VBoxGuest.cpp@ 41212

Last change on this file since 41212 was 40806, checked in by vboxsync, 13 years ago
RTSpinlock: Redid the interface, eliminating NoInts and Tmp. Whether a spinlock is interrupt safe or not is now defined at creation time, preventing stupid bugs arrising from calling the wrong acquire and/or release methods somewhere. The saved flags are stored in the spinlock strucutre, eliminating the annoying Tmp variable. Needs testing on each platform before fixing the build burn.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 96.0 KB

Line
1	/* $Id: VBoxGuest.cpp 40806 2012-04-06 21:05:19Z vboxsync $ */
2	/** @file
3	* VBoxGuest - Guest Additions Driver, Common Code.
4	*/
5
6	/*
7	* Copyright (C) 2007-2010 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*******************************************************************************
20	* Header Files *
21	*******************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DEFAULT
23	#include "VBoxGuestInternal.h"
24	#include "VBoxGuest2.h"
25	#include <VBox/VMMDev.h> /* for VMMDEV_RAM_SIZE */
26	#include <VBox/log.h>
27	#include <iprt/mem.h>
28	#include <iprt/time.h>
29	#include <iprt/memobj.h>
30	#include <iprt/asm.h>
31	#include <iprt/asm-amd64-x86.h>
32	#include <iprt/string.h>
33	#include <iprt/process.h>
34	#include <iprt/assert.h>
35	#include <iprt/param.h>
36	#ifdef VBOX_WITH_HGCM
37	# include <iprt/thread.h>
38	#endif
39	#include "version-generated.h"
40	#if defined(RT_OS_LINUX) \|\| defined(RT_OS_FREEBSD)
41	# include "revision-generated.h"
42	#endif
43	#ifdef RT_OS_WINDOWS
44	# ifndef CTL_CODE
45	# include <Windows.h>
46	# endif
47	#endif
48	#if defined(RT_OS_SOLARIS)
49	# include <iprt/rand.h>
50	#endif
51
52
53	/*******************************************************************************
54	* Internal Functions *
55	*******************************************************************************/
56	#ifdef VBOX_WITH_HGCM
57	static DECLCALLBACK(int) VBoxGuestHGCMAsyncWaitCallback(VMMDevHGCMRequestHeader pHdrNonVolatile, void pvUser, uint32_t u32User);
58	#endif
59	#ifdef DEBUG
60	static void testSetMouseStatus(void);
61	#endif
62	static int VBoxGuestCommonIOCtl_SetMouseStatus(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession, uint32_t fFeatures);
63
64
65	/*******************************************************************************
66	* Global Variables *
67	*******************************************************************************/
68	static const size_t cbChangeMemBalloonReq = RT_OFFSETOF(VMMDevChangeMemBalloon, aPhysPage[VMMDEV_MEMORY_BALLOON_CHUNK_PAGES]);
69
70	#if defined(RT_OS_SOLARIS)
71	/**
72	* Drag in the rest of IRPT since we share it with the
73	* rest of the kernel modules on Solaris.
74	*/
75	PFNRT g_apfnVBoxGuestIPRTDeps[] =
76	{
77	/* VirtioNet */
78	(PFNRT)RTRandBytes,
79	NULL
80	};
81	#endif /* RT_OS_SOLARIS */
82
83
84	/**
85	* Reserves memory in which the VMM can relocate any guest mappings
86	* that are floating around.
87	*
88	* This operation is a little bit tricky since the VMM might not accept
89	* just any address because of address clashes between the three contexts
90	* it operates in, so use a small stack to perform this operation.
91	*
92	* @returns VBox status code (ignored).
93	* @param pDevExt The device extension.
94	*/
95	static int vboxGuestInitFixateGuestMappings(PVBOXGUESTDEVEXT pDevExt)
96	{
97	/*
98	* Query the required space.
99	*/
100	VMMDevReqHypervisorInfo *pReq;
101	int rc = VbglGRAlloc((VMMDevRequestHeader **)&pReq, sizeof(VMMDevReqHypervisorInfo), VMMDevReq_GetHypervisorInfo);
102	if (RT_FAILURE(rc))
103	return rc;
104	pReq->hypervisorStart = 0;
105	pReq->hypervisorSize = 0;
106	rc = VbglGRPerform(&pReq->header);
107	if (RT_FAILURE(rc)) /* this shouldn't happen! */
108	{
109	VbglGRFree(&pReq->header);
110	return rc;
111	}
112
113	/*
114	* The VMM will report back if there is nothing it wants to map, like for
115	* instance in VT-x and AMD-V mode.
116	*/
117	if (pReq->hypervisorSize == 0)
118	Log(("vboxGuestInitFixateGuestMappings: nothing to do\n"));
119	else
120	{
121	/*
122	* We have to try several times since the host can be picky
123	* about certain addresses.
124	*/
125	RTR0MEMOBJ hFictive = NIL_RTR0MEMOBJ;
126	uint32_t cbHypervisor = pReq->hypervisorSize;
127	RTR0MEMOBJ ahTries[5];
128	uint32_t iTry;
129	bool fBitched = false;
130	Log(("vboxGuestInitFixateGuestMappings: cbHypervisor=%#x\n", cbHypervisor));
131	for (iTry = 0; iTry < RT_ELEMENTS(ahTries); iTry++)
132	{
133	/*
134	* Reserve space, or if that isn't supported, create a object for
135	* some fictive physical memory and map that in to kernel space.
136	*
137	* To make the code a bit uglier, most systems cannot help with
138	* 4MB alignment, so we have to deal with that in addition to
139	* having two ways of getting the memory.
140	*/
141	uint32_t uAlignment = _4M;
142	RTR0MEMOBJ hObj;
143	rc = RTR0MemObjReserveKernel(&hObj, (void *)-1, RT_ALIGN_32(cbHypervisor, _4M), uAlignment);
144	if (rc == VERR_NOT_SUPPORTED)
145	{
146	uAlignment = PAGE_SIZE;
147	rc = RTR0MemObjReserveKernel(&hObj, (void *)-1, RT_ALIGN_32(cbHypervisor, _4M) + _4M, uAlignment);
148	}
149	/*
150	* If both RTR0MemObjReserveKernel calls above failed because either not supported or
151	* not implemented at all at the current platform, try to map the memory object into the
152	* virtual kernel space.
153	*/
154	if (rc == VERR_NOT_SUPPORTED)
155	{
156	if (hFictive == NIL_RTR0MEMOBJ)
157	{
158	rc = RTR0MemObjEnterPhys(&hObj, VBOXGUEST_HYPERVISOR_PHYSICAL_START, cbHypervisor + _4M, RTMEM_CACHE_POLICY_DONT_CARE);
159	if (RT_FAILURE(rc))
160	break;
161	hFictive = hObj;
162	}
163	uAlignment = _4M;
164	rc = RTR0MemObjMapKernel(&hObj, hFictive, (void *)-1, uAlignment, RTMEM_PROT_READ \| RTMEM_PROT_WRITE);
165	if (rc == VERR_NOT_SUPPORTED)
166	{
167	uAlignment = PAGE_SIZE;
168	rc = RTR0MemObjMapKernel(&hObj, hFictive, (void *)-1, uAlignment, RTMEM_PROT_READ \| RTMEM_PROT_WRITE);
169	}
170	}
171	if (RT_FAILURE(rc))
172	{
173	LogRel(("VBoxGuest: Failed to reserve memory for the hypervisor: rc=%Rrc (cbHypervisor=%#x uAlignment=%#x iTry=%u)\n",
174	rc, cbHypervisor, uAlignment, iTry));
175	fBitched = true;
176	break;
177	}
178
179	/*
180	* Try set it.
181	*/
182	pReq->header.requestType = VMMDevReq_SetHypervisorInfo;
183	pReq->header.rc = VERR_INTERNAL_ERROR;
184	pReq->hypervisorSize = cbHypervisor;
185	pReq->hypervisorStart = (uintptr_t)RTR0MemObjAddress(hObj);
186	if ( uAlignment == PAGE_SIZE
187	&& pReq->hypervisorStart & (_4M - 1))
188	pReq->hypervisorStart = RT_ALIGN_32(pReq->hypervisorStart, _4M);
189	AssertMsg(RT_ALIGN_32(pReq->hypervisorStart, _4M) == pReq->hypervisorStart, ("%#x\n", pReq->hypervisorStart));
190
191	rc = VbglGRPerform(&pReq->header);
192	if (RT_SUCCESS(rc))
193	{
194	pDevExt->hGuestMappings = hFictive != NIL_RTR0MEMOBJ ? hFictive : hObj;
195	Log(("VBoxGuest: %p LB %#x; uAlignment=%#x iTry=%u hGuestMappings=%p (%s)\n",
196	RTR0MemObjAddress(pDevExt->hGuestMappings),
197	RTR0MemObjSize(pDevExt->hGuestMappings),
198	uAlignment, iTry, pDevExt->hGuestMappings, hFictive != NIL_RTR0PTR ? "fictive" : "reservation"));
199	break;
200	}
201	ahTries[iTry] = hObj;
202	}
203
204	/*
205	* Cleanup failed attempts.
206	*/
207	while (iTry-- > 0)
208	RTR0MemObjFree(ahTries[iTry], false /* fFreeMappings */);
209	if ( RT_FAILURE(rc)
210	&& hFictive != NIL_RTR0PTR)
211	RTR0MemObjFree(hFictive, false /* fFreeMappings */);
212	if (RT_FAILURE(rc) && !fBitched)
213	LogRel(("VBoxGuest: Warning: failed to reserve %#d of memory for guest mappings.\n", cbHypervisor));
214	}
215	VbglGRFree(&pReq->header);
216
217	/*
218	* We ignore failed attempts for now.
219	*/
220	return VINF_SUCCESS;
221	}
222
223
224	/**
225	* Undo what vboxGuestInitFixateGuestMappings did.
226	*
227	* @param pDevExt The device extension.
228	*/
229	static void vboxGuestTermUnfixGuestMappings(PVBOXGUESTDEVEXT pDevExt)
230	{
231	if (pDevExt->hGuestMappings != NIL_RTR0PTR)
232	{
233	/*
234	* Tell the host that we're going to free the memory we reserved for
235	* it, the free it up. (Leak the memory if anything goes wrong here.)
236	*/
237	VMMDevReqHypervisorInfo *pReq;
238	int rc = VbglGRAlloc((VMMDevRequestHeader **)&pReq, sizeof(VMMDevReqHypervisorInfo), VMMDevReq_SetHypervisorInfo);
239	if (RT_SUCCESS(rc))
240	{
241	pReq->hypervisorStart = 0;
242	pReq->hypervisorSize = 0;
243	rc = VbglGRPerform(&pReq->header);
244	VbglGRFree(&pReq->header);
245	}
246	if (RT_SUCCESS(rc))
247	{
248	rc = RTR0MemObjFree(pDevExt->hGuestMappings, true /* fFreeMappings */);
249	AssertRC(rc);
250	}
251	else
252	LogRel(("vboxGuestTermUnfixGuestMappings: Failed to unfix the guest mappings! rc=%Rrc\n", rc));
253
254	pDevExt->hGuestMappings = NIL_RTR0MEMOBJ;
255	}
256	}
257
258
259	/**
260	* Sets the interrupt filter mask during initialization and termination.
261	*
262	* This will ASSUME that we're the ones in carge over the mask, so
263	* we'll simply clear all bits we don't set.
264	*
265	* @returns VBox status code (ignored).
266	* @param pDevExt The device extension.
267	* @param fMask The new mask.
268	*/
269	static int vboxGuestSetFilterMask(PVBOXGUESTDEVEXT pDevExt, uint32_t fMask)
270	{
271	VMMDevCtlGuestFilterMask *pReq;
272	int rc = VbglGRAlloc((VMMDevRequestHeader *)&pReq, sizeof(pReq), VMMDevReq_CtlGuestFilterMask);
273	if (RT_SUCCESS(rc))
274	{
275	pReq->u32OrMask = fMask;
276	pReq->u32NotMask = ~fMask;
277	rc = VbglGRPerform(&pReq->header);
278	if (RT_FAILURE(rc))
279	LogRel(("vboxGuestSetFilterMask: failed with rc=%Rrc\n", rc));
280	VbglGRFree(&pReq->header);
281	}
282	return rc;
283	}
284
285
286	/**
287	* Inflate the balloon by one chunk represented by an R0 memory object.
288	*
289	* The caller owns the balloon mutex.
290	*
291	* @returns IPRT status code.
292	* @param pMemObj Pointer to the R0 memory object.
293	* @param pReq The pre-allocated request for performing the VMMDev call.
294	*/
295	static int vboxGuestBalloonInflate(PRTR0MEMOBJ pMemObj, VMMDevChangeMemBalloon *pReq)
296	{
297	uint32_t iPage;
298	int rc;
299
300	for (iPage = 0; iPage < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; iPage++)
301	{
302	RTHCPHYS phys = RTR0MemObjGetPagePhysAddr(*pMemObj, iPage);
303	pReq->aPhysPage[iPage] = phys;
304	}
305
306	pReq->fInflate = true;
307	pReq->header.size = cbChangeMemBalloonReq;
308	pReq->cPages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
309
310	rc = VbglGRPerform(&pReq->header);
311	if (RT_FAILURE(rc))
312	LogRel(("vboxGuestBalloonInflate: VbglGRPerform failed. rc=%Rrc\n", rc));
313	return rc;
314	}
315
316
317	/**
318	* Deflate the balloon by one chunk - info the host and free the memory object.
319	*
320	* The caller owns the balloon mutex.
321	*
322	* @returns IPRT status code.
323	* @param pMemObj Pointer to the R0 memory object.
324	* The memory object will be freed afterwards.
325	* @param pReq The pre-allocated request for performing the VMMDev call.
326	*/
327	static int vboxGuestBalloonDeflate(PRTR0MEMOBJ pMemObj, VMMDevChangeMemBalloon *pReq)
328	{
329	uint32_t iPage;
330	int rc;
331
332	for (iPage = 0; iPage < VMMDEV_MEMORY_BALLOON_CHUNK_PAGES; iPage++)
333	{
334	RTHCPHYS phys = RTR0MemObjGetPagePhysAddr(*pMemObj, iPage);
335	pReq->aPhysPage[iPage] = phys;
336	}
337
338	pReq->fInflate = false;
339	pReq->header.size = cbChangeMemBalloonReq;
340	pReq->cPages = VMMDEV_MEMORY_BALLOON_CHUNK_PAGES;
341
342	rc = VbglGRPerform(&pReq->header);
343	if (RT_FAILURE(rc))
344	{
345	LogRel(("vboxGuestBalloonDeflate: VbglGRPerform failed. rc=%Rrc\n", rc));
346	return rc;
347	}
348
349	rc = RTR0MemObjFree(*pMemObj, true);
350	if (RT_FAILURE(rc))
351	{
352	LogRel(("vboxGuestBalloonDeflate: RTR0MemObjFree(%p,true) -> %Rrc; this is BAD!\n", *pMemObj, rc));
353	return rc;
354	}
355
356	*pMemObj = NIL_RTR0MEMOBJ;
357	return VINF_SUCCESS;
358	}
359
360
361	/**
362	* Inflate/deflate the memory balloon and notify the host.
363	*
364	* This is a worker used by VBoxGuestCommonIOCtl_CheckMemoryBalloon - it takes
365	* the mutex.
366	*
367	* @returns VBox status code.
368	* @param pDevExt The device extension.
369	* @param pSession The session.
370	* @param cBalloonChunks The new size of the balloon in chunks of 1MB.
371	* @param pfHandleInR3 Where to return the handle-in-ring3 indicator
372	* (VINF_SUCCESS if set).
373	*/
374	static int vboxGuestSetBalloonSizeKernel(PVBOXGUESTDEVEXT pDevExt, uint32_t cBalloonChunks, uint32_t *pfHandleInR3)
375	{
376	int rc = VINF_SUCCESS;
377
378	if (pDevExt->MemBalloon.fUseKernelAPI)
379	{
380	VMMDevChangeMemBalloon *pReq;
381	uint32_t i;
382
383	if (cBalloonChunks > pDevExt->MemBalloon.cMaxChunks)
384	{
385	LogRel(("vboxGuestSetBalloonSizeKernel: illegal balloon size %u (max=%u)\n",
386	cBalloonChunks, pDevExt->MemBalloon.cMaxChunks));
387	return VERR_INVALID_PARAMETER;
388	}
389
390	if (cBalloonChunks == pDevExt->MemBalloon.cMaxChunks)
391	return VINF_SUCCESS; /* nothing to do */
392
393	if ( cBalloonChunks > pDevExt->MemBalloon.cChunks
394	&& !pDevExt->MemBalloon.paMemObj)
395	{
396	pDevExt->MemBalloon.paMemObj = (PRTR0MEMOBJ)RTMemAllocZ(sizeof(RTR0MEMOBJ) * pDevExt->MemBalloon.cMaxChunks);
397	if (!pDevExt->MemBalloon.paMemObj)
398	{
399	LogRel(("VBoxGuestSetBalloonSizeKernel: no memory for paMemObj!\n"));
400	return VERR_NO_MEMORY;
401	}
402	}
403
404	rc = VbglGRAlloc((VMMDevRequestHeader **)&pReq, cbChangeMemBalloonReq, VMMDevReq_ChangeMemBalloon);
405	if (RT_FAILURE(rc))
406	return rc;
407
408	if (cBalloonChunks > pDevExt->MemBalloon.cChunks)
409	{
410	/* inflate */
411	for (i = pDevExt->MemBalloon.cChunks; i < cBalloonChunks; i++)
412	{
413	rc = RTR0MemObjAllocPhysNC(&pDevExt->MemBalloon.paMemObj[i],
414	VMMDEV_MEMORY_BALLOON_CHUNK_SIZE, NIL_RTHCPHYS);
415	if (RT_FAILURE(rc))
416	{
417	if (rc == VERR_NOT_SUPPORTED)
418	{
419	/* not supported -- fall back to the R3-allocated memory. */
420	rc = VINF_SUCCESS;
421	pDevExt->MemBalloon.fUseKernelAPI = false;
422	Assert(pDevExt->MemBalloon.cChunks == 0);
423	Log(("VBoxGuestSetBalloonSizeKernel: PhysNC allocs not supported, falling back to R3 allocs.\n"));
424	}
425	/* else if (rc == VERR_NO_MEMORY \|\| rc == VERR_NO_PHYS_MEMORY):
426	* cannot allocate more memory => don't try further, just stop here */
427	/* else: XXX what else can fail? VERR_MEMOBJ_INIT_FAILED for instance. just stop. */
428	break;
429	}
430
431	rc = vboxGuestBalloonInflate(&pDevExt->MemBalloon.paMemObj[i], pReq);
432	if (RT_FAILURE(rc))
433	{
434	Log(("vboxGuestSetBalloonSize(inflate): failed, rc=%Rrc!\n", rc));
435	RTR0MemObjFree(pDevExt->MemBalloon.paMemObj[i], true);
436	pDevExt->MemBalloon.paMemObj[i] = NIL_RTR0MEMOBJ;
437	break;
438	}
439	pDevExt->MemBalloon.cChunks++;
440	}
441	}
442	else
443	{
444	/* deflate */
445	for (i = pDevExt->MemBalloon.cChunks; i-- > cBalloonChunks;)
446	{
447	rc = vboxGuestBalloonDeflate(&pDevExt->MemBalloon.paMemObj[i], pReq);
448	if (RT_FAILURE(rc))
449	{
450	Log(("vboxGuestSetBalloonSize(deflate): failed, rc=%Rrc!\n", rc));
451	break;
452	}
453	pDevExt->MemBalloon.cChunks--;
454	}
455	}
456
457	VbglGRFree(&pReq->header);
458	}
459
460	/*
461	* Set the handle-in-ring3 indicator. When set Ring-3 will have to work
462	* the balloon changes via the other API.
463	*/
464	*pfHandleInR3 = pDevExt->MemBalloon.fUseKernelAPI ? false : true;
465
466	return rc;
467	}
468
469
470	/**
471	* Helper to reinit the VBoxVMM communication after hibernation.
472	*
473	* @returns VBox status code.
474	* @param pDevExt The device extension.
475	* @param enmOSType The OS type.
476	*/
477	int VBoxGuestReinitDevExtAfterHibernation(PVBOXGUESTDEVEXT pDevExt, VBOXOSTYPE enmOSType)
478	{
479	int rc = VBoxGuestReportGuestInfo(enmOSType);
480	if (RT_SUCCESS(rc))
481	{
482	rc = VBoxGuestReportDriverStatus(true /* Driver is active */);
483	if (RT_FAILURE(rc))
484	Log(("VBoxGuest::VBoxGuestReinitDevExtAfterHibernation: could not report guest driver status, rc=%Rrc\n", rc));
485	}
486	else
487	Log(("VBoxGuest::VBoxGuestReinitDevExtAfterHibernation: could not report guest information to host, rc=%Rrc\n", rc));
488	Log(("VBoxGuest::VBoxGuestReinitDevExtAfterHibernation: returned with rc=%Rrc\n", rc));
489	return rc;
490	}
491
492
493	/**
494	* Inflate/deflate the balloon by one chunk.
495	*
496	* Worker for VBoxGuestCommonIOCtl_ChangeMemoryBalloon - it takes the mutex.
497	*
498	* @returns VBox status code.
499	* @param pDevExt The device extension.
500	* @param pSession The session.
501	* @param u64ChunkAddr The address of the chunk to add to / remove from the
502	* balloon.
503	* @param fInflate Inflate if true, deflate if false.
504	*/
505	static int vboxGuestSetBalloonSizeFromUser(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
506	uint64_t u64ChunkAddr, bool fInflate)
507	{
508	VMMDevChangeMemBalloon *pReq;
509	int rc = VINF_SUCCESS;
510	uint32_t i;
511	PRTR0MEMOBJ pMemObj = NULL;
512
513	if (fInflate)
514	{
515	if ( pDevExt->MemBalloon.cChunks > pDevExt->MemBalloon.cMaxChunks - 1
516	\|\| pDevExt->MemBalloon.cMaxChunks == 0 /* If called without first querying. */)
517	{
518	LogRel(("vboxGuestSetBalloonSize: cannot inflate balloon, already have %u chunks (max=%u)\n",
519	pDevExt->MemBalloon.cChunks, pDevExt->MemBalloon.cMaxChunks));
520	return VERR_INVALID_PARAMETER;
521	}
522
523	if (!pDevExt->MemBalloon.paMemObj)
524	{
525	pDevExt->MemBalloon.paMemObj = (PRTR0MEMOBJ)RTMemAlloc(sizeof(RTR0MEMOBJ) * pDevExt->MemBalloon.cMaxChunks);
526	if (!pDevExt->MemBalloon.paMemObj)
527	{
528	LogRel(("VBoxGuestSetBalloonSizeFromUser: no memory for paMemObj!\n"));
529	return VERR_NO_MEMORY;
530	}
531	for (i = 0; i < pDevExt->MemBalloon.cMaxChunks; i++)
532	pDevExt->MemBalloon.paMemObj[i] = NIL_RTR0MEMOBJ;
533	}
534	}
535	else
536	{
537	if (pDevExt->MemBalloon.cChunks == 0)
538	{
539	AssertMsgFailed(("vboxGuestSetBalloonSize: cannot decrease balloon, already at size 0\n"));
540	return VERR_INVALID_PARAMETER;
541	}
542	}
543
544	/*
545	* Enumerate all memory objects and check if the object is already registered.
546	*/
547	for (i = 0; i < pDevExt->MemBalloon.cMaxChunks; i++)
548	{
549	if ( fInflate
550	&& !pMemObj
551	&& pDevExt->MemBalloon.paMemObj[i] == NIL_RTR0MEMOBJ)
552	pMemObj = &pDevExt->MemBalloon.paMemObj[i]; /* found free object pointer */
553	if (RTR0MemObjAddressR3(pDevExt->MemBalloon.paMemObj[i]) == u64ChunkAddr)
554	{
555	if (fInflate)
556	return VERR_ALREADY_EXISTS; /* don't provide the same memory twice */
557	pMemObj = &pDevExt->MemBalloon.paMemObj[i];
558	break;
559	}
560	}
561	if (!pMemObj)
562	{
563	if (fInflate)
564	{
565	/* no free object pointer found -- should not happen */
566	return VERR_NO_MEMORY;
567	}
568
569	/* cannot free this memory as it wasn't provided before */
570	return VERR_NOT_FOUND;
571	}
572
573	/*
574	* Try inflate / default the balloon as requested.
575	*/
576	rc = VbglGRAlloc((VMMDevRequestHeader **)&pReq, cbChangeMemBalloonReq, VMMDevReq_ChangeMemBalloon);
577	if (RT_FAILURE(rc))
578	return rc;
579
580	if (fInflate)
581	{
582	rc = RTR0MemObjLockUser(pMemObj, u64ChunkAddr, VMMDEV_MEMORY_BALLOON_CHUNK_SIZE,
583	RTMEM_PROT_READ \| RTMEM_PROT_WRITE, NIL_RTR0PROCESS);
584	if (RT_SUCCESS(rc))
585	{
586	rc = vboxGuestBalloonInflate(pMemObj, pReq);
587	if (RT_SUCCESS(rc))
588	pDevExt->MemBalloon.cChunks++;
589	else
590	{
591	Log(("vboxGuestSetBalloonSize(inflate): failed, rc=%Rrc!\n", rc));
592	RTR0MemObjFree(*pMemObj, true);
593	*pMemObj = NIL_RTR0MEMOBJ;
594	}
595	}
596	}
597	else
598	{
599	rc = vboxGuestBalloonDeflate(pMemObj, pReq);
600	if (RT_SUCCESS(rc))
601	pDevExt->MemBalloon.cChunks--;
602	else
603	Log(("vboxGuestSetBalloonSize(deflate): failed, rc=%Rrc!\n", rc));
604	}
605
606	VbglGRFree(&pReq->header);
607	return rc;
608	}
609
610
611	/**
612	* Cleanup the memory balloon of a session.
613	*
614	* Will request the balloon mutex, so it must be valid and the caller must not
615	* own it already.
616	*
617	* @param pDevExt The device extension.
618	* @param pDevExt The session. Can be NULL at unload.
619	*/
620	static void vboxGuestCloseMemBalloon(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
621	{
622	RTSemFastMutexRequest(pDevExt->MemBalloon.hMtx);
623	if ( pDevExt->MemBalloon.pOwner == pSession
624	\|\| pSession == NULL /unload/)
625	{
626	if (pDevExt->MemBalloon.paMemObj)
627	{
628	VMMDevChangeMemBalloon *pReq;
629	int rc = VbglGRAlloc((VMMDevRequestHeader **)&pReq, cbChangeMemBalloonReq, VMMDevReq_ChangeMemBalloon);
630	if (RT_SUCCESS(rc))
631	{
632	uint32_t i;
633	for (i = pDevExt->MemBalloon.cChunks; i-- > 0;)
634	{
635	rc = vboxGuestBalloonDeflate(&pDevExt->MemBalloon.paMemObj[i], pReq);
636	if (RT_FAILURE(rc))
637	{
638	LogRel(("vboxGuestCloseMemBalloon: Deflate failed with rc=%Rrc. Will leak %u chunks.\n",
639	rc, pDevExt->MemBalloon.cChunks));
640	break;
641	}
642	pDevExt->MemBalloon.paMemObj[i] = NIL_RTR0MEMOBJ;
643	pDevExt->MemBalloon.cChunks--;
644	}
645	VbglGRFree(&pReq->header);
646	}
647	else
648	LogRel(("vboxGuestCloseMemBalloon: Failed to allocate VMMDev request buffer (rc=%Rrc). Will leak %u chunks.\n",
649	rc, pDevExt->MemBalloon.cChunks));
650	RTMemFree(pDevExt->MemBalloon.paMemObj);
651	pDevExt->MemBalloon.paMemObj = NULL;
652	}
653
654	pDevExt->MemBalloon.pOwner = NULL;
655	}
656	RTSemFastMutexRelease(pDevExt->MemBalloon.hMtx);
657	}
658
659
660	/**
661	* Initializes the VBoxGuest device extension when the
662	* device driver is loaded.
663	*
664	* The native code locates the VMMDev on the PCI bus and retrieve
665	* the MMIO and I/O port ranges, this function will take care of
666	* mapping the MMIO memory (if present). Upon successful return
667	* the native code should set up the interrupt handler.
668	*
669	* @returns VBox status code.
670	*
671	* @param pDevExt The device extension. Allocated by the native code.
672	* @param IOPortBase The base of the I/O port range.
673	* @param pvMMIOBase The base of the MMIO memory mapping.
674	* This is optional, pass NULL if not present.
675	* @param cbMMIO The size of the MMIO memory mapping.
676	* This is optional, pass 0 if not present.
677	* @param enmOSType The guest OS type to report to the VMMDev.
678	* @param fFixedEvents Events that will be enabled upon init and no client
679	* will ever be allowed to mask.
680	*/
681	int VBoxGuestInitDevExt(PVBOXGUESTDEVEXT pDevExt, uint16_t IOPortBase,
682	void *pvMMIOBase, uint32_t cbMMIO, VBOXOSTYPE enmOSType, uint32_t fFixedEvents)
683	{
684	int rc, rc2;
685
686	/*
687	* Adjust fFixedEvents.
688	*/
689	#ifdef VBOX_WITH_HGCM
690	fFixedEvents \|= VMMDEV_EVENT_HGCM;
691	#endif
692
693	/*
694	* Initialize the data.
695	*/
696	pDevExt->IOPortBase = IOPortBase;
697	pDevExt->pVMMDevMemory = NULL;
698	pDevExt->fFixedEvents = fFixedEvents;
699	pDevExt->hGuestMappings = NIL_RTR0MEMOBJ;
700	pDevExt->EventSpinlock = NIL_RTSPINLOCK;
701	pDevExt->pIrqAckEvents = NULL;
702	pDevExt->PhysIrqAckEvents = NIL_RTCCPHYS;
703	RTListInit(&pDevExt->WaitList);
704	#ifdef VBOX_WITH_HGCM
705	RTListInit(&pDevExt->HGCMWaitList);
706	#endif
707	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
708	RTListInit(&pDevExt->WakeUpList);
709	#endif
710	RTListInit(&pDevExt->WokenUpList);
711	RTListInit(&pDevExt->FreeList);
712	#ifdef VBOX_WITH_VRDP_SESSION_HANDLING
713	pDevExt->fVRDPEnabled = false;
714	#endif
715	pDevExt->fLoggingEnabled = false;
716	pDevExt->f32PendingEvents = 0;
717	pDevExt->u32MousePosChangedSeq = 0;
718	pDevExt->SessionSpinlock = NIL_RTSPINLOCK;
719	pDevExt->MemBalloon.hMtx = NIL_RTSEMFASTMUTEX;
720	pDevExt->MemBalloon.cChunks = 0;
721	pDevExt->MemBalloon.cMaxChunks = 0;
722	pDevExt->MemBalloon.fUseKernelAPI = true;
723	pDevExt->MemBalloon.paMemObj = NULL;
724	pDevExt->MemBalloon.pOwner = NULL;
725
726	/*
727	* If there is an MMIO region validate the version and size.
728	*/
729	if (pvMMIOBase)
730	{
731	VMMDevMemory pVMMDev = (VMMDevMemory )pvMMIOBase;
732	Assert(cbMMIO);
733	if ( pVMMDev->u32Version == VMMDEV_MEMORY_VERSION
734	&& pVMMDev->u32Size >= 32
735	&& pVMMDev->u32Size <= cbMMIO)
736	{
737	pDevExt->pVMMDevMemory = pVMMDev;
738	Log(("VBoxGuestInitDevExt: VMMDevMemory: mapping=%p size=%#RX32 (%#RX32) version=%#RX32\n",
739	pVMMDev, pVMMDev->u32Size, cbMMIO, pVMMDev->u32Version));
740	}
741	else /* try live without it. */
742	LogRel(("VBoxGuestInitDevExt: Bogus VMMDev memory; u32Version=%RX32 (expected %RX32) u32Size=%RX32 (expected <= %RX32)\n",
743	pVMMDev->u32Version, VMMDEV_MEMORY_VERSION, pVMMDev->u32Size, cbMMIO));
744	}
745
746	/*
747	* Create the wait and session spinlocks as well as the ballooning mutex.
748	*/
749	rc = RTSpinlockCreate(&pDevExt->EventSpinlock, RTSPINLOCK_FLAGS_INTERRUPT_SAFE, "VBoxGuestEvent");
750	if (RT_SUCCESS(rc))
751	rc = RTSpinlockCreate(&pDevExt->SessionSpinlock, RTSPINLOCK_FLAGS_INTERRUPT_SAFE, "VBoxGuestSession");
752	if (RT_FAILURE(rc))
753	{
754	LogRel(("VBoxGuestInitDevExt: failed to create spinlock, rc=%Rrc!\n", rc));
755	if (pDevExt->EventSpinlock != NIL_RTSPINLOCK)
756	RTSpinlockDestroy(pDevExt->EventSpinlock);
757	return rc;
758	}
759
760	rc = RTSemFastMutexCreate(&pDevExt->MemBalloon.hMtx);
761	if (RT_FAILURE(rc))
762	{
763	LogRel(("VBoxGuestInitDevExt: failed to create mutex, rc=%Rrc!\n", rc));
764	RTSpinlockDestroy(pDevExt->SessionSpinlock);
765	RTSpinlockDestroy(pDevExt->EventSpinlock);
766	return rc;
767	}
768
769	/*
770	* Initialize the guest library and report the guest info back to VMMDev,
771	* set the interrupt control filter mask, and fixate the guest mappings
772	* made by the VMM.
773	*/
774	rc = VbglInit(pDevExt->IOPortBase, (VMMDevMemory *)pDevExt->pVMMDevMemory);
775	if (RT_SUCCESS(rc))
776	{
777	rc = VbglGRAlloc((VMMDevRequestHeader **)&pDevExt->pIrqAckEvents, sizeof(VMMDevEvents), VMMDevReq_AcknowledgeEvents);
778	if (RT_SUCCESS(rc))
779	{
780	pDevExt->PhysIrqAckEvents = VbglPhysHeapGetPhysAddr(pDevExt->pIrqAckEvents);
781	Assert(pDevExt->PhysIrqAckEvents != 0);
782
783	rc = VBoxGuestReportGuestInfo(enmOSType);
784	if (RT_SUCCESS(rc))
785	{
786	rc = vboxGuestSetFilterMask(pDevExt, fFixedEvents);
787	if (RT_SUCCESS(rc))
788	{
789	/*
790	* Disable guest graphics capability by default. The guest specific
791	* graphics driver will re-enable this when it is necessary.
792	*/
793	rc = VBoxGuestSetGuestCapabilities(0, VMMDEV_GUEST_SUPPORTS_GRAPHICS);
794	if (RT_SUCCESS(rc))
795	{
796	vboxGuestInitFixateGuestMappings(pDevExt);
797
798	#ifdef DEBUG
799	testSetMouseStatus(); /* Other tests? */
800	#endif
801
802	rc = VBoxGuestReportDriverStatus(true /* Driver is active */);
803	if (RT_FAILURE(rc))
804	LogRel(("VBoxGuestInitDevExt: VBoxReportGuestDriverStatus failed, rc=%Rrc\n", rc));
805
806	Log(("VBoxGuestInitDevExt: returns success\n"));
807	return VINF_SUCCESS;
808	}
809
810	LogRel(("VBoxGuestInitDevExt: VBoxGuestSetGuestCapabilities failed, rc=%Rrc\n", rc));
811	}
812	else
813	LogRel(("VBoxGuestInitDevExt: vboxGuestSetFilterMask failed, rc=%Rrc\n", rc));
814	}
815	else
816	LogRel(("VBoxGuestInitDevExt: VBoxReportGuestInfo failed, rc=%Rrc\n", rc));
817	VbglGRFree((VMMDevRequestHeader *)pDevExt->pIrqAckEvents);
818	}
819	else
820	LogRel(("VBoxGuestInitDevExt: VBoxGRAlloc failed, rc=%Rrc\n", rc));
821
822	VbglTerminate();
823	}
824	else
825	LogRel(("VBoxGuestInitDevExt: VbglInit failed, rc=%Rrc\n", rc));
826
827	rc2 = RTSemFastMutexDestroy(pDevExt->MemBalloon.hMtx); AssertRC(rc2);
828	rc2 = RTSpinlockDestroy(pDevExt->EventSpinlock); AssertRC(rc2);
829	rc2 = RTSpinlockDestroy(pDevExt->SessionSpinlock); AssertRC(rc2);
830	return rc; /* (failed) */
831	}
832
833
834	/**
835	* Deletes all the items in a wait chain.
836	* @param pList The head of the chain.
837	*/
838	static void VBoxGuestDeleteWaitList(PRTLISTNODE pList)
839	{
840	while (!RTListIsEmpty(pList))
841	{
842	int rc2;
843	PVBOXGUESTWAIT pWait = RTListGetFirst(pList, VBOXGUESTWAIT, ListNode);
844	RTListNodeRemove(&pWait->ListNode);
845
846	rc2 = RTSemEventMultiDestroy(pWait->Event); AssertRC(rc2);
847	pWait->Event = NIL_RTSEMEVENTMULTI;
848	pWait->pSession = NULL;
849	RTMemFree(pWait);
850	}
851	}
852
853
854	/**
855	* Destroys the VBoxGuest device extension.
856	*
857	* The native code should call this before the driver is loaded,
858	* but don't call this on shutdown.
859	*
860	* @param pDevExt The device extension.
861	*/
862	void VBoxGuestDeleteDevExt(PVBOXGUESTDEVEXT pDevExt)
863	{
864	int rc2;
865	Log(("VBoxGuestDeleteDevExt:\n"));
866	Log(("VBoxGuest: The additions driver is terminating.\n"));
867
868	/*
869	* Clean up the bits that involves the host first.
870	*/
871	vboxGuestTermUnfixGuestMappings(pDevExt);
872	VBoxGuestSetGuestCapabilities(0, UINT32_MAX); /* clears all capabilities */
873	vboxGuestSetFilterMask(pDevExt, 0); /* filter all events */
874	vboxGuestCloseMemBalloon(pDevExt, (PVBOXGUESTSESSION)NULL);
875
876	/*
877	* Cleanup all the other resources.
878	*/
879	rc2 = RTSpinlockDestroy(pDevExt->EventSpinlock); AssertRC(rc2);
880	rc2 = RTSpinlockDestroy(pDevExt->SessionSpinlock); AssertRC(rc2);
881	rc2 = RTSemFastMutexDestroy(pDevExt->MemBalloon.hMtx); AssertRC(rc2);
882
883	VBoxGuestDeleteWaitList(&pDevExt->WaitList);
884	#ifdef VBOX_WITH_HGCM
885	VBoxGuestDeleteWaitList(&pDevExt->HGCMWaitList);
886	#endif
887	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
888	VBoxGuestDeleteWaitList(&pDevExt->WakeUpList);
889	#endif
890	VBoxGuestDeleteWaitList(&pDevExt->WokenUpList);
891	VBoxGuestDeleteWaitList(&pDevExt->FreeList);
892
893	VbglTerminate();
894
895	pDevExt->pVMMDevMemory = NULL;
896
897	pDevExt->IOPortBase = 0;
898	pDevExt->pIrqAckEvents = NULL;
899	}
900
901
902	/**
903	* Creates a VBoxGuest user session.
904	*
905	* The native code calls this when a ring-3 client opens the device.
906	* Use VBoxGuestCreateKernelSession when a ring-0 client connects.
907	*
908	* @returns VBox status code.
909	* @param pDevExt The device extension.
910	* @param ppSession Where to store the session on success.
911	*/
912	int VBoxGuestCreateUserSession(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION *ppSession)
913	{
914	PVBOXGUESTSESSION pSession = (PVBOXGUESTSESSION)RTMemAllocZ(sizeof(*pSession));
915	if (RT_UNLIKELY(!pSession))
916	{
917	LogRel(("VBoxGuestCreateUserSession: no memory!\n"));
918	return VERR_NO_MEMORY;
919	}
920
921	pSession->Process = RTProcSelf();
922	pSession->R0Process = RTR0ProcHandleSelf();
923	pSession->pDevExt = pDevExt;
924
925	*ppSession = pSession;
926	LogFlow(("VBoxGuestCreateUserSession: pSession=%p proc=%RTproc (%d) r0proc=%p\n",
927	pSession, pSession->Process, (int)pSession->Process, (uintptr_t)pSession->R0Process)); /** @todo %RTr0proc */
928	return VINF_SUCCESS;
929	}
930
931
932	/**
933	* Creates a VBoxGuest kernel session.
934	*
935	* The native code calls this when a ring-0 client connects to the device.
936	* Use VBoxGuestCreateUserSession when a ring-3 client opens the device.
937	*
938	* @returns VBox status code.
939	* @param pDevExt The device extension.
940	* @param ppSession Where to store the session on success.
941	*/
942	int VBoxGuestCreateKernelSession(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION *ppSession)
943	{
944	PVBOXGUESTSESSION pSession = (PVBOXGUESTSESSION)RTMemAllocZ(sizeof(*pSession));
945	if (RT_UNLIKELY(!pSession))
946	{
947	LogRel(("VBoxGuestCreateKernelSession: no memory!\n"));
948	return VERR_NO_MEMORY;
949	}
950
951	pSession->Process = NIL_RTPROCESS;
952	pSession->R0Process = NIL_RTR0PROCESS;
953	pSession->pDevExt = pDevExt;
954
955	*ppSession = pSession;
956	LogFlow(("VBoxGuestCreateKernelSession: pSession=%p proc=%RTproc (%d) r0proc=%p\n",
957	pSession, pSession->Process, (int)pSession->Process, (uintptr_t)pSession->R0Process)); /** @todo %RTr0proc */
958	return VINF_SUCCESS;
959	}
960
961
962
963	/**
964	* Closes a VBoxGuest session.
965	*
966	* @param pDevExt The device extension.
967	* @param pSession The session to close (and free).
968	*/
969	void VBoxGuestCloseSession(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
970	{
971	unsigned i; NOREF(i);
972	Log(("VBoxGuestCloseSession: pSession=%p proc=%RTproc (%d) r0proc=%p\n",
973	pSession, pSession->Process, (int)pSession->Process, (uintptr_t)pSession->R0Process)); /** @todo %RTr0proc */
974
975	#ifdef VBOX_WITH_HGCM
976	for (i = 0; i < RT_ELEMENTS(pSession->aHGCMClientIds); i++)
977	if (pSession->aHGCMClientIds[i])
978	{
979	VBoxGuestHGCMDisconnectInfo Info;
980	Info.result = 0;
981	Info.u32ClientID = pSession->aHGCMClientIds[i];
982	pSession->aHGCMClientIds[i] = 0;
983	Log(("VBoxGuestCloseSession: disconnecting client id %#RX32\n", Info.u32ClientID));
984	VbglR0HGCMInternalDisconnect(&Info, VBoxGuestHGCMAsyncWaitCallback, pDevExt, RT_INDEFINITE_WAIT);
985	}
986	#endif
987
988	pSession->pDevExt = NULL;
989	pSession->Process = NIL_RTPROCESS;
990	pSession->R0Process = NIL_RTR0PROCESS;
991	vboxGuestCloseMemBalloon(pDevExt, pSession);
992	/* Reset any mouse status flags which the session may have set. */
993	VBoxGuestCommonIOCtl_SetMouseStatus(pDevExt, pSession, 0);
994	RTMemFree(pSession);
995	}
996
997
998	/**
999	* Allocates a wait-for-event entry.
1000	*
1001	* @returns The wait-for-event entry.
1002	* @param pDevExt The device extension.
1003	* @param pSession The session that's allocating this. Can be NULL.
1004	*/
1005	static PVBOXGUESTWAIT VBoxGuestWaitAlloc(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
1006	{
1007	/*
1008	* Allocate it one way or the other.
1009	*/
1010	PVBOXGUESTWAIT pWait = RTListGetFirst(&pDevExt->FreeList, VBOXGUESTWAIT, ListNode);
1011	if (pWait)
1012	{
1013	RTSpinlockAcquire(pDevExt->EventSpinlock);
1014
1015	pWait = RTListGetFirst(&pDevExt->FreeList, VBOXGUESTWAIT, ListNode);
1016	if (pWait)
1017	RTListNodeRemove(&pWait->ListNode);
1018
1019	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
1020	}
1021	if (!pWait)
1022	{
1023	static unsigned s_cErrors = 0;
1024	int rc;
1025
1026	pWait = (PVBOXGUESTWAIT)RTMemAlloc(sizeof(*pWait));
1027	if (!pWait)
1028	{
1029	if (s_cErrors++ < 32)
1030	LogRel(("VBoxGuestWaitAlloc: out-of-memory!\n"));
1031	return NULL;
1032	}
1033
1034	rc = RTSemEventMultiCreate(&pWait->Event);
1035	if (RT_FAILURE(rc))
1036	{
1037	if (s_cErrors++ < 32)
1038	LogRel(("VBoxGuestCommonIOCtl: RTSemEventMultiCreate failed with rc=%Rrc!\n", rc));
1039	RTMemFree(pWait);
1040	return NULL;
1041	}
1042
1043	pWait->ListNode.pNext = NULL;
1044	pWait->ListNode.pPrev = NULL;
1045	}
1046
1047	/*
1048	* Zero members just as an precaution.
1049	*/
1050	pWait->fReqEvents = 0;
1051	pWait->fResEvents = 0;
1052	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
1053	pWait->fPendingWakeUp = false;
1054	pWait->fFreeMe = false;
1055	#endif
1056	pWait->pSession = pSession;
1057	#ifdef VBOX_WITH_HGCM
1058	pWait->pHGCMReq = NULL;
1059	#endif
1060	RTSemEventMultiReset(pWait->Event);
1061	return pWait;
1062	}
1063
1064
1065	/**
1066	* Frees the wait-for-event entry.
1067	*
1068	* The caller must own the wait spinlock !
1069	* The entry must be in a list!
1070	*
1071	* @param pDevExt The device extension.
1072	* @param pWait The wait-for-event entry to free.
1073	*/
1074	static void VBoxGuestWaitFreeLocked(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTWAIT pWait)
1075	{
1076	pWait->fReqEvents = 0;
1077	pWait->fResEvents = 0;
1078	#ifdef VBOX_WITH_HGCM
1079	pWait->pHGCMReq = NULL;
1080	#endif
1081	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
1082	Assert(!pWait->fFreeMe);
1083	if (pWait->fPendingWakeUp)
1084	pWait->fFreeMe = true;
1085	else
1086	#endif
1087	{
1088	RTListNodeRemove(&pWait->ListNode);
1089	RTListAppend(&pDevExt->FreeList, &pWait->ListNode);
1090	}
1091	}
1092
1093
1094	/**
1095	* Frees the wait-for-event entry.
1096	*
1097	* @param pDevExt The device extension.
1098	* @param pWait The wait-for-event entry to free.
1099	*/
1100	static void VBoxGuestWaitFreeUnlocked(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTWAIT pWait)
1101	{
1102	RTSpinlockAcquire(pDevExt->EventSpinlock);
1103	VBoxGuestWaitFreeLocked(pDevExt, pWait);
1104	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
1105	}
1106
1107
1108	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
1109	/**
1110	* Processes the wake-up list.
1111	*
1112	* All entries in the wake-up list gets signalled and moved to the woken-up
1113	* list.
1114	*
1115	* @param pDevExt The device extension.
1116	*/
1117	void VBoxGuestWaitDoWakeUps(PVBOXGUESTDEVEXT pDevExt)
1118	{
1119	if (!RTListIsEmpty(&pDevExt->WakeUpList))
1120	{
1121	RTSpinlockAcquire(pDevExt->EventSpinlock);
1122	for (;;)
1123	{
1124	int rc;
1125	PVBOXGUESTWAIT pWait = RTListGetFirst(&pDevExt->WakeUpList, VBOXGUESTWAIT, ListNode);
1126	if (!pWait)
1127	break;
1128	pWait->fPendingWakeUp = true;
1129	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
1130
1131	rc = RTSemEventMultiSignal(pWait->Event);
1132	AssertRC(rc);
1133
1134	RTSpinlockAcquire(pDevExt->EventSpinlock);
1135	pWait->fPendingWakeUp = false;
1136	if (!pWait->fFreeMe)
1137	{
1138	RTListNodeRemove(&pWait->ListNode);
1139	RTListAppend(&pDevExt->WokenUpList, &pWait->ListNode);
1140	}
1141	else
1142	{
1143	pWait->fFreeMe = false;
1144	VBoxGuestWaitFreeLocked(pDevExt, pWait);
1145	}
1146	}
1147	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
1148	}
1149	}
1150	#endif /* VBOXGUEST_USE_DEFERRED_WAKE_UP */
1151
1152
1153	/**
1154	* Modifies the guest capabilities.
1155	*
1156	* Should be called during driver init and termination.
1157	*
1158	* @returns VBox status code.
1159	* @param fOr The Or mask (what to enable).
1160	* @param fNot The Not mask (what to disable).
1161	*/
1162	int VBoxGuestSetGuestCapabilities(uint32_t fOr, uint32_t fNot)
1163	{
1164	VMMDevReqGuestCapabilities2 *pReq;
1165	int rc = VbglGRAlloc((VMMDevRequestHeader *)&pReq, sizeof(pReq), VMMDevReq_SetGuestCapabilities);
1166	if (RT_FAILURE(rc))
1167	{
1168	Log(("VBoxGuestSetGuestCapabilities: failed to allocate %u (%#x) bytes to cache the request. rc=%Rrc!!\n",
1169	sizeof(pReq), sizeof(pReq), rc));
1170	return rc;
1171	}
1172
1173	pReq->u32OrMask = fOr;
1174	pReq->u32NotMask = fNot;
1175
1176	rc = VbglGRPerform(&pReq->header);
1177	if (RT_FAILURE(rc))
1178	Log(("VBoxGuestSetGuestCapabilities: VbglGRPerform failed, rc=%Rrc!\n", rc));
1179
1180	VbglGRFree(&pReq->header);
1181	return rc;
1182	}
1183
1184
1185	/**
1186	* Implements the fast (no input or output) type of IOCtls.
1187	*
1188	* This is currently just a placeholder stub inherited from the support driver code.
1189	*
1190	* @returns VBox status code.
1191	* @param iFunction The IOCtl function number.
1192	* @param pDevExt The device extension.
1193	* @param pSession The session.
1194	*/
1195	int VBoxGuestCommonIOCtlFast(unsigned iFunction, PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
1196	{
1197	Log(("VBoxGuestCommonIOCtlFast: iFunction=%#x pDevExt=%p pSession=%p\n", iFunction, pDevExt, pSession));
1198
1199	NOREF(iFunction);
1200	NOREF(pDevExt);
1201	NOREF(pSession);
1202	return VERR_NOT_SUPPORTED;
1203	}
1204
1205
1206	/**
1207	* Return the VMM device port.
1208	*
1209	* returns IPRT status code.
1210	* @param pDevExt The device extension.
1211	* @param pInfo The request info.
1212	* @param pcbDataReturned (out) contains the number of bytes to return.
1213	*/
1214	static int VBoxGuestCommonIOCtl_GetVMMDevPort(PVBOXGUESTDEVEXT pDevExt, VBoxGuestPortInfo pInfo, size_t pcbDataReturned)
1215	{
1216	Log(("VBoxGuestCommonIOCtl: GETVMMDEVPORT\n"));
1217	pInfo->portAddress = pDevExt->IOPortBase;
1218	pInfo->pVMMDevMemory = (VMMDevMemory *)pDevExt->pVMMDevMemory;
1219	if (pcbDataReturned)
1220	pcbDataReturned = sizeof(pInfo);
1221	return VINF_SUCCESS;
1222	}
1223
1224
1225	/**
1226	* Worker VBoxGuestCommonIOCtl_WaitEvent.
1227	*
1228	* The caller enters the spinlock, we leave it.
1229	*
1230	* @returns VINF_SUCCESS if we've left the spinlock and can return immediately.
1231	*/
1232	DECLINLINE(int) WaitEventCheckCondition(PVBOXGUESTDEVEXT pDevExt, VBoxGuestWaitEventInfo *pInfo,
1233	int iEvent, const uint32_t fReqEvents)
1234	{
1235	uint32_t fMatches = pDevExt->f32PendingEvents & fReqEvents;
1236	if (fMatches)
1237	{
1238	ASMAtomicAndU32(&pDevExt->f32PendingEvents, ~fMatches);
1239	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
1240
1241	pInfo->u32EventFlagsOut = fMatches;
1242	pInfo->u32Result = VBOXGUEST_WAITEVENT_OK;
1243	if (fReqEvents & ~((uint32_t)1 << iEvent))
1244	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns %#x\n", pInfo->u32EventFlagsOut));
1245	else
1246	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns %#x/%d\n", pInfo->u32EventFlagsOut, iEvent));
1247	return VINF_SUCCESS;
1248	}
1249	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
1250	return VERR_TIMEOUT;
1251	}
1252
1253
1254	static int VBoxGuestCommonIOCtl_WaitEvent(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
1255	VBoxGuestWaitEventInfo pInfo, size_t pcbDataReturned, bool fInterruptible)
1256	{
1257	const uint32_t fReqEvents = pInfo->u32EventMaskIn;
1258	uint32_t fResEvents;
1259	int iEvent;
1260	PVBOXGUESTWAIT pWait;
1261	int rc;
1262
1263	pInfo->u32EventFlagsOut = 0;
1264	pInfo->u32Result = VBOXGUEST_WAITEVENT_ERROR;
1265	if (pcbDataReturned)
1266	pcbDataReturned = sizeof(pInfo);
1267
1268	/*
1269	* Copy and verify the input mask.
1270	*/
1271	iEvent = ASMBitFirstSetU32(fReqEvents) - 1;
1272	if (RT_UNLIKELY(iEvent < 0))
1273	{
1274	Log(("VBoxGuestCommonIOCtl: WAITEVENT: Invalid input mask %#x!!\n", fReqEvents));
1275	return VERR_INVALID_PARAMETER;
1276	}
1277
1278	/*
1279	* Check the condition up front, before doing the wait-for-event allocations.
1280	*/
1281	RTSpinlockAcquire(pDevExt->EventSpinlock);
1282	rc = WaitEventCheckCondition(pDevExt, pInfo, iEvent, fReqEvents);
1283	if (rc == VINF_SUCCESS)
1284	return rc;
1285
1286	if (!pInfo->u32TimeoutIn)
1287	{
1288	pInfo->u32Result = VBOXGUEST_WAITEVENT_TIMEOUT;
1289	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns VERR_TIMEOUT\n"));
1290	return VERR_TIMEOUT;
1291	}
1292
1293	pWait = VBoxGuestWaitAlloc(pDevExt, pSession);
1294	if (!pWait)
1295	return VERR_NO_MEMORY;
1296	pWait->fReqEvents = fReqEvents;
1297
1298	/*
1299	* We've got the wait entry now, re-enter the spinlock and check for the condition.
1300	* If the wait condition is met, return.
1301	* Otherwise enter into the list and go to sleep waiting for the ISR to signal us.
1302	*/
1303	RTSpinlockAcquire(pDevExt->EventSpinlock);
1304	RTListAppend(&pDevExt->WaitList, &pWait->ListNode);
1305	rc = WaitEventCheckCondition(pDevExt, pInfo, iEvent, fReqEvents);
1306	if (rc == VINF_SUCCESS)
1307	{
1308	VBoxGuestWaitFreeUnlocked(pDevExt, pWait);
1309	return rc;
1310	}
1311
1312	if (fInterruptible)
1313	rc = RTSemEventMultiWaitNoResume(pWait->Event,
1314	pInfo->u32TimeoutIn == UINT32_MAX ? RT_INDEFINITE_WAIT : pInfo->u32TimeoutIn);
1315	else
1316	rc = RTSemEventMultiWait(pWait->Event,
1317	pInfo->u32TimeoutIn == UINT32_MAX ? RT_INDEFINITE_WAIT : pInfo->u32TimeoutIn);
1318
1319	/*
1320	* There is one special case here and that's when the semaphore is
1321	* destroyed upon device driver unload. This shouldn't happen of course,
1322	* but in case it does, just get out of here ASAP.
1323	*/
1324	if (rc == VERR_SEM_DESTROYED)
1325	return rc;
1326
1327	/*
1328	* Unlink the wait item and dispose of it.
1329	*/
1330	RTSpinlockAcquire(pDevExt->EventSpinlock);
1331	fResEvents = pWait->fResEvents;
1332	VBoxGuestWaitFreeLocked(pDevExt, pWait);
1333	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
1334
1335	/*
1336	* Now deal with the return code.
1337	*/
1338	if ( fResEvents
1339	&& fResEvents != UINT32_MAX)
1340	{
1341	pInfo->u32EventFlagsOut = fResEvents;
1342	pInfo->u32Result = VBOXGUEST_WAITEVENT_OK;
1343	if (fReqEvents & ~((uint32_t)1 << iEvent))
1344	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns %#x\n", pInfo->u32EventFlagsOut));
1345	else
1346	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns %#x/%d\n", pInfo->u32EventFlagsOut, iEvent));
1347	rc = VINF_SUCCESS;
1348	}
1349	else if ( fResEvents == UINT32_MAX
1350	\|\| rc == VERR_INTERRUPTED)
1351	{
1352	pInfo->u32Result = VBOXGUEST_WAITEVENT_INTERRUPTED;
1353	rc = VERR_INTERRUPTED;
1354	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns VERR_INTERRUPTED\n"));
1355	}
1356	else if (rc == VERR_TIMEOUT)
1357	{
1358	pInfo->u32Result = VBOXGUEST_WAITEVENT_TIMEOUT;
1359	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns VERR_TIMEOUT (2)\n"));
1360	}
1361	else
1362	{
1363	if (RT_SUCCESS(rc))
1364	{
1365	static unsigned s_cErrors = 0;
1366	if (s_cErrors++ < 32)
1367	LogRel(("VBoxGuestCommonIOCtl: WAITEVENT: returns %Rrc but no events!\n", rc));
1368	rc = VERR_INTERNAL_ERROR;
1369	}
1370	pInfo->u32Result = VBOXGUEST_WAITEVENT_ERROR;
1371	Log(("VBoxGuestCommonIOCtl: WAITEVENT: returns %Rrc\n", rc));
1372	}
1373
1374	return rc;
1375	}
1376
1377
1378	static int VBoxGuestCommonIOCtl_CancelAllWaitEvents(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
1379	{
1380	PVBOXGUESTWAIT pWait;
1381	PVBOXGUESTWAIT pSafe;
1382	int rc = 0;
1383
1384	Log(("VBoxGuestCommonIOCtl: CANCEL_ALL_WAITEVENTS\n"));
1385
1386	/*
1387	* Walk the event list and wake up anyone with a matching session.
1388	*/
1389	RTSpinlockAcquire(pDevExt->EventSpinlock);
1390	RTListForEachSafe(&pDevExt->WaitList, pWait, pSafe, VBOXGUESTWAIT, ListNode)
1391	{
1392	if (pWait->pSession == pSession)
1393	{
1394	pWait->fResEvents = UINT32_MAX;
1395	RTListNodeRemove(&pWait->ListNode);
1396	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
1397	RTListAppend(&pDevExt->WakeUpList, &pWait->ListNode);
1398	#else
1399	rc \|= RTSemEventMultiSignal(pWait->Event);
1400	RTListAppend(&pDevExt->WokenUpList, &pWait->ListNode);
1401	#endif
1402	}
1403	}
1404	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
1405	Assert(rc == 0);
1406
1407	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
1408	VBoxGuestWaitDoWakeUps(pDevExt);
1409	#endif
1410
1411	return VINF_SUCCESS;
1412	}
1413
1414	/**
1415	* Checks if the VMM request is allowed in the context of the given session.
1416	*
1417	* @returns VINF_SUCCESS or VERR_PERMISSION_DENIED.
1418	* @param pSession The calling session.
1419	* @param enmType The request type.
1420	* @param pReqHdr The request.
1421	*/
1422	static int VBoxGuestCheckIfVMMReqAllowed(PVBOXGUESTSESSION pSession, VMMDevRequestType enmType,
1423	VMMDevRequestHeader const *pReqHdr)
1424	{
1425	/*
1426	* Categorize the request being made.
1427	*/
1428	/** @todo This need quite some more work! */
1429	enum
1430	{
1431	kLevel_Invalid, kLevel_NoOne, kLevel_OnlyVBoxGuest, kLevel_OnlyKernel, kLevel_TrustedUsers, kLevel_AllUsers
1432	} enmRequired;
1433	switch (enmType)
1434	{
1435	/*
1436	* Deny access to anything we don't know or provide specialized I/O controls for.
1437	*/
1438	#ifdef VBOX_WITH_HGCM
1439	case VMMDevReq_HGCMConnect:
1440	case VMMDevReq_HGCMDisconnect:
1441	# ifdef VBOX_WITH_64_BITS_GUESTS
1442	case VMMDevReq_HGCMCall32:
1443	case VMMDevReq_HGCMCall64:
1444	# else
1445	case VMMDevReq_HGCMCall:
1446	# endif /* VBOX_WITH_64_BITS_GUESTS */
1447	case VMMDevReq_HGCMCancel:
1448	case VMMDevReq_HGCMCancel2:
1449	#endif /* VBOX_WITH_HGCM */
1450	default:
1451	enmRequired = kLevel_NoOne;
1452	break;
1453
1454	/*
1455	* There are a few things only this driver can do (and it doesn't use
1456	* the VMMRequst I/O control route anyway, but whatever).
1457	*/
1458	case VMMDevReq_ReportGuestInfo:
1459	case VMMDevReq_ReportGuestInfo2:
1460	case VMMDevReq_GetHypervisorInfo:
1461	case VMMDevReq_SetHypervisorInfo:
1462	case VMMDevReq_RegisterPatchMemory:
1463	case VMMDevReq_DeregisterPatchMemory:
1464	case VMMDevReq_GetMemBalloonChangeRequest:
1465	enmRequired = kLevel_OnlyVBoxGuest;
1466	break;
1467
1468	/*
1469	* Trusted users apps only.
1470	*/
1471	case VMMDevReq_QueryCredentials:
1472	case VMMDevReq_ReportCredentialsJudgement:
1473	case VMMDevReq_RegisterSharedModule:
1474	case VMMDevReq_UnregisterSharedModule:
1475	case VMMDevReq_WriteCoreDump:
1476	case VMMDevReq_GetCpuHotPlugRequest:
1477	case VMMDevReq_SetCpuHotPlugStatus:
1478	case VMMDevReq_CheckSharedModules:
1479	case VMMDevReq_GetPageSharingStatus:
1480	case VMMDevReq_DebugIsPageShared:
1481	case VMMDevReq_ReportGuestStats:
1482	case VMMDevReq_GetStatisticsChangeRequest:
1483	case VMMDevReq_ChangeMemBalloon:
1484	enmRequired = kLevel_TrustedUsers;
1485	break;
1486
1487	/*
1488	* Anyone.
1489	*/
1490	case VMMDevReq_GetMouseStatus:
1491	case VMMDevReq_SetMouseStatus:
1492	case VMMDevReq_SetPointerShape:
1493	case VMMDevReq_GetHostVersion:
1494	case VMMDevReq_Idle:
1495	case VMMDevReq_GetHostTime:
1496	case VMMDevReq_SetPowerStatus:
1497	case VMMDevReq_AcknowledgeEvents:
1498	case VMMDevReq_CtlGuestFilterMask:
1499	case VMMDevReq_ReportGuestStatus:
1500	case VMMDevReq_GetDisplayChangeRequest:
1501	case VMMDevReq_VideoModeSupported:
1502	case VMMDevReq_GetHeightReduction:
1503	case VMMDevReq_GetDisplayChangeRequest2:
1504	case VMMDevReq_SetGuestCapabilities:
1505	case VMMDevReq_VideoModeSupported2:
1506	case VMMDevReq_VideoAccelEnable:
1507	case VMMDevReq_VideoAccelFlush:
1508	case VMMDevReq_VideoSetVisibleRegion:
1509	case VMMDevReq_GetSeamlessChangeRequest:
1510	case VMMDevReq_GetVRDPChangeRequest:
1511	case VMMDevReq_LogString:
1512	case VMMDevReq_GetSessionId:
1513	enmRequired = kLevel_AllUsers;
1514	break;
1515
1516	/*
1517	* Depends on the request parameters...
1518	*/
1519	/** @todo this have to be changed into an I/O control and the facilities
1520	* tracked in the session so they can automatically be failed when the
1521	* session terminates without reporting the new status.
1522	*
1523	* The information presented by IGuest is not reliable without this! */
1524	case VMMDevReq_ReportGuestCapabilities:
1525	switch (((VMMDevReportGuestStatus const *)pReqHdr)->guestStatus.facility)
1526	{
1527	case VBoxGuestFacilityType_All:
1528	case VBoxGuestFacilityType_VBoxGuestDriver:
1529	enmRequired = kLevel_OnlyVBoxGuest;
1530	break;
1531	case VBoxGuestFacilityType_VBoxService:
1532	enmRequired = kLevel_TrustedUsers;
1533	break;
1534	case VBoxGuestFacilityType_VBoxTrayClient:
1535	case VBoxGuestFacilityType_Seamless:
1536	case VBoxGuestFacilityType_Graphics:
1537	default:
1538	enmRequired = kLevel_AllUsers;
1539	break;
1540	}
1541	break;
1542	}
1543
1544	/*
1545	* Check against the session.
1546	*/
1547	switch (enmRequired)
1548	{
1549	default:
1550	case kLevel_NoOne:
1551	break;
1552	case kLevel_OnlyVBoxGuest:
1553	case kLevel_OnlyKernel:
1554	if (pSession->R0Process == NIL_RTR0PROCESS)
1555	return VINF_SUCCESS;
1556	break;
1557	case kLevel_TrustedUsers:
1558	case kLevel_AllUsers:
1559	return VINF_SUCCESS;
1560	}
1561
1562	return VERR_PERMISSION_DENIED;
1563	}
1564
1565	static int VBoxGuestCommonIOCtl_VMMRequest(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
1566	VMMDevRequestHeader pReqHdr, size_t cbData, size_t pcbDataReturned)
1567	{
1568	int rc;
1569	VMMDevRequestHeader *pReqCopy;
1570
1571	/*
1572	* Validate the header and request size.
1573	*/
1574	const VMMDevRequestType enmType = pReqHdr->requestType;
1575	const uint32_t cbReq = pReqHdr->size;
1576	const uint32_t cbMinSize = vmmdevGetRequestSize(enmType);
1577
1578	Log(("VBoxGuestCommonIOCtl: VMMREQUEST type %d\n", pReqHdr->requestType));
1579
1580	if (cbReq < cbMinSize)
1581	{
1582	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: invalid hdr size %#x, expected >= %#x; type=%#x!!\n",
1583	cbReq, cbMinSize, enmType));
1584	return VERR_INVALID_PARAMETER;
1585	}
1586	if (cbReq > cbData)
1587	{
1588	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: invalid size %#x, expected >= %#x (hdr); type=%#x!!\n",
1589	cbData, cbReq, enmType));
1590	return VERR_INVALID_PARAMETER;
1591	}
1592	rc = VbglGRVerify(pReqHdr, cbData);
1593	if (RT_FAILURE(rc))
1594	{
1595	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: invalid header: size %#x, expected >= %#x (hdr); type=%#x; rc=%Rrc!!\n",
1596	cbData, cbReq, enmType, rc));
1597	return rc;
1598	}
1599
1600	rc = VBoxGuestCheckIfVMMReqAllowed(pSession, enmType, pReqHdr);
1601	if (RT_FAILURE(rc))
1602	{
1603	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: Operation not allowed! type=%#x rc=%Rrc\n", enmType, rc));
1604	return rc;
1605	}
1606
1607	/*
1608	* Make a copy of the request in the physical memory heap so
1609	* the VBoxGuestLibrary can more easily deal with the request.
1610	* (This is really a waste of time since the OS or the OS specific
1611	* code has already buffered or locked the input/output buffer, but
1612	* it does makes things a bit simpler wrt to phys address.)
1613	*/
1614	rc = VbglGRAlloc(&pReqCopy, cbReq, enmType);
1615	if (RT_FAILURE(rc))
1616	{
1617	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: failed to allocate %u (%#x) bytes to cache the request. rc=%Rrc!!\n",
1618	cbReq, cbReq, rc));
1619	return rc;
1620	}
1621	memcpy(pReqCopy, pReqHdr, cbReq);
1622
1623	if (enmType == VMMDevReq_GetMouseStatus) /* clear poll condition. */
1624	pSession->u32MousePosChangedSeq = ASMAtomicUoReadU32(&pDevExt->u32MousePosChangedSeq);
1625
1626	rc = VbglGRPerform(pReqCopy);
1627	if ( RT_SUCCESS(rc)
1628	&& RT_SUCCESS(pReqCopy->rc))
1629	{
1630	Assert(rc != VINF_HGCM_ASYNC_EXECUTE);
1631	Assert(pReqCopy->rc != VINF_HGCM_ASYNC_EXECUTE);
1632
1633	memcpy(pReqHdr, pReqCopy, cbReq);
1634	if (pcbDataReturned)
1635	*pcbDataReturned = cbReq;
1636	}
1637	else if (RT_FAILURE(rc))
1638	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: VbglGRPerform - rc=%Rrc!\n", rc));
1639	else
1640	{
1641	Log(("VBoxGuestCommonIOCtl: VMMREQUEST: request execution failed; VMMDev rc=%Rrc!\n", pReqCopy->rc));
1642	rc = pReqCopy->rc;
1643	}
1644
1645	VbglGRFree(pReqCopy);
1646	return rc;
1647	}
1648
1649
1650	static int VBoxGuestCommonIOCtl_CtlFilterMask(PVBOXGUESTDEVEXT pDevExt, VBoxGuestFilterMaskInfo *pInfo)
1651	{
1652	VMMDevCtlGuestFilterMask *pReq;
1653	int rc = VbglGRAlloc((VMMDevRequestHeader *)&pReq, sizeof(pReq), VMMDevReq_CtlGuestFilterMask);
1654	if (RT_FAILURE(rc))
1655	{
1656	Log(("VBoxGuestCommonIOCtl: CTL_FILTER_MASK: failed to allocate %u (%#x) bytes to cache the request. rc=%Rrc!!\n",
1657	sizeof(pReq), sizeof(pReq), rc));
1658	return rc;
1659	}
1660
1661	pReq->u32OrMask = pInfo->u32OrMask;
1662	pReq->u32NotMask = pInfo->u32NotMask;
1663	pReq->u32NotMask &= ~pDevExt->fFixedEvents; /* don't permit these to be cleared! */
1664	rc = VbglGRPerform(&pReq->header);
1665	if (RT_FAILURE(rc))
1666	Log(("VBoxGuestCommonIOCtl: CTL_FILTER_MASK: VbglGRPerform failed, rc=%Rrc!\n", rc));
1667
1668	VbglGRFree(&pReq->header);
1669	return rc;
1670	}
1671
1672	#ifdef VBOX_WITH_HGCM
1673
1674	AssertCompile(RT_INDEFINITE_WAIT == (uint32_t)RT_INDEFINITE_WAIT); /* assumed by code below */
1675
1676	/** Worker for VBoxGuestHGCMAsyncWaitCallback. /
1677	static int VBoxGuestHGCMAsyncWaitCallbackWorker(VMMDevHGCMRequestHeader volatile *pHdr, PVBOXGUESTDEVEXT pDevExt,
1678	bool fInterruptible, uint32_t cMillies)
1679	{
1680	int rc;
1681
1682	/*
1683	* Check to see if the condition was met by the time we got here.
1684	*
1685	* We create a simple poll loop here for dealing with out-of-memory
1686	* conditions since the caller isn't necessarily able to deal with
1687	* us returning too early.
1688	*/
1689	PVBOXGUESTWAIT pWait;
1690	for (;;)
1691	{
1692	RTSpinlockAcquire(pDevExt->EventSpinlock);
1693	if ((pHdr->fu32Flags & VBOX_HGCM_REQ_DONE) != 0)
1694	{
1695	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
1696	return VINF_SUCCESS;
1697	}
1698	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
1699
1700	pWait = VBoxGuestWaitAlloc(pDevExt, NULL);
1701	if (pWait)
1702	break;
1703	if (fInterruptible)
1704	return VERR_INTERRUPTED;
1705	RTThreadSleep(1);
1706	}
1707	pWait->fReqEvents = VMMDEV_EVENT_HGCM;
1708	pWait->pHGCMReq = pHdr;
1709
1710	/*
1711	* Re-enter the spinlock and re-check for the condition.
1712	* If the condition is met, return.
1713	* Otherwise link us into the HGCM wait list and go to sleep.
1714	*/
1715	RTSpinlockAcquire(pDevExt->EventSpinlock);
1716	RTListAppend(&pDevExt->HGCMWaitList, &pWait->ListNode);
1717	if ((pHdr->fu32Flags & VBOX_HGCM_REQ_DONE) != 0)
1718	{
1719	VBoxGuestWaitFreeLocked(pDevExt, pWait);
1720	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
1721	return VINF_SUCCESS;
1722	}
1723	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
1724
1725	if (fInterruptible)
1726	rc = RTSemEventMultiWaitNoResume(pWait->Event, cMillies);
1727	else
1728	rc = RTSemEventMultiWait(pWait->Event, cMillies);
1729	if (rc == VERR_SEM_DESTROYED)
1730	return rc;
1731
1732	/*
1733	* Unlink, free and return.
1734	*/
1735	if ( RT_FAILURE(rc)
1736	&& rc != VERR_TIMEOUT
1737	&& ( !fInterruptible
1738	\|\| rc != VERR_INTERRUPTED))
1739	LogRel(("VBoxGuestHGCMAsyncWaitCallback: wait failed! %Rrc\n", rc));
1740
1741	VBoxGuestWaitFreeUnlocked(pDevExt, pWait);
1742	return rc;
1743	}
1744
1745
1746	/**
1747	* This is a callback for dealing with async waits.
1748	*
1749	* It operates in a manner similar to VBoxGuestCommonIOCtl_WaitEvent.
1750	*/
1751	static DECLCALLBACK(int) VBoxGuestHGCMAsyncWaitCallback(VMMDevHGCMRequestHeader pHdr, void pvUser, uint32_t u32User)
1752	{
1753	PVBOXGUESTDEVEXT pDevExt = (PVBOXGUESTDEVEXT)pvUser;
1754	Log(("VBoxGuestHGCMAsyncWaitCallback: requestType=%d\n", pHdr->header.requestType));
1755	return VBoxGuestHGCMAsyncWaitCallbackWorker((VMMDevHGCMRequestHeader volatile *)pHdr,
1756	pDevExt,
1757	false /* fInterruptible */,
1758	u32User /* cMillies */);
1759	}
1760
1761
1762	/**
1763	* This is a callback for dealing with async waits with a timeout.
1764	*
1765	* It operates in a manner similar to VBoxGuestCommonIOCtl_WaitEvent.
1766	*/
1767	static DECLCALLBACK(int) VBoxGuestHGCMAsyncWaitCallbackInterruptible(VMMDevHGCMRequestHeader *pHdr,
1768	void *pvUser, uint32_t u32User)
1769	{
1770	PVBOXGUESTDEVEXT pDevExt = (PVBOXGUESTDEVEXT)pvUser;
1771	Log(("VBoxGuestHGCMAsyncWaitCallbackInterruptible: requestType=%d\n", pHdr->header.requestType));
1772	return VBoxGuestHGCMAsyncWaitCallbackWorker((VMMDevHGCMRequestHeader volatile *)pHdr,
1773	pDevExt,
1774	true /* fInterruptible */,
1775	u32User /* cMillies */ );
1776
1777	}
1778
1779
1780	static int VBoxGuestCommonIOCtl_HGCMConnect(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
1781	VBoxGuestHGCMConnectInfo pInfo, size_t pcbDataReturned)
1782	{
1783	int rc;
1784
1785	/*
1786	* The VbglHGCMConnect call will invoke the callback if the HGCM
1787	* call is performed in an ASYNC fashion. The function is not able
1788	* to deal with cancelled requests.
1789	*/
1790	Log(("VBoxGuestCommonIOCtl: HGCM_CONNECT: %.128s\n",
1791	pInfo->Loc.type == VMMDevHGCMLoc_LocalHost \|\| pInfo->Loc.type == VMMDevHGCMLoc_LocalHost_Existing
1792	? pInfo->Loc.u.host.achName : "<not local host>"));
1793
1794	rc = VbglR0HGCMInternalConnect(pInfo, VBoxGuestHGCMAsyncWaitCallback, pDevExt, RT_INDEFINITE_WAIT);
1795	if (RT_SUCCESS(rc))
1796	{
1797	Log(("VBoxGuestCommonIOCtl: HGCM_CONNECT: u32Client=%RX32 result=%Rrc (rc=%Rrc)\n",
1798	pInfo->u32ClientID, pInfo->result, rc));
1799	if (RT_SUCCESS(pInfo->result))
1800	{
1801	/*
1802	* Append the client id to the client id table.
1803	* If the table has somehow become filled up, we'll disconnect the session.
1804	*/
1805	unsigned i;
1806	RTSpinlockAcquire(pDevExt->SessionSpinlock);
1807	for (i = 0; i < RT_ELEMENTS(pSession->aHGCMClientIds); i++)
1808	if (!pSession->aHGCMClientIds[i])
1809	{
1810	pSession->aHGCMClientIds[i] = pInfo->u32ClientID;
1811	break;
1812	}
1813	RTSpinlockReleaseNoInts(pDevExt->SessionSpinlock);
1814	if (i >= RT_ELEMENTS(pSession->aHGCMClientIds))
1815	{
1816	static unsigned s_cErrors = 0;
1817	VBoxGuestHGCMDisconnectInfo Info;
1818
1819	if (s_cErrors++ < 32)
1820	LogRel(("VBoxGuestCommonIOCtl: HGCM_CONNECT: too many HGCMConnect calls for one session!\n"));
1821
1822	Info.result = 0;
1823	Info.u32ClientID = pInfo->u32ClientID;
1824	VbglR0HGCMInternalDisconnect(&Info, VBoxGuestHGCMAsyncWaitCallback, pDevExt, RT_INDEFINITE_WAIT);
1825	return VERR_TOO_MANY_OPEN_FILES;
1826	}
1827	}
1828	if (pcbDataReturned)
1829	pcbDataReturned = sizeof(pInfo);
1830	}
1831	return rc;
1832	}
1833
1834
1835	static int VBoxGuestCommonIOCtl_HGCMDisconnect(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession, VBoxGuestHGCMDisconnectInfo *pInfo,
1836	size_t *pcbDataReturned)
1837	{
1838	/*
1839	* Validate the client id and invalidate its entry while we're in the call.
1840	*/
1841	int rc;
1842	const uint32_t u32ClientId = pInfo->u32ClientID;
1843	unsigned i;
1844	RTSpinlockAcquire(pDevExt->SessionSpinlock);
1845	for (i = 0; i < RT_ELEMENTS(pSession->aHGCMClientIds); i++)
1846	if (pSession->aHGCMClientIds[i] == u32ClientId)
1847	{
1848	pSession->aHGCMClientIds[i] = UINT32_MAX;
1849	break;
1850	}
1851	RTSpinlockReleaseNoInts(pDevExt->SessionSpinlock);
1852	if (i >= RT_ELEMENTS(pSession->aHGCMClientIds))
1853	{
1854	static unsigned s_cErrors = 0;
1855	if (s_cErrors++ > 32)
1856	LogRel(("VBoxGuestCommonIOCtl: HGCM_DISCONNECT: u32Client=%RX32\n", u32ClientId));
1857	return VERR_INVALID_HANDLE;
1858	}
1859
1860	/*
1861	* The VbglHGCMConnect call will invoke the callback if the HGCM
1862	* call is performed in an ASYNC fashion. The function is not able
1863	* to deal with cancelled requests.
1864	*/
1865	Log(("VBoxGuestCommonIOCtl: HGCM_DISCONNECT: u32Client=%RX32\n", pInfo->u32ClientID));
1866	rc = VbglR0HGCMInternalDisconnect(pInfo, VBoxGuestHGCMAsyncWaitCallback, pDevExt, RT_INDEFINITE_WAIT);
1867	if (RT_SUCCESS(rc))
1868	{
1869	Log(("VBoxGuestCommonIOCtl: HGCM_DISCONNECT: result=%Rrc\n", pInfo->result));
1870	if (pcbDataReturned)
1871	pcbDataReturned = sizeof(pInfo);
1872	}
1873
1874	/* Update the client id array according to the result. */
1875	RTSpinlockAcquire(pDevExt->SessionSpinlock);
1876	if (pSession->aHGCMClientIds[i] == UINT32_MAX)
1877	pSession->aHGCMClientIds[i] = RT_SUCCESS(rc) && RT_SUCCESS(pInfo->result) ? 0 : u32ClientId;
1878	RTSpinlockReleaseNoInts(pDevExt->SessionSpinlock);
1879
1880	return rc;
1881	}
1882
1883
1884	static int VBoxGuestCommonIOCtl_HGCMCall(PVBOXGUESTDEVEXT pDevExt,
1885	PVBOXGUESTSESSION pSession,
1886	VBoxGuestHGCMCallInfo *pInfo,
1887	uint32_t cMillies, bool fInterruptible, bool f32bit, bool fUserData,
1888	size_t cbExtra, size_t cbData, size_t *pcbDataReturned)
1889	{
1890	const uint32_t u32ClientId = pInfo->u32ClientID;
1891	uint32_t fFlags;
1892	size_t cbActual;
1893	unsigned i;
1894	int rc;
1895
1896	/*
1897	* Some more validations.
1898	*/
1899	if (pInfo->cParms > 4096) /* (Just make sure it doesn't overflow the next check.) */
1900	{
1901	LogRel(("VBoxGuestCommonIOCtl: HGCM_CALL: cParm=%RX32 is not sane\n", pInfo->cParms));
1902	return VERR_INVALID_PARAMETER;
1903	}
1904
1905	cbActual = cbExtra + sizeof(*pInfo);
1906	#ifdef RT_ARCH_AMD64
1907	if (f32bit)
1908	cbActual += pInfo->cParms * sizeof(HGCMFunctionParameter32);
1909	else
1910	#endif
1911	cbActual += pInfo->cParms * sizeof(HGCMFunctionParameter);
1912	if (cbData < cbActual)
1913	{
1914	LogRel(("VBoxGuestCommonIOCtl: HGCM_CALL: cbData=%#zx (%zu) required size is %#zx (%zu)\n",
1915	cbData, cbActual));
1916	return VERR_INVALID_PARAMETER;
1917	}
1918
1919	/*
1920	* Validate the client id.
1921	*/
1922	RTSpinlockAcquire(pDevExt->SessionSpinlock);
1923	for (i = 0; i < RT_ELEMENTS(pSession->aHGCMClientIds); i++)
1924	if (pSession->aHGCMClientIds[i] == u32ClientId)
1925	break;
1926	RTSpinlockReleaseNoInts(pDevExt->SessionSpinlock);
1927	if (RT_UNLIKELY(i >= RT_ELEMENTS(pSession->aHGCMClientIds)))
1928	{
1929	static unsigned s_cErrors = 0;
1930	if (s_cErrors++ > 32)
1931	LogRel(("VBoxGuestCommonIOCtl: HGCM_CALL: Invalid handle. u32Client=%RX32\n", u32ClientId));
1932	return VERR_INVALID_HANDLE;
1933	}
1934
1935	/*
1936	* The VbglHGCMCall call will invoke the callback if the HGCM
1937	* call is performed in an ASYNC fashion. This function can
1938	* deal with cancelled requests, so we let user more requests
1939	* be interruptible (should add a flag for this later I guess).
1940	*/
1941	Log(("VBoxGuestCommonIOCtl: HGCM_CALL: u32Client=%RX32\n", pInfo->u32ClientID));
1942	fFlags = !fUserData && pSession->R0Process == NIL_RTR0PROCESS ? VBGLR0_HGCMCALL_F_KERNEL : VBGLR0_HGCMCALL_F_USER;
1943	#ifdef RT_ARCH_AMD64
1944	if (f32bit)
1945	{
1946	if (fInterruptible)
1947	rc = VbglR0HGCMInternalCall32(pInfo, cbData - cbExtra, fFlags, VBoxGuestHGCMAsyncWaitCallbackInterruptible, pDevExt, cMillies);
1948	else
1949	rc = VbglR0HGCMInternalCall32(pInfo, cbData - cbExtra, fFlags, VBoxGuestHGCMAsyncWaitCallback, pDevExt, cMillies);
1950	}
1951	else
1952	#endif
1953	{
1954	if (fInterruptible)
1955	rc = VbglR0HGCMInternalCall(pInfo, cbData - cbExtra, fFlags, VBoxGuestHGCMAsyncWaitCallbackInterruptible, pDevExt, cMillies);
1956	else
1957	rc = VbglR0HGCMInternalCall(pInfo, cbData - cbExtra, fFlags, VBoxGuestHGCMAsyncWaitCallback, pDevExt, cMillies);
1958	}
1959	if (RT_SUCCESS(rc))
1960	{
1961	Log(("VBoxGuestCommonIOCtl: HGCM_CALL: result=%Rrc\n", pInfo->result));
1962	if (pcbDataReturned)
1963	*pcbDataReturned = cbActual;
1964	}
1965	else
1966	{
1967	if ( rc != VERR_INTERRUPTED
1968	&& rc != VERR_TIMEOUT)
1969	{
1970	static unsigned s_cErrors = 0;
1971	if (s_cErrors++ < 32)
1972	LogRel(("VBoxGuestCommonIOCtl: HGCM_CALL: %s Failed. rc=%Rrc.\n", f32bit ? "32" : "64", rc));
1973	}
1974	else
1975	Log(("VBoxGuestCommonIOCtl: HGCM_CALL: %s Failed. rc=%Rrc.\n", f32bit ? "32" : "64", rc));
1976	}
1977	return rc;
1978	}
1979
1980
1981	#endif /* VBOX_WITH_HGCM */
1982
1983	/**
1984	* Handle VBOXGUEST_IOCTL_CHECK_BALLOON from R3.
1985	*
1986	* Ask the host for the size of the balloon and try to set it accordingly. If
1987	* this approach fails because it's not supported, return with fHandleInR3 set
1988	* and let the user land supply memory we can lock via the other ioctl.
1989	*
1990	* @returns VBox status code.
1991	*
1992	* @param pDevExt The device extension.
1993	* @param pSession The session.
1994	* @param pInfo The output buffer.
1995	* @param pcbDataReturned Where to store the amount of returned data. Can
1996	* be NULL.
1997	*/
1998	static int VBoxGuestCommonIOCtl_CheckMemoryBalloon(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
1999	VBoxGuestCheckBalloonInfo pInfo, size_t pcbDataReturned)
2000	{
2001	VMMDevGetMemBalloonChangeRequest *pReq;
2002	int rc;
2003
2004	Log(("VBoxGuestCommonIOCtl: CHECK_MEMORY_BALLOON\n"));
2005	rc = RTSemFastMutexRequest(pDevExt->MemBalloon.hMtx);
2006	AssertRCReturn(rc, rc);
2007
2008	/*
2009	* The first user trying to query/change the balloon becomes the
2010	* owner and owns it until the session is closed (vboxGuestCloseMemBalloon).
2011	*/
2012	if ( pDevExt->MemBalloon.pOwner != pSession
2013	&& pDevExt->MemBalloon.pOwner == NULL)
2014	pDevExt->MemBalloon.pOwner = pSession;
2015
2016	if (pDevExt->MemBalloon.pOwner == pSession)
2017	{
2018	rc = VbglGRAlloc((VMMDevRequestHeader **)&pReq, sizeof(VMMDevGetMemBalloonChangeRequest), VMMDevReq_GetMemBalloonChangeRequest);
2019	if (RT_SUCCESS(rc))
2020	{
2021	/*
2022	* This is a response to that event. Setting this bit means that
2023	* we request the value from the host and change the guest memory
2024	* balloon according to this value.
2025	*/
2026	pReq->eventAck = VMMDEV_EVENT_BALLOON_CHANGE_REQUEST;
2027	rc = VbglGRPerform(&pReq->header);
2028	if (RT_SUCCESS(rc))
2029	{
2030	Assert(pDevExt->MemBalloon.cMaxChunks == pReq->cPhysMemChunks \|\| pDevExt->MemBalloon.cMaxChunks == 0);
2031	pDevExt->MemBalloon.cMaxChunks = pReq->cPhysMemChunks;
2032
2033	pInfo->cBalloonChunks = pReq->cBalloonChunks;
2034	pInfo->fHandleInR3 = false;
2035
2036	rc = vboxGuestSetBalloonSizeKernel(pDevExt, pReq->cBalloonChunks, &pInfo->fHandleInR3);
2037	/* Ignore various out of memory failures. */
2038	if ( rc == VERR_NO_MEMORY
2039	\|\| rc == VERR_NO_PHYS_MEMORY
2040	\|\| rc == VERR_NO_CONT_MEMORY)
2041	rc = VINF_SUCCESS;
2042
2043	if (pcbDataReturned)
2044	*pcbDataReturned = sizeof(VBoxGuestCheckBalloonInfo);
2045	}
2046	else
2047	LogRel(("VBoxGuestCommonIOCtl: CHECK_MEMORY_BALLOON: VbglGRPerform failed. rc=%Rrc\n", rc));
2048	VbglGRFree(&pReq->header);
2049	}
2050	}
2051	else
2052	rc = VERR_PERMISSION_DENIED;
2053
2054	RTSemFastMutexRelease(pDevExt->MemBalloon.hMtx);
2055	Log(("VBoxGuestCommonIOCtl: CHECK_MEMORY_BALLOON returns %Rrc\n", rc));
2056	return rc;
2057	}
2058
2059
2060	/**
2061	* Handle a request for changing the memory balloon.
2062	*
2063	* @returns VBox status code.
2064	*
2065	* @param pDevExt The device extention.
2066	* @param pSession The session.
2067	* @param pInfo The change request structure (input).
2068	* @param pcbDataReturned Where to store the amount of returned data. Can
2069	* be NULL.
2070	*/
2071	static int VBoxGuestCommonIOCtl_ChangeMemoryBalloon(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
2072	VBoxGuestChangeBalloonInfo pInfo, size_t pcbDataReturned)
2073	{
2074	int rc = RTSemFastMutexRequest(pDevExt->MemBalloon.hMtx);
2075	AssertRCReturn(rc, rc);
2076
2077	if (!pDevExt->MemBalloon.fUseKernelAPI)
2078	{
2079	/*
2080	* The first user trying to query/change the balloon becomes the
2081	* owner and owns it until the session is closed (vboxGuestCloseMemBalloon).
2082	*/
2083	if ( pDevExt->MemBalloon.pOwner != pSession
2084	&& pDevExt->MemBalloon.pOwner == NULL)
2085	pDevExt->MemBalloon.pOwner = pSession;
2086
2087	if (pDevExt->MemBalloon.pOwner == pSession)
2088	{
2089	rc = vboxGuestSetBalloonSizeFromUser(pDevExt, pSession, pInfo->u64ChunkAddr, !!pInfo->fInflate);
2090	if (pcbDataReturned)
2091	*pcbDataReturned = 0;
2092	}
2093	else
2094	rc = VERR_PERMISSION_DENIED;
2095	}
2096	else
2097	rc = VERR_PERMISSION_DENIED;
2098
2099	RTSemFastMutexRelease(pDevExt->MemBalloon.hMtx);
2100	return rc;
2101	}
2102
2103
2104	/**
2105	* Handle a request for writing a core dump of the guest on the host.
2106	*
2107	* @returns VBox status code.
2108	*
2109	* @param pDevExt The device extension.
2110	* @param pInfo The output buffer.
2111	*/
2112	static int VBoxGuestCommonIOCtl_WriteCoreDump(PVBOXGUESTDEVEXT pDevExt, VBoxGuestWriteCoreDump *pInfo)
2113	{
2114	VMMDevReqWriteCoreDump *pReq = NULL;
2115	int rc = VbglGRAlloc((VMMDevRequestHeader *)&pReq, sizeof(pReq), VMMDevReq_WriteCoreDump);
2116	if (RT_FAILURE(rc))
2117	{
2118	Log(("VBoxGuestCommonIOCtl: WRITE_CORE_DUMP: failed to allocate %u (%#x) bytes to cache the request. rc=%Rrc!!\n",
2119	sizeof(pReq), sizeof(pReq), rc));
2120	return rc;
2121	}
2122
2123	pReq->fFlags = pInfo->fFlags;
2124	rc = VbglGRPerform(&pReq->header);
2125	if (RT_FAILURE(rc))
2126	Log(("VBoxGuestCommonIOCtl: WRITE_CORE_DUMP: VbglGRPerform failed, rc=%Rrc!\n", rc));
2127
2128	VbglGRFree(&pReq->header);
2129	return rc;
2130	}
2131
2132
2133	#ifdef VBOX_WITH_VRDP_SESSION_HANDLING
2134	/**
2135	* Enables the VRDP session and saves its session ID.
2136	*
2137	* @returns VBox status code.
2138	*
2139	* @param pDevExt The device extention.
2140	* @param pSession The session.
2141	*/
2142	static int VBoxGuestCommonIOCtl_EnableVRDPSession(VBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
2143	{
2144	/* Nothing to do here right now, since this only is supported on Windows at the moment. */
2145	return VERR_NOT_IMPLEMENTED;
2146	}
2147
2148
2149	/**
2150	* Disables the VRDP session.
2151	*
2152	* @returns VBox status code.
2153	*
2154	* @param pDevExt The device extention.
2155	* @param pSession The session.
2156	*/
2157	static int VBoxGuestCommonIOCtl_DisableVRDPSession(VBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession)
2158	{
2159	/* Nothing to do here right now, since this only is supported on Windows at the moment. */
2160	return VERR_NOT_IMPLEMENTED;
2161	}
2162	#endif /* VBOX_WITH_VRDP_SESSION_HANDLING */
2163
2164	#ifdef DEBUG
2165	/** Unit test SetMouseStatus instead of really executing the request. */
2166	static bool g_test_fSetMouseStatus = false;
2167	/** When unit testing SetMouseStatus, the fake RC for the GR to return. */
2168	static int g_test_SetMouseStatusGRRC;
2169	/** When unit testing SetMouseStatus this will be set to the status passed to
2170	* the GR. */
2171	static uint32_t g_test_statusSetMouseStatus;
2172	#endif
2173
2174	static int vboxguestcommonSetMouseStatus(uint32_t fFeatures)
2175	{
2176	VMMDevReqMouseStatus *pReq;
2177	int rc;
2178
2179	LogRelFlowFunc(("fFeatures=%u\n", (int) fFeatures));
2180	rc = VbglGRAlloc((VMMDevRequestHeader *)&pReq, sizeof(pReq), VMMDevReq_SetMouseStatus);
2181	if (RT_SUCCESS(rc))
2182	{
2183	pReq->mouseFeatures = fFeatures;
2184	pReq->pointerXPos = 0;
2185	pReq->pointerYPos = 0;
2186	#ifdef DEBUG
2187	if (g_test_fSetMouseStatus)
2188	{
2189	g_test_statusSetMouseStatus = pReq->mouseFeatures;
2190	rc = g_test_SetMouseStatusGRRC;
2191	}
2192	else
2193	#endif
2194	rc = VbglGRPerform(&pReq->header);
2195	VbglGRFree(&pReq->header);
2196	}
2197	LogRelFlowFunc(("rc=%Rrc\n", rc));
2198	return rc;
2199	}
2200
2201
2202	/**
2203	* Sets the mouse status features for this session and updates them
2204	* globally. We aim to ensure that if several threads call this in
2205	* parallel the most recent status will always end up being set.
2206	*
2207	* @returns VBox status code.
2208	*
2209	* @param pDevExt The device extention.
2210	* @param pSession The session.
2211	* @param fFeatures New bitmap of enabled features.
2212	*/
2213	static int VBoxGuestCommonIOCtl_SetMouseStatus(PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession, uint32_t fFeatures)
2214	{
2215	uint32_t fNewDevExtStatus = 0;
2216	unsigned i;
2217	int rc;
2218	/* Exit early if nothing has changed - hack to work around the
2219	* Windows Additions not using the common code. */
2220	bool fNoAction;
2221
2222	RTSpinlockAcquire(pDevExt->SessionSpinlock);
2223
2224	for (i = 0; i < sizeof(fFeatures) * 8; i++)
2225	{
2226	if (RT_BIT_32(i) & VMMDEV_MOUSE_GUEST_MASK)
2227	{
2228	if ( (RT_BIT_32(i) & fFeatures)
2229	&& !(RT_BIT_32(i) & pSession->fMouseStatus))
2230	pDevExt->cMouseFeatureUsage[i]++;
2231	else if ( !(RT_BIT_32(i) & fFeatures)
2232	&& (RT_BIT_32(i) & pSession->fMouseStatus))
2233	pDevExt->cMouseFeatureUsage[i]--;
2234	}
2235	if (pDevExt->cMouseFeatureUsage[i] > 0)
2236	fNewDevExtStatus \|= RT_BIT_32(i);
2237	}
2238
2239	pSession->fMouseStatus = fFeatures & VMMDEV_MOUSE_GUEST_MASK;
2240	fNoAction = (pDevExt->fMouseStatus == fNewDevExtStatus);
2241	pDevExt->fMouseStatus = fNewDevExtStatus;
2242
2243	RTSpinlockReleaseNoInts(pDevExt->SessionSpinlock);
2244	if (fNoAction)
2245	return VINF_SUCCESS;
2246
2247	do
2248	{
2249	fNewDevExtStatus = pDevExt->fMouseStatus;
2250	rc = vboxguestcommonSetMouseStatus(fNewDevExtStatus);
2251	} while ( RT_SUCCESS(rc)
2252	&& fNewDevExtStatus != pDevExt->fMouseStatus);
2253
2254	return rc;
2255	}
2256
2257
2258	#ifdef DEBUG
2259	/** Unit test for the SET_MOUSE_STATUS IoCtl. Since this is closely tied to
2260	* the code in question it probably makes most sense to keep it next to the
2261	* code. */
2262	static void testSetMouseStatus(void)
2263	{
2264	uint32_t u32Data;
2265	int rc;
2266	RTSPINLOCK Spinlock;
2267
2268	g_test_fSetMouseStatus = true;
2269	rc = RTSpinlockCreate(&Spinlock, RTSPINLOCK_FLAGS_INTERRUPT_SAFE, "VBoxGuestTest");
2270	AssertRCReturnVoid(rc);
2271	{
2272	VBOXGUESTDEVEXT DevExt = { 0 };
2273	VBOXGUESTSESSION Session = { 0 };
2274
2275	g_test_statusSetMouseStatus = ~0;
2276	g_test_SetMouseStatusGRRC = VINF_SUCCESS;
2277	DevExt.SessionSpinlock = Spinlock;
2278	u32Data = VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE;
2279	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2280	&Session, &u32Data, sizeof(u32Data), NULL);
2281	AssertRCSuccess(rc);
2282	AssertMsg( g_test_statusSetMouseStatus
2283	== VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE,
2284	("Actual status: 0x%x\n", g_test_statusSetMouseStatus));
2285	DevExt.cMouseFeatureUsage[ASMBitFirstSetU32(VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR) - 1] = 1;
2286	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2287	&Session, &u32Data, sizeof(u32Data), NULL);
2288	AssertRCSuccess(rc);
2289	AssertMsg( g_test_statusSetMouseStatus
2290	== ( VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE
2291	\| VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR),
2292	("Actual status: 0x%x\n", g_test_statusSetMouseStatus));
2293	u32Data = VMMDEV_MOUSE_HOST_WANTS_ABSOLUTE; /* Can't change this */
2294	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2295	&Session, &u32Data, sizeof(u32Data), NULL);
2296	AssertRCSuccess(rc);
2297	AssertMsg( g_test_statusSetMouseStatus
2298	== VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR,
2299	("Actual status: 0x%x\n", g_test_statusSetMouseStatus));
2300	u32Data = VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR;
2301	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2302	&Session, &u32Data, sizeof(u32Data), NULL);
2303	AssertRCSuccess(rc);
2304	AssertMsg( g_test_statusSetMouseStatus
2305	== VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR,
2306	("Actual status: 0x%x\n", g_test_statusSetMouseStatus));
2307	u32Data = 0;
2308	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2309	&Session, &u32Data, sizeof(u32Data), NULL);
2310	AssertRCSuccess(rc);
2311	AssertMsg( g_test_statusSetMouseStatus
2312	== VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR,
2313	("Actual status: 0x%x\n", g_test_statusSetMouseStatus));
2314	AssertMsg(DevExt.cMouseFeatureUsage[ASMBitFirstSetU32(VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR) - 1] == 1,
2315	("Actual value: %d\n", DevExt.cMouseFeatureUsage[ASMBitFirstSetU32(VMMDEV_MOUSE_GUEST_NEEDS_HOST_CURSOR)]));
2316	g_test_SetMouseStatusGRRC = VERR_UNRESOLVED_ERROR;
2317	/* This should succeed as the host request should not be made
2318	* since nothing has changed. */
2319	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2320	&Session, &u32Data, sizeof(u32Data), NULL);
2321	AssertRCSuccess(rc);
2322	/* This should fail with VERR_UNRESOLVED_ERROR as set above. */
2323	u32Data = VMMDEV_MOUSE_GUEST_CAN_ABSOLUTE;
2324	rc = VBoxGuestCommonIOCtl(VBOXGUEST_IOCTL_SET_MOUSE_STATUS, &DevExt,
2325	&Session, &u32Data, sizeof(u32Data), NULL);
2326	AssertMsg(rc == VERR_UNRESOLVED_ERROR, ("rc == %Rrc\n", rc));
2327	/* Untested paths: out of memory; race setting status to host */
2328	}
2329	RTSpinlockDestroy(Spinlock);
2330	g_test_fSetMouseStatus = false;
2331	}
2332	#endif
2333
2334
2335	/**
2336	* Guest backdoor logging.
2337	*
2338	* @returns VBox status code.
2339	*
2340	* @param pDevExt The device extension.
2341	* @param pch The log message (need not be NULL terminated).
2342	* @param cbData Size of the buffer.
2343	* @param pcbDataReturned Where to store the amount of returned data. Can be NULL.
2344	*/
2345	static int VBoxGuestCommonIOCtl_Log(PVBOXGUESTDEVEXT pDevExt, const char pch, size_t cbData, size_t pcbDataReturned)
2346	{
2347	NOREF(pch);
2348	NOREF(cbData);
2349	if (pDevExt->fLoggingEnabled)
2350	RTLogBackdoorPrintf("%.*s", cbData, pch);
2351	else
2352	Log(("%.*s", cbData, pch));
2353	if (pcbDataReturned)
2354	*pcbDataReturned = 0;
2355	return VINF_SUCCESS;
2356	}
2357
2358
2359	/**
2360	* Common IOCtl for user to kernel and kernel to kernel communication.
2361	*
2362	* This function only does the basic validation and then invokes
2363	* worker functions that takes care of each specific function.
2364	*
2365	* @returns VBox status code.
2366	*
2367	* @param iFunction The requested function.
2368	* @param pDevExt The device extension.
2369	* @param pSession The client session.
2370	* @param pvData The input/output data buffer. Can be NULL depending on the function.
2371	* @param cbData The max size of the data buffer.
2372	* @param pcbDataReturned Where to store the amount of returned data. Can be NULL.
2373	*/
2374	int VBoxGuestCommonIOCtl(unsigned iFunction, PVBOXGUESTDEVEXT pDevExt, PVBOXGUESTSESSION pSession,
2375	void pvData, size_t cbData, size_t pcbDataReturned)
2376	{
2377	int rc;
2378	Log(("VBoxGuestCommonIOCtl: iFunction=%#x pDevExt=%p pSession=%p pvData=%p cbData=%zu\n",
2379	iFunction, pDevExt, pSession, pvData, cbData));
2380
2381	/*
2382	* Make sure the returned data size is set to zero.
2383	*/
2384	if (pcbDataReturned)
2385	*pcbDataReturned = 0;
2386
2387	/*
2388	* Define some helper macros to simplify validation.
2389	*/
2390	#define CHECKRET_RING0(mnemonic) \
2391	do { \
2392	if (pSession->R0Process != NIL_RTR0PROCESS) \
2393	{ \
2394	LogFunc((mnemonic ": Ring-0 only, caller is %RTproc/%p\n", \
2395	pSession->Process, (uintptr_t)pSession->R0Process)); \
2396	return VERR_PERMISSION_DENIED; \
2397	} \
2398	} while (0)
2399	#define CHECKRET_MIN_SIZE(mnemonic, cbMin) \
2400	do { \
2401	if (cbData < (cbMin)) \
2402	{ \
2403	LogFunc((mnemonic ": cbData=%#zx (%zu) min is %#zx (%zu)\n", \
2404	cbData, cbData, (size_t)(cbMin), (size_t)(cbMin))); \
2405	return VERR_BUFFER_OVERFLOW; \
2406	} \
2407	if ((cbMin) != 0 && !VALID_PTR(pvData)) \
2408	{ \
2409	LogFunc((mnemonic ": Invalid pointer %p\n", pvData)); \
2410	return VERR_INVALID_POINTER; \
2411	} \
2412	} while (0)
2413	#define CHECKRET_SIZE(mnemonic, cb) \
2414	do { \
2415	if (cbData != (cb)) \
2416	{ \
2417	LogFunc((mnemonic ": cbData=%#zx (%zu) expected is %#zx (%zu)\n", \
2418	cbData, cbData, (size_t)(cb), (size_t)(cb))); \
2419	return VERR_BUFFER_OVERFLOW; \
2420	} \
2421	if ((cb) != 0 && !VALID_PTR(pvData)) \
2422	{ \
2423	LogFunc((mnemonic ": Invalid pointer %p\n", pvData)); \
2424	return VERR_INVALID_POINTER; \
2425	} \
2426	} while (0)
2427
2428
2429	/*
2430	* Deal with variably sized requests first.
2431	*/
2432	rc = VINF_SUCCESS;
2433	if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_VMMREQUEST(0)))
2434	{
2435	CHECKRET_MIN_SIZE("VMMREQUEST", sizeof(VMMDevRequestHeader));
2436	rc = VBoxGuestCommonIOCtl_VMMRequest(pDevExt, pSession, (VMMDevRequestHeader *)pvData, cbData, pcbDataReturned);
2437	}
2438	#ifdef VBOX_WITH_HGCM
2439	/*
2440	* These ones are a bit tricky.
2441	*/
2442	else if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_HGCM_CALL(0)))
2443	{
2444	bool fInterruptible = pSession->R0Process != NIL_RTR0PROCESS;
2445	CHECKRET_MIN_SIZE("HGCM_CALL", sizeof(VBoxGuestHGCMCallInfo));
2446	rc = VBoxGuestCommonIOCtl_HGCMCall(pDevExt, pSession, (VBoxGuestHGCMCallInfo *)pvData, RT_INDEFINITE_WAIT,
2447	fInterruptible, false /f32bit/, false /* fUserData */,
2448	0, cbData, pcbDataReturned);
2449	}
2450	else if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_HGCM_CALL_TIMED(0)))
2451	{
2452	VBoxGuestHGCMCallInfoTimed pInfo = (VBoxGuestHGCMCallInfoTimed )pvData;
2453	CHECKRET_MIN_SIZE("HGCM_CALL_TIMED", sizeof(VBoxGuestHGCMCallInfoTimed));
2454	rc = VBoxGuestCommonIOCtl_HGCMCall(pDevExt, pSession, &pInfo->info, pInfo->u32Timeout,
2455	!!pInfo->fInterruptible \|\| pSession->R0Process != NIL_RTR0PROCESS,
2456	false /f32bit/, false /* fUserData */,
2457	RT_OFFSETOF(VBoxGuestHGCMCallInfoTimed, info), cbData, pcbDataReturned);
2458	}
2459	else if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_HGCM_CALL_USERDATA(0)))
2460	{
2461	bool fInterruptible = true;
2462	CHECKRET_MIN_SIZE("HGCM_CALL", sizeof(VBoxGuestHGCMCallInfo));
2463	rc = VBoxGuestCommonIOCtl_HGCMCall(pDevExt, pSession, (VBoxGuestHGCMCallInfo *)pvData, RT_INDEFINITE_WAIT,
2464	fInterruptible, false /f32bit/, true /* fUserData */,
2465	0, cbData, pcbDataReturned);
2466	}
2467	# ifdef RT_ARCH_AMD64
2468	else if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_HGCM_CALL_32(0)))
2469	{
2470	bool fInterruptible = pSession->R0Process != NIL_RTR0PROCESS;
2471	CHECKRET_MIN_SIZE("HGCM_CALL", sizeof(VBoxGuestHGCMCallInfo));
2472	rc = VBoxGuestCommonIOCtl_HGCMCall(pDevExt, pSession, (VBoxGuestHGCMCallInfo *)pvData, RT_INDEFINITE_WAIT,
2473	fInterruptible, true /f32bit/, false /* fUserData */,
2474	0, cbData, pcbDataReturned);
2475	}
2476	else if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_HGCM_CALL_TIMED_32(0)))
2477	{
2478	CHECKRET_MIN_SIZE("HGCM_CALL_TIMED", sizeof(VBoxGuestHGCMCallInfoTimed));
2479	VBoxGuestHGCMCallInfoTimed pInfo = (VBoxGuestHGCMCallInfoTimed )pvData;
2480	rc = VBoxGuestCommonIOCtl_HGCMCall(pDevExt, pSession, &pInfo->info, pInfo->u32Timeout,
2481	!!pInfo->fInterruptible \|\| pSession->R0Process != NIL_RTR0PROCESS,
2482	true /f32bit/, false /* fUserData */,
2483	RT_OFFSETOF(VBoxGuestHGCMCallInfoTimed, info), cbData, pcbDataReturned);
2484	}
2485	# endif
2486	#endif /* VBOX_WITH_HGCM */
2487	else if (VBOXGUEST_IOCTL_STRIP_SIZE(iFunction) == VBOXGUEST_IOCTL_STRIP_SIZE(VBOXGUEST_IOCTL_LOG(0)))
2488	{
2489	CHECKRET_MIN_SIZE("LOG", 1);
2490	rc = VBoxGuestCommonIOCtl_Log(pDevExt, (char *)pvData, cbData, pcbDataReturned);
2491	}
2492	else
2493	{
2494	switch (iFunction)
2495	{
2496	case VBOXGUEST_IOCTL_GETVMMDEVPORT:
2497	CHECKRET_RING0("GETVMMDEVPORT");
2498	CHECKRET_MIN_SIZE("GETVMMDEVPORT", sizeof(VBoxGuestPortInfo));
2499	rc = VBoxGuestCommonIOCtl_GetVMMDevPort(pDevExt, (VBoxGuestPortInfo *)pvData, pcbDataReturned);
2500	break;
2501
2502	case VBOXGUEST_IOCTL_WAITEVENT:
2503	CHECKRET_MIN_SIZE("WAITEVENT", sizeof(VBoxGuestWaitEventInfo));
2504	rc = VBoxGuestCommonIOCtl_WaitEvent(pDevExt, pSession, (VBoxGuestWaitEventInfo *)pvData,
2505	pcbDataReturned, pSession->R0Process != NIL_RTR0PROCESS);
2506	break;
2507
2508	case VBOXGUEST_IOCTL_CANCEL_ALL_WAITEVENTS:
2509	if (cbData != 0)
2510	rc = VERR_INVALID_PARAMETER;
2511	rc = VBoxGuestCommonIOCtl_CancelAllWaitEvents(pDevExt, pSession);
2512	break;
2513
2514	case VBOXGUEST_IOCTL_CTL_FILTER_MASK:
2515	CHECKRET_MIN_SIZE("CTL_FILTER_MASK", sizeof(VBoxGuestFilterMaskInfo));
2516	rc = VBoxGuestCommonIOCtl_CtlFilterMask(pDevExt, (VBoxGuestFilterMaskInfo *)pvData);
2517	break;
2518
2519	#ifdef VBOX_WITH_HGCM
2520	case VBOXGUEST_IOCTL_HGCM_CONNECT:
2521	# ifdef RT_ARCH_AMD64
2522	case VBOXGUEST_IOCTL_HGCM_CONNECT_32:
2523	# endif
2524	CHECKRET_MIN_SIZE("HGCM_CONNECT", sizeof(VBoxGuestHGCMConnectInfo));
2525	rc = VBoxGuestCommonIOCtl_HGCMConnect(pDevExt, pSession, (VBoxGuestHGCMConnectInfo *)pvData, pcbDataReturned);
2526	break;
2527
2528	case VBOXGUEST_IOCTL_HGCM_DISCONNECT:
2529	# ifdef RT_ARCH_AMD64
2530	case VBOXGUEST_IOCTL_HGCM_DISCONNECT_32:
2531	# endif
2532	CHECKRET_MIN_SIZE("HGCM_DISCONNECT", sizeof(VBoxGuestHGCMDisconnectInfo));
2533	rc = VBoxGuestCommonIOCtl_HGCMDisconnect(pDevExt, pSession, (VBoxGuestHGCMDisconnectInfo *)pvData, pcbDataReturned);
2534	break;
2535	#endif /* VBOX_WITH_HGCM */
2536
2537	case VBOXGUEST_IOCTL_CHECK_BALLOON:
2538	CHECKRET_MIN_SIZE("CHECK_MEMORY_BALLOON", sizeof(VBoxGuestCheckBalloonInfo));
2539	rc = VBoxGuestCommonIOCtl_CheckMemoryBalloon(pDevExt, pSession, (VBoxGuestCheckBalloonInfo *)pvData, pcbDataReturned);
2540	break;
2541
2542	case VBOXGUEST_IOCTL_CHANGE_BALLOON:
2543	CHECKRET_MIN_SIZE("CHANGE_MEMORY_BALLOON", sizeof(VBoxGuestChangeBalloonInfo));
2544	rc = VBoxGuestCommonIOCtl_ChangeMemoryBalloon(pDevExt, pSession, (VBoxGuestChangeBalloonInfo *)pvData, pcbDataReturned);
2545	break;
2546
2547	case VBOXGUEST_IOCTL_WRITE_CORE_DUMP:
2548	CHECKRET_MIN_SIZE("WRITE_CORE_DUMP", sizeof(VBoxGuestWriteCoreDump));
2549	rc = VBoxGuestCommonIOCtl_WriteCoreDump(pDevExt, (VBoxGuestWriteCoreDump *)pvData);
2550	break;
2551
2552	#ifdef VBOX_WITH_VRDP_SESSION_HANDLING
2553	case VBOXGUEST_IOCTL_ENABLE_VRDP_SESSION:
2554	rc = VBoxGuestCommonIOCtl_EnableVRDPSession(pDevExt, pSession);
2555	break;
2556
2557	case VBOXGUEST_IOCTL_DISABLE_VRDP_SESSION:
2558	rc = VBoxGuestCommonIOCtl_DisableVRDPSession(pDevExt, pSession);
2559	break;
2560	#endif /* VBOX_WITH_VRDP_SESSION_HANDLING */
2561	case VBOXGUEST_IOCTL_SET_MOUSE_STATUS:
2562	CHECKRET_SIZE("SET_MOUSE_STATUS", sizeof(uint32_t));
2563	rc = VBoxGuestCommonIOCtl_SetMouseStatus(pDevExt, pSession,
2564	(uint32_t )pvData);
2565	break;
2566
2567	default:
2568	{
2569	LogRel(("VBoxGuestCommonIOCtl: Unknown request iFunction=%#x Stripped size=%#x\n", iFunction,
2570	VBOXGUEST_IOCTL_STRIP_SIZE(iFunction)));
2571	rc = VERR_NOT_SUPPORTED;
2572	break;
2573	}
2574	}
2575	}
2576
2577	Log(("VBoxGuestCommonIOCtl: returns %Rrc pcbDataReturned=%zu\n", rc, pcbDataReturned ? pcbDataReturned : 0));
2578	return rc;
2579	}
2580
2581
2582
2583	/**
2584	* Common interrupt service routine.
2585	*
2586	* This deals with events and with waking up thread waiting for those events.
2587	*
2588	* @returns true if it was our interrupt, false if it wasn't.
2589	* @param pDevExt The VBoxGuest device extension.
2590	*/
2591	bool VBoxGuestCommonISR(PVBOXGUESTDEVEXT pDevExt)
2592	{
2593	bool fMousePositionChanged = false;
2594	VMMDevEvents volatile *pReq = pDevExt->pIrqAckEvents;
2595	int rc = 0;
2596	bool fOurIrq;
2597
2598	/*
2599	* Make sure we've initialized the device extension.
2600	*/
2601	if (RT_UNLIKELY(!pReq))
2602	return false;
2603
2604	/*
2605	* Enter the spinlock and check if it's our IRQ or not.
2606	*/
2607	RTSpinlockAcquire(pDevExt->EventSpinlock);
2608	fOurIrq = pDevExt->pVMMDevMemory->V.V1_04.fHaveEvents;
2609	if (fOurIrq)
2610	{
2611	/*
2612	* Acknowlegde events.
2613	* We don't use VbglGRPerform here as it may take another spinlocks.
2614	*/
2615	pReq->header.rc = VERR_INTERNAL_ERROR;
2616	pReq->events = 0;
2617	ASMCompilerBarrier();
2618	ASMOutU32(pDevExt->IOPortBase + VMMDEV_PORT_OFF_REQUEST, (uint32_t)pDevExt->PhysIrqAckEvents);
2619	ASMCompilerBarrier(); /* paranoia */
2620	if (RT_SUCCESS(pReq->header.rc))
2621	{
2622	uint32_t fEvents = pReq->events;
2623	PVBOXGUESTWAIT pWait;
2624	PVBOXGUESTWAIT pSafe;
2625
2626	Log(("VBoxGuestCommonISR: acknowledge events succeeded %#RX32\n", fEvents));
2627
2628	/*
2629	* VMMDEV_EVENT_MOUSE_POSITION_CHANGED can only be polled for.
2630	*/
2631	if (fEvents & VMMDEV_EVENT_MOUSE_POSITION_CHANGED)
2632	{
2633	fMousePositionChanged = true;
2634	fEvents &= ~VMMDEV_EVENT_MOUSE_POSITION_CHANGED;
2635	}
2636
2637	#ifdef VBOX_WITH_HGCM
2638	/*
2639	* The HGCM event/list is kind of different in that we evaluate all entries.
2640	*/
2641	if (fEvents & VMMDEV_EVENT_HGCM)
2642	{
2643	RTListForEachSafe(&pDevExt->HGCMWaitList, pWait, pSafe, VBOXGUESTWAIT, ListNode)
2644	{
2645	if (pWait->pHGCMReq->fu32Flags & VBOX_HGCM_REQ_DONE)
2646	{
2647	pWait->fResEvents = VMMDEV_EVENT_HGCM;
2648	RTListNodeRemove(&pWait->ListNode);
2649	# ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
2650	RTListAppend(&pDevExt->WakeUpList, &pWait->ListNode);
2651	# else
2652	RTListAppend(&pDevExt->WokenUpList, &pWait->ListNode);
2653	rc \|= RTSemEventMultiSignal(pWait->Event);
2654	# endif
2655	}
2656	}
2657	fEvents &= ~VMMDEV_EVENT_HGCM;
2658	}
2659	#endif
2660
2661	/*
2662	* Normal FIFO waiter evaluation.
2663	*/
2664	fEvents \|= pDevExt->f32PendingEvents;
2665	RTListForEachSafe(&pDevExt->WaitList, pWait, pSafe, VBOXGUESTWAIT, ListNode)
2666	{
2667	if ( (pWait->fReqEvents & fEvents)
2668	&& !pWait->fResEvents)
2669	{
2670	pWait->fResEvents = pWait->fReqEvents & fEvents;
2671	fEvents &= ~pWait->fResEvents;
2672	RTListNodeRemove(&pWait->ListNode);
2673	#ifdef VBOXGUEST_USE_DEFERRED_WAKE_UP
2674	RTListAppend(&pDevExt->WakeUpList, &pWait->ListNode);
2675	#else
2676	RTListAppend(&pDevExt->WokenUpList, &pWait->ListNode);
2677	rc \|= RTSemEventMultiSignal(pWait->Event);
2678	#endif
2679	if (!fEvents)
2680	break;
2681	}
2682	}
2683	ASMAtomicWriteU32(&pDevExt->f32PendingEvents, fEvents);
2684	}
2685	else /* something is serious wrong... */
2686	Log(("VBoxGuestCommonISR: acknowledge events failed rc=%Rrc (events=%#x)!!\n",
2687	pReq->header.rc, pReq->events));
2688	}
2689	else
2690	LogFlow(("VBoxGuestCommonISR: not ours\n"));
2691
2692	RTSpinlockReleaseNoInts(pDevExt->EventSpinlock);
2693
2694	#if defined(VBOXGUEST_USE_DEFERRED_WAKE_UP) && !defined(RT_OS_WINDOWS)
2695	/*
2696	* Do wake-ups.
2697	* Note. On Windows this isn't possible at this IRQL, so a DPC will take
2698	* care of it.
2699	*/
2700	VBoxGuestWaitDoWakeUps(pDevExt);
2701	#endif
2702
2703	/*
2704	* Work the poll and async notification queues on OSes that implements that.
2705	* (Do this outside the spinlock to prevent some recursive spinlocking.)
2706	*/
2707	if (fMousePositionChanged)
2708	{
2709	ASMAtomicIncU32(&pDevExt->u32MousePosChangedSeq);
2710	VBoxGuestNativeISRMousePollEvent(pDevExt);
2711	}
2712
2713	Assert(rc == 0);
2714	return fOurIrq;
2715	}
2716

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Additions/common/VBoxGuest/VBoxGuest.cpp@ 41212

Download in other formats: