drivers/virt/vboxguest/vboxguest_core.c

   1 /* SPDX-License-Identifier: (GPL-2.0 OR CDDL-1.0) */
   2 /*
   3  * vboxguest core guest-device handling code, VBoxGuest.cpp in upstream svn.
   4  *
   5  * Copyright (C) 2007-2016 Oracle Corporation
   6  */
   7
   8 #include <linux/device.h>
   9 #include <linux/io.h>
  10 #include <linux/mm.h>
  11 #include <linux/sched.h>
  12 #include <linux/sizes.h>
  13 #include <linux/slab.h>
  14 #include <linux/vbox_err.h>
  15 #include <linux/vbox_utils.h>
  16 #include <linux/vmalloc.h>
  17 #include "vboxguest_core.h"
  18 #include "vboxguest_version.h"
  19
  20 /* Get the pointer to the first HGCM parameter. */
  21 #define VBG_IOCTL_HGCM_CALL_PARMS(a) \
  22         ((struct vmmdev_hgcm_function_parameter *)( \
  23                 (u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call)))
  24 /* Get the pointer to the first HGCM parameter in a 32-bit request. */
  25 #define VBG_IOCTL_HGCM_CALL_PARMS32(a) \
  26         ((struct vmmdev_hgcm_function_parameter32 *)( \
  27                 (u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call)))
  28
  29 #define GUEST_MAPPINGS_TRIES    5
  30
  31 #define VBG_KERNEL_REQUEST \
  32         (VMMDEV_REQUESTOR_KERNEL | VMMDEV_REQUESTOR_USR_DRV | \
  33          VMMDEV_REQUESTOR_CON_DONT_KNOW | VMMDEV_REQUESTOR_TRUST_NOT_GIVEN)
  34
  35 /**
  36  * Reserves memory in which the VMM can relocate any guest mappings
  37  * that are floating around.
  38  *
  39  * This operation is a little bit tricky since the VMM might not accept
  40  * just any address because of address clashes between the three contexts
  41  * it operates in, so we try several times.
  42  *
  43  * Failure to reserve the guest mappings is ignored.
  44  *
  45  * @gdev:               The Guest extension device.
  46  */
  47 static void vbg_guest_mappings_init(struct vbg_dev *gdev)
  48 {
  49         struct vmmdev_hypervisorinfo *req;
  50         void *guest_mappings[GUEST_MAPPINGS_TRIES];
  51         struct page **pages = NULL;
  52         u32 size, hypervisor_size;
  53         int i, rc;
  54
  55         /* Query the required space. */
  56         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HYPERVISOR_INFO,
  57                             VBG_KERNEL_REQUEST);
  58         if (!req)
  59                 return;
  60
  61         req->hypervisor_start = 0;
  62         req->hypervisor_size = 0;
  63         rc = vbg_req_perform(gdev, req);
  64         if (rc < 0)
  65                 goto out;
  66
  67         /*
  68          * The VMM will report back if there is nothing it wants to map, like
  69          * for instance in VT-x and AMD-V mode.
  70          */
  71         if (req->hypervisor_size == 0)
  72                 goto out;
  73
  74         hypervisor_size = req->hypervisor_size;
  75         /* Add 4M so that we can align the vmap to 4MiB as the host requires. */
  76         size = PAGE_ALIGN(req->hypervisor_size) + SZ_4M;
  77
  78         pages = kmalloc_array(size >> PAGE_SHIFT, sizeof(*pages), GFP_KERNEL);
  79         if (!pages)
  80                 goto out;
  81
  82         gdev->guest_mappings_dummy_page = alloc_page(GFP_HIGHUSER);
  83         if (!gdev->guest_mappings_dummy_page)
  84                 goto out;
  85
  86         for (i = 0; i < (size >> PAGE_SHIFT); i++)
  87                 pages[i] = gdev->guest_mappings_dummy_page;
  88
  89         /*
  90          * Try several times, the VMM might not accept some addresses because
  91          * of address clashes between the three contexts.
  92          */
  93         for (i = 0; i < GUEST_MAPPINGS_TRIES; i++) {
  94                 guest_mappings[i] = vmap(pages, (size >> PAGE_SHIFT),
  95                                          VM_MAP, PAGE_KERNEL_RO);
  96                 if (!guest_mappings[i])
  97                         break;
  98
  99                 req->header.request_type = VMMDEVREQ_SET_HYPERVISOR_INFO;
 100                 req->header.rc = VERR_INTERNAL_ERROR;
 101                 req->hypervisor_size = hypervisor_size;
 102                 req->hypervisor_start =
 103                         (unsigned long)PTR_ALIGN(guest_mappings[i], SZ_4M);
 104
 105                 rc = vbg_req_perform(gdev, req);
 106                 if (rc >= 0) {
 107                         gdev->guest_mappings = guest_mappings[i];
 108                         break;
 109                 }
 110         }
 111
 112         /* Free vmap's from failed attempts. */
 113         while (--i >= 0)
 114                 vunmap(guest_mappings[i]);
 115
 116         /* On failure free the dummy-page backing the vmap */
 117         if (!gdev->guest_mappings) {
 118                 __free_page(gdev->guest_mappings_dummy_page);
 119                 gdev->guest_mappings_dummy_page = NULL;
 120         }
 121
 122 out:
 123         vbg_req_free(req, sizeof(*req));
 124         kfree(pages);
 125 }
 126
 127 /**
 128  * Undo what vbg_guest_mappings_init did.
 129  *
 130  * @gdev:               The Guest extension device.
 131  */
 132 static void vbg_guest_mappings_exit(struct vbg_dev *gdev)
 133 {
 134         struct vmmdev_hypervisorinfo *req;
 135         int rc;
 136
 137         if (!gdev->guest_mappings)
 138                 return;
 139
 140         /*
 141          * Tell the host that we're going to free the memory we reserved for
 142          * it, the free it up. (Leak the memory if anything goes wrong here.)
 143          */
 144         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_HYPERVISOR_INFO,
 145                             VBG_KERNEL_REQUEST);
 146         if (!req)
 147                 return;
 148
 149         req->hypervisor_start = 0;
 150         req->hypervisor_size = 0;
 151
 152         rc = vbg_req_perform(gdev, req);
 153
 154         vbg_req_free(req, sizeof(*req));
 155
 156         if (rc < 0) {
 157                 vbg_err("%s error: %d\n", __func__, rc);
 158                 return;
 159         }
 160
 161         vunmap(gdev->guest_mappings);
 162         gdev->guest_mappings = NULL;
 163
 164         __free_page(gdev->guest_mappings_dummy_page);
 165         gdev->guest_mappings_dummy_page = NULL;
 166 }
 167
 168 /**
 169  * Report the guest information to the host.
 170  * Return: 0 or negative errno value.
 171  * @gdev:               The Guest extension device.
 172  */
 173 static int vbg_report_guest_info(struct vbg_dev *gdev)
 174 {
 175         /*
 176          * Allocate and fill in the two guest info reports.
 177          */
 178         struct vmmdev_guest_info *req1 = NULL;
 179         struct vmmdev_guest_info2 *req2 = NULL;
 180         int rc, ret = -ENOMEM;
 181
 182         req1 = vbg_req_alloc(sizeof(*req1), VMMDEVREQ_REPORT_GUEST_INFO,
 183                              VBG_KERNEL_REQUEST);
 184         req2 = vbg_req_alloc(sizeof(*req2), VMMDEVREQ_REPORT_GUEST_INFO2,
 185                              VBG_KERNEL_REQUEST);
 186         if (!req1 || !req2)
 187                 goto out_free;
 188
 189         req1->interface_version = VMMDEV_VERSION;
 190         req1->os_type = VMMDEV_OSTYPE_LINUX26;
 191 #if __BITS_PER_LONG == 64
 192         req1->os_type |= VMMDEV_OSTYPE_X64;
 193 #endif
 194
 195         req2->additions_major = VBG_VERSION_MAJOR;
 196         req2->additions_minor = VBG_VERSION_MINOR;
 197         req2->additions_build = VBG_VERSION_BUILD;
 198         req2->additions_revision = VBG_SVN_REV;
 199         req2->additions_features =
 200                 VMMDEV_GUEST_INFO2_ADDITIONS_FEATURES_REQUESTOR_INFO;
 201         strlcpy(req2->name, VBG_VERSION_STRING,
 202                 sizeof(req2->name));
 203
 204         /*
 205          * There are two protocols here:
 206          *      1. INFO2 + INFO1. Supported by >=3.2.51.
 207          *      2. INFO1 and optionally INFO2. The old protocol.
 208          *
 209          * We try protocol 2 first.  It will fail with VERR_NOT_SUPPORTED
 210          * if not supported by the VMMDev (message ordering requirement).
 211          */
 212         rc = vbg_req_perform(gdev, req2);
 213         if (rc >= 0) {
 214                 rc = vbg_req_perform(gdev, req1);
 215         } else if (rc == VERR_NOT_SUPPORTED || rc == VERR_NOT_IMPLEMENTED) {
 216                 rc = vbg_req_perform(gdev, req1);
 217                 if (rc >= 0) {
 218                         rc = vbg_req_perform(gdev, req2);
 219                         if (rc == VERR_NOT_IMPLEMENTED)
 220                                 rc = VINF_SUCCESS;
 221                 }
 222         }
 223         ret = vbg_status_code_to_errno(rc);
 224
 225 out_free:
 226         vbg_req_free(req2, sizeof(*req2));
 227         vbg_req_free(req1, sizeof(*req1));
 228         return ret;
 229 }
 230
 231 /**
 232  * Report the guest driver status to the host.
 233  * Return: 0 or negative errno value.
 234  * @gdev:               The Guest extension device.
 235  * @active:             Flag whether the driver is now active or not.
 236  */
 237 static int vbg_report_driver_status(struct vbg_dev *gdev, bool active)
 238 {
 239         struct vmmdev_guest_status *req;
 240         int rc;
 241
 242         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_REPORT_GUEST_STATUS,
 243                             VBG_KERNEL_REQUEST);
 244         if (!req)
 245                 return -ENOMEM;
 246
 247         req->facility = VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER;
 248         if (active)
 249                 req->status = VBOXGUEST_FACILITY_STATUS_ACTIVE;
 250         else
 251                 req->status = VBOXGUEST_FACILITY_STATUS_INACTIVE;
 252         req->flags = 0;
 253
 254         rc = vbg_req_perform(gdev, req);
 255         if (rc == VERR_NOT_IMPLEMENTED) /* Compatibility with older hosts. */
 256                 rc = VINF_SUCCESS;
 257
 258         vbg_req_free(req, sizeof(*req));
 259
 260         return vbg_status_code_to_errno(rc);
 261 }
 262
 263 /**
 264  * Inflate the balloon by one chunk. The caller owns the balloon mutex.
 265  * Return: 0 or negative errno value.
 266  * @gdev:               The Guest extension device.
 267  * @chunk_idx:          Index of the chunk.
 268  */
 269 static int vbg_balloon_inflate(struct vbg_dev *gdev, u32 chunk_idx)
 270 {
 271         struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req;
 272         struct page **pages;
 273         int i, rc, ret;
 274
 275         pages = kmalloc_array(VMMDEV_MEMORY_BALLOON_CHUNK_PAGES,
 276                               sizeof(*pages),
 277                               GFP_KERNEL | __GFP_NOWARN);
 278         if (!pages)
 279                 return -ENOMEM;
 280
 281         req->header.size = sizeof(*req);
 282         req->inflate = true;
 283         req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
 284
 285         for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++) {
 286                 pages[i] = alloc_page(GFP_KERNEL | __GFP_NOWARN);
 287                 if (!pages[i]) {
 288                         ret = -ENOMEM;
 289                         goto out_error;
 290                 }
 291
 292                 req->phys_page[i] = page_to_phys(pages[i]);
 293         }
 294
 295         rc = vbg_req_perform(gdev, req);
 296         if (rc < 0) {
 297                 vbg_err("%s error, rc: %d\n", __func__, rc);
 298                 ret = vbg_status_code_to_errno(rc);
 299                 goto out_error;
 300         }
 301
 302         gdev->mem_balloon.pages[chunk_idx] = pages;
 303
 304         return 0;
 305
 306 out_error:
 307         while (--i >= 0)
 308                 __free_page(pages[i]);
 309         kfree(pages);
 310
 311         return ret;
 312 }
 313
 314 /**
 315  * Deflate the balloon by one chunk. The caller owns the balloon mutex.
 316  * Return: 0 or negative errno value.
 317  * @gdev:               The Guest extension device.
 318  * @chunk_idx:          Index of the chunk.
 319  */
 320 static int vbg_balloon_deflate(struct vbg_dev *gdev, u32 chunk_idx)
 321 {
 322         struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req;
 323         struct page **pages = gdev->mem_balloon.pages[chunk_idx];
 324         int i, rc;
 325
 326         req->header.size = sizeof(*req);
 327         req->inflate = false;
 328         req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
 329
 330         for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++)
 331                 req->phys_page[i] = page_to_phys(pages[i]);
 332
 333         rc = vbg_req_perform(gdev, req);
 334         if (rc < 0) {
 335                 vbg_err("%s error, rc: %d\n", __func__, rc);
 336                 return vbg_status_code_to_errno(rc);
 337         }
 338
 339         for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++)
 340                 __free_page(pages[i]);
 341         kfree(pages);
 342         gdev->mem_balloon.pages[chunk_idx] = NULL;
 343
 344         return 0;
 345 }
 346
 347 /**
 348  * Respond to VMMDEV_EVENT_BALLOON_CHANGE_REQUEST events, query the size
 349  * the host wants the balloon to be and adjust accordingly.
 350  */
 351 static void vbg_balloon_work(struct work_struct *work)
 352 {
 353         struct vbg_dev *gdev =
 354                 container_of(work, struct vbg_dev, mem_balloon.work);
 355         struct vmmdev_memballoon_info *req = gdev->mem_balloon.get_req;
 356         u32 i, chunks;
 357         int rc, ret;
 358
 359         /*
 360          * Setting this bit means that we request the value from the host and
 361          * change the guest memory balloon according to the returned value.
 362          */
 363         req->event_ack = VMMDEV_EVENT_BALLOON_CHANGE_REQUEST;
 364         rc = vbg_req_perform(gdev, req);
 365         if (rc < 0) {
 366                 vbg_err("%s error, rc: %d)\n", __func__, rc);
 367                 return;
 368         }
 369
 370         /*
 371          * The host always returns the same maximum amount of chunks, so
 372          * we do this once.
 373          */
 374         if (!gdev->mem_balloon.max_chunks) {
 375                 gdev->mem_balloon.pages =
 376                         devm_kcalloc(gdev->dev, req->phys_mem_chunks,
 377                                      sizeof(struct page **), GFP_KERNEL);
 378                 if (!gdev->mem_balloon.pages)
 379                         return;
 380
 381                 gdev->mem_balloon.max_chunks = req->phys_mem_chunks;
 382         }
 383
 384         chunks = req->balloon_chunks;
 385         if (chunks > gdev->mem_balloon.max_chunks) {
 386                 vbg_err("%s: illegal balloon size %u (max=%u)\n",
 387                         __func__, chunks, gdev->mem_balloon.max_chunks);
 388                 return;
 389         }
 390
 391         if (chunks > gdev->mem_balloon.chunks) {
 392                 /* inflate */
 393                 for (i = gdev->mem_balloon.chunks; i < chunks; i++) {
 394                         ret = vbg_balloon_inflate(gdev, i);
 395                         if (ret < 0)
 396                                 return;
 397
 398                         gdev->mem_balloon.chunks++;
 399                 }
 400         } else {
 401                 /* deflate */
 402                 for (i = gdev->mem_balloon.chunks; i-- > chunks;) {
 403                         ret = vbg_balloon_deflate(gdev, i);
 404                         if (ret < 0)
 405                                 return;
 406
 407                         gdev->mem_balloon.chunks--;
 408                 }
 409         }
 410 }
 411
 412 /**
 413  * Callback for heartbeat timer.
 414  */
 415 static void vbg_heartbeat_timer(struct timer_list *t)
 416 {
 417         struct vbg_dev *gdev = from_timer(gdev, t, heartbeat_timer);
 418
 419         vbg_req_perform(gdev, gdev->guest_heartbeat_req);
 420         mod_timer(&gdev->heartbeat_timer,
 421                   msecs_to_jiffies(gdev->heartbeat_interval_ms));
 422 }
 423
 424 /**
 425  * Configure the host to check guest's heartbeat
 426  * and get heartbeat interval from the host.
 427  * Return: 0 or negative errno value.
 428  * @gdev:               The Guest extension device.
 429  * @enabled:            Set true to enable guest heartbeat checks on host.
 430  */
 431 static int vbg_heartbeat_host_config(struct vbg_dev *gdev, bool enabled)
 432 {
 433         struct vmmdev_heartbeat *req;
 434         int rc;
 435
 436         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_HEARTBEAT_CONFIGURE,
 437                             VBG_KERNEL_REQUEST);
 438         if (!req)
 439                 return -ENOMEM;
 440
 441         req->enabled = enabled;
 442         req->interval_ns = 0;
 443         rc = vbg_req_perform(gdev, req);
 444         do_div(req->interval_ns, 1000000); /* ns -> ms */
 445         gdev->heartbeat_interval_ms = req->interval_ns;
 446         vbg_req_free(req, sizeof(*req));
 447
 448         return vbg_status_code_to_errno(rc);
 449 }
 450
 451 /**
 452  * Initializes the heartbeat timer. This feature may be disabled by the host.
 453  * Return: 0 or negative errno value.
 454  * @gdev:               The Guest extension device.
 455  */
 456 static int vbg_heartbeat_init(struct vbg_dev *gdev)
 457 {
 458         int ret;
 459
 460         /* Make sure that heartbeat checking is disabled if we fail. */
 461         ret = vbg_heartbeat_host_config(gdev, false);
 462         if (ret < 0)
 463                 return ret;
 464
 465         ret = vbg_heartbeat_host_config(gdev, true);
 466         if (ret < 0)
 467                 return ret;
 468
 469         gdev->guest_heartbeat_req = vbg_req_alloc(
 470                                         sizeof(*gdev->guest_heartbeat_req),
 471                                         VMMDEVREQ_GUEST_HEARTBEAT,
 472                                         VBG_KERNEL_REQUEST);
 473         if (!gdev->guest_heartbeat_req)
 474                 return -ENOMEM;
 475
 476         vbg_info("%s: Setting up heartbeat to trigger every %d milliseconds\n",
 477                  __func__, gdev->heartbeat_interval_ms);
 478         mod_timer(&gdev->heartbeat_timer, 0);
 479
 480         return 0;
 481 }
 482
 483 /**
 484  * Cleanup hearbeat code, stop HB timer and disable host heartbeat checking.
 485  * @gdev:               The Guest extension device.
 486  */
 487 static void vbg_heartbeat_exit(struct vbg_dev *gdev)
 488 {
 489         del_timer_sync(&gdev->heartbeat_timer);
 490         vbg_heartbeat_host_config(gdev, false);
 491         vbg_req_free(gdev->guest_heartbeat_req,
 492                      sizeof(*gdev->guest_heartbeat_req));
 493 }
 494
 495 /**
 496  * Applies a change to the bit usage tracker.
 497  * Return: true if the mask changed, false if not.
 498  * @tracker:            The bit usage tracker.
 499  * @changed:            The bits to change.
 500  * @previous:           The previous value of the bits.
 501  */
 502 static bool vbg_track_bit_usage(struct vbg_bit_usage_tracker *tracker,
 503                                 u32 changed, u32 previous)
 504 {
 505         bool global_change = false;
 506
 507         while (changed) {
 508                 u32 bit = ffs(changed) - 1;
 509                 u32 bitmask = BIT(bit);
 510
 511                 if (bitmask & previous) {
 512                         tracker->per_bit_usage[bit] -= 1;
 513                         if (tracker->per_bit_usage[bit] == 0) {
 514                                 global_change = true;
 515                                 tracker->mask &= ~bitmask;
 516                         }
 517                 } else {
 518                         tracker->per_bit_usage[bit] += 1;
 519                         if (tracker->per_bit_usage[bit] == 1) {
 520                                 global_change = true;
 521                                 tracker->mask |= bitmask;
 522                         }
 523                 }
 524
 525                 changed &= ~bitmask;
 526         }
 527
 528         return global_change;
 529 }
 530
 531 /**
 532  * Init and termination worker for resetting the (host) event filter on the host
 533  * Return: 0 or negative errno value.
 534  * @gdev:                  The Guest extension device.
 535  * @fixed_events:          Fixed events (init time).
 536  */
 537 static int vbg_reset_host_event_filter(struct vbg_dev *gdev,
 538                                        u32 fixed_events)
 539 {
 540         struct vmmdev_mask *req;
 541         int rc;
 542
 543         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK,
 544                             VBG_KERNEL_REQUEST);
 545         if (!req)
 546                 return -ENOMEM;
 547
 548         req->not_mask = U32_MAX & ~fixed_events;
 549         req->or_mask = fixed_events;
 550         rc = vbg_req_perform(gdev, req);
 551         if (rc < 0)
 552                 vbg_err("%s error, rc: %d\n", __func__, rc);
 553
 554         vbg_req_free(req, sizeof(*req));
 555         return vbg_status_code_to_errno(rc);
 556 }
 557
 558 /**
 559  * Changes the event filter mask for the given session.
 560  *
 561  * This is called in response to VBG_IOCTL_CHANGE_FILTER_MASK as well as to
 562  * do session cleanup. Takes the session mutex.
 563  *
 564  * Return: 0 or negative errno value.
 565  * @gdev:                       The Guest extension device.
 566  * @session:                    The session.
 567  * @or_mask:                    The events to add.
 568  * @not_mask:                   The events to remove.
 569  * @session_termination:        Set if we're called by the session cleanup code.
 570  *                              This tweaks the error handling so we perform
 571  *                              proper session cleanup even if the host
 572  *                              misbehaves.
 573  */
 574 static int vbg_set_session_event_filter(struct vbg_dev *gdev,
 575                                         struct vbg_session *session,
 576                                         u32 or_mask, u32 not_mask,
 577                                         bool session_termination)
 578 {
 579         struct vmmdev_mask *req;
 580         u32 changed, previous;
 581         int rc, ret = 0;
 582
 583         /*
 584          * Allocate a request buffer before taking the spinlock, when
 585          * the session is being terminated the requestor is the kernel,
 586          * as we're cleaning up.
 587          */
 588         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK,
 589                             session_termination ? VBG_KERNEL_REQUEST :
 590                                                   session->requestor);
 591         if (!req) {
 592                 if (!session_termination)
 593                         return -ENOMEM;
 594                 /* Ignore allocation failure, we must do session cleanup. */
 595         }
 596
 597         mutex_lock(&gdev->session_mutex);
 598
 599         /* Apply the changes to the session mask. */
 600         previous = session->event_filter;
 601         session->event_filter |= or_mask;
 602         session->event_filter &= ~not_mask;
 603
 604         /* If anything actually changed, update the global usage counters. */
 605         changed = previous ^ session->event_filter;
 606         if (!changed)
 607                 goto out;
 608
 609         vbg_track_bit_usage(&gdev->event_filter_tracker, changed, previous);
 610         or_mask = gdev->fixed_events | gdev->event_filter_tracker.mask;
 611
 612         if (gdev->event_filter_host == or_mask || !req)
 613                 goto out;
 614
 615         gdev->event_filter_host = or_mask;
 616         req->or_mask = or_mask;
 617         req->not_mask = ~or_mask;
 618         rc = vbg_req_perform(gdev, req);
 619         if (rc < 0) {
 620                 ret = vbg_status_code_to_errno(rc);
 621
 622                 /* Failed, roll back (unless it's session termination time). */
 623                 gdev->event_filter_host = U32_MAX;
 624                 if (session_termination)
 625                         goto out;
 626
 627                 vbg_track_bit_usage(&gdev->event_filter_tracker, changed,
 628                                     session->event_filter);
 629                 session->event_filter = previous;
 630         }
 631
 632 out:
 633         mutex_unlock(&gdev->session_mutex);
 634         vbg_req_free(req, sizeof(*req));
 635
 636         return ret;
 637 }
 638
 639 /**
 640  * Init and termination worker for set guest capabilities to zero on the host.
 641  * Return: 0 or negative errno value.
 642  * @gdev:               The Guest extension device.
 643  */
 644 static int vbg_reset_host_capabilities(struct vbg_dev *gdev)
 645 {
 646         struct vmmdev_mask *req;
 647         int rc;
 648
 649         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES,
 650                             VBG_KERNEL_REQUEST);
 651         if (!req)
 652                 return -ENOMEM;
 653
 654         req->not_mask = U32_MAX;
 655         req->or_mask = 0;
 656         rc = vbg_req_perform(gdev, req);
 657         if (rc < 0)
 658                 vbg_err("%s error, rc: %d\n", __func__, rc);
 659
 660         vbg_req_free(req, sizeof(*req));
 661         return vbg_status_code_to_errno(rc);
 662 }
 663
 664 /**
 665  * Set guest capabilities on the host.
 666  * Must be called with gdev->session_mutex hold.
 667  * Return: 0 or negative errno value.
 668  * @gdev:                       The Guest extension device.
 669  * @session:                    The session.
 670  * @session_termination:        Set if we're called by the session cleanup code.
 671  */
 672 static int vbg_set_host_capabilities(struct vbg_dev *gdev,
 673                                      struct vbg_session *session,
 674                                      bool session_termination)
 675 {
 676         struct vmmdev_mask *req;
 677         u32 caps;
 678         int rc;
 679
 680         WARN_ON(!mutex_is_locked(&gdev->session_mutex));
 681
 682         caps = gdev->acquired_guest_caps | gdev->set_guest_caps_tracker.mask;
 683
 684         if (gdev->guest_caps_host == caps)
 685                 return 0;
 686
 687         /* On termination the requestor is the kernel, as we're cleaning up. */
 688         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES,
 689                             session_termination ? VBG_KERNEL_REQUEST :
 690                                                   session->requestor);
 691         if (!req) {
 692                 gdev->guest_caps_host = U32_MAX;
 693                 return -ENOMEM;
 694         }
 695
 696         req->or_mask = caps;
 697         req->not_mask = ~caps;
 698         rc = vbg_req_perform(gdev, req);
 699         vbg_req_free(req, sizeof(*req));
 700
 701         gdev->guest_caps_host = (rc >= 0) ? caps : U32_MAX;
 702
 703         return vbg_status_code_to_errno(rc);
 704 }
 705
 706 /**
 707  * Acquire (get exclusive access) guest capabilities for a session.
 708  * Takes the session mutex.
 709  * Return: 0 or negative errno value.
 710  * @gdev:                       The Guest extension device.
 711  * @session:                    The session.
 712  * @flags:                      Flags (VBGL_IOC_AGC_FLAGS_XXX).
 713  * @or_mask:                    The capabilities to add.
 714  * @not_mask:                   The capabilities to remove.
 715  * @session_termination:        Set if we're called by the session cleanup code.
 716  *                              This tweaks the error handling so we perform
 717  *                              proper session cleanup even if the host
 718  *                              misbehaves.
 719  */
 720 static int vbg_acquire_session_capabilities(struct vbg_dev *gdev,
 721                                             struct vbg_session *session,
 722                                             u32 or_mask, u32 not_mask,
 723                                             u32 flags, bool session_termination)
 724 {
 725         unsigned long irqflags;
 726         bool wakeup = false;
 727         int ret = 0;
 728
 729         mutex_lock(&gdev->session_mutex);
 730
 731         if (gdev->set_guest_caps_tracker.mask & or_mask) {
 732                 vbg_err("%s error: cannot acquire caps which are currently set\n",
 733                         __func__);
 734                 ret = -EINVAL;
 735                 goto out;
 736         }
 737
 738         /*
 739          * Mark any caps in the or_mask as now being in acquire-mode. Note
 740          * once caps are in acquire_mode they always stay in this mode.
 741          * This impacts event handling, so we take the event-lock.
 742          */
 743         spin_lock_irqsave(&gdev->event_spinlock, irqflags);
 744         gdev->acquire_mode_guest_caps |= or_mask;
 745         spin_unlock_irqrestore(&gdev->event_spinlock, irqflags);
 746
 747         /* If we only have to switch the caps to acquire mode, we're done. */
 748         if (flags & VBGL_IOC_AGC_FLAGS_CONFIG_ACQUIRE_MODE)
 749                 goto out;
 750
 751         not_mask &= ~or_mask; /* or_mask takes priority over not_mask */
 752         not_mask &= session->acquired_guest_caps;
 753         or_mask &= ~session->acquired_guest_caps;
 754
 755         if (or_mask == 0 && not_mask == 0)
 756                 goto out;
 757
 758         if (gdev->acquired_guest_caps & or_mask) {
 759                 ret = -EBUSY;
 760                 goto out;
 761         }
 762
 763         gdev->acquired_guest_caps |= or_mask;
 764         gdev->acquired_guest_caps &= ~not_mask;
 765         /* session->acquired_guest_caps impacts event handling, take the lock */
 766         spin_lock_irqsave(&gdev->event_spinlock, irqflags);
 767         session->acquired_guest_caps |= or_mask;
 768         session->acquired_guest_caps &= ~not_mask;
 769         spin_unlock_irqrestore(&gdev->event_spinlock, irqflags);
 770
 771         ret = vbg_set_host_capabilities(gdev, session, session_termination);
 772         /* Roll back on failure, unless it's session termination time. */
 773         if (ret < 0 && !session_termination) {
 774                 gdev->acquired_guest_caps &= ~or_mask;
 775                 gdev->acquired_guest_caps |= not_mask;
 776                 spin_lock_irqsave(&gdev->event_spinlock, irqflags);
 777                 session->acquired_guest_caps &= ~or_mask;
 778                 session->acquired_guest_caps |= not_mask;
 779                 spin_unlock_irqrestore(&gdev->event_spinlock, irqflags);
 780         }
 781
 782         /*
 783          * If we added a capability, check if that means some other thread in
 784          * our session should be unblocked because there are events pending
 785          * (the result of vbg_get_allowed_event_mask_for_session() may change).
 786          *
 787          * HACK ALERT! When the seamless support capability is added we generate
 788          *      a seamless change event so that the ring-3 client can sync with
 789          *      the seamless state.
 790          */
 791         if (ret == 0 && or_mask != 0) {
 792                 spin_lock_irqsave(&gdev->event_spinlock, irqflags);
 793
 794                 if (or_mask & VMMDEV_GUEST_SUPPORTS_SEAMLESS)
 795                         gdev->pending_events |=
 796                                 VMMDEV_EVENT_SEAMLESS_MODE_CHANGE_REQUEST;
 797
 798                 if (gdev->pending_events)
 799                         wakeup = true;
 800
 801                 spin_unlock_irqrestore(&gdev->event_spinlock, irqflags);
 802
 803                 if (wakeup)
 804                         wake_up(&gdev->event_wq);
 805         }
 806
 807 out:
 808         mutex_unlock(&gdev->session_mutex);
 809
 810         return ret;
 811 }
 812
 813 /**
 814  * Sets the guest capabilities for a session. Takes the session mutex.
 815  * Return: 0 or negative errno value.
 816  * @gdev:                       The Guest extension device.
 817  * @session:                    The session.
 818  * @or_mask:                    The capabilities to add.
 819  * @not_mask:                   The capabilities to remove.
 820  * @session_termination:        Set if we're called by the session cleanup code.
 821  *                              This tweaks the error handling so we perform
 822  *                              proper session cleanup even if the host
 823  *                              misbehaves.
 824  */
 825 static int vbg_set_session_capabilities(struct vbg_dev *gdev,
 826                                         struct vbg_session *session,
 827                                         u32 or_mask, u32 not_mask,
 828                                         bool session_termination)
 829 {
 830         u32 changed, previous;
 831         int ret = 0;
 832
 833         mutex_lock(&gdev->session_mutex);
 834
 835         if (gdev->acquire_mode_guest_caps & or_mask) {
 836                 vbg_err("%s error: cannot set caps which are in acquire_mode\n",
 837                         __func__);
 838                 ret = -EBUSY;
 839                 goto out;
 840         }
 841
 842         /* Apply the changes to the session mask. */
 843         previous = session->set_guest_caps;
 844         session->set_guest_caps |= or_mask;
 845         session->set_guest_caps &= ~not_mask;
 846
 847         /* If anything actually changed, update the global usage counters. */
 848         changed = previous ^ session->set_guest_caps;
 849         if (!changed)
 850                 goto out;
 851
 852         vbg_track_bit_usage(&gdev->set_guest_caps_tracker, changed, previous);
 853
 854         ret = vbg_set_host_capabilities(gdev, session, session_termination);
 855         /* Roll back on failure, unless it's session termination time. */
 856         if (ret < 0 && !session_termination) {
 857                 vbg_track_bit_usage(&gdev->set_guest_caps_tracker, changed,
 858                                     session->set_guest_caps);
 859                 session->set_guest_caps = previous;
 860         }
 861
 862 out:
 863         mutex_unlock(&gdev->session_mutex);
 864
 865         return ret;
 866 }
 867
 868 /**
 869  * vbg_query_host_version get the host feature mask and version information.
 870  * Return: 0 or negative errno value.
 871  * @gdev:               The Guest extension device.
 872  */
 873 static int vbg_query_host_version(struct vbg_dev *gdev)
 874 {
 875         struct vmmdev_host_version *req;
 876         int rc, ret;
 877
 878         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HOST_VERSION,
 879                             VBG_KERNEL_REQUEST);
 880         if (!req)
 881                 return -ENOMEM;
 882
 883         rc = vbg_req_perform(gdev, req);
 884         ret = vbg_status_code_to_errno(rc);
 885         if (ret) {
 886                 vbg_err("%s error: %d\n", __func__, rc);
 887                 goto out;
 888         }
 889
 890         snprintf(gdev->host_version, sizeof(gdev->host_version), "%u.%u.%ur%u",
 891                  req->major, req->minor, req->build, req->revision);
 892         gdev->host_features = req->features;
 893
 894         vbg_info("vboxguest: host-version: %s %#x\n", gdev->host_version,
 895                  gdev->host_features);
 896
 897         if (!(req->features & VMMDEV_HVF_HGCM_PHYS_PAGE_LIST)) {
 898                 vbg_err("vboxguest: Error host too old (does not support page-lists)\n");
 899                 ret = -ENODEV;
 900         }
 901
 902 out:
 903         vbg_req_free(req, sizeof(*req));
 904         return ret;
 905 }
 906
 907 /**
 908  * Initializes the VBoxGuest device extension when the
 909  * device driver is loaded.
 910  *
 911  * The native code locates the VMMDev on the PCI bus and retrieve
 912  * the MMIO and I/O port ranges, this function will take care of
 913  * mapping the MMIO memory (if present). Upon successful return
 914  * the native code should set up the interrupt handler.
 915  *
 916  * Return: 0 or negative errno value.
 917  *
 918  * @gdev:               The Guest extension device.
 919  * @fixed_events:       Events that will be enabled upon init and no client
 920  *                      will ever be allowed to mask.
 921  */
 922 int vbg_core_init(struct vbg_dev *gdev, u32 fixed_events)
 923 {
 924         int ret = -ENOMEM;
 925
 926         gdev->fixed_events = fixed_events | VMMDEV_EVENT_HGCM;
 927         gdev->event_filter_host = U32_MAX;      /* forces a report */
 928         gdev->guest_caps_host = U32_MAX;        /* forces a report */
 929
 930         init_waitqueue_head(&gdev->event_wq);
 931         init_waitqueue_head(&gdev->hgcm_wq);
 932         spin_lock_init(&gdev->event_spinlock);
 933         mutex_init(&gdev->session_mutex);
 934         mutex_init(&gdev->cancel_req_mutex);
 935         timer_setup(&gdev->heartbeat_timer, vbg_heartbeat_timer, 0);
 936         INIT_WORK(&gdev->mem_balloon.work, vbg_balloon_work);
 937
 938         gdev->mem_balloon.get_req =
 939                 vbg_req_alloc(sizeof(*gdev->mem_balloon.get_req),
 940                               VMMDEVREQ_GET_MEMBALLOON_CHANGE_REQ,
 941                               VBG_KERNEL_REQUEST);
 942         gdev->mem_balloon.change_req =
 943                 vbg_req_alloc(sizeof(*gdev->mem_balloon.change_req),
 944                               VMMDEVREQ_CHANGE_MEMBALLOON,
 945                               VBG_KERNEL_REQUEST);
 946         gdev->cancel_req =
 947                 vbg_req_alloc(sizeof(*(gdev->cancel_req)),
 948                               VMMDEVREQ_HGCM_CANCEL2,
 949                               VBG_KERNEL_REQUEST);
 950         gdev->ack_events_req =
 951                 vbg_req_alloc(sizeof(*gdev->ack_events_req),
 952                               VMMDEVREQ_ACKNOWLEDGE_EVENTS,
 953                               VBG_KERNEL_REQUEST);
 954         gdev->mouse_status_req =
 955                 vbg_req_alloc(sizeof(*gdev->mouse_status_req),
 956                               VMMDEVREQ_GET_MOUSE_STATUS,
 957                               VBG_KERNEL_REQUEST);
 958
 959         if (!gdev->mem_balloon.get_req || !gdev->mem_balloon.change_req ||
 960             !gdev->cancel_req || !gdev->ack_events_req ||
 961             !gdev->mouse_status_req)
 962                 goto err_free_reqs;
 963
 964         ret = vbg_query_host_version(gdev);
 965         if (ret)
 966                 goto err_free_reqs;
 967
 968         ret = vbg_report_guest_info(gdev);
 969         if (ret) {
 970                 vbg_err("vboxguest: vbg_report_guest_info error: %d\n", ret);
 971                 goto err_free_reqs;
 972         }
 973
 974         ret = vbg_reset_host_event_filter(gdev, gdev->fixed_events);
 975         if (ret) {
 976                 vbg_err("vboxguest: Error setting fixed event filter: %d\n",
 977                         ret);
 978                 goto err_free_reqs;
 979         }
 980
 981         ret = vbg_reset_host_capabilities(gdev);
 982         if (ret) {
 983                 vbg_err("vboxguest: Error clearing guest capabilities: %d\n",
 984                         ret);
 985                 goto err_free_reqs;
 986         }
 987
 988         ret = vbg_core_set_mouse_status(gdev, 0);
 989         if (ret) {
 990                 vbg_err("vboxguest: Error clearing mouse status: %d\n", ret);
 991                 goto err_free_reqs;
 992         }
 993
 994         /* These may fail without requiring the driver init to fail. */
 995         vbg_guest_mappings_init(gdev);
 996         vbg_heartbeat_init(gdev);
 997
 998         /* All Done! */
 999         ret = vbg_report_driver_status(gdev, true);
1000         if (ret < 0)
1001                 vbg_err("vboxguest: Error reporting driver status: %d\n", ret);
1002
1003         return 0;
1004
1005 err_free_reqs:
1006         vbg_req_free(gdev->mouse_status_req,
1007                      sizeof(*gdev->mouse_status_req));
1008         vbg_req_free(gdev->ack_events_req,
1009                      sizeof(*gdev->ack_events_req));
1010         vbg_req_free(gdev->cancel_req,
1011                      sizeof(*gdev->cancel_req));
1012         vbg_req_free(gdev->mem_balloon.change_req,
1013                      sizeof(*gdev->mem_balloon.change_req));
1014         vbg_req_free(gdev->mem_balloon.get_req,
1015                      sizeof(*gdev->mem_balloon.get_req));
1016         return ret;
1017 }
1018
1019 /**
1020  * Call this on exit to clean-up vboxguest-core managed resources.
1021  *
1022  * The native code should call this before the driver is loaded,
1023  * but don't call this on shutdown.
1024  * @gdev:               The Guest extension device.
1025  */
1026 void vbg_core_exit(struct vbg_dev *gdev)
1027 {
1028         vbg_heartbeat_exit(gdev);
1029         vbg_guest_mappings_exit(gdev);
1030
1031         /* Clear the host flags (mouse status etc). */
1032         vbg_reset_host_event_filter(gdev, 0);
1033         vbg_reset_host_capabilities(gdev);
1034         vbg_core_set_mouse_status(gdev, 0);
1035
1036         vbg_req_free(gdev->mouse_status_req,
1037                      sizeof(*gdev->mouse_status_req));
1038         vbg_req_free(gdev->ack_events_req,
1039                      sizeof(*gdev->ack_events_req));
1040         vbg_req_free(gdev->cancel_req,
1041                      sizeof(*gdev->cancel_req));
1042         vbg_req_free(gdev->mem_balloon.change_req,
1043                      sizeof(*gdev->mem_balloon.change_req));
1044         vbg_req_free(gdev->mem_balloon.get_req,
1045                      sizeof(*gdev->mem_balloon.get_req));
1046 }
1047
1048 /**
1049  * Creates a VBoxGuest user session.
1050  *
1051  * vboxguest_linux.c calls this when userspace opens the char-device.
1052  * Return: A pointer to the new session or an ERR_PTR on error.
1053  * @gdev:               The Guest extension device.
1054  * @requestor:          VMMDEV_REQUESTOR_* flags
1055  */
1056 struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, u32 requestor)
1057 {
1058         struct vbg_session *session;
1059
1060         session = kzalloc(sizeof(*session), GFP_KERNEL);
1061         if (!session)
1062                 return ERR_PTR(-ENOMEM);
1063
1064         session->gdev = gdev;
1065         session->requestor = requestor;
1066
1067         return session;
1068 }
1069
1070 /**
1071  * Closes a VBoxGuest session.
1072  * @session:            The session to close (and free).
1073  */
1074 void vbg_core_close_session(struct vbg_session *session)
1075 {
1076         struct vbg_dev *gdev = session->gdev;
1077         int i, rc;
1078
1079         vbg_acquire_session_capabilities(gdev, session, 0, U32_MAX, 0, true);
1080         vbg_set_session_capabilities(gdev, session, 0, U32_MAX, true);
1081         vbg_set_session_event_filter(gdev, session, 0, U32_MAX, true);
1082
1083         for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) {
1084                 if (!session->hgcm_client_ids[i])
1085                         continue;
1086
1087                 /* requestor is kernel here, as we're cleaning up. */
1088                 vbg_hgcm_disconnect(gdev, VBG_KERNEL_REQUEST,
1089                                     session->hgcm_client_ids[i], &rc);
1090         }
1091
1092         kfree(session);
1093 }
1094
1095 static int vbg_ioctl_chk(struct vbg_ioctl_hdr *hdr, size_t in_size,
1096                          size_t out_size)
1097 {
1098         if (hdr->size_in  != (sizeof(*hdr) + in_size) ||
1099             hdr->size_out != (sizeof(*hdr) + out_size))
1100                 return -EINVAL;
1101
1102         return 0;
1103 }
1104
1105 static int vbg_ioctl_driver_version_info(
1106         struct vbg_ioctl_driver_version_info *info)
1107 {
1108         const u16 vbg_maj_version = VBG_IOC_VERSION >> 16;
1109         u16 min_maj_version, req_maj_version;
1110
1111         if (vbg_ioctl_chk(&info->hdr, sizeof(info->u.in), sizeof(info->u.out)))
1112                 return -EINVAL;
1113
1114         req_maj_version = info->u.in.req_version >> 16;
1115         min_maj_version = info->u.in.min_version >> 16;
1116
1117         if (info->u.in.min_version > info->u.in.req_version ||
1118             min_maj_version != req_maj_version)
1119                 return -EINVAL;
1120
1121         if (info->u.in.min_version <= VBG_IOC_VERSION &&
1122             min_maj_version == vbg_maj_version) {
1123                 info->u.out.session_version = VBG_IOC_VERSION;
1124         } else {
1125                 info->u.out.session_version = U32_MAX;
1126                 info->hdr.rc = VERR_VERSION_MISMATCH;
1127         }
1128
1129         info->u.out.driver_version  = VBG_IOC_VERSION;
1130         info->u.out.driver_revision = 0;
1131         info->u.out.reserved1      = 0;
1132         info->u.out.reserved2      = 0;
1133
1134         return 0;
1135 }
1136
1137 /* Must be called with the event_lock held */
1138 static u32 vbg_get_allowed_event_mask_for_session(struct vbg_dev *gdev,
1139                                                   struct vbg_session *session)
1140 {
1141         u32 acquire_mode_caps = gdev->acquire_mode_guest_caps;
1142         u32 session_acquired_caps = session->acquired_guest_caps;
1143         u32 allowed_events = VMMDEV_EVENT_VALID_EVENT_MASK;
1144
1145         if ((acquire_mode_caps & VMMDEV_GUEST_SUPPORTS_GRAPHICS) &&
1146             !(session_acquired_caps & VMMDEV_GUEST_SUPPORTS_GRAPHICS))
1147                 allowed_events &= ~VMMDEV_EVENT_DISPLAY_CHANGE_REQUEST;
1148
1149         if ((acquire_mode_caps & VMMDEV_GUEST_SUPPORTS_SEAMLESS) &&
1150             !(session_acquired_caps & VMMDEV_GUEST_SUPPORTS_SEAMLESS))
1151                 allowed_events &= ~VMMDEV_EVENT_SEAMLESS_MODE_CHANGE_REQUEST;
1152
1153         return allowed_events;
1154 }
1155
1156 static bool vbg_wait_event_cond(struct vbg_dev *gdev,
1157                                 struct vbg_session *session,
1158                                 u32 event_mask)
1159 {
1160         unsigned long flags;
1161         bool wakeup;
1162         u32 events;
1163
1164         spin_lock_irqsave(&gdev->event_spinlock, flags);
1165
1166         events = gdev->pending_events & event_mask;
1167         events &= vbg_get_allowed_event_mask_for_session(gdev, session);
1168         wakeup = events || session->cancel_waiters;
1169
1170         spin_unlock_irqrestore(&gdev->event_spinlock, flags);
1171
1172         return wakeup;
1173 }
1174
1175 /* Must be called with the event_lock held */
1176 static u32 vbg_consume_events_locked(struct vbg_dev *gdev,
1177                                      struct vbg_session *session,
1178                                      u32 event_mask)
1179 {
1180         u32 events = gdev->pending_events & event_mask;
1181
1182         events &= vbg_get_allowed_event_mask_for_session(gdev, session);
1183         gdev->pending_events &= ~events;
1184         return events;
1185 }
1186
1187 static int vbg_ioctl_wait_for_events(struct vbg_dev *gdev,
1188                                      struct vbg_session *session,
1189                                      struct vbg_ioctl_wait_for_events *wait)
1190 {
1191         u32 timeout_ms = wait->u.in.timeout_ms;
1192         u32 event_mask = wait->u.in.events;
1193         unsigned long flags;
1194         long timeout;
1195         int ret = 0;
1196
1197         if (vbg_ioctl_chk(&wait->hdr, sizeof(wait->u.in), sizeof(wait->u.out)))
1198                 return -EINVAL;
1199
1200         if (timeout_ms == U32_MAX)
1201                 timeout = MAX_SCHEDULE_TIMEOUT;
1202         else
1203                 timeout = msecs_to_jiffies(timeout_ms);
1204
1205         wait->u.out.events = 0;
1206         do {
1207                 timeout = wait_event_interruptible_timeout(
1208                                 gdev->event_wq,
1209                                 vbg_wait_event_cond(gdev, session, event_mask),
1210                                 timeout);
1211
1212                 spin_lock_irqsave(&gdev->event_spinlock, flags);
1213
1214                 if (timeout < 0 || session->cancel_waiters) {
1215                         ret = -EINTR;
1216                 } else if (timeout == 0) {
1217                         ret = -ETIMEDOUT;
1218                 } else {
1219                         wait->u.out.events =
1220                            vbg_consume_events_locked(gdev, session, event_mask);
1221                 }
1222
1223                 spin_unlock_irqrestore(&gdev->event_spinlock, flags);
1224
1225                 /*
1226                  * Someone else may have consumed the event(s) first, in
1227                  * which case we go back to waiting.
1228                  */
1229         } while (ret == 0 && wait->u.out.events == 0);
1230
1231         return ret;
1232 }
1233
1234 static int vbg_ioctl_interrupt_all_wait_events(struct vbg_dev *gdev,
1235                                                struct vbg_session *session,
1236                                                struct vbg_ioctl_hdr *hdr)
1237 {
1238         unsigned long flags;
1239
1240         if (hdr->size_in != sizeof(*hdr) || hdr->size_out != sizeof(*hdr))
1241                 return -EINVAL;
1242
1243         spin_lock_irqsave(&gdev->event_spinlock, flags);
1244         session->cancel_waiters = true;
1245         spin_unlock_irqrestore(&gdev->event_spinlock, flags);
1246
1247         wake_up(&gdev->event_wq);
1248
1249         return 0;
1250 }
1251
1252 /**
1253  * Checks if the VMM request is allowed in the context of the given session.
1254  * Return: 0 or negative errno value.
1255  * @gdev:               The Guest extension device.
1256  * @session:            The calling session.
1257  * @req:                The request.
1258  */
1259 static int vbg_req_allowed(struct vbg_dev *gdev, struct vbg_session *session,
1260                            const struct vmmdev_request_header *req)
1261 {
1262         const struct vmmdev_guest_status *guest_status;
1263         bool trusted_apps_only;
1264
1265         switch (req->request_type) {
1266         /* Trusted users apps only. */
1267         case VMMDEVREQ_QUERY_CREDENTIALS:
1268         case VMMDEVREQ_REPORT_CREDENTIALS_JUDGEMENT:
1269         case VMMDEVREQ_REGISTER_SHARED_MODULE:
1270         case VMMDEVREQ_UNREGISTER_SHARED_MODULE:
1271         case VMMDEVREQ_WRITE_COREDUMP:
1272         case VMMDEVREQ_GET_CPU_HOTPLUG_REQ:
1273         case VMMDEVREQ_SET_CPU_HOTPLUG_STATUS:
1274         case VMMDEVREQ_CHECK_SHARED_MODULES:
1275         case VMMDEVREQ_GET_PAGE_SHARING_STATUS:
1276         case VMMDEVREQ_DEBUG_IS_PAGE_SHARED:
1277         case VMMDEVREQ_REPORT_GUEST_STATS:
1278         case VMMDEVREQ_REPORT_GUEST_USER_STATE:
1279         case VMMDEVREQ_GET_STATISTICS_CHANGE_REQ:
1280                 trusted_apps_only = true;
1281                 break;
1282
1283         /* Anyone. */
1284         case VMMDEVREQ_GET_MOUSE_STATUS:
1285         case VMMDEVREQ_SET_MOUSE_STATUS:
1286         case VMMDEVREQ_SET_POINTER_SHAPE:
1287         case VMMDEVREQ_GET_HOST_VERSION:
1288         case VMMDEVREQ_IDLE:
1289         case VMMDEVREQ_GET_HOST_TIME:
1290         case VMMDEVREQ_SET_POWER_STATUS:
1291         case VMMDEVREQ_ACKNOWLEDGE_EVENTS:
1292         case VMMDEVREQ_CTL_GUEST_FILTER_MASK:
1293         case VMMDEVREQ_REPORT_GUEST_STATUS:
1294         case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ:
1295         case VMMDEVREQ_VIDEMODE_SUPPORTED:
1296         case VMMDEVREQ_GET_HEIGHT_REDUCTION:
1297         case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ2:
1298         case VMMDEVREQ_VIDEMODE_SUPPORTED2:
1299         case VMMDEVREQ_VIDEO_ACCEL_ENABLE:
1300         case VMMDEVREQ_VIDEO_ACCEL_FLUSH:
1301         case VMMDEVREQ_VIDEO_SET_VISIBLE_REGION:
1302         case VMMDEVREQ_VIDEO_UPDATE_MONITOR_POSITIONS:
1303         case VMMDEVREQ_GET_DISPLAY_CHANGE_REQEX:
1304         case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ_MULTI:
1305         case VMMDEVREQ_GET_SEAMLESS_CHANGE_REQ:
1306         case VMMDEVREQ_GET_VRDPCHANGE_REQ:
1307         case VMMDEVREQ_LOG_STRING:
1308         case VMMDEVREQ_GET_SESSION_ID:
1309                 trusted_apps_only = false;
1310                 break;
1311
1312         /* Depends on the request parameters... */
1313         case VMMDEVREQ_REPORT_GUEST_CAPABILITIES:
1314                 guest_status = (const struct vmmdev_guest_status *)req;
1315                 switch (guest_status->facility) {
1316                 case VBOXGUEST_FACILITY_TYPE_ALL:
1317                 case VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER:
1318                         vbg_err("Denying userspace vmm report guest cap. call facility %#08x\n",
1319                                 guest_status->facility);
1320                         return -EPERM;
1321                 case VBOXGUEST_FACILITY_TYPE_VBOX_SERVICE:
1322                         trusted_apps_only = true;
1323                         break;
1324                 case VBOXGUEST_FACILITY_TYPE_VBOX_TRAY_CLIENT:
1325                 case VBOXGUEST_FACILITY_TYPE_SEAMLESS:
1326                 case VBOXGUEST_FACILITY_TYPE_GRAPHICS:
1327                 default:
1328                         trusted_apps_only = false;
1329                         break;
1330                 }
1331                 break;
1332
1333         /* Anything else is not allowed. */
1334         default:
1335                 vbg_err("Denying userspace vmm call type %#08x\n",
1336                         req->request_type);
1337                 return -EPERM;
1338         }
1339
1340         if (trusted_apps_only &&
1341             (session->requestor & VMMDEV_REQUESTOR_USER_DEVICE)) {
1342                 vbg_err("Denying userspace vmm call type %#08x through vboxuser device node\n",
1343                         req->request_type);
1344                 return -EPERM;
1345         }
1346
1347         return 0;
1348 }
1349
1350 static int vbg_ioctl_vmmrequest(struct vbg_dev *gdev,
1351                                 struct vbg_session *session, void *data)
1352 {
1353         struct vbg_ioctl_hdr *hdr = data;
1354         int ret;
1355
1356         if (hdr->size_in != hdr->size_out)
1357                 return -EINVAL;
1358
1359         if (hdr->size_in > VMMDEV_MAX_VMMDEVREQ_SIZE)
1360                 return -E2BIG;
1361
1362         if (hdr->type == VBG_IOCTL_HDR_TYPE_DEFAULT)
1363                 return -EINVAL;
1364
1365         ret = vbg_req_allowed(gdev, session, data);
1366         if (ret < 0)
1367                 return ret;
1368
1369         vbg_req_perform(gdev, data);
1370         WARN_ON(hdr->rc == VINF_HGCM_ASYNC_EXECUTE);
1371
1372         return 0;
1373 }
1374
1375 static int vbg_ioctl_hgcm_connect(struct vbg_dev *gdev,
1376                                   struct vbg_session *session,
1377                                   struct vbg_ioctl_hgcm_connect *conn)
1378 {
1379         u32 client_id;
1380         int i, ret;
1381
1382         if (vbg_ioctl_chk(&conn->hdr, sizeof(conn->u.in), sizeof(conn->u.out)))
1383                 return -EINVAL;
1384
1385         /* Find a free place in the sessions clients array and claim it */
1386         mutex_lock(&gdev->session_mutex);
1387         for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) {
1388                 if (!session->hgcm_client_ids[i]) {
1389                         session->hgcm_client_ids[i] = U32_MAX;
1390                         break;
1391                 }
1392         }
1393         mutex_unlock(&gdev->session_mutex);
1394
1395         if (i >= ARRAY_SIZE(session->hgcm_client_ids))
1396                 return -EMFILE;
1397
1398         ret = vbg_hgcm_connect(gdev, session->requestor, &conn->u.in.loc,
1399                                &client_id, &conn->hdr.rc);
1400
1401         mutex_lock(&gdev->session_mutex);
1402         if (ret == 0 && conn->hdr.rc >= 0) {
1403                 conn->u.out.client_id = client_id;
1404                 session->hgcm_client_ids[i] = client_id;
1405         } else {
1406                 conn->u.out.client_id = 0;
1407                 session->hgcm_client_ids[i] = 0;
1408         }
1409         mutex_unlock(&gdev->session_mutex);
1410
1411         return ret;
1412 }
1413
1414 static int vbg_ioctl_hgcm_disconnect(struct vbg_dev *gdev,
1415                                      struct vbg_session *session,
1416                                      struct vbg_ioctl_hgcm_disconnect *disconn)
1417 {
1418         u32 client_id;
1419         int i, ret;
1420
1421         if (vbg_ioctl_chk(&disconn->hdr, sizeof(disconn->u.in), 0))
1422                 return -EINVAL;
1423
1424         client_id = disconn->u.in.client_id;
1425         if (client_id == 0 || client_id == U32_MAX)
1426                 return -EINVAL;
1427
1428         mutex_lock(&gdev->session_mutex);
1429         for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) {
1430                 if (session->hgcm_client_ids[i] == client_id) {
1431                         session->hgcm_client_ids[i] = U32_MAX;
1432                         break;
1433                 }
1434         }
1435         mutex_unlock(&gdev->session_mutex);
1436
1437         if (i >= ARRAY_SIZE(session->hgcm_client_ids))
1438                 return -EINVAL;
1439
1440         ret = vbg_hgcm_disconnect(gdev, session->requestor, client_id,
1441                                   &disconn->hdr.rc);
1442
1443         mutex_lock(&gdev->session_mutex);
1444         if (ret == 0 && disconn->hdr.rc >= 0)
1445                 session->hgcm_client_ids[i] = 0;
1446         else
1447                 session->hgcm_client_ids[i] = client_id;
1448         mutex_unlock(&gdev->session_mutex);
1449
1450         return ret;
1451 }
1452
1453 static bool vbg_param_valid(enum vmmdev_hgcm_function_parameter_type type)
1454 {
1455         switch (type) {
1456         case VMMDEV_HGCM_PARM_TYPE_32BIT:
1457         case VMMDEV_HGCM_PARM_TYPE_64BIT:
1458         case VMMDEV_HGCM_PARM_TYPE_LINADDR:
1459         case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
1460         case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
1461                 return true;
1462         default:
1463                 return false;
1464         }
1465 }
1466
1467 static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
1468                                struct vbg_session *session, bool f32bit,
1469                                struct vbg_ioctl_hgcm_call *call)
1470 {
1471         size_t actual_size;
1472         u32 client_id;
1473         int i, ret;
1474
1475         if (call->hdr.size_in < sizeof(*call))
1476                 return -EINVAL;
1477
1478         if (call->hdr.size_in != call->hdr.size_out)
1479                 return -EINVAL;
1480
1481         if (call->parm_count > VMMDEV_HGCM_MAX_PARMS)
1482                 return -E2BIG;
1483
1484         client_id = call->client_id;
1485         if (client_id == 0 || client_id == U32_MAX)
1486                 return -EINVAL;
1487
1488         actual_size = sizeof(*call);
1489         if (f32bit)
1490                 actual_size += call->parm_count *
1491                                sizeof(struct vmmdev_hgcm_function_parameter32);
1492         else
1493                 actual_size += call->parm_count *
1494                                sizeof(struct vmmdev_hgcm_function_parameter);
1495         if (call->hdr.size_in < actual_size) {
1496                 vbg_debug("VBG_IOCTL_HGCM_CALL: hdr.size_in %d required size is %zd\n",
1497                           call->hdr.size_in, actual_size);
1498                 return -EINVAL;
1499         }
1500         call->hdr.size_out = actual_size;
1501
1502         /* Validate parameter types */
1503         if (f32bit) {
1504                 struct vmmdev_hgcm_function_parameter32 *parm =
1505                         VBG_IOCTL_HGCM_CALL_PARMS32(call);
1506
1507                 for (i = 0; i < call->parm_count; i++)
1508                         if (!vbg_param_valid(parm[i].type))
1509                                 return -EINVAL;
1510         } else {
1511                 struct vmmdev_hgcm_function_parameter *parm =
1512                         VBG_IOCTL_HGCM_CALL_PARMS(call);
1513
1514                 for (i = 0; i < call->parm_count; i++)
1515                         if (!vbg_param_valid(parm[i].type))
1516                                 return -EINVAL;
1517         }
1518
1519         /*
1520          * Validate the client id.
1521          */
1522         mutex_lock(&gdev->session_mutex);
1523         for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++)
1524                 if (session->hgcm_client_ids[i] == client_id)
1525                         break;
1526         mutex_unlock(&gdev->session_mutex);
1527         if (i >= ARRAY_SIZE(session->hgcm_client_ids)) {
1528                 vbg_debug("VBG_IOCTL_HGCM_CALL: INVALID handle. u32Client=%#08x\n",
1529                           client_id);
1530                 return -EINVAL;
1531         }
1532
1533         if (IS_ENABLED(CONFIG_COMPAT) && f32bit)
1534                 ret = vbg_hgcm_call32(gdev, session->requestor, client_id,
1535                                       call->function, call->timeout_ms,
1536                                       VBG_IOCTL_HGCM_CALL_PARMS32(call),
1537                                       call->parm_count, &call->hdr.rc);
1538         else
1539                 ret = vbg_hgcm_call(gdev, session->requestor, client_id,
1540                                     call->function, call->timeout_ms,
1541                                     VBG_IOCTL_HGCM_CALL_PARMS(call),
1542                                     call->parm_count, &call->hdr.rc);
1543
1544         if (ret == -E2BIG) {
1545                 /* E2BIG needs to be reported through the hdr.rc field. */
1546                 call->hdr.rc = VERR_OUT_OF_RANGE;
1547                 ret = 0;
1548         }
1549
1550         if (ret && ret != -EINTR && ret != -ETIMEDOUT)
1551                 vbg_err("VBG_IOCTL_HGCM_CALL error: %d\n", ret);
1552
1553         return ret;
1554 }
1555
1556 static int vbg_ioctl_log(struct vbg_ioctl_log *log)
1557 {
1558         if (log->hdr.size_out != sizeof(log->hdr))
1559                 return -EINVAL;
1560
1561         vbg_info("%.*s", (int)(log->hdr.size_in - sizeof(log->hdr)),
1562                  log->u.in.msg);
1563
1564         return 0;
1565 }
1566
1567 static int vbg_ioctl_change_filter_mask(struct vbg_dev *gdev,
1568                                         struct vbg_session *session,
1569                                         struct vbg_ioctl_change_filter *filter)
1570 {
1571         u32 or_mask, not_mask;
1572
1573         if (vbg_ioctl_chk(&filter->hdr, sizeof(filter->u.in), 0))
1574                 return -EINVAL;
1575
1576         or_mask = filter->u.in.or_mask;
1577         not_mask = filter->u.in.not_mask;
1578
1579         if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK)
1580                 return -EINVAL;
1581
1582         return vbg_set_session_event_filter(gdev, session, or_mask, not_mask,
1583                                             false);
1584 }
1585
1586 static int vbg_ioctl_acquire_guest_capabilities(struct vbg_dev *gdev,
1587              struct vbg_session *session,
1588              struct vbg_ioctl_acquire_guest_caps *caps)
1589 {
1590         u32 flags, or_mask, not_mask;
1591
1592         if (vbg_ioctl_chk(&caps->hdr, sizeof(caps->u.in), 0))
1593                 return -EINVAL;
1594
1595         flags = caps->u.in.flags;
1596         or_mask = caps->u.in.or_mask;
1597         not_mask = caps->u.in.not_mask;
1598
1599         if (flags & ~VBGL_IOC_AGC_FLAGS_VALID_MASK)
1600                 return -EINVAL;
1601
1602         if ((or_mask | not_mask) & ~VMMDEV_GUEST_CAPABILITIES_MASK)
1603                 return -EINVAL;
1604
1605         return vbg_acquire_session_capabilities(gdev, session, or_mask,
1606                                                 not_mask, flags, false);
1607 }
1608
1609 static int vbg_ioctl_change_guest_capabilities(struct vbg_dev *gdev,
1610              struct vbg_session *session, struct vbg_ioctl_set_guest_caps *caps)
1611 {
1612         u32 or_mask, not_mask;
1613         int ret;
1614
1615         if (vbg_ioctl_chk(&caps->hdr, sizeof(caps->u.in), sizeof(caps->u.out)))
1616                 return -EINVAL;
1617
1618         or_mask = caps->u.in.or_mask;
1619         not_mask = caps->u.in.not_mask;
1620
1621         if ((or_mask | not_mask) & ~VMMDEV_GUEST_CAPABILITIES_MASK)
1622                 return -EINVAL;
1623
1624         ret = vbg_set_session_capabilities(gdev, session, or_mask, not_mask,
1625                                            false);
1626         if (ret)
1627                 return ret;
1628
1629         caps->u.out.session_caps = session->set_guest_caps;
1630         caps->u.out.global_caps = gdev->guest_caps_host;
1631
1632         return 0;
1633 }
1634
1635 static int vbg_ioctl_check_balloon(struct vbg_dev *gdev,
1636                                    struct vbg_ioctl_check_balloon *balloon_info)
1637 {
1638         if (vbg_ioctl_chk(&balloon_info->hdr, 0, sizeof(balloon_info->u.out)))
1639                 return -EINVAL;
1640
1641         balloon_info->u.out.balloon_chunks = gdev->mem_balloon.chunks;
1642         /*
1643          * Under Linux we handle VMMDEV_EVENT_BALLOON_CHANGE_REQUEST
1644          * events entirely in the kernel, see vbg_core_isr().
1645          */
1646         balloon_info->u.out.handle_in_r3 = false;
1647
1648         return 0;
1649 }
1650
1651 static int vbg_ioctl_write_core_dump(struct vbg_dev *gdev,
1652                                      struct vbg_session *session,
1653                                      struct vbg_ioctl_write_coredump *dump)
1654 {
1655         struct vmmdev_write_core_dump *req;
1656
1657         if (vbg_ioctl_chk(&dump->hdr, sizeof(dump->u.in), 0))
1658                 return -EINVAL;
1659
1660         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_WRITE_COREDUMP,
1661                             session->requestor);
1662         if (!req)
1663                 return -ENOMEM;
1664
1665         req->flags = dump->u.in.flags;
1666         dump->hdr.rc = vbg_req_perform(gdev, req);
1667
1668         vbg_req_free(req, sizeof(*req));
1669         return 0;
1670 }
1671
1672 /**
1673  * Common IOCtl for user to kernel communication.
1674  * Return: 0 or negative errno value.
1675  * @session:    The client session.
1676  * @req:        The requested function.
1677  * @data:       The i/o data buffer, minimum size sizeof(struct vbg_ioctl_hdr).
1678  */
1679 int vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data)
1680 {
1681         unsigned int req_no_size = req & ~IOCSIZE_MASK;
1682         struct vbg_dev *gdev = session->gdev;
1683         struct vbg_ioctl_hdr *hdr = data;
1684         bool f32bit = false;
1685
1686         hdr->rc = VINF_SUCCESS;
1687         if (!hdr->size_out)
1688                 hdr->size_out = hdr->size_in;
1689
1690         /*
1691          * hdr->version and hdr->size_in / hdr->size_out minimum size are
1692          * already checked by vbg_misc_device_ioctl().
1693          */
1694
1695         /* For VMMDEV_REQUEST hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT */
1696         if (req_no_size == VBG_IOCTL_VMMDEV_REQUEST(0) ||
1697             req == VBG_IOCTL_VMMDEV_REQUEST_BIG ||
1698             req == VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT)
1699                 return vbg_ioctl_vmmrequest(gdev, session, data);
1700
1701         if (hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT)
1702                 return -EINVAL;
1703
1704         /* Fixed size requests. */
1705         switch (req) {
1706         case VBG_IOCTL_DRIVER_VERSION_INFO:
1707                 return vbg_ioctl_driver_version_info(data);
1708         case VBG_IOCTL_HGCM_CONNECT:
1709                 return vbg_ioctl_hgcm_connect(gdev, session, data);
1710         case VBG_IOCTL_HGCM_DISCONNECT:
1711                 return vbg_ioctl_hgcm_disconnect(gdev, session, data);
1712         case VBG_IOCTL_WAIT_FOR_EVENTS:
1713                 return vbg_ioctl_wait_for_events(gdev, session, data);
1714         case VBG_IOCTL_INTERRUPT_ALL_WAIT_FOR_EVENTS:
1715                 return vbg_ioctl_interrupt_all_wait_events(gdev, session, data);
1716         case VBG_IOCTL_CHANGE_FILTER_MASK:
1717                 return vbg_ioctl_change_filter_mask(gdev, session, data);
1718         case VBG_IOCTL_ACQUIRE_GUEST_CAPABILITIES:
1719                 return vbg_ioctl_acquire_guest_capabilities(gdev, session, data);
1720         case VBG_IOCTL_CHANGE_GUEST_CAPABILITIES:
1721                 return vbg_ioctl_change_guest_capabilities(gdev, session, data);
1722         case VBG_IOCTL_CHECK_BALLOON:
1723                 return vbg_ioctl_check_balloon(gdev, data);
1724         case VBG_IOCTL_WRITE_CORE_DUMP:
1725                 return vbg_ioctl_write_core_dump(gdev, session, data);
1726         }
1727
1728         /* Variable sized requests. */
1729         switch (req_no_size) {
1730 #ifdef CONFIG_COMPAT
1731         case VBG_IOCTL_HGCM_CALL_32(0):
1732                 f32bit = true;
1733                 fallthrough;
1734 #endif
1735         case VBG_IOCTL_HGCM_CALL(0):
1736                 return vbg_ioctl_hgcm_call(gdev, session, f32bit, data);
1737         case VBG_IOCTL_LOG(0):
1738         case VBG_IOCTL_LOG_ALT(0):
1739                 return vbg_ioctl_log(data);
1740         }
1741
1742         vbg_err_ratelimited("Userspace made an unknown ioctl req %#08x\n", req);
1743         return -ENOTTY;
1744 }
1745
1746 /**
1747  * Report guest supported mouse-features to the host.
1748  *
1749  * Return: 0 or negative errno value.
1750  * @gdev:               The Guest extension device.
1751  * @features:           The set of features to report to the host.
1752  */
1753 int vbg_core_set_mouse_status(struct vbg_dev *gdev, u32 features)
1754 {
1755         struct vmmdev_mouse_status *req;
1756         int rc;
1757
1758         req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_MOUSE_STATUS,
1759                             VBG_KERNEL_REQUEST);
1760         if (!req)
1761                 return -ENOMEM;
1762
1763         req->mouse_features = features;
1764         req->pointer_pos_x = 0;
1765         req->pointer_pos_y = 0;
1766
1767         rc = vbg_req_perform(gdev, req);
1768         if (rc < 0)
1769                 vbg_err("%s error, rc: %d\n", __func__, rc);
1770
1771         vbg_req_free(req, sizeof(*req));
1772         return vbg_status_code_to_errno(rc);
1773 }
1774
1775 /** Core interrupt service routine. */
1776 irqreturn_t vbg_core_isr(int irq, void *dev_id)
1777 {
1778         struct vbg_dev *gdev = dev_id;
1779         struct vmmdev_events *req = gdev->ack_events_req;
1780         bool mouse_position_changed = false;
1781         unsigned long flags;
1782         u32 events = 0;
1783         int rc;
1784
1785         if (!gdev->mmio->V.V1_04.have_events)
1786                 return IRQ_NONE;
1787
1788         /* Get and acknowlegde events. */
1789         req->header.rc = VERR_INTERNAL_ERROR;
1790         req->events = 0;
1791         rc = vbg_req_perform(gdev, req);
1792         if (rc < 0) {
1793                 vbg_err("Error performing events req, rc: %d\n", rc);
1794                 return IRQ_NONE;
1795         }
1796
1797         events = req->events;
1798
1799         if (events & VMMDEV_EVENT_MOUSE_POSITION_CHANGED) {
1800                 mouse_position_changed = true;
1801                 events &= ~VMMDEV_EVENT_MOUSE_POSITION_CHANGED;
1802         }
1803
1804         if (events & VMMDEV_EVENT_HGCM) {
1805                 wake_up(&gdev->hgcm_wq);
1806                 events &= ~VMMDEV_EVENT_HGCM;
1807         }
1808
1809         if (events & VMMDEV_EVENT_BALLOON_CHANGE_REQUEST) {
1810                 schedule_work(&gdev->mem_balloon.work);
1811                 events &= ~VMMDEV_EVENT_BALLOON_CHANGE_REQUEST;
1812         }
1813
1814         if (events) {
1815                 spin_lock_irqsave(&gdev->event_spinlock, flags);
1816                 gdev->pending_events |= events;
1817                 spin_unlock_irqrestore(&gdev->event_spinlock, flags);
1818
1819                 wake_up(&gdev->event_wq);
1820         }
1821
1822         if (mouse_position_changed)
1823                 vbg_linux_mouse_event(gdev);
1824
1825         return IRQ_HANDLED;
1826 }