LSM: Revive CONFIG_DEFAULT_SECURITY_* for "make oldconfig"
[muen/linux.git] / drivers / virt / vboxguest / vboxguest_core.c
1 /* SPDX-License-Identifier: (GPL-2.0 OR CDDL-1.0) */
2 /*
3  * vboxguest core guest-device handling code, VBoxGuest.cpp in upstream svn.
4  *
5  * Copyright (C) 2007-2016 Oracle Corporation
6  */
7
8 #include <linux/device.h>
9 #include <linux/mm.h>
10 #include <linux/sched.h>
11 #include <linux/sizes.h>
12 #include <linux/slab.h>
13 #include <linux/vbox_err.h>
14 #include <linux/vbox_utils.h>
15 #include <linux/vmalloc.h>
16 #include "vboxguest_core.h"
17 #include "vboxguest_version.h"
18
19 /* Get the pointer to the first HGCM parameter. */
20 #define VBG_IOCTL_HGCM_CALL_PARMS(a) \
21         ((struct vmmdev_hgcm_function_parameter *)( \
22                 (u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call)))
23 /* Get the pointer to the first HGCM parameter in a 32-bit request. */
24 #define VBG_IOCTL_HGCM_CALL_PARMS32(a) \
25         ((struct vmmdev_hgcm_function_parameter32 *)( \
26                 (u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call)))
27
28 #define GUEST_MAPPINGS_TRIES    5
29
30 /**
31  * Reserves memory in which the VMM can relocate any guest mappings
32  * that are floating around.
33  *
34  * This operation is a little bit tricky since the VMM might not accept
35  * just any address because of address clashes between the three contexts
36  * it operates in, so we try several times.
37  *
38  * Failure to reserve the guest mappings is ignored.
39  *
40  * @gdev:               The Guest extension device.
41  */
42 static void vbg_guest_mappings_init(struct vbg_dev *gdev)
43 {
44         struct vmmdev_hypervisorinfo *req;
45         void *guest_mappings[GUEST_MAPPINGS_TRIES];
46         struct page **pages = NULL;
47         u32 size, hypervisor_size;
48         int i, rc;
49
50         /* Query the required space. */
51         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HYPERVISOR_INFO);
52         if (!req)
53                 return;
54
55         req->hypervisor_start = 0;
56         req->hypervisor_size = 0;
57         rc = vbg_req_perform(gdev, req);
58         if (rc < 0)
59                 goto out;
60
61         /*
62          * The VMM will report back if there is nothing it wants to map, like
63          * for instance in VT-x and AMD-V mode.
64          */
65         if (req->hypervisor_size == 0)
66                 goto out;
67
68         hypervisor_size = req->hypervisor_size;
69         /* Add 4M so that we can align the vmap to 4MiB as the host requires. */
70         size = PAGE_ALIGN(req->hypervisor_size) + SZ_4M;
71
72         pages = kmalloc_array(size >> PAGE_SHIFT, sizeof(*pages), GFP_KERNEL);
73         if (!pages)
74                 goto out;
75
76         gdev->guest_mappings_dummy_page = alloc_page(GFP_HIGHUSER);
77         if (!gdev->guest_mappings_dummy_page)
78                 goto out;
79
80         for (i = 0; i < (size >> PAGE_SHIFT); i++)
81                 pages[i] = gdev->guest_mappings_dummy_page;
82
83         /*
84          * Try several times, the VMM might not accept some addresses because
85          * of address clashes between the three contexts.
86          */
87         for (i = 0; i < GUEST_MAPPINGS_TRIES; i++) {
88                 guest_mappings[i] = vmap(pages, (size >> PAGE_SHIFT),
89                                          VM_MAP, PAGE_KERNEL_RO);
90                 if (!guest_mappings[i])
91                         break;
92
93                 req->header.request_type = VMMDEVREQ_SET_HYPERVISOR_INFO;
94                 req->header.rc = VERR_INTERNAL_ERROR;
95                 req->hypervisor_size = hypervisor_size;
96                 req->hypervisor_start =
97                         (unsigned long)PTR_ALIGN(guest_mappings[i], SZ_4M);
98
99                 rc = vbg_req_perform(gdev, req);
100                 if (rc >= 0) {
101                         gdev->guest_mappings = guest_mappings[i];
102                         break;
103                 }
104         }
105
106         /* Free vmap's from failed attempts. */
107         while (--i >= 0)
108                 vunmap(guest_mappings[i]);
109
110         /* On failure free the dummy-page backing the vmap */
111         if (!gdev->guest_mappings) {
112                 __free_page(gdev->guest_mappings_dummy_page);
113                 gdev->guest_mappings_dummy_page = NULL;
114         }
115
116 out:
117         vbg_req_free(req, sizeof(*req));
118         kfree(pages);
119 }
120
121 /**
122  * Undo what vbg_guest_mappings_init did.
123  *
124  * @gdev:               The Guest extension device.
125  */
126 static void vbg_guest_mappings_exit(struct vbg_dev *gdev)
127 {
128         struct vmmdev_hypervisorinfo *req;
129         int rc;
130
131         if (!gdev->guest_mappings)
132                 return;
133
134         /*
135          * Tell the host that we're going to free the memory we reserved for
136          * it, the free it up. (Leak the memory if anything goes wrong here.)
137          */
138         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_HYPERVISOR_INFO);
139         if (!req)
140                 return;
141
142         req->hypervisor_start = 0;
143         req->hypervisor_size = 0;
144
145         rc = vbg_req_perform(gdev, req);
146
147         vbg_req_free(req, sizeof(*req));
148
149         if (rc < 0) {
150                 vbg_err("%s error: %d\n", __func__, rc);
151                 return;
152         }
153
154         vunmap(gdev->guest_mappings);
155         gdev->guest_mappings = NULL;
156
157         __free_page(gdev->guest_mappings_dummy_page);
158         gdev->guest_mappings_dummy_page = NULL;
159 }
160
161 /**
162  * Report the guest information to the host.
163  * Return: 0 or negative errno value.
164  * @gdev:               The Guest extension device.
165  */
166 static int vbg_report_guest_info(struct vbg_dev *gdev)
167 {
168         /*
169          * Allocate and fill in the two guest info reports.
170          */
171         struct vmmdev_guest_info *req1 = NULL;
172         struct vmmdev_guest_info2 *req2 = NULL;
173         int rc, ret = -ENOMEM;
174
175         req1 = vbg_req_alloc(sizeof(*req1), VMMDEVREQ_REPORT_GUEST_INFO);
176         req2 = vbg_req_alloc(sizeof(*req2), VMMDEVREQ_REPORT_GUEST_INFO2);
177         if (!req1 || !req2)
178                 goto out_free;
179
180         req1->interface_version = VMMDEV_VERSION;
181         req1->os_type = VMMDEV_OSTYPE_LINUX26;
182 #if __BITS_PER_LONG == 64
183         req1->os_type |= VMMDEV_OSTYPE_X64;
184 #endif
185
186         req2->additions_major = VBG_VERSION_MAJOR;
187         req2->additions_minor = VBG_VERSION_MINOR;
188         req2->additions_build = VBG_VERSION_BUILD;
189         req2->additions_revision = VBG_SVN_REV;
190         /* (no features defined yet) */
191         req2->additions_features = 0;
192         strlcpy(req2->name, VBG_VERSION_STRING,
193                 sizeof(req2->name));
194
195         /*
196          * There are two protocols here:
197          *      1. INFO2 + INFO1. Supported by >=3.2.51.
198          *      2. INFO1 and optionally INFO2. The old protocol.
199          *
200          * We try protocol 2 first.  It will fail with VERR_NOT_SUPPORTED
201          * if not supported by the VMMDev (message ordering requirement).
202          */
203         rc = vbg_req_perform(gdev, req2);
204         if (rc >= 0) {
205                 rc = vbg_req_perform(gdev, req1);
206         } else if (rc == VERR_NOT_SUPPORTED || rc == VERR_NOT_IMPLEMENTED) {
207                 rc = vbg_req_perform(gdev, req1);
208                 if (rc >= 0) {
209                         rc = vbg_req_perform(gdev, req2);
210                         if (rc == VERR_NOT_IMPLEMENTED)
211                                 rc = VINF_SUCCESS;
212                 }
213         }
214         ret = vbg_status_code_to_errno(rc);
215
216 out_free:
217         vbg_req_free(req2, sizeof(*req2));
218         vbg_req_free(req1, sizeof(*req1));
219         return ret;
220 }
221
222 /**
223  * Report the guest driver status to the host.
224  * Return: 0 or negative errno value.
225  * @gdev:               The Guest extension device.
226  * @active:             Flag whether the driver is now active or not.
227  */
228 static int vbg_report_driver_status(struct vbg_dev *gdev, bool active)
229 {
230         struct vmmdev_guest_status *req;
231         int rc;
232
233         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_REPORT_GUEST_STATUS);
234         if (!req)
235                 return -ENOMEM;
236
237         req->facility = VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER;
238         if (active)
239                 req->status = VBOXGUEST_FACILITY_STATUS_ACTIVE;
240         else
241                 req->status = VBOXGUEST_FACILITY_STATUS_INACTIVE;
242         req->flags = 0;
243
244         rc = vbg_req_perform(gdev, req);
245         if (rc == VERR_NOT_IMPLEMENTED) /* Compatibility with older hosts. */
246                 rc = VINF_SUCCESS;
247
248         vbg_req_free(req, sizeof(*req));
249
250         return vbg_status_code_to_errno(rc);
251 }
252
253 /**
254  * Inflate the balloon by one chunk. The caller owns the balloon mutex.
255  * Return: 0 or negative errno value.
256  * @gdev:               The Guest extension device.
257  * @chunk_idx:          Index of the chunk.
258  */
259 static int vbg_balloon_inflate(struct vbg_dev *gdev, u32 chunk_idx)
260 {
261         struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req;
262         struct page **pages;
263         int i, rc, ret;
264
265         pages = kmalloc_array(VMMDEV_MEMORY_BALLOON_CHUNK_PAGES,
266                               sizeof(*pages),
267                               GFP_KERNEL | __GFP_NOWARN);
268         if (!pages)
269                 return -ENOMEM;
270
271         req->header.size = sizeof(*req);
272         req->inflate = true;
273         req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
274
275         for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++) {
276                 pages[i] = alloc_page(GFP_KERNEL | __GFP_NOWARN);
277                 if (!pages[i]) {
278                         ret = -ENOMEM;
279                         goto out_error;
280                 }
281
282                 req->phys_page[i] = page_to_phys(pages[i]);
283         }
284
285         rc = vbg_req_perform(gdev, req);
286         if (rc < 0) {
287                 vbg_err("%s error, rc: %d\n", __func__, rc);
288                 ret = vbg_status_code_to_errno(rc);
289                 goto out_error;
290         }
291
292         gdev->mem_balloon.pages[chunk_idx] = pages;
293
294         return 0;
295
296 out_error:
297         while (--i >= 0)
298                 __free_page(pages[i]);
299         kfree(pages);
300
301         return ret;
302 }
303
304 /**
305  * Deflate the balloon by one chunk. The caller owns the balloon mutex.
306  * Return: 0 or negative errno value.
307  * @gdev:               The Guest extension device.
308  * @chunk_idx:          Index of the chunk.
309  */
310 static int vbg_balloon_deflate(struct vbg_dev *gdev, u32 chunk_idx)
311 {
312         struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req;
313         struct page **pages = gdev->mem_balloon.pages[chunk_idx];
314         int i, rc;
315
316         req->header.size = sizeof(*req);
317         req->inflate = false;
318         req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
319
320         for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++)
321                 req->phys_page[i] = page_to_phys(pages[i]);
322
323         rc = vbg_req_perform(gdev, req);
324         if (rc < 0) {
325                 vbg_err("%s error, rc: %d\n", __func__, rc);
326                 return vbg_status_code_to_errno(rc);
327         }
328
329         for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++)
330                 __free_page(pages[i]);
331         kfree(pages);
332         gdev->mem_balloon.pages[chunk_idx] = NULL;
333
334         return 0;
335 }
336
337 /**
338  * Respond to VMMDEV_EVENT_BALLOON_CHANGE_REQUEST events, query the size
339  * the host wants the balloon to be and adjust accordingly.
340  */
341 static void vbg_balloon_work(struct work_struct *work)
342 {
343         struct vbg_dev *gdev =
344                 container_of(work, struct vbg_dev, mem_balloon.work);
345         struct vmmdev_memballoon_info *req = gdev->mem_balloon.get_req;
346         u32 i, chunks;
347         int rc, ret;
348
349         /*
350          * Setting this bit means that we request the value from the host and
351          * change the guest memory balloon according to the returned value.
352          */
353         req->event_ack = VMMDEV_EVENT_BALLOON_CHANGE_REQUEST;
354         rc = vbg_req_perform(gdev, req);
355         if (rc < 0) {
356                 vbg_err("%s error, rc: %d)\n", __func__, rc);
357                 return;
358         }
359
360         /*
361          * The host always returns the same maximum amount of chunks, so
362          * we do this once.
363          */
364         if (!gdev->mem_balloon.max_chunks) {
365                 gdev->mem_balloon.pages =
366                         devm_kcalloc(gdev->dev, req->phys_mem_chunks,
367                                      sizeof(struct page **), GFP_KERNEL);
368                 if (!gdev->mem_balloon.pages)
369                         return;
370
371                 gdev->mem_balloon.max_chunks = req->phys_mem_chunks;
372         }
373
374         chunks = req->balloon_chunks;
375         if (chunks > gdev->mem_balloon.max_chunks) {
376                 vbg_err("%s: illegal balloon size %u (max=%u)\n",
377                         __func__, chunks, gdev->mem_balloon.max_chunks);
378                 return;
379         }
380
381         if (chunks > gdev->mem_balloon.chunks) {
382                 /* inflate */
383                 for (i = gdev->mem_balloon.chunks; i < chunks; i++) {
384                         ret = vbg_balloon_inflate(gdev, i);
385                         if (ret < 0)
386                                 return;
387
388                         gdev->mem_balloon.chunks++;
389                 }
390         } else {
391                 /* deflate */
392                 for (i = gdev->mem_balloon.chunks; i-- > chunks;) {
393                         ret = vbg_balloon_deflate(gdev, i);
394                         if (ret < 0)
395                                 return;
396
397                         gdev->mem_balloon.chunks--;
398                 }
399         }
400 }
401
402 /**
403  * Callback for heartbeat timer.
404  */
405 static void vbg_heartbeat_timer(struct timer_list *t)
406 {
407         struct vbg_dev *gdev = from_timer(gdev, t, heartbeat_timer);
408
409         vbg_req_perform(gdev, gdev->guest_heartbeat_req);
410         mod_timer(&gdev->heartbeat_timer,
411                   msecs_to_jiffies(gdev->heartbeat_interval_ms));
412 }
413
414 /**
415  * Configure the host to check guest's heartbeat
416  * and get heartbeat interval from the host.
417  * Return: 0 or negative errno value.
418  * @gdev:               The Guest extension device.
419  * @enabled:            Set true to enable guest heartbeat checks on host.
420  */
421 static int vbg_heartbeat_host_config(struct vbg_dev *gdev, bool enabled)
422 {
423         struct vmmdev_heartbeat *req;
424         int rc;
425
426         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_HEARTBEAT_CONFIGURE);
427         if (!req)
428                 return -ENOMEM;
429
430         req->enabled = enabled;
431         req->interval_ns = 0;
432         rc = vbg_req_perform(gdev, req);
433         do_div(req->interval_ns, 1000000); /* ns -> ms */
434         gdev->heartbeat_interval_ms = req->interval_ns;
435         vbg_req_free(req, sizeof(*req));
436
437         return vbg_status_code_to_errno(rc);
438 }
439
440 /**
441  * Initializes the heartbeat timer. This feature may be disabled by the host.
442  * Return: 0 or negative errno value.
443  * @gdev:               The Guest extension device.
444  */
445 static int vbg_heartbeat_init(struct vbg_dev *gdev)
446 {
447         int ret;
448
449         /* Make sure that heartbeat checking is disabled if we fail. */
450         ret = vbg_heartbeat_host_config(gdev, false);
451         if (ret < 0)
452                 return ret;
453
454         ret = vbg_heartbeat_host_config(gdev, true);
455         if (ret < 0)
456                 return ret;
457
458         gdev->guest_heartbeat_req = vbg_req_alloc(
459                                         sizeof(*gdev->guest_heartbeat_req),
460                                         VMMDEVREQ_GUEST_HEARTBEAT);
461         if (!gdev->guest_heartbeat_req)
462                 return -ENOMEM;
463
464         vbg_info("%s: Setting up heartbeat to trigger every %d milliseconds\n",
465                  __func__, gdev->heartbeat_interval_ms);
466         mod_timer(&gdev->heartbeat_timer, 0);
467
468         return 0;
469 }
470
471 /**
472  * Cleanup hearbeat code, stop HB timer and disable host heartbeat checking.
473  * @gdev:               The Guest extension device.
474  */
475 static void vbg_heartbeat_exit(struct vbg_dev *gdev)
476 {
477         del_timer_sync(&gdev->heartbeat_timer);
478         vbg_heartbeat_host_config(gdev, false);
479         vbg_req_free(gdev->guest_heartbeat_req,
480                      sizeof(*gdev->guest_heartbeat_req));
481 }
482
483 /**
484  * Applies a change to the bit usage tracker.
485  * Return: true if the mask changed, false if not.
486  * @tracker:            The bit usage tracker.
487  * @changed:            The bits to change.
488  * @previous:           The previous value of the bits.
489  */
490 static bool vbg_track_bit_usage(struct vbg_bit_usage_tracker *tracker,
491                                 u32 changed, u32 previous)
492 {
493         bool global_change = false;
494
495         while (changed) {
496                 u32 bit = ffs(changed) - 1;
497                 u32 bitmask = BIT(bit);
498
499                 if (bitmask & previous) {
500                         tracker->per_bit_usage[bit] -= 1;
501                         if (tracker->per_bit_usage[bit] == 0) {
502                                 global_change = true;
503                                 tracker->mask &= ~bitmask;
504                         }
505                 } else {
506                         tracker->per_bit_usage[bit] += 1;
507                         if (tracker->per_bit_usage[bit] == 1) {
508                                 global_change = true;
509                                 tracker->mask |= bitmask;
510                         }
511                 }
512
513                 changed &= ~bitmask;
514         }
515
516         return global_change;
517 }
518
519 /**
520  * Init and termination worker for resetting the (host) event filter on the host
521  * Return: 0 or negative errno value.
522  * @gdev:                  The Guest extension device.
523  * @fixed_events:          Fixed events (init time).
524  */
525 static int vbg_reset_host_event_filter(struct vbg_dev *gdev,
526                                        u32 fixed_events)
527 {
528         struct vmmdev_mask *req;
529         int rc;
530
531         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK);
532         if (!req)
533                 return -ENOMEM;
534
535         req->not_mask = U32_MAX & ~fixed_events;
536         req->or_mask = fixed_events;
537         rc = vbg_req_perform(gdev, req);
538         if (rc < 0)
539                 vbg_err("%s error, rc: %d\n", __func__, rc);
540
541         vbg_req_free(req, sizeof(*req));
542         return vbg_status_code_to_errno(rc);
543 }
544
545 /**
546  * Changes the event filter mask for the given session.
547  *
548  * This is called in response to VBG_IOCTL_CHANGE_FILTER_MASK as well as to
549  * do session cleanup. Takes the session spinlock.
550  *
551  * Return: 0 or negative errno value.
552  * @gdev:                       The Guest extension device.
553  * @session:                    The session.
554  * @or_mask:                    The events to add.
555  * @not_mask:                   The events to remove.
556  * @session_termination:        Set if we're called by the session cleanup code.
557  *                              This tweaks the error handling so we perform
558  *                              proper session cleanup even if the host
559  *                              misbehaves.
560  */
561 static int vbg_set_session_event_filter(struct vbg_dev *gdev,
562                                         struct vbg_session *session,
563                                         u32 or_mask, u32 not_mask,
564                                         bool session_termination)
565 {
566         struct vmmdev_mask *req;
567         u32 changed, previous;
568         int rc, ret = 0;
569
570         /* Allocate a request buffer before taking the spinlock */
571         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK);
572         if (!req) {
573                 if (!session_termination)
574                         return -ENOMEM;
575                 /* Ignore allocation failure, we must do session cleanup. */
576         }
577
578         mutex_lock(&gdev->session_mutex);
579
580         /* Apply the changes to the session mask. */
581         previous = session->event_filter;
582         session->event_filter |= or_mask;
583         session->event_filter &= ~not_mask;
584
585         /* If anything actually changed, update the global usage counters. */
586         changed = previous ^ session->event_filter;
587         if (!changed)
588                 goto out;
589
590         vbg_track_bit_usage(&gdev->event_filter_tracker, changed, previous);
591         or_mask = gdev->fixed_events | gdev->event_filter_tracker.mask;
592
593         if (gdev->event_filter_host == or_mask || !req)
594                 goto out;
595
596         gdev->event_filter_host = or_mask;
597         req->or_mask = or_mask;
598         req->not_mask = ~or_mask;
599         rc = vbg_req_perform(gdev, req);
600         if (rc < 0) {
601                 ret = vbg_status_code_to_errno(rc);
602
603                 /* Failed, roll back (unless it's session termination time). */
604                 gdev->event_filter_host = U32_MAX;
605                 if (session_termination)
606                         goto out;
607
608                 vbg_track_bit_usage(&gdev->event_filter_tracker, changed,
609                                     session->event_filter);
610                 session->event_filter = previous;
611         }
612
613 out:
614         mutex_unlock(&gdev->session_mutex);
615         vbg_req_free(req, sizeof(*req));
616
617         return ret;
618 }
619
620 /**
621  * Init and termination worker for set guest capabilities to zero on the host.
622  * Return: 0 or negative errno value.
623  * @gdev:               The Guest extension device.
624  */
625 static int vbg_reset_host_capabilities(struct vbg_dev *gdev)
626 {
627         struct vmmdev_mask *req;
628         int rc;
629
630         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES);
631         if (!req)
632                 return -ENOMEM;
633
634         req->not_mask = U32_MAX;
635         req->or_mask = 0;
636         rc = vbg_req_perform(gdev, req);
637         if (rc < 0)
638                 vbg_err("%s error, rc: %d\n", __func__, rc);
639
640         vbg_req_free(req, sizeof(*req));
641         return vbg_status_code_to_errno(rc);
642 }
643
644 /**
645  * Sets the guest capabilities for a session. Takes the session spinlock.
646  * Return: 0 or negative errno value.
647  * @gdev:                       The Guest extension device.
648  * @session:                    The session.
649  * @or_mask:                    The capabilities to add.
650  * @not_mask:                   The capabilities to remove.
651  * @session_termination:        Set if we're called by the session cleanup code.
652  *                              This tweaks the error handling so we perform
653  *                              proper session cleanup even if the host
654  *                              misbehaves.
655  */
656 static int vbg_set_session_capabilities(struct vbg_dev *gdev,
657                                         struct vbg_session *session,
658                                         u32 or_mask, u32 not_mask,
659                                         bool session_termination)
660 {
661         struct vmmdev_mask *req;
662         u32 changed, previous;
663         int rc, ret = 0;
664
665         /* Allocate a request buffer before taking the spinlock */
666         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES);
667         if (!req) {
668                 if (!session_termination)
669                         return -ENOMEM;
670                 /* Ignore allocation failure, we must do session cleanup. */
671         }
672
673         mutex_lock(&gdev->session_mutex);
674
675         /* Apply the changes to the session mask. */
676         previous = session->guest_caps;
677         session->guest_caps |= or_mask;
678         session->guest_caps &= ~not_mask;
679
680         /* If anything actually changed, update the global usage counters. */
681         changed = previous ^ session->guest_caps;
682         if (!changed)
683                 goto out;
684
685         vbg_track_bit_usage(&gdev->guest_caps_tracker, changed, previous);
686         or_mask = gdev->guest_caps_tracker.mask;
687
688         if (gdev->guest_caps_host == or_mask || !req)
689                 goto out;
690
691         gdev->guest_caps_host = or_mask;
692         req->or_mask = or_mask;
693         req->not_mask = ~or_mask;
694         rc = vbg_req_perform(gdev, req);
695         if (rc < 0) {
696                 ret = vbg_status_code_to_errno(rc);
697
698                 /* Failed, roll back (unless it's session termination time). */
699                 gdev->guest_caps_host = U32_MAX;
700                 if (session_termination)
701                         goto out;
702
703                 vbg_track_bit_usage(&gdev->guest_caps_tracker, changed,
704                                     session->guest_caps);
705                 session->guest_caps = previous;
706         }
707
708 out:
709         mutex_unlock(&gdev->session_mutex);
710         vbg_req_free(req, sizeof(*req));
711
712         return ret;
713 }
714
715 /**
716  * vbg_query_host_version get the host feature mask and version information.
717  * Return: 0 or negative errno value.
718  * @gdev:               The Guest extension device.
719  */
720 static int vbg_query_host_version(struct vbg_dev *gdev)
721 {
722         struct vmmdev_host_version *req;
723         int rc, ret;
724
725         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HOST_VERSION);
726         if (!req)
727                 return -ENOMEM;
728
729         rc = vbg_req_perform(gdev, req);
730         ret = vbg_status_code_to_errno(rc);
731         if (ret) {
732                 vbg_err("%s error: %d\n", __func__, rc);
733                 goto out;
734         }
735
736         snprintf(gdev->host_version, sizeof(gdev->host_version), "%u.%u.%ur%u",
737                  req->major, req->minor, req->build, req->revision);
738         gdev->host_features = req->features;
739
740         vbg_info("vboxguest: host-version: %s %#x\n", gdev->host_version,
741                  gdev->host_features);
742
743         if (!(req->features & VMMDEV_HVF_HGCM_PHYS_PAGE_LIST)) {
744                 vbg_err("vboxguest: Error host too old (does not support page-lists)\n");
745                 ret = -ENODEV;
746         }
747
748 out:
749         vbg_req_free(req, sizeof(*req));
750         return ret;
751 }
752
753 /**
754  * Initializes the VBoxGuest device extension when the
755  * device driver is loaded.
756  *
757  * The native code locates the VMMDev on the PCI bus and retrieve
758  * the MMIO and I/O port ranges, this function will take care of
759  * mapping the MMIO memory (if present). Upon successful return
760  * the native code should set up the interrupt handler.
761  *
762  * Return: 0 or negative errno value.
763  *
764  * @gdev:               The Guest extension device.
765  * @fixed_events:       Events that will be enabled upon init and no client
766  *                      will ever be allowed to mask.
767  */
768 int vbg_core_init(struct vbg_dev *gdev, u32 fixed_events)
769 {
770         int ret = -ENOMEM;
771
772         gdev->fixed_events = fixed_events | VMMDEV_EVENT_HGCM;
773         gdev->event_filter_host = U32_MAX;      /* forces a report */
774         gdev->guest_caps_host = U32_MAX;        /* forces a report */
775
776         init_waitqueue_head(&gdev->event_wq);
777         init_waitqueue_head(&gdev->hgcm_wq);
778         spin_lock_init(&gdev->event_spinlock);
779         mutex_init(&gdev->session_mutex);
780         mutex_init(&gdev->cancel_req_mutex);
781         timer_setup(&gdev->heartbeat_timer, vbg_heartbeat_timer, 0);
782         INIT_WORK(&gdev->mem_balloon.work, vbg_balloon_work);
783
784         gdev->mem_balloon.get_req =
785                 vbg_req_alloc(sizeof(*gdev->mem_balloon.get_req),
786                               VMMDEVREQ_GET_MEMBALLOON_CHANGE_REQ);
787         gdev->mem_balloon.change_req =
788                 vbg_req_alloc(sizeof(*gdev->mem_balloon.change_req),
789                               VMMDEVREQ_CHANGE_MEMBALLOON);
790         gdev->cancel_req =
791                 vbg_req_alloc(sizeof(*(gdev->cancel_req)),
792                               VMMDEVREQ_HGCM_CANCEL2);
793         gdev->ack_events_req =
794                 vbg_req_alloc(sizeof(*gdev->ack_events_req),
795                               VMMDEVREQ_ACKNOWLEDGE_EVENTS);
796         gdev->mouse_status_req =
797                 vbg_req_alloc(sizeof(*gdev->mouse_status_req),
798                               VMMDEVREQ_GET_MOUSE_STATUS);
799
800         if (!gdev->mem_balloon.get_req || !gdev->mem_balloon.change_req ||
801             !gdev->cancel_req || !gdev->ack_events_req ||
802             !gdev->mouse_status_req)
803                 goto err_free_reqs;
804
805         ret = vbg_query_host_version(gdev);
806         if (ret)
807                 goto err_free_reqs;
808
809         ret = vbg_report_guest_info(gdev);
810         if (ret) {
811                 vbg_err("vboxguest: vbg_report_guest_info error: %d\n", ret);
812                 goto err_free_reqs;
813         }
814
815         ret = vbg_reset_host_event_filter(gdev, gdev->fixed_events);
816         if (ret) {
817                 vbg_err("vboxguest: Error setting fixed event filter: %d\n",
818                         ret);
819                 goto err_free_reqs;
820         }
821
822         ret = vbg_reset_host_capabilities(gdev);
823         if (ret) {
824                 vbg_err("vboxguest: Error clearing guest capabilities: %d\n",
825                         ret);
826                 goto err_free_reqs;
827         }
828
829         ret = vbg_core_set_mouse_status(gdev, 0);
830         if (ret) {
831                 vbg_err("vboxguest: Error clearing mouse status: %d\n", ret);
832                 goto err_free_reqs;
833         }
834
835         /* These may fail without requiring the driver init to fail. */
836         vbg_guest_mappings_init(gdev);
837         vbg_heartbeat_init(gdev);
838
839         /* All Done! */
840         ret = vbg_report_driver_status(gdev, true);
841         if (ret < 0)
842                 vbg_err("vboxguest: Error reporting driver status: %d\n", ret);
843
844         return 0;
845
846 err_free_reqs:
847         vbg_req_free(gdev->mouse_status_req,
848                      sizeof(*gdev->mouse_status_req));
849         vbg_req_free(gdev->ack_events_req,
850                      sizeof(*gdev->ack_events_req));
851         vbg_req_free(gdev->cancel_req,
852                      sizeof(*gdev->cancel_req));
853         vbg_req_free(gdev->mem_balloon.change_req,
854                      sizeof(*gdev->mem_balloon.change_req));
855         vbg_req_free(gdev->mem_balloon.get_req,
856                      sizeof(*gdev->mem_balloon.get_req));
857         return ret;
858 }
859
860 /**
861  * Call this on exit to clean-up vboxguest-core managed resources.
862  *
863  * The native code should call this before the driver is loaded,
864  * but don't call this on shutdown.
865  * @gdev:               The Guest extension device.
866  */
867 void vbg_core_exit(struct vbg_dev *gdev)
868 {
869         vbg_heartbeat_exit(gdev);
870         vbg_guest_mappings_exit(gdev);
871
872         /* Clear the host flags (mouse status etc). */
873         vbg_reset_host_event_filter(gdev, 0);
874         vbg_reset_host_capabilities(gdev);
875         vbg_core_set_mouse_status(gdev, 0);
876
877         vbg_req_free(gdev->mouse_status_req,
878                      sizeof(*gdev->mouse_status_req));
879         vbg_req_free(gdev->ack_events_req,
880                      sizeof(*gdev->ack_events_req));
881         vbg_req_free(gdev->cancel_req,
882                      sizeof(*gdev->cancel_req));
883         vbg_req_free(gdev->mem_balloon.change_req,
884                      sizeof(*gdev->mem_balloon.change_req));
885         vbg_req_free(gdev->mem_balloon.get_req,
886                      sizeof(*gdev->mem_balloon.get_req));
887 }
888
889 /**
890  * Creates a VBoxGuest user session.
891  *
892  * vboxguest_linux.c calls this when userspace opens the char-device.
893  * Return: A pointer to the new session or an ERR_PTR on error.
894  * @gdev:               The Guest extension device.
895  * @user:               Set if this is a session for the vboxuser device.
896  */
897 struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, bool user)
898 {
899         struct vbg_session *session;
900
901         session = kzalloc(sizeof(*session), GFP_KERNEL);
902         if (!session)
903                 return ERR_PTR(-ENOMEM);
904
905         session->gdev = gdev;
906         session->user_session = user;
907
908         return session;
909 }
910
911 /**
912  * Closes a VBoxGuest session.
913  * @session:            The session to close (and free).
914  */
915 void vbg_core_close_session(struct vbg_session *session)
916 {
917         struct vbg_dev *gdev = session->gdev;
918         int i, rc;
919
920         vbg_set_session_capabilities(gdev, session, 0, U32_MAX, true);
921         vbg_set_session_event_filter(gdev, session, 0, U32_MAX, true);
922
923         for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) {
924                 if (!session->hgcm_client_ids[i])
925                         continue;
926
927                 vbg_hgcm_disconnect(gdev, session->hgcm_client_ids[i], &rc);
928         }
929
930         kfree(session);
931 }
932
933 static int vbg_ioctl_chk(struct vbg_ioctl_hdr *hdr, size_t in_size,
934                          size_t out_size)
935 {
936         if (hdr->size_in  != (sizeof(*hdr) + in_size) ||
937             hdr->size_out != (sizeof(*hdr) + out_size))
938                 return -EINVAL;
939
940         return 0;
941 }
942
943 static int vbg_ioctl_driver_version_info(
944         struct vbg_ioctl_driver_version_info *info)
945 {
946         const u16 vbg_maj_version = VBG_IOC_VERSION >> 16;
947         u16 min_maj_version, req_maj_version;
948
949         if (vbg_ioctl_chk(&info->hdr, sizeof(info->u.in), sizeof(info->u.out)))
950                 return -EINVAL;
951
952         req_maj_version = info->u.in.req_version >> 16;
953         min_maj_version = info->u.in.min_version >> 16;
954
955         if (info->u.in.min_version > info->u.in.req_version ||
956             min_maj_version != req_maj_version)
957                 return -EINVAL;
958
959         if (info->u.in.min_version <= VBG_IOC_VERSION &&
960             min_maj_version == vbg_maj_version) {
961                 info->u.out.session_version = VBG_IOC_VERSION;
962         } else {
963                 info->u.out.session_version = U32_MAX;
964                 info->hdr.rc = VERR_VERSION_MISMATCH;
965         }
966
967         info->u.out.driver_version  = VBG_IOC_VERSION;
968         info->u.out.driver_revision = 0;
969         info->u.out.reserved1      = 0;
970         info->u.out.reserved2      = 0;
971
972         return 0;
973 }
974
975 static bool vbg_wait_event_cond(struct vbg_dev *gdev,
976                                 struct vbg_session *session,
977                                 u32 event_mask)
978 {
979         unsigned long flags;
980         bool wakeup;
981         u32 events;
982
983         spin_lock_irqsave(&gdev->event_spinlock, flags);
984
985         events = gdev->pending_events & event_mask;
986         wakeup = events || session->cancel_waiters;
987
988         spin_unlock_irqrestore(&gdev->event_spinlock, flags);
989
990         return wakeup;
991 }
992
993 /* Must be called with the event_lock held */
994 static u32 vbg_consume_events_locked(struct vbg_dev *gdev,
995                                      struct vbg_session *session,
996                                      u32 event_mask)
997 {
998         u32 events = gdev->pending_events & event_mask;
999
1000         gdev->pending_events &= ~events;
1001         return events;
1002 }
1003
1004 static int vbg_ioctl_wait_for_events(struct vbg_dev *gdev,
1005                                      struct vbg_session *session,
1006                                      struct vbg_ioctl_wait_for_events *wait)
1007 {
1008         u32 timeout_ms = wait->u.in.timeout_ms;
1009         u32 event_mask = wait->u.in.events;
1010         unsigned long flags;
1011         long timeout;
1012         int ret = 0;
1013
1014         if (vbg_ioctl_chk(&wait->hdr, sizeof(wait->u.in), sizeof(wait->u.out)))
1015                 return -EINVAL;
1016
1017         if (timeout_ms == U32_MAX)
1018                 timeout = MAX_SCHEDULE_TIMEOUT;
1019         else
1020                 timeout = msecs_to_jiffies(timeout_ms);
1021
1022         wait->u.out.events = 0;
1023         do {
1024                 timeout = wait_event_interruptible_timeout(
1025                                 gdev->event_wq,
1026                                 vbg_wait_event_cond(gdev, session, event_mask),
1027                                 timeout);
1028
1029                 spin_lock_irqsave(&gdev->event_spinlock, flags);
1030
1031                 if (timeout < 0 || session->cancel_waiters) {
1032                         ret = -EINTR;
1033                 } else if (timeout == 0) {
1034                         ret = -ETIMEDOUT;
1035                 } else {
1036                         wait->u.out.events =
1037                            vbg_consume_events_locked(gdev, session, event_mask);
1038                 }
1039
1040                 spin_unlock_irqrestore(&gdev->event_spinlock, flags);
1041
1042                 /*
1043                  * Someone else may have consumed the event(s) first, in
1044                  * which case we go back to waiting.
1045                  */
1046         } while (ret == 0 && wait->u.out.events == 0);
1047
1048         return ret;
1049 }
1050
1051 static int vbg_ioctl_interrupt_all_wait_events(struct vbg_dev *gdev,
1052                                                struct vbg_session *session,
1053                                                struct vbg_ioctl_hdr *hdr)
1054 {
1055         unsigned long flags;
1056
1057         if (hdr->size_in != sizeof(*hdr) || hdr->size_out != sizeof(*hdr))
1058                 return -EINVAL;
1059
1060         spin_lock_irqsave(&gdev->event_spinlock, flags);
1061         session->cancel_waiters = true;
1062         spin_unlock_irqrestore(&gdev->event_spinlock, flags);
1063
1064         wake_up(&gdev->event_wq);
1065
1066         return 0;
1067 }
1068
1069 /**
1070  * Checks if the VMM request is allowed in the context of the given session.
1071  * Return: 0 or negative errno value.
1072  * @gdev:               The Guest extension device.
1073  * @session:            The calling session.
1074  * @req:                The request.
1075  */
1076 static int vbg_req_allowed(struct vbg_dev *gdev, struct vbg_session *session,
1077                            const struct vmmdev_request_header *req)
1078 {
1079         const struct vmmdev_guest_status *guest_status;
1080         bool trusted_apps_only;
1081
1082         switch (req->request_type) {
1083         /* Trusted users apps only. */
1084         case VMMDEVREQ_QUERY_CREDENTIALS:
1085         case VMMDEVREQ_REPORT_CREDENTIALS_JUDGEMENT:
1086         case VMMDEVREQ_REGISTER_SHARED_MODULE:
1087         case VMMDEVREQ_UNREGISTER_SHARED_MODULE:
1088         case VMMDEVREQ_WRITE_COREDUMP:
1089         case VMMDEVREQ_GET_CPU_HOTPLUG_REQ:
1090         case VMMDEVREQ_SET_CPU_HOTPLUG_STATUS:
1091         case VMMDEVREQ_CHECK_SHARED_MODULES:
1092         case VMMDEVREQ_GET_PAGE_SHARING_STATUS:
1093         case VMMDEVREQ_DEBUG_IS_PAGE_SHARED:
1094         case VMMDEVREQ_REPORT_GUEST_STATS:
1095         case VMMDEVREQ_REPORT_GUEST_USER_STATE:
1096         case VMMDEVREQ_GET_STATISTICS_CHANGE_REQ:
1097                 trusted_apps_only = true;
1098                 break;
1099
1100         /* Anyone. */
1101         case VMMDEVREQ_GET_MOUSE_STATUS:
1102         case VMMDEVREQ_SET_MOUSE_STATUS:
1103         case VMMDEVREQ_SET_POINTER_SHAPE:
1104         case VMMDEVREQ_GET_HOST_VERSION:
1105         case VMMDEVREQ_IDLE:
1106         case VMMDEVREQ_GET_HOST_TIME:
1107         case VMMDEVREQ_SET_POWER_STATUS:
1108         case VMMDEVREQ_ACKNOWLEDGE_EVENTS:
1109         case VMMDEVREQ_CTL_GUEST_FILTER_MASK:
1110         case VMMDEVREQ_REPORT_GUEST_STATUS:
1111         case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ:
1112         case VMMDEVREQ_VIDEMODE_SUPPORTED:
1113         case VMMDEVREQ_GET_HEIGHT_REDUCTION:
1114         case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ2:
1115         case VMMDEVREQ_VIDEMODE_SUPPORTED2:
1116         case VMMDEVREQ_VIDEO_ACCEL_ENABLE:
1117         case VMMDEVREQ_VIDEO_ACCEL_FLUSH:
1118         case VMMDEVREQ_VIDEO_SET_VISIBLE_REGION:
1119         case VMMDEVREQ_GET_DISPLAY_CHANGE_REQEX:
1120         case VMMDEVREQ_GET_SEAMLESS_CHANGE_REQ:
1121         case VMMDEVREQ_GET_VRDPCHANGE_REQ:
1122         case VMMDEVREQ_LOG_STRING:
1123         case VMMDEVREQ_GET_SESSION_ID:
1124                 trusted_apps_only = false;
1125                 break;
1126
1127         /* Depends on the request parameters... */
1128         case VMMDEVREQ_REPORT_GUEST_CAPABILITIES:
1129                 guest_status = (const struct vmmdev_guest_status *)req;
1130                 switch (guest_status->facility) {
1131                 case VBOXGUEST_FACILITY_TYPE_ALL:
1132                 case VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER:
1133                         vbg_err("Denying userspace vmm report guest cap. call facility %#08x\n",
1134                                 guest_status->facility);
1135                         return -EPERM;
1136                 case VBOXGUEST_FACILITY_TYPE_VBOX_SERVICE:
1137                         trusted_apps_only = true;
1138                         break;
1139                 case VBOXGUEST_FACILITY_TYPE_VBOX_TRAY_CLIENT:
1140                 case VBOXGUEST_FACILITY_TYPE_SEAMLESS:
1141                 case VBOXGUEST_FACILITY_TYPE_GRAPHICS:
1142                 default:
1143                         trusted_apps_only = false;
1144                         break;
1145                 }
1146                 break;
1147
1148         /* Anything else is not allowed. */
1149         default:
1150                 vbg_err("Denying userspace vmm call type %#08x\n",
1151                         req->request_type);
1152                 return -EPERM;
1153         }
1154
1155         if (trusted_apps_only && session->user_session) {
1156                 vbg_err("Denying userspace vmm call type %#08x through vboxuser device node\n",
1157                         req->request_type);
1158                 return -EPERM;
1159         }
1160
1161         return 0;
1162 }
1163
1164 static int vbg_ioctl_vmmrequest(struct vbg_dev *gdev,
1165                                 struct vbg_session *session, void *data)
1166 {
1167         struct vbg_ioctl_hdr *hdr = data;
1168         int ret;
1169
1170         if (hdr->size_in != hdr->size_out)
1171                 return -EINVAL;
1172
1173         if (hdr->size_in > VMMDEV_MAX_VMMDEVREQ_SIZE)
1174                 return -E2BIG;
1175
1176         if (hdr->type == VBG_IOCTL_HDR_TYPE_DEFAULT)
1177                 return -EINVAL;
1178
1179         ret = vbg_req_allowed(gdev, session, data);
1180         if (ret < 0)
1181                 return ret;
1182
1183         vbg_req_perform(gdev, data);
1184         WARN_ON(hdr->rc == VINF_HGCM_ASYNC_EXECUTE);
1185
1186         return 0;
1187 }
1188
1189 static int vbg_ioctl_hgcm_connect(struct vbg_dev *gdev,
1190                                   struct vbg_session *session,
1191                                   struct vbg_ioctl_hgcm_connect *conn)
1192 {
1193         u32 client_id;
1194         int i, ret;
1195
1196         if (vbg_ioctl_chk(&conn->hdr, sizeof(conn->u.in), sizeof(conn->u.out)))
1197                 return -EINVAL;
1198
1199         /* Find a free place in the sessions clients array and claim it */
1200         mutex_lock(&gdev->session_mutex);
1201         for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) {
1202                 if (!session->hgcm_client_ids[i]) {
1203                         session->hgcm_client_ids[i] = U32_MAX;
1204                         break;
1205                 }
1206         }
1207         mutex_unlock(&gdev->session_mutex);
1208
1209         if (i >= ARRAY_SIZE(session->hgcm_client_ids))
1210                 return -EMFILE;
1211
1212         ret = vbg_hgcm_connect(gdev, &conn->u.in.loc, &client_id,
1213                                &conn->hdr.rc);
1214
1215         mutex_lock(&gdev->session_mutex);
1216         if (ret == 0 && conn->hdr.rc >= 0) {
1217                 conn->u.out.client_id = client_id;
1218                 session->hgcm_client_ids[i] = client_id;
1219         } else {
1220                 conn->u.out.client_id = 0;
1221                 session->hgcm_client_ids[i] = 0;
1222         }
1223         mutex_unlock(&gdev->session_mutex);
1224
1225         return ret;
1226 }
1227
1228 static int vbg_ioctl_hgcm_disconnect(struct vbg_dev *gdev,
1229                                      struct vbg_session *session,
1230                                      struct vbg_ioctl_hgcm_disconnect *disconn)
1231 {
1232         u32 client_id;
1233         int i, ret;
1234
1235         if (vbg_ioctl_chk(&disconn->hdr, sizeof(disconn->u.in), 0))
1236                 return -EINVAL;
1237
1238         client_id = disconn->u.in.client_id;
1239         if (client_id == 0 || client_id == U32_MAX)
1240                 return -EINVAL;
1241
1242         mutex_lock(&gdev->session_mutex);
1243         for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) {
1244                 if (session->hgcm_client_ids[i] == client_id) {
1245                         session->hgcm_client_ids[i] = U32_MAX;
1246                         break;
1247                 }
1248         }
1249         mutex_unlock(&gdev->session_mutex);
1250
1251         if (i >= ARRAY_SIZE(session->hgcm_client_ids))
1252                 return -EINVAL;
1253
1254         ret = vbg_hgcm_disconnect(gdev, client_id, &disconn->hdr.rc);
1255
1256         mutex_lock(&gdev->session_mutex);
1257         if (ret == 0 && disconn->hdr.rc >= 0)
1258                 session->hgcm_client_ids[i] = 0;
1259         else
1260                 session->hgcm_client_ids[i] = client_id;
1261         mutex_unlock(&gdev->session_mutex);
1262
1263         return ret;
1264 }
1265
1266 static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
1267                                struct vbg_session *session, bool f32bit,
1268                                struct vbg_ioctl_hgcm_call *call)
1269 {
1270         size_t actual_size;
1271         u32 client_id;
1272         int i, ret;
1273
1274         if (call->hdr.size_in < sizeof(*call))
1275                 return -EINVAL;
1276
1277         if (call->hdr.size_in != call->hdr.size_out)
1278                 return -EINVAL;
1279
1280         if (call->parm_count > VMMDEV_HGCM_MAX_PARMS)
1281                 return -E2BIG;
1282
1283         client_id = call->client_id;
1284         if (client_id == 0 || client_id == U32_MAX)
1285                 return -EINVAL;
1286
1287         actual_size = sizeof(*call);
1288         if (f32bit)
1289                 actual_size += call->parm_count *
1290                                sizeof(struct vmmdev_hgcm_function_parameter32);
1291         else
1292                 actual_size += call->parm_count *
1293                                sizeof(struct vmmdev_hgcm_function_parameter);
1294         if (call->hdr.size_in < actual_size) {
1295                 vbg_debug("VBG_IOCTL_HGCM_CALL: hdr.size_in %d required size is %zd\n",
1296                           call->hdr.size_in, actual_size);
1297                 return -EINVAL;
1298         }
1299         call->hdr.size_out = actual_size;
1300
1301         /*
1302          * Validate the client id.
1303          */
1304         mutex_lock(&gdev->session_mutex);
1305         for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++)
1306                 if (session->hgcm_client_ids[i] == client_id)
1307                         break;
1308         mutex_unlock(&gdev->session_mutex);
1309         if (i >= ARRAY_SIZE(session->hgcm_client_ids)) {
1310                 vbg_debug("VBG_IOCTL_HGCM_CALL: INVALID handle. u32Client=%#08x\n",
1311                           client_id);
1312                 return -EINVAL;
1313         }
1314
1315         if (IS_ENABLED(CONFIG_COMPAT) && f32bit)
1316                 ret = vbg_hgcm_call32(gdev, client_id,
1317                                       call->function, call->timeout_ms,
1318                                       VBG_IOCTL_HGCM_CALL_PARMS32(call),
1319                                       call->parm_count, &call->hdr.rc);
1320         else
1321                 ret = vbg_hgcm_call(gdev, client_id,
1322                                     call->function, call->timeout_ms,
1323                                     VBG_IOCTL_HGCM_CALL_PARMS(call),
1324                                     call->parm_count, &call->hdr.rc);
1325
1326         if (ret == -E2BIG) {
1327                 /* E2BIG needs to be reported through the hdr.rc field. */
1328                 call->hdr.rc = VERR_OUT_OF_RANGE;
1329                 ret = 0;
1330         }
1331
1332         if (ret && ret != -EINTR && ret != -ETIMEDOUT)
1333                 vbg_err("VBG_IOCTL_HGCM_CALL error: %d\n", ret);
1334
1335         return ret;
1336 }
1337
1338 static int vbg_ioctl_log(struct vbg_ioctl_log *log)
1339 {
1340         if (log->hdr.size_out != sizeof(log->hdr))
1341                 return -EINVAL;
1342
1343         vbg_info("%.*s", (int)(log->hdr.size_in - sizeof(log->hdr)),
1344                  log->u.in.msg);
1345
1346         return 0;
1347 }
1348
1349 static int vbg_ioctl_change_filter_mask(struct vbg_dev *gdev,
1350                                         struct vbg_session *session,
1351                                         struct vbg_ioctl_change_filter *filter)
1352 {
1353         u32 or_mask, not_mask;
1354
1355         if (vbg_ioctl_chk(&filter->hdr, sizeof(filter->u.in), 0))
1356                 return -EINVAL;
1357
1358         or_mask = filter->u.in.or_mask;
1359         not_mask = filter->u.in.not_mask;
1360
1361         if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK)
1362                 return -EINVAL;
1363
1364         return vbg_set_session_event_filter(gdev, session, or_mask, not_mask,
1365                                             false);
1366 }
1367
1368 static int vbg_ioctl_change_guest_capabilities(struct vbg_dev *gdev,
1369              struct vbg_session *session, struct vbg_ioctl_set_guest_caps *caps)
1370 {
1371         u32 or_mask, not_mask;
1372         int ret;
1373
1374         if (vbg_ioctl_chk(&caps->hdr, sizeof(caps->u.in), sizeof(caps->u.out)))
1375                 return -EINVAL;
1376
1377         or_mask = caps->u.in.or_mask;
1378         not_mask = caps->u.in.not_mask;
1379
1380         if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK)
1381                 return -EINVAL;
1382
1383         ret = vbg_set_session_capabilities(gdev, session, or_mask, not_mask,
1384                                            false);
1385         if (ret)
1386                 return ret;
1387
1388         caps->u.out.session_caps = session->guest_caps;
1389         caps->u.out.global_caps = gdev->guest_caps_host;
1390
1391         return 0;
1392 }
1393
1394 static int vbg_ioctl_check_balloon(struct vbg_dev *gdev,
1395                                    struct vbg_ioctl_check_balloon *balloon_info)
1396 {
1397         if (vbg_ioctl_chk(&balloon_info->hdr, 0, sizeof(balloon_info->u.out)))
1398                 return -EINVAL;
1399
1400         balloon_info->u.out.balloon_chunks = gdev->mem_balloon.chunks;
1401         /*
1402          * Under Linux we handle VMMDEV_EVENT_BALLOON_CHANGE_REQUEST
1403          * events entirely in the kernel, see vbg_core_isr().
1404          */
1405         balloon_info->u.out.handle_in_r3 = false;
1406
1407         return 0;
1408 }
1409
1410 static int vbg_ioctl_write_core_dump(struct vbg_dev *gdev,
1411                                      struct vbg_ioctl_write_coredump *dump)
1412 {
1413         struct vmmdev_write_core_dump *req;
1414
1415         if (vbg_ioctl_chk(&dump->hdr, sizeof(dump->u.in), 0))
1416                 return -EINVAL;
1417
1418         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_WRITE_COREDUMP);
1419         if (!req)
1420                 return -ENOMEM;
1421
1422         req->flags = dump->u.in.flags;
1423         dump->hdr.rc = vbg_req_perform(gdev, req);
1424
1425         vbg_req_free(req, sizeof(*req));
1426         return 0;
1427 }
1428
1429 /**
1430  * Common IOCtl for user to kernel communication.
1431  * Return: 0 or negative errno value.
1432  * @session:    The client session.
1433  * @req:        The requested function.
1434  * @data:       The i/o data buffer, minimum size sizeof(struct vbg_ioctl_hdr).
1435  */
1436 int vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data)
1437 {
1438         unsigned int req_no_size = req & ~IOCSIZE_MASK;
1439         struct vbg_dev *gdev = session->gdev;
1440         struct vbg_ioctl_hdr *hdr = data;
1441         bool f32bit = false;
1442
1443         hdr->rc = VINF_SUCCESS;
1444         if (!hdr->size_out)
1445                 hdr->size_out = hdr->size_in;
1446
1447         /*
1448          * hdr->version and hdr->size_in / hdr->size_out minimum size are
1449          * already checked by vbg_misc_device_ioctl().
1450          */
1451
1452         /* For VMMDEV_REQUEST hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT */
1453         if (req_no_size == VBG_IOCTL_VMMDEV_REQUEST(0) ||
1454             req == VBG_IOCTL_VMMDEV_REQUEST_BIG)
1455                 return vbg_ioctl_vmmrequest(gdev, session, data);
1456
1457         if (hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT)
1458                 return -EINVAL;
1459
1460         /* Fixed size requests. */
1461         switch (req) {
1462         case VBG_IOCTL_DRIVER_VERSION_INFO:
1463                 return vbg_ioctl_driver_version_info(data);
1464         case VBG_IOCTL_HGCM_CONNECT:
1465                 return vbg_ioctl_hgcm_connect(gdev, session, data);
1466         case VBG_IOCTL_HGCM_DISCONNECT:
1467                 return vbg_ioctl_hgcm_disconnect(gdev, session, data);
1468         case VBG_IOCTL_WAIT_FOR_EVENTS:
1469                 return vbg_ioctl_wait_for_events(gdev, session, data);
1470         case VBG_IOCTL_INTERRUPT_ALL_WAIT_FOR_EVENTS:
1471                 return vbg_ioctl_interrupt_all_wait_events(gdev, session, data);
1472         case VBG_IOCTL_CHANGE_FILTER_MASK:
1473                 return vbg_ioctl_change_filter_mask(gdev, session, data);
1474         case VBG_IOCTL_CHANGE_GUEST_CAPABILITIES:
1475                 return vbg_ioctl_change_guest_capabilities(gdev, session, data);
1476         case VBG_IOCTL_CHECK_BALLOON:
1477                 return vbg_ioctl_check_balloon(gdev, data);
1478         case VBG_IOCTL_WRITE_CORE_DUMP:
1479                 return vbg_ioctl_write_core_dump(gdev, data);
1480         }
1481
1482         /* Variable sized requests. */
1483         switch (req_no_size) {
1484 #ifdef CONFIG_COMPAT
1485         case VBG_IOCTL_HGCM_CALL_32(0):
1486                 f32bit = true;
1487 #endif
1488                 /* Fall through */
1489         case VBG_IOCTL_HGCM_CALL(0):
1490                 return vbg_ioctl_hgcm_call(gdev, session, f32bit, data);
1491         case VBG_IOCTL_LOG(0):
1492                 return vbg_ioctl_log(data);
1493         }
1494
1495         vbg_debug("VGDrvCommonIoCtl: Unknown req %#08x\n", req);
1496         return -ENOTTY;
1497 }
1498
1499 /**
1500  * Report guest supported mouse-features to the host.
1501  *
1502  * Return: 0 or negative errno value.
1503  * @gdev:               The Guest extension device.
1504  * @features:           The set of features to report to the host.
1505  */
1506 int vbg_core_set_mouse_status(struct vbg_dev *gdev, u32 features)
1507 {
1508         struct vmmdev_mouse_status *req;
1509         int rc;
1510
1511         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_MOUSE_STATUS);
1512         if (!req)
1513                 return -ENOMEM;
1514
1515         req->mouse_features = features;
1516         req->pointer_pos_x = 0;
1517         req->pointer_pos_y = 0;
1518
1519         rc = vbg_req_perform(gdev, req);
1520         if (rc < 0)
1521                 vbg_err("%s error, rc: %d\n", __func__, rc);
1522
1523         vbg_req_free(req, sizeof(*req));
1524         return vbg_status_code_to_errno(rc);
1525 }
1526
1527 /** Core interrupt service routine. */
1528 irqreturn_t vbg_core_isr(int irq, void *dev_id)
1529 {
1530         struct vbg_dev *gdev = dev_id;
1531         struct vmmdev_events *req = gdev->ack_events_req;
1532         bool mouse_position_changed = false;
1533         unsigned long flags;
1534         u32 events = 0;
1535         int rc;
1536
1537         if (!gdev->mmio->V.V1_04.have_events)
1538                 return IRQ_NONE;
1539
1540         /* Get and acknowlegde events. */
1541         req->header.rc = VERR_INTERNAL_ERROR;
1542         req->events = 0;
1543         rc = vbg_req_perform(gdev, req);
1544         if (rc < 0) {
1545                 vbg_err("Error performing events req, rc: %d\n", rc);
1546                 return IRQ_NONE;
1547         }
1548
1549         events = req->events;
1550
1551         if (events & VMMDEV_EVENT_MOUSE_POSITION_CHANGED) {
1552                 mouse_position_changed = true;
1553                 events &= ~VMMDEV_EVENT_MOUSE_POSITION_CHANGED;
1554         }
1555
1556         if (events & VMMDEV_EVENT_HGCM) {
1557                 wake_up(&gdev->hgcm_wq);
1558                 events &= ~VMMDEV_EVENT_HGCM;
1559         }
1560
1561         if (events & VMMDEV_EVENT_BALLOON_CHANGE_REQUEST) {
1562                 schedule_work(&gdev->mem_balloon.work);
1563                 events &= ~VMMDEV_EVENT_BALLOON_CHANGE_REQUEST;
1564         }
1565
1566         if (events) {
1567                 spin_lock_irqsave(&gdev->event_spinlock, flags);
1568                 gdev->pending_events |= events;
1569                 spin_unlock_irqrestore(&gdev->event_spinlock, flags);
1570
1571                 wake_up(&gdev->event_wq);
1572         }
1573
1574         if (mouse_position_changed)
1575                 vbg_linux_mouse_event(gdev);
1576
1577         return IRQ_HANDLED;
1578 }