All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH resend v2 0/3] virt: Add vboxguest driver for Virtual Box Guest integration
@ 2017-11-26 15:12 Hans de Goede
  2017-11-26 15:12 ` [PATCH resend v2 1/3] virt: Add vboxguest driver for Virtual Box Guest integration UAPI Hans de Goede
                   ` (3 more replies)
  0 siblings, 4 replies; 14+ messages in thread
From: Hans de Goede @ 2017-11-26 15:12 UTC (permalink / raw)
  To: Arnd Bergmann, Greg Kroah-Hartman
  Cc: Hans de Goede, Michael Thayer, Knut St . Osmundsen, Larry Finger,
	Christoph Hellwig, linux-kernel

Here is resend of v2 of my cleaned up version of the VirtualBox vboxguest
driver, rebased on top of current the master from Linus.

Note there currently is an issue with vboxvideo in the current master from
Linus, this is fixed by this patch:
https://patchwork.freedesktop.org/patch/189812/

Once this is merged, I will do some further cleanups on the vboxsf driver
and also submit that upstream, if people want to test it before then, here
is a version which applies on top of this series:
https://github.com/jwrdegoede/linux-sunxi/commit/7f18b741945de3ae09ca8f1a9e48456ce32986c9

Changes in v2:
-Change all uapi headers to kernel coding style: Drop struct and enum typedefs
 make type and struct-member names all lowercase, enum values all uppercase.
-Remove unused struct type declarations from some headers (shaving of another
 1000 lines)
-Remove or fixup doxygen style comments
-Get rid of CHECK macros, use a function taking in_ and out_size args instead
-Some other small codyingstyle fixes
-Split into multiple patches

Here is (part of) the v1 cover-letter which is still relevant:

VirtualBox upstream has declared the ioctl API for the /dev/vboxguest device
as being stable now, so once this passes review this is ready for merging.

I'm only submitting the vboxguest driver for now, as the vboxsf driver
depends on this and it easier to first just get the vboxguest driver
upstream.

I've removed all depenencies on vbox's OS-independent runtime and
the runtime itself, reducing the vboxguest driver from 100000+ lines
of code to aprox. 4300 lines. This reduces the non debug vboxguest.ko
size from 450kB to less then 100 kB. I've also cleaned up various other
warts such as doing hardware init in module_init rather then in a
pci_probe callback.

The vboxguest driver introduces a new userspace API + ABI in the form
of ioctls on a character device. VirtualBox upstream not willing to
commit to keeping this ABI stable was one of the things which has
kept this driver driver out of mainline sofar. I've been talking to
VirtualBox upstream about mainlining the guest drivers and VirtualBox
upstream has agreed to consider the userspace ABI stable and only
extend it in a backwards compatible manner from now on.

Regards,

Hans

^ permalink raw reply	[flat|nested] 14+ messages in thread

* [PATCH resend v2 1/3] virt: Add vboxguest driver for Virtual Box Guest integration UAPI
  2017-11-26 15:12 [PATCH resend v2 0/3] virt: Add vboxguest driver for Virtual Box Guest integration Hans de Goede
@ 2017-11-26 15:12 ` Hans de Goede
  2017-11-27 19:44   ` Larry Finger
  2017-11-26 15:12 ` [PATCH resend v2 2/3] virt: Add vboxguest VMMDEV communication code Hans de Goede
                   ` (2 subsequent siblings)
  3 siblings, 1 reply; 14+ messages in thread
From: Hans de Goede @ 2017-11-26 15:12 UTC (permalink / raw)
  To: Arnd Bergmann, Greg Kroah-Hartman
  Cc: Hans de Goede, Michael Thayer, Knut St . Osmundsen, Larry Finger,
	Christoph Hellwig, linux-kernel

This commit adds the headers describing the ioctl API for the
/dev/vboxguest device used by the Virtual Box Guest Additions
in Virtual Box virtual machines.

The driver providing the /dev/vboxguest device will allow Virtual Box
Guest Additions features such as copy-and-paste, seamless mode and
OpenGL pass-through.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
---
Changes in v2:
-Change all uapi headers to kernel coding style: Drop struct and enum typedefs
 make type and struct-member names all lowercase, enum values all uppercase.
-Remove unused struct type declarations from some headers (shaving of another
 1000 lines)
-Remove or fixup doxygen style comments
-Get rid of CHECK macros, use a function taking in_ and out_size args instead
-Some other small codyingstyle fixes
-Split into multiple patches
---
 MAINTAINERS                            |   7 +
 include/uapi/linux/vbox_err.h          | 170 ++++++++++++++++
 include/uapi/linux/vbox_vmmdev_types.h | 237 +++++++++++++++++++++++
 include/uapi/linux/vboxguest.h         | 341 +++++++++++++++++++++++++++++++++
 4 files changed, 755 insertions(+)
 create mode 100644 include/uapi/linux/vbox_err.h
 create mode 100644 include/uapi/linux/vbox_vmmdev_types.h
 create mode 100644 include/uapi/linux/vboxguest.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 275815e2ef44..fe3dc0e9b901 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14549,6 +14549,13 @@ S:	Maintained
 F:	drivers/virtio/virtio_input.c
 F:	include/uapi/linux/virtio_input.h
 
+VIRTUAL BOX GUEST DEVICE DRIVER
+M:	Hans de Goede <hdegoede@redhat.com>
+M:	Arnd Bergmann <arnd@arndb.de>
+M:	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+S:	Maintained
+F:	include/uapi/linux/vbox*.h
+
 VIRTUAL SERIO DEVICE DRIVER
 M:	Stephen Chandler Paul <thatslyude@gmail.com>
 S:	Maintained
diff --git a/include/uapi/linux/vbox_err.h b/include/uapi/linux/vbox_err.h
new file mode 100644
index 000000000000..6f56d2952621
--- /dev/null
+++ b/include/uapi/linux/vbox_err.h
@@ -0,0 +1,170 @@
+/*
+ * Copyright (C) 2017 Oracle Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __UAPI_VBOX_ERR_H__
+#define __UAPI_VBOX_ERR_H__
+
+#define VINF_SUCCESS                        0
+#define VERR_GENERAL_FAILURE                (-1)
+#define VERR_INVALID_PARAMETER              (-2)
+#define VERR_INVALID_MAGIC                  (-3)
+#define VERR_INVALID_HANDLE                 (-4)
+#define VERR_LOCK_FAILED                    (-5)
+#define VERR_INVALID_POINTER                (-6)
+#define VERR_IDT_FAILED                     (-7)
+#define VERR_NO_MEMORY                      (-8)
+#define VERR_ALREADY_LOADED                 (-9)
+#define VERR_PERMISSION_DENIED              (-10)
+#define VERR_VERSION_MISMATCH               (-11)
+#define VERR_NOT_IMPLEMENTED                (-12)
+#define VERR_INVALID_FLAGS                  (-13)
+
+#define VERR_NOT_EQUAL                      (-18)
+#define VERR_NOT_SYMLINK                    (-19)
+#define VERR_NO_TMP_MEMORY                  (-20)
+#define VERR_INVALID_FMODE                  (-21)
+#define VERR_WRONG_ORDER                    (-22)
+#define VERR_NO_TLS_FOR_SELF                (-23)
+#define VERR_FAILED_TO_SET_SELF_TLS         (-24)
+#define VERR_NO_CONT_MEMORY                 (-26)
+#define VERR_NO_PAGE_MEMORY                 (-27)
+#define VERR_THREAD_IS_DEAD                 (-29)
+#define VERR_THREAD_NOT_WAITABLE            (-30)
+#define VERR_PAGE_TABLE_NOT_PRESENT         (-31)
+#define VERR_INVALID_CONTEXT                (-32)
+#define VERR_TIMER_BUSY                     (-33)
+#define VERR_ADDRESS_CONFLICT               (-34)
+#define VERR_UNRESOLVED_ERROR               (-35)
+#define VERR_INVALID_FUNCTION               (-36)
+#define VERR_NOT_SUPPORTED                  (-37)
+#define VERR_ACCESS_DENIED                  (-38)
+#define VERR_INTERRUPTED                    (-39)
+#define VERR_TIMEOUT                        (-40)
+#define VERR_BUFFER_OVERFLOW                (-41)
+#define VERR_TOO_MUCH_DATA                  (-42)
+#define VERR_MAX_THRDS_REACHED              (-43)
+#define VERR_MAX_PROCS_REACHED              (-44)
+#define VERR_SIGNAL_REFUSED                 (-45)
+#define VERR_SIGNAL_PENDING                 (-46)
+#define VERR_SIGNAL_INVALID                 (-47)
+#define VERR_STATE_CHANGED                  (-48)
+#define VERR_INVALID_UUID_FORMAT            (-49)
+#define VERR_PROCESS_NOT_FOUND              (-50)
+#define VERR_PROCESS_RUNNING                (-51)
+#define VERR_TRY_AGAIN                      (-52)
+#define VERR_PARSE_ERROR                    (-53)
+#define VERR_OUT_OF_RANGE                   (-54)
+#define VERR_NUMBER_TOO_BIG                 (-55)
+#define VERR_NO_DIGITS                      (-56)
+#define VERR_NEGATIVE_UNSIGNED              (-57)
+#define VERR_NO_TRANSLATION                 (-58)
+
+#define VERR_NOT_FOUND                      (-78)
+#define VERR_INVALID_STATE                  (-79)
+#define VERR_OUT_OF_RESOURCES               (-80)
+
+#define VERR_FILE_NOT_FOUND                 (-102)
+#define VERR_PATH_NOT_FOUND                 (-103)
+#define VERR_INVALID_NAME                   (-104)
+#define VERR_ALREADY_EXISTS                 (-105)
+#define VERR_TOO_MANY_OPEN_FILES            (-106)
+#define VERR_SEEK                           (-107)
+#define VERR_NEGATIVE_SEEK                  (-108)
+#define VERR_SEEK_ON_DEVICE                 (-109)
+#define VERR_EOF                            (-110)
+#define VERR_READ_ERROR                     (-111)
+#define VERR_WRITE_ERROR                    (-112)
+#define VERR_WRITE_PROTECT                  (-113)
+#define VERR_SHARING_VIOLATION              (-114)
+#define VERR_FILE_LOCK_FAILED               (-115)
+#define VERR_FILE_LOCK_VIOLATION            (-116)
+#define VERR_CANT_CREATE                    (-117)
+#define VERR_CANT_DELETE_DIRECTORY          (-118)
+#define VERR_NOT_SAME_DEVICE                (-119)
+#define VERR_FILENAME_TOO_LONG              (-120)
+#define VERR_MEDIA_NOT_PRESENT              (-121)
+#define VERR_MEDIA_NOT_RECOGNIZED           (-122)
+#define VERR_FILE_NOT_LOCKED                (-123)
+#define VERR_FILE_LOCK_LOST                 (-124)
+#define VERR_DIR_NOT_EMPTY                  (-125)
+#define VERR_NOT_A_DIRECTORY                (-126)
+#define VERR_IS_A_DIRECTORY                 (-127)
+#define VERR_FILE_TOO_BIG                   (-128)
+
+#define VERR_NET_IO_ERROR                       (-400)
+#define VERR_NET_OUT_OF_RESOURCES               (-401)
+#define VERR_NET_HOST_NOT_FOUND                 (-402)
+#define VERR_NET_PATH_NOT_FOUND                 (-403)
+#define VERR_NET_PRINT_ERROR                    (-404)
+#define VERR_NET_NO_NETWORK                     (-405)
+#define VERR_NET_NOT_UNIQUE_NAME                (-406)
+
+#define VERR_NET_IN_PROGRESS                    (-436)
+#define VERR_NET_ALREADY_IN_PROGRESS            (-437)
+#define VERR_NET_NOT_SOCKET                     (-438)
+#define VERR_NET_DEST_ADDRESS_REQUIRED          (-439)
+#define VERR_NET_MSG_SIZE                       (-440)
+#define VERR_NET_PROTOCOL_TYPE                  (-441)
+#define VERR_NET_PROTOCOL_NOT_AVAILABLE         (-442)
+#define VERR_NET_PROTOCOL_NOT_SUPPORTED         (-443)
+#define VERR_NET_SOCKET_TYPE_NOT_SUPPORTED      (-444)
+#define VERR_NET_OPERATION_NOT_SUPPORTED        (-445)
+#define VERR_NET_PROTOCOL_FAMILY_NOT_SUPPORTED  (-446)
+#define VERR_NET_ADDRESS_FAMILY_NOT_SUPPORTED   (-447)
+#define VERR_NET_ADDRESS_IN_USE                 (-448)
+#define VERR_NET_ADDRESS_NOT_AVAILABLE          (-449)
+#define VERR_NET_DOWN                           (-450)
+#define VERR_NET_UNREACHABLE                    (-451)
+#define VERR_NET_CONNECTION_RESET               (-452)
+#define VERR_NET_CONNECTION_ABORTED             (-453)
+#define VERR_NET_CONNECTION_RESET_BY_PEER       (-454)
+#define VERR_NET_NO_BUFFER_SPACE                (-455)
+#define VERR_NET_ALREADY_CONNECTED              (-456)
+#define VERR_NET_NOT_CONNECTED                  (-457)
+#define VERR_NET_SHUTDOWN                       (-458)
+#define VERR_NET_TOO_MANY_REFERENCES            (-459)
+#define VERR_NET_CONNECTION_TIMED_OUT           (-460)
+#define VERR_NET_CONNECTION_REFUSED             (-461)
+#define VERR_NET_HOST_DOWN                      (-464)
+#define VERR_NET_HOST_UNREACHABLE               (-465)
+#define VERR_NET_PROTOCOL_ERROR                 (-466)
+#define VERR_NET_INCOMPLETE_TX_PACKET           (-467)
+
+/* misc. unsorted codes */
+#define VERR_RESOURCE_BUSY                      (-138)
+#define VERR_DISK_FULL                          (-152)
+#define VERR_TOO_MANY_SYMLINKS                  (-156)
+#define VERR_NO_MORE_FILES                      (-201)
+#define VERR_INTERNAL_ERROR                     (-225)
+#define VERR_INTERNAL_ERROR_2                   (-226)
+#define VERR_INTERNAL_ERROR_3                   (-227)
+#define VERR_INTERNAL_ERROR_4                   (-228)
+#define VERR_DEV_IO_ERROR                       (-250)
+#define VERR_IO_BAD_LENGTH                      (-255)
+#define VERR_BROKEN_PIPE                        (-301)
+#define VERR_NO_DATA                            (-304)
+#define VERR_SEM_DESTROYED                      (-363)
+#define VERR_DEADLOCK                           (-365)
+#define VERR_BAD_EXE_FORMAT                     (-608)
+#define VINF_HGCM_ASYNC_EXECUTE                 (2903)
+
+#endif
diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h
new file mode 100644
index 000000000000..1fdabee603fa
--- /dev/null
+++ b/include/uapi/linux/vbox_vmmdev_types.h
@@ -0,0 +1,237 @@
+/*
+ * Virtual Device for Guest <-> VMM/Host communication, type definitions
+ * which are also used for the vboxguest ioctl interface / by vboxsf
+ *
+ * Copyright (C) 2006-2016 Oracle Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, in which case the provisions of the CDDL are applicable
+ * instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+#ifndef __UAPI_VBOX_VMMDEV_TYPES_H__
+#define __UAPI_VBOX_VMMDEV_TYPES_H__
+
+#include <asm/bitsperlong.h>
+#include <linux/types.h>
+
+/*
+ * We cannot use linux' compiletime_assert here because it expects to be used
+ * inside a function only. Use a typedef to a char array with a negative size.
+ */
+#define VMMDEV_ASSERT_SIZE(type, size) \
+	typedef char type ## _asrt_size[1 - 2*!!(sizeof(struct type) != (size))]
+
+/** enum vmmdev_request_type - VMMDev request types. */
+enum vmmdev_request_type {
+	VMMDEVREQ_INVALID_REQUEST              =  0,
+	VMMDEVREQ_GET_MOUSE_STATUS             =  1,
+	VMMDEVREQ_SET_MOUSE_STATUS             =  2,
+	VMMDEVREQ_SET_POINTER_SHAPE            =  3,
+	VMMDEVREQ_GET_HOST_VERSION             =  4,
+	VMMDEVREQ_IDLE                         =  5,
+	VMMDEVREQ_GET_HOST_TIME                = 10,
+	VMMDEVREQ_GET_HYPERVISOR_INFO          = 20,
+	VMMDEVREQ_SET_HYPERVISOR_INFO          = 21,
+	VMMDEVREQ_REGISTER_PATCH_MEMORY        = 22, /* since version 3.0.6 */
+	VMMDEVREQ_DEREGISTER_PATCH_MEMORY      = 23, /* since version 3.0.6 */
+	VMMDEVREQ_SET_POWER_STATUS             = 30,
+	VMMDEVREQ_ACKNOWLEDGE_EVENTS           = 41,
+	VMMDEVREQ_CTL_GUEST_FILTER_MASK        = 42,
+	VMMDEVREQ_REPORT_GUEST_INFO            = 50,
+	VMMDEVREQ_REPORT_GUEST_INFO2           = 58, /* since version 3.2.0 */
+	VMMDEVREQ_REPORT_GUEST_STATUS          = 59, /* since version 3.2.8 */
+	VMMDEVREQ_REPORT_GUEST_USER_STATE      = 74, /* since version 4.3 */
+	/* Retrieve a display resize request sent by the host, deprecated. */
+	VMMDEVREQ_GET_DISPLAY_CHANGE_REQ       = 51,
+	VMMDEVREQ_VIDEMODE_SUPPORTED           = 52,
+	VMMDEVREQ_GET_HEIGHT_REDUCTION         = 53,
+	/**
+	 * @VMMDEVREQ_GET_DISPLAY_CHANGE_REQ2:
+	 * Retrieve a display resize request sent by the host.
+	 *
+	 * Queries a display resize request sent from the host.  If the
+	 * event_ack member is sent to true and there is an unqueried request
+	 * available for one of the virtual display then that request will
+	 * be returned.  If several displays have unqueried requests the lowest
+	 * numbered display will be chosen first.  Only the most recent unseen
+	 * request for each display is remembered.
+	 * If event_ack is set to false, the last host request queried with
+	 * event_ack set is resent, or failing that the most recent received
+	 * from the host.  If no host request was ever received then all zeros
+	 * are returned.
+	 */
+	VMMDEVREQ_GET_DISPLAY_CHANGE_REQ2      = 54,
+	VMMDEVREQ_REPORT_GUEST_CAPABILITIES    = 55,
+	VMMDEVREQ_SET_GUEST_CAPABILITIES       = 56,
+	VMMDEVREQ_VIDEMODE_SUPPORTED2          = 57, /* since version 3.2.0 */
+	VMMDEVREQ_GET_DISPLAY_CHANGE_REQEX     = 80, /* since version 4.2.4 */
+	VMMDEVREQ_HGCM_CONNECT                 = 60,
+	VMMDEVREQ_HGCM_DISCONNECT              = 61,
+	VMMDEVREQ_HGCM_CALL32                  = 62,
+	VMMDEVREQ_HGCM_CALL64                  = 63,
+	VMMDEVREQ_HGCM_CANCEL                  = 64,
+	VMMDEVREQ_HGCM_CANCEL2                 = 65,
+	VMMDEVREQ_VIDEO_ACCEL_ENABLE           = 70,
+	VMMDEVREQ_VIDEO_ACCEL_FLUSH            = 71,
+	VMMDEVREQ_VIDEO_SET_VISIBLE_REGION     = 72,
+	VMMDEVREQ_GET_SEAMLESS_CHANGE_REQ      = 73,
+	VMMDEVREQ_QUERY_CREDENTIALS            = 100,
+	VMMDEVREQ_REPORT_CREDENTIALS_JUDGEMENT = 101,
+	VMMDEVREQ_REPORT_GUEST_STATS           = 110,
+	VMMDEVREQ_GET_MEMBALLOON_CHANGE_REQ    = 111,
+	VMMDEVREQ_GET_STATISTICS_CHANGE_REQ    = 112,
+	VMMDEVREQ_CHANGE_MEMBALLOON            = 113,
+	VMMDEVREQ_GET_VRDPCHANGE_REQ           = 150,
+	VMMDEVREQ_LOG_STRING                   = 200,
+	VMMDEVREQ_GET_CPU_HOTPLUG_REQ          = 210,
+	VMMDEVREQ_SET_CPU_HOTPLUG_STATUS       = 211,
+	VMMDEVREQ_REGISTER_SHARED_MODULE       = 212,
+	VMMDEVREQ_UNREGISTER_SHARED_MODULE     = 213,
+	VMMDEVREQ_CHECK_SHARED_MODULES         = 214,
+	VMMDEVREQ_GET_PAGE_SHARING_STATUS      = 215,
+	VMMDEVREQ_DEBUG_IS_PAGE_SHARED         = 216,
+	VMMDEVREQ_GET_SESSION_ID               = 217, /* since version 3.2.8 */
+	VMMDEVREQ_WRITE_COREDUMP               = 218,
+	VMMDEVREQ_GUEST_HEARTBEAT              = 219,
+	VMMDEVREQ_HEARTBEAT_CONFIGURE          = 220,
+	/* Ensure the enum is a 32 bit data-type */
+	VMMDEVREQ_SIZEHACK                     = 0x7fffffff
+};
+
+#if __BITS_PER_LONG == 64
+#define VMMDEVREQ_HGCM_CALL VMMDEVREQ_HGCM_CALL64
+#else
+#define VMMDEVREQ_HGCM_CALL VMMDEVREQ_HGCM_CALL32
+#endif
+
+/** HGCM service location types. */
+enum vmmdev_hgcm_service_location_type {
+	VMMDEV_HGCM_LOC_INVALID    = 0,
+	VMMDEV_HGCM_LOC_LOCALHOST  = 1,
+	VMMDEV_HGCM_LOC_LOCALHOST_EXISTING = 2,
+	/* Ensure the enum is a 32 bit data-type */
+	VMMDEV_HGCM_LOC_SIZEHACK   = 0x7fffffff
+};
+
+/** HGCM host service location. */
+struct vmmdev_hgcm_service_location_localhost {
+	/** Service name */
+	char service_name[128];
+};
+VMMDEV_ASSERT_SIZE(vmmdev_hgcm_service_location_localhost, 128);
+
+/** HGCM service location. */
+struct vmmdev_hgcm_service_location {
+	/** Type of the location. */
+	enum vmmdev_hgcm_service_location_type type;
+
+	union {
+		struct vmmdev_hgcm_service_location_localhost localhost;
+	} u;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_hgcm_service_location, 128 + 4);
+
+/** HGCM function parameter type. */
+enum vmmdev_hgcm_function_parameter_type {
+	VMMDEV_HGCM_PARM_TYPE_INVALID            = 0,
+	VMMDEV_HGCM_PARM_TYPE_32BIT              = 1,
+	VMMDEV_HGCM_PARM_TYPE_64BIT              = 2,
+	/** Deprecated Doesn't work, use PAGELIST. */
+	VMMDEV_HGCM_PARM_TYPE_PHYSADDR           = 3,
+	/** In and Out, user-memory */
+	VMMDEV_HGCM_PARM_TYPE_LINADDR            = 4,
+	/** In, user-memory  (read;  host<-guest) */
+	VMMDEV_HGCM_PARM_TYPE_LINADDR_IN         = 5,
+	/** Out, user-memory (write; host->guest) */
+	VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT        = 6,
+	/** In and Out, kernel-memory */
+	VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL     = 7,
+	/** In, kernel-memory  (read;  host<-guest) */
+	VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN  = 8,
+	/** Out, kernel-memory (write; host->guest) */
+	VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT = 9,
+	/** Physical addresses of locked pages for a buffer. */
+	VMMDEV_HGCM_PARM_TYPE_PAGELIST           = 10,
+	/* Ensure the enum is a 32 bit data-type */
+	VMMDEV_HGCM_PARM_TYPE_SIZEHACK           = 0x7fffffff
+};
+
+/** HGCM function parameter, 32-bit client. */
+struct vmmdev_hgcm_function_parameter32 {
+	enum vmmdev_hgcm_function_parameter_type type;
+	union {
+		__u32 value32;
+		__u64 value64;
+		struct {
+			__u32 size;
+			union {
+				__u32 phys_addr;
+				__u32 linear_addr;
+			} u;
+		} pointer;
+		struct {
+			/** Size of the buffer described by the page list. */
+			__u32 size;
+			/** Relative to the request header. */
+			__u32 offset;
+		} page_list;
+	} u;
+} __packed;
+VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8);
+
+/** HGCM function parameter, 64-bit client. */
+struct vmmdev_hgcm_function_parameter64 {
+	enum vmmdev_hgcm_function_parameter_type type;
+	union {
+		__u32 value32;
+		__u64 value64;
+		struct {
+			__u32 size;
+			union {
+				__u64 phys_addr;
+				__u64 linear_addr;
+			} u;
+		} __packed pointer;
+		struct {
+			/** Size of the buffer described by the page list. */
+			__u32 size;
+			/** Relative to the request header. */
+			__u32 offset;
+		} page_list;
+	} __packed u;
+} __packed;
+VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter64, 4 + 12);
+
+#if __BITS_PER_LONG == 64
+#define vmmdev_hgcm_function_parameter vmmdev_hgcm_function_parameter64
+#else
+#define vmmdev_hgcm_function_parameter vmmdev_hgcm_function_parameter32
+#endif
+
+#define VMMDEV_HGCM_F_PARM_DIRECTION_NONE      0x00000000U
+#define VMMDEV_HGCM_F_PARM_DIRECTION_TO_HOST   0x00000001U
+#define VMMDEV_HGCM_F_PARM_DIRECTION_FROM_HOST 0x00000002U
+#define VMMDEV_HGCM_F_PARM_DIRECTION_BOTH      0x00000003U
+
+/**
+ * struct vmmdev_hgcm_pagelist - VMMDEV_HGCM_PARM_TYPE_PAGELIST parameters
+ * point to this structure to actually describe the buffer.
+ */
+struct vmmdev_hgcm_pagelist {
+	__u32 flags;             /** VMMDEV_HGCM_F_PARM_*. */
+	__u16 offset_first_page; /** Data offset in the first page. */
+	__u16 page_count;        /** Number of pages. */
+	__u64 pages[1];          /** Page addresses. */
+};
+VMMDEV_ASSERT_SIZE(vmmdev_hgcm_pagelist, 4 + 2 + 2 + 8);
+
+#endif
diff --git a/include/uapi/linux/vboxguest.h b/include/uapi/linux/vboxguest.h
new file mode 100644
index 000000000000..d201eb080df2
--- /dev/null
+++ b/include/uapi/linux/vboxguest.h
@@ -0,0 +1,341 @@
+/*
+ * VBoxGuest - VirtualBox Guest Additions Driver Interface.
+ *
+ * Copyright (C) 2006-2016 Oracle Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, in which case the provisions of the CDDL are applicable
+ * instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+#ifndef __UAPI_VBOXGUEST_H__
+#define __UAPI_VBOXGUEST_H__
+
+#include <asm/bitsperlong.h>
+#include <linux/ioctl.h>
+#include <linux/vbox_err.h>
+#include <linux/vbox_vmmdev_types.h>
+
+/* Version of vbg_ioctl_hdr structure. */
+#define VBG_IOCTL_HDR_VERSION		0x10001
+/* Default request type.  Use this for non-VMMDev requests. */
+#define VBG_IOCTL_HDR_TYPE_DEFAULT		0
+
+/**
+ * Common ioctl header.
+ *
+ * This is a mirror of vmmdev_request_header to prevent duplicating data and
+ * needing to verify things multiple times.
+ */
+struct vbg_ioctl_hdr {
+	/** IN: The request input size, and output size if size_out is zero. */
+	__u32 size_in;
+	/** IN: Structure version (VBG_IOCTL_HDR_VERSION) */
+	__u32 version;
+	/** IN: The VMMDev request type or VBG_IOCTL_HDR_TYPE_DEFAULT. */
+	__u32 type;
+	/**
+	 * OUT: The VBox status code of the operation, out direction only.
+	 * This is a VINF_ or VERR_ value as defined in vbox_err.h.
+	 */
+	__s32 rc;
+	/** IN: Output size. Set to zero to use size_in as output size. */
+	__u32 size_out;
+	/** Reserved, MBZ. */
+	__u32 reserved;
+};
+VMMDEV_ASSERT_SIZE(vbg_ioctl_hdr, 24);
+
+
+/*
+ * The VBoxGuest I/O control version.
+ *
+ * As usual, the high word contains the major version and changes to it
+ * signifies incompatible changes.
+ *
+ * The lower word is the minor version number, it is increased when new
+ * functions are added or existing changed in a backwards compatible manner.
+ */
+#define VBG_IOC_VERSION		0x00010000u
+
+/**
+ * VBG_IOCTL_DRIVER_VERSION_INFO data structure
+ *
+ * Note VBG_IOCTL_DRIVER_VERSION_INFO may switch the session to a backwards
+ * compatible interface version if uClientVersion indicates older client code.
+ */
+struct vbg_ioctl_driver_version_info {
+	/** The header. */
+	struct vbg_ioctl_hdr hdr;
+	union {
+		struct {
+			/** Requested interface version (VBG_IOC_VERSION). */
+			__u32 req_version;
+			/**
+			 * Minimum interface version number (typically the
+			 * major version part of VBG_IOC_VERSION).
+			 */
+			__u32 min_version;
+			/** Reserved, MBZ. */
+			__u32 reserved1;
+			/** Reserved, MBZ. */
+			__u32 reserved2;
+		} in;
+		struct {
+			/** Version for this session (typ. VBG_IOC_VERSION). */
+			__u32 session_version;
+			/** Version of the IDC interface (VBG_IOC_VERSION). */
+			__u32 driver_version;
+			/** The SVN revision of the driver, or 0. */
+			__u32 driver_revision;
+			/** Reserved \#1 (zero until defined). */
+			__u32 reserved1;
+			/** Reserved \#2 (zero until defined). */
+			__u32 reserved2;
+		} out;
+	} u;
+};
+VMMDEV_ASSERT_SIZE(vbg_ioctl_driver_version_info, 24 + 20);
+
+#define VBG_IOCTL_DRIVER_VERSION_INFO \
+	_IOWR('V', 0, struct vbg_ioctl_driver_version_info)
+
+
+/* IOCTL to perform a VMM Device request less than 1KB in size. */
+#define VBG_IOCTL_VMMDEV_REQUEST(s)	_IOC(_IOC_READ | _IOC_WRITE, 'V', 2, s)
+
+
+/* IOCTL to perform a VMM Device request larger then 1KB. */
+#define VBG_IOCTL_VMMDEV_REQUEST_BIG	_IOC(_IOC_READ | _IOC_WRITE, 'V', 3, 0)
+
+
+/** VBG_IOCTL_HGCM_CONNECT data structure. */
+struct vbg_ioctl_hgcm_connect {
+	struct vbg_ioctl_hdr hdr;
+	union {
+		struct {
+			struct vmmdev_hgcm_service_location loc;
+		} in;
+		struct {
+			__u32 client_id;
+		} out;
+	} u;
+};
+VMMDEV_ASSERT_SIZE(vbg_ioctl_hgcm_connect, 24 + 132);
+
+#define VBG_IOCTL_HGCM_CONNECT \
+	_IOWR('V', 4, struct vbg_ioctl_hgcm_connect)
+
+
+/** VBG_IOCTL_HGCM_DISCONNECT data structure. */
+struct vbg_ioctl_hgcm_disconnect {
+	struct vbg_ioctl_hdr hdr;
+	union {
+		struct {
+			__u32 client_id;
+		} in;
+	} u;
+};
+VMMDEV_ASSERT_SIZE(vbg_ioctl_hgcm_disconnect, 24 + 4);
+
+#define VBG_IOCTL_HGCM_DISCONNECT \
+	_IOWR('V', 5, struct vbg_ioctl_hgcm_disconnect)
+
+
+/** VBG_IOCTL_HGCM_CALL data structure. */
+struct vbg_ioctl_hgcm_call {
+	/** The header. */
+	struct vbg_ioctl_hdr hdr;
+	/** Input: The id of the caller. */
+	__u32 client_id;
+	/** Input: Function number. */
+	__u32 function;
+	/**
+	 * Input: How long to wait (milliseconds) for completion before
+	 * cancelling the call. Set to -1 to wait indefinitely.
+	 */
+	__u32 timeout_ms;
+	/** Interruptable flag, ignored for userspace calls. */
+	__u8 interruptible;
+	/** Explicit padding, MBZ. */
+	__u8 reserved;
+	/**
+	 * Input: How many parameters following this structure.
+	 *
+	 * The parameters are either HGCMFunctionParameter64 or 32,
+	 * depending on whether we're receiving a 64-bit or 32-bit request.
+	 *
+	 * The current maximum is 61 parameters (given a 1KB max request size,
+	 * and a 64-bit parameter size of 16 bytes).
+	 */
+	__u16 parm_count;
+	/*
+	 * Parameters follow in form:
+	 * struct hgcm_function_parameter<32|64> parms[parm_count]
+	 */
+};
+VMMDEV_ASSERT_SIZE(vbg_ioctl_hgcm_call, 24 + 16);
+
+#define VBG_IOCTL_HGCM_CALL_32(s)	_IOC(_IOC_READ | _IOC_WRITE, 'V', 6, s)
+#define VBG_IOCTL_HGCM_CALL_64(s)	_IOC(_IOC_READ | _IOC_WRITE, 'V', 7, s)
+#if __BITS_PER_LONG == 64
+#define VBG_IOCTL_HGCM_CALL(s)		VBG_IOCTL_HGCM_CALL_64(s)
+#else
+#define VBG_IOCTL_HGCM_CALL(s)		VBG_IOCTL_HGCM_CALL_32(s)
+#endif
+
+
+/** VBG_IOCTL_LOG data structure. */
+struct vbg_ioctl_log {
+	/** The header. */
+	struct vbg_ioctl_hdr hdr;
+	union {
+		struct {
+			/**
+			 * The log message, this may be zero terminated. If it
+			 * is not zero terminated then the length is determined
+			 * from the input size.
+			 */
+			char msg[1];
+		} in;
+	} u;
+};
+
+#define VBG_IOCTL_LOG(s)		_IOC(_IOC_READ | _IOC_WRITE, 'V', 9, s)
+
+
+/** VBG_IOCTL_WAIT_FOR_EVENTS data structure. */
+struct vbg_ioctl_wait_for_events {
+	/** The header. */
+	struct vbg_ioctl_hdr hdr;
+	union {
+		struct {
+			/** Timeout in milliseconds. */
+			__u32 timeout_ms;
+			/** Events to wait for. */
+			__u32 events;
+		} in;
+		struct {
+			/** Events that occurred. */
+			__u32 events;
+		} out;
+	} u;
+};
+VMMDEV_ASSERT_SIZE(vbg_ioctl_wait_for_events, 24 + 8);
+
+#define VBG_IOCTL_WAIT_FOR_EVENTS \
+	_IOWR('V', 10, struct vbg_ioctl_wait_for_events)
+
+
+/*
+ * IOCTL to VBoxGuest to interrupt (cancel) any pending
+ * VBG_IOCTL_WAIT_FOR_EVENTS and return.
+ *
+ * Handled inside the vboxguest driver and not seen by the host at all.
+ * After calling this, VBG_IOCTL_WAIT_FOR_EVENTS should no longer be called in
+ * the same session. Any VBOXGUEST_IOCTL_WAITEVENT calls in the same session
+ * done after calling this will directly exit with -EINTR.
+ */
+#define VBG_IOCTL_INTERRUPT_ALL_WAIT_FOR_EVENTS \
+	_IOWR('V', 11, struct vbg_ioctl_hdr)
+
+
+/** VBG_IOCTL_CHANGE_FILTER_MASK data structure. */
+struct vbg_ioctl_change_filter {
+	/** The header. */
+	struct vbg_ioctl_hdr hdr;
+	union {
+		struct {
+			/** Flags to set. */
+			__u32 or_mask;
+			/** Flags to remove. */
+			__u32 not_mask;
+		} in;
+	} u;
+};
+VMMDEV_ASSERT_SIZE(vbg_ioctl_change_filter, 24 + 8);
+
+/* IOCTL to VBoxGuest to control the event filter mask. */
+#define VBG_IOCTL_CHANGE_FILTER_MASK \
+	_IOWR('V', 12, struct vbg_ioctl_change_filter)
+
+
+/** VBG_IOCTL_CHANGE_GUEST_CAPABILITIES data structure. */
+struct vbg_ioctl_set_guest_caps {
+	/** The header. */
+	struct vbg_ioctl_hdr hdr;
+	union {
+		struct {
+			/** Capabilities to set (VMMDEV_GUEST_SUPPORTS_XXX). */
+			__u32 or_mask;
+			/** Capabilities to drop (VMMDEV_GUEST_SUPPORTS_XXX). */
+			__u32 not_mask;
+		} in;
+		struct {
+			/** Capabilities held by the session after the call. */
+			__u32 session_caps;
+			/** Capabilities for all the sessions after the call. */
+			__u32 global_caps;
+		} out;
+	} u;
+};
+VMMDEV_ASSERT_SIZE(vbg_ioctl_set_guest_caps, 24 + 8);
+
+#define VBG_IOCTL_CHANGE_GUEST_CAPABILITIES \
+	_IOWR('V', 14, struct vbg_ioctl_set_guest_caps)
+
+
+/** VBG_IOCTL_CHECK_BALLOON data structure. */
+struct vbg_ioctl_check_balloon {
+	/** The header. */
+	struct vbg_ioctl_hdr hdr;
+	union {
+		struct {
+			/** The size of the balloon in chunks of 1MB. */
+			__u32 balloon_chunks;
+			/**
+			 * false = handled in R0, no further action required.
+			 *  true = allocate balloon memory in R3.
+			 */
+			__u8 handle_in_r3;
+			/** Explicit padding, MBZ. */
+			__u8 padding[3];
+		} out;
+	} u;
+};
+VMMDEV_ASSERT_SIZE(vbg_ioctl_check_balloon, 24 + 8);
+
+/*
+ * IOCTL to check memory ballooning.
+ *
+ * The guest kernel module will ask the host for the current size of the
+ * balloon and adjust the size. Or it will set handle_in_r3 = true and R3 is
+ * responsible for allocating memory and calling VBG_IOCTL_CHANGE_BALLOON.
+ */
+#define VBG_IOCTL_CHECK_BALLOON \
+	_IOWR('V', 17, struct vbg_ioctl_check_balloon)
+
+
+/** VBG_IOCTL_WRITE_CORE_DUMP data structure. */
+struct vbg_ioctl_write_coredump {
+	struct vbg_ioctl_hdr hdr;
+	union {
+		struct {
+			__u32 flags; /** Flags (reserved, MBZ). */
+		} in;
+	} u;
+};
+VMMDEV_ASSERT_SIZE(vbg_ioctl_write_coredump, 24 + 4);
+
+#define VBG_IOCTL_WRITE_CORE_DUMP \
+	_IOWR('V', 19, struct vbg_ioctl_write_coredump)
+
+#endif
-- 
2.14.3

^ permalink raw reply related	[flat|nested] 14+ messages in thread

* [PATCH resend v2 2/3] virt: Add vboxguest VMMDEV communication code
  2017-11-26 15:12 [PATCH resend v2 0/3] virt: Add vboxguest driver for Virtual Box Guest integration Hans de Goede
  2017-11-26 15:12 ` [PATCH resend v2 1/3] virt: Add vboxguest driver for Virtual Box Guest integration UAPI Hans de Goede
@ 2017-11-26 15:12 ` Hans de Goede
  2017-11-27 19:46   ` Larry Finger
  2017-11-26 15:12 ` [PATCH resend v2 3/3] virt: Add vboxguest driver for Virtual Box Guest integration Hans de Goede
  2017-11-27 19:44 ` [PATCH resend v2 0/3] " Larry Finger
  3 siblings, 1 reply; 14+ messages in thread
From: Hans de Goede @ 2017-11-26 15:12 UTC (permalink / raw)
  To: Arnd Bergmann, Greg Kroah-Hartman
  Cc: Hans de Goede, Michael Thayer, Knut St . Osmundsen, Larry Finger,
	Christoph Hellwig, linux-kernel

This commits adds a header describing the hardware interface for the
Virtual Box Guest PCI device used in Virtual Box virtual machines and
utility functions for talking to the Virtual Box hypervisor over this
interface.

These utility functions will used both by the vboxguest driver for the
PCI device which offers the /dev/vboxguest ioctl API and by the vboxfs
driver which offers folder sharing support.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
---
Changes in v2:
-Change all uapi headers to kernel coding style: Drop struct and enum typedefs
 make type and struct-member names all lowercase, enum values all uppercase.
-Remove unused struct type declarations from some headers (shaving of another
 1000 lines)
-Remove or fixup doxygen style comments
-Get rid of CHECK macros, use a function taking in_ and out_size args instead
-Some other small codyingstyle fixes
-Split into multiple patches
---
 MAINTAINERS                              |   2 +
 drivers/virt/vboxguest/vboxguest_utils.c | 811 +++++++++++++++++++++++++++++++
 drivers/virt/vboxguest/vmmdev.h          | 460 ++++++++++++++++++
 include/linux/vbox_utils.h               |  92 ++++
 4 files changed, 1365 insertions(+)
 create mode 100644 drivers/virt/vboxguest/vboxguest_utils.c
 create mode 100644 drivers/virt/vboxguest/vmmdev.h
 create mode 100644 include/linux/vbox_utils.h

diff --git a/MAINTAINERS b/MAINTAINERS
index fe3dc0e9b901..01b30c12c267 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14554,7 +14554,9 @@ M:	Hans de Goede <hdegoede@redhat.com>
 M:	Arnd Bergmann <arnd@arndb.de>
 M:	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 S:	Maintained
+F:	include/linux/vbox_utils.h
 F:	include/uapi/linux/vbox*.h
+F:	drivers/virt/vboxguest/
 
 VIRTUAL SERIO DEVICE DRIVER
 M:	Stephen Chandler Paul <thatslyude@gmail.com>
diff --git a/drivers/virt/vboxguest/vboxguest_utils.c b/drivers/virt/vboxguest/vboxguest_utils.c
new file mode 100644
index 000000000000..5e1737d0a4fb
--- /dev/null
+++ b/drivers/virt/vboxguest/vboxguest_utils.c
@@ -0,0 +1,811 @@
+/*
+ * vboxguest vmm-req and hgcm-call code, VBoxGuestR0LibHGCMInternal.cpp,
+ * VBoxGuestR0LibGenericRequest.cpp and RTErrConvertToErrno.cpp in vbox svn.
+ *
+ * Copyright (C) 2006-2016 Oracle Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, in which case the provisions of the CDDL are applicable
+ * instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/sizes.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/vmalloc.h>
+#include <linux/vbox_err.h>
+#include <linux/vbox_utils.h>
+#include "vboxguest_core.h"
+
+/* Get the pointer to the first parameter of a HGCM call request. */
+#define VMMDEV_HGCM_CALL_PARMS(a) \
+	((struct vmmdev_hgcm_function_parameter *)( \
+		(u8 *)(a) + sizeof(struct vmmdev_hgcm_call)))
+
+/* The max parameter buffer size for a user request. */
+#define VBG_MAX_HGCM_USER_PARM		(24 * SZ_1M)
+/* The max parameter buffer size for a kernel request. */
+#define VBG_MAX_HGCM_KERNEL_PARM	(16 * SZ_1M)
+
+#define VBG_DEBUG_PORT			0x504
+
+/* This protects vbg_log_buf and serializes VBG_DEBUG_PORT accesses */
+static DEFINE_SPINLOCK(vbg_log_lock);
+static char vbg_log_buf[128];
+
+#define VBG_LOG(name, pr_func) \
+void name(const char *fmt, ...)						\
+{									\
+	unsigned long flags;						\
+	va_list args;							\
+	int i, count;							\
+									\
+	va_start(args, fmt);						\
+	spin_lock_irqsave(&vbg_log_lock, flags);			\
+									\
+	count = vscnprintf(vbg_log_buf, sizeof(vbg_log_buf), fmt, args);\
+	for (i = 0; i < count; i++)					\
+		outb(vbg_log_buf[i], VBG_DEBUG_PORT);			\
+									\
+	pr_func("%s", vbg_log_buf);					\
+									\
+	spin_unlock_irqrestore(&vbg_log_lock, flags);			\
+	va_end(args);							\
+}									\
+EXPORT_SYMBOL(name)
+
+VBG_LOG(vbg_info, pr_info);
+VBG_LOG(vbg_warn, pr_warn);
+VBG_LOG(vbg_err, pr_err);
+#if defined(DEBUG) && !defined(CONFIG_DYNAMIC_DEBUG)
+VBG_LOG(vbg_debug, pr_debug);
+#endif
+
+void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type)
+{
+	struct vmmdev_request_header *req;
+
+	req = kmalloc(len, GFP_KERNEL | __GFP_DMA32);
+	if (!req)
+		return NULL;
+
+	memset(req, 0xaa, len);
+
+	req->size = len;
+	req->version = VMMDEV_REQUEST_HEADER_VERSION;
+	req->request_type = req_type;
+	req->rc = VERR_GENERAL_FAILURE;
+	req->reserved1 = 0;
+	req->reserved2 = 0;
+
+	return req;
+}
+
+/* Note this function returns a VBox status code, not a negative errno!! */
+int vbg_req_perform(struct vbg_dev *gdev, void *req)
+{
+	unsigned long phys_req = virt_to_phys(req);
+
+	outl(phys_req, gdev->io_port + VMMDEV_PORT_OFF_REQUEST);
+	/*
+	 * The host changes the request as a result of the outl, make sure
+	 * the outl and any reads of the req happen in the correct order.
+	 */
+	mb();
+
+	return ((struct vmmdev_request_header *)req)->rc;
+}
+
+static bool hgcm_req_done(struct vbg_dev *gdev,
+			  struct vmmdev_hgcmreq_header *header)
+{
+	unsigned long flags;
+	bool done;
+
+	spin_lock_irqsave(&gdev->event_spinlock, flags);
+	done = header->flags & VMMDEV_HGCM_REQ_DONE;
+	spin_unlock_irqrestore(&gdev->event_spinlock, flags);
+
+	return done;
+}
+
+int vbg_hgcm_connect(struct vbg_dev *gdev,
+		     struct vmmdev_hgcm_service_location *loc,
+		     u32 *client_id, int *vbox_status)
+{
+	struct vmmdev_hgcm_connect *hgcm_connect = NULL;
+	int rc;
+
+	hgcm_connect = vbg_req_alloc(sizeof(*hgcm_connect),
+				     VMMDEVREQ_HGCM_CONNECT);
+	if (!hgcm_connect)
+		return -ENOMEM;
+
+	hgcm_connect->header.flags = 0;
+	memcpy(&hgcm_connect->loc, loc, sizeof(*loc));
+	hgcm_connect->client_id = 0;
+
+	rc = vbg_req_perform(gdev, hgcm_connect);
+
+	if (rc == VINF_HGCM_ASYNC_EXECUTE)
+		wait_event(gdev->hgcm_wq,
+			   hgcm_req_done(gdev, &hgcm_connect->header));
+
+	if (rc >= 0) {
+		*client_id = hgcm_connect->client_id;
+		rc = hgcm_connect->header.result;
+	}
+
+	kfree(hgcm_connect);
+
+	*vbox_status = rc;
+	return 0;
+}
+EXPORT_SYMBOL(vbg_hgcm_connect);
+
+int vbg_hgcm_disconnect(struct vbg_dev *gdev, u32 client_id, int *vbox_status)
+{
+	struct vmmdev_hgcm_disconnect *hgcm_disconnect = NULL;
+	int rc;
+
+	hgcm_disconnect = vbg_req_alloc(sizeof(*hgcm_disconnect),
+					VMMDEVREQ_HGCM_DISCONNECT);
+	if (!hgcm_disconnect)
+		return -ENOMEM;
+
+	hgcm_disconnect->header.flags = 0;
+	hgcm_disconnect->client_id = client_id;
+
+	rc = vbg_req_perform(gdev, hgcm_disconnect);
+
+	if (rc == VINF_HGCM_ASYNC_EXECUTE)
+		wait_event(gdev->hgcm_wq,
+			   hgcm_req_done(gdev, &hgcm_disconnect->header));
+
+	if (rc >= 0)
+		rc = hgcm_disconnect->header.result;
+
+	kfree(hgcm_disconnect);
+
+	*vbox_status = rc;
+	return 0;
+}
+EXPORT_SYMBOL(vbg_hgcm_disconnect);
+
+static u32 hgcm_call_buf_size_in_pages(void *buf, u32 len)
+{
+	u32 size = PAGE_ALIGN(len + ((unsigned long)buf & ~PAGE_MASK));
+
+	return size >> PAGE_SHIFT;
+}
+
+static void hgcm_call_add_pagelist_size(void *buf, u32 len, size_t *extra)
+{
+	u32 page_count;
+
+	page_count = hgcm_call_buf_size_in_pages(buf, len);
+	*extra += offsetof(struct vmmdev_hgcm_pagelist, pages[page_count]);
+}
+
+static int hgcm_call_preprocess_linaddr(
+	const struct vmmdev_hgcm_function_parameter *src_parm,
+	void **bounce_buf_ret, size_t *extra)
+{
+	void *buf, *bounce_buf;
+	bool copy_in;
+	u32 len;
+	int ret;
+
+	buf = (void *)src_parm->u.pointer.u.linear_addr;
+	len = src_parm->u.pointer.size;
+	copy_in = src_parm->type != VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT;
+
+	if (len > VBG_MAX_HGCM_USER_PARM)
+		return -E2BIG;
+
+	bounce_buf = kvmalloc(len, GFP_KERNEL);
+	if (!bounce_buf)
+		return -ENOMEM;
+
+	if (copy_in) {
+		ret = copy_from_user(bounce_buf, (void __user *)buf, len);
+		if (ret)
+			return -EFAULT;
+	} else {
+		memset(bounce_buf, 0, len);
+	}
+
+	*bounce_buf_ret = bounce_buf;
+	hgcm_call_add_pagelist_size(bounce_buf, len, extra);
+	return 0;
+}
+
+/**
+ * Preprocesses the HGCM call, validate parameters, alloc bounce buffers and
+ * figure out how much extra storage we need for page lists.
+ * Return: 0 or negative errno value.
+ * @src_parm:         Pointer to source function call parameters
+ * @parm_count:       Number of function call parameters.
+ * @bounce_bufs_ret:  Where to return the allocated bouncebuffer array
+ * @extra:            Where to return the extra request space needed for
+ *                    physical page lists.
+ */
+static int hgcm_call_preprocess(
+	const struct vmmdev_hgcm_function_parameter *src_parm,
+	u32 parm_count, void ***bounce_bufs_ret, size_t *extra)
+{
+	void *buf, **bounce_bufs = NULL;
+	u32 i, len;
+	int ret;
+
+	for (i = 0; i < parm_count; i++, src_parm++) {
+		switch (src_parm->type) {
+		case VMMDEV_HGCM_PARM_TYPE_32BIT:
+		case VMMDEV_HGCM_PARM_TYPE_64BIT:
+			break;
+
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
+			if (!bounce_bufs) {
+				bounce_bufs = kcalloc(parm_count,
+						      sizeof(void *),
+						      GFP_KERNEL);
+				if (!bounce_bufs)
+					return -ENOMEM;
+
+				*bounce_bufs_ret = bounce_bufs;
+			}
+
+			ret = hgcm_call_preprocess_linaddr(src_parm,
+							   &bounce_bufs[i],
+							   extra);
+			if (ret)
+				return ret;
+
+			break;
+
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT:
+			buf = (void *)src_parm->u.pointer.u.linear_addr;
+			len = src_parm->u.pointer.size;
+			if (WARN_ON(len > VBG_MAX_HGCM_KERNEL_PARM))
+				return -E2BIG;
+
+			hgcm_call_add_pagelist_size(buf, len, extra);
+			break;
+
+		default:
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+/**
+ * Translates linear address types to page list direction flags.
+ *
+ * Return: page list flags.
+ * @type:  The type.
+ */
+static u32 hgcm_call_linear_addr_type_to_pagelist_flags(
+	enum vmmdev_hgcm_function_parameter_type type)
+{
+	switch (type) {
+	default:
+		WARN_ON(1);
+	case VMMDEV_HGCM_PARM_TYPE_LINADDR:
+	case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL:
+		return VMMDEV_HGCM_F_PARM_DIRECTION_BOTH;
+
+	case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
+	case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN:
+		return VMMDEV_HGCM_F_PARM_DIRECTION_TO_HOST;
+
+	case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
+	case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT:
+		return VMMDEV_HGCM_F_PARM_DIRECTION_FROM_HOST;
+	}
+}
+
+static void hgcm_call_init_linaddr(struct vmmdev_hgcm_call *call,
+	struct vmmdev_hgcm_function_parameter *dst_parm, void *buf, u32 len,
+	enum vmmdev_hgcm_function_parameter_type type, u32 *off_extra)
+{
+	struct vmmdev_hgcm_pagelist *dst_pg_lst;
+	struct page *page;
+	bool is_vmalloc;
+	u32 i, page_count;
+
+	dst_parm->type = type;
+
+	if (len == 0) {
+		dst_parm->u.pointer.size = 0;
+		dst_parm->u.pointer.u.linear_addr = 0;
+		return;
+	}
+
+	dst_pg_lst = (void *)call + *off_extra;
+	page_count = hgcm_call_buf_size_in_pages(buf, len);
+	is_vmalloc = is_vmalloc_addr(buf);
+
+	dst_parm->type = VMMDEV_HGCM_PARM_TYPE_PAGELIST;
+	dst_parm->u.page_list.size = len;
+	dst_parm->u.page_list.offset = *off_extra;
+	dst_pg_lst->flags = hgcm_call_linear_addr_type_to_pagelist_flags(type);
+	dst_pg_lst->offset_first_page = (unsigned long)buf & ~PAGE_MASK;
+	dst_pg_lst->page_count = page_count;
+
+	for (i = 0; i < page_count; i++) {
+		if (is_vmalloc)
+			page = vmalloc_to_page(buf);
+		else
+			page = virt_to_page(buf);
+
+		dst_pg_lst->pages[i] = page_to_phys(page);
+		buf += PAGE_SIZE;
+	}
+
+	*off_extra += offsetof(struct vmmdev_hgcm_pagelist, pages[page_count]);
+}
+
+/**
+ * Initializes the call request that we're sending to the host.
+ * @call:            The call to initialize.
+ * @client_id:       The client ID of the caller.
+ * @function:        The function number of the function to call.
+ * @src_parm:        Pointer to source function call parameters.
+ * @parm_count:      Number of function call parameters.
+ * @bounce_bufs:     The bouncebuffer array.
+ */
+static void hgcm_call_init_call(
+	struct vmmdev_hgcm_call *call, u32 client_id, u32 function,
+	const struct vmmdev_hgcm_function_parameter *src_parm,
+	u32 parm_count, void **bounce_bufs)
+{
+	struct vmmdev_hgcm_function_parameter *dst_parm =
+		VMMDEV_HGCM_CALL_PARMS(call);
+	u32 i, off_extra = (uintptr_t)(dst_parm + parm_count) - (uintptr_t)call;
+	void *buf;
+
+	call->header.flags = 0;
+	call->header.result = VINF_SUCCESS;
+	call->client_id = client_id;
+	call->function = function;
+	call->parm_count = parm_count;
+
+	for (i = 0; i < parm_count; i++, src_parm++, dst_parm++) {
+		switch (src_parm->type) {
+		case VMMDEV_HGCM_PARM_TYPE_32BIT:
+		case VMMDEV_HGCM_PARM_TYPE_64BIT:
+			*dst_parm = *src_parm;
+			break;
+
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
+			hgcm_call_init_linaddr(call, dst_parm, bounce_bufs[i],
+					       src_parm->u.pointer.size,
+					       src_parm->type, &off_extra);
+			break;
+
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT:
+			buf = (void *)src_parm->u.pointer.u.linear_addr;
+			hgcm_call_init_linaddr(call, dst_parm, buf,
+					       src_parm->u.pointer.size,
+					       src_parm->type, &off_extra);
+			break;
+
+		default:
+			WARN_ON(1);
+			dst_parm->type = VMMDEV_HGCM_PARM_TYPE_INVALID;
+		}
+	}
+}
+
+/**
+ * Tries to cancel a pending HGCM call.
+ *
+ * Return: VBox status code
+ */
+static int hgcm_cancel_call(struct vbg_dev *gdev, struct vmmdev_hgcm_call *call)
+{
+	int rc;
+
+	/*
+	 * We use a pre-allocated request for cancellations, which is
+	 * protected by cancel_req_mutex. This means that all cancellations
+	 * get serialized, this should be fine since they should be rare.
+	 */
+	mutex_lock(&gdev->cancel_req_mutex);
+	gdev->cancel_req->phys_req_to_cancel = virt_to_phys(call);
+	rc = vbg_req_perform(gdev, gdev->cancel_req);
+	mutex_unlock(&gdev->cancel_req_mutex);
+
+	if (rc == VERR_NOT_IMPLEMENTED) {
+		call->header.flags |= VMMDEV_HGCM_REQ_CANCELLED;
+		call->header.header.request_type = VMMDEVREQ_HGCM_CANCEL;
+
+		rc = vbg_req_perform(gdev, call);
+		if (rc == VERR_INVALID_PARAMETER)
+			rc = VERR_NOT_FOUND;
+	}
+
+	if (rc >= 0)
+		call->header.flags |= VMMDEV_HGCM_REQ_CANCELLED;
+
+	return rc;
+}
+
+/**
+ * Performs the call and completion wait.
+ * Return: 0 or negative errno value.
+ * @gdev:        The VBoxGuest device extension.
+ * @call:        The call to execute.
+ * @timeout_ms:  Timeout in ms.
+ * @leak_it:     Where to return the leak it / free it, indicator.
+ *               Cancellation fun.
+ */
+static int vbg_hgcm_do_call(struct vbg_dev *gdev, struct vmmdev_hgcm_call *call,
+			    u32 timeout_ms, bool *leak_it)
+{
+	int rc, cancel_rc, ret;
+	long timeout;
+
+	*leak_it = false;
+
+	rc = vbg_req_perform(gdev, call);
+
+	/*
+	 * If the call failed, then pretend success. Upper layers will
+	 * interpret the result code in the packet.
+	 */
+	if (rc < 0) {
+		call->header.result = rc;
+		return 0;
+	}
+
+	if (rc != VINF_HGCM_ASYNC_EXECUTE)
+		return 0;
+
+	/* Host decided to process the request asynchronously, wait for it */
+	if (timeout_ms == U32_MAX)
+		timeout = MAX_SCHEDULE_TIMEOUT;
+	else
+		timeout = msecs_to_jiffies(timeout_ms);
+
+	timeout = wait_event_interruptible_timeout(
+					gdev->hgcm_wq,
+					hgcm_req_done(gdev, &call->header),
+					timeout);
+
+	/* timeout > 0 means hgcm_req_done has returned true, so success */
+	if (timeout > 0)
+		return 0;
+
+	if (timeout == 0)
+		ret = -ETIMEDOUT;
+	else
+		ret = -EINTR;
+
+	/* Cancel the request */
+	cancel_rc = hgcm_cancel_call(gdev, call);
+	if (cancel_rc >= 0)
+		return ret;
+
+	/*
+	 * Failed to cancel, this should mean that the cancel has lost the
+	 * race with normal completion, wait while the host completes it.
+	 */
+	if (cancel_rc == VERR_NOT_FOUND || cancel_rc == VERR_SEM_DESTROYED)
+		timeout = msecs_to_jiffies(500);
+	else
+		timeout = msecs_to_jiffies(2000);
+
+	timeout = wait_event_timeout(gdev->hgcm_wq,
+				     hgcm_req_done(gdev, &call->header),
+				     timeout);
+
+	if (WARN_ON(timeout == 0)) {
+		/* We really should never get here */
+		vbg_err("%s: Call timedout and cancellation failed, leaking the request\n",
+			__func__);
+		*leak_it = true;
+		return ret;
+	}
+
+	/* The call has completed normally after all */
+	return 0;
+}
+
+/**
+ * Copies the result of the call back to the caller info structure and user
+ * buffers.
+ * Return: 0 or negative errno value.
+ * @call:            HGCM call request.
+ * @dst_parm:        Pointer to function call parameters destination.
+ * @parm_count:      Number of function call parameters.
+ * @bounce_bufs:     The bouncebuffer array.
+ */
+static int hgcm_call_copy_back_result(
+	const struct vmmdev_hgcm_call *call,
+	struct vmmdev_hgcm_function_parameter *dst_parm,
+	u32 parm_count, void **bounce_bufs)
+{
+	const struct vmmdev_hgcm_function_parameter *src_parm =
+		VMMDEV_HGCM_CALL_PARMS(call);
+	void __user *p;
+	int ret;
+	u32 i;
+
+	/* Copy back parameters. */
+	for (i = 0; i < parm_count; i++, src_parm++, dst_parm++) {
+		switch (dst_parm->type) {
+		case VMMDEV_HGCM_PARM_TYPE_32BIT:
+		case VMMDEV_HGCM_PARM_TYPE_64BIT:
+			*dst_parm = *src_parm;
+			break;
+
+		case VMMDEV_HGCM_PARM_TYPE_PAGELIST:
+			dst_parm->u.page_list.size = src_parm->u.page_list.size;
+			break;
+
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT:
+			dst_parm->u.pointer.size = src_parm->u.pointer.size;
+			break;
+
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
+			dst_parm->u.pointer.size = src_parm->u.pointer.size;
+
+			p = (void __user *)dst_parm->u.pointer.u.linear_addr;
+			ret = copy_to_user(p, bounce_bufs[i],
+					   min(src_parm->u.pointer.size,
+					       dst_parm->u.pointer.size));
+			if (ret)
+				return -EFAULT;
+			break;
+
+		default:
+			WARN_ON(1);
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+int vbg_hgcm_call(struct vbg_dev *gdev, u32 client_id, u32 function,
+		  u32 timeout_ms, struct vmmdev_hgcm_function_parameter *parms,
+		  u32 parm_count, int *vbox_status)
+{
+	struct vmmdev_hgcm_call *call;
+	void **bounce_bufs = NULL;
+	bool leak_it;
+	size_t size;
+	int i, ret;
+
+	size = sizeof(struct vmmdev_hgcm_call) +
+		   parm_count * sizeof(struct vmmdev_hgcm_function_parameter);
+	/*
+	 * Validate and buffer the parameters for the call. This also increases
+	 * call_size with the amount of extra space needed for page lists.
+	 */
+	ret = hgcm_call_preprocess(parms, parm_count, &bounce_bufs, &size);
+	if (ret) {
+		/* Even on error bounce bufs may still have been allocated */
+		goto free_bounce_bufs;
+	}
+
+	call = vbg_req_alloc(size, VMMDEVREQ_HGCM_CALL);
+	if (!call) {
+		ret = -ENOMEM;
+		goto free_bounce_bufs;
+	}
+
+	hgcm_call_init_call(call, client_id, function, parms, parm_count,
+			    bounce_bufs);
+
+	ret = vbg_hgcm_do_call(gdev, call, timeout_ms, &leak_it);
+	if (ret == 0) {
+		*vbox_status = call->header.result;
+		ret = hgcm_call_copy_back_result(call, parms, parm_count,
+						 bounce_bufs);
+	}
+
+	if (!leak_it)
+		kfree(call);
+
+free_bounce_bufs:
+	if (bounce_bufs) {
+		for (i = 0; i < parm_count; i++)
+			kvfree(bounce_bufs[i]);
+		kfree(bounce_bufs);
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL(vbg_hgcm_call);
+
+#ifdef CONFIG_COMPAT
+int vbg_hgcm_call32(
+	struct vbg_dev *gdev, u32 client_id, u32 function, u32 timeout_ms,
+	struct vmmdev_hgcm_function_parameter32 *parm32, u32 parm_count,
+	int *vbox_status)
+{
+	struct vmmdev_hgcm_function_parameter *parm64 = NULL;
+	u32 i, size;
+	int ret = 0;
+
+	/* KISS allocate a temporary request and convert the parameters. */
+	size = parm_count * sizeof(struct vmmdev_hgcm_function_parameter);
+	parm64 = kzalloc(size, GFP_KERNEL);
+	if (!parm64)
+		return -ENOMEM;
+
+	for (i = 0; i < parm_count; i++) {
+		switch (parm32[i].type) {
+		case VMMDEV_HGCM_PARM_TYPE_32BIT:
+			parm64[i].type = VMMDEV_HGCM_PARM_TYPE_32BIT;
+			parm64[i].u.value32 = parm32[i].u.value32;
+			break;
+
+		case VMMDEV_HGCM_PARM_TYPE_64BIT:
+			parm64[i].type = VMMDEV_HGCM_PARM_TYPE_64BIT;
+			parm64[i].u.value64 = parm32[i].u.value64;
+			break;
+
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
+			parm64[i].type = parm32[i].type;
+			parm64[i].u.pointer.size = parm32[i].u.pointer.size;
+			parm64[i].u.pointer.u.linear_addr =
+			    parm32[i].u.pointer.u.linear_addr;
+			break;
+
+		default:
+			ret = -EINVAL;
+		}
+		if (ret < 0)
+			goto out_free;
+	}
+
+	ret = vbg_hgcm_call(gdev, client_id, function, timeout_ms,
+			    parm64, parm_count, vbox_status);
+	if (ret < 0)
+		goto out_free;
+
+	/* Copy back. */
+	for (i = 0; i < parm_count; i++, parm32++, parm64++) {
+		switch (parm64[i].type) {
+		case VMMDEV_HGCM_PARM_TYPE_32BIT:
+			parm32[i].u.value32 = parm64[i].u.value32;
+			break;
+
+		case VMMDEV_HGCM_PARM_TYPE_64BIT:
+			parm32[i].u.value64 = parm64[i].u.value64;
+			break;
+
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR:
+		case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
+			parm32[i].u.pointer.size = parm64[i].u.pointer.size;
+			break;
+
+		default:
+			WARN_ON(1);
+			ret = -EINVAL;
+		}
+	}
+
+out_free:
+	kfree(parm64);
+	return ret;
+}
+#endif
+
+static const int vbg_status_code_to_errno_table[] = {
+	[-VERR_ACCESS_DENIED]                            = -EPERM,
+	[-VERR_FILE_NOT_FOUND]                           = -ENOENT,
+	[-VERR_PROCESS_NOT_FOUND]                        = -ESRCH,
+	[-VERR_INTERRUPTED]                              = -EINTR,
+	[-VERR_DEV_IO_ERROR]                             = -EIO,
+	[-VERR_TOO_MUCH_DATA]                            = -E2BIG,
+	[-VERR_BAD_EXE_FORMAT]                           = -ENOEXEC,
+	[-VERR_INVALID_HANDLE]                           = -EBADF,
+	[-VERR_TRY_AGAIN]                                = -EAGAIN,
+	[-VERR_NO_MEMORY]                                = -ENOMEM,
+	[-VERR_INVALID_POINTER]                          = -EFAULT,
+	[-VERR_RESOURCE_BUSY]                            = -EBUSY,
+	[-VERR_ALREADY_EXISTS]                           = -EEXIST,
+	[-VERR_NOT_SAME_DEVICE]                          = -EXDEV,
+	[-VERR_NOT_A_DIRECTORY]                          = -ENOTDIR,
+	[-VERR_PATH_NOT_FOUND]                           = -ENOTDIR,
+	[-VERR_IS_A_DIRECTORY]                           = -EISDIR,
+	[-VERR_INVALID_PARAMETER]                        = -EINVAL,
+	[-VERR_TOO_MANY_OPEN_FILES]                      = -ENFILE,
+	[-VERR_INVALID_FUNCTION]                         = -ENOTTY,
+	[-VERR_SHARING_VIOLATION]                        = -ETXTBSY,
+	[-VERR_FILE_TOO_BIG]                             = -EFBIG,
+	[-VERR_DISK_FULL]                                = -ENOSPC,
+	[-VERR_SEEK_ON_DEVICE]                           = -ESPIPE,
+	[-VERR_WRITE_PROTECT]                            = -EROFS,
+	[-VERR_BROKEN_PIPE]                              = -EPIPE,
+	[-VERR_DEADLOCK]                                 = -EDEADLK,
+	[-VERR_FILENAME_TOO_LONG]                        = -ENAMETOOLONG,
+	[-VERR_FILE_LOCK_FAILED]                         = -ENOLCK,
+	[-VERR_NOT_IMPLEMENTED]                          = -ENOSYS,
+	[-VERR_NOT_SUPPORTED]                            = -ENOSYS,
+	[-VERR_DIR_NOT_EMPTY]                            = -ENOTEMPTY,
+	[-VERR_TOO_MANY_SYMLINKS]                        = -ELOOP,
+	[-VERR_NO_DATA]                                  = -ENODATA,
+	[-VERR_NET_NO_NETWORK]                           = -ENONET,
+	[-VERR_NET_NOT_UNIQUE_NAME]                      = -ENOTUNIQ,
+	[-VERR_NO_TRANSLATION]                           = -EILSEQ,
+	[-VERR_NET_NOT_SOCKET]                           = -ENOTSOCK,
+	[-VERR_NET_DEST_ADDRESS_REQUIRED]                = -EDESTADDRREQ,
+	[-VERR_NET_MSG_SIZE]                             = -EMSGSIZE,
+	[-VERR_NET_PROTOCOL_TYPE]                        = -EPROTOTYPE,
+	[-VERR_NET_PROTOCOL_NOT_AVAILABLE]               = -ENOPROTOOPT,
+	[-VERR_NET_PROTOCOL_NOT_SUPPORTED]               = -EPROTONOSUPPORT,
+	[-VERR_NET_SOCKET_TYPE_NOT_SUPPORTED]            = -ESOCKTNOSUPPORT,
+	[-VERR_NET_OPERATION_NOT_SUPPORTED]              = -EOPNOTSUPP,
+	[-VERR_NET_PROTOCOL_FAMILY_NOT_SUPPORTED]        = -EPFNOSUPPORT,
+	[-VERR_NET_ADDRESS_FAMILY_NOT_SUPPORTED]         = -EAFNOSUPPORT,
+	[-VERR_NET_ADDRESS_IN_USE]                       = -EADDRINUSE,
+	[-VERR_NET_ADDRESS_NOT_AVAILABLE]                = -EADDRNOTAVAIL,
+	[-VERR_NET_DOWN]                                 = -ENETDOWN,
+	[-VERR_NET_UNREACHABLE]                          = -ENETUNREACH,
+	[-VERR_NET_CONNECTION_RESET]                     = -ENETRESET,
+	[-VERR_NET_CONNECTION_ABORTED]                   = -ECONNABORTED,
+	[-VERR_NET_CONNECTION_RESET_BY_PEER]             = -ECONNRESET,
+	[-VERR_NET_NO_BUFFER_SPACE]                      = -ENOBUFS,
+	[-VERR_NET_ALREADY_CONNECTED]                    = -EISCONN,
+	[-VERR_NET_NOT_CONNECTED]                        = -ENOTCONN,
+	[-VERR_NET_SHUTDOWN]                             = -ESHUTDOWN,
+	[-VERR_NET_TOO_MANY_REFERENCES]                  = -ETOOMANYREFS,
+	[-VERR_TIMEOUT]                                  = -ETIMEDOUT,
+	[-VERR_NET_CONNECTION_REFUSED]                   = -ECONNREFUSED,
+	[-VERR_NET_HOST_DOWN]                            = -EHOSTDOWN,
+	[-VERR_NET_HOST_UNREACHABLE]                     = -EHOSTUNREACH,
+	[-VERR_NET_ALREADY_IN_PROGRESS]                  = -EALREADY,
+	[-VERR_NET_IN_PROGRESS]                          = -EINPROGRESS,
+	[-VERR_MEDIA_NOT_PRESENT]                        = -ENOMEDIUM,
+	[-VERR_MEDIA_NOT_RECOGNIZED]                     = -EMEDIUMTYPE,
+};
+
+int vbg_status_code_to_errno(int rc)
+{
+	if (rc >= 0)
+		return 0;
+
+	rc = -rc;
+	if (rc >= ARRAY_SIZE(vbg_status_code_to_errno_table) ||
+	    vbg_status_code_to_errno_table[rc] == 0) {
+		vbg_warn("%s: Unhandled err %d\n", __func__, -rc);
+		return -EPROTO;
+	}
+
+	return vbg_status_code_to_errno_table[rc];
+}
+EXPORT_SYMBOL(vbg_status_code_to_errno);
diff --git a/drivers/virt/vboxguest/vmmdev.h b/drivers/virt/vboxguest/vmmdev.h
new file mode 100644
index 000000000000..0802a669b72b
--- /dev/null
+++ b/drivers/virt/vboxguest/vmmdev.h
@@ -0,0 +1,460 @@
+/*
+ * Virtual Device for Guest <-> VMM/Host communication interface
+ *
+ * Copyright (C) 2006-2016 Oracle Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, in which case the provisions of the CDDL are applicable
+ * instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+#ifndef __VBOX_VMMDEV_H__
+#define __VBOX_VMMDEV_H__
+
+#include <asm/bitsperlong.h>
+#include <linux/sizes.h>
+#include <linux/types.h>
+#include <linux/vbox_vmmdev_types.h>
+
+/* Port for generic request interface (relative offset). */
+#define VMMDEV_PORT_OFF_REQUEST                             0
+
+/** Layout of VMMDEV RAM region that contains information for guest. */
+struct vmmdev_memory {
+	/** The size of this structure. */
+	u32 size;
+	/** The structure version. (VMMDEV_MEMORY_VERSION) */
+	u32 version;
+
+	union {
+		struct {
+			/** Flag telling that VMMDev has events pending. */
+			u8 have_events;
+			/** Explicit padding, MBZ. */
+			u8 padding[3];
+		} V1_04;
+
+		struct {
+			/** Pending events flags, set by host. */
+			u32 host_events;
+			/** Mask of events the guest wants, set by guest. */
+			u32 guest_event_mask;
+		} V1_03;
+	} V;
+
+	/* struct vbva_memory, not used */
+};
+VMMDEV_ASSERT_SIZE(vmmdev_memory, 8 + 8);
+
+/** Version of vmmdev_memory structure (vmmdev_memory::version). */
+#define VMMDEV_MEMORY_VERSION   (1)
+
+/* Host mouse capabilities has been changed. */
+#define VMMDEV_EVENT_MOUSE_CAPABILITIES_CHANGED             BIT(0)
+/* HGCM event. */
+#define VMMDEV_EVENT_HGCM                                   BIT(1)
+/* A display change request has been issued. */
+#define VMMDEV_EVENT_DISPLAY_CHANGE_REQUEST                 BIT(2)
+/* Credentials are available for judgement. */
+#define VMMDEV_EVENT_JUDGE_CREDENTIALS                      BIT(3)
+/* The guest has been restored. */
+#define VMMDEV_EVENT_RESTORED                               BIT(4)
+/* Seamless mode state changed. */
+#define VMMDEV_EVENT_SEAMLESS_MODE_CHANGE_REQUEST           BIT(5)
+/* Memory balloon size changed. */
+#define VMMDEV_EVENT_BALLOON_CHANGE_REQUEST                 BIT(6)
+/* Statistics interval changed. */
+#define VMMDEV_EVENT_STATISTICS_INTERVAL_CHANGE_REQUEST     BIT(7)
+/* VRDP status changed. */
+#define VMMDEV_EVENT_VRDP                                   BIT(8)
+/* New mouse position data available. */
+#define VMMDEV_EVENT_MOUSE_POSITION_CHANGED                 BIT(9)
+/* CPU hotplug event occurred. */
+#define VMMDEV_EVENT_CPU_HOTPLUG                            BIT(10)
+/* The mask of valid events, for sanity checking. */
+#define VMMDEV_EVENT_VALID_EVENT_MASK                       0x000007ffU
+
+/*
+ * Additions are allowed to work only if additions_major == vmmdev_current &&
+ * additions_minor <= vmmdev_current. Additions version is reported to host
+ * (VMMDev) by VMMDEVREQ_REPORT_GUEST_INFO.
+ */
+#define VMMDEV_VERSION                      0x00010004
+#define VMMDEV_VERSION_MAJOR                (VMMDEV_VERSION >> 16)
+#define VMMDEV_VERSION_MINOR                (VMMDEV_VERSION & 0xffff)
+
+/* Maximum request packet size. */
+#define VMMDEV_MAX_VMMDEVREQ_SIZE           1048576
+
+/* Version of vmmdev_request_header structure. */
+#define VMMDEV_REQUEST_HEADER_VERSION       0x10001
+
+/** struct vmmdev_request_header - Generic VMMDev request header. */
+struct vmmdev_request_header {
+	/** IN: Size of the structure in bytes (including body). */
+	u32 size;
+	/** IN: Version of the structure.  */
+	u32 version;
+	/** IN: Type of the request. */
+	enum vmmdev_request_type request_type;
+	/** OUT: Return code. */
+	s32 rc;
+	/** Reserved field no.1. MBZ. */
+	u32 reserved1;
+	/** Reserved field no.2. MBZ. */
+	u32 reserved2;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_request_header, 24);
+
+/**
+ * struct vmmdev_mouse_status - Mouse status request structure.
+ *
+ * Used by VMMDEVREQ_GET_MOUSE_STATUS and VMMDEVREQ_SET_MOUSE_STATUS.
+ */
+struct vmmdev_mouse_status {
+	/** header */
+	struct vmmdev_request_header header;
+	/** Mouse feature mask. See VMMDEV_MOUSE_*. */
+	u32 mouse_features;
+	/** Mouse x position. */
+	s32 pointer_pos_x;
+	/** Mouse y position. */
+	s32 pointer_pos_y;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_mouse_status, 24 + 12);
+
+/* The guest can (== wants to) handle absolute coordinates.  */
+#define VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE                     BIT(0)
+/*
+ * The host can (== wants to) send absolute coordinates.
+ * (Input not captured.)
+ */
+#define VMMDEV_MOUSE_HOST_WANTS_ABSOLUTE                    BIT(1)
+/*
+ * The guest can *NOT* switch to software cursor and therefore depends on the
+ * host cursor.
+ *
+ * When guest additions are installed and the host has promised to display the
+ * cursor itself, the guest installs a hardware mouse driver. Don't ask the
+ * guest to switch to a software cursor then.
+ */
+#define VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR                BIT(2)
+/* The host does NOT provide support for drawing the cursor itself. */
+#define VMMDEV_MOUSE_HOST_CANNOT_HWPOINTER                  BIT(3)
+/* The guest can read VMMDev events to find out about pointer movement */
+#define VMMDEV_MOUSE_NEW_PROTOCOL                           BIT(4)
+/*
+ * If the guest changes the status of the VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR
+ * bit, the host will honour this.
+ */
+#define VMMDEV_MOUSE_HOST_RECHECKS_NEEDS_HOST_CURSOR        BIT(5)
+/*
+ * The host supplies an absolute pointing device.  The Guest Additions may
+ * wish to use this to decide whether to install their own driver.
+ */
+#define VMMDEV_MOUSE_HOST_HAS_ABS_DEV                       BIT(6)
+
+/* The minimum value our pointing device can return. */
+#define VMMDEV_MOUSE_RANGE_MIN 0
+/* The maximum value our pointing device can return. */
+#define VMMDEV_MOUSE_RANGE_MAX 0xFFFF
+
+/**
+ * struct vmmdev_host_version - VirtualBox host version request structure.
+ *
+ * VBG uses this to detect the precense of new features in the interface.
+ */
+struct vmmdev_host_version {
+	/** Header. */
+	struct vmmdev_request_header header;
+	/** Major version. */
+	u16 major;
+	/** Minor version. */
+	u16 minor;
+	/** Build number. */
+	u32 build;
+	/** SVN revision. */
+	u32 revision;
+	/** Feature mask. */
+	u32 features;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_host_version, 24 + 16);
+
+/* Physical page lists are supported by HGCM. */
+#define VMMDEV_HVF_HGCM_PHYS_PAGE_LIST  BIT(0)
+
+/**
+ * struct vmmdev_mask - Structure to set / clear bits in a mask used for
+ * VMMDEVREQ_SET_GUEST_CAPABILITIES and VMMDEVREQ_CTL_GUEST_FILTER_MASK.
+ */
+struct vmmdev_mask {
+	/** Header. */
+	struct vmmdev_request_header header;
+	/** Mask of bits to be set. */
+	u32 or_mask;
+	/** Mask of bits to be cleared. */
+	u32 not_mask;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_mask, 24 + 8);
+
+/* The guest supports seamless display rendering. */
+#define VMMDEV_GUEST_SUPPORTS_SEAMLESS                      BIT(0)
+/* The guest supports mapping guest to host windows. */
+#define VMMDEV_GUEST_SUPPORTS_GUEST_HOST_WINDOW_MAPPING     BIT(1)
+/*
+ * The guest graphical additions are active.
+ * Used for fast activation and deactivation of certain graphical operations
+ * (e.g. resizing & seamless). The legacy VMMDEVREQ_REPORT_GUEST_CAPABILITIES
+ * request sets this automatically, but VMMDEVREQ_SET_GUEST_CAPABILITIES does
+ * not.
+ */
+#define VMMDEV_GUEST_SUPPORTS_GRAPHICS                      BIT(2)
+
+/** struct vmmdev_hypervisorinfo - Hypervisor info structure. */
+struct vmmdev_hypervisorinfo {
+	/** Header. */
+	struct vmmdev_request_header header;
+	/**
+	 * Guest virtual address of proposed hypervisor start.
+	 * Not used by VMMDEVREQ_GET_HYPERVISOR_INFO.
+	 */
+	u32 hypervisor_start;
+	/** Hypervisor size in bytes. */
+	u32 hypervisor_size;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_hypervisorinfo, 24 + 8);
+
+/** struct vmmdev_events - Pending events structure. */
+struct vmmdev_events {
+	/** Header. */
+	struct vmmdev_request_header header;
+	/** OUT: Pending event mask. */
+	u32 events;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_events, 24 + 4);
+
+#define VMMDEV_OSTYPE_LINUX26		0x53000
+#define VMMDEV_OSTYPE_X64		BIT(8)
+
+/** struct vmmdev_guestinfo - Guest information report. */
+struct vmmdev_guest_info {
+	/** Header. */
+	struct vmmdev_request_header header;
+	/**
+	 * The VMMDev interface version expected by additions.
+	 * *Deprecated*, do not use anymore! Will be removed.
+	 */
+	u32 interface_version;
+	/** Guest OS type. */
+	u32 os_type;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_guest_info, 24 + 8);
+
+/** struct vmmdev_guestinfo2 - Guest information report, version 2. */
+struct vmmdev_guest_info2 {
+	/** Header. */
+	struct vmmdev_request_header header;
+	/** Major version. */
+	u16 additions_major;
+	/** Minor version. */
+	u16 additions_minor;
+	/** Build number. */
+	u32 additions_build;
+	/** SVN revision. */
+	u32 additions_revision;
+	/** Feature mask, currently unused. */
+	u32 additions_features;
+	/**
+	 * The intentional meaning of this field was:
+	 * Some additional information, for example 'Beta 1' or something like
+	 * that.
+	 *
+	 * The way it was implemented was implemented: VBG_VERSION_STRING.
+	 *
+	 * This means the first three members are duplicated in this field (if
+	 * the guest build config is sane). So, the user must check this and
+	 * chop it off before usage. There is, because of the Main code's blind
+	 * trust in the field's content, no way back.
+	 */
+	char name[128];
+};
+VMMDEV_ASSERT_SIZE(vmmdev_guest_info2, 24 + 144);
+
+enum vmmdev_guest_facility_type {
+	VBOXGUEST_FACILITY_TYPE_UNKNOWN          = 0,
+	VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER = 20,
+	/* VBoxGINA / VBoxCredProv / pam_vbox. */
+	VBOXGUEST_FACILITY_TYPE_AUTO_LOGON       = 90,
+	VBOXGUEST_FACILITY_TYPE_VBOX_SERVICE     = 100,
+	/* VBoxTray (Windows), VBoxClient (Linux, Unix). */
+	VBOXGUEST_FACILITY_TYPE_VBOX_TRAY_CLIENT = 101,
+	VBOXGUEST_FACILITY_TYPE_SEAMLESS         = 1000,
+	VBOXGUEST_FACILITY_TYPE_GRAPHICS         = 1100,
+	VBOXGUEST_FACILITY_TYPE_ALL              = 0x7ffffffe,
+	/* Ensure the enum is a 32 bit data-type */
+	VBOXGUEST_FACILITY_TYPE_SIZEHACK         = 0x7fffffff
+};
+
+enum vmmdev_guest_facility_status {
+	VBOXGUEST_FACILITY_STATUS_INACTIVE    = 0,
+	VBOXGUEST_FACILITY_STATUS_PAUSED      = 1,
+	VBOXGUEST_FACILITY_STATUS_PRE_INIT    = 20,
+	VBOXGUEST_FACILITY_STATUS_INIT        = 30,
+	VBOXGUEST_FACILITY_STATUS_ACTIVE      = 50,
+	VBOXGUEST_FACILITY_STATUS_TERMINATING = 100,
+	VBOXGUEST_FACILITY_STATUS_TERMINATED  = 101,
+	VBOXGUEST_FACILITY_STATUS_FAILED      = 800,
+	VBOXGUEST_FACILITY_STATUS_UNKNOWN     = 999,
+	/* Ensure the enum is a 32 bit data-type */
+	VBOXGUEST_FACILITY_STATUS_SIZEHACK    = 0x7fffffff
+};
+
+/** struct vmmdev_guest_status - Guest Additions status structure. */
+struct vmmdev_guest_status {
+	/** Header. */
+	struct vmmdev_request_header header;
+	/** Facility the status is indicated for. */
+	enum vmmdev_guest_facility_type facility;
+	/** Current guest status. */
+	enum vmmdev_guest_facility_status status;
+	/** Flags, not used at the moment. */
+	u32 flags;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_guest_status, 24 + 12);
+
+#define VMMDEV_MEMORY_BALLOON_CHUNK_SIZE             (1048576)
+#define VMMDEV_MEMORY_BALLOON_CHUNK_PAGES            (1048576 / 4096)
+
+/** struct vmmdev_memballoon_info - Memory-balloon info structure. */
+struct vmmdev_memballoon_info {
+	/** Header. */
+	struct vmmdev_request_header header;
+	/** Balloon size in megabytes. */
+	u32 balloon_chunks;
+	/** Guest ram size in megabytes. */
+	u32 phys_mem_chunks;
+	/**
+	 * Setting this to VMMDEV_EVENT_BALLOON_CHANGE_REQUEST indicates that
+	 * the request is a response to that event.
+	 * (Don't confuse this with VMMDEVREQ_ACKNOWLEDGE_EVENTS.)
+	 */
+	u32 event_ack;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_memballoon_info, 24 + 12);
+
+/** struct vmmdev_memballoon_change - Change the size of the balloon. */
+struct vmmdev_memballoon_change {
+	/** Header. */
+	struct vmmdev_request_header header;
+	/** The number of pages in the array. */
+	u32 pages;
+	/** true = inflate, false = deflate.  */
+	u32 inflate;
+	/** Physical address (u64) of each page. */
+	u64 phys_page[VMMDEV_MEMORY_BALLOON_CHUNK_PAGES];
+};
+
+/** struct vmmdev_write_core_dump - Write Core Dump request data. */
+struct vmmdev_write_core_dump {
+	/** Header. */
+	struct vmmdev_request_header header;
+	/** Flags (reserved, MBZ). */
+	u32 flags;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_write_core_dump, 24 + 4);
+
+/** struct vmmdev_heartbeat - Heart beat check state structure. */
+struct vmmdev_heartbeat {
+	/** Header. */
+	struct vmmdev_request_header header;
+	/** OUT: Guest heartbeat interval in nanosec. */
+	u64 interval_ns;
+	/** Heartbeat check flag. */
+	u8 enabled;
+	/** Explicit padding, MBZ. */
+	u8 padding[3];
+} __packed;
+VMMDEV_ASSERT_SIZE(vmmdev_heartbeat, 24 + 12);
+
+#define VMMDEV_HGCM_REQ_DONE      BIT(0)
+#define VMMDEV_HGCM_REQ_CANCELLED BIT(1)
+
+/** struct vmmdev_hgcmreq_header - vmmdev HGCM requests header. */
+struct vmmdev_hgcmreq_header {
+	/** Request header. */
+	struct vmmdev_request_header header;
+
+	/** HGCM flags. */
+	u32 flags;
+
+	/** Result code. */
+	s32 result;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_hgcmreq_header, 24 + 8);
+
+/** struct vmmdev_hgcm_connect - HGCM connect request structure. */
+struct vmmdev_hgcm_connect {
+	/** HGCM request header. */
+	struct vmmdev_hgcmreq_header header;
+
+	/** IN: Description of service to connect to. */
+	struct vmmdev_hgcm_service_location loc;
+
+	/** OUT: Client identifier assigned by local instance of HGCM. */
+	u32 client_id;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_hgcm_connect, 32 + 132 + 4);
+
+/** struct vmmdev_hgcm_disconnect - HGCM disconnect request structure. */
+struct vmmdev_hgcm_disconnect {
+	/** HGCM request header. */
+	struct vmmdev_hgcmreq_header header;
+
+	/** IN: Client identifier. */
+	u32 client_id;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_hgcm_disconnect, 32 + 4);
+
+#define VMMDEV_HGCM_MAX_PARMS 32
+
+/** struct vmmdev_hgcm_call - HGCM call request structure. */
+struct vmmdev_hgcm_call {
+	/* request header */
+	struct vmmdev_hgcmreq_header header;
+
+	/** IN: Client identifier. */
+	u32 client_id;
+	/** IN: Service function number. */
+	u32 function;
+	/** IN: Number of parameters. */
+	u32 parm_count;
+	/** Parameters follow in form: HGCMFunctionParameter32|64 parms[X]; */
+};
+VMMDEV_ASSERT_SIZE(vmmdev_hgcm_call, 32 + 12);
+
+/**
+ * struct vmmdev_hgcm_cancel2 - HGCM cancel request structure, version 2.
+ *
+ * After the request header.rc will be:
+ *
+ * VINF_SUCCESS when cancelled.
+ * VERR_NOT_FOUND if the specified request cannot be found.
+ * VERR_INVALID_PARAMETER if the address is invalid valid.
+ */
+struct vmmdev_hgcm_cancel2 {
+	/** Header. */
+	struct vmmdev_request_header header;
+	/** The physical address of the request to cancel. */
+	u32 phys_req_to_cancel;
+};
+VMMDEV_ASSERT_SIZE(vmmdev_hgcm_cancel2, 24 + 4);
+
+#endif
diff --git a/include/linux/vbox_utils.h b/include/linux/vbox_utils.h
new file mode 100644
index 000000000000..a0a2b84c8c2e
--- /dev/null
+++ b/include/linux/vbox_utils.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2006-2016 Oracle Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, in which case the provisions of the CDDL are applicable
+ * instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+#ifndef __VBOX_UTILS_H__
+#define __VBOX_UTILS_H__
+
+#include <linux/printk.h>
+#include <linux/vbox_vmmdev_types.h>
+
+struct vbg_dev;
+
+/**
+ * vboxguest logging functions, these log both to the backdoor and call
+ * the equivalent kernel pr_foo function.
+ */
+__printf(1, 2) void vbg_info(const char *fmt, ...);
+__printf(1, 2) void vbg_warn(const char *fmt, ...);
+__printf(1, 2) void vbg_err(const char *fmt, ...);
+
+/* Only use backdoor logging for non-dynamic debug builds */
+#if defined(DEBUG) && !defined(CONFIG_DYNAMIC_DEBUG)
+__printf(1, 2) void vbg_debug(const char *fmt, ...);
+#else
+#define vbg_debug pr_debug
+#endif
+
+/**
+ * Allocate memory for generic request and initialize the request header.
+ *
+ * Return: the allocated memory
+ * @len:		Size of memory block required for the request.
+ * @req_type:		The generic request type.
+ */
+void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type);
+
+/**
+ * Perform a generic request.
+ *
+ * Return: VBox status code
+ * @gdev:		The Guest extension device.
+ * @req:		Pointer to the request structure.
+ */
+int vbg_req_perform(struct vbg_dev *gdev, void *req);
+
+int vbg_hgcm_connect(struct vbg_dev *gdev,
+		     struct vmmdev_hgcm_service_location *loc,
+		     u32 *client_id, int *vbox_status);
+
+int vbg_hgcm_disconnect(struct vbg_dev *gdev, u32 client_id, int *vbox_status);
+
+int vbg_hgcm_call(struct vbg_dev *gdev, u32 client_id, u32 function,
+		  u32 timeout_ms, struct vmmdev_hgcm_function_parameter *parms,
+		  u32 parm_count, int *vbox_status);
+
+int vbg_hgcm_call32(
+	struct vbg_dev *gdev, u32 client_id, u32 function, u32 timeout_ms,
+	struct vmmdev_hgcm_function_parameter32 *parm32, u32 parm_count,
+	int *vbox_status);
+
+/**
+ * Convert a VirtualBox status code to a standard Linux kernel return value.
+ * Return: 0 or negative errno value.
+ * @rc:			VirtualBox status code to convert.
+ */
+int vbg_status_code_to_errno(int rc);
+
+/**
+ * Helper for the vboxsf driver to get a reference to the guest device.
+ * Return: a pointer to the gdev; or a ERR_PTR value on error.
+ */
+struct vbg_dev *vbg_get_gdev(void);
+
+/**
+ * Helper for the vboxsf driver to put a guest device reference.
+ * @gdev:		Reference returned by vbg_get_gdev to put.
+ */
+void vbg_put_gdev(struct vbg_dev *gdev);
+
+#endif
-- 
2.14.3

^ permalink raw reply related	[flat|nested] 14+ messages in thread

* [PATCH resend v2 3/3] virt: Add vboxguest driver for Virtual Box Guest integration
  2017-11-26 15:12 [PATCH resend v2 0/3] virt: Add vboxguest driver for Virtual Box Guest integration Hans de Goede
  2017-11-26 15:12 ` [PATCH resend v2 1/3] virt: Add vboxguest driver for Virtual Box Guest integration UAPI Hans de Goede
  2017-11-26 15:12 ` [PATCH resend v2 2/3] virt: Add vboxguest VMMDEV communication code Hans de Goede
@ 2017-11-26 15:12 ` Hans de Goede
  2017-11-27 19:46   ` Larry Finger
  2017-11-27 19:44 ` [PATCH resend v2 0/3] " Larry Finger
  3 siblings, 1 reply; 14+ messages in thread
From: Hans de Goede @ 2017-11-26 15:12 UTC (permalink / raw)
  To: Arnd Bergmann, Greg Kroah-Hartman
  Cc: Hans de Goede, Michael Thayer, Knut St . Osmundsen, Larry Finger,
	Christoph Hellwig, linux-kernel

This commit adds a driver for the Virtual Box Guest PCI device used in
Virtual Box virtual machines. Enabling this driver will add support for
Virtual Box Guest integration features such as copy-and-paste, seamless
mode and OpenGL pass-through.

This driver also offers vboxguest IPC functionality which is needed
for the vboxfs driver which offers folder sharing support.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
---
Changes in v2:
-Change all uapi headers to kernel coding style: Drop struct and enum typedefs
 make type and struct-member names all lowercase, enum values all uppercase.
-Remove unused struct type declarations from some headers (shaving of another
 1000 lines)
-Remove or fixup doxygen style comments
-Get rid of CHECK macros, use a function taking in_ and out_size args instead
-Some other small codyingstyle fixes
-Split into multiple patches
---
 drivers/virt/Kconfig                       |    1 +
 drivers/virt/Makefile                      |    1 +
 drivers/virt/vboxguest/Kconfig             |   16 +
 drivers/virt/vboxguest/Makefile            |    3 +
 drivers/virt/vboxguest/vboxguest_core.c    | 1577 ++++++++++++++++++++++++++++
 drivers/virt/vboxguest/vboxguest_core.h    |  187 ++++
 drivers/virt/vboxguest/vboxguest_linux.c   |  469 +++++++++
 drivers/virt/vboxguest/vboxguest_version.h |   18 +
 8 files changed, 2272 insertions(+)
 create mode 100644 drivers/virt/vboxguest/Kconfig
 create mode 100644 drivers/virt/vboxguest/Makefile
 create mode 100644 drivers/virt/vboxguest/vboxguest_core.c
 create mode 100644 drivers/virt/vboxguest/vboxguest_core.h
 create mode 100644 drivers/virt/vboxguest/vboxguest_linux.c
 create mode 100644 drivers/virt/vboxguest/vboxguest_version.h

diff --git a/drivers/virt/Kconfig b/drivers/virt/Kconfig
index 99ebdde590f8..8d9cdfbd6bcc 100644
--- a/drivers/virt/Kconfig
+++ b/drivers/virt/Kconfig
@@ -30,4 +30,5 @@ config FSL_HV_MANAGER
           4) A kernel interface for receiving callbacks when a managed
 	     partition shuts down.
 
+source "drivers/virt/vboxguest/Kconfig"
 endif
diff --git a/drivers/virt/Makefile b/drivers/virt/Makefile
index c47f04dd343b..d3f7b2540890 100644
--- a/drivers/virt/Makefile
+++ b/drivers/virt/Makefile
@@ -3,3 +3,4 @@
 #
 
 obj-$(CONFIG_FSL_HV_MANAGER)	+= fsl_hypervisor.o
+obj-y				+= vboxguest/
diff --git a/drivers/virt/vboxguest/Kconfig b/drivers/virt/vboxguest/Kconfig
new file mode 100644
index 000000000000..e88ee46c31d4
--- /dev/null
+++ b/drivers/virt/vboxguest/Kconfig
@@ -0,0 +1,16 @@
+config VBOXGUEST
+	tristate "Virtual Box Guest integration support"
+	depends on X86 && PCI && INPUT
+	help
+	  This is a driver for the Virtual Box Guest PCI device used in
+	  Virtual Box virtual machines. Enabling this driver will add
+	  support for Virtual Box Guest integration features such as
+	  copy-and-paste, seamless mode and OpenGL pass-through.
+
+	  This driver also offers vboxguest IPC functionality which is needed
+	  for the vboxfs driver which offers folder sharing support.
+
+	  Although it is possible to build this module in, it is advised
+	  to build this driver as a module, so that it can be updated
+	  independently of the kernel. Select M to build this driver as a
+	  module.
diff --git a/drivers/virt/vboxguest/Makefile b/drivers/virt/vboxguest/Makefile
new file mode 100644
index 000000000000..203b8f465817
--- /dev/null
+++ b/drivers/virt/vboxguest/Makefile
@@ -0,0 +1,3 @@
+vboxguest-y := vboxguest_linux.o vboxguest_core.o vboxguest_utils.o
+
+obj-$(CONFIG_VBOXGUEST) += vboxguest.o
diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
new file mode 100644
index 000000000000..4927c0d3e336
--- /dev/null
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -0,0 +1,1577 @@
+/*
+ * vboxguest core guest-device handling code, VBoxGuest.cpp in upstream svn.
+ *
+ * Copyright (C) 2007-2016 Oracle Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, in which case the provisions of the CDDL are applicable
+ * instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+#include <linux/device.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/sizes.h>
+#include <linux/slab.h>
+#include <linux/vbox_err.h>
+#include <linux/vbox_utils.h>
+#include <linux/vmalloc.h>
+#include "vboxguest_core.h"
+#include "vboxguest_version.h"
+
+/* Get the pointer to the first HGCM parameter. */
+#define VBG_IOCTL_HGCM_CALL_PARMS(a) \
+	((struct vmmdev_hgcm_function_parameter *)( \
+		(u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call)))
+/* Get the pointer to the first HGCM parameter in a 32-bit request. */
+#define VBG_IOCTL_HGCM_CALL_PARMS32(a) \
+	((struct vmmdev_hgcm_function_parameter32 *)( \
+		(u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call)))
+
+#define GUEST_MAPPINGS_TRIES	5
+
+/**
+ * Reserves memory in which the VMM can relocate any guest mappings
+ * that are floating around.
+ *
+ * This operation is a little bit tricky since the VMM might not accept
+ * just any address because of address clashes between the three contexts
+ * it operates in, so we try several times.
+ *
+ * Failure to reserve the guest mappings is ignored.
+ *
+ * @gdev:		The Guest extension device.
+ */
+static void vbg_guest_mappings_init(struct vbg_dev *gdev)
+{
+	struct vmmdev_hypervisorinfo *req;
+	void *guest_mappings[GUEST_MAPPINGS_TRIES];
+	struct page **pages = NULL;
+	u32 size, hypervisor_size;
+	int i, rc;
+
+	/* Query the required space. */
+	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HYPERVISOR_INFO);
+	if (!req)
+		return;
+
+	req->hypervisor_start = 0;
+	req->hypervisor_size = 0;
+	rc = vbg_req_perform(gdev, req);
+	if (rc < 0)
+		goto out;
+
+	/*
+	 * The VMM will report back if there is nothing it wants to map, like
+	 * for instance in VT-x and AMD-V mode.
+	 */
+	if (req->hypervisor_size == 0)
+		goto out;
+
+	hypervisor_size = req->hypervisor_size;
+	/* Add 4M so that we can align the vmap to 4MiB as the host requires. */
+	size = PAGE_ALIGN(req->hypervisor_size) + SZ_4M;
+
+	pages = kmalloc(sizeof(*pages) * (size >> PAGE_SHIFT), GFP_KERNEL);
+	if (!pages)
+		goto out;
+
+	gdev->guest_mappings_dummy_page = alloc_page(GFP_HIGHUSER);
+	if (!gdev->guest_mappings_dummy_page)
+		goto out;
+
+	for (i = 0; i < (size >> PAGE_SHIFT); i++)
+		pages[i] = gdev->guest_mappings_dummy_page;
+
+	/* Try several times, the host can be picky about certain addresses. */
+	for (i = 0; i < GUEST_MAPPINGS_TRIES; i++) {
+		guest_mappings[i] = vmap(pages, (size >> PAGE_SHIFT),
+					 VM_MAP, PAGE_KERNEL_RO);
+		if (!guest_mappings[i])
+			break;
+
+		req->header.request_type = VMMDEVREQ_SET_HYPERVISOR_INFO;
+		req->header.rc = VERR_INTERNAL_ERROR;
+		req->hypervisor_size = hypervisor_size;
+		req->hypervisor_start =
+			(unsigned long)PTR_ALIGN(guest_mappings[i], SZ_4M);
+
+		rc = vbg_req_perform(gdev, req);
+		if (rc >= 0) {
+			gdev->guest_mappings = guest_mappings[i];
+			break;
+		}
+	}
+
+	/* Free vmap's from failed attempts. */
+	while (--i >= 0)
+		vunmap(guest_mappings[i]);
+
+	/* On failure free the dummy-page backing the vmap */
+	if (!gdev->guest_mappings) {
+		__free_page(gdev->guest_mappings_dummy_page);
+		gdev->guest_mappings_dummy_page = NULL;
+	}
+
+out:
+	kfree(req);
+	kfree(pages);
+}
+
+/**
+ * Undo what vbg_guest_mappings_init did.
+ *
+ * @gdev:		The Guest extension device.
+ */
+static void vbg_guest_mappings_exit(struct vbg_dev *gdev)
+{
+	struct vmmdev_hypervisorinfo *req;
+	int rc;
+
+	if (!gdev->guest_mappings)
+		return;
+
+	/*
+	 * Tell the host that we're going to free the memory we reserved for
+	 * it, the free it up. (Leak the memory if anything goes wrong here.)
+	 */
+	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_HYPERVISOR_INFO);
+	if (!req)
+		return;
+
+	req->hypervisor_start = 0;
+	req->hypervisor_size = 0;
+
+	rc = vbg_req_perform(gdev, req);
+
+	kfree(req);
+
+	if (rc < 0) {
+		vbg_err("%s error: %d\n", __func__, rc);
+		return;
+	}
+
+	vunmap(gdev->guest_mappings);
+	gdev->guest_mappings = NULL;
+
+	__free_page(gdev->guest_mappings_dummy_page);
+	gdev->guest_mappings_dummy_page = NULL;
+}
+
+/**
+ * Report the guest information to the host.
+ * Return: 0 or negative errno value.
+ * @gdev:		The Guest extension device.
+ */
+static int vbg_report_guest_info(struct vbg_dev *gdev)
+{
+	/*
+	 * Allocate and fill in the two guest info reports.
+	 */
+	struct vmmdev_guest_info *req1 = NULL;
+	struct vmmdev_guest_info2 *req2 = NULL;
+	int rc, ret = -ENOMEM;
+
+	req1 = vbg_req_alloc(sizeof(*req1), VMMDEVREQ_REPORT_GUEST_INFO);
+	req2 = vbg_req_alloc(sizeof(*req2), VMMDEVREQ_REPORT_GUEST_INFO2);
+	if (!req1 || !req2)
+		goto out_free;
+
+	req1->interface_version = VMMDEV_VERSION;
+	req1->os_type = VMMDEV_OSTYPE_LINUX26;
+#if __BITS_PER_LONG == 64
+	req1->os_type |= VMMDEV_OSTYPE_X64;
+#endif
+
+	req2->additions_major = VBG_VERSION_MAJOR;
+	req2->additions_minor = VBG_VERSION_MINOR;
+	req2->additions_build = VBG_VERSION_BUILD;
+	req2->additions_revision = VBG_SVN_REV;
+	/* (no features defined yet) */
+	req2->additions_features = 0;
+	strlcpy(req2->name, VBG_VERSION_STRING,
+		sizeof(req2->name));
+
+	/*
+	 * There are two protocols here:
+	 *      1. INFO2 + INFO1. Supported by >=3.2.51.
+	 *      2. INFO1 and optionally INFO2. The old protocol.
+	 *
+	 * We try protocol 2 first.  It will fail with VERR_NOT_SUPPORTED
+	 * if not supported by the VMMDev (message ordering requirement).
+	 */
+	rc = vbg_req_perform(gdev, req2);
+	if (rc >= 0) {
+		rc = vbg_req_perform(gdev, req1);
+	} else if (rc == VERR_NOT_SUPPORTED || rc == VERR_NOT_IMPLEMENTED) {
+		rc = vbg_req_perform(gdev, req1);
+		if (rc >= 0) {
+			rc = vbg_req_perform(gdev, req2);
+			if (rc == VERR_NOT_IMPLEMENTED)
+				rc = VINF_SUCCESS;
+		}
+	}
+	ret = vbg_status_code_to_errno(rc);
+
+out_free:
+	kfree(req2);
+	kfree(req1);
+	return ret;
+}
+
+/**
+ * Report the guest driver status to the host.
+ * Return: 0 or negative errno value.
+ * @gdev:		The Guest extension device.
+ * @active:		Flag whether the driver is now active or not.
+ */
+static int vbg_report_driver_status(struct vbg_dev *gdev, bool active)
+{
+	struct vmmdev_guest_status *req;
+	int rc;
+
+	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_REPORT_GUEST_STATUS);
+	if (!req)
+		return -ENOMEM;
+
+	req->facility = VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER;
+	if (active)
+		req->status = VBOXGUEST_FACILITY_STATUS_ACTIVE;
+	else
+		req->status = VBOXGUEST_FACILITY_STATUS_INACTIVE;
+	req->flags = 0;
+
+	rc = vbg_req_perform(gdev, req);
+	if (rc == VERR_NOT_IMPLEMENTED)	/* Compatibility with older hosts. */
+		rc = VINF_SUCCESS;
+
+	kfree(req);
+
+	return vbg_status_code_to_errno(rc);
+}
+
+/**
+ * Inflate the balloon by one chunk. The caller owns the balloon mutex.
+ * Return: 0 or negative errno value.
+ * @gdev:		The Guest extension device.
+ * @chunk_idx:		Index of the chunk.
+ */
+static int vbg_balloon_inflate(struct vbg_dev *gdev, u32 chunk_idx)
+{
+	struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req;
+	struct page **pages;
+	int i, rc, ret;
+
+	pages = kmalloc(sizeof(*pages) * VMMDEV_MEMORY_BALLOON_CHUNK_PAGES,
+			GFP_KERNEL | __GFP_NOWARN);
+	if (!pages)
+		return -ENOMEM;
+
+	req->header.size = sizeof(*req);
+	req->inflate = true;
+	req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
+
+	for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++) {
+		pages[i] = alloc_page(GFP_KERNEL | __GFP_NOWARN);
+		if (!pages[i]) {
+			ret = -ENOMEM;
+			goto out_error;
+		}
+
+		req->phys_page[i] = page_to_phys(pages[i]);
+	}
+
+	rc = vbg_req_perform(gdev, req);
+	if (rc < 0) {
+		vbg_err("%s error, rc: %d\n", __func__, rc);
+		ret = vbg_status_code_to_errno(rc);
+		goto out_error;
+	}
+
+	gdev->mem_balloon.pages[chunk_idx] = pages;
+
+	return 0;
+
+out_error:
+	while (--i >= 0)
+		__free_page(pages[i]);
+	kfree(pages);
+
+	return ret;
+}
+
+/**
+ * Deflate the balloon by one chunk. The caller owns the balloon mutex.
+ * Return: 0 or negative errno value.
+ * @gdev:		The Guest extension device.
+ * @chunk_idx:		Index of the chunk.
+ */
+static int vbg_balloon_deflate(struct vbg_dev *gdev, u32 chunk_idx)
+{
+	struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req;
+	struct page **pages = gdev->mem_balloon.pages[chunk_idx];
+	int i, rc;
+
+	req->header.size = sizeof(*req);
+	req->inflate = false;
+	req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
+
+	for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++)
+		req->phys_page[i] = page_to_phys(pages[i]);
+
+	rc = vbg_req_perform(gdev, req);
+	if (rc < 0) {
+		vbg_err("%s error, rc: %d\n", __func__, rc);
+		return vbg_status_code_to_errno(rc);
+	}
+
+	for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++)
+		__free_page(pages[i]);
+	kfree(pages);
+	gdev->mem_balloon.pages[chunk_idx] = NULL;
+
+	return 0;
+}
+
+/**
+ * Respond to VMMDEV_EVENT_BALLOON_CHANGE_REQUEST events, query the size
+ * the host wants the balloon to be and adjust accordingly.
+ */
+static void vbg_balloon_work(struct work_struct *work)
+{
+	struct vbg_dev *gdev =
+		container_of(work, struct vbg_dev, mem_balloon.work);
+	struct vmmdev_memballoon_info *req = gdev->mem_balloon.get_req;
+	u32 i, chunks;
+	int rc, ret;
+
+	/*
+	 * Setting this bit means that we request the value from the host and
+	 * change the guest memory balloon according to the returned value.
+	 */
+	req->event_ack = VMMDEV_EVENT_BALLOON_CHANGE_REQUEST;
+	rc = vbg_req_perform(gdev, req);
+	if (rc < 0) {
+		vbg_err("%s error, rc: %d)\n", __func__, rc);
+		return;
+	}
+
+	/*
+	 * The host always returns the same maximum amount of chunks, so
+	 * we do this once.
+	 */
+	if (!gdev->mem_balloon.max_chunks) {
+		gdev->mem_balloon.pages =
+			devm_kcalloc(gdev->dev, req->phys_mem_chunks,
+				     sizeof(struct page **), GFP_KERNEL);
+		if (!gdev->mem_balloon.pages)
+			return;
+
+		gdev->mem_balloon.max_chunks = req->phys_mem_chunks;
+	}
+
+	chunks = req->balloon_chunks;
+	if (chunks > gdev->mem_balloon.max_chunks) {
+		vbg_err("%s: illegal balloon size %u (max=%u)\n",
+			__func__, chunks, gdev->mem_balloon.max_chunks);
+		return;
+	}
+
+	if (chunks > gdev->mem_balloon.chunks) {
+		/* inflate */
+		for (i = gdev->mem_balloon.chunks; i < chunks; i++) {
+			ret = vbg_balloon_inflate(gdev, i);
+			if (ret < 0)
+				return;
+
+			gdev->mem_balloon.chunks++;
+		}
+	} else {
+		/* deflate */
+		for (i = gdev->mem_balloon.chunks; i-- > chunks;) {
+			ret = vbg_balloon_deflate(gdev, i);
+			if (ret < 0)
+				return;
+
+			gdev->mem_balloon.chunks--;
+		}
+	}
+}
+
+/**
+ * Callback for heartbeat timer.
+ */
+static void vbg_heartbeat_timer(struct timer_list *t)
+{
+	struct vbg_dev *gdev = from_timer(gdev, t, heartbeat_timer);
+
+	vbg_req_perform(gdev, gdev->guest_heartbeat_req);
+	mod_timer(&gdev->heartbeat_timer,
+		  msecs_to_jiffies(gdev->heartbeat_interval_ms));
+}
+
+/**
+ * Configure the host to check guest's heartbeat
+ * and get heartbeat interval from the host.
+ * Return: 0 or negative errno value.
+ * @gdev:		The Guest extension device.
+ * @enabled:		Set true to enable guest heartbeat checks on host.
+ */
+static int vbg_heartbeat_host_config(struct vbg_dev *gdev, bool enabled)
+{
+	struct vmmdev_heartbeat *req;
+	int rc;
+
+	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_HEARTBEAT_CONFIGURE);
+	if (!req)
+		return -ENOMEM;
+
+	req->enabled = enabled;
+	req->interval_ns = 0;
+	rc = vbg_req_perform(gdev, req);
+	do_div(req->interval_ns, 1000000); /* ns -> ms */
+	gdev->heartbeat_interval_ms = req->interval_ns;
+	kfree(req);
+
+	return vbg_status_code_to_errno(rc);
+}
+
+/**
+ * Initializes the heartbeat timer. This feature may be disabled by the host.
+ * Return: 0 or negative errno value.
+ * @gdev:		The Guest extension device.
+ */
+static int vbg_heartbeat_init(struct vbg_dev *gdev)
+{
+	int ret;
+
+	/* Make sure that heartbeat checking is disabled if we fail. */
+	ret = vbg_heartbeat_host_config(gdev, false);
+	if (ret < 0)
+		return ret;
+
+	ret = vbg_heartbeat_host_config(gdev, true);
+	if (ret < 0)
+		return ret;
+
+	/*
+	 * Preallocate the request to use it from the timer callback because:
+	 *    1) on Windows vbg_req_alloc must be called at IRQL <= APC_LEVEL
+	 *       and the timer callback runs at DISPATCH_LEVEL;
+	 *    2) avoid repeated allocations.
+	 */
+	gdev->guest_heartbeat_req = vbg_req_alloc(
+					sizeof(*gdev->guest_heartbeat_req),
+					VMMDEVREQ_GUEST_HEARTBEAT);
+	if (!gdev->guest_heartbeat_req)
+		return -ENOMEM;
+
+	vbg_info("%s: Setting up heartbeat to trigger every %d milliseconds\n",
+		 __func__, gdev->heartbeat_interval_ms);
+	mod_timer(&gdev->heartbeat_timer, 0);
+
+	return 0;
+}
+
+/**
+ * Cleanup hearbeat code, stop HB timer and disable host heartbeat checking.
+ * @gdev:		The Guest extension device.
+ */
+static void vbg_heartbeat_exit(struct vbg_dev *gdev)
+{
+	del_timer_sync(&gdev->heartbeat_timer);
+	vbg_heartbeat_host_config(gdev, false);
+	kfree(gdev->guest_heartbeat_req);
+
+}
+
+/**
+ * Applies a change to the bit usage tracker.
+ * Return: true if the mask changed, false if not.
+ * @tracker:		The bit usage tracker.
+ * @changed:		The bits to change.
+ * @previous:		The previous value of the bits.
+ */
+static bool vbg_track_bit_usage(struct vbg_bit_usage_tracker *tracker,
+				u32 changed, u32 previous)
+{
+	bool global_change = false;
+
+	while (changed) {
+		u32 bit = ffs(changed) - 1;
+		u32 bitmask = BIT(bit);
+
+		if (bitmask & previous) {
+			tracker->per_bit_usage[bit] -= 1;
+			if (tracker->per_bit_usage[bit] == 0) {
+				global_change = true;
+				tracker->mask &= ~bitmask;
+			}
+		} else {
+			tracker->per_bit_usage[bit] += 1;
+			if (tracker->per_bit_usage[bit] == 1) {
+				global_change = true;
+				tracker->mask |= bitmask;
+			}
+		}
+
+		changed &= ~bitmask;
+	}
+
+	return global_change;
+}
+
+/**
+ * Init and termination worker for resetting the (host) event filter on the host
+ * Return: 0 or negative errno value.
+ * @gdev:		   The Guest extension device.
+ * @fixed_events:	   Fixed events (init time).
+ */
+static int vbg_reset_host_event_filter(struct vbg_dev *gdev,
+				       u32 fixed_events)
+{
+	struct vmmdev_mask *req;
+	int rc;
+
+	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK);
+	if (!req)
+		return -ENOMEM;
+
+	req->not_mask = U32_MAX & ~fixed_events;
+	req->or_mask = fixed_events;
+	rc = vbg_req_perform(gdev, req);
+	if (rc < 0)
+		vbg_err("%s error, rc: %d\n", __func__, rc);
+
+	kfree(req);
+	return vbg_status_code_to_errno(rc);
+}
+
+/**
+ * Changes the event filter mask for the given session.
+ *
+ * This is called in response to VBG_IOCTL_CHANGE_FILTER_MASK as well as to
+ * do session cleanup. Takes the session spinlock.
+ *
+ * Return: 0 or negative errno value.
+ * @gdev:			The Guest extension device.
+ * @session:			The session.
+ * @or_mask:			The events to add.
+ * @not_mask:			The events to remove.
+ * @session_termination:	Set if we're called by the session cleanup code.
+ *				This tweaks the error handling so we perform
+ *				proper session cleanup even if the host
+ *				misbehaves.
+ */
+static int vbg_set_session_event_filter(struct vbg_dev *gdev,
+					struct vbg_session *session,
+					u32 or_mask, u32 not_mask,
+					bool session_termination)
+{
+	struct vmmdev_mask *req;
+	u32 changed, previous;
+	int rc, ret = 0;
+
+	/* Allocate a request buffer before taking the spinlock */
+	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK);
+	if (!req) {
+		if (!session_termination)
+			return -ENOMEM;
+		/* Ignore failure, we must do session cleanup. */
+	}
+
+	mutex_lock(&gdev->session_mutex);
+
+	/* Apply the changes to the session mask. */
+	previous = session->event_filter;
+	session->event_filter |= or_mask;
+	session->event_filter &= ~not_mask;
+
+	/* If anything actually changed, update the global usage counters. */
+	changed = previous ^ session->event_filter;
+	if (!changed)
+		goto out;
+
+	vbg_track_bit_usage(&gdev->event_filter_tracker, changed, previous);
+	req->or_mask = gdev->fixed_events | gdev->event_filter_tracker.mask;
+
+	if (gdev->event_filter_host == req->or_mask || !req)
+		goto out;
+
+	gdev->event_filter_host = req->or_mask;
+	req->not_mask = ~req->or_mask;
+	rc = vbg_req_perform(gdev, req);
+	if (rc < 0) {
+		ret = vbg_status_code_to_errno(rc);
+
+		/* Failed, roll back (unless it's session termination time). */
+		gdev->event_filter_host = U32_MAX;
+		if (session_termination)
+			goto out;
+
+		vbg_track_bit_usage(&gdev->event_filter_tracker, changed,
+				    session->event_filter);
+		session->event_filter = previous;
+	}
+
+out:
+	mutex_unlock(&gdev->session_mutex);
+	kfree(req);
+
+	return ret;
+}
+
+/**
+ * Init and termination worker for set guest capabilities to zero on the host.
+ * Return: 0 or negative errno value.
+ * @gdev:		The Guest extension device.
+ */
+static int vbg_reset_host_capabilities(struct vbg_dev *gdev)
+{
+	struct vmmdev_mask *req;
+	int rc;
+
+	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES);
+	if (!req)
+		return -ENOMEM;
+
+	req->not_mask = U32_MAX;
+	req->or_mask = 0;
+	rc = vbg_req_perform(gdev, req);
+	if (rc < 0)
+		vbg_err("%s error, rc: %d\n", __func__, rc);
+
+	kfree(req);
+	return vbg_status_code_to_errno(rc);
+}
+
+/**
+ * Sets the guest capabilities for a session. Takes the session spinlock.
+ * Return: 0 or negative errno value.
+ * @gdev:			The Guest extension device.
+ * @session:			The session.
+ * @or_mask:			The capabilities to add.
+ * @not_mask:			The capabilities to remove.
+ * @session_termination:	Set if we're called by the session cleanup code.
+ *				This tweaks the error handling so we perform
+ *				proper session cleanup even if the host
+ *				misbehaves.
+ */
+static int vbg_set_session_capabilities(struct vbg_dev *gdev,
+					struct vbg_session *session,
+					u32 or_mask, u32 not_mask,
+					bool session_termination)
+{
+	struct vmmdev_mask *req;
+	u32 changed, previous;
+	int rc, ret = 0;
+
+	/* Allocate a request buffer before taking the spinlock */
+	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES);
+	if (!req) {
+		if (!session_termination)
+			return -ENOMEM;
+		/* Ignore failure, we must do session cleanup. */
+	}
+
+	mutex_lock(&gdev->session_mutex);
+
+	/* Apply the changes to the session mask. */
+	previous = session->guest_caps;
+	session->guest_caps |= or_mask;
+	session->guest_caps &= ~not_mask;
+
+	/* If anything actually changed, update the global usage counters. */
+	changed = previous ^ session->guest_caps;
+	if (!changed)
+		goto out;
+
+	vbg_track_bit_usage(&gdev->guest_caps_tracker, changed, previous);
+	req->or_mask = gdev->guest_caps_tracker.mask;
+
+	if (gdev->guest_caps_host == req->or_mask || !req)
+		goto out;
+
+	gdev->guest_caps_host = req->or_mask;
+	req->not_mask = ~req->or_mask;
+	rc = vbg_req_perform(gdev, req);
+	if (rc < 0) {
+		ret = vbg_status_code_to_errno(rc);
+
+		/* Failed, roll back (unless it's session termination time). */
+		gdev->guest_caps_host = U32_MAX;
+		if (session_termination)
+			goto out;
+
+		vbg_track_bit_usage(&gdev->guest_caps_tracker, changed,
+				    session->guest_caps);
+		session->guest_caps = previous;
+	}
+
+out:
+	mutex_unlock(&gdev->session_mutex);
+	kfree(req);
+
+	return ret;
+}
+
+/**
+ * vbg_query_host_version get the host feature mask and version information.
+ * Return: 0 or negative errno value.
+ * @gdev:		The Guest extension device.
+ */
+static int vbg_query_host_version(struct vbg_dev *gdev)
+{
+	struct vmmdev_host_version *req;
+	int rc, ret;
+
+	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HOST_VERSION);
+	if (!req)
+		return -ENOMEM;
+
+	rc = vbg_req_perform(gdev, req);
+	ret = vbg_status_code_to_errno(rc);
+	if (ret)
+		goto out;
+
+	snprintf(gdev->host_version, sizeof(gdev->host_version), "%u.%u.%ur%u",
+		 req->major, req->minor, req->build, req->revision);
+	gdev->host_features = req->features;
+
+	vbg_info("vboxguest: host-version: %s %#x\n", gdev->host_version,
+		 gdev->host_features);
+
+	if (!(req->features & VMMDEV_HVF_HGCM_PHYS_PAGE_LIST)) {
+		vbg_err("vboxguest: Error host too old (does not support page-lists)\n");
+		ret = -ENODEV;
+	}
+
+out:
+	kfree(req);
+	return ret;
+}
+
+/**
+ * Initializes the VBoxGuest device extension when the
+ * device driver is loaded.
+ *
+ * The native code locates the VMMDev on the PCI bus and retrieve
+ * the MMIO and I/O port ranges, this function will take care of
+ * mapping the MMIO memory (if present). Upon successful return
+ * the native code should set up the interrupt handler.
+ *
+ * Return: 0 or negative errno value.
+ *
+ * @gdev:		The Guest extension device.
+ * @fixed_events:	Events that will be enabled upon init and no client
+ *			will ever be allowed to mask.
+ */
+int vbg_core_init(struct vbg_dev *gdev, u32 fixed_events)
+{
+	int ret = -ENOMEM;
+
+	gdev->fixed_events = fixed_events | VMMDEV_EVENT_HGCM;
+	gdev->event_filter_host = U32_MAX;	/* forces a report */
+	gdev->guest_caps_host = U32_MAX;	/* forces a report */
+
+	init_waitqueue_head(&gdev->event_wq);
+	init_waitqueue_head(&gdev->hgcm_wq);
+	spin_lock_init(&gdev->event_spinlock);
+	mutex_init(&gdev->session_mutex);
+	mutex_init(&gdev->cancel_req_mutex);
+	timer_setup(&gdev->heartbeat_timer, vbg_heartbeat_timer, 0);
+	INIT_WORK(&gdev->mem_balloon.work, vbg_balloon_work);
+
+	gdev->mem_balloon.get_req =
+		vbg_req_alloc(sizeof(*gdev->mem_balloon.get_req),
+			      VMMDEVREQ_GET_MEMBALLOON_CHANGE_REQ);
+	gdev->mem_balloon.change_req =
+		vbg_req_alloc(sizeof(*gdev->mem_balloon.change_req),
+			      VMMDEVREQ_CHANGE_MEMBALLOON);
+	gdev->cancel_req =
+		vbg_req_alloc(sizeof(*(gdev->cancel_req)),
+			      VMMDEVREQ_HGCM_CANCEL2);
+	gdev->ack_events_req =
+		vbg_req_alloc(sizeof(*gdev->ack_events_req),
+			      VMMDEVREQ_ACKNOWLEDGE_EVENTS);
+	gdev->mouse_status_req =
+		vbg_req_alloc(sizeof(*gdev->mouse_status_req),
+			      VMMDEVREQ_GET_MOUSE_STATUS);
+
+	if (!gdev->mem_balloon.get_req || !gdev->mem_balloon.change_req ||
+	    !gdev->cancel_req || !gdev->ack_events_req ||
+	    !gdev->mouse_status_req)
+		goto err_free_reqs;
+
+	ret = vbg_query_host_version(gdev);
+	if (ret)
+		goto err_free_reqs;
+
+	ret = vbg_report_guest_info(gdev);
+	if (ret) {
+		vbg_err("vboxguest: vbg_report_guest_info error: %d\n", ret);
+		goto err_free_reqs;
+	}
+
+	ret = vbg_reset_host_event_filter(gdev, gdev->fixed_events);
+	if (ret) {
+		vbg_err("vboxguest: Error setting fixed event filter: %d\n",
+			ret);
+		goto err_free_reqs;
+	}
+
+	ret = vbg_reset_host_capabilities(gdev);
+	if (ret) {
+		vbg_err("vboxguest: Error clearing guest capabilities: %d\n",
+			ret);
+		goto err_free_reqs;
+	}
+
+	ret = vbg_core_set_mouse_status(gdev, 0);
+	if (ret) {
+		vbg_err("vboxguest: Error clearing mouse status: %d\n", ret);
+		goto err_free_reqs;
+	}
+
+	/* These may fail without requiring the driver init to fail. */
+	vbg_guest_mappings_init(gdev);
+	vbg_heartbeat_init(gdev);
+
+	/* All Done! */
+	ret = vbg_report_driver_status(gdev, true);
+	if (ret < 0)
+		vbg_err("vboxguest: Error reporting driver status: %d\n", ret);
+
+	return 0;
+
+err_free_reqs:
+	kfree(gdev->mouse_status_req);
+	kfree(gdev->ack_events_req);
+	kfree(gdev->cancel_req);
+	kfree(gdev->mem_balloon.change_req);
+	kfree(gdev->mem_balloon.get_req);
+	return ret;
+}
+
+/**
+ * Call this on exit to clean-up vboxguest-core managed resources.
+ *
+ * The native code should call this before the driver is loaded,
+ * but don't call this on shutdown.
+ * @gdev:		The Guest extension device.
+ */
+void vbg_core_exit(struct vbg_dev *gdev)
+{
+	vbg_heartbeat_exit(gdev);
+	vbg_guest_mappings_exit(gdev);
+
+	/* Clear the host flags (mouse status etc). */
+	vbg_reset_host_event_filter(gdev, 0);
+	vbg_reset_host_capabilities(gdev);
+	vbg_core_set_mouse_status(gdev, 0);
+
+	kfree(gdev->mouse_status_req);
+	kfree(gdev->ack_events_req);
+	kfree(gdev->cancel_req);
+	kfree(gdev->mem_balloon.change_req);
+	kfree(gdev->mem_balloon.get_req);
+}
+
+/**
+ * Creates a VBoxGuest user session.
+ *
+ * vboxguest_linux.c calls this when userspace opens the char-device.
+ * Return: A pointer to the new session or an ERR_PTR on error.
+ * @gdev:		The Guest extension device.
+ * @user:		Set if this is a session for the vboxuser device.
+ */
+struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, bool user)
+{
+	struct vbg_session *session;
+
+	session = kzalloc(sizeof(*session), GFP_KERNEL);
+	if (!session)
+		return ERR_PTR(-ENOMEM);
+
+	session->gdev = gdev;
+	session->user_session = user;
+
+	return session;
+}
+
+/**
+ * Closes a VBoxGuest session.
+ * @session:		The session to close (and free).
+ */
+void vbg_core_close_session(struct vbg_session *session)
+{
+	struct vbg_dev *gdev = session->gdev;
+	int i, rc;
+
+	vbg_set_session_capabilities(gdev, session, 0, U32_MAX, true);
+	vbg_set_session_event_filter(gdev, session, 0, U32_MAX, true);
+
+	for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) {
+		if (!session->hgcm_client_ids[i])
+			continue;
+
+		vbg_hgcm_disconnect(gdev, session->hgcm_client_ids[i], &rc);
+	}
+
+	kfree(session);
+}
+
+static int vbg_ioctl_chk(struct vbg_ioctl_hdr *hdr, size_t in_size,
+			 size_t out_size)
+{
+	if (hdr->size_in  != (sizeof(*hdr) + in_size) ||
+	    hdr->size_out != (sizeof(*hdr) + out_size))
+		return -EINVAL;
+
+	return 0;
+}
+
+static int vbg_ioctl_driver_version_info(
+	struct vbg_ioctl_driver_version_info *info)
+{
+	const u16 vbg_maj_version = VBG_IOC_VERSION >> 16;
+	u16 min_maj_version, req_maj_version;
+
+	if (vbg_ioctl_chk(&info->hdr, sizeof(info->u.in), sizeof(info->u.out)))
+		return -EINVAL;
+
+	req_maj_version = info->u.in.req_version >> 16;
+	min_maj_version = info->u.in.min_version >> 16;
+
+	if (info->u.in.min_version > info->u.in.req_version ||
+	    min_maj_version != req_maj_version)
+		return -EINVAL;
+
+	if (info->u.in.min_version <= VBG_IOC_VERSION &&
+	    min_maj_version == vbg_maj_version) {
+		info->u.out.session_version = VBG_IOC_VERSION;
+	} else {
+		info->u.out.session_version = U32_MAX;
+		info->hdr.rc = VERR_VERSION_MISMATCH;
+	}
+
+	info->u.out.driver_version  = VBG_IOC_VERSION;
+	info->u.out.driver_revision = 0;
+	info->u.out.reserved1      = 0;
+	info->u.out.reserved2      = 0;
+
+	return 0;
+}
+
+static bool vbg_wait_event_cond(struct vbg_dev *gdev,
+				struct vbg_session *session,
+				u32 event_mask)
+{
+	unsigned long flags;
+	bool wakeup;
+	u32 events;
+
+	spin_lock_irqsave(&gdev->event_spinlock, flags);
+
+	events = gdev->pending_events & event_mask;
+	wakeup = events || session->cancel_waiters;
+
+	spin_unlock_irqrestore(&gdev->event_spinlock, flags);
+
+	return wakeup;
+}
+
+/* Must be called with the event_lock held */
+static u32 vbg_consume_events_locked(struct vbg_dev *gdev,
+				     struct vbg_session *session,
+				     u32 event_mask)
+{
+	u32 events = gdev->pending_events & event_mask;
+
+	gdev->pending_events &= ~events;
+	return events;
+}
+
+static int vbg_ioctl_wait_for_events(struct vbg_dev *gdev,
+				     struct vbg_session *session,
+				     struct vbg_ioctl_wait_for_events *wait)
+{
+	u32 timeout_ms = wait->u.in.timeout_ms;
+	u32 event_mask = wait->u.in.events;
+	unsigned long flags;
+	long timeout;
+	int ret = 0;
+
+	if (vbg_ioctl_chk(&wait->hdr, sizeof(wait->u.in), sizeof(wait->u.out)))
+		return -EINVAL;
+
+	if (timeout_ms == U32_MAX)
+		timeout = MAX_SCHEDULE_TIMEOUT;
+	else
+		timeout = msecs_to_jiffies(timeout_ms);
+
+	wait->u.out.events = 0;
+	do {
+		timeout = wait_event_interruptible_timeout(
+				gdev->event_wq,
+				vbg_wait_event_cond(gdev, session, event_mask),
+				timeout);
+
+		spin_lock_irqsave(&gdev->event_spinlock, flags);
+
+		if (timeout < 0 || session->cancel_waiters) {
+			ret = -EINTR;
+		} else if (timeout == 0) {
+			ret = -ETIMEDOUT;
+		} else {
+			wait->u.out.events =
+			   vbg_consume_events_locked(gdev, session, event_mask);
+		}
+
+		spin_unlock_irqrestore(&gdev->event_spinlock, flags);
+
+		/*
+		 * Someone else may have consumed the event(s) first, in
+		 * which case we go back to waiting.
+		 */
+	} while (ret == 0 && wait->u.out.events == 0);
+
+	return ret;
+}
+
+static int vbg_ioctl_interrupt_all_wait_events(struct vbg_dev *gdev,
+					       struct vbg_session *session,
+					       struct vbg_ioctl_hdr *hdr)
+{
+	unsigned long flags;
+
+	if (hdr->size_in != sizeof(*hdr) || hdr->size_out != sizeof(*hdr))
+		return -EINVAL;
+
+	spin_lock_irqsave(&gdev->event_spinlock, flags);
+	session->cancel_waiters = true;
+	spin_unlock_irqrestore(&gdev->event_spinlock, flags);
+
+	wake_up(&gdev->event_wq);
+
+	return 0;
+}
+
+/**
+ * Checks if the VMM request is allowed in the context of the given session.
+ * Return: 0 or negative errno value.
+ * @gdev:		The Guest extension device.
+ * @session:		The calling session.
+ * @req:		The request.
+ */
+static int vbg_req_allowed(struct vbg_dev *gdev, struct vbg_session *session,
+			   const struct vmmdev_request_header *req)
+{
+	const struct vmmdev_guest_status *guest_status;
+	bool trusted_apps_only;
+
+	switch (req->request_type) {
+	/* Trusted users apps only. */
+	case VMMDEVREQ_QUERY_CREDENTIALS:
+	case VMMDEVREQ_REPORT_CREDENTIALS_JUDGEMENT:
+	case VMMDEVREQ_REGISTER_SHARED_MODULE:
+	case VMMDEVREQ_UNREGISTER_SHARED_MODULE:
+	case VMMDEVREQ_WRITE_COREDUMP:
+	case VMMDEVREQ_GET_CPU_HOTPLUG_REQ:
+	case VMMDEVREQ_SET_CPU_HOTPLUG_STATUS:
+	case VMMDEVREQ_CHECK_SHARED_MODULES:
+	case VMMDEVREQ_GET_PAGE_SHARING_STATUS:
+	case VMMDEVREQ_DEBUG_IS_PAGE_SHARED:
+	case VMMDEVREQ_REPORT_GUEST_STATS:
+	case VMMDEVREQ_REPORT_GUEST_USER_STATE:
+	case VMMDEVREQ_GET_STATISTICS_CHANGE_REQ:
+		trusted_apps_only = true;
+		break;
+
+	/* Anyone. */
+	case VMMDEVREQ_GET_MOUSE_STATUS:
+	case VMMDEVREQ_SET_MOUSE_STATUS:
+	case VMMDEVREQ_SET_POINTER_SHAPE:
+	case VMMDEVREQ_GET_HOST_VERSION:
+	case VMMDEVREQ_IDLE:
+	case VMMDEVREQ_GET_HOST_TIME:
+	case VMMDEVREQ_SET_POWER_STATUS:
+	case VMMDEVREQ_ACKNOWLEDGE_EVENTS:
+	case VMMDEVREQ_CTL_GUEST_FILTER_MASK:
+	case VMMDEVREQ_REPORT_GUEST_STATUS:
+	case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ:
+	case VMMDEVREQ_VIDEMODE_SUPPORTED:
+	case VMMDEVREQ_GET_HEIGHT_REDUCTION:
+	case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ2:
+	case VMMDEVREQ_VIDEMODE_SUPPORTED2:
+	case VMMDEVREQ_VIDEO_ACCEL_ENABLE:
+	case VMMDEVREQ_VIDEO_ACCEL_FLUSH:
+	case VMMDEVREQ_VIDEO_SET_VISIBLE_REGION:
+	case VMMDEVREQ_GET_DISPLAY_CHANGE_REQEX:
+	case VMMDEVREQ_GET_SEAMLESS_CHANGE_REQ:
+	case VMMDEVREQ_GET_VRDPCHANGE_REQ:
+	case VMMDEVREQ_LOG_STRING:
+	case VMMDEVREQ_GET_SESSION_ID:
+		trusted_apps_only = false;
+		break;
+
+	/* Depends on the request parameters... */
+	case VMMDEVREQ_REPORT_GUEST_CAPABILITIES:
+		guest_status = (const struct vmmdev_guest_status *)req;
+		switch (guest_status->facility) {
+		case VBOXGUEST_FACILITY_TYPE_ALL:
+		case VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER:
+			vbg_err("Denying userspace vmm report guest cap. call facility %#08x\n",
+				guest_status->facility);
+			return -EPERM;
+		case VBOXGUEST_FACILITY_TYPE_VBOX_SERVICE:
+			trusted_apps_only = true;
+			break;
+		case VBOXGUEST_FACILITY_TYPE_VBOX_TRAY_CLIENT:
+		case VBOXGUEST_FACILITY_TYPE_SEAMLESS:
+		case VBOXGUEST_FACILITY_TYPE_GRAPHICS:
+		default:
+			trusted_apps_only = false;
+			break;
+		}
+		break;
+
+	/* Anything else is not allowed. */
+	default:
+		vbg_err("Denying userspace vmm call type %#08x\n",
+			req->request_type);
+		return -EPERM;
+	}
+
+	if (trusted_apps_only && session->user_session) {
+		vbg_err("Denying userspace vmm call type %#08x through vboxuser device node\n",
+			req->request_type);
+		return -EPERM;
+	}
+
+	return 0;
+}
+
+static int vbg_ioctl_vmmrequest(struct vbg_dev *gdev,
+				struct vbg_session *session, void *data)
+{
+	struct vbg_ioctl_hdr *hdr = data;
+	int ret;
+
+	if (hdr->size_in != hdr->size_out)
+		return -EINVAL;
+
+	if (hdr->size_in > VMMDEV_MAX_VMMDEVREQ_SIZE)
+		return -E2BIG;
+
+	if (hdr->type == VBG_IOCTL_HDR_TYPE_DEFAULT)
+		return -EINVAL;
+
+	ret = vbg_req_allowed(gdev, session, data);
+	if (ret < 0)
+		return ret;
+
+	vbg_req_perform(gdev, data);
+	WARN_ON(hdr->rc == VINF_HGCM_ASYNC_EXECUTE);
+
+	return 0;
+}
+
+static int vbg_ioctl_hgcm_connect(struct vbg_dev *gdev,
+				  struct vbg_session *session,
+				  struct vbg_ioctl_hgcm_connect *conn)
+{
+	u32 client_id;
+	int i, ret;
+
+	if (vbg_ioctl_chk(&conn->hdr, sizeof(conn->u.in), sizeof(conn->u.out)))
+		return -EINVAL;
+
+	/* Find a free place in the sessions clients array and claim it */
+	mutex_lock(&gdev->session_mutex);
+	for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) {
+		if (!session->hgcm_client_ids[i]) {
+			session->hgcm_client_ids[i] = U32_MAX;
+			break;
+		}
+	}
+	mutex_unlock(&gdev->session_mutex);
+
+	if (i >= ARRAY_SIZE(session->hgcm_client_ids))
+		return -EMFILE;
+
+	ret = vbg_hgcm_connect(gdev, &conn->u.in.loc, &client_id,
+			       &conn->hdr.rc);
+
+	mutex_lock(&gdev->session_mutex);
+	if (ret == 0 && conn->hdr.rc >= 0) {
+		conn->u.out.client_id = client_id;
+		session->hgcm_client_ids[i] = client_id;
+	} else {
+		conn->u.out.client_id = 0;
+		session->hgcm_client_ids[i] = 0;
+	}
+	mutex_unlock(&gdev->session_mutex);
+
+	return ret;
+}
+
+static int vbg_ioctl_hgcm_disconnect(struct vbg_dev *gdev,
+				     struct vbg_session *session,
+				     struct vbg_ioctl_hgcm_disconnect *disconn)
+{
+	u32 client_id;
+	int i, ret;
+
+	if (vbg_ioctl_chk(&disconn->hdr, sizeof(disconn->u.in), 0))
+		return -EINVAL;
+
+	client_id = disconn->u.in.client_id;
+	if (client_id == 0 || client_id == U32_MAX)
+		return -EINVAL;
+
+	mutex_lock(&gdev->session_mutex);
+	for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) {
+		if (session->hgcm_client_ids[i] == client_id) {
+			session->hgcm_client_ids[i] = U32_MAX;
+			break;
+		}
+	}
+	mutex_unlock(&gdev->session_mutex);
+
+	if (i >= ARRAY_SIZE(session->hgcm_client_ids))
+		return -EINVAL;
+
+	ret = vbg_hgcm_disconnect(gdev, client_id, &disconn->hdr.rc);
+
+	mutex_lock(&gdev->session_mutex);
+	if (ret == 0 && disconn->hdr.rc >= 0)
+		session->hgcm_client_ids[i] = 0;
+	else
+		session->hgcm_client_ids[i] = client_id;
+	mutex_unlock(&gdev->session_mutex);
+
+	return ret;
+}
+
+static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
+			       struct vbg_session *session, bool f32bit,
+			       struct vbg_ioctl_hgcm_call *call)
+{
+	size_t actual_size;
+	u32 client_id;
+	int i, ret;
+
+	if (call->hdr.size_in < sizeof(*call))
+		return -EINVAL;
+
+	if (call->hdr.size_in != call->hdr.size_out)
+		return -EINVAL;
+
+	if (call->parm_count > VMMDEV_HGCM_MAX_PARMS)
+		return -E2BIG;
+
+	client_id = call->client_id;
+	if (client_id == 0 || client_id == U32_MAX)
+		return -EINVAL;
+
+	actual_size = sizeof(*call);
+	if (f32bit)
+		actual_size += call->parm_count *
+			       sizeof(struct vmmdev_hgcm_function_parameter32);
+	else
+		actual_size += call->parm_count *
+			       sizeof(struct vmmdev_hgcm_function_parameter);
+	if (call->hdr.size_in < actual_size) {
+		vbg_debug("VBG_IOCTL_HGCM_CALL: hdr.size_in %d required size is %zd\n",
+			  call->hdr.size_in, actual_size);
+		return -EINVAL;
+	}
+	call->hdr.size_out = actual_size;
+
+	/*
+	 * Validate the client id.
+	 */
+	mutex_lock(&gdev->session_mutex);
+	for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++)
+		if (session->hgcm_client_ids[i] == client_id)
+			break;
+	mutex_unlock(&gdev->session_mutex);
+	if (i >= ARRAY_SIZE(session->hgcm_client_ids)) {
+		vbg_debug("VBG_IOCTL_HGCM_CALL: INVALID handle. u32Client=%#08x\n",
+			  client_id);
+		return -EINVAL;
+	}
+
+	if (f32bit)
+		ret = vbg_hgcm_call32(gdev, client_id,
+				      call->function, call->timeout_ms,
+				      VBG_IOCTL_HGCM_CALL_PARMS32(call),
+				      call->parm_count, &call->hdr.rc);
+	else
+		ret = vbg_hgcm_call(gdev, client_id,
+				    call->function, call->timeout_ms,
+				    VBG_IOCTL_HGCM_CALL_PARMS(call),
+				    call->parm_count, &call->hdr.rc);
+
+	if (ret == -E2BIG) {
+		/* E2BIG needs to be reported through the hdr.rc field. */
+		call->hdr.rc = VERR_OUT_OF_RANGE;
+		ret = 0;
+	}
+
+	if (ret && ret != -EINTR && ret != -ETIMEDOUT)
+		vbg_err("VBG_IOCTL_HGCM_CALL error: %d\n", ret);
+
+	return ret;
+}
+
+static int vbg_ioctl_log(struct vbg_ioctl_log *log)
+{
+	if (log->hdr.size_out != sizeof(log->hdr))
+		return -EINVAL;
+
+	vbg_info("%.*s", (int)(log->hdr.size_in - sizeof(log->hdr)),
+		 log->u.in.msg);
+
+	return 0;
+}
+
+static int vbg_ioctl_change_filter_mask(struct vbg_dev *gdev,
+					struct vbg_session *session,
+					struct vbg_ioctl_change_filter *filter)
+{
+	u32 or_mask, not_mask;
+
+	if (vbg_ioctl_chk(&filter->hdr, sizeof(filter->u.in), 0))
+		return -EINVAL;
+
+	or_mask = filter->u.in.or_mask;
+	not_mask = filter->u.in.not_mask;
+
+	if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK)
+		return -EINVAL;
+
+	return vbg_set_session_event_filter(gdev, session, or_mask, not_mask,
+					    false);
+}
+
+static int vbg_ioctl_change_guest_capabilities(struct vbg_dev *gdev,
+	     struct vbg_session *session, struct vbg_ioctl_set_guest_caps *caps)
+{
+	u32 or_mask, not_mask;
+	int ret;
+
+	if (vbg_ioctl_chk(&caps->hdr, sizeof(caps->u.in), sizeof(caps->u.out)))
+		return -EINVAL;
+
+	or_mask = caps->u.in.or_mask;
+	not_mask = caps->u.in.not_mask;
+
+	if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK)
+		return -EINVAL;
+
+	ret = vbg_set_session_capabilities(gdev, session, or_mask, not_mask,
+					   false);
+	if (ret)
+		return ret;
+
+	caps->u.out.session_caps = session->guest_caps;
+	caps->u.out.global_caps = gdev->guest_caps_host;
+
+	return 0;
+}
+
+static int vbg_ioctl_check_balloon(struct vbg_dev *gdev,
+				   struct vbg_ioctl_check_balloon *balloon_info)
+{
+	if (vbg_ioctl_chk(&balloon_info->hdr, 0, sizeof(balloon_info->u.out)))
+		return -EINVAL;
+
+	balloon_info->u.out.balloon_chunks = gdev->mem_balloon.chunks;
+	/*
+	 * Under Linux we handle VMMDEV_EVENT_BALLOON_CHANGE_REQUEST
+	 * events entirely in the kernel, see vbg_core_isr().
+	 */
+	balloon_info->u.out.handle_in_r3 = false;
+
+	return 0;
+}
+
+static int vbg_ioctl_write_core_dump(struct vbg_dev *gdev,
+				     struct vbg_ioctl_write_coredump *dump)
+{
+	struct vmmdev_write_core_dump *req;
+
+	if (vbg_ioctl_chk(&dump->hdr, sizeof(dump->u.in), 0))
+		return -EINVAL;
+
+	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_WRITE_COREDUMP);
+	if (!req)
+		return -ENOMEM;
+
+	req->flags = dump->u.in.flags;
+	dump->hdr.rc = vbg_req_perform(gdev, req);
+
+	kfree(req);
+	return 0;
+}
+
+/**
+ * Common IOCtl for user to kernel communication.
+ * Return: 0 or negative errno value.
+ * @session:	The client session.
+ * @req:	The requested function.
+ * @data:	The i/o data buffer, minimum size sizeof(struct vbg_ioctl_hdr).
+ */
+int vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data)
+{
+	unsigned int req_no_size = req & ~IOCSIZE_MASK;
+	struct vbg_dev *gdev = session->gdev;
+	struct vbg_ioctl_hdr *hdr = data;
+	bool f32bit = false;
+
+	hdr->rc = VINF_SUCCESS;
+	if (!hdr->size_out)
+		hdr->size_out = hdr->size_in;
+
+	/*
+	 * hdr->version and hdr->size_in / hdr->size_out minimum size are
+	 * already checked by vbg_misc_device_ioctl().
+	 */
+
+	/* For VMMDEV_REQUEST hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT */
+	if (req_no_size == VBG_IOCTL_VMMDEV_REQUEST(0) ||
+	    req == VBG_IOCTL_VMMDEV_REQUEST_BIG)
+		return vbg_ioctl_vmmrequest(gdev, session, data);
+
+	if (hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT)
+		return -EINVAL;
+
+	/* Fixed size requests. */
+	switch (req) {
+	case VBG_IOCTL_DRIVER_VERSION_INFO:
+		return vbg_ioctl_driver_version_info(data);
+	case VBG_IOCTL_HGCM_CONNECT:
+		return vbg_ioctl_hgcm_connect(gdev, session, data);
+	case VBG_IOCTL_HGCM_DISCONNECT:
+		return vbg_ioctl_hgcm_disconnect(gdev, session, data);
+	case VBG_IOCTL_WAIT_FOR_EVENTS:
+		return vbg_ioctl_wait_for_events(gdev, session, data);
+	case VBG_IOCTL_INTERRUPT_ALL_WAIT_FOR_EVENTS:
+		return vbg_ioctl_interrupt_all_wait_events(gdev, session, data);
+	case VBG_IOCTL_CHANGE_FILTER_MASK:
+		return vbg_ioctl_change_filter_mask(gdev, session, data);
+	case VBG_IOCTL_CHANGE_GUEST_CAPABILITIES:
+		return vbg_ioctl_change_guest_capabilities(gdev, session, data);
+	case VBG_IOCTL_CHECK_BALLOON:
+		return vbg_ioctl_check_balloon(gdev, data);
+	case VBG_IOCTL_WRITE_CORE_DUMP:
+		return vbg_ioctl_write_core_dump(gdev, data);
+	}
+
+	/* Variable sized requests. */
+	switch (req_no_size) {
+#ifdef CONFIG_COMPAT
+	case VBG_IOCTL_HGCM_CALL_32(0):
+		f32bit = true;
+		/* Fall through */
+#endif
+	case VBG_IOCTL_HGCM_CALL(0):
+		return vbg_ioctl_hgcm_call(gdev, session, f32bit, data);
+	case VBG_IOCTL_LOG(0):
+		return vbg_ioctl_log(data);
+	}
+
+	vbg_debug("VGDrvCommonIoCtl: Unknown req %#08x\n", req);
+	return -ENOTTY;
+}
+
+/**
+ * Report guest supported mouse-features to the host.
+ *
+ * Return: 0 or negative errno value.
+ * @gdev:		The Guest extension device.
+ * @features:		The set of features to report to the host.
+ */
+int vbg_core_set_mouse_status(struct vbg_dev *gdev, u32 features)
+{
+	struct vmmdev_mouse_status *req;
+	int rc;
+
+	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_MOUSE_STATUS);
+	if (!req)
+		return -ENOMEM;
+
+	req->mouse_features = features;
+	req->pointer_pos_x = 0;
+	req->pointer_pos_y = 0;
+
+	rc = vbg_req_perform(gdev, req);
+	if (rc < 0)
+		vbg_err("%s error, rc: %d\n", __func__, rc);
+
+	kfree(req);
+	return vbg_status_code_to_errno(rc);
+}
+
+/** Core interrupt service routine. */
+irqreturn_t vbg_core_isr(int irq, void *dev_id)
+{
+	struct vbg_dev *gdev = dev_id;
+	struct vmmdev_events *req = gdev->ack_events_req;
+	bool mouse_position_changed = false;
+	unsigned long flags;
+	u32 events = 0;
+	int rc;
+
+	if (!gdev->mmio->V.V1_04.have_events)
+		return IRQ_NONE;
+
+	/* Get and acknowlegde events. */
+	req->header.rc = VERR_INTERNAL_ERROR;
+	req->events = 0;
+	rc = vbg_req_perform(gdev, req);
+	if (rc < 0) {
+		vbg_err("Error performing events req, rc: %d\n", rc);
+		return IRQ_NONE;
+	}
+
+	events = req->events;
+
+	if (events & VMMDEV_EVENT_MOUSE_POSITION_CHANGED) {
+		mouse_position_changed = true;
+		events &= ~VMMDEV_EVENT_MOUSE_POSITION_CHANGED;
+	}
+
+	if (events & VMMDEV_EVENT_HGCM) {
+		wake_up(&gdev->hgcm_wq);
+		events &= ~VMMDEV_EVENT_HGCM;
+	}
+
+	if (events & VMMDEV_EVENT_BALLOON_CHANGE_REQUEST) {
+		schedule_work(&gdev->mem_balloon.work);
+		events &= ~VMMDEV_EVENT_BALLOON_CHANGE_REQUEST;
+	}
+
+	if (events) {
+		spin_lock_irqsave(&gdev->event_spinlock, flags);
+		gdev->pending_events |= events;
+		spin_unlock_irqrestore(&gdev->event_spinlock, flags);
+
+		wake_up(&gdev->event_wq);
+	}
+
+	if (mouse_position_changed)
+		vbg_linux_mouse_event(gdev);
+
+	return IRQ_HANDLED;
+}
diff --git a/drivers/virt/vboxguest/vboxguest_core.h b/drivers/virt/vboxguest/vboxguest_core.h
new file mode 100644
index 000000000000..423a985b0ab8
--- /dev/null
+++ b/drivers/virt/vboxguest/vboxguest_core.h
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2010-2016 Oracle Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, in which case the provisions of the CDDL are applicable
+ * instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+#ifndef __VBOXGUEST_CORE_H__
+#define __VBOXGUEST_CORE_H__
+
+#include <linux/input.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/miscdevice.h>
+#include <linux/spinlock.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+#include <linux/vboxguest.h>
+#include "vmmdev.h"
+
+struct vbg_session;
+
+/** VBox guest memory balloon. */
+struct vbg_mem_balloon {
+	/** Work handling VMMDEV_EVENT_BALLOON_CHANGE_REQUEST events */
+	struct work_struct work;
+	/** Pre-allocated vmmdev_memballoon_info req for query */
+	struct vmmdev_memballoon_info *get_req;
+	/** Pre-allocated vmmdev_memballoon_change req for inflate / deflate */
+	struct vmmdev_memballoon_change *change_req;
+	/** The current number of chunks in the balloon. */
+	u32 chunks;
+	/** The maximum number of chunks in the balloon. */
+	u32 max_chunks;
+	/**
+	 * Array of pointers to page arrays. A page * array is allocated for
+	 * each chunk when inflating, and freed when the deflating.
+	 */
+	struct page ***pages;
+};
+
+/**
+ * Per bit usage tracker for a u32 mask.
+ *
+ * Used for optimal handling of guest properties and event filter.
+ */
+struct vbg_bit_usage_tracker {
+	/** Per bit usage counters. */
+	u32 per_bit_usage[32];
+	/** The current mask according to per_bit_usage. */
+	u32 mask;
+};
+
+/** VBox guest device (data) extension. */
+struct vbg_dev {
+	struct device *dev;
+	/** The base of the adapter I/O ports. */
+	u16 io_port;
+	/** Pointer to the mapping of the VMMDev adapter memory. */
+	struct vmmdev_memory *mmio;
+	/** Host version */
+	char host_version[64];
+	/** Host features */
+	unsigned int host_features;
+	/**
+	 * Dummy page and vmap address for reserved kernel virtual-address
+	 * space for the guest mappings, only used on hosts lacking vtx.
+	 */
+	struct page *guest_mappings_dummy_page;
+	void *guest_mappings;
+	/** Spinlock protecting pending_events. */
+	spinlock_t event_spinlock;
+	/** Preallocated struct vmmdev_events for the IRQ handler. */
+	struct vmmdev_events *ack_events_req;
+	/** Wait-for-event list for threads waiting for multiple events. */
+	wait_queue_head_t event_wq;
+	/** Mask of pending events. */
+	u32 pending_events;
+	/** Wait-for-event list for threads waiting on HGCM async completion. */
+	wait_queue_head_t hgcm_wq;
+	/** Pre-allocated hgcm cancel2 req. for cancellation on timeout */
+	struct vmmdev_hgcm_cancel2 *cancel_req;
+	/** Mutex protecting cancel_req accesses */
+	struct mutex cancel_req_mutex;
+	/** Pre-allocated mouse-status request for the input-device handling. */
+	struct vmmdev_mouse_status *mouse_status_req;
+	/** Input device for reporting abs mouse coordinates to the guest. */
+	struct input_dev *input;
+
+	/** Memory balloon information. */
+	struct vbg_mem_balloon mem_balloon;
+
+	/** Lock for session related items in vbg_dev and vbg_session */
+	struct mutex session_mutex;
+	/** Events we won't permit anyone to filter out. */
+	u32 fixed_events;
+	/**
+	 * Usage counters for the host events (excludes fixed events),
+	 * Protected by session_mutex.
+	 */
+	struct vbg_bit_usage_tracker event_filter_tracker;
+	/**
+	 * The event filter last reported to the host (or UINT32_MAX).
+	 * Protected by session_mutex.
+	 */
+	u32 event_filter_host;
+
+	/**
+	 * Usage counters for guest capabilities. Indexed by capability bit
+	 * number, one count per session using a capability.
+	 * Protected by session_mutex.
+	 */
+	struct vbg_bit_usage_tracker guest_caps_tracker;
+	/**
+	 * The guest capabilities last reported to the host (or UINT32_MAX).
+	 * Protected by session_mutex.
+	 */
+	u32 guest_caps_host;
+
+	/**
+	 * Heartbeat timer which fires with interval
+	 * cNsHearbeatInterval and its handler sends
+	 * VMMDEVREQ_GUEST_HEARTBEAT to VMMDev.
+	 */
+	struct timer_list heartbeat_timer;
+	/** Heartbeat timer interval in ms. */
+	int heartbeat_interval_ms;
+	/** Preallocated VMMDEVREQ_GUEST_HEARTBEAT request. */
+	struct vmmdev_request_header *guest_heartbeat_req;
+
+	/** "vboxguest" char-device */
+	struct miscdevice misc_device;
+	/** "vboxuser" char-device */
+	struct miscdevice misc_device_user;
+};
+
+/** The VBoxGuest per session data. */
+struct vbg_session {
+	/** Pointer to the device extension. */
+	struct vbg_dev *gdev;
+
+	/**
+	 * Array containing HGCM client IDs associated with this session.
+	 * These will be automatically disconnected when the session is closed.
+	 * Protected by vbg_gdev.session_mutex.
+	 */
+	u32 hgcm_client_ids[64];
+	/**
+	 * Host events requested by the session.
+	 * An event type requested in any guest session will be added to the
+	 * host filter. Protected by vbg_gdev.session_mutex.
+	 */
+	u32 event_filter;
+	/**
+	 * Guest capabilities for this session.
+	 * A capability claimed by any guest session will be reported to the
+	 * host. Protected by vbg_gdev.session_mutex.
+	 */
+	u32 guest_caps;
+	/** Does this session belong to a root process or a user one? */
+	bool user_session;
+	/** Set on CANCEL_ALL_WAITEVENTS, protected by vbg_devevent_spinlock. */
+	bool cancel_waiters;
+};
+
+int  vbg_core_init(struct vbg_dev *gdev, u32 fixed_events);
+void vbg_core_exit(struct vbg_dev *gdev);
+struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, bool user);
+void vbg_core_close_session(struct vbg_session *session);
+int  vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data);
+int  vbg_core_set_mouse_status(struct vbg_dev *gdev, u32 features);
+
+irqreturn_t vbg_core_isr(int irq, void *dev_id);
+
+void vbg_linux_mouse_event(struct vbg_dev *gdev);
+
+#endif
diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c
new file mode 100644
index 000000000000..86904b87ce83
--- /dev/null
+++ b/drivers/virt/vboxguest/vboxguest_linux.c
@@ -0,0 +1,469 @@
+/*
+ * vboxguest linux pci driver, char-dev and input-device code,
+ *
+ * Copyright (C) 2006-2016 Oracle Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/input.h>
+#include <linux/kernel.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/poll.h>
+#include <linux/vbox_utils.h>
+#include "vboxguest_core.h"
+
+/** The device name. */
+#define DEVICE_NAME		"vboxguest"
+/** The device name for the device node open to everyone. */
+#define DEVICE_NAME_USER	"vboxuser"
+/** VirtualBox PCI vendor ID. */
+#define VBOX_VENDORID		0x80ee
+/** VMMDev PCI card product ID. */
+#define VMMDEV_DEVICEID		0xcafe
+
+/** Mutex protecting the global vbg_gdev pointer used by vbg_get/put_gdev. */
+static DEFINE_MUTEX(vbg_gdev_mutex);
+/** Global vbg_gdev pointer used by vbg_get/put_gdev. */
+static struct vbg_dev *vbg_gdev;
+
+static int vbg_misc_device_open(struct inode *inode, struct file *filp)
+{
+	struct vbg_session *session;
+	struct vbg_dev *gdev;
+
+	/* misc_open sets filp->private_data to our misc device */
+	gdev = container_of(filp->private_data, struct vbg_dev, misc_device);
+
+	session = vbg_core_open_session(gdev, false);
+	if (IS_ERR(session))
+		return PTR_ERR(session);
+
+	filp->private_data = session;
+	return 0;
+}
+
+static int vbg_misc_device_user_open(struct inode *inode, struct file *filp)
+{
+	struct vbg_session *session;
+	struct vbg_dev *gdev;
+
+	/* misc_open sets filp->private_data to our misc device */
+	gdev = container_of(filp->private_data, struct vbg_dev,
+			    misc_device_user);
+
+	session = vbg_core_open_session(gdev, false);
+	if (IS_ERR(session))
+		return PTR_ERR(session);
+
+	filp->private_data = session;
+	return 0;
+}
+
+/**
+ * Close device.
+ * Return: 0 on success, negated errno on failure.
+ * @inode:		Pointer to inode info structure.
+ * @filp:		Associated file pointer.
+ */
+static int vbg_misc_device_close(struct inode *inode, struct file *filp)
+{
+	vbg_core_close_session(filp->private_data);
+	filp->private_data = NULL;
+	return 0;
+}
+
+/**
+ * Device I/O Control entry point.
+ * Return: 0 on success, negated errno on failure.
+ * @filp:		Associated file pointer.
+ * @req:		The request specified to ioctl().
+ * @arg:		The argument specified to ioctl().
+ */
+static long vbg_misc_device_ioctl(struct file *filp, unsigned int req,
+				  unsigned long arg)
+{
+	struct vbg_session *session = filp->private_data;
+	size_t returned_size, size;
+	struct vbg_ioctl_hdr hdr;
+	int ret = 0;
+	void *buf;
+
+	if (copy_from_user(&hdr, (void *)arg, sizeof(hdr)))
+		return -EFAULT;
+
+	if (hdr.version != VBG_IOCTL_HDR_VERSION)
+		return -EINVAL;
+
+	if (hdr.size_in < sizeof(hdr) ||
+	    (hdr.size_out && hdr.size_out < sizeof(hdr)))
+		return -EINVAL;
+
+	size = max(hdr.size_in, hdr.size_out);
+	if (_IOC_SIZE(req) && _IOC_SIZE(req) != size)
+		return -EINVAL;
+	if (size > SZ_16M)
+		return -E2BIG;
+
+	/* __GFP_DMA32 because IOCTL_VMMDEV_REQUEST passes this to the host */
+	buf = kmalloc(size, GFP_KERNEL | __GFP_DMA32);
+	if (!buf)
+		return -ENOMEM;
+
+	if (copy_from_user(buf, (void *)arg, hdr.size_in)) {
+		ret = -EFAULT;
+		goto out;
+	}
+	if (hdr.size_in < size)
+		memset(buf + hdr.size_in, 0, size -  hdr.size_in);
+
+	ret = vbg_core_ioctl(session, req, buf);
+	if (ret)
+		goto out;
+
+	returned_size = ((struct vbg_ioctl_hdr *)buf)->size_out;
+	if (returned_size > size) {
+		vbg_debug("%s: too much output data %zu > %zu\n",
+			  __func__, returned_size, size);
+		returned_size = size;
+	}
+	if (copy_to_user((void *)arg, buf, returned_size) != 0)
+		ret = -EFAULT;
+
+out:
+	kfree(buf);
+
+	return ret;
+}
+
+/** The file_operations structures. */
+static const struct file_operations vbg_misc_device_fops = {
+	.owner			= THIS_MODULE,
+	.open			= vbg_misc_device_open,
+	.release		= vbg_misc_device_close,
+	.unlocked_ioctl		= vbg_misc_device_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl		= vbg_misc_device_ioctl,
+#endif
+};
+static const struct file_operations vbg_misc_device_user_fops = {
+	.owner			= THIS_MODULE,
+	.open			= vbg_misc_device_user_open,
+	.release		= vbg_misc_device_close,
+	.unlocked_ioctl		= vbg_misc_device_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl		= vbg_misc_device_ioctl,
+#endif
+};
+
+/**
+ * Called when the input device is first opened.
+ *
+ * Sets up absolute mouse reporting.
+ */
+static int vbg_input_open(struct input_dev *input)
+{
+	struct vbg_dev *gdev = input_get_drvdata(input);
+	u32 feat = VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE | VMMDEV_MOUSE_NEW_PROTOCOL;
+	int ret;
+
+	ret = vbg_core_set_mouse_status(gdev, feat);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+/**
+ * Called if all open handles to the input device are closed.
+ *
+ * Disables absolute reporting.
+ */
+static void vbg_input_close(struct input_dev *input)
+{
+	struct vbg_dev *gdev = input_get_drvdata(input);
+
+	vbg_core_set_mouse_status(gdev, 0);
+}
+
+/**
+ * Creates the kernel input device.
+ *
+ * Return: 0 on success, negated errno on failure.
+ */
+static int vbg_create_input_device(struct vbg_dev *gdev)
+{
+	struct input_dev *input;
+
+	input = devm_input_allocate_device(gdev->dev);
+	if (!input)
+		return -ENOMEM;
+
+	input->id.bustype = BUS_PCI;
+	input->id.vendor = VBOX_VENDORID;
+	input->id.product = VMMDEV_DEVICEID;
+	input->open = vbg_input_open;
+	input->close = vbg_input_close;
+	input->dev.parent = gdev->dev;
+	input->name = "VirtualBox mouse integration";
+
+	input_set_abs_params(input, ABS_X, VMMDEV_MOUSE_RANGE_MIN,
+			     VMMDEV_MOUSE_RANGE_MAX, 0, 0);
+	input_set_abs_params(input, ABS_Y, VMMDEV_MOUSE_RANGE_MIN,
+			     VMMDEV_MOUSE_RANGE_MAX, 0, 0);
+	input_set_capability(input, EV_KEY, BTN_MOUSE);
+	input_set_drvdata(input, gdev);
+
+	gdev->input = input;
+
+	return input_register_device(gdev->input);
+}
+
+static ssize_t host_version_show(struct device *dev,
+				 struct device_attribute *attr, char *buf)
+{
+	struct vbg_dev *gdev = dev_get_drvdata(dev);
+
+	return sprintf(buf, "%s\n", gdev->host_version);
+}
+
+static ssize_t host_features_show(struct device *dev,
+				 struct device_attribute *attr, char *buf)
+{
+	struct vbg_dev *gdev = dev_get_drvdata(dev);
+
+	return sprintf(buf, "%#x\n", gdev->host_features);
+}
+
+static DEVICE_ATTR_RO(host_version);
+static DEVICE_ATTR_RO(host_features);
+
+/**
+ * Does the PCI detection and init of the device.
+ *
+ * Return: 0 on success, negated errno on failure.
+ */
+static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+{
+	struct device *dev = &pci->dev;
+	resource_size_t io, io_len, mmio, mmio_len;
+	struct vmmdev_memory *vmmdev;
+	struct vbg_dev *gdev;
+	int ret;
+
+	gdev = devm_kzalloc(dev, sizeof(*gdev), GFP_KERNEL);
+	if (!gdev)
+		return -ENOMEM;
+
+	ret = pci_enable_device(pci);
+	if (ret != 0) {
+		vbg_err("vboxguest: Error enabling device: %d\n", ret);
+		return ret;
+	}
+
+	ret = -ENODEV;
+
+	io = pci_resource_start(pci, 0);
+	io_len = pci_resource_len(pci, 0);
+	if (!io || !io_len) {
+		vbg_err("vboxguest: Error IO-port resource (0) is missing\n");
+		goto err_disable_pcidev;
+	}
+	if (devm_request_region(dev, io, io_len, DEVICE_NAME) == NULL) {
+		vbg_err("vboxguest: Error could not claim IO resource\n");
+		ret = -EBUSY;
+		goto err_disable_pcidev;
+	}
+
+	mmio = pci_resource_start(pci, 1);
+	mmio_len = pci_resource_len(pci, 1);
+	if (!mmio || !mmio_len) {
+		vbg_err("vboxguest: Error MMIO resource (1) is missing\n");
+		goto err_disable_pcidev;
+	}
+
+	if (devm_request_mem_region(dev, mmio, mmio_len, DEVICE_NAME) == NULL) {
+		vbg_err("vboxguest: Error could not claim MMIO resource\n");
+		ret = -EBUSY;
+		goto err_disable_pcidev;
+	}
+
+	vmmdev = devm_ioremap(dev, mmio, mmio_len);
+	if (!vmmdev) {
+		vbg_err("vboxguest: Error ioremap failed; MMIO addr=%p size=%d\n",
+			(void *)mmio, (int)mmio_len);
+		goto err_disable_pcidev;
+	}
+
+	/* Validate MMIO region version and size. */
+	if (vmmdev->version != VMMDEV_MEMORY_VERSION ||
+	    vmmdev->size < 32 || vmmdev->size > mmio_len) {
+		vbg_err("vboxguest: Bogus VMMDev memory; version=%08x (expected %08x) size=%d (expected <= %d)\n",
+			vmmdev->version, VMMDEV_MEMORY_VERSION,
+			vmmdev->size, (int)mmio_len);
+		goto err_disable_pcidev;
+	}
+
+	gdev->io_port = io;
+	gdev->mmio = vmmdev;
+	gdev->dev = dev;
+	gdev->misc_device.minor = MISC_DYNAMIC_MINOR;
+	gdev->misc_device.name = DEVICE_NAME;
+	gdev->misc_device.fops = &vbg_misc_device_fops;
+	gdev->misc_device_user.minor = MISC_DYNAMIC_MINOR;
+	gdev->misc_device_user.name = DEVICE_NAME_USER;
+	gdev->misc_device_user.fops = &vbg_misc_device_user_fops;
+
+	ret = vbg_core_init(gdev, VMMDEV_EVENT_MOUSE_POSITION_CHANGED);
+	if (ret)
+		goto err_disable_pcidev;
+
+	ret = vbg_create_input_device(gdev);
+	if (ret) {
+		vbg_err("vboxguest: Error creating input device: %d\n", ret);
+		goto err_vbg_core_exit;
+	}
+
+	ret = devm_request_irq(dev, pci->irq, vbg_core_isr, IRQF_SHARED,
+			       DEVICE_NAME, gdev);
+	if (ret) {
+		vbg_err("vboxguest: Error requesting irq: %d\n", ret);
+		goto err_vbg_core_exit;
+	}
+
+	ret = misc_register(&gdev->misc_device);
+	if (ret) {
+		vbg_err("vboxguest: Error misc_register %s failed: %d\n",
+			DEVICE_NAME, ret);
+		goto err_vbg_core_exit;
+	}
+
+	ret = misc_register(&gdev->misc_device_user);
+	if (ret) {
+		vbg_err("vboxguest: Error misc_register %s failed: %d\n",
+			DEVICE_NAME_USER, ret);
+		goto err_unregister_misc_device;
+	}
+
+	mutex_lock(&vbg_gdev_mutex);
+	if (!vbg_gdev)
+		vbg_gdev = gdev;
+	else
+		ret = -EBUSY;
+	mutex_unlock(&vbg_gdev_mutex);
+
+	if (ret) {
+		vbg_err("vboxguest: Error more then 1 vbox guest pci device\n");
+		goto err_unregister_misc_device_user;
+	}
+
+	pci_set_drvdata(pci, gdev);
+	device_create_file(dev, &dev_attr_host_version);
+	device_create_file(dev, &dev_attr_host_features);
+
+	vbg_info("vboxguest: misc device minor %d, IRQ %d, I/O port %x, MMIO at %p (size %d)\n",
+		 gdev->misc_device.minor, pci->irq, gdev->io_port,
+		 (void *)mmio, (int)mmio_len);
+
+	return 0;
+
+err_unregister_misc_device_user:
+	misc_deregister(&gdev->misc_device_user);
+err_unregister_misc_device:
+	misc_deregister(&gdev->misc_device);
+err_vbg_core_exit:
+	vbg_core_exit(gdev);
+err_disable_pcidev:
+	pci_disable_device(pci);
+
+	return ret;
+}
+
+static void vbg_pci_remove(struct pci_dev *pci)
+{
+	struct vbg_dev *gdev = pci_get_drvdata(pci);
+
+	mutex_lock(&vbg_gdev_mutex);
+	vbg_gdev = NULL;
+	mutex_unlock(&vbg_gdev_mutex);
+
+	device_remove_file(gdev->dev, &dev_attr_host_features);
+	device_remove_file(gdev->dev, &dev_attr_host_version);
+	misc_deregister(&gdev->misc_device_user);
+	misc_deregister(&gdev->misc_device);
+	vbg_core_exit(gdev);
+	pci_disable_device(pci);
+}
+
+struct vbg_dev *vbg_get_gdev(void)
+{
+	mutex_lock(&vbg_gdev_mutex);
+
+	/*
+	 * Note on success we keep the mutex locked until vbg_put_gdev(),
+	 * this stops vbg_pci_remove from removing the device from underneath
+	 * vboxsf. vboxsf will only hold a reference for a short while.
+	 */
+	if (vbg_gdev)
+		return vbg_gdev;
+
+	mutex_unlock(&vbg_gdev_mutex);
+	return ERR_PTR(-ENODEV);
+}
+EXPORT_SYMBOL(vbg_get_gdev);
+
+void vbg_put_gdev(struct vbg_dev *gdev)
+{
+	WARN_ON(gdev != vbg_gdev);
+	mutex_unlock(&vbg_gdev_mutex);
+}
+EXPORT_SYMBOL(vbg_put_gdev);
+
+/**
+ * Callback for mouse events.
+ *
+ * This is called at the end of the ISR, after leaving the event spinlock, if
+ * VMMDEV_EVENT_MOUSE_POSITION_CHANGED was raised by the host.
+ *
+ * @gdev:		The device extension.
+ */
+void vbg_linux_mouse_event(struct vbg_dev *gdev)
+{
+	int rc;
+
+	/* Report events to the kernel input device */
+	gdev->mouse_status_req->mouse_features = 0;
+	gdev->mouse_status_req->pointer_pos_x = 0;
+	gdev->mouse_status_req->pointer_pos_y = 0;
+	rc = vbg_req_perform(gdev, gdev->mouse_status_req);
+	if (rc >= 0) {
+		input_report_abs(gdev->input, ABS_X,
+				 gdev->mouse_status_req->pointer_pos_x);
+		input_report_abs(gdev->input, ABS_Y,
+				 gdev->mouse_status_req->pointer_pos_y);
+		input_sync(gdev->input);
+	}
+}
+
+static const struct pci_device_id vbg_pci_ids[] = {
+	{ .vendor = VBOX_VENDORID, .device = VMMDEV_DEVICEID },
+	{}
+};
+MODULE_DEVICE_TABLE(pci,  vbg_pci_ids);
+
+static struct pci_driver vbg_pci_driver = {
+	.name		= DEVICE_NAME,
+	.id_table	= vbg_pci_ids,
+	.probe		= vbg_pci_probe,
+	.remove		= vbg_pci_remove,
+};
+
+module_pci_driver(vbg_pci_driver);
+
+MODULE_AUTHOR("Oracle Corporation");
+MODULE_DESCRIPTION("Oracle VM VirtualBox Guest Additions for Linux Module");
+MODULE_LICENSE("GPL");
diff --git a/drivers/virt/vboxguest/vboxguest_version.h b/drivers/virt/vboxguest/vboxguest_version.h
new file mode 100644
index 000000000000..2aed18a2005f
--- /dev/null
+++ b/drivers/virt/vboxguest/vboxguest_version.h
@@ -0,0 +1,18 @@
+/*
+ * VBox Guest additions version info, this is used by the host to determine
+ * supported guest-addition features in some cases. So this will need to be
+ * synced with vbox upstreams versioning scheme when we implement / port
+ * new features from the upstream out-of-tree vboxguest driver.
+ */
+
+#ifndef __VBOX_VERSION_H__
+#define __VBOX_VERSION_H__
+
+/* Last synced October 4th 2017 */
+#define VBG_VERSION_MAJOR 5
+#define VBG_VERSION_MINOR 2
+#define VBG_VERSION_BUILD 0
+#define VBG_SVN_REV 68940
+#define VBG_VERSION_STRING "5.2.0"
+
+#endif
-- 
2.14.3

^ permalink raw reply related	[flat|nested] 14+ messages in thread

* Re: [PATCH resend v2 0/3] virt: Add vboxguest driver for Virtual Box Guest integration
  2017-11-26 15:12 [PATCH resend v2 0/3] virt: Add vboxguest driver for Virtual Box Guest integration Hans de Goede
                   ` (2 preceding siblings ...)
  2017-11-26 15:12 ` [PATCH resend v2 3/3] virt: Add vboxguest driver for Virtual Box Guest integration Hans de Goede
@ 2017-11-27 19:44 ` Larry Finger
  2017-11-28 10:01   ` Hans de Goede
  3 siblings, 1 reply; 14+ messages in thread
From: Larry Finger @ 2017-11-27 19:44 UTC (permalink / raw)
  To: Hans de Goede, Arnd Bergmann, Greg Kroah-Hartman
  Cc: Michael Thayer, Knut St . Osmundsen, Christoph Hellwig, linux-kernel

On 11/26/2017 09:12 AM, Hans de Goede wrote:
> Here is resend of v2 of my cleaned up version of the VirtualBox vboxguest
> driver, rebased on top of current the master from Linus.
> 
> Note there currently is an issue with vboxvideo in the current master from
> Linus, this is fixed by this patch:
> https://patchwork.freedesktop.org/patch/189812/
> 
> Once this is merged, I will do some further cleanups on the vboxsf driver
> and also submit that upstream, if people want to test it before then, here
> is a version which applies on top of this series:
> https://github.com/jwrdegoede/linux-sunxi/commit/7f18b741945de3ae09ca8f1a9e48456ce32986c9
> 
> Changes in v2:
> -Change all uapi headers to kernel coding style: Drop struct and enum typedefs
>   make type and struct-member names all lowercase, enum values all uppercase.
> -Remove unused struct type declarations from some headers (shaving of another
>   1000 lines)
> -Remove or fixup doxygen style comments
> -Get rid of CHECK macros, use a function taking in_ and out_size args instead
> -Some other small codyingstyle fixes
> -Split into multiple patches
> 
> Here is (part of) the v1 cover-letter which is still relevant:
> 
> VirtualBox upstream has declared the ioctl API for the /dev/vboxguest device
> as being stable now, so once this passes review this is ready for merging.
> 
> I'm only submitting the vboxguest driver for now, as the vboxsf driver
> depends on this and it easier to first just get the vboxguest driver
> upstream.
> 
> I've removed all depenencies on vbox's OS-independent runtime and
> the runtime itself, reducing the vboxguest driver from 100000+ lines
> of code to aprox. 4300 lines. This reduces the non debug vboxguest.ko
> size from 450kB to less then 100 kB. I've also cleaned up various other
> warts such as doing hardware init in module_init rather then in a
> pci_probe callback.
> 
> The vboxguest driver introduces a new userspace API + ABI in the form
> of ioctls on a character device. VirtualBox upstream not willing to
> commit to keeping this ABI stable was one of the things which has
> kept this driver driver out of mainline sofar. I've been talking to
> VirtualBox upstream about mainlining the guest drivers and VirtualBox
> upstream has agreed to consider the userspace ABI stable and only
> extend it in a backwards compatible manner from now on.

Hans,

I have finished reviewing the commits for vboxguest. Most of my comments are 
minor. I did have two problems when I tried to build these commits and the one 
that creates vboxsf.

The more serious one is that it is possible to build vboxguest without 
vboxvideo. When that happens, a non-privileged user cannot start X. As I say in 
the review, I think that combination does not make sense and should not be allowed.

When the system is booted, vboxsf is not loaded, and the shared folders are not 
automounted. Of course, that issue is not germane to these patches, but will be 
important when vboxsf is merged.

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH resend v2 1/3] virt: Add vboxguest driver for Virtual Box Guest integration UAPI
  2017-11-26 15:12 ` [PATCH resend v2 1/3] virt: Add vboxguest driver for Virtual Box Guest integration UAPI Hans de Goede
@ 2017-11-27 19:44   ` Larry Finger
  2017-11-28 10:08     ` Hans de Goede
  0 siblings, 1 reply; 14+ messages in thread
From: Larry Finger @ 2017-11-27 19:44 UTC (permalink / raw)
  To: Hans de Goede, Arnd Bergmann, Greg Kroah-Hartman
  Cc: Michael Thayer, Knut St . Osmundsen, Christoph Hellwig, linux-kernel

On 11/26/2017 09:12 AM, Hans de Goede wrote:
> This commit adds the headers describing the ioctl API for the
> /dev/vboxguest device used by the Virtual Box Guest Additions
> in Virtual Box virtual machines.
> 
> The driver providing the /dev/vboxguest device will allow Virtual Box
> Guest Additions features such as copy-and-paste, seamless mode and
> OpenGL pass-through.
> 
> Signed-off-by: Hans de Goede <hdegoede@redhat.com>

Minor comments inline in the code.

Reviewed-by: Larry Finger <Larry.Finger@lwfinger.net>

Larry

> ---
> Changes in v2:
> -Change all uapi headers to kernel coding style: Drop struct and enum typedefs
>   make type and struct-member names all lowercase, enum values all uppercase.
> -Remove unused struct type declarations from some headers (shaving of another
>   1000 lines)
> -Remove or fixup doxygen style comments
> -Get rid of CHECK macros, use a function taking in_ and out_size args instead
> -Some other small codyingstyle fixes
> -Split into multiple patches
> ---
>   MAINTAINERS                            |   7 +
>   include/uapi/linux/vbox_err.h          | 170 ++++++++++++++++
>   include/uapi/linux/vbox_vmmdev_types.h | 237 +++++++++++++++++++++++
>   include/uapi/linux/vboxguest.h         | 341 +++++++++++++++++++++++++++++++++
>   4 files changed, 755 insertions(+)
>   create mode 100644 include/uapi/linux/vbox_err.h
>   create mode 100644 include/uapi/linux/vbox_vmmdev_types.h
>   create mode 100644 include/uapi/linux/vboxguest.h
> 
> diff --git a/MAINTAINERS b/MAINTAINERS
> index 275815e2ef44..fe3dc0e9b901 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -14549,6 +14549,13 @@ S:	Maintained
>   F:	drivers/virtio/virtio_input.c
>   F:	include/uapi/linux/virtio_input.h
>   
> +VIRTUAL BOX GUEST DEVICE DRIVER
> +M:	Hans de Goede <hdegoede@redhat.com>
> +M:	Arnd Bergmann <arnd@arndb.de>
> +M:	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> +S:	Maintained
> +F:	include/uapi/linux/vbox*.h
> +
>   VIRTUAL SERIO DEVICE DRIVER
>   M:	Stephen Chandler Paul <thatslyude@gmail.com>
>   S:	Maintained
> diff --git a/include/uapi/linux/vbox_err.h b/include/uapi/linux/vbox_err.h
> new file mode 100644
> index 000000000000..6f56d2952621
> --- /dev/null
> +++ b/include/uapi/linux/vbox_err.h
> @@ -0,0 +1,170 @@
> +/*
> + * Copyright (C) 2017 Oracle Corporation
> + *
> + * Permission is hereby granted, free of charge, to any person obtaining a
> + * copy of this software and associated documentation files (the "Software"),
> + * to deal in the Software without restriction, including without limitation
> + * the rights to use, copy, modify, merge, publish, distribute, sublicense,
> + * and/or sell copies of the Software, and to permit persons to whom the
> + * Software is furnished to do so, subject to the following conditions:
> + *
> + * The above copyright notice and this permission notice shall be included in
> + * all copies or substantial portions of the Software.
> + *
> + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
> + * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
> + * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
> + * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
> + * OTHER DEALINGS IN THE SOFTWARE.
> + */
> +
> +#ifndef __UAPI_VBOX_ERR_H__
> +#define __UAPI_VBOX_ERR_H__
> +
> +#define VINF_SUCCESS                        0
> +#define VERR_GENERAL_FAILURE                (-1)
> +#define VERR_INVALID_PARAMETER              (-2)
> +#define VERR_INVALID_MAGIC                  (-3)
> +#define VERR_INVALID_HANDLE                 (-4)
> +#define VERR_LOCK_FAILED                    (-5)
> +#define VERR_INVALID_POINTER                (-6)
> +#define VERR_IDT_FAILED                     (-7)
> +#define VERR_NO_MEMORY                      (-8)
> +#define VERR_ALREADY_LOADED                 (-9)
> +#define VERR_PERMISSION_DENIED              (-10)
> +#define VERR_VERSION_MISMATCH               (-11)
> +#define VERR_NOT_IMPLEMENTED                (-12)
> +#define VERR_INVALID_FLAGS                  (-13)
> +
> +#define VERR_NOT_EQUAL                      (-18)
> +#define VERR_NOT_SYMLINK                    (-19)
> +#define VERR_NO_TMP_MEMORY                  (-20)
> +#define VERR_INVALID_FMODE                  (-21)
> +#define VERR_WRONG_ORDER                    (-22)
> +#define VERR_NO_TLS_FOR_SELF                (-23)
> +#define VERR_FAILED_TO_SET_SELF_TLS         (-24)
> +#define VERR_NO_CONT_MEMORY                 (-26)
> +#define VERR_NO_PAGE_MEMORY                 (-27)
> +#define VERR_THREAD_IS_DEAD                 (-29)
> +#define VERR_THREAD_NOT_WAITABLE            (-30)
> +#define VERR_PAGE_TABLE_NOT_PRESENT         (-31)
> +#define VERR_INVALID_CONTEXT                (-32)
> +#define VERR_TIMER_BUSY                     (-33)
> +#define VERR_ADDRESS_CONFLICT               (-34)
> +#define VERR_UNRESOLVED_ERROR               (-35)
> +#define VERR_INVALID_FUNCTION               (-36)
> +#define VERR_NOT_SUPPORTED                  (-37)
> +#define VERR_ACCESS_DENIED                  (-38)
> +#define VERR_INTERRUPTED                    (-39)
> +#define VERR_TIMEOUT                        (-40)
> +#define VERR_BUFFER_OVERFLOW                (-41)
> +#define VERR_TOO_MUCH_DATA                  (-42)
> +#define VERR_MAX_THRDS_REACHED              (-43)
> +#define VERR_MAX_PROCS_REACHED              (-44)
> +#define VERR_SIGNAL_REFUSED                 (-45)
> +#define VERR_SIGNAL_PENDING                 (-46)
> +#define VERR_SIGNAL_INVALID                 (-47)
> +#define VERR_STATE_CHANGED                  (-48)
> +#define VERR_INVALID_UUID_FORMAT            (-49)
> +#define VERR_PROCESS_NOT_FOUND              (-50)
> +#define VERR_PROCESS_RUNNING                (-51)
> +#define VERR_TRY_AGAIN                      (-52)
> +#define VERR_PARSE_ERROR                    (-53)
> +#define VERR_OUT_OF_RANGE                   (-54)
> +#define VERR_NUMBER_TOO_BIG                 (-55)
> +#define VERR_NO_DIGITS                      (-56)
> +#define VERR_NEGATIVE_UNSIGNED              (-57)
> +#define VERR_NO_TRANSLATION                 (-58)
> +
> +#define VERR_NOT_FOUND                      (-78)
> +#define VERR_INVALID_STATE                  (-79)
> +#define VERR_OUT_OF_RESOURCES               (-80)
> +
> +#define VERR_FILE_NOT_FOUND                 (-102)
> +#define VERR_PATH_NOT_FOUND                 (-103)
> +#define VERR_INVALID_NAME                   (-104)
> +#define VERR_ALREADY_EXISTS                 (-105)
> +#define VERR_TOO_MANY_OPEN_FILES            (-106)
> +#define VERR_SEEK                           (-107)
> +#define VERR_NEGATIVE_SEEK                  (-108)
> +#define VERR_SEEK_ON_DEVICE                 (-109)
> +#define VERR_EOF                            (-110)
> +#define VERR_READ_ERROR                     (-111)
> +#define VERR_WRITE_ERROR                    (-112)
> +#define VERR_WRITE_PROTECT                  (-113)
> +#define VERR_SHARING_VIOLATION              (-114)
> +#define VERR_FILE_LOCK_FAILED               (-115)
> +#define VERR_FILE_LOCK_VIOLATION            (-116)
> +#define VERR_CANT_CREATE                    (-117)
> +#define VERR_CANT_DELETE_DIRECTORY          (-118)
> +#define VERR_NOT_SAME_DEVICE                (-119)
> +#define VERR_FILENAME_TOO_LONG              (-120)
> +#define VERR_MEDIA_NOT_PRESENT              (-121)
> +#define VERR_MEDIA_NOT_RECOGNIZED           (-122)
> +#define VERR_FILE_NOT_LOCKED                (-123)
> +#define VERR_FILE_LOCK_LOST                 (-124)
> +#define VERR_DIR_NOT_EMPTY                  (-125)
> +#define VERR_NOT_A_DIRECTORY                (-126)
> +#define VERR_IS_A_DIRECTORY                 (-127)
> +#define VERR_FILE_TOO_BIG                   (-128)
> +
> +#define VERR_NET_IO_ERROR                       (-400)
> +#define VERR_NET_OUT_OF_RESOURCES               (-401)
> +#define VERR_NET_HOST_NOT_FOUND                 (-402)
> +#define VERR_NET_PATH_NOT_FOUND                 (-403)
> +#define VERR_NET_PRINT_ERROR                    (-404)
> +#define VERR_NET_NO_NETWORK                     (-405)
> +#define VERR_NET_NOT_UNIQUE_NAME                (-406)
> +
> +#define VERR_NET_IN_PROGRESS                    (-436)
> +#define VERR_NET_ALREADY_IN_PROGRESS            (-437)
> +#define VERR_NET_NOT_SOCKET                     (-438)
> +#define VERR_NET_DEST_ADDRESS_REQUIRED          (-439)
> +#define VERR_NET_MSG_SIZE                       (-440)
> +#define VERR_NET_PROTOCOL_TYPE                  (-441)
> +#define VERR_NET_PROTOCOL_NOT_AVAILABLE         (-442)
> +#define VERR_NET_PROTOCOL_NOT_SUPPORTED         (-443)
> +#define VERR_NET_SOCKET_TYPE_NOT_SUPPORTED      (-444)
> +#define VERR_NET_OPERATION_NOT_SUPPORTED        (-445)
> +#define VERR_NET_PROTOCOL_FAMILY_NOT_SUPPORTED  (-446)
> +#define VERR_NET_ADDRESS_FAMILY_NOT_SUPPORTED   (-447)
> +#define VERR_NET_ADDRESS_IN_USE                 (-448)
> +#define VERR_NET_ADDRESS_NOT_AVAILABLE          (-449)
> +#define VERR_NET_DOWN                           (-450)
> +#define VERR_NET_UNREACHABLE                    (-451)
> +#define VERR_NET_CONNECTION_RESET               (-452)
> +#define VERR_NET_CONNECTION_ABORTED             (-453)
> +#define VERR_NET_CONNECTION_RESET_BY_PEER       (-454)
> +#define VERR_NET_NO_BUFFER_SPACE                (-455)
> +#define VERR_NET_ALREADY_CONNECTED              (-456)
> +#define VERR_NET_NOT_CONNECTED                  (-457)
> +#define VERR_NET_SHUTDOWN                       (-458)
> +#define VERR_NET_TOO_MANY_REFERENCES            (-459)
> +#define VERR_NET_CONNECTION_TIMED_OUT           (-460)
> +#define VERR_NET_CONNECTION_REFUSED             (-461)
> +#define VERR_NET_HOST_DOWN                      (-464)
> +#define VERR_NET_HOST_UNREACHABLE               (-465)
> +#define VERR_NET_PROTOCOL_ERROR                 (-466)
> +#define VERR_NET_INCOMPLETE_TX_PACKET           (-467)
> +
> +/* misc. unsorted codes */
> +#define VERR_RESOURCE_BUSY                      (-138)
> +#define VERR_DISK_FULL                          (-152)
> +#define VERR_TOO_MANY_SYMLINKS                  (-156)
> +#define VERR_NO_MORE_FILES                      (-201)
> +#define VERR_INTERNAL_ERROR                     (-225)
> +#define VERR_INTERNAL_ERROR_2                   (-226)
> +#define VERR_INTERNAL_ERROR_3                   (-227)
> +#define VERR_INTERNAL_ERROR_4                   (-228)
> +#define VERR_DEV_IO_ERROR                       (-250)
> +#define VERR_IO_BAD_LENGTH                      (-255)
> +#define VERR_BROKEN_PIPE                        (-301)
> +#define VERR_NO_DATA                            (-304)
> +#define VERR_SEM_DESTROYED                      (-363)
> +#define VERR_DEADLOCK                           (-365)
> +#define VERR_BAD_EXE_FORMAT                     (-608)
> +#define VINF_HGCM_ASYNC_EXECUTE                 (2903)
> +
> +#endif
> diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h
> new file mode 100644
> index 000000000000..1fdabee603fa
> --- /dev/null
> +++ b/include/uapi/linux/vbox_vmmdev_types.h
> @@ -0,0 +1,237 @@
> +/*
> + * Virtual Device for Guest <-> VMM/Host communication, type definitions
> + * which are also used for the vboxguest ioctl interface / by vboxsf
> + *
> + * Copyright (C) 2006-2016 Oracle Corporation
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + *
> + * The contents of this file may alternatively be used under the terms
> + * of the Common Development and Distribution License Version 1.0
> + * (CDDL) only, in which case the provisions of the CDDL are applicable
> + * instead of those of the GPL.
> + *
> + * You may elect to license modified versions of this file under the
> + * terms and conditions of either the GPL or the CDDL or both.
> + */
> +
> +#ifndef __UAPI_VBOX_VMMDEV_TYPES_H__
> +#define __UAPI_VBOX_VMMDEV_TYPES_H__
> +
> +#include <asm/bitsperlong.h>
> +#include <linux/types.h>
> +
> +/*
> + * We cannot use linux' compiletime_assert here because it expects to be used
> + * inside a function only. Use a typedef to a char array with a negative size.
> + */
> +#define VMMDEV_ASSERT_SIZE(type, size) \
> +	typedef char type ## _asrt_size[1 - 2*!!(sizeof(struct type) != (size))]

I wondered about defining a new typedef here, and checkpatch.pl complained about 
it. I think your comment explains it very well.

> +
> +/** enum vmmdev_request_type - VMMDev request types. */
> +enum vmmdev_request_type {
> +	VMMDEVREQ_INVALID_REQUEST              =  0,
> +	VMMDEVREQ_GET_MOUSE_STATUS             =  1,
> +	VMMDEVREQ_SET_MOUSE_STATUS             =  2,
> +	VMMDEVREQ_SET_POINTER_SHAPE            =  3,
> +	VMMDEVREQ_GET_HOST_VERSION             =  4,
> +	VMMDEVREQ_IDLE                         =  5,
> +	VMMDEVREQ_GET_HOST_TIME                = 10,
> +	VMMDEVREQ_GET_HYPERVISOR_INFO          = 20,
> +	VMMDEVREQ_SET_HYPERVISOR_INFO          = 21,
> +	VMMDEVREQ_REGISTER_PATCH_MEMORY        = 22, /* since version 3.0.6 */
> +	VMMDEVREQ_DEREGISTER_PATCH_MEMORY      = 23, /* since version 3.0.6 */
> +	VMMDEVREQ_SET_POWER_STATUS             = 30,
> +	VMMDEVREQ_ACKNOWLEDGE_EVENTS           = 41,
> +	VMMDEVREQ_CTL_GUEST_FILTER_MASK        = 42,
> +	VMMDEVREQ_REPORT_GUEST_INFO            = 50,
> +	VMMDEVREQ_REPORT_GUEST_INFO2           = 58, /* since version 3.2.0 */
> +	VMMDEVREQ_REPORT_GUEST_STATUS          = 59, /* since version 3.2.8 */
> +	VMMDEVREQ_REPORT_GUEST_USER_STATE      = 74, /* since version 4.3 */
> +	/* Retrieve a display resize request sent by the host, deprecated. */
> +	VMMDEVREQ_GET_DISPLAY_CHANGE_REQ       = 51,
> +	VMMDEVREQ_VIDEMODE_SUPPORTED           = 52,
> +	VMMDEVREQ_GET_HEIGHT_REDUCTION         = 53,
> +	/**
> +	 * @VMMDEVREQ_GET_DISPLAY_CHANGE_REQ2:
> +	 * Retrieve a display resize request sent by the host.
> +	 *
> +	 * Queries a display resize request sent from the host.  If the
> +	 * event_ack member is sent to true and there is an unqueried request
> +	 * available for one of the virtual display then that request will
> +	 * be returned.  If several displays have unqueried requests the lowest
> +	 * numbered display will be chosen first.  Only the most recent unseen
> +	 * request for each display is remembered.
> +	 * If event_ack is set to false, the last host request queried with
> +	 * event_ack set is resent, or failing that the most recent received
> +	 * from the host.  If no host request was ever received then all zeros
> +	 * are returned.
> +	 */
> +	VMMDEVREQ_GET_DISPLAY_CHANGE_REQ2      = 54,
> +	VMMDEVREQ_REPORT_GUEST_CAPABILITIES    = 55,
> +	VMMDEVREQ_SET_GUEST_CAPABILITIES       = 56,
> +	VMMDEVREQ_VIDEMODE_SUPPORTED2          = 57, /* since version 3.2.0 */
> +	VMMDEVREQ_GET_DISPLAY_CHANGE_REQEX     = 80, /* since version 4.2.4 */
> +	VMMDEVREQ_HGCM_CONNECT                 = 60,
> +	VMMDEVREQ_HGCM_DISCONNECT              = 61,
> +	VMMDEVREQ_HGCM_CALL32                  = 62,
> +	VMMDEVREQ_HGCM_CALL64                  = 63,
> +	VMMDEVREQ_HGCM_CANCEL                  = 64,
> +	VMMDEVREQ_HGCM_CANCEL2                 = 65,
> +	VMMDEVREQ_VIDEO_ACCEL_ENABLE           = 70,
> +	VMMDEVREQ_VIDEO_ACCEL_FLUSH            = 71,
> +	VMMDEVREQ_VIDEO_SET_VISIBLE_REGION     = 72,
> +	VMMDEVREQ_GET_SEAMLESS_CHANGE_REQ      = 73,
> +	VMMDEVREQ_QUERY_CREDENTIALS            = 100,
> +	VMMDEVREQ_REPORT_CREDENTIALS_JUDGEMENT = 101,
> +	VMMDEVREQ_REPORT_GUEST_STATS           = 110,
> +	VMMDEVREQ_GET_MEMBALLOON_CHANGE_REQ    = 111,
> +	VMMDEVREQ_GET_STATISTICS_CHANGE_REQ    = 112,
> +	VMMDEVREQ_CHANGE_MEMBALLOON            = 113,
> +	VMMDEVREQ_GET_VRDPCHANGE_REQ           = 150,
> +	VMMDEVREQ_LOG_STRING                   = 200,
> +	VMMDEVREQ_GET_CPU_HOTPLUG_REQ          = 210,
> +	VMMDEVREQ_SET_CPU_HOTPLUG_STATUS       = 211,
> +	VMMDEVREQ_REGISTER_SHARED_MODULE       = 212,
> +	VMMDEVREQ_UNREGISTER_SHARED_MODULE     = 213,
> +	VMMDEVREQ_CHECK_SHARED_MODULES         = 214,
> +	VMMDEVREQ_GET_PAGE_SHARING_STATUS      = 215,
> +	VMMDEVREQ_DEBUG_IS_PAGE_SHARED         = 216,
> +	VMMDEVREQ_GET_SESSION_ID               = 217, /* since version 3.2.8 */
> +	VMMDEVREQ_WRITE_COREDUMP               = 218,
> +	VMMDEVREQ_GUEST_HEARTBEAT              = 219,
> +	VMMDEVREQ_HEARTBEAT_CONFIGURE          = 220,
> +	/* Ensure the enum is a 32 bit data-type */
> +	VMMDEVREQ_SIZEHACK                     = 0x7fffffff
> +};
> +
> +#if __BITS_PER_LONG == 64
> +#define VMMDEVREQ_HGCM_CALL VMMDEVREQ_HGCM_CALL64
> +#else
> +#define VMMDEVREQ_HGCM_CALL VMMDEVREQ_HGCM_CALL32
> +#endif
> +
> +/** HGCM service location types. */
> +enum vmmdev_hgcm_service_location_type {
> +	VMMDEV_HGCM_LOC_INVALID    = 0,
> +	VMMDEV_HGCM_LOC_LOCALHOST  = 1,
> +	VMMDEV_HGCM_LOC_LOCALHOST_EXISTING = 2,
> +	/* Ensure the enum is a 32 bit data-type */
> +	VMMDEV_HGCM_LOC_SIZEHACK   = 0x7fffffff
> +};
> +
> +/** HGCM host service location. */
> +struct vmmdev_hgcm_service_location_localhost {
> +	/** Service name */
> +	char service_name[128];
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_service_location_localhost, 128);
> +
> +/** HGCM service location. */
> +struct vmmdev_hgcm_service_location {
> +	/** Type of the location. */
> +	enum vmmdev_hgcm_service_location_type type;
> +
> +	union {
> +		struct vmmdev_hgcm_service_location_localhost localhost;
> +	} u;
> +};

This union only has one member. Is there some reason to keep the union here?

> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_service_location, 128 + 4);
> +
> +/** HGCM function parameter type. */
> +enum vmmdev_hgcm_function_parameter_type {
> +	VMMDEV_HGCM_PARM_TYPE_INVALID            = 0,
> +	VMMDEV_HGCM_PARM_TYPE_32BIT              = 1,
> +	VMMDEV_HGCM_PARM_TYPE_64BIT              = 2,
> +	/** Deprecated Doesn't work, use PAGELIST. */
> +	VMMDEV_HGCM_PARM_TYPE_PHYSADDR           = 3,
> +	/** In and Out, user-memory */
> +	VMMDEV_HGCM_PARM_TYPE_LINADDR            = 4,
> +	/** In, user-memory  (read;  host<-guest) */
> +	VMMDEV_HGCM_PARM_TYPE_LINADDR_IN         = 5,
> +	/** Out, user-memory (write; host->guest) */
> +	VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT        = 6,
> +	/** In and Out, kernel-memory */
> +	VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL     = 7,
> +	/** In, kernel-memory  (read;  host<-guest) */
> +	VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN  = 8,
> +	/** Out, kernel-memory (write; host->guest) */
> +	VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT = 9,
> +	/** Physical addresses of locked pages for a buffer. */
> +	VMMDEV_HGCM_PARM_TYPE_PAGELIST           = 10,
> +	/* Ensure the enum is a 32 bit data-type */
> +	VMMDEV_HGCM_PARM_TYPE_SIZEHACK           = 0x7fffffff
> +};
> +
> +/** HGCM function parameter, 32-bit client. */
> +struct vmmdev_hgcm_function_parameter32 {
> +	enum vmmdev_hgcm_function_parameter_type type;
> +	union {
> +		__u32 value32;
> +		__u64 value64;
> +		struct {
> +			__u32 size;
> +			union {
> +				__u32 phys_addr;
> +				__u32 linear_addr;
> +			} u;
> +		} pointer;
> +		struct {
> +			/** Size of the buffer described by the page list. */
> +			__u32 size;
> +			/** Relative to the request header. */
> +			__u32 offset;
> +		} page_list;
> +	} u;
> +} __packed;
> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8);
> +
> +/** HGCM function parameter, 64-bit client. */
> +struct vmmdev_hgcm_function_parameter64 {
> +	enum vmmdev_hgcm_function_parameter_type type;
> +	union {
> +		__u32 value32;
> +		__u64 value64;
> +		struct {
> +			__u32 size;
> +			union {
> +				__u64 phys_addr;
> +				__u64 linear_addr;
> +			} u;
> +		} __packed pointer;
> +		struct {
> +			/** Size of the buffer described by the page list. */
> +			__u32 size;
> +			/** Relative to the request header. */
> +			__u32 offset;
> +		} page_list;
> +	} __packed u;
> +} __packed;
> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter64, 4 + 12);
> +
> +#if __BITS_PER_LONG == 64
> +#define vmmdev_hgcm_function_parameter vmmdev_hgcm_function_parameter64
> +#else
> +#define vmmdev_hgcm_function_parameter vmmdev_hgcm_function_parameter32
> +#endif
> +
> +#define VMMDEV_HGCM_F_PARM_DIRECTION_NONE      0x00000000U
> +#define VMMDEV_HGCM_F_PARM_DIRECTION_TO_HOST   0x00000001U
> +#define VMMDEV_HGCM_F_PARM_DIRECTION_FROM_HOST 0x00000002U
> +#define VMMDEV_HGCM_F_PARM_DIRECTION_BOTH      0x00000003U
> +
> +/**
> + * struct vmmdev_hgcm_pagelist - VMMDEV_HGCM_PARM_TYPE_PAGELIST parameters
> + * point to this structure to actually describe the buffer.
> + */
> +struct vmmdev_hgcm_pagelist {
> +	__u32 flags;             /** VMMDEV_HGCM_F_PARM_*. */
> +	__u16 offset_first_page; /** Data offset in the first page. */
> +	__u16 page_count;        /** Number of pages. */
> +	__u64 pages[1];          /** Page addresses. */
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_pagelist, 4 + 2 + 2 + 8);
> +
> +#endif
> diff --git a/include/uapi/linux/vboxguest.h b/include/uapi/linux/vboxguest.h
> new file mode 100644
> index 000000000000..d201eb080df2
> --- /dev/null
> +++ b/include/uapi/linux/vboxguest.h
> @@ -0,0 +1,341 @@
> +/*
> + * VBoxGuest - VirtualBox Guest Additions Driver Interface.
> + *
> + * Copyright (C) 2006-2016 Oracle Corporation
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + *
> + * The contents of this file may alternatively be used under the terms
> + * of the Common Development and Distribution License Version 1.0
> + * (CDDL) only, in which case the provisions of the CDDL are applicable
> + * instead of those of the GPL.
> + *
> + * You may elect to license modified versions of this file under the
> + * terms and conditions of either the GPL or the CDDL or both.
> + */
> +
> +#ifndef __UAPI_VBOXGUEST_H__
> +#define __UAPI_VBOXGUEST_H__
> +
> +#include <asm/bitsperlong.h>
> +#include <linux/ioctl.h>
> +#include <linux/vbox_err.h>
> +#include <linux/vbox_vmmdev_types.h>
> +
> +/* Version of vbg_ioctl_hdr structure. */
> +#define VBG_IOCTL_HDR_VERSION		0x10001
> +/* Default request type.  Use this for non-VMMDev requests. */
> +#define VBG_IOCTL_HDR_TYPE_DEFAULT		0
> +
> +/**
> + * Common ioctl header.
> + *
> + * This is a mirror of vmmdev_request_header to prevent duplicating data and
> + * needing to verify things multiple times.
> + */
> +struct vbg_ioctl_hdr {
> +	/** IN: The request input size, and output size if size_out is zero. */
> +	__u32 size_in;
> +	/** IN: Structure version (VBG_IOCTL_HDR_VERSION) */
> +	__u32 version;
> +	/** IN: The VMMDev request type or VBG_IOCTL_HDR_TYPE_DEFAULT. */
> +	__u32 type;
> +	/**
> +	 * OUT: The VBox status code of the operation, out direction only.
> +	 * This is a VINF_ or VERR_ value as defined in vbox_err.h.
> +	 */
> +	__s32 rc;
> +	/** IN: Output size. Set to zero to use size_in as output size. */
> +	__u32 size_out;
> +	/** Reserved, MBZ. */
> +	__u32 reserved;
> +};
> +VMMDEV_ASSERT_SIZE(vbg_ioctl_hdr, 24);
> +
> +
> +/*
> + * The VBoxGuest I/O control version.
> + *
> + * As usual, the high word contains the major version and changes to it
> + * signifies incompatible changes.
> + *
> + * The lower word is the minor version number, it is increased when new
> + * functions are added or existing changed in a backwards compatible manner.
> + */
> +#define VBG_IOC_VERSION		0x00010000u
> +
> +/**
> + * VBG_IOCTL_DRIVER_VERSION_INFO data structure
> + *
> + * Note VBG_IOCTL_DRIVER_VERSION_INFO may switch the session to a backwards
> + * compatible interface version if uClientVersion indicates older client code.
> + */
> +struct vbg_ioctl_driver_version_info {
> +	/** The header. */
> +	struct vbg_ioctl_hdr hdr;
> +	union {
> +		struct {
> +			/** Requested interface version (VBG_IOC_VERSION). */
> +			__u32 req_version;
> +			/**
> +			 * Minimum interface version number (typically the
> +			 * major version part of VBG_IOC_VERSION).
> +			 */
> +			__u32 min_version;
> +			/** Reserved, MBZ. */
> +			__u32 reserved1;
> +			/** Reserved, MBZ. */
> +			__u32 reserved2;
> +		} in;
> +		struct {
> +			/** Version for this session (typ. VBG_IOC_VERSION). */
> +			__u32 session_version;
> +			/** Version of the IDC interface (VBG_IOC_VERSION). */
> +			__u32 driver_version;
> +			/** The SVN revision of the driver, or 0. */
> +			__u32 driver_revision;
> +			/** Reserved \#1 (zero until defined). */
> +			__u32 reserved1;
> +			/** Reserved \#2 (zero until defined). */
> +			__u32 reserved2;
> +		} out;
> +	} u;
> +};
> +VMMDEV_ASSERT_SIZE(vbg_ioctl_driver_version_info, 24 + 20);
> +
> +#define VBG_IOCTL_DRIVER_VERSION_INFO \
> +	_IOWR('V', 0, struct vbg_ioctl_driver_version_info)
> +
> +
> +/* IOCTL to perform a VMM Device request less than 1KB in size. */
> +#define VBG_IOCTL_VMMDEV_REQUEST(s)	_IOC(_IOC_READ | _IOC_WRITE, 'V', 2, s)
> +
> +
> +/* IOCTL to perform a VMM Device request larger then 1KB. */
> +#define VBG_IOCTL_VMMDEV_REQUEST_BIG	_IOC(_IOC_READ | _IOC_WRITE, 'V', 3, 0)
> +
> +
> +/** VBG_IOCTL_HGCM_CONNECT data structure. */
> +struct vbg_ioctl_hgcm_connect {
> +	struct vbg_ioctl_hdr hdr;
> +	union {
> +		struct {
> +			struct vmmdev_hgcm_service_location loc;
> +		} in;
> +		struct {
> +			__u32 client_id;
> +		} out;
> +	} u;
> +};
> +VMMDEV_ASSERT_SIZE(vbg_ioctl_hgcm_connect, 24 + 132);
> +
> +#define VBG_IOCTL_HGCM_CONNECT \
> +	_IOWR('V', 4, struct vbg_ioctl_hgcm_connect)
> +
> +
> +/** VBG_IOCTL_HGCM_DISCONNECT data structure. */
> +struct vbg_ioctl_hgcm_disconnect {
> +	struct vbg_ioctl_hdr hdr;
> +	union {
> +		struct {
> +			__u32 client_id;
> +		} in;
> +	} u;
> +};

Another single-member union.

> +VMMDEV_ASSERT_SIZE(vbg_ioctl_hgcm_disconnect, 24 + 4);
> +
> +#define VBG_IOCTL_HGCM_DISCONNECT \
> +	_IOWR('V', 5, struct vbg_ioctl_hgcm_disconnect)
> +
> +
> +/** VBG_IOCTL_HGCM_CALL data structure. */
> +struct vbg_ioctl_hgcm_call {
> +	/** The header. */
> +	struct vbg_ioctl_hdr hdr;
> +	/** Input: The id of the caller. */
> +	__u32 client_id;
> +	/** Input: Function number. */
> +	__u32 function;
> +	/**
> +	 * Input: How long to wait (milliseconds) for completion before
> +	 * cancelling the call. Set to -1 to wait indefinitely.
> +	 */
> +	__u32 timeout_ms;
> +	/** Interruptable flag, ignored for userspace calls. */
> +	__u8 interruptible;
> +	/** Explicit padding, MBZ. */
> +	__u8 reserved;
> +	/**
> +	 * Input: How many parameters following this structure.
> +	 *
> +	 * The parameters are either HGCMFunctionParameter64 or 32,
> +	 * depending on whether we're receiving a 64-bit or 32-bit request.
> +	 *
> +	 * The current maximum is 61 parameters (given a 1KB max request size,
> +	 * and a 64-bit parameter size of 16 bytes).
> +	 */
> +	__u16 parm_count;
> +	/*
> +	 * Parameters follow in form:
> +	 * struct hgcm_function_parameter<32|64> parms[parm_count]
> +	 */
> +};
> +VMMDEV_ASSERT_SIZE(vbg_ioctl_hgcm_call, 24 + 16);
> +
> +#define VBG_IOCTL_HGCM_CALL_32(s)	_IOC(_IOC_READ | _IOC_WRITE, 'V', 6, s)
> +#define VBG_IOCTL_HGCM_CALL_64(s)	_IOC(_IOC_READ | _IOC_WRITE, 'V', 7, s)
> +#if __BITS_PER_LONG == 64
> +#define VBG_IOCTL_HGCM_CALL(s)		VBG_IOCTL_HGCM_CALL_64(s)
> +#else
> +#define VBG_IOCTL_HGCM_CALL(s)		VBG_IOCTL_HGCM_CALL_32(s)
> +#endif
> +
> +
> +/** VBG_IOCTL_LOG data structure. */
> +struct vbg_ioctl_log {
> +	/** The header. */
> +	struct vbg_ioctl_hdr hdr;
> +	union {
> +		struct {
> +			/**
> +			 * The log message, this may be zero terminated. If it
> +			 * is not zero terminated then the length is determined
> +			 * from the input size.
> +			 */
> +			char msg[1];
> +		} in;
> +	} u;
> +};

Amother single-member union.

> +
> +#define VBG_IOCTL_LOG(s)		_IOC(_IOC_READ | _IOC_WRITE, 'V', 9, s)
> +
> +
> +/** VBG_IOCTL_WAIT_FOR_EVENTS data structure. */
> +struct vbg_ioctl_wait_for_events {
> +	/** The header. */
> +	struct vbg_ioctl_hdr hdr;
> +	union {
> +		struct {
> +			/** Timeout in milliseconds. */
> +			__u32 timeout_ms;
> +			/** Events to wait for. */
> +			__u32 events;
> +		} in;
> +		struct {
> +			/** Events that occurred. */
> +			__u32 events;
> +		} out;
> +	} u;
> +};
> +VMMDEV_ASSERT_SIZE(vbg_ioctl_wait_for_events, 24 + 8);
> +
> +#define VBG_IOCTL_WAIT_FOR_EVENTS \
> +	_IOWR('V', 10, struct vbg_ioctl_wait_for_events)
> +
> +
> +/*
> + * IOCTL to VBoxGuest to interrupt (cancel) any pending
> + * VBG_IOCTL_WAIT_FOR_EVENTS and return.
> + *
> + * Handled inside the vboxguest driver and not seen by the host at all.
> + * After calling this, VBG_IOCTL_WAIT_FOR_EVENTS should no longer be called in
> + * the same session. Any VBOXGUEST_IOCTL_WAITEVENT calls in the same session
> + * done after calling this will directly exit with -EINTR.
> + */
> +#define VBG_IOCTL_INTERRUPT_ALL_WAIT_FOR_EVENTS \
> +	_IOWR('V', 11, struct vbg_ioctl_hdr)
> +
> +
> +/** VBG_IOCTL_CHANGE_FILTER_MASK data structure. */
> +struct vbg_ioctl_change_filter {
> +	/** The header. */
> +	struct vbg_ioctl_hdr hdr;
> +	union {
> +		struct {
> +			/** Flags to set. */
> +			__u32 or_mask;
> +			/** Flags to remove. */
> +			__u32 not_mask;
> +		} in;
> +	} u;
> +};

Amother single-member union.

> +VMMDEV_ASSERT_SIZE(vbg_ioctl_change_filter, 24 + 8);
> +
> +/* IOCTL to VBoxGuest to control the event filter mask. */
> +#define VBG_IOCTL_CHANGE_FILTER_MASK \
> +	_IOWR('V', 12, struct vbg_ioctl_change_filter)
> +
> +
> +/** VBG_IOCTL_CHANGE_GUEST_CAPABILITIES data structure. */
> +struct vbg_ioctl_set_guest_caps {
> +	/** The header. */
> +	struct vbg_ioctl_hdr hdr;
> +	union {
> +		struct {
> +			/** Capabilities to set (VMMDEV_GUEST_SUPPORTS_XXX). */
> +			__u32 or_mask;
> +			/** Capabilities to drop (VMMDEV_GUEST_SUPPORTS_XXX). */
> +			__u32 not_mask;
> +		} in;
> +		struct {
> +			/** Capabilities held by the session after the call. */
> +			__u32 session_caps;
> +			/** Capabilities for all the sessions after the call. */
> +			__u32 global_caps;
> +		} out;
> +	} u;
> +};
> +VMMDEV_ASSERT_SIZE(vbg_ioctl_set_guest_caps, 24 + 8);
> +
> +#define VBG_IOCTL_CHANGE_GUEST_CAPABILITIES \
> +	_IOWR('V', 14, struct vbg_ioctl_set_guest_caps)
> +
> +
> +/** VBG_IOCTL_CHECK_BALLOON data structure. */
> +struct vbg_ioctl_check_balloon {
> +	/** The header. */
> +	struct vbg_ioctl_hdr hdr;
> +	union {
> +		struct {
> +			/** The size of the balloon in chunks of 1MB. */
> +			__u32 balloon_chunks;
> +			/**
> +			 * false = handled in R0, no further action required.
> +			 *  true = allocate balloon memory in R3.
> +			 */
> +			__u8 handle_in_r3;
> +			/** Explicit padding, MBZ. */
> +			__u8 padding[3];
> +		} out;
> +	} u;
> +};
> +VMMDEV_ASSERT_SIZE(vbg_ioctl_check_balloon, 24 + 8);
> +
> +/*
> + * IOCTL to check memory ballooning.
> + *
> + * The guest kernel module will ask the host for the current size of the
> + * balloon and adjust the size. Or it will set handle_in_r3 = true and R3 is
> + * responsible for allocating memory and calling VBG_IOCTL_CHANGE_BALLOON.
> + */
> +#define VBG_IOCTL_CHECK_BALLOON \
> +	_IOWR('V', 17, struct vbg_ioctl_check_balloon)
> +
> +
> +/** VBG_IOCTL_WRITE_CORE_DUMP data structure. */
> +struct vbg_ioctl_write_coredump {
> +	struct vbg_ioctl_hdr hdr;
> +	union {
> +		struct {
> +			__u32 flags; /** Flags (reserved, MBZ). */
> +		} in;
> +	} u;
> +};
> +VMMDEV_ASSERT_SIZE(vbg_ioctl_write_coredump, 24 + 4);

Another single-member union.


> +
> +#define VBG_IOCTL_WRITE_CORE_DUMP \
> +	_IOWR('V', 19, struct vbg_ioctl_write_coredump)
> +
> +#endif
> 

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH resend v2 3/3] virt: Add vboxguest driver for Virtual Box Guest integration
  2017-11-26 15:12 ` [PATCH resend v2 3/3] virt: Add vboxguest driver for Virtual Box Guest integration Hans de Goede
@ 2017-11-27 19:46   ` Larry Finger
  2017-11-29 14:16     ` Hans de Goede
  0 siblings, 1 reply; 14+ messages in thread
From: Larry Finger @ 2017-11-27 19:46 UTC (permalink / raw)
  To: Hans de Goede, Arnd Bergmann, Greg Kroah-Hartman
  Cc: Michael Thayer, Knut St . Osmundsen, Christoph Hellwig, linux-kernel

On 11/26/2017 09:12 AM, Hans de Goede wrote:
> This commit adds a driver for the Virtual Box Guest PCI device used in
> Virtual Box virtual machines. Enabling this driver will add support for
> Virtual Box Guest integration features such as copy-and-paste, seamless
> mode and OpenGL pass-through.
> 
> This driver also offers vboxguest IPC functionality which is needed
> for the vboxfs driver which offers folder sharing support.
> 
> Signed-off-by: Hans de Goede <hdegoede@redhat.com>

Reviewed-by: Larry Finger <Larry.Finger.net>


Smatch lists the following:

   CHECK   drivers/virt/vboxguest/vboxguest_core.c
drivers/virt/vboxguest/vboxguest_core.c:604 vbg_set_session_event_filter() 
error: we previously assumed 'req' could be null (see line 585)
drivers/virt/vboxguest/vboxguest_core.c:606 vbg_set_session_event_filter() warn: 
variable dereferenced before check 'req' (see line 604)
drivers/virt/vboxguest/vboxguest_core.c:698 vbg_set_session_capabilities() 
error: we previously assumed 'req' could be null (see line 679)
drivers/virt/vboxguest/vboxguest_core.c:700 vbg_set_session_capabilities() warn: 
variable dereferenced before check 'req' (see line 698)

vbox_utils.c is clean.

The reasons for the above errors, and other comments inline below.

> ---
> Changes in v2:
> -Change all uapi headers to kernel coding style: Drop struct and enum typedefs
>   make type and struct-member names all lowercase, enum values all uppercase.
> -Remove unused struct type declarations from some headers (shaving of another
>   1000 lines)
> -Remove or fixup doxygen style comments
> -Get rid of CHECK macros, use a function taking in_ and out_size args instead
> -Some other small codyingstyle fixes
> -Split into multiple patches
> ---
>   drivers/virt/Kconfig                       |    1 +
>   drivers/virt/Makefile                      |    1 +
>   drivers/virt/vboxguest/Kconfig             |   16 +
>   drivers/virt/vboxguest/Makefile            |    3 +
>   drivers/virt/vboxguest/vboxguest_core.c    | 1577 ++++++++++++++++++++++++++++
>   drivers/virt/vboxguest/vboxguest_core.h    |  187 ++++
>   drivers/virt/vboxguest/vboxguest_linux.c   |  469 +++++++++
>   drivers/virt/vboxguest/vboxguest_version.h |   18 +
>   8 files changed, 2272 insertions(+)
>   create mode 100644 drivers/virt/vboxguest/Kconfig
>   create mode 100644 drivers/virt/vboxguest/Makefile
>   create mode 100644 drivers/virt/vboxguest/vboxguest_core.c
>   create mode 100644 drivers/virt/vboxguest/vboxguest_core.h
>   create mode 100644 drivers/virt/vboxguest/vboxguest_linux.c
>   create mode 100644 drivers/virt/vboxguest/vboxguest_version.h
> 
> diff --git a/drivers/virt/Kconfig b/drivers/virt/Kconfig
> index 99ebdde590f8..8d9cdfbd6bcc 100644
> --- a/drivers/virt/Kconfig
> +++ b/drivers/virt/Kconfig
> @@ -30,4 +30,5 @@ config FSL_HV_MANAGER
>             4) A kernel interface for receiving callbacks when a managed
>   	     partition shuts down.
>   
> +source "drivers/virt/vboxguest/Kconfig"
>   endif
> diff --git a/drivers/virt/Makefile b/drivers/virt/Makefile
> index c47f04dd343b..d3f7b2540890 100644
> --- a/drivers/virt/Makefile
> +++ b/drivers/virt/Makefile
> @@ -3,3 +3,4 @@
>   #
>   
>   obj-$(CONFIG_FSL_HV_MANAGER)	+= fsl_hypervisor.o
> +obj-y				+= vboxguest/
> diff --git a/drivers/virt/vboxguest/Kconfig b/drivers/virt/vboxguest/Kconfig
> new file mode 100644
> index 000000000000..e88ee46c31d4
> --- /dev/null
> +++ b/drivers/virt/vboxguest/Kconfig
> @@ -0,0 +1,16 @@
> +config VBOXGUEST
> +	tristate "Virtual Box Guest integration support"
> +	depends on X86 && PCI && INPUT
> +	help
> +	  This is a driver for the Virtual Box Guest PCI device used in
> +	  Virtual Box virtual machines. Enabling this driver will add
> +	  support for Virtual Box Guest integration features such as
> +	  copy-and-paste, seamless mode and OpenGL pass-through.
> +
> +	  This driver also offers vboxguest IPC functionality which is needed
> +	  for the vboxfs driver which offers folder sharing support.
> +
> +	  Although it is possible to build this module in, it is advised
> +	  to build this driver as a module, so that it can be updated
> +	  independently of the kernel. Select M to build this driver as a
> +	  module.

This Kconfig allows vboxguest to be built even though vboxvideo is not being 
built. That does not seem to be a useful combination.

> diff --git a/drivers/virt/vboxguest/Makefile b/drivers/virt/vboxguest/Makefile
> new file mode 100644
> index 000000000000..203b8f465817
> --- /dev/null
> +++ b/drivers/virt/vboxguest/Makefile
> @@ -0,0 +1,3 @@
> +vboxguest-y := vboxguest_linux.o vboxguest_core.o vboxguest_utils.o
> +
> +obj-$(CONFIG_VBOXGUEST) += vboxguest.o
> diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
> new file mode 100644
> index 000000000000..4927c0d3e336
> --- /dev/null
> +++ b/drivers/virt/vboxguest/vboxguest_core.c
> @@ -0,0 +1,1577 @@
> +/*
> + * vboxguest core guest-device handling code, VBoxGuest.cpp in upstream svn.
> + *
> + * Copyright (C) 2007-2016 Oracle Corporation
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + *
> + * The contents of this file may alternatively be used under the terms
> + * of the Common Development and Distribution License Version 1.0
> + * (CDDL) only, in which case the provisions of the CDDL are applicable
> + * instead of those of the GPL.
> + *
> + * You may elect to license modified versions of this file under the
> + * terms and conditions of either the GPL or the CDDL or both.
> + */
> +
> +#include <linux/device.h>
> +#include <linux/mm.h>
> +#include <linux/sched.h>
> +#include <linux/sizes.h>
> +#include <linux/slab.h>
> +#include <linux/vbox_err.h>
> +#include <linux/vbox_utils.h>
> +#include <linux/vmalloc.h>
> +#include "vboxguest_core.h"
> +#include "vboxguest_version.h"
> +
> +/* Get the pointer to the first HGCM parameter. */
> +#define VBG_IOCTL_HGCM_CALL_PARMS(a) \
> +	((struct vmmdev_hgcm_function_parameter *)( \
> +		(u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call)))
> +/* Get the pointer to the first HGCM parameter in a 32-bit request. */
> +#define VBG_IOCTL_HGCM_CALL_PARMS32(a) \
> +	((struct vmmdev_hgcm_function_parameter32 *)( \
> +		(u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call)))
> +
> +#define GUEST_MAPPINGS_TRIES	5
> +
> +/**
> + * Reserves memory in which the VMM can relocate any guest mappings
> + * that are floating around.
> + *
> + * This operation is a little bit tricky since the VMM might not accept
> + * just any address because of address clashes between the three contexts
> + * it operates in, so we try several times.
> + *
> + * Failure to reserve the guest mappings is ignored.
> + *
> + * @gdev:		The Guest extension device.
> + */
> +static void vbg_guest_mappings_init(struct vbg_dev *gdev)
> +{
> +	struct vmmdev_hypervisorinfo *req;
> +	void *guest_mappings[GUEST_MAPPINGS_TRIES];
> +	struct page **pages = NULL;
> +	u32 size, hypervisor_size;
> +	int i, rc;
> +
> +	/* Query the required space. */
> +	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HYPERVISOR_INFO);
> +	if (!req)
> +		return;
> +
> +	req->hypervisor_start = 0;
> +	req->hypervisor_size = 0;
> +	rc = vbg_req_perform(gdev, req);
> +	if (rc < 0)
> +		goto out;
> +
> +	/*
> +	 * The VMM will report back if there is nothing it wants to map, like
> +	 * for instance in VT-x and AMD-V mode.
> +	 */
> +	if (req->hypervisor_size == 0)
> +		goto out;
> +
> +	hypervisor_size = req->hypervisor_size;
> +	/* Add 4M so that we can align the vmap to 4MiB as the host requires. */
> +	size = PAGE_ALIGN(req->hypervisor_size) + SZ_4M;
> +
> +	pages = kmalloc(sizeof(*pages) * (size >> PAGE_SHIFT), GFP_KERNEL);
> +	if (!pages)
> +		goto out;
> +
> +	gdev->guest_mappings_dummy_page = alloc_page(GFP_HIGHUSER);
> +	if (!gdev->guest_mappings_dummy_page)
> +		goto out;
> +
> +	for (i = 0; i < (size >> PAGE_SHIFT); i++)
> +		pages[i] = gdev->guest_mappings_dummy_page;
> +
> +	/* Try several times, the host can be picky about certain addresses. */

This comment should repeat that address clashes could be due to the different 
contexts. When I read this the first time, I had missed the comment above, and I 
expect that other readers might make the same mistake.


> +	for (i = 0; i < GUEST_MAPPINGS_TRIES; i++) {
> +		guest_mappings[i] = vmap(pages, (size >> PAGE_SHIFT),
> +					 VM_MAP, PAGE_KERNEL_RO);
> +		if (!guest_mappings[i])
> +			break;
> +
> +		req->header.request_type = VMMDEVREQ_SET_HYPERVISOR_INFO;
> +		req->header.rc = VERR_INTERNAL_ERROR;
> +		req->hypervisor_size = hypervisor_size;
> +		req->hypervisor_start =
> +			(unsigned long)PTR_ALIGN(guest_mappings[i], SZ_4M);
> +
> +		rc = vbg_req_perform(gdev, req);
> +		if (rc >= 0) {
> +			gdev->guest_mappings = guest_mappings[i];
> +			break;
> +		}
> +	}
> +
> +	/* Free vmap's from failed attempts. */
> +	while (--i >= 0)
> +		vunmap(guest_mappings[i]);
> +
> +	/* On failure free the dummy-page backing the vmap */
> +	if (!gdev->guest_mappings) {
> +		__free_page(gdev->guest_mappings_dummy_page);
> +		gdev->guest_mappings_dummy_page = NULL;
> +	}
> +
> +out:
> +	kfree(req);
> +	kfree(pages);
> +}
> +
> +/**
> + * Undo what vbg_guest_mappings_init did.
> + *
> + * @gdev:		The Guest extension device.
> + */
> +static void vbg_guest_mappings_exit(struct vbg_dev *gdev)
> +{
> +	struct vmmdev_hypervisorinfo *req;
> +	int rc;
> +
> +	if (!gdev->guest_mappings)
> +		return;
> +
> +	/*
> +	 * Tell the host that we're going to free the memory we reserved for
> +	 * it, the free it up. (Leak the memory if anything goes wrong here.)
> +	 */
> +	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_HYPERVISOR_INFO);
> +	if (!req)
> +		return;
> +
> +	req->hypervisor_start = 0;
> +	req->hypervisor_size = 0;
> +
> +	rc = vbg_req_perform(gdev, req);
> +
> +	kfree(req);
> +
> +	if (rc < 0) {
> +		vbg_err("%s error: %d\n", __func__, rc);
> +		return;
> +	}
> +
> +	vunmap(gdev->guest_mappings);
> +	gdev->guest_mappings = NULL;
> +
> +	__free_page(gdev->guest_mappings_dummy_page);
> +	gdev->guest_mappings_dummy_page = NULL;
> +}
> +
> +/**
> + * Report the guest information to the host.
> + * Return: 0 or negative errno value.
> + * @gdev:		The Guest extension device.
> + */
> +static int vbg_report_guest_info(struct vbg_dev *gdev)
> +{
> +	/*
> +	 * Allocate and fill in the two guest info reports.
> +	 */
> +	struct vmmdev_guest_info *req1 = NULL;
> +	struct vmmdev_guest_info2 *req2 = NULL;
> +	int rc, ret = -ENOMEM;
> +
> +	req1 = vbg_req_alloc(sizeof(*req1), VMMDEVREQ_REPORT_GUEST_INFO);
> +	req2 = vbg_req_alloc(sizeof(*req2), VMMDEVREQ_REPORT_GUEST_INFO2);
> +	if (!req1 || !req2)
> +		goto out_free;
> +
> +	req1->interface_version = VMMDEV_VERSION;
> +	req1->os_type = VMMDEV_OSTYPE_LINUX26;
> +#if __BITS_PER_LONG == 64
> +	req1->os_type |= VMMDEV_OSTYPE_X64;
> +#endif
> +
> +	req2->additions_major = VBG_VERSION_MAJOR;
> +	req2->additions_minor = VBG_VERSION_MINOR;
> +	req2->additions_build = VBG_VERSION_BUILD;
> +	req2->additions_revision = VBG_SVN_REV;
> +	/* (no features defined yet) */
> +	req2->additions_features = 0;
> +	strlcpy(req2->name, VBG_VERSION_STRING,
> +		sizeof(req2->name));
> +
> +	/*
> +	 * There are two protocols here:
> +	 *      1. INFO2 + INFO1. Supported by >=3.2.51.
> +	 *      2. INFO1 and optionally INFO2. The old protocol.
> +	 *
> +	 * We try protocol 2 first.  It will fail with VERR_NOT_SUPPORTED
> +	 * if not supported by the VMMDev (message ordering requirement).
> +	 */
> +	rc = vbg_req_perform(gdev, req2);
> +	if (rc >= 0) {
> +		rc = vbg_req_perform(gdev, req1);
> +	} else if (rc == VERR_NOT_SUPPORTED || rc == VERR_NOT_IMPLEMENTED) {
> +		rc = vbg_req_perform(gdev, req1);
> +		if (rc >= 0) {
> +			rc = vbg_req_perform(gdev, req2);
> +			if (rc == VERR_NOT_IMPLEMENTED)
> +				rc = VINF_SUCCESS;
> +		}
> +	}
> +	ret = vbg_status_code_to_errno(rc);
> +
> +out_free:
> +	kfree(req2);
> +	kfree(req1);
> +	return ret;
> +}
> +
> +/**
> + * Report the guest driver status to the host.
> + * Return: 0 or negative errno value.
> + * @gdev:		The Guest extension device.
> + * @active:		Flag whether the driver is now active or not.
> + */
> +static int vbg_report_driver_status(struct vbg_dev *gdev, bool active)
> +{
> +	struct vmmdev_guest_status *req;
> +	int rc;
> +
> +	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_REPORT_GUEST_STATUS);
> +	if (!req)
> +		return -ENOMEM;
> +
> +	req->facility = VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER;
> +	if (active)
> +		req->status = VBOXGUEST_FACILITY_STATUS_ACTIVE;
> +	else
> +		req->status = VBOXGUEST_FACILITY_STATUS_INACTIVE;
> +	req->flags = 0;
> +
> +	rc = vbg_req_perform(gdev, req);
> +	if (rc == VERR_NOT_IMPLEMENTED)	/* Compatibility with older hosts. */
> +		rc = VINF_SUCCESS;
> +
> +	kfree(req);
> +
> +	return vbg_status_code_to_errno(rc);
> +}
> +
> +/**
> + * Inflate the balloon by one chunk. The caller owns the balloon mutex.
> + * Return: 0 or negative errno value.
> + * @gdev:		The Guest extension device.
> + * @chunk_idx:		Index of the chunk.
> + */
> +static int vbg_balloon_inflate(struct vbg_dev *gdev, u32 chunk_idx)
> +{
> +	struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req;
> +	struct page **pages;
> +	int i, rc, ret;
> +
> +	pages = kmalloc(sizeof(*pages) * VMMDEV_MEMORY_BALLOON_CHUNK_PAGES,
> +			GFP_KERNEL | __GFP_NOWARN);
> +	if (!pages)
> +		return -ENOMEM;
> +
> +	req->header.size = sizeof(*req);
> +	req->inflate = true;
> +	req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
> +
> +	for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++) {
> +		pages[i] = alloc_page(GFP_KERNEL | __GFP_NOWARN);
> +		if (!pages[i]) {
> +			ret = -ENOMEM;
> +			goto out_error;
> +		}
> +
> +		req->phys_page[i] = page_to_phys(pages[i]);
> +	}
> +
> +	rc = vbg_req_perform(gdev, req);
> +	if (rc < 0) {
> +		vbg_err("%s error, rc: %d\n", __func__, rc);
> +		ret = vbg_status_code_to_errno(rc);
> +		goto out_error;
> +	}
> +
> +	gdev->mem_balloon.pages[chunk_idx] = pages;
> +
> +	return 0;
> +
> +out_error:
> +	while (--i >= 0)
> +		__free_page(pages[i]);
> +	kfree(pages);
> +
> +	return ret;
> +}
> +
> +/**
> + * Deflate the balloon by one chunk. The caller owns the balloon mutex.
> + * Return: 0 or negative errno value.
> + * @gdev:		The Guest extension device.
> + * @chunk_idx:		Index of the chunk.
> + */
> +static int vbg_balloon_deflate(struct vbg_dev *gdev, u32 chunk_idx)
> +{
> +	struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req;
> +	struct page **pages = gdev->mem_balloon.pages[chunk_idx];
> +	int i, rc;
> +
> +	req->header.size = sizeof(*req);
> +	req->inflate = false;
> +	req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
> +
> +	for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++)
> +		req->phys_page[i] = page_to_phys(pages[i]);
> +
> +	rc = vbg_req_perform(gdev, req);
> +	if (rc < 0) {
> +		vbg_err("%s error, rc: %d\n", __func__, rc);
> +		return vbg_status_code_to_errno(rc);
> +	}
> +
> +	for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++)
> +		__free_page(pages[i]);
> +	kfree(pages);
> +	gdev->mem_balloon.pages[chunk_idx] = NULL;
> +
> +	return 0;
> +}
> +
> +/**
> + * Respond to VMMDEV_EVENT_BALLOON_CHANGE_REQUEST events, query the size
> + * the host wants the balloon to be and adjust accordingly.
> + */
> +static void vbg_balloon_work(struct work_struct *work)
> +{
> +	struct vbg_dev *gdev =
> +		container_of(work, struct vbg_dev, mem_balloon.work);
> +	struct vmmdev_memballoon_info *req = gdev->mem_balloon.get_req;
> +	u32 i, chunks;
> +	int rc, ret;
> +
> +	/*
> +	 * Setting this bit means that we request the value from the host and
> +	 * change the guest memory balloon according to the returned value.
> +	 */
> +	req->event_ack = VMMDEV_EVENT_BALLOON_CHANGE_REQUEST;
> +	rc = vbg_req_perform(gdev, req);
> +	if (rc < 0) {
> +		vbg_err("%s error, rc: %d)\n", __func__, rc);
> +		return;
> +	}
> +
> +	/*
> +	 * The host always returns the same maximum amount of chunks, so
> +	 * we do this once.
> +	 */
> +	if (!gdev->mem_balloon.max_chunks) {
> +		gdev->mem_balloon.pages =
> +			devm_kcalloc(gdev->dev, req->phys_mem_chunks,
> +				     sizeof(struct page **), GFP_KERNEL);
> +		if (!gdev->mem_balloon.pages)
> +			return;
> +
> +		gdev->mem_balloon.max_chunks = req->phys_mem_chunks;
> +	}
> +
> +	chunks = req->balloon_chunks;
> +	if (chunks > gdev->mem_balloon.max_chunks) {
> +		vbg_err("%s: illegal balloon size %u (max=%u)\n",
> +			__func__, chunks, gdev->mem_balloon.max_chunks);
> +		return;
> +	}
> +
> +	if (chunks > gdev->mem_balloon.chunks) {
> +		/* inflate */
> +		for (i = gdev->mem_balloon.chunks; i < chunks; i++) {
> +			ret = vbg_balloon_inflate(gdev, i);
> +			if (ret < 0)
> +				return;
> +
> +			gdev->mem_balloon.chunks++;
> +		}
> +	} else {
> +		/* deflate */
> +		for (i = gdev->mem_balloon.chunks; i-- > chunks;) {
> +			ret = vbg_balloon_deflate(gdev, i);
> +			if (ret < 0)
> +				return;
> +
> +			gdev->mem_balloon.chunks--;
> +		}
> +	}
> +}
> +
> +/**
> + * Callback for heartbeat timer.
> + */
> +static void vbg_heartbeat_timer(struct timer_list *t)
> +{
> +	struct vbg_dev *gdev = from_timer(gdev, t, heartbeat_timer);
> +
> +	vbg_req_perform(gdev, gdev->guest_heartbeat_req);
> +	mod_timer(&gdev->heartbeat_timer,
> +		  msecs_to_jiffies(gdev->heartbeat_interval_ms));
> +}
> +
> +/**
> + * Configure the host to check guest's heartbeat
> + * and get heartbeat interval from the host.
> + * Return: 0 or negative errno value.
> + * @gdev:		The Guest extension device.
> + * @enabled:		Set true to enable guest heartbeat checks on host.
> + */
> +static int vbg_heartbeat_host_config(struct vbg_dev *gdev, bool enabled)
> +{
> +	struct vmmdev_heartbeat *req;
> +	int rc;
> +
> +	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_HEARTBEAT_CONFIGURE);
> +	if (!req)
> +		return -ENOMEM;
> +
> +	req->enabled = enabled;
> +	req->interval_ns = 0;
> +	rc = vbg_req_perform(gdev, req);
> +	do_div(req->interval_ns, 1000000); /* ns -> ms */
> +	gdev->heartbeat_interval_ms = req->interval_ns;
> +	kfree(req);
> +
> +	return vbg_status_code_to_errno(rc);
> +}
> +
> +/**
> + * Initializes the heartbeat timer. This feature may be disabled by the host.
> + * Return: 0 or negative errno value.
> + * @gdev:		The Guest extension device.
> + */
> +static int vbg_heartbeat_init(struct vbg_dev *gdev)
> +{
> +	int ret;
> +
> +	/* Make sure that heartbeat checking is disabled if we fail. */
> +	ret = vbg_heartbeat_host_config(gdev, false);
> +	if (ret < 0)
> +		return ret;
> +
> +	ret = vbg_heartbeat_host_config(gdev, true);
> +	if (ret < 0)
> +		return ret;
> +
> +	/*
> +	 * Preallocate the request to use it from the timer callback because:
> +	 *    1) on Windows vbg_req_alloc must be called at IRQL <= APC_LEVEL
> +	 *       and the timer callback runs at DISPATCH_LEVEL;
> +	 *    2) avoid repeated allocations.
> +	 */
> +	gdev->guest_heartbeat_req = vbg_req_alloc(
> +					sizeof(*gdev->guest_heartbeat_req),
> +					VMMDEVREQ_GUEST_HEARTBEAT);
> +	if (!gdev->guest_heartbeat_req)
> +		return -ENOMEM;
> +
> +	vbg_info("%s: Setting up heartbeat to trigger every %d milliseconds\n",
> +		 __func__, gdev->heartbeat_interval_ms);
> +	mod_timer(&gdev->heartbeat_timer, 0);
> +
> +	return 0;
> +}
> +
> +/**
> + * Cleanup hearbeat code, stop HB timer and disable host heartbeat checking.
> + * @gdev:		The Guest extension device.
> + */
> +static void vbg_heartbeat_exit(struct vbg_dev *gdev)
> +{
> +	del_timer_sync(&gdev->heartbeat_timer);
> +	vbg_heartbeat_host_config(gdev, false);
> +	kfree(gdev->guest_heartbeat_req);
> +
> +}
> +
> +/**
> + * Applies a change to the bit usage tracker.
> + * Return: true if the mask changed, false if not.
> + * @tracker:		The bit usage tracker.
> + * @changed:		The bits to change.
> + * @previous:		The previous value of the bits.
> + */
> +static bool vbg_track_bit_usage(struct vbg_bit_usage_tracker *tracker,
> +				u32 changed, u32 previous)
> +{
> +	bool global_change = false;
> +
> +	while (changed) {
> +		u32 bit = ffs(changed) - 1;
> +		u32 bitmask = BIT(bit);
> +
> +		if (bitmask & previous) {
> +			tracker->per_bit_usage[bit] -= 1;
> +			if (tracker->per_bit_usage[bit] == 0) {
> +				global_change = true;
> +				tracker->mask &= ~bitmask;
> +			}
> +		} else {
> +			tracker->per_bit_usage[bit] += 1;
> +			if (tracker->per_bit_usage[bit] == 1) {
> +				global_change = true;
> +				tracker->mask |= bitmask;
> +			}
> +		}
> +
> +		changed &= ~bitmask;
> +	}
> +
> +	return global_change;
> +}
> +
> +/**
> + * Init and termination worker for resetting the (host) event filter on the host
> + * Return: 0 or negative errno value.
> + * @gdev:		   The Guest extension device.
> + * @fixed_events:	   Fixed events (init time).
> + */
> +static int vbg_reset_host_event_filter(struct vbg_dev *gdev,
> +				       u32 fixed_events)
> +{
> +	struct vmmdev_mask *req;
> +	int rc;
> +
> +	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK);
> +	if (!req)
> +		return -ENOMEM;
> +
> +	req->not_mask = U32_MAX & ~fixed_events;
> +	req->or_mask = fixed_events;
> +	rc = vbg_req_perform(gdev, req);
> +	if (rc < 0)
> +		vbg_err("%s error, rc: %d\n", __func__, rc);
> +
> +	kfree(req);
> +	return vbg_status_code_to_errno(rc);
> +}
> +
> +/**
> + * Changes the event filter mask for the given session.
> + *
> + * This is called in response to VBG_IOCTL_CHANGE_FILTER_MASK as well as to
> + * do session cleanup. Takes the session spinlock.
> + *
> + * Return: 0 or negative errno value.
> + * @gdev:			The Guest extension device.
> + * @session:			The session.
> + * @or_mask:			The events to add.
> + * @not_mask:			The events to remove.
> + * @session_termination:	Set if we're called by the session cleanup code.
> + *				This tweaks the error handling so we perform
> + *				proper session cleanup even if the host
> + *				misbehaves.
> + */
> +static int vbg_set_session_event_filter(struct vbg_dev *gdev,
> +					struct vbg_session *session,
> +					u32 or_mask, u32 not_mask,
> +					bool session_termination)
> +{
> +	struct vmmdev_mask *req;
> +	u32 changed, previous;
> +	int rc, ret = 0;
> +
> +	/* Allocate a request buffer before taking the spinlock */
> +	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK);
> +	if (!req) {
> +		if (!session_termination)
> +			return -ENOMEM;
> +		/* Ignore failure, we must do session cleanup. */

The comment should say "Ignore allocation failure ...", but that leads to 
problems below.

> +	}
> +
> +	mutex_lock(&gdev->session_mutex);
> +
> +	/* Apply the changes to the session mask. */
> +	previous = session->event_filter;
> +	session->event_filter |= or_mask;
> +	session->event_filter &= ~not_mask;
> +
> +	/* If anything actually changed, update the global usage counters. */
> +	changed = previous ^ session->event_filter;
> +	if (!changed)
> +		goto out;
> +
> +	vbg_track_bit_usage(&gdev->event_filter_tracker, changed, previous);
> +	req->or_mask = gdev->fixed_events | gdev->event_filter_tracker.mask;

At this point, req could be NULL. I'm not sure what session cleanup is needed if 
req is NULL and session_termination is not, but it needs to be split out.

> +
> +	if (gdev->event_filter_host == req->or_mask || !req)
> +		goto out;
> +
> +	gdev->event_filter_host = req->or_mask;
> +	req->not_mask = ~req->or_mask;
> +	rc = vbg_req_perform(gdev, req);
> +	if (rc < 0) {
> +		ret = vbg_status_code_to_errno(rc);
> +
> +		/* Failed, roll back (unless it's session termination time). */
> +		gdev->event_filter_host = U32_MAX;
> +		if (session_termination)
> +			goto out;
> +
> +		vbg_track_bit_usage(&gdev->event_filter_tracker, changed,
> +				    session->event_filter);
> +		session->event_filter = previous;
> +	}
> +
> +out:
> +	mutex_unlock(&gdev->session_mutex);
> +	kfree(req);
> +
> +	return ret;
> +}
> +
> +/**
> + * Init and termination worker for set guest capabilities to zero on the host.
> + * Return: 0 or negative errno value.
> + * @gdev:		The Guest extension device.
> + */
> +static int vbg_reset_host_capabilities(struct vbg_dev *gdev)
> +{
> +	struct vmmdev_mask *req;
> +	int rc;
> +
> +	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES);
> +	if (!req)
> +		return -ENOMEM;
> +
> +	req->not_mask = U32_MAX;
> +	req->or_mask = 0;
> +	rc = vbg_req_perform(gdev, req);
> +	if (rc < 0)
> +		vbg_err("%s error, rc: %d\n", __func__, rc);
> +
> +	kfree(req);
> +	return vbg_status_code_to_errno(rc);
> +}
> +
> +/**
> + * Sets the guest capabilities for a session. Takes the session spinlock.
> + * Return: 0 or negative errno value.
> + * @gdev:			The Guest extension device.
> + * @session:			The session.
> + * @or_mask:			The capabilities to add.
> + * @not_mask:			The capabilities to remove.
> + * @session_termination:	Set if we're called by the session cleanup code.
> + *				This tweaks the error handling so we perform
> + *				proper session cleanup even if the host
> + *				misbehaves.
> + */
> +static int vbg_set_session_capabilities(struct vbg_dev *gdev,
> +					struct vbg_session *session,
> +					u32 or_mask, u32 not_mask,
> +					bool session_termination)
> +{
> +	struct vmmdev_mask *req;
> +	u32 changed, previous;
> +	int rc, ret = 0;
> +
> +	/* Allocate a request buffer before taking the spinlock */
> +	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES);
> +	if (!req) {
> +		if (!session_termination)
> +			return -ENOMEM;
> +		/* Ignore failure, we must do session cleanup. */

This comment should also be changed.

> +	}
> +
> +	mutex_lock(&gdev->session_mutex);
> +
> +	/* Apply the changes to the session mask. */
> +	previous = session->guest_caps;
> +	session->guest_caps |= or_mask;
> +	session->guest_caps &= ~not_mask;
> +
> +	/* If anything actually changed, update the global usage counters. */
> +	changed = previous ^ session->guest_caps;
> +	if (!changed)
> +		goto out;
> +
> +	vbg_track_bit_usage(&gdev->guest_caps_tracker, changed, previous);
> +	req->or_mask = gdev->guest_caps_tracker.mask;

req can be NULL here.

> +
> +	if (gdev->guest_caps_host == req->or_mask || !req)
> +		goto out;
> +
> +	gdev->guest_caps_host = req->or_mask;
> +	req->not_mask = ~req->or_mask;
> +	rc = vbg_req_perform(gdev, req);
> +	if (rc < 0) {
> +		ret = vbg_status_code_to_errno(rc);
> +
> +		/* Failed, roll back (unless it's session termination time). */
> +		gdev->guest_caps_host = U32_MAX;
> +		if (session_termination)
> +			goto out;
> +
> +		vbg_track_bit_usage(&gdev->guest_caps_tracker, changed,
> +				    session->guest_caps);
> +		session->guest_caps = previous;
> +	}
> +
> +out:
> +	mutex_unlock(&gdev->session_mutex);
> +	kfree(req);
> +
> +	return ret;
> +}
> +
> +/**
> + * vbg_query_host_version get the host feature mask and version information.
> + * Return: 0 or negative errno value.
> + * @gdev:		The Guest extension device.
> + */
> +static int vbg_query_host_version(struct vbg_dev *gdev)
> +{
> +	struct vmmdev_host_version *req;
> +	int rc, ret;
> +
> +	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HOST_VERSION);
> +	if (!req)
> +		return -ENOMEM;
> +
> +	rc = vbg_req_perform(gdev, req);
> +	ret = vbg_status_code_to_errno(rc);
> +	if (ret)
> +		goto out;
> +
> +	snprintf(gdev->host_version, sizeof(gdev->host_version), "%u.%u.%ur%u",
> +		 req->major, req->minor, req->build, req->revision);
> +	gdev->host_features = req->features;
> +
> +	vbg_info("vboxguest: host-version: %s %#x\n", gdev->host_version,
> +		 gdev->host_features);
> +
> +	if (!(req->features & VMMDEV_HVF_HGCM_PHYS_PAGE_LIST)) {
> +		vbg_err("vboxguest: Error host too old (does not support page-lists)\n");
> +		ret = -ENODEV;
> +	}
> +
> +out:
> +	kfree(req);
> +	return ret;
> +}
> +
> +/**
> + * Initializes the VBoxGuest device extension when the
> + * device driver is loaded.
> + *
> + * The native code locates the VMMDev on the PCI bus and retrieve
> + * the MMIO and I/O port ranges, this function will take care of
> + * mapping the MMIO memory (if present). Upon successful return
> + * the native code should set up the interrupt handler.
> + *
> + * Return: 0 or negative errno value.
> + *
> + * @gdev:		The Guest extension device.
> + * @fixed_events:	Events that will be enabled upon init and no client
> + *			will ever be allowed to mask.
> + */
> +int vbg_core_init(struct vbg_dev *gdev, u32 fixed_events)
> +{
> +	int ret = -ENOMEM;
> +
> +	gdev->fixed_events = fixed_events | VMMDEV_EVENT_HGCM;
> +	gdev->event_filter_host = U32_MAX;	/* forces a report */
> +	gdev->guest_caps_host = U32_MAX;	/* forces a report */
> +
> +	init_waitqueue_head(&gdev->event_wq);
> +	init_waitqueue_head(&gdev->hgcm_wq);
> +	spin_lock_init(&gdev->event_spinlock);
> +	mutex_init(&gdev->session_mutex);
> +	mutex_init(&gdev->cancel_req_mutex);
> +	timer_setup(&gdev->heartbeat_timer, vbg_heartbeat_timer, 0);
> +	INIT_WORK(&gdev->mem_balloon.work, vbg_balloon_work);
> +
> +	gdev->mem_balloon.get_req =
> +		vbg_req_alloc(sizeof(*gdev->mem_balloon.get_req),
> +			      VMMDEVREQ_GET_MEMBALLOON_CHANGE_REQ);
> +	gdev->mem_balloon.change_req =
> +		vbg_req_alloc(sizeof(*gdev->mem_balloon.change_req),
> +			      VMMDEVREQ_CHANGE_MEMBALLOON);
> +	gdev->cancel_req =
> +		vbg_req_alloc(sizeof(*(gdev->cancel_req)),
> +			      VMMDEVREQ_HGCM_CANCEL2);
> +	gdev->ack_events_req =
> +		vbg_req_alloc(sizeof(*gdev->ack_events_req),
> +			      VMMDEVREQ_ACKNOWLEDGE_EVENTS);
> +	gdev->mouse_status_req =
> +		vbg_req_alloc(sizeof(*gdev->mouse_status_req),
> +			      VMMDEVREQ_GET_MOUSE_STATUS);
> +
> +	if (!gdev->mem_balloon.get_req || !gdev->mem_balloon.change_req ||
> +	    !gdev->cancel_req || !gdev->ack_events_req ||
> +	    !gdev->mouse_status_req)
> +		goto err_free_reqs;
> +
> +	ret = vbg_query_host_version(gdev);
> +	if (ret)
> +		goto err_free_reqs;
> +
> +	ret = vbg_report_guest_info(gdev);
> +	if (ret) {
> +		vbg_err("vboxguest: vbg_report_guest_info error: %d\n", ret);
> +		goto err_free_reqs;
> +	}
> +
> +	ret = vbg_reset_host_event_filter(gdev, gdev->fixed_events);
> +	if (ret) {
> +		vbg_err("vboxguest: Error setting fixed event filter: %d\n",
> +			ret);
> +		goto err_free_reqs;
> +	}
> +
> +	ret = vbg_reset_host_capabilities(gdev);
> +	if (ret) {
> +		vbg_err("vboxguest: Error clearing guest capabilities: %d\n",
> +			ret);
> +		goto err_free_reqs;
> +	}
> +
> +	ret = vbg_core_set_mouse_status(gdev, 0);
> +	if (ret) {
> +		vbg_err("vboxguest: Error clearing mouse status: %d\n", ret);
> +		goto err_free_reqs;
> +	}
> +
> +	/* These may fail without requiring the driver init to fail. */
> +	vbg_guest_mappings_init(gdev);
> +	vbg_heartbeat_init(gdev);
> +
> +	/* All Done! */
> +	ret = vbg_report_driver_status(gdev, true);
> +	if (ret < 0)
> +		vbg_err("vboxguest: Error reporting driver status: %d\n", ret);
> +
> +	return 0;
> +
> +err_free_reqs:
> +	kfree(gdev->mouse_status_req);
> +	kfree(gdev->ack_events_req);
> +	kfree(gdev->cancel_req);
> +	kfree(gdev->mem_balloon.change_req);
> +	kfree(gdev->mem_balloon.get_req);
> +	return ret;
> +}
> +
> +/**
> + * Call this on exit to clean-up vboxguest-core managed resources.
> + *
> + * The native code should call this before the driver is loaded,
> + * but don't call this on shutdown.
> + * @gdev:		The Guest extension device.
> + */
> +void vbg_core_exit(struct vbg_dev *gdev)
> +{
> +	vbg_heartbeat_exit(gdev);
> +	vbg_guest_mappings_exit(gdev);
> +
> +	/* Clear the host flags (mouse status etc). */
> +	vbg_reset_host_event_filter(gdev, 0);
> +	vbg_reset_host_capabilities(gdev);
> +	vbg_core_set_mouse_status(gdev, 0);
> +
> +	kfree(gdev->mouse_status_req);
> +	kfree(gdev->ack_events_req);
> +	kfree(gdev->cancel_req);
> +	kfree(gdev->mem_balloon.change_req);
> +	kfree(gdev->mem_balloon.get_req);
> +}
> +
> +/**
> + * Creates a VBoxGuest user session.
> + *
> + * vboxguest_linux.c calls this when userspace opens the char-device.
> + * Return: A pointer to the new session or an ERR_PTR on error.
> + * @gdev:		The Guest extension device.
> + * @user:		Set if this is a session for the vboxuser device.
> + */
> +struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, bool user)
> +{
> +	struct vbg_session *session;
> +
> +	session = kzalloc(sizeof(*session), GFP_KERNEL);
> +	if (!session)
> +		return ERR_PTR(-ENOMEM);
> +
> +	session->gdev = gdev;
> +	session->user_session = user;
> +
> +	return session;
> +}
> +
> +/**
> + * Closes a VBoxGuest session.
> + * @session:		The session to close (and free).
> + */
> +void vbg_core_close_session(struct vbg_session *session)
> +{
> +	struct vbg_dev *gdev = session->gdev;
> +	int i, rc;
> +
> +	vbg_set_session_capabilities(gdev, session, 0, U32_MAX, true);
> +	vbg_set_session_event_filter(gdev, session, 0, U32_MAX, true);
> +
> +	for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) {
> +		if (!session->hgcm_client_ids[i])
> +			continue;
> +
> +		vbg_hgcm_disconnect(gdev, session->hgcm_client_ids[i], &rc);
> +	}
> +
> +	kfree(session);
> +}
> +
> +static int vbg_ioctl_chk(struct vbg_ioctl_hdr *hdr, size_t in_size,
> +			 size_t out_size)
> +{
> +	if (hdr->size_in  != (sizeof(*hdr) + in_size) ||
> +	    hdr->size_out != (sizeof(*hdr) + out_size))
> +		return -EINVAL;
> +
> +	return 0;
> +}
> +
> +static int vbg_ioctl_driver_version_info(
> +	struct vbg_ioctl_driver_version_info *info)
> +{
> +	const u16 vbg_maj_version = VBG_IOC_VERSION >> 16;
> +	u16 min_maj_version, req_maj_version;
> +
> +	if (vbg_ioctl_chk(&info->hdr, sizeof(info->u.in), sizeof(info->u.out)))
> +		return -EINVAL;
> +
> +	req_maj_version = info->u.in.req_version >> 16;
> +	min_maj_version = info->u.in.min_version >> 16;
> +
> +	if (info->u.in.min_version > info->u.in.req_version ||
> +	    min_maj_version != req_maj_version)
> +		return -EINVAL;
> +
> +	if (info->u.in.min_version <= VBG_IOC_VERSION &&
> +	    min_maj_version == vbg_maj_version) {
> +		info->u.out.session_version = VBG_IOC_VERSION;
> +	} else {
> +		info->u.out.session_version = U32_MAX;
> +		info->hdr.rc = VERR_VERSION_MISMATCH;
> +	}
> +
> +	info->u.out.driver_version  = VBG_IOC_VERSION;
> +	info->u.out.driver_revision = 0;
> +	info->u.out.reserved1      = 0;
> +	info->u.out.reserved2      = 0;
> +
> +	return 0;
> +}
> +
> +static bool vbg_wait_event_cond(struct vbg_dev *gdev,
> +				struct vbg_session *session,
> +				u32 event_mask)
> +{
> +	unsigned long flags;
> +	bool wakeup;
> +	u32 events;
> +
> +	spin_lock_irqsave(&gdev->event_spinlock, flags);
> +
> +	events = gdev->pending_events & event_mask;
> +	wakeup = events || session->cancel_waiters;
> +
> +	spin_unlock_irqrestore(&gdev->event_spinlock, flags);
> +
> +	return wakeup;
> +}
> +
> +/* Must be called with the event_lock held */
> +static u32 vbg_consume_events_locked(struct vbg_dev *gdev,
> +				     struct vbg_session *session,
> +				     u32 event_mask)
> +{
> +	u32 events = gdev->pending_events & event_mask;
> +
> +	gdev->pending_events &= ~events;
> +	return events;
> +}
> +
> +static int vbg_ioctl_wait_for_events(struct vbg_dev *gdev,
> +				     struct vbg_session *session,
> +				     struct vbg_ioctl_wait_for_events *wait)
> +{
> +	u32 timeout_ms = wait->u.in.timeout_ms;
> +	u32 event_mask = wait->u.in.events;
> +	unsigned long flags;
> +	long timeout;
> +	int ret = 0;
> +
> +	if (vbg_ioctl_chk(&wait->hdr, sizeof(wait->u.in), sizeof(wait->u.out)))
> +		return -EINVAL;
> +
> +	if (timeout_ms == U32_MAX)
> +		timeout = MAX_SCHEDULE_TIMEOUT;
> +	else
> +		timeout = msecs_to_jiffies(timeout_ms);
> +
> +	wait->u.out.events = 0;
> +	do {
> +		timeout = wait_event_interruptible_timeout(
> +				gdev->event_wq,
> +				vbg_wait_event_cond(gdev, session, event_mask),
> +				timeout);
> +
> +		spin_lock_irqsave(&gdev->event_spinlock, flags);
> +
> +		if (timeout < 0 || session->cancel_waiters) {
> +			ret = -EINTR;
> +		} else if (timeout == 0) {
> +			ret = -ETIMEDOUT;
> +		} else {
> +			wait->u.out.events =
> +			   vbg_consume_events_locked(gdev, session, event_mask);
> +		}
> +
> +		spin_unlock_irqrestore(&gdev->event_spinlock, flags);
> +
> +		/*
> +		 * Someone else may have consumed the event(s) first, in
> +		 * which case we go back to waiting.
> +		 */
> +	} while (ret == 0 && wait->u.out.events == 0);
> +
> +	return ret;
> +}
> +
> +static int vbg_ioctl_interrupt_all_wait_events(struct vbg_dev *gdev,
> +					       struct vbg_session *session,
> +					       struct vbg_ioctl_hdr *hdr)
> +{
> +	unsigned long flags;
> +
> +	if (hdr->size_in != sizeof(*hdr) || hdr->size_out != sizeof(*hdr))
> +		return -EINVAL;
> +
> +	spin_lock_irqsave(&gdev->event_spinlock, flags);
> +	session->cancel_waiters = true;
> +	spin_unlock_irqrestore(&gdev->event_spinlock, flags);
> +
> +	wake_up(&gdev->event_wq);
> +
> +	return 0;
> +}
> +
> +/**
> + * Checks if the VMM request is allowed in the context of the given session.
> + * Return: 0 or negative errno value.
> + * @gdev:		The Guest extension device.
> + * @session:		The calling session.
> + * @req:		The request.
> + */
> +static int vbg_req_allowed(struct vbg_dev *gdev, struct vbg_session *session,
> +			   const struct vmmdev_request_header *req)
> +{
> +	const struct vmmdev_guest_status *guest_status;
> +	bool trusted_apps_only;
> +
> +	switch (req->request_type) {
> +	/* Trusted users apps only. */
> +	case VMMDEVREQ_QUERY_CREDENTIALS:
> +	case VMMDEVREQ_REPORT_CREDENTIALS_JUDGEMENT:
> +	case VMMDEVREQ_REGISTER_SHARED_MODULE:
> +	case VMMDEVREQ_UNREGISTER_SHARED_MODULE:
> +	case VMMDEVREQ_WRITE_COREDUMP:
> +	case VMMDEVREQ_GET_CPU_HOTPLUG_REQ:
> +	case VMMDEVREQ_SET_CPU_HOTPLUG_STATUS:
> +	case VMMDEVREQ_CHECK_SHARED_MODULES:
> +	case VMMDEVREQ_GET_PAGE_SHARING_STATUS:
> +	case VMMDEVREQ_DEBUG_IS_PAGE_SHARED:
> +	case VMMDEVREQ_REPORT_GUEST_STATS:
> +	case VMMDEVREQ_REPORT_GUEST_USER_STATE:
> +	case VMMDEVREQ_GET_STATISTICS_CHANGE_REQ:
> +		trusted_apps_only = true;
> +		break;
> +
> +	/* Anyone. */
> +	case VMMDEVREQ_GET_MOUSE_STATUS:
> +	case VMMDEVREQ_SET_MOUSE_STATUS:
> +	case VMMDEVREQ_SET_POINTER_SHAPE:
> +	case VMMDEVREQ_GET_HOST_VERSION:
> +	case VMMDEVREQ_IDLE:
> +	case VMMDEVREQ_GET_HOST_TIME:
> +	case VMMDEVREQ_SET_POWER_STATUS:
> +	case VMMDEVREQ_ACKNOWLEDGE_EVENTS:
> +	case VMMDEVREQ_CTL_GUEST_FILTER_MASK:
> +	case VMMDEVREQ_REPORT_GUEST_STATUS:
> +	case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ:
> +	case VMMDEVREQ_VIDEMODE_SUPPORTED:
> +	case VMMDEVREQ_GET_HEIGHT_REDUCTION:
> +	case VMMDEVREQ_GET_DISPLAY_CHANGE_REQ2:
> +	case VMMDEVREQ_VIDEMODE_SUPPORTED2:
> +	case VMMDEVREQ_VIDEO_ACCEL_ENABLE:
> +	case VMMDEVREQ_VIDEO_ACCEL_FLUSH:
> +	case VMMDEVREQ_VIDEO_SET_VISIBLE_REGION:
> +	case VMMDEVREQ_GET_DISPLAY_CHANGE_REQEX:
> +	case VMMDEVREQ_GET_SEAMLESS_CHANGE_REQ:
> +	case VMMDEVREQ_GET_VRDPCHANGE_REQ:
> +	case VMMDEVREQ_LOG_STRING:
> +	case VMMDEVREQ_GET_SESSION_ID:
> +		trusted_apps_only = false;
> +		break;
> +
> +	/* Depends on the request parameters... */
> +	case VMMDEVREQ_REPORT_GUEST_CAPABILITIES:
> +		guest_status = (const struct vmmdev_guest_status *)req;
> +		switch (guest_status->facility) {
> +		case VBOXGUEST_FACILITY_TYPE_ALL:
> +		case VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER:
> +			vbg_err("Denying userspace vmm report guest cap. call facility %#08x\n",
> +				guest_status->facility);
> +			return -EPERM;
> +		case VBOXGUEST_FACILITY_TYPE_VBOX_SERVICE:
> +			trusted_apps_only = true;
> +			break;
> +		case VBOXGUEST_FACILITY_TYPE_VBOX_TRAY_CLIENT:
> +		case VBOXGUEST_FACILITY_TYPE_SEAMLESS:
> +		case VBOXGUEST_FACILITY_TYPE_GRAPHICS:
> +		default:
> +			trusted_apps_only = false;
> +			break;
> +		}
> +		break;
> +
> +	/* Anything else is not allowed. */
> +	default:
> +		vbg_err("Denying userspace vmm call type %#08x\n",
> +			req->request_type);
> +		return -EPERM;
> +	}
> +
> +	if (trusted_apps_only && session->user_session) {
> +		vbg_err("Denying userspace vmm call type %#08x through vboxuser device node\n",
> +			req->request_type);
> +		return -EPERM;
> +	}
> +
> +	return 0;
> +}
> +
> +static int vbg_ioctl_vmmrequest(struct vbg_dev *gdev,
> +				struct vbg_session *session, void *data)
> +{
> +	struct vbg_ioctl_hdr *hdr = data;
> +	int ret;
> +
> +	if (hdr->size_in != hdr->size_out)
> +		return -EINVAL;
> +
> +	if (hdr->size_in > VMMDEV_MAX_VMMDEVREQ_SIZE)
> +		return -E2BIG;
> +
> +	if (hdr->type == VBG_IOCTL_HDR_TYPE_DEFAULT)
> +		return -EINVAL;
> +
> +	ret = vbg_req_allowed(gdev, session, data);
> +	if (ret < 0)
> +		return ret;
> +
> +	vbg_req_perform(gdev, data);
> +	WARN_ON(hdr->rc == VINF_HGCM_ASYNC_EXECUTE);
> +
> +	return 0;
> +}
> +
> +static int vbg_ioctl_hgcm_connect(struct vbg_dev *gdev,
> +				  struct vbg_session *session,
> +				  struct vbg_ioctl_hgcm_connect *conn)
> +{
> +	u32 client_id;
> +	int i, ret;
> +
> +	if (vbg_ioctl_chk(&conn->hdr, sizeof(conn->u.in), sizeof(conn->u.out)))
> +		return -EINVAL;
> +
> +	/* Find a free place in the sessions clients array and claim it */
> +	mutex_lock(&gdev->session_mutex);
> +	for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) {
> +		if (!session->hgcm_client_ids[i]) {
> +			session->hgcm_client_ids[i] = U32_MAX;
> +			break;
> +		}
> +	}
> +	mutex_unlock(&gdev->session_mutex);
> +
> +	if (i >= ARRAY_SIZE(session->hgcm_client_ids))
> +		return -EMFILE;
> +
> +	ret = vbg_hgcm_connect(gdev, &conn->u.in.loc, &client_id,
> +			       &conn->hdr.rc);
> +
> +	mutex_lock(&gdev->session_mutex);
> +	if (ret == 0 && conn->hdr.rc >= 0) {
> +		conn->u.out.client_id = client_id;
> +		session->hgcm_client_ids[i] = client_id;
> +	} else {
> +		conn->u.out.client_id = 0;
> +		session->hgcm_client_ids[i] = 0;
> +	}
> +	mutex_unlock(&gdev->session_mutex);
> +
> +	return ret;
> +}
> +
> +static int vbg_ioctl_hgcm_disconnect(struct vbg_dev *gdev,
> +				     struct vbg_session *session,
> +				     struct vbg_ioctl_hgcm_disconnect *disconn)
> +{
> +	u32 client_id;
> +	int i, ret;
> +
> +	if (vbg_ioctl_chk(&disconn->hdr, sizeof(disconn->u.in), 0))
> +		return -EINVAL;
> +
> +	client_id = disconn->u.in.client_id;
> +	if (client_id == 0 || client_id == U32_MAX)
> +		return -EINVAL;
> +
> +	mutex_lock(&gdev->session_mutex);
> +	for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++) {
> +		if (session->hgcm_client_ids[i] == client_id) {
> +			session->hgcm_client_ids[i] = U32_MAX;
> +			break;
> +		}
> +	}
> +	mutex_unlock(&gdev->session_mutex);
> +
> +	if (i >= ARRAY_SIZE(session->hgcm_client_ids))
> +		return -EINVAL;
> +
> +	ret = vbg_hgcm_disconnect(gdev, client_id, &disconn->hdr.rc);
> +
> +	mutex_lock(&gdev->session_mutex);
> +	if (ret == 0 && disconn->hdr.rc >= 0)
> +		session->hgcm_client_ids[i] = 0;
> +	else
> +		session->hgcm_client_ids[i] = client_id;
> +	mutex_unlock(&gdev->session_mutex);
> +
> +	return ret;
> +}
> +
> +static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
> +			       struct vbg_session *session, bool f32bit,
> +			       struct vbg_ioctl_hgcm_call *call)
> +{
> +	size_t actual_size;
> +	u32 client_id;
> +	int i, ret;
> +
> +	if (call->hdr.size_in < sizeof(*call))
> +		return -EINVAL;
> +
> +	if (call->hdr.size_in != call->hdr.size_out)
> +		return -EINVAL;
> +
> +	if (call->parm_count > VMMDEV_HGCM_MAX_PARMS)
> +		return -E2BIG;
> +
> +	client_id = call->client_id;
> +	if (client_id == 0 || client_id == U32_MAX)
> +		return -EINVAL;
> +
> +	actual_size = sizeof(*call);
> +	if (f32bit)
> +		actual_size += call->parm_count *
> +			       sizeof(struct vmmdev_hgcm_function_parameter32);
> +	else
> +		actual_size += call->parm_count *
> +			       sizeof(struct vmmdev_hgcm_function_parameter);
> +	if (call->hdr.size_in < actual_size) {
> +		vbg_debug("VBG_IOCTL_HGCM_CALL: hdr.size_in %d required size is %zd\n",
> +			  call->hdr.size_in, actual_size);
> +		return -EINVAL;
> +	}
> +	call->hdr.size_out = actual_size;
> +
> +	/*
> +	 * Validate the client id.
> +	 */
> +	mutex_lock(&gdev->session_mutex);
> +	for (i = 0; i < ARRAY_SIZE(session->hgcm_client_ids); i++)
> +		if (session->hgcm_client_ids[i] == client_id)
> +			break;
> +	mutex_unlock(&gdev->session_mutex);
> +	if (i >= ARRAY_SIZE(session->hgcm_client_ids)) {
> +		vbg_debug("VBG_IOCTL_HGCM_CALL: INVALID handle. u32Client=%#08x\n",
> +			  client_id);
> +		return -EINVAL;
> +	}
> +
> +	if (f32bit)
> +		ret = vbg_hgcm_call32(gdev, client_id,
> +				      call->function, call->timeout_ms,
> +				      VBG_IOCTL_HGCM_CALL_PARMS32(call),
> +				      call->parm_count, &call->hdr.rc);
> +	else
> +		ret = vbg_hgcm_call(gdev, client_id,
> +				    call->function, call->timeout_ms,
> +				    VBG_IOCTL_HGCM_CALL_PARMS(call),
> +				    call->parm_count, &call->hdr.rc);
> +
> +	if (ret == -E2BIG) {
> +		/* E2BIG needs to be reported through the hdr.rc field. */
> +		call->hdr.rc = VERR_OUT_OF_RANGE;
> +		ret = 0;
> +	}
> +
> +	if (ret && ret != -EINTR && ret != -ETIMEDOUT)
> +		vbg_err("VBG_IOCTL_HGCM_CALL error: %d\n", ret);
> +
> +	return ret;
> +}
> +
> +static int vbg_ioctl_log(struct vbg_ioctl_log *log)
> +{
> +	if (log->hdr.size_out != sizeof(log->hdr))
> +		return -EINVAL;
> +
> +	vbg_info("%.*s", (int)(log->hdr.size_in - sizeof(log->hdr)),
> +		 log->u.in.msg);
> +
> +	return 0;
> +}
> +
> +static int vbg_ioctl_change_filter_mask(struct vbg_dev *gdev,
> +					struct vbg_session *session,
> +					struct vbg_ioctl_change_filter *filter)
> +{
> +	u32 or_mask, not_mask;
> +
> +	if (vbg_ioctl_chk(&filter->hdr, sizeof(filter->u.in), 0))
> +		return -EINVAL;
> +
> +	or_mask = filter->u.in.or_mask;
> +	not_mask = filter->u.in.not_mask;
> +
> +	if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK)
> +		return -EINVAL;
> +
> +	return vbg_set_session_event_filter(gdev, session, or_mask, not_mask,
> +					    false);
> +}
> +
> +static int vbg_ioctl_change_guest_capabilities(struct vbg_dev *gdev,
> +	     struct vbg_session *session, struct vbg_ioctl_set_guest_caps *caps)
> +{
> +	u32 or_mask, not_mask;
> +	int ret;
> +
> +	if (vbg_ioctl_chk(&caps->hdr, sizeof(caps->u.in), sizeof(caps->u.out)))
> +		return -EINVAL;
> +
> +	or_mask = caps->u.in.or_mask;
> +	not_mask = caps->u.in.not_mask;
> +
> +	if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK)
> +		return -EINVAL;
> +
> +	ret = vbg_set_session_capabilities(gdev, session, or_mask, not_mask,
> +					   false);
> +	if (ret)
> +		return ret;
> +
> +	caps->u.out.session_caps = session->guest_caps;
> +	caps->u.out.global_caps = gdev->guest_caps_host;
> +
> +	return 0;
> +}
> +
> +static int vbg_ioctl_check_balloon(struct vbg_dev *gdev,
> +				   struct vbg_ioctl_check_balloon *balloon_info)
> +{
> +	if (vbg_ioctl_chk(&balloon_info->hdr, 0, sizeof(balloon_info->u.out)))
> +		return -EINVAL;
> +
> +	balloon_info->u.out.balloon_chunks = gdev->mem_balloon.chunks;
> +	/*
> +	 * Under Linux we handle VMMDEV_EVENT_BALLOON_CHANGE_REQUEST
> +	 * events entirely in the kernel, see vbg_core_isr().
> +	 */
> +	balloon_info->u.out.handle_in_r3 = false;
> +
> +	return 0;
> +}
> +
> +static int vbg_ioctl_write_core_dump(struct vbg_dev *gdev,
> +				     struct vbg_ioctl_write_coredump *dump)
> +{
> +	struct vmmdev_write_core_dump *req;
> +
> +	if (vbg_ioctl_chk(&dump->hdr, sizeof(dump->u.in), 0))
> +		return -EINVAL;
> +
> +	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_WRITE_COREDUMP);
> +	if (!req)
> +		return -ENOMEM;
> +
> +	req->flags = dump->u.in.flags;
> +	dump->hdr.rc = vbg_req_perform(gdev, req);
> +
> +	kfree(req);
> +	return 0;
> +}
> +
> +/**
> + * Common IOCtl for user to kernel communication.
> + * Return: 0 or negative errno value.
> + * @session:	The client session.
> + * @req:	The requested function.
> + * @data:	The i/o data buffer, minimum size sizeof(struct vbg_ioctl_hdr).
> + */
> +int vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data)
> +{
> +	unsigned int req_no_size = req & ~IOCSIZE_MASK;
> +	struct vbg_dev *gdev = session->gdev;
> +	struct vbg_ioctl_hdr *hdr = data;
> +	bool f32bit = false;
> +
> +	hdr->rc = VINF_SUCCESS;
> +	if (!hdr->size_out)
> +		hdr->size_out = hdr->size_in;
> +
> +	/*
> +	 * hdr->version and hdr->size_in / hdr->size_out minimum size are
> +	 * already checked by vbg_misc_device_ioctl().
> +	 */
> +
> +	/* For VMMDEV_REQUEST hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT */
> +	if (req_no_size == VBG_IOCTL_VMMDEV_REQUEST(0) ||
> +	    req == VBG_IOCTL_VMMDEV_REQUEST_BIG)
> +		return vbg_ioctl_vmmrequest(gdev, session, data);
> +
> +	if (hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT)
> +		return -EINVAL;
> +
> +	/* Fixed size requests. */
> +	switch (req) {
> +	case VBG_IOCTL_DRIVER_VERSION_INFO:
> +		return vbg_ioctl_driver_version_info(data);
> +	case VBG_IOCTL_HGCM_CONNECT:
> +		return vbg_ioctl_hgcm_connect(gdev, session, data);
> +	case VBG_IOCTL_HGCM_DISCONNECT:
> +		return vbg_ioctl_hgcm_disconnect(gdev, session, data);
> +	case VBG_IOCTL_WAIT_FOR_EVENTS:
> +		return vbg_ioctl_wait_for_events(gdev, session, data);
> +	case VBG_IOCTL_INTERRUPT_ALL_WAIT_FOR_EVENTS:
> +		return vbg_ioctl_interrupt_all_wait_events(gdev, session, data);
> +	case VBG_IOCTL_CHANGE_FILTER_MASK:
> +		return vbg_ioctl_change_filter_mask(gdev, session, data);
> +	case VBG_IOCTL_CHANGE_GUEST_CAPABILITIES:
> +		return vbg_ioctl_change_guest_capabilities(gdev, session, data);
> +	case VBG_IOCTL_CHECK_BALLOON:
> +		return vbg_ioctl_check_balloon(gdev, data);
> +	case VBG_IOCTL_WRITE_CORE_DUMP:
> +		return vbg_ioctl_write_core_dump(gdev, data);
> +	}
> +
> +	/* Variable sized requests. */
> +	switch (req_no_size) {
> +#ifdef CONFIG_COMPAT
> +	case VBG_IOCTL_HGCM_CALL_32(0):
> +		f32bit = true;
> +		/* Fall through */
> +#endif
> +	case VBG_IOCTL_HGCM_CALL(0):
> +		return vbg_ioctl_hgcm_call(gdev, session, f32bit, data);
> +	case VBG_IOCTL_LOG(0):
> +		return vbg_ioctl_log(data);
> +	}
> +
> +	vbg_debug("VGDrvCommonIoCtl: Unknown req %#08x\n", req);
> +	return -ENOTTY;
> +}
> +
> +/**
> + * Report guest supported mouse-features to the host.
> + *
> + * Return: 0 or negative errno value.
> + * @gdev:		The Guest extension device.
> + * @features:		The set of features to report to the host.
> + */
> +int vbg_core_set_mouse_status(struct vbg_dev *gdev, u32 features)
> +{
> +	struct vmmdev_mouse_status *req;
> +	int rc;
> +
> +	req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_MOUSE_STATUS);
> +	if (!req)
> +		return -ENOMEM;
> +
> +	req->mouse_features = features;
> +	req->pointer_pos_x = 0;
> +	req->pointer_pos_y = 0;
> +
> +	rc = vbg_req_perform(gdev, req);
> +	if (rc < 0)
> +		vbg_err("%s error, rc: %d\n", __func__, rc);
> +
> +	kfree(req);
> +	return vbg_status_code_to_errno(rc);
> +}
> +
> +/** Core interrupt service routine. */
> +irqreturn_t vbg_core_isr(int irq, void *dev_id)
> +{
> +	struct vbg_dev *gdev = dev_id;
> +	struct vmmdev_events *req = gdev->ack_events_req;
> +	bool mouse_position_changed = false;
> +	unsigned long flags;
> +	u32 events = 0;
> +	int rc;
> +
> +	if (!gdev->mmio->V.V1_04.have_events)
> +		return IRQ_NONE;
> +
> +	/* Get and acknowlegde events. */
> +	req->header.rc = VERR_INTERNAL_ERROR;
> +	req->events = 0;
> +	rc = vbg_req_perform(gdev, req);
> +	if (rc < 0) {
> +		vbg_err("Error performing events req, rc: %d\n", rc);
> +		return IRQ_NONE;
> +	}
> +
> +	events = req->events;
> +
> +	if (events & VMMDEV_EVENT_MOUSE_POSITION_CHANGED) {
> +		mouse_position_changed = true;
> +		events &= ~VMMDEV_EVENT_MOUSE_POSITION_CHANGED;
> +	}
> +
> +	if (events & VMMDEV_EVENT_HGCM) {
> +		wake_up(&gdev->hgcm_wq);
> +		events &= ~VMMDEV_EVENT_HGCM;
> +	}
> +
> +	if (events & VMMDEV_EVENT_BALLOON_CHANGE_REQUEST) {
> +		schedule_work(&gdev->mem_balloon.work);
> +		events &= ~VMMDEV_EVENT_BALLOON_CHANGE_REQUEST;
> +	}
> +
> +	if (events) {
> +		spin_lock_irqsave(&gdev->event_spinlock, flags);
> +		gdev->pending_events |= events;
> +		spin_unlock_irqrestore(&gdev->event_spinlock, flags);
> +
> +		wake_up(&gdev->event_wq);
> +	}
> +
> +	if (mouse_position_changed)
> +		vbg_linux_mouse_event(gdev);
> +
> +	return IRQ_HANDLED;
> +}
> diff --git a/drivers/virt/vboxguest/vboxguest_core.h b/drivers/virt/vboxguest/vboxguest_core.h
> new file mode 100644
> index 000000000000..423a985b0ab8
> --- /dev/null
> +++ b/drivers/virt/vboxguest/vboxguest_core.h
> @@ -0,0 +1,187 @@
> +/*
> + * Copyright (C) 2010-2016 Oracle Corporation
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + *
> + * The contents of this file may alternatively be used under the terms
> + * of the Common Development and Distribution License Version 1.0
> + * (CDDL) only, in which case the provisions of the CDDL are applicable
> + * instead of those of the GPL.
> + *
> + * You may elect to license modified versions of this file under the
> + * terms and conditions of either the GPL or the CDDL or both.
> + */
> +
> +#ifndef __VBOXGUEST_CORE_H__
> +#define __VBOXGUEST_CORE_H__
> +
> +#include <linux/input.h>
> +#include <linux/interrupt.h>
> +#include <linux/kernel.h>
> +#include <linux/list.h>
> +#include <linux/miscdevice.h>
> +#include <linux/spinlock.h>
> +#include <linux/wait.h>
> +#include <linux/workqueue.h>
> +#include <linux/vboxguest.h>
> +#include "vmmdev.h"
> +
> +struct vbg_session;
> +
> +/** VBox guest memory balloon. */
> +struct vbg_mem_balloon {
> +	/** Work handling VMMDEV_EVENT_BALLOON_CHANGE_REQUEST events */
> +	struct work_struct work;
> +	/** Pre-allocated vmmdev_memballoon_info req for query */
> +	struct vmmdev_memballoon_info *get_req;
> +	/** Pre-allocated vmmdev_memballoon_change req for inflate / deflate */
> +	struct vmmdev_memballoon_change *change_req;
> +	/** The current number of chunks in the balloon. */
> +	u32 chunks;
> +	/** The maximum number of chunks in the balloon. */
> +	u32 max_chunks;
> +	/**
> +	 * Array of pointers to page arrays. A page * array is allocated for
> +	 * each chunk when inflating, and freed when the deflating.
> +	 */
> +	struct page ***pages;
> +};
> +
> +/**
> + * Per bit usage tracker for a u32 mask.
> + *
> + * Used for optimal handling of guest properties and event filter.
> + */
> +struct vbg_bit_usage_tracker {
> +	/** Per bit usage counters. */
> +	u32 per_bit_usage[32];
> +	/** The current mask according to per_bit_usage. */
> +	u32 mask;
> +};
> +
> +/** VBox guest device (data) extension. */
> +struct vbg_dev {
> +	struct device *dev;
> +	/** The base of the adapter I/O ports. */
> +	u16 io_port;
> +	/** Pointer to the mapping of the VMMDev adapter memory. */
> +	struct vmmdev_memory *mmio;
> +	/** Host version */
> +	char host_version[64];
> +	/** Host features */
> +	unsigned int host_features;
> +	/**
> +	 * Dummy page and vmap address for reserved kernel virtual-address
> +	 * space for the guest mappings, only used on hosts lacking vtx.
> +	 */
> +	struct page *guest_mappings_dummy_page;
> +	void *guest_mappings;
> +	/** Spinlock protecting pending_events. */
> +	spinlock_t event_spinlock;
> +	/** Preallocated struct vmmdev_events for the IRQ handler. */
> +	struct vmmdev_events *ack_events_req;
> +	/** Wait-for-event list for threads waiting for multiple events. */
> +	wait_queue_head_t event_wq;
> +	/** Mask of pending events. */
> +	u32 pending_events;
> +	/** Wait-for-event list for threads waiting on HGCM async completion. */
> +	wait_queue_head_t hgcm_wq;
> +	/** Pre-allocated hgcm cancel2 req. for cancellation on timeout */
> +	struct vmmdev_hgcm_cancel2 *cancel_req;
> +	/** Mutex protecting cancel_req accesses */
> +	struct mutex cancel_req_mutex;
> +	/** Pre-allocated mouse-status request for the input-device handling. */
> +	struct vmmdev_mouse_status *mouse_status_req;
> +	/** Input device for reporting abs mouse coordinates to the guest. */
> +	struct input_dev *input;
> +
> +	/** Memory balloon information. */
> +	struct vbg_mem_balloon mem_balloon;
> +
> +	/** Lock for session related items in vbg_dev and vbg_session */
> +	struct mutex session_mutex;
> +	/** Events we won't permit anyone to filter out. */
> +	u32 fixed_events;
> +	/**
> +	 * Usage counters for the host events (excludes fixed events),
> +	 * Protected by session_mutex.
> +	 */
> +	struct vbg_bit_usage_tracker event_filter_tracker;
> +	/**
> +	 * The event filter last reported to the host (or UINT32_MAX).
> +	 * Protected by session_mutex.
> +	 */
> +	u32 event_filter_host;
> +
> +	/**
> +	 * Usage counters for guest capabilities. Indexed by capability bit
> +	 * number, one count per session using a capability.
> +	 * Protected by session_mutex.
> +	 */
> +	struct vbg_bit_usage_tracker guest_caps_tracker;
> +	/**
> +	 * The guest capabilities last reported to the host (or UINT32_MAX).
> +	 * Protected by session_mutex.
> +	 */
> +	u32 guest_caps_host;
> +
> +	/**
> +	 * Heartbeat timer which fires with interval
> +	 * cNsHearbeatInterval and its handler sends
> +	 * VMMDEVREQ_GUEST_HEARTBEAT to VMMDev.
> +	 */
> +	struct timer_list heartbeat_timer;
> +	/** Heartbeat timer interval in ms. */
> +	int heartbeat_interval_ms;
> +	/** Preallocated VMMDEVREQ_GUEST_HEARTBEAT request. */
> +	struct vmmdev_request_header *guest_heartbeat_req;
> +
> +	/** "vboxguest" char-device */
> +	struct miscdevice misc_device;
> +	/** "vboxuser" char-device */
> +	struct miscdevice misc_device_user;
> +};
> +
> +/** The VBoxGuest per session data. */
> +struct vbg_session {
> +	/** Pointer to the device extension. */
> +	struct vbg_dev *gdev;
> +
> +	/**
> +	 * Array containing HGCM client IDs associated with this session.
> +	 * These will be automatically disconnected when the session is closed.
> +	 * Protected by vbg_gdev.session_mutex.
> +	 */
> +	u32 hgcm_client_ids[64];
> +	/**
> +	 * Host events requested by the session.
> +	 * An event type requested in any guest session will be added to the
> +	 * host filter. Protected by vbg_gdev.session_mutex.
> +	 */
> +	u32 event_filter;
> +	/**
> +	 * Guest capabilities for this session.
> +	 * A capability claimed by any guest session will be reported to the
> +	 * host. Protected by vbg_gdev.session_mutex.
> +	 */
> +	u32 guest_caps;
> +	/** Does this session belong to a root process or a user one? */
> +	bool user_session;
> +	/** Set on CANCEL_ALL_WAITEVENTS, protected by vbg_devevent_spinlock. */
> +	bool cancel_waiters;
> +};
> +
> +int  vbg_core_init(struct vbg_dev *gdev, u32 fixed_events);
> +void vbg_core_exit(struct vbg_dev *gdev);
> +struct vbg_session *vbg_core_open_session(struct vbg_dev *gdev, bool user);
> +void vbg_core_close_session(struct vbg_session *session);
> +int  vbg_core_ioctl(struct vbg_session *session, unsigned int req, void *data);
> +int  vbg_core_set_mouse_status(struct vbg_dev *gdev, u32 features);
> +
> +irqreturn_t vbg_core_isr(int irq, void *dev_id);
> +
> +void vbg_linux_mouse_event(struct vbg_dev *gdev);
> +
> +#endif
> diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c
> new file mode 100644
> index 000000000000..86904b87ce83
> --- /dev/null
> +++ b/drivers/virt/vboxguest/vboxguest_linux.c
> @@ -0,0 +1,469 @@
> +/*
> + * vboxguest linux pci driver, char-dev and input-device code,
> + *
> + * Copyright (C) 2006-2016 Oracle Corporation
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + */
> +
> +#include <linux/input.h>
> +#include <linux/kernel.h>
> +#include <linux/miscdevice.h>
> +#include <linux/module.h>
> +#include <linux/pci.h>
> +#include <linux/poll.h>
> +#include <linux/vbox_utils.h>
> +#include "vboxguest_core.h"
> +
> +/** The device name. */
> +#define DEVICE_NAME		"vboxguest"
> +/** The device name for the device node open to everyone. */
> +#define DEVICE_NAME_USER	"vboxuser"
> +/** VirtualBox PCI vendor ID. */
> +#define VBOX_VENDORID		0x80ee
> +/** VMMDev PCI card product ID. */
> +#define VMMDEV_DEVICEID		0xcafe
> +
> +/** Mutex protecting the global vbg_gdev pointer used by vbg_get/put_gdev. */
> +static DEFINE_MUTEX(vbg_gdev_mutex);
> +/** Global vbg_gdev pointer used by vbg_get/put_gdev. */
> +static struct vbg_dev *vbg_gdev;
> +
> +static int vbg_misc_device_open(struct inode *inode, struct file *filp)
> +{
> +	struct vbg_session *session;
> +	struct vbg_dev *gdev;
> +
> +	/* misc_open sets filp->private_data to our misc device */
> +	gdev = container_of(filp->private_data, struct vbg_dev, misc_device);
> +
> +	session = vbg_core_open_session(gdev, false);
> +	if (IS_ERR(session))
> +		return PTR_ERR(session);
> +
> +	filp->private_data = session;
> +	return 0;
> +}
> +
> +static int vbg_misc_device_user_open(struct inode *inode, struct file *filp)
> +{
> +	struct vbg_session *session;
> +	struct vbg_dev *gdev;
> +
> +	/* misc_open sets filp->private_data to our misc device */
> +	gdev = container_of(filp->private_data, struct vbg_dev,
> +			    misc_device_user);
> +
> +	session = vbg_core_open_session(gdev, false);
> +	if (IS_ERR(session))
> +		return PTR_ERR(session);
> +
> +	filp->private_data = session;
> +	return 0;
> +}
> +
> +/**
> + * Close device.
> + * Return: 0 on success, negated errno on failure.
> + * @inode:		Pointer to inode info structure.
> + * @filp:		Associated file pointer.
> + */
> +static int vbg_misc_device_close(struct inode *inode, struct file *filp)
> +{
> +	vbg_core_close_session(filp->private_data);
> +	filp->private_data = NULL;
> +	return 0;
> +}
> +
> +/**
> + * Device I/O Control entry point.
> + * Return: 0 on success, negated errno on failure.
> + * @filp:		Associated file pointer.
> + * @req:		The request specified to ioctl().
> + * @arg:		The argument specified to ioctl().
> + */
> +static long vbg_misc_device_ioctl(struct file *filp, unsigned int req,
> +				  unsigned long arg)
> +{
> +	struct vbg_session *session = filp->private_data;
> +	size_t returned_size, size;
> +	struct vbg_ioctl_hdr hdr;
> +	int ret = 0;
> +	void *buf;
> +
> +	if (copy_from_user(&hdr, (void *)arg, sizeof(hdr)))
> +		return -EFAULT;
> +
> +	if (hdr.version != VBG_IOCTL_HDR_VERSION)
> +		return -EINVAL;
> +
> +	if (hdr.size_in < sizeof(hdr) ||
> +	    (hdr.size_out && hdr.size_out < sizeof(hdr)))
> +		return -EINVAL;
> +
> +	size = max(hdr.size_in, hdr.size_out);
> +	if (_IOC_SIZE(req) && _IOC_SIZE(req) != size)
> +		return -EINVAL;
> +	if (size > SZ_16M)
> +		return -E2BIG;
> +
> +	/* __GFP_DMA32 because IOCTL_VMMDEV_REQUEST passes this to the host */
> +	buf = kmalloc(size, GFP_KERNEL | __GFP_DMA32);
> +	if (!buf)
> +		return -ENOMEM;
> +
> +	if (copy_from_user(buf, (void *)arg, hdr.size_in)) {
> +		ret = -EFAULT;
> +		goto out;
> +	}
> +	if (hdr.size_in < size)
> +		memset(buf + hdr.size_in, 0, size -  hdr.size_in);
> +
> +	ret = vbg_core_ioctl(session, req, buf);
> +	if (ret)
> +		goto out;
> +
> +	returned_size = ((struct vbg_ioctl_hdr *)buf)->size_out;
> +	if (returned_size > size) {
> +		vbg_debug("%s: too much output data %zu > %zu\n",
> +			  __func__, returned_size, size);
> +		returned_size = size;
> +	}
> +	if (copy_to_user((void *)arg, buf, returned_size) != 0)
> +		ret = -EFAULT;
> +
> +out:
> +	kfree(buf);
> +
> +	return ret;
> +}
> +
> +/** The file_operations structures. */
> +static const struct file_operations vbg_misc_device_fops = {
> +	.owner			= THIS_MODULE,
> +	.open			= vbg_misc_device_open,
> +	.release		= vbg_misc_device_close,
> +	.unlocked_ioctl		= vbg_misc_device_ioctl,
> +#ifdef CONFIG_COMPAT
> +	.compat_ioctl		= vbg_misc_device_ioctl,
> +#endif
> +};
> +static const struct file_operations vbg_misc_device_user_fops = {
> +	.owner			= THIS_MODULE,
> +	.open			= vbg_misc_device_user_open,
> +	.release		= vbg_misc_device_close,
> +	.unlocked_ioctl		= vbg_misc_device_ioctl,
> +#ifdef CONFIG_COMPAT
> +	.compat_ioctl		= vbg_misc_device_ioctl,
> +#endif
> +};
> +
> +/**
> + * Called when the input device is first opened.
> + *
> + * Sets up absolute mouse reporting.
> + */
> +static int vbg_input_open(struct input_dev *input)
> +{
> +	struct vbg_dev *gdev = input_get_drvdata(input);
> +	u32 feat = VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE | VMMDEV_MOUSE_NEW_PROTOCOL;
> +	int ret;
> +
> +	ret = vbg_core_set_mouse_status(gdev, feat);
> +	if (ret)
> +		return ret;
> +
> +	return 0;
> +}
> +
> +/**
> + * Called if all open handles to the input device are closed.
> + *
> + * Disables absolute reporting.
> + */
> +static void vbg_input_close(struct input_dev *input)
> +{
> +	struct vbg_dev *gdev = input_get_drvdata(input);
> +
> +	vbg_core_set_mouse_status(gdev, 0);
> +}
> +
> +/**
> + * Creates the kernel input device.
> + *
> + * Return: 0 on success, negated errno on failure.
> + */
> +static int vbg_create_input_device(struct vbg_dev *gdev)
> +{
> +	struct input_dev *input;
> +
> +	input = devm_input_allocate_device(gdev->dev);
> +	if (!input)
> +		return -ENOMEM;
> +
> +	input->id.bustype = BUS_PCI;
> +	input->id.vendor = VBOX_VENDORID;
> +	input->id.product = VMMDEV_DEVICEID;
> +	input->open = vbg_input_open;
> +	input->close = vbg_input_close;
> +	input->dev.parent = gdev->dev;
> +	input->name = "VirtualBox mouse integration";
> +
> +	input_set_abs_params(input, ABS_X, VMMDEV_MOUSE_RANGE_MIN,
> +			     VMMDEV_MOUSE_RANGE_MAX, 0, 0);
> +	input_set_abs_params(input, ABS_Y, VMMDEV_MOUSE_RANGE_MIN,
> +			     VMMDEV_MOUSE_RANGE_MAX, 0, 0);
> +	input_set_capability(input, EV_KEY, BTN_MOUSE);
> +	input_set_drvdata(input, gdev);
> +
> +	gdev->input = input;
> +
> +	return input_register_device(gdev->input);
> +}
> +
> +static ssize_t host_version_show(struct device *dev,
> +				 struct device_attribute *attr, char *buf)
> +{
> +	struct vbg_dev *gdev = dev_get_drvdata(dev);
> +
> +	return sprintf(buf, "%s\n", gdev->host_version);
> +}
> +
> +static ssize_t host_features_show(struct device *dev,
> +				 struct device_attribute *attr, char *buf)
> +{
> +	struct vbg_dev *gdev = dev_get_drvdata(dev);
> +
> +	return sprintf(buf, "%#x\n", gdev->host_features);
> +}
> +
> +static DEVICE_ATTR_RO(host_version);
> +static DEVICE_ATTR_RO(host_features);
> +
> +/**
> + * Does the PCI detection and init of the device.
> + *
> + * Return: 0 on success, negated errno on failure.
> + */
> +static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
> +{
> +	struct device *dev = &pci->dev;
> +	resource_size_t io, io_len, mmio, mmio_len;
> +	struct vmmdev_memory *vmmdev;
> +	struct vbg_dev *gdev;
> +	int ret;
> +
> +	gdev = devm_kzalloc(dev, sizeof(*gdev), GFP_KERNEL);
> +	if (!gdev)
> +		return -ENOMEM;
> +
> +	ret = pci_enable_device(pci);
> +	if (ret != 0) {
> +		vbg_err("vboxguest: Error enabling device: %d\n", ret);
> +		return ret;
> +	}
> +
> +	ret = -ENODEV;
> +
> +	io = pci_resource_start(pci, 0);
> +	io_len = pci_resource_len(pci, 0);
> +	if (!io || !io_len) {
> +		vbg_err("vboxguest: Error IO-port resource (0) is missing\n");
> +		goto err_disable_pcidev;
> +	}
> +	if (devm_request_region(dev, io, io_len, DEVICE_NAME) == NULL) {
> +		vbg_err("vboxguest: Error could not claim IO resource\n");
> +		ret = -EBUSY;
> +		goto err_disable_pcidev;
> +	}
> +
> +	mmio = pci_resource_start(pci, 1);
> +	mmio_len = pci_resource_len(pci, 1);
> +	if (!mmio || !mmio_len) {
> +		vbg_err("vboxguest: Error MMIO resource (1) is missing\n");
> +		goto err_disable_pcidev;
> +	}
> +
> +	if (devm_request_mem_region(dev, mmio, mmio_len, DEVICE_NAME) == NULL) {
> +		vbg_err("vboxguest: Error could not claim MMIO resource\n");
> +		ret = -EBUSY;
> +		goto err_disable_pcidev;
> +	}
> +
> +	vmmdev = devm_ioremap(dev, mmio, mmio_len);
> +	if (!vmmdev) {
> +		vbg_err("vboxguest: Error ioremap failed; MMIO addr=%p size=%d\n",
> +			(void *)mmio, (int)mmio_len);
> +		goto err_disable_pcidev;
> +	}
> +
> +	/* Validate MMIO region version and size. */
> +	if (vmmdev->version != VMMDEV_MEMORY_VERSION ||
> +	    vmmdev->size < 32 || vmmdev->size > mmio_len) {
> +		vbg_err("vboxguest: Bogus VMMDev memory; version=%08x (expected %08x) size=%d (expected <= %d)\n",
> +			vmmdev->version, VMMDEV_MEMORY_VERSION,
> +			vmmdev->size, (int)mmio_len);
> +		goto err_disable_pcidev;
> +	}
> +
> +	gdev->io_port = io;
> +	gdev->mmio = vmmdev;
> +	gdev->dev = dev;
> +	gdev->misc_device.minor = MISC_DYNAMIC_MINOR;
> +	gdev->misc_device.name = DEVICE_NAME;
> +	gdev->misc_device.fops = &vbg_misc_device_fops;
> +	gdev->misc_device_user.minor = MISC_DYNAMIC_MINOR;
> +	gdev->misc_device_user.name = DEVICE_NAME_USER;
> +	gdev->misc_device_user.fops = &vbg_misc_device_user_fops;
> +
> +	ret = vbg_core_init(gdev, VMMDEV_EVENT_MOUSE_POSITION_CHANGED);
> +	if (ret)
> +		goto err_disable_pcidev;
> +
> +	ret = vbg_create_input_device(gdev);
> +	if (ret) {
> +		vbg_err("vboxguest: Error creating input device: %d\n", ret);
> +		goto err_vbg_core_exit;
> +	}
> +
> +	ret = devm_request_irq(dev, pci->irq, vbg_core_isr, IRQF_SHARED,
> +			       DEVICE_NAME, gdev);
> +	if (ret) {
> +		vbg_err("vboxguest: Error requesting irq: %d\n", ret);
> +		goto err_vbg_core_exit;
> +	}
> +
> +	ret = misc_register(&gdev->misc_device);
> +	if (ret) {
> +		vbg_err("vboxguest: Error misc_register %s failed: %d\n",
> +			DEVICE_NAME, ret);
> +		goto err_vbg_core_exit;
> +	}
> +
> +	ret = misc_register(&gdev->misc_device_user);
> +	if (ret) {
> +		vbg_err("vboxguest: Error misc_register %s failed: %d\n",
> +			DEVICE_NAME_USER, ret);
> +		goto err_unregister_misc_device;
> +	}
> +
> +	mutex_lock(&vbg_gdev_mutex);
> +	if (!vbg_gdev)
> +		vbg_gdev = gdev;
> +	else
> +		ret = -EBUSY;
> +	mutex_unlock(&vbg_gdev_mutex);
> +
> +	if (ret) {
> +		vbg_err("vboxguest: Error more then 1 vbox guest pci device\n");
> +		goto err_unregister_misc_device_user;
> +	}
> +
> +	pci_set_drvdata(pci, gdev);
> +	device_create_file(dev, &dev_attr_host_version);
> +	device_create_file(dev, &dev_attr_host_features);
> +
> +	vbg_info("vboxguest: misc device minor %d, IRQ %d, I/O port %x, MMIO at %p (size %d)\n",
> +		 gdev->misc_device.minor, pci->irq, gdev->io_port,
> +		 (void *)mmio, (int)mmio_len);
> +
> +	return 0;
> +
> +err_unregister_misc_device_user:
> +	misc_deregister(&gdev->misc_device_user);
> +err_unregister_misc_device:
> +	misc_deregister(&gdev->misc_device);
> +err_vbg_core_exit:
> +	vbg_core_exit(gdev);
> +err_disable_pcidev:
> +	pci_disable_device(pci);
> +
> +	return ret;
> +}
> +
> +static void vbg_pci_remove(struct pci_dev *pci)
> +{
> +	struct vbg_dev *gdev = pci_get_drvdata(pci);
> +
> +	mutex_lock(&vbg_gdev_mutex);
> +	vbg_gdev = NULL;
> +	mutex_unlock(&vbg_gdev_mutex);
> +
> +	device_remove_file(gdev->dev, &dev_attr_host_features);
> +	device_remove_file(gdev->dev, &dev_attr_host_version);
> +	misc_deregister(&gdev->misc_device_user);
> +	misc_deregister(&gdev->misc_device);
> +	vbg_core_exit(gdev);
> +	pci_disable_device(pci);
> +}
> +
> +struct vbg_dev *vbg_get_gdev(void)
> +{
> +	mutex_lock(&vbg_gdev_mutex);
> +
> +	/*
> +	 * Note on success we keep the mutex locked until vbg_put_gdev(),
> +	 * this stops vbg_pci_remove from removing the device from underneath
> +	 * vboxsf. vboxsf will only hold a reference for a short while.
> +	 */
> +	if (vbg_gdev)
> +		return vbg_gdev;
> +
> +	mutex_unlock(&vbg_gdev_mutex);
> +	return ERR_PTR(-ENODEV);
> +}
> +EXPORT_SYMBOL(vbg_get_gdev);
> +
> +void vbg_put_gdev(struct vbg_dev *gdev)
> +{
> +	WARN_ON(gdev != vbg_gdev);
> +	mutex_unlock(&vbg_gdev_mutex);
> +}
> +EXPORT_SYMBOL(vbg_put_gdev);
> +
> +/**
> + * Callback for mouse events.
> + *
> + * This is called at the end of the ISR, after leaving the event spinlock, if
> + * VMMDEV_EVENT_MOUSE_POSITION_CHANGED was raised by the host.
> + *
> + * @gdev:		The device extension.
> + */
> +void vbg_linux_mouse_event(struct vbg_dev *gdev)
> +{
> +	int rc;
> +
> +	/* Report events to the kernel input device */
> +	gdev->mouse_status_req->mouse_features = 0;
> +	gdev->mouse_status_req->pointer_pos_x = 0;
> +	gdev->mouse_status_req->pointer_pos_y = 0;
> +	rc = vbg_req_perform(gdev, gdev->mouse_status_req);
> +	if (rc >= 0) {
> +		input_report_abs(gdev->input, ABS_X,
> +				 gdev->mouse_status_req->pointer_pos_x);
> +		input_report_abs(gdev->input, ABS_Y,
> +				 gdev->mouse_status_req->pointer_pos_y);
> +		input_sync(gdev->input);
> +	}
> +}
> +
> +static const struct pci_device_id vbg_pci_ids[] = {
> +	{ .vendor = VBOX_VENDORID, .device = VMMDEV_DEVICEID },
> +	{}
> +};
> +MODULE_DEVICE_TABLE(pci,  vbg_pci_ids);
> +
> +static struct pci_driver vbg_pci_driver = {
> +	.name		= DEVICE_NAME,
> +	.id_table	= vbg_pci_ids,
> +	.probe		= vbg_pci_probe,
> +	.remove		= vbg_pci_remove,
> +};
> +
> +module_pci_driver(vbg_pci_driver);
> +
> +MODULE_AUTHOR("Oracle Corporation");
> +MODULE_DESCRIPTION("Oracle VM VirtualBox Guest Additions for Linux Module");
> +MODULE_LICENSE("GPL");
> diff --git a/drivers/virt/vboxguest/vboxguest_version.h b/drivers/virt/vboxguest/vboxguest_version.h
> new file mode 100644
> index 000000000000..2aed18a2005f
> --- /dev/null
> +++ b/drivers/virt/vboxguest/vboxguest_version.h
> @@ -0,0 +1,18 @@
> +/*
> + * VBox Guest additions version info, this is used by the host to determine
> + * supported guest-addition features in some cases. So this will need to be
> + * synced with vbox upstreams versioning scheme when we implement / port
> + * new features from the upstream out-of-tree vboxguest driver.
> + */
> +
> +#ifndef __VBOX_VERSION_H__
> +#define __VBOX_VERSION_H__
> +
> +/* Last synced October 4th 2017 */
> +#define VBG_VERSION_MAJOR 5
> +#define VBG_VERSION_MINOR 2
> +#define VBG_VERSION_BUILD 0
> +#define VBG_SVN_REV 68940
> +#define VBG_VERSION_STRING "5.2.0"
> +
> +#endif
> 

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH resend v2 2/3] virt: Add vboxguest VMMDEV communication code
  2017-11-26 15:12 ` [PATCH resend v2 2/3] virt: Add vboxguest VMMDEV communication code Hans de Goede
@ 2017-11-27 19:46   ` Larry Finger
  2017-11-29 13:17     ` Hans de Goede
  0 siblings, 1 reply; 14+ messages in thread
From: Larry Finger @ 2017-11-27 19:46 UTC (permalink / raw)
  To: Hans de Goede, Arnd Bergmann, Greg Kroah-Hartman
  Cc: Michael Thayer, Knut St . Osmundsen, Christoph Hellwig, linux-kernel

On 11/26/2017 09:12 AM, Hans de Goede wrote:
> This commits adds a header describing the hardware interface for the
> Virtual Box Guest PCI device used in Virtual Box virtual machines and
> utility functions for talking to the Virtual Box hypervisor over this
> interface.
> 
> These utility functions will used both by the vboxguest driver for the
> PCI device which offers the /dev/vboxguest ioctl API and by the vboxfs
> driver which offers folder sharing support.
> 
> Signed-off-by: Hans de Goede <hdegoede@redhat.com>

Reviewed-by: Larry Finger <Larry.Finger.net>

This patch has only minor defects. Please see the inline comments.

> ---
> Changes in v2:
> -Change all uapi headers to kernel coding style: Drop struct and enum typedefs
>   make type and struct-member names all lowercase, enum values all uppercase.
> -Remove unused struct type declarations from some headers (shaving of another
>   1000 lines)
> -Remove or fixup doxygen style comments
> -Get rid of CHECK macros, use a function taking in_ and out_size args instead
> -Some other small codyingstyle fixes
> -Split into multiple patches
> ---
>   MAINTAINERS                              |   2 +
>   drivers/virt/vboxguest/vboxguest_utils.c | 811 +++++++++++++++++++++++++++++++
>   drivers/virt/vboxguest/vmmdev.h          | 460 ++++++++++++++++++
>   include/linux/vbox_utils.h               |  92 ++++
>   4 files changed, 1365 insertions(+)
>   create mode 100644 drivers/virt/vboxguest/vboxguest_utils.c
>   create mode 100644 drivers/virt/vboxguest/vmmdev.h
>   create mode 100644 include/linux/vbox_utils.h
> 
> diff --git a/MAINTAINERS b/MAINTAINERS
> index fe3dc0e9b901..01b30c12c267 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -14554,7 +14554,9 @@ M:	Hans de Goede <hdegoede@redhat.com>
>   M:	Arnd Bergmann <arnd@arndb.de>
>   M:	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>   S:	Maintained
> +F:	include/linux/vbox_utils.h
>   F:	include/uapi/linux/vbox*.h
> +F:	drivers/virt/vboxguest/
>   
>   VIRTUAL SERIO DEVICE DRIVER
>   M:	Stephen Chandler Paul <thatslyude@gmail.com>
> diff --git a/drivers/virt/vboxguest/vboxguest_utils.c b/drivers/virt/vboxguest/vboxguest_utils.c
> new file mode 100644
> index 000000000000..5e1737d0a4fb
> --- /dev/null
> +++ b/drivers/virt/vboxguest/vboxguest_utils.c
> @@ -0,0 +1,811 @@
> +/*
> + * vboxguest vmm-req and hgcm-call code, VBoxGuestR0LibHGCMInternal.cpp,
> + * VBoxGuestR0LibGenericRequest.cpp and RTErrConvertToErrno.cpp in vbox svn.
> + *
> + * Copyright (C) 2006-2016 Oracle Corporation
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + *
> + * The contents of this file may alternatively be used under the terms
> + * of the Common Development and Distribution License Version 1.0
> + * (CDDL) only, in which case the provisions of the CDDL are applicable
> + * instead of those of the GPL.
> + *
> + * You may elect to license modified versions of this file under the
> + * terms and conditions of either the GPL or the CDDL or both.
> + */
> +
> +#include <linux/errno.h>
> +#include <linux/kernel.h>
> +#include <linux/mm.h>
> +#include <linux/module.h>
> +#include <linux/sizes.h>
> +#include <linux/slab.h>
> +#include <linux/uaccess.h>
> +#include <linux/vmalloc.h>
> +#include <linux/vbox_err.h>
> +#include <linux/vbox_utils.h>
> +#include "vboxguest_core.h"
> +
> +/* Get the pointer to the first parameter of a HGCM call request. */
> +#define VMMDEV_HGCM_CALL_PARMS(a) \
> +	((struct vmmdev_hgcm_function_parameter *)( \
> +		(u8 *)(a) + sizeof(struct vmmdev_hgcm_call)))
> +
> +/* The max parameter buffer size for a user request. */
> +#define VBG_MAX_HGCM_USER_PARM		(24 * SZ_1M)
> +/* The max parameter buffer size for a kernel request. */
> +#define VBG_MAX_HGCM_KERNEL_PARM	(16 * SZ_1M)
> +
> +#define VBG_DEBUG_PORT			0x504
> +
> +/* This protects vbg_log_buf and serializes VBG_DEBUG_PORT accesses */
> +static DEFINE_SPINLOCK(vbg_log_lock);
> +static char vbg_log_buf[128];
> +
> +#define VBG_LOG(name, pr_func) \
> +void name(const char *fmt, ...)						\
> +{									\
> +	unsigned long flags;						\
> +	va_list args;							\
> +	int i, count;							\
> +									\
> +	va_start(args, fmt);						\
> +	spin_lock_irqsave(&vbg_log_lock, flags);			\
> +									\
> +	count = vscnprintf(vbg_log_buf, sizeof(vbg_log_buf), fmt, args);\
> +	for (i = 0; i < count; i++)					\
> +		outb(vbg_log_buf[i], VBG_DEBUG_PORT);			\
> +									\
> +	pr_func("%s", vbg_log_buf);					\
> +									\
> +	spin_unlock_irqrestore(&vbg_log_lock, flags);			\
> +	va_end(args);							\
> +}									\
> +EXPORT_SYMBOL(name)
> +
> +VBG_LOG(vbg_info, pr_info);
> +VBG_LOG(vbg_warn, pr_warn);
> +VBG_LOG(vbg_err, pr_err);
> +#if defined(DEBUG) && !defined(CONFIG_DYNAMIC_DEBUG)
> +VBG_LOG(vbg_debug, pr_debug);
> +#endif
> +
> +void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type)
> +{
> +	struct vmmdev_request_header *req;
> +
> +	req = kmalloc(len, GFP_KERNEL | __GFP_DMA32);
> +	if (!req)
> +		return NULL;
> +
> +	memset(req, 0xaa, len);
> +
> +	req->size = len;
> +	req->version = VMMDEV_REQUEST_HEADER_VERSION;
> +	req->request_type = req_type;
> +	req->rc = VERR_GENERAL_FAILURE;
> +	req->reserved1 = 0;
> +	req->reserved2 = 0;
> +
> +	return req;
> +}
> +
> +/* Note this function returns a VBox status code, not a negative errno!! */
> +int vbg_req_perform(struct vbg_dev *gdev, void *req)
> +{
> +	unsigned long phys_req = virt_to_phys(req);
> +
> +	outl(phys_req, gdev->io_port + VMMDEV_PORT_OFF_REQUEST);
> +	/*
> +	 * The host changes the request as a result of the outl, make sure
> +	 * the outl and any reads of the req happen in the correct order.
> +	 */
> +	mb();
> +
> +	return ((struct vmmdev_request_header *)req)->rc;
> +}
> +
> +static bool hgcm_req_done(struct vbg_dev *gdev,
> +			  struct vmmdev_hgcmreq_header *header)
> +{
> +	unsigned long flags;
> +	bool done;
> +
> +	spin_lock_irqsave(&gdev->event_spinlock, flags);
> +	done = header->flags & VMMDEV_HGCM_REQ_DONE;
> +	spin_unlock_irqrestore(&gdev->event_spinlock, flags);
> +
> +	return done;
> +}
> +
> +int vbg_hgcm_connect(struct vbg_dev *gdev,
> +		     struct vmmdev_hgcm_service_location *loc,
> +		     u32 *client_id, int *vbox_status)
> +{
> +	struct vmmdev_hgcm_connect *hgcm_connect = NULL;
> +	int rc;
> +
> +	hgcm_connect = vbg_req_alloc(sizeof(*hgcm_connect),
> +				     VMMDEVREQ_HGCM_CONNECT);
> +	if (!hgcm_connect)
> +		return -ENOMEM;
> +
> +	hgcm_connect->header.flags = 0;
> +	memcpy(&hgcm_connect->loc, loc, sizeof(*loc));
> +	hgcm_connect->client_id = 0;
> +
> +	rc = vbg_req_perform(gdev, hgcm_connect);
> +
> +	if (rc == VINF_HGCM_ASYNC_EXECUTE)
> +		wait_event(gdev->hgcm_wq,
> +			   hgcm_req_done(gdev, &hgcm_connect->header));
> +
> +	if (rc >= 0) {
> +		*client_id = hgcm_connect->client_id;
> +		rc = hgcm_connect->header.result;
> +	}
> +
> +	kfree(hgcm_connect);
> +
> +	*vbox_status = rc;
> +	return 0;
> +}
> +EXPORT_SYMBOL(vbg_hgcm_connect);
> +
> +int vbg_hgcm_disconnect(struct vbg_dev *gdev, u32 client_id, int *vbox_status)
> +{
> +	struct vmmdev_hgcm_disconnect *hgcm_disconnect = NULL;
> +	int rc;
> +
> +	hgcm_disconnect = vbg_req_alloc(sizeof(*hgcm_disconnect),
> +					VMMDEVREQ_HGCM_DISCONNECT);
> +	if (!hgcm_disconnect)
> +		return -ENOMEM;
> +
> +	hgcm_disconnect->header.flags = 0;
> +	hgcm_disconnect->client_id = client_id;
> +
> +	rc = vbg_req_perform(gdev, hgcm_disconnect);
> +
> +	if (rc == VINF_HGCM_ASYNC_EXECUTE)
> +		wait_event(gdev->hgcm_wq,
> +			   hgcm_req_done(gdev, &hgcm_disconnect->header));
> +
> +	if (rc >= 0)
> +		rc = hgcm_disconnect->header.result;
> +
> +	kfree(hgcm_disconnect);
> +
> +	*vbox_status = rc;
> +	return 0;
> +}
> +EXPORT_SYMBOL(vbg_hgcm_disconnect);
> +
> +static u32 hgcm_call_buf_size_in_pages(void *buf, u32 len)
> +{
> +	u32 size = PAGE_ALIGN(len + ((unsigned long)buf & ~PAGE_MASK));
> +
> +	return size >> PAGE_SHIFT;
> +}
> +
> +static void hgcm_call_add_pagelist_size(void *buf, u32 len, size_t *extra)
> +{
> +	u32 page_count;
> +
> +	page_count = hgcm_call_buf_size_in_pages(buf, len);
> +	*extra += offsetof(struct vmmdev_hgcm_pagelist, pages[page_count]);
> +}
> +
> +static int hgcm_call_preprocess_linaddr(
> +	const struct vmmdev_hgcm_function_parameter *src_parm,
> +	void **bounce_buf_ret, size_t *extra)
> +{
> +	void *buf, *bounce_buf;
> +	bool copy_in;
> +	u32 len;
> +	int ret;
> +
> +	buf = (void *)src_parm->u.pointer.u.linear_addr;
> +	len = src_parm->u.pointer.size;
> +	copy_in = src_parm->type != VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT;
> +
> +	if (len > VBG_MAX_HGCM_USER_PARM)
> +		return -E2BIG;
> +
> +	bounce_buf = kvmalloc(len, GFP_KERNEL);
> +	if (!bounce_buf)
> +		return -ENOMEM;
> +
> +	if (copy_in) {
> +		ret = copy_from_user(bounce_buf, (void __user *)buf, len);
> +		if (ret)
> +			return -EFAULT;
> +	} else {
> +		memset(bounce_buf, 0, len);
> +	}
> +
> +	*bounce_buf_ret = bounce_buf;
> +	hgcm_call_add_pagelist_size(bounce_buf, len, extra);
> +	return 0;
> +}
> +
> +/**
> + * Preprocesses the HGCM call, validate parameters, alloc bounce buffers and
> + * figure out how much extra storage we need for page lists.
> + * Return: 0 or negative errno value.
> + * @src_parm:         Pointer to source function call parameters
> + * @parm_count:       Number of function call parameters.
> + * @bounce_bufs_ret:  Where to return the allocated bouncebuffer array
> + * @extra:            Where to return the extra request space needed for
> + *                    physical page lists.
> + */
> +static int hgcm_call_preprocess(
> +	const struct vmmdev_hgcm_function_parameter *src_parm,
> +	u32 parm_count, void ***bounce_bufs_ret, size_t *extra)
> +{
> +	void *buf, **bounce_bufs = NULL;
> +	u32 i, len;
> +	int ret;
> +
> +	for (i = 0; i < parm_count; i++, src_parm++) {
> +		switch (src_parm->type) {
> +		case VMMDEV_HGCM_PARM_TYPE_32BIT:
> +		case VMMDEV_HGCM_PARM_TYPE_64BIT:
> +			break;
> +
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
> +			if (!bounce_bufs) {
> +				bounce_bufs = kcalloc(parm_count,
> +						      sizeof(void *),
> +						      GFP_KERNEL);
> +				if (!bounce_bufs)
> +					return -ENOMEM;
> +
> +				*bounce_bufs_ret = bounce_bufs;
> +			}
> +
> +			ret = hgcm_call_preprocess_linaddr(src_parm,
> +							   &bounce_bufs[i],
> +							   extra);
> +			if (ret)
> +				return ret;
> +
> +			break;
> +
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT:
> +			buf = (void *)src_parm->u.pointer.u.linear_addr;
> +			len = src_parm->u.pointer.size;
> +			if (WARN_ON(len > VBG_MAX_HGCM_KERNEL_PARM))
> +				return -E2BIG;
> +
> +			hgcm_call_add_pagelist_size(buf, len, extra);
> +			break;
> +
> +		default:
> +			return -EINVAL;
> +		}
> +	}
> +
> +	return 0;
> +}
> +
> +/**
> + * Translates linear address types to page list direction flags.
> + *
> + * Return: page list flags.
> + * @type:  The type.
> + */
> +static u32 hgcm_call_linear_addr_type_to_pagelist_flags(
> +	enum vmmdev_hgcm_function_parameter_type type)
> +{
> +	switch (type) {
> +	default:
> +		WARN_ON(1);

Do you intend a fall through here? If so, please add a comment to that effect.

> +	case VMMDEV_HGCM_PARM_TYPE_LINADDR:
> +	case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL:
> +		return VMMDEV_HGCM_F_PARM_DIRECTION_BOTH;
> +
> +	case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
> +	case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN:
> +		return VMMDEV_HGCM_F_PARM_DIRECTION_TO_HOST;
> +
> +	case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
> +	case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT:
> +		return VMMDEV_HGCM_F_PARM_DIRECTION_FROM_HOST;
> +	}
> +}
> +
> +static void hgcm_call_init_linaddr(struct vmmdev_hgcm_call *call,
> +	struct vmmdev_hgcm_function_parameter *dst_parm, void *buf, u32 len,
> +	enum vmmdev_hgcm_function_parameter_type type, u32 *off_extra)
> +{
> +	struct vmmdev_hgcm_pagelist *dst_pg_lst;
> +	struct page *page;
> +	bool is_vmalloc;
> +	u32 i, page_count;
> +
> +	dst_parm->type = type;
> +
> +	if (len == 0) {
> +		dst_parm->u.pointer.size = 0;
> +		dst_parm->u.pointer.u.linear_addr = 0;
> +		return;
> +	}
> +
> +	dst_pg_lst = (void *)call + *off_extra;
> +	page_count = hgcm_call_buf_size_in_pages(buf, len);
> +	is_vmalloc = is_vmalloc_addr(buf);
> +
> +	dst_parm->type = VMMDEV_HGCM_PARM_TYPE_PAGELIST;
> +	dst_parm->u.page_list.size = len;
> +	dst_parm->u.page_list.offset = *off_extra;
> +	dst_pg_lst->flags = hgcm_call_linear_addr_type_to_pagelist_flags(type);
> +	dst_pg_lst->offset_first_page = (unsigned long)buf & ~PAGE_MASK;
> +	dst_pg_lst->page_count = page_count;
> +
> +	for (i = 0; i < page_count; i++) {
> +		if (is_vmalloc)
> +			page = vmalloc_to_page(buf);
> +		else
> +			page = virt_to_page(buf);
> +
> +		dst_pg_lst->pages[i] = page_to_phys(page);
> +		buf += PAGE_SIZE;
> +	}
> +
> +	*off_extra += offsetof(struct vmmdev_hgcm_pagelist, pages[page_count]);
> +}
> +
> +/**
> + * Initializes the call request that we're sending to the host.
> + * @call:            The call to initialize.
> + * @client_id:       The client ID of the caller.
> + * @function:        The function number of the function to call.
> + * @src_parm:        Pointer to source function call parameters.
> + * @parm_count:      Number of function call parameters.
> + * @bounce_bufs:     The bouncebuffer array.
> + */
> +static void hgcm_call_init_call(
> +	struct vmmdev_hgcm_call *call, u32 client_id, u32 function,
> +	const struct vmmdev_hgcm_function_parameter *src_parm,
> +	u32 parm_count, void **bounce_bufs)
> +{
> +	struct vmmdev_hgcm_function_parameter *dst_parm =
> +		VMMDEV_HGCM_CALL_PARMS(call);
> +	u32 i, off_extra = (uintptr_t)(dst_parm + parm_count) - (uintptr_t)call;
> +	void *buf;
> +
> +	call->header.flags = 0;
> +	call->header.result = VINF_SUCCESS;
> +	call->client_id = client_id;
> +	call->function = function;
> +	call->parm_count = parm_count;
> +
> +	for (i = 0; i < parm_count; i++, src_parm++, dst_parm++) {
> +		switch (src_parm->type) {
> +		case VMMDEV_HGCM_PARM_TYPE_32BIT:
> +		case VMMDEV_HGCM_PARM_TYPE_64BIT:
> +			*dst_parm = *src_parm;
> +			break;
> +
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
> +			hgcm_call_init_linaddr(call, dst_parm, bounce_bufs[i],
> +					       src_parm->u.pointer.size,
> +					       src_parm->type, &off_extra);
> +			break;
> +
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT:
> +			buf = (void *)src_parm->u.pointer.u.linear_addr;
> +			hgcm_call_init_linaddr(call, dst_parm, buf,
> +					       src_parm->u.pointer.size,
> +					       src_parm->type, &off_extra);
> +			break;
> +
> +		default:
> +			WARN_ON(1);
> +			dst_parm->type = VMMDEV_HGCM_PARM_TYPE_INVALID;
> +		}
> +	}
> +}
> +
> +/**
> + * Tries to cancel a pending HGCM call.
> + *
> + * Return: VBox status code
> + */
> +static int hgcm_cancel_call(struct vbg_dev *gdev, struct vmmdev_hgcm_call *call)
> +{
> +	int rc;
> +
> +	/*
> +	 * We use a pre-allocated request for cancellations, which is
> +	 * protected by cancel_req_mutex. This means that all cancellations
> +	 * get serialized, this should be fine since they should be rare.
> +	 */
> +	mutex_lock(&gdev->cancel_req_mutex);
> +	gdev->cancel_req->phys_req_to_cancel = virt_to_phys(call);
> +	rc = vbg_req_perform(gdev, gdev->cancel_req);
> +	mutex_unlock(&gdev->cancel_req_mutex);
> +
> +	if (rc == VERR_NOT_IMPLEMENTED) {
> +		call->header.flags |= VMMDEV_HGCM_REQ_CANCELLED;
> +		call->header.header.request_type = VMMDEVREQ_HGCM_CANCEL;
> +
> +		rc = vbg_req_perform(gdev, call);
> +		if (rc == VERR_INVALID_PARAMETER)
> +			rc = VERR_NOT_FOUND;
> +	}
> +
> +	if (rc >= 0)
> +		call->header.flags |= VMMDEV_HGCM_REQ_CANCELLED;
> +
> +	return rc;
> +}
> +
> +/**
> + * Performs the call and completion wait.
> + * Return: 0 or negative errno value.
> + * @gdev:        The VBoxGuest device extension.
> + * @call:        The call to execute.
> + * @timeout_ms:  Timeout in ms.
> + * @leak_it:     Where to return the leak it / free it, indicator.
> + *               Cancellation fun.
> + */
> +static int vbg_hgcm_do_call(struct vbg_dev *gdev, struct vmmdev_hgcm_call *call,
> +			    u32 timeout_ms, bool *leak_it)
> +{
> +	int rc, cancel_rc, ret;
> +	long timeout;
> +
> +	*leak_it = false;
> +
> +	rc = vbg_req_perform(gdev, call);
> +
> +	/*
> +	 * If the call failed, then pretend success. Upper layers will
> +	 * interpret the result code in the packet.
> +	 */
> +	if (rc < 0) {
> +		call->header.result = rc;
> +		return 0;
> +	}
> +
> +	if (rc != VINF_HGCM_ASYNC_EXECUTE)
> +		return 0;
> +
> +	/* Host decided to process the request asynchronously, wait for it */
> +	if (timeout_ms == U32_MAX)
> +		timeout = MAX_SCHEDULE_TIMEOUT;
> +	else
> +		timeout = msecs_to_jiffies(timeout_ms);
> +
> +	timeout = wait_event_interruptible_timeout(
> +					gdev->hgcm_wq,
> +					hgcm_req_done(gdev, &call->header),
> +					timeout);
> +
> +	/* timeout > 0 means hgcm_req_done has returned true, so success */
> +	if (timeout > 0)
> +		return 0;
> +
> +	if (timeout == 0)
> +		ret = -ETIMEDOUT;
> +	else
> +		ret = -EINTR;
> +
> +	/* Cancel the request */
> +	cancel_rc = hgcm_cancel_call(gdev, call);
> +	if (cancel_rc >= 0)
> +		return ret;
> +
> +	/*
> +	 * Failed to cancel, this should mean that the cancel has lost the
> +	 * race with normal completion, wait while the host completes it.
> +	 */
> +	if (cancel_rc == VERR_NOT_FOUND || cancel_rc == VERR_SEM_DESTROYED)
> +		timeout = msecs_to_jiffies(500);
> +	else
> +		timeout = msecs_to_jiffies(2000);
> +
> +	timeout = wait_event_timeout(gdev->hgcm_wq,
> +				     hgcm_req_done(gdev, &call->header),
> +				     timeout);
> +
> +	if (WARN_ON(timeout == 0)) {
> +		/* We really should never get here */
> +		vbg_err("%s: Call timedout and cancellation failed, leaking the request\n",
> +			__func__);
> +		*leak_it = true;
> +		return ret;
> +	}
> +
> +	/* The call has completed normally after all */
> +	return 0;
> +}
> +
> +/**
> + * Copies the result of the call back to the caller info structure and user
> + * buffers.
> + * Return: 0 or negative errno value.
> + * @call:            HGCM call request.
> + * @dst_parm:        Pointer to function call parameters destination.
> + * @parm_count:      Number of function call parameters.
> + * @bounce_bufs:     The bouncebuffer array.
> + */
> +static int hgcm_call_copy_back_result(
> +	const struct vmmdev_hgcm_call *call,
> +	struct vmmdev_hgcm_function_parameter *dst_parm,
> +	u32 parm_count, void **bounce_bufs)
> +{
> +	const struct vmmdev_hgcm_function_parameter *src_parm =
> +		VMMDEV_HGCM_CALL_PARMS(call);
> +	void __user *p;
> +	int ret;
> +	u32 i;
> +
> +	/* Copy back parameters. */
> +	for (i = 0; i < parm_count; i++, src_parm++, dst_parm++) {
> +		switch (dst_parm->type) {
> +		case VMMDEV_HGCM_PARM_TYPE_32BIT:
> +		case VMMDEV_HGCM_PARM_TYPE_64BIT:
> +			*dst_parm = *src_parm;
> +			break;
> +
> +		case VMMDEV_HGCM_PARM_TYPE_PAGELIST:
> +			dst_parm->u.page_list.size = src_parm->u.page_list.size;
> +			break;
> +
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT:
> +			dst_parm->u.pointer.size = src_parm->u.pointer.size;
> +			break;
> +
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
> +			dst_parm->u.pointer.size = src_parm->u.pointer.size;
> +
> +			p = (void __user *)dst_parm->u.pointer.u.linear_addr;
> +			ret = copy_to_user(p, bounce_bufs[i],
> +					   min(src_parm->u.pointer.size,
> +					       dst_parm->u.pointer.size));
> +			if (ret)
> +				return -EFAULT;
> +			break;
> +
> +		default:
> +			WARN_ON(1);
> +			return -EINVAL;
> +		}
> +	}
> +
> +	return 0;
> +}
> +
> +int vbg_hgcm_call(struct vbg_dev *gdev, u32 client_id, u32 function,
> +		  u32 timeout_ms, struct vmmdev_hgcm_function_parameter *parms,
> +		  u32 parm_count, int *vbox_status)
> +{
> +	struct vmmdev_hgcm_call *call;
> +	void **bounce_bufs = NULL;
> +	bool leak_it;
> +	size_t size;
> +	int i, ret;
> +
> +	size = sizeof(struct vmmdev_hgcm_call) +
> +		   parm_count * sizeof(struct vmmdev_hgcm_function_parameter);
> +	/*
> +	 * Validate and buffer the parameters for the call. This also increases
> +	 * call_size with the amount of extra space needed for page lists.
> +	 */
> +	ret = hgcm_call_preprocess(parms, parm_count, &bounce_bufs, &size);
> +	if (ret) {
> +		/* Even on error bounce bufs may still have been allocated */
> +		goto free_bounce_bufs;
> +	}
> +
> +	call = vbg_req_alloc(size, VMMDEVREQ_HGCM_CALL);
> +	if (!call) {
> +		ret = -ENOMEM;
> +		goto free_bounce_bufs;
> +	}
> +
> +	hgcm_call_init_call(call, client_id, function, parms, parm_count,
> +			    bounce_bufs);
> +
> +	ret = vbg_hgcm_do_call(gdev, call, timeout_ms, &leak_it);
> +	if (ret == 0) {
> +		*vbox_status = call->header.result;
> +		ret = hgcm_call_copy_back_result(call, parms, parm_count,
> +						 bounce_bufs);
> +	}
> +
> +	if (!leak_it)
> +		kfree(call);
> +
> +free_bounce_bufs:
> +	if (bounce_bufs) {
> +		for (i = 0; i < parm_count; i++)
> +			kvfree(bounce_bufs[i]);
> +		kfree(bounce_bufs);
> +	}
> +
> +	return ret;
> +}
> +EXPORT_SYMBOL(vbg_hgcm_call);
> +
> +#ifdef CONFIG_COMPAT
> +int vbg_hgcm_call32(
> +	struct vbg_dev *gdev, u32 client_id, u32 function, u32 timeout_ms,
> +	struct vmmdev_hgcm_function_parameter32 *parm32, u32 parm_count,
> +	int *vbox_status)
> +{
> +	struct vmmdev_hgcm_function_parameter *parm64 = NULL;
> +	u32 i, size;
> +	int ret = 0;
> +
> +	/* KISS allocate a temporary request and convert the parameters. */
> +	size = parm_count * sizeof(struct vmmdev_hgcm_function_parameter);
> +	parm64 = kzalloc(size, GFP_KERNEL);
> +	if (!parm64)
> +		return -ENOMEM;
> +
> +	for (i = 0; i < parm_count; i++) {
> +		switch (parm32[i].type) {
> +		case VMMDEV_HGCM_PARM_TYPE_32BIT:
> +			parm64[i].type = VMMDEV_HGCM_PARM_TYPE_32BIT;
> +			parm64[i].u.value32 = parm32[i].u.value32;
> +			break;
> +
> +		case VMMDEV_HGCM_PARM_TYPE_64BIT:
> +			parm64[i].type = VMMDEV_HGCM_PARM_TYPE_64BIT;
> +			parm64[i].u.value64 = parm32[i].u.value64;
> +			break;
> +
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
> +			parm64[i].type = parm32[i].type;
> +			parm64[i].u.pointer.size = parm32[i].u.pointer.size;
> +			parm64[i].u.pointer.u.linear_addr =
> +			    parm32[i].u.pointer.u.linear_addr;
> +			break;
> +
> +		default:
> +			ret = -EINVAL;
> +		}
> +		if (ret < 0)
> +			goto out_free;
> +	}
> +
> +	ret = vbg_hgcm_call(gdev, client_id, function, timeout_ms,
> +			    parm64, parm_count, vbox_status);
> +	if (ret < 0)
> +		goto out_free;
> +
> +	/* Copy back. */
> +	for (i = 0; i < parm_count; i++, parm32++, parm64++) {
> +		switch (parm64[i].type) {
> +		case VMMDEV_HGCM_PARM_TYPE_32BIT:
> +			parm32[i].u.value32 = parm64[i].u.value32;
> +			break;
> +
> +		case VMMDEV_HGCM_PARM_TYPE_64BIT:
> +			parm32[i].u.value64 = parm64[i].u.value64;
> +			break;
> +
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR:
> +		case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
> +			parm32[i].u.pointer.size = parm64[i].u.pointer.size;
> +			break;
> +
> +		default:
> +			WARN_ON(1);
> +			ret = -EINVAL;
> +		}
> +	}
> +
> +out_free:
> +	kfree(parm64);
> +	return ret;
> +}
> +#endif
> +
> +static const int vbg_status_code_to_errno_table[] = {
> +	[-VERR_ACCESS_DENIED]                            = -EPERM,
> +	[-VERR_FILE_NOT_FOUND]                           = -ENOENT,
> +	[-VERR_PROCESS_NOT_FOUND]                        = -ESRCH,
> +	[-VERR_INTERRUPTED]                              = -EINTR,
> +	[-VERR_DEV_IO_ERROR]                             = -EIO,
> +	[-VERR_TOO_MUCH_DATA]                            = -E2BIG,
> +	[-VERR_BAD_EXE_FORMAT]                           = -ENOEXEC,
> +	[-VERR_INVALID_HANDLE]                           = -EBADF,
> +	[-VERR_TRY_AGAIN]                                = -EAGAIN,
> +	[-VERR_NO_MEMORY]                                = -ENOMEM,
> +	[-VERR_INVALID_POINTER]                          = -EFAULT,
> +	[-VERR_RESOURCE_BUSY]                            = -EBUSY,
> +	[-VERR_ALREADY_EXISTS]                           = -EEXIST,
> +	[-VERR_NOT_SAME_DEVICE]                          = -EXDEV,
> +	[-VERR_NOT_A_DIRECTORY]                          = -ENOTDIR,
> +	[-VERR_PATH_NOT_FOUND]                           = -ENOTDIR,
> +	[-VERR_IS_A_DIRECTORY]                           = -EISDIR,
> +	[-VERR_INVALID_PARAMETER]                        = -EINVAL,
> +	[-VERR_TOO_MANY_OPEN_FILES]                      = -ENFILE,
> +	[-VERR_INVALID_FUNCTION]                         = -ENOTTY,
> +	[-VERR_SHARING_VIOLATION]                        = -ETXTBSY,
> +	[-VERR_FILE_TOO_BIG]                             = -EFBIG,
> +	[-VERR_DISK_FULL]                                = -ENOSPC,
> +	[-VERR_SEEK_ON_DEVICE]                           = -ESPIPE,
> +	[-VERR_WRITE_PROTECT]                            = -EROFS,
> +	[-VERR_BROKEN_PIPE]                              = -EPIPE,
> +	[-VERR_DEADLOCK]                                 = -EDEADLK,
> +	[-VERR_FILENAME_TOO_LONG]                        = -ENAMETOOLONG,
> +	[-VERR_FILE_LOCK_FAILED]                         = -ENOLCK,
> +	[-VERR_NOT_IMPLEMENTED]                          = -ENOSYS,
> +	[-VERR_NOT_SUPPORTED]                            = -ENOSYS,
> +	[-VERR_DIR_NOT_EMPTY]                            = -ENOTEMPTY,
> +	[-VERR_TOO_MANY_SYMLINKS]                        = -ELOOP,
> +	[-VERR_NO_DATA]                                  = -ENODATA,
> +	[-VERR_NET_NO_NETWORK]                           = -ENONET,
> +	[-VERR_NET_NOT_UNIQUE_NAME]                      = -ENOTUNIQ,
> +	[-VERR_NO_TRANSLATION]                           = -EILSEQ,
> +	[-VERR_NET_NOT_SOCKET]                           = -ENOTSOCK,
> +	[-VERR_NET_DEST_ADDRESS_REQUIRED]                = -EDESTADDRREQ,
> +	[-VERR_NET_MSG_SIZE]                             = -EMSGSIZE,
> +	[-VERR_NET_PROTOCOL_TYPE]                        = -EPROTOTYPE,
> +	[-VERR_NET_PROTOCOL_NOT_AVAILABLE]               = -ENOPROTOOPT,
> +	[-VERR_NET_PROTOCOL_NOT_SUPPORTED]               = -EPROTONOSUPPORT,
> +	[-VERR_NET_SOCKET_TYPE_NOT_SUPPORTED]            = -ESOCKTNOSUPPORT,
> +	[-VERR_NET_OPERATION_NOT_SUPPORTED]              = -EOPNOTSUPP,
> +	[-VERR_NET_PROTOCOL_FAMILY_NOT_SUPPORTED]        = -EPFNOSUPPORT,
> +	[-VERR_NET_ADDRESS_FAMILY_NOT_SUPPORTED]         = -EAFNOSUPPORT,
> +	[-VERR_NET_ADDRESS_IN_USE]                       = -EADDRINUSE,
> +	[-VERR_NET_ADDRESS_NOT_AVAILABLE]                = -EADDRNOTAVAIL,
> +	[-VERR_NET_DOWN]                                 = -ENETDOWN,
> +	[-VERR_NET_UNREACHABLE]                          = -ENETUNREACH,
> +	[-VERR_NET_CONNECTION_RESET]                     = -ENETRESET,
> +	[-VERR_NET_CONNECTION_ABORTED]                   = -ECONNABORTED,
> +	[-VERR_NET_CONNECTION_RESET_BY_PEER]             = -ECONNRESET,
> +	[-VERR_NET_NO_BUFFER_SPACE]                      = -ENOBUFS,
> +	[-VERR_NET_ALREADY_CONNECTED]                    = -EISCONN,
> +	[-VERR_NET_NOT_CONNECTED]                        = -ENOTCONN,
> +	[-VERR_NET_SHUTDOWN]                             = -ESHUTDOWN,
> +	[-VERR_NET_TOO_MANY_REFERENCES]                  = -ETOOMANYREFS,
> +	[-VERR_TIMEOUT]                                  = -ETIMEDOUT,
> +	[-VERR_NET_CONNECTION_REFUSED]                   = -ECONNREFUSED,
> +	[-VERR_NET_HOST_DOWN]                            = -EHOSTDOWN,
> +	[-VERR_NET_HOST_UNREACHABLE]                     = -EHOSTUNREACH,
> +	[-VERR_NET_ALREADY_IN_PROGRESS]                  = -EALREADY,
> +	[-VERR_NET_IN_PROGRESS]                          = -EINPROGRESS,
> +	[-VERR_MEDIA_NOT_PRESENT]                        = -ENOMEDIUM,
> +	[-VERR_MEDIA_NOT_RECOGNIZED]                     = -EMEDIUMTYPE,
> +};
> +
> +int vbg_status_code_to_errno(int rc)
> +{
> +	if (rc >= 0)
> +		return 0;
> +
> +	rc = -rc;
> +	if (rc >= ARRAY_SIZE(vbg_status_code_to_errno_table) ||
> +	    vbg_status_code_to_errno_table[rc] == 0) {
> +		vbg_warn("%s: Unhandled err %d\n", __func__, -rc);
> +		return -EPROTO;
> +	}
> +
> +	return vbg_status_code_to_errno_table[rc];
> +}
> +EXPORT_SYMBOL(vbg_status_code_to_errno);
> diff --git a/drivers/virt/vboxguest/vmmdev.h b/drivers/virt/vboxguest/vmmdev.h
> new file mode 100644
> index 000000000000..0802a669b72b
> --- /dev/null
> +++ b/drivers/virt/vboxguest/vmmdev.h
> @@ -0,0 +1,460 @@
> +/*
> + * Virtual Device for Guest <-> VMM/Host communication interface
> + *
> + * Copyright (C) 2006-2016 Oracle Corporation
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + *
> + * The contents of this file may alternatively be used under the terms
> + * of the Common Development and Distribution License Version 1.0
> + * (CDDL) only, in which case the provisions of the CDDL are applicable
> + * instead of those of the GPL.
> + *
> + * You may elect to license modified versions of this file under the
> + * terms and conditions of either the GPL or the CDDL or both.
> + */
> +
> +#ifndef __VBOX_VMMDEV_H__
> +#define __VBOX_VMMDEV_H__
> +
> +#include <asm/bitsperlong.h>
> +#include <linux/sizes.h>
> +#include <linux/types.h>
> +#include <linux/vbox_vmmdev_types.h>
> +
> +/* Port for generic request interface (relative offset). */
> +#define VMMDEV_PORT_OFF_REQUEST                             0
> +
> +/** Layout of VMMDEV RAM region that contains information for guest. */
> +struct vmmdev_memory {
> +	/** The size of this structure. */
> +	u32 size;
> +	/** The structure version. (VMMDEV_MEMORY_VERSION) */
> +	u32 version;
> +
> +	union {
> +		struct {
> +			/** Flag telling that VMMDev has events pending. */
> +			u8 have_events;
> +			/** Explicit padding, MBZ. */
> +			u8 padding[3];
> +		} V1_04;
> +
> +		struct {
> +			/** Pending events flags, set by host. */
> +			u32 host_events;
> +			/** Mask of events the guest wants, set by guest. */
> +			u32 guest_event_mask;
> +		} V1_03;
> +	} V;
> +
> +	/* struct vbva_memory, not used */
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_memory, 8 + 8);
> +
> +/** Version of vmmdev_memory structure (vmmdev_memory::version). */
> +#define VMMDEV_MEMORY_VERSION   (1)
> +
> +/* Host mouse capabilities has been changed. */
> +#define VMMDEV_EVENT_MOUSE_CAPABILITIES_CHANGED             BIT(0)
> +/* HGCM event. */
> +#define VMMDEV_EVENT_HGCM                                   BIT(1)
> +/* A display change request has been issued. */
> +#define VMMDEV_EVENT_DISPLAY_CHANGE_REQUEST                 BIT(2)
> +/* Credentials are available for judgement. */
> +#define VMMDEV_EVENT_JUDGE_CREDENTIALS                      BIT(3)
> +/* The guest has been restored. */
> +#define VMMDEV_EVENT_RESTORED                               BIT(4)
> +/* Seamless mode state changed. */
> +#define VMMDEV_EVENT_SEAMLESS_MODE_CHANGE_REQUEST           BIT(5)
> +/* Memory balloon size changed. */
> +#define VMMDEV_EVENT_BALLOON_CHANGE_REQUEST                 BIT(6)
> +/* Statistics interval changed. */
> +#define VMMDEV_EVENT_STATISTICS_INTERVAL_CHANGE_REQUEST     BIT(7)
> +/* VRDP status changed. */
> +#define VMMDEV_EVENT_VRDP                                   BIT(8)
> +/* New mouse position data available. */
> +#define VMMDEV_EVENT_MOUSE_POSITION_CHANGED                 BIT(9)
> +/* CPU hotplug event occurred. */
> +#define VMMDEV_EVENT_CPU_HOTPLUG                            BIT(10)
> +/* The mask of valid events, for sanity checking. */
> +#define VMMDEV_EVENT_VALID_EVENT_MASK                       0x000007ffU
> +
> +/*
> + * Additions are allowed to work only if additions_major == vmmdev_current &&
> + * additions_minor <= vmmdev_current. Additions version is reported to host
> + * (VMMDev) by VMMDEVREQ_REPORT_GUEST_INFO.
> + */
> +#define VMMDEV_VERSION                      0x00010004
> +#define VMMDEV_VERSION_MAJOR                (VMMDEV_VERSION >> 16)
> +#define VMMDEV_VERSION_MINOR                (VMMDEV_VERSION & 0xffff)
> +
> +/* Maximum request packet size. */
> +#define VMMDEV_MAX_VMMDEVREQ_SIZE           1048576
> +
> +/* Version of vmmdev_request_header structure. */
> +#define VMMDEV_REQUEST_HEADER_VERSION       0x10001
> +
> +/** struct vmmdev_request_header - Generic VMMDev request header. */
> +struct vmmdev_request_header {
> +	/** IN: Size of the structure in bytes (including body). */
> +	u32 size;
> +	/** IN: Version of the structure.  */
> +	u32 version;
> +	/** IN: Type of the request. */
> +	enum vmmdev_request_type request_type;
> +	/** OUT: Return code. */
> +	s32 rc;
> +	/** Reserved field no.1. MBZ. */
> +	u32 reserved1;
> +	/** Reserved field no.2. MBZ. */
> +	u32 reserved2;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_request_header, 24);
> +
> +/**
> + * struct vmmdev_mouse_status - Mouse status request structure.
> + *
> + * Used by VMMDEVREQ_GET_MOUSE_STATUS and VMMDEVREQ_SET_MOUSE_STATUS.
> + */
> +struct vmmdev_mouse_status {
> +	/** header */
> +	struct vmmdev_request_header header;
> +	/** Mouse feature mask. See VMMDEV_MOUSE_*. */
> +	u32 mouse_features;
> +	/** Mouse x position. */
> +	s32 pointer_pos_x;
> +	/** Mouse y position. */
> +	s32 pointer_pos_y;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_mouse_status, 24 + 12);
> +
> +/* The guest can (== wants to) handle absolute coordinates.  */
> +#define VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE                     BIT(0)
> +/*
> + * The host can (== wants to) send absolute coordinates.
> + * (Input not captured.)
> + */
> +#define VMMDEV_MOUSE_HOST_WANTS_ABSOLUTE                    BIT(1)
> +/*
> + * The guest can *NOT* switch to software cursor and therefore depends on the
> + * host cursor.
> + *
> + * When guest additions are installed and the host has promised to display the
> + * cursor itself, the guest installs a hardware mouse driver. Don't ask the
> + * guest to switch to a software cursor then.
> + */
> +#define VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR                BIT(2)
> +/* The host does NOT provide support for drawing the cursor itself. */
> +#define VMMDEV_MOUSE_HOST_CANNOT_HWPOINTER                  BIT(3)
> +/* The guest can read VMMDev events to find out about pointer movement */
> +#define VMMDEV_MOUSE_NEW_PROTOCOL                           BIT(4)
> +/*
> + * If the guest changes the status of the VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR
> + * bit, the host will honour this.
> + */
> +#define VMMDEV_MOUSE_HOST_RECHECKS_NEEDS_HOST_CURSOR        BIT(5)
> +/*
> + * The host supplies an absolute pointing device.  The Guest Additions may
> + * wish to use this to decide whether to install their own driver.
> + */
> +#define VMMDEV_MOUSE_HOST_HAS_ABS_DEV                       BIT(6)
> +
> +/* The minimum value our pointing device can return. */
> +#define VMMDEV_MOUSE_RANGE_MIN 0
> +/* The maximum value our pointing device can return. */
> +#define VMMDEV_MOUSE_RANGE_MAX 0xFFFF
> +
> +/**
> + * struct vmmdev_host_version - VirtualBox host version request structure.
> + *
> + * VBG uses this to detect the precense of new features in the interface.
> + */
> +struct vmmdev_host_version {
> +	/** Header. */
> +	struct vmmdev_request_header header;
> +	/** Major version. */
> +	u16 major;
> +	/** Minor version. */
> +	u16 minor;
> +	/** Build number. */
> +	u32 build;
> +	/** SVN revision. */
> +	u32 revision;
> +	/** Feature mask. */
> +	u32 features;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_host_version, 24 + 16);
> +
> +/* Physical page lists are supported by HGCM. */
> +#define VMMDEV_HVF_HGCM_PHYS_PAGE_LIST  BIT(0)
> +
> +/**
> + * struct vmmdev_mask - Structure to set / clear bits in a mask used for
> + * VMMDEVREQ_SET_GUEST_CAPABILITIES and VMMDEVREQ_CTL_GUEST_FILTER_MASK.
> + */
> +struct vmmdev_mask {
> +	/** Header. */
> +	struct vmmdev_request_header header;
> +	/** Mask of bits to be set. */
> +	u32 or_mask;
> +	/** Mask of bits to be cleared. */
> +	u32 not_mask;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_mask, 24 + 8);
> +
> +/* The guest supports seamless display rendering. */
> +#define VMMDEV_GUEST_SUPPORTS_SEAMLESS                      BIT(0)
> +/* The guest supports mapping guest to host windows. */
> +#define VMMDEV_GUEST_SUPPORTS_GUEST_HOST_WINDOW_MAPPING     BIT(1)
> +/*
> + * The guest graphical additions are active.
> + * Used for fast activation and deactivation of certain graphical operations
> + * (e.g. resizing & seamless). The legacy VMMDEVREQ_REPORT_GUEST_CAPABILITIES
> + * request sets this automatically, but VMMDEVREQ_SET_GUEST_CAPABILITIES does
> + * not.
> + */
> +#define VMMDEV_GUEST_SUPPORTS_GRAPHICS                      BIT(2)
> +
> +/** struct vmmdev_hypervisorinfo - Hypervisor info structure. */
> +struct vmmdev_hypervisorinfo {
> +	/** Header. */
> +	struct vmmdev_request_header header;
> +	/**
> +	 * Guest virtual address of proposed hypervisor start.
> +	 * Not used by VMMDEVREQ_GET_HYPERVISOR_INFO.
> +	 */
> +	u32 hypervisor_start;
> +	/** Hypervisor size in bytes. */
> +	u32 hypervisor_size;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_hypervisorinfo, 24 + 8);
> +
> +/** struct vmmdev_events - Pending events structure. */
> +struct vmmdev_events {
> +	/** Header. */
> +	struct vmmdev_request_header header;
> +	/** OUT: Pending event mask. */
> +	u32 events;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_events, 24 + 4);
> +
> +#define VMMDEV_OSTYPE_LINUX26		0x53000
> +#define VMMDEV_OSTYPE_X64		BIT(8)
> +
> +/** struct vmmdev_guestinfo - Guest information report. */
> +struct vmmdev_guest_info {
> +	/** Header. */
> +	struct vmmdev_request_header header;
> +	/**
> +	 * The VMMDev interface version expected by additions.
> +	 * *Deprecated*, do not use anymore! Will be removed.
> +	 */
> +	u32 interface_version;
> +	/** Guest OS type. */
> +	u32 os_type;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_guest_info, 24 + 8);
> +
> +/** struct vmmdev_guestinfo2 - Guest information report, version 2. */
> +struct vmmdev_guest_info2 {
> +	/** Header. */
> +	struct vmmdev_request_header header;
> +	/** Major version. */
> +	u16 additions_major;
> +	/** Minor version. */
> +	u16 additions_minor;
> +	/** Build number. */
> +	u32 additions_build;
> +	/** SVN revision. */
> +	u32 additions_revision;
> +	/** Feature mask, currently unused. */
> +	u32 additions_features;
> +	/**
> +	 * The intentional meaning of this field was:
> +	 * Some additional information, for example 'Beta 1' or something like
> +	 * that.
> +	 *
> +	 * The way it was implemented was implemented: VBG_VERSION_STRING.
> +	 *
> +	 * This means the first three members are duplicated in this field (if
> +	 * the guest build config is sane). So, the user must check this and
> +	 * chop it off before usage. There is, because of the Main code's blind
> +	 * trust in the field's content, no way back.
> +	 */
> +	char name[128];
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_guest_info2, 24 + 144);
> +
> +enum vmmdev_guest_facility_type {
> +	VBOXGUEST_FACILITY_TYPE_UNKNOWN          = 0,
> +	VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER = 20,
> +	/* VBoxGINA / VBoxCredProv / pam_vbox. */
> +	VBOXGUEST_FACILITY_TYPE_AUTO_LOGON       = 90,
> +	VBOXGUEST_FACILITY_TYPE_VBOX_SERVICE     = 100,
> +	/* VBoxTray (Windows), VBoxClient (Linux, Unix). */
> +	VBOXGUEST_FACILITY_TYPE_VBOX_TRAY_CLIENT = 101,
> +	VBOXGUEST_FACILITY_TYPE_SEAMLESS         = 1000,
> +	VBOXGUEST_FACILITY_TYPE_GRAPHICS         = 1100,
> +	VBOXGUEST_FACILITY_TYPE_ALL              = 0x7ffffffe,
> +	/* Ensure the enum is a 32 bit data-type */
> +	VBOXGUEST_FACILITY_TYPE_SIZEHACK         = 0x7fffffff
> +};
> +
> +enum vmmdev_guest_facility_status {
> +	VBOXGUEST_FACILITY_STATUS_INACTIVE    = 0,
> +	VBOXGUEST_FACILITY_STATUS_PAUSED      = 1,
> +	VBOXGUEST_FACILITY_STATUS_PRE_INIT    = 20,
> +	VBOXGUEST_FACILITY_STATUS_INIT        = 30,
> +	VBOXGUEST_FACILITY_STATUS_ACTIVE      = 50,
> +	VBOXGUEST_FACILITY_STATUS_TERMINATING = 100,
> +	VBOXGUEST_FACILITY_STATUS_TERMINATED  = 101,
> +	VBOXGUEST_FACILITY_STATUS_FAILED      = 800,
> +	VBOXGUEST_FACILITY_STATUS_UNKNOWN     = 999,
> +	/* Ensure the enum is a 32 bit data-type */
> +	VBOXGUEST_FACILITY_STATUS_SIZEHACK    = 0x7fffffff
> +};
> +
> +/** struct vmmdev_guest_status - Guest Additions status structure. */
> +struct vmmdev_guest_status {
> +	/** Header. */
> +	struct vmmdev_request_header header;
> +	/** Facility the status is indicated for. */
> +	enum vmmdev_guest_facility_type facility;
> +	/** Current guest status. */
> +	enum vmmdev_guest_facility_status status;
> +	/** Flags, not used at the moment. */
> +	u32 flags;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_guest_status, 24 + 12);
> +
> +#define VMMDEV_MEMORY_BALLOON_CHUNK_SIZE             (1048576)
> +#define VMMDEV_MEMORY_BALLOON_CHUNK_PAGES            (1048576 / 4096)
> +
> +/** struct vmmdev_memballoon_info - Memory-balloon info structure. */
> +struct vmmdev_memballoon_info {
> +	/** Header. */
> +	struct vmmdev_request_header header;
> +	/** Balloon size in megabytes. */
> +	u32 balloon_chunks;
> +	/** Guest ram size in megabytes. */
> +	u32 phys_mem_chunks;
> +	/**
> +	 * Setting this to VMMDEV_EVENT_BALLOON_CHANGE_REQUEST indicates that
> +	 * the request is a response to that event.
> +	 * (Don't confuse this with VMMDEVREQ_ACKNOWLEDGE_EVENTS.)
> +	 */
> +	u32 event_ack;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_memballoon_info, 24 + 12);
> +
> +/** struct vmmdev_memballoon_change - Change the size of the balloon. */
> +struct vmmdev_memballoon_change {
> +	/** Header. */
> +	struct vmmdev_request_header header;
> +	/** The number of pages in the array. */
> +	u32 pages;
> +	/** true = inflate, false = deflate.  */
> +	u32 inflate;
> +	/** Physical address (u64) of each page. */
> +	u64 phys_page[VMMDEV_MEMORY_BALLOON_CHUNK_PAGES];
> +};
> +
> +/** struct vmmdev_write_core_dump - Write Core Dump request data. */
> +struct vmmdev_write_core_dump {
> +	/** Header. */
> +	struct vmmdev_request_header header;
> +	/** Flags (reserved, MBZ). */
> +	u32 flags;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_write_core_dump, 24 + 4);
> +
> +/** struct vmmdev_heartbeat - Heart beat check state structure. */
> +struct vmmdev_heartbeat {
> +	/** Header. */
> +	struct vmmdev_request_header header;
> +	/** OUT: Guest heartbeat interval in nanosec. */
> +	u64 interval_ns;
> +	/** Heartbeat check flag. */
> +	u8 enabled;
> +	/** Explicit padding, MBZ. */
> +	u8 padding[3];
> +} __packed;
> +VMMDEV_ASSERT_SIZE(vmmdev_heartbeat, 24 + 12);
> +
> +#define VMMDEV_HGCM_REQ_DONE      BIT(0)
> +#define VMMDEV_HGCM_REQ_CANCELLED BIT(1)
> +
> +/** struct vmmdev_hgcmreq_header - vmmdev HGCM requests header. */
> +struct vmmdev_hgcmreq_header {
> +	/** Request header. */
> +	struct vmmdev_request_header header;
> +
> +	/** HGCM flags. */
> +	u32 flags;
> +
> +	/** Result code. */
> +	s32 result;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_hgcmreq_header, 24 + 8);
> +
> +/** struct vmmdev_hgcm_connect - HGCM connect request structure. */
> +struct vmmdev_hgcm_connect {
> +	/** HGCM request header. */
> +	struct vmmdev_hgcmreq_header header;
> +
> +	/** IN: Description of service to connect to. */
> +	struct vmmdev_hgcm_service_location loc;
> +
> +	/** OUT: Client identifier assigned by local instance of HGCM. */
> +	u32 client_id;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_connect, 32 + 132 + 4);
> +
> +/** struct vmmdev_hgcm_disconnect - HGCM disconnect request structure. */
> +struct vmmdev_hgcm_disconnect {
> +	/** HGCM request header. */
> +	struct vmmdev_hgcmreq_header header;
> +
> +	/** IN: Client identifier. */
> +	u32 client_id;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_disconnect, 32 + 4);
> +
> +#define VMMDEV_HGCM_MAX_PARMS 32
> +
> +/** struct vmmdev_hgcm_call - HGCM call request structure. */
> +struct vmmdev_hgcm_call {
> +	/* request header */
> +	struct vmmdev_hgcmreq_header header;
> +
> +	/** IN: Client identifier. */
> +	u32 client_id;
> +	/** IN: Service function number. */
> +	u32 function;
> +	/** IN: Number of parameters. */
> +	u32 parm_count;
> +	/** Parameters follow in form: HGCMFunctionParameter32|64 parms[X]; */
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_call, 32 + 12);
> +
> +/**
> + * struct vmmdev_hgcm_cancel2 - HGCM cancel request structure, version 2.
> + *
> + * After the request header.rc will be:
> + *
> + * VINF_SUCCESS when cancelled.
> + * VERR_NOT_FOUND if the specified request cannot be found.
> + * VERR_INVALID_PARAMETER if the address is invalid valid.
> + */
> +struct vmmdev_hgcm_cancel2 {
> +	/** Header. */
> +	struct vmmdev_request_header header;
> +	/** The physical address of the request to cancel. */
> +	u32 phys_req_to_cancel;
> +};
> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_cancel2, 24 + 4);
> +
> +#endif
> diff --git a/include/linux/vbox_utils.h b/include/linux/vbox_utils.h
> new file mode 100644
> index 000000000000..a0a2b84c8c2e
> --- /dev/null
> +++ b/include/linux/vbox_utils.h
> @@ -0,0 +1,92 @@
> +/*
> + * Copyright (C) 2006-2016 Oracle Corporation
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + *
> + * The contents of this file may alternatively be used under the terms
> + * of the Common Development and Distribution License Version 1.0
> + * (CDDL) only, in which case the provisions of the CDDL are applicable
> + * instead of those of the GPL.
> + *
> + * You may elect to license modified versions of this file under the
> + * terms and conditions of either the GPL or the CDDL or both.
> + */
> +
> +#ifndef __VBOX_UTILS_H__
> +#define __VBOX_UTILS_H__
> +
> +#include <linux/printk.h>
> +#include <linux/vbox_vmmdev_types.h>
> +
> +struct vbg_dev;
> +
> +/**
> + * vboxguest logging functions, these log both to the backdoor and call
> + * the equivalent kernel pr_foo function.
> + */
> +__printf(1, 2) void vbg_info(const char *fmt, ...);
> +__printf(1, 2) void vbg_warn(const char *fmt, ...);
> +__printf(1, 2) void vbg_err(const char *fmt, ...);
> +
> +/* Only use backdoor logging for non-dynamic debug builds */
> +#if defined(DEBUG) && !defined(CONFIG_DYNAMIC_DEBUG)
> +__printf(1, 2) void vbg_debug(const char *fmt, ...);
> +#else
> +#define vbg_debug pr_debug
> +#endif
> +
> +/**
> + * Allocate memory for generic request and initialize the request header.
> + *
> + * Return: the allocated memory
> + * @len:		Size of memory block required for the request.
> + * @req_type:		The generic request type.
> + */
> +void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type);
> +
> +/**
> + * Perform a generic request.
> + *
> + * Return: VBox status code
> + * @gdev:		The Guest extension device.
> + * @req:		Pointer to the request structure.
> + */
> +int vbg_req_perform(struct vbg_dev *gdev, void *req);
> +
> +int vbg_hgcm_connect(struct vbg_dev *gdev,
> +		     struct vmmdev_hgcm_service_location *loc,
> +		     u32 *client_id, int *vbox_status);
> +
> +int vbg_hgcm_disconnect(struct vbg_dev *gdev, u32 client_id, int *vbox_status);
> +
> +int vbg_hgcm_call(struct vbg_dev *gdev, u32 client_id, u32 function,
> +		  u32 timeout_ms, struct vmmdev_hgcm_function_parameter *parms,
> +		  u32 parm_count, int *vbox_status);
> +
> +int vbg_hgcm_call32(
> +	struct vbg_dev *gdev, u32 client_id, u32 function, u32 timeout_ms,
> +	struct vmmdev_hgcm_function_parameter32 *parm32, u32 parm_count,
> +	int *vbox_status);
> +
> +/**
> + * Convert a VirtualBox status code to a standard Linux kernel return value.
> + * Return: 0 or negative errno value.
> + * @rc:			VirtualBox status code to convert.
> + */
> +int vbg_status_code_to_errno(int rc);
> +
> +/**
> + * Helper for the vboxsf driver to get a reference to the guest device.
> + * Return: a pointer to the gdev; or a ERR_PTR value on error.
> + */
> +struct vbg_dev *vbg_get_gdev(void);
> +
> +/**
> + * Helper for the vboxsf driver to put a guest device reference.
> + * @gdev:		Reference returned by vbg_get_gdev to put.
> + */
> +void vbg_put_gdev(struct vbg_dev *gdev);
> +
> +#endif
> 

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH resend v2 0/3] virt: Add vboxguest driver for Virtual Box Guest integration
  2017-11-27 19:44 ` [PATCH resend v2 0/3] " Larry Finger
@ 2017-11-28 10:01   ` Hans de Goede
  2017-11-28 16:15     ` Larry Finger
  0 siblings, 1 reply; 14+ messages in thread
From: Hans de Goede @ 2017-11-28 10:01 UTC (permalink / raw)
  To: Larry Finger, Arnd Bergmann, Greg Kroah-Hartman
  Cc: Michael Thayer, Knut St . Osmundsen, Christoph Hellwig, linux-kernel

Hi,

On 27-11-17 20:44, Larry Finger wrote:
> On 11/26/2017 09:12 AM, Hans de Goede wrote:
>> Here is resend of v2 of my cleaned up version of the VirtualBox vboxguest
>> driver, rebased on top of current the master from Linus.
>>
>> Note there currently is an issue with vboxvideo in the current master from
>> Linus, this is fixed by this patch:
>> https://patchwork.freedesktop.org/patch/189812/
>>
>> Once this is merged, I will do some further cleanups on the vboxsf driver
>> and also submit that upstream, if people want to test it before then, here
>> is a version which applies on top of this series:
>> https://github.com/jwrdegoede/linux-sunxi/commit/7f18b741945de3ae09ca8f1a9e48456ce32986c9
>>
>> Changes in v2:
>> -Change all uapi headers to kernel coding style: Drop struct and enum typedefs
>>   make type and struct-member names all lowercase, enum values all uppercase.
>> -Remove unused struct type declarations from some headers (shaving of another
>>   1000 lines)
>> -Remove or fixup doxygen style comments
>> -Get rid of CHECK macros, use a function taking in_ and out_size args instead
>> -Some other small codyingstyle fixes
>> -Split into multiple patches
>>
>> Here is (part of) the v1 cover-letter which is still relevant:
>>
>> VirtualBox upstream has declared the ioctl API for the /dev/vboxguest device
>> as being stable now, so once this passes review this is ready for merging.
>>
>> I'm only submitting the vboxguest driver for now, as the vboxsf driver
>> depends on this and it easier to first just get the vboxguest driver
>> upstream.
>>
>> I've removed all depenencies on vbox's OS-independent runtime and
>> the runtime itself, reducing the vboxguest driver from 100000+ lines
>> of code to aprox. 4300 lines. This reduces the non debug vboxguest.ko
>> size from 450kB to less then 100 kB. I've also cleaned up various other
>> warts such as doing hardware init in module_init rather then in a
>> pci_probe callback.
>>
>> The vboxguest driver introduces a new userspace API + ABI in the form
>> of ioctls on a character device. VirtualBox upstream not willing to
>> commit to keeping this ABI stable was one of the things which has
>> kept this driver driver out of mainline sofar. I've been talking to
>> VirtualBox upstream about mainlining the guest drivers and VirtualBox
>> upstream has agreed to consider the userspace ABI stable and only
>> extend it in a backwards compatible manner from now on.
> 
> Hans,
> 
> I have finished reviewing the commits for vboxguest. Most of my comments are minor.

Thank you for the review!

> I did have two problems when I tried to build these commits and the one that creates vboxsf.
> 
> The more serious one is that it is possible to build vboxguest without vboxvideo. When that happens, a non-privileged user cannot start X. As I say in the review, > I think that combination does not make sense and should not be allowed.

vboxguest and vboxvideo are completely independent at least from the kernel pov,
I do not believe that making them depend on each other makes sense.

AFAIK a non-privileged user cannot start X without vboxvideo at all, independent
of vboxguest being build or not. Falling back to vesa modesetting always requires
Xorg to be suid root, or the user to be privileged.

TL;DR: I can add a dependency between the 2, but I would rather not.

> When the system is booted, vboxsf is not loaded, and the shared folders are not automounted. Of course, that issue is not germane to these patches, but will be important when vboxsf is merged.

Hmm, I mount a couple of shares from rc.local (I don't use vbox' automount as I
want to specify a uid for the files) and as soon as mount.vboxsf gets executed
the vboxsf module gets auto-loaded as the module contains:

MODULE_ALIAS_FS("vboxsf");

AFAIK the communication of which volumes to automount is done through vboxguest,
anyways I will look into this before submitting vboxsf, in the worst case
we need to drop a modprobe.conf.d/vboxguest.conf file which has a postinst vboxguest
which loads vboxsf.

Regards,

Hans

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH resend v2 1/3] virt: Add vboxguest driver for Virtual Box Guest integration UAPI
  2017-11-27 19:44   ` Larry Finger
@ 2017-11-28 10:08     ` Hans de Goede
  0 siblings, 0 replies; 14+ messages in thread
From: Hans de Goede @ 2017-11-28 10:08 UTC (permalink / raw)
  To: Larry Finger, Arnd Bergmann, Greg Kroah-Hartman
  Cc: Michael Thayer, Knut St . Osmundsen, Christoph Hellwig, linux-kernel

Hi,

On 27-11-17 20:44, Larry Finger wrote:
> On 11/26/2017 09:12 AM, Hans de Goede wrote:
>> This commit adds the headers describing the ioctl API for the
>> /dev/vboxguest device used by the Virtual Box Guest Additions
>> in Virtual Box virtual machines.
>>
>> The driver providing the /dev/vboxguest device will allow Virtual Box
>> Guest Additions features such as copy-and-paste, seamless mode and
>> OpenGL pass-through.
>>
>> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
> 
> Minor comments inline in the code.
> 
> Reviewed-by: Larry Finger <Larry.Finger@lwfinger.net>
> 
> Larry
> 
>> ---
>> Changes in v2:
>> -Change all uapi headers to kernel coding style: Drop struct and enum typedefs
>>   make type and struct-member names all lowercase, enum values all uppercase.
>> -Remove unused struct type declarations from some headers (shaving of another
>>   1000 lines)
>> -Remove or fixup doxygen style comments
>> -Get rid of CHECK macros, use a function taking in_ and out_size args instead
>> -Some other small codyingstyle fixes
>> -Split into multiple patches
>> ---
>>   MAINTAINERS                            |   7 +
>>   include/uapi/linux/vbox_err.h          | 170 ++++++++++++++++
>>   include/uapi/linux/vbox_vmmdev_types.h | 237 +++++++++++++++++++++++
>>   include/uapi/linux/vboxguest.h         | 341 +++++++++++++++++++++++++++++++++
>>   4 files changed, 755 insertions(+)
>>   create mode 100644 include/uapi/linux/vbox_err.h
>>   create mode 100644 include/uapi/linux/vbox_vmmdev_types.h
>>   create mode 100644 include/uapi/linux/vboxguest.h
>>

<snip>

>> diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h
>> new file mode 100644
>> index 000000000000..1fdabee603fa
>> --- /dev/null
>> +++ b/include/uapi/linux/vbox_vmmdev_types.h
>> @@ -0,0 +1,237 @@
>> +/*
>> + * Virtual Device for Guest <-> VMM/Host communication, type definitions
>> + * which are also used for the vboxguest ioctl interface / by vboxsf
>> + *
>> + * Copyright (C) 2006-2016 Oracle Corporation
>> + *
>> + * This program is free software; you can redistribute it and/or modify
>> + * it under the terms of the GNU General Public License version 2 as
>> + * published by the Free Software Foundation.
>> + *
>> + * The contents of this file may alternatively be used under the terms
>> + * of the Common Development and Distribution License Version 1.0
>> + * (CDDL) only, in which case the provisions of the CDDL are applicable
>> + * instead of those of the GPL.
>> + *
>> + * You may elect to license modified versions of this file under the
>> + * terms and conditions of either the GPL or the CDDL or both.
>> + */
>> +
>> +#ifndef __UAPI_VBOX_VMMDEV_TYPES_H__
>> +#define __UAPI_VBOX_VMMDEV_TYPES_H__
>> +
>> +#include <asm/bitsperlong.h>
>> +#include <linux/types.h>
>> +
>> +/*
>> + * We cannot use linux' compiletime_assert here because it expects to be used
>> + * inside a function only. Use a typedef to a char array with a negative size.
>> + */
>> +#define VMMDEV_ASSERT_SIZE(type, size) \
>> +    typedef char type ## _asrt_size[1 - 2*!!(sizeof(struct type) != (size))]
> 
> I wondered about defining a new typedef here, and checkpatch.pl complained about it. I think your comment explains it very well.

Ok :)

>> +
>> +/** enum vmmdev_request_type - VMMDev request types. */
>> +enum vmmdev_request_type {
>> +    VMMDEVREQ_INVALID_REQUEST              =  0,
>> +    VMMDEVREQ_GET_MOUSE_STATUS             =  1,
>> +    VMMDEVREQ_SET_MOUSE_STATUS             =  2,
>> +    VMMDEVREQ_SET_POINTER_SHAPE            =  3,
>> +    VMMDEVREQ_GET_HOST_VERSION             =  4,
>> +    VMMDEVREQ_IDLE                         =  5,
>> +    VMMDEVREQ_GET_HOST_TIME                = 10,
>> +    VMMDEVREQ_GET_HYPERVISOR_INFO          = 20,
>> +    VMMDEVREQ_SET_HYPERVISOR_INFO          = 21,
>> +    VMMDEVREQ_REGISTER_PATCH_MEMORY        = 22, /* since version 3.0.6 */
>> +    VMMDEVREQ_DEREGISTER_PATCH_MEMORY      = 23, /* since version 3.0.6 */
>> +    VMMDEVREQ_SET_POWER_STATUS             = 30,
>> +    VMMDEVREQ_ACKNOWLEDGE_EVENTS           = 41,
>> +    VMMDEVREQ_CTL_GUEST_FILTER_MASK        = 42,
>> +    VMMDEVREQ_REPORT_GUEST_INFO            = 50,
>> +    VMMDEVREQ_REPORT_GUEST_INFO2           = 58, /* since version 3.2.0 */
>> +    VMMDEVREQ_REPORT_GUEST_STATUS          = 59, /* since version 3.2.8 */
>> +    VMMDEVREQ_REPORT_GUEST_USER_STATE      = 74, /* since version 4.3 */
>> +    /* Retrieve a display resize request sent by the host, deprecated. */
>> +    VMMDEVREQ_GET_DISPLAY_CHANGE_REQ       = 51,
>> +    VMMDEVREQ_VIDEMODE_SUPPORTED           = 52,
>> +    VMMDEVREQ_GET_HEIGHT_REDUCTION         = 53,
>> +    /**
>> +     * @VMMDEVREQ_GET_DISPLAY_CHANGE_REQ2:
>> +     * Retrieve a display resize request sent by the host.
>> +     *
>> +     * Queries a display resize request sent from the host.  If the
>> +     * event_ack member is sent to true and there is an unqueried request
>> +     * available for one of the virtual display then that request will
>> +     * be returned.  If several displays have unqueried requests the lowest
>> +     * numbered display will be chosen first.  Only the most recent unseen
>> +     * request for each display is remembered.
>> +     * If event_ack is set to false, the last host request queried with
>> +     * event_ack set is resent, or failing that the most recent received
>> +     * from the host.  If no host request was ever received then all zeros
>> +     * are returned.
>> +     */
>> +    VMMDEVREQ_GET_DISPLAY_CHANGE_REQ2      = 54,
>> +    VMMDEVREQ_REPORT_GUEST_CAPABILITIES    = 55,
>> +    VMMDEVREQ_SET_GUEST_CAPABILITIES       = 56,
>> +    VMMDEVREQ_VIDEMODE_SUPPORTED2          = 57, /* since version 3.2.0 */
>> +    VMMDEVREQ_GET_DISPLAY_CHANGE_REQEX     = 80, /* since version 4.2.4 */
>> +    VMMDEVREQ_HGCM_CONNECT                 = 60,
>> +    VMMDEVREQ_HGCM_DISCONNECT              = 61,
>> +    VMMDEVREQ_HGCM_CALL32                  = 62,
>> +    VMMDEVREQ_HGCM_CALL64                  = 63,
>> +    VMMDEVREQ_HGCM_CANCEL                  = 64,
>> +    VMMDEVREQ_HGCM_CANCEL2                 = 65,
>> +    VMMDEVREQ_VIDEO_ACCEL_ENABLE           = 70,
>> +    VMMDEVREQ_VIDEO_ACCEL_FLUSH            = 71,
>> +    VMMDEVREQ_VIDEO_SET_VISIBLE_REGION     = 72,
>> +    VMMDEVREQ_GET_SEAMLESS_CHANGE_REQ      = 73,
>> +    VMMDEVREQ_QUERY_CREDENTIALS            = 100,
>> +    VMMDEVREQ_REPORT_CREDENTIALS_JUDGEMENT = 101,
>> +    VMMDEVREQ_REPORT_GUEST_STATS           = 110,
>> +    VMMDEVREQ_GET_MEMBALLOON_CHANGE_REQ    = 111,
>> +    VMMDEVREQ_GET_STATISTICS_CHANGE_REQ    = 112,
>> +    VMMDEVREQ_CHANGE_MEMBALLOON            = 113,
>> +    VMMDEVREQ_GET_VRDPCHANGE_REQ           = 150,
>> +    VMMDEVREQ_LOG_STRING                   = 200,
>> +    VMMDEVREQ_GET_CPU_HOTPLUG_REQ          = 210,
>> +    VMMDEVREQ_SET_CPU_HOTPLUG_STATUS       = 211,
>> +    VMMDEVREQ_REGISTER_SHARED_MODULE       = 212,
>> +    VMMDEVREQ_UNREGISTER_SHARED_MODULE     = 213,
>> +    VMMDEVREQ_CHECK_SHARED_MODULES         = 214,
>> +    VMMDEVREQ_GET_PAGE_SHARING_STATUS      = 215,
>> +    VMMDEVREQ_DEBUG_IS_PAGE_SHARED         = 216,
>> +    VMMDEVREQ_GET_SESSION_ID               = 217, /* since version 3.2.8 */
>> +    VMMDEVREQ_WRITE_COREDUMP               = 218,
>> +    VMMDEVREQ_GUEST_HEARTBEAT              = 219,
>> +    VMMDEVREQ_HEARTBEAT_CONFIGURE          = 220,
>> +    /* Ensure the enum is a 32 bit data-type */
>> +    VMMDEVREQ_SIZEHACK                     = 0x7fffffff
>> +};
>> +
>> +#if __BITS_PER_LONG == 64
>> +#define VMMDEVREQ_HGCM_CALL VMMDEVREQ_HGCM_CALL64
>> +#else
>> +#define VMMDEVREQ_HGCM_CALL VMMDEVREQ_HGCM_CALL32
>> +#endif
>> +
>> +/** HGCM service location types. */
>> +enum vmmdev_hgcm_service_location_type {
>> +    VMMDEV_HGCM_LOC_INVALID    = 0,
>> +    VMMDEV_HGCM_LOC_LOCALHOST  = 1,
>> +    VMMDEV_HGCM_LOC_LOCALHOST_EXISTING = 2,
>> +    /* Ensure the enum is a 32 bit data-type */
>> +    VMMDEV_HGCM_LOC_SIZEHACK   = 0x7fffffff
>> +};
>> +
>> +/** HGCM host service location. */
>> +struct vmmdev_hgcm_service_location_localhost {
>> +    /** Service name */
>> +    char service_name[128];
>> +};
>> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_service_location_localhost, 128);
>> +
>> +/** HGCM service location. */
>> +struct vmmdev_hgcm_service_location {
>> +    /** Type of the location. */
>> +    enum vmmdev_hgcm_service_location_type type;
>> +
>> +    union {
>> +        struct vmmdev_hgcm_service_location_localhost localhost;
>> +    } u;
>> +};
> 
> This union only has one member. Is there some reason to keep the union here?

This is the ABI as defined by vbox upstream, I believe the intend
is that in the future there may be other values for
type then VMMDEV_HGCM_LOC_LOCALHOST and those would get a different
member in the union to represent the address/location format
for this to-be-added-in-the-future service_location_type.

>> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_service_location, 128 + 4);
>> +
>> +/** HGCM function parameter type. */
>> +enum vmmdev_hgcm_function_parameter_type {
>> +    VMMDEV_HGCM_PARM_TYPE_INVALID            = 0,
>> +    VMMDEV_HGCM_PARM_TYPE_32BIT              = 1,
>> +    VMMDEV_HGCM_PARM_TYPE_64BIT              = 2,
>> +    /** Deprecated Doesn't work, use PAGELIST. */
>> +    VMMDEV_HGCM_PARM_TYPE_PHYSADDR           = 3,
>> +    /** In and Out, user-memory */
>> +    VMMDEV_HGCM_PARM_TYPE_LINADDR            = 4,
>> +    /** In, user-memory  (read;  host<-guest) */
>> +    VMMDEV_HGCM_PARM_TYPE_LINADDR_IN         = 5,
>> +    /** Out, user-memory (write; host->guest) */
>> +    VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT        = 6,
>> +    /** In and Out, kernel-memory */
>> +    VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL     = 7,
>> +    /** In, kernel-memory  (read;  host<-guest) */
>> +    VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN  = 8,
>> +    /** Out, kernel-memory (write; host->guest) */
>> +    VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT = 9,
>> +    /** Physical addresses of locked pages for a buffer. */
>> +    VMMDEV_HGCM_PARM_TYPE_PAGELIST           = 10,
>> +    /* Ensure the enum is a 32 bit data-type */
>> +    VMMDEV_HGCM_PARM_TYPE_SIZEHACK           = 0x7fffffff
>> +};
>> +
>> +/** HGCM function parameter, 32-bit client. */
>> +struct vmmdev_hgcm_function_parameter32 {
>> +    enum vmmdev_hgcm_function_parameter_type type;
>> +    union {
>> +        __u32 value32;
>> +        __u64 value64;
>> +        struct {
>> +            __u32 size;
>> +            union {
>> +                __u32 phys_addr;
>> +                __u32 linear_addr;
>> +            } u;
>> +        } pointer;
>> +        struct {
>> +            /** Size of the buffer described by the page list. */
>> +            __u32 size;
>> +            /** Relative to the request header. */
>> +            __u32 offset;
>> +        } page_list;
>> +    } u;
>> +} __packed;
>> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8);
>> +
>> +/** HGCM function parameter, 64-bit client. */
>> +struct vmmdev_hgcm_function_parameter64 {
>> +    enum vmmdev_hgcm_function_parameter_type type;
>> +    union {
>> +        __u32 value32;
>> +        __u64 value64;
>> +        struct {
>> +            __u32 size;
>> +            union {
>> +                __u64 phys_addr;
>> +                __u64 linear_addr;
>> +            } u;
>> +        } __packed pointer;
>> +        struct {
>> +            /** Size of the buffer described by the page list. */
>> +            __u32 size;
>> +            /** Relative to the request header. */
>> +            __u32 offset;
>> +        } page_list;
>> +    } __packed u;
>> +} __packed;
>> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter64, 4 + 12);
>> +
>> +#if __BITS_PER_LONG == 64
>> +#define vmmdev_hgcm_function_parameter vmmdev_hgcm_function_parameter64
>> +#else
>> +#define vmmdev_hgcm_function_parameter vmmdev_hgcm_function_parameter32
>> +#endif
>> +
>> +#define VMMDEV_HGCM_F_PARM_DIRECTION_NONE      0x00000000U
>> +#define VMMDEV_HGCM_F_PARM_DIRECTION_TO_HOST   0x00000001U
>> +#define VMMDEV_HGCM_F_PARM_DIRECTION_FROM_HOST 0x00000002U
>> +#define VMMDEV_HGCM_F_PARM_DIRECTION_BOTH      0x00000003U
>> +
>> +/**
>> + * struct vmmdev_hgcm_pagelist - VMMDEV_HGCM_PARM_TYPE_PAGELIST parameters
>> + * point to this structure to actually describe the buffer.
>> + */
>> +struct vmmdev_hgcm_pagelist {
>> +    __u32 flags;             /** VMMDEV_HGCM_F_PARM_*. */
>> +    __u16 offset_first_page; /** Data offset in the first page. */
>> +    __u16 page_count;        /** Number of pages. */
>> +    __u64 pages[1];          /** Page addresses. */
>> +};
>> +VMMDEV_ASSERT_SIZE(vmmdev_hgcm_pagelist, 4 + 2 + 2 + 8);
>> +
>> +#endif
>> diff --git a/include/uapi/linux/vboxguest.h b/include/uapi/linux/vboxguest.h
>> new file mode 100644
>> index 000000000000..d201eb080df2
>> --- /dev/null
>> +++ b/include/uapi/linux/vboxguest.h
>> @@ -0,0 +1,341 @@
>> +/*
>> + * VBoxGuest - VirtualBox Guest Additions Driver Interface.
>> + *
>> + * Copyright (C) 2006-2016 Oracle Corporation
>> + *
>> + * This program is free software; you can redistribute it and/or modify
>> + * it under the terms of the GNU General Public License version 2 as
>> + * published by the Free Software Foundation.
>> + *
>> + * The contents of this file may alternatively be used under the terms
>> + * of the Common Development and Distribution License Version 1.0
>> + * (CDDL) only, in which case the provisions of the CDDL are applicable
>> + * instead of those of the GPL.
>> + *
>> + * You may elect to license modified versions of this file under the
>> + * terms and conditions of either the GPL or the CDDL or both.
>> + */
>> +
>> +#ifndef __UAPI_VBOXGUEST_H__
>> +#define __UAPI_VBOXGUEST_H__
>> +
>> +#include <asm/bitsperlong.h>
>> +#include <linux/ioctl.h>
>> +#include <linux/vbox_err.h>
>> +#include <linux/vbox_vmmdev_types.h>
>> +
>> +/* Version of vbg_ioctl_hdr structure. */
>> +#define VBG_IOCTL_HDR_VERSION        0x10001
>> +/* Default request type.  Use this for non-VMMDev requests. */
>> +#define VBG_IOCTL_HDR_TYPE_DEFAULT        0
>> +
>> +/**
>> + * Common ioctl header.
>> + *
>> + * This is a mirror of vmmdev_request_header to prevent duplicating data and
>> + * needing to verify things multiple times.
>> + */
>> +struct vbg_ioctl_hdr {
>> +    /** IN: The request input size, and output size if size_out is zero. */
>> +    __u32 size_in;
>> +    /** IN: Structure version (VBG_IOCTL_HDR_VERSION) */
>> +    __u32 version;
>> +    /** IN: The VMMDev request type or VBG_IOCTL_HDR_TYPE_DEFAULT. */
>> +    __u32 type;
>> +    /**
>> +     * OUT: The VBox status code of the operation, out direction only.
>> +     * This is a VINF_ or VERR_ value as defined in vbox_err.h.
>> +     */
>> +    __s32 rc;
>> +    /** IN: Output size. Set to zero to use size_in as output size. */
>> +    __u32 size_out;
>> +    /** Reserved, MBZ. */
>> +    __u32 reserved;
>> +};
>> +VMMDEV_ASSERT_SIZE(vbg_ioctl_hdr, 24);
>> +
>> +
>> +/*
>> + * The VBoxGuest I/O control version.
>> + *
>> + * As usual, the high word contains the major version and changes to it
>> + * signifies incompatible changes.
>> + *
>> + * The lower word is the minor version number, it is increased when new
>> + * functions are added or existing changed in a backwards compatible manner.
>> + */
>> +#define VBG_IOC_VERSION        0x00010000u
>> +
>> +/**
>> + * VBG_IOCTL_DRIVER_VERSION_INFO data structure
>> + *
>> + * Note VBG_IOCTL_DRIVER_VERSION_INFO may switch the session to a backwards
>> + * compatible interface version if uClientVersion indicates older client code.
>> + */
>> +struct vbg_ioctl_driver_version_info {
>> +    /** The header. */
>> +    struct vbg_ioctl_hdr hdr;
>> +    union {
>> +        struct {
>> +            /** Requested interface version (VBG_IOC_VERSION). */
>> +            __u32 req_version;
>> +            /**
>> +             * Minimum interface version number (typically the
>> +             * major version part of VBG_IOC_VERSION).
>> +             */
>> +            __u32 min_version;
>> +            /** Reserved, MBZ. */
>> +            __u32 reserved1;
>> +            /** Reserved, MBZ. */
>> +            __u32 reserved2;
>> +        } in;
>> +        struct {
>> +            /** Version for this session (typ. VBG_IOC_VERSION). */
>> +            __u32 session_version;
>> +            /** Version of the IDC interface (VBG_IOC_VERSION). */
>> +            __u32 driver_version;
>> +            /** The SVN revision of the driver, or 0. */
>> +            __u32 driver_revision;
>> +            /** Reserved \#1 (zero until defined). */
>> +            __u32 reserved1;
>> +            /** Reserved \#2 (zero until defined). */
>> +            __u32 reserved2;
>> +        } out;
>> +    } u;
>> +};
>> +VMMDEV_ASSERT_SIZE(vbg_ioctl_driver_version_info, 24 + 20);
>> +
>> +#define VBG_IOCTL_DRIVER_VERSION_INFO \
>> +    _IOWR('V', 0, struct vbg_ioctl_driver_version_info)
>> +
>> +
>> +/* IOCTL to perform a VMM Device request less than 1KB in size. */
>> +#define VBG_IOCTL_VMMDEV_REQUEST(s)    _IOC(_IOC_READ | _IOC_WRITE, 'V', 2, s)
>> +
>> +
>> +/* IOCTL to perform a VMM Device request larger then 1KB. */
>> +#define VBG_IOCTL_VMMDEV_REQUEST_BIG    _IOC(_IOC_READ | _IOC_WRITE, 'V', 3, 0)
>> +
>> +
>> +/** VBG_IOCTL_HGCM_CONNECT data structure. */
>> +struct vbg_ioctl_hgcm_connect {
>> +    struct vbg_ioctl_hdr hdr;
>> +    union {
>> +        struct {
>> +            struct vmmdev_hgcm_service_location loc;
>> +        } in;
>> +        struct {
>> +            __u32 client_id;
>> +        } out;
>> +    } u;
>> +};
>> +VMMDEV_ASSERT_SIZE(vbg_ioctl_hgcm_connect, 24 + 132);
>> +
>> +#define VBG_IOCTL_HGCM_CONNECT \
>> +    _IOWR('V', 4, struct vbg_ioctl_hgcm_connect)
>> +
>> +
>> +/** VBG_IOCTL_HGCM_DISCONNECT data structure. */
>> +struct vbg_ioctl_hgcm_disconnect {
>> +    struct vbg_ioctl_hdr hdr;
>> +    union {
>> +        struct {
>> +            __u32 client_id;
>> +        } in;
>> +    } u;
>> +};
> 
> Another single-member union.

Right, in this case this is done for consistency to follow the
format of all the other ioctls which also have a union with in /
out parameters, as this ioctl only sends data from the
caller to the kernel it only has the in member.

>> +VMMDEV_ASSERT_SIZE(vbg_ioctl_hgcm_disconnect, 24 + 4);
>> +
>> +#define VBG_IOCTL_HGCM_DISCONNECT \
>> +    _IOWR('V', 5, struct vbg_ioctl_hgcm_disconnect)
>> +
>> +
>> +/** VBG_IOCTL_HGCM_CALL data structure. */
>> +struct vbg_ioctl_hgcm_call {
>> +    /** The header. */
>> +    struct vbg_ioctl_hdr hdr;
>> +    /** Input: The id of the caller. */
>> +    __u32 client_id;
>> +    /** Input: Function number. */
>> +    __u32 function;
>> +    /**
>> +     * Input: How long to wait (milliseconds) for completion before
>> +     * cancelling the call. Set to -1 to wait indefinitely.
>> +     */
>> +    __u32 timeout_ms;
>> +    /** Interruptable flag, ignored for userspace calls. */
>> +    __u8 interruptible;
>> +    /** Explicit padding, MBZ. */
>> +    __u8 reserved;
>> +    /**
>> +     * Input: How many parameters following this structure.
>> +     *
>> +     * The parameters are either HGCMFunctionParameter64 or 32,
>> +     * depending on whether we're receiving a 64-bit or 32-bit request.
>> +     *
>> +     * The current maximum is 61 parameters (given a 1KB max request size,
>> +     * and a 64-bit parameter size of 16 bytes).
>> +     */
>> +    __u16 parm_count;
>> +    /*
>> +     * Parameters follow in form:
>> +     * struct hgcm_function_parameter<32|64> parms[parm_count]
>> +     */
>> +};
>> +VMMDEV_ASSERT_SIZE(vbg_ioctl_hgcm_call, 24 + 16);
>> +
>> +#define VBG_IOCTL_HGCM_CALL_32(s)    _IOC(_IOC_READ | _IOC_WRITE, 'V', 6, s)
>> +#define VBG_IOCTL_HGCM_CALL_64(s)    _IOC(_IOC_READ | _IOC_WRITE, 'V', 7, s)
>> +#if __BITS_PER_LONG == 64
>> +#define VBG_IOCTL_HGCM_CALL(s)        VBG_IOCTL_HGCM_CALL_64(s)
>> +#else
>> +#define VBG_IOCTL_HGCM_CALL(s)        VBG_IOCTL_HGCM_CALL_32(s)
>> +#endif
>> +
>> +
>> +/** VBG_IOCTL_LOG data structure. */
>> +struct vbg_ioctl_log {
>> +    /** The header. */
>> +    struct vbg_ioctl_hdr hdr;
>> +    union {
>> +        struct {
>> +            /**
>> +             * The log message, this may be zero terminated. If it
>> +             * is not zero terminated then the length is determined
>> +             * from the input size.
>> +             */
>> +            char msg[1];
>> +        } in;
>> +    } u;
>> +};
> 
> Amother single-member union.

Same reason as the previous one.

>> +
>> +#define VBG_IOCTL_LOG(s)        _IOC(_IOC_READ | _IOC_WRITE, 'V', 9, s)
>> +
>> +
>> +/** VBG_IOCTL_WAIT_FOR_EVENTS data structure. */
>> +struct vbg_ioctl_wait_for_events {
>> +    /** The header. */
>> +    struct vbg_ioctl_hdr hdr;
>> +    union {
>> +        struct {
>> +            /** Timeout in milliseconds. */
>> +            __u32 timeout_ms;
>> +            /** Events to wait for. */
>> +            __u32 events;
>> +        } in;
>> +        struct {
>> +            /** Events that occurred. */
>> +            __u32 events;
>> +        } out;
>> +    } u;
>> +};
>> +VMMDEV_ASSERT_SIZE(vbg_ioctl_wait_for_events, 24 + 8);
>> +
>> +#define VBG_IOCTL_WAIT_FOR_EVENTS \
>> +    _IOWR('V', 10, struct vbg_ioctl_wait_for_events)
>> +
>> +
>> +/*
>> + * IOCTL to VBoxGuest to interrupt (cancel) any pending
>> + * VBG_IOCTL_WAIT_FOR_EVENTS and return.
>> + *
>> + * Handled inside the vboxguest driver and not seen by the host at all.
>> + * After calling this, VBG_IOCTL_WAIT_FOR_EVENTS should no longer be called in
>> + * the same session. Any VBOXGUEST_IOCTL_WAITEVENT calls in the same session
>> + * done after calling this will directly exit with -EINTR.
>> + */
>> +#define VBG_IOCTL_INTERRUPT_ALL_WAIT_FOR_EVENTS \
>> +    _IOWR('V', 11, struct vbg_ioctl_hdr)
>> +
>> +
>> +/** VBG_IOCTL_CHANGE_FILTER_MASK data structure. */
>> +struct vbg_ioctl_change_filter {
>> +    /** The header. */
>> +    struct vbg_ioctl_hdr hdr;
>> +    union {
>> +        struct {
>> +            /** Flags to set. */
>> +            __u32 or_mask;
>> +            /** Flags to remove. */
>> +            __u32 not_mask;
>> +        } in;
>> +    } u;
>> +};
> 
> Amother single-member union.

Same reason as the previous ones  :)

>> +VMMDEV_ASSERT_SIZE(vbg_ioctl_change_filter, 24 + 8);
>> +
>> +/* IOCTL to VBoxGuest to control the event filter mask. */
>> +#define VBG_IOCTL_CHANGE_FILTER_MASK \
>> +    _IOWR('V', 12, struct vbg_ioctl_change_filter)
>> +
>> +
>> +/** VBG_IOCTL_CHANGE_GUEST_CAPABILITIES data structure. */
>> +struct vbg_ioctl_set_guest_caps {
>> +    /** The header. */
>> +    struct vbg_ioctl_hdr hdr;
>> +    union {
>> +        struct {
>> +            /** Capabilities to set (VMMDEV_GUEST_SUPPORTS_XXX). */
>> +            __u32 or_mask;
>> +            /** Capabilities to drop (VMMDEV_GUEST_SUPPORTS_XXX). */
>> +            __u32 not_mask;
>> +        } in;
>> +        struct {
>> +            /** Capabilities held by the session after the call. */
>> +            __u32 session_caps;
>> +            /** Capabilities for all the sessions after the call. */
>> +            __u32 global_caps;
>> +        } out;
>> +    } u;
>> +};
>> +VMMDEV_ASSERT_SIZE(vbg_ioctl_set_guest_caps, 24 + 8);
>> +
>> +#define VBG_IOCTL_CHANGE_GUEST_CAPABILITIES \
>> +    _IOWR('V', 14, struct vbg_ioctl_set_guest_caps)
>> +
>> +
>> +/** VBG_IOCTL_CHECK_BALLOON data structure. */
>> +struct vbg_ioctl_check_balloon {
>> +    /** The header. */
>> +    struct vbg_ioctl_hdr hdr;
>> +    union {
>> +        struct {
>> +            /** The size of the balloon in chunks of 1MB. */
>> +            __u32 balloon_chunks;
>> +            /**
>> +             * false = handled in R0, no further action required.
>> +             *  true = allocate balloon memory in R3.
>> +             */
>> +            __u8 handle_in_r3;
>> +            /** Explicit padding, MBZ. */
>> +            __u8 padding[3];
>> +        } out;
>> +    } u;
>> +};
>> +VMMDEV_ASSERT_SIZE(vbg_ioctl_check_balloon, 24 + 8);
>> +
>> +/*
>> + * IOCTL to check memory ballooning.
>> + *
>> + * The guest kernel module will ask the host for the current size of the
>> + * balloon and adjust the size. Or it will set handle_in_r3 = true and R3 is
>> + * responsible for allocating memory and calling VBG_IOCTL_CHANGE_BALLOON.
>> + */
>> +#define VBG_IOCTL_CHECK_BALLOON \
>> +    _IOWR('V', 17, struct vbg_ioctl_check_balloon)
>> +
>> +
>> +/** VBG_IOCTL_WRITE_CORE_DUMP data structure. */
>> +struct vbg_ioctl_write_coredump {
>> +    struct vbg_ioctl_hdr hdr;
>> +    union {
>> +        struct {
>> +            __u32 flags; /** Flags (reserved, MBZ). */
>> +        } in;
>> +    } u;
>> +};
>> +VMMDEV_ASSERT_SIZE(vbg_ioctl_write_coredump, 24 + 4);
> 
> Another single-member union.

Yes, this is another input only ioctl.

>> +
>> +#define VBG_IOCTL_WRITE_CORE_DUMP \
>> +    _IOWR('V', 19, struct vbg_ioctl_write_coredump)
>> +
>> +#endif
>>
> 

Regards,

Hans

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH resend v2 0/3] virt: Add vboxguest driver for Virtual Box Guest integration
  2017-11-28 10:01   ` Hans de Goede
@ 2017-11-28 16:15     ` Larry Finger
  2017-11-29 12:54       ` Hans de Goede
  0 siblings, 1 reply; 14+ messages in thread
From: Larry Finger @ 2017-11-28 16:15 UTC (permalink / raw)
  To: Hans de Goede, Arnd Bergmann, Greg Kroah-Hartman
  Cc: Michael Thayer, Knut St . Osmundsen, Christoph Hellwig, linux-kernel

On 11/28/2017 04:01 AM, Hans de Goede wrote:
> Hi,
> 

>> I did have two problems when I tried to build these commits and the one that 
>> creates vboxsf.
>>
>> The more serious one is that it is possible to build vboxguest without 
>> vboxvideo. When that happens, a non-privileged user cannot start X. As I say 
>> in the review, > I think that combination does not make sense and should not 
>> be allowed.
> 
> vboxguest and vboxvideo are completely independent at least from the kernel pov,
> I do not believe that making them depend on each other makes sense.
> 
> AFAIK a non-privileged user cannot start X without vboxvideo at all, independent
> of vboxguest being build or not. Falling back to vesa modesetting always requires
> Xorg to be suid root, or the user to be privileged.
> 
> TL;DR: I can add a dependency between the 2, but I would rather not.

Keep in mind that at some point, the newest kernel will support vboxvideo and 
vboxguest; however, any distribution package will still need to contain both 
kernel modules so that older kernels will work. My test showed that loading an 
in-kernel vboxguest with Oracle's vboxvideo fails *unless* you run as root, 
which is not acceptable. When both are in the kernel, then Xorg starts for a 
non-privaleged user. That is why I think you need either a "depends on 
VBOXVIDEO" or a "selects VBOXVIDEO" in the Kconfig for vboxvideo. My preference 
is for the latter.

>> When the system is booted, vboxsf is not loaded, and the shared folders are 
>> not automounted. Of course, that issue is not germane to these patches, but 
>> will be important when vboxsf is merged.
> 
> Hmm, I mount a couple of shares from rc.local (I don't use vbox' automount as I
> want to specify a uid for the files) and as soon as mount.vboxsf gets executed
> the vboxsf module gets auto-loaded as the module contains:
> 
> MODULE_ALIAS_FS("vboxsf");
> 
> AFAIK the communication of which volumes to automount is done through vboxguest,
> anyways I will look into this before submitting vboxsf, in the worst case
> we need to drop a modprobe.conf.d/vboxguest.conf file which has a postinst 
> vboxguest
> which loads vboxsf.

Thanks. Adding something of this type will make the in-kernel version match the 
Oracle documentation.

Larry

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH resend v2 0/3] virt: Add vboxguest driver for Virtual Box Guest integration
  2017-11-28 16:15     ` Larry Finger
@ 2017-11-29 12:54       ` Hans de Goede
  0 siblings, 0 replies; 14+ messages in thread
From: Hans de Goede @ 2017-11-29 12:54 UTC (permalink / raw)
  To: Larry Finger, Arnd Bergmann, Greg Kroah-Hartman
  Cc: Michael Thayer, Knut St . Osmundsen, Christoph Hellwig, linux-kernel

Hi,

On 28-11-17 17:15, Larry Finger wrote:
> On 11/28/2017 04:01 AM, Hans de Goede wrote:
>> Hi,
>>
> 
>>> I did have two problems when I tried to build these commits and the one that creates vboxsf.
>>>
>>> The more serious one is that it is possible to build vboxguest without vboxvideo. When that happens, a non-privileged user cannot start X. As I say in the review, > I think that combination does not make sense and should not be allowed.
>>
>> vboxguest and vboxvideo are completely independent at least from the kernel pov,
>> I do not believe that making them depend on each other makes sense.
>>
>> AFAIK a non-privileged user cannot start X without vboxvideo at all, independent
>> of vboxguest being build or not. Falling back to vesa modesetting always requires
>> Xorg to be suid root, or the user to be privileged.
>>
>> TL;DR: I can add a dependency between the 2, but I would rather not.
> 
> Keep in mind that at some point, the newest kernel will support vboxvideo and vboxguest; however, any distribution package will still need to contain both kernel modules so that older kernels will work. My test showed that loading an in-kernel vboxguest with Oracle's vboxvideo fails *unless* you run as root, which is not acceptable.

Hmm, I guess what is happening here is that the vbox provided vboxguest is not loading
because the one built into the kernel is not loading, and then vboxvideo does not load
because it depends on symbols from vboxguest. But the vboxvideo shipped with the guest
additions has been changed to no longer depend on vboxguest quite a while ago, so with
current guest additions this should not be an issue and functionality wise the 2
vboxguest drivers are equivalent.

"depends on" / "select" really are reserved for when drivers use symbols from another
module and not to express weird interactions like this. There are many ways a .config
can be made which userspace will not like, yet we still allow this. IMHO adding a
depends on between 2 independent modules is simply just wrong.

For the next version I will add a text to the help part of the Kconfig advising to also
enable the vboxvideo driver. That really is the best we can do IMHO.

Talking about the next version, yesterday I ran out of time while working on this,
I hope to post a v3 addressing your review comments today.

> When both are in the kernel, then Xorg starts for a non-privaleged user. That is why I think you need either a "depends on VBOXVIDEO" or a "selects VBOXVIDEO" in the Kconfig for vboxvideo. My preference is for the latter.
> 
>>> When the system is booted, vboxsf is not loaded, and the shared folders are not automounted. Of course, that issue is not germane to these patches, but will be important when vboxsf is merged.
>>
>> Hmm, I mount a couple of shares from rc.local (I don't use vbox' automount as I
>> want to specify a uid for the files) and as soon as mount.vboxsf gets executed
>> the vboxsf module gets auto-loaded as the module contains:
>>
>> MODULE_ALIAS_FS("vboxsf");
>>
>> AFAIK the communication of which volumes to automount is done through vboxguest,
>> anyways I will look into this before submitting vboxsf, in the worst case
>> we need to drop a modprobe.conf.d/vboxguest.conf file which has a postinst vboxguest
>> which loads vboxsf.
> 
> Thanks. Adding something of this type will make the in-kernel version match the Oracle documentation.

Regards,

Hans

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH resend v2 2/3] virt: Add vboxguest VMMDEV communication code
  2017-11-27 19:46   ` Larry Finger
@ 2017-11-29 13:17     ` Hans de Goede
  0 siblings, 0 replies; 14+ messages in thread
From: Hans de Goede @ 2017-11-29 13:17 UTC (permalink / raw)
  To: Larry Finger, Arnd Bergmann, Greg Kroah-Hartman
  Cc: Michael Thayer, Knut St . Osmundsen, Christoph Hellwig, linux-kernel

Hi,

On 27-11-17 20:46, Larry Finger wrote:
> On 11/26/2017 09:12 AM, Hans de Goede wrote:
>> This commits adds a header describing the hardware interface for the
>> Virtual Box Guest PCI device used in Virtual Box virtual machines and
>> utility functions for talking to the Virtual Box hypervisor over this
>> interface.
>>
>> These utility functions will used both by the vboxguest driver for the
>> PCI device which offers the /dev/vboxguest ioctl API and by the vboxfs
>> driver which offers folder sharing support.
>>
>> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
> 
> Reviewed-by: Larry Finger <Larry.Finger.net>
> 
> This patch has only minor defects. Please see the inline comments.
> 
>> ---
>> Changes in v2:
>> -Change all uapi headers to kernel coding style: Drop struct and enum typedefs
>>   make type and struct-member names all lowercase, enum values all uppercase.
>> -Remove unused struct type declarations from some headers (shaving of another
>>   1000 lines)
>> -Remove or fixup doxygen style comments
>> -Get rid of CHECK macros, use a function taking in_ and out_size args instead
>> -Some other small codyingstyle fixes
>> -Split into multiple patches

<snip>

>> +
>> +/**
>> + * Translates linear address types to page list direction flags.
>> + *
>> + * Return: page list flags.
>> + * @type:  The type.
>> + */
>> +static u32 hgcm_call_linear_addr_type_to_pagelist_flags(
>> +    enum vmmdev_hgcm_function_parameter_type type)
>> +{
>> +    switch (type) {
>> +    default:
>> +        WARN_ON(1);
> 
> Do you intend a fall through here? If so, please add a comment to that effect.

Yes, comment added for v3.

>> +    case VMMDEV_HGCM_PARM_TYPE_LINADDR:
>> +    case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL:
>> +        return VMMDEV_HGCM_F_PARM_DIRECTION_BOTH;
>> +
>> +    case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
>> +    case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_IN:
>> +        return VMMDEV_HGCM_F_PARM_DIRECTION_TO_HOST;
>> +
>> +    case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
>> +    case VMMDEV_HGCM_PARM_TYPE_LINADDR_KERNEL_OUT:
>> +        return VMMDEV_HGCM_F_PARM_DIRECTION_FROM_HOST;
>> +    }
>> +}

Regards,

Hans

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH resend v2 3/3] virt: Add vboxguest driver for Virtual Box Guest integration
  2017-11-27 19:46   ` Larry Finger
@ 2017-11-29 14:16     ` Hans de Goede
  0 siblings, 0 replies; 14+ messages in thread
From: Hans de Goede @ 2017-11-29 14:16 UTC (permalink / raw)
  To: Larry Finger, Arnd Bergmann, Greg Kroah-Hartman
  Cc: Michael Thayer, Knut St . Osmundsen, Christoph Hellwig, linux-kernel

Hi,

On 27-11-17 20:46, Larry Finger wrote:
> On 11/26/2017 09:12 AM, Hans de Goede wrote:
>> This commit adds a driver for the Virtual Box Guest PCI device used in
>> Virtual Box virtual machines. Enabling this driver will add support for
>> Virtual Box Guest integration features such as copy-and-paste, seamless
>> mode and OpenGL pass-through.
>>
>> This driver also offers vboxguest IPC functionality which is needed
>> for the vboxfs driver which offers folder sharing support.
>>
>> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
> 
> Reviewed-by: Larry Finger <Larry.Finger.net>
> 
> 
> Smatch lists the following:
> 
>    CHECK   drivers/virt/vboxguest/vboxguest_core.c
> drivers/virt/vboxguest/vboxguest_core.c:604 vbg_set_session_event_filter() error: we previously assumed 'req' could be null (see line 585)
> drivers/virt/vboxguest/vboxguest_core.c:606 vbg_set_session_event_filter() warn: variable dereferenced before check 'req' (see line 604)
> drivers/virt/vboxguest/vboxguest_core.c:698 vbg_set_session_capabilities() error: we previously assumed 'req' could be null (see line 679)
> drivers/virt/vboxguest/vboxguest_core.c:700 vbg_set_session_capabilities() warn: variable dereferenced before check 'req' (see line 698)

Good idea to run smatch, thank you for catching these.

> vbox_utils.c is clean.
> 
> The reasons for the above errors, and other comments inline below.
> 
>> ---
>> Changes in v2:
>> -Change all uapi headers to kernel coding style: Drop struct and enum typedefs
>>   make type and struct-member names all lowercase, enum values all uppercase.
>> -Remove unused struct type declarations from some headers (shaving of another
>>   1000 lines)
>> -Remove or fixup doxygen style comments
>> -Get rid of CHECK macros, use a function taking in_ and out_size args instead
>> -Some other small codyingstyle fixes
>> -Split into multiple patches
>> ---
>>   drivers/virt/Kconfig                       |    1 +
>>   drivers/virt/Makefile                      |    1 +
>>   drivers/virt/vboxguest/Kconfig             |   16 +
>>   drivers/virt/vboxguest/Makefile            |    3 +
>>   drivers/virt/vboxguest/vboxguest_core.c    | 1577 ++++++++++++++++++++++++++++
>>   drivers/virt/vboxguest/vboxguest_core.h    |  187 ++++
>>   drivers/virt/vboxguest/vboxguest_linux.c   |  469 +++++++++
>>   drivers/virt/vboxguest/vboxguest_version.h |   18 +
>>   8 files changed, 2272 insertions(+)
>>   create mode 100644 drivers/virt/vboxguest/Kconfig
>>   create mode 100644 drivers/virt/vboxguest/Makefile
>>   create mode 100644 drivers/virt/vboxguest/vboxguest_core.c
>>   create mode 100644 drivers/virt/vboxguest/vboxguest_core.h
>>   create mode 100644 drivers/virt/vboxguest/vboxguest_linux.c
>>   create mode 100644 drivers/virt/vboxguest/vboxguest_version.h
>>
>> diff --git a/drivers/virt/Kconfig b/drivers/virt/Kconfig
>> index 99ebdde590f8..8d9cdfbd6bcc 100644
>> --- a/drivers/virt/Kconfig
>> +++ b/drivers/virt/Kconfig
>> @@ -30,4 +30,5 @@ config FSL_HV_MANAGER
>>             4) A kernel interface for receiving callbacks when a managed
>>            partition shuts down.
>> +source "drivers/virt/vboxguest/Kconfig"
>>   endif
>> diff --git a/drivers/virt/Makefile b/drivers/virt/Makefile
>> index c47f04dd343b..d3f7b2540890 100644
>> --- a/drivers/virt/Makefile
>> +++ b/drivers/virt/Makefile
>> @@ -3,3 +3,4 @@
>>   #
>>   obj-$(CONFIG_FSL_HV_MANAGER)    += fsl_hypervisor.o
>> +obj-y                += vboxguest/
>> diff --git a/drivers/virt/vboxguest/Kconfig b/drivers/virt/vboxguest/Kconfig
>> new file mode 100644
>> index 000000000000..e88ee46c31d4
>> --- /dev/null
>> +++ b/drivers/virt/vboxguest/Kconfig
>> @@ -0,0 +1,16 @@
>> +config VBOXGUEST
>> +    tristate "Virtual Box Guest integration support"
>> +    depends on X86 && PCI && INPUT
>> +    help
>> +      This is a driver for the Virtual Box Guest PCI device used in
>> +      Virtual Box virtual machines. Enabling this driver will add
>> +      support for Virtual Box Guest integration features such as
>> +      copy-and-paste, seamless mode and OpenGL pass-through.
>> +
>> +      This driver also offers vboxguest IPC functionality which is needed
>> +      for the vboxfs driver which offers folder sharing support.
>> +
>> +      Although it is possible to build this module in, it is advised
>> +      to build this driver as a module, so that it can be updated
>> +      independently of the kernel. Select M to build this driver as a
>> +      module.
> 
> This Kconfig allows vboxguest to be built even though vboxvideo is not being built. That does not seem to be a useful combination.

As discussed in the cover-letter thread, I agree this is not useful, but
adding a "depends on" is also not really the answer, so I've added this
line to the help section:

	  If you enable this driver you should also enable the VBOXVIDEO option.


>> diff --git a/drivers/virt/vboxguest/Makefile b/drivers/virt/vboxguest/Makefile
>> new file mode 100644
>> index 000000000000..203b8f465817
>> --- /dev/null
>> +++ b/drivers/virt/vboxguest/Makefile
>> @@ -0,0 +1,3 @@
>> +vboxguest-y := vboxguest_linux.o vboxguest_core.o vboxguest_utils.o
>> +
>> +obj-$(CONFIG_VBOXGUEST) += vboxguest.o
>> diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
>> new file mode 100644
>> index 000000000000..4927c0d3e336
>> --- /dev/null
>> +++ b/drivers/virt/vboxguest/vboxguest_core.c
>> @@ -0,0 +1,1577 @@
>> +/*
>> + * vboxguest core guest-device handling code, VBoxGuest.cpp in upstream svn.
>> + *
>> + * Copyright (C) 2007-2016 Oracle Corporation
>> + *
>> + * This program is free software; you can redistribute it and/or modify
>> + * it under the terms of the GNU General Public License version 2 as
>> + * published by the Free Software Foundation.
>> + *
>> + * The contents of this file may alternatively be used under the terms
>> + * of the Common Development and Distribution License Version 1.0
>> + * (CDDL) only, in which case the provisions of the CDDL are applicable
>> + * instead of those of the GPL.
>> + *
>> + * You may elect to license modified versions of this file under the
>> + * terms and conditions of either the GPL or the CDDL or both.
>> + */
>> +
>> +#include <linux/device.h>
>> +#include <linux/mm.h>
>> +#include <linux/sched.h>
>> +#include <linux/sizes.h>
>> +#include <linux/slab.h>
>> +#include <linux/vbox_err.h>
>> +#include <linux/vbox_utils.h>
>> +#include <linux/vmalloc.h>
>> +#include "vboxguest_core.h"
>> +#include "vboxguest_version.h"
>> +
>> +/* Get the pointer to the first HGCM parameter. */
>> +#define VBG_IOCTL_HGCM_CALL_PARMS(a) \
>> +    ((struct vmmdev_hgcm_function_parameter *)( \
>> +        (u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call)))
>> +/* Get the pointer to the first HGCM parameter in a 32-bit request. */
>> +#define VBG_IOCTL_HGCM_CALL_PARMS32(a) \
>> +    ((struct vmmdev_hgcm_function_parameter32 *)( \
>> +        (u8 *)(a) + sizeof(struct vbg_ioctl_hgcm_call)))
>> +
>> +#define GUEST_MAPPINGS_TRIES    5
>> +
>> +/**
>> + * Reserves memory in which the VMM can relocate any guest mappings
>> + * that are floating around.
>> + *
>> + * This operation is a little bit tricky since the VMM might not accept
>> + * just any address because of address clashes between the three contexts
>> + * it operates in, so we try several times.
>> + *
>> + * Failure to reserve the guest mappings is ignored.
>> + *
>> + * @gdev:        The Guest extension device.
>> + */
>> +static void vbg_guest_mappings_init(struct vbg_dev *gdev)
>> +{
>> +    struct vmmdev_hypervisorinfo *req;
>> +    void *guest_mappings[GUEST_MAPPINGS_TRIES];
>> +    struct page **pages = NULL;
>> +    u32 size, hypervisor_size;
>> +    int i, rc;
>> +
>> +    /* Query the required space. */
>> +    req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_GET_HYPERVISOR_INFO);
>> +    if (!req)
>> +        return;
>> +
>> +    req->hypervisor_start = 0;
>> +    req->hypervisor_size = 0;
>> +    rc = vbg_req_perform(gdev, req);
>> +    if (rc < 0)
>> +        goto out;
>> +
>> +    /*
>> +     * The VMM will report back if there is nothing it wants to map, like
>> +     * for instance in VT-x and AMD-V mode.
>> +     */
>> +    if (req->hypervisor_size == 0)
>> +        goto out;
>> +
>> +    hypervisor_size = req->hypervisor_size;
>> +    /* Add 4M so that we can align the vmap to 4MiB as the host requires. */
>> +    size = PAGE_ALIGN(req->hypervisor_size) + SZ_4M;
>> +
>> +    pages = kmalloc(sizeof(*pages) * (size >> PAGE_SHIFT), GFP_KERNEL);
>> +    if (!pages)
>> +        goto out;
>> +
>> +    gdev->guest_mappings_dummy_page = alloc_page(GFP_HIGHUSER);
>> +    if (!gdev->guest_mappings_dummy_page)
>> +        goto out;
>> +
>> +    for (i = 0; i < (size >> PAGE_SHIFT); i++)
>> +        pages[i] = gdev->guest_mappings_dummy_page;
>> +
>> +    /* Try several times, the host can be picky about certain addresses. */
> 
> This comment should repeat that address clashes could be due to the different contexts. When I read this the first time, I had missed the comment above, and I expect that other readers might make the same mistake.

Ok, fixed for v3.

>> +    for (i = 0; i < GUEST_MAPPINGS_TRIES; i++) {
>> +        guest_mappings[i] = vmap(pages, (size >> PAGE_SHIFT),
>> +                     VM_MAP, PAGE_KERNEL_RO);
>> +        if (!guest_mappings[i])
>> +            break;
>> +
>> +        req->header.request_type = VMMDEVREQ_SET_HYPERVISOR_INFO;
>> +        req->header.rc = VERR_INTERNAL_ERROR;
>> +        req->hypervisor_size = hypervisor_size;
>> +        req->hypervisor_start =
>> +            (unsigned long)PTR_ALIGN(guest_mappings[i], SZ_4M);
>> +
>> +        rc = vbg_req_perform(gdev, req);
>> +        if (rc >= 0) {
>> +            gdev->guest_mappings = guest_mappings[i];
>> +            break;
>> +        }
>> +    }
>> +
>> +    /* Free vmap's from failed attempts. */
>> +    while (--i >= 0)
>> +        vunmap(guest_mappings[i]);
>> +
>> +    /* On failure free the dummy-page backing the vmap */
>> +    if (!gdev->guest_mappings) {
>> +        __free_page(gdev->guest_mappings_dummy_page);
>> +        gdev->guest_mappings_dummy_page = NULL;
>> +    }
>> +
>> +out:
>> +    kfree(req);
>> +    kfree(pages);
>> +}
>> +
>> +/**
>> + * Undo what vbg_guest_mappings_init did.
>> + *
>> + * @gdev:        The Guest extension device.
>> + */
>> +static void vbg_guest_mappings_exit(struct vbg_dev *gdev)
>> +{
>> +    struct vmmdev_hypervisorinfo *req;
>> +    int rc;
>> +
>> +    if (!gdev->guest_mappings)
>> +        return;
>> +
>> +    /*
>> +     * Tell the host that we're going to free the memory we reserved for
>> +     * it, the free it up. (Leak the memory if anything goes wrong here.)
>> +     */
>> +    req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_HYPERVISOR_INFO);
>> +    if (!req)
>> +        return;
>> +
>> +    req->hypervisor_start = 0;
>> +    req->hypervisor_size = 0;
>> +
>> +    rc = vbg_req_perform(gdev, req);
>> +
>> +    kfree(req);
>> +
>> +    if (rc < 0) {
>> +        vbg_err("%s error: %d\n", __func__, rc);
>> +        return;
>> +    }
>> +
>> +    vunmap(gdev->guest_mappings);
>> +    gdev->guest_mappings = NULL;
>> +
>> +    __free_page(gdev->guest_mappings_dummy_page);
>> +    gdev->guest_mappings_dummy_page = NULL;
>> +}
>> +
>> +/**
>> + * Report the guest information to the host.
>> + * Return: 0 or negative errno value.
>> + * @gdev:        The Guest extension device.
>> + */
>> +static int vbg_report_guest_info(struct vbg_dev *gdev)
>> +{
>> +    /*
>> +     * Allocate and fill in the two guest info reports.
>> +     */
>> +    struct vmmdev_guest_info *req1 = NULL;
>> +    struct vmmdev_guest_info2 *req2 = NULL;
>> +    int rc, ret = -ENOMEM;
>> +
>> +    req1 = vbg_req_alloc(sizeof(*req1), VMMDEVREQ_REPORT_GUEST_INFO);
>> +    req2 = vbg_req_alloc(sizeof(*req2), VMMDEVREQ_REPORT_GUEST_INFO2);
>> +    if (!req1 || !req2)
>> +        goto out_free;
>> +
>> +    req1->interface_version = VMMDEV_VERSION;
>> +    req1->os_type = VMMDEV_OSTYPE_LINUX26;
>> +#if __BITS_PER_LONG == 64
>> +    req1->os_type |= VMMDEV_OSTYPE_X64;
>> +#endif
>> +
>> +    req2->additions_major = VBG_VERSION_MAJOR;
>> +    req2->additions_minor = VBG_VERSION_MINOR;
>> +    req2->additions_build = VBG_VERSION_BUILD;
>> +    req2->additions_revision = VBG_SVN_REV;
>> +    /* (no features defined yet) */
>> +    req2->additions_features = 0;
>> +    strlcpy(req2->name, VBG_VERSION_STRING,
>> +        sizeof(req2->name));
>> +
>> +    /*
>> +     * There are two protocols here:
>> +     *      1. INFO2 + INFO1. Supported by >=3.2.51.
>> +     *      2. INFO1 and optionally INFO2. The old protocol.
>> +     *
>> +     * We try protocol 2 first.  It will fail with VERR_NOT_SUPPORTED
>> +     * if not supported by the VMMDev (message ordering requirement).
>> +     */
>> +    rc = vbg_req_perform(gdev, req2);
>> +    if (rc >= 0) {
>> +        rc = vbg_req_perform(gdev, req1);
>> +    } else if (rc == VERR_NOT_SUPPORTED || rc == VERR_NOT_IMPLEMENTED) {
>> +        rc = vbg_req_perform(gdev, req1);
>> +        if (rc >= 0) {
>> +            rc = vbg_req_perform(gdev, req2);
>> +            if (rc == VERR_NOT_IMPLEMENTED)
>> +                rc = VINF_SUCCESS;
>> +        }
>> +    }
>> +    ret = vbg_status_code_to_errno(rc);
>> +
>> +out_free:
>> +    kfree(req2);
>> +    kfree(req1);
>> +    return ret;
>> +}
>> +
>> +/**
>> + * Report the guest driver status to the host.
>> + * Return: 0 or negative errno value.
>> + * @gdev:        The Guest extension device.
>> + * @active:        Flag whether the driver is now active or not.
>> + */
>> +static int vbg_report_driver_status(struct vbg_dev *gdev, bool active)
>> +{
>> +    struct vmmdev_guest_status *req;
>> +    int rc;
>> +
>> +    req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_REPORT_GUEST_STATUS);
>> +    if (!req)
>> +        return -ENOMEM;
>> +
>> +    req->facility = VBOXGUEST_FACILITY_TYPE_VBOXGUEST_DRIVER;
>> +    if (active)
>> +        req->status = VBOXGUEST_FACILITY_STATUS_ACTIVE;
>> +    else
>> +        req->status = VBOXGUEST_FACILITY_STATUS_INACTIVE;
>> +    req->flags = 0;
>> +
>> +    rc = vbg_req_perform(gdev, req);
>> +    if (rc == VERR_NOT_IMPLEMENTED)    /* Compatibility with older hosts. */
>> +        rc = VINF_SUCCESS;
>> +
>> +    kfree(req);
>> +
>> +    return vbg_status_code_to_errno(rc);
>> +}
>> +
>> +/**
>> + * Inflate the balloon by one chunk. The caller owns the balloon mutex.
>> + * Return: 0 or negative errno value.
>> + * @gdev:        The Guest extension device.
>> + * @chunk_idx:        Index of the chunk.
>> + */
>> +static int vbg_balloon_inflate(struct vbg_dev *gdev, u32 chunk_idx)
>> +{
>> +    struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req;
>> +    struct page **pages;
>> +    int i, rc, ret;
>> +
>> +    pages = kmalloc(sizeof(*pages) * VMMDEV_MEMORY_BALLOON_CHUNK_PAGES,
>> +            GFP_KERNEL | __GFP_NOWARN);
>> +    if (!pages)
>> +        return -ENOMEM;
>> +
>> +    req->header.size = sizeof(*req);
>> +    req->inflate = true;
>> +    req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
>> +
>> +    for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++) {
>> +        pages[i] = alloc_page(GFP_KERNEL | __GFP_NOWARN);
>> +        if (!pages[i]) {
>> +            ret = -ENOMEM;
>> +            goto out_error;
>> +        }
>> +
>> +        req->phys_page[i] = page_to_phys(pages[i]);
>> +    }
>> +
>> +    rc = vbg_req_perform(gdev, req);
>> +    if (rc < 0) {
>> +        vbg_err("%s error, rc: %d\n", __func__, rc);
>> +        ret = vbg_status_code_to_errno(rc);
>> +        goto out_error;
>> +    }
>> +
>> +    gdev->mem_balloon.pages[chunk_idx] = pages;
>> +
>> +    return 0;
>> +
>> +out_error:
>> +    while (--i >= 0)
>> +        __free_page(pages[i]);
>> +    kfree(pages);
>> +
>> +    return ret;
>> +}
>> +
>> +/**
>> + * Deflate the balloon by one chunk. The caller owns the balloon mutex.
>> + * Return: 0 or negative errno value.
>> + * @gdev:        The Guest extension device.
>> + * @chunk_idx:        Index of the chunk.
>> + */
>> +static int vbg_balloon_deflate(struct vbg_dev *gdev, u32 chunk_idx)
>> +{
>> +    struct vmmdev_memballoon_change *req = gdev->mem_balloon.change_req;
>> +    struct page **pages = gdev->mem_balloon.pages[chunk_idx];
>> +    int i, rc;
>> +
>> +    req->header.size = sizeof(*req);
>> +    req->inflate = false;
>> +    req->pages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
>> +
>> +    for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++)
>> +        req->phys_page[i] = page_to_phys(pages[i]);
>> +
>> +    rc = vbg_req_perform(gdev, req);
>> +    if (rc < 0) {
>> +        vbg_err("%s error, rc: %d\n", __func__, rc);
>> +        return vbg_status_code_to_errno(rc);
>> +    }
>> +
>> +    for (i = 0; i < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; i++)
>> +        __free_page(pages[i]);
>> +    kfree(pages);
>> +    gdev->mem_balloon.pages[chunk_idx] = NULL;
>> +
>> +    return 0;
>> +}
>> +
>> +/**
>> + * Respond to VMMDEV_EVENT_BALLOON_CHANGE_REQUEST events, query the size
>> + * the host wants the balloon to be and adjust accordingly.
>> + */
>> +static void vbg_balloon_work(struct work_struct *work)
>> +{
>> +    struct vbg_dev *gdev =
>> +        container_of(work, struct vbg_dev, mem_balloon.work);
>> +    struct vmmdev_memballoon_info *req = gdev->mem_balloon.get_req;
>> +    u32 i, chunks;
>> +    int rc, ret;
>> +
>> +    /*
>> +     * Setting this bit means that we request the value from the host and
>> +     * change the guest memory balloon according to the returned value.
>> +     */
>> +    req->event_ack = VMMDEV_EVENT_BALLOON_CHANGE_REQUEST;
>> +    rc = vbg_req_perform(gdev, req);
>> +    if (rc < 0) {
>> +        vbg_err("%s error, rc: %d)\n", __func__, rc);
>> +        return;
>> +    }
>> +
>> +    /*
>> +     * The host always returns the same maximum amount of chunks, so
>> +     * we do this once.
>> +     */
>> +    if (!gdev->mem_balloon.max_chunks) {
>> +        gdev->mem_balloon.pages =
>> +            devm_kcalloc(gdev->dev, req->phys_mem_chunks,
>> +                     sizeof(struct page **), GFP_KERNEL);
>> +        if (!gdev->mem_balloon.pages)
>> +            return;
>> +
>> +        gdev->mem_balloon.max_chunks = req->phys_mem_chunks;
>> +    }
>> +
>> +    chunks = req->balloon_chunks;
>> +    if (chunks > gdev->mem_balloon.max_chunks) {
>> +        vbg_err("%s: illegal balloon size %u (max=%u)\n",
>> +            __func__, chunks, gdev->mem_balloon.max_chunks);
>> +        return;
>> +    }
>> +
>> +    if (chunks > gdev->mem_balloon.chunks) {
>> +        /* inflate */
>> +        for (i = gdev->mem_balloon.chunks; i < chunks; i++) {
>> +            ret = vbg_balloon_inflate(gdev, i);
>> +            if (ret < 0)
>> +                return;
>> +
>> +            gdev->mem_balloon.chunks++;
>> +        }
>> +    } else {
>> +        /* deflate */
>> +        for (i = gdev->mem_balloon.chunks; i-- > chunks;) {
>> +            ret = vbg_balloon_deflate(gdev, i);
>> +            if (ret < 0)
>> +                return;
>> +
>> +            gdev->mem_balloon.chunks--;
>> +        }
>> +    }
>> +}
>> +
>> +/**
>> + * Callback for heartbeat timer.
>> + */
>> +static void vbg_heartbeat_timer(struct timer_list *t)
>> +{
>> +    struct vbg_dev *gdev = from_timer(gdev, t, heartbeat_timer);
>> +
>> +    vbg_req_perform(gdev, gdev->guest_heartbeat_req);
>> +    mod_timer(&gdev->heartbeat_timer,
>> +          msecs_to_jiffies(gdev->heartbeat_interval_ms));
>> +}
>> +
>> +/**
>> + * Configure the host to check guest's heartbeat
>> + * and get heartbeat interval from the host.
>> + * Return: 0 or negative errno value.
>> + * @gdev:        The Guest extension device.
>> + * @enabled:        Set true to enable guest heartbeat checks on host.
>> + */
>> +static int vbg_heartbeat_host_config(struct vbg_dev *gdev, bool enabled)
>> +{
>> +    struct vmmdev_heartbeat *req;
>> +    int rc;
>> +
>> +    req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_HEARTBEAT_CONFIGURE);
>> +    if (!req)
>> +        return -ENOMEM;
>> +
>> +    req->enabled = enabled;
>> +    req->interval_ns = 0;
>> +    rc = vbg_req_perform(gdev, req);
>> +    do_div(req->interval_ns, 1000000); /* ns -> ms */
>> +    gdev->heartbeat_interval_ms = req->interval_ns;
>> +    kfree(req);
>> +
>> +    return vbg_status_code_to_errno(rc);
>> +}
>> +
>> +/**
>> + * Initializes the heartbeat timer. This feature may be disabled by the host.
>> + * Return: 0 or negative errno value.
>> + * @gdev:        The Guest extension device.
>> + */
>> +static int vbg_heartbeat_init(struct vbg_dev *gdev)
>> +{
>> +    int ret;
>> +
>> +    /* Make sure that heartbeat checking is disabled if we fail. */
>> +    ret = vbg_heartbeat_host_config(gdev, false);
>> +    if (ret < 0)
>> +        return ret;
>> +
>> +    ret = vbg_heartbeat_host_config(gdev, true);
>> +    if (ret < 0)
>> +        return ret;
>> +
>> +    /*
>> +     * Preallocate the request to use it from the timer callback because:
>> +     *    1) on Windows vbg_req_alloc must be called at IRQL <= APC_LEVEL
>> +     *       and the timer callback runs at DISPATCH_LEVEL;
>> +     *    2) avoid repeated allocations.
>> +     */
>> +    gdev->guest_heartbeat_req = vbg_req_alloc(
>> +                    sizeof(*gdev->guest_heartbeat_req),
>> +                    VMMDEVREQ_GUEST_HEARTBEAT);
>> +    if (!gdev->guest_heartbeat_req)
>> +        return -ENOMEM;
>> +
>> +    vbg_info("%s: Setting up heartbeat to trigger every %d milliseconds\n",
>> +         __func__, gdev->heartbeat_interval_ms);
>> +    mod_timer(&gdev->heartbeat_timer, 0);
>> +
>> +    return 0;
>> +}
>> +
>> +/**
>> + * Cleanup hearbeat code, stop HB timer and disable host heartbeat checking.
>> + * @gdev:        The Guest extension device.
>> + */
>> +static void vbg_heartbeat_exit(struct vbg_dev *gdev)
>> +{
>> +    del_timer_sync(&gdev->heartbeat_timer);
>> +    vbg_heartbeat_host_config(gdev, false);
>> +    kfree(gdev->guest_heartbeat_req);
>> +
>> +}
>> +
>> +/**
>> + * Applies a change to the bit usage tracker.
>> + * Return: true if the mask changed, false if not.
>> + * @tracker:        The bit usage tracker.
>> + * @changed:        The bits to change.
>> + * @previous:        The previous value of the bits.
>> + */
>> +static bool vbg_track_bit_usage(struct vbg_bit_usage_tracker *tracker,
>> +                u32 changed, u32 previous)
>> +{
>> +    bool global_change = false;
>> +
>> +    while (changed) {
>> +        u32 bit = ffs(changed) - 1;
>> +        u32 bitmask = BIT(bit);
>> +
>> +        if (bitmask & previous) {
>> +            tracker->per_bit_usage[bit] -= 1;
>> +            if (tracker->per_bit_usage[bit] == 0) {
>> +                global_change = true;
>> +                tracker->mask &= ~bitmask;
>> +            }
>> +        } else {
>> +            tracker->per_bit_usage[bit] += 1;
>> +            if (tracker->per_bit_usage[bit] == 1) {
>> +                global_change = true;
>> +                tracker->mask |= bitmask;
>> +            }
>> +        }
>> +
>> +        changed &= ~bitmask;
>> +    }
>> +
>> +    return global_change;
>> +}
>> +
>> +/**
>> + * Init and termination worker for resetting the (host) event filter on the host
>> + * Return: 0 or negative errno value.
>> + * @gdev:           The Guest extension device.
>> + * @fixed_events:       Fixed events (init time).
>> + */
>> +static int vbg_reset_host_event_filter(struct vbg_dev *gdev,
>> +                       u32 fixed_events)
>> +{
>> +    struct vmmdev_mask *req;
>> +    int rc;
>> +
>> +    req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK);
>> +    if (!req)
>> +        return -ENOMEM;
>> +
>> +    req->not_mask = U32_MAX & ~fixed_events;
>> +    req->or_mask = fixed_events;
>> +    rc = vbg_req_perform(gdev, req);
>> +    if (rc < 0)
>> +        vbg_err("%s error, rc: %d\n", __func__, rc);
>> +
>> +    kfree(req);
>> +    return vbg_status_code_to_errno(rc);
>> +}
>> +
>> +/**
>> + * Changes the event filter mask for the given session.
>> + *
>> + * This is called in response to VBG_IOCTL_CHANGE_FILTER_MASK as well as to
>> + * do session cleanup. Takes the session spinlock.
>> + *
>> + * Return: 0 or negative errno value.
>> + * @gdev:            The Guest extension device.
>> + * @session:            The session.
>> + * @or_mask:            The events to add.
>> + * @not_mask:            The events to remove.
>> + * @session_termination:    Set if we're called by the session cleanup code.
>> + *                This tweaks the error handling so we perform
>> + *                proper session cleanup even if the host
>> + *                misbehaves.
>> + */
>> +static int vbg_set_session_event_filter(struct vbg_dev *gdev,
>> +                    struct vbg_session *session,
>> +                    u32 or_mask, u32 not_mask,
>> +                    bool session_termination)
>> +{
>> +    struct vmmdev_mask *req;
>> +    u32 changed, previous;
>> +    int rc, ret = 0;
>> +
>> +    /* Allocate a request buffer before taking the spinlock */
>> +    req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_CTL_GUEST_FILTER_MASK);
>> +    if (!req) {
>> +        if (!session_termination)
>> +            return -ENOMEM;
>> +        /* Ignore failure, we must do session cleanup. */
> 
> The comment should say "Ignore allocation failure ...", but that leads to problems below.

Ok, fixed for v3.

>> +    }
>> +
>> +    mutex_lock(&gdev->session_mutex);
>> +
>> +    /* Apply the changes to the session mask. */
>> +    previous = session->event_filter;
>> +    session->event_filter |= or_mask;
>> +    session->event_filter &= ~not_mask;
>> +
>> +    /* If anything actually changed, update the global usage counters. */
>> +    changed = previous ^ session->event_filter;
>> +    if (!changed)
>> +        goto out;
>> +
>> +    vbg_track_bit_usage(&gdev->event_filter_tracker, changed, previous);
>> +    req->or_mask = gdev->fixed_events | gdev->event_filter_tracker.mask;
> 
> At this point, req could be NULL. I'm not sure what session cleanup is needed if req is NULL and session_termination is not, but it needs to be split out.

Right, I've solved this by using a local or_mask variable and ...

>> +
>> +    if (gdev->event_filter_host == req->or_mask || !req)
>> +        goto out;
>> +
>> +    gdev->event_filter_host = req->or_mask;
>> +    req->not_mask = ~req->or_mask;

Assigning that to req->or_mask here, after the !req check.

>> +    rc = vbg_req_perform(gdev, req);
>> +    if (rc < 0) {
>> +        ret = vbg_status_code_to_errno(rc);
>> +
>> +        /* Failed, roll back (unless it's session termination time). */
>> +        gdev->event_filter_host = U32_MAX;
>> +        if (session_termination)
>> +            goto out;
>> +
>> +        vbg_track_bit_usage(&gdev->event_filter_tracker, changed,
>> +                    session->event_filter);
>> +        session->event_filter = previous;
>> +    }
>> +
>> +out:
>> +    mutex_unlock(&gdev->session_mutex);
>> +    kfree(req);
>> +
>> +    return ret;
>> +}
>> +
>> +/**
>> + * Init and termination worker for set guest capabilities to zero on the host.
>> + * Return: 0 or negative errno value.
>> + * @gdev:        The Guest extension device.
>> + */
>> +static int vbg_reset_host_capabilities(struct vbg_dev *gdev)
>> +{
>> +    struct vmmdev_mask *req;
>> +    int rc;
>> +
>> +    req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES);
>> +    if (!req)
>> +        return -ENOMEM;
>> +
>> +    req->not_mask = U32_MAX;
>> +    req->or_mask = 0;
>> +    rc = vbg_req_perform(gdev, req);
>> +    if (rc < 0)
>> +        vbg_err("%s error, rc: %d\n", __func__, rc);
>> +
>> +    kfree(req);
>> +    return vbg_status_code_to_errno(rc);
>> +}
>> +
>> +/**
>> + * Sets the guest capabilities for a session. Takes the session spinlock.
>> + * Return: 0 or negative errno value.
>> + * @gdev:            The Guest extension device.
>> + * @session:            The session.
>> + * @or_mask:            The capabilities to add.
>> + * @not_mask:            The capabilities to remove.
>> + * @session_termination:    Set if we're called by the session cleanup code.
>> + *                This tweaks the error handling so we perform
>> + *                proper session cleanup even if the host
>> + *                misbehaves.
>> + */
>> +static int vbg_set_session_capabilities(struct vbg_dev *gdev,
>> +                    struct vbg_session *session,
>> +                    u32 or_mask, u32 not_mask,
>> +                    bool session_termination)
>> +{
>> +    struct vmmdev_mask *req;
>> +    u32 changed, previous;
>> +    int rc, ret = 0;
>> +
>> +    /* Allocate a request buffer before taking the spinlock */
>> +    req = vbg_req_alloc(sizeof(*req), VMMDEVREQ_SET_GUEST_CAPABILITIES);
>> +    if (!req) {
>> +        if (!session_termination)
>> +            return -ENOMEM;
>> +        /* Ignore failure, we must do session cleanup. */
> 
> This comment should also be changed.

Ack, also fixed.

>> +    }
>> +
>> +    mutex_lock(&gdev->session_mutex);
>> +
>> +    /* Apply the changes to the session mask. */
>> +    previous = session->guest_caps;
>> +    session->guest_caps |= or_mask;
>> +    session->guest_caps &= ~not_mask;
>> +
>> +    /* If anything actually changed, update the global usage counters. */
>> +    changed = previous ^ session->guest_caps;
>> +    if (!changed)
>> +        goto out;
>> +
>> +    vbg_track_bit_usage(&gdev->guest_caps_tracker, changed, previous);
>> +    req->or_mask = gdev->guest_caps_tracker.mask;
> 
> req can be NULL here.

Ack, fixed in the same way as above.

>> +
>> +    if (gdev->guest_caps_host == req->or_mask || !req)
>> +        goto out;
>> +
>> +    gdev->guest_caps_host = req->or_mask;
>> +    req->not_mask = ~req->or_mask;
>> +    rc = vbg_req_perform(gdev, req);
>> +    if (rc < 0) {
>> +        ret = vbg_status_code_to_errno(rc);
>> +
>> +        /* Failed, roll back (unless it's session termination time). */
>> +        gdev->guest_caps_host = U32_MAX;
>> +        if (session_termination)
>> +            goto out;
>> +
>> +        vbg_track_bit_usage(&gdev->guest_caps_tracker, changed,
>> +                    session->guest_caps);
>> +        session->guest_caps = previous;
>> +    }
>> +
>> +out:
>> +    mutex_unlock(&gdev->session_mutex);
>> +    kfree(req);
>> +
>> +    return ret;
>> +}

<snip>

Regards,

Hans

^ permalink raw reply	[flat|nested] 14+ messages in thread

end of thread, other threads:[~2017-11-29 14:16 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-11-26 15:12 [PATCH resend v2 0/3] virt: Add vboxguest driver for Virtual Box Guest integration Hans de Goede
2017-11-26 15:12 ` [PATCH resend v2 1/3] virt: Add vboxguest driver for Virtual Box Guest integration UAPI Hans de Goede
2017-11-27 19:44   ` Larry Finger
2017-11-28 10:08     ` Hans de Goede
2017-11-26 15:12 ` [PATCH resend v2 2/3] virt: Add vboxguest VMMDEV communication code Hans de Goede
2017-11-27 19:46   ` Larry Finger
2017-11-29 13:17     ` Hans de Goede
2017-11-26 15:12 ` [PATCH resend v2 3/3] virt: Add vboxguest driver for Virtual Box Guest integration Hans de Goede
2017-11-27 19:46   ` Larry Finger
2017-11-29 14:16     ` Hans de Goede
2017-11-27 19:44 ` [PATCH resend v2 0/3] " Larry Finger
2017-11-28 10:01   ` Hans de Goede
2017-11-28 16:15     ` Larry Finger
2017-11-29 12:54       ` Hans de Goede

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.