1 /* SPDX-License-Identifier: GPL-2.0 */
2 /*
3 * vboxguest linux pci driver, char-dev and input-device code,
4 *
5 * Copyright (C) 2006-2016 Oracle Corporation
6 */
7
8 #include <linux/input.h>
9 #include <linux/kernel.h>
10 #include <linux/miscdevice.h>
11 #include <linux/module.h>
12 #include <linux/pci.h>
13 #include <linux/poll.h>
14 #include <linux/vbox_utils.h>
15 #include "vboxguest_core.h"
16
17 /** The device name. */
18 #define DEVICE_NAME "vboxguest"
19 /** The device name for the device node open to everyone. */
20 #define DEVICE_NAME_USER "vboxuser"
21 /** VirtualBox PCI vendor ID. */
22 #define VBOX_VENDORID 0x80ee
23 /** VMMDev PCI card product ID. */
24 #define VMMDEV_DEVICEID 0xcafe
25
26 /** Mutex protecting the global vbg_gdev pointer used by vbg_get/put_gdev. */
27 static DEFINE_MUTEX(vbg_gdev_mutex);
28 /** Global vbg_gdev pointer used by vbg_get/put_gdev. */
29 static struct vbg_dev *vbg_gdev;
30
vbg_misc_device_open(struct inode * inode,struct file * filp)31 static int vbg_misc_device_open(struct inode *inode, struct file *filp)
32 {
33 struct vbg_session *session;
34 struct vbg_dev *gdev;
35
36 /* misc_open sets filp->private_data to our misc device */
37 gdev = container_of(filp->private_data, struct vbg_dev, misc_device);
38
39 session = vbg_core_open_session(gdev, false);
40 if (IS_ERR(session))
41 return PTR_ERR(session);
42
43 filp->private_data = session;
44 return 0;
45 }
46
vbg_misc_device_user_open(struct inode * inode,struct file * filp)47 static int vbg_misc_device_user_open(struct inode *inode, struct file *filp)
48 {
49 struct vbg_session *session;
50 struct vbg_dev *gdev;
51
52 /* misc_open sets filp->private_data to our misc device */
53 gdev = container_of(filp->private_data, struct vbg_dev,
54 misc_device_user);
55
56 session = vbg_core_open_session(gdev, false);
57 if (IS_ERR(session))
58 return PTR_ERR(session);
59
60 filp->private_data = session;
61 return 0;
62 }
63
64 /**
65 * Close device.
66 * Return: 0 on success, negated errno on failure.
67 * @inode: Pointer to inode info structure.
68 * @filp: Associated file pointer.
69 */
vbg_misc_device_close(struct inode * inode,struct file * filp)70 static int vbg_misc_device_close(struct inode *inode, struct file *filp)
71 {
72 vbg_core_close_session(filp->private_data);
73 filp->private_data = NULL;
74 return 0;
75 }
76
77 /**
78 * Device I/O Control entry point.
79 * Return: 0 on success, negated errno on failure.
80 * @filp: Associated file pointer.
81 * @req: The request specified to ioctl().
82 * @arg: The argument specified to ioctl().
83 */
vbg_misc_device_ioctl(struct file * filp,unsigned int req,unsigned long arg)84 static long vbg_misc_device_ioctl(struct file *filp, unsigned int req,
85 unsigned long arg)
86 {
87 struct vbg_session *session = filp->private_data;
88 size_t returned_size, size;
89 struct vbg_ioctl_hdr hdr;
90 bool is_vmmdev_req;
91 int ret = 0;
92 void *buf;
93
94 if (copy_from_user(&hdr, (void *)arg, sizeof(hdr)))
95 return -EFAULT;
96
97 if (hdr.version != VBG_IOCTL_HDR_VERSION)
98 return -EINVAL;
99
100 if (hdr.size_in < sizeof(hdr) ||
101 (hdr.size_out && hdr.size_out < sizeof(hdr)))
102 return -EINVAL;
103
104 size = max(hdr.size_in, hdr.size_out);
105 if (_IOC_SIZE(req) && _IOC_SIZE(req) != size)
106 return -EINVAL;
107 if (size > SZ_16M)
108 return -E2BIG;
109
110 /*
111 * IOCTL_VMMDEV_REQUEST needs the buffer to be below 4G to avoid
112 * the need for a bounce-buffer and another copy later on.
113 */
114 is_vmmdev_req = (req & ~IOCSIZE_MASK) == VBG_IOCTL_VMMDEV_REQUEST(0) ||
115 req == VBG_IOCTL_VMMDEV_REQUEST_BIG ||
116 req == VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT;
117
118 if (is_vmmdev_req)
119 buf = vbg_req_alloc(size, VBG_IOCTL_HDR_TYPE_DEFAULT);
120 else
121 buf = kmalloc(size, GFP_KERNEL);
122 if (!buf)
123 return -ENOMEM;
124
125 *((struct vbg_ioctl_hdr *)buf) = hdr;
126 if (copy_from_user(buf + sizeof(hdr), (void *)arg + sizeof(hdr),
127 hdr.size_in - sizeof(hdr))) {
128 ret = -EFAULT;
129 goto out;
130 }
131 if (hdr.size_in < size)
132 memset(buf + hdr.size_in, 0, size - hdr.size_in);
133
134 ret = vbg_core_ioctl(session, req, buf);
135 if (ret)
136 goto out;
137
138 returned_size = ((struct vbg_ioctl_hdr *)buf)->size_out;
139 if (returned_size > size) {
140 vbg_debug("%s: too much output data %zu > %zu\n",
141 __func__, returned_size, size);
142 returned_size = size;
143 }
144 if (copy_to_user((void *)arg, buf, returned_size) != 0)
145 ret = -EFAULT;
146
147 out:
148 if (is_vmmdev_req)
149 vbg_req_free(buf, size);
150 else
151 kfree(buf);
152
153 return ret;
154 }
155
156 /** The file_operations structures. */
157 static const struct file_operations vbg_misc_device_fops = {
158 .owner = THIS_MODULE,
159 .open = vbg_misc_device_open,
160 .release = vbg_misc_device_close,
161 .unlocked_ioctl = vbg_misc_device_ioctl,
162 #ifdef CONFIG_COMPAT
163 .compat_ioctl = vbg_misc_device_ioctl,
164 #endif
165 };
166 static const struct file_operations vbg_misc_device_user_fops = {
167 .owner = THIS_MODULE,
168 .open = vbg_misc_device_user_open,
169 .release = vbg_misc_device_close,
170 .unlocked_ioctl = vbg_misc_device_ioctl,
171 #ifdef CONFIG_COMPAT
172 .compat_ioctl = vbg_misc_device_ioctl,
173 #endif
174 };
175
176 /**
177 * Called when the input device is first opened.
178 *
179 * Sets up absolute mouse reporting.
180 */
vbg_input_open(struct input_dev * input)181 static int vbg_input_open(struct input_dev *input)
182 {
183 struct vbg_dev *gdev = input_get_drvdata(input);
184 u32 feat = VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE | VMMDEV_MOUSE_NEW_PROTOCOL;
185 int ret;
186
187 ret = vbg_core_set_mouse_status(gdev, feat);
188 if (ret)
189 return ret;
190
191 return 0;
192 }
193
194 /**
195 * Called if all open handles to the input device are closed.
196 *
197 * Disables absolute reporting.
198 */
vbg_input_close(struct input_dev * input)199 static void vbg_input_close(struct input_dev *input)
200 {
201 struct vbg_dev *gdev = input_get_drvdata(input);
202
203 vbg_core_set_mouse_status(gdev, 0);
204 }
205
206 /**
207 * Creates the kernel input device.
208 *
209 * Return: 0 on success, negated errno on failure.
210 */
vbg_create_input_device(struct vbg_dev * gdev)211 static int vbg_create_input_device(struct vbg_dev *gdev)
212 {
213 struct input_dev *input;
214
215 input = devm_input_allocate_device(gdev->dev);
216 if (!input)
217 return -ENOMEM;
218
219 input->id.bustype = BUS_PCI;
220 input->id.vendor = VBOX_VENDORID;
221 input->id.product = VMMDEV_DEVICEID;
222 input->open = vbg_input_open;
223 input->close = vbg_input_close;
224 input->dev.parent = gdev->dev;
225 input->name = "VirtualBox mouse integration";
226
227 input_set_abs_params(input, ABS_X, VMMDEV_MOUSE_RANGE_MIN,
228 VMMDEV_MOUSE_RANGE_MAX, 0, 0);
229 input_set_abs_params(input, ABS_Y, VMMDEV_MOUSE_RANGE_MIN,
230 VMMDEV_MOUSE_RANGE_MAX, 0, 0);
231 input_set_capability(input, EV_KEY, BTN_MOUSE);
232 input_set_drvdata(input, gdev);
233
234 gdev->input = input;
235
236 return input_register_device(gdev->input);
237 }
238
host_version_show(struct device * dev,struct device_attribute * attr,char * buf)239 static ssize_t host_version_show(struct device *dev,
240 struct device_attribute *attr, char *buf)
241 {
242 struct vbg_dev *gdev = dev_get_drvdata(dev);
243
244 return sprintf(buf, "%s\n", gdev->host_version);
245 }
246
host_features_show(struct device * dev,struct device_attribute * attr,char * buf)247 static ssize_t host_features_show(struct device *dev,
248 struct device_attribute *attr, char *buf)
249 {
250 struct vbg_dev *gdev = dev_get_drvdata(dev);
251
252 return sprintf(buf, "%#x\n", gdev->host_features);
253 }
254
255 static DEVICE_ATTR_RO(host_version);
256 static DEVICE_ATTR_RO(host_features);
257
258 /**
259 * Does the PCI detection and init of the device.
260 *
261 * Return: 0 on success, negated errno on failure.
262 */
vbg_pci_probe(struct pci_dev * pci,const struct pci_device_id * id)263 static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
264 {
265 struct device *dev = &pci->dev;
266 resource_size_t io, io_len, mmio, mmio_len;
267 struct vmmdev_memory *vmmdev;
268 struct vbg_dev *gdev;
269 int ret;
270
271 gdev = devm_kzalloc(dev, sizeof(*gdev), GFP_KERNEL);
272 if (!gdev)
273 return -ENOMEM;
274
275 ret = pci_enable_device(pci);
276 if (ret != 0) {
277 vbg_err("vboxguest: Error enabling device: %d\n", ret);
278 return ret;
279 }
280
281 ret = -ENODEV;
282
283 io = pci_resource_start(pci, 0);
284 io_len = pci_resource_len(pci, 0);
285 if (!io || !io_len) {
286 vbg_err("vboxguest: Error IO-port resource (0) is missing\n");
287 goto err_disable_pcidev;
288 }
289 if (devm_request_region(dev, io, io_len, DEVICE_NAME) == NULL) {
290 vbg_err("vboxguest: Error could not claim IO resource\n");
291 ret = -EBUSY;
292 goto err_disable_pcidev;
293 }
294
295 mmio = pci_resource_start(pci, 1);
296 mmio_len = pci_resource_len(pci, 1);
297 if (!mmio || !mmio_len) {
298 vbg_err("vboxguest: Error MMIO resource (1) is missing\n");
299 goto err_disable_pcidev;
300 }
301
302 if (devm_request_mem_region(dev, mmio, mmio_len, DEVICE_NAME) == NULL) {
303 vbg_err("vboxguest: Error could not claim MMIO resource\n");
304 ret = -EBUSY;
305 goto err_disable_pcidev;
306 }
307
308 vmmdev = devm_ioremap(dev, mmio, mmio_len);
309 if (!vmmdev) {
310 vbg_err("vboxguest: Error ioremap failed; MMIO addr=%pap size=%pap\n",
311 &mmio, &mmio_len);
312 goto err_disable_pcidev;
313 }
314
315 /* Validate MMIO region version and size. */
316 if (vmmdev->version != VMMDEV_MEMORY_VERSION ||
317 vmmdev->size < 32 || vmmdev->size > mmio_len) {
318 vbg_err("vboxguest: Bogus VMMDev memory; version=%08x (expected %08x) size=%d (expected <= %d)\n",
319 vmmdev->version, VMMDEV_MEMORY_VERSION,
320 vmmdev->size, (int)mmio_len);
321 goto err_disable_pcidev;
322 }
323
324 gdev->io_port = io;
325 gdev->mmio = vmmdev;
326 gdev->dev = dev;
327 gdev->misc_device.minor = MISC_DYNAMIC_MINOR;
328 gdev->misc_device.name = DEVICE_NAME;
329 gdev->misc_device.fops = &vbg_misc_device_fops;
330 gdev->misc_device_user.minor = MISC_DYNAMIC_MINOR;
331 gdev->misc_device_user.name = DEVICE_NAME_USER;
332 gdev->misc_device_user.fops = &vbg_misc_device_user_fops;
333
334 ret = vbg_core_init(gdev, VMMDEV_EVENT_MOUSE_POSITION_CHANGED);
335 if (ret)
336 goto err_disable_pcidev;
337
338 ret = vbg_create_input_device(gdev);
339 if (ret) {
340 vbg_err("vboxguest: Error creating input device: %d\n", ret);
341 goto err_vbg_core_exit;
342 }
343
344 ret = request_irq(pci->irq, vbg_core_isr, IRQF_SHARED, DEVICE_NAME,
345 gdev);
346 if (ret) {
347 vbg_err("vboxguest: Error requesting irq: %d\n", ret);
348 goto err_vbg_core_exit;
349 }
350
351 ret = misc_register(&gdev->misc_device);
352 if (ret) {
353 vbg_err("vboxguest: Error misc_register %s failed: %d\n",
354 DEVICE_NAME, ret);
355 goto err_free_irq;
356 }
357
358 ret = misc_register(&gdev->misc_device_user);
359 if (ret) {
360 vbg_err("vboxguest: Error misc_register %s failed: %d\n",
361 DEVICE_NAME_USER, ret);
362 goto err_unregister_misc_device;
363 }
364
365 mutex_lock(&vbg_gdev_mutex);
366 if (!vbg_gdev)
367 vbg_gdev = gdev;
368 else
369 ret = -EBUSY;
370 mutex_unlock(&vbg_gdev_mutex);
371
372 if (ret) {
373 vbg_err("vboxguest: Error more then 1 vbox guest pci device\n");
374 goto err_unregister_misc_device_user;
375 }
376
377 pci_set_drvdata(pci, gdev);
378 device_create_file(dev, &dev_attr_host_version);
379 device_create_file(dev, &dev_attr_host_features);
380
381 vbg_info("vboxguest: misc device minor %d, IRQ %d, I/O port %x, MMIO at %pap (size %pap)\n",
382 gdev->misc_device.minor, pci->irq, gdev->io_port,
383 &mmio, &mmio_len);
384
385 return 0;
386
387 err_unregister_misc_device_user:
388 misc_deregister(&gdev->misc_device_user);
389 err_unregister_misc_device:
390 misc_deregister(&gdev->misc_device);
391 err_free_irq:
392 free_irq(pci->irq, gdev);
393 err_vbg_core_exit:
394 vbg_core_exit(gdev);
395 err_disable_pcidev:
396 pci_disable_device(pci);
397
398 return ret;
399 }
400
vbg_pci_remove(struct pci_dev * pci)401 static void vbg_pci_remove(struct pci_dev *pci)
402 {
403 struct vbg_dev *gdev = pci_get_drvdata(pci);
404
405 mutex_lock(&vbg_gdev_mutex);
406 vbg_gdev = NULL;
407 mutex_unlock(&vbg_gdev_mutex);
408
409 free_irq(pci->irq, gdev);
410 device_remove_file(gdev->dev, &dev_attr_host_features);
411 device_remove_file(gdev->dev, &dev_attr_host_version);
412 misc_deregister(&gdev->misc_device_user);
413 misc_deregister(&gdev->misc_device);
414 vbg_core_exit(gdev);
415 pci_disable_device(pci);
416 }
417
vbg_get_gdev(void)418 struct vbg_dev *vbg_get_gdev(void)
419 {
420 mutex_lock(&vbg_gdev_mutex);
421
422 /*
423 * Note on success we keep the mutex locked until vbg_put_gdev(),
424 * this stops vbg_pci_remove from removing the device from underneath
425 * vboxsf. vboxsf will only hold a reference for a short while.
426 */
427 if (vbg_gdev)
428 return vbg_gdev;
429
430 mutex_unlock(&vbg_gdev_mutex);
431 return ERR_PTR(-ENODEV);
432 }
433 EXPORT_SYMBOL(vbg_get_gdev);
434
vbg_put_gdev(struct vbg_dev * gdev)435 void vbg_put_gdev(struct vbg_dev *gdev)
436 {
437 WARN_ON(gdev != vbg_gdev);
438 mutex_unlock(&vbg_gdev_mutex);
439 }
440 EXPORT_SYMBOL(vbg_put_gdev);
441
442 /**
443 * Callback for mouse events.
444 *
445 * This is called at the end of the ISR, after leaving the event spinlock, if
446 * VMMDEV_EVENT_MOUSE_POSITION_CHANGED was raised by the host.
447 *
448 * @gdev: The device extension.
449 */
vbg_linux_mouse_event(struct vbg_dev * gdev)450 void vbg_linux_mouse_event(struct vbg_dev *gdev)
451 {
452 int rc;
453
454 /* Report events to the kernel input device */
455 gdev->mouse_status_req->mouse_features = 0;
456 gdev->mouse_status_req->pointer_pos_x = 0;
457 gdev->mouse_status_req->pointer_pos_y = 0;
458 rc = vbg_req_perform(gdev, gdev->mouse_status_req);
459 if (rc >= 0) {
460 input_report_abs(gdev->input, ABS_X,
461 gdev->mouse_status_req->pointer_pos_x);
462 input_report_abs(gdev->input, ABS_Y,
463 gdev->mouse_status_req->pointer_pos_y);
464 input_sync(gdev->input);
465 }
466 }
467
468 static const struct pci_device_id vbg_pci_ids[] = {
469 { .vendor = VBOX_VENDORID, .device = VMMDEV_DEVICEID },
470 {}
471 };
472 MODULE_DEVICE_TABLE(pci, vbg_pci_ids);
473
474 static struct pci_driver vbg_pci_driver = {
475 .name = DEVICE_NAME,
476 .id_table = vbg_pci_ids,
477 .probe = vbg_pci_probe,
478 .remove = vbg_pci_remove,
479 };
480
481 module_pci_driver(vbg_pci_driver);
482
483 MODULE_AUTHOR("Oracle Corporation");
484 MODULE_DESCRIPTION("Oracle VM VirtualBox Guest Additions for Linux Module");
485 MODULE_LICENSE("GPL");
486