SUPDrv.c@ 20953

Last change on this file since 20953 was 20860, checked in by vboxsync, 16 years ago
SUP: Bumped major version because of layout changes in RTLOGGER. Executed the todo list: retire old page alloc api and drop the windows lock/unlock hack (locking not used directly anywhere except as a fallback that doesn't apply to windows).
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 204.9 KB

Line
1	/* $Revision: 20860 $ */
2	/** @file
3	* VBoxDrv - The VirtualBox Support Driver - Common code.
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*
26	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
27	* Clara, CA 95054 USA or visit http://www.sun.com if you need
28	* additional information or have any questions.
29	*/
30
31	/*******************************************************************************
32	* Header Files *
33	*******************************************************************************/
34	#define LOG_GROUP LOG_GROUP_SUP_DRV
35	#include "SUPDrvInternal.h"
36	#ifndef PAGE_SHIFT
37	# include <iprt/param.h>
38	#endif
39	#include <iprt/alloc.h>
40	#include <iprt/cpuset.h>
41	#include <iprt/handletable.h>
42	#include <iprt/mp.h>
43	#include <iprt/power.h>
44	#include <iprt/process.h>
45	#include <iprt/semaphore.h>
46	#include <iprt/spinlock.h>
47	#include <iprt/thread.h>
48	#include <iprt/uuid.h>
49	#include <VBox/param.h>
50	#include <VBox/log.h>
51	#include <VBox/err.h>
52	#if defined(RT_OS_DARWIN) \|\| defined(RT_OS_SOLARIS) \|\| defined(RT_OS_FREEBSD)
53	# include <iprt/crc32.h>
54	# include <iprt/net.h>
55	# include <iprt/string.h>
56	#endif
57	/* VBox/x86.h not compatible with the Linux kernel sources */
58	#ifdef RT_OS_LINUX
59	# define X86_CPUID_VENDOR_AMD_EBX 0x68747541
60	# define X86_CPUID_VENDOR_AMD_ECX 0x444d4163
61	# define X86_CPUID_VENDOR_AMD_EDX 0x69746e65
62	#else
63	# include <VBox/x86.h>
64	#endif
65
66	/*
67	* Logging assignments:
68	* Log - useful stuff, like failures.
69	* LogFlow - program flow, except the really noisy bits.
70	* Log2 - Cleanup.
71	* Log3 - Loader flow noise.
72	* Log4 - Call VMMR0 flow noise.
73	* Log5 - Native yet-to-be-defined noise.
74	* Log6 - Native ioctl flow noise.
75	*
76	* Logging requires BUILD_TYPE=debug and possibly changes to the logger
77	* instanciation in log-vbox.c(pp).
78	*/
79
80
81	/*******************************************************************************
82	* Defined Constants And Macros *
83	*******************************************************************************/
84	/* from x86.h - clashes with linux thus this duplication */
85	#undef X86_CR0_PG
86	#define X86_CR0_PG RT_BIT(31)
87	#undef X86_CR0_PE
88	#define X86_CR0_PE RT_BIT(0)
89	#undef X86_CPUID_AMD_FEATURE_EDX_NX
90	#define X86_CPUID_AMD_FEATURE_EDX_NX RT_BIT(20)
91	#undef MSR_K6_EFER
92	#define MSR_K6_EFER 0xc0000080
93	#undef MSR_K6_EFER_NXE
94	#define MSR_K6_EFER_NXE RT_BIT(11)
95	#undef MSR_K6_EFER_LMA
96	#define MSR_K6_EFER_LMA RT_BIT(10)
97	#undef X86_CR4_PGE
98	#define X86_CR4_PGE RT_BIT(7)
99	#undef X86_CR4_PAE
100	#define X86_CR4_PAE RT_BIT(5)
101	#undef X86_CPUID_AMD_FEATURE_EDX_LONG_MODE
102	#define X86_CPUID_AMD_FEATURE_EDX_LONG_MODE RT_BIT(29)
103
104
105	/** The frequency by which we recalculate the u32UpdateHz and
106	* u32UpdateIntervalNS GIP members. The value must be a power of 2. */
107	#define GIP_UPDATEHZ_RECALC_FREQ 0x800
108
109	/**
110	* Validates a session pointer.
111	*
112	* @returns true/false accordingly.
113	* @param pSession The session.
114	*/
115	#define SUP_IS_SESSION_VALID(pSession) \
116	( VALID_PTR(pSession) \
117	&& pSession->u32Cookie == BIRD_INV)
118
119	/** @def VBOX_SVN_REV
120	* The makefile should define this if it can. */
121	#ifndef VBOX_SVN_REV
122	# define VBOX_SVN_REV 0
123	#endif
124
125	/*******************************************************************************
126	* Internal Functions *
127	*******************************************************************************/
128	static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void pvObj, void pvCtx, void *pvUser);
129	static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void pvObj, void pvCtx, void *pvUser);
130	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession);
131	static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType);
132	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq);
133	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq);
134	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq);
135	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq);
136	static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq);
137	static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0EntryInt, void pvVMMR0EntryFast, void pvVMMR0EntryEx);
138	static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt);
139	static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage);
140	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage);
141	static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq);
142	static int supdrvIOCtl_LoggerSettings(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLOGGERSETTINGS pReq);
143	static SUPGIPMODE supdrvGipDeterminTscMode(PSUPDRVDEVEXT pDevExt);
144	static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt);
145	static void supdrvGipDestroy(PSUPDRVDEVEXT pDevExt);
146	static DECLCALLBACK(void) supdrvGipSyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick);
147	static DECLCALLBACK(void) supdrvGipAsyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick);
148	static DECLCALLBACK(void) supdrvGipMpEvent(RTMPEVENT enmEvent, RTCPUID idCpu, void *pvUser);
149
150	#ifdef RT_WITH_W64_UNWIND_HACK
151	DECLASM(int) supdrvNtWrapVMMR0EntryEx(PFNRT pfnVMMR0EntryEx, PVM pVM, VMCPUID idCpu, unsigned uOperation, PSUPVMMR0REQHDR pReq, uint64_t u64Arg, PSUPDRVSESSION pSession);
152	DECLASM(int) supdrvNtWrapVMMR0EntryFast(PFNRT pfnVMMR0EntryFast, PVM pVM, VMCPUID idCpu, unsigned uOperation);
153	DECLASM(void) supdrvNtWrapObjDestructor(PFNRT pfnDestruction, void pvObj, void pvUser1, void *pvUser2);
154	DECLASM(void ) supdrvNtWrapQueryFactoryInterface(PFNRT pfnQueryFactoryInterface, struct SUPDRVFACTORY const pSupDrvFactory, PSUPDRVSESSION pSession, const char *pszInterfaceUuid);
155	DECLASM(int) supdrvNtWrapModuleInit(PFNRT pfnModuleInit);
156	DECLASM(void) supdrvNtWrapModuleTerm(PFNRT pfnModuleTerm);
157	DECLASM(int) supdrvNtWrapServiceReqHandler(PFNRT pfnServiceReqHandler, PSUPDRVSESSION pSession, uint32_t uOperation, uint64_t u64Arg, PSUPR0SERVICEREQHDR pReqHdr);
158
159	DECLASM(int) UNWIND_WRAP(SUPR0ComponentRegisterFactory)(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory);
160	DECLASM(int) UNWIND_WRAP(SUPR0ComponentDeregisterFactory)(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory);
161	DECLASM(int) UNWIND_WRAP(SUPR0ComponentQueryFactory)(PSUPDRVSESSION pSession, const char pszName, const char pszInterfaceUuid, void **ppvFactoryIf);
162	DECLASM(void ) UNWIND_WRAP(SUPR0ObjRegister)(PSUPDRVSESSION pSession, SUPDRVOBJTYPE enmType, PFNSUPDRVDESTRUCTOR pfnDestructor, void pvUser1, void *pvUser2);
163	DECLASM(int) UNWIND_WRAP(SUPR0ObjAddRef)(void *pvObj, PSUPDRVSESSION pSession);
164	DECLASM(int) UNWIND_WRAP(SUPR0ObjAddRefEx)(void *pvObj, PSUPDRVSESSION pSession, bool fNoPreempt);
165	DECLASM(int) UNWIND_WRAP(SUPR0ObjRelease)(void *pvObj, PSUPDRVSESSION pSession);
166	DECLASM(int) UNWIND_WRAP(SUPR0ObjVerifyAccess)(void pvObj, PSUPDRVSESSION pSession, const char pszObjName);
167	DECLASM(int) UNWIND_WRAP(SUPR0LockMem)(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t cPages, PRTHCPHYS paPages);
168	DECLASM(int) UNWIND_WRAP(SUPR0UnlockMem)(PSUPDRVSESSION pSession, RTR3PTR pvR3);
169	DECLASM(int) UNWIND_WRAP(SUPR0ContAlloc)(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS pHCPhys);
170	DECLASM(int) UNWIND_WRAP(SUPR0ContFree)(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr);
171	DECLASM(int) UNWIND_WRAP(SUPR0LowAlloc)(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS paPages);
172	DECLASM(int) UNWIND_WRAP(SUPR0LowFree)(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr);
173	DECLASM(int) UNWIND_WRAP(SUPR0MemAlloc)(PSUPDRVSESSION pSession, uint32_t cb, PRTR0PTR ppvR0, PRTR3PTR ppvR3);
174	DECLASM(int) UNWIND_WRAP(SUPR0MemGetPhys)(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, PSUPPAGE paPages);
175	DECLASM(int) UNWIND_WRAP(SUPR0MemFree)(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr);
176	DECLASM(int) UNWIND_WRAP(SUPR0PageAllocEx)(PSUPDRVSESSION pSession, uint32_t cPages, uint32_t fFlags, PRTR3PTR ppvR3, PRTR0PTR ppvR0, PRTHCPHYS paPages);
177	DECLASM(int) UNWIND_WRAP(SUPR0PageFree)(PSUPDRVSESSION pSession, RTR3PTR pvR3);
178	//DECLASM(int) UNWIND_WRAP(SUPR0Printf)(const char *pszFormat, ...);
179	DECLASM(int) UNWIND_WRAP(SUPSemEventCreate)(PSUPDRVSESSION pSession, PSUPSEMEVENT phEvent);
180	DECLASM(int) UNWIND_WRAP(SUPSemEventClose)(PSUPDRVSESSION pSession, SUPSEMEVENT hEvent);
181	DECLASM(int) UNWIND_WRAP(SUPSemEventSignal)(PSUPDRVSESSION pSession, SUPSEMEVENT hEvent);
182	DECLASM(int) UNWIND_WRAP(SUPSemEventWait)(PSUPDRVSESSION pSession, SUPSEMEVENT hEvent, uint32_t cMillies);
183	DECLASM(int) UNWIND_WRAP(SUPSemEventWaitNoResume)(PSUPDRVSESSION pSession, SUPSEMEVENT hEvent, uint32_t cMillies);
184	DECLASM(int) UNWIND_WRAP(SUPSemEventMultiCreate)(PSUPDRVSESSION pSession, PSUPSEMEVENTMULTI phEventMulti);
185	DECLASM(int) UNWIND_WRAP(SUPSemEventMultiClose)(PSUPDRVSESSION pSession, SUPSEMEVENTMULTI hEventMulti);
186	DECLASM(int) UNWIND_WRAP(SUPSemEventMultiSignal)(PSUPDRVSESSION pSession, SUPSEMEVENTMULTI hEventMulti);
187	DECLASM(int) UNWIND_WRAP(SUPSemEventMultiReset)(PSUPDRVSESSION pSession, SUPSEMEVENTMULTI hEventMulti);
188	DECLASM(int) UNWIND_WRAP(SUPSemEventMultiWait)(PSUPDRVSESSION pSession, SUPSEMEVENTMULTI hEventMulti, uint32_t cMillies);
189	DECLASM(int) UNWIND_WRAP(SUPSemEventMultiWaitNoResume)(PSUPDRVSESSION pSession, SUPSEMEVENTMULTI hEventMulti, uint32_t cMillies);
190	DECLASM(SUPPAGINGMODE) UNWIND_WRAP(SUPR0GetPagingMode)(void);
191	DECLASM(void *) UNWIND_WRAP(RTMemAlloc)(size_t cb) RT_NO_THROW;
192	DECLASM(void *) UNWIND_WRAP(RTMemAllocZ)(size_t cb) RT_NO_THROW;
193	DECLASM(void) UNWIND_WRAP(RTMemFree)(void *pv) RT_NO_THROW;
194	DECLASM(void ) UNWIND_WRAP(RTMemDup)(const void pvSrc, size_t cb) RT_NO_THROW;
195	DECLASM(void ) UNWIND_WRAP(RTMemDupEx)(const void pvSrc, size_t cbSrc, size_t cbExtra) RT_NO_THROW;
196	DECLASM(void ) UNWIND_WRAP(RTMemRealloc)(void pvOld, size_t cbNew) RT_NO_THROW;
197	DECLASM(int) UNWIND_WRAP(RTR0MemObjAllocLow)(PRTR0MEMOBJ pMemObj, size_t cb, bool fExecutable);
198	DECLASM(int) UNWIND_WRAP(RTR0MemObjAllocPage)(PRTR0MEMOBJ pMemObj, size_t cb, bool fExecutable);
199	DECLASM(int) UNWIND_WRAP(RTR0MemObjAllocPhys)(PRTR0MEMOBJ pMemObj, size_t cb, RTHCPHYS PhysHighest);
200	DECLASM(int) UNWIND_WRAP(RTR0MemObjAllocPhysNC)(PRTR0MEMOBJ pMemObj, size_t cb, RTHCPHYS PhysHighest);
201	DECLASM(int) UNWIND_WRAP(RTR0MemObjAllocCont)(PRTR0MEMOBJ pMemObj, size_t cb, bool fExecutable);
202	DECLASM(int) UNWIND_WRAP(RTR0MemObjEnterPhys)(PRTR0MEMOBJ pMemObj, RTHCPHYS Phys, size_t cb);
203	DECLASM(int) UNWIND_WRAP(RTR0MemObjLockUser)(PRTR0MEMOBJ pMemObj, RTR3PTR R3Ptr, size_t cb, RTR0PROCESS R0Process);
204	DECLASM(int) UNWIND_WRAP(RTR0MemObjMapKernel)(PRTR0MEMOBJ pMemObj, RTR0MEMOBJ MemObjToMap, void *pvFixed, size_t uAlignment, unsigned fProt);
205	DECLASM(int) UNWIND_WRAP(RTR0MemObjMapKernelEx)(PRTR0MEMOBJ pMemObj, RTR0MEMOBJ MemObjToMap, void *pvFixed, size_t uAlignment, unsigned fProt, size_t offSub, size_t cbSub);
206	DECLASM(int) UNWIND_WRAP(RTR0MemObjMapUser)(PRTR0MEMOBJ pMemObj, RTR0MEMOBJ MemObjToMap, RTR3PTR R3PtrFixed, size_t uAlignment, unsigned fProt, RTR0PROCESS R0Process);
207	DECLASM(int) UNWIND_WRAP(RTR0MemObjProtect)(RTR0MEMOBJ hMemObj, size_t offsub, size_t cbSub, uint32_t fProt);
208	/DECLASM(void ) UNWIND_WRAP(RTR0MemObjAddress)(RTR0MEMOBJ MemObj); - not necessary */
209	/DECLASM(RTR3PTR) UNWIND_WRAP(RTR0MemObjAddressR3)(RTR0MEMOBJ MemObj); - not necessary /
210	/DECLASM(size_t) UNWIND_WRAP(RTR0MemObjSize)(RTR0MEMOBJ MemObj); - not necessary /
211	/DECLASM(bool) UNWIND_WRAP(RTR0MemObjIsMapping)(RTR0MEMOBJ MemObj); - not necessary /
212	/DECLASM(RTHCPHYS) UNWIND_WRAP(RTR0MemObjGetPagePhysAddr)(RTR0MEMOBJ MemObj, size_t iPage); - not necessary /
213	DECLASM(int) UNWIND_WRAP(RTR0MemObjFree)(RTR0MEMOBJ MemObj, bool fFreeMappings);
214	/* RTProcSelf - not necessary */
215	/* RTR0ProcHandleSelf - not necessary */
216	DECLASM(int) UNWIND_WRAP(RTSemFastMutexCreate)(PRTSEMFASTMUTEX pMutexSem);
217	DECLASM(int) UNWIND_WRAP(RTSemFastMutexDestroy)(RTSEMFASTMUTEX MutexSem);
218	DECLASM(int) UNWIND_WRAP(RTSemFastMutexRequest)(RTSEMFASTMUTEX MutexSem);
219	DECLASM(int) UNWIND_WRAP(RTSemFastMutexRelease)(RTSEMFASTMUTEX MutexSem);
220	DECLASM(int) UNWIND_WRAP(RTSemEventCreate)(PRTSEMEVENT pEventSem);
221	DECLASM(int) UNWIND_WRAP(RTSemEventSignal)(RTSEMEVENT EventSem);
222	DECLASM(int) UNWIND_WRAP(RTSemEventWait)(RTSEMEVENT EventSem, unsigned cMillies);
223	DECLASM(int) UNWIND_WRAP(RTSemEventWaitNoResume)(RTSEMEVENT EventSem, unsigned cMillies);
224	DECLASM(int) UNWIND_WRAP(RTSemEventDestroy)(RTSEMEVENT EventSem);
225	DECLASM(int) UNWIND_WRAP(RTSemEventMultiCreate)(PRTSEMEVENTMULTI pEventMultiSem);
226	DECLASM(int) UNWIND_WRAP(RTSemEventMultiSignal)(RTSEMEVENTMULTI EventMultiSem);
227	DECLASM(int) UNWIND_WRAP(RTSemEventMultiReset)(RTSEMEVENTMULTI EventMultiSem);
228	DECLASM(int) UNWIND_WRAP(RTSemEventMultiWait)(RTSEMEVENTMULTI EventMultiSem, unsigned cMillies);
229	DECLASM(int) UNWIND_WRAP(RTSemEventMultiWaitNoResume)(RTSEMEVENTMULTI EventMultiSem, unsigned cMillies);
230	DECLASM(int) UNWIND_WRAP(RTSemEventMultiDestroy)(RTSEMEVENTMULTI EventMultiSem);
231	DECLASM(int) UNWIND_WRAP(RTSpinlockCreate)(PRTSPINLOCK pSpinlock);
232	DECLASM(int) UNWIND_WRAP(RTSpinlockDestroy)(RTSPINLOCK Spinlock);
233	DECLASM(void) UNWIND_WRAP(RTSpinlockAcquire)(RTSPINLOCK Spinlock, PRTSPINLOCKTMP pTmp);
234	DECLASM(void) UNWIND_WRAP(RTSpinlockRelease)(RTSPINLOCK Spinlock, PRTSPINLOCKTMP pTmp);
235	DECLASM(void) UNWIND_WRAP(RTSpinlockAcquireNoInts)(RTSPINLOCK Spinlock, PRTSPINLOCKTMP pTmp);
236	DECLASM(void) UNWIND_WRAP(RTSpinlockReleaseNoInts)(RTSPINLOCK Spinlock, PRTSPINLOCKTMP pTmp);
237	/* RTTimeNanoTS - not necessary */
238	/* RTTimeMilliTS - not necessary */
239	/* RTTimeSystemNanoTS - not necessary */
240	/* RTTimeSystemMilliTS - not necessary */
241	/* RTThreadNativeSelf - not necessary */
242	DECLASM(int) UNWIND_WRAP(RTThreadSleep)(unsigned cMillies);
243	DECLASM(bool) UNWIND_WRAP(RTThreadYield)(void);
244	#if 0
245	/* RTThreadSelf - not necessary */
246	DECLASM(int) UNWIND_WRAP(RTThreadCreate)(PRTTHREAD pThread, PFNRTTHREAD pfnThread, void *pvUser, size_t cbStack,
247	RTTHREADTYPE enmType, unsigned fFlags, const char *pszName);
248	DECLASM(RTNATIVETHREAD) UNWIND_WRAP(RTThreadGetNative)(RTTHREAD Thread);
249	DECLASM(int) UNWIND_WRAP(RTThreadWait)(RTTHREAD Thread, unsigned cMillies, int *prc);
250	DECLASM(int) UNWIND_WRAP(RTThreadWaitNoResume)(RTTHREAD Thread, unsigned cMillies, int *prc);
251	DECLASM(const char *) UNWIND_WRAP(RTThreadGetName)(RTTHREAD Thread);
252	DECLASM(const char *) UNWIND_WRAP(RTThreadSelfName)(void);
253	DECLASM(RTTHREADTYPE) UNWIND_WRAP(RTThreadGetType)(RTTHREAD Thread);
254	DECLASM(int) UNWIND_WRAP(RTThreadUserSignal)(RTTHREAD Thread);
255	DECLASM(int) UNWIND_WRAP(RTThreadUserReset)(RTTHREAD Thread);
256	DECLASM(int) UNWIND_WRAP(RTThreadUserWait)(RTTHREAD Thread, unsigned cMillies);
257	DECLASM(int) UNWIND_WRAP(RTThreadUserWaitNoResume)(RTTHREAD Thread, unsigned cMillies);
258	#endif
259	/* RTThreadPreemptIsEnabled - not necessary */
260	/* RTThreadPreemptIsPending - not necessary */
261	/* RTThreadPreemptIsPendingTrusty - not necessary */
262	/* RTThreadPreemptDisable - not necessary */
263	DECLASM(void) UNWIND_WRAP(RTThreadPreemptRestore)(RTTHREADPREEMPTSTATE pState);
264	/* RTLogDefaultInstance - a bit of a gamble, but we do not want the overhead! */
265	/* RTMpCpuId - not necessary */
266	/* RTMpCpuIdFromSetIndex - not necessary */
267	/* RTMpCpuIdToSetIndex - not necessary */
268	/* RTMpIsCpuPossible - not necessary */
269	/* RTMpGetCount - not necessary */
270	/* RTMpGetMaxCpuId - not necessary */
271	/* RTMpGetOnlineCount - not necessary */
272	/* RTMpGetOnlineSet - not necessary */
273	/* RTMpGetSet - not necessary */
274	/* RTMpIsCpuOnline - not necessary */
275	DECLASM(int) UNWIND_WRAP(RTMpIsCpuWorkPending)(void);
276	DECLASM(int) UNWIND_WRAP(RTMpOnAll)(PFNRTMPWORKER pfnWorker, void pvUser1, void pvUser2);
277	DECLASM(int) UNWIND_WRAP(RTMpOnOthers)(PFNRTMPWORKER pfnWorker, void pvUser1, void pvUser2);
278	DECLASM(int) UNWIND_WRAP(RTMpOnSpecific)(RTCPUID idCpu, PFNRTMPWORKER pfnWorker, void pvUser1, void pvUser2);
279	DECLASM(int) UNWIND_WRAP(RTMpPokeCpu)(RTCPUID idCpu);
280	/* RTLogRelDefaultInstance - not necessary. */
281	DECLASM(int) UNWIND_WRAP(RTLogSetDefaultInstanceThread)(PRTLOGGER pLogger, uintptr_t uKey);
282	/* RTLogLogger - can't wrap this buster. */
283	/* RTLogLoggerEx - can't wrap this buster. */
284	DECLASM(void) UNWIND_WRAP(RTLogLoggerExV)(PRTLOGGER pLogger, unsigned fFlags, unsigned iGroup, const char *pszFormat, va_list args);
285	/* RTLogPrintf - can't wrap this buster. / /* @todo provide va_list log wrappers in RuntimeR0. */
286	DECLASM(void) UNWIND_WRAP(RTLogPrintfV)(const char *pszFormat, va_list args);
287	DECLASM(void) UNWIND_WRAP(AssertMsg1)(const char pszExpr, unsigned uLine, const char pszFile, const char *pszFunction);
288	/* AssertMsg2 - can't wrap this buster. */
289	#endif /* RT_WITH_W64_UNWIND_HACK */
290
291
292	/*******************************************************************************
293	* Global Variables *
294	*******************************************************************************/
295	/**
296	* Array of the R0 SUP API.
297	*/
298	static SUPFUNC g_aFunctions[] =
299	{
300	/* name function */
301	/* Entries with absolute addresses determined at runtime, fixup
302	code makes ugly ASSUMPTIONS about the order here: */
303	{ "SUPR0AbsIs64bit", (void *)0 },
304	{ "SUPR0Abs64bitKernelCS", (void *)0 },
305	{ "SUPR0Abs64bitKernelSS", (void *)0 },
306	{ "SUPR0Abs64bitKernelDS", (void *)0 },
307	{ "SUPR0AbsKernelCS", (void *)0 },
308	{ "SUPR0AbsKernelSS", (void *)0 },
309	{ "SUPR0AbsKernelDS", (void *)0 },
310	{ "SUPR0AbsKernelES", (void *)0 },
311	{ "SUPR0AbsKernelFS", (void *)0 },
312	{ "SUPR0AbsKernelGS", (void *)0 },
313	/* Normal function pointers: */
314	{ "SUPR0ComponentRegisterFactory", (void *)UNWIND_WRAP(SUPR0ComponentRegisterFactory) },
315	{ "SUPR0ComponentDeregisterFactory", (void *)UNWIND_WRAP(SUPR0ComponentDeregisterFactory) },
316	{ "SUPR0ComponentQueryFactory", (void *)UNWIND_WRAP(SUPR0ComponentQueryFactory) },
317	{ "SUPR0ObjRegister", (void *)UNWIND_WRAP(SUPR0ObjRegister) },
318	{ "SUPR0ObjAddRef", (void *)UNWIND_WRAP(SUPR0ObjAddRef) },
319	{ "SUPR0ObjAddRefEx", (void *)UNWIND_WRAP(SUPR0ObjAddRefEx) },
320	{ "SUPR0ObjRelease", (void *)UNWIND_WRAP(SUPR0ObjRelease) },
321	{ "SUPR0ObjVerifyAccess", (void *)UNWIND_WRAP(SUPR0ObjVerifyAccess) },
322	{ "SUPR0LockMem", (void *)UNWIND_WRAP(SUPR0LockMem) },
323	{ "SUPR0UnlockMem", (void *)UNWIND_WRAP(SUPR0UnlockMem) },
324	{ "SUPR0ContAlloc", (void *)UNWIND_WRAP(SUPR0ContAlloc) },
325	{ "SUPR0ContFree", (void *)UNWIND_WRAP(SUPR0ContFree) },
326	{ "SUPR0LowAlloc", (void *)UNWIND_WRAP(SUPR0LowAlloc) },
327	{ "SUPR0LowFree", (void *)UNWIND_WRAP(SUPR0LowFree) },
328	{ "SUPR0MemAlloc", (void *)UNWIND_WRAP(SUPR0MemAlloc) },
329	{ "SUPR0MemGetPhys", (void *)UNWIND_WRAP(SUPR0MemGetPhys) },
330	{ "SUPR0MemFree", (void *)UNWIND_WRAP(SUPR0MemFree) },
331	{ "SUPR0PageAllocEx", (void *)UNWIND_WRAP(SUPR0PageAllocEx) },
332	{ "SUPR0PageFree", (void *)UNWIND_WRAP(SUPR0PageFree) },
333	{ "SUPR0Printf", (void )SUPR0Printf }, /* @todo needs wrapping? */
334	{ "SUPSemEventCreate", (void *)UNWIND_WRAP(SUPSemEventCreate) },
335	{ "SUPSemEventClose", (void *)UNWIND_WRAP(SUPSemEventClose) },
336	{ "SUPSemEventSignal", (void *)UNWIND_WRAP(SUPSemEventSignal) },
337	{ "SUPSemEventWait", (void *)UNWIND_WRAP(SUPSemEventWait) },
338	{ "SUPSemEventWaitNoResume", (void *)UNWIND_WRAP(SUPSemEventWaitNoResume) },
339	{ "SUPSemEventMultiCreate", (void *)UNWIND_WRAP(SUPSemEventMultiCreate) },
340	{ "SUPSemEventMultiClose", (void *)UNWIND_WRAP(SUPSemEventMultiClose) },
341	{ "SUPSemEventMultiSignal", (void *)UNWIND_WRAP(SUPSemEventMultiSignal) },
342	{ "SUPSemEventMultiReset", (void *)UNWIND_WRAP(SUPSemEventMultiReset) },
343	{ "SUPSemEventMultiWait", (void *)UNWIND_WRAP(SUPSemEventMultiWait) },
344	{ "SUPSemEventMultiWaitNoResume", (void *)UNWIND_WRAP(SUPSemEventMultiWaitNoResume) },
345	{ "SUPR0GetPagingMode", (void *)UNWIND_WRAP(SUPR0GetPagingMode) },
346	{ "SUPR0EnableVTx", (void *)SUPR0EnableVTx },
347	{ "RTMemAlloc", (void *)UNWIND_WRAP(RTMemAlloc) },
348	{ "RTMemAllocZ", (void *)UNWIND_WRAP(RTMemAllocZ) },
349	{ "RTMemFree", (void *)UNWIND_WRAP(RTMemFree) },
350	/{ "RTMemDup", (void )UNWIND_WRAP(RTMemDup) },
351	{ "RTMemDupEx", (void )UNWIND_WRAP(RTMemDupEx) },/
352	{ "RTMemRealloc", (void *)UNWIND_WRAP(RTMemRealloc) },
353	{ "RTR0MemObjAllocLow", (void *)UNWIND_WRAP(RTR0MemObjAllocLow) },
354	{ "RTR0MemObjAllocPage", (void *)UNWIND_WRAP(RTR0MemObjAllocPage) },
355	{ "RTR0MemObjAllocPhys", (void *)UNWIND_WRAP(RTR0MemObjAllocPhys) },
356	{ "RTR0MemObjAllocPhysNC", (void *)UNWIND_WRAP(RTR0MemObjAllocPhysNC) },
357	{ "RTR0MemObjAllocCont", (void *)UNWIND_WRAP(RTR0MemObjAllocCont) },
358	{ "RTR0MemObjEnterPhys", (void *)UNWIND_WRAP(RTR0MemObjEnterPhys) },
359	{ "RTR0MemObjLockUser", (void *)UNWIND_WRAP(RTR0MemObjLockUser) },
360	{ "RTR0MemObjMapKernel", (void *)UNWIND_WRAP(RTR0MemObjMapKernel) },
361	{ "RTR0MemObjMapKernelEx", (void *)UNWIND_WRAP(RTR0MemObjMapKernelEx) },
362	{ "RTR0MemObjMapUser", (void *)UNWIND_WRAP(RTR0MemObjMapUser) },
363	{ "RTR0MemObjProtect", (void *)UNWIND_WRAP(RTR0MemObjProtect) },
364	{ "RTR0MemObjAddress", (void *)RTR0MemObjAddress },
365	{ "RTR0MemObjAddressR3", (void *)RTR0MemObjAddressR3 },
366	{ "RTR0MemObjSize", (void *)RTR0MemObjSize },
367	{ "RTR0MemObjIsMapping", (void *)RTR0MemObjIsMapping },
368	{ "RTR0MemObjGetPagePhysAddr", (void *)RTR0MemObjGetPagePhysAddr },
369	{ "RTR0MemObjFree", (void *)UNWIND_WRAP(RTR0MemObjFree) },
370	/* These don't work yet on linux - use fast mutexes!
371	{ "RTSemMutexCreate", (void *)RTSemMutexCreate },
372	{ "RTSemMutexRequest", (void *)RTSemMutexRequest },
373	{ "RTSemMutexRelease", (void *)RTSemMutexRelease },
374	{ "RTSemMutexDestroy", (void *)RTSemMutexDestroy },
375	*/
376	{ "RTProcSelf", (void *)RTProcSelf },
377	{ "RTR0ProcHandleSelf", (void *)RTR0ProcHandleSelf },
378	{ "RTSemFastMutexCreate", (void *)UNWIND_WRAP(RTSemFastMutexCreate) },
379	{ "RTSemFastMutexDestroy", (void *)UNWIND_WRAP(RTSemFastMutexDestroy) },
380	{ "RTSemFastMutexRequest", (void *)UNWIND_WRAP(RTSemFastMutexRequest) },
381	{ "RTSemFastMutexRelease", (void *)UNWIND_WRAP(RTSemFastMutexRelease) },
382	{ "RTSemEventCreate", (void *)UNWIND_WRAP(RTSemEventCreate) },
383	{ "RTSemEventSignal", (void *)UNWIND_WRAP(RTSemEventSignal) },
384	{ "RTSemEventWait", (void *)UNWIND_WRAP(RTSemEventWait) },
385	{ "RTSemEventWaitNoResume", (void *)UNWIND_WRAP(RTSemEventWaitNoResume) },
386	{ "RTSemEventDestroy", (void *)UNWIND_WRAP(RTSemEventDestroy) },
387	{ "RTSemEventMultiCreate", (void *)UNWIND_WRAP(RTSemEventMultiCreate) },
388	{ "RTSemEventMultiSignal", (void *)UNWIND_WRAP(RTSemEventMultiSignal) },
389	{ "RTSemEventMultiReset", (void *)UNWIND_WRAP(RTSemEventMultiReset) },
390	{ "RTSemEventMultiWait", (void *)UNWIND_WRAP(RTSemEventMultiWait) },
391	{ "RTSemEventMultiWaitNoResume", (void *)UNWIND_WRAP(RTSemEventMultiWaitNoResume) },
392	{ "RTSemEventMultiDestroy", (void *)UNWIND_WRAP(RTSemEventMultiDestroy) },
393	{ "RTSpinlockCreate", (void *)UNWIND_WRAP(RTSpinlockCreate) },
394	{ "RTSpinlockDestroy", (void *)UNWIND_WRAP(RTSpinlockDestroy) },
395	{ "RTSpinlockAcquire", (void *)UNWIND_WRAP(RTSpinlockAcquire) },
396	{ "RTSpinlockRelease", (void *)UNWIND_WRAP(RTSpinlockRelease) },
397	{ "RTSpinlockAcquireNoInts", (void *)UNWIND_WRAP(RTSpinlockAcquireNoInts) },
398	{ "RTSpinlockReleaseNoInts", (void *)UNWIND_WRAP(RTSpinlockReleaseNoInts) },
399	{ "RTTimeNanoTS", (void *)RTTimeNanoTS },
400	{ "RTTimeMilliTS", (void *)RTTimeMilliTS },
401	{ "RTTimeSystemNanoTS", (void *)RTTimeSystemNanoTS },
402	{ "RTTimeSystemMilliTS", (void *)RTTimeSystemMilliTS },
403	{ "RTThreadNativeSelf", (void *)RTThreadNativeSelf },
404	{ "RTThreadSleep", (void *)UNWIND_WRAP(RTThreadSleep) },
405	{ "RTThreadYield", (void *)UNWIND_WRAP(RTThreadYield) },
406	#if 0 /* Thread APIs, Part 2. */
407	{ "RTThreadSelf", (void *)UNWIND_WRAP(RTThreadSelf) },
408	{ "RTThreadCreate", (void )UNWIND_WRAP(RTThreadCreate) }, /* @todo need to wrap the callback */
409	{ "RTThreadGetNative", (void *)UNWIND_WRAP(RTThreadGetNative) },
410	{ "RTThreadWait", (void *)UNWIND_WRAP(RTThreadWait) },
411	{ "RTThreadWaitNoResume", (void *)UNWIND_WRAP(RTThreadWaitNoResume) },
412	{ "RTThreadGetName", (void *)UNWIND_WRAP(RTThreadGetName) },
413	{ "RTThreadSelfName", (void *)UNWIND_WRAP(RTThreadSelfName) },
414	{ "RTThreadGetType", (void *)UNWIND_WRAP(RTThreadGetType) },
415	{ "RTThreadUserSignal", (void *)UNWIND_WRAP(RTThreadUserSignal) },
416	{ "RTThreadUserReset", (void *)UNWIND_WRAP(RTThreadUserReset) },
417	{ "RTThreadUserWait", (void *)UNWIND_WRAP(RTThreadUserWait) },
418	{ "RTThreadUserWaitNoResume", (void *)UNWIND_WRAP(RTThreadUserWaitNoResume) },
419	#endif
420	{ "RTThreadPreemptIsEnabled", (void *)RTThreadPreemptIsEnabled },
421	{ "RTThreadPreemptIsPending", (void *)RTThreadPreemptIsPending },
422	{ "RTThreadPreemptIsPendingTrusty", (void *)RTThreadPreemptIsPendingTrusty },
423	{ "RTThreadPreemptDisable", (void *)RTThreadPreemptDisable },
424	{ "RTThreadPreemptRestore", (void *)UNWIND_WRAP(RTThreadPreemptRestore) },
425
426	{ "RTLogDefaultInstance", (void *)RTLogDefaultInstance },
427	{ "RTMpCpuId", (void *)RTMpCpuId },
428	{ "RTMpCpuIdFromSetIndex", (void *)RTMpCpuIdFromSetIndex },
429	{ "RTMpCpuIdToSetIndex", (void *)RTMpCpuIdToSetIndex },
430	{ "RTMpIsCpuPossible", (void *)RTMpIsCpuPossible },
431	{ "RTMpGetCount", (void *)RTMpGetCount },
432	{ "RTMpGetMaxCpuId", (void *)RTMpGetMaxCpuId },
433	{ "RTMpGetOnlineCount", (void *)RTMpGetOnlineCount },
434	{ "RTMpGetOnlineSet", (void *)RTMpGetOnlineSet },
435	{ "RTMpGetSet", (void *)RTMpGetSet },
436	{ "RTMpIsCpuOnline", (void *)RTMpIsCpuOnline },
437	{ "RTMpIsCpuWorkPending", (void *)UNWIND_WRAP(RTMpIsCpuWorkPending) },
438	{ "RTMpOnAll", (void *)UNWIND_WRAP(RTMpOnAll) },
439	{ "RTMpOnOthers", (void *)UNWIND_WRAP(RTMpOnOthers) },
440	{ "RTMpOnSpecific", (void *)UNWIND_WRAP(RTMpOnSpecific) },
441	{ "RTMpPokeCpu", (void *)UNWIND_WRAP(RTMpPokeCpu) },
442	{ "RTPowerNotificationRegister", (void *)RTPowerNotificationRegister },
443	{ "RTPowerNotificationDeregister", (void *)RTPowerNotificationDeregister },
444	{ "RTLogRelDefaultInstance", (void *)RTLogRelDefaultInstance },
445	{ "RTLogSetDefaultInstanceThread", (void *)UNWIND_WRAP(RTLogSetDefaultInstanceThread) },
446	{ "RTLogLogger", (void )RTLogLogger }, /* @todo remove this */
447	{ "RTLogLoggerEx", (void )RTLogLoggerEx }, /* @todo remove this */
448	{ "RTLogLoggerExV", (void *)UNWIND_WRAP(RTLogLoggerExV) },
449	{ "RTLogPrintf", (void )RTLogPrintf }, /* @todo remove this */
450	{ "RTLogPrintfV", (void *)UNWIND_WRAP(RTLogPrintfV) },
451	{ "AssertMsg1", (void *)UNWIND_WRAP(AssertMsg1) },
452	{ "AssertMsg2", (void )AssertMsg2 }, /* @todo replace this by RTAssertMsg2V */
453	#if defined(RT_OS_DARWIN) \|\| defined(RT_OS_SOLARIS)
454	{ "RTR0AssertPanicSystem", (void *)RTR0AssertPanicSystem },
455	#endif
456	#if defined(RT_OS_DARWIN)
457	{ "RTAssertMsg1", (void *)RTAssertMsg1 },
458	{ "RTAssertMsg2", (void *)RTAssertMsg2 },
459	{ "RTAssertMsg2V", (void *)RTAssertMsg2V },
460	#endif
461	};
462
463	#if defined(RT_OS_DARWIN) \|\| defined(RT_OS_SOLARIS) \|\| defined(RT_OS_FREEBSD)
464	/**
465	* Drag in the rest of IRPT since we share it with the
466	* rest of the kernel modules on darwin.
467	*/
468	PFNRT g_apfnVBoxDrvIPRTDeps[] =
469	{
470	(PFNRT)RTCrc32,
471	(PFNRT)RTErrConvertFromErrno,
472	(PFNRT)RTNetIPv4IsHdrValid,
473	(PFNRT)RTNetIPv4TCPChecksum,
474	(PFNRT)RTNetIPv4UDPChecksum,
475	(PFNRT)RTUuidCompare,
476	(PFNRT)RTUuidCompareStr,
477	(PFNRT)RTUuidFromStr,
478	(PFNRT)RTStrDup,
479	(PFNRT)RTStrFree,
480	NULL
481	};
482	#endif /* RT_OS_DARWIN \|\| RT_OS_SOLARIS \|\| RT_OS_SOLARIS */
483
484
485	/**
486	* Initializes the device extentsion structure.
487	*
488	* @returns IPRT status code.
489	* @param pDevExt The device extension to initialize.
490	*/
491	int VBOXCALL supdrvInitDevExt(PSUPDRVDEVEXT pDevExt)
492	{
493	int rc;
494
495	#ifdef SUPDRV_WITH_RELEASE_LOGGER
496	/*
497	* Create the release log.
498	*/
499	static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
500	PRTLOGGER pRelLogger;
501	rc = RTLogCreate(&pRelLogger, 0 /* fFlags */, "all",
502	"VBOX_RELEASE_LOG", RT_ELEMENTS(s_apszGroups), s_apszGroups,
503	RTLOGDEST_STDOUT \| RTLOGDEST_DEBUGGER, NULL);
504	if (RT_SUCCESS(rc))
505	RTLogRelSetDefaultInstance(pRelLogger);
506	#endif
507
508	/*
509	* Initialize it.
510	*/
511	memset(pDevExt, 0, sizeof(*pDevExt));
512	rc = RTSpinlockCreate(&pDevExt->Spinlock);
513	if (!rc)
514	{
515	rc = RTSemFastMutexCreate(&pDevExt->mtxLdr);
516	if (!rc)
517	{
518	rc = RTSemFastMutexCreate(&pDevExt->mtxComponentFactory);
519	if (!rc)
520	{
521	rc = RTSemFastMutexCreate(&pDevExt->mtxGip);
522	if (!rc)
523	{
524	rc = supdrvGipCreate(pDevExt);
525	if (RT_SUCCESS(rc))
526	{
527	pDevExt->u32Cookie = BIRD; /** @todo make this random? */
528
529	/*
530	* Fixup the absolute symbols.
531	*
532	* Because of the table indexing assumptions we'll have a little #ifdef orgy
533	* here rather than distributing this to OS specific files. At least for now.
534	*/
535	#ifdef RT_OS_DARWIN
536	# if ARCH_BITS == 32
537	if (SUPR0GetPagingMode() >= SUPPAGINGMODE_AMD64)
538	{
539	g_aFunctions[0].pfn = (void )1; / SUPR0AbsIs64bit */
540	g_aFunctions[1].pfn = (void )0x80; / SUPR0Abs64bitKernelCS - KERNEL64_CS, seg.h */
541	g_aFunctions[2].pfn = (void )0x88; / SUPR0Abs64bitKernelSS - KERNEL64_SS, seg.h */
542	g_aFunctions[3].pfn = (void )0x88; / SUPR0Abs64bitKernelDS - KERNEL64_SS, seg.h */
543	}
544	else
545	g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[4].pfn = (void *)0;
546	g_aFunctions[4].pfn = (void )0x08; / SUPR0AbsKernelCS - KERNEL_CS, seg.h */
547	g_aFunctions[5].pfn = (void )0x10; / SUPR0AbsKernelSS - KERNEL_DS, seg.h */
548	g_aFunctions[6].pfn = (void )0x10; / SUPR0AbsKernelDS - KERNEL_DS, seg.h */
549	g_aFunctions[7].pfn = (void )0x10; / SUPR0AbsKernelES - KERNEL_DS, seg.h */
550	g_aFunctions[8].pfn = (void )0x10; / SUPR0AbsKernelFS - KERNEL_DS, seg.h */
551	g_aFunctions[9].pfn = (void )0x48; / SUPR0AbsKernelGS - CPU_DATA_GS, seg.h */
552	# else /* 64-bit darwin: */
553	g_aFunctions[0].pfn = (void )1; / SUPR0AbsIs64bit */
554	g_aFunctions[1].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0Abs64bitKernelCS */
555	g_aFunctions[2].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0Abs64bitKernelSS */
556	g_aFunctions[3].pfn = (void )0; / SUPR0Abs64bitKernelDS */
557	g_aFunctions[4].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0AbsKernelCS */
558	g_aFunctions[5].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0AbsKernelSS */
559	g_aFunctions[6].pfn = (void )0; / SUPR0AbsKernelDS */
560	g_aFunctions[7].pfn = (void )0; / SUPR0AbsKernelES */
561	g_aFunctions[8].pfn = (void )0; / SUPR0AbsKernelFS */
562	g_aFunctions[9].pfn = (void )0; / SUPR0AbsKernelGS */
563
564	# endif
565	#else /* !RT_OS_DARWIN */
566	# if ARCH_BITS == 64
567	g_aFunctions[0].pfn = (void )1; / SUPR0AbsIs64bit */
568	g_aFunctions[1].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0Abs64bitKernelCS */
569	g_aFunctions[2].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0Abs64bitKernelSS */
570	g_aFunctions[3].pfn = (void )(uintptr_t)ASMGetDS(); / SUPR0Abs64bitKernelDS */
571	# else
572	g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[4].pfn = (void *)0;
573	# endif
574	g_aFunctions[4].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0AbsKernelCS */
575	g_aFunctions[5].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0AbsKernelSS */
576	g_aFunctions[6].pfn = (void )(uintptr_t)ASMGetDS(); / SUPR0AbsKernelDS */
577	g_aFunctions[7].pfn = (void )(uintptr_t)ASMGetES(); / SUPR0AbsKernelES */
578	g_aFunctions[8].pfn = (void )(uintptr_t)ASMGetFS(); / SUPR0AbsKernelFS */
579	g_aFunctions[9].pfn = (void )(uintptr_t)ASMGetGS(); / SUPR0AbsKernelGS */
580	#endif /* !RT_OS_DARWIN */
581	return VINF_SUCCESS;
582	}
583
584	RTSemFastMutexDestroy(pDevExt->mtxGip);
585	pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
586	}
587	RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
588	pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
589	}
590	RTSemFastMutexDestroy(pDevExt->mtxLdr);
591	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
592	}
593	RTSpinlockDestroy(pDevExt->Spinlock);
594	pDevExt->Spinlock = NIL_RTSPINLOCK;
595	}
596	#ifdef SUPDRV_WITH_RELEASE_LOGGER
597	RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
598	RTLogDestroy(RTLogSetDefaultInstance(NULL));
599	#endif
600
601	return rc;
602	}
603
604
605	/**
606	* Delete the device extension (e.g. cleanup members).
607	*
608	* @param pDevExt The device extension to delete.
609	*/
610	void VBOXCALL supdrvDeleteDevExt(PSUPDRVDEVEXT pDevExt)
611	{
612	PSUPDRVOBJ pObj;
613	PSUPDRVUSAGE pUsage;
614
615	/*
616	* Kill mutexes and spinlocks.
617	*/
618	RTSemFastMutexDestroy(pDevExt->mtxGip);
619	pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
620	RTSemFastMutexDestroy(pDevExt->mtxLdr);
621	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
622	RTSpinlockDestroy(pDevExt->Spinlock);
623	pDevExt->Spinlock = NIL_RTSPINLOCK;
624	RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
625	pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
626
627	/*
628	* Free lists.
629	*/
630	/* objects. */
631	pObj = pDevExt->pObjs;
632	#if !defined(DEBUG_bird) \|\| !defined(RT_OS_LINUX) /* breaks unloading, temporary, remove me! */
633	Assert(!pObj); /* (can trigger on forced unloads) */
634	#endif
635	pDevExt->pObjs = NULL;
636	while (pObj)
637	{
638	void *pvFree = pObj;
639	pObj = pObj->pNext;
640	RTMemFree(pvFree);
641	}
642
643	/* usage records. */
644	pUsage = pDevExt->pUsageFree;
645	pDevExt->pUsageFree = NULL;
646	while (pUsage)
647	{
648	void *pvFree = pUsage;
649	pUsage = pUsage->pNext;
650	RTMemFree(pvFree);
651	}
652
653	/* kill the GIP. */
654	supdrvGipDestroy(pDevExt);
655
656	#ifdef SUPDRV_WITH_RELEASE_LOGGER
657	/* destroy the loggers. */
658	RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
659	RTLogDestroy(RTLogSetDefaultInstance(NULL));
660	#endif
661	}
662
663
664	/**
665	* Create session.
666	*
667	* @returns IPRT status code.
668	* @param pDevExt Device extension.
669	* @param fUser Flag indicating whether this is a user or kernel session.
670	* @param ppSession Where to store the pointer to the session data.
671	*/
672	int VBOXCALL supdrvCreateSession(PSUPDRVDEVEXT pDevExt, bool fUser, PSUPDRVSESSION *ppSession)
673	{
674	/*
675	* Allocate memory for the session data.
676	*/
677	int rc = VERR_NO_MEMORY;
678	PSUPDRVSESSION pSession = ppSession = (PSUPDRVSESSION)RTMemAllocZ(sizeof(pSession));
679	if (pSession)
680	{
681	/* Initialize session data. */
682	rc = RTSpinlockCreate(&pSession->Spinlock);
683	if (!rc)
684	{
685	rc = RTHandleTableCreateEx(&pSession->hHandleTable,
686	RTHANDLETABLE_FLAGS_LOCKED \| RTHANDLETABLE_FLAGS_CONTEXT,
687	1 /uBase/, 32768 /cMax/, supdrvSessionObjHandleRetain, pSession);
688	if (RT_SUCCESS(rc))
689	{
690	Assert(pSession->Spinlock != NIL_RTSPINLOCK);
691	pSession->pDevExt = pDevExt;
692	pSession->u32Cookie = BIRD_INV;
693	/*pSession->pLdrUsage = NULL;
694	pSession->pVM = NULL;
695	pSession->pUsage = NULL;
696	pSession->pGip = NULL;
697	pSession->fGipReferenced = false;
698	pSession->Bundle.cUsed = 0; */
699	pSession->Uid = NIL_RTUID;
700	pSession->Gid = NIL_RTGID;
701	if (fUser)
702	{
703	pSession->Process = RTProcSelf();
704	pSession->R0Process = RTR0ProcHandleSelf();
705	}
706	else
707	{
708	pSession->Process = NIL_RTPROCESS;
709	pSession->R0Process = NIL_RTR0PROCESS;
710	}
711
712	LogFlow(("Created session %p initial cookie=%#x\n", pSession, pSession->u32Cookie));
713	return VINF_SUCCESS;
714	}
715
716	RTSpinlockDestroy(pSession->Spinlock);
717	}
718	RTMemFree(pSession);
719	*ppSession = NULL;
720	Log(("Failed to create spinlock, rc=%d!\n", rc));
721	}
722
723	return rc;
724	}
725
726
727	/**
728	* Shared code for cleaning up a session.
729	*
730	* @param pDevExt Device extension.
731	* @param pSession Session data.
732	* This data will be freed by this routine.
733	*/
734	void VBOXCALL supdrvCloseSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
735	{
736	/*
737	* Cleanup the session first.
738	*/
739	supdrvCleanupSession(pDevExt, pSession);
740
741	/*
742	* Free the rest of the session stuff.
743	*/
744	RTSpinlockDestroy(pSession->Spinlock);
745	pSession->Spinlock = NIL_RTSPINLOCK;
746	pSession->pDevExt = NULL;
747	RTMemFree(pSession);
748	LogFlow(("supdrvCloseSession: returns\n"));
749	}
750
751
752	/**
753	* Shared code for cleaning up a session (but not quite freeing it).
754	*
755	* This is primarily intended for MAC OS X where we have to clean up the memory
756	* stuff before the file handle is closed.
757	*
758	* @param pDevExt Device extension.
759	* @param pSession Session data.
760	* This data will be freed by this routine.
761	*/
762	void VBOXCALL supdrvCleanupSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
763	{
764	int rc;
765	PSUPDRVBUNDLE pBundle;
766	LogFlow(("supdrvCleanupSession: pSession=%p\n", pSession));
767
768	/*
769	* Remove logger instances related to this session.
770	*/
771	RTLogSetDefaultInstanceThread(NULL, (uintptr_t)pSession);
772
773	/*
774	* Destroy the handle table.
775	*/
776	rc = RTHandleTableDestroy(pSession->hHandleTable, supdrvSessionObjHandleDelete, pSession);
777	AssertRC(rc);
778	pSession->hHandleTable = NIL_RTHANDLETABLE;
779
780	/*
781	* Release object references made in this session.
782	* In theory there should be noone racing us in this session.
783	*/
784	Log2(("release objects - start\n"));
785	if (pSession->pUsage)
786	{
787	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
788	PSUPDRVUSAGE pUsage;
789	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
790
791	while ((pUsage = pSession->pUsage) != NULL)
792	{
793	PSUPDRVOBJ pObj = pUsage->pObj;
794	pSession->pUsage = pUsage->pNext;
795
796	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
797	if (pUsage->cUsage < pObj->cUsage)
798	{
799	pObj->cUsage -= pUsage->cUsage;
800	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
801	}
802	else
803	{
804	/* Destroy the object and free the record. */
805	if (pDevExt->pObjs == pObj)
806	pDevExt->pObjs = pObj->pNext;
807	else
808	{
809	PSUPDRVOBJ pObjPrev;
810	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
811	if (pObjPrev->pNext == pObj)
812	{
813	pObjPrev->pNext = pObj->pNext;
814	break;
815	}
816	Assert(pObjPrev);
817	}
818	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
819
820	Log(("supdrvCleanupSession: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
821	pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
822	if (pObj->pfnDestructor)
823	#ifdef RT_WITH_W64_UNWIND_HACK
824	supdrvNtWrapObjDestructor((PFNRT)pObj->pfnDestructor, pObj, pObj->pvUser1, pObj->pvUser2);
825	#else
826	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
827	#endif
828	RTMemFree(pObj);
829	}
830
831	/* free it and continue. */
832	RTMemFree(pUsage);
833
834	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
835	}
836
837	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
838	AssertMsg(!pSession->pUsage, ("Some buster reregistered an object during desturction!\n"));
839	}
840	Log2(("release objects - done\n"));
841
842	/*
843	* Release memory allocated in the session.
844	*
845	* We do not serialize this as we assume that the application will
846	* not allocated memory while closing the file handle object.
847	*/
848	Log2(("freeing memory:\n"));
849	pBundle = &pSession->Bundle;
850	while (pBundle)
851	{
852	PSUPDRVBUNDLE pToFree;
853	unsigned i;
854
855	/*
856	* Check and unlock all entries in the bundle.
857	*/
858	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
859	{
860	if (pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ)
861	{
862	int rc;
863	Log2(("eType=%d pvR0=%p pvR3=%p cb=%ld\n", pBundle->aMem[i].eType, RTR0MemObjAddress(pBundle->aMem[i].MemObj),
864	(void *)RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3), (long)RTR0MemObjSize(pBundle->aMem[i].MemObj)));
865	if (pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ)
866	{
867	rc = RTR0MemObjFree(pBundle->aMem[i].MapObjR3, false);
868	AssertRC(rc); /** @todo figure out how to handle this. */
869	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
870	}
871	rc = RTR0MemObjFree(pBundle->aMem[i].MemObj, true /* fFreeMappings */);
872	AssertRC(rc); /** @todo figure out how to handle this. */
873	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
874	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
875	}
876	}
877
878	/*
879	* Advance and free previous bundle.
880	*/
881	pToFree = pBundle;
882	pBundle = pBundle->pNext;
883
884	pToFree->pNext = NULL;
885	pToFree->cUsed = 0;
886	if (pToFree != &pSession->Bundle)
887	RTMemFree(pToFree);
888	}
889	Log2(("freeing memory - done\n"));
890
891	/*
892	* Deregister component factories.
893	*/
894	RTSemFastMutexRequest(pDevExt->mtxComponentFactory);
895	Log2(("deregistering component factories:\n"));
896	if (pDevExt->pComponentFactoryHead)
897	{
898	PSUPDRVFACTORYREG pPrev = NULL;
899	PSUPDRVFACTORYREG pCur = pDevExt->pComponentFactoryHead;
900	while (pCur)
901	{
902	if (pCur->pSession == pSession)
903	{
904	/* unlink it */
905	PSUPDRVFACTORYREG pNext = pCur->pNext;
906	if (pPrev)
907	pPrev->pNext = pNext;
908	else
909	pDevExt->pComponentFactoryHead = pNext;
910
911	/* free it */
912	pCur->pNext = NULL;
913	pCur->pSession = NULL;
914	pCur->pFactory = NULL;
915	RTMemFree(pCur);
916
917	/* next */
918	pCur = pNext;
919	}
920	else
921	{
922	/* next */
923	pPrev = pCur;
924	pCur = pCur->pNext;
925	}
926	}
927	}
928	RTSemFastMutexRelease(pDevExt->mtxComponentFactory);
929	Log2(("deregistering component factories - done\n"));
930
931	/*
932	* Loaded images needs to be dereferenced and possibly freed up.
933	*/
934	RTSemFastMutexRequest(pDevExt->mtxLdr);
935	Log2(("freeing images:\n"));
936	if (pSession->pLdrUsage)
937	{
938	PSUPDRVLDRUSAGE pUsage = pSession->pLdrUsage;
939	pSession->pLdrUsage = NULL;
940	while (pUsage)
941	{
942	void *pvFree = pUsage;
943	PSUPDRVLDRIMAGE pImage = pUsage->pImage;
944	if (pImage->cUsage > pUsage->cUsage)
945	pImage->cUsage -= pUsage->cUsage;
946	else
947	supdrvLdrFree(pDevExt, pImage);
948	pUsage->pImage = NULL;
949	pUsage = pUsage->pNext;
950	RTMemFree(pvFree);
951	}
952	}
953	RTSemFastMutexRelease(pDevExt->mtxLdr);
954	Log2(("freeing images - done\n"));
955
956	/*
957	* Unmap the GIP.
958	*/
959	Log2(("umapping GIP:\n"));
960	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
961	{
962	SUPR0GipUnmap(pSession);
963	pSession->fGipReferenced = 0;
964	}
965	Log2(("umapping GIP - done\n"));
966	}
967
968
969	/**
970	* RTHandleTableDestroy callback used by supdrvCleanupSession.
971	*
972	* @returns IPRT status code, see SUPR0ObjAddRef.
973	* @param hHandleTable The handle table handle. Ignored.
974	* @param pvObj The object pointer.
975	* @param pvCtx Context, the handle type. Ignored.
976	* @param pvUser Session pointer.
977	*/
978	static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void pvObj, void pvCtx, void *pvUser)
979	{
980	NOREF(pvCtx);
981	NOREF(hHandleTable);
982	return SUPR0ObjAddRef(pvObj, (PSUPDRVSESSION)pvUser);
983	}
984
985
986	/**
987	* RTHandleTableDestroy callback used by supdrvCleanupSession.
988	*
989	* @param hHandleTable The handle table handle. Ignored.
990	* @param h The handle value. Ignored.
991	* @param pvObj The object pointer.
992	* @param pvCtx Context, the handle type. Ignored.
993	* @param pvUser Session pointer.
994	*/
995	static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void pvObj, void pvCtx, void *pvUser)
996	{
997	NOREF(pvCtx);
998	NOREF(h);
999	NOREF(hHandleTable);
1000	SUPR0ObjRelease(pvObj, (PSUPDRVSESSION)pvUser);
1001	}
1002
1003
1004	/**
1005	* Fast path I/O Control worker.
1006	*
1007	* @returns VBox status code that should be passed down to ring-3 unchanged.
1008	* @param uIOCtl Function number.
1009	* @param idCpu VMCPU id.
1010	* @param pDevExt Device extention.
1011	* @param pSession Session data.
1012	*/
1013	int VBOXCALL supdrvIOCtlFast(uintptr_t uIOCtl, VMCPUID idCpu, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
1014	{
1015	/*
1016	* We check the two prereqs after doing this only to allow the compiler to optimize things better.
1017	*/
1018	if (RT_LIKELY(pSession->pVM && pDevExt->pfnVMMR0EntryFast))
1019	{
1020	switch (uIOCtl)
1021	{
1022	case SUP_IOCTL_FAST_DO_RAW_RUN:
1023	#ifdef RT_WITH_W64_UNWIND_HACK
1024	supdrvNtWrapVMMR0EntryFast((PFNRT)pDevExt->pfnVMMR0EntryFast, pSession->pVM, idCpu, SUP_VMMR0_DO_RAW_RUN);
1025	#else
1026	pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_RAW_RUN);
1027	#endif
1028	break;
1029	case SUP_IOCTL_FAST_DO_HWACC_RUN:
1030	#ifdef RT_WITH_W64_UNWIND_HACK
1031	supdrvNtWrapVMMR0EntryFast((PFNRT)pDevExt->pfnVMMR0EntryFast, pSession->pVM, idCpu, SUP_VMMR0_DO_HWACC_RUN);
1032	#else
1033	pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_HWACC_RUN);
1034	#endif
1035	break;
1036	case SUP_IOCTL_FAST_DO_NOP:
1037	#ifdef RT_WITH_W64_UNWIND_HACK
1038	supdrvNtWrapVMMR0EntryFast((PFNRT)pDevExt->pfnVMMR0EntryFast, pSession->pVM, idCpu, SUP_VMMR0_DO_NOP);
1039	#else
1040	pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_NOP);
1041	#endif
1042	break;
1043	default:
1044	return VERR_INTERNAL_ERROR;
1045	}
1046	return VINF_SUCCESS;
1047	}
1048	return VERR_INTERNAL_ERROR;
1049	}
1050
1051
1052	/**
1053	* Helper for supdrvIOCtl. Check if pszStr contains any character of pszChars.
1054	* We would use strpbrk here if this function would be contained in the RedHat kABI white
1055	* list, see http://www.kerneldrivers.org/RHEL5.
1056	*
1057	* @return 1 if pszStr does contain any character of pszChars, 0 otherwise.
1058	* @param pszStr String to check
1059	* @param pszChars Character set
1060	*/
1061	static int supdrvCheckInvalidChar(const char pszStr, const char pszChars)
1062	{
1063	int chCur;
1064	while ((chCur = *pszStr++) != '\0')
1065	{
1066	int ch;
1067	const char *psz = pszChars;
1068	while ((ch = *psz++) != '\0')
1069	if (ch == chCur)
1070	return 1;
1071
1072	}
1073	return 0;
1074	}
1075
1076
1077	/**
1078	* I/O Control worker.
1079	*
1080	* @returns 0 on success.
1081	* @returns VERR_INVALID_PARAMETER if the request is invalid.
1082	*
1083	* @param uIOCtl Function number.
1084	* @param pDevExt Device extention.
1085	* @param pSession Session data.
1086	* @param pReqHdr The request header.
1087	*/
1088	int VBOXCALL supdrvIOCtl(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPREQHDR pReqHdr)
1089	{
1090	/*
1091	* Validate the request.
1092	*/
1093	/* this first check could probably be omitted as its also done by the OS specific code... */
1094	if (RT_UNLIKELY( (pReqHdr->fFlags & SUPREQHDR_FLAGS_MAGIC_MASK) != SUPREQHDR_FLAGS_MAGIC
1095	\|\| pReqHdr->cbIn < sizeof(*pReqHdr)
1096	\|\| pReqHdr->cbOut < sizeof(*pReqHdr)))
1097	{
1098	OSDBGPRINT(("vboxdrv: Bad ioctl request header; cbIn=%#lx cbOut=%#lx fFlags=%#lx\n",
1099	(long)pReqHdr->cbIn, (long)pReqHdr->cbOut, (long)pReqHdr->fFlags));
1100	return VERR_INVALID_PARAMETER;
1101	}
1102	if (RT_UNLIKELY(uIOCtl == SUP_IOCTL_COOKIE))
1103	{
1104	if (pReqHdr->u32Cookie != SUPCOOKIE_INITIAL_COOKIE)
1105	{
1106	OSDBGPRINT(("SUP_IOCTL_COOKIE: bad cookie %#lx\n", (long)pReqHdr->u32Cookie));
1107	return VERR_INVALID_PARAMETER;
1108	}
1109	}
1110	else if (RT_UNLIKELY( pReqHdr->u32Cookie != pDevExt->u32Cookie
1111	\|\| pReqHdr->u32SessionCookie != pSession->u32Cookie))
1112	{
1113	OSDBGPRINT(("vboxdrv: bad cookie %#lx / %#lx.\n", (long)pReqHdr->u32Cookie, (long)pReqHdr->u32SessionCookie));
1114	return VERR_INVALID_PARAMETER;
1115	}
1116
1117	/*
1118	* Validation macros
1119	*/
1120	#define REQ_CHECK_SIZES_EX(Name, cbInExpect, cbOutExpect) \
1121	do { \
1122	if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect) \|\| pReqHdr->cbOut != (cbOutExpect))) \
1123	{ \
1124	OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld. cbOut=%ld expected %ld.\n", \
1125	(long)pReq->Hdr.cbIn, (long)(cbInExpect), (long)pReq->Hdr.cbOut, (long)(cbOutExpect))); \
1126	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1127	} \
1128	} while (0)
1129
1130	#define REQ_CHECK_SIZES(Name) REQ_CHECK_SIZES_EX(Name, Name ## _SIZE_IN, Name ## _SIZE_OUT)
1131
1132	#define REQ_CHECK_SIZE_IN(Name, cbInExpect) \
1133	do { \
1134	if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect))) \
1135	{ \
1136	OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld.\n", \
1137	(long)pReq->Hdr.cbIn, (long)(cbInExpect))); \
1138	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1139	} \
1140	} while (0)
1141
1142	#define REQ_CHECK_SIZE_OUT(Name, cbOutExpect) \
1143	do { \
1144	if (RT_UNLIKELY(pReqHdr->cbOut != (cbOutExpect))) \
1145	{ \
1146	OSDBGPRINT(( #Name ": Invalid input/output sizes. cbOut=%ld expected %ld.\n", \
1147	(long)pReq->Hdr.cbOut, (long)(cbOutExpect))); \
1148	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1149	} \
1150	} while (0)
1151
1152	#define REQ_CHECK_EXPR(Name, expr) \
1153	do { \
1154	if (RT_UNLIKELY(!(expr))) \
1155	{ \
1156	OSDBGPRINT(( #Name ": %s\n", #expr)); \
1157	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1158	} \
1159	} while (0)
1160
1161	#define REQ_CHECK_EXPR_FMT(expr, fmt) \
1162	do { \
1163	if (RT_UNLIKELY(!(expr))) \
1164	{ \
1165	OSDBGPRINT( fmt ); \
1166	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1167	} \
1168	} while (0)
1169
1170
1171	/*
1172	* The switch.
1173	*/
1174	switch (SUP_CTL_CODE_NO_SIZE(uIOCtl))
1175	{
1176	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_COOKIE):
1177	{
1178	PSUPCOOKIE pReq = (PSUPCOOKIE)pReqHdr;
1179	REQ_CHECK_SIZES(SUP_IOCTL_COOKIE);
1180	if (strncmp(pReq->u.In.szMagic, SUPCOOKIE_MAGIC, sizeof(pReq->u.In.szMagic)))
1181	{
1182	OSDBGPRINT(("SUP_IOCTL_COOKIE: invalid magic %.16s\n", pReq->u.In.szMagic));
1183	pReq->Hdr.rc = VERR_INVALID_MAGIC;
1184	return 0;
1185	}
1186
1187	#if 0
1188	/*
1189	* Call out to the OS specific code and let it do permission checks on the
1190	* client process.
1191	*/
1192	if (!supdrvOSValidateClientProcess(pDevExt, pSession))
1193	{
1194	pReq->u.Out.u32Cookie = 0xffffffff;
1195	pReq->u.Out.u32SessionCookie = 0xffffffff;
1196	pReq->u.Out.u32SessionVersion = 0xffffffff;
1197	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1198	pReq->u.Out.pSession = NULL;
1199	pReq->u.Out.cFunctions = 0;
1200	pReq->Hdr.rc = VERR_PERMISSION_DENIED;
1201	return 0;
1202	}
1203	#endif
1204
1205	/*
1206	* Match the version.
1207	* The current logic is very simple, match the major interface version.
1208	*/
1209	if ( pReq->u.In.u32MinVersion > SUPDRV_IOC_VERSION
1210	\|\| (pReq->u.In.u32MinVersion & 0xffff0000) != (SUPDRV_IOC_VERSION & 0xffff0000))
1211	{
1212	OSDBGPRINT(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
1213	pReq->u.In.u32ReqVersion, pReq->u.In.u32MinVersion, SUPDRV_IOC_VERSION));
1214	pReq->u.Out.u32Cookie = 0xffffffff;
1215	pReq->u.Out.u32SessionCookie = 0xffffffff;
1216	pReq->u.Out.u32SessionVersion = 0xffffffff;
1217	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1218	pReq->u.Out.pSession = NULL;
1219	pReq->u.Out.cFunctions = 0;
1220	pReq->Hdr.rc = VERR_VERSION_MISMATCH;
1221	return 0;
1222	}
1223
1224	/*
1225	* Fill in return data and be gone.
1226	* N.B. The first one to change SUPDRV_IOC_VERSION shall makes sure that
1227	* u32SessionVersion <= u32ReqVersion!
1228	*/
1229	/** @todo Somehow validate the client and negotiate a secure cookie... */
1230	pReq->u.Out.u32Cookie = pDevExt->u32Cookie;
1231	pReq->u.Out.u32SessionCookie = pSession->u32Cookie;
1232	pReq->u.Out.u32SessionVersion = SUPDRV_IOC_VERSION;
1233	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1234	pReq->u.Out.pSession = pSession;
1235	pReq->u.Out.cFunctions = sizeof(g_aFunctions) / sizeof(g_aFunctions[0]);
1236	pReq->Hdr.rc = VINF_SUCCESS;
1237	return 0;
1238	}
1239
1240	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_QUERY_FUNCS(0)):
1241	{
1242	/* validate */
1243	PSUPQUERYFUNCS pReq = (PSUPQUERYFUNCS)pReqHdr;
1244	REQ_CHECK_SIZES_EX(SUP_IOCTL_QUERY_FUNCS, SUP_IOCTL_QUERY_FUNCS_SIZE_IN, SUP_IOCTL_QUERY_FUNCS_SIZE_OUT(RT_ELEMENTS(g_aFunctions)));
1245
1246	/* execute */
1247	pReq->u.Out.cFunctions = RT_ELEMENTS(g_aFunctions);
1248	memcpy(&pReq->u.Out.aFunctions[0], g_aFunctions, sizeof(g_aFunctions));
1249	pReq->Hdr.rc = VINF_SUCCESS;
1250	return 0;
1251	}
1252
1253	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_LOCK):
1254	{
1255	/* validate */
1256	PSUPPAGELOCK pReq = (PSUPPAGELOCK)pReqHdr;
1257	REQ_CHECK_SIZE_IN(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_IN);
1258	REQ_CHECK_SIZE_OUT(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_OUT(pReq->u.In.cPages));
1259	REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.cPages > 0);
1260	REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.pvR3 >= PAGE_SIZE);
1261
1262	/* execute */
1263	pReq->Hdr.rc = SUPR0LockMem(pSession, pReq->u.In.pvR3, pReq->u.In.cPages, &pReq->u.Out.aPages[0]);
1264	if (RT_FAILURE(pReq->Hdr.rc))
1265	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1266	return 0;
1267	}
1268
1269	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_UNLOCK):
1270	{
1271	/* validate */
1272	PSUPPAGEUNLOCK pReq = (PSUPPAGEUNLOCK)pReqHdr;
1273	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_UNLOCK);
1274
1275	/* execute */
1276	pReq->Hdr.rc = SUPR0UnlockMem(pSession, pReq->u.In.pvR3);
1277	return 0;
1278	}
1279
1280	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_ALLOC):
1281	{
1282	/* validate */
1283	PSUPCONTALLOC pReq = (PSUPCONTALLOC)pReqHdr;
1284	REQ_CHECK_SIZES(SUP_IOCTL_CONT_ALLOC);
1285
1286	/* execute */
1287	pReq->Hdr.rc = SUPR0ContAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.HCPhys);
1288	if (RT_FAILURE(pReq->Hdr.rc))
1289	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1290	return 0;
1291	}
1292
1293	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_FREE):
1294	{
1295	/* validate */
1296	PSUPCONTFREE pReq = (PSUPCONTFREE)pReqHdr;
1297	REQ_CHECK_SIZES(SUP_IOCTL_CONT_FREE);
1298
1299	/* execute */
1300	pReq->Hdr.rc = SUPR0ContFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1301	return 0;
1302	}
1303
1304	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_OPEN):
1305	{
1306	/* validate */
1307	PSUPLDROPEN pReq = (PSUPLDROPEN)pReqHdr;
1308	REQ_CHECK_SIZES(SUP_IOCTL_LDR_OPEN);
1309	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImage > 0);
1310	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImage < _1M*16);
1311	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.szName[0]);
1312	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, memchr(pReq->u.In.szName, '\0', sizeof(pReq->u.In.szName)));
1313	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, !supdrvCheckInvalidChar(pReq->u.In.szName, ";:()[]{}/\\\|&*%#@!~`\"'"));
1314
1315	/* execute */
1316	pReq->Hdr.rc = supdrvIOCtl_LdrOpen(pDevExt, pSession, pReq);
1317	return 0;
1318	}
1319
1320	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_LOAD):
1321	{
1322	/* validate */
1323	PSUPLDRLOAD pReq = (PSUPLDRLOAD)pReqHdr;
1324	REQ_CHECK_EXPR(Name, pReq->Hdr.cbIn >= sizeof(*pReq));
1325	REQ_CHECK_SIZES_EX(SUP_IOCTL_LDR_LOAD, SUP_IOCTL_LDR_LOAD_SIZE_IN(pReq->u.In.cbImage), SUP_IOCTL_LDR_LOAD_SIZE_OUT);
1326	REQ_CHECK_EXPR(SUP_IOCTL_LDR_LOAD, pReq->u.In.cSymbols <= 16384);
1327	REQ_CHECK_EXPR_FMT( !pReq->u.In.cSymbols
1328	\|\| ( pReq->u.In.offSymbols < pReq->u.In.cbImage
1329	&& pReq->u.In.offSymbols + pReq->u.In.cSymbols * sizeof(SUPLDRSYM) <= pReq->u.In.cbImage),
1330	("SUP_IOCTL_LDR_LOAD: offSymbols=%#lx cSymbols=%#lx cbImage=%#lx\n", (long)pReq->u.In.offSymbols,
1331	(long)pReq->u.In.cSymbols, (long)pReq->u.In.cbImage));
1332	REQ_CHECK_EXPR_FMT( !pReq->u.In.cbStrTab
1333	\|\| ( pReq->u.In.offStrTab < pReq->u.In.cbImage
1334	&& pReq->u.In.offStrTab + pReq->u.In.cbStrTab <= pReq->u.In.cbImage
1335	&& pReq->u.In.cbStrTab <= pReq->u.In.cbImage),
1336	("SUP_IOCTL_LDR_LOAD: offStrTab=%#lx cbStrTab=%#lx cbImage=%#lx\n", (long)pReq->u.In.offStrTab,
1337	(long)pReq->u.In.cbStrTab, (long)pReq->u.In.cbImage));
1338
1339	if (pReq->u.In.cSymbols)
1340	{
1341	uint32_t i;
1342	PSUPLDRSYM paSyms = (PSUPLDRSYM)&pReq->u.In.achImage[pReq->u.In.offSymbols];
1343	for (i = 0; i < pReq->u.In.cSymbols; i++)
1344	{
1345	REQ_CHECK_EXPR_FMT(paSyms[i].offSymbol < pReq->u.In.cbImage,
1346	("SUP_IOCTL_LDR_LOAD: sym #%ld: symb off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offSymbol, (long)pReq->u.In.cbImage));
1347	REQ_CHECK_EXPR_FMT(paSyms[i].offName < pReq->u.In.cbStrTab,
1348	("SUP_IOCTL_LDR_LOAD: sym #%ld: name off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImage));
1349	REQ_CHECK_EXPR_FMT(memchr(&pReq->u.In.achImage[pReq->u.In.offStrTab + paSyms[i].offName], '\0', pReq->u.In.cbStrTab - paSyms[i].offName),
1350	("SUP_IOCTL_LDR_LOAD: sym #%ld: unterminated name! (%#lx / %#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImage));
1351	}
1352	}
1353
1354	/* execute */
1355	pReq->Hdr.rc = supdrvIOCtl_LdrLoad(pDevExt, pSession, pReq);
1356	return 0;
1357	}
1358
1359	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_FREE):
1360	{
1361	/* validate */
1362	PSUPLDRFREE pReq = (PSUPLDRFREE)pReqHdr;
1363	REQ_CHECK_SIZES(SUP_IOCTL_LDR_FREE);
1364
1365	/* execute */
1366	pReq->Hdr.rc = supdrvIOCtl_LdrFree(pDevExt, pSession, pReq);
1367	return 0;
1368	}
1369
1370	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_GET_SYMBOL):
1371	{
1372	/* validate */
1373	PSUPLDRGETSYMBOL pReq = (PSUPLDRGETSYMBOL)pReqHdr;
1374	REQ_CHECK_SIZES(SUP_IOCTL_LDR_GET_SYMBOL);
1375	REQ_CHECK_EXPR(SUP_IOCTL_LDR_GET_SYMBOL, memchr(pReq->u.In.szSymbol, '\0', sizeof(pReq->u.In.szSymbol)));
1376
1377	/* execute */
1378	pReq->Hdr.rc = supdrvIOCtl_LdrGetSymbol(pDevExt, pSession, pReq);
1379	return 0;
1380	}
1381
1382	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_VMMR0(0)):
1383	{
1384	/* validate */
1385	PSUPCALLVMMR0 pReq = (PSUPCALLVMMR0)pReqHdr;
1386	Log4(("SUP_IOCTL_CALL_VMMR0: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1387	pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1388
1389	if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_VMMR0_SIZE(0))
1390	{
1391	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(0), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(0));
1392
1393	/* execute */
1394	if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1395	#ifdef RT_WITH_W64_UNWIND_HACK
1396	pReq->Hdr.rc = supdrvNtWrapVMMR0EntryEx((PFNRT)pDevExt->pfnVMMR0EntryEx, pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, NULL, pReq->u.In.u64Arg, pSession);
1397	#else
1398	pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, NULL, pReq->u.In.u64Arg, pSession);
1399	#endif
1400	else
1401	pReq->Hdr.rc = VERR_WRONG_ORDER;
1402	}
1403	else
1404	{
1405	PSUPVMMR0REQHDR pVMMReq = (PSUPVMMR0REQHDR)&pReq->abReqPkt[0];
1406	REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR)),
1407	("SUP_IOCTL_CALL_VMMR0: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR))));
1408	REQ_CHECK_EXPR(SUP_IOCTL_CALL_VMMR0, pVMMReq->u32Magic == SUPVMMR0REQHDR_MAGIC);
1409	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(pVMMReq->cbReq), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(pVMMReq->cbReq));
1410
1411	/* execute */
1412	if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1413	#ifdef RT_WITH_W64_UNWIND_HACK
1414	pReq->Hdr.rc = supdrvNtWrapVMMR0EntryEx((PFNRT)pDevExt->pfnVMMR0EntryEx, pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1415	#else
1416	pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1417	#endif
1418	else
1419	pReq->Hdr.rc = VERR_WRONG_ORDER;
1420	}
1421
1422	if ( RT_FAILURE(pReq->Hdr.rc)
1423	&& pReq->Hdr.rc != VERR_INTERRUPTED
1424	&& pReq->Hdr.rc != VERR_TIMEOUT)
1425	Log(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1426	pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1427	else
1428	Log4(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1429	pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1430	return 0;
1431	}
1432
1433	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GET_PAGING_MODE):
1434	{
1435	/* validate */
1436	PSUPGETPAGINGMODE pReq = (PSUPGETPAGINGMODE)pReqHdr;
1437	REQ_CHECK_SIZES(SUP_IOCTL_GET_PAGING_MODE);
1438
1439	/* execute */
1440	pReq->Hdr.rc = VINF_SUCCESS;
1441	pReq->u.Out.enmMode = SUPR0GetPagingMode();
1442	return 0;
1443	}
1444
1445	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_ALLOC):
1446	{
1447	/* validate */
1448	PSUPLOWALLOC pReq = (PSUPLOWALLOC)pReqHdr;
1449	REQ_CHECK_EXPR(SUP_IOCTL_LOW_ALLOC, pReq->Hdr.cbIn <= SUP_IOCTL_LOW_ALLOC_SIZE_IN);
1450	REQ_CHECK_SIZES_EX(SUP_IOCTL_LOW_ALLOC, SUP_IOCTL_LOW_ALLOC_SIZE_IN, SUP_IOCTL_LOW_ALLOC_SIZE_OUT(pReq->u.In.cPages));
1451
1452	/* execute */
1453	pReq->Hdr.rc = SUPR0LowAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.aPages[0]);
1454	if (RT_FAILURE(pReq->Hdr.rc))
1455	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1456	return 0;
1457	}
1458
1459	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_FREE):
1460	{
1461	/* validate */
1462	PSUPLOWFREE pReq = (PSUPLOWFREE)pReqHdr;
1463	REQ_CHECK_SIZES(SUP_IOCTL_LOW_FREE);
1464
1465	/* execute */
1466	pReq->Hdr.rc = SUPR0LowFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1467	return 0;
1468	}
1469
1470	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_MAP):
1471	{
1472	/* validate */
1473	PSUPGIPMAP pReq = (PSUPGIPMAP)pReqHdr;
1474	REQ_CHECK_SIZES(SUP_IOCTL_GIP_MAP);
1475
1476	/* execute */
1477	pReq->Hdr.rc = SUPR0GipMap(pSession, &pReq->u.Out.pGipR3, &pReq->u.Out.HCPhysGip);
1478	if (RT_SUCCESS(pReq->Hdr.rc))
1479	pReq->u.Out.pGipR0 = pDevExt->pGip;
1480	return 0;
1481	}
1482
1483	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_UNMAP):
1484	{
1485	/* validate */
1486	PSUPGIPUNMAP pReq = (PSUPGIPUNMAP)pReqHdr;
1487	REQ_CHECK_SIZES(SUP_IOCTL_GIP_UNMAP);
1488
1489	/* execute */
1490	pReq->Hdr.rc = SUPR0GipUnmap(pSession);
1491	return 0;
1492	}
1493
1494	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SET_VM_FOR_FAST):
1495	{
1496	/* validate */
1497	PSUPSETVMFORFAST pReq = (PSUPSETVMFORFAST)pReqHdr;
1498	REQ_CHECK_SIZES(SUP_IOCTL_SET_VM_FOR_FAST);
1499	REQ_CHECK_EXPR_FMT( !pReq->u.In.pVMR0
1500	\|\| ( VALID_PTR(pReq->u.In.pVMR0)
1501	&& !((uintptr_t)pReq->u.In.pVMR0 & (PAGE_SIZE - 1))),
1502	("SUP_IOCTL_SET_VM_FOR_FAST: pVMR0=%p!\n", pReq->u.In.pVMR0));
1503	/* execute */
1504	pSession->pVM = pReq->u.In.pVMR0;
1505	pReq->Hdr.rc = VINF_SUCCESS;
1506	return 0;
1507	}
1508
1509	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_ALLOC_EX):
1510	{
1511	/* validate */
1512	PSUPPAGEALLOCEX pReq = (PSUPPAGEALLOCEX)pReqHdr;
1513	REQ_CHECK_EXPR(SUP_IOCTL_PAGE_ALLOC_EX, pReq->Hdr.cbIn <= SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN);
1514	REQ_CHECK_SIZES_EX(SUP_IOCTL_PAGE_ALLOC_EX, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_OUT(pReq->u.In.cPages));
1515	REQ_CHECK_EXPR_FMT(pReq->u.In.fKernelMapping \|\| pReq->u.In.fUserMapping,
1516	("SUP_IOCTL_PAGE_ALLOC_EX: No mapping requested!\n"));
1517	REQ_CHECK_EXPR_FMT(pReq->u.In.fUserMapping,
1518	("SUP_IOCTL_PAGE_ALLOC_EX: Must have user mapping!\n"));
1519	REQ_CHECK_EXPR_FMT(!pReq->u.In.fReserved0 && !pReq->u.In.fReserved1,
1520	("SUP_IOCTL_PAGE_ALLOC_EX: fReserved0=%d fReserved1=%d\n", pReq->u.In.fReserved0, pReq->u.In.fReserved1));
1521
1522	/* execute */
1523	pReq->Hdr.rc = SUPR0PageAllocEx(pSession, pReq->u.In.cPages, 0 /* fFlags */,
1524	pReq->u.In.fUserMapping ? &pReq->u.Out.pvR3 : NULL,
1525	pReq->u.In.fKernelMapping ? &pReq->u.Out.pvR0 : NULL,
1526	&pReq->u.Out.aPages[0]);
1527	if (RT_FAILURE(pReq->Hdr.rc))
1528	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1529	return 0;
1530	}
1531
1532	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_MAP_KERNEL):
1533	{
1534	/* validate */
1535	PSUPPAGEMAPKERNEL pReq = (PSUPPAGEMAPKERNEL)pReqHdr;
1536	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_MAP_KERNEL);
1537	REQ_CHECK_EXPR_FMT(!pReq->u.In.fFlags, ("SUP_IOCTL_PAGE_MAP_KERNEL: fFlags=%#x! MBZ\n", pReq->u.In.fFlags));
1538	REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_MAP_KERNEL: offSub=%#x\n", pReq->u.In.offSub));
1539	REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
1540	("SUP_IOCTL_PAGE_MAP_KERNEL: cbSub=%#x\n", pReq->u.In.cbSub));
1541
1542	/* execute */
1543	pReq->Hdr.rc = SUPR0PageMapKernel(pSession, pReq->u.In.pvR3, pReq->u.In.offSub, pReq->u.In.cbSub,
1544	pReq->u.In.fFlags, &pReq->u.Out.pvR0);
1545	if (RT_FAILURE(pReq->Hdr.rc))
1546	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1547	return 0;
1548	}
1549
1550	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_PROTECT):
1551	{
1552	/* validate */
1553	PSUPPAGEPROTECT pReq = (PSUPPAGEPROTECT)pReqHdr;
1554	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_PROTECT);
1555	REQ_CHECK_EXPR_FMT(!(pReq->u.In.fProt & ~(RTMEM_PROT_READ \| RTMEM_PROT_WRITE \| RTMEM_PROT_EXEC \| RTMEM_PROT_NONE)),
1556	("SUP_IOCTL_PAGE_PROTECT: fProt=%#x!\n", pReq->u.In.fProt));
1557	REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_PROTECT: offSub=%#x\n", pReq->u.In.offSub));
1558	REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
1559	("SUP_IOCTL_PAGE_PROTECT: cbSub=%#x\n", pReq->u.In.cbSub));
1560
1561	/* execute */
1562	pReq->Hdr.rc = SUPR0PageProtect(pSession, pReq->u.In.pvR3, pReq->u.In.pvR0, pReq->u.In.offSub, pReq->u.In.cbSub, pReq->u.In.fProt);
1563	return 0;
1564	}
1565
1566	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_FREE):
1567	{
1568	/* validate */
1569	PSUPPAGEFREE pReq = (PSUPPAGEFREE)pReqHdr;
1570	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_FREE);
1571
1572	/* execute */
1573	pReq->Hdr.rc = SUPR0PageFree(pSession, pReq->u.In.pvR3);
1574	return 0;
1575	}
1576
1577	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_SERVICE(0)):
1578	{
1579	/* validate */
1580	PSUPCALLSERVICE pReq = (PSUPCALLSERVICE)pReqHdr;
1581	Log4(("SUP_IOCTL_CALL_SERVICE: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1582	pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1583
1584	if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
1585	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(0), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(0));
1586	else
1587	{
1588	PSUPR0SERVICEREQHDR pSrvReq = (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0];
1589	REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR)),
1590	("SUP_IOCTL_CALL_SERVICE: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR))));
1591	REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, pSrvReq->u32Magic == SUPR0SERVICEREQHDR_MAGIC);
1592	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(pSrvReq->cbReq), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(pSrvReq->cbReq));
1593	}
1594	REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, memchr(pReq->u.In.szName, '\0', sizeof(pReq->u.In.szName)));
1595
1596	/* execute */
1597	pReq->Hdr.rc = supdrvIOCtl_CallServiceModule(pDevExt, pSession, pReq);
1598	return 0;
1599	}
1600
1601	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOGGER_SETTINGS(0)):
1602	{
1603	/* validate */
1604	PSUPLOGGERSETTINGS pReq = (PSUPLOGGERSETTINGS)pReqHdr;
1605	size_t cbStrTab;
1606	REQ_CHECK_SIZE_OUT(SUP_IOCTL_LOGGER_SETTINGS, SUP_IOCTL_LOGGER_SETTINGS_SIZE_OUT);
1607	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->Hdr.cbIn >= SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(1));
1608	cbStrTab = pReq->Hdr.cbIn - SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(0);
1609	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offGroups < cbStrTab);
1610	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offFlags < cbStrTab);
1611	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offDestination < cbStrTab);
1612	REQ_CHECK_EXPR_FMT(pReq->u.In.szStrings[cbStrTab - 1] == '\0',
1613	("SUP_IOCTL_LOGGER_SETTINGS: cbIn=%#x cbStrTab=%#zx LastChar=%d\n",
1614	pReq->Hdr.cbIn, cbStrTab, pReq->u.In.szStrings[cbStrTab - 1]));
1615	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhich <= SUPLOGGERSETTINGS_WHICH_RELEASE);
1616	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhat <= SUPLOGGERSETTINGS_WHAT_DESTROY);
1617
1618	/* execute */
1619	pReq->Hdr.rc = supdrvIOCtl_LoggerSettings(pDevExt, pSession, pReq);
1620	return 0;
1621	}
1622
1623	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_CREATE):
1624	{
1625	/* validate */
1626	PSUPSEMCREATE pReq = (PSUPSEMCREATE)pReqHdr;
1627	REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_CREATE, SUP_IOCTL_SEM_CREATE_SIZE_IN, SUP_IOCTL_SEM_CREATE_SIZE_OUT);
1628
1629	/* execute */
1630	switch (pReq->u.In.uType)
1631	{
1632	case SUP_SEM_TYPE_EVENT:
1633	{
1634	SUPSEMEVENT hEvent;
1635	pReq->Hdr.rc = SUPSemEventCreate(pSession, &hEvent);
1636	pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEvent;
1637	break;
1638	}
1639
1640	case SUP_SEM_TYPE_EVENT_MULTI:
1641	{
1642	SUPSEMEVENTMULTI hEventMulti;
1643	pReq->Hdr.rc = SUPSemEventMultiCreate(pSession, &hEventMulti);
1644	pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEventMulti;
1645	break;
1646	}
1647
1648	default:
1649	pReq->Hdr.rc = VERR_INVALID_PARAMETER;
1650	break;
1651	}
1652	return 0;
1653	}
1654
1655	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_OP):
1656	{
1657	/* validate */
1658	PSUPSEMOP pReq = (PSUPSEMOP)pReqHdr;
1659	REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_OP, SUP_IOCTL_SEM_OP_SIZE_IN, SUP_IOCTL_SEM_OP_SIZE_OUT);
1660
1661	/* execute */
1662	switch (pReq->u.In.uType)
1663	{
1664	case SUP_SEM_TYPE_EVENT:
1665	{
1666	SUPSEMEVENT hEvent = (SUPSEMEVENT)(uintptr_t)pReq->u.In.hSem;
1667	switch (pReq->u.In.uOp)
1668	{
1669	case SUPSEMOP_WAIT:
1670	pReq->Hdr.rc = SUPSemEventWaitNoResume(pSession, hEvent, pReq->u.In.cMillies);
1671	break;
1672	case SUPSEMOP_SIGNAL:
1673	pReq->Hdr.rc = SUPSemEventSignal(pSession, hEvent);
1674	break;
1675	case SUPSEMOP_CLOSE:
1676	pReq->Hdr.rc = SUPSemEventClose(pSession, hEvent);
1677	break;
1678	case SUPSEMOP_RESET:
1679	default:
1680	pReq->Hdr.rc = VERR_INVALID_FUNCTION;
1681	break;
1682	}
1683	break;
1684	}
1685
1686	case SUP_SEM_TYPE_EVENT_MULTI:
1687	{
1688	SUPSEMEVENTMULTI hEventMulti = (SUPSEMEVENTMULTI)(uintptr_t)pReq->u.In.hSem;
1689	switch (pReq->u.In.uOp)
1690	{
1691	case SUPSEMOP_WAIT:
1692	pReq->Hdr.rc = SUPSemEventMultiWaitNoResume(pSession, hEventMulti, pReq->u.In.cMillies);
1693	break;
1694	case SUPSEMOP_SIGNAL:
1695	pReq->Hdr.rc = SUPSemEventMultiSignal(pSession, hEventMulti);
1696	break;
1697	case SUPSEMOP_CLOSE:
1698	pReq->Hdr.rc = SUPSemEventMultiClose(pSession, hEventMulti);
1699	break;
1700	case SUPSEMOP_RESET:
1701	pReq->Hdr.rc = SUPSemEventMultiReset(pSession, hEventMulti);
1702	break;
1703	default:
1704	pReq->Hdr.rc = VERR_INVALID_FUNCTION;
1705	break;
1706	}
1707	break;
1708	}
1709
1710	default:
1711	pReq->Hdr.rc = VERR_INVALID_PARAMETER;
1712	break;
1713	}
1714	return 0;
1715	}
1716
1717	default:
1718	Log(("Unknown IOCTL %#lx\n", (long)uIOCtl));
1719	break;
1720	}
1721	return SUPDRV_ERR_GENERAL_FAILURE;
1722	}
1723
1724
1725	/**
1726	* Inter-Driver Communcation (IDC) worker.
1727	*
1728	* @returns VBox status code.
1729	* @retval VINF_SUCCESS on success.
1730	* @retval VERR_INVALID_PARAMETER if the request is invalid.
1731	* @retval VERR_NOT_SUPPORTED if the request isn't supported.
1732	*
1733	* @param uReq The request (function) code.
1734	* @param pDevExt Device extention.
1735	* @param pSession Session data.
1736	* @param pReqHdr The request header.
1737	*/
1738	int VBOXCALL supdrvIDC(uintptr_t uReq, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQHDR pReqHdr)
1739	{
1740	/*
1741	* The OS specific code has already validated the pSession
1742	* pointer, and the request size being greater or equal to
1743	* size of the header.
1744	*
1745	* So, just check that pSession is a kernel context session.
1746	*/
1747	if (RT_UNLIKELY( pSession
1748	&& pSession->R0Process != NIL_RTR0PROCESS))
1749	return VERR_INVALID_PARAMETER;
1750
1751	/*
1752	* Validation macro.
1753	*/
1754	#define REQ_CHECK_IDC_SIZE(Name, cbExpect) \
1755	do { \
1756	if (RT_UNLIKELY(pReqHdr->cb != (cbExpect))) \
1757	{ \
1758	OSDBGPRINT(( #Name ": Invalid input/output sizes. cb=%ld expected %ld.\n", \
1759	(long)pReqHdr->cb, (long)(cbExpect))); \
1760	return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1761	} \
1762	} while (0)
1763
1764	switch (uReq)
1765	{
1766	case SUPDRV_IDC_REQ_CONNECT:
1767	{
1768	PSUPDRVIDCREQCONNECT pReq = (PSUPDRVIDCREQCONNECT)pReqHdr;
1769	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_CONNECT, sizeof(*pReq));
1770
1771	/*
1772	* Validate the cookie and other input.
1773	*/
1774	if (pReq->Hdr.pSession != NULL)
1775	{
1776	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: pSession=%p expected NULL!\n", pReq->Hdr.pSession));
1777	return pReqHdr->rc = VERR_INVALID_PARAMETER;
1778	}
1779	if (pReq->u.In.u32MagicCookie != SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE)
1780	{
1781	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: u32MagicCookie=%#x expected %#x!\n",
1782	(unsigned)pReq->u.In.u32MagicCookie, (unsigned)SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE));
1783	return pReqHdr->rc = VERR_INVALID_PARAMETER;
1784	}
1785	if ( pReq->u.In.uMinVersion > pReq->u.In.uReqVersion
1786	\|\| (pReq->u.In.uMinVersion & UINT32_C(0xffff0000)) != (pReq->u.In.uReqVersion & UINT32_C(0xffff0000)))
1787	{
1788	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: uMinVersion=%#x uMaxVersion=%#x doesn't match!\n",
1789	pReq->u.In.uMinVersion, pReq->u.In.uReqVersion));
1790	return pReqHdr->rc = VERR_INVALID_PARAMETER;
1791	}
1792
1793	/*
1794	* Match the version.
1795	* The current logic is very simple, match the major interface version.
1796	*/
1797	if ( pReq->u.In.uMinVersion > SUPDRV_IDC_VERSION
1798	\|\| (pReq->u.In.uMinVersion & 0xffff0000) != (SUPDRV_IDC_VERSION & 0xffff0000))
1799	{
1800	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
1801	pReq->u.In.uReqVersion, pReq->u.In.uMinVersion, (unsigned)SUPDRV_IDC_VERSION));
1802	pReq->u.Out.pSession = NULL;
1803	pReq->u.Out.uSessionVersion = 0xffffffff;
1804	pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
1805	pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
1806	pReq->Hdr.rc = VERR_VERSION_MISMATCH;
1807	return VINF_SUCCESS;
1808	}
1809
1810	pReq->u.Out.pSession = NULL;
1811	pReq->u.Out.uSessionVersion = SUPDRV_IDC_VERSION;
1812	pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
1813	pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
1814
1815	/*
1816	* On NT we will already have a session associated with the
1817	* client, just like with the SUP_IOCTL_COOKIE request, while
1818	* the other doesn't.
1819	*/
1820	#ifdef RT_OS_WINDOWS
1821	pReq->Hdr.rc = VINF_SUCCESS;
1822	#else
1823	AssertReturn(!pSession, VERR_INTERNAL_ERROR);
1824	pReq->Hdr.rc = supdrvCreateSession(pDevExt, false /* fUser */, &pSession);
1825	if (RT_FAILURE(pReq->Hdr.rc))
1826	{
1827	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: failed to create session, rc=%d\n", pReq->Hdr.rc));
1828	return VINF_SUCCESS;
1829	}
1830	#endif
1831
1832	pReq->u.Out.pSession = pSession;
1833	pReq->Hdr.pSession = pSession;
1834
1835	return VINF_SUCCESS;
1836	}
1837
1838	case SUPDRV_IDC_REQ_DISCONNECT:
1839	{
1840	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_DISCONNECT, sizeof(*pReqHdr));
1841
1842	#ifdef RT_OS_WINDOWS
1843	/* Windows will destroy the session when the file object is destroyed. */
1844	#else
1845	supdrvCloseSession(pDevExt, pSession);
1846	#endif
1847	return pReqHdr->rc = VINF_SUCCESS;
1848	}
1849
1850	case SUPDRV_IDC_REQ_GET_SYMBOL:
1851	{
1852	PSUPDRVIDCREQGETSYM pReq = (PSUPDRVIDCREQGETSYM)pReqHdr;
1853	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_GET_SYMBOL, sizeof(*pReq));
1854
1855	pReq->Hdr.rc = supdrvIDC_LdrGetSymbol(pDevExt, pSession, pReq);
1856	return VINF_SUCCESS;
1857	}
1858
1859	case SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY:
1860	{
1861	PSUPDRVIDCREQCOMPREGFACTORY pReq = (PSUPDRVIDCREQCOMPREGFACTORY)pReqHdr;
1862	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY, sizeof(*pReq));
1863
1864	pReq->Hdr.rc = SUPR0ComponentRegisterFactory(pSession, pReq->u.In.pFactory);
1865	return VINF_SUCCESS;
1866	}
1867
1868	case SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY:
1869	{
1870	PSUPDRVIDCREQCOMPDEREGFACTORY pReq = (PSUPDRVIDCREQCOMPDEREGFACTORY)pReqHdr;
1871	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY, sizeof(*pReq));
1872
1873	pReq->Hdr.rc = SUPR0ComponentDeregisterFactory(pSession, pReq->u.In.pFactory);
1874	return VINF_SUCCESS;
1875	}
1876
1877	default:
1878	Log(("Unknown IDC %#lx\n", (long)uReq));
1879	break;
1880	}
1881
1882	#undef REQ_CHECK_IDC_SIZE
1883	return VERR_NOT_SUPPORTED;
1884	}
1885
1886
1887	/**
1888	* Register a object for reference counting.
1889	* The object is registered with one reference in the specified session.
1890	*
1891	* @returns Unique identifier on success (pointer).
1892	* All future reference must use this identifier.
1893	* @returns NULL on failure.
1894	* @param pfnDestructor The destructore function which will be called when the reference count reaches 0.
1895	* @param pvUser1 The first user argument.
1896	* @param pvUser2 The second user argument.
1897	*/
1898	SUPR0DECL(void ) SUPR0ObjRegister(PSUPDRVSESSION pSession, SUPDRVOBJTYPE enmType, PFNSUPDRVDESTRUCTOR pfnDestructor, void pvUser1, void *pvUser2)
1899	{
1900	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1901	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1902	PSUPDRVOBJ pObj;
1903	PSUPDRVUSAGE pUsage;
1904
1905	/*
1906	* Validate the input.
1907	*/
1908	AssertReturn(SUP_IS_SESSION_VALID(pSession), NULL);
1909	AssertReturn(enmType > SUPDRVOBJTYPE_INVALID && enmType < SUPDRVOBJTYPE_END, NULL);
1910	AssertPtrReturn(pfnDestructor, NULL);
1911
1912	/*
1913	* Allocate and initialize the object.
1914	*/
1915	pObj = (PSUPDRVOBJ)RTMemAlloc(sizeof(*pObj));
1916	if (!pObj)
1917	return NULL;
1918	pObj->u32Magic = SUPDRVOBJ_MAGIC;
1919	pObj->enmType = enmType;
1920	pObj->pNext = NULL;
1921	pObj->cUsage = 1;
1922	pObj->pfnDestructor = pfnDestructor;
1923	pObj->pvUser1 = pvUser1;
1924	pObj->pvUser2 = pvUser2;
1925	pObj->CreatorUid = pSession->Uid;
1926	pObj->CreatorGid = pSession->Gid;
1927	pObj->CreatorProcess= pSession->Process;
1928	supdrvOSObjInitCreator(pObj, pSession);
1929
1930	/*
1931	* Allocate the usage record.
1932	* (We keep freed usage records around to simplify SUPR0ObjAddRefEx().)
1933	*/
1934	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1935
1936	pUsage = pDevExt->pUsageFree;
1937	if (pUsage)
1938	pDevExt->pUsageFree = pUsage->pNext;
1939	else
1940	{
1941	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1942	pUsage = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsage));
1943	if (!pUsage)
1944	{
1945	RTMemFree(pObj);
1946	return NULL;
1947	}
1948	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1949	}
1950
1951	/*
1952	* Insert the object and create the session usage record.
1953	*/
1954	/* The object. */
1955	pObj->pNext = pDevExt->pObjs;
1956	pDevExt->pObjs = pObj;
1957
1958	/* The session record. */
1959	pUsage->cUsage = 1;
1960	pUsage->pObj = pObj;
1961	pUsage->pNext = pSession->pUsage;
1962	/* Log2(("SUPR0ObjRegister: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext)); */
1963	pSession->pUsage = pUsage;
1964
1965	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1966
1967	Log(("SUPR0ObjRegister: returns %p (pvUser1=%p, pvUser=%p)\n", pObj, pvUser1, pvUser2));
1968	return pObj;
1969	}
1970
1971
1972	/**
1973	* Increment the reference counter for the object associating the reference
1974	* with the specified session.
1975	*
1976	* @returns IPRT status code.
1977	* @param pvObj The identifier returned by SUPR0ObjRegister().
1978	* @param pSession The session which is referencing the object.
1979	*
1980	* @remarks The caller should not own any spinlocks and must carefully protect
1981	* itself against potential race with the destructor so freed memory
1982	* isn't accessed here.
1983	*/
1984	SUPR0DECL(int) SUPR0ObjAddRef(void *pvObj, PSUPDRVSESSION pSession)
1985	{
1986	return SUPR0ObjAddRefEx(pvObj, pSession, false /* fNoBlocking */);
1987	}
1988
1989
1990	/**
1991	* Increment the reference counter for the object associating the reference
1992	* with the specified session.
1993	*
1994	* @returns IPRT status code.
1995	* @retval VERR_TRY_AGAIN if fNoBlocking was set and a new usage record
1996	* couldn't be allocated. (If you see this you're not doing the right
1997	* thing and it won't ever work reliably.)
1998	*
1999	* @param pvObj The identifier returned by SUPR0ObjRegister().
2000	* @param pSession The session which is referencing the object.
2001	* @param fNoBlocking Set if it's not OK to block. Never try to make the
2002	* first reference to an object in a session with this
2003	* argument set.
2004	*
2005	* @remarks The caller should not own any spinlocks and must carefully protect
2006	* itself against potential race with the destructor so freed memory
2007	* isn't accessed here.
2008	*/
2009	SUPR0DECL(int) SUPR0ObjAddRefEx(void *pvObj, PSUPDRVSESSION pSession, bool fNoBlocking)
2010	{
2011	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2012	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2013	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2014	int rc = VINF_SUCCESS;
2015	PSUPDRVUSAGE pUsagePre;
2016	PSUPDRVUSAGE pUsage;
2017
2018	/*
2019	* Validate the input.
2020	* Be ready for the destruction race (someone might be stuck in the
2021	* destructor waiting a lock we own).
2022	*/
2023	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2024	AssertPtrReturn(pObj, VERR_INVALID_POINTER);
2025	AssertMsgReturn(pObj->u32Magic == SUPDRVOBJ_MAGIC \|\| pObj->u32Magic == SUPDRVOBJ_MAGIC_DEAD,
2026	("Invalid pvObj=%p magic=%#x (expected %#x or %#x)\n", pvObj, pObj->u32Magic, SUPDRVOBJ_MAGIC, SUPDRVOBJ_MAGIC_DEAD),
2027	VERR_INVALID_PARAMETER);
2028
2029	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
2030
2031	if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
2032	{
2033	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2034
2035	AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
2036	return VERR_WRONG_ORDER;
2037	}
2038
2039	/*
2040	* Preallocate the usage record if we can.
2041	*/
2042	pUsagePre = pDevExt->pUsageFree;
2043	if (pUsagePre)
2044	pDevExt->pUsageFree = pUsagePre->pNext;
2045	else if (!fNoBlocking)
2046	{
2047	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2048	pUsagePre = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsagePre));
2049	if (!pUsagePre)
2050	return VERR_NO_MEMORY;
2051
2052	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
2053	if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
2054	{
2055	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2056
2057	AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
2058	return VERR_WRONG_ORDER;
2059	}
2060	}
2061
2062	/*
2063	* Reference the object.
2064	*/
2065	pObj->cUsage++;
2066
2067	/*
2068	* Look for the session record.
2069	*/
2070	for (pUsage = pSession->pUsage; pUsage; pUsage = pUsage->pNext)
2071	{
2072	/Log(("SUPR0AddRef: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));/
2073	if (pUsage->pObj == pObj)
2074	break;
2075	}
2076	if (pUsage)
2077	pUsage->cUsage++;
2078	else if (pUsagePre)
2079	{
2080	/* create a new session record. */
2081	pUsagePre->cUsage = 1;
2082	pUsagePre->pObj = pObj;
2083	pUsagePre->pNext = pSession->pUsage;
2084	pSession->pUsage = pUsagePre;
2085	/Log(("SUPR0AddRef: pUsagePre=%p:{.pObj=%p, .pNext=%p}\n", pUsagePre, pUsagePre->pObj, pUsagePre->pNext));/
2086
2087	pUsagePre = NULL;
2088	}
2089	else
2090	{
2091	pObj->cUsage--;
2092	rc = VERR_TRY_AGAIN;
2093	}
2094
2095	/*
2096	* Put any unused usage record into the free list..
2097	*/
2098	if (pUsagePre)
2099	{
2100	pUsagePre->pNext = pDevExt->pUsageFree;
2101	pDevExt->pUsageFree = pUsagePre;
2102	}
2103
2104	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2105
2106	return rc;
2107	}
2108
2109
2110	/**
2111	* Decrement / destroy a reference counter record for an object.
2112	*
2113	* The object is uniquely identified by pfnDestructor+pvUser1+pvUser2.
2114	*
2115	* @returns IPRT status code.
2116	* @retval VINF_SUCCESS if not destroyed.
2117	* @retval VINF_OBJECT_DESTROYED if it's destroyed by this release call.
2118	* @retval VERR_INVALID_PARAMETER if the object isn't valid. Will assert in
2119	* string builds.
2120	*
2121	* @param pvObj The identifier returned by SUPR0ObjRegister().
2122	* @param pSession The session which is referencing the object.
2123	*/
2124	SUPR0DECL(int) SUPR0ObjRelease(void *pvObj, PSUPDRVSESSION pSession)
2125	{
2126	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2127	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2128	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2129	int rc = VERR_INVALID_PARAMETER;
2130	PSUPDRVUSAGE pUsage;
2131	PSUPDRVUSAGE pUsagePrev;
2132
2133	/*
2134	* Validate the input.
2135	*/
2136	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2137	AssertMsgReturn(VALID_PTR(pObj) && pObj->u32Magic == SUPDRVOBJ_MAGIC,
2138	("Invalid pvObj=%p magic=%#x (exepcted %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
2139	VERR_INVALID_PARAMETER);
2140
2141	/*
2142	* Acquire the spinlock and look for the usage record.
2143	*/
2144	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
2145
2146	for (pUsagePrev = NULL, pUsage = pSession->pUsage;
2147	pUsage;
2148	pUsagePrev = pUsage, pUsage = pUsage->pNext)
2149	{
2150	/Log2(("SUPR0ObjRelease: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));/
2151	if (pUsage->pObj == pObj)
2152	{
2153	rc = VINF_SUCCESS;
2154	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
2155	if (pUsage->cUsage > 1)
2156	{
2157	pObj->cUsage--;
2158	pUsage->cUsage--;
2159	}
2160	else
2161	{
2162	/*
2163	* Free the session record.
2164	*/
2165	if (pUsagePrev)
2166	pUsagePrev->pNext = pUsage->pNext;
2167	else
2168	pSession->pUsage = pUsage->pNext;
2169	pUsage->pNext = pDevExt->pUsageFree;
2170	pDevExt->pUsageFree = pUsage;
2171
2172	/* What about the object? */
2173	if (pObj->cUsage > 1)
2174	pObj->cUsage--;
2175	else
2176	{
2177	/*
2178	* Object is to be destroyed, unlink it.
2179	*/
2180	pObj->u32Magic = SUPDRVOBJ_MAGIC_DEAD;
2181	rc = VINF_OBJECT_DESTROYED;
2182	if (pDevExt->pObjs == pObj)
2183	pDevExt->pObjs = pObj->pNext;
2184	else
2185	{
2186	PSUPDRVOBJ pObjPrev;
2187	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
2188	if (pObjPrev->pNext == pObj)
2189	{
2190	pObjPrev->pNext = pObj->pNext;
2191	break;
2192	}
2193	Assert(pObjPrev);
2194	}
2195	}
2196	}
2197	break;
2198	}
2199	}
2200
2201	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2202
2203	/*
2204	* Call the destructor and free the object if required.
2205	*/
2206	if (rc == VINF_OBJECT_DESTROYED)
2207	{
2208	Log(("SUPR0ObjRelease: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
2209	pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
2210	if (pObj->pfnDestructor)
2211	#ifdef RT_WITH_W64_UNWIND_HACK
2212	supdrvNtWrapObjDestructor((PFNRT)pObj->pfnDestructor, pObj, pObj->pvUser1, pObj->pvUser2);
2213	#else
2214	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
2215	#endif
2216	RTMemFree(pObj);
2217	}
2218
2219	AssertMsg(pUsage, ("pvObj=%p\n", pvObj));
2220	return rc;
2221	}
2222
2223
2224	/**
2225	* Verifies that the current process can access the specified object.
2226	*
2227	* @returns The following IPRT status code:
2228	* @retval VINF_SUCCESS if access was granted.
2229	* @retval VERR_PERMISSION_DENIED if denied access.
2230	* @retval VERR_INVALID_PARAMETER if invalid parameter.
2231	*
2232	* @param pvObj The identifier returned by SUPR0ObjRegister().
2233	* @param pSession The session which wishes to access the object.
2234	* @param pszObjName Object string name. This is optional and depends on the object type.
2235	*
2236	* @remark The caller is responsible for making sure the object isn't removed while
2237	* we're inside this function. If uncertain about this, just call AddRef before calling us.
2238	*/
2239	SUPR0DECL(int) SUPR0ObjVerifyAccess(void pvObj, PSUPDRVSESSION pSession, const char pszObjName)
2240	{
2241	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2242	int rc;
2243
2244	/*
2245	* Validate the input.
2246	*/
2247	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2248	AssertMsgReturn(VALID_PTR(pObj) && pObj->u32Magic == SUPDRVOBJ_MAGIC,
2249	("Invalid pvObj=%p magic=%#x (exepcted %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
2250	VERR_INVALID_PARAMETER);
2251
2252	/*
2253	* Check access. (returns true if a decision has been made.)
2254	*/
2255	rc = VERR_INTERNAL_ERROR;
2256	if (supdrvOSObjCanAccess(pObj, pSession, pszObjName, &rc))
2257	return rc;
2258
2259	/*
2260	* Default policy is to allow the user to access his own
2261	* stuff but nothing else.
2262	*/
2263	if (pObj->CreatorUid == pSession->Uid)
2264	return VINF_SUCCESS;
2265	return VERR_PERMISSION_DENIED;
2266	}
2267
2268
2269	/**
2270	* Lock pages.
2271	*
2272	* @returns IPRT status code.
2273	* @param pSession Session to which the locked memory should be associated.
2274	* @param pvR3 Start of the memory range to lock.
2275	* This must be page aligned.
2276	* @param cPages Number of pages to lock.
2277	* @param paPages Where to put the physical addresses of locked memory.
2278	*/
2279	SUPR0DECL(int) SUPR0LockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t cPages, PRTHCPHYS paPages)
2280	{
2281	int rc;
2282	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2283	const size_t cb = (size_t)cPages << PAGE_SHIFT;
2284	LogFlow(("SUPR0LockMem: pSession=%p pvR3=%p cPages=%d paPages=%p\n", pSession, (void *)pvR3, cPages, paPages));
2285
2286	/*
2287	* Verify input.
2288	*/
2289	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2290	AssertPtrReturn(paPages, VERR_INVALID_PARAMETER);
2291	if ( RT_ALIGN_R3PT(pvR3, PAGE_SIZE, RTR3PTR) != pvR3
2292	\|\| !pvR3)
2293	{
2294	Log(("pvR3 (%p) must be page aligned and not NULL!\n", (void *)pvR3));
2295	return VERR_INVALID_PARAMETER;
2296	}
2297
2298	/*
2299	* Let IPRT do the job.
2300	*/
2301	Mem.eType = MEMREF_TYPE_LOCKED;
2302	rc = RTR0MemObjLockUser(&Mem.MemObj, pvR3, cb, RTR0ProcHandleSelf());
2303	if (RT_SUCCESS(rc))
2304	{
2305	uint32_t iPage = cPages;
2306	AssertMsg(RTR0MemObjAddressR3(Mem.MemObj) == pvR3, ("%p == %p\n", RTR0MemObjAddressR3(Mem.MemObj), pvR3));
2307	AssertMsg(RTR0MemObjSize(Mem.MemObj) == cb, ("%x == %x\n", RTR0MemObjSize(Mem.MemObj), cb));
2308
2309	while (iPage-- > 0)
2310	{
2311	paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
2312	if (RT_UNLIKELY(paPages[iPage] == NIL_RTCCPHYS))
2313	{
2314	AssertMsgFailed(("iPage=%d\n", iPage));
2315	rc = VERR_INTERNAL_ERROR;
2316	break;
2317	}
2318	}
2319	if (RT_SUCCESS(rc))
2320	rc = supdrvMemAdd(&Mem, pSession);
2321	if (RT_FAILURE(rc))
2322	{
2323	int rc2 = RTR0MemObjFree(Mem.MemObj, false);
2324	AssertRC(rc2);
2325	}
2326	}
2327
2328	return rc;
2329	}
2330
2331
2332	/**
2333	* Unlocks the memory pointed to by pv.
2334	*
2335	* @returns IPRT status code.
2336	* @param pSession Session to which the memory was locked.
2337	* @param pvR3 Memory to unlock.
2338	*/
2339	SUPR0DECL(int) SUPR0UnlockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3)
2340	{
2341	LogFlow(("SUPR0UnlockMem: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
2342	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2343	return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_LOCKED);
2344	}
2345
2346
2347	/**
2348	* Allocates a chunk of page aligned memory with contiguous and fixed physical
2349	* backing.
2350	*
2351	* @returns IPRT status code.
2352	* @param pSession Session data.
2353	* @param cPages Number of pages to allocate.
2354	* @param ppvR0 Where to put the address of Ring-0 mapping the allocated memory.
2355	* @param ppvR3 Where to put the address of Ring-3 mapping the allocated memory.
2356	* @param pHCPhys Where to put the physical address of allocated memory.
2357	*/
2358	SUPR0DECL(int) SUPR0ContAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS pHCPhys)
2359	{
2360	int rc;
2361	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2362	LogFlow(("SUPR0ContAlloc: pSession=%p cPages=%d ppvR0=%p ppvR3=%p pHCPhys=%p\n", pSession, cPages, ppvR0, ppvR3, pHCPhys));
2363
2364	/*
2365	* Validate input.
2366	*/
2367	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2368	if (!ppvR3 \|\| !ppvR0 \|\| !pHCPhys)
2369	{
2370	Log(("Null pointer. All of these should be set: pSession=%p ppvR0=%p ppvR3=%p pHCPhys=%p\n",
2371	pSession, ppvR0, ppvR3, pHCPhys));
2372	return VERR_INVALID_PARAMETER;
2373
2374	}
2375	if (cPages < 1 \|\| cPages >= 256)
2376	{
2377	Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
2378	return VERR_PAGE_COUNT_OUT_OF_RANGE;
2379	}
2380
2381	/*
2382	* Let IPRT do the job.
2383	*/
2384	rc = RTR0MemObjAllocCont(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable R0 mapping */);
2385	if (RT_SUCCESS(rc))
2386	{
2387	int rc2;
2388	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2389	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2390	if (RT_SUCCESS(rc))
2391	{
2392	Mem.eType = MEMREF_TYPE_CONT;
2393	rc = supdrvMemAdd(&Mem, pSession);
2394	if (!rc)
2395	{
2396	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2397	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2398	*pHCPhys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, 0);
2399	return 0;
2400	}
2401
2402	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2403	AssertRC(rc2);
2404	}
2405	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2406	AssertRC(rc2);
2407	}
2408
2409	return rc;
2410	}
2411
2412
2413	/**
2414	* Frees memory allocated using SUPR0ContAlloc().
2415	*
2416	* @returns IPRT status code.
2417	* @param pSession The session to which the memory was allocated.
2418	* @param uPtr Pointer to the memory (ring-3 or ring-0).
2419	*/
2420	SUPR0DECL(int) SUPR0ContFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2421	{
2422	LogFlow(("SUPR0ContFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2423	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2424	return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_CONT);
2425	}
2426
2427
2428	/**
2429	* Allocates a chunk of page aligned memory with fixed physical backing below 4GB.
2430	*
2431	* The memory isn't zeroed.
2432	*
2433	* @returns IPRT status code.
2434	* @param pSession Session data.
2435	* @param cPages Number of pages to allocate.
2436	* @param ppvR0 Where to put the address of Ring-0 mapping of the allocated memory.
2437	* @param ppvR3 Where to put the address of Ring-3 mapping of the allocated memory.
2438	* @param paPages Where to put the physical addresses of allocated memory.
2439	*/
2440	SUPR0DECL(int) SUPR0LowAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS paPages)
2441	{
2442	unsigned iPage;
2443	int rc;
2444	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2445	LogFlow(("SUPR0LowAlloc: pSession=%p cPages=%d ppvR3=%p ppvR0=%p paPages=%p\n", pSession, cPages, ppvR3, ppvR0, paPages));
2446
2447	/*
2448	* Validate input.
2449	*/
2450	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2451	if (!ppvR3 \|\| !ppvR0 \|\| !paPages)
2452	{
2453	Log(("Null pointer. All of these should be set: pSession=%p ppvR3=%p ppvR0=%p paPages=%p\n",
2454	pSession, ppvR3, ppvR0, paPages));
2455	return VERR_INVALID_PARAMETER;
2456
2457	}
2458	if (cPages < 1 \|\| cPages >= 256)
2459	{
2460	Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
2461	return VERR_PAGE_COUNT_OUT_OF_RANGE;
2462	}
2463
2464	/*
2465	* Let IPRT do the work.
2466	*/
2467	rc = RTR0MemObjAllocLow(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable ring-0 mapping */);
2468	if (RT_SUCCESS(rc))
2469	{
2470	int rc2;
2471	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2472	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2473	if (RT_SUCCESS(rc))
2474	{
2475	Mem.eType = MEMREF_TYPE_LOW;
2476	rc = supdrvMemAdd(&Mem, pSession);
2477	if (!rc)
2478	{
2479	for (iPage = 0; iPage < cPages; iPage++)
2480	{
2481	paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
2482	AssertMsg(!(paPages[iPage] & (PAGE_SIZE - 1)), ("iPage=%d Phys=%RHp\n", paPages[iPage]));
2483	}
2484	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2485	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2486	return 0;
2487	}
2488
2489	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2490	AssertRC(rc2);
2491	}
2492
2493	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2494	AssertRC(rc2);
2495	}
2496
2497	return rc;
2498	}
2499
2500
2501	/**
2502	* Frees memory allocated using SUPR0LowAlloc().
2503	*
2504	* @returns IPRT status code.
2505	* @param pSession The session to which the memory was allocated.
2506	* @param uPtr Pointer to the memory (ring-3 or ring-0).
2507	*/
2508	SUPR0DECL(int) SUPR0LowFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2509	{
2510	LogFlow(("SUPR0LowFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2511	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2512	return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_LOW);
2513	}
2514
2515
2516
2517	/**
2518	* Allocates a chunk of memory with both R0 and R3 mappings.
2519	* The memory is fixed and it's possible to query the physical addresses using SUPR0MemGetPhys().
2520	*
2521	* @returns IPRT status code.
2522	* @param pSession The session to associated the allocation with.
2523	* @param cb Number of bytes to allocate.
2524	* @param ppvR0 Where to store the address of the Ring-0 mapping.
2525	* @param ppvR3 Where to store the address of the Ring-3 mapping.
2526	*/
2527	SUPR0DECL(int) SUPR0MemAlloc(PSUPDRVSESSION pSession, uint32_t cb, PRTR0PTR ppvR0, PRTR3PTR ppvR3)
2528	{
2529	int rc;
2530	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2531	LogFlow(("SUPR0MemAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p\n", pSession, cb, ppvR0, ppvR3));
2532
2533	/*
2534	* Validate input.
2535	*/
2536	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2537	AssertPtrReturn(ppvR0, VERR_INVALID_POINTER);
2538	AssertPtrReturn(ppvR3, VERR_INVALID_POINTER);
2539	if (cb < 1 \|\| cb >= _4M)
2540	{
2541	Log(("Illegal request cb=%u; must be greater than 0 and smaller than 4MB.\n", cb));
2542	return VERR_INVALID_PARAMETER;
2543	}
2544
2545	/*
2546	* Let IPRT do the work.
2547	*/
2548	rc = RTR0MemObjAllocPage(&Mem.MemObj, cb, true /* executable ring-0 mapping */);
2549	if (RT_SUCCESS(rc))
2550	{
2551	int rc2;
2552	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2553	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2554	if (RT_SUCCESS(rc))
2555	{
2556	Mem.eType = MEMREF_TYPE_MEM;
2557	rc = supdrvMemAdd(&Mem, pSession);
2558	if (!rc)
2559	{
2560	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2561	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2562	return VINF_SUCCESS;
2563	}
2564
2565	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2566	AssertRC(rc2);
2567	}
2568
2569	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2570	AssertRC(rc2);
2571	}
2572
2573	return rc;
2574	}
2575
2576
2577	/**
2578	* Get the physical addresses of memory allocated using SUPR0MemAlloc().
2579	*
2580	* @returns IPRT status code.
2581	* @param pSession The session to which the memory was allocated.
2582	* @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2583	* @param paPages Where to store the physical addresses.
2584	*/
2585	SUPR0DECL(int) SUPR0MemGetPhys(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, PSUPPAGE paPages) /** @todo switch this bugger to RTHCPHYS */
2586	{
2587	PSUPDRVBUNDLE pBundle;
2588	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2589	LogFlow(("SUPR0MemGetPhys: pSession=%p uPtr=%p paPages=%p\n", pSession, (void *)uPtr, paPages));
2590
2591	/*
2592	* Validate input.
2593	*/
2594	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2595	AssertPtrReturn(paPages, VERR_INVALID_POINTER);
2596	AssertReturn(uPtr, VERR_INVALID_PARAMETER);
2597
2598	/*
2599	* Search for the address.
2600	*/
2601	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2602	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2603	{
2604	if (pBundle->cUsed > 0)
2605	{
2606	unsigned i;
2607	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2608	{
2609	if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
2610	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2611	&& ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
2612	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2613	&& RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr)
2614	)
2615	)
2616	{
2617	const size_t cPages = RTR0MemObjSize(pBundle->aMem[i].MemObj) >> PAGE_SHIFT;
2618	size_t iPage;
2619	for (iPage = 0; iPage < cPages; iPage++)
2620	{
2621	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(pBundle->aMem[i].MemObj, iPage);
2622	paPages[iPage].uReserved = 0;
2623	}
2624	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2625	return VINF_SUCCESS;
2626	}
2627	}
2628	}
2629	}
2630	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2631	Log(("Failed to find %p!!!\n", (void *)uPtr));
2632	return VERR_INVALID_PARAMETER;
2633	}
2634
2635
2636	/**
2637	* Free memory allocated by SUPR0MemAlloc().
2638	*
2639	* @returns IPRT status code.
2640	* @param pSession The session owning the allocation.
2641	* @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2642	*/
2643	SUPR0DECL(int) SUPR0MemFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2644	{
2645	LogFlow(("SUPR0MemFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2646	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2647	return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_MEM);
2648	}
2649
2650
2651	/**
2652	* Allocates a chunk of memory with a kernel or/and a user mode mapping.
2653	*
2654	* The memory is fixed and it's possible to query the physical addresses using
2655	* SUPR0MemGetPhys().
2656	*
2657	* @returns IPRT status code.
2658	* @param pSession The session to associated the allocation with.
2659	* @param cPages The number of pages to allocate.
2660	* @param fFlags Flags, reserved for the future. Must be zero.
2661	* @param ppvR3 Where to store the address of the Ring-3 mapping.
2662	* NULL if no ring-3 mapping.
2663	* @param ppvR3 Where to store the address of the Ring-0 mapping.
2664	* NULL if no ring-0 mapping.
2665	* @param paPages Where to store the addresses of the pages. Optional.
2666	*/
2667	SUPR0DECL(int) SUPR0PageAllocEx(PSUPDRVSESSION pSession, uint32_t cPages, uint32_t fFlags, PRTR3PTR ppvR3, PRTR0PTR ppvR0, PRTHCPHYS paPages)
2668	{
2669	int rc;
2670	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2671	LogFlow(("SUPR0PageAlloc: pSession=%p cb=%d ppvR3=%p\n", pSession, cPages, ppvR3));
2672
2673	/*
2674	* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2675	*/
2676	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2677	AssertPtrNullReturn(ppvR3, VERR_INVALID_POINTER);
2678	AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
2679	AssertReturn(ppvR3 \|\| ppvR0, VERR_INVALID_PARAMETER);
2680	AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
2681	if (cPages < 1 \|\| cPages > VBOX_MAX_ALLOC_PAGE_COUNT)
2682	{
2683	Log(("SUPR0PageAlloc: Illegal request cb=%u; must be greater than 0 and smaller than 128MB.\n", cPages));
2684	return VERR_PAGE_COUNT_OUT_OF_RANGE;
2685	}
2686
2687	/*
2688	* Let IPRT do the work.
2689	*/
2690	if (ppvR0)
2691	rc = RTR0MemObjAllocPage(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, true /* fExecutable */);
2692	else
2693	rc = RTR0MemObjAllocPhysNC(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, NIL_RTHCPHYS);
2694	if (RT_SUCCESS(rc))
2695	{
2696	int rc2;
2697	if (ppvR3)
2698	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2699	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2700	else
2701	Mem.MapObjR3 = NIL_RTR0MEMOBJ;
2702	if (RT_SUCCESS(rc))
2703	{
2704	Mem.eType = MEMREF_TYPE_PAGE;
2705	rc = supdrvMemAdd(&Mem, pSession);
2706	if (!rc)
2707	{
2708	if (ppvR3)
2709	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2710	if (ppvR0)
2711	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2712	if (paPages)
2713	{
2714	uint32_t iPage = cPages;
2715	while (iPage-- > 0)
2716	{
2717	paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MapObjR3, iPage);
2718	Assert(paPages[iPage] != NIL_RTHCPHYS);
2719	}
2720	}
2721	return VINF_SUCCESS;
2722	}
2723
2724	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2725	AssertRC(rc2);
2726	}
2727
2728	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2729	AssertRC(rc2);
2730	}
2731	return rc;
2732	}
2733
2734
2735	/**
2736	* Maps a chunk of memory previously allocated by SUPR0PageAllocEx into kernel
2737	* space.
2738	*
2739	* @returns IPRT status code.
2740	* @param pSession The session to associated the allocation with.
2741	* @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
2742	* @param offSub Where to start mapping. Must be page aligned.
2743	* @param cbSub How much to map. Must be page aligned.
2744	* @param fFlags Flags, MBZ.
2745	* @param ppvR0 Where to reutrn the address of the ring-0 mapping on
2746	* success.
2747	*/
2748	SUPR0DECL(int) SUPR0PageMapKernel(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t offSub, uint32_t cbSub,
2749	uint32_t fFlags, PRTR0PTR ppvR0)
2750	{
2751	int rc;
2752	PSUPDRVBUNDLE pBundle;
2753	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2754	RTR0MEMOBJ hMemObj = NIL_RTR0MEMOBJ;
2755	LogFlow(("SUPR0PageMapKernel: pSession=%p pvR3=%p offSub=%#x cbSub=%#x\n", pSession, pvR3, offSub, cbSub));
2756
2757	/*
2758	* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2759	*/
2760	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2761	AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
2762	AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
2763	AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2764	AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2765	AssertReturn(cbSub, VERR_INVALID_PARAMETER);
2766
2767	/*
2768	* Find the memory object.
2769	*/
2770	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2771	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2772	{
2773	if (pBundle->cUsed > 0)
2774	{
2775	unsigned i;
2776	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2777	{
2778	if ( ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
2779	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2780	&& pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2781	&& RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3)
2782	\|\| ( pBundle->aMem[i].eType == MEMREF_TYPE_LOCKED
2783	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2784	&& pBundle->aMem[i].MapObjR3 == NIL_RTR0MEMOBJ
2785	&& RTR0MemObjAddressR3(pBundle->aMem[i].MemObj) == pvR3))
2786	{
2787	hMemObj = pBundle->aMem[i].MemObj;
2788	break;
2789	}
2790	}
2791	}
2792	}
2793	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2794
2795	rc = VERR_INVALID_PARAMETER;
2796	if (hMemObj != NIL_RTR0MEMOBJ)
2797	{
2798	/*
2799	* Do some furter input validations before calling IPRT.
2800	* (Cleanup is done indirectly by telling RTR0MemObjFree to include mappings.)
2801	*/
2802	size_t cbMemObj = RTR0MemObjSize(hMemObj);
2803	if ( offSub < cbMemObj
2804	&& cbSub <= cbMemObj
2805	&& offSub + cbSub <= cbMemObj)
2806	{
2807	RTR0MEMOBJ hMapObj;
2808	rc = RTR0MemObjMapKernelEx(&hMapObj, hMemObj, (void *)-1, 0,
2809	RTMEM_PROT_READ \| RTMEM_PROT_WRITE, offSub, cbSub);
2810	if (RT_SUCCESS(rc))
2811	*ppvR0 = RTR0MemObjAddress(hMapObj);
2812	}
2813	else
2814	SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
2815
2816	}
2817	return rc;
2818	}
2819
2820
2821	/**
2822	* Changes the page level protection of one or more pages previously allocated
2823	* by SUPR0PageAllocEx.
2824	*
2825	* @returns IPRT status code.
2826	* @param pSession The session to associated the allocation with.
2827	* @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
2828	* NIL_RTR3PTR if the ring-3 mapping should be unaffected.
2829	* @param pvR0 The ring-0 address returned by SUPR0PageAllocEx.
2830	* NIL_RTR0PTR if the ring-0 mapping should be unaffected.
2831	* @param offSub Where to start changing. Must be page aligned.
2832	* @param cbSub How much to change. Must be page aligned.
2833	* @param fProt The new page level protection, see RTMEM_PROT_*.
2834	*/
2835	SUPR0DECL(int) SUPR0PageProtect(PSUPDRVSESSION pSession, RTR3PTR pvR3, RTR0PTR pvR0, uint32_t offSub, uint32_t cbSub, uint32_t fProt)
2836	{
2837	int rc;
2838	PSUPDRVBUNDLE pBundle;
2839	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2840	RTR0MEMOBJ hMemObjR0 = NIL_RTR0MEMOBJ;
2841	RTR0MEMOBJ hMemObjR3 = NIL_RTR0MEMOBJ;
2842	LogFlow(("SUPR0PageProtect: pSession=%p pvR3=%p pvR0=%p offSub=%#x cbSub=%#x fProt-%#x\n", pSession, pvR3, pvR0, offSub, cbSub, fProt));
2843
2844	/*
2845	* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2846	*/
2847	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2848	AssertReturn(!(fProt & ~(RTMEM_PROT_READ \| RTMEM_PROT_WRITE \| RTMEM_PROT_EXEC \| RTMEM_PROT_NONE)), VERR_INVALID_PARAMETER);
2849	AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2850	AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2851	AssertReturn(cbSub, VERR_INVALID_PARAMETER);
2852
2853	/*
2854	* Find the memory object.
2855	*/
2856	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2857	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2858	{
2859	if (pBundle->cUsed > 0)
2860	{
2861	unsigned i;
2862	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2863	{
2864	if ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
2865	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2866	&& ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2867	\|\| pvR3 == NIL_RTR3PTR)
2868	&& ( pvR0 != NIL_RTR0PTR
2869	\|\| RTR0MemObjAddress(pBundle->aMem[i].MemObj))
2870	&& ( pvR3 != NIL_RTR3PTR
2871	\|\| RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3))
2872	{
2873	if (pvR0 != NIL_RTR0PTR)
2874	hMemObjR0 = pBundle->aMem[i].MemObj;
2875	if (pvR3 != NIL_RTR3PTR)
2876	hMemObjR3 = pBundle->aMem[i].MapObjR3;
2877	break;
2878	}
2879	}
2880	}
2881	}
2882	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2883
2884	rc = VERR_INVALID_PARAMETER;
2885	if ( hMemObjR0 != NIL_RTR0MEMOBJ
2886	\|\| hMemObjR3 != NIL_RTR0MEMOBJ)
2887	{
2888	/*
2889	* Do some furter input validations before calling IPRT.
2890	*/
2891	size_t cbMemObj = hMemObjR0 != NIL_RTR0PTR ? RTR0MemObjSize(hMemObjR0) : RTR0MemObjSize(hMemObjR3);
2892	if ( offSub < cbMemObj
2893	&& cbSub <= cbMemObj
2894	&& offSub + cbSub <= cbMemObj)
2895	{
2896	rc = VINF_SUCCESS;
2897	if (hMemObjR3 != NIL_RTR0PTR)
2898	rc = RTR0MemObjProtect(hMemObjR3, offSub, cbSub, fProt);
2899	if (hMemObjR0 != NIL_RTR0PTR && RT_SUCCESS(rc))
2900	rc = RTR0MemObjProtect(hMemObjR0, offSub, cbSub, fProt);
2901	}
2902	else
2903	SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
2904
2905	}
2906	return rc;
2907
2908	}
2909
2910
2911	/**
2912	* Free memory allocated by SUPR0PageAlloc() and SUPR0PageAllocEx().
2913	*
2914	* @returns IPRT status code.
2915	* @param pSession The session owning the allocation.
2916	* @param pvR3 The Ring-3 address returned by SUPR0PageAlloc() or
2917	* SUPR0PageAllocEx().
2918	*/
2919	SUPR0DECL(int) SUPR0PageFree(PSUPDRVSESSION pSession, RTR3PTR pvR3)
2920	{
2921	LogFlow(("SUPR0PageFree: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
2922	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2923	return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_PAGE);
2924	}
2925
2926
2927	/**
2928	* Maps the GIP into userspace and/or get the physical address of the GIP.
2929	*
2930	* @returns IPRT status code.
2931	* @param pSession Session to which the GIP mapping should belong.
2932	* @param ppGipR3 Where to store the address of the ring-3 mapping. (optional)
2933	* @param pHCPhysGip Where to store the physical address. (optional)
2934	*
2935	* @remark There is no reference counting on the mapping, so one call to this function
2936	* count globally as one reference. One call to SUPR0GipUnmap() is will unmap GIP
2937	* and remove the session as a GIP user.
2938	*/
2939	SUPR0DECL(int) SUPR0GipMap(PSUPDRVSESSION pSession, PRTR3PTR ppGipR3, PRTHCPHYS pHCPhysGip)
2940	{
2941	int rc = VINF_SUCCESS;
2942	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2943	RTR3PTR pGip = NIL_RTR3PTR;
2944	RTHCPHYS HCPhys = NIL_RTHCPHYS;
2945	LogFlow(("SUPR0GipMap: pSession=%p ppGipR3=%p pHCPhysGip=%p\n", pSession, ppGipR3, pHCPhysGip));
2946
2947	/*
2948	* Validate
2949	*/
2950	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2951	AssertPtrNullReturn(ppGipR3, VERR_INVALID_POINTER);
2952	AssertPtrNullReturn(pHCPhysGip, VERR_INVALID_POINTER);
2953
2954	RTSemFastMutexRequest(pDevExt->mtxGip);
2955	if (pDevExt->pGip)
2956	{
2957	/*
2958	* Map it?
2959	*/
2960	if (ppGipR3)
2961	{
2962	if (pSession->GipMapObjR3 == NIL_RTR0MEMOBJ)
2963	rc = RTR0MemObjMapUser(&pSession->GipMapObjR3, pDevExt->GipMemObj, (RTR3PTR)-1, 0,
2964	RTMEM_PROT_READ, RTR0ProcHandleSelf());
2965	if (RT_SUCCESS(rc))
2966	{
2967	pGip = RTR0MemObjAddressR3(pSession->GipMapObjR3);
2968	rc = VINF_SUCCESS; /** @todo remove this and replace the !rc below with RT_SUCCESS(rc). */
2969	}
2970	}
2971
2972	/*
2973	* Get physical address.
2974	*/
2975	if (pHCPhysGip && !rc)
2976	HCPhys = pDevExt->HCPhysGip;
2977
2978	/*
2979	* Reference globally.
2980	*/
2981	if (!pSession->fGipReferenced && !rc)
2982	{
2983	pSession->fGipReferenced = 1;
2984	pDevExt->cGipUsers++;
2985	if (pDevExt->cGipUsers == 1)
2986	{
2987	PSUPGLOBALINFOPAGE pGip = pDevExt->pGip;
2988	unsigned i;
2989
2990	LogFlow(("SUPR0GipMap: Resumes GIP updating\n"));
2991
2992	for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
2993	ASMAtomicXchgU32(&pGip->aCPUs[i].u32TransactionId, pGip->aCPUs[i].u32TransactionId & ~(GIP_UPDATEHZ_RECALC_FREQ * 2 - 1));
2994	ASMAtomicXchgU64(&pGip->u64NanoTSLastUpdateHz, 0);
2995
2996	rc = RTTimerStart(pDevExt->pGipTimer, 0);
2997	AssertRC(rc); rc = VINF_SUCCESS;
2998	}
2999	}
3000	}
3001	else
3002	{
3003	rc = SUPDRV_ERR_GENERAL_FAILURE;
3004	Log(("SUPR0GipMap: GIP is not available!\n"));
3005	}
3006	RTSemFastMutexRelease(pDevExt->mtxGip);
3007
3008	/*
3009	* Write returns.
3010	*/
3011	if (pHCPhysGip)
3012	*pHCPhysGip = HCPhys;
3013	if (ppGipR3)
3014	*ppGipR3 = pGip;
3015
3016	#ifdef DEBUG_DARWIN_GIP
3017	OSDBGPRINT(("SUPR0GipMap: returns %d pHCPhysGip=%lx pGip=%p\n", rc, (unsigned long)HCPhys, (void )pGip));
3018	#else
3019	LogFlow(( "SUPR0GipMap: returns %d pHCPhysGip=%lx pGip=%p\n", rc, (unsigned long)HCPhys, (void )pGip));
3020	#endif
3021	return rc;
3022	}
3023
3024
3025	/**
3026	* Unmaps any user mapping of the GIP and terminates all GIP access
3027	* from this session.
3028	*
3029	* @returns IPRT status code.
3030	* @param pSession Session to which the GIP mapping should belong.
3031	*/
3032	SUPR0DECL(int) SUPR0GipUnmap(PSUPDRVSESSION pSession)
3033	{
3034	int rc = VINF_SUCCESS;
3035	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
3036	#ifdef DEBUG_DARWIN_GIP
3037	OSDBGPRINT(("SUPR0GipUnmap: pSession=%p pGip=%p GipMapObjR3=%p\n",
3038	pSession,
3039	pSession->GipMapObjR3 != NIL_RTR0MEMOBJ ? RTR0MemObjAddress(pSession->GipMapObjR3) : NULL,
3040	pSession->GipMapObjR3));
3041	#else
3042	LogFlow(("SUPR0GipUnmap: pSession=%p\n", pSession));
3043	#endif
3044	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3045
3046	RTSemFastMutexRequest(pDevExt->mtxGip);
3047
3048	/*
3049	* Unmap anything?
3050	*/
3051	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
3052	{
3053	rc = RTR0MemObjFree(pSession->GipMapObjR3, false);
3054	AssertRC(rc);
3055	if (RT_SUCCESS(rc))
3056	pSession->GipMapObjR3 = NIL_RTR0MEMOBJ;
3057	}
3058
3059	/*
3060	* Dereference global GIP.
3061	*/
3062	if (pSession->fGipReferenced && !rc)
3063	{
3064	pSession->fGipReferenced = 0;
3065	if ( pDevExt->cGipUsers > 0
3066	&& !--pDevExt->cGipUsers)
3067	{
3068	LogFlow(("SUPR0GipUnmap: Suspends GIP updating\n"));
3069	rc = RTTimerStop(pDevExt->pGipTimer); AssertRC(rc); rc = VINF_SUCCESS;
3070	}
3071	}
3072
3073	RTSemFastMutexRelease(pDevExt->mtxGip);
3074
3075	return rc;
3076	}
3077
3078
3079	/**
3080	* Register a component factory with the support driver.
3081	*
3082	* This is currently restricted to kernel sessions only.
3083	*
3084	* @returns VBox status code.
3085	* @retval VINF_SUCCESS on success.
3086	* @retval VERR_NO_MEMORY if we're out of memory.
3087	* @retval VERR_ALREADY_EXISTS if the factory has already been registered.
3088	* @retval VERR_ACCESS_DENIED if it isn't a kernel session.
3089	* @retval VERR_INVALID_PARAMETER on invalid parameter.
3090	* @retval VERR_INVALID_POINTER on invalid pointer parameter.
3091	*
3092	* @param pSession The SUPDRV session (must be a ring-0 session).
3093	* @param pFactory Pointer to the component factory registration structure.
3094	*
3095	* @remarks This interface is also available via SUPR0IdcComponentRegisterFactory.
3096	*/
3097	SUPR0DECL(int) SUPR0ComponentRegisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
3098	{
3099	PSUPDRVFACTORYREG pNewReg;
3100	const char *psz;
3101	int rc;
3102
3103	/*
3104	* Validate parameters.
3105	*/
3106	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3107	AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
3108	AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
3109	AssertPtrReturn(pFactory->pfnQueryFactoryInterface, VERR_INVALID_POINTER);
3110	psz = (const char *)memchr(pFactory->szName, '\0', sizeof(pFactory->szName));
3111	AssertReturn(psz, VERR_INVALID_PARAMETER);
3112
3113	/*
3114	* Allocate and initialize a new registration structure.
3115	*/
3116	pNewReg = (PSUPDRVFACTORYREG)RTMemAlloc(sizeof(SUPDRVFACTORYREG));
3117	if (pNewReg)
3118	{
3119	pNewReg->pNext = NULL;
3120	pNewReg->pFactory = pFactory;
3121	pNewReg->pSession = pSession;
3122	pNewReg->cchName = psz - &pFactory->szName[0];
3123
3124	/*
3125	* Add it to the tail of the list after checking for prior registration.
3126	*/
3127	rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3128	if (RT_SUCCESS(rc))
3129	{
3130	PSUPDRVFACTORYREG pPrev = NULL;
3131	PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3132	while (pCur && pCur->pFactory != pFactory)
3133	{
3134	pPrev = pCur;
3135	pCur = pCur->pNext;
3136	}
3137	if (!pCur)
3138	{
3139	if (pPrev)
3140	pPrev->pNext = pNewReg;
3141	else
3142	pSession->pDevExt->pComponentFactoryHead = pNewReg;
3143	rc = VINF_SUCCESS;
3144	}
3145	else
3146	rc = VERR_ALREADY_EXISTS;
3147
3148	RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3149	}
3150
3151	if (RT_FAILURE(rc))
3152	RTMemFree(pNewReg);
3153	}
3154	else
3155	rc = VERR_NO_MEMORY;
3156	return rc;
3157	}
3158
3159
3160	/**
3161	* Deregister a component factory.
3162	*
3163	* @returns VBox status code.
3164	* @retval VINF_SUCCESS on success.
3165	* @retval VERR_NOT_FOUND if the factory wasn't registered.
3166	* @retval VERR_ACCESS_DENIED if it isn't a kernel session.
3167	* @retval VERR_INVALID_PARAMETER on invalid parameter.
3168	* @retval VERR_INVALID_POINTER on invalid pointer parameter.
3169	*
3170	* @param pSession The SUPDRV session (must be a ring-0 session).
3171	* @param pFactory Pointer to the component factory registration structure
3172	* previously passed SUPR0ComponentRegisterFactory().
3173	*
3174	* @remarks This interface is also available via SUPR0IdcComponentDeregisterFactory.
3175	*/
3176	SUPR0DECL(int) SUPR0ComponentDeregisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
3177	{
3178	int rc;
3179
3180	/*
3181	* Validate parameters.
3182	*/
3183	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3184	AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
3185	AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
3186
3187	/*
3188	* Take the lock and look for the registration record.
3189	*/
3190	rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3191	if (RT_SUCCESS(rc))
3192	{
3193	PSUPDRVFACTORYREG pPrev = NULL;
3194	PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3195	while (pCur && pCur->pFactory != pFactory)
3196	{
3197	pPrev = pCur;
3198	pCur = pCur->pNext;
3199	}
3200	if (pCur)
3201	{
3202	if (!pPrev)
3203	pSession->pDevExt->pComponentFactoryHead = pCur->pNext;
3204	else
3205	pPrev->pNext = pCur->pNext;
3206
3207	pCur->pNext = NULL;
3208	pCur->pFactory = NULL;
3209	pCur->pSession = NULL;
3210	rc = VINF_SUCCESS;
3211	}
3212	else
3213	rc = VERR_NOT_FOUND;
3214
3215	RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3216
3217	RTMemFree(pCur);
3218	}
3219	return rc;
3220	}
3221
3222
3223	/**
3224	* Queries a component factory.
3225	*
3226	* @returns VBox status code.
3227	* @retval VERR_INVALID_PARAMETER on invalid parameter.
3228	* @retval VERR_INVALID_POINTER on invalid pointer parameter.
3229	* @retval VERR_SUPDRV_COMPONENT_NOT_FOUND if the component factory wasn't found.
3230	* @retval VERR_SUPDRV_INTERFACE_NOT_SUPPORTED if the interface wasn't supported.
3231	*
3232	* @param pSession The SUPDRV session.
3233	* @param pszName The name of the component factory.
3234	* @param pszInterfaceUuid The UUID of the factory interface (stringified).
3235	* @param ppvFactoryIf Where to store the factory interface.
3236	*/
3237	SUPR0DECL(int) SUPR0ComponentQueryFactory(PSUPDRVSESSION pSession, const char pszName, const char pszInterfaceUuid, void **ppvFactoryIf)
3238	{
3239	const char *pszEnd;
3240	size_t cchName;
3241	int rc;
3242
3243	/*
3244	* Validate parameters.
3245	*/
3246	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3247
3248	AssertPtrReturn(pszName, VERR_INVALID_POINTER);
3249	pszEnd = memchr(pszName, '\0', RT_SIZEOFMEMB(SUPDRVFACTORY, szName));
3250	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
3251	cchName = pszEnd - pszName;
3252
3253	AssertPtrReturn(pszInterfaceUuid, VERR_INVALID_POINTER);
3254	pszEnd = memchr(pszInterfaceUuid, '\0', RTUUID_STR_LENGTH);
3255	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
3256
3257	AssertPtrReturn(ppvFactoryIf, VERR_INVALID_POINTER);
3258	*ppvFactoryIf = NULL;
3259
3260	/*
3261	* Take the lock and try all factories by this name.
3262	*/
3263	rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3264	if (RT_SUCCESS(rc))
3265	{
3266	PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3267	rc = VERR_SUPDRV_COMPONENT_NOT_FOUND;
3268	while (pCur)
3269	{
3270	if ( pCur->cchName == cchName
3271	&& !memcmp(pCur->pFactory->szName, pszName, cchName))
3272	{
3273	#ifdef RT_WITH_W64_UNWIND_HACK
3274	void *pvFactory = supdrvNtWrapQueryFactoryInterface((PFNRT)pCur->pFactory->pfnQueryFactoryInterface, pCur->pFactory, pSession, pszInterfaceUuid);
3275	#else
3276	void *pvFactory = pCur->pFactory->pfnQueryFactoryInterface(pCur->pFactory, pSession, pszInterfaceUuid);
3277	#endif
3278	if (pvFactory)
3279	{
3280	*ppvFactoryIf = pvFactory;
3281	rc = VINF_SUCCESS;
3282	break;
3283	}
3284	rc = VERR_SUPDRV_INTERFACE_NOT_SUPPORTED;
3285	}
3286
3287	/* next */
3288	pCur = pCur->pNext;
3289	}
3290
3291	RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3292	}
3293	return rc;
3294	}
3295
3296
3297	/**
3298	* Destructor for objects created by SUPSemEventCreate.
3299	*
3300	* @param pvObj The object handle.
3301	* @param pvUser1 The IPRT event handle.
3302	* @param pvUser2 NULL.
3303	*/
3304	static DECLCALLBACK(void) supR0SemEventDestructor(void pvObj, void pvUser1, void *pvUser2)
3305	{
3306	Assert(pvUser2 == NULL);
3307	NOREF(pvObj);
3308	RTSemEventDestroy((RTSEMEVENT)pvUser1);
3309	}
3310
3311
3312	SUPDECL(int) SUPSemEventCreate(PSUPDRVSESSION pSession, PSUPSEMEVENT phEvent)
3313	{
3314	int rc;
3315	RTSEMEVENT hEventReal;
3316
3317	/*
3318	* Input validation.
3319	*/
3320	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3321	AssertPtrReturn(phEvent, VERR_INVALID_POINTER);
3322
3323	/*
3324	* Create the event semaphore object.
3325	*/
3326	rc = RTSemEventCreate(&hEventReal);
3327	if (RT_SUCCESS(rc))
3328	{
3329	void *pvObj = SUPR0ObjRegister(pSession, SUPDRVOBJTYPE_SEM_EVENT, supR0SemEventDestructor, hEventReal, NULL);
3330	if (pvObj)
3331	{
3332	uint32_t h32;
3333	rc = RTHandleTableAllocWithCtx(pSession->hHandleTable, pvObj, SUPDRV_HANDLE_CTX_EVENT, &h32);
3334	if (RT_SUCCESS(rc))
3335	{
3336	*phEvent = (SUPSEMEVENT)(uintptr_t)h32;
3337	return VINF_SUCCESS;
3338	}
3339	SUPR0ObjRelease(pvObj, pSession);
3340	}
3341	else
3342	RTSemEventDestroy(hEventReal);
3343	}
3344	return rc;
3345	}
3346
3347
3348	SUPDECL(int) SUPSemEventClose(PSUPDRVSESSION pSession, SUPSEMEVENT hEvent)
3349	{
3350	uint32_t h32;
3351	PSUPDRVOBJ pObj;
3352
3353	/*
3354	* Input validation.
3355	*/
3356	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3357	if (hEvent == NIL_SUPSEMEVENT)
3358	return VINF_SUCCESS;
3359	h32 = (uint32_t)(uintptr_t)hEvent;
3360	if (h32 != (uintptr_t)hEvent)
3361	return VERR_INVALID_HANDLE;
3362
3363	/*
3364	* Do the job.
3365	*/
3366	pObj = (PSUPDRVOBJ)RTHandleTableFreeWithCtx(pSession->hHandleTable, h32, SUPDRV_HANDLE_CTX_EVENT);
3367	if (!pObj)
3368	return VERR_INVALID_HANDLE;
3369
3370	Assert(pObj->cUsage >= 2);
3371	SUPR0ObjRelease(pObj, pSession); /* The free call above. */
3372	return SUPR0ObjRelease(pObj, pSession); /* The handle table reference. */
3373	}
3374
3375
3376	SUPDECL(int) SUPSemEventSignal(PSUPDRVSESSION pSession, SUPSEMEVENT hEvent)
3377	{
3378	int rc;
3379	uint32_t h32;
3380	PSUPDRVOBJ pObj;
3381
3382	/*
3383	* Input validation.
3384	*/
3385	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3386	h32 = (uint32_t)(uintptr_t)hEvent;
3387	if (h32 != (uintptr_t)hEvent)
3388	return VERR_INVALID_HANDLE;
3389	pObj = (PSUPDRVOBJ)RTHandleTableLookupWithCtx(pSession->hHandleTable, h32, SUPDRV_HANDLE_CTX_EVENT);
3390	if (!pObj)
3391	return VERR_INVALID_HANDLE;
3392
3393	/*
3394	* Do the job.
3395	*/
3396	rc = RTSemEventSignal((RTSEMEVENT)pObj->pvUser1);
3397
3398	SUPR0ObjRelease(pObj, pSession);
3399	return rc;
3400	}
3401
3402
3403	SUPDECL(int) SUPSemEventWait(PSUPDRVSESSION pSession, SUPSEMEVENT hEvent, uint32_t cMillies)
3404	{
3405	int rc;
3406	uint32_t h32;
3407	PSUPDRVOBJ pObj;
3408
3409	/*
3410	* Input validation.
3411	*/
3412	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3413	h32 = (uint32_t)(uintptr_t)hEvent;
3414	if (h32 != (uintptr_t)hEvent)
3415	return VERR_INVALID_HANDLE;
3416	pObj = (PSUPDRVOBJ)RTHandleTableLookupWithCtx(pSession->hHandleTable, h32, SUPDRV_HANDLE_CTX_EVENT);
3417	if (!pObj)
3418	return VERR_INVALID_HANDLE;
3419
3420	/*
3421	* Do the job.
3422	*/
3423	rc = RTSemEventWait((RTSEMEVENT)pObj->pvUser1, cMillies);
3424
3425	SUPR0ObjRelease(pObj, pSession);
3426	return rc;
3427	}
3428
3429
3430	SUPDECL(int) SUPSemEventWaitNoResume(PSUPDRVSESSION pSession, SUPSEMEVENT hEvent, uint32_t cMillies)
3431	{
3432	int rc;
3433	uint32_t h32;
3434	PSUPDRVOBJ pObj;
3435
3436	/*
3437	* Input validation.
3438	*/
3439	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3440	h32 = (uint32_t)(uintptr_t)hEvent;
3441	if (h32 != (uintptr_t)hEvent)
3442	return VERR_INVALID_HANDLE;
3443	pObj = (PSUPDRVOBJ)RTHandleTableLookupWithCtx(pSession->hHandleTable, h32, SUPDRV_HANDLE_CTX_EVENT);
3444	if (!pObj)
3445	return VERR_INVALID_HANDLE;
3446
3447	/*
3448	* Do the job.
3449	*/
3450	rc = RTSemEventWaitNoResume((RTSEMEVENT)pObj->pvUser1, cMillies);
3451
3452	SUPR0ObjRelease(pObj, pSession);
3453	return rc;
3454	}
3455
3456
3457	/**
3458	* Destructor for objects created by SUPSemEventMultiCreate.
3459	*
3460	* @param pvObj The object handle.
3461	* @param pvUser1 The IPRT event handle.
3462	* @param pvUser2 NULL.
3463	*/
3464	static DECLCALLBACK(void) supR0SemEventMultiDestructor(void pvObj, void pvUser1, void *pvUser2)
3465	{
3466	Assert(pvUser2 == NULL);
3467	NOREF(pvObj);
3468	RTSemEventMultiDestroy((RTSEMEVENTMULTI)pvUser1);
3469	}
3470
3471
3472	SUPDECL(int) SUPSemEventMultiCreate(PSUPDRVSESSION pSession, PSUPSEMEVENTMULTI phEventMulti)
3473	{
3474	int rc;
3475	RTSEMEVENTMULTI hEventMultReal;
3476
3477	/*
3478	* Input validation.
3479	*/
3480	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3481	AssertPtrReturn(phEventMulti, VERR_INVALID_POINTER);
3482
3483	/*
3484	* Create the event semaphore object.
3485	*/
3486	rc = RTSemEventMultiCreate(&hEventMultReal);
3487	if (RT_SUCCESS(rc))
3488	{
3489	void *pvObj = SUPR0ObjRegister(pSession, SUPDRVOBJTYPE_SEM_EVENT_MULTI, supR0SemEventMultiDestructor, hEventMultReal, NULL);
3490	if (pvObj)
3491	{
3492	uint32_t h32;
3493	rc = RTHandleTableAllocWithCtx(pSession->hHandleTable, pvObj, SUPDRV_HANDLE_CTX_EVENT_MULTI, &h32);
3494	if (RT_SUCCESS(rc))
3495	{
3496	*phEventMulti = (SUPSEMEVENTMULTI)(uintptr_t)h32;
3497	return VINF_SUCCESS;
3498	}
3499	SUPR0ObjRelease(pvObj, pSession);
3500	}
3501	else
3502	RTSemEventMultiDestroy(hEventMultReal);
3503	}
3504	return rc;
3505	}
3506
3507
3508	SUPDECL(int) SUPSemEventMultiClose(PSUPDRVSESSION pSession, SUPSEMEVENTMULTI hEventMulti)
3509	{
3510	uint32_t h32;
3511	PSUPDRVOBJ pObj;
3512
3513	/*
3514	* Input validation.
3515	*/
3516	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3517	if (hEventMulti == NIL_SUPSEMEVENTMULTI)
3518	return VINF_SUCCESS;
3519	h32 = (uint32_t)(uintptr_t)hEventMulti;
3520	if (h32 != (uintptr_t)hEventMulti)
3521	return VERR_INVALID_HANDLE;
3522
3523	/*
3524	* Do the job.
3525	*/
3526	pObj = (PSUPDRVOBJ)RTHandleTableFreeWithCtx(pSession->hHandleTable, h32, SUPDRV_HANDLE_CTX_EVENT_MULTI);
3527	if (!pObj)
3528	return VERR_INVALID_HANDLE;
3529
3530	Assert(pObj->cUsage >= 2);
3531	SUPR0ObjRelease(pObj, pSession); /* The free call above. */
3532	return SUPR0ObjRelease(pObj, pSession); /* The handle table reference. */
3533	}
3534
3535
3536	SUPDECL(int) SUPSemEventMultiSignal(PSUPDRVSESSION pSession, SUPSEMEVENTMULTI hEventMulti)
3537	{
3538	int rc;
3539	uint32_t h32;
3540	PSUPDRVOBJ pObj;
3541
3542	/*
3543	* Input validation.
3544	*/
3545	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3546	h32 = (uint32_t)(uintptr_t)hEventMulti;
3547	if (h32 != (uintptr_t)hEventMulti)
3548	return VERR_INVALID_HANDLE;
3549	pObj = (PSUPDRVOBJ)RTHandleTableLookupWithCtx(pSession->hHandleTable, h32, SUPDRV_HANDLE_CTX_EVENT_MULTI);
3550	if (!pObj)
3551	return VERR_INVALID_HANDLE;
3552
3553	/*
3554	* Do the job.
3555	*/
3556	rc = RTSemEventMultiSignal((RTSEMEVENTMULTI)pObj->pvUser1);
3557
3558	SUPR0ObjRelease(pObj, pSession);
3559	return rc;
3560	}
3561
3562
3563	SUPDECL(int) SUPSemEventMultiReset(PSUPDRVSESSION pSession, SUPSEMEVENTMULTI hEventMulti)
3564	{
3565	int rc;
3566	uint32_t h32;
3567	PSUPDRVOBJ pObj;
3568
3569	/*
3570	* Input validation.
3571	*/
3572	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3573	h32 = (uint32_t)(uintptr_t)hEventMulti;
3574	if (h32 != (uintptr_t)hEventMulti)
3575	return VERR_INVALID_HANDLE;
3576	pObj = (PSUPDRVOBJ)RTHandleTableLookupWithCtx(pSession->hHandleTable, h32, SUPDRV_HANDLE_CTX_EVENT_MULTI);
3577	if (!pObj)
3578	return VERR_INVALID_HANDLE;
3579
3580	/*
3581	* Do the job.
3582	*/
3583	rc = RTSemEventMultiReset((RTSEMEVENTMULTI)pObj->pvUser1);
3584
3585	SUPR0ObjRelease(pObj, pSession);
3586	return rc;
3587	}
3588
3589
3590	SUPDECL(int) SUPSemEventMultiWait(PSUPDRVSESSION pSession, SUPSEMEVENTMULTI hEventMulti, uint32_t cMillies)
3591	{
3592	int rc;
3593	uint32_t h32;
3594	PSUPDRVOBJ pObj;
3595
3596	/*
3597	* Input validation.
3598	*/
3599	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3600	h32 = (uint32_t)(uintptr_t)hEventMulti;
3601	if (h32 != (uintptr_t)hEventMulti)
3602	return VERR_INVALID_HANDLE;
3603	pObj = (PSUPDRVOBJ)RTHandleTableLookupWithCtx(pSession->hHandleTable, h32, SUPDRV_HANDLE_CTX_EVENT_MULTI);
3604	if (!pObj)
3605	return VERR_INVALID_HANDLE;
3606
3607	/*
3608	* Do the job.
3609	*/
3610	rc = RTSemEventMultiWait((RTSEMEVENTMULTI)pObj->pvUser1, cMillies);
3611
3612	SUPR0ObjRelease(pObj, pSession);
3613	return rc;
3614	}
3615
3616
3617	SUPDECL(int) SUPSemEventMultiWaitNoResume(PSUPDRVSESSION pSession, SUPSEMEVENTMULTI hEventMulti, uint32_t cMillies)
3618	{
3619	int rc;
3620	uint32_t h32;
3621	PSUPDRVOBJ pObj;
3622
3623	/*
3624	* Input validation.
3625	*/
3626	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3627	h32 = (uint32_t)(uintptr_t)hEventMulti;
3628	if (h32 != (uintptr_t)hEventMulti)
3629	return VERR_INVALID_HANDLE;
3630	pObj = (PSUPDRVOBJ)RTHandleTableLookupWithCtx(pSession->hHandleTable, h32, SUPDRV_HANDLE_CTX_EVENT_MULTI);
3631	if (!pObj)
3632	return VERR_INVALID_HANDLE;
3633
3634	/*
3635	* Do the job.
3636	*/
3637	rc = RTSemEventMultiWaitNoResume((RTSEMEVENTMULTI)pObj->pvUser1, cMillies);
3638
3639	SUPR0ObjRelease(pObj, pSession);
3640	return rc;
3641	}
3642
3643
3644	/**
3645	* Adds a memory object to the session.
3646	*
3647	* @returns IPRT status code.
3648	* @param pMem Memory tracking structure containing the
3649	* information to track.
3650	* @param pSession The session.
3651	*/
3652	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession)
3653	{
3654	PSUPDRVBUNDLE pBundle;
3655	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3656
3657	/*
3658	* Find free entry and record the allocation.
3659	*/
3660	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3661	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3662	{
3663	if (pBundle->cUsed < RT_ELEMENTS(pBundle->aMem))
3664	{
3665	unsigned i;
3666	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3667	{
3668	if (pBundle->aMem[i].MemObj == NIL_RTR0MEMOBJ)
3669	{
3670	pBundle->cUsed++;
3671	pBundle->aMem[i] = *pMem;
3672	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3673	return VINF_SUCCESS;
3674	}
3675	}
3676	AssertFailed(); /* !!this can't be happening!!! */
3677	}
3678	}
3679	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3680
3681	/*
3682	* Need to allocate a new bundle.
3683	* Insert into the last entry in the bundle.
3684	*/
3685	pBundle = (PSUPDRVBUNDLE)RTMemAllocZ(sizeof(*pBundle));
3686	if (!pBundle)
3687	return VERR_NO_MEMORY;
3688
3689	/* take last entry. */
3690	pBundle->cUsed++;
3691	pBundle->aMem[RT_ELEMENTS(pBundle->aMem) - 1] = *pMem;
3692
3693	/* insert into list. */
3694	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3695	pBundle->pNext = pSession->Bundle.pNext;
3696	pSession->Bundle.pNext = pBundle;
3697	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3698
3699	return VINF_SUCCESS;
3700	}
3701
3702
3703	/**
3704	* Releases a memory object referenced by pointer and type.
3705	*
3706	* @returns IPRT status code.
3707	* @param pSession Session data.
3708	* @param uPtr Pointer to memory. This is matched against both the R0 and R3 addresses.
3709	* @param eType Memory type.
3710	*/
3711	static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType)
3712	{
3713	PSUPDRVBUNDLE pBundle;
3714	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3715
3716	/*
3717	* Validate input.
3718	*/
3719	if (!uPtr)
3720	{
3721	Log(("Illegal address %p\n", (void *)uPtr));
3722	return VERR_INVALID_PARAMETER;
3723	}
3724
3725	/*
3726	* Search for the address.
3727	*/
3728	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3729	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3730	{
3731	if (pBundle->cUsed > 0)
3732	{
3733	unsigned i;
3734	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3735	{
3736	if ( pBundle->aMem[i].eType == eType
3737	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3738	&& ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
3739	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
3740	&& RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr))
3741	)
3742	{
3743	/* Make a copy of it and release it outside the spinlock. */
3744	SUPDRVMEMREF Mem = pBundle->aMem[i];
3745	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
3746	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
3747	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
3748	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3749
3750	if (Mem.MapObjR3 != NIL_RTR0MEMOBJ)
3751	{
3752	int rc = RTR0MemObjFree(Mem.MapObjR3, false);
3753	AssertRC(rc); /** @todo figure out how to handle this. */
3754	}
3755	if (Mem.MemObj != NIL_RTR0MEMOBJ)
3756	{
3757	int rc = RTR0MemObjFree(Mem.MemObj, true /* fFreeMappings */);
3758	AssertRC(rc); /** @todo figure out how to handle this. */
3759	}
3760	return VINF_SUCCESS;
3761	}
3762	}
3763	}
3764	}
3765	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3766	Log(("Failed to find %p!!! (eType=%d)\n", (void *)uPtr, eType));
3767	return VERR_INVALID_PARAMETER;
3768	}
3769
3770
3771	/**
3772	* Opens an image. If it's the first time it's opened the call must upload
3773	* the bits using the supdrvIOCtl_LdrLoad() / SUPDRV_IOCTL_LDR_LOAD function.
3774	*
3775	* This is the 1st step of the loading.
3776	*
3777	* @returns IPRT status code.
3778	* @param pDevExt Device globals.
3779	* @param pSession Session data.
3780	* @param pReq The open request.
3781	*/
3782	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq)
3783	{
3784	PSUPDRVLDRIMAGE pImage;
3785	unsigned cb;
3786	void *pv;
3787	size_t cchName = strlen(pReq->u.In.szName); /* (caller checked < 32). */
3788	LogFlow(("supdrvIOCtl_LdrOpen: szName=%s cbImage=%d\n", pReq->u.In.szName, pReq->u.In.cbImage));
3789
3790	/*
3791	* Check if we got an instance of the image already.
3792	*/
3793	RTSemFastMutexRequest(pDevExt->mtxLdr);
3794	for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
3795	{
3796	if ( pImage->szName[cchName] == '\0'
3797	&& !memcmp(pImage->szName, pReq->u.In.szName, cchName))
3798	{
3799	pImage->cUsage++;
3800	pReq->u.Out.pvImageBase = pImage->pvImage;
3801	pReq->u.Out.fNeedsLoading = pImage->uState == SUP_IOCTL_LDR_OPEN;
3802	supdrvLdrAddUsage(pSession, pImage);
3803	RTSemFastMutexRelease(pDevExt->mtxLdr);
3804	return VINF_SUCCESS;
3805	}
3806	}
3807	/* (not found - add it!) */
3808
3809	/*
3810	* Allocate memory.
3811	*/
3812	cb = pReq->u.In.cbImage + sizeof(SUPDRVLDRIMAGE) + 31;
3813	pv = RTMemExecAlloc(cb);
3814	if (!pv)
3815	{
3816	RTSemFastMutexRelease(pDevExt->mtxLdr);
3817	Log(("supdrvIOCtl_LdrOpen: RTMemExecAlloc(%u) failed\n", cb));
3818	return VERR_NO_MEMORY;
3819	}
3820
3821	/*
3822	* Setup and link in the LDR stuff.
3823	*/
3824	pImage = (PSUPDRVLDRIMAGE)pv;
3825	pImage->pvImage = RT_ALIGN_P(pImage + 1, 32);
3826	pImage->cbImage = pReq->u.In.cbImage;
3827	pImage->pfnModuleInit = NULL;
3828	pImage->pfnModuleTerm = NULL;
3829	pImage->pfnServiceReqHandler = NULL;
3830	pImage->uState = SUP_IOCTL_LDR_OPEN;
3831	pImage->cUsage = 1;
3832	memcpy(pImage->szName, pReq->u.In.szName, cchName + 1);
3833
3834	pImage->pNext = pDevExt->pLdrImages;
3835	pDevExt->pLdrImages = pImage;
3836
3837	supdrvLdrAddUsage(pSession, pImage);
3838
3839	pReq->u.Out.pvImageBase = pImage->pvImage;
3840	pReq->u.Out.fNeedsLoading = true;
3841	RTSemFastMutexRelease(pDevExt->mtxLdr);
3842
3843	#if defined(RT_OS_WINDOWS) && defined(DEBUG)
3844	SUPR0Printf("VBoxDrv: windbg> .reload /f %s=%#p\n", pImage->szName, pImage->pvImage);
3845	#endif
3846	return VINF_SUCCESS;
3847	}
3848
3849
3850	/**
3851	* Loads the image bits.
3852	*
3853	* This is the 2nd step of the loading.
3854	*
3855	* @returns IPRT status code.
3856	* @param pDevExt Device globals.
3857	* @param pSession Session data.
3858	* @param pReq The request.
3859	*/
3860	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq)
3861	{
3862	PSUPDRVLDRUSAGE pUsage;
3863	PSUPDRVLDRIMAGE pImage;
3864	int rc;
3865	LogFlow(("supdrvIOCtl_LdrLoad: pvImageBase=%p cbImage=%d\n", pReq->u.In.pvImageBase, pReq->u.In.cbImage));
3866
3867	/*
3868	* Find the ldr image.
3869	*/
3870	RTSemFastMutexRequest(pDevExt->mtxLdr);
3871	pUsage = pSession->pLdrUsage;
3872	while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
3873	pUsage = pUsage->pNext;
3874	if (!pUsage)
3875	{
3876	RTSemFastMutexRelease(pDevExt->mtxLdr);
3877	Log(("SUP_IOCTL_LDR_LOAD: couldn't find image!\n"));
3878	return VERR_INVALID_HANDLE;
3879	}
3880	pImage = pUsage->pImage;
3881	if (pImage->cbImage != pReq->u.In.cbImage)
3882	{
3883	RTSemFastMutexRelease(pDevExt->mtxLdr);
3884	Log(("SUP_IOCTL_LDR_LOAD: image size mismatch!! %d(prep) != %d(load)\n", pImage->cbImage, pReq->u.In.cbImage));
3885	return VERR_INVALID_HANDLE;
3886	}
3887	if (pImage->uState != SUP_IOCTL_LDR_OPEN)
3888	{
3889	unsigned uState = pImage->uState;
3890	RTSemFastMutexRelease(pDevExt->mtxLdr);
3891	if (uState != SUP_IOCTL_LDR_LOAD)
3892	AssertMsgFailed(("SUP_IOCTL_LDR_LOAD: invalid image state %d (%#x)!\n", uState, uState));
3893	return SUPDRV_ERR_ALREADY_LOADED;
3894	}
3895	switch (pReq->u.In.eEPType)
3896	{
3897	case SUPLDRLOADEP_NOTHING:
3898	break;
3899
3900	case SUPLDRLOADEP_VMMR0:
3901	if ( !pReq->u.In.EP.VMMR0.pvVMMR0
3902	\|\| !pReq->u.In.EP.VMMR0.pvVMMR0EntryInt
3903	\|\| !pReq->u.In.EP.VMMR0.pvVMMR0EntryFast
3904	\|\| !pReq->u.In.EP.VMMR0.pvVMMR0EntryEx)
3905	{
3906	RTSemFastMutexRelease(pDevExt->mtxLdr);
3907	Log(("NULL pointer: pvVMMR0=%p pvVMMR0EntryInt=%p pvVMMR0EntryFast=%p pvVMMR0EntryEx=%p!\n",
3908	pReq->u.In.EP.VMMR0.pvVMMR0, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt,
3909	pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx));
3910	return VERR_INVALID_PARAMETER;
3911	}
3912	/** @todo validate pReq->u.In.EP.VMMR0.pvVMMR0 against pvImage! */
3913	if ( (uintptr_t)pReq->u.In.EP.VMMR0.pvVMMR0EntryInt - (uintptr_t)pImage->pvImage >= pReq->u.In.cbImage
3914	\|\| (uintptr_t)pReq->u.In.EP.VMMR0.pvVMMR0EntryFast - (uintptr_t)pImage->pvImage >= pReq->u.In.cbImage
3915	\|\| (uintptr_t)pReq->u.In.EP.VMMR0.pvVMMR0EntryEx - (uintptr_t)pImage->pvImage >= pReq->u.In.cbImage)
3916	{
3917	RTSemFastMutexRelease(pDevExt->mtxLdr);
3918	Log(("Out of range (%p LB %#x): pvVMMR0EntryInt=%p, pvVMMR0EntryFast=%p or pvVMMR0EntryEx=%p is NULL!\n",
3919	pImage->pvImage, pReq->u.In.cbImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt,
3920	pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx));
3921	return VERR_INVALID_PARAMETER;
3922	}
3923	break;
3924
3925	case SUPLDRLOADEP_SERVICE:
3926	if (!pReq->u.In.EP.Service.pfnServiceReq)
3927	{
3928	RTSemFastMutexRelease(pDevExt->mtxLdr);
3929	Log(("NULL pointer: pfnServiceReq=%p!\n", pReq->u.In.EP.Service.pfnServiceReq));
3930	return VERR_INVALID_PARAMETER;
3931	}
3932	if ((uintptr_t)pReq->u.In.EP.Service.pfnServiceReq - (uintptr_t)pImage->pvImage >= pReq->u.In.cbImage)
3933	{
3934	RTSemFastMutexRelease(pDevExt->mtxLdr);
3935	Log(("Out of range (%p LB %#x): pfnServiceReq=%p, pvVMMR0EntryFast=%p or pvVMMR0EntryEx=%p is NULL!\n",
3936	pImage->pvImage, pReq->u.In.cbImage, pReq->u.In.EP.Service.pfnServiceReq));
3937	return VERR_INVALID_PARAMETER;
3938	}
3939	if ( pReq->u.In.EP.Service.apvReserved[0] != NIL_RTR0PTR
3940	\|\| pReq->u.In.EP.Service.apvReserved[1] != NIL_RTR0PTR
3941	\|\| pReq->u.In.EP.Service.apvReserved[2] != NIL_RTR0PTR)
3942	{
3943	RTSemFastMutexRelease(pDevExt->mtxLdr);
3944	Log(("Out of range (%p LB %#x): apvReserved={%p,%p,%p} MBZ!\n",
3945	pImage->pvImage, pReq->u.In.cbImage,
3946	pReq->u.In.EP.Service.apvReserved[0],
3947	pReq->u.In.EP.Service.apvReserved[1],
3948	pReq->u.In.EP.Service.apvReserved[2]));
3949	return VERR_INVALID_PARAMETER;
3950	}
3951	break;
3952
3953	default:
3954	RTSemFastMutexRelease(pDevExt->mtxLdr);
3955	Log(("Invalid eEPType=%d\n", pReq->u.In.eEPType));
3956	return VERR_INVALID_PARAMETER;
3957	}
3958	if ( pReq->u.In.pfnModuleInit
3959	&& (uintptr_t)pReq->u.In.pfnModuleInit - (uintptr_t)pImage->pvImage >= pReq->u.In.cbImage)
3960	{
3961	RTSemFastMutexRelease(pDevExt->mtxLdr);
3962	Log(("SUP_IOCTL_LDR_LOAD: pfnModuleInit=%p is outside the image (%p %d bytes)\n",
3963	pReq->u.In.pfnModuleInit, pImage->pvImage, pReq->u.In.cbImage));
3964	return VERR_INVALID_PARAMETER;
3965	}
3966	if ( pReq->u.In.pfnModuleTerm
3967	&& (uintptr_t)pReq->u.In.pfnModuleTerm - (uintptr_t)pImage->pvImage >= pReq->u.In.cbImage)
3968	{
3969	RTSemFastMutexRelease(pDevExt->mtxLdr);
3970	Log(("SUP_IOCTL_LDR_LOAD: pfnModuleTerm=%p is outside the image (%p %d bytes)\n",
3971	pReq->u.In.pfnModuleTerm, pImage->pvImage, pReq->u.In.cbImage));
3972	return VERR_INVALID_PARAMETER;
3973	}
3974
3975	/*
3976	* Copy the memory.
3977	*/
3978	/* no need to do try/except as this is a buffered request. */
3979	memcpy(pImage->pvImage, &pReq->u.In.achImage[0], pImage->cbImage);
3980	pImage->uState = SUP_IOCTL_LDR_LOAD;
3981	pImage->pfnModuleInit = pReq->u.In.pfnModuleInit;
3982	pImage->pfnModuleTerm = pReq->u.In.pfnModuleTerm;
3983	pImage->offSymbols = pReq->u.In.offSymbols;
3984	pImage->cSymbols = pReq->u.In.cSymbols;
3985	pImage->offStrTab = pReq->u.In.offStrTab;
3986	pImage->cbStrTab = pReq->u.In.cbStrTab;
3987
3988	/*
3989	* Update any entry points.
3990	*/
3991	switch (pReq->u.In.eEPType)
3992	{
3993	default:
3994	case SUPLDRLOADEP_NOTHING:
3995	rc = VINF_SUCCESS;
3996	break;
3997	case SUPLDRLOADEP_VMMR0:
3998	rc = supdrvLdrSetVMMR0EPs(pDevExt, pReq->u.In.EP.VMMR0.pvVMMR0, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt,
3999	pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx);
4000	break;
4001	case SUPLDRLOADEP_SERVICE:
4002	pImage->pfnServiceReqHandler = pReq->u.In.EP.Service.pfnServiceReq;
4003	rc = VINF_SUCCESS;
4004	break;
4005	}
4006
4007	/*
4008	* On success call the module initialization.
4009	*/
4010	LogFlow(("supdrvIOCtl_LdrLoad: pfnModuleInit=%p\n", pImage->pfnModuleInit));
4011	if (RT_SUCCESS(rc) && pImage->pfnModuleInit)
4012	{
4013	Log(("supdrvIOCtl_LdrLoad: calling pfnModuleInit=%p\n", pImage->pfnModuleInit));
4014	#ifdef RT_WITH_W64_UNWIND_HACK
4015	rc = supdrvNtWrapModuleInit((PFNRT)pImage->pfnModuleInit);
4016	#else
4017	rc = pImage->pfnModuleInit();
4018	#endif
4019	if (rc && pDevExt->pvVMMR0 == pImage->pvImage)
4020	supdrvLdrUnsetVMMR0EPs(pDevExt);
4021	}
4022
4023	if (rc)
4024	pImage->uState = SUP_IOCTL_LDR_OPEN;
4025
4026	RTSemFastMutexRelease(pDevExt->mtxLdr);
4027	return rc;
4028	}
4029
4030
4031	/**
4032	* Frees a previously loaded (prep'ed) image.
4033	*
4034	* @returns IPRT status code.
4035	* @param pDevExt Device globals.
4036	* @param pSession Session data.
4037	* @param pReq The request.
4038	*/
4039	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq)
4040	{
4041	int rc;
4042	PSUPDRVLDRUSAGE pUsagePrev;
4043	PSUPDRVLDRUSAGE pUsage;
4044	PSUPDRVLDRIMAGE pImage;
4045	LogFlow(("supdrvIOCtl_LdrFree: pvImageBase=%p\n", pReq->u.In.pvImageBase));
4046
4047	/*
4048	* Find the ldr image.
4049	*/
4050	RTSemFastMutexRequest(pDevExt->mtxLdr);
4051	pUsagePrev = NULL;
4052	pUsage = pSession->pLdrUsage;
4053	while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
4054	{
4055	pUsagePrev = pUsage;
4056	pUsage = pUsage->pNext;
4057	}
4058	if (!pUsage)
4059	{
4060	RTSemFastMutexRelease(pDevExt->mtxLdr);
4061	Log(("SUP_IOCTL_LDR_FREE: couldn't find image!\n"));
4062	return VERR_INVALID_HANDLE;
4063	}
4064
4065	/*
4066	* Check if we can remove anything.
4067	*/
4068	rc = VINF_SUCCESS;
4069	pImage = pUsage->pImage;
4070	if (pImage->cUsage <= 1 \|\| pUsage->cUsage <= 1)
4071	{
4072	/*
4073	* Check if there are any objects with destructors in the image, if
4074	* so leave it for the session cleanup routine so we get a chance to
4075	* clean things up in the right order and not leave them all dangling.
4076	*/
4077	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
4078	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
4079	if (pImage->cUsage <= 1)
4080	{
4081	PSUPDRVOBJ pObj;
4082	for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
4083	if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImage))
4084	{
4085	rc = VERR_DANGLING_OBJECTS;
4086	break;
4087	}
4088	}
4089	else
4090	{
4091	PSUPDRVUSAGE pGenUsage;
4092	for (pGenUsage = pSession->pUsage; pGenUsage; pGenUsage = pGenUsage->pNext)
4093	if (RT_UNLIKELY((uintptr_t)pGenUsage->pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImage))
4094	{
4095	rc = VERR_DANGLING_OBJECTS;
4096	break;
4097	}
4098	}
4099	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
4100	if (rc == VINF_SUCCESS)
4101	{
4102	/* unlink it */
4103	if (pUsagePrev)
4104	pUsagePrev->pNext = pUsage->pNext;
4105	else
4106	pSession->pLdrUsage = pUsage->pNext;
4107
4108	/* free it */
4109	pUsage->pImage = NULL;
4110	pUsage->pNext = NULL;
4111	RTMemFree(pUsage);
4112
4113	/*
4114	* Derefrence the image.
4115	*/
4116	if (pImage->cUsage <= 1)
4117	supdrvLdrFree(pDevExt, pImage);
4118	else
4119	pImage->cUsage--;
4120	}
4121	else
4122	{
4123	Log(("supdrvIOCtl_LdrFree: Dangling objects in %p/%s!\n", pImage->pvImage, pImage->szName));
4124	rc = VINF_SUCCESS; /** @todo BRANCH-2.1: remove this after branching. */
4125	}
4126	}
4127	else
4128	{
4129	/*
4130	* Dereference both image and usage.
4131	*/
4132	pImage->cUsage--;
4133	pUsage->cUsage--;
4134	}
4135
4136	RTSemFastMutexRelease(pDevExt->mtxLdr);
4137	return rc;
4138	}
4139
4140
4141	/**
4142	* Gets the address of a symbol in an open image.
4143	*
4144	* @returns 0 on success.
4145	* @returns SUPDRV_ERR_* on failure.
4146	* @param pDevExt Device globals.
4147	* @param pSession Session data.
4148	* @param pReq The request buffer.
4149	*/
4150	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq)
4151	{
4152	PSUPDRVLDRIMAGE pImage;
4153	PSUPDRVLDRUSAGE pUsage;
4154	uint32_t i;
4155	PSUPLDRSYM paSyms;
4156	const char *pchStrings;
4157	const size_t cbSymbol = strlen(pReq->u.In.szSymbol) + 1;
4158	void *pvSymbol = NULL;
4159	int rc = VERR_GENERAL_FAILURE;
4160	Log3(("supdrvIOCtl_LdrGetSymbol: pvImageBase=%p szSymbol=\"%s\"\n", pReq->u.In.pvImageBase, pReq->u.In.szSymbol));
4161
4162	/*
4163	* Find the ldr image.
4164	*/
4165	RTSemFastMutexRequest(pDevExt->mtxLdr);
4166	pUsage = pSession->pLdrUsage;
4167	while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
4168	pUsage = pUsage->pNext;
4169	if (!pUsage)
4170	{
4171	RTSemFastMutexRelease(pDevExt->mtxLdr);
4172	Log(("SUP_IOCTL_LDR_GET_SYMBOL: couldn't find image!\n"));
4173	return VERR_INVALID_HANDLE;
4174	}
4175	pImage = pUsage->pImage;
4176	if (pImage->uState != SUP_IOCTL_LDR_LOAD)
4177	{
4178	unsigned uState = pImage->uState;
4179	RTSemFastMutexRelease(pDevExt->mtxLdr);
4180	Log(("SUP_IOCTL_LDR_GET_SYMBOL: invalid image state %d (%#x)!\n", uState, uState)); NOREF(uState);
4181	return VERR_ALREADY_LOADED;
4182	}
4183
4184	/*
4185	* Search the symbol strings.
4186	*/
4187	pchStrings = (const char )((uint8_t )pImage->pvImage + pImage->offStrTab);
4188	paSyms = (PSUPLDRSYM)((uint8_t *)pImage->pvImage + pImage->offSymbols);
4189	for (i = 0; i < pImage->cSymbols; i++)
4190	{
4191	if ( paSyms[i].offSymbol < pImage->cbImage /* paranoia */
4192	&& paSyms[i].offName + cbSymbol <= pImage->cbStrTab
4193	&& !memcmp(pchStrings + paSyms[i].offName, pReq->u.In.szSymbol, cbSymbol))
4194	{
4195	pvSymbol = (uint8_t *)pImage->pvImage + paSyms[i].offSymbol;
4196	rc = VINF_SUCCESS;
4197	break;
4198	}
4199	}
4200	RTSemFastMutexRelease(pDevExt->mtxLdr);
4201	pReq->u.Out.pvSymbol = pvSymbol;
4202	return rc;
4203	}
4204
4205
4206	/**
4207	* Gets the address of a symbol in an open image or the support driver.
4208	*
4209	* @returns VINF_SUCCESS on success.
4210	* @returns
4211	* @param pDevExt Device globals.
4212	* @param pSession Session data.
4213	* @param pReq The request buffer.
4214	*/
4215	static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq)
4216	{
4217	int rc = VINF_SUCCESS;
4218	const char *pszSymbol = pReq->u.In.pszSymbol;
4219	const char *pszModule = pReq->u.In.pszModule;
4220	size_t cbSymbol;
4221	char const *pszEnd;
4222	uint32_t i;
4223
4224	/*
4225	* Input validation.
4226	*/
4227	AssertPtrReturn(pszSymbol, VERR_INVALID_POINTER);
4228	pszEnd = (char *)memchr(pszSymbol, '\0', 512);
4229	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4230	cbSymbol = pszEnd - pszSymbol + 1;
4231
4232	if (pszModule)
4233	{
4234	AssertPtrReturn(pszModule, VERR_INVALID_POINTER);
4235	pszEnd = (char *)memchr(pszModule, '\0', 64);
4236	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4237	}
4238	Log3(("supdrvIDC_LdrGetSymbol: pszModule=%p:{%s} pszSymbol=%p:{%s}\n", pszModule, pszModule, pszSymbol, pszSymbol));
4239
4240
4241	if ( !pszModule
4242	\|\| !strcmp(pszModule, "SupDrv"))
4243	{
4244	/*
4245	* Search the support driver export table.
4246	*/
4247	for (i = 0; i < RT_ELEMENTS(g_aFunctions); i++)
4248	if (!strcmp(g_aFunctions[i].szName, pszSymbol))
4249	{
4250	pReq->u.Out.pfnSymbol = g_aFunctions[i].pfn;
4251	break;
4252	}
4253	}
4254	else
4255	{
4256	/*
4257	* Find the loader image.
4258	*/
4259	PSUPDRVLDRIMAGE pImage;
4260
4261	RTSemFastMutexRequest(pDevExt->mtxLdr);
4262
4263	for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
4264	if (!strcmp(pImage->szName, pszModule))
4265	break;
4266	if (pImage && pImage->uState == SUP_IOCTL_LDR_LOAD)
4267	{
4268	/*
4269	* Search the symbol strings.
4270	*/
4271	const char pchStrings = (const char )((uint8_t *)pImage->pvImage + pImage->offStrTab);
4272	PCSUPLDRSYM paSyms = (PCSUPLDRSYM)((uint8_t *)pImage->pvImage + pImage->offSymbols);
4273	for (i = 0; i < pImage->cSymbols; i++)
4274	{
4275	if ( paSyms[i].offSymbol < pImage->cbImage /* paranoia */
4276	&& paSyms[i].offName + cbSymbol <= pImage->cbStrTab
4277	&& !memcmp(pchStrings + paSyms[i].offName, pszSymbol, cbSymbol))
4278	{
4279	/*
4280	* Found it! Calc the symbol address and add a reference to the module.
4281	*/
4282	pReq->u.Out.pfnSymbol = (PFNRT)((uint8_t *)pImage->pvImage + paSyms[i].offSymbol);
4283	rc = supdrvLdrAddUsage(pSession, pImage);
4284	break;
4285	}
4286	}
4287	}
4288	else
4289	rc = pImage ? VERR_WRONG_ORDER : VERR_MODULE_NOT_FOUND;
4290
4291	RTSemFastMutexRelease(pDevExt->mtxLdr);
4292	}
4293	return rc;
4294	}
4295
4296
4297	/**
4298	* Updates the VMMR0 entry point pointers.
4299	*
4300	* @returns IPRT status code.
4301	* @param pDevExt Device globals.
4302	* @param pSession Session data.
4303	* @param pVMMR0 VMMR0 image handle.
4304	* @param pvVMMR0EntryInt VMMR0EntryInt address.
4305	* @param pvVMMR0EntryFast VMMR0EntryFast address.
4306	* @param pvVMMR0EntryEx VMMR0EntryEx address.
4307	* @remark Caller must own the loader mutex.
4308	*/
4309	static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0EntryInt, void pvVMMR0EntryFast, void pvVMMR0EntryEx)
4310	{
4311	int rc = VINF_SUCCESS;
4312	LogFlow(("supdrvLdrSetR0EP pvVMMR0=%p pvVMMR0EntryInt=%p\n", pvVMMR0, pvVMMR0EntryInt));
4313
4314
4315	/*
4316	* Check if not yet set.
4317	*/
4318	if (!pDevExt->pvVMMR0)
4319	{
4320	pDevExt->pvVMMR0 = pvVMMR0;
4321	pDevExt->pfnVMMR0EntryInt = pvVMMR0EntryInt;
4322	pDevExt->pfnVMMR0EntryFast = pvVMMR0EntryFast;
4323	pDevExt->pfnVMMR0EntryEx = pvVMMR0EntryEx;
4324	}
4325	else
4326	{
4327	/*
4328	* Return failure or success depending on whether the values match or not.
4329	*/
4330	if ( pDevExt->pvVMMR0 != pvVMMR0
4331	\|\| (void *)pDevExt->pfnVMMR0EntryInt != pvVMMR0EntryInt
4332	\|\| (void *)pDevExt->pfnVMMR0EntryFast != pvVMMR0EntryFast
4333	\|\| (void *)pDevExt->pfnVMMR0EntryEx != pvVMMR0EntryEx)
4334	{
4335	AssertMsgFailed(("SUP_IOCTL_LDR_SETR0EP: Already set pointing to a different module!\n"));
4336	rc = VERR_INVALID_PARAMETER;
4337	}
4338	}
4339	return rc;
4340	}
4341
4342
4343	/**
4344	* Unsets the VMMR0 entry point installed by supdrvLdrSetR0EP.
4345	*
4346	* @param pDevExt Device globals.
4347	*/
4348	static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt)
4349	{
4350	pDevExt->pvVMMR0 = NULL;
4351	pDevExt->pfnVMMR0EntryInt = NULL;
4352	pDevExt->pfnVMMR0EntryFast = NULL;
4353	pDevExt->pfnVMMR0EntryEx = NULL;
4354	}
4355
4356
4357	/**
4358	* Adds a usage reference in the specified session of an image.
4359	*
4360	* Called while owning the loader semaphore.
4361	*
4362	* @returns VINF_SUCCESS on success and VERR_NO_MEMORY on failure.
4363	* @param pSession Session in question.
4364	* @param pImage Image which the session is using.
4365	*/
4366	static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage)
4367	{
4368	PSUPDRVLDRUSAGE pUsage;
4369	LogFlow(("supdrvLdrAddUsage: pImage=%p\n", pImage));
4370
4371	/*
4372	* Referenced it already?
4373	*/
4374	pUsage = pSession->pLdrUsage;
4375	while (pUsage)
4376	{
4377	if (pUsage->pImage == pImage)
4378	{
4379	pUsage->cUsage++;
4380	return VINF_SUCCESS;
4381	}
4382	pUsage = pUsage->pNext;
4383	}
4384
4385	/*
4386	* Allocate new usage record.
4387	*/
4388	pUsage = (PSUPDRVLDRUSAGE)RTMemAlloc(sizeof(*pUsage));
4389	AssertReturn(pUsage, VERR_NO_MEMORY);
4390	pUsage->cUsage = 1;
4391	pUsage->pImage = pImage;
4392	pUsage->pNext = pSession->pLdrUsage;
4393	pSession->pLdrUsage = pUsage;
4394	return VINF_SUCCESS;
4395	}
4396
4397
4398	/**
4399	* Frees a load image.
4400	*
4401	* @param pDevExt Pointer to device extension.
4402	* @param pImage Pointer to the image we're gonna free.
4403	* This image must exit!
4404	* @remark The caller MUST own SUPDRVDEVEXT::mtxLdr!
4405	*/
4406	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage)
4407	{
4408	PSUPDRVLDRIMAGE pImagePrev;
4409	LogFlow(("supdrvLdrFree: pImage=%p\n", pImage));
4410
4411	/* find it - arg. should've used doubly linked list. */
4412	Assert(pDevExt->pLdrImages);
4413	pImagePrev = NULL;
4414	if (pDevExt->pLdrImages != pImage)
4415	{
4416	pImagePrev = pDevExt->pLdrImages;
4417	while (pImagePrev->pNext != pImage)
4418	pImagePrev = pImagePrev->pNext;
4419	Assert(pImagePrev->pNext == pImage);
4420	}
4421
4422	/* unlink */
4423	if (pImagePrev)
4424	pImagePrev->pNext = pImage->pNext;
4425	else
4426	pDevExt->pLdrImages = pImage->pNext;
4427
4428	/* check if this is VMMR0.r0 unset its entry point pointers. */
4429	if (pDevExt->pvVMMR0 == pImage->pvImage)
4430	supdrvLdrUnsetVMMR0EPs(pDevExt);
4431
4432	/* check for objects with destructors in this image. (Shouldn't happen.) */
4433	if (pDevExt->pObjs)
4434	{
4435	unsigned cObjs = 0;
4436	PSUPDRVOBJ pObj;
4437	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
4438	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
4439	for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
4440	if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImage))
4441	{
4442	pObj->pfnDestructor = NULL;
4443	cObjs++;
4444	}
4445	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
4446	if (cObjs)
4447	OSDBGPRINT(("supdrvLdrFree: Image '%s' has %d dangling objects!\n", pImage->szName, cObjs));
4448	}
4449
4450	/* call termination function if fully loaded. */
4451	if ( pImage->pfnModuleTerm
4452	&& pImage->uState == SUP_IOCTL_LDR_LOAD)
4453	{
4454	LogFlow(("supdrvIOCtl_LdrLoad: calling pfnModuleTerm=%p\n", pImage->pfnModuleTerm));
4455	#ifdef RT_WITH_W64_UNWIND_HACK
4456	supdrvNtWrapModuleTerm(pImage->pfnModuleTerm);
4457	#else
4458	pImage->pfnModuleTerm();
4459	#endif
4460	}
4461
4462	/* free the image */
4463	pImage->cUsage = 0;
4464	pImage->pNext = 0;
4465	pImage->uState = SUP_IOCTL_LDR_FREE;
4466	RTMemExecFree(pImage);
4467	}
4468
4469
4470	/**
4471	* Implements the service call request.
4472	*
4473	* @returns VBox status code.
4474	* @param pDevExt The device extension.
4475	* @param pSession The calling session.
4476	* @param pReq The request packet, valid.
4477	*/
4478	static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq)
4479	{
4480	#if !defined(RT_OS_WINDOWS) \|\| defined(DEBUG)
4481	int rc;
4482
4483	/*
4484	* Find the module first in the module referenced by the calling session.
4485	*/
4486	rc = RTSemFastMutexRequest(pDevExt->mtxLdr);
4487	if (RT_SUCCESS(rc))
4488	{
4489	PFNSUPR0SERVICEREQHANDLER pfnServiceReqHandler = NULL;
4490	PSUPDRVLDRUSAGE pUsage;
4491
4492	for (pUsage = pSession->pLdrUsage; pUsage; pUsage = pUsage->pNext)
4493	if ( pUsage->pImage->pfnServiceReqHandler
4494	&& !strcmp(pUsage->pImage->szName, pReq->u.In.szName))
4495	{
4496	pfnServiceReqHandler = pUsage->pImage->pfnServiceReqHandler;
4497	break;
4498	}
4499	RTSemFastMutexRelease(pDevExt->mtxLdr);
4500
4501	if (pfnServiceReqHandler)
4502	{
4503	/*
4504	* Call it.
4505	*/
4506	if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
4507	#ifdef RT_WITH_W64_UNWIND_HACK
4508	rc = supdrvNtWrapServiceReqHandler((PFNRT)pfnServiceReqHandler, pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, NULL);
4509	#else
4510	rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, NULL);
4511	#endif
4512	else
4513	#ifdef RT_WITH_W64_UNWIND_HACK
4514	rc = supdrvNtWrapServiceReqHandler((PFNRT)pfnServiceReqHandler, pSession, pReq->u.In.uOperation,
4515	pReq->u.In.u64Arg, (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0]);
4516	#else
4517	rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0]);
4518	#endif
4519	}
4520	else
4521	rc = VERR_SUPDRV_SERVICE_NOT_FOUND;
4522	}
4523
4524	/* log it */
4525	if ( RT_FAILURE(rc)
4526	&& rc != VERR_INTERRUPTED
4527	&& rc != VERR_TIMEOUT)
4528	Log(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
4529	rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
4530	else
4531	Log4(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
4532	rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
4533	return rc;
4534	#else /* RT_OS_WINDOWS && !DEBUG */
4535	return VERR_NOT_IMPLEMENTED;
4536	#endif /* RT_OS_WINDOWS && !DEBUG */
4537	}
4538
4539
4540	/**
4541	* Implements the logger settings request.
4542	*
4543	* @returns VBox status code.
4544	* @param pDevExt The device extension.
4545	* @param pSession The caller's session.
4546	* @param pReq The request.
4547	*/
4548	static int supdrvIOCtl_LoggerSettings(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLOGGERSETTINGS pReq)
4549	{
4550	const char *pszGroup = &pReq->u.In.szStrings[pReq->u.In.offGroups];
4551	const char *pszFlags = &pReq->u.In.szStrings[pReq->u.In.offFlags];
4552	const char *pszDest = &pReq->u.In.szStrings[pReq->u.In.offDestination];
4553	PRTLOGGER pLogger = NULL;
4554	int rc;
4555
4556	/*
4557	* Some further validation.
4558	*/
4559	switch (pReq->u.In.fWhat)
4560	{
4561	case SUPLOGGERSETTINGS_WHAT_SETTINGS:
4562	case SUPLOGGERSETTINGS_WHAT_CREATE:
4563	break;
4564
4565	case SUPLOGGERSETTINGS_WHAT_DESTROY:
4566	if (pszGroup \|\| pszFlags \|\| *pszDest)
4567	return VERR_INVALID_PARAMETER;
4568	if (pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_RELEASE)
4569	return VERR_ACCESS_DENIED;
4570	break;
4571
4572	default:
4573	return VERR_INTERNAL_ERROR;
4574	}
4575
4576	/*
4577	* Get the logger.
4578	*/
4579	switch (pReq->u.In.fWhich)
4580	{
4581	case SUPLOGGERSETTINGS_WHICH_DEBUG:
4582	pLogger = RTLogGetDefaultInstance();
4583	break;
4584
4585	case SUPLOGGERSETTINGS_WHICH_RELEASE:
4586	pLogger = RTLogRelDefaultInstance();
4587	break;
4588
4589	default:
4590	return VERR_INTERNAL_ERROR;
4591	}
4592
4593	/*
4594	* Do the job.
4595	*/
4596	switch (pReq->u.In.fWhat)
4597	{
4598	case SUPLOGGERSETTINGS_WHAT_SETTINGS:
4599	if (pLogger)
4600	{
4601	rc = RTLogFlags(pLogger, pszFlags);
4602	if (RT_SUCCESS(rc))
4603	rc = RTLogGroupSettings(pLogger, pszGroup);
4604	NOREF(pszDest);
4605	}
4606	else
4607	rc = VERR_NOT_FOUND;
4608	break;
4609
4610	case SUPLOGGERSETTINGS_WHAT_CREATE:
4611	{
4612	if (pLogger)
4613	rc = VERR_ALREADY_EXISTS;
4614	else
4615	{
4616	static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
4617
4618	rc = RTLogCreate(&pLogger,
4619	0 /* fFlags */,
4620	pszGroup,
4621	pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_DEBUG
4622	? "VBOX_LOG"
4623	: "VBOX_RELEASE_LOG",
4624	RT_ELEMENTS(s_apszGroups),
4625	s_apszGroups,
4626	RTLOGDEST_STDOUT \| RTLOGDEST_DEBUGGER,
4627	NULL);
4628	if (RT_SUCCESS(rc))
4629	{
4630	rc = RTLogFlags(pLogger, pszFlags);
4631	NOREF(pszDest);
4632	if (RT_SUCCESS(rc))
4633	{
4634	switch (pReq->u.In.fWhich)
4635	{
4636	case SUPLOGGERSETTINGS_WHICH_DEBUG:
4637	pLogger = RTLogSetDefaultInstance(pLogger);
4638	break;
4639	case SUPLOGGERSETTINGS_WHICH_RELEASE:
4640	pLogger = RTLogRelSetDefaultInstance(pLogger);
4641	break;
4642	}
4643	}
4644	RTLogDestroy(pLogger);
4645	}
4646	}
4647	break;
4648	}
4649
4650	case SUPLOGGERSETTINGS_WHAT_DESTROY:
4651	switch (pReq->u.In.fWhich)
4652	{
4653	case SUPLOGGERSETTINGS_WHICH_DEBUG:
4654	pLogger = RTLogSetDefaultInstance(NULL);
4655	break;
4656	case SUPLOGGERSETTINGS_WHICH_RELEASE:
4657	pLogger = RTLogRelSetDefaultInstance(NULL);
4658	break;
4659	}
4660	rc = RTLogDestroy(pLogger);
4661	break;
4662
4663	default:
4664	{
4665	rc = VERR_INTERNAL_ERROR;
4666	break;
4667	}
4668	}
4669
4670	return rc;
4671	}
4672
4673
4674	/**
4675	* Gets the paging mode of the current CPU.
4676	*
4677	* @returns Paging mode, SUPPAGEINGMODE_INVALID on error.
4678	*/
4679	SUPR0DECL(SUPPAGINGMODE) SUPR0GetPagingMode(void)
4680	{
4681	SUPPAGINGMODE enmMode;
4682
4683	RTR0UINTREG cr0 = ASMGetCR0();
4684	if ((cr0 & (X86_CR0_PG \| X86_CR0_PE)) != (X86_CR0_PG \| X86_CR0_PE))
4685	enmMode = SUPPAGINGMODE_INVALID;
4686	else
4687	{
4688	RTR0UINTREG cr4 = ASMGetCR4();
4689	uint32_t fNXEPlusLMA = 0;
4690	if (cr4 & X86_CR4_PAE)
4691	{
4692	uint32_t fAmdFeatures = ASMCpuId_EDX(0x80000001);
4693	if (fAmdFeatures & (X86_CPUID_AMD_FEATURE_EDX_NX \| X86_CPUID_AMD_FEATURE_EDX_LONG_MODE))
4694	{
4695	uint64_t efer = ASMRdMsr(MSR_K6_EFER);
4696	if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_NX) && (efer & MSR_K6_EFER_NXE))
4697	fNXEPlusLMA \|= RT_BIT(0);
4698	if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE) && (efer & MSR_K6_EFER_LMA))
4699	fNXEPlusLMA \|= RT_BIT(1);
4700	}
4701	}
4702
4703	switch ((cr4 & (X86_CR4_PAE \| X86_CR4_PGE)) \| fNXEPlusLMA)
4704	{
4705	case 0:
4706	enmMode = SUPPAGINGMODE_32_BIT;
4707	break;
4708
4709	case X86_CR4_PGE:
4710	enmMode = SUPPAGINGMODE_32_BIT_GLOBAL;
4711	break;
4712
4713	case X86_CR4_PAE:
4714	enmMode = SUPPAGINGMODE_PAE;
4715	break;
4716
4717	case X86_CR4_PAE \| RT_BIT(0):
4718	enmMode = SUPPAGINGMODE_PAE_NX;
4719	break;
4720
4721	case X86_CR4_PAE \| X86_CR4_PGE:
4722	enmMode = SUPPAGINGMODE_PAE_GLOBAL;
4723	break;
4724
4725	case X86_CR4_PAE \| X86_CR4_PGE \| RT_BIT(0):
4726	enmMode = SUPPAGINGMODE_PAE_GLOBAL;
4727	break;
4728
4729	case RT_BIT(1) \| X86_CR4_PAE:
4730	enmMode = SUPPAGINGMODE_AMD64;
4731	break;
4732
4733	case RT_BIT(1) \| X86_CR4_PAE \| RT_BIT(0):
4734	enmMode = SUPPAGINGMODE_AMD64_NX;
4735	break;
4736
4737	case RT_BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE:
4738	enmMode = SUPPAGINGMODE_AMD64_GLOBAL;
4739	break;
4740
4741	case RT_BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE \| RT_BIT(0):
4742	enmMode = SUPPAGINGMODE_AMD64_GLOBAL_NX;
4743	break;
4744
4745	default:
4746	AssertMsgFailed(("Cannot happen! cr4=%#x fNXEPlusLMA=%d\n", cr4, fNXEPlusLMA));
4747	enmMode = SUPPAGINGMODE_INVALID;
4748	break;
4749	}
4750	}
4751	return enmMode;
4752	}
4753
4754
4755	/**
4756	* Enables or disabled hardware virtualization extensions using native OS APIs.
4757	*
4758	* @returns VBox status code.
4759	* @retval VINF_SUCCESS on success.
4760	* @retval VERR_NOT_SUPPORTED if not supported by the native OS.
4761	*
4762	* @param fEnable Whether to enable or disable.
4763	*/
4764	SUPR0DECL(int) SUPR0EnableVTx(bool fEnable)
4765	{
4766	#ifdef RT_OS_DARWIN
4767	return supdrvOSEnableVTx(fEnable);
4768	#else
4769	return VERR_NOT_SUPPORTED;
4770	#endif
4771	}
4772
4773
4774	/**
4775	* Creates the GIP.
4776	*
4777	* @returns VBox status code.
4778	* @param pDevExt Instance data. GIP stuff may be updated.
4779	*/
4780	static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt)
4781	{
4782	PSUPGLOBALINFOPAGE pGip;
4783	RTHCPHYS HCPhysGip;
4784	uint32_t u32SystemResolution;
4785	uint32_t u32Interval;
4786	int rc;
4787
4788	LogFlow(("supdrvGipCreate:\n"));
4789
4790	/* assert order */
4791	Assert(pDevExt->u32SystemTimerGranularityGrant == 0);
4792	Assert(pDevExt->GipMemObj == NIL_RTR0MEMOBJ);
4793	Assert(!pDevExt->pGipTimer);
4794
4795	/*
4796	* Allocate a suitable page with a default kernel mapping.
4797	*/
4798	rc = RTR0MemObjAllocLow(&pDevExt->GipMemObj, PAGE_SIZE, false);
4799	if (RT_FAILURE(rc))
4800	{
4801	OSDBGPRINT(("supdrvGipCreate: failed to allocate the GIP page. rc=%d\n", rc));
4802	return rc;
4803	}
4804	pGip = (PSUPGLOBALINFOPAGE)RTR0MemObjAddress(pDevExt->GipMemObj); AssertPtr(pGip);
4805	HCPhysGip = RTR0MemObjGetPagePhysAddr(pDevExt->GipMemObj, 0); Assert(HCPhysGip != NIL_RTHCPHYS);
4806
4807	#if 0 /** @todo Disabled this as we didn't used to do it before and causes unnecessary stress on laptops.
4808	* It only applies to Windows and should probably revisited later, if possible made part of the
4809	* timer code (return min granularity in RTTimerGetSystemGranularity and set it in RTTimerStart). */
4810	/*
4811	* Try bump up the system timer resolution.
4812	* The more interrupts the better...
4813	*/
4814	if ( RT_SUCCESS(RTTimerRequestSystemGranularity( 488281 /* 2048 HZ */, &u32SystemResolution))
4815	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 500000 /* 2000 HZ */, &u32SystemResolution))
4816	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 976563 /* 1024 HZ */, &u32SystemResolution))
4817	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 1000000 /* 1000 HZ */, &u32SystemResolution))
4818	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 1953125 /* 512 HZ */, &u32SystemResolution))
4819	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 2000000 /* 500 HZ */, &u32SystemResolution))
4820	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 3906250 /* 256 HZ */, &u32SystemResolution))
4821	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 4000000 /* 250 HZ */, &u32SystemResolution))
4822	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 7812500 /* 128 HZ */, &u32SystemResolution))
4823	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(10000000 /* 100 HZ */, &u32SystemResolution))
4824	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(15625000 /* 64 HZ */, &u32SystemResolution))
4825	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(31250000 /* 32 HZ */, &u32SystemResolution))
4826	)
4827	{
4828	Assert(RTTimerGetSystemGranularity() <= u32SystemResolution);
4829	pDevExt->u32SystemTimerGranularityGrant = u32SystemResolution;
4830	}
4831	#endif
4832
4833	/*
4834	* Find a reasonable update interval and initialize the structure.
4835	*/
4836	u32Interval = u32SystemResolution = RTTimerGetSystemGranularity();
4837	while (u32Interval < 10000000 /* 10 ms */)
4838	u32Interval += u32SystemResolution;
4839
4840	supdrvGipInit(pDevExt, pGip, HCPhysGip, RTTimeSystemNanoTS(), 1000000000 / u32Interval /=Hz/);
4841
4842	/*
4843	* Create the timer.
4844	* If CPU_ALL isn't supported we'll have to fall back to synchronous mode.
4845	*/
4846	if (pGip->u32Mode == SUPGIPMODE_ASYNC_TSC)
4847	{
4848	rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, RTTIMER_FLAGS_CPU_ALL, supdrvGipAsyncTimer, pDevExt);
4849	if (rc == VERR_NOT_SUPPORTED)
4850	{
4851	OSDBGPRINT(("supdrvGipCreate: omni timer not supported, falling back to synchronous mode\n"));
4852	pGip->u32Mode = SUPGIPMODE_SYNC_TSC;
4853	}
4854	}
4855	if (pGip->u32Mode != SUPGIPMODE_ASYNC_TSC)
4856	rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, 0, supdrvGipSyncTimer, pDevExt);
4857	if (RT_SUCCESS(rc))
4858	{
4859	if (pGip->u32Mode == SUPGIPMODE_ASYNC_TSC)
4860	rc = RTMpNotificationRegister(supdrvGipMpEvent, pDevExt);
4861	if (RT_SUCCESS(rc))
4862	{
4863	/*
4864	* We're good.
4865	*/
4866	dprintf(("supdrvGipCreate: %ld ns interval.\n", (long)u32Interval));
4867	return VINF_SUCCESS;
4868	}
4869
4870	OSDBGPRINT(("supdrvGipCreate: failed register MP event notfication. rc=%d\n", rc));
4871	}
4872	else
4873	{
4874	OSDBGPRINT(("supdrvGipCreate: failed create GIP timer at %ld ns interval. rc=%d\n", (long)u32Interval, rc));
4875	Assert(!pDevExt->pGipTimer);
4876	}
4877	supdrvGipDestroy(pDevExt);
4878	return rc;
4879	}
4880
4881
4882	/**
4883	* Terminates the GIP.
4884	*
4885	* @param pDevExt Instance data. GIP stuff may be updated.
4886	*/
4887	static void supdrvGipDestroy(PSUPDRVDEVEXT pDevExt)
4888	{
4889	int rc;
4890	#ifdef DEBUG_DARWIN_GIP
4891	OSDBGPRINT(("supdrvGipDestroy: pDevExt=%p pGip=%p pGipTimer=%p GipMemObj=%p\n", pDevExt,
4892	pDevExt->GipMemObj != NIL_RTR0MEMOBJ ? RTR0MemObjAddress(pDevExt->GipMemObj) : NULL,
4893	pDevExt->pGipTimer, pDevExt->GipMemObj));
4894	#endif
4895
4896	/*
4897	* Invalid the GIP data.
4898	*/
4899	if (pDevExt->pGip)
4900	{
4901	supdrvGipTerm(pDevExt->pGip);
4902	pDevExt->pGip = NULL;
4903	}
4904
4905	/*
4906	* Destroy the timer and free the GIP memory object.
4907	*/
4908	if (pDevExt->pGipTimer)
4909	{
4910	rc = RTTimerDestroy(pDevExt->pGipTimer); AssertRC(rc);
4911	pDevExt->pGipTimer = NULL;
4912	}
4913
4914	if (pDevExt->GipMemObj != NIL_RTR0MEMOBJ)
4915	{
4916	rc = RTR0MemObjFree(pDevExt->GipMemObj, true /* free mappings */); AssertRC(rc);
4917	pDevExt->GipMemObj = NIL_RTR0MEMOBJ;
4918	}
4919
4920	/*
4921	* Finally, release the system timer resolution request if one succeeded.
4922	*/
4923	if (pDevExt->u32SystemTimerGranularityGrant)
4924	{
4925	rc = RTTimerReleaseSystemGranularity(pDevExt->u32SystemTimerGranularityGrant); AssertRC(rc);
4926	pDevExt->u32SystemTimerGranularityGrant = 0;
4927	}
4928	}
4929
4930
4931	/**
4932	* Timer callback function sync GIP mode.
4933	* @param pTimer The timer.
4934	* @param pvUser The device extension.
4935	*/
4936	static DECLCALLBACK(void) supdrvGipSyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick)
4937	{
4938	RTCCUINTREG fOldFlags = ASMIntDisableFlags(); /* No interruptions please (real problem on S10). */
4939	PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
4940
4941	supdrvGipUpdate(pDevExt->pGip, RTTimeSystemNanoTS());
4942
4943	ASMSetFlags(fOldFlags);
4944	}
4945
4946
4947	/**
4948	* Timer callback function for async GIP mode.
4949	* @param pTimer The timer.
4950	* @param pvUser The device extension.
4951	*/
4952	static DECLCALLBACK(void) supdrvGipAsyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick)
4953	{
4954	RTCCUINTREG fOldFlags = ASMIntDisableFlags(); /* No interruptions please (real problem on S10). */
4955	PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
4956	RTCPUID idCpu = RTMpCpuId();
4957	uint64_t NanoTS = RTTimeSystemNanoTS();
4958
4959	/** @todo reset the transaction number and whatnot when iTick == 1. */
4960	if (pDevExt->idGipMaster == idCpu)
4961	supdrvGipUpdate(pDevExt->pGip, NanoTS);
4962	else
4963	supdrvGipUpdatePerCpu(pDevExt->pGip, NanoTS, ASMGetApicId());
4964
4965	ASMSetFlags(fOldFlags);
4966	}
4967
4968
4969	/**
4970	* Multiprocessor event notification callback.
4971	*
4972	* This is used to make sue that the GIP master gets passed on to
4973	* another CPU.
4974	*
4975	* @param enmEvent The event.
4976	* @param idCpu The cpu it applies to.
4977	* @param pvUser Pointer to the device extension.
4978	*/
4979	static DECLCALLBACK(void) supdrvGipMpEvent(RTMPEVENT enmEvent, RTCPUID idCpu, void *pvUser)
4980	{
4981	PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
4982	if (enmEvent == RTMPEVENT_OFFLINE)
4983	{
4984	RTCPUID idGipMaster;
4985	ASMAtomicReadSize(&pDevExt->idGipMaster, &idGipMaster);
4986	if (idGipMaster == idCpu)
4987	{
4988	/*
4989	* Find a new GIP master.
4990	*/
4991	bool fIgnored;
4992	unsigned i;
4993	RTCPUID idNewGipMaster = NIL_RTCPUID;
4994	RTCPUSET OnlineCpus;
4995	RTMpGetOnlineSet(&OnlineCpus);
4996
4997	for (i = 0; i < RTCPUSET_MAX_CPUS; i++)
4998	{
4999	RTCPUID idCurCpu = RTMpCpuIdFromSetIndex(i);
5000	if ( RTCpuSetIsMember(&OnlineCpus, idCurCpu)
5001	&& idCurCpu != idGipMaster)
5002	{
5003	idNewGipMaster = idCurCpu;
5004	break;
5005	}
5006	}
5007
5008	dprintf(("supdrvGipMpEvent: Gip master %#lx -> %#lx\n", (long)idGipMaster, (long)idNewGipMaster));
5009	ASMAtomicCmpXchgSize(&pDevExt->idGipMaster, idNewGipMaster, idGipMaster, fIgnored);
5010	NOREF(fIgnored);
5011	}
5012	}
5013	}
5014
5015
5016	/**
5017	* Initializes the GIP data.
5018	*
5019	* @returns IPRT status code.
5020	* @param pDevExt Pointer to the device instance data.
5021	* @param pGip Pointer to the read-write kernel mapping of the GIP.
5022	* @param HCPhys The physical address of the GIP.
5023	* @param u64NanoTS The current nanosecond timestamp.
5024	* @param uUpdateHz The update freqence.
5025	*/
5026	int VBOXCALL supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys, uint64_t u64NanoTS, unsigned uUpdateHz)
5027	{
5028	unsigned i;
5029	#ifdef DEBUG_DARWIN_GIP
5030	OSDBGPRINT(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
5031	#else
5032	LogFlow(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
5033	#endif
5034
5035	/*
5036	* Initialize the structure.
5037	*/
5038	memset(pGip, 0, PAGE_SIZE);
5039	pGip->u32Magic = SUPGLOBALINFOPAGE_MAGIC;
5040	pGip->u32Version = SUPGLOBALINFOPAGE_VERSION;
5041	pGip->u32Mode = supdrvGipDeterminTscMode(pDevExt);
5042	pGip->u32UpdateHz = uUpdateHz;
5043	pGip->u32UpdateIntervalNS = 1000000000 / uUpdateHz;
5044	pGip->u64NanoTSLastUpdateHz = u64NanoTS;
5045
5046	for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
5047	{
5048	pGip->aCPUs[i].u32TransactionId = 2;
5049	pGip->aCPUs[i].u64NanoTS = u64NanoTS;
5050	pGip->aCPUs[i].u64TSC = ASMReadTSC();
5051
5052	/*
5053	* We don't know the following values until we've executed updates.
5054	* So, we'll just insert very high values.
5055	*/
5056	pGip->aCPUs[i].u64CpuHz = _4G + 1;
5057	pGip->aCPUs[i].u32UpdateIntervalTSC = _2G / 4;
5058	pGip->aCPUs[i].au32TSCHistory[0] = _2G / 4;
5059	pGip->aCPUs[i].au32TSCHistory[1] = _2G / 4;
5060	pGip->aCPUs[i].au32TSCHistory[2] = _2G / 4;
5061	pGip->aCPUs[i].au32TSCHistory[3] = _2G / 4;
5062	pGip->aCPUs[i].au32TSCHistory[4] = _2G / 4;
5063	pGip->aCPUs[i].au32TSCHistory[5] = _2G / 4;
5064	pGip->aCPUs[i].au32TSCHistory[6] = _2G / 4;
5065	pGip->aCPUs[i].au32TSCHistory[7] = _2G / 4;
5066	}
5067
5068	/*
5069	* Link it to the device extension.
5070	*/
5071	pDevExt->pGip = pGip;
5072	pDevExt->HCPhysGip = HCPhys;
5073	pDevExt->cGipUsers = 0;
5074
5075	return VINF_SUCCESS;
5076	}
5077
5078
5079	/**
5080	* Callback used by supdrvDetermineAsyncTSC to read the TSC on a CPU.
5081	*
5082	* @param idCpu Ignored.
5083	* @param pvUser1 Where to put the TSC.
5084	* @param pvUser2 Ignored.
5085	*/
5086	static DECLCALLBACK(void) supdrvDetermineAsyncTscWorker(RTCPUID idCpu, void pvUser1, void pvUser2)
5087	{
5088	#if 1
5089	ASMAtomicWriteU64((uint64_t volatile *)pvUser1, ASMReadTSC());
5090	#else
5091	(uint64_t )pvUser1 = ASMReadTSC();
5092	#endif
5093	}
5094
5095
5096	/**
5097	* Determine if Async GIP mode is required because of TSC drift.
5098	*
5099	* When using the default/normal timer code it is essential that the time stamp counter
5100	* (TSC) runs never backwards, that is, a read operation to the counter should return
5101	* a bigger value than any previous read operation. This is guaranteed by the latest
5102	* AMD CPUs and by newer Intel CPUs which never enter the C2 state (P4). In any other
5103	* case we have to choose the asynchronous timer mode.
5104	*
5105	* @param poffMin Pointer to the determined difference between different cores.
5106	* @return false if the time stamp counters appear to be synchron, true otherwise.
5107	*/
5108	bool VBOXCALL supdrvDetermineAsyncTsc(uint64_t *poffMin)
5109	{
5110	/*
5111	* Just iterate all the cpus 8 times and make sure that the TSC is
5112	* ever increasing. We don't bother taking TSC rollover into account.
5113	*/
5114	RTCPUSET CpuSet;
5115	int iLastCpu = RTCpuLastIndex(RTMpGetSet(&CpuSet));
5116	int iCpu;
5117	int cLoops = 8;
5118	bool fAsync = false;
5119	int rc = VINF_SUCCESS;
5120	uint64_t offMax = 0;
5121	uint64_t offMin = ~(uint64_t)0;
5122	uint64_t PrevTsc = ASMReadTSC();
5123
5124	while (cLoops-- > 0)
5125	{
5126	for (iCpu = 0; iCpu <= iLastCpu; iCpu++)
5127	{
5128	uint64_t CurTsc;
5129	rc = RTMpOnSpecific(RTMpCpuIdFromSetIndex(iCpu), supdrvDetermineAsyncTscWorker, &CurTsc, NULL);
5130	if (RT_SUCCESS(rc))
5131	{
5132	if (CurTsc <= PrevTsc)
5133	{
5134	fAsync = true;
5135	offMin = offMax = PrevTsc - CurTsc;
5136	dprintf(("supdrvDetermineAsyncTsc: iCpu=%d cLoops=%d CurTsc=%llx PrevTsc=%llx\n",
5137	iCpu, cLoops, CurTsc, PrevTsc));
5138	break;
5139	}
5140
5141	/* Gather statistics (except the first time). */
5142	if (iCpu != 0 \|\| cLoops != 7)
5143	{
5144	uint64_t off = CurTsc - PrevTsc;
5145	if (off < offMin)
5146	offMin = off;
5147	if (off > offMax)
5148	offMax = off;
5149	dprintf2(("%d/%d: off=%llx\n", cLoops, iCpu, off));
5150	}
5151
5152	/* Next */
5153	PrevTsc = CurTsc;
5154	}
5155	else if (rc == VERR_NOT_SUPPORTED)
5156	break;
5157	else
5158	AssertMsg(rc == VERR_CPU_NOT_FOUND \|\| rc == VERR_CPU_OFFLINE, ("%d\n", rc));
5159	}
5160
5161	/* broke out of the loop. */
5162	if (iCpu <= iLastCpu)
5163	break;
5164	}
5165
5166	poffMin = offMin; / Almost RTMpOnSpecific profiling. */
5167	dprintf(("supdrvDetermineAsyncTsc: returns %d; iLastCpu=%d rc=%d offMin=%llx offMax=%llx\n",
5168	fAsync, iLastCpu, rc, offMin, offMax));
5169	#if !defined(RT_OS_SOLARIS) && !defined(RT_OS_OS2) && !defined(RT_OS_WINDOWS)
5170	OSDBGPRINT(("vboxdrv: fAsync=%d offMin=%#lx offMax=%#lx\n", fAsync, (long)offMin, (long)offMax));
5171	#endif
5172	return fAsync;
5173	}
5174
5175
5176	/**
5177	* Determin the GIP TSC mode.
5178	*
5179	* @returns The most suitable TSC mode.
5180	* @param pDevExt Pointer to the device instance data.
5181	*/
5182	static SUPGIPMODE supdrvGipDeterminTscMode(PSUPDRVDEVEXT pDevExt)
5183	{
5184	/*
5185	* On SMP we're faced with two problems:
5186	* (1) There might be a skew between the CPU, so that cpu0
5187	* returns a TSC that is sligtly different from cpu1.
5188	* (2) Power management (and other things) may cause the TSC
5189	* to run at a non-constant speed, and cause the speed
5190	* to be different on the cpus. This will result in (1).
5191	*
5192	* So, on SMP systems we'll have to select the ASYNC update method
5193	* if there are symphoms of these problems.
5194	*/
5195	if (RTMpGetCount() > 1)
5196	{
5197	uint32_t uEAX, uEBX, uECX, uEDX;
5198	uint64_t u64DiffCoresIgnored;
5199
5200	/* Permit the user and/or the OS specfic bits to force async mode. */
5201	if (supdrvOSGetForcedAsyncTscMode(pDevExt))
5202	return SUPGIPMODE_ASYNC_TSC;
5203
5204	/* Try check for current differences between the cpus. */
5205	if (supdrvDetermineAsyncTsc(&u64DiffCoresIgnored))
5206	return SUPGIPMODE_ASYNC_TSC;
5207
5208	/*
5209	* If the CPU supports power management and is an AMD one we
5210	* won't trust it unless it has the TscInvariant bit is set.
5211	*/
5212	/* Check for "AuthenticAMD" */
5213	ASMCpuId(0, &uEAX, &uEBX, &uECX, &uEDX);
5214	if ( uEAX >= 1
5215	&& uEBX == X86_CPUID_VENDOR_AMD_EBX
5216	&& uECX == X86_CPUID_VENDOR_AMD_ECX
5217	&& uEDX == X86_CPUID_VENDOR_AMD_EDX)
5218	{
5219	/* Check for APM support and that TscInvariant is cleared. */
5220	ASMCpuId(0x80000000, &uEAX, &uEBX, &uECX, &uEDX);
5221	if (uEAX >= 0x80000007)
5222	{
5223	ASMCpuId(0x80000007, &uEAX, &uEBX, &uECX, &uEDX);
5224	if ( !(uEDX & RT_BIT(8))/* TscInvariant */
5225	&& (uEDX & 0x3e)) /* STC\|TM\|THERMTRIP\|VID\|FID. Ignore TS. */
5226	return SUPGIPMODE_ASYNC_TSC;
5227	}
5228	}
5229	}
5230	return SUPGIPMODE_SYNC_TSC;
5231	}
5232
5233
5234	/**
5235	* Invalidates the GIP data upon termination.
5236	*
5237	* @param pGip Pointer to the read-write kernel mapping of the GIP.
5238	*/
5239	void VBOXCALL supdrvGipTerm(PSUPGLOBALINFOPAGE pGip)
5240	{
5241	unsigned i;
5242	pGip->u32Magic = 0;
5243	for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
5244	{
5245	pGip->aCPUs[i].u64NanoTS = 0;
5246	pGip->aCPUs[i].u64TSC = 0;
5247	pGip->aCPUs[i].iTSCHistoryHead = 0;
5248	}
5249	}
5250
5251
5252	/**
5253	* Worker routine for supdrvGipUpdate and supdrvGipUpdatePerCpu that
5254	* updates all the per cpu data except the transaction id.
5255	*
5256	* @param pGip The GIP.
5257	* @param pGipCpu Pointer to the per cpu data.
5258	* @param u64NanoTS The current time stamp.
5259	*/
5260	static void supdrvGipDoUpdateCpu(PSUPGLOBALINFOPAGE pGip, PSUPGIPCPU pGipCpu, uint64_t u64NanoTS)
5261	{
5262	uint64_t u64TSC;
5263	uint64_t u64TSCDelta;
5264	uint32_t u32UpdateIntervalTSC;
5265	uint32_t u32UpdateIntervalTSCSlack;
5266	unsigned iTSCHistoryHead;
5267	uint64_t u64CpuHz;
5268
5269	/*
5270	* Update the NanoTS.
5271	*/
5272	ASMAtomicXchgU64(&pGipCpu->u64NanoTS, u64NanoTS);
5273
5274	/*
5275	* Calc TSC delta.
5276	*/
5277	/** @todo validate the NanoTS delta, don't trust the OS to call us when it should... */
5278	u64TSC = ASMReadTSC();
5279	u64TSCDelta = u64TSC - pGipCpu->u64TSC;
5280	ASMAtomicXchgU64(&pGipCpu->u64TSC, u64TSC);
5281
5282	if (u64TSCDelta >> 32)
5283	{
5284	u64TSCDelta = pGipCpu->u32UpdateIntervalTSC;
5285	pGipCpu->cErrors++;
5286	}
5287
5288	/*
5289	* TSC History.
5290	*/
5291	Assert(RT_ELEMENTS(pGipCpu->au32TSCHistory) == 8);
5292
5293	iTSCHistoryHead = (pGipCpu->iTSCHistoryHead + 1) & 7;
5294	ASMAtomicXchgU32(&pGipCpu->iTSCHistoryHead, iTSCHistoryHead);
5295	ASMAtomicXchgU32(&pGipCpu->au32TSCHistory[iTSCHistoryHead], (uint32_t)u64TSCDelta);
5296
5297	/*
5298	* UpdateIntervalTSC = average of last 8,2,1 intervals depending on update HZ.
5299	*/
5300	if (pGip->u32UpdateHz >= 1000)
5301	{
5302	uint32_t u32;
5303	u32 = pGipCpu->au32TSCHistory[0];
5304	u32 += pGipCpu->au32TSCHistory[1];
5305	u32 += pGipCpu->au32TSCHistory[2];
5306	u32 += pGipCpu->au32TSCHistory[3];
5307	u32 >>= 2;
5308	u32UpdateIntervalTSC = pGipCpu->au32TSCHistory[4];
5309	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[5];
5310	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[6];
5311	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[7];
5312	u32UpdateIntervalTSC >>= 2;
5313	u32UpdateIntervalTSC += u32;
5314	u32UpdateIntervalTSC >>= 1;
5315
5316	/* Value choosen for a 2GHz Athlon64 running linux 2.6.10/11, . */
5317	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 14;
5318	}
5319	else if (pGip->u32UpdateHz >= 90)
5320	{
5321	u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
5322	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[(iTSCHistoryHead - 1) & 7];
5323	u32UpdateIntervalTSC >>= 1;
5324
5325	/* value choosen on a 2GHz thinkpad running windows */
5326	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 7;
5327	}
5328	else
5329	{
5330	u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
5331
5332	/* This value hasn't be checked yet.. waiting for OS/2 and 33Hz timers.. :-) */
5333	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 6;
5334	}
5335	ASMAtomicXchgU32(&pGipCpu->u32UpdateIntervalTSC, u32UpdateIntervalTSC + u32UpdateIntervalTSCSlack);
5336
5337	/*
5338	* CpuHz.
5339	*/
5340	u64CpuHz = ASMMult2xU32RetU64(u32UpdateIntervalTSC, pGip->u32UpdateHz);
5341	ASMAtomicXchgU64(&pGipCpu->u64CpuHz, u64CpuHz);
5342	}
5343
5344
5345	/**
5346	* Updates the GIP.
5347	*
5348	* @param pGip Pointer to the GIP.
5349	* @param u64NanoTS The current nanosecond timesamp.
5350	*/
5351	void VBOXCALL supdrvGipUpdate(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS)
5352	{
5353	/*
5354	* Determin the relevant CPU data.
5355	*/
5356	PSUPGIPCPU pGipCpu;
5357	if (pGip->u32Mode != SUPGIPMODE_ASYNC_TSC)
5358	pGipCpu = &pGip->aCPUs[0];
5359	else
5360	{
5361	unsigned iCpu = ASMGetApicId();
5362	if (RT_LIKELY(iCpu >= RT_ELEMENTS(pGip->aCPUs)))
5363	return;
5364	pGipCpu = &pGip->aCPUs[iCpu];
5365	}
5366
5367	/*
5368	* Start update transaction.
5369	*/
5370	if (!(ASMAtomicIncU32(&pGipCpu->u32TransactionId) & 1))
5371	{
5372	/* this can happen on win32 if we're taking to long and there are more CPUs around. shouldn't happen though. */
5373	AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGipCpu->u32TransactionId));
5374	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5375	pGipCpu->cErrors++;
5376	return;
5377	}
5378
5379	/*
5380	* Recalc the update frequency every 0x800th time.
5381	*/
5382	if (!(pGipCpu->u32TransactionId & (GIP_UPDATEHZ_RECALC_FREQ * 2 - 2)))
5383	{
5384	if (pGip->u64NanoTSLastUpdateHz)
5385	{
5386	#ifdef RT_ARCH_AMD64 /** @todo fix 64-bit div here to work on x86 linux. */
5387	uint64_t u64Delta = u64NanoTS - pGip->u64NanoTSLastUpdateHz;
5388	uint32_t u32UpdateHz = (uint32_t)((UINT64_C(1000000000) * GIP_UPDATEHZ_RECALC_FREQ) / u64Delta);
5389	if (u32UpdateHz <= 2000 && u32UpdateHz >= 30)
5390	{
5391	ASMAtomicXchgU32(&pGip->u32UpdateHz, u32UpdateHz);
5392	ASMAtomicXchgU32(&pGip->u32UpdateIntervalNS, 1000000000 / u32UpdateHz);
5393	}
5394	#endif
5395	}
5396	ASMAtomicXchgU64(&pGip->u64NanoTSLastUpdateHz, u64NanoTS);
5397	}
5398
5399	/*
5400	* Update the data.
5401	*/
5402	supdrvGipDoUpdateCpu(pGip, pGipCpu, u64NanoTS);
5403
5404	/*
5405	* Complete transaction.
5406	*/
5407	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5408	}
5409
5410
5411	/**
5412	* Updates the per cpu GIP data for the calling cpu.
5413	*
5414	* @param pGip Pointer to the GIP.
5415	* @param u64NanoTS The current nanosecond timesamp.
5416	* @param iCpu The CPU index.
5417	*/
5418	void VBOXCALL supdrvGipUpdatePerCpu(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, unsigned iCpu)
5419	{
5420	PSUPGIPCPU pGipCpu;
5421
5422	if (RT_LIKELY(iCpu < RT_ELEMENTS(pGip->aCPUs)))
5423	{
5424	pGipCpu = &pGip->aCPUs[iCpu];
5425
5426	/*
5427	* Start update transaction.
5428	*/
5429	if (!(ASMAtomicIncU32(&pGipCpu->u32TransactionId) & 1))
5430	{
5431	AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGipCpu->u32TransactionId));
5432	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5433	pGipCpu->cErrors++;
5434	return;
5435	}
5436
5437	/*
5438	* Update the data.
5439	*/
5440	supdrvGipDoUpdateCpu(pGip, pGipCpu, u64NanoTS);
5441
5442	/*
5443	* Complete transaction.
5444	*/
5445	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5446	}
5447	}
5448

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPDrv.c@ 20953

Download in other formats: