This change restricts the reading and setting of the head and tail
pointers on 32bit X86 to 32bit for both correctness and
performance reasons. On uniprocessor X86_32, the atomic64_read
may be implemented as a non-locked cmpxchg8b. This may result in
updates to the pointers done by the VMCI device being overwritten.
On MP systems, there is no such correctness issue, but using 32bit
atomics avoids the overhead of the locked 64bit operation. All this
is safe because the queue size on 32bit systems will never exceed
a 32bit value.
Reviewed-by: NThomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: NJorgen Hansen <jhansen@vmware.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The current maximum size of a queue in a queue pair is 128 MB. If
we increase that in the future, the queue pair allocation routines
may run into overflow issues. This change adds additional checks
to guard against this.
Acked-by: NAndy King <acking@vmware.com>
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NJorgen Hansen <jhansen@vmware.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Ensure that the size filled in by userland in the datagram header
matches the size of the buffer passed down in the IOCTL. Note that we
account for the size of the header itself in the check.
Acked-by: NJorgen Hansen <jhansen@vmware.com>
Acked-by: NAditya Sarwade <asarwade@vmware.com>
Signed-off-by: NAndy King <acking@vmware.com>
Reported-by: NDavid Ramos <daramos@stanford.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

(this is a resend of this patch. Originally sent last year, but post
 appears to have been lost)

This change fixes two bugs in the VMCI host driver related to mapping
the notify boolean from user space into kernel space:
- the actual UVA was rounded up to the next page boundary - resulting
  in memory corruption in the calling process whenever notifications
  would be signalled. This has been fixed by just removing the
  PAGE_ALIGN part, since get_user_pages_fast can figure this out on
  its own
- the mapped page wasn't stored anywhere, so it wasn't unmapped and
  put back when a VMCI context was destroyed. Fixed this by
  remembering the page.
Acked-by: NAndy King <acking@vmware.com>
Acked-by: NDarius Davis <darius@vmware.com>
Signed-off-by: NJorgen Hansen <jhansen@vmware.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch adds support for virtual IOMMU to the vmci module.  We switch
to DMA consistent mappings for guest queuepair and doorbell pages that
are passed to the device.  We still allocate each page individually,
since there's no guarantee that we'll get a contiguous block of physical
for an entire queuepair (especially since we allow up to 128 MiB!).

Also made the split between guest and host in the kernelIf struct much
clearer.  Now it's obvious which fields are which.
Acked-by: NGeorge Zhang <georgezhang@vmware.com>
Acked-by: NAditya Sarwade <asarwade@vmware.com>
Signed-off-by: NAndy King <acking@vmware.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

VMCI driver code implementes both the host and guest personalities of the VMCI driver.
Signed-off-by: NGeorge Zhang <georgezhang@vmware.com>
Acked-by: NAndy king <acking@vmware.com>
Acked-by: NDmitry Torokhov <dtor@vmware.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>