VBoxGuest.cpp@ 40195

Last change on this file since 40195 was 40195, checked in by vboxsync, 13 years ago
VBoxGuest: BOOL -> bool.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 95.9 KB

Line
1	/* $Id: VBoxGuest.cpp 40195 2012-02-21 12:48:41Z vboxsync $ */
2	/** @file
3	* VBoxGuest - Guest Additions Driver, Common Code.
4	*/
5
6	/*
7	* Copyright (C) 2007-2010 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*******************************************************************************
20	* Header Files *
21	*******************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DEFAULT
23	#include "VBoxGuestInternal.h"
24	#include "VBoxGuest2.h"
25	#include <VBox/VMMDev.h> /* for VMMDEV_RAM_SIZE */
26	#include <VBox/log.h>
27	#include <iprt/mem.h>
28	#include <iprt/time.h>
29	#include <iprt/memobj.h>
30	#include <iprt/asm.h>
31	#include <iprt/asm-amd64-x86.h>
32	#include <iprt/string.h>
33	#include <iprt/process.h>
34	#include <iprt/assert.h>
35	#include <iprt/param.h>
36	#ifdef VBOX_WITH_HGCM
37	# include <iprt/thread.h>
38	#endif
39	#include "version-generated.h"
40	#if defined(RT_OS_LINUX) \|\| defined(RT_OS_FREEBSD)
41	# include "revision-generated.h"
42	#endif
43	#ifdef RT_OS_WINDOWS
44	# ifndef CTL_CODE
45	# include <Windows.h>
46	# endif
47	#endif
48	#if defined(RT_OS_SOLARIS)
49	# include <iprt/rand.h>
50	#endif
51
52
53	/*******************************************************************************
54	* Internal Functions *
55	*******************************************************************************/
56	#ifdef VBOX_WITH_HGCM
57	static DECLCALLBACK(int) VBoxGuestHGCMAsyncWaitCallback(VMMDevHGCMRequestHeader pHdrNonVolatile, void pvUser, uint32_t u32User);
58	#endif
59	#ifdef DEBUG
60	static void testSetMouseStatus(void);
61	#endif
62	static int VBoxGuestCommonIOCtl_SetMouseStatus(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession, uint32_t fFeatures);
63
64
65	/*******************************************************************************
66	* Global Variables *
67	*******************************************************************************/
68	static const size_t cbChangeMemBalloonReq = RT_OFFSETOF(VMMDevChangeMemBalloon, aPhysPage[VMMDEV_MEMORY_BALLOON_CHUNK_PAGES]);
69
70	#if defined(RT_OS_SOLARIS)
71	/**
72	* Drag in the rest of IRPT since we share it with the
73	* rest of the kernel modules on Solaris.
74	*/
75	PFNRT g_apfnVBoxGuestIPRTDeps[] =
76	{
77	/* VirtioNet */
78	(PFNRT)RTRandBytes,
79	NULL
80	};
81	#endif /* RT_OS_SOLARIS */
82
83
84	/**
85	* Reserves memory in which the VMM can relocate any guest mappings
86	* that are floating around.
87	*
88	* This operation is a little bit tricky since the VMM might not accept
89	* just any address because of address clashes between the three contexts
90	* it operates in, so use a small stack to perform this operation.
91	*
92	* @returns VBox status code (ignored).
93	* @param pDevExt The device extension.
94	*/
95	static int vboxGuestInitFixateGuestMappings(PVBOXGUESTDEVEXT pDevExt)
96	{
97	/*
98	* Query the required space.
99	*/
100	VMMDevReqHypervisorInfo *pReq;
101	int rc = VbglGRAlloc((VMMDevRequestHeader **)&pReq, sizeof(VMMDevReqHypervisorInfo), VMMDevReq_GetHypervisorInfo);
102	if (RT_FAILURE(rc))
103	return rc;
104	pReq->hypervisorStart = 0;
105	pReq->hypervisorSize = 0;
106	rc = VbglGRPerform(&pReq->header);
107	if (RT_FAILURE(rc)) /* this shouldn't happen! */
108	{
109	VbglGRFree(&pReq->header);
110	return rc;
111	}
112
113	/*
114	* The VMM will report back if there is nothing it wants to map, like for
115	* instance in VT-x and AMD-V mode.
116	*/
117	if (pReq->hypervisorSize == 0)
118	Log(("vboxGuestInitFixateGuestMappings: nothing to do\n"));
119	else
120	{
121	/*
122	* We have to try several times since the host can be picky
123	* about certain addresses.
124	*/
125	RTR0MEMOBJ hFictive = NIL_RTR0MEMOBJ;
126	uint32_t cbHypervisor = pReq->hypervisorSize;
127	RTR0MEMOBJ ahTries[5];
128	uint32_t iTry;
129	bool fBitched = false;
130	Log(("vboxGuestInitFixateGuestMappings: cbHypervisor=%#x\n", cbHypervisor));
131	for (iTry = 0; iTry < RT_ELEMENTS(ahTries); iTry++)
132	{
133	/*
134	* Reserve space, or if that isn't supported, create a object for
135	* some fictive physical memory and map that in to kernel space.
136	*
137	* To make the code a bit uglier, most systems cannot help with
138	* 4MB alignment, so we have to deal with that in addition to
139	* having two ways of getting the memory.
140	*/
141	uint32_t uAlignment = _4M;
142	RTR0MEMOBJ hObj;
143	rc = RTR0MemObjReserveKernel(&hObj, (void *)-1, RT_ALIGN_32(cbHypervisor, _4M), uAlignment);
144	if (rc == VERR_NOT_SUPPORTED)
145	{
146	uAlignment = PAGE_SIZE;
147	rc = RTR0MemObjReserveKernel(&hObj, (void *)-1, RT_ALIGN_32(cbHypervisor, _4M) + _4M, uAlignment);
148	}
149	/*
150	* If both RTR0MemObjReserveKernel calls above failed because either not supported or
151	* not implemented at all at the current platform, try to map the memory object into the
152	* virtual kernel space.
153	*/
154	if (rc == VERR_NOT_SUPPORTED)
155	{
156	if (hFictive == NIL_RTR0MEMOBJ)
157	{
158	rc = RTR0MemObjEnterPhys(&hObj, VBOXGUEST_HYPERVISOR_PHYSICAL_START, cbHypervisor + _4M, RTMEM_CACHE_POLICY_DONT_CARE);
159	if (RT_FAILURE(rc))
160	break;
161	hFictive = hObj;
162	}
163	uAlignment = _4M;
164	rc = RTR0MemObjMapKernel(&hObj, hFictive, (void *)-1, uAlignment, RTMEM_PROT_READ \| RTMEM_PROT_WRITE);
165	if (rc == VERR_NOT_SUPPORTED)
166	{
167	uAlignment = PAGE_SIZE;
168	rc = RTR0MemObjMapKernel(&hObj, hFictive, (void *)-1, uAlignment, RTMEM_PROT_READ \| RTMEM_PROT_WRITE);
169	}
170	}
171	if (RT_FAILURE(rc))
172	{
173	LogRel(("VBoxGuest: Failed to reserve memory for the hypervisor: rc=%Rrc (cbHypervisor=%#x uAlignment=%#x iTry=%u)\n",
174	rc, cbHypervisor, uAlignment, iTry));
175	fBitched = true;
176	break;
177	}
178
179	/*
180	* Try set it.
181	*/
182	pReq->header.requestType = VMMDevReq_SetHypervisorInfo;
183	pReq->header.rc = VERR_INTERNAL_ERROR;
184	pReq->hypervisorSize = cbHypervisor;
185	pReq->hypervisorStart = (uintptr_t)RTR0MemObjAddress(hObj);
186	if ( uAlignment == PAGE_SIZE
187	&& pReq->hypervisorStart & (_4M - 1))
188	pReq->hypervisorStart = RT_ALIGN_32(pReq->hypervisorStart, _4M);
189	AssertMsg(RT_ALIGN_32(pReq->hypervisorStart, _4M) == pReq->hypervisorStart, ("%#x\n", pReq->hypervisorStart));
190
191	rc = VbglGRPerform(&pReq->header);
192	if (RT_SUCCESS(rc))
193	{
194	pDevExt->hGuestMappings = hFictive != NIL_RTR0MEMOBJ ? hFictive : hObj;
195	Log(("VBoxGuest: %p LB %#x; uAlignment=%#x iTry=%u hGuestMappings=%p (%s)\n",
196	RTR0MemObjAddress(pDevExt->hGuestMappings),
197	RTR0MemObjSize(pDevExt->hGuestMappings),
198	uAlignment, iTry, pDevExt->hGuestMappings, hFictive != NIL_RTR0PTR ? "fictive" : "reservation"));
199	break;
200	}
201	ahTries[iTry] = hObj;
202	}
203
204	/*
205	* Cleanup failed attempts.
206	*/
207	while (iTry-- > 0)
208	RTR0MemObjFree(ahTries[iTry], false /* fFreeMappings */);
209	if ( RT_FAILURE(rc)
210	&& hFictive != NIL_RTR0PTR)
211	RTR0MemObjFree(hFictive, false /* fFreeMappings */);
212	if (RT_FAILURE(rc) && !fBitched)
213	LogRel(("VBoxGuest: Warning: failed to reserve %#d of memory for guest mappings.\n", cbHypervisor));
214	}
215	VbglGRFree(&pReq->header);
216
217	/*
218	* We ignore failed attempts for now.
219	*/
220	return VINF_SUCCESS;
221	}
222
223
224	/**
225	* Undo what vboxGuestInitFixateGuestMappings did.
226	*
227	* @param pDevExt The device extension.
228	*/
229	static void vboxGuestTermUnfixGuestMappings(PVBOXGUESTDEVEXT pDevExt)
230	{
231	if (pDevExt->hGuestMappings != NIL_RTR0PTR)
232	{
233	/*
234	* Tell the host that we're going to free the memory we reserved for
235	* it, the free it up. (Leak the memory if anything goes wrong here.)
236	*/
237	VMMDevReqHypervisorInfo *pReq;
238	int rc = VbglGRAlloc((VMMDevRequestHeader **)&pReq, sizeof(VMMDevReqHypervisorInfo), VMMDevReq_SetHypervisorInfo);
239	if (RT_SUCCESS(rc))
240	{
241	pReq->hypervisorStart = 0;
242	pReq->hypervisorSize = 0;
243	rc = VbglGRPerform(&pReq->header);
244	VbglGRFree(&pReq->header);
245	}
246	if (RT_SUCCESS(rc))
247	{
248	rc = RTR0MemObjFree(pDevExt->hGuestMappings, true /* fFreeMappings */);
249	AssertRC(rc);
250	}
251	else
252	LogRel(("vboxGuestTermUnfixGuestMappings: Failed to unfix the guest mappings! rc=%Rrc\n", rc));
253
254	pDevExt->hGuestMappings = NIL_RTR0MEMOBJ;
255	}
256	}
257
258
259	/**
260	* Sets the interrupt filter mask during initialization and termination.
261	*
262	* This will ASSUME that we're the ones in carge over the mask, so
263	* we'll simply clear all bits we don't set.
264	*
265	* @returns VBox status code (ignored).
266	* @param pDevExt The device extension.
267	* @param fMask The new mask.
268	*/
269	static int vboxGuestSetFilterMask(PVBOXGUESTDEVEXT pDevExt, uint32_t fMask)
270	{
271	VMMDevCtlGuestFilterMask *pReq;
272	int rc = VbglGRAlloc((VMMDevRequestHeader *)&pReq, sizeof(pReq), VMMDevReq_CtlGuestFilterMask);
273	if (RT_SUCCESS(rc))
274	{
275	pReq->u32OrMask = fMask;
276	pReq->u32NotMask = ~fMask;
277	rc = VbglGRPerform(&pReq->header);
278	if (RT_FAILURE(rc))
279	LogRel(("vboxGuestSetFilterMask: failed with rc=%Rrc\n", rc));
280	VbglGRFree(&pReq->header);
281	}
282	return rc;
283	}
284
285
286	/**
287	* Inflate the balloon by one chunk represented by an R0 memory object.
288	*
289	* The caller owns the balloon mutex.
290	*
291	* @returns IPRT status code.
292	* @param pMemObj Pointer to the R0 memory object.
293	* @param pReq The pre-allocated request for performing the VMMDev call.
294	*/
295	static int vboxGuestBalloonInflate(PRTR0MEMOBJ pMemObj, VMMDevChangeMemBalloon *pReq)
296	{
297	uint32_t iPage;
298	int rc;
299
300	for (iPage = 0; iPage < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; iPage++)
301	{
302	RTHCPHYS phys = RTR0MemObjGetPagePhysAddr(*pMemObj, iPage);
303	pReq->aPhysPage[iPage] = phys;
304	}
305
306	pReq->fInflate = true;
307	pReq->header.size = cbChangeMemBalloonReq;
308	pReq->cPages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
309
310	rc = VbglGRPerform(&pReq->header);
311	if (RT_FAILURE(rc))
312	LogRel(("vboxGuestBalloonInflate: VbglGRPerform failed. rc=%Rrc\n", rc));
313	return rc;
314	}
315
316
317	/**
318	* Deflate the balloon by one chunk - info the host and free the memory object.
319	*
320	* The caller owns the balloon mutex.
321	*
322	* @returns IPRT status code.
323	* @param pMemObj Pointer to the R0 memory object.
324	* The memory object will be freed afterwards.
325	* @param pReq The pre-allocated request for performing the VMMDev call.
326	*/
327	static int vboxGuestBalloonDeflate(PRTR0MEMOBJ pMemObj, VMMDevChangeMemBalloon *pReq)
328	{
329	uint32_t iPage;
330	int rc;
331
332	for (iPage = 0; iPage < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; iPage++)
333	{
334	RTHCPHYS phys = RTR0MemObjGetPagePhysAddr(*pMemObj, iPage);
335	pReq->aPhysPage[iPage] = phys;
336	}
337
338	pReq->fInflate = false;
339	pReq->header.size = cbChangeMemBalloonReq;
340	pReq->cPages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
341
342	rc = VbglGRPerform(&pReq->header);
343	if (RT_FAILURE(rc))
344	{
345	LogRel(("vboxGuestBalloonDeflate: VbglGRPerform failed. rc=%Rrc\n", rc));
346	return rc;
347	}
348
349	rc = RTR0MemObjFree(*pMemObj, true);
350	if (RT_FAILURE(rc))
351	{
352	LogRel(("vboxGuestBalloonDeflate: RTR0MemObjFree(%p,true) -> %Rrc; this is BAD!\n", *pMemObj, rc));
353	return rc;
354	}
355
356	*pMemObj = NIL_RTR0MEMOBJ;
357	return VINF_SUCCESS;
358	}
359
360
361	/**
362	* Inflate/deflate the memory balloon and notify the host.
363	*
364	* This is a worker used by VBoxGuestCommonIOCtl_CheckMemoryBalloon - it takes
365	* the mutex.
366	*
367	* @returns VBox status code.
368	* @param pDevExt The device extension.
369	* @param pSession The session.
370	* @param cBalloonChunks The new size of the balloon in chunks of 1MB.
371	* @param pfHandleInR3 Where to return the handle-in-ring3 indicator
372	* (VINF_SUCCESS if set).
373	*/
374	static int vboxGuestSetBalloonSizeKernel(PVBOXGUESTDEVEXT pDevExt, uint32_t cBalloonChunks, uint32_t *pfHandleInR3)
375	{
376	int rc = VINF_SUCCESS;
377
378	if (pDevExt->MemBalloon.fUseKernelAPI)
379	{
380	VMMDevChangeMemBalloon *pReq;
381	uint32_t i;
382
383	if (cBalloonChunks > pDevExt->MemBalloon.cMaxChunks)
384	{
385	LogRel(("vboxGuestSetBalloonSizeKernel: illegal balloon size %u (max=%u)\n",
386	cBalloonChunks, pDevExt->MemBalloon.cMaxChunks));
387	return VERR_INVALID_PARAMETER;
388	}
389
390	if (cBalloonChunks == pDevExt->MemBalloon.cMaxChunks)
391	return VINF_SUCCESS; /* nothing to do */
392
393	if ( cBalloonChunks > pDevExt->MemBalloon.cChunks
394	&& !pDevExt->MemBalloon.paMemObj)
395	{
396	pDevExt->MemBalloon.paMemObj = (PRTR0MEMOBJ)RTMemAllocZ(sizeof(RTR0MEMOBJ) * pDevExt->MemBalloon.cMaxChunks);
397	if (!pDevExt->MemBalloon.paMemObj)
398	{
399	LogRel(("VBoxGuestSetBalloonSizeKernel: no memory for paMemObj!\n"));
400	return VERR_NO_MEMORY;
401	}
402	}
403
404	rc = VbglGRAlloc((VMMDevRequestHeader **)&pReq, cbChangeMemBalloonReq, VMMDevReq_ChangeMemBalloon);
405	if (RT_FAILURE(rc))
406	return rc;
407
408	if (cBalloonChunks > pDevExt->MemBalloon.cChunks)
409	{
410	/* inflate */
411	for (i = pDevExt->MemBalloon.cChunks; i < cBalloonChunks; i++)
412	{
413	rc = RTR0MemObjAllocPhysNC(&pDevExt->MemBalloon.paMemObj[i],
414	VMMDEV_MEMORY_BALLOON_CHUNK_SIZE, NIL_RTHCPHYS);
415	if (RT_FAILURE(rc))
416	{
417	if (rc == VERR_NOT_SUPPORTED)
418	{
419	/* not supported -- fall back to the R3-allocated memory. */
420	rc = VINF_SUCCESS;
421	pDevExt->MemBalloon.fUseKernelAPI = false;
422	Assert(pDevExt->MemBalloon.cChunks == 0);
423	Log(("VBoxGuestSetBalloonSizeKernel: PhysNC allocs not supported, falling back to R3 allocs.\n"));
424	}
425	/* else if (rc == VERR_NO_MEMORY \|\| rc == VERR_NO_PHYS_MEMORY):
426	* cannot allocate more memory => don't try further, just stop here */
427	/* else: XXX what else can fail? VERR_MEMOBJ_INIT_FAILED for instance. just stop. */
428	break;
429	}
430
431	rc = vboxGuestBalloonInflate(&pDevExt->MemBalloon.paMemObj[i], pReq);
432	if (RT_FAILURE(rc))
433	{
434	Log(("vboxGuestSetBalloonSize(inflate): failed, rc=%Rrc!\n", rc));
435	RTR0MemObjFree(pDevExt->MemBalloon.paMemObj[i], true);
436	pDevExt->MemBalloon.paMemObj[i] = NIL_RTR0MEMOBJ;
437	break;
438	}
439	pDevExt->MemBalloon.cChunks++;
440	}
441	}
442	else
443	{
444	/* deflate */
445	for (i = pDevExt->MemBalloon.cChunks; i-- > cBalloonChunks;)
446	{
447	rc = vboxGuestBalloonDeflate(&pDevExt->MemBalloon.paMemObj[i], pReq);
448	if (RT_FAILURE(rc))
449	{
450	Log(("vboxGuestSetBalloonSize(deflate): failed, rc=%Rrc!\n", rc));
451	break;
452	}
453	pDevExt->MemBalloon.cChunks--;
454	}
455	}
456
457	VbglGRFree(&pReq->header);
458	}
459
460	/*
461	* Set the handle-in-ring3 indicator. When set Ring-3 will have to work
462	* the balloon changes via the other API.
463	*/
464	*pfHandleInR3 = pDevExt->MemBalloon.fUseKernelAPI ? false : true;
465
466	return rc;
467	}
468
469
470	/**
471	* Helper to reinit the VBoxVMM communication after hibernation.
472	*
473	* @returns VBox status code.
474	* @param pDevExt The device extension.
475	* @param enmOSType The OS type.
476	*/
477	int VBoxGuestReinitDevExtAfterHibernation(PVBOXGUESTDEVEXT pDevExt, VBOXOSTYPE enmOSType)
478	{
479	int rc = VBoxGuestReportGuestInfo(enmOSType);
480	if (RT_SUCCESS(rc))
481	{
482	rc = VBoxGuestReportDriverStatus(true /* Driver is active */);
483	if (RT_FAILURE(rc))
484	Log(("VBoxGuest::VBoxGuestReinitDevExtAfterHibernation: could not report guest driver status, rc=%Rrc\n", rc));
485	}
486	else
487	Log(("VBoxGuest::VBoxGuestReinitDevExtAfterHibernation: could not report guest information to host, rc=%Rrc\n", rc));
488	Log(("VBoxGuest::VBoxGuestReinitDevExtAfterHibernation: returned with rc=%Rrc\n", rc));
489	return rc;
490	}
491
492
493	/**
494	* Inflate/deflate the balloon by one chunk.
495	*
496	* Worker for VBoxGuestCommonIOCtl_ChangeMemoryBalloon - it takes the mutex.
497	*
498	* @returns VBox status code.
499	* @param pDevExt The device extension.
500	* @param pSession The session.
501	* @param u64ChunkAddr The address of the chunk to add to / remove from the
502	* balloon.
503	* @param fInflate Inflate if true, deflate if false.
504	*/
505	static int vboxGuestSetBalloonSizeFromUser(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
506	uint64_t u64ChunkAddr, bool fInflate)
507	{
508	VMMDevChangeMemBalloon *pReq;
509	int rc = VINF_SUCCESS;
510	uint32_t i;
511	PRTR0MEMOBJ pMemObj = NULL;
512
513	if (fInflate)
514	{
515	if ( pDevExt->MemBalloon.cChunks > pDevExt->MemBalloon.cMaxChunks - 1
516	\|\| pDevExt->MemBalloon.cMaxChunks == 0 /* If called without first querying. */)
517	{
518	LogRel(("vboxGuestSetBalloonSize: cannot inflate balloon, already have %u chunks (max=%u)\n",
519	pDevExt->MemBalloon.cChunks, pDevExt->MemBalloon.cMaxChunks));
520	return VERR_INVALID_PARAMETER;
521	}
522
523	if (!pDevExt->MemBalloon.paMemObj)
524	{
525	pDevExt->MemBalloon.paMemObj = (PRTR0MEMOBJ)RTMemAlloc(sizeof(RTR0MEMOBJ) * pDevExt->MemBalloon.cMaxChunks);
526	if (!pDevExt->MemBalloon.paMemObj)
527	{
528	LogRel(("VBoxGuestSetBalloonSizeFromUser: no memory for paMemObj!\n"));
529	return VERR_NO_MEMORY;
530	}
531	for (i = 0; i < pDevExt->MemBalloon.cMaxChunks; i++)
532	pDevExt->MemBalloon.paMemObj[i] = NIL_RTR0MEMOBJ;
533	}
534	}
535	else
536	{
537	if (pDevExt->MemBalloon.cChunks == 0)
538	{
539	AssertMsgFailed(("vboxGuestSetBalloonSize: cannot decrease balloon, already at size 0\n"));
540	return VERR_INVALID_PARAMETER;
541	}
542	}
543
544	/*
545	* Enumerate all memory objects and check if the object is already registered.
546	*/
547	for (i = 0; i < pDevExt->MemBalloon.cMaxChunks; i++)
548	{
549	if ( fInflate
550	&& !pMemObj
551	&& pDevExt->MemBalloon.paMemObj[i] == NIL_RTR0MEMOBJ)
552	pMemObj = &pDevExt->MemBalloon.paMemObj[i]; /* found free object pointer */
553	if (RTR0MemObjAddressR3(pDevExt->MemBalloon.paMemObj[i]) == u64ChunkAddr)
554	{
555	if (fInflate)
556	return VERR_ALREADY_EXISTS; /* don't provide the same memory twice */
557	pMemObj = &pDevExt->MemBalloon.paMemObj[i];
558	break;
559	}
560	}
561	if (!pMemObj)
562	{
563	if (fInflate)
564	{
565	/* no free object pointer found -- should not happen */
566	return VERR_NO_MEMORY;
567	}
568
569	/* cannot free this memory as it wasn't provided before */
570	return VERR_NOT_FOUND;
571	}
572
573	/*
574	* Try inflate / default the balloon as requested.
575	*/
576	rc = VbglGRAlloc((VMMDevRequestHeader **)&pReq, cbChangeMemBalloonReq, VMMDevReq_ChangeMemBalloon);
577	if (RT_FAILURE(rc))
578	return rc;
579
580	if (fInflate)
581	{
582	rc = RTR0MemObjLockUser(pMemObj, u64ChunkAddr, VMMDEV_MEMORY_BALLOON_CHUNK_SIZE,
583	RTMEM_PROT_READ \| RTMEM_PROT_WRITE, NIL_RTR0PROCESS);
584	if (RT_SUCCESS(rc))
585	{
586	rc = vboxGuestBalloonInflate(pMemObj, pReq);
587	if (RT_SUCCESS(rc))
588	pDevExt->MemBalloon.cChunks++;
589	else
590	{
591	Log(("vboxGuestSetBalloonSize(inflate): failed, rc=%Rrc!\n", rc));
592	RTR0MemObjFree(*pMemObj, true);
593	*pMemObj = NIL_RTR0MEMOBJ;
594	}
595	}
596	}
597	else
598	{
599	rc = vboxGuestBalloonDeflate(pMemObj, pReq);
600	if (RT_SUCCESS(rc))
601	pDevExt->MemBalloon.cChunks--;
602	else
603	Log(("vboxGuestSetBalloonSize(deflate): failed, rc=%Rrc!\n", rc));
604	}
605
606	VbglGRFree(&pReq->header);
607	return rc;
608	}
609
610
611	/**
612	* Cleanup the memory balloon of a session.
613	*
614	* Will request the balloon mutex, so it must be valid and the caller must not
615	* own it already.
616	*
617	* @param pDevExt The device extension.
618	* @param pDevExt The session. Can be NULL at unload.
619	*/
620	static void vboxGuestCloseMemBalloon(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
621	{
622	RTSemFastMutexRequest(pDevExt->MemBalloon.hMtx);
623	if ( pDevExt->MemBalloon.pOwner == pSession
624	\|\| pSession == NULL /unload/)
625	{
626	if (pDevExt->MemBalloon.paMemObj)
627	{
628	VMMDevChangeMemBalloon *pReq;
629	int rc = VbglGRAlloc((VMMDevRequestHeader **)&pReq, cbChangeMemBalloonReq, VMMDevReq_ChangeMemBalloon);
630	if (RT_SUCCESS(rc))
631	{
632	uint32_t i;
633	for (i = pDevExt->MemBalloon.cChunks; i-- > 0;)
634	{
635	rc = vboxGuestBalloonDeflate(&pDevExt->MemBalloon.paMemObj[i], pReq);
636	if (RT_FAILURE(rc))
637	{
638	LogRel(("vboxGuestCloseMemBalloon: Deflate failed with rc=%Rrc. Will leak %u chunks.\n",
639	rc, pDevExt->MemBalloon.cChunks));
640	break;
641	}
642	pDevExt->MemBalloon.paMemObj[i] = NIL_RTR0MEMOBJ;
643	pDevExt->MemBalloon.cChunks--;
644	}
645	VbglGRFree(&pReq->header);
646	}
647	else
648	LogRel(("vboxGuestCloseMemBalloon: Failed to allocate VMMDev request buffer (rc=%Rrc). Will leak %u chunks.\n",
649	rc, pDevExt->MemBalloon.cChunks));
650	RTMemFree(pDevExt->MemBalloon.paMemObj);
651	pDevExt->MemBalloon.paMemObj = NULL;
652	}
653
654	pDevExt->MemBalloon.pOwner = NULL;
655	}
656	RTSemFastMutexRelease(pDevExt->MemBalloon.hMtx);
657	}
658
659
660	/**
661	* Initializes the VBoxGuest device extension when the
662	* device driver is loaded.
663	*
664	* The native code locates the VMMDev on the PCI bus and retrieve
665	* the MMIO and I/O port ranges, this function will take care of
666	* mapping the MMIO memory (if present). Upon successful return
667	* the native code should set up the interrupt handler.
668	*
669	* @returns VBox status code.
670	*
671	* @param pDevExt The device extension. Allocated by the native code.
672	* @param IOPortBase The base of the I/O port range.
673	* @param pvMMIOBase The base of the MMIO memory mapping.
674	* This is optional, pass NULL if not present.
675	* @param cbMMIO The size of the MMIO memory mapping.
676	* This is optional, pass 0 if not present.
677	* @param enmOSType The guest OS type to report to the VMMDev.
678	* @param fFixedEvents Events that will be enabled upon init and no client
679	* will ever be allowed to mask.
680	*/
681	int VBoxGuestInitDevExt(PVBOXGUESTDEVEXT pDevExt, uint16_t IOPortBase,
682	void *pvMMIOBase, uint32_t cbMMIO, VBOXOSTYPE enmOSType, uint32_t fFixedEvents)
683	{
684	int rc, rc2;
685
686	/*
687	* Adjust fFixedEvents.
688	*/
689	#ifdef VBOX_WITH_HGCM
690	fFixedEvents \|= VMMDEV_EVENT_HGCM;
691	#endif
692
693	/*
694	* Initialize the data.
695	*/
696	pDevExt->IOPortBase = IOPortBase;
697	pDevExt->pVMMDevMemory = NULL;
698	pDevExt->fFixedEvents = fFixedEvents;
699	pDevExt->hGuestMappings = NIL_RTR0MEMOBJ;
700	pDevExt->EventSpinlock = NIL_RTSPINLOCK;
701	pDevExt->pIrqAckEvents = NULL;
702	pDevExt->PhysIrqAckEvents = NIL_RTCCPHYS;
703	RTListInit(&pDevExt->WaitList);
704	#ifdef VBOX_WITH_HGCM
705	RTListInit(&pDevExt->HGCMWaitList);
706	#endif
707	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
708	RTListInit(&pDevExt->WakeUpList);
709	#endif
710	RTListInit(&pDevExt->WokenUpList);
711	RTListInit(&pDevExt->FreeList);
712	#ifdef
713	#ifdef VBOX_WITH_VRDP_SESSION_HANDLING
714	pDevExt->fVRDPEnabled = false;
715	#endif
716	pDevExt->f32PendingEvents = 0;
717	pDevExt->u32MousePosChangedSeq = 0;
718	pDevExt->SessionSpinlock = NIL_RTSPINLOCK;
719	pDevExt->MemBalloon.hMtx = NIL_RTSEMFASTMUTEX;
720	pDevExt->MemBalloon.cChunks = 0;
721	pDevExt->MemBalloon.cMaxChunks = 0;
722	pDevExt->MemBalloon.fUseKernelAPI = true;
723	pDevExt->MemBalloon.paMemObj = NULL;
724	pDevExt->MemBalloon.pOwner = NULL;
725
726	/*
727	* If there is an MMIO region validate the version and size.
728	*/
729	if (pvMMIOBase)
730	{
731	VMMDevMemory pVMMDev = (VMMDevMemory )pvMMIOBase;
732	Assert(cbMMIO);
733	if ( pVMMDev->u32Version == VMMDEV_MEMORY_VERSION
734	&& pVMMDev->u32Size >= 32
735	&& pVMMDev->u32Size <= cbMMIO)
736	{
737	pDevExt->pVMMDevMemory = pVMMDev;
738	Log(("VBoxGuestInitDevExt: VMMDevMemory: mapping=%p size=%#RX32 (%#RX32) version=%#RX32\n",
739	pVMMDev, pVMMDev->u32Size, cbMMIO, pVMMDev->u32Version));
740	}
741	else /* try live without it. */
742	LogRel(("VBoxGuestInitDevExt: Bogus VMMDev memory; u32Version=%RX32 (expected %RX32) u32Size=%RX32 (expected <= %RX32)\n",
743	pVMMDev->u32Version, VMMDEV_MEMORY_VERSION, pVMMDev->u32Size, cbMMIO));
744	}
745
746	/*
747	* Create the wait and session spinlocks as well as the ballooning mutex.
748	*/
749	rc = RTSpinlockCreate(&pDevExt->EventSpinlock);
750	if (RT_SUCCESS(rc))
751	rc = RTSpinlockCreate(&pDevExt->SessionSpinlock);
752	if (RT_FAILURE(rc))
753	{
754	LogRel(("VBoxGuestInitDevExt: failed to create spinlock, rc=%Rrc!\n", rc));
755	if (pDevExt->EventSpinlock != NIL_RTSPINLOCK)
756	RTSpinlockDestroy(pDevExt->EventSpinlock);
757	return rc;
758	}
759
760	rc = RTSemFastMutexCreate(&pDevExt->MemBalloon.hMtx);
761	if (RT_FAILURE(rc))
762	{
763	LogRel(("VBoxGuestInitDevExt: failed to create mutex, rc=%Rrc!\n", rc));
764	RTSpinlockDestroy(pDevExt->SessionSpinlock);
765	RTSpinlockDestroy(pDevExt->EventSpinlock);
766	return rc;
767	}
768
769	/*
770	* Initialize the guest library and report the guest info back to VMMDev,
771	* set the interrupt control filter mask, and fixate the guest mappings
772	* made by the VMM.
773	*/
774	rc = VbglInit(pDevExt->IOPortBase, (VMMDevMemory *)pDevExt->pVMMDevMemory);
775	if (RT_SUCCESS(rc))
776	{
777	rc = VbglGRAlloc((VMMDevRequestHeader **)&pDevExt->pIrqAckEvents, sizeof(VMMDevEvents), VMMDevReq_AcknowledgeEvents);
778	if (RT_SUCCESS(rc))
779	{
780	pDevExt->PhysIrqAckEvents = VbglPhysHeapGetPhysAddr(pDevExt->pIrqAckEvents);
781	Assert(pDevExt->PhysIrqAckEvents != 0);
782
783	rc = VBoxGuestReportGuestInfo(enmOSType);
784	if (RT_SUCCESS(rc))
785	{
786	rc = vboxGuestSetFilterMask(pDevExt, fFixedEvents);
787	if (RT_SUCCESS(rc))
788	{
789	/*
790	* Disable guest graphics capability by default. The guest specific
791	* graphics driver will re-enable this when it is necessary.
792	*/
793	rc = VBoxGuestSetGuestCapabilities(0, VMMDEV_GUEST_SUPPORTS_GRAPHICS);
794	if (RT_SUCCESS(rc))
795	{
796	vboxGuestInitFixateGuestMappings(pDevExt);
797
798	#ifdef DEBUG
799	testSetMouseStatus(); /* Other tests? */
800	#endif
801
802	rc = VBoxGuestReportDriverStatus(true /* Driver is active */);
803	if (RT_FAILURE(rc))
804	LogRel(("VBoxGuestInitDevExt: VBoxReportGuestDriverStatus failed, rc=%Rrc\n", rc));
805
806	Log(("VBoxGuestInitDevExt: returns success\n"));
807	return VINF_SUCCESS;
808	}
809
810	LogRel(("VBoxGuestInitDevExt: VBoxGuestSetGuestCapabilities failed, rc=%Rrc\n", rc));
811	}
812	else
813	LogRel(("VBoxGuestInitDevExt: vboxGuestSetFilterMask failed, rc=%Rrc\n", rc));
814	}
815	else
816	LogRel(("VBoxGuestInitDevExt: VBoxReportGuestInfo failed, rc=%Rrc\n", rc));
817	VbglGRFree((VMMDevRequestHeader *)pDevExt->pIrqAckEvents);
818	}
819	else
820	LogRel(("VBoxGuestInitDevExt: VBoxGRAlloc failed, rc=%Rrc\n", rc));
821
822	VbglTerminate();
823	}
824	else
825	LogRel(("VBoxGuestInitDevExt: VbglInit failed, rc=%Rrc\n", rc));
826
827	rc2 = RTSemFastMutexDestroy(pDevExt->MemBalloon.hMtx); AssertRC(rc2);
828	rc2 = RTSpinlockDestroy(pDevExt->EventSpinlock); AssertRC(rc2);
829	rc2 = RTSpinlockDestroy(pDevExt->SessionSpinlock); AssertRC(rc2);
830	return rc; /* (failed) */
831	}
832
833
834	/**
835	* Deletes all the items in a wait chain.
836	* @param pList The head of the chain.
837	*/
838	static void VBoxGuestDeleteWaitList(PRTLISTNODE pList)
839	{
840	while (!RTListIsEmpty(pList))
841	{
842	int rc2;
843	PVBOXGUESTWAIT pWait = RTListGetFirst(pList, VBOXGUESTWAIT, ListNode);
844	RTListNodeRemove(&pWait->ListNode);
845
846	rc2 = RTSemEventMultiDestroy(pWait->Event); AssertRC(rc2);
847	pWait->Event = NIL_RTSEMEVENTMULTI;
848	pWait->pSession = NULL;
849	RTMemFree(pWait);
850	}
851	}
852
853
854	/**
855	* Destroys the VBoxGuest device extension.
856	*
857	* The native code should call this before the driver is loaded,
858	* but don't call this on shutdown.
859	*
860	* @param pDevExt The device extension.
861	*/
862	void VBoxGuestDeleteDevExt(PVBOXGUESTDEVEXT pDevExt)
863	{
864	int rc2;
865	Log(("VBoxGuestDeleteDevExt:\n"));
866	Log(("VBoxGuest: The additions driver is terminating.\n"));
867
868	/*
869	* Clean up the bits that involves the host first.
870	*/
871	vboxGuestTermUnfixGuestMappings(pDevExt);
872	VBoxGuestSetGuestCapabilities(0, UINT32_MAX); /* clears all capabilities */
873	vboxGuestSetFilterMask(pDevExt, 0); /* filter all events */
874	vboxGuestCloseMemBalloon(pDevExt, (PVBOXGUESTSESSION)NULL);
875
876	/*
877	* Cleanup all the other resources.
878	*/
879	rc2 = RTSpinlockDestroy(pDevExt->EventSpinlock); AssertRC(rc2);
880	rc2 = RTSpinlockDestroy(pDevExt->SessionSpinlock); AssertRC(rc2);
881	rc2 = RTSemFastMutexDestroy(pDevExt->MemBalloon.hMtx); AssertRC(rc2);
882
883	VBoxGuestDeleteWaitList(&pDevExt->WaitList);
884	#ifdef VBOX_WITH_HGCM
885	VBoxGuestDeleteWaitList(&pDevExt->HGCMWaitList);
886	#endif
887	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
888	VBoxGuestDeleteWaitList(&pDevExt->WakeUpList);
889	#endif
890	VBoxGuestDeleteWaitList(&pDevExt->WokenUpList);
891	VBoxGuestDeleteWaitList(&pDevExt->FreeList);
892
893	VbglTerminate();
894
895	pDevExt->pVMMDevMemory = NULL;
896
897	pDevExt->IOPortBase = 0;
898	pDevExt->pIrqAckEvents = NULL;
899	}
900
901
902	/**
903	* Creates a VBoxGuest user session.
904	*
905	* The native code calls this when a ring-3 client opens the device.
906	* Use VBoxGuestCreateKernelSession when a ring-0 client connects.
907	*
908	* @returns VBox status code.
909	* @param pDevExt The device extension.
910	* @param ppSession Where to store the session on success.
911	*/
912	int VBoxGuestCreateUserSession(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION *ppSession)
913	{
914	PVBOXGUESTSESSION pSession = (PVBOXGUESTSESSION)RTMemAllocZ(sizeof(*pSession));
915	if (RT_UNLIKELY(!pSession))
916	{
917	LogRel(("VBoxGuestCreateUserSession: no memory!\n"));
918	return VERR_NO_MEMORY;
919	}
920
921	pSession->Process = RTProcSelf();
922	pSession->R0Process = RTR0ProcHandleSelf();
923	pSession->pDevExt = pDevExt;
924
925	*ppSession = pSession;
926	LogFlow(("VBoxGuestCreateUserSession: pSession=%p proc=%RTproc (%d) r0proc=%p\n",
927	pSession, pSession->Process, (int)pSession->Process, (uintptr_t)pSession->R0Process)); /** @todo %RTr0proc */
928	return VINF_SUCCESS;
929	}
930
931
932	/**
933	* Creates a VBoxGuest kernel session.
934	*
935	* The native code calls this when a ring-0 client connects to the device.
936	* Use VBoxGuestCreateUserSession when a ring-3 client opens the device.
937	*
938	* @returns VBox status code.
939	* @param pDevExt The device extension.
940	* @param ppSession Where to store the session on success.
941	*/
942	int VBoxGuestCreateKernelSession(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION *ppSession)
943	{
944	PVBOXGUESTSESSION pSession = (PVBOXGUESTSESSION)RTMemAllocZ(sizeof(*pSession));
945	if (RT_UNLIKELY(!pSession))
946	{
947	LogRel(("VBoxGuestCreateKernelSession: no memory!\n"));
948	return VERR_NO_MEMORY;
949	}
950
951	pSession->Process = NIL_RTPROCESS;
952	pSession->R0Process = NIL_RTR0PROCESS;
953	pSession->pDevExt = pDevExt;
954
955	*ppSession = pSession;
956	LogFlow(("VBoxGuestCreateKernelSession: pSession=%p proc=%RTproc (%d) r0proc=%p\n",
957	pSession, pSession->Process, (int)pSession->Process, (uintptr_t)pSession->R0Process)); /** @todo %RTr0proc */
958	return VINF_SUCCESS;
959	}
960
961
962
963	/**
964	* Closes a VBoxGuest session.
965	*
966	* @param pDevExt The device extension.
967	* @param pSession The session to close (and free).
968	*/
969	void VBoxGuestCloseSession(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
970	{
971	unsigned i; NOREF(i);
972	Log(("VBoxGuestCloseSession: pSession=%p proc=%RTproc (%d) r0proc=%p\n",
973	pSession, pSession->Process, (int)pSession->Process, (uintptr_t)pSession->R0Process)); /** @todo %RTr0proc */
974
975	#ifdef VBOX_WITH_HGCM
976	for (i = 0; i < RT_ELEMENTS(pSession->aHGCMClientIds); i++)
977	if (pSession->aHGCMClientIds[i])
978	{
979	VBoxGuestHGCMDisconnectInfo Info;
980	Info.result = 0;
981	Info.u32ClientID = pSession->aHGCMClientIds[i];
982	pSession->aHGCMClientIds[i] = 0;
983	Log(("VBoxGuestCloseSession: disconnecting client id %#RX32\n", Info.u32ClientID));
984	VbglR0HGCMInternalDisconnect(&Info, VBoxGuestHGCMAsyncWaitCallback, pDevExt, RT_INDEFINITE_WAIT);
985	}
986	#endif
987
988	pSession->pDevExt = NULL;
989	pSession->Process = NIL_RTPROCESS;
990	pSession->R0Process = NIL_RTR0PROCESS;
991	vboxGuestCloseMemBalloon(pDevExt, pSession);
992	/* Reset any mouse status flags which the session may have set. */
993	VBoxGuestCommonIOCtl_SetMouseStatus(pDevExt, pSession, 0);
994	RTMemFree(pSession);
995	}
996
997
998	/**
999	* Allocates a wait-for-event entry.
1000	*
1001	* @returns The wait-for-event entry.
1002	* @param pDevExt The device extension.
1003	* @param pSession The session that's allocating this. Can be NULL.
1004	*/
1005	static PVBOXGUESTWAIT VBoxGuestWaitAlloc(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
1006	{
1007	/*
1008	* Allocate it one way or the other.
1009	*/
1010	PVBOXGUESTWAIT pWait = RTListGetFirst(&pDevExt->FreeList, VBOXGUESTWAIT, ListNode);
1011	if (pWait)
1012	{
1013	RTSPINLOCKTMP Tmp = RTSPINLOCKTMP_INITIALIZER;
1014	RTSpinlockAcquireNoInts(pDevExt->EventSpinlock, &Tmp);
1015
1016	pWait = RTListGetFirst(&pDevExt->FreeList, VBOXGUESTWAIT, ListNode);
1017	if (pWait)
1018	RTListNodeRemove(&pWait->ListNode);
1019
1020	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, &Tmp);
1021	}
1022	if (!pWait)
1023	{
1024	static unsigned s_cErrors = 0;
1025	int rc;
1026
1027	pWait = (PVBOXGUESTWAIT)RTMemAlloc(sizeof(*pWait));
1028	if (!pWait)
1029	{
1030	if (s_cErrors++ < 32)
1031	LogRel(("VBoxGuestWaitAlloc: out-of-memory!\n"));
1032	return NULL;
1033	}
1034
1035	rc = RTSemEventMultiCreate(&pWait->Event);
1036	if (RT_FAILURE(rc))
1037	{
1038	if (s_cErrors++ < 32)
1039	LogRel(("VBoxGuestCommonIOCtl: RTSemEventMultiCreate failed with rc=%Rrc!\n", rc));
1040	RTMemFree(pWait);
1041	return NULL;
1042	}
1043
1044	pWait->ListNode.pNext = NULL;
1045	pWait->ListNode.pPrev = NULL;
1046	}
1047
1048	/*
1049	* Zero members just as an precaution.
1050	*/
1051	pWait->fReqEvents = 0;
1052	pWait->fResEvents = 0;
1053	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
1054	pWait->fPendingWakeUp = false;
1055	pWait->fFreeMe = false;
1056	#endif
1057	pWait->pSession = pSession;
1058	#ifdef VBOX_WITH_HGCM
1059	pWait->pHGCMReq = NULL;
1060	#endif
1061	RTSemEventMultiReset(pWait->Event);
1062	return pWait;
1063	}
1064
1065
1066	/**
1067	* Frees the wait-for-event entry.
1068	*
1069	* The caller must own the wait spinlock !
1070	* The entry must be in a list!
1071	*
1072	* @param pDevExt The device extension.
1073	* @param pWait The wait-for-event entry to free.
1074	*/
1075	static void VBoxGuestWaitFreeLocked(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTWAIT pWait)
1076	{
1077	pWait->fReqEvents = 0;
1078	pWait->fResEvents = 0;
1079	#ifdef VBOX_WITH_HGCM
1080	pWait->pHGCMReq = NULL;
1081	#endif
1082	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
1083	Assert(!pWait->fFreeMe);
1084	if (pWait->fPendingWakeUp)
1085	pWait->fFreeMe = true;
1086	else
1087	#endif
1088	{
1089	RTListNodeRemove(&pWait->ListNode);
1090	RTListAppend(&pDevExt->FreeList, &pWait->ListNode);
1091	}
1092	}
1093
1094
1095	/**
1096	* Frees the wait-for-event entry.
1097	*
1098	* @param pDevExt The device extension.
1099	* @param pWait The wait-for-event entry to free.
1100	*/
1101	static void VBoxGuestWaitFreeUnlocked(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTWAIT pWait)
1102	{
1103	RTSPINLOCKTMP Tmp = RTSPINLOCKTMP_INITIALIZER;
1104	RTSpinlockAcquireNoInts(pDevExt->EventSpinlock, &Tmp);
1105	VBoxGuestWaitFreeLocked(pDevExt, pWait);
1106	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, &Tmp);
1107	}
1108
1109
1110	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
1111	/**
1112	* Processes the wake-up list.
1113	*
1114	* All entries in the wake-up list gets signalled and moved to the woken-up
1115	* list.
1116	*
1117	* @param pDevExt The device extension.
1118	*/
1119	void VBoxGuestWaitDoWakeUps(PVBOXGUESTDEVEXT pDevExt)
1120	{
1121	if (!RTListIsEmpty(&pDevExt->WakeUpList))
1122	{
1123	RTSPINLOCKTMP Tmp = RTSPINLOCKTMP_INITIALIZER;
1124	RTSpinlockAcquireNoInts(pDevExt->EventSpinlock, &Tmp);
1125	for (;;)
1126	{
1127	int rc;
1128	PVBOXGUESTWAIT pWait = RTListGetFirst(&pDevExt->WakeUpList, VBOXGUESTWAIT, ListNode);
1129	if (!pWait)
1130	break;
1131	pWait->fPendingWakeUp = true;
1132	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, &Tmp);
1133
1134	rc = RTSemEventMultiSignal(pWait->Event);
1135	AssertRC(rc);
1136
1137	RTSpinlockAcquireNoInts(pDevExt->EventSpinlock, &Tmp);
1138	pWait->fPendingWakeUp = false;
1139	if (!pWait->fFreeMe)
1140	{
1141	RTListNodeRemove(&pWait->ListNode);
1142	RTListAppend(&pDevExt->WokenUpList, &pWait->ListNode);
1143	}
1144	else
1145	{
1146	pWait->fFreeMe = false;
1147	VBoxGuestWaitFreeLocked(pDevExt, pWait);
1148	}
1149	}
1150	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, &Tmp);
1151	}
1152	}
1153	#endif /* VBOXGUEST_USE_DEFERRED_WAKE_UP */
1154
1155
1156	/**
1157	* Modifies the guest capabilities.
1158	*
1159	* Should be called during driver init and termination.
1160	*
1161	* @returns VBox status code.
1162	* @param fOr The Or mask (what to enable).
1163	* @param fNot The Not mask (what to disable).
1164	*/
1165	int VBoxGuestSetGuestCapabilities(uint32_t fOr, uint32_t fNot)
1166	{
1167	VMMDevReqGuestCapabilities2 *pReq;
1168	int rc = VbglGRAlloc((VMMDevRequestHeader *)&pReq, sizeof(pReq), VMMDevReq_SetGuestCapabilities);
1169	if (RT_FAILURE(rc))
1170	{
1171	Log(("VBoxGuestSetGuestCapabilities: failed to allocate %u (%#x) bytes to cache the request. rc=%Rrc!!\n",
1172	sizeof(pReq), sizeof(pReq), rc));
1173	return rc;
1174	}
1175
1176	pReq->u32OrMask = fOr;
1177	pReq->u32NotMask = fNot;
1178
1179	rc = VbglGRPerform(&pReq->header);
1180	if (RT_FAILURE(rc))
1181	Log(("VBoxGuestSetGuestCapabilities: VbglGRPerform failed, rc=%Rrc!\n", rc));
1182
1183	VbglGRFree(&pReq->header);
1184	return rc;
1185	}
1186
1187
1188	/**
1189	* Implements the fast (no input or output) type of IOCtls.
1190	*
1191	* This is currently just a placeholder stub inherited from the support driver code.
1192	*
1193	* @returns VBox status code.
1194	* @param iFunction The IOCtl function number.
1195	* @param pDevExt The device extension.
1196	* @param pSession The session.
1197	*/
1198	int VBoxGuestCommonIOCtlFast(unsigned iFunction, PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
1199	{
1200	Log(("VBoxGuestCommonIOCtlFast: iFunction=%#x pDevExt=%p pSession=%p\n", iFunction, pDevExt, pSession));
1201
1202	NOREF(iFunction);
1203	NOREF(pDevExt);
1204	NOREF(pSession);
1205	return VERR_NOT_SUPPORTED;
1206	}
1207
1208
1209	/**
1210	* Return the VMM device port.
1211	*
1212	* returns IPRT status code.
1213	* @param pDevExt The device extension.
1214	* @param pInfo The request info.
1215	* @param pcbDataReturned (out) contains the number of bytes to return.
1216	*/
1217	static int VBoxGuestCommonIOCtl_GetVMMDevPort(PVBOXGUESTDEVEXT pDevExt, VBoxGuestPortInfo pInfo, size_t pcbDataReturned)
1218	{
1219	Log(("VBoxGuestCommonIOCtl: GETVMMDEVPORT\n"));
1220	pInfo->portAddress = pDevExt->IOPortBase;
1221	pInfo->pVMMDevMemory = (VMMDevMemory *)pDevExt->pVMMDevMemory;
1222	if (pcbDataReturned)
1223	pcbDataReturned = sizeof(pInfo);
1224	return VINF_SUCCESS;
1225	}
1226
1227
1228	/**
1229	* Worker VBoxGuestCommonIOCtl_WaitEvent.
1230	*
1231	* The caller enters the spinlock, we leave it.
1232	*
1233	* @returns VINF_SUCCESS if we've left the spinlock and can return immediately.
1234	*/
1235	DECLINLINE(int) WaitEventCheckCondition(PVBOXGUESTDEVEXT pDevExt, VBoxGuestWaitEventInfo *pInfo,
1236	int iEvent, const uint32_t fReqEvents, PRTSPINLOCKTMP pTmp)
1237	{
1238	uint32_t fMatches = pDevExt->f32PendingEvents & fReqEvents;
1239	if (fMatches)
1240	{
1241	ASMAtomicAndU32(&pDevExt->f32PendingEvents, ~fMatches);
1242	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, pTmp);
1243
1244	pInfo->u32EventFlagsOut = fMatches;
1245	pInfo->u32Result = VBOXGUEST_WAITEVENT_OK;
1246	if (fReqEvents & ~((uint32_t)1 << iEvent))
1247	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns %#x\n", pInfo->u32EventFlagsOut));
1248	else
1249	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns %#x/%d\n", pInfo->u32EventFlagsOut, iEvent));
1250	return VINF_SUCCESS;
1251	}
1252	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, pTmp);
1253	return VERR_TIMEOUT;
1254	}
1255
1256
1257	static int VBoxGuestCommonIOCtl_WaitEvent(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
1258	VBoxGuestWaitEventInfo pInfo, size_t pcbDataReturned, bool fInterruptible)
1259	{
1260	RTSPINLOCKTMP Tmp = RTSPINLOCKTMP_INITIALIZER;
1261	const uint32_t fReqEvents = pInfo->u32EventMaskIn;
1262	uint32_t fResEvents;
1263	int iEvent;
1264	PVBOXGUESTWAIT pWait;
1265	int rc;
1266
1267	pInfo->u32EventFlagsOut = 0;
1268	pInfo->u32Result = VBOXGUEST_WAITEVENT_ERROR;
1269	if (pcbDataReturned)
1270	pcbDataReturned = sizeof(pInfo);
1271
1272	/*
1273	* Copy and verify the input mask.
1274	*/
1275	iEvent = ASMBitFirstSetU32(fReqEvents) - 1;
1276	if (RT_UNLIKELY(iEvent < 0))
1277	{
1278	Log(("VBoxGuestCommonIOCtl: WAITEVENT: Invalid input mask %#x!!\n", fReqEvents));
1279	return VERR_INVALID_PARAMETER;
1280	}
1281
1282	/*
1283	* Check the condition up front, before doing the wait-for-event allocations.
1284	*/
1285	RTSpinlockAcquireNoInts(pDevExt->EventSpinlock, &Tmp);
1286	rc = WaitEventCheckCondition(pDevExt, pInfo, iEvent, fReqEvents, &Tmp);
1287	if (rc == VINF_SUCCESS)
1288	return rc;
1289
1290	if (!pInfo->u32TimeoutIn)
1291	{
1292	pInfo->u32Result = VBOXGUEST_WAITEVENT_TIMEOUT;
1293	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns VERR_TIMEOUT\n"));
1294	return VERR_TIMEOUT;
1295	}
1296
1297	pWait = VBoxGuestWaitAlloc(pDevExt, pSession);
1298	if (!pWait)
1299	return VERR_NO_MEMORY;
1300	pWait->fReqEvents = fReqEvents;
1301
1302	/*
1303	* We've got the wait entry now, re-enter the spinlock and check for the condition.
1304	* If the wait condition is met, return.
1305	* Otherwise enter into the list and go to sleep waiting for the ISR to signal us.
1306	*/
1307	RTSpinlockAcquireNoInts(pDevExt->EventSpinlock, &Tmp);
1308	RTListAppend(&pDevExt->WaitList, &pWait->ListNode);
1309	rc = WaitEventCheckCondition(pDevExt, pInfo, iEvent, fReqEvents, &Tmp);
1310	if (rc == VINF_SUCCESS)
1311	{
1312	VBoxGuestWaitFreeUnlocked(pDevExt, pWait);
1313	return rc;
1314	}
1315
1316	if (fInterruptible)
1317	rc = RTSemEventMultiWaitNoResume(pWait->Event,
1318	pInfo->u32TimeoutIn == UINT32_MAX ? RT_INDEFINITE_WAIT : pInfo->u32TimeoutIn);
1319	else
1320	rc = RTSemEventMultiWait(pWait->Event,
1321	pInfo->u32TimeoutIn == UINT32_MAX ? RT_INDEFINITE_WAIT : pInfo->u32TimeoutIn);
1322
1323	/*
1324	* There is one special case here and that's when the semaphore is
1325	* destroyed upon device driver unload. This shouldn't happen of course,
1326	* but in case it does, just get out of here ASAP.
1327	*/
1328	if (rc == VERR_SEM_DESTROYED)
1329	return rc;
1330
1331	/*
1332	* Unlink the wait item and dispose of it.
1333	*/
1334	RTSpinlockAcquireNoInts(pDevExt->EventSpinlock, &Tmp);
1335	fResEvents = pWait->fResEvents;
1336	VBoxGuestWaitFreeLocked(pDevExt, pWait);
1337	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, &Tmp);
1338
1339	/*
1340	* Now deal with the return code.
1341	*/
1342	if ( fResEvents
1343	&& fResEvents != UINT32_MAX)
1344	{
1345	pInfo->u32EventFlagsOut = fResEvents;
1346	pInfo->u32Result = VBOXGUEST_WAITEVENT_OK;
1347	if (fReqEvents & ~((uint32_t)1 << iEvent))
1348	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns %#x\n", pInfo->u32EventFlagsOut));
1349	else
1350	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns %#x/%d\n", pInfo->u32EventFlagsOut, iEvent));
1351	rc = VINF_SUCCESS;
1352	}
1353	else if ( fResEvents == UINT32_MAX
1354	\|\| rc == VERR_INTERRUPTED)
1355	{
1356	pInfo->u32Result = VBOXGUEST_WAITEVENT_INTERRUPTED;
1357	rc = VERR_INTERRUPTED;
1358	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns VERR_INTERRUPTED\n"));
1359	}
1360	else if (rc == VERR_TIMEOUT)
1361	{
1362	pInfo->u32Result = VBOXGUEST_WAITEVENT_TIMEOUT;
1363	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns VERR_TIMEOUT (2)\n"));
1364	}
1365	else
1366	{
1367	if (RT_SUCCESS(rc))
1368	{
1369	static unsigned s_cErrors = 0;
1370	if (s_cErrors++ < 32)
1371	LogRel(("VBoxGuestCommonIOCtl: WAITEVENT: returns %Rrc but no events!\n", rc));
1372	rc = VERR_INTERNAL_ERROR;
1373	}
1374	pInfo->u32Result = VBOXGUEST_WAITEVENT_ERROR;
1375	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns %Rrc\n", rc));
1376	}
1377
1378	return rc;
1379	}
1380
1381
1382	static int VBoxGuestCommonIOCtl_CancelAllWaitEvents(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
1383	{
1384	RTSPINLOCKTMP Tmp = RTSPINLOCKTMP_INITIALIZER;
1385	PVBOXGUESTWAIT pWait;
1386	PVBOXGUESTWAIT pSafe;
1387	int rc = 0;
1388
1389	Log(("VBoxGuestCommonIOCtl: CANCEL_ALL_WAITEVENTS\n"));
1390
1391	/*
1392	* Walk the event list and wake up anyone with a matching session.
1393	*/
1394	RTSpinlockAcquireNoInts(pDevExt->EventSpinlock, &Tmp);
1395	RTListForEachSafe(&pDevExt->WaitList, pWait, pSafe, VBOXGUESTWAIT, ListNode)
1396	{
1397	if (pWait->pSession == pSession)
1398	{
1399	pWait->fResEvents = UINT32_MAX;
1400	RTListNodeRemove(&pWait->ListNode);
1401	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
1402	RTListAppend(&pDevExt->WakeUpList, &pWait->ListNode);
1403	#else
1404	rc \|= RTSemEventMultiSignal(pWait->Event);
1405	RTListAppend(&pDevExt->WokenUpList, &pWait->ListNode);
1406	#endif
1407	}
1408	}
1409	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, &Tmp);
1410	Assert(rc == 0);
1411
1412	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
1413	VBoxGuestWaitDoWakeUps(pDevExt);
1414	#endif
1415
1416	return VINF_SUCCESS;
1417	}
1418
1419	/**
1420	* Checks if the VMM request is allowed in the context of the given session.
1421	*
1422	* @returns VINF_SUCCESS or VERR_PERMISSION_DENIED.
1423	* @param pSession The calling session.
1424	* @param enmType The request type.
1425	* @param pReqHdr The request.
1426	*/
1427	static int VBoxGuestCheckIfVMMReqAllowed(PVBOXGUESTSESSION pSession, VMMDevRequestType enmType,
1428	VMMDevRequestHeader const *pReqHdr)
1429	{
1430	/*
1431	* Categorize the request being made.
1432	*/
1433	/** @todo This need quite some more work! */
1434	enum
1435	{
1436	kLevel_Invalid, kLevel_NoOne, kLevel_OnlyVBoxGuest, kLevel_OnlyKernel, kLevel_TrustedUsers, kLevel_AllUsers
1437	} enmRequired;
1438	switch (enmType)
1439	{
1440	/*
1441	* Deny access to anything we don't know or provide specialized I/O controls for.
1442	*/
1443	#ifdef VBOX_WITH_HGCM
1444	case VMMDevReq_HGCMConnect:
1445	case VMMDevReq_HGCMDisconnect:
1446	# ifdef VBOX_WITH_64_BITS_GUESTS
1447	case VMMDevReq_HGCMCall32:
1448	case VMMDevReq_HGCMCall64:
1449	# else
1450	case VMMDevReq_HGCMCall:
1451	# endif /* VBOX_WITH_64_BITS_GUESTS */
1452	case VMMDevReq_HGCMCancel:
1453	case VMMDevReq_HGCMCancel2:
1454	#endif /* VBOX_WITH_HGCM */
1455	default:
1456	enmRequired = kLevel_NoOne;
1457	break;
1458
1459	/*
1460	* There are a few things only this driver can do (and it doesn't use
1461	* the VMMRequst I/O control route anyway, but whatever).
1462	*/
1463	case VMMDevReq_ReportGuestInfo:
1464	case VMMDevReq_ReportGuestInfo2:
1465	case VMMDevReq_GetHypervisorInfo:
1466	case VMMDevReq_SetHypervisorInfo:
1467	case VMMDevReq_RegisterPatchMemory:
1468	case VMMDevReq_DeregisterPatchMemory:
1469	case VMMDevReq_GetMemBalloonChangeRequest:
1470	enmRequired = kLevel_OnlyVBoxGuest;
1471	break;
1472
1473	/*
1474	* Trusted users apps only.
1475	*/
1476	case VMMDevReq_QueryCredentials:
1477	case VMMDevReq_ReportCredentialsJudgement:
1478	case VMMDevReq_RegisterSharedModule:
1479	case VMMDevReq_UnregisterSharedModule:
1480	case VMMDevReq_WriteCoreDump:
1481	case VMMDevReq_GetCpuHotPlugRequest:
1482	case VMMDevReq_SetCpuHotPlugStatus:
1483	case VMMDevReq_CheckSharedModules:
1484	case VMMDevReq_GetPageSharingStatus:
1485	case VMMDevReq_DebugIsPageShared:
1486	case VMMDevReq_ReportGuestStats:
1487	case VMMDevReq_GetStatisticsChangeRequest:
1488	case VMMDevReq_ChangeMemBalloon:
1489	enmRequired = kLevel_TrustedUsers;
1490	break;
1491
1492	/*
1493	* Anyone.
1494	*/
1495	case VMMDevReq_GetMouseStatus:
1496	case VMMDevReq_SetMouseStatus:
1497	case VMMDevReq_SetPointerShape:
1498	case VMMDevReq_GetHostVersion:
1499	case VMMDevReq_Idle:
1500	case VMMDevReq_GetHostTime:
1501	case VMMDevReq_SetPowerStatus:
1502	case VMMDevReq_AcknowledgeEvents:
1503	case VMMDevReq_CtlGuestFilterMask:
1504	case VMMDevReq_ReportGuestStatus:
1505	case VMMDevReq_GetDisplayChangeRequest:
1506	case VMMDevReq_VideoModeSupported:
1507	case VMMDevReq_GetHeightReduction:
1508	case VMMDevReq_GetDisplayChangeRequest2:
1509	case VMMDevReq_SetGuestCapabilities:
1510	case VMMDevReq_VideoModeSupported2:
1511	case VMMDevReq_VideoAccelEnable:
1512	case VMMDevReq_VideoAccelFlush:
1513	case VMMDevReq_VideoSetVisibleRegion:
1514	case VMMDevReq_GetSeamlessChangeRequest:
1515	case VMMDevReq_GetVRDPChangeRequest:
1516	case VMMDevReq_LogString:
1517	case VMMDevReq_GetSessionId:
1518	enmRequired = kLevel_AllUsers;
1519	break;
1520
1521	/*
1522	* Depends on the request parameters...
1523	*/
1524	/** @todo this have to be changed into an I/O control and the facilities
1525	* tracked in the session so they can automatically be failed when the
1526	* session terminates without reporting the new status.
1527	*
1528	* The information presented by IGuest is not reliable without this! */
1529	case VMMDevReq_ReportGuestCapabilities:
1530	switch (((VMMDevReportGuestStatus const *)pReqHdr)->guestStatus.facility)
1531	{
1532	case VBoxGuestFacilityType_All:
1533	case VBoxGuestFacilityType_VBoxGuestDriver:
1534	enmRequired = kLevel_OnlyVBoxGuest;
1535	break;
1536	case VBoxGuestFacilityType_VBoxService:
1537	enmRequired = kLevel_TrustedUsers;
1538	break;
1539	case VBoxGuestFacilityType_VBoxTrayClient:
1540	case VBoxGuestFacilityType_Seamless:
1541	case VBoxGuestFacilityType_Graphics:
1542	default:
1543	enmRequired = kLevel_AllUsers;
1544	break;
1545	}
1546	break;
1547	}
1548
1549	/*
1550	* Check against the session.
1551	*/
1552	switch (enmRequired)
1553	{
1554	default:
1555	case kLevel_NoOne:
1556	break;
1557	case kLevel_OnlyVBoxGuest:
1558	case kLevel_OnlyKernel:
1559	if (pSession->R0Process == NIL_RTR0PROCESS)
1560	return VINF_SUCCESS;
1561	break;
1562	case kLevel_TrustedUsers:
1563	case kLevel_AllUsers:
1564	return VINF_SUCCESS;
1565	}
1566
1567	return VERR_PERMISSION_DENIED;
1568	}
1569
1570	static int VBoxGuestCommonIOCtl_VMMRequest(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
1571	VMMDevRequestHeader pReqHdr, size_t cbData, size_t pcbDataReturned)
1572	{
1573	int rc;
1574	VMMDevRequestHeader *pReqCopy;
1575
1576	/*
1577	* Validate the header and request size.
1578	*/
1579	const VMMDevRequestType enmType = pReqHdr->requestType;
1580	const uint32_t cbReq = pReqHdr->size;
1581	const uint32_t cbMinSize = vmmdevGetRequestSize(enmType);
1582
1583	Log(("VBoxGuestCommonIOCtl: VMMREQUEST type %d\n", pReqHdr->requestType));
1584
1585	if (cbReq < cbMinSize)
1586	{
1587	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: invalid hdr size %#x, expected >= %#x; type=%#x!!\n",
1588	cbReq, cbMinSize, enmType));
1589	return VERR_INVALID_PARAMETER;
1590	}
1591	if (cbReq > cbData)
1592	{
1593	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: invalid size %#x, expected >= %#x (hdr); type=%#x!!\n",
1594	cbData, cbReq, enmType));
1595	return VERR_INVALID_PARAMETER;
1596	}
1597	rc = VbglGRVerify(pReqHdr, cbData);
1598	if (RT_FAILURE(rc))
1599	{
1600	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: invalid header: size %#x, expected >= %#x (hdr); type=%#x; rc=%Rrc!!\n",
1601	cbData, cbReq, enmType, rc));
1602	return rc;
1603	}
1604
1605	rc = VBoxGuestCheckIfVMMReqAllowed(pSession, enmType, pReqHdr);
1606	if (RT_FAILURE(rc))
1607	{
1608	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: Operation not allowed! type=%#x rc=%Rrc\n", enmType, rc));
1609	return rc;
1610	}
1611
1612	/*
1613	* Make a copy of the request in the physical memory heap so
1614	* the VBoxGuestLibrary can more easily deal with the request.
1615	* (This is really a waste of time since the OS or the OS specific
1616	* code has already buffered or locked the input/output buffer, but
1617	* it does makes things a bit simpler wrt to phys address.)
1618	*/
1619	rc = VbglGRAlloc(&pReqCopy, cbReq, enmType);
1620	if (RT_FAILURE(rc))
1621	{
1622	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: failed to allocate %u (%#x) bytes to cache the request. rc=%Rrc!!\n",
1623	cbReq, cbReq, rc));
1624	return rc;
1625	}
1626	memcpy(pReqCopy, pReqHdr, cbReq);
1627
1628	if (enmType == VMMDevReq_GetMouseStatus) /* clear poll condition. */
1629	pSession->u32MousePosChangedSeq = ASMAtomicUoReadU32(&pDevExt->u32MousePosChangedSeq);
1630
1631	rc = VbglGRPerform(pReqCopy);
1632	if ( RT_SUCCESS(rc)
1633	&& RT_SUCCESS(pReqCopy->rc))
1634	{
1635	Assert(rc != VINF_HGCM_ASYNC_EXECUTE);
1636	Assert(pReqCopy->rc != VINF_HGCM_ASYNC_EXECUTE);
1637
1638	memcpy(pReqHdr, pReqCopy, cbReq);
1639	if (pcbDataReturned)
1640	*pcbDataReturned = cbReq;
1641	}
1642	else if (RT_FAILURE(rc))
1643	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: VbglGRPerform - rc=%Rrc!\n", rc));
1644	else
1645	{
1646	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: request execution failed; VMMDev rc=%Rrc!\n", pReqCopy->rc));
1647	rc = pReqCopy->rc;
1648	}
1649
1650	VbglGRFree(pReqCopy);
1651	return rc;
1652	}
1653
1654
1655	static int VBoxGuestCommonIOCtl_CtlFilterMask(PVBOXGUESTDEVEXT pDevExt, VBoxGuestFilterMaskInfo *pInfo)
1656	{
1657	VMMDevCtlGuestFilterMask *pReq;
1658	int rc = VbglGRAlloc((VMMDevRequestHeader *)&pReq, sizeof(pReq), VMMDevReq_CtlGuestFilterMask);
1659	if (RT_FAILURE(rc))
1660	{
1661	Log(("VBoxGuestCommonIOCtl: CTL_FILTER_MASK: failed to allocate %u (%#x) bytes to cache the request. rc=%Rrc!!\n",
1662	sizeof(pReq), sizeof(pReq), rc));
1663	return rc;
1664	}
1665
1666	pReq->u32OrMask = pInfo->u32OrMask;
1667	pReq->u32NotMask = pInfo->u32NotMask;
1668	pReq->u32NotMask &= ~pDevExt->fFixedEvents; /* don't permit these to be cleared! */
1669	rc = VbglGRPerform(&pReq->header);
1670	if (RT_FAILURE(rc))
1671	Log(("VBoxGuestCommonIOCtl: CTL_FILTER_MASK: VbglGRPerform failed, rc=%Rrc!\n", rc));
1672
1673	VbglGRFree(&pReq->header);
1674	return rc;
1675	}
1676
1677	#ifdef VBOX_WITH_HGCM
1678
1679	AssertCompile(RT_INDEFINITE_WAIT == (uint32_t)RT_INDEFINITE_WAIT); /* assumed by code below */
1680
1681	/** Worker for VBoxGuestHGCMAsyncWaitCallback. /
1682	static int VBoxGuestHGCMAsyncWaitCallbackWorker(VMMDevHGCMRequestHeader volatile *pHdr, PVBOXGUESTDEVEXT pDevExt,
1683	bool fInterruptible, uint32_t cMillies)
1684	{
1685	int rc;
1686
1687	/*
1688	* Check to see if the condition was met by the time we got here.
1689	*
1690	* We create a simple poll loop here for dealing with out-of-memory
1691	* conditions since the caller isn't necessarily able to deal with
1692	* us returning too early.
1693	*/
1694	RTSPINLOCKTMP Tmp = RTSPINLOCKTMP_INITIALIZER;
1695	PVBOXGUESTWAIT pWait;
1696	for (;;)
1697	{
1698	RTSpinlockAcquireNoInts(pDevExt->EventSpinlock, &Tmp);
1699	if ((pHdr->fu32Flags & VBOX_HGCM_REQ_DONE) != 0)
1700	{
1701	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, &Tmp);
1702	return VINF_SUCCESS;
1703	}
1704	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, &Tmp);
1705
1706	pWait = VBoxGuestWaitAlloc(pDevExt, NULL);
1707	if (pWait)
1708	break;
1709	if (fInterruptible)
1710	return VERR_INTERRUPTED;
1711	RTThreadSleep(1);
1712	}
1713	pWait->fReqEvents = VMMDEV_EVENT_HGCM;
1714	pWait->pHGCMReq = pHdr;
1715
1716	/*
1717	* Re-enter the spinlock and re-check for the condition.
1718	* If the condition is met, return.
1719	* Otherwise link us into the HGCM wait list and go to sleep.
1720	*/
1721	RTSpinlockAcquireNoInts(pDevExt->EventSpinlock, &Tmp);
1722	RTListAppend(&pDevExt->HGCMWaitList, &pWait->ListNode);
1723	if ((pHdr->fu32Flags & VBOX_HGCM_REQ_DONE) != 0)
1724	{
1725	VBoxGuestWaitFreeLocked(pDevExt, pWait);
1726	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, &Tmp);
1727	return VINF_SUCCESS;
1728	}
1729	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, &Tmp);
1730
1731	if (fInterruptible)
1732	rc = RTSemEventMultiWaitNoResume(pWait->Event, cMillies);
1733	else
1734	rc = RTSemEventMultiWait(pWait->Event, cMillies);
1735	if (rc == VERR_SEM_DESTROYED)
1736	return rc;
1737
1738	/*
1739	* Unlink, free and return.
1740	*/
1741	if ( RT_FAILURE(rc)
1742	&& rc != VERR_TIMEOUT
1743	&& ( !fInterruptible
1744	\|\| rc != VERR_INTERRUPTED))
1745	LogRel(("VBoxGuestHGCMAsyncWaitCallback: wait failed! %Rrc\n", rc));
1746
1747	VBoxGuestWaitFreeUnlocked(pDevExt, pWait);
1748	return rc;
1749	}
1750
1751
1752	/**
1753	* This is a callback for dealing with async waits.
1754	*
1755	* It operates in a manner similar to VBoxGuestCommonIOCtl_WaitEvent.
1756	*/
1757	static DECLCALLBACK(int) VBoxGuestHGCMAsyncWaitCallback(VMMDevHGCMRequestHeader pHdr, void pvUser, uint32_t u32User)
1758	{
1759	PVBOXGUESTDEVEXT pDevExt = (PVBOXGUESTDEVEXT)pvUser;
1760	Log(("VBoxGuestHGCMAsyncWaitCallback: requestType=%d\n", pHdr->header.requestType));
1761	return VBoxGuestHGCMAsyncWaitCallbackWorker((VMMDevHGCMRequestHeader volatile *)pHdr,
1762	pDevExt,
1763	false /* fInterruptible */,
1764	u32User /* cMillies */);
1765	}
1766
1767
1768	/**
1769	* This is a callback for dealing with async waits with a timeout.
1770	*
1771	* It operates in a manner similar to VBoxGuestCommonIOCtl_WaitEvent.
1772	*/
1773	static DECLCALLBACK(int) VBoxGuestHGCMAsyncWaitCallbackInterruptible(VMMDevHGCMRequestHeader *pHdr,
1774	void *pvUser, uint32_t u32User)
1775	{
1776	PVBOXGUESTDEVEXT pDevExt = (PVBOXGUESTDEVEXT)pvUser;
1777	Log(("VBoxGuestHGCMAsyncWaitCallbackInterruptible: requestType=%d\n", pHdr->header.requestType));
1778	return VBoxGuestHGCMAsyncWaitCallbackWorker((VMMDevHGCMRequestHeader volatile *)pHdr,
1779	pDevExt,
1780	true /* fInterruptible */,
1781	u32User /* cMillies */ );
1782
1783	}
1784
1785
1786	static int VBoxGuestCommonIOCtl_HGCMConnect(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
1787	VBoxGuestHGCMConnectInfo pInfo, size_t pcbDataReturned)
1788	{
1789	int rc;
1790
1791	/*
1792	* The VbglHGCMConnect call will invoke the callback if the HGCM
1793	* call is performed in an ASYNC fashion. The function is not able
1794	* to deal with cancelled requests.
1795	*/
1796	Log(("VBoxGuestCommonIOCtl: HGCM_CONNECT: %.128s\n",
1797	pInfo->Loc.type == VMMDevHGCMLoc_LocalHost \|\| pInfo->Loc.type == VMMDevHGCMLoc_LocalHost_Existing
1798	? pInfo->Loc.u.host.achName : "<not local host>"));
1799
1800	rc = VbglR0HGCMInternalConnect(pInfo, VBoxGuestHGCMAsyncWaitCallback, pDevExt, RT_INDEFINITE_WAIT);
1801	if (RT_SUCCESS(rc))
1802	{
1803	Log(("VBoxGuestCommonIOCtl: HGCM_CONNECT: u32Client=%RX32 result=%Rrc (rc=%Rrc)\n",
1804	pInfo->u32ClientID, pInfo->result, rc));
1805	if (RT_SUCCESS(pInfo->result))
1806	{
1807	/*
1808	* Append the client id to the client id table.
1809	* If the table has somehow become filled up, we'll disconnect the session.
1810	*/
1811	unsigned i;
1812	RTSPINLOCKTMP Tmp = RTSPINLOCKTMP_INITIALIZER;
1813	RTSpinlockAcquireNoInts(pDevExt->SessionSpinlock, &Tmp);
1814	for (i = 0; i < RT_ELEMENTS(pSession->aHGCMClientIds); i++)
1815	if (!pSession->aHGCMClientIds[i])
1816	{
1817	pSession->aHGCMClientIds[i] = pInfo->u32ClientID;
1818	break;
1819	}
1820	RTSpinlockReleaseNoInts(pDevExt->SessionSpinlock, &Tmp);
1821	if (i >= RT_ELEMENTS(pSession->aHGCMClientIds))
1822	{
1823	static unsigned s_cErrors = 0;
1824	VBoxGuestHGCMDisconnectInfo Info;
1825
1826	if (s_cErrors++ < 32)
1827	LogRel(("VBoxGuestCommonIOCtl: HGCM_CONNECT: too many HGCMConnect calls for one session!\n"));
1828
1829	Info.result = 0;
1830	Info.u32ClientID = pInfo->u32ClientID;
1831	VbglR0HGCMInternalDisconnect(&Info, VBoxGuestHGCMAsyncWaitCallback, pDevExt, RT_INDEFINITE_WAIT);
1832	return VERR_TOO_MANY_OPEN_FILES;
1833	}
1834	}
1835	if (pcbDataReturned)
1836	pcbDataReturned = sizeof(pInfo);
1837	}
1838	return rc;
1839	}
1840
1841
1842	static int VBoxGuestCommonIOCtl_HGCMDisconnect(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession, VBoxGuestHGCMDisconnectInfo *pInfo,
1843	size_t *pcbDataReturned)
1844	{
1845	/*
1846	* Validate the client id and invalidate its entry while we're in the call.
1847	*/
1848	int rc;
1849	const uint32_t u32ClientId = pInfo->u32ClientID;
1850	unsigned i;
1851	RTSPINLOCKTMP Tmp = RTSPINLOCKTMP_INITIALIZER;
1852	RTSpinlockAcquireNoInts(pDevExt->SessionSpinlock, &Tmp);
1853	for (i = 0; i < RT_ELEMENTS(pSession->aHGCMClientIds); i++)
1854	if (pSession->aHGCMClientIds[i] == u32ClientId)
1855	{
1856	pSession->aHGCMClientIds[i] = UINT32_MAX;
1857	break;
1858	}
1859	RTSpinlockReleaseNoInts(pDevExt->SessionSpinlock, &Tmp);
1860	if (i >= RT_ELEMENTS(pSession->aHGCMClientIds))
1861	{
1862	static unsigned s_cErrors = 0;
1863	if (s_cErrors++ > 32)
1864	LogRel(("VBoxGuestCommonIOCtl: HGCM_DISCONNECT: u32Client=%RX32\n", u32ClientId));
1865	return VERR_INVALID_HANDLE;
1866	}
1867
1868	/*
1869	* The VbglHGCMConnect call will invoke the callback if the HGCM
1870	* call is performed in an ASYNC fashion. The function is not able
1871	* to deal with cancelled requests.
1872	*/
1873	Log(("VBoxGuestCommonIOCtl: HGCM_DISCONNECT: u32Client=%RX32\n", pInfo->u32ClientID));
1874	rc = VbglR0HGCMInternalDisconnect(pInfo, VBoxGuestHGCMAsyncWaitCallback, pDevExt, RT_INDEFINITE_WAIT);
1875	if (RT_SUCCESS(rc))
1876	{
1877	Log(("VBoxGuestCommonIOCtl: HGCM_DISCONNECT: result=%Rrc\n", pInfo->result));
1878	if (pcbDataReturned)
1879	pcbDataReturned = sizeof(pInfo);
1880	}
1881
1882	/* Update the client id array according to the result. */
1883	RTSpinlockAcquireNoInts(pDevExt->SessionSpinlock, &Tmp);
1884	if (pSession->aHGCMClientIds[i] == UINT32_MAX)
1885	pSession->aHGCMClientIds[i] = RT_SUCCESS(rc) && RT_SUCCESS(pInfo->result) ? 0 : u32ClientId;
1886	RTSpinlockReleaseNoInts(pDevExt->SessionSpinlock, &Tmp);
1887
1888	return rc;
1889	}
1890
1891
1892	static int VBoxGuestCommonIOCtl_HGCMCall(PVBOXGUESTDEVEXT pDevExt,
1893	PVBOXGUESTSESSION pSession,
1894	VBoxGuestHGCMCallInfo *pInfo,
1895	uint32_t cMillies, bool fInterruptible, bool f32bit,
1896	size_t cbExtra, size_t cbData, size_t *pcbDataReturned)
1897	{
1898	const uint32_t u32ClientId = pInfo->u32ClientID;
1899	RTSPINLOCKTMP Tmp = RTSPINLOCKTMP_INITIALIZER;
1900	uint32_t fFlags;
1901	size_t cbActual;
1902	unsigned i;
1903	int rc;
1904
1905	/*
1906	* Some more validations.
1907	*/
1908	if (pInfo->cParms > 4096) /* (Just make sure it doesn't overflow the next check.) */
1909	{
1910	LogRel(("VBoxGuestCommonIOCtl: HGCM_CALL: cParm=%RX32 is not sane\n", pInfo->cParms));
1911	return VERR_INVALID_PARAMETER;
1912	}
1913
1914	cbActual = cbExtra + sizeof(*pInfo);
1915	#ifdef RT_ARCH_AMD64
1916	if (f32bit)
1917	cbActual += pInfo->cParms * sizeof(HGCMFunctionParameter32);
1918	else
1919	#endif
1920	cbActual += pInfo->cParms * sizeof(HGCMFunctionParameter);
1921	if (cbData < cbActual)
1922	{
1923	LogRel(("VBoxGuestCommonIOCtl: HGCM_CALL: cbData=%#zx (%zu) required size is %#zx (%zu)\n",
1924	cbData, cbActual));
1925	return VERR_INVALID_PARAMETER;
1926	}
1927
1928	/*
1929	* Validate the client id.
1930	*/
1931	RTSpinlockAcquireNoInts(pDevExt->SessionSpinlock, &Tmp);
1932	for (i = 0; i < RT_ELEMENTS(pSession->aHGCMClientIds); i++)
1933	if (pSession->aHGCMClientIds[i] == u32ClientId)
1934	break;
1935	RTSpinlockReleaseNoInts(pDevExt->SessionSpinlock, &Tmp);
1936	if (RT_UNLIKELY(i >= RT_ELEMENTS(pSession->aHGCMClientIds)))
1937	{
1938	static unsigned s_cErrors = 0;
1939	if (s_cErrors++ > 32)
1940	LogRel(("VBoxGuestCommonIOCtl: HGCM_CALL: Invalid handle. u32Client=%RX32\n", u32ClientId));
1941	return VERR_INVALID_HANDLE;
1942	}
1943
1944	/*
1945	* The VbglHGCMCall call will invoke the callback if the HGCM
1946	* call is performed in an ASYNC fashion. This function can
1947	* deal with cancelled requests, so we let user more requests
1948	* be interruptible (should add a flag for this later I guess).
1949	*/
1950	Log(("VBoxGuestCommonIOCtl: HGCM_CALL: u32Client=%RX32\n", pInfo->u32ClientID));
1951	fFlags = pSession->R0Process == NIL_RTR0PROCESS ? VBGLR0_HGCMCALL_F_KERNEL : VBGLR0_HGCMCALL_F_USER;
1952	#ifdef RT_ARCH_AMD64
1953	if (f32bit)
1954	{
1955	if (fInterruptible)
1956	rc = VbglR0HGCMInternalCall32(pInfo, cbData - cbExtra, fFlags, VBoxGuestHGCMAsyncWaitCallbackInterruptible, pDevExt, cMillies);
1957	else
1958	rc = VbglR0HGCMInternalCall32(pInfo, cbData - cbExtra, fFlags, VBoxGuestHGCMAsyncWaitCallback, pDevExt, cMillies);
1959	}
1960	else
1961	#endif
1962	{
1963	if (fInterruptible)
1964	rc = VbglR0HGCMInternalCall(pInfo, cbData - cbExtra, fFlags, VBoxGuestHGCMAsyncWaitCallbackInterruptible, pDevExt, cMillies);
1965	else
1966	rc = VbglR0HGCMInternalCall(pInfo, cbData - cbExtra, fFlags, VBoxGuestHGCMAsyncWaitCallback, pDevExt, cMillies);
1967	}
1968	if (RT_SUCCESS(rc))
1969	{
1970	Log(("VBoxGuestCommonIOCtl: HGCM_CALL: result=%Rrc\n", pInfo->result));
1971	if (pcbDataReturned)
1972	*pcbDataReturned = cbActual;
1973	}
1974	else
1975	{
1976	if ( rc != VERR_INTERRUPTED
1977	&& rc != VERR_TIMEOUT)
1978	{
1979	static unsigned s_cErrors = 0;
1980	if (s_cErrors++ < 32)
1981	LogRel(("VBoxGuestCommonIOCtl: HGCM_CALL: %s Failed. rc=%Rrc.\n", f32bit ? "32" : "64", rc));
1982	}
1983	else
1984	Log(("VBoxGuestCommonIOCtl: HGCM_CALL: %s Failed. rc=%Rrc.\n", f32bit ? "32" : "64", rc));
1985	}
1986	return rc;
1987	}
1988
1989
1990	#endif /* VBOX_WITH_HGCM */
1991
1992	/**
1993	* Handle VBOXGUEST_IOCTL_CHECK_BALLOON from R3.
1994	*
1995	* Ask the host for the size of the balloon and try to set it accordingly. If
1996	* this approach fails because it's not supported, return with fHandleInR3 set
1997	* and let the user land supply memory we can lock via the other ioctl.
1998	*
1999	* @returns VBox status code.
2000	*
2001	* @param pDevExt The device extension.
2002	* @param pSession The session.
2003	* @param pInfo The output buffer.
2004	* @param pcbDataReturned Where to store the amount of returned data. Can
2005	* be NULL.
2006	*/
2007	static int VBoxGuestCommonIOCtl_CheckMemoryBalloon(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
2008	VBoxGuestCheckBalloonInfo pInfo, size_t pcbDataReturned)
2009	{
2010	VMMDevGetMemBalloonChangeRequest *pReq;
2011	int rc;
2012
2013	Log(("VBoxGuestCommonIOCtl: CHECK_MEMORY_BALLOON\n"));
2014	rc = RTSemFastMutexRequest(pDevExt->MemBalloon.hMtx);
2015	AssertRCReturn(rc, rc);
2016
2017	/*
2018	* The first user trying to query/change the balloon becomes the
2019	* owner and owns it until the session is closed (vboxGuestCloseMemBalloon).
2020	*/
2021	if ( pDevExt->MemBalloon.pOwner != pSession
2022	&& pDevExt->MemBalloon.pOwner == NULL)
2023	pDevExt->MemBalloon.pOwner = pSession;
2024
2025	if (pDevExt->MemBalloon.pOwner == pSession)
2026	{
2027	rc = VbglGRAlloc((VMMDevRequestHeader **)&pReq, sizeof(VMMDevGetMemBalloonChangeRequest), VMMDevReq_GetMemBalloonChangeRequest);
2028	if (RT_SUCCESS(rc))
2029	{
2030	/*
2031	* This is a response to that event. Setting this bit means that
2032	* we request the value from the host and change the guest memory
2033	* balloon according to this value.
2034	*/
2035	pReq->eventAck = VMMDEV_EVENT_BALLOON_CHANGE_REQUEST;
2036	rc = VbglGRPerform(&pReq->header);
2037	if (RT_SUCCESS(rc))
2038	{
2039	Assert(pDevExt->MemBalloon.cMaxChunks == pReq->cPhysMemChunks \|\| pDevExt->MemBalloon.cMaxChunks == 0);
2040	pDevExt->MemBalloon.cMaxChunks = pReq->cPhysMemChunks;
2041
2042	pInfo->cBalloonChunks = pReq->cBalloonChunks;
2043	pInfo->fHandleInR3 = false;
2044
2045	rc = vboxGuestSetBalloonSizeKernel(pDevExt, pReq->cBalloonChunks, &pInfo->fHandleInR3);
2046	/* Ignore various out of memory failures. */
2047	if ( rc == VERR_NO_MEMORY
2048	\|\| rc == VERR_NO_PHYS_MEMORY
2049	\|\| rc == VERR_NO_CONT_MEMORY)
2050	rc = VINF_SUCCESS;
2051
2052	if (pcbDataReturned)
2053	*pcbDataReturned = sizeof(VBoxGuestCheckBalloonInfo);
2054	}
2055	else
2056	LogRel(("VBoxGuestCommonIOCtl: CHECK_MEMORY_BALLOON: VbglGRPerform failed. rc=%Rrc\n", rc));
2057	VbglGRFree(&pReq->header);
2058	}
2059	}
2060	else
2061	rc = VERR_PERMISSION_DENIED;
2062
2063	RTSemFastMutexRelease(pDevExt->MemBalloon.hMtx);
2064	Log(("VBoxGuestCommonIOCtl: CHECK_MEMORY_BALLOON returns %Rrc\n", rc));
2065	return rc;
2066	}
2067
2068
2069	/**
2070	* Handle a request for changing the memory balloon.
2071	*
2072	* @returns VBox status code.
2073	*
2074	* @param pDevExt The device extention.
2075	* @param pSession The session.
2076	* @param pInfo The change request structure (input).
2077	* @param pcbDataReturned Where to store the amount of returned data. Can
2078	* be NULL.
2079	*/
2080	static int VBoxGuestCommonIOCtl_ChangeMemoryBalloon(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
2081	VBoxGuestChangeBalloonInfo pInfo, size_t pcbDataReturned)
2082	{
2083	int rc = RTSemFastMutexRequest(pDevExt->MemBalloon.hMtx);
2084	AssertRCReturn(rc, rc);
2085
2086	if (!pDevExt->MemBalloon.fUseKernelAPI)
2087	{
2088	/*
2089	* The first user trying to query/change the balloon becomes the
2090	* owner and owns it until the session is closed (vboxGuestCloseMemBalloon).
2091	*/
2092	if ( pDevExt->MemBalloon.pOwner != pSession
2093	&& pDevExt->MemBalloon.pOwner == NULL)
2094	pDevExt->MemBalloon.pOwner = pSession;
2095
2096	if (pDevExt->MemBalloon.pOwner == pSession)
2097	{
2098	rc = vboxGuestSetBalloonSizeFromUser(pDevExt, pSession, pInfo->u64ChunkAddr, !!pInfo->fInflate);
2099	if (pcbDataReturned)
2100	*pcbDataReturned = 0;
2101	}
2102	else
2103	rc = VERR_PERMISSION_DENIED;
2104	}
2105	else
2106	rc = VERR_PERMISSION_DENIED;
2107
2108	RTSemFastMutexRelease(pDevExt->MemBalloon.hMtx);
2109	return rc;
2110	}
2111
2112
2113	/**
2114	* Handle a request for writing a core dump of the guest on the host.
2115	*
2116	* @returns VBox status code.
2117	*
2118	* @param pDevExt The device extension.
2119	* @param pInfo The output buffer.
2120	*/
2121	static int VBoxGuestCommonIOCtl_WriteCoreDump(PVBOXGUESTDEVEXT pDevExt, VBoxGuestWriteCoreDump *pInfo)
2122	{
2123	VMMDevReqWriteCoreDump *pReq = NULL;
2124	int rc = VbglGRAlloc((VMMDevRequestHeader *)&pReq, sizeof(pReq), VMMDevReq_WriteCoreDump);
2125	if (RT_FAILURE(rc))
2126	{
2127	Log(("VBoxGuestCommonIOCtl: WRITE_CORE_DUMP: failed to allocate %u (%#x) bytes to cache the request. rc=%Rrc!!\n",
2128	sizeof(pReq), sizeof(pReq), rc));
2129	return rc;
2130	}
2131
2132	pReq->fFlags = pInfo->fFlags;
2133	rc = VbglGRPerform(&pReq->header);
2134	if (RT_FAILURE(rc))
2135	Log(("VBoxGuestCommonIOCtl: WRITE_CORE_DUMP: VbglGRPerform failed, rc=%Rrc!\n", rc));
2136
2137	VbglGRFree(&pReq->header);
2138	return rc;
2139	}
2140
2141
2142	#ifdef VBOX_WITH_VRDP_SESSION_HANDLING
2143	/**
2144	* Enables the VRDP session and saves its session ID.
2145	*
2146	* @returns VBox status code.
2147	*
2148	* @param pDevExt The device extention.
2149	* @param pSession The session.
2150	*/
2151	static int VBoxGuestCommonIOCtl_EnableVRDPSession(VBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
2152	{
2153	/* Nothing to do here right now, since this only is supported on Windows at the moment. */
2154	return VERR_NOT_IMPLEMENTED;
2155	}
2156
2157
2158	/**
2159	* Disables the VRDP session.
2160	*
2161	* @returns VBox status code.
2162	*
2163	* @param pDevExt The device extention.
2164	* @param pSession The session.
2165	*/
2166	static int VBoxGuestCommonIOCtl_DisableVRDPSession(VBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
2167	{
2168	/* Nothing to do here right now, since this only is supported on Windows at the moment. */
2169	return VERR_NOT_IMPLEMENTED;
2170	}
2171	#endif /* VBOX_WITH_VRDP_SESSION_HANDLING */
2172
2173	#ifdef DEBUG
2174	/** Unit test SetMouseStatus instead of really executing the request. */
2175	static bool g_test_fSetMouseStatus = false;
2176	/** When unit testing SetMouseStatus, the fake RC for the GR to return. */
2177	static int g_test_SetMouseStatusGRRC;
2178	/** When unit testing SetMouseStatus this will be set to the status passed to
2179	* the GR. */
2180	static uint32_t g_test_statusSetMouseStatus;
2181	#endif
2182
2183	static int vboxguestcommonSetMouseStatus(uint32_t fFeatures)
2184	{
2185	VMMDevReqMouseStatus *pReq;
2186	int rc;
2187
2188	LogRelFlowFunc(("fFeatures=%u\n", (int) fFeatures));
2189	rc = VbglGRAlloc((VMMDevRequestHeader *)&pReq, sizeof(pReq), VMMDevReq_SetMouseStatus);
2190	if (RT_SUCCESS(rc))
2191	{
2192	pReq->mouseFeatures = fFeatures;
2193	pReq->pointerXPos = 0;
2194	pReq->pointerYPos = 0;
2195	#ifdef DEBUG
2196	if (g_test_fSetMouseStatus)
2197	{
2198	g_test_statusSetMouseStatus = pReq->mouseFeatures;
2199	rc = g_test_SetMouseStatusGRRC;
2200	}
2201	else
2202	#endif
2203	rc = VbglGRPerform(&pReq->header);
2204	VbglGRFree(&pReq->header);
2205	}
2206	LogRelFlowFunc(("rc=%Rrc\n", rc));
2207	return rc;
2208	}
2209
2210
2211	/**
2212	* Sets the mouse status features for this session and updates them
2213	* globally. We aim to ensure that if several threads call this in
2214	* parallel the most recent status will always end up being set.
2215	*
2216	* @returns VBox status code.
2217	*
2218	* @param pDevExt The device extention.
2219	* @param pSession The session.
2220	* @param fFeatures New bitmap of enabled features.
2221	*/
2222	static int VBoxGuestCommonIOCtl_SetMouseStatus(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession, uint32_t fFeatures)
2223	{
2224	unsigned i;
2225	RTSPINLOCKTMP Tmp = RTSPINLOCKTMP_INITIALIZER;
2226	uint32_t fNewDevExtStatus = 0;
2227	int rc;
2228	/* Exit early if nothing has changed - hack to work around the
2229	* Windows Additions not using the common code. */
2230	bool fNoAction;
2231
2232	RTSpinlockAcquireNoInts(pDevExt->SessionSpinlock, &Tmp);
2233	for (i = 0; i < sizeof(fFeatures) * 8; ++i)
2234	{
2235	if (RT_BIT_32(i) & VMMDEV_MOUSE_GUEST_MASK)
2236	{
2237	if ( (RT_BIT_32(i) & fFeatures)
2238	&& !(RT_BIT_32(i) & pSession->fMouseStatus))
2239	++pDevExt->cMouseFeatureUsage[i];
2240	else if ( !(RT_BIT_32(i) & fFeatures)
2241	&& (RT_BIT_32(i) & pSession->fMouseStatus))
2242	--pDevExt->cMouseFeatureUsage[i];
2243	}
2244	if (pDevExt->cMouseFeatureUsage[i] > 0)
2245	fNewDevExtStatus \|= RT_BIT_32(i);
2246	}
2247	pSession->fMouseStatus = fFeatures & VMMDEV_MOUSE_GUEST_MASK;
2248	fNoAction = (pDevExt->fMouseStatus == fNewDevExtStatus);
2249	pDevExt->fMouseStatus = fNewDevExtStatus;
2250	RTSpinlockReleaseNoInts(pDevExt->SessionSpinlock, &Tmp);
2251	if (fNoAction)
2252	return VINF_SUCCESS;
2253	do
2254	{
2255	fNewDevExtStatus = pDevExt->fMouseStatus;
2256	rc = vboxguestcommonSetMouseStatus(fNewDevExtStatus);
2257	} while(RT_SUCCESS(rc) && fNewDevExtStatus != pDevExt->fMouseStatus);
2258	return rc;
2259	}
2260
2261
2262	#ifdef DEBUG
2263	/** Unit test for the SET_MOUSE_STATUS IoCtl. Since this is closely tied to
2264	* the code in question it probably makes most sense to keep it next to the
2265	* code. */
2266	static void testSetMouseStatus(void)
2267	{
2268	uint32_t u32Data;
2269	int rc;
2270	RTSPINLOCK Spinlock;
2271
2272	g_test_fSetMouseStatus = true;
2273	rc = RTSpinlockCreate(&Spinlock);
2274	AssertRCReturnVoid(rc);
2275	{
2276	VBOXGUESTDEVEXT DevExt = { 0 };
2277	VBOXGUESTSESSION Session = { 0 };
2278
2279	g_test_statusSetMouseStatus = ~0;
2280	g_test_SetMouseStatusGRRC = VINF_SUCCESS;
2281	DevExt.SessionSpinlock = Spinlock;
2282	u32Data = VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE;
2283	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2284	&Session, &u32Data, sizeof(u32Data), NULL);
2285	AssertRCSuccess(rc);
2286	AssertMsg( g_test_statusSetMouseStatus
2287	== VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE,
2288	("Actual status: 0x%x\n", g_test_statusSetMouseStatus));
2289	DevExt.cMouseFeatureUsage[ASMBitFirstSetU32(VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR) - 1] = 1;
2290	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2291	&Session, &u32Data, sizeof(u32Data), NULL);
2292	AssertRCSuccess(rc);
2293	AssertMsg( g_test_statusSetMouseStatus
2294	== ( VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE
2295	\| VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR),
2296	("Actual status: 0x%x\n", g_test_statusSetMouseStatus));
2297	u32Data = VMMDEV_MOUSE_HOST_WANTS_ABSOLUTE; /* Can't change this */
2298	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2299	&Session, &u32Data, sizeof(u32Data), NULL);
2300	AssertRCSuccess(rc);
2301	AssertMsg( g_test_statusSetMouseStatus
2302	== VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR,
2303	("Actual status: 0x%x\n", g_test_statusSetMouseStatus));
2304	u32Data = VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR;
2305	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2306	&Session, &u32Data, sizeof(u32Data), NULL);
2307	AssertRCSuccess(rc);
2308	AssertMsg( g_test_statusSetMouseStatus
2309	== VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR,
2310	("Actual status: 0x%x\n", g_test_statusSetMouseStatus));
2311	u32Data = 0;
2312	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2313	&Session, &u32Data, sizeof(u32Data), NULL);
2314	AssertRCSuccess(rc);
2315	AssertMsg( g_test_statusSetMouseStatus
2316	== VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR,
2317	("Actual status: 0x%x\n", g_test_statusSetMouseStatus));
2318	AssertMsg(DevExt.cMouseFeatureUsage[ASMBitFirstSetU32(VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR) - 1] == 1,
2319	("Actual value: %d\n", DevExt.cMouseFeatureUsage[ASMBitFirstSetU32(VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR)]));
2320	g_test_SetMouseStatusGRRC = VERR_UNRESOLVED_ERROR;
2321	/* This should succeed as the host request should not be made
2322	* since nothing has changed. */
2323	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2324	&Session, &u32Data, sizeof(u32Data), NULL);
2325	AssertRCSuccess(rc);
2326	/* This should fail with VERR_UNRESOLVED_ERROR as set above. */
2327	u32Data = VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE;
2328	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2329	&Session, &u32Data, sizeof(u32Data), NULL);
2330	AssertMsg(rc == VERR_UNRESOLVED_ERROR, ("rc == %Rrc\n", rc));
2331	/* Untested paths: out of memory; race setting status to host */
2332	}
2333	RTSpinlockDestroy(Spinlock);
2334	g_test_fSetMouseStatus = false;
2335	}
2336	#endif
2337
2338
2339	/**
2340	* Guest backdoor logging.
2341	*
2342	* @returns VBox status code.
2343	*
2344	* @param pch The log message (need not be NULL terminated).
2345	* @param cbData Size of the buffer.
2346	* @param pcbDataReturned Where to store the amount of returned data. Can be NULL.
2347	*/
2348	static int VBoxGuestCommonIOCtl_Log(const char pch, size_t cbData, size_t pcbDataReturned)
2349	{
2350	NOREF(pch);
2351	NOREF(cbData);
2352	Log(("%.*s", cbData, pch));
2353	if (pcbDataReturned)
2354	*pcbDataReturned = 0;
2355	return VINF_SUCCESS;
2356	}
2357
2358
2359	/**
2360	* Common IOCtl for user to kernel and kernel to kernel communication.
2361	*
2362	* This function only does the basic validation and then invokes
2363	* worker functions that takes care of each specific function.
2364	*
2365	* @returns VBox status code.
2366	*
2367	* @param iFunction The requested function.
2368	* @param pDevExt The device extension.
2369	* @param pSession The client session.
2370	* @param pvData The input/output data buffer. Can be NULL depending on the function.
2371	* @param cbData The max size of the data buffer.
2372	* @param pcbDataReturned Where to store the amount of returned data. Can be NULL.
2373	*/
2374	int VBoxGuestCommonIOCtl(unsigned iFunction, PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
2375	void pvData, size_t cbData, size_t pcbDataReturned)
2376	{
2377	int rc;
2378	Log(("VBoxGuestCommonIOCtl: iFunction=%#x pDevExt=%p pSession=%p pvData=%p cbData=%zu\n",
2379	iFunction, pDevExt, pSession, pvData, cbData));
2380
2381	/*
2382	* Make sure the returned data size is set to zero.
2383	*/
2384	if (pcbDataReturned)
2385	*pcbDataReturned = 0;
2386
2387	/*
2388	* Define some helper macros to simplify validation.
2389	*/
2390	#define CHECKRET_RING0(mnemonic) \
2391	do { \
2392	if (pSession->R0Process != NIL_RTR0PROCESS) \
2393	{ \
2394	LogFunc((mnemonic ": Ring-0 only, caller is %RTproc/%p\n", \
2395	pSession->Process, (uintptr_t)pSession->R0Process)); \
2396	return VERR_PERMISSION_DENIED; \
2397	} \
2398	} while (0)
2399	#define CHECKRET_MIN_SIZE(mnemonic, cbMin) \
2400	do { \
2401	if (cbData < (cbMin)) \
2402	{ \
2403	LogFunc((mnemonic ": cbData=%#zx (%zu) min is %#zx (%zu)\n", \
2404	cbData, cbData, (size_t)(cbMin), (size_t)(cbMin))); \
2405	return VERR_BUFFER_OVERFLOW; \
2406	} \
2407	if ((cbMin) != 0 && !VALID_PTR(pvData)) \
2408	{ \
2409	LogFunc((mnemonic ": Invalid pointer %p\n", pvData)); \
2410	return VERR_INVALID_POINTER; \
2411	} \
2412	} while (0)
2413	#define CHECKRET_SIZE(mnemonic, cb) \
2414	do { \
2415	if (cbData != (cb)) \
2416	{ \
2417	LogFunc((mnemonic ": cbData=%#zx (%zu) expected is %#zx (%zu)\n", \
2418	cbData, cbData, (size_t)(cb), (size_t)(cb))); \
2419	return VERR_BUFFER_OVERFLOW; \
2420	} \
2421	if ((cb) != 0 && !VALID_PTR(pvData)) \
2422	{ \
2423	LogFunc((mnemonic ": Invalid pointer %p\n", pvData)); \
2424	return VERR_INVALID_POINTER; \
2425	} \
2426	} while (0)
2427
2428
2429	/*
2430	* Deal with variably sized requests first.
2431	*/
2432	rc = VINF_SUCCESS;
2433	if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_VMMREQUEST(0)))
2434	{
2435	CHECKRET_MIN_SIZE("VMMREQUEST", sizeof(VMMDevRequestHeader));
2436	rc = VBoxGuestCommonIOCtl_VMMRequest(pDevExt, pSession, (VMMDevRequestHeader *)pvData, cbData, pcbDataReturned);
2437	}
2438	#ifdef VBOX_WITH_HGCM
2439	/*
2440	* These ones are a bit tricky.
2441	*/
2442	else if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_HGCM_CALL(0)))
2443	{
2444	bool fInterruptible = pSession->R0Process != NIL_RTR0PROCESS;
2445	CHECKRET_MIN_SIZE("HGCM_CALL", sizeof(VBoxGuestHGCMCallInfo));
2446	rc = VBoxGuestCommonIOCtl_HGCMCall(pDevExt, pSession, (VBoxGuestHGCMCallInfo *)pvData, RT_INDEFINITE_WAIT,
2447	fInterruptible, false /f32bit/,
2448	0, cbData, pcbDataReturned);
2449	}
2450	else if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_HGCM_CALL_TIMED(0)))
2451	{
2452	VBoxGuestHGCMCallInfoTimed pInfo = (VBoxGuestHGCMCallInfoTimed )pvData;
2453	CHECKRET_MIN_SIZE("HGCM_CALL_TIMED", sizeof(VBoxGuestHGCMCallInfoTimed));
2454	rc = VBoxGuestCommonIOCtl_HGCMCall(pDevExt, pSession, &pInfo->info, pInfo->u32Timeout,
2455	!!pInfo->fInterruptible \|\| pSession->R0Process != NIL_RTR0PROCESS,
2456	false /f32bit/,
2457	RT_OFFSETOF(VBoxGuestHGCMCallInfoTimed, info), cbData, pcbDataReturned);
2458	}
2459	# ifdef RT_ARCH_AMD64
2460	else if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_HGCM_CALL_32(0)))
2461	{
2462	bool fInterruptible = pSession->R0Process != NIL_RTR0PROCESS;
2463	CHECKRET_MIN_SIZE("HGCM_CALL", sizeof(VBoxGuestHGCMCallInfo));
2464	rc = VBoxGuestCommonIOCtl_HGCMCall(pDevExt, pSession, (VBoxGuestHGCMCallInfo *)pvData, RT_INDEFINITE_WAIT,
2465	fInterruptible, true /f32bit/,
2466	0, cbData, pcbDataReturned);
2467	}
2468	else if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_HGCM_CALL_TIMED_32(0)))
2469	{
2470	CHECKRET_MIN_SIZE("HGCM_CALL_TIMED", sizeof(VBoxGuestHGCMCallInfoTimed));
2471	VBoxGuestHGCMCallInfoTimed pInfo = (VBoxGuestHGCMCallInfoTimed )pvData;
2472	rc = VBoxGuestCommonIOCtl_HGCMCall(pDevExt, pSession, &pInfo->info, pInfo->u32Timeout,
2473	!!pInfo->fInterruptible \|\| pSession->R0Process != NIL_RTR0PROCESS,
2474	true /f32bit/,
2475	RT_OFFSETOF(VBoxGuestHGCMCallInfoTimed, info), cbData, pcbDataReturned);
2476	}
2477	# endif
2478	#endif /* VBOX_WITH_HGCM */
2479	else if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_LOG(0)))
2480	{
2481	CHECKRET_MIN_SIZE("LOG", 1);
2482	rc = VBoxGuestCommonIOCtl_Log((char *)pvData, cbData, pcbDataReturned);
2483	}
2484	else
2485	{
2486	switch (iFunction)
2487	{
2488	case VBOXGUEST_IOCTL_GETVMMDEVPORT:
2489	CHECKRET_RING0("GETVMMDEVPORT");
2490	CHECKRET_MIN_SIZE("GETVMMDEVPORT", sizeof(VBoxGuestPortInfo));
2491	rc = VBoxGuestCommonIOCtl_GetVMMDevPort(pDevExt, (VBoxGuestPortInfo *)pvData, pcbDataReturned);
2492	break;
2493
2494	case VBOXGUEST_IOCTL_WAITEVENT:
2495	CHECKRET_MIN_SIZE("WAITEVENT", sizeof(VBoxGuestWaitEventInfo));
2496	rc = VBoxGuestCommonIOCtl_WaitEvent(pDevExt, pSession, (VBoxGuestWaitEventInfo *)pvData,
2497	pcbDataReturned, pSession->R0Process != NIL_RTR0PROCESS);
2498	break;
2499
2500	case VBOXGUEST_IOCTL_CANCEL_ALL_WAITEVENTS:
2501	if (cbData != 0)
2502	rc = VERR_INVALID_PARAMETER;
2503	rc = VBoxGuestCommonIOCtl_CancelAllWaitEvents(pDevExt, pSession);
2504	break;
2505
2506	case VBOXGUEST_IOCTL_CTL_FILTER_MASK:
2507	CHECKRET_MIN_SIZE("CTL_FILTER_MASK", sizeof(VBoxGuestFilterMaskInfo));
2508	rc = VBoxGuestCommonIOCtl_CtlFilterMask(pDevExt, (VBoxGuestFilterMaskInfo *)pvData);
2509	break;
2510
2511	#ifdef VBOX_WITH_HGCM
2512	case VBOXGUEST_IOCTL_HGCM_CONNECT:
2513	# ifdef RT_ARCH_AMD64
2514	case VBOXGUEST_IOCTL_HGCM_CONNECT_32:
2515	# endif
2516	CHECKRET_MIN_SIZE("HGCM_CONNECT", sizeof(VBoxGuestHGCMConnectInfo));
2517	rc = VBoxGuestCommonIOCtl_HGCMConnect(pDevExt, pSession, (VBoxGuestHGCMConnectInfo *)pvData, pcbDataReturned);
2518	break;
2519
2520	case VBOXGUEST_IOCTL_HGCM_DISCONNECT:
2521	# ifdef RT_ARCH_AMD64
2522	case VBOXGUEST_IOCTL_HGCM_DISCONNECT_32:
2523	# endif
2524	CHECKRET_MIN_SIZE("HGCM_DISCONNECT", sizeof(VBoxGuestHGCMDisconnectInfo));
2525	rc = VBoxGuestCommonIOCtl_HGCMDisconnect(pDevExt, pSession, (VBoxGuestHGCMDisconnectInfo *)pvData, pcbDataReturned);
2526	break;
2527	#endif /* VBOX_WITH_HGCM */
2528
2529	case VBOXGUEST_IOCTL_CHECK_BALLOON:
2530	CHECKRET_MIN_SIZE("CHECK_MEMORY_BALLOON", sizeof(VBoxGuestCheckBalloonInfo));
2531	rc = VBoxGuestCommonIOCtl_CheckMemoryBalloon(pDevExt, pSession, (VBoxGuestCheckBalloonInfo *)pvData, pcbDataReturned);
2532	break;
2533
2534	case VBOXGUEST_IOCTL_CHANGE_BALLOON:
2535	CHECKRET_MIN_SIZE("CHANGE_MEMORY_BALLOON", sizeof(VBoxGuestChangeBalloonInfo));
2536	rc = VBoxGuestCommonIOCtl_ChangeMemoryBalloon(pDevExt, pSession, (VBoxGuestChangeBalloonInfo *)pvData, pcbDataReturned);
2537	break;
2538
2539	case VBOXGUEST_IOCTL_WRITE_CORE_DUMP:
2540	CHECKRET_MIN_SIZE("WRITE_CORE_DUMP", sizeof(VBoxGuestWriteCoreDump));
2541	rc = VBoxGuestCommonIOCtl_WriteCoreDump(pDevExt, (VBoxGuestWriteCoreDump *)pvData);
2542	break;
2543
2544	#ifdef VBOX_WITH_VRDP_SESSION_HANDLING
2545	case VBOXGUEST_IOCTL_ENABLE_VRDP_SESSION:
2546	rc = VBoxGuestCommonIOCtl_EnableVRDPSession(pDevExt, pSession);
2547	break;
2548
2549	case VBOXGUEST_IOCTL_DISABLE_VRDP_SESSION:
2550	rc = VBoxGuestCommonIOCtl_DisableVRDPSession(pDevExt, pSession);
2551	break;
2552	#endif /* VBOX_WITH_VRDP_SESSION_HANDLING */
2553	case VBOXGUEST_IOCTL_SET_MOUSE_STATUS:
2554	CHECKRET_SIZE("SET_MOUSE_STATUS", sizeof(uint32_t));
2555	rc = VBoxGuestCommonIOCtl_SetMouseStatus(pDevExt, pSession,
2556	(uint32_t )pvData);
2557	break;
2558
2559	default:
2560	{
2561	LogRel(("VBoxGuestCommonIOCtl: Unknown request iFunction=%#x Stripped size=%#x\n", iFunction,
2562	VBOXGUEST_IOCTL_STRIP_SIZE(iFunction)));
2563	rc = VERR_NOT_SUPPORTED;
2564	break;
2565	}
2566	}
2567	}
2568
2569	Log(("VBoxGuestCommonIOCtl: returns %Rrc pcbDataReturned=%zu\n", rc, pcbDataReturned ? pcbDataReturned : 0));
2570	return rc;
2571	}
2572
2573
2574
2575	/**
2576	* Common interrupt service routine.
2577	*
2578	* This deals with events and with waking up thread waiting for those events.
2579	*
2580	* @returns true if it was our interrupt, false if it wasn't.
2581	* @param pDevExt The VBoxGuest device extension.
2582	*/
2583	bool VBoxGuestCommonISR(PVBOXGUESTDEVEXT pDevExt)
2584	{
2585	bool fMousePositionChanged = false;
2586	RTSPINLOCKTMP Tmp = RTSPINLOCKTMP_INITIALIZER;
2587	VMMDevEvents volatile *pReq = pDevExt->pIrqAckEvents;
2588	int rc = 0;
2589	bool fOurIrq;
2590
2591	/*
2592	* Make sure we've initialized the device extension.
2593	*/
2594	if (RT_UNLIKELY(!pReq))
2595	return false;
2596
2597	/*
2598	* Enter the spinlock and check if it's our IRQ or not.
2599	*/
2600	RTSpinlockAcquireNoInts(pDevExt->EventSpinlock, &Tmp);
2601	fOurIrq = pDevExt->pVMMDevMemory->V.V1_04.fHaveEvents;
2602	if (fOurIrq)
2603	{
2604	/*
2605	* Acknowlegde events.
2606	* We don't use VbglGRPerform here as it may take another spinlocks.
2607	*/
2608	pReq->header.rc = VERR_INTERNAL_ERROR;
2609	pReq->events = 0;
2610	ASMCompilerBarrier();
2611	ASMOutU32(pDevExt->IOPortBase + VMMDEV_PORT_OFF_REQUEST, (uint32_t)pDevExt->PhysIrqAckEvents);
2612	ASMCompilerBarrier(); /* paranoia */
2613	if (RT_SUCCESS(pReq->header.rc))
2614	{
2615	uint32_t fEvents = pReq->events;
2616	PVBOXGUESTWAIT pWait;
2617	PVBOXGUESTWAIT pSafe;
2618
2619	Log(("VBoxGuestCommonISR: acknowledge events succeeded %#RX32\n", fEvents));
2620
2621	/*
2622	* VMMDEV_EVENT_MOUSE_POSITION_CHANGED can only be polled for.
2623	*/
2624	if (fEvents & VMMDEV_EVENT_MOUSE_POSITION_CHANGED)
2625	{
2626	fMousePositionChanged = true;
2627	fEvents &= ~VMMDEV_EVENT_MOUSE_POSITION_CHANGED;
2628	}
2629
2630	#ifdef VBOX_WITH_HGCM
2631	/*
2632	* The HGCM event/list is kind of different in that we evaluate all entries.
2633	*/
2634	if (fEvents & VMMDEV_EVENT_HGCM)
2635	{
2636	RTListForEachSafe(&pDevExt->HGCMWaitList, pWait, pSafe, VBOXGUESTWAIT, ListNode)
2637	{
2638	if (pWait->pHGCMReq->fu32Flags & VBOX_HGCM_REQ_DONE)
2639	{
2640	pWait->fResEvents = VMMDEV_EVENT_HGCM;
2641	RTListNodeRemove(&pWait->ListNode);
2642	# ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
2643	RTListAppend(&pDevExt->WakeUpList, &pWait->ListNode);
2644	# else
2645	RTListAppend(&pDevExt->WokenUpList, &pWait->ListNode);
2646	rc \|= RTSemEventMultiSignal(pWait->Event);
2647	# endif
2648	}
2649	}
2650	fEvents &= ~VMMDEV_EVENT_HGCM;
2651	}
2652	#endif
2653
2654	/*
2655	* Normal FIFO waiter evaluation.
2656	*/
2657	fEvents \|= pDevExt->f32PendingEvents;
2658	RTListForEachSafe(&pDevExt->WaitList, pWait, pSafe, VBOXGUESTWAIT, ListNode)
2659	{
2660	if ( (pWait->fReqEvents & fEvents)
2661	&& !pWait->fResEvents)
2662	{
2663	pWait->fResEvents = pWait->fReqEvents & fEvents;
2664	fEvents &= ~pWait->fResEvents;
2665	RTListNodeRemove(&pWait->ListNode);
2666	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
2667	RTListAppend(&pDevExt->WakeUpList, &pWait->ListNode);
2668	#else
2669	RTListAppend(&pDevExt->WokenUpList, &pWait->ListNode);
2670	rc \|= RTSemEventMultiSignal(pWait->Event);
2671	#endif
2672	if (!fEvents)
2673	break;
2674	}
2675	}
2676	ASMAtomicWriteU32(&pDevExt->f32PendingEvents, fEvents);
2677	}
2678	else /* something is serious wrong... */
2679	Log(("VBoxGuestCommonISR: acknowledge events failed rc=%Rrc (events=%#x)!!\n",
2680	pReq->header.rc, pReq->events));
2681	}
2682	else
2683	LogFlow(("VBoxGuestCommonISR: not ours\n"));
2684
2685	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock, &Tmp);
2686
2687	#if defined(VBOXGUEST_USE_DEFERRED_WAKE_UP) && !defined(RT_OS_WINDOWS)
2688	/*
2689	* Do wake-ups.
2690	* Note. On Windows this isn't possible at this IRQL, so a DPC will take
2691	* care of it.
2692	*/
2693	VBoxGuestWaitDoWakeUps(pDevExt);
2694	#endif
2695
2696	/*
2697	* Work the poll and async notification queues on OSes that implements that.
2698	* (Do this outside the spinlock to prevent some recursive spinlocking.)
2699	*/
2700	if (fMousePositionChanged)
2701	{
2702	ASMAtomicIncU32(&pDevExt->u32MousePosChangedSeq);
2703	VBoxGuestNativeISRMousePollEvent(pDevExt);
2704	}
2705
2706	Assert(rc == 0);
2707	return fOurIrq;
2708	}
2709

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Additions/common/VBoxGuest/VBoxGuest.cpp@ 40195

Download in other formats: