1 /* 2 * vfio protocol over a UNIX socket device handling. 3 * 4 * Copyright © 2018, 2021 Oracle and/or its affiliates. 5 * 6 * SPDX-License-Identifier: GPL-2.0-or-later 7 */ 8 9 #include "qemu/osdep.h" 10 #include "qapi/error.h" 11 #include "qemu/error-report.h" 12 13 #include "hw/vfio-user/device.h" 14 #include "hw/vfio-user/trace.h" 15 16 /* 17 * These are to defend against a malign server trying 18 * to force us to run out of memory. 19 */ 20 #define VFIO_USER_MAX_REGIONS 100 21 #define VFIO_USER_MAX_IRQS 50 22 23 bool vfio_user_get_device_info(VFIOUserProxy *proxy, 24 struct vfio_device_info *info, Error **errp) 25 { 26 VFIOUserDeviceInfo msg; 27 uint32_t argsz = sizeof(msg) - sizeof(msg.hdr); 28 29 memset(&msg, 0, sizeof(msg)); 30 vfio_user_request_msg(&msg.hdr, VFIO_USER_DEVICE_GET_INFO, sizeof(msg), 0); 31 msg.argsz = argsz; 32 33 if (!vfio_user_send_wait(proxy, &msg.hdr, NULL, 0, errp)) { 34 return false; 35 } 36 37 if (msg.hdr.flags & VFIO_USER_ERROR) { 38 error_setg_errno(errp, -msg.hdr.error_reply, 39 "VFIO_USER_DEVICE_GET_INFO failed"); 40 return false; 41 } 42 43 trace_vfio_user_get_info(msg.num_regions, msg.num_irqs); 44 45 memcpy(info, &msg.argsz, argsz); 46 47 /* defend against a malicious server */ 48 if (info->num_regions > VFIO_USER_MAX_REGIONS || 49 info->num_irqs > VFIO_USER_MAX_IRQS) { 50 error_setg_errno(errp, EINVAL, "invalid reply"); 51 return false; 52 } 53 54 return true; 55 } 56 57 static int vfio_user_get_region_info(VFIOUserProxy *proxy, 58 struct vfio_region_info *info, 59 VFIOUserFDs *fds) 60 { 61 g_autofree VFIOUserRegionInfo *msgp = NULL; 62 Error *local_err = NULL; 63 uint32_t size; 64 65 /* data returned can be larger than vfio_region_info */ 66 if (info->argsz < sizeof(*info)) { 67 error_printf("vfio_user_get_region_info argsz too small\n"); 68 return -E2BIG; 69 } 70 if (fds != NULL && fds->send_fds != 0) { 71 error_printf("vfio_user_get_region_info can't send FDs\n"); 72 return -EINVAL; 73 } 74 75 size = info->argsz + sizeof(VFIOUserHdr); 76 msgp = g_malloc0(size); 77 78 vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_GET_REGION_INFO, 79 sizeof(*msgp), 0); 80 msgp->argsz = info->argsz; 81 msgp->index = info->index; 82 83 if (!vfio_user_send_wait(proxy, &msgp->hdr, fds, size, &local_err)) { 84 error_prepend(&local_err, "%s: ", __func__); 85 error_report_err(local_err); 86 return -EFAULT; 87 } 88 89 if (msgp->hdr.flags & VFIO_USER_ERROR) { 90 return -msgp->hdr.error_reply; 91 } 92 trace_vfio_user_get_region_info(msgp->index, msgp->flags, msgp->size); 93 94 memcpy(info, &msgp->argsz, info->argsz); 95 return 0; 96 } 97 98 99 static int vfio_user_device_io_get_region_info(VFIODevice *vbasedev, 100 struct vfio_region_info *info, 101 int *fd) 102 { 103 VFIOUserFDs fds = { 0, 1, fd}; 104 int ret; 105 106 if (info->index > vbasedev->num_regions) { 107 return -EINVAL; 108 } 109 110 ret = vfio_user_get_region_info(vbasedev->proxy, info, &fds); 111 if (ret) { 112 return ret; 113 } 114 115 /* cap_offset in valid area */ 116 if ((info->flags & VFIO_REGION_INFO_FLAG_CAPS) && 117 (info->cap_offset < sizeof(*info) || info->cap_offset > info->argsz)) { 118 return -EINVAL; 119 } 120 121 return 0; 122 } 123 124 /* 125 * Socket-based io_ops 126 */ 127 VFIODeviceIOOps vfio_user_device_io_ops_sock = { 128 .get_region_info = vfio_user_device_io_get_region_info, 129 }; 130