtocolSelector.Serial.serial = serial;
918 c->ProtocolSelector.Serial.channel = channel_id;
919 }
920 c->param = client_param ? ASTRDUP(client_param) : NULL;
921 c->clie_opaque = clie_opaque;
922 c->clie_recv = clie_recv;
923 c->clie_close = clie_close;
924 c->clie_save = clie_save;
925 c->clie_load = clie_load;
926 c->service = NULL;
927 c->next_serv = NULL;
928 c->next = NULL;
929 c->framing = 0;
930 c->need_header = 1;
931 qemud_sink_reset(c->header, FRAME_HEADER_SIZE, c->header0);
932
933 qemud_client_prepend(c, pclients);
934
935 return c;
936 }
937
938 /* forward */
939 static void qemud_service_save_name( QEMUFile* f, QemudService* s );
940 static char* qemud_service_load_name( QEMUFile* f );
941 static QemudService* qemud_service_find( QemudService* service_list,
942 const char* service_name );
943 static QemudClient* qemud_service_connect_client( QemudService *sv,
944 int channel_id,
945 const char* client_param);
946
947 /* Saves the client state needed to re-establish connections on load.
948 * Note that we save only serial clients here. The pipe clients will be
949 * saved along with the pipe to which they are attached.
950 */
951 static void
qemud_serial_client_save(QEMUFile * f,QemudClient * c)952 qemud_serial_client_save(QEMUFile* f, QemudClient* c)
953 {
954 /* save generic information */
955 qemud_service_save_name(f, c->service);
956 qemu_put_string(f, c->param);
957 qemu_put_be32(f, c->ProtocolSelector.Serial.channel);
958
959 /* save client-specific state */
960 if (c->clie_save)
961 c->clie_save(f, c, c->clie_opaque);
962
963 /* save framing configuration */
964 qemu_put_be32(f, c->framing);
965 if (c->framing) {
966 qemu_put_be32(f, c->need_header);
967 /* header sink always connected to c->header0, no need to save */
968 qemu_put_be32(f, FRAME_HEADER_SIZE);
969 qemu_put_buffer(f, c->header0, FRAME_HEADER_SIZE);
970 /* payload sink */
971 qemud_sink_save(f, c->payload);
972 qemu_put_buffer(f, c->payload->buff, c->payload->size);
973 }
974 }
975
976 /* Loads client state from file, then starts a new client connected to the
977 * corresponding service.
978 * Note that we load only serial clients here. The pipe clients will be
979 * loaded along with the pipe to which they were attached.
980 */
981 static int
qemud_serial_client_load(QEMUFile * f,QemudService * current_services,int version)982 qemud_serial_client_load(QEMUFile* f, QemudService* current_services, int version )
983 {
984 char *service_name = qemud_service_load_name(f);
985 if (service_name == NULL)
986 return -EIO;
987 char* param = qemu_get_string(f);
988 /* get current service instance */
989 QemudService *sv = qemud_service_find(current_services, service_name);
990 if (sv == NULL) {
991 D("%s: load failed: unknown service \"%s\"\n",
992 __FUNCTION__, service_name);
993 return -EIO;
994 }
995
996 int channel = qemu_get_be32(f);
997
998 if (channel == 0) {
999 D("%s: illegal snapshot: client for control channel must no be saved\n",
1000 __FUNCTION__);
1001 return -EIO;
1002 }
1003
1004 /* re-connect client */
1005 QemudClient* c = qemud_service_connect_client(sv, channel, param);
1006 if(c == NULL)
1007 return -EIO;
1008
1009 /* load client-specific state */
1010 int ret;
1011 if (c->clie_load)
1012 if ((ret = c->clie_load(f, c, c->clie_opaque)))
1013 return ret; /* load failure */
1014
1015 /* load framing configuration */
1016 c->framing = qemu_get_be32(f);
1017 if (c->framing) {
1018
1019 /* header buffer */
1020 c->need_header = qemu_get_be32(f);
1021 int header_size = qemu_get_be32(f);
1022 if (header_size > FRAME_HEADER_SIZE) {
1023 D("%s: load failed: payload buffer requires %d bytes, %d available\n",
1024 __FUNCTION__, header_size, FRAME_HEADER_SIZE);
1025 return -EIO;
1026 }
1027 int ret;
1028 if ((ret = qemu_get_buffer(f, c->header0, header_size)) != header_size) {
1029 D("%s: frame header buffer load failed: expected %d bytes, got %d\n",
1030 __FUNCTION__, header_size, ret);
1031 return -EIO;
1032 }
1033
1034 /* payload sink */
1035 if ((ret = qemud_sink_load(f, c->payload)))
1036 return ret;
1037
1038 /* replace payload buffer by saved data */
1039 if (c->payload->buff) {
1040 AFREE(c->payload->buff);
1041 }
1042 AARRAY_NEW(c->payload->buff, c->payload->size+1); /* +1 for terminating zero */
1043 if ((ret = qemu_get_buffer(f, c->payload->buff, c->payload->size)) != c->payload->size) {
1044 D("%s: frame payload buffer load failed: expected %d bytes, got %d\n",
1045 __FUNCTION__, c->payload->size, ret);
1046 AFREE(c->payload->buff);
1047 return -EIO;
1048 }
1049 }
1050
1051 return 0;
1052 }
1053
1054
1055 /** SERVICES
1056 **/
1057
1058 /* A QemudService models a _named_ service facility implemented
1059 * by the emulator, that clients in the emulated system can connect
1060 * to.
1061 *
1062 * Each service can have a limit on the number of clients they
1063 * accept (this number if unlimited if 'max_clients' is 0).
1064 *
1065 * Each service maintains a list of active QemudClients and
1066 * can also be used to create new QemudClient objects through
1067 * its 'serv_opaque' and 'serv_connect' fields.
1068 */
1069 struct QemudService {
1070 const char* name;
1071 int max_clients;
1072 int num_clients;
1073 QemudClient* clients;
1074 QemudServiceConnect serv_connect;
1075 QemudServiceSave serv_save;
1076 QemudServiceLoad serv_load;
1077 void* serv_opaque;
1078 QemudService* next;
1079 };
1080
1081 /* Create a new QemudService object */
1082 static QemudService*
qemud_service_new(const char * name,int max_clients,void * serv_opaque,QemudServiceConnect serv_connect,QemudServiceSave serv_save,QemudServiceLoad serv_load,QemudService ** pservices)1083 qemud_service_new( const char* name,
1084 int max_clients,
1085 void* serv_opaque,
1086 QemudServiceConnect serv_connect,
1087 QemudServiceSave serv_save,
1088 QemudServiceLoad serv_load,
1089 QemudService** pservices )
1090 {
1091 QemudService* s;
1092
1093 ANEW0(s);
1094 s->name = ASTRDUP(name);
1095 s->max_clients = max_clients;
1096 s->num_clients = 0;
1097 s->clients = NULL;
1098
1099 s->serv_opaque = serv_opaque;
1100 s->serv_connect = serv_connect;
1101 s->serv_save = serv_save;
1102 s->serv_load = serv_load;
1103
1104 s->next = *pservices;
1105 *pservices = s;
1106
1107 return s;
1108 }
1109
1110 /* used internally to populate a QemudService object with a
1111 * new QemudClient */
1112 static void
qemud_service_add_client(QemudService * s,QemudClient * c)1113 qemud_service_add_client( QemudService* s, QemudClient* c )
1114 {
1115 c->service = s;
1116 c->next_serv = s->clients;
1117 s->clients = c;
1118 s->num_clients += 1;
1119 }
1120
1121 /* used internally to remove a QemudClient from a QemudService */
1122 static void
qemud_service_remove_client(QemudService * s,QemudClient * c)1123 qemud_service_remove_client( QemudService* s, QemudClient* c )
1124 {
1125 QemudClient** pnode = &s->clients;
1126 QemudClient* node;
1127
1128 /* remove from clients linked-list */
1129 for (;;) {
1130 node = *pnode;
1131 if (node == NULL) {
1132 D("%s: could not find client for service '%s'",
1133 __FUNCTION__, s->name);
1134 return;
1135 }
1136 if (node == c)
1137 break;
1138 pnode = &node->next_serv;
1139 }
1140
1141 *pnode = node->next_serv;
1142 s->num_clients -= 1;
1143 }
1144
1145 /* ask the service to create a new QemudClient. Note that we
1146 * assume that this calls qemud_client_new() which will add
1147 * the client to the service's list automatically.
1148 *
1149 * returns the client or NULL if an error occurred
1150 */
1151 static QemudClient*
qemud_service_connect_client(QemudService * sv,int channel_id,const char * client_param)1152 qemud_service_connect_client(QemudService *sv,
1153 int channel_id,
1154 const char* client_param)
1155 {
1156 QemudClient* client =
1157 sv->serv_connect( sv->serv_opaque, sv, channel_id, client_param );
1158 if (client == NULL) {
1159 D("%s: registration failed for '%s' service",
1160 __FUNCTION__, sv->name);
1161 return NULL;
1162 }
1163 D("%s: registered client channel %d for '%s' service",
1164 __FUNCTION__, channel_id, sv->name);
1165 return client;
1166 }
1167
1168 /* find a registered service by name.
1169 */
1170 static QemudService*
qemud_service_find(QemudService * service_list,const char * service_name)1171 qemud_service_find( QemudService* service_list, const char* service_name)
1172 {
1173 QemudService* sv = NULL;
1174 for (sv = service_list; sv != NULL; sv = sv->next) {
1175 if (!strcmp(sv->name, service_name)) {
1176 break;
1177 }
1178 }
1179 return sv;
1180 }
1181
1182 /* Save the name of the given service.
1183 */
1184 static void
qemud_service_save_name(QEMUFile * f,QemudService * s)1185 qemud_service_save_name(QEMUFile* f, QemudService* s)
1186 {
1187 int len = strlen(s->name) + 1; // include '\0' terminator
1188 qemu_put_be32(f, len);
1189 qemu_put_buffer(f, (const uint8_t *) s->name, len);
1190 }
1191
1192 /* Load the name of a service. Returns a pointer to the loaded name, or NULL
1193 * on failure.
1194 */
1195 static char*
qemud_service_load_name(QEMUFile * f)1196 qemud_service_load_name( QEMUFile* f )
1197 {
1198 int ret;
1199 int name_len = qemu_get_be32(f);
1200 char *service_name = android_alloc(name_len);
1201 if ((ret = qemu_get_buffer(f, (uint8_t*)service_name, name_len) != name_len)) {
1202 D("%s: service name load failed: expected %d bytes, got %d\n",
1203 __FUNCTION__, name_len, ret);
1204 AFREE(service_name);
1205 return NULL;
1206 }
1207 if (service_name[name_len - 1] != '\0') {
1208 char last = service_name[name_len - 1];
1209 service_name[name_len - 1] = '\0'; /* make buffer contents printable */
1210 D("%s: service name load failed: expecting NULL-terminated string, but "
1211 "last char is '%c' (buffer contents: '%s%c')\n",
1212 __FUNCTION__, name_len, last, service_name, last);
1213 AFREE(service_name);
1214 return NULL;
1215 }
1216
1217 return service_name;
1218 }
1219
1220 /* Saves state of a service.
1221 */
1222 static void
qemud_service_save(QEMUFile * f,QemudService * s)1223 qemud_service_save(QEMUFile* f, QemudService* s)
1224 {
1225 qemud_service_save_name(f, s);
1226 qemu_put_be32(f, s->max_clients);
1227 qemu_put_be32(f, s->num_clients);
1228
1229 if (s->serv_save)
1230 s->serv_save(f, s, s->serv_opaque);
1231 }
1232
1233 /* Loads service state from file, then updates the currently running instance
1234 * of that service to mirror the loaded state. If the service is not running,
1235 * the load process is aborted.
1236 *
1237 * Parameter 'current_services' should be the list of active services.
1238 */
1239 static int
qemud_service_load(QEMUFile * f,QemudService * current_services)1240 qemud_service_load( QEMUFile* f, QemudService* current_services )
1241 {
1242 char* service_name = qemud_service_load_name(f);
1243 if (service_name == NULL)
1244 return -EIO;
1245
1246 /* get current service instance */
1247 QemudService *sv = qemud_service_find(current_services, service_name);
1248 if (sv == NULL) {
1249 D("%s: loading failed: service \"%s\" not available\n",
1250 __FUNCTION__, service_name);
1251 return -EIO;
1252 }
1253
1254 /* reconfigure service as required */
1255 sv->max_clients = qemu_get_be32(f);
1256 sv->num_clients = qemu_get_be32(f);
1257
1258 /* load service specific data */
1259 int ret;
1260 if (sv->serv_load)
1261 if ((ret = sv->serv_load(f, sv, sv->serv_opaque)))
1262 return ret; /* load failure */
1263
1264 return 0;
1265 }
1266
1267
1268 /** MULTIPLEXER
1269 **/
1270
1271 /* A QemudMultiplexer object maintains the global state of the
1272 * qemud service facility. It holds a QemudSerial object to
1273 * maintain the state of the serial port connection.
1274 *
1275 * The QemudMultiplexer receives all incoming messages from
1276 * the serial port, and dispatches them to the appropriate
1277 * QemudClient.
1278 *
1279 * It also has a global list of clients, and a global list of
1280 * services.
1281 *
1282 * Finally, the QemudMultiplexer has a special QemudClient used
1283 * to handle channel 0, i.e. the control channel used to handle
1284 * connections and disconnections of clients.
1285 */
1286 typedef struct QemudMultiplexer QemudMultiplexer;
1287
1288 struct QemudMultiplexer {
1289 QemudSerial serial[1];
1290 QemudClient* clients;
1291 QemudService* services;
1292 };
1293
1294 /* this is the serial_recv callback that is called
1295 * whenever an incoming message arrives through the serial port
1296 */
1297 static void
qemud_multiplexer_serial_recv(void * opaque,int channel,uint8_t * msg,int msglen)1298 qemud_multiplexer_serial_recv( void* opaque,
1299 int channel,
1300 uint8_t* msg,
1301 int msglen )
1302 {
1303 QemudMultiplexer* m = opaque;
1304 QemudClient* c = m->clients;
1305
1306 /* dispatch to an existing client if possible
1307 * note that channel 0 is handled by a special
1308 * QemudClient that is setup in qemud_multiplexer_init()
1309 */
1310 for ( ; c != NULL; c = c->next ) {
1311 if (!_is_pipe_client(c) && c->ProtocolSelector.Serial.channel == channel) {
1312 qemud_client_recv(c, msg, msglen);
1313 return;
1314 }
1315 }
1316
1317 D("%s: ignoring %d bytes for unknown channel %d",
1318 __FUNCTION__, msglen, channel);
1319 }
1320
1321 /* handle a new connection attempt. This returns 0 on
1322 * success, -1 if the service name is unknown, or -2
1323 * if the service's maximum number of clients has been
1324 * reached.
1325 */
1326 static int
qemud_multiplexer_connect(QemudMultiplexer * m,const char * service_name,int channel_id)1327 qemud_multiplexer_connect( QemudMultiplexer* m,
1328 const char* service_name,
1329 int channel_id )
1330 {
1331 /* find the corresponding registered service by name */
1332 QemudService* sv = qemud_service_find(m->services, service_name);
1333 if (sv == NULL) {
1334 D("%s: no registered '%s' service", __FUNCTION__, service_name);
1335 return -1;
1336 }
1337
1338 /* check service's client count */
1339 if (sv->max_clients > 0 && sv->num_clients >= sv->max_clients) {
1340 D("%s: registration failed for '%s' service: too many clients (%d)",
1341 __FUNCTION__, service_name, sv->num_clients);
1342 return -2;
1343 }
1344
1345 /* connect a new client to the service on the given channel */
1346 if (qemud_service_connect_client(sv, channel_id, NULL) == NULL)
1347 return -1;
1348
1349 return 0;
1350 }
1351
1352 /* disconnect a given client from its channel id */
1353 static void
qemud_multiplexer_disconnect(QemudMultiplexer * m,int channel)1354 qemud_multiplexer_disconnect( QemudMultiplexer* m,
1355 int channel )
1356 {
1357 QemudClient* c;
1358
1359 /* find the client by its channel id, then disconnect it */
1360 for (c = m->clients; c; c = c->next) {
1361 if (!_is_pipe_client(c) && c->ProtocolSelector.Serial.channel == channel) {
1362 D("%s: disconnecting client %d",
1363 __FUNCTION__, channel);
1364 /* note thatt this removes the client from
1365 * m->clients automatically.
1366 */
1367 c->ProtocolSelector.Serial.channel = -1; /* no need to send disconnect:<id> */
1368 qemud_client_disconnect(c, 0);
1369 return;
1370 }
1371 }
1372 D("%s: disconnecting unknown channel %d",
1373 __FUNCTION__, channel);
1374 }
1375
1376 /* disconnects all channels, except for the control channel, without informing
1377 * the daemon in the guest that disconnection has occurred.
1378 *
1379 * Used to silently kill clients when restoring emulator state snapshots.
1380 */
1381 static void
qemud_multiplexer_disconnect_noncontrol(QemudMultiplexer * m)1382 qemud_multiplexer_disconnect_noncontrol( QemudMultiplexer* m )
1383 {
1384 QemudClient* c;
1385 QemudClient* next = m->clients;
1386
1387 while (next) {
1388 c = next;
1389 next = c->next; /* disconnect frees c, remember next in advance */
1390
1391 if (!_is_pipe_client(c) && c->ProtocolSelector.Serial.channel > 0) {
1392 /* skip control channel */
1393 D("%s: disconnecting client %d",
1394 __FUNCTION__, c->ProtocolSelector.Serial.channel);
1395 D("%s: disconnecting client %d\n",
1396 __FUNCTION__, c->ProtocolSelector.Serial.channel);
1397 c->ProtocolSelector.Serial.channel = -1; /* do not send disconnect:<id> */
1398 qemud_client_disconnect(c, 0);
1399 }
1400 }
1401 }
1402
1403 /* handle control messages. This is used as the receive
1404 * callback for the special QemudClient setup to manage
1405 * channel 0.
1406 *
1407 * note that the message is zero-terminated for convenience
1408 * (i.e. msg[msglen] is a valid memory read that returns '\0')
1409 */
1410 static void
qemud_multiplexer_control_recv(void * opaque,uint8_t * msg,int msglen,QemudClient * client)1411 qemud_multiplexer_control_recv( void* opaque,
1412 uint8_t* msg,
1413 int msglen,
1414 QemudClient* client )
1415 {
1416 QemudMultiplexer* mult = opaque;
1417 uint8_t* msgend = msg + msglen;
1418 char tmp[64], *p=tmp, *end=p+sizeof(tmp);
1419
1420 /* handle connection attempts.
1421 * the client message must be "connect:<service-name>:<id>"
1422 * where <id> is a 2-char hexadecimal string, which must be > 0
1423 */
1424 if (msglen > 8 && !memcmp(msg, "connect:", 8))
1425 {
1426 const char* service_name = (const char*)msg + 8;
1427 int channel, ret;
1428 char* q;
1429
1430 q = strchr(service_name, ':');
1431 if (q == NULL || q+3 != (char*)msgend) {
1432 D("%s: malformed connect message: '%.*s' (offset=%d)",
1433 __FUNCTION__, msglen, (const char*)msg, q ? q-(char*)msg : -1);
1434 return;
1435 }
1436 *q++ = 0; /* zero-terminate service name */
1437 channel = hex2int((uint8_t*)q, 2);
1438 if (channel <= 0) {
1439 D("%s: malformed channel id '%.*s",
1440 __FUNCTION__, 2, q);
1441 return;
1442 }
1443
1444 ret = qemud_multiplexer_connect(mult, service_name, channel);
1445 /* the answer can be one of:
1446 * ok:connect:<id>
1447 * ko:connect:<id>:<reason-for-failure>
1448 */
1449 if (ret < 0) {
1450 if (ret == -1) {
1451 /* could not connect */
1452 p = bufprint(tmp, end, "ko:connect:%02x:unknown service", channel);
1453 } else {
1454 p = bufprint(tmp, end, "ko:connect:%02x:service busy", channel);
1455 }
1456 }
1457 else {
1458 p = bufprint(tmp, end, "ok:connect:%02x", channel);
1459 }
1460 qemud_serial_send(mult->serial, 0, 0, (uint8_t*)tmp, p-tmp);
1461 return;
1462 }
1463
1464 /* handle client disconnections,
1465 * this message arrives when the client has closed the connection.
1466 * format: "disconnect:<id>" where <id> is a 2-hex channel id > 0
1467 */
1468 if (msglen == 13 && !memcmp(msg, "disconnect:", 11)) {
1469 int channel_id = hex2int(msg+11, 2);
1470 if (channel_id <= 0) {
1471 D("%s: malformed disconnect channel id: '%.*s'",
1472 __FUNCTION__, 2, msg+11);
1473 return;
1474 }
1475 qemud_multiplexer_disconnect(mult, channel_id);
1476 return;
1477 }
1478
1479 #if SUPPORT_LEGACY_QEMUD
1480 /* an ok:connect:<service>:<id> message can be received if we're
1481 * talking to a legacy qemud daemon, i.e. one running in a 1.0 or
1482 * 1.1 system image.
1483 *
1484 * we should treat is as a normal "connect:" attempt, except that
1485 * we must not send back any acknowledgment.
1486 */
1487 if (msglen > 11 && !memcmp(msg, "ok:connect:", 11)) {
1488 const char* service_name = (const char*)msg + 11;
1489 char* q = strchr(service_name, ':');
1490 int channel;
1491
1492 if (q == NULL || q+3 != (char*)msgend) {
1493 D("%s: malformed legacy connect message: '%.*s' (offset=%d)",
1494 __FUNCTION__, msglen, (const char*)msg, q ? q-(char*)msg : -1);
1495 return;
1496 }
1497 *q++ = 0; /* zero-terminate service name */
1498 channel = hex2int((uint8_t*)q, 2);
1499 if (channel <= 0) {
1500 D("%s: malformed legacy channel id '%.*s",
1501 __FUNCTION__, 2, q);
1502 return;
1503 }
1504
1505 switch (mult->serial->version) {
1506 case QEMUD_VERSION_UNKNOWN:
1507 mult->serial->version = QEMUD_VERSION_LEGACY;
1508 D("%s: legacy qemud daemon detected.", __FUNCTION__);
1509 break;
1510
1511 case QEMUD_VERSION_LEGACY:
1512 /* nothing unusual */
1513 break;
1514
1515 default:
1516 D("%s: weird, ignoring legacy qemud control message: '%.*s'",
1517 __FUNCTION__, msglen, msg);
1518 return;
1519 }
1520
1521 /* "hw-control" was called "control" in 1.0/1.1 */
1522 if (!strcmp(service_name,"control"))
1523 service_name = "hw-control";
1524
1525 qemud_multiplexer_connect(mult, service_name, channel);
1526 return;
1527 }
1528
1529 /* anything else, don't answer for legacy */
1530 if (mult->serial->version == QEMUD_VERSION_LEGACY)
1531 return;
1532 #endif /* SUPPORT_LEGACY_QEMUD */
1533
1534 /* anything else is a problem */
1535 p = bufprint(tmp, end, "ko:unknown command");
1536 qemud_serial_send(mult->serial, 0, 0, (uint8_t*)tmp, p-tmp);
1537 }
1538
1539 /* initialize the global QemudMultiplexer.
1540 */
1541 static void
qemud_multiplexer_init(QemudMultiplexer * mult,CharDriverState * serial_cs)1542 qemud_multiplexer_init( QemudMultiplexer* mult,
1543 CharDriverState* serial_cs )
1544 {
1545 QemudClient* control;
1546
1547 /* initialize serial handler */
1548 qemud_serial_init( mult->serial,
1549 serial_cs,
1550 qemud_multiplexer_serial_recv,
1551 mult );
1552
1553 /* setup listener for channel 0 */
1554 control = qemud_client_alloc( 0,
1555 NULL,
1556 mult,
1557 qemud_multiplexer_control_recv,
1558 NULL, NULL, NULL,
1559 mult->serial,
1560 &mult->clients );
1561 }
1562
1563 /* the global multiplexer state */
1564 static QemudMultiplexer _multiplexer[1];
1565
1566 /** HIGH-LEVEL API
1567 **/
1568
1569 /* this function must be used in the serv_connect callback
1570 * of a given QemudService object (see qemud_service_register()
1571 * below). It is used to register a new QemudClient to acknowledge
1572 * a new client connection.
1573 *
1574 * 'clie_opaque', 'clie_recv' and 'clie_close' are used to
1575 * send incoming client messages to the corresponding service
1576 * implementation, or notify the service that a client has
1577 * disconnected.
1578 */
1579 QemudClient*
qemud_client_new(QemudService * service,int channelId,const char * client_param,void * clie_opaque,QemudClientRecv clie_recv,QemudClientClose clie_close,QemudClientSave clie_save,QemudClientLoad clie_load)1580 qemud_client_new( QemudService* service,
1581 int channelId,
1582 const char* client_param,
1583 void* clie_opaque,
1584 QemudClientRecv clie_recv,
1585 QemudClientClose clie_close,
1586 QemudClientSave clie_save,
1587 QemudClientLoad clie_load )
1588 {
1589 QemudMultiplexer* m = _multiplexer;
1590 QemudClient* c = qemud_client_alloc( channelId,
1591 client_param,
1592 clie_opaque,
1593 clie_recv,
1594 clie_close,
1595 clie_save,
1596 clie_load,
1597 m->serial,
1598 &m->clients );
1599
1600 qemud_service_add_client(service, c);
1601 return c;
1602 }
1603
1604 /* Caches a service message into the client's descriptor.
1605 *
1606 * See comments on QemudPipeMessage structure for more info.
1607 */
1608 static void
_qemud_pipe_cache_buffer(QemudClient * client,const uint8_t * msg,int msglen)1609 _qemud_pipe_cache_buffer(QemudClient* client, const uint8_t* msg, int msglen)
1610 {
1611 QemudPipeMessage* buf;
1612 QemudPipeMessage** ins_at = &client->ProtocolSelector.Pipe.messages;
1613
1614 /* Allocate descriptor big enough to contain message as well. */
1615 buf = (QemudPipeMessage*)malloc(msglen + sizeof(QemudPipeMessage));
1616 if (buf != NULL) {
1617 /* Message starts right after the descriptor. */
1618 buf->message = (uint8_t*)buf + sizeof(QemudPipeMessage);
1619 buf->size = msglen;
1620 memcpy(buf->message, msg, msglen);
1621 buf->offset = 0;
1622 buf->next = NULL;
1623 while (*ins_at != NULL) {
1624 ins_at = &(*ins_at)->next;
1625 }
1626 *ins_at = buf;
1627 /* Notify the pipe that there is data to read. */
1628 goldfish_pipe_wake(client->ProtocolSelector.Pipe.qemud_pipe->hwpipe,
1629 PIPE_WAKE_READ);
1630 }
1631 }
1632
1633 /* Sends service message to the client.
1634 */
1635 static void
_qemud_pipe_send(QemudClient * client,const uint8_t * msg,int msglen)1636 _qemud_pipe_send(QemudClient* client, const uint8_t* msg, int msglen)
1637 {
1638 uint8_t frame[FRAME_HEADER_SIZE];
1639 int avail, len = msglen;
1640 int framing = client->framing;
1641
1642 if (msglen <= 0)
1643 return;
1644
1645 D("%s: len=%3d '%s'",
1646 __FUNCTION__, msglen, quote_bytes((const void*)msg, msglen));
1647
1648 if (framing) {
1649 len += FRAME_HEADER_SIZE;
1650 }
1651
1652 /* packetize the payload for the serial MTU */
1653 while (len > 0)
1654 {
1655 avail = len;
1656 if (avail > MAX_SERIAL_PAYLOAD)
1657 avail = MAX_SERIAL_PAYLOAD;
1658
1659 /* insert frame header when needed */
1660 if (framing) {
1661 int2hex(frame, FRAME_HEADER_SIZE, msglen);
1662 T("%s: '%.*s'", __FUNCTION__, FRAME_HEADER_SIZE, frame);
1663 _qemud_pipe_cache_buffer(client, frame, FRAME_HEADER_SIZE);
1664 avail -= FRAME_HEADER_SIZE;
1665 len -= FRAME_HEADER_SIZE;
1666 framing = 0;
1667 }
1668
1669 /* write message content */
1670 T("%s: '%.*s'", __FUNCTION__, avail, msg);
1671 _qemud_pipe_cache_buffer(client, msg, avail);
1672 msg += avail;
1673 len -= avail;
1674 }
1675 }
1676
1677 /* this can be used by a service implementation to send an answer
1678 * or message to a specific client.
1679 */
1680 void
qemud_client_send(QemudClient * client,const uint8_t * msg,int msglen)1681 qemud_client_send ( QemudClient* client, const uint8_t* msg, int msglen )
1682 {
1683 if (_is_pipe_client(client)) {
1684 _qemud_pipe_send(client, msg, msglen);
1685 } else {
1686 qemud_serial_send(client->ProtocolSelector.Serial.serial,
1687 client->ProtocolSelector.Serial.channel,
1688 client->framing != 0, msg, msglen);
1689 }
1690 }
1691
1692 /* enable framing for this client. When TRUE, this will
1693 * use internally a simple 4-hexchar header before each
1694 * message exchanged through the serial port.
1695 */
1696 void
qemud_client_set_framing(QemudClient * client,int framing)1697 qemud_client_set_framing( QemudClient* client, int framing )
1698 {
1699 /* release dynamic buffer if we're disabling framing */
1700 if (client->framing) {
1701 if (!client->need_header) {
1702 AFREE(client->payload->buff);
1703 client->need_header = 1;
1704 }
1705 }
1706 client->framing = !!framing;
1707 }
1708
1709 /* this can be used by a service implementation to close a
1710 * specific client connection.
1711 */
1712 void
qemud_client_close(QemudClient * client)1713 qemud_client_close( QemudClient* client )
1714 {
1715 qemud_client_disconnect(client, 0);
1716 }
1717
1718
1719 /** SNAPSHOT SUPPORT
1720 **/
1721
1722 /* Saves the number of clients.
1723 */
1724 static void
qemud_client_save_count(QEMUFile * f,QemudClient * c)1725 qemud_client_save_count(QEMUFile* f, QemudClient* c)
1726 {
1727 unsigned int client_count = 0;
1728 for( ; c; c = c->next) // walk over linked list
1729 /* skip control channel, which is not saved, and pipe channels that
1730 * are saved along with the pipe. */
1731 if (!_is_pipe_client(c) && c->ProtocolSelector.Serial.channel > 0)
1732 client_count++;
1733
1734 qemu_put_be32(f, client_count);
1735 }
1736
1737 /* Saves the number of services currently available.
1738 */
1739 static void
qemud_service_save_count(QEMUFile * f,QemudService * s)1740 qemud_service_save_count(QEMUFile* f, QemudService* s)
1741 {
1742 unsigned int service_count = 0;
1743 for( ; s; s = s->next ) // walk over linked list
1744 service_count++;
1745
1746 qemu_put_be32(f, service_count);
1747 }
1748
1749 /* Save QemuD state to snapshot.
1750 *
1751 * The control channel has no state of its own, other than the local variables
1752 * in qemud_multiplexer_control_recv. We can therefore safely skip saving it,
1753 * which spares us dealing with the exception of a client not connected to a
1754 * service.
1755 */
1756 static void
qemud_save(QEMUFile * f,void * opaque)1757 qemud_save(QEMUFile* f, void* opaque)
1758 {
1759 QemudMultiplexer *m = opaque;
1760
1761 qemud_serial_save(f, m->serial);
1762
1763 /* save service states */
1764 qemud_service_save_count(f, m->services);
1765 QemudService *s;
1766 for (s = m->services; s; s = s->next)
1767 qemud_service_save(f, s);
1768
1769 /* save client channels */
1770 qemud_client_save_count(f, m->clients);
1771 QemudClient *c;
1772 for (c = m->clients; c; c = c->next) {
1773 /* skip control channel, and pipe clients */
1774 if (!_is_pipe_client(c) && c->ProtocolSelector.Serial.channel > 0) {
1775 qemud_serial_client_save(f, c);
1776 }
1777 }
1778
1779 }
1780
1781
1782 /* Checks whether the same services are available at this point as when the
1783 * snapshot was made.
1784 */
1785 static int
qemud_load_services(QEMUFile * f,QemudService * current_services)1786 qemud_load_services( QEMUFile* f, QemudService* current_services )
1787 {
1788 int i, ret;
1789 int service_count = qemu_get_be32(f);
1790 for (i = 0; i < service_count; i++) {
1791 if ((ret = qemud_service_load(f, current_services)))
1792 return ret;
1793 }
1794
1795 return 0;
1796 }
1797
1798 /* Removes all active non-control clients, then creates new ones with state
1799 * taken from the snapshot.
1800 *
1801 * We do not send "disconnect" commands, over the channel. If we did, we might
1802 * stop clients in the restored guest, resulting in an incorrect restore.
1803 *
1804 * Instead, we silently replace the clients that were running before the
1805 * restore with new clients, whose state we copy from the snapshot. Since
1806 * everything is multiplexed over one link, only the multiplexer notices the
1807 * changes, there is no communication with the guest.
1808 */
1809 static int
qemud_load_clients(QEMUFile * f,QemudMultiplexer * m,int version)1810 qemud_load_clients(QEMUFile* f, QemudMultiplexer* m, int version )
1811 {
1812 /* Remove all clients, except on the control channel.*/
1813 qemud_multiplexer_disconnect_noncontrol(m);
1814
1815 /* Load clients from snapshot */
1816 int client_count = qemu_get_be32(f);
1817 int i, ret;
1818 for (i = 0; i < client_count; i++) {
1819 if ((ret = qemud_serial_client_load(f, m->services, version))) {
1820 return ret;
1821 }
1822 }
1823
1824 return 0;
1825 }
1826
1827 /* Load QemuD state from file.
1828 */
1829 static int
qemud_load(QEMUFile * f,void * opaque,int version)1830 qemud_load(QEMUFile *f, void* opaque, int version)
1831 {
1832 QemudMultiplexer *m = opaque;
1833
1834 int ret;
1835
1836 if ((ret = qemud_serial_load(f, m->serial)))
1837 return ret;
1838 if ((ret = qemud_load_services(f, m->services)))
1839 return ret;
1840 if ((ret = qemud_load_clients(f, m, version)))
1841 return ret;
1842
1843 return 0;
1844 }
1845
1846 /*------------------------------------------------------------------------------
1847 *
1848 * QEMUD PIPE service callbacks
1849 *
1850 * ----------------------------------------------------------------------------*/
1851
1852 /* Saves pending pipe message to the snapshot file. */
1853 static void
_save_pipe_message(QEMUFile * f,QemudPipeMessage * msg)1854 _save_pipe_message(QEMUFile* f, QemudPipeMessage* msg)
1855 {
1856 qemu_put_be32(f, msg->size);
1857 qemu_put_be32(f, msg->offset);
1858 qemu_put_buffer(f, msg->message, msg->size);
1859 }
1860
1861 /* Loads pending pipe messages from the snapshot file.
1862 * Return:
1863 * List of pending pipe messages loaded from snapshot, or NULL if snapshot didn't
1864 * contain saved messages.
1865 */
1866 static QemudPipeMessage*
_load_pipe_message(QEMUFile * f)1867 _load_pipe_message(QEMUFile* f)
1868 {
1869 QemudPipeMessage* ret = NULL;
1870 QemudPipeMessage** next = &ret;
1871
1872 uint32_t size = qemu_get_be32(f);
1873 while (size != 0) {
1874 QemudPipeMessage* wrk;
1875 ANEW0(wrk);
1876 *next = wrk;
1877 wrk->size = size;
1878 wrk->offset = qemu_get_be32(f);
1879 wrk->message = malloc(wrk->size);
1880 if (wrk->message == NULL) {
1881 APANIC("Unable to allocate buffer for pipe's pending message.");
1882 }
1883 qemu_get_buffer(f, wrk->message, wrk->size);
1884 next = &wrk->next;
1885 *next = NULL;
1886 size = qemu_get_be32(f);
1887 }
1888
1889 return ret;
1890 }
1891
1892 /* This is a callback that gets invoked when guest is connecting to the service.
1893 *
1894 * Here we will create a new client as well as pipe descriptor representing new
1895 * connection.
1896 */
1897 static void*
_qemudPipe_init(void * hwpipe,void * _looper,const char * args)1898 _qemudPipe_init(void* hwpipe, void* _looper, const char* args)
1899 {
1900 QemudMultiplexer *m = _multiplexer;
1901 QemudService* sv = m->services;
1902 QemudClient* client;
1903 QemudPipe* pipe = NULL;
1904 char service_name[512];
1905 const char* client_args;
1906 size_t srv_name_len;
1907
1908 /* 'args' passed in this callback represents name of the service the guest is
1909 * connecting to. It can't be NULL. */
1910 if (args == NULL) {
1911 D("%s: Missing address!", __FUNCTION__);
1912 return NULL;
1913 }
1914
1915 /* 'args' contain service name, and optional parameters for the client that
1916 * is about to be created in this call. The parameters are separated from the
1917 * service name wit ':'. Separate service name from the client param. */
1918 client_args = strchr(args, ':');
1919 if (client_args != NULL) {
1920 srv_name_len = min(client_args - args, sizeof(service_name) - 1);
1921 client_args++; // Past the ':'
1922 if (*client_args == '\0') {
1923 /* No actual parameters. */
1924 client_args = NULL;
1925 }
1926 } else {
1927 srv_name_len = min(strlen(args), sizeof(service_name) - 1);
1928 }
1929 memcpy(service_name, args, srv_name_len);
1930 service_name[srv_name_len] = '\0';
1931
1932 /* Lookup registered service by its name. */
1933 while (sv != NULL && strcmp(sv->name, service_name)) {
1934 sv = sv->next;
1935 }
1936 if (sv == NULL) {
1937 D("%s: Service '%s' has not been registered!", __FUNCTION__, service_name);
1938 return NULL;
1939 }
1940
1941 /* Create a client for this connection. -1 as a channel ID signals that this
1942 * is a pipe client. */
1943 client = qemud_service_connect_client(sv, -1, client_args);
1944 if (client != NULL) {
1945 ANEW0(pipe);
1946 pipe->hwpipe = hwpipe;
1947 pipe->looper = _looper;
1948 pipe->service = sv;
1949 pipe->client = client;
1950 client->ProtocolSelector.Pipe.qemud_pipe = pipe;
1951 }
1952
1953 return pipe;
1954 }
1955
1956 /* Called when the guest wants to close the channel.
1957 */
1958 static void
_qemudPipe_closeFromGuest(void * opaque)1959 _qemudPipe_closeFromGuest( void* opaque )
1960 {
1961 QemudPipe* pipe = opaque;
1962 QemudClient* client = pipe->client;
1963 D("%s", __FUNCTION__);
1964 if (client != NULL) {
1965 qemud_client_disconnect(client, 1);
1966 } else {
1967 D("%s: Unexpected NULL client", __FUNCTION__);
1968 }
1969 }
1970
1971 /* Called when the guest has sent some data to the client.
1972 */
1973 static int
_qemudPipe_sendBuffers(void * opaque,const GoldfishPipeBuffer * buffers,int numBuffers)1974 _qemudPipe_sendBuffers(void* opaque,
1975 const GoldfishPipeBuffer* buffers,
1976 int numBuffers)
1977 {
1978 QemudPipe* pipe = opaque;
1979 QemudClient* client = pipe->client;
1980 size_t transferred = 0;
1981
1982 if (client == NULL) {
1983 D("%s: Unexpected NULL client", __FUNCTION__);
1984 return -1;
1985 }
1986
1987 if (numBuffers == 1) {
1988 /* Simple case: all data are in one buffer. */
1989 D("%s: %s", __FUNCTION__, quote_bytes((char*)buffers->data, buffers->size));
1990 qemud_client_recv(client, buffers->data, buffers->size);
1991 transferred = buffers->size;
1992 } else {
1993 /* If there are multiple buffers involved, collect all data in one buffer
1994 * before calling the high level client. */
1995 uint8_t* msg, *wrk;
1996 int n;
1997 for (n = 0; n < numBuffers; n++) {
1998 transferred += buffers[n].size;
1999 }
2000 msg = malloc(transferred);
2001 wrk = msg;
2002 for (n = 0; n < numBuffers; n++) {
2003 memcpy(wrk, buffers[n].data, buffers[n].size);
2004 wrk += buffers[n].size;
2005 }
2006 D("%s: %s", __FUNCTION__, quote_bytes((char*)msg, transferred));
2007 qemud_client_recv(client, msg, transferred);
2008 free(msg);
2009 }
2010
2011 return transferred;
2012 }
2013
2014 /* Called when the guest is reading data from the client.
2015 */
2016 static int
_qemudPipe_recvBuffers(void * opaque,GoldfishPipeBuffer * buffers,int numBuffers)2017 _qemudPipe_recvBuffers(void* opaque, GoldfishPipeBuffer* buffers, int numBuffers)
2018 {
2019 QemudPipe* pipe = opaque;
2020 QemudClient* client = pipe->client;
2021 QemudPipeMessage** msg_list;
2022 GoldfishPipeBuffer* buff = buffers;
2023 GoldfishPipeBuffer* endbuff = buffers + numBuffers;
2024 size_t sent_bytes = 0;
2025 size_t off_in_buff = 0;
2026
2027 if (client == NULL) {
2028 D("%s: Unexpected NULL client", __FUNCTION__);
2029 return -1;
2030 }
2031
2032 msg_list = &client->ProtocolSelector.Pipe.messages;
2033 if (*msg_list == NULL) {
2034 /* No data to send. Let it block until we wake it up with
2035 * PIPE_WAKE_READ when service sends data to the client. */
2036 return PIPE_ERROR_AGAIN;
2037 }
2038
2039 /* Fill in goldfish buffers while they are still available, and there are
2040 * messages in the client's message list. */
2041 while (buff != endbuff && *msg_list != NULL) {
2042 QemudPipeMessage* msg = *msg_list;
2043 /* Message data fiting the current pipe's buffer. */
2044 size_t to_copy = min(msg->size - msg->offset, buff->size - off_in_buff);
2045 memcpy(buff->data + off_in_buff, msg->message + msg->offset, to_copy);
2046 /* Update offsets. */
2047 off_in_buff += to_copy;
2048 msg->offset += to_copy;
2049 sent_bytes += to_copy;
2050 if (msg->size == msg->offset) {
2051 /* We're done with the current message. Go to the next one. */
2052 *msg_list = msg->next;
2053 free(msg);
2054 }
2055 if (off_in_buff == buff->size) {
2056 /* Current pipe buffer is full. Continue with the next one. */
2057 buff++;
2058 off_in_buff = 0;
2059 }
2060 }
2061
2062 D("%s: -> %u (of %u)", __FUNCTION__, sent_bytes, buffers->size);
2063
2064 return sent_bytes;
2065 }
2066
2067 static unsigned
_qemudPipe_poll(void * opaque)2068 _qemudPipe_poll(void* opaque)
2069 {
2070 QemudPipe* pipe = opaque;
2071 QemudClient* client = pipe->client;
2072 unsigned ret = 0;
2073
2074 if (client != NULL) {
2075 ret |= PIPE_POLL_OUT;
2076 if (client->ProtocolSelector.Pipe.messages != NULL) {
2077 ret |= PIPE_POLL_IN;
2078 }
2079 } else {
2080 D("%s: Unexpected NULL client", __FUNCTION__);
2081 }
2082
2083 return ret;
2084 }
2085
2086 static void
_qemudPipe_wakeOn(void * opaque,int flags)2087 _qemudPipe_wakeOn(void* opaque, int flags)
2088 {
2089 D("%s: -> %X", __FUNCTION__, flags);
2090 }
2091
2092 static void
_qemudPipe_save(void * opaque,QEMUFile * f)2093 _qemudPipe_save(void* opaque, QEMUFile* f )
2094 {
2095 QemudPipe* qemud_pipe = (QemudPipe*)opaque;
2096 QemudClient* c = qemud_pipe->client;
2097 QemudPipeMessage* msg = c->ProtocolSelector.Pipe.messages;
2098
2099 /* save generic information */
2100 qemud_service_save_name(f, c->service);
2101 qemu_put_string(f, c->param);
2102
2103 /* Save pending messages. */
2104 while (msg != NULL) {
2105 _save_pipe_message(f, msg);
2106 msg = msg->next;
2107 }
2108 /* End of pending messages. */
2109 qemu_put_be32(f, 0);
2110
2111 /* save client-specific state */
2112 if (c->clie_save)
2113 c->clie_save(f, c, c->clie_opaque);
2114
2115 /* save framing configuration */
2116 qemu_put_be32(f, c->framing);
2117 if (c->framing) {
2118 qemu_put_be32(f, c->need_header);
2119 /* header sink always connected to c->header0, no need to save */
2120 qemu_put_be32(f, FRAME_HEADER_SIZE);
2121 qemu_put_buffer(f, c->header0, FRAME_HEADER_SIZE);
2122 /* payload sink */
2123 qemud_sink_save(f, c->payload);
2124 qemu_put_buffer(f, c->payload->buff, c->payload->size);
2125 }
2126 }
2127
2128 static void*
_qemudPipe_load(void * hwpipe,void * pipeOpaque,const char * args,QEMUFile * f)2129 _qemudPipe_load(void* hwpipe, void* pipeOpaque, const char* args, QEMUFile* f)
2130 {
2131 QemudPipe* qemud_pipe = NULL;
2132 char* param;
2133 char *service_name = qemud_service_load_name(f);
2134 if (service_name == NULL)
2135 return NULL;
2136 /* get service instance for the loading client*/
2137 QemudService *sv = qemud_service_find(_multiplexer->services, service_name);
2138 if (sv == NULL) {
2139 D("%s: load failed: unknown service \"%s\"\n",
2140 __FUNCTION__, service_name);
2141 return NULL;
2142 }
2143
2144 /* Load saved parameters. */
2145 param = qemu_get_string(f);
2146
2147 /* re-connect client */
2148 QemudClient* c = qemud_service_connect_client(sv, -1, param);
2149 if(c == NULL)
2150 return NULL;
2151
2152 /* Load pending messages. */
2153 c->ProtocolSelector.Pipe.messages = _load_pipe_message(f);
2154
2155 /* load client-specific state */
2156 if (c->clie_load && c->clie_load(f, c, c->clie_opaque)) {
2157 /* load failure */
2158 return NULL;
2159 }
2160
2161 /* load framing configuration */
2162 c->framing = qemu_get_be32(f);
2163 if (c->framing) {
2164
2165 /* header buffer */
2166 c->need_header = qemu_get_be32(f);
2167 int header_size = qemu_get_be32(f);
2168 if (header_size > FRAME_HEADER_SIZE) {
2169 D("%s: load failed: payload buffer requires %d bytes, %d available\n",
2170 __FUNCTION__, header_size, FRAME_HEADER_SIZE);
2171 return NULL;
2172 }
2173 int ret;
2174 if ((ret = qemu_get_buffer(f, c->header0, header_size)) != header_size) {
2175 D("%s: frame header buffer load failed: expected %d bytes, got %d\n",
2176 __FUNCTION__, header_size, ret);
2177 return NULL;
2178 }
2179
2180 /* payload sink */
2181 if ((ret = qemud_sink_load(f, c->payload)))
2182 return NULL;
2183
2184 /* replace payload buffer by saved data */
2185 if (c->payload->buff) {
2186 AFREE(c->payload->buff);
2187 }
2188 AARRAY_NEW(c->payload->buff, c->payload->size+1); /* +1 for terminating zero */
2189 if ((ret = qemu_get_buffer(f, c->payload->buff, c->payload->size)) != c->payload->size) {
2190 D("%s: frame payload buffer load failed: expected %d bytes, got %d\n",
2191 __FUNCTION__, c->payload->size, ret);
2192 AFREE(c->payload->buff);
2193 return NULL;
2194 }
2195 }
2196
2197 /* Associate the client with the pipe. */
2198 ANEW0(qemud_pipe);
2199 qemud_pipe->hwpipe = hwpipe;
2200 qemud_pipe->looper = pipeOpaque;
2201 qemud_pipe->service = sv;
2202 qemud_pipe->client = c;
2203 c->ProtocolSelector.Pipe.qemud_pipe = qemud_pipe;
2204
2205 return qemud_pipe;
2206 }
2207
2208 /* QEMUD pipe functions.
2209 */
2210 static const GoldfishPipeFuncs _qemudPipe_funcs = {
2211 _qemudPipe_init,
2212 _qemudPipe_closeFromGuest,
2213 _qemudPipe_sendBuffers,
2214 _qemudPipe_recvBuffers,
2215 _qemudPipe_poll,
2216 _qemudPipe_wakeOn,
2217 _qemudPipe_save,
2218 _qemudPipe_load,
2219 };
2220
2221 /* Initializes QEMUD pipe interface.
2222 */
2223 static void
_android_qemud_pipe_init(void)2224 _android_qemud_pipe_init(void)
2225 {
2226 static ABool _qemud_pipe_initialized = false;
2227
2228 if (!_qemud_pipe_initialized) {
2229 goldfish_pipe_add_type( "qemud", looper_newCore(), &_qemudPipe_funcs );
2230 _qemud_pipe_initialized = true;
2231 }
2232 }
2233
2234 /* this is the end of the serial charpipe that must be passed
2235 * to the emulated tty implementation. The other end of the
2236 * charpipe must be passed to qemud_multiplexer_init().
2237 */
2238 static CharDriverState* android_qemud_cs;
2239
2240 /* Initializes QEMUD serial interface.
2241 */
2242 static void
_android_qemud_serial_init(void)2243 _android_qemud_serial_init(void)
2244 {
2245 CharDriverState* cs;
2246
2247 if (android_qemud_cs != NULL)
2248 return;
2249
2250 if (qemu_chr_open_charpipe( &android_qemud_cs, &cs ) < 0) {
2251 derror( "%s: can't create charpipe to serial port",
2252 __FUNCTION__ );
2253 exit(1);
2254 }
2255
2256 qemud_multiplexer_init(_multiplexer, cs);
2257
2258 register_savevm( "qemud", 0, QEMUD_SAVE_VERSION,
2259 qemud_save, qemud_load, _multiplexer);
2260 }
2261
2262 extern void
android_qemud_init(void)2263 android_qemud_init( void )
2264 {
2265 D("%s", __FUNCTION__);
2266 /* We don't know in advance whether the guest system supports qemud pipes,
2267 * so we will initialize both qemud machineries, the legacy (over serial
2268 * port), and the new one (over qemu pipe). Then we let the guest to connect
2269 * via one, or the other. */
2270 _android_qemud_serial_init();
2271 _android_qemud_pipe_init();
2272 }
2273
2274 /* return the serial charpipe endpoint that must be used
2275 * by the emulated tty implementation.
2276 */
android_qemud_get_cs(void)2277 CharDriverState* android_qemud_get_cs( void )
2278 {
2279 if (android_qemud_cs == NULL)
2280 android_qemud_init();
2281
2282 return android_qemud_cs;
2283 }
2284
2285 /* this function is used to register a new named qemud-based
2286 * service. You must provide 'serv_opaque' and 'serv_connect'
2287 * which will be called whenever a new client tries to connect
2288 * to the services.
2289 *
2290 * 'serv_connect' shall return NULL if the connection is refused,
2291 * or a handle to a new QemudClient otherwise. The latter can be
2292 * created through qemud_client_new() defined above.
2293 *
2294 * 'max_clients' is the maximum number of clients accepted by
2295 * the service concurrently. If this value is 0, then any number
2296 * of clients can connect.
2297 */
2298 QemudService*
qemud_service_register(const char * service_name,int max_clients,void * serv_opaque,QemudServiceConnect serv_connect,QemudServiceSave serv_save,QemudServiceLoad serv_load)2299 qemud_service_register( const char* service_name,
2300 int max_clients,
2301 void* serv_opaque,
2302 QemudServiceConnect serv_connect,
2303 QemudServiceSave serv_save,
2304 QemudServiceLoad serv_load )
2305 {
2306 QemudService* sv;
2307 QemudMultiplexer* m = _multiplexer;
2308
2309 android_qemud_init();
2310
2311 sv = qemud_service_new(service_name,
2312 max_clients,
2313 serv_opaque,
2314 serv_connect,
2315 serv_save,
2316 serv_load,
2317 &m->services);
2318 D("Registered QEMUD service %s", service_name);
2319 return sv;
2320 }
2321
2322 /* broadcast a given message to all clients of a given QemudService
2323 */
2324 extern void
qemud_service_broadcast(QemudService * sv,const uint8_t * msg,int msglen)2325 qemud_service_broadcast( QemudService* sv,
2326 const uint8_t* msg,
2327 int msglen )
2328 {
2329 QemudClient* c;
2330
2331 for (c = sv->clients; c; c = c->next_serv)
2332 qemud_client_send(c, msg, msglen);
2333 }
2334
2335
2336
2337 /*
2338 * The following code is used for backwards compatibility reasons.
2339 * It allows you to implement a given qemud-based service through
2340 * a charpipe.
2341 *
2342 * In other words, this implements a QemudService and corresponding
2343 * QemudClient that connects a qemud client running in the emulated
2344 * system, to a CharDriverState object implemented through a charpipe.
2345 *
2346 * QemudCharClient <===charpipe====> (char driver user)
2347 *
2348 * For example, this is used to implement the "gsm" service when the
2349 * modem emulation is provided through an external serial device.
2350 *
2351 * A QemudCharService can have only one client by definition.
2352 * There is no QemudCharClient object because we can store a single
2353 * CharDriverState handle in the 'opaque' field for simplicity.
2354 */
2355
2356 typedef struct {
2357 QemudService* service;
2358 CharDriverState* cs;
2359 } QemudCharService;
2360
2361 /* called whenever a new message arrives from a qemud client.
2362 * this simply sends the message through the charpipe to the user.
2363 */
2364 static void
_qemud_char_client_recv(void * opaque,uint8_t * msg,int msglen,QemudClient * client)2365 _qemud_char_client_recv( void* opaque, uint8_t* msg, int msglen,
2366 QemudClient* client )
2367 {
2368 CharDriverState* cs = opaque;
2369 qemu_chr_write(cs, msg, msglen);
2370 }
2371
2372 /* we don't expect clients of char. services to exit. Just
2373 * print an error to signal an unexpected situation. We should
2374 * be able to recover from these though, so don't panic.
2375 */
2376 static void
_qemud_char_client_close(void * opaque)2377 _qemud_char_client_close( void* opaque )
2378
2379 {
2380 QemudClient* client = opaque;
2381
2382 /* At this point modem driver still uses char pipe to communicate with
2383 * hw-qemud, while communication with the guest is done over qemu pipe.
2384 * So, when guest disconnects from the qemu pipe, and emulator-side client
2385 * goes through the disconnection process, this routine is called, since it
2386 * has been set to called during service registration. Unless modem driver
2387 * is changed to drop char pipe communication, this routine will be called
2388 * due to guest disconnection. As long as the client was a qemu pipe - based
2389 * client, it's fine, since we don't really need to do anything in this case.
2390 */
2391 if (!_is_pipe_client(client)) {
2392 derror("unexpected qemud char. channel close");
2393 }
2394 }
2395
2396
2397 /* called by the charpipe to know how much data can be read from
2398 * the user. Since we send everything directly to the serial port
2399 * we can return an arbitrary number.
2400 */
2401 static int
_qemud_char_service_can_read(void * opaque)2402 _qemud_char_service_can_read( void* opaque )
2403 {
2404 return 8192; /* whatever */
2405 }
2406
2407 /* called to read data from the charpipe and send it to the client.
2408 * used qemud_service_broadcast() even if there is a single client
2409 * because we don't need a QemudCharClient object this way.
2410 */
2411 static void
_qemud_char_service_read(void * opaque,const uint8_t * from,int len)2412 _qemud_char_service_read( void* opaque, const uint8_t* from, int len )
2413 {
2414 QemudService* sv = opaque;
2415 qemud_service_broadcast( sv, from, len );
2416 }
2417
2418 /* called when a qemud client tries to connect to a char. service.
2419 * we simply create a new client and open the charpipe to receive
2420 * data from it.
2421 */
2422 static QemudClient*
_qemud_char_service_connect(void * opaque,QemudService * sv,int channel,const char * client_param)2423 _qemud_char_service_connect(void* opaque,
2424 QemudService* sv,
2425 int channel,
2426 const char* client_param )
2427 {
2428 CharDriverState* cs = opaque;
2429 QemudClient* c = qemud_client_new( sv, channel, client_param,
2430 cs,
2431 _qemud_char_client_recv,
2432 _qemud_char_client_close,
2433 NULL, NULL );
2434
2435 /* now we can open the gates :-) */
2436 qemu_chr_add_handlers( cs,
2437 _qemud_char_service_can_read,
2438 _qemud_char_service_read,
2439 NULL,
2440 sv );
2441
2442 return c;
2443 }
2444
2445 /* returns a charpipe endpoint that can be used by an emulated
2446 * device or external serial port to implement a char. service
2447 */
2448 int
android_qemud_get_channel(const char * name,CharDriverState ** pcs)2449 android_qemud_get_channel( const char* name, CharDriverState* *pcs )
2450 {
2451 CharDriverState* cs;
2452
2453 if (qemu_chr_open_charpipe(&cs, pcs) < 0) {
2454 derror("can't open charpipe for '%s' qemud service", name);
2455 exit(2);
2456 }
2457 qemud_service_register(name, 1, cs, _qemud_char_service_connect, NULL, NULL);
2458 return 0;
2459 }
2460
2461 /* set the character driver state for a given qemud communication channel. this
2462 * is used to attach the channel to an external char driver device directly.
2463 * returns 0 on success, -1 on error
2464 */
2465 int
android_qemud_set_channel(const char * name,CharDriverState * peer_cs)2466 android_qemud_set_channel( const char* name, CharDriverState* peer_cs )
2467 {
2468 CharDriverState* char_buffer = qemu_chr_open_buffer(peer_cs);
2469
2470 if (char_buffer == NULL)
2471 return -1;
2472
2473 qemud_service_register(name, 1, char_buffer, _qemud_char_service_connect,
2474 NULL, NULL);
2475 return 0;
2476 }
2477