1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * VMware VMCI Driver
4 *
5 * Copyright (C) 2012 VMware, Inc. All rights reserved.
6 */
7
8 #include <linux/vmw_vmci_defs.h>
9 #include <linux/vmw_vmci_api.h>
10 #include <linux/miscdevice.h>
11 #include <linux/interrupt.h>
12 #include <linux/highmem.h>
13 #include <linux/atomic.h>
14 #include <linux/kernel.h>
15 #include <linux/module.h>
16 #include <linux/mutex.h>
17 #include <linux/sched.h>
18 #include <linux/cred.h>
19 #include <linux/slab.h>
20 #include <linux/file.h>
21 #include <linux/init.h>
22 #include <linux/poll.h>
23 #include <linux/pci.h>
24 #include <linux/smp.h>
25 #include <linux/fs.h>
26 #include <linux/io.h>
27
28 #include "vmci_handle_array.h"
29 #include "vmci_queue_pair.h"
30 #include "vmci_datagram.h"
31 #include "vmci_doorbell.h"
32 #include "vmci_resource.h"
33 #include "vmci_context.h"
34 #include "vmci_driver.h"
35 #include "vmci_event.h"
36
37 #define VMCI_UTIL_NUM_RESOURCES 1
38
39 enum {
40 VMCI_NOTIFY_RESOURCE_QUEUE_PAIR = 0,
41 VMCI_NOTIFY_RESOURCE_DOOR_BELL = 1,
42 };
43
44 enum {
45 VMCI_NOTIFY_RESOURCE_ACTION_NOTIFY = 0,
46 VMCI_NOTIFY_RESOURCE_ACTION_CREATE = 1,
47 VMCI_NOTIFY_RESOURCE_ACTION_DESTROY = 2,
48 };
49
50 /*
51 * VMCI driver initialization. This block can also be used to
52 * pass initial group membership etc.
53 */
54 struct vmci_init_blk {
55 u32 cid;
56 u32 flags;
57 };
58
59 /* VMCIqueue_pairAllocInfo_VMToVM */
60 struct vmci_qp_alloc_info_vmvm {
61 struct vmci_handle handle;
62 u32 peer;
63 u32 flags;
64 u64 produce_size;
65 u64 consume_size;
66 u64 produce_page_file; /* User VA. */
67 u64 consume_page_file; /* User VA. */
68 u64 produce_page_file_size; /* Size of the file name array. */
69 u64 consume_page_file_size; /* Size of the file name array. */
70 s32 result;
71 u32 _pad;
72 };
73
74 /* VMCISetNotifyInfo: Used to pass notify flag's address to the host driver. */
75 struct vmci_set_notify_info {
76 u64 notify_uva;
77 s32 result;
78 u32 _pad;
79 };
80
81 /*
82 * Per-instance host state
83 */
84 struct vmci_host_dev {
85 struct vmci_ctx *context;
86 int user_version;
87 enum vmci_obj_type ct_type;
88 struct mutex lock; /* Mutex lock for vmci context access */
89 };
90
91 static struct vmci_ctx *host_context;
92 static bool vmci_host_device_initialized;
93 static atomic_t vmci_host_active_users = ATOMIC_INIT(0);
94
95 /*
96 * Determines whether the VMCI host personality is
97 * available. Since the core functionality of the host driver is
98 * always present, all guests could possibly use the host
99 * personality. However, to minimize the deviation from the
100 * pre-unified driver state of affairs, we only consider the host
101 * device active if there is no active guest device or if there
102 * are VMX'en with active VMCI contexts using the host device.
103 */
vmci_host_code_active(void)104 bool vmci_host_code_active(void)
105 {
106 return vmci_host_device_initialized &&
107 (!vmci_guest_code_active() ||
108 atomic_read(&vmci_host_active_users) > 0);
109 }
110
vmci_host_users(void)111 int vmci_host_users(void)
112 {
113 return atomic_read(&vmci_host_active_users);
114 }
115
116 /*
117 * Called on open of /dev/vmci.
118 */
vmci_host_open(struct inode * inode,struct file * filp)119 static int vmci_host_open(struct inode *inode, struct file *filp)
120 {
121 struct vmci_host_dev *vmci_host_dev;
122
123 vmci_host_dev = kzalloc(sizeof(struct vmci_host_dev), GFP_KERNEL);
124 if (vmci_host_dev == NULL)
125 return -ENOMEM;
126
127 vmci_host_dev->ct_type = VMCIOBJ_NOT_SET;
128 mutex_init(&vmci_host_dev->lock);
129 filp->private_data = vmci_host_dev;
130
131 return 0;
132 }
133
134 /*
135 * Called on close of /dev/vmci, most often when the process
136 * exits.
137 */
vmci_host_close(struct inode * inode,struct file * filp)138 static int vmci_host_close(struct inode *inode, struct file *filp)
139 {
140 struct vmci_host_dev *vmci_host_dev = filp->private_data;
141
142 if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
143 vmci_ctx_destroy(vmci_host_dev->context);
144 vmci_host_dev->context = NULL;
145
146 /*
147 * The number of active contexts is used to track whether any
148 * VMX'en are using the host personality. It is incremented when
149 * a context is created through the IOCTL_VMCI_INIT_CONTEXT
150 * ioctl.
151 */
152 atomic_dec(&vmci_host_active_users);
153 }
154 vmci_host_dev->ct_type = VMCIOBJ_NOT_SET;
155
156 kfree(vmci_host_dev);
157 filp->private_data = NULL;
158 return 0;
159 }
160
161 /*
162 * This is used to wake up the VMX when a VMCI call arrives, or
163 * to wake up select() or poll() at the next clock tick.
164 */
vmci_host_poll(struct file * filp,poll_table * wait)165 static __poll_t vmci_host_poll(struct file *filp, poll_table *wait)
166 {
167 struct vmci_host_dev *vmci_host_dev = filp->private_data;
168 struct vmci_ctx *context;
169 __poll_t mask = 0;
170
171 if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
172 /*
173 * Read context only if ct_type == VMCIOBJ_CONTEXT to make
174 * sure that context is initialized
175 */
176 context = vmci_host_dev->context;
177
178 /* Check for VMCI calls to this VM context. */
179 if (wait)
180 poll_wait(filp, &context->host_context.wait_queue,
181 wait);
182
183 spin_lock(&context->lock);
184 if (context->pending_datagrams > 0 ||
185 vmci_handle_arr_get_size(
186 context->pending_doorbell_array) > 0) {
187 mask = EPOLLIN;
188 }
189 spin_unlock(&context->lock);
190 }
191 return mask;
192 }
193
194 /*
195 * Copies the handles of a handle array into a user buffer, and
196 * returns the new length in userBufferSize. If the copy to the
197 * user buffer fails, the functions still returns VMCI_SUCCESS,
198 * but retval != 0.
199 */
drv_cp_harray_to_user(void __user * user_buf_uva,u64 * user_buf_size,struct vmci_handle_arr * handle_array,int * retval)200 static int drv_cp_harray_to_user(void __user *user_buf_uva,
201 u64 *user_buf_size,
202 struct vmci_handle_arr *handle_array,
203 int *retval)
204 {
205 u32 array_size = 0;
206 struct vmci_handle *handles;
207
208 if (handle_array)
209 array_size = vmci_handle_arr_get_size(handle_array);
210
211 if (array_size * sizeof(*handles) > *user_buf_size)
212 return VMCI_ERROR_MORE_DATA;
213
214 *user_buf_size = array_size * sizeof(*handles);
215 if (*user_buf_size)
216 *retval = copy_to_user(user_buf_uva,
217 vmci_handle_arr_get_handles
218 (handle_array), *user_buf_size);
219
220 return VMCI_SUCCESS;
221 }
222
223 /*
224 * Sets up a given context for notify to work. Maps the notify
225 * boolean in user VA into kernel space.
226 */
vmci_host_setup_notify(struct vmci_ctx * context,unsigned long uva)227 static int vmci_host_setup_notify(struct vmci_ctx *context,
228 unsigned long uva)
229 {
230 int retval;
231
232 if (context->notify_page) {
233 pr_devel("%s: Notify mechanism is already set up\n", __func__);
234 return VMCI_ERROR_DUPLICATE_ENTRY;
235 }
236
237 /*
238 * We are using 'bool' internally, but let's make sure we explicit
239 * about the size.
240 */
241 BUILD_BUG_ON(sizeof(bool) != sizeof(u8));
242
243 /*
244 * Lock physical page backing a given user VA.
245 */
246 retval = get_user_pages_fast(uva, 1, FOLL_WRITE, &context->notify_page);
247 if (retval != 1) {
248 context->notify_page = NULL;
249 return VMCI_ERROR_GENERIC;
250 }
251 if (context->notify_page == NULL)
252 return VMCI_ERROR_UNAVAILABLE;
253
254 /*
255 * Map the locked page and set up notify pointer.
256 */
257 context->notify = kmap(context->notify_page) + (uva & (PAGE_SIZE - 1));
258 vmci_ctx_check_signal_notify(context);
259
260 return VMCI_SUCCESS;
261 }
262
vmci_host_get_version(struct vmci_host_dev * vmci_host_dev,unsigned int cmd,void __user * uptr)263 static int vmci_host_get_version(struct vmci_host_dev *vmci_host_dev,
264 unsigned int cmd, void __user *uptr)
265 {
266 if (cmd == IOCTL_VMCI_VERSION2) {
267 int __user *vptr = uptr;
268 if (get_user(vmci_host_dev->user_version, vptr))
269 return -EFAULT;
270 }
271
272 /*
273 * The basic logic here is:
274 *
275 * If the user sends in a version of 0 tell it our version.
276 * If the user didn't send in a version, tell it our version.
277 * If the user sent in an old version, tell it -its- version.
278 * If the user sent in an newer version, tell it our version.
279 *
280 * The rationale behind telling the caller its version is that
281 * Workstation 6.5 required that VMX and VMCI kernel module were
282 * version sync'd. All new VMX users will be programmed to
283 * handle the VMCI kernel module version.
284 */
285
286 if (vmci_host_dev->user_version > 0 &&
287 vmci_host_dev->user_version < VMCI_VERSION_HOSTQP) {
288 return vmci_host_dev->user_version;
289 }
290
291 return VMCI_VERSION;
292 }
293
294 #define vmci_ioctl_err(fmt, ...) \
295 pr_devel("%s: " fmt, ioctl_name, ##__VA_ARGS__)
296
vmci_host_do_init_context(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)297 static int vmci_host_do_init_context(struct vmci_host_dev *vmci_host_dev,
298 const char *ioctl_name,
299 void __user *uptr)
300 {
301 struct vmci_init_blk init_block;
302 const struct cred *cred;
303 int retval;
304
305 if (copy_from_user(&init_block, uptr, sizeof(init_block))) {
306 vmci_ioctl_err("error reading init block\n");
307 return -EFAULT;
308 }
309
310 mutex_lock(&vmci_host_dev->lock);
311
312 if (vmci_host_dev->ct_type != VMCIOBJ_NOT_SET) {
313 vmci_ioctl_err("received VMCI init on initialized handle\n");
314 retval = -EINVAL;
315 goto out;
316 }
317
318 if (init_block.flags & ~VMCI_PRIVILEGE_FLAG_RESTRICTED) {
319 vmci_ioctl_err("unsupported VMCI restriction flag\n");
320 retval = -EINVAL;
321 goto out;
322 }
323
324 cred = get_current_cred();
325 vmci_host_dev->context = vmci_ctx_create(init_block.cid,
326 init_block.flags, 0,
327 vmci_host_dev->user_version,
328 cred);
329 put_cred(cred);
330 if (IS_ERR(vmci_host_dev->context)) {
331 retval = PTR_ERR(vmci_host_dev->context);
332 vmci_ioctl_err("error initializing context\n");
333 goto out;
334 }
335
336 /*
337 * Copy cid to userlevel, we do this to allow the VMX
338 * to enforce its policy on cid generation.
339 */
340 init_block.cid = vmci_ctx_get_id(vmci_host_dev->context);
341 if (copy_to_user(uptr, &init_block, sizeof(init_block))) {
342 vmci_ctx_destroy(vmci_host_dev->context);
343 vmci_host_dev->context = NULL;
344 vmci_ioctl_err("error writing init block\n");
345 retval = -EFAULT;
346 goto out;
347 }
348
349 vmci_host_dev->ct_type = VMCIOBJ_CONTEXT;
350 atomic_inc(&vmci_host_active_users);
351
352 vmci_call_vsock_callback(true);
353
354 retval = 0;
355
356 out:
357 mutex_unlock(&vmci_host_dev->lock);
358 return retval;
359 }
360
vmci_host_do_send_datagram(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)361 static int vmci_host_do_send_datagram(struct vmci_host_dev *vmci_host_dev,
362 const char *ioctl_name,
363 void __user *uptr)
364 {
365 struct vmci_datagram_snd_rcv_info send_info;
366 struct vmci_datagram *dg = NULL;
367 u32 cid;
368
369 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
370 vmci_ioctl_err("only valid for contexts\n");
371 return -EINVAL;
372 }
373
374 if (copy_from_user(&send_info, uptr, sizeof(send_info)))
375 return -EFAULT;
376
377 if (send_info.len > VMCI_MAX_DG_SIZE) {
378 vmci_ioctl_err("datagram is too big (size=%d)\n",
379 send_info.len);
380 return -EINVAL;
381 }
382
383 if (send_info.len < sizeof(*dg)) {
384 vmci_ioctl_err("datagram is too small (size=%d)\n",
385 send_info.len);
386 return -EINVAL;
387 }
388
389 dg = memdup_user((void __user *)(uintptr_t)send_info.addr,
390 send_info.len);
391 if (IS_ERR(dg)) {
392 vmci_ioctl_err(
393 "cannot allocate memory to dispatch datagram\n");
394 return PTR_ERR(dg);
395 }
396
397 if (VMCI_DG_SIZE(dg) != send_info.len) {
398 vmci_ioctl_err("datagram size mismatch\n");
399 kfree(dg);
400 return -EINVAL;
401 }
402
403 pr_devel("Datagram dst (handle=0x%x:0x%x) src (handle=0x%x:0x%x), payload (size=%llu bytes)\n",
404 dg->dst.context, dg->dst.resource,
405 dg->src.context, dg->src.resource,
406 (unsigned long long)dg->payload_size);
407
408 /* Get source context id. */
409 cid = vmci_ctx_get_id(vmci_host_dev->context);
410 send_info.result = vmci_datagram_dispatch(cid, dg, true);
411 kfree(dg);
412
413 return copy_to_user(uptr, &send_info, sizeof(send_info)) ? -EFAULT : 0;
414 }
415
vmci_host_do_receive_datagram(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)416 static int vmci_host_do_receive_datagram(struct vmci_host_dev *vmci_host_dev,
417 const char *ioctl_name,
418 void __user *uptr)
419 {
420 struct vmci_datagram_snd_rcv_info recv_info;
421 struct vmci_datagram *dg = NULL;
422 int retval;
423 size_t size;
424
425 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
426 vmci_ioctl_err("only valid for contexts\n");
427 return -EINVAL;
428 }
429
430 if (copy_from_user(&recv_info, uptr, sizeof(recv_info)))
431 return -EFAULT;
432
433 size = recv_info.len;
434 recv_info.result = vmci_ctx_dequeue_datagram(vmci_host_dev->context,
435 &size, &dg);
436
437 if (recv_info.result >= VMCI_SUCCESS) {
438 void __user *ubuf = (void __user *)(uintptr_t)recv_info.addr;
439 retval = copy_to_user(ubuf, dg, VMCI_DG_SIZE(dg));
440 kfree(dg);
441 if (retval != 0)
442 return -EFAULT;
443 }
444
445 return copy_to_user(uptr, &recv_info, sizeof(recv_info)) ? -EFAULT : 0;
446 }
447
vmci_host_do_alloc_queuepair(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)448 static int vmci_host_do_alloc_queuepair(struct vmci_host_dev *vmci_host_dev,
449 const char *ioctl_name,
450 void __user *uptr)
451 {
452 struct vmci_handle handle;
453 int vmci_status;
454 int __user *retptr;
455
456 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
457 vmci_ioctl_err("only valid for contexts\n");
458 return -EINVAL;
459 }
460
461 if (vmci_host_dev->user_version < VMCI_VERSION_NOVMVM) {
462 struct vmci_qp_alloc_info_vmvm alloc_info;
463 struct vmci_qp_alloc_info_vmvm __user *info = uptr;
464
465 if (copy_from_user(&alloc_info, uptr, sizeof(alloc_info)))
466 return -EFAULT;
467
468 handle = alloc_info.handle;
469 retptr = &info->result;
470
471 vmci_status = vmci_qp_broker_alloc(alloc_info.handle,
472 alloc_info.peer,
473 alloc_info.flags,
474 VMCI_NO_PRIVILEGE_FLAGS,
475 alloc_info.produce_size,
476 alloc_info.consume_size,
477 NULL,
478 vmci_host_dev->context);
479
480 if (vmci_status == VMCI_SUCCESS)
481 vmci_status = VMCI_SUCCESS_QUEUEPAIR_CREATE;
482 } else {
483 struct vmci_qp_alloc_info alloc_info;
484 struct vmci_qp_alloc_info __user *info = uptr;
485 struct vmci_qp_page_store page_store;
486
487 if (copy_from_user(&alloc_info, uptr, sizeof(alloc_info)))
488 return -EFAULT;
489
490 handle = alloc_info.handle;
491 retptr = &info->result;
492
493 page_store.pages = alloc_info.ppn_va;
494 page_store.len = alloc_info.num_ppns;
495
496 vmci_status = vmci_qp_broker_alloc(alloc_info.handle,
497 alloc_info.peer,
498 alloc_info.flags,
499 VMCI_NO_PRIVILEGE_FLAGS,
500 alloc_info.produce_size,
501 alloc_info.consume_size,
502 &page_store,
503 vmci_host_dev->context);
504 }
505
506 if (put_user(vmci_status, retptr)) {
507 if (vmci_status >= VMCI_SUCCESS) {
508 vmci_status = vmci_qp_broker_detach(handle,
509 vmci_host_dev->context);
510 }
511 return -EFAULT;
512 }
513
514 return 0;
515 }
516
vmci_host_do_queuepair_setva(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)517 static int vmci_host_do_queuepair_setva(struct vmci_host_dev *vmci_host_dev,
518 const char *ioctl_name,
519 void __user *uptr)
520 {
521 struct vmci_qp_set_va_info set_va_info;
522 struct vmci_qp_set_va_info __user *info = uptr;
523 s32 result;
524
525 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
526 vmci_ioctl_err("only valid for contexts\n");
527 return -EINVAL;
528 }
529
530 if (vmci_host_dev->user_version < VMCI_VERSION_NOVMVM) {
531 vmci_ioctl_err("is not allowed\n");
532 return -EINVAL;
533 }
534
535 if (copy_from_user(&set_va_info, uptr, sizeof(set_va_info)))
536 return -EFAULT;
537
538 if (set_va_info.va) {
539 /*
540 * VMX is passing down a new VA for the queue
541 * pair mapping.
542 */
543 result = vmci_qp_broker_map(set_va_info.handle,
544 vmci_host_dev->context,
545 set_va_info.va);
546 } else {
547 /*
548 * The queue pair is about to be unmapped by
549 * the VMX.
550 */
551 result = vmci_qp_broker_unmap(set_va_info.handle,
552 vmci_host_dev->context, 0);
553 }
554
555 return put_user(result, &info->result) ? -EFAULT : 0;
556 }
557
vmci_host_do_queuepair_setpf(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)558 static int vmci_host_do_queuepair_setpf(struct vmci_host_dev *vmci_host_dev,
559 const char *ioctl_name,
560 void __user *uptr)
561 {
562 struct vmci_qp_page_file_info page_file_info;
563 struct vmci_qp_page_file_info __user *info = uptr;
564 s32 result;
565
566 if (vmci_host_dev->user_version < VMCI_VERSION_HOSTQP ||
567 vmci_host_dev->user_version >= VMCI_VERSION_NOVMVM) {
568 vmci_ioctl_err("not supported on this VMX (version=%d)\n",
569 vmci_host_dev->user_version);
570 return -EINVAL;
571 }
572
573 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
574 vmci_ioctl_err("only valid for contexts\n");
575 return -EINVAL;
576 }
577
578 if (copy_from_user(&page_file_info, uptr, sizeof(*info)))
579 return -EFAULT;
580
581 /*
582 * Communicate success pre-emptively to the caller. Note that the
583 * basic premise is that it is incumbent upon the caller not to look at
584 * the info.result field until after the ioctl() returns. And then,
585 * only if the ioctl() result indicates no error. We send up the
586 * SUCCESS status before calling SetPageStore() store because failing
587 * to copy up the result code means unwinding the SetPageStore().
588 *
589 * It turns out the logic to unwind a SetPageStore() opens a can of
590 * worms. For example, if a host had created the queue_pair and a
591 * guest attaches and SetPageStore() is successful but writing success
592 * fails, then ... the host has to be stopped from writing (anymore)
593 * data into the queue_pair. That means an additional test in the
594 * VMCI_Enqueue() code path. Ugh.
595 */
596
597 if (put_user(VMCI_SUCCESS, &info->result)) {
598 /*
599 * In this case, we can't write a result field of the
600 * caller's info block. So, we don't even try to
601 * SetPageStore().
602 */
603 return -EFAULT;
604 }
605
606 result = vmci_qp_broker_set_page_store(page_file_info.handle,
607 page_file_info.produce_va,
608 page_file_info.consume_va,
609 vmci_host_dev->context);
610 if (result < VMCI_SUCCESS) {
611 if (put_user(result, &info->result)) {
612 /*
613 * Note that in this case the SetPageStore()
614 * call failed but we were unable to
615 * communicate that to the caller (because the
616 * copy_to_user() call failed). So, if we
617 * simply return an error (in this case
618 * -EFAULT) then the caller will know that the
619 * SetPageStore failed even though we couldn't
620 * put the result code in the result field and
621 * indicate exactly why it failed.
622 *
623 * That says nothing about the issue where we
624 * were once able to write to the caller's info
625 * memory and now can't. Something more
626 * serious is probably going on than the fact
627 * that SetPageStore() didn't work.
628 */
629 return -EFAULT;
630 }
631 }
632
633 return 0;
634 }
635
vmci_host_do_qp_detach(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)636 static int vmci_host_do_qp_detach(struct vmci_host_dev *vmci_host_dev,
637 const char *ioctl_name,
638 void __user *uptr)
639 {
640 struct vmci_qp_dtch_info detach_info;
641 struct vmci_qp_dtch_info __user *info = uptr;
642 s32 result;
643
644 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
645 vmci_ioctl_err("only valid for contexts\n");
646 return -EINVAL;
647 }
648
649 if (copy_from_user(&detach_info, uptr, sizeof(detach_info)))
650 return -EFAULT;
651
652 result = vmci_qp_broker_detach(detach_info.handle,
653 vmci_host_dev->context);
654 if (result == VMCI_SUCCESS &&
655 vmci_host_dev->user_version < VMCI_VERSION_NOVMVM) {
656 result = VMCI_SUCCESS_LAST_DETACH;
657 }
658
659 return put_user(result, &info->result) ? -EFAULT : 0;
660 }
661
vmci_host_do_ctx_add_notify(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)662 static int vmci_host_do_ctx_add_notify(struct vmci_host_dev *vmci_host_dev,
663 const char *ioctl_name,
664 void __user *uptr)
665 {
666 struct vmci_ctx_info ar_info;
667 struct vmci_ctx_info __user *info = uptr;
668 s32 result;
669 u32 cid;
670
671 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
672 vmci_ioctl_err("only valid for contexts\n");
673 return -EINVAL;
674 }
675
676 if (copy_from_user(&ar_info, uptr, sizeof(ar_info)))
677 return -EFAULT;
678
679 cid = vmci_ctx_get_id(vmci_host_dev->context);
680 result = vmci_ctx_add_notification(cid, ar_info.remote_cid);
681
682 return put_user(result, &info->result) ? -EFAULT : 0;
683 }
684
vmci_host_do_ctx_remove_notify(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)685 static int vmci_host_do_ctx_remove_notify(struct vmci_host_dev *vmci_host_dev,
686 const char *ioctl_name,
687 void __user *uptr)
688 {
689 struct vmci_ctx_info ar_info;
690 struct vmci_ctx_info __user *info = uptr;
691 u32 cid;
692 int result;
693
694 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
695 vmci_ioctl_err("only valid for contexts\n");
696 return -EINVAL;
697 }
698
699 if (copy_from_user(&ar_info, uptr, sizeof(ar_info)))
700 return -EFAULT;
701
702 cid = vmci_ctx_get_id(vmci_host_dev->context);
703 result = vmci_ctx_remove_notification(cid,
704 ar_info.remote_cid);
705
706 return put_user(result, &info->result) ? -EFAULT : 0;
707 }
708
vmci_host_do_ctx_get_cpt_state(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)709 static int vmci_host_do_ctx_get_cpt_state(struct vmci_host_dev *vmci_host_dev,
710 const char *ioctl_name,
711 void __user *uptr)
712 {
713 struct vmci_ctx_chkpt_buf_info get_info;
714 u32 cid;
715 void *cpt_buf;
716 int retval;
717
718 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
719 vmci_ioctl_err("only valid for contexts\n");
720 return -EINVAL;
721 }
722
723 if (copy_from_user(&get_info, uptr, sizeof(get_info)))
724 return -EFAULT;
725
726 cid = vmci_ctx_get_id(vmci_host_dev->context);
727 get_info.result = vmci_ctx_get_chkpt_state(cid, get_info.cpt_type,
728 &get_info.buf_size, &cpt_buf);
729 if (get_info.result == VMCI_SUCCESS && get_info.buf_size) {
730 void __user *ubuf = (void __user *)(uintptr_t)get_info.cpt_buf;
731 retval = copy_to_user(ubuf, cpt_buf, get_info.buf_size);
732 kfree(cpt_buf);
733
734 if (retval)
735 return -EFAULT;
736 }
737
738 return copy_to_user(uptr, &get_info, sizeof(get_info)) ? -EFAULT : 0;
739 }
740
vmci_host_do_ctx_set_cpt_state(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)741 static int vmci_host_do_ctx_set_cpt_state(struct vmci_host_dev *vmci_host_dev,
742 const char *ioctl_name,
743 void __user *uptr)
744 {
745 struct vmci_ctx_chkpt_buf_info set_info;
746 u32 cid;
747 void *cpt_buf;
748 int retval;
749
750 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
751 vmci_ioctl_err("only valid for contexts\n");
752 return -EINVAL;
753 }
754
755 if (copy_from_user(&set_info, uptr, sizeof(set_info)))
756 return -EFAULT;
757
758 cpt_buf = memdup_user((void __user *)(uintptr_t)set_info.cpt_buf,
759 set_info.buf_size);
760 if (IS_ERR(cpt_buf))
761 return PTR_ERR(cpt_buf);
762
763 cid = vmci_ctx_get_id(vmci_host_dev->context);
764 set_info.result = vmci_ctx_set_chkpt_state(cid, set_info.cpt_type,
765 set_info.buf_size, cpt_buf);
766
767 retval = copy_to_user(uptr, &set_info, sizeof(set_info)) ? -EFAULT : 0;
768
769 kfree(cpt_buf);
770 return retval;
771 }
772
vmci_host_do_get_context_id(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)773 static int vmci_host_do_get_context_id(struct vmci_host_dev *vmci_host_dev,
774 const char *ioctl_name,
775 void __user *uptr)
776 {
777 u32 __user *u32ptr = uptr;
778
779 return put_user(VMCI_HOST_CONTEXT_ID, u32ptr) ? -EFAULT : 0;
780 }
781
vmci_host_do_set_notify(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)782 static int vmci_host_do_set_notify(struct vmci_host_dev *vmci_host_dev,
783 const char *ioctl_name,
784 void __user *uptr)
785 {
786 struct vmci_set_notify_info notify_info;
787
788 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
789 vmci_ioctl_err("only valid for contexts\n");
790 return -EINVAL;
791 }
792
793 if (copy_from_user(¬ify_info, uptr, sizeof(notify_info)))
794 return -EFAULT;
795
796 if (notify_info.notify_uva) {
797 notify_info.result =
798 vmci_host_setup_notify(vmci_host_dev->context,
799 notify_info.notify_uva);
800 } else {
801 vmci_ctx_unset_notify(vmci_host_dev->context);
802 notify_info.result = VMCI_SUCCESS;
803 }
804
805 return copy_to_user(uptr, ¬ify_info, sizeof(notify_info)) ?
806 -EFAULT : 0;
807 }
808
vmci_host_do_notify_resource(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)809 static int vmci_host_do_notify_resource(struct vmci_host_dev *vmci_host_dev,
810 const char *ioctl_name,
811 void __user *uptr)
812 {
813 struct vmci_dbell_notify_resource_info info;
814 u32 cid;
815
816 if (vmci_host_dev->user_version < VMCI_VERSION_NOTIFY) {
817 vmci_ioctl_err("invalid for current VMX versions\n");
818 return -EINVAL;
819 }
820
821 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
822 vmci_ioctl_err("only valid for contexts\n");
823 return -EINVAL;
824 }
825
826 if (copy_from_user(&info, uptr, sizeof(info)))
827 return -EFAULT;
828
829 cid = vmci_ctx_get_id(vmci_host_dev->context);
830
831 switch (info.action) {
832 case VMCI_NOTIFY_RESOURCE_ACTION_NOTIFY:
833 if (info.resource == VMCI_NOTIFY_RESOURCE_DOOR_BELL) {
834 u32 flags = VMCI_NO_PRIVILEGE_FLAGS;
835 info.result = vmci_ctx_notify_dbell(cid, info.handle,
836 flags);
837 } else {
838 info.result = VMCI_ERROR_UNAVAILABLE;
839 }
840 break;
841
842 case VMCI_NOTIFY_RESOURCE_ACTION_CREATE:
843 info.result = vmci_ctx_dbell_create(cid, info.handle);
844 break;
845
846 case VMCI_NOTIFY_RESOURCE_ACTION_DESTROY:
847 info.result = vmci_ctx_dbell_destroy(cid, info.handle);
848 break;
849
850 default:
851 vmci_ioctl_err("got unknown action (action=%d)\n",
852 info.action);
853 info.result = VMCI_ERROR_INVALID_ARGS;
854 }
855
856 return copy_to_user(uptr, &info, sizeof(info)) ? -EFAULT : 0;
857 }
858
vmci_host_do_recv_notifications(struct vmci_host_dev * vmci_host_dev,const char * ioctl_name,void __user * uptr)859 static int vmci_host_do_recv_notifications(struct vmci_host_dev *vmci_host_dev,
860 const char *ioctl_name,
861 void __user *uptr)
862 {
863 struct vmci_ctx_notify_recv_info info;
864 struct vmci_handle_arr *db_handle_array;
865 struct vmci_handle_arr *qp_handle_array;
866 void __user *ubuf;
867 u32 cid;
868 int retval = 0;
869
870 if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
871 vmci_ioctl_err("only valid for contexts\n");
872 return -EINVAL;
873 }
874
875 if (vmci_host_dev->user_version < VMCI_VERSION_NOTIFY) {
876 vmci_ioctl_err("not supported for the current vmx version\n");
877 return -EINVAL;
878 }
879
880 if (copy_from_user(&info, uptr, sizeof(info)))
881 return -EFAULT;
882
883 if ((info.db_handle_buf_size && !info.db_handle_buf_uva) ||
884 (info.qp_handle_buf_size && !info.qp_handle_buf_uva)) {
885 return -EINVAL;
886 }
887
888 cid = vmci_ctx_get_id(vmci_host_dev->context);
889
890 info.result = vmci_ctx_rcv_notifications_get(cid,
891 &db_handle_array, &qp_handle_array);
892 if (info.result != VMCI_SUCCESS)
893 return copy_to_user(uptr, &info, sizeof(info)) ? -EFAULT : 0;
894
895 ubuf = (void __user *)(uintptr_t)info.db_handle_buf_uva;
896 info.result = drv_cp_harray_to_user(ubuf, &info.db_handle_buf_size,
897 db_handle_array, &retval);
898 if (info.result == VMCI_SUCCESS && !retval) {
899 ubuf = (void __user *)(uintptr_t)info.qp_handle_buf_uva;
900 info.result = drv_cp_harray_to_user(ubuf,
901 &info.qp_handle_buf_size,
902 qp_handle_array, &retval);
903 }
904
905 if (!retval && copy_to_user(uptr, &info, sizeof(info)))
906 retval = -EFAULT;
907
908 vmci_ctx_rcv_notifications_release(cid,
909 db_handle_array, qp_handle_array,
910 info.result == VMCI_SUCCESS && !retval);
911
912 return retval;
913 }
914
vmci_host_unlocked_ioctl(struct file * filp,unsigned int iocmd,unsigned long ioarg)915 static long vmci_host_unlocked_ioctl(struct file *filp,
916 unsigned int iocmd, unsigned long ioarg)
917 {
918 #define VMCI_DO_IOCTL(ioctl_name, ioctl_fn) do { \
919 char *name = "IOCTL_VMCI_" # ioctl_name; \
920 return vmci_host_do_ ## ioctl_fn( \
921 vmci_host_dev, name, uptr); \
922 } while (0)
923
924 struct vmci_host_dev *vmci_host_dev = filp->private_data;
925 void __user *uptr = (void __user *)ioarg;
926
927 switch (iocmd) {
928 case IOCTL_VMCI_INIT_CONTEXT:
929 VMCI_DO_IOCTL(INIT_CONTEXT, init_context);
930 case IOCTL_VMCI_DATAGRAM_SEND:
931 VMCI_DO_IOCTL(DATAGRAM_SEND, send_datagram);
932 case IOCTL_VMCI_DATAGRAM_RECEIVE:
933 VMCI_DO_IOCTL(DATAGRAM_RECEIVE, receive_datagram);
934 case IOCTL_VMCI_QUEUEPAIR_ALLOC:
935 VMCI_DO_IOCTL(QUEUEPAIR_ALLOC, alloc_queuepair);
936 case IOCTL_VMCI_QUEUEPAIR_SETVA:
937 VMCI_DO_IOCTL(QUEUEPAIR_SETVA, queuepair_setva);
938 case IOCTL_VMCI_QUEUEPAIR_SETPAGEFILE:
939 VMCI_DO_IOCTL(QUEUEPAIR_SETPAGEFILE, queuepair_setpf);
940 case IOCTL_VMCI_QUEUEPAIR_DETACH:
941 VMCI_DO_IOCTL(QUEUEPAIR_DETACH, qp_detach);
942 case IOCTL_VMCI_CTX_ADD_NOTIFICATION:
943 VMCI_DO_IOCTL(CTX_ADD_NOTIFICATION, ctx_add_notify);
944 case IOCTL_VMCI_CTX_REMOVE_NOTIFICATION:
945 VMCI_DO_IOCTL(CTX_REMOVE_NOTIFICATION, ctx_remove_notify);
946 case IOCTL_VMCI_CTX_GET_CPT_STATE:
947 VMCI_DO_IOCTL(CTX_GET_CPT_STATE, ctx_get_cpt_state);
948 case IOCTL_VMCI_CTX_SET_CPT_STATE:
949 VMCI_DO_IOCTL(CTX_SET_CPT_STATE, ctx_set_cpt_state);
950 case IOCTL_VMCI_GET_CONTEXT_ID:
951 VMCI_DO_IOCTL(GET_CONTEXT_ID, get_context_id);
952 case IOCTL_VMCI_SET_NOTIFY:
953 VMCI_DO_IOCTL(SET_NOTIFY, set_notify);
954 case IOCTL_VMCI_NOTIFY_RESOURCE:
955 VMCI_DO_IOCTL(NOTIFY_RESOURCE, notify_resource);
956 case IOCTL_VMCI_NOTIFICATIONS_RECEIVE:
957 VMCI_DO_IOCTL(NOTIFICATIONS_RECEIVE, recv_notifications);
958
959 case IOCTL_VMCI_VERSION:
960 case IOCTL_VMCI_VERSION2:
961 return vmci_host_get_version(vmci_host_dev, iocmd, uptr);
962
963 default:
964 pr_devel("%s: Unknown ioctl (iocmd=%d)\n", __func__, iocmd);
965 return -EINVAL;
966 }
967
968 #undef VMCI_DO_IOCTL
969 }
970
971 static const struct file_operations vmuser_fops = {
972 .owner = THIS_MODULE,
973 .open = vmci_host_open,
974 .release = vmci_host_close,
975 .poll = vmci_host_poll,
976 .unlocked_ioctl = vmci_host_unlocked_ioctl,
977 .compat_ioctl = compat_ptr_ioctl,
978 };
979
980 static struct miscdevice vmci_host_miscdev = {
981 .name = "vmci",
982 .minor = MISC_DYNAMIC_MINOR,
983 .fops = &vmuser_fops,
984 };
985
vmci_host_init(void)986 int __init vmci_host_init(void)
987 {
988 int error;
989
990 host_context = vmci_ctx_create(VMCI_HOST_CONTEXT_ID,
991 VMCI_DEFAULT_PROC_PRIVILEGE_FLAGS,
992 -1, VMCI_VERSION, NULL);
993 if (IS_ERR(host_context)) {
994 error = PTR_ERR(host_context);
995 pr_warn("Failed to initialize VMCIContext (error%d)\n",
996 error);
997 return error;
998 }
999
1000 error = misc_register(&vmci_host_miscdev);
1001 if (error) {
1002 pr_warn("Module registration error (name=%s, major=%d, minor=%d, err=%d)\n",
1003 vmci_host_miscdev.name,
1004 MISC_MAJOR, vmci_host_miscdev.minor,
1005 error);
1006 pr_warn("Unable to initialize host personality\n");
1007 vmci_ctx_destroy(host_context);
1008 return error;
1009 }
1010
1011 pr_info("VMCI host device registered (name=%s, major=%d, minor=%d)\n",
1012 vmci_host_miscdev.name, MISC_MAJOR, vmci_host_miscdev.minor);
1013
1014 vmci_host_device_initialized = true;
1015 return 0;
1016 }
1017
vmci_host_exit(void)1018 void __exit vmci_host_exit(void)
1019 {
1020 vmci_host_device_initialized = false;
1021
1022 misc_deregister(&vmci_host_miscdev);
1023 vmci_ctx_destroy(host_context);
1024 vmci_qp_broker_exit();
1025
1026 pr_debug("VMCI host driver module unloaded\n");
1027 }
1028