1 /* SPDX-License-Identifier: (GPL-2.0 OR CDDL-1.0) */ 2 /* 3 * vboxguest core guest-device handling code, VBoxGuest.cpp in upstream svn. 4 * 5 * Copyright (C) 2007-2016 Oracle Corporation 6 */ 7 8 #include <linux/device.h> 9 #include <linux/mm.h> 10 #include <linux/sched.h> 11 #include <linux/sizes.h> 12 #include <linux/slab.h> 13 #include <linux/vbox_err.h> 14 #include <linux/vbox_utils.h> 15 #include <linux/vmalloc.h> 16 #include "vboxguest_core.h" 17 #include "vboxguest_version.h" 18 19 /* Get the pointer to the first HGCM parameter. */ 20 #define VBG_IOCTL_HGCM_CALL_PARMS(a) \ 21 ((struct vmmdev_hgcm_function_parameter *)( \ 22 (u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call))) 23 /* Get the pointer to the first HGCM parameter in a 32-bit request. */ 24 #define VBG_IOCTL_HGCM_CALL_PARMS32(a) \ 25 ((struct vmmdev_hgcm_function_parameter32 *)( \ 26 (u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call))) 27 28 #define GUEST_MAPPINGS_TRIES 5 29 30 /** 31 * Reserves memory in which the VMM can relocate any guest mappings 32 * that are floating around. 33 * 34 * This operation is a little bit tricky since the VMM might not accept 35 * just any address because of address clashes between the three contexts 36 * it operates in, so we try several times. 37 * 38 * Failure to reserve the guest mappings is ignored. 39 * 40 * @gdev: The Guest extension device. 41 */ 42 static void vbg_guest_mappings_init(struct vbg_dev *gdev) 43 { 44 struct vmmdev_hypervisorinfo *req; 45 void *guest_mappings[GUEST_MAPPINGS_TRIES]; 46 struct page **pages = NULL; 47 u32 size, hypervisor_size; 48 int i, rc; 49 50 /* Query the required space. */ 51 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HYPERVISOR_INFO); 52 if (!req) 53 return; 54 55 req->hypervisor_start = 0; 56 req->hypervisor_size = 0; 57 rc = vbg_req_perform(gdev, req); 58 if (rc < 0) 59 goto out; 60 61 /* 62 * The VMM will report back if there is nothing it wants to map, like 63 * for instance in VT-x and AMD-V mode. 64 */ 65 if (req->hypervisor_size == 0) 66 goto out; 67 68 hypervisor_size = req->hypervisor_size; 69 /* Add 4M so that we can align the vmap to 4MiB as the host requires. */ 70 size = PAGE_ALIGN(req->hypervisor_size) + SZ_4M; 71 72 pages = kmalloc_array(size >> PAGE_SHIFT, sizeof(*pages), GFP_KERNEL); 73 if (!pages) 74 goto out; 75 76 gdev->guest_mappings_dummy_page = alloc_page(GFP_HIGHUSER); 77 if (!gdev->guest_mappings_dummy_page) 78 goto out; 79 80 for (i = 0; i < (size >> PAGE_SHIFT); i++) 81 pages[i] = gdev->guest_mappings_dummy_page; 82 83 /* 84 * Try several times, the VMM might not accept some addresses because 85 * of address clashes between the three contexts. 86 */ 87 for (i = 0; i < GUEST_MAPPINGS_TRIES; i++) { 88 guest_mappings[i] = vmap(pages, (size >> PAGE_SHIFT), 89 VM_MAP, PAGE_KERNEL_RO); 90 if (!guest_mappings[i]) 91 break; 92 93 req->header.request_type = VMMDEVREQ_SET_HYPERVISOR_INFO; 94 req->header.rc = VERR_INTERNAL_ERROR; 95 req->hypervisor_size = hypervisor_size; 96 req->hypervisor_start = 97 (unsigned long)PTR_ALIGN(guest_mappings[i], SZ_4M); 98 99 rc = vbg_req_perform(gdev, req); 100 if (rc >= 0) { 101 gdev->guest_mappings = guest_mappings[i]; 102 break; 103 } 104 } 105 106 /* Free vmap's from failed attempts. */ 107 while (--i >= 0) 108 vunmap(guest_mappings[i]); 109 110 /* On failure free the dummy-page backing the vmap */ 111 if (!gdev->guest_mappings) { 112 __free_page(gdev->guest_mappings_dummy_page); 113 gdev->guest_mappings_dummy_page = NULL; 114 } 115 116 out: 117 vbg_req_free(req, sizeof(*req)); 118 kfree(pages); 119 } 120 121 /** 122 * Undo what vbg_guest_mappings_init did. 123 * 124 * @gdev: The Guest extension device. 125 */ 126 static void vbg_guest_mappings_exit(struct vbg_dev *gdev) 127 { 128 struct vmmdev_hypervisorinfo *req; 129 int rc; 130 131 if (!gdev->guest_mappings) 132 return; 133 134 /* 135 * Tell the host that we're going to free the memory we reserved for 136 * it, the free it up. (Leak the memory if anything goes wrong here.) 137 */ 138 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_HYPERVISOR_INFO); 139 if (!req) 140 return; 141 142 req->hypervisor_start = 0; 143 req->hypervisor_size = 0; 144 145 rc = vbg_req_perform(gdev, req); 146 147 vbg_req_free(req, sizeof(*req)); 148 149 if (rc < 0) { 150 vbg_err("%s error: %d\n", __func__, rc); 151 return; 152 } 153 154 vunmap(gdev->guest_mappings); 155 gdev->guest_mappings = NULL; 156 157 __free_page(gdev->guest_mappings_dummy_page); 158 gdev->guest_mappings_dummy_page = NULL; 159 } 160 161 /** 162 * Report the guest information to the host. 163 * Return: 0 or negative errno value. 164 * @gdev: The Guest extension device. 165 */ 166 static int vbg_report_guest_info(struct vbg_dev *gdev) 167 { 168 /* 169 * Allocate and fill in the two guest info reports. 170 */ 171 struct vmmdev_guest_info *req1 = NULL; 172 struct vmmdev_guest_info2 *req2 = NULL; 173 int rc, ret = -ENOMEM; 174 175 req1 = vbg_req_alloc(sizeof(*req1), VMMDEVREQ_REPORT_GUEST_INFO); 176 req2 = vbg_req_alloc(sizeof(*req2), VMMDEVREQ_REPORT_GUEST_INFO2); 177 if (!req1 || !req2) 178 goto out_free; 179 180 req1->interface_version = VMMDEV_VERSION; 181 req1->os_type = VMMDEV_OSTYPE_LINUX26; 182 #if __BITS_PER_LONG == 64 183 req1->os_type |= VMMDEV_OSTYPE_X64; 184 #endif 185 186 req2->additions_major = VBG_VERSION_MAJOR; 187 req2->additions_minor = VBG_VERSION_MINOR; 188 req2->additions_build = VBG_VERSION_BUILD; 189 req2->additions_revision = VBG_SVN_REV; 190 /* (no features defined yet) */ 191 req2->additions_features = 0; 192 strlcpy(req2->name, VBG_VERSION_STRING, 193 sizeof(req2->name)); 194 195 /* 196 * There are two protocols here: 197 * 1. INFO2 + INFO1. Supported by >=3.2.51. 198 * 2. INFO1 and optionally INFO2. The old protocol. 199 * 200 * We try protocol 2 first. It will fail with VERR_NOT_SUPPORTED 201 * if not supported by the VMMDev (message ordering requirement). 202 */ 203 rc = vbg_req_perform(gdev, req2); 204 if (rc >= 0) { 205 rc = vbg_req_perform(gdev, req1); 206 } else if (rc == VERR_NOT_SUPPORTED || rc == VERR_NOT_IMPLEMENTED) { 207 rc = vbg_req_perform(gdev, req1); 208 if (rc >= 0) { 209 rc = vbg_req_perform(gdev, req2); 210 if (rc == VERR_NOT_IMPLEMENTED) 211 rc = VINF_SUCCESS; 212 } 213 } 214 ret = vbg_status_code_to_errno(rc); 215 216 out_free: 217 vbg_req_free(req2, sizeof(*req2)); 218 vbg_req_free(req1, sizeof(*req1)); 219 return ret; 220 } 221 222 /** 223 * Report the guest driver status to the host. 224 * Return: 0 or negative errno value. 225 * @gdev: The Guest extension device. 226 * @active: Flag whether the driver is now active or not. 227 */ 228 static int vbg_report_driver_status(struct vbg_dev *gdev, bool active) 229 { 230 struct vmmdev_guest_status *req; 231 int rc; 232 233 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_REPORT_GUEST_STATUS); 234 if (!req) 235 return -ENOMEM; 236 237 req->facility = VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER; 238 if (active) 239 req->status = VBOXGUEST_FACILITY_STATUS_ACTIVE; 240 else 241 req->status = VBOXGUEST_FACILITY_STATUS_INACTIVE; 242 req->flags = 0; 243 244 rc = vbg_req_perform(gdev, req); 245 if (rc == VERR_NOT_IMPLEMENTED) /* Compatibility with older hosts. */ 246 rc = VINF_SUCCESS; 247 248 vbg_req_free(req, sizeof(*req)); 249 250 return vbg_status_code_to_errno(rc); 251 } 252 253 /** 254 * Inflate the balloon by one chunk. The caller owns the balloon mutex. 255 * Return: 0 or negative errno value. 256 * @gdev: The Guest extension device. 257 * @chunk_idx: Index of the chunk. 258 */ 259 static int vbg_balloon_inflate(struct vbg_dev *gdev, u32 chunk_idx) 260 { 261 struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req; 262 struct page **pages; 263 int i, rc, ret; 264 265 pages = kmalloc_array(VMMDEV_MEMORY_BALLOON_CHUNK_PAGES, 266 sizeof(*pages), 267 GFP_KERNEL | __GFP_NOWARN); 268 if (!pages) 269 return -ENOMEM; 270 271 req->header.size = sizeof(*req); 272 req->inflate = true; 273 req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; 274 275 for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++) { 276 pages[i] = alloc_page(GFP_KERNEL | __GFP_NOWARN); 277 if (!pages[i]) { 278 ret = -ENOMEM; 279 goto out_error; 280 } 281 282 req->phys_page[i] = page_to_phys(pages[i]); 283 } 284 285 rc = vbg_req_perform(gdev, req); 286 if (rc < 0) { 287 vbg_err("%s error, rc: %d\n", __func__, rc); 288 ret = vbg_status_code_to_errno(rc); 289 goto out_error; 290 } 291 292 gdev->mem_balloon.pages[chunk_idx] = pages; 293 294 return 0; 295 296 out_error: 297 while (--i >= 0) 298 __free_page(pages[i]); 299 kfree(pages); 300 301 return ret; 302 } 303 304 /** 305 * Deflate the balloon by one chunk. The caller owns the balloon mutex. 306 * Return: 0 or negative errno value. 307 * @gdev: The Guest extension device. 308 * @chunk_idx: Index of the chunk. 309 */ 310 static int vbg_balloon_deflate(struct vbg_dev *gdev, u32 chunk_idx) 311 { 312 struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req; 313 struct page **pages = gdev->mem_balloon.pages[chunk_idx]; 314 int i, rc; 315 316 req->header.size = sizeof(*req); 317 req->inflate = false; 318 req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; 319 320 for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++) 321 req->phys_page[i] = page_to_phys(pages[i]); 322 323 rc = vbg_req_perform(gdev, req); 324 if (rc < 0) { 325 vbg_err("%s error, rc: %d\n", __func__, rc); 326 return vbg_status_code_to_errno(rc); 327 } 328 329 for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++) 330 __free_page(pages[i]); 331 kfree(pages); 332 gdev->mem_balloon.pages[chunk_idx] = NULL; 333 334 return 0; 335 } 336 337 /** 338 * Respond to VMMDEV_EVENT_BALLOON_CHANGE_REQUEST events, query the size 339 * the host wants the balloon to be and adjust accordingly. 340 */ 341 static void vbg_balloon_work(struct work_struct *work) 342 { 343 struct vbg_dev *gdev = 344 container_of(work, struct vbg_dev, mem_balloon.work); 345 struct vmmdev_memballoon_info *req = gdev->mem_balloon.get_req; 346 u32 i, chunks; 347 int rc, ret; 348 349 /* 350 * Setting this bit means that we request the value from the host and 351 * change the guest memory balloon according to the returned value. 352 */ 353 req->event_ack = VMMDEV_EVENT_BALLOON_CHANGE_REQUEST; 354 rc = vbg_req_perform(gdev, req); 355 if (rc < 0) { 356 vbg_err("%s error, rc: %d)\n", __func__, rc); 357 return; 358 } 359 360 /* 361 * The host always returns the same maximum amount of chunks, so 362 * we do this once. 363 */ 364 if (!gdev->mem_balloon.max_chunks) { 365 gdev->mem_balloon.pages = 366 devm_kcalloc(gdev->dev, req->phys_mem_chunks, 367 sizeof(struct page **), GFP_KERNEL); 368 if (!gdev->mem_balloon.pages) 369 return; 370 371 gdev->mem_balloon.max_chunks = req->phys_mem_chunks; 372 } 373 374 chunks = req->balloon_chunks; 375 if (chunks > gdev->mem_balloon.max_chunks) { 376 vbg_err("%s: illegal balloon size %u (max=%u)\n", 377 __func__, chunks, gdev->mem_balloon.max_chunks); 378 return; 379 } 380 381 if (chunks > gdev->mem_balloon.chunks) { 382 /* inflate */ 383 for (i = gdev->mem_balloon.chunks; i < chunks; i++) { 384 ret = vbg_balloon_inflate(gdev, i); 385 if (ret < 0) 386 return; 387 388 gdev->mem_balloon.chunks++; 389 } 390 } else { 391 /* deflate */ 392 for (i = gdev->mem_balloon.chunks; i-- > chunks;) { 393 ret = vbg_balloon_deflate(gdev, i); 394 if (ret < 0) 395 return; 396 397 gdev->mem_balloon.chunks--; 398 } 399 } 400 } 401 402 /** 403 * Callback for heartbeat timer. 404 */ 405 static void vbg_heartbeat_timer(struct timer_list *t) 406 { 407 struct vbg_dev *gdev = from_timer(gdev, t, heartbeat_timer); 408 409 vbg_req_perform(gdev, gdev->guest_heartbeat_req); 410 mod_timer(&gdev->heartbeat_timer, 411 msecs_to_jiffies(gdev->heartbeat_interval_ms)); 412 } 413 414 /** 415 * Configure the host to check guest's heartbeat 416 * and get heartbeat interval from the host. 417 * Return: 0 or negative errno value. 418 * @gdev: The Guest extension device. 419 * @enabled: Set true to enable guest heartbeat checks on host. 420 */ 421 static int vbg_heartbeat_host_config(struct vbg_dev *gdev, bool enabled) 422 { 423 struct vmmdev_heartbeat *req; 424 int rc; 425 426 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_HEARTBEAT_CONFIGURE); 427 if (!req) 428 return -ENOMEM; 429 430 req->enabled = enabled; 431 req->interval_ns = 0; 432 rc = vbg_req_perform(gdev, req); 433 do_div(req->interval_ns, 1000000); /* ns -> ms */ 434 gdev->heartbeat_interval_ms = req->interval_ns; 435 vbg_req_free(req, sizeof(*req)); 436 437 return vbg_status_code_to_errno(rc); 438 } 439 440 /** 441 * Initializes the heartbeat timer. This feature may be disabled by the host. 442 * Return: 0 or negative errno value. 443 * @gdev: The Guest extension device. 444 */ 445 static int vbg_heartbeat_init(struct vbg_dev *gdev) 446 { 447 int ret; 448 449 /* Make sure that heartbeat checking is disabled if we fail. */ 450 ret = vbg_heartbeat_host_config(gdev, false); 451 if (ret < 0) 452 return ret; 453 454 ret = vbg_heartbeat_host_config(gdev, true); 455 if (ret < 0) 456 return ret; 457 458 gdev->guest_heartbeat_req = vbg_req_alloc( 459 sizeof(*gdev->guest_heartbeat_req), 460 VMMDEVREQ_GUEST_HEARTBEAT); 461 if (!gdev->guest_heartbeat_req) 462 return -ENOMEM; 463 464 vbg_info("%s: Setting up heartbeat to trigger every %d milliseconds\n", 465 __func__, gdev->heartbeat_interval_ms); 466 mod_timer(&gdev->heartbeat_timer, 0); 467 468 return 0; 469 } 470 471 /** 472 * Cleanup hearbeat code, stop HB timer and disable host heartbeat checking. 473 * @gdev: The Guest extension device. 474 */ 475 static void vbg_heartbeat_exit(struct vbg_dev *gdev) 476 { 477 del_timer_sync(&gdev->heartbeat_timer); 478 vbg_heartbeat_host_config(gdev, false); 479 vbg_req_free(gdev->guest_heartbeat_req, 480 sizeof(*gdev->guest_heartbeat_req)); 481 } 482 483 /** 484 * Applies a change to the bit usage tracker. 485 * Return: true if the mask changed, false if not. 486 * @tracker: The bit usage tracker. 487 * @changed: The bits to change. 488 * @previous: The previous value of the bits. 489 */ 490 static bool vbg_track_bit_usage(struct vbg_bit_usage_tracker *tracker, 491 u32 changed, u32 previous) 492 { 493 bool global_change = false; 494 495 while (changed) { 496 u32 bit = ffs(changed) - 1; 497 u32 bitmask = BIT(bit); 498 499 if (bitmask & previous) { 500 tracker->per_bit_usage[bit] -= 1; 501 if (tracker->per_bit_usage[bit] == 0) { 502 global_change = true; 503 tracker->mask &= ~bitmask; 504 } 505 } else { 506 tracker->per_bit_usage[bit] += 1; 507 if (tracker->per_bit_usage[bit] == 1) { 508 global_change = true; 509 tracker->mask |= bitmask; 510 } 511 } 512 513 changed &= ~bitmask; 514 } 515 516 return global_change; 517 } 518 519 /** 520 * Init and termination worker for resetting the (host) event filter on the host 521 * Return: 0 or negative errno value. 522 * @gdev: The Guest extension device. 523 * @fixed_events: Fixed events (init time). 524 */ 525 static int vbg_reset_host_event_filter(struct vbg_dev *gdev, 526 u32 fixed_events) 527 { 528 struct vmmdev_mask *req; 529 int rc; 530 531 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK); 532 if (!req) 533 return -ENOMEM; 534 535 req->not_mask = U32_MAX & ~fixed_events; 536 req->or_mask = fixed_events; 537 rc = vbg_req_perform(gdev, req); 538 if (rc < 0) 539 vbg_err("%s error, rc: %d\n", __func__, rc); 540 541 vbg_req_free(req, sizeof(*req)); 542 return vbg_status_code_to_errno(rc); 543 } 544 545 /** 546 * Changes the event filter mask for the given session. 547 * 548 * This is called in response to VBG_IOCTL_CHANGE_FILTER_MASK as well as to 549 * do session cleanup. Takes the session spinlock. 550 * 551 * Return: 0 or negative errno value. 552 * @gdev: The Guest extension device. 553 * @session: The session. 554 * @or_mask: The events to add. 555 * @not_mask: The events to remove. 556 * @session_termination: Set if we're called by the session cleanup code. 557 * This tweaks the error handling so we perform 558 * proper session cleanup even if the host 559 * misbehaves. 560 */ 561 static int vbg_set_session_event_filter(struct vbg_dev *gdev, 562 struct vbg_session *session, 563 u32 or_mask, u32 not_mask, 564 bool session_termination) 565 { 566 struct vmmdev_mask *req; 567 u32 changed, previous; 568 int rc, ret = 0; 569 570 /* Allocate a request buffer before taking the spinlock */ 571 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK); 572 if (!req) { 573 if (!session_termination) 574 return -ENOMEM; 575 /* Ignore allocation failure, we must do session cleanup. */ 576 } 577 578 mutex_lock(&gdev->session_mutex); 579 580 /* Apply the changes to the session mask. */ 581 previous = session->event_filter; 582 session->event_filter |= or_mask; 583 session->event_filter &= ~not_mask; 584 585 /* If anything actually changed, update the global usage counters. */ 586 changed = previous ^ session->event_filter; 587 if (!changed) 588 goto out; 589 590 vbg_track_bit_usage(&gdev->event_filter_tracker, changed, previous); 591 or_mask = gdev->fixed_events | gdev->event_filter_tracker.mask; 592 593 if (gdev->event_filter_host == or_mask || !req) 594 goto out; 595 596 gdev->event_filter_host = or_mask; 597 req->or_mask = or_mask; 598 req->not_mask = ~or_mask; 599 rc = vbg_req_perform(gdev, req); 600 if (rc < 0) { 601 ret = vbg_status_code_to_errno(rc); 602 603 /* Failed, roll back (unless it's session termination time). */ 604 gdev->event_filter_host = U32_MAX; 605 if (session_termination) 606 goto out; 607 608 vbg_track_bit_usage(&gdev->event_filter_tracker, changed, 609 session->event_filter); 610 session->event_filter = previous; 611 } 612 613 out: 614 mutex_unlock(&gdev->session_mutex); 615 vbg_req_free(req, sizeof(*req)); 616 617 return ret; 618 } 619 620 /** 621 * Init and termination worker for set guest capabilities to zero on the host. 622 * Return: 0 or negative errno value. 623 * @gdev: The Guest extension device. 624 */ 625 static int vbg_reset_host_capabilities(struct vbg_dev *gdev) 626 { 627 struct vmmdev_mask *req; 628 int rc; 629 630 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES); 631 if (!req) 632 return -ENOMEM; 633 634 req->not_mask = U32_MAX; 635 req->or_mask = 0; 636 rc = vbg_req_perform(gdev, req); 637 if (rc < 0) 638 vbg_err("%s error, rc: %d\n", __func__, rc); 639 640 vbg_req_free(req, sizeof(*req)); 641 return vbg_status_code_to_errno(rc); 642 } 643 644 /** 645 * Sets the guest capabilities for a session. Takes the session spinlock. 646 * Return: 0 or negative errno value. 647 * @gdev: The Guest extension device. 648 * @session: The session. 649 * @or_mask: The capabilities to add. 650 * @not_mask: The capabilities to remove. 651 * @session_termination: Set if we're called by the session cleanup code. 652 * This tweaks the error handling so we perform 653 * proper session cleanup even if the host 654 * misbehaves. 655 */ 656 static int vbg_set_session_capabilities(struct vbg_dev *gdev, 657 struct vbg_session *session, 658 u32 or_mask, u32 not_mask, 659 bool session_termination) 660 { 661 struct vmmdev_mask *req; 662 u32 changed, previous; 663 int rc, ret = 0; 664 665 /* Allocate a request buffer before taking the spinlock */ 666 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES); 667 if (!req) { 668 if (!session_termination) 669 return -ENOMEM; 670 /* Ignore allocation failure, we must do session cleanup. */ 671 } 672 673 mutex_lock(&gdev->session_mutex); 674 675 /* Apply the changes to the session mask. */ 676 previous = session->guest_caps; 677 session->guest_caps |= or_mask; 678 session->guest_caps &= ~not_mask; 679 680 /* If anything actually changed, update the global usage counters. */ 681 changed = previous ^ session->guest_caps; 682 if (!changed) 683 goto out; 684 685 vbg_track_bit_usage(&gdev->guest_caps_tracker, changed, previous); 686 or_mask = gdev->guest_caps_tracker.mask; 687 688 if (gdev->guest_caps_host == or_mask || !req) 689 goto out; 690 691 gdev->guest_caps_host = or_mask; 692 req->or_mask = or_mask; 693 req->not_mask = ~or_mask; 694 rc = vbg_req_perform(gdev, req); 695 if (rc < 0) { 696 ret = vbg_status_code_to_errno(rc); 697 698 /* Failed, roll back (unless it's session termination time). */ 699 gdev->guest_caps_host = U32_MAX; 700 if (session_termination) 701 goto out; 702 703 vbg_track_bit_usage(&gdev->guest_caps_tracker, changed, 704 session->guest_caps); 705 session->guest_caps = previous; 706 } 707 708 out: 709 mutex_unlock(&gdev->session_mutex); 710 vbg_req_free(req, sizeof(*req)); 711 712 return ret; 713 } 714 715 /** 716 * vbg_query_host_version get the host feature mask and version information. 717 * Return: 0 or negative errno value. 718 * @gdev: The Guest extension device. 719 */ 720 static int vbg_query_host_version(struct vbg_dev *gdev) 721 { 722 struct vmmdev_host_version *req; 723 int rc, ret; 724 725 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HOST_VERSION); 726 if (!req) 727 return -ENOMEM; 728 729 rc = vbg_req_perform(gdev, req); 730 ret = vbg_status_code_to_errno(rc); 731 if (ret) { 732 vbg_err("%s error: %d\n", __func__, rc); 733 goto out; 734 } 735 736 snprintf(gdev->host_version, sizeof(gdev->host_version), "%u.%u.%ur%u", 737 req->major, req->minor, req->build, req->revision); 738 gdev->host_features = req->features; 739 740 vbg_info("vboxguest: host-version: %s %#x\n", gdev->host_version, 741 gdev->host_features); 742 743 if (!(req->features & VMMDEV_HVF_HGCM_PHYS_PAGE_LIST)) { 744 vbg_err("vboxguest: Error host too old (does not support page-lists)\n"); 745 ret = -ENODEV; 746 } 747 748 out: 749 vbg_req_free(req, sizeof(*req)); 750 return ret; 751 } 752 753 /** 754 * Initializes the VBoxGuest device extension when the 755 * device driver is loaded. 756 * 757 * The native code locates the VMMDev on the PCI bus and retrieve 758 * the MMIO and I/O port ranges, this function will take care of 759 * mapping the MMIO memory (if present). Upon successful return 760 * the native code should set up the interrupt handler. 761 * 762 * Return: 0 or negative errno value. 763 * 764 * @gdev: The Guest extension device. 765 * @fixed_events: Events that will be enabled upon init and no client 766 * will ever be allowed to mask. 767 */ 768 int vbg_core_init(struct vbg_dev *gdev, u32 fixed_events) 769 { 770 int ret = -ENOMEM; 771 772 gdev->fixed_events = fixed_events | VMMDEV_EVENT_HGCM; 773 gdev->event_filter_host = U32_MAX; /* forces a report */ 774 gdev->guest_caps_host = U32_MAX; /* forces a report */ 775 776 init_waitqueue_head(&gdev->event_wq); 777 init_waitqueue_head(&gdev->hgcm_wq); 778 spin_lock_init(&gdev->event_spinlock); 779 mutex_init(&gdev->session_mutex); 780 mutex_init(&gdev->cancel_req_mutex); 781 timer_setup(&gdev->heartbeat_timer, vbg_heartbeat_timer, 0); 782 INIT_WORK(&gdev->mem_balloon.work, vbg_balloon_work); 783 784 gdev->mem_balloon.get_req = 785 vbg_req_alloc(sizeof(*gdev->mem_balloon.get_req), 786 VMMDEVREQ_GET_MEMBALLOON_CHANGE_REQ); 787 gdev->mem_balloon.change_req = 788 vbg_req_alloc(sizeof(*gdev->mem_balloon.change_req), 789 VMMDEVREQ_CHANGE_MEMBALLOON); 790 gdev->cancel_req = 791 vbg_req_alloc(sizeof(*(gdev->cancel_req)), 792 VMMDEVREQ_HGCM_CANCEL2); 793 gdev->ack_events_req = 794 vbg_req_alloc(sizeof(*gdev->ack_events_req), 795 VMMDEVREQ_ACKNOWLEDGE_EVENTS); 796 gdev->mouse_status_req = 797 vbg_req_alloc(sizeof(*gdev->mouse_status_req), 798 VMMDEVREQ_GET_MOUSE_STATUS); 799 800 if (!gdev->mem_balloon.get_req || !gdev->mem_balloon.change_req || 801 !gdev->cancel_req || !gdev->ack_events_req || 802 !gdev->mouse_status_req) 803 goto err_free_reqs; 804 805 ret = vbg_query_host_version(gdev); 806 if (ret) 807 goto err_free_reqs; 808 809 ret = vbg_report_guest_info(gdev); 810 if (ret) { 811 vbg_err("vboxguest: vbg_report_guest_info error: %d\n", ret); 812 goto err_free_reqs; 813 } 814 815 ret = vbg_reset_host_event_filter(gdev, gdev->fixed_events); 816 if (ret) { 817 vbg_err("vboxguest: Error setting fixed event filter: %d\n", 818 ret); 819 goto err_free_reqs; 820 } 821 822 ret = vbg_reset_host_capabilities(gdev); 823 if (ret) { 824 vbg_err("vboxguest: Error clearing guest capabilities: %d\n", 825 ret); 826 goto err_free_reqs; 827 } 828 829 ret = vbg_core_set_mouse_status(gdev, 0); 830 if (ret) { 831 vbg_err("vboxguest: Error clearing mouse status: %d\n", ret); 832 goto err_free_reqs; 833 } 834 835 /* These may fail without requiring the driver init to fail. */ 836 vbg_guest_mappings_init(gdev); 837 vbg_heartbeat_init(gdev); 838 839 /* All Done! */ 840 ret = vbg_report_driver_status(gdev, true); 841 if (ret < 0) 842 vbg_err("vboxguest: Error reporting driver status: %d\n", ret); 843 844 return 0; 845 846 err_free_reqs: 847 vbg_req_free(gdev->mouse_status_req, 848 sizeof(*gdev->mouse_status_req)); 849 vbg_req_free(gdev->ack_events_req, 850 sizeof(*gdev->ack_events_req)); 851 vbg_req_free(gdev->cancel_req, 852 sizeof(*gdev->cancel_req)); 853 vbg_req_free(gdev->mem_balloon.change_req, 854 sizeof(*gdev->mem_balloon.change_req)); 855 vbg_req_free(gdev->mem_balloon.get_req, 856 sizeof(*gdev->mem_balloon.get_req)); 857 return ret; 858 } 859 860 /** 861 * Call this on exit to clean-up vboxguest-core managed resources. 862 * 863 * The native code should call this before the driver is loaded, 864 * but don't call this on shutdown. 865 * @gdev: The Guest extension device. 866 */ 867 void vbg_core_exit(struct vbg_dev *gdev) 868 { 869 vbg_heartbeat_exit(gdev); 870 vbg_guest_mappings_exit(gdev); 871 872 /* Clear the host flags (mouse status etc). */ 873 vbg_reset_host_event_filter(gdev, 0); 874 vbg_reset_host_capabilities(gdev); 875 vbg_core_set_mouse_status(gdev, 0); 876 877 vbg_req_free(gdev->mouse_status_req, 878 sizeof(*gdev->mouse_status_req)); 879 vbg_req_free(gdev->ack_events_req, 880 sizeof(*gdev->ack_events_req)); 881 vbg_req_free(gdev->cancel_req, 882 sizeof(*gdev->cancel_req)); 883 vbg_req_free(gdev->mem_balloon.change_req, 884 sizeof(*gdev->mem_balloon.change_req)); 885 vbg_req_free(gdev->mem_balloon.get_req, 886 sizeof(*gdev->mem_balloon.get_req)); 887 } 888 889 /** 890 * Creates a VBoxGuest user session. 891 * 892 * vboxguest_linux.c calls this when userspace opens the char-device. 893 * Return: A pointer to the new session or an ERR_PTR on error. 894 * @gdev: The Guest extension device. 895 * @user: Set if this is a session for the vboxuser device. 896 */ 897 struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, bool user) 898 { 899 struct vbg_session *session; 900 901 session = kzalloc(sizeof(*session), GFP_KERNEL); 902 if (!session) 903 return ERR_PTR(-ENOMEM); 904 905 session->gdev = gdev; 906 session->user_session = user; 907 908 return session; 909 } 910 911 /** 912 * Closes a VBoxGuest session. 913 * @session: The session to close (and free). 914 */ 915 void vbg_core_close_session(struct vbg_session *session) 916 { 917 struct vbg_dev *gdev = session->gdev; 918 int i, rc; 919 920 vbg_set_session_capabilities(gdev, session, 0, U32_MAX, true); 921 vbg_set_session_event_filter(gdev, session, 0, U32_MAX, true); 922 923 for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) { 924 if (!session->hgcm_client_ids[i]) 925 continue; 926 927 vbg_hgcm_disconnect(gdev, session->hgcm_client_ids[i], &rc); 928 } 929 930 kfree(session); 931 } 932 933 static int vbg_ioctl_chk(struct vbg_ioctl_hdr *hdr, size_t in_size, 934 size_t out_size) 935 { 936 if (hdr->size_in != (sizeof(*hdr) + in_size) || 937 hdr->size_out != (sizeof(*hdr) + out_size)) 938 return -EINVAL; 939 940 return 0; 941 } 942 943 static int vbg_ioctl_driver_version_info( 944 struct vbg_ioctl_driver_version_info *info) 945 { 946 const u16 vbg_maj_version = VBG_IOC_VERSION >> 16; 947 u16 min_maj_version, req_maj_version; 948 949 if (vbg_ioctl_chk(&info->hdr, sizeof(info->u.in), sizeof(info->u.out))) 950 return -EINVAL; 951 952 req_maj_version = info->u.in.req_version >> 16; 953 min_maj_version = info->u.in.min_version >> 16; 954 955 if (info->u.in.min_version > info->u.in.req_version || 956 min_maj_version != req_maj_version) 957 return -EINVAL; 958 959 if (info->u.in.min_version <= VBG_IOC_VERSION && 960 min_maj_version == vbg_maj_version) { 961 info->u.out.session_version = VBG_IOC_VERSION; 962 } else { 963 info->u.out.session_version = U32_MAX; 964 info->hdr.rc = VERR_VERSION_MISMATCH; 965 } 966 967 info->u.out.driver_version = VBG_IOC_VERSION; 968 info->u.out.driver_revision = 0; 969 info->u.out.reserved1 = 0; 970 info->u.out.reserved2 = 0; 971 972 return 0; 973 } 974 975 static bool vbg_wait_event_cond(struct vbg_dev *gdev, 976 struct vbg_session *session, 977 u32 event_mask) 978 { 979 unsigned long flags; 980 bool wakeup; 981 u32 events; 982 983 spin_lock_irqsave(&gdev->event_spinlock, flags); 984 985 events = gdev->pending_events & event_mask; 986 wakeup = events || session->cancel_waiters; 987 988 spin_unlock_irqrestore(&gdev->event_spinlock, flags); 989 990 return wakeup; 991 } 992 993 /* Must be called with the event_lock held */ 994 static u32 vbg_consume_events_locked(struct vbg_dev *gdev, 995 struct vbg_session *session, 996 u32 event_mask) 997 { 998 u32 events = gdev->pending_events & event_mask; 999 1000 gdev->pending_events &= ~events; 1001 return events; 1002 } 1003 1004 static int vbg_ioctl_wait_for_events(struct vbg_dev *gdev, 1005 struct vbg_session *session, 1006 struct vbg_ioctl_wait_for_events *wait) 1007 { 1008 u32 timeout_ms = wait->u.in.timeout_ms; 1009 u32 event_mask = wait->u.in.events; 1010 unsigned long flags; 1011 long timeout; 1012 int ret = 0; 1013 1014 if (vbg_ioctl_chk(&wait->hdr, sizeof(wait->u.in), sizeof(wait->u.out))) 1015 return -EINVAL; 1016 1017 if (timeout_ms == U32_MAX) 1018 timeout = MAX_SCHEDULE_TIMEOUT; 1019 else 1020 timeout = msecs_to_jiffies(timeout_ms); 1021 1022 wait->u.out.events = 0; 1023 do { 1024 timeout = wait_event_interruptible_timeout( 1025 gdev->event_wq, 1026 vbg_wait_event_cond(gdev, session, event_mask), 1027 timeout); 1028 1029 spin_lock_irqsave(&gdev->event_spinlock, flags); 1030 1031 if (timeout < 0 || session->cancel_waiters) { 1032 ret = -EINTR; 1033 } else if (timeout == 0) { 1034 ret = -ETIMEDOUT; 1035 } else { 1036 wait->u.out.events = 1037 vbg_consume_events_locked(gdev, session, event_mask); 1038 } 1039 1040 spin_unlock_irqrestore(&gdev->event_spinlock, flags); 1041 1042 /* 1043 * Someone else may have consumed the event(s) first, in 1044 * which case we go back to waiting. 1045 */ 1046 } while (ret == 0 && wait->u.out.events == 0); 1047 1048 return ret; 1049 } 1050 1051 static int vbg_ioctl_interrupt_all_wait_events(struct vbg_dev *gdev, 1052 struct vbg_session *session, 1053 struct vbg_ioctl_hdr *hdr) 1054 { 1055 unsigned long flags; 1056 1057 if (hdr->size_in != sizeof(*hdr) || hdr->size_out != sizeof(*hdr)) 1058 return -EINVAL; 1059 1060 spin_lock_irqsave(&gdev->event_spinlock, flags); 1061 session->cancel_waiters = true; 1062 spin_unlock_irqrestore(&gdev->event_spinlock, flags); 1063 1064 wake_up(&gdev->event_wq); 1065 1066 return 0; 1067 } 1068 1069 /** 1070 * Checks if the VMM request is allowed in the context of the given session. 1071 * Return: 0 or negative errno value. 1072 * @gdev: The Guest extension device. 1073 * @session: The calling session. 1074 * @req: The request. 1075 */ 1076 static int vbg_req_allowed(struct vbg_dev *gdev, struct vbg_session *session, 1077 const struct vmmdev_request_header *req) 1078 { 1079 const struct vmmdev_guest_status *guest_status; 1080 bool trusted_apps_only; 1081 1082 switch (req->request_type) { 1083 /* Trusted users apps only. */ 1084 case VMMDEVREQ_QUERY_CREDENTIALS: 1085 case VMMDEVREQ_REPORT_CREDENTIALS_JUDGEMENT: 1086 case VMMDEVREQ_REGISTER_SHARED_MODULE: 1087 case VMMDEVREQ_UNREGISTER_SHARED_MODULE: 1088 case VMMDEVREQ_WRITE_COREDUMP: 1089 case VMMDEVREQ_GET_CPU_HOTPLUG_REQ: 1090 case VMMDEVREQ_SET_CPU_HOTPLUG_STATUS: 1091 case VMMDEVREQ_CHECK_SHARED_MODULES: 1092 case VMMDEVREQ_GET_PAGE_SHARING_STATUS: 1093 case VMMDEVREQ_DEBUG_IS_PAGE_SHARED: 1094 case VMMDEVREQ_REPORT_GUEST_STATS: 1095 case VMMDEVREQ_REPORT_GUEST_USER_STATE: 1096 case VMMDEVREQ_GET_STATISTICS_CHANGE_REQ: 1097 trusted_apps_only = true; 1098 break; 1099 1100 /* Anyone. */ 1101 case VMMDEVREQ_GET_MOUSE_STATUS: 1102 case VMMDEVREQ_SET_MOUSE_STATUS: 1103 case VMMDEVREQ_SET_POINTER_SHAPE: 1104 case VMMDEVREQ_GET_HOST_VERSION: 1105 case VMMDEVREQ_IDLE: 1106 case VMMDEVREQ_GET_HOST_TIME: 1107 case VMMDEVREQ_SET_POWER_STATUS: 1108 case VMMDEVREQ_ACKNOWLEDGE_EVENTS: 1109 case VMMDEVREQ_CTL_GUEST_FILTER_MASK: 1110 case VMMDEVREQ_REPORT_GUEST_STATUS: 1111 case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ: 1112 case VMMDEVREQ_VIDEMODE_SUPPORTED: 1113 case VMMDEVREQ_GET_HEIGHT_REDUCTION: 1114 case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ2: 1115 case VMMDEVREQ_VIDEMODE_SUPPORTED2: 1116 case VMMDEVREQ_VIDEO_ACCEL_ENABLE: 1117 case VMMDEVREQ_VIDEO_ACCEL_FLUSH: 1118 case VMMDEVREQ_VIDEO_SET_VISIBLE_REGION: 1119 case VMMDEVREQ_GET_DISPLAY_CHANGE_REQEX: 1120 case VMMDEVREQ_GET_SEAMLESS_CHANGE_REQ: 1121 case VMMDEVREQ_GET_VRDPCHANGE_REQ: 1122 case VMMDEVREQ_LOG_STRING: 1123 case VMMDEVREQ_GET_SESSION_ID: 1124 trusted_apps_only = false; 1125 break; 1126 1127 /* Depends on the request parameters... */ 1128 case VMMDEVREQ_REPORT_GUEST_CAPABILITIES: 1129 guest_status = (const struct vmmdev_guest_status *)req; 1130 switch (guest_status->facility) { 1131 case VBOXGUEST_FACILITY_TYPE_ALL: 1132 case VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER: 1133 vbg_err("Denying userspace vmm report guest cap. call facility %#08x\n", 1134 guest_status->facility); 1135 return -EPERM; 1136 case VBOXGUEST_FACILITY_TYPE_VBOX_SERVICE: 1137 trusted_apps_only = true; 1138 break; 1139 case VBOXGUEST_FACILITY_TYPE_VBOX_TRAY_CLIENT: 1140 case VBOXGUEST_FACILITY_TYPE_SEAMLESS: 1141 case VBOXGUEST_FACILITY_TYPE_GRAPHICS: 1142 default: 1143 trusted_apps_only = false; 1144 break; 1145 } 1146 break; 1147 1148 /* Anything else is not allowed. */ 1149 default: 1150 vbg_err("Denying userspace vmm call type %#08x\n", 1151 req->request_type); 1152 return -EPERM; 1153 } 1154 1155 if (trusted_apps_only && session->user_session) { 1156 vbg_err("Denying userspace vmm call type %#08x through vboxuser device node\n", 1157 req->request_type); 1158 return -EPERM; 1159 } 1160 1161 return 0; 1162 } 1163 1164 static int vbg_ioctl_vmmrequest(struct vbg_dev *gdev, 1165 struct vbg_session *session, void *data) 1166 { 1167 struct vbg_ioctl_hdr *hdr = data; 1168 int ret; 1169 1170 if (hdr->size_in != hdr->size_out) 1171 return -EINVAL; 1172 1173 if (hdr->size_in > VMMDEV_MAX_VMMDEVREQ_SIZE) 1174 return -E2BIG; 1175 1176 if (hdr->type == VBG_IOCTL_HDR_TYPE_DEFAULT) 1177 return -EINVAL; 1178 1179 ret = vbg_req_allowed(gdev, session, data); 1180 if (ret < 0) 1181 return ret; 1182 1183 vbg_req_perform(gdev, data); 1184 WARN_ON(hdr->rc == VINF_HGCM_ASYNC_EXECUTE); 1185 1186 return 0; 1187 } 1188 1189 static int vbg_ioctl_hgcm_connect(struct vbg_dev *gdev, 1190 struct vbg_session *session, 1191 struct vbg_ioctl_hgcm_connect *conn) 1192 { 1193 u32 client_id; 1194 int i, ret; 1195 1196 if (vbg_ioctl_chk(&conn->hdr, sizeof(conn->u.in), sizeof(conn->u.out))) 1197 return -EINVAL; 1198 1199 /* Find a free place in the sessions clients array and claim it */ 1200 mutex_lock(&gdev->session_mutex); 1201 for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) { 1202 if (!session->hgcm_client_ids[i]) { 1203 session->hgcm_client_ids[i] = U32_MAX; 1204 break; 1205 } 1206 } 1207 mutex_unlock(&gdev->session_mutex); 1208 1209 if (i >= ARRAY_SIZE(session->hgcm_client_ids)) 1210 return -EMFILE; 1211 1212 ret = vbg_hgcm_connect(gdev, &conn->u.in.loc, &client_id, 1213 &conn->hdr.rc); 1214 1215 mutex_lock(&gdev->session_mutex); 1216 if (ret == 0 && conn->hdr.rc >= 0) { 1217 conn->u.out.client_id = client_id; 1218 session->hgcm_client_ids[i] = client_id; 1219 } else { 1220 conn->u.out.client_id = 0; 1221 session->hgcm_client_ids[i] = 0; 1222 } 1223 mutex_unlock(&gdev->session_mutex); 1224 1225 return ret; 1226 } 1227 1228 static int vbg_ioctl_hgcm_disconnect(struct vbg_dev *gdev, 1229 struct vbg_session *session, 1230 struct vbg_ioctl_hgcm_disconnect *disconn) 1231 { 1232 u32 client_id; 1233 int i, ret; 1234 1235 if (vbg_ioctl_chk(&disconn->hdr, sizeof(disconn->u.in), 0)) 1236 return -EINVAL; 1237 1238 client_id = disconn->u.in.client_id; 1239 if (client_id == 0 || client_id == U32_MAX) 1240 return -EINVAL; 1241 1242 mutex_lock(&gdev->session_mutex); 1243 for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) { 1244 if (session->hgcm_client_ids[i] == client_id) { 1245 session->hgcm_client_ids[i] = U32_MAX; 1246 break; 1247 } 1248 } 1249 mutex_unlock(&gdev->session_mutex); 1250 1251 if (i >= ARRAY_SIZE(session->hgcm_client_ids)) 1252 return -EINVAL; 1253 1254 ret = vbg_hgcm_disconnect(gdev, client_id, &disconn->hdr.rc); 1255 1256 mutex_lock(&gdev->session_mutex); 1257 if (ret == 0 && disconn->hdr.rc >= 0) 1258 session->hgcm_client_ids[i] = 0; 1259 else 1260 session->hgcm_client_ids[i] = client_id; 1261 mutex_unlock(&gdev->session_mutex); 1262 1263 return ret; 1264 } 1265 1266 static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev, 1267 struct vbg_session *session, bool f32bit, 1268 struct vbg_ioctl_hgcm_call *call) 1269 { 1270 size_t actual_size; 1271 u32 client_id; 1272 int i, ret; 1273 1274 if (call->hdr.size_in < sizeof(*call)) 1275 return -EINVAL; 1276 1277 if (call->hdr.size_in != call->hdr.size_out) 1278 return -EINVAL; 1279 1280 if (call->parm_count > VMMDEV_HGCM_MAX_PARMS) 1281 return -E2BIG; 1282 1283 client_id = call->client_id; 1284 if (client_id == 0 || client_id == U32_MAX) 1285 return -EINVAL; 1286 1287 actual_size = sizeof(*call); 1288 if (f32bit) 1289 actual_size += call->parm_count * 1290 sizeof(struct vmmdev_hgcm_function_parameter32); 1291 else 1292 actual_size += call->parm_count * 1293 sizeof(struct vmmdev_hgcm_function_parameter); 1294 if (call->hdr.size_in < actual_size) { 1295 vbg_debug("VBG_IOCTL_HGCM_CALL: hdr.size_in %d required size is %zd\n", 1296 call->hdr.size_in, actual_size); 1297 return -EINVAL; 1298 } 1299 call->hdr.size_out = actual_size; 1300 1301 /* 1302 * Validate the client id. 1303 */ 1304 mutex_lock(&gdev->session_mutex); 1305 for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) 1306 if (session->hgcm_client_ids[i] == client_id) 1307 break; 1308 mutex_unlock(&gdev->session_mutex); 1309 if (i >= ARRAY_SIZE(session->hgcm_client_ids)) { 1310 vbg_debug("VBG_IOCTL_HGCM_CALL: INVALID handle. u32Client=%#08x\n", 1311 client_id); 1312 return -EINVAL; 1313 } 1314 1315 if (f32bit) 1316 ret = vbg_hgcm_call32(gdev, client_id, 1317 call->function, call->timeout_ms, 1318 VBG_IOCTL_HGCM_CALL_PARMS32(call), 1319 call->parm_count, &call->hdr.rc); 1320 else 1321 ret = vbg_hgcm_call(gdev, client_id, 1322 call->function, call->timeout_ms, 1323 VBG_IOCTL_HGCM_CALL_PARMS(call), 1324 call->parm_count, &call->hdr.rc); 1325 1326 if (ret == -E2BIG) { 1327 /* E2BIG needs to be reported through the hdr.rc field. */ 1328 call->hdr.rc = VERR_OUT_OF_RANGE; 1329 ret = 0; 1330 } 1331 1332 if (ret && ret != -EINTR && ret != -ETIMEDOUT) 1333 vbg_err("VBG_IOCTL_HGCM_CALL error: %d\n", ret); 1334 1335 return ret; 1336 } 1337 1338 static int vbg_ioctl_log(struct vbg_ioctl_log *log) 1339 { 1340 if (log->hdr.size_out != sizeof(log->hdr)) 1341 return -EINVAL; 1342 1343 vbg_info("%.*s", (int)(log->hdr.size_in - sizeof(log->hdr)), 1344 log->u.in.msg); 1345 1346 return 0; 1347 } 1348 1349 static int vbg_ioctl_change_filter_mask(struct vbg_dev *gdev, 1350 struct vbg_session *session, 1351 struct vbg_ioctl_change_filter *filter) 1352 { 1353 u32 or_mask, not_mask; 1354 1355 if (vbg_ioctl_chk(&filter->hdr, sizeof(filter->u.in), 0)) 1356 return -EINVAL; 1357 1358 or_mask = filter->u.in.or_mask; 1359 not_mask = filter->u.in.not_mask; 1360 1361 if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK) 1362 return -EINVAL; 1363 1364 return vbg_set_session_event_filter(gdev, session, or_mask, not_mask, 1365 false); 1366 } 1367 1368 static int vbg_ioctl_change_guest_capabilities(struct vbg_dev *gdev, 1369 struct vbg_session *session, struct vbg_ioctl_set_guest_caps *caps) 1370 { 1371 u32 or_mask, not_mask; 1372 int ret; 1373 1374 if (vbg_ioctl_chk(&caps->hdr, sizeof(caps->u.in), sizeof(caps->u.out))) 1375 return -EINVAL; 1376 1377 or_mask = caps->u.in.or_mask; 1378 not_mask = caps->u.in.not_mask; 1379 1380 if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK) 1381 return -EINVAL; 1382 1383 ret = vbg_set_session_capabilities(gdev, session, or_mask, not_mask, 1384 false); 1385 if (ret) 1386 return ret; 1387 1388 caps->u.out.session_caps = session->guest_caps; 1389 caps->u.out.global_caps = gdev->guest_caps_host; 1390 1391 return 0; 1392 } 1393 1394 static int vbg_ioctl_check_balloon(struct vbg_dev *gdev, 1395 struct vbg_ioctl_check_balloon *balloon_info) 1396 { 1397 if (vbg_ioctl_chk(&balloon_info->hdr, 0, sizeof(balloon_info->u.out))) 1398 return -EINVAL; 1399 1400 balloon_info->u.out.balloon_chunks = gdev->mem_balloon.chunks; 1401 /* 1402 * Under Linux we handle VMMDEV_EVENT_BALLOON_CHANGE_REQUEST 1403 * events entirely in the kernel, see vbg_core_isr(). 1404 */ 1405 balloon_info->u.out.handle_in_r3 = false; 1406 1407 return 0; 1408 } 1409 1410 static int vbg_ioctl_write_core_dump(struct vbg_dev *gdev, 1411 struct vbg_ioctl_write_coredump *dump) 1412 { 1413 struct vmmdev_write_core_dump *req; 1414 1415 if (vbg_ioctl_chk(&dump->hdr, sizeof(dump->u.in), 0)) 1416 return -EINVAL; 1417 1418 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_WRITE_COREDUMP); 1419 if (!req) 1420 return -ENOMEM; 1421 1422 req->flags = dump->u.in.flags; 1423 dump->hdr.rc = vbg_req_perform(gdev, req); 1424 1425 vbg_req_free(req, sizeof(*req)); 1426 return 0; 1427 } 1428 1429 /** 1430 * Common IOCtl for user to kernel communication. 1431 * Return: 0 or negative errno value. 1432 * @session: The client session. 1433 * @req: The requested function. 1434 * @data: The i/o data buffer, minimum size sizeof(struct vbg_ioctl_hdr). 1435 */ 1436 int vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data) 1437 { 1438 unsigned int req_no_size = req & ~IOCSIZE_MASK; 1439 struct vbg_dev *gdev = session->gdev; 1440 struct vbg_ioctl_hdr *hdr = data; 1441 bool f32bit = false; 1442 1443 hdr->rc = VINF_SUCCESS; 1444 if (!hdr->size_out) 1445 hdr->size_out = hdr->size_in; 1446 1447 /* 1448 * hdr->version and hdr->size_in / hdr->size_out minimum size are 1449 * already checked by vbg_misc_device_ioctl(). 1450 */ 1451 1452 /* For VMMDEV_REQUEST hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT */ 1453 if (req_no_size == VBG_IOCTL_VMMDEV_REQUEST(0) || 1454 req == VBG_IOCTL_VMMDEV_REQUEST_BIG) 1455 return vbg_ioctl_vmmrequest(gdev, session, data); 1456 1457 if (hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT) 1458 return -EINVAL; 1459 1460 /* Fixed size requests. */ 1461 switch (req) { 1462 case VBG_IOCTL_DRIVER_VERSION_INFO: 1463 return vbg_ioctl_driver_version_info(data); 1464 case VBG_IOCTL_HGCM_CONNECT: 1465 return vbg_ioctl_hgcm_connect(gdev, session, data); 1466 case VBG_IOCTL_HGCM_DISCONNECT: 1467 return vbg_ioctl_hgcm_disconnect(gdev, session, data); 1468 case VBG_IOCTL_WAIT_FOR_EVENTS: 1469 return vbg_ioctl_wait_for_events(gdev, session, data); 1470 case VBG_IOCTL_INTERRUPT_ALL_WAIT_FOR_EVENTS: 1471 return vbg_ioctl_interrupt_all_wait_events(gdev, session, data); 1472 case VBG_IOCTL_CHANGE_FILTER_MASK: 1473 return vbg_ioctl_change_filter_mask(gdev, session, data); 1474 case VBG_IOCTL_CHANGE_GUEST_CAPABILITIES: 1475 return vbg_ioctl_change_guest_capabilities(gdev, session, data); 1476 case VBG_IOCTL_CHECK_BALLOON: 1477 return vbg_ioctl_check_balloon(gdev, data); 1478 case VBG_IOCTL_WRITE_CORE_DUMP: 1479 return vbg_ioctl_write_core_dump(gdev, data); 1480 } 1481 1482 /* Variable sized requests. */ 1483 switch (req_no_size) { 1484 #ifdef CONFIG_COMPAT 1485 case VBG_IOCTL_HGCM_CALL_32(0): 1486 f32bit = true; 1487 /* Fall through */ 1488 #endif 1489 case VBG_IOCTL_HGCM_CALL(0): 1490 return vbg_ioctl_hgcm_call(gdev, session, f32bit, data); 1491 case VBG_IOCTL_LOG(0): 1492 return vbg_ioctl_log(data); 1493 } 1494 1495 vbg_debug("VGDrvCommonIoCtl: Unknown req %#08x\n", req); 1496 return -ENOTTY; 1497 } 1498 1499 /** 1500 * Report guest supported mouse-features to the host. 1501 * 1502 * Return: 0 or negative errno value. 1503 * @gdev: The Guest extension device. 1504 * @features: The set of features to report to the host. 1505 */ 1506 int vbg_core_set_mouse_status(struct vbg_dev *gdev, u32 features) 1507 { 1508 struct vmmdev_mouse_status *req; 1509 int rc; 1510 1511 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_MOUSE_STATUS); 1512 if (!req) 1513 return -ENOMEM; 1514 1515 req->mouse_features = features; 1516 req->pointer_pos_x = 0; 1517 req->pointer_pos_y = 0; 1518 1519 rc = vbg_req_perform(gdev, req); 1520 if (rc < 0) 1521 vbg_err("%s error, rc: %d\n", __func__, rc); 1522 1523 vbg_req_free(req, sizeof(*req)); 1524 return vbg_status_code_to_errno(rc); 1525 } 1526 1527 /** Core interrupt service routine. */ 1528 irqreturn_t vbg_core_isr(int irq, void *dev_id) 1529 { 1530 struct vbg_dev *gdev = dev_id; 1531 struct vmmdev_events *req = gdev->ack_events_req; 1532 bool mouse_position_changed = false; 1533 unsigned long flags; 1534 u32 events = 0; 1535 int rc; 1536 1537 if (!gdev->mmio->V.V1_04.have_events) 1538 return IRQ_NONE; 1539 1540 /* Get and acknowlegde events. */ 1541 req->header.rc = VERR_INTERNAL_ERROR; 1542 req->events = 0; 1543 rc = vbg_req_perform(gdev, req); 1544 if (rc < 0) { 1545 vbg_err("Error performing events req, rc: %d\n", rc); 1546 return IRQ_NONE; 1547 } 1548 1549 events = req->events; 1550 1551 if (events & VMMDEV_EVENT_MOUSE_POSITION_CHANGED) { 1552 mouse_position_changed = true; 1553 events &= ~VMMDEV_EVENT_MOUSE_POSITION_CHANGED; 1554 } 1555 1556 if (events & VMMDEV_EVENT_HGCM) { 1557 wake_up(&gdev->hgcm_wq); 1558 events &= ~VMMDEV_EVENT_HGCM; 1559 } 1560 1561 if (events & VMMDEV_EVENT_BALLOON_CHANGE_REQUEST) { 1562 schedule_work(&gdev->mem_balloon.work); 1563 events &= ~VMMDEV_EVENT_BALLOON_CHANGE_REQUEST; 1564 } 1565 1566 if (events) { 1567 spin_lock_irqsave(&gdev->event_spinlock, flags); 1568 gdev->pending_events |= events; 1569 spin_unlock_irqrestore(&gdev->event_spinlock, flags); 1570 1571 wake_up(&gdev->event_wq); 1572 } 1573 1574 if (mouse_position_changed) 1575 vbg_linux_mouse_event(gdev); 1576 1577 return IRQ_HANDLED; 1578 } 1579