Changeset 106022 in vbox for trunk/src/VBox

Timestamp:

Sep 12, 2024 9:44:36 AM (3 months ago)

Author:

vboxsync

Message:

VMM/PDM: Added PDMR3DriverEnumInstances for use by Console::i_onNATDnsChanged, introducing a read/write lock for the core PDM lists (devices, drivers, usb devices, and more). Medium risk since it involves new locking.

Location:

trunk/src/VBox/VMM

Files:

• VMMR3/PDM.cpp (modified) (54 diffs)
• VMMR3/PDMDevHlp.cpp (modified) (40 diffs)
• VMMR3/PDMDevice.cpp (modified) (27 diffs)
• VMMR3/PDMDriver.cpp (modified) (42 diffs)
• VMMR3/PDMUsb.cpp (modified) (41 diffs)
• VMMR3/VMMR3.def (modified) (1 diff)
• include/PDMInternal.h (modified) (7 diffs)

trunk/src/VBox/VMM/VMMR3/PDM.cpp

@@ -462 +462 @@
     pUVM->pdm.s.pCritSects = NULL;
     pUVM->pdm.s.pRwCritSects = NULL;
-    return RTCritSectInit(&pUVM->pdm.s.ListCritSect);
+    return RTCritSectInitNamed(&pUVM->pdm.s.ListCritSect, "PDM-ListCritSect");
 }
 
@@ -502 +502 @@
             pVM->pdm.s.NopCritSect.s.Core.fFlags |= RTCRITSECT_FLAGS_NOP;
     }
+    if (RT_SUCCESS(rc))
+        rc = RTCritSectRwInitNamed(&pVM->pdm.s.CoreListCritSectRw, "PDM-CoreListCritSectRw");
 
     /*
@@ -614 +616 @@
         pVM->pdm.s.IoApic.pfnSetIrqRC       += offDelta;
         if (pVM->pdm.s.IoApic.pfnSendMsiRC)
-            pVM->pdm.s.IoApic.pfnSendMsiRC      += offDelta;
+            pVM->pdm.s.IoApic.pfnSendMsiRC  += offDelta;
         if (pVM->pdm.s.IoApic.pfnSetEoiRC)
-            pVM->pdm.s.IoApic.pfnSetEoiRC       += offDelta;
+            pVM->pdm.s.IoApic.pfnSetEoiRC   += offDelta;
     }
 
@@ -637 +639 @@
     }
 
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
     {
@@ -690 +693 @@
 
     }
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
+
 #endif /* VBOX_WITH_RAW_MODE_KEEP */
 }
@@ -696 +701 @@
 /**
  * Worker for pdmR3Term that terminates a LUN chain.
+ *
+ * @note    Caller owns CoreListCritSectRw in exclusive mode.
+ *          Will temporarily leave and retake the lock when calling destructors.
  *
  * @param   pVM         The cross context VM structure.
@@ -722 +730 @@
                 LogFlow(("pdmR3DevTerm: Destroying - driver '%s'/%d on LUN#%d of device '%s'/%d\n",
                          pDrvIns->pReg->szName, pDrvIns->iInstance, pLun->iLun, pszDevice, iInstance));
+                RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
                 pDrvIns->pReg->pfnDestruct(pDrvIns);
+                RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
             }
             pDrvIns->Internal.s.pDrv->cInstances--;
@@ -769 +779 @@
      *      from any MM heap since MM will do that in its Term function.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     /* usb ones first. */
     for (PPDMUSBINS pUsbIns = pVM->pdm.s.pUsbInstances; pUsbIns; pUsbIns = pUsbIns->Internal.s.pNext)
@@ -781 +793 @@
         if (pHub)
         {
+            RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
             int rc = pHub->Reg.pfnDetachDevice(pHub->pDrvIns, pUsbIns, pUsbIns->Internal.s.iPort);
-            if (RT_FAILURE(rc))
-            {
-                LogRel(("PDM: Failed to detach USB device '%s' instance %d from %p: %Rrc\n",
-                        pUsbIns->pReg->szName, pUsbIns->iInstance, pHub, rc));
-            }
-            else
+            RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+            if (RT_SUCCESS(rc))
             {
                 pHub->cAvailablePorts++;
@@ -793 +802 @@
                 pUsbIns->Internal.s.pHub = NULL;
             }
-        }
+            else
+                LogRel(("PDM: Failed to detach USB device '%s' instance %d from %p: %Rrc\n",
+                        pUsbIns->pReg->szName, pUsbIns->iInstance, pHub, rc));
+        }
+
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
         if (pUsbIns->pReg->pfnDestruct)
         {
-            LogFlow(("pdmR3DevTerm: Destroying - device '%s'/%d\n",
-                     pUsbIns->pReg->szName, pUsbIns->iInstance));
+            LogFlow(("pdmR3DevTerm: Destroying - device '%s'/%d\n", pUsbIns->pReg->szName, pUsbIns->iInstance));
             pUsbIns->pReg->pfnDestruct(pUsbIns);
         }
@@ -811 +824 @@
             pUsbIns->pszName = NULL;
         }
+
+        RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
     }
 
@@ -821 +836 @@
         {
             LogFlow(("pdmR3DevTerm: Destroying - device '%s'/%d\n", pDevIns->pReg->szName, pDevIns->iInstance));
+            RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
             pDevIns->pReg->pfnDestruct(pDevIns);
+            RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
         }
 
@@ -851 +868 @@
         }
 #endif
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
         TMR3TimerDestroyDevice(pVM, pDevIns);
@@ -864 +882 @@
 #endif
         DBGFR3InfoDeregisterDevice(pVM, pDevIns, NULL);
-    }
+
+        RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+    }
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     /*
@@ -909 +931 @@
     PDMR3CritSectDelete(pVM, &pVM->pdm.s.CritSect);
     /* The MiscCritSect is deleted by PDMR3CritSectBothTerm later. */
+
+    if (RTCritSectRwIsInitialized(&pVM->pdm.s.CoreListCritSectRw))
+        RTCritSectRwDelete(&pVM->pdm.s.CoreListCritSectRw);
 
     LogFlow(("PDMR3Term: returns %Rrc\n", VINF_SUCCESS));
@@ -1216 +1241 @@
      * Load the list of devices and verify that they are all there.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
         pDevIns->Internal.s.fIntFlags &= ~PDMDEVINSINT_FLAGS_FOUND;
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     for (uint32_t i = 0; ; i++)
@@ -1242 +1269 @@
 
         /* Try locate it. */
+        RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
         PPDMDEVINS pDevIns;
         for (pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
@@ -1247 +1275 @@
                 && pDevIns->iInstance == iInstance)
             {
-                AssertLogRelMsgReturn(!(pDevIns->Internal.s.fIntFlags & PDMDEVINSINT_FLAGS_FOUND),
-                                      ("%s/#%u\n", pDevIns->pReg->szName, pDevIns->iInstance),
-                                      VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
+                AssertLogRelMsgReturnStmt(!(pDevIns->Internal.s.fIntFlags & PDMDEVINSINT_FLAGS_FOUND),
+                                          ("%s/#%u\n", pDevIns->pReg->szName, pDevIns->iInstance),
+                                          RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw),
+                                          VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
                 pDevIns->Internal.s.fIntFlags |= PDMDEVINSINT_FLAGS_FOUND;
                 break;
             }
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
         if (!pDevIns)
@@ -1275 +1305 @@
      * Check that no additional devices were configured.
      */
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
         if (!(pDevIns->Internal.s.fIntFlags & PDMDEVINSINT_FLAGS_FOUND))
@@ -1285 +1316 @@
              */
             if (   SSMR3HandleGetAfter(pSSM) != SSMAFTER_DEBUG_IT
-                && RTStrCmp(pDevIns->pReg->szName, "tpm-ppi"))
+                && RTStrCmp(pDevIns->pReg->szName, "tpm-ppi") /* !!HACK ALERT!! - ugly, see todo above */)
+            {
+                RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                 return SSMR3SetCfgError(pSSM, RT_SRC_POS, N_("Device '%s'/%d not found in the saved state"),
                                         pDevIns->pReg->szName, pDevIns->iInstance);
-        }
-
+            }
+        }
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
 
     /*
@@ -1393 +1427 @@
      * processing the drivers associated with those.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+    /** @todo locking   */
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
     int rc = VINF_SUCCESS;
     for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances;  pDevIns && RT_SUCCESS(rc);  pDevIns = pDevIns->Internal.s.pNextR3)
@@ -1718 +1755 @@
      * Clear all the reset flags.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
     {
@@ -1734 +1772 @@
     }
 #endif
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     /*
@@ -1748 +1787 @@
          * processing the drivers associated with those.
          */
+        /** @todo locking   */
         for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
         {
@@ -2080 +2120 @@
          * taking any. (DrvVD changes to read-only in this particular case.)
          */
+        RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+        /** @todo locking   */
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
         for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
         {
@@ -2223 +2266 @@
      * processing the drivers associated with those.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+    /** @todo locking   */
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
     int rc = VINF_SUCCESS;
-    for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances;  pDevIns && RT_SUCCESS(rc);  pDevIns = pDevIns->Internal.s.pNextR3)
-    {
-        for (PPDMLUN pLun = pDevIns->Internal.s.pLunsR3;  pLun && RT_SUCCESS(rc);  pLun    = pLun->pNext)
-            for (PPDMDRVINS pDrvIns = pLun->pTop;  pDrvIns && RT_SUCCESS(rc);  pDrvIns = pDrvIns->Internal.s.pDown)
+    for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns && RT_SUCCESS(rc); pDevIns = pDevIns->Internal.s.pNextR3)
+    {
+        for (PPDMLUN pLun = pDevIns->Internal.s.pLunsR3; pLun && RT_SUCCESS(rc); pLun = pLun->pNext)
+            for (PPDMDRVINS pDrvIns = pLun->pTop; pDrvIns && RT_SUCCESS(rc); pDrvIns = pDrvIns->Internal.s.pDown)
                 rc = pdmR3ResumeDrv(pDrvIns, pDevIns->pReg->szName, pDevIns->iInstance, pLun->iLun);
         if (RT_SUCCESS(rc))
@@ -2234 +2280 @@
 
 #ifdef VBOX_WITH_USB
-    for (PPDMUSBINS pUsbIns = pVM->pdm.s.pUsbInstances;  pUsbIns && RT_SUCCESS(rc);  pUsbIns = pUsbIns->Internal.s.pNext)
-    {
-        for (PPDMLUN pLun = pUsbIns->Internal.s.pLuns;  pLun && RT_SUCCESS(rc);  pLun = pLun->pNext)
-            for (PPDMDRVINS pDrvIns = pLun->pTop;  pDrvIns && RT_SUCCESS(rc);  pDrvIns = pDrvIns->Internal.s.pDown)
+    for (PPDMUSBINS pUsbIns = pVM->pdm.s.pUsbInstances; pUsbIns && RT_SUCCESS(rc); pUsbIns = pUsbIns->Internal.s.pNext)
+    {
+        for (PPDMLUN pLun = pUsbIns->Internal.s.pLuns; pLun && RT_SUCCESS(rc); pLun = pLun->pNext)
+            for (PPDMDRVINS pDrvIns = pLun->pTop; pDrvIns && RT_SUCCESS(rc); pDrvIns = pDrvIns->Internal.s.pDown)
                 rc = pdmR3ResumeDrv(pDrvIns, pUsbIns->pReg->szName, pUsbIns->iInstance, pLun->iLun);
         if (RT_SUCCESS(rc))
@@ -2426 +2472 @@
      * be called in any case.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
     {
@@ -2445 +2492 @@
     }
 #endif
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     /*
@@ -2464 +2512 @@
          * taking any. (DrvVD changes to read-only in this particular case.)
          */
+        /** @todo locking   */
         for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
         {
@@ -2530 +2579 @@
     LogFlow(("PDMR3DeviceQuery: pszDevice=%p:{%s} iInstance=%u ppBase=%p\n", pszDevice, pszDevice, iInstance, ppBase));
     UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
-    VM_ASSERT_VALID_EXT_RETURN(pUVM->pVM, VERR_INVALID_VM_HANDLE);
+    PVM const pVM = pUVM->pVM;
+    VM_ASSERT_VALID_EXT_RETURN(pVM, VERR_INVALID_VM_HANDLE);
 
     /*
      * Iterate registered devices looking for the device.
      */
-    size_t cchDevice = strlen(pszDevice);
-    for (PPDMDEV pDev = pUVM->pVM->pdm.s.pDevs; pDev; pDev = pDev->pNext)
+    size_t const cchDevice = strlen(pszDevice);
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
+    for (PPDMDEV pDev = pVM->pdm.s.pDevs; pDev; pDev = pDev->pNext)
     {
         if (    pDev->cchName == cchDevice
@@ -2551 +2602 @@
                     {
                         *ppBase = &pDevIns->IBase;
+                        RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                         LogFlow(("PDMR3DeviceQuery: return VINF_SUCCESS and *ppBase=%p\n", *ppBase));
                         return VINF_SUCCESS;
                     }
 
+                    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                     LogFlow(("PDMR3DeviceQuery: returns VERR_PDM_DEVICE_INSTANCE_NO_IBASE\n"));
                     return VERR_PDM_DEVICE_INSTANCE_NO_IBASE;
@@ -2560 +2613 @@
             }
 
+            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
             LogFlow(("PDMR3DeviceQuery: returns VERR_PDM_DEVICE_INSTANCE_NOT_FOUND\n"));
             return VERR_PDM_DEVICE_INSTANCE_NOT_FOUND;
@@ -2565 +2619 @@
     }
 
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     LogFlow(("PDMR3QueryDevice: returns VERR_PDM_DEVICE_NOT_FOUND\n"));
     return VERR_PDM_DEVICE_NOT_FOUND;
@@ -2631 +2686 @@
      * Find the LUN.
      */
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     PPDMLUN pLun;
     int rc = pdmR3DevFindLun(pVM, pszDevice, iInstance, iLun, &pLun);
@@ -2638 +2694 @@
         {
             *ppBase = &pLun->pTop->IBase;
+            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
             LogFlow(("PDMR3QueryLun: return %Rrc and *ppBase=%p\n", VINF_SUCCESS, *ppBase));
             return VINF_SUCCESS;
@@ -2643 +2700 @@
         rc = VERR_PDM_NO_DRIVER_ATTACHED_TO_LUN;
     }
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     LogFlow(("PDMR3QueryLun: returns %Rrc\n", rc));
     return rc;
@@ -2669 +2727 @@
     LogFlow(("PDMR3QueryDriverOnLun: pszDevice=%p:{%s} iInstance=%u iLun=%u pszDriver=%p:{%s} ppBase=%p\n",
              pszDevice, pszDevice, iInstance, iLun, pszDriver, pszDriver, ppBase));
+    *ppBase = NULL;
     UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
-    VM_ASSERT_VALID_EXT_RETURN(pUVM->pVM, VERR_INVALID_VM_HANDLE);
+    PVM const pVM = pUVM->pVM;
+    VM_ASSERT_VALID_EXT_RETURN(pVM, VERR_INVALID_VM_HANDLE);
 
     /*
      * Find the LUN.
      */
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     PPDMLUN pLun;
-    int rc = pdmR3DevFindLun(pUVM->pVM, pszDevice, iInstance, iLun, &pLun);
+    int rc = pdmR3DevFindLun(pVM, pszDevice, iInstance, iLun, &pLun);
     if (RT_SUCCESS(rc))
     {
@@ -2685 +2746 @@
                 {
                     *ppBase = &pDrvIns->IBase;
+                    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                     LogFlow(("PDMR3QueryDriverOnLun: return %Rrc and *ppBase=%p\n", VINF_SUCCESS, *ppBase));
                     return VINF_SUCCESS;
-
                 }
             rc = VERR_PDM_DRIVER_NOT_FOUND;
@@ -2694 +2755 @@
             rc = VERR_PDM_NO_DRIVER_ATTACHED_TO_LUN;
     }
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     LogFlow(("PDMR3QueryDriverOnLun: returns %Rrc\n", rc));
     return rc;
 }
 
+
 /**
  * Executes pending DMA transfers.
@@ -2706 +2769 @@
 VMMR3DECL(void) PDMR3DmaRun(PVM pVM)
 {
+    /** @todo this is bad in SMP... */
     /* Note! Not really SMP safe; restrict it to VCPU 0. */
     if (VMMGetCpuId(pVM) != 0)
@@ -2712 +2776 @@
     if (VM_FF_TEST_AND_CLEAR(pVM, VM_FF_PDM_DMA))
     {
-        if (pVM->pdm.s.pDmac)
-        {
-            bool fMore = pVM->pdm.s.pDmac->Reg.pfnRun(pVM->pdm.s.pDmac->pDevIns);
+        PPDMDMAC const pDmac = pVM->pdm.s.pDmac;
+        if (pDmac)
+        {
+            bool const fMore = pDmac->Reg.pfnRun(pDmac->pDevIns);
             if (fMore)
                 VM_FF_SET(pVM, VM_FF_PDM_DMA);
@@ -2793 +2858 @@
     {
         AssertReturn(fApply, VINF_SUCCESS);
+        RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
 
         for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
@@ -2812 +2878 @@
         }
 #endif
+
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
         return VINF_SUCCESS;
     }
@@ -2825 +2893 @@
     if (!strncmp("dev", pszName, 3))
     {
+        RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw); /* Shared-mode is sufficient for this. */
         for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
         {
@@ -2842 +2911 @@
     else if (!strncmp("usb", pszName, 3))
     {
+        RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw); /* Shared-mode is sufficient for this. */
         for (PPDMUSBINS pUsbIns = pVM->pdm.s.pUsbInstances; pUsbIns; pUsbIns = pUsbIns->Internal.s.pNext)
         {
@@ -2860 +2930 @@
     {
         AssertReturn(fApply, VINF_SUCCESS);
+        RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw); /* Shared-mode is sufficient for this. */
 
         for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
@@ -2896 +2967 @@
                 }
 #endif
+
     }
     else
         return VERR_NOT_FOUND;
 
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     return cMatches > 0 ? VINF_SUCCESS : VERR_NOT_FOUND;
 }
@@ -2914 +2987 @@
 VMMR3_INT_DECL(bool) PDMR3TracingAreAll(PVM pVM, bool fEnabled)
 {
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
+
     for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
     {
         if (pDevIns->fTracing != (uint32_t)fEnabled)
+        {
+            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
             return false;
+        }
 
         for (PPDMLUN pLun = pDevIns->Internal.s.pLunsR3; pLun; pLun = pLun->pNext)
             for (PPDMDRVINS pDrvIns = pLun->pTop; pDrvIns; pDrvIns = pDrvIns->Internal.s.pDown)
                 if (pDrvIns->fTracing != (uint32_t)fEnabled)
+                {
+                    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                     return false;
+                }
     }
 
@@ -2929 +3010 @@
     {
         if (pUsbIns->fTracing != (uint32_t)fEnabled)
+        {
+            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
             return false;
+        }
 
         for (PPDMLUN pLun = pUsbIns->Internal.s.pLuns; pLun; pLun = pLun->pNext)
             for (PPDMDRVINS pDrvIns = pLun->pTop; pDrvIns; pDrvIns = pDrvIns->Internal.s.pDown)
                 if (pDrvIns->fTracing != (uint32_t)fEnabled)
+                {
+                    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                     return false;
+                }
     }
 #endif
 
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     return true;
 }
@@ -2991 +3079 @@
 VMMR3_INT_DECL(int) PDMR3TracingQueryConfig(PVM pVM, char *pszConfig, size_t cbConfig)
 {
-    int     rc;
     char   *pszDst = pszConfig;
     size_t  cbDst  = cbConfig;
 
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
+
     for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
     {
         if (pDevIns->fTracing)
         {
-            rc = pdmR3TracingAdd(&pszDst, &cbDst, pszDst != pszConfig, "dev", pDevIns->Internal.s.pDevR3->pReg->szName);
+            int rc = pdmR3TracingAdd(&pszDst, &cbDst, pszDst != pszConfig, "dev", pDevIns->Internal.s.pDevR3->pReg->szName);
             if (RT_FAILURE(rc))
+            {
+                RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                 return rc;
+            }
         }
 
@@ -3008 +3100 @@
                 if (pDrvIns->fTracing)
                 {
-                    rc = pdmR3TracingAdd(&pszDst, &cbDst, pszDst != pszConfig, "drv", pDrvIns->Internal.s.pDrv->pReg->szName);
+                    int rc = pdmR3TracingAdd(&pszDst, &cbDst, pszDst != pszConfig, "drv", pDrvIns->Internal.s.pDrv->pReg->szName);
                     if (RT_FAILURE(rc))
+                    {
+                        RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                         return rc;
+                    }
                 }
     }
@@ -3019 +3114 @@
         if (pUsbIns->fTracing)
         {
-            rc = pdmR3TracingAdd(&pszDst, &cbDst, pszDst != pszConfig, "usb", pUsbIns->Internal.s.pUsbDev->pReg->szName);
+            int rc = pdmR3TracingAdd(&pszDst, &cbDst, pszDst != pszConfig, "usb", pUsbIns->Internal.s.pUsbDev->pReg->szName);
             if (RT_FAILURE(rc))
+            {
+                RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                 return rc;
+            }
         }
 
@@ -3028 +3126 @@
                 if (pDrvIns->fTracing)
                 {
-                    rc = pdmR3TracingAdd(&pszDst, &cbDst, pszDst != pszConfig, "drv", pDrvIns->Internal.s.pDrv->pReg->szName);
+                    int rc = pdmR3TracingAdd(&pszDst, &cbDst, pszDst != pszConfig, "drv", pDrvIns->Internal.s.pDrv->pReg->szName);
                     if (RT_FAILURE(rc))
+                    {
+                        RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                         return rc;
+                    }
                 }
     }
 #endif
 
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     return VINF_SUCCESS;
 }

trunk/src/VBox/VMM/VMMR3/PDMDevHlp.cpp

@@ -181 +181 @@
 
 /** @interface_method_impl{PDMDEVHLPR3,pfnMmioCreateEx} */
-static DECLCALLBACK(int) pdmR3DevHlp_MmioCreateEx(PPDMDEVINS pDevIns, RTGCPHYS cbRegion,
-                                                  uint32_t fFlags, PPDMPCIDEV pPciDev, uint32_t iPciRegion,
-                                                  PFNIOMMMIONEWWRITE pfnWrite, PFNIOMMMIONEWREAD pfnRead, PFNIOMMMIONEWFILL pfnFill,
+static DECLCALLBACK(int) pdmR3DevHlp_MmioCreateEx(PPDMDEVINS pDevIns, RTGCPHYS cbRegion, uint32_t fFlags,
+                                                  PPDMPCIDEV pPciDev, uint32_t iPciRegion, PFNIOMMMIONEWWRITE pfnWrite,
+                                                  PFNIOMMMIONEWREAD pfnRead, PFNIOMMMIONEWFILL pfnFill,
                                                   void *pvUser, const char *pszDesc, PIOMMMIOHANDLE phRegion)
 {
@@ -2599 +2599 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    PVM pVM = pDevIns->Internal.s.pVMR3;
+    PVM const pVM = pDevIns->Internal.s.pVMR3;
     VM_ASSERT_EMT(pVM);
     LogFlow(("pdmR3DevHlp_DriverAttach: caller='%s'/%d: iLun=%d pBaseInterface=%p ppBaseInterface=%p pszDesc=%p:{%s}\n",
@@ -2607 +2607 @@
      * Lookup the LUN, it might already be registered.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     PPDMLUN pLunPrev = NULL;
     PPDMLUN pLun = pDevIns->Internal.s.pLunsR3;
@@ -2618 +2620 @@
     if (!pLun)
     {
-        if (    !pBaseInterface
-            ||  !pszDesc
-            ||  !*pszDesc)
+        if (   !pBaseInterface
+            || !pszDesc
+            || !*pszDesc)
         {
+            RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
             Assert(pBaseInterface);
             Assert(pszDesc || *pszDesc);
@@ -2629 +2632 @@
         pLun = (PPDMLUN)MMR3HeapAlloc(pVM, MM_TAG_PDM_LUN, sizeof(*pLun));
         if (!pLun)
+        {
+            RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
             return VERR_NO_MEMORY;
+        }
 
         pLun->iLun      = iLun;
@@ -2648 +2654 @@
     else if (pLun->pTop)
     {
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
         AssertMsgFailed(("Already attached! The device should keep track of such things!\n"));
         LogFlow(("pdmR3DevHlp_DriverAttach: caller='%s'/%d: returns %Rrc\n", pDevIns->pReg->szName, pDevIns->iInstance, VERR_PDM_DRIVER_ALREADY_ATTACHED));
@@ -2659 +2666 @@
      */
     int rc;
-    PCFGMNODE pNode = CFGMR3GetChildF(pDevIns->Internal.s.pCfgHandle, "LUN#%u", iLun);
+    PCFGMNODE const pNode = CFGMR3GetChildF(pDevIns->Internal.s.pCfgHandle, "LUN#%u", iLun);
     if (pNode)
         rc = pdmR3DrvInstantiate(pVM, pNode, pBaseInterface, NULL /*pDrvAbove*/, pLun, ppBaseInterface);
@@ -2665 +2672 @@
         rc = VERR_PDM_NO_ATTACHED_DRIVER;
 
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     LogFlow(("pdmR3DevHlp_DriverAttach: caller='%s'/%d: returns %Rrc\n", pDevIns->pReg->szName, pDevIns->iInstance, rc));
     return rc;
@@ -2677 +2686 @@
              pDevIns->pReg->szName, pDevIns->iInstance, pDrvIns));
 
-#ifdef VBOX_STRICT
-    PVM pVM = pDevIns->Internal.s.pVMR3;
+    PVM const pVM = pDevIns->Internal.s.pVMR3;
     VM_ASSERT_EMT(pVM);
-#endif
-
-    int rc = pdmR3DrvDetach(pDrvIns, fFlags);
+
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+    int rc = pdmR3DrvDetach(pVM, pDrvIns, fFlags);
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     LogFlow(("pdmR3DevHlp_DriverDetach: caller='%s'/%d: returns %Rrc\n", pDevIns->pReg->szName, pDevIns->iInstance, rc));
@@ -2694 +2703 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    PVM pVM = pDevIns->Internal.s.pVMR3;
+    PVM const pVM = pDevIns->Internal.s.pVMR3;
     VM_ASSERT_EMT(pVM);
     LogFlow(("pdmR3DevHlp_DriverReconfigure: caller='%s'/%d: iLun=%u cDepth=%u fFlags=%#x\n",
@@ -2715 +2724 @@
     }
     AssertReturn(fFlags == 0, VERR_INVALID_FLAGS);
+
+    /*
+     * Exclusively lock the core stuff (mind, pdmR3DrvDetach will leave + reenter).
+     */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     /*
@@ -2724 +2738 @@
             if (pLun->pTop)
             {
-                int rc = pdmR3DrvDetach(pLun->pTop, 0);
-                AssertRCReturn(rc, rc);
+                int rc = pdmR3DrvDetach(pVM, pLun->pTop, 0);
+                AssertRCReturnStmt(rc, RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw), rc);
             }
             break;
@@ -2767 +2781 @@
     }
 
+    /* Keep the lock till the end to serialize the CFGM changes. */
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
     LogFlow(("pdmR3DevHlp_DriverReconfigure: caller='%s'/%d: returns %Rrc\n", pDevIns->pReg->szName, pDevIns->iInstance, rc));
     return rc;
@@ -3513 +3529 @@
      * Only one DMA device.
      */
-    PVM pVM = pDevIns->Internal.s.pVMR3;
-    if (pVM->pdm.s.pRtc)
+    PVM const pVM = pDevIns->Internal.s.pVMR3;
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
+    int rc = VINF_SUCCESS;
+    if (!pVM->pdm.s.pRtc)
+    {
+        /*
+         * Allocate and initialize pci bus structure.
+         */
+        PPDMRTC pRtc = (PPDMRTC)MMR3HeapAlloc(pDevIns->Internal.s.pVMR3, MM_TAG_PDM_DEVICE, sizeof(*pRtc));
+        if (pRtc)
+        {
+            pRtc->pDevIns   = pDevIns;
+            pRtc->Reg       = *pRtcReg;
+            pVM->pdm.s.pRtc = pRtc;
+
+            /* set the helper pointer. */
+            *ppRtcHlp = &g_pdmR3DevRtcHlp;
+            Log(("PDM: Registered RTC device '%s'/%d pDevIns=%p\n",
+                 pDevIns->pReg->szName, pDevIns->iInstance, pDevIns));
+        }
+        else
+            rc = VERR_NO_MEMORY;
+    }
+    else
     {
         AssertMsgFailed(("Only one RTC device is supported!\n"));
-        LogFlow(("pdmR3DevHlp_RTCRegister: caller='%s'/%d: returns %Rrc\n",
-                 pDevIns->pReg->szName, pDevIns->iInstance, VERR_INVALID_PARAMETER));
-        return VERR_INVALID_PARAMETER;
-    }
-
-    /*
-     * Allocate and initialize pci bus structure.
-     */
-    int rc = VINF_SUCCESS;
-    PPDMRTC pRtc = (PPDMRTC)MMR3HeapAlloc(pDevIns->Internal.s.pVMR3, MM_TAG_PDM_DEVICE, sizeof(*pRtc));
-    if (pRtc)
-    {
-        pRtc->pDevIns   = pDevIns;
-        pRtc->Reg       = *pRtcReg;
-        pVM->pdm.s.pRtc = pRtc;
-
-        /* set the helper pointer. */
-        *ppRtcHlp = &g_pdmR3DevRtcHlp;
-        Log(("PDM: Registered RTC device '%s'/%d pDevIns=%p\n",
-             pDevIns->pReg->szName, pDevIns->iInstance, pDevIns));
-    }
-    else
-        rc = VERR_NO_MEMORY;
-
+        rc = VERR_ALREADY_EXISTS;
+    }
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
     LogFlow(("pdmR3DevHlp_RTCRegister: caller='%s'/%d: returns %Rrc\n",
              pDevIns->pReg->szName, pDevIns->iInstance, rc));
@@ -3555 +3574 @@
     LogFlow(("pdmR3DevHlp_DMARegister: caller='%s'/%d: uChannel=%d pfnTransferHandler=%p pvUser=%p\n",
              pDevIns->pReg->szName, pDevIns->iInstance, uChannel, pfnTransferHandler, pvUser));
-    int rc = VINF_SUCCESS;
-    if (pVM->pdm.s.pDmac)
-        pVM->pdm.s.pDmac->Reg.pfnRegister(pVM->pdm.s.pDmac->pDevIns, uChannel, pDevIns, pfnTransferHandler, pvUser);
+    int            rc    = VINF_SUCCESS;
+    PPDMDMAC const pDmac = pVM->pdm.s.pDmac;
+    if (pDmac)
+        pDmac->Reg.pfnRegister(pDmac->pDevIns, uChannel, pDevIns, pfnTransferHandler, pvUser);
     else
     {
@@ -3577 +3597 @@
     LogFlow(("pdmR3DevHlp_DMAReadMemory: caller='%s'/%d: uChannel=%d pvBuffer=%p off=%#x cbBlock=%#x pcbRead=%p\n",
              pDevIns->pReg->szName, pDevIns->iInstance, uChannel, pvBuffer, off, cbBlock, pcbRead));
-    int rc = VINF_SUCCESS;
-    if (pVM->pdm.s.pDmac)
-    {
-        uint32_t cb = pVM->pdm.s.pDmac->Reg.pfnReadMemory(pVM->pdm.s.pDmac->pDevIns, uChannel, pvBuffer, off, cbBlock);
+    int            rc    = VINF_SUCCESS;
+    PPDMDMAC const pDmac = pVM->pdm.s.pDmac;
+    if (pDmac)
+    {
+        uint32_t cb = pDmac->Reg.pfnReadMemory(pDmac->pDevIns, uChannel, pvBuffer, off, cbBlock);
         if (pcbRead)
             *pcbRead = cb;
@@ -3603 +3624 @@
     LogFlow(("pdmR3DevHlp_DMAWriteMemory: caller='%s'/%d: uChannel=%d pvBuffer=%p off=%#x cbBlock=%#x pcbWritten=%p\n",
              pDevIns->pReg->szName, pDevIns->iInstance, uChannel, pvBuffer, off, cbBlock, pcbWritten));
-    int rc = VINF_SUCCESS;
-    if (pVM->pdm.s.pDmac)
-    {
-        uint32_t cb = pVM->pdm.s.pDmac->Reg.pfnWriteMemory(pVM->pdm.s.pDmac->pDevIns, uChannel, pvBuffer, off, cbBlock);
+    int            rc    = VINF_SUCCESS;
+    PPDMDMAC const pDmac = pVM->pdm.s.pDmac;
+    if (pDmac)
+    {
+        uint32_t cb = pDmac->Reg.pfnWriteMemory(pDmac->pDevIns, uChannel, pvBuffer, off, cbBlock);
         if (pcbWritten)
             *pcbWritten = cb;
@@ -3629 +3651 @@
     LogFlow(("pdmR3DevHlp_DMASetDREQ: caller='%s'/%d: uChannel=%d uLevel=%d\n",
              pDevIns->pReg->szName, pDevIns->iInstance, uChannel, uLevel));
-    int rc = VINF_SUCCESS;
-    if (pVM->pdm.s.pDmac)
-        pVM->pdm.s.pDmac->Reg.pfnSetDREQ(pVM->pdm.s.pDmac->pDevIns, uChannel, uLevel);
+    int            rc    = VINF_SUCCESS;
+    PPDMDMAC const pDmac = pVM->pdm.s.pDmac;
+    if (pDmac)
+        pDmac->Reg.pfnSetDREQ(pDmac->pDevIns, uChannel, uLevel);
     else
     {
@@ -3650 +3673 @@
     LogFlow(("pdmR3DevHlp_DMAGetChannelMode: caller='%s'/%d: uChannel=%d\n",
              pDevIns->pReg->szName, pDevIns->iInstance, uChannel));
-    uint8_t u8Mode;
-    if (pVM->pdm.s.pDmac)
-        u8Mode = pVM->pdm.s.pDmac->Reg.pfnGetChannelMode(pVM->pdm.s.pDmac->pDevIns, uChannel);
+    uint8_t        u8Mode;
+    PPDMDMAC const pDmac = pVM->pdm.s.pDmac;
+    if (pDmac)
+        u8Mode = pDmac->Reg.pfnGetChannelMode(pDmac->pDevIns, uChannel);
     else
     {
@@ -3688 +3712 @@
              pDevIns->pReg->szName, pDevIns->iInstance, iReg, u8Value));
     int rc;
-    if (pVM->pdm.s.pRtc)
-    {
-        PPDMDEVINS pDevInsRtc = pVM->pdm.s.pRtc->pDevIns;
+    PPDMRTC const pRtc = pVM->pdm.s.pRtc;
+    if (pRtc)
+    {
+        PPDMDEVINS const pDevInsRtc = pRtc->pDevIns;
         rc = PDMCritSectEnter(pVM, pDevInsRtc->pCritSectRoR3, VERR_IGNORED);
         if (RT_SUCCESS(rc))
         {
-            rc = pVM->pdm.s.pRtc->Reg.pfnWrite(pDevInsRtc, iReg, u8Value);
+            rc = pRtc->Reg.pfnWrite(pDevInsRtc, iReg, u8Value);
             PDMCritSectLeave(pVM, pDevInsRtc->pCritSectRoR3);
         }
@@ -3717 +3742 @@
              pDevIns->pReg->szName, pDevIns->iInstance, iReg, pu8Value));
     int rc;
-    if (pVM->pdm.s.pRtc)
-    {
-        PPDMDEVINS pDevInsRtc = pVM->pdm.s.pRtc->pDevIns;
+    PPDMRTC const pRtc = pVM->pdm.s.pRtc;
+    if (pRtc)
+    {
+        PPDMDEVINS const pDevInsRtc = pRtc->pDevIns;
         rc = PDMCritSectEnter(pVM, pDevInsRtc->pCritSectRoR3, VERR_IGNORED);
         if (RT_SUCCESS(rc))
         {
-            rc = pVM->pdm.s.pRtc->Reg.pfnRead(pDevInsRtc, iReg, pu8Value);
+            rc = pRtc->Reg.pfnRead(pDevInsRtc, iReg, pu8Value);
             PDMCritSectLeave(pVM, pDevInsRtc->pCritSectRoR3);
         }
@@ -3979 +4005 @@
     VM_ASSERT_STATE_RETURN(pVM, VMSTATE_CREATING, VERR_WRONG_ORDER);
 
+    /* Take the core lock exclusively just to be safe. */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     /*
      * Find free PCI bus entry.
@@ -3986 +4015 @@
         if (!pVM->pdm.s.aPciBuses[iBus].pDevInsR3)
             break;
-    AssertLogRelMsgReturn(iBus < RT_ELEMENTS(pVM->pdm.s.aPciBuses),
-                          ("Too many PCI buses. Max=%u\n", RT_ELEMENTS(pVM->pdm.s.aPciBuses)),
-                          VERR_OUT_OF_RESOURCES);
+    AssertLogRelMsgReturnStmt(iBus < RT_ELEMENTS(pVM->pdm.s.aPciBuses),
+                              ("Too many PCI buses. Max=%u\n", RT_ELEMENTS(pVM->pdm.s.aPciBuses)),
+                              RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw),
+                              VERR_OUT_OF_RESOURCES);
     PPDMPCIBUS pPciBus = &pVM->pdm.s.aPciBuses[iBus];
 
@@ -4005 +4035 @@
 
     Log(("PDM: Registered PCI bus device '%s'/%d pDevIns=%p\n", pDevIns->pReg->szName, pDevIns->iInstance, pDevIns));
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     /* set the helper pointer and return. */
@@ -4042 +4074 @@
     VM_ASSERT_EMT0_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
 
+    /* Take the core lock exclusively just to be safe. */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     /*
      * Find free IOMMU slot.
@@ -4051 +4086 @@
         if (!pVM->pdm.s.aIommus[idxIommu].pDevInsR3)
             break;
-    AssertLogRelMsgReturn(idxIommu < RT_ELEMENTS(pVM->pdm.s.aIommus),
-                          ("Too many IOMMUs. Max=%u\n", RT_ELEMENTS(pVM->pdm.s.aIommus)),
-                          VERR_OUT_OF_RESOURCES);
+    AssertLogRelMsgReturnStmt(idxIommu < RT_ELEMENTS(pVM->pdm.s.aIommus),
+                              ("Too many IOMMUs. Max=%u\n", RT_ELEMENTS(pVM->pdm.s.aIommus)),
+                              RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw),
+                              VERR_OUT_OF_RESOURCES);
 #else
     /* Currently we support only a single IOMMU. */
-    AssertMsgReturn(!pVM->pdm.s.aIommus[0].pDevInsR3,
-                    ("%s/%u: Only one IOMMU device is supported!\n", pDevIns->pReg->szName, pDevIns->iInstance),
-                    VERR_ALREADY_EXISTS);
+    AssertMsgReturnStmt(!pVM->pdm.s.aIommus[idxIommu].pDevInsR3,
+                        ("%s/%u: Only one IOMMU device is supported!\n", pDevIns->pReg->szName, pDevIns->iInstance),
+                        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw),
+                        VERR_ALREADY_EXISTS);
 #endif
     PPDMIOMMUR3 pIommu = &pVM->pdm.s.aIommus[idxIommu];
@@ -4071 +4108 @@
     pIommu->pfnMsiRemap      = pIommuReg->pfnMsiRemap;
     Log(("PDM: Registered IOMMU device '%s'/%d pDevIns=%p\n", pDevIns->pReg->szName, pDevIns->iInstance, pDevIns));
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     /* Set the helper pointer and return. */
@@ -4107 +4146 @@
     VM_ASSERT_EMT0_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
 
+    /* Take the core lock exclusively just to be safe. */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     /*
      * Only one PIC device.
      */
-    AssertMsgReturn(pVM->pdm.s.Pic.pDevInsR3 == NULL, ("%s/%d: Only one PIC!\n", pDevIns->pReg->szName, pDevIns->iInstance),
-                    VERR_ALREADY_EXISTS);
+    AssertMsgReturnStmt(pVM->pdm.s.Pic.pDevInsR3 == NULL,
+                        ("%s/%d: Only one PIC!\n", pDevIns->pReg->szName, pDevIns->iInstance),
+                        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw),
+                        VERR_ALREADY_EXISTS);
 
     /*
@@ -4121 +4165 @@
     Log(("PDM: Registered PIC device '%s'/%d pDevIns=%p\n", pDevIns->pReg->szName, pDevIns->iInstance, pDevIns));
 
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     /* set the helper pointer and return. */
     *ppPicHlp = &g_pdmR3DevPicHlp;
@@ -4140 +4186 @@
     VM_ASSERT_EMT0_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
 
+    /* Take the core lock exclusively just to be safe. */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     /*
      * Only one APIC device. On SMP we have single logical device covering all LAPICs,
      * as they need to communicate and share state easily.
      */
-    AssertMsgReturn(pVM->pdm.s.Apic.pDevInsR3 == NULL,
-                    ("%s/%u: Only one APIC device is supported!\n", pDevIns->pReg->szName, pDevIns->iInstance),
-                    VERR_ALREADY_EXISTS);
+    AssertMsgReturnStmt(pVM->pdm.s.Apic.pDevInsR3 == NULL,
+                        ("%s/%u: Only one APIC device is supported!\n", pDevIns->pReg->szName, pDevIns->iInstance),
+                        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw),
+                        VERR_ALREADY_EXISTS);
 
     /*
@@ -4156 +4206 @@
     Assert(pVM->pdm.s.Apic.pDevInsRC || !VM_IS_RAW_MODE_ENABLED(pVM));
 #endif
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     LogFlow(("pdmR3DevHlp_ApicRegister: caller='%s'/%d: returns %Rrc\n", pDevIns->pReg->szName, pDevIns->iInstance, VINF_SUCCESS));
@@ -4186 +4238 @@
     VM_ASSERT_EMT0_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
 
+    /* Take the core lock exclusively just to be safe. */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     /*
      * The I/O APIC requires the APIC to be present (hacks++).
      * If the I/O APIC does GC stuff so must the APIC.
      */
-    AssertMsgReturn(pVM->pdm.s.Apic.pDevInsR3 != NULL, ("Configuration error / Init order error! No APIC!\n"), VERR_WRONG_ORDER);
+    AssertMsgReturnStmt(pVM->pdm.s.Apic.pDevInsR3 != NULL,
+                        ("Configuration error / Init order error! No APIC!\n"),
+                        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw),
+                        VERR_WRONG_ORDER);
 
     /*
      * Only one I/O APIC device.
      */
-    AssertMsgReturn(pVM->pdm.s.IoApic.pDevInsR3 == NULL,
-                    ("Only one IOAPIC device is supported! (caller %s/%d)\n", pDevIns->pReg->szName, pDevIns->iInstance),
-                    VERR_ALREADY_EXISTS);
+    AssertMsgReturnStmt(pVM->pdm.s.IoApic.pDevInsR3 == NULL,
+                        ("Only one IOAPIC device is supported! (caller %s/%d)\n", pDevIns->pReg->szName, pDevIns->iInstance),
+                        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw),
+                        VERR_ALREADY_EXISTS);
 
     /*
@@ -4207 +4266 @@
     pVM->pdm.s.IoApic.pfnSetEoiR3  = pIoApicReg->pfnSetEoi;
     Log(("PDM: Registered I/O APIC device '%s'/%d pDevIns=%p\n", pDevIns->pReg->szName, pDevIns->iInstance, pDevIns));
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     /* set the helper pointer and return. */
@@ -4235 +4296 @@
      * Only one HPET device.
      */
-    AssertMsgReturn(pVM->pdm.s.pHpet == NULL,
-                    ("Only one HPET device is supported! (caller %s/%d)\n", pDevIns->pReg->szName, pDevIns->iInstance),
-                    VERR_ALREADY_EXISTS);
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
+    AssertMsgReturnStmt(pVM->pdm.s.pHpet == NULL,
+                        ("Only one HPET device is supported! (caller %s/%d)\n", pDevIns->pReg->szName, pDevIns->iInstance),
+                        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw),
+                        VERR_ALREADY_EXISTS);
 
     /*
@@ -4243 +4307 @@
      */
     pVM->pdm.s.pHpet = pDevIns;
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     *ppHpetHlpR3 = &g_pdmR3DevHpetHlp;
 
@@ -4330 +4397 @@
      * Only one DMA device.
      */
-    PVM pVM = pDevIns->Internal.s.pVMR3;
-    if (pVM->pdm.s.pDmac)
+    PVM const pVM = pDevIns->Internal.s.pVMR3;
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
+    int rc = VINF_SUCCESS;
+    if (!pVM->pdm.s.pDmac)
+    {
+
+        /*
+         * Allocate and initialize pci bus structure.
+         */
+        PPDMDMAC pDmac = (PPDMDMAC)MMR3HeapAlloc(pDevIns->Internal.s.pVMR3, MM_TAG_PDM_DEVICE, sizeof(*pDmac));
+        if (pDmac)
+        {
+            pDmac->pDevIns   = pDevIns;
+            pDmac->Reg       = *pDmacReg;
+            pVM->pdm.s.pDmac = pDmac;
+
+            /* set the helper pointer. */
+            *ppDmacHlp = &g_pdmR3DevDmacHlp;
+            Log(("PDM: Registered DMAC device '%s'/%d pDevIns=%p\n",
+                 pDevIns->pReg->szName, pDevIns->iInstance, pDevIns));
+        }
+        else
+            rc = VERR_NO_MEMORY;
+    }
+    else
     {
         AssertMsgFailed(("Only one DMA device is supported!\n"));
-        LogFlow(("pdmR3DevHlp_DMACRegister: caller='%s'/%d: returns %Rrc\n",
-                 pDevIns->pReg->szName, pDevIns->iInstance, VERR_INVALID_PARAMETER));
-        return VERR_INVALID_PARAMETER;
-    }
-
-    /*
-     * Allocate and initialize pci bus structure.
-     */
-    int rc = VINF_SUCCESS;
-    PPDMDMAC  pDmac = (PPDMDMAC)MMR3HeapAlloc(pDevIns->Internal.s.pVMR3, MM_TAG_PDM_DEVICE, sizeof(*pDmac));
-    if (pDmac)
-    {
-        pDmac->pDevIns   = pDevIns;
-        pDmac->Reg       = *pDmacReg;
-        pVM->pdm.s.pDmac = pDmac;
-
-        /* set the helper pointer. */
-        *ppDmacHlp = &g_pdmR3DevDmacHlp;
-        Log(("PDM: Registered DMAC device '%s'/%d pDevIns=%p\n",
-             pDevIns->pReg->szName, pDevIns->iInstance, pDevIns));
-    }
-    else
-        rc = VERR_NO_MEMORY;
-
+        rc = VERR_ALREADY_EXISTS;
+    }
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
     LogFlow(("pdmR3DevHlp_DMACRegister: caller='%s'/%d: returns %Rrc\n",
              pDevIns->pReg->szName, pDevIns->iInstance, rc));
@@ -4375 +4446 @@
              pDevIns->pReg->szName, pDevIns->iInstance, GCPhys, pvHeap, cbHeap));
 
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
     if (pVM->pdm.s.pvVMMDevHeap == NULL)
     {
@@ -4390 +4462 @@
         {
             pVM->pdm.s.GCPhysVMMDevHeap = GCPhys;
-            if (pVM->pdm.s.pfnVMMDevHeapNotify)
-                pVM->pdm.s.pfnVMMDevHeapNotify(pVM, pvHeap, GCPhys);
+            PFNPDMVMMDEVHEAPNOTIFY const pfnVMMDevHeapNotify = pVM->pdm.s.pfnVMMDevHeapNotify;
+            if (pfnVMMDevHeapNotify)
+                pfnVMMDevHeapNotify(pVM, pvHeap, GCPhys);
         }
     }
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     LogFlow(("pdmR3DevHlp_RegisterVMMDevHeap: caller='%s'/%d: returns %Rrc\n",
@@ -4438 +4512 @@
 
     /*
-     * Only one DMA device.
+     * Only one firmware registration.
      */
-    PVM pVM = pDevIns->Internal.s.pVMR3;
-    if (pVM->pdm.s.pFirmware)
+    PVM const pVM = pDevIns->Internal.s.pVMR3;
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
+    int rc = VINF_SUCCESS;
+    if (!pVM->pdm.s.pFirmware)
+    {
+        /*
+         * Allocate and initialize pci bus structure.
+         */
+        PPDMFW pFirmware = (PPDMFW)MMR3HeapAlloc(pDevIns->Internal.s.pVMR3, MM_TAG_PDM_DEVICE, sizeof(*pFirmware));
+        if (pFirmware)
+        {
+            pFirmware->pDevIns   = pDevIns;
+            pFirmware->Reg       = *pFwReg;
+            pVM->pdm.s.pFirmware = pFirmware;
+
+            /* set the helper pointer. */
+            *ppFwHlp = &g_pdmR3DevFirmwareHlp;
+            Log(("PDM: Registered firmware device '%s'/%d pDevIns=%p\n",
+                 pDevIns->pReg->szName, pDevIns->iInstance, pDevIns));
+        }
+        else
+            rc = VERR_NO_MEMORY;
+    }
+    else
     {
         AssertMsgFailed(("Only one firmware device is supported!\n"));
-        LogFlow(("pdmR3DevHlp_FirmwareRegister: caller='%s'/%d: returns %Rrc\n",
-                 pDevIns->pReg->szName, pDevIns->iInstance, VERR_INVALID_PARAMETER));
-        return VERR_INVALID_PARAMETER;
-    }
-
-    /*
-     * Allocate and initialize pci bus structure.
-     */
-    int rc = VINF_SUCCESS;
-    PPDMFW pFirmware = (PPDMFW)MMR3HeapAlloc(pDevIns->Internal.s.pVMR3, MM_TAG_PDM_DEVICE, sizeof(*pFirmware));
-    if (pFirmware)
-    {
-        pFirmware->pDevIns   = pDevIns;
-        pFirmware->Reg       = *pFwReg;
-        pVM->pdm.s.pFirmware = pFirmware;
-
-        /* set the helper pointer. */
-        *ppFwHlp = &g_pdmR3DevFirmwareHlp;
-        Log(("PDM: Registered firmware device '%s'/%d pDevIns=%p\n",
-             pDevIns->pReg->szName, pDevIns->iInstance, pDevIns));
-    }
-    else
-        rc = VERR_NO_MEMORY;
-
+        rc = VERR_ALREADY_EXISTS;
+    }
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
     LogFlow(("pdmR3DevHlp_FirmwareRegister: caller='%s'/%d: returns %Rrc\n",
              pDevIns->pReg->szName, pDevIns->iInstance, rc));
@@ -4805 +4882 @@
 /** @interface_method_impl{PDMDEVHLPR3,pfnQueryLun} */
 static DECLCALLBACK(int) pdmR3DevHlp_QueryLun(PPDMDEVINS pDevIns, const char *pszDevice,
-                                                 unsigned iInstance, unsigned iLun, PPDMIBASE *ppBase)
+                                              unsigned iInstance, unsigned iLun, PPDMIBASE *ppBase)
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);

trunk/src/VBox/VMM/VMMR3/PDMDevice.cpp

@@ -501 +501 @@
          * Link it into all the lists.
          */
+        RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
         /* The global instance FIFO. */
         PPDMDEVINS pPrev1 = pVM->pdm.s.pDevInstances;
@@ -536 +538 @@
                     VMSetError(pVM, rc, RT_SRC_POS, "Failed to construct device '%s' instance #%u",
                                pDevIns->pReg->szName, pDevIns->iInstance);
-                paDevs[i].pDev->cInstances--;
+                RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
                 return VERR_NO_MEMORY;
             }
@@ -550 +552 @@
          */
         paDevs[i].pDev->cInstances++;
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
+
         Log(("PDM: Constructing device '%s' instance %d...\n", pDevIns->pReg->szName, pDevIns->iInstance));
         rc = pDevIns->pReg->pfnConstruct(pDevIns, pDevIns->iInstance, pDevIns->pCfg);
@@ -560 +564 @@
             /* Because we're damn lazy, the destructor will be called even if
                the constructor fails.  So, no unlinking. */
-            paDevs[i].pDev->cInstances--;
+            //paDevs[i].pDev->cInstances--;
             return rc == VERR_VERSION_MISMATCH ? VERR_PDM_DEVICE_VERSION_MISMATCH : rc;
         }
@@ -584 +588 @@
                     VMSetError(pVM, rc, RT_SRC_POS, "The ring-0 constructor of device '%s' instance #%u failed",
                                pDevIns->pReg->szName, pDevIns->iInstance);
-                paDevs[i].pDev->cInstances--;
+                /* No unlinking, see above. */
+                //paDevs[i].pDev->cInstances--;
                 return rc == VERR_VERSION_MISMATCH ? VERR_PDM_DEVICE_VERSION_MISMATCH : rc;
             }
@@ -617 +622 @@
      * Iterate thru the device instances and work the callback.
      */
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMDEVINS pDevIns = pVM->pdm.s.pDevInstances; pDevIns; pDevIns = pDevIns->Internal.s.pNextR3)
     {
         if (pDevIns->pReg->pfnInitComplete)
         {
+            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
             PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
             rc = pDevIns->pReg->pfnInitComplete(pDevIns);
@@ -630 +637 @@
                 return rc;
             }
+            RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
         }
     }
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
 
 #ifdef VBOX_WITH_USB
@@ -653 +662 @@
 PPDMDEV pdmR3DevLookup(PVM pVM, const char *pszName)
 {
-    size_t cchName = strlen(pszName);
+    size_t const cchName = strlen(pszName);
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMDEV pDev = pVM->pdm.s.pDevs; pDev; pDev = pDev->pNext)
-        if (    pDev->cchName == cchName
-            &&  !strcmp(pDev->pReg->szName, pszName))
+        if (   pDev->cchName == cchName
+            && !strcmp(pDev->pReg->szName, pszName))
+        {
+            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
             return pDev;
+        }
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     return NULL;
 }
@@ -916 +930 @@
      */
     PCPDMDEVREGCBINT pRegCB = (PCPDMDEVREGCBINT)pCallbacks;
+    PVM const        pVM    = pRegCB->pVM;
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     PPDMDEV pDevPrev = NULL;
-    PPDMDEV pDev = pRegCB->pVM->pdm.s.pDevs;
+    PPDMDEV pDev     = pVM->pdm.s.pDevs;
     for (; pDev; pDevPrev = pDev, pDev = pDev->pNext)
-        AssertMsgReturn(strcmp(pDev->pReg->szName, pReg->szName),
-                        ("Device '%s' already exists\n", pReg->szName),
-                        VERR_PDM_DEVICE_NAME_CLASH);
+        AssertMsgReturnStmt(strcmp(pDev->pReg->szName, pReg->szName),
+                            ("Device '%s' already exists\n", pReg->szName),
+                            RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw),
+                            VERR_PDM_DEVICE_NAME_CLASH);
 
     /*
@@ -944 +962 @@
             else
                 pRegCB->pVM->pdm.s.pDevs = pDev;
+
+            RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
             Log(("PDM: Registered device '%s'\n", pReg->szName));
             return VINF_SUCCESS;
@@ -952 +972 @@
     else
         rc = VERR_NO_MEMORY;
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
     return rc;
 }
@@ -972 +994 @@
      * Iterate registered devices looking for the device.
      */
-    size_t cchDevice = strlen(pszDevice);
+    size_t const cchDevice = strlen(pszDevice);
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMDEV pDev = pVM->pdm.s.pDevs; pDev; pDev = pDev->pNext)
     {
@@ -992 +1015 @@
                         if (pLun->iLun == iLun)
                         {
+                            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                             *ppLun = pLun;
                             return VINF_SUCCESS;
                         }
                     }
+                    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                     return VERR_PDM_LUN_NOT_FOUND;
                 }
             }
+            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
             return VERR_PDM_DEVICE_INSTANCE_NOT_FOUND;
         }
     }
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     return VERR_PDM_DEVICE_NOT_FOUND;
 }
@@ -1020 +1047 @@
  * @thread  EMT
  */
-VMMR3DECL(int) PDMR3DeviceAttach(PUVM pUVM, const char *pszDevice, unsigned iInstance, unsigned iLun, uint32_t fFlags, PPPDMIBASE ppBase)
+VMMR3DECL(int) PDMR3DeviceAttach(PUVM pUVM, const char *pszDevice, unsigned iInstance, unsigned iLun,
+                                 uint32_t fFlags, PPPDMIBASE ppBase)
 {
+    if (ppBase)
+        *ppBase = NULL;
     UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
     PVM pVM = pUVM->pVM;
@@ -1032 +1062 @@
      * Find the LUN in question.
      */
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     PPDMLUN pLun;
     int rc = pdmR3DevFindLun(pVM, pszDevice, iInstance, iLun, &pLun);
@@ -1044 +1075 @@
             if (!pLun->pTop)
             {
+                RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                 PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
                 rc = pDevIns->pReg->pfnAttach(pDevIns, iLun, fFlags);
                 PDMCritSectLeave(pVM, pDevIns->pCritSectRoR3);
+                RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
             }
             else
@@ -1057 +1090 @@
             *ppBase = pLun->pTop ? &pLun->pTop->IBase : NULL;
     }
-    else if (ppBase)
-        *ppBase = NULL;
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
 
     if (ppBase)
@@ -1128 +1160 @@
  * @thread  EMT
  */
-VMMR3DECL(int) PDMR3DriverAttach(PUVM pUVM, const char *pszDevice, unsigned iInstance, unsigned iLun, uint32_t fFlags, PPPDMIBASE ppBase)
+VMMR3DECL(int) PDMR3DriverAttach(PUVM pUVM, const char *pszDevice, unsigned iInstance, unsigned iLun,
+                                 uint32_t fFlags, PPPDMIBASE ppBase)
 {
     LogFlow(("PDMR3DriverAttach: pszDevice=%p:{%s} iInstance=%d iLun=%d fFlags=%#x ppBase=%p\n",
              pszDevice, pszDevice, iInstance, iLun, fFlags, ppBase));
+    if (ppBase)
+        *ppBase = NULL;
     UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
     PVM pVM = pUVM->pVM;
@@ -1137 +1172 @@
     VM_ASSERT_EMT(pVM);
 
-    if (ppBase)
-        *ppBase = NULL;
-
     /*
      * Find the LUN in question.
      */
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     PPDMLUN pLun;
     int rc = pdmR3DevFindLun(pVM, pszDevice, iInstance, iLun, &pLun);
@@ -1157 +1190 @@
             if (pDevIns->pReg->pfnAttach)
             {
+                RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                 PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
                 rc = pDevIns->pReg->pfnAttach(pDevIns, iLun, fFlags);
@@ -1162 +1196 @@
                     *ppBase = pLun->pTop ? &pLun->pTop->IBase : NULL;
                 PDMCritSectLeave(pVM, pDevIns->pCritSectRoR3);
+                RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
             }
             else
@@ -1173 +1208 @@
             if (pDrvIns->pReg->pfnAttach)
             {
+                RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                 rc = pDrvIns->pReg->pfnAttach(pDrvIns, fFlags);
+                RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
                 if (RT_SUCCESS(rc) && ppBase)
                     *ppBase = pDrvIns->Internal.s.pDown
@@ -1183 +1220 @@
         }
     }
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
 
     if (ppBase)
@@ -1221 +1259 @@
              pszDevice, pszDevice, iDevIns, iLun, pszDriver, pszDriver, iOccurrence, fFlags));
     UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
-    PVM pVM = pUVM->pVM;
+    PVM const pVM = pUVM->pVM;
     VM_ASSERT_VALID_EXT_RETURN(pVM, VERR_INVALID_VM_HANDLE);
     VM_ASSERT_EMT(pVM);
@@ -1232 +1270 @@
      * Find the LUN in question.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
     PPDMLUN pLun;
     int rc = pdmR3DevFindLun(pVM, pszDevice, iDevIns, iLun, &pLun);
@@ -1256 +1295 @@
             }
             if (pDrvIns)
-                rc = pdmR3DrvDetach(pDrvIns, fFlags);
+                rc = pdmR3DrvDetach(pVM, pDrvIns, fFlags);
             else
                 rc = VERR_PDM_DRIVER_INSTANCE_NOT_FOUND;
@@ -1263 +1302 @@
             rc = VINF_PDM_NO_DRIVER_ATTACHED_TO_LUN;
     }
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     LogFlow(("PDMR3DriverDetach: returns %Rrc\n", rc));

trunk/src/VBox/VMM/VMMR3/PDMDriver.cpp

@@ -327 +327 @@
      * Check for duplicate and find FIFO entry at the same time.
      */
-    PCPDMDRVREGCBINT pRegCB = (PCPDMDRVREGCBINT)pCallbacks;
+    PCPDMDRVREGCBINT const  pRegCB = (PCPDMDRVREGCBINT)pCallbacks;
+    PVM const               pVM    = pRegCB->pVM;
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     PPDMDRV pDrvPrev = NULL;
     PPDMDRV pDrv = pRegCB->pVM->pdm.s.pDrvs;
@@ -334 +337 @@
         if (!strcmp(pDrv->pReg->szName, pReg->szName))
         {
+            RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
             AssertMsgFailed(("Driver '%s' already exists\n", pReg->szName));
             return VERR_PDM_DRIVER_NAME_CLASH;
@@ -350 +354 @@
         pDrv->iNextInstance = 0;
         pDrv->pReg          = pReg;
+        pDrv->pInstances    = NULL;
         rc = CFGMR3QueryStringAllocDef(    pRegCB->pCfgNode, "RCSearchPath", &pDrv->pszRCSearchPath, NULL);
         if (RT_SUCCESS(rc))
@@ -359 +364 @@
             else
                 pRegCB->pVM->pdm.s.pDrvs = pDrv;
+            RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
+
             Log(("PDM: Registered driver '%s'\n", pReg->szName));
             return VINF_SUCCESS;
@@ -366 +373 @@
     else
         rc = VERR_NO_MEMORY;
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
     return rc;
 }
@@ -376 +384 @@
 PPDMDRV pdmR3DrvLookup(PVM pVM, const char *pszName)
 {
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMDRV pDrv = pVM->pdm.s.pDrvs; pDrv; pDrv = pDrv->pNext)
         if (!strcmp(pDrv->pReg->szName, pszName))
+        {
+            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
             return pDrv;
+        }
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     return NULL;
 }
@@ -394 +407 @@
  * @param   ppNode              The AttachedDriver node, replaced if any
  *                              morphing took place.
+ * @note    Caller owns CoreListCritSectRw exclusivly.
  */
 static int pdmR3DrvMaybeTransformChain(PVM pVM, PPDMDRVINS pDrvAbove, PPDMLUN pLun, PCFGMNODE *ppNode)
@@ -653 +667 @@
  * Instantiate a driver.
  *
+ * @note    The caller must enter CoreListCritSectRw with exclusive access
+ *          rights before the call.  This function _will_ release the lock for
+ *          doing callbacks (and failure cleanups), but it will still own it
+ *          upon return.
+ *
  * @returns VBox status code, including informational statuses.
  *
@@ -680 +699 @@
 
     Assert(pBaseInterface->pfnQueryInterface(pBaseInterface, PDMIBASE_IID) == pBaseInterface);
+
+    /* Exclusive lock ownership w/o any extra recursions. */
+    Assert(RTCritSectRwIsWriteOwner(&pVM->pdm.s.CoreListCritSectRw));
+    Assert(RTCritSectRwGetWriteRecursion(&pVM->pdm.s.CoreListCritSectRw) == 1);
 
     /*
@@ -747 +770 @@
                     //pNew->Internal.s.pfnAsyncNotify = NULL;
                     pNew->Internal.s.pCfgHandle     = pNode;
+                    //pNew->Internal.s.pNext          = NULL;
                     pNew->pReg                      = pDrv->pReg;
                     pNew->pCfg                      = pConfigNode;
@@ -775 +799 @@
 #endif
 
+                    /*
+                     * Update PDMDRV members and link it into the instance list.
+                     */
                     pDrv->iNextInstance++;
                     pDrv->cInstances++;
+
+                    PPDMDRVINS pPrevDrvIns = pDrv->pInstances;
+                    if (!pPrevDrvIns)
+                        pDrv->pInstances = pNew;
+                    else
+                    {
+                        while (pPrevDrvIns->Internal.s.pNext)
+                            pPrevDrvIns = pPrevDrvIns->Internal.s.pNext;
+                        pPrevDrvIns->Internal.s.pNext = pNew;
+                    }
 
                     /*
@@ -793 +830 @@
                     /*
                      * Invoke the constructor.
+                     *
+                     * We have to leave the exclusive CoreListCritSectRw ownership here, as
+                     * the constructor may call us back recursively to attach drivers down
+                     * the stack, which would cause trouble in pdmR3DrvDestroyChain since
+                     * it assumes there is no lock recursion.  There is also the possibility
+                     * of the constructor engaging with PDM asynchronously via another thread.
                      */
+                    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
                     rc = pDrv->pReg->pfnConstruct(pNew, pNew->pCfg, 0 /*fFlags*/);
+                    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
                     if (RT_SUCCESS(rc))
                     {
@@ -816 +861 @@
                     else
                     {
-                        pdmR3DrvDestroyChain(pNew, PDM_TACH_FLAGS_NO_CALLBACKS);
+                        pdmR3DrvDestroyChain(pVM, pNew, PDM_TACH_FLAGS_NO_CALLBACKS);
                         if (rc == VERR_VERSION_MISMATCH)
                             rc = VERR_PDM_DRIVER_VERSION_MISMATCH;
@@ -854 +899 @@
  * This will of course lead to the destruction of the driver and all drivers below it in the chain.
  *
+ * @note    The caller must enter CoreListCritSectRw with exclusive access
+ *          rights before the call.  This function _will_ release the lock for
+ *          doing callbacks and cleaning up resources associated with the
+ *          drivers being destroyed, but it will still own it upon return.
+ *
  * @returns VINF_SUCCESS
+ * @param   pVM         The cross context VM structure.
  * @param   pDrvIns     The driver instance to detach.
  * @param   fFlags      Flags, combination of the PDMDEVATT_FLAGS_* \#defines.
  */
-int pdmR3DrvDetach(PPDMDRVINS pDrvIns, uint32_t fFlags)
+int pdmR3DrvDetach(PVM pVM, PPDMDRVINS pDrvIns, uint32_t fFlags)
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
     LogFlow(("pdmR3DrvDetach: pDrvIns=%p '%s'/%d\n", pDrvIns, pDrvIns->pReg->szName, pDrvIns->iInstance));
-    VM_ASSERT_EMT(pDrvIns->Internal.s.pVMR3);
+    VM_ASSERT_EMT(pVM);
 
     /*
@@ -891 +942 @@
      * Join paths with pdmR3DrvDestroyChain.
      */
-    pdmR3DrvDestroyChain(pDrvIns, fFlags);
+    pdmR3DrvDestroyChain(pVM, pDrvIns, fFlags);
+
     return VINF_SUCCESS;
 }
@@ -901 +953 @@
  * This is used when unplugging a device at run time.
  *
+ * @note    The caller must enter CoreListCritSectRw with exclusive access
+ *          rights before the call.  This function _will_ release the lock for
+ *          doing callbacks and cleaning up resources associated with the
+ *          drivers being destroyed, but it will still own it upon return.
+ *
+ * @param   pVM         The cross context VM structure.
  * @param   pDrvIns     Pointer to the driver instance to start with.
  * @param   fFlags      PDM_TACH_FLAGS_NOT_HOT_PLUG, PDM_TACH_FLAGS_NO_CALLBACKS
  *                      or 0.
  */
-void pdmR3DrvDestroyChain(PPDMDRVINS pDrvIns, uint32_t fFlags)
-{
-    PVM pVM = pDrvIns->Internal.s.pVMR3;
+void pdmR3DrvDestroyChain(PVM pVM, PPDMDRVINS pDrvIns, uint32_t fFlags)
+{
+    Assert(pDrvIns->Internal.s.pVMR3 == pVM);
     VM_ASSERT_EMT(pVM);
+
+    /* Exclusive lock ownership w/o any extra recursions. */
+    Assert(RTCritSectRwIsWriteOwner(&pVM->pdm.s.CoreListCritSectRw));
+    Assert(RTCritSectRwGetWriteRecursion(&pVM->pdm.s.CoreListCritSectRw) == 1);
 
     /*
      * Detach the bottommost driver until we've detached pDrvIns.
      */
+    Assert(!pDrvIns->Internal.s.fDetaching);
     pDrvIns->Internal.s.fDetaching = true;
+
     PPDMDRVINS pCur;
     do
@@ -940 +1004 @@
 
             if (!(fFlags & PDM_TACH_FLAGS_NO_CALLBACKS) && pParent->pReg->pfnDetach)
+            {
+                RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
                 pParent->pReg->pfnDetach(pParent, fFlags);
+                RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+            }
 
             pParent->pDownBase = NULL;
@@ -955 +1023 @@
                     if (pLun->pDevIns->pReg->pfnDetach)
                     {
+                        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
                         PDMCritSectEnter(pVM, pLun->pDevIns->pCritSectRoR3, VERR_IGNORED);
                         pLun->pDevIns->pReg->pfnDetach(pLun->pDevIns, pLun->iLun, fFlags);
                         PDMCritSectLeave(pVM, pLun->pDevIns->pCritSectRoR3);
+                        RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
                     }
                 }
@@ -964 +1034 @@
                     if (pLun->pUsbIns->pReg->pfnDriverDetach)
                     {
+                        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
                         /** @todo USB device locking? */
                         pLun->pUsbIns->pReg->pfnDriverDetach(pLun->pUsbIns, pLun->iLun, fFlags);
+                        RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
                     }
                 }
@@ -972 +1044 @@
 
         /*
-         * Call destructor.
+         * Unlink the instance and call the destructor.
          */
+        PPDMDRVINS pPrevEntry = pCur->Internal.s.pDrv->pInstances;
+        if (pCur == pPrevEntry)
+            pCur->Internal.s.pDrv->pInstances = pCur->Internal.s.pNext;
+        else if (pPrevEntry)
+        {
+            PPDMDRVINS pCurEntry = pPrevEntry->Internal.s.pNext;
+            while (pCurEntry != pCur && pCurEntry)
+            {
+                pPrevEntry = pCurEntry;
+                pCurEntry = pCurEntry->Internal.s.pNext;
+            }
+            AssertLogRelMsg(pCurEntry == pCur, ("%s", pCur->pReg->szName));
+            if (pCurEntry == pCur)
+                pPrevEntry->Internal.s.pNext = pCur->Internal.s.pNext;
+        }
+        else
+            AssertLogRelMsg(pPrevEntry != NULL, ("%s", pCur->pReg->szName));
+
         pCur->pUpBase = NULL;
+        pCur->Internal.s.pDrv->cInstances--;
+
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
+
         if (pCur->pReg->pfnDestruct)
             pCur->pReg->pfnDestruct(pCur);
-        pCur->Internal.s.pDrv->cInstances--;
 
         /*
@@ -1026 +1119 @@
             MMR3HeapFree(pCur);
 
+        RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
     } while (pCur != pDrvIns);
 }
 
+
+/**
+ * Enumerates driver instances via a callback.
+ *
+ * @returns VBox status code.
+ * @retval  VERR_PDM_DRIVER_NOT_FOUND if @a pszDriver isn't registered.
+ * @param   pUVM            The user mode VM handle.
+ * @param   pszDriver       The name of the driver which instances should be
+ *                          enumerated.
+ * @param   pfnCallback     The callback function.
+ * @param   pvUser          User argument.
+ */
+VMMR3DECL(int) PDMR3DriverEnumInstances(PUVM pUVM, const char *pszDriver, PFNPDMENUMDRVINS pfnCallback, void *pvUser)
+{
+    LogFlow(("PDMR3DriverEnumInstances: pszDriver=%p:{%s} pfnCallback=%p pvUser=%p\n", pszDriver, pszDriver, pfnCallback, pvUser));
+    UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
+    PVM const pVM = pUVM->pVM;
+    VM_ASSERT_VALID_EXT_RETURN(pVM, VERR_INVALID_VM_HANDLE);
+
+    /*
+     * First find the PDMDRV entry for the driver.
+     */
+    int           rc   = VINF_SUCCESS;
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
+    PPDMDRV const pDrv = pdmR3DrvLookup(pVM, pszDriver);
+    if (pDrv)
+    {
+        /*
+         * Walk the list of instances.
+         */
+        for (PPDMDRVINSR3 pDrvIns = pDrv->pInstances; pDrvIns; pDrvIns = pDrvIns->Internal.s.pNext)
+        {
+            if (!pDrvIns->Internal.s.fDetaching) /* paranoia */
+            {
+                PPDMLUN const       pLun         = pDrvIns->Internal.s.pLun;
+                PPDMDEVINS const    pDevIns      = pLun->pDevIns;
+                const char * const  pszDevName   = pDevIns ? pDevIns->pReg->szName : pLun->pUsbIns->pReg->szName;
+                uint32_t const      uDevInstance = pDevIns ? pDevIns->iInstance    : pLun->pUsbIns->iInstance;
+                int rc2 = pfnCallback(&pDrvIns->IBase, pDrvIns->iInstance, pDevIns == NULL,
+                                      pszDevName, uDevInstance, pLun->iLun, pvUser);
+                if (RT_FAILURE(rc2))
+                {
+                    rc = rc2;
+                    break;
+                }
+            }
+        }
+    }
+    else
+        AssertFailedStmt(rc = VERR_PDM_DRIVER_NOT_FOUND);
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
+    return rc;
+}
 
 
@@ -1049 +1196 @@
      * Check that there isn't anything attached already.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
     int rc;
     if (!pDrvIns->Internal.s.pDown)
@@ -1068 +1216 @@
         rc = VERR_PDM_DRIVER_ALREADY_ATTACHED;
     }
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     LogFlow(("pdmR3DrvHlp_Attach: caller='%s'/%d: return %Rrc\n",
@@ -1081 +1230 @@
     LogFlow(("pdmR3DrvHlp_Detach: caller='%s'/%d: fFlags=%#x\n",
              pDrvIns->pReg->szName, pDrvIns->iInstance, fFlags));
-    VM_ASSERT_EMT(pDrvIns->Internal.s.pVMR3);
+    PVM const pVM =  pDrvIns->Internal.s.pVMR3;
+    VM_ASSERT_EMT(pVM);
 
     /*
@@ -1087 +1237 @@
      */
     int rc;
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
     if (pDrvIns->Internal.s.pDown)
-        rc = pdmR3DrvDetach(pDrvIns->Internal.s.pDown, fFlags);
+        rc = pdmR3DrvDetach(pVM, pDrvIns->Internal.s.pDown, fFlags);
     else
     {
@@ -1094 +1245 @@
         rc = VERR_PDM_NO_DRIVER_ATTACHED;
     }
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     LogFlow(("pdmR3DrvHlp_Detach: caller='%s'/%d: returns %Rrc\n",
@@ -1107 +1259 @@
     LogFlow(("pdmR3DrvHlp_DetachSelf: caller='%s'/%d: fFlags=%#x\n",
              pDrvIns->pReg->szName, pDrvIns->iInstance, fFlags));
-    VM_ASSERT_EMT(pDrvIns->Internal.s.pVMR3);
-
-    int rc = pdmR3DrvDetach(pDrvIns, fFlags);
+    PVM const pVM = pDrvIns->Internal.s.pVMR3;
+    VM_ASSERT_EMT(pVM);
+
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+    int rc = pdmR3DrvDetach(pVM, pDrvIns, fFlags);
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     LogFlow(("pdmR3DrvHlp_Detach: returns %Rrc\n", rc)); /* pDrvIns is freed by now. */
@@ -1122 +1277 @@
     LogFlow(("pdmR3DrvHlp_MountPrepare: caller='%s'/%d: pszFilename=%p:{%s} pszCoreDriver=%p:{%s}\n",
              pDrvIns->pReg->szName, pDrvIns->iInstance, pszFilename, pszFilename, pszCoreDriver, pszCoreDriver));
-    VM_ASSERT_EMT(pDrvIns->Internal.s.pVMR3);
+    PVM const pVM = pDrvIns->Internal.s.pVMR3;
+    VM_ASSERT_EMT(pVM);
+
+    /* We're using CoreListCritSectRw for some setup & CFGM serialization here. */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     /*
@@ -1129 +1288 @@
     if (pDrvIns->Internal.s.pDown)
     {
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
         AssertMsgFailed(("Cannot prepare a mount when something's attached to you!\n"));
         return VERR_PDM_DRIVER_ALREADY_ATTACHED;
@@ -1137 +1297 @@
      * attached configuration tree.
      */
-    PCFGMNODE   pNode = CFGMR3GetChild(pDrvIns->Internal.s.pCfgHandle, "AttachedDriver");
+    PCFGMNODE pNode = CFGMR3GetChild(pDrvIns->Internal.s.pCfgHandle, "AttachedDriver");
     if (pNode)
         CFGMR3RemoveNode(pNode);
@@ -1147 +1307 @@
     {
         /** @todo implement image probing. */
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
         AssertReleaseMsgFailed(("Not implemented!\n"));
         return VERR_NOT_IMPLEMENTED;
@@ -1167 +1328 @@
                 if (RT_SUCCESS(rc))
                 {
+                    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
                     LogFlow(("pdmR3DrvHlp_MountPrepare: caller='%s'/%d: returns %Rrc (Driver=%s)\n",
                              pDrvIns->pReg->szName, pDrvIns->iInstance, rc, pszCoreDriver));
                     return rc;
                 }
-                else
-                    AssertMsgFailed(("Path string insert failed, rc=%Rrc\n", rc));
+                AssertMsgFailed(("Path string insert failed, rc=%Rrc\n", rc));
             }
             else
@@ -1184 +1345 @@
         AssertMsgFailed(("AttachedDriver node insert failed, rc=%Rrc\n", rc));
 
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
     LogFlow(("pdmR3DrvHlp_MountPrepare: caller='%s'/%d: returns %Rrc\n",
              pDrvIns->pReg->szName, pDrvIns->iInstance, rc));
@@ -1226 +1388 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    int rc2 = VMSetErrorV(pDrvIns->Internal.s.pVMR3, rc, RT_SRC_POS_ARGS, pszFormat, va); Assert(rc2 == rc); NOREF(rc2);
+    int const rc2 = VMSetErrorV(pDrvIns->Internal.s.pVMR3, rc, RT_SRC_POS_ARGS, pszFormat, va);
+    Assert(rc2 == rc); RT_NOREF_PV(rc2);
     return rc;
 }
@@ -1407 +1570 @@
     PDMDRV_ASSERT_DRVINS(pDrvIns);
     VM_ASSERT_EMT(pDrvIns->Internal.s.pVMR3);
-    LogFlow(("pdmR3DrvHlp_SSMRegister: caller='%s'/%d: uVersion=%#x cbGuess=%#x \n"
+    LogFlow(("pdmR3DrvHlp_SSMRegister: caller='%s'/%d: uVersion=%#x cbGuess=%#x\n"
              "    pfnLivePrep=%p pfnLiveExec=%p pfnLiveVote=%p  pfnSavePrep=%p pfnSaveExec=%p pfnSaveDone=%p pszLoadPrep=%p pfnLoadExec=%p pfnLoaddone=%p\n",
              pDrvIns->pReg->szName, pDrvIns->iInstance, uVersion, cbGuess,
@@ -1453 +1616 @@
 
 /** @interface_method_impl{PDMDRVHLPR3,pfnDBGFInfoRegister} */
-static DECLCALLBACK(int) pdmR3DrvHlp_DBGFInfoRegister(PPDMDRVINS pDrvIns, const char *pszName, const char *pszDesc, PFNDBGFHANDLERDRV pfnHandler)
+static DECLCALLBACK(int) pdmR3DrvHlp_DBGFInfoRegister(PPDMDRVINS pDrvIns, const char *pszName, const char *pszDesc,
+                                                      PFNDBGFHANDLERDRV pfnHandler)
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
@@ -1467 +1631 @@
 
 /** @interface_method_impl{PDMDRVHLPR3,pfnDBGFInfoRegisterArgv} */
-static DECLCALLBACK(int) pdmR3DrvHlp_DBGFInfoRegisterArgv(PPDMDRVINS pDrvIns, const char *pszName, const char *pszDesc, PFNDBGFINFOARGVDRV pfnHandler)
+static DECLCALLBACK(int) pdmR3DrvHlp_DBGFInfoRegisterArgv(PPDMDRVINS pDrvIns, const char *pszName, const char *pszDesc,
+                                                          PFNDBGFINFOARGVDRV pfnHandler)
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
@@ -1516 +1681 @@
 
 /** @interface_method_impl{PDMDRVHLPR3,pfnSTAMRegisterV} */
-static DECLCALLBACK(void) pdmR3DrvHlp_STAMRegisterV(PPDMDRVINS pDrvIns, void *pvSample, STAMTYPE enmType, STAMVISIBILITY enmVisibility,
-                                                    STAMUNIT enmUnit, const char *pszDesc, const char *pszName, va_list args)
+static DECLCALLBACK(void) pdmR3DrvHlp_STAMRegisterV(PPDMDRVINS pDrvIns, void *pvSample, STAMTYPE enmType,
+                                                    STAMVISIBILITY enmVisibility, STAMUNIT enmUnit, const char *pszDesc,
+                                                    const char *pszName, va_list args)
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
@@ -1546 +1712 @@
 
 /** @interface_method_impl{PDMDRVHLPR3,pfnSTAMRegisterF} */
-static DECLCALLBACK(void) pdmR3DrvHlp_STAMRegisterF(PPDMDRVINS pDrvIns, void *pvSample, STAMTYPE enmType, STAMVISIBILITY enmVisibility,
-                                                    STAMUNIT enmUnit, const char *pszDesc, const char *pszName, ...)
+static DECLCALLBACK(void) pdmR3DrvHlp_STAMRegisterF(PPDMDRVINS pDrvIns, void *pvSample, STAMTYPE enmType,
+                                                    STAMVISIBILITY enmVisibility, STAMUNIT enmUnit, const char *pszDesc,
+                                                    const char *pszName, ...)
 {
     va_list va;
@@ -1592 +1759 @@
     if (    uOperation >= VMMR0_DO_SRV_START
         &&  uOperation <  VMMR0_DO_SRV_END)
-        rc = SUPR3CallVMMR0Ex(VMCC_GET_VMR0_FOR_CALL(pDrvIns->Internal.s.pVMR3), NIL_VMCPUID, uOperation, 0, (PSUPVMMR0REQHDR)pvArg);
+        rc = SUPR3CallVMMR0Ex(VMCC_GET_VMR0_FOR_CALL(pDrvIns->Internal.s.pVMR3), NIL_VMCPUID,
+                              uOperation, 0, (PSUPVMMR0REQHDR)pvArg);
     else
     {
@@ -1605 +1773 @@
 
 /** @interface_method_impl{PDMDRVHLPR3,pfnUSBRegisterHub} */
-static DECLCALLBACK(int) pdmR3DrvHlp_USBRegisterHub(PPDMDRVINS pDrvIns, uint32_t fVersions, uint32_t cPorts, PCPDMUSBHUBREG pUsbHubReg, PPCPDMUSBHUBHLP ppUsbHubHlp)
+static DECLCALLBACK(int) pdmR3DrvHlp_USBRegisterHub(PPDMDRVINS pDrvIns, uint32_t fVersions, uint32_t cPorts,
+                                                    PCPDMUSBHUBREG pUsbHubReg, PPCPDMUSBHUBHLP ppUsbHubHlp)
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
@@ -1676 +1845 @@
 
 /** @interface_method_impl{PDMDRVHLPR3,pfnThreadCreate} */
-static DECLCALLBACK(int) pdmR3DrvHlp_ThreadCreate(PPDMDRVINS pDrvIns, PPPDMTHREAD ppThread, void *pvUser, PFNPDMTHREADDRV pfnThread,
-                                                  PFNPDMTHREADWAKEUPDRV pfnWakeup, size_t cbStack, RTTHREADTYPE enmType, const char *pszName)
+static DECLCALLBACK(int) pdmR3DrvHlp_ThreadCreate(PPDMDRVINS pDrvIns, PPPDMTHREAD ppThread, void *pvUser,
+                                                  PFNPDMTHREADDRV pfnThread, PFNPDMTHREADWAKEUPDRV pfnWakeup, size_t cbStack,
+                                                  RTTHREADTYPE enmType, const char *pszName)
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);

trunk/src/VBox/VMM/VMMR3/PDMUsb.cpp

@@ -142 +142 @@
      * Check for duplicate registration and find the last hub for FIFO registration.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     PPDMUSBHUB pPrev = NULL;
     for (PPDMUSBHUB pCur = pVM->pdm.s.pUsbHubs; pCur; pCur = pCur->pNext)
     {
         if (pCur->pDrvIns == pDrvIns)
+        {
+            RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
             return VERR_PDM_USB_HUB_EXISTS;
+        }
         pPrev = pCur;
     }
@@ -155 +160 @@
     PPDMUSBHUB pHub = (PPDMUSBHUB)MMR3HeapAlloc(pVM, MM_TAG_PDM_DRIVER, sizeof(*pHub));
     if (!pHub)
+    {
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
         return VERR_NO_MEMORY;
+    }
 
     pHub->fVersions = fVersions;
@@ -169 +177 @@
     else
         pVM->pdm.s.pUsbHubs = pHub;
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     Log(("PDM: Registered USB hub %p/%s\n", pDrvIns, pDrvIns->pReg->szName));
@@ -251 +261 @@
      * Check for duplicate and find FIFO entry at the same time.
      */
-    PCPDMUSBREGCBINT pRegCB = (PCPDMUSBREGCBINT)pCallbacks;
+    PCPDMUSBREGCBINT const pRegCB   = (PCPDMUSBREGCBINT)pCallbacks;
+    PVM const              pVM      = pRegCB->pVM;
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     PPDMUSB pUsbPrev = NULL;
-    PPDMUSB pUsb = pRegCB->pVM->pdm.s.pUsbDevs;
+    PPDMUSB pUsb     = pVM->pdm.s.pUsbDevs;
     for (; pUsb; pUsbPrev = pUsb, pUsb = pUsb->pNext)
-        AssertMsgReturn(strcmp(pUsb->pReg->szName, pReg->szName),
-                        ("USB Device '%s' already exists\n", pReg->szName),
-                        VERR_PDM_USB_NAME_CLASH);
+        AssertMsgReturnStmt(strcmp(pUsb->pReg->szName, pReg->szName),
+                            ("USB Device '%s' already exists\n", pReg->szName),
+                            RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw),
+                            VERR_PDM_USB_NAME_CLASH);
 
     /*
      * Allocate new device structure and insert it into the list.
      */
-    pUsb = (PPDMUSB)MMR3HeapAlloc(pRegCB->pVM, MM_TAG_PDM_DEVICE, sizeof(*pUsb));
+    pUsb = (PPDMUSB)MMR3HeapAlloc(pVM, MM_TAG_PDM_DEVICE, sizeof(*pUsb));
     if (pUsb)
     {
@@ -274 +288 @@
             pUsbPrev->pNext = pUsb;
         else
-            pRegCB->pVM->pdm.s.pUsbDevs = pUsb;
+            pVM->pdm.s.pUsbDevs = pUsb;
+
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
         Log(("PDM: Registered USB device '%s'\n", pReg->szName));
         return VINF_SUCCESS;
     }
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
     return VERR_NO_MEMORY;
 }
@@ -402 +420 @@
 int pdmR3UsbVMInitComplete(PVM pVM)
 {
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMUSBINS pUsbIns = pVM->pdm.s.pUsbInstances; pUsbIns; pUsbIns = pUsbIns->Internal.s.pNext)
     {
         if (pUsbIns->pReg->pfnVMInitComplete)
         {
+            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
             int rc = pUsbIns->pReg->pfnVMInitComplete(pUsbIns);
             if (RT_FAILURE(rc))
@@ -413 +433 @@
                 return rc;
             }
-        }
-    }
+            RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
+        }
+    }
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     return VINF_SUCCESS;
 }
@@ -425 +447 @@
 PPDMUSB pdmR3UsbLookup(PVM pVM, const char *pszName)
 {
-    size_t cchName = strlen(pszName);
+    size_t const cchName = strlen(pszName);
+
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMUSB pUsb = pVM->pdm.s.pUsbDevs; pUsb; pUsb = pUsb->pNext)
-        if (    pUsb->cchName == cchName
-            &&  !strcmp(pUsb->pReg->szName, pszName))
+        if (   pUsb->cchName == cchName
+            && !strcmp(pUsb->pReg->szName, pszName))
+        {
+            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
             return pUsb;
+        }
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     return NULL;
 }
@@ -449 +477 @@
         return VERR_PDM_NO_USB_HUBS;
 
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMUSBHUB pCur = pVM->pdm.s.pUsbHubs; pCur; pCur = pCur->pNext)
         if (pCur->cAvailablePorts > 0)
@@ -459 +488 @@
             }
             /* For high-speed USB 2.0 devices only, allow USB 1.1 fallback. */
-            if ((iUsbVersion & VUSB_STDVER_20) && (pCur->fVersions == VUSB_STDVER_11))
+            if ((iUsbVersion & VUSB_STDVER_20) && pCur->fVersions == VUSB_STDVER_11)
                 *ppHub = pCur;
         }
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     if (*ppHub)
         return VINF_SUCCESS;
@@ -662 +692 @@
      * Link it into all the lists.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     /* The global instance FIFO. */
     PPDMUSBINS pPrev1 = pVM->pdm.s.pUsbInstances;
@@ -689 +721 @@
         pPrev2->Internal.s.pPerDeviceNext = pUsbIns;
     }
+
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     /*
@@ -1138 +1172 @@
      * Destroy the luns with their driver chains and call the device destructor.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
     while (pUsbIns->Internal.s.pLuns)
     {
@@ -1143 +1178 @@
         pUsbIns->Internal.s.pLuns = pLun->pNext;
         if (pLun->pTop)
-            pdmR3DrvDestroyChain(pLun->pTop, PDM_TACH_FLAGS_NOT_HOT_PLUG); /* Hotplugging is handled differently here atm. */
+            pdmR3DrvDestroyChain(pVM, pLun->pTop, PDM_TACH_FLAGS_NOT_HOT_PLUG); /* Hotplugging is handled differently here atm. */
         MMR3HeapFree(pLun);
     }
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
     /* finally, the device. */
@@ -1163 +1199 @@
      * Unlink it.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     /* The global instance FIFO. */
     if (pVM->pdm.s.pUsbInstances == pUsbIns)
@@ -1196 +1234 @@
     }
 
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     /*
      * Trash it.
@@ -1225 +1265 @@
      */
     UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
-    PVM pVM = pUVM->pVM;
+    PVM const pVM = pUVM->pVM;
     VM_ASSERT_VALID_EXT_RETURN(pVM, VERR_INVALID_VM_HANDLE);
     VM_ASSERT_EMT(pVM);
@@ -1233 +1273 @@
      * Search the global list for it.
      */
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     PPDMUSBINS pUsbIns = pVM->pdm.s.pUsbInstances;
     for ( ; pUsbIns; pUsbIns = pUsbIns->Internal.s.pNext)
@@ -1238 +1279 @@
             break;
     if (!pUsbIns)
+    {
+        RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
         return VERR_PDM_DEVICE_INSTANCE_NOT_FOUND; /** @todo VERR_PDM_USB_INSTANCE_NOT_FOUND */
+    }
 
     /*
@@ -1244 +1288 @@
      */
     PPDMUSBHUB pHub = pUsbIns->Internal.s.pHub;
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw); /** @todo would be nice to call the pfnDetachDevice owning this.. */
     if (pHub)
     {
@@ -1254 +1299 @@
         }
 
+        RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
         pHub->cAvailablePorts++;
         Assert(pHub->cAvailablePorts > 0 && pHub->cAvailablePorts <= pHub->cPorts);
         pUsbIns->Internal.s.pHub = NULL;
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
     }
 
@@ -1292 +1339 @@
  * @param   iLun            The Logical Unit to obtain the interface of.
  * @param   ppLun           Where to store the pointer to the LUN if found.
- * @thread  Try only do this in EMT...
  */
 static int pdmR3UsbFindLun(PVM pVM, const char *pszDevice, unsigned iInstance, unsigned iLun, PPPDMLUN ppLun)
@@ -1299 +1345 @@
      * Iterate registered devices looking for the device.
      */
-    size_t cchDevice = strlen(pszDevice);
+    size_t const cchDevice = strlen(pszDevice);
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
     for (PPDMUSB pUsbDev = pVM->pdm.s.pUsbDevs; pUsbDev; pUsbDev = pUsbDev->pNext)
     {
-        if (    pUsbDev->cchName == cchDevice
-            &&  !memcmp(pUsbDev->pReg->szName, pszDevice, cchDevice))
+        if (   pUsbDev->cchName == cchDevice
+            && !memcmp(pUsbDev->pReg->szName, pszDevice, cchDevice))
         {
             /*
@@ -1320 +1367 @@
                         {
                             *ppLun = pLun;
+                            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                             return VINF_SUCCESS;
                         }
                     }
+                    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                     return VERR_PDM_LUN_NOT_FOUND;
                 }
             }
+            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
             return VERR_PDM_DEVICE_INSTANCE_NOT_FOUND;
         }
     }
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     return VERR_PDM_DEVICE_NOT_FOUND;
 }
@@ -1355 +1406 @@
     LogFlow(("PDMR3UsbDriverAttach: pszDevice=%p:{%s} iDevIns=%d iLun=%d fFlags=%#x ppBase=%p\n",
              pszDevice, pszDevice, iDevIns, iLun, fFlags, ppBase));
+    if (ppBase)
+        *ppBase = NULL;
     UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
-    PVM pVM = pUVM->pVM;
+    PVM const pVM = pUVM->pVM;
     VM_ASSERT_VALID_EXT_RETURN(pVM, VERR_INVALID_VM_HANDLE);
     VM_ASSERT_EMT(pVM);
-
-    if (ppBase)
-        *ppBase = NULL;
 
     /*
@@ -1453 +1503 @@
      * Find the LUN in question.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
+
     PPDMLUN pLun;
     int rc = pdmR3UsbFindLun(pVM, pszDevice, iDevIns, iLun, &pLun);
@@ -1477 +1529 @@
             }
             if (pDrvIns)
-                rc = pdmR3DrvDetach(pDrvIns, fFlags);
-            else
-                rc = VERR_PDM_DRIVER_INSTANCE_NOT_FOUND;
+            {
+                rc = pdmR3DrvDetach(pVM, pDrvIns, fFlags);
+
+                RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
+                LogFlow(("PDMR3UsbDriverDetach: returns %Rrc (pdmR3DrvDetach)\n", rc));
+                return rc;
+            }
+            rc = VERR_PDM_DRIVER_INSTANCE_NOT_FOUND;
         }
         else
@@ -1485 +1542 @@
     }
 
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
     LogFlow(("PDMR3UsbDriverDetach: returns %Rrc\n", rc));
     return rc;
@@ -1506 +1564 @@
     LogFlow(("PDMR3UsbQueryLun: pszDevice=%p:{%s} iInstance=%u iLun=%u ppBase=%p\n",
              pszDevice, pszDevice, iInstance, iLun, ppBase));
+    *ppBase = NULL;
     UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
     PVM pVM = pUVM->pVM;
@@ -1513 +1572 @@
      * Find the LUN.
      */
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
+
     PPDMLUN pLun;
     int rc = pdmR3UsbFindLun(pVM, pszDevice, iInstance, iLun, &pLun);
@@ -1520 +1581 @@
         {
             *ppBase = &pLun->pTop->IBase;
+
+            RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
             LogFlow(("PDMR3UsbQueryLun: return %Rrc and *ppBase=%p\n", VINF_SUCCESS, *ppBase));
             return VINF_SUCCESS;
@@ -1525 +1588 @@
         rc = VERR_PDM_NO_DRIVER_ATTACHED_TO_LUN;
     }
+
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     LogFlow(("PDMR3UsbQueryLun: returns %Rrc\n", rc));
     return rc;
@@ -1552 +1617 @@
     LogFlow(("PDMR3QueryDriverOnLun: pszDevice=%p:{%s} iInstance=%u iLun=%u pszDriver=%p:{%s} ppBase=%p\n",
              pszDevice, pszDevice, iInstance, iLun, pszDriver, pszDriver, ppBase));
+    *ppBase = NULL;
     UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
     PVM pVM = pUVM->pVM;
@@ -1559 +1625 @@
      * Find the LUN.
      */
+    RTCritSectRwEnterShared(&pVM->pdm.s.CoreListCritSectRw);
+
     PPDMLUN pLun;
     int rc = pdmR3UsbFindLun(pVM, pszDevice, iInstance, iLun, &pLun);
@@ -1569 +1637 @@
                 {
                     *ppBase = &pDrvIns->IBase;
+
+                    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
                     LogFlow(("PDMR3UsbQueryDriverOnLun: return %Rrc and *ppBase=%p\n", VINF_SUCCESS, *ppBase));
                     return VINF_SUCCESS;
-
                 }
             rc = VERR_PDM_DRIVER_NOT_FOUND;
@@ -1578 +1647 @@
             rc = VERR_PDM_NO_DRIVER_ATTACHED_TO_LUN;
     }
+
+    RTCritSectRwLeaveShared(&pVM->pdm.s.CoreListCritSectRw);
     LogFlow(("PDMR3UsbQueryDriverOnLun: returns %Rrc\n", rc));
     return rc;
@@ -1600 +1671 @@
      * Lookup the LUN, it might already be registered.
      */
+    RTCritSectRwEnterExcl(&pVM->pdm.s.CoreListCritSectRw);
     PPDMLUN pLunPrev = NULL;
     PPDMLUN pLun = pUsbIns->Internal.s.pLuns;
@@ -1611 +1683 @@
     if (!pLun)
     {
-        if (    !pBaseInterface
-            ||  !pszDesc
-            ||  !*pszDesc)
-        {
+        if (   !pBaseInterface
+            || !pszDesc
+            || !*pszDesc)
+        {
+            RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
             Assert(pBaseInterface);
             Assert(pszDesc || *pszDesc);
@@ -1622 +1695 @@
         pLun = (PPDMLUN)MMR3HeapAlloc(pVM, MM_TAG_PDM_LUN, sizeof(*pLun));
         if (!pLun)
+        {
+            RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
             return VERR_NO_MEMORY;
+        }
 
         pLun->iLun      = iLun;
@@ -1641 +1717 @@
     else if (pLun->pTop)
     {
+        RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
         AssertMsgFailed(("Already attached! The device should keep track of such things!\n"));
         LogFlow(("pdmR3UsbHlp_DriverAttach: caller='%s'/%d: returns %Rrc\n", pUsbIns->pReg->szName, pUsbIns->iInstance, VERR_PDM_DRIVER_ALREADY_ATTACHED));
@@ -1657 +1734 @@
     else
         rc = VERR_PDM_NO_ATTACHED_DRIVER;
+    RTCritSectRwLeaveExcl(&pVM->pdm.s.CoreListCritSectRw);
 
 

trunk/src/VBox/VMM/VMMR3/VMMR3.def

@@ -281 +281 @@
     PDMR3DriverAttach
     PDMR3DriverDetach
+    PDMR3DriverEnumInstances
     PDMR3NsBwGroupSetLimit
     PDMR3QueryDeviceLun

trunk/src/VBox/VMM/include/PDMInternal.h

@@ -417 +417 @@
     /** Pointer to the ring-0 request handler function. */
     PFNPDMDRVREQHANDLERR0           pfnReqHandlerR0;
+    /** Pointer to the next instance (starts at PDMDRV::pInstances). */
+    R3PTRTYPE(PPDMDRVINS)           pNext;
 } PDMDRVINSINT;
 
@@ -610 +612 @@
     PPDMDRVINS                      pBottom;
     /** Pointer to the device instance which the LUN belongs to.
-     * Either this is set or pUsbIns is set. Both is never set at the same time. */
+     * Either this is set or pUsbIns is set. Both are never set at the same time. */
     PPDMDEVINS                      pDevIns;
     /** Pointer to the USB device instance which the LUN belongs to. */
@@ -698 +700 @@
     /** The search path for ring-0 context modules (';' as separator). */
     char                           *pszR0SearchPath;
+    /** Pointer to chain of instances. */
+    PPDMDRVINSR3                    pInstances;
 } PDMDRV;
 
@@ -1464 +1468 @@
      * concurrently. */
     PDMCRITSECT                     NopCritSect;
+    /** Critical read/write section protecting the core list: devices,
+     *  usb devices, drivers.
+     * @note The PDMUSERPERVM::ListCritSect lock covers queues and the stuff in
+     *       PDMUSERPERVM. */
+    RTCRITSECTRW                    CoreListCritSectRw;
 
     /** The ring-0 capable task sets (max 128). */
@@ -1504 +1513 @@
     /** The registered RTC device. */
     R3PTRTYPE(PPDMRTC)              pRtc;
-    /** The registered USB HUBs. (FIFO) */
+    /** The registered USB HUBs. (FIFO)
+     * @note Protected by CoreListCritSectRw. */
     R3PTRTYPE(PPDMUSBHUB)           pUsbHubs;
 
     /** @name Queues
+     * @note Protected by PDMUSERPERVM::ListCritSect.
      * @{ */
     /** Number of ring-0 capable queues in apQueues. */
@@ -1652 +1663 @@
     /** @todo move more stuff over here. */
 
-    /** Lock protecting the lists below it and the queue list. */
+    /** Lock protecting the lists below it and the queue list (in PDM). */
     RTCRITSECT                      ListCritSect;
     /** Pointer to list of loaded modules. */
@@ -1772 +1783 @@
 int         pdmR3DrvInstantiate(PVM pVM, PCFGMNODE pNode, PPDMIBASE pBaseInterface, PPDMDRVINS pDrvAbove,
                                 PPDMLUN pLun, PPDMIBASE *ppBaseInterface);
-int         pdmR3DrvDetach(PPDMDRVINS pDrvIns, uint32_t fFlags);
-void        pdmR3DrvDestroyChain(PPDMDRVINS pDrvIns, uint32_t fFlags);
+int         pdmR3DrvDetach(PVM pVM, PPDMDRVINS pDrvIns, uint32_t fFlags);
+void        pdmR3DrvDestroyChain(PVM pVM, PPDMDRVINS pDrvIns, uint32_t fFlags);
 PPDMDRV     pdmR3DrvLookup(PVM pVM, const char *pszName);