SUPDrv.c@ 32651

Last change on this file since 32651 was 32572, checked in by vboxsync, 14 years ago
VMM,SUPDrv,IPRT: More changes for related to the priodic preemption timer. (still disabled)
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 197.4 KB

Line
1	/* $Revision: 32572 $ */
2	/** @file
3	* VBoxDrv - The VirtualBox Support Driver - Common code.
4	*/
5
6	/*
7	* Copyright (C) 2006-2010 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27	/*******************************************************************************
28	* Header Files *
29	*******************************************************************************/
30	#define LOG_GROUP LOG_GROUP_SUP_DRV
31	#define SUPDRV_AGNOSTIC
32	#include "SUPDrvInternal.h"
33	#ifndef PAGE_SHIFT
34	# include <iprt/param.h>
35	#endif
36	#include <iprt/asm.h>
37	#include <iprt/asm-amd64-x86.h>
38	#include <iprt/asm-math.h>
39	#include <iprt/cpuset.h>
40	#include <iprt/handletable.h>
41	#include <iprt/mem.h>
42	#include <iprt/mp.h>
43	#include <iprt/power.h>
44	#include <iprt/process.h>
45	#include <iprt/semaphore.h>
46	#include <iprt/spinlock.h>
47	#include <iprt/thread.h>
48	#include <iprt/uuid.h>
49	#include <iprt/net.h>
50	#include <iprt/crc.h>
51	#include <iprt/string.h>
52	#include <iprt/timer.h>
53	#if defined(RT_OS_DARWIN) \|\| defined(RT_OS_SOLARIS) \|\| defined(RT_OS_FREEBSD)
54	# include <iprt/rand.h>
55	# include <iprt/path.h>
56	#endif
57
58	#include <VBox/param.h>
59	#include <VBox/log.h>
60	#include <VBox/err.h>
61	#include <VBox/hwacc_svm.h>
62	#include <VBox/hwacc_vmx.h>
63	#include <VBox/x86.h>
64
65	/*
66	* Logging assignments:
67	* Log - useful stuff, like failures.
68	* LogFlow - program flow, except the really noisy bits.
69	* Log2 - Cleanup.
70	* Log3 - Loader flow noise.
71	* Log4 - Call VMMR0 flow noise.
72	* Log5 - Native yet-to-be-defined noise.
73	* Log6 - Native ioctl flow noise.
74	*
75	* Logging requires BUILD_TYPE=debug and possibly changes to the logger
76	* instanciation in log-vbox.c(pp).
77	*/
78
79
80	/*******************************************************************************
81	* Defined Constants And Macros *
82	*******************************************************************************/
83	/** The frequency by which we recalculate the u32UpdateHz and
84	* u32UpdateIntervalNS GIP members. The value must be a power of 2. */
85	#define GIP_UPDATEHZ_RECALC_FREQ 0x800
86
87	/** @def VBOX_SVN_REV
88	* The makefile should define this if it can. */
89	#ifndef VBOX_SVN_REV
90	# define VBOX_SVN_REV 0
91	#endif
92
93
94	/*******************************************************************************
95	* Internal Functions *
96	*******************************************************************************/
97	static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void pvObj, void pvCtx, void *pvUser);
98	static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void pvObj, void pvCtx, void *pvUser);
99	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession);
100	static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType);
101	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq);
102	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq);
103	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq);
104	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq);
105	static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq);
106	static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0EntryInt, void pvVMMR0EntryFast, void pvVMMR0EntryEx);
107	static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt);
108	static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage);
109	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage);
110	DECLINLINE(int) supdrvLdrLock(PSUPDRVDEVEXT pDevExt);
111	DECLINLINE(int) supdrvLdrUnlock(PSUPDRVDEVEXT pDevExt);
112	static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq);
113	static int supdrvIOCtl_LoggerSettings(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLOGGERSETTINGS pReq);
114	static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt);
115	static void supdrvGipDestroy(PSUPDRVDEVEXT pDevExt);
116	static DECLCALLBACK(void) supdrvGipSyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick);
117	static DECLCALLBACK(void) supdrvGipAsyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick);
118	static DECLCALLBACK(void) supdrvGipMpEvent(RTMPEVENT enmEvent, RTCPUID idCpu, void *pvUser);
119	static void supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys, uint64_t u64NanoTS, unsigned uUpdateHz);
120	static void supdrvGipTerm(PSUPGLOBALINFOPAGE pGip);
121	static void supdrvGipUpdate(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, uint64_t u64TSC, uint64_t iTick);
122	static void supdrvGipUpdatePerCpu(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, uint64_t u64TSC, unsigned iCpu, uint64_t iTick);
123
124
125	/*******************************************************************************
126	* Global Variables *
127	*******************************************************************************/
128	DECLEXPORT(PSUPGLOBALINFOPAGE) g_pSUPGlobalInfoPage = NULL;
129
130	/**
131	* Array of the R0 SUP API.
132	*/
133	static SUPFUNC g_aFunctions[] =
134	{
135	/* name function */
136	/* Entries with absolute addresses determined at runtime, fixup
137	code makes ugly ASSUMPTIONS about the order here: */
138	{ "SUPR0AbsIs64bit", (void *)0 },
139	{ "SUPR0Abs64bitKernelCS", (void *)0 },
140	{ "SUPR0Abs64bitKernelSS", (void *)0 },
141	{ "SUPR0Abs64bitKernelDS", (void *)0 },
142	{ "SUPR0AbsKernelCS", (void *)0 },
143	{ "SUPR0AbsKernelSS", (void *)0 },
144	{ "SUPR0AbsKernelDS", (void *)0 },
145	{ "SUPR0AbsKernelES", (void *)0 },
146	{ "SUPR0AbsKernelFS", (void *)0 },
147	{ "SUPR0AbsKernelGS", (void *)0 },
148	/* Normal function pointers: */
149	{ "SUPR0ComponentRegisterFactory", (void *)SUPR0ComponentRegisterFactory },
150	{ "SUPR0ComponentDeregisterFactory", (void *)SUPR0ComponentDeregisterFactory },
151	{ "SUPR0ComponentQueryFactory", (void *)SUPR0ComponentQueryFactory },
152	{ "SUPR0ObjRegister", (void *)SUPR0ObjRegister },
153	{ "SUPR0ObjAddRef", (void *)SUPR0ObjAddRef },
154	{ "SUPR0ObjAddRefEx", (void *)SUPR0ObjAddRefEx },
155	{ "SUPR0ObjRelease", (void *)SUPR0ObjRelease },
156	{ "SUPR0ObjVerifyAccess", (void *)SUPR0ObjVerifyAccess },
157	{ "SUPR0LockMem", (void *)SUPR0LockMem },
158	{ "SUPR0UnlockMem", (void *)SUPR0UnlockMem },
159	{ "SUPR0ContAlloc", (void *)SUPR0ContAlloc },
160	{ "SUPR0ContFree", (void *)SUPR0ContFree },
161	{ "SUPR0LowAlloc", (void *)SUPR0LowAlloc },
162	{ "SUPR0LowFree", (void *)SUPR0LowFree },
163	{ "SUPR0MemAlloc", (void *)SUPR0MemAlloc },
164	{ "SUPR0MemGetPhys", (void *)SUPR0MemGetPhys },
165	{ "SUPR0MemFree", (void *)SUPR0MemFree },
166	{ "SUPR0PageAllocEx", (void *)SUPR0PageAllocEx },
167	{ "SUPR0PageFree", (void *)SUPR0PageFree },
168	{ "SUPR0Printf", (void )SUPR0Printf }, /* @todo needs wrapping? */
169	{ "SUPSemEventCreate", (void *)SUPSemEventCreate },
170	{ "SUPSemEventClose", (void *)SUPSemEventClose },
171	{ "SUPSemEventSignal", (void *)SUPSemEventSignal },
172	{ "SUPSemEventWait", (void *)SUPSemEventWait },
173	{ "SUPSemEventWaitNoResume", (void *)SUPSemEventWaitNoResume },
174	{ "SUPSemEventMultiCreate", (void *)SUPSemEventMultiCreate },
175	{ "SUPSemEventMultiClose", (void *)SUPSemEventMultiClose },
176	{ "SUPSemEventMultiSignal", (void *)SUPSemEventMultiSignal },
177	{ "SUPSemEventMultiReset", (void *)SUPSemEventMultiReset },
178	{ "SUPSemEventMultiWait", (void *)SUPSemEventMultiWait },
179	{ "SUPSemEventMultiWaitNoResume", (void *)SUPSemEventMultiWaitNoResume },
180	{ "SUPR0GetPagingMode", (void *)SUPR0GetPagingMode },
181	{ "SUPR0EnableVTx", (void *)SUPR0EnableVTx },
182	{ "SUPGetGIP", (void *)SUPGetGIP },
183	{ "g_pSUPGlobalInfoPage", (void *)&g_pSUPGlobalInfoPage },
184	{ "RTMemAllocTag", (void *)RTMemAllocTag },
185	{ "RTMemAllocZTag", (void *)RTMemAllocZTag },
186	{ "RTMemAllocVarTag", (void *)RTMemAllocVarTag },
187	{ "RTMemAllocZVarTag", (void *)RTMemAllocZVarTag },
188	{ "RTMemFree", (void *)RTMemFree },
189	{ "RTMemDupTag", (void *)RTMemDupTag },
190	{ "RTMemDupExTag", (void *)RTMemDupExTag },
191	{ "RTMemReallocTag", (void *)RTMemReallocTag },
192	{ "RTR0MemObjAllocLowTag", (void *)RTR0MemObjAllocLowTag },
193	{ "RTR0MemObjAllocPageTag", (void *)RTR0MemObjAllocPageTag },
194	{ "RTR0MemObjAllocPhysTag", (void *)RTR0MemObjAllocPhysTag },
195	{ "RTR0MemObjAllocPhysExTag", (void *)RTR0MemObjAllocPhysExTag },
196	{ "RTR0MemObjAllocPhysNCTag", (void *)RTR0MemObjAllocPhysNCTag },
197	{ "RTR0MemObjAllocContTag", (void *)RTR0MemObjAllocContTag },
198	{ "RTR0MemObjEnterPhysTag", (void *)RTR0MemObjEnterPhysTag },
199	{ "RTR0MemObjLockUserTag", (void *)RTR0MemObjLockUserTag },
200	{ "RTR0MemObjMapKernelTag", (void *)RTR0MemObjMapKernelTag },
201	{ "RTR0MemObjMapKernelExTag", (void *)RTR0MemObjMapKernelExTag },
202	{ "RTR0MemObjMapUserTag", (void *)RTR0MemObjMapUserTag },
203	{ "RTR0MemObjProtect", (void *)RTR0MemObjProtect },
204	{ "RTR0MemObjAddress", (void *)RTR0MemObjAddress },
205	{ "RTR0MemObjAddressR3", (void *)RTR0MemObjAddressR3 },
206	{ "RTR0MemObjSize", (void *)RTR0MemObjSize },
207	{ "RTR0MemObjIsMapping", (void *)RTR0MemObjIsMapping },
208	{ "RTR0MemObjGetPagePhysAddr", (void *)RTR0MemObjGetPagePhysAddr },
209	{ "RTR0MemObjFree", (void *)RTR0MemObjFree },
210	{ "RTR0MemUserCopyFrom", (void *)RTR0MemUserCopyFrom },
211	{ "RTR0MemUserCopyTo", (void *)RTR0MemUserCopyTo },
212	{ "RTR0MemUserIsValidAddr", (void *)RTR0MemUserIsValidAddr },
213	{ "RTR0MemKernelIsValidAddr", (void *)RTR0MemKernelIsValidAddr },
214	{ "RTR0MemAreKrnlAndUsrDifferent", (void *)RTR0MemAreKrnlAndUsrDifferent },
215	{ "RTSemMutexCreate", (void *)RTSemMutexCreate },
216	{ "RTSemMutexRequest", (void *)RTSemMutexRequest },
217	{ "RTSemMutexRequestDebug", (void *)RTSemMutexRequestDebug },
218	{ "RTSemMutexRequestNoResume", (void *)RTSemMutexRequestNoResume },
219	{ "RTSemMutexRequestNoResumeDebug", (void *)RTSemMutexRequestNoResumeDebug },
220	{ "RTSemMutexRelease", (void *)RTSemMutexRelease },
221	{ "RTSemMutexDestroy", (void *)RTSemMutexDestroy },
222	{ "RTProcSelf", (void *)RTProcSelf },
223	{ "RTR0ProcHandleSelf", (void *)RTR0ProcHandleSelf },
224	{ "RTSemFastMutexCreate", (void *)RTSemFastMutexCreate },
225	{ "RTSemFastMutexDestroy", (void *)RTSemFastMutexDestroy },
226	{ "RTSemFastMutexRequest", (void *)RTSemFastMutexRequest },
227	{ "RTSemFastMutexRelease", (void *)RTSemFastMutexRelease },
228	{ "RTSemEventCreate", (void *)RTSemEventCreate },
229	{ "RTSemEventSignal", (void *)RTSemEventSignal },
230	{ "RTSemEventWait", (void *)RTSemEventWait },
231	{ "RTSemEventWaitNoResume", (void *)RTSemEventWaitNoResume },
232	{ "RTSemEventDestroy", (void *)RTSemEventDestroy },
233	{ "RTSemEventMultiCreate", (void *)RTSemEventMultiCreate },
234	{ "RTSemEventMultiSignal", (void *)RTSemEventMultiSignal },
235	{ "RTSemEventMultiReset", (void *)RTSemEventMultiReset },
236	{ "RTSemEventMultiWait", (void *)RTSemEventMultiWait },
237	{ "RTSemEventMultiWaitNoResume", (void *)RTSemEventMultiWaitNoResume },
238	{ "RTSemEventMultiDestroy", (void *)RTSemEventMultiDestroy },
239	{ "RTSpinlockCreate", (void *)RTSpinlockCreate },
240	{ "RTSpinlockDestroy", (void *)RTSpinlockDestroy },
241	{ "RTSpinlockAcquire", (void *)RTSpinlockAcquire },
242	{ "RTSpinlockRelease", (void *)RTSpinlockRelease },
243	{ "RTSpinlockAcquireNoInts", (void *)RTSpinlockAcquireNoInts },
244	{ "RTSpinlockReleaseNoInts", (void *)RTSpinlockReleaseNoInts },
245	{ "RTTimeNanoTS", (void *)RTTimeNanoTS },
246	{ "RTTimeMilliTS", (void *)RTTimeMilliTS },
247	{ "RTTimeSystemNanoTS", (void *)RTTimeSystemNanoTS },
248	{ "RTTimeSystemMilliTS", (void *)RTTimeSystemMilliTS },
249	{ "RTThreadNativeSelf", (void *)RTThreadNativeSelf },
250	{ "RTThreadSleep", (void *)RTThreadSleep },
251	{ "RTThreadYield", (void *)RTThreadYield },
252	#if 0 /* Thread APIs, Part 2. */
253	{ "RTThreadSelf", (void *)RTThreadSelf },
254	{ "RTThreadCreate", (void *)RTThreadCreate },
255	{ "RTThreadGetNative", (void *)RTThreadGetNative },
256	{ "RTThreadWait", (void *)RTThreadWait },
257	{ "RTThreadWaitNoResume", (void *)RTThreadWaitNoResume },
258	{ "RTThreadGetName", (void *)RTThreadGetName },
259	{ "RTThreadSelfName", (void *)RTThreadSelfName },
260	{ "RTThreadGetType", (void *)RTThreadGetType },
261	{ "RTThreadUserSignal", (void *)RTThreadUserSignal },
262	{ "RTThreadUserReset", (void *)RTThreadUserReset },
263	{ "RTThreadUserWait", (void *)RTThreadUserWait },
264	{ "RTThreadUserWaitNoResume", (void *)RTThreadUserWaitNoResume },
265	#endif
266	{ "RTThreadPreemptIsEnabled", (void *)RTThreadPreemptIsEnabled },
267	{ "RTThreadPreemptIsPending", (void *)RTThreadPreemptIsPending },
268	{ "RTThreadPreemptIsPendingTrusty", (void *)RTThreadPreemptIsPendingTrusty },
269	{ "RTThreadPreemptIsPossible", (void *)RTThreadPreemptIsPossible },
270	{ "RTThreadPreemptDisable", (void *)RTThreadPreemptDisable },
271	{ "RTThreadPreemptRestore", (void *)RTThreadPreemptRestore },
272	{ "RTThreadIsInInterrupt", (void *)RTThreadIsInInterrupt },
273	{ "RTTimerCreate", (void *)RTTimerCreate },
274	{ "RTTimerCreateEx", (void *)RTTimerCreateEx },
275	{ "RTTimerDestroy", (void *)RTTimerDestroy },
276	{ "RTTimerStart", (void *)RTTimerStart },
277	{ "RTTimerStop", (void *)RTTimerStop },
278	{ "RTTimerChangeInterval", (void *)RTTimerChangeInterval },
279	{ "RTTimerGetSystemGranularity", (void *)RTTimerGetSystemGranularity },
280	{ "RTTimerRequestSystemGranularity", (void *)RTTimerRequestSystemGranularity },
281	{ "RTTimerReleaseSystemGranularity", (void *)RTTimerReleaseSystemGranularity },
282	{ "RTTimerCanDoHighResolution", (void *)RTTimerCanDoHighResolution },
283
284	{ "RTLogDefaultInstance", (void *)RTLogDefaultInstance },
285	{ "RTMpCpuId", (void *)RTMpCpuId },
286	{ "RTMpCpuIdFromSetIndex", (void *)RTMpCpuIdFromSetIndex },
287	{ "RTMpCpuIdToSetIndex", (void *)RTMpCpuIdToSetIndex },
288	{ "RTMpGetArraySize", (void *)RTMpGetArraySize },
289	{ "RTMpIsCpuPossible", (void *)RTMpIsCpuPossible },
290	{ "RTMpGetCount", (void *)RTMpGetCount },
291	{ "RTMpGetMaxCpuId", (void *)RTMpGetMaxCpuId },
292	{ "RTMpGetOnlineCount", (void *)RTMpGetOnlineCount },
293	{ "RTMpGetOnlineSet", (void *)RTMpGetOnlineSet },
294	{ "RTMpGetSet", (void *)RTMpGetSet },
295	{ "RTMpIsCpuOnline", (void *)RTMpIsCpuOnline },
296	{ "RTMpIsCpuWorkPending", (void *)RTMpIsCpuWorkPending },
297	{ "RTMpOnAll", (void *)RTMpOnAll },
298	{ "RTMpOnOthers", (void *)RTMpOnOthers },
299	{ "RTMpOnSpecific", (void *)RTMpOnSpecific },
300	{ "RTMpPokeCpu", (void *)RTMpPokeCpu },
301	{ "RTPowerNotificationRegister", (void *)RTPowerNotificationRegister },
302	{ "RTPowerNotificationDeregister", (void *)RTPowerNotificationDeregister },
303	{ "RTLogRelDefaultInstance", (void *)RTLogRelDefaultInstance },
304	{ "RTLogSetDefaultInstanceThread", (void *)RTLogSetDefaultInstanceThread },
305	{ "RTLogLoggerExV", (void *)RTLogLoggerExV },
306	{ "RTLogPrintfV", (void *)RTLogPrintfV },
307	{ "RTR0AssertPanicSystem", (void *)RTR0AssertPanicSystem },
308	{ "RTAssertMsg1", (void *)RTAssertMsg1 },
309	{ "RTAssertMsg2V", (void *)RTAssertMsg2V },
310	{ "RTAssertSetQuiet", (void *)RTAssertSetQuiet },
311	{ "RTAssertMayPanic", (void *)RTAssertMayPanic },
312	{ "RTAssertSetMayPanic", (void *)RTAssertSetMayPanic },
313	{ "RTAssertAreQuiet", (void *)RTAssertAreQuiet },
314	{ "RTStrFormat", (void *)RTStrFormat },
315	{ "RTStrFormatNumber", (void *)RTStrFormatNumber },
316	{ "RTStrFormatTypeDeregister", (void *)RTStrFormatTypeDeregister },
317	{ "RTStrFormatTypeRegister", (void *)RTStrFormatTypeRegister },
318	{ "RTStrFormatTypeSetUser", (void *)RTStrFormatTypeSetUser },
319	{ "RTStrFormatV", (void *)RTStrFormatV },
320	{ "RTStrPrintf", (void *)RTStrPrintf },
321	{ "RTStrPrintfEx", (void *)RTStrPrintfEx },
322	{ "RTStrPrintfExV", (void *)RTStrPrintfExV },
323	{ "RTStrPrintfV", (void *)RTStrPrintfV },
324	{ "RTHandleTableAllocWithCtx", (void *)RTHandleTableAllocWithCtx },
325	{ "RTHandleTableCreate", (void *)RTHandleTableCreate },
326	{ "RTHandleTableCreateEx", (void *)RTHandleTableCreateEx },
327	{ "RTHandleTableDestroy", (void *)RTHandleTableDestroy },
328	{ "RTHandleTableFreeWithCtx", (void *)RTHandleTableFreeWithCtx },
329	{ "RTHandleTableLookupWithCtx", (void *)RTHandleTableLookupWithCtx },
330	{ "RTNetIPv4AddDataChecksum", (void *)RTNetIPv4AddDataChecksum },
331	{ "RTNetIPv4AddTCPChecksum", (void *)RTNetIPv4AddTCPChecksum },
332	{ "RTNetIPv4AddUDPChecksum", (void *)RTNetIPv4AddUDPChecksum },
333	{ "RTNetIPv4FinalizeChecksum", (void *)RTNetIPv4FinalizeChecksum },
334	{ "RTNetIPv4HdrChecksum", (void *)RTNetIPv4HdrChecksum },
335	{ "RTNetIPv4IsDHCPValid", (void *)RTNetIPv4IsDHCPValid },
336	{ "RTNetIPv4IsHdrValid", (void *)RTNetIPv4IsHdrValid },
337	{ "RTNetIPv4IsTCPSizeValid", (void *)RTNetIPv4IsTCPSizeValid },
338	{ "RTNetIPv4IsTCPValid", (void *)RTNetIPv4IsTCPValid },
339	{ "RTNetIPv4IsUDPSizeValid", (void *)RTNetIPv4IsUDPSizeValid },
340	{ "RTNetIPv4IsUDPValid", (void *)RTNetIPv4IsUDPValid },
341	{ "RTNetIPv4PseudoChecksum", (void *)RTNetIPv4PseudoChecksum },
342	{ "RTNetIPv4PseudoChecksumBits", (void *)RTNetIPv4PseudoChecksumBits },
343	{ "RTNetIPv4TCPChecksum", (void *)RTNetIPv4TCPChecksum },
344	{ "RTNetIPv4UDPChecksum", (void *)RTNetIPv4UDPChecksum },
345	{ "RTNetIPv6PseudoChecksum", (void *)RTNetIPv6PseudoChecksum },
346	{ "RTNetIPv6PseudoChecksumBits", (void *)RTNetIPv6PseudoChecksumBits },
347	{ "RTNetIPv6PseudoChecksumEx", (void *)RTNetIPv6PseudoChecksumEx },
348	{ "RTNetTCPChecksum", (void *)RTNetTCPChecksum },
349	{ "RTNetUDPChecksum", (void *)RTNetUDPChecksum },
350	{ "RTCrc32", (void *)RTCrc32 },
351	{ "RTCrc32Finish", (void *)RTCrc32Finish },
352	{ "RTCrc32Process", (void *)RTCrc32Process },
353	{ "RTCrc32Start", (void *)RTCrc32Start },
354	};
355
356	#if defined(RT_OS_DARWIN) \|\| defined(RT_OS_SOLARIS) \|\| defined(RT_OS_FREEBSD)
357	/**
358	* Drag in the rest of IRPT since we share it with the
359	* rest of the kernel modules on darwin.
360	*/
361	PFNRT g_apfnVBoxDrvIPRTDeps[] =
362	{
363	/* VBoxNetFlt */
364	(PFNRT)RTErrConvertFromErrno,
365	(PFNRT)RTUuidCompare,
366	(PFNRT)RTUuidCompareStr,
367	(PFNRT)RTUuidFromStr,
368	(PFNRT)RTStrDupTag,
369	(PFNRT)RTStrFree,
370	/* VBoxNetAdp */
371	(PFNRT)RTRandBytes,
372	/* VBoxUSB */
373	(PFNRT)RTPathStripFilename,
374	NULL
375	};
376	#endif /* RT_OS_DARWIN \|\| RT_OS_SOLARIS \|\| RT_OS_SOLARIS */
377
378
379	/**
380	* Initializes the device extentsion structure.
381	*
382	* @returns IPRT status code.
383	* @param pDevExt The device extension to initialize.
384	* @param cbSession The size of the session structure. The size of
385	* SUPDRVSESSION may be smaller when SUPDRV_AGNOSTIC is
386	* defined because we're skipping the OS specific members
387	* then.
388	*/
389	int VBOXCALL supdrvInitDevExt(PSUPDRVDEVEXT pDevExt, size_t cbSession)
390	{
391	int rc;
392
393	#ifdef SUPDRV_WITH_RELEASE_LOGGER
394	/*
395	* Create the release log.
396	*/
397	static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
398	PRTLOGGER pRelLogger;
399	rc = RTLogCreate(&pRelLogger, 0 /* fFlags */, "all",
400	"VBOX_RELEASE_LOG", RT_ELEMENTS(s_apszGroups), s_apszGroups,
401	RTLOGDEST_STDOUT \| RTLOGDEST_DEBUGGER, NULL);
402	if (RT_SUCCESS(rc))
403	RTLogRelSetDefaultInstance(pRelLogger);
404	/** @todo Add native hook for getting logger config parameters and setting
405	* them. On linux we should use the module parameter stuff... */
406	#endif
407
408	/*
409	* Initialize it.
410	*/
411	memset(pDevExt, 0, sizeof(*pDevExt));
412	rc = RTSpinlockCreate(&pDevExt->Spinlock);
413	if (RT_SUCCESS(rc))
414	{
415	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
416	rc = RTSemMutexCreate(&pDevExt->mtxLdr);
417	#else
418	rc = RTSemFastMutexCreate(&pDevExt->mtxLdr);
419	#endif
420	if (RT_SUCCESS(rc))
421	{
422	rc = RTSemFastMutexCreate(&pDevExt->mtxComponentFactory);
423	if (RT_SUCCESS(rc))
424	{
425	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
426	rc = RTSemMutexCreate(&pDevExt->mtxGip);
427	#else
428	rc = RTSemFastMutexCreate(&pDevExt->mtxGip);
429	#endif
430	if (RT_SUCCESS(rc))
431	{
432	rc = supdrvGipCreate(pDevExt);
433	if (RT_SUCCESS(rc))
434	{
435	pDevExt->u32Cookie = BIRD; /** @todo make this random? */
436	pDevExt->cbSession = cbSession;
437
438	/*
439	* Fixup the absolute symbols.
440	*
441	* Because of the table indexing assumptions we'll have a little #ifdef orgy
442	* here rather than distributing this to OS specific files. At least for now.
443	*/
444	#ifdef RT_OS_DARWIN
445	# if ARCH_BITS == 32
446	if (SUPR0GetPagingMode() >= SUPPAGINGMODE_AMD64)
447	{
448	g_aFunctions[0].pfn = (void )1; / SUPR0AbsIs64bit */
449	g_aFunctions[1].pfn = (void )0x80; / SUPR0Abs64bitKernelCS - KERNEL64_CS, seg.h */
450	g_aFunctions[2].pfn = (void )0x88; / SUPR0Abs64bitKernelSS - KERNEL64_SS, seg.h */
451	g_aFunctions[3].pfn = (void )0x88; / SUPR0Abs64bitKernelDS - KERNEL64_SS, seg.h */
452	}
453	else
454	g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[4].pfn = (void *)0;
455	g_aFunctions[4].pfn = (void )0x08; / SUPR0AbsKernelCS - KERNEL_CS, seg.h */
456	g_aFunctions[5].pfn = (void )0x10; / SUPR0AbsKernelSS - KERNEL_DS, seg.h */
457	g_aFunctions[6].pfn = (void )0x10; / SUPR0AbsKernelDS - KERNEL_DS, seg.h */
458	g_aFunctions[7].pfn = (void )0x10; / SUPR0AbsKernelES - KERNEL_DS, seg.h */
459	g_aFunctions[8].pfn = (void )0x10; / SUPR0AbsKernelFS - KERNEL_DS, seg.h */
460	g_aFunctions[9].pfn = (void )0x48; / SUPR0AbsKernelGS - CPU_DATA_GS, seg.h */
461	# else /* 64-bit darwin: */
462	g_aFunctions[0].pfn = (void )1; / SUPR0AbsIs64bit */
463	g_aFunctions[1].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0Abs64bitKernelCS */
464	g_aFunctions[2].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0Abs64bitKernelSS */
465	g_aFunctions[3].pfn = (void )0; / SUPR0Abs64bitKernelDS */
466	g_aFunctions[4].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0AbsKernelCS */
467	g_aFunctions[5].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0AbsKernelSS */
468	g_aFunctions[6].pfn = (void )0; / SUPR0AbsKernelDS */
469	g_aFunctions[7].pfn = (void )0; / SUPR0AbsKernelES */
470	g_aFunctions[8].pfn = (void )0; / SUPR0AbsKernelFS */
471	g_aFunctions[9].pfn = (void )0; / SUPR0AbsKernelGS */
472
473	# endif
474	#else /* !RT_OS_DARWIN */
475	# if ARCH_BITS == 64
476	g_aFunctions[0].pfn = (void )1; / SUPR0AbsIs64bit */
477	g_aFunctions[1].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0Abs64bitKernelCS */
478	g_aFunctions[2].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0Abs64bitKernelSS */
479	g_aFunctions[3].pfn = (void )(uintptr_t)ASMGetDS(); / SUPR0Abs64bitKernelDS */
480	# else
481	g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[4].pfn = (void *)0;
482	# endif
483	g_aFunctions[4].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0AbsKernelCS */
484	g_aFunctions[5].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0AbsKernelSS */
485	g_aFunctions[6].pfn = (void )(uintptr_t)ASMGetDS(); / SUPR0AbsKernelDS */
486	g_aFunctions[7].pfn = (void )(uintptr_t)ASMGetES(); / SUPR0AbsKernelES */
487	g_aFunctions[8].pfn = (void )(uintptr_t)ASMGetFS(); / SUPR0AbsKernelFS */
488	g_aFunctions[9].pfn = (void )(uintptr_t)ASMGetGS(); / SUPR0AbsKernelGS */
489	#endif /* !RT_OS_DARWIN */
490	return VINF_SUCCESS;
491	}
492
493	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
494	RTSemMutexDestroy(pDevExt->mtxGip);
495	pDevExt->mtxGip = NIL_RTSEMMUTEX;
496	#else
497	RTSemFastMutexDestroy(pDevExt->mtxGip);
498	pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
499	#endif
500	}
501	RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
502	pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
503	}
504	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
505	RTSemMutexDestroy(pDevExt->mtxLdr);
506	pDevExt->mtxLdr = NIL_RTSEMMUTEX;
507	#else
508	RTSemFastMutexDestroy(pDevExt->mtxLdr);
509	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
510	#endif
511	}
512	RTSpinlockDestroy(pDevExt->Spinlock);
513	pDevExt->Spinlock = NIL_RTSPINLOCK;
514	}
515	#ifdef SUPDRV_WITH_RELEASE_LOGGER
516	RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
517	RTLogDestroy(RTLogSetDefaultInstance(NULL));
518	#endif
519
520	return rc;
521	}
522
523
524	/**
525	* Delete the device extension (e.g. cleanup members).
526	*
527	* @param pDevExt The device extension to delete.
528	*/
529	void VBOXCALL supdrvDeleteDevExt(PSUPDRVDEVEXT pDevExt)
530	{
531	PSUPDRVOBJ pObj;
532	PSUPDRVUSAGE pUsage;
533
534	/*
535	* Kill mutexes and spinlocks.
536	*/
537	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
538	RTSemMutexDestroy(pDevExt->mtxGip);
539	pDevExt->mtxGip = NIL_RTSEMMUTEX;
540	#else
541	RTSemFastMutexDestroy(pDevExt->mtxGip);
542	pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
543	#endif
544	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
545	RTSemMutexDestroy(pDevExt->mtxLdr);
546	pDevExt->mtxLdr = NIL_RTSEMMUTEX;
547	#else
548	RTSemFastMutexDestroy(pDevExt->mtxLdr);
549	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
550	#endif
551	RTSpinlockDestroy(pDevExt->Spinlock);
552	pDevExt->Spinlock = NIL_RTSPINLOCK;
553	RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
554	pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
555
556	/*
557	* Free lists.
558	*/
559	/* objects. */
560	pObj = pDevExt->pObjs;
561	Assert(!pObj); /* (can trigger on forced unloads) */
562	pDevExt->pObjs = NULL;
563	while (pObj)
564	{
565	void *pvFree = pObj;
566	pObj = pObj->pNext;
567	RTMemFree(pvFree);
568	}
569
570	/* usage records. */
571	pUsage = pDevExt->pUsageFree;
572	pDevExt->pUsageFree = NULL;
573	while (pUsage)
574	{
575	void *pvFree = pUsage;
576	pUsage = pUsage->pNext;
577	RTMemFree(pvFree);
578	}
579
580	/* kill the GIP. */
581	supdrvGipDestroy(pDevExt);
582
583	#ifdef SUPDRV_WITH_RELEASE_LOGGER
584	/* destroy the loggers. */
585	RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
586	RTLogDestroy(RTLogSetDefaultInstance(NULL));
587	#endif
588	}
589
590
591	/**
592	* Create session.
593	*
594	* @returns IPRT status code.
595	* @param pDevExt Device extension.
596	* @param fUser Flag indicating whether this is a user or kernel session.
597	* @param ppSession Where to store the pointer to the session data.
598	*/
599	int VBOXCALL supdrvCreateSession(PSUPDRVDEVEXT pDevExt, bool fUser, PSUPDRVSESSION *ppSession)
600	{
601	/*
602	* Allocate memory for the session data.
603	*/
604	int rc;
605	PSUPDRVSESSION pSession = *ppSession = (PSUPDRVSESSION)RTMemAllocZ(pDevExt->cbSession);
606	if (pSession)
607	{
608	/* Initialize session data. */
609	rc = RTSpinlockCreate(&pSession->Spinlock);
610	if (!rc)
611	{
612	rc = RTHandleTableCreateEx(&pSession->hHandleTable,
613	RTHANDLETABLE_FLAGS_LOCKED \| RTHANDLETABLE_FLAGS_CONTEXT,
614	1 /uBase/, 32768 /cMax/, supdrvSessionObjHandleRetain, pSession);
615	if (RT_SUCCESS(rc))
616	{
617	Assert(pSession->Spinlock != NIL_RTSPINLOCK);
618	pSession->pDevExt = pDevExt;
619	pSession->u32Cookie = BIRD_INV;
620	/*pSession->pLdrUsage = NULL;
621	pSession->pVM = NULL;
622	pSession->pUsage = NULL;
623	pSession->pGip = NULL;
624	pSession->fGipReferenced = false;
625	pSession->Bundle.cUsed = 0; */
626	pSession->Uid = NIL_RTUID;
627	pSession->Gid = NIL_RTGID;
628	if (fUser)
629	{
630	pSession->Process = RTProcSelf();
631	pSession->R0Process = RTR0ProcHandleSelf();
632	}
633	else
634	{
635	pSession->Process = NIL_RTPROCESS;
636	pSession->R0Process = NIL_RTR0PROCESS;
637	}
638
639	LogFlow(("Created session %p initial cookie=%#x\n", pSession, pSession->u32Cookie));
640	return VINF_SUCCESS;
641	}
642
643	RTSpinlockDestroy(pSession->Spinlock);
644	}
645	RTMemFree(pSession);
646	*ppSession = NULL;
647	Log(("Failed to create spinlock, rc=%d!\n", rc));
648	}
649	else
650	rc = VERR_NO_MEMORY;
651
652	return rc;
653	}
654
655
656	/**
657	* Shared code for cleaning up a session.
658	*
659	* @param pDevExt Device extension.
660	* @param pSession Session data.
661	* This data will be freed by this routine.
662	*/
663	void VBOXCALL supdrvCloseSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
664	{
665	/*
666	* Cleanup the session first.
667	*/
668	supdrvCleanupSession(pDevExt, pSession);
669
670	/*
671	* Free the rest of the session stuff.
672	*/
673	RTSpinlockDestroy(pSession->Spinlock);
674	pSession->Spinlock = NIL_RTSPINLOCK;
675	pSession->pDevExt = NULL;
676	RTMemFree(pSession);
677	LogFlow(("supdrvCloseSession: returns\n"));
678	}
679
680
681	/**
682	* Shared code for cleaning up a session (but not quite freeing it).
683	*
684	* This is primarily intended for MAC OS X where we have to clean up the memory
685	* stuff before the file handle is closed.
686	*
687	* @param pDevExt Device extension.
688	* @param pSession Session data.
689	* This data will be freed by this routine.
690	*/
691	void VBOXCALL supdrvCleanupSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
692	{
693	int rc;
694	PSUPDRVBUNDLE pBundle;
695	LogFlow(("supdrvCleanupSession: pSession=%p\n", pSession));
696
697	/*
698	* Remove logger instances related to this session.
699	*/
700	RTLogSetDefaultInstanceThread(NULL, (uintptr_t)pSession);
701
702	/*
703	* Destroy the handle table.
704	*/
705	rc = RTHandleTableDestroy(pSession->hHandleTable, supdrvSessionObjHandleDelete, pSession);
706	AssertRC(rc);
707	pSession->hHandleTable = NIL_RTHANDLETABLE;
708
709	/*
710	* Release object references made in this session.
711	* In theory there should be noone racing us in this session.
712	*/
713	Log2(("release objects - start\n"));
714	if (pSession->pUsage)
715	{
716	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
717	PSUPDRVUSAGE pUsage;
718	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
719
720	while ((pUsage = pSession->pUsage) != NULL)
721	{
722	PSUPDRVOBJ pObj = pUsage->pObj;
723	pSession->pUsage = pUsage->pNext;
724
725	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
726	if (pUsage->cUsage < pObj->cUsage)
727	{
728	pObj->cUsage -= pUsage->cUsage;
729	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
730	}
731	else
732	{
733	/* Destroy the object and free the record. */
734	if (pDevExt->pObjs == pObj)
735	pDevExt->pObjs = pObj->pNext;
736	else
737	{
738	PSUPDRVOBJ pObjPrev;
739	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
740	if (pObjPrev->pNext == pObj)
741	{
742	pObjPrev->pNext = pObj->pNext;
743	break;
744	}
745	Assert(pObjPrev);
746	}
747	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
748
749	Log(("supdrvCleanupSession: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
750	pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
751	if (pObj->pfnDestructor)
752	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
753	RTMemFree(pObj);
754	}
755
756	/* free it and continue. */
757	RTMemFree(pUsage);
758
759	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
760	}
761
762	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
763	AssertMsg(!pSession->pUsage, ("Some buster reregistered an object during desturction!\n"));
764	}
765	Log2(("release objects - done\n"));
766
767	/*
768	* Release memory allocated in the session.
769	*
770	* We do not serialize this as we assume that the application will
771	* not allocated memory while closing the file handle object.
772	*/
773	Log2(("freeing memory:\n"));
774	pBundle = &pSession->Bundle;
775	while (pBundle)
776	{
777	PSUPDRVBUNDLE pToFree;
778	unsigned i;
779
780	/*
781	* Check and unlock all entries in the bundle.
782	*/
783	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
784	{
785	if (pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ)
786	{
787	Log2(("eType=%d pvR0=%p pvR3=%p cb=%ld\n", pBundle->aMem[i].eType, RTR0MemObjAddress(pBundle->aMem[i].MemObj),
788	(void *)RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3), (long)RTR0MemObjSize(pBundle->aMem[i].MemObj)));
789	if (pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ)
790	{
791	rc = RTR0MemObjFree(pBundle->aMem[i].MapObjR3, false);
792	AssertRC(rc); /** @todo figure out how to handle this. */
793	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
794	}
795	rc = RTR0MemObjFree(pBundle->aMem[i].MemObj, true /* fFreeMappings */);
796	AssertRC(rc); /** @todo figure out how to handle this. */
797	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
798	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
799	}
800	}
801
802	/*
803	* Advance and free previous bundle.
804	*/
805	pToFree = pBundle;
806	pBundle = pBundle->pNext;
807
808	pToFree->pNext = NULL;
809	pToFree->cUsed = 0;
810	if (pToFree != &pSession->Bundle)
811	RTMemFree(pToFree);
812	}
813	Log2(("freeing memory - done\n"));
814
815	/*
816	* Deregister component factories.
817	*/
818	RTSemFastMutexRequest(pDevExt->mtxComponentFactory);
819	Log2(("deregistering component factories:\n"));
820	if (pDevExt->pComponentFactoryHead)
821	{
822	PSUPDRVFACTORYREG pPrev = NULL;
823	PSUPDRVFACTORYREG pCur = pDevExt->pComponentFactoryHead;
824	while (pCur)
825	{
826	if (pCur->pSession == pSession)
827	{
828	/* unlink it */
829	PSUPDRVFACTORYREG pNext = pCur->pNext;
830	if (pPrev)
831	pPrev->pNext = pNext;
832	else
833	pDevExt->pComponentFactoryHead = pNext;
834
835	/* free it */
836	pCur->pNext = NULL;
837	pCur->pSession = NULL;
838	pCur->pFactory = NULL;
839	RTMemFree(pCur);
840
841	/* next */
842	pCur = pNext;
843	}
844	else
845	{
846	/* next */
847	pPrev = pCur;
848	pCur = pCur->pNext;
849	}
850	}
851	}
852	RTSemFastMutexRelease(pDevExt->mtxComponentFactory);
853	Log2(("deregistering component factories - done\n"));
854
855	/*
856	* Loaded images needs to be dereferenced and possibly freed up.
857	*/
858	supdrvLdrLock(pDevExt);
859	Log2(("freeing images:\n"));
860	if (pSession->pLdrUsage)
861	{
862	PSUPDRVLDRUSAGE pUsage = pSession->pLdrUsage;
863	pSession->pLdrUsage = NULL;
864	while (pUsage)
865	{
866	void *pvFree = pUsage;
867	PSUPDRVLDRIMAGE pImage = pUsage->pImage;
868	if (pImage->cUsage > pUsage->cUsage)
869	pImage->cUsage -= pUsage->cUsage;
870	else
871	supdrvLdrFree(pDevExt, pImage);
872	pUsage->pImage = NULL;
873	pUsage = pUsage->pNext;
874	RTMemFree(pvFree);
875	}
876	}
877	supdrvLdrUnlock(pDevExt);
878	Log2(("freeing images - done\n"));
879
880	/*
881	* Unmap the GIP.
882	*/
883	Log2(("umapping GIP:\n"));
884	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
885	{
886	SUPR0GipUnmap(pSession);
887	pSession->fGipReferenced = 0;
888	}
889	Log2(("umapping GIP - done\n"));
890	}
891
892
893	/**
894	* RTHandleTableDestroy callback used by supdrvCleanupSession.
895	*
896	* @returns IPRT status code, see SUPR0ObjAddRef.
897	* @param hHandleTable The handle table handle. Ignored.
898	* @param pvObj The object pointer.
899	* @param pvCtx Context, the handle type. Ignored.
900	* @param pvUser Session pointer.
901	*/
902	static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void pvObj, void pvCtx, void *pvUser)
903	{
904	NOREF(pvCtx);
905	NOREF(hHandleTable);
906	return SUPR0ObjAddRefEx(pvObj, (PSUPDRVSESSION)pvUser, true /fNoBlocking/);
907	}
908
909
910	/**
911	* RTHandleTableDestroy callback used by supdrvCleanupSession.
912	*
913	* @param hHandleTable The handle table handle. Ignored.
914	* @param h The handle value. Ignored.
915	* @param pvObj The object pointer.
916	* @param pvCtx Context, the handle type. Ignored.
917	* @param pvUser Session pointer.
918	*/
919	static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void pvObj, void pvCtx, void *pvUser)
920	{
921	NOREF(pvCtx);
922	NOREF(h);
923	NOREF(hHandleTable);
924	SUPR0ObjRelease(pvObj, (PSUPDRVSESSION)pvUser);
925	}
926
927
928	/**
929	* Fast path I/O Control worker.
930	*
931	* @returns VBox status code that should be passed down to ring-3 unchanged.
932	* @param uIOCtl Function number.
933	* @param idCpu VMCPU id.
934	* @param pDevExt Device extention.
935	* @param pSession Session data.
936	*/
937	int VBOXCALL supdrvIOCtlFast(uintptr_t uIOCtl, VMCPUID idCpu, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
938	{
939	/*
940	* We check the two prereqs after doing this only to allow the compiler to optimize things better.
941	*/
942	if (RT_LIKELY(pSession->pVM && pDevExt->pfnVMMR0EntryFast))
943	{
944	switch (uIOCtl)
945	{
946	case SUP_IOCTL_FAST_DO_RAW_RUN:
947	pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_RAW_RUN);
948	break;
949	case SUP_IOCTL_FAST_DO_HWACC_RUN:
950	pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_HWACC_RUN);
951	break;
952	case SUP_IOCTL_FAST_DO_NOP:
953	pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_NOP);
954	break;
955	default:
956	return VERR_INTERNAL_ERROR;
957	}
958	return VINF_SUCCESS;
959	}
960	return VERR_INTERNAL_ERROR;
961	}
962
963
964	/**
965	* Helper for supdrvIOCtl. Check if pszStr contains any character of pszChars.
966	* We would use strpbrk here if this function would be contained in the RedHat kABI white
967	* list, see http://www.kerneldrivers.org/RHEL5.
968	*
969	* @returns 1 if pszStr does contain any character of pszChars, 0 otherwise.
970	* @param pszStr String to check
971	* @param pszChars Character set
972	*/
973	static int supdrvCheckInvalidChar(const char pszStr, const char pszChars)
974	{
975	int chCur;
976	while ((chCur = *pszStr++) != '\0')
977	{
978	int ch;
979	const char *psz = pszChars;
980	while ((ch = *psz++) != '\0')
981	if (ch == chCur)
982	return 1;
983
984	}
985	return 0;
986	}
987
988
989	/**
990	* I/O Control worker.
991	*
992	* @returns IPRT status code.
993	* @retval VERR_INVALID_PARAMETER if the request is invalid.
994	*
995	* @param uIOCtl Function number.
996	* @param pDevExt Device extention.
997	* @param pSession Session data.
998	* @param pReqHdr The request header.
999	*/
1000	int VBOXCALL supdrvIOCtl(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPREQHDR pReqHdr)
1001	{
1002	/*
1003	* Validate the request.
1004	*/
1005	/* this first check could probably be omitted as its also done by the OS specific code... */
1006	if (RT_UNLIKELY( (pReqHdr->fFlags & SUPREQHDR_FLAGS_MAGIC_MASK) != SUPREQHDR_FLAGS_MAGIC
1007	\|\| pReqHdr->cbIn < sizeof(*pReqHdr)
1008	\|\| pReqHdr->cbOut < sizeof(*pReqHdr)))
1009	{
1010	OSDBGPRINT(("vboxdrv: Bad ioctl request header; cbIn=%#lx cbOut=%#lx fFlags=%#lx\n",
1011	(long)pReqHdr->cbIn, (long)pReqHdr->cbOut, (long)pReqHdr->fFlags));
1012	return VERR_INVALID_PARAMETER;
1013	}
1014	if (RT_UNLIKELY(uIOCtl == SUP_IOCTL_COOKIE))
1015	{
1016	if (pReqHdr->u32Cookie != SUPCOOKIE_INITIAL_COOKIE)
1017	{
1018	OSDBGPRINT(("SUP_IOCTL_COOKIE: bad cookie %#lx\n", (long)pReqHdr->u32Cookie));
1019	return VERR_INVALID_PARAMETER;
1020	}
1021	}
1022	else if (RT_UNLIKELY( pReqHdr->u32Cookie != pDevExt->u32Cookie
1023	\|\| pReqHdr->u32SessionCookie != pSession->u32Cookie))
1024	{
1025	OSDBGPRINT(("vboxdrv: bad cookie %#lx / %#lx.\n", (long)pReqHdr->u32Cookie, (long)pReqHdr->u32SessionCookie));
1026	return VERR_INVALID_PARAMETER;
1027	}
1028
1029	/*
1030	* Validation macros
1031	*/
1032	#define REQ_CHECK_SIZES_EX(Name, cbInExpect, cbOutExpect) \
1033	do { \
1034	if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect) \|\| pReqHdr->cbOut != (cbOutExpect))) \
1035	{ \
1036	OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld. cbOut=%ld expected %ld.\n", \
1037	(long)pReq->Hdr.cbIn, (long)(cbInExpect), (long)pReq->Hdr.cbOut, (long)(cbOutExpect))); \
1038	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1039	} \
1040	} while (0)
1041
1042	#define REQ_CHECK_SIZES(Name) REQ_CHECK_SIZES_EX(Name, Name ## _SIZE_IN, Name ## _SIZE_OUT)
1043
1044	#define REQ_CHECK_SIZE_IN(Name, cbInExpect) \
1045	do { \
1046	if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect))) \
1047	{ \
1048	OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld.\n", \
1049	(long)pReq->Hdr.cbIn, (long)(cbInExpect))); \
1050	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1051	} \
1052	} while (0)
1053
1054	#define REQ_CHECK_SIZE_OUT(Name, cbOutExpect) \
1055	do { \
1056	if (RT_UNLIKELY(pReqHdr->cbOut != (cbOutExpect))) \
1057	{ \
1058	OSDBGPRINT(( #Name ": Invalid input/output sizes. cbOut=%ld expected %ld.\n", \
1059	(long)pReq->Hdr.cbOut, (long)(cbOutExpect))); \
1060	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1061	} \
1062	} while (0)
1063
1064	#define REQ_CHECK_EXPR(Name, expr) \
1065	do { \
1066	if (RT_UNLIKELY(!(expr))) \
1067	{ \
1068	OSDBGPRINT(( #Name ": %s\n", #expr)); \
1069	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1070	} \
1071	} while (0)
1072
1073	#define REQ_CHECK_EXPR_FMT(expr, fmt) \
1074	do { \
1075	if (RT_UNLIKELY(!(expr))) \
1076	{ \
1077	OSDBGPRINT( fmt ); \
1078	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1079	} \
1080	} while (0)
1081
1082
1083	/*
1084	* The switch.
1085	*/
1086	switch (SUP_CTL_CODE_NO_SIZE(uIOCtl))
1087	{
1088	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_COOKIE):
1089	{
1090	PSUPCOOKIE pReq = (PSUPCOOKIE)pReqHdr;
1091	REQ_CHECK_SIZES(SUP_IOCTL_COOKIE);
1092	if (strncmp(pReq->u.In.szMagic, SUPCOOKIE_MAGIC, sizeof(pReq->u.In.szMagic)))
1093	{
1094	OSDBGPRINT(("SUP_IOCTL_COOKIE: invalid magic %.16s\n", pReq->u.In.szMagic));
1095	pReq->Hdr.rc = VERR_INVALID_MAGIC;
1096	return 0;
1097	}
1098
1099	#if 0
1100	/*
1101	* Call out to the OS specific code and let it do permission checks on the
1102	* client process.
1103	*/
1104	if (!supdrvOSValidateClientProcess(pDevExt, pSession))
1105	{
1106	pReq->u.Out.u32Cookie = 0xffffffff;
1107	pReq->u.Out.u32SessionCookie = 0xffffffff;
1108	pReq->u.Out.u32SessionVersion = 0xffffffff;
1109	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1110	pReq->u.Out.pSession = NULL;
1111	pReq->u.Out.cFunctions = 0;
1112	pReq->Hdr.rc = VERR_PERMISSION_DENIED;
1113	return 0;
1114	}
1115	#endif
1116
1117	/*
1118	* Match the version.
1119	* The current logic is very simple, match the major interface version.
1120	*/
1121	if ( pReq->u.In.u32MinVersion > SUPDRV_IOC_VERSION
1122	\|\| (pReq->u.In.u32MinVersion & 0xffff0000) != (SUPDRV_IOC_VERSION & 0xffff0000))
1123	{
1124	OSDBGPRINT(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
1125	pReq->u.In.u32ReqVersion, pReq->u.In.u32MinVersion, SUPDRV_IOC_VERSION));
1126	pReq->u.Out.u32Cookie = 0xffffffff;
1127	pReq->u.Out.u32SessionCookie = 0xffffffff;
1128	pReq->u.Out.u32SessionVersion = 0xffffffff;
1129	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1130	pReq->u.Out.pSession = NULL;
1131	pReq->u.Out.cFunctions = 0;
1132	pReq->Hdr.rc = VERR_VERSION_MISMATCH;
1133	return 0;
1134	}
1135
1136	/*
1137	* Fill in return data and be gone.
1138	* N.B. The first one to change SUPDRV_IOC_VERSION shall makes sure that
1139	* u32SessionVersion <= u32ReqVersion!
1140	*/
1141	/** @todo Somehow validate the client and negotiate a secure cookie... */
1142	pReq->u.Out.u32Cookie = pDevExt->u32Cookie;
1143	pReq->u.Out.u32SessionCookie = pSession->u32Cookie;
1144	pReq->u.Out.u32SessionVersion = SUPDRV_IOC_VERSION;
1145	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1146	pReq->u.Out.pSession = pSession;
1147	pReq->u.Out.cFunctions = sizeof(g_aFunctions) / sizeof(g_aFunctions[0]);
1148	pReq->Hdr.rc = VINF_SUCCESS;
1149	return 0;
1150	}
1151
1152	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_QUERY_FUNCS(0)):
1153	{
1154	/* validate */
1155	PSUPQUERYFUNCS pReq = (PSUPQUERYFUNCS)pReqHdr;
1156	REQ_CHECK_SIZES_EX(SUP_IOCTL_QUERY_FUNCS, SUP_IOCTL_QUERY_FUNCS_SIZE_IN, SUP_IOCTL_QUERY_FUNCS_SIZE_OUT(RT_ELEMENTS(g_aFunctions)));
1157
1158	/* execute */
1159	pReq->u.Out.cFunctions = RT_ELEMENTS(g_aFunctions);
1160	memcpy(&pReq->u.Out.aFunctions[0], g_aFunctions, sizeof(g_aFunctions));
1161	pReq->Hdr.rc = VINF_SUCCESS;
1162	return 0;
1163	}
1164
1165	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_LOCK):
1166	{
1167	/* validate */
1168	PSUPPAGELOCK pReq = (PSUPPAGELOCK)pReqHdr;
1169	REQ_CHECK_SIZE_IN(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_IN);
1170	REQ_CHECK_SIZE_OUT(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_OUT(pReq->u.In.cPages));
1171	REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.cPages > 0);
1172	REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.pvR3 >= PAGE_SIZE);
1173
1174	/* execute */
1175	pReq->Hdr.rc = SUPR0LockMem(pSession, pReq->u.In.pvR3, pReq->u.In.cPages, &pReq->u.Out.aPages[0]);
1176	if (RT_FAILURE(pReq->Hdr.rc))
1177	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1178	return 0;
1179	}
1180
1181	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_UNLOCK):
1182	{
1183	/* validate */
1184	PSUPPAGEUNLOCK pReq = (PSUPPAGEUNLOCK)pReqHdr;
1185	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_UNLOCK);
1186
1187	/* execute */
1188	pReq->Hdr.rc = SUPR0UnlockMem(pSession, pReq->u.In.pvR3);
1189	return 0;
1190	}
1191
1192	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_ALLOC):
1193	{
1194	/* validate */
1195	PSUPCONTALLOC pReq = (PSUPCONTALLOC)pReqHdr;
1196	REQ_CHECK_SIZES(SUP_IOCTL_CONT_ALLOC);
1197
1198	/* execute */
1199	pReq->Hdr.rc = SUPR0ContAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.HCPhys);
1200	if (RT_FAILURE(pReq->Hdr.rc))
1201	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1202	return 0;
1203	}
1204
1205	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_FREE):
1206	{
1207	/* validate */
1208	PSUPCONTFREE pReq = (PSUPCONTFREE)pReqHdr;
1209	REQ_CHECK_SIZES(SUP_IOCTL_CONT_FREE);
1210
1211	/* execute */
1212	pReq->Hdr.rc = SUPR0ContFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1213	return 0;
1214	}
1215
1216	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_OPEN):
1217	{
1218	/* validate */
1219	PSUPLDROPEN pReq = (PSUPLDROPEN)pReqHdr;
1220	REQ_CHECK_SIZES(SUP_IOCTL_LDR_OPEN);
1221	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageWithTabs > 0);
1222	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageWithTabs < 16*_1M);
1223	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits > 0);
1224	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits > 0);
1225	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits < pReq->u.In.cbImageWithTabs);
1226	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.szName[0]);
1227	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, RTStrEnd(pReq->u.In.szName, sizeof(pReq->u.In.szName)));
1228	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, !supdrvCheckInvalidChar(pReq->u.In.szName, ";:()[]{}/\\\|&*%#@!~`\"'"));
1229	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, RTStrEnd(pReq->u.In.szFilename, sizeof(pReq->u.In.szFilename)));
1230
1231	/* execute */
1232	pReq->Hdr.rc = supdrvIOCtl_LdrOpen(pDevExt, pSession, pReq);
1233	return 0;
1234	}
1235
1236	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_LOAD):
1237	{
1238	/* validate */
1239	PSUPLDRLOAD pReq = (PSUPLDRLOAD)pReqHdr;
1240	REQ_CHECK_EXPR(Name, pReq->Hdr.cbIn >= sizeof(*pReq));
1241	REQ_CHECK_SIZES_EX(SUP_IOCTL_LDR_LOAD, SUP_IOCTL_LDR_LOAD_SIZE_IN(pReq->u.In.cbImageWithTabs), SUP_IOCTL_LDR_LOAD_SIZE_OUT);
1242	REQ_CHECK_EXPR(SUP_IOCTL_LDR_LOAD, pReq->u.In.cSymbols <= 16384);
1243	REQ_CHECK_EXPR_FMT( !pReq->u.In.cSymbols
1244	\|\| ( pReq->u.In.offSymbols < pReq->u.In.cbImageWithTabs
1245	&& pReq->u.In.offSymbols + pReq->u.In.cSymbols * sizeof(SUPLDRSYM) <= pReq->u.In.cbImageWithTabs),
1246	("SUP_IOCTL_LDR_LOAD: offSymbols=%#lx cSymbols=%#lx cbImageWithTabs=%#lx\n", (long)pReq->u.In.offSymbols,
1247	(long)pReq->u.In.cSymbols, (long)pReq->u.In.cbImageWithTabs));
1248	REQ_CHECK_EXPR_FMT( !pReq->u.In.cbStrTab
1249	\|\| ( pReq->u.In.offStrTab < pReq->u.In.cbImageWithTabs
1250	&& pReq->u.In.offStrTab + pReq->u.In.cbStrTab <= pReq->u.In.cbImageWithTabs
1251	&& pReq->u.In.cbStrTab <= pReq->u.In.cbImageWithTabs),
1252	("SUP_IOCTL_LDR_LOAD: offStrTab=%#lx cbStrTab=%#lx cbImageWithTabs=%#lx\n", (long)pReq->u.In.offStrTab,
1253	(long)pReq->u.In.cbStrTab, (long)pReq->u.In.cbImageWithTabs));
1254
1255	if (pReq->u.In.cSymbols)
1256	{
1257	uint32_t i;
1258	PSUPLDRSYM paSyms = (PSUPLDRSYM)&pReq->u.In.abImage[pReq->u.In.offSymbols];
1259	for (i = 0; i < pReq->u.In.cSymbols; i++)
1260	{
1261	REQ_CHECK_EXPR_FMT(paSyms[i].offSymbol < pReq->u.In.cbImageWithTabs,
1262	("SUP_IOCTL_LDR_LOAD: sym #%ld: symb off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offSymbol, (long)pReq->u.In.cbImageWithTabs));
1263	REQ_CHECK_EXPR_FMT(paSyms[i].offName < pReq->u.In.cbStrTab,
1264	("SUP_IOCTL_LDR_LOAD: sym #%ld: name off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithTabs));
1265	REQ_CHECK_EXPR_FMT(RTStrEnd((char const *)&pReq->u.In.abImage[pReq->u.In.offStrTab + paSyms[i].offName],
1266	pReq->u.In.cbStrTab - paSyms[i].offName),
1267	("SUP_IOCTL_LDR_LOAD: sym #%ld: unterminated name! (%#lx / %#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithTabs));
1268	}
1269	}
1270
1271	/* execute */
1272	pReq->Hdr.rc = supdrvIOCtl_LdrLoad(pDevExt, pSession, pReq);
1273	return 0;
1274	}
1275
1276	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_FREE):
1277	{
1278	/* validate */
1279	PSUPLDRFREE pReq = (PSUPLDRFREE)pReqHdr;
1280	REQ_CHECK_SIZES(SUP_IOCTL_LDR_FREE);
1281
1282	/* execute */
1283	pReq->Hdr.rc = supdrvIOCtl_LdrFree(pDevExt, pSession, pReq);
1284	return 0;
1285	}
1286
1287	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_GET_SYMBOL):
1288	{
1289	/* validate */
1290	PSUPLDRGETSYMBOL pReq = (PSUPLDRGETSYMBOL)pReqHdr;
1291	REQ_CHECK_SIZES(SUP_IOCTL_LDR_GET_SYMBOL);
1292	REQ_CHECK_EXPR(SUP_IOCTL_LDR_GET_SYMBOL, RTStrEnd(pReq->u.In.szSymbol, sizeof(pReq->u.In.szSymbol)));
1293
1294	/* execute */
1295	pReq->Hdr.rc = supdrvIOCtl_LdrGetSymbol(pDevExt, pSession, pReq);
1296	return 0;
1297	}
1298
1299	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_VMMR0(0)):
1300	{
1301	/* validate */
1302	PSUPCALLVMMR0 pReq = (PSUPCALLVMMR0)pReqHdr;
1303	Log4(("SUP_IOCTL_CALL_VMMR0: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1304	pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1305
1306	if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_VMMR0_SIZE(0))
1307	{
1308	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(0), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(0));
1309
1310	/* execute */
1311	if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1312	pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, NULL, pReq->u.In.u64Arg, pSession);
1313	else
1314	pReq->Hdr.rc = VERR_WRONG_ORDER;
1315	}
1316	else
1317	{
1318	PSUPVMMR0REQHDR pVMMReq = (PSUPVMMR0REQHDR)&pReq->abReqPkt[0];
1319	REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR)),
1320	("SUP_IOCTL_CALL_VMMR0: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR))));
1321	REQ_CHECK_EXPR(SUP_IOCTL_CALL_VMMR0, pVMMReq->u32Magic == SUPVMMR0REQHDR_MAGIC);
1322	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(pVMMReq->cbReq), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(pVMMReq->cbReq));
1323
1324	/* execute */
1325	if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1326	pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1327	else
1328	pReq->Hdr.rc = VERR_WRONG_ORDER;
1329	}
1330
1331	if ( RT_FAILURE(pReq->Hdr.rc)
1332	&& pReq->Hdr.rc != VERR_INTERRUPTED
1333	&& pReq->Hdr.rc != VERR_TIMEOUT)
1334	Log(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1335	pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1336	else
1337	Log4(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1338	pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1339	return 0;
1340	}
1341
1342	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GET_PAGING_MODE):
1343	{
1344	/* validate */
1345	PSUPGETPAGINGMODE pReq = (PSUPGETPAGINGMODE)pReqHdr;
1346	REQ_CHECK_SIZES(SUP_IOCTL_GET_PAGING_MODE);
1347
1348	/* execute */
1349	pReq->Hdr.rc = VINF_SUCCESS;
1350	pReq->u.Out.enmMode = SUPR0GetPagingMode();
1351	return 0;
1352	}
1353
1354	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_ALLOC):
1355	{
1356	/* validate */
1357	PSUPLOWALLOC pReq = (PSUPLOWALLOC)pReqHdr;
1358	REQ_CHECK_EXPR(SUP_IOCTL_LOW_ALLOC, pReq->Hdr.cbIn <= SUP_IOCTL_LOW_ALLOC_SIZE_IN);
1359	REQ_CHECK_SIZES_EX(SUP_IOCTL_LOW_ALLOC, SUP_IOCTL_LOW_ALLOC_SIZE_IN, SUP_IOCTL_LOW_ALLOC_SIZE_OUT(pReq->u.In.cPages));
1360
1361	/* execute */
1362	pReq->Hdr.rc = SUPR0LowAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.aPages[0]);
1363	if (RT_FAILURE(pReq->Hdr.rc))
1364	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1365	return 0;
1366	}
1367
1368	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_FREE):
1369	{
1370	/* validate */
1371	PSUPLOWFREE pReq = (PSUPLOWFREE)pReqHdr;
1372	REQ_CHECK_SIZES(SUP_IOCTL_LOW_FREE);
1373
1374	/* execute */
1375	pReq->Hdr.rc = SUPR0LowFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1376	return 0;
1377	}
1378
1379	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_MAP):
1380	{
1381	/* validate */
1382	PSUPGIPMAP pReq = (PSUPGIPMAP)pReqHdr;
1383	REQ_CHECK_SIZES(SUP_IOCTL_GIP_MAP);
1384
1385	/* execute */
1386	pReq->Hdr.rc = SUPR0GipMap(pSession, &pReq->u.Out.pGipR3, &pReq->u.Out.HCPhysGip);
1387	if (RT_SUCCESS(pReq->Hdr.rc))
1388	pReq->u.Out.pGipR0 = pDevExt->pGip;
1389	return 0;
1390	}
1391
1392	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_UNMAP):
1393	{
1394	/* validate */
1395	PSUPGIPUNMAP pReq = (PSUPGIPUNMAP)pReqHdr;
1396	REQ_CHECK_SIZES(SUP_IOCTL_GIP_UNMAP);
1397
1398	/* execute */
1399	pReq->Hdr.rc = SUPR0GipUnmap(pSession);
1400	return 0;
1401	}
1402
1403	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SET_VM_FOR_FAST):
1404	{
1405	/* validate */
1406	PSUPSETVMFORFAST pReq = (PSUPSETVMFORFAST)pReqHdr;
1407	REQ_CHECK_SIZES(SUP_IOCTL_SET_VM_FOR_FAST);
1408	REQ_CHECK_EXPR_FMT( !pReq->u.In.pVMR0
1409	\|\| ( VALID_PTR(pReq->u.In.pVMR0)
1410	&& !((uintptr_t)pReq->u.In.pVMR0 & (PAGE_SIZE - 1))),
1411	("SUP_IOCTL_SET_VM_FOR_FAST: pVMR0=%p!\n", pReq->u.In.pVMR0));
1412	/* execute */
1413	pSession->pVM = pReq->u.In.pVMR0;
1414	pReq->Hdr.rc = VINF_SUCCESS;
1415	return 0;
1416	}
1417
1418	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_ALLOC_EX):
1419	{
1420	/* validate */
1421	PSUPPAGEALLOCEX pReq = (PSUPPAGEALLOCEX)pReqHdr;
1422	REQ_CHECK_EXPR(SUP_IOCTL_PAGE_ALLOC_EX, pReq->Hdr.cbIn <= SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN);
1423	REQ_CHECK_SIZES_EX(SUP_IOCTL_PAGE_ALLOC_EX, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_OUT(pReq->u.In.cPages));
1424	REQ_CHECK_EXPR_FMT(pReq->u.In.fKernelMapping \|\| pReq->u.In.fUserMapping,
1425	("SUP_IOCTL_PAGE_ALLOC_EX: No mapping requested!\n"));
1426	REQ_CHECK_EXPR_FMT(pReq->u.In.fUserMapping,
1427	("SUP_IOCTL_PAGE_ALLOC_EX: Must have user mapping!\n"));
1428	REQ_CHECK_EXPR_FMT(!pReq->u.In.fReserved0 && !pReq->u.In.fReserved1,
1429	("SUP_IOCTL_PAGE_ALLOC_EX: fReserved0=%d fReserved1=%d\n", pReq->u.In.fReserved0, pReq->u.In.fReserved1));
1430
1431	/* execute */
1432	pReq->Hdr.rc = SUPR0PageAllocEx(pSession, pReq->u.In.cPages, 0 /* fFlags */,
1433	pReq->u.In.fUserMapping ? &pReq->u.Out.pvR3 : NULL,
1434	pReq->u.In.fKernelMapping ? &pReq->u.Out.pvR0 : NULL,
1435	&pReq->u.Out.aPages[0]);
1436	if (RT_FAILURE(pReq->Hdr.rc))
1437	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1438	return 0;
1439	}
1440
1441	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_MAP_KERNEL):
1442	{
1443	/* validate */
1444	PSUPPAGEMAPKERNEL pReq = (PSUPPAGEMAPKERNEL)pReqHdr;
1445	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_MAP_KERNEL);
1446	REQ_CHECK_EXPR_FMT(!pReq->u.In.fFlags, ("SUP_IOCTL_PAGE_MAP_KERNEL: fFlags=%#x! MBZ\n", pReq->u.In.fFlags));
1447	REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_MAP_KERNEL: offSub=%#x\n", pReq->u.In.offSub));
1448	REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
1449	("SUP_IOCTL_PAGE_MAP_KERNEL: cbSub=%#x\n", pReq->u.In.cbSub));
1450
1451	/* execute */
1452	pReq->Hdr.rc = SUPR0PageMapKernel(pSession, pReq->u.In.pvR3, pReq->u.In.offSub, pReq->u.In.cbSub,
1453	pReq->u.In.fFlags, &pReq->u.Out.pvR0);
1454	if (RT_FAILURE(pReq->Hdr.rc))
1455	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1456	return 0;
1457	}
1458
1459	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_PROTECT):
1460	{
1461	/* validate */
1462	PSUPPAGEPROTECT pReq = (PSUPPAGEPROTECT)pReqHdr;
1463	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_PROTECT);
1464	REQ_CHECK_EXPR_FMT(!(pReq->u.In.fProt & ~(RTMEM_PROT_READ \| RTMEM_PROT_WRITE \| RTMEM_PROT_EXEC \| RTMEM_PROT_NONE)),
1465	("SUP_IOCTL_PAGE_PROTECT: fProt=%#x!\n", pReq->u.In.fProt));
1466	REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_PROTECT: offSub=%#x\n", pReq->u.In.offSub));
1467	REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
1468	("SUP_IOCTL_PAGE_PROTECT: cbSub=%#x\n", pReq->u.In.cbSub));
1469
1470	/* execute */
1471	pReq->Hdr.rc = SUPR0PageProtect(pSession, pReq->u.In.pvR3, pReq->u.In.pvR0, pReq->u.In.offSub, pReq->u.In.cbSub, pReq->u.In.fProt);
1472	return 0;
1473	}
1474
1475	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_FREE):
1476	{
1477	/* validate */
1478	PSUPPAGEFREE pReq = (PSUPPAGEFREE)pReqHdr;
1479	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_FREE);
1480
1481	/* execute */
1482	pReq->Hdr.rc = SUPR0PageFree(pSession, pReq->u.In.pvR3);
1483	return 0;
1484	}
1485
1486	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_SERVICE(0)):
1487	{
1488	/* validate */
1489	PSUPCALLSERVICE pReq = (PSUPCALLSERVICE)pReqHdr;
1490	Log4(("SUP_IOCTL_CALL_SERVICE: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1491	pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1492
1493	if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
1494	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(0), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(0));
1495	else
1496	{
1497	PSUPR0SERVICEREQHDR pSrvReq = (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0];
1498	REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR)),
1499	("SUP_IOCTL_CALL_SERVICE: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR))));
1500	REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, pSrvReq->u32Magic == SUPR0SERVICEREQHDR_MAGIC);
1501	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(pSrvReq->cbReq), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(pSrvReq->cbReq));
1502	}
1503	REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, RTStrEnd(pReq->u.In.szName, sizeof(pReq->u.In.szName)));
1504
1505	/* execute */
1506	pReq->Hdr.rc = supdrvIOCtl_CallServiceModule(pDevExt, pSession, pReq);
1507	return 0;
1508	}
1509
1510	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOGGER_SETTINGS(0)):
1511	{
1512	/* validate */
1513	PSUPLOGGERSETTINGS pReq = (PSUPLOGGERSETTINGS)pReqHdr;
1514	size_t cbStrTab;
1515	REQ_CHECK_SIZE_OUT(SUP_IOCTL_LOGGER_SETTINGS, SUP_IOCTL_LOGGER_SETTINGS_SIZE_OUT);
1516	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->Hdr.cbIn >= SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(1));
1517	cbStrTab = pReq->Hdr.cbIn - SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(0);
1518	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offGroups < cbStrTab);
1519	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offFlags < cbStrTab);
1520	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offDestination < cbStrTab);
1521	REQ_CHECK_EXPR_FMT(pReq->u.In.szStrings[cbStrTab - 1] == '\0',
1522	("SUP_IOCTL_LOGGER_SETTINGS: cbIn=%#x cbStrTab=%#zx LastChar=%d\n",
1523	pReq->Hdr.cbIn, cbStrTab, pReq->u.In.szStrings[cbStrTab - 1]));
1524	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhich <= SUPLOGGERSETTINGS_WHICH_RELEASE);
1525	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhat <= SUPLOGGERSETTINGS_WHAT_DESTROY);
1526
1527	/* execute */
1528	pReq->Hdr.rc = supdrvIOCtl_LoggerSettings(pDevExt, pSession, pReq);
1529	return 0;
1530	}
1531
1532	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_CREATE):
1533	{
1534	/* validate */
1535	PSUPSEMCREATE pReq = (PSUPSEMCREATE)pReqHdr;
1536	REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_CREATE, SUP_IOCTL_SEM_CREATE_SIZE_IN, SUP_IOCTL_SEM_CREATE_SIZE_OUT);
1537
1538	/* execute */
1539	switch (pReq->u.In.uType)
1540	{
1541	case SUP_SEM_TYPE_EVENT:
1542	{
1543	SUPSEMEVENT hEvent;
1544	pReq->Hdr.rc = SUPSemEventCreate(pSession, &hEvent);
1545	pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEvent;
1546	break;
1547	}
1548
1549	case SUP_SEM_TYPE_EVENT_MULTI:
1550	{
1551	SUPSEMEVENTMULTI hEventMulti;
1552	pReq->Hdr.rc = SUPSemEventMultiCreate(pSession, &hEventMulti);
1553	pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEventMulti;
1554	break;
1555	}
1556
1557	default:
1558	pReq->Hdr.rc = VERR_INVALID_PARAMETER;
1559	break;
1560	}
1561	return 0;
1562	}
1563
1564	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_OP):
1565	{
1566	/* validate */
1567	PSUPSEMOP pReq = (PSUPSEMOP)pReqHdr;
1568	REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_OP, SUP_IOCTL_SEM_OP_SIZE_IN, SUP_IOCTL_SEM_OP_SIZE_OUT);
1569
1570	/* execute */
1571	switch (pReq->u.In.uType)
1572	{
1573	case SUP_SEM_TYPE_EVENT:
1574	{
1575	SUPSEMEVENT hEvent = (SUPSEMEVENT)(uintptr_t)pReq->u.In.hSem;
1576	switch (pReq->u.In.uOp)
1577	{
1578	case SUPSEMOP_WAIT:
1579	pReq->Hdr.rc = SUPSemEventWaitNoResume(pSession, hEvent, pReq->u.In.cMillies);
1580	break;
1581	case SUPSEMOP_SIGNAL:
1582	pReq->Hdr.rc = SUPSemEventSignal(pSession, hEvent);
1583	break;
1584	case SUPSEMOP_CLOSE:
1585	pReq->Hdr.rc = SUPSemEventClose(pSession, hEvent);
1586	break;
1587	case SUPSEMOP_RESET:
1588	default:
1589	pReq->Hdr.rc = VERR_INVALID_FUNCTION;
1590	break;
1591	}
1592	break;
1593	}
1594
1595	case SUP_SEM_TYPE_EVENT_MULTI:
1596	{
1597	SUPSEMEVENTMULTI hEventMulti = (SUPSEMEVENTMULTI)(uintptr_t)pReq->u.In.hSem;
1598	switch (pReq->u.In.uOp)
1599	{
1600	case SUPSEMOP_WAIT:
1601	pReq->Hdr.rc = SUPSemEventMultiWaitNoResume(pSession, hEventMulti, pReq->u.In.cMillies);
1602	break;
1603	case SUPSEMOP_SIGNAL:
1604	pReq->Hdr.rc = SUPSemEventMultiSignal(pSession, hEventMulti);
1605	break;
1606	case SUPSEMOP_CLOSE:
1607	pReq->Hdr.rc = SUPSemEventMultiClose(pSession, hEventMulti);
1608	break;
1609	case SUPSEMOP_RESET:
1610	pReq->Hdr.rc = SUPSemEventMultiReset(pSession, hEventMulti);
1611	break;
1612	default:
1613	pReq->Hdr.rc = VERR_INVALID_FUNCTION;
1614	break;
1615	}
1616	break;
1617	}
1618
1619	default:
1620	pReq->Hdr.rc = VERR_INVALID_PARAMETER;
1621	break;
1622	}
1623	return 0;
1624	}
1625
1626	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_VT_CAPS):
1627	{
1628	/* validate */
1629	PSUPVTCAPS pReq = (PSUPVTCAPS)pReqHdr;
1630	REQ_CHECK_SIZES(SUP_IOCTL_VT_CAPS);
1631	REQ_CHECK_EXPR(SUP_IOCTL_VT_CAPS, pReq->Hdr.cbIn <= SUP_IOCTL_VT_CAPS_SIZE_IN);
1632
1633	/* execute */
1634	pReq->Hdr.rc = SUPR0QueryVTCaps(pSession, &pReq->u.Out.Caps);
1635	if (RT_FAILURE(pReq->Hdr.rc))
1636	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1637	return 0;
1638	}
1639
1640	default:
1641	Log(("Unknown IOCTL %#lx\n", (long)uIOCtl));
1642	break;
1643	}
1644	return VERR_GENERAL_FAILURE;
1645	}
1646
1647
1648	/**
1649	* Inter-Driver Communcation (IDC) worker.
1650	*
1651	* @returns VBox status code.
1652	* @retval VINF_SUCCESS on success.
1653	* @retval VERR_INVALID_PARAMETER if the request is invalid.
1654	* @retval VERR_NOT_SUPPORTED if the request isn't supported.
1655	*
1656	* @param uReq The request (function) code.
1657	* @param pDevExt Device extention.
1658	* @param pSession Session data.
1659	* @param pReqHdr The request header.
1660	*/
1661	int VBOXCALL supdrvIDC(uintptr_t uReq, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQHDR pReqHdr)
1662	{
1663	/*
1664	* The OS specific code has already validated the pSession
1665	* pointer, and the request size being greater or equal to
1666	* size of the header.
1667	*
1668	* So, just check that pSession is a kernel context session.
1669	*/
1670	if (RT_UNLIKELY( pSession
1671	&& pSession->R0Process != NIL_RTR0PROCESS))
1672	return VERR_INVALID_PARAMETER;
1673
1674	/*
1675	* Validation macro.
1676	*/
1677	#define REQ_CHECK_IDC_SIZE(Name, cbExpect) \
1678	do { \
1679	if (RT_UNLIKELY(pReqHdr->cb != (cbExpect))) \
1680	{ \
1681	OSDBGPRINT(( #Name ": Invalid input/output sizes. cb=%ld expected %ld.\n", \
1682	(long)pReqHdr->cb, (long)(cbExpect))); \
1683	return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1684	} \
1685	} while (0)
1686
1687	switch (uReq)
1688	{
1689	case SUPDRV_IDC_REQ_CONNECT:
1690	{
1691	PSUPDRVIDCREQCONNECT pReq = (PSUPDRVIDCREQCONNECT)pReqHdr;
1692	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_CONNECT, sizeof(*pReq));
1693
1694	/*
1695	* Validate the cookie and other input.
1696	*/
1697	if (pReq->Hdr.pSession != NULL)
1698	{
1699	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: pSession=%p expected NULL!\n", pReq->Hdr.pSession));
1700	return pReqHdr->rc = VERR_INVALID_PARAMETER;
1701	}
1702	if (pReq->u.In.u32MagicCookie != SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE)
1703	{
1704	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: u32MagicCookie=%#x expected %#x!\n",
1705	(unsigned)pReq->u.In.u32MagicCookie, (unsigned)SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE));
1706	return pReqHdr->rc = VERR_INVALID_PARAMETER;
1707	}
1708	if ( pReq->u.In.uMinVersion > pReq->u.In.uReqVersion
1709	\|\| (pReq->u.In.uMinVersion & UINT32_C(0xffff0000)) != (pReq->u.In.uReqVersion & UINT32_C(0xffff0000)))
1710	{
1711	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: uMinVersion=%#x uMaxVersion=%#x doesn't match!\n",
1712	pReq->u.In.uMinVersion, pReq->u.In.uReqVersion));
1713	return pReqHdr->rc = VERR_INVALID_PARAMETER;
1714	}
1715
1716	/*
1717	* Match the version.
1718	* The current logic is very simple, match the major interface version.
1719	*/
1720	if ( pReq->u.In.uMinVersion > SUPDRV_IDC_VERSION
1721	\|\| (pReq->u.In.uMinVersion & 0xffff0000) != (SUPDRV_IDC_VERSION & 0xffff0000))
1722	{
1723	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
1724	pReq->u.In.uReqVersion, pReq->u.In.uMinVersion, (unsigned)SUPDRV_IDC_VERSION));
1725	pReq->u.Out.pSession = NULL;
1726	pReq->u.Out.uSessionVersion = 0xffffffff;
1727	pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
1728	pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
1729	pReq->Hdr.rc = VERR_VERSION_MISMATCH;
1730	return VINF_SUCCESS;
1731	}
1732
1733	pReq->u.Out.pSession = NULL;
1734	pReq->u.Out.uSessionVersion = SUPDRV_IDC_VERSION;
1735	pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
1736	pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
1737
1738	/*
1739	* On NT we will already have a session associated with the
1740	* client, just like with the SUP_IOCTL_COOKIE request, while
1741	* the other doesn't.
1742	*/
1743	#ifdef RT_OS_WINDOWS
1744	pReq->Hdr.rc = VINF_SUCCESS;
1745	#else
1746	AssertReturn(!pSession, VERR_INTERNAL_ERROR);
1747	pReq->Hdr.rc = supdrvCreateSession(pDevExt, false /* fUser */, &pSession);
1748	if (RT_FAILURE(pReq->Hdr.rc))
1749	{
1750	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: failed to create session, rc=%d\n", pReq->Hdr.rc));
1751	return VINF_SUCCESS;
1752	}
1753	#endif
1754
1755	pReq->u.Out.pSession = pSession;
1756	pReq->Hdr.pSession = pSession;
1757
1758	return VINF_SUCCESS;
1759	}
1760
1761	case SUPDRV_IDC_REQ_DISCONNECT:
1762	{
1763	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_DISCONNECT, sizeof(*pReqHdr));
1764
1765	#ifdef RT_OS_WINDOWS
1766	/* Windows will destroy the session when the file object is destroyed. */
1767	#else
1768	supdrvCloseSession(pDevExt, pSession);
1769	#endif
1770	return pReqHdr->rc = VINF_SUCCESS;
1771	}
1772
1773	case SUPDRV_IDC_REQ_GET_SYMBOL:
1774	{
1775	PSUPDRVIDCREQGETSYM pReq = (PSUPDRVIDCREQGETSYM)pReqHdr;
1776	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_GET_SYMBOL, sizeof(*pReq));
1777
1778	pReq->Hdr.rc = supdrvIDC_LdrGetSymbol(pDevExt, pSession, pReq);
1779	return VINF_SUCCESS;
1780	}
1781
1782	case SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY:
1783	{
1784	PSUPDRVIDCREQCOMPREGFACTORY pReq = (PSUPDRVIDCREQCOMPREGFACTORY)pReqHdr;
1785	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY, sizeof(*pReq));
1786
1787	pReq->Hdr.rc = SUPR0ComponentRegisterFactory(pSession, pReq->u.In.pFactory);
1788	return VINF_SUCCESS;
1789	}
1790
1791	case SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY:
1792	{
1793	PSUPDRVIDCREQCOMPDEREGFACTORY pReq = (PSUPDRVIDCREQCOMPDEREGFACTORY)pReqHdr;
1794	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY, sizeof(*pReq));
1795
1796	pReq->Hdr.rc = SUPR0ComponentDeregisterFactory(pSession, pReq->u.In.pFactory);
1797	return VINF_SUCCESS;
1798	}
1799
1800	default:
1801	Log(("Unknown IDC %#lx\n", (long)uReq));
1802	break;
1803	}
1804
1805	#undef REQ_CHECK_IDC_SIZE
1806	return VERR_NOT_SUPPORTED;
1807	}
1808
1809
1810	/**
1811	* Register a object for reference counting.
1812	* The object is registered with one reference in the specified session.
1813	*
1814	* @returns Unique identifier on success (pointer).
1815	* All future reference must use this identifier.
1816	* @returns NULL on failure.
1817	* @param pfnDestructor The destructore function which will be called when the reference count reaches 0.
1818	* @param pvUser1 The first user argument.
1819	* @param pvUser2 The second user argument.
1820	*/
1821	SUPR0DECL(void ) SUPR0ObjRegister(PSUPDRVSESSION pSession, SUPDRVOBJTYPE enmType, PFNSUPDRVDESTRUCTOR pfnDestructor, void pvUser1, void *pvUser2)
1822	{
1823	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1824	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1825	PSUPDRVOBJ pObj;
1826	PSUPDRVUSAGE pUsage;
1827
1828	/*
1829	* Validate the input.
1830	*/
1831	AssertReturn(SUP_IS_SESSION_VALID(pSession), NULL);
1832	AssertReturn(enmType > SUPDRVOBJTYPE_INVALID && enmType < SUPDRVOBJTYPE_END, NULL);
1833	AssertPtrReturn(pfnDestructor, NULL);
1834
1835	/*
1836	* Allocate and initialize the object.
1837	*/
1838	pObj = (PSUPDRVOBJ)RTMemAlloc(sizeof(*pObj));
1839	if (!pObj)
1840	return NULL;
1841	pObj->u32Magic = SUPDRVOBJ_MAGIC;
1842	pObj->enmType = enmType;
1843	pObj->pNext = NULL;
1844	pObj->cUsage = 1;
1845	pObj->pfnDestructor = pfnDestructor;
1846	pObj->pvUser1 = pvUser1;
1847	pObj->pvUser2 = pvUser2;
1848	pObj->CreatorUid = pSession->Uid;
1849	pObj->CreatorGid = pSession->Gid;
1850	pObj->CreatorProcess= pSession->Process;
1851	supdrvOSObjInitCreator(pObj, pSession);
1852
1853	/*
1854	* Allocate the usage record.
1855	* (We keep freed usage records around to simplify SUPR0ObjAddRefEx().)
1856	*/
1857	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1858
1859	pUsage = pDevExt->pUsageFree;
1860	if (pUsage)
1861	pDevExt->pUsageFree = pUsage->pNext;
1862	else
1863	{
1864	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1865	pUsage = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsage));
1866	if (!pUsage)
1867	{
1868	RTMemFree(pObj);
1869	return NULL;
1870	}
1871	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1872	}
1873
1874	/*
1875	* Insert the object and create the session usage record.
1876	*/
1877	/* The object. */
1878	pObj->pNext = pDevExt->pObjs;
1879	pDevExt->pObjs = pObj;
1880
1881	/* The session record. */
1882	pUsage->cUsage = 1;
1883	pUsage->pObj = pObj;
1884	pUsage->pNext = pSession->pUsage;
1885	/* Log2(("SUPR0ObjRegister: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext)); */
1886	pSession->pUsage = pUsage;
1887
1888	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1889
1890	Log(("SUPR0ObjRegister: returns %p (pvUser1=%p, pvUser=%p)\n", pObj, pvUser1, pvUser2));
1891	return pObj;
1892	}
1893
1894
1895	/**
1896	* Increment the reference counter for the object associating the reference
1897	* with the specified session.
1898	*
1899	* @returns IPRT status code.
1900	* @param pvObj The identifier returned by SUPR0ObjRegister().
1901	* @param pSession The session which is referencing the object.
1902	*
1903	* @remarks The caller should not own any spinlocks and must carefully protect
1904	* itself against potential race with the destructor so freed memory
1905	* isn't accessed here.
1906	*/
1907	SUPR0DECL(int) SUPR0ObjAddRef(void *pvObj, PSUPDRVSESSION pSession)
1908	{
1909	return SUPR0ObjAddRefEx(pvObj, pSession, false /* fNoBlocking */);
1910	}
1911
1912
1913	/**
1914	* Increment the reference counter for the object associating the reference
1915	* with the specified session.
1916	*
1917	* @returns IPRT status code.
1918	* @retval VERR_TRY_AGAIN if fNoBlocking was set and a new usage record
1919	* couldn't be allocated. (If you see this you're not doing the right
1920	* thing and it won't ever work reliably.)
1921	*
1922	* @param pvObj The identifier returned by SUPR0ObjRegister().
1923	* @param pSession The session which is referencing the object.
1924	* @param fNoBlocking Set if it's not OK to block. Never try to make the
1925	* first reference to an object in a session with this
1926	* argument set.
1927	*
1928	* @remarks The caller should not own any spinlocks and must carefully protect
1929	* itself against potential race with the destructor so freed memory
1930	* isn't accessed here.
1931	*/
1932	SUPR0DECL(int) SUPR0ObjAddRefEx(void *pvObj, PSUPDRVSESSION pSession, bool fNoBlocking)
1933	{
1934	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1935	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1936	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
1937	int rc = VINF_SUCCESS;
1938	PSUPDRVUSAGE pUsagePre;
1939	PSUPDRVUSAGE pUsage;
1940
1941	/*
1942	* Validate the input.
1943	* Be ready for the destruction race (someone might be stuck in the
1944	* destructor waiting a lock we own).
1945	*/
1946	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
1947	AssertPtrReturn(pObj, VERR_INVALID_POINTER);
1948	AssertMsgReturn(pObj->u32Magic == SUPDRVOBJ_MAGIC \|\| pObj->u32Magic == SUPDRVOBJ_MAGIC_DEAD,
1949	("Invalid pvObj=%p magic=%#x (expected %#x or %#x)\n", pvObj, pObj->u32Magic, SUPDRVOBJ_MAGIC, SUPDRVOBJ_MAGIC_DEAD),
1950	VERR_INVALID_PARAMETER);
1951
1952	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1953
1954	if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
1955	{
1956	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1957
1958	AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
1959	return VERR_WRONG_ORDER;
1960	}
1961
1962	/*
1963	* Preallocate the usage record if we can.
1964	*/
1965	pUsagePre = pDevExt->pUsageFree;
1966	if (pUsagePre)
1967	pDevExt->pUsageFree = pUsagePre->pNext;
1968	else if (!fNoBlocking)
1969	{
1970	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1971	pUsagePre = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsagePre));
1972	if (!pUsagePre)
1973	return VERR_NO_MEMORY;
1974
1975	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1976	if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
1977	{
1978	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1979
1980	AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
1981	return VERR_WRONG_ORDER;
1982	}
1983	}
1984
1985	/*
1986	* Reference the object.
1987	*/
1988	pObj->cUsage++;
1989
1990	/*
1991	* Look for the session record.
1992	*/
1993	for (pUsage = pSession->pUsage; pUsage; pUsage = pUsage->pNext)
1994	{
1995	/Log(("SUPR0AddRef: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));/
1996	if (pUsage->pObj == pObj)
1997	break;
1998	}
1999	if (pUsage)
2000	pUsage->cUsage++;
2001	else if (pUsagePre)
2002	{
2003	/* create a new session record. */
2004	pUsagePre->cUsage = 1;
2005	pUsagePre->pObj = pObj;
2006	pUsagePre->pNext = pSession->pUsage;
2007	pSession->pUsage = pUsagePre;
2008	/Log(("SUPR0AddRef: pUsagePre=%p:{.pObj=%p, .pNext=%p}\n", pUsagePre, pUsagePre->pObj, pUsagePre->pNext));/
2009
2010	pUsagePre = NULL;
2011	}
2012	else
2013	{
2014	pObj->cUsage--;
2015	rc = VERR_TRY_AGAIN;
2016	}
2017
2018	/*
2019	* Put any unused usage record into the free list..
2020	*/
2021	if (pUsagePre)
2022	{
2023	pUsagePre->pNext = pDevExt->pUsageFree;
2024	pDevExt->pUsageFree = pUsagePre;
2025	}
2026
2027	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2028
2029	return rc;
2030	}
2031
2032
2033	/**
2034	* Decrement / destroy a reference counter record for an object.
2035	*
2036	* The object is uniquely identified by pfnDestructor+pvUser1+pvUser2.
2037	*
2038	* @returns IPRT status code.
2039	* @retval VINF_SUCCESS if not destroyed.
2040	* @retval VINF_OBJECT_DESTROYED if it's destroyed by this release call.
2041	* @retval VERR_INVALID_PARAMETER if the object isn't valid. Will assert in
2042	* string builds.
2043	*
2044	* @param pvObj The identifier returned by SUPR0ObjRegister().
2045	* @param pSession The session which is referencing the object.
2046	*/
2047	SUPR0DECL(int) SUPR0ObjRelease(void *pvObj, PSUPDRVSESSION pSession)
2048	{
2049	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2050	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2051	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2052	int rc = VERR_INVALID_PARAMETER;
2053	PSUPDRVUSAGE pUsage;
2054	PSUPDRVUSAGE pUsagePrev;
2055
2056	/*
2057	* Validate the input.
2058	*/
2059	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2060	AssertMsgReturn(VALID_PTR(pObj) && pObj->u32Magic == SUPDRVOBJ_MAGIC,
2061	("Invalid pvObj=%p magic=%#x (exepcted %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
2062	VERR_INVALID_PARAMETER);
2063
2064	/*
2065	* Acquire the spinlock and look for the usage record.
2066	*/
2067	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
2068
2069	for (pUsagePrev = NULL, pUsage = pSession->pUsage;
2070	pUsage;
2071	pUsagePrev = pUsage, pUsage = pUsage->pNext)
2072	{
2073	/Log2(("SUPR0ObjRelease: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));/
2074	if (pUsage->pObj == pObj)
2075	{
2076	rc = VINF_SUCCESS;
2077	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
2078	if (pUsage->cUsage > 1)
2079	{
2080	pObj->cUsage--;
2081	pUsage->cUsage--;
2082	}
2083	else
2084	{
2085	/*
2086	* Free the session record.
2087	*/
2088	if (pUsagePrev)
2089	pUsagePrev->pNext = pUsage->pNext;
2090	else
2091	pSession->pUsage = pUsage->pNext;
2092	pUsage->pNext = pDevExt->pUsageFree;
2093	pDevExt->pUsageFree = pUsage;
2094
2095	/* What about the object? */
2096	if (pObj->cUsage > 1)
2097	pObj->cUsage--;
2098	else
2099	{
2100	/*
2101	* Object is to be destroyed, unlink it.
2102	*/
2103	pObj->u32Magic = SUPDRVOBJ_MAGIC_DEAD;
2104	rc = VINF_OBJECT_DESTROYED;
2105	if (pDevExt->pObjs == pObj)
2106	pDevExt->pObjs = pObj->pNext;
2107	else
2108	{
2109	PSUPDRVOBJ pObjPrev;
2110	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
2111	if (pObjPrev->pNext == pObj)
2112	{
2113	pObjPrev->pNext = pObj->pNext;
2114	break;
2115	}
2116	Assert(pObjPrev);
2117	}
2118	}
2119	}
2120	break;
2121	}
2122	}
2123
2124	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2125
2126	/*
2127	* Call the destructor and free the object if required.
2128	*/
2129	if (rc == VINF_OBJECT_DESTROYED)
2130	{
2131	Log(("SUPR0ObjRelease: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
2132	pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
2133	if (pObj->pfnDestructor)
2134	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
2135	RTMemFree(pObj);
2136	}
2137
2138	AssertMsg(pUsage, ("pvObj=%p\n", pvObj));
2139	return rc;
2140	}
2141
2142
2143	/**
2144	* Verifies that the current process can access the specified object.
2145	*
2146	* @returns The following IPRT status code:
2147	* @retval VINF_SUCCESS if access was granted.
2148	* @retval VERR_PERMISSION_DENIED if denied access.
2149	* @retval VERR_INVALID_PARAMETER if invalid parameter.
2150	*
2151	* @param pvObj The identifier returned by SUPR0ObjRegister().
2152	* @param pSession The session which wishes to access the object.
2153	* @param pszObjName Object string name. This is optional and depends on the object type.
2154	*
2155	* @remark The caller is responsible for making sure the object isn't removed while
2156	* we're inside this function. If uncertain about this, just call AddRef before calling us.
2157	*/
2158	SUPR0DECL(int) SUPR0ObjVerifyAccess(void pvObj, PSUPDRVSESSION pSession, const char pszObjName)
2159	{
2160	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2161	int rc;
2162
2163	/*
2164	* Validate the input.
2165	*/
2166	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2167	AssertMsgReturn(VALID_PTR(pObj) && pObj->u32Magic == SUPDRVOBJ_MAGIC,
2168	("Invalid pvObj=%p magic=%#x (exepcted %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
2169	VERR_INVALID_PARAMETER);
2170
2171	/*
2172	* Check access. (returns true if a decision has been made.)
2173	*/
2174	rc = VERR_INTERNAL_ERROR;
2175	if (supdrvOSObjCanAccess(pObj, pSession, pszObjName, &rc))
2176	return rc;
2177
2178	/*
2179	* Default policy is to allow the user to access his own
2180	* stuff but nothing else.
2181	*/
2182	if (pObj->CreatorUid == pSession->Uid)
2183	return VINF_SUCCESS;
2184	return VERR_PERMISSION_DENIED;
2185	}
2186
2187
2188	/**
2189	* Lock pages.
2190	*
2191	* @returns IPRT status code.
2192	* @param pSession Session to which the locked memory should be associated.
2193	* @param pvR3 Start of the memory range to lock.
2194	* This must be page aligned.
2195	* @param cPages Number of pages to lock.
2196	* @param paPages Where to put the physical addresses of locked memory.
2197	*/
2198	SUPR0DECL(int) SUPR0LockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t cPages, PRTHCPHYS paPages)
2199	{
2200	int rc;
2201	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2202	const size_t cb = (size_t)cPages << PAGE_SHIFT;
2203	LogFlow(("SUPR0LockMem: pSession=%p pvR3=%p cPages=%d paPages=%p\n", pSession, (void *)pvR3, cPages, paPages));
2204
2205	/*
2206	* Verify input.
2207	*/
2208	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2209	AssertPtrReturn(paPages, VERR_INVALID_PARAMETER);
2210	if ( RT_ALIGN_R3PT(pvR3, PAGE_SIZE, RTR3PTR) != pvR3
2211	\|\| !pvR3)
2212	{
2213	Log(("pvR3 (%p) must be page aligned and not NULL!\n", (void *)pvR3));
2214	return VERR_INVALID_PARAMETER;
2215	}
2216
2217	/*
2218	* Let IPRT do the job.
2219	*/
2220	Mem.eType = MEMREF_TYPE_LOCKED;
2221	rc = RTR0MemObjLockUser(&Mem.MemObj, pvR3, cb, RTMEM_PROT_READ \| RTMEM_PROT_WRITE, RTR0ProcHandleSelf());
2222	if (RT_SUCCESS(rc))
2223	{
2224	uint32_t iPage = cPages;
2225	AssertMsg(RTR0MemObjAddressR3(Mem.MemObj) == pvR3, ("%p == %p\n", RTR0MemObjAddressR3(Mem.MemObj), pvR3));
2226	AssertMsg(RTR0MemObjSize(Mem.MemObj) == cb, ("%x == %x\n", RTR0MemObjSize(Mem.MemObj), cb));
2227
2228	while (iPage-- > 0)
2229	{
2230	paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
2231	if (RT_UNLIKELY(paPages[iPage] == NIL_RTCCPHYS))
2232	{
2233	AssertMsgFailed(("iPage=%d\n", iPage));
2234	rc = VERR_INTERNAL_ERROR;
2235	break;
2236	}
2237	}
2238	if (RT_SUCCESS(rc))
2239	rc = supdrvMemAdd(&Mem, pSession);
2240	if (RT_FAILURE(rc))
2241	{
2242	int rc2 = RTR0MemObjFree(Mem.MemObj, false);
2243	AssertRC(rc2);
2244	}
2245	}
2246
2247	return rc;
2248	}
2249
2250
2251	/**
2252	* Unlocks the memory pointed to by pv.
2253	*
2254	* @returns IPRT status code.
2255	* @param pSession Session to which the memory was locked.
2256	* @param pvR3 Memory to unlock.
2257	*/
2258	SUPR0DECL(int) SUPR0UnlockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3)
2259	{
2260	LogFlow(("SUPR0UnlockMem: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
2261	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2262	return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_LOCKED);
2263	}
2264
2265
2266	/**
2267	* Allocates a chunk of page aligned memory with contiguous and fixed physical
2268	* backing.
2269	*
2270	* @returns IPRT status code.
2271	* @param pSession Session data.
2272	* @param cPages Number of pages to allocate.
2273	* @param ppvR0 Where to put the address of Ring-0 mapping the allocated memory.
2274	* @param ppvR3 Where to put the address of Ring-3 mapping the allocated memory.
2275	* @param pHCPhys Where to put the physical address of allocated memory.
2276	*/
2277	SUPR0DECL(int) SUPR0ContAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS pHCPhys)
2278	{
2279	int rc;
2280	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2281	LogFlow(("SUPR0ContAlloc: pSession=%p cPages=%d ppvR0=%p ppvR3=%p pHCPhys=%p\n", pSession, cPages, ppvR0, ppvR3, pHCPhys));
2282
2283	/*
2284	* Validate input.
2285	*/
2286	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2287	if (!ppvR3 \|\| !ppvR0 \|\| !pHCPhys)
2288	{
2289	Log(("Null pointer. All of these should be set: pSession=%p ppvR0=%p ppvR3=%p pHCPhys=%p\n",
2290	pSession, ppvR0, ppvR3, pHCPhys));
2291	return VERR_INVALID_PARAMETER;
2292
2293	}
2294	if (cPages < 1 \|\| cPages >= 256)
2295	{
2296	Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
2297	return VERR_PAGE_COUNT_OUT_OF_RANGE;
2298	}
2299
2300	/*
2301	* Let IPRT do the job.
2302	*/
2303	rc = RTR0MemObjAllocCont(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable R0 mapping */);
2304	if (RT_SUCCESS(rc))
2305	{
2306	int rc2;
2307	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2308	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2309	if (RT_SUCCESS(rc))
2310	{
2311	Mem.eType = MEMREF_TYPE_CONT;
2312	rc = supdrvMemAdd(&Mem, pSession);
2313	if (!rc)
2314	{
2315	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2316	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2317	*pHCPhys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, 0);
2318	return 0;
2319	}
2320
2321	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2322	AssertRC(rc2);
2323	}
2324	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2325	AssertRC(rc2);
2326	}
2327
2328	return rc;
2329	}
2330
2331
2332	/**
2333	* Frees memory allocated using SUPR0ContAlloc().
2334	*
2335	* @returns IPRT status code.
2336	* @param pSession The session to which the memory was allocated.
2337	* @param uPtr Pointer to the memory (ring-3 or ring-0).
2338	*/
2339	SUPR0DECL(int) SUPR0ContFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2340	{
2341	LogFlow(("SUPR0ContFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2342	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2343	return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_CONT);
2344	}
2345
2346
2347	/**
2348	* Allocates a chunk of page aligned memory with fixed physical backing below 4GB.
2349	*
2350	* The memory isn't zeroed.
2351	*
2352	* @returns IPRT status code.
2353	* @param pSession Session data.
2354	* @param cPages Number of pages to allocate.
2355	* @param ppvR0 Where to put the address of Ring-0 mapping of the allocated memory.
2356	* @param ppvR3 Where to put the address of Ring-3 mapping of the allocated memory.
2357	* @param paPages Where to put the physical addresses of allocated memory.
2358	*/
2359	SUPR0DECL(int) SUPR0LowAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS paPages)
2360	{
2361	unsigned iPage;
2362	int rc;
2363	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2364	LogFlow(("SUPR0LowAlloc: pSession=%p cPages=%d ppvR3=%p ppvR0=%p paPages=%p\n", pSession, cPages, ppvR3, ppvR0, paPages));
2365
2366	/*
2367	* Validate input.
2368	*/
2369	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2370	if (!ppvR3 \|\| !ppvR0 \|\| !paPages)
2371	{
2372	Log(("Null pointer. All of these should be set: pSession=%p ppvR3=%p ppvR0=%p paPages=%p\n",
2373	pSession, ppvR3, ppvR0, paPages));
2374	return VERR_INVALID_PARAMETER;
2375
2376	}
2377	if (cPages < 1 \|\| cPages >= 256)
2378	{
2379	Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
2380	return VERR_PAGE_COUNT_OUT_OF_RANGE;
2381	}
2382
2383	/*
2384	* Let IPRT do the work.
2385	*/
2386	rc = RTR0MemObjAllocLow(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable ring-0 mapping */);
2387	if (RT_SUCCESS(rc))
2388	{
2389	int rc2;
2390	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2391	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2392	if (RT_SUCCESS(rc))
2393	{
2394	Mem.eType = MEMREF_TYPE_LOW;
2395	rc = supdrvMemAdd(&Mem, pSession);
2396	if (!rc)
2397	{
2398	for (iPage = 0; iPage < cPages; iPage++)
2399	{
2400	paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
2401	AssertMsg(!(paPages[iPage] & (PAGE_SIZE - 1)), ("iPage=%d Phys=%RHp\n", paPages[iPage]));
2402	}
2403	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2404	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2405	return 0;
2406	}
2407
2408	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2409	AssertRC(rc2);
2410	}
2411
2412	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2413	AssertRC(rc2);
2414	}
2415
2416	return rc;
2417	}
2418
2419
2420	/**
2421	* Frees memory allocated using SUPR0LowAlloc().
2422	*
2423	* @returns IPRT status code.
2424	* @param pSession The session to which the memory was allocated.
2425	* @param uPtr Pointer to the memory (ring-3 or ring-0).
2426	*/
2427	SUPR0DECL(int) SUPR0LowFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2428	{
2429	LogFlow(("SUPR0LowFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2430	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2431	return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_LOW);
2432	}
2433
2434
2435
2436	/**
2437	* Allocates a chunk of memory with both R0 and R3 mappings.
2438	* The memory is fixed and it's possible to query the physical addresses using SUPR0MemGetPhys().
2439	*
2440	* @returns IPRT status code.
2441	* @param pSession The session to associated the allocation with.
2442	* @param cb Number of bytes to allocate.
2443	* @param ppvR0 Where to store the address of the Ring-0 mapping.
2444	* @param ppvR3 Where to store the address of the Ring-3 mapping.
2445	*/
2446	SUPR0DECL(int) SUPR0MemAlloc(PSUPDRVSESSION pSession, uint32_t cb, PRTR0PTR ppvR0, PRTR3PTR ppvR3)
2447	{
2448	int rc;
2449	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2450	LogFlow(("SUPR0MemAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p\n", pSession, cb, ppvR0, ppvR3));
2451
2452	/*
2453	* Validate input.
2454	*/
2455	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2456	AssertPtrReturn(ppvR0, VERR_INVALID_POINTER);
2457	AssertPtrReturn(ppvR3, VERR_INVALID_POINTER);
2458	if (cb < 1 \|\| cb >= _4M)
2459	{
2460	Log(("Illegal request cb=%u; must be greater than 0 and smaller than 4MB.\n", cb));
2461	return VERR_INVALID_PARAMETER;
2462	}
2463
2464	/*
2465	* Let IPRT do the work.
2466	*/
2467	rc = RTR0MemObjAllocPage(&Mem.MemObj, cb, true /* executable ring-0 mapping */);
2468	if (RT_SUCCESS(rc))
2469	{
2470	int rc2;
2471	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2472	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2473	if (RT_SUCCESS(rc))
2474	{
2475	Mem.eType = MEMREF_TYPE_MEM;
2476	rc = supdrvMemAdd(&Mem, pSession);
2477	if (!rc)
2478	{
2479	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2480	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2481	return VINF_SUCCESS;
2482	}
2483
2484	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2485	AssertRC(rc2);
2486	}
2487
2488	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2489	AssertRC(rc2);
2490	}
2491
2492	return rc;
2493	}
2494
2495
2496	/**
2497	* Get the physical addresses of memory allocated using SUPR0MemAlloc().
2498	*
2499	* @returns IPRT status code.
2500	* @param pSession The session to which the memory was allocated.
2501	* @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2502	* @param paPages Where to store the physical addresses.
2503	*/
2504	SUPR0DECL(int) SUPR0MemGetPhys(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, PSUPPAGE paPages) /** @todo switch this bugger to RTHCPHYS */
2505	{
2506	PSUPDRVBUNDLE pBundle;
2507	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2508	LogFlow(("SUPR0MemGetPhys: pSession=%p uPtr=%p paPages=%p\n", pSession, (void *)uPtr, paPages));
2509
2510	/*
2511	* Validate input.
2512	*/
2513	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2514	AssertPtrReturn(paPages, VERR_INVALID_POINTER);
2515	AssertReturn(uPtr, VERR_INVALID_PARAMETER);
2516
2517	/*
2518	* Search for the address.
2519	*/
2520	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2521	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2522	{
2523	if (pBundle->cUsed > 0)
2524	{
2525	unsigned i;
2526	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2527	{
2528	if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
2529	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2530	&& ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
2531	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2532	&& RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr)
2533	)
2534	)
2535	{
2536	const size_t cPages = RTR0MemObjSize(pBundle->aMem[i].MemObj) >> PAGE_SHIFT;
2537	size_t iPage;
2538	for (iPage = 0; iPage < cPages; iPage++)
2539	{
2540	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(pBundle->aMem[i].MemObj, iPage);
2541	paPages[iPage].uReserved = 0;
2542	}
2543	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2544	return VINF_SUCCESS;
2545	}
2546	}
2547	}
2548	}
2549	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2550	Log(("Failed to find %p!!!\n", (void *)uPtr));
2551	return VERR_INVALID_PARAMETER;
2552	}
2553
2554
2555	/**
2556	* Free memory allocated by SUPR0MemAlloc().
2557	*
2558	* @returns IPRT status code.
2559	* @param pSession The session owning the allocation.
2560	* @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2561	*/
2562	SUPR0DECL(int) SUPR0MemFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2563	{
2564	LogFlow(("SUPR0MemFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2565	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2566	return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_MEM);
2567	}
2568
2569
2570	/**
2571	* Allocates a chunk of memory with a kernel or/and a user mode mapping.
2572	*
2573	* The memory is fixed and it's possible to query the physical addresses using
2574	* SUPR0MemGetPhys().
2575	*
2576	* @returns IPRT status code.
2577	* @param pSession The session to associated the allocation with.
2578	* @param cPages The number of pages to allocate.
2579	* @param fFlags Flags, reserved for the future. Must be zero.
2580	* @param ppvR3 Where to store the address of the Ring-3 mapping.
2581	* NULL if no ring-3 mapping.
2582	* @param ppvR3 Where to store the address of the Ring-0 mapping.
2583	* NULL if no ring-0 mapping.
2584	* @param paPages Where to store the addresses of the pages. Optional.
2585	*/
2586	SUPR0DECL(int) SUPR0PageAllocEx(PSUPDRVSESSION pSession, uint32_t cPages, uint32_t fFlags, PRTR3PTR ppvR3, PRTR0PTR ppvR0, PRTHCPHYS paPages)
2587	{
2588	int rc;
2589	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2590	LogFlow(("SUPR0PageAlloc: pSession=%p cb=%d ppvR3=%p\n", pSession, cPages, ppvR3));
2591
2592	/*
2593	* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2594	*/
2595	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2596	AssertPtrNullReturn(ppvR3, VERR_INVALID_POINTER);
2597	AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
2598	AssertReturn(ppvR3 \|\| ppvR0, VERR_INVALID_PARAMETER);
2599	AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
2600	if (cPages < 1 \|\| cPages > VBOX_MAX_ALLOC_PAGE_COUNT)
2601	{
2602	Log(("SUPR0PageAlloc: Illegal request cb=%u; must be greater than 0 and smaller than %uMB (VBOX_MAX_ALLOC_PAGE_COUNT pages).\n", cPages, VBOX_MAX_ALLOC_PAGE_COUNT * (_1M / _4K)));
2603	return VERR_PAGE_COUNT_OUT_OF_RANGE;
2604	}
2605
2606	/*
2607	* Let IPRT do the work.
2608	*/
2609	if (ppvR0)
2610	rc = RTR0MemObjAllocPage(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, true /* fExecutable */);
2611	else
2612	rc = RTR0MemObjAllocPhysNC(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, NIL_RTHCPHYS);
2613	if (RT_SUCCESS(rc))
2614	{
2615	int rc2;
2616	if (ppvR3)
2617	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2618	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2619	else
2620	Mem.MapObjR3 = NIL_RTR0MEMOBJ;
2621	if (RT_SUCCESS(rc))
2622	{
2623	Mem.eType = MEMREF_TYPE_PAGE;
2624	rc = supdrvMemAdd(&Mem, pSession);
2625	if (!rc)
2626	{
2627	if (ppvR3)
2628	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2629	if (ppvR0)
2630	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2631	if (paPages)
2632	{
2633	uint32_t iPage = cPages;
2634	while (iPage-- > 0)
2635	{
2636	paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MapObjR3, iPage);
2637	Assert(paPages[iPage] != NIL_RTHCPHYS);
2638	}
2639	}
2640	return VINF_SUCCESS;
2641	}
2642
2643	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2644	AssertRC(rc2);
2645	}
2646
2647	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2648	AssertRC(rc2);
2649	}
2650	return rc;
2651	}
2652
2653
2654	/**
2655	* Maps a chunk of memory previously allocated by SUPR0PageAllocEx into kernel
2656	* space.
2657	*
2658	* @returns IPRT status code.
2659	* @param pSession The session to associated the allocation with.
2660	* @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
2661	* @param offSub Where to start mapping. Must be page aligned.
2662	* @param cbSub How much to map. Must be page aligned.
2663	* @param fFlags Flags, MBZ.
2664	* @param ppvR0 Where to reutrn the address of the ring-0 mapping on
2665	* success.
2666	*/
2667	SUPR0DECL(int) SUPR0PageMapKernel(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t offSub, uint32_t cbSub,
2668	uint32_t fFlags, PRTR0PTR ppvR0)
2669	{
2670	int rc;
2671	PSUPDRVBUNDLE pBundle;
2672	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2673	RTR0MEMOBJ hMemObj = NIL_RTR0MEMOBJ;
2674	LogFlow(("SUPR0PageMapKernel: pSession=%p pvR3=%p offSub=%#x cbSub=%#x\n", pSession, pvR3, offSub, cbSub));
2675
2676	/*
2677	* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2678	*/
2679	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2680	AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
2681	AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
2682	AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2683	AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2684	AssertReturn(cbSub, VERR_INVALID_PARAMETER);
2685
2686	/*
2687	* Find the memory object.
2688	*/
2689	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2690	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2691	{
2692	if (pBundle->cUsed > 0)
2693	{
2694	unsigned i;
2695	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2696	{
2697	if ( ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
2698	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2699	&& pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2700	&& RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3)
2701	\|\| ( pBundle->aMem[i].eType == MEMREF_TYPE_LOCKED
2702	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2703	&& pBundle->aMem[i].MapObjR3 == NIL_RTR0MEMOBJ
2704	&& RTR0MemObjAddressR3(pBundle->aMem[i].MemObj) == pvR3))
2705	{
2706	hMemObj = pBundle->aMem[i].MemObj;
2707	break;
2708	}
2709	}
2710	}
2711	}
2712	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2713
2714	rc = VERR_INVALID_PARAMETER;
2715	if (hMemObj != NIL_RTR0MEMOBJ)
2716	{
2717	/*
2718	* Do some furter input validations before calling IPRT.
2719	* (Cleanup is done indirectly by telling RTR0MemObjFree to include mappings.)
2720	*/
2721	size_t cbMemObj = RTR0MemObjSize(hMemObj);
2722	if ( offSub < cbMemObj
2723	&& cbSub <= cbMemObj
2724	&& offSub + cbSub <= cbMemObj)
2725	{
2726	RTR0MEMOBJ hMapObj;
2727	rc = RTR0MemObjMapKernelEx(&hMapObj, hMemObj, (void *)-1, 0,
2728	RTMEM_PROT_READ \| RTMEM_PROT_WRITE, offSub, cbSub);
2729	if (RT_SUCCESS(rc))
2730	*ppvR0 = RTR0MemObjAddress(hMapObj);
2731	}
2732	else
2733	SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
2734
2735	}
2736	return rc;
2737	}
2738
2739
2740	/**
2741	* Changes the page level protection of one or more pages previously allocated
2742	* by SUPR0PageAllocEx.
2743	*
2744	* @returns IPRT status code.
2745	* @param pSession The session to associated the allocation with.
2746	* @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
2747	* NIL_RTR3PTR if the ring-3 mapping should be unaffected.
2748	* @param pvR0 The ring-0 address returned by SUPR0PageAllocEx.
2749	* NIL_RTR0PTR if the ring-0 mapping should be unaffected.
2750	* @param offSub Where to start changing. Must be page aligned.
2751	* @param cbSub How much to change. Must be page aligned.
2752	* @param fProt The new page level protection, see RTMEM_PROT_*.
2753	*/
2754	SUPR0DECL(int) SUPR0PageProtect(PSUPDRVSESSION pSession, RTR3PTR pvR3, RTR0PTR pvR0, uint32_t offSub, uint32_t cbSub, uint32_t fProt)
2755	{
2756	int rc;
2757	PSUPDRVBUNDLE pBundle;
2758	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2759	RTR0MEMOBJ hMemObjR0 = NIL_RTR0MEMOBJ;
2760	RTR0MEMOBJ hMemObjR3 = NIL_RTR0MEMOBJ;
2761	LogFlow(("SUPR0PageProtect: pSession=%p pvR3=%p pvR0=%p offSub=%#x cbSub=%#x fProt-%#x\n", pSession, pvR3, pvR0, offSub, cbSub, fProt));
2762
2763	/*
2764	* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2765	*/
2766	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2767	AssertReturn(!(fProt & ~(RTMEM_PROT_READ \| RTMEM_PROT_WRITE \| RTMEM_PROT_EXEC \| RTMEM_PROT_NONE)), VERR_INVALID_PARAMETER);
2768	AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2769	AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2770	AssertReturn(cbSub, VERR_INVALID_PARAMETER);
2771
2772	/*
2773	* Find the memory object.
2774	*/
2775	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2776	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2777	{
2778	if (pBundle->cUsed > 0)
2779	{
2780	unsigned i;
2781	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2782	{
2783	if ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
2784	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2785	&& ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2786	\|\| pvR3 == NIL_RTR3PTR)
2787	&& ( pvR0 == NIL_RTR0PTR
2788	\|\| RTR0MemObjAddress(pBundle->aMem[i].MemObj) == pvR0)
2789	&& ( pvR3 == NIL_RTR3PTR
2790	\|\| RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3))
2791	{
2792	if (pvR0 != NIL_RTR0PTR)
2793	hMemObjR0 = pBundle->aMem[i].MemObj;
2794	if (pvR3 != NIL_RTR3PTR)
2795	hMemObjR3 = pBundle->aMem[i].MapObjR3;
2796	break;
2797	}
2798	}
2799	}
2800	}
2801	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2802
2803	rc = VERR_INVALID_PARAMETER;
2804	if ( hMemObjR0 != NIL_RTR0MEMOBJ
2805	\|\| hMemObjR3 != NIL_RTR0MEMOBJ)
2806	{
2807	/*
2808	* Do some furter input validations before calling IPRT.
2809	*/
2810	size_t cbMemObj = hMemObjR0 != NIL_RTR0PTR ? RTR0MemObjSize(hMemObjR0) : RTR0MemObjSize(hMemObjR3);
2811	if ( offSub < cbMemObj
2812	&& cbSub <= cbMemObj
2813	&& offSub + cbSub <= cbMemObj)
2814	{
2815	rc = VINF_SUCCESS;
2816	if (hMemObjR3 != NIL_RTR0PTR)
2817	rc = RTR0MemObjProtect(hMemObjR3, offSub, cbSub, fProt);
2818	if (hMemObjR0 != NIL_RTR0PTR && RT_SUCCESS(rc))
2819	rc = RTR0MemObjProtect(hMemObjR0, offSub, cbSub, fProt);
2820	}
2821	else
2822	SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
2823
2824	}
2825	return rc;
2826
2827	}
2828
2829
2830	/**
2831	* Free memory allocated by SUPR0PageAlloc() and SUPR0PageAllocEx().
2832	*
2833	* @returns IPRT status code.
2834	* @param pSession The session owning the allocation.
2835	* @param pvR3 The Ring-3 address returned by SUPR0PageAlloc() or
2836	* SUPR0PageAllocEx().
2837	*/
2838	SUPR0DECL(int) SUPR0PageFree(PSUPDRVSESSION pSession, RTR3PTR pvR3)
2839	{
2840	LogFlow(("SUPR0PageFree: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
2841	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2842	return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_PAGE);
2843	}
2844
2845
2846	/**
2847	* Gets the paging mode of the current CPU.
2848	*
2849	* @returns Paging mode, SUPPAGEINGMODE_INVALID on error.
2850	*/
2851	SUPR0DECL(SUPPAGINGMODE) SUPR0GetPagingMode(void)
2852	{
2853	SUPPAGINGMODE enmMode;
2854
2855	RTR0UINTREG cr0 = ASMGetCR0();
2856	if ((cr0 & (X86_CR0_PG \| X86_CR0_PE)) != (X86_CR0_PG \| X86_CR0_PE))
2857	enmMode = SUPPAGINGMODE_INVALID;
2858	else
2859	{
2860	RTR0UINTREG cr4 = ASMGetCR4();
2861	uint32_t fNXEPlusLMA = 0;
2862	if (cr4 & X86_CR4_PAE)
2863	{
2864	uint32_t fAmdFeatures = ASMCpuId_EDX(0x80000001);
2865	if (fAmdFeatures & (X86_CPUID_AMD_FEATURE_EDX_NX \| X86_CPUID_AMD_FEATURE_EDX_LONG_MODE))
2866	{
2867	uint64_t efer = ASMRdMsr(MSR_K6_EFER);
2868	if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_NX) && (efer & MSR_K6_EFER_NXE))
2869	fNXEPlusLMA \|= RT_BIT(0);
2870	if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE) && (efer & MSR_K6_EFER_LMA))
2871	fNXEPlusLMA \|= RT_BIT(1);
2872	}
2873	}
2874
2875	switch ((cr4 & (X86_CR4_PAE \| X86_CR4_PGE)) \| fNXEPlusLMA)
2876	{
2877	case 0:
2878	enmMode = SUPPAGINGMODE_32_BIT;
2879	break;
2880
2881	case X86_CR4_PGE:
2882	enmMode = SUPPAGINGMODE_32_BIT_GLOBAL;
2883	break;
2884
2885	case X86_CR4_PAE:
2886	enmMode = SUPPAGINGMODE_PAE;
2887	break;
2888
2889	case X86_CR4_PAE \| RT_BIT(0):
2890	enmMode = SUPPAGINGMODE_PAE_NX;
2891	break;
2892
2893	case X86_CR4_PAE \| X86_CR4_PGE:
2894	enmMode = SUPPAGINGMODE_PAE_GLOBAL;
2895	break;
2896
2897	case X86_CR4_PAE \| X86_CR4_PGE \| RT_BIT(0):
2898	enmMode = SUPPAGINGMODE_PAE_GLOBAL;
2899	break;
2900
2901	case RT_BIT(1) \| X86_CR4_PAE:
2902	enmMode = SUPPAGINGMODE_AMD64;
2903	break;
2904
2905	case RT_BIT(1) \| X86_CR4_PAE \| RT_BIT(0):
2906	enmMode = SUPPAGINGMODE_AMD64_NX;
2907	break;
2908
2909	case RT_BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE:
2910	enmMode = SUPPAGINGMODE_AMD64_GLOBAL;
2911	break;
2912
2913	case RT_BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE \| RT_BIT(0):
2914	enmMode = SUPPAGINGMODE_AMD64_GLOBAL_NX;
2915	break;
2916
2917	default:
2918	AssertMsgFailed(("Cannot happen! cr4=%#x fNXEPlusLMA=%d\n", cr4, fNXEPlusLMA));
2919	enmMode = SUPPAGINGMODE_INVALID;
2920	break;
2921	}
2922	}
2923	return enmMode;
2924	}
2925
2926
2927	/**
2928	* Enables or disabled hardware virtualization extensions using native OS APIs.
2929	*
2930	* @returns VBox status code.
2931	* @retval VINF_SUCCESS on success.
2932	* @retval VERR_NOT_SUPPORTED if not supported by the native OS.
2933	*
2934	* @param fEnable Whether to enable or disable.
2935	*/
2936	SUPR0DECL(int) SUPR0EnableVTx(bool fEnable)
2937	{
2938	#ifdef RT_OS_DARWIN
2939	return supdrvOSEnableVTx(fEnable);
2940	#else
2941	return VERR_NOT_SUPPORTED;
2942	#endif
2943	}
2944
2945
2946	/** @todo document me */
2947	SUPR0DECL(int) SUPR0QueryVTCaps(PSUPDRVSESSION pSession, uint32_t *pfCaps)
2948	{
2949	/*
2950	* Input validation.
2951	*/
2952	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2953	AssertPtrReturn(pfCaps, VERR_INVALID_POINTER);
2954
2955	*pfCaps = 0;
2956
2957	if (ASMHasCpuId())
2958	{
2959	uint32_t u32FeaturesECX;
2960	uint32_t u32Dummy;
2961	uint32_t u32FeaturesEDX;
2962	uint32_t u32VendorEBX, u32VendorECX, u32VendorEDX, u32AMDFeatureEDX, u32AMDFeatureECX;
2963	uint64_t val;
2964
2965	ASMCpuId(0, &u32Dummy, &u32VendorEBX, &u32VendorECX, &u32VendorEDX);
2966	ASMCpuId(1, &u32Dummy, &u32Dummy, &u32FeaturesECX, &u32FeaturesEDX);
2967	/* Query AMD features. */
2968	ASMCpuId(0x80000001, &u32Dummy, &u32Dummy, &u32AMDFeatureECX, &u32AMDFeatureEDX);
2969
2970	if ( u32VendorEBX == X86_CPUID_VENDOR_INTEL_EBX
2971	&& u32VendorECX == X86_CPUID_VENDOR_INTEL_ECX
2972	&& u32VendorEDX == X86_CPUID_VENDOR_INTEL_EDX
2973	)
2974	{
2975	if ( (u32FeaturesECX & X86_CPUID_FEATURE_ECX_VMX)
2976	&& (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_MSR)
2977	&& (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_FXSR)
2978	)
2979	{
2980	val = ASMRdMsr(MSR_IA32_FEATURE_CONTROL);
2981	/*
2982	* Both the LOCK and VMXON bit must be set; otherwise VMXON will generate a #GP.
2983	* Once the lock bit is set, this MSR can no longer be modified.
2984	*/
2985	if ( (val & (MSR_IA32_FEATURE_CONTROL_VMXON\|MSR_IA32_FEATURE_CONTROL_LOCK))
2986	== (MSR_IA32_FEATURE_CONTROL_VMXON\|MSR_IA32_FEATURE_CONTROL_LOCK) /* enabled and locked */
2987	\|\| !(val & MSR_IA32_FEATURE_CONTROL_LOCK) /* not enabled, but not locked either */
2988	)
2989	{
2990	VMX_CAPABILITY vtCaps;
2991
2992	*pfCaps \|= SUPVTCAPS_VT_X;
2993
2994	vtCaps.u = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS);
2995	if (vtCaps.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
2996	{
2997	vtCaps.u = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS2);
2998	if (vtCaps.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_EPT)
2999	*pfCaps \|= SUPVTCAPS_NESTED_PAGING;
3000	}
3001	return VINF_SUCCESS;
3002	}
3003	return VERR_VMX_MSR_LOCKED_OR_DISABLED;
3004	}
3005	return VERR_VMX_NO_VMX;
3006	}
3007
3008	if ( u32VendorEBX == X86_CPUID_VENDOR_AMD_EBX
3009	&& u32VendorECX == X86_CPUID_VENDOR_AMD_ECX
3010	&& u32VendorEDX == X86_CPUID_VENDOR_AMD_EDX
3011	)
3012	{
3013	if ( (u32AMDFeatureECX & X86_CPUID_AMD_FEATURE_ECX_SVM)
3014	&& (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_MSR)
3015	&& (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_FXSR)
3016	)
3017	{
3018	/* Check if SVM is disabled */
3019	val = ASMRdMsr(MSR_K8_VM_CR);
3020	if (!(val & MSR_K8_VM_CR_SVM_DISABLE))
3021	{
3022	*pfCaps \|= SUPVTCAPS_AMD_V;
3023
3024	/* Query AMD features. */
3025	ASMCpuId(0x8000000A, &u32Dummy, &u32Dummy, &u32Dummy, &u32FeaturesEDX);
3026
3027	if (u32FeaturesEDX & AMD_CPUID_SVM_FEATURE_EDX_NESTED_PAGING)
3028	*pfCaps \|= SUPVTCAPS_NESTED_PAGING;
3029
3030	return VINF_SUCCESS;
3031	}
3032	return VERR_SVM_DISABLED;
3033	}
3034	return VERR_SVM_NO_SVM;
3035	}
3036	}
3037
3038	return VERR_UNSUPPORTED_CPU;
3039	}
3040
3041
3042	/**
3043	* (Re-)initializes the per-cpu structure prior to starting or resuming the GIP
3044	* updating.
3045	*
3046	* @param pGipCpu The per CPU structure for this CPU.
3047	* @param u64NanoTS The current time.
3048	*/
3049	static void supdrvGipReInitCpu(PSUPGIPCPU pGipCpu, uint64_t u64NanoTS)
3050	{
3051	pGipCpu->u64TSC = ASMReadTSC() - pGipCpu->u32UpdateIntervalTSC;
3052	pGipCpu->u64NanoTS = u64NanoTS;
3053	}
3054
3055
3056	/**
3057	* Set the current TSC and NanoTS value for the CPU.
3058	*
3059	* @param idCpu The CPU ID. Unused - we have to use the APIC ID.
3060	* @param pvUser1 Pointer to the ring-0 GIP mapping.
3061	* @param pvUser2 Pointer to the variable holding the current time.
3062	*/
3063	static DECLCALLBACK(void) supdrvGipReInitCpuCallback(RTCPUID idCpu, void pvUser1, void pvUser2)
3064	{
3065	PSUPGLOBALINFOPAGE pGip = (PSUPGLOBALINFOPAGE)pvUser1;
3066	unsigned iCpu = ASMGetApicId();
3067
3068	if (RT_LIKELY(iCpu < RT_ELEMENTS(pGip->aCPUs)))
3069	supdrvGipReInitCpu(&pGip->aCPUs[iCpu], (uint64_t )pvUser2);
3070
3071	NOREF(pvUser2);
3072	NOREF(idCpu);
3073	}
3074
3075
3076	/**
3077	* Maps the GIP into userspace and/or get the physical address of the GIP.
3078	*
3079	* @returns IPRT status code.
3080	* @param pSession Session to which the GIP mapping should belong.
3081	* @param ppGipR3 Where to store the address of the ring-3 mapping. (optional)
3082	* @param pHCPhysGip Where to store the physical address. (optional)
3083	*
3084	* @remark There is no reference counting on the mapping, so one call to this function
3085	* count globally as one reference. One call to SUPR0GipUnmap() is will unmap GIP
3086	* and remove the session as a GIP user.
3087	*/
3088	SUPR0DECL(int) SUPR0GipMap(PSUPDRVSESSION pSession, PRTR3PTR ppGipR3, PRTHCPHYS pHCPhysGip)
3089	{
3090	int rc;
3091	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
3092	RTR3PTR pGipR3 = NIL_RTR3PTR;
3093	RTHCPHYS HCPhys = NIL_RTHCPHYS;
3094	LogFlow(("SUPR0GipMap: pSession=%p ppGipR3=%p pHCPhysGip=%p\n", pSession, ppGipR3, pHCPhysGip));
3095
3096	/*
3097	* Validate
3098	*/
3099	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3100	AssertPtrNullReturn(ppGipR3, VERR_INVALID_POINTER);
3101	AssertPtrNullReturn(pHCPhysGip, VERR_INVALID_POINTER);
3102
3103	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3104	RTSemMutexRequest(pDevExt->mtxGip, RT_INDEFINITE_WAIT);
3105	#else
3106	RTSemFastMutexRequest(pDevExt->mtxGip);
3107	#endif
3108	if (pDevExt->pGip)
3109	{
3110	/*
3111	* Map it?
3112	*/
3113	rc = VINF_SUCCESS;
3114	if (ppGipR3)
3115	{
3116	if (pSession->GipMapObjR3 == NIL_RTR0MEMOBJ)
3117	rc = RTR0MemObjMapUser(&pSession->GipMapObjR3, pDevExt->GipMemObj, (RTR3PTR)-1, 0,
3118	RTMEM_PROT_READ, RTR0ProcHandleSelf());
3119	if (RT_SUCCESS(rc))
3120	pGipR3 = RTR0MemObjAddressR3(pSession->GipMapObjR3);
3121	}
3122
3123	/*
3124	* Get physical address.
3125	*/
3126	if (pHCPhysGip && RT_SUCCESS(rc))
3127	HCPhys = pDevExt->HCPhysGip;
3128
3129	/*
3130	* Reference globally.
3131	*/
3132	if (!pSession->fGipReferenced && RT_SUCCESS(rc))
3133	{
3134	pSession->fGipReferenced = 1;
3135	pDevExt->cGipUsers++;
3136	if (pDevExt->cGipUsers == 1)
3137	{
3138	PSUPGLOBALINFOPAGE pGipR0 = pDevExt->pGip;
3139	uint64_t u64NanoTS;
3140	unsigned i;
3141
3142	LogFlow(("SUPR0GipMap: Resumes GIP updating\n"));
3143
3144	if (pGipR0->aCPUs[0].u32TransactionId != 2 /* not the first time */)
3145	{
3146	for (i = 0; i < RT_ELEMENTS(pGipR0->aCPUs); i++)
3147	ASMAtomicUoWriteU32(&pGipR0->aCPUs[i].u32TransactionId,
3148	(pGipR0->aCPUs[i].u32TransactionId + GIP_UPDATEHZ_RECALC_FREQ * 2)
3149	& ~(GIP_UPDATEHZ_RECALC_FREQ * 2 - 1));
3150	ASMAtomicWriteU64(&pGipR0->u64NanoTSLastUpdateHz, 0);
3151	}
3152
3153	u64NanoTS = RTTimeSystemNanoTS() - pGipR0->u32UpdateIntervalNS;
3154	if ( pGipR0->u32Mode == SUPGIPMODE_SYNC_TSC
3155	\|\| RTMpGetOnlineCount() == 1)
3156	supdrvGipReInitCpu(&pGipR0->aCPUs[0], u64NanoTS);
3157	else
3158	RTMpOnAll(supdrvGipReInitCpuCallback, pGipR0, &u64NanoTS);
3159
3160	rc = RTTimerStart(pDevExt->pGipTimer, 0);
3161	AssertRC(rc); rc = VINF_SUCCESS;
3162	}
3163	}
3164	}
3165	else
3166	{
3167	rc = VERR_GENERAL_FAILURE;
3168	Log(("SUPR0GipMap: GIP is not available!\n"));
3169	}
3170	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3171	RTSemMutexRelease(pDevExt->mtxGip);
3172	#else
3173	RTSemFastMutexRelease(pDevExt->mtxGip);
3174	#endif
3175
3176	/*
3177	* Write returns.
3178	*/
3179	if (pHCPhysGip)
3180	*pHCPhysGip = HCPhys;
3181	if (ppGipR3)
3182	*ppGipR3 = pGipR3;
3183
3184	#ifdef DEBUG_DARWIN_GIP
3185	OSDBGPRINT(("SUPR0GipMap: returns %d pHCPhysGip=%lx pGipR3=%p\n", rc, (unsigned long)HCPhys, (void )pGipR3));
3186	#else
3187	LogFlow(( "SUPR0GipMap: returns %d pHCPhysGip=%lx pGipR3=%p\n", rc, (unsigned long)HCPhys, (void )pGipR3));
3188	#endif
3189	return rc;
3190	}
3191
3192
3193	/**
3194	* Unmaps any user mapping of the GIP and terminates all GIP access
3195	* from this session.
3196	*
3197	* @returns IPRT status code.
3198	* @param pSession Session to which the GIP mapping should belong.
3199	*/
3200	SUPR0DECL(int) SUPR0GipUnmap(PSUPDRVSESSION pSession)
3201	{
3202	int rc = VINF_SUCCESS;
3203	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
3204	#ifdef DEBUG_DARWIN_GIP
3205	OSDBGPRINT(("SUPR0GipUnmap: pSession=%p pGip=%p GipMapObjR3=%p\n",
3206	pSession,
3207	pSession->GipMapObjR3 != NIL_RTR0MEMOBJ ? RTR0MemObjAddress(pSession->GipMapObjR3) : NULL,
3208	pSession->GipMapObjR3));
3209	#else
3210	LogFlow(("SUPR0GipUnmap: pSession=%p\n", pSession));
3211	#endif
3212	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3213
3214	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3215	RTSemMutexRequest(pDevExt->mtxGip, RT_INDEFINITE_WAIT);
3216	#else
3217	RTSemFastMutexRequest(pDevExt->mtxGip);
3218	#endif
3219
3220	/*
3221	* Unmap anything?
3222	*/
3223	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
3224	{
3225	rc = RTR0MemObjFree(pSession->GipMapObjR3, false);
3226	AssertRC(rc);
3227	if (RT_SUCCESS(rc))
3228	pSession->GipMapObjR3 = NIL_RTR0MEMOBJ;
3229	}
3230
3231	/*
3232	* Dereference global GIP.
3233	*/
3234	if (pSession->fGipReferenced && !rc)
3235	{
3236	pSession->fGipReferenced = 0;
3237	if ( pDevExt->cGipUsers > 0
3238	&& !--pDevExt->cGipUsers)
3239	{
3240	LogFlow(("SUPR0GipUnmap: Suspends GIP updating\n"));
3241	rc = RTTimerStop(pDevExt->pGipTimer); AssertRC(rc); rc = VINF_SUCCESS;
3242	}
3243	}
3244
3245	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3246	RTSemMutexRelease(pDevExt->mtxGip);
3247	#else
3248	RTSemFastMutexRelease(pDevExt->mtxGip);
3249	#endif
3250
3251	return rc;
3252	}
3253
3254
3255	/**
3256	* Gets the GIP pointer.
3257	*
3258	* @returns Pointer to the GIP or NULL.
3259	*/
3260	SUPDECL(PSUPGLOBALINFOPAGE) SUPGetGIP(void)
3261	{
3262	return g_pSUPGlobalInfoPage;
3263	}
3264
3265
3266	/**
3267	* Register a component factory with the support driver.
3268	*
3269	* This is currently restricted to kernel sessions only.
3270	*
3271	* @returns VBox status code.
3272	* @retval VINF_SUCCESS on success.
3273	* @retval VERR_NO_MEMORY if we're out of memory.
3274	* @retval VERR_ALREADY_EXISTS if the factory has already been registered.
3275	* @retval VERR_ACCESS_DENIED if it isn't a kernel session.
3276	* @retval VERR_INVALID_PARAMETER on invalid parameter.
3277	* @retval VERR_INVALID_POINTER on invalid pointer parameter.
3278	*
3279	* @param pSession The SUPDRV session (must be a ring-0 session).
3280	* @param pFactory Pointer to the component factory registration structure.
3281	*
3282	* @remarks This interface is also available via SUPR0IdcComponentRegisterFactory.
3283	*/
3284	SUPR0DECL(int) SUPR0ComponentRegisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
3285	{
3286	PSUPDRVFACTORYREG pNewReg;
3287	const char *psz;
3288	int rc;
3289
3290	/*
3291	* Validate parameters.
3292	*/
3293	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3294	AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
3295	AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
3296	AssertPtrReturn(pFactory->pfnQueryFactoryInterface, VERR_INVALID_POINTER);
3297	psz = RTStrEnd(pFactory->szName, sizeof(pFactory->szName));
3298	AssertReturn(psz, VERR_INVALID_PARAMETER);
3299
3300	/*
3301	* Allocate and initialize a new registration structure.
3302	*/
3303	pNewReg = (PSUPDRVFACTORYREG)RTMemAlloc(sizeof(SUPDRVFACTORYREG));
3304	if (pNewReg)
3305	{
3306	pNewReg->pNext = NULL;
3307	pNewReg->pFactory = pFactory;
3308	pNewReg->pSession = pSession;
3309	pNewReg->cchName = psz - &pFactory->szName[0];
3310
3311	/*
3312	* Add it to the tail of the list after checking for prior registration.
3313	*/
3314	rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3315	if (RT_SUCCESS(rc))
3316	{
3317	PSUPDRVFACTORYREG pPrev = NULL;
3318	PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3319	while (pCur && pCur->pFactory != pFactory)
3320	{
3321	pPrev = pCur;
3322	pCur = pCur->pNext;
3323	}
3324	if (!pCur)
3325	{
3326	if (pPrev)
3327	pPrev->pNext = pNewReg;
3328	else
3329	pSession->pDevExt->pComponentFactoryHead = pNewReg;
3330	rc = VINF_SUCCESS;
3331	}
3332	else
3333	rc = VERR_ALREADY_EXISTS;
3334
3335	RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3336	}
3337
3338	if (RT_FAILURE(rc))
3339	RTMemFree(pNewReg);
3340	}
3341	else
3342	rc = VERR_NO_MEMORY;
3343	return rc;
3344	}
3345
3346
3347	/**
3348	* Deregister a component factory.
3349	*
3350	* @returns VBox status code.
3351	* @retval VINF_SUCCESS on success.
3352	* @retval VERR_NOT_FOUND if the factory wasn't registered.
3353	* @retval VERR_ACCESS_DENIED if it isn't a kernel session.
3354	* @retval VERR_INVALID_PARAMETER on invalid parameter.
3355	* @retval VERR_INVALID_POINTER on invalid pointer parameter.
3356	*
3357	* @param pSession The SUPDRV session (must be a ring-0 session).
3358	* @param pFactory Pointer to the component factory registration structure
3359	* previously passed SUPR0ComponentRegisterFactory().
3360	*
3361	* @remarks This interface is also available via SUPR0IdcComponentDeregisterFactory.
3362	*/
3363	SUPR0DECL(int) SUPR0ComponentDeregisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
3364	{
3365	int rc;
3366
3367	/*
3368	* Validate parameters.
3369	*/
3370	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3371	AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
3372	AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
3373
3374	/*
3375	* Take the lock and look for the registration record.
3376	*/
3377	rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3378	if (RT_SUCCESS(rc))
3379	{
3380	PSUPDRVFACTORYREG pPrev = NULL;
3381	PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3382	while (pCur && pCur->pFactory != pFactory)
3383	{
3384	pPrev = pCur;
3385	pCur = pCur->pNext;
3386	}
3387	if (pCur)
3388	{
3389	if (!pPrev)
3390	pSession->pDevExt->pComponentFactoryHead = pCur->pNext;
3391	else
3392	pPrev->pNext = pCur->pNext;
3393
3394	pCur->pNext = NULL;
3395	pCur->pFactory = NULL;
3396	pCur->pSession = NULL;
3397	rc = VINF_SUCCESS;
3398	}
3399	else
3400	rc = VERR_NOT_FOUND;
3401
3402	RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3403
3404	RTMemFree(pCur);
3405	}
3406	return rc;
3407	}
3408
3409
3410	/**
3411	* Queries a component factory.
3412	*
3413	* @returns VBox status code.
3414	* @retval VERR_INVALID_PARAMETER on invalid parameter.
3415	* @retval VERR_INVALID_POINTER on invalid pointer parameter.
3416	* @retval VERR_SUPDRV_COMPONENT_NOT_FOUND if the component factory wasn't found.
3417	* @retval VERR_SUPDRV_INTERFACE_NOT_SUPPORTED if the interface wasn't supported.
3418	*
3419	* @param pSession The SUPDRV session.
3420	* @param pszName The name of the component factory.
3421	* @param pszInterfaceUuid The UUID of the factory interface (stringified).
3422	* @param ppvFactoryIf Where to store the factory interface.
3423	*/
3424	SUPR0DECL(int) SUPR0ComponentQueryFactory(PSUPDRVSESSION pSession, const char pszName, const char pszInterfaceUuid, void **ppvFactoryIf)
3425	{
3426	const char *pszEnd;
3427	size_t cchName;
3428	int rc;
3429
3430	/*
3431	* Validate parameters.
3432	*/
3433	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3434
3435	AssertPtrReturn(pszName, VERR_INVALID_POINTER);
3436	pszEnd = RTStrEnd(pszName, RT_SIZEOFMEMB(SUPDRVFACTORY, szName));
3437	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
3438	cchName = pszEnd - pszName;
3439
3440	AssertPtrReturn(pszInterfaceUuid, VERR_INVALID_POINTER);
3441	pszEnd = RTStrEnd(pszInterfaceUuid, RTUUID_STR_LENGTH);
3442	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
3443
3444	AssertPtrReturn(ppvFactoryIf, VERR_INVALID_POINTER);
3445	*ppvFactoryIf = NULL;
3446
3447	/*
3448	* Take the lock and try all factories by this name.
3449	*/
3450	rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3451	if (RT_SUCCESS(rc))
3452	{
3453	PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3454	rc = VERR_SUPDRV_COMPONENT_NOT_FOUND;
3455	while (pCur)
3456	{
3457	if ( pCur->cchName == cchName
3458	&& !memcmp(pCur->pFactory->szName, pszName, cchName))
3459	{
3460	void *pvFactory = pCur->pFactory->pfnQueryFactoryInterface(pCur->pFactory, pSession, pszInterfaceUuid);
3461	if (pvFactory)
3462	{
3463	*ppvFactoryIf = pvFactory;
3464	rc = VINF_SUCCESS;
3465	break;
3466	}
3467	rc = VERR_SUPDRV_INTERFACE_NOT_SUPPORTED;
3468	}
3469
3470	/* next */
3471	pCur = pCur->pNext;
3472	}
3473
3474	RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3475	}
3476	return rc;
3477	}
3478
3479
3480	/**
3481	* Adds a memory object to the session.
3482	*
3483	* @returns IPRT status code.
3484	* @param pMem Memory tracking structure containing the
3485	* information to track.
3486	* @param pSession The session.
3487	*/
3488	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession)
3489	{
3490	PSUPDRVBUNDLE pBundle;
3491	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3492
3493	/*
3494	* Find free entry and record the allocation.
3495	*/
3496	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3497	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3498	{
3499	if (pBundle->cUsed < RT_ELEMENTS(pBundle->aMem))
3500	{
3501	unsigned i;
3502	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3503	{
3504	if (pBundle->aMem[i].MemObj == NIL_RTR0MEMOBJ)
3505	{
3506	pBundle->cUsed++;
3507	pBundle->aMem[i] = *pMem;
3508	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3509	return VINF_SUCCESS;
3510	}
3511	}
3512	AssertFailed(); /* !!this can't be happening!!! */
3513	}
3514	}
3515	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3516
3517	/*
3518	* Need to allocate a new bundle.
3519	* Insert into the last entry in the bundle.
3520	*/
3521	pBundle = (PSUPDRVBUNDLE)RTMemAllocZ(sizeof(*pBundle));
3522	if (!pBundle)
3523	return VERR_NO_MEMORY;
3524
3525	/* take last entry. */
3526	pBundle->cUsed++;
3527	pBundle->aMem[RT_ELEMENTS(pBundle->aMem) - 1] = *pMem;
3528
3529	/* insert into list. */
3530	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3531	pBundle->pNext = pSession->Bundle.pNext;
3532	pSession->Bundle.pNext = pBundle;
3533	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3534
3535	return VINF_SUCCESS;
3536	}
3537
3538
3539	/**
3540	* Releases a memory object referenced by pointer and type.
3541	*
3542	* @returns IPRT status code.
3543	* @param pSession Session data.
3544	* @param uPtr Pointer to memory. This is matched against both the R0 and R3 addresses.
3545	* @param eType Memory type.
3546	*/
3547	static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType)
3548	{
3549	PSUPDRVBUNDLE pBundle;
3550	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3551
3552	/*
3553	* Validate input.
3554	*/
3555	if (!uPtr)
3556	{
3557	Log(("Illegal address %p\n", (void *)uPtr));
3558	return VERR_INVALID_PARAMETER;
3559	}
3560
3561	/*
3562	* Search for the address.
3563	*/
3564	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3565	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3566	{
3567	if (pBundle->cUsed > 0)
3568	{
3569	unsigned i;
3570	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3571	{
3572	if ( pBundle->aMem[i].eType == eType
3573	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3574	&& ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
3575	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
3576	&& RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr))
3577	)
3578	{
3579	/* Make a copy of it and release it outside the spinlock. */
3580	SUPDRVMEMREF Mem = pBundle->aMem[i];
3581	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
3582	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
3583	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
3584	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3585
3586	if (Mem.MapObjR3 != NIL_RTR0MEMOBJ)
3587	{
3588	int rc = RTR0MemObjFree(Mem.MapObjR3, false);
3589	AssertRC(rc); /** @todo figure out how to handle this. */
3590	}
3591	if (Mem.MemObj != NIL_RTR0MEMOBJ)
3592	{
3593	int rc = RTR0MemObjFree(Mem.MemObj, true /* fFreeMappings */);
3594	AssertRC(rc); /** @todo figure out how to handle this. */
3595	}
3596	return VINF_SUCCESS;
3597	}
3598	}
3599	}
3600	}
3601	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3602	Log(("Failed to find %p!!! (eType=%d)\n", (void *)uPtr, eType));
3603	return VERR_INVALID_PARAMETER;
3604	}
3605
3606
3607	/**
3608	* Opens an image. If it's the first time it's opened the call must upload
3609	* the bits using the supdrvIOCtl_LdrLoad() / SUPDRV_IOCTL_LDR_LOAD function.
3610	*
3611	* This is the 1st step of the loading.
3612	*
3613	* @returns IPRT status code.
3614	* @param pDevExt Device globals.
3615	* @param pSession Session data.
3616	* @param pReq The open request.
3617	*/
3618	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq)
3619	{
3620	int rc;
3621	PSUPDRVLDRIMAGE pImage;
3622	void *pv;
3623	size_t cchName = strlen(pReq->u.In.szName); /* (caller checked < 32). */
3624	LogFlow(("supdrvIOCtl_LdrOpen: szName=%s cbImageWithTabs=%d\n", pReq->u.In.szName, pReq->u.In.cbImageWithTabs));
3625
3626	/*
3627	* Check if we got an instance of the image already.
3628	*/
3629	supdrvLdrLock(pDevExt);
3630	for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
3631	{
3632	if ( pImage->szName[cchName] == '\0'
3633	&& !memcmp(pImage->szName, pReq->u.In.szName, cchName))
3634	{
3635	/** @todo check cbImageBits and cbImageWithTabs here, if they differs that indicates that the images are different. */
3636	pImage->cUsage++;
3637	pReq->u.Out.pvImageBase = pImage->pvImage;
3638	pReq->u.Out.fNeedsLoading = pImage->uState == SUP_IOCTL_LDR_OPEN;
3639	pReq->u.Out.fNativeLoader = pImage->fNative;
3640	supdrvLdrAddUsage(pSession, pImage);
3641	supdrvLdrUnlock(pDevExt);
3642	return VINF_SUCCESS;
3643	}
3644	}
3645	/* (not found - add it!) */
3646
3647	/*
3648	* Allocate memory.
3649	*/
3650	pv = RTMemAlloc(RT_OFFSETOF(SUPDRVLDRIMAGE, szName[cchName + 1]));
3651	if (!pv)
3652	{
3653	supdrvLdrUnlock(pDevExt);
3654	Log(("supdrvIOCtl_LdrOpen: RTMemAlloc() failed\n"));
3655	return /VERR_NO_MEMORY/ VERR_INTERNAL_ERROR_2;
3656	}
3657
3658	/*
3659	* Setup and link in the LDR stuff.
3660	*/
3661	pImage = (PSUPDRVLDRIMAGE)pv;
3662	pImage->pvImage = NULL;
3663	pImage->pvImageAlloc = NULL;
3664	pImage->cbImageWithTabs = pReq->u.In.cbImageWithTabs;
3665	pImage->cbImageBits = pReq->u.In.cbImageBits;
3666	pImage->cSymbols = 0;
3667	pImage->paSymbols = NULL;
3668	pImage->pachStrTab = NULL;
3669	pImage->cbStrTab = 0;
3670	pImage->pfnModuleInit = NULL;
3671	pImage->pfnModuleTerm = NULL;
3672	pImage->pfnServiceReqHandler = NULL;
3673	pImage->uState = SUP_IOCTL_LDR_OPEN;
3674	pImage->cUsage = 1;
3675	memcpy(pImage->szName, pReq->u.In.szName, cchName + 1);
3676
3677	/*
3678	* Try load it using the native loader, if that isn't supported, fall back
3679	* on the older method.
3680	*/
3681	pImage->fNative = true;
3682	rc = supdrvOSLdrOpen(pDevExt, pImage, pReq->u.In.szFilename);
3683	if (rc == VERR_NOT_SUPPORTED)
3684	{
3685	pImage->pvImageAlloc = RTMemExecAlloc(pImage->cbImageBits + 31);
3686	pImage->pvImage = RT_ALIGN_P(pImage->pvImageAlloc, 32);
3687	pImage->fNative = false;
3688	rc = pImage->pvImageAlloc ? VINF_SUCCESS : VERR_NO_EXEC_MEMORY;
3689	}
3690	if (RT_FAILURE(rc))
3691	{
3692	supdrvLdrUnlock(pDevExt);
3693	RTMemFree(pImage);
3694	Log(("supdrvIOCtl_LdrOpen(%s): failed - %Rrc\n", pReq->u.In.szName, rc));
3695	return rc;
3696	}
3697	Assert(VALID_PTR(pImage->pvImage) \|\| RT_FAILURE(rc));
3698
3699	/*
3700	* Link it.
3701	*/
3702	pImage->pNext = pDevExt->pLdrImages;
3703	pDevExt->pLdrImages = pImage;
3704
3705	supdrvLdrAddUsage(pSession, pImage);
3706
3707	pReq->u.Out.pvImageBase = pImage->pvImage;
3708	pReq->u.Out.fNeedsLoading = true;
3709	pReq->u.Out.fNativeLoader = pImage->fNative;
3710	supdrvLdrUnlock(pDevExt);
3711
3712	#if defined(RT_OS_WINDOWS) && defined(DEBUG)
3713	SUPR0Printf("VBoxDrv: windbg> .reload /f %s=%#p\n", pImage->szName, pImage->pvImage);
3714	#endif
3715	return VINF_SUCCESS;
3716	}
3717
3718
3719	/**
3720	* Worker that validates a pointer to an image entrypoint.
3721	*
3722	* @returns IPRT status code.
3723	* @param pDevExt The device globals.
3724	* @param pImage The loader image.
3725	* @param pv The pointer into the image.
3726	* @param fMayBeNull Whether it may be NULL.
3727	* @param pszWhat What is this entrypoint? (for logging)
3728	* @param pbImageBits The image bits prepared by ring-3.
3729	*
3730	* @remarks Will leave the lock on failure.
3731	*/
3732	static int supdrvLdrValidatePointer(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage, void *pv,
3733	bool fMayBeNull, const uint8_t pbImageBits, const char pszWhat)
3734	{
3735	if (!fMayBeNull \|\| pv)
3736	{
3737	if ((uintptr_t)pv - (uintptr_t)pImage->pvImage >= pImage->cbImageBits)
3738	{
3739	supdrvLdrUnlock(pDevExt);
3740	Log(("Out of range (%p LB %#x): %s=%p\n", pImage->pvImage, pImage->cbImageBits, pszWhat, pv));
3741	return VERR_INVALID_PARAMETER;
3742	}
3743
3744	if (pImage->fNative)
3745	{
3746	int rc = supdrvOSLdrValidatePointer(pDevExt, pImage, pv, pbImageBits);
3747	if (RT_FAILURE(rc))
3748	{
3749	supdrvLdrUnlock(pDevExt);
3750	Log(("Bad entry point address: %s=%p (rc=%Rrc)\n", pszWhat, pv, rc));
3751	return rc;
3752	}
3753	}
3754	}
3755	return VINF_SUCCESS;
3756	}
3757
3758
3759	/**
3760	* Loads the image bits.
3761	*
3762	* This is the 2nd step of the loading.
3763	*
3764	* @returns IPRT status code.
3765	* @param pDevExt Device globals.
3766	* @param pSession Session data.
3767	* @param pReq The request.
3768	*/
3769	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq)
3770	{
3771	PSUPDRVLDRUSAGE pUsage;
3772	PSUPDRVLDRIMAGE pImage;
3773	int rc;
3774	LogFlow(("supdrvIOCtl_LdrLoad: pvImageBase=%p cbImageWithBits=%d\n", pReq->u.In.pvImageBase, pReq->u.In.cbImageWithTabs));
3775
3776	/*
3777	* Find the ldr image.
3778	*/
3779	supdrvLdrLock(pDevExt);
3780	pUsage = pSession->pLdrUsage;
3781	while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
3782	pUsage = pUsage->pNext;
3783	if (!pUsage)
3784	{
3785	supdrvLdrUnlock(pDevExt);
3786	Log(("SUP_IOCTL_LDR_LOAD: couldn't find image!\n"));
3787	return VERR_INVALID_HANDLE;
3788	}
3789	pImage = pUsage->pImage;
3790
3791	/*
3792	* Validate input.
3793	*/
3794	if ( pImage->cbImageWithTabs != pReq->u.In.cbImageWithTabs
3795	\|\| pImage->cbImageBits != pReq->u.In.cbImageBits)
3796	{
3797	supdrvLdrUnlock(pDevExt);
3798	Log(("SUP_IOCTL_LDR_LOAD: image size mismatch!! %d(prep) != %d(load) or %d != %d\n",
3799	pImage->cbImageWithTabs, pReq->u.In.cbImageWithTabs, pImage->cbImageBits, pReq->u.In.cbImageBits));
3800	return VERR_INVALID_HANDLE;
3801	}
3802
3803	if (pImage->uState != SUP_IOCTL_LDR_OPEN)
3804	{
3805	unsigned uState = pImage->uState;
3806	supdrvLdrUnlock(pDevExt);
3807	if (uState != SUP_IOCTL_LDR_LOAD)
3808	AssertMsgFailed(("SUP_IOCTL_LDR_LOAD: invalid image state %d (%#x)!\n", uState, uState));
3809	return VERR_ALREADY_LOADED;
3810	}
3811
3812	switch (pReq->u.In.eEPType)
3813	{
3814	case SUPLDRLOADEP_NOTHING:
3815	break;
3816
3817	case SUPLDRLOADEP_VMMR0:
3818	rc = supdrvLdrValidatePointer( pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0, false, pReq->u.In.abImage, "pvVMMR0");
3819	if (RT_SUCCESS(rc))
3820	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt, false, pReq->u.In.abImage, "pvVMMR0EntryInt");
3821	if (RT_SUCCESS(rc))
3822	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, false, pReq->u.In.abImage, "pvVMMR0EntryFast");
3823	if (RT_SUCCESS(rc))
3824	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx, false, pReq->u.In.abImage, "pvVMMR0EntryEx");
3825	if (RT_FAILURE(rc))
3826	return rc;
3827	break;
3828
3829	case SUPLDRLOADEP_SERVICE:
3830	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.Service.pfnServiceReq, false, pReq->u.In.abImage, "pfnServiceReq");
3831	if (RT_FAILURE(rc))
3832	return rc;
3833	if ( pReq->u.In.EP.Service.apvReserved[0] != NIL_RTR0PTR
3834	\|\| pReq->u.In.EP.Service.apvReserved[1] != NIL_RTR0PTR
3835	\|\| pReq->u.In.EP.Service.apvReserved[2] != NIL_RTR0PTR)
3836	{
3837	supdrvLdrUnlock(pDevExt);
3838	Log(("Out of range (%p LB %#x): apvReserved={%p,%p,%p} MBZ!\n",
3839	pImage->pvImage, pReq->u.In.cbImageWithTabs,
3840	pReq->u.In.EP.Service.apvReserved[0],
3841	pReq->u.In.EP.Service.apvReserved[1],
3842	pReq->u.In.EP.Service.apvReserved[2]));
3843	return VERR_INVALID_PARAMETER;
3844	}
3845	break;
3846
3847	default:
3848	supdrvLdrUnlock(pDevExt);
3849	Log(("Invalid eEPType=%d\n", pReq->u.In.eEPType));
3850	return VERR_INVALID_PARAMETER;
3851	}
3852
3853	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.pfnModuleInit, true, pReq->u.In.abImage, "pfnModuleInit");
3854	if (RT_FAILURE(rc))
3855	return rc;
3856	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.pfnModuleTerm, true, pReq->u.In.abImage, "pfnModuleTerm");
3857	if (RT_FAILURE(rc))
3858	return rc;
3859
3860	/*
3861	* Allocate and copy the tables.
3862	* (No need to do try/except as this is a buffered request.)
3863	*/
3864	pImage->cbStrTab = pReq->u.In.cbStrTab;
3865	if (pImage->cbStrTab)
3866	{
3867	pImage->pachStrTab = (char *)RTMemAlloc(pImage->cbStrTab);
3868	if (pImage->pachStrTab)
3869	memcpy(pImage->pachStrTab, &pReq->u.In.abImage[pReq->u.In.offStrTab], pImage->cbStrTab);
3870	else
3871	rc = /VERR_NO_MEMORY/ VERR_INTERNAL_ERROR_3;
3872	}
3873
3874	pImage->cSymbols = pReq->u.In.cSymbols;
3875	if (RT_SUCCESS(rc) && pImage->cSymbols)
3876	{
3877	size_t cbSymbols = pImage->cSymbols * sizeof(SUPLDRSYM);
3878	pImage->paSymbols = (PSUPLDRSYM)RTMemAlloc(cbSymbols);
3879	if (pImage->paSymbols)
3880	memcpy(pImage->paSymbols, &pReq->u.In.abImage[pReq->u.In.offSymbols], cbSymbols);
3881	else
3882	rc = /VERR_NO_MEMORY/ VERR_INTERNAL_ERROR_4;
3883	}
3884
3885	/*
3886	* Copy the bits / complete native loading.
3887	*/
3888	if (RT_SUCCESS(rc))
3889	{
3890	pImage->uState = SUP_IOCTL_LDR_LOAD;
3891	pImage->pfnModuleInit = pReq->u.In.pfnModuleInit;
3892	pImage->pfnModuleTerm = pReq->u.In.pfnModuleTerm;
3893
3894	if (pImage->fNative)
3895	rc = supdrvOSLdrLoad(pDevExt, pImage, pReq->u.In.abImage);
3896	else
3897	memcpy(pImage->pvImage, &pReq->u.In.abImage[0], pImage->cbImageBits);
3898	}
3899
3900	/*
3901	* Update any entry points.
3902	*/
3903	if (RT_SUCCESS(rc))
3904	{
3905	switch (pReq->u.In.eEPType)
3906	{
3907	default:
3908	case SUPLDRLOADEP_NOTHING:
3909	rc = VINF_SUCCESS;
3910	break;
3911	case SUPLDRLOADEP_VMMR0:
3912	rc = supdrvLdrSetVMMR0EPs(pDevExt, pReq->u.In.EP.VMMR0.pvVMMR0, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt,
3913	pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx);
3914	break;
3915	case SUPLDRLOADEP_SERVICE:
3916	pImage->pfnServiceReqHandler = pReq->u.In.EP.Service.pfnServiceReq;
3917	rc = VINF_SUCCESS;
3918	break;
3919	}
3920	}
3921
3922	/*
3923	* On success call the module initialization.
3924	*/
3925	LogFlow(("supdrvIOCtl_LdrLoad: pfnModuleInit=%p\n", pImage->pfnModuleInit));
3926	if (RT_SUCCESS(rc) && pImage->pfnModuleInit)
3927	{
3928	Log(("supdrvIOCtl_LdrLoad: calling pfnModuleInit=%p\n", pImage->pfnModuleInit));
3929	rc = pImage->pfnModuleInit();
3930	if (rc && pDevExt->pvVMMR0 == pImage->pvImage)
3931	supdrvLdrUnsetVMMR0EPs(pDevExt);
3932	}
3933
3934	if (RT_FAILURE(rc))
3935	{
3936	pImage->uState = SUP_IOCTL_LDR_OPEN;
3937	pImage->pfnModuleInit = NULL;
3938	pImage->pfnModuleTerm = NULL;
3939	pImage->pfnServiceReqHandler= NULL;
3940	pImage->cbStrTab = 0;
3941	RTMemFree(pImage->pachStrTab);
3942	pImage->pachStrTab = NULL;
3943	RTMemFree(pImage->paSymbols);
3944	pImage->paSymbols = NULL;
3945	pImage->cSymbols = 0;
3946	}
3947
3948	supdrvLdrUnlock(pDevExt);
3949	return rc;
3950	}
3951
3952
3953	/**
3954	* Frees a previously loaded (prep'ed) image.
3955	*
3956	* @returns IPRT status code.
3957	* @param pDevExt Device globals.
3958	* @param pSession Session data.
3959	* @param pReq The request.
3960	*/
3961	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq)
3962	{
3963	int rc;
3964	PSUPDRVLDRUSAGE pUsagePrev;
3965	PSUPDRVLDRUSAGE pUsage;
3966	PSUPDRVLDRIMAGE pImage;
3967	LogFlow(("supdrvIOCtl_LdrFree: pvImageBase=%p\n", pReq->u.In.pvImageBase));
3968
3969	/*
3970	* Find the ldr image.
3971	*/
3972	supdrvLdrLock(pDevExt);
3973	pUsagePrev = NULL;
3974	pUsage = pSession->pLdrUsage;
3975	while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
3976	{
3977	pUsagePrev = pUsage;
3978	pUsage = pUsage->pNext;
3979	}
3980	if (!pUsage)
3981	{
3982	supdrvLdrUnlock(pDevExt);
3983	Log(("SUP_IOCTL_LDR_FREE: couldn't find image!\n"));
3984	return VERR_INVALID_HANDLE;
3985	}
3986
3987	/*
3988	* Check if we can remove anything.
3989	*/
3990	rc = VINF_SUCCESS;
3991	pImage = pUsage->pImage;
3992	if (pImage->cUsage <= 1 \|\| pUsage->cUsage <= 1)
3993	{
3994	/*
3995	* Check if there are any objects with destructors in the image, if
3996	* so leave it for the session cleanup routine so we get a chance to
3997	* clean things up in the right order and not leave them all dangling.
3998	*/
3999	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
4000	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
4001	if (pImage->cUsage <= 1)
4002	{
4003	PSUPDRVOBJ pObj;
4004	for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
4005	if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
4006	{
4007	rc = VERR_DANGLING_OBJECTS;
4008	break;
4009	}
4010	}
4011	else
4012	{
4013	PSUPDRVUSAGE pGenUsage;
4014	for (pGenUsage = pSession->pUsage; pGenUsage; pGenUsage = pGenUsage->pNext)
4015	if (RT_UNLIKELY((uintptr_t)pGenUsage->pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
4016	{
4017	rc = VERR_DANGLING_OBJECTS;
4018	break;
4019	}
4020	}
4021	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
4022	if (rc == VINF_SUCCESS)
4023	{
4024	/* unlink it */
4025	if (pUsagePrev)
4026	pUsagePrev->pNext = pUsage->pNext;
4027	else
4028	pSession->pLdrUsage = pUsage->pNext;
4029
4030	/* free it */
4031	pUsage->pImage = NULL;
4032	pUsage->pNext = NULL;
4033	RTMemFree(pUsage);
4034
4035	/*
4036	* Dereference the image.
4037	*/
4038	if (pImage->cUsage <= 1)
4039	supdrvLdrFree(pDevExt, pImage);
4040	else
4041	pImage->cUsage--;
4042	}
4043	else
4044	{
4045	Log(("supdrvIOCtl_LdrFree: Dangling objects in %p/%s!\n", pImage->pvImage, pImage->szName));
4046	rc = VINF_SUCCESS; /** @todo BRANCH-2.1: remove this after branching. */
4047	}
4048	}
4049	else
4050	{
4051	/*
4052	* Dereference both image and usage.
4053	*/
4054	pImage->cUsage--;
4055	pUsage->cUsage--;
4056	}
4057
4058	supdrvLdrUnlock(pDevExt);
4059	return rc;
4060	}
4061
4062
4063	/**
4064	* Gets the address of a symbol in an open image.
4065	*
4066	* @returns IPRT status code.
4067	* @param pDevExt Device globals.
4068	* @param pSession Session data.
4069	* @param pReq The request buffer.
4070	*/
4071	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq)
4072	{
4073	PSUPDRVLDRIMAGE pImage;
4074	PSUPDRVLDRUSAGE pUsage;
4075	uint32_t i;
4076	PSUPLDRSYM paSyms;
4077	const char *pchStrings;
4078	const size_t cbSymbol = strlen(pReq->u.In.szSymbol) + 1;
4079	void *pvSymbol = NULL;
4080	int rc = VERR_GENERAL_FAILURE;
4081	Log3(("supdrvIOCtl_LdrGetSymbol: pvImageBase=%p szSymbol=\"%s\"\n", pReq->u.In.pvImageBase, pReq->u.In.szSymbol));
4082
4083	/*
4084	* Find the ldr image.
4085	*/
4086	supdrvLdrLock(pDevExt);
4087	pUsage = pSession->pLdrUsage;
4088	while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
4089	pUsage = pUsage->pNext;
4090	if (!pUsage)
4091	{
4092	supdrvLdrUnlock(pDevExt);
4093	Log(("SUP_IOCTL_LDR_GET_SYMBOL: couldn't find image!\n"));
4094	return VERR_INVALID_HANDLE;
4095	}
4096	pImage = pUsage->pImage;
4097	if (pImage->uState != SUP_IOCTL_LDR_LOAD)
4098	{
4099	unsigned uState = pImage->uState;
4100	supdrvLdrUnlock(pDevExt);
4101	Log(("SUP_IOCTL_LDR_GET_SYMBOL: invalid image state %d (%#x)!\n", uState, uState)); NOREF(uState);
4102	return VERR_ALREADY_LOADED;
4103	}
4104
4105	/*
4106	* Search the symbol strings.
4107	*/
4108	pchStrings = pImage->pachStrTab;
4109	paSyms = pImage->paSymbols;
4110	for (i = 0; i < pImage->cSymbols; i++)
4111	{
4112	if ( paSyms[i].offSymbol < pImage->cbImageBits /* paranoia */
4113	&& paSyms[i].offName + cbSymbol <= pImage->cbStrTab
4114	&& !memcmp(pchStrings + paSyms[i].offName, pReq->u.In.szSymbol, cbSymbol))
4115	{
4116	pvSymbol = (uint8_t *)pImage->pvImage + paSyms[i].offSymbol;
4117	rc = VINF_SUCCESS;
4118	break;
4119	}
4120	}
4121	supdrvLdrUnlock(pDevExt);
4122	pReq->u.Out.pvSymbol = pvSymbol;
4123	return rc;
4124	}
4125
4126
4127	/**
4128	* Gets the address of a symbol in an open image or the support driver.
4129	*
4130	* @returns VINF_SUCCESS on success.
4131	* @returns
4132	* @param pDevExt Device globals.
4133	* @param pSession Session data.
4134	* @param pReq The request buffer.
4135	*/
4136	static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq)
4137	{
4138	int rc = VINF_SUCCESS;
4139	const char *pszSymbol = pReq->u.In.pszSymbol;
4140	const char *pszModule = pReq->u.In.pszModule;
4141	size_t cbSymbol;
4142	char const *pszEnd;
4143	uint32_t i;
4144
4145	/*
4146	* Input validation.
4147	*/
4148	AssertPtrReturn(pszSymbol, VERR_INVALID_POINTER);
4149	pszEnd = RTStrEnd(pszSymbol, 512);
4150	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4151	cbSymbol = pszEnd - pszSymbol + 1;
4152
4153	if (pszModule)
4154	{
4155	AssertPtrReturn(pszModule, VERR_INVALID_POINTER);
4156	pszEnd = RTStrEnd(pszModule, 64);
4157	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4158	}
4159	Log3(("supdrvIDC_LdrGetSymbol: pszModule=%p:{%s} pszSymbol=%p:{%s}\n", pszModule, pszModule, pszSymbol, pszSymbol));
4160
4161
4162	if ( !pszModule
4163	\|\| !strcmp(pszModule, "SupDrv"))
4164	{
4165	/*
4166	* Search the support driver export table.
4167	*/
4168	for (i = 0; i < RT_ELEMENTS(g_aFunctions); i++)
4169	if (!strcmp(g_aFunctions[i].szName, pszSymbol))
4170	{
4171	pReq->u.Out.pfnSymbol = g_aFunctions[i].pfn;
4172	break;
4173	}
4174	}
4175	else
4176	{
4177	/*
4178	* Find the loader image.
4179	*/
4180	PSUPDRVLDRIMAGE pImage;
4181
4182	supdrvLdrLock(pDevExt);
4183
4184	for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
4185	if (!strcmp(pImage->szName, pszModule))
4186	break;
4187	if (pImage && pImage->uState == SUP_IOCTL_LDR_LOAD)
4188	{
4189	/*
4190	* Search the symbol strings.
4191	*/
4192	const char *pchStrings = pImage->pachStrTab;
4193	PCSUPLDRSYM paSyms = pImage->paSymbols;
4194	for (i = 0; i < pImage->cSymbols; i++)
4195	{
4196	if ( paSyms[i].offSymbol < pImage->cbImageBits /* paranoia */
4197	&& paSyms[i].offName + cbSymbol <= pImage->cbStrTab
4198	&& !memcmp(pchStrings + paSyms[i].offName, pszSymbol, cbSymbol))
4199	{
4200	/*
4201	* Found it! Calc the symbol address and add a reference to the module.
4202	*/
4203	pReq->u.Out.pfnSymbol = (PFNRT)((uint8_t *)pImage->pvImage + paSyms[i].offSymbol);
4204	rc = supdrvLdrAddUsage(pSession, pImage);
4205	break;
4206	}
4207	}
4208	}
4209	else
4210	rc = pImage ? VERR_WRONG_ORDER : VERR_MODULE_NOT_FOUND;
4211
4212	supdrvLdrUnlock(pDevExt);
4213	}
4214	return rc;
4215	}
4216
4217
4218	/**
4219	* Updates the VMMR0 entry point pointers.
4220	*
4221	* @returns IPRT status code.
4222	* @param pDevExt Device globals.
4223	* @param pSession Session data.
4224	* @param pVMMR0 VMMR0 image handle.
4225	* @param pvVMMR0EntryInt VMMR0EntryInt address.
4226	* @param pvVMMR0EntryFast VMMR0EntryFast address.
4227	* @param pvVMMR0EntryEx VMMR0EntryEx address.
4228	* @remark Caller must own the loader mutex.
4229	*/
4230	static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0EntryInt, void pvVMMR0EntryFast, void pvVMMR0EntryEx)
4231	{
4232	int rc = VINF_SUCCESS;
4233	LogFlow(("supdrvLdrSetR0EP pvVMMR0=%p pvVMMR0EntryInt=%p\n", pvVMMR0, pvVMMR0EntryInt));
4234
4235
4236	/*
4237	* Check if not yet set.
4238	*/
4239	if (!pDevExt->pvVMMR0)
4240	{
4241	pDevExt->pvVMMR0 = pvVMMR0;
4242	pDevExt->pfnVMMR0EntryInt = pvVMMR0EntryInt;
4243	pDevExt->pfnVMMR0EntryFast = pvVMMR0EntryFast;
4244	pDevExt->pfnVMMR0EntryEx = pvVMMR0EntryEx;
4245	}
4246	else
4247	{
4248	/*
4249	* Return failure or success depending on whether the values match or not.
4250	*/
4251	if ( pDevExt->pvVMMR0 != pvVMMR0
4252	\|\| (void *)pDevExt->pfnVMMR0EntryInt != pvVMMR0EntryInt
4253	\|\| (void *)pDevExt->pfnVMMR0EntryFast != pvVMMR0EntryFast
4254	\|\| (void *)pDevExt->pfnVMMR0EntryEx != pvVMMR0EntryEx)
4255	{
4256	AssertMsgFailed(("SUP_IOCTL_LDR_SETR0EP: Already set pointing to a different module!\n"));
4257	rc = VERR_INVALID_PARAMETER;
4258	}
4259	}
4260	return rc;
4261	}
4262
4263
4264	/**
4265	* Unsets the VMMR0 entry point installed by supdrvLdrSetR0EP.
4266	*
4267	* @param pDevExt Device globals.
4268	*/
4269	static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt)
4270	{
4271	pDevExt->pvVMMR0 = NULL;
4272	pDevExt->pfnVMMR0EntryInt = NULL;
4273	pDevExt->pfnVMMR0EntryFast = NULL;
4274	pDevExt->pfnVMMR0EntryEx = NULL;
4275	}
4276
4277
4278	/**
4279	* Adds a usage reference in the specified session of an image.
4280	*
4281	* Called while owning the loader semaphore.
4282	*
4283	* @returns VINF_SUCCESS on success and VERR_NO_MEMORY on failure.
4284	* @param pSession Session in question.
4285	* @param pImage Image which the session is using.
4286	*/
4287	static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage)
4288	{
4289	PSUPDRVLDRUSAGE pUsage;
4290	LogFlow(("supdrvLdrAddUsage: pImage=%p\n", pImage));
4291
4292	/*
4293	* Referenced it already?
4294	*/
4295	pUsage = pSession->pLdrUsage;
4296	while (pUsage)
4297	{
4298	if (pUsage->pImage == pImage)
4299	{
4300	pUsage->cUsage++;
4301	return VINF_SUCCESS;
4302	}
4303	pUsage = pUsage->pNext;
4304	}
4305
4306	/*
4307	* Allocate new usage record.
4308	*/
4309	pUsage = (PSUPDRVLDRUSAGE)RTMemAlloc(sizeof(*pUsage));
4310	AssertReturn(pUsage, /VERR_NO_MEMORY/ VERR_INTERNAL_ERROR_5);
4311	pUsage->cUsage = 1;
4312	pUsage->pImage = pImage;
4313	pUsage->pNext = pSession->pLdrUsage;
4314	pSession->pLdrUsage = pUsage;
4315	return VINF_SUCCESS;
4316	}
4317
4318
4319	/**
4320	* Frees a load image.
4321	*
4322	* @param pDevExt Pointer to device extension.
4323	* @param pImage Pointer to the image we're gonna free.
4324	* This image must exit!
4325	* @remark The caller MUST own SUPDRVDEVEXT::mtxLdr!
4326	*/
4327	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage)
4328	{
4329	PSUPDRVLDRIMAGE pImagePrev;
4330	LogFlow(("supdrvLdrFree: pImage=%p\n", pImage));
4331
4332	/* find it - arg. should've used doubly linked list. */
4333	Assert(pDevExt->pLdrImages);
4334	pImagePrev = NULL;
4335	if (pDevExt->pLdrImages != pImage)
4336	{
4337	pImagePrev = pDevExt->pLdrImages;
4338	while (pImagePrev->pNext != pImage)
4339	pImagePrev = pImagePrev->pNext;
4340	Assert(pImagePrev->pNext == pImage);
4341	}
4342
4343	/* unlink */
4344	if (pImagePrev)
4345	pImagePrev->pNext = pImage->pNext;
4346	else
4347	pDevExt->pLdrImages = pImage->pNext;
4348
4349	/* check if this is VMMR0.r0 unset its entry point pointers. */
4350	if (pDevExt->pvVMMR0 == pImage->pvImage)
4351	supdrvLdrUnsetVMMR0EPs(pDevExt);
4352
4353	/* check for objects with destructors in this image. (Shouldn't happen.) */
4354	if (pDevExt->pObjs)
4355	{
4356	unsigned cObjs = 0;
4357	PSUPDRVOBJ pObj;
4358	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
4359	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
4360	for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
4361	if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
4362	{
4363	pObj->pfnDestructor = NULL;
4364	cObjs++;
4365	}
4366	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
4367	if (cObjs)
4368	OSDBGPRINT(("supdrvLdrFree: Image '%s' has %d dangling objects!\n", pImage->szName, cObjs));
4369	}
4370
4371	/* call termination function if fully loaded. */
4372	if ( pImage->pfnModuleTerm
4373	&& pImage->uState == SUP_IOCTL_LDR_LOAD)
4374	{
4375	LogFlow(("supdrvIOCtl_LdrLoad: calling pfnModuleTerm=%p\n", pImage->pfnModuleTerm));
4376	pImage->pfnModuleTerm();
4377	}
4378
4379	/* do native unload if appropriate. */
4380	if (pImage->fNative)
4381	supdrvOSLdrUnload(pDevExt, pImage);
4382
4383	/* free the image */
4384	pImage->cUsage = 0;
4385	pImage->pNext = 0;
4386	pImage->uState = SUP_IOCTL_LDR_FREE;
4387	RTMemExecFree(pImage->pvImageAlloc);
4388	pImage->pvImageAlloc = NULL;
4389	RTMemFree(pImage->pachStrTab);
4390	pImage->pachStrTab = NULL;
4391	RTMemFree(pImage->paSymbols);
4392	pImage->paSymbols = NULL;
4393	RTMemFree(pImage);
4394	}
4395
4396
4397	/**
4398	* Acquires the loader lock.
4399	*
4400	* @returns IPRT status code.
4401	* @param pDevExt The device extension.
4402	*/
4403	DECLINLINE(int) supdrvLdrLock(PSUPDRVDEVEXT pDevExt)
4404	{
4405	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
4406	int rc = RTSemMutexRequest(pDevExt->mtxLdr, RT_INDEFINITE_WAIT);
4407	#else
4408	int rc = RTSemFastMutexRequest(pDevExt->mtxLdr);
4409	#endif
4410	AssertRC(rc);
4411	return rc;
4412	}
4413
4414
4415	/**
4416	* Releases the loader lock.
4417	*
4418	* @returns IPRT status code.
4419	* @param pDevExt The device extension.
4420	*/
4421	DECLINLINE(int) supdrvLdrUnlock(PSUPDRVDEVEXT pDevExt)
4422	{
4423	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
4424	return RTSemMutexRelease(pDevExt->mtxLdr);
4425	#else
4426	return RTSemFastMutexRelease(pDevExt->mtxLdr);
4427	#endif
4428	}
4429
4430
4431	/**
4432	* Implements the service call request.
4433	*
4434	* @returns VBox status code.
4435	* @param pDevExt The device extension.
4436	* @param pSession The calling session.
4437	* @param pReq The request packet, valid.
4438	*/
4439	static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq)
4440	{
4441	#if !defined(RT_OS_WINDOWS) \|\| defined(DEBUG)
4442	int rc;
4443
4444	/*
4445	* Find the module first in the module referenced by the calling session.
4446	*/
4447	rc = supdrvLdrLock(pDevExt);
4448	if (RT_SUCCESS(rc))
4449	{
4450	PFNSUPR0SERVICEREQHANDLER pfnServiceReqHandler = NULL;
4451	PSUPDRVLDRUSAGE pUsage;
4452
4453	for (pUsage = pSession->pLdrUsage; pUsage; pUsage = pUsage->pNext)
4454	if ( pUsage->pImage->pfnServiceReqHandler
4455	&& !strcmp(pUsage->pImage->szName, pReq->u.In.szName))
4456	{
4457	pfnServiceReqHandler = pUsage->pImage->pfnServiceReqHandler;
4458	break;
4459	}
4460	supdrvLdrUnlock(pDevExt);
4461
4462	if (pfnServiceReqHandler)
4463	{
4464	/*
4465	* Call it.
4466	*/
4467	if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
4468	rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, NULL);
4469	else
4470	rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0]);
4471	}
4472	else
4473	rc = VERR_SUPDRV_SERVICE_NOT_FOUND;
4474	}
4475
4476	/* log it */
4477	if ( RT_FAILURE(rc)
4478	&& rc != VERR_INTERRUPTED
4479	&& rc != VERR_TIMEOUT)
4480	Log(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
4481	rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
4482	else
4483	Log4(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
4484	rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
4485	return rc;
4486	#else /* RT_OS_WINDOWS && !DEBUG */
4487	return VERR_NOT_IMPLEMENTED;
4488	#endif /* RT_OS_WINDOWS && !DEBUG */
4489	}
4490
4491
4492	/**
4493	* Implements the logger settings request.
4494	*
4495	* @returns VBox status code.
4496	* @param pDevExt The device extension.
4497	* @param pSession The caller's session.
4498	* @param pReq The request.
4499	*/
4500	static int supdrvIOCtl_LoggerSettings(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLOGGERSETTINGS pReq)
4501	{
4502	const char *pszGroup = &pReq->u.In.szStrings[pReq->u.In.offGroups];
4503	const char *pszFlags = &pReq->u.In.szStrings[pReq->u.In.offFlags];
4504	const char *pszDest = &pReq->u.In.szStrings[pReq->u.In.offDestination];
4505	PRTLOGGER pLogger = NULL;
4506	int rc;
4507
4508	/*
4509	* Some further validation.
4510	*/
4511	switch (pReq->u.In.fWhat)
4512	{
4513	case SUPLOGGERSETTINGS_WHAT_SETTINGS:
4514	case SUPLOGGERSETTINGS_WHAT_CREATE:
4515	break;
4516
4517	case SUPLOGGERSETTINGS_WHAT_DESTROY:
4518	if (pszGroup \|\| pszFlags \|\| *pszDest)
4519	return VERR_INVALID_PARAMETER;
4520	if (pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_RELEASE)
4521	return VERR_ACCESS_DENIED;
4522	break;
4523
4524	default:
4525	return VERR_INTERNAL_ERROR;
4526	}
4527
4528	/*
4529	* Get the logger.
4530	*/
4531	switch (pReq->u.In.fWhich)
4532	{
4533	case SUPLOGGERSETTINGS_WHICH_DEBUG:
4534	pLogger = RTLogGetDefaultInstance();
4535	break;
4536
4537	case SUPLOGGERSETTINGS_WHICH_RELEASE:
4538	pLogger = RTLogRelDefaultInstance();
4539	break;
4540
4541	default:
4542	return VERR_INTERNAL_ERROR;
4543	}
4544
4545	/*
4546	* Do the job.
4547	*/
4548	switch (pReq->u.In.fWhat)
4549	{
4550	case SUPLOGGERSETTINGS_WHAT_SETTINGS:
4551	if (pLogger)
4552	{
4553	rc = RTLogFlags(pLogger, pszFlags);
4554	if (RT_SUCCESS(rc))
4555	rc = RTLogGroupSettings(pLogger, pszGroup);
4556	NOREF(pszDest);
4557	}
4558	else
4559	rc = VERR_NOT_FOUND;
4560	break;
4561
4562	case SUPLOGGERSETTINGS_WHAT_CREATE:
4563	{
4564	if (pLogger)
4565	rc = VERR_ALREADY_EXISTS;
4566	else
4567	{
4568	static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
4569
4570	rc = RTLogCreate(&pLogger,
4571	0 /* fFlags */,
4572	pszGroup,
4573	pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_DEBUG
4574	? "VBOX_LOG"
4575	: "VBOX_RELEASE_LOG",
4576	RT_ELEMENTS(s_apszGroups),
4577	s_apszGroups,
4578	RTLOGDEST_STDOUT \| RTLOGDEST_DEBUGGER,
4579	NULL);
4580	if (RT_SUCCESS(rc))
4581	{
4582	rc = RTLogFlags(pLogger, pszFlags);
4583	NOREF(pszDest);
4584	if (RT_SUCCESS(rc))
4585	{
4586	switch (pReq->u.In.fWhich)
4587	{
4588	case SUPLOGGERSETTINGS_WHICH_DEBUG:
4589	pLogger = RTLogSetDefaultInstance(pLogger);
4590	break;
4591	case SUPLOGGERSETTINGS_WHICH_RELEASE:
4592	pLogger = RTLogRelSetDefaultInstance(pLogger);
4593	break;
4594	}
4595	}
4596	RTLogDestroy(pLogger);
4597	}
4598	}
4599	break;
4600	}
4601
4602	case SUPLOGGERSETTINGS_WHAT_DESTROY:
4603	switch (pReq->u.In.fWhich)
4604	{
4605	case SUPLOGGERSETTINGS_WHICH_DEBUG:
4606	pLogger = RTLogSetDefaultInstance(NULL);
4607	break;
4608	case SUPLOGGERSETTINGS_WHICH_RELEASE:
4609	pLogger = RTLogRelSetDefaultInstance(NULL);
4610	break;
4611	}
4612	rc = RTLogDestroy(pLogger);
4613	break;
4614
4615	default:
4616	{
4617	rc = VERR_INTERNAL_ERROR;
4618	break;
4619	}
4620	}
4621
4622	return rc;
4623	}
4624
4625
4626	/**
4627	* Creates the GIP.
4628	*
4629	* @returns VBox status code.
4630	* @param pDevExt Instance data. GIP stuff may be updated.
4631	*/
4632	static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt)
4633	{
4634	PSUPGLOBALINFOPAGE pGip;
4635	RTHCPHYS HCPhysGip;
4636	uint32_t u32SystemResolution;
4637	uint32_t u32Interval;
4638	int rc;
4639
4640	LogFlow(("supdrvGipCreate:\n"));
4641
4642	/* assert order */
4643	Assert(pDevExt->u32SystemTimerGranularityGrant == 0);
4644	Assert(pDevExt->GipMemObj == NIL_RTR0MEMOBJ);
4645	Assert(!pDevExt->pGipTimer);
4646
4647	/*
4648	* Allocate a suitable page with a default kernel mapping.
4649	*/
4650	rc = RTR0MemObjAllocLow(&pDevExt->GipMemObj, PAGE_SIZE, false);
4651	if (RT_FAILURE(rc))
4652	{
4653	OSDBGPRINT(("supdrvGipCreate: failed to allocate the GIP page. rc=%d\n", rc));
4654	return rc;
4655	}
4656	pGip = (PSUPGLOBALINFOPAGE)RTR0MemObjAddress(pDevExt->GipMemObj); AssertPtr(pGip);
4657	HCPhysGip = RTR0MemObjGetPagePhysAddr(pDevExt->GipMemObj, 0); Assert(HCPhysGip != NIL_RTHCPHYS);
4658
4659	#if 0 /** @todo Disabled this as we didn't used to do it before and causes unnecessary stress on laptops.
4660	* It only applies to Windows and should probably revisited later, if possible made part of the
4661	* timer code (return min granularity in RTTimerGetSystemGranularity and set it in RTTimerStart). */
4662	/*
4663	* Try bump up the system timer resolution.
4664	* The more interrupts the better...
4665	*/
4666	if ( RT_SUCCESS(RTTimerRequestSystemGranularity( 488281 /* 2048 HZ */, &u32SystemResolution))
4667	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 500000 /* 2000 HZ */, &u32SystemResolution))
4668	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 976563 /* 1024 HZ */, &u32SystemResolution))
4669	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 1000000 /* 1000 HZ */, &u32SystemResolution))
4670	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 1953125 /* 512 HZ */, &u32SystemResolution))
4671	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 2000000 /* 500 HZ */, &u32SystemResolution))
4672	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 3906250 /* 256 HZ */, &u32SystemResolution))
4673	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 4000000 /* 250 HZ */, &u32SystemResolution))
4674	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 7812500 /* 128 HZ */, &u32SystemResolution))
4675	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(10000000 /* 100 HZ */, &u32SystemResolution))
4676	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(15625000 /* 64 HZ */, &u32SystemResolution))
4677	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(31250000 /* 32 HZ */, &u32SystemResolution))
4678	)
4679	{
4680	Assert(RTTimerGetSystemGranularity() <= u32SystemResolution);
4681	pDevExt->u32SystemTimerGranularityGrant = u32SystemResolution;
4682	}
4683	#endif
4684
4685	/*
4686	* Find a reasonable update interval and initialize the structure.
4687	*/
4688	u32Interval = u32SystemResolution = RTTimerGetSystemGranularity();
4689	while (u32Interval < 10000000 /* 10 ms */)
4690	u32Interval += u32SystemResolution;
4691
4692	supdrvGipInit(pDevExt, pGip, HCPhysGip, RTTimeSystemNanoTS(), 1000000000 / u32Interval /=Hz/);
4693
4694	/*
4695	* Create the timer.
4696	* If CPU_ALL isn't supported we'll have to fall back to synchronous mode.
4697	*/
4698	if (pGip->u32Mode == SUPGIPMODE_ASYNC_TSC)
4699	{
4700	rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, RTTIMER_FLAGS_CPU_ALL, supdrvGipAsyncTimer, pDevExt);
4701	if (rc == VERR_NOT_SUPPORTED)
4702	{
4703	OSDBGPRINT(("supdrvGipCreate: omni timer not supported, falling back to synchronous mode\n"));
4704	pGip->u32Mode = SUPGIPMODE_SYNC_TSC;
4705	}
4706	}
4707	if (pGip->u32Mode != SUPGIPMODE_ASYNC_TSC)
4708	rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, 0, supdrvGipSyncTimer, pDevExt);
4709	if (RT_SUCCESS(rc))
4710	{
4711	if (pGip->u32Mode == SUPGIPMODE_ASYNC_TSC)
4712	rc = RTMpNotificationRegister(supdrvGipMpEvent, pDevExt);
4713	if (RT_SUCCESS(rc))
4714	{
4715	/*
4716	* We're good.
4717	*/
4718	Log(("supdrvGipCreate: %ld ns interval.\n", (long)u32Interval));
4719	g_pSUPGlobalInfoPage = pGip;
4720	return VINF_SUCCESS;
4721	}
4722
4723	OSDBGPRINT(("supdrvGipCreate: failed register MP event notfication. rc=%d\n", rc));
4724	}
4725	else
4726	{
4727	OSDBGPRINT(("supdrvGipCreate: failed create GIP timer at %ld ns interval. rc=%d\n", (long)u32Interval, rc));
4728	Assert(!pDevExt->pGipTimer);
4729	}
4730	supdrvGipDestroy(pDevExt);
4731	return rc;
4732	}
4733
4734
4735	/**
4736	* Terminates the GIP.
4737	*
4738	* @param pDevExt Instance data. GIP stuff may be updated.
4739	*/
4740	static void supdrvGipDestroy(PSUPDRVDEVEXT pDevExt)
4741	{
4742	int rc;
4743	#ifdef DEBUG_DARWIN_GIP
4744	OSDBGPRINT(("supdrvGipDestroy: pDevExt=%p pGip=%p pGipTimer=%p GipMemObj=%p\n", pDevExt,
4745	pDevExt->GipMemObj != NIL_RTR0MEMOBJ ? RTR0MemObjAddress(pDevExt->GipMemObj) : NULL,
4746	pDevExt->pGipTimer, pDevExt->GipMemObj));
4747	#endif
4748
4749	/*
4750	* Invalid the GIP data.
4751	*/
4752	if (pDevExt->pGip)
4753	{
4754	supdrvGipTerm(pDevExt->pGip);
4755	pDevExt->pGip = NULL;
4756	}
4757	g_pSUPGlobalInfoPage = NULL;
4758
4759	/*
4760	* Destroy the timer and free the GIP memory object.
4761	*/
4762	if (pDevExt->pGipTimer)
4763	{
4764	rc = RTTimerDestroy(pDevExt->pGipTimer); AssertRC(rc);
4765	pDevExt->pGipTimer = NULL;
4766	}
4767
4768	if (pDevExt->GipMemObj != NIL_RTR0MEMOBJ)
4769	{
4770	rc = RTR0MemObjFree(pDevExt->GipMemObj, true /* free mappings */); AssertRC(rc);
4771	pDevExt->GipMemObj = NIL_RTR0MEMOBJ;
4772	}
4773
4774	/*
4775	* Finally, release the system timer resolution request if one succeeded.
4776	*/
4777	if (pDevExt->u32SystemTimerGranularityGrant)
4778	{
4779	rc = RTTimerReleaseSystemGranularity(pDevExt->u32SystemTimerGranularityGrant); AssertRC(rc);
4780	pDevExt->u32SystemTimerGranularityGrant = 0;
4781	}
4782	}
4783
4784
4785	/**
4786	* Timer callback function sync GIP mode.
4787	* @param pTimer The timer.
4788	* @param pvUser The device extension.
4789	*/
4790	static DECLCALLBACK(void) supdrvGipSyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick)
4791	{
4792	RTCCUINTREG fOldFlags = ASMIntDisableFlags(); /* No interruptions please (real problem on S10). */
4793	PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
4794	uint64_t u64TSC = ASMReadTSC();
4795	uint64_t NanoTS = RTTimeSystemNanoTS();
4796
4797	supdrvGipUpdate(pDevExt->pGip, NanoTS, u64TSC, iTick);
4798
4799	ASMSetFlags(fOldFlags);
4800	}
4801
4802
4803	/**
4804	* Timer callback function for async GIP mode.
4805	* @param pTimer The timer.
4806	* @param pvUser The device extension.
4807	*/
4808	static DECLCALLBACK(void) supdrvGipAsyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick)
4809	{
4810	RTCCUINTREG fOldFlags = ASMIntDisableFlags(); /* No interruptions please (real problem on S10). */
4811	PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
4812	RTCPUID idCpu = RTMpCpuId();
4813	uint64_t u64TSC = ASMReadTSC();
4814	uint64_t NanoTS = RTTimeSystemNanoTS();
4815
4816	/** @todo reset the transaction number and whatnot when iTick == 1. */
4817	if (pDevExt->idGipMaster == idCpu)
4818	supdrvGipUpdate(pDevExt->pGip, NanoTS, u64TSC, iTick);
4819	else
4820	supdrvGipUpdatePerCpu(pDevExt->pGip, NanoTS, u64TSC, ASMGetApicId(), iTick);
4821
4822	ASMSetFlags(fOldFlags);
4823	}
4824
4825
4826	/**
4827	* Multiprocessor event notification callback.
4828	*
4829	* This is used to make sue that the GIP master gets passed on to
4830	* another CPU.
4831	*
4832	* @param enmEvent The event.
4833	* @param idCpu The cpu it applies to.
4834	* @param pvUser Pointer to the device extension.
4835	*/
4836	static DECLCALLBACK(void) supdrvGipMpEvent(RTMPEVENT enmEvent, RTCPUID idCpu, void *pvUser)
4837	{
4838	PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
4839	if (enmEvent == RTMPEVENT_OFFLINE)
4840	{
4841	RTCPUID idGipMaster;
4842	ASMAtomicReadSize(&pDevExt->idGipMaster, &idGipMaster);
4843	if (idGipMaster == idCpu)
4844	{
4845	/*
4846	* Find a new GIP master.
4847	*/
4848	bool fIgnored;
4849	unsigned i;
4850	RTCPUID idNewGipMaster = NIL_RTCPUID;
4851	RTCPUSET OnlineCpus;
4852	RTMpGetOnlineSet(&OnlineCpus);
4853
4854	for (i = 0; i < RTCPUSET_MAX_CPUS; i++)
4855	{
4856	RTCPUID idCurCpu = RTMpCpuIdFromSetIndex(i);
4857	if ( RTCpuSetIsMember(&OnlineCpus, idCurCpu)
4858	&& idCurCpu != idGipMaster)
4859	{
4860	idNewGipMaster = idCurCpu;
4861	break;
4862	}
4863	}
4864
4865	Log(("supdrvGipMpEvent: Gip master %#lx -> %#lx\n", (long)idGipMaster, (long)idNewGipMaster));
4866	ASMAtomicCmpXchgSize(&pDevExt->idGipMaster, idNewGipMaster, idGipMaster, fIgnored);
4867	NOREF(fIgnored);
4868	}
4869	}
4870	}
4871
4872
4873	/**
4874	* Callback used by supdrvDetermineAsyncTSC to read the TSC on a CPU.
4875	*
4876	* @param idCpu Ignored.
4877	* @param pvUser1 Where to put the TSC.
4878	* @param pvUser2 Ignored.
4879	*/
4880	static DECLCALLBACK(void) supdrvDetermineAsyncTscWorker(RTCPUID idCpu, void pvUser1, void pvUser2)
4881	{
4882	#if 1
4883	ASMAtomicWriteU64((uint64_t volatile *)pvUser1, ASMReadTSC());
4884	#else
4885	(uint64_t )pvUser1 = ASMReadTSC();
4886	#endif
4887	}
4888
4889
4890	/**
4891	* Determine if Async GIP mode is required because of TSC drift.
4892	*
4893	* When using the default/normal timer code it is essential that the time stamp counter
4894	* (TSC) runs never backwards, that is, a read operation to the counter should return
4895	* a bigger value than any previous read operation. This is guaranteed by the latest
4896	* AMD CPUs and by newer Intel CPUs which never enter the C2 state (P4). In any other
4897	* case we have to choose the asynchronous timer mode.
4898	*
4899	* @param poffMin Pointer to the determined difference between different cores.
4900	* @return false if the time stamp counters appear to be synchron, true otherwise.
4901	*/
4902	static bool supdrvDetermineAsyncTsc(uint64_t *poffMin)
4903	{
4904	/*
4905	* Just iterate all the cpus 8 times and make sure that the TSC is
4906	* ever increasing. We don't bother taking TSC rollover into account.
4907	*/
4908	int iEndCpu = RTMpGetArraySize();
4909	int iCpu;
4910	int cLoops = 8;
4911	bool fAsync = false;
4912	int rc = VINF_SUCCESS;
4913	uint64_t offMax = 0;
4914	uint64_t offMin = ~(uint64_t)0;
4915	uint64_t PrevTsc = ASMReadTSC();
4916
4917	while (cLoops-- > 0)
4918	{
4919	for (iCpu = 0; iCpu < iEndCpu; iCpu++)
4920	{
4921	uint64_t CurTsc;
4922	rc = RTMpOnSpecific(RTMpCpuIdFromSetIndex(iCpu), supdrvDetermineAsyncTscWorker, &CurTsc, NULL);
4923	if (RT_SUCCESS(rc))
4924	{
4925	if (CurTsc <= PrevTsc)
4926	{
4927	fAsync = true;
4928	offMin = offMax = PrevTsc - CurTsc;
4929	Log(("supdrvDetermineAsyncTsc: iCpu=%d cLoops=%d CurTsc=%llx PrevTsc=%llx\n",
4930	iCpu, cLoops, CurTsc, PrevTsc));
4931	break;
4932	}
4933
4934	/* Gather statistics (except the first time). */
4935	if (iCpu != 0 \|\| cLoops != 7)
4936	{
4937	uint64_t off = CurTsc - PrevTsc;
4938	if (off < offMin)
4939	offMin = off;
4940	if (off > offMax)
4941	offMax = off;
4942	Log2(("%d/%d: off=%llx\n", cLoops, iCpu, off));
4943	}
4944
4945	/* Next */
4946	PrevTsc = CurTsc;
4947	}
4948	else if (rc == VERR_NOT_SUPPORTED)
4949	break;
4950	else
4951	AssertMsg(rc == VERR_CPU_NOT_FOUND \|\| rc == VERR_CPU_OFFLINE, ("%d\n", rc));
4952	}
4953
4954	/* broke out of the loop. */
4955	if (iCpu < iEndCpu)
4956	break;
4957	}
4958
4959	poffMin = offMin; / Almost RTMpOnSpecific profiling. */
4960	Log(("supdrvDetermineAsyncTsc: returns %d; iEndCpu=%d rc=%d offMin=%llx offMax=%llx\n",
4961	fAsync, iEndCpu, rc, offMin, offMax));
4962	#if !defined(RT_OS_SOLARIS) && !defined(RT_OS_OS2) && !defined(RT_OS_WINDOWS)
4963	OSDBGPRINT(("vboxdrv: fAsync=%d offMin=%#lx offMax=%#lx\n", fAsync, (long)offMin, (long)offMax));
4964	#endif
4965	return fAsync;
4966	}
4967
4968
4969	/**
4970	* Determin the GIP TSC mode.
4971	*
4972	* @returns The most suitable TSC mode.
4973	* @param pDevExt Pointer to the device instance data.
4974	*/
4975	static SUPGIPMODE supdrvGipDeterminTscMode(PSUPDRVDEVEXT pDevExt)
4976	{
4977	/*
4978	* On SMP we're faced with two problems:
4979	* (1) There might be a skew between the CPU, so that cpu0
4980	* returns a TSC that is sligtly different from cpu1.
4981	* (2) Power management (and other things) may cause the TSC
4982	* to run at a non-constant speed, and cause the speed
4983	* to be different on the cpus. This will result in (1).
4984	*
4985	* So, on SMP systems we'll have to select the ASYNC update method
4986	* if there are symphoms of these problems.
4987	*/
4988	if (RTMpGetCount() > 1)
4989	{
4990	uint32_t uEAX, uEBX, uECX, uEDX;
4991	uint64_t u64DiffCoresIgnored;
4992
4993	/* Permit the user and/or the OS specfic bits to force async mode. */
4994	if (supdrvOSGetForcedAsyncTscMode(pDevExt))
4995	return SUPGIPMODE_ASYNC_TSC;
4996
4997	/* Try check for current differences between the cpus. */
4998	if (supdrvDetermineAsyncTsc(&u64DiffCoresIgnored))
4999	return SUPGIPMODE_ASYNC_TSC;
5000
5001	/*
5002	* If the CPU supports power management and is an AMD one we
5003	* won't trust it unless it has the TscInvariant bit is set.
5004	*/
5005	/* Check for "AuthenticAMD" */
5006	ASMCpuId(0, &uEAX, &uEBX, &uECX, &uEDX);
5007	if ( uEAX >= 1
5008	&& uEBX == X86_CPUID_VENDOR_AMD_EBX
5009	&& uECX == X86_CPUID_VENDOR_AMD_ECX
5010	&& uEDX == X86_CPUID_VENDOR_AMD_EDX)
5011	{
5012	/* Check for APM support and that TscInvariant is cleared. */
5013	ASMCpuId(0x80000000, &uEAX, &uEBX, &uECX, &uEDX);
5014	if (uEAX >= 0x80000007)
5015	{
5016	ASMCpuId(0x80000007, &uEAX, &uEBX, &uECX, &uEDX);
5017	if ( !(uEDX & RT_BIT(8))/* TscInvariant */
5018	&& (uEDX & 0x3e)) /* STC\|TM\|THERMTRIP\|VID\|FID. Ignore TS. */
5019	return SUPGIPMODE_ASYNC_TSC;
5020	}
5021	}
5022	}
5023	return SUPGIPMODE_SYNC_TSC;
5024	}
5025
5026
5027
5028	/**
5029	* Initializes the GIP data.
5030	*
5031	* @param pDevExt Pointer to the device instance data.
5032	* @param pGip Pointer to the read-write kernel mapping of the GIP.
5033	* @param HCPhys The physical address of the GIP.
5034	* @param u64NanoTS The current nanosecond timestamp.
5035	* @param uUpdateHz The update freqence.
5036	*/
5037	static void supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys, uint64_t u64NanoTS, unsigned uUpdateHz)
5038	{
5039	unsigned i;
5040	#ifdef DEBUG_DARWIN_GIP
5041	OSDBGPRINT(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
5042	#else
5043	LogFlow(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
5044	#endif
5045
5046	/*
5047	* Initialize the structure.
5048	*/
5049	memset(pGip, 0, PAGE_SIZE);
5050	pGip->u32Magic = SUPGLOBALINFOPAGE_MAGIC;
5051	pGip->u32Version = SUPGLOBALINFOPAGE_VERSION;
5052	pGip->u32Mode = supdrvGipDeterminTscMode(pDevExt);
5053	pGip->u32UpdateHz = uUpdateHz;
5054	pGip->u32UpdateIntervalNS = 1000000000 / uUpdateHz;
5055	pGip->u64NanoTSLastUpdateHz = u64NanoTS;
5056
5057	for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
5058	{
5059	pGip->aCPUs[i].u32TransactionId = 2;
5060	pGip->aCPUs[i].u64NanoTS = u64NanoTS;
5061	pGip->aCPUs[i].u64TSC = ASMReadTSC();
5062
5063	/*
5064	* We don't know the following values until we've executed updates.
5065	* So, we'll just pretend it's a 4 GHz CPU and adjust the history it on
5066	* the 2nd timer callout.
5067	*/
5068	pGip->aCPUs[i].u64CpuHz = _4G + 1; /* tstGIP-2 depends on this. */
5069	pGip->aCPUs[i].u32UpdateIntervalTSC
5070	= pGip->aCPUs[i].au32TSCHistory[0]
5071	= pGip->aCPUs[i].au32TSCHistory[1]
5072	= pGip->aCPUs[i].au32TSCHistory[2]
5073	= pGip->aCPUs[i].au32TSCHistory[3]
5074	= pGip->aCPUs[i].au32TSCHistory[4]
5075	= pGip->aCPUs[i].au32TSCHistory[5]
5076	= pGip->aCPUs[i].au32TSCHistory[6]
5077	= pGip->aCPUs[i].au32TSCHistory[7]
5078	= /pGip->aCPUs[i].u64CpuHz/ _4G / uUpdateHz;
5079	}
5080
5081	/*
5082	* Link it to the device extension.
5083	*/
5084	pDevExt->pGip = pGip;
5085	pDevExt->HCPhysGip = HCPhys;
5086	pDevExt->cGipUsers = 0;
5087	}
5088
5089
5090	/**
5091	* Invalidates the GIP data upon termination.
5092	*
5093	* @param pGip Pointer to the read-write kernel mapping of the GIP.
5094	*/
5095	static void supdrvGipTerm(PSUPGLOBALINFOPAGE pGip)
5096	{
5097	unsigned i;
5098	pGip->u32Magic = 0;
5099	for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
5100	{
5101	pGip->aCPUs[i].u64NanoTS = 0;
5102	pGip->aCPUs[i].u64TSC = 0;
5103	pGip->aCPUs[i].iTSCHistoryHead = 0;
5104	}
5105	}
5106
5107
5108	/**
5109	* Worker routine for supdrvGipUpdate and supdrvGipUpdatePerCpu that
5110	* updates all the per cpu data except the transaction id.
5111	*
5112	* @param pGip The GIP.
5113	* @param pGipCpu Pointer to the per cpu data.
5114	* @param u64NanoTS The current time stamp.
5115	* @param u64TSC The current TSC.
5116	* @param iTick The current timer tick.
5117	*/
5118	static void supdrvGipDoUpdateCpu(PSUPGLOBALINFOPAGE pGip, PSUPGIPCPU pGipCpu, uint64_t u64NanoTS, uint64_t u64TSC, uint64_t iTick)
5119	{
5120	uint64_t u64TSCDelta;
5121	uint32_t u32UpdateIntervalTSC;
5122	uint32_t u32UpdateIntervalTSCSlack;
5123	unsigned iTSCHistoryHead;
5124	uint64_t u64CpuHz;
5125	uint32_t u32TransactionId;
5126
5127	/* Delta between this and the previous update. */
5128	ASMAtomicUoWriteU32(&pGipCpu->u32PrevUpdateIntervalNS, (uint32_t)(u64NanoTS - pGipCpu->u64NanoTS));
5129
5130	/*
5131	* Update the NanoTS.
5132	*/
5133	ASMAtomicXchgU64(&pGipCpu->u64NanoTS, u64NanoTS);
5134
5135	/*
5136	* Calc TSC delta.
5137	*/
5138	/** @todo validate the NanoTS delta, don't trust the OS to call us when it should... */
5139	u64TSCDelta = u64TSC - pGipCpu->u64TSC;
5140	ASMAtomicXchgU64(&pGipCpu->u64TSC, u64TSC);
5141
5142	if (u64TSCDelta >> 32)
5143	{
5144	u64TSCDelta = pGipCpu->u32UpdateIntervalTSC;
5145	pGipCpu->cErrors++;
5146	}
5147
5148	/*
5149	* On the 2nd and 3rd callout, reset the history with the current TSC
5150	* interval since the values entered by supdrvGipInit are totally off.
5151	* The interval on the 1st callout completely unreliable, the 2nd is a bit
5152	* better, while the 3rd should be most reliable.
5153	*/
5154	u32TransactionId = pGipCpu->u32TransactionId;
5155	if (RT_UNLIKELY( ( u32TransactionId == 5
5156	\|\| u32TransactionId == 7)
5157	&& ( iTick == 2
5158	\|\| iTick == 3) ))
5159	{
5160	unsigned i;
5161	for (i = 0; i < RT_ELEMENTS(pGipCpu->au32TSCHistory); i++)
5162	ASMAtomicUoWriteU32(&pGipCpu->au32TSCHistory[i], (uint32_t)u64TSCDelta);
5163	}
5164
5165	/*
5166	* TSC History.
5167	*/
5168	Assert(RT_ELEMENTS(pGipCpu->au32TSCHistory) == 8);
5169	iTSCHistoryHead = (pGipCpu->iTSCHistoryHead + 1) & 7;
5170	ASMAtomicXchgU32(&pGipCpu->iTSCHistoryHead, iTSCHistoryHead);
5171	ASMAtomicXchgU32(&pGipCpu->au32TSCHistory[iTSCHistoryHead], (uint32_t)u64TSCDelta);
5172
5173	/*
5174	* UpdateIntervalTSC = average of last 8,2,1 intervals depending on update HZ.
5175	*/
5176	if (pGip->u32UpdateHz >= 1000)
5177	{
5178	uint32_t u32;
5179	u32 = pGipCpu->au32TSCHistory[0];
5180	u32 += pGipCpu->au32TSCHistory[1];
5181	u32 += pGipCpu->au32TSCHistory[2];
5182	u32 += pGipCpu->au32TSCHistory[3];
5183	u32 >>= 2;
5184	u32UpdateIntervalTSC = pGipCpu->au32TSCHistory[4];
5185	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[5];
5186	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[6];
5187	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[7];
5188	u32UpdateIntervalTSC >>= 2;
5189	u32UpdateIntervalTSC += u32;
5190	u32UpdateIntervalTSC >>= 1;
5191
5192	/* Value choosen for a 2GHz Athlon64 running linux 2.6.10/11, . */
5193	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 14;
5194	}
5195	else if (pGip->u32UpdateHz >= 90)
5196	{
5197	u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
5198	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[(iTSCHistoryHead - 1) & 7];
5199	u32UpdateIntervalTSC >>= 1;
5200
5201	/* value choosen on a 2GHz thinkpad running windows */
5202	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 7;
5203	}
5204	else
5205	{
5206	u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
5207
5208	/* This value hasn't be checked yet.. waiting for OS/2 and 33Hz timers.. :-) */
5209	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 6;
5210	}
5211	ASMAtomicXchgU32(&pGipCpu->u32UpdateIntervalTSC, u32UpdateIntervalTSC + u32UpdateIntervalTSCSlack);
5212
5213	/*
5214	* CpuHz.
5215	*/
5216	u64CpuHz = ASMMult2xU32RetU64(u32UpdateIntervalTSC, pGip->u32UpdateHz);
5217	ASMAtomicXchgU64(&pGipCpu->u64CpuHz, u64CpuHz);
5218	}
5219
5220
5221	/**
5222	* Updates the GIP.
5223	*
5224	* @param pGip Pointer to the GIP.
5225	* @param u64NanoTS The current nanosecond timesamp.
5226	* @param u64TSC The current TSC timesamp.
5227	* @param iTick The current timer tick.
5228	*/
5229	static void supdrvGipUpdate(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, uint64_t u64TSC, uint64_t iTick)
5230	{
5231	/*
5232	* Determin the relevant CPU data.
5233	*/
5234	PSUPGIPCPU pGipCpu;
5235	if (pGip->u32Mode != SUPGIPMODE_ASYNC_TSC)
5236	pGipCpu = &pGip->aCPUs[0];
5237	else
5238	{
5239	unsigned iCpu = ASMGetApicId();
5240	if (RT_UNLIKELY(iCpu >= RT_ELEMENTS(pGip->aCPUs)))
5241	return;
5242	pGipCpu = &pGip->aCPUs[iCpu];
5243	}
5244
5245	/*
5246	* Start update transaction.
5247	*/
5248	if (!(ASMAtomicIncU32(&pGipCpu->u32TransactionId) & 1))
5249	{
5250	/* this can happen on win32 if we're taking to long and there are more CPUs around. shouldn't happen though. */
5251	AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGipCpu->u32TransactionId));
5252	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5253	pGipCpu->cErrors++;
5254	return;
5255	}
5256
5257	/*
5258	* Recalc the update frequency every 0x800th time.
5259	*/
5260	if (!(pGipCpu->u32TransactionId & (GIP_UPDATEHZ_RECALC_FREQ * 2 - 2)))
5261	{
5262	if (pGip->u64NanoTSLastUpdateHz)
5263	{
5264	#ifdef RT_ARCH_AMD64 /** @todo fix 64-bit div here to work on x86 linux. */
5265	uint64_t u64Delta = u64NanoTS - pGip->u64NanoTSLastUpdateHz;
5266	uint32_t u32UpdateHz = (uint32_t)((UINT64_C(1000000000) * GIP_UPDATEHZ_RECALC_FREQ) / u64Delta);
5267	if (u32UpdateHz <= 2000 && u32UpdateHz >= 30)
5268	{
5269	ASMAtomicXchgU32(&pGip->u32UpdateHz, u32UpdateHz);
5270	ASMAtomicXchgU32(&pGip->u32UpdateIntervalNS, 1000000000 / u32UpdateHz);
5271	}
5272	#endif
5273	}
5274	ASMAtomicXchgU64(&pGip->u64NanoTSLastUpdateHz, u64NanoTS);
5275	}
5276
5277	/*
5278	* Update the data.
5279	*/
5280	supdrvGipDoUpdateCpu(pGip, pGipCpu, u64NanoTS, u64TSC, iTick);
5281
5282	/*
5283	* Complete transaction.
5284	*/
5285	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5286	}
5287
5288
5289	/**
5290	* Updates the per cpu GIP data for the calling cpu.
5291	*
5292	* @param pGip Pointer to the GIP.
5293	* @param u64NanoTS The current nanosecond timesamp.
5294	* @param u64TSC The current TSC timesamp.
5295	* @param iCpu The CPU index.
5296	* @param iTick The current timer tick.
5297	*/
5298	static void supdrvGipUpdatePerCpu(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, uint64_t u64TSC, unsigned iCpu, uint64_t iTick)
5299	{
5300	PSUPGIPCPU pGipCpu;
5301
5302	if (RT_LIKELY(iCpu < RT_ELEMENTS(pGip->aCPUs)))
5303	{
5304	pGipCpu = &pGip->aCPUs[iCpu];
5305
5306	/*
5307	* Start update transaction.
5308	*/
5309	if (!(ASMAtomicIncU32(&pGipCpu->u32TransactionId) & 1))
5310	{
5311	AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGipCpu->u32TransactionId));
5312	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5313	pGipCpu->cErrors++;
5314	return;
5315	}
5316
5317	/*
5318	* Update the data.
5319	*/
5320	supdrvGipDoUpdateCpu(pGip, pGipCpu, u64NanoTS, u64TSC, iTick);
5321
5322	/*
5323	* Complete transaction.
5324	*/
5325	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5326	}
5327	}
5328

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPDrv.c@ 32651

Download in other formats: