/* Copyright (C) 2007-2008 The Android Open Source Project ** ** This software is licensed under the terms of the GNU General Public ** License version 2, as published by the Free Software Foundation, and ** may be copied, distributed, and modified under those terms. ** ** This program is distributed in the hope that it will be useful, ** but WITHOUT ANY WARRANTY; without even the implied warranty of ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ** GNU General Public License for more details. */ #include "android/hw-qemud.h" #include "android/utils/debug.h" #include "android/utils/misc.h" #include "android/utils/system.h" #include "android/utils/bufprint.h" #include "android/looper.h" #include "hw/hw.h" #include "hw/goldfish_pipe.h" #include "qemu-char.h" #include "charpipe.h" #include "cbuffer.h" #include "utils/panic.h" #define D(...) VERBOSE_PRINT(qemud,__VA_ARGS__) #define D_ACTIVE VERBOSE_CHECK(qemud) /* the T(...) macro is used to dump traffic */ #define T_ACTIVE 0 #if T_ACTIVE #define T(...) VERBOSE_PRINT(qemud,__VA_ARGS__) #else #define T(...) ((void)0) #endif /* max serial MTU. Don't change this without modifying * development/emulator/qemud/qemud.c as well. */ #define MAX_SERIAL_PAYLOAD 4000 /* max framed data payload. Must be < (1 << 16) */ #define MAX_FRAME_PAYLOAD 65535 /* Version number of snapshots code. Increment whenever the data saved * or the layout in which it is saved is changed. */ #define QEMUD_SAVE_VERSION 2 #define min(a, b) (((a) < (b)) ? (a) : (b)) /* define SUPPORT_LEGACY_QEMUD to 1 if you want to support * talking to a legacy qemud daemon. See docs/ANDROID-QEMUD.TXT * for details. */ #ifdef TARGET_ARM #define SUPPORT_LEGACY_QEMUD 1 #endif #ifdef TARGET_I386 #define SUPPORT_LEGACY_QEMUD 0 /* no legacy support */ #endif #if SUPPORT_LEGACY_QEMUD #include "telephony/android_modem.h" #include "telephony/modem_driver.h" #endif /* * This implements support for the 'qemud' multiplexing communication * channel between clients running in the emulated system and 'services' * provided by the emulator. * * For additional details, please read docs/ANDROID-QEMUD.TXT * */ /* * IMPLEMENTATION DETAILS: * * We use one charpipe to connect the emulated serial port to the 'QemudSerial' * object. This object is used to receive data from the serial port, and * unframe messages (i.e. extract payload length + channel id from header, * then the payload itself), before sending them to a generic receiver. * * The QemudSerial object can also be used to send messages to the daemon * through the serial port (see qemud_serial_send()) * * The multiplexer is connected to one or more 'service' objects. * are themselves connected through a charpipe to an emulated device or * control sub-module in the emulator. * * tty <==charpipe==> QemudSerial ---> QemudMultiplexer ----> QemudClient * ^ | * | | * +--------------------------------------+ * */ /** HANDLING INCOMING DATA FRAMES **/ /* A QemudSink is just a handly data structure that is used to * read a fixed amount of bytes into a buffer */ typedef struct QemudSink { int used; /* number of bytes already used */ int size; /* total number of bytes in buff */ uint8_t* buff; } QemudSink; /* save the state of a QemudSink to a snapshot. * * The buffer pointer is not saved, since it usually points to buffer * fields in other structs, which have save functions themselves. It * is up to the caller to make sure the buffer is correctly saved and * restored. */ static void qemud_sink_save(QEMUFile* f, QemudSink* s) { qemu_put_be32(f, s->used); qemu_put_be32(f, s->size); } /* load the state of a QemudSink from a snapshot. */ static int qemud_sink_load(QEMUFile* f, QemudSink* s) { s->used = qemu_get_be32(f); s->size = qemu_get_be32(f); return 0; } /* reset a QemudSink, i.e. provide a new destination buffer address * and its size in bytes. */ static void qemud_sink_reset( QemudSink* ss, int size, uint8_t* buffer ) { ss->used = 0; ss->size = size; ss->buff = buffer; } /* try to fill the sink by reading bytes from the source buffer * '*pmsg' which contains '*plen' bytes * * this functions updates '*pmsg' and '*plen', and returns * 1 if the sink's destination buffer is full, or 0 otherwise. */ static int qemud_sink_fill( QemudSink* ss, const uint8_t* *pmsg, int *plen) { int avail = ss->size - ss->used; if (avail <= 0) return 1; if (avail > *plen) avail = *plen; memcpy(ss->buff + ss->used, *pmsg, avail); *pmsg += avail; *plen -= avail; ss->used += avail; return (ss->used == ss->size); } /* returns the number of bytes needed to fill a sink's destination * buffer. */ static int qemud_sink_needed( QemudSink* ss ) { return ss->size - ss->used; } /** HANDLING SERIAL PORT CONNECTION **/ /* The QemudSerial object receives data from the serial port charpipe. * It parses the header to extract the channel id and payload length, * then the message itself. * * Incoming messages are sent to a generic receiver identified by * the 'recv_opaque' and 'recv_func' parameters to qemud_serial_init() * * It also provides qemud_serial_send() which can be used to send * messages back through the serial port. */ #define HEADER_SIZE 6 #define LENGTH_OFFSET 2 #define LENGTH_SIZE 4 #define CHANNEL_OFFSET 0 #define CHANNEL_SIZE 2 #if SUPPORT_LEGACY_QEMUD typedef enum { QEMUD_VERSION_UNKNOWN, QEMUD_VERSION_LEGACY, QEMUD_VERSION_NORMAL } QemudVersion; # define LEGACY_LENGTH_OFFSET 0 # define LEGACY_CHANNEL_OFFSET 4 #endif /* length of the framed header */ #define FRAME_HEADER_SIZE 4 #define BUFFER_SIZE MAX_SERIAL_PAYLOAD /* out of convenience, the incoming message is zero-terminated * and can be modified by the receiver (e.g. for tokenization). */ typedef void (*QemudSerialReceive)( void* opaque, int channel, uint8_t* msg, int msglen); typedef struct QemudSerial { CharDriverState* cs; /* serial charpipe endpoint */ /* managing incoming packets from the serial port */ ABool need_header; int overflow; int in_size; int in_channel; #if SUPPORT_LEGACY_QEMUD QemudVersion version; #endif QemudSink header[1]; QemudSink payload[1]; uint8_t data0[MAX_SERIAL_PAYLOAD+1]; /* receiver */ QemudSerialReceive recv_func; /* receiver callback */ void* recv_opaque; /* receiver user-specific data */ } QemudSerial; /* Save the state of a QemudSerial to a snapshot file. */ static void qemud_serial_save(QEMUFile* f, QemudSerial* s) { /* cs, recv_func and recv_opaque are not saved, as these are assigned only * during emulator init. A load within a session can re-use the values * already assigned, a newly launched emulator has freshly assigned values. */ /* state of incoming packets from the serial port */ qemu_put_be32(f, s->need_header); qemu_put_be32(f, s->overflow); qemu_put_be32(f, s->in_size); qemu_put_be32(f, s->in_channel); #if SUPPORT_LEGACY_QEMUD qemu_put_be32(f, s->version); #endif qemud_sink_save(f, s->header); qemud_sink_save(f, s->payload); qemu_put_be32(f, MAX_SERIAL_PAYLOAD+1); qemu_put_buffer(f, s->data0, MAX_SERIAL_PAYLOAD+1); } /* Load the state of a QemudSerial from a snapshot file. */ static int qemud_serial_load(QEMUFile* f, QemudSerial* s) { /* state of incoming packets from the serial port */ s->need_header = qemu_get_be32(f); s->overflow = qemu_get_be32(f); s->in_size = qemu_get_be32(f); s->in_channel = qemu_get_be32(f); #if SUPPORT_LEGACY_QEMUD s->version = qemu_get_be32(f); #endif qemud_sink_load(f, s->header); qemud_sink_load(f, s->payload); /* s->header and s->payload are only ever connected to s->data0 */ s->header->buff = s->payload->buff = s->data0; int len = qemu_get_be32(f); if (len - 1 > MAX_SERIAL_PAYLOAD) { D("%s: load failed: size of saved payload buffer (%d) exceeds " "current maximum (%d)\n", __FUNCTION__, len - 1, MAX_SERIAL_PAYLOAD); return -EIO; } int ret; if ((ret = qemu_get_buffer(f, s->data0, len)) != len) { D("%s: failed to load serial buffer contents (tried reading %d bytes, got %d)\n", __FUNCTION__, len, ret); return -EIO; } return 0; } /* called by the charpipe to see how much bytes can be * read from the serial port. */ static int qemud_serial_can_read( void* opaque ) { QemudSerial* s = opaque; if (s->overflow > 0) { return s->overflow; } /* if in_size is 0, we're reading the header */ if (s->need_header) return qemud_sink_needed(s->header); /* otherwise, we're reading the payload */ return qemud_sink_needed(s->payload); } /* called by the charpipe to read data from the serial * port. 'len' cannot be more than the value returned * by 'qemud_serial_can_read'. */ static void qemud_serial_read( void* opaque, const uint8_t* from, int len ) { QemudSerial* s = opaque; T("%s: received %3d bytes: '%s'", __FUNCTION__, len, quote_bytes((const void*)from, len)); while (len > 0) { int avail; /* skip overflow bytes */ if (s->overflow > 0) { avail = s->overflow; if (avail > len) avail = len; from += avail; len -= avail; continue; } /* read header if needed */ if (s->need_header) { if (!qemud_sink_fill(s->header, (const uint8_t**)&from, &len)) break; #if SUPPORT_LEGACY_QEMUD if (s->version == QEMUD_VERSION_UNKNOWN) { /* if we receive "001200" as the first header, then we * detected a legacy qemud daemon. See the comments * in qemud_serial_send_legacy_probe() for details. */ if ( !memcmp(s->data0, "001200", 6) ) { D("%s: legacy qemud detected.", __FUNCTION__); s->version = QEMUD_VERSION_LEGACY; /* tell the modem to use legacy emulation mode */ amodem_set_legacy(android_modem); } else { D("%s: normal qemud detected.", __FUNCTION__); s->version = QEMUD_VERSION_NORMAL; } } if (s->version == QEMUD_VERSION_LEGACY) { s->in_size = hex2int( s->data0 + LEGACY_LENGTH_OFFSET, LENGTH_SIZE ); s->in_channel = hex2int( s->data0 + LEGACY_CHANNEL_OFFSET, CHANNEL_SIZE ); } else { s->in_size = hex2int( s->data0 + LENGTH_OFFSET, LENGTH_SIZE ); s->in_channel = hex2int( s->data0 + CHANNEL_OFFSET, CHANNEL_SIZE ); } #else /* extract payload length + channel id */ s->in_size = hex2int( s->data0 + LENGTH_OFFSET, LENGTH_SIZE ); s->in_channel = hex2int( s->data0 + CHANNEL_OFFSET, CHANNEL_SIZE ); #endif s->header->used = 0; if (s->in_size <= 0 || s->in_channel < 0) { D("%s: bad header: '%.*s'", __FUNCTION__, HEADER_SIZE, s->data0); continue; } if (s->in_size > MAX_SERIAL_PAYLOAD) { D("%s: ignoring huge serial packet: length=%d channel=%1", __FUNCTION__, s->in_size, s->in_channel); s->overflow = s->in_size; continue; } /* prepare 'in_data' for payload */ s->need_header = 0; qemud_sink_reset(s->payload, s->in_size, s->data0); } /* read payload bytes */ if (!qemud_sink_fill(s->payload, &from, &len)) break; /* zero-terminate payload, then send it to receiver */ s->payload->buff[s->payload->size] = 0; D("%s: channel=%2d len=%3d '%s'", __FUNCTION__, s->in_channel, s->payload->size, quote_bytes((const void*)s->payload->buff, s->payload->size)); s->recv_func( s->recv_opaque, s->in_channel, s->payload->buff, s->payload->size ); /* prepare for new header */ s->need_header = 1; } } #if SUPPORT_LEGACY_QEMUD static void qemud_serial_send_legacy_probe( QemudSerial* s ) { /* we're going to send a specially crafted packet to the qemud * daemon, this will help us determine whether we're talking * to a legacy or a normal daemon. * * the trick is to known that a legacy daemon uses the following * header: * * * * while the normal one uses: * * * * where is a 2-hexchar string, and a 4-hexchar * string. * * if we send a header of "000100", it is interpreted: * * - as the header of a 1-byte payload by the legacy daemon * - as the header of a 256-byte payload by the normal one. * * we're going to send something that looks like: * * "000100" + "X" + * "000b00" + "connect:gsm" + * "000b00" + "connect:gps" + * "000f00" + "connect:control" + * "00c210" + "0"*194 * * the normal daemon will interpret this as a 256-byte payload * for channel 0, with garbage content ("X000b00conn...") which * will be silently ignored. * * on the other hand, the legacy daemon will see it as a * series of packets: * * one message "X" on channel 0, which will force the daemon * to send back "001200ko:unknown command" as its first answer. * * three "connect:" messages used to receive the channel * numbers of the three legacy services implemented by the daemon. * * a garbage packet of 194 zeroes for channel 16, which will be * silently ignored. */ uint8_t tab[194]; memset(tab, 0, sizeof(tab)); qemu_chr_write(s->cs, (uint8_t*)"000100X", 7); qemu_chr_write(s->cs, (uint8_t*)"000b00connect:gsm", 17); qemu_chr_write(s->cs, (uint8_t*)"000b00connect:gps", 17); qemu_chr_write(s->cs, (uint8_t*)"000f00connect:control", 21); qemu_chr_write(s->cs, (uint8_t*)"00c210", 6); qemu_chr_write(s->cs, tab, sizeof(tab)); } #endif /* SUPPORT_LEGACY_QEMUD */ /* intialize a QemudSerial object with a charpipe endpoint * and a receiver. */ static void qemud_serial_init( QemudSerial* s, CharDriverState* cs, QemudSerialReceive recv_func, void* recv_opaque ) { s->cs = cs; s->recv_func = recv_func; s->recv_opaque = recv_opaque; s->need_header = 1; s->overflow = 0; qemud_sink_reset( s->header, HEADER_SIZE, s->data0 ); s->in_size = 0; s->in_channel = -1; #if SUPPORT_LEGACY_QEMUD s->version = QEMUD_VERSION_UNKNOWN; qemud_serial_send_legacy_probe(s); #endif qemu_chr_add_handlers( cs, qemud_serial_can_read, qemud_serial_read, NULL, s ); } /* send a message to the serial port. This will add the necessary * header. */ static void qemud_serial_send( QemudSerial* s, int channel, ABool framing, const uint8_t* msg, int msglen ) { uint8_t header[HEADER_SIZE]; uint8_t frame[FRAME_HEADER_SIZE]; int avail, len = msglen; if (msglen <= 0 || channel < 0) return; D("%s: channel=%2d len=%3d '%s'", __FUNCTION__, channel, msglen, quote_bytes((const void*)msg, msglen)); if (framing) { len += FRAME_HEADER_SIZE; } /* packetize the payload for the serial MTU */ while (len > 0) { avail = len; if (avail > MAX_SERIAL_PAYLOAD) avail = MAX_SERIAL_PAYLOAD; /* write this packet's header */ #if SUPPORT_LEGACY_QEMUD if (s->version == QEMUD_VERSION_LEGACY) { int2hex(header + LEGACY_LENGTH_OFFSET, LENGTH_SIZE, avail); int2hex(header + LEGACY_CHANNEL_OFFSET, CHANNEL_SIZE, channel); } else { int2hex(header + LENGTH_OFFSET, LENGTH_SIZE, avail); int2hex(header + CHANNEL_OFFSET, CHANNEL_SIZE, channel); } #else int2hex(header + LENGTH_OFFSET, LENGTH_SIZE, avail); int2hex(header + CHANNEL_OFFSET, CHANNEL_SIZE, channel); #endif T("%s: '%.*s'", __FUNCTION__, HEADER_SIZE, header); qemu_chr_write(s->cs, header, HEADER_SIZE); /* insert frame header when needed */ if (framing) { int2hex(frame, FRAME_HEADER_SIZE, msglen); T("%s: '%.*s'", __FUNCTION__, FRAME_HEADER_SIZE, frame); qemu_chr_write(s->cs, frame, FRAME_HEADER_SIZE); avail -= FRAME_HEADER_SIZE; len -= FRAME_HEADER_SIZE; framing = 0; } /* write message content */ T("%s: '%.*s'", __FUNCTION__, avail, msg); qemu_chr_write(s->cs, msg, avail); msg += avail; len -= avail; } } /** CLIENTS **/ /* Descriptor for a data buffer pending to be sent to a qemud pipe client. * * When a service decides to send data to the client, there could be cases when * client is not ready to read them. In this case there is no GoldfishPipeBuffer * available to write service's data to, So, we need to cache that data into the * client descriptor, and "send" them over to the client in _qemudPipe_recvBuffers * callback. Pending service data is stored in the client descriptor as a list * of QemudPipeMessage instances. */ typedef struct QemudPipeMessage QemudPipeMessage; struct QemudPipeMessage { /* Message to send. */ uint8_t* message; /* Message size. */ size_t size; /* Offset in the message buffer of the chunk, that has not been sent * to the pipe yet. */ size_t offset; /* Links next message in the client. */ QemudPipeMessage* next; }; /* A QemudClient models a single client as seen by the emulator. * Each client has its own channel id (for the serial qemud), or pipe descriptor * (for the pipe based qemud), and belongs to a given QemudService (see below). * * There is a global list of serial clients used to multiplex incoming * messages from the channel id (see qemud_multiplexer_serial_recv()). Pipe * clients don't need multiplexing, because they are communicated via qemud pipes * that are unique for each client. * */ /* Defines type of the client: pipe, or serial. */ typedef enum QemudProtocol { /* Client is communicating via pipe. */ QEMUD_PROTOCOL_PIPE, /* Client is communicating via serial port. */ QEMUD_PROTOCOL_SERIAL } QemudProtocol; /* Descriptor for a QEMUD pipe connection. * * Every time a client connects to the QEMUD via pipe, an instance of this * structure is created to represent a connection used by new pipe client. */ typedef struct QemudPipe { /* Pipe descriptor. */ void* hwpipe; /* Looper used for I/O */ void* looper; /* Service for this pipe. */ QemudService* service; /* Client for this pipe. */ QemudClient* client; } QemudPipe; struct QemudClient { /* Defines protocol, used by the client. */ QemudProtocol protocol; /* Fields that are common for all protocols. */ char* param; void* clie_opaque; QemudClientRecv clie_recv; QemudClientClose clie_close; QemudClientSave clie_save; QemudClientLoad clie_load; QemudService* service; QemudClient* next_serv; /* next in same service */ QemudClient* next; QemudClient** pref; /* framing support */ int framing; ABool need_header; ABool closing; QemudSink header[1]; uint8_t header0[FRAME_HEADER_SIZE]; QemudSink payload[1]; /* Fields that are protocol-specific. */ union { /* Serial-specific fields. */ struct { int channel; QemudSerial* serial; } Serial; /* Pipe-specific fields. */ struct { QemudPipe* qemud_pipe; QemudPipeMessage* messages; } Pipe; } ProtocolSelector; }; static ABool _is_pipe_client(QemudClient* client) { return (client-> protocol == QEMUD_PROTOCOL_PIPE) ? true : false; } static void qemud_service_remove_client( QemudService* service, QemudClient* client ); /* remove a QemudClient from global list */ static void qemud_client_remove( QemudClient* c ) { c->pref[0] = c->next; if (c->next) c->next->pref = c->pref; c->next = NULL; c->pref = &c->next; } /* add a QemudClient to global list */ static void qemud_client_prepend( QemudClient* c, QemudClient** plist ) { c->next = *plist; c->pref = plist; *plist = c; if (c->next) c->next->pref = &c->next; } /* receive a new message from a client, and dispatch it to * the real service implementation. */ static void qemud_client_recv( void* opaque, uint8_t* msg, int msglen ) { QemudClient* c = opaque; /* no framing, things are simple */ if (!c->framing) { if (c->clie_recv) c->clie_recv( c->clie_opaque, msg, msglen, c ); return; } /* framing */ #if 1 /* special case, in 99% of cases, everything is in * the incoming message, and we can do all we need * directly without dynamic allocation. */ if (msglen > FRAME_HEADER_SIZE && c->need_header == 1 && qemud_sink_needed(c->header) == 0) { int len = hex2int( msg, FRAME_HEADER_SIZE ); if (len >= 0 && msglen == len + FRAME_HEADER_SIZE) { if (c->clie_recv) c->clie_recv( c->clie_opaque, msg+FRAME_HEADER_SIZE, msglen-FRAME_HEADER_SIZE, c ); return; } } #endif while (msglen > 0) { uint8_t *data; /* read the header */ if (c->need_header) { int frame_size; uint8_t* data; if (!qemud_sink_fill(c->header, (const uint8_t**)&msg, &msglen)) break; frame_size = hex2int(c->header0, 4); if (frame_size == 0) { D("%s: ignoring empty frame", __FUNCTION__); continue; } if (frame_size < 0) { D("%s: ignoring corrupted frame header '.*s'", __FUNCTION__, FRAME_HEADER_SIZE, c->header0 ); continue; } AARRAY_NEW(data, frame_size+1); /* +1 for terminating zero */ qemud_sink_reset(c->payload, frame_size, data); c->need_header = 0; c->header->used = 0; } /* read the payload */ if (!qemud_sink_fill(c->payload, (const uint8_t**)&msg, &msglen)) break; c->payload->buff[c->payload->size] = 0; c->need_header = 1; data = c->payload->buff; /* Technically, calling 'clie_recv' can destroy client object 'c' * if it decides to close the connection, so ensure we don't * use/dereference it after the call. */ if (c->clie_recv) c->clie_recv( c->clie_opaque, c->payload->buff, c->payload->size, c ); AFREE(data); } } /* Sends data to a pipe-based client. */ static void _qemud_pipe_send(QemudClient* client, const uint8_t* msg, int msglen); /* Frees memory allocated for the qemud client. */ static void _qemud_client_free(QemudClient* c) { if ( c != NULL) { if (_is_pipe_client(c)) { /* Free outstanding messages. */ QemudPipeMessage** msg_list = &c->ProtocolSelector.Pipe.messages; while (*msg_list != NULL) { QemudPipeMessage* to_free = *msg_list; *msg_list = to_free->next; free(to_free); } } if (c->param != NULL) { free(c->param); } AFREE(c); } } /* disconnect a client. this automatically frees the QemudClient. * note that this also removes the client from the global list * and from its service's list, if any. * Param: * opaque - QemuClient instance * guest_close - For pipe clients control whether or not the disconnect is * caused by guest closing the pipe handle (in which case 1 is passed in * this parameter). For serial clients this parameter is ignored. */ static void qemud_client_disconnect( void* opaque, int guest_close ) { QemudClient* c = opaque; if (c->closing) { /* recursive call, exit immediately */ return; } if (_is_pipe_client(c) && !guest_close) { /* This is emulator component (rather than the guest) closing a pipe * client. Since pipe clients are controlled strictly by the guest, we * don't actually close the client here, but notify the guest about the * client being disconnected. Then we will do the real client close when * the guest explicitly closes the pipe, in which case this routine will * be called from the _qemudPipe_closeFromGuest callback with guest_close * set to 1. */ char tmp[128], *p=tmp, *end=p+sizeof(tmp); p = bufprint(tmp, end, "disconnect:00"); _qemud_pipe_send(c, (uint8_t*)tmp, p-tmp); return; } c->closing = 1; /* remove from current list */ qemud_client_remove(c); if (_is_pipe_client(c)) { /* We must NULL the client reference in the QemuPipe for this connection, * so if a sudden receive request comes after client has been closed, we * don't blow up. */ c->ProtocolSelector.Pipe.qemud_pipe->client = NULL; } else if (c->ProtocolSelector.Serial.channel > 0) { /* send a disconnect command to the daemon */ char tmp[128], *p=tmp, *end=p+sizeof(tmp); p = bufprint(tmp, end, "disconnect:%02x", c->ProtocolSelector.Serial.channel); qemud_serial_send(c->ProtocolSelector.Serial.serial, 0, 0, (uint8_t*)tmp, p-tmp); } /* call the client close callback */ if (c->clie_close) { c->clie_close(c->clie_opaque); c->clie_close = NULL; } c->clie_recv = NULL; /* remove from service list, if any */ if (c->service) { qemud_service_remove_client(c->service, c); c->service = NULL; } _qemud_client_free(c); } /* allocate a new QemudClient object * NOTE: channel_id valie is used as a selector between serial and pipe clients. * Since channel_id < 0 is an invalid value for a serial client, it would * indicate that creating client is a pipe client. */ static QemudClient* qemud_client_alloc( int channel_id, const char* client_param, void* clie_opaque, QemudClientRecv clie_recv, QemudClientClose clie_close, QemudClientSave clie_save, QemudClientLoad clie_load, QemudSerial* serial, QemudClient** pclients ) { QemudClient* c; ANEW0(c); if (channel_id < 0) { /* Allocating a pipe client. */ c->protocol = QEMUD_PROTOCOL_PIPE; c->ProtocolSelector.Pipe.messages = NULL; c->ProtocolSelector.Pipe.qemud_pipe = NULL; } else { /* Allocating a serial client. */ c->protocol = QEMUD_PROTOCOL_SERIAL; c->ProtocolSelector.Serial.serial = serial; c->ProtocolSelector.Serial.channel = channel_id; } c->param = client_param ? ASTRDUP(client_param) : NULL; c->clie_opaque = clie_opaque; c->clie_recv = clie_recv; c->clie_close = clie_close; c->clie_save = clie_save; c->clie_load = clie_load; c->service = NULL; c->next_serv = NULL; c->next = NULL; c->framing = 0; c->need_header = 1; qemud_sink_reset(c->header, FRAME_HEADER_SIZE, c->header0); qemud_client_prepend(c, pclients); return c; } /* forward */ static void qemud_service_save_name( QEMUFile* f, QemudService* s ); static char* qemud_service_load_name( QEMUFile* f ); static QemudService* qemud_service_find( QemudService* service_list, const char* service_name ); static QemudClient* qemud_service_connect_client( QemudService *sv, int channel_id, const char* client_param); /* Saves the client state needed to re-establish connections on load. * Note that we save only serial clients here. The pipe clients will be * saved along with the pipe to which they are attached. */ static void qemud_serial_client_save(QEMUFile* f, QemudClient* c) { /* save generic information */ qemud_service_save_name(f, c->service); qemu_put_string(f, c->param); qemu_put_be32(f, c->ProtocolSelector.Serial.channel); /* save client-specific state */ if (c->clie_save) c->clie_save(f, c, c->clie_opaque); /* save framing configuration */ qemu_put_be32(f, c->framing); if (c->framing) { qemu_put_be32(f, c->need_header); /* header sink always connected to c->header0, no need to save */ qemu_put_be32(f, FRAME_HEADER_SIZE); qemu_put_buffer(f, c->header0, FRAME_HEADER_SIZE); /* payload sink */ qemud_sink_save(f, c->payload); qemu_put_buffer(f, c->payload->buff, c->payload->size); } } /* Loads client state from file, then starts a new client connected to the * corresponding service. * Note that we load only serial clients here. The pipe clients will be * loaded along with the pipe to which they were attached. */ static int qemud_serial_client_load(QEMUFile* f, QemudService* current_services, int version ) { char *service_name = qemud_service_load_name(f); if (service_name == NULL) return -EIO; char* param = qemu_get_string(f); /* get current service instance */ QemudService *sv = qemud_service_find(current_services, service_name); if (sv == NULL) { D("%s: load failed: unknown service \"%s\"\n", __FUNCTION__, service_name); return -EIO; } int channel = qemu_get_be32(f); if (channel == 0) { D("%s: illegal snapshot: client for control channel must no be saved\n", __FUNCTION__); return -EIO; } /* re-connect client */ QemudClient* c = qemud_service_connect_client(sv, channel, param); if(c == NULL) return -EIO; /* load client-specific state */ int ret; if (c->clie_load) if ((ret = c->clie_load(f, c, c->clie_opaque))) return ret; /* load failure */ /* load framing configuration */ c->framing = qemu_get_be32(f); if (c->framing) { /* header buffer */ c->need_header = qemu_get_be32(f); int header_size = qemu_get_be32(f); if (header_size > FRAME_HEADER_SIZE) { D("%s: load failed: payload buffer requires %d bytes, %d available\n", __FUNCTION__, header_size, FRAME_HEADER_SIZE); return -EIO; } int ret; if ((ret = qemu_get_buffer(f, c->header0, header_size)) != header_size) { D("%s: frame header buffer load failed: expected %d bytes, got %d\n", __FUNCTION__, header_size, ret); return -EIO; } /* payload sink */ if ((ret = qemud_sink_load(f, c->payload))) return ret; /* replace payload buffer by saved data */ if (c->payload->buff) { AFREE(c->payload->buff); } AARRAY_NEW(c->payload->buff, c->payload->size+1); /* +1 for terminating zero */ if ((ret = qemu_get_buffer(f, c->payload->buff, c->payload->size)) != c->payload->size) { D("%s: frame payload buffer load failed: expected %d bytes, got %d\n", __FUNCTION__, c->payload->size, ret); AFREE(c->payload->buff); return -EIO; } } return 0; } /** SERVICES **/ /* A QemudService models a _named_ service facility implemented * by the emulator, that clients in the emulated system can connect * to. * * Each service can have a limit on the number of clients they * accept (this number if unlimited if 'max_clients' is 0). * * Each service maintains a list of active QemudClients and * can also be used to create new QemudClient objects through * its 'serv_opaque' and 'serv_connect' fields. */ struct QemudService { const char* name; int max_clients; int num_clients; QemudClient* clients; QemudServiceConnect serv_connect; QemudServiceSave serv_save; QemudServiceLoad serv_load; void* serv_opaque; QemudService* next; }; /* Create a new QemudService object */ static QemudService* qemud_service_new( const char* name, int max_clients, void* serv_opaque, QemudServiceConnect serv_connect, QemudServiceSave serv_save, QemudServiceLoad serv_load, QemudService** pservices ) { QemudService* s; ANEW0(s); s->name = ASTRDUP(name); s->max_clients = max_clients; s->num_clients = 0; s->clients = NULL; s->serv_opaque = serv_opaque; s->serv_connect = serv_connect; s->serv_save = serv_save; s->serv_load = serv_load; s->next = *pservices; *pservices = s; return s; } /* used internally to populate a QemudService object with a * new QemudClient */ static void qemud_service_add_client( QemudService* s, QemudClient* c ) { c->service = s; c->next_serv = s->clients; s->clients = c; s->num_clients += 1; } /* used internally to remove a QemudClient from a QemudService */ static void qemud_service_remove_client( QemudService* s, QemudClient* c ) { QemudClient** pnode = &s->clients; QemudClient* node; /* remove from clients linked-list */ for (;;) { node = *pnode; if (node == NULL) { D("%s: could not find client for service '%s'", __FUNCTION__, s->name); return; } if (node == c) break; pnode = &node->next_serv; } *pnode = node->next_serv; s->num_clients -= 1; } /* ask the service to create a new QemudClient. Note that we * assume that this calls qemud_client_new() which will add * the client to the service's list automatically. * * returns the client or NULL if an error occurred */ static QemudClient* qemud_service_connect_client(QemudService *sv, int channel_id, const char* client_param) { QemudClient* client = sv->serv_connect( sv->serv_opaque, sv, channel_id, client_param ); if (client == NULL) { D("%s: registration failed for '%s' service", __FUNCTION__, sv->name); return NULL; } D("%s: registered client channel %d for '%s' service", __FUNCTION__, channel_id, sv->name); return client; } /* find a registered service by name. */ static QemudService* qemud_service_find( QemudService* service_list, const char* service_name) { QemudService* sv = NULL; for (sv = service_list; sv != NULL; sv = sv->next) { if (!strcmp(sv->name, service_name)) { break; } } return sv; } /* Save the name of the given service. */ static void qemud_service_save_name(QEMUFile* f, QemudService* s) { int len = strlen(s->name) + 1; // include '\0' terminator qemu_put_be32(f, len); qemu_put_buffer(f, (const uint8_t *) s->name, len); } /* Load the name of a service. Returns a pointer to the loaded name, or NULL * on failure. */ static char* qemud_service_load_name( QEMUFile* f ) { int ret; int name_len = qemu_get_be32(f); char *service_name = android_alloc(name_len); if ((ret = qemu_get_buffer(f, (uint8_t*)service_name, name_len) != name_len)) { D("%s: service name load failed: expected %d bytes, got %d\n", __FUNCTION__, name_len, ret); AFREE(service_name); return NULL; } if (service_name[name_len - 1] != '\0') { char last = service_name[name_len - 1]; service_name[name_len - 1] = '\0'; /* make buffer contents printable */ D("%s: service name load failed: expecting NULL-terminated string, but " "last char is '%c' (buffer contents: '%s%c')\n", __FUNCTION__, name_len, last, service_name, last); AFREE(service_name); return NULL; } return service_name; } /* Saves state of a service. */ static void qemud_service_save(QEMUFile* f, QemudService* s) { qemud_service_save_name(f, s); qemu_put_be32(f, s->max_clients); qemu_put_be32(f, s->num_clients); if (s->serv_save) s->serv_save(f, s, s->serv_opaque); } /* Loads service state from file, then updates the currently running instance * of that service to mirror the loaded state. If the service is not running, * the load process is aborted. * * Parameter 'current_services' should be the list of active services. */ static int qemud_service_load( QEMUFile* f, QemudService* current_services ) { char* service_name = qemud_service_load_name(f); if (service_name == NULL) return -EIO; /* get current service instance */ QemudService *sv = qemud_service_find(current_services, service_name); if (sv == NULL) { D("%s: loading failed: service \"%s\" not available\n", __FUNCTION__, service_name); return -EIO; } /* reconfigure service as required */ sv->max_clients = qemu_get_be32(f); sv->num_clients = qemu_get_be32(f); /* load service specific data */ int ret; if (sv->serv_load) if ((ret = sv->serv_load(f, sv, sv->serv_opaque))) return ret; /* load failure */ return 0; } /** MULTIPLEXER **/ /* A QemudMultiplexer object maintains the global state of the * qemud service facility. It holds a QemudSerial object to * maintain the state of the serial port connection. * * The QemudMultiplexer receives all incoming messages from * the serial port, and dispatches them to the appropriate * QemudClient. * * It also has a global list of clients, and a global list of * services. * * Finally, the QemudMultiplexer has a special QemudClient used * to handle channel 0, i.e. the control channel used to handle * connections and disconnections of clients. */ typedef struct QemudMultiplexer QemudMultiplexer; struct QemudMultiplexer { QemudSerial serial[1]; QemudClient* clients; QemudService* services; }; /* this is the serial_recv callback that is called * whenever an incoming message arrives through the serial port */ static void qemud_multiplexer_serial_recv( void* opaque, int channel, uint8_t* msg, int msglen ) { QemudMultiplexer* m = opaque; QemudClient* c = m->clients; /* dispatch to an existing client if possible * note that channel 0 is handled by a special * QemudClient that is setup in qemud_multiplexer_init() */ for ( ; c != NULL; c = c->next ) { if (!_is_pipe_client(c) && c->ProtocolSelector.Serial.channel == channel) { qemud_client_recv(c, msg, msglen); return; } } D("%s: ignoring %d bytes for unknown channel %d", __FUNCTION__, msglen, channel); } /* handle a new connection attempt. This returns 0 on * success, -1 if the service name is unknown, or -2 * if the service's maximum number of clients has been * reached. */ static int qemud_multiplexer_connect( QemudMultiplexer* m, const char* service_name, int channel_id ) { /* find the corresponding registered service by name */ QemudService* sv = qemud_service_find(m->services, service_name); if (sv == NULL) { D("%s: no registered '%s' service", __FUNCTION__, service_name); return -1; } /* check service's client count */ if (sv->max_clients > 0 && sv->num_clients >= sv->max_clients) { D("%s: registration failed for '%s' service: too many clients (%d)", __FUNCTION__, service_name, sv->num_clients); return -2; } /* connect a new client to the service on the given channel */ if (qemud_service_connect_client(sv, channel_id, NULL) == NULL) return -1; return 0; } /* disconnect a given client from its channel id */ static void qemud_multiplexer_disconnect( QemudMultiplexer* m, int channel ) { QemudClient* c; /* find the client by its channel id, then disconnect it */ for (c = m->clients; c; c = c->next) { if (!_is_pipe_client(c) && c->ProtocolSelector.Serial.channel == channel) { D("%s: disconnecting client %d", __FUNCTION__, channel); /* note thatt this removes the client from * m->clients automatically. */ c->ProtocolSelector.Serial.channel = -1; /* no need to send disconnect: */ qemud_client_disconnect(c, 0); return; } } D("%s: disconnecting unknown channel %d", __FUNCTION__, channel); } /* disconnects all channels, except for the control channel, without informing * the daemon in the guest that disconnection has occurred. * * Used to silently kill clients when restoring emulator state snapshots. */ static void qemud_multiplexer_disconnect_noncontrol( QemudMultiplexer* m ) { QemudClient* c; QemudClient* next = m->clients; while (next) { c = next; next = c->next; /* disconnect frees c, remember next in advance */ if (!_is_pipe_client(c) && c->ProtocolSelector.Serial.channel > 0) { /* skip control channel */ D("%s: disconnecting client %d", __FUNCTION__, c->ProtocolSelector.Serial.channel); D("%s: disconnecting client %d\n", __FUNCTION__, c->ProtocolSelector.Serial.channel); c->ProtocolSelector.Serial.channel = -1; /* do not send disconnect: */ qemud_client_disconnect(c, 0); } } } /* handle control messages. This is used as the receive * callback for the special QemudClient setup to manage * channel 0. * * note that the message is zero-terminated for convenience * (i.e. msg[msglen] is a valid memory read that returns '\0') */ static void qemud_multiplexer_control_recv( void* opaque, uint8_t* msg, int msglen, QemudClient* client ) { QemudMultiplexer* mult = opaque; uint8_t* msgend = msg + msglen; char tmp[64], *p=tmp, *end=p+sizeof(tmp); /* handle connection attempts. * the client message must be "connect::" * where is a 2-char hexadecimal string, which must be > 0 */ if (msglen > 8 && !memcmp(msg, "connect:", 8)) { const char* service_name = (const char*)msg + 8; int channel, ret; char* q; q = strchr(service_name, ':'); if (q == NULL || q+3 != (char*)msgend) { D("%s: malformed connect message: '%.*s' (offset=%d)", __FUNCTION__, msglen, (const char*)msg, q ? q-(char*)msg : -1); return; } *q++ = 0; /* zero-terminate service name */ channel = hex2int((uint8_t*)q, 2); if (channel <= 0) { D("%s: malformed channel id '%.*s", __FUNCTION__, 2, q); return; } ret = qemud_multiplexer_connect(mult, service_name, channel); /* the answer can be one of: * ok:connect: * ko:connect:: */ if (ret < 0) { if (ret == -1) { /* could not connect */ p = bufprint(tmp, end, "ko:connect:%02x:unknown service", channel); } else { p = bufprint(tmp, end, "ko:connect:%02x:service busy", channel); } } else { p = bufprint(tmp, end, "ok:connect:%02x", channel); } qemud_serial_send(mult->serial, 0, 0, (uint8_t*)tmp, p-tmp); return; } /* handle client disconnections, * this message arrives when the client has closed the connection. * format: "disconnect:" where is a 2-hex channel id > 0 */ if (msglen == 13 && !memcmp(msg, "disconnect:", 11)) { int channel_id = hex2int(msg+11, 2); if (channel_id <= 0) { D("%s: malformed disconnect channel id: '%.*s'", __FUNCTION__, 2, msg+11); return; } qemud_multiplexer_disconnect(mult, channel_id); return; } #if SUPPORT_LEGACY_QEMUD /* an ok:connect:: message can be received if we're * talking to a legacy qemud daemon, i.e. one running in a 1.0 or * 1.1 system image. * * we should treat is as a normal "connect:" attempt, except that * we must not send back any acknowledgment. */ if (msglen > 11 && !memcmp(msg, "ok:connect:", 11)) { const char* service_name = (const char*)msg + 11; char* q = strchr(service_name, ':'); int channel; if (q == NULL || q+3 != (char*)msgend) { D("%s: malformed legacy connect message: '%.*s' (offset=%d)", __FUNCTION__, msglen, (const char*)msg, q ? q-(char*)msg : -1); return; } *q++ = 0; /* zero-terminate service name */ channel = hex2int((uint8_t*)q, 2); if (channel <= 0) { D("%s: malformed legacy channel id '%.*s", __FUNCTION__, 2, q); return; } switch (mult->serial->version) { case QEMUD_VERSION_UNKNOWN: mult->serial->version = QEMUD_VERSION_LEGACY; D("%s: legacy qemud daemon detected.", __FUNCTION__); break; case QEMUD_VERSION_LEGACY: /* nothing unusual */ break; default: D("%s: weird, ignoring legacy qemud control message: '%.*s'", __FUNCTION__, msglen, msg); return; } /* "hw-control" was called "control" in 1.0/1.1 */ if (!strcmp(service_name,"control")) service_name = "hw-control"; qemud_multiplexer_connect(mult, service_name, channel); return; } /* anything else, don't answer for legacy */ if (mult->serial->version == QEMUD_VERSION_LEGACY) return; #endif /* SUPPORT_LEGACY_QEMUD */ /* anything else is a problem */ p = bufprint(tmp, end, "ko:unknown command"); qemud_serial_send(mult->serial, 0, 0, (uint8_t*)tmp, p-tmp); } /* initialize the global QemudMultiplexer. */ static void qemud_multiplexer_init( QemudMultiplexer* mult, CharDriverState* serial_cs ) { QemudClient* control; /* initialize serial handler */ qemud_serial_init( mult->serial, serial_cs, qemud_multiplexer_serial_recv, mult ); /* setup listener for channel 0 */ control = qemud_client_alloc( 0, NULL, mult, qemud_multiplexer_control_recv, NULL, NULL, NULL, mult->serial, &mult->clients ); } /* the global multiplexer state */ static QemudMultiplexer _multiplexer[1]; /** HIGH-LEVEL API **/ /* this function must be used in the serv_connect callback * of a given QemudService object (see qemud_service_register() * below). It is used to register a new QemudClient to acknowledge * a new client connection. * * 'clie_opaque', 'clie_recv' and 'clie_close' are used to * send incoming client messages to the corresponding service * implementation, or notify the service that a client has * disconnected. */ QemudClient* qemud_client_new( QemudService* service, int channelId, const char* client_param, void* clie_opaque, QemudClientRecv clie_recv, QemudClientClose clie_close, QemudClientSave clie_save, QemudClientLoad clie_load ) { QemudMultiplexer* m = _multiplexer; QemudClient* c = qemud_client_alloc( channelId, client_param, clie_opaque, clie_recv, clie_close, clie_save, clie_load, m->serial, &m->clients ); qemud_service_add_client(service, c); return c; } /* Caches a service message into the client's descriptor. * * See comments on QemudPipeMessage structure for more info. */ static void _qemud_pipe_cache_buffer(QemudClient* client, const uint8_t* msg, int msglen) { QemudPipeMessage* buf; QemudPipeMessage** ins_at = &client->ProtocolSelector.Pipe.messages; /* Allocate descriptor big enough to contain message as well. */ buf = (QemudPipeMessage*)malloc(msglen + sizeof(QemudPipeMessage)); if (buf != NULL) { /* Message starts right after the descriptor. */ buf->message = (uint8_t*)buf + sizeof(QemudPipeMessage); buf->size = msglen; memcpy(buf->message, msg, msglen); buf->offset = 0; buf->next = NULL; while (*ins_at != NULL) { ins_at = &(*ins_at)->next; } *ins_at = buf; /* Notify the pipe that there is data to read. */ goldfish_pipe_wake(client->ProtocolSelector.Pipe.qemud_pipe->hwpipe, PIPE_WAKE_READ); } } /* Sends service message to the client. */ static void _qemud_pipe_send(QemudClient* client, const uint8_t* msg, int msglen) { uint8_t frame[FRAME_HEADER_SIZE]; int avail, len = msglen; int framing = client->framing; if (msglen <= 0) return; D("%s: len=%3d '%s'", __FUNCTION__, msglen, quote_bytes((const void*)msg, msglen)); if (framing) { len += FRAME_HEADER_SIZE; } /* packetize the payload for the serial MTU */ while (len > 0) { avail = len; if (avail > MAX_SERIAL_PAYLOAD) avail = MAX_SERIAL_PAYLOAD; /* insert frame header when needed */ if (framing) { int2hex(frame, FRAME_HEADER_SIZE, msglen); T("%s: '%.*s'", __FUNCTION__, FRAME_HEADER_SIZE, frame); _qemud_pipe_cache_buffer(client, frame, FRAME_HEADER_SIZE); avail -= FRAME_HEADER_SIZE; len -= FRAME_HEADER_SIZE; framing = 0; } /* write message content */ T("%s: '%.*s'", __FUNCTION__, avail, msg); _qemud_pipe_cache_buffer(client, msg, avail); msg += avail; len -= avail; } } /* this can be used by a service implementation to send an answer * or message to a specific client. */ void qemud_client_send ( QemudClient* client, const uint8_t* msg, int msglen ) { if (_is_pipe_client(client)) { _qemud_pipe_send(client, msg, msglen); } else { qemud_serial_send(client->ProtocolSelector.Serial.serial, client->ProtocolSelector.Serial.channel, client->framing != 0, msg, msglen); } } /* enable framing for this client. When TRUE, this will * use internally a simple 4-hexchar header before each * message exchanged through the serial port. */ void qemud_client_set_framing( QemudClient* client, int framing ) { /* release dynamic buffer if we're disabling framing */ if (client->framing) { if (!client->need_header) { AFREE(client->payload->buff); client->need_header = 1; } } client->framing = !!framing; } /* this can be used by a service implementation to close a * specific client connection. */ void qemud_client_close( QemudClient* client ) { qemud_client_disconnect(client, 0); } /** SNAPSHOT SUPPORT **/ /* Saves the number of clients. */ static void qemud_client_save_count(QEMUFile* f, QemudClient* c) { unsigned int client_count = 0; for( ; c; c = c->next) // walk over linked list /* skip control channel, which is not saved, and pipe channels that * are saved along with the pipe. */ if (!_is_pipe_client(c) && c->ProtocolSelector.Serial.channel > 0) client_count++; qemu_put_be32(f, client_count); } /* Saves the number of services currently available. */ static void qemud_service_save_count(QEMUFile* f, QemudService* s) { unsigned int service_count = 0; for( ; s; s = s->next ) // walk over linked list service_count++; qemu_put_be32(f, service_count); } /* Save QemuD state to snapshot. * * The control channel has no state of its own, other than the local variables * in qemud_multiplexer_control_recv. We can therefore safely skip saving it, * which spares us dealing with the exception of a client not connected to a * service. */ static void qemud_save(QEMUFile* f, void* opaque) { QemudMultiplexer *m = opaque; qemud_serial_save(f, m->serial); /* save service states */ qemud_service_save_count(f, m->services); QemudService *s; for (s = m->services; s; s = s->next) qemud_service_save(f, s); /* save client channels */ qemud_client_save_count(f, m->clients); QemudClient *c; for (c = m->clients; c; c = c->next) { /* skip control channel, and pipe clients */ if (!_is_pipe_client(c) && c->ProtocolSelector.Serial.channel > 0) { qemud_serial_client_save(f, c); } } } /* Checks whether the same services are available at this point as when the * snapshot was made. */ static int qemud_load_services( QEMUFile* f, QemudService* current_services ) { int i, ret; int service_count = qemu_get_be32(f); for (i = 0; i < service_count; i++) { if ((ret = qemud_service_load(f, current_services))) return ret; } return 0; } /* Removes all active non-control clients, then creates new ones with state * taken from the snapshot. * * We do not send "disconnect" commands, over the channel. If we did, we might * stop clients in the restored guest, resulting in an incorrect restore. * * Instead, we silently replace the clients that were running before the * restore with new clients, whose state we copy from the snapshot. Since * everything is multiplexed over one link, only the multiplexer notices the * changes, there is no communication with the guest. */ static int qemud_load_clients(QEMUFile* f, QemudMultiplexer* m, int version ) { /* Remove all clients, except on the control channel.*/ qemud_multiplexer_disconnect_noncontrol(m); /* Load clients from snapshot */ int client_count = qemu_get_be32(f); int i, ret; for (i = 0; i < client_count; i++) { if ((ret = qemud_serial_client_load(f, m->services, version))) { return ret; } } return 0; } /* Load QemuD state from file. */ static int qemud_load(QEMUFile *f, void* opaque, int version) { QemudMultiplexer *m = opaque; int ret; if ((ret = qemud_serial_load(f, m->serial))) return ret; if ((ret = qemud_load_services(f, m->services))) return ret; if ((ret = qemud_load_clients(f, m, version))) return ret; return 0; } /*------------------------------------------------------------------------------ * * QEMUD PIPE service callbacks * * ----------------------------------------------------------------------------*/ /* Saves pending pipe message to the snapshot file. */ static void _save_pipe_message(QEMUFile* f, QemudPipeMessage* msg) { qemu_put_be32(f, msg->size); qemu_put_be32(f, msg->offset); qemu_put_buffer(f, msg->message, msg->size); } /* Loads pending pipe messages from the snapshot file. * Return: * List of pending pipe messages loaded from snapshot, or NULL if snapshot didn't * contain saved messages. */ static QemudPipeMessage* _load_pipe_message(QEMUFile* f) { QemudPipeMessage* ret = NULL; QemudPipeMessage** next = &ret; uint32_t size = qemu_get_be32(f); while (size != 0) { QemudPipeMessage* wrk; ANEW0(wrk); *next = wrk; wrk->size = size; wrk->offset = qemu_get_be32(f); wrk->message = malloc(wrk->size); if (wrk->message == NULL) { APANIC("Unable to allocate buffer for pipe's pending message."); } qemu_get_buffer(f, wrk->message, wrk->size); next = &wrk->next; *next = NULL; size = qemu_get_be32(f); } return ret; } /* This is a callback that gets invoked when guest is connecting to the service. * * Here we will create a new client as well as pipe descriptor representing new * connection. */ static void* _qemudPipe_init(void* hwpipe, void* _looper, const char* args) { QemudMultiplexer *m = _multiplexer; QemudService* sv = m->services; QemudClient* client; QemudPipe* pipe = NULL; char service_name[512]; const char* client_args; size_t srv_name_len; /* 'args' passed in this callback represents name of the service the guest is * connecting to. It can't be NULL. */ if (args == NULL) { D("%s: Missing address!", __FUNCTION__); return NULL; } /* 'args' contain service name, and optional parameters for the client that * is about to be created in this call. The parameters are separated from the * service name wit ':'. Separate service name from the client param. */ client_args = strchr(args, ':'); if (client_args != NULL) { srv_name_len = min(client_args - args, sizeof(service_name) - 1); client_args++; // Past the ':' if (*client_args == '\0') { /* No actual parameters. */ client_args = NULL; } } else { srv_name_len = min(strlen(args), sizeof(service_name) - 1); } memcpy(service_name, args, srv_name_len); service_name[srv_name_len] = '\0'; /* Lookup registered service by its name. */ while (sv != NULL && strcmp(sv->name, service_name)) { sv = sv->next; } if (sv == NULL) { D("%s: Service '%s' has not been registered!", __FUNCTION__, service_name); return NULL; } /* Create a client for this connection. -1 as a channel ID signals that this * is a pipe client. */ client = qemud_service_connect_client(sv, -1, client_args); if (client != NULL) { ANEW0(pipe); pipe->hwpipe = hwpipe; pipe->looper = _looper; pipe->service = sv; pipe->client = client; client->ProtocolSelector.Pipe.qemud_pipe = pipe; } return pipe; } /* Called when the guest wants to close the channel. */ static void _qemudPipe_closeFromGuest( void* opaque ) { QemudPipe* pipe = opaque; QemudClient* client = pipe->client; D("%s", __FUNCTION__); if (client != NULL) { qemud_client_disconnect(client, 1); } else { D("%s: Unexpected NULL client", __FUNCTION__); } } /* Called when the guest has sent some data to the client. */ static int _qemudPipe_sendBuffers(void* opaque, const GoldfishPipeBuffer* buffers, int numBuffers) { QemudPipe* pipe = opaque; QemudClient* client = pipe->client; size_t transferred = 0; if (client == NULL) { D("%s: Unexpected NULL client", __FUNCTION__); return -1; } if (numBuffers == 1) { /* Simple case: all data are in one buffer. */ D("%s: %s", __FUNCTION__, quote_bytes((char*)buffers->data, buffers->size)); qemud_client_recv(client, buffers->data, buffers->size); transferred = buffers->size; } else { /* If there are multiple buffers involved, collect all data in one buffer * before calling the high level client. */ uint8_t* msg, *wrk; int n; for (n = 0; n < numBuffers; n++) { transferred += buffers[n].size; } msg = malloc(transferred); wrk = msg; for (n = 0; n < numBuffers; n++) { memcpy(wrk, buffers[n].data, buffers[n].size); wrk += buffers[n].size; } D("%s: %s", __FUNCTION__, quote_bytes((char*)msg, transferred)); qemud_client_recv(client, msg, transferred); free(msg); } return transferred; } /* Called when the guest is reading data from the client. */ static int _qemudPipe_recvBuffers(void* opaque, GoldfishPipeBuffer* buffers, int numBuffers) { QemudPipe* pipe = opaque; QemudClient* client = pipe->client; QemudPipeMessage** msg_list; GoldfishPipeBuffer* buff = buffers; GoldfishPipeBuffer* endbuff = buffers + numBuffers; size_t sent_bytes = 0; size_t off_in_buff = 0; if (client == NULL) { D("%s: Unexpected NULL client", __FUNCTION__); return -1; } msg_list = &client->ProtocolSelector.Pipe.messages; if (*msg_list == NULL) { /* No data to send. Let it block until we wake it up with * PIPE_WAKE_READ when service sends data to the client. */ return PIPE_ERROR_AGAIN; } /* Fill in goldfish buffers while they are still available, and there are * messages in the client's message list. */ while (buff != endbuff && *msg_list != NULL) { QemudPipeMessage* msg = *msg_list; /* Message data fiting the current pipe's buffer. */ size_t to_copy = min(msg->size - msg->offset, buff->size - off_in_buff); memcpy(buff->data + off_in_buff, msg->message + msg->offset, to_copy); /* Update offsets. */ off_in_buff += to_copy; msg->offset += to_copy; sent_bytes += to_copy; if (msg->size == msg->offset) { /* We're done with the current message. Go to the next one. */ *msg_list = msg->next; free(msg); } if (off_in_buff == buff->size) { /* Current pipe buffer is full. Continue with the next one. */ buff++; off_in_buff = 0; } } D("%s: -> %u (of %u)", __FUNCTION__, sent_bytes, buffers->size); return sent_bytes; } static unsigned _qemudPipe_poll(void* opaque) { QemudPipe* pipe = opaque; QemudClient* client = pipe->client; unsigned ret = 0; if (client != NULL) { ret |= PIPE_POLL_OUT; if (client->ProtocolSelector.Pipe.messages != NULL) { ret |= PIPE_POLL_IN; } } else { D("%s: Unexpected NULL client", __FUNCTION__); } return ret; } static void _qemudPipe_wakeOn(void* opaque, int flags) { D("%s: -> %X", __FUNCTION__, flags); } static void _qemudPipe_save(void* opaque, QEMUFile* f ) { QemudPipe* qemud_pipe = (QemudPipe*)opaque; QemudClient* c = qemud_pipe->client; QemudPipeMessage* msg = c->ProtocolSelector.Pipe.messages; /* save generic information */ qemud_service_save_name(f, c->service); qemu_put_string(f, c->param); /* Save pending messages. */ while (msg != NULL) { _save_pipe_message(f, msg); msg = msg->next; } /* End of pending messages. */ qemu_put_be32(f, 0); /* save client-specific state */ if (c->clie_save) c->clie_save(f, c, c->clie_opaque); /* save framing configuration */ qemu_put_be32(f, c->framing); if (c->framing) { qemu_put_be32(f, c->need_header); /* header sink always connected to c->header0, no need to save */ qemu_put_be32(f, FRAME_HEADER_SIZE); qemu_put_buffer(f, c->header0, FRAME_HEADER_SIZE); /* payload sink */ qemud_sink_save(f, c->payload); qemu_put_buffer(f, c->payload->buff, c->payload->size); } } static void* _qemudPipe_load(void* hwpipe, void* pipeOpaque, const char* args, QEMUFile* f) { QemudPipe* qemud_pipe = NULL; char* param; char *service_name = qemud_service_load_name(f); if (service_name == NULL) return NULL; /* get service instance for the loading client*/ QemudService *sv = qemud_service_find(_multiplexer->services, service_name); if (sv == NULL) { D("%s: load failed: unknown service \"%s\"\n", __FUNCTION__, service_name); return NULL; } /* Load saved parameters. */ param = qemu_get_string(f); /* re-connect client */ QemudClient* c = qemud_service_connect_client(sv, -1, param); if(c == NULL) return NULL; /* Load pending messages. */ c->ProtocolSelector.Pipe.messages = _load_pipe_message(f); /* load client-specific state */ if (c->clie_load && c->clie_load(f, c, c->clie_opaque)) { /* load failure */ return NULL; } /* load framing configuration */ c->framing = qemu_get_be32(f); if (c->framing) { /* header buffer */ c->need_header = qemu_get_be32(f); int header_size = qemu_get_be32(f); if (header_size > FRAME_HEADER_SIZE) { D("%s: load failed: payload buffer requires %d bytes, %d available\n", __FUNCTION__, header_size, FRAME_HEADER_SIZE); return NULL; } int ret; if ((ret = qemu_get_buffer(f, c->header0, header_size)) != header_size) { D("%s: frame header buffer load failed: expected %d bytes, got %d\n", __FUNCTION__, header_size, ret); return NULL; } /* payload sink */ if ((ret = qemud_sink_load(f, c->payload))) return NULL; /* replace payload buffer by saved data */ if (c->payload->buff) { AFREE(c->payload->buff); } AARRAY_NEW(c->payload->buff, c->payload->size+1); /* +1 for terminating zero */ if ((ret = qemu_get_buffer(f, c->payload->buff, c->payload->size)) != c->payload->size) { D("%s: frame payload buffer load failed: expected %d bytes, got %d\n", __FUNCTION__, c->payload->size, ret); AFREE(c->payload->buff); return NULL; } } /* Associate the client with the pipe. */ ANEW0(qemud_pipe); qemud_pipe->hwpipe = hwpipe; qemud_pipe->looper = pipeOpaque; qemud_pipe->service = sv; qemud_pipe->client = c; c->ProtocolSelector.Pipe.qemud_pipe = qemud_pipe; return qemud_pipe; } /* QEMUD pipe functions. */ static const GoldfishPipeFuncs _qemudPipe_funcs = { _qemudPipe_init, _qemudPipe_closeFromGuest, _qemudPipe_sendBuffers, _qemudPipe_recvBuffers, _qemudPipe_poll, _qemudPipe_wakeOn, _qemudPipe_save, _qemudPipe_load, }; /* Initializes QEMUD pipe interface. */ static void _android_qemud_pipe_init(void) { static ABool _qemud_pipe_initialized = false; if (!_qemud_pipe_initialized) { goldfish_pipe_add_type( "qemud", looper_newCore(), &_qemudPipe_funcs ); _qemud_pipe_initialized = true; } } /* this is the end of the serial charpipe that must be passed * to the emulated tty implementation. The other end of the * charpipe must be passed to qemud_multiplexer_init(). */ static CharDriverState* android_qemud_cs; /* Initializes QEMUD serial interface. */ static void _android_qemud_serial_init(void) { CharDriverState* cs; if (android_qemud_cs != NULL) return; if (qemu_chr_open_charpipe( &android_qemud_cs, &cs ) < 0) { derror( "%s: can't create charpipe to serial port", __FUNCTION__ ); exit(1); } qemud_multiplexer_init(_multiplexer, cs); register_savevm( "qemud", 0, QEMUD_SAVE_VERSION, qemud_save, qemud_load, _multiplexer); } extern void android_qemud_init( void ) { D("%s", __FUNCTION__); /* We don't know in advance whether the guest system supports qemud pipes, * so we will initialize both qemud machineries, the legacy (over serial * port), and the new one (over qemu pipe). Then we let the guest to connect * via one, or the other. */ _android_qemud_serial_init(); _android_qemud_pipe_init(); } /* return the serial charpipe endpoint that must be used * by the emulated tty implementation. */ CharDriverState* android_qemud_get_cs( void ) { if (android_qemud_cs == NULL) android_qemud_init(); return android_qemud_cs; } /* this function is used to register a new named qemud-based * service. You must provide 'serv_opaque' and 'serv_connect' * which will be called whenever a new client tries to connect * to the services. * * 'serv_connect' shall return NULL if the connection is refused, * or a handle to a new QemudClient otherwise. The latter can be * created through qemud_client_new() defined above. * * 'max_clients' is the maximum number of clients accepted by * the service concurrently. If this value is 0, then any number * of clients can connect. */ QemudService* qemud_service_register( const char* service_name, int max_clients, void* serv_opaque, QemudServiceConnect serv_connect, QemudServiceSave serv_save, QemudServiceLoad serv_load ) { QemudService* sv; QemudMultiplexer* m = _multiplexer; android_qemud_init(); sv = qemud_service_new(service_name, max_clients, serv_opaque, serv_connect, serv_save, serv_load, &m->services); D("Registered QEMUD service %s", service_name); return sv; } /* broadcast a given message to all clients of a given QemudService */ extern void qemud_service_broadcast( QemudService* sv, const uint8_t* msg, int msglen ) { QemudClient* c; for (c = sv->clients; c; c = c->next_serv) qemud_client_send(c, msg, msglen); } /* * The following code is used for backwards compatibility reasons. * It allows you to implement a given qemud-based service through * a charpipe. * * In other words, this implements a QemudService and corresponding * QemudClient that connects a qemud client running in the emulated * system, to a CharDriverState object implemented through a charpipe. * * QemudCharClient <===charpipe====> (char driver user) * * For example, this is used to implement the "gsm" service when the * modem emulation is provided through an external serial device. * * A QemudCharService can have only one client by definition. * There is no QemudCharClient object because we can store a single * CharDriverState handle in the 'opaque' field for simplicity. */ typedef struct { QemudService* service; CharDriverState* cs; } QemudCharService; /* called whenever a new message arrives from a qemud client. * this simply sends the message through the charpipe to the user. */ static void _qemud_char_client_recv( void* opaque, uint8_t* msg, int msglen, QemudClient* client ) { CharDriverState* cs = opaque; qemu_chr_write(cs, msg, msglen); } /* we don't expect clients of char. services to exit. Just * print an error to signal an unexpected situation. We should * be able to recover from these though, so don't panic. */ static void _qemud_char_client_close( void* opaque ) { QemudClient* client = opaque; /* At this point modem driver still uses char pipe to communicate with * hw-qemud, while communication with the guest is done over qemu pipe. * So, when guest disconnects from the qemu pipe, and emulator-side client * goes through the disconnection process, this routine is called, since it * has been set to called during service registration. Unless modem driver * is changed to drop char pipe communication, this routine will be called * due to guest disconnection. As long as the client was a qemu pipe - based * client, it's fine, since we don't really need to do anything in this case. */ if (!_is_pipe_client(client)) { derror("unexpected qemud char. channel close"); } } /* called by the charpipe to know how much data can be read from * the user. Since we send everything directly to the serial port * we can return an arbitrary number. */ static int _qemud_char_service_can_read( void* opaque ) { return 8192; /* whatever */ } /* called to read data from the charpipe and send it to the client. * used qemud_service_broadcast() even if there is a single client * because we don't need a QemudCharClient object this way. */ static void _qemud_char_service_read( void* opaque, const uint8_t* from, int len ) { QemudService* sv = opaque; qemud_service_broadcast( sv, from, len ); } /* called when a qemud client tries to connect to a char. service. * we simply create a new client and open the charpipe to receive * data from it. */ static QemudClient* _qemud_char_service_connect(void* opaque, QemudService* sv, int channel, const char* client_param ) { CharDriverState* cs = opaque; QemudClient* c = qemud_client_new( sv, channel, client_param, cs, _qemud_char_client_recv, _qemud_char_client_close, NULL, NULL ); /* now we can open the gates :-) */ qemu_chr_add_handlers( cs, _qemud_char_service_can_read, _qemud_char_service_read, NULL, sv ); return c; } /* returns a charpipe endpoint that can be used by an emulated * device or external serial port to implement a char. service */ int android_qemud_get_channel( const char* name, CharDriverState* *pcs ) { CharDriverState* cs; if (qemu_chr_open_charpipe(&cs, pcs) < 0) { derror("can't open charpipe for '%s' qemud service", name); exit(2); } qemud_service_register(name, 1, cs, _qemud_char_service_connect, NULL, NULL); return 0; } /* set the character driver state for a given qemud communication channel. this * is used to attach the channel to an external char driver device directly. * returns 0 on success, -1 on error */ int android_qemud_set_channel( const char* name, CharDriverState* peer_cs ) { CharDriverState* char_buffer = qemu_chr_open_buffer(peer_cs); if (char_buffer == NULL) return -1; qemud_service_register(name, 1, char_buffer, _qemud_char_service_connect, NULL, NULL); return 0; }