SUPDrv.c@ 40777

Last change on this file since 40777 was 40777, checked in by vboxsync, 13 years ago
SUPDrv: tracing infastructure coding...
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 217.2 KB

Line
1	/* $Id: SUPDrv.c 40777 2012-04-05 15:18:37Z vboxsync $ */
2	/** @file
3	* VBoxDrv - The VirtualBox Support Driver - Common code.
4	*/
5
6	/*
7	* Copyright (C) 2006-2012 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27	/*******************************************************************************
28	* Header Files *
29	*******************************************************************************/
30	#define LOG_GROUP LOG_GROUP_SUP_DRV
31	#define SUPDRV_AGNOSTIC
32	#include "SUPDrvInternal.h"
33	#ifndef PAGE_SHIFT
34	# include <iprt/param.h>
35	#endif
36	#include <iprt/asm.h>
37	#include <iprt/asm-amd64-x86.h>
38	#include <iprt/asm-math.h>
39	#include <iprt/cpuset.h>
40	#include <iprt/handletable.h>
41	#include <iprt/mem.h>
42	#include <iprt/mp.h>
43	#include <iprt/power.h>
44	#include <iprt/process.h>
45	#include <iprt/semaphore.h>
46	#include <iprt/spinlock.h>
47	#include <iprt/thread.h>
48	#include <iprt/uuid.h>
49	#include <iprt/net.h>
50	#include <iprt/crc.h>
51	#include <iprt/string.h>
52	#include <iprt/timer.h>
53	#if defined(RT_OS_DARWIN) \|\| defined(RT_OS_SOLARIS) \|\| defined(RT_OS_FREEBSD)
54	# include <iprt/rand.h>
55	# include <iprt/path.h>
56	#endif
57	#include <iprt/x86.h>
58
59	#include <VBox/param.h>
60	#include <VBox/log.h>
61	#include <VBox/err.h>
62	#include <VBox/vmm/hwacc_svm.h>
63	#include <VBox/vmm/hwacc_vmx.h>
64
65	#if defined(RT_OS_SOLARIS) \|\| defined(RT_OS_DARWIN)
66	# include "dtrace/SUPDrv.h"
67	#else
68	# define VBOXDRV_SESSION_CREATE(pvSession, fUser) do { } while (0)
69	# define VBOXDRV_SESSION_CLOSE(pvSession) do { } while (0)
70	# define VBOXDRV_IOCTL_ENTRY(pvSession, uIOCtl, pvReqHdr) do { } while (0)
71	# define VBOXDRV_IOCTL_RETURN(pvSession, uIOCtl, pvReqHdr, rcRet, rcReq) do { } while (0)
72	#endif
73
74	/*
75	* Logging assignments:
76	* Log - useful stuff, like failures.
77	* LogFlow - program flow, except the really noisy bits.
78	* Log2 - Cleanup.
79	* Log3 - Loader flow noise.
80	* Log4 - Call VMMR0 flow noise.
81	* Log5 - Native yet-to-be-defined noise.
82	* Log6 - Native ioctl flow noise.
83	*
84	* Logging requires BUILD_TYPE=debug and possibly changes to the logger
85	* instantiation in log-vbox.c(pp).
86	*/
87
88
89	/*******************************************************************************
90	* Defined Constants And Macros *
91	*******************************************************************************/
92	/** The frequency by which we recalculate the u32UpdateHz and
93	* u32UpdateIntervalNS GIP members. The value must be a power of 2. */
94	#define GIP_UPDATEHZ_RECALC_FREQ 0x800
95
96	/** @def VBOX_SVN_REV
97	* The makefile should define this if it can. */
98	#ifndef VBOX_SVN_REV
99	# define VBOX_SVN_REV 0
100	#endif
101
102	#if 0 /* Don't start the GIP timers. Useful when debugging the IPRT timer code. */
103	# define DO_NOT_START_GIP
104	#endif
105
106
107	/*******************************************************************************
108	* Internal Functions *
109	*******************************************************************************/
110	static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void pvObj, void pvCtx, void *pvUser);
111	static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void pvObj, void pvCtx, void *pvUser);
112	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession);
113	static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType);
114	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq);
115	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq);
116	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq);
117	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq);
118	static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq);
119	static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0EntryInt, void pvVMMR0EntryFast, void pvVMMR0EntryEx);
120	static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt);
121	static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage);
122	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage);
123	DECLINLINE(int) supdrvLdrLock(PSUPDRVDEVEXT pDevExt);
124	DECLINLINE(int) supdrvLdrUnlock(PSUPDRVDEVEXT pDevExt);
125	static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq);
126	static int supdrvIOCtl_LoggerSettings(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLOGGERSETTINGS pReq);
127	static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt);
128	static void supdrvGipDestroy(PSUPDRVDEVEXT pDevExt);
129	static DECLCALLBACK(void) supdrvGipSyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick);
130	static DECLCALLBACK(void) supdrvGipAsyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick);
131	static DECLCALLBACK(void) supdrvGipMpEvent(RTMPEVENT enmEvent, RTCPUID idCpu, void *pvUser);
132	static void supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys,
133	uint64_t u64NanoTS, unsigned uUpdateHz, unsigned cCpus);
134	static DECLCALLBACK(void) supdrvGipInitOnCpu(RTCPUID idCpu, void pvUser1, void pvUser2);
135	static void supdrvGipTerm(PSUPGLOBALINFOPAGE pGip);
136	static void supdrvGipUpdate(PSUPDRVDEVEXT pDevExt, uint64_t u64NanoTS, uint64_t u64TSC, RTCPUID idCpu, uint64_t iTick);
137	static void supdrvGipUpdatePerCpu(PSUPDRVDEVEXT pDevExt, uint64_t u64NanoTS, uint64_t u64TSC,
138	RTCPUID idCpu, uint8_t idApic, uint64_t iTick);
139	static void supdrvGipInitCpu(PSUPGLOBALINFOPAGE pGip, PSUPGIPCPU pCpu, uint64_t u64NanoTS);
140
141
142	/*******************************************************************************
143	* Global Variables *
144	*******************************************************************************/
145	DECLEXPORT(PSUPGLOBALINFOPAGE) g_pSUPGlobalInfoPage = NULL;
146
147	/**
148	* Array of the R0 SUP API.
149	*/
150	static SUPFUNC g_aFunctions[] =
151	{
152	/* name function */
153	/* Entries with absolute addresses determined at runtime, fixup
154	code makes ugly ASSUMPTIONS about the order here: */
155	{ "SUPR0AbsIs64bit", (void *)0 },
156	{ "SUPR0Abs64bitKernelCS", (void *)0 },
157	{ "SUPR0Abs64bitKernelSS", (void *)0 },
158	{ "SUPR0Abs64bitKernelDS", (void *)0 },
159	{ "SUPR0AbsKernelCS", (void *)0 },
160	{ "SUPR0AbsKernelSS", (void *)0 },
161	{ "SUPR0AbsKernelDS", (void *)0 },
162	{ "SUPR0AbsKernelES", (void *)0 },
163	{ "SUPR0AbsKernelFS", (void *)0 },
164	{ "SUPR0AbsKernelGS", (void *)0 },
165	{ "SUPR0TracerFireProbe", (void *)SUPR0TracerFireProbe },
166	/* Normal function pointers: */
167	{ "SUPR0ComponentRegisterFactory", (void *)SUPR0ComponentRegisterFactory },
168	{ "SUPR0ComponentDeregisterFactory", (void *)SUPR0ComponentDeregisterFactory },
169	{ "SUPR0ComponentQueryFactory", (void *)SUPR0ComponentQueryFactory },
170	{ "SUPR0ObjRegister", (void *)SUPR0ObjRegister },
171	{ "SUPR0ObjAddRef", (void *)SUPR0ObjAddRef },
172	{ "SUPR0ObjAddRefEx", (void *)SUPR0ObjAddRefEx },
173	{ "SUPR0ObjRelease", (void *)SUPR0ObjRelease },
174	{ "SUPR0ObjVerifyAccess", (void *)SUPR0ObjVerifyAccess },
175	{ "SUPR0LockMem", (void *)SUPR0LockMem },
176	{ "SUPR0UnlockMem", (void *)SUPR0UnlockMem },
177	{ "SUPR0ContAlloc", (void *)SUPR0ContAlloc },
178	{ "SUPR0ContFree", (void *)SUPR0ContFree },
179	{ "SUPR0LowAlloc", (void *)SUPR0LowAlloc },
180	{ "SUPR0LowFree", (void *)SUPR0LowFree },
181	{ "SUPR0MemAlloc", (void *)SUPR0MemAlloc },
182	{ "SUPR0MemGetPhys", (void *)SUPR0MemGetPhys },
183	{ "SUPR0MemFree", (void *)SUPR0MemFree },
184	{ "SUPR0PageAllocEx", (void *)SUPR0PageAllocEx },
185	{ "SUPR0PageFree", (void *)SUPR0PageFree },
186	{ "SUPR0Printf", (void )SUPR0Printf }, /* @todo needs wrapping? */
187	{ "SUPSemEventCreate", (void *)SUPSemEventCreate },
188	{ "SUPSemEventClose", (void *)SUPSemEventClose },
189	{ "SUPSemEventSignal", (void *)SUPSemEventSignal },
190	{ "SUPSemEventWait", (void *)SUPSemEventWait },
191	{ "SUPSemEventWaitNoResume", (void *)SUPSemEventWaitNoResume },
192	{ "SUPSemEventWaitNsAbsIntr", (void *)SUPSemEventWaitNsAbsIntr },
193	{ "SUPSemEventWaitNsRelIntr", (void *)SUPSemEventWaitNsRelIntr },
194	{ "SUPSemEventGetResolution", (void *)SUPSemEventGetResolution },
195	{ "SUPSemEventMultiCreate", (void *)SUPSemEventMultiCreate },
196	{ "SUPSemEventMultiClose", (void *)SUPSemEventMultiClose },
197	{ "SUPSemEventMultiSignal", (void *)SUPSemEventMultiSignal },
198	{ "SUPSemEventMultiReset", (void *)SUPSemEventMultiReset },
199	{ "SUPSemEventMultiWait", (void *)SUPSemEventMultiWait },
200	{ "SUPSemEventMultiWaitNoResume", (void *)SUPSemEventMultiWaitNoResume },
201	{ "SUPSemEventMultiWaitNsAbsIntr", (void *)SUPSemEventMultiWaitNsAbsIntr },
202	{ "SUPSemEventMultiWaitNsRelIntr", (void *)SUPSemEventMultiWaitNsRelIntr },
203	{ "SUPSemEventMultiGetResolution", (void *)SUPSemEventMultiGetResolution },
204	{ "SUPR0GetPagingMode", (void *)SUPR0GetPagingMode },
205	{ "SUPR0EnableVTx", (void *)SUPR0EnableVTx },
206	{ "SUPR0TracerRegisterModule", (void *)SUPR0TracerRegisterModule },
207	{ "SUPGetGIP", (void *)SUPGetGIP },
208	{ "g_pSUPGlobalInfoPage", (void *)&g_pSUPGlobalInfoPage },
209	{ "RTMemAllocTag", (void *)RTMemAllocTag },
210	{ "RTMemAllocZTag", (void *)RTMemAllocZTag },
211	{ "RTMemAllocVarTag", (void *)RTMemAllocVarTag },
212	{ "RTMemAllocZVarTag", (void *)RTMemAllocZVarTag },
213	{ "RTMemFree", (void *)RTMemFree },
214	{ "RTMemDupTag", (void *)RTMemDupTag },
215	{ "RTMemDupExTag", (void *)RTMemDupExTag },
216	{ "RTMemReallocTag", (void *)RTMemReallocTag },
217	{ "RTR0MemObjAllocLowTag", (void *)RTR0MemObjAllocLowTag },
218	{ "RTR0MemObjAllocPageTag", (void *)RTR0MemObjAllocPageTag },
219	{ "RTR0MemObjAllocPhysTag", (void *)RTR0MemObjAllocPhysTag },
220	{ "RTR0MemObjAllocPhysExTag", (void *)RTR0MemObjAllocPhysExTag },
221	{ "RTR0MemObjAllocPhysNCTag", (void *)RTR0MemObjAllocPhysNCTag },
222	{ "RTR0MemObjAllocContTag", (void *)RTR0MemObjAllocContTag },
223	{ "RTR0MemObjEnterPhysTag", (void *)RTR0MemObjEnterPhysTag },
224	{ "RTR0MemObjLockUserTag", (void *)RTR0MemObjLockUserTag },
225	{ "RTR0MemObjMapKernelTag", (void *)RTR0MemObjMapKernelTag },
226	{ "RTR0MemObjMapKernelExTag", (void *)RTR0MemObjMapKernelExTag },
227	{ "RTR0MemObjMapUserTag", (void *)RTR0MemObjMapUserTag },
228	{ "RTR0MemObjProtect", (void *)RTR0MemObjProtect },
229	{ "RTR0MemObjAddress", (void *)RTR0MemObjAddress },
230	{ "RTR0MemObjAddressR3", (void *)RTR0MemObjAddressR3 },
231	{ "RTR0MemObjSize", (void *)RTR0MemObjSize },
232	{ "RTR0MemObjIsMapping", (void *)RTR0MemObjIsMapping },
233	{ "RTR0MemObjGetPagePhysAddr", (void *)RTR0MemObjGetPagePhysAddr },
234	{ "RTR0MemObjFree", (void *)RTR0MemObjFree },
235	{ "RTR0MemUserCopyFrom", (void *)RTR0MemUserCopyFrom },
236	{ "RTR0MemUserCopyTo", (void *)RTR0MemUserCopyTo },
237	{ "RTR0MemUserIsValidAddr", (void *)RTR0MemUserIsValidAddr },
238	{ "RTR0MemKernelIsValidAddr", (void *)RTR0MemKernelIsValidAddr },
239	{ "RTR0MemAreKrnlAndUsrDifferent", (void *)RTR0MemAreKrnlAndUsrDifferent },
240	{ "RTSemMutexCreate", (void *)RTSemMutexCreate },
241	{ "RTSemMutexRequest", (void *)RTSemMutexRequest },
242	{ "RTSemMutexRequestDebug", (void *)RTSemMutexRequestDebug },
243	{ "RTSemMutexRequestNoResume", (void *)RTSemMutexRequestNoResume },
244	{ "RTSemMutexRequestNoResumeDebug", (void *)RTSemMutexRequestNoResumeDebug },
245	{ "RTSemMutexRelease", (void *)RTSemMutexRelease },
246	{ "RTSemMutexDestroy", (void *)RTSemMutexDestroy },
247	{ "RTProcSelf", (void *)RTProcSelf },
248	{ "RTR0ProcHandleSelf", (void *)RTR0ProcHandleSelf },
249	{ "RTSemFastMutexCreate", (void *)RTSemFastMutexCreate },
250	{ "RTSemFastMutexDestroy", (void *)RTSemFastMutexDestroy },
251	{ "RTSemFastMutexRequest", (void *)RTSemFastMutexRequest },
252	{ "RTSemFastMutexRelease", (void *)RTSemFastMutexRelease },
253	{ "RTSemEventCreate", (void *)RTSemEventCreate },
254	{ "RTSemEventSignal", (void *)RTSemEventSignal },
255	{ "RTSemEventWait", (void *)RTSemEventWait },
256	{ "RTSemEventWaitNoResume", (void *)RTSemEventWaitNoResume },
257	{ "RTSemEventWaitEx", (void *)RTSemEventWaitEx },
258	{ "RTSemEventWaitExDebug", (void *)RTSemEventWaitExDebug },
259	{ "RTSemEventGetResolution", (void *)RTSemEventGetResolution },
260	{ "RTSemEventDestroy", (void *)RTSemEventDestroy },
261	{ "RTSemEventMultiCreate", (void *)RTSemEventMultiCreate },
262	{ "RTSemEventMultiSignal", (void *)RTSemEventMultiSignal },
263	{ "RTSemEventMultiReset", (void *)RTSemEventMultiReset },
264	{ "RTSemEventMultiWait", (void *)RTSemEventMultiWait },
265	{ "RTSemEventMultiWaitNoResume", (void *)RTSemEventMultiWaitNoResume },
266	{ "RTSemEventMultiWaitEx", (void *)RTSemEventMultiWaitEx },
267	{ "RTSemEventMultiWaitExDebug", (void *)RTSemEventMultiWaitExDebug },
268	{ "RTSemEventMultiGetResolution", (void *)RTSemEventMultiGetResolution },
269	{ "RTSemEventMultiDestroy", (void *)RTSemEventMultiDestroy },
270	{ "RTSpinlockCreate", (void *)RTSpinlockCreate },
271	{ "RTSpinlockDestroy", (void *)RTSpinlockDestroy },
272	{ "RTSpinlockAcquire", (void *)RTSpinlockAcquire },
273	{ "RTSpinlockRelease", (void *)RTSpinlockRelease },
274	{ "RTSpinlockAcquireNoInts", (void *)RTSpinlockAcquireNoInts },
275	{ "RTSpinlockReleaseNoInts", (void *)RTSpinlockReleaseNoInts },
276	{ "RTTimeNanoTS", (void *)RTTimeNanoTS },
277	{ "RTTimeMilliTS", (void *)RTTimeMilliTS },
278	{ "RTTimeSystemNanoTS", (void *)RTTimeSystemNanoTS },
279	{ "RTTimeSystemMilliTS", (void *)RTTimeSystemMilliTS },
280	{ "RTThreadNativeSelf", (void *)RTThreadNativeSelf },
281	{ "RTThreadSleep", (void *)RTThreadSleep },
282	{ "RTThreadYield", (void *)RTThreadYield },
283	{ "RTThreadSelf", (void *)RTThreadSelf },
284	{ "RTThreadCreate", (void *)RTThreadCreate },
285	{ "RTThreadGetNative", (void *)RTThreadGetNative },
286	{ "RTThreadWait", (void *)RTThreadWait },
287	{ "RTThreadWaitNoResume", (void *)RTThreadWaitNoResume },
288	{ "RTThreadGetName", (void *)RTThreadGetName },
289	{ "RTThreadSelfName", (void *)RTThreadSelfName },
290	{ "RTThreadGetType", (void *)RTThreadGetType },
291	{ "RTThreadUserSignal", (void *)RTThreadUserSignal },
292	{ "RTThreadUserReset", (void *)RTThreadUserReset },
293	{ "RTThreadUserWait", (void *)RTThreadUserWait },
294	{ "RTThreadUserWaitNoResume", (void *)RTThreadUserWaitNoResume },
295	{ "RTThreadPreemptIsEnabled", (void *)RTThreadPreemptIsEnabled },
296	{ "RTThreadPreemptIsPending", (void *)RTThreadPreemptIsPending },
297	{ "RTThreadPreemptIsPendingTrusty", (void *)RTThreadPreemptIsPendingTrusty },
298	{ "RTThreadPreemptIsPossible", (void *)RTThreadPreemptIsPossible },
299	{ "RTThreadPreemptDisable", (void *)RTThreadPreemptDisable },
300	{ "RTThreadPreemptRestore", (void *)RTThreadPreemptRestore },
301	{ "RTThreadIsInInterrupt", (void *)RTThreadIsInInterrupt },
302	{ "RTTimerCreate", (void *)RTTimerCreate },
303	{ "RTTimerCreateEx", (void *)RTTimerCreateEx },
304	{ "RTTimerDestroy", (void *)RTTimerDestroy },
305	{ "RTTimerStart", (void *)RTTimerStart },
306	{ "RTTimerStop", (void *)RTTimerStop },
307	{ "RTTimerChangeInterval", (void *)RTTimerChangeInterval },
308	{ "RTTimerGetSystemGranularity", (void *)RTTimerGetSystemGranularity },
309	{ "RTTimerRequestSystemGranularity", (void *)RTTimerRequestSystemGranularity },
310	{ "RTTimerReleaseSystemGranularity", (void *)RTTimerReleaseSystemGranularity },
311	{ "RTTimerCanDoHighResolution", (void *)RTTimerCanDoHighResolution },
312
313	{ "RTLogDefaultInstance", (void *)RTLogDefaultInstance },
314	{ "RTMpCpuId", (void *)RTMpCpuId },
315	{ "RTMpCpuIdFromSetIndex", (void *)RTMpCpuIdFromSetIndex },
316	{ "RTMpCpuIdToSetIndex", (void *)RTMpCpuIdToSetIndex },
317	{ "RTMpGetArraySize", (void *)RTMpGetArraySize },
318	{ "RTMpIsCpuPossible", (void *)RTMpIsCpuPossible },
319	{ "RTMpGetCount", (void *)RTMpGetCount },
320	{ "RTMpGetMaxCpuId", (void *)RTMpGetMaxCpuId },
321	{ "RTMpGetOnlineCount", (void *)RTMpGetOnlineCount },
322	{ "RTMpGetOnlineSet", (void *)RTMpGetOnlineSet },
323	{ "RTMpGetSet", (void *)RTMpGetSet },
324	{ "RTMpIsCpuOnline", (void *)RTMpIsCpuOnline },
325	{ "RTMpIsCpuWorkPending", (void *)RTMpIsCpuWorkPending },
326	{ "RTMpNotificationRegister", (void *)RTMpNotificationRegister },
327	{ "RTMpNotificationDeregister", (void *)RTMpNotificationDeregister },
328	{ "RTMpOnAll", (void *)RTMpOnAll },
329	{ "RTMpOnOthers", (void *)RTMpOnOthers },
330	{ "RTMpOnSpecific", (void *)RTMpOnSpecific },
331	{ "RTMpPokeCpu", (void *)RTMpPokeCpu },
332	{ "RTPowerNotificationRegister", (void *)RTPowerNotificationRegister },
333	{ "RTPowerNotificationDeregister", (void *)RTPowerNotificationDeregister },
334	{ "RTLogRelDefaultInstance", (void *)RTLogRelDefaultInstance },
335	{ "RTLogSetDefaultInstanceThread", (void *)RTLogSetDefaultInstanceThread },
336	{ "RTLogLoggerExV", (void *)RTLogLoggerExV },
337	{ "RTLogPrintfV", (void *)RTLogPrintfV },
338	{ "RTR0AssertPanicSystem", (void *)RTR0AssertPanicSystem },
339	{ "RTAssertMsg1", (void *)RTAssertMsg1 },
340	{ "RTAssertMsg2V", (void *)RTAssertMsg2V },
341	{ "RTAssertMsg2AddV", (void *)RTAssertMsg2AddV },
342	{ "RTAssertSetQuiet", (void *)RTAssertSetQuiet },
343	{ "RTAssertMayPanic", (void *)RTAssertMayPanic },
344	{ "RTAssertSetMayPanic", (void *)RTAssertSetMayPanic },
345	{ "RTAssertAreQuiet", (void *)RTAssertAreQuiet },
346	{ "RTStrFormat", (void *)RTStrFormat },
347	{ "RTStrFormatNumber", (void *)RTStrFormatNumber },
348	{ "RTStrFormatTypeDeregister", (void *)RTStrFormatTypeDeregister },
349	{ "RTStrFormatTypeRegister", (void *)RTStrFormatTypeRegister },
350	{ "RTStrFormatTypeSetUser", (void *)RTStrFormatTypeSetUser },
351	{ "RTStrFormatV", (void *)RTStrFormatV },
352	{ "RTStrPrintf", (void *)RTStrPrintf },
353	{ "RTStrPrintfEx", (void *)RTStrPrintfEx },
354	{ "RTStrPrintfExV", (void *)RTStrPrintfExV },
355	{ "RTStrPrintfV", (void *)RTStrPrintfV },
356	{ "RTHandleTableAllocWithCtx", (void *)RTHandleTableAllocWithCtx },
357	{ "RTHandleTableCreate", (void *)RTHandleTableCreate },
358	{ "RTHandleTableCreateEx", (void *)RTHandleTableCreateEx },
359	{ "RTHandleTableDestroy", (void *)RTHandleTableDestroy },
360	{ "RTHandleTableFreeWithCtx", (void *)RTHandleTableFreeWithCtx },
361	{ "RTHandleTableLookupWithCtx", (void *)RTHandleTableLookupWithCtx },
362	{ "RTNetIPv4AddDataChecksum", (void *)RTNetIPv4AddDataChecksum },
363	{ "RTNetIPv4AddTCPChecksum", (void *)RTNetIPv4AddTCPChecksum },
364	{ "RTNetIPv4AddUDPChecksum", (void *)RTNetIPv4AddUDPChecksum },
365	{ "RTNetIPv4FinalizeChecksum", (void *)RTNetIPv4FinalizeChecksum },
366	{ "RTNetIPv4HdrChecksum", (void *)RTNetIPv4HdrChecksum },
367	{ "RTNetIPv4IsDHCPValid", (void *)RTNetIPv4IsDHCPValid },
368	{ "RTNetIPv4IsHdrValid", (void *)RTNetIPv4IsHdrValid },
369	{ "RTNetIPv4IsTCPSizeValid", (void *)RTNetIPv4IsTCPSizeValid },
370	{ "RTNetIPv4IsTCPValid", (void *)RTNetIPv4IsTCPValid },
371	{ "RTNetIPv4IsUDPSizeValid", (void *)RTNetIPv4IsUDPSizeValid },
372	{ "RTNetIPv4IsUDPValid", (void *)RTNetIPv4IsUDPValid },
373	{ "RTNetIPv4PseudoChecksum", (void *)RTNetIPv4PseudoChecksum },
374	{ "RTNetIPv4PseudoChecksumBits", (void *)RTNetIPv4PseudoChecksumBits },
375	{ "RTNetIPv4TCPChecksum", (void *)RTNetIPv4TCPChecksum },
376	{ "RTNetIPv4UDPChecksum", (void *)RTNetIPv4UDPChecksum },
377	{ "RTNetIPv6PseudoChecksum", (void *)RTNetIPv6PseudoChecksum },
378	{ "RTNetIPv6PseudoChecksumBits", (void *)RTNetIPv6PseudoChecksumBits },
379	{ "RTNetIPv6PseudoChecksumEx", (void *)RTNetIPv6PseudoChecksumEx },
380	{ "RTNetTCPChecksum", (void *)RTNetTCPChecksum },
381	{ "RTNetUDPChecksum", (void *)RTNetUDPChecksum },
382	{ "RTCrc32", (void *)RTCrc32 },
383	{ "RTCrc32Finish", (void *)RTCrc32Finish },
384	{ "RTCrc32Process", (void *)RTCrc32Process },
385	{ "RTCrc32Start", (void *)RTCrc32Start },
386	};
387
388	#if defined(RT_OS_DARWIN) \|\| defined(RT_OS_SOLARIS) \|\| defined(RT_OS_FREEBSD)
389	/**
390	* Drag in the rest of IRPT since we share it with the
391	* rest of the kernel modules on darwin.
392	*/
393	PFNRT g_apfnVBoxDrvIPRTDeps[] =
394	{
395	/* VBoxNetFlt */
396	(PFNRT)RTErrConvertFromErrno,
397	(PFNRT)RTUuidCompare,
398	(PFNRT)RTUuidCompareStr,
399	(PFNRT)RTUuidFromStr,
400	(PFNRT)RTStrDupTag,
401	(PFNRT)RTStrFree,
402	(PFNRT)RTStrCopy,
403	(PFNRT)RTStrNCmp,
404	/* VBoxNetAdp */
405	(PFNRT)RTRandBytes,
406	/* VBoxUSB */
407	(PFNRT)RTPathStripFilename,
408	NULL
409	};
410	#endif /* RT_OS_DARWIN \|\| RT_OS_SOLARIS \|\| RT_OS_SOLARIS */
411
412
413	/**
414	* Initializes the device extentsion structure.
415	*
416	* @returns IPRT status code.
417	* @param pDevExt The device extension to initialize.
418	* @param cbSession The size of the session structure. The size of
419	* SUPDRVSESSION may be smaller when SUPDRV_AGNOSTIC is
420	* defined because we're skipping the OS specific members
421	* then.
422	*/
423	int VBOXCALL supdrvInitDevExt(PSUPDRVDEVEXT pDevExt, size_t cbSession)
424	{
425	int rc;
426
427	#ifdef SUPDRV_WITH_RELEASE_LOGGER
428	/*
429	* Create the release log.
430	*/
431	static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
432	PRTLOGGER pRelLogger;
433	rc = RTLogCreate(&pRelLogger, 0 /* fFlags */, "all",
434	"VBOX_RELEASE_LOG", RT_ELEMENTS(s_apszGroups), s_apszGroups, RTLOGDEST_STDOUT \| RTLOGDEST_DEBUGGER, NULL);
435	if (RT_SUCCESS(rc))
436	RTLogRelSetDefaultInstance(pRelLogger);
437	/** @todo Add native hook for getting logger config parameters and setting
438	* them. On linux we should use the module parameter stuff... */
439	#endif
440
441	/*
442	* Initialize it.
443	*/
444	memset(pDevExt, 0, sizeof(*pDevExt));
445	rc = RTSpinlockCreate(&pDevExt->Spinlock);
446	if (RT_SUCCESS(rc))
447	{
448	rc = RTSpinlockCreate(&pDevExt->spinGip);
449	if (RT_SUCCESS(rc))
450	{
451	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
452	rc = RTSemMutexCreate(&pDevExt->mtxLdr);
453	#else
454	rc = RTSemFastMutexCreate(&pDevExt->mtxLdr);
455	#endif
456	if (RT_SUCCESS(rc))
457	{
458	rc = RTSemFastMutexCreate(&pDevExt->mtxComponentFactory);
459	if (RT_SUCCESS(rc))
460	{
461	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
462	rc = RTSemMutexCreate(&pDevExt->mtxGip);
463	#else
464	rc = RTSemFastMutexCreate(&pDevExt->mtxGip);
465	#endif
466	if (RT_SUCCESS(rc))
467	{
468	rc = supdrvGipCreate(pDevExt);
469	if (RT_SUCCESS(rc))
470	{
471	rc = supdrvTracerInit(pDevExt);
472	if (RT_SUCCESS(rc))
473	{
474	pDevExt->pLdrInitImage = NULL;
475	pDevExt->hLdrInitThread = NIL_RTNATIVETHREAD;
476	pDevExt->u32Cookie = BIRD; /** @todo make this random? */
477	pDevExt->cbSession = (uint32_t)cbSession;
478
479	/*
480	* Fixup the absolute symbols.
481	*
482	* Because of the table indexing assumptions we'll have a little #ifdef orgy
483	* here rather than distributing this to OS specific files. At least for now.
484	*/
485	#ifdef RT_OS_DARWIN
486	# if ARCH_BITS == 32
487	if (SUPR0GetPagingMode() >= SUPPAGINGMODE_AMD64)
488	{
489	g_aFunctions[0].pfn = (void )1; / SUPR0AbsIs64bit */
490	g_aFunctions[1].pfn = (void )0x80; / SUPR0Abs64bitKernelCS - KERNEL64_CS, seg.h */
491	g_aFunctions[2].pfn = (void )0x88; / SUPR0Abs64bitKernelSS - KERNEL64_SS, seg.h */
492	g_aFunctions[3].pfn = (void )0x88; / SUPR0Abs64bitKernelDS - KERNEL64_SS, seg.h */
493	}
494	else
495	g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[4].pfn = (void *)0;
496	g_aFunctions[4].pfn = (void )0x08; / SUPR0AbsKernelCS - KERNEL_CS, seg.h */
497	g_aFunctions[5].pfn = (void )0x10; / SUPR0AbsKernelSS - KERNEL_DS, seg.h */
498	g_aFunctions[6].pfn = (void )0x10; / SUPR0AbsKernelDS - KERNEL_DS, seg.h */
499	g_aFunctions[7].pfn = (void )0x10; / SUPR0AbsKernelES - KERNEL_DS, seg.h */
500	g_aFunctions[8].pfn = (void )0x10; / SUPR0AbsKernelFS - KERNEL_DS, seg.h */
501	g_aFunctions[9].pfn = (void )0x48; / SUPR0AbsKernelGS - CPU_DATA_GS, seg.h */
502	# else /* 64-bit darwin: */
503	g_aFunctions[0].pfn = (void )1; / SUPR0AbsIs64bit */
504	g_aFunctions[1].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0Abs64bitKernelCS */
505	g_aFunctions[2].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0Abs64bitKernelSS */
506	g_aFunctions[3].pfn = (void )0; / SUPR0Abs64bitKernelDS */
507	g_aFunctions[4].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0AbsKernelCS */
508	g_aFunctions[5].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0AbsKernelSS */
509	g_aFunctions[6].pfn = (void )0; / SUPR0AbsKernelDS */
510	g_aFunctions[7].pfn = (void )0; / SUPR0AbsKernelES */
511	g_aFunctions[8].pfn = (void )0; / SUPR0AbsKernelFS */
512	g_aFunctions[9].pfn = (void )0; / SUPR0AbsKernelGS */
513
514	# endif
515	#else /* !RT_OS_DARWIN */
516	# if ARCH_BITS == 64
517	g_aFunctions[0].pfn = (void )1; / SUPR0AbsIs64bit */
518	g_aFunctions[1].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0Abs64bitKernelCS */
519	g_aFunctions[2].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0Abs64bitKernelSS */
520	g_aFunctions[3].pfn = (void )(uintptr_t)ASMGetDS(); / SUPR0Abs64bitKernelDS */
521	# else
522	g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[4].pfn = (void *)0;
523	# endif
524	g_aFunctions[4].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0AbsKernelCS */
525	g_aFunctions[5].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0AbsKernelSS */
526	g_aFunctions[6].pfn = (void )(uintptr_t)ASMGetDS(); / SUPR0AbsKernelDS */
527	g_aFunctions[7].pfn = (void )(uintptr_t)ASMGetES(); / SUPR0AbsKernelES */
528	g_aFunctions[8].pfn = (void )(uintptr_t)ASMGetFS(); / SUPR0AbsKernelFS */
529	g_aFunctions[9].pfn = (void )(uintptr_t)ASMGetGS(); / SUPR0AbsKernelGS */
530	#endif /* !RT_OS_DARWIN */
531	return VINF_SUCCESS;
532	}
533
534	supdrvGipDestroy(pDevExt);
535	}
536
537	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
538	RTSemMutexDestroy(pDevExt->mtxGip);
539	pDevExt->mtxGip = NIL_RTSEMMUTEX;
540	#else
541	RTSemFastMutexDestroy(pDevExt->mtxGip);
542	pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
543	#endif
544	}
545	RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
546	pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
547	}
548	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
549	RTSemMutexDestroy(pDevExt->mtxLdr);
550	pDevExt->mtxLdr = NIL_RTSEMMUTEX;
551	#else
552	RTSemFastMutexDestroy(pDevExt->mtxLdr);
553	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
554	#endif
555	}
556	RTSpinlockDestroy(pDevExt->spinGip);
557	pDevExt->spinGip = NIL_RTSPINLOCK;
558	}
559	RTSpinlockDestroy(pDevExt->Spinlock);
560	pDevExt->Spinlock = NIL_RTSPINLOCK;
561	}
562	#ifdef SUPDRV_WITH_RELEASE_LOGGER
563	RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
564	RTLogDestroy(RTLogSetDefaultInstance(NULL));
565	#endif
566
567	return rc;
568	}
569
570
571	/**
572	* Delete the device extension (e.g. cleanup members).
573	*
574	* @param pDevExt The device extension to delete.
575	*/
576	void VBOXCALL supdrvDeleteDevExt(PSUPDRVDEVEXT pDevExt)
577	{
578	PSUPDRVOBJ pObj;
579	PSUPDRVUSAGE pUsage;
580
581	/*
582	* Kill mutexes and spinlocks.
583	*/
584	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
585	RTSemMutexDestroy(pDevExt->mtxGip);
586	pDevExt->mtxGip = NIL_RTSEMMUTEX;
587	#else
588	RTSemFastMutexDestroy(pDevExt->mtxGip);
589	pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
590	#endif
591	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
592	RTSemMutexDestroy(pDevExt->mtxLdr);
593	pDevExt->mtxLdr = NIL_RTSEMMUTEX;
594	#else
595	RTSemFastMutexDestroy(pDevExt->mtxLdr);
596	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
597	#endif
598	RTSpinlockDestroy(pDevExt->Spinlock);
599	pDevExt->Spinlock = NIL_RTSPINLOCK;
600	RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
601	pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
602
603	/*
604	* Free lists.
605	*/
606	/* objects. */
607	pObj = pDevExt->pObjs;
608	Assert(!pObj); /* (can trigger on forced unloads) */
609	pDevExt->pObjs = NULL;
610	while (pObj)
611	{
612	void *pvFree = pObj;
613	pObj = pObj->pNext;
614	RTMemFree(pvFree);
615	}
616
617	/* usage records. */
618	pUsage = pDevExt->pUsageFree;
619	pDevExt->pUsageFree = NULL;
620	while (pUsage)
621	{
622	void *pvFree = pUsage;
623	pUsage = pUsage->pNext;
624	RTMemFree(pvFree);
625	}
626
627	/* kill the GIP. */
628	supdrvGipDestroy(pDevExt);
629	RTSpinlockDestroy(pDevExt->spinGip);
630	pDevExt->spinGip = NIL_RTSPINLOCK;
631
632	supdrvTracerTerm(pDevExt);
633
634	#ifdef SUPDRV_WITH_RELEASE_LOGGER
635	/* destroy the loggers. */
636	RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
637	RTLogDestroy(RTLogSetDefaultInstance(NULL));
638	#endif
639	}
640
641
642	/**
643	* Create session.
644	*
645	* @returns IPRT status code.
646	* @param pDevExt Device extension.
647	* @param fUser Flag indicating whether this is a user or kernel session.
648	* @param ppSession Where to store the pointer to the session data.
649	*/
650	int VBOXCALL supdrvCreateSession(PSUPDRVDEVEXT pDevExt, bool fUser, PSUPDRVSESSION *ppSession)
651	{
652	/*
653	* Allocate memory for the session data.
654	*/
655	int rc;
656	PSUPDRVSESSION pSession = *ppSession = (PSUPDRVSESSION)RTMemAllocZ(pDevExt->cbSession);
657	if (pSession)
658	{
659	/* Initialize session data. */
660	rc = RTSpinlockCreate(&pSession->Spinlock);
661	if (!rc)
662	{
663	rc = RTHandleTableCreateEx(&pSession->hHandleTable,
664	RTHANDLETABLE_FLAGS_LOCKED \| RTHANDLETABLE_FLAGS_CONTEXT,
665	1 /uBase/, 32768 /cMax/, supdrvSessionObjHandleRetain, pSession);
666	if (RT_SUCCESS(rc))
667	{
668	Assert(pSession->Spinlock != NIL_RTSPINLOCK);
669	pSession->pDevExt = pDevExt;
670	pSession->u32Cookie = BIRD_INV;
671	/*pSession->pLdrUsage = NULL;
672	pSession->pVM = NULL;
673	pSession->pUsage = NULL;
674	pSession->pGip = NULL;
675	pSession->fGipReferenced = false;
676	pSession->Bundle.cUsed = 0; */
677	pSession->Uid = NIL_RTUID;
678	pSession->Gid = NIL_RTGID;
679	if (fUser)
680	{
681	pSession->Process = RTProcSelf();
682	pSession->R0Process = RTR0ProcHandleSelf();
683	}
684	else
685	{
686	pSession->Process = NIL_RTPROCESS;
687	pSession->R0Process = NIL_RTR0PROCESS;
688	}
689
690	VBOXDRV_SESSION_CREATE(pSession, fUser);
691	LogFlow(("Created session %p initial cookie=%#x\n", pSession, pSession->u32Cookie));
692	return VINF_SUCCESS;
693	}
694
695	RTSpinlockDestroy(pSession->Spinlock);
696	}
697	RTMemFree(pSession);
698	*ppSession = NULL;
699	Log(("Failed to create spinlock, rc=%d!\n", rc));
700	}
701	else
702	rc = VERR_NO_MEMORY;
703
704	return rc;
705	}
706
707
708	/**
709	* Shared code for cleaning up a session.
710	*
711	* @param pDevExt Device extension.
712	* @param pSession Session data.
713	* This data will be freed by this routine.
714	*/
715	void VBOXCALL supdrvCloseSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
716	{
717	VBOXDRV_SESSION_CLOSE(pSession);
718
719	/*
720	* Cleanup the session first.
721	*/
722	supdrvCleanupSession(pDevExt, pSession);
723
724	/*
725	* Free the rest of the session stuff.
726	*/
727	RTSpinlockDestroy(pSession->Spinlock);
728	pSession->Spinlock = NIL_RTSPINLOCK;
729	pSession->pDevExt = NULL;
730	RTMemFree(pSession);
731	LogFlow(("supdrvCloseSession: returns\n"));
732	}
733
734
735	/**
736	* Shared code for cleaning up a session (but not quite freeing it).
737	*
738	* This is primarily intended for MAC OS X where we have to clean up the memory
739	* stuff before the file handle is closed.
740	*
741	* @param pDevExt Device extension.
742	* @param pSession Session data.
743	* This data will be freed by this routine.
744	*/
745	void VBOXCALL supdrvCleanupSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
746	{
747	int rc;
748	PSUPDRVBUNDLE pBundle;
749	LogFlow(("supdrvCleanupSession: pSession=%p\n", pSession));
750
751	/*
752	* Remove logger instances related to this session.
753	*/
754	RTLogSetDefaultInstanceThread(NULL, (uintptr_t)pSession);
755
756	/*
757	* Destroy the handle table.
758	*/
759	rc = RTHandleTableDestroy(pSession->hHandleTable, supdrvSessionObjHandleDelete, pSession);
760	AssertRC(rc);
761	pSession->hHandleTable = NIL_RTHANDLETABLE;
762
763	/*
764	* Release object references made in this session.
765	* In theory there should be noone racing us in this session.
766	*/
767	Log2(("release objects - start\n"));
768	if (pSession->pUsage)
769	{
770	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
771	PSUPDRVUSAGE pUsage;
772	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
773
774	while ((pUsage = pSession->pUsage) != NULL)
775	{
776	PSUPDRVOBJ pObj = pUsage->pObj;
777	pSession->pUsage = pUsage->pNext;
778
779	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
780	if (pUsage->cUsage < pObj->cUsage)
781	{
782	pObj->cUsage -= pUsage->cUsage;
783	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
784	}
785	else
786	{
787	/* Destroy the object and free the record. */
788	if (pDevExt->pObjs == pObj)
789	pDevExt->pObjs = pObj->pNext;
790	else
791	{
792	PSUPDRVOBJ pObjPrev;
793	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
794	if (pObjPrev->pNext == pObj)
795	{
796	pObjPrev->pNext = pObj->pNext;
797	break;
798	}
799	Assert(pObjPrev);
800	}
801	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
802
803	Log(("supdrvCleanupSession: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
804	pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
805	if (pObj->pfnDestructor)
806	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
807	RTMemFree(pObj);
808	}
809
810	/* free it and continue. */
811	RTMemFree(pUsage);
812
813	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
814	}
815
816	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
817	AssertMsg(!pSession->pUsage, ("Some buster reregistered an object during desturction!\n"));
818	}
819	Log2(("release objects - done\n"));
820
821	/*
822	* Do tracer cleanups related to this session.
823	*/
824	Log2(("release tracer stuff - start\n"));
825	supdrvTracerCleanupSession(pDevExt, pSession);
826	Log2(("release tracer stuff - end\n"));
827
828	/*
829	* Release memory allocated in the session.
830	*
831	* We do not serialize this as we assume that the application will
832	* not allocated memory while closing the file handle object.
833	*/
834	Log2(("freeing memory:\n"));
835	pBundle = &pSession->Bundle;
836	while (pBundle)
837	{
838	PSUPDRVBUNDLE pToFree;
839	unsigned i;
840
841	/*
842	* Check and unlock all entries in the bundle.
843	*/
844	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
845	{
846	if (pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ)
847	{
848	Log2(("eType=%d pvR0=%p pvR3=%p cb=%ld\n", pBundle->aMem[i].eType, RTR0MemObjAddress(pBundle->aMem[i].MemObj),
849	(void *)RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3), (long)RTR0MemObjSize(pBundle->aMem[i].MemObj)));
850	if (pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ)
851	{
852	rc = RTR0MemObjFree(pBundle->aMem[i].MapObjR3, false);
853	AssertRC(rc); /** @todo figure out how to handle this. */
854	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
855	}
856	rc = RTR0MemObjFree(pBundle->aMem[i].MemObj, true /* fFreeMappings */);
857	AssertRC(rc); /** @todo figure out how to handle this. */
858	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
859	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
860	}
861	}
862
863	/*
864	* Advance and free previous bundle.
865	*/
866	pToFree = pBundle;
867	pBundle = pBundle->pNext;
868
869	pToFree->pNext = NULL;
870	pToFree->cUsed = 0;
871	if (pToFree != &pSession->Bundle)
872	RTMemFree(pToFree);
873	}
874	Log2(("freeing memory - done\n"));
875
876	/*
877	* Deregister component factories.
878	*/
879	RTSemFastMutexRequest(pDevExt->mtxComponentFactory);
880	Log2(("deregistering component factories:\n"));
881	if (pDevExt->pComponentFactoryHead)
882	{
883	PSUPDRVFACTORYREG pPrev = NULL;
884	PSUPDRVFACTORYREG pCur = pDevExt->pComponentFactoryHead;
885	while (pCur)
886	{
887	if (pCur->pSession == pSession)
888	{
889	/* unlink it */
890	PSUPDRVFACTORYREG pNext = pCur->pNext;
891	if (pPrev)
892	pPrev->pNext = pNext;
893	else
894	pDevExt->pComponentFactoryHead = pNext;
895
896	/* free it */
897	pCur->pNext = NULL;
898	pCur->pSession = NULL;
899	pCur->pFactory = NULL;
900	RTMemFree(pCur);
901
902	/* next */
903	pCur = pNext;
904	}
905	else
906	{
907	/* next */
908	pPrev = pCur;
909	pCur = pCur->pNext;
910	}
911	}
912	}
913	RTSemFastMutexRelease(pDevExt->mtxComponentFactory);
914	Log2(("deregistering component factories - done\n"));
915
916	/*
917	* Loaded images needs to be dereferenced and possibly freed up.
918	*/
919	supdrvLdrLock(pDevExt);
920	Log2(("freeing images:\n"));
921	if (pSession->pLdrUsage)
922	{
923	PSUPDRVLDRUSAGE pUsage = pSession->pLdrUsage;
924	pSession->pLdrUsage = NULL;
925	while (pUsage)
926	{
927	void *pvFree = pUsage;
928	PSUPDRVLDRIMAGE pImage = pUsage->pImage;
929	if (pImage->cUsage > pUsage->cUsage)
930	pImage->cUsage -= pUsage->cUsage;
931	else
932	supdrvLdrFree(pDevExt, pImage);
933	pUsage->pImage = NULL;
934	pUsage = pUsage->pNext;
935	RTMemFree(pvFree);
936	}
937	}
938	supdrvLdrUnlock(pDevExt);
939	Log2(("freeing images - done\n"));
940
941	/*
942	* Unmap the GIP.
943	*/
944	Log2(("umapping GIP:\n"));
945	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
946	{
947	SUPR0GipUnmap(pSession);
948	pSession->fGipReferenced = 0;
949	}
950	Log2(("umapping GIP - done\n"));
951	}
952
953
954	/**
955	* RTHandleTableDestroy callback used by supdrvCleanupSession.
956	*
957	* @returns IPRT status code, see SUPR0ObjAddRef.
958	* @param hHandleTable The handle table handle. Ignored.
959	* @param pvObj The object pointer.
960	* @param pvCtx Context, the handle type. Ignored.
961	* @param pvUser Session pointer.
962	*/
963	static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void pvObj, void pvCtx, void *pvUser)
964	{
965	NOREF(pvCtx);
966	NOREF(hHandleTable);
967	return SUPR0ObjAddRefEx(pvObj, (PSUPDRVSESSION)pvUser, true /fNoBlocking/);
968	}
969
970
971	/**
972	* RTHandleTableDestroy callback used by supdrvCleanupSession.
973	*
974	* @param hHandleTable The handle table handle. Ignored.
975	* @param h The handle value. Ignored.
976	* @param pvObj The object pointer.
977	* @param pvCtx Context, the handle type. Ignored.
978	* @param pvUser Session pointer.
979	*/
980	static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void pvObj, void pvCtx, void *pvUser)
981	{
982	NOREF(pvCtx);
983	NOREF(h);
984	NOREF(hHandleTable);
985	SUPR0ObjRelease(pvObj, (PSUPDRVSESSION)pvUser);
986	}
987
988
989	/**
990	* Fast path I/O Control worker.
991	*
992	* @returns VBox status code that should be passed down to ring-3 unchanged.
993	* @param uIOCtl Function number.
994	* @param idCpu VMCPU id.
995	* @param pDevExt Device extention.
996	* @param pSession Session data.
997	*/
998	int VBOXCALL supdrvIOCtlFast(uintptr_t uIOCtl, VMCPUID idCpu, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
999	{
1000	/*
1001	* We check the two prereqs after doing this only to allow the compiler to optimize things better.
1002	*/
1003	if (RT_LIKELY( RT_VALID_PTR(pSession)
1004	&& pSession->pVM
1005	&& pDevExt->pfnVMMR0EntryFast))
1006	{
1007	switch (uIOCtl)
1008	{
1009	case SUP_IOCTL_FAST_DO_RAW_RUN:
1010	pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_RAW_RUN);
1011	break;
1012	case SUP_IOCTL_FAST_DO_HWACC_RUN:
1013	pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_HWACC_RUN);
1014	break;
1015	case SUP_IOCTL_FAST_DO_NOP:
1016	pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_NOP);
1017	break;
1018	default:
1019	return VERR_INTERNAL_ERROR;
1020	}
1021	return VINF_SUCCESS;
1022	}
1023	return VERR_INTERNAL_ERROR;
1024	}
1025
1026
1027	/**
1028	* Helper for supdrvIOCtl. Check if pszStr contains any character of pszChars.
1029	* We would use strpbrk here if this function would be contained in the RedHat kABI white
1030	* list, see http://www.kerneldrivers.org/RHEL5.
1031	*
1032	* @returns 1 if pszStr does contain any character of pszChars, 0 otherwise.
1033	* @param pszStr String to check
1034	* @param pszChars Character set
1035	*/
1036	static int supdrvCheckInvalidChar(const char pszStr, const char pszChars)
1037	{
1038	int chCur;
1039	while ((chCur = *pszStr++) != '\0')
1040	{
1041	int ch;
1042	const char *psz = pszChars;
1043	while ((ch = *psz++) != '\0')
1044	if (ch == chCur)
1045	return 1;
1046
1047	}
1048	return 0;
1049	}
1050
1051
1052	/**
1053	* I/O Control worker.
1054	*
1055	* @returns IPRT status code.
1056	* @retval VERR_INVALID_PARAMETER if the request is invalid.
1057	*
1058	* @param uIOCtl Function number.
1059	* @param pDevExt Device extention.
1060	* @param pSession Session data.
1061	* @param pReqHdr The request header.
1062	*/
1063	int VBOXCALL supdrvIOCtl(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPREQHDR pReqHdr)
1064	{
1065	VBOXDRV_IOCTL_ENTRY(pSession, uIOCtl, pReqHdr);
1066
1067	/*
1068	* Validate the request.
1069	*/
1070	/* this first check could probably be omitted as its also done by the OS specific code... */
1071	if (RT_UNLIKELY( (pReqHdr->fFlags & SUPREQHDR_FLAGS_MAGIC_MASK) != SUPREQHDR_FLAGS_MAGIC
1072	\|\| pReqHdr->cbIn < sizeof(*pReqHdr)
1073	\|\| pReqHdr->cbOut < sizeof(*pReqHdr)))
1074	{
1075	OSDBGPRINT(("vboxdrv: Bad ioctl request header; cbIn=%#lx cbOut=%#lx fFlags=%#lx\n",
1076	(long)pReqHdr->cbIn, (long)pReqHdr->cbOut, (long)pReqHdr->fFlags));
1077	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
1078	return VERR_INVALID_PARAMETER;
1079	}
1080	if (RT_UNLIKELY(!RT_VALID_PTR(pSession)))
1081	{
1082	OSDBGPRINT(("vboxdrv: Invalid pSession valud %p (ioctl=%p)\n", pSession, (void *)uIOCtl));
1083	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
1084	return VERR_INVALID_PARAMETER;
1085	}
1086	if (RT_UNLIKELY(uIOCtl == SUP_IOCTL_COOKIE))
1087	{
1088	if (pReqHdr->u32Cookie != SUPCOOKIE_INITIAL_COOKIE)
1089	{
1090	OSDBGPRINT(("SUP_IOCTL_COOKIE: bad cookie %#lx\n", (long)pReqHdr->u32Cookie));
1091	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
1092	return VERR_INVALID_PARAMETER;
1093	}
1094	}
1095	else if (RT_UNLIKELY( pReqHdr->u32Cookie != pDevExt->u32Cookie
1096	\|\| pReqHdr->u32SessionCookie != pSession->u32Cookie))
1097	{
1098	OSDBGPRINT(("vboxdrv: bad cookie %#lx / %#lx.\n", (long)pReqHdr->u32Cookie, (long)pReqHdr->u32SessionCookie));
1099	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
1100	return VERR_INVALID_PARAMETER;
1101	}
1102
1103	/*
1104	* Validation macros
1105	*/
1106	#define REQ_CHECK_SIZES_EX(Name, cbInExpect, cbOutExpect) \
1107	do { \
1108	if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect) \|\| pReqHdr->cbOut != (cbOutExpect))) \
1109	{ \
1110	OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld. cbOut=%ld expected %ld.\n", \
1111	(long)pReq->Hdr.cbIn, (long)(cbInExpect), (long)pReq->Hdr.cbOut, (long)(cbOutExpect))); \
1112	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VERR_INVALID_PARAMETER); \
1113	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1114	} \
1115	} while (0)
1116
1117	#define REQ_CHECK_SIZES(Name) REQ_CHECK_SIZES_EX(Name, Name ## _SIZE_IN, Name ## _SIZE_OUT)
1118
1119	#define REQ_CHECK_SIZE_IN(Name, cbInExpect) \
1120	do { \
1121	if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect))) \
1122	{ \
1123	OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld.\n", \
1124	(long)pReq->Hdr.cbIn, (long)(cbInExpect))); \
1125	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VERR_INVALID_PARAMETER); \
1126	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1127	} \
1128	} while (0)
1129
1130	#define REQ_CHECK_SIZE_OUT(Name, cbOutExpect) \
1131	do { \
1132	if (RT_UNLIKELY(pReqHdr->cbOut != (cbOutExpect))) \
1133	{ \
1134	OSDBGPRINT(( #Name ": Invalid input/output sizes. cbOut=%ld expected %ld.\n", \
1135	(long)pReq->Hdr.cbOut, (long)(cbOutExpect))); \
1136	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VERR_INVALID_PARAMETER); \
1137	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1138	} \
1139	} while (0)
1140
1141	#define REQ_CHECK_EXPR(Name, expr) \
1142	do { \
1143	if (RT_UNLIKELY(!(expr))) \
1144	{ \
1145	OSDBGPRINT(( #Name ": %s\n", #expr)); \
1146	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VERR_INVALID_PARAMETER); \
1147	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1148	} \
1149	} while (0)
1150
1151	#define REQ_CHECK_EXPR_FMT(expr, fmt) \
1152	do { \
1153	if (RT_UNLIKELY(!(expr))) \
1154	{ \
1155	OSDBGPRINT( fmt ); \
1156	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VERR_INVALID_PARAMETER); \
1157	return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1158	} \
1159	} while (0)
1160
1161	/*
1162	* The switch.
1163	*/
1164	switch (SUP_CTL_CODE_NO_SIZE(uIOCtl))
1165	{
1166	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_COOKIE):
1167	{
1168	PSUPCOOKIE pReq = (PSUPCOOKIE)pReqHdr;
1169	REQ_CHECK_SIZES(SUP_IOCTL_COOKIE);
1170	if (strncmp(pReq->u.In.szMagic, SUPCOOKIE_MAGIC, sizeof(pReq->u.In.szMagic)))
1171	{
1172	OSDBGPRINT(("SUP_IOCTL_COOKIE: invalid magic %.16s\n", pReq->u.In.szMagic));
1173	pReq->Hdr.rc = VERR_INVALID_MAGIC;
1174	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, VERR_INVALID_MAGIC);
1175	return 0;
1176	}
1177
1178	#if 0
1179	/*
1180	* Call out to the OS specific code and let it do permission checks on the
1181	* client process.
1182	*/
1183	if (!supdrvOSValidateClientProcess(pDevExt, pSession))
1184	{
1185	pReq->u.Out.u32Cookie = 0xffffffff;
1186	pReq->u.Out.u32SessionCookie = 0xffffffff;
1187	pReq->u.Out.u32SessionVersion = 0xffffffff;
1188	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1189	pReq->u.Out.pSession = NULL;
1190	pReq->u.Out.cFunctions = 0;
1191	pReq->Hdr.rc = VERR_PERMISSION_DENIED;
1192	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, VERR_PERMISSION_DENIED);
1193	return 0;
1194	}
1195	#endif
1196
1197	/*
1198	* Match the version.
1199	* The current logic is very simple, match the major interface version.
1200	*/
1201	if ( pReq->u.In.u32MinVersion > SUPDRV_IOC_VERSION
1202	\|\| (pReq->u.In.u32MinVersion & 0xffff0000) != (SUPDRV_IOC_VERSION & 0xffff0000))
1203	{
1204	OSDBGPRINT(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
1205	pReq->u.In.u32ReqVersion, pReq->u.In.u32MinVersion, SUPDRV_IOC_VERSION));
1206	pReq->u.Out.u32Cookie = 0xffffffff;
1207	pReq->u.Out.u32SessionCookie = 0xffffffff;
1208	pReq->u.Out.u32SessionVersion = 0xffffffff;
1209	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1210	pReq->u.Out.pSession = NULL;
1211	pReq->u.Out.cFunctions = 0;
1212	pReq->Hdr.rc = VERR_VERSION_MISMATCH;
1213	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1214	return 0;
1215	}
1216
1217	/*
1218	* Fill in return data and be gone.
1219	* N.B. The first one to change SUPDRV_IOC_VERSION shall makes sure that
1220	* u32SessionVersion <= u32ReqVersion!
1221	*/
1222	/** @todo Somehow validate the client and negotiate a secure cookie... */
1223	pReq->u.Out.u32Cookie = pDevExt->u32Cookie;
1224	pReq->u.Out.u32SessionCookie = pSession->u32Cookie;
1225	pReq->u.Out.u32SessionVersion = SUPDRV_IOC_VERSION;
1226	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1227	pReq->u.Out.pSession = pSession;
1228	pReq->u.Out.cFunctions = sizeof(g_aFunctions) / sizeof(g_aFunctions[0]);
1229	pReq->Hdr.rc = VINF_SUCCESS;
1230	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1231	return 0;
1232	}
1233
1234	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_QUERY_FUNCS(0)):
1235	{
1236	/* validate */
1237	PSUPQUERYFUNCS pReq = (PSUPQUERYFUNCS)pReqHdr;
1238	REQ_CHECK_SIZES_EX(SUP_IOCTL_QUERY_FUNCS, SUP_IOCTL_QUERY_FUNCS_SIZE_IN, SUP_IOCTL_QUERY_FUNCS_SIZE_OUT(RT_ELEMENTS(g_aFunctions)));
1239
1240	/* execute */
1241	pReq->u.Out.cFunctions = RT_ELEMENTS(g_aFunctions);
1242	memcpy(&pReq->u.Out.aFunctions[0], g_aFunctions, sizeof(g_aFunctions));
1243	pReq->Hdr.rc = VINF_SUCCESS;
1244	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1245	return 0;
1246	}
1247
1248	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_LOCK):
1249	{
1250	/* validate */
1251	PSUPPAGELOCK pReq = (PSUPPAGELOCK)pReqHdr;
1252	REQ_CHECK_SIZE_IN(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_IN);
1253	REQ_CHECK_SIZE_OUT(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_OUT(pReq->u.In.cPages));
1254	REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.cPages > 0);
1255	REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.pvR3 >= PAGE_SIZE);
1256
1257	/* execute */
1258	pReq->Hdr.rc = SUPR0LockMem(pSession, pReq->u.In.pvR3, pReq->u.In.cPages, &pReq->u.Out.aPages[0]);
1259	if (RT_FAILURE(pReq->Hdr.rc))
1260	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1261	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1262	return 0;
1263	}
1264
1265	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_UNLOCK):
1266	{
1267	/* validate */
1268	PSUPPAGEUNLOCK pReq = (PSUPPAGEUNLOCK)pReqHdr;
1269	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_UNLOCK);
1270
1271	/* execute */
1272	pReq->Hdr.rc = SUPR0UnlockMem(pSession, pReq->u.In.pvR3);
1273	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1274	return 0;
1275	}
1276
1277	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_ALLOC):
1278	{
1279	/* validate */
1280	PSUPCONTALLOC pReq = (PSUPCONTALLOC)pReqHdr;
1281	REQ_CHECK_SIZES(SUP_IOCTL_CONT_ALLOC);
1282
1283	/* execute */
1284	pReq->Hdr.rc = SUPR0ContAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.HCPhys);
1285	if (RT_FAILURE(pReq->Hdr.rc))
1286	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1287	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1288	return 0;
1289	}
1290
1291	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_FREE):
1292	{
1293	/* validate */
1294	PSUPCONTFREE pReq = (PSUPCONTFREE)pReqHdr;
1295	REQ_CHECK_SIZES(SUP_IOCTL_CONT_FREE);
1296
1297	/* execute */
1298	pReq->Hdr.rc = SUPR0ContFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1299	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1300	return 0;
1301	}
1302
1303	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_OPEN):
1304	{
1305	/* validate */
1306	PSUPLDROPEN pReq = (PSUPLDROPEN)pReqHdr;
1307	REQ_CHECK_SIZES(SUP_IOCTL_LDR_OPEN);
1308	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageWithTabs > 0);
1309	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageWithTabs < 16*_1M);
1310	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits > 0);
1311	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits > 0);
1312	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits < pReq->u.In.cbImageWithTabs);
1313	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.szName[0]);
1314	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, RTStrEnd(pReq->u.In.szName, sizeof(pReq->u.In.szName)));
1315	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, !supdrvCheckInvalidChar(pReq->u.In.szName, ";:()[]{}/\\\|&*%#@!~`\"'"));
1316	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, RTStrEnd(pReq->u.In.szFilename, sizeof(pReq->u.In.szFilename)));
1317
1318	/* execute */
1319	pReq->Hdr.rc = supdrvIOCtl_LdrOpen(pDevExt, pSession, pReq);
1320	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1321	return 0;
1322	}
1323
1324	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_LOAD):
1325	{
1326	/* validate */
1327	PSUPLDRLOAD pReq = (PSUPLDRLOAD)pReqHdr;
1328	REQ_CHECK_EXPR(Name, pReq->Hdr.cbIn >= sizeof(*pReq));
1329	REQ_CHECK_SIZES_EX(SUP_IOCTL_LDR_LOAD, SUP_IOCTL_LDR_LOAD_SIZE_IN(pReq->u.In.cbImageWithTabs), SUP_IOCTL_LDR_LOAD_SIZE_OUT);
1330	REQ_CHECK_EXPR(SUP_IOCTL_LDR_LOAD, pReq->u.In.cSymbols <= 16384);
1331	REQ_CHECK_EXPR_FMT( !pReq->u.In.cSymbols
1332	\|\| ( pReq->u.In.offSymbols < pReq->u.In.cbImageWithTabs
1333	&& pReq->u.In.offSymbols + pReq->u.In.cSymbols * sizeof(SUPLDRSYM) <= pReq->u.In.cbImageWithTabs),
1334	("SUP_IOCTL_LDR_LOAD: offSymbols=%#lx cSymbols=%#lx cbImageWithTabs=%#lx\n", (long)pReq->u.In.offSymbols,
1335	(long)pReq->u.In.cSymbols, (long)pReq->u.In.cbImageWithTabs));
1336	REQ_CHECK_EXPR_FMT( !pReq->u.In.cbStrTab
1337	\|\| ( pReq->u.In.offStrTab < pReq->u.In.cbImageWithTabs
1338	&& pReq->u.In.offStrTab + pReq->u.In.cbStrTab <= pReq->u.In.cbImageWithTabs
1339	&& pReq->u.In.cbStrTab <= pReq->u.In.cbImageWithTabs),
1340	("SUP_IOCTL_LDR_LOAD: offStrTab=%#lx cbStrTab=%#lx cbImageWithTabs=%#lx\n", (long)pReq->u.In.offStrTab,
1341	(long)pReq->u.In.cbStrTab, (long)pReq->u.In.cbImageWithTabs));
1342
1343	if (pReq->u.In.cSymbols)
1344	{
1345	uint32_t i;
1346	PSUPLDRSYM paSyms = (PSUPLDRSYM)&pReq->u.In.abImage[pReq->u.In.offSymbols];
1347	for (i = 0; i < pReq->u.In.cSymbols; i++)
1348	{
1349	REQ_CHECK_EXPR_FMT(paSyms[i].offSymbol < pReq->u.In.cbImageWithTabs,
1350	("SUP_IOCTL_LDR_LOAD: sym #%ld: symb off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offSymbol, (long)pReq->u.In.cbImageWithTabs));
1351	REQ_CHECK_EXPR_FMT(paSyms[i].offName < pReq->u.In.cbStrTab,
1352	("SUP_IOCTL_LDR_LOAD: sym #%ld: name off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithTabs));
1353	REQ_CHECK_EXPR_FMT(RTStrEnd((char const *)&pReq->u.In.abImage[pReq->u.In.offStrTab + paSyms[i].offName],
1354	pReq->u.In.cbStrTab - paSyms[i].offName),
1355	("SUP_IOCTL_LDR_LOAD: sym #%ld: unterminated name! (%#lx / %#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithTabs));
1356	}
1357	}
1358
1359	/* execute */
1360	pReq->Hdr.rc = supdrvIOCtl_LdrLoad(pDevExt, pSession, pReq);
1361	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1362	return 0;
1363	}
1364
1365	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_FREE):
1366	{
1367	/* validate */
1368	PSUPLDRFREE pReq = (PSUPLDRFREE)pReqHdr;
1369	REQ_CHECK_SIZES(SUP_IOCTL_LDR_FREE);
1370
1371	/* execute */
1372	pReq->Hdr.rc = supdrvIOCtl_LdrFree(pDevExt, pSession, pReq);
1373	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1374	return 0;
1375	}
1376
1377	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_GET_SYMBOL):
1378	{
1379	/* validate */
1380	PSUPLDRGETSYMBOL pReq = (PSUPLDRGETSYMBOL)pReqHdr;
1381	REQ_CHECK_SIZES(SUP_IOCTL_LDR_GET_SYMBOL);
1382	REQ_CHECK_EXPR(SUP_IOCTL_LDR_GET_SYMBOL, RTStrEnd(pReq->u.In.szSymbol, sizeof(pReq->u.In.szSymbol)));
1383
1384	/* execute */
1385	pReq->Hdr.rc = supdrvIOCtl_LdrGetSymbol(pDevExt, pSession, pReq);
1386	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1387	return 0;
1388	}
1389
1390	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_VMMR0(0)):
1391	{
1392	/* validate */
1393	PSUPCALLVMMR0 pReq = (PSUPCALLVMMR0)pReqHdr;
1394	Log4(("SUP_IOCTL_CALL_VMMR0: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1395	pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1396
1397	if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_VMMR0_SIZE(0))
1398	{
1399	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(0), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(0));
1400
1401	/* execute */
1402	if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1403	pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, NULL, pReq->u.In.u64Arg, pSession);
1404	else
1405	pReq->Hdr.rc = VERR_WRONG_ORDER;
1406	}
1407	else
1408	{
1409	PSUPVMMR0REQHDR pVMMReq = (PSUPVMMR0REQHDR)&pReq->abReqPkt[0];
1410	REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR)),
1411	("SUP_IOCTL_CALL_VMMR0: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR))));
1412	REQ_CHECK_EXPR(SUP_IOCTL_CALL_VMMR0, pVMMReq->u32Magic == SUPVMMR0REQHDR_MAGIC);
1413	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(pVMMReq->cbReq), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(pVMMReq->cbReq));
1414
1415	/* execute */
1416	if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1417	pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1418	else
1419	pReq->Hdr.rc = VERR_WRONG_ORDER;
1420	}
1421
1422	if ( RT_FAILURE(pReq->Hdr.rc)
1423	&& pReq->Hdr.rc != VERR_INTERRUPTED
1424	&& pReq->Hdr.rc != VERR_TIMEOUT)
1425	Log(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1426	pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1427	else
1428	Log4(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1429	pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1430	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1431	return 0;
1432	}
1433
1434	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_VMMR0_BIG):
1435	{
1436	/* validate */
1437	PSUPCALLVMMR0 pReq = (PSUPCALLVMMR0)pReqHdr;
1438	PSUPVMMR0REQHDR pVMMReq;
1439	Log4(("SUP_IOCTL_CALL_VMMR0_BIG: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1440	pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1441
1442	pVMMReq = (PSUPVMMR0REQHDR)&pReq->abReqPkt[0];
1443	REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_VMMR0_BIG_SIZE(sizeof(SUPVMMR0REQHDR)),
1444	("SUP_IOCTL_CALL_VMMR0_BIG: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_VMMR0_BIG_SIZE(sizeof(SUPVMMR0REQHDR))));
1445	REQ_CHECK_EXPR(SUP_IOCTL_CALL_VMMR0_BIG, pVMMReq->u32Magic == SUPVMMR0REQHDR_MAGIC);
1446	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0_BIG, SUP_IOCTL_CALL_VMMR0_BIG_SIZE_IN(pVMMReq->cbReq), SUP_IOCTL_CALL_VMMR0_BIG_SIZE_OUT(pVMMReq->cbReq));
1447
1448	/* execute */
1449	if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1450	pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1451	else
1452	pReq->Hdr.rc = VERR_WRONG_ORDER;
1453
1454	if ( RT_FAILURE(pReq->Hdr.rc)
1455	&& pReq->Hdr.rc != VERR_INTERRUPTED
1456	&& pReq->Hdr.rc != VERR_TIMEOUT)
1457	Log(("SUP_IOCTL_CALL_VMMR0_BIG: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1458	pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1459	else
1460	Log4(("SUP_IOCTL_CALL_VMMR0_BIG: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1461	pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1462	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1463	return 0;
1464	}
1465
1466	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GET_PAGING_MODE):
1467	{
1468	/* validate */
1469	PSUPGETPAGINGMODE pReq = (PSUPGETPAGINGMODE)pReqHdr;
1470	REQ_CHECK_SIZES(SUP_IOCTL_GET_PAGING_MODE);
1471
1472	/* execute */
1473	pReq->Hdr.rc = VINF_SUCCESS;
1474	pReq->u.Out.enmMode = SUPR0GetPagingMode();
1475	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1476	return 0;
1477	}
1478
1479	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_ALLOC):
1480	{
1481	/* validate */
1482	PSUPLOWALLOC pReq = (PSUPLOWALLOC)pReqHdr;
1483	REQ_CHECK_EXPR(SUP_IOCTL_LOW_ALLOC, pReq->Hdr.cbIn <= SUP_IOCTL_LOW_ALLOC_SIZE_IN);
1484	REQ_CHECK_SIZES_EX(SUP_IOCTL_LOW_ALLOC, SUP_IOCTL_LOW_ALLOC_SIZE_IN, SUP_IOCTL_LOW_ALLOC_SIZE_OUT(pReq->u.In.cPages));
1485
1486	/* execute */
1487	pReq->Hdr.rc = SUPR0LowAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.aPages[0]);
1488	if (RT_FAILURE(pReq->Hdr.rc))
1489	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1490	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1491	return 0;
1492	}
1493
1494	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_FREE):
1495	{
1496	/* validate */
1497	PSUPLOWFREE pReq = (PSUPLOWFREE)pReqHdr;
1498	REQ_CHECK_SIZES(SUP_IOCTL_LOW_FREE);
1499
1500	/* execute */
1501	pReq->Hdr.rc = SUPR0LowFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1502	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1503	return 0;
1504	}
1505
1506	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_MAP):
1507	{
1508	/* validate */
1509	PSUPGIPMAP pReq = (PSUPGIPMAP)pReqHdr;
1510	REQ_CHECK_SIZES(SUP_IOCTL_GIP_MAP);
1511
1512	/* execute */
1513	pReq->Hdr.rc = SUPR0GipMap(pSession, &pReq->u.Out.pGipR3, &pReq->u.Out.HCPhysGip);
1514	if (RT_SUCCESS(pReq->Hdr.rc))
1515	pReq->u.Out.pGipR0 = pDevExt->pGip;
1516	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1517	return 0;
1518	}
1519
1520	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_UNMAP):
1521	{
1522	/* validate */
1523	PSUPGIPUNMAP pReq = (PSUPGIPUNMAP)pReqHdr;
1524	REQ_CHECK_SIZES(SUP_IOCTL_GIP_UNMAP);
1525
1526	/* execute */
1527	pReq->Hdr.rc = SUPR0GipUnmap(pSession);
1528	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1529	return 0;
1530	}
1531
1532	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SET_VM_FOR_FAST):
1533	{
1534	/* validate */
1535	PSUPSETVMFORFAST pReq = (PSUPSETVMFORFAST)pReqHdr;
1536	REQ_CHECK_SIZES(SUP_IOCTL_SET_VM_FOR_FAST);
1537	REQ_CHECK_EXPR_FMT( !pReq->u.In.pVMR0
1538	\|\| ( VALID_PTR(pReq->u.In.pVMR0)
1539	&& !((uintptr_t)pReq->u.In.pVMR0 & (PAGE_SIZE - 1))),
1540	("SUP_IOCTL_SET_VM_FOR_FAST: pVMR0=%p!\n", pReq->u.In.pVMR0));
1541	/* execute */
1542	pSession->pVM = pReq->u.In.pVMR0;
1543	pReq->Hdr.rc = VINF_SUCCESS;
1544	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1545	return 0;
1546	}
1547
1548	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_ALLOC_EX):
1549	{
1550	/* validate */
1551	PSUPPAGEALLOCEX pReq = (PSUPPAGEALLOCEX)pReqHdr;
1552	REQ_CHECK_EXPR(SUP_IOCTL_PAGE_ALLOC_EX, pReq->Hdr.cbIn <= SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN);
1553	REQ_CHECK_SIZES_EX(SUP_IOCTL_PAGE_ALLOC_EX, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_OUT(pReq->u.In.cPages));
1554	REQ_CHECK_EXPR_FMT(pReq->u.In.fKernelMapping \|\| pReq->u.In.fUserMapping,
1555	("SUP_IOCTL_PAGE_ALLOC_EX: No mapping requested!\n"));
1556	REQ_CHECK_EXPR_FMT(pReq->u.In.fUserMapping,
1557	("SUP_IOCTL_PAGE_ALLOC_EX: Must have user mapping!\n"));
1558	REQ_CHECK_EXPR_FMT(!pReq->u.In.fReserved0 && !pReq->u.In.fReserved1,
1559	("SUP_IOCTL_PAGE_ALLOC_EX: fReserved0=%d fReserved1=%d\n", pReq->u.In.fReserved0, pReq->u.In.fReserved1));
1560
1561	/* execute */
1562	pReq->Hdr.rc = SUPR0PageAllocEx(pSession, pReq->u.In.cPages, 0 /* fFlags */,
1563	pReq->u.In.fUserMapping ? &pReq->u.Out.pvR3 : NULL,
1564	pReq->u.In.fKernelMapping ? &pReq->u.Out.pvR0 : NULL,
1565	&pReq->u.Out.aPages[0]);
1566	if (RT_FAILURE(pReq->Hdr.rc))
1567	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1568	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1569	return 0;
1570	}
1571
1572	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_MAP_KERNEL):
1573	{
1574	/* validate */
1575	PSUPPAGEMAPKERNEL pReq = (PSUPPAGEMAPKERNEL)pReqHdr;
1576	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_MAP_KERNEL);
1577	REQ_CHECK_EXPR_FMT(!pReq->u.In.fFlags, ("SUP_IOCTL_PAGE_MAP_KERNEL: fFlags=%#x! MBZ\n", pReq->u.In.fFlags));
1578	REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_MAP_KERNEL: offSub=%#x\n", pReq->u.In.offSub));
1579	REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
1580	("SUP_IOCTL_PAGE_MAP_KERNEL: cbSub=%#x\n", pReq->u.In.cbSub));
1581
1582	/* execute */
1583	pReq->Hdr.rc = SUPR0PageMapKernel(pSession, pReq->u.In.pvR3, pReq->u.In.offSub, pReq->u.In.cbSub,
1584	pReq->u.In.fFlags, &pReq->u.Out.pvR0);
1585	if (RT_FAILURE(pReq->Hdr.rc))
1586	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1587	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1588	return 0;
1589	}
1590
1591	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_PROTECT):
1592	{
1593	/* validate */
1594	PSUPPAGEPROTECT pReq = (PSUPPAGEPROTECT)pReqHdr;
1595	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_PROTECT);
1596	REQ_CHECK_EXPR_FMT(!(pReq->u.In.fProt & ~(RTMEM_PROT_READ \| RTMEM_PROT_WRITE \| RTMEM_PROT_EXEC \| RTMEM_PROT_NONE)),
1597	("SUP_IOCTL_PAGE_PROTECT: fProt=%#x!\n", pReq->u.In.fProt));
1598	REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_PROTECT: offSub=%#x\n", pReq->u.In.offSub));
1599	REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
1600	("SUP_IOCTL_PAGE_PROTECT: cbSub=%#x\n", pReq->u.In.cbSub));
1601
1602	/* execute */
1603	pReq->Hdr.rc = SUPR0PageProtect(pSession, pReq->u.In.pvR3, pReq->u.In.pvR0, pReq->u.In.offSub, pReq->u.In.cbSub, pReq->u.In.fProt);
1604	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1605	return 0;
1606	}
1607
1608	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_FREE):
1609	{
1610	/* validate */
1611	PSUPPAGEFREE pReq = (PSUPPAGEFREE)pReqHdr;
1612	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_FREE);
1613
1614	/* execute */
1615	pReq->Hdr.rc = SUPR0PageFree(pSession, pReq->u.In.pvR3);
1616	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1617	return 0;
1618	}
1619
1620	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_SERVICE(0)):
1621	{
1622	/* validate */
1623	PSUPCALLSERVICE pReq = (PSUPCALLSERVICE)pReqHdr;
1624	Log4(("SUP_IOCTL_CALL_SERVICE: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1625	pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1626
1627	if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
1628	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(0), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(0));
1629	else
1630	{
1631	PSUPR0SERVICEREQHDR pSrvReq = (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0];
1632	REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR)),
1633	("SUP_IOCTL_CALL_SERVICE: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR))));
1634	REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, pSrvReq->u32Magic == SUPR0SERVICEREQHDR_MAGIC);
1635	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(pSrvReq->cbReq), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(pSrvReq->cbReq));
1636	}
1637	REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, RTStrEnd(pReq->u.In.szName, sizeof(pReq->u.In.szName)));
1638
1639	/* execute */
1640	pReq->Hdr.rc = supdrvIOCtl_CallServiceModule(pDevExt, pSession, pReq);
1641	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1642	return 0;
1643	}
1644
1645	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOGGER_SETTINGS(0)):
1646	{
1647	/* validate */
1648	PSUPLOGGERSETTINGS pReq = (PSUPLOGGERSETTINGS)pReqHdr;
1649	size_t cbStrTab;
1650	REQ_CHECK_SIZE_OUT(SUP_IOCTL_LOGGER_SETTINGS, SUP_IOCTL_LOGGER_SETTINGS_SIZE_OUT);
1651	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->Hdr.cbIn >= SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(1));
1652	cbStrTab = pReq->Hdr.cbIn - SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(0);
1653	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offGroups < cbStrTab);
1654	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offFlags < cbStrTab);
1655	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offDestination < cbStrTab);
1656	REQ_CHECK_EXPR_FMT(pReq->u.In.szStrings[cbStrTab - 1] == '\0',
1657	("SUP_IOCTL_LOGGER_SETTINGS: cbIn=%#x cbStrTab=%#zx LastChar=%d\n",
1658	pReq->Hdr.cbIn, cbStrTab, pReq->u.In.szStrings[cbStrTab - 1]));
1659	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhich <= SUPLOGGERSETTINGS_WHICH_RELEASE);
1660	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhat <= SUPLOGGERSETTINGS_WHAT_DESTROY);
1661
1662	/* execute */
1663	pReq->Hdr.rc = supdrvIOCtl_LoggerSettings(pDevExt, pSession, pReq);
1664	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1665	return 0;
1666	}
1667
1668	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_OP2):
1669	{
1670	/* validate */
1671	PSUPSEMOP2 pReq = (PSUPSEMOP2)pReqHdr;
1672	REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_OP2, SUP_IOCTL_SEM_OP2_SIZE_IN, SUP_IOCTL_SEM_OP2_SIZE_OUT);
1673	REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP2, pReq->u.In.uReserved == 0);
1674
1675	/* execute */
1676	switch (pReq->u.In.uType)
1677	{
1678	case SUP_SEM_TYPE_EVENT:
1679	{
1680	SUPSEMEVENT hEvent = (SUPSEMEVENT)(uintptr_t)pReq->u.In.hSem;
1681	switch (pReq->u.In.uOp)
1682	{
1683	case SUPSEMOP2_WAIT_MS_REL:
1684	pReq->Hdr.rc = SUPSemEventWaitNoResume(pSession, hEvent, pReq->u.In.uArg.cRelMsTimeout);
1685	break;
1686	case SUPSEMOP2_WAIT_NS_ABS:
1687	pReq->Hdr.rc = SUPSemEventWaitNsAbsIntr(pSession, hEvent, pReq->u.In.uArg.uAbsNsTimeout);
1688	break;
1689	case SUPSEMOP2_WAIT_NS_REL:
1690	pReq->Hdr.rc = SUPSemEventWaitNsRelIntr(pSession, hEvent, pReq->u.In.uArg.cRelNsTimeout);
1691	break;
1692	case SUPSEMOP2_SIGNAL:
1693	pReq->Hdr.rc = SUPSemEventSignal(pSession, hEvent);
1694	break;
1695	case SUPSEMOP2_CLOSE:
1696	pReq->Hdr.rc = SUPSemEventClose(pSession, hEvent);
1697	break;
1698	case SUPSEMOP2_RESET:
1699	default:
1700	pReq->Hdr.rc = VERR_INVALID_FUNCTION;
1701	break;
1702	}
1703	break;
1704	}
1705
1706	case SUP_SEM_TYPE_EVENT_MULTI:
1707	{
1708	SUPSEMEVENTMULTI hEventMulti = (SUPSEMEVENTMULTI)(uintptr_t)pReq->u.In.hSem;
1709	switch (pReq->u.In.uOp)
1710	{
1711	case SUPSEMOP2_WAIT_MS_REL:
1712	pReq->Hdr.rc = SUPSemEventMultiWaitNoResume(pSession, hEventMulti, pReq->u.In.uArg.cRelMsTimeout);
1713	break;
1714	case SUPSEMOP2_WAIT_NS_ABS:
1715	pReq->Hdr.rc = SUPSemEventMultiWaitNsAbsIntr(pSession, hEventMulti, pReq->u.In.uArg.uAbsNsTimeout);
1716	break;
1717	case SUPSEMOP2_WAIT_NS_REL:
1718	pReq->Hdr.rc = SUPSemEventMultiWaitNsRelIntr(pSession, hEventMulti, pReq->u.In.uArg.cRelNsTimeout);
1719	break;
1720	case SUPSEMOP2_SIGNAL:
1721	pReq->Hdr.rc = SUPSemEventMultiSignal(pSession, hEventMulti);
1722	break;
1723	case SUPSEMOP2_CLOSE:
1724	pReq->Hdr.rc = SUPSemEventMultiClose(pSession, hEventMulti);
1725	break;
1726	case SUPSEMOP2_RESET:
1727	pReq->Hdr.rc = SUPSemEventMultiReset(pSession, hEventMulti);
1728	break;
1729	default:
1730	pReq->Hdr.rc = VERR_INVALID_FUNCTION;
1731	break;
1732	}
1733	break;
1734	}
1735
1736	default:
1737	pReq->Hdr.rc = VERR_INVALID_PARAMETER;
1738	break;
1739	}
1740	return 0;
1741	}
1742
1743	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_OP3):
1744	{
1745	/* validate */
1746	PSUPSEMOP3 pReq = (PSUPSEMOP3)pReqHdr;
1747	REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_OP3, SUP_IOCTL_SEM_OP3_SIZE_IN, SUP_IOCTL_SEM_OP3_SIZE_OUT);
1748	REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, pReq->u.In.u32Reserved == 0 && pReq->u.In.u64Reserved == 0);
1749
1750	/* execute */
1751	switch (pReq->u.In.uType)
1752	{
1753	case SUP_SEM_TYPE_EVENT:
1754	{
1755	SUPSEMEVENT hEvent = (SUPSEMEVENT)(uintptr_t)pReq->u.In.hSem;
1756	switch (pReq->u.In.uOp)
1757	{
1758	case SUPSEMOP3_CREATE:
1759	REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, hEvent == NIL_SUPSEMEVENT);
1760	pReq->Hdr.rc = SUPSemEventCreate(pSession, &hEvent);
1761	pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEvent;
1762	break;
1763	case SUPSEMOP3_GET_RESOLUTION:
1764	REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, hEvent == NIL_SUPSEMEVENT);
1765	pReq->Hdr.rc = VINF_SUCCESS;
1766	pReq->Hdr.cbOut = sizeof(*pReq);
1767	pReq->u.Out.cNsResolution = SUPSemEventGetResolution(pSession);
1768	break;
1769	default:
1770	pReq->Hdr.rc = VERR_INVALID_FUNCTION;
1771	break;
1772	}
1773	break;
1774	}
1775
1776	case SUP_SEM_TYPE_EVENT_MULTI:
1777	{
1778	SUPSEMEVENTMULTI hEventMulti = (SUPSEMEVENTMULTI)(uintptr_t)pReq->u.In.hSem;
1779	switch (pReq->u.In.uOp)
1780	{
1781	case SUPSEMOP3_CREATE:
1782	REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, hEventMulti == NIL_SUPSEMEVENTMULTI);
1783	pReq->Hdr.rc = SUPSemEventMultiCreate(pSession, &hEventMulti);
1784	pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEventMulti;
1785	break;
1786	case SUPSEMOP3_GET_RESOLUTION:
1787	REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, hEventMulti == NIL_SUPSEMEVENTMULTI);
1788	pReq->Hdr.rc = VINF_SUCCESS;
1789	pReq->u.Out.cNsResolution = SUPSemEventMultiGetResolution(pSession);
1790	break;
1791	default:
1792	pReq->Hdr.rc = VERR_INVALID_FUNCTION;
1793	break;
1794	}
1795	break;
1796	}
1797
1798	default:
1799	pReq->Hdr.rc = VERR_INVALID_PARAMETER;
1800	break;
1801	}
1802	return 0;
1803	}
1804
1805	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_VT_CAPS):
1806	{
1807	/* validate */
1808	PSUPVTCAPS pReq = (PSUPVTCAPS)pReqHdr;
1809	REQ_CHECK_SIZES(SUP_IOCTL_VT_CAPS);
1810	REQ_CHECK_EXPR(SUP_IOCTL_VT_CAPS, pReq->Hdr.cbIn <= SUP_IOCTL_VT_CAPS_SIZE_IN);
1811
1812	/* execute */
1813	pReq->Hdr.rc = SUPR0QueryVTCaps(pSession, &pReq->u.Out.Caps);
1814	if (RT_FAILURE(pReq->Hdr.rc))
1815	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1816	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VINF_SUCCESS, pReq->Hdr.rc);
1817	return 0;
1818	}
1819
1820	default:
1821	Log(("Unknown IOCTL %#lx\n", (long)uIOCtl));
1822	break;
1823	}
1824	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_GENERAL_FAILURE, VERR_GENERAL_FAILURE);
1825	return VERR_GENERAL_FAILURE;
1826	}
1827
1828
1829	/**
1830	* Inter-Driver Communication (IDC) worker.
1831	*
1832	* @returns VBox status code.
1833	* @retval VINF_SUCCESS on success.
1834	* @retval VERR_INVALID_PARAMETER if the request is invalid.
1835	* @retval VERR_NOT_SUPPORTED if the request isn't supported.
1836	*
1837	* @param uReq The request (function) code.
1838	* @param pDevExt Device extention.
1839	* @param pSession Session data.
1840	* @param pReqHdr The request header.
1841	*/
1842	int VBOXCALL supdrvIDC(uintptr_t uReq, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQHDR pReqHdr)
1843	{
1844	/*
1845	* The OS specific code has already validated the pSession
1846	* pointer, and the request size being greater or equal to
1847	* size of the header.
1848	*
1849	* So, just check that pSession is a kernel context session.
1850	*/
1851	if (RT_UNLIKELY( pSession
1852	&& pSession->R0Process != NIL_RTR0PROCESS))
1853	return VERR_INVALID_PARAMETER;
1854
1855	/*
1856	* Validation macro.
1857	*/
1858	#define REQ_CHECK_IDC_SIZE(Name, cbExpect) \
1859	do { \
1860	if (RT_UNLIKELY(pReqHdr->cb != (cbExpect))) \
1861	{ \
1862	OSDBGPRINT(( #Name ": Invalid input/output sizes. cb=%ld expected %ld.\n", \
1863	(long)pReqHdr->cb, (long)(cbExpect))); \
1864	return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1865	} \
1866	} while (0)
1867
1868	switch (uReq)
1869	{
1870	case SUPDRV_IDC_REQ_CONNECT:
1871	{
1872	PSUPDRVIDCREQCONNECT pReq = (PSUPDRVIDCREQCONNECT)pReqHdr;
1873	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_CONNECT, sizeof(*pReq));
1874
1875	/*
1876	* Validate the cookie and other input.
1877	*/
1878	if (pReq->Hdr.pSession != NULL)
1879	{
1880	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: Hdr.pSession=%p expected NULL!\n", pReq->Hdr.pSession));
1881	return pReqHdr->rc = VERR_INVALID_PARAMETER;
1882	}
1883	if (pReq->u.In.u32MagicCookie != SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE)
1884	{
1885	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: u32MagicCookie=%#x expected %#x!\n",
1886	(unsigned)pReq->u.In.u32MagicCookie, (unsigned)SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE));
1887	return pReqHdr->rc = VERR_INVALID_PARAMETER;
1888	}
1889	if ( pReq->u.In.uMinVersion > pReq->u.In.uReqVersion
1890	\|\| (pReq->u.In.uMinVersion & UINT32_C(0xffff0000)) != (pReq->u.In.uReqVersion & UINT32_C(0xffff0000)))
1891	{
1892	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: uMinVersion=%#x uMaxVersion=%#x doesn't match!\n",
1893	pReq->u.In.uMinVersion, pReq->u.In.uReqVersion));
1894	return pReqHdr->rc = VERR_INVALID_PARAMETER;
1895	}
1896	if (pSession != NULL)
1897	{
1898	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: pSession=%p expected NULL!\n", pSession));
1899	return pReqHdr->rc = VERR_INVALID_PARAMETER;
1900	}
1901
1902	/*
1903	* Match the version.
1904	* The current logic is very simple, match the major interface version.
1905	*/
1906	if ( pReq->u.In.uMinVersion > SUPDRV_IDC_VERSION
1907	\|\| (pReq->u.In.uMinVersion & 0xffff0000) != (SUPDRV_IDC_VERSION & 0xffff0000))
1908	{
1909	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
1910	pReq->u.In.uReqVersion, pReq->u.In.uMinVersion, (unsigned)SUPDRV_IDC_VERSION));
1911	pReq->u.Out.pSession = NULL;
1912	pReq->u.Out.uSessionVersion = 0xffffffff;
1913	pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
1914	pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
1915	pReq->Hdr.rc = VERR_VERSION_MISMATCH;
1916	return VINF_SUCCESS;
1917	}
1918
1919	pReq->u.Out.pSession = NULL;
1920	pReq->u.Out.uSessionVersion = SUPDRV_IDC_VERSION;
1921	pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
1922	pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
1923
1924	pReq->Hdr.rc = supdrvCreateSession(pDevExt, false /* fUser */, &pSession);
1925	if (RT_FAILURE(pReq->Hdr.rc))
1926	{
1927	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: failed to create session, rc=%d\n", pReq->Hdr.rc));
1928	return VINF_SUCCESS;
1929	}
1930
1931	pReq->u.Out.pSession = pSession;
1932	pReq->Hdr.pSession = pSession;
1933
1934	return VINF_SUCCESS;
1935	}
1936
1937	case SUPDRV_IDC_REQ_DISCONNECT:
1938	{
1939	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_DISCONNECT, sizeof(*pReqHdr));
1940
1941	supdrvCloseSession(pDevExt, pSession);
1942	return pReqHdr->rc = VINF_SUCCESS;
1943	}
1944
1945	case SUPDRV_IDC_REQ_GET_SYMBOL:
1946	{
1947	PSUPDRVIDCREQGETSYM pReq = (PSUPDRVIDCREQGETSYM)pReqHdr;
1948	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_GET_SYMBOL, sizeof(*pReq));
1949
1950	pReq->Hdr.rc = supdrvIDC_LdrGetSymbol(pDevExt, pSession, pReq);
1951	return VINF_SUCCESS;
1952	}
1953
1954	case SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY:
1955	{
1956	PSUPDRVIDCREQCOMPREGFACTORY pReq = (PSUPDRVIDCREQCOMPREGFACTORY)pReqHdr;
1957	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY, sizeof(*pReq));
1958
1959	pReq->Hdr.rc = SUPR0ComponentRegisterFactory(pSession, pReq->u.In.pFactory);
1960	return VINF_SUCCESS;
1961	}
1962
1963	case SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY:
1964	{
1965	PSUPDRVIDCREQCOMPDEREGFACTORY pReq = (PSUPDRVIDCREQCOMPDEREGFACTORY)pReqHdr;
1966	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY, sizeof(*pReq));
1967
1968	pReq->Hdr.rc = SUPR0ComponentDeregisterFactory(pSession, pReq->u.In.pFactory);
1969	return VINF_SUCCESS;
1970	}
1971
1972	default:
1973	Log(("Unknown IDC %#lx\n", (long)uReq));
1974	break;
1975	}
1976
1977	#undef REQ_CHECK_IDC_SIZE
1978	return VERR_NOT_SUPPORTED;
1979	}
1980
1981
1982	/**
1983	* Register a object for reference counting.
1984	* The object is registered with one reference in the specified session.
1985	*
1986	* @returns Unique identifier on success (pointer).
1987	* All future reference must use this identifier.
1988	* @returns NULL on failure.
1989	* @param pfnDestructor The destructore function which will be called when the reference count reaches 0.
1990	* @param pvUser1 The first user argument.
1991	* @param pvUser2 The second user argument.
1992	*/
1993	SUPR0DECL(void ) SUPR0ObjRegister(PSUPDRVSESSION pSession, SUPDRVOBJTYPE enmType, PFNSUPDRVDESTRUCTOR pfnDestructor, void pvUser1, void *pvUser2)
1994	{
1995	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1996	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1997	PSUPDRVOBJ pObj;
1998	PSUPDRVUSAGE pUsage;
1999
2000	/*
2001	* Validate the input.
2002	*/
2003	AssertReturn(SUP_IS_SESSION_VALID(pSession), NULL);
2004	AssertReturn(enmType > SUPDRVOBJTYPE_INVALID && enmType < SUPDRVOBJTYPE_END, NULL);
2005	AssertPtrReturn(pfnDestructor, NULL);
2006
2007	/*
2008	* Allocate and initialize the object.
2009	*/
2010	pObj = (PSUPDRVOBJ)RTMemAlloc(sizeof(*pObj));
2011	if (!pObj)
2012	return NULL;
2013	pObj->u32Magic = SUPDRVOBJ_MAGIC;
2014	pObj->enmType = enmType;
2015	pObj->pNext = NULL;
2016	pObj->cUsage = 1;
2017	pObj->pfnDestructor = pfnDestructor;
2018	pObj->pvUser1 = pvUser1;
2019	pObj->pvUser2 = pvUser2;
2020	pObj->CreatorUid = pSession->Uid;
2021	pObj->CreatorGid = pSession->Gid;
2022	pObj->CreatorProcess= pSession->Process;
2023	supdrvOSObjInitCreator(pObj, pSession);
2024
2025	/*
2026	* Allocate the usage record.
2027	* (We keep freed usage records around to simplify SUPR0ObjAddRefEx().)
2028	*/
2029	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
2030
2031	pUsage = pDevExt->pUsageFree;
2032	if (pUsage)
2033	pDevExt->pUsageFree = pUsage->pNext;
2034	else
2035	{
2036	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2037	pUsage = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsage));
2038	if (!pUsage)
2039	{
2040	RTMemFree(pObj);
2041	return NULL;
2042	}
2043	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
2044	}
2045
2046	/*
2047	* Insert the object and create the session usage record.
2048	*/
2049	/* The object. */
2050	pObj->pNext = pDevExt->pObjs;
2051	pDevExt->pObjs = pObj;
2052
2053	/* The session record. */
2054	pUsage->cUsage = 1;
2055	pUsage->pObj = pObj;
2056	pUsage->pNext = pSession->pUsage;
2057	/* Log2(("SUPR0ObjRegister: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext)); */
2058	pSession->pUsage = pUsage;
2059
2060	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2061
2062	Log(("SUPR0ObjRegister: returns %p (pvUser1=%p, pvUser=%p)\n", pObj, pvUser1, pvUser2));
2063	return pObj;
2064	}
2065
2066
2067	/**
2068	* Increment the reference counter for the object associating the reference
2069	* with the specified session.
2070	*
2071	* @returns IPRT status code.
2072	* @param pvObj The identifier returned by SUPR0ObjRegister().
2073	* @param pSession The session which is referencing the object.
2074	*
2075	* @remarks The caller should not own any spinlocks and must carefully protect
2076	* itself against potential race with the destructor so freed memory
2077	* isn't accessed here.
2078	*/
2079	SUPR0DECL(int) SUPR0ObjAddRef(void *pvObj, PSUPDRVSESSION pSession)
2080	{
2081	return SUPR0ObjAddRefEx(pvObj, pSession, false /* fNoBlocking */);
2082	}
2083
2084
2085	/**
2086	* Increment the reference counter for the object associating the reference
2087	* with the specified session.
2088	*
2089	* @returns IPRT status code.
2090	* @retval VERR_TRY_AGAIN if fNoBlocking was set and a new usage record
2091	* couldn't be allocated. (If you see this you're not doing the right
2092	* thing and it won't ever work reliably.)
2093	*
2094	* @param pvObj The identifier returned by SUPR0ObjRegister().
2095	* @param pSession The session which is referencing the object.
2096	* @param fNoBlocking Set if it's not OK to block. Never try to make the
2097	* first reference to an object in a session with this
2098	* argument set.
2099	*
2100	* @remarks The caller should not own any spinlocks and must carefully protect
2101	* itself against potential race with the destructor so freed memory
2102	* isn't accessed here.
2103	*/
2104	SUPR0DECL(int) SUPR0ObjAddRefEx(void *pvObj, PSUPDRVSESSION pSession, bool fNoBlocking)
2105	{
2106	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2107	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2108	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2109	int rc = VINF_SUCCESS;
2110	PSUPDRVUSAGE pUsagePre;
2111	PSUPDRVUSAGE pUsage;
2112
2113	/*
2114	* Validate the input.
2115	* Be ready for the destruction race (someone might be stuck in the
2116	* destructor waiting a lock we own).
2117	*/
2118	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2119	AssertPtrReturn(pObj, VERR_INVALID_POINTER);
2120	AssertMsgReturn(pObj->u32Magic == SUPDRVOBJ_MAGIC \|\| pObj->u32Magic == SUPDRVOBJ_MAGIC_DEAD,
2121	("Invalid pvObj=%p magic=%#x (expected %#x or %#x)\n", pvObj, pObj->u32Magic, SUPDRVOBJ_MAGIC, SUPDRVOBJ_MAGIC_DEAD),
2122	VERR_INVALID_PARAMETER);
2123
2124	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
2125
2126	if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
2127	{
2128	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2129
2130	AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
2131	return VERR_WRONG_ORDER;
2132	}
2133
2134	/*
2135	* Preallocate the usage record if we can.
2136	*/
2137	pUsagePre = pDevExt->pUsageFree;
2138	if (pUsagePre)
2139	pDevExt->pUsageFree = pUsagePre->pNext;
2140	else if (!fNoBlocking)
2141	{
2142	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2143	pUsagePre = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsagePre));
2144	if (!pUsagePre)
2145	return VERR_NO_MEMORY;
2146
2147	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
2148	if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
2149	{
2150	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2151
2152	AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
2153	return VERR_WRONG_ORDER;
2154	}
2155	}
2156
2157	/*
2158	* Reference the object.
2159	*/
2160	pObj->cUsage++;
2161
2162	/*
2163	* Look for the session record.
2164	*/
2165	for (pUsage = pSession->pUsage; pUsage; pUsage = pUsage->pNext)
2166	{
2167	/Log(("SUPR0AddRef: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));/
2168	if (pUsage->pObj == pObj)
2169	break;
2170	}
2171	if (pUsage)
2172	pUsage->cUsage++;
2173	else if (pUsagePre)
2174	{
2175	/* create a new session record. */
2176	pUsagePre->cUsage = 1;
2177	pUsagePre->pObj = pObj;
2178	pUsagePre->pNext = pSession->pUsage;
2179	pSession->pUsage = pUsagePre;
2180	/Log(("SUPR0AddRef: pUsagePre=%p:{.pObj=%p, .pNext=%p}\n", pUsagePre, pUsagePre->pObj, pUsagePre->pNext));/
2181
2182	pUsagePre = NULL;
2183	}
2184	else
2185	{
2186	pObj->cUsage--;
2187	rc = VERR_TRY_AGAIN;
2188	}
2189
2190	/*
2191	* Put any unused usage record into the free list..
2192	*/
2193	if (pUsagePre)
2194	{
2195	pUsagePre->pNext = pDevExt->pUsageFree;
2196	pDevExt->pUsageFree = pUsagePre;
2197	}
2198
2199	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2200
2201	return rc;
2202	}
2203
2204
2205	/**
2206	* Decrement / destroy a reference counter record for an object.
2207	*
2208	* The object is uniquely identified by pfnDestructor+pvUser1+pvUser2.
2209	*
2210	* @returns IPRT status code.
2211	* @retval VINF_SUCCESS if not destroyed.
2212	* @retval VINF_OBJECT_DESTROYED if it's destroyed by this release call.
2213	* @retval VERR_INVALID_PARAMETER if the object isn't valid. Will assert in
2214	* string builds.
2215	*
2216	* @param pvObj The identifier returned by SUPR0ObjRegister().
2217	* @param pSession The session which is referencing the object.
2218	*/
2219	SUPR0DECL(int) SUPR0ObjRelease(void *pvObj, PSUPDRVSESSION pSession)
2220	{
2221	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2222	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2223	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2224	int rc = VERR_INVALID_PARAMETER;
2225	PSUPDRVUSAGE pUsage;
2226	PSUPDRVUSAGE pUsagePrev;
2227
2228	/*
2229	* Validate the input.
2230	*/
2231	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2232	AssertMsgReturn(VALID_PTR(pObj) && pObj->u32Magic == SUPDRVOBJ_MAGIC,
2233	("Invalid pvObj=%p magic=%#x (exepcted %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
2234	VERR_INVALID_PARAMETER);
2235
2236	/*
2237	* Acquire the spinlock and look for the usage record.
2238	*/
2239	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
2240
2241	for (pUsagePrev = NULL, pUsage = pSession->pUsage;
2242	pUsage;
2243	pUsagePrev = pUsage, pUsage = pUsage->pNext)
2244	{
2245	/Log2(("SUPR0ObjRelease: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));/
2246	if (pUsage->pObj == pObj)
2247	{
2248	rc = VINF_SUCCESS;
2249	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
2250	if (pUsage->cUsage > 1)
2251	{
2252	pObj->cUsage--;
2253	pUsage->cUsage--;
2254	}
2255	else
2256	{
2257	/*
2258	* Free the session record.
2259	*/
2260	if (pUsagePrev)
2261	pUsagePrev->pNext = pUsage->pNext;
2262	else
2263	pSession->pUsage = pUsage->pNext;
2264	pUsage->pNext = pDevExt->pUsageFree;
2265	pDevExt->pUsageFree = pUsage;
2266
2267	/* What about the object? */
2268	if (pObj->cUsage > 1)
2269	pObj->cUsage--;
2270	else
2271	{
2272	/*
2273	* Object is to be destroyed, unlink it.
2274	*/
2275	pObj->u32Magic = SUPDRVOBJ_MAGIC_DEAD;
2276	rc = VINF_OBJECT_DESTROYED;
2277	if (pDevExt->pObjs == pObj)
2278	pDevExt->pObjs = pObj->pNext;
2279	else
2280	{
2281	PSUPDRVOBJ pObjPrev;
2282	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
2283	if (pObjPrev->pNext == pObj)
2284	{
2285	pObjPrev->pNext = pObj->pNext;
2286	break;
2287	}
2288	Assert(pObjPrev);
2289	}
2290	}
2291	}
2292	break;
2293	}
2294	}
2295
2296	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2297
2298	/*
2299	* Call the destructor and free the object if required.
2300	*/
2301	if (rc == VINF_OBJECT_DESTROYED)
2302	{
2303	Log(("SUPR0ObjRelease: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
2304	pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
2305	if (pObj->pfnDestructor)
2306	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
2307	RTMemFree(pObj);
2308	}
2309
2310	AssertMsg(pUsage, ("pvObj=%p\n", pvObj));
2311	return rc;
2312	}
2313
2314
2315	/**
2316	* Verifies that the current process can access the specified object.
2317	*
2318	* @returns The following IPRT status code:
2319	* @retval VINF_SUCCESS if access was granted.
2320	* @retval VERR_PERMISSION_DENIED if denied access.
2321	* @retval VERR_INVALID_PARAMETER if invalid parameter.
2322	*
2323	* @param pvObj The identifier returned by SUPR0ObjRegister().
2324	* @param pSession The session which wishes to access the object.
2325	* @param pszObjName Object string name. This is optional and depends on the object type.
2326	*
2327	* @remark The caller is responsible for making sure the object isn't removed while
2328	* we're inside this function. If uncertain about this, just call AddRef before calling us.
2329	*/
2330	SUPR0DECL(int) SUPR0ObjVerifyAccess(void pvObj, PSUPDRVSESSION pSession, const char pszObjName)
2331	{
2332	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2333	int rc;
2334
2335	/*
2336	* Validate the input.
2337	*/
2338	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2339	AssertMsgReturn(VALID_PTR(pObj) && pObj->u32Magic == SUPDRVOBJ_MAGIC,
2340	("Invalid pvObj=%p magic=%#x (exepcted %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
2341	VERR_INVALID_PARAMETER);
2342
2343	/*
2344	* Check access. (returns true if a decision has been made.)
2345	*/
2346	rc = VERR_INTERNAL_ERROR;
2347	if (supdrvOSObjCanAccess(pObj, pSession, pszObjName, &rc))
2348	return rc;
2349
2350	/*
2351	* Default policy is to allow the user to access his own
2352	* stuff but nothing else.
2353	*/
2354	if (pObj->CreatorUid == pSession->Uid)
2355	return VINF_SUCCESS;
2356	return VERR_PERMISSION_DENIED;
2357	}
2358
2359
2360	/**
2361	* Lock pages.
2362	*
2363	* @returns IPRT status code.
2364	* @param pSession Session to which the locked memory should be associated.
2365	* @param pvR3 Start of the memory range to lock.
2366	* This must be page aligned.
2367	* @param cPages Number of pages to lock.
2368	* @param paPages Where to put the physical addresses of locked memory.
2369	*/
2370	SUPR0DECL(int) SUPR0LockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t cPages, PRTHCPHYS paPages)
2371	{
2372	int rc;
2373	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2374	const size_t cb = (size_t)cPages << PAGE_SHIFT;
2375	LogFlow(("SUPR0LockMem: pSession=%p pvR3=%p cPages=%d paPages=%p\n", pSession, (void *)pvR3, cPages, paPages));
2376
2377	/*
2378	* Verify input.
2379	*/
2380	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2381	AssertPtrReturn(paPages, VERR_INVALID_PARAMETER);
2382	if ( RT_ALIGN_R3PT(pvR3, PAGE_SIZE, RTR3PTR) != pvR3
2383	\|\| !pvR3)
2384	{
2385	Log(("pvR3 (%p) must be page aligned and not NULL!\n", (void *)pvR3));
2386	return VERR_INVALID_PARAMETER;
2387	}
2388
2389	/*
2390	* Let IPRT do the job.
2391	*/
2392	Mem.eType = MEMREF_TYPE_LOCKED;
2393	rc = RTR0MemObjLockUser(&Mem.MemObj, pvR3, cb, RTMEM_PROT_READ \| RTMEM_PROT_WRITE, RTR0ProcHandleSelf());
2394	if (RT_SUCCESS(rc))
2395	{
2396	uint32_t iPage = cPages;
2397	AssertMsg(RTR0MemObjAddressR3(Mem.MemObj) == pvR3, ("%p == %p\n", RTR0MemObjAddressR3(Mem.MemObj), pvR3));
2398	AssertMsg(RTR0MemObjSize(Mem.MemObj) == cb, ("%x == %x\n", RTR0MemObjSize(Mem.MemObj), cb));
2399
2400	while (iPage-- > 0)
2401	{
2402	paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
2403	if (RT_UNLIKELY(paPages[iPage] == NIL_RTCCPHYS))
2404	{
2405	AssertMsgFailed(("iPage=%d\n", iPage));
2406	rc = VERR_INTERNAL_ERROR;
2407	break;
2408	}
2409	}
2410	if (RT_SUCCESS(rc))
2411	rc = supdrvMemAdd(&Mem, pSession);
2412	if (RT_FAILURE(rc))
2413	{
2414	int rc2 = RTR0MemObjFree(Mem.MemObj, false);
2415	AssertRC(rc2);
2416	}
2417	}
2418
2419	return rc;
2420	}
2421
2422
2423	/**
2424	* Unlocks the memory pointed to by pv.
2425	*
2426	* @returns IPRT status code.
2427	* @param pSession Session to which the memory was locked.
2428	* @param pvR3 Memory to unlock.
2429	*/
2430	SUPR0DECL(int) SUPR0UnlockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3)
2431	{
2432	LogFlow(("SUPR0UnlockMem: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
2433	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2434	return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_LOCKED);
2435	}
2436
2437
2438	/**
2439	* Allocates a chunk of page aligned memory with contiguous and fixed physical
2440	* backing.
2441	*
2442	* @returns IPRT status code.
2443	* @param pSession Session data.
2444	* @param cPages Number of pages to allocate.
2445	* @param ppvR0 Where to put the address of Ring-0 mapping the allocated memory.
2446	* @param ppvR3 Where to put the address of Ring-3 mapping the allocated memory.
2447	* @param pHCPhys Where to put the physical address of allocated memory.
2448	*/
2449	SUPR0DECL(int) SUPR0ContAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS pHCPhys)
2450	{
2451	int rc;
2452	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2453	LogFlow(("SUPR0ContAlloc: pSession=%p cPages=%d ppvR0=%p ppvR3=%p pHCPhys=%p\n", pSession, cPages, ppvR0, ppvR3, pHCPhys));
2454
2455	/*
2456	* Validate input.
2457	*/
2458	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2459	if (!ppvR3 \|\| !ppvR0 \|\| !pHCPhys)
2460	{
2461	Log(("Null pointer. All of these should be set: pSession=%p ppvR0=%p ppvR3=%p pHCPhys=%p\n",
2462	pSession, ppvR0, ppvR3, pHCPhys));
2463	return VERR_INVALID_PARAMETER;
2464
2465	}
2466	if (cPages < 1 \|\| cPages >= 256)
2467	{
2468	Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
2469	return VERR_PAGE_COUNT_OUT_OF_RANGE;
2470	}
2471
2472	/*
2473	* Let IPRT do the job.
2474	*/
2475	rc = RTR0MemObjAllocCont(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable R0 mapping */);
2476	if (RT_SUCCESS(rc))
2477	{
2478	int rc2;
2479	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2480	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2481	if (RT_SUCCESS(rc))
2482	{
2483	Mem.eType = MEMREF_TYPE_CONT;
2484	rc = supdrvMemAdd(&Mem, pSession);
2485	if (!rc)
2486	{
2487	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2488	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2489	*pHCPhys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, 0);
2490	return 0;
2491	}
2492
2493	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2494	AssertRC(rc2);
2495	}
2496	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2497	AssertRC(rc2);
2498	}
2499
2500	return rc;
2501	}
2502
2503
2504	/**
2505	* Frees memory allocated using SUPR0ContAlloc().
2506	*
2507	* @returns IPRT status code.
2508	* @param pSession The session to which the memory was allocated.
2509	* @param uPtr Pointer to the memory (ring-3 or ring-0).
2510	*/
2511	SUPR0DECL(int) SUPR0ContFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2512	{
2513	LogFlow(("SUPR0ContFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2514	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2515	return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_CONT);
2516	}
2517
2518
2519	/**
2520	* Allocates a chunk of page aligned memory with fixed physical backing below 4GB.
2521	*
2522	* The memory isn't zeroed.
2523	*
2524	* @returns IPRT status code.
2525	* @param pSession Session data.
2526	* @param cPages Number of pages to allocate.
2527	* @param ppvR0 Where to put the address of Ring-0 mapping of the allocated memory.
2528	* @param ppvR3 Where to put the address of Ring-3 mapping of the allocated memory.
2529	* @param paPages Where to put the physical addresses of allocated memory.
2530	*/
2531	SUPR0DECL(int) SUPR0LowAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS paPages)
2532	{
2533	unsigned iPage;
2534	int rc;
2535	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2536	LogFlow(("SUPR0LowAlloc: pSession=%p cPages=%d ppvR3=%p ppvR0=%p paPages=%p\n", pSession, cPages, ppvR3, ppvR0, paPages));
2537
2538	/*
2539	* Validate input.
2540	*/
2541	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2542	if (!ppvR3 \|\| !ppvR0 \|\| !paPages)
2543	{
2544	Log(("Null pointer. All of these should be set: pSession=%p ppvR3=%p ppvR0=%p paPages=%p\n",
2545	pSession, ppvR3, ppvR0, paPages));
2546	return VERR_INVALID_PARAMETER;
2547
2548	}
2549	if (cPages < 1 \|\| cPages >= 256)
2550	{
2551	Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
2552	return VERR_PAGE_COUNT_OUT_OF_RANGE;
2553	}
2554
2555	/*
2556	* Let IPRT do the work.
2557	*/
2558	rc = RTR0MemObjAllocLow(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable ring-0 mapping */);
2559	if (RT_SUCCESS(rc))
2560	{
2561	int rc2;
2562	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2563	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2564	if (RT_SUCCESS(rc))
2565	{
2566	Mem.eType = MEMREF_TYPE_LOW;
2567	rc = supdrvMemAdd(&Mem, pSession);
2568	if (!rc)
2569	{
2570	for (iPage = 0; iPage < cPages; iPage++)
2571	{
2572	paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
2573	AssertMsg(!(paPages[iPage] & (PAGE_SIZE - 1)), ("iPage=%d Phys=%RHp\n", paPages[iPage]));
2574	}
2575	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2576	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2577	return 0;
2578	}
2579
2580	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2581	AssertRC(rc2);
2582	}
2583
2584	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2585	AssertRC(rc2);
2586	}
2587
2588	return rc;
2589	}
2590
2591
2592	/**
2593	* Frees memory allocated using SUPR0LowAlloc().
2594	*
2595	* @returns IPRT status code.
2596	* @param pSession The session to which the memory was allocated.
2597	* @param uPtr Pointer to the memory (ring-3 or ring-0).
2598	*/
2599	SUPR0DECL(int) SUPR0LowFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2600	{
2601	LogFlow(("SUPR0LowFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2602	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2603	return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_LOW);
2604	}
2605
2606
2607
2608	/**
2609	* Allocates a chunk of memory with both R0 and R3 mappings.
2610	* The memory is fixed and it's possible to query the physical addresses using SUPR0MemGetPhys().
2611	*
2612	* @returns IPRT status code.
2613	* @param pSession The session to associated the allocation with.
2614	* @param cb Number of bytes to allocate.
2615	* @param ppvR0 Where to store the address of the Ring-0 mapping.
2616	* @param ppvR3 Where to store the address of the Ring-3 mapping.
2617	*/
2618	SUPR0DECL(int) SUPR0MemAlloc(PSUPDRVSESSION pSession, uint32_t cb, PRTR0PTR ppvR0, PRTR3PTR ppvR3)
2619	{
2620	int rc;
2621	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2622	LogFlow(("SUPR0MemAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p\n", pSession, cb, ppvR0, ppvR3));
2623
2624	/*
2625	* Validate input.
2626	*/
2627	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2628	AssertPtrReturn(ppvR0, VERR_INVALID_POINTER);
2629	AssertPtrReturn(ppvR3, VERR_INVALID_POINTER);
2630	if (cb < 1 \|\| cb >= _4M)
2631	{
2632	Log(("Illegal request cb=%u; must be greater than 0 and smaller than 4MB.\n", cb));
2633	return VERR_INVALID_PARAMETER;
2634	}
2635
2636	/*
2637	* Let IPRT do the work.
2638	*/
2639	rc = RTR0MemObjAllocPage(&Mem.MemObj, cb, true /* executable ring-0 mapping */);
2640	if (RT_SUCCESS(rc))
2641	{
2642	int rc2;
2643	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2644	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2645	if (RT_SUCCESS(rc))
2646	{
2647	Mem.eType = MEMREF_TYPE_MEM;
2648	rc = supdrvMemAdd(&Mem, pSession);
2649	if (!rc)
2650	{
2651	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2652	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2653	return VINF_SUCCESS;
2654	}
2655
2656	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2657	AssertRC(rc2);
2658	}
2659
2660	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2661	AssertRC(rc2);
2662	}
2663
2664	return rc;
2665	}
2666
2667
2668	/**
2669	* Get the physical addresses of memory allocated using SUPR0MemAlloc().
2670	*
2671	* @returns IPRT status code.
2672	* @param pSession The session to which the memory was allocated.
2673	* @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2674	* @param paPages Where to store the physical addresses.
2675	*/
2676	SUPR0DECL(int) SUPR0MemGetPhys(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, PSUPPAGE paPages) /** @todo switch this bugger to RTHCPHYS */
2677	{
2678	PSUPDRVBUNDLE pBundle;
2679	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2680	LogFlow(("SUPR0MemGetPhys: pSession=%p uPtr=%p paPages=%p\n", pSession, (void *)uPtr, paPages));
2681
2682	/*
2683	* Validate input.
2684	*/
2685	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2686	AssertPtrReturn(paPages, VERR_INVALID_POINTER);
2687	AssertReturn(uPtr, VERR_INVALID_PARAMETER);
2688
2689	/*
2690	* Search for the address.
2691	*/
2692	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2693	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2694	{
2695	if (pBundle->cUsed > 0)
2696	{
2697	unsigned i;
2698	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2699	{
2700	if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
2701	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2702	&& ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
2703	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2704	&& RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr)
2705	)
2706	)
2707	{
2708	const size_t cPages = RTR0MemObjSize(pBundle->aMem[i].MemObj) >> PAGE_SHIFT;
2709	size_t iPage;
2710	for (iPage = 0; iPage < cPages; iPage++)
2711	{
2712	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(pBundle->aMem[i].MemObj, iPage);
2713	paPages[iPage].uReserved = 0;
2714	}
2715	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2716	return VINF_SUCCESS;
2717	}
2718	}
2719	}
2720	}
2721	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2722	Log(("Failed to find %p!!!\n", (void *)uPtr));
2723	return VERR_INVALID_PARAMETER;
2724	}
2725
2726
2727	/**
2728	* Free memory allocated by SUPR0MemAlloc().
2729	*
2730	* @returns IPRT status code.
2731	* @param pSession The session owning the allocation.
2732	* @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2733	*/
2734	SUPR0DECL(int) SUPR0MemFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2735	{
2736	LogFlow(("SUPR0MemFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2737	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2738	return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_MEM);
2739	}
2740
2741
2742	/**
2743	* Allocates a chunk of memory with a kernel or/and a user mode mapping.
2744	*
2745	* The memory is fixed and it's possible to query the physical addresses using
2746	* SUPR0MemGetPhys().
2747	*
2748	* @returns IPRT status code.
2749	* @param pSession The session to associated the allocation with.
2750	* @param cPages The number of pages to allocate.
2751	* @param fFlags Flags, reserved for the future. Must be zero.
2752	* @param ppvR3 Where to store the address of the Ring-3 mapping.
2753	* NULL if no ring-3 mapping.
2754	* @param ppvR3 Where to store the address of the Ring-0 mapping.
2755	* NULL if no ring-0 mapping.
2756	* @param paPages Where to store the addresses of the pages. Optional.
2757	*/
2758	SUPR0DECL(int) SUPR0PageAllocEx(PSUPDRVSESSION pSession, uint32_t cPages, uint32_t fFlags, PRTR3PTR ppvR3, PRTR0PTR ppvR0, PRTHCPHYS paPages)
2759	{
2760	int rc;
2761	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2762	LogFlow(("SUPR0PageAlloc: pSession=%p cb=%d ppvR3=%p\n", pSession, cPages, ppvR3));
2763
2764	/*
2765	* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2766	*/
2767	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2768	AssertPtrNullReturn(ppvR3, VERR_INVALID_POINTER);
2769	AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
2770	AssertReturn(ppvR3 \|\| ppvR0, VERR_INVALID_PARAMETER);
2771	AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
2772	if (cPages < 1 \|\| cPages > VBOX_MAX_ALLOC_PAGE_COUNT)
2773	{
2774	Log(("SUPR0PageAlloc: Illegal request cb=%u; must be greater than 0 and smaller than %uMB (VBOX_MAX_ALLOC_PAGE_COUNT pages).\n", cPages, VBOX_MAX_ALLOC_PAGE_COUNT * (_1M / _4K)));
2775	return VERR_PAGE_COUNT_OUT_OF_RANGE;
2776	}
2777
2778	/*
2779	* Let IPRT do the work.
2780	*/
2781	if (ppvR0)
2782	rc = RTR0MemObjAllocPage(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, true /* fExecutable */);
2783	else
2784	rc = RTR0MemObjAllocPhysNC(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, NIL_RTHCPHYS);
2785	if (RT_SUCCESS(rc))
2786	{
2787	int rc2;
2788	if (ppvR3)
2789	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2790	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2791	else
2792	Mem.MapObjR3 = NIL_RTR0MEMOBJ;
2793	if (RT_SUCCESS(rc))
2794	{
2795	Mem.eType = MEMREF_TYPE_PAGE;
2796	rc = supdrvMemAdd(&Mem, pSession);
2797	if (!rc)
2798	{
2799	if (ppvR3)
2800	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2801	if (ppvR0)
2802	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2803	if (paPages)
2804	{
2805	uint32_t iPage = cPages;
2806	while (iPage-- > 0)
2807	{
2808	paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MapObjR3, iPage);
2809	Assert(paPages[iPage] != NIL_RTHCPHYS);
2810	}
2811	}
2812	return VINF_SUCCESS;
2813	}
2814
2815	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2816	AssertRC(rc2);
2817	}
2818
2819	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2820	AssertRC(rc2);
2821	}
2822	return rc;
2823	}
2824
2825
2826	/**
2827	* Maps a chunk of memory previously allocated by SUPR0PageAllocEx into kernel
2828	* space.
2829	*
2830	* @returns IPRT status code.
2831	* @param pSession The session to associated the allocation with.
2832	* @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
2833	* @param offSub Where to start mapping. Must be page aligned.
2834	* @param cbSub How much to map. Must be page aligned.
2835	* @param fFlags Flags, MBZ.
2836	* @param ppvR0 Where to return the address of the ring-0 mapping on
2837	* success.
2838	*/
2839	SUPR0DECL(int) SUPR0PageMapKernel(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t offSub, uint32_t cbSub,
2840	uint32_t fFlags, PRTR0PTR ppvR0)
2841	{
2842	int rc;
2843	PSUPDRVBUNDLE pBundle;
2844	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2845	RTR0MEMOBJ hMemObj = NIL_RTR0MEMOBJ;
2846	LogFlow(("SUPR0PageMapKernel: pSession=%p pvR3=%p offSub=%#x cbSub=%#x\n", pSession, pvR3, offSub, cbSub));
2847
2848	/*
2849	* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2850	*/
2851	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2852	AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
2853	AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
2854	AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2855	AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2856	AssertReturn(cbSub, VERR_INVALID_PARAMETER);
2857
2858	/*
2859	* Find the memory object.
2860	*/
2861	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2862	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2863	{
2864	if (pBundle->cUsed > 0)
2865	{
2866	unsigned i;
2867	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2868	{
2869	if ( ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
2870	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2871	&& pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2872	&& RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3)
2873	\|\| ( pBundle->aMem[i].eType == MEMREF_TYPE_LOCKED
2874	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2875	&& pBundle->aMem[i].MapObjR3 == NIL_RTR0MEMOBJ
2876	&& RTR0MemObjAddressR3(pBundle->aMem[i].MemObj) == pvR3))
2877	{
2878	hMemObj = pBundle->aMem[i].MemObj;
2879	break;
2880	}
2881	}
2882	}
2883	}
2884	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2885
2886	rc = VERR_INVALID_PARAMETER;
2887	if (hMemObj != NIL_RTR0MEMOBJ)
2888	{
2889	/*
2890	* Do some further input validations before calling IPRT.
2891	* (Cleanup is done indirectly by telling RTR0MemObjFree to include mappings.)
2892	*/
2893	size_t cbMemObj = RTR0MemObjSize(hMemObj);
2894	if ( offSub < cbMemObj
2895	&& cbSub <= cbMemObj
2896	&& offSub + cbSub <= cbMemObj)
2897	{
2898	RTR0MEMOBJ hMapObj;
2899	rc = RTR0MemObjMapKernelEx(&hMapObj, hMemObj, (void *)-1, 0,
2900	RTMEM_PROT_READ \| RTMEM_PROT_WRITE, offSub, cbSub);
2901	if (RT_SUCCESS(rc))
2902	*ppvR0 = RTR0MemObjAddress(hMapObj);
2903	}
2904	else
2905	SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
2906
2907	}
2908	return rc;
2909	}
2910
2911
2912	/**
2913	* Changes the page level protection of one or more pages previously allocated
2914	* by SUPR0PageAllocEx.
2915	*
2916	* @returns IPRT status code.
2917	* @param pSession The session to associated the allocation with.
2918	* @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
2919	* NIL_RTR3PTR if the ring-3 mapping should be unaffected.
2920	* @param pvR0 The ring-0 address returned by SUPR0PageAllocEx.
2921	* NIL_RTR0PTR if the ring-0 mapping should be unaffected.
2922	* @param offSub Where to start changing. Must be page aligned.
2923	* @param cbSub How much to change. Must be page aligned.
2924	* @param fProt The new page level protection, see RTMEM_PROT_*.
2925	*/
2926	SUPR0DECL(int) SUPR0PageProtect(PSUPDRVSESSION pSession, RTR3PTR pvR3, RTR0PTR pvR0, uint32_t offSub, uint32_t cbSub, uint32_t fProt)
2927	{
2928	int rc;
2929	PSUPDRVBUNDLE pBundle;
2930	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2931	RTR0MEMOBJ hMemObjR0 = NIL_RTR0MEMOBJ;
2932	RTR0MEMOBJ hMemObjR3 = NIL_RTR0MEMOBJ;
2933	LogFlow(("SUPR0PageProtect: pSession=%p pvR3=%p pvR0=%p offSub=%#x cbSub=%#x fProt-%#x\n", pSession, pvR3, pvR0, offSub, cbSub, fProt));
2934
2935	/*
2936	* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2937	*/
2938	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2939	AssertReturn(!(fProt & ~(RTMEM_PROT_READ \| RTMEM_PROT_WRITE \| RTMEM_PROT_EXEC \| RTMEM_PROT_NONE)), VERR_INVALID_PARAMETER);
2940	AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2941	AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2942	AssertReturn(cbSub, VERR_INVALID_PARAMETER);
2943
2944	/*
2945	* Find the memory object.
2946	*/
2947	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2948	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2949	{
2950	if (pBundle->cUsed > 0)
2951	{
2952	unsigned i;
2953	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2954	{
2955	if ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
2956	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2957	&& ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2958	\|\| pvR3 == NIL_RTR3PTR)
2959	&& ( pvR0 == NIL_RTR0PTR
2960	\|\| RTR0MemObjAddress(pBundle->aMem[i].MemObj) == pvR0)
2961	&& ( pvR3 == NIL_RTR3PTR
2962	\|\| RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3))
2963	{
2964	if (pvR0 != NIL_RTR0PTR)
2965	hMemObjR0 = pBundle->aMem[i].MemObj;
2966	if (pvR3 != NIL_RTR3PTR)
2967	hMemObjR3 = pBundle->aMem[i].MapObjR3;
2968	break;
2969	}
2970	}
2971	}
2972	}
2973	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2974
2975	rc = VERR_INVALID_PARAMETER;
2976	if ( hMemObjR0 != NIL_RTR0MEMOBJ
2977	\|\| hMemObjR3 != NIL_RTR0MEMOBJ)
2978	{
2979	/*
2980	* Do some further input validations before calling IPRT.
2981	*/
2982	size_t cbMemObj = hMemObjR0 != NIL_RTR0PTR ? RTR0MemObjSize(hMemObjR0) : RTR0MemObjSize(hMemObjR3);
2983	if ( offSub < cbMemObj
2984	&& cbSub <= cbMemObj
2985	&& offSub + cbSub <= cbMemObj)
2986	{
2987	rc = VINF_SUCCESS;
2988	if (hMemObjR3 != NIL_RTR0PTR)
2989	rc = RTR0MemObjProtect(hMemObjR3, offSub, cbSub, fProt);
2990	if (hMemObjR0 != NIL_RTR0PTR && RT_SUCCESS(rc))
2991	rc = RTR0MemObjProtect(hMemObjR0, offSub, cbSub, fProt);
2992	}
2993	else
2994	SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
2995
2996	}
2997	return rc;
2998
2999	}
3000
3001
3002	/**
3003	* Free memory allocated by SUPR0PageAlloc() and SUPR0PageAllocEx().
3004	*
3005	* @returns IPRT status code.
3006	* @param pSession The session owning the allocation.
3007	* @param pvR3 The Ring-3 address returned by SUPR0PageAlloc() or
3008	* SUPR0PageAllocEx().
3009	*/
3010	SUPR0DECL(int) SUPR0PageFree(PSUPDRVSESSION pSession, RTR3PTR pvR3)
3011	{
3012	LogFlow(("SUPR0PageFree: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
3013	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3014	return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_PAGE);
3015	}
3016
3017
3018	/**
3019	* Gets the paging mode of the current CPU.
3020	*
3021	* @returns Paging mode, SUPPAGEINGMODE_INVALID on error.
3022	*/
3023	SUPR0DECL(SUPPAGINGMODE) SUPR0GetPagingMode(void)
3024	{
3025	SUPPAGINGMODE enmMode;
3026
3027	RTR0UINTREG cr0 = ASMGetCR0();
3028	if ((cr0 & (X86_CR0_PG \| X86_CR0_PE)) != (X86_CR0_PG \| X86_CR0_PE))
3029	enmMode = SUPPAGINGMODE_INVALID;
3030	else
3031	{
3032	RTR0UINTREG cr4 = ASMGetCR4();
3033	uint32_t fNXEPlusLMA = 0;
3034	if (cr4 & X86_CR4_PAE)
3035	{
3036	uint32_t fAmdFeatures = ASMCpuId_EDX(0x80000001);
3037	if (fAmdFeatures & (X86_CPUID_AMD_FEATURE_EDX_NX \| X86_CPUID_AMD_FEATURE_EDX_LONG_MODE))
3038	{
3039	uint64_t efer = ASMRdMsr(MSR_K6_EFER);
3040	if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_NX) && (efer & MSR_K6_EFER_NXE))
3041	fNXEPlusLMA \|= RT_BIT(0);
3042	if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE) && (efer & MSR_K6_EFER_LMA))
3043	fNXEPlusLMA \|= RT_BIT(1);
3044	}
3045	}
3046
3047	switch ((cr4 & (X86_CR4_PAE \| X86_CR4_PGE)) \| fNXEPlusLMA)
3048	{
3049	case 0:
3050	enmMode = SUPPAGINGMODE_32_BIT;
3051	break;
3052
3053	case X86_CR4_PGE:
3054	enmMode = SUPPAGINGMODE_32_BIT_GLOBAL;
3055	break;
3056
3057	case X86_CR4_PAE:
3058	enmMode = SUPPAGINGMODE_PAE;
3059	break;
3060
3061	case X86_CR4_PAE \| RT_BIT(0):
3062	enmMode = SUPPAGINGMODE_PAE_NX;
3063	break;
3064
3065	case X86_CR4_PAE \| X86_CR4_PGE:
3066	enmMode = SUPPAGINGMODE_PAE_GLOBAL;
3067	break;
3068
3069	case X86_CR4_PAE \| X86_CR4_PGE \| RT_BIT(0):
3070	enmMode = SUPPAGINGMODE_PAE_GLOBAL;
3071	break;
3072
3073	case RT_BIT(1) \| X86_CR4_PAE:
3074	enmMode = SUPPAGINGMODE_AMD64;
3075	break;
3076
3077	case RT_BIT(1) \| X86_CR4_PAE \| RT_BIT(0):
3078	enmMode = SUPPAGINGMODE_AMD64_NX;
3079	break;
3080
3081	case RT_BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE:
3082	enmMode = SUPPAGINGMODE_AMD64_GLOBAL;
3083	break;
3084
3085	case RT_BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE \| RT_BIT(0):
3086	enmMode = SUPPAGINGMODE_AMD64_GLOBAL_NX;
3087	break;
3088
3089	default:
3090	AssertMsgFailed(("Cannot happen! cr4=%#x fNXEPlusLMA=%d\n", cr4, fNXEPlusLMA));
3091	enmMode = SUPPAGINGMODE_INVALID;
3092	break;
3093	}
3094	}
3095	return enmMode;
3096	}
3097
3098
3099	/**
3100	* Enables or disabled hardware virtualization extensions using native OS APIs.
3101	*
3102	* @returns VBox status code.
3103	* @retval VINF_SUCCESS on success.
3104	* @retval VERR_NOT_SUPPORTED if not supported by the native OS.
3105	*
3106	* @param fEnable Whether to enable or disable.
3107	*/
3108	SUPR0DECL(int) SUPR0EnableVTx(bool fEnable)
3109	{
3110	#ifdef RT_OS_DARWIN
3111	return supdrvOSEnableVTx(fEnable);
3112	#else
3113	return VERR_NOT_SUPPORTED;
3114	#endif
3115	}
3116
3117
3118	/** @todo document me */
3119	SUPR0DECL(int) SUPR0QueryVTCaps(PSUPDRVSESSION pSession, uint32_t *pfCaps)
3120	{
3121	/*
3122	* Input validation.
3123	*/
3124	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3125	AssertPtrReturn(pfCaps, VERR_INVALID_POINTER);
3126
3127	*pfCaps = 0;
3128
3129	if (ASMHasCpuId())
3130	{
3131	uint32_t u32FeaturesECX;
3132	uint32_t u32Dummy;
3133	uint32_t u32FeaturesEDX;
3134	uint32_t u32VendorEBX, u32VendorECX, u32VendorEDX, u32AMDFeatureEDX, u32AMDFeatureECX;
3135	uint64_t val;
3136
3137	ASMCpuId(0, &u32Dummy, &u32VendorEBX, &u32VendorECX, &u32VendorEDX);
3138	ASMCpuId(1, &u32Dummy, &u32Dummy, &u32FeaturesECX, &u32FeaturesEDX);
3139	/* Query AMD features. */
3140	ASMCpuId(0x80000001, &u32Dummy, &u32Dummy, &u32AMDFeatureECX, &u32AMDFeatureEDX);
3141
3142	if ( u32VendorEBX == X86_CPUID_VENDOR_INTEL_EBX
3143	&& u32VendorECX == X86_CPUID_VENDOR_INTEL_ECX
3144	&& u32VendorEDX == X86_CPUID_VENDOR_INTEL_EDX
3145	)
3146	{
3147	if ( (u32FeaturesECX & X86_CPUID_FEATURE_ECX_VMX)
3148	&& (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_MSR)
3149	&& (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_FXSR)
3150	)
3151	{
3152	val = ASMRdMsr(MSR_IA32_FEATURE_CONTROL);
3153	/*
3154	* Both the LOCK and VMXON bit must be set; otherwise VMXON will generate a #GP.
3155	* Once the lock bit is set, this MSR can no longer be modified.
3156	*/
3157	if ( (val & (MSR_IA32_FEATURE_CONTROL_VMXON\|MSR_IA32_FEATURE_CONTROL_LOCK))
3158	== (MSR_IA32_FEATURE_CONTROL_VMXON\|MSR_IA32_FEATURE_CONTROL_LOCK) /* enabled and locked */
3159	\|\| !(val & MSR_IA32_FEATURE_CONTROL_LOCK) /* not enabled, but not locked either */
3160	)
3161	{
3162	VMX_CAPABILITY vtCaps;
3163
3164	*pfCaps \|= SUPVTCAPS_VT_X;
3165
3166	vtCaps.u = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS);
3167	if (vtCaps.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
3168	{
3169	vtCaps.u = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS2);
3170	if (vtCaps.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_EPT)
3171	*pfCaps \|= SUPVTCAPS_NESTED_PAGING;
3172	}
3173	return VINF_SUCCESS;
3174	}
3175	return VERR_VMX_MSR_LOCKED_OR_DISABLED;
3176	}
3177	return VERR_VMX_NO_VMX;
3178	}
3179
3180	if ( u32VendorEBX == X86_CPUID_VENDOR_AMD_EBX
3181	&& u32VendorECX == X86_CPUID_VENDOR_AMD_ECX
3182	&& u32VendorEDX == X86_CPUID_VENDOR_AMD_EDX
3183	)
3184	{
3185	if ( (u32AMDFeatureECX & X86_CPUID_AMD_FEATURE_ECX_SVM)
3186	&& (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_MSR)
3187	&& (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_FXSR)
3188	)
3189	{
3190	/* Check if SVM is disabled */
3191	val = ASMRdMsr(MSR_K8_VM_CR);
3192	if (!(val & MSR_K8_VM_CR_SVM_DISABLE))
3193	{
3194	*pfCaps \|= SUPVTCAPS_AMD_V;
3195
3196	/* Query AMD features. */
3197	ASMCpuId(0x8000000A, &u32Dummy, &u32Dummy, &u32Dummy, &u32FeaturesEDX);
3198
3199	if (u32FeaturesEDX & AMD_CPUID_SVM_FEATURE_EDX_NESTED_PAGING)
3200	*pfCaps \|= SUPVTCAPS_NESTED_PAGING;
3201
3202	return VINF_SUCCESS;
3203	}
3204	return VERR_SVM_DISABLED;
3205	}
3206	return VERR_SVM_NO_SVM;
3207	}
3208	}
3209
3210	return VERR_UNSUPPORTED_CPU;
3211	}
3212
3213
3214	/**
3215	* (Re-)initializes the per-cpu structure prior to starting or resuming the GIP
3216	* updating.
3217	*
3218	* @param pGipCpu The per CPU structure for this CPU.
3219	* @param u64NanoTS The current time.
3220	*/
3221	static void supdrvGipReInitCpu(PSUPGIPCPU pGipCpu, uint64_t u64NanoTS)
3222	{
3223	pGipCpu->u64TSC = ASMReadTSC() - pGipCpu->u32UpdateIntervalTSC;
3224	pGipCpu->u64NanoTS = u64NanoTS;
3225	}
3226
3227
3228	/**
3229	* Set the current TSC and NanoTS value for the CPU.
3230	*
3231	* @param idCpu The CPU ID. Unused - we have to use the APIC ID.
3232	* @param pvUser1 Pointer to the ring-0 GIP mapping.
3233	* @param pvUser2 Pointer to the variable holding the current time.
3234	*/
3235	static DECLCALLBACK(void) supdrvGipReInitCpuCallback(RTCPUID idCpu, void pvUser1, void pvUser2)
3236	{
3237	PSUPGLOBALINFOPAGE pGip = (PSUPGLOBALINFOPAGE)pvUser1;
3238	unsigned iCpu = pGip->aiCpuFromApicId[ASMGetApicId()];
3239
3240	if (RT_LIKELY(iCpu < pGip->cCpus && pGip->aCPUs[iCpu].idCpu == idCpu))
3241	supdrvGipReInitCpu(&pGip->aCPUs[iCpu], (uint64_t )pvUser2);
3242
3243	NOREF(pvUser2);
3244	NOREF(idCpu);
3245	}
3246
3247
3248	/**
3249	* Maps the GIP into userspace and/or get the physical address of the GIP.
3250	*
3251	* @returns IPRT status code.
3252	* @param pSession Session to which the GIP mapping should belong.
3253	* @param ppGipR3 Where to store the address of the ring-3 mapping. (optional)
3254	* @param pHCPhysGip Where to store the physical address. (optional)
3255	*
3256	* @remark There is no reference counting on the mapping, so one call to this function
3257	* count globally as one reference. One call to SUPR0GipUnmap() is will unmap GIP
3258	* and remove the session as a GIP user.
3259	*/
3260	SUPR0DECL(int) SUPR0GipMap(PSUPDRVSESSION pSession, PRTR3PTR ppGipR3, PRTHCPHYS pHCPhysGip)
3261	{
3262	int rc;
3263	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
3264	RTR3PTR pGipR3 = NIL_RTR3PTR;
3265	RTHCPHYS HCPhys = NIL_RTHCPHYS;
3266	LogFlow(("SUPR0GipMap: pSession=%p ppGipR3=%p pHCPhysGip=%p\n", pSession, ppGipR3, pHCPhysGip));
3267
3268	/*
3269	* Validate
3270	*/
3271	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3272	AssertPtrNullReturn(ppGipR3, VERR_INVALID_POINTER);
3273	AssertPtrNullReturn(pHCPhysGip, VERR_INVALID_POINTER);
3274
3275	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3276	RTSemMutexRequest(pDevExt->mtxGip, RT_INDEFINITE_WAIT);
3277	#else
3278	RTSemFastMutexRequest(pDevExt->mtxGip);
3279	#endif
3280	if (pDevExt->pGip)
3281	{
3282	/*
3283	* Map it?
3284	*/
3285	rc = VINF_SUCCESS;
3286	if (ppGipR3)
3287	{
3288	if (pSession->GipMapObjR3 == NIL_RTR0MEMOBJ)
3289	rc = RTR0MemObjMapUser(&pSession->GipMapObjR3, pDevExt->GipMemObj, (RTR3PTR)-1, 0,
3290	RTMEM_PROT_READ, RTR0ProcHandleSelf());
3291	if (RT_SUCCESS(rc))
3292	pGipR3 = RTR0MemObjAddressR3(pSession->GipMapObjR3);
3293	}
3294
3295	/*
3296	* Get physical address.
3297	*/
3298	if (pHCPhysGip && RT_SUCCESS(rc))
3299	HCPhys = pDevExt->HCPhysGip;
3300
3301	/*
3302	* Reference globally.
3303	*/
3304	if (!pSession->fGipReferenced && RT_SUCCESS(rc))
3305	{
3306	pSession->fGipReferenced = 1;
3307	pDevExt->cGipUsers++;
3308	if (pDevExt->cGipUsers == 1)
3309	{
3310	PSUPGLOBALINFOPAGE pGipR0 = pDevExt->pGip;
3311	uint64_t u64NanoTS;
3312	uint32_t u32SystemResolution;
3313	unsigned i;
3314
3315	LogFlow(("SUPR0GipMap: Resumes GIP updating\n"));
3316
3317	/*
3318	* Try bump up the system timer resolution.
3319	* The more interrupts the better...
3320	*/
3321	if ( RT_SUCCESS_NP(RTTimerRequestSystemGranularity( 976563 /* 1024 HZ */, &u32SystemResolution))
3322	\|\| RT_SUCCESS_NP(RTTimerRequestSystemGranularity( 1000000 /* 1000 HZ */, &u32SystemResolution))
3323	\|\| RT_SUCCESS_NP(RTTimerRequestSystemGranularity( 1953125 /* 512 HZ */, &u32SystemResolution))
3324	\|\| RT_SUCCESS_NP(RTTimerRequestSystemGranularity( 2000000 /* 500 HZ */, &u32SystemResolution))
3325	)
3326	{
3327	Assert(RTTimerGetSystemGranularity() <= u32SystemResolution);
3328	pDevExt->u32SystemTimerGranularityGrant = u32SystemResolution;
3329	}
3330
3331	if (pGipR0->aCPUs[0].u32TransactionId != 2 /* not the first time */)
3332	{
3333	for (i = 0; i < RT_ELEMENTS(pGipR0->aCPUs); i++)
3334	ASMAtomicUoWriteU32(&pGipR0->aCPUs[i].u32TransactionId,
3335	(pGipR0->aCPUs[i].u32TransactionId + GIP_UPDATEHZ_RECALC_FREQ * 2)
3336	& ~(GIP_UPDATEHZ_RECALC_FREQ * 2 - 1));
3337	ASMAtomicWriteU64(&pGipR0->u64NanoTSLastUpdateHz, 0);
3338	}
3339
3340	u64NanoTS = RTTimeSystemNanoTS() - pGipR0->u32UpdateIntervalNS;
3341	if ( pGipR0->u32Mode == SUPGIPMODE_SYNC_TSC
3342	\|\| RTMpGetOnlineCount() == 1)
3343	supdrvGipReInitCpu(&pGipR0->aCPUs[0], u64NanoTS);
3344	else
3345	RTMpOnAll(supdrvGipReInitCpuCallback, pGipR0, &u64NanoTS);
3346
3347	#ifndef DO_NOT_START_GIP
3348	rc = RTTimerStart(pDevExt->pGipTimer, 0); AssertRC(rc);
3349	#endif
3350	rc = VINF_SUCCESS;
3351	}
3352	}
3353	}
3354	else
3355	{
3356	rc = VERR_GENERAL_FAILURE;
3357	Log(("SUPR0GipMap: GIP is not available!\n"));
3358	}
3359	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3360	RTSemMutexRelease(pDevExt->mtxGip);
3361	#else
3362	RTSemFastMutexRelease(pDevExt->mtxGip);
3363	#endif
3364
3365	/*
3366	* Write returns.
3367	*/
3368	if (pHCPhysGip)
3369	*pHCPhysGip = HCPhys;
3370	if (ppGipR3)
3371	*ppGipR3 = pGipR3;
3372
3373	#ifdef DEBUG_DARWIN_GIP
3374	OSDBGPRINT(("SUPR0GipMap: returns %d pHCPhysGip=%lx pGipR3=%p\n", rc, (unsigned long)HCPhys, (void )pGipR3));
3375	#else
3376	LogFlow(( "SUPR0GipMap: returns %d pHCPhysGip=%lx pGipR3=%p\n", rc, (unsigned long)HCPhys, (void )pGipR3));
3377	#endif
3378	return rc;
3379	}
3380
3381
3382	/**
3383	* Unmaps any user mapping of the GIP and terminates all GIP access
3384	* from this session.
3385	*
3386	* @returns IPRT status code.
3387	* @param pSession Session to which the GIP mapping should belong.
3388	*/
3389	SUPR0DECL(int) SUPR0GipUnmap(PSUPDRVSESSION pSession)
3390	{
3391	int rc = VINF_SUCCESS;
3392	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
3393	#ifdef DEBUG_DARWIN_GIP
3394	OSDBGPRINT(("SUPR0GipUnmap: pSession=%p pGip=%p GipMapObjR3=%p\n",
3395	pSession,
3396	pSession->GipMapObjR3 != NIL_RTR0MEMOBJ ? RTR0MemObjAddress(pSession->GipMapObjR3) : NULL,
3397	pSession->GipMapObjR3));
3398	#else
3399	LogFlow(("SUPR0GipUnmap: pSession=%p\n", pSession));
3400	#endif
3401	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3402
3403	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3404	RTSemMutexRequest(pDevExt->mtxGip, RT_INDEFINITE_WAIT);
3405	#else
3406	RTSemFastMutexRequest(pDevExt->mtxGip);
3407	#endif
3408
3409	/*
3410	* Unmap anything?
3411	*/
3412	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
3413	{
3414	rc = RTR0MemObjFree(pSession->GipMapObjR3, false);
3415	AssertRC(rc);
3416	if (RT_SUCCESS(rc))
3417	pSession->GipMapObjR3 = NIL_RTR0MEMOBJ;
3418	}
3419
3420	/*
3421	* Dereference global GIP.
3422	*/
3423	if (pSession->fGipReferenced && !rc)
3424	{
3425	pSession->fGipReferenced = 0;
3426	if ( pDevExt->cGipUsers > 0
3427	&& !--pDevExt->cGipUsers)
3428	{
3429	LogFlow(("SUPR0GipUnmap: Suspends GIP updating\n"));
3430	#ifndef DO_NOT_START_GIP
3431	rc = RTTimerStop(pDevExt->pGipTimer); AssertRC(rc); rc = VINF_SUCCESS;
3432	#endif
3433
3434	if (pDevExt->u32SystemTimerGranularityGrant)
3435	{
3436	int rc2 = RTTimerReleaseSystemGranularity(pDevExt->u32SystemTimerGranularityGrant);
3437	AssertRC(rc2);
3438	pDevExt->u32SystemTimerGranularityGrant = 0;
3439	}
3440	}
3441	}
3442
3443	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3444	RTSemMutexRelease(pDevExt->mtxGip);
3445	#else
3446	RTSemFastMutexRelease(pDevExt->mtxGip);
3447	#endif
3448
3449	return rc;
3450	}
3451
3452
3453	/**
3454	* Gets the GIP pointer.
3455	*
3456	* @returns Pointer to the GIP or NULL.
3457	*/
3458	SUPDECL(PSUPGLOBALINFOPAGE) SUPGetGIP(void)
3459	{
3460	return g_pSUPGlobalInfoPage;
3461	}
3462
3463
3464	/**
3465	* Register a component factory with the support driver.
3466	*
3467	* This is currently restricted to kernel sessions only.
3468	*
3469	* @returns VBox status code.
3470	* @retval VINF_SUCCESS on success.
3471	* @retval VERR_NO_MEMORY if we're out of memory.
3472	* @retval VERR_ALREADY_EXISTS if the factory has already been registered.
3473	* @retval VERR_ACCESS_DENIED if it isn't a kernel session.
3474	* @retval VERR_INVALID_PARAMETER on invalid parameter.
3475	* @retval VERR_INVALID_POINTER on invalid pointer parameter.
3476	*
3477	* @param pSession The SUPDRV session (must be a ring-0 session).
3478	* @param pFactory Pointer to the component factory registration structure.
3479	*
3480	* @remarks This interface is also available via SUPR0IdcComponentRegisterFactory.
3481	*/
3482	SUPR0DECL(int) SUPR0ComponentRegisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
3483	{
3484	PSUPDRVFACTORYREG pNewReg;
3485	const char *psz;
3486	int rc;
3487
3488	/*
3489	* Validate parameters.
3490	*/
3491	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3492	AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
3493	AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
3494	AssertPtrReturn(pFactory->pfnQueryFactoryInterface, VERR_INVALID_POINTER);
3495	psz = RTStrEnd(pFactory->szName, sizeof(pFactory->szName));
3496	AssertReturn(psz, VERR_INVALID_PARAMETER);
3497
3498	/*
3499	* Allocate and initialize a new registration structure.
3500	*/
3501	pNewReg = (PSUPDRVFACTORYREG)RTMemAlloc(sizeof(SUPDRVFACTORYREG));
3502	if (pNewReg)
3503	{
3504	pNewReg->pNext = NULL;
3505	pNewReg->pFactory = pFactory;
3506	pNewReg->pSession = pSession;
3507	pNewReg->cchName = psz - &pFactory->szName[0];
3508
3509	/*
3510	* Add it to the tail of the list after checking for prior registration.
3511	*/
3512	rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3513	if (RT_SUCCESS(rc))
3514	{
3515	PSUPDRVFACTORYREG pPrev = NULL;
3516	PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3517	while (pCur && pCur->pFactory != pFactory)
3518	{
3519	pPrev = pCur;
3520	pCur = pCur->pNext;
3521	}
3522	if (!pCur)
3523	{
3524	if (pPrev)
3525	pPrev->pNext = pNewReg;
3526	else
3527	pSession->pDevExt->pComponentFactoryHead = pNewReg;
3528	rc = VINF_SUCCESS;
3529	}
3530	else
3531	rc = VERR_ALREADY_EXISTS;
3532
3533	RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3534	}
3535
3536	if (RT_FAILURE(rc))
3537	RTMemFree(pNewReg);
3538	}
3539	else
3540	rc = VERR_NO_MEMORY;
3541	return rc;
3542	}
3543
3544
3545	/**
3546	* Deregister a component factory.
3547	*
3548	* @returns VBox status code.
3549	* @retval VINF_SUCCESS on success.
3550	* @retval VERR_NOT_FOUND if the factory wasn't registered.
3551	* @retval VERR_ACCESS_DENIED if it isn't a kernel session.
3552	* @retval VERR_INVALID_PARAMETER on invalid parameter.
3553	* @retval VERR_INVALID_POINTER on invalid pointer parameter.
3554	*
3555	* @param pSession The SUPDRV session (must be a ring-0 session).
3556	* @param pFactory Pointer to the component factory registration structure
3557	* previously passed SUPR0ComponentRegisterFactory().
3558	*
3559	* @remarks This interface is also available via SUPR0IdcComponentDeregisterFactory.
3560	*/
3561	SUPR0DECL(int) SUPR0ComponentDeregisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
3562	{
3563	int rc;
3564
3565	/*
3566	* Validate parameters.
3567	*/
3568	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3569	AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
3570	AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
3571
3572	/*
3573	* Take the lock and look for the registration record.
3574	*/
3575	rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3576	if (RT_SUCCESS(rc))
3577	{
3578	PSUPDRVFACTORYREG pPrev = NULL;
3579	PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3580	while (pCur && pCur->pFactory != pFactory)
3581	{
3582	pPrev = pCur;
3583	pCur = pCur->pNext;
3584	}
3585	if (pCur)
3586	{
3587	if (!pPrev)
3588	pSession->pDevExt->pComponentFactoryHead = pCur->pNext;
3589	else
3590	pPrev->pNext = pCur->pNext;
3591
3592	pCur->pNext = NULL;
3593	pCur->pFactory = NULL;
3594	pCur->pSession = NULL;
3595	rc = VINF_SUCCESS;
3596	}
3597	else
3598	rc = VERR_NOT_FOUND;
3599
3600	RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3601
3602	RTMemFree(pCur);
3603	}
3604	return rc;
3605	}
3606
3607
3608	/**
3609	* Queries a component factory.
3610	*
3611	* @returns VBox status code.
3612	* @retval VERR_INVALID_PARAMETER on invalid parameter.
3613	* @retval VERR_INVALID_POINTER on invalid pointer parameter.
3614	* @retval VERR_SUPDRV_COMPONENT_NOT_FOUND if the component factory wasn't found.
3615	* @retval VERR_SUPDRV_INTERFACE_NOT_SUPPORTED if the interface wasn't supported.
3616	*
3617	* @param pSession The SUPDRV session.
3618	* @param pszName The name of the component factory.
3619	* @param pszInterfaceUuid The UUID of the factory interface (stringified).
3620	* @param ppvFactoryIf Where to store the factory interface.
3621	*/
3622	SUPR0DECL(int) SUPR0ComponentQueryFactory(PSUPDRVSESSION pSession, const char pszName, const char pszInterfaceUuid, void **ppvFactoryIf)
3623	{
3624	const char *pszEnd;
3625	size_t cchName;
3626	int rc;
3627
3628	/*
3629	* Validate parameters.
3630	*/
3631	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3632
3633	AssertPtrReturn(pszName, VERR_INVALID_POINTER);
3634	pszEnd = RTStrEnd(pszName, RT_SIZEOFMEMB(SUPDRVFACTORY, szName));
3635	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
3636	cchName = pszEnd - pszName;
3637
3638	AssertPtrReturn(pszInterfaceUuid, VERR_INVALID_POINTER);
3639	pszEnd = RTStrEnd(pszInterfaceUuid, RTUUID_STR_LENGTH);
3640	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
3641
3642	AssertPtrReturn(ppvFactoryIf, VERR_INVALID_POINTER);
3643	*ppvFactoryIf = NULL;
3644
3645	/*
3646	* Take the lock and try all factories by this name.
3647	*/
3648	rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3649	if (RT_SUCCESS(rc))
3650	{
3651	PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3652	rc = VERR_SUPDRV_COMPONENT_NOT_FOUND;
3653	while (pCur)
3654	{
3655	if ( pCur->cchName == cchName
3656	&& !memcmp(pCur->pFactory->szName, pszName, cchName))
3657	{
3658	void *pvFactory = pCur->pFactory->pfnQueryFactoryInterface(pCur->pFactory, pSession, pszInterfaceUuid);
3659	if (pvFactory)
3660	{
3661	*ppvFactoryIf = pvFactory;
3662	rc = VINF_SUCCESS;
3663	break;
3664	}
3665	rc = VERR_SUPDRV_INTERFACE_NOT_SUPPORTED;
3666	}
3667
3668	/* next */
3669	pCur = pCur->pNext;
3670	}
3671
3672	RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3673	}
3674	return rc;
3675	}
3676
3677
3678	/**
3679	* Adds a memory object to the session.
3680	*
3681	* @returns IPRT status code.
3682	* @param pMem Memory tracking structure containing the
3683	* information to track.
3684	* @param pSession The session.
3685	*/
3686	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession)
3687	{
3688	PSUPDRVBUNDLE pBundle;
3689	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3690
3691	/*
3692	* Find free entry and record the allocation.
3693	*/
3694	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3695	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3696	{
3697	if (pBundle->cUsed < RT_ELEMENTS(pBundle->aMem))
3698	{
3699	unsigned i;
3700	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3701	{
3702	if (pBundle->aMem[i].MemObj == NIL_RTR0MEMOBJ)
3703	{
3704	pBundle->cUsed++;
3705	pBundle->aMem[i] = *pMem;
3706	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3707	return VINF_SUCCESS;
3708	}
3709	}
3710	AssertFailed(); /* !!this can't be happening!!! */
3711	}
3712	}
3713	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3714
3715	/*
3716	* Need to allocate a new bundle.
3717	* Insert into the last entry in the bundle.
3718	*/
3719	pBundle = (PSUPDRVBUNDLE)RTMemAllocZ(sizeof(*pBundle));
3720	if (!pBundle)
3721	return VERR_NO_MEMORY;
3722
3723	/* take last entry. */
3724	pBundle->cUsed++;
3725	pBundle->aMem[RT_ELEMENTS(pBundle->aMem) - 1] = *pMem;
3726
3727	/* insert into list. */
3728	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3729	pBundle->pNext = pSession->Bundle.pNext;
3730	pSession->Bundle.pNext = pBundle;
3731	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3732
3733	return VINF_SUCCESS;
3734	}
3735
3736
3737	/**
3738	* Releases a memory object referenced by pointer and type.
3739	*
3740	* @returns IPRT status code.
3741	* @param pSession Session data.
3742	* @param uPtr Pointer to memory. This is matched against both the R0 and R3 addresses.
3743	* @param eType Memory type.
3744	*/
3745	static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType)
3746	{
3747	PSUPDRVBUNDLE pBundle;
3748	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3749
3750	/*
3751	* Validate input.
3752	*/
3753	if (!uPtr)
3754	{
3755	Log(("Illegal address %p\n", (void *)uPtr));
3756	return VERR_INVALID_PARAMETER;
3757	}
3758
3759	/*
3760	* Search for the address.
3761	*/
3762	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3763	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3764	{
3765	if (pBundle->cUsed > 0)
3766	{
3767	unsigned i;
3768	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3769	{
3770	if ( pBundle->aMem[i].eType == eType
3771	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3772	&& ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
3773	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
3774	&& RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr))
3775	)
3776	{
3777	/* Make a copy of it and release it outside the spinlock. */
3778	SUPDRVMEMREF Mem = pBundle->aMem[i];
3779	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
3780	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
3781	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
3782	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3783
3784	if (Mem.MapObjR3 != NIL_RTR0MEMOBJ)
3785	{
3786	int rc = RTR0MemObjFree(Mem.MapObjR3, false);
3787	AssertRC(rc); /** @todo figure out how to handle this. */
3788	}
3789	if (Mem.MemObj != NIL_RTR0MEMOBJ)
3790	{
3791	int rc = RTR0MemObjFree(Mem.MemObj, true /* fFreeMappings */);
3792	AssertRC(rc); /** @todo figure out how to handle this. */
3793	}
3794	return VINF_SUCCESS;
3795	}
3796	}
3797	}
3798	}
3799	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3800	Log(("Failed to find %p!!! (eType=%d)\n", (void *)uPtr, eType));
3801	return VERR_INVALID_PARAMETER;
3802	}
3803
3804
3805	/**
3806	* Opens an image. If it's the first time it's opened the call must upload
3807	* the bits using the supdrvIOCtl_LdrLoad() / SUPDRV_IOCTL_LDR_LOAD function.
3808	*
3809	* This is the 1st step of the loading.
3810	*
3811	* @returns IPRT status code.
3812	* @param pDevExt Device globals.
3813	* @param pSession Session data.
3814	* @param pReq The open request.
3815	*/
3816	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq)
3817	{
3818	int rc;
3819	PSUPDRVLDRIMAGE pImage;
3820	void *pv;
3821	size_t cchName = strlen(pReq->u.In.szName); /* (caller checked < 32). */
3822	LogFlow(("supdrvIOCtl_LdrOpen: szName=%s cbImageWithTabs=%d\n", pReq->u.In.szName, pReq->u.In.cbImageWithTabs));
3823
3824	/*
3825	* Check if we got an instance of the image already.
3826	*/
3827	supdrvLdrLock(pDevExt);
3828	for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
3829	{
3830	if ( pImage->szName[cchName] == '\0'
3831	&& !memcmp(pImage->szName, pReq->u.In.szName, cchName))
3832	{
3833	/** @todo check cbImageBits and cbImageWithTabs here, if they differs that indicates that the images are different. */
3834	pImage->cUsage++;
3835	pReq->u.Out.pvImageBase = pImage->pvImage;
3836	pReq->u.Out.fNeedsLoading = pImage->uState == SUP_IOCTL_LDR_OPEN;
3837	pReq->u.Out.fNativeLoader = pImage->fNative;
3838	supdrvLdrAddUsage(pSession, pImage);
3839	supdrvLdrUnlock(pDevExt);
3840	return VINF_SUCCESS;
3841	}
3842	}
3843	/* (not found - add it!) */
3844
3845	/*
3846	* Allocate memory.
3847	*/
3848	pv = RTMemAlloc(RT_OFFSETOF(SUPDRVLDRIMAGE, szName[cchName + 1]));
3849	if (!pv)
3850	{
3851	supdrvLdrUnlock(pDevExt);
3852	Log(("supdrvIOCtl_LdrOpen: RTMemAlloc() failed\n"));
3853	return /VERR_NO_MEMORY/ VERR_INTERNAL_ERROR_2;
3854	}
3855
3856	/*
3857	* Setup and link in the LDR stuff.
3858	*/
3859	pImage = (PSUPDRVLDRIMAGE)pv;
3860	pImage->pvImage = NULL;
3861	pImage->pvImageAlloc = NULL;
3862	pImage->cbImageWithTabs = pReq->u.In.cbImageWithTabs;
3863	pImage->cbImageBits = pReq->u.In.cbImageBits;
3864	pImage->cSymbols = 0;
3865	pImage->paSymbols = NULL;
3866	pImage->pachStrTab = NULL;
3867	pImage->cbStrTab = 0;
3868	pImage->pfnModuleInit = NULL;
3869	pImage->pfnModuleTerm = NULL;
3870	pImage->pfnServiceReqHandler = NULL;
3871	pImage->uState = SUP_IOCTL_LDR_OPEN;
3872	pImage->cUsage = 1;
3873	pImage->pDevExt = pDevExt;
3874	memcpy(pImage->szName, pReq->u.In.szName, cchName + 1);
3875
3876	/*
3877	* Try load it using the native loader, if that isn't supported, fall back
3878	* on the older method.
3879	*/
3880	pImage->fNative = true;
3881	rc = supdrvOSLdrOpen(pDevExt, pImage, pReq->u.In.szFilename);
3882	if (rc == VERR_NOT_SUPPORTED)
3883	{
3884	pImage->pvImageAlloc = RTMemExecAlloc(pImage->cbImageBits + 31);
3885	pImage->pvImage = RT_ALIGN_P(pImage->pvImageAlloc, 32);
3886	pImage->fNative = false;
3887	rc = pImage->pvImageAlloc ? VINF_SUCCESS : VERR_NO_EXEC_MEMORY;
3888	}
3889	if (RT_FAILURE(rc))
3890	{
3891	supdrvLdrUnlock(pDevExt);
3892	RTMemFree(pImage);
3893	Log(("supdrvIOCtl_LdrOpen(%s): failed - %Rrc\n", pReq->u.In.szName, rc));
3894	return rc;
3895	}
3896	Assert(VALID_PTR(pImage->pvImage) \|\| RT_FAILURE(rc));
3897
3898	/*
3899	* Link it.
3900	*/
3901	pImage->pNext = pDevExt->pLdrImages;
3902	pDevExt->pLdrImages = pImage;
3903
3904	supdrvLdrAddUsage(pSession, pImage);
3905
3906	pReq->u.Out.pvImageBase = pImage->pvImage;
3907	pReq->u.Out.fNeedsLoading = true;
3908	pReq->u.Out.fNativeLoader = pImage->fNative;
3909	supdrvLdrUnlock(pDevExt);
3910
3911	#if defined(RT_OS_WINDOWS) && defined(DEBUG)
3912	SUPR0Printf("VBoxDrv: windbg> .reload /f %s=%#p\n", pImage->szName, pImage->pvImage);
3913	#endif
3914	return VINF_SUCCESS;
3915	}
3916
3917
3918	/**
3919	* Worker that validates a pointer to an image entrypoint.
3920	*
3921	* @returns IPRT status code.
3922	* @param pDevExt The device globals.
3923	* @param pImage The loader image.
3924	* @param pv The pointer into the image.
3925	* @param fMayBeNull Whether it may be NULL.
3926	* @param pszWhat What is this entrypoint? (for logging)
3927	* @param pbImageBits The image bits prepared by ring-3.
3928	*
3929	* @remarks Will leave the lock on failure.
3930	*/
3931	static int supdrvLdrValidatePointer(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage, void *pv,
3932	bool fMayBeNull, const uint8_t pbImageBits, const char pszWhat)
3933	{
3934	if (!fMayBeNull \|\| pv)
3935	{
3936	if ((uintptr_t)pv - (uintptr_t)pImage->pvImage >= pImage->cbImageBits)
3937	{
3938	supdrvLdrUnlock(pDevExt);
3939	Log(("Out of range (%p LB %#x): %s=%p\n", pImage->pvImage, pImage->cbImageBits, pszWhat, pv));
3940	return VERR_INVALID_PARAMETER;
3941	}
3942
3943	if (pImage->fNative)
3944	{
3945	int rc = supdrvOSLdrValidatePointer(pDevExt, pImage, pv, pbImageBits);
3946	if (RT_FAILURE(rc))
3947	{
3948	supdrvLdrUnlock(pDevExt);
3949	Log(("Bad entry point address: %s=%p (rc=%Rrc)\n", pszWhat, pv, rc));
3950	return rc;
3951	}
3952	}
3953	}
3954	return VINF_SUCCESS;
3955	}
3956
3957
3958	/**
3959	* Loads the image bits.
3960	*
3961	* This is the 2nd step of the loading.
3962	*
3963	* @returns IPRT status code.
3964	* @param pDevExt Device globals.
3965	* @param pSession Session data.
3966	* @param pReq The request.
3967	*/
3968	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq)
3969	{
3970	PSUPDRVLDRUSAGE pUsage;
3971	PSUPDRVLDRIMAGE pImage;
3972	int rc;
3973	LogFlow(("supdrvIOCtl_LdrLoad: pvImageBase=%p cbImageWithBits=%d\n", pReq->u.In.pvImageBase, pReq->u.In.cbImageWithTabs));
3974
3975	/*
3976	* Find the ldr image.
3977	*/
3978	supdrvLdrLock(pDevExt);
3979	pUsage = pSession->pLdrUsage;
3980	while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
3981	pUsage = pUsage->pNext;
3982	if (!pUsage)
3983	{
3984	supdrvLdrUnlock(pDevExt);
3985	Log(("SUP_IOCTL_LDR_LOAD: couldn't find image!\n"));
3986	return VERR_INVALID_HANDLE;
3987	}
3988	pImage = pUsage->pImage;
3989
3990	/*
3991	* Validate input.
3992	*/
3993	if ( pImage->cbImageWithTabs != pReq->u.In.cbImageWithTabs
3994	\|\| pImage->cbImageBits != pReq->u.In.cbImageBits)
3995	{
3996	supdrvLdrUnlock(pDevExt);
3997	Log(("SUP_IOCTL_LDR_LOAD: image size mismatch!! %d(prep) != %d(load) or %d != %d\n",
3998	pImage->cbImageWithTabs, pReq->u.In.cbImageWithTabs, pImage->cbImageBits, pReq->u.In.cbImageBits));
3999	return VERR_INVALID_HANDLE;
4000	}
4001
4002	if (pImage->uState != SUP_IOCTL_LDR_OPEN)
4003	{
4004	unsigned uState = pImage->uState;
4005	supdrvLdrUnlock(pDevExt);
4006	if (uState != SUP_IOCTL_LDR_LOAD)
4007	AssertMsgFailed(("SUP_IOCTL_LDR_LOAD: invalid image state %d (%#x)!\n", uState, uState));
4008	return VERR_ALREADY_LOADED;
4009	}
4010
4011	switch (pReq->u.In.eEPType)
4012	{
4013	case SUPLDRLOADEP_NOTHING:
4014	break;
4015
4016	case SUPLDRLOADEP_VMMR0:
4017	rc = supdrvLdrValidatePointer( pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0, false, pReq->u.In.abImage, "pvVMMR0");
4018	if (RT_SUCCESS(rc))
4019	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt, false, pReq->u.In.abImage, "pvVMMR0EntryInt");
4020	if (RT_SUCCESS(rc))
4021	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, false, pReq->u.In.abImage, "pvVMMR0EntryFast");
4022	if (RT_SUCCESS(rc))
4023	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx, false, pReq->u.In.abImage, "pvVMMR0EntryEx");
4024	if (RT_FAILURE(rc))
4025	return rc;
4026	break;
4027
4028	case SUPLDRLOADEP_SERVICE:
4029	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.Service.pfnServiceReq, false, pReq->u.In.abImage, "pfnServiceReq");
4030	if (RT_FAILURE(rc))
4031	return rc;
4032	if ( pReq->u.In.EP.Service.apvReserved[0] != NIL_RTR0PTR
4033	\|\| pReq->u.In.EP.Service.apvReserved[1] != NIL_RTR0PTR
4034	\|\| pReq->u.In.EP.Service.apvReserved[2] != NIL_RTR0PTR)
4035	{
4036	supdrvLdrUnlock(pDevExt);
4037	Log(("Out of range (%p LB %#x): apvReserved={%p,%p,%p} MBZ!\n",
4038	pImage->pvImage, pReq->u.In.cbImageWithTabs,
4039	pReq->u.In.EP.Service.apvReserved[0],
4040	pReq->u.In.EP.Service.apvReserved[1],
4041	pReq->u.In.EP.Service.apvReserved[2]));
4042	return VERR_INVALID_PARAMETER;
4043	}
4044	break;
4045
4046	default:
4047	supdrvLdrUnlock(pDevExt);
4048	Log(("Invalid eEPType=%d\n", pReq->u.In.eEPType));
4049	return VERR_INVALID_PARAMETER;
4050	}
4051
4052	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.pfnModuleInit, true, pReq->u.In.abImage, "pfnModuleInit");
4053	if (RT_FAILURE(rc))
4054	return rc;
4055	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.pfnModuleTerm, true, pReq->u.In.abImage, "pfnModuleTerm");
4056	if (RT_FAILURE(rc))
4057	return rc;
4058
4059	/*
4060	* Allocate and copy the tables.
4061	* (No need to do try/except as this is a buffered request.)
4062	*/
4063	pImage->cbStrTab = pReq->u.In.cbStrTab;
4064	if (pImage->cbStrTab)
4065	{
4066	pImage->pachStrTab = (char *)RTMemAlloc(pImage->cbStrTab);
4067	if (pImage->pachStrTab)
4068	memcpy(pImage->pachStrTab, &pReq->u.In.abImage[pReq->u.In.offStrTab], pImage->cbStrTab);
4069	else
4070	rc = /VERR_NO_MEMORY/ VERR_INTERNAL_ERROR_3;
4071	}
4072
4073	pImage->cSymbols = pReq->u.In.cSymbols;
4074	if (RT_SUCCESS(rc) && pImage->cSymbols)
4075	{
4076	size_t cbSymbols = pImage->cSymbols * sizeof(SUPLDRSYM);
4077	pImage->paSymbols = (PSUPLDRSYM)RTMemAlloc(cbSymbols);
4078	if (pImage->paSymbols)
4079	memcpy(pImage->paSymbols, &pReq->u.In.abImage[pReq->u.In.offSymbols], cbSymbols);
4080	else
4081	rc = /VERR_NO_MEMORY/ VERR_INTERNAL_ERROR_4;
4082	}
4083
4084	/*
4085	* Copy the bits / complete native loading.
4086	*/
4087	if (RT_SUCCESS(rc))
4088	{
4089	pImage->uState = SUP_IOCTL_LDR_LOAD;
4090	pImage->pfnModuleInit = pReq->u.In.pfnModuleInit;
4091	pImage->pfnModuleTerm = pReq->u.In.pfnModuleTerm;
4092
4093	if (pImage->fNative)
4094	rc = supdrvOSLdrLoad(pDevExt, pImage, pReq->u.In.abImage, pReq);
4095	else
4096	memcpy(pImage->pvImage, &pReq->u.In.abImage[0], pImage->cbImageBits);
4097	}
4098
4099	/*
4100	* Update any entry points.
4101	*/
4102	if (RT_SUCCESS(rc))
4103	{
4104	switch (pReq->u.In.eEPType)
4105	{
4106	default:
4107	case SUPLDRLOADEP_NOTHING:
4108	rc = VINF_SUCCESS;
4109	break;
4110	case SUPLDRLOADEP_VMMR0:
4111	rc = supdrvLdrSetVMMR0EPs(pDevExt, pReq->u.In.EP.VMMR0.pvVMMR0, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt,
4112	pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx);
4113	break;
4114	case SUPLDRLOADEP_SERVICE:
4115	pImage->pfnServiceReqHandler = pReq->u.In.EP.Service.pfnServiceReq;
4116	rc = VINF_SUCCESS;
4117	break;
4118	}
4119	}
4120
4121	/*
4122	* On success call the module initialization.
4123	*/
4124	LogFlow(("supdrvIOCtl_LdrLoad: pfnModuleInit=%p\n", pImage->pfnModuleInit));
4125	if (RT_SUCCESS(rc) && pImage->pfnModuleInit)
4126	{
4127	Log(("supdrvIOCtl_LdrLoad: calling pfnModuleInit=%p\n", pImage->pfnModuleInit));
4128	pDevExt->pLdrInitImage = pImage;
4129	pDevExt->hLdrInitThread = RTThreadNativeSelf();
4130	rc = pImage->pfnModuleInit(pImage);
4131	pDevExt->pLdrInitImage = NULL;
4132	pDevExt->hLdrInitThread = NIL_RTNATIVETHREAD;
4133	if (RT_FAILURE(rc) && pDevExt->pvVMMR0 == pImage->pvImage)
4134	supdrvLdrUnsetVMMR0EPs(pDevExt);
4135	}
4136
4137	if (RT_FAILURE(rc))
4138	{
4139	/* Inform the tracing component in case ModuleInit registered TPs. */
4140	supdrvTracerModuleUnloading(pDevExt, pImage);
4141
4142	pImage->uState = SUP_IOCTL_LDR_OPEN;
4143	pImage->pfnModuleInit = NULL;
4144	pImage->pfnModuleTerm = NULL;
4145	pImage->pfnServiceReqHandler= NULL;
4146	pImage->cbStrTab = 0;
4147	RTMemFree(pImage->pachStrTab);
4148	pImage->pachStrTab = NULL;
4149	RTMemFree(pImage->paSymbols);
4150	pImage->paSymbols = NULL;
4151	pImage->cSymbols = 0;
4152	}
4153
4154	supdrvLdrUnlock(pDevExt);
4155	return rc;
4156	}
4157
4158
4159	/**
4160	* Frees a previously loaded (prep'ed) image.
4161	*
4162	* @returns IPRT status code.
4163	* @param pDevExt Device globals.
4164	* @param pSession Session data.
4165	* @param pReq The request.
4166	*/
4167	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq)
4168	{
4169	int rc;
4170	PSUPDRVLDRUSAGE pUsagePrev;
4171	PSUPDRVLDRUSAGE pUsage;
4172	PSUPDRVLDRIMAGE pImage;
4173	LogFlow(("supdrvIOCtl_LdrFree: pvImageBase=%p\n", pReq->u.In.pvImageBase));
4174
4175	/*
4176	* Find the ldr image.
4177	*/
4178	supdrvLdrLock(pDevExt);
4179	pUsagePrev = NULL;
4180	pUsage = pSession->pLdrUsage;
4181	while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
4182	{
4183	pUsagePrev = pUsage;
4184	pUsage = pUsage->pNext;
4185	}
4186	if (!pUsage)
4187	{
4188	supdrvLdrUnlock(pDevExt);
4189	Log(("SUP_IOCTL_LDR_FREE: couldn't find image!\n"));
4190	return VERR_INVALID_HANDLE;
4191	}
4192
4193	/*
4194	* Check if we can remove anything.
4195	*/
4196	rc = VINF_SUCCESS;
4197	pImage = pUsage->pImage;
4198	if (pImage->cUsage <= 1 \|\| pUsage->cUsage <= 1)
4199	{
4200	/*
4201	* Check if there are any objects with destructors in the image, if
4202	* so leave it for the session cleanup routine so we get a chance to
4203	* clean things up in the right order and not leave them all dangling.
4204	*/
4205	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
4206	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
4207	if (pImage->cUsage <= 1)
4208	{
4209	PSUPDRVOBJ pObj;
4210	for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
4211	if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
4212	{
4213	rc = VERR_DANGLING_OBJECTS;
4214	break;
4215	}
4216	}
4217	else
4218	{
4219	PSUPDRVUSAGE pGenUsage;
4220	for (pGenUsage = pSession->pUsage; pGenUsage; pGenUsage = pGenUsage->pNext)
4221	if (RT_UNLIKELY((uintptr_t)pGenUsage->pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
4222	{
4223	rc = VERR_DANGLING_OBJECTS;
4224	break;
4225	}
4226	}
4227	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
4228	if (rc == VINF_SUCCESS)
4229	{
4230	/* unlink it */
4231	if (pUsagePrev)
4232	pUsagePrev->pNext = pUsage->pNext;
4233	else
4234	pSession->pLdrUsage = pUsage->pNext;
4235
4236	/* free it */
4237	pUsage->pImage = NULL;
4238	pUsage->pNext = NULL;
4239	RTMemFree(pUsage);
4240
4241	/*
4242	* Dereference the image.
4243	*/
4244	if (pImage->cUsage <= 1)
4245	supdrvLdrFree(pDevExt, pImage);
4246	else
4247	pImage->cUsage--;
4248	}
4249	else
4250	{
4251	Log(("supdrvIOCtl_LdrFree: Dangling objects in %p/%s!\n", pImage->pvImage, pImage->szName));
4252	rc = VINF_SUCCESS; /** @todo BRANCH-2.1: remove this after branching. */
4253	}
4254	}
4255	else
4256	{
4257	/*
4258	* Dereference both image and usage.
4259	*/
4260	pImage->cUsage--;
4261	pUsage->cUsage--;
4262	}
4263
4264	supdrvLdrUnlock(pDevExt);
4265	return rc;
4266	}
4267
4268
4269	/**
4270	* Gets the address of a symbol in an open image.
4271	*
4272	* @returns IPRT status code.
4273	* @param pDevExt Device globals.
4274	* @param pSession Session data.
4275	* @param pReq The request buffer.
4276	*/
4277	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq)
4278	{
4279	PSUPDRVLDRIMAGE pImage;
4280	PSUPDRVLDRUSAGE pUsage;
4281	uint32_t i;
4282	PSUPLDRSYM paSyms;
4283	const char *pchStrings;
4284	const size_t cbSymbol = strlen(pReq->u.In.szSymbol) + 1;
4285	void *pvSymbol = NULL;
4286	int rc = VERR_GENERAL_FAILURE;
4287	Log3(("supdrvIOCtl_LdrGetSymbol: pvImageBase=%p szSymbol=\"%s\"\n", pReq->u.In.pvImageBase, pReq->u.In.szSymbol));
4288
4289	/*
4290	* Find the ldr image.
4291	*/
4292	supdrvLdrLock(pDevExt);
4293	pUsage = pSession->pLdrUsage;
4294	while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
4295	pUsage = pUsage->pNext;
4296	if (!pUsage)
4297	{
4298	supdrvLdrUnlock(pDevExt);
4299	Log(("SUP_IOCTL_LDR_GET_SYMBOL: couldn't find image!\n"));
4300	return VERR_INVALID_HANDLE;
4301	}
4302	pImage = pUsage->pImage;
4303	if (pImage->uState != SUP_IOCTL_LDR_LOAD)
4304	{
4305	unsigned uState = pImage->uState;
4306	supdrvLdrUnlock(pDevExt);
4307	Log(("SUP_IOCTL_LDR_GET_SYMBOL: invalid image state %d (%#x)!\n", uState, uState)); NOREF(uState);
4308	return VERR_ALREADY_LOADED;
4309	}
4310
4311	/*
4312	* Search the symbol strings.
4313	*
4314	* Note! The int32_t is for native loading on solaris where the data
4315	* and text segments are in very different places.
4316	*/
4317	pchStrings = pImage->pachStrTab;
4318	paSyms = pImage->paSymbols;
4319	for (i = 0; i < pImage->cSymbols; i++)
4320	{
4321	if ( paSyms[i].offName + cbSymbol <= pImage->cbStrTab
4322	&& !memcmp(pchStrings + paSyms[i].offName, pReq->u.In.szSymbol, cbSymbol))
4323	{
4324	pvSymbol = (uint8_t *)pImage->pvImage + (int32_t)paSyms[i].offSymbol;
4325	rc = VINF_SUCCESS;
4326	break;
4327	}
4328	}
4329	supdrvLdrUnlock(pDevExt);
4330	pReq->u.Out.pvSymbol = pvSymbol;
4331	return rc;
4332	}
4333
4334
4335	/**
4336	* Gets the address of a symbol in an open image or the support driver.
4337	*
4338	* @returns VINF_SUCCESS on success.
4339	* @returns
4340	* @param pDevExt Device globals.
4341	* @param pSession Session data.
4342	* @param pReq The request buffer.
4343	*/
4344	static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq)
4345	{
4346	int rc = VINF_SUCCESS;
4347	const char *pszSymbol = pReq->u.In.pszSymbol;
4348	const char *pszModule = pReq->u.In.pszModule;
4349	size_t cbSymbol;
4350	char const *pszEnd;
4351	uint32_t i;
4352
4353	/*
4354	* Input validation.
4355	*/
4356	AssertPtrReturn(pszSymbol, VERR_INVALID_POINTER);
4357	pszEnd = RTStrEnd(pszSymbol, 512);
4358	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4359	cbSymbol = pszEnd - pszSymbol + 1;
4360
4361	if (pszModule)
4362	{
4363	AssertPtrReturn(pszModule, VERR_INVALID_POINTER);
4364	pszEnd = RTStrEnd(pszModule, 64);
4365	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4366	}
4367	Log3(("supdrvIDC_LdrGetSymbol: pszModule=%p:{%s} pszSymbol=%p:{%s}\n", pszModule, pszModule, pszSymbol, pszSymbol));
4368
4369
4370	if ( !pszModule
4371	\|\| !strcmp(pszModule, "SupDrv"))
4372	{
4373	/*
4374	* Search the support driver export table.
4375	*/
4376	for (i = 0; i < RT_ELEMENTS(g_aFunctions); i++)
4377	if (!strcmp(g_aFunctions[i].szName, pszSymbol))
4378	{
4379	pReq->u.Out.pfnSymbol = g_aFunctions[i].pfn;
4380	break;
4381	}
4382	}
4383	else
4384	{
4385	/*
4386	* Find the loader image.
4387	*/
4388	PSUPDRVLDRIMAGE pImage;
4389
4390	supdrvLdrLock(pDevExt);
4391
4392	for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
4393	if (!strcmp(pImage->szName, pszModule))
4394	break;
4395	if (pImage && pImage->uState == SUP_IOCTL_LDR_LOAD)
4396	{
4397	/*
4398	* Search the symbol strings.
4399	*/
4400	const char *pchStrings = pImage->pachStrTab;
4401	PCSUPLDRSYM paSyms = pImage->paSymbols;
4402	for (i = 0; i < pImage->cSymbols; i++)
4403	{
4404	if ( paSyms[i].offName + cbSymbol <= pImage->cbStrTab
4405	&& !memcmp(pchStrings + paSyms[i].offName, pszSymbol, cbSymbol))
4406	{
4407	/*
4408	* Found it! Calc the symbol address and add a reference to the module.
4409	*/
4410	pReq->u.Out.pfnSymbol = (PFNRT)((uint8_t *)pImage->pvImage + (int32_t)paSyms[i].offSymbol);
4411	rc = supdrvLdrAddUsage(pSession, pImage);
4412	break;
4413	}
4414	}
4415	}
4416	else
4417	rc = pImage ? VERR_WRONG_ORDER : VERR_MODULE_NOT_FOUND;
4418
4419	supdrvLdrUnlock(pDevExt);
4420	}
4421	return rc;
4422	}
4423
4424
4425	/**
4426	* Updates the VMMR0 entry point pointers.
4427	*
4428	* @returns IPRT status code.
4429	* @param pDevExt Device globals.
4430	* @param pSession Session data.
4431	* @param pVMMR0 VMMR0 image handle.
4432	* @param pvVMMR0EntryInt VMMR0EntryInt address.
4433	* @param pvVMMR0EntryFast VMMR0EntryFast address.
4434	* @param pvVMMR0EntryEx VMMR0EntryEx address.
4435	* @remark Caller must own the loader mutex.
4436	*/
4437	static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0EntryInt, void pvVMMR0EntryFast, void pvVMMR0EntryEx)
4438	{
4439	int rc = VINF_SUCCESS;
4440	LogFlow(("supdrvLdrSetR0EP pvVMMR0=%p pvVMMR0EntryInt=%p\n", pvVMMR0, pvVMMR0EntryInt));
4441
4442
4443	/*
4444	* Check if not yet set.
4445	*/
4446	if (!pDevExt->pvVMMR0)
4447	{
4448	pDevExt->pvVMMR0 = pvVMMR0;
4449	pDevExt->pfnVMMR0EntryInt = pvVMMR0EntryInt;
4450	pDevExt->pfnVMMR0EntryFast = pvVMMR0EntryFast;
4451	pDevExt->pfnVMMR0EntryEx = pvVMMR0EntryEx;
4452	}
4453	else
4454	{
4455	/*
4456	* Return failure or success depending on whether the values match or not.
4457	*/
4458	if ( pDevExt->pvVMMR0 != pvVMMR0
4459	\|\| (void *)pDevExt->pfnVMMR0EntryInt != pvVMMR0EntryInt
4460	\|\| (void *)pDevExt->pfnVMMR0EntryFast != pvVMMR0EntryFast
4461	\|\| (void *)pDevExt->pfnVMMR0EntryEx != pvVMMR0EntryEx)
4462	{
4463	AssertMsgFailed(("SUP_IOCTL_LDR_SETR0EP: Already set pointing to a different module!\n"));
4464	rc = VERR_INVALID_PARAMETER;
4465	}
4466	}
4467	return rc;
4468	}
4469
4470
4471	/**
4472	* Unsets the VMMR0 entry point installed by supdrvLdrSetR0EP.
4473	*
4474	* @param pDevExt Device globals.
4475	*/
4476	static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt)
4477	{
4478	pDevExt->pvVMMR0 = NULL;
4479	pDevExt->pfnVMMR0EntryInt = NULL;
4480	pDevExt->pfnVMMR0EntryFast = NULL;
4481	pDevExt->pfnVMMR0EntryEx = NULL;
4482	}
4483
4484
4485	/**
4486	* Adds a usage reference in the specified session of an image.
4487	*
4488	* Called while owning the loader semaphore.
4489	*
4490	* @returns VINF_SUCCESS on success and VERR_NO_MEMORY on failure.
4491	* @param pSession Session in question.
4492	* @param pImage Image which the session is using.
4493	*/
4494	static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage)
4495	{
4496	PSUPDRVLDRUSAGE pUsage;
4497	LogFlow(("supdrvLdrAddUsage: pImage=%p\n", pImage));
4498
4499	/*
4500	* Referenced it already?
4501	*/
4502	pUsage = pSession->pLdrUsage;
4503	while (pUsage)
4504	{
4505	if (pUsage->pImage == pImage)
4506	{
4507	pUsage->cUsage++;
4508	return VINF_SUCCESS;
4509	}
4510	pUsage = pUsage->pNext;
4511	}
4512
4513	/*
4514	* Allocate new usage record.
4515	*/
4516	pUsage = (PSUPDRVLDRUSAGE)RTMemAlloc(sizeof(*pUsage));
4517	AssertReturn(pUsage, /VERR_NO_MEMORY/ VERR_INTERNAL_ERROR_5);
4518	pUsage->cUsage = 1;
4519	pUsage->pImage = pImage;
4520	pUsage->pNext = pSession->pLdrUsage;
4521	pSession->pLdrUsage = pUsage;
4522	return VINF_SUCCESS;
4523	}
4524
4525
4526	/**
4527	* Frees a load image.
4528	*
4529	* @param pDevExt Pointer to device extension.
4530	* @param pImage Pointer to the image we're gonna free.
4531	* This image must exit!
4532	* @remark The caller MUST own SUPDRVDEVEXT::mtxLdr!
4533	*/
4534	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage)
4535	{
4536	PSUPDRVLDRIMAGE pImagePrev;
4537	LogFlow(("supdrvLdrFree: pImage=%p\n", pImage));
4538
4539	/* find it - arg. should've used doubly linked list. */
4540	Assert(pDevExt->pLdrImages);
4541	pImagePrev = NULL;
4542	if (pDevExt->pLdrImages != pImage)
4543	{
4544	pImagePrev = pDevExt->pLdrImages;
4545	while (pImagePrev->pNext != pImage)
4546	pImagePrev = pImagePrev->pNext;
4547	Assert(pImagePrev->pNext == pImage);
4548	}
4549
4550	/* unlink */
4551	if (pImagePrev)
4552	pImagePrev->pNext = pImage->pNext;
4553	else
4554	pDevExt->pLdrImages = pImage->pNext;
4555
4556	/* check if this is VMMR0.r0 unset its entry point pointers. */
4557	if (pDevExt->pvVMMR0 == pImage->pvImage)
4558	supdrvLdrUnsetVMMR0EPs(pDevExt);
4559
4560	/* check for objects with destructors in this image. (Shouldn't happen.) */
4561	if (pDevExt->pObjs)
4562	{
4563	unsigned cObjs = 0;
4564	PSUPDRVOBJ pObj;
4565	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
4566	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
4567	for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
4568	if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
4569	{
4570	pObj->pfnDestructor = NULL;
4571	cObjs++;
4572	}
4573	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
4574	if (cObjs)
4575	OSDBGPRINT(("supdrvLdrFree: Image '%s' has %d dangling objects!\n", pImage->szName, cObjs));
4576	}
4577
4578	/* call termination function if fully loaded. */
4579	if ( pImage->pfnModuleTerm
4580	&& pImage->uState == SUP_IOCTL_LDR_LOAD)
4581	{
4582	LogFlow(("supdrvIOCtl_LdrLoad: calling pfnModuleTerm=%p\n", pImage->pfnModuleTerm));
4583	pImage->pfnModuleTerm(pImage);
4584	}
4585
4586	/* Inform the tracing component. */
4587	supdrvTracerModuleUnloading(pDevExt, pImage);
4588
4589	/* do native unload if appropriate. */
4590	if (pImage->fNative)
4591	supdrvOSLdrUnload(pDevExt, pImage);
4592
4593	/* free the image */
4594	pImage->cUsage = 0;
4595	pImage->pDevExt = NULL;
4596	pImage->pNext = NULL;
4597	pImage->uState = SUP_IOCTL_LDR_FREE;
4598	RTMemExecFree(pImage->pvImageAlloc, pImage->cbImageBits + 31);
4599	pImage->pvImageAlloc = NULL;
4600	RTMemFree(pImage->pachStrTab);
4601	pImage->pachStrTab = NULL;
4602	RTMemFree(pImage->paSymbols);
4603	pImage->paSymbols = NULL;
4604	RTMemFree(pImage);
4605	}
4606
4607
4608	/**
4609	* Acquires the loader lock.
4610	*
4611	* @returns IPRT status code.
4612	* @param pDevExt The device extension.
4613	*/
4614	DECLINLINE(int) supdrvLdrLock(PSUPDRVDEVEXT pDevExt)
4615	{
4616	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
4617	int rc = RTSemMutexRequest(pDevExt->mtxLdr, RT_INDEFINITE_WAIT);
4618	#else
4619	int rc = RTSemFastMutexRequest(pDevExt->mtxLdr);
4620	#endif
4621	AssertRC(rc);
4622	return rc;
4623	}
4624
4625
4626	/**
4627	* Releases the loader lock.
4628	*
4629	* @returns IPRT status code.
4630	* @param pDevExt The device extension.
4631	*/
4632	DECLINLINE(int) supdrvLdrUnlock(PSUPDRVDEVEXT pDevExt)
4633	{
4634	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
4635	return RTSemMutexRelease(pDevExt->mtxLdr);
4636	#else
4637	return RTSemFastMutexRelease(pDevExt->mtxLdr);
4638	#endif
4639	}
4640
4641
4642	/**
4643	* Implements the service call request.
4644	*
4645	* @returns VBox status code.
4646	* @param pDevExt The device extension.
4647	* @param pSession The calling session.
4648	* @param pReq The request packet, valid.
4649	*/
4650	static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq)
4651	{
4652	#if !defined(RT_OS_WINDOWS) \|\| defined(DEBUG)
4653	int rc;
4654
4655	/*
4656	* Find the module first in the module referenced by the calling session.
4657	*/
4658	rc = supdrvLdrLock(pDevExt);
4659	if (RT_SUCCESS(rc))
4660	{
4661	PFNSUPR0SERVICEREQHANDLER pfnServiceReqHandler = NULL;
4662	PSUPDRVLDRUSAGE pUsage;
4663
4664	for (pUsage = pSession->pLdrUsage; pUsage; pUsage = pUsage->pNext)
4665	if ( pUsage->pImage->pfnServiceReqHandler
4666	&& !strcmp(pUsage->pImage->szName, pReq->u.In.szName))
4667	{
4668	pfnServiceReqHandler = pUsage->pImage->pfnServiceReqHandler;
4669	break;
4670	}
4671	supdrvLdrUnlock(pDevExt);
4672
4673	if (pfnServiceReqHandler)
4674	{
4675	/*
4676	* Call it.
4677	*/
4678	if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
4679	rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, NULL);
4680	else
4681	rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0]);
4682	}
4683	else
4684	rc = VERR_SUPDRV_SERVICE_NOT_FOUND;
4685	}
4686
4687	/* log it */
4688	if ( RT_FAILURE(rc)
4689	&& rc != VERR_INTERRUPTED
4690	&& rc != VERR_TIMEOUT)
4691	Log(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
4692	rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
4693	else
4694	Log4(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
4695	rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
4696	return rc;
4697	#else /* RT_OS_WINDOWS && !DEBUG */
4698	return VERR_NOT_IMPLEMENTED;
4699	#endif /* RT_OS_WINDOWS && !DEBUG */
4700	}
4701
4702
4703	/**
4704	* Implements the logger settings request.
4705	*
4706	* @returns VBox status code.
4707	* @param pDevExt The device extension.
4708	* @param pSession The caller's session.
4709	* @param pReq The request.
4710	*/
4711	static int supdrvIOCtl_LoggerSettings(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLOGGERSETTINGS pReq)
4712	{
4713	const char *pszGroup = &pReq->u.In.szStrings[pReq->u.In.offGroups];
4714	const char *pszFlags = &pReq->u.In.szStrings[pReq->u.In.offFlags];
4715	const char *pszDest = &pReq->u.In.szStrings[pReq->u.In.offDestination];
4716	PRTLOGGER pLogger = NULL;
4717	int rc;
4718
4719	/*
4720	* Some further validation.
4721	*/
4722	switch (pReq->u.In.fWhat)
4723	{
4724	case SUPLOGGERSETTINGS_WHAT_SETTINGS:
4725	case SUPLOGGERSETTINGS_WHAT_CREATE:
4726	break;
4727
4728	case SUPLOGGERSETTINGS_WHAT_DESTROY:
4729	if (pszGroup \|\| pszFlags \|\| *pszDest)
4730	return VERR_INVALID_PARAMETER;
4731	if (pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_RELEASE)
4732	return VERR_ACCESS_DENIED;
4733	break;
4734
4735	default:
4736	return VERR_INTERNAL_ERROR;
4737	}
4738
4739	/*
4740	* Get the logger.
4741	*/
4742	switch (pReq->u.In.fWhich)
4743	{
4744	case SUPLOGGERSETTINGS_WHICH_DEBUG:
4745	pLogger = RTLogGetDefaultInstance();
4746	break;
4747
4748	case SUPLOGGERSETTINGS_WHICH_RELEASE:
4749	pLogger = RTLogRelDefaultInstance();
4750	break;
4751
4752	default:
4753	return VERR_INTERNAL_ERROR;
4754	}
4755
4756	/*
4757	* Do the job.
4758	*/
4759	switch (pReq->u.In.fWhat)
4760	{
4761	case SUPLOGGERSETTINGS_WHAT_SETTINGS:
4762	if (pLogger)
4763	{
4764	rc = RTLogFlags(pLogger, pszFlags);
4765	if (RT_SUCCESS(rc))
4766	rc = RTLogGroupSettings(pLogger, pszGroup);
4767	NOREF(pszDest);
4768	}
4769	else
4770	rc = VERR_NOT_FOUND;
4771	break;
4772
4773	case SUPLOGGERSETTINGS_WHAT_CREATE:
4774	{
4775	if (pLogger)
4776	rc = VERR_ALREADY_EXISTS;
4777	else
4778	{
4779	static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
4780
4781	rc = RTLogCreate(&pLogger,
4782	0 /* fFlags */,
4783	pszGroup,
4784	pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_DEBUG
4785	? "VBOX_LOG"
4786	: "VBOX_RELEASE_LOG",
4787	RT_ELEMENTS(s_apszGroups),
4788	s_apszGroups,
4789	RTLOGDEST_STDOUT \| RTLOGDEST_DEBUGGER,
4790	NULL);
4791	if (RT_SUCCESS(rc))
4792	{
4793	rc = RTLogFlags(pLogger, pszFlags);
4794	NOREF(pszDest);
4795	if (RT_SUCCESS(rc))
4796	{
4797	switch (pReq->u.In.fWhich)
4798	{
4799	case SUPLOGGERSETTINGS_WHICH_DEBUG:
4800	pLogger = RTLogSetDefaultInstance(pLogger);
4801	break;
4802	case SUPLOGGERSETTINGS_WHICH_RELEASE:
4803	pLogger = RTLogRelSetDefaultInstance(pLogger);
4804	break;
4805	}
4806	}
4807	RTLogDestroy(pLogger);
4808	}
4809	}
4810	break;
4811	}
4812
4813	case SUPLOGGERSETTINGS_WHAT_DESTROY:
4814	switch (pReq->u.In.fWhich)
4815	{
4816	case SUPLOGGERSETTINGS_WHICH_DEBUG:
4817	pLogger = RTLogSetDefaultInstance(NULL);
4818	break;
4819	case SUPLOGGERSETTINGS_WHICH_RELEASE:
4820	pLogger = RTLogRelSetDefaultInstance(NULL);
4821	break;
4822	}
4823	rc = RTLogDestroy(pLogger);
4824	break;
4825
4826	default:
4827	{
4828	rc = VERR_INTERNAL_ERROR;
4829	break;
4830	}
4831	}
4832
4833	return rc;
4834	}
4835
4836
4837	/**
4838	* Creates the GIP.
4839	*
4840	* @returns VBox status code.
4841	* @param pDevExt Instance data. GIP stuff may be updated.
4842	*/
4843	static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt)
4844	{
4845	PSUPGLOBALINFOPAGE pGip;
4846	RTHCPHYS HCPhysGip;
4847	uint32_t u32SystemResolution;
4848	uint32_t u32Interval;
4849	unsigned cCpus;
4850	int rc;
4851
4852
4853	LogFlow(("supdrvGipCreate:\n"));
4854
4855	/* assert order */
4856	Assert(pDevExt->u32SystemTimerGranularityGrant == 0);
4857	Assert(pDevExt->GipMemObj == NIL_RTR0MEMOBJ);
4858	Assert(!pDevExt->pGipTimer);
4859
4860	/*
4861	* Check the CPU count.
4862	*/
4863	cCpus = RTMpGetArraySize();
4864	if ( cCpus > RTCPUSET_MAX_CPUS
4865	\|\| cCpus > 256 /ApicId is used for the mappings/)
4866	{
4867	SUPR0Printf("VBoxDrv: Too many CPUs (%u) for the GIP (max %u)\n", cCpus, RT_MIN(RTCPUSET_MAX_CPUS, 256));
4868	return VERR_TOO_MANY_CPUS;
4869	}
4870
4871	/*
4872	* Allocate a contiguous set of pages with a default kernel mapping.
4873	*/
4874	rc = RTR0MemObjAllocCont(&pDevExt->GipMemObj, RT_UOFFSETOF(SUPGLOBALINFOPAGE, aCPUs[cCpus]), false /fExecutable/);
4875	if (RT_FAILURE(rc))
4876	{
4877	OSDBGPRINT(("supdrvGipCreate: failed to allocate the GIP page. rc=%d\n", rc));
4878	return rc;
4879	}
4880	pGip = (PSUPGLOBALINFOPAGE)RTR0MemObjAddress(pDevExt->GipMemObj); AssertPtr(pGip);
4881	HCPhysGip = RTR0MemObjGetPagePhysAddr(pDevExt->GipMemObj, 0); Assert(HCPhysGip != NIL_RTHCPHYS);
4882
4883	/*
4884	* Find a reasonable update interval and initialize the structure.
4885	*/
4886	u32Interval = u32SystemResolution = RTTimerGetSystemGranularity();
4887	while (u32Interval < 10000000 /* 10 ms */)
4888	u32Interval += u32SystemResolution;
4889
4890	supdrvGipInit(pDevExt, pGip, HCPhysGip, RTTimeSystemNanoTS(), 1000000000 / u32Interval /=Hz/, cCpus);
4891
4892	/*
4893	* Create the timer.
4894	* If CPU_ALL isn't supported we'll have to fall back to synchronous mode.
4895	*/
4896	if (pGip->u32Mode == SUPGIPMODE_ASYNC_TSC)
4897	{
4898	rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, RTTIMER_FLAGS_CPU_ALL, supdrvGipAsyncTimer, pDevExt);
4899	if (rc == VERR_NOT_SUPPORTED)
4900	{
4901	OSDBGPRINT(("supdrvGipCreate: omni timer not supported, falling back to synchronous mode\n"));
4902	pGip->u32Mode = SUPGIPMODE_SYNC_TSC;
4903	}
4904	}
4905	if (pGip->u32Mode != SUPGIPMODE_ASYNC_TSC)
4906	rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, 0, supdrvGipSyncTimer, pDevExt);
4907	if (RT_SUCCESS(rc))
4908	{
4909	rc = RTMpNotificationRegister(supdrvGipMpEvent, pDevExt);
4910	if (RT_SUCCESS(rc))
4911	{
4912	rc = RTMpOnAll(supdrvGipInitOnCpu, pDevExt, pGip);
4913	if (RT_SUCCESS(rc))
4914	{
4915	/*
4916	* We're good.
4917	*/
4918	Log(("supdrvGipCreate: %u ns interval.\n", u32Interval));
4919	g_pSUPGlobalInfoPage = pGip;
4920	return VINF_SUCCESS;
4921	}
4922
4923	OSDBGPRINT(("supdrvGipCreate: RTMpOnAll failed with rc=%Rrc\n", rc));
4924	RTMpNotificationDeregister(supdrvGipMpEvent, pDevExt);
4925
4926	}
4927	else
4928	OSDBGPRINT(("supdrvGipCreate: failed to register MP event notfication. rc=%Rrc\n", rc));
4929	}
4930	else
4931	{
4932	OSDBGPRINT(("supdrvGipCreate: failed create GIP timer at %u ns interval. rc=%Rrc\n", u32Interval, rc));
4933	Assert(!pDevExt->pGipTimer);
4934	}
4935	supdrvGipDestroy(pDevExt);
4936	return rc;
4937	}
4938
4939
4940	/**
4941	* Terminates the GIP.
4942	*
4943	* @param pDevExt Instance data. GIP stuff may be updated.
4944	*/
4945	static void supdrvGipDestroy(PSUPDRVDEVEXT pDevExt)
4946	{
4947	int rc;
4948	#ifdef DEBUG_DARWIN_GIP
4949	OSDBGPRINT(("supdrvGipDestroy: pDevExt=%p pGip=%p pGipTimer=%p GipMemObj=%p\n", pDevExt,
4950	pDevExt->GipMemObj != NIL_RTR0MEMOBJ ? RTR0MemObjAddress(pDevExt->GipMemObj) : NULL,
4951	pDevExt->pGipTimer, pDevExt->GipMemObj));
4952	#endif
4953
4954	/*
4955	* Invalid the GIP data.
4956	*/
4957	if (pDevExt->pGip)
4958	{
4959	supdrvGipTerm(pDevExt->pGip);
4960	pDevExt->pGip = NULL;
4961	}
4962	g_pSUPGlobalInfoPage = NULL;
4963
4964	/*
4965	* Destroy the timer and free the GIP memory object.
4966	*/
4967	if (pDevExt->pGipTimer)
4968	{
4969	rc = RTTimerDestroy(pDevExt->pGipTimer); AssertRC(rc);
4970	pDevExt->pGipTimer = NULL;
4971	}
4972
4973	if (pDevExt->GipMemObj != NIL_RTR0MEMOBJ)
4974	{
4975	rc = RTR0MemObjFree(pDevExt->GipMemObj, true /* free mappings */); AssertRC(rc);
4976	pDevExt->GipMemObj = NIL_RTR0MEMOBJ;
4977	}
4978
4979	/*
4980	* Finally, make sure we've release the system timer resolution request
4981	* if one actually succeeded and is still pending.
4982	*/
4983	if (pDevExt->u32SystemTimerGranularityGrant)
4984	{
4985	rc = RTTimerReleaseSystemGranularity(pDevExt->u32SystemTimerGranularityGrant); AssertRC(rc);
4986	pDevExt->u32SystemTimerGranularityGrant = 0;
4987	}
4988	}
4989
4990
4991	/**
4992	* Timer callback function sync GIP mode.
4993	* @param pTimer The timer.
4994	* @param pvUser The device extension.
4995	*/
4996	static DECLCALLBACK(void) supdrvGipSyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick)
4997	{
4998	RTCCUINTREG fOldFlags = ASMIntDisableFlags(); /* No interruptions please (real problem on S10). */
4999	PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
5000	uint64_t u64TSC = ASMReadTSC();
5001	uint64_t NanoTS = RTTimeSystemNanoTS();
5002
5003	supdrvGipUpdate(pDevExt, NanoTS, u64TSC, NIL_RTCPUID, iTick);
5004
5005	ASMSetFlags(fOldFlags);
5006	}
5007
5008
5009	/**
5010	* Timer callback function for async GIP mode.
5011	* @param pTimer The timer.
5012	* @param pvUser The device extension.
5013	*/
5014	static DECLCALLBACK(void) supdrvGipAsyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick)
5015	{
5016	RTCCUINTREG fOldFlags = ASMIntDisableFlags(); /* No interruptions please (real problem on S10). */
5017	PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
5018	RTCPUID idCpu = RTMpCpuId();
5019	uint64_t u64TSC = ASMReadTSC();
5020	uint64_t NanoTS = RTTimeSystemNanoTS();
5021
5022	/** @todo reset the transaction number and whatnot when iTick == 1. */
5023	if (pDevExt->idGipMaster == idCpu)
5024	supdrvGipUpdate(pDevExt, NanoTS, u64TSC, idCpu, iTick);
5025	else
5026	supdrvGipUpdatePerCpu(pDevExt, NanoTS, u64TSC, idCpu, ASMGetApicId(), iTick);
5027
5028	ASMSetFlags(fOldFlags);
5029	}
5030
5031
5032	/**
5033	* Finds our (@a idCpu) entry, or allocates a new one if not found.
5034	*
5035	* @returns Index of the CPU in the cache set.
5036	* @param pGip The GIP.
5037	* @param idCpu The CPU ID.
5038	*/
5039	static uint32_t supdrvGipCpuIndexFromCpuId(PSUPGLOBALINFOPAGE pGip, RTCPUID idCpu)
5040	{
5041	uint32_t i, cTries;
5042
5043	/*
5044	* ASSUMES that CPU IDs are constant.
5045	*/
5046	for (i = 0; i < pGip->cCpus; i++)
5047	if (pGip->aCPUs[i].idCpu == idCpu)
5048	return i;
5049
5050	cTries = 0;
5051	do
5052	{
5053	for (i = 0; i < pGip->cCpus; i++)
5054	{
5055	bool fRc;
5056	ASMAtomicCmpXchgSize(&pGip->aCPUs[i].idCpu, idCpu, NIL_RTCPUID, fRc);
5057	if (fRc)
5058	return i;
5059	}
5060	} while (cTries++ < 32);
5061	AssertReleaseFailed();
5062	return i - 1;
5063	}
5064
5065
5066	/**
5067	* The calling CPU should be accounted as online, update GIP accordingly.
5068	*
5069	* This is used by supdrvGipMpEvent as well as the supdrvGipCreate.
5070	*
5071	* @param pDevExt The device extension.
5072	* @param idCpu The CPU ID.
5073	*/
5074	static void supdrvGipMpEventOnline(PSUPDRVDEVEXT pDevExt, RTCPUID idCpu)
5075	{
5076	int iCpuSet = 0;
5077	uint16_t idApic = UINT16_MAX;
5078	uint32_t i = 0;
5079	uint64_t u64NanoTS = 0;
5080	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
5081	PSUPGLOBALINFOPAGE pGip = pDevExt->pGip;
5082
5083	AssertPtrReturnVoid(pGip);
5084	AssertRelease(idCpu == RTMpCpuId());
5085	Assert(pGip->cPossibleCpus == RTMpGetCount());
5086
5087	/*
5088	* Do this behind a spinlock with interrupts disabled as this can fire
5089	* on all CPUs simultaneously, see #6110.
5090	*/
5091	RTSpinlockAcquireNoInts(pDevExt->spinGip, &SpinlockTmp);
5092
5093	/*
5094	* Update the globals.
5095	*/
5096	ASMAtomicWriteU16(&pGip->cPresentCpus, RTMpGetPresentCount());
5097	ASMAtomicWriteU16(&pGip->cOnlineCpus, RTMpGetOnlineCount());
5098	iCpuSet = RTMpCpuIdToSetIndex(idCpu);
5099	if (iCpuSet >= 0)
5100	{
5101	Assert(RTCpuSetIsMemberByIndex(&pGip->PossibleCpuSet, iCpuSet));
5102	RTCpuSetAddByIndex(&pGip->OnlineCpuSet, iCpuSet);
5103	RTCpuSetAddByIndex(&pGip->PresentCpuSet, iCpuSet);
5104	}
5105
5106	/*
5107	* Update the entry.
5108	*/
5109	u64NanoTS = RTTimeSystemNanoTS() - pGip->u32UpdateIntervalNS;
5110	i = supdrvGipCpuIndexFromCpuId(pGip, idCpu);
5111	supdrvGipInitCpu(pGip, &pGip->aCPUs[i], u64NanoTS);
5112	idApic = ASMGetApicId();
5113	ASMAtomicWriteU16(&pGip->aCPUs[i].idApic, idApic);
5114	ASMAtomicWriteS16(&pGip->aCPUs[i].iCpuSet, (int16_t)iCpuSet);
5115	ASMAtomicWriteSize(&pGip->aCPUs[i].idCpu, idCpu);
5116
5117	/*
5118	* Update the APIC ID and CPU set index mappings.
5119	*/
5120	ASMAtomicWriteU16(&pGip->aiCpuFromApicId[idApic], i);
5121	ASMAtomicWriteU16(&pGip->aiCpuFromCpuSetIdx[iCpuSet], i);
5122
5123	/* commit it */
5124	ASMAtomicWriteSize(&pGip->aCPUs[i].enmState, SUPGIPCPUSTATE_ONLINE);
5125
5126	RTSpinlockReleaseNoInts(pDevExt->spinGip, &SpinlockTmp);
5127	}
5128
5129
5130	/**
5131	* The CPU should be accounted as offline, update the GIP accordingly.
5132	*
5133	* This is used by supdrvGipMpEvent.
5134	*
5135	* @param pDevExt The device extension.
5136	* @param idCpu The CPU ID.
5137	*/
5138	static void supdrvGipMpEventOffline(PSUPDRVDEVEXT pDevExt, RTCPUID idCpu)
5139	{
5140	int iCpuSet;
5141	unsigned i;
5142
5143	PSUPGLOBALINFOPAGE pGip = pDevExt->pGip;
5144	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
5145
5146	AssertPtrReturnVoid(pGip);
5147	RTSpinlockAcquireNoInts(pDevExt->spinGip, &SpinlockTmp);
5148
5149	iCpuSet = RTMpCpuIdToSetIndex(idCpu);
5150	AssertReturnVoid(iCpuSet >= 0);
5151
5152	i = pGip->aiCpuFromCpuSetIdx[iCpuSet];
5153	AssertReturnVoid(i < pGip->cCpus);
5154	AssertReturnVoid(pGip->aCPUs[i].idCpu == idCpu);
5155
5156	Assert(RTCpuSetIsMemberByIndex(&pGip->PossibleCpuSet, iCpuSet));
5157	RTCpuSetDelByIndex(&pGip->OnlineCpuSet, iCpuSet);
5158
5159	/* commit it */
5160	ASMAtomicWriteSize(&pGip->aCPUs[i].enmState, SUPGIPCPUSTATE_OFFLINE);
5161
5162	RTSpinlockReleaseNoInts(pDevExt->spinGip, &SpinlockTmp);
5163	}
5164
5165
5166	/**
5167	* Multiprocessor event notification callback.
5168	*
5169	* This is used to make sure that the GIP master gets passed on to
5170	* another CPU. It also updates the associated CPU data.
5171	*
5172	* @param enmEvent The event.
5173	* @param idCpu The cpu it applies to.
5174	* @param pvUser Pointer to the device extension.
5175	*
5176	* @remarks This function -must- fire on the newly online'd CPU for the
5177	* RTMPEVENT_ONLINE case and can fire on any CPU for the
5178	* RTMPEVENT_OFFLINE case.
5179	*/
5180	static DECLCALLBACK(void) supdrvGipMpEvent(RTMPEVENT enmEvent, RTCPUID idCpu, void *pvUser)
5181	{
5182	PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
5183	PSUPGLOBALINFOPAGE pGip = pDevExt->pGip;
5184
5185	AssertRelease(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
5186
5187	/*
5188	* Update the GIP CPU data.
5189	*/
5190	if (pGip)
5191	{
5192	switch (enmEvent)
5193	{
5194	case RTMPEVENT_ONLINE:
5195	AssertRelease(idCpu == RTMpCpuId());
5196	supdrvGipMpEventOnline(pDevExt, idCpu);
5197	break;
5198	case RTMPEVENT_OFFLINE:
5199	supdrvGipMpEventOffline(pDevExt, idCpu);
5200	break;
5201
5202	}
5203	}
5204
5205	/*
5206	* Make sure there is a master GIP.
5207	*/
5208	if (enmEvent == RTMPEVENT_OFFLINE)
5209	{
5210	RTCPUID idGipMaster = ASMAtomicReadU32(&pDevExt->idGipMaster);
5211	if (idGipMaster == idCpu)
5212	{
5213	/*
5214	* Find a new GIP master.
5215	*/
5216	bool fIgnored;
5217	unsigned i;
5218	RTCPUID idNewGipMaster = NIL_RTCPUID;
5219	RTCPUSET OnlineCpus;
5220	RTMpGetOnlineSet(&OnlineCpus);
5221
5222	for (i = 0; i < RTCPUSET_MAX_CPUS; i++)
5223	{
5224	RTCPUID idCurCpu = RTMpCpuIdFromSetIndex(i);
5225	if ( RTCpuSetIsMember(&OnlineCpus, idCurCpu)
5226	&& idCurCpu != idGipMaster)
5227	{
5228	idNewGipMaster = idCurCpu;
5229	break;
5230	}
5231	}
5232
5233	Log(("supdrvGipMpEvent: Gip master %#lx -> %#lx\n", (long)idGipMaster, (long)idNewGipMaster));
5234	ASMAtomicCmpXchgSize(&pDevExt->idGipMaster, idNewGipMaster, idGipMaster, fIgnored);
5235	NOREF(fIgnored);
5236	}
5237	}
5238	}
5239
5240
5241	/**
5242	* Callback used by supdrvDetermineAsyncTSC to read the TSC on a CPU.
5243	*
5244	* @param idCpu Ignored.
5245	* @param pvUser1 Where to put the TSC.
5246	* @param pvUser2 Ignored.
5247	*/
5248	static DECLCALLBACK(void) supdrvDetermineAsyncTscWorker(RTCPUID idCpu, void pvUser1, void pvUser2)
5249	{
5250	#if 1
5251	ASMAtomicWriteU64((uint64_t volatile *)pvUser1, ASMReadTSC());
5252	#else
5253	(uint64_t )pvUser1 = ASMReadTSC();
5254	#endif
5255	}
5256
5257
5258	/**
5259	* Determine if Async GIP mode is required because of TSC drift.
5260	*
5261	* When using the default/normal timer code it is essential that the time stamp counter
5262	* (TSC) runs never backwards, that is, a read operation to the counter should return
5263	* a bigger value than any previous read operation. This is guaranteed by the latest
5264	* AMD CPUs and by newer Intel CPUs which never enter the C2 state (P4). In any other
5265	* case we have to choose the asynchronous timer mode.
5266	*
5267	* @param poffMin Pointer to the determined difference between different cores.
5268	* @return false if the time stamp counters appear to be synchronized, true otherwise.
5269	*/
5270	static bool supdrvDetermineAsyncTsc(uint64_t *poffMin)
5271	{
5272	/*
5273	* Just iterate all the cpus 8 times and make sure that the TSC is
5274	* ever increasing. We don't bother taking TSC rollover into account.
5275	*/
5276	int iEndCpu = RTMpGetArraySize();
5277	int iCpu;
5278	int cLoops = 8;
5279	bool fAsync = false;
5280	int rc = VINF_SUCCESS;
5281	uint64_t offMax = 0;
5282	uint64_t offMin = ~(uint64_t)0;
5283	uint64_t PrevTsc = ASMReadTSC();
5284
5285	while (cLoops-- > 0)
5286	{
5287	for (iCpu = 0; iCpu < iEndCpu; iCpu++)
5288	{
5289	uint64_t CurTsc;
5290	rc = RTMpOnSpecific(RTMpCpuIdFromSetIndex(iCpu), supdrvDetermineAsyncTscWorker, &CurTsc, NULL);
5291	if (RT_SUCCESS(rc))
5292	{
5293	if (CurTsc <= PrevTsc)
5294	{
5295	fAsync = true;
5296	offMin = offMax = PrevTsc - CurTsc;
5297	Log(("supdrvDetermineAsyncTsc: iCpu=%d cLoops=%d CurTsc=%llx PrevTsc=%llx\n",
5298	iCpu, cLoops, CurTsc, PrevTsc));
5299	break;
5300	}
5301
5302	/* Gather statistics (except the first time). */
5303	if (iCpu != 0 \|\| cLoops != 7)
5304	{
5305	uint64_t off = CurTsc - PrevTsc;
5306	if (off < offMin)
5307	offMin = off;
5308	if (off > offMax)
5309	offMax = off;
5310	Log2(("%d/%d: off=%llx\n", cLoops, iCpu, off));
5311	}
5312
5313	/* Next */
5314	PrevTsc = CurTsc;
5315	}
5316	else if (rc == VERR_NOT_SUPPORTED)
5317	break;
5318	else
5319	AssertMsg(rc == VERR_CPU_NOT_FOUND \|\| rc == VERR_CPU_OFFLINE, ("%d\n", rc));
5320	}
5321
5322	/* broke out of the loop. */
5323	if (iCpu < iEndCpu)
5324	break;
5325	}
5326
5327	poffMin = offMin; / Almost RTMpOnSpecific profiling. */
5328	Log(("supdrvDetermineAsyncTsc: returns %d; iEndCpu=%d rc=%d offMin=%llx offMax=%llx\n",
5329	fAsync, iEndCpu, rc, offMin, offMax));
5330	#if !defined(RT_OS_SOLARIS) && !defined(RT_OS_OS2) && !defined(RT_OS_WINDOWS)
5331	OSDBGPRINT(("vboxdrv: fAsync=%d offMin=%#lx offMax=%#lx\n", fAsync, (long)offMin, (long)offMax));
5332	#endif
5333	return fAsync;
5334	}
5335
5336
5337	/**
5338	* Determine the GIP TSC mode.
5339	*
5340	* @returns The most suitable TSC mode.
5341	* @param pDevExt Pointer to the device instance data.
5342	*/
5343	static SUPGIPMODE supdrvGipDeterminTscMode(PSUPDRVDEVEXT pDevExt)
5344	{
5345	/*
5346	* On SMP we're faced with two problems:
5347	* (1) There might be a skew between the CPU, so that cpu0
5348	* returns a TSC that is slightly different from cpu1.
5349	* (2) Power management (and other things) may cause the TSC
5350	* to run at a non-constant speed, and cause the speed
5351	* to be different on the cpus. This will result in (1).
5352	*
5353	* So, on SMP systems we'll have to select the ASYNC update method
5354	* if there are symptoms of these problems.
5355	*/
5356	if (RTMpGetCount() > 1)
5357	{
5358	uint32_t uEAX, uEBX, uECX, uEDX;
5359	uint64_t u64DiffCoresIgnored;
5360
5361	/* Permit the user and/or the OS specific bits to force async mode. */
5362	if (supdrvOSGetForcedAsyncTscMode(pDevExt))
5363	return SUPGIPMODE_ASYNC_TSC;
5364
5365	/* Try check for current differences between the cpus. */
5366	if (supdrvDetermineAsyncTsc(&u64DiffCoresIgnored))
5367	return SUPGIPMODE_ASYNC_TSC;
5368
5369	/*
5370	* If the CPU supports power management and is an AMD one we
5371	* won't trust it unless it has the TscInvariant bit is set.
5372	*/
5373	/* Check for "AuthenticAMD" */
5374	ASMCpuId(0, &uEAX, &uEBX, &uECX, &uEDX);
5375	if ( uEAX >= 1
5376	&& uEBX == X86_CPUID_VENDOR_AMD_EBX
5377	&& uECX == X86_CPUID_VENDOR_AMD_ECX
5378	&& uEDX == X86_CPUID_VENDOR_AMD_EDX)
5379	{
5380	/* Check for APM support and that TscInvariant is cleared. */
5381	ASMCpuId(0x80000000, &uEAX, &uEBX, &uECX, &uEDX);
5382	if (uEAX >= 0x80000007)
5383	{
5384	ASMCpuId(0x80000007, &uEAX, &uEBX, &uECX, &uEDX);
5385	if ( !(uEDX & RT_BIT(8))/* TscInvariant */
5386	&& (uEDX & 0x3e)) /* STC\|TM\|THERMTRIP\|VID\|FID. Ignore TS. */
5387	return SUPGIPMODE_ASYNC_TSC;
5388	}
5389	}
5390	}
5391	return SUPGIPMODE_SYNC_TSC;
5392	}
5393
5394
5395	/**
5396	* Initializes per-CPU GIP information.
5397	*
5398	* @param pGip Pointer to the read-write kernel mapping of the GIP.
5399	* @param pCpu Pointer to which GIP CPU to initalize.
5400	* @param u64NanoTS The current nanosecond timestamp.
5401	*/
5402	static void supdrvGipInitCpu(PSUPGLOBALINFOPAGE pGip, PSUPGIPCPU pCpu, uint64_t u64NanoTS)
5403	{
5404	pCpu->u32TransactionId = 2;
5405	pCpu->u64NanoTS = u64NanoTS;
5406	pCpu->u64TSC = ASMReadTSC();
5407
5408	ASMAtomicWriteSize(&pCpu->enmState, SUPGIPCPUSTATE_INVALID);
5409	ASMAtomicWriteSize(&pCpu->idCpu, NIL_RTCPUID);
5410	ASMAtomicWriteS16(&pCpu->iCpuSet, -1);
5411	ASMAtomicWriteU16(&pCpu->idApic, UINT16_MAX);
5412
5413	/*
5414	* We don't know the following values until we've executed updates.
5415	* So, we'll just pretend it's a 4 GHz CPU and adjust the history it on
5416	* the 2nd timer callout.
5417	*/
5418	pCpu->u64CpuHz = _4G + 1; /* tstGIP-2 depends on this. */
5419	pCpu->u32UpdateIntervalTSC
5420	= pCpu->au32TSCHistory[0]
5421	= pCpu->au32TSCHistory[1]
5422	= pCpu->au32TSCHistory[2]
5423	= pCpu->au32TSCHistory[3]
5424	= pCpu->au32TSCHistory[4]
5425	= pCpu->au32TSCHistory[5]
5426	= pCpu->au32TSCHistory[6]
5427	= pCpu->au32TSCHistory[7]
5428	= (uint32_t)(_4G / pGip->u32UpdateHz);
5429	}
5430
5431
5432	/**
5433	* Initializes the GIP data.
5434	*
5435	* @param pDevExt Pointer to the device instance data.
5436	* @param pGip Pointer to the read-write kernel mapping of the GIP.
5437	* @param HCPhys The physical address of the GIP.
5438	* @param u64NanoTS The current nanosecond timestamp.
5439	* @param uUpdateHz The update frequency.
5440	* @param cCpus The CPU count.
5441	*/
5442	static void supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys,
5443	uint64_t u64NanoTS, unsigned uUpdateHz, unsigned cCpus)
5444	{
5445	size_t const cbGip = RT_ALIGN_Z(RT_OFFSETOF(SUPGLOBALINFOPAGE, aCPUs[cCpus]), PAGE_SIZE);
5446	unsigned i;
5447	#ifdef DEBUG_DARWIN_GIP
5448	OSDBGPRINT(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d cCpus=%u\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz, cCpus));
5449	#else
5450	LogFlow(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d cCpus=%u\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz, cCpus));
5451	#endif
5452
5453	/*
5454	* Initialize the structure.
5455	*/
5456	memset(pGip, 0, cbGip);
5457	pGip->u32Magic = SUPGLOBALINFOPAGE_MAGIC;
5458	pGip->u32Version = SUPGLOBALINFOPAGE_VERSION;
5459	pGip->u32Mode = supdrvGipDeterminTscMode(pDevExt);
5460	pGip->cCpus = (uint16_t)cCpus;
5461	pGip->cPages = (uint16_t)(cbGip / PAGE_SIZE);
5462	pGip->u32UpdateHz = uUpdateHz;
5463	pGip->u32UpdateIntervalNS = 1000000000 / uUpdateHz;
5464	pGip->u64NanoTSLastUpdateHz = u64NanoTS;
5465	RTCpuSetEmpty(&pGip->OnlineCpuSet);
5466	RTCpuSetEmpty(&pGip->PresentCpuSet);
5467	RTMpGetSet(&pGip->PossibleCpuSet);
5468	pGip->cOnlineCpus = RTMpGetOnlineCount();
5469	pGip->cPresentCpus = RTMpGetPresentCount();
5470	pGip->cPossibleCpus = RTMpGetCount();
5471	pGip->idCpuMax = RTMpGetMaxCpuId();
5472	for (i = 0; i < RT_ELEMENTS(pGip->aiCpuFromApicId); i++)
5473	pGip->aiCpuFromApicId[i] = 0;
5474	for (i = 0; i < RT_ELEMENTS(pGip->aiCpuFromCpuSetIdx); i++)
5475	pGip->aiCpuFromCpuSetIdx[i] = UINT16_MAX;
5476
5477	for (i = 0; i < cCpus; i++)
5478	supdrvGipInitCpu(pGip, &pGip->aCPUs[i], u64NanoTS);
5479
5480	/*
5481	* Link it to the device extension.
5482	*/
5483	pDevExt->pGip = pGip;
5484	pDevExt->HCPhysGip = HCPhys;
5485	pDevExt->cGipUsers = 0;
5486	}
5487
5488
5489	/**
5490	* On CPU initialization callback for RTMpOnAll.
5491	*
5492	* @param idCpu The CPU ID.
5493	* @param pvUser1 The device extension.
5494	* @param pvUser2 The GIP.
5495	*/
5496	static DECLCALLBACK(void) supdrvGipInitOnCpu(RTCPUID idCpu, void pvUser1, void pvUser2)
5497	{
5498	/* This is good enough, even though it will update some of the globals a
5499	bit to much. */
5500	supdrvGipMpEventOnline((PSUPDRVDEVEXT)pvUser1, idCpu);
5501	}
5502
5503
5504	/**
5505	* Invalidates the GIP data upon termination.
5506	*
5507	* @param pGip Pointer to the read-write kernel mapping of the GIP.
5508	*/
5509	static void supdrvGipTerm(PSUPGLOBALINFOPAGE pGip)
5510	{
5511	unsigned i;
5512	pGip->u32Magic = 0;
5513	for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
5514	{
5515	pGip->aCPUs[i].u64NanoTS = 0;
5516	pGip->aCPUs[i].u64TSC = 0;
5517	pGip->aCPUs[i].iTSCHistoryHead = 0;
5518	}
5519	}
5520
5521
5522	/**
5523	* Worker routine for supdrvGipUpdate and supdrvGipUpdatePerCpu that
5524	* updates all the per cpu data except the transaction id.
5525	*
5526	* @param pDevExt The device extension.
5527	* @param pGipCpu Pointer to the per cpu data.
5528	* @param u64NanoTS The current time stamp.
5529	* @param u64TSC The current TSC.
5530	* @param iTick The current timer tick.
5531	*/
5532	static void supdrvGipDoUpdateCpu(PSUPDRVDEVEXT pDevExt, PSUPGIPCPU pGipCpu, uint64_t u64NanoTS, uint64_t u64TSC, uint64_t iTick)
5533	{
5534	uint64_t u64TSCDelta;
5535	uint32_t u32UpdateIntervalTSC;
5536	uint32_t u32UpdateIntervalTSCSlack;
5537	unsigned iTSCHistoryHead;
5538	uint64_t u64CpuHz;
5539	uint32_t u32TransactionId;
5540
5541	PSUPGLOBALINFOPAGE pGip = pDevExt->pGip;
5542	AssertPtrReturnVoid(pGip);
5543
5544	/* Delta between this and the previous update. */
5545	ASMAtomicUoWriteU32(&pGipCpu->u32PrevUpdateIntervalNS, (uint32_t)(u64NanoTS - pGipCpu->u64NanoTS));
5546
5547	/*
5548	* Update the NanoTS.
5549	*/
5550	ASMAtomicWriteU64(&pGipCpu->u64NanoTS, u64NanoTS);
5551
5552	/*
5553	* Calc TSC delta.
5554	*/
5555	/** @todo validate the NanoTS delta, don't trust the OS to call us when it should... */
5556	u64TSCDelta = u64TSC - pGipCpu->u64TSC;
5557	ASMAtomicWriteU64(&pGipCpu->u64TSC, u64TSC);
5558
5559	if (u64TSCDelta >> 32)
5560	{
5561	u64TSCDelta = pGipCpu->u32UpdateIntervalTSC;
5562	pGipCpu->cErrors++;
5563	}
5564
5565	/*
5566	* On the 2nd and 3rd callout, reset the history with the current TSC
5567	* interval since the values entered by supdrvGipInit are totally off.
5568	* The interval on the 1st callout completely unreliable, the 2nd is a bit
5569	* better, while the 3rd should be most reliable.
5570	*/
5571	u32TransactionId = pGipCpu->u32TransactionId;
5572	if (RT_UNLIKELY( ( u32TransactionId == 5
5573	\|\| u32TransactionId == 7)
5574	&& ( iTick == 2
5575	\|\| iTick == 3) ))
5576	{
5577	unsigned i;
5578	for (i = 0; i < RT_ELEMENTS(pGipCpu->au32TSCHistory); i++)
5579	ASMAtomicUoWriteU32(&pGipCpu->au32TSCHistory[i], (uint32_t)u64TSCDelta);
5580	}
5581
5582	/*
5583	* TSC History.
5584	*/
5585	Assert(RT_ELEMENTS(pGipCpu->au32TSCHistory) == 8);
5586	iTSCHistoryHead = (pGipCpu->iTSCHistoryHead + 1) & 7;
5587	ASMAtomicWriteU32(&pGipCpu->iTSCHistoryHead, iTSCHistoryHead);
5588	ASMAtomicWriteU32(&pGipCpu->au32TSCHistory[iTSCHistoryHead], (uint32_t)u64TSCDelta);
5589
5590	/*
5591	* UpdateIntervalTSC = average of last 8,2,1 intervals depending on update HZ.
5592	*/
5593	if (pGip->u32UpdateHz >= 1000)
5594	{
5595	uint32_t u32;
5596	u32 = pGipCpu->au32TSCHistory[0];
5597	u32 += pGipCpu->au32TSCHistory[1];
5598	u32 += pGipCpu->au32TSCHistory[2];
5599	u32 += pGipCpu->au32TSCHistory[3];
5600	u32 >>= 2;
5601	u32UpdateIntervalTSC = pGipCpu->au32TSCHistory[4];
5602	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[5];
5603	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[6];
5604	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[7];
5605	u32UpdateIntervalTSC >>= 2;
5606	u32UpdateIntervalTSC += u32;
5607	u32UpdateIntervalTSC >>= 1;
5608
5609	/* Value chosen for a 2GHz Athlon64 running linux 2.6.10/11, . */
5610	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 14;
5611	}
5612	else if (pGip->u32UpdateHz >= 90)
5613	{
5614	u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
5615	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[(iTSCHistoryHead - 1) & 7];
5616	u32UpdateIntervalTSC >>= 1;
5617
5618	/* value chosen on a 2GHz thinkpad running windows */
5619	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 7;
5620	}
5621	else
5622	{
5623	u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
5624
5625	/* This value hasn't be checked yet.. waiting for OS/2 and 33Hz timers.. :-) */
5626	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 6;
5627	}
5628	ASMAtomicWriteU32(&pGipCpu->u32UpdateIntervalTSC, u32UpdateIntervalTSC + u32UpdateIntervalTSCSlack);
5629
5630	/*
5631	* CpuHz.
5632	*/
5633	u64CpuHz = ASMMult2xU32RetU64(u32UpdateIntervalTSC, pGip->u32UpdateHz);
5634	ASMAtomicWriteU64(&pGipCpu->u64CpuHz, u64CpuHz);
5635	}
5636
5637
5638	/**
5639	* Updates the GIP.
5640	*
5641	* @param pDevExt The device extension.
5642	* @param u64NanoTS The current nanosecond timesamp.
5643	* @param u64TSC The current TSC timesamp.
5644	* @param idCpu The CPU ID.
5645	* @param iTick The current timer tick.
5646	*/
5647	static void supdrvGipUpdate(PSUPDRVDEVEXT pDevExt, uint64_t u64NanoTS, uint64_t u64TSC, RTCPUID idCpu, uint64_t iTick)
5648	{
5649	/*
5650	* Determine the relevant CPU data.
5651	*/
5652	PSUPGIPCPU pGipCpu;
5653	PSUPGLOBALINFOPAGE pGip = pDevExt->pGip;
5654	AssertPtrReturnVoid(pGip);
5655
5656	if (pGip->u32Mode != SUPGIPMODE_ASYNC_TSC)
5657	pGipCpu = &pGip->aCPUs[0];
5658	else
5659	{
5660	unsigned iCpu = pGip->aiCpuFromApicId[ASMGetApicId()];
5661	if (RT_UNLIKELY(iCpu >= pGip->cCpus))
5662	return;
5663	pGipCpu = &pGip->aCPUs[iCpu];
5664	if (RT_UNLIKELY(pGipCpu->idCpu != idCpu))
5665	return;
5666	}
5667
5668	/*
5669	* Start update transaction.
5670	*/
5671	if (!(ASMAtomicIncU32(&pGipCpu->u32TransactionId) & 1))
5672	{
5673	/* this can happen on win32 if we're taking to long and there are more CPUs around. shouldn't happen though. */
5674	AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGipCpu->u32TransactionId));
5675	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5676	pGipCpu->cErrors++;
5677	return;
5678	}
5679
5680	/*
5681	* Recalc the update frequency every 0x800th time.
5682	*/
5683	if (!(pGipCpu->u32TransactionId & (GIP_UPDATEHZ_RECALC_FREQ * 2 - 2)))
5684	{
5685	if (pGip->u64NanoTSLastUpdateHz)
5686	{
5687	#ifdef RT_ARCH_AMD64 /** @todo fix 64-bit div here to work on x86 linux. */
5688	uint64_t u64Delta = u64NanoTS - pGip->u64NanoTSLastUpdateHz;
5689	uint32_t u32UpdateHz = (uint32_t)((UINT64_C(1000000000) * GIP_UPDATEHZ_RECALC_FREQ) / u64Delta);
5690	if (u32UpdateHz <= 2000 && u32UpdateHz >= 30)
5691	{
5692	ASMAtomicWriteU32(&pGip->u32UpdateHz, u32UpdateHz);
5693	ASMAtomicWriteU32(&pGip->u32UpdateIntervalNS, 1000000000 / u32UpdateHz);
5694	}
5695	#endif
5696	}
5697	ASMAtomicWriteU64(&pGip->u64NanoTSLastUpdateHz, u64NanoTS);
5698	}
5699
5700	/*
5701	* Update the data.
5702	*/
5703	supdrvGipDoUpdateCpu(pDevExt, pGipCpu, u64NanoTS, u64TSC, iTick);
5704
5705	/*
5706	* Complete transaction.
5707	*/
5708	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5709	}
5710
5711
5712	/**
5713	* Updates the per cpu GIP data for the calling cpu.
5714	*
5715	* @param pDevExt The device extension.
5716	* @param u64NanoTS The current nanosecond timesamp.
5717	* @param u64TSC The current TSC timesamp.
5718	* @param idCpu The CPU ID.
5719	* @param idApic The APIC id for the CPU index.
5720	* @param iTick The current timer tick.
5721	*/
5722	static void supdrvGipUpdatePerCpu(PSUPDRVDEVEXT pDevExt, uint64_t u64NanoTS, uint64_t u64TSC,
5723	RTCPUID idCpu, uint8_t idApic, uint64_t iTick)
5724	{
5725	uint32_t iCpu;
5726	PSUPGLOBALINFOPAGE pGip = pDevExt->pGip;
5727
5728	/*
5729	* Avoid a potential race when a CPU online notification doesn't fire on
5730	* the onlined CPU but the tick creeps in before the event notification is
5731	* run.
5732	*/
5733	if (RT_UNLIKELY(iTick == 1))
5734	{
5735	iCpu = supdrvGipCpuIndexFromCpuId(pGip, idCpu);
5736	if (pGip->aCPUs[iCpu].enmState == SUPGIPCPUSTATE_OFFLINE)
5737	supdrvGipMpEventOnline(pDevExt, idCpu);
5738	}
5739
5740	iCpu = pGip->aiCpuFromApicId[idApic];
5741	if (RT_LIKELY(iCpu < pGip->cCpus))
5742	{
5743	PSUPGIPCPU pGipCpu = &pGip->aCPUs[iCpu];
5744	if (pGipCpu->idCpu == idCpu)
5745	{
5746	/*
5747	* Start update transaction.
5748	*/
5749	if (!(ASMAtomicIncU32(&pGipCpu->u32TransactionId) & 1))
5750	{
5751	AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGipCpu->u32TransactionId));
5752	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5753	pGipCpu->cErrors++;
5754	return;
5755	}
5756
5757	/*
5758	* Update the data.
5759	*/
5760	supdrvGipDoUpdateCpu(pDevExt, pGipCpu, u64NanoTS, u64TSC, iTick);
5761
5762	/*
5763	* Complete transaction.
5764	*/
5765	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5766	}
5767	}
5768	}
5769

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPDrv.c@ 40777

Download in other formats: