vmci_context.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * VMware VMCI Driver
   4 *
   5 * Copyright (C) 2012 VMware, Inc. All rights reserved.
   6 */
   7
   8#include <linux/vmw_vmci_defs.h>
   9#include <linux/vmw_vmci_api.h>
  10#include <linux/highmem.h>
  11#include <linux/kernel.h>
  12#include <linux/module.h>
  13#include <linux/sched.h>
  14#include <linux/cred.h>
  15#include <linux/slab.h>
  16
  17#include "vmci_queue_pair.h"
  18#include "vmci_datagram.h"
  19#include "vmci_doorbell.h"
  20#include "vmci_context.h"
  21#include "vmci_driver.h"
  22#include "vmci_event.h"
  23
  24/* Use a wide upper bound for the maximum contexts. */
  25#define VMCI_MAX_CONTEXTS 2000
  26
  27/*
  28 * List of current VMCI contexts.  Contexts can be added by
  29 * vmci_ctx_create() and removed via vmci_ctx_destroy().
  30 * These, along with context lookup, are protected by the
  31 * list structure's lock.
  32 */
  33static struct {
  34	struct list_head head;
  35	spinlock_t lock; /* Spinlock for context list operations */
  36} ctx_list = {
  37	.head = LIST_HEAD_INIT(ctx_list.head),
  38	.lock = __SPIN_LOCK_UNLOCKED(ctx_list.lock),
  39};
  40
  41/* Used by contexts that did not set up notify flag pointers */
  42static bool ctx_dummy_notify;
  43
  44static void ctx_signal_notify(struct vmci_ctx *context)
  45{
  46	*context->notify = true;
  47}
  48
  49static void ctx_clear_notify(struct vmci_ctx *context)
  50{
  51	*context->notify = false;
  52}
  53
  54/*
  55 * If nothing requires the attention of the guest, clears both
  56 * notify flag and call.
  57 */
  58static void ctx_clear_notify_call(struct vmci_ctx *context)
  59{
  60	if (context->pending_datagrams == 0 &&
  61	    vmci_handle_arr_get_size(context->pending_doorbell_array) == 0)
  62		ctx_clear_notify(context);
  63}
  64
  65/*
  66 * Sets the context's notify flag iff datagrams are pending for this
  67 * context.  Called from vmci_setup_notify().
  68 */
  69void vmci_ctx_check_signal_notify(struct vmci_ctx *context)
  70{
  71	spin_lock(&context->lock);
  72	if (context->pending_datagrams)
  73		ctx_signal_notify(context);
  74	spin_unlock(&context->lock);
  75}
  76
  77/*
  78 * Allocates and initializes a VMCI context.
  79 */
  80struct vmci_ctx *vmci_ctx_create(u32 cid, u32 priv_flags,
  81				 uintptr_t event_hnd,
  82				 int user_version,
  83				 const struct cred *cred)
  84{
  85	struct vmci_ctx *context;
  86	int error;
  87
  88	if (cid == VMCI_INVALID_ID) {
  89		pr_devel("Invalid context ID for VMCI context\n");
  90		error = -EINVAL;
  91		goto err_out;
  92	}
  93
  94	if (priv_flags & ~VMCI_PRIVILEGE_ALL_FLAGS) {
  95		pr_devel("Invalid flag (flags=0x%x) for VMCI context\n",
  96			 priv_flags);
  97		error = -EINVAL;
  98		goto err_out;
  99	}
 100
 101	if (user_version == 0) {
 102		pr_devel("Invalid suer_version %d\n", user_version);
 103		error = -EINVAL;
 104		goto err_out;
 105	}
 106
 107	context = kzalloc(sizeof(*context), GFP_KERNEL);
 108	if (!context) {
 109		pr_warn("Failed to allocate memory for VMCI context\n");
 110		error = -ENOMEM;
 111		goto err_out;
 112	}
 113
 114	kref_init(&context->kref);
 115	spin_lock_init(&context->lock);
 116	INIT_LIST_HEAD(&context->list_item);
 117	INIT_LIST_HEAD(&context->datagram_queue);
 118	INIT_LIST_HEAD(&context->notifier_list);
 119
 120	/* Initialize host-specific VMCI context. */
 121	init_waitqueue_head(&context->host_context.wait_queue);
 122
 123	context->queue_pair_array =
 124		vmci_handle_arr_create(0, VMCI_MAX_GUEST_QP_COUNT);
 125	if (!context->queue_pair_array) {
 126		error = -ENOMEM;
 127		goto err_free_ctx;
 128	}
 129
 130	context->doorbell_array =
 131		vmci_handle_arr_create(0, VMCI_MAX_GUEST_DOORBELL_COUNT);
 132	if (!context->doorbell_array) {
 133		error = -ENOMEM;
 134		goto err_free_qp_array;
 135	}
 136
 137	context->pending_doorbell_array =
 138		vmci_handle_arr_create(0, VMCI_MAX_GUEST_DOORBELL_COUNT);
 139	if (!context->pending_doorbell_array) {
 140		error = -ENOMEM;
 141		goto err_free_db_array;
 142	}
 143
 144	context->user_version = user_version;
 145
 146	context->priv_flags = priv_flags;
 147
 148	if (cred)
 149		context->cred = get_cred(cred);
 150
 151	context->notify = &ctx_dummy_notify;
 152	context->notify_page = NULL;
 153
 154	/*
 155	 * If we collide with an existing context we generate a new
 156	 * and use it instead. The VMX will determine if regeneration
 157	 * is okay. Since there isn't 4B - 16 VMs running on a given
 158	 * host, the below loop will terminate.
 159	 */
 160	spin_lock(&ctx_list.lock);
 161
 162	while (vmci_ctx_exists(cid)) {
 163		/* We reserve the lowest 16 ids for fixed contexts. */
 164		cid = max(cid, VMCI_RESERVED_CID_LIMIT - 1) + 1;
 165		if (cid == VMCI_INVALID_ID)
 166			cid = VMCI_RESERVED_CID_LIMIT;
 167	}
 168	context->cid = cid;
 169
 170	list_add_tail_rcu(&context->list_item, &ctx_list.head);
 171	spin_unlock(&ctx_list.lock);
 172
 173	return context;
 174
 175 err_free_db_array:
 176	vmci_handle_arr_destroy(context->doorbell_array);
 177 err_free_qp_array:
 178	vmci_handle_arr_destroy(context->queue_pair_array);
 179 err_free_ctx:
 180	kfree(context);
 181 err_out:
 182	return ERR_PTR(error);
 183}
 184
 185/*
 186 * Destroy VMCI context.
 187 */
 188void vmci_ctx_destroy(struct vmci_ctx *context)
 189{
 190	spin_lock(&ctx_list.lock);
 191	list_del_rcu(&context->list_item);
 192	spin_unlock(&ctx_list.lock);
 193	synchronize_rcu();
 194
 195	vmci_ctx_put(context);
 196}
 197
 198/*
 199 * Fire notification for all contexts interested in given cid.
 200 */
 201static int ctx_fire_notification(u32 context_id, u32 priv_flags)
 202{
 203	u32 i, array_size;
 204	struct vmci_ctx *sub_ctx;
 205	struct vmci_handle_arr *subscriber_array;
 206	struct vmci_handle context_handle =
 207		vmci_make_handle(context_id, VMCI_EVENT_HANDLER);
 208
 209	/*
 210	 * We create an array to hold the subscribers we find when
 211	 * scanning through all contexts.
 212	 */
 213	subscriber_array = vmci_handle_arr_create(0, VMCI_MAX_CONTEXTS);
 214	if (subscriber_array == NULL)
 215		return VMCI_ERROR_NO_MEM;
 216
 217	/*
 218	 * Scan all contexts to find who is interested in being
 219	 * notified about given contextID.
 220	 */
 221	rcu_read_lock();
 222	list_for_each_entry_rcu(sub_ctx, &ctx_list.head, list_item) {
 223		struct vmci_handle_list *node;
 224
 225		/*
 226		 * We only deliver notifications of the removal of
 227		 * contexts, if the two contexts are allowed to
 228		 * interact.
 229		 */
 230		if (vmci_deny_interaction(priv_flags, sub_ctx->priv_flags))
 231			continue;
 232
 233		list_for_each_entry_rcu(node, &sub_ctx->notifier_list, node) {
 234			if (!vmci_handle_is_equal(node->handle, context_handle))
 235				continue;
 236
 237			vmci_handle_arr_append_entry(&subscriber_array,
 238					vmci_make_handle(sub_ctx->cid,
 239							 VMCI_EVENT_HANDLER));
 240		}
 241	}
 242	rcu_read_unlock();
 243
 244	/* Fire event to all subscribers. */
 245	array_size = vmci_handle_arr_get_size(subscriber_array);
 246	for (i = 0; i < array_size; i++) {
 247		int result;
 248		struct vmci_event_ctx ev;
 249
 250		ev.msg.hdr.dst = vmci_handle_arr_get_entry(subscriber_array, i);
 251		ev.msg.hdr.src = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID,
 252						  VMCI_CONTEXT_RESOURCE_ID);
 253		ev.msg.hdr.payload_size = sizeof(ev) - sizeof(ev.msg.hdr);
 254		memset((char*)&ev + sizeof(ev.msg.hdr), 0,
 255			ev.msg.hdr.payload_size);
 256		ev.msg.event_data.event = VMCI_EVENT_CTX_REMOVED;
 257		ev.payload.context_id = context_id;
 258
 259		result = vmci_datagram_dispatch(VMCI_HYPERVISOR_CONTEXT_ID,
 260						&ev.msg.hdr, false);
 261		if (result < VMCI_SUCCESS) {
 262			pr_devel("Failed to enqueue event datagram (type=%d) for context (ID=0x%x)\n",
 263				 ev.msg.event_data.event,
 264				 ev.msg.hdr.dst.context);
 265			/* We continue to enqueue on next subscriber. */
 266		}
 267	}
 268	vmci_handle_arr_destroy(subscriber_array);
 269
 270	return VMCI_SUCCESS;
 271}
 272
 273/*
 274 * Queues a VMCI datagram for the appropriate target VM context.
 275 */
 276int vmci_ctx_enqueue_datagram(u32 cid, struct vmci_datagram *dg)
 277{
 278	struct vmci_datagram_queue_entry *dq_entry;
 279	struct vmci_ctx *context;
 280	struct vmci_handle dg_src;
 281	size_t vmci_dg_size;
 282
 283	vmci_dg_size = VMCI_DG_SIZE(dg);
 284	if (vmci_dg_size > VMCI_MAX_DG_SIZE) {
 285		pr_devel("Datagram too large (bytes=%zu)\n", vmci_dg_size);
 286		return VMCI_ERROR_INVALID_ARGS;
 287	}
 288
 289	/* Get the target VM's VMCI context. */
 290	context = vmci_ctx_get(cid);
 291	if (!context) {
 292		pr_devel("Invalid context (ID=0x%x)\n", cid);
 293		return VMCI_ERROR_INVALID_ARGS;
 294	}
 295
 296	/* Allocate guest call entry and add it to the target VM's queue. */
 297	dq_entry = kmalloc(sizeof(*dq_entry), GFP_KERNEL);
 298	if (dq_entry == NULL) {
 299		pr_warn("Failed to allocate memory for datagram\n");
 300		vmci_ctx_put(context);
 301		return VMCI_ERROR_NO_MEM;
 302	}
 303	dq_entry->dg = dg;
 304	dq_entry->dg_size = vmci_dg_size;
 305	dg_src = dg->src;
 306	INIT_LIST_HEAD(&dq_entry->list_item);
 307
 308	spin_lock(&context->lock);
 309
 310	/*
 311	 * We put a higher limit on datagrams from the hypervisor.  If
 312	 * the pending datagram is not from hypervisor, then we check
 313	 * if enqueueing it would exceed the
 314	 * VMCI_MAX_DATAGRAM_QUEUE_SIZE limit on the destination.  If
 315	 * the pending datagram is from hypervisor, we allow it to be
 316	 * queued at the destination side provided we don't reach the
 317	 * VMCI_MAX_DATAGRAM_AND_EVENT_QUEUE_SIZE limit.
 318	 */
 319	if (context->datagram_queue_size + vmci_dg_size >=
 320	    VMCI_MAX_DATAGRAM_QUEUE_SIZE &&
 321	    (!vmci_handle_is_equal(dg_src,
 322				vmci_make_handle
 323				(VMCI_HYPERVISOR_CONTEXT_ID,
 324				 VMCI_CONTEXT_RESOURCE_ID)) ||
 325	     context->datagram_queue_size + vmci_dg_size >=
 326	     VMCI_MAX_DATAGRAM_AND_EVENT_QUEUE_SIZE)) {
 327		spin_unlock(&context->lock);
 328		vmci_ctx_put(context);
 329		kfree(dq_entry);
 330		pr_devel("Context (ID=0x%x) receive queue is full\n", cid);
 331		return VMCI_ERROR_NO_RESOURCES;
 332	}
 333
 334	list_add(&dq_entry->list_item, &context->datagram_queue);
 335	context->pending_datagrams++;
 336	context->datagram_queue_size += vmci_dg_size;
 337	ctx_signal_notify(context);
 338	wake_up(&context->host_context.wait_queue);
 339	spin_unlock(&context->lock);
 340	vmci_ctx_put(context);
 341
 342	return vmci_dg_size;
 343}
 344
 345/*
 346 * Verifies whether a context with the specified context ID exists.
 347 * FIXME: utility is dubious as no decisions can be reliably made
 348 * using this data as context can appear and disappear at any time.
 349 */
 350bool vmci_ctx_exists(u32 cid)
 351{
 352	struct vmci_ctx *context;
 353	bool exists = false;
 354
 355	rcu_read_lock();
 356
 357	list_for_each_entry_rcu(context, &ctx_list.head, list_item) {
 358		if (context->cid == cid) {
 359			exists = true;
 360			break;
 361		}
 362	}
 363
 364	rcu_read_unlock();
 365	return exists;
 366}
 367
 368/*
 369 * Retrieves VMCI context corresponding to the given cid.
 370 */
 371struct vmci_ctx *vmci_ctx_get(u32 cid)
 372{
 373	struct vmci_ctx *c, *context = NULL;
 374
 375	if (cid == VMCI_INVALID_ID)
 376		return NULL;
 377
 378	rcu_read_lock();
 379	list_for_each_entry_rcu(c, &ctx_list.head, list_item) {
 380		if (c->cid == cid) {
 381			/*
 382			 * The context owner drops its own reference to the
 383			 * context only after removing it from the list and
 384			 * waiting for RCU grace period to expire. This
 385			 * means that we are not about to increase the
 386			 * reference count of something that is in the
 387			 * process of being destroyed.
 388			 */
 389			context = c;
 390			kref_get(&context->kref);
 391			break;
 392		}
 393	}
 394	rcu_read_unlock();
 395
 396	return context;
 397}
 398
 399/*
 400 * Deallocates all parts of a context data structure. This
 401 * function doesn't lock the context, because it assumes that
 402 * the caller was holding the last reference to context.
 403 */
 404static void ctx_free_ctx(struct kref *kref)
 405{
 406	struct vmci_ctx *context = container_of(kref, struct vmci_ctx, kref);
 407	struct vmci_datagram_queue_entry *dq_entry, *dq_entry_tmp;
 408	struct vmci_handle temp_handle;
 409	struct vmci_handle_list *notifier, *tmp;
 410
 411	/*
 412	 * Fire event to all contexts interested in knowing this
 413	 * context is dying.
 414	 */
 415	ctx_fire_notification(context->cid, context->priv_flags);
 416
 417	/*
 418	 * Cleanup all queue pair resources attached to context.  If
 419	 * the VM dies without cleaning up, this code will make sure
 420	 * that no resources are leaked.
 421	 */
 422	temp_handle = vmci_handle_arr_get_entry(context->queue_pair_array, 0);
 423	while (!vmci_handle_is_equal(temp_handle, VMCI_INVALID_HANDLE)) {
 424		if (vmci_qp_broker_detach(temp_handle,
 425					  context) < VMCI_SUCCESS) {
 426			/*
 427			 * When vmci_qp_broker_detach() succeeds it
 428			 * removes the handle from the array.  If
 429			 * detach fails, we must remove the handle
 430			 * ourselves.
 431			 */
 432			vmci_handle_arr_remove_entry(context->queue_pair_array,
 433						     temp_handle);
 434		}
 435		temp_handle =
 436		    vmci_handle_arr_get_entry(context->queue_pair_array, 0);
 437	}
 438
 439	/*
 440	 * It is fine to destroy this without locking the callQueue, as
 441	 * this is the only thread having a reference to the context.
 442	 */
 443	list_for_each_entry_safe(dq_entry, dq_entry_tmp,
 444				 &context->datagram_queue, list_item) {
 445		WARN_ON(dq_entry->dg_size != VMCI_DG_SIZE(dq_entry->dg));
 446		list_del(&dq_entry->list_item);
 447		kfree(dq_entry->dg);
 448		kfree(dq_entry);
 449	}
 450
 451	list_for_each_entry_safe(notifier, tmp,
 452				 &context->notifier_list, node) {
 453		list_del(&notifier->node);
 454		kfree(notifier);
 455	}
 456
 457	vmci_handle_arr_destroy(context->queue_pair_array);
 458	vmci_handle_arr_destroy(context->doorbell_array);
 459	vmci_handle_arr_destroy(context->pending_doorbell_array);
 460	vmci_ctx_unset_notify(context);
 461	if (context->cred)
 462		put_cred(context->cred);
 463	kfree(context);
 464}
 465
 466/*
 467 * Drops reference to VMCI context. If this is the last reference to
 468 * the context it will be deallocated. A context is created with
 469 * a reference count of one, and on destroy, it is removed from
 470 * the context list before its reference count is decremented. Thus,
 471 * if we reach zero, we are sure that nobody else are about to increment
 472 * it (they need the entry in the context list for that), and so there
 473 * is no need for locking.
 474 */
 475void vmci_ctx_put(struct vmci_ctx *context)
 476{
 477	kref_put(&context->kref, ctx_free_ctx);
 478}
 479
 480/*
 481 * Dequeues the next datagram and returns it to caller.
 482 * The caller passes in a pointer to the max size datagram
 483 * it can handle and the datagram is only unqueued if the
 484 * size is less than max_size. If larger max_size is set to
 485 * the size of the datagram to give the caller a chance to
 486 * set up a larger buffer for the guestcall.
 487 */
 488int vmci_ctx_dequeue_datagram(struct vmci_ctx *context,
 489			      size_t *max_size,
 490			      struct vmci_datagram **dg)
 491{
 492	struct vmci_datagram_queue_entry *dq_entry;
 493	struct list_head *list_item;
 494	int rv;
 495
 496	/* Dequeue the next datagram entry. */
 497	spin_lock(&context->lock);
 498	if (context->pending_datagrams == 0) {
 499		ctx_clear_notify_call(context);
 500		spin_unlock(&context->lock);
 501		pr_devel("No datagrams pending\n");
 502		return VMCI_ERROR_NO_MORE_DATAGRAMS;
 503	}
 504
 505	list_item = context->datagram_queue.next;
 506
 507	dq_entry =
 508	    list_entry(list_item, struct vmci_datagram_queue_entry, list_item);
 509
 510	/* Check size of caller's buffer. */
 511	if (*max_size < dq_entry->dg_size) {
 512		*max_size = dq_entry->dg_size;
 513		spin_unlock(&context->lock);
 514		pr_devel("Caller's buffer should be at least (size=%u bytes)\n",
 515			 (u32) *max_size);
 516		return VMCI_ERROR_NO_MEM;
 517	}
 518
 519	list_del(list_item);
 520	context->pending_datagrams--;
 521	context->datagram_queue_size -= dq_entry->dg_size;
 522	if (context->pending_datagrams == 0) {
 523		ctx_clear_notify_call(context);
 524		rv = VMCI_SUCCESS;
 525	} else {
 526		/*
 527		 * Return the size of the next datagram.
 528		 */
 529		struct vmci_datagram_queue_entry *next_entry;
 530
 531		list_item = context->datagram_queue.next;
 532		next_entry =
 533		    list_entry(list_item, struct vmci_datagram_queue_entry,
 534			       list_item);
 535
 536		/*
 537		 * The following size_t -> int truncation is fine as
 538		 * the maximum size of a (routable) datagram is 68KB.
 539		 */
 540		rv = (int)next_entry->dg_size;
 541	}
 542	spin_unlock(&context->lock);
 543
 544	/* Caller must free datagram. */
 545	*dg = dq_entry->dg;
 546	dq_entry->dg = NULL;
 547	kfree(dq_entry);
 548
 549	return rv;
 550}
 551
 552/*
 553 * Reverts actions set up by vmci_setup_notify().  Unmaps and unlocks the
 554 * page mapped/locked by vmci_setup_notify().
 555 */
 556void vmci_ctx_unset_notify(struct vmci_ctx *context)
 557{
 558	struct page *notify_page;
 559
 560	spin_lock(&context->lock);
 561
 562	notify_page = context->notify_page;
 563	context->notify = &ctx_dummy_notify;
 564	context->notify_page = NULL;
 565
 566	spin_unlock(&context->lock);
 567
 568	if (notify_page) {
 569		kunmap(notify_page);
 570		put_page(notify_page);
 571	}
 572}
 573
 574/*
 575 * Add remote_cid to list of contexts current contexts wants
 576 * notifications from/about.
 577 */
 578int vmci_ctx_add_notification(u32 context_id, u32 remote_cid)
 579{
 580	struct vmci_ctx *context;
 581	struct vmci_handle_list *notifier, *n;
 582	int result;
 583	bool exists = false;
 584
 585	context = vmci_ctx_get(context_id);
 586	if (!context)
 587		return VMCI_ERROR_NOT_FOUND;
 588
 589	if (VMCI_CONTEXT_IS_VM(context_id) && VMCI_CONTEXT_IS_VM(remote_cid)) {
 590		pr_devel("Context removed notifications for other VMs not supported (src=0x%x, remote=0x%x)\n",
 591			 context_id, remote_cid);
 592		result = VMCI_ERROR_DST_UNREACHABLE;
 593		goto out;
 594	}
 595
 596	if (context->priv_flags & VMCI_PRIVILEGE_FLAG_RESTRICTED) {
 597		result = VMCI_ERROR_NO_ACCESS;
 598		goto out;
 599	}
 600
 601	notifier = kmalloc(sizeof(struct vmci_handle_list), GFP_KERNEL);
 602	if (!notifier) {
 603		result = VMCI_ERROR_NO_MEM;
 604		goto out;
 605	}
 606
 607	INIT_LIST_HEAD(&notifier->node);
 608	notifier->handle = vmci_make_handle(remote_cid, VMCI_EVENT_HANDLER);
 609
 610	spin_lock(&context->lock);
 611
 612	if (context->n_notifiers < VMCI_MAX_CONTEXTS) {
 613		list_for_each_entry(n, &context->notifier_list, node) {
 614			if (vmci_handle_is_equal(n->handle, notifier->handle)) {
 615				exists = true;
 616				break;
 617			}
 618		}
 619
 620		if (exists) {
 621			kfree(notifier);
 622			result = VMCI_ERROR_ALREADY_EXISTS;
 623		} else {
 624			list_add_tail_rcu(&notifier->node,
 625					  &context->notifier_list);
 626			context->n_notifiers++;
 627			result = VMCI_SUCCESS;
 628		}
 629	} else {
 630		kfree(notifier);
 631		result = VMCI_ERROR_NO_MEM;
 632	}
 633
 634	spin_unlock(&context->lock);
 635
 636 out:
 637	vmci_ctx_put(context);
 638	return result;
 639}
 640
 641/*
 642 * Remove remote_cid from current context's list of contexts it is
 643 * interested in getting notifications from/about.
 644 */
 645int vmci_ctx_remove_notification(u32 context_id, u32 remote_cid)
 646{
 647	struct vmci_ctx *context;
 648	struct vmci_handle_list *notifier = NULL, *iter, *tmp;
 649	struct vmci_handle handle;
 650
 651	context = vmci_ctx_get(context_id);
 652	if (!context)
 653		return VMCI_ERROR_NOT_FOUND;
 654
 655	handle = vmci_make_handle(remote_cid, VMCI_EVENT_HANDLER);
 656
 657	spin_lock(&context->lock);
 658	list_for_each_entry_safe(iter, tmp,
 659				 &context->notifier_list, node) {
 660		if (vmci_handle_is_equal(iter->handle, handle)) {
 661			list_del_rcu(&iter->node);
 662			context->n_notifiers--;
 663			notifier = iter;
 664			break;
 665		}
 666	}
 667	spin_unlock(&context->lock);
 668
 669	if (notifier)
 670		kvfree_rcu_mightsleep(notifier);
 671
 672	vmci_ctx_put(context);
 673
 674	return notifier ? VMCI_SUCCESS : VMCI_ERROR_NOT_FOUND;
 675}
 676
 677static int vmci_ctx_get_chkpt_notifiers(struct vmci_ctx *context,
 678					u32 *buf_size, void **pbuf)
 679{
 680	u32 *notifiers;
 681	size_t data_size;
 682	struct vmci_handle_list *entry;
 683	int i = 0;
 684
 685	if (context->n_notifiers == 0) {
 686		*buf_size = 0;
 687		*pbuf = NULL;
 688		return VMCI_SUCCESS;
 689	}
 690
 691	data_size = context->n_notifiers * sizeof(*notifiers);
 692	if (*buf_size < data_size) {
 693		*buf_size = data_size;
 694		return VMCI_ERROR_MORE_DATA;
 695	}
 696
 697	notifiers = kmalloc(data_size, GFP_ATOMIC); /* FIXME: want GFP_KERNEL */
 698	if (!notifiers)
 699		return VMCI_ERROR_NO_MEM;
 700
 701	list_for_each_entry(entry, &context->notifier_list, node)
 702		notifiers[i++] = entry->handle.context;
 703
 704	*buf_size = data_size;
 705	*pbuf = notifiers;
 706	return VMCI_SUCCESS;
 707}
 708
 709static int vmci_ctx_get_chkpt_doorbells(struct vmci_ctx *context,
 710					u32 *buf_size, void **pbuf)
 711{
 712	struct dbell_cpt_state *dbells;
 713	u32 i, n_doorbells;
 714
 715	n_doorbells = vmci_handle_arr_get_size(context->doorbell_array);
 716	if (n_doorbells > 0) {
 717		size_t data_size = n_doorbells * sizeof(*dbells);
 718		if (*buf_size < data_size) {
 719			*buf_size = data_size;
 720			return VMCI_ERROR_MORE_DATA;
 721		}
 722
 723		dbells = kzalloc(data_size, GFP_ATOMIC);
 724		if (!dbells)
 725			return VMCI_ERROR_NO_MEM;
 726
 727		for (i = 0; i < n_doorbells; i++)
 728			dbells[i].handle = vmci_handle_arr_get_entry(
 729						context->doorbell_array, i);
 730
 731		*buf_size = data_size;
 732		*pbuf = dbells;
 733	} else {
 734		*buf_size = 0;
 735		*pbuf = NULL;
 736	}
 737
 738	return VMCI_SUCCESS;
 739}
 740
 741/*
 742 * Get current context's checkpoint state of given type.
 743 */
 744int vmci_ctx_get_chkpt_state(u32 context_id,
 745			     u32 cpt_type,
 746			     u32 *buf_size,
 747			     void **pbuf)
 748{
 749	struct vmci_ctx *context;
 750	int result;
 751
 752	context = vmci_ctx_get(context_id);
 753	if (!context)
 754		return VMCI_ERROR_NOT_FOUND;
 755
 756	spin_lock(&context->lock);
 757
 758	switch (cpt_type) {
 759	case VMCI_NOTIFICATION_CPT_STATE:
 760		result = vmci_ctx_get_chkpt_notifiers(context, buf_size, pbuf);
 761		break;
 762
 763	case VMCI_WELLKNOWN_CPT_STATE:
 764		/*
 765		 * For compatibility with VMX'en with VM to VM communication, we
 766		 * always return zero wellknown handles.
 767		 */
 768
 769		*buf_size = 0;
 770		*pbuf = NULL;
 771		result = VMCI_SUCCESS;
 772		break;
 773
 774	case VMCI_DOORBELL_CPT_STATE:
 775		result = vmci_ctx_get_chkpt_doorbells(context, buf_size, pbuf);
 776		break;
 777
 778	default:
 779		pr_devel("Invalid cpt state (type=%d)\n", cpt_type);
 780		result = VMCI_ERROR_INVALID_ARGS;
 781		break;
 782	}
 783
 784	spin_unlock(&context->lock);
 785	vmci_ctx_put(context);
 786
 787	return result;
 788}
 789
 790/*
 791 * Set current context's checkpoint state of given type.
 792 */
 793int vmci_ctx_set_chkpt_state(u32 context_id,
 794			     u32 cpt_type,
 795			     u32 buf_size,
 796			     void *cpt_buf)
 797{
 798	u32 i;
 799	u32 current_id;
 800	int result = VMCI_SUCCESS;
 801	u32 num_ids = buf_size / sizeof(u32);
 802
 803	if (cpt_type == VMCI_WELLKNOWN_CPT_STATE && num_ids > 0) {
 804		/*
 805		 * We would end up here if VMX with VM to VM communication
 806		 * attempts to restore a checkpoint with wellknown handles.
 807		 */
 808		pr_warn("Attempt to restore checkpoint with obsolete wellknown handles\n");
 809		return VMCI_ERROR_OBSOLETE;
 810	}
 811
 812	if (cpt_type != VMCI_NOTIFICATION_CPT_STATE) {
 813		pr_devel("Invalid cpt state (type=%d)\n", cpt_type);
 814		return VMCI_ERROR_INVALID_ARGS;
 815	}
 816
 817	for (i = 0; i < num_ids && result == VMCI_SUCCESS; i++) {
 818		current_id = ((u32 *)cpt_buf)[i];
 819		result = vmci_ctx_add_notification(context_id, current_id);
 820		if (result != VMCI_SUCCESS)
 821			break;
 822	}
 823	if (result != VMCI_SUCCESS)
 824		pr_devel("Failed to set cpt state (type=%d) (error=%d)\n",
 825			 cpt_type, result);
 826
 827	return result;
 828}
 829
 830/*
 831 * Retrieves the specified context's pending notifications in the
 832 * form of a handle array. The handle arrays returned are the
 833 * actual data - not a copy and should not be modified by the
 834 * caller. They must be released using
 835 * vmci_ctx_rcv_notifications_release.
 836 */
 837int vmci_ctx_rcv_notifications_get(u32 context_id,
 838				   struct vmci_handle_arr **db_handle_array,
 839				   struct vmci_handle_arr **qp_handle_array)
 840{
 841	struct vmci_ctx *context;
 842	int result = VMCI_SUCCESS;
 843
 844	context = vmci_ctx_get(context_id);
 845	if (context == NULL)
 846		return VMCI_ERROR_NOT_FOUND;
 847
 848	spin_lock(&context->lock);
 849
 850	*db_handle_array = context->pending_doorbell_array;
 851	context->pending_doorbell_array =
 852		vmci_handle_arr_create(0, VMCI_MAX_GUEST_DOORBELL_COUNT);
 853	if (!context->pending_doorbell_array) {
 854		context->pending_doorbell_array = *db_handle_array;
 855		*db_handle_array = NULL;
 856		result = VMCI_ERROR_NO_MEM;
 857	}
 858	*qp_handle_array = NULL;
 859
 860	spin_unlock(&context->lock);
 861	vmci_ctx_put(context);
 862
 863	return result;
 864}
 865
 866/*
 867 * Releases handle arrays with pending notifications previously
 868 * retrieved using vmci_ctx_rcv_notifications_get. If the
 869 * notifications were not successfully handed over to the guest,
 870 * success must be false.
 871 */
 872void vmci_ctx_rcv_notifications_release(u32 context_id,
 873					struct vmci_handle_arr *db_handle_array,
 874					struct vmci_handle_arr *qp_handle_array,
 875					bool success)
 876{
 877	struct vmci_ctx *context = vmci_ctx_get(context_id);
 878
 879	spin_lock(&context->lock);
 880	if (!success) {
 881		struct vmci_handle handle;
 882
 883		/*
 884		 * New notifications may have been added while we were not
 885		 * holding the context lock, so we transfer any new pending
 886		 * doorbell notifications to the old array, and reinstate the
 887		 * old array.
 888		 */
 889
 890		handle = vmci_handle_arr_remove_tail(
 891					context->pending_doorbell_array);
 892		while (!vmci_handle_is_invalid(handle)) {
 893			if (!vmci_handle_arr_has_entry(db_handle_array,
 894						       handle)) {
 895				vmci_handle_arr_append_entry(
 896						&db_handle_array, handle);
 897			}
 898			handle = vmci_handle_arr_remove_tail(
 899					context->pending_doorbell_array);
 900		}
 901		vmci_handle_arr_destroy(context->pending_doorbell_array);
 902		context->pending_doorbell_array = db_handle_array;
 903		db_handle_array = NULL;
 904	} else {
 905		ctx_clear_notify_call(context);
 906	}
 907	spin_unlock(&context->lock);
 908	vmci_ctx_put(context);
 909
 910	if (db_handle_array)
 911		vmci_handle_arr_destroy(db_handle_array);
 912
 913	if (qp_handle_array)
 914		vmci_handle_arr_destroy(qp_handle_array);
 915}
 916
 917/*
 918 * Registers that a new doorbell handle has been allocated by the
 919 * context. Only doorbell handles registered can be notified.
 920 */
 921int vmci_ctx_dbell_create(u32 context_id, struct vmci_handle handle)
 922{
 923	struct vmci_ctx *context;
 924	int result;
 925
 926	if (context_id == VMCI_INVALID_ID || vmci_handle_is_invalid(handle))
 927		return VMCI_ERROR_INVALID_ARGS;
 928
 929	context = vmci_ctx_get(context_id);
 930	if (context == NULL)
 931		return VMCI_ERROR_NOT_FOUND;
 932
 933	spin_lock(&context->lock);
 934	if (!vmci_handle_arr_has_entry(context->doorbell_array, handle))
 935		result = vmci_handle_arr_append_entry(&context->doorbell_array,
 936						      handle);
 937	else
 938		result = VMCI_ERROR_DUPLICATE_ENTRY;
 939
 940	spin_unlock(&context->lock);
 941	vmci_ctx_put(context);
 942
 943	return result;
 944}
 945
 946/*
 947 * Unregisters a doorbell handle that was previously registered
 948 * with vmci_ctx_dbell_create.
 949 */
 950int vmci_ctx_dbell_destroy(u32 context_id, struct vmci_handle handle)
 951{
 952	struct vmci_ctx *context;
 953	struct vmci_handle removed_handle;
 954
 955	if (context_id == VMCI_INVALID_ID || vmci_handle_is_invalid(handle))
 956		return VMCI_ERROR_INVALID_ARGS;
 957
 958	context = vmci_ctx_get(context_id);
 959	if (context == NULL)
 960		return VMCI_ERROR_NOT_FOUND;
 961
 962	spin_lock(&context->lock);
 963	removed_handle =
 964	    vmci_handle_arr_remove_entry(context->doorbell_array, handle);
 965	vmci_handle_arr_remove_entry(context->pending_doorbell_array, handle);
 966	spin_unlock(&context->lock);
 967
 968	vmci_ctx_put(context);
 969
 970	return vmci_handle_is_invalid(removed_handle) ?
 971	    VMCI_ERROR_NOT_FOUND : VMCI_SUCCESS;
 972}
 973
 974/*
 975 * Registers a notification of a doorbell handle initiated by the
 976 * specified source context. The notification of doorbells are
 977 * subject to the same isolation rules as datagram delivery. To
 978 * allow host side senders of notifications a finer granularity
 979 * of sender rights than those assigned to the sending context
 980 * itself, the host context is required to specify a different
 981 * set of privilege flags that will override the privileges of
 982 * the source context.
 983 */
 984int vmci_ctx_notify_dbell(u32 src_cid,
 985			  struct vmci_handle handle,
 986			  u32 src_priv_flags)
 987{
 988	struct vmci_ctx *dst_context;
 989	int result;
 990
 991	if (vmci_handle_is_invalid(handle))
 992		return VMCI_ERROR_INVALID_ARGS;
 993
 994	/* Get the target VM's VMCI context. */
 995	dst_context = vmci_ctx_get(handle.context);
 996	if (!dst_context) {
 997		pr_devel("Invalid context (ID=0x%x)\n", handle.context);
 998		return VMCI_ERROR_NOT_FOUND;
 999	}
1000
1001	if (src_cid != handle.context) {
1002		u32 dst_priv_flags;
1003
1004		if (VMCI_CONTEXT_IS_VM(src_cid) &&
1005		    VMCI_CONTEXT_IS_VM(handle.context)) {
1006			pr_devel("Doorbell notification from VM to VM not supported (src=0x%x, dst=0x%x)\n",
1007				 src_cid, handle.context);
1008			result = VMCI_ERROR_DST_UNREACHABLE;
1009			goto out;
1010		}
1011
1012		result = vmci_dbell_get_priv_flags(handle, &dst_priv_flags);
1013		if (result < VMCI_SUCCESS) {
1014			pr_warn("Failed to get privilege flags for destination (handle=0x%x:0x%x)\n",
1015				handle.context, handle.resource);
1016			goto out;
1017		}
1018
1019		if (src_cid != VMCI_HOST_CONTEXT_ID ||
1020		    src_priv_flags == VMCI_NO_PRIVILEGE_FLAGS) {
1021			src_priv_flags = vmci_context_get_priv_flags(src_cid);
1022		}
1023
1024		if (vmci_deny_interaction(src_priv_flags, dst_priv_flags)) {
1025			result = VMCI_ERROR_NO_ACCESS;
1026			goto out;
1027		}
1028	}
1029
1030	if (handle.context == VMCI_HOST_CONTEXT_ID) {
1031		result = vmci_dbell_host_context_notify(src_cid, handle);
1032	} else {
1033		spin_lock(&dst_context->lock);
1034
1035		if (!vmci_handle_arr_has_entry(dst_context->doorbell_array,
1036					       handle)) {
1037			result = VMCI_ERROR_NOT_FOUND;
1038		} else {
1039			if (!vmci_handle_arr_has_entry(
1040					dst_context->pending_doorbell_array,
1041					handle)) {
1042				result = vmci_handle_arr_append_entry(
1043					&dst_context->pending_doorbell_array,
1044					handle);
1045				if (result == VMCI_SUCCESS) {
1046					ctx_signal_notify(dst_context);
1047					wake_up(&dst_context->host_context.wait_queue);
1048				}
1049			} else {
1050				result = VMCI_SUCCESS;
1051			}
1052		}
1053		spin_unlock(&dst_context->lock);
1054	}
1055
1056 out:
1057	vmci_ctx_put(dst_context);
1058
1059	return result;
1060}
1061
1062bool vmci_ctx_supports_host_qp(struct vmci_ctx *context)
1063{
1064	return context && context->user_version >= VMCI_VERSION_HOSTQP;
1065}
1066
1067/*
1068 * Registers that a new queue pair handle has been allocated by
1069 * the context.
1070 */
1071int vmci_ctx_qp_create(struct vmci_ctx *context, struct vmci_handle handle)
1072{
1073	int result;
1074
1075	if (context == NULL || vmci_handle_is_invalid(handle))
1076		return VMCI_ERROR_INVALID_ARGS;
1077
1078	if (!vmci_handle_arr_has_entry(context->queue_pair_array, handle))
1079		result = vmci_handle_arr_append_entry(
1080			&context->queue_pair_array, handle);
1081	else
1082		result = VMCI_ERROR_DUPLICATE_ENTRY;
1083
1084	return result;
1085}
1086
1087/*
1088 * Unregisters a queue pair handle that was previously registered
1089 * with vmci_ctx_qp_create.
1090 */
1091int vmci_ctx_qp_destroy(struct vmci_ctx *context, struct vmci_handle handle)
1092{
1093	struct vmci_handle hndl;
1094
1095	if (context == NULL || vmci_handle_is_invalid(handle))
1096		return VMCI_ERROR_INVALID_ARGS;
1097
1098	hndl = vmci_handle_arr_remove_entry(context->queue_pair_array, handle);
1099
1100	return vmci_handle_is_invalid(hndl) ?
1101		VMCI_ERROR_NOT_FOUND : VMCI_SUCCESS;
1102}
1103
1104/*
1105 * Determines whether a given queue pair handle is registered
1106 * with the given context.
1107 */
1108bool vmci_ctx_qp_exists(struct vmci_ctx *context, struct vmci_handle handle)
1109{
1110	if (context == NULL || vmci_handle_is_invalid(handle))
1111		return false;
1112
1113	return vmci_handle_arr_has_entry(context->queue_pair_array, handle);
1114}
1115
1116/*
1117 * vmci_context_get_priv_flags() - Retrieve privilege flags.
1118 * @context_id: The context ID of the VMCI context.
1119 *
1120 * Retrieves privilege flags of the given VMCI context ID.
1121 */
1122u32 vmci_context_get_priv_flags(u32 context_id)
1123{
1124	if (vmci_host_code_active()) {
1125		u32 flags;
1126		struct vmci_ctx *context;
1127
1128		context = vmci_ctx_get(context_id);
1129		if (!context)
1130			return VMCI_LEAST_PRIVILEGE_FLAGS;
1131
1132		flags = context->priv_flags;
1133		vmci_ctx_put(context);
1134		return flags;
1135	}
1136	return VMCI_NO_PRIVILEGE_FLAGS;
1137}
1138EXPORT_SYMBOL_GPL(vmci_context_get_priv_flags);
1139
1140/*
1141 * vmci_is_context_owner() - Determimnes if user is the context owner
1142 * @context_id: The context ID of the VMCI context.
1143 * @uid:        The host user id (real kernel value).
1144 *
1145 * Determines whether a given UID is the owner of given VMCI context.
1146 */
1147bool vmci_is_context_owner(u32 context_id, kuid_t uid)
1148{
1149	bool is_owner = false;
1150
1151	if (vmci_host_code_active()) {
1152		struct vmci_ctx *context = vmci_ctx_get(context_id);
1153		if (context) {
1154			if (context->cred)
1155				is_owner = uid_eq(context->cred->uid, uid);
1156			vmci_ctx_put(context);
1157		}
1158	}
1159
1160	return is_owner;
1161}
1162EXPORT_SYMBOL_GPL(vmci_is_context_owner);