1/* SPDX-License-Identifier: (GPL-2.0 OR CDDL-1.0) */ 2/* 3 * vboxguest core guest-device handling code, VBoxGuest.cpp in upstream svn. 4 * 5 * Copyright (C) 2007-2016 Oracle Corporation 6 */ 7 8#include <linux/device.h> 9#include <linux/io.h> 10#include <linux/mm.h> 11#include <linux/sched.h> 12#include <linux/sizes.h> 13#include <linux/slab.h> 14#include <linux/vbox_err.h> 15#include <linux/vbox_utils.h> 16#include <linux/vmalloc.h> 17#include "vboxguest_core.h" 18#include "vboxguest_version.h" 19 20/* Get the pointer to the first HGCM parameter. */ 21#define VBG_IOCTL_HGCM_CALL_PARMS(a) \ 22 ((struct vmmdev_hgcm_function_parameter *)( \ 23 (u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call))) 24/* Get the pointer to the first HGCM parameter in a 32-bit request. */ 25#define VBG_IOCTL_HGCM_CALL_PARMS32(a) \ 26 ((struct vmmdev_hgcm_function_parameter32 *)( \ 27 (u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call))) 28 29#define GUEST_MAPPINGS_TRIES 5 30 31#define VBG_KERNEL_REQUEST \ 32 (VMMDEV_REQUESTOR_KERNEL | VMMDEV_REQUESTOR_USR_DRV | \ 33 VMMDEV_REQUESTOR_CON_DONT_KNOW | VMMDEV_REQUESTOR_TRUST_NOT_GIVEN) 34 35/** 36 * vbg_guest_mappings_init - Reserves memory in which the VMM can 37 * relocate any guest mappings that are floating around. 38 * @gdev: The Guest extension device. 39 * 40 * This operation is a little bit tricky since the VMM might not accept 41 * just any address because of address clashes between the three contexts 42 * it operates in, so we try several times. 43 * 44 * Failure to reserve the guest mappings is ignored. 45 */ 46static void vbg_guest_mappings_init(struct vbg_dev *gdev) 47{ 48 struct vmmdev_hypervisorinfo *req; 49 void *guest_mappings[GUEST_MAPPINGS_TRIES]; 50 struct page **pages = NULL; 51 u32 size, hypervisor_size; 52 int i, rc; 53 54 /* Query the required space. */ 55 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HYPERVISOR_INFO, 56 VBG_KERNEL_REQUEST); 57 if (!req) 58 return; 59 60 req->hypervisor_start = 0; 61 req->hypervisor_size = 0; 62 rc = vbg_req_perform(gdev, req); 63 if (rc < 0) 64 goto out; 65 66 /* 67 * The VMM will report back if there is nothing it wants to map, like 68 * for instance in VT-x and AMD-V mode. 69 */ 70 if (req->hypervisor_size == 0) 71 goto out; 72 73 hypervisor_size = req->hypervisor_size; 74 /* Add 4M so that we can align the vmap to 4MiB as the host requires. */ 75 size = PAGE_ALIGN(req->hypervisor_size) + SZ_4M; 76 77 pages = kmalloc_array(size >> PAGE_SHIFT, sizeof(*pages), GFP_KERNEL); 78 if (!pages) 79 goto out; 80 81 gdev->guest_mappings_dummy_page = alloc_page(GFP_HIGHUSER); 82 if (!gdev->guest_mappings_dummy_page) 83 goto out; 84 85 for (i = 0; i < (size >> PAGE_SHIFT); i++) 86 pages[i] = gdev->guest_mappings_dummy_page; 87 88 /* 89 * Try several times, the VMM might not accept some addresses because 90 * of address clashes between the three contexts. 91 */ 92 for (i = 0; i < GUEST_MAPPINGS_TRIES; i++) { 93 guest_mappings[i] = vmap(pages, (size >> PAGE_SHIFT), 94 VM_MAP, PAGE_KERNEL_RO); 95 if (!guest_mappings[i]) 96 break; 97 98 req->header.request_type = VMMDEVREQ_SET_HYPERVISOR_INFO; 99 req->header.rc = VERR_INTERNAL_ERROR; 100 req->hypervisor_size = hypervisor_size; 101 req->hypervisor_start = 102 (unsigned long)PTR_ALIGN(guest_mappings[i], SZ_4M); 103 104 rc = vbg_req_perform(gdev, req); 105 if (rc >= 0) { 106 gdev->guest_mappings = guest_mappings[i]; 107 break; 108 } 109 } 110 111 /* Free vmap's from failed attempts. */ 112 while (--i >= 0) 113 vunmap(guest_mappings[i]); 114 115 /* On failure free the dummy-page backing the vmap */ 116 if (!gdev->guest_mappings) { 117 __free_page(gdev->guest_mappings_dummy_page); 118 gdev->guest_mappings_dummy_page = NULL; 119 } 120 121out: 122 vbg_req_free(req, sizeof(*req)); 123 kfree(pages); 124} 125 126/** 127 * vbg_guest_mappings_exit - Undo what vbg_guest_mappings_init did. 128 * 129 * @gdev: The Guest extension device. 130 */ 131static void vbg_guest_mappings_exit(struct vbg_dev *gdev) 132{ 133 struct vmmdev_hypervisorinfo *req; 134 int rc; 135 136 if (!gdev->guest_mappings) 137 return; 138 139 /* 140 * Tell the host that we're going to free the memory we reserved for 141 * it, the free it up. (Leak the memory if anything goes wrong here.) 142 */ 143 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_HYPERVISOR_INFO, 144 VBG_KERNEL_REQUEST); 145 if (!req) 146 return; 147 148 req->hypervisor_start = 0; 149 req->hypervisor_size = 0; 150 151 rc = vbg_req_perform(gdev, req); 152 153 vbg_req_free(req, sizeof(*req)); 154 155 if (rc < 0) { 156 vbg_err("%s error: %d\n", __func__, rc); 157 return; 158 } 159 160 vunmap(gdev->guest_mappings); 161 gdev->guest_mappings = NULL; 162 163 __free_page(gdev->guest_mappings_dummy_page); 164 gdev->guest_mappings_dummy_page = NULL; 165} 166 167/** 168 * vbg_report_guest_info - Report the guest information to the host. 169 * @gdev: The Guest extension device. 170 * 171 * Return: %0 or negative errno value. 172 */ 173static int vbg_report_guest_info(struct vbg_dev *gdev) 174{ 175 /* 176 * Allocate and fill in the two guest info reports. 177 */ 178 struct vmmdev_guest_info *req1 = NULL; 179 struct vmmdev_guest_info2 *req2 = NULL; 180 int rc, ret = -ENOMEM; 181 182 req1 = vbg_req_alloc(sizeof(*req1), VMMDEVREQ_REPORT_GUEST_INFO, 183 VBG_KERNEL_REQUEST); 184 req2 = vbg_req_alloc(sizeof(*req2), VMMDEVREQ_REPORT_GUEST_INFO2, 185 VBG_KERNEL_REQUEST); 186 if (!req1 || !req2) 187 goto out_free; 188 189 req1->interface_version = VMMDEV_VERSION; 190 req1->os_type = VMMDEV_OSTYPE_LINUX26; 191#if __BITS_PER_LONG == 64 192 req1->os_type |= VMMDEV_OSTYPE_X64; 193#endif 194 195 req2->additions_major = VBG_VERSION_MAJOR; 196 req2->additions_minor = VBG_VERSION_MINOR; 197 req2->additions_build = VBG_VERSION_BUILD; 198 req2->additions_revision = VBG_SVN_REV; 199 req2->additions_features = 200 VMMDEV_GUEST_INFO2_ADDITIONS_FEATURES_REQUESTOR_INFO; 201 strscpy(req2->name, VBG_VERSION_STRING, 202 sizeof(req2->name)); 203 204 /* 205 * There are two protocols here: 206 * 1. INFO2 + INFO1. Supported by >=3.2.51. 207 * 2. INFO1 and optionally INFO2. The old protocol. 208 * 209 * We try protocol 2 first. It will fail with VERR_NOT_SUPPORTED 210 * if not supported by the VMMDev (message ordering requirement). 211 */ 212 rc = vbg_req_perform(gdev, req2); 213 if (rc >= 0) { 214 rc = vbg_req_perform(gdev, req1); 215 } else if (rc == VERR_NOT_SUPPORTED || rc == VERR_NOT_IMPLEMENTED) { 216 rc = vbg_req_perform(gdev, req1); 217 if (rc >= 0) { 218 rc = vbg_req_perform(gdev, req2); 219 if (rc == VERR_NOT_IMPLEMENTED) 220 rc = VINF_SUCCESS; 221 } 222 } 223 ret = vbg_status_code_to_errno(rc); 224 225out_free: 226 vbg_req_free(req2, sizeof(*req2)); 227 vbg_req_free(req1, sizeof(*req1)); 228 return ret; 229} 230 231/** 232 * vbg_report_driver_status - Report the guest driver status to the host. 233 * @gdev: The Guest extension device. 234 * @active: Flag whether the driver is now active or not. 235 * 236 * Return: 0 or negative errno value. 237 */ 238static int vbg_report_driver_status(struct vbg_dev *gdev, bool active) 239{ 240 struct vmmdev_guest_status *req; 241 int rc; 242 243 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_REPORT_GUEST_STATUS, 244 VBG_KERNEL_REQUEST); 245 if (!req) 246 return -ENOMEM; 247 248 req->facility = VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER; 249 if (active) 250 req->status = VBOXGUEST_FACILITY_STATUS_ACTIVE; 251 else 252 req->status = VBOXGUEST_FACILITY_STATUS_INACTIVE; 253 req->flags = 0; 254 255 rc = vbg_req_perform(gdev, req); 256 if (rc == VERR_NOT_IMPLEMENTED) /* Compatibility with older hosts. */ 257 rc = VINF_SUCCESS; 258 259 vbg_req_free(req, sizeof(*req)); 260 261 return vbg_status_code_to_errno(rc); 262} 263 264/** 265 * vbg_balloon_inflate - Inflate the balloon by one chunk. The caller 266 * owns the balloon mutex. 267 * @gdev: The Guest extension device. 268 * @chunk_idx: Index of the chunk. 269 * 270 * Return: %0 or negative errno value. 271 */ 272static int vbg_balloon_inflate(struct vbg_dev *gdev, u32 chunk_idx) 273{ 274 struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req; 275 struct page **pages; 276 int i, rc, ret; 277 278 pages = kmalloc_array(VMMDEV_MEMORY_BALLOON_CHUNK_PAGES, 279 sizeof(*pages), 280 GFP_KERNEL | __GFP_NOWARN); 281 if (!pages) 282 return -ENOMEM; 283 284 req->header.size = sizeof(*req); 285 req->inflate = true; 286 req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; 287 288 for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++) { 289 pages[i] = alloc_page(GFP_KERNEL | __GFP_NOWARN); 290 if (!pages[i]) { 291 ret = -ENOMEM; 292 goto out_error; 293 } 294 295 req->phys_page[i] = page_to_phys(pages[i]); 296 } 297 298 rc = vbg_req_perform(gdev, req); 299 if (rc < 0) { 300 vbg_err("%s error, rc: %d\n", __func__, rc); 301 ret = vbg_status_code_to_errno(rc); 302 goto out_error; 303 } 304 305 gdev->mem_balloon.pages[chunk_idx] = pages; 306 307 return 0; 308 309out_error: 310 while (--i >= 0) 311 __free_page(pages[i]); 312 kfree(pages); 313 314 return ret; 315} 316 317/** 318 * vbg_balloon_deflate - Deflate the balloon by one chunk. The caller 319 * owns the balloon mutex. 320 * @gdev: The Guest extension device. 321 * @chunk_idx: Index of the chunk. 322 * 323 * Return: %0 or negative errno value. 324 */ 325static int vbg_balloon_deflate(struct vbg_dev *gdev, u32 chunk_idx) 326{ 327 struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req; 328 struct page **pages = gdev->mem_balloon.pages[chunk_idx]; 329 int i, rc; 330 331 req->header.size = sizeof(*req); 332 req->inflate = false; 333 req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; 334 335 for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++) 336 req->phys_page[i] = page_to_phys(pages[i]); 337 338 rc = vbg_req_perform(gdev, req); 339 if (rc < 0) { 340 vbg_err("%s error, rc: %d\n", __func__, rc); 341 return vbg_status_code_to_errno(rc); 342 } 343 344 for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++) 345 __free_page(pages[i]); 346 kfree(pages); 347 gdev->mem_balloon.pages[chunk_idx] = NULL; 348 349 return 0; 350} 351 352/* 353 * Respond to VMMDEV_EVENT_BALLOON_CHANGE_REQUEST events, query the size 354 * the host wants the balloon to be and adjust accordingly. 355 */ 356static void vbg_balloon_work(struct work_struct *work) 357{ 358 struct vbg_dev *gdev = 359 container_of(work, struct vbg_dev, mem_balloon.work); 360 struct vmmdev_memballoon_info *req = gdev->mem_balloon.get_req; 361 u32 i, chunks; 362 int rc, ret; 363 364 /* 365 * Setting this bit means that we request the value from the host and 366 * change the guest memory balloon according to the returned value. 367 */ 368 req->event_ack = VMMDEV_EVENT_BALLOON_CHANGE_REQUEST; 369 rc = vbg_req_perform(gdev, req); 370 if (rc < 0) { 371 vbg_err("%s error, rc: %d)\n", __func__, rc); 372 return; 373 } 374 375 /* 376 * The host always returns the same maximum amount of chunks, so 377 * we do this once. 378 */ 379 if (!gdev->mem_balloon.max_chunks) { 380 gdev->mem_balloon.pages = 381 devm_kcalloc(gdev->dev, req->phys_mem_chunks, 382 sizeof(struct page **), GFP_KERNEL); 383 if (!gdev->mem_balloon.pages) 384 return; 385 386 gdev->mem_balloon.max_chunks = req->phys_mem_chunks; 387 } 388 389 chunks = req->balloon_chunks; 390 if (chunks > gdev->mem_balloon.max_chunks) { 391 vbg_err("%s: illegal balloon size %u (max=%u)\n", 392 __func__, chunks, gdev->mem_balloon.max_chunks); 393 return; 394 } 395 396 if (chunks > gdev->mem_balloon.chunks) { 397 /* inflate */ 398 for (i = gdev->mem_balloon.chunks; i < chunks; i++) { 399 ret = vbg_balloon_inflate(gdev, i); 400 if (ret < 0) 401 return; 402 403 gdev->mem_balloon.chunks++; 404 } 405 } else { 406 /* deflate */ 407 for (i = gdev->mem_balloon.chunks; i-- > chunks;) { 408 ret = vbg_balloon_deflate(gdev, i); 409 if (ret < 0) 410 return; 411 412 gdev->mem_balloon.chunks--; 413 } 414 } 415} 416 417/* 418 * Callback for heartbeat timer. 419 */ 420static void vbg_heartbeat_timer(struct timer_list *t) 421{ 422 struct vbg_dev *gdev = from_timer(gdev, t, heartbeat_timer); 423 424 vbg_req_perform(gdev, gdev->guest_heartbeat_req); 425 mod_timer(&gdev->heartbeat_timer, 426 msecs_to_jiffies(gdev->heartbeat_interval_ms)); 427} 428 429/** 430 * vbg_heartbeat_host_config - Configure the host to check guest's heartbeat 431 * and get heartbeat interval from the host. 432 * @gdev: The Guest extension device. 433 * @enabled: Set true to enable guest heartbeat checks on host. 434 * 435 * Return: %0 or negative errno value. 436 */ 437static int vbg_heartbeat_host_config(struct vbg_dev *gdev, bool enabled) 438{ 439 struct vmmdev_heartbeat *req; 440 int rc; 441 442 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_HEARTBEAT_CONFIGURE, 443 VBG_KERNEL_REQUEST); 444 if (!req) 445 return -ENOMEM; 446 447 req->enabled = enabled; 448 req->interval_ns = 0; 449 rc = vbg_req_perform(gdev, req); 450 do_div(req->interval_ns, 1000000); /* ns -> ms */ 451 gdev->heartbeat_interval_ms = req->interval_ns; 452 vbg_req_free(req, sizeof(*req)); 453 454 return vbg_status_code_to_errno(rc); 455} 456 457/** 458 * vbg_heartbeat_init - Initializes the heartbeat timer. This feature 459 * may be disabled by the host. 460 * @gdev: The Guest extension device. 461 * 462 * Return: %0 or negative errno value. 463 */ 464static int vbg_heartbeat_init(struct vbg_dev *gdev) 465{ 466 int ret; 467 468 /* Make sure that heartbeat checking is disabled if we fail. */ 469 ret = vbg_heartbeat_host_config(gdev, false); 470 if (ret < 0) 471 return ret; 472 473 ret = vbg_heartbeat_host_config(gdev, true); 474 if (ret < 0) 475 return ret; 476 477 gdev->guest_heartbeat_req = vbg_req_alloc( 478 sizeof(*gdev->guest_heartbeat_req), 479 VMMDEVREQ_GUEST_HEARTBEAT, 480 VBG_KERNEL_REQUEST); 481 if (!gdev->guest_heartbeat_req) 482 return -ENOMEM; 483 484 vbg_info("%s: Setting up heartbeat to trigger every %d milliseconds\n", 485 __func__, gdev->heartbeat_interval_ms); 486 mod_timer(&gdev->heartbeat_timer, 0); 487 488 return 0; 489} 490 491/** 492 * vbg_heartbeat_exit - Cleanup heartbeat code, stop HB timer and disable 493 * host heartbeat checking. 494 * @gdev: The Guest extension device. 495 */ 496static void vbg_heartbeat_exit(struct vbg_dev *gdev) 497{ 498 del_timer_sync(&gdev->heartbeat_timer); 499 vbg_heartbeat_host_config(gdev, false); 500 vbg_req_free(gdev->guest_heartbeat_req, 501 sizeof(*gdev->guest_heartbeat_req)); 502} 503 504/** 505 * vbg_track_bit_usage - Applies a change to the bit usage tracker. 506 * @tracker: The bit usage tracker. 507 * @changed: The bits to change. 508 * @previous: The previous value of the bits. 509 * 510 * Return: %true if the mask changed, %false if not. 511 */ 512static bool vbg_track_bit_usage(struct vbg_bit_usage_tracker *tracker, 513 u32 changed, u32 previous) 514{ 515 bool global_change = false; 516 517 while (changed) { 518 u32 bit = ffs(changed) - 1; 519 u32 bitmask = BIT(bit); 520 521 if (bitmask & previous) { 522 tracker->per_bit_usage[bit] -= 1; 523 if (tracker->per_bit_usage[bit] == 0) { 524 global_change = true; 525 tracker->mask &= ~bitmask; 526 } 527 } else { 528 tracker->per_bit_usage[bit] += 1; 529 if (tracker->per_bit_usage[bit] == 1) { 530 global_change = true; 531 tracker->mask |= bitmask; 532 } 533 } 534 535 changed &= ~bitmask; 536 } 537 538 return global_change; 539} 540 541/** 542 * vbg_reset_host_event_filter - Init and termination worker for 543 * resetting the (host) event filter on the host 544 * @gdev: The Guest extension device. 545 * @fixed_events: Fixed events (init time). 546 * 547 * Return: %0 or negative errno value. 548 */ 549static int vbg_reset_host_event_filter(struct vbg_dev *gdev, 550 u32 fixed_events) 551{ 552 struct vmmdev_mask *req; 553 int rc; 554 555 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK, 556 VBG_KERNEL_REQUEST); 557 if (!req) 558 return -ENOMEM; 559 560 req->not_mask = U32_MAX & ~fixed_events; 561 req->or_mask = fixed_events; 562 rc = vbg_req_perform(gdev, req); 563 if (rc < 0) 564 vbg_err("%s error, rc: %d\n", __func__, rc); 565 566 vbg_req_free(req, sizeof(*req)); 567 return vbg_status_code_to_errno(rc); 568} 569 570/** 571 * vbg_set_session_event_filter - Changes the event filter mask for the 572 * given session. 573 * @gdev: The Guest extension device. 574 * @session: The session. 575 * @or_mask: The events to add. 576 * @not_mask: The events to remove. 577 * @session_termination: Set if we're called by the session cleanup code. 578 * This tweaks the error handling so we perform 579 * proper session cleanup even if the host 580 * misbehaves. 581 * 582 * This is called in response to VBG_IOCTL_CHANGE_FILTER_MASK as well as to 583 * do session cleanup. Takes the session mutex. 584 * 585 * Return: 0 or negative errno value. 586 */ 587static int vbg_set_session_event_filter(struct vbg_dev *gdev, 588 struct vbg_session *session, 589 u32 or_mask, u32 not_mask, 590 bool session_termination) 591{ 592 struct vmmdev_mask *req; 593 u32 changed, previous; 594 int rc, ret = 0; 595 596 /* 597 * Allocate a request buffer before taking the spinlock, when 598 * the session is being terminated the requestor is the kernel, 599 * as we're cleaning up. 600 */ 601 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK, 602 session_termination ? VBG_KERNEL_REQUEST : 603 session->requestor); 604 if (!req) { 605 if (!session_termination) 606 return -ENOMEM; 607 /* Ignore allocation failure, we must do session cleanup. */ 608 } 609 610 mutex_lock(&gdev->session_mutex); 611 612 /* Apply the changes to the session mask. */ 613 previous = session->event_filter; 614 session->event_filter |= or_mask; 615 session->event_filter &= ~not_mask; 616 617 /* If anything actually changed, update the global usage counters. */ 618 changed = previous ^ session->event_filter; 619 if (!changed) 620 goto out; 621 622 vbg_track_bit_usage(&gdev->event_filter_tracker, changed, previous); 623 or_mask = gdev->fixed_events | gdev->event_filter_tracker.mask; 624 625 if (gdev->event_filter_host == or_mask || !req) 626 goto out; 627 628 gdev->event_filter_host = or_mask; 629 req->or_mask = or_mask; 630 req->not_mask = ~or_mask; 631 rc = vbg_req_perform(gdev, req); 632 if (rc < 0) { 633 ret = vbg_status_code_to_errno(rc); 634 635 /* Failed, roll back (unless it's session termination time). */ 636 gdev->event_filter_host = U32_MAX; 637 if (session_termination) 638 goto out; 639 640 vbg_track_bit_usage(&gdev->event_filter_tracker, changed, 641 session->event_filter); 642 session->event_filter = previous; 643 } 644 645out: 646 mutex_unlock(&gdev->session_mutex); 647 vbg_req_free(req, sizeof(*req)); 648 649 return ret; 650} 651 652/** 653 * vbg_reset_host_capabilities - Init and termination worker for set 654 * guest capabilities to zero on the host. 655 * @gdev: The Guest extension device. 656 * 657 * Return: %0 or negative errno value. 658 */ 659static int vbg_reset_host_capabilities(struct vbg_dev *gdev) 660{ 661 struct vmmdev_mask *req; 662 int rc; 663 664 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES, 665 VBG_KERNEL_REQUEST); 666 if (!req) 667 return -ENOMEM; 668 669 req->not_mask = U32_MAX; 670 req->or_mask = 0; 671 rc = vbg_req_perform(gdev, req); 672 if (rc < 0) 673 vbg_err("%s error, rc: %d\n", __func__, rc); 674 675 vbg_req_free(req, sizeof(*req)); 676 return vbg_status_code_to_errno(rc); 677} 678 679/** 680 * vbg_set_host_capabilities - Set guest capabilities on the host. 681 * @gdev: The Guest extension device. 682 * @session: The session. 683 * @session_termination: Set if we're called by the session cleanup code. 684 * 685 * Must be called with gdev->session_mutex hold. 686 * 687 * Return: %0 or negative errno value. 688 */ 689static int vbg_set_host_capabilities(struct vbg_dev *gdev, 690 struct vbg_session *session, 691 bool session_termination) 692{ 693 struct vmmdev_mask *req; 694 u32 caps; 695 int rc; 696 697 WARN_ON(!mutex_is_locked(&gdev->session_mutex)); 698 699 caps = gdev->acquired_guest_caps | gdev->set_guest_caps_tracker.mask; 700 701 if (gdev->guest_caps_host == caps) 702 return 0; 703 704 /* On termination the requestor is the kernel, as we're cleaning up. */ 705 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES, 706 session_termination ? VBG_KERNEL_REQUEST : 707 session->requestor); 708 if (!req) { 709 gdev->guest_caps_host = U32_MAX; 710 return -ENOMEM; 711 } 712 713 req->or_mask = caps; 714 req->not_mask = ~caps; 715 rc = vbg_req_perform(gdev, req); 716 vbg_req_free(req, sizeof(*req)); 717 718 gdev->guest_caps_host = (rc >= 0) ? caps : U32_MAX; 719 720 return vbg_status_code_to_errno(rc); 721} 722 723/** 724 * vbg_acquire_session_capabilities - Acquire (get exclusive access) 725 * guest capabilities for a session. 726 * @gdev: The Guest extension device. 727 * @session: The session. 728 * @flags: Flags (VBGL_IOC_AGC_FLAGS_XXX). 729 * @or_mask: The capabilities to add. 730 * @not_mask: The capabilities to remove. 731 * @session_termination: Set if we're called by the session cleanup code. 732 * This tweaks the error handling so we perform 733 * proper session cleanup even if the host 734 * misbehaves. 735 * 736 * Takes the session mutex. 737 * 738 * Return: %0 or negative errno value. 739 */ 740static int vbg_acquire_session_capabilities(struct vbg_dev *gdev, 741 struct vbg_session *session, 742 u32 or_mask, u32 not_mask, 743 u32 flags, bool session_termination) 744{ 745 unsigned long irqflags; 746 bool wakeup = false; 747 int ret = 0; 748 749 mutex_lock(&gdev->session_mutex); 750 751 if (gdev->set_guest_caps_tracker.mask & or_mask) { 752 vbg_err("%s error: cannot acquire caps which are currently set\n", 753 __func__); 754 ret = -EINVAL; 755 goto out; 756 } 757 758 /* 759 * Mark any caps in the or_mask as now being in acquire-mode. Note 760 * once caps are in acquire_mode they always stay in this mode. 761 * This impacts event handling, so we take the event-lock. 762 */ 763 spin_lock_irqsave(&gdev->event_spinlock, irqflags); 764 gdev->acquire_mode_guest_caps |= or_mask; 765 spin_unlock_irqrestore(&gdev->event_spinlock, irqflags); 766 767 /* If we only have to switch the caps to acquire mode, we're done. */ 768 if (flags & VBGL_IOC_AGC_FLAGS_CONFIG_ACQUIRE_MODE) 769 goto out; 770 771 not_mask &= ~or_mask; /* or_mask takes priority over not_mask */ 772 not_mask &= session->acquired_guest_caps; 773 or_mask &= ~session->acquired_guest_caps; 774 775 if (or_mask == 0 && not_mask == 0) 776 goto out; 777 778 if (gdev->acquired_guest_caps & or_mask) { 779 ret = -EBUSY; 780 goto out; 781 } 782 783 gdev->acquired_guest_caps |= or_mask; 784 gdev->acquired_guest_caps &= ~not_mask; 785 /* session->acquired_guest_caps impacts event handling, take the lock */ 786 spin_lock_irqsave(&gdev->event_spinlock, irqflags); 787 session->acquired_guest_caps |= or_mask; 788 session->acquired_guest_caps &= ~not_mask; 789 spin_unlock_irqrestore(&gdev->event_spinlock, irqflags); 790 791 ret = vbg_set_host_capabilities(gdev, session, session_termination); 792 /* Roll back on failure, unless it's session termination time. */ 793 if (ret < 0 && !session_termination) { 794 gdev->acquired_guest_caps &= ~or_mask; 795 gdev->acquired_guest_caps |= not_mask; 796 spin_lock_irqsave(&gdev->event_spinlock, irqflags); 797 session->acquired_guest_caps &= ~or_mask; 798 session->acquired_guest_caps |= not_mask; 799 spin_unlock_irqrestore(&gdev->event_spinlock, irqflags); 800 } 801 802 /* 803 * If we added a capability, check if that means some other thread in 804 * our session should be unblocked because there are events pending 805 * (the result of vbg_get_allowed_event_mask_for_session() may change). 806 * 807 * HACK ALERT! When the seamless support capability is added we generate 808 * a seamless change event so that the ring-3 client can sync with 809 * the seamless state. 810 */ 811 if (ret == 0 && or_mask != 0) { 812 spin_lock_irqsave(&gdev->event_spinlock, irqflags); 813 814 if (or_mask & VMMDEV_GUEST_SUPPORTS_SEAMLESS) 815 gdev->pending_events |= 816 VMMDEV_EVENT_SEAMLESS_MODE_CHANGE_REQUEST; 817 818 if (gdev->pending_events) 819 wakeup = true; 820 821 spin_unlock_irqrestore(&gdev->event_spinlock, irqflags); 822 823 if (wakeup) 824 wake_up(&gdev->event_wq); 825 } 826 827out: 828 mutex_unlock(&gdev->session_mutex); 829 830 return ret; 831} 832 833/** 834 * vbg_set_session_capabilities - Sets the guest capabilities for a 835 * session. Takes the session mutex. 836 * @gdev: The Guest extension device. 837 * @session: The session. 838 * @or_mask: The capabilities to add. 839 * @not_mask: The capabilities to remove. 840 * @session_termination: Set if we're called by the session cleanup code. 841 * This tweaks the error handling so we perform 842 * proper session cleanup even if the host 843 * misbehaves. 844 * 845 * Return: %0 or negative errno value. 846 */ 847static int vbg_set_session_capabilities(struct vbg_dev *gdev, 848 struct vbg_session *session, 849 u32 or_mask, u32 not_mask, 850 bool session_termination) 851{ 852 u32 changed, previous; 853 int ret = 0; 854 855 mutex_lock(&gdev->session_mutex); 856 857 if (gdev->acquire_mode_guest_caps & or_mask) { 858 vbg_err("%s error: cannot set caps which are in acquire_mode\n", 859 __func__); 860 ret = -EBUSY; 861 goto out; 862 } 863 864 /* Apply the changes to the session mask. */ 865 previous = session->set_guest_caps; 866 session->set_guest_caps |= or_mask; 867 session->set_guest_caps &= ~not_mask; 868 869 /* If anything actually changed, update the global usage counters. */ 870 changed = previous ^ session->set_guest_caps; 871 if (!changed) 872 goto out; 873 874 vbg_track_bit_usage(&gdev->set_guest_caps_tracker, changed, previous); 875 876 ret = vbg_set_host_capabilities(gdev, session, session_termination); 877 /* Roll back on failure, unless it's session termination time. */ 878 if (ret < 0 && !session_termination) { 879 vbg_track_bit_usage(&gdev->set_guest_caps_tracker, changed, 880 session->set_guest_caps); 881 session->set_guest_caps = previous; 882 } 883 884out: 885 mutex_unlock(&gdev->session_mutex); 886 887 return ret; 888} 889 890/** 891 * vbg_query_host_version - get the host feature mask and version information. 892 * @gdev: The Guest extension device. 893 * 894 * Return: %0 or negative errno value. 895 */ 896static int vbg_query_host_version(struct vbg_dev *gdev) 897{ 898 struct vmmdev_host_version *req; 899 int rc, ret; 900 901 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HOST_VERSION, 902 VBG_KERNEL_REQUEST); 903 if (!req) 904 return -ENOMEM; 905 906 rc = vbg_req_perform(gdev, req); 907 ret = vbg_status_code_to_errno(rc); 908 if (ret) { 909 vbg_err("%s error: %d\n", __func__, rc); 910 goto out; 911 } 912 913 snprintf(gdev->host_version, sizeof(gdev->host_version), "%u.%u.%ur%u", 914 req->major, req->minor, req->build, req->revision); 915 gdev->host_features = req->features; 916 917 vbg_info("vboxguest: host-version: %s %#x\n", gdev->host_version, 918 gdev->host_features); 919 920 if (!(req->features & VMMDEV_HVF_HGCM_PHYS_PAGE_LIST)) { 921 vbg_err("vboxguest: Error host too old (does not support page-lists)\n"); 922 ret = -ENODEV; 923 } 924 925out: 926 vbg_req_free(req, sizeof(*req)); 927 return ret; 928} 929 930/** 931 * vbg_core_init - Initializes the VBoxGuest device extension when the 932 * device driver is loaded. 933 * @gdev: The Guest extension device. 934 * @fixed_events: Events that will be enabled upon init and no client 935 * will ever be allowed to mask. 936 * 937 * The native code locates the VMMDev on the PCI bus and retrieve 938 * the MMIO and I/O port ranges, this function will take care of 939 * mapping the MMIO memory (if present). Upon successful return 940 * the native code should set up the interrupt handler. 941 * 942 * Return: %0 or negative errno value. 943 */ 944int vbg_core_init(struct vbg_dev *gdev, u32 fixed_events) 945{ 946 int ret = -ENOMEM; 947 948 gdev->fixed_events = fixed_events | VMMDEV_EVENT_HGCM; 949 gdev->event_filter_host = U32_MAX; /* forces a report */ 950 gdev->guest_caps_host = U32_MAX; /* forces a report */ 951 952 init_waitqueue_head(&gdev->event_wq); 953 init_waitqueue_head(&gdev->hgcm_wq); 954 spin_lock_init(&gdev->event_spinlock); 955 mutex_init(&gdev->session_mutex); 956 mutex_init(&gdev->cancel_req_mutex); 957 timer_setup(&gdev->heartbeat_timer, vbg_heartbeat_timer, 0); 958 INIT_WORK(&gdev->mem_balloon.work, vbg_balloon_work); 959 960 gdev->mem_balloon.get_req = 961 vbg_req_alloc(sizeof(*gdev->mem_balloon.get_req), 962 VMMDEVREQ_GET_MEMBALLOON_CHANGE_REQ, 963 VBG_KERNEL_REQUEST); 964 gdev->mem_balloon.change_req = 965 vbg_req_alloc(sizeof(*gdev->mem_balloon.change_req), 966 VMMDEVREQ_CHANGE_MEMBALLOON, 967 VBG_KERNEL_REQUEST); 968 gdev->cancel_req = 969 vbg_req_alloc(sizeof(*(gdev->cancel_req)), 970 VMMDEVREQ_HGCM_CANCEL2, 971 VBG_KERNEL_REQUEST); 972 gdev->ack_events_req = 973 vbg_req_alloc(sizeof(*gdev->ack_events_req), 974 VMMDEVREQ_ACKNOWLEDGE_EVENTS, 975 VBG_KERNEL_REQUEST); 976 gdev->mouse_status_req = 977 vbg_req_alloc(sizeof(*gdev->mouse_status_req), 978 VMMDEVREQ_GET_MOUSE_STATUS, 979 VBG_KERNEL_REQUEST); 980 981 if (!gdev->mem_balloon.get_req || !gdev->mem_balloon.change_req || 982 !gdev->cancel_req || !gdev->ack_events_req || 983 !gdev->mouse_status_req) 984 goto err_free_reqs; 985 986 ret = vbg_query_host_version(gdev); 987 if (ret) 988 goto err_free_reqs; 989 990 ret = vbg_report_guest_info(gdev); 991 if (ret) { 992 vbg_err("vboxguest: vbg_report_guest_info error: %d\n", ret); 993 goto err_free_reqs; 994 } 995 996 ret = vbg_reset_host_event_filter(gdev, gdev->fixed_events); 997 if (ret) { 998 vbg_err("vboxguest: Error setting fixed event filter: %d\n", 999 ret); 1000 goto err_free_reqs; 1001 } 1002 1003 ret = vbg_reset_host_capabilities(gdev); 1004 if (ret) { 1005 vbg_err("vboxguest: Error clearing guest capabilities: %d\n", 1006 ret); 1007 goto err_free_reqs; 1008 } 1009 1010 ret = vbg_core_set_mouse_status(gdev, 0); 1011 if (ret) { 1012 vbg_err("vboxguest: Error clearing mouse status: %d\n", ret); 1013 goto err_free_reqs; 1014 } 1015 1016 /* These may fail without requiring the driver init to fail. */ 1017 vbg_guest_mappings_init(gdev); 1018 vbg_heartbeat_init(gdev); 1019 1020 /* All Done! */ 1021 ret = vbg_report_driver_status(gdev, true); 1022 if (ret < 0) 1023 vbg_err("vboxguest: Error reporting driver status: %d\n", ret); 1024 1025 return 0; 1026 1027err_free_reqs: 1028 vbg_req_free(gdev->mouse_status_req, 1029 sizeof(*gdev->mouse_status_req)); 1030 vbg_req_free(gdev->ack_events_req, 1031 sizeof(*gdev->ack_events_req)); 1032 vbg_req_free(gdev->cancel_req, 1033 sizeof(*gdev->cancel_req)); 1034 vbg_req_free(gdev->mem_balloon.change_req, 1035 sizeof(*gdev->mem_balloon.change_req)); 1036 vbg_req_free(gdev->mem_balloon.get_req, 1037 sizeof(*gdev->mem_balloon.get_req)); 1038 return ret; 1039} 1040 1041/** 1042 * vbg_core_exit - Call this on exit to clean-up vboxguest-core managed 1043 * resources. 1044 * @gdev: The Guest extension device. 1045 * 1046 * The native code should call this before the driver is loaded, 1047 * but don't call this on shutdown. 1048 */ 1049void vbg_core_exit(struct vbg_dev *gdev) 1050{ 1051 vbg_heartbeat_exit(gdev); 1052 vbg_guest_mappings_exit(gdev); 1053 1054 /* Clear the host flags (mouse status etc). */ 1055 vbg_reset_host_event_filter(gdev, 0); 1056 vbg_reset_host_capabilities(gdev); 1057 vbg_core_set_mouse_status(gdev, 0); 1058 1059 vbg_req_free(gdev->mouse_status_req, 1060 sizeof(*gdev->mouse_status_req)); 1061 vbg_req_free(gdev->ack_events_req, 1062 sizeof(*gdev->ack_events_req)); 1063 vbg_req_free(gdev->cancel_req, 1064 sizeof(*gdev->cancel_req)); 1065 vbg_req_free(gdev->mem_balloon.change_req, 1066 sizeof(*gdev->mem_balloon.change_req)); 1067 vbg_req_free(gdev->mem_balloon.get_req, 1068 sizeof(*gdev->mem_balloon.get_req)); 1069} 1070 1071/** 1072 * vbg_core_open_session - Creates a VBoxGuest user session. 1073 * @gdev: The Guest extension device. 1074 * @requestor: VMMDEV_REQUESTOR_* flags 1075 * 1076 * vboxguest_linux.c calls this when userspace opens the char-device. 1077 * 1078 * Return: A pointer to the new session or an ERR_PTR on error. 1079 */ 1080struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, u32 requestor) 1081{ 1082 struct vbg_session *session; 1083 1084 session = kzalloc(sizeof(*session), GFP_KERNEL); 1085 if (!session) 1086 return ERR_PTR(-ENOMEM); 1087 1088 session->gdev = gdev; 1089 session->requestor = requestor; 1090 1091 return session; 1092} 1093 1094/** 1095 * vbg_core_close_session - Closes a VBoxGuest session. 1096 * @session: The session to close (and free). 1097 */ 1098void vbg_core_close_session(struct vbg_session *session) 1099{ 1100 struct vbg_dev *gdev = session->gdev; 1101 int i, rc; 1102 1103 vbg_acquire_session_capabilities(gdev, session, 0, U32_MAX, 0, true); 1104 vbg_set_session_capabilities(gdev, session, 0, U32_MAX, true); 1105 vbg_set_session_event_filter(gdev, session, 0, U32_MAX, true); 1106 1107 for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) { 1108 if (!session->hgcm_client_ids[i]) 1109 continue; 1110 1111 /* requestor is kernel here, as we're cleaning up. */ 1112 vbg_hgcm_disconnect(gdev, VBG_KERNEL_REQUEST, 1113 session->hgcm_client_ids[i], &rc); 1114 } 1115 1116 kfree(session); 1117} 1118 1119static int vbg_ioctl_chk(struct vbg_ioctl_hdr *hdr, size_t in_size, 1120 size_t out_size) 1121{ 1122 if (hdr->size_in != (sizeof(*hdr) + in_size) || 1123 hdr->size_out != (sizeof(*hdr) + out_size)) 1124 return -EINVAL; 1125 1126 return 0; 1127} 1128 1129static int vbg_ioctl_driver_version_info( 1130 struct vbg_ioctl_driver_version_info *info) 1131{ 1132 const u16 vbg_maj_version = VBG_IOC_VERSION >> 16; 1133 u16 min_maj_version, req_maj_version; 1134 1135 if (vbg_ioctl_chk(&info->hdr, sizeof(info->u.in), sizeof(info->u.out))) 1136 return -EINVAL; 1137 1138 req_maj_version = info->u.in.req_version >> 16; 1139 min_maj_version = info->u.in.min_version >> 16; 1140 1141 if (info->u.in.min_version > info->u.in.req_version || 1142 min_maj_version != req_maj_version) 1143 return -EINVAL; 1144 1145 if (info->u.in.min_version <= VBG_IOC_VERSION && 1146 min_maj_version == vbg_maj_version) { 1147 info->u.out.session_version = VBG_IOC_VERSION; 1148 } else { 1149 info->u.out.session_version = U32_MAX; 1150 info->hdr.rc = VERR_VERSION_MISMATCH; 1151 } 1152 1153 info->u.out.driver_version = VBG_IOC_VERSION; 1154 info->u.out.driver_revision = 0; 1155 info->u.out.reserved1 = 0; 1156 info->u.out.reserved2 = 0; 1157 1158 return 0; 1159} 1160 1161/* Must be called with the event_lock held */ 1162static u32 vbg_get_allowed_event_mask_for_session(struct vbg_dev *gdev, 1163 struct vbg_session *session) 1164{ 1165 u32 acquire_mode_caps = gdev->acquire_mode_guest_caps; 1166 u32 session_acquired_caps = session->acquired_guest_caps; 1167 u32 allowed_events = VMMDEV_EVENT_VALID_EVENT_MASK; 1168 1169 if ((acquire_mode_caps & VMMDEV_GUEST_SUPPORTS_GRAPHICS) && 1170 !(session_acquired_caps & VMMDEV_GUEST_SUPPORTS_GRAPHICS)) 1171 allowed_events &= ~VMMDEV_EVENT_DISPLAY_CHANGE_REQUEST; 1172 1173 if ((acquire_mode_caps & VMMDEV_GUEST_SUPPORTS_SEAMLESS) && 1174 !(session_acquired_caps & VMMDEV_GUEST_SUPPORTS_SEAMLESS)) 1175 allowed_events &= ~VMMDEV_EVENT_SEAMLESS_MODE_CHANGE_REQUEST; 1176 1177 return allowed_events; 1178} 1179 1180static bool vbg_wait_event_cond(struct vbg_dev *gdev, 1181 struct vbg_session *session, 1182 u32 event_mask) 1183{ 1184 unsigned long flags; 1185 bool wakeup; 1186 u32 events; 1187 1188 spin_lock_irqsave(&gdev->event_spinlock, flags); 1189 1190 events = gdev->pending_events & event_mask; 1191 events &= vbg_get_allowed_event_mask_for_session(gdev, session); 1192 wakeup = events || session->cancel_waiters; 1193 1194 spin_unlock_irqrestore(&gdev->event_spinlock, flags); 1195 1196 return wakeup; 1197} 1198 1199/* Must be called with the event_lock held */ 1200static u32 vbg_consume_events_locked(struct vbg_dev *gdev, 1201 struct vbg_session *session, 1202 u32 event_mask) 1203{ 1204 u32 events = gdev->pending_events & event_mask; 1205 1206 events &= vbg_get_allowed_event_mask_for_session(gdev, session); 1207 gdev->pending_events &= ~events; 1208 return events; 1209} 1210 1211static int vbg_ioctl_wait_for_events(struct vbg_dev *gdev, 1212 struct vbg_session *session, 1213 struct vbg_ioctl_wait_for_events *wait) 1214{ 1215 u32 timeout_ms = wait->u.in.timeout_ms; 1216 u32 event_mask = wait->u.in.events; 1217 unsigned long flags; 1218 long timeout; 1219 int ret = 0; 1220 1221 if (vbg_ioctl_chk(&wait->hdr, sizeof(wait->u.in), sizeof(wait->u.out))) 1222 return -EINVAL; 1223 1224 if (timeout_ms == U32_MAX) 1225 timeout = MAX_SCHEDULE_TIMEOUT; 1226 else 1227 timeout = msecs_to_jiffies(timeout_ms); 1228 1229 wait->u.out.events = 0; 1230 do { 1231 timeout = wait_event_interruptible_timeout( 1232 gdev->event_wq, 1233 vbg_wait_event_cond(gdev, session, event_mask), 1234 timeout); 1235 1236 spin_lock_irqsave(&gdev->event_spinlock, flags); 1237 1238 if (timeout < 0 || session->cancel_waiters) { 1239 ret = -EINTR; 1240 } else if (timeout == 0) { 1241 ret = -ETIMEDOUT; 1242 } else { 1243 wait->u.out.events = 1244 vbg_consume_events_locked(gdev, session, event_mask); 1245 } 1246 1247 spin_unlock_irqrestore(&gdev->event_spinlock, flags); 1248 1249 /* 1250 * Someone else may have consumed the event(s) first, in 1251 * which case we go back to waiting. 1252 */ 1253 } while (ret == 0 && wait->u.out.events == 0); 1254 1255 return ret; 1256} 1257 1258static int vbg_ioctl_interrupt_all_wait_events(struct vbg_dev *gdev, 1259 struct vbg_session *session, 1260 struct vbg_ioctl_hdr *hdr) 1261{ 1262 unsigned long flags; 1263 1264 if (hdr->size_in != sizeof(*hdr) || hdr->size_out != sizeof(*hdr)) 1265 return -EINVAL; 1266 1267 spin_lock_irqsave(&gdev->event_spinlock, flags); 1268 session->cancel_waiters = true; 1269 spin_unlock_irqrestore(&gdev->event_spinlock, flags); 1270 1271 wake_up(&gdev->event_wq); 1272 1273 return 0; 1274} 1275 1276/** 1277 * vbg_req_allowed - Checks if the VMM request is allowed in the 1278 * context of the given session. 1279 * @gdev: The Guest extension device. 1280 * @session: The calling session. 1281 * @req: The request. 1282 * 1283 * Return: %0 or negative errno value. 1284 */ 1285static int vbg_req_allowed(struct vbg_dev *gdev, struct vbg_session *session, 1286 const struct vmmdev_request_header *req) 1287{ 1288 const struct vmmdev_guest_status *guest_status; 1289 bool trusted_apps_only; 1290 1291 switch (req->request_type) { 1292 /* Trusted users apps only. */ 1293 case VMMDEVREQ_QUERY_CREDENTIALS: 1294 case VMMDEVREQ_REPORT_CREDENTIALS_JUDGEMENT: 1295 case VMMDEVREQ_REGISTER_SHARED_MODULE: 1296 case VMMDEVREQ_UNREGISTER_SHARED_MODULE: 1297 case VMMDEVREQ_WRITE_COREDUMP: 1298 case VMMDEVREQ_GET_CPU_HOTPLUG_REQ: 1299 case VMMDEVREQ_SET_CPU_HOTPLUG_STATUS: 1300 case VMMDEVREQ_CHECK_SHARED_MODULES: 1301 case VMMDEVREQ_GET_PAGE_SHARING_STATUS: 1302 case VMMDEVREQ_DEBUG_IS_PAGE_SHARED: 1303 case VMMDEVREQ_REPORT_GUEST_STATS: 1304 case VMMDEVREQ_REPORT_GUEST_USER_STATE: 1305 case VMMDEVREQ_GET_STATISTICS_CHANGE_REQ: 1306 trusted_apps_only = true; 1307 break; 1308 1309 /* Anyone. */ 1310 case VMMDEVREQ_GET_MOUSE_STATUS: 1311 case VMMDEVREQ_SET_MOUSE_STATUS: 1312 case VMMDEVREQ_SET_POINTER_SHAPE: 1313 case VMMDEVREQ_GET_HOST_VERSION: 1314 case VMMDEVREQ_IDLE: 1315 case VMMDEVREQ_GET_HOST_TIME: 1316 case VMMDEVREQ_SET_POWER_STATUS: 1317 case VMMDEVREQ_ACKNOWLEDGE_EVENTS: 1318 case VMMDEVREQ_CTL_GUEST_FILTER_MASK: 1319 case VMMDEVREQ_REPORT_GUEST_STATUS: 1320 case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ: 1321 case VMMDEVREQ_VIDEMODE_SUPPORTED: 1322 case VMMDEVREQ_GET_HEIGHT_REDUCTION: 1323 case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ2: 1324 case VMMDEVREQ_VIDEMODE_SUPPORTED2: 1325 case VMMDEVREQ_VIDEO_ACCEL_ENABLE: 1326 case VMMDEVREQ_VIDEO_ACCEL_FLUSH: 1327 case VMMDEVREQ_VIDEO_SET_VISIBLE_REGION: 1328 case VMMDEVREQ_VIDEO_UPDATE_MONITOR_POSITIONS: 1329 case VMMDEVREQ_GET_DISPLAY_CHANGE_REQEX: 1330 case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ_MULTI: 1331 case VMMDEVREQ_GET_SEAMLESS_CHANGE_REQ: 1332 case VMMDEVREQ_GET_VRDPCHANGE_REQ: 1333 case VMMDEVREQ_LOG_STRING: 1334 case VMMDEVREQ_GET_SESSION_ID: 1335 trusted_apps_only = false; 1336 break; 1337 1338 /* Depends on the request parameters... */ 1339 case VMMDEVREQ_REPORT_GUEST_CAPABILITIES: 1340 guest_status = (const struct vmmdev_guest_status *)req; 1341 switch (guest_status->facility) { 1342 case VBOXGUEST_FACILITY_TYPE_ALL: 1343 case VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER: 1344 vbg_err("Denying userspace vmm report guest cap. call facility %#08x\n", 1345 guest_status->facility); 1346 return -EPERM; 1347 case VBOXGUEST_FACILITY_TYPE_VBOX_SERVICE: 1348 trusted_apps_only = true; 1349 break; 1350 case VBOXGUEST_FACILITY_TYPE_VBOX_TRAY_CLIENT: 1351 case VBOXGUEST_FACILITY_TYPE_SEAMLESS: 1352 case VBOXGUEST_FACILITY_TYPE_GRAPHICS: 1353 default: 1354 trusted_apps_only = false; 1355 break; 1356 } 1357 break; 1358 1359 /* Anything else is not allowed. */ 1360 default: 1361 vbg_err("Denying userspace vmm call type %#08x\n", 1362 req->request_type); 1363 return -EPERM; 1364 } 1365 1366 if (trusted_apps_only && 1367 (session->requestor & VMMDEV_REQUESTOR_USER_DEVICE)) { 1368 vbg_err("Denying userspace vmm call type %#08x through vboxuser device node\n", 1369 req->request_type); 1370 return -EPERM; 1371 } 1372 1373 return 0; 1374} 1375 1376static int vbg_ioctl_vmmrequest(struct vbg_dev *gdev, 1377 struct vbg_session *session, void *data) 1378{ 1379 struct vbg_ioctl_hdr *hdr = data; 1380 int ret; 1381 1382 if (hdr->size_in != hdr->size_out) 1383 return -EINVAL; 1384 1385 if (hdr->size_in > VMMDEV_MAX_VMMDEVREQ_SIZE) 1386 return -E2BIG; 1387 1388 if (hdr->type == VBG_IOCTL_HDR_TYPE_DEFAULT) 1389 return -EINVAL; 1390 1391 ret = vbg_req_allowed(gdev, session, data); 1392 if (ret < 0) 1393 return ret; 1394 1395 vbg_req_perform(gdev, data); 1396 WARN_ON(hdr->rc == VINF_HGCM_ASYNC_EXECUTE); 1397 1398 return 0; 1399} 1400 1401static int vbg_ioctl_hgcm_connect(struct vbg_dev *gdev, 1402 struct vbg_session *session, 1403 struct vbg_ioctl_hgcm_connect *conn) 1404{ 1405 u32 client_id; 1406 int i, ret; 1407 1408 if (vbg_ioctl_chk(&conn->hdr, sizeof(conn->u.in), sizeof(conn->u.out))) 1409 return -EINVAL; 1410 1411 /* Find a free place in the sessions clients array and claim it */ 1412 mutex_lock(&gdev->session_mutex); 1413 for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) { 1414 if (!session->hgcm_client_ids[i]) { 1415 session->hgcm_client_ids[i] = U32_MAX; 1416 break; 1417 } 1418 } 1419 mutex_unlock(&gdev->session_mutex); 1420 1421 if (i >= ARRAY_SIZE(session->hgcm_client_ids)) 1422 return -EMFILE; 1423 1424 ret = vbg_hgcm_connect(gdev, session->requestor, &conn->u.in.loc, 1425 &client_id, &conn->hdr.rc); 1426 1427 mutex_lock(&gdev->session_mutex); 1428 if (ret == 0 && conn->hdr.rc >= 0) { 1429 conn->u.out.client_id = client_id; 1430 session->hgcm_client_ids[i] = client_id; 1431 } else { 1432 conn->u.out.client_id = 0; 1433 session->hgcm_client_ids[i] = 0; 1434 } 1435 mutex_unlock(&gdev->session_mutex); 1436 1437 return ret; 1438} 1439 1440static int vbg_ioctl_hgcm_disconnect(struct vbg_dev *gdev, 1441 struct vbg_session *session, 1442 struct vbg_ioctl_hgcm_disconnect *disconn) 1443{ 1444 u32 client_id; 1445 int i, ret; 1446 1447 if (vbg_ioctl_chk(&disconn->hdr, sizeof(disconn->u.in), 0)) 1448 return -EINVAL; 1449 1450 client_id = disconn->u.in.client_id; 1451 if (client_id == 0 || client_id == U32_MAX) 1452 return -EINVAL; 1453 1454 mutex_lock(&gdev->session_mutex); 1455 for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) { 1456 if (session->hgcm_client_ids[i] == client_id) { 1457 session->hgcm_client_ids[i] = U32_MAX; 1458 break; 1459 } 1460 } 1461 mutex_unlock(&gdev->session_mutex); 1462 1463 if (i >= ARRAY_SIZE(session->hgcm_client_ids)) 1464 return -EINVAL; 1465 1466 ret = vbg_hgcm_disconnect(gdev, session->requestor, client_id, 1467 &disconn->hdr.rc); 1468 1469 mutex_lock(&gdev->session_mutex); 1470 if (ret == 0 && disconn->hdr.rc >= 0) 1471 session->hgcm_client_ids[i] = 0; 1472 else 1473 session->hgcm_client_ids[i] = client_id; 1474 mutex_unlock(&gdev->session_mutex); 1475 1476 return ret; 1477} 1478 1479static bool vbg_param_valid(enum vmmdev_hgcm_function_parameter_type type) 1480{ 1481 switch (type) { 1482 case VMMDEV_HGCM_PARM_TYPE_32BIT: 1483 case VMMDEV_HGCM_PARM_TYPE_64BIT: 1484 case VMMDEV_HGCM_PARM_TYPE_LINADDR: 1485 case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN: 1486 case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT: 1487 return true; 1488 default: 1489 return false; 1490 } 1491} 1492 1493static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev, 1494 struct vbg_session *session, bool f32bit, 1495 struct vbg_ioctl_hgcm_call *call) 1496{ 1497 size_t actual_size; 1498 u32 client_id; 1499 int i, ret; 1500 1501 if (call->hdr.size_in < sizeof(*call)) 1502 return -EINVAL; 1503 1504 if (call->hdr.size_in != call->hdr.size_out) 1505 return -EINVAL; 1506 1507 if (call->parm_count > VMMDEV_HGCM_MAX_PARMS) 1508 return -E2BIG; 1509 1510 client_id = call->client_id; 1511 if (client_id == 0 || client_id == U32_MAX) 1512 return -EINVAL; 1513 1514 actual_size = sizeof(*call); 1515 if (f32bit) 1516 actual_size += call->parm_count * 1517 sizeof(struct vmmdev_hgcm_function_parameter32); 1518 else 1519 actual_size += call->parm_count * 1520 sizeof(struct vmmdev_hgcm_function_parameter); 1521 if (call->hdr.size_in < actual_size) { 1522 vbg_debug("VBG_IOCTL_HGCM_CALL: hdr.size_in %d required size is %zd\n", 1523 call->hdr.size_in, actual_size); 1524 return -EINVAL; 1525 } 1526 call->hdr.size_out = actual_size; 1527 1528 /* Validate parameter types */ 1529 if (f32bit) { 1530 struct vmmdev_hgcm_function_parameter32 *parm = 1531 VBG_IOCTL_HGCM_CALL_PARMS32(call); 1532 1533 for (i = 0; i < call->parm_count; i++) 1534 if (!vbg_param_valid(parm[i].type)) 1535 return -EINVAL; 1536 } else { 1537 struct vmmdev_hgcm_function_parameter *parm = 1538 VBG_IOCTL_HGCM_CALL_PARMS(call); 1539 1540 for (i = 0; i < call->parm_count; i++) 1541 if (!vbg_param_valid(parm[i].type)) 1542 return -EINVAL; 1543 } 1544 1545 /* 1546 * Validate the client id. 1547 */ 1548 mutex_lock(&gdev->session_mutex); 1549 for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) 1550 if (session->hgcm_client_ids[i] == client_id) 1551 break; 1552 mutex_unlock(&gdev->session_mutex); 1553 if (i >= ARRAY_SIZE(session->hgcm_client_ids)) { 1554 vbg_debug("VBG_IOCTL_HGCM_CALL: INVALID handle. u32Client=%#08x\n", 1555 client_id); 1556 return -EINVAL; 1557 } 1558 1559 if (IS_ENABLED(CONFIG_COMPAT) && f32bit) 1560 ret = vbg_hgcm_call32(gdev, session->requestor, client_id, 1561 call->function, call->timeout_ms, 1562 VBG_IOCTL_HGCM_CALL_PARMS32(call), 1563 call->parm_count, &call->hdr.rc); 1564 else 1565 ret = vbg_hgcm_call(gdev, session->requestor, client_id, 1566 call->function, call->timeout_ms, 1567 VBG_IOCTL_HGCM_CALL_PARMS(call), 1568 call->parm_count, &call->hdr.rc); 1569 1570 if (ret == -E2BIG) { 1571 /* E2BIG needs to be reported through the hdr.rc field. */ 1572 call->hdr.rc = VERR_OUT_OF_RANGE; 1573 ret = 0; 1574 } 1575 1576 if (ret && ret != -EINTR && ret != -ETIMEDOUT) 1577 vbg_err("VBG_IOCTL_HGCM_CALL error: %d\n", ret); 1578 1579 return ret; 1580} 1581 1582static int vbg_ioctl_log(struct vbg_ioctl_log *log) 1583{ 1584 if (log->hdr.size_out != sizeof(log->hdr)) 1585 return -EINVAL; 1586 1587 vbg_info("%.*s", (int)(log->hdr.size_in - sizeof(log->hdr)), 1588 log->u.in.msg); 1589 1590 return 0; 1591} 1592 1593static int vbg_ioctl_change_filter_mask(struct vbg_dev *gdev, 1594 struct vbg_session *session, 1595 struct vbg_ioctl_change_filter *filter) 1596{ 1597 u32 or_mask, not_mask; 1598 1599 if (vbg_ioctl_chk(&filter->hdr, sizeof(filter->u.in), 0)) 1600 return -EINVAL; 1601 1602 or_mask = filter->u.in.or_mask; 1603 not_mask = filter->u.in.not_mask; 1604 1605 if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK) 1606 return -EINVAL; 1607 1608 return vbg_set_session_event_filter(gdev, session, or_mask, not_mask, 1609 false); 1610} 1611 1612static int vbg_ioctl_acquire_guest_capabilities(struct vbg_dev *gdev, 1613 struct vbg_session *session, 1614 struct vbg_ioctl_acquire_guest_caps *caps) 1615{ 1616 u32 flags, or_mask, not_mask; 1617 1618 if (vbg_ioctl_chk(&caps->hdr, sizeof(caps->u.in), 0)) 1619 return -EINVAL; 1620 1621 flags = caps->u.in.flags; 1622 or_mask = caps->u.in.or_mask; 1623 not_mask = caps->u.in.not_mask; 1624 1625 if (flags & ~VBGL_IOC_AGC_FLAGS_VALID_MASK) 1626 return -EINVAL; 1627 1628 if ((or_mask | not_mask) & ~VMMDEV_GUEST_CAPABILITIES_MASK) 1629 return -EINVAL; 1630 1631 return vbg_acquire_session_capabilities(gdev, session, or_mask, 1632 not_mask, flags, false); 1633} 1634 1635static int vbg_ioctl_change_guest_capabilities(struct vbg_dev *gdev, 1636 struct vbg_session *session, struct vbg_ioctl_set_guest_caps *caps) 1637{ 1638 u32 or_mask, not_mask; 1639 int ret; 1640 1641 if (vbg_ioctl_chk(&caps->hdr, sizeof(caps->u.in), sizeof(caps->u.out))) 1642 return -EINVAL; 1643 1644 or_mask = caps->u.in.or_mask; 1645 not_mask = caps->u.in.not_mask; 1646 1647 if ((or_mask | not_mask) & ~VMMDEV_GUEST_CAPABILITIES_MASK) 1648 return -EINVAL; 1649 1650 ret = vbg_set_session_capabilities(gdev, session, or_mask, not_mask, 1651 false); 1652 if (ret) 1653 return ret; 1654 1655 caps->u.out.session_caps = session->set_guest_caps; 1656 caps->u.out.global_caps = gdev->guest_caps_host; 1657 1658 return 0; 1659} 1660 1661static int vbg_ioctl_check_balloon(struct vbg_dev *gdev, 1662 struct vbg_ioctl_check_balloon *balloon_info) 1663{ 1664 if (vbg_ioctl_chk(&balloon_info->hdr, 0, sizeof(balloon_info->u.out))) 1665 return -EINVAL; 1666 1667 balloon_info->u.out.balloon_chunks = gdev->mem_balloon.chunks; 1668 /* 1669 * Under Linux we handle VMMDEV_EVENT_BALLOON_CHANGE_REQUEST 1670 * events entirely in the kernel, see vbg_core_isr(). 1671 */ 1672 balloon_info->u.out.handle_in_r3 = false; 1673 1674 return 0; 1675} 1676 1677static int vbg_ioctl_write_core_dump(struct vbg_dev *gdev, 1678 struct vbg_session *session, 1679 struct vbg_ioctl_write_coredump *dump) 1680{ 1681 struct vmmdev_write_core_dump *req; 1682 1683 if (vbg_ioctl_chk(&dump->hdr, sizeof(dump->u.in), 0)) 1684 return -EINVAL; 1685 1686 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_WRITE_COREDUMP, 1687 session->requestor); 1688 if (!req) 1689 return -ENOMEM; 1690 1691 req->flags = dump->u.in.flags; 1692 dump->hdr.rc = vbg_req_perform(gdev, req); 1693 1694 vbg_req_free(req, sizeof(*req)); 1695 return 0; 1696} 1697 1698/** 1699 * vbg_core_ioctl - Common IOCtl for user to kernel communication. 1700 * @session: The client session. 1701 * @req: The requested function. 1702 * @data: The i/o data buffer, minimum size sizeof(struct vbg_ioctl_hdr). 1703 * 1704 * Return: %0 or negative errno value. 1705 */ 1706int vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data) 1707{ 1708 unsigned int req_no_size = req & ~IOCSIZE_MASK; 1709 struct vbg_dev *gdev = session->gdev; 1710 struct vbg_ioctl_hdr *hdr = data; 1711 bool f32bit = false; 1712 1713 hdr->rc = VINF_SUCCESS; 1714 if (!hdr->size_out) 1715 hdr->size_out = hdr->size_in; 1716 1717 /* 1718 * hdr->version and hdr->size_in / hdr->size_out minimum size are 1719 * already checked by vbg_misc_device_ioctl(). 1720 */ 1721 1722 /* For VMMDEV_REQUEST hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT */ 1723 if (req_no_size == VBG_IOCTL_VMMDEV_REQUEST(0) || 1724 req == VBG_IOCTL_VMMDEV_REQUEST_BIG || 1725 req == VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT) 1726 return vbg_ioctl_vmmrequest(gdev, session, data); 1727 1728 if (hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT) 1729 return -EINVAL; 1730 1731 /* Fixed size requests. */ 1732 switch (req) { 1733 case VBG_IOCTL_DRIVER_VERSION_INFO: 1734 return vbg_ioctl_driver_version_info(data); 1735 case VBG_IOCTL_HGCM_CONNECT: 1736 return vbg_ioctl_hgcm_connect(gdev, session, data); 1737 case VBG_IOCTL_HGCM_DISCONNECT: 1738 return vbg_ioctl_hgcm_disconnect(gdev, session, data); 1739 case VBG_IOCTL_WAIT_FOR_EVENTS: 1740 return vbg_ioctl_wait_for_events(gdev, session, data); 1741 case VBG_IOCTL_INTERRUPT_ALL_WAIT_FOR_EVENTS: 1742 return vbg_ioctl_interrupt_all_wait_events(gdev, session, data); 1743 case VBG_IOCTL_CHANGE_FILTER_MASK: 1744 return vbg_ioctl_change_filter_mask(gdev, session, data); 1745 case VBG_IOCTL_ACQUIRE_GUEST_CAPABILITIES: 1746 return vbg_ioctl_acquire_guest_capabilities(gdev, session, data); 1747 case VBG_IOCTL_CHANGE_GUEST_CAPABILITIES: 1748 return vbg_ioctl_change_guest_capabilities(gdev, session, data); 1749 case VBG_IOCTL_CHECK_BALLOON: 1750 return vbg_ioctl_check_balloon(gdev, data); 1751 case VBG_IOCTL_WRITE_CORE_DUMP: 1752 return vbg_ioctl_write_core_dump(gdev, session, data); 1753 } 1754 1755 /* Variable sized requests. */ 1756 switch (req_no_size) { 1757#ifdef CONFIG_COMPAT 1758 case VBG_IOCTL_HGCM_CALL_32(0): 1759 f32bit = true; 1760 fallthrough; 1761#endif 1762 case VBG_IOCTL_HGCM_CALL(0): 1763 return vbg_ioctl_hgcm_call(gdev, session, f32bit, data); 1764 case VBG_IOCTL_LOG(0): 1765 case VBG_IOCTL_LOG_ALT(0): 1766 return vbg_ioctl_log(data); 1767 } 1768 1769 vbg_err_ratelimited("Userspace made an unknown ioctl req %#08x\n", req); 1770 return -ENOTTY; 1771} 1772 1773/** 1774 * vbg_core_set_mouse_status - Report guest supported mouse-features to the host. 1775 * 1776 * @gdev: The Guest extension device. 1777 * @features: The set of features to report to the host. 1778 * 1779 * Return: %0 or negative errno value. 1780 */ 1781int vbg_core_set_mouse_status(struct vbg_dev *gdev, u32 features) 1782{ 1783 struct vmmdev_mouse_status *req; 1784 int rc; 1785 1786 req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_MOUSE_STATUS, 1787 VBG_KERNEL_REQUEST); 1788 if (!req) 1789 return -ENOMEM; 1790 1791 req->mouse_features = features; 1792 req->pointer_pos_x = 0; 1793 req->pointer_pos_y = 0; 1794 1795 rc = vbg_req_perform(gdev, req); 1796 if (rc < 0) 1797 vbg_err("%s error, rc: %d\n", __func__, rc); 1798 1799 vbg_req_free(req, sizeof(*req)); 1800 return vbg_status_code_to_errno(rc); 1801} 1802 1803/* Core interrupt service routine. */ 1804irqreturn_t vbg_core_isr(int irq, void *dev_id) 1805{ 1806 struct vbg_dev *gdev = dev_id; 1807 struct vmmdev_events *req = gdev->ack_events_req; 1808 bool mouse_position_changed = false; 1809 unsigned long flags; 1810 u32 events = 0; 1811 int rc; 1812 1813 if (!gdev->mmio->V.V1_04.have_events) 1814 return IRQ_NONE; 1815 1816 /* Get and acknowlegde events. */ 1817 req->header.rc = VERR_INTERNAL_ERROR; 1818 req->events = 0; 1819 rc = vbg_req_perform(gdev, req); 1820 if (rc < 0) { 1821 vbg_err("Error performing events req, rc: %d\n", rc); 1822 return IRQ_NONE; 1823 } 1824 1825 events = req->events; 1826 1827 if (events & VMMDEV_EVENT_MOUSE_POSITION_CHANGED) { 1828 mouse_position_changed = true; 1829 events &= ~VMMDEV_EVENT_MOUSE_POSITION_CHANGED; 1830 } 1831 1832 if (events & VMMDEV_EVENT_HGCM) { 1833 wake_up(&gdev->hgcm_wq); 1834 events &= ~VMMDEV_EVENT_HGCM; 1835 } 1836 1837 if (events & VMMDEV_EVENT_BALLOON_CHANGE_REQUEST) { 1838 schedule_work(&gdev->mem_balloon.work); 1839 events &= ~VMMDEV_EVENT_BALLOON_CHANGE_REQUEST; 1840 } 1841 1842 if (events) { 1843 spin_lock_irqsave(&gdev->event_spinlock, flags); 1844 gdev->pending_events |= events; 1845 spin_unlock_irqrestore(&gdev->event_spinlock, flags); 1846 1847 wake_up(&gdev->event_wq); 1848 } 1849 1850 if (mouse_position_changed) 1851 vbg_linux_mouse_event(gdev); 1852 1853 return IRQ_HANDLED; 1854} 1855