mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-27 13:05:03 +08:00
a9cd9c044a
Discovered by static code analysis tool. If for some reason communication with the host fails more than preset number of retries, return an error instead of return garbage. Signed-off-by: Sinclair Yeh <syeh@vmware.com> Reviewed-by: Charmaine Lee <charmainel@vmware.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
422 lines
9.6 KiB
C
422 lines
9.6 KiB
C
/*
|
|
* Copyright © 2016 VMware, Inc., Palo Alto, CA., USA
|
|
* All Rights Reserved.
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person obtaining a
|
|
* copy of this software and associated documentation files (the
|
|
* "Software"), to deal in the Software without restriction, including
|
|
* without limitation the rights to use, copy, modify, merge, publish,
|
|
* distribute, sub license, and/or sell copies of the Software, and to
|
|
* permit persons to whom the Software is furnished to do so, subject to
|
|
* the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice (including the
|
|
* next paragraph) shall be included in all copies or substantial portions
|
|
* of the Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
|
|
* THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
|
|
* DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
|
* OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
|
|
* USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
*
|
|
*/
|
|
|
|
|
|
#include <linux/slab.h>
|
|
#include <linux/module.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/frame.h>
|
|
#include <asm/hypervisor.h>
|
|
#include "drmP.h"
|
|
#include "vmwgfx_msg.h"
|
|
|
|
|
|
#define MESSAGE_STATUS_SUCCESS 0x0001
|
|
#define MESSAGE_STATUS_DORECV 0x0002
|
|
#define MESSAGE_STATUS_CPT 0x0010
|
|
#define MESSAGE_STATUS_HB 0x0080
|
|
|
|
#define RPCI_PROTOCOL_NUM 0x49435052
|
|
#define GUESTMSG_FLAG_COOKIE 0x80000000
|
|
|
|
#define RETRIES 3
|
|
|
|
#define VMW_HYPERVISOR_MAGIC 0x564D5868
|
|
#define VMW_HYPERVISOR_PORT 0x5658
|
|
#define VMW_HYPERVISOR_HB_PORT 0x5659
|
|
|
|
#define VMW_PORT_CMD_MSG 30
|
|
#define VMW_PORT_CMD_HB_MSG 0
|
|
#define VMW_PORT_CMD_OPEN_CHANNEL (MSG_TYPE_OPEN << 16 | VMW_PORT_CMD_MSG)
|
|
#define VMW_PORT_CMD_CLOSE_CHANNEL (MSG_TYPE_CLOSE << 16 | VMW_PORT_CMD_MSG)
|
|
#define VMW_PORT_CMD_SENDSIZE (MSG_TYPE_SENDSIZE << 16 | VMW_PORT_CMD_MSG)
|
|
#define VMW_PORT_CMD_RECVSIZE (MSG_TYPE_RECVSIZE << 16 | VMW_PORT_CMD_MSG)
|
|
#define VMW_PORT_CMD_RECVSTATUS (MSG_TYPE_RECVSTATUS << 16 | VMW_PORT_CMD_MSG)
|
|
|
|
#define HIGH_WORD(X) ((X & 0xFFFF0000) >> 16)
|
|
|
|
static u32 vmw_msg_enabled = 1;
|
|
|
|
enum rpc_msg_type {
|
|
MSG_TYPE_OPEN,
|
|
MSG_TYPE_SENDSIZE,
|
|
MSG_TYPE_SENDPAYLOAD,
|
|
MSG_TYPE_RECVSIZE,
|
|
MSG_TYPE_RECVPAYLOAD,
|
|
MSG_TYPE_RECVSTATUS,
|
|
MSG_TYPE_CLOSE,
|
|
};
|
|
|
|
struct rpc_channel {
|
|
u16 channel_id;
|
|
u32 cookie_high;
|
|
u32 cookie_low;
|
|
};
|
|
|
|
|
|
|
|
/**
|
|
* vmw_open_channel
|
|
*
|
|
* @channel: RPC channel
|
|
* @protocol:
|
|
*
|
|
* Returns: 0 on success
|
|
*/
|
|
static int vmw_open_channel(struct rpc_channel *channel, unsigned int protocol)
|
|
{
|
|
unsigned long eax, ebx, ecx, edx, si = 0, di = 0;
|
|
|
|
VMW_PORT(VMW_PORT_CMD_OPEN_CHANNEL,
|
|
(protocol | GUESTMSG_FLAG_COOKIE), si, di,
|
|
VMW_HYPERVISOR_PORT,
|
|
VMW_HYPERVISOR_MAGIC,
|
|
eax, ebx, ecx, edx, si, di);
|
|
|
|
if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0)
|
|
return -EINVAL;
|
|
|
|
channel->channel_id = HIGH_WORD(edx);
|
|
channel->cookie_high = si;
|
|
channel->cookie_low = di;
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
* vmw_close_channel
|
|
*
|
|
* @channel: RPC channel
|
|
*
|
|
* Returns: 0 on success
|
|
*/
|
|
static int vmw_close_channel(struct rpc_channel *channel)
|
|
{
|
|
unsigned long eax, ebx, ecx, edx, si, di;
|
|
|
|
/* Set up additional parameters */
|
|
si = channel->cookie_high;
|
|
di = channel->cookie_low;
|
|
|
|
VMW_PORT(VMW_PORT_CMD_CLOSE_CHANNEL,
|
|
0, si, di,
|
|
(VMW_HYPERVISOR_PORT | (channel->channel_id << 16)),
|
|
VMW_HYPERVISOR_MAGIC,
|
|
eax, ebx, ecx, edx, si, di);
|
|
|
|
if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0)
|
|
return -EINVAL;
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
* vmw_send_msg: Sends a message to the host
|
|
*
|
|
* @channel: RPC channel
|
|
* @logmsg: NULL terminated string
|
|
*
|
|
* Returns: 0 on success
|
|
*/
|
|
static int vmw_send_msg(struct rpc_channel *channel, const char *msg)
|
|
{
|
|
unsigned long eax, ebx, ecx, edx, si, di, bp;
|
|
size_t msg_len = strlen(msg);
|
|
int retries = 0;
|
|
|
|
|
|
while (retries < RETRIES) {
|
|
retries++;
|
|
|
|
/* Set up additional parameters */
|
|
si = channel->cookie_high;
|
|
di = channel->cookie_low;
|
|
|
|
VMW_PORT(VMW_PORT_CMD_SENDSIZE,
|
|
msg_len, si, di,
|
|
VMW_HYPERVISOR_PORT | (channel->channel_id << 16),
|
|
VMW_HYPERVISOR_MAGIC,
|
|
eax, ebx, ecx, edx, si, di);
|
|
|
|
if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0 ||
|
|
(HIGH_WORD(ecx) & MESSAGE_STATUS_HB) == 0) {
|
|
/* Expected success + high-bandwidth. Give up. */
|
|
return -EINVAL;
|
|
}
|
|
|
|
/* Send msg */
|
|
si = (uintptr_t) msg;
|
|
di = channel->cookie_low;
|
|
bp = channel->cookie_high;
|
|
|
|
VMW_PORT_HB_OUT(
|
|
(MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
|
|
msg_len, si, di,
|
|
VMW_HYPERVISOR_HB_PORT | (channel->channel_id << 16),
|
|
VMW_HYPERVISOR_MAGIC, bp,
|
|
eax, ebx, ecx, edx, si, di);
|
|
|
|
if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) != 0) {
|
|
return 0;
|
|
} else if ((HIGH_WORD(ebx) & MESSAGE_STATUS_CPT) != 0) {
|
|
/* A checkpoint occurred. Retry. */
|
|
continue;
|
|
} else {
|
|
break;
|
|
}
|
|
}
|
|
|
|
return -EINVAL;
|
|
}
|
|
STACK_FRAME_NON_STANDARD(vmw_send_msg);
|
|
|
|
|
|
/**
|
|
* vmw_recv_msg: Receives a message from the host
|
|
*
|
|
* Note: It is the caller's responsibility to call kfree() on msg.
|
|
*
|
|
* @channel: channel opened by vmw_open_channel
|
|
* @msg: [OUT] message received from the host
|
|
* @msg_len: message length
|
|
*/
|
|
static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
|
|
size_t *msg_len)
|
|
{
|
|
unsigned long eax, ebx, ecx, edx, si, di, bp;
|
|
char *reply;
|
|
size_t reply_len;
|
|
int retries = 0;
|
|
|
|
|
|
*msg_len = 0;
|
|
*msg = NULL;
|
|
|
|
while (retries < RETRIES) {
|
|
retries++;
|
|
|
|
/* Set up additional parameters */
|
|
si = channel->cookie_high;
|
|
di = channel->cookie_low;
|
|
|
|
VMW_PORT(VMW_PORT_CMD_RECVSIZE,
|
|
0, si, di,
|
|
(VMW_HYPERVISOR_PORT | (channel->channel_id << 16)),
|
|
VMW_HYPERVISOR_MAGIC,
|
|
eax, ebx, ecx, edx, si, di);
|
|
|
|
if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0 ||
|
|
(HIGH_WORD(ecx) & MESSAGE_STATUS_HB) == 0) {
|
|
DRM_ERROR("Failed to get reply size\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
/* No reply available. This is okay. */
|
|
if ((HIGH_WORD(ecx) & MESSAGE_STATUS_DORECV) == 0)
|
|
return 0;
|
|
|
|
reply_len = ebx;
|
|
reply = kzalloc(reply_len + 1, GFP_KERNEL);
|
|
if (reply == NULL) {
|
|
DRM_ERROR("Cannot allocate memory for reply\n");
|
|
return -ENOMEM;
|
|
}
|
|
|
|
|
|
/* Receive buffer */
|
|
si = channel->cookie_high;
|
|
di = (uintptr_t) reply;
|
|
bp = channel->cookie_low;
|
|
|
|
VMW_PORT_HB_IN(
|
|
(MESSAGE_STATUS_SUCCESS << 16) | VMW_PORT_CMD_HB_MSG,
|
|
reply_len, si, di,
|
|
VMW_HYPERVISOR_HB_PORT | (channel->channel_id << 16),
|
|
VMW_HYPERVISOR_MAGIC, bp,
|
|
eax, ebx, ecx, edx, si, di);
|
|
|
|
if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) == 0) {
|
|
kfree(reply);
|
|
|
|
if ((HIGH_WORD(ebx) & MESSAGE_STATUS_CPT) != 0) {
|
|
/* A checkpoint occurred. Retry. */
|
|
continue;
|
|
}
|
|
|
|
return -EINVAL;
|
|
}
|
|
|
|
reply[reply_len] = '\0';
|
|
|
|
|
|
/* Ack buffer */
|
|
si = channel->cookie_high;
|
|
di = channel->cookie_low;
|
|
|
|
VMW_PORT(VMW_PORT_CMD_RECVSTATUS,
|
|
MESSAGE_STATUS_SUCCESS, si, di,
|
|
(VMW_HYPERVISOR_PORT | (channel->channel_id << 16)),
|
|
VMW_HYPERVISOR_MAGIC,
|
|
eax, ebx, ecx, edx, si, di);
|
|
|
|
if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
|
|
kfree(reply);
|
|
|
|
if ((HIGH_WORD(ecx) & MESSAGE_STATUS_CPT) != 0) {
|
|
/* A checkpoint occurred. Retry. */
|
|
continue;
|
|
}
|
|
|
|
return -EINVAL;
|
|
}
|
|
|
|
break;
|
|
}
|
|
|
|
if (retries == RETRIES)
|
|
return -EINVAL;
|
|
|
|
*msg_len = reply_len;
|
|
*msg = reply;
|
|
|
|
return 0;
|
|
}
|
|
STACK_FRAME_NON_STANDARD(vmw_recv_msg);
|
|
|
|
|
|
/**
|
|
* vmw_host_get_guestinfo: Gets a GuestInfo parameter
|
|
*
|
|
* Gets the value of a GuestInfo.* parameter. The value returned will be in
|
|
* a string, and it is up to the caller to post-process.
|
|
*
|
|
* @guest_info_param: Parameter to get, e.g. GuestInfo.svga.gl3
|
|
* @buffer: if NULL, *reply_len will contain reply size.
|
|
* @length: size of the reply_buf. Set to size of reply upon return
|
|
*
|
|
* Returns: 0 on success
|
|
*/
|
|
int vmw_host_get_guestinfo(const char *guest_info_param,
|
|
char *buffer, size_t *length)
|
|
{
|
|
struct rpc_channel channel;
|
|
char *msg, *reply = NULL;
|
|
size_t msg_len, reply_len = 0;
|
|
int ret = 0;
|
|
|
|
|
|
if (!vmw_msg_enabled)
|
|
return -ENODEV;
|
|
|
|
if (!guest_info_param || !length)
|
|
return -EINVAL;
|
|
|
|
msg_len = strlen(guest_info_param) + strlen("info-get ") + 1;
|
|
msg = kzalloc(msg_len, GFP_KERNEL);
|
|
if (msg == NULL) {
|
|
DRM_ERROR("Cannot allocate memory to get %s", guest_info_param);
|
|
return -ENOMEM;
|
|
}
|
|
|
|
sprintf(msg, "info-get %s", guest_info_param);
|
|
|
|
if (vmw_open_channel(&channel, RPCI_PROTOCOL_NUM) ||
|
|
vmw_send_msg(&channel, msg) ||
|
|
vmw_recv_msg(&channel, (void *) &reply, &reply_len) ||
|
|
vmw_close_channel(&channel)) {
|
|
DRM_ERROR("Failed to get %s", guest_info_param);
|
|
|
|
ret = -EINVAL;
|
|
}
|
|
|
|
if (buffer && reply && reply_len > 0) {
|
|
/* Remove reply code, which are the first 2 characters of
|
|
* the reply
|
|
*/
|
|
reply_len = max(reply_len - 2, (size_t) 0);
|
|
reply_len = min(reply_len, *length);
|
|
|
|
if (reply_len > 0)
|
|
memcpy(buffer, reply + 2, reply_len);
|
|
}
|
|
|
|
*length = reply_len;
|
|
|
|
kfree(reply);
|
|
kfree(msg);
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
* vmw_host_log: Sends a log message to the host
|
|
*
|
|
* @log: NULL terminated string
|
|
*
|
|
* Returns: 0 on success
|
|
*/
|
|
int vmw_host_log(const char *log)
|
|
{
|
|
struct rpc_channel channel;
|
|
char *msg;
|
|
int msg_len;
|
|
int ret = 0;
|
|
|
|
|
|
if (!vmw_msg_enabled)
|
|
return -ENODEV;
|
|
|
|
if (!log)
|
|
return ret;
|
|
|
|
msg_len = strlen(log) + strlen("log ") + 1;
|
|
msg = kzalloc(msg_len, GFP_KERNEL);
|
|
if (msg == NULL) {
|
|
DRM_ERROR("Cannot allocate memory for log message\n");
|
|
return -ENOMEM;
|
|
}
|
|
|
|
sprintf(msg, "log %s", log);
|
|
|
|
if (vmw_open_channel(&channel, RPCI_PROTOCOL_NUM) ||
|
|
vmw_send_msg(&channel, msg) ||
|
|
vmw_close_channel(&channel)) {
|
|
DRM_ERROR("Failed to send log\n");
|
|
|
|
ret = -EINVAL;
|
|
}
|
|
|
|
kfree(msg);
|
|
|
|
return ret;
|
|
}
|