SUPDRVShared.c@ 706

Last change on this file since 706 was 679, checked in by vboxsync, 18 years ago
WIN32 / WIN64.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 138.4 KB

Line
1	/** @file
2	*
3	* VBox host drivers - Ring-0 support drivers - Shared code:
4	* Driver code for all host platforms
5	*/
6
7	/*
8	* Copyright (C) 2006 InnoTek Systemberatung GmbH
9	*
10	* This file is part of VirtualBox Open Source Edition (OSE), as
11	* available from http://www.virtualbox.org. This file is free software;
12	* you can redistribute it and/or modify it under the terms of the GNU
13	* General Public License as published by the Free Software Foundation,
14	* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
15	* distribution. VirtualBox OSE is distributed in the hope that it will
16	* be useful, but WITHOUT ANY WARRANTY of any kind.
17	*
18	* If you received this file as part of a commercial VirtualBox
19	* distribution, then only the terms of your commercial VirtualBox
20	* license agreement apply instead of the previous paragraph.
21	*/
22
23
24	/*******************************************************************************
25	* Header Files *
26	*******************************************************************************/
27	#include "SUPDRV.h"
28	#ifndef PAGE_SHIFT
29	# include <iprt/param.h>
30	#endif
31	#include <iprt/alloc.h>
32	#include <iprt/semaphore.h>
33	#include <iprt/spinlock.h>
34	#include <iprt/thread.h>
35	#include <iprt/process.h>
36	#include <iprt/log.h>
37	#ifdef VBOX_WITHOUT_IDT_PATCHING
38	# include <VBox/vmm.h>
39	#endif
40
41
42	/*******************************************************************************
43	* Defined Constants And Macros *
44	*******************************************************************************/
45	/* from x86.h - clashes with linux thus this duplication */
46	#undef X86_CR0_PG
47	#define X86_CR0_PG BIT(31)
48	#undef X86_CR0_PE
49	#define X86_CR0_PE BIT(0)
50	#undef X86_CPUID_AMD_FEATURE_EDX_NX
51	#define X86_CPUID_AMD_FEATURE_EDX_NX BIT(20)
52	#undef MSR_K6_EFER
53	#define MSR_K6_EFER 0xc0000080
54	#undef MSR_K6_EFER_NXE
55	#define MSR_K6_EFER_NXE BIT(11)
56	#undef MSR_K6_EFER_LMA
57	#define MSR_K6_EFER_LMA BIT(10)
58	#undef X86_CR4_PGE
59	#define X86_CR4_PGE BIT(7)
60	#undef X86_CR4_PAE
61	#define X86_CR4_PAE BIT(5)
62	#undef X86_CPUID_AMD_FEATURE_EDX_LONG_MODE
63	#define X86_CPUID_AMD_FEATURE_EDX_LONG_MODE BIT(29)
64
65
66	/** The frequency by which we recalculate the u32UpdateHz and
67	* u32UpdateIntervalNS GIP members. The value must be a power of 2. */
68	#define GIP_UPDATEHZ_RECALC_FREQ 0x800
69
70
71	/*******************************************************************************
72	* Global Variables *
73	*******************************************************************************/
74	/**
75	* Array of the R0 SUP API.
76	*/
77	static SUPFUNC g_aFunctions[] =
78	{
79	/* name function */
80	{ "SUPR0ObjRegister", (void *)SUPR0ObjRegister },
81	{ "SUPR0ObjAddRef", (void *)SUPR0ObjAddRef },
82	{ "SUPR0ObjRelease", (void *)SUPR0ObjRelease },
83	{ "SUPR0ObjVerifyAccess", (void *)SUPR0ObjVerifyAccess },
84	{ "SUPR0LockMem", (void *)SUPR0LockMem },
85	{ "SUPR0UnlockMem", (void *)SUPR0UnlockMem },
86	{ "SUPR0ContAlloc", (void *)SUPR0ContAlloc },
87	{ "SUPR0ContFree", (void *)SUPR0ContFree },
88	{ "SUPR0MemAlloc", (void *)SUPR0MemAlloc },
89	{ "SUPR0MemGetPhys", (void *)SUPR0MemGetPhys },
90	{ "SUPR0MemFree", (void *)SUPR0MemFree },
91	{ "SUPR0Printf", (void *)SUPR0Printf },
92	{ "RTMemAlloc", (void *)RTMemAlloc },
93	{ "RTMemAllocZ", (void *)RTMemAllocZ },
94	{ "RTMemFree", (void *)RTMemFree },
95	/* These doesn't work yet on linux - use fast mutexes!
96	{ "RTSemMutexCreate", (void *)RTSemMutexCreate },
97	{ "RTSemMutexRequest", (void *)RTSemMutexRequest },
98	{ "RTSemMutexRelease", (void *)RTSemMutexRelease },
99	{ "RTSemMutexDestroy", (void *)RTSemMutexDestroy },
100	*/
101	{ "RTSemFastMutexCreate", (void *)RTSemFastMutexCreate },
102	{ "RTSemFastMutexDestroy", (void *)RTSemFastMutexDestroy },
103	{ "RTSemFastMutexRequest", (void *)RTSemFastMutexRequest },
104	{ "RTSemFastMutexRelease", (void *)RTSemFastMutexRelease },
105	{ "RTSemEventCreate", (void *)RTSemEventCreate },
106	{ "RTSemEventSignal", (void *)RTSemEventSignal },
107	{ "RTSemEventWait", (void *)RTSemEventWait },
108	{ "RTSemEventDestroy", (void *)RTSemEventDestroy },
109	{ "RTSpinlockCreate", (void *)RTSpinlockCreate },
110	{ "RTSpinlockDestroy", (void *)RTSpinlockDestroy },
111	{ "RTSpinlockAcquire", (void *)RTSpinlockAcquire },
112	{ "RTSpinlockRelease", (void *)RTSpinlockRelease },
113	{ "RTSpinlockAcquireNoInts", (void *)RTSpinlockAcquireNoInts },
114	{ "RTSpinlockReleaseNoInts", (void *)RTSpinlockReleaseNoInts },
115	{ "RTThreadNativeSelf", (void *)RTThreadNativeSelf },
116	{ "RTThreadSleep", (void *)RTThreadSleep },
117	{ "RTThreadYield", (void *)RTThreadYield },
118	#if 0 /* Thread APIs, Part 2. */
119	{ "RTThreadSelf", (void *)RTThreadSelf },
120	{ "RTThreadCreate", (void *)RTThreadCreate },
121	{ "RTThreadGetNative", (void *)RTThreadGetNative },
122	{ "RTThreadWait", (void *)RTThreadWait },
123	{ "RTThreadWaitNoResume", (void *)RTThreadWaitNoResume },
124	{ "RTThreadGetName", (void *)RTThreadGetName },
125	{ "RTThreadSelfName", (void *)RTThreadSelfName },
126	{ "RTThreadGetType", (void *)RTThreadGetType },
127	{ "RTThreadUserSignal", (void *)RTThreadUserSignal },
128	{ "RTThreadUserReset", (void *)RTThreadUserReset },
129	{ "RTThreadUserWait", (void *)RTThreadUserWait },
130	{ "RTThreadUserWaitNoResume", (void *)RTThreadUserWaitNoResume },
131	#endif
132	{ "RTLogDefaultInstance", (void *)RTLogDefaultInstance },
133	{ "RTLogRelDefaultInstance", (void *)RTLogRelDefaultInstance },
134	{ "RTLogSetDefaultInstanceThread", (void *)RTLogSetDefaultInstanceThread },
135	{ "RTLogLogger", (void *)RTLogLogger },
136	{ "RTLogLoggerEx", (void *)RTLogLoggerEx },
137	{ "RTLogLoggerExV", (void *)RTLogLoggerExV },
138	{ "AssertMsg1", (void *)AssertMsg1 },
139	{ "AssertMsg2", (void *)AssertMsg2 },
140	};
141
142
143	/*******************************************************************************
144	* Internal Functions *
145	*******************************************************************************/
146	__BEGIN_DECLS
147	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession);
148	static int supdrvMemRelease(PSUPDRVSESSION pSession, void *pv, SUPDRVMEMREFTYPE eType);
149	#ifndef VBOX_WITHOUT_IDT_PATCHING
150	static int supdrvIOCtl_IdtInstall(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPIDTINSTALL_IN pIn, PSUPIDTINSTALL_OUT pOut);
151	static PSUPDRVPATCH supdrvIdtPatchOne(PSUPDRVDEVEXT pDevExt, PSUPDRVPATCH pPatch);
152	static int supdrvIOCtl_IdtRemoveAll(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession);
153	static void supdrvIdtRemoveOne(PSUPDRVDEVEXT pDevExt, PSUPDRVPATCH pPatch);
154	static void supdrvIdtWrite(volatile void pvIdtEntry, const SUPDRVIDTE pNewIDTEntry);
155	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
156	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN_IN pIn, PSUPLDROPEN_OUT pOut);
157	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD_IN pIn);
158	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE_IN pIn);
159	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL_IN pIn, PSUPLDRGETSYMBOL_OUT pOut);
160	static int supdrvLdrSetR0EP(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0Entry);
161	static void supdrvLdrUnsetR0EP(PSUPDRVDEVEXT pDevExt);
162	static void supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage);
163	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage);
164	static int supdrvIOCtl_GetPagingMode(PSUPGETPAGINGMODE_OUT pOut);
165	#ifdef USE_NEW_OS_INTERFACE
166	static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt);
167	static int supdrvGipDestroy(PSUPDRVDEVEXT pDevExt);
168	static DECLCALLBACK(void) supdrvGipTimer(PRTTIMER pTimer, void *pvUser);
169	#endif
170
171	__END_DECLS
172
173
174	/**
175	* Initializes the device extentsion structure.
176	*
177	* @returns 0 on success.
178	* @returns SUPDRV_ERR_ on failure.
179	* @param pDevExt The device extension to initialize.
180	*/
181	int VBOXCALL supdrvInitDevExt(PSUPDRVDEVEXT pDevExt)
182	{
183	/*
184	* Initialize it.
185	*/
186	int rc;
187	memset(pDevExt, 0, sizeof(*pDevExt));
188	rc = RTSpinlockCreate(&pDevExt->Spinlock);
189	if (!rc)
190	{
191	rc = RTSemFastMutexCreate(&pDevExt->mtxLdr);
192	if (!rc)
193	{
194	rc = RTSemFastMutexCreate(&pDevExt->mtxGip);
195	if (!rc)
196	{
197	#ifdef USE_NEW_OS_INTERFACE
198	rc = supdrvGipCreate(pDevExt);
199	if (RT_SUCCESS(rc))
200	{
201	pDevExt->u32Cookie = BIRD;
202	return 0;
203	}
204	#else
205	pDevExt->u32Cookie = BIRD;
206	return 0;
207	#endif
208	}
209	RTSemFastMutexDestroy(pDevExt->mtxLdr);
210	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
211	}
212	RTSpinlockDestroy(pDevExt->Spinlock);
213	pDevExt->Spinlock = NIL_RTSPINLOCK;
214	}
215	return rc;
216	}
217
218	/**
219	* Delete the device extension (e.g. cleanup members).
220	*
221	* @returns 0.
222	* @param pDevExt The device extension to delete.
223	*/
224	int VBOXCALL supdrvDeleteDevExt(PSUPDRVDEVEXT pDevExt)
225	{
226	#ifndef VBOX_WITHOUT_IDT_PATCHING
227	PSUPDRVPATCH pPatch;
228	#endif
229	PSUPDRVOBJ pObj;
230	PSUPDRVUSAGE pUsage;
231
232	/*
233	* Kill mutexes and spinlocks.
234	*/
235	RTSemFastMutexDestroy(pDevExt->mtxGip);
236	pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
237	RTSemFastMutexDestroy(pDevExt->mtxLdr);
238	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
239	RTSpinlockDestroy(pDevExt->Spinlock);
240	pDevExt->Spinlock = NIL_RTSPINLOCK;
241
242	/*
243	* Free lists.
244	*/
245
246	#ifndef VBOX_WITHOUT_IDT_PATCHING
247	/* patches */
248	/** @todo make sure we don't uninstall patches which has been patched by someone else. */
249	pPatch = pDevExt->pIdtPatchesFree;
250	pDevExt->pIdtPatchesFree = NULL;
251	while (pPatch)
252	{
253	void *pvFree = pPatch;
254	pPatch = pPatch->pNext;
255	RTMemExecFree(pvFree);
256	}
257	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
258
259	/* objects. */
260	pObj = pDevExt->pObjs;
261	#if !defined(DEBUG_bird) \|\| !defined(__LINUX__) /* breaks unloading, temporary, remove me! */
262	Assert(!pObj); /* (can trigger on forced unloads) */
263	#endif
264	pDevExt->pObjs = NULL;
265	while (pObj)
266	{
267	void *pvFree = pObj;
268	pObj = pObj->pNext;
269	RTMemFree(pvFree);
270	}
271
272	/* usage records. */
273	pUsage = pDevExt->pUsageFree;
274	pDevExt->pUsageFree = NULL;
275	while (pUsage)
276	{
277	void *pvFree = pUsage;
278	pUsage = pUsage->pNext;
279	RTMemFree(pvFree);
280	}
281
282	#ifdef USE_NEW_OS_INTERFACE
283	/* kill the GIP */
284	supdrvGipDestroy(pDevExt);
285	#endif
286
287	return 0;
288	}
289
290
291	/**
292	* Create session.
293	*
294	* @returns 0 on success.
295	* @returns SUPDRV_ERR_ on failure.
296	* @param pDevExt Device extension.
297	* @param ppSession Where to store the pointer to the session data.
298	*/
299	int VBOXCALL supdrvCreateSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION *ppSession)
300	{
301	/*
302	* Allocate memory for the session data.
303	*/
304	int rc = SUPDRV_ERR_NO_MEMORY;
305	PSUPDRVSESSION pSession = ppSession = (PSUPDRVSESSION)RTMemAllocZ(sizeof(pSession));
306	if (pSession)
307	{
308	/* Initialize session data. */
309	rc = RTSpinlockCreate(&pSession->Spinlock);
310	if (!rc)
311	{
312	Assert(pSession->Spinlock != NIL_RTSPINLOCK);
313	pSession->pDevExt = pDevExt;
314	pSession->u32Cookie = BIRD_INV;
315	//pSession->pLdrUsage = NULL;
316	//pSession->pPatchUsage = NULL;
317	//pSession->pUsage = NULL;
318	//pSession->pGip = NULL;
319	//pSession->fGipReferenced = false;
320	//pSession->Bundle.cUsed = 0
321
322	dprintf(("Created session %p initial cookie=%#x\n", pSession, pSession->u32Cookie));
323	return 0;
324	}
325
326	RTMemFree(pSession);
327	*ppSession = NULL;
328	}
329
330	dprintf(("Failed to create spinlock, rc=%d!\n", rc));
331	return rc;
332	}
333
334
335	/**
336	* Shared code for cleaning up a session.
337	*
338	* @param pDevExt Device extension.
339	* @param pSession Session data.
340	* This data will be freed by this routine.
341	*/
342	void VBOXCALL supdrvCloseSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
343	{
344	/*
345	* Cleanup the session first.
346	*/
347	supdrvCleanupSession(pDevExt, pSession);
348
349	/*
350	* Free the rest of the session stuff.
351	*/
352	RTSpinlockDestroy(pSession->Spinlock);
353	pSession->Spinlock = NIL_RTSPINLOCK;
354	pSession->pDevExt = NULL;
355	RTMemFree(pSession);
356	dprintf2(("supdrvCloseSession: returns\n"));
357	}
358
359
360	/**
361	* Shared code for cleaning up a session (but not quite freeing it).
362	*
363	* This is primarily intended for MAC OS X where we have to clean up the memory
364	* stuff before the file handle is closed.
365	*
366	* @param pDevExt Device extension.
367	* @param pSession Session data.
368	* This data will be freed by this routine.
369	*/
370	void VBOXCALL supdrvCleanupSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
371	{
372	PSUPDRVBUNDLE pBundle;
373	dprintf(("supdrvCleanupSession: pSession=%p\n", pSession));
374
375	/*
376	* Remove logger instances related to this session.
377	* (This assumes the dprintf and dprintf2 macros doesn't use the normal logging.)
378	*/
379	RTLogSetDefaultInstanceThread(NULL, (uintptr_t)pSession);
380
381	#ifndef VBOX_WITHOUT_IDT_PATCHING
382	/*
383	* Uninstall any IDT patches installed for this session.
384	*/
385	supdrvIOCtl_IdtRemoveAll(pDevExt, pSession);
386	#endif
387
388	/*
389	* Release object references made in this session.
390	* In theory there should be noone racing us in this session.
391	*/
392	dprintf2(("release objects - start\n"));
393	if (pSession->pUsage)
394	{
395	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
396	PSUPDRVUSAGE pUsage;
397	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
398
399	while ((pUsage = pSession->pUsage) != NULL)
400	{
401	PSUPDRVOBJ pObj = pUsage->pObj;
402	pSession->pUsage = pUsage->pNext;
403
404	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
405	if (pUsage->cUsage < pObj->cUsage)
406	{
407	pObj->cUsage -= pUsage->cUsage;
408	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
409	}
410	else
411	{
412	/* Destroy the object and free the record. */
413	if (pDevExt->pObjs == pObj)
414	pDevExt->pObjs = pObj->pNext;
415	else
416	{
417	PSUPDRVOBJ pObjPrev;
418	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
419	if (pObjPrev->pNext == pObj)
420	{
421	pObjPrev->pNext = pObj->pNext;
422	break;
423	}
424	Assert(pObjPrev);
425	}
426	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
427
428	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
429	RTMemFree(pObj);
430	}
431
432	/* free it and continue. */
433	RTMemFree(pUsage);
434
435	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
436	}
437
438	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
439	AssertMsg(!pSession->pUsage, ("Some buster reregistered an object during desturction!\n"));
440	}
441	dprintf2(("release objects - done\n"));
442
443	/*
444	* Release memory allocated in the session.
445	*
446	* We do not serialize this as we assume that the application will
447	* not allocated memory while closing the file handle object.
448	*/
449	dprintf2(("freeing memory:\n"));
450	pBundle = &pSession->Bundle;
451	while (pBundle)
452	{
453	PSUPDRVBUNDLE pToFree;
454	unsigned i;
455
456	/*
457	* Check and unlock all entries in the bundle.
458	*/
459	for (i = 0; i < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]); i++)
460	{
461	#ifdef USE_NEW_OS_INTERFACE
462	if (pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ)
463	{
464	int rc;
465	if (pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ)
466	{
467	rc = RTR0MemObjFree(pBundle->aMem[i].MapObjR3, false);
468	AssertRC(rc); /** @todo figure out how to handle this. */
469	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
470	}
471	rc = RTR0MemObjFree(pBundle->aMem[i].MemObj, false);
472	AssertRC(rc); /** @todo figure out how to handle this. */
473	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
474	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
475	}
476
477	#else /* !USE_NEW_OS_INTERFACE */
478	if ( pBundle->aMem[i].pvR0
479	\|\| pBundle->aMem[i].pvR3)
480	{
481	dprintf2(("eType=%d pvR0=%p pvR3=%p cb=%d\n", pBundle->aMem[i].eType,
482	pBundle->aMem[i].pvR0, pBundle->aMem[i].pvR3, pBundle->aMem[i].cb));
483	switch (pBundle->aMem[i].eType)
484	{
485	case MEMREF_TYPE_LOCKED:
486	supdrvOSUnlockMemOne(&pBundle->aMem[i]);
487	break;
488	case MEMREF_TYPE_CONT:
489	supdrvOSContFreeOne(&pBundle->aMem[i]);
490	break;
491	case MEMREF_TYPE_LOW:
492	supdrvOSLowFreeOne(&pBundle->aMem[i]);
493	break;
494	case MEMREF_TYPE_MEM:
495	supdrvOSMemFreeOne(&pBundle->aMem[i]);
496	break;
497	default:
498	break;
499	}
500	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
501	}
502	#endif /* !USE_NEW_OS_INTERFACE */
503	}
504
505	/*
506	* Advance and free previous bundle.
507	*/
508	pToFree = pBundle;
509	pBundle = pBundle->pNext;
510
511	pToFree->pNext = NULL;
512	pToFree->cUsed = 0;
513	if (pToFree != &pSession->Bundle)
514	RTMemFree(pToFree);
515	}
516	dprintf2(("freeing memory - done\n"));
517
518	/*
519	* Loaded images needs to be dereferenced and possibly freed up.
520	*/
521	RTSemFastMutexRequest(pDevExt->mtxLdr);
522	dprintf2(("freeing images:\n"));
523	if (pSession->pLdrUsage)
524	{
525	PSUPDRVLDRUSAGE pUsage = pSession->pLdrUsage;
526	pSession->pLdrUsage = NULL;
527	while (pUsage)
528	{
529	void *pvFree = pUsage;
530	PSUPDRVLDRIMAGE pImage = pUsage->pImage;
531	if (pImage->cUsage > pUsage->cUsage)
532	pImage->cUsage -= pUsage->cUsage;
533	else
534	supdrvLdrFree(pDevExt, pImage);
535	pUsage->pImage = NULL;
536	pUsage = pUsage->pNext;
537	RTMemFree(pvFree);
538	}
539	}
540	RTSemFastMutexRelease(pDevExt->mtxLdr);
541	dprintf2(("freeing images - done\n"));
542
543	/*
544	* Unmap the GIP.
545	*/
546	dprintf2(("umapping GIP:\n"));
547	#ifdef USE_NEW_OS_INTERFACE
548	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
549	#else
550	if (pSession->pGip)
551	#endif
552	{
553	SUPR0GipUnmap(pSession);
554	#ifndef USE_NEW_OS_INTERFACE
555	pSession->pGip = NULL;
556	#endif
557	pSession->fGipReferenced = 0;
558	}
559	dprintf2(("umapping GIP - done\n"));
560	}
561
562
563	#ifdef VBOX_WITHOUT_IDT_PATCHING
564	/**
565	* Fast path I/O Control worker.
566	*
567	* @returns 0 on success.
568	* @returns One of the SUPDRV_ERR_* on failure.
569	* @param uIOCtl Function number.
570	* @param pDevExt Device extention.
571	* @param pSession Session data.
572	*/
573	int VBOXCALL supdrvIOCtlFast(unsigned uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
574	{
575	/*
576	* Disable interrupts before invoking VMMR0Entry() because it ASSUMES
577	* that interrupts are disabled. (We check the two prereqs after doing
578	* this only to allow the compiler to optimize things better.)
579	*/
580	RTCCUINTREG uFlags = ASMGetFlags();
581	ASMIntDisable();
582
583	int rc;
584	if (RT_LIKELY(pSession->pVM && pDevExt->pfnVMMR0Entry))
585	{
586	switch (uIOCtl)
587	{
588	case SUP_IOCTL_FAST_DO_RAW_RUN:
589	rc = pDevExt->pfnVMMR0Entry(pSession->pVM, VMMR0_DO_RAW_RUN, NULL);
590	break;
591	case SUP_IOCTL_FAST_DO_HWACC_RUN:
592	rc = pDevExt->pfnVMMR0Entry(pSession->pVM, VMMR0_DO_HWACC_RUN, NULL);
593	break;
594	case SUP_IOCTL_FAST_DO_NOP:
595	rc = pDevExt->pfnVMMR0Entry(pSession->pVM, VMMR0_DO_NOP, NULL);
596	break;
597	default:
598	rc = VERR_INTERNAL_ERROR;
599	break;
600	}
601	}
602	else
603	rc = VERR_INTERNAL_ERROR;
604
605	ASMSetFlags(uFlags);
606	return rc;
607	}
608	#endif /* VBOX_WITHOUT_IDT_PATCHING */
609
610
611	/**
612	* I/O Control worker.
613	*
614	* @returns 0 on success.
615	* @returns One of the SUPDRV_ERR_* on failure.
616	* @param uIOCtl Function number.
617	* @param pDevExt Device extention.
618	* @param pSession Session data.
619	* @param pvIn Input data.
620	* @param cbIn Size of input data.
621	* @param pvOut Output data.
622	* IMPORTANT! This buffer may be shared with the input
623	* data, thus no writing before done reading
624	* input data!!!
625	* @param cbOut Size of output data.
626	* @param pcbReturned Size of the returned data.
627	*/
628	int VBOXCALL supdrvIOCtl(unsigned int uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession,
629	void pvIn, unsigned cbIn, void pvOut, unsigned cbOut, unsigned *pcbReturned)
630	{
631	*pcbReturned = 0;
632	switch (uIOCtl)
633	{
634	case SUP_IOCTL_COOKIE:
635	{
636	PSUPCOOKIE_IN pIn = (PSUPCOOKIE_IN)pvIn;
637	PSUPCOOKIE_OUT pOut = (PSUPCOOKIE_OUT)pvOut;
638
639	/*
640	* Validate.
641	*/
642	if ( cbIn != sizeof(*pIn)
643	\|\| cbOut != sizeof(*pOut))
644	{
645	dprintf(("SUP_IOCTL_COOKIE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
646	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
647	return SUPDRV_ERR_INVALID_PARAM;
648	}
649	if (strncmp(pIn->szMagic, SUPCOOKIE_MAGIC, sizeof(pIn->szMagic)))
650	{
651	dprintf(("SUP_IOCTL_COOKIE: invalid magic %.16s\n", pIn->szMagic));
652	return SUPDRV_ERR_INVALID_MAGIC;
653	}
654	if (pIn->u32Version != SUPDRVIOC_VERSION)
655	{
656	dprintf(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Current: %#x\n", pIn->u32Version, SUPDRVIOC_VERSION));
657	return SUPDRV_ERR_VERSION_MISMATCH;
658	}
659
660	/*
661	* Fill in return data and be gone.
662	*/
663	/** @todo secure cookie negotiation? */
664	pOut->u32Cookie = pDevExt->u32Cookie;
665	pOut->u32SessionCookie = pSession->u32Cookie;
666	pOut->u32Version = SUPDRVIOC_VERSION;
667	pOut->pSession = pSession;
668	pOut->cFunctions = sizeof(g_aFunctions) / sizeof(g_aFunctions[0]);
669	pcbReturned = sizeof(pOut);
670	return 0;
671	}
672
673
674	case SUP_IOCTL_QUERY_FUNCS:
675	{
676	unsigned cFunctions;
677	PSUPQUERYFUNCS_IN pIn = (PSUPQUERYFUNCS_IN)pvIn;
678	PSUPQUERYFUNCS_OUT pOut = (PSUPQUERYFUNCS_OUT)pvOut;
679
680	/*
681	* Validate.
682	*/
683	if ( cbIn != sizeof(*pIn)
684	\|\| cbOut < sizeof(*pOut))
685	{
686	dprintf(("SUP_IOCTL_QUERY_FUNCS: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
687	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
688	return SUPDRV_ERR_INVALID_PARAM;
689	}
690	if ( pIn->u32Cookie != pDevExt->u32Cookie
691	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
692	{
693	dprintf(("SUP_IOCTL_QUERY_FUNCS: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
694	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
695	return SUPDRV_ERR_INVALID_MAGIC;
696	}
697
698	/*
699	* Copy the functions.
700	*/
701	cFunctions = (cbOut - RT_OFFSETOF(SUPQUERYFUNCS_OUT, aFunctions)) / sizeof(pOut->aFunctions[0]);
702	cFunctions = RT_MIN(cFunctions, ELEMENTS(g_aFunctions));
703	AssertMsg(cFunctions == ELEMENTS(g_aFunctions),
704	("Why aren't R3 querying all the functions!?! cFunctions=%d while there are %d available\n",
705	cFunctions, ELEMENTS(g_aFunctions)));
706	pOut->cFunctions = cFunctions;
707	memcpy(&pOut->aFunctions[0], g_aFunctions, sizeof(pOut->aFunctions[0]) * cFunctions);
708	*pcbReturned = RT_OFFSETOF(SUPQUERYFUNCS_OUT, aFunctions[cFunctions]);
709	return 0;
710	}
711
712
713	case SUP_IOCTL_IDT_INSTALL:
714	{
715	PSUPIDTINSTALL_IN pIn = (PSUPIDTINSTALL_IN)pvIn;
716	PSUPIDTINSTALL_OUT pOut = (PSUPIDTINSTALL_OUT)pvOut;
717
718	/*
719	* Validate.
720	*/
721	if ( cbIn != sizeof(*pIn)
722	\|\| cbOut != sizeof(*pOut))
723	{
724	dprintf(("SUP_IOCTL_INSTALL: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
725	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
726	return SUPDRV_ERR_INVALID_PARAM;
727	}
728	if ( pIn->u32Cookie != pDevExt->u32Cookie
729	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
730	{
731	dprintf(("SUP_IOCTL_INSTALL: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
732	pIn->u32Cookie, pDevExt->u32Cookie,
733	pIn->u32SessionCookie, pSession->u32Cookie));
734	return SUPDRV_ERR_INVALID_MAGIC;
735	}
736
737	pcbReturned = sizeof(pOut);
738	#ifndef VBOX_WITHOUT_IDT_PATCHING
739	return supdrvIOCtl_IdtInstall(pDevExt, pSession, pIn, pOut);
740	#else
741	pOut->u8Idt = 3;
742	return 0;
743	#endif
744	}
745
746
747	case SUP_IOCTL_IDT_REMOVE:
748	{
749	PSUPIDTREMOVE_IN pIn = (PSUPIDTREMOVE_IN)pvIn;
750
751	/*
752	* Validate.
753	*/
754	if ( cbIn != sizeof(*pIn)
755	\|\| cbOut != 0)
756	{
757	dprintf(("SUP_IOCTL_REMOVE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
758	cbIn, sizeof(*pIn), cbOut, 0));
759	return SUPDRV_ERR_INVALID_PARAM;
760	}
761	if ( pIn->u32Cookie != pDevExt->u32Cookie
762	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
763	{
764	dprintf(("SUP_IOCTL_REMOVE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
765	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
766	return SUPDRV_ERR_INVALID_MAGIC;
767	}
768
769	#ifndef VBOX_WITHOUT_IDT_PATCHING
770	return supdrvIOCtl_IdtRemoveAll(pDevExt, pSession);
771	#else
772	return 0;
773	#endif
774	}
775
776
777	case SUP_IOCTL_PINPAGES:
778	{
779	int rc;
780	PSUPPINPAGES_IN pIn = (PSUPPINPAGES_IN)pvIn;
781	PSUPPINPAGES_OUT pOut = (PSUPPINPAGES_OUT)pvOut;
782
783	/*
784	* Validate.
785	*/
786	if ( cbIn != sizeof(*pIn)
787	\|\| cbOut < sizeof(*pOut))
788	{
789	dprintf(("SUP_IOCTL_PINPAGES: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
790	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
791	return SUPDRV_ERR_INVALID_PARAM;
792	}
793	if ( pIn->u32Cookie != pDevExt->u32Cookie
794	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
795	{
796	dprintf(("SUP_IOCTL_PINPAGES: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
797	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
798	return SUPDRV_ERR_INVALID_MAGIC;
799	}
800	if (pIn->cb <= 0 \|\| !pIn->pv)
801	{
802	dprintf(("SUP_IOCTL_PINPAGES: Illegal request %p %d\n", pIn->pv, pIn->cb));
803	return SUPDRV_ERR_INVALID_PARAM;
804	}
805	if ((unsigned)RT_OFFSETOF(SUPPINPAGES_OUT, aPages[pIn->cb >> PAGE_SHIFT]) > cbOut)
806	{
807	dprintf(("SUP_IOCTL_PINPAGES: Output buffer is too small! %d required %d passed in.\n",
808	RT_OFFSETOF(SUPPINPAGES_OUT, aPages[pIn->cb >> PAGE_SHIFT]), cbOut));
809	return SUPDRV_ERR_INVALID_PARAM;
810	}
811
812	/*
813	* Execute.
814	*/
815	*pcbReturned = RT_OFFSETOF(SUPPINPAGES_OUT, aPages[pIn->cb >> PAGE_SHIFT]);
816	rc = SUPR0LockMem(pSession, pIn->pv, pIn->cb, &pOut->aPages[0]);
817	if (rc)
818	*pcbReturned = 0;
819	return rc;
820	}
821
822
823	case SUP_IOCTL_UNPINPAGES:
824	{
825	PSUPUNPINPAGES_IN pIn = (PSUPUNPINPAGES_IN)pvIn;
826
827	/*
828	* Validate.
829	*/
830	if ( cbIn != sizeof(*pIn)
831	\|\| cbOut != 0)
832	{
833	dprintf(("SUP_IOCTL_UNPINPAGES: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
834	cbIn, sizeof(*pIn), cbOut, 0));
835	return SUPDRV_ERR_INVALID_PARAM;
836	}
837	if ( pIn->u32Cookie != pDevExt->u32Cookie
838	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
839	{
840	dprintf(("SUP_IOCTL_UNPINPAGES: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
841	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
842	return SUPDRV_ERR_INVALID_MAGIC;
843	}
844
845	/*
846	* Execute.
847	*/
848	return SUPR0UnlockMem(pSession, pIn->pv);
849	}
850
851	case SUP_IOCTL_CONT_ALLOC:
852	{
853	int rc;
854	PSUPCONTALLOC_IN pIn = (PSUPCONTALLOC_IN)pvIn;
855	PSUPCONTALLOC_OUT pOut = (PSUPCONTALLOC_OUT)pvOut;
856
857	/*
858	* Validate.
859	*/
860	if ( cbIn != sizeof(*pIn)
861	\|\| cbOut < sizeof(*pOut))
862	{
863	dprintf(("SUP_IOCTL_CONT_ALLOC: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
864	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
865	return SUPDRV_ERR_INVALID_PARAM;
866	}
867	if ( pIn->u32Cookie != pDevExt->u32Cookie
868	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
869	{
870	dprintf(("SUP_IOCTL_CONT_ALLOC: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
871	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
872	return SUPDRV_ERR_INVALID_MAGIC;
873	}
874
875	/*
876	* Execute.
877	*/
878	rc = SUPR0ContAlloc(pSession, pIn->cb, &pOut->pvR0, &pOut->pvR3, &pOut->HCPhys);
879	if (!rc)
880	pcbReturned = sizeof(pOut);
881	return rc;
882	}
883
884
885	case SUP_IOCTL_CONT_FREE:
886	{
887	PSUPCONTFREE_IN pIn = (PSUPCONTFREE_IN)pvIn;
888
889	/*
890	* Validate.
891	*/
892	if ( cbIn != sizeof(*pIn)
893	\|\| cbOut != 0)
894	{
895	dprintf(("SUP_IOCTL_CONT_FREE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
896	cbIn, sizeof(*pIn), cbOut, 0));
897	return SUPDRV_ERR_INVALID_PARAM;
898	}
899	if ( pIn->u32Cookie != pDevExt->u32Cookie
900	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
901	{
902	dprintf(("SUP_IOCTL_CONT_FREE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
903	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
904	return SUPDRV_ERR_INVALID_MAGIC;
905	}
906
907	/*
908	* Execute.
909	*/
910	return SUPR0ContFree(pSession, pIn->pv);
911	}
912
913
914	case SUP_IOCTL_LDR_OPEN:
915	{
916	PSUPLDROPEN_IN pIn = (PSUPLDROPEN_IN)pvIn;
917	PSUPLDROPEN_OUT pOut = (PSUPLDROPEN_OUT)pvOut;
918
919	/*
920	* Validate.
921	*/
922	if ( cbIn != sizeof(*pIn)
923	\|\| cbOut != sizeof(*pOut))
924	{
925	dprintf(("SUP_IOCTL_LDR_OPEN: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
926	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
927	return SUPDRV_ERR_INVALID_PARAM;
928	}
929	if ( pIn->u32Cookie != pDevExt->u32Cookie
930	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
931	{
932	dprintf(("SUP_IOCTL_LDR_OPEN: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
933	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
934	return SUPDRV_ERR_INVALID_MAGIC;
935	}
936	if ( pIn->cbImage <= 0
937	\|\| pIn->cbImage >= 1610241024 /16MB/)
938	{
939	dprintf(("SUP_IOCTL_LDR_OPEN: Invalid size %d. (max is 16MB)\n", pIn->cbImage));
940	return SUPDRV_ERR_INVALID_PARAM;
941	}
942	if (!memchr(pIn->szName, '\0', sizeof(pIn->szName)))
943	{
944	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: The image name isn't terminated!\n"));
945	return SUPDRV_ERR_INVALID_PARAM;
946	}
947	if (!pIn->szName[0])
948	{
949	dprintf(("SUP_IOCTL_LDR_OPEN: The image name is too short\n"));
950	return SUPDRV_ERR_INVALID_PARAM;
951	}
952	if (strpbrk(pIn->szName, ";:()[]{}/\\\|&*%#@!~`\"'"))
953	{
954	dprintf(("SUP_IOCTL_LDR_OPEN: The name is invalid '%s'\n", pIn->szName));
955	return SUPDRV_ERR_INVALID_PARAM;
956	}
957
958	pcbReturned = sizeof(pOut);
959	return supdrvIOCtl_LdrOpen(pDevExt, pSession, pIn, pOut);
960	}
961
962
963	case SUP_IOCTL_LDR_LOAD:
964	{
965	PSUPLDRLOAD_IN pIn = (PSUPLDRLOAD_IN)pvIn;
966
967	/*
968	* Validate.
969	*/
970	if ( cbIn <= sizeof(*pIn)
971	\|\| cbOut != 0)
972	{
973	dprintf(("SUP_IOCTL_LDR_LOAD: Invalid input/output sizes. cbIn=%d expected greater than %d. cbOut=%d expected %d.\n",
974	cbIn, sizeof(*pIn), cbOut, 0));
975	return SUPDRV_ERR_INVALID_PARAM;
976	}
977	if ( pIn->u32Cookie != pDevExt->u32Cookie
978	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
979	{
980	dprintf(("SUP_IOCTL_LDR_LOAD: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
981	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
982	return SUPDRV_ERR_INVALID_MAGIC;
983	}
984	if ((unsigned)RT_OFFSETOF(SUPLDRLOAD_IN, achImage[pIn->cbImage]) > cbIn)
985	{
986	dprintf(("SUP_IOCTL_LDR_LOAD: Invalid size %d. InputBufferLength=%d\n",
987	pIn->cbImage, cbIn));
988	return SUPDRV_ERR_INVALID_PARAM;
989	}
990	if (pIn->cSymbols > 16384)
991	{
992	dprintf(("SUP_IOCTL_LDR_LOAD: Too many symbols. cSymbols=%u max=16384\n", pIn->cSymbols));
993	return SUPDRV_ERR_INVALID_PARAM;
994	}
995	if ( pIn->cSymbols
996	&& ( pIn->offSymbols >= pIn->cbImage
997	\|\| pIn->offSymbols + pIn->cSymbols * sizeof(SUPLDRSYM) > pIn->cbImage)
998	)
999	{
1000	dprintf(("SUP_IOCTL_LDR_LOAD: symbol table is outside the image bits! offSymbols=%u cSymbols=%d cbImage=%d\n",
1001	pIn->offSymbols, pIn->cSymbols, pIn->cbImage));
1002	return SUPDRV_ERR_INVALID_PARAM;
1003	}
1004	if ( pIn->cbStrTab
1005	&& ( pIn->offStrTab >= pIn->cbImage
1006	\|\| pIn->offStrTab + pIn->cbStrTab > pIn->cbImage
1007	\|\| pIn->offStrTab + pIn->cbStrTab < pIn->offStrTab)
1008	)
1009	{
1010	dprintf(("SUP_IOCTL_LDR_LOAD: string table is outside the image bits! offStrTab=%u cbStrTab=%d cbImage=%d\n",
1011	pIn->offStrTab, pIn->cbStrTab, pIn->cbImage));
1012	return SUPDRV_ERR_INVALID_PARAM;
1013	}
1014
1015	if (pIn->cSymbols)
1016	{
1017	uint32_t i;
1018	PSUPLDRSYM paSyms = (PSUPLDRSYM)&pIn->achImage[pIn->offSymbols];
1019	for (i = 0; i < pIn->cSymbols; i++)
1020	{
1021	if (paSyms[i].offSymbol >= pIn->cbImage)
1022	{
1023	dprintf(("SUP_IOCTL_LDR_LOAD: symbol i=%d has an invalid symbol offset: %#x (max=%#x)\n",
1024	i, paSyms[i].offSymbol, pIn->cbImage));
1025	return SUPDRV_ERR_INVALID_PARAM;
1026	}
1027	if (paSyms[i].offName >= pIn->cbStrTab)
1028	{
1029	dprintf(("SUP_IOCTL_LDR_LOAD: symbol i=%d has an invalid name offset: %#x (max=%#x)\n",
1030	i, paSyms[i].offName, pIn->cbStrTab));
1031	return SUPDRV_ERR_INVALID_PARAM;
1032	}
1033	if (!memchr(&pIn->achImage[pIn->offStrTab + paSyms[i].offName], '\0', pIn->cbStrTab - paSyms[i].offName))
1034	{
1035	dprintf(("SUP_IOCTL_LDR_LOAD: symbol i=%d has an unterminated name! offName=%#x (max=%#x)\n",
1036	i, paSyms[i].offName, pIn->cbStrTab));
1037	return SUPDRV_ERR_INVALID_PARAM;
1038	}
1039	}
1040	}
1041
1042	return supdrvIOCtl_LdrLoad(pDevExt, pSession, pIn);
1043	}
1044
1045
1046	case SUP_IOCTL_LDR_FREE:
1047	{
1048	PSUPLDRFREE_IN pIn = (PSUPLDRFREE_IN)pvIn;
1049
1050	/*
1051	* Validate.
1052	*/
1053	if ( cbIn != sizeof(*pIn)
1054	\|\| cbOut != 0)
1055	{
1056	dprintf(("SUP_IOCTL_LDR_FREE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1057	cbIn, sizeof(*pIn), cbOut, 0));
1058	return SUPDRV_ERR_INVALID_PARAM;
1059	}
1060	if ( pIn->u32Cookie != pDevExt->u32Cookie
1061	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1062	{
1063	dprintf(("SUP_IOCTL_LDR_FREE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1064	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1065	return SUPDRV_ERR_INVALID_MAGIC;
1066	}
1067
1068	return supdrvIOCtl_LdrFree(pDevExt, pSession, pIn);
1069	}
1070
1071
1072	case SUP_IOCTL_LDR_GET_SYMBOL:
1073	{
1074	PSUPLDRGETSYMBOL_IN pIn = (PSUPLDRGETSYMBOL_IN)pvIn;
1075	PSUPLDRGETSYMBOL_OUT pOut = (PSUPLDRGETSYMBOL_OUT)pvOut;
1076	char *pszEnd;
1077
1078	/*
1079	* Validate.
1080	*/
1081	if ( cbIn < (unsigned)RT_OFFSETOF(SUPLDRGETSYMBOL_IN, szSymbol[2])
1082	\|\| cbOut != sizeof(*pOut))
1083	{
1084	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: Invalid input/output sizes. cbIn=%d expected >=%d. cbOut=%d expected at%d.\n",
1085	cbIn, RT_OFFSETOF(SUPLDRGETSYMBOL_IN, szSymbol[2]), cbOut, 0));
1086	return SUPDRV_ERR_INVALID_PARAM;
1087	}
1088	if ( pIn->u32Cookie != pDevExt->u32Cookie
1089	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1090	{
1091	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1092	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1093	return SUPDRV_ERR_INVALID_MAGIC;
1094	}
1095	pszEnd = memchr(pIn->szSymbol, '\0', cbIn - RT_OFFSETOF(SUPLDRGETSYMBOL_IN, szSymbol));
1096	if (!pszEnd)
1097	{
1098	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: The symbol name isn't terminated!\n"));
1099	return SUPDRV_ERR_INVALID_PARAM;
1100	}
1101	if (pszEnd - &pIn->szSymbol[0] >= 1024)
1102	{
1103	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: The symbol name too long (%d chars, max is %d)!\n",
1104	pszEnd - &pIn->szSymbol[0], 1024));
1105	return SUPDRV_ERR_INVALID_PARAM;
1106	}
1107
1108	pOut->pvSymbol = NULL;
1109	pcbReturned = sizeof(pOut);
1110	return supdrvIOCtl_LdrGetSymbol(pDevExt, pSession, pIn, pOut);
1111	}
1112
1113
1114	/** @todo this interface needs re-doing, we're accessing Ring-3 buffers directly here! */
1115	case SUP_IOCTL_CALL_VMMR0:
1116	{
1117	PSUPCALLVMMR0_IN pIn = (PSUPCALLVMMR0_IN)pvIn;
1118	PSUPCALLVMMR0_OUT pOut = (PSUPCALLVMMR0_OUT)pvOut;
1119
1120	/*
1121	* Validate.
1122	*/
1123	if ( cbIn != sizeof(*pIn)
1124	\|\| cbOut != sizeof(*pOut))
1125	{
1126	dprintf(("SUP_IOCTL_CALL_VMMR0: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1127	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
1128	return SUPDRV_ERR_INVALID_PARAM;
1129	}
1130	if ( pIn->u32Cookie != pDevExt->u32Cookie
1131	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
1132	{
1133	dprintf(("SUP_IOCTL_CALL_VMMR0: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1134	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1135	return SUPDRV_ERR_INVALID_MAGIC;
1136	}
1137
1138	/*
1139	* Do we have an entrypoint?
1140	*/
1141	if (!pDevExt->pfnVMMR0Entry)
1142	return SUPDRV_ERR_GENERAL_FAILURE;
1143
1144	/*
1145	* Execute.
1146	*/
1147	pOut->rc = pDevExt->pfnVMMR0Entry(pIn->pVM, pIn->uOperation, pIn->pvArg);
1148	pcbReturned = sizeof(pOut);
1149	return 0;
1150	}
1151
1152
1153	case SUP_IOCTL_GET_PAGING_MODE:
1154	{
1155	int rc;
1156	PSUPGETPAGINGMODE_IN pIn = (PSUPGETPAGINGMODE_IN)pvIn;
1157	PSUPGETPAGINGMODE_OUT pOut = (PSUPGETPAGINGMODE_OUT)pvOut;
1158
1159	/*
1160	* Validate.
1161	*/
1162	if ( cbIn != sizeof(*pIn)
1163	\|\| cbOut != sizeof(*pOut))
1164	{
1165	dprintf(("SUP_IOCTL_GET_PAGING_MODE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1166	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
1167	return SUPDRV_ERR_INVALID_PARAM;
1168	}
1169	if ( pIn->u32Cookie != pDevExt->u32Cookie
1170	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
1171	{
1172	dprintf(("SUP_IOCTL_GET_PAGING_MODE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1173	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1174	return SUPDRV_ERR_INVALID_MAGIC;
1175	}
1176
1177	/*
1178	* Execute.
1179	*/
1180	pcbReturned = sizeof(pOut);
1181	rc = supdrvIOCtl_GetPagingMode(pOut);
1182	if (rc)
1183	*pcbReturned = 0;
1184	return rc;
1185	}
1186
1187
1188	case SUP_IOCTL_LOW_ALLOC:
1189	{
1190	int rc;
1191	PSUPLOWALLOC_IN pIn = (PSUPLOWALLOC_IN)pvIn;
1192	PSUPLOWALLOC_OUT pOut = (PSUPLOWALLOC_OUT)pvOut;
1193
1194	/*
1195	* Validate.
1196	*/
1197	if ( cbIn != sizeof(*pIn)
1198	\|\| cbOut < sizeof(*pOut))
1199	{
1200	dprintf(("SUP_IOCTL_LOW_ALLOC: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1201	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
1202	return SUPDRV_ERR_INVALID_PARAM;
1203	}
1204	if ( pIn->u32Cookie != pDevExt->u32Cookie
1205	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
1206	{
1207	dprintf(("SUP_IOCTL_LOW_ALLOC: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1208	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1209	return SUPDRV_ERR_INVALID_MAGIC;
1210	}
1211	if ((unsigned)RT_OFFSETOF(SUPLOWALLOC_OUT, aPages[pIn->cPages]) > cbOut)
1212	{
1213	dprintf(("SUP_IOCTL_LOW_ALLOC: Output buffer is too small! %d required %d passed in.\n",
1214	RT_OFFSETOF(SUPLOWALLOC_OUT, aPages[pIn->cPages]), cbOut));
1215	return SUPDRV_ERR_INVALID_PARAM;
1216	}
1217
1218	/*
1219	* Execute.
1220	*/
1221	*pcbReturned = RT_OFFSETOF(SUPLOWALLOC_OUT, aPages[pIn->cPages]);
1222	rc = SUPR0LowAlloc(pSession, pIn->cPages, &pOut->pvVirt, &pOut->aPages[0]);
1223	if (rc)
1224	*pcbReturned = 0;
1225	return rc;
1226	}
1227
1228
1229	case SUP_IOCTL_LOW_FREE:
1230	{
1231	PSUPLOWFREE_IN pIn = (PSUPLOWFREE_IN)pvIn;
1232
1233	/*
1234	* Validate.
1235	*/
1236	if ( cbIn != sizeof(*pIn)
1237	\|\| cbOut != 0)
1238	{
1239	dprintf(("SUP_IOCTL_LOW_FREE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1240	cbIn, sizeof(*pIn), cbOut, 0));
1241	return SUPDRV_ERR_INVALID_PARAM;
1242	}
1243	if ( pIn->u32Cookie != pDevExt->u32Cookie
1244	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1245	{
1246	dprintf(("SUP_IOCTL_LOW_FREE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1247	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1248	return SUPDRV_ERR_INVALID_MAGIC;
1249	}
1250
1251	/*
1252	* Execute.
1253	*/
1254	return SUPR0LowFree(pSession, pIn->pv);
1255	}
1256
1257
1258	case SUP_IOCTL_GIP_MAP:
1259	{
1260	int rc;
1261	PSUPGIPMAP_IN pIn = (PSUPGIPMAP_IN)pvIn;
1262	PSUPGIPMAP_OUT pOut = (PSUPGIPMAP_OUT)pvOut;
1263
1264	/*
1265	* Validate.
1266	*/
1267	if ( cbIn != sizeof(*pIn)
1268	\|\| cbOut != sizeof(*pOut))
1269	{
1270	dprintf(("SUP_IOCTL_GIP_MAP: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1271	cbIn, sizeof(*pIn), cbOut, 0));
1272	return SUPDRV_ERR_INVALID_PARAM;
1273	}
1274	if ( pIn->u32Cookie != pDevExt->u32Cookie
1275	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1276	{
1277	dprintf(("SUP_IOCTL_GIP_MAP: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1278	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1279	return SUPDRV_ERR_INVALID_MAGIC;
1280	}
1281
1282	/*
1283	* Execute.
1284	*/
1285	rc = SUPR0GipMap(pSession, &pOut->pGipR3, &pOut->HCPhysGip);
1286	if (!rc)
1287	{
1288	pOut->pGipR0 = pDevExt->pGip;
1289	pcbReturned = sizeof(pOut);
1290	}
1291	return rc;
1292	}
1293
1294
1295	case SUP_IOCTL_GIP_UNMAP:
1296	{
1297	PSUPGIPUNMAP_IN pIn = (PSUPGIPUNMAP_IN)pvIn;
1298
1299	/*
1300	* Validate.
1301	*/
1302	if ( cbIn != sizeof(*pIn)
1303	\|\| cbOut != 0)
1304	{
1305	dprintf(("SUP_IOCTL_GIP_UNMAP: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1306	cbIn, sizeof(*pIn), cbOut, 0));
1307	return SUPDRV_ERR_INVALID_PARAM;
1308	}
1309	if ( pIn->u32Cookie != pDevExt->u32Cookie
1310	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1311	{
1312	dprintf(("SUP_IOCTL_GIP_UNMAP: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1313	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1314	return SUPDRV_ERR_INVALID_MAGIC;
1315	}
1316
1317	/*
1318	* Execute.
1319	*/
1320	return SUPR0GipUnmap(pSession);
1321	}
1322
1323
1324	case SUP_IOCTL_SET_VM_FOR_FAST:
1325	{
1326	PSUPSETVMFORFAST_IN pIn = (PSUPSETVMFORFAST_IN)pvIn;
1327
1328	/*
1329	* Validate.
1330	*/
1331	if ( cbIn != sizeof(*pIn)
1332	\|\| cbOut != 0)
1333	{
1334	dprintf(("SUP_IOCTL_SET_VM_FOR_FAST: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1335	cbIn, sizeof(*pIn), cbOut, 0));
1336	return SUPDRV_ERR_INVALID_PARAM;
1337	}
1338	if ( pIn->u32Cookie != pDevExt->u32Cookie
1339	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1340	{
1341	dprintf(("SUP_IOCTL_SET_VM_FOR_FAST: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1342	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1343	return SUPDRV_ERR_INVALID_MAGIC;
1344	}
1345	if ( pIn->pVMR0 != NULL
1346	&& ( !VALID_PTR(pIn->pVMR0)
1347	\|\| ((uintptr_t)pIn->pVMR0 & (PAGE_SIZE - 1))
1348	)
1349	)
1350	{
1351	dprintf(("SUP_IOCTL_SET_VM_FOR_FAST: pVMR0=%p! Must be a valid, page aligned, pointer.\n", pIn->pVMR0));
1352	return SUPDRV_ERR_INVALID_POINTER;
1353	}
1354
1355	/*
1356	* Execute.
1357	*/
1358	#ifndef VBOX_WITHOUT_IDT_PATCHING
1359	OSDBGPRINT(("SUP_IOCTL_SET_VM_FOR_FAST: !VBOX_WITHOUT_IDT_PATCHING\n"));
1360	return SUPDRV_ERR_GENERAL_FAILURE;
1361	#else
1362	pSession->pVM = pIn->pVMR0;
1363	return 0;
1364	#endif
1365	}
1366
1367
1368	default:
1369	dprintf(("Unknown IOCTL %#x\n", uIOCtl));
1370	break;
1371	}
1372	return SUPDRV_ERR_GENERAL_FAILURE;
1373	}
1374
1375
1376	/**
1377	* Register a object for reference counting.
1378	* The object is registered with one reference in the specified session.
1379	*
1380	* @returns Unique identifier on success (pointer).
1381	* All future reference must use this identifier.
1382	* @returns NULL on failure.
1383	* @param pfnDestructor The destructore function which will be called when the reference count reaches 0.
1384	* @param pvUser1 The first user argument.
1385	* @param pvUser2 The second user argument.
1386	*/
1387	SUPR0DECL(void ) SUPR0ObjRegister(PSUPDRVSESSION pSession, SUPDRVOBJTYPE enmType, PFNSUPDRVDESTRUCTOR pfnDestructor, void pvUser1, void *pvUser2)
1388	{
1389	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1390	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1391	PSUPDRVOBJ pObj;
1392	PSUPDRVUSAGE pUsage;
1393
1394	/*
1395	* Validate the input.
1396	*/
1397	if (!pSession)
1398	{
1399	AssertMsgFailed(("Invalid pSession=%p\n", pSession));
1400	return NULL;
1401	}
1402	if ( enmType <= SUPDRVOBJTYPE_INVALID
1403	\|\| enmType >= SUPDRVOBJTYPE_END)
1404	{
1405	AssertMsgFailed(("Invalid enmType=%d\n", enmType));
1406	return NULL;
1407	}
1408	if (!pfnDestructor)
1409	{
1410	AssertMsgFailed(("Invalid pfnDestructor=%d\n", pfnDestructor));
1411	return NULL;
1412	}
1413
1414	/*
1415	* Allocate and initialize the object.
1416	*/
1417	pObj = (PSUPDRVOBJ)RTMemAlloc(sizeof(*pObj));
1418	if (!pObj)
1419	return NULL;
1420	pObj->u32Magic = SUPDRVOBJ_MAGIC;
1421	pObj->enmType = enmType;
1422	pObj->pNext = NULL;
1423	pObj->cUsage = 1;
1424	pObj->pfnDestructor = pfnDestructor;
1425	pObj->pvUser1 = pvUser1;
1426	pObj->pvUser2 = pvUser2;
1427	pObj->CreatorUid = pSession->Uid;
1428	pObj->CreatorGid = pSession->Gid;
1429	pObj->CreatorProcess= pSession->Process;
1430	supdrvOSObjInitCreator(pObj, pSession);
1431
1432	/*
1433	* Allocate the usage record.
1434	* (We keep freed usage records around to simplity SUPR0ObjAddRef().)
1435	*/
1436	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1437
1438	pUsage = pDevExt->pUsageFree;
1439	if (pUsage)
1440	pDevExt->pUsageFree = pUsage->pNext;
1441	else
1442	{
1443	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1444	pUsage = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsage));
1445	if (!pUsage)
1446	{
1447	RTMemFree(pObj);
1448	return NULL;
1449	}
1450	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1451	}
1452
1453	/*
1454	* Insert the object and create the session usage record.
1455	*/
1456	/* The object. */
1457	pObj->pNext = pDevExt->pObjs;
1458	pDevExt->pObjs = pObj;
1459
1460	/* The session record. */
1461	pUsage->cUsage = 1;
1462	pUsage->pObj = pObj;
1463	pUsage->pNext = pSession->pUsage;
1464	dprintf(("SUPR0ObjRegister: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));
1465	pSession->pUsage = pUsage;
1466
1467	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1468
1469	dprintf(("SUPR0ObjRegister: returns %p (pvUser1=%p, pvUser=%p)\n", pObj, pvUser1, pvUser2));
1470	return pObj;
1471	}
1472
1473
1474	/**
1475	* Increment the reference counter for the object associating the reference
1476	* with the specified session.
1477	*
1478	* @returns 0 on success.
1479	* @returns SUPDRV_ERR_* on failure.
1480	* @param pvObj The identifier returned by SUPR0ObjRegister().
1481	* @param pSession The session which is referencing the object.
1482	*/
1483	SUPR0DECL(int) SUPR0ObjAddRef(void *pvObj, PSUPDRVSESSION pSession)
1484	{
1485	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1486	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1487	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
1488	PSUPDRVUSAGE pUsagePre;
1489	PSUPDRVUSAGE pUsage;
1490
1491	/*
1492	* Validate the input.
1493	*/
1494	if (!pSession)
1495	{
1496	AssertMsgFailed(("Invalid pSession=%p\n", pSession));
1497	return SUPDRV_ERR_INVALID_PARAM;
1498	}
1499	if (!pObj \|\| pObj->u32Magic != SUPDRVOBJ_MAGIC)
1500	{
1501	AssertMsgFailed(("Invalid pvObj=%p magic=%#x (exepcted %#x)\n",
1502	pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC));
1503	return SUPDRV_ERR_INVALID_PARAM;
1504	}
1505
1506	/*
1507	* Preallocate the usage record.
1508	*/
1509	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1510
1511	pUsagePre = pDevExt->pUsageFree;
1512	if (pUsagePre)
1513	pDevExt->pUsageFree = pUsagePre->pNext;
1514	else
1515	{
1516	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1517	pUsagePre = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsagePre));
1518	if (!pUsagePre)
1519	return SUPDRV_ERR_NO_MEMORY;
1520	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1521	}
1522
1523	/*
1524	* Reference the object.
1525	*/
1526	pObj->cUsage++;
1527
1528	/*
1529	* Look for the session record.
1530	*/
1531	for (pUsage = pSession->pUsage; pUsage; pUsage = pUsage->pNext)
1532	{
1533	dprintf(("SUPR0AddRef: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));
1534	if (pUsage->pObj == pObj)
1535	break;
1536	}
1537	if (pUsage)
1538	pUsage->cUsage++;
1539	else
1540	{
1541	/* create a new session record. */
1542	pUsagePre->cUsage = 1;
1543	pUsagePre->pObj = pObj;
1544	pUsagePre->pNext = pSession->pUsage;
1545	pSession->pUsage = pUsagePre;
1546	dprintf(("SUPR0ObjRelease: pUsagePre=%p:{.pObj=%p, .pNext=%p}\n", pUsagePre, pUsagePre->pObj, pUsagePre->pNext));
1547
1548	pUsagePre = NULL;
1549	}
1550
1551	/*
1552	* Put any unused usage record into the free list..
1553	*/
1554	if (pUsagePre)
1555	{
1556	pUsagePre->pNext = pDevExt->pUsageFree;
1557	pDevExt->pUsageFree = pUsagePre;
1558	}
1559
1560	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1561
1562	return 0;
1563	}
1564
1565
1566	/**
1567	* Decrement / destroy a reference counter record for an object.
1568	*
1569	* The object is uniquely identified by pfnDestructor+pvUser1+pvUser2.
1570	*
1571	* @returns 0 on success.
1572	* @returns SUPDRV_ERR_* on failure.
1573	* @param pvObj The identifier returned by SUPR0ObjRegister().
1574	* @param pSession The session which is referencing the object.
1575	*/
1576	SUPR0DECL(int) SUPR0ObjRelease(void *pvObj, PSUPDRVSESSION pSession)
1577	{
1578	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1579	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1580	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
1581	bool fDestroy = false;
1582	PSUPDRVUSAGE pUsage;
1583	PSUPDRVUSAGE pUsagePrev;
1584
1585	/*
1586	* Validate the input.
1587	*/
1588	if (!pSession)
1589	{
1590	AssertMsgFailed(("Invalid pSession=%p\n", pSession));
1591	return SUPDRV_ERR_INVALID_PARAM;
1592	}
1593	if (!pObj \|\| pObj->u32Magic != SUPDRVOBJ_MAGIC)
1594	{
1595	AssertMsgFailed(("Invalid pvObj=%p magic=%#x (exepcted %#x)\n",
1596	pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC));
1597	return SUPDRV_ERR_INVALID_PARAM;
1598	}
1599
1600	/*
1601	* Acquire the spinlock and look for the usage record.
1602	*/
1603	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1604
1605	for (pUsagePrev = NULL, pUsage = pSession->pUsage;
1606	pUsage;
1607	pUsagePrev = pUsage, pUsage = pUsage->pNext)
1608	{
1609	dprintf(("SUPR0ObjRelease: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));
1610	if (pUsage->pObj == pObj)
1611	{
1612	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
1613	if (pUsage->cUsage > 1)
1614	{
1615	pObj->cUsage--;
1616	pUsage->cUsage--;
1617	}
1618	else
1619	{
1620	/*
1621	* Free the session record.
1622	*/
1623	if (pUsagePrev)
1624	pUsagePrev->pNext = pUsage->pNext;
1625	else
1626	pSession->pUsage = pUsage->pNext;
1627	pUsage->pNext = pDevExt->pUsageFree;
1628	pDevExt->pUsageFree = pUsage;
1629
1630	/* What about the object? */
1631	if (pObj->cUsage > 1)
1632	pObj->cUsage--;
1633	else
1634	{
1635	/*
1636	* Object is to be destroyed, unlink it.
1637	*/
1638	fDestroy = true;
1639	if (pDevExt->pObjs == pObj)
1640	pDevExt->pObjs = pObj->pNext;
1641	else
1642	{
1643	PSUPDRVOBJ pObjPrev;
1644	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
1645	if (pObjPrev->pNext == pObj)
1646	{
1647	pObjPrev->pNext = pObj->pNext;
1648	break;
1649	}
1650	Assert(pObjPrev);
1651	}
1652	}
1653	}
1654	break;
1655	}
1656	}
1657
1658	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1659
1660	/*
1661	* Call the destructor and free the object if required.
1662	*/
1663	if (fDestroy)
1664	{
1665	pObj->u32Magic++;
1666	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
1667	RTMemFree(pObj);
1668	}
1669
1670	AssertMsg(pUsage, ("pvObj=%p\n", pvObj));
1671	return pUsage ? 0 : SUPDRV_ERR_INVALID_PARAM;
1672	}
1673
1674	/**
1675	* Verifies that the current process can access the specified object.
1676	*
1677	* @returns 0 if access is granted.
1678	* @returns SUPDRV_ERR_PERMISSION_DENIED if denied access.
1679	* @returns SUPDRV_ERR_INVALID_PARAM if invalid parameter.
1680	*
1681	* @param pvObj The identifier returned by SUPR0ObjRegister().
1682	* @param pSession The session which wishes to access the object.
1683	* @param pszObjName Object string name. This is optional and depends on the object type.
1684	*
1685	* @remark The caller is responsible for making sure the object isn't removed while
1686	* we're inside this function. If uncertain about this, just call AddRef before calling us.
1687	*/
1688	SUPR0DECL(int) SUPR0ObjVerifyAccess(void pvObj, PSUPDRVSESSION pSession, const char pszObjName)
1689	{
1690	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
1691	int rc = SUPDRV_ERR_GENERAL_FAILURE;
1692
1693	/*
1694	* Validate the input.
1695	*/
1696	if (!pSession)
1697	{
1698	AssertMsgFailed(("Invalid pSession=%p\n", pSession));
1699	return SUPDRV_ERR_INVALID_PARAM;
1700	}
1701	if (!pObj \|\| pObj->u32Magic != SUPDRVOBJ_MAGIC)
1702	{
1703	AssertMsgFailed(("Invalid pvObj=%p magic=%#x (exepcted %#x)\n",
1704	pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC));
1705	return SUPDRV_ERR_INVALID_PARAM;
1706	}
1707
1708	/*
1709	* Check access. (returns true if a decision has been made.)
1710	*/
1711	if (supdrvOSObjCanAccess(pObj, pSession, pszObjName, &rc))
1712	return rc;
1713
1714	/*
1715	* Default policy is to allow the user to access his own
1716	* stuff but nothing else.
1717	*/
1718	if (pObj->CreatorUid == pSession->Uid)
1719	return 0;
1720	return SUPDRV_ERR_PERMISSION_DENIED;
1721	}
1722
1723
1724	/**
1725	* Lock pages.
1726	*
1727	* @param pSession Session to which the locked memory should be associated.
1728	* @param pvR3 Start of the memory range to lock.
1729	* This must be page aligned.
1730	* @param cb Size of the memory range to lock.
1731	* This must be page aligned.
1732	*/
1733	SUPR0DECL(int) SUPR0LockMem(PSUPDRVSESSION pSession, void *pvR3, unsigned cb, PSUPPAGE paPages)
1734	{
1735	int rc;
1736	SUPDRVMEMREF Mem = {0};
1737	dprintf(("SUPR0LockMem: pSession=%p pvR3=%p cb=%d paPages=%p\n",
1738	pSession, pvR3, cb, paPages));
1739
1740	/*
1741	* Verify input.
1742	*/
1743	if (RT_ALIGN_R3PT(pvR3, PAGE_SIZE, void *) != pvR3 \|\| !pvR3)
1744	{
1745	dprintf(("pvR3 (%p) must be page aligned and not NULL!\n", pvR3));
1746	return SUPDRV_ERR_INVALID_PARAM;
1747	}
1748	if (RT_ALIGN(cb, PAGE_SIZE) != cb)
1749	{
1750	dprintf(("cb (%u) must be page aligned!\n", cb));
1751	return SUPDRV_ERR_INVALID_PARAM;
1752	}
1753	if (!paPages)
1754	{
1755	dprintf(("paPages is NULL!\n"));
1756	return SUPDRV_ERR_INVALID_PARAM;
1757	}
1758
1759	#ifdef USE_NEW_OS_INTERFACE
1760	/*
1761	* Let IPRT do the job.
1762	*/
1763	Mem.eType = MEMREF_TYPE_LOCKED;
1764	rc = RTR0MemObjLockUser(&Mem.MemObj, pvR3, cb, RTR0ProcHandleSelf());
1765	if (RT_SUCCESS(rc))
1766	{
1767	unsigned iPage = cb >> PAGE_SHIFT;
1768	while (iPage-- > 0)
1769	{
1770	paPages[iPage].uReserved = 0;
1771	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
1772	if (RT_UNLIKELY(paPages[iPage].Phys == NIL_RTCCPHYS))
1773	{
1774	AssertMsgFailed(("iPage=%d\n", iPage));
1775	rc = VERR_INTERNAL_ERROR;
1776	break;
1777	}
1778	}
1779	if (RT_SUCCESS(rc))
1780	rc = supdrvMemAdd(&Mem, pSession);
1781	if (RT_FAILURE(rc))
1782	{
1783	int rc2 = RTR0MemObjFree(Mem.MemObj, false);
1784	AssertRC(rc2);
1785	}
1786	}
1787
1788	#else /* !USE_NEW_OS_INTERFACE */
1789
1790	/*
1791	* Let the OS specific code have a go.
1792	*/
1793	Mem.pvR0 = NULL;
1794	Mem.pvR3 = pvR3;
1795	Mem.eType = MEMREF_TYPE_LOCKED;
1796	Mem.cb = cb;
1797	rc = supdrvOSLockMemOne(&Mem, paPages);
1798	if (rc)
1799	return rc;
1800
1801	/*
1802	* Everything when fine, add the memory reference to the session.
1803	*/
1804	rc = supdrvMemAdd(&Mem, pSession);
1805	if (rc)
1806	supdrvOSUnlockMemOne(&Mem);
1807	#endif /* !USE_NEW_OS_INTERFACE */
1808	return rc;
1809	}
1810
1811
1812	/**
1813	* Unlocks the memory pointed to by pv.
1814	*
1815	* @returns 0 on success.
1816	* @returns SUPDRV_ERR_* on failure
1817	* @param pSession Session to which the memory was locked.
1818	* @param pvR3 Memory to unlock.
1819	*/
1820	SUPR0DECL(int) SUPR0UnlockMem(PSUPDRVSESSION pSession, void *pvR3)
1821	{
1822	dprintf(("SUPR0UnlockMem: pSession=%p pvR3=%p\n", pSession, pvR3));
1823	return supdrvMemRelease(pSession, pvR3, MEMREF_TYPE_LOCKED);
1824	}
1825
1826
1827	/**
1828	* Allocates a chunk of page aligned memory with contiguous and fixed physical
1829	* backing.
1830	*
1831	* @returns 0 on success.
1832	* @returns SUPDRV_ERR_* on failure.
1833	* @param pSession Session data.
1834	* @param cb Number of bytes to allocate.
1835	* @param ppvR0 Where to put the address of Ring-0 mapping the allocated memory. optional
1836	* @param ppvR3 Where to put the address of Ring-3 mapping the allocated memory.
1837	* @param pHCPhys Where to put the physical address of allocated memory.
1838	*/
1839	SUPR0DECL(int) SUPR0ContAlloc(PSUPDRVSESSION pSession, unsigned cb, void ppvR0, void ppvR3, PRTHCPHYS pHCPhys)
1840	{
1841	int rc;
1842	SUPDRVMEMREF Mem = {0};
1843	dprintf(("SUPR0ContAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p pHCPhys=%p\n", pSession, cb, ppvR0, ppvR3, pHCPhys));
1844
1845	/*
1846	* Validate input.
1847	*/
1848	if (!pSession \|\| !ppvR3 \|\| !pHCPhys)
1849	{
1850	dprintf(("Null pointer. All of these should be set: pSession=%p ppvR3=%p pHCPhys=%p\n",
1851	pSession, ppvR3, pHCPhys));
1852	return SUPDRV_ERR_INVALID_PARAM;
1853
1854	}
1855	if (cb <= 64 \|\| cb >= PAGE_SIZE * 256)
1856	{
1857	dprintf(("Illegal request cb=%d, must be greater than 64 and smaller than PAGE_SIZE*256\n", cb));
1858	return SUPDRV_ERR_INVALID_PARAM;
1859	}
1860
1861	#ifdef USE_NEW_OS_INTERFACE
1862	/*
1863	* Let IPRT do the job.
1864	*/
1865	rc = RTR0MemObjAllocCont(&Mem.MemObj, cb, true /* executable R0 mapping */);
1866	if (RT_SUCCESS(rc))
1867	{
1868	int rc2;
1869	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (void *)-1, 0,
1870	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
1871	if (RT_SUCCESS(rc))
1872	{
1873	Mem.eType = MEMREF_TYPE_CONT;
1874	rc = supdrvMemAdd(&Mem, pSession);
1875	if (!rc)
1876	{
1877	if (ppvR0)
1878	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
1879	*ppvR3 = RTR0MemObjAddress(Mem.MapObjR3);
1880	*pHCPhys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, 0);
1881	return 0;
1882	}
1883
1884	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
1885	AssertRC(rc2);
1886	}
1887	rc2 = RTR0MemObjFree(Mem.MemObj, false);
1888	AssertRC(rc2);
1889	}
1890
1891	#else /* !USE_NEW_OS_INTERFACE */
1892
1893	/*
1894	* Let the OS specific code have a go.
1895	*/
1896	Mem.pvR0 = NULL;
1897	Mem.pvR3 = NULL;
1898	Mem.eType = MEMREF_TYPE_CONT;
1899	Mem.cb = cb;
1900	rc = supdrvOSContAllocOne(&Mem, ppvR0, ppvR3, pHCPhys);
1901	if (rc)
1902	return rc;
1903	AssertMsg(!((uintptr_t)ppvR3 & (PAGE_SIZE - 1)) \|\| !(pHCPhys & (PAGE_SIZE - 1)),
1904	("Memory is not page aligned! ppvR0=%p ppvR3=%p phys=%VHp\n", ppvR0 ? ppvR0 : NULL, ppvR3, *pHCPhys));
1905
1906	/*
1907	* Everything when fine, add the memory reference to the session.
1908	*/
1909	rc = supdrvMemAdd(&Mem, pSession);
1910	if (rc)
1911	supdrvOSContFreeOne(&Mem);
1912	#endif /* !USE_NEW_OS_INTERFACE */
1913
1914	return rc;
1915	}
1916
1917
1918	/**
1919	* Frees memory allocated using SUPR0ContAlloc().
1920	*
1921	* @returns 0 on success.
1922	* @returns SUPDRV_ERR_* on failure.
1923	* @param pSession The session to which the memory was allocated.
1924	* @param pv Pointer to the memory.
1925	*/
1926	SUPR0DECL(int) SUPR0ContFree(PSUPDRVSESSION pSession, void *pv)
1927	{
1928	dprintf(("SUPR0ContFree: pSession=%p pv=%p\n", pSession, pv));
1929	return supdrvMemRelease(pSession, pv, MEMREF_TYPE_CONT);
1930	}
1931
1932
1933	/**
1934	* Allocates a chunk of page aligned memory with fixed physical backing below 4GB.
1935	*
1936	* @returns 0 on success.
1937	* @returns SUPDRV_ERR_* on failure.
1938	* @param pSession Session data.
1939	* @param cPages Number of pages to allocate.
1940	* @param ppvR3 Where to put the address of Ring-3 mapping of the allocated memory.
1941	* @param paPages Where to put the physical addresses of allocated memory.
1942	*/
1943	SUPR0DECL(int) SUPR0LowAlloc(PSUPDRVSESSION pSession, unsigned cPages, void **ppvR3, PSUPPAGE paPages)
1944	{
1945	unsigned iPage;
1946	int rc;
1947	SUPDRVMEMREF Mem = {0};
1948	dprintf(("SUPR0LowAlloc: pSession=%p cPages=%d ppvR3=%p paPages=%p\n", pSession, cPages, ppvR3, paPages));
1949
1950	/*
1951	* Validate input.
1952	*/
1953	if (!pSession \|\| !ppvR3 \|\| !paPages)
1954	{
1955	dprintf(("Null pointer. All of these should be set: pSession=%p ppvR3=%p paPages=%p\n",
1956	pSession, ppvR3, paPages));
1957	return SUPDRV_ERR_INVALID_PARAM;
1958
1959	}
1960	if (cPages < 1 \|\| cPages > 256)
1961	{
1962	dprintf(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
1963	return SUPDRV_ERR_INVALID_PARAM;
1964	}
1965
1966	#ifdef USE_NEW_OS_INTERFACE
1967	/*
1968	* Let IPRT do the work.
1969	*/
1970	rc = RTR0MemObjAllocLow(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable ring-0 mapping */);
1971	if (RT_SUCCESS(rc))
1972	{
1973	int rc2;
1974	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (void *)-1, 0,
1975	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
1976	if (RT_SUCCESS(rc))
1977	{
1978	Mem.eType = MEMREF_TYPE_LOW;
1979	rc = supdrvMemAdd(&Mem, pSession);
1980	if (!rc)
1981	{
1982	for (iPage = 0; iPage < cPages; iPage++)
1983	{
1984	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
1985	paPages[iPage].uReserved = 0;
1986	AssertMsg(!(paPages[iPage].Phys & (PAGE_SIZE - 1)), ("iPage=%d Phys=%VHp\n", paPages[iPage].Phys));
1987	}
1988	/*if (ppvR0)
1989	ppvR0 = RTR0MemObjAddress(Mem.MemObj); /
1990	*ppvR3 = RTR0MemObjAddress(Mem.MapObjR3);
1991	return 0;
1992	}
1993
1994	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
1995	AssertRC(rc2);
1996	}
1997
1998	rc2 = RTR0MemObjFree(Mem.MemObj, false);
1999	AssertRC(rc2);
2000	}
2001
2002	#else /* !USE_NEW_OS_INTERFACE */
2003
2004	/*
2005	* Let the OS specific code have a go.
2006	*/
2007	Mem.pvR0 = NULL;
2008	Mem.pvR3 = NULL;
2009	Mem.eType = MEMREF_TYPE_LOW;
2010	Mem.cb = cPages << PAGE_SHIFT;
2011	rc = supdrvOSLowAllocOne(&Mem, ppvR3, paPages);
2012	if (rc)
2013	return rc;
2014	AssertMsg(!((uintptr_t)ppvR3 & (PAGE_SIZE - 1)), ("Memory is not page aligned! virt=%p\n", ppvR3));
2015	for (iPage = 0; iPage < cPages; iPage++)
2016	AssertMsg(!(paPages[iPage].Phys & (PAGE_SIZE - 1)), ("iPage=%d Phys=%VHp\n", paPages[iPage].Phys));
2017
2018	/*
2019	* Everything when fine, add the memory reference to the session.
2020	*/
2021	rc = supdrvMemAdd(&Mem, pSession);
2022	if (rc)
2023	supdrvOSLowFreeOne(&Mem);
2024	#endif /* !USE_NEW_OS_INTERFACE */
2025	return rc;
2026	}
2027
2028
2029	/**
2030	* Frees memory allocated using SUPR0LowAlloc().
2031	*
2032	* @returns 0 on success.
2033	* @returns SUPDRV_ERR_* on failure.
2034	* @param pSession The session to which the memory was allocated.
2035	* @param pv Pointer to the memory.
2036	*/
2037	SUPR0DECL(int) SUPR0LowFree(PSUPDRVSESSION pSession, void *pv)
2038	{
2039	dprintf(("SUPR0LowFree: pSession=%p pv=%p\n", pSession, pv));
2040	return supdrvMemRelease(pSession, pv, MEMREF_TYPE_LOW);
2041	}
2042
2043
2044	/**
2045	* Allocates a chunk of memory with both R0 and R3 mappings.
2046	* The memory is fixed and it's possible to query the physical addresses using SUPR0MemGetPhys().
2047	*
2048	* @returns 0 on success.
2049	* @returns SUPDRV_ERR_* on failure.
2050	* @param pSession The session to associated the allocation with.
2051	* @param cb Number of bytes to allocate.
2052	* @param ppvR0 Where to store the address of the Ring-0 mapping.
2053	* @param ppvR3 Where to store the address of the Ring-3 mapping.
2054	*/
2055	SUPR0DECL(int) SUPR0MemAlloc(PSUPDRVSESSION pSession, unsigned cb, void ppvR0, void ppvR3)
2056	{
2057	int rc;
2058	SUPDRVMEMREF Mem = {0};
2059	dprintf(("SUPR0MemAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p\n", pSession, cb, ppvR0, ppvR3));
2060
2061	/*
2062	* Validate input.
2063	*/
2064	if (!pSession \|\| !ppvR0 \|\| !ppvR3)
2065	{
2066	dprintf(("Null pointer. All of these should be set: pSession=%p ppvR0=%p ppvR3=%p\n",
2067	pSession, ppvR0, ppvR3));
2068	return SUPDRV_ERR_INVALID_PARAM;
2069
2070	}
2071	if (cb < 1 \|\| cb >= PAGE_SIZE * 256)
2072	{
2073	dprintf(("Illegal request cb=%u; must be greater than 0 and smaller than 4MB.\n", cb));
2074	return SUPDRV_ERR_INVALID_PARAM;
2075	}
2076
2077	#ifdef USE_NEW_OS_INTERFACE
2078	/*
2079	* Let IPRT do the work.
2080	*/
2081	rc = RTR0MemObjAllocPage(&Mem.MemObj, cb, true /* executable ring-0 mapping */);
2082	if (RT_SUCCESS(rc))
2083	{
2084	int rc2;
2085	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (void*)-1, 0,
2086	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2087	if (RT_SUCCESS(rc))
2088	{
2089	Mem.eType = MEMREF_TYPE_MEM;
2090	rc = supdrvMemAdd(&Mem, pSession);
2091	if (!rc)
2092	{
2093	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2094	*ppvR3 = RTR0MemObjAddress(Mem.MapObjR3);
2095	return 0;
2096	}
2097	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2098	AssertRC(rc2);
2099	}
2100
2101	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2102	AssertRC(rc2);
2103	}
2104
2105	#else /* !USE_NEW_OS_INTERFACE */
2106
2107	/*
2108	* Let the OS specific code have a go.
2109	*/
2110	Mem.pvR0 = NULL;
2111	Mem.pvR3 = NULL;
2112	Mem.eType = MEMREF_TYPE_MEM;
2113	Mem.cb = cb;
2114	rc = supdrvOSMemAllocOne(&Mem, ppvR0, ppvR3);
2115	if (rc)
2116	return rc;
2117	AssertMsg(!((uintptr_t)ppvR0 & (PAGE_SIZE - 1)), ("Memory is not page aligned! pvR0=%p\n", ppvR0));
2118	AssertMsg(!((uintptr_t)ppvR3 & (PAGE_SIZE - 1)), ("Memory is not page aligned! pvR3=%p\n", ppvR3));
2119
2120	/*
2121	* Everything when fine, add the memory reference to the session.
2122	*/
2123	rc = supdrvMemAdd(&Mem, pSession);
2124	if (rc)
2125	supdrvOSMemFreeOne(&Mem);
2126	#endif /* !USE_NEW_OS_INTERFACE */
2127	return rc;
2128	}
2129
2130
2131	/**
2132	* Get the physical addresses of memory allocated using SUPR0MemAlloc().
2133	*
2134	* @returns 0 on success.
2135	* @returns SUPDRV_ERR_* on failure.
2136	* @param pSession The session to which the memory was allocated.
2137	* @param pv The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2138	*/
2139	SUPR0DECL(int) SUPR0MemGetPhys(PSUPDRVSESSION pSession, void *pv, PSUPPAGE paPages)
2140	{
2141	PSUPDRVBUNDLE pBundle;
2142	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2143	dprintf(("SUPR0MemGetPhys: pSession=%p pv=%p paPages=%p\n", pSession, pv, paPages));
2144
2145	/*
2146	* Validate input.
2147	*/
2148	if (!pSession)
2149	{
2150	dprintf(("pSession must not be NULL!"));
2151	return SUPDRV_ERR_INVALID_PARAM;
2152	}
2153	if (!pv \|\| !paPages)
2154	{
2155	dprintf(("Illegal address pv=%p or/and paPages=%p\n", pv, paPages));
2156	return SUPDRV_ERR_INVALID_PARAM;
2157	}
2158
2159	/*
2160	* Search for the address.
2161	*/
2162	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2163	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2164	{
2165	if (pBundle->cUsed > 0)
2166	{
2167	unsigned i;
2168	for (i = 0; i < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]); i++)
2169	{
2170	#ifdef USE_NEW_OS_INTERFACE
2171	if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
2172	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2173	&& ( RTR0MemObjAddress(pBundle->aMem[i].MemObj) == pv
2174	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2175	&& RTR0MemObjAddress(pBundle->aMem[i].MapObjR3) == pv)
2176	)
2177	)
2178	{
2179	const unsigned cPages = RTR0MemObjSize(pBundle->aMem[i].MemObj) >> PAGE_SHIFT;
2180	unsigned iPage;
2181	for (iPage = 0; iPage < cPages; iPage++)
2182	{
2183	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(pBundle->aMem[i].MemObj, iPage);
2184	paPages[iPage].uReserved = 0;
2185	}
2186	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2187	return 0;
2188	}
2189	#else /* !USE_NEW_OS_INTERFACE */
2190	if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
2191	&& ( pBundle->aMem[i].pvR0 == pv
2192	\|\| pBundle->aMem[i].pvR3 == pv))
2193	{
2194	supdrvOSMemGetPages(&pBundle->aMem[i], paPages);
2195	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2196	return 0;
2197	}
2198	#endif
2199	}
2200	}
2201	}
2202	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2203	dprintf(("Failed to find %p!!!\n", pv));
2204	return SUPDRV_ERR_INVALID_PARAM;
2205	}
2206
2207
2208	/**
2209	* Free memory allocated by SUPR0MemAlloc().
2210	*
2211	* @returns 0 on success.
2212	* @returns SUPDRV_ERR_* on failure.
2213	* @param pSession The session owning the allocation.
2214	* @param pv The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2215	*/
2216	SUPR0DECL(int) SUPR0MemFree(PSUPDRVSESSION pSession, void *pv)
2217	{
2218	dprintf(("SUPR0MemFree: pSession=%p pv=%p\n", pSession, pv));
2219	return supdrvMemRelease(pSession, pv, MEMREF_TYPE_MEM);
2220	}
2221
2222
2223	/**
2224	* Maps the GIP into userspace and/or get the physical address of the GIP.
2225	*
2226	* @returns 0 on success.
2227	* @returns SUPDRV_ERR_* on failure.
2228	* @param pSession Session to which the GIP mapping should belong.
2229	* @param ppGip Where to store the address of the mapping. (optional)
2230	* @param pHCPhysGip Where to store the physical address. (optional)
2231	*
2232	* @remark There is no reference counting on the mapping, so one call to this function
2233	* count globally as one reference. One call to SUPR0GipUnmap() is will unmap GIP
2234	* and remove the session as a GIP user.
2235	*/
2236	SUPR0DECL(int) SUPR0GipMap(PSUPDRVSESSION pSession, PCSUPGLOBALINFOPAGE ppGip, RTHCPHYS pHCPhysGid)
2237	{
2238	int rc = 0;
2239	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2240	PCSUPGLOBALINFOPAGE pGip = NULL;
2241	RTHCPHYS HCPhys = NIL_RTHCPHYS;
2242	dprintf(("SUPR0GipMap: pSession=%p ppGip=%p pHCPhysGid=%p\n", pSession, ppGip, pHCPhysGid));
2243
2244	/*
2245	* Validate
2246	*/
2247	if (!ppGip && !pHCPhysGid)
2248	return 0;
2249
2250	RTSemFastMutexRequest(pDevExt->mtxGip);
2251	if (pDevExt->pGip)
2252	{
2253	/*
2254	* Map it?
2255	*/
2256	if (ppGip)
2257	{
2258	#ifdef USE_NEW_OS_INTERFACE
2259	if (pSession->GipMapObjR3 == NIL_RTR0MEMOBJ)
2260	rc = RTR0MemObjMapUser(&pSession->GipMapObjR3, pDevExt->GipMemObj, (void*)-1, 0,
2261	RTMEM_PROT_READ, RTR0ProcHandleSelf());
2262	if (RT_SUCCESS(rc))
2263	{
2264	pGip = (PCSUPGLOBALINFOPAGE)RTR0MemObjAddress(pSession->GipMapObjR3);
2265	rc = VINF_SUCCESS; /** @todo remove this and replace the !rc below with RT_SUCCESS(rc). */
2266	}
2267	#else /* !USE_NEW_OS_INTERFACE */
2268	if (!pSession->pGip)
2269	rc = supdrvOSGipMap(pSession->pDevExt, &pSession->pGip);
2270	if (!rc)
2271	pGip = pSession->pGip;
2272	#endif /* !USE_NEW_OS_INTERFACE */
2273	}
2274
2275	/*
2276	* Get physical address.
2277	*/
2278	if (pHCPhysGid && !rc)
2279	HCPhys = pDevExt->HCPhysGip;
2280
2281	/*
2282	* Reference globally.
2283	*/
2284	if (!pSession->fGipReferenced && !rc)
2285	{
2286	pSession->fGipReferenced = 1;
2287	pDevExt->cGipUsers++;
2288	if (pDevExt->cGipUsers == 1)
2289	{
2290	dprintf(("SUPR0GipMap: Resumes GIP updating\n"));
2291	ASMAtomicXchgU32(&pDevExt->pGip->u32TransactionId,
2292	pDevExt->pGip->u32TransactionId & ~(GIP_UPDATEHZ_RECALC_FREQ * 2 - 1));
2293	ASMAtomicXchgU64(&pDevExt->pGip->u64NanoTSLastUpdateHz, 0);
2294	#ifdef USE_NEW_OS_INTERFACE
2295	rc = RTTimerStart(pDevExt->pGipTimer, 0); AssertRC(rc); rc = 0;
2296	#else
2297	supdrvOSGipResume(pDevExt);
2298	#endif
2299	}
2300	}
2301	}
2302	else
2303	{
2304	rc = SUPDRV_ERR_GENERAL_FAILURE;
2305	dprintf(("SUPR0GipMap: GIP is not available!\n"));
2306	}
2307	RTSemFastMutexRelease(pDevExt->mtxGip);
2308
2309	/*
2310	* Write returns.
2311	*/
2312	if (pHCPhysGid)
2313	*pHCPhysGid = HCPhys;
2314	if (ppGip)
2315	*ppGip = pGip;
2316
2317	dprintf(("SUPR0GipMap: returns %d pHCPhysGid=%lx ppGip=%p\n", rc, (unsigned long)HCPhys, pGip));
2318	return rc;
2319	}
2320
2321
2322	/**
2323	* Unmaps any user mapping of the GIP and terminates all GIP access
2324	* from this session.
2325	*
2326	* @returns 0 on success.
2327	* @returns SUPDRV_ERR_* on failure.
2328	* @param pSession Session to which the GIP mapping should belong.
2329	*/
2330	SUPR0DECL(int) SUPR0GipUnmap(PSUPDRVSESSION pSession)
2331	{
2332	int rc = 0;
2333	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2334	dprintf(("SUPR0GipUnmap: pSession=%p\n", pSession));
2335
2336	RTSemFastMutexRequest(pDevExt->mtxGip);
2337
2338	/*
2339	* Unmap anything?
2340	*/
2341	#ifdef USE_NEW_OS_INTERFACE
2342	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
2343	{
2344	rc = RTR0MemObjFree(pSession->GipMapObjR3, false);
2345	AssertRC(rc);
2346	if (RT_SUCCESS(rc))
2347	pSession->GipMapObjR3 = NIL_RTR0MEMOBJ;
2348	}
2349	#else
2350	if (pSession->pGip)
2351	{
2352	rc = supdrvOSGipUnmap(pDevExt, pSession->pGip);
2353	if (!rc)
2354	pSession->pGip = NULL;
2355	}
2356	#endif
2357
2358	/*
2359	* Dereference global GIP.
2360	*/
2361	if (pSession->fGipReferenced && !rc)
2362	{
2363	pSession->fGipReferenced = 0;
2364	if ( pDevExt->cGipUsers > 0
2365	&& !--pDevExt->cGipUsers)
2366	{
2367	dprintf(("SUPR0GipUnmap: Suspends GIP updating\n"));
2368	#ifdef USE_NEW_OS_INTERFACE
2369	rc = RTTimerStop(pDevExt->pGipTimer); AssertRC(rc); rc = 0;
2370	#else
2371	supdrvOSGipSuspend(pDevExt);
2372	#endif
2373	}
2374	}
2375
2376	RTSemFastMutexRelease(pDevExt->mtxGip);
2377
2378	return rc;
2379	}
2380
2381
2382	/**
2383	* Adds a memory object to the session.
2384	*
2385	* @returns 0 on success.
2386	* @returns SUPDRV_ERR_* on failure.
2387	* @param pMem Memory tracking structure containing the
2388	* information to track.
2389	* @param pSession The session.
2390	*/
2391	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession)
2392	{
2393	PSUPDRVBUNDLE pBundle;
2394	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2395
2396	/*
2397	* Find free entry and record the allocation.
2398	*/
2399	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2400	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2401	{
2402	if (pBundle->cUsed < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]))
2403	{
2404	unsigned i;
2405	for (i = 0; i < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]); i++)
2406	{
2407	#ifdef USE_NEW_OS_INTERFACE
2408	if (pBundle->aMem[i].MemObj == NIL_RTR0MEMOBJ)
2409	#else /* !USE_NEW_OS_INTERFACE */
2410	if ( !pBundle->aMem[i].pvR0
2411	&& !pBundle->aMem[i].pvR3)
2412	#endif /* !USE_NEW_OS_INTERFACE */
2413	{
2414	pBundle->cUsed++;
2415	pBundle->aMem[i] = *pMem;
2416	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2417	return 0;
2418	}
2419	}
2420	AssertFailed(); /* !!this can't be happening!!! */
2421	}
2422	}
2423	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2424
2425	/*
2426	* Need to allocate a new bundle.
2427	* Insert into the last entry in the bundle.
2428	*/
2429	pBundle = (PSUPDRVBUNDLE)RTMemAlloc(sizeof(*pBundle));
2430	if (!pBundle)
2431	return SUPDRV_ERR_NO_MEMORY;
2432	memset(pBundle, 0, sizeof(*pBundle));
2433
2434	/* take last entry. */
2435	pBundle->cUsed++;
2436	pBundle->aMem[sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]) - 1] = *pMem;
2437
2438	/* insert into list. */
2439	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2440	pBundle->pNext = pSession->Bundle.pNext;
2441	pSession->Bundle.pNext = pBundle;
2442	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2443
2444	return 0;
2445	}
2446
2447
2448	/**
2449	* Releases a memory object referenced by pointer and type.
2450	*
2451	* @returns 0 on success.
2452	* @returns SUPDRV_ERR_INVALID_PARAM on failure.
2453	* @param pSession Session data.
2454	* @param pv Pointer to memory. This is matched against both the R0 and R3 addresses.
2455	* @param eType Memory type.
2456	*/
2457	static int supdrvMemRelease(PSUPDRVSESSION pSession, void *pv, SUPDRVMEMREFTYPE eType)
2458	{
2459	PSUPDRVBUNDLE pBundle;
2460	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2461
2462	/*
2463	* Validate input.
2464	*/
2465	if (!pSession)
2466	{
2467	dprintf(("pSession must not be NULL!"));
2468	return SUPDRV_ERR_INVALID_PARAM;
2469	}
2470	if (!pv)
2471	{
2472	dprintf(("Illegal address %p\n", pv));
2473	return SUPDRV_ERR_INVALID_PARAM;
2474	}
2475
2476	/*
2477	* Search for the address.
2478	*/
2479	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2480	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2481	{
2482	if (pBundle->cUsed > 0)
2483	{
2484	unsigned i;
2485	for (i = 0; i < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]); i++)
2486	{
2487	#ifdef USE_NEW_OS_INTERFACE
2488	if ( pBundle->aMem[i].eType == eType
2489	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2490	&& ( RTR0MemObjAddress(pBundle->aMem[i].MemObj) == pv
2491	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2492	&& RTR0MemObjAddress(pBundle->aMem[i].MapObjR3) == pv))
2493	)
2494	{
2495	/* Make a copy of it and release it outside the spinlock. */
2496	SUPDRVMEMREF Mem = pBundle->aMem[i];
2497	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
2498	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
2499	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
2500	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2501
2502	if (Mem.MapObjR3)
2503	{
2504	int rc = RTR0MemObjFree(Mem.MapObjR3, false);
2505	AssertRC(rc); /** @todo figure out how to handle this. */
2506	}
2507	if (Mem.MemObj)
2508	{
2509	int rc = RTR0MemObjFree(Mem.MemObj, false);
2510	AssertRC(rc); /** @todo figure out how to handle this. */
2511	}
2512	return 0;
2513	}
2514	#else /* !USE_NEW_OS_INTERFACE */
2515	if ( pBundle->aMem[i].eType == eType
2516	&& ( pBundle->aMem[i].pvR0 == pv
2517	\|\| pBundle->aMem[i].pvR3 == pv))
2518	{
2519	/* Make a copy of it and release it outside the spinlock. */
2520	SUPDRVMEMREF Mem = pBundle->aMem[i];
2521	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
2522	pBundle->aMem[i].pvR0 = NULL;
2523	pBundle->aMem[i].pvR3 = NULL;
2524	pBundle->aMem[i].cb = 0;
2525	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2526
2527	/* Type specific free operation. */
2528	switch (Mem.eType)
2529	{
2530	case MEMREF_TYPE_LOCKED:
2531	supdrvOSUnlockMemOne(&Mem);
2532	break;
2533	case MEMREF_TYPE_CONT:
2534	supdrvOSContFreeOne(&Mem);
2535	break;
2536	case MEMREF_TYPE_LOW:
2537	supdrvOSLowFreeOne(&Mem);
2538	break;
2539	case MEMREF_TYPE_MEM:
2540	supdrvOSMemFreeOne(&Mem);
2541	break;
2542	default:
2543	case MEMREF_TYPE_UNUSED:
2544	break;
2545	}
2546	return 0;
2547	}
2548	#endif /* !USE_NEW_OS_INTERFACE */
2549	}
2550	}
2551	}
2552	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2553	dprintf(("Failed to find %p!!! (eType=%d)\n", pv, eType));
2554	return SUPDRV_ERR_INVALID_PARAM;
2555	}
2556
2557
2558	#ifndef VBOX_WITHOUT_IDT_PATCHING
2559	/**
2560	* Install IDT for the current CPU.
2561	*
2562	* @returns 0 on success.
2563	* @returns SUPDRV_ERR_NO_MEMORY or SUPDRV_ERROR_IDT_FAILED on failure.
2564	* @param pIn Input data.
2565	* @param pOut Output data.
2566	*/
2567	static int supdrvIOCtl_IdtInstall(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPIDTINSTALL_IN pIn, PSUPIDTINSTALL_OUT pOut)
2568	{
2569	PSUPDRVPATCHUSAGE pUsagePre;
2570	PSUPDRVPATCH pPatchPre;
2571	RTIDTR Idtr;
2572	PSUPDRVPATCH pPatch;
2573	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2574	dprintf(("supdrvIOCtl_IdtInstall\n"));
2575
2576	/*
2577	* Preallocate entry for this CPU cause we don't wanna do
2578	* that inside the spinlock!
2579	*/
2580	pUsagePre = (PSUPDRVPATCHUSAGE)RTMemAlloc(sizeof(*pUsagePre));
2581	if (!pUsagePre)
2582	return SUPDRV_ERR_NO_MEMORY;
2583
2584	/*
2585	* Take the spinlock and see what we need to do.
2586	*/
2587	RTSpinlockAcquireNoInts(pDevExt->Spinlock, &SpinlockTmp);
2588
2589	/* check if we already got a free patch. */
2590	if (!pDevExt->pIdtPatchesFree)
2591	{
2592	/*
2593	* Allocate a patch - outside the spinlock of course.
2594	*/
2595	RTSpinlockReleaseNoInts(pDevExt->Spinlock, &SpinlockTmp);
2596
2597	pPatchPre = (PSUPDRVPATCH)RTMemExecAlloc(sizeof(*pPatchPre));
2598	if (!pPatchPre)
2599	return SUPDRV_ERR_NO_MEMORY;
2600
2601	RTSpinlockAcquireNoInts(pDevExt->Spinlock, &SpinlockTmp);
2602	}
2603	else
2604	{
2605	pPatchPre = pDevExt->pIdtPatchesFree;
2606	pDevExt->pIdtPatchesFree = pPatchPre->pNext;
2607	}
2608
2609	/* look for matching patch entry */
2610	ASMGetIDTR(&Idtr);
2611	pPatch = pDevExt->pIdtPatches;
2612	while (pPatch && pPatch->pvIdt != (void *)Idtr.pIdt)
2613	pPatch = pPatch->pNext;
2614
2615	if (!pPatch)
2616	{
2617	/*
2618	* Create patch.
2619	*/
2620	pPatch = supdrvIdtPatchOne(pDevExt, pPatchPre);
2621	if (pPatch)
2622	pPatchPre = NULL; /* mark as used. */
2623	}
2624	else
2625	{
2626	/*
2627	* Simply increment patch usage.
2628	*/
2629	pPatch->cUsage++;
2630	}
2631
2632	if (pPatch)
2633	{
2634	/*
2635	* Increment and add if need be the session usage record for this patch.
2636	*/
2637	PSUPDRVPATCHUSAGE pUsage = pSession->pPatchUsage;
2638	while (pUsage && pUsage->pPatch != pPatch)
2639	pUsage = pUsage->pNext;
2640
2641	if (!pUsage)
2642	{
2643	/*
2644	* Add usage record.
2645	*/
2646	pUsagePre->cUsage = 1;
2647	pUsagePre->pPatch = pPatch;
2648	pUsagePre->pNext = pSession->pPatchUsage;
2649	pSession->pPatchUsage = pUsagePre;
2650	pUsagePre = NULL; /* mark as used. */
2651	}
2652	else
2653	{
2654	/*
2655	* Increment usage count.
2656	*/
2657	pUsage->cUsage++;
2658	}
2659	}
2660
2661	/* free patch - we accumulate them for paranoid saftly reasons. */
2662	if (pPatchPre)
2663	{
2664	pPatchPre->pNext = pDevExt->pIdtPatchesFree;
2665	pDevExt->pIdtPatchesFree = pPatchPre;
2666	}
2667
2668	RTSpinlockReleaseNoInts(pDevExt->Spinlock, &SpinlockTmp);
2669
2670	/*
2671	* Free unused preallocated buffers.
2672	*/
2673	if (pUsagePre)
2674	RTMemFree(pUsagePre);
2675
2676	pOut->u8Idt = pDevExt->u8Idt;
2677
2678	return pPatch ? 0 : SUPDRV_ERR_IDT_FAILED;
2679	}
2680
2681
2682	/**
2683	* This creates a IDT patch entry.
2684	* If the first patch being installed it'll also determin the IDT entry
2685	* to use.
2686	*
2687	* @returns pPatch on success.
2688	* @returns NULL on failure.
2689	* @param pDevExt Pointer to globals.
2690	* @param pPatch Patch entry to use.
2691	* This will be linked into SUPDRVDEVEXT::pIdtPatches on
2692	* successful return.
2693	* @remark Call must be owning the SUPDRVDEVEXT::Spinlock!
2694	*/
2695	static PSUPDRVPATCH supdrvIdtPatchOne(PSUPDRVDEVEXT pDevExt, PSUPDRVPATCH pPatch)
2696	{
2697	RTIDTR Idtr;
2698	PSUPDRVIDTE paIdt;
2699	dprintf(("supdrvIOCtl_IdtPatchOne: pPatch=%p\n", pPatch));
2700
2701	/*
2702	* Get IDT.
2703	*/
2704	ASMGetIDTR(&Idtr);
2705	paIdt = (PSUPDRVIDTE)Idtr.pIdt;
2706	if ((uintptr_t)paIdt < 0x80000000)
2707	{
2708	AssertMsgFailed(("bad paIdt=%p\n", paIdt));
2709	return NULL;
2710	}
2711
2712	if (!pDevExt->u8Idt)
2713	{
2714	/*
2715	* Test out the alternatives.
2716	*
2717	* At the moment we do not support chaining thus we ASSUME that one of
2718	* these 48 entries is unused (which is not a problem on Win32 and
2719	* Linux to my knowledge).
2720	*/
2721	/** @todo we MUST change this detection to try grab an entry which is NOT in use. This can be
2722	* combined with gathering info about which guest system call gates we can hook up directly. */
2723	unsigned i;
2724	uint8_t u8Idt = 0;
2725	static uint8_t au8Ints[] =
2726	{
2727	#ifdef __WIN__ /* We don't use 0xef and above because they are system stuff on linux (ef is IPI,
2728	* local apic timer, or some other frequently fireing thing). */
2729	0xef, 0xee, 0xed, 0xec,
2730	#endif
2731	0xeb, 0xea, 0xe9, 0xe8,
2732	0xdf, 0xde, 0xdd, 0xdc,
2733	0x7b, 0x7a, 0x79, 0x78,
2734	0xbf, 0xbe, 0xbd, 0xbc,
2735	};
2736	#if defined(__AMD64__)
2737	dprintf(("IDT: Idtr=%p:%#x\n", (void *)Idtr.pIdt, (unsigned)Idtr.cbIdt));
2738	for (i = 0; i*16+15 < Idtr.cbIdt; i++)
2739	{
2740	dprintf(("%#x: %04x:%08x%04x%04x P=%d DPL=%d IST=%d Type1=%#x u32Reserved=%#x u5Reserved=%#x\n",
2741	i, paIdt[i].u16SegSel, paIdt[i].u32OffsetTop, paIdt[i].u16OffsetHigh, paIdt[i].u16OffsetLow,
2742	paIdt[i].u1Present, paIdt[i].u2DPL, paIdt[i].u3IST, paIdt[i].u5Type2,
2743	paIdt[i].u32Reserved, paIdt[i].u5Reserved));
2744	}
2745	#endif
2746	/* look for entries which are not present or otherwise unused. */
2747	for (i = 0; i < sizeof(au8Ints) / sizeof(au8Ints[0]); i++)
2748	{
2749	u8Idt = au8Ints[i];
2750	if ( u8Idt * sizeof(SUPDRVIDTE) < Idtr.cbIdt
2751	&& ( !paIdt[u8Idt].u1Present
2752	\|\| paIdt[u8Idt].u5Type2 == 0))
2753	break;
2754	u8Idt = 0;
2755	}
2756	if (!u8Idt)
2757	{
2758	/* try again, look for a compatible entry .*/
2759	for (i = 0; i < sizeof(au8Ints) / sizeof(au8Ints[0]); i++)
2760	{
2761	u8Idt = au8Ints[i];
2762	if ( u8Idt * sizeof(SUPDRVIDTE) < Idtr.cbIdt
2763	&& paIdt[u8Idt].u1Present
2764	&& paIdt[u8Idt].u5Type2 == SUPDRV_IDTE_TYPE2_INTERRUPT_GATE
2765	&& !(paIdt[u8Idt].u16SegSel & 3))
2766	break;
2767	u8Idt = 0;
2768	}
2769	if (!u8Idt)
2770	{
2771	dprintf(("Failed to find appropirate IDT entry!!\n"));
2772	return NULL;
2773	}
2774	}
2775	pDevExt->u8Idt = u8Idt;
2776	dprintf(("supdrvIOCtl_IdtPatchOne: u8Idt=%x\n", u8Idt));
2777	}
2778
2779	/*
2780	* Prepare the patch
2781	*/
2782	memset(pPatch, 0, sizeof(*pPatch));
2783	pPatch->pvIdt = paIdt;
2784	pPatch->cUsage = 1;
2785	pPatch->pIdtEntry = &paIdt[pDevExt->u8Idt];
2786	pPatch->SavedIdt = paIdt[pDevExt->u8Idt];
2787	pPatch->ChangedIdt.u16OffsetLow = (uint32_t)((uintptr_t)&pPatch->auCode[0] & 0xffff);
2788	pPatch->ChangedIdt.u16OffsetHigh = (uint32_t)((uintptr_t)&pPatch->auCode[0] >> 16);
2789	#ifdef __AMD64__
2790	pPatch->ChangedIdt.u32OffsetTop = (uint32_t)((uintptr_t)&pPatch->auCode[0] >> 32);
2791	#endif
2792	pPatch->ChangedIdt.u16SegSel = ASMGetCS();
2793	#ifdef __AMD64__
2794	pPatch->ChangedIdt.u3IST = 0;
2795	pPatch->ChangedIdt.u5Reserved = 0;
2796	#else /* x86 */
2797	pPatch->ChangedIdt.u5Reserved = 0;
2798	pPatch->ChangedIdt.u3Type1 = 0;
2799	#endif /* x86 */
2800	pPatch->ChangedIdt.u5Type2 = SUPDRV_IDTE_TYPE2_INTERRUPT_GATE;
2801	pPatch->ChangedIdt.u2DPL = 3;
2802	pPatch->ChangedIdt.u1Present = 1;
2803
2804	/*
2805	* Generate the patch code.
2806	*/
2807	{
2808	#ifdef __AMD64__
2809	union
2810	{
2811	uint8_t *pb;
2812	uint32_t *pu32;
2813	uint64_t *pu64;
2814	} u, uFixJmp, uFixCall, uNotNested;
2815	u.pb = &pPatch->auCode[0];
2816
2817	/* check the cookie */
2818	*u.pb++ = 0x3d; // cmp eax, GLOBALCOOKIE
2819	*u.pu32++ = pDevExt->u32Cookie;
2820
2821	*u.pb++ = 0x74; // jz @VBoxCall
2822	*u.pb++ = 2;
2823
2824	/* jump to forwarder code. */
2825	*u.pb++ = 0xeb;
2826	uFixJmp = u;
2827	*u.pb++ = 0xfe;
2828
2829	// @VBoxCall:
2830	*u.pb++ = 0x0f; // swapgs
2831	*u.pb++ = 0x01;
2832	*u.pb++ = 0xf8;
2833
2834	/*
2835	* Call VMMR0Entry
2836	* We don't have to push the arguments here, but we have to
2837	* reserve some stack space for the interrupt forwarding.
2838	*/
2839	# ifdef __WIN__
2840	*u.pb++ = 0x50; // push rax ; alignment filler.
2841	*u.pb++ = 0x41; // push r8 ; uArg
2842	*u.pb++ = 0x50;
2843	*u.pb++ = 0x52; // push rdx ; uOperation
2844	*u.pb++ = 0x51; // push rcx ; pVM
2845	# else
2846	*u.pb++ = 0x51; // push rcx ; alignment filler.
2847	*u.pb++ = 0x52; // push rdx ; uArg
2848	*u.pb++ = 0x56; // push rsi ; uOperation
2849	*u.pb++ = 0x57; // push rdi ; pVM
2850	# endif
2851
2852	*u.pb++ = 0xff; // call qword [pfnVMMR0Entry wrt rip]
2853	*u.pb++ = 0x15;
2854	uFixCall = u;
2855	*u.pu32++ = 0;
2856
2857	*u.pb++ = 0x48; // add rsp, 20h ; remove call frame.
2858	*u.pb++ = 0x81;
2859	*u.pb++ = 0xc4;
2860	*u.pu32++ = 0x20;
2861
2862	*u.pb++ = 0x0f; // swapgs
2863	*u.pb++ = 0x01;
2864	*u.pb++ = 0xf8;
2865
2866	/* Return to R3. */
2867	uNotNested = u;
2868	*u.pb++ = 0x48; // iretq
2869	*u.pb++ = 0xcf;
2870
2871	while ((uintptr_t)u.pb & 0x7) // align 8
2872	*u.pb++ = 0xcc;
2873
2874	/* Pointer to the VMMR0Entry. */ // pfnVMMR0Entry dq StubVMMR0Entry
2875	*uFixCall.pu32 = (uint32_t)(u.pb - uFixCall.pb - 4); uFixCall.pb = NULL;
2876	pPatch->offVMMR0EntryFixup = (uint16_t)(u.pb - &pPatch->auCode[0]);
2877	*u.pu64++ = pDevExt->pvVMMR0 ? (uint64_t)pDevExt->pfnVMMR0Entry : (uint64_t)u.pb + 8;
2878
2879	/* stub entry. */ // StubVMMR0Entry:
2880	pPatch->offStub = (uint16_t)(u.pb - &pPatch->auCode[0]);
2881	*u.pb++ = 0x33; // xor eax, eax
2882	*u.pb++ = 0xc0;
2883
2884	*u.pb++ = 0x48; // dec rax
2885	*u.pb++ = 0xff;
2886	*u.pb++ = 0xc8;
2887
2888	*u.pb++ = 0xc3; // ret
2889
2890	/* forward to the original handler using a retf. */
2891	*uFixJmp.pb = (uint8_t)(u.pb - uFixJmp.pb - 1); uFixJmp.pb = NULL;
2892
2893	*u.pb++ = 0x68; // push <target cs>
2894	*u.pu32++ = !pPatch->SavedIdt.u5Type2 ? ASMGetCS() : pPatch->SavedIdt.u16SegSel;
2895
2896	*u.pb++ = 0x68; // push <low target rip>
2897	*u.pu32++ = !pPatch->SavedIdt.u5Type2
2898	? (uint32_t)(uintptr_t)uNotNested.pb
2899	: (uint32_t)pPatch->SavedIdt.u16OffsetLow
2900	\| (uint32_t)pPatch->SavedIdt.u16OffsetHigh << 16;
2901
2902	*u.pb++ = 0xc7; // mov dword [rsp + 4], <high target rip>
2903	*u.pb++ = 0x44;
2904	*u.pb++ = 0x24;
2905	*u.pb++ = 0x04;
2906	*u.pu32++ = !pPatch->SavedIdt.u5Type2
2907	? (uint32_t)((uint64_t)uNotNested.pb >> 32)
2908	: pPatch->SavedIdt.u32OffsetTop;
2909
2910	*u.pb++ = 0x48; // retf ; does this require prefix?
2911	*u.pb++ = 0xcb;
2912
2913	#else /* __X86__ */
2914
2915	union
2916	{
2917	uint8_t *pb;
2918	uint16_t *pu16;
2919	uint32_t *pu32;
2920	} u, uFixJmpNotNested, uFixJmp, uFixCall, uNotNested;
2921	u.pb = &pPatch->auCode[0];
2922
2923	/* check the cookie */
2924	*u.pb++ = 0x81; // cmp esi, GLOBALCOOKIE
2925	*u.pb++ = 0xfe;
2926	*u.pu32++ = pDevExt->u32Cookie;
2927
2928	*u.pb++ = 0x74; // jz VBoxCall
2929	uFixJmp = u;
2930	*u.pb++ = 0;
2931
2932	/* jump (far) to the original handler / not-nested-stub. */
2933	*u.pb++ = 0xea; // jmp far NotNested
2934	uFixJmpNotNested = u;
2935	*u.pu32++ = 0;
2936	*u.pu16++ = 0;
2937
2938	/* save selector registers. */ // VBoxCall:
2939	*uFixJmp.pb = (uint8_t)(u.pb - uFixJmp.pb - 1);
2940	*u.pb++ = 0x0f; // push fs
2941	*u.pb++ = 0xa0;
2942
2943	*u.pb++ = 0x1e; // push ds
2944
2945	*u.pb++ = 0x06; // push es
2946
2947	/* call frame */
2948	*u.pb++ = 0x51; // push ecx
2949
2950	*u.pb++ = 0x52; // push edx
2951
2952	*u.pb++ = 0x50; // push eax
2953
2954	/* load ds, es and perhaps fs before call. */
2955	*u.pb++ = 0xb8; // mov eax, KernelDS
2956	*u.pu32++ = ASMGetDS();
2957
2958	*u.pb++ = 0x8e; // mov ds, eax
2959	*u.pb++ = 0xd8;
2960
2961	*u.pb++ = 0x8e; // mov es, eax
2962	*u.pb++ = 0xc0;
2963
2964	#ifdef __WIN__
2965	*u.pb++ = 0xb8; // mov eax, KernelFS
2966	*u.pu32++ = ASMGetFS();
2967
2968	*u.pb++ = 0x8e; // mov fs, eax
2969	*u.pb++ = 0xe0;
2970	#endif
2971
2972	/* do the call. */
2973	*u.pb++ = 0xe8; // call _VMMR0Entry / StubVMMR0Entry
2974	uFixCall = u;
2975	pPatch->offVMMR0EntryFixup = (uint16_t)(u.pb - &pPatch->auCode[0]);
2976	*u.pu32++ = 0xfffffffb;
2977
2978	*u.pb++ = 0x83; // add esp, 0ch ; cdecl
2979	*u.pb++ = 0xc4;
2980	*u.pb++ = 0x0c;
2981
2982	/* restore selector registers. */
2983	*u.pb++ = 0x07; // pop es
2984	//
2985	*u.pb++ = 0x1f; // pop ds
2986
2987	*u.pb++ = 0x0f; // pop fs
2988	*u.pb++ = 0xa1;
2989
2990	uNotNested = u; // NotNested:
2991	*u.pb++ = 0xcf; // iretd
2992
2993	/* the stub VMMR0Entry. */ // StubVMMR0Entry:
2994	pPatch->offStub = (uint16_t)(u.pb - &pPatch->auCode[0]);
2995	*u.pb++ = 0x33; // xor eax, eax
2996	*u.pb++ = 0xc0;
2997
2998	*u.pb++ = 0x48; // dec eax
2999
3000	*u.pb++ = 0xc3; // ret
3001
3002	/* Fixup the VMMR0Entry call. */
3003	if (pDevExt->pvVMMR0)
3004	*uFixCall.pu32 = (uint32_t)pDevExt->pfnVMMR0Entry - (uint32_t)(uFixCall.pu32 + 1);
3005	else
3006	*uFixCall.pu32 = (uint32_t)&pPatch->auCode[pPatch->offStub] - (uint32_t)(uFixCall.pu32 + 1);
3007
3008	/* Fixup the forward / nested far jump. */
3009	if (!pPatch->SavedIdt.u5Type2)
3010	{
3011	*uFixJmpNotNested.pu32++ = (uint32_t)uNotNested.pb;
3012	*uFixJmpNotNested.pu16++ = ASMGetCS();
3013	}
3014	else
3015	{
3016	*uFixJmpNotNested.pu32++ = ((uint32_t)pPatch->SavedIdt.u16OffsetHigh << 16) \| pPatch->SavedIdt.u16OffsetLow;
3017	*uFixJmpNotNested.pu16++ = pPatch->SavedIdt.u16SegSel;
3018	}
3019	#endif /* __X86__ */
3020	Assert(u.pb <= &pPatch->auCode[sizeof(pPatch->auCode)]);
3021	#if 0
3022	/* dump the patch code */
3023	dprintf(("patch code: %p\n", &pPatch->auCode[0]));
3024	for (uFixCall.pb = &pPatch->auCode[0]; uFixCall.pb < u.pb; uFixCall.pb++)
3025	dprintf(("0x%02x,\n", *uFixCall.pb));
3026	#endif
3027	}
3028
3029	/*
3030	* Install the patch.
3031	*/
3032	supdrvIdtWrite(pPatch->pIdtEntry, &pPatch->ChangedIdt);
3033	AssertMsg(!memcmp((void *)pPatch->pIdtEntry, &pPatch->ChangedIdt, sizeof(pPatch->ChangedIdt)), ("The stupid change code didn't work!!!!!\n"));
3034
3035	/*
3036	* Link in the patch.
3037	*/
3038	pPatch->pNext = pDevExt->pIdtPatches;
3039	pDevExt->pIdtPatches = pPatch;
3040
3041	return pPatch;
3042	}
3043
3044
3045	/**
3046	* Removes the sessions IDT references.
3047	* This will uninstall our IDT patch if we left unreferenced.
3048	*
3049	* @returns 0 indicating success.
3050	* @param pDevExt Device globals.
3051	* @param pSession Session data.
3052	*/
3053	static int supdrvIOCtl_IdtRemoveAll(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
3054	{
3055	PSUPDRVPATCHUSAGE pUsage;
3056	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3057	dprintf(("supdrvIOCtl_IdtRemoveAll: pSession=%p\n", pSession));
3058
3059	/*
3060	* Take the spinlock.
3061	*/
3062	RTSpinlockAcquireNoInts(pDevExt->Spinlock, &SpinlockTmp);
3063
3064	/*
3065	* Walk usage list.
3066	*/
3067	pUsage = pSession->pPatchUsage;
3068	while (pUsage)
3069	{
3070	if (pUsage->pPatch->cUsage <= pUsage->cUsage)
3071	supdrvIdtRemoveOne(pDevExt, pUsage->pPatch);
3072	else
3073	pUsage->pPatch->cUsage -= pUsage->cUsage;
3074
3075	/* next */
3076	pUsage = pUsage->pNext;
3077	}
3078
3079	/*
3080	* Empty the usage chain and we're done inside the spinlock.
3081	*/
3082	pUsage = pSession->pPatchUsage;
3083	pSession->pPatchUsage = NULL;
3084
3085	RTSpinlockReleaseNoInts(pDevExt->Spinlock, &SpinlockTmp);
3086
3087	/*
3088	* Free usage entries.
3089	*/
3090	while (pUsage)
3091	{
3092	void *pvToFree = pUsage;
3093	pUsage->cUsage = 0;
3094	pUsage->pPatch = NULL;
3095	pUsage = pUsage->pNext;
3096	RTMemFree(pvToFree);
3097	}
3098
3099	return 0;
3100	}
3101
3102
3103	/**
3104	* Remove one patch.
3105	*
3106	* @param pDevExt Device globals.
3107	* @param pPatch Patch entry to remove.
3108	* @remark Caller must own SUPDRVDEVEXT::Spinlock!
3109	*/
3110	static void supdrvIdtRemoveOne(PSUPDRVDEVEXT pDevExt, PSUPDRVPATCH pPatch)
3111	{
3112	dprintf(("supdrvIdtRemoveOne: pPatch=%p\n", pPatch));
3113
3114	pPatch->cUsage = 0;
3115
3116	/*
3117	* If the IDT entry was changed it have to kick around for ever!
3118	* This will be attempted freed again, perhaps next time we'll succeed :-)
3119	*/
3120	if (memcmp((void *)pPatch->pIdtEntry, &pPatch->ChangedIdt, sizeof(pPatch->ChangedIdt)))
3121	{
3122	AssertMsgFailed(("The hijacked IDT entry has CHANGED!!!\n"));
3123	return;
3124	}
3125
3126	/*
3127	* Unlink it.
3128	*/
3129	if (pDevExt->pIdtPatches != pPatch)
3130	{
3131	PSUPDRVPATCH pPatchPrev = pDevExt->pIdtPatches;
3132	while (pPatchPrev)
3133	{
3134	if (pPatchPrev->pNext == pPatch)
3135	{
3136	pPatchPrev->pNext = pPatch->pNext;
3137	break;
3138	}
3139	pPatchPrev = pPatchPrev->pNext;
3140	}
3141	Assert(!pPatchPrev);
3142	}
3143	else
3144	pDevExt->pIdtPatches = pPatch->pNext;
3145	pPatch->pNext = NULL;
3146
3147
3148	/*
3149	* Verify and restore the IDT.
3150	*/
3151	AssertMsg(!memcmp((void *)pPatch->pIdtEntry, &pPatch->ChangedIdt, sizeof(pPatch->ChangedIdt)), ("The hijacked IDT entry has CHANGED!!!\n"));
3152	supdrvIdtWrite(pPatch->pIdtEntry, &pPatch->SavedIdt);
3153	AssertMsg(!memcmp((void *)pPatch->pIdtEntry, &pPatch->SavedIdt, sizeof(pPatch->SavedIdt)), ("The hijacked IDT entry has CHANGED!!!\n"));
3154
3155	/*
3156	* Put it in the free list.
3157	* (This free list stuff is to calm my paranoia.)
3158	*/
3159	pPatch->pvIdt = NULL;
3160	pPatch->pIdtEntry = NULL;
3161
3162	pPatch->pNext = pDevExt->pIdtPatchesFree;
3163	pDevExt->pIdtPatchesFree = pPatch;
3164	}
3165
3166
3167	/**
3168	* Write to an IDT entry.
3169	*
3170	* @param pvIdtEntry Where to write.
3171	* @param pNewIDTEntry What to write.
3172	*/
3173	static void supdrvIdtWrite(volatile void pvIdtEntry, const SUPDRVIDTE pNewIDTEntry)
3174	{
3175	RTUINTREG uCR0;
3176	RTUINTREG uFlags;
3177
3178	/*
3179	* On SMP machines (P4 hyperthreading included) we must preform a
3180	* 64-bit locked write when updating the IDT entry.
3181	*
3182	* The F00F bugfix for linux (and probably other OSes) causes
3183	* the IDT to be pointing to an readonly mapping. We get around that
3184	* by temporarily turning of WP. Since we're inside a spinlock at this
3185	* point, interrupts are disabled and there isn't any way the WP bit
3186	* flipping can cause any trouble.
3187	*/
3188
3189	/* Save & Clear interrupt flag; Save & clear WP. */
3190	uFlags = ASMGetFlags();
3191	ASMSetFlags(uFlags & ~(RTUINTREG)(1 << 9)); /X86_EFL_IF/
3192	Assert(!(ASMGetFlags() & (1 << 9)));
3193	uCR0 = ASMGetCR0();
3194	ASMSetCR0(uCR0 & ~(RTUINTREG)(1 << 16)); /X86_CR0_WP/
3195
3196	/* Update IDT Entry */
3197	#ifdef __AMD64__
3198	ASMAtomicXchgU128((volatile uint128_t )pvIdtEntry, (uint128_t *)(uintptr_t)pNewIDTEntry);
3199	#else
3200	ASMAtomicXchgU64((volatile uint64_t )pvIdtEntry, (uint64_t *)(uintptr_t)pNewIDTEntry);
3201	#endif
3202
3203	/* Restore CR0 & Flags */
3204	ASMSetCR0(uCR0);
3205	ASMSetFlags(uFlags);
3206	}
3207	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
3208
3209
3210	/**
3211	* Opens an image. If it's the first time it's opened the call must upload
3212	* the bits using the supdrvIOCtl_LdrLoad() / SUPDRV_IOCTL_LDR_LOAD function.
3213	*
3214	* This is the 1st step of the loading.
3215	*
3216	* @returns 0 on success.
3217	* @returns SUPDRV_ERR_* on failure.
3218	* @param pDevExt Device globals.
3219	* @param pSession Session data.
3220	* @param pIn Input.
3221	* @param pOut Output. (May overlap pIn.)
3222	*/
3223	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN_IN pIn, PSUPLDROPEN_OUT pOut)
3224	{
3225	PSUPDRVLDRIMAGE pImage;
3226	unsigned cb;
3227	void *pv;
3228	dprintf(("supdrvIOCtl_LdrOpen: szName=%s cbImage=%d\n", pIn->szName, pIn->cbImage));
3229
3230	/*
3231	* Check if we got an instance of the image already.
3232	*/
3233	RTSemFastMutexRequest(pDevExt->mtxLdr);
3234	for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
3235	{
3236	if (!strcmp(pImage->szName, pIn->szName))
3237	{
3238	pImage->cUsage++;
3239	pOut->pvImageBase = pImage->pvImage;
3240	pOut->fNeedsLoading = pImage->uState == SUP_IOCTL_LDR_OPEN;
3241	supdrvLdrAddUsage(pSession, pImage);
3242	RTSemFastMutexRelease(pDevExt->mtxLdr);
3243	return 0;
3244	}
3245	}
3246	/* (not found - add it!) */
3247
3248	/*
3249	* Allocate memory.
3250	*/
3251	cb = pIn->cbImage + sizeof(SUPDRVLDRIMAGE) + 31;
3252	pv = RTMemExecAlloc(cb);
3253	if (!pv)
3254	{
3255	RTSemFastMutexRelease(pDevExt->mtxLdr);
3256	return SUPDRV_ERR_NO_MEMORY;
3257	}
3258
3259	/*
3260	* Setup and link in the LDR stuff.
3261	*/
3262	pImage = (PSUPDRVLDRIMAGE)pv;
3263	pImage->pvImage = ALIGNP(pImage + 1, 32);
3264	pImage->cbImage = pIn->cbImage;
3265	pImage->pfnModuleInit = NULL;
3266	pImage->pfnModuleTerm = NULL;
3267	pImage->uState = SUP_IOCTL_LDR_OPEN;
3268	pImage->cUsage = 1;
3269	strcpy(pImage->szName, pIn->szName);
3270
3271	pImage->pNext = pDevExt->pLdrImages;
3272	pDevExt->pLdrImages = pImage;
3273
3274	supdrvLdrAddUsage(pSession, pImage);
3275
3276	pOut->pvImageBase = pImage->pvImage;
3277	pOut->fNeedsLoading = 1;
3278	RTSemFastMutexRelease(pDevExt->mtxLdr);
3279	return 0;
3280	}
3281
3282
3283	/**
3284	* Loads the image bits.
3285	*
3286	* This is the 2nd step of the loading.
3287	*
3288	* @returns 0 on success.
3289	* @returns SUPDRV_ERR_* on failure.
3290	* @param pDevExt Device globals.
3291	* @param pSession Session data.
3292	* @param pIn Input.
3293	*/
3294	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD_IN pIn)
3295	{
3296	PSUPDRVLDRUSAGE pUsage;
3297	PSUPDRVLDRIMAGE pImage;
3298	int rc;
3299	dprintf(("supdrvIOCtl_LdrLoad: pvImageBase=%p cbImage=%d\n", pIn->pvImageBase, pIn->cbImage));
3300
3301	/*
3302	* Find the ldr image.
3303	*/
3304	RTSemFastMutexRequest(pDevExt->mtxLdr);
3305	pUsage = pSession->pLdrUsage;
3306	while (pUsage && pUsage->pImage->pvImage != pIn->pvImageBase)
3307	pUsage = pUsage->pNext;
3308	if (!pUsage)
3309	{
3310	RTSemFastMutexRelease(pDevExt->mtxLdr);
3311	dprintf(("SUP_IOCTL_LDR_LOAD: couldn't find image!\n"));
3312	return SUPDRV_ERR_INVALID_HANDLE;
3313	}
3314	pImage = pUsage->pImage;
3315	if (pImage->cbImage != pIn->cbImage)
3316	{
3317	RTSemFastMutexRelease(pDevExt->mtxLdr);
3318	dprintf(("SUP_IOCTL_LDR_LOAD: image size mismatch!! %d(prep) != %d(load)\n", pImage->cbImage, pIn->cbImage));
3319	return SUPDRV_ERR_INVALID_HANDLE;
3320	}
3321	if (pImage->uState != SUP_IOCTL_LDR_OPEN)
3322	{
3323	unsigned uState = pImage->uState;
3324	RTSemFastMutexRelease(pDevExt->mtxLdr);
3325	if (uState != SUP_IOCTL_LDR_LOAD)
3326	AssertMsgFailed(("SUP_IOCTL_LDR_LOAD: invalid image state %d (%#x)!\n", uState, uState));
3327	return SUPDRV_ERR_ALREADY_LOADED;
3328	}
3329	switch (pIn->eEPType)
3330	{
3331	case EP_NOTHING:
3332	break;
3333	case EP_VMMR0:
3334	if (!pIn->EP.VMMR0.pvVMMR0 \|\| !pIn->EP.VMMR0.pvVMMR0Entry)
3335	{
3336	RTSemFastMutexRelease(pDevExt->mtxLdr);
3337	dprintf(("pvVMMR0=%p or pIn->EP.VMMR0.pvVMMR0Entry=%p is NULL!\n",
3338	pIn->EP.VMMR0.pvVMMR0, pIn->EP.VMMR0.pvVMMR0Entry));
3339	return SUPDRV_ERR_INVALID_PARAM;
3340	}
3341	if ((uintptr_t)pIn->EP.VMMR0.pvVMMR0Entry - (uintptr_t)pImage->pvImage >= pIn->cbImage)
3342	{
3343	RTSemFastMutexRelease(pDevExt->mtxLdr);
3344	dprintf(("SUP_IOCTL_LDR_LOAD: pvVMMR0Entry=%p is outside the image (%p %d bytes)\n",
3345	pIn->EP.VMMR0.pvVMMR0Entry, pImage->pvImage, pIn->cbImage));
3346	return SUPDRV_ERR_INVALID_PARAM;
3347	}
3348	break;
3349	default:
3350	RTSemFastMutexRelease(pDevExt->mtxLdr);
3351	dprintf(("Invalid eEPType=%d\n", pIn->eEPType));
3352	return SUPDRV_ERR_INVALID_PARAM;
3353	}
3354	if ( pIn->pfnModuleInit
3355	&& (uintptr_t)pIn->pfnModuleInit - (uintptr_t)pImage->pvImage >= pIn->cbImage)
3356	{
3357	RTSemFastMutexRelease(pDevExt->mtxLdr);
3358	dprintf(("SUP_IOCTL_LDR_LOAD: pfnModuleInit=%p is outside the image (%p %d bytes)\n",
3359	pIn->pfnModuleInit, pImage->pvImage, pIn->cbImage));
3360	return SUPDRV_ERR_INVALID_PARAM;
3361	}
3362	if ( pIn->pfnModuleTerm
3363	&& (uintptr_t)pIn->pfnModuleTerm - (uintptr_t)pImage->pvImage >= pIn->cbImage)
3364	{
3365	RTSemFastMutexRelease(pDevExt->mtxLdr);
3366	dprintf(("SUP_IOCTL_LDR_LOAD: pfnModuleTerm=%p is outside the image (%p %d bytes)\n",
3367	pIn->pfnModuleTerm, pImage->pvImage, pIn->cbImage));
3368	return SUPDRV_ERR_INVALID_PARAM;
3369	}
3370
3371	/*
3372	* Copy the memory.
3373	*/
3374	/* no need to do try/except as this is a buffered request. */
3375	memcpy(pImage->pvImage, &pIn->achImage[0], pImage->cbImage);
3376	pImage->uState = SUP_IOCTL_LDR_LOAD;
3377	pImage->pfnModuleInit = pIn->pfnModuleInit;
3378	pImage->pfnModuleTerm = pIn->pfnModuleTerm;
3379	pImage->offSymbols = pIn->offSymbols;
3380	pImage->cSymbols = pIn->cSymbols;
3381	pImage->offStrTab = pIn->offStrTab;
3382	pImage->cbStrTab = pIn->cbStrTab;
3383
3384	/*
3385	* Update any entry points.
3386	*/
3387	switch (pIn->eEPType)
3388	{
3389	default:
3390	case EP_NOTHING:
3391	rc = 0;
3392	break;
3393	case EP_VMMR0:
3394	rc = supdrvLdrSetR0EP(pDevExt, pIn->EP.VMMR0.pvVMMR0, pIn->EP.VMMR0.pvVMMR0Entry);
3395	break;
3396	}
3397
3398	/*
3399	* On success call the module initialization.
3400	*/
3401	dprintf(("supdrvIOCtl_LdrLoad: pfnModuleInit=%p\n", pImage->pfnModuleInit));
3402	if (!rc && pImage->pfnModuleInit)
3403	{
3404	dprintf(("supdrvIOCtl_LdrLoad: calling pfnModuleInit=%p\n", pImage->pfnModuleInit));
3405	rc = pImage->pfnModuleInit();
3406	if (rc && pDevExt->pvVMMR0 == pImage->pvImage)
3407	supdrvLdrUnsetR0EP(pDevExt);
3408	}
3409
3410	if (rc)
3411	pImage->uState = SUP_IOCTL_LDR_OPEN;
3412
3413	RTSemFastMutexRelease(pDevExt->mtxLdr);
3414	return rc;
3415	}
3416
3417
3418	/**
3419	* Frees a previously loaded (prep'ed) image.
3420	*
3421	* @returns 0 on success.
3422	* @returns SUPDRV_ERR_* on failure.
3423	* @param pDevExt Device globals.
3424	* @param pSession Session data.
3425	* @param pIn Input.
3426	*/
3427	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE_IN pIn)
3428	{
3429	PSUPDRVLDRUSAGE pUsagePrev;
3430	PSUPDRVLDRUSAGE pUsage;
3431	PSUPDRVLDRIMAGE pImage;
3432	dprintf(("supdrvIOCtl_LdrFree: pvImageBase=%p\n", pIn->pvImageBase));
3433
3434	/*
3435	* Find the ldr image.
3436	*/
3437	RTSemFastMutexRequest(pDevExt->mtxLdr);
3438	pUsagePrev = NULL;
3439	pUsage = pSession->pLdrUsage;
3440	while (pUsage && pUsage->pImage->pvImage != pIn->pvImageBase)
3441	{
3442	pUsagePrev = pUsage;
3443	pUsage = pUsage->pNext;
3444	}
3445	if (!pUsage)
3446	{
3447	RTSemFastMutexRelease(pDevExt->mtxLdr);
3448	dprintf(("SUP_IOCTL_LDR_FREE: couldn't find image!\n"));
3449	return SUPDRV_ERR_INVALID_HANDLE;
3450	}
3451
3452	/*
3453	* Check if we can remove anything.
3454	*/
3455	pImage = pUsage->pImage;
3456	if (pImage->cUsage <= 1 \|\| pUsage->cUsage <= 1)
3457	{
3458	/* unlink it */
3459	if (pUsagePrev)
3460	pUsagePrev->pNext = pUsage->pNext;
3461	else
3462	pSession->pLdrUsage = pUsage->pNext;
3463	/* free it */
3464	pUsage->pImage = NULL;
3465	pUsage->pNext = NULL;
3466	RTMemFree(pUsage);
3467
3468	/*
3469	* Derefrence the image.
3470	*/
3471	if (pImage->cUsage <= 1)
3472	supdrvLdrFree(pDevExt, pImage);
3473	else
3474	pImage->cUsage--;
3475	}
3476	else
3477	{
3478	/*
3479	* Dereference both image and usage.
3480	*/
3481	pImage->cUsage--;
3482	pUsage->cUsage--;
3483	}
3484
3485	RTSemFastMutexRelease(pDevExt->mtxLdr);
3486	return 0;
3487	}
3488
3489
3490	/**
3491	* Gets the address of a symbol in an open image.
3492	*
3493	* @returns 0 on success.
3494	* @returns SUPDRV_ERR_* on failure.
3495	* @param pDevExt Device globals.
3496	* @param pSession Session data.
3497	* @param pIn Input.
3498	* @param pOut Output. (May overlap pIn.)
3499	*/
3500	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL_IN pIn, PSUPLDRGETSYMBOL_OUT pOut)
3501	{
3502	PSUPDRVLDRIMAGE pImage;
3503	PSUPDRVLDRUSAGE pUsage;
3504	uint32_t i;
3505	PSUPLDRSYM paSyms;
3506	const char *pchStrings;
3507	const size_t cbSymbol = strlen(pIn->szSymbol) + 1;
3508	void *pvSymbol = NULL;
3509	int rc = SUPDRV_ERR_GENERAL_FAILURE; /** @todo better error code. */
3510	dprintf2(("supdrvIOCtl_LdrGetSymbol: pvImageBase=%p szSymbol=\"%s\"\n", pIn->pvImageBase, pIn->szSymbol));
3511
3512	/*
3513	* Find the ldr image.
3514	*/
3515	RTSemFastMutexRequest(pDevExt->mtxLdr);
3516	pUsage = pSession->pLdrUsage;
3517	while (pUsage && pUsage->pImage->pvImage != pIn->pvImageBase)
3518	pUsage = pUsage->pNext;
3519	if (!pUsage)
3520	{
3521	RTSemFastMutexRelease(pDevExt->mtxLdr);
3522	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: couldn't find image!\n"));
3523	return SUPDRV_ERR_INVALID_HANDLE;
3524	}
3525	pImage = pUsage->pImage;
3526	if (pImage->uState != SUP_IOCTL_LDR_LOAD)
3527	{
3528	unsigned uState = pImage->uState;
3529	RTSemFastMutexRelease(pDevExt->mtxLdr);
3530	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: invalid image state %d (%#x)!\n", uState, uState)); NOREF(uState);
3531	return SUPDRV_ERR_ALREADY_LOADED;
3532	}
3533
3534	/*
3535	* Search the symbol string.
3536	*/
3537	pchStrings = (const char )((uint8_t )pImage->pvImage + pImage->offStrTab);
3538	paSyms = (PSUPLDRSYM)((uint8_t *)pImage->pvImage + pImage->offSymbols);
3539	for (i = 0; i < pImage->cSymbols; i++)
3540	{
3541	if ( paSyms[i].offSymbol < pImage->cbImage /* paranoia */
3542	&& paSyms[i].offName + cbSymbol <= pImage->cbStrTab
3543	&& !memcmp(pchStrings + paSyms[i].offName, pIn->szSymbol, cbSymbol))
3544	{
3545	pvSymbol = (uint8_t *)pImage->pvImage + paSyms[i].offSymbol;
3546	rc = 0;
3547	break;
3548	}
3549	}
3550	RTSemFastMutexRelease(pDevExt->mtxLdr);
3551	pOut->pvSymbol = pvSymbol;
3552	return rc;
3553	}
3554
3555
3556	/**
3557	* Updates the IDT patches to point to the specified VMM R0 entry
3558	* point (i.e. VMMR0Enter()).
3559	*
3560	* @returns 0 on success.
3561	* @returns SUPDRV_ERR_* on failure.
3562	* @param pDevExt Device globals.
3563	* @param pSession Session data.
3564	* @param pVMMR0 VMMR0 image handle.
3565	* @param pVMMR0Entry VMMR0Entry address.
3566	* @remark Caller must own the loader mutex.
3567	*/
3568	static int supdrvLdrSetR0EP(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0Entry)
3569	{
3570	int rc;
3571	dprintf(("supdrvLdrSetR0EP pvVMMR0=%p pvVMMR0Entry=%p\n", pvVMMR0, pvVMMR0Entry));
3572
3573
3574	/*
3575	* Check if not yet set.
3576	*/
3577	rc = 0;
3578	if (!pDevExt->pvVMMR0)
3579	{
3580	#ifndef VBOX_WITHOUT_IDT_PATCHING
3581	PSUPDRVPATCH pPatch;
3582	#endif
3583
3584	/*
3585	* Set it and update IDT patch code.
3586	*/
3587	pDevExt->pvVMMR0 = pvVMMR0;
3588	pDevExt->pfnVMMR0Entry = pvVMMR0Entry;
3589	#ifndef VBOX_WITHOUT_IDT_PATCHING
3590	for (pPatch = pDevExt->pIdtPatches; pPatch; pPatch = pPatch->pNext)
3591	{
3592	# ifdef __AMD64__
3593	ASMAtomicXchgU64((volatile uint64_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup], (uint64_t)pvVMMR0);
3594	# else /* __X86__ */
3595	ASMAtomicXchgU32((volatile uint32_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup],
3596	(uint32_t)pvVMMR0 - (uint32_t)&pPatch->auCode[pPatch->offVMMR0EntryFixup + 4]);
3597	# endif
3598	}
3599	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
3600	}
3601	else
3602	{
3603	/*
3604	* Return failure or success depending on whether the
3605	* values match or not.
3606	*/
3607	if ( pDevExt->pvVMMR0 != pvVMMR0
3608	\|\| (void *)pDevExt->pfnVMMR0Entry != pvVMMR0Entry)
3609	{
3610	AssertMsgFailed(("SUP_IOCTL_LDR_SETR0EP: Already set pointing to a different module!\n"));
3611	rc = SUPDRV_ERR_INVALID_PARAM;
3612	}
3613	}
3614	return rc;
3615	}
3616
3617
3618	/**
3619	* Unsets the R0 entry point installed by supdrvLdrSetR0EP.
3620	*
3621	* @param pDevExt Device globals.
3622	*/
3623	static void supdrvLdrUnsetR0EP(PSUPDRVDEVEXT pDevExt)
3624	{
3625	#ifndef VBOX_WITHOUT_IDT_PATCHING
3626	PSUPDRVPATCH pPatch;
3627	#endif
3628
3629	pDevExt->pvVMMR0 = NULL;
3630	pDevExt->pfnVMMR0Entry = NULL;
3631
3632	#ifndef VBOX_WITHOUT_IDT_PATCHING
3633	for (pPatch = pDevExt->pIdtPatches; pPatch; pPatch = pPatch->pNext)
3634	{
3635	# ifdef __AMD64__
3636	ASMAtomicXchgU64((volatile uint64_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup],
3637	(uint64_t)&pPatch->auCode[pPatch->offStub]);
3638	# else /* __X86__ */
3639	ASMAtomicXchgU32((volatile uint32_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup],
3640	(uint32_t)&pPatch->auCode[pPatch->offStub] - (uint32_t)&pPatch->auCode[pPatch->offVMMR0EntryFixup + 4]);
3641	# endif
3642	}
3643	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
3644	}
3645
3646
3647	/**
3648	* Adds a usage reference in the specified session of an image.
3649	*
3650	* @param pSession Session in question.
3651	* @param pImage Image which the session is using.
3652	*/
3653	static void supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage)
3654	{
3655	PSUPDRVLDRUSAGE pUsage;
3656	dprintf(("supdrvLdrAddUsage: pImage=%p\n", pImage));
3657
3658	/*
3659	* Referenced it already?
3660	*/
3661	pUsage = pSession->pLdrUsage;
3662	while (pUsage)
3663	{
3664	if (pUsage->pImage == pImage)
3665	{
3666	pUsage->cUsage++;
3667	return;
3668	}
3669	pUsage = pUsage->pNext;
3670	}
3671
3672	/*
3673	* Allocate new usage record.
3674	*/
3675	pUsage = (PSUPDRVLDRUSAGE)RTMemAlloc(sizeof(*pUsage));
3676	Assert(pUsage);
3677	if (pUsage)
3678	{
3679	pUsage->cUsage = 1;
3680	pUsage->pImage = pImage;
3681	pUsage->pNext = pSession->pLdrUsage;
3682	pSession->pLdrUsage = pUsage;
3683	}
3684	/* ignore errors... */
3685	}
3686
3687
3688	/**
3689	* Frees a load image.
3690	*
3691	* @param pDevExt Pointer to device extension.
3692	* @param pImage Pointer to the image we're gonna free.
3693	* This image must exit!
3694	* @remark The caller MUST own SUPDRVDEVEXT::mtxLdr!
3695	*/
3696	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage)
3697	{
3698	PSUPDRVLDRIMAGE pImagePrev;
3699	dprintf(("supdrvLdrFree: pImage=%p\n", pImage));
3700
3701	/* find it - arg. should've used doubly linked list. */
3702	Assert(pDevExt->pLdrImages);
3703	pImagePrev = NULL;
3704	if (pDevExt->pLdrImages != pImage)
3705	{
3706	pImagePrev = pDevExt->pLdrImages;
3707	while (pImagePrev->pNext != pImage)
3708	pImagePrev = pImagePrev->pNext;
3709	Assert(pImagePrev->pNext == pImage);
3710	}
3711
3712	/* unlink */
3713	if (pImagePrev)
3714	pImagePrev->pNext = pImage->pNext;
3715	else
3716	pDevExt->pLdrImages = pImage->pNext;
3717
3718	/* check if this is VMMR0.r0 and fix the Idt patches if it is. */
3719	if (pDevExt->pvVMMR0 == pImage->pvImage)
3720	supdrvLdrUnsetR0EP(pDevExt);
3721
3722	/* call termination function if fully loaded. */
3723	if ( pImage->pfnModuleTerm
3724	&& pImage->uState == SUP_IOCTL_LDR_LOAD)
3725	{
3726	dprintf(("supdrvIOCtl_LdrLoad: calling pfnModuleTerm=%p\n", pImage->pfnModuleTerm));
3727	pImage->pfnModuleTerm();
3728	}
3729
3730	/* free the image */
3731	pImage->cUsage = 0;
3732	pImage->pNext = 0;
3733	pImage->uState = SUP_IOCTL_LDR_FREE;
3734	RTMemExecFree(pImage);
3735	}
3736
3737
3738	/**
3739	* Gets the current paging mode of the CPU and stores in in pOut.
3740	*/
3741	static int supdrvIOCtl_GetPagingMode(PSUPGETPAGINGMODE_OUT pOut)
3742	{
3743	RTUINTREG cr0 = ASMGetCR0();
3744	if ((cr0 & (X86_CR0_PG \| X86_CR0_PE)) != (X86_CR0_PG \| X86_CR0_PE))
3745	pOut->enmMode = SUPPAGINGMODE_INVALID;
3746	else
3747	{
3748	RTUINTREG cr4 = ASMGetCR4();
3749	uint32_t fNXEPlusLMA = 0;
3750	if (cr4 & X86_CR4_PAE)
3751	{
3752	uint32_t fAmdFeatures = ASMCpuId_EDX(0x80000001);
3753	if (fAmdFeatures & (X86_CPUID_AMD_FEATURE_EDX_NX \| X86_CPUID_AMD_FEATURE_EDX_LONG_MODE))
3754	{
3755	uint64_t efer = ASMRdMsr(MSR_K6_EFER);
3756	if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_NX) && (efer & MSR_K6_EFER_NXE))
3757	fNXEPlusLMA \|= BIT(0);
3758	if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE) && (efer & MSR_K6_EFER_LMA))
3759	fNXEPlusLMA \|= BIT(1);
3760	}
3761	}
3762
3763	switch ((cr4 & (X86_CR4_PAE \| X86_CR4_PGE)) \| fNXEPlusLMA)
3764	{
3765	case 0:
3766	pOut->enmMode = SUPPAGINGMODE_32_BIT;
3767	break;
3768
3769	case X86_CR4_PGE:
3770	pOut->enmMode = SUPPAGINGMODE_32_BIT_GLOBAL;
3771	break;
3772
3773	case X86_CR4_PAE:
3774	pOut->enmMode = SUPPAGINGMODE_PAE;
3775	break;
3776
3777	case X86_CR4_PAE \| BIT(0):
3778	pOut->enmMode = SUPPAGINGMODE_PAE_NX;
3779	break;
3780
3781	case X86_CR4_PAE \| X86_CR4_PGE:
3782	pOut->enmMode = SUPPAGINGMODE_PAE_GLOBAL;
3783	break;
3784
3785	case X86_CR4_PAE \| X86_CR4_PGE \| BIT(0):
3786	pOut->enmMode = SUPPAGINGMODE_PAE_GLOBAL;
3787	break;
3788
3789	case BIT(1) \| X86_CR4_PAE:
3790	pOut->enmMode = SUPPAGINGMODE_AMD64;
3791	break;
3792
3793	case BIT(1) \| X86_CR4_PAE \| BIT(0):
3794	pOut->enmMode = SUPPAGINGMODE_AMD64_NX;
3795	break;
3796
3797	case BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE:
3798	pOut->enmMode = SUPPAGINGMODE_AMD64_GLOBAL;
3799	break;
3800
3801	case BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE \| BIT(0):
3802	pOut->enmMode = SUPPAGINGMODE_AMD64_GLOBAL_NX;
3803	break;
3804
3805	default:
3806	AssertMsgFailed(("Cannot happen! cr4=%#x fNXEPlusLMA=%d\n", cr4, fNXEPlusLMA));
3807	pOut->enmMode = SUPPAGINGMODE_INVALID;
3808	break;
3809	}
3810	}
3811	return 0;
3812	}
3813
3814
3815	#if !defined(SUPDRV_OS_HAVE_LOW) && !defined(USE_NEW_OS_INTERFACE) /* Use same backend as the contiguous stuff */
3816	/**
3817	* OS Specific code for allocating page aligned memory with fixed
3818	* physical backing below 4GB.
3819	*
3820	* @returns 0 on success.
3821	* @returns SUPDRV_ERR_* on failure.
3822	* @param pMem Memory reference record of the memory to be allocated.
3823	* (This is not linked in anywhere.)
3824	* @param ppvR3 Where to store the Ring-3 mapping of the allocated memory.
3825	* @param paPagesOut Where to store the physical addresss.
3826	*/
3827	int VBOXCALL supdrvOSLowAllocOne(PSUPDRVMEMREF pMem, void **ppvR3, PSUPPAGE paPagesOut)
3828	{
3829	RTHCPHYS HCPhys;
3830	int rc = supdrvOSContAllocOne(pMem, NULL, ppvR3, &HCPhys);
3831	if (!rc)
3832	{
3833	unsigned iPage = pMem->cb >> PAGE_SHIFT;
3834	while (iPage-- > 0)
3835	{
3836	paPagesOut[iPage].Phys = HCPhys + (iPage << PAGE_SHIFT);
3837	paPagesOut[iPage].uReserved = 0;
3838	}
3839	}
3840	return rc;
3841	}
3842
3843
3844	/**
3845	* Frees low memory.
3846	*
3847	* @param pMem Memory reference record of the memory to be freed.
3848	*/
3849	void VBOXCALL supdrvOSLowFreeOne(PSUPDRVMEMREF pMem)
3850	{
3851	supdrvOSContFreeOne(pMem);
3852	}
3853	#endif /* !SUPDRV_OS_HAVE_LOW */
3854
3855
3856	#ifdef USE_NEW_OS_INTERFACE
3857	/**
3858	* Creates the GIP.
3859	*
3860	* @returns negative errno.
3861	* @param pDevExt Instance data. GIP stuff may be updated.
3862	*/
3863	static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt)
3864	{
3865	PSUPGLOBALINFOPAGE pGip;
3866	RTHCPHYS HCPhysGip;
3867	uint32_t u32SystemResolution;
3868	uint32_t u32Interval;
3869	int rc;
3870
3871	dprintf(("supdrvGipCreate:\n"));
3872
3873	/* assert order */
3874	Assert(pDevExt->u32SystemTimerGranularityGrant == 0);
3875	Assert(pDevExt->GipMemObj == NIL_RTR0MEMOBJ);
3876	Assert(!pDevExt->pGipTimer);
3877
3878	/*
3879	* Allocate a suitable page with a default kernel mapping.
3880	*/
3881	rc = RTR0MemObjAllocLow(&pDevExt->GipMemObj, PAGE_SIZE, false);
3882	if (RT_FAILURE(rc))
3883	{
3884	OSDBGPRINT(("supdrvGipCreate: failed to allocate the GIP page. rc=%d\n", rc));
3885	return rc;
3886	}
3887	pGip = (PSUPGLOBALINFOPAGE)RTR0MemObjAddress(pDevExt->GipMemObj); AssertPtr(pGip);
3888	HCPhysGip = RTR0MemObjGetPagePhysAddr(pDevExt->GipMemObj, 0); Assert(HCPhysGip != NIL_RTHCPHYS);
3889
3890	/*
3891	* Try bump up the system timer resolution.
3892	* The more interrupts the better...
3893	*/
3894	if ( RT_SUCCESS(RTTimerRequestSystemGranularity( 976563 /* 1024 HZ */, &u32SystemResolution))
3895	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 1000000 /* 1000 HZ */, &u32SystemResolution))
3896	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 3906250 /* 256 HZ */, &u32SystemResolution))
3897	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 4000000 /* 250 HZ */, &u32SystemResolution))
3898	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 7812500 /* 128 HZ */, &u32SystemResolution))
3899	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(10000000 /* 100 HZ */, &u32SystemResolution))
3900	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(15625000 /* 64 HZ */, &u32SystemResolution))
3901	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(31250000 /* 32 HZ */, &u32SystemResolution))
3902	)
3903	{
3904	Assert(RTTimerGetSystemGranularity() <= u32SystemResolution);
3905	pDevExt->u32SystemTimerGranularityGrant = u32SystemResolution;
3906	}
3907
3908	/*
3909	* Find a reasonable update interval, something close to 10ms would be nice,
3910	* and create a recurring timer.
3911	*/
3912	u32Interval = u32SystemResolution = RTTimerGetSystemGranularity();
3913	while (u32Interval < 10000000 /* 10 ms */)
3914	u32Interval += u32SystemResolution;
3915
3916	rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, 0, supdrvGipTimer, pDevExt);
3917	if (RT_FAILURE(rc))
3918	{
3919	OSDBGPRINT(("supdrvGipCreate: failed create GIP timer at %RU32 ns interval. rc=%d\n", u32Interval, rc));
3920	Assert(!pDevExt->pGipTimer);
3921	supdrvGipDestroy(pDevExt);
3922	return rc;
3923	}
3924
3925	/*
3926	* We're good.
3927	*/
3928	supdrvGipInit(pDevExt, pGip, HCPhysGip, RTTimeSystemNanoTS(), 1000000000 / u32Interval /=Hz/);
3929	return 0;
3930	}
3931
3932
3933	/**
3934	* Terminates the GIP.
3935	*
3936	* @returns negative errno.
3937	* @param pDevExt Instance data. GIP stuff may be updated.
3938	*/
3939	static int supdrvGipDestroy(PSUPDRVDEVEXT pDevExt)
3940	{
3941	int rc;
3942
3943	/*
3944	* Invalid the GIP data.
3945	*/
3946	if (pDevExt->pGip)
3947	{
3948	supdrvGipTerm(pDevExt->pGip);
3949	pDevExt->pGip = 0;
3950	}
3951
3952	/*
3953	* Destroy the timer and free the GIP memory object.
3954	*/
3955	if (pDevExt->pGipTimer)
3956	{
3957	rc = RTTimerDestroy(pDevExt->pGipTimer); AssertRC(rc);
3958	pDevExt->pGipTimer = NULL;
3959	}
3960
3961	if (pDevExt->GipMemObj != NIL_RTR0MEMOBJ)
3962	{
3963	rc = RTR0MemObjFree(pDevExt->GipMemObj, true /* free mappings */); AssertRC(rc);
3964	pDevExt->GipMemObj = NIL_RTR0MEMOBJ;
3965	}
3966
3967	/*
3968	* Finally, release the system timer resolution request if one succeeded.
3969	*/
3970	if (pDevExt->u32SystemTimerGranularityGrant)
3971	{
3972	rc = RTTimerReleaseSystemGranularity(pDevExt->u32SystemTimerGranularityGrant); AssertRC(rc);
3973	pDevExt->u32SystemTimerGranularityGrant = 0;
3974	}
3975
3976	return 0;
3977	}
3978
3979
3980	/**
3981	* Timer callback function.
3982	* @param pTimer The timer.
3983	* @param pvUser The device extension.
3984	*/
3985	static DECLCALLBACK(void) supdrvGipTimer(PRTTIMER pTimer, void *pvUser)
3986	{
3987	PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
3988	supdrvGipUpdate(pDevExt->pGip, RTTimeSystemNanoTS());
3989	}
3990	#endif /* USE_NEW_OS_INTERFACE */
3991
3992
3993	/**
3994	* Initializes the GIP data.
3995	*
3996	* @returns VBox status code.
3997	* @param pDevExt Pointer to the device instance data.
3998	* @param pGip Pointer to the read-write kernel mapping of the GIP.
3999	* @param HCPhys The physical address of the GIP.
4000	* @param u64NanoTS The current nanosecond timestamp.
4001	* @param uUpdateHz The update freqence.
4002	*/
4003	int VBOXCALL supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys, uint64_t u64NanoTS, unsigned uUpdateHz)
4004	{
4005	dprintf(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
4006
4007	memset(pGip, 0, PAGE_SIZE);
4008	pGip->u32Magic = SUPGLOBALINFOPAGE_MAGIC;
4009	pGip->u32UpdateHz = uUpdateHz;
4010	pGip->u32UpdateIntervalNS = 1000000000 / uUpdateHz;
4011	pGip->u32TransactionId = 2;
4012	pGip->u64NanoTS = u64NanoTS;
4013	pGip->u64NanoTSLastUpdateHz = u64NanoTS;
4014	pGip->u64TSC = ASMReadTSC();
4015
4016	/*
4017	* We don't know the following values until we've executed updates.
4018	* So, we'll just insert very high values.
4019	*/
4020	pGip->u64CpuHz = _4G + 1;
4021	pGip->u32UpdateIntervalTSC = _2G / 4;
4022	pGip->au32TSCHistory[0] = _2G / 4;
4023	pGip->au32TSCHistory[1] = _2G / 4;
4024	pGip->au32TSCHistory[2] = _2G / 4;
4025	pGip->au32TSCHistory[3] = _2G / 4;
4026	pGip->au32TSCHistory[4] = _2G / 4;
4027	pGip->au32TSCHistory[5] = _2G / 4;
4028	pGip->au32TSCHistory[6] = _2G / 4;
4029	pGip->au32TSCHistory[7] = _2G / 4;
4030
4031	/*
4032	* Link it to the device extension.
4033	*/
4034	pDevExt->pGip = pGip;
4035	pDevExt->HCPhysGip = HCPhys;
4036	pDevExt->cGipUsers = 0;
4037
4038	return 0;
4039	}
4040
4041
4042	/**
4043	* Invalidates the GIP data upon termination.
4044	*
4045	* @param pGip Pointer to the read-write kernel mapping of the GIP.
4046	*/
4047	void VBOXCALL supdrvGipTerm(PSUPGLOBALINFOPAGE pGip)
4048	{
4049	pGip->iTSCHistoryHead = ~0;
4050	pGip->u64NanoTS = 0;
4051	pGip->u64TSC = 0;
4052	pGip->u32Magic = 0;
4053	pGip->iTSCHistoryHead = 0;
4054	}
4055
4056
4057	/**
4058	* Updates the GIP.
4059	*
4060	* @param pGip Pointer to the GIP.
4061	* @param u64NanoTS The current nanosecond timesamp.
4062	*/
4063	void VBOXCALL supdrvGipUpdate(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS)
4064	{
4065	uint64_t u64TSC;
4066	uint64_t u64TSCDelta;
4067	uint32_t u32UpdateIntervalTSC;
4068	uint32_t u32UpdateIntervalTSCSlack;
4069	unsigned iTSCHistoryHead;
4070	uint64_t u64CpuHz;
4071
4072	/*
4073	* Start update transaction.
4074	*/
4075	if (!(ASMAtomicIncU32(&pGip->u32TransactionId) & 1))
4076	{
4077	/* this can happen on win32 if we're taking to long and there are more CPUs around. shouldn't happen though. */
4078	AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGip->u32TransactionId));
4079	ASMAtomicIncU32(&pGip->u32TransactionId);
4080	pGip->cErrors++;
4081	return;
4082	}
4083
4084	ASMAtomicXchgU64(&pGip->u64NanoTS, u64NanoTS);
4085
4086	/*
4087	* Recalc the update frequency every 0x800th time.
4088	*/
4089	if (!(pGip->u32TransactionId & (GIP_UPDATEHZ_RECALC_FREQ * 2 - 2)))
4090	{
4091	if (pGip->u64NanoTSLastUpdateHz)
4092	{
4093	#ifdef __AMD64__ /** @todo fix 64-bit div here to work on x86 linux. */
4094	uint64_t u64Delta = u64NanoTS - pGip->u64NanoTSLastUpdateHz;
4095	uint32_t u32UpdateHz = (uint32_t)((UINT64_C(1000000000) * GIP_UPDATEHZ_RECALC_FREQ) / u64Delta);
4096	if (u32UpdateHz <= 2000 && u32UpdateHz >= 30)
4097	{
4098	ASMAtomicXchgU32(&pGip->u32UpdateHz, u32UpdateHz);
4099	ASMAtomicXchgU32(&pGip->u32UpdateIntervalNS, 1000000000 / u32UpdateHz);
4100	}
4101	#endif
4102	}
4103	ASMAtomicXchgU64(&pGip->u64NanoTSLastUpdateHz, u64NanoTS);
4104	}
4105
4106	/*
4107	* Calc TSC delta.
4108	*/
4109	/** @todo validate the NanoTS delta, don't trust the OS to call us when it should... */
4110	u64TSC = ASMReadTSC();
4111	u64TSCDelta = u64TSC - pGip->u64TSC;
4112	ASMAtomicXchgU64(&pGip->u64TSC, u64TSC);
4113
4114	if (u64TSCDelta >> 32)
4115	{
4116	u64TSCDelta = pGip->u32UpdateIntervalTSC;
4117	pGip->cErrors++;
4118	}
4119
4120	/*
4121	* TSC History.
4122	*/
4123	Assert(ELEMENTS(pGip->au32TSCHistory) == 8);
4124
4125	iTSCHistoryHead = (pGip->iTSCHistoryHead + 1) & 7;
4126	ASMAtomicXchgU32(&pGip->iTSCHistoryHead, iTSCHistoryHead);
4127	ASMAtomicXchgU32(&pGip->au32TSCHistory[iTSCHistoryHead], (uint32_t)u64TSCDelta);
4128
4129	/*
4130	* UpdateIntervalTSC = average of last 8,2,1 intervals depending on update HZ.
4131	*/
4132	if (pGip->u32UpdateHz >= 1000)
4133	{
4134	uint32_t u32;
4135	u32 = pGip->au32TSCHistory[0];
4136	u32 += pGip->au32TSCHistory[1];
4137	u32 += pGip->au32TSCHistory[2];
4138	u32 += pGip->au32TSCHistory[3];
4139	u32 >>= 2;
4140	u32UpdateIntervalTSC = pGip->au32TSCHistory[4];
4141	u32UpdateIntervalTSC += pGip->au32TSCHistory[5];
4142	u32UpdateIntervalTSC += pGip->au32TSCHistory[6];
4143	u32UpdateIntervalTSC += pGip->au32TSCHistory[7];
4144	u32UpdateIntervalTSC >>= 2;
4145	u32UpdateIntervalTSC += u32;
4146	u32UpdateIntervalTSC >>= 1;
4147
4148	/* Value choosen for a 2GHz Athlon64 running linux 2.6.10/11, . */
4149	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 14;
4150	}
4151	else if (pGip->u32UpdateHz >= 90)
4152	{
4153	u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
4154	u32UpdateIntervalTSC += pGip->au32TSCHistory[(iTSCHistoryHead - 1) & 7];
4155	u32UpdateIntervalTSC >>= 1;
4156
4157	/* value choosen on a 2GHz thinkpad running windows */
4158	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 7;
4159	}
4160	else
4161	{
4162	u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
4163
4164	/* This value hasn't be checked yet.. waiting for OS/2 and 33Hz timers.. :-) */
4165	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 6;
4166	}
4167	ASMAtomicXchgU32(&pGip->u32UpdateIntervalTSC, u32UpdateIntervalTSC + u32UpdateIntervalTSCSlack);
4168
4169	/*
4170	* CpuHz.
4171	*/
4172	u64CpuHz = ASMMult2xU32RetU64(u32UpdateIntervalTSC, pGip->u32UpdateHz);
4173	ASMAtomicXchgU64(&pGip->u64CpuHz, u64CpuHz);
4174
4175	/*
4176	* Complete transaction.
4177	*/
4178	ASMAtomicIncU32(&pGip->u32TransactionId);
4179	}
4180
4181
4182	#ifndef DEBUG /** @todo change #ifndef DEBUG -> #ifdef LOG_ENABLED */
4183	/**
4184	* Stub function for non-debug builds.
4185	*/
4186	RTDECL(PRTLOGGER) RTLogDefaultInstance(void)
4187	{
4188	return NULL;
4189	}
4190
4191	RTDECL(PRTLOGGER) RTLogRelDefaultInstance(void)
4192	{
4193	return NULL;
4194	}
4195
4196	/**
4197	* Stub function for non-debug builds.
4198	*/
4199	RTDECL(int) RTLogSetDefaultInstanceThread(PRTLOGGER pLogger, uintptr_t uKey)
4200	{
4201	return 0;
4202	}
4203
4204	/**
4205	* Stub function for non-debug builds.
4206	*/
4207	RTDECL(void) RTLogLogger(PRTLOGGER pLogger, void pvCallerRet, const char pszFormat, ...)
4208	{
4209	}
4210
4211	/**
4212	* Stub function for non-debug builds.
4213	*/
4214	RTDECL(void) RTLogLoggerEx(PRTLOGGER pLogger, unsigned fFlags, unsigned iGroup, const char *pszFormat, ...)
4215	{
4216	}
4217
4218	/**
4219	* Stub function for non-debug builds.
4220	*/
4221	RTDECL(void) RTLogLoggerExV(PRTLOGGER pLogger, unsigned fFlags, unsigned iGroup, const char *pszFormat, va_list args)
4222	{
4223	}
4224	#endif /* !DEBUG */
4225

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPDRVShared.c@ 706

Download in other formats: