1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* 3 * vboxguest linux pci driver, char-dev and input-device code, 4 * 5 * Copyright (C) 2006-2016 Oracle Corporation 6 */ 7 8 #include <linux/input.h> 9 #include <linux/kernel.h> 10 #include <linux/miscdevice.h> 11 #include <linux/module.h> 12 #include <linux/pci.h> 13 #include <linux/poll.h> 14 #include <linux/vbox_utils.h> 15 #include "vboxguest_core.h" 16 17 /** The device name. */ 18 #define DEVICE_NAME "vboxguest" 19 /** The device name for the device node open to everyone. */ 20 #define DEVICE_NAME_USER "vboxuser" 21 /** VirtualBox PCI vendor ID. */ 22 #define VBOX_VENDORID 0x80ee 23 /** VMMDev PCI card product ID. */ 24 #define VMMDEV_DEVICEID 0xcafe 25 26 /** Mutex protecting the global vbg_gdev pointer used by vbg_get/put_gdev. */ 27 static DEFINE_MUTEX(vbg_gdev_mutex); 28 /** Global vbg_gdev pointer used by vbg_get/put_gdev. */ 29 static struct vbg_dev *vbg_gdev; 30 31 static int vbg_misc_device_open(struct inode *inode, struct file *filp) 32 { 33 struct vbg_session *session; 34 struct vbg_dev *gdev; 35 36 /* misc_open sets filp->private_data to our misc device */ 37 gdev = container_of(filp->private_data, struct vbg_dev, misc_device); 38 39 session = vbg_core_open_session(gdev, false); 40 if (IS_ERR(session)) 41 return PTR_ERR(session); 42 43 filp->private_data = session; 44 return 0; 45 } 46 47 static int vbg_misc_device_user_open(struct inode *inode, struct file *filp) 48 { 49 struct vbg_session *session; 50 struct vbg_dev *gdev; 51 52 /* misc_open sets filp->private_data to our misc device */ 53 gdev = container_of(filp->private_data, struct vbg_dev, 54 misc_device_user); 55 56 session = vbg_core_open_session(gdev, false); 57 if (IS_ERR(session)) 58 return PTR_ERR(session); 59 60 filp->private_data = session; 61 return 0; 62 } 63 64 /** 65 * Close device. 66 * Return: 0 on success, negated errno on failure. 67 * @inode: Pointer to inode info structure. 68 * @filp: Associated file pointer. 69 */ 70 static int vbg_misc_device_close(struct inode *inode, struct file *filp) 71 { 72 vbg_core_close_session(filp->private_data); 73 filp->private_data = NULL; 74 return 0; 75 } 76 77 /** 78 * Device I/O Control entry point. 79 * Return: 0 on success, negated errno on failure. 80 * @filp: Associated file pointer. 81 * @req: The request specified to ioctl(). 82 * @arg: The argument specified to ioctl(). 83 */ 84 static long vbg_misc_device_ioctl(struct file *filp, unsigned int req, 85 unsigned long arg) 86 { 87 struct vbg_session *session = filp->private_data; 88 size_t returned_size, size; 89 struct vbg_ioctl_hdr hdr; 90 bool is_vmmdev_req; 91 int ret = 0; 92 void *buf; 93 94 if (copy_from_user(&hdr, (void *)arg, sizeof(hdr))) 95 return -EFAULT; 96 97 if (hdr.version != VBG_IOCTL_HDR_VERSION) 98 return -EINVAL; 99 100 if (hdr.size_in < sizeof(hdr) || 101 (hdr.size_out && hdr.size_out < sizeof(hdr))) 102 return -EINVAL; 103 104 size = max(hdr.size_in, hdr.size_out); 105 if (_IOC_SIZE(req) && _IOC_SIZE(req) != size) 106 return -EINVAL; 107 if (size > SZ_16M) 108 return -E2BIG; 109 110 /* 111 * IOCTL_VMMDEV_REQUEST needs the buffer to be below 4G to avoid 112 * the need for a bounce-buffer and another copy later on. 113 */ 114 is_vmmdev_req = (req & ~IOCSIZE_MASK) == VBG_IOCTL_VMMDEV_REQUEST(0) || 115 req == VBG_IOCTL_VMMDEV_REQUEST_BIG; 116 117 if (is_vmmdev_req) 118 buf = vbg_req_alloc(size, VBG_IOCTL_HDR_TYPE_DEFAULT); 119 else 120 buf = kmalloc(size, GFP_KERNEL); 121 if (!buf) 122 return -ENOMEM; 123 124 *((struct vbg_ioctl_hdr *)buf) = hdr; 125 if (copy_from_user(buf + sizeof(hdr), (void *)arg + sizeof(hdr), 126 hdr.size_in - sizeof(hdr))) { 127 ret = -EFAULT; 128 goto out; 129 } 130 if (hdr.size_in < size) 131 memset(buf + hdr.size_in, 0, size - hdr.size_in); 132 133 ret = vbg_core_ioctl(session, req, buf); 134 if (ret) 135 goto out; 136 137 returned_size = ((struct vbg_ioctl_hdr *)buf)->size_out; 138 if (returned_size > size) { 139 vbg_debug("%s: too much output data %zu > %zu\n", 140 __func__, returned_size, size); 141 returned_size = size; 142 } 143 if (copy_to_user((void *)arg, buf, returned_size) != 0) 144 ret = -EFAULT; 145 146 out: 147 if (is_vmmdev_req) 148 vbg_req_free(buf, size); 149 else 150 kfree(buf); 151 152 return ret; 153 } 154 155 /** The file_operations structures. */ 156 static const struct file_operations vbg_misc_device_fops = { 157 .owner = THIS_MODULE, 158 .open = vbg_misc_device_open, 159 .release = vbg_misc_device_close, 160 .unlocked_ioctl = vbg_misc_device_ioctl, 161 #ifdef CONFIG_COMPAT 162 .compat_ioctl = vbg_misc_device_ioctl, 163 #endif 164 }; 165 static const struct file_operations vbg_misc_device_user_fops = { 166 .owner = THIS_MODULE, 167 .open = vbg_misc_device_user_open, 168 .release = vbg_misc_device_close, 169 .unlocked_ioctl = vbg_misc_device_ioctl, 170 #ifdef CONFIG_COMPAT 171 .compat_ioctl = vbg_misc_device_ioctl, 172 #endif 173 }; 174 175 /** 176 * Called when the input device is first opened. 177 * 178 * Sets up absolute mouse reporting. 179 */ 180 static int vbg_input_open(struct input_dev *input) 181 { 182 struct vbg_dev *gdev = input_get_drvdata(input); 183 u32 feat = VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE | VMMDEV_MOUSE_NEW_PROTOCOL; 184 int ret; 185 186 ret = vbg_core_set_mouse_status(gdev, feat); 187 if (ret) 188 return ret; 189 190 return 0; 191 } 192 193 /** 194 * Called if all open handles to the input device are closed. 195 * 196 * Disables absolute reporting. 197 */ 198 static void vbg_input_close(struct input_dev *input) 199 { 200 struct vbg_dev *gdev = input_get_drvdata(input); 201 202 vbg_core_set_mouse_status(gdev, 0); 203 } 204 205 /** 206 * Creates the kernel input device. 207 * 208 * Return: 0 on success, negated errno on failure. 209 */ 210 static int vbg_create_input_device(struct vbg_dev *gdev) 211 { 212 struct input_dev *input; 213 214 input = devm_input_allocate_device(gdev->dev); 215 if (!input) 216 return -ENOMEM; 217 218 input->id.bustype = BUS_PCI; 219 input->id.vendor = VBOX_VENDORID; 220 input->id.product = VMMDEV_DEVICEID; 221 input->open = vbg_input_open; 222 input->close = vbg_input_close; 223 input->dev.parent = gdev->dev; 224 input->name = "VirtualBox mouse integration"; 225 226 input_set_abs_params(input, ABS_X, VMMDEV_MOUSE_RANGE_MIN, 227 VMMDEV_MOUSE_RANGE_MAX, 0, 0); 228 input_set_abs_params(input, ABS_Y, VMMDEV_MOUSE_RANGE_MIN, 229 VMMDEV_MOUSE_RANGE_MAX, 0, 0); 230 input_set_capability(input, EV_KEY, BTN_MOUSE); 231 input_set_drvdata(input, gdev); 232 233 gdev->input = input; 234 235 return input_register_device(gdev->input); 236 } 237 238 static ssize_t host_version_show(struct device *dev, 239 struct device_attribute *attr, char *buf) 240 { 241 struct vbg_dev *gdev = dev_get_drvdata(dev); 242 243 return sprintf(buf, "%s\n", gdev->host_version); 244 } 245 246 static ssize_t host_features_show(struct device *dev, 247 struct device_attribute *attr, char *buf) 248 { 249 struct vbg_dev *gdev = dev_get_drvdata(dev); 250 251 return sprintf(buf, "%#x\n", gdev->host_features); 252 } 253 254 static DEVICE_ATTR_RO(host_version); 255 static DEVICE_ATTR_RO(host_features); 256 257 /** 258 * Does the PCI detection and init of the device. 259 * 260 * Return: 0 on success, negated errno on failure. 261 */ 262 static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) 263 { 264 struct device *dev = &pci->dev; 265 resource_size_t io, io_len, mmio, mmio_len; 266 struct vmmdev_memory *vmmdev; 267 struct vbg_dev *gdev; 268 int ret; 269 270 gdev = devm_kzalloc(dev, sizeof(*gdev), GFP_KERNEL); 271 if (!gdev) 272 return -ENOMEM; 273 274 ret = pci_enable_device(pci); 275 if (ret != 0) { 276 vbg_err("vboxguest: Error enabling device: %d\n", ret); 277 return ret; 278 } 279 280 ret = -ENODEV; 281 282 io = pci_resource_start(pci, 0); 283 io_len = pci_resource_len(pci, 0); 284 if (!io || !io_len) { 285 vbg_err("vboxguest: Error IO-port resource (0) is missing\n"); 286 goto err_disable_pcidev; 287 } 288 if (devm_request_region(dev, io, io_len, DEVICE_NAME) == NULL) { 289 vbg_err("vboxguest: Error could not claim IO resource\n"); 290 ret = -EBUSY; 291 goto err_disable_pcidev; 292 } 293 294 mmio = pci_resource_start(pci, 1); 295 mmio_len = pci_resource_len(pci, 1); 296 if (!mmio || !mmio_len) { 297 vbg_err("vboxguest: Error MMIO resource (1) is missing\n"); 298 goto err_disable_pcidev; 299 } 300 301 if (devm_request_mem_region(dev, mmio, mmio_len, DEVICE_NAME) == NULL) { 302 vbg_err("vboxguest: Error could not claim MMIO resource\n"); 303 ret = -EBUSY; 304 goto err_disable_pcidev; 305 } 306 307 vmmdev = devm_ioremap(dev, mmio, mmio_len); 308 if (!vmmdev) { 309 vbg_err("vboxguest: Error ioremap failed; MMIO addr=%pap size=%pap\n", 310 &mmio, &mmio_len); 311 goto err_disable_pcidev; 312 } 313 314 /* Validate MMIO region version and size. */ 315 if (vmmdev->version != VMMDEV_MEMORY_VERSION || 316 vmmdev->size < 32 || vmmdev->size > mmio_len) { 317 vbg_err("vboxguest: Bogus VMMDev memory; version=%08x (expected %08x) size=%d (expected <= %d)\n", 318 vmmdev->version, VMMDEV_MEMORY_VERSION, 319 vmmdev->size, (int)mmio_len); 320 goto err_disable_pcidev; 321 } 322 323 gdev->io_port = io; 324 gdev->mmio = vmmdev; 325 gdev->dev = dev; 326 gdev->misc_device.minor = MISC_DYNAMIC_MINOR; 327 gdev->misc_device.name = DEVICE_NAME; 328 gdev->misc_device.fops = &vbg_misc_device_fops; 329 gdev->misc_device_user.minor = MISC_DYNAMIC_MINOR; 330 gdev->misc_device_user.name = DEVICE_NAME_USER; 331 gdev->misc_device_user.fops = &vbg_misc_device_user_fops; 332 333 ret = vbg_core_init(gdev, VMMDEV_EVENT_MOUSE_POSITION_CHANGED); 334 if (ret) 335 goto err_disable_pcidev; 336 337 ret = vbg_create_input_device(gdev); 338 if (ret) { 339 vbg_err("vboxguest: Error creating input device: %d\n", ret); 340 goto err_vbg_core_exit; 341 } 342 343 ret = devm_request_irq(dev, pci->irq, vbg_core_isr, IRQF_SHARED, 344 DEVICE_NAME, gdev); 345 if (ret) { 346 vbg_err("vboxguest: Error requesting irq: %d\n", ret); 347 goto err_vbg_core_exit; 348 } 349 350 ret = misc_register(&gdev->misc_device); 351 if (ret) { 352 vbg_err("vboxguest: Error misc_register %s failed: %d\n", 353 DEVICE_NAME, ret); 354 goto err_vbg_core_exit; 355 } 356 357 ret = misc_register(&gdev->misc_device_user); 358 if (ret) { 359 vbg_err("vboxguest: Error misc_register %s failed: %d\n", 360 DEVICE_NAME_USER, ret); 361 goto err_unregister_misc_device; 362 } 363 364 mutex_lock(&vbg_gdev_mutex); 365 if (!vbg_gdev) 366 vbg_gdev = gdev; 367 else 368 ret = -EBUSY; 369 mutex_unlock(&vbg_gdev_mutex); 370 371 if (ret) { 372 vbg_err("vboxguest: Error more then 1 vbox guest pci device\n"); 373 goto err_unregister_misc_device_user; 374 } 375 376 pci_set_drvdata(pci, gdev); 377 device_create_file(dev, &dev_attr_host_version); 378 device_create_file(dev, &dev_attr_host_features); 379 380 vbg_info("vboxguest: misc device minor %d, IRQ %d, I/O port %x, MMIO at %pap (size %pap)\n", 381 gdev->misc_device.minor, pci->irq, gdev->io_port, 382 &mmio, &mmio_len); 383 384 return 0; 385 386 err_unregister_misc_device_user: 387 misc_deregister(&gdev->misc_device_user); 388 err_unregister_misc_device: 389 misc_deregister(&gdev->misc_device); 390 err_vbg_core_exit: 391 vbg_core_exit(gdev); 392 err_disable_pcidev: 393 pci_disable_device(pci); 394 395 return ret; 396 } 397 398 static void vbg_pci_remove(struct pci_dev *pci) 399 { 400 struct vbg_dev *gdev = pci_get_drvdata(pci); 401 402 mutex_lock(&vbg_gdev_mutex); 403 vbg_gdev = NULL; 404 mutex_unlock(&vbg_gdev_mutex); 405 406 device_remove_file(gdev->dev, &dev_attr_host_features); 407 device_remove_file(gdev->dev, &dev_attr_host_version); 408 misc_deregister(&gdev->misc_device_user); 409 misc_deregister(&gdev->misc_device); 410 vbg_core_exit(gdev); 411 pci_disable_device(pci); 412 } 413 414 struct vbg_dev *vbg_get_gdev(void) 415 { 416 mutex_lock(&vbg_gdev_mutex); 417 418 /* 419 * Note on success we keep the mutex locked until vbg_put_gdev(), 420 * this stops vbg_pci_remove from removing the device from underneath 421 * vboxsf. vboxsf will only hold a reference for a short while. 422 */ 423 if (vbg_gdev) 424 return vbg_gdev; 425 426 mutex_unlock(&vbg_gdev_mutex); 427 return ERR_PTR(-ENODEV); 428 } 429 EXPORT_SYMBOL(vbg_get_gdev); 430 431 void vbg_put_gdev(struct vbg_dev *gdev) 432 { 433 WARN_ON(gdev != vbg_gdev); 434 mutex_unlock(&vbg_gdev_mutex); 435 } 436 EXPORT_SYMBOL(vbg_put_gdev); 437 438 /** 439 * Callback for mouse events. 440 * 441 * This is called at the end of the ISR, after leaving the event spinlock, if 442 * VMMDEV_EVENT_MOUSE_POSITION_CHANGED was raised by the host. 443 * 444 * @gdev: The device extension. 445 */ 446 void vbg_linux_mouse_event(struct vbg_dev *gdev) 447 { 448 int rc; 449 450 /* Report events to the kernel input device */ 451 gdev->mouse_status_req->mouse_features = 0; 452 gdev->mouse_status_req->pointer_pos_x = 0; 453 gdev->mouse_status_req->pointer_pos_y = 0; 454 rc = vbg_req_perform(gdev, gdev->mouse_status_req); 455 if (rc >= 0) { 456 input_report_abs(gdev->input, ABS_X, 457 gdev->mouse_status_req->pointer_pos_x); 458 input_report_abs(gdev->input, ABS_Y, 459 gdev->mouse_status_req->pointer_pos_y); 460 input_sync(gdev->input); 461 } 462 } 463 464 static const struct pci_device_id vbg_pci_ids[] = { 465 { .vendor = VBOX_VENDORID, .device = VMMDEV_DEVICEID }, 466 {} 467 }; 468 MODULE_DEVICE_TABLE(pci, vbg_pci_ids); 469 470 static struct pci_driver vbg_pci_driver = { 471 .name = DEVICE_NAME, 472 .id_table = vbg_pci_ids, 473 .probe = vbg_pci_probe, 474 .remove = vbg_pci_remove, 475 }; 476 477 module_pci_driver(vbg_pci_driver); 478 479 MODULE_AUTHOR("Oracle Corporation"); 480 MODULE_DESCRIPTION("Oracle VM VirtualBox Guest Additions for Linux Module"); 481 MODULE_LICENSE("GPL"); 482