Changeset 21456 in vbox

Timestamp:

Jul 9, 2009 8:09:23 PM (15 years ago)

Author:

vboxsync

Message:

HGCM&Co: physical page list.

Location:

trunk

Files:

• include/VBox/VBoxGuestLib.h (modified) (2 diffs)
• include/VBox/VMMDev.h (modified) (6 diffs)
• src/VBox/Additions/WINNT/VBoxGuest/VBoxGuest.cpp (modified) (4 diffs)
• src/VBox/Additions/common/VBoxGuest/VBoxGuest.cpp (modified) (2 diffs)
• src/VBox/Additions/common/VBoxGuestLib/HGCMInternal.cpp (modified) (6 diffs)
• src/VBox/Devices/VMMDev/VMMDev.cpp (modified) (1 diff)
• src/VBox/Devices/VMMDev/VMMDevHGCM.cpp (modified) (14 diffs)
• src/VBox/Devices/VMMDev/VMMDevHGCM.h (modified) (1 diff)

trunk/include/VBox/VBoxGuestLib.h

@@ -225 +225 @@
  * @return VBox status code.
  */
-DECLR0VBGL(int) VbglR0HGCMInternalCall (VBoxGuestHGCMCallInfo *pCallInfo, uint32_t fFlags,
+DECLR0VBGL(int) VbglR0HGCMInternalCall (VBoxGuestHGCMCallInfo *pCallInfo, uint32_t cbCallInfo, uint32_t fFlags,
                                         VBGLHGCMCALLBACK *pAsyncCallback, void *pvAsyncData, uint32_t u32AsyncData);
 
@@ -242 +242 @@
  * @return VBox status code.
  */
-DECLR0VBGL(int) VbglR0HGCMInternalCall32 (VBoxGuestHGCMCallInfo *pCallInfo, uint32_t fFlags,
+DECLR0VBGL(int) VbglR0HGCMInternalCall32 (VBoxGuestHGCMCallInfo *pCallInfo, uint32_t cbCallInfo, uint32_t fFlags,
                                           VBGLHGCMCALLBACK *pAsyncCallback, void *pvAsyncData, uint32_t u32AsyncData);
 

trunk/include/VBox/VMMDev.h

@@ -105 +105 @@
  * Additions version is reported to host (VMMDev) by VMMDevReq_ReportGuestInfo.
  *
- * @remark  These defines also live in the 16-bit and assembly versions of this header.
+ * @remarks These defines also live in the 16-bit and assembly versions of this
+ *          header.
  */
 #define VMMDEV_VERSION                      0x00010004
@@ -1005 +1006 @@
     VMMDevHGCMParmType_64bit              = 2,
     VMMDevHGCMParmType_PhysAddr           = 3,
-    VMMDevHGCMParmType_LinAddr            = 4, /**< In and Out */
-    VMMDevHGCMParmType_LinAddr_In         = 5, /**< In  (read;  host<-guest) */
-    VMMDevHGCMParmType_LinAddr_Out        = 6, /**< Out (write; host->guest) */
-    VMMDevHGCMParmType_LinAddr_Locked     = 7, /**< Locked In and Out */
-    VMMDevHGCMParmType_LinAddr_Locked_In  = 8, /**< Locked In  (read;  host<-guest) */
-    VMMDevHGCMParmType_LinAddr_Locked_Out = 9, /**< Locked Out (write; host->guest) */
+    VMMDevHGCMParmType_LinAddr            = 4,  /**< In and Out */
+    VMMDevHGCMParmType_LinAddr_In         = 5,  /**< In  (read;  host<-guest) */
+    VMMDevHGCMParmType_LinAddr_Out        = 6,  /**< Out (write; host->guest) */
+    VMMDevHGCMParmType_LinAddr_Locked     = 7,  /**< Locked In and Out */
+    VMMDevHGCMParmType_LinAddr_Locked_In  = 8,  /**< Locked In  (read;  host<-guest) */
+    VMMDevHGCMParmType_LinAddr_Locked_Out = 9,  /**< Locked Out (write; host->guest) */
+    VMMDevHGCMParmType_PageList           = 10, /**< Physical addresses of locked pages for a buffer. */
     VMMDevHGCMParmType_SizeHack           = 0x7fffffff
 } HGCMFunctionParameterType;
@@ -1036 +1038 @@
             } u;
         } Pointer;
+        struct
+        {
+            uint32_t size;   /**< Size of the buffer described by the page list. */
+            uint32_t offset; /**< Relative to the request header, valid if size != 0. */
+        } PageList;
     } u;
 #  ifdef __cplusplus
@@ -1101 +1108 @@
             } u;
         } Pointer;
+        struct
+        {
+            uint32_t size;   /**< Size of the buffer described by the page list. */
+            uint32_t offset; /**< Relative to the request header, valid if size != 0. */
+        } PageList;
     } u;
 #  ifdef __cplusplus
@@ -1181 +1193 @@
             } u;
         } Pointer;
+        struct
+        {
+            uint32_t size;   /**< Size of the buffer described by the page list. */
+            uint32_t offset; /**< Relative to the request header, valid if size != 0. */
+        } PageList;
     } u;
 #  ifdef __cplusplus
@@ -1246 +1263 @@
 } VMMDevHGCMCall;
 AssertCompileSize(VMMDevHGCMCall, 32+12);
+
+/** @name Direction of data transfer (HGCMPageListInfo::flags). Bit flags.
+ * @{ */
+#define VBOX_HGCM_F_PARM_DIRECTION_NONE      UINT32_C(0x00000000)
+#define VBOX_HGCM_F_PARM_DIRECTION_TO_HOST   UINT32_C(0x00000001)
+#define VBOX_HGCM_F_PARM_DIRECTION_FROM_HOST UINT32_C(0x00000002)
+#define VBOX_HGCM_F_PARM_DIRECTION_BOTH      UINT32_C(0x00000003)
+/** @} */
+
+/**
+ * VMMDevHGCMParmType_PageList points to this structure to actually describe the
+ * buffer.
+ */
+typedef struct _HGCMPageListInfo
+{
+    uint32_t flags;        /* VBOX_HGCM_F_PARM_*. */
+    uint16_t offFirstPage; /* Offset in the first page where data begins. */
+    uint16_t cPages;       /* Number of pages. */
+    RTGCPHYS64 aPages[1];  /* Page addesses. */
+} HGCMPageListInfo;
+AssertCompileSize(HGCMPageListInfo, 4+2+2+8);
 
 # pragma pack()

trunk/src/VBox/Additions/WINNT/VBoxGuest/VBoxGuest.cpp

@@ -1192 +1192 @@
             uint32_t fFlags = pIrp->RequestorMode == KernelMode ? VBGLR0_HGCMCALL_F_KERNEL : VBGLR0_HGCMCALL_F_USER;
 
-            rc = VbglR0HGCMInternalCall32(ptr, fFlags, pIrp->RequestorMode == KernelMode? VBoxHGCMCallbackKernelMode :VBoxHGCMCallback, pDevExt, RT_INDEFINITE_WAIT);
+            rc = VbglR0HGCMInternalCall32(ptr, pStack->Parameters.DeviceIoControl.InputBufferLength, fFlags,
+                                          pIrp->RequestorMode == KernelMode? VBoxHGCMCallbackKernelMode :VBoxHGCMCallback,
+                                          pDevExt, RT_INDEFINITE_WAIT);
 
             if (RT_FAILURE(rc))
@@ -1225 +1227 @@
             uint32_t fFlags = pIrp->RequestorMode == KernelMode ? VBGLR0_HGCMCALL_F_KERNEL : VBGLR0_HGCMCALL_F_USER;
 
-            rc = VbglR0HGCMInternalCall (ptr, fFlags, pIrp->RequestorMode == KernelMode? VBoxHGCMCallbackKernelMode :VBoxHGCMCallback,
+            rc = VbglR0HGCMInternalCall (ptr, pStack->Parameters.DeviceIoControl.InputBufferLength, fFlags,
+                                         pIrp->RequestorMode == KernelMode? VBoxHGCMCallbackKernelMode :VBoxHGCMCallback,
                                          pDevExt, RT_INDEFINITE_WAIT);
 
@@ -1263 +1266 @@
                 dprintf(("VBoxGuest::VBoxGuestDeviceControl: calling VBoxHGCMCall interruptible, timeout %lu ms\n",
                          pInfo->u32Timeout));
-                rc = VbglR0HGCMInternalCall (ptr, fFlags, VBoxHGCMCallbackInterruptible, pDevExt, pInfo->u32Timeout);
+                rc = VbglR0HGCMInternalCall (ptr, pStack->Parameters.DeviceIoControl.InputBufferLength, fFlags,
+                                             VBoxHGCMCallbackInterruptible, pDevExt, pInfo->u32Timeout);
             }
             else
@@ -1269 +1273 @@
                 dprintf(("VBoxGuest::VBoxGuestDeviceControl: calling VBoxHGCMCall, timeout %lu ms\n",
                          pInfo->u32Timeout));
-                rc = VbglR0HGCMInternalCall (ptr, fFlags, VBoxHGCMCallback, pDevExt, pInfo->u32Timeout);
+                rc = VbglR0HGCMInternalCall (ptr, pStack->Parameters.DeviceIoControl.InputBufferLength, fFlags,
+                                             VBoxHGCMCallback, pDevExt, pInfo->u32Timeout);
             }
 

trunk/src/VBox/Additions/common/VBoxGuest/VBoxGuest.cpp

@@ -1126 +1126 @@
     {
         if (fInterruptible)
-            rc = VbglR0HGCMInternalCall32(pInfo, fFlags, VBoxGuestHGCMAsyncWaitCallbackInterruptible, pDevExt, cMillies);
+            rc = VbglR0HGCMInternalCall32(pInfo, cbData - cbExtra, fFlags, VBoxGuestHGCMAsyncWaitCallbackInterruptible, pDevExt, cMillies);
         else
-            rc = VbglR0HGCMInternalCall32(pInfo, fFlags, VBoxGuestHGCMAsyncWaitCallback, pDevExt, cMillies);
+            rc = VbglR0HGCMInternalCall32(pInfo, cbData - cbExtra, fFlags, VBoxGuestHGCMAsyncWaitCallback, pDevExt, cMillies);
     }
     else
@@ -1134 +1134 @@
     {
         if (fInterruptible)
-            rc = VbglR0HGCMInternalCall(pInfo, fFlags, VBoxGuestHGCMAsyncWaitCallbackInterruptible, pDevExt, cMillies);
+            rc = VbglR0HGCMInternalCall(pInfo, cbData - cbExtra, fFlags, VBoxGuestHGCMAsyncWaitCallbackInterruptible, pDevExt, cMillies);
         else
-            rc = VbglR0HGCMInternalCall(pInfo, fFlags, VBoxGuestHGCMAsyncWaitCallback, pDevExt, cMillies);
+            rc = VbglR0HGCMInternalCall(pInfo, cbData - cbExtra, fFlags, VBoxGuestHGCMAsyncWaitCallback, pDevExt, cMillies);
     }
     if (RT_SUCCESS(rc))

trunk/src/VBox/Additions/common/VBoxGuestLib/HGCMInternal.cpp

@@ -122 +122 @@
 
 /** @todo merge with the one below (use a header file). Too lazy now. */
-DECLR0VBGL(int) VbglR0HGCMInternalCall (VBoxGuestHGCMCallInfo *pCallInfo, uint32_t fFlags,
+DECLR0VBGL(int) VbglR0HGCMInternalCall (VBoxGuestHGCMCallInfo *pCallInfo, uint32_t cbCallInfo, uint32_t fFlags,
                                         VBGLHGCMCALLBACK *pAsyncCallback, void *pvAsyncData, uint32_t u32AsyncData)
 {
@@ -140 +140 @@
     pHGCMCall = NULL;
 
-    cbParms = pCallInfo->cParms * sizeof (HGCMFunctionParameter);
+    if (cbCallInfo == 0)
+    {
+        /* Caller did not specify the size (a valid value should be at least sizeof(VBoxGuestHGCMCallInfo)).
+         * Compute the size.
+         */
+        cbParms = pCallInfo->cParms * sizeof (HGCMFunctionParameter32);
+    }
+    else if (cbCallInfo < sizeof (VBoxGuestHGCMCallInfo))
+    {
+        return VERR_INVALID_PARAMETER;
+    }
+    else
+    {
+        cbParms = cbCallInfo - sizeof (VBoxGuestHGCMCallInfo);
+    }
 
     /* Allocate request */
@@ -195 +209 @@
                     else
                         pParm->type = VMMDevHGCMParmType_LinAddr;
+                    break;
+
+                case VMMDevHGCMParmType_PageList:
+                    if ((fFlags & VBGLR0_HGCMCALL_F_MODE_MASK) == VBGLR0_HGCMCALL_F_USER)
+                        rc = VERR_INVALID_PARAMETER;
                     break;
 
@@ -307 +326 @@
 # if ARCH_BITS == 64
 /** @todo merge with the one above (use a header file). Too lazy now. */
-DECLR0VBGL(int) VbglR0HGCMInternalCall32 (VBoxGuestHGCMCallInfo *pCallInfo, uint32_t fFlags,
+DECLR0VBGL(int) VbglR0HGCMInternalCall32 (VBoxGuestHGCMCallInfo *pCallInfo, uint32_t cbCallInfo, uint32_t fFlags,
                                           VBGLHGCMCALLBACK *pAsyncCallback, void *pvAsyncData, uint32_t u32AsyncData)
 {
@@ -325 +344 @@
     pHGCMCall = NULL;
 
-    cbParms = pCallInfo->cParms * sizeof (HGCMFunctionParameter32);
+    if (cbCallInfo == 0)
+    {
+        /* Caller did not specify the size (a valid value should be at least sizeof(VBoxGuestHGCMCallInfo)).
+         * Compute the size.
+         */
+        cbParms = pCallInfo->cParms * sizeof (HGCMFunctionParameter32);
+    }
+    else if (cbCallInfo < sizeof (VBoxGuestHGCMCallInfo))
+    {
+        return VERR_INVALID_PARAMETER;
+    }
+    else
+    {
+        cbParms = cbCallInfo - sizeof (VBoxGuestHGCMCallInfo);
+    }
 
     /* Allocate request */
@@ -380 +413 @@
                     else
                         pParm->type = VMMDevHGCMParmType_LinAddr;
+                    break;
+
+                case VMMDevHGCMParmType_PageList:
+                    if ((fFlags & VBGLR0_HGCMCALL_F_MODE_MASK) == VBGLR0_HGCMCALL_F_USER)
+                        rc = VERR_INVALID_PARAMETER;
                     break;
 

trunk/src/VBox/Devices/VMMDev/VMMDev.cpp

@@ -1108 +1108 @@
 #endif /* VBOX_WITH_64_BITS_GUESTS */
 
-                pRequestHeader->rc = vmmdevHGCMCall (pThis, pHGCMCall, (RTGCPHYS)u32, f64Bits);
+                pRequestHeader->rc = vmmdevHGCMCall (pThis, pHGCMCall, requestHeader.size, (RTGCPHYS)u32, f64Bits);
             }
             break;

trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp

@@ -338 +338 @@
 }
 
+static int vmmdevHGCMPageListRead(PPDMDEVINSR3 pDevIns, void *pvDst, uint32_t cbDst, const HGCMPageListInfo *pPageListInfo)
+{
+    int rc = VINF_SUCCESS;
+
+    uint8_t *pu8Dst = (uint8_t *)pvDst;
+    uint32_t offPage = pPageListInfo->offFirstPage;
+    size_t cbRemaining = (size_t)cbDst;
+
+    uint32_t iPage;
+    for (iPage = 0; iPage < pPageListInfo->cPages; iPage++)
+    {
+        if (cbRemaining == 0)
+        {
+            break;
+        }
+
+        size_t cbChunk = PAGE_SIZE - offPage;
+
+        if (cbChunk > cbRemaining)
+        {
+            cbChunk = cbRemaining;
+        }
+
+        rc = PDMDevHlpPhysRead(pDevIns,
+                               pPageListInfo->aPages[iPage] + offPage,
+                               pu8Dst, cbChunk);
+
+        AssertRCBreak(rc);
+
+        offPage = 0; /* A next page is read from 0 offset. */
+        cbRemaining -= cbChunk;
+        pu8Dst += cbChunk;
+    }
+
+    return rc;
+}
+
+static int vmmdevHGCMPageListWrite(PPDMDEVINSR3 pDevIns, const HGCMPageListInfo *pPageListInfo, const void *pvSrc, uint32_t cbSrc)
+{
+    int rc = VINF_SUCCESS;
+
+    uint8_t *pu8Src = (uint8_t *)pvSrc;
+    uint32_t offPage = pPageListInfo->offFirstPage;
+    size_t cbRemaining = (size_t)cbSrc;
+
+    uint32_t iPage;
+    for (iPage = 0; iPage < pPageListInfo->cPages; iPage++)
+    {
+        if (cbRemaining == 0)
+        {
+            break;
+        }
+
+        size_t cbChunk = PAGE_SIZE - offPage;
+
+        if (cbChunk > cbRemaining)
+        {
+            cbChunk = cbRemaining;
+        }
+
+        rc = PDMDevHlpPhysWrite(pDevIns,
+                                pPageListInfo->aPages[iPage] + offPage,
+                                pu8Src, cbChunk);
+
+        AssertRCBreak(rc);
+
+        offPage = 0; /* A next page is read from 0 offset. */
+        cbRemaining -= cbChunk;
+        pu8Src += cbChunk;
+    }
+
+    return rc;
+}
+
 static void logRelSavedCmdSizeMismatch (const char *pszFunction, uint32_t cbExpected, uint32_t cbCmdSize)
 {
@@ -456 +530 @@
 }
 
-
-int vmmdevHGCMCall (VMMDevState *pVMMDevState, VMMDevHGCMCall *pHGCMCall, RTGCPHYS GCPhys, bool f64Bits)
+int vmmdevHGCMCall (VMMDevState *pVMMDevState, VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall, RTGCPHYS GCPhys, bool f64Bits)
 {
     int rc = VINF_SUCCESS;
@@ -516 +589 @@
                 } break;
 
+                case VMMDevHGCMParmType_PageList:
+                {
+                    cbCmdSize += pGuestParm->u.PageList.size;
+                    Log(("vmmdevHGCMCall: pagelist size = %d\n", pGuestParm->u.PageList.size));
+                } break;
+
                 case VMMDevHGCMParmType_32bit:
                 case VMMDevHGCMParmType_64bit:
@@ -560 +639 @@
 
                     Log(("vmmdevHGCMCall: linptr size = %d\n", pGuestParm->u.Pointer.size));
+                } break;
+
+                case VMMDevHGCMParmType_PageList:
+                {
+                    cbCmdSize += pGuestParm->u.PageList.size;
+                    Log(("vmmdevHGCMCall: pagelist size = %d\n", pGuestParm->u.PageList.size));
                 } break;
 
@@ -727 +812 @@
                      }
 
+                     case VMMDevHGCMParmType_PageList:
+                     {
+                         uint32_t size = pGuestParm->u.PageList.size;
+
+                         /* Check that the page list info is within the request. */
+                         if (   cbHGCMCall < sizeof (HGCMPageListInfo)
+                             || pGuestParm->u.PageList.offset > cbHGCMCall - sizeof (HGCMPageListInfo))
+                         {
+                             rc = VERR_INVALID_PARAMETER;
+                             break;
+                         }
+
+                         /* At least the structure is within. */
+                         HGCMPageListInfo *pPageListInfo = (HGCMPageListInfo *)((uint8_t *)pHGCMCall + pGuestParm->u.PageList.offset);
+
+                         uint32_t cbPageListInfo = sizeof (HGCMPageListInfo) + (pPageListInfo->cPages - 1) * sizeof (pPageListInfo->aPages[0]);
+
+                         if (   pPageListInfo->cPages == 0
+                             || cbHGCMCall < pGuestParm->u.PageList.offset + cbPageListInfo)
+                         {
+                             rc = VERR_INVALID_PARAMETER;
+                             break;
+                         }
+
+                         pHostParm->type = VBOX_HGCM_SVC_PARM_PTR;
+                         pHostParm->u.pointer.size = size;
+
+                         /* Copy guest data to an allocated buffer, so
+                          * services can use the data.
+                          */
+
+                         if (size == 0)
+                         {
+                             pHostParm->u.pointer.addr = NULL;
+                         }
+                         else
+                         {
+                             if (pPageListInfo->flags & VBOX_HGCM_F_PARM_DIRECTION_TO_HOST)
+                             {
+                                 /* Copy pages to the pcBuf[size]. */
+                                 rc = vmmdevHGCMPageListRead(pVMMDevState->pDevIns, pcBuf, size, pPageListInfo);
+                             }
+                             else
+                                 rc = VINF_SUCCESS;
+
+                             if (RT_SUCCESS(rc))
+                             {
+                                 pHostParm->u.pointer.addr = pcBuf;
+                                 pcBuf += size;
+                             }
+                         }
+
+                         Log(("vmmdevHGCMCall: PageList guest parameter rc = %Rrc\n", rc));
+                         break;
+                     }
+
                     /* just to shut up gcc */
                     default:
@@ -828 +969 @@
                      }
 
+                     case VMMDevHGCMParmType_PageList:
+                     {
+                         uint32_t size = pGuestParm->u.PageList.size;
+
+                         /* Check that the page list info is within the request. */
+                         if (   cbHGCMCall < sizeof (HGCMPageListInfo)
+                             || pGuestParm->u.PageList.offset > cbHGCMCall - sizeof (HGCMPageListInfo))
+                         {
+                             rc = VERR_INVALID_PARAMETER;
+                             break;
+                         }
+
+                         /* At least the structure is within. */
+                         HGCMPageListInfo *pPageListInfo = (HGCMPageListInfo *)((uint8_t *)pHGCMCall + pGuestParm->u.PageList.offset);
+
+                         uint32_t cbPageListInfo = sizeof (HGCMPageListInfo) + (pPageListInfo->cPages - 1) * sizeof (pPageListInfo->aPages[0]);
+
+                         if (   pPageListInfo->cPages == 0
+                             || cbHGCMCall < pGuestParm->u.PageList.offset + cbPageListInfo)
+                         {
+                             rc = VERR_INVALID_PARAMETER;
+                             break;
+                         }
+
+                         pHostParm->type = VBOX_HGCM_SVC_PARM_PTR;
+                         pHostParm->u.pointer.size = size;
+
+                         /* Copy guest data to an allocated buffer, so
+                          * services can use the data.
+                          */
+
+                         if (size == 0)
+                         {
+                             pHostParm->u.pointer.addr = NULL;
+                         }
+                         else
+                         {
+                             if (pPageListInfo->flags & VBOX_HGCM_F_PARM_DIRECTION_TO_HOST)
+                             {
+                                 /* Copy pages to the pcBuf[size]. */
+                                 rc = vmmdevHGCMPageListRead(pVMMDevState->pDevIns, pcBuf, size, pPageListInfo);
+                             }
+                             else
+                                 rc = VINF_SUCCESS;
+
+                             if (RT_SUCCESS(rc))
+                             {
+                                 pHostParm->u.pointer.addr = pcBuf;
+                                 pcBuf += size;
+                             }
+                         }
+
+                         Log(("vmmdevHGCMCall: PageList guest parameter rc = %Rrc\n", rc));
+                         break;
+                     }
+
                     /* just to shut up gcc */
                     default:
@@ -869 +1066 @@
 
 
-static int vmmdevHGCMCallSaved (VMMDevState *pVMMDevState, VMMDevHGCMCall *pHGCMCall, bool f64Bits, bool *pfHGCMCalled, VBOXHGCMCMD *pSavedCmd)
+static int vmmdevHGCMCallSaved (VMMDevState *pVMMDevState, VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall, bool f64Bits, bool *pfHGCMCalled, VBOXHGCMCMD *pSavedCmd)
 {
     int rc = VINF_SUCCESS;
@@ -1043 +1240 @@
                      }
 
+                     case VMMDevHGCMParmType_PageList:
+                     {
+                         uint32_t size = pGuestParm->u.PageList.size;
+
+                         /* Check that the page list info is within the request. */
+                         if (   cbHGCMCall < sizeof (HGCMPageListInfo)
+                             || pGuestParm->u.PageList.offset > cbHGCMCall - sizeof (HGCMPageListInfo))
+                         {
+                             rc = VERR_INVALID_PARAMETER;
+                             break;
+                         }
+
+                         /* At least the structure is within. */
+                         HGCMPageListInfo *pPageListInfo = (HGCMPageListInfo *)((uint8_t *)pHGCMCall + pGuestParm->u.PageList.offset);
+
+                         uint32_t cbPageListInfo = sizeof (HGCMPageListInfo) + (pPageListInfo->cPages - 1) * sizeof (pPageListInfo->aPages[0]);
+
+                         if (   pPageListInfo->cPages == 0
+                             || cbHGCMCall < pGuestParm->u.PageList.offset + cbPageListInfo)
+                         {
+                             rc = VERR_INVALID_PARAMETER;
+                             break;
+                         }
+
+                         pHostParm->type = VBOX_HGCM_SVC_PARM_PTR;
+                         pHostParm->u.pointer.size = size;
+
+                         /* Copy guest data to an allocated buffer, so
+                          * services can use the data.
+                          */
+
+                         if (size == 0)
+                         {
+                             pHostParm->u.pointer.addr = NULL;
+                         }
+                         else
+                         {
+                             if (pPageListInfo->flags & VBOX_HGCM_F_PARM_DIRECTION_TO_HOST)
+                             {
+                                 /* Copy pages to the pcBuf[size]. */
+                                 rc = vmmdevHGCMPageListRead(pVMMDevState->pDevIns, pu8Buf, size, pPageListInfo);
+                             }
+                             else
+                                 rc = VINF_SUCCESS;
+
+                             if (RT_SUCCESS(rc))
+                             {
+                                 pHostParm->u.pointer.addr = pu8Buf;
+                                 pu8Buf += size;
+                             }
+                         }
+
+                         Log(("vmmdevHGCMCall: PageList guest parameter rc = %Rrc\n", rc));
+                         break;
+                     }
+
                     /* just to shut up gcc */
                     default:
@@ -1183 +1436 @@
                      }
 
+                     case VMMDevHGCMParmType_PageList:
+                     {
+                         uint32_t size = pGuestParm->u.PageList.size;
+
+                         /* Check that the page list info is within the request. */
+                         if (   cbHGCMCall < sizeof (HGCMPageListInfo)
+                             || pGuestParm->u.PageList.offset > cbHGCMCall - sizeof (HGCMPageListInfo))
+                         {
+                             rc = VERR_INVALID_PARAMETER;
+                             break;
+                         }
+
+                         /* At least the structure is within. */
+                         HGCMPageListInfo *pPageListInfo = (HGCMPageListInfo *)((uint8_t *)pHGCMCall + pGuestParm->u.PageList.offset);
+
+                         uint32_t cbPageListInfo = sizeof (HGCMPageListInfo) + (pPageListInfo->cPages - 1) * sizeof (pPageListInfo->aPages[0]);
+
+                         if (   pPageListInfo->cPages == 0
+                             || cbHGCMCall < pGuestParm->u.PageList.offset + cbPageListInfo)
+                         {
+                             rc = VERR_INVALID_PARAMETER;
+                             break;
+                         }
+
+                         pHostParm->type = VBOX_HGCM_SVC_PARM_PTR;
+                         pHostParm->u.pointer.size = size;
+
+                         /* Copy guest data to an allocated buffer, so
+                          * services can use the data.
+                          */
+
+                         if (size == 0)
+                         {
+                             pHostParm->u.pointer.addr = NULL;
+                         }
+                         else
+                         {
+                             if (pPageListInfo->flags & VBOX_HGCM_F_PARM_DIRECTION_TO_HOST)
+                             {
+                                 /* Copy pages to the pcBuf[size]. */
+                                 rc = vmmdevHGCMPageListRead(pVMMDevState->pDevIns, pu8Buf, size, pPageListInfo);
+                             }
+                             else
+                                 rc = VINF_SUCCESS;
+
+                             if (RT_SUCCESS(rc))
+                             {
+                                 pHostParm->u.pointer.addr = pu8Buf;
+                                 pu8Buf += size;
+                             }
+                         }
+
+                         Log(("vmmdevHGCMCall: PageList guest parameter rc = %Rrc\n", rc));
+                         break;
+                     }
+
                     /* just to shut up gcc */
                     default:
@@ -1405 +1714 @@
                         } break;
 
+                        case VMMDevHGCMParmType_PageList:
+                        {
+                            uint32_t cbHGCMCall = pCmd->cbSize; /* Size of the request. */
+
+                            uint32_t size = pGuestParm->u.PageList.size;
+
+                            /* Check that the page list info is within the request. */
+                            if (   cbHGCMCall < sizeof (HGCMPageListInfo)
+                                || pGuestParm->u.PageList.offset > cbHGCMCall - sizeof (HGCMPageListInfo))
+                            {
+                                rc = VERR_INVALID_PARAMETER;
+                                break;
+                            }
+
+                            /* At least the structure is within. */
+                            HGCMPageListInfo *pPageListInfo = (HGCMPageListInfo *)((uint8_t *)pHGCMCall + pGuestParm->u.PageList.offset);
+
+                            uint32_t cbPageListInfo = sizeof (HGCMPageListInfo) + (pPageListInfo->cPages - 1) * sizeof (pPageListInfo->aPages[0]);
+
+                            if (   pPageListInfo->cPages == 0
+                                || cbHGCMCall < pGuestParm->u.PageList.offset + cbPageListInfo)
+                            {
+                                rc = VERR_INVALID_PARAMETER;
+                                break;
+                            }
+
+                            if (size > 0)
+                            {
+                                if (pPageListInfo->flags & VBOX_HGCM_F_PARM_DIRECTION_FROM_HOST)
+                                {
+                                    /* Copy pHostParm->u.pointer.addr[pHostParm->u.pointer.size] to pages. */
+                                    rc = vmmdevHGCMPageListWrite(pVMMDevState->pDevIns, pPageListInfo, pHostParm->u.pointer.addr, size);
+                                }
+                                else
+                                    rc = VINF_SUCCESS;
+                            }
+
+                            Log(("vmmdevHGCMCall: PageList guest parameter rc = %Rrc\n", rc));
+                        } break;
+
                         default:
                         {
@@ -1466 +1815 @@
                                 iLinPtr++;
                             }
+                        } break;
+
+                        case VMMDevHGCMParmType_PageList:
+                        {
+                            uint32_t cbHGCMCall = pCmd->cbSize; /* Size of the request. */
+
+                            uint32_t size = pGuestParm->u.PageList.size;
+
+                            /* Check that the page list info is within the request. */
+                            if (   cbHGCMCall < sizeof (HGCMPageListInfo)
+                                || pGuestParm->u.PageList.offset > cbHGCMCall - sizeof (HGCMPageListInfo))
+                            {
+                                rc = VERR_INVALID_PARAMETER;
+                                break;
+                            }
+
+                            /* At least the structure is within. */
+                            HGCMPageListInfo *pPageListInfo = (HGCMPageListInfo *)((uint8_t *)pHGCMCall + pGuestParm->u.PageList.offset);
+
+                            uint32_t cbPageListInfo = sizeof (HGCMPageListInfo) + (pPageListInfo->cPages - 1) * sizeof (pPageListInfo->aPages[0]);
+
+                            if (   pPageListInfo->cPages == 0
+                                || cbHGCMCall < pGuestParm->u.PageList.offset + cbPageListInfo)
+                            {
+                                rc = VERR_INVALID_PARAMETER;
+                                break;
+                            }
+
+                            if (size > 0)
+                            {
+                                if (pPageListInfo->flags & VBOX_HGCM_F_PARM_DIRECTION_FROM_HOST)
+                                {
+                                    /* Copy pHostParm->u.pointer.addr[pHostParm->u.pointer.size] to pages. */
+                                    rc = vmmdevHGCMPageListWrite(pVMMDevState->pDevIns, pPageListInfo, pHostParm->u.pointer.addr, size);
+                                }
+                                else
+                                    rc = VINF_SUCCESS;
+                            }
+
+                            Log(("vmmdevHGCMCall: PageList guest parameter rc = %Rrc\n", rc));
                         } break;
 
@@ -1529 +1918 @@
                                 iLinPtr++;
                             }
+                        } break;
+
+                        case VMMDevHGCMParmType_PageList:
+                        {
+                            uint32_t cbHGCMCall = pCmd->cbSize; /* Size of the request. */
+
+                            uint32_t size = pGuestParm->u.PageList.size;
+
+                            /* Check that the page list info is within the request. */
+                            if (   cbHGCMCall < sizeof (HGCMPageListInfo)
+                                || pGuestParm->u.PageList.offset > cbHGCMCall - sizeof (HGCMPageListInfo))
+                            {
+                                rc = VERR_INVALID_PARAMETER;
+                                break;
+                            }
+
+                            /* At least the structure is within. */
+                            HGCMPageListInfo *pPageListInfo = (HGCMPageListInfo *)((uint8_t *)pHGCMCall + pGuestParm->u.PageList.offset);
+
+                            uint32_t cbPageListInfo = sizeof (HGCMPageListInfo) + (pPageListInfo->cPages - 1) * sizeof (pPageListInfo->aPages[0]);
+
+                            if (   pPageListInfo->cPages == 0
+                                || cbHGCMCall < pGuestParm->u.PageList.offset + cbPageListInfo)
+                            {
+                                rc = VERR_INVALID_PARAMETER;
+                                break;
+                            }
+
+                            if (size > 0)
+                            {
+                                if (pPageListInfo->flags & VBOX_HGCM_F_PARM_DIRECTION_FROM_HOST)
+                                {
+                                    /* Copy pHostParm->u.pointer.addr[pHostParm->u.pointer.size] to pages. */
+                                    rc = vmmdevHGCMPageListWrite(pVMMDevState->pDevIns, pPageListInfo, pHostParm->u.pointer.addr, size);
+                                }
+                                else
+                                    rc = VINF_SUCCESS;
+                            }
+
+                            Log(("vmmdevHGCMCall: PageList guest parameter rc = %Rrc\n", rc));
                         } break;
 
@@ -2009 +2438 @@
                                 bool f64Bits = false;
 #endif /* VBOX_WITH_64_BITS_GUESTS */
-                                requestHeader->header.rc = vmmdevHGCMCallSaved (pVMMDevState, pHGCMCall, f64Bits, &fHGCMCalled, pIter);
+                                requestHeader->header.rc = vmmdevHGCMCallSaved (pVMMDevState, pHGCMCall, requestHeader->header.size, f64Bits, &fHGCMCalled, pIter);
                             }
                             break;
@@ -2093 +2522 @@
                                         bool f64Bits = false;
 #endif /* VBOX_WITH_64_BITS_GUESTS */
-                                        requestHeader->header.rc = vmmdevHGCMCall (pVMMDevState, pHGCMCall, pIter->GCPhys, f64Bits);
+                                        requestHeader->header.rc = vmmdevHGCMCall (pVMMDevState, pHGCMCall, requestHeader->header.size, pIter->GCPhys, f64Bits);
                                     }
                                     break;

trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.h

@@ -28 +28 @@
 DECLCALLBACK(int) vmmdevHGCMConnect (VMMDevState *pVMMDevState, VMMDevHGCMConnect *pHGCMConnect, RTGCPHYS GCPtr);
 DECLCALLBACK(int) vmmdevHGCMDisconnect (VMMDevState *pVMMDevState, VMMDevHGCMDisconnect *pHGCMDisconnect, RTGCPHYS GCPtr);
-DECLCALLBACK(int) vmmdevHGCMCall (VMMDevState *pVMMDevState, VMMDevHGCMCall *pHGCMCall, RTGCPHYS GCPtr, bool f64Bits);
+DECLCALLBACK(int) vmmdevHGCMCall (VMMDevState *pVMMDevState, VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall, RTGCPHYS GCPtr, bool f64Bits);
 DECLCALLBACK(int) vmmdevHGCMCancel (VMMDevState *pVMMDevState, VMMDevHGCMCancel *pHGCMCancel, RTGCPHYS GCPtr);