SUPDRVShared.c@ 1003

Last change on this file since 1003 was 982, checked in by vboxsync, 18 years ago
fixed bustage.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 138.6 KB

Line
1	/** @file
2	*
3	* VBox host drivers - Ring-0 support drivers - Shared code:
4	* Driver code for all host platforms
5	*/
6
7	/*
8	* Copyright (C) 2006 InnoTek Systemberatung GmbH
9	*
10	* This file is part of VirtualBox Open Source Edition (OSE), as
11	* available from http://www.virtualbox.org. This file is free software;
12	* you can redistribute it and/or modify it under the terms of the GNU
13	* General Public License as published by the Free Software Foundation,
14	* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
15	* distribution. VirtualBox OSE is distributed in the hope that it will
16	* be useful, but WITHOUT ANY WARRANTY of any kind.
17	*
18	* If you received this file as part of a commercial VirtualBox
19	* distribution, then only the terms of your commercial VirtualBox
20	* license agreement apply instead of the previous paragraph.
21	*/
22
23
24	/*******************************************************************************
25	* Header Files *
26	*******************************************************************************/
27	#include "SUPDRV.h"
28	#ifndef PAGE_SHIFT
29	# include <iprt/param.h>
30	#endif
31	#include <iprt/alloc.h>
32	#include <iprt/semaphore.h>
33	#include <iprt/spinlock.h>
34	#include <iprt/thread.h>
35	#include <iprt/process.h>
36	#include <iprt/log.h>
37	#ifdef VBOX_WITHOUT_IDT_PATCHING
38	# include <VBox/vmm.h>
39	#endif
40
41
42	/*******************************************************************************
43	* Defined Constants And Macros *
44	*******************************************************************************/
45	/* from x86.h - clashes with linux thus this duplication */
46	#undef X86_CR0_PG
47	#define X86_CR0_PG BIT(31)
48	#undef X86_CR0_PE
49	#define X86_CR0_PE BIT(0)
50	#undef X86_CPUID_AMD_FEATURE_EDX_NX
51	#define X86_CPUID_AMD_FEATURE_EDX_NX BIT(20)
52	#undef MSR_K6_EFER
53	#define MSR_K6_EFER 0xc0000080
54	#undef MSR_K6_EFER_NXE
55	#define MSR_K6_EFER_NXE BIT(11)
56	#undef MSR_K6_EFER_LMA
57	#define MSR_K6_EFER_LMA BIT(10)
58	#undef X86_CR4_PGE
59	#define X86_CR4_PGE BIT(7)
60	#undef X86_CR4_PAE
61	#define X86_CR4_PAE BIT(5)
62	#undef X86_CPUID_AMD_FEATURE_EDX_LONG_MODE
63	#define X86_CPUID_AMD_FEATURE_EDX_LONG_MODE BIT(29)
64
65
66	/** The frequency by which we recalculate the u32UpdateHz and
67	* u32UpdateIntervalNS GIP members. The value must be a power of 2. */
68	#define GIP_UPDATEHZ_RECALC_FREQ 0x800
69
70
71	/*******************************************************************************
72	* Global Variables *
73	*******************************************************************************/
74	/**
75	* Array of the R0 SUP API.
76	*/
77	static SUPFUNC g_aFunctions[] =
78	{
79	/* name function */
80	{ "SUPR0ObjRegister", (void *)SUPR0ObjRegister },
81	{ "SUPR0ObjAddRef", (void *)SUPR0ObjAddRef },
82	{ "SUPR0ObjRelease", (void *)SUPR0ObjRelease },
83	{ "SUPR0ObjVerifyAccess", (void *)SUPR0ObjVerifyAccess },
84	{ "SUPR0LockMem", (void *)SUPR0LockMem },
85	{ "SUPR0UnlockMem", (void *)SUPR0UnlockMem },
86	{ "SUPR0ContAlloc", (void *)SUPR0ContAlloc },
87	{ "SUPR0ContFree", (void *)SUPR0ContFree },
88	{ "SUPR0MemAlloc", (void *)SUPR0MemAlloc },
89	{ "SUPR0MemGetPhys", (void *)SUPR0MemGetPhys },
90	{ "SUPR0MemFree", (void *)SUPR0MemFree },
91	{ "SUPR0Printf", (void *)SUPR0Printf },
92	{ "RTMemAlloc", (void *)RTMemAlloc },
93	{ "RTMemAllocZ", (void *)RTMemAllocZ },
94	{ "RTMemFree", (void *)RTMemFree },
95	/* These doesn't work yet on linux - use fast mutexes!
96	{ "RTSemMutexCreate", (void *)RTSemMutexCreate },
97	{ "RTSemMutexRequest", (void *)RTSemMutexRequest },
98	{ "RTSemMutexRelease", (void *)RTSemMutexRelease },
99	{ "RTSemMutexDestroy", (void *)RTSemMutexDestroy },
100	*/
101	{ "RTSemFastMutexCreate", (void *)RTSemFastMutexCreate },
102	{ "RTSemFastMutexDestroy", (void *)RTSemFastMutexDestroy },
103	{ "RTSemFastMutexRequest", (void *)RTSemFastMutexRequest },
104	{ "RTSemFastMutexRelease", (void *)RTSemFastMutexRelease },
105	{ "RTSemEventCreate", (void *)RTSemEventCreate },
106	{ "RTSemEventSignal", (void *)RTSemEventSignal },
107	{ "RTSemEventWait", (void *)RTSemEventWait },
108	{ "RTSemEventDestroy", (void *)RTSemEventDestroy },
109	{ "RTSpinlockCreate", (void *)RTSpinlockCreate },
110	{ "RTSpinlockDestroy", (void *)RTSpinlockDestroy },
111	{ "RTSpinlockAcquire", (void *)RTSpinlockAcquire },
112	{ "RTSpinlockRelease", (void *)RTSpinlockRelease },
113	{ "RTSpinlockAcquireNoInts", (void *)RTSpinlockAcquireNoInts },
114	{ "RTSpinlockReleaseNoInts", (void *)RTSpinlockReleaseNoInts },
115	{ "RTThreadNativeSelf", (void *)RTThreadNativeSelf },
116	{ "RTThreadSleep", (void *)RTThreadSleep },
117	{ "RTThreadYield", (void *)RTThreadYield },
118	#if 0 /* Thread APIs, Part 2. */
119	{ "RTThreadSelf", (void *)RTThreadSelf },
120	{ "RTThreadCreate", (void *)RTThreadCreate },
121	{ "RTThreadGetNative", (void *)RTThreadGetNative },
122	{ "RTThreadWait", (void *)RTThreadWait },
123	{ "RTThreadWaitNoResume", (void *)RTThreadWaitNoResume },
124	{ "RTThreadGetName", (void *)RTThreadGetName },
125	{ "RTThreadSelfName", (void *)RTThreadSelfName },
126	{ "RTThreadGetType", (void *)RTThreadGetType },
127	{ "RTThreadUserSignal", (void *)RTThreadUserSignal },
128	{ "RTThreadUserReset", (void *)RTThreadUserReset },
129	{ "RTThreadUserWait", (void *)RTThreadUserWait },
130	{ "RTThreadUserWaitNoResume", (void *)RTThreadUserWaitNoResume },
131	#endif
132	{ "RTLogDefaultInstance", (void *)RTLogDefaultInstance },
133	{ "RTLogRelDefaultInstance", (void *)RTLogRelDefaultInstance },
134	{ "RTLogSetDefaultInstanceThread", (void *)RTLogSetDefaultInstanceThread },
135	{ "RTLogLogger", (void *)RTLogLogger },
136	{ "RTLogLoggerEx", (void *)RTLogLoggerEx },
137	{ "RTLogLoggerExV", (void *)RTLogLoggerExV },
138	{ "AssertMsg1", (void *)AssertMsg1 },
139	{ "AssertMsg2", (void *)AssertMsg2 },
140	};
141
142
143	/*******************************************************************************
144	* Internal Functions *
145	*******************************************************************************/
146	__BEGIN_DECLS
147	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession);
148	static int supdrvMemRelease(PSUPDRVSESSION pSession, void *pv, SUPDRVMEMREFTYPE eType);
149	#ifndef VBOX_WITHOUT_IDT_PATCHING
150	static int supdrvIOCtl_IdtInstall(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPIDTINSTALL_IN pIn, PSUPIDTINSTALL_OUT pOut);
151	static PSUPDRVPATCH supdrvIdtPatchOne(PSUPDRVDEVEXT pDevExt, PSUPDRVPATCH pPatch);
152	static int supdrvIOCtl_IdtRemoveAll(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession);
153	static void supdrvIdtRemoveOne(PSUPDRVDEVEXT pDevExt, PSUPDRVPATCH pPatch);
154	static void supdrvIdtWrite(volatile void pvIdtEntry, const SUPDRVIDTE pNewIDTEntry);
155	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
156	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN_IN pIn, PSUPLDROPEN_OUT pOut);
157	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD_IN pIn);
158	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE_IN pIn);
159	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL_IN pIn, PSUPLDRGETSYMBOL_OUT pOut);
160	static int supdrvLdrSetR0EP(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0Entry);
161	static void supdrvLdrUnsetR0EP(PSUPDRVDEVEXT pDevExt);
162	static void supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage);
163	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage);
164	static int supdrvIOCtl_GetPagingMode(PSUPGETPAGINGMODE_OUT pOut);
165	#ifdef USE_NEW_OS_INTERFACE
166	static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt);
167	static int supdrvGipDestroy(PSUPDRVDEVEXT pDevExt);
168	static DECLCALLBACK(void) supdrvGipTimer(PRTTIMER pTimer, void *pvUser);
169	#endif
170
171	__END_DECLS
172
173
174	/**
175	* Initializes the device extentsion structure.
176	*
177	* @returns 0 on success.
178	* @returns SUPDRV_ERR_ on failure.
179	* @param pDevExt The device extension to initialize.
180	*/
181	int VBOXCALL supdrvInitDevExt(PSUPDRVDEVEXT pDevExt)
182	{
183	/*
184	* Initialize it.
185	*/
186	int rc;
187	memset(pDevExt, 0, sizeof(*pDevExt));
188	rc = RTSpinlockCreate(&pDevExt->Spinlock);
189	if (!rc)
190	{
191	rc = RTSemFastMutexCreate(&pDevExt->mtxLdr);
192	if (!rc)
193	{
194	rc = RTSemFastMutexCreate(&pDevExt->mtxGip);
195	if (!rc)
196	{
197	#ifdef USE_NEW_OS_INTERFACE
198	rc = supdrvGipCreate(pDevExt);
199	if (RT_SUCCESS(rc))
200	{
201	pDevExt->u32Cookie = BIRD;
202	return 0;
203	}
204	#else
205	pDevExt->u32Cookie = BIRD;
206	return 0;
207	#endif
208	}
209	RTSemFastMutexDestroy(pDevExt->mtxLdr);
210	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
211	}
212	RTSpinlockDestroy(pDevExt->Spinlock);
213	pDevExt->Spinlock = NIL_RTSPINLOCK;
214	}
215	return rc;
216	}
217
218	/**
219	* Delete the device extension (e.g. cleanup members).
220	*
221	* @returns 0.
222	* @param pDevExt The device extension to delete.
223	*/
224	int VBOXCALL supdrvDeleteDevExt(PSUPDRVDEVEXT pDevExt)
225	{
226	#ifndef VBOX_WITHOUT_IDT_PATCHING
227	PSUPDRVPATCH pPatch;
228	#endif
229	PSUPDRVOBJ pObj;
230	PSUPDRVUSAGE pUsage;
231
232	/*
233	* Kill mutexes and spinlocks.
234	*/
235	RTSemFastMutexDestroy(pDevExt->mtxGip);
236	pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
237	RTSemFastMutexDestroy(pDevExt->mtxLdr);
238	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
239	RTSpinlockDestroy(pDevExt->Spinlock);
240	pDevExt->Spinlock = NIL_RTSPINLOCK;
241
242	/*
243	* Free lists.
244	*/
245
246	#ifndef VBOX_WITHOUT_IDT_PATCHING
247	/* patches */
248	/** @todo make sure we don't uninstall patches which has been patched by someone else. */
249	pPatch = pDevExt->pIdtPatchesFree;
250	pDevExt->pIdtPatchesFree = NULL;
251	while (pPatch)
252	{
253	void *pvFree = pPatch;
254	pPatch = pPatch->pNext;
255	RTMemExecFree(pvFree);
256	}
257	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
258
259	/* objects. */
260	pObj = pDevExt->pObjs;
261	#if !defined(DEBUG_bird) \|\| !defined(__LINUX__) /* breaks unloading, temporary, remove me! */
262	Assert(!pObj); /* (can trigger on forced unloads) */
263	#endif
264	pDevExt->pObjs = NULL;
265	while (pObj)
266	{
267	void *pvFree = pObj;
268	pObj = pObj->pNext;
269	RTMemFree(pvFree);
270	}
271
272	/* usage records. */
273	pUsage = pDevExt->pUsageFree;
274	pDevExt->pUsageFree = NULL;
275	while (pUsage)
276	{
277	void *pvFree = pUsage;
278	pUsage = pUsage->pNext;
279	RTMemFree(pvFree);
280	}
281
282	#ifdef USE_NEW_OS_INTERFACE
283	/* kill the GIP */
284	supdrvGipDestroy(pDevExt);
285	#endif
286
287	return 0;
288	}
289
290
291	/**
292	* Create session.
293	*
294	* @returns 0 on success.
295	* @returns SUPDRV_ERR_ on failure.
296	* @param pDevExt Device extension.
297	* @param ppSession Where to store the pointer to the session data.
298	*/
299	int VBOXCALL supdrvCreateSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION *ppSession)
300	{
301	/*
302	* Allocate memory for the session data.
303	*/
304	int rc = SUPDRV_ERR_NO_MEMORY;
305	PSUPDRVSESSION pSession = ppSession = (PSUPDRVSESSION)RTMemAllocZ(sizeof(pSession));
306	if (pSession)
307	{
308	/* Initialize session data. */
309	rc = RTSpinlockCreate(&pSession->Spinlock);
310	if (!rc)
311	{
312	Assert(pSession->Spinlock != NIL_RTSPINLOCK);
313	pSession->pDevExt = pDevExt;
314	pSession->u32Cookie = BIRD_INV;
315	//pSession->pLdrUsage = NULL;
316	//pSession->pPatchUsage = NULL;
317	//pSession->pUsage = NULL;
318	//pSession->pGip = NULL;
319	//pSession->fGipReferenced = false;
320	//pSession->Bundle.cUsed = 0
321
322	dprintf(("Created session %p initial cookie=%#x\n", pSession, pSession->u32Cookie));
323	return 0;
324	}
325
326	RTMemFree(pSession);
327	*ppSession = NULL;
328	}
329
330	dprintf(("Failed to create spinlock, rc=%d!\n", rc));
331	return rc;
332	}
333
334
335	/**
336	* Shared code for cleaning up a session.
337	*
338	* @param pDevExt Device extension.
339	* @param pSession Session data.
340	* This data will be freed by this routine.
341	*/
342	void VBOXCALL supdrvCloseSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
343	{
344	/*
345	* Cleanup the session first.
346	*/
347	supdrvCleanupSession(pDevExt, pSession);
348
349	/*
350	* Free the rest of the session stuff.
351	*/
352	RTSpinlockDestroy(pSession->Spinlock);
353	pSession->Spinlock = NIL_RTSPINLOCK;
354	pSession->pDevExt = NULL;
355	RTMemFree(pSession);
356	dprintf2(("supdrvCloseSession: returns\n"));
357	}
358
359
360	/**
361	* Shared code for cleaning up a session (but not quite freeing it).
362	*
363	* This is primarily intended for MAC OS X where we have to clean up the memory
364	* stuff before the file handle is closed.
365	*
366	* @param pDevExt Device extension.
367	* @param pSession Session data.
368	* This data will be freed by this routine.
369	*/
370	void VBOXCALL supdrvCleanupSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
371	{
372	PSUPDRVBUNDLE pBundle;
373	dprintf(("supdrvCleanupSession: pSession=%p\n", pSession));
374
375	/*
376	* Remove logger instances related to this session.
377	* (This assumes the dprintf and dprintf2 macros doesn't use the normal logging.)
378	*/
379	RTLogSetDefaultInstanceThread(NULL, (uintptr_t)pSession);
380
381	#ifndef VBOX_WITHOUT_IDT_PATCHING
382	/*
383	* Uninstall any IDT patches installed for this session.
384	*/
385	supdrvIOCtl_IdtRemoveAll(pDevExt, pSession);
386	#endif
387
388	/*
389	* Release object references made in this session.
390	* In theory there should be noone racing us in this session.
391	*/
392	dprintf2(("release objects - start\n"));
393	if (pSession->pUsage)
394	{
395	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
396	PSUPDRVUSAGE pUsage;
397	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
398
399	while ((pUsage = pSession->pUsage) != NULL)
400	{
401	PSUPDRVOBJ pObj = pUsage->pObj;
402	pSession->pUsage = pUsage->pNext;
403
404	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
405	if (pUsage->cUsage < pObj->cUsage)
406	{
407	pObj->cUsage -= pUsage->cUsage;
408	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
409	}
410	else
411	{
412	/* Destroy the object and free the record. */
413	if (pDevExt->pObjs == pObj)
414	pDevExt->pObjs = pObj->pNext;
415	else
416	{
417	PSUPDRVOBJ pObjPrev;
418	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
419	if (pObjPrev->pNext == pObj)
420	{
421	pObjPrev->pNext = pObj->pNext;
422	break;
423	}
424	Assert(pObjPrev);
425	}
426	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
427
428	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
429	RTMemFree(pObj);
430	}
431
432	/* free it and continue. */
433	RTMemFree(pUsage);
434
435	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
436	}
437
438	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
439	AssertMsg(!pSession->pUsage, ("Some buster reregistered an object during desturction!\n"));
440	}
441	dprintf2(("release objects - done\n"));
442
443	/*
444	* Release memory allocated in the session.
445	*
446	* We do not serialize this as we assume that the application will
447	* not allocated memory while closing the file handle object.
448	*/
449	dprintf2(("freeing memory:\n"));
450	pBundle = &pSession->Bundle;
451	while (pBundle)
452	{
453	PSUPDRVBUNDLE pToFree;
454	unsigned i;
455
456	/*
457	* Check and unlock all entries in the bundle.
458	*/
459	for (i = 0; i < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]); i++)
460	{
461	#ifdef USE_NEW_OS_INTERFACE
462	if (pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ)
463	{
464	int rc;
465	if (pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ)
466	{
467	rc = RTR0MemObjFree(pBundle->aMem[i].MapObjR3, false);
468	AssertRC(rc); /** @todo figure out how to handle this. */
469	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
470	}
471	rc = RTR0MemObjFree(pBundle->aMem[i].MemObj, false);
472	AssertRC(rc); /** @todo figure out how to handle this. */
473	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
474	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
475	}
476
477	#else /* !USE_NEW_OS_INTERFACE */
478	if ( pBundle->aMem[i].pvR0
479	\|\| pBundle->aMem[i].pvR3)
480	{
481	dprintf2(("eType=%d pvR0=%p pvR3=%p cb=%d\n", pBundle->aMem[i].eType,
482	pBundle->aMem[i].pvR0, pBundle->aMem[i].pvR3, pBundle->aMem[i].cb));
483	switch (pBundle->aMem[i].eType)
484	{
485	case MEMREF_TYPE_LOCKED:
486	supdrvOSUnlockMemOne(&pBundle->aMem[i]);
487	break;
488	case MEMREF_TYPE_CONT:
489	supdrvOSContFreeOne(&pBundle->aMem[i]);
490	break;
491	case MEMREF_TYPE_LOW:
492	supdrvOSLowFreeOne(&pBundle->aMem[i]);
493	break;
494	case MEMREF_TYPE_MEM:
495	supdrvOSMemFreeOne(&pBundle->aMem[i]);
496	break;
497	default:
498	break;
499	}
500	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
501	}
502	#endif /* !USE_NEW_OS_INTERFACE */
503	}
504
505	/*
506	* Advance and free previous bundle.
507	*/
508	pToFree = pBundle;
509	pBundle = pBundle->pNext;
510
511	pToFree->pNext = NULL;
512	pToFree->cUsed = 0;
513	if (pToFree != &pSession->Bundle)
514	RTMemFree(pToFree);
515	}
516	dprintf2(("freeing memory - done\n"));
517
518	/*
519	* Loaded images needs to be dereferenced and possibly freed up.
520	*/
521	RTSemFastMutexRequest(pDevExt->mtxLdr);
522	dprintf2(("freeing images:\n"));
523	if (pSession->pLdrUsage)
524	{
525	PSUPDRVLDRUSAGE pUsage = pSession->pLdrUsage;
526	pSession->pLdrUsage = NULL;
527	while (pUsage)
528	{
529	void *pvFree = pUsage;
530	PSUPDRVLDRIMAGE pImage = pUsage->pImage;
531	if (pImage->cUsage > pUsage->cUsage)
532	pImage->cUsage -= pUsage->cUsage;
533	else
534	supdrvLdrFree(pDevExt, pImage);
535	pUsage->pImage = NULL;
536	pUsage = pUsage->pNext;
537	RTMemFree(pvFree);
538	}
539	}
540	RTSemFastMutexRelease(pDevExt->mtxLdr);
541	dprintf2(("freeing images - done\n"));
542
543	/*
544	* Unmap the GIP.
545	*/
546	dprintf2(("umapping GIP:\n"));
547	#ifdef USE_NEW_OS_INTERFACE
548	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
549	#else
550	if (pSession->pGip)
551	#endif
552	{
553	SUPR0GipUnmap(pSession);
554	#ifndef USE_NEW_OS_INTERFACE
555	pSession->pGip = NULL;
556	#endif
557	pSession->fGipReferenced = 0;
558	}
559	dprintf2(("umapping GIP - done\n"));
560	}
561
562
563	#ifdef VBOX_WITHOUT_IDT_PATCHING
564	/**
565	* Fast path I/O Control worker.
566	*
567	* @returns 0 on success.
568	* @returns One of the SUPDRV_ERR_* on failure.
569	* @param uIOCtl Function number.
570	* @param pDevExt Device extention.
571	* @param pSession Session data.
572	*/
573	int VBOXCALL supdrvIOCtlFast(unsigned uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
574	{
575	/*
576	* Disable interrupts before invoking VMMR0Entry() because it ASSUMES
577	* that interrupts are disabled. (We check the two prereqs after doing
578	* this only to allow the compiler to optimize things better.)
579	*/
580	RTCCUINTREG uFlags = ASMGetFlags();
581	ASMIntDisable();
582
583	int rc;
584	if (RT_LIKELY(pSession->pVM && pDevExt->pfnVMMR0Entry))
585	{
586	switch (uIOCtl)
587	{
588	case SUP_IOCTL_FAST_DO_RAW_RUN:
589	rc = pDevExt->pfnVMMR0Entry(pSession->pVM, VMMR0_DO_RAW_RUN, NULL);
590	break;
591	case SUP_IOCTL_FAST_DO_HWACC_RUN:
592	rc = pDevExt->pfnVMMR0Entry(pSession->pVM, VMMR0_DO_HWACC_RUN, NULL);
593	break;
594	case SUP_IOCTL_FAST_DO_NOP:
595	rc = pDevExt->pfnVMMR0Entry(pSession->pVM, VMMR0_DO_NOP, NULL);
596	break;
597	default:
598	rc = VERR_INTERNAL_ERROR;
599	break;
600	}
601	}
602	else
603	rc = VERR_INTERNAL_ERROR;
604
605	ASMSetFlags(uFlags);
606	return rc;
607	}
608	#endif /* VBOX_WITHOUT_IDT_PATCHING */
609
610
611	/**
612	* I/O Control worker.
613	*
614	* @returns 0 on success.
615	* @returns One of the SUPDRV_ERR_* on failure.
616	* @param uIOCtl Function number.
617	* @param pDevExt Device extention.
618	* @param pSession Session data.
619	* @param pvIn Input data.
620	* @param cbIn Size of input data.
621	* @param pvOut Output data.
622	* IMPORTANT! This buffer may be shared with the input
623	* data, thus no writing before done reading
624	* input data!!!
625	* @param cbOut Size of output data.
626	* @param pcbReturned Size of the returned data.
627	*/
628	int VBOXCALL supdrvIOCtl(unsigned int uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession,
629	void pvIn, unsigned cbIn, void pvOut, unsigned cbOut, unsigned *pcbReturned)
630	{
631	*pcbReturned = 0;
632	switch (uIOCtl)
633	{
634	case SUP_IOCTL_COOKIE:
635	{
636	PSUPCOOKIE_IN pIn = (PSUPCOOKIE_IN)pvIn;
637	PSUPCOOKIE_OUT pOut = (PSUPCOOKIE_OUT)pvOut;
638
639	/*
640	* Validate.
641	*/
642	if ( cbIn != sizeof(*pIn)
643	\|\| cbOut != sizeof(*pOut))
644	{
645	dprintf(("SUP_IOCTL_COOKIE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
646	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
647	return SUPDRV_ERR_INVALID_PARAM;
648	}
649	if (strncmp(pIn->szMagic, SUPCOOKIE_MAGIC, sizeof(pIn->szMagic)))
650	{
651	dprintf(("SUP_IOCTL_COOKIE: invalid magic %.16s\n", pIn->szMagic));
652	return SUPDRV_ERR_INVALID_MAGIC;
653	}
654	if (pIn->u32Version != SUPDRVIOC_VERSION)
655	{
656	dprintf(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Current: %#x\n", pIn->u32Version, SUPDRVIOC_VERSION));
657	return SUPDRV_ERR_VERSION_MISMATCH;
658	}
659
660	/*
661	* Fill in return data and be gone.
662	*/
663	/** @todo secure cookie negotiation? */
664	pOut->u32Cookie = pDevExt->u32Cookie;
665	pOut->u32SessionCookie = pSession->u32Cookie;
666	pOut->u32Version = SUPDRVIOC_VERSION;
667	pOut->pSession = pSession;
668	pOut->cFunctions = sizeof(g_aFunctions) / sizeof(g_aFunctions[0]);
669	pcbReturned = sizeof(pOut);
670	return 0;
671	}
672
673
674	case SUP_IOCTL_QUERY_FUNCS:
675	{
676	unsigned cFunctions;
677	PSUPQUERYFUNCS_IN pIn = (PSUPQUERYFUNCS_IN)pvIn;
678	PSUPQUERYFUNCS_OUT pOut = (PSUPQUERYFUNCS_OUT)pvOut;
679
680	/*
681	* Validate.
682	*/
683	if ( cbIn != sizeof(*pIn)
684	\|\| cbOut < sizeof(*pOut))
685	{
686	dprintf(("SUP_IOCTL_QUERY_FUNCS: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
687	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
688	return SUPDRV_ERR_INVALID_PARAM;
689	}
690	if ( pIn->u32Cookie != pDevExt->u32Cookie
691	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
692	{
693	dprintf(("SUP_IOCTL_QUERY_FUNCS: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
694	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
695	return SUPDRV_ERR_INVALID_MAGIC;
696	}
697
698	/*
699	* Copy the functions.
700	*/
701	cFunctions = (cbOut - RT_OFFSETOF(SUPQUERYFUNCS_OUT, aFunctions)) / sizeof(pOut->aFunctions[0]);
702	cFunctions = RT_MIN(cFunctions, ELEMENTS(g_aFunctions));
703	AssertMsg(cFunctions == ELEMENTS(g_aFunctions),
704	("Why aren't R3 querying all the functions!?! cFunctions=%d while there are %d available\n",
705	cFunctions, ELEMENTS(g_aFunctions)));
706	pOut->cFunctions = cFunctions;
707	memcpy(&pOut->aFunctions[0], g_aFunctions, sizeof(pOut->aFunctions[0]) * cFunctions);
708	*pcbReturned = RT_OFFSETOF(SUPQUERYFUNCS_OUT, aFunctions[cFunctions]);
709	return 0;
710	}
711
712
713	case SUP_IOCTL_IDT_INSTALL:
714	{
715	PSUPIDTINSTALL_IN pIn = (PSUPIDTINSTALL_IN)pvIn;
716	PSUPIDTINSTALL_OUT pOut = (PSUPIDTINSTALL_OUT)pvOut;
717
718	/*
719	* Validate.
720	*/
721	if ( cbIn != sizeof(*pIn)
722	\|\| cbOut != sizeof(*pOut))
723	{
724	dprintf(("SUP_IOCTL_INSTALL: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
725	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
726	return SUPDRV_ERR_INVALID_PARAM;
727	}
728	if ( pIn->u32Cookie != pDevExt->u32Cookie
729	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
730	{
731	dprintf(("SUP_IOCTL_INSTALL: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
732	pIn->u32Cookie, pDevExt->u32Cookie,
733	pIn->u32SessionCookie, pSession->u32Cookie));
734	return SUPDRV_ERR_INVALID_MAGIC;
735	}
736
737	pcbReturned = sizeof(pOut);
738	#ifndef VBOX_WITHOUT_IDT_PATCHING
739	return supdrvIOCtl_IdtInstall(pDevExt, pSession, pIn, pOut);
740	#else
741	pOut->u8Idt = 3;
742	return 0;
743	#endif
744	}
745
746
747	case SUP_IOCTL_IDT_REMOVE:
748	{
749	PSUPIDTREMOVE_IN pIn = (PSUPIDTREMOVE_IN)pvIn;
750
751	/*
752	* Validate.
753	*/
754	if ( cbIn != sizeof(*pIn)
755	\|\| cbOut != 0)
756	{
757	dprintf(("SUP_IOCTL_REMOVE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
758	cbIn, sizeof(*pIn), cbOut, 0));
759	return SUPDRV_ERR_INVALID_PARAM;
760	}
761	if ( pIn->u32Cookie != pDevExt->u32Cookie
762	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
763	{
764	dprintf(("SUP_IOCTL_REMOVE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
765	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
766	return SUPDRV_ERR_INVALID_MAGIC;
767	}
768
769	#ifndef VBOX_WITHOUT_IDT_PATCHING
770	return supdrvIOCtl_IdtRemoveAll(pDevExt, pSession);
771	#else
772	return 0;
773	#endif
774	}
775
776
777	case SUP_IOCTL_PINPAGES:
778	{
779	int rc;
780	PSUPPINPAGES_IN pIn = (PSUPPINPAGES_IN)pvIn;
781	PSUPPINPAGES_OUT pOut = (PSUPPINPAGES_OUT)pvOut;
782
783	/*
784	* Validate.
785	*/
786	if ( cbIn != sizeof(*pIn)
787	\|\| cbOut < sizeof(*pOut))
788	{
789	dprintf(("SUP_IOCTL_PINPAGES: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
790	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
791	return SUPDRV_ERR_INVALID_PARAM;
792	}
793	if ( pIn->u32Cookie != pDevExt->u32Cookie
794	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
795	{
796	dprintf(("SUP_IOCTL_PINPAGES: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
797	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
798	return SUPDRV_ERR_INVALID_MAGIC;
799	}
800	if (pIn->cb <= 0 \|\| !pIn->pv)
801	{
802	dprintf(("SUP_IOCTL_PINPAGES: Illegal request %p %d\n", pIn->pv, pIn->cb));
803	return SUPDRV_ERR_INVALID_PARAM;
804	}
805	if ((unsigned)RT_OFFSETOF(SUPPINPAGES_OUT, aPages[pIn->cb >> PAGE_SHIFT]) > cbOut)
806	{
807	dprintf(("SUP_IOCTL_PINPAGES: Output buffer is too small! %d required %d passed in.\n",
808	RT_OFFSETOF(SUPPINPAGES_OUT, aPages[pIn->cb >> PAGE_SHIFT]), cbOut));
809	return SUPDRV_ERR_INVALID_PARAM;
810	}
811
812	/*
813	* Execute.
814	*/
815	*pcbReturned = RT_OFFSETOF(SUPPINPAGES_OUT, aPages[pIn->cb >> PAGE_SHIFT]);
816	rc = SUPR0LockMem(pSession, pIn->pv, pIn->cb, &pOut->aPages[0]);
817	if (rc)
818	*pcbReturned = 0;
819	return rc;
820	}
821
822
823	case SUP_IOCTL_UNPINPAGES:
824	{
825	PSUPUNPINPAGES_IN pIn = (PSUPUNPINPAGES_IN)pvIn;
826
827	/*
828	* Validate.
829	*/
830	if ( cbIn != sizeof(*pIn)
831	\|\| cbOut != 0)
832	{
833	dprintf(("SUP_IOCTL_UNPINPAGES: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
834	cbIn, sizeof(*pIn), cbOut, 0));
835	return SUPDRV_ERR_INVALID_PARAM;
836	}
837	if ( pIn->u32Cookie != pDevExt->u32Cookie
838	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
839	{
840	dprintf(("SUP_IOCTL_UNPINPAGES: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
841	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
842	return SUPDRV_ERR_INVALID_MAGIC;
843	}
844
845	/*
846	* Execute.
847	*/
848	return SUPR0UnlockMem(pSession, pIn->pv);
849	}
850
851	case SUP_IOCTL_CONT_ALLOC:
852	{
853	int rc;
854	PSUPCONTALLOC_IN pIn = (PSUPCONTALLOC_IN)pvIn;
855	PSUPCONTALLOC_OUT pOut = (PSUPCONTALLOC_OUT)pvOut;
856
857	/*
858	* Validate.
859	*/
860	if ( cbIn != sizeof(*pIn)
861	\|\| cbOut < sizeof(*pOut))
862	{
863	dprintf(("SUP_IOCTL_CONT_ALLOC: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
864	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
865	return SUPDRV_ERR_INVALID_PARAM;
866	}
867	if ( pIn->u32Cookie != pDevExt->u32Cookie
868	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
869	{
870	dprintf(("SUP_IOCTL_CONT_ALLOC: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
871	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
872	return SUPDRV_ERR_INVALID_MAGIC;
873	}
874
875	/*
876	* Execute.
877	*/
878	rc = SUPR0ContAlloc(pSession, pIn->cb, &pOut->pvR0, &pOut->pvR3, &pOut->HCPhys);
879	if (!rc)
880	pcbReturned = sizeof(pOut);
881	return rc;
882	}
883
884
885	case SUP_IOCTL_CONT_FREE:
886	{
887	PSUPCONTFREE_IN pIn = (PSUPCONTFREE_IN)pvIn;
888
889	/*
890	* Validate.
891	*/
892	if ( cbIn != sizeof(*pIn)
893	\|\| cbOut != 0)
894	{
895	dprintf(("SUP_IOCTL_CONT_FREE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
896	cbIn, sizeof(*pIn), cbOut, 0));
897	return SUPDRV_ERR_INVALID_PARAM;
898	}
899	if ( pIn->u32Cookie != pDevExt->u32Cookie
900	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
901	{
902	dprintf(("SUP_IOCTL_CONT_FREE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
903	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
904	return SUPDRV_ERR_INVALID_MAGIC;
905	}
906
907	/*
908	* Execute.
909	*/
910	return SUPR0ContFree(pSession, pIn->pv);
911	}
912
913
914	case SUP_IOCTL_LDR_OPEN:
915	{
916	PSUPLDROPEN_IN pIn = (PSUPLDROPEN_IN)pvIn;
917	PSUPLDROPEN_OUT pOut = (PSUPLDROPEN_OUT)pvOut;
918
919	/*
920	* Validate.
921	*/
922	if ( cbIn != sizeof(*pIn)
923	\|\| cbOut != sizeof(*pOut))
924	{
925	dprintf(("SUP_IOCTL_LDR_OPEN: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
926	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
927	return SUPDRV_ERR_INVALID_PARAM;
928	}
929	if ( pIn->u32Cookie != pDevExt->u32Cookie
930	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
931	{
932	dprintf(("SUP_IOCTL_LDR_OPEN: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
933	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
934	return SUPDRV_ERR_INVALID_MAGIC;
935	}
936	if ( pIn->cbImage <= 0
937	\|\| pIn->cbImage >= 1610241024 /16MB/)
938	{
939	dprintf(("SUP_IOCTL_LDR_OPEN: Invalid size %d. (max is 16MB)\n", pIn->cbImage));
940	return SUPDRV_ERR_INVALID_PARAM;
941	}
942	if (!memchr(pIn->szName, '\0', sizeof(pIn->szName)))
943	{
944	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: The image name isn't terminated!\n"));
945	return SUPDRV_ERR_INVALID_PARAM;
946	}
947	if (!pIn->szName[0])
948	{
949	dprintf(("SUP_IOCTL_LDR_OPEN: The image name is too short\n"));
950	return SUPDRV_ERR_INVALID_PARAM;
951	}
952	if (strpbrk(pIn->szName, ";:()[]{}/\\\|&*%#@!~`\"'"))
953	{
954	dprintf(("SUP_IOCTL_LDR_OPEN: The name is invalid '%s'\n", pIn->szName));
955	return SUPDRV_ERR_INVALID_PARAM;
956	}
957
958	pcbReturned = sizeof(pOut);
959	return supdrvIOCtl_LdrOpen(pDevExt, pSession, pIn, pOut);
960	}
961
962
963	case SUP_IOCTL_LDR_LOAD:
964	{
965	PSUPLDRLOAD_IN pIn = (PSUPLDRLOAD_IN)pvIn;
966
967	/*
968	* Validate.
969	*/
970	if ( cbIn <= sizeof(*pIn)
971	\|\| cbOut != 0)
972	{
973	dprintf(("SUP_IOCTL_LDR_LOAD: Invalid input/output sizes. cbIn=%d expected greater than %d. cbOut=%d expected %d.\n",
974	cbIn, sizeof(*pIn), cbOut, 0));
975	return SUPDRV_ERR_INVALID_PARAM;
976	}
977	if ( pIn->u32Cookie != pDevExt->u32Cookie
978	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
979	{
980	dprintf(("SUP_IOCTL_LDR_LOAD: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
981	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
982	return SUPDRV_ERR_INVALID_MAGIC;
983	}
984	if ((unsigned)RT_OFFSETOF(SUPLDRLOAD_IN, achImage[pIn->cbImage]) > cbIn)
985	{
986	dprintf(("SUP_IOCTL_LDR_LOAD: Invalid size %d. InputBufferLength=%d\n",
987	pIn->cbImage, cbIn));
988	return SUPDRV_ERR_INVALID_PARAM;
989	}
990	if (pIn->cSymbols > 16384)
991	{
992	dprintf(("SUP_IOCTL_LDR_LOAD: Too many symbols. cSymbols=%u max=16384\n", pIn->cSymbols));
993	return SUPDRV_ERR_INVALID_PARAM;
994	}
995	if ( pIn->cSymbols
996	&& ( pIn->offSymbols >= pIn->cbImage
997	\|\| pIn->offSymbols + pIn->cSymbols * sizeof(SUPLDRSYM) > pIn->cbImage)
998	)
999	{
1000	dprintf(("SUP_IOCTL_LDR_LOAD: symbol table is outside the image bits! offSymbols=%u cSymbols=%d cbImage=%d\n",
1001	pIn->offSymbols, pIn->cSymbols, pIn->cbImage));
1002	return SUPDRV_ERR_INVALID_PARAM;
1003	}
1004	if ( pIn->cbStrTab
1005	&& ( pIn->offStrTab >= pIn->cbImage
1006	\|\| pIn->offStrTab + pIn->cbStrTab > pIn->cbImage
1007	\|\| pIn->offStrTab + pIn->cbStrTab < pIn->offStrTab)
1008	)
1009	{
1010	dprintf(("SUP_IOCTL_LDR_LOAD: string table is outside the image bits! offStrTab=%u cbStrTab=%d cbImage=%d\n",
1011	pIn->offStrTab, pIn->cbStrTab, pIn->cbImage));
1012	return SUPDRV_ERR_INVALID_PARAM;
1013	}
1014
1015	if (pIn->cSymbols)
1016	{
1017	uint32_t i;
1018	PSUPLDRSYM paSyms = (PSUPLDRSYM)&pIn->achImage[pIn->offSymbols];
1019	for (i = 0; i < pIn->cSymbols; i++)
1020	{
1021	if (paSyms[i].offSymbol >= pIn->cbImage)
1022	{
1023	dprintf(("SUP_IOCTL_LDR_LOAD: symbol i=%d has an invalid symbol offset: %#x (max=%#x)\n",
1024	i, paSyms[i].offSymbol, pIn->cbImage));
1025	return SUPDRV_ERR_INVALID_PARAM;
1026	}
1027	if (paSyms[i].offName >= pIn->cbStrTab)
1028	{
1029	dprintf(("SUP_IOCTL_LDR_LOAD: symbol i=%d has an invalid name offset: %#x (max=%#x)\n",
1030	i, paSyms[i].offName, pIn->cbStrTab));
1031	return SUPDRV_ERR_INVALID_PARAM;
1032	}
1033	if (!memchr(&pIn->achImage[pIn->offStrTab + paSyms[i].offName], '\0', pIn->cbStrTab - paSyms[i].offName))
1034	{
1035	dprintf(("SUP_IOCTL_LDR_LOAD: symbol i=%d has an unterminated name! offName=%#x (max=%#x)\n",
1036	i, paSyms[i].offName, pIn->cbStrTab));
1037	return SUPDRV_ERR_INVALID_PARAM;
1038	}
1039	}
1040	}
1041
1042	return supdrvIOCtl_LdrLoad(pDevExt, pSession, pIn);
1043	}
1044
1045
1046	case SUP_IOCTL_LDR_FREE:
1047	{
1048	PSUPLDRFREE_IN pIn = (PSUPLDRFREE_IN)pvIn;
1049
1050	/*
1051	* Validate.
1052	*/
1053	if ( cbIn != sizeof(*pIn)
1054	\|\| cbOut != 0)
1055	{
1056	dprintf(("SUP_IOCTL_LDR_FREE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1057	cbIn, sizeof(*pIn), cbOut, 0));
1058	return SUPDRV_ERR_INVALID_PARAM;
1059	}
1060	if ( pIn->u32Cookie != pDevExt->u32Cookie
1061	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1062	{
1063	dprintf(("SUP_IOCTL_LDR_FREE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1064	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1065	return SUPDRV_ERR_INVALID_MAGIC;
1066	}
1067
1068	return supdrvIOCtl_LdrFree(pDevExt, pSession, pIn);
1069	}
1070
1071
1072	case SUP_IOCTL_LDR_GET_SYMBOL:
1073	{
1074	PSUPLDRGETSYMBOL_IN pIn = (PSUPLDRGETSYMBOL_IN)pvIn;
1075	PSUPLDRGETSYMBOL_OUT pOut = (PSUPLDRGETSYMBOL_OUT)pvOut;
1076	char *pszEnd;
1077
1078	/*
1079	* Validate.
1080	*/
1081	if ( cbIn < (unsigned)RT_OFFSETOF(SUPLDRGETSYMBOL_IN, szSymbol[2])
1082	\|\| cbOut != sizeof(*pOut))
1083	{
1084	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: Invalid input/output sizes. cbIn=%d expected >=%d. cbOut=%d expected at%d.\n",
1085	cbIn, RT_OFFSETOF(SUPLDRGETSYMBOL_IN, szSymbol[2]), cbOut, 0));
1086	return SUPDRV_ERR_INVALID_PARAM;
1087	}
1088	if ( pIn->u32Cookie != pDevExt->u32Cookie
1089	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1090	{
1091	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1092	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1093	return SUPDRV_ERR_INVALID_MAGIC;
1094	}
1095	pszEnd = memchr(pIn->szSymbol, '\0', cbIn - RT_OFFSETOF(SUPLDRGETSYMBOL_IN, szSymbol));
1096	if (!pszEnd)
1097	{
1098	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: The symbol name isn't terminated!\n"));
1099	return SUPDRV_ERR_INVALID_PARAM;
1100	}
1101	if (pszEnd - &pIn->szSymbol[0] >= 1024)
1102	{
1103	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: The symbol name too long (%d chars, max is %d)!\n",
1104	pszEnd - &pIn->szSymbol[0], 1024));
1105	return SUPDRV_ERR_INVALID_PARAM;
1106	}
1107
1108	pOut->pvSymbol = NULL;
1109	pcbReturned = sizeof(pOut);
1110	return supdrvIOCtl_LdrGetSymbol(pDevExt, pSession, pIn, pOut);
1111	}
1112
1113
1114	/** @todo this interface needs re-doing, we're accessing Ring-3 buffers directly here! */
1115	case SUP_IOCTL_CALL_VMMR0:
1116	{
1117	PSUPCALLVMMR0_IN pIn = (PSUPCALLVMMR0_IN)pvIn;
1118	PSUPCALLVMMR0_OUT pOut = (PSUPCALLVMMR0_OUT)pvOut;
1119
1120	/*
1121	* Validate.
1122	*/
1123	if ( cbIn != sizeof(*pIn)
1124	\|\| cbOut != sizeof(*pOut))
1125	{
1126	dprintf(("SUP_IOCTL_CALL_VMMR0: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1127	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
1128	return SUPDRV_ERR_INVALID_PARAM;
1129	}
1130	if ( pIn->u32Cookie != pDevExt->u32Cookie
1131	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
1132	{
1133	dprintf(("SUP_IOCTL_CALL_VMMR0: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1134	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1135	return SUPDRV_ERR_INVALID_MAGIC;
1136	}
1137
1138	/*
1139	* Do we have an entrypoint?
1140	*/
1141	if (!pDevExt->pfnVMMR0Entry)
1142	return SUPDRV_ERR_GENERAL_FAILURE;
1143
1144	/*
1145	* Execute.
1146	*/
1147	pOut->rc = pDevExt->pfnVMMR0Entry(pIn->pVMR0, pIn->uOperation, pIn->pvArg);
1148	pcbReturned = sizeof(pOut);
1149	return 0;
1150	}
1151
1152
1153	case SUP_IOCTL_GET_PAGING_MODE:
1154	{
1155	int rc;
1156	PSUPGETPAGINGMODE_IN pIn = (PSUPGETPAGINGMODE_IN)pvIn;
1157	PSUPGETPAGINGMODE_OUT pOut = (PSUPGETPAGINGMODE_OUT)pvOut;
1158
1159	/*
1160	* Validate.
1161	*/
1162	if ( cbIn != sizeof(*pIn)
1163	\|\| cbOut != sizeof(*pOut))
1164	{
1165	dprintf(("SUP_IOCTL_GET_PAGING_MODE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1166	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
1167	return SUPDRV_ERR_INVALID_PARAM;
1168	}
1169	if ( pIn->u32Cookie != pDevExt->u32Cookie
1170	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
1171	{
1172	dprintf(("SUP_IOCTL_GET_PAGING_MODE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1173	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1174	return SUPDRV_ERR_INVALID_MAGIC;
1175	}
1176
1177	/*
1178	* Execute.
1179	*/
1180	pcbReturned = sizeof(pOut);
1181	rc = supdrvIOCtl_GetPagingMode(pOut);
1182	if (rc)
1183	*pcbReturned = 0;
1184	return rc;
1185	}
1186
1187
1188	case SUP_IOCTL_LOW_ALLOC:
1189	{
1190	int rc;
1191	PSUPLOWALLOC_IN pIn = (PSUPLOWALLOC_IN)pvIn;
1192	PSUPLOWALLOC_OUT pOut = (PSUPLOWALLOC_OUT)pvOut;
1193
1194	/*
1195	* Validate.
1196	*/
1197	if ( cbIn != sizeof(*pIn)
1198	\|\| cbOut < sizeof(*pOut))
1199	{
1200	dprintf(("SUP_IOCTL_LOW_ALLOC: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1201	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
1202	return SUPDRV_ERR_INVALID_PARAM;
1203	}
1204	if ( pIn->u32Cookie != pDevExt->u32Cookie
1205	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
1206	{
1207	dprintf(("SUP_IOCTL_LOW_ALLOC: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1208	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1209	return SUPDRV_ERR_INVALID_MAGIC;
1210	}
1211	if ((unsigned)RT_OFFSETOF(SUPLOWALLOC_OUT, aPages[pIn->cPages]) > cbOut)
1212	{
1213	dprintf(("SUP_IOCTL_LOW_ALLOC: Output buffer is too small! %d required %d passed in.\n",
1214	RT_OFFSETOF(SUPLOWALLOC_OUT, aPages[pIn->cPages]), cbOut));
1215	return SUPDRV_ERR_INVALID_PARAM;
1216	}
1217
1218	/*
1219	* Execute.
1220	*/
1221	*pcbReturned = RT_OFFSETOF(SUPLOWALLOC_OUT, aPages[pIn->cPages]);
1222	rc = SUPR0LowAlloc(pSession, pIn->cPages, &pOut->pvVirt, &pOut->aPages[0]);
1223	if (rc)
1224	*pcbReturned = 0;
1225	return rc;
1226	}
1227
1228
1229	case SUP_IOCTL_LOW_FREE:
1230	{
1231	PSUPLOWFREE_IN pIn = (PSUPLOWFREE_IN)pvIn;
1232
1233	/*
1234	* Validate.
1235	*/
1236	if ( cbIn != sizeof(*pIn)
1237	\|\| cbOut != 0)
1238	{
1239	dprintf(("SUP_IOCTL_LOW_FREE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1240	cbIn, sizeof(*pIn), cbOut, 0));
1241	return SUPDRV_ERR_INVALID_PARAM;
1242	}
1243	if ( pIn->u32Cookie != pDevExt->u32Cookie
1244	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1245	{
1246	dprintf(("SUP_IOCTL_LOW_FREE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1247	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1248	return SUPDRV_ERR_INVALID_MAGIC;
1249	}
1250
1251	/*
1252	* Execute.
1253	*/
1254	return SUPR0LowFree(pSession, pIn->pv);
1255	}
1256
1257
1258	case SUP_IOCTL_GIP_MAP:
1259	{
1260	int rc;
1261	PSUPGIPMAP_IN pIn = (PSUPGIPMAP_IN)pvIn;
1262	PSUPGIPMAP_OUT pOut = (PSUPGIPMAP_OUT)pvOut;
1263
1264	/*
1265	* Validate.
1266	*/
1267	if ( cbIn != sizeof(*pIn)
1268	\|\| cbOut != sizeof(*pOut))
1269	{
1270	dprintf(("SUP_IOCTL_GIP_MAP: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1271	cbIn, sizeof(*pIn), cbOut, 0));
1272	return SUPDRV_ERR_INVALID_PARAM;
1273	}
1274	if ( pIn->u32Cookie != pDevExt->u32Cookie
1275	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1276	{
1277	dprintf(("SUP_IOCTL_GIP_MAP: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1278	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1279	return SUPDRV_ERR_INVALID_MAGIC;
1280	}
1281
1282	/*
1283	* Execute.
1284	*/
1285	rc = SUPR0GipMap(pSession, &pOut->pGipR3, &pOut->HCPhysGip);
1286	if (!rc)
1287	{
1288	pOut->pGipR0 = pDevExt->pGip;
1289	pcbReturned = sizeof(pOut);
1290	}
1291	return rc;
1292	}
1293
1294
1295	case SUP_IOCTL_GIP_UNMAP:
1296	{
1297	PSUPGIPUNMAP_IN pIn = (PSUPGIPUNMAP_IN)pvIn;
1298
1299	/*
1300	* Validate.
1301	*/
1302	if ( cbIn != sizeof(*pIn)
1303	\|\| cbOut != 0)
1304	{
1305	dprintf(("SUP_IOCTL_GIP_UNMAP: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1306	cbIn, sizeof(*pIn), cbOut, 0));
1307	return SUPDRV_ERR_INVALID_PARAM;
1308	}
1309	if ( pIn->u32Cookie != pDevExt->u32Cookie
1310	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1311	{
1312	dprintf(("SUP_IOCTL_GIP_UNMAP: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1313	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1314	return SUPDRV_ERR_INVALID_MAGIC;
1315	}
1316
1317	/*
1318	* Execute.
1319	*/
1320	return SUPR0GipUnmap(pSession);
1321	}
1322
1323
1324	case SUP_IOCTL_SET_VM_FOR_FAST:
1325	{
1326	PSUPSETVMFORFAST_IN pIn = (PSUPSETVMFORFAST_IN)pvIn;
1327
1328	/*
1329	* Validate.
1330	*/
1331	if ( cbIn != sizeof(*pIn)
1332	\|\| cbOut != 0)
1333	{
1334	dprintf(("SUP_IOCTL_SET_VM_FOR_FAST: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1335	cbIn, sizeof(*pIn), cbOut, 0));
1336	return SUPDRV_ERR_INVALID_PARAM;
1337	}
1338	if ( pIn->u32Cookie != pDevExt->u32Cookie
1339	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1340	{
1341	dprintf(("SUP_IOCTL_SET_VM_FOR_FAST: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1342	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1343	return SUPDRV_ERR_INVALID_MAGIC;
1344	}
1345	if ( pIn->pVMR0 != NULL
1346	&& ( !VALID_PTR(pIn->pVMR0)
1347	\|\| ((uintptr_t)pIn->pVMR0 & (PAGE_SIZE - 1))
1348	)
1349	)
1350	{
1351	dprintf(("SUP_IOCTL_SET_VM_FOR_FAST: pVMR0=%p! Must be a valid, page aligned, pointer.\n", pIn->pVMR0));
1352	return SUPDRV_ERR_INVALID_POINTER;
1353	}
1354
1355	/*
1356	* Execute.
1357	*/
1358	#ifndef VBOX_WITHOUT_IDT_PATCHING
1359	OSDBGPRINT(("SUP_IOCTL_SET_VM_FOR_FAST: !VBOX_WITHOUT_IDT_PATCHING\n"));
1360	return SUPDRV_ERR_GENERAL_FAILURE;
1361	#else
1362	pSession->pVM = pIn->pVMR0;
1363	return 0;
1364	#endif
1365	}
1366
1367
1368	default:
1369	dprintf(("Unknown IOCTL %#x\n", uIOCtl));
1370	break;
1371	}
1372	return SUPDRV_ERR_GENERAL_FAILURE;
1373	}
1374
1375
1376	/**
1377	* Register a object for reference counting.
1378	* The object is registered with one reference in the specified session.
1379	*
1380	* @returns Unique identifier on success (pointer).
1381	* All future reference must use this identifier.
1382	* @returns NULL on failure.
1383	* @param pfnDestructor The destructore function which will be called when the reference count reaches 0.
1384	* @param pvUser1 The first user argument.
1385	* @param pvUser2 The second user argument.
1386	*/
1387	SUPR0DECL(void ) SUPR0ObjRegister(PSUPDRVSESSION pSession, SUPDRVOBJTYPE enmType, PFNSUPDRVDESTRUCTOR pfnDestructor, void pvUser1, void *pvUser2)
1388	{
1389	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1390	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1391	PSUPDRVOBJ pObj;
1392	PSUPDRVUSAGE pUsage;
1393
1394	/*
1395	* Validate the input.
1396	*/
1397	if (!pSession)
1398	{
1399	AssertMsgFailed(("Invalid pSession=%p\n", pSession));
1400	return NULL;
1401	}
1402	if ( enmType <= SUPDRVOBJTYPE_INVALID
1403	\|\| enmType >= SUPDRVOBJTYPE_END)
1404	{
1405	AssertMsgFailed(("Invalid enmType=%d\n", enmType));
1406	return NULL;
1407	}
1408	if (!pfnDestructor)
1409	{
1410	AssertMsgFailed(("Invalid pfnDestructor=%d\n", pfnDestructor));
1411	return NULL;
1412	}
1413
1414	/*
1415	* Allocate and initialize the object.
1416	*/
1417	pObj = (PSUPDRVOBJ)RTMemAlloc(sizeof(*pObj));
1418	if (!pObj)
1419	return NULL;
1420	pObj->u32Magic = SUPDRVOBJ_MAGIC;
1421	pObj->enmType = enmType;
1422	pObj->pNext = NULL;
1423	pObj->cUsage = 1;
1424	pObj->pfnDestructor = pfnDestructor;
1425	pObj->pvUser1 = pvUser1;
1426	pObj->pvUser2 = pvUser2;
1427	pObj->CreatorUid = pSession->Uid;
1428	pObj->CreatorGid = pSession->Gid;
1429	pObj->CreatorProcess= pSession->Process;
1430	supdrvOSObjInitCreator(pObj, pSession);
1431
1432	/*
1433	* Allocate the usage record.
1434	* (We keep freed usage records around to simplity SUPR0ObjAddRef().)
1435	*/
1436	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1437
1438	pUsage = pDevExt->pUsageFree;
1439	if (pUsage)
1440	pDevExt->pUsageFree = pUsage->pNext;
1441	else
1442	{
1443	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1444	pUsage = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsage));
1445	if (!pUsage)
1446	{
1447	RTMemFree(pObj);
1448	return NULL;
1449	}
1450	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1451	}
1452
1453	/*
1454	* Insert the object and create the session usage record.
1455	*/
1456	/* The object. */
1457	pObj->pNext = pDevExt->pObjs;
1458	pDevExt->pObjs = pObj;
1459
1460	/* The session record. */
1461	pUsage->cUsage = 1;
1462	pUsage->pObj = pObj;
1463	pUsage->pNext = pSession->pUsage;
1464	dprintf(("SUPR0ObjRegister: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));
1465	pSession->pUsage = pUsage;
1466
1467	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1468
1469	dprintf(("SUPR0ObjRegister: returns %p (pvUser1=%p, pvUser=%p)\n", pObj, pvUser1, pvUser2));
1470	return pObj;
1471	}
1472
1473
1474	/**
1475	* Increment the reference counter for the object associating the reference
1476	* with the specified session.
1477	*
1478	* @returns 0 on success.
1479	* @returns SUPDRV_ERR_* on failure.
1480	* @param pvObj The identifier returned by SUPR0ObjRegister().
1481	* @param pSession The session which is referencing the object.
1482	*/
1483	SUPR0DECL(int) SUPR0ObjAddRef(void *pvObj, PSUPDRVSESSION pSession)
1484	{
1485	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1486	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1487	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
1488	PSUPDRVUSAGE pUsagePre;
1489	PSUPDRVUSAGE pUsage;
1490
1491	/*
1492	* Validate the input.
1493	*/
1494	if (!pSession)
1495	{
1496	AssertMsgFailed(("Invalid pSession=%p\n", pSession));
1497	return SUPDRV_ERR_INVALID_PARAM;
1498	}
1499	if (!pObj \|\| pObj->u32Magic != SUPDRVOBJ_MAGIC)
1500	{
1501	AssertMsgFailed(("Invalid pvObj=%p magic=%#x (exepcted %#x)\n",
1502	pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC));
1503	return SUPDRV_ERR_INVALID_PARAM;
1504	}
1505
1506	/*
1507	* Preallocate the usage record.
1508	*/
1509	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1510
1511	pUsagePre = pDevExt->pUsageFree;
1512	if (pUsagePre)
1513	pDevExt->pUsageFree = pUsagePre->pNext;
1514	else
1515	{
1516	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1517	pUsagePre = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsagePre));
1518	if (!pUsagePre)
1519	return SUPDRV_ERR_NO_MEMORY;
1520	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1521	}
1522
1523	/*
1524	* Reference the object.
1525	*/
1526	pObj->cUsage++;
1527
1528	/*
1529	* Look for the session record.
1530	*/
1531	for (pUsage = pSession->pUsage; pUsage; pUsage = pUsage->pNext)
1532	{
1533	dprintf(("SUPR0AddRef: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));
1534	if (pUsage->pObj == pObj)
1535	break;
1536	}
1537	if (pUsage)
1538	pUsage->cUsage++;
1539	else
1540	{
1541	/* create a new session record. */
1542	pUsagePre->cUsage = 1;
1543	pUsagePre->pObj = pObj;
1544	pUsagePre->pNext = pSession->pUsage;
1545	pSession->pUsage = pUsagePre;
1546	dprintf(("SUPR0ObjRelease: pUsagePre=%p:{.pObj=%p, .pNext=%p}\n", pUsagePre, pUsagePre->pObj, pUsagePre->pNext));
1547
1548	pUsagePre = NULL;
1549	}
1550
1551	/*
1552	* Put any unused usage record into the free list..
1553	*/
1554	if (pUsagePre)
1555	{
1556	pUsagePre->pNext = pDevExt->pUsageFree;
1557	pDevExt->pUsageFree = pUsagePre;
1558	}
1559
1560	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1561
1562	return 0;
1563	}
1564
1565
1566	/**
1567	* Decrement / destroy a reference counter record for an object.
1568	*
1569	* The object is uniquely identified by pfnDestructor+pvUser1+pvUser2.
1570	*
1571	* @returns 0 on success.
1572	* @returns SUPDRV_ERR_* on failure.
1573	* @param pvObj The identifier returned by SUPR0ObjRegister().
1574	* @param pSession The session which is referencing the object.
1575	*/
1576	SUPR0DECL(int) SUPR0ObjRelease(void *pvObj, PSUPDRVSESSION pSession)
1577	{
1578	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1579	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1580	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
1581	bool fDestroy = false;
1582	PSUPDRVUSAGE pUsage;
1583	PSUPDRVUSAGE pUsagePrev;
1584
1585	/*
1586	* Validate the input.
1587	*/
1588	if (!pSession)
1589	{
1590	AssertMsgFailed(("Invalid pSession=%p\n", pSession));
1591	return SUPDRV_ERR_INVALID_PARAM;
1592	}
1593	if (!pObj \|\| pObj->u32Magic != SUPDRVOBJ_MAGIC)
1594	{
1595	AssertMsgFailed(("Invalid pvObj=%p magic=%#x (exepcted %#x)\n",
1596	pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC));
1597	return SUPDRV_ERR_INVALID_PARAM;
1598	}
1599
1600	/*
1601	* Acquire the spinlock and look for the usage record.
1602	*/
1603	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1604
1605	for (pUsagePrev = NULL, pUsage = pSession->pUsage;
1606	pUsage;
1607	pUsagePrev = pUsage, pUsage = pUsage->pNext)
1608	{
1609	dprintf(("SUPR0ObjRelease: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));
1610	if (pUsage->pObj == pObj)
1611	{
1612	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
1613	if (pUsage->cUsage > 1)
1614	{
1615	pObj->cUsage--;
1616	pUsage->cUsage--;
1617	}
1618	else
1619	{
1620	/*
1621	* Free the session record.
1622	*/
1623	if (pUsagePrev)
1624	pUsagePrev->pNext = pUsage->pNext;
1625	else
1626	pSession->pUsage = pUsage->pNext;
1627	pUsage->pNext = pDevExt->pUsageFree;
1628	pDevExt->pUsageFree = pUsage;
1629
1630	/* What about the object? */
1631	if (pObj->cUsage > 1)
1632	pObj->cUsage--;
1633	else
1634	{
1635	/*
1636	* Object is to be destroyed, unlink it.
1637	*/
1638	fDestroy = true;
1639	if (pDevExt->pObjs == pObj)
1640	pDevExt->pObjs = pObj->pNext;
1641	else
1642	{
1643	PSUPDRVOBJ pObjPrev;
1644	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
1645	if (pObjPrev->pNext == pObj)
1646	{
1647	pObjPrev->pNext = pObj->pNext;
1648	break;
1649	}
1650	Assert(pObjPrev);
1651	}
1652	}
1653	}
1654	break;
1655	}
1656	}
1657
1658	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1659
1660	/*
1661	* Call the destructor and free the object if required.
1662	*/
1663	if (fDestroy)
1664	{
1665	pObj->u32Magic++;
1666	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
1667	RTMemFree(pObj);
1668	}
1669
1670	AssertMsg(pUsage, ("pvObj=%p\n", pvObj));
1671	return pUsage ? 0 : SUPDRV_ERR_INVALID_PARAM;
1672	}
1673
1674	/**
1675	* Verifies that the current process can access the specified object.
1676	*
1677	* @returns 0 if access is granted.
1678	* @returns SUPDRV_ERR_PERMISSION_DENIED if denied access.
1679	* @returns SUPDRV_ERR_INVALID_PARAM if invalid parameter.
1680	*
1681	* @param pvObj The identifier returned by SUPR0ObjRegister().
1682	* @param pSession The session which wishes to access the object.
1683	* @param pszObjName Object string name. This is optional and depends on the object type.
1684	*
1685	* @remark The caller is responsible for making sure the object isn't removed while
1686	* we're inside this function. If uncertain about this, just call AddRef before calling us.
1687	*/
1688	SUPR0DECL(int) SUPR0ObjVerifyAccess(void pvObj, PSUPDRVSESSION pSession, const char pszObjName)
1689	{
1690	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
1691	int rc = SUPDRV_ERR_GENERAL_FAILURE;
1692
1693	/*
1694	* Validate the input.
1695	*/
1696	if (!pSession)
1697	{
1698	AssertMsgFailed(("Invalid pSession=%p\n", pSession));
1699	return SUPDRV_ERR_INVALID_PARAM;
1700	}
1701	if (!pObj \|\| pObj->u32Magic != SUPDRVOBJ_MAGIC)
1702	{
1703	AssertMsgFailed(("Invalid pvObj=%p magic=%#x (exepcted %#x)\n",
1704	pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC));
1705	return SUPDRV_ERR_INVALID_PARAM;
1706	}
1707
1708	/*
1709	* Check access. (returns true if a decision has been made.)
1710	*/
1711	if (supdrvOSObjCanAccess(pObj, pSession, pszObjName, &rc))
1712	return rc;
1713
1714	/*
1715	* Default policy is to allow the user to access his own
1716	* stuff but nothing else.
1717	*/
1718	if (pObj->CreatorUid == pSession->Uid)
1719	return 0;
1720	return SUPDRV_ERR_PERMISSION_DENIED;
1721	}
1722
1723
1724	/**
1725	* Lock pages.
1726	*
1727	* @param pSession Session to which the locked memory should be associated.
1728	* @param pvR3 Start of the memory range to lock.
1729	* This must be page aligned.
1730	* @param cb Size of the memory range to lock.
1731	* This must be page aligned.
1732	*/
1733	SUPR0DECL(int) SUPR0LockMem(PSUPDRVSESSION pSession, void *pvR3, unsigned cb, PSUPPAGE paPages)
1734	{
1735	int rc;
1736	SUPDRVMEMREF Mem = {0};
1737	dprintf(("SUPR0LockMem: pSession=%p pvR3=%p cb=%d paPages=%p\n",
1738	pSession, pvR3, cb, paPages));
1739
1740	/*
1741	* Verify input.
1742	*/
1743	if (RT_ALIGN_R3PT(pvR3, PAGE_SIZE, void *) != pvR3 \|\| !pvR3)
1744	{
1745	dprintf(("pvR3 (%p) must be page aligned and not NULL!\n", pvR3));
1746	return SUPDRV_ERR_INVALID_PARAM;
1747	}
1748	if (RT_ALIGN(cb, PAGE_SIZE) != cb)
1749	{
1750	dprintf(("cb (%u) must be page aligned!\n", cb));
1751	return SUPDRV_ERR_INVALID_PARAM;
1752	}
1753	if (!paPages)
1754	{
1755	dprintf(("paPages is NULL!\n"));
1756	return SUPDRV_ERR_INVALID_PARAM;
1757	}
1758
1759	#ifdef USE_NEW_OS_INTERFACE
1760	/*
1761	* Let IPRT do the job.
1762	*/
1763	Mem.eType = MEMREF_TYPE_LOCKED;
1764	rc = RTR0MemObjLockUser(&Mem.MemObj, pvR3, cb, RTR0ProcHandleSelf());
1765	if (RT_SUCCESS(rc))
1766	{
1767	unsigned iPage = cb >> PAGE_SHIFT;
1768	while (iPage-- > 0)
1769	{
1770	paPages[iPage].uReserved = 0;
1771	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
1772	if (RT_UNLIKELY(paPages[iPage].Phys == NIL_RTCCPHYS))
1773	{
1774	AssertMsgFailed(("iPage=%d\n", iPage));
1775	rc = VERR_INTERNAL_ERROR;
1776	break;
1777	}
1778	}
1779	if (RT_SUCCESS(rc))
1780	rc = supdrvMemAdd(&Mem, pSession);
1781	if (RT_FAILURE(rc))
1782	{
1783	int rc2 = RTR0MemObjFree(Mem.MemObj, false);
1784	AssertRC(rc2);
1785	}
1786	}
1787
1788	#else /* !USE_NEW_OS_INTERFACE */
1789
1790	/*
1791	* Let the OS specific code have a go.
1792	*/
1793	Mem.pvR0 = NULL;
1794	Mem.pvR3 = pvR3;
1795	Mem.eType = MEMREF_TYPE_LOCKED;
1796	Mem.cb = cb;
1797	rc = supdrvOSLockMemOne(&Mem, paPages);
1798	if (rc)
1799	return rc;
1800
1801	/*
1802	* Everything when fine, add the memory reference to the session.
1803	*/
1804	rc = supdrvMemAdd(&Mem, pSession);
1805	if (rc)
1806	supdrvOSUnlockMemOne(&Mem);
1807	#endif /* !USE_NEW_OS_INTERFACE */
1808	return rc;
1809	}
1810
1811
1812	/**
1813	* Unlocks the memory pointed to by pv.
1814	*
1815	* @returns 0 on success.
1816	* @returns SUPDRV_ERR_* on failure
1817	* @param pSession Session to which the memory was locked.
1818	* @param pvR3 Memory to unlock.
1819	*/
1820	SUPR0DECL(int) SUPR0UnlockMem(PSUPDRVSESSION pSession, void *pvR3)
1821	{
1822	dprintf(("SUPR0UnlockMem: pSession=%p pvR3=%p\n", pSession, pvR3));
1823	return supdrvMemRelease(pSession, pvR3, MEMREF_TYPE_LOCKED);
1824	}
1825
1826
1827	/**
1828	* Allocates a chunk of page aligned memory with contiguous and fixed physical
1829	* backing.
1830	*
1831	* @returns 0 on success.
1832	* @returns SUPDRV_ERR_* on failure.
1833	* @param pSession Session data.
1834	* @param cb Number of bytes to allocate.
1835	* @param ppvR0 Where to put the address of Ring-0 mapping the allocated memory. optional
1836	* @param ppvR3 Where to put the address of Ring-3 mapping the allocated memory.
1837	* @param pHCPhys Where to put the physical address of allocated memory.
1838	*/
1839	SUPR0DECL(int) SUPR0ContAlloc(PSUPDRVSESSION pSession, unsigned cb, void **ppvR0, PRTR3PTR ppvR3, PRTHCPHYS pHCPhys)
1840	{
1841	int rc;
1842	SUPDRVMEMREF Mem = {0};
1843	dprintf(("SUPR0ContAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p pHCPhys=%p\n", pSession, cb, ppvR0, ppvR3, pHCPhys));
1844
1845	/*
1846	* Validate input.
1847	*/
1848	if (!pSession \|\| !ppvR3 \|\| !pHCPhys)
1849	{
1850	dprintf(("Null pointer. All of these should be set: pSession=%p ppvR3=%p pHCPhys=%p\n",
1851	pSession, ppvR3, pHCPhys));
1852	return SUPDRV_ERR_INVALID_PARAM;
1853
1854	}
1855	if (cb <= 64 \|\| cb >= PAGE_SIZE * 256)
1856	{
1857	dprintf(("Illegal request cb=%d, must be greater than 64 and smaller than PAGE_SIZE*256\n", cb));
1858	return SUPDRV_ERR_INVALID_PARAM;
1859	}
1860
1861	#ifdef USE_NEW_OS_INTERFACE
1862	/*
1863	* Let IPRT do the job.
1864	*/
1865	rc = RTR0MemObjAllocCont(&Mem.MemObj, cb, true /* executable R0 mapping */);
1866	if (RT_SUCCESS(rc))
1867	{
1868	int rc2;
1869	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (void *)-1, 0,
1870	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
1871	if (RT_SUCCESS(rc))
1872	{
1873	Mem.eType = MEMREF_TYPE_CONT;
1874	rc = supdrvMemAdd(&Mem, pSession);
1875	if (!rc)
1876	{
1877	if (ppvR0)
1878	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
1879	*ppvR3 = RTR0MemObjAddress(Mem.MapObjR3);
1880	*pHCPhys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, 0);
1881	return 0;
1882	}
1883
1884	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
1885	AssertRC(rc2);
1886	}
1887	rc2 = RTR0MemObjFree(Mem.MemObj, false);
1888	AssertRC(rc2);
1889	}
1890
1891	#else /* !USE_NEW_OS_INTERFACE */
1892
1893	/*
1894	* Let the OS specific code have a go.
1895	*/
1896	Mem.pvR0 = NULL;
1897	Mem.pvR3 = NULL;
1898	Mem.eType = MEMREF_TYPE_CONT;
1899	Mem.cb = cb;
1900	rc = supdrvOSContAllocOne(&Mem, ppvR0, ppvR3, pHCPhys);
1901	if (rc)
1902	return rc;
1903	AssertMsg(!((uintptr_t)ppvR3 & (PAGE_SIZE - 1)) \|\| !(pHCPhys & (PAGE_SIZE - 1)),
1904	("Memory is not page aligned! ppvR0=%p ppvR3=%p phys=%VHp\n", ppvR0 ? ppvR0 : NULL, ppvR3, *pHCPhys));
1905
1906	/*
1907	* Everything when fine, add the memory reference to the session.
1908	*/
1909	rc = supdrvMemAdd(&Mem, pSession);
1910	if (rc)
1911	supdrvOSContFreeOne(&Mem);
1912	#endif /* !USE_NEW_OS_INTERFACE */
1913
1914	return rc;
1915	}
1916
1917
1918	/**
1919	* Frees memory allocated using SUPR0ContAlloc().
1920	*
1921	* @returns 0 on success.
1922	* @returns SUPDRV_ERR_* on failure.
1923	* @param pSession The session to which the memory was allocated.
1924	* @param pv Pointer to the memory.
1925	*/
1926	SUPR0DECL(int) SUPR0ContFree(PSUPDRVSESSION pSession, void *pv)
1927	{
1928	dprintf(("SUPR0ContFree: pSession=%p pv=%p\n", pSession, pv));
1929	return supdrvMemRelease(pSession, pv, MEMREF_TYPE_CONT);
1930	}
1931
1932
1933	/**
1934	* Allocates a chunk of page aligned memory with fixed physical backing below 4GB.
1935	*
1936	* @returns 0 on success.
1937	* @returns SUPDRV_ERR_* on failure.
1938	* @param pSession Session data.
1939	* @param cPages Number of pages to allocate.
1940	* @param ppvR3 Where to put the address of Ring-3 mapping of the allocated memory.
1941	* @param paPages Where to put the physical addresses of allocated memory.
1942	*/
1943	SUPR0DECL(int) SUPR0LowAlloc(PSUPDRVSESSION pSession, unsigned cPages, void **ppvR3, PSUPPAGE paPages)
1944	{
1945	unsigned iPage;
1946	int rc;
1947	SUPDRVMEMREF Mem = {0};
1948	dprintf(("SUPR0LowAlloc: pSession=%p cPages=%d ppvR3=%p paPages=%p\n", pSession, cPages, ppvR3, paPages));
1949
1950	/*
1951	* Validate input.
1952	*/
1953	if (!pSession \|\| !ppvR3 \|\| !paPages)
1954	{
1955	dprintf(("Null pointer. All of these should be set: pSession=%p ppvR3=%p paPages=%p\n",
1956	pSession, ppvR3, paPages));
1957	return SUPDRV_ERR_INVALID_PARAM;
1958
1959	}
1960	if (cPages < 1 \|\| cPages > 256)
1961	{
1962	dprintf(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
1963	return SUPDRV_ERR_INVALID_PARAM;
1964	}
1965
1966	#ifdef USE_NEW_OS_INTERFACE
1967	/*
1968	* Let IPRT do the work.
1969	*/
1970	rc = RTR0MemObjAllocLow(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable ring-0 mapping */);
1971	if (RT_SUCCESS(rc))
1972	{
1973	int rc2;
1974	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (void *)-1, 0,
1975	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
1976	if (RT_SUCCESS(rc))
1977	{
1978	Mem.eType = MEMREF_TYPE_LOW;
1979	rc = supdrvMemAdd(&Mem, pSession);
1980	if (!rc)
1981	{
1982	for (iPage = 0; iPage < cPages; iPage++)
1983	{
1984	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
1985	paPages[iPage].uReserved = 0;
1986	AssertMsg(!(paPages[iPage].Phys & (PAGE_SIZE - 1)), ("iPage=%d Phys=%VHp\n", paPages[iPage].Phys));
1987	}
1988	/*if (ppvR0)
1989	ppvR0 = RTR0MemObjAddress(Mem.MemObj); /
1990	*ppvR3 = RTR0MemObjAddress(Mem.MapObjR3);
1991	return 0;
1992	}
1993
1994	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
1995	AssertRC(rc2);
1996	}
1997
1998	rc2 = RTR0MemObjFree(Mem.MemObj, false);
1999	AssertRC(rc2);
2000	}
2001
2002	#else /* !USE_NEW_OS_INTERFACE */
2003
2004	/*
2005	* Let the OS specific code have a go.
2006	*/
2007	Mem.pvR0 = NULL;
2008	Mem.pvR3 = NULL;
2009	Mem.eType = MEMREF_TYPE_LOW;
2010	Mem.cb = cPages << PAGE_SHIFT;
2011	rc = supdrvOSLowAllocOne(&Mem, ppvR3, paPages);
2012	if (rc)
2013	return rc;
2014	AssertMsg(!((uintptr_t)ppvR3 & (PAGE_SIZE - 1)), ("Memory is not page aligned! virt=%p\n", ppvR3));
2015	for (iPage = 0; iPage < cPages; iPage++)
2016	AssertMsg(!(paPages[iPage].Phys & (PAGE_SIZE - 1)), ("iPage=%d Phys=%VHp\n", paPages[iPage].Phys));
2017
2018	/*
2019	* Everything when fine, add the memory reference to the session.
2020	*/
2021	rc = supdrvMemAdd(&Mem, pSession);
2022	if (rc)
2023	supdrvOSLowFreeOne(&Mem);
2024	#endif /* !USE_NEW_OS_INTERFACE */
2025	return rc;
2026	}
2027
2028
2029	/**
2030	* Frees memory allocated using SUPR0LowAlloc().
2031	*
2032	* @returns 0 on success.
2033	* @returns SUPDRV_ERR_* on failure.
2034	* @param pSession The session to which the memory was allocated.
2035	* @param pv Pointer to the memory.
2036	*/
2037	SUPR0DECL(int) SUPR0LowFree(PSUPDRVSESSION pSession, void *pv)
2038	{
2039	dprintf(("SUPR0LowFree: pSession=%p pv=%p\n", pSession, pv));
2040	return supdrvMemRelease(pSession, pv, MEMREF_TYPE_LOW);
2041	}
2042
2043
2044	/**
2045	* Allocates a chunk of memory with both R0 and R3 mappings.
2046	* The memory is fixed and it's possible to query the physical addresses using SUPR0MemGetPhys().
2047	*
2048	* @returns 0 on success.
2049	* @returns SUPDRV_ERR_* on failure.
2050	* @param pSession The session to associated the allocation with.
2051	* @param cb Number of bytes to allocate.
2052	* @param ppvR0 Where to store the address of the Ring-0 mapping.
2053	* @param ppvR3 Where to store the address of the Ring-3 mapping.
2054	*/
2055	SUPR0DECL(int) SUPR0MemAlloc(PSUPDRVSESSION pSession, unsigned cb, void ppvR0, void ppvR3)
2056	{
2057	int rc;
2058	SUPDRVMEMREF Mem = {0};
2059	dprintf(("SUPR0MemAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p\n", pSession, cb, ppvR0, ppvR3));
2060
2061	/*
2062	* Validate input.
2063	*/
2064	if (!pSession \|\| !ppvR0 \|\| !ppvR3)
2065	{
2066	dprintf(("Null pointer. All of these should be set: pSession=%p ppvR0=%p ppvR3=%p\n",
2067	pSession, ppvR0, ppvR3));
2068	return SUPDRV_ERR_INVALID_PARAM;
2069
2070	}
2071	if (cb < 1 \|\| cb >= PAGE_SIZE * 256)
2072	{
2073	dprintf(("Illegal request cb=%u; must be greater than 0 and smaller than 4MB.\n", cb));
2074	return SUPDRV_ERR_INVALID_PARAM;
2075	}
2076
2077	#ifdef USE_NEW_OS_INTERFACE
2078	/*
2079	* Let IPRT do the work.
2080	*/
2081	rc = RTR0MemObjAllocPage(&Mem.MemObj, cb, true /* executable ring-0 mapping */);
2082	if (RT_SUCCESS(rc))
2083	{
2084	int rc2;
2085	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (void*)-1, 0,
2086	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2087	if (RT_SUCCESS(rc))
2088	{
2089	Mem.eType = MEMREF_TYPE_MEM;
2090	rc = supdrvMemAdd(&Mem, pSession);
2091	if (!rc)
2092	{
2093	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2094	*ppvR3 = RTR0MemObjAddress(Mem.MapObjR3);
2095	return 0;
2096	}
2097	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2098	AssertRC(rc2);
2099	}
2100
2101	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2102	AssertRC(rc2);
2103	}
2104
2105	#else /* !USE_NEW_OS_INTERFACE */
2106
2107	/*
2108	* Let the OS specific code have a go.
2109	*/
2110	Mem.pvR0 = NULL;
2111	Mem.pvR3 = NULL;
2112	Mem.eType = MEMREF_TYPE_MEM;
2113	Mem.cb = cb;
2114	rc = supdrvOSMemAllocOne(&Mem, ppvR0, ppvR3);
2115	if (rc)
2116	return rc;
2117	AssertMsg(!((uintptr_t)ppvR0 & (PAGE_SIZE - 1)), ("Memory is not page aligned! pvR0=%p\n", ppvR0));
2118	AssertMsg(!((uintptr_t)ppvR3 & (PAGE_SIZE - 1)), ("Memory is not page aligned! pvR3=%p\n", ppvR3));
2119
2120	/*
2121	* Everything when fine, add the memory reference to the session.
2122	*/
2123	rc = supdrvMemAdd(&Mem, pSession);
2124	if (rc)
2125	supdrvOSMemFreeOne(&Mem);
2126	#endif /* !USE_NEW_OS_INTERFACE */
2127	return rc;
2128	}
2129
2130
2131	/**
2132	* Get the physical addresses of memory allocated using SUPR0MemAlloc().
2133	*
2134	* @returns 0 on success.
2135	* @returns SUPDRV_ERR_* on failure.
2136	* @param pSession The session to which the memory was allocated.
2137	* @param pv The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2138	*/
2139	SUPR0DECL(int) SUPR0MemGetPhys(PSUPDRVSESSION pSession, void *pv, PSUPPAGE paPages)
2140	{
2141	PSUPDRVBUNDLE pBundle;
2142	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2143	dprintf(("SUPR0MemGetPhys: pSession=%p pv=%p paPages=%p\n", pSession, pv, paPages));
2144
2145	/*
2146	* Validate input.
2147	*/
2148	if (!pSession)
2149	{
2150	dprintf(("pSession must not be NULL!"));
2151	return SUPDRV_ERR_INVALID_PARAM;
2152	}
2153	if (!pv \|\| !paPages)
2154	{
2155	dprintf(("Illegal address pv=%p or/and paPages=%p\n", pv, paPages));
2156	return SUPDRV_ERR_INVALID_PARAM;
2157	}
2158
2159	/*
2160	* Search for the address.
2161	*/
2162	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2163	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2164	{
2165	if (pBundle->cUsed > 0)
2166	{
2167	unsigned i;
2168	for (i = 0; i < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]); i++)
2169	{
2170	#ifdef USE_NEW_OS_INTERFACE
2171	if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
2172	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2173	&& ( RTR0MemObjAddress(pBundle->aMem[i].MemObj) == pv
2174	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2175	&& RTR0MemObjAddress(pBundle->aMem[i].MapObjR3) == pv)
2176	)
2177	)
2178	{
2179	const unsigned cPages = RTR0MemObjSize(pBundle->aMem[i].MemObj) >> PAGE_SHIFT;
2180	unsigned iPage;
2181	for (iPage = 0; iPage < cPages; iPage++)
2182	{
2183	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(pBundle->aMem[i].MemObj, iPage);
2184	paPages[iPage].uReserved = 0;
2185	}
2186	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2187	return 0;
2188	}
2189	#else /* !USE_NEW_OS_INTERFACE */
2190	if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
2191	&& ( pBundle->aMem[i].pvR0 == pv
2192	\|\| pBundle->aMem[i].pvR3 == pv))
2193	{
2194	supdrvOSMemGetPages(&pBundle->aMem[i], paPages);
2195	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2196	return 0;
2197	}
2198	#endif
2199	}
2200	}
2201	}
2202	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2203	dprintf(("Failed to find %p!!!\n", pv));
2204	return SUPDRV_ERR_INVALID_PARAM;
2205	}
2206
2207
2208	/**
2209	* Free memory allocated by SUPR0MemAlloc().
2210	*
2211	* @returns 0 on success.
2212	* @returns SUPDRV_ERR_* on failure.
2213	* @param pSession The session owning the allocation.
2214	* @param pv The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2215	*/
2216	SUPR0DECL(int) SUPR0MemFree(PSUPDRVSESSION pSession, void *pv)
2217	{
2218	dprintf(("SUPR0MemFree: pSession=%p pv=%p\n", pSession, pv));
2219	return supdrvMemRelease(pSession, pv, MEMREF_TYPE_MEM);
2220	}
2221
2222
2223	/**
2224	* Maps the GIP into userspace and/or get the physical address of the GIP.
2225	*
2226	* @returns 0 on success.
2227	* @returns SUPDRV_ERR_* on failure.
2228	* @param pSession Session to which the GIP mapping should belong.
2229	* @param ppGip Where to store the address of the mapping. (optional)
2230	* @param pHCPhysGip Where to store the physical address. (optional)
2231	*
2232	* @remark There is no reference counting on the mapping, so one call to this function
2233	* count globally as one reference. One call to SUPR0GipUnmap() is will unmap GIP
2234	* and remove the session as a GIP user.
2235	*/
2236	SUPR0DECL(int) SUPR0GipMap(PSUPDRVSESSION pSession, PCSUPGLOBALINFOPAGE ppGip, RTHCPHYS pHCPhysGid)
2237	{
2238	int rc = 0;
2239	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2240	PCSUPGLOBALINFOPAGE pGip = NULL;
2241	RTHCPHYS HCPhys = NIL_RTHCPHYS;
2242	dprintf(("SUPR0GipMap: pSession=%p ppGip=%p pHCPhysGid=%p\n", pSession, ppGip, pHCPhysGid));
2243
2244	/*
2245	* Validate
2246	*/
2247	if (!ppGip && !pHCPhysGid)
2248	return 0;
2249
2250	RTSemFastMutexRequest(pDevExt->mtxGip);
2251	if (pDevExt->pGip)
2252	{
2253	/*
2254	* Map it?
2255	*/
2256	if (ppGip)
2257	{
2258	#ifdef USE_NEW_OS_INTERFACE
2259	if (pSession->GipMapObjR3 == NIL_RTR0MEMOBJ)
2260	rc = RTR0MemObjMapUser(&pSession->GipMapObjR3, pDevExt->GipMemObj, (void*)-1, 0,
2261	RTMEM_PROT_READ, RTR0ProcHandleSelf());
2262	if (RT_SUCCESS(rc))
2263	{
2264	pGip = (PCSUPGLOBALINFOPAGE)RTR0MemObjAddress(pSession->GipMapObjR3);
2265	rc = VINF_SUCCESS; /** @todo remove this and replace the !rc below with RT_SUCCESS(rc). */
2266	}
2267	#else /* !USE_NEW_OS_INTERFACE */
2268	if (!pSession->pGip)
2269	rc = supdrvOSGipMap(pSession->pDevExt, &pSession->pGip);
2270	if (!rc)
2271	pGip = pSession->pGip;
2272	#endif /* !USE_NEW_OS_INTERFACE */
2273	}
2274
2275	/*
2276	* Get physical address.
2277	*/
2278	if (pHCPhysGid && !rc)
2279	HCPhys = pDevExt->HCPhysGip;
2280
2281	/*
2282	* Reference globally.
2283	*/
2284	if (!pSession->fGipReferenced && !rc)
2285	{
2286	pSession->fGipReferenced = 1;
2287	pDevExt->cGipUsers++;
2288	if (pDevExt->cGipUsers == 1)
2289	{
2290	dprintf(("SUPR0GipMap: Resumes GIP updating\n"));
2291	ASMAtomicXchgU32(&pDevExt->pGip->u32TransactionId,
2292	pDevExt->pGip->u32TransactionId & ~(GIP_UPDATEHZ_RECALC_FREQ * 2 - 1));
2293	ASMAtomicXchgU64(&pDevExt->pGip->u64NanoTSLastUpdateHz, 0);
2294	#ifdef USE_NEW_OS_INTERFACE
2295	rc = RTTimerStart(pDevExt->pGipTimer, 0); AssertRC(rc); rc = 0;
2296	#else
2297	supdrvOSGipResume(pDevExt);
2298	#endif
2299	}
2300	}
2301	}
2302	else
2303	{
2304	rc = SUPDRV_ERR_GENERAL_FAILURE;
2305	dprintf(("SUPR0GipMap: GIP is not available!\n"));
2306	}
2307	RTSemFastMutexRelease(pDevExt->mtxGip);
2308
2309	/*
2310	* Write returns.
2311	*/
2312	if (pHCPhysGid)
2313	*pHCPhysGid = HCPhys;
2314	if (ppGip)
2315	*ppGip = pGip;
2316
2317	dprintf(("SUPR0GipMap: returns %d pHCPhysGid=%lx ppGip=%p\n", rc, (unsigned long)HCPhys, pGip));
2318	return rc;
2319	}
2320
2321
2322	/**
2323	* Unmaps any user mapping of the GIP and terminates all GIP access
2324	* from this session.
2325	*
2326	* @returns 0 on success.
2327	* @returns SUPDRV_ERR_* on failure.
2328	* @param pSession Session to which the GIP mapping should belong.
2329	*/
2330	SUPR0DECL(int) SUPR0GipUnmap(PSUPDRVSESSION pSession)
2331	{
2332	int rc = 0;
2333	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2334	dprintf(("SUPR0GipUnmap: pSession=%p\n", pSession));
2335
2336	RTSemFastMutexRequest(pDevExt->mtxGip);
2337
2338	/*
2339	* Unmap anything?
2340	*/
2341	#ifdef USE_NEW_OS_INTERFACE
2342	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
2343	{
2344	rc = RTR0MemObjFree(pSession->GipMapObjR3, false);
2345	AssertRC(rc);
2346	if (RT_SUCCESS(rc))
2347	pSession->GipMapObjR3 = NIL_RTR0MEMOBJ;
2348	}
2349	#else
2350	if (pSession->pGip)
2351	{
2352	rc = supdrvOSGipUnmap(pDevExt, pSession->pGip);
2353	if (!rc)
2354	pSession->pGip = NULL;
2355	}
2356	#endif
2357
2358	/*
2359	* Dereference global GIP.
2360	*/
2361	if (pSession->fGipReferenced && !rc)
2362	{
2363	pSession->fGipReferenced = 0;
2364	if ( pDevExt->cGipUsers > 0
2365	&& !--pDevExt->cGipUsers)
2366	{
2367	dprintf(("SUPR0GipUnmap: Suspends GIP updating\n"));
2368	#ifdef USE_NEW_OS_INTERFACE
2369	rc = RTTimerStop(pDevExt->pGipTimer); AssertRC(rc); rc = 0;
2370	#else
2371	supdrvOSGipSuspend(pDevExt);
2372	#endif
2373	}
2374	}
2375
2376	RTSemFastMutexRelease(pDevExt->mtxGip);
2377
2378	return rc;
2379	}
2380
2381
2382	/**
2383	* Adds a memory object to the session.
2384	*
2385	* @returns 0 on success.
2386	* @returns SUPDRV_ERR_* on failure.
2387	* @param pMem Memory tracking structure containing the
2388	* information to track.
2389	* @param pSession The session.
2390	*/
2391	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession)
2392	{
2393	PSUPDRVBUNDLE pBundle;
2394	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2395
2396	/*
2397	* Find free entry and record the allocation.
2398	*/
2399	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2400	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2401	{
2402	if (pBundle->cUsed < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]))
2403	{
2404	unsigned i;
2405	for (i = 0; i < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]); i++)
2406	{
2407	#ifdef USE_NEW_OS_INTERFACE
2408	if (pBundle->aMem[i].MemObj == NIL_RTR0MEMOBJ)
2409	#else /* !USE_NEW_OS_INTERFACE */
2410	if ( !pBundle->aMem[i].pvR0
2411	&& !pBundle->aMem[i].pvR3)
2412	#endif /* !USE_NEW_OS_INTERFACE */
2413	{
2414	pBundle->cUsed++;
2415	pBundle->aMem[i] = *pMem;
2416	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2417	return 0;
2418	}
2419	}
2420	AssertFailed(); /* !!this can't be happening!!! */
2421	}
2422	}
2423	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2424
2425	/*
2426	* Need to allocate a new bundle.
2427	* Insert into the last entry in the bundle.
2428	*/
2429	pBundle = (PSUPDRVBUNDLE)RTMemAlloc(sizeof(*pBundle));
2430	if (!pBundle)
2431	return SUPDRV_ERR_NO_MEMORY;
2432	memset(pBundle, 0, sizeof(*pBundle));
2433
2434	/* take last entry. */
2435	pBundle->cUsed++;
2436	pBundle->aMem[sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]) - 1] = *pMem;
2437
2438	/* insert into list. */
2439	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2440	pBundle->pNext = pSession->Bundle.pNext;
2441	pSession->Bundle.pNext = pBundle;
2442	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2443
2444	return 0;
2445	}
2446
2447
2448	/**
2449	* Releases a memory object referenced by pointer and type.
2450	*
2451	* @returns 0 on success.
2452	* @returns SUPDRV_ERR_INVALID_PARAM on failure.
2453	* @param pSession Session data.
2454	* @param pv Pointer to memory. This is matched against both the R0 and R3 addresses.
2455	* @param eType Memory type.
2456	*/
2457	static int supdrvMemRelease(PSUPDRVSESSION pSession, void *pv, SUPDRVMEMREFTYPE eType)
2458	{
2459	PSUPDRVBUNDLE pBundle;
2460	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2461
2462	/*
2463	* Validate input.
2464	*/
2465	if (!pSession)
2466	{
2467	dprintf(("pSession must not be NULL!"));
2468	return SUPDRV_ERR_INVALID_PARAM;
2469	}
2470	if (!pv)
2471	{
2472	dprintf(("Illegal address %p\n", pv));
2473	return SUPDRV_ERR_INVALID_PARAM;
2474	}
2475
2476	/*
2477	* Search for the address.
2478	*/
2479	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2480	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2481	{
2482	if (pBundle->cUsed > 0)
2483	{
2484	unsigned i;
2485	for (i = 0; i < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]); i++)
2486	{
2487	#ifdef USE_NEW_OS_INTERFACE
2488	if ( pBundle->aMem[i].eType == eType
2489	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2490	&& ( RTR0MemObjAddress(pBundle->aMem[i].MemObj) == pv
2491	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2492	&& RTR0MemObjAddress(pBundle->aMem[i].MapObjR3) == pv))
2493	)
2494	{
2495	/* Make a copy of it and release it outside the spinlock. */
2496	SUPDRVMEMREF Mem = pBundle->aMem[i];
2497	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
2498	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
2499	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
2500	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2501
2502	if (Mem.MapObjR3)
2503	{
2504	int rc = RTR0MemObjFree(Mem.MapObjR3, false);
2505	AssertRC(rc); /** @todo figure out how to handle this. */
2506	}
2507	if (Mem.MemObj)
2508	{
2509	int rc = RTR0MemObjFree(Mem.MemObj, false);
2510	AssertRC(rc); /** @todo figure out how to handle this. */
2511	}
2512	return 0;
2513	}
2514	#else /* !USE_NEW_OS_INTERFACE */
2515	if ( pBundle->aMem[i].eType == eType
2516	&& ( pBundle->aMem[i].pvR0 == pv
2517	\|\| pBundle->aMem[i].pvR3 == pv))
2518	{
2519	/* Make a copy of it and release it outside the spinlock. */
2520	SUPDRVMEMREF Mem = pBundle->aMem[i];
2521	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
2522	pBundle->aMem[i].pvR0 = NULL;
2523	pBundle->aMem[i].pvR3 = NULL;
2524	pBundle->aMem[i].cb = 0;
2525	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2526
2527	/* Type specific free operation. */
2528	switch (Mem.eType)
2529	{
2530	case MEMREF_TYPE_LOCKED:
2531	supdrvOSUnlockMemOne(&Mem);
2532	break;
2533	case MEMREF_TYPE_CONT:
2534	supdrvOSContFreeOne(&Mem);
2535	break;
2536	case MEMREF_TYPE_LOW:
2537	supdrvOSLowFreeOne(&Mem);
2538	break;
2539	case MEMREF_TYPE_MEM:
2540	supdrvOSMemFreeOne(&Mem);
2541	break;
2542	default:
2543	case MEMREF_TYPE_UNUSED:
2544	break;
2545	}
2546	return 0;
2547	}
2548	#endif /* !USE_NEW_OS_INTERFACE */
2549	}
2550	}
2551	}
2552	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2553	dprintf(("Failed to find %p!!! (eType=%d)\n", pv, eType));
2554	return SUPDRV_ERR_INVALID_PARAM;
2555	}
2556
2557
2558	#ifndef VBOX_WITHOUT_IDT_PATCHING
2559	/**
2560	* Install IDT for the current CPU.
2561	*
2562	* @returns 0 on success.
2563	* @returns SUPDRV_ERR_NO_MEMORY or SUPDRV_ERROR_IDT_FAILED on failure.
2564	* @param pIn Input data.
2565	* @param pOut Output data.
2566	*/
2567	static int supdrvIOCtl_IdtInstall(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPIDTINSTALL_IN pIn, PSUPIDTINSTALL_OUT pOut)
2568	{
2569	PSUPDRVPATCHUSAGE pUsagePre;
2570	PSUPDRVPATCH pPatchPre;
2571	RTIDTR Idtr;
2572	PSUPDRVPATCH pPatch;
2573	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2574	dprintf(("supdrvIOCtl_IdtInstall\n"));
2575
2576	/*
2577	* Preallocate entry for this CPU cause we don't wanna do
2578	* that inside the spinlock!
2579	*/
2580	pUsagePre = (PSUPDRVPATCHUSAGE)RTMemAlloc(sizeof(*pUsagePre));
2581	if (!pUsagePre)
2582	return SUPDRV_ERR_NO_MEMORY;
2583
2584	/*
2585	* Take the spinlock and see what we need to do.
2586	*/
2587	RTSpinlockAcquireNoInts(pDevExt->Spinlock, &SpinlockTmp);
2588
2589	/* check if we already got a free patch. */
2590	if (!pDevExt->pIdtPatchesFree)
2591	{
2592	/*
2593	* Allocate a patch - outside the spinlock of course.
2594	*/
2595	RTSpinlockReleaseNoInts(pDevExt->Spinlock, &SpinlockTmp);
2596
2597	pPatchPre = (PSUPDRVPATCH)RTMemExecAlloc(sizeof(*pPatchPre));
2598	if (!pPatchPre)
2599	return SUPDRV_ERR_NO_MEMORY;
2600
2601	RTSpinlockAcquireNoInts(pDevExt->Spinlock, &SpinlockTmp);
2602	}
2603	else
2604	{
2605	pPatchPre = pDevExt->pIdtPatchesFree;
2606	pDevExt->pIdtPatchesFree = pPatchPre->pNext;
2607	}
2608
2609	/* look for matching patch entry */
2610	ASMGetIDTR(&Idtr);
2611	pPatch = pDevExt->pIdtPatches;
2612	while (pPatch && pPatch->pvIdt != (void *)Idtr.pIdt)
2613	pPatch = pPatch->pNext;
2614
2615	if (!pPatch)
2616	{
2617	/*
2618	* Create patch.
2619	*/
2620	pPatch = supdrvIdtPatchOne(pDevExt, pPatchPre);
2621	if (pPatch)
2622	pPatchPre = NULL; /* mark as used. */
2623	}
2624	else
2625	{
2626	/*
2627	* Simply increment patch usage.
2628	*/
2629	pPatch->cUsage++;
2630	}
2631
2632	if (pPatch)
2633	{
2634	/*
2635	* Increment and add if need be the session usage record for this patch.
2636	*/
2637	PSUPDRVPATCHUSAGE pUsage = pSession->pPatchUsage;
2638	while (pUsage && pUsage->pPatch != pPatch)
2639	pUsage = pUsage->pNext;
2640
2641	if (!pUsage)
2642	{
2643	/*
2644	* Add usage record.
2645	*/
2646	pUsagePre->cUsage = 1;
2647	pUsagePre->pPatch = pPatch;
2648	pUsagePre->pNext = pSession->pPatchUsage;
2649	pSession->pPatchUsage = pUsagePre;
2650	pUsagePre = NULL; /* mark as used. */
2651	}
2652	else
2653	{
2654	/*
2655	* Increment usage count.
2656	*/
2657	pUsage->cUsage++;
2658	}
2659	}
2660
2661	/* free patch - we accumulate them for paranoid saftly reasons. */
2662	if (pPatchPre)
2663	{
2664	pPatchPre->pNext = pDevExt->pIdtPatchesFree;
2665	pDevExt->pIdtPatchesFree = pPatchPre;
2666	}
2667
2668	RTSpinlockReleaseNoInts(pDevExt->Spinlock, &SpinlockTmp);
2669
2670	/*
2671	* Free unused preallocated buffers.
2672	*/
2673	if (pUsagePre)
2674	RTMemFree(pUsagePre);
2675
2676	pOut->u8Idt = pDevExt->u8Idt;
2677
2678	return pPatch ? 0 : SUPDRV_ERR_IDT_FAILED;
2679	}
2680
2681
2682	/**
2683	* This creates a IDT patch entry.
2684	* If the first patch being installed it'll also determin the IDT entry
2685	* to use.
2686	*
2687	* @returns pPatch on success.
2688	* @returns NULL on failure.
2689	* @param pDevExt Pointer to globals.
2690	* @param pPatch Patch entry to use.
2691	* This will be linked into SUPDRVDEVEXT::pIdtPatches on
2692	* successful return.
2693	* @remark Call must be owning the SUPDRVDEVEXT::Spinlock!
2694	*/
2695	static PSUPDRVPATCH supdrvIdtPatchOne(PSUPDRVDEVEXT pDevExt, PSUPDRVPATCH pPatch)
2696	{
2697	RTIDTR Idtr;
2698	PSUPDRVIDTE paIdt;
2699	dprintf(("supdrvIOCtl_IdtPatchOne: pPatch=%p\n", pPatch));
2700
2701	/*
2702	* Get IDT.
2703	*/
2704	ASMGetIDTR(&Idtr);
2705	paIdt = (PSUPDRVIDTE)Idtr.pIdt;
2706	if ((uintptr_t)paIdt < 0x80000000)
2707	{
2708	AssertMsgFailed(("bad paIdt=%p\n", paIdt));
2709	return NULL;
2710	}
2711
2712	if (!pDevExt->u8Idt)
2713	{
2714	/*
2715	* Test out the alternatives.
2716	*
2717	* At the moment we do not support chaining thus we ASSUME that one of
2718	* these 48 entries is unused (which is not a problem on Win32 and
2719	* Linux to my knowledge).
2720	*/
2721	/** @todo we MUST change this detection to try grab an entry which is NOT in use. This can be
2722	* combined with gathering info about which guest system call gates we can hook up directly. */
2723	unsigned i;
2724	uint8_t u8Idt = 0;
2725	static uint8_t au8Ints[] =
2726	{
2727	#ifdef __WIN__ /* We don't use 0xef and above because they are system stuff on linux (ef is IPI,
2728	* local apic timer, or some other frequently fireing thing). */
2729	0xef, 0xee, 0xed, 0xec,
2730	#endif
2731	0xeb, 0xea, 0xe9, 0xe8,
2732	0xdf, 0xde, 0xdd, 0xdc,
2733	0x7b, 0x7a, 0x79, 0x78,
2734	0xbf, 0xbe, 0xbd, 0xbc,
2735	};
2736	#if defined(__AMD64__) && defined(DEBUG)
2737	static int s_iWobble = 0;
2738	unsigned iMax = !(s_iWobble++ % 2) ? 0x80 : 0x100;
2739	dprintf(("IDT: Idtr=%p:%#x\n", (void *)Idtr.pIdt, (unsigned)Idtr.cbIdt));
2740	for (i = iMax - 0x80; i*16+15 < Idtr.cbIdt && i < iMax; i++)
2741	{
2742	dprintf(("%#x: %04x:%08x%04x%04x P=%d DPL=%d IST=%d Type1=%#x u32Reserved=%#x u5Reserved=%#x\n",
2743	i, paIdt[i].u16SegSel, paIdt[i].u32OffsetTop, paIdt[i].u16OffsetHigh, paIdt[i].u16OffsetLow,
2744	paIdt[i].u1Present, paIdt[i].u2DPL, paIdt[i].u3IST, paIdt[i].u5Type2,
2745	paIdt[i].u32Reserved, paIdt[i].u5Reserved));
2746	}
2747	#endif
2748	/* look for entries which are not present or otherwise unused. */
2749	for (i = 0; i < sizeof(au8Ints) / sizeof(au8Ints[0]); i++)
2750	{
2751	u8Idt = au8Ints[i];
2752	if ( u8Idt * sizeof(SUPDRVIDTE) < Idtr.cbIdt
2753	&& ( !paIdt[u8Idt].u1Present
2754	\|\| paIdt[u8Idt].u5Type2 == 0))
2755	break;
2756	u8Idt = 0;
2757	}
2758	if (!u8Idt)
2759	{
2760	/* try again, look for a compatible entry .*/
2761	for (i = 0; i < sizeof(au8Ints) / sizeof(au8Ints[0]); i++)
2762	{
2763	u8Idt = au8Ints[i];
2764	if ( u8Idt * sizeof(SUPDRVIDTE) < Idtr.cbIdt
2765	&& paIdt[u8Idt].u1Present
2766	&& paIdt[u8Idt].u5Type2 == SUPDRV_IDTE_TYPE2_INTERRUPT_GATE
2767	&& !(paIdt[u8Idt].u16SegSel & 3))
2768	break;
2769	u8Idt = 0;
2770	}
2771	if (!u8Idt)
2772	{
2773	dprintf(("Failed to find appropirate IDT entry!!\n"));
2774	return NULL;
2775	}
2776	}
2777	pDevExt->u8Idt = u8Idt;
2778	dprintf(("supdrvIOCtl_IdtPatchOne: u8Idt=%x\n", u8Idt));
2779	}
2780
2781	/*
2782	* Prepare the patch
2783	*/
2784	memset(pPatch, 0, sizeof(*pPatch));
2785	pPatch->pvIdt = paIdt;
2786	pPatch->cUsage = 1;
2787	pPatch->pIdtEntry = &paIdt[pDevExt->u8Idt];
2788	pPatch->SavedIdt = paIdt[pDevExt->u8Idt];
2789	pPatch->ChangedIdt.u16OffsetLow = (uint32_t)((uintptr_t)&pPatch->auCode[0] & 0xffff);
2790	pPatch->ChangedIdt.u16OffsetHigh = (uint32_t)((uintptr_t)&pPatch->auCode[0] >> 16);
2791	#ifdef __AMD64__
2792	pPatch->ChangedIdt.u32OffsetTop = (uint32_t)((uintptr_t)&pPatch->auCode[0] >> 32);
2793	#endif
2794	pPatch->ChangedIdt.u16SegSel = ASMGetCS();
2795	#ifdef __AMD64__
2796	pPatch->ChangedIdt.u3IST = 0;
2797	pPatch->ChangedIdt.u5Reserved = 0;
2798	#else /* x86 */
2799	pPatch->ChangedIdt.u5Reserved = 0;
2800	pPatch->ChangedIdt.u3Type1 = 0;
2801	#endif /* x86 */
2802	pPatch->ChangedIdt.u5Type2 = SUPDRV_IDTE_TYPE2_INTERRUPT_GATE;
2803	pPatch->ChangedIdt.u2DPL = 3;
2804	pPatch->ChangedIdt.u1Present = 1;
2805
2806	/*
2807	* Generate the patch code.
2808	*/
2809	{
2810	#ifdef __AMD64__
2811	union
2812	{
2813	uint8_t *pb;
2814	uint32_t *pu32;
2815	uint64_t *pu64;
2816	} u, uFixJmp, uFixCall, uNotNested;
2817	u.pb = &pPatch->auCode[0];
2818
2819	/* check the cookie */
2820	*u.pb++ = 0x3d; // cmp eax, GLOBALCOOKIE
2821	*u.pu32++ = pDevExt->u32Cookie;
2822
2823	*u.pb++ = 0x74; // jz @VBoxCall
2824	*u.pb++ = 2;
2825
2826	/* jump to forwarder code. */
2827	*u.pb++ = 0xeb;
2828	uFixJmp = u;
2829	*u.pb++ = 0xfe;
2830
2831	// @VBoxCall:
2832	*u.pb++ = 0x0f; // swapgs
2833	*u.pb++ = 0x01;
2834	*u.pb++ = 0xf8;
2835
2836	/*
2837	* Call VMMR0Entry
2838	* We don't have to push the arguments here, but we have to
2839	* reserve some stack space for the interrupt forwarding.
2840	*/
2841	# ifdef __WIN__
2842	*u.pb++ = 0x50; // push rax ; alignment filler.
2843	*u.pb++ = 0x41; // push r8 ; uArg
2844	*u.pb++ = 0x50;
2845	*u.pb++ = 0x52; // push rdx ; uOperation
2846	*u.pb++ = 0x51; // push rcx ; pVM
2847	# else
2848	*u.pb++ = 0x51; // push rcx ; alignment filler.
2849	*u.pb++ = 0x52; // push rdx ; uArg
2850	*u.pb++ = 0x56; // push rsi ; uOperation
2851	*u.pb++ = 0x57; // push rdi ; pVM
2852	# endif
2853
2854	*u.pb++ = 0xff; // call qword [pfnVMMR0Entry wrt rip]
2855	*u.pb++ = 0x15;
2856	uFixCall = u;
2857	*u.pu32++ = 0;
2858
2859	*u.pb++ = 0x48; // add rsp, 20h ; remove call frame.
2860	*u.pb++ = 0x81;
2861	*u.pb++ = 0xc4;
2862	*u.pu32++ = 0x20;
2863
2864	*u.pb++ = 0x0f; // swapgs
2865	*u.pb++ = 0x01;
2866	*u.pb++ = 0xf8;
2867
2868	/* Return to R3. */
2869	uNotNested = u;
2870	*u.pb++ = 0x48; // iretq
2871	*u.pb++ = 0xcf;
2872
2873	while ((uintptr_t)u.pb & 0x7) // align 8
2874	*u.pb++ = 0xcc;
2875
2876	/* Pointer to the VMMR0Entry. */ // pfnVMMR0Entry dq StubVMMR0Entry
2877	*uFixCall.pu32 = (uint32_t)(u.pb - uFixCall.pb - 4); uFixCall.pb = NULL;
2878	pPatch->offVMMR0EntryFixup = (uint16_t)(u.pb - &pPatch->auCode[0]);
2879	*u.pu64++ = pDevExt->pvVMMR0 ? (uint64_t)pDevExt->pfnVMMR0Entry : (uint64_t)u.pb + 8;
2880
2881	/* stub entry. */ // StubVMMR0Entry:
2882	pPatch->offStub = (uint16_t)(u.pb - &pPatch->auCode[0]);
2883	*u.pb++ = 0x33; // xor eax, eax
2884	*u.pb++ = 0xc0;
2885
2886	*u.pb++ = 0x48; // dec rax
2887	*u.pb++ = 0xff;
2888	*u.pb++ = 0xc8;
2889
2890	*u.pb++ = 0xc3; // ret
2891
2892	/* forward to the original handler using a retf. */
2893	*uFixJmp.pb = (uint8_t)(u.pb - uFixJmp.pb - 1); uFixJmp.pb = NULL;
2894
2895	*u.pb++ = 0x68; // push <target cs>
2896	*u.pu32++ = !pPatch->SavedIdt.u5Type2 ? ASMGetCS() : pPatch->SavedIdt.u16SegSel;
2897
2898	*u.pb++ = 0x68; // push <low target rip>
2899	*u.pu32++ = !pPatch->SavedIdt.u5Type2
2900	? (uint32_t)(uintptr_t)uNotNested.pb
2901	: (uint32_t)pPatch->SavedIdt.u16OffsetLow
2902	\| (uint32_t)pPatch->SavedIdt.u16OffsetHigh << 16;
2903
2904	*u.pb++ = 0xc7; // mov dword [rsp + 4], <high target rip>
2905	*u.pb++ = 0x44;
2906	*u.pb++ = 0x24;
2907	*u.pb++ = 0x04;
2908	*u.pu32++ = !pPatch->SavedIdt.u5Type2
2909	? (uint32_t)((uint64_t)uNotNested.pb >> 32)
2910	: pPatch->SavedIdt.u32OffsetTop;
2911
2912	*u.pb++ = 0x48; // retf ; does this require prefix?
2913	*u.pb++ = 0xcb;
2914
2915	#else /* __X86__ */
2916
2917	union
2918	{
2919	uint8_t *pb;
2920	uint16_t *pu16;
2921	uint32_t *pu32;
2922	} u, uFixJmpNotNested, uFixJmp, uFixCall, uNotNested;
2923	u.pb = &pPatch->auCode[0];
2924
2925	/* check the cookie */
2926	*u.pb++ = 0x81; // cmp esi, GLOBALCOOKIE
2927	*u.pb++ = 0xfe;
2928	*u.pu32++ = pDevExt->u32Cookie;
2929
2930	*u.pb++ = 0x74; // jz VBoxCall
2931	uFixJmp = u;
2932	*u.pb++ = 0;
2933
2934	/* jump (far) to the original handler / not-nested-stub. */
2935	*u.pb++ = 0xea; // jmp far NotNested
2936	uFixJmpNotNested = u;
2937	*u.pu32++ = 0;
2938	*u.pu16++ = 0;
2939
2940	/* save selector registers. */ // VBoxCall:
2941	*uFixJmp.pb = (uint8_t)(u.pb - uFixJmp.pb - 1);
2942	*u.pb++ = 0x0f; // push fs
2943	*u.pb++ = 0xa0;
2944
2945	*u.pb++ = 0x1e; // push ds
2946
2947	*u.pb++ = 0x06; // push es
2948
2949	/* call frame */
2950	*u.pb++ = 0x51; // push ecx
2951
2952	*u.pb++ = 0x52; // push edx
2953
2954	*u.pb++ = 0x50; // push eax
2955
2956	/* load ds, es and perhaps fs before call. */
2957	*u.pb++ = 0xb8; // mov eax, KernelDS
2958	*u.pu32++ = ASMGetDS();
2959
2960	*u.pb++ = 0x8e; // mov ds, eax
2961	*u.pb++ = 0xd8;
2962
2963	*u.pb++ = 0x8e; // mov es, eax
2964	*u.pb++ = 0xc0;
2965
2966	#ifdef __WIN__
2967	*u.pb++ = 0xb8; // mov eax, KernelFS
2968	*u.pu32++ = ASMGetFS();
2969
2970	*u.pb++ = 0x8e; // mov fs, eax
2971	*u.pb++ = 0xe0;
2972	#endif
2973
2974	/* do the call. */
2975	*u.pb++ = 0xe8; // call _VMMR0Entry / StubVMMR0Entry
2976	uFixCall = u;
2977	pPatch->offVMMR0EntryFixup = (uint16_t)(u.pb - &pPatch->auCode[0]);
2978	*u.pu32++ = 0xfffffffb;
2979
2980	*u.pb++ = 0x83; // add esp, 0ch ; cdecl
2981	*u.pb++ = 0xc4;
2982	*u.pb++ = 0x0c;
2983
2984	/* restore selector registers. */
2985	*u.pb++ = 0x07; // pop es
2986	//
2987	*u.pb++ = 0x1f; // pop ds
2988
2989	*u.pb++ = 0x0f; // pop fs
2990	*u.pb++ = 0xa1;
2991
2992	uNotNested = u; // NotNested:
2993	*u.pb++ = 0xcf; // iretd
2994
2995	/* the stub VMMR0Entry. */ // StubVMMR0Entry:
2996	pPatch->offStub = (uint16_t)(u.pb - &pPatch->auCode[0]);
2997	*u.pb++ = 0x33; // xor eax, eax
2998	*u.pb++ = 0xc0;
2999
3000	*u.pb++ = 0x48; // dec eax
3001
3002	*u.pb++ = 0xc3; // ret
3003
3004	/* Fixup the VMMR0Entry call. */
3005	if (pDevExt->pvVMMR0)
3006	*uFixCall.pu32 = (uint32_t)pDevExt->pfnVMMR0Entry - (uint32_t)(uFixCall.pu32 + 1);
3007	else
3008	*uFixCall.pu32 = (uint32_t)&pPatch->auCode[pPatch->offStub] - (uint32_t)(uFixCall.pu32 + 1);
3009
3010	/* Fixup the forward / nested far jump. */
3011	if (!pPatch->SavedIdt.u5Type2)
3012	{
3013	*uFixJmpNotNested.pu32++ = (uint32_t)uNotNested.pb;
3014	*uFixJmpNotNested.pu16++ = ASMGetCS();
3015	}
3016	else
3017	{
3018	*uFixJmpNotNested.pu32++ = ((uint32_t)pPatch->SavedIdt.u16OffsetHigh << 16) \| pPatch->SavedIdt.u16OffsetLow;
3019	*uFixJmpNotNested.pu16++ = pPatch->SavedIdt.u16SegSel;
3020	}
3021	#endif /* __X86__ */
3022	Assert(u.pb <= &pPatch->auCode[sizeof(pPatch->auCode)]);
3023	#if 0
3024	/* dump the patch code */
3025	dprintf(("patch code: %p\n", &pPatch->auCode[0]));
3026	for (uFixCall.pb = &pPatch->auCode[0]; uFixCall.pb < u.pb; uFixCall.pb++)
3027	dprintf(("0x%02x,\n", *uFixCall.pb));
3028	#endif
3029	}
3030
3031	/*
3032	* Install the patch.
3033	*/
3034	supdrvIdtWrite(pPatch->pIdtEntry, &pPatch->ChangedIdt);
3035	AssertMsg(!memcmp((void *)pPatch->pIdtEntry, &pPatch->ChangedIdt, sizeof(pPatch->ChangedIdt)), ("The stupid change code didn't work!!!!!\n"));
3036
3037	/*
3038	* Link in the patch.
3039	*/
3040	pPatch->pNext = pDevExt->pIdtPatches;
3041	pDevExt->pIdtPatches = pPatch;
3042
3043	return pPatch;
3044	}
3045
3046
3047	/**
3048	* Removes the sessions IDT references.
3049	* This will uninstall our IDT patch if we left unreferenced.
3050	*
3051	* @returns 0 indicating success.
3052	* @param pDevExt Device globals.
3053	* @param pSession Session data.
3054	*/
3055	static int supdrvIOCtl_IdtRemoveAll(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
3056	{
3057	PSUPDRVPATCHUSAGE pUsage;
3058	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3059	dprintf(("supdrvIOCtl_IdtRemoveAll: pSession=%p\n", pSession));
3060
3061	/*
3062	* Take the spinlock.
3063	*/
3064	RTSpinlockAcquireNoInts(pDevExt->Spinlock, &SpinlockTmp);
3065
3066	/*
3067	* Walk usage list.
3068	*/
3069	pUsage = pSession->pPatchUsage;
3070	while (pUsage)
3071	{
3072	if (pUsage->pPatch->cUsage <= pUsage->cUsage)
3073	supdrvIdtRemoveOne(pDevExt, pUsage->pPatch);
3074	else
3075	pUsage->pPatch->cUsage -= pUsage->cUsage;
3076
3077	/* next */
3078	pUsage = pUsage->pNext;
3079	}
3080
3081	/*
3082	* Empty the usage chain and we're done inside the spinlock.
3083	*/
3084	pUsage = pSession->pPatchUsage;
3085	pSession->pPatchUsage = NULL;
3086
3087	RTSpinlockReleaseNoInts(pDevExt->Spinlock, &SpinlockTmp);
3088
3089	/*
3090	* Free usage entries.
3091	*/
3092	while (pUsage)
3093	{
3094	void *pvToFree = pUsage;
3095	pUsage->cUsage = 0;
3096	pUsage->pPatch = NULL;
3097	pUsage = pUsage->pNext;
3098	RTMemFree(pvToFree);
3099	}
3100
3101	return 0;
3102	}
3103
3104
3105	/**
3106	* Remove one patch.
3107	*
3108	* @param pDevExt Device globals.
3109	* @param pPatch Patch entry to remove.
3110	* @remark Caller must own SUPDRVDEVEXT::Spinlock!
3111	*/
3112	static void supdrvIdtRemoveOne(PSUPDRVDEVEXT pDevExt, PSUPDRVPATCH pPatch)
3113	{
3114	dprintf(("supdrvIdtRemoveOne: pPatch=%p\n", pPatch));
3115
3116	pPatch->cUsage = 0;
3117
3118	/*
3119	* If the IDT entry was changed it have to kick around for ever!
3120	* This will be attempted freed again, perhaps next time we'll succeed :-)
3121	*/
3122	if (memcmp((void *)pPatch->pIdtEntry, &pPatch->ChangedIdt, sizeof(pPatch->ChangedIdt)))
3123	{
3124	AssertMsgFailed(("The hijacked IDT entry has CHANGED!!!\n"));
3125	return;
3126	}
3127
3128	/*
3129	* Unlink it.
3130	*/
3131	if (pDevExt->pIdtPatches != pPatch)
3132	{
3133	PSUPDRVPATCH pPatchPrev = pDevExt->pIdtPatches;
3134	while (pPatchPrev)
3135	{
3136	if (pPatchPrev->pNext == pPatch)
3137	{
3138	pPatchPrev->pNext = pPatch->pNext;
3139	break;
3140	}
3141	pPatchPrev = pPatchPrev->pNext;
3142	}
3143	Assert(!pPatchPrev);
3144	}
3145	else
3146	pDevExt->pIdtPatches = pPatch->pNext;
3147	pPatch->pNext = NULL;
3148
3149
3150	/*
3151	* Verify and restore the IDT.
3152	*/
3153	AssertMsg(!memcmp((void *)pPatch->pIdtEntry, &pPatch->ChangedIdt, sizeof(pPatch->ChangedIdt)), ("The hijacked IDT entry has CHANGED!!!\n"));
3154	supdrvIdtWrite(pPatch->pIdtEntry, &pPatch->SavedIdt);
3155	AssertMsg(!memcmp((void *)pPatch->pIdtEntry, &pPatch->SavedIdt, sizeof(pPatch->SavedIdt)), ("The hijacked IDT entry has CHANGED!!!\n"));
3156
3157	/*
3158	* Put it in the free list.
3159	* (This free list stuff is to calm my paranoia.)
3160	*/
3161	pPatch->pvIdt = NULL;
3162	pPatch->pIdtEntry = NULL;
3163
3164	pPatch->pNext = pDevExt->pIdtPatchesFree;
3165	pDevExt->pIdtPatchesFree = pPatch;
3166	}
3167
3168
3169	/**
3170	* Write to an IDT entry.
3171	*
3172	* @param pvIdtEntry Where to write.
3173	* @param pNewIDTEntry What to write.
3174	*/
3175	static void supdrvIdtWrite(volatile void pvIdtEntry, const SUPDRVIDTE pNewIDTEntry)
3176	{
3177	RTUINTREG uCR0;
3178	RTUINTREG uFlags;
3179
3180	/*
3181	* On SMP machines (P4 hyperthreading included) we must preform a
3182	* 64-bit locked write when updating the IDT entry.
3183	*
3184	* The F00F bugfix for linux (and probably other OSes) causes
3185	* the IDT to be pointing to an readonly mapping. We get around that
3186	* by temporarily turning of WP. Since we're inside a spinlock at this
3187	* point, interrupts are disabled and there isn't any way the WP bit
3188	* flipping can cause any trouble.
3189	*/
3190
3191	/* Save & Clear interrupt flag; Save & clear WP. */
3192	uFlags = ASMGetFlags();
3193	ASMSetFlags(uFlags & ~(RTUINTREG)(1 << 9)); /X86_EFL_IF/
3194	Assert(!(ASMGetFlags() & (1 << 9)));
3195	uCR0 = ASMGetCR0();
3196	ASMSetCR0(uCR0 & ~(RTUINTREG)(1 << 16)); /X86_CR0_WP/
3197
3198	/* Update IDT Entry */
3199	#ifdef __AMD64__
3200	ASMAtomicXchgU128((volatile uint128_t )pvIdtEntry, (uint128_t *)(uintptr_t)pNewIDTEntry);
3201	#else
3202	ASMAtomicXchgU64((volatile uint64_t )pvIdtEntry, (uint64_t *)(uintptr_t)pNewIDTEntry);
3203	#endif
3204
3205	/* Restore CR0 & Flags */
3206	ASMSetCR0(uCR0);
3207	ASMSetFlags(uFlags);
3208	}
3209	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
3210
3211
3212	/**
3213	* Opens an image. If it's the first time it's opened the call must upload
3214	* the bits using the supdrvIOCtl_LdrLoad() / SUPDRV_IOCTL_LDR_LOAD function.
3215	*
3216	* This is the 1st step of the loading.
3217	*
3218	* @returns 0 on success.
3219	* @returns SUPDRV_ERR_* on failure.
3220	* @param pDevExt Device globals.
3221	* @param pSession Session data.
3222	* @param pIn Input.
3223	* @param pOut Output. (May overlap pIn.)
3224	*/
3225	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN_IN pIn, PSUPLDROPEN_OUT pOut)
3226	{
3227	PSUPDRVLDRIMAGE pImage;
3228	unsigned cb;
3229	void *pv;
3230	dprintf(("supdrvIOCtl_LdrOpen: szName=%s cbImage=%d\n", pIn->szName, pIn->cbImage));
3231
3232	/*
3233	* Check if we got an instance of the image already.
3234	*/
3235	RTSemFastMutexRequest(pDevExt->mtxLdr);
3236	for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
3237	{
3238	if (!strcmp(pImage->szName, pIn->szName))
3239	{
3240	pImage->cUsage++;
3241	pOut->pvImageBase = pImage->pvImage;
3242	pOut->fNeedsLoading = pImage->uState == SUP_IOCTL_LDR_OPEN;
3243	supdrvLdrAddUsage(pSession, pImage);
3244	RTSemFastMutexRelease(pDevExt->mtxLdr);
3245	return 0;
3246	}
3247	}
3248	/* (not found - add it!) */
3249
3250	/*
3251	* Allocate memory.
3252	*/
3253	cb = pIn->cbImage + sizeof(SUPDRVLDRIMAGE) + 31;
3254	pv = RTMemExecAlloc(cb);
3255	if (!pv)
3256	{
3257	RTSemFastMutexRelease(pDevExt->mtxLdr);
3258	return SUPDRV_ERR_NO_MEMORY;
3259	}
3260
3261	/*
3262	* Setup and link in the LDR stuff.
3263	*/
3264	pImage = (PSUPDRVLDRIMAGE)pv;
3265	pImage->pvImage = ALIGNP(pImage + 1, 32);
3266	pImage->cbImage = pIn->cbImage;
3267	pImage->pfnModuleInit = NULL;
3268	pImage->pfnModuleTerm = NULL;
3269	pImage->uState = SUP_IOCTL_LDR_OPEN;
3270	pImage->cUsage = 1;
3271	strcpy(pImage->szName, pIn->szName);
3272
3273	pImage->pNext = pDevExt->pLdrImages;
3274	pDevExt->pLdrImages = pImage;
3275
3276	supdrvLdrAddUsage(pSession, pImage);
3277
3278	pOut->pvImageBase = pImage->pvImage;
3279	pOut->fNeedsLoading = 1;
3280	RTSemFastMutexRelease(pDevExt->mtxLdr);
3281	return 0;
3282	}
3283
3284
3285	/**
3286	* Loads the image bits.
3287	*
3288	* This is the 2nd step of the loading.
3289	*
3290	* @returns 0 on success.
3291	* @returns SUPDRV_ERR_* on failure.
3292	* @param pDevExt Device globals.
3293	* @param pSession Session data.
3294	* @param pIn Input.
3295	*/
3296	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD_IN pIn)
3297	{
3298	PSUPDRVLDRUSAGE pUsage;
3299	PSUPDRVLDRIMAGE pImage;
3300	int rc;
3301	dprintf(("supdrvIOCtl_LdrLoad: pvImageBase=%p cbImage=%d\n", pIn->pvImageBase, pIn->cbImage));
3302
3303	/*
3304	* Find the ldr image.
3305	*/
3306	RTSemFastMutexRequest(pDevExt->mtxLdr);
3307	pUsage = pSession->pLdrUsage;
3308	while (pUsage && pUsage->pImage->pvImage != pIn->pvImageBase)
3309	pUsage = pUsage->pNext;
3310	if (!pUsage)
3311	{
3312	RTSemFastMutexRelease(pDevExt->mtxLdr);
3313	dprintf(("SUP_IOCTL_LDR_LOAD: couldn't find image!\n"));
3314	return SUPDRV_ERR_INVALID_HANDLE;
3315	}
3316	pImage = pUsage->pImage;
3317	if (pImage->cbImage != pIn->cbImage)
3318	{
3319	RTSemFastMutexRelease(pDevExt->mtxLdr);
3320	dprintf(("SUP_IOCTL_LDR_LOAD: image size mismatch!! %d(prep) != %d(load)\n", pImage->cbImage, pIn->cbImage));
3321	return SUPDRV_ERR_INVALID_HANDLE;
3322	}
3323	if (pImage->uState != SUP_IOCTL_LDR_OPEN)
3324	{
3325	unsigned uState = pImage->uState;
3326	RTSemFastMutexRelease(pDevExt->mtxLdr);
3327	if (uState != SUP_IOCTL_LDR_LOAD)
3328	AssertMsgFailed(("SUP_IOCTL_LDR_LOAD: invalid image state %d (%#x)!\n", uState, uState));
3329	return SUPDRV_ERR_ALREADY_LOADED;
3330	}
3331	switch (pIn->eEPType)
3332	{
3333	case EP_NOTHING:
3334	break;
3335	case EP_VMMR0:
3336	if (!pIn->EP.VMMR0.pvVMMR0 \|\| !pIn->EP.VMMR0.pvVMMR0Entry)
3337	{
3338	RTSemFastMutexRelease(pDevExt->mtxLdr);
3339	dprintf(("pvVMMR0=%p or pIn->EP.VMMR0.pvVMMR0Entry=%p is NULL!\n",
3340	pIn->EP.VMMR0.pvVMMR0, pIn->EP.VMMR0.pvVMMR0Entry));
3341	return SUPDRV_ERR_INVALID_PARAM;
3342	}
3343	if ((uintptr_t)pIn->EP.VMMR0.pvVMMR0Entry - (uintptr_t)pImage->pvImage >= pIn->cbImage)
3344	{
3345	RTSemFastMutexRelease(pDevExt->mtxLdr);
3346	dprintf(("SUP_IOCTL_LDR_LOAD: pvVMMR0Entry=%p is outside the image (%p %d bytes)\n",
3347	pIn->EP.VMMR0.pvVMMR0Entry, pImage->pvImage, pIn->cbImage));
3348	return SUPDRV_ERR_INVALID_PARAM;
3349	}
3350	break;
3351	default:
3352	RTSemFastMutexRelease(pDevExt->mtxLdr);
3353	dprintf(("Invalid eEPType=%d\n", pIn->eEPType));
3354	return SUPDRV_ERR_INVALID_PARAM;
3355	}
3356	if ( pIn->pfnModuleInit
3357	&& (uintptr_t)pIn->pfnModuleInit - (uintptr_t)pImage->pvImage >= pIn->cbImage)
3358	{
3359	RTSemFastMutexRelease(pDevExt->mtxLdr);
3360	dprintf(("SUP_IOCTL_LDR_LOAD: pfnModuleInit=%p is outside the image (%p %d bytes)\n",
3361	pIn->pfnModuleInit, pImage->pvImage, pIn->cbImage));
3362	return SUPDRV_ERR_INVALID_PARAM;
3363	}
3364	if ( pIn->pfnModuleTerm
3365	&& (uintptr_t)pIn->pfnModuleTerm - (uintptr_t)pImage->pvImage >= pIn->cbImage)
3366	{
3367	RTSemFastMutexRelease(pDevExt->mtxLdr);
3368	dprintf(("SUP_IOCTL_LDR_LOAD: pfnModuleTerm=%p is outside the image (%p %d bytes)\n",
3369	pIn->pfnModuleTerm, pImage->pvImage, pIn->cbImage));
3370	return SUPDRV_ERR_INVALID_PARAM;
3371	}
3372
3373	/*
3374	* Copy the memory.
3375	*/
3376	/* no need to do try/except as this is a buffered request. */
3377	memcpy(pImage->pvImage, &pIn->achImage[0], pImage->cbImage);
3378	pImage->uState = SUP_IOCTL_LDR_LOAD;
3379	pImage->pfnModuleInit = pIn->pfnModuleInit;
3380	pImage->pfnModuleTerm = pIn->pfnModuleTerm;
3381	pImage->offSymbols = pIn->offSymbols;
3382	pImage->cSymbols = pIn->cSymbols;
3383	pImage->offStrTab = pIn->offStrTab;
3384	pImage->cbStrTab = pIn->cbStrTab;
3385
3386	/*
3387	* Update any entry points.
3388	*/
3389	switch (pIn->eEPType)
3390	{
3391	default:
3392	case EP_NOTHING:
3393	rc = 0;
3394	break;
3395	case EP_VMMR0:
3396	rc = supdrvLdrSetR0EP(pDevExt, pIn->EP.VMMR0.pvVMMR0, pIn->EP.VMMR0.pvVMMR0Entry);
3397	break;
3398	}
3399
3400	/*
3401	* On success call the module initialization.
3402	*/
3403	dprintf(("supdrvIOCtl_LdrLoad: pfnModuleInit=%p\n", pImage->pfnModuleInit));
3404	if (!rc && pImage->pfnModuleInit)
3405	{
3406	dprintf(("supdrvIOCtl_LdrLoad: calling pfnModuleInit=%p\n", pImage->pfnModuleInit));
3407	rc = pImage->pfnModuleInit();
3408	if (rc && pDevExt->pvVMMR0 == pImage->pvImage)
3409	supdrvLdrUnsetR0EP(pDevExt);
3410	}
3411
3412	if (rc)
3413	pImage->uState = SUP_IOCTL_LDR_OPEN;
3414
3415	RTSemFastMutexRelease(pDevExt->mtxLdr);
3416	return rc;
3417	}
3418
3419
3420	/**
3421	* Frees a previously loaded (prep'ed) image.
3422	*
3423	* @returns 0 on success.
3424	* @returns SUPDRV_ERR_* on failure.
3425	* @param pDevExt Device globals.
3426	* @param pSession Session data.
3427	* @param pIn Input.
3428	*/
3429	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE_IN pIn)
3430	{
3431	PSUPDRVLDRUSAGE pUsagePrev;
3432	PSUPDRVLDRUSAGE pUsage;
3433	PSUPDRVLDRIMAGE pImage;
3434	dprintf(("supdrvIOCtl_LdrFree: pvImageBase=%p\n", pIn->pvImageBase));
3435
3436	/*
3437	* Find the ldr image.
3438	*/
3439	RTSemFastMutexRequest(pDevExt->mtxLdr);
3440	pUsagePrev = NULL;
3441	pUsage = pSession->pLdrUsage;
3442	while (pUsage && pUsage->pImage->pvImage != pIn->pvImageBase)
3443	{
3444	pUsagePrev = pUsage;
3445	pUsage = pUsage->pNext;
3446	}
3447	if (!pUsage)
3448	{
3449	RTSemFastMutexRelease(pDevExt->mtxLdr);
3450	dprintf(("SUP_IOCTL_LDR_FREE: couldn't find image!\n"));
3451	return SUPDRV_ERR_INVALID_HANDLE;
3452	}
3453
3454	/*
3455	* Check if we can remove anything.
3456	*/
3457	pImage = pUsage->pImage;
3458	if (pImage->cUsage <= 1 \|\| pUsage->cUsage <= 1)
3459	{
3460	/* unlink it */
3461	if (pUsagePrev)
3462	pUsagePrev->pNext = pUsage->pNext;
3463	else
3464	pSession->pLdrUsage = pUsage->pNext;
3465	/* free it */
3466	pUsage->pImage = NULL;
3467	pUsage->pNext = NULL;
3468	RTMemFree(pUsage);
3469
3470	/*
3471	* Derefrence the image.
3472	*/
3473	if (pImage->cUsage <= 1)
3474	supdrvLdrFree(pDevExt, pImage);
3475	else
3476	pImage->cUsage--;
3477	}
3478	else
3479	{
3480	/*
3481	* Dereference both image and usage.
3482	*/
3483	pImage->cUsage--;
3484	pUsage->cUsage--;
3485	}
3486
3487	RTSemFastMutexRelease(pDevExt->mtxLdr);
3488	return 0;
3489	}
3490
3491
3492	/**
3493	* Gets the address of a symbol in an open image.
3494	*
3495	* @returns 0 on success.
3496	* @returns SUPDRV_ERR_* on failure.
3497	* @param pDevExt Device globals.
3498	* @param pSession Session data.
3499	* @param pIn Input.
3500	* @param pOut Output. (May overlap pIn.)
3501	*/
3502	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL_IN pIn, PSUPLDRGETSYMBOL_OUT pOut)
3503	{
3504	PSUPDRVLDRIMAGE pImage;
3505	PSUPDRVLDRUSAGE pUsage;
3506	uint32_t i;
3507	PSUPLDRSYM paSyms;
3508	const char *pchStrings;
3509	const size_t cbSymbol = strlen(pIn->szSymbol) + 1;
3510	void *pvSymbol = NULL;
3511	int rc = SUPDRV_ERR_GENERAL_FAILURE; /** @todo better error code. */
3512	dprintf2(("supdrvIOCtl_LdrGetSymbol: pvImageBase=%p szSymbol=\"%s\"\n", pIn->pvImageBase, pIn->szSymbol));
3513
3514	/*
3515	* Find the ldr image.
3516	*/
3517	RTSemFastMutexRequest(pDevExt->mtxLdr);
3518	pUsage = pSession->pLdrUsage;
3519	while (pUsage && pUsage->pImage->pvImage != pIn->pvImageBase)
3520	pUsage = pUsage->pNext;
3521	if (!pUsage)
3522	{
3523	RTSemFastMutexRelease(pDevExt->mtxLdr);
3524	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: couldn't find image!\n"));
3525	return SUPDRV_ERR_INVALID_HANDLE;
3526	}
3527	pImage = pUsage->pImage;
3528	if (pImage->uState != SUP_IOCTL_LDR_LOAD)
3529	{
3530	unsigned uState = pImage->uState;
3531	RTSemFastMutexRelease(pDevExt->mtxLdr);
3532	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: invalid image state %d (%#x)!\n", uState, uState)); NOREF(uState);
3533	return SUPDRV_ERR_ALREADY_LOADED;
3534	}
3535
3536	/*
3537	* Search the symbol string.
3538	*/
3539	pchStrings = (const char )((uint8_t )pImage->pvImage + pImage->offStrTab);
3540	paSyms = (PSUPLDRSYM)((uint8_t *)pImage->pvImage + pImage->offSymbols);
3541	for (i = 0; i < pImage->cSymbols; i++)
3542	{
3543	if ( paSyms[i].offSymbol < pImage->cbImage /* paranoia */
3544	&& paSyms[i].offName + cbSymbol <= pImage->cbStrTab
3545	&& !memcmp(pchStrings + paSyms[i].offName, pIn->szSymbol, cbSymbol))
3546	{
3547	pvSymbol = (uint8_t *)pImage->pvImage + paSyms[i].offSymbol;
3548	rc = 0;
3549	break;
3550	}
3551	}
3552	RTSemFastMutexRelease(pDevExt->mtxLdr);
3553	pOut->pvSymbol = pvSymbol;
3554	return rc;
3555	}
3556
3557
3558	/**
3559	* Updates the IDT patches to point to the specified VMM R0 entry
3560	* point (i.e. VMMR0Enter()).
3561	*
3562	* @returns 0 on success.
3563	* @returns SUPDRV_ERR_* on failure.
3564	* @param pDevExt Device globals.
3565	* @param pSession Session data.
3566	* @param pVMMR0 VMMR0 image handle.
3567	* @param pVMMR0Entry VMMR0Entry address.
3568	* @remark Caller must own the loader mutex.
3569	*/
3570	static int supdrvLdrSetR0EP(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0Entry)
3571	{
3572	int rc;
3573	dprintf(("supdrvLdrSetR0EP pvVMMR0=%p pvVMMR0Entry=%p\n", pvVMMR0, pvVMMR0Entry));
3574
3575
3576	/*
3577	* Check if not yet set.
3578	*/
3579	rc = 0;
3580	if (!pDevExt->pvVMMR0)
3581	{
3582	#ifndef VBOX_WITHOUT_IDT_PATCHING
3583	PSUPDRVPATCH pPatch;
3584	#endif
3585
3586	/*
3587	* Set it and update IDT patch code.
3588	*/
3589	pDevExt->pvVMMR0 = pvVMMR0;
3590	pDevExt->pfnVMMR0Entry = pvVMMR0Entry;
3591	#ifndef VBOX_WITHOUT_IDT_PATCHING
3592	for (pPatch = pDevExt->pIdtPatches; pPatch; pPatch = pPatch->pNext)
3593	{
3594	# ifdef __AMD64__
3595	ASMAtomicXchgU64((volatile uint64_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup], (uint64_t)pvVMMR0);
3596	# else /* __X86__ */
3597	ASMAtomicXchgU32((volatile uint32_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup],
3598	(uint32_t)pvVMMR0 - (uint32_t)&pPatch->auCode[pPatch->offVMMR0EntryFixup + 4]);
3599	# endif
3600	}
3601	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
3602	}
3603	else
3604	{
3605	/*
3606	* Return failure or success depending on whether the
3607	* values match or not.
3608	*/
3609	if ( pDevExt->pvVMMR0 != pvVMMR0
3610	\|\| (void *)pDevExt->pfnVMMR0Entry != pvVMMR0Entry)
3611	{
3612	AssertMsgFailed(("SUP_IOCTL_LDR_SETR0EP: Already set pointing to a different module!\n"));
3613	rc = SUPDRV_ERR_INVALID_PARAM;
3614	}
3615	}
3616	return rc;
3617	}
3618
3619
3620	/**
3621	* Unsets the R0 entry point installed by supdrvLdrSetR0EP.
3622	*
3623	* @param pDevExt Device globals.
3624	*/
3625	static void supdrvLdrUnsetR0EP(PSUPDRVDEVEXT pDevExt)
3626	{
3627	#ifndef VBOX_WITHOUT_IDT_PATCHING
3628	PSUPDRVPATCH pPatch;
3629	#endif
3630
3631	pDevExt->pvVMMR0 = NULL;
3632	pDevExt->pfnVMMR0Entry = NULL;
3633
3634	#ifndef VBOX_WITHOUT_IDT_PATCHING
3635	for (pPatch = pDevExt->pIdtPatches; pPatch; pPatch = pPatch->pNext)
3636	{
3637	# ifdef __AMD64__
3638	ASMAtomicXchgU64((volatile uint64_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup],
3639	(uint64_t)&pPatch->auCode[pPatch->offStub]);
3640	# else /* __X86__ */
3641	ASMAtomicXchgU32((volatile uint32_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup],
3642	(uint32_t)&pPatch->auCode[pPatch->offStub] - (uint32_t)&pPatch->auCode[pPatch->offVMMR0EntryFixup + 4]);
3643	# endif
3644	}
3645	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
3646	}
3647
3648
3649	/**
3650	* Adds a usage reference in the specified session of an image.
3651	*
3652	* @param pSession Session in question.
3653	* @param pImage Image which the session is using.
3654	*/
3655	static void supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage)
3656	{
3657	PSUPDRVLDRUSAGE pUsage;
3658	dprintf(("supdrvLdrAddUsage: pImage=%p\n", pImage));
3659
3660	/*
3661	* Referenced it already?
3662	*/
3663	pUsage = pSession->pLdrUsage;
3664	while (pUsage)
3665	{
3666	if (pUsage->pImage == pImage)
3667	{
3668	pUsage->cUsage++;
3669	return;
3670	}
3671	pUsage = pUsage->pNext;
3672	}
3673
3674	/*
3675	* Allocate new usage record.
3676	*/
3677	pUsage = (PSUPDRVLDRUSAGE)RTMemAlloc(sizeof(*pUsage));
3678	Assert(pUsage);
3679	if (pUsage)
3680	{
3681	pUsage->cUsage = 1;
3682	pUsage->pImage = pImage;
3683	pUsage->pNext = pSession->pLdrUsage;
3684	pSession->pLdrUsage = pUsage;
3685	}
3686	/* ignore errors... */
3687	}
3688
3689
3690	/**
3691	* Frees a load image.
3692	*
3693	* @param pDevExt Pointer to device extension.
3694	* @param pImage Pointer to the image we're gonna free.
3695	* This image must exit!
3696	* @remark The caller MUST own SUPDRVDEVEXT::mtxLdr!
3697	*/
3698	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage)
3699	{
3700	PSUPDRVLDRIMAGE pImagePrev;
3701	dprintf(("supdrvLdrFree: pImage=%p\n", pImage));
3702
3703	/* find it - arg. should've used doubly linked list. */
3704	Assert(pDevExt->pLdrImages);
3705	pImagePrev = NULL;
3706	if (pDevExt->pLdrImages != pImage)
3707	{
3708	pImagePrev = pDevExt->pLdrImages;
3709	while (pImagePrev->pNext != pImage)
3710	pImagePrev = pImagePrev->pNext;
3711	Assert(pImagePrev->pNext == pImage);
3712	}
3713
3714	/* unlink */
3715	if (pImagePrev)
3716	pImagePrev->pNext = pImage->pNext;
3717	else
3718	pDevExt->pLdrImages = pImage->pNext;
3719
3720	/* check if this is VMMR0.r0 and fix the Idt patches if it is. */
3721	if (pDevExt->pvVMMR0 == pImage->pvImage)
3722	supdrvLdrUnsetR0EP(pDevExt);
3723
3724	/* call termination function if fully loaded. */
3725	if ( pImage->pfnModuleTerm
3726	&& pImage->uState == SUP_IOCTL_LDR_LOAD)
3727	{
3728	dprintf(("supdrvIOCtl_LdrLoad: calling pfnModuleTerm=%p\n", pImage->pfnModuleTerm));
3729	pImage->pfnModuleTerm();
3730	}
3731
3732	/* free the image */
3733	pImage->cUsage = 0;
3734	pImage->pNext = 0;
3735	pImage->uState = SUP_IOCTL_LDR_FREE;
3736	RTMemExecFree(pImage);
3737	}
3738
3739
3740	/**
3741	* Gets the current paging mode of the CPU and stores in in pOut.
3742	*/
3743	static int supdrvIOCtl_GetPagingMode(PSUPGETPAGINGMODE_OUT pOut)
3744	{
3745	RTUINTREG cr0 = ASMGetCR0();
3746	if ((cr0 & (X86_CR0_PG \| X86_CR0_PE)) != (X86_CR0_PG \| X86_CR0_PE))
3747	pOut->enmMode = SUPPAGINGMODE_INVALID;
3748	else
3749	{
3750	RTUINTREG cr4 = ASMGetCR4();
3751	uint32_t fNXEPlusLMA = 0;
3752	if (cr4 & X86_CR4_PAE)
3753	{
3754	uint32_t fAmdFeatures = ASMCpuId_EDX(0x80000001);
3755	if (fAmdFeatures & (X86_CPUID_AMD_FEATURE_EDX_NX \| X86_CPUID_AMD_FEATURE_EDX_LONG_MODE))
3756	{
3757	uint64_t efer = ASMRdMsr(MSR_K6_EFER);
3758	if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_NX) && (efer & MSR_K6_EFER_NXE))
3759	fNXEPlusLMA \|= BIT(0);
3760	if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE) && (efer & MSR_K6_EFER_LMA))
3761	fNXEPlusLMA \|= BIT(1);
3762	}
3763	}
3764
3765	switch ((cr4 & (X86_CR4_PAE \| X86_CR4_PGE)) \| fNXEPlusLMA)
3766	{
3767	case 0:
3768	pOut->enmMode = SUPPAGINGMODE_32_BIT;
3769	break;
3770
3771	case X86_CR4_PGE:
3772	pOut->enmMode = SUPPAGINGMODE_32_BIT_GLOBAL;
3773	break;
3774
3775	case X86_CR4_PAE:
3776	pOut->enmMode = SUPPAGINGMODE_PAE;
3777	break;
3778
3779	case X86_CR4_PAE \| BIT(0):
3780	pOut->enmMode = SUPPAGINGMODE_PAE_NX;
3781	break;
3782
3783	case X86_CR4_PAE \| X86_CR4_PGE:
3784	pOut->enmMode = SUPPAGINGMODE_PAE_GLOBAL;
3785	break;
3786
3787	case X86_CR4_PAE \| X86_CR4_PGE \| BIT(0):
3788	pOut->enmMode = SUPPAGINGMODE_PAE_GLOBAL;
3789	break;
3790
3791	case BIT(1) \| X86_CR4_PAE:
3792	pOut->enmMode = SUPPAGINGMODE_AMD64;
3793	break;
3794
3795	case BIT(1) \| X86_CR4_PAE \| BIT(0):
3796	pOut->enmMode = SUPPAGINGMODE_AMD64_NX;
3797	break;
3798
3799	case BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE:
3800	pOut->enmMode = SUPPAGINGMODE_AMD64_GLOBAL;
3801	break;
3802
3803	case BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE \| BIT(0):
3804	pOut->enmMode = SUPPAGINGMODE_AMD64_GLOBAL_NX;
3805	break;
3806
3807	default:
3808	AssertMsgFailed(("Cannot happen! cr4=%#x fNXEPlusLMA=%d\n", cr4, fNXEPlusLMA));
3809	pOut->enmMode = SUPPAGINGMODE_INVALID;
3810	break;
3811	}
3812	}
3813	return 0;
3814	}
3815
3816
3817	#if !defined(SUPDRV_OS_HAVE_LOW) && !defined(USE_NEW_OS_INTERFACE) /* Use same backend as the contiguous stuff */
3818	/**
3819	* OS Specific code for allocating page aligned memory with fixed
3820	* physical backing below 4GB.
3821	*
3822	* @returns 0 on success.
3823	* @returns SUPDRV_ERR_* on failure.
3824	* @param pMem Memory reference record of the memory to be allocated.
3825	* (This is not linked in anywhere.)
3826	* @param ppvR3 Where to store the Ring-3 mapping of the allocated memory.
3827	* @param paPagesOut Where to store the physical addresss.
3828	*/
3829	int VBOXCALL supdrvOSLowAllocOne(PSUPDRVMEMREF pMem, void **ppvR3, PSUPPAGE paPagesOut)
3830	{
3831	RTHCPHYS HCPhys;
3832	int rc = supdrvOSContAllocOne(pMem, NULL, ppvR3, &HCPhys);
3833	if (!rc)
3834	{
3835	unsigned iPage = pMem->cb >> PAGE_SHIFT;
3836	while (iPage-- > 0)
3837	{
3838	paPagesOut[iPage].Phys = HCPhys + (iPage << PAGE_SHIFT);
3839	paPagesOut[iPage].uReserved = 0;
3840	}
3841	}
3842	return rc;
3843	}
3844
3845
3846	/**
3847	* Frees low memory.
3848	*
3849	* @param pMem Memory reference record of the memory to be freed.
3850	*/
3851	void VBOXCALL supdrvOSLowFreeOne(PSUPDRVMEMREF pMem)
3852	{
3853	supdrvOSContFreeOne(pMem);
3854	}
3855	#endif /* !SUPDRV_OS_HAVE_LOW */
3856
3857
3858	#ifdef USE_NEW_OS_INTERFACE
3859	/**
3860	* Creates the GIP.
3861	*
3862	* @returns negative errno.
3863	* @param pDevExt Instance data. GIP stuff may be updated.
3864	*/
3865	static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt)
3866	{
3867	PSUPGLOBALINFOPAGE pGip;
3868	RTHCPHYS HCPhysGip;
3869	uint32_t u32SystemResolution;
3870	uint32_t u32Interval;
3871	int rc;
3872
3873	dprintf(("supdrvGipCreate:\n"));
3874
3875	/* assert order */
3876	Assert(pDevExt->u32SystemTimerGranularityGrant == 0);
3877	Assert(pDevExt->GipMemObj == NIL_RTR0MEMOBJ);
3878	Assert(!pDevExt->pGipTimer);
3879
3880	/*
3881	* Allocate a suitable page with a default kernel mapping.
3882	*/
3883	rc = RTR0MemObjAllocLow(&pDevExt->GipMemObj, PAGE_SIZE, false);
3884	if (RT_FAILURE(rc))
3885	{
3886	OSDBGPRINT(("supdrvGipCreate: failed to allocate the GIP page. rc=%d\n", rc));
3887	return rc;
3888	}
3889	pGip = (PSUPGLOBALINFOPAGE)RTR0MemObjAddress(pDevExt->GipMemObj); AssertPtr(pGip);
3890	HCPhysGip = RTR0MemObjGetPagePhysAddr(pDevExt->GipMemObj, 0); Assert(HCPhysGip != NIL_RTHCPHYS);
3891
3892	/*
3893	* Try bump up the system timer resolution.
3894	* The more interrupts the better...
3895	*/
3896	if ( RT_SUCCESS(RTTimerRequestSystemGranularity( 976563 /* 1024 HZ */, &u32SystemResolution))
3897	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 1000000 /* 1000 HZ */, &u32SystemResolution))
3898	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 3906250 /* 256 HZ */, &u32SystemResolution))
3899	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 4000000 /* 250 HZ */, &u32SystemResolution))
3900	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 7812500 /* 128 HZ */, &u32SystemResolution))
3901	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(10000000 /* 100 HZ */, &u32SystemResolution))
3902	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(15625000 /* 64 HZ */, &u32SystemResolution))
3903	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(31250000 /* 32 HZ */, &u32SystemResolution))
3904	)
3905	{
3906	Assert(RTTimerGetSystemGranularity() <= u32SystemResolution);
3907	pDevExt->u32SystemTimerGranularityGrant = u32SystemResolution;
3908	}
3909
3910	/*
3911	* Find a reasonable update interval, something close to 10ms would be nice,
3912	* and create a recurring timer.
3913	*/
3914	u32Interval = u32SystemResolution = RTTimerGetSystemGranularity();
3915	while (u32Interval < 10000000 /* 10 ms */)
3916	u32Interval += u32SystemResolution;
3917
3918	rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, 0, supdrvGipTimer, pDevExt);
3919	if (RT_FAILURE(rc))
3920	{
3921	OSDBGPRINT(("supdrvGipCreate: failed create GIP timer at %RU32 ns interval. rc=%d\n", u32Interval, rc));
3922	Assert(!pDevExt->pGipTimer);
3923	supdrvGipDestroy(pDevExt);
3924	return rc;
3925	}
3926
3927	/*
3928	* We're good.
3929	*/
3930	supdrvGipInit(pDevExt, pGip, HCPhysGip, RTTimeSystemNanoTS(), 1000000000 / u32Interval /=Hz/);
3931	return 0;
3932	}
3933
3934
3935	/**
3936	* Terminates the GIP.
3937	*
3938	* @returns negative errno.
3939	* @param pDevExt Instance data. GIP stuff may be updated.
3940	*/
3941	static int supdrvGipDestroy(PSUPDRVDEVEXT pDevExt)
3942	{
3943	int rc;
3944
3945	/*
3946	* Invalid the GIP data.
3947	*/
3948	if (pDevExt->pGip)
3949	{
3950	supdrvGipTerm(pDevExt->pGip);
3951	pDevExt->pGip = 0;
3952	}
3953
3954	/*
3955	* Destroy the timer and free the GIP memory object.
3956	*/
3957	if (pDevExt->pGipTimer)
3958	{
3959	rc = RTTimerDestroy(pDevExt->pGipTimer); AssertRC(rc);
3960	pDevExt->pGipTimer = NULL;
3961	}
3962
3963	if (pDevExt->GipMemObj != NIL_RTR0MEMOBJ)
3964	{
3965	rc = RTR0MemObjFree(pDevExt->GipMemObj, true /* free mappings */); AssertRC(rc);
3966	pDevExt->GipMemObj = NIL_RTR0MEMOBJ;
3967	}
3968
3969	/*
3970	* Finally, release the system timer resolution request if one succeeded.
3971	*/
3972	if (pDevExt->u32SystemTimerGranularityGrant)
3973	{
3974	rc = RTTimerReleaseSystemGranularity(pDevExt->u32SystemTimerGranularityGrant); AssertRC(rc);
3975	pDevExt->u32SystemTimerGranularityGrant = 0;
3976	}
3977
3978	return 0;
3979	}
3980
3981
3982	/**
3983	* Timer callback function.
3984	* @param pTimer The timer.
3985	* @param pvUser The device extension.
3986	*/
3987	static DECLCALLBACK(void) supdrvGipTimer(PRTTIMER pTimer, void *pvUser)
3988	{
3989	PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
3990	supdrvGipUpdate(pDevExt->pGip, RTTimeSystemNanoTS());
3991	}
3992	#endif /* USE_NEW_OS_INTERFACE */
3993
3994
3995	/**
3996	* Initializes the GIP data.
3997	*
3998	* @returns VBox status code.
3999	* @param pDevExt Pointer to the device instance data.
4000	* @param pGip Pointer to the read-write kernel mapping of the GIP.
4001	* @param HCPhys The physical address of the GIP.
4002	* @param u64NanoTS The current nanosecond timestamp.
4003	* @param uUpdateHz The update freqence.
4004	*/
4005	int VBOXCALL supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys, uint64_t u64NanoTS, unsigned uUpdateHz)
4006	{
4007	dprintf(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
4008
4009	memset(pGip, 0, PAGE_SIZE);
4010	pGip->u32Magic = SUPGLOBALINFOPAGE_MAGIC;
4011	pGip->u32UpdateHz = uUpdateHz;
4012	pGip->u32UpdateIntervalNS = 1000000000 / uUpdateHz;
4013	pGip->u32TransactionId = 2;
4014	pGip->u64NanoTS = u64NanoTS;
4015	pGip->u64NanoTSLastUpdateHz = u64NanoTS;
4016	pGip->u64TSC = ASMReadTSC();
4017
4018	/*
4019	* We don't know the following values until we've executed updates.
4020	* So, we'll just insert very high values.
4021	*/
4022	pGip->u64CpuHz = _4G + 1;
4023	pGip->u32UpdateIntervalTSC = _2G / 4;
4024	pGip->au32TSCHistory[0] = _2G / 4;
4025	pGip->au32TSCHistory[1] = _2G / 4;
4026	pGip->au32TSCHistory[2] = _2G / 4;
4027	pGip->au32TSCHistory[3] = _2G / 4;
4028	pGip->au32TSCHistory[4] = _2G / 4;
4029	pGip->au32TSCHistory[5] = _2G / 4;
4030	pGip->au32TSCHistory[6] = _2G / 4;
4031	pGip->au32TSCHistory[7] = _2G / 4;
4032
4033	/*
4034	* Link it to the device extension.
4035	*/
4036	pDevExt->pGip = pGip;
4037	pDevExt->HCPhysGip = HCPhys;
4038	pDevExt->cGipUsers = 0;
4039
4040	return 0;
4041	}
4042
4043
4044	/**
4045	* Invalidates the GIP data upon termination.
4046	*
4047	* @param pGip Pointer to the read-write kernel mapping of the GIP.
4048	*/
4049	void VBOXCALL supdrvGipTerm(PSUPGLOBALINFOPAGE pGip)
4050	{
4051	pGip->iTSCHistoryHead = ~0;
4052	pGip->u64NanoTS = 0;
4053	pGip->u64TSC = 0;
4054	pGip->u32Magic = 0;
4055	pGip->iTSCHistoryHead = 0;
4056	}
4057
4058
4059	/**
4060	* Updates the GIP.
4061	*
4062	* @param pGip Pointer to the GIP.
4063	* @param u64NanoTS The current nanosecond timesamp.
4064	*/
4065	void VBOXCALL supdrvGipUpdate(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS)
4066	{
4067	uint64_t u64TSC;
4068	uint64_t u64TSCDelta;
4069	uint32_t u32UpdateIntervalTSC;
4070	uint32_t u32UpdateIntervalTSCSlack;
4071	unsigned iTSCHistoryHead;
4072	uint64_t u64CpuHz;
4073
4074	/*
4075	* Start update transaction.
4076	*/
4077	if (!(ASMAtomicIncU32(&pGip->u32TransactionId) & 1))
4078	{
4079	/* this can happen on win32 if we're taking to long and there are more CPUs around. shouldn't happen though. */
4080	AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGip->u32TransactionId));
4081	ASMAtomicIncU32(&pGip->u32TransactionId);
4082	pGip->cErrors++;
4083	return;
4084	}
4085
4086	ASMAtomicXchgU64(&pGip->u64NanoTS, u64NanoTS);
4087
4088	/*
4089	* Recalc the update frequency every 0x800th time.
4090	*/
4091	if (!(pGip->u32TransactionId & (GIP_UPDATEHZ_RECALC_FREQ * 2 - 2)))
4092	{
4093	if (pGip->u64NanoTSLastUpdateHz)
4094	{
4095	#ifdef __AMD64__ /** @todo fix 64-bit div here to work on x86 linux. */
4096	uint64_t u64Delta = u64NanoTS - pGip->u64NanoTSLastUpdateHz;
4097	uint32_t u32UpdateHz = (uint32_t)((UINT64_C(1000000000) * GIP_UPDATEHZ_RECALC_FREQ) / u64Delta);
4098	if (u32UpdateHz <= 2000 && u32UpdateHz >= 30)
4099	{
4100	ASMAtomicXchgU32(&pGip->u32UpdateHz, u32UpdateHz);
4101	ASMAtomicXchgU32(&pGip->u32UpdateIntervalNS, 1000000000 / u32UpdateHz);
4102	}
4103	#endif
4104	}
4105	ASMAtomicXchgU64(&pGip->u64NanoTSLastUpdateHz, u64NanoTS);
4106	}
4107
4108	/*
4109	* Calc TSC delta.
4110	*/
4111	/** @todo validate the NanoTS delta, don't trust the OS to call us when it should... */
4112	u64TSC = ASMReadTSC();
4113	u64TSCDelta = u64TSC - pGip->u64TSC;
4114	ASMAtomicXchgU64(&pGip->u64TSC, u64TSC);
4115
4116	if (u64TSCDelta >> 32)
4117	{
4118	u64TSCDelta = pGip->u32UpdateIntervalTSC;
4119	pGip->cErrors++;
4120	}
4121
4122	/*
4123	* TSC History.
4124	*/
4125	Assert(ELEMENTS(pGip->au32TSCHistory) == 8);
4126
4127	iTSCHistoryHead = (pGip->iTSCHistoryHead + 1) & 7;
4128	ASMAtomicXchgU32(&pGip->iTSCHistoryHead, iTSCHistoryHead);
4129	ASMAtomicXchgU32(&pGip->au32TSCHistory[iTSCHistoryHead], (uint32_t)u64TSCDelta);
4130
4131	/*
4132	* UpdateIntervalTSC = average of last 8,2,1 intervals depending on update HZ.
4133	*/
4134	if (pGip->u32UpdateHz >= 1000)
4135	{
4136	uint32_t u32;
4137	u32 = pGip->au32TSCHistory[0];
4138	u32 += pGip->au32TSCHistory[1];
4139	u32 += pGip->au32TSCHistory[2];
4140	u32 += pGip->au32TSCHistory[3];
4141	u32 >>= 2;
4142	u32UpdateIntervalTSC = pGip->au32TSCHistory[4];
4143	u32UpdateIntervalTSC += pGip->au32TSCHistory[5];
4144	u32UpdateIntervalTSC += pGip->au32TSCHistory[6];
4145	u32UpdateIntervalTSC += pGip->au32TSCHistory[7];
4146	u32UpdateIntervalTSC >>= 2;
4147	u32UpdateIntervalTSC += u32;
4148	u32UpdateIntervalTSC >>= 1;
4149
4150	/* Value choosen for a 2GHz Athlon64 running linux 2.6.10/11, . */
4151	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 14;
4152	}
4153	else if (pGip->u32UpdateHz >= 90)
4154	{
4155	u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
4156	u32UpdateIntervalTSC += pGip->au32TSCHistory[(iTSCHistoryHead - 1) & 7];
4157	u32UpdateIntervalTSC >>= 1;
4158
4159	/* value choosen on a 2GHz thinkpad running windows */
4160	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 7;
4161	}
4162	else
4163	{
4164	u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
4165
4166	/* This value hasn't be checked yet.. waiting for OS/2 and 33Hz timers.. :-) */
4167	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 6;
4168	}
4169	ASMAtomicXchgU32(&pGip->u32UpdateIntervalTSC, u32UpdateIntervalTSC + u32UpdateIntervalTSCSlack);
4170
4171	/*
4172	* CpuHz.
4173	*/
4174	u64CpuHz = ASMMult2xU32RetU64(u32UpdateIntervalTSC, pGip->u32UpdateHz);
4175	ASMAtomicXchgU64(&pGip->u64CpuHz, u64CpuHz);
4176
4177	/*
4178	* Complete transaction.
4179	*/
4180	ASMAtomicIncU32(&pGip->u32TransactionId);
4181	}
4182
4183
4184	#ifndef DEBUG /** @todo change #ifndef DEBUG -> #ifdef LOG_ENABLED */
4185	/**
4186	* Stub function for non-debug builds.
4187	*/
4188	RTDECL(PRTLOGGER) RTLogDefaultInstance(void)
4189	{
4190	return NULL;
4191	}
4192
4193	RTDECL(PRTLOGGER) RTLogRelDefaultInstance(void)
4194	{
4195	return NULL;
4196	}
4197
4198	/**
4199	* Stub function for non-debug builds.
4200	*/
4201	RTDECL(int) RTLogSetDefaultInstanceThread(PRTLOGGER pLogger, uintptr_t uKey)
4202	{
4203	return 0;
4204	}
4205
4206	/**
4207	* Stub function for non-debug builds.
4208	*/
4209	RTDECL(void) RTLogLogger(PRTLOGGER pLogger, void pvCallerRet, const char pszFormat, ...)
4210	{
4211	}
4212
4213	/**
4214	* Stub function for non-debug builds.
4215	*/
4216	RTDECL(void) RTLogLoggerEx(PRTLOGGER pLogger, unsigned fFlags, unsigned iGroup, const char *pszFormat, ...)
4217	{
4218	}
4219
4220	/**
4221	* Stub function for non-debug builds.
4222	*/
4223	RTDECL(void) RTLogLoggerExV(PRTLOGGER pLogger, unsigned fFlags, unsigned iGroup, const char *pszFormat, va_list args)
4224	{
4225	}
4226	#endif /* !DEBUG */
4227

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPDRVShared.c@ 1003

Download in other formats: