SUPDrv.cpp@ 55980

Last change on this file since 55980 was 55980, checked in by vboxsync, 10 years ago
iprt/log.h,++: Added extended logger instance getters that also checks whether the given logger and group-flags are enabled, making the LogRel* checks more efficient in avoid uncessary RTLogLoggerEx parameter building and calls. Ditto for debug logging. The LOG_INSTANCE and LOG_REL_INSTANCE tricks are gone for now.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 206.4 KB

Line
1	/* $Id: SUPDrv.cpp 55980 2015-05-20 17:35:22Z vboxsync $ */
2	/** @file
3	* VBoxDrv - The VirtualBox Support Driver - Common code.
4	*/
5
6	/*
7	* Copyright (C) 2006-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.215389.xyz. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27	/*******************************************************************************
28	* Header Files *
29	*******************************************************************************/
30	#define LOG_GROUP LOG_GROUP_SUP_DRV
31	#define SUPDRV_AGNOSTIC
32	#include "SUPDrvInternal.h"
33	#ifndef PAGE_SHIFT
34	# include <iprt/param.h>
35	#endif
36	#include <iprt/asm.h>
37	#include <iprt/asm-amd64-x86.h>
38	#include <iprt/asm-math.h>
39	#include <iprt/cpuset.h>
40	#include <iprt/handletable.h>
41	#include <iprt/mem.h>
42	#include <iprt/mp.h>
43	#include <iprt/power.h>
44	#include <iprt/process.h>
45	#include <iprt/semaphore.h>
46	#include <iprt/spinlock.h>
47	#include <iprt/thread.h>
48	#include <iprt/uuid.h>
49	#include <iprt/net.h>
50	#include <iprt/crc.h>
51	#include <iprt/string.h>
52	#include <iprt/timer.h>
53	#if defined(RT_OS_DARWIN) \|\| defined(RT_OS_SOLARIS) \|\| defined(RT_OS_FREEBSD)
54	# include <iprt/rand.h>
55	# include <iprt/path.h>
56	#endif
57	#include <iprt/uint128.h>
58	#include <iprt/x86.h>
59
60	#include <VBox/param.h>
61	#include <VBox/log.h>
62	#include <VBox/err.h>
63	#include <VBox/vmm/hm_svm.h>
64	#include <VBox/vmm/hm_vmx.h>
65
66	#if defined(RT_OS_SOLARIS) \|\| defined(RT_OS_DARWIN)
67	# include "dtrace/SUPDrv.h"
68	#else
69	# define VBOXDRV_SESSION_CREATE(pvSession, fUser) do { } while (0)
70	# define VBOXDRV_SESSION_CLOSE(pvSession) do { } while (0)
71	# define VBOXDRV_IOCTL_ENTRY(pvSession, uIOCtl, pvReqHdr) do { } while (0)
72	# define VBOXDRV_IOCTL_RETURN(pvSession, uIOCtl, pvReqHdr, rcRet, rcReq) do { } while (0)
73	#endif
74
75	/*
76	* Logging assignments:
77	* Log - useful stuff, like failures.
78	* LogFlow - program flow, except the really noisy bits.
79	* Log2 - Cleanup.
80	* Log3 - Loader flow noise.
81	* Log4 - Call VMMR0 flow noise.
82	* Log5 - Native yet-to-be-defined noise.
83	* Log6 - Native ioctl flow noise.
84	*
85	* Logging requires BUILD_TYPE=debug and possibly changes to the logger
86	* instantiation in log-vbox.c(pp).
87	*/
88
89
90	/*******************************************************************************
91	* Defined Constants And Macros *
92	*******************************************************************************/
93	/** @def VBOX_SVN_REV
94	* The makefile should define this if it can. */
95	#ifndef VBOX_SVN_REV
96	# define VBOX_SVN_REV 0
97	#endif
98
99
100	/*******************************************************************************
101	* Internal Functions *
102	*******************************************************************************/
103	static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void pvObj, void pvCtx, void *pvUser);
104	static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void pvObj, void pvCtx, void *pvUser);
105	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession);
106	static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType);
107	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq);
108	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq);
109	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq);
110	static int supdrvIOCtl_LdrLockDown(PSUPDRVDEVEXT pDevExt);
111	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq);
112	static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq);
113	static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0EntryInt,void pvVMMR0EntryFast, void pvVMMR0EntryEx);
114	static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt);
115	static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage);
116	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage);
117	DECLINLINE(int) supdrvLdrLock(PSUPDRVDEVEXT pDevExt);
118	DECLINLINE(int) supdrvLdrUnlock(PSUPDRVDEVEXT pDevExt);
119	static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq);
120	static int supdrvIOCtl_LoggerSettings(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLOGGERSETTINGS pReq);
121	static int supdrvIOCtl_MsrProber(PSUPDRVDEVEXT pDevExt, PSUPMSRPROBER pReq);
122	static int supdrvIOCtl_ResumeSuspendedKbds(void);
123
124
125	/*******************************************************************************
126	* Global Variables *
127	*******************************************************************************/
128	/**
129	* Array of the R0 SUP API.
130	*
131	* While making changes to these exports, make sure to update the IOC
132	* minor version (SUPDRV_IOC_VERSION).
133	*/
134	static SUPFUNC g_aFunctions[] =
135	{
136	/* SED: START */
137	/* name function */
138	/* Entries with absolute addresses determined at runtime, fixup
139	code makes ugly ASSUMPTIONS about the order here: */
140	{ "SUPR0AbsIs64bit", (void *)0 },
141	{ "SUPR0Abs64bitKernelCS", (void *)0 },
142	{ "SUPR0Abs64bitKernelSS", (void *)0 },
143	{ "SUPR0Abs64bitKernelDS", (void *)0 },
144	{ "SUPR0AbsKernelCS", (void *)0 },
145	{ "SUPR0AbsKernelSS", (void *)0 },
146	{ "SUPR0AbsKernelDS", (void *)0 },
147	{ "SUPR0AbsKernelES", (void *)0 },
148	{ "SUPR0AbsKernelFS", (void *)0 },
149	{ "SUPR0AbsKernelGS", (void *)0 },
150	/* Normal function pointers: */
151	{ "g_pSUPGlobalInfoPage", (void )&g_pSUPGlobalInfoPage }, / SED: DATA */
152	{ "SUPGetGIP", (void *)SUPGetGIP },
153	{ "SUPReadTscWithDelta", (void *)SUPReadTscWithDelta },
154	{ "SUPGetTscDeltaSlow", (void *)SUPGetTscDeltaSlow },
155	{ "SUPGetCpuHzFromGipForAsyncMode", (void *)SUPGetCpuHzFromGipForAsyncMode },
156	{ "SUPR0ComponentDeregisterFactory", (void *)SUPR0ComponentDeregisterFactory },
157	{ "SUPR0ComponentQueryFactory", (void *)SUPR0ComponentQueryFactory },
158	{ "SUPR0ComponentRegisterFactory", (void *)SUPR0ComponentRegisterFactory },
159	{ "SUPR0ContAlloc", (void *)SUPR0ContAlloc },
160	{ "SUPR0ContFree", (void *)SUPR0ContFree },
161	{ "SUPR0ChangeCR4", (void *)SUPR0ChangeCR4 },
162	{ "SUPR0EnableVTx", (void *)SUPR0EnableVTx },
163	{ "SUPR0SuspendVTxOnCpu", (void *)SUPR0SuspendVTxOnCpu },
164	{ "SUPR0ResumeVTxOnCpu", (void *)SUPR0ResumeVTxOnCpu },
165	{ "SUPR0GetKernelFeatures", (void *)SUPR0GetKernelFeatures },
166	{ "SUPR0GetPagingMode", (void *)SUPR0GetPagingMode },
167	{ "SUPR0GetSvmUsability", (void *)SUPR0GetSvmUsability },
168	{ "SUPR0GetVmxUsability", (void *)SUPR0GetVmxUsability },
169	{ "SUPR0LockMem", (void *)SUPR0LockMem },
170	{ "SUPR0LowAlloc", (void *)SUPR0LowAlloc },
171	{ "SUPR0LowFree", (void *)SUPR0LowFree },
172	{ "SUPR0MemAlloc", (void *)SUPR0MemAlloc },
173	{ "SUPR0MemFree", (void *)SUPR0MemFree },
174	{ "SUPR0MemGetPhys", (void *)SUPR0MemGetPhys },
175	{ "SUPR0ObjAddRef", (void *)SUPR0ObjAddRef },
176	{ "SUPR0ObjAddRefEx", (void *)SUPR0ObjAddRefEx },
177	{ "SUPR0ObjRegister", (void *)SUPR0ObjRegister },
178	{ "SUPR0ObjRelease", (void *)SUPR0ObjRelease },
179	{ "SUPR0ObjVerifyAccess", (void *)SUPR0ObjVerifyAccess },
180	{ "SUPR0PageAllocEx", (void *)SUPR0PageAllocEx },
181	{ "SUPR0PageFree", (void *)SUPR0PageFree },
182	{ "SUPR0Printf", (void *)SUPR0Printf },
183	{ "SUPR0TscDeltaMeasureBySetIndex", (void *)SUPR0TscDeltaMeasureBySetIndex },
184	{ "SUPR0TracerDeregisterDrv", (void *)SUPR0TracerDeregisterDrv },
185	{ "SUPR0TracerDeregisterImpl", (void *)SUPR0TracerDeregisterImpl },
186	{ "SUPR0TracerFireProbe", (void *)SUPR0TracerFireProbe },
187	{ "SUPR0TracerRegisterDrv", (void *)SUPR0TracerRegisterDrv },
188	{ "SUPR0TracerRegisterImpl", (void *)SUPR0TracerRegisterImpl },
189	{ "SUPR0TracerRegisterModule", (void *)SUPR0TracerRegisterModule },
190	{ "SUPR0TracerUmodProbeFire", (void *)SUPR0TracerUmodProbeFire },
191	{ "SUPR0UnlockMem", (void *)SUPR0UnlockMem },
192	{ "SUPSemEventClose", (void *)SUPSemEventClose },
193	{ "SUPSemEventCreate", (void *)SUPSemEventCreate },
194	{ "SUPSemEventGetResolution", (void *)SUPSemEventGetResolution },
195	{ "SUPSemEventMultiClose", (void *)SUPSemEventMultiClose },
196	{ "SUPSemEventMultiCreate", (void *)SUPSemEventMultiCreate },
197	{ "SUPSemEventMultiGetResolution", (void *)SUPSemEventMultiGetResolution },
198	{ "SUPSemEventMultiReset", (void *)SUPSemEventMultiReset },
199	{ "SUPSemEventMultiSignal", (void *)SUPSemEventMultiSignal },
200	{ "SUPSemEventMultiWait", (void *)SUPSemEventMultiWait },
201	{ "SUPSemEventMultiWaitNoResume", (void *)SUPSemEventMultiWaitNoResume },
202	{ "SUPSemEventMultiWaitNsAbsIntr", (void *)SUPSemEventMultiWaitNsAbsIntr },
203	{ "SUPSemEventMultiWaitNsRelIntr", (void *)SUPSemEventMultiWaitNsRelIntr },
204	{ "SUPSemEventSignal", (void *)SUPSemEventSignal },
205	{ "SUPSemEventWait", (void *)SUPSemEventWait },
206	{ "SUPSemEventWaitNoResume", (void *)SUPSemEventWaitNoResume },
207	{ "SUPSemEventWaitNsAbsIntr", (void *)SUPSemEventWaitNsAbsIntr },
208	{ "SUPSemEventWaitNsRelIntr", (void *)SUPSemEventWaitNsRelIntr },
209
210	{ "RTAssertAreQuiet", (void *)RTAssertAreQuiet },
211	{ "RTAssertMayPanic", (void *)RTAssertMayPanic },
212	{ "RTAssertMsg1", (void *)RTAssertMsg1 },
213	{ "RTAssertMsg2AddV", (void *)RTAssertMsg2AddV },
214	{ "RTAssertMsg2V", (void *)RTAssertMsg2V },
215	{ "RTAssertSetMayPanic", (void *)RTAssertSetMayPanic },
216	{ "RTAssertSetQuiet", (void *)RTAssertSetQuiet },
217	{ "RTCrc32", (void *)RTCrc32 },
218	{ "RTCrc32Finish", (void *)RTCrc32Finish },
219	{ "RTCrc32Process", (void *)RTCrc32Process },
220	{ "RTCrc32Start", (void *)RTCrc32Start },
221	{ "RTErrConvertFromErrno", (void *)RTErrConvertFromErrno },
222	{ "RTErrConvertToErrno", (void *)RTErrConvertToErrno },
223	{ "RTHandleTableAllocWithCtx", (void *)RTHandleTableAllocWithCtx },
224	{ "RTHandleTableCreate", (void *)RTHandleTableCreate },
225	{ "RTHandleTableCreateEx", (void *)RTHandleTableCreateEx },
226	{ "RTHandleTableDestroy", (void *)RTHandleTableDestroy },
227	{ "RTHandleTableFreeWithCtx", (void *)RTHandleTableFreeWithCtx },
228	{ "RTHandleTableLookupWithCtx", (void *)RTHandleTableLookupWithCtx },
229	{ "RTLogDefaultInstance", (void *)RTLogDefaultInstance },
230	{ "RTLogDefaultInstanceEx", (void *)RTLogDefaultInstanceEx },
231	{ "RTLogGetDefaultInstance", (void *)RTLogGetDefaultInstance },
232	{ "RTLogGetDefaultInstanceEx", (void *)RTLogGetDefaultInstanceEx },
233	{ "RTLogLoggerExV", (void *)RTLogLoggerExV },
234	{ "RTLogPrintfV", (void *)RTLogPrintfV },
235	{ "RTLogRelDefaultInstance", (void *)RTLogRelGetDefaultInstance },
236	{ "RTLogRelGetDefaultInstance", (void *)RTLogRelGetDefaultInstance },
237	{ "RTLogRelGetDefaultInstanceEx", (void *)RTLogRelGetDefaultInstanceEx },
238	{ "RTLogSetDefaultInstanceThread", (void *)RTLogSetDefaultInstanceThread },
239	{ "RTMemAllocExTag", (void *)RTMemAllocExTag },
240	{ "RTMemAllocTag", (void *)RTMemAllocTag },
241	{ "RTMemAllocVarTag", (void *)RTMemAllocVarTag },
242	{ "RTMemAllocZTag", (void *)RTMemAllocZTag },
243	{ "RTMemAllocZVarTag", (void *)RTMemAllocZVarTag },
244	{ "RTMemDupExTag", (void *)RTMemDupExTag },
245	{ "RTMemDupTag", (void *)RTMemDupTag },
246	{ "RTMemFree", (void *)RTMemFree },
247	{ "RTMemFreeEx", (void *)RTMemFreeEx },
248	{ "RTMemReallocTag", (void *)RTMemReallocTag },
249	{ "RTMpCpuId", (void *)RTMpCpuId },
250	{ "RTMpCpuIdFromSetIndex", (void *)RTMpCpuIdFromSetIndex },
251	{ "RTMpCpuIdToSetIndex", (void *)RTMpCpuIdToSetIndex },
252	{ "RTMpCurSetIndex", (void *)RTMpCurSetIndex },
253	{ "RTMpCurSetIndexAndId", (void *)RTMpCurSetIndexAndId },
254	{ "RTMpGetArraySize", (void *)RTMpGetArraySize },
255	{ "RTMpGetCount", (void *)RTMpGetCount },
256	{ "RTMpGetMaxCpuId", (void *)RTMpGetMaxCpuId },
257	{ "RTMpGetOnlineCount", (void *)RTMpGetOnlineCount },
258	{ "RTMpGetOnlineSet", (void *)RTMpGetOnlineSet },
259	{ "RTMpGetSet", (void *)RTMpGetSet },
260	{ "RTMpIsCpuOnline", (void *)RTMpIsCpuOnline },
261	{ "RTMpIsCpuPossible", (void *)RTMpIsCpuPossible },
262	{ "RTMpIsCpuWorkPending", (void *)RTMpIsCpuWorkPending },
263	{ "RTMpNotificationDeregister", (void *)RTMpNotificationDeregister },
264	{ "RTMpNotificationRegister", (void *)RTMpNotificationRegister },
265	{ "RTMpOnAll", (void *)RTMpOnAll },
266	{ "RTMpOnOthers", (void *)RTMpOnOthers },
267	{ "RTMpOnSpecific", (void *)RTMpOnSpecific },
268	{ "RTMpPokeCpu", (void *)RTMpPokeCpu },
269	{ "RTNetIPv4AddDataChecksum", (void *)RTNetIPv4AddDataChecksum },
270	{ "RTNetIPv4AddTCPChecksum", (void *)RTNetIPv4AddTCPChecksum },
271	{ "RTNetIPv4AddUDPChecksum", (void *)RTNetIPv4AddUDPChecksum },
272	{ "RTNetIPv4FinalizeChecksum", (void *)RTNetIPv4FinalizeChecksum },
273	{ "RTNetIPv4HdrChecksum", (void *)RTNetIPv4HdrChecksum },
274	{ "RTNetIPv4IsDHCPValid", (void *)RTNetIPv4IsDHCPValid },
275	{ "RTNetIPv4IsHdrValid", (void *)RTNetIPv4IsHdrValid },
276	{ "RTNetIPv4IsTCPSizeValid", (void *)RTNetIPv4IsTCPSizeValid },
277	{ "RTNetIPv4IsTCPValid", (void *)RTNetIPv4IsTCPValid },
278	{ "RTNetIPv4IsUDPSizeValid", (void *)RTNetIPv4IsUDPSizeValid },
279	{ "RTNetIPv4IsUDPValid", (void *)RTNetIPv4IsUDPValid },
280	{ "RTNetIPv4PseudoChecksum", (void *)RTNetIPv4PseudoChecksum },
281	{ "RTNetIPv4PseudoChecksumBits", (void *)RTNetIPv4PseudoChecksumBits },
282	{ "RTNetIPv4TCPChecksum", (void *)RTNetIPv4TCPChecksum },
283	{ "RTNetIPv4UDPChecksum", (void *)RTNetIPv4UDPChecksum },
284	{ "RTNetIPv6PseudoChecksum", (void *)RTNetIPv6PseudoChecksum },
285	{ "RTNetIPv6PseudoChecksumBits", (void *)RTNetIPv6PseudoChecksumBits },
286	{ "RTNetIPv6PseudoChecksumEx", (void *)RTNetIPv6PseudoChecksumEx },
287	{ "RTNetTCPChecksum", (void *)RTNetTCPChecksum },
288	{ "RTNetUDPChecksum", (void *)RTNetUDPChecksum },
289	{ "RTPowerNotificationDeregister", (void *)RTPowerNotificationDeregister },
290	{ "RTPowerNotificationRegister", (void *)RTPowerNotificationRegister },
291	{ "RTProcSelf", (void *)RTProcSelf },
292	{ "RTR0AssertPanicSystem", (void *)RTR0AssertPanicSystem },
293	{ "RTR0MemAreKrnlAndUsrDifferent", (void *)RTR0MemAreKrnlAndUsrDifferent },
294	{ "RTR0MemKernelIsValidAddr", (void *)RTR0MemKernelIsValidAddr },
295	{ "RTR0MemKernelCopyFrom", (void *)RTR0MemKernelCopyFrom },
296	{ "RTR0MemKernelCopyTo", (void *)RTR0MemKernelCopyTo },
297	{ "RTR0MemObjAddress", (void *)RTR0MemObjAddress },
298	{ "RTR0MemObjAddressR3", (void *)RTR0MemObjAddressR3 },
299	{ "RTR0MemObjAllocContTag", (void *)RTR0MemObjAllocContTag },
300	{ "RTR0MemObjAllocLowTag", (void *)RTR0MemObjAllocLowTag },
301	{ "RTR0MemObjAllocPageTag", (void *)RTR0MemObjAllocPageTag },
302	{ "RTR0MemObjAllocPhysExTag", (void *)RTR0MemObjAllocPhysExTag },
303	{ "RTR0MemObjAllocPhysNCTag", (void *)RTR0MemObjAllocPhysNCTag },
304	{ "RTR0MemObjAllocPhysTag", (void *)RTR0MemObjAllocPhysTag },
305	{ "RTR0MemObjEnterPhysTag", (void *)RTR0MemObjEnterPhysTag },
306	{ "RTR0MemObjFree", (void *)RTR0MemObjFree },
307	{ "RTR0MemObjGetPagePhysAddr", (void *)RTR0MemObjGetPagePhysAddr },
308	{ "RTR0MemObjIsMapping", (void *)RTR0MemObjIsMapping },
309	{ "RTR0MemObjLockUserTag", (void *)RTR0MemObjLockUserTag },
310	{ "RTR0MemObjMapKernelExTag", (void *)RTR0MemObjMapKernelExTag },
311	{ "RTR0MemObjMapKernelTag", (void *)RTR0MemObjMapKernelTag },
312	{ "RTR0MemObjMapUserTag", (void *)RTR0MemObjMapUserTag },
313	{ "RTR0MemObjProtect", (void *)RTR0MemObjProtect },
314	{ "RTR0MemObjSize", (void *)RTR0MemObjSize },
315	{ "RTR0MemUserCopyFrom", (void *)RTR0MemUserCopyFrom },
316	{ "RTR0MemUserCopyTo", (void *)RTR0MemUserCopyTo },
317	{ "RTR0MemUserIsValidAddr", (void *)RTR0MemUserIsValidAddr },
318	{ "RTR0ProcHandleSelf", (void *)RTR0ProcHandleSelf },
319	{ "RTSemEventCreate", (void *)RTSemEventCreate },
320	{ "RTSemEventDestroy", (void *)RTSemEventDestroy },
321	{ "RTSemEventGetResolution", (void *)RTSemEventGetResolution },
322	{ "RTSemEventMultiCreate", (void *)RTSemEventMultiCreate },
323	{ "RTSemEventMultiDestroy", (void *)RTSemEventMultiDestroy },
324	{ "RTSemEventMultiGetResolution", (void *)RTSemEventMultiGetResolution },
325	{ "RTSemEventMultiReset", (void *)RTSemEventMultiReset },
326	{ "RTSemEventMultiSignal", (void *)RTSemEventMultiSignal },
327	{ "RTSemEventMultiWait", (void *)RTSemEventMultiWait },
328	{ "RTSemEventMultiWaitEx", (void *)RTSemEventMultiWaitEx },
329	{ "RTSemEventMultiWaitExDebug", (void *)RTSemEventMultiWaitExDebug },
330	{ "RTSemEventMultiWaitNoResume", (void *)RTSemEventMultiWaitNoResume },
331	{ "RTSemEventSignal", (void *)RTSemEventSignal },
332	{ "RTSemEventWait", (void *)RTSemEventWait },
333	{ "RTSemEventWaitEx", (void *)RTSemEventWaitEx },
334	{ "RTSemEventWaitExDebug", (void *)RTSemEventWaitExDebug },
335	{ "RTSemEventWaitNoResume", (void *)RTSemEventWaitNoResume },
336	{ "RTSemFastMutexCreate", (void *)RTSemFastMutexCreate },
337	{ "RTSemFastMutexDestroy", (void *)RTSemFastMutexDestroy },
338	{ "RTSemFastMutexRelease", (void *)RTSemFastMutexRelease },
339	{ "RTSemFastMutexRequest", (void *)RTSemFastMutexRequest },
340	{ "RTSemMutexCreate", (void *)RTSemMutexCreate },
341	{ "RTSemMutexDestroy", (void *)RTSemMutexDestroy },
342	{ "RTSemMutexRelease", (void *)RTSemMutexRelease },
343	{ "RTSemMutexRequest", (void *)RTSemMutexRequest },
344	{ "RTSemMutexRequestDebug", (void *)RTSemMutexRequestDebug },
345	{ "RTSemMutexRequestNoResume", (void *)RTSemMutexRequestNoResume },
346	{ "RTSemMutexRequestNoResumeDebug", (void *)RTSemMutexRequestNoResumeDebug },
347	{ "RTSpinlockAcquire", (void *)RTSpinlockAcquire },
348	{ "RTSpinlockCreate", (void *)RTSpinlockCreate },
349	{ "RTSpinlockDestroy", (void *)RTSpinlockDestroy },
350	{ "RTSpinlockRelease", (void *)RTSpinlockRelease },
351	{ "RTStrCopy", (void *)RTStrCopy },
352	{ "RTStrDupTag", (void *)RTStrDupTag },
353	{ "RTStrFormat", (void *)RTStrFormat },
354	{ "RTStrFormatNumber", (void *)RTStrFormatNumber },
355	{ "RTStrFormatTypeDeregister", (void *)RTStrFormatTypeDeregister },
356	{ "RTStrFormatTypeRegister", (void *)RTStrFormatTypeRegister },
357	{ "RTStrFormatTypeSetUser", (void *)RTStrFormatTypeSetUser },
358	{ "RTStrFormatV", (void *)RTStrFormatV },
359	{ "RTStrFree", (void *)RTStrFree },
360	{ "RTStrNCmp", (void *)RTStrNCmp },
361	{ "RTStrPrintf", (void *)RTStrPrintf },
362	{ "RTStrPrintfEx", (void *)RTStrPrintfEx },
363	{ "RTStrPrintfExV", (void *)RTStrPrintfExV },
364	{ "RTStrPrintfV", (void *)RTStrPrintfV },
365	{ "RTThreadCreate", (void *)RTThreadCreate },
366	{ "RTThreadCtxHookIsEnabled", (void *)RTThreadCtxHookIsEnabled },
367	{ "RTThreadCtxHookCreate", (void *)RTThreadCtxHookCreate },
368	{ "RTThreadCtxHookDestroy", (void *)RTThreadCtxHookDestroy },
369	{ "RTThreadCtxHookDisable", (void *)RTThreadCtxHookDisable },
370	{ "RTThreadCtxHookEnable", (void *)RTThreadCtxHookEnable },
371	{ "RTThreadGetName", (void *)RTThreadGetName },
372	{ "RTThreadGetNative", (void *)RTThreadGetNative },
373	{ "RTThreadGetType", (void *)RTThreadGetType },
374	{ "RTThreadIsInInterrupt", (void *)RTThreadIsInInterrupt },
375	{ "RTThreadNativeSelf", (void *)RTThreadNativeSelf },
376	{ "RTThreadPreemptDisable", (void *)RTThreadPreemptDisable },
377	{ "RTThreadPreemptIsEnabled", (void *)RTThreadPreemptIsEnabled },
378	{ "RTThreadPreemptIsPending", (void *)RTThreadPreemptIsPending },
379	{ "RTThreadPreemptIsPendingTrusty", (void *)RTThreadPreemptIsPendingTrusty },
380	{ "RTThreadPreemptIsPossible", (void *)RTThreadPreemptIsPossible },
381	{ "RTThreadPreemptRestore", (void *)RTThreadPreemptRestore },
382	{ "RTThreadSelf", (void *)RTThreadSelf },
383	{ "RTThreadSelfName", (void *)RTThreadSelfName },
384	{ "RTThreadSleep", (void *)RTThreadSleep },
385	{ "RTThreadUserReset", (void *)RTThreadUserReset },
386	{ "RTThreadUserSignal", (void *)RTThreadUserSignal },
387	{ "RTThreadUserWait", (void *)RTThreadUserWait },
388	{ "RTThreadUserWaitNoResume", (void *)RTThreadUserWaitNoResume },
389	{ "RTThreadWait", (void *)RTThreadWait },
390	{ "RTThreadWaitNoResume", (void *)RTThreadWaitNoResume },
391	{ "RTThreadYield", (void *)RTThreadYield },
392	{ "RTTimeMilliTS", (void *)RTTimeMilliTS },
393	{ "RTTimeNanoTS", (void *)RTTimeNanoTS },
394	{ "RTTimeNow", (void *)RTTimeNow },
395	{ "RTTimerCanDoHighResolution", (void *)RTTimerCanDoHighResolution },
396	{ "RTTimerChangeInterval", (void *)RTTimerChangeInterval },
397	{ "RTTimerCreate", (void *)RTTimerCreate },
398	{ "RTTimerCreateEx", (void *)RTTimerCreateEx },
399	{ "RTTimerDestroy", (void *)RTTimerDestroy },
400	{ "RTTimerGetSystemGranularity", (void *)RTTimerGetSystemGranularity },
401	{ "RTTimerReleaseSystemGranularity", (void *)RTTimerReleaseSystemGranularity },
402	{ "RTTimerRequestSystemGranularity", (void *)RTTimerRequestSystemGranularity },
403	{ "RTTimerStart", (void *)RTTimerStart },
404	{ "RTTimerStop", (void *)RTTimerStop },
405	{ "RTTimeSystemMilliTS", (void *)RTTimeSystemMilliTS },
406	{ "RTTimeSystemNanoTS", (void *)RTTimeSystemNanoTS },
407	{ "RTUuidCompare", (void *)RTUuidCompare },
408	{ "RTUuidCompareStr", (void *)RTUuidCompareStr },
409	{ "RTUuidFromStr", (void *)RTUuidFromStr },
410	/* SED: END */
411	};
412
413	#if defined(RT_OS_DARWIN) \|\| defined(RT_OS_SOLARIS) \|\| defined(RT_OS_FREEBSD)
414	/**
415	* Drag in the rest of IRPT since we share it with the
416	* rest of the kernel modules on darwin.
417	*/
418	PFNRT g_apfnVBoxDrvIPRTDeps[] =
419	{
420	/* VBoxNetAdp */
421	(PFNRT)RTRandBytes,
422	/* VBoxUSB */
423	(PFNRT)RTPathStripFilename,
424	NULL
425	};
426	#endif /* RT_OS_DARWIN \|\| RT_OS_SOLARIS \|\| RT_OS_SOLARIS */
427
428
429	/**
430	* Initializes the device extentsion structure.
431	*
432	* @returns IPRT status code.
433	* @param pDevExt The device extension to initialize.
434	* @param cbSession The size of the session structure. The size of
435	* SUPDRVSESSION may be smaller when SUPDRV_AGNOSTIC is
436	* defined because we're skipping the OS specific members
437	* then.
438	*/
439	int VBOXCALL supdrvInitDevExt(PSUPDRVDEVEXT pDevExt, size_t cbSession)
440	{
441	int rc;
442
443	#ifdef SUPDRV_WITH_RELEASE_LOGGER
444	/*
445	* Create the release log.
446	*/
447	static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
448	PRTLOGGER pRelLogger;
449	rc = RTLogCreate(&pRelLogger, 0 /* fFlags */, "all",
450	"VBOX_RELEASE_LOG", RT_ELEMENTS(s_apszGroups), s_apszGroups, RTLOGDEST_STDOUT \| RTLOGDEST_DEBUGGER, NULL);
451	if (RT_SUCCESS(rc))
452	RTLogRelSetDefaultInstance(pRelLogger);
453	/** @todo Add native hook for getting logger config parameters and setting
454	* them. On linux we should use the module parameter stuff... */
455	#endif
456
457	/*
458	* Initialize it.
459	*/
460	memset(pDevExt, 0, sizeof(pDevExt)); / Does not wipe OS specific tail section of the structure. */
461	pDevExt->Spinlock = NIL_RTSPINLOCK;
462	pDevExt->hGipSpinlock = NIL_RTSPINLOCK;
463	pDevExt->hSessionHashTabSpinlock = NIL_RTSPINLOCK;
464	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
465	pDevExt->mtxLdr = NIL_RTSEMMUTEX;
466	#else
467	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
468	#endif
469	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
470	pDevExt->mtxGip = NIL_RTSEMMUTEX;
471	pDevExt->mtxTscDelta = NIL_RTSEMMUTEX;
472	#else
473	pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
474	pDevExt->mtxTscDelta = NIL_RTSEMFASTMUTEX;
475	#endif
476
477	rc = RTSpinlockCreate(&pDevExt->Spinlock, RTSPINLOCK_FLAGS_INTERRUPT_SAFE, "SUPDrvDevExt");
478	if (RT_SUCCESS(rc))
479	rc = RTSpinlockCreate(&pDevExt->hGipSpinlock, RTSPINLOCK_FLAGS_INTERRUPT_SAFE, "SUPDrvGip");
480	if (RT_SUCCESS(rc))
481	rc = RTSpinlockCreate(&pDevExt->hSessionHashTabSpinlock, RTSPINLOCK_FLAGS_INTERRUPT_SAFE, "SUPDrvSession");
482
483	if (RT_SUCCESS(rc))
484	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
485	rc = RTSemMutexCreate(&pDevExt->mtxLdr);
486	#else
487	rc = RTSemFastMutexCreate(&pDevExt->mtxLdr);
488	#endif
489	if (RT_SUCCESS(rc))
490	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
491	rc = RTSemMutexCreate(&pDevExt->mtxTscDelta);
492	#else
493	rc = RTSemFastMutexCreate(&pDevExt->mtxTscDelta);
494	#endif
495	if (RT_SUCCESS(rc))
496	{
497	rc = RTSemFastMutexCreate(&pDevExt->mtxComponentFactory);
498	if (RT_SUCCESS(rc))
499	{
500	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
501	rc = RTSemMutexCreate(&pDevExt->mtxGip);
502	#else
503	rc = RTSemFastMutexCreate(&pDevExt->mtxGip);
504	#endif
505	if (RT_SUCCESS(rc))
506	{
507	rc = supdrvGipCreate(pDevExt);
508	if (RT_SUCCESS(rc))
509	{
510	rc = supdrvTracerInit(pDevExt);
511	if (RT_SUCCESS(rc))
512	{
513	pDevExt->pLdrInitImage = NULL;
514	pDevExt->hLdrInitThread = NIL_RTNATIVETHREAD;
515	pDevExt->u32Cookie = BIRD; /** @todo make this random? */
516	pDevExt->cbSession = (uint32_t)cbSession;
517
518	/*
519	* Fixup the absolute symbols.
520	*
521	* Because of the table indexing assumptions we'll have a little #ifdef orgy
522	* here rather than distributing this to OS specific files. At least for now.
523	*/
524	#ifdef RT_OS_DARWIN
525	# if ARCH_BITS == 32
526	if (SUPR0GetPagingMode() >= SUPPAGINGMODE_AMD64)
527	{
528	g_aFunctions[0].pfn = (void )1; / SUPR0AbsIs64bit */
529	g_aFunctions[1].pfn = (void )0x80; / SUPR0Abs64bitKernelCS - KERNEL64_CS, seg.h */
530	g_aFunctions[2].pfn = (void )0x88; / SUPR0Abs64bitKernelSS - KERNEL64_SS, seg.h */
531	g_aFunctions[3].pfn = (void )0x88; / SUPR0Abs64bitKernelDS - KERNEL64_SS, seg.h */
532	}
533	else
534	g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[4].pfn = (void *)0;
535	g_aFunctions[4].pfn = (void )0x08; / SUPR0AbsKernelCS - KERNEL_CS, seg.h */
536	g_aFunctions[5].pfn = (void )0x10; / SUPR0AbsKernelSS - KERNEL_DS, seg.h */
537	g_aFunctions[6].pfn = (void )0x10; / SUPR0AbsKernelDS - KERNEL_DS, seg.h */
538	g_aFunctions[7].pfn = (void )0x10; / SUPR0AbsKernelES - KERNEL_DS, seg.h */
539	g_aFunctions[8].pfn = (void )0x10; / SUPR0AbsKernelFS - KERNEL_DS, seg.h */
540	g_aFunctions[9].pfn = (void )0x48; / SUPR0AbsKernelGS - CPU_DATA_GS, seg.h */
541	# else /* 64-bit darwin: */
542	g_aFunctions[0].pfn = (void )1; / SUPR0AbsIs64bit */
543	g_aFunctions[1].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0Abs64bitKernelCS */
544	g_aFunctions[2].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0Abs64bitKernelSS */
545	g_aFunctions[3].pfn = (void )0; / SUPR0Abs64bitKernelDS */
546	g_aFunctions[4].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0AbsKernelCS */
547	g_aFunctions[5].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0AbsKernelSS */
548	g_aFunctions[6].pfn = (void )0; / SUPR0AbsKernelDS */
549	g_aFunctions[7].pfn = (void )0; / SUPR0AbsKernelES */
550	g_aFunctions[8].pfn = (void )0; / SUPR0AbsKernelFS */
551	g_aFunctions[9].pfn = (void )0; / SUPR0AbsKernelGS */
552
553	# endif
554	#else /* !RT_OS_DARWIN */
555	# if ARCH_BITS == 64
556	g_aFunctions[0].pfn = (void )1; / SUPR0AbsIs64bit */
557	g_aFunctions[1].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0Abs64bitKernelCS */
558	g_aFunctions[2].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0Abs64bitKernelSS */
559	g_aFunctions[3].pfn = (void )(uintptr_t)ASMGetDS(); / SUPR0Abs64bitKernelDS */
560	# else
561	g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[4].pfn = (void *)0;
562	# endif
563	g_aFunctions[4].pfn = (void )(uintptr_t)ASMGetCS(); / SUPR0AbsKernelCS */
564	g_aFunctions[5].pfn = (void )(uintptr_t)ASMGetSS(); / SUPR0AbsKernelSS */
565	g_aFunctions[6].pfn = (void )(uintptr_t)ASMGetDS(); / SUPR0AbsKernelDS */
566	g_aFunctions[7].pfn = (void )(uintptr_t)ASMGetES(); / SUPR0AbsKernelES */
567	g_aFunctions[8].pfn = (void )(uintptr_t)ASMGetFS(); / SUPR0AbsKernelFS */
568	g_aFunctions[9].pfn = (void )(uintptr_t)ASMGetGS(); / SUPR0AbsKernelGS */
569	#endif /* !RT_OS_DARWIN */
570	return VINF_SUCCESS;
571	}
572
573	supdrvGipDestroy(pDevExt);
574	}
575
576	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
577	RTSemMutexDestroy(pDevExt->mtxGip);
578	pDevExt->mtxGip = NIL_RTSEMMUTEX;
579	#else
580	RTSemFastMutexDestroy(pDevExt->mtxGip);
581	pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
582	#endif
583	}
584	RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
585	pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
586	}
587	}
588
589	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
590	RTSemMutexDestroy(pDevExt->mtxTscDelta);
591	pDevExt->mtxTscDelta = NIL_RTSEMMUTEX;
592	#else
593	RTSemFastMutexDestroy(pDevExt->mtxTscDelta);
594	pDevExt->mtxTscDelta = NIL_RTSEMFASTMUTEX;
595	#endif
596	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
597	RTSemMutexDestroy(pDevExt->mtxLdr);
598	pDevExt->mtxLdr = NIL_RTSEMMUTEX;
599	#else
600	RTSemFastMutexDestroy(pDevExt->mtxLdr);
601	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
602	#endif
603	RTSpinlockDestroy(pDevExt->Spinlock);
604	pDevExt->Spinlock = NIL_RTSPINLOCK;
605	RTSpinlockDestroy(pDevExt->hGipSpinlock);
606	pDevExt->hGipSpinlock = NIL_RTSPINLOCK;
607	RTSpinlockDestroy(pDevExt->hSessionHashTabSpinlock);
608	pDevExt->hSessionHashTabSpinlock = NIL_RTSPINLOCK;
609
610	#ifdef SUPDRV_WITH_RELEASE_LOGGER
611	RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
612	RTLogDestroy(RTLogSetDefaultInstance(NULL));
613	#endif
614
615	return rc;
616	}
617
618
619	/**
620	* Delete the device extension (e.g. cleanup members).
621	*
622	* @param pDevExt The device extension to delete.
623	*/
624	void VBOXCALL supdrvDeleteDevExt(PSUPDRVDEVEXT pDevExt)
625	{
626	PSUPDRVOBJ pObj;
627	PSUPDRVUSAGE pUsage;
628
629	/*
630	* Kill mutexes and spinlocks.
631	*/
632	#ifdef SUPDRV_USE_MUTEX_FOR_GIP
633	RTSemMutexDestroy(pDevExt->mtxGip);
634	pDevExt->mtxGip = NIL_RTSEMMUTEX;
635	RTSemMutexDestroy(pDevExt->mtxTscDelta);
636	pDevExt->mtxTscDelta = NIL_RTSEMMUTEX;
637	#else
638	RTSemFastMutexDestroy(pDevExt->mtxGip);
639	pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
640	RTSemFastMutexDestroy(pDevExt->mtxTscDelta);
641	pDevExt->mtxTscDelta = NIL_RTSEMFASTMUTEX;
642	#endif
643	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
644	RTSemMutexDestroy(pDevExt->mtxLdr);
645	pDevExt->mtxLdr = NIL_RTSEMMUTEX;
646	#else
647	RTSemFastMutexDestroy(pDevExt->mtxLdr);
648	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
649	#endif
650	RTSpinlockDestroy(pDevExt->Spinlock);
651	pDevExt->Spinlock = NIL_RTSPINLOCK;
652	RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
653	pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
654	RTSpinlockDestroy(pDevExt->hSessionHashTabSpinlock);
655	pDevExt->hSessionHashTabSpinlock = NIL_RTSPINLOCK;
656
657	/*
658	* Free lists.
659	*/
660	/* objects. */
661	pObj = pDevExt->pObjs;
662	Assert(!pObj); /* (can trigger on forced unloads) */
663	pDevExt->pObjs = NULL;
664	while (pObj)
665	{
666	void *pvFree = pObj;
667	pObj = pObj->pNext;
668	RTMemFree(pvFree);
669	}
670
671	/* usage records. */
672	pUsage = pDevExt->pUsageFree;
673	pDevExt->pUsageFree = NULL;
674	while (pUsage)
675	{
676	void *pvFree = pUsage;
677	pUsage = pUsage->pNext;
678	RTMemFree(pvFree);
679	}
680
681	/* kill the GIP. */
682	supdrvGipDestroy(pDevExt);
683	RTSpinlockDestroy(pDevExt->hGipSpinlock);
684	pDevExt->hGipSpinlock = NIL_RTSPINLOCK;
685
686	supdrvTracerTerm(pDevExt);
687
688	#ifdef SUPDRV_WITH_RELEASE_LOGGER
689	/* destroy the loggers. */
690	RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
691	RTLogDestroy(RTLogSetDefaultInstance(NULL));
692	#endif
693	}
694
695
696	/**
697	* Create session.
698	*
699	* @returns IPRT status code.
700	* @param pDevExt Device extension.
701	* @param fUser Flag indicating whether this is a user or kernel
702	* session.
703	* @param fUnrestricted Unrestricted access (system) or restricted access
704	* (user)?
705	* @param ppSession Where to store the pointer to the session data.
706	*/
707	int VBOXCALL supdrvCreateSession(PSUPDRVDEVEXT pDevExt, bool fUser, bool fUnrestricted, PSUPDRVSESSION *ppSession)
708	{
709	int rc;
710	PSUPDRVSESSION pSession;
711
712	if (!SUP_IS_DEVEXT_VALID(pDevExt))
713	return VERR_INVALID_PARAMETER;
714
715	/*
716	* Allocate memory for the session data.
717	*/
718	pSession = *ppSession = (PSUPDRVSESSION)RTMemAllocZ(pDevExt->cbSession);
719	if (pSession)
720	{
721	/* Initialize session data. */
722	rc = RTSpinlockCreate(&pSession->Spinlock, RTSPINLOCK_FLAGS_INTERRUPT_UNSAFE, "SUPDrvSession");
723	if (!rc)
724	{
725	rc = RTHandleTableCreateEx(&pSession->hHandleTable,
726	RTHANDLETABLE_FLAGS_LOCKED_IRQ_SAFE \| RTHANDLETABLE_FLAGS_CONTEXT,
727	1 /uBase/, 32768 /cMax/, supdrvSessionObjHandleRetain, pSession);
728	if (RT_SUCCESS(rc))
729	{
730	Assert(pSession->Spinlock != NIL_RTSPINLOCK);
731	pSession->pDevExt = pDevExt;
732	pSession->u32Cookie = BIRD_INV;
733	pSession->fUnrestricted = fUnrestricted;
734	/pSession->fInHashTable = false; /
735	pSession->cRefs = 1;
736	/*pSession->pCommonNextHash = NULL;
737	pSession->ppOsSessionPtr = NULL; */
738	if (fUser)
739	{
740	pSession->Process = RTProcSelf();
741	pSession->R0Process = RTR0ProcHandleSelf();
742	}
743	else
744	{
745	pSession->Process = NIL_RTPROCESS;
746	pSession->R0Process = NIL_RTR0PROCESS;
747	}
748	/*pSession->pLdrUsage = NULL;
749	pSession->pVM = NULL;
750	pSession->pUsage = NULL;
751	pSession->pGip = NULL;
752	pSession->fGipReferenced = false;
753	pSession->Bundle.cUsed = 0; */
754	pSession->Uid = NIL_RTUID;
755	pSession->Gid = NIL_RTGID;
756	/pSession->uTracerData = 0;/
757	pSession->hTracerCaller = NIL_RTNATIVETHREAD;
758	RTListInit(&pSession->TpProviders);
759	/pSession->cTpProviders = 0;/
760	/pSession->cTpProbesFiring = 0;/
761	RTListInit(&pSession->TpUmods);
762	/RT_ZERO(pSession->apTpLookupTable);/
763
764	VBOXDRV_SESSION_CREATE(pSession, fUser);
765	LogFlow(("Created session %p initial cookie=%#x\n", pSession, pSession->u32Cookie));
766	return VINF_SUCCESS;
767	}
768
769	RTSpinlockDestroy(pSession->Spinlock);
770	}
771	RTMemFree(pSession);
772	*ppSession = NULL;
773	Log(("Failed to create spinlock, rc=%d!\n", rc));
774	}
775	else
776	rc = VERR_NO_MEMORY;
777
778	return rc;
779	}
780
781
782	/**
783	* Cleans up the session in the context of the process to which it belongs, the
784	* caller will free the session and the session spinlock.
785	*
786	* This should normally occur when the session is closed or as the process
787	* exits. Careful reference counting in the OS specfic code makes sure that
788	* there cannot be any races between process/handle cleanup callbacks and
789	* threads doing I/O control calls.
790	*
791	* @param pDevExt The device extension.
792	* @param pSession Session data.
793	*/
794	static void supdrvCleanupSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
795	{
796	int rc;
797	PSUPDRVBUNDLE pBundle;
798	LogFlow(("supdrvCleanupSession: pSession=%p\n", pSession));
799
800	Assert(!pSession->fInHashTable);
801	Assert(!pSession->ppOsSessionPtr);
802	AssertReleaseMsg(pSession->R0Process == RTR0ProcHandleSelf() \|\| pSession->R0Process == NIL_RTR0PROCESS,
803	("R0Process=%p cur=%p; Process=%u curpid=%u\n", RTR0ProcHandleSelf(), RTProcSelf()));
804
805	/*
806	* Remove logger instances related to this session.
807	*/
808	RTLogSetDefaultInstanceThread(NULL, (uintptr_t)pSession);
809
810	/*
811	* Destroy the handle table.
812	*/
813	rc = RTHandleTableDestroy(pSession->hHandleTable, supdrvSessionObjHandleDelete, pSession);
814	AssertRC(rc);
815	pSession->hHandleTable = NIL_RTHANDLETABLE;
816
817	/*
818	* Release object references made in this session.
819	* In theory there should be noone racing us in this session.
820	*/
821	Log2(("release objects - start\n"));
822	if (pSession->pUsage)
823	{
824	PSUPDRVUSAGE pUsage;
825	RTSpinlockAcquire(pDevExt->Spinlock);
826
827	while ((pUsage = pSession->pUsage) != NULL)
828	{
829	PSUPDRVOBJ pObj = pUsage->pObj;
830	pSession->pUsage = pUsage->pNext;
831
832	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
833	if (pUsage->cUsage < pObj->cUsage)
834	{
835	pObj->cUsage -= pUsage->cUsage;
836	RTSpinlockRelease(pDevExt->Spinlock);
837	}
838	else
839	{
840	/* Destroy the object and free the record. */
841	if (pDevExt->pObjs == pObj)
842	pDevExt->pObjs = pObj->pNext;
843	else
844	{
845	PSUPDRVOBJ pObjPrev;
846	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
847	if (pObjPrev->pNext == pObj)
848	{
849	pObjPrev->pNext = pObj->pNext;
850	break;
851	}
852	Assert(pObjPrev);
853	}
854	RTSpinlockRelease(pDevExt->Spinlock);
855
856	Log(("supdrvCleanupSession: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
857	pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
858	if (pObj->pfnDestructor)
859	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
860	RTMemFree(pObj);
861	}
862
863	/* free it and continue. */
864	RTMemFree(pUsage);
865
866	RTSpinlockAcquire(pDevExt->Spinlock);
867	}
868
869	RTSpinlockRelease(pDevExt->Spinlock);
870	AssertMsg(!pSession->pUsage, ("Some buster reregistered an object during desturction!\n"));
871	}
872	Log2(("release objects - done\n"));
873
874	/*
875	* Do tracer cleanups related to this session.
876	*/
877	Log2(("release tracer stuff - start\n"));
878	supdrvTracerCleanupSession(pDevExt, pSession);
879	Log2(("release tracer stuff - end\n"));
880
881	/*
882	* Release memory allocated in the session.
883	*
884	* We do not serialize this as we assume that the application will
885	* not allocated memory while closing the file handle object.
886	*/
887	Log2(("freeing memory:\n"));
888	pBundle = &pSession->Bundle;
889	while (pBundle)
890	{
891	PSUPDRVBUNDLE pToFree;
892	unsigned i;
893
894	/*
895	* Check and unlock all entries in the bundle.
896	*/
897	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
898	{
899	if (pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ)
900	{
901	Log2(("eType=%d pvR0=%p pvR3=%p cb=%ld\n", pBundle->aMem[i].eType, RTR0MemObjAddress(pBundle->aMem[i].MemObj),
902	(void *)RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3), (long)RTR0MemObjSize(pBundle->aMem[i].MemObj)));
903	if (pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ)
904	{
905	rc = RTR0MemObjFree(pBundle->aMem[i].MapObjR3, false);
906	AssertRC(rc); /** @todo figure out how to handle this. */
907	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
908	}
909	rc = RTR0MemObjFree(pBundle->aMem[i].MemObj, true /* fFreeMappings */);
910	AssertRC(rc); /** @todo figure out how to handle this. */
911	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
912	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
913	}
914	}
915
916	/*
917	* Advance and free previous bundle.
918	*/
919	pToFree = pBundle;
920	pBundle = pBundle->pNext;
921
922	pToFree->pNext = NULL;
923	pToFree->cUsed = 0;
924	if (pToFree != &pSession->Bundle)
925	RTMemFree(pToFree);
926	}
927	Log2(("freeing memory - done\n"));
928
929	/*
930	* Deregister component factories.
931	*/
932	RTSemFastMutexRequest(pDevExt->mtxComponentFactory);
933	Log2(("deregistering component factories:\n"));
934	if (pDevExt->pComponentFactoryHead)
935	{
936	PSUPDRVFACTORYREG pPrev = NULL;
937	PSUPDRVFACTORYREG pCur = pDevExt->pComponentFactoryHead;
938	while (pCur)
939	{
940	if (pCur->pSession == pSession)
941	{
942	/* unlink it */
943	PSUPDRVFACTORYREG pNext = pCur->pNext;
944	if (pPrev)
945	pPrev->pNext = pNext;
946	else
947	pDevExt->pComponentFactoryHead = pNext;
948
949	/* free it */
950	pCur->pNext = NULL;
951	pCur->pSession = NULL;
952	pCur->pFactory = NULL;
953	RTMemFree(pCur);
954
955	/* next */
956	pCur = pNext;
957	}
958	else
959	{
960	/* next */
961	pPrev = pCur;
962	pCur = pCur->pNext;
963	}
964	}
965	}
966	RTSemFastMutexRelease(pDevExt->mtxComponentFactory);
967	Log2(("deregistering component factories - done\n"));
968
969	/*
970	* Loaded images needs to be dereferenced and possibly freed up.
971	*/
972	supdrvLdrLock(pDevExt);
973	Log2(("freeing images:\n"));
974	if (pSession->pLdrUsage)
975	{
976	PSUPDRVLDRUSAGE pUsage = pSession->pLdrUsage;
977	pSession->pLdrUsage = NULL;
978	while (pUsage)
979	{
980	void *pvFree = pUsage;
981	PSUPDRVLDRIMAGE pImage = pUsage->pImage;
982	if (pImage->cUsage > pUsage->cUsage)
983	pImage->cUsage -= pUsage->cUsage;
984	else
985	supdrvLdrFree(pDevExt, pImage);
986	pUsage->pImage = NULL;
987	pUsage = pUsage->pNext;
988	RTMemFree(pvFree);
989	}
990	}
991	supdrvLdrUnlock(pDevExt);
992	Log2(("freeing images - done\n"));
993
994	/*
995	* Unmap the GIP.
996	*/
997	Log2(("umapping GIP:\n"));
998	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
999	{
1000	SUPR0GipUnmap(pSession);
1001	pSession->fGipReferenced = 0;
1002	}
1003	Log2(("umapping GIP - done\n"));
1004	}
1005
1006
1007	/**
1008	* Common code for freeing a session when the reference count reaches zero.
1009	*
1010	* @param pDevExt Device extension.
1011	* @param pSession Session data.
1012	* This data will be freed by this routine.
1013	*/
1014	static void supdrvDestroySession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
1015	{
1016	VBOXDRV_SESSION_CLOSE(pSession);
1017
1018	/*
1019	* Cleanup the session first.
1020	*/
1021	supdrvCleanupSession(pDevExt, pSession);
1022	supdrvOSCleanupSession(pDevExt, pSession);
1023
1024	/*
1025	* Free the rest of the session stuff.
1026	*/
1027	RTSpinlockDestroy(pSession->Spinlock);
1028	pSession->Spinlock = NIL_RTSPINLOCK;
1029	pSession->pDevExt = NULL;
1030	RTMemFree(pSession);
1031	LogFlow(("supdrvDestroySession: returns\n"));
1032	}
1033
1034
1035	/**
1036	* Inserts the session into the global hash table.
1037	*
1038	* @retval VINF_SUCCESS on success.
1039	* @retval VERR_WRONG_ORDER if the session was already inserted (asserted).
1040	* @retval VERR_INVALID_PARAMETER if the session handle is invalid or a ring-0
1041	* session (asserted).
1042	* @retval VERR_DUPLICATE if there is already a session for that pid.
1043	*
1044	* @param pDevExt The device extension.
1045	* @param pSession The session.
1046	* @param ppOsSessionPtr Pointer to the OS session pointer, if any is
1047	* available and used. This will set to point to the
1048	* session while under the protection of the session
1049	* hash table spinlock. It will also be kept in
1050	* PSUPDRVSESSION::ppOsSessionPtr for lookup and
1051	* cleanup use.
1052	* @param pvUser Argument for supdrvOSSessionHashTabInserted.
1053	*/
1054	int VBOXCALL supdrvSessionHashTabInsert(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVSESSION *ppOsSessionPtr,
1055	void *pvUser)
1056	{
1057	PSUPDRVSESSION pCur;
1058	unsigned iHash;
1059
1060	/*
1061	* Validate input.
1062	*/
1063	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
1064	AssertReturn(pSession->R0Process != NIL_RTR0PROCESS, VERR_INVALID_PARAMETER);
1065
1066	/*
1067	* Calculate the hash table index and acquire the spinlock.
1068	*/
1069	iHash = SUPDRV_SESSION_HASH(pSession->Process);
1070
1071	RTSpinlockAcquire(pDevExt->hSessionHashTabSpinlock);
1072
1073	/*
1074	* If there are a collisions, we need to carefully check if we got a
1075	* duplicate. There can only be one open session per process.
1076	*/
1077	pCur = pDevExt->apSessionHashTab[iHash];
1078	if (pCur)
1079	{
1080	while (pCur && pCur->Process != pSession->Process)
1081	pCur = pCur->pCommonNextHash;
1082
1083	if (pCur)
1084	{
1085	RTSpinlockRelease(pDevExt->hSessionHashTabSpinlock);
1086	if (pCur == pSession)
1087	{
1088	Assert(pSession->fInHashTable);
1089	AssertFailed();
1090	return VERR_WRONG_ORDER;
1091	}
1092	Assert(!pSession->fInHashTable);
1093	if (pCur->R0Process == pSession->R0Process)
1094	return VERR_RESOURCE_IN_USE;
1095	return VERR_DUPLICATE;
1096	}
1097	}
1098	Assert(!pSession->fInHashTable);
1099	Assert(!pSession->ppOsSessionPtr);
1100
1101	/*
1102	* Insert it, doing a callout to the OS specific code in case it has
1103	* anything it wishes to do while we're holding the spinlock.
1104	*/
1105	pSession->pCommonNextHash = pDevExt->apSessionHashTab[iHash];
1106	pDevExt->apSessionHashTab[iHash] = pSession;
1107	pSession->fInHashTable = true;
1108	ASMAtomicIncS32(&pDevExt->cSessions);
1109
1110	pSession->ppOsSessionPtr = ppOsSessionPtr;
1111	if (ppOsSessionPtr)
1112	ASMAtomicWritePtr(ppOsSessionPtr, pSession);
1113
1114	supdrvOSSessionHashTabInserted(pDevExt, pSession, pvUser);
1115
1116	/*
1117	* Retain a reference for the pointer in the session table.
1118	*/
1119	ASMAtomicIncU32(&pSession->cRefs);
1120
1121	RTSpinlockRelease(pDevExt->hSessionHashTabSpinlock);
1122	return VINF_SUCCESS;
1123	}
1124
1125
1126	/**
1127	* Removes the session from the global hash table.
1128	*
1129	* @retval VINF_SUCCESS on success.
1130	* @retval VERR_NOT_FOUND if the session was already removed (asserted).
1131	* @retval VERR_INVALID_PARAMETER if the session handle is invalid or a ring-0
1132	* session (asserted).
1133	*
1134	* @param pDevExt The device extension.
1135	* @param pSession The session. The caller is expected to have a reference
1136	* to this so it won't croak on us when we release the hash
1137	* table reference.
1138	* @param pvUser OS specific context value for the
1139	* supdrvOSSessionHashTabInserted callback.
1140	*/
1141	int VBOXCALL supdrvSessionHashTabRemove(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, void *pvUser)
1142	{
1143	PSUPDRVSESSION pCur;
1144	unsigned iHash;
1145	int32_t cRefs;
1146
1147	/*
1148	* Validate input.
1149	*/
1150	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
1151	AssertReturn(pSession->R0Process != NIL_RTR0PROCESS, VERR_INVALID_PARAMETER);
1152
1153	/*
1154	* Calculate the hash table index and acquire the spinlock.
1155	*/
1156	iHash = SUPDRV_SESSION_HASH(pSession->Process);
1157
1158	RTSpinlockAcquire(pDevExt->hSessionHashTabSpinlock);
1159
1160	/*
1161	* Unlink it.
1162	*/
1163	pCur = pDevExt->apSessionHashTab[iHash];
1164	if (pCur == pSession)
1165	pDevExt->apSessionHashTab[iHash] = pSession->pCommonNextHash;
1166	else
1167	{
1168	PSUPDRVSESSION pPrev = pCur;
1169	while (pCur && pCur != pSession)
1170	{
1171	pPrev = pCur;
1172	pCur = pCur->pCommonNextHash;
1173	}
1174	if (pCur)
1175	pPrev->pCommonNextHash = pCur->pCommonNextHash;
1176	else
1177	{
1178	Assert(!pSession->fInHashTable);
1179	RTSpinlockRelease(pDevExt->hSessionHashTabSpinlock);
1180	return VERR_NOT_FOUND;
1181	}
1182	}
1183
1184	pSession->pCommonNextHash = NULL;
1185	pSession->fInHashTable = false;
1186
1187	ASMAtomicDecS32(&pDevExt->cSessions);
1188
1189	/*
1190	* Clear OS specific session pointer if available and do the OS callback.
1191	*/
1192	if (pSession->ppOsSessionPtr)
1193	{
1194	ASMAtomicCmpXchgPtr(pSession->ppOsSessionPtr, NULL, pSession);
1195	pSession->ppOsSessionPtr = NULL;
1196	}
1197
1198	supdrvOSSessionHashTabRemoved(pDevExt, pSession, pvUser);
1199
1200	RTSpinlockRelease(pDevExt->hSessionHashTabSpinlock);
1201
1202	/*
1203	* Drop the reference the hash table had to the session. This shouldn't
1204	* be the last reference!
1205	*/
1206	cRefs = ASMAtomicDecU32(&pSession->cRefs);
1207	Assert(cRefs > 0 && cRefs < _1M);
1208	if (cRefs == 0)
1209	supdrvDestroySession(pDevExt, pSession);
1210
1211	return VINF_SUCCESS;
1212	}
1213
1214
1215	/**
1216	* Looks up the session for the current process in the global hash table or in
1217	* OS specific pointer.
1218	*
1219	* @returns Pointer to the session with a reference that the caller must
1220	* release. If no valid session was found, NULL is returned.
1221	*
1222	* @param pDevExt The device extension.
1223	* @param Process The process ID.
1224	* @param R0Process The ring-0 process handle.
1225	* @param ppOsSessionPtr The OS session pointer if available. If not NULL,
1226	* this is used instead of the hash table. For
1227	* additional safety it must then be equal to the
1228	* SUPDRVSESSION::ppOsSessionPtr member.
1229	* This can be NULL even if the OS has a session
1230	* pointer.
1231	*/
1232	PSUPDRVSESSION VBOXCALL supdrvSessionHashTabLookup(PSUPDRVDEVEXT pDevExt, RTPROCESS Process, RTR0PROCESS R0Process,
1233	PSUPDRVSESSION *ppOsSessionPtr)
1234	{
1235	PSUPDRVSESSION pCur;
1236	unsigned iHash;
1237
1238	/*
1239	* Validate input.
1240	*/
1241	AssertReturn(R0Process != NIL_RTR0PROCESS, NULL);
1242
1243	/*
1244	* Calculate the hash table index and acquire the spinlock.
1245	*/
1246	iHash = SUPDRV_SESSION_HASH(Process);
1247
1248	RTSpinlockAcquire(pDevExt->hSessionHashTabSpinlock);
1249
1250	/*
1251	* If an OS session pointer is provided, always use it.
1252	*/
1253	if (ppOsSessionPtr)
1254	{
1255	pCur = *ppOsSessionPtr;
1256	if ( pCur
1257	&& ( pCur->ppOsSessionPtr != ppOsSessionPtr
1258	\|\| pCur->Process != Process
1259	\|\| pCur->R0Process != R0Process) )
1260	pCur = NULL;
1261	}
1262	else
1263	{
1264	/*
1265	* Otherwise, do the hash table lookup.
1266	*/
1267	pCur = pDevExt->apSessionHashTab[iHash];
1268	while ( pCur
1269	&& ( pCur->Process != Process
1270	\|\| pCur->R0Process != R0Process) )
1271	pCur = pCur->pCommonNextHash;
1272	}
1273
1274	/*
1275	* Retain the session.
1276	*/
1277	if (pCur)
1278	{
1279	uint32_t cRefs = ASMAtomicIncU32(&pCur->cRefs);
1280	NOREF(cRefs);
1281	Assert(cRefs > 1 && cRefs < _1M);
1282	}
1283
1284	RTSpinlockRelease(pDevExt->hSessionHashTabSpinlock);
1285
1286	return pCur;
1287	}
1288
1289
1290	/**
1291	* Retain a session to make sure it doesn't go away while it is in use.
1292	*
1293	* @returns New reference count on success, UINT32_MAX on failure.
1294	* @param pSession Session data.
1295	*/
1296	uint32_t VBOXCALL supdrvSessionRetain(PSUPDRVSESSION pSession)
1297	{
1298	uint32_t cRefs;
1299	AssertPtrReturn(pSession, UINT32_MAX);
1300	AssertReturn(SUP_IS_SESSION_VALID(pSession), UINT32_MAX);
1301
1302	cRefs = ASMAtomicIncU32(&pSession->cRefs);
1303	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pSession));
1304	return cRefs;
1305	}
1306
1307
1308	/**
1309	* Releases a given session.
1310	*
1311	* @returns New reference count on success (0 if closed), UINT32_MAX on failure.
1312	* @param pSession Session data.
1313	*/
1314	uint32_t VBOXCALL supdrvSessionRelease(PSUPDRVSESSION pSession)
1315	{
1316	uint32_t cRefs;
1317	AssertPtrReturn(pSession, UINT32_MAX);
1318	AssertReturn(SUP_IS_SESSION_VALID(pSession), UINT32_MAX);
1319
1320	cRefs = ASMAtomicDecU32(&pSession->cRefs);
1321	AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pSession));
1322	if (cRefs == 0)
1323	supdrvDestroySession(pSession->pDevExt, pSession);
1324	return cRefs;
1325	}
1326
1327
1328	/**
1329	* RTHandleTableDestroy callback used by supdrvCleanupSession.
1330	*
1331	* @returns IPRT status code, see SUPR0ObjAddRef.
1332	* @param hHandleTable The handle table handle. Ignored.
1333	* @param pvObj The object pointer.
1334	* @param pvCtx Context, the handle type. Ignored.
1335	* @param pvUser Session pointer.
1336	*/
1337	static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void pvObj, void pvCtx, void *pvUser)
1338	{
1339	NOREF(pvCtx);
1340	NOREF(hHandleTable);
1341	return SUPR0ObjAddRefEx(pvObj, (PSUPDRVSESSION)pvUser, true /fNoBlocking/);
1342	}
1343
1344
1345	/**
1346	* RTHandleTableDestroy callback used by supdrvCleanupSession.
1347	*
1348	* @param hHandleTable The handle table handle. Ignored.
1349	* @param h The handle value. Ignored.
1350	* @param pvObj The object pointer.
1351	* @param pvCtx Context, the handle type. Ignored.
1352	* @param pvUser Session pointer.
1353	*/
1354	static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void pvObj, void pvCtx, void *pvUser)
1355	{
1356	NOREF(pvCtx);
1357	NOREF(h);
1358	NOREF(hHandleTable);
1359	SUPR0ObjRelease(pvObj, (PSUPDRVSESSION)pvUser);
1360	}
1361
1362
1363	/**
1364	* Fast path I/O Control worker.
1365	*
1366	* @returns VBox status code that should be passed down to ring-3 unchanged.
1367	* @param uIOCtl Function number.
1368	* @param idCpu VMCPU id.
1369	* @param pDevExt Device extention.
1370	* @param pSession Session data.
1371	*/
1372	int VBOXCALL supdrvIOCtlFast(uintptr_t uIOCtl, VMCPUID idCpu, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
1373	{
1374	/*
1375	* We check the two prereqs after doing this only to allow the compiler to optimize things better.
1376	*/
1377	if (RT_LIKELY( RT_VALID_PTR(pSession)
1378	&& pSession->pVM
1379	&& pDevExt->pfnVMMR0EntryFast))
1380	{
1381	switch (uIOCtl)
1382	{
1383	case SUP_IOCTL_FAST_DO_RAW_RUN:
1384	pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_RAW_RUN);
1385	break;
1386	case SUP_IOCTL_FAST_DO_HM_RUN:
1387	pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_HM_RUN);
1388	break;
1389	case SUP_IOCTL_FAST_DO_NOP:
1390	pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_NOP);
1391	break;
1392	default:
1393	return VERR_INTERNAL_ERROR;
1394	}
1395	return VINF_SUCCESS;
1396	}
1397	return VERR_INTERNAL_ERROR;
1398	}
1399
1400
1401	/**
1402	* Helper for supdrvIOCtl used to validate module names passed to SUP_IOCTL_LDR_OPEN.
1403	*
1404	* Check if pszStr contains any character of pszChars. We would use strpbrk
1405	* here if this function would be contained in the RedHat kABI white list, see
1406	* http://www.kerneldrivers.org/RHEL5.
1407	*
1408	* @returns true if fine, false if not.
1409	* @param pszName The module name to check.
1410	*/
1411	static bool supdrvIsLdrModuleNameValid(const char *pszName)
1412	{
1413	int chCur;
1414	while ((chCur = *pszName++) != '\0')
1415	{
1416	static const char s_szInvalidChars[] = ";:()[]{}/\\\|&*%#@!~`\"'";
1417	unsigned offInv = RT_ELEMENTS(s_szInvalidChars);
1418	while (offInv-- > 0)
1419	if (s_szInvalidChars[offInv] == chCur)
1420	return false;
1421	}
1422	return true;
1423	}
1424
1425
1426
1427	/**
1428	* I/O Control inner worker (tracing reasons).
1429	*
1430	* @returns IPRT status code.
1431	* @retval VERR_INVALID_PARAMETER if the request is invalid.
1432	*
1433	* @param uIOCtl Function number.
1434	* @param pDevExt Device extention.
1435	* @param pSession Session data.
1436	* @param pReqHdr The request header.
1437	*/
1438	static int supdrvIOCtlInnerUnrestricted(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPREQHDR pReqHdr)
1439	{
1440	/*
1441	* Validation macros
1442	*/
1443	#define REQ_CHECK_SIZES_EX(Name, cbInExpect, cbOutExpect) \
1444	do { \
1445	if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect) \|\| pReqHdr->cbOut != (cbOutExpect))) \
1446	{ \
1447	OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld. cbOut=%ld expected %ld.\n", \
1448	(long)pReqHdr->cbIn, (long)(cbInExpect), (long)pReqHdr->cbOut, (long)(cbOutExpect))); \
1449	return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1450	} \
1451	} while (0)
1452
1453	#define REQ_CHECK_SIZES(Name) REQ_CHECK_SIZES_EX(Name, Name ## _SIZE_IN, Name ## _SIZE_OUT)
1454
1455	#define REQ_CHECK_SIZE_IN(Name, cbInExpect) \
1456	do { \
1457	if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect))) \
1458	{ \
1459	OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld.\n", \
1460	(long)pReqHdr->cbIn, (long)(cbInExpect))); \
1461	return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1462	} \
1463	} while (0)
1464
1465	#define REQ_CHECK_SIZE_OUT(Name, cbOutExpect) \
1466	do { \
1467	if (RT_UNLIKELY(pReqHdr->cbOut != (cbOutExpect))) \
1468	{ \
1469	OSDBGPRINT(( #Name ": Invalid input/output sizes. cbOut=%ld expected %ld.\n", \
1470	(long)pReqHdr->cbOut, (long)(cbOutExpect))); \
1471	return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1472	} \
1473	} while (0)
1474
1475	#define REQ_CHECK_EXPR(Name, expr) \
1476	do { \
1477	if (RT_UNLIKELY(!(expr))) \
1478	{ \
1479	OSDBGPRINT(( #Name ": %s\n", #expr)); \
1480	return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1481	} \
1482	} while (0)
1483
1484	#define REQ_CHECK_EXPR_FMT(expr, fmt) \
1485	do { \
1486	if (RT_UNLIKELY(!(expr))) \
1487	{ \
1488	OSDBGPRINT( fmt ); \
1489	return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1490	} \
1491	} while (0)
1492
1493	/*
1494	* The switch.
1495	*/
1496	switch (SUP_CTL_CODE_NO_SIZE(uIOCtl))
1497	{
1498	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_COOKIE):
1499	{
1500	PSUPCOOKIE pReq = (PSUPCOOKIE)pReqHdr;
1501	REQ_CHECK_SIZES(SUP_IOCTL_COOKIE);
1502	if (strncmp(pReq->u.In.szMagic, SUPCOOKIE_MAGIC, sizeof(pReq->u.In.szMagic)))
1503	{
1504	OSDBGPRINT(("SUP_IOCTL_COOKIE: invalid magic %.16s\n", pReq->u.In.szMagic));
1505	pReq->Hdr.rc = VERR_INVALID_MAGIC;
1506	return 0;
1507	}
1508
1509	#if 0
1510	/*
1511	* Call out to the OS specific code and let it do permission checks on the
1512	* client process.
1513	*/
1514	if (!supdrvOSValidateClientProcess(pDevExt, pSession))
1515	{
1516	pReq->u.Out.u32Cookie = 0xffffffff;
1517	pReq->u.Out.u32SessionCookie = 0xffffffff;
1518	pReq->u.Out.u32SessionVersion = 0xffffffff;
1519	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1520	pReq->u.Out.pSession = NULL;
1521	pReq->u.Out.cFunctions = 0;
1522	pReq->Hdr.rc = VERR_PERMISSION_DENIED;
1523	return 0;
1524	}
1525	#endif
1526
1527	/*
1528	* Match the version.
1529	* The current logic is very simple, match the major interface version.
1530	*/
1531	if ( pReq->u.In.u32MinVersion > SUPDRV_IOC_VERSION
1532	\|\| (pReq->u.In.u32MinVersion & 0xffff0000) != (SUPDRV_IOC_VERSION & 0xffff0000))
1533	{
1534	OSDBGPRINT(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
1535	pReq->u.In.u32ReqVersion, pReq->u.In.u32MinVersion, SUPDRV_IOC_VERSION));
1536	pReq->u.Out.u32Cookie = 0xffffffff;
1537	pReq->u.Out.u32SessionCookie = 0xffffffff;
1538	pReq->u.Out.u32SessionVersion = 0xffffffff;
1539	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1540	pReq->u.Out.pSession = NULL;
1541	pReq->u.Out.cFunctions = 0;
1542	pReq->Hdr.rc = VERR_VERSION_MISMATCH;
1543	return 0;
1544	}
1545
1546	/*
1547	* Fill in return data and be gone.
1548	* N.B. The first one to change SUPDRV_IOC_VERSION shall makes sure that
1549	* u32SessionVersion <= u32ReqVersion!
1550	*/
1551	/** @todo Somehow validate the client and negotiate a secure cookie... */
1552	pReq->u.Out.u32Cookie = pDevExt->u32Cookie;
1553	pReq->u.Out.u32SessionCookie = pSession->u32Cookie;
1554	pReq->u.Out.u32SessionVersion = SUPDRV_IOC_VERSION;
1555	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1556	pReq->u.Out.pSession = pSession;
1557	pReq->u.Out.cFunctions = sizeof(g_aFunctions) / sizeof(g_aFunctions[0]);
1558	pReq->Hdr.rc = VINF_SUCCESS;
1559	return 0;
1560	}
1561
1562	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_QUERY_FUNCS(0)):
1563	{
1564	/* validate */
1565	PSUPQUERYFUNCS pReq = (PSUPQUERYFUNCS)pReqHdr;
1566	REQ_CHECK_SIZES_EX(SUP_IOCTL_QUERY_FUNCS, SUP_IOCTL_QUERY_FUNCS_SIZE_IN, SUP_IOCTL_QUERY_FUNCS_SIZE_OUT(RT_ELEMENTS(g_aFunctions)));
1567
1568	/* execute */
1569	pReq->u.Out.cFunctions = RT_ELEMENTS(g_aFunctions);
1570	memcpy(&pReq->u.Out.aFunctions[0], g_aFunctions, sizeof(g_aFunctions));
1571	pReq->Hdr.rc = VINF_SUCCESS;
1572	return 0;
1573	}
1574
1575	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_LOCK):
1576	{
1577	/* validate */
1578	PSUPPAGELOCK pReq = (PSUPPAGELOCK)pReqHdr;
1579	REQ_CHECK_SIZE_IN(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_IN);
1580	REQ_CHECK_SIZE_OUT(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_OUT(pReq->u.In.cPages));
1581	REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.cPages > 0);
1582	REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.pvR3 >= PAGE_SIZE);
1583
1584	/* execute */
1585	pReq->Hdr.rc = SUPR0LockMem(pSession, pReq->u.In.pvR3, pReq->u.In.cPages, &pReq->u.Out.aPages[0]);
1586	if (RT_FAILURE(pReq->Hdr.rc))
1587	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1588	return 0;
1589	}
1590
1591	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_UNLOCK):
1592	{
1593	/* validate */
1594	PSUPPAGEUNLOCK pReq = (PSUPPAGEUNLOCK)pReqHdr;
1595	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_UNLOCK);
1596
1597	/* execute */
1598	pReq->Hdr.rc = SUPR0UnlockMem(pSession, pReq->u.In.pvR3);
1599	return 0;
1600	}
1601
1602	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_ALLOC):
1603	{
1604	/* validate */
1605	PSUPCONTALLOC pReq = (PSUPCONTALLOC)pReqHdr;
1606	REQ_CHECK_SIZES(SUP_IOCTL_CONT_ALLOC);
1607
1608	/* execute */
1609	pReq->Hdr.rc = SUPR0ContAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.HCPhys);
1610	if (RT_FAILURE(pReq->Hdr.rc))
1611	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1612	return 0;
1613	}
1614
1615	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_FREE):
1616	{
1617	/* validate */
1618	PSUPCONTFREE pReq = (PSUPCONTFREE)pReqHdr;
1619	REQ_CHECK_SIZES(SUP_IOCTL_CONT_FREE);
1620
1621	/* execute */
1622	pReq->Hdr.rc = SUPR0ContFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1623	return 0;
1624	}
1625
1626	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_OPEN):
1627	{
1628	/* validate */
1629	PSUPLDROPEN pReq = (PSUPLDROPEN)pReqHdr;
1630	REQ_CHECK_SIZES(SUP_IOCTL_LDR_OPEN);
1631	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageWithTabs > 0);
1632	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageWithTabs < 16*_1M);
1633	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits > 0);
1634	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits > 0);
1635	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits < pReq->u.In.cbImageWithTabs);
1636	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.szName[0]);
1637	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, RTStrEnd(pReq->u.In.szName, sizeof(pReq->u.In.szName)));
1638	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, supdrvIsLdrModuleNameValid(pReq->u.In.szName));
1639	REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, RTStrEnd(pReq->u.In.szFilename, sizeof(pReq->u.In.szFilename)));
1640
1641	/* execute */
1642	pReq->Hdr.rc = supdrvIOCtl_LdrOpen(pDevExt, pSession, pReq);
1643	return 0;
1644	}
1645
1646	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_LOAD):
1647	{
1648	/* validate */
1649	PSUPLDRLOAD pReq = (PSUPLDRLOAD)pReqHdr;
1650	REQ_CHECK_EXPR(Name, pReq->Hdr.cbIn >= sizeof(*pReq));
1651	REQ_CHECK_SIZES_EX(SUP_IOCTL_LDR_LOAD, SUP_IOCTL_LDR_LOAD_SIZE_IN(pReq->u.In.cbImageWithTabs), SUP_IOCTL_LDR_LOAD_SIZE_OUT);
1652	REQ_CHECK_EXPR(SUP_IOCTL_LDR_LOAD, pReq->u.In.cSymbols <= 16384);
1653	REQ_CHECK_EXPR_FMT( !pReq->u.In.cSymbols
1654	\|\| ( pReq->u.In.offSymbols < pReq->u.In.cbImageWithTabs
1655	&& pReq->u.In.offSymbols + pReq->u.In.cSymbols * sizeof(SUPLDRSYM) <= pReq->u.In.cbImageWithTabs),
1656	("SUP_IOCTL_LDR_LOAD: offSymbols=%#lx cSymbols=%#lx cbImageWithTabs=%#lx\n", (long)pReq->u.In.offSymbols,
1657	(long)pReq->u.In.cSymbols, (long)pReq->u.In.cbImageWithTabs));
1658	REQ_CHECK_EXPR_FMT( !pReq->u.In.cbStrTab
1659	\|\| ( pReq->u.In.offStrTab < pReq->u.In.cbImageWithTabs
1660	&& pReq->u.In.offStrTab + pReq->u.In.cbStrTab <= pReq->u.In.cbImageWithTabs
1661	&& pReq->u.In.cbStrTab <= pReq->u.In.cbImageWithTabs),
1662	("SUP_IOCTL_LDR_LOAD: offStrTab=%#lx cbStrTab=%#lx cbImageWithTabs=%#lx\n", (long)pReq->u.In.offStrTab,
1663	(long)pReq->u.In.cbStrTab, (long)pReq->u.In.cbImageWithTabs));
1664
1665	if (pReq->u.In.cSymbols)
1666	{
1667	uint32_t i;
1668	PSUPLDRSYM paSyms = (PSUPLDRSYM)&pReq->u.In.abImage[pReq->u.In.offSymbols];
1669	for (i = 0; i < pReq->u.In.cSymbols; i++)
1670	{
1671	REQ_CHECK_EXPR_FMT(paSyms[i].offSymbol < pReq->u.In.cbImageWithTabs,
1672	("SUP_IOCTL_LDR_LOAD: sym #%ld: symb off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offSymbol, (long)pReq->u.In.cbImageWithTabs));
1673	REQ_CHECK_EXPR_FMT(paSyms[i].offName < pReq->u.In.cbStrTab,
1674	("SUP_IOCTL_LDR_LOAD: sym #%ld: name off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithTabs));
1675	REQ_CHECK_EXPR_FMT(RTStrEnd((char const *)&pReq->u.In.abImage[pReq->u.In.offStrTab + paSyms[i].offName],
1676	pReq->u.In.cbStrTab - paSyms[i].offName),
1677	("SUP_IOCTL_LDR_LOAD: sym #%ld: unterminated name! (%#lx / %#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithTabs));
1678	}
1679	}
1680
1681	/* execute */
1682	pReq->Hdr.rc = supdrvIOCtl_LdrLoad(pDevExt, pSession, pReq);
1683	return 0;
1684	}
1685
1686	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_FREE):
1687	{
1688	/* validate */
1689	PSUPLDRFREE pReq = (PSUPLDRFREE)pReqHdr;
1690	REQ_CHECK_SIZES(SUP_IOCTL_LDR_FREE);
1691
1692	/* execute */
1693	pReq->Hdr.rc = supdrvIOCtl_LdrFree(pDevExt, pSession, pReq);
1694	return 0;
1695	}
1696
1697	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_LOCK_DOWN):
1698	{
1699	/* validate */
1700	REQ_CHECK_SIZES(SUP_IOCTL_LDR_LOCK_DOWN);
1701
1702	/* execute */
1703	pReqHdr->rc = supdrvIOCtl_LdrLockDown(pDevExt);
1704	return 0;
1705	}
1706
1707	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_GET_SYMBOL):
1708	{
1709	/* validate */
1710	PSUPLDRGETSYMBOL pReq = (PSUPLDRGETSYMBOL)pReqHdr;
1711	REQ_CHECK_SIZES(SUP_IOCTL_LDR_GET_SYMBOL);
1712	REQ_CHECK_EXPR(SUP_IOCTL_LDR_GET_SYMBOL, RTStrEnd(pReq->u.In.szSymbol, sizeof(pReq->u.In.szSymbol)));
1713
1714	/* execute */
1715	pReq->Hdr.rc = supdrvIOCtl_LdrGetSymbol(pDevExt, pSession, pReq);
1716	return 0;
1717	}
1718
1719	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_VMMR0_NO_SIZE()):
1720	{
1721	/* validate */
1722	PSUPCALLVMMR0 pReq = (PSUPCALLVMMR0)pReqHdr;
1723	Log4(("SUP_IOCTL_CALL_VMMR0: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1724	pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1725
1726	if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_VMMR0_SIZE(0))
1727	{
1728	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(0), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(0));
1729
1730	/* execute */
1731	if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1732	pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, NULL, pReq->u.In.u64Arg, pSession);
1733	else
1734	pReq->Hdr.rc = VERR_WRONG_ORDER;
1735	}
1736	else
1737	{
1738	PSUPVMMR0REQHDR pVMMReq = (PSUPVMMR0REQHDR)&pReq->abReqPkt[0];
1739	REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR)),
1740	("SUP_IOCTL_CALL_VMMR0: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR))));
1741	REQ_CHECK_EXPR(SUP_IOCTL_CALL_VMMR0, pVMMReq->u32Magic == SUPVMMR0REQHDR_MAGIC);
1742	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(pVMMReq->cbReq), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(pVMMReq->cbReq));
1743
1744	/* execute */
1745	if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1746	pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1747	else
1748	pReq->Hdr.rc = VERR_WRONG_ORDER;
1749	}
1750
1751	if ( RT_FAILURE(pReq->Hdr.rc)
1752	&& pReq->Hdr.rc != VERR_INTERRUPTED
1753	&& pReq->Hdr.rc != VERR_TIMEOUT)
1754	Log(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1755	pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1756	else
1757	Log4(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1758	pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1759	return 0;
1760	}
1761
1762	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_VMMR0_BIG):
1763	{
1764	/* validate */
1765	PSUPCALLVMMR0 pReq = (PSUPCALLVMMR0)pReqHdr;
1766	PSUPVMMR0REQHDR pVMMReq;
1767	Log4(("SUP_IOCTL_CALL_VMMR0_BIG: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1768	pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1769
1770	pVMMReq = (PSUPVMMR0REQHDR)&pReq->abReqPkt[0];
1771	REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_VMMR0_BIG_SIZE(sizeof(SUPVMMR0REQHDR)),
1772	("SUP_IOCTL_CALL_VMMR0_BIG: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_VMMR0_BIG_SIZE(sizeof(SUPVMMR0REQHDR))));
1773	REQ_CHECK_EXPR(SUP_IOCTL_CALL_VMMR0_BIG, pVMMReq->u32Magic == SUPVMMR0REQHDR_MAGIC);
1774	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0_BIG, SUP_IOCTL_CALL_VMMR0_BIG_SIZE_IN(pVMMReq->cbReq), SUP_IOCTL_CALL_VMMR0_BIG_SIZE_OUT(pVMMReq->cbReq));
1775
1776	/* execute */
1777	if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1778	pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1779	else
1780	pReq->Hdr.rc = VERR_WRONG_ORDER;
1781
1782	if ( RT_FAILURE(pReq->Hdr.rc)
1783	&& pReq->Hdr.rc != VERR_INTERRUPTED
1784	&& pReq->Hdr.rc != VERR_TIMEOUT)
1785	Log(("SUP_IOCTL_CALL_VMMR0_BIG: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1786	pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1787	else
1788	Log4(("SUP_IOCTL_CALL_VMMR0_BIG: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1789	pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1790	return 0;
1791	}
1792
1793	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GET_PAGING_MODE):
1794	{
1795	/* validate */
1796	PSUPGETPAGINGMODE pReq = (PSUPGETPAGINGMODE)pReqHdr;
1797	REQ_CHECK_SIZES(SUP_IOCTL_GET_PAGING_MODE);
1798
1799	/* execute */
1800	pReq->Hdr.rc = VINF_SUCCESS;
1801	pReq->u.Out.enmMode = SUPR0GetPagingMode();
1802	return 0;
1803	}
1804
1805	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_ALLOC):
1806	{
1807	/* validate */
1808	PSUPLOWALLOC pReq = (PSUPLOWALLOC)pReqHdr;
1809	REQ_CHECK_EXPR(SUP_IOCTL_LOW_ALLOC, pReq->Hdr.cbIn <= SUP_IOCTL_LOW_ALLOC_SIZE_IN);
1810	REQ_CHECK_SIZES_EX(SUP_IOCTL_LOW_ALLOC, SUP_IOCTL_LOW_ALLOC_SIZE_IN, SUP_IOCTL_LOW_ALLOC_SIZE_OUT(pReq->u.In.cPages));
1811
1812	/* execute */
1813	pReq->Hdr.rc = SUPR0LowAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.aPages[0]);
1814	if (RT_FAILURE(pReq->Hdr.rc))
1815	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1816	return 0;
1817	}
1818
1819	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_FREE):
1820	{
1821	/* validate */
1822	PSUPLOWFREE pReq = (PSUPLOWFREE)pReqHdr;
1823	REQ_CHECK_SIZES(SUP_IOCTL_LOW_FREE);
1824
1825	/* execute */
1826	pReq->Hdr.rc = SUPR0LowFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1827	return 0;
1828	}
1829
1830	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_MAP):
1831	{
1832	/* validate */
1833	PSUPGIPMAP pReq = (PSUPGIPMAP)pReqHdr;
1834	REQ_CHECK_SIZES(SUP_IOCTL_GIP_MAP);
1835
1836	/* execute */
1837	pReq->Hdr.rc = SUPR0GipMap(pSession, &pReq->u.Out.pGipR3, &pReq->u.Out.HCPhysGip);
1838	if (RT_SUCCESS(pReq->Hdr.rc))
1839	pReq->u.Out.pGipR0 = pDevExt->pGip;
1840	return 0;
1841	}
1842
1843	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_UNMAP):
1844	{
1845	/* validate */
1846	PSUPGIPUNMAP pReq = (PSUPGIPUNMAP)pReqHdr;
1847	REQ_CHECK_SIZES(SUP_IOCTL_GIP_UNMAP);
1848
1849	/* execute */
1850	pReq->Hdr.rc = SUPR0GipUnmap(pSession);
1851	return 0;
1852	}
1853
1854	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SET_VM_FOR_FAST):
1855	{
1856	/* validate */
1857	PSUPSETVMFORFAST pReq = (PSUPSETVMFORFAST)pReqHdr;
1858	REQ_CHECK_SIZES(SUP_IOCTL_SET_VM_FOR_FAST);
1859	REQ_CHECK_EXPR_FMT( !pReq->u.In.pVMR0
1860	\|\| ( VALID_PTR(pReq->u.In.pVMR0)
1861	&& !((uintptr_t)pReq->u.In.pVMR0 & (PAGE_SIZE - 1))),
1862	("SUP_IOCTL_SET_VM_FOR_FAST: pVMR0=%p!\n", pReq->u.In.pVMR0));
1863	/* execute */
1864	pSession->pVM = pReq->u.In.pVMR0;
1865	pReq->Hdr.rc = VINF_SUCCESS;
1866	return 0;
1867	}
1868
1869	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_ALLOC_EX):
1870	{
1871	/* validate */
1872	PSUPPAGEALLOCEX pReq = (PSUPPAGEALLOCEX)pReqHdr;
1873	REQ_CHECK_EXPR(SUP_IOCTL_PAGE_ALLOC_EX, pReq->Hdr.cbIn <= SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN);
1874	REQ_CHECK_SIZES_EX(SUP_IOCTL_PAGE_ALLOC_EX, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_OUT(pReq->u.In.cPages));
1875	REQ_CHECK_EXPR_FMT(pReq->u.In.fKernelMapping \|\| pReq->u.In.fUserMapping,
1876	("SUP_IOCTL_PAGE_ALLOC_EX: No mapping requested!\n"));
1877	REQ_CHECK_EXPR_FMT(pReq->u.In.fUserMapping,
1878	("SUP_IOCTL_PAGE_ALLOC_EX: Must have user mapping!\n"));
1879	REQ_CHECK_EXPR_FMT(!pReq->u.In.fReserved0 && !pReq->u.In.fReserved1,
1880	("SUP_IOCTL_PAGE_ALLOC_EX: fReserved0=%d fReserved1=%d\n", pReq->u.In.fReserved0, pReq->u.In.fReserved1));
1881
1882	/* execute */
1883	pReq->Hdr.rc = SUPR0PageAllocEx(pSession, pReq->u.In.cPages, 0 /* fFlags */,
1884	pReq->u.In.fUserMapping ? &pReq->u.Out.pvR3 : NULL,
1885	pReq->u.In.fKernelMapping ? &pReq->u.Out.pvR0 : NULL,
1886	&pReq->u.Out.aPages[0]);
1887	if (RT_FAILURE(pReq->Hdr.rc))
1888	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1889	return 0;
1890	}
1891
1892	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_MAP_KERNEL):
1893	{
1894	/* validate */
1895	PSUPPAGEMAPKERNEL pReq = (PSUPPAGEMAPKERNEL)pReqHdr;
1896	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_MAP_KERNEL);
1897	REQ_CHECK_EXPR_FMT(!pReq->u.In.fFlags, ("SUP_IOCTL_PAGE_MAP_KERNEL: fFlags=%#x! MBZ\n", pReq->u.In.fFlags));
1898	REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_MAP_KERNEL: offSub=%#x\n", pReq->u.In.offSub));
1899	REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
1900	("SUP_IOCTL_PAGE_MAP_KERNEL: cbSub=%#x\n", pReq->u.In.cbSub));
1901
1902	/* execute */
1903	pReq->Hdr.rc = SUPR0PageMapKernel(pSession, pReq->u.In.pvR3, pReq->u.In.offSub, pReq->u.In.cbSub,
1904	pReq->u.In.fFlags, &pReq->u.Out.pvR0);
1905	if (RT_FAILURE(pReq->Hdr.rc))
1906	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1907	return 0;
1908	}
1909
1910	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_PROTECT):
1911	{
1912	/* validate */
1913	PSUPPAGEPROTECT pReq = (PSUPPAGEPROTECT)pReqHdr;
1914	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_PROTECT);
1915	REQ_CHECK_EXPR_FMT(!(pReq->u.In.fProt & ~(RTMEM_PROT_READ \| RTMEM_PROT_WRITE \| RTMEM_PROT_EXEC \| RTMEM_PROT_NONE)),
1916	("SUP_IOCTL_PAGE_PROTECT: fProt=%#x!\n", pReq->u.In.fProt));
1917	REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_PROTECT: offSub=%#x\n", pReq->u.In.offSub));
1918	REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
1919	("SUP_IOCTL_PAGE_PROTECT: cbSub=%#x\n", pReq->u.In.cbSub));
1920
1921	/* execute */
1922	pReq->Hdr.rc = SUPR0PageProtect(pSession, pReq->u.In.pvR3, pReq->u.In.pvR0, pReq->u.In.offSub, pReq->u.In.cbSub, pReq->u.In.fProt);
1923	return 0;
1924	}
1925
1926	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_FREE):
1927	{
1928	/* validate */
1929	PSUPPAGEFREE pReq = (PSUPPAGEFREE)pReqHdr;
1930	REQ_CHECK_SIZES(SUP_IOCTL_PAGE_FREE);
1931
1932	/* execute */
1933	pReq->Hdr.rc = SUPR0PageFree(pSession, pReq->u.In.pvR3);
1934	return 0;
1935	}
1936
1937	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_SERVICE_NO_SIZE()):
1938	{
1939	/* validate */
1940	PSUPCALLSERVICE pReq = (PSUPCALLSERVICE)pReqHdr;
1941	Log4(("SUP_IOCTL_CALL_SERVICE: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1942	pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1943
1944	if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
1945	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(0), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(0));
1946	else
1947	{
1948	PSUPR0SERVICEREQHDR pSrvReq = (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0];
1949	REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR)),
1950	("SUP_IOCTL_CALL_SERVICE: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR))));
1951	REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, pSrvReq->u32Magic == SUPR0SERVICEREQHDR_MAGIC);
1952	REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(pSrvReq->cbReq), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(pSrvReq->cbReq));
1953	}
1954	REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, RTStrEnd(pReq->u.In.szName, sizeof(pReq->u.In.szName)));
1955
1956	/* execute */
1957	pReq->Hdr.rc = supdrvIOCtl_CallServiceModule(pDevExt, pSession, pReq);
1958	return 0;
1959	}
1960
1961	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOGGER_SETTINGS_NO_SIZE()):
1962	{
1963	/* validate */
1964	PSUPLOGGERSETTINGS pReq = (PSUPLOGGERSETTINGS)pReqHdr;
1965	size_t cbStrTab;
1966	REQ_CHECK_SIZE_OUT(SUP_IOCTL_LOGGER_SETTINGS, SUP_IOCTL_LOGGER_SETTINGS_SIZE_OUT);
1967	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->Hdr.cbIn >= SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(1));
1968	cbStrTab = pReq->Hdr.cbIn - SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(0);
1969	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offGroups < cbStrTab);
1970	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offFlags < cbStrTab);
1971	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offDestination < cbStrTab);
1972	REQ_CHECK_EXPR_FMT(pReq->u.In.szStrings[cbStrTab - 1] == '\0',
1973	("SUP_IOCTL_LOGGER_SETTINGS: cbIn=%#x cbStrTab=%#zx LastChar=%d\n",
1974	pReq->Hdr.cbIn, cbStrTab, pReq->u.In.szStrings[cbStrTab - 1]));
1975	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhich <= SUPLOGGERSETTINGS_WHICH_RELEASE);
1976	REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhat <= SUPLOGGERSETTINGS_WHAT_DESTROY);
1977
1978	/* execute */
1979	pReq->Hdr.rc = supdrvIOCtl_LoggerSettings(pDevExt, pSession, pReq);
1980	return 0;
1981	}
1982
1983	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_OP2):
1984	{
1985	/* validate */
1986	PSUPSEMOP2 pReq = (PSUPSEMOP2)pReqHdr;
1987	REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_OP2, SUP_IOCTL_SEM_OP2_SIZE_IN, SUP_IOCTL_SEM_OP2_SIZE_OUT);
1988	REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP2, pReq->u.In.uReserved == 0);
1989
1990	/* execute */
1991	switch (pReq->u.In.uType)
1992	{
1993	case SUP_SEM_TYPE_EVENT:
1994	{
1995	SUPSEMEVENT hEvent = (SUPSEMEVENT)(uintptr_t)pReq->u.In.hSem;
1996	switch (pReq->u.In.uOp)
1997	{
1998	case SUPSEMOP2_WAIT_MS_REL:
1999	pReq->Hdr.rc = SUPSemEventWaitNoResume(pSession, hEvent, pReq->u.In.uArg.cRelMsTimeout);
2000	break;
2001	case SUPSEMOP2_WAIT_NS_ABS:
2002	pReq->Hdr.rc = SUPSemEventWaitNsAbsIntr(pSession, hEvent, pReq->u.In.uArg.uAbsNsTimeout);
2003	break;
2004	case SUPSEMOP2_WAIT_NS_REL:
2005	pReq->Hdr.rc = SUPSemEventWaitNsRelIntr(pSession, hEvent, pReq->u.In.uArg.cRelNsTimeout);
2006	break;
2007	case SUPSEMOP2_SIGNAL:
2008	pReq->Hdr.rc = SUPSemEventSignal(pSession, hEvent);
2009	break;
2010	case SUPSEMOP2_CLOSE:
2011	pReq->Hdr.rc = SUPSemEventClose(pSession, hEvent);
2012	break;
2013	case SUPSEMOP2_RESET:
2014	default:
2015	pReq->Hdr.rc = VERR_INVALID_FUNCTION;
2016	break;
2017	}
2018	break;
2019	}
2020
2021	case SUP_SEM_TYPE_EVENT_MULTI:
2022	{
2023	SUPSEMEVENTMULTI hEventMulti = (SUPSEMEVENTMULTI)(uintptr_t)pReq->u.In.hSem;
2024	switch (pReq->u.In.uOp)
2025	{
2026	case SUPSEMOP2_WAIT_MS_REL:
2027	pReq->Hdr.rc = SUPSemEventMultiWaitNoResume(pSession, hEventMulti, pReq->u.In.uArg.cRelMsTimeout);
2028	break;
2029	case SUPSEMOP2_WAIT_NS_ABS:
2030	pReq->Hdr.rc = SUPSemEventMultiWaitNsAbsIntr(pSession, hEventMulti, pReq->u.In.uArg.uAbsNsTimeout);
2031	break;
2032	case SUPSEMOP2_WAIT_NS_REL:
2033	pReq->Hdr.rc = SUPSemEventMultiWaitNsRelIntr(pSession, hEventMulti, pReq->u.In.uArg.cRelNsTimeout);
2034	break;
2035	case SUPSEMOP2_SIGNAL:
2036	pReq->Hdr.rc = SUPSemEventMultiSignal(pSession, hEventMulti);
2037	break;
2038	case SUPSEMOP2_CLOSE:
2039	pReq->Hdr.rc = SUPSemEventMultiClose(pSession, hEventMulti);
2040	break;
2041	case SUPSEMOP2_RESET:
2042	pReq->Hdr.rc = SUPSemEventMultiReset(pSession, hEventMulti);
2043	break;
2044	default:
2045	pReq->Hdr.rc = VERR_INVALID_FUNCTION;
2046	break;
2047	}
2048	break;
2049	}
2050
2051	default:
2052	pReq->Hdr.rc = VERR_INVALID_PARAMETER;
2053	break;
2054	}
2055	return 0;
2056	}
2057
2058	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_OP3):
2059	{
2060	/* validate */
2061	PSUPSEMOP3 pReq = (PSUPSEMOP3)pReqHdr;
2062	REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_OP3, SUP_IOCTL_SEM_OP3_SIZE_IN, SUP_IOCTL_SEM_OP3_SIZE_OUT);
2063	REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, pReq->u.In.u32Reserved == 0 && pReq->u.In.u64Reserved == 0);
2064
2065	/* execute */
2066	switch (pReq->u.In.uType)
2067	{
2068	case SUP_SEM_TYPE_EVENT:
2069	{
2070	SUPSEMEVENT hEvent = (SUPSEMEVENT)(uintptr_t)pReq->u.In.hSem;
2071	switch (pReq->u.In.uOp)
2072	{
2073	case SUPSEMOP3_CREATE:
2074	REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, hEvent == NIL_SUPSEMEVENT);
2075	pReq->Hdr.rc = SUPSemEventCreate(pSession, &hEvent);
2076	pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEvent;
2077	break;
2078	case SUPSEMOP3_GET_RESOLUTION:
2079	REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, hEvent == NIL_SUPSEMEVENT);
2080	pReq->Hdr.rc = VINF_SUCCESS;
2081	pReq->Hdr.cbOut = sizeof(*pReq);
2082	pReq->u.Out.cNsResolution = SUPSemEventGetResolution(pSession);
2083	break;
2084	default:
2085	pReq->Hdr.rc = VERR_INVALID_FUNCTION;
2086	break;
2087	}
2088	break;
2089	}
2090
2091	case SUP_SEM_TYPE_EVENT_MULTI:
2092	{
2093	SUPSEMEVENTMULTI hEventMulti = (SUPSEMEVENTMULTI)(uintptr_t)pReq->u.In.hSem;
2094	switch (pReq->u.In.uOp)
2095	{
2096	case SUPSEMOP3_CREATE:
2097	REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, hEventMulti == NIL_SUPSEMEVENTMULTI);
2098	pReq->Hdr.rc = SUPSemEventMultiCreate(pSession, &hEventMulti);
2099	pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEventMulti;
2100	break;
2101	case SUPSEMOP3_GET_RESOLUTION:
2102	REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, hEventMulti == NIL_SUPSEMEVENTMULTI);
2103	pReq->Hdr.rc = VINF_SUCCESS;
2104	pReq->u.Out.cNsResolution = SUPSemEventMultiGetResolution(pSession);
2105	break;
2106	default:
2107	pReq->Hdr.rc = VERR_INVALID_FUNCTION;
2108	break;
2109	}
2110	break;
2111	}
2112
2113	default:
2114	pReq->Hdr.rc = VERR_INVALID_PARAMETER;
2115	break;
2116	}
2117	return 0;
2118	}
2119
2120	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_VT_CAPS):
2121	{
2122	/* validate */
2123	PSUPVTCAPS pReq = (PSUPVTCAPS)pReqHdr;
2124	REQ_CHECK_SIZES(SUP_IOCTL_VT_CAPS);
2125
2126	/* execute */
2127	pReq->Hdr.rc = SUPR0QueryVTCaps(pSession, &pReq->u.Out.Caps);
2128	if (RT_FAILURE(pReq->Hdr.rc))
2129	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
2130	return 0;
2131	}
2132
2133	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TRACER_OPEN):
2134	{
2135	/* validate */
2136	PSUPTRACEROPEN pReq = (PSUPTRACEROPEN)pReqHdr;
2137	REQ_CHECK_SIZES(SUP_IOCTL_TRACER_OPEN);
2138
2139	/* execute */
2140	pReq->Hdr.rc = supdrvIOCtl_TracerOpen(pDevExt, pSession, pReq->u.In.uCookie, pReq->u.In.uArg);
2141	return 0;
2142	}
2143
2144	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TRACER_CLOSE):
2145	{
2146	/* validate */
2147	REQ_CHECK_SIZES(SUP_IOCTL_TRACER_CLOSE);
2148
2149	/* execute */
2150	pReqHdr->rc = supdrvIOCtl_TracerClose(pDevExt, pSession);
2151	return 0;
2152	}
2153
2154	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TRACER_IOCTL):
2155	{
2156	/* validate */
2157	PSUPTRACERIOCTL pReq = (PSUPTRACERIOCTL)pReqHdr;
2158	REQ_CHECK_SIZES(SUP_IOCTL_TRACER_IOCTL);
2159
2160	/* execute */
2161	pReqHdr->rc = supdrvIOCtl_TracerIOCtl(pDevExt, pSession, pReq->u.In.uCmd, pReq->u.In.uArg, &pReq->u.Out.iRetVal);
2162	return 0;
2163	}
2164
2165	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TRACER_UMOD_REG):
2166	{
2167	/* validate */
2168	PSUPTRACERUMODREG pReq = (PSUPTRACERUMODREG)pReqHdr;
2169	REQ_CHECK_SIZES(SUP_IOCTL_TRACER_UMOD_REG);
2170	if (!RTStrEnd(pReq->u.In.szName, sizeof(pReq->u.In.szName)))
2171	return VERR_INVALID_PARAMETER;
2172
2173	/* execute */
2174	pReqHdr->rc = supdrvIOCtl_TracerUmodRegister(pDevExt, pSession,
2175	pReq->u.In.R3PtrVtgHdr, pReq->u.In.uVtgHdrAddr,
2176	pReq->u.In.R3PtrStrTab, pReq->u.In.cbStrTab,
2177	pReq->u.In.szName, pReq->u.In.fFlags);
2178	return 0;
2179	}
2180
2181	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TRACER_UMOD_DEREG):
2182	{
2183	/* validate */
2184	PSUPTRACERUMODDEREG pReq = (PSUPTRACERUMODDEREG)pReqHdr;
2185	REQ_CHECK_SIZES(SUP_IOCTL_TRACER_UMOD_DEREG);
2186
2187	/* execute */
2188	pReqHdr->rc = supdrvIOCtl_TracerUmodDeregister(pDevExt, pSession, pReq->u.In.pVtgHdr);
2189	return 0;
2190	}
2191
2192	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TRACER_UMOD_FIRE_PROBE):
2193	{
2194	/* validate */
2195	PSUPTRACERUMODFIREPROBE pReq = (PSUPTRACERUMODFIREPROBE)pReqHdr;
2196	REQ_CHECK_SIZES(SUP_IOCTL_TRACER_UMOD_FIRE_PROBE);
2197
2198	supdrvIOCtl_TracerUmodProbeFire(pDevExt, pSession, &pReq->u.In);
2199	pReqHdr->rc = VINF_SUCCESS;
2200	return 0;
2201	}
2202
2203	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_MSR_PROBER):
2204	{
2205	/* validate */
2206	PSUPMSRPROBER pReq = (PSUPMSRPROBER)pReqHdr;
2207	REQ_CHECK_SIZES(SUP_IOCTL_MSR_PROBER);
2208	REQ_CHECK_EXPR(SUP_IOCTL_MSR_PROBER,
2209	pReq->u.In.enmOp > SUPMSRPROBEROP_INVALID && pReq->u.In.enmOp < SUPMSRPROBEROP_END);
2210
2211	pReqHdr->rc = supdrvIOCtl_MsrProber(pDevExt, pReq);
2212	return 0;
2213	}
2214
2215	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_RESUME_SUSPENDED_KBDS):
2216	{
2217	/* validate */
2218	REQ_CHECK_SIZES(SUP_IOCTL_RESUME_SUSPENDED_KBDS);
2219
2220	pReqHdr->rc = supdrvIOCtl_ResumeSuspendedKbds();
2221	return 0;
2222	}
2223
2224	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TSC_DELTA_MEASURE):
2225	{
2226	/* validate */
2227	PSUPTSCDELTAMEASURE pReq = (PSUPTSCDELTAMEASURE)pReqHdr;
2228	REQ_CHECK_SIZES(SUP_IOCTL_TSC_DELTA_MEASURE);
2229
2230	pReqHdr->rc = supdrvIOCtl_TscDeltaMeasure(pDevExt, pSession, pReq);
2231	return 0;
2232	}
2233
2234	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TSC_READ):
2235	{
2236	/* validate */
2237	PSUPTSCREAD pReq = (PSUPTSCREAD)pReqHdr;
2238	REQ_CHECK_SIZES(SUP_IOCTL_TSC_READ);
2239
2240	pReqHdr->rc = supdrvIOCtl_TscRead(pDevExt, pSession, pReq);
2241	return 0;
2242	}
2243
2244	default:
2245	Log(("Unknown IOCTL %#lx\n", (long)uIOCtl));
2246	break;
2247	}
2248	return VERR_GENERAL_FAILURE;
2249	}
2250
2251
2252	/**
2253	* I/O Control inner worker for the restricted operations.
2254	*
2255	* @returns IPRT status code.
2256	* @retval VERR_INVALID_PARAMETER if the request is invalid.
2257	*
2258	* @param uIOCtl Function number.
2259	* @param pDevExt Device extention.
2260	* @param pSession Session data.
2261	* @param pReqHdr The request header.
2262	*/
2263	static int supdrvIOCtlInnerRestricted(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPREQHDR pReqHdr)
2264	{
2265	/*
2266	* The switch.
2267	*/
2268	switch (SUP_CTL_CODE_NO_SIZE(uIOCtl))
2269	{
2270	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_COOKIE):
2271	{
2272	PSUPCOOKIE pReq = (PSUPCOOKIE)pReqHdr;
2273	REQ_CHECK_SIZES(SUP_IOCTL_COOKIE);
2274	if (strncmp(pReq->u.In.szMagic, SUPCOOKIE_MAGIC, sizeof(pReq->u.In.szMagic)))
2275	{
2276	OSDBGPRINT(("SUP_IOCTL_COOKIE: invalid magic %.16s\n", pReq->u.In.szMagic));
2277	pReq->Hdr.rc = VERR_INVALID_MAGIC;
2278	return 0;
2279	}
2280
2281	/*
2282	* Match the version.
2283	* The current logic is very simple, match the major interface version.
2284	*/
2285	if ( pReq->u.In.u32MinVersion > SUPDRV_IOC_VERSION
2286	\|\| (pReq->u.In.u32MinVersion & 0xffff0000) != (SUPDRV_IOC_VERSION & 0xffff0000))
2287	{
2288	OSDBGPRINT(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
2289	pReq->u.In.u32ReqVersion, pReq->u.In.u32MinVersion, SUPDRV_IOC_VERSION));
2290	pReq->u.Out.u32Cookie = 0xffffffff;
2291	pReq->u.Out.u32SessionCookie = 0xffffffff;
2292	pReq->u.Out.u32SessionVersion = 0xffffffff;
2293	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
2294	pReq->u.Out.pSession = NULL;
2295	pReq->u.Out.cFunctions = 0;
2296	pReq->Hdr.rc = VERR_VERSION_MISMATCH;
2297	return 0;
2298	}
2299
2300	/*
2301	* Fill in return data and be gone.
2302	* N.B. The first one to change SUPDRV_IOC_VERSION shall makes sure that
2303	* u32SessionVersion <= u32ReqVersion!
2304	*/
2305	/** @todo Somehow validate the client and negotiate a secure cookie... */
2306	pReq->u.Out.u32Cookie = pDevExt->u32Cookie;
2307	pReq->u.Out.u32SessionCookie = pSession->u32Cookie;
2308	pReq->u.Out.u32SessionVersion = SUPDRV_IOC_VERSION;
2309	pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
2310	pReq->u.Out.pSession = pSession;
2311	pReq->u.Out.cFunctions = 0;
2312	pReq->Hdr.rc = VINF_SUCCESS;
2313	return 0;
2314	}
2315
2316	case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_VT_CAPS):
2317	{
2318	/* validate */
2319	PSUPVTCAPS pReq = (PSUPVTCAPS)pReqHdr;
2320	REQ_CHECK_SIZES(SUP_IOCTL_VT_CAPS);
2321
2322	/* execute */
2323	pReq->Hdr.rc = SUPR0QueryVTCaps(pSession, &pReq->u.Out.Caps);
2324	if (RT_FAILURE(pReq->Hdr.rc))
2325	pReq->Hdr.cbOut = sizeof(pReq->Hdr);
2326	return 0;
2327	}
2328
2329	default:
2330	Log(("Unknown IOCTL %#lx\n", (long)uIOCtl));
2331	break;
2332	}
2333	return VERR_GENERAL_FAILURE;
2334	}
2335
2336
2337	/**
2338	* I/O Control worker.
2339	*
2340	* @returns IPRT status code.
2341	* @retval VERR_INVALID_PARAMETER if the request is invalid.
2342	*
2343	* @param uIOCtl Function number.
2344	* @param pDevExt Device extention.
2345	* @param pSession Session data.
2346	* @param pReqHdr The request header.
2347	*/
2348	int VBOXCALL supdrvIOCtl(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPREQHDR pReqHdr, size_t cbReq)
2349	{
2350	int rc;
2351	VBOXDRV_IOCTL_ENTRY(pSession, uIOCtl, pReqHdr);
2352
2353	/*
2354	* Validate the request.
2355	*/
2356	if (RT_UNLIKELY(cbReq < sizeof(*pReqHdr)))
2357	{
2358	OSDBGPRINT(("vboxdrv: Bad ioctl request size; cbReq=%#lx\n", (long)cbReq));
2359	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
2360	return VERR_INVALID_PARAMETER;
2361	}
2362	if (RT_UNLIKELY( (pReqHdr->fFlags & SUPREQHDR_FLAGS_MAGIC_MASK) != SUPREQHDR_FLAGS_MAGIC
2363	\|\| pReqHdr->cbIn < sizeof(*pReqHdr)
2364	\|\| pReqHdr->cbIn > cbReq
2365	\|\| pReqHdr->cbOut < sizeof(*pReqHdr)
2366	\|\| pReqHdr->cbOut > cbReq))
2367	{
2368	OSDBGPRINT(("vboxdrv: Bad ioctl request header; cbIn=%#lx cbOut=%#lx fFlags=%#lx\n",
2369	(long)pReqHdr->cbIn, (long)pReqHdr->cbOut, (long)pReqHdr->fFlags));
2370	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
2371	return VERR_INVALID_PARAMETER;
2372	}
2373	if (RT_UNLIKELY(!RT_VALID_PTR(pSession)))
2374	{
2375	OSDBGPRINT(("vboxdrv: Invalid pSession value %p (ioctl=%p)\n", pSession, (void *)uIOCtl));
2376	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
2377	return VERR_INVALID_PARAMETER;
2378	}
2379	if (RT_UNLIKELY(uIOCtl == SUP_IOCTL_COOKIE))
2380	{
2381	if (pReqHdr->u32Cookie != SUPCOOKIE_INITIAL_COOKIE)
2382	{
2383	OSDBGPRINT(("SUP_IOCTL_COOKIE: bad cookie %#lx\n", (long)pReqHdr->u32Cookie));
2384	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
2385	return VERR_INVALID_PARAMETER;
2386	}
2387	}
2388	else if (RT_UNLIKELY( pReqHdr->u32Cookie != pDevExt->u32Cookie
2389	\|\| pReqHdr->u32SessionCookie != pSession->u32Cookie))
2390	{
2391	OSDBGPRINT(("vboxdrv: bad cookie %#lx / %#lx.\n", (long)pReqHdr->u32Cookie, (long)pReqHdr->u32SessionCookie));
2392	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
2393	return VERR_INVALID_PARAMETER;
2394	}
2395
2396	/*
2397	* Hand it to an inner function to avoid lots of unnecessary return tracepoints.
2398	*/
2399	if (pSession->fUnrestricted)
2400	rc = supdrvIOCtlInnerUnrestricted(uIOCtl, pDevExt, pSession, pReqHdr);
2401	else
2402	rc = supdrvIOCtlInnerRestricted(uIOCtl, pDevExt, pSession, pReqHdr);
2403
2404	VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, pReqHdr->rc, rc);
2405	return rc;
2406	}
2407
2408
2409	/**
2410	* Inter-Driver Communication (IDC) worker.
2411	*
2412	* @returns VBox status code.
2413	* @retval VINF_SUCCESS on success.
2414	* @retval VERR_INVALID_PARAMETER if the request is invalid.
2415	* @retval VERR_NOT_SUPPORTED if the request isn't supported.
2416	*
2417	* @param uReq The request (function) code.
2418	* @param pDevExt Device extention.
2419	* @param pSession Session data.
2420	* @param pReqHdr The request header.
2421	*/
2422	int VBOXCALL supdrvIDC(uintptr_t uReq, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQHDR pReqHdr)
2423	{
2424	/*
2425	* The OS specific code has already validated the pSession
2426	* pointer, and the request size being greater or equal to
2427	* size of the header.
2428	*
2429	* So, just check that pSession is a kernel context session.
2430	*/
2431	if (RT_UNLIKELY( pSession
2432	&& pSession->R0Process != NIL_RTR0PROCESS))
2433	return VERR_INVALID_PARAMETER;
2434
2435	/*
2436	* Validation macro.
2437	*/
2438	#define REQ_CHECK_IDC_SIZE(Name, cbExpect) \
2439	do { \
2440	if (RT_UNLIKELY(pReqHdr->cb != (cbExpect))) \
2441	{ \
2442	OSDBGPRINT(( #Name ": Invalid input/output sizes. cb=%ld expected %ld.\n", \
2443	(long)pReqHdr->cb, (long)(cbExpect))); \
2444	return pReqHdr->rc = VERR_INVALID_PARAMETER; \
2445	} \
2446	} while (0)
2447
2448	switch (uReq)
2449	{
2450	case SUPDRV_IDC_REQ_CONNECT:
2451	{
2452	PSUPDRVIDCREQCONNECT pReq = (PSUPDRVIDCREQCONNECT)pReqHdr;
2453	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_CONNECT, sizeof(*pReq));
2454
2455	/*
2456	* Validate the cookie and other input.
2457	*/
2458	if (pReq->Hdr.pSession != NULL)
2459	{
2460	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: Hdr.pSession=%p expected NULL!\n", pReq->Hdr.pSession));
2461	return pReqHdr->rc = VERR_INVALID_PARAMETER;
2462	}
2463	if (pReq->u.In.u32MagicCookie != SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE)
2464	{
2465	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: u32MagicCookie=%#x expected %#x!\n",
2466	(unsigned)pReq->u.In.u32MagicCookie, (unsigned)SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE));
2467	return pReqHdr->rc = VERR_INVALID_PARAMETER;
2468	}
2469	if ( pReq->u.In.uMinVersion > pReq->u.In.uReqVersion
2470	\|\| (pReq->u.In.uMinVersion & UINT32_C(0xffff0000)) != (pReq->u.In.uReqVersion & UINT32_C(0xffff0000)))
2471	{
2472	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: uMinVersion=%#x uMaxVersion=%#x doesn't match!\n",
2473	pReq->u.In.uMinVersion, pReq->u.In.uReqVersion));
2474	return pReqHdr->rc = VERR_INVALID_PARAMETER;
2475	}
2476	if (pSession != NULL)
2477	{
2478	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: pSession=%p expected NULL!\n", pSession));
2479	return pReqHdr->rc = VERR_INVALID_PARAMETER;
2480	}
2481
2482	/*
2483	* Match the version.
2484	* The current logic is very simple, match the major interface version.
2485	*/
2486	if ( pReq->u.In.uMinVersion > SUPDRV_IDC_VERSION
2487	\|\| (pReq->u.In.uMinVersion & 0xffff0000) != (SUPDRV_IDC_VERSION & 0xffff0000))
2488	{
2489	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
2490	pReq->u.In.uReqVersion, pReq->u.In.uMinVersion, (unsigned)SUPDRV_IDC_VERSION));
2491	pReq->u.Out.pSession = NULL;
2492	pReq->u.Out.uSessionVersion = 0xffffffff;
2493	pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
2494	pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
2495	pReq->Hdr.rc = VERR_VERSION_MISMATCH;
2496	return VINF_SUCCESS;
2497	}
2498
2499	pReq->u.Out.pSession = NULL;
2500	pReq->u.Out.uSessionVersion = SUPDRV_IDC_VERSION;
2501	pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
2502	pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
2503
2504	pReq->Hdr.rc = supdrvCreateSession(pDevExt, false /* fUser /, true /fUnrestricted*/, &pSession);
2505	if (RT_FAILURE(pReq->Hdr.rc))
2506	{
2507	OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: failed to create session, rc=%d\n", pReq->Hdr.rc));
2508	return VINF_SUCCESS;
2509	}
2510
2511	pReq->u.Out.pSession = pSession;
2512	pReq->Hdr.pSession = pSession;
2513
2514	return VINF_SUCCESS;
2515	}
2516
2517	case SUPDRV_IDC_REQ_DISCONNECT:
2518	{
2519	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_DISCONNECT, sizeof(*pReqHdr));
2520
2521	supdrvSessionRelease(pSession);
2522	return pReqHdr->rc = VINF_SUCCESS;
2523	}
2524
2525	case SUPDRV_IDC_REQ_GET_SYMBOL:
2526	{
2527	PSUPDRVIDCREQGETSYM pReq = (PSUPDRVIDCREQGETSYM)pReqHdr;
2528	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_GET_SYMBOL, sizeof(*pReq));
2529
2530	pReq->Hdr.rc = supdrvIDC_LdrGetSymbol(pDevExt, pSession, pReq);
2531	return VINF_SUCCESS;
2532	}
2533
2534	case SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY:
2535	{
2536	PSUPDRVIDCREQCOMPREGFACTORY pReq = (PSUPDRVIDCREQCOMPREGFACTORY)pReqHdr;
2537	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY, sizeof(*pReq));
2538
2539	pReq->Hdr.rc = SUPR0ComponentRegisterFactory(pSession, pReq->u.In.pFactory);
2540	return VINF_SUCCESS;
2541	}
2542
2543	case SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY:
2544	{
2545	PSUPDRVIDCREQCOMPDEREGFACTORY pReq = (PSUPDRVIDCREQCOMPDEREGFACTORY)pReqHdr;
2546	REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY, sizeof(*pReq));
2547
2548	pReq->Hdr.rc = SUPR0ComponentDeregisterFactory(pSession, pReq->u.In.pFactory);
2549	return VINF_SUCCESS;
2550	}
2551
2552	default:
2553	Log(("Unknown IDC %#lx\n", (long)uReq));
2554	break;
2555	}
2556
2557	#undef REQ_CHECK_IDC_SIZE
2558	return VERR_NOT_SUPPORTED;
2559	}
2560
2561
2562	/**
2563	* Register a object for reference counting.
2564	* The object is registered with one reference in the specified session.
2565	*
2566	* @returns Unique identifier on success (pointer).
2567	* All future reference must use this identifier.
2568	* @returns NULL on failure.
2569	* @param pfnDestructor The destructore function which will be called when the reference count reaches 0.
2570	* @param pvUser1 The first user argument.
2571	* @param pvUser2 The second user argument.
2572	*/
2573	SUPR0DECL(void ) SUPR0ObjRegister(PSUPDRVSESSION pSession, SUPDRVOBJTYPE enmType, PFNSUPDRVDESTRUCTOR pfnDestructor, void pvUser1, void *pvUser2)
2574	{
2575	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2576	PSUPDRVOBJ pObj;
2577	PSUPDRVUSAGE pUsage;
2578
2579	/*
2580	* Validate the input.
2581	*/
2582	AssertReturn(SUP_IS_SESSION_VALID(pSession), NULL);
2583	AssertReturn(enmType > SUPDRVOBJTYPE_INVALID && enmType < SUPDRVOBJTYPE_END, NULL);
2584	AssertPtrReturn(pfnDestructor, NULL);
2585
2586	/*
2587	* Allocate and initialize the object.
2588	*/
2589	pObj = (PSUPDRVOBJ)RTMemAlloc(sizeof(*pObj));
2590	if (!pObj)
2591	return NULL;
2592	pObj->u32Magic = SUPDRVOBJ_MAGIC;
2593	pObj->enmType = enmType;
2594	pObj->pNext = NULL;
2595	pObj->cUsage = 1;
2596	pObj->pfnDestructor = pfnDestructor;
2597	pObj->pvUser1 = pvUser1;
2598	pObj->pvUser2 = pvUser2;
2599	pObj->CreatorUid = pSession->Uid;
2600	pObj->CreatorGid = pSession->Gid;
2601	pObj->CreatorProcess= pSession->Process;
2602	supdrvOSObjInitCreator(pObj, pSession);
2603
2604	/*
2605	* Allocate the usage record.
2606	* (We keep freed usage records around to simplify SUPR0ObjAddRefEx().)
2607	*/
2608	RTSpinlockAcquire(pDevExt->Spinlock);
2609
2610	pUsage = pDevExt->pUsageFree;
2611	if (pUsage)
2612	pDevExt->pUsageFree = pUsage->pNext;
2613	else
2614	{
2615	RTSpinlockRelease(pDevExt->Spinlock);
2616	pUsage = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsage));
2617	if (!pUsage)
2618	{
2619	RTMemFree(pObj);
2620	return NULL;
2621	}
2622	RTSpinlockAcquire(pDevExt->Spinlock);
2623	}
2624
2625	/*
2626	* Insert the object and create the session usage record.
2627	*/
2628	/* The object. */
2629	pObj->pNext = pDevExt->pObjs;
2630	pDevExt->pObjs = pObj;
2631
2632	/* The session record. */
2633	pUsage->cUsage = 1;
2634	pUsage->pObj = pObj;
2635	pUsage->pNext = pSession->pUsage;
2636	/* Log2(("SUPR0ObjRegister: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext)); */
2637	pSession->pUsage = pUsage;
2638
2639	RTSpinlockRelease(pDevExt->Spinlock);
2640
2641	Log(("SUPR0ObjRegister: returns %p (pvUser1=%p, pvUser=%p)\n", pObj, pvUser1, pvUser2));
2642	return pObj;
2643	}
2644
2645
2646	/**
2647	* Increment the reference counter for the object associating the reference
2648	* with the specified session.
2649	*
2650	* @returns IPRT status code.
2651	* @param pvObj The identifier returned by SUPR0ObjRegister().
2652	* @param pSession The session which is referencing the object.
2653	*
2654	* @remarks The caller should not own any spinlocks and must carefully protect
2655	* itself against potential race with the destructor so freed memory
2656	* isn't accessed here.
2657	*/
2658	SUPR0DECL(int) SUPR0ObjAddRef(void *pvObj, PSUPDRVSESSION pSession)
2659	{
2660	return SUPR0ObjAddRefEx(pvObj, pSession, false /* fNoBlocking */);
2661	}
2662
2663
2664	/**
2665	* Increment the reference counter for the object associating the reference
2666	* with the specified session.
2667	*
2668	* @returns IPRT status code.
2669	* @retval VERR_TRY_AGAIN if fNoBlocking was set and a new usage record
2670	* couldn't be allocated. (If you see this you're not doing the right
2671	* thing and it won't ever work reliably.)
2672	*
2673	* @param pvObj The identifier returned by SUPR0ObjRegister().
2674	* @param pSession The session which is referencing the object.
2675	* @param fNoBlocking Set if it's not OK to block. Never try to make the
2676	* first reference to an object in a session with this
2677	* argument set.
2678	*
2679	* @remarks The caller should not own any spinlocks and must carefully protect
2680	* itself against potential race with the destructor so freed memory
2681	* isn't accessed here.
2682	*/
2683	SUPR0DECL(int) SUPR0ObjAddRefEx(void *pvObj, PSUPDRVSESSION pSession, bool fNoBlocking)
2684	{
2685	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2686	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2687	int rc = VINF_SUCCESS;
2688	PSUPDRVUSAGE pUsagePre;
2689	PSUPDRVUSAGE pUsage;
2690
2691	/*
2692	* Validate the input.
2693	* Be ready for the destruction race (someone might be stuck in the
2694	* destructor waiting a lock we own).
2695	*/
2696	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2697	AssertPtrReturn(pObj, VERR_INVALID_POINTER);
2698	AssertMsgReturn(pObj->u32Magic == SUPDRVOBJ_MAGIC \|\| pObj->u32Magic == SUPDRVOBJ_MAGIC_DEAD,
2699	("Invalid pvObj=%p magic=%#x (expected %#x or %#x)\n", pvObj, pObj->u32Magic, SUPDRVOBJ_MAGIC, SUPDRVOBJ_MAGIC_DEAD),
2700	VERR_INVALID_PARAMETER);
2701
2702	RTSpinlockAcquire(pDevExt->Spinlock);
2703
2704	if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
2705	{
2706	RTSpinlockRelease(pDevExt->Spinlock);
2707
2708	AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
2709	return VERR_WRONG_ORDER;
2710	}
2711
2712	/*
2713	* Preallocate the usage record if we can.
2714	*/
2715	pUsagePre = pDevExt->pUsageFree;
2716	if (pUsagePre)
2717	pDevExt->pUsageFree = pUsagePre->pNext;
2718	else if (!fNoBlocking)
2719	{
2720	RTSpinlockRelease(pDevExt->Spinlock);
2721	pUsagePre = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsagePre));
2722	if (!pUsagePre)
2723	return VERR_NO_MEMORY;
2724
2725	RTSpinlockAcquire(pDevExt->Spinlock);
2726	if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
2727	{
2728	RTSpinlockRelease(pDevExt->Spinlock);
2729
2730	AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
2731	return VERR_WRONG_ORDER;
2732	}
2733	}
2734
2735	/*
2736	* Reference the object.
2737	*/
2738	pObj->cUsage++;
2739
2740	/*
2741	* Look for the session record.
2742	*/
2743	for (pUsage = pSession->pUsage; pUsage; pUsage = pUsage->pNext)
2744	{
2745	/Log(("SUPR0AddRef: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));/
2746	if (pUsage->pObj == pObj)
2747	break;
2748	}
2749	if (pUsage)
2750	pUsage->cUsage++;
2751	else if (pUsagePre)
2752	{
2753	/* create a new session record. */
2754	pUsagePre->cUsage = 1;
2755	pUsagePre->pObj = pObj;
2756	pUsagePre->pNext = pSession->pUsage;
2757	pSession->pUsage = pUsagePre;
2758	/Log(("SUPR0AddRef: pUsagePre=%p:{.pObj=%p, .pNext=%p}\n", pUsagePre, pUsagePre->pObj, pUsagePre->pNext));/
2759
2760	pUsagePre = NULL;
2761	}
2762	else
2763	{
2764	pObj->cUsage--;
2765	rc = VERR_TRY_AGAIN;
2766	}
2767
2768	/*
2769	* Put any unused usage record into the free list..
2770	*/
2771	if (pUsagePre)
2772	{
2773	pUsagePre->pNext = pDevExt->pUsageFree;
2774	pDevExt->pUsageFree = pUsagePre;
2775	}
2776
2777	RTSpinlockRelease(pDevExt->Spinlock);
2778
2779	return rc;
2780	}
2781
2782
2783	/**
2784	* Decrement / destroy a reference counter record for an object.
2785	*
2786	* The object is uniquely identified by pfnDestructor+pvUser1+pvUser2.
2787	*
2788	* @returns IPRT status code.
2789	* @retval VINF_SUCCESS if not destroyed.
2790	* @retval VINF_OBJECT_DESTROYED if it's destroyed by this release call.
2791	* @retval VERR_INVALID_PARAMETER if the object isn't valid. Will assert in
2792	* string builds.
2793	*
2794	* @param pvObj The identifier returned by SUPR0ObjRegister().
2795	* @param pSession The session which is referencing the object.
2796	*/
2797	SUPR0DECL(int) SUPR0ObjRelease(void *pvObj, PSUPDRVSESSION pSession)
2798	{
2799	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2800	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2801	int rc = VERR_INVALID_PARAMETER;
2802	PSUPDRVUSAGE pUsage;
2803	PSUPDRVUSAGE pUsagePrev;
2804
2805	/*
2806	* Validate the input.
2807	*/
2808	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2809	AssertMsgReturn(VALID_PTR(pObj)&& pObj->u32Magic == SUPDRVOBJ_MAGIC,
2810	("Invalid pvObj=%p magic=%#x (expected %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
2811	VERR_INVALID_PARAMETER);
2812
2813	/*
2814	* Acquire the spinlock and look for the usage record.
2815	*/
2816	RTSpinlockAcquire(pDevExt->Spinlock);
2817
2818	for (pUsagePrev = NULL, pUsage = pSession->pUsage;
2819	pUsage;
2820	pUsagePrev = pUsage, pUsage = pUsage->pNext)
2821	{
2822	/Log2(("SUPR0ObjRelease: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));/
2823	if (pUsage->pObj == pObj)
2824	{
2825	rc = VINF_SUCCESS;
2826	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
2827	if (pUsage->cUsage > 1)
2828	{
2829	pObj->cUsage--;
2830	pUsage->cUsage--;
2831	}
2832	else
2833	{
2834	/*
2835	* Free the session record.
2836	*/
2837	if (pUsagePrev)
2838	pUsagePrev->pNext = pUsage->pNext;
2839	else
2840	pSession->pUsage = pUsage->pNext;
2841	pUsage->pNext = pDevExt->pUsageFree;
2842	pDevExt->pUsageFree = pUsage;
2843
2844	/* What about the object? */
2845	if (pObj->cUsage > 1)
2846	pObj->cUsage--;
2847	else
2848	{
2849	/*
2850	* Object is to be destroyed, unlink it.
2851	*/
2852	pObj->u32Magic = SUPDRVOBJ_MAGIC_DEAD;
2853	rc = VINF_OBJECT_DESTROYED;
2854	if (pDevExt->pObjs == pObj)
2855	pDevExt->pObjs = pObj->pNext;
2856	else
2857	{
2858	PSUPDRVOBJ pObjPrev;
2859	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
2860	if (pObjPrev->pNext == pObj)
2861	{
2862	pObjPrev->pNext = pObj->pNext;
2863	break;
2864	}
2865	Assert(pObjPrev);
2866	}
2867	}
2868	}
2869	break;
2870	}
2871	}
2872
2873	RTSpinlockRelease(pDevExt->Spinlock);
2874
2875	/*
2876	* Call the destructor and free the object if required.
2877	*/
2878	if (rc == VINF_OBJECT_DESTROYED)
2879	{
2880	Log(("SUPR0ObjRelease: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
2881	pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
2882	if (pObj->pfnDestructor)
2883	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
2884	RTMemFree(pObj);
2885	}
2886
2887	AssertMsg(pUsage, ("pvObj=%p\n", pvObj));
2888	return rc;
2889	}
2890
2891
2892	/**
2893	* Verifies that the current process can access the specified object.
2894	*
2895	* @returns The following IPRT status code:
2896	* @retval VINF_SUCCESS if access was granted.
2897	* @retval VERR_PERMISSION_DENIED if denied access.
2898	* @retval VERR_INVALID_PARAMETER if invalid parameter.
2899	*
2900	* @param pvObj The identifier returned by SUPR0ObjRegister().
2901	* @param pSession The session which wishes to access the object.
2902	* @param pszObjName Object string name. This is optional and depends on the object type.
2903	*
2904	* @remark The caller is responsible for making sure the object isn't removed while
2905	* we're inside this function. If uncertain about this, just call AddRef before calling us.
2906	*/
2907	SUPR0DECL(int) SUPR0ObjVerifyAccess(void pvObj, PSUPDRVSESSION pSession, const char pszObjName)
2908	{
2909	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2910	int rc;
2911
2912	/*
2913	* Validate the input.
2914	*/
2915	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2916	AssertMsgReturn(VALID_PTR(pObj) && pObj->u32Magic == SUPDRVOBJ_MAGIC,
2917	("Invalid pvObj=%p magic=%#x (exepcted %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
2918	VERR_INVALID_PARAMETER);
2919
2920	/*
2921	* Check access. (returns true if a decision has been made.)
2922	*/
2923	rc = VERR_INTERNAL_ERROR;
2924	if (supdrvOSObjCanAccess(pObj, pSession, pszObjName, &rc))
2925	return rc;
2926
2927	/*
2928	* Default policy is to allow the user to access his own
2929	* stuff but nothing else.
2930	*/
2931	if (pObj->CreatorUid == pSession->Uid)
2932	return VINF_SUCCESS;
2933	return VERR_PERMISSION_DENIED;
2934	}
2935
2936
2937	/**
2938	* Lock pages.
2939	*
2940	* @returns IPRT status code.
2941	* @param pSession Session to which the locked memory should be associated.
2942	* @param pvR3 Start of the memory range to lock.
2943	* This must be page aligned.
2944	* @param cPages Number of pages to lock.
2945	* @param paPages Where to put the physical addresses of locked memory.
2946	*/
2947	SUPR0DECL(int) SUPR0LockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t cPages, PRTHCPHYS paPages)
2948	{
2949	int rc;
2950	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2951	const size_t cb = (size_t)cPages << PAGE_SHIFT;
2952	LogFlow(("SUPR0LockMem: pSession=%p pvR3=%p cPages=%d paPages=%p\n", pSession, (void *)pvR3, cPages, paPages));
2953
2954	/*
2955	* Verify input.
2956	*/
2957	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2958	AssertPtrReturn(paPages, VERR_INVALID_PARAMETER);
2959	if ( RT_ALIGN_R3PT(pvR3, PAGE_SIZE, RTR3PTR) != pvR3
2960	\|\| !pvR3)
2961	{
2962	Log(("pvR3 (%p) must be page aligned and not NULL!\n", (void *)pvR3));
2963	return VERR_INVALID_PARAMETER;
2964	}
2965
2966	/*
2967	* Let IPRT do the job.
2968	*/
2969	Mem.eType = MEMREF_TYPE_LOCKED;
2970	rc = RTR0MemObjLockUser(&Mem.MemObj, pvR3, cb, RTMEM_PROT_READ \| RTMEM_PROT_WRITE, RTR0ProcHandleSelf());
2971	if (RT_SUCCESS(rc))
2972	{
2973	uint32_t iPage = cPages;
2974	AssertMsg(RTR0MemObjAddressR3(Mem.MemObj) == pvR3, ("%p == %p\n", RTR0MemObjAddressR3(Mem.MemObj), pvR3));
2975	AssertMsg(RTR0MemObjSize(Mem.MemObj) == cb, ("%x == %x\n", RTR0MemObjSize(Mem.MemObj), cb));
2976
2977	while (iPage-- > 0)
2978	{
2979	paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
2980	if (RT_UNLIKELY(paPages[iPage] == NIL_RTCCPHYS))
2981	{
2982	AssertMsgFailed(("iPage=%d\n", iPage));
2983	rc = VERR_INTERNAL_ERROR;
2984	break;
2985	}
2986	}
2987	if (RT_SUCCESS(rc))
2988	rc = supdrvMemAdd(&Mem, pSession);
2989	if (RT_FAILURE(rc))
2990	{
2991	int rc2 = RTR0MemObjFree(Mem.MemObj, false);
2992	AssertRC(rc2);
2993	}
2994	}
2995
2996	return rc;
2997	}
2998
2999
3000	/**
3001	* Unlocks the memory pointed to by pv.
3002	*
3003	* @returns IPRT status code.
3004	* @param pSession Session to which the memory was locked.
3005	* @param pvR3 Memory to unlock.
3006	*/
3007	SUPR0DECL(int) SUPR0UnlockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3)
3008	{
3009	LogFlow(("SUPR0UnlockMem: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
3010	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3011	return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_LOCKED);
3012	}
3013
3014
3015	/**
3016	* Allocates a chunk of page aligned memory with contiguous and fixed physical
3017	* backing.
3018	*
3019	* @returns IPRT status code.
3020	* @param pSession Session data.
3021	* @param cPages Number of pages to allocate.
3022	* @param ppvR0 Where to put the address of Ring-0 mapping the allocated memory.
3023	* @param ppvR3 Where to put the address of Ring-3 mapping the allocated memory.
3024	* @param pHCPhys Where to put the physical address of allocated memory.
3025	*/
3026	SUPR0DECL(int) SUPR0ContAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS pHCPhys)
3027	{
3028	int rc;
3029	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
3030	LogFlow(("SUPR0ContAlloc: pSession=%p cPages=%d ppvR0=%p ppvR3=%p pHCPhys=%p\n", pSession, cPages, ppvR0, ppvR3, pHCPhys));
3031
3032	/*
3033	* Validate input.
3034	*/
3035	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3036	if (!ppvR3 \|\| !ppvR0 \|\| !pHCPhys)
3037	{
3038	Log(("Null pointer. All of these should be set: pSession=%p ppvR0=%p ppvR3=%p pHCPhys=%p\n",
3039	pSession, ppvR0, ppvR3, pHCPhys));
3040	return VERR_INVALID_PARAMETER;
3041
3042	}
3043	if (cPages < 1 \|\| cPages >= 256)
3044	{
3045	Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
3046	return VERR_PAGE_COUNT_OUT_OF_RANGE;
3047	}
3048
3049	/*
3050	* Let IPRT do the job.
3051	*/
3052	rc = RTR0MemObjAllocCont(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable R0 mapping */);
3053	if (RT_SUCCESS(rc))
3054	{
3055	int rc2;
3056	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
3057	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
3058	if (RT_SUCCESS(rc))
3059	{
3060	Mem.eType = MEMREF_TYPE_CONT;
3061	rc = supdrvMemAdd(&Mem, pSession);
3062	if (!rc)
3063	{
3064	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
3065	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
3066	*pHCPhys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, 0);
3067	return 0;
3068	}
3069
3070	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
3071	AssertRC(rc2);
3072	}
3073	rc2 = RTR0MemObjFree(Mem.MemObj, false);
3074	AssertRC(rc2);
3075	}
3076
3077	return rc;
3078	}
3079
3080
3081	/**
3082	* Frees memory allocated using SUPR0ContAlloc().
3083	*
3084	* @returns IPRT status code.
3085	* @param pSession The session to which the memory was allocated.
3086	* @param uPtr Pointer to the memory (ring-3 or ring-0).
3087	*/
3088	SUPR0DECL(int) SUPR0ContFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
3089	{
3090	LogFlow(("SUPR0ContFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
3091	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3092	return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_CONT);
3093	}
3094
3095
3096	/**
3097	* Allocates a chunk of page aligned memory with fixed physical backing below 4GB.
3098	*
3099	* The memory isn't zeroed.
3100	*
3101	* @returns IPRT status code.
3102	* @param pSession Session data.
3103	* @param cPages Number of pages to allocate.
3104	* @param ppvR0 Where to put the address of Ring-0 mapping of the allocated memory.
3105	* @param ppvR3 Where to put the address of Ring-3 mapping of the allocated memory.
3106	* @param paPages Where to put the physical addresses of allocated memory.
3107	*/
3108	SUPR0DECL(int) SUPR0LowAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS paPages)
3109	{
3110	unsigned iPage;
3111	int rc;
3112	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
3113	LogFlow(("SUPR0LowAlloc: pSession=%p cPages=%d ppvR3=%p ppvR0=%p paPages=%p\n", pSession, cPages, ppvR3, ppvR0, paPages));
3114
3115	/*
3116	* Validate input.
3117	*/
3118	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3119	if (!ppvR3 \|\| !ppvR0 \|\| !paPages)
3120	{
3121	Log(("Null pointer. All of these should be set: pSession=%p ppvR3=%p ppvR0=%p paPages=%p\n",
3122	pSession, ppvR3, ppvR0, paPages));
3123	return VERR_INVALID_PARAMETER;
3124
3125	}
3126	if (cPages < 1 \|\| cPages >= 256)
3127	{
3128	Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
3129	return VERR_PAGE_COUNT_OUT_OF_RANGE;
3130	}
3131
3132	/*
3133	* Let IPRT do the work.
3134	*/
3135	rc = RTR0MemObjAllocLow(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable ring-0 mapping */);
3136	if (RT_SUCCESS(rc))
3137	{
3138	int rc2;
3139	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
3140	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
3141	if (RT_SUCCESS(rc))
3142	{
3143	Mem.eType = MEMREF_TYPE_LOW;
3144	rc = supdrvMemAdd(&Mem, pSession);
3145	if (!rc)
3146	{
3147	for (iPage = 0; iPage < cPages; iPage++)
3148	{
3149	paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
3150	AssertMsg(!(paPages[iPage] & (PAGE_SIZE - 1)), ("iPage=%d Phys=%RHp\n", paPages[iPage]));
3151	}
3152	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
3153	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
3154	return 0;
3155	}
3156
3157	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
3158	AssertRC(rc2);
3159	}
3160
3161	rc2 = RTR0MemObjFree(Mem.MemObj, false);
3162	AssertRC(rc2);
3163	}
3164
3165	return rc;
3166	}
3167
3168
3169	/**
3170	* Frees memory allocated using SUPR0LowAlloc().
3171	*
3172	* @returns IPRT status code.
3173	* @param pSession The session to which the memory was allocated.
3174	* @param uPtr Pointer to the memory (ring-3 or ring-0).
3175	*/
3176	SUPR0DECL(int) SUPR0LowFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
3177	{
3178	LogFlow(("SUPR0LowFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
3179	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3180	return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_LOW);
3181	}
3182
3183
3184
3185	/**
3186	* Allocates a chunk of memory with both R0 and R3 mappings.
3187	* The memory is fixed and it's possible to query the physical addresses using SUPR0MemGetPhys().
3188	*
3189	* @returns IPRT status code.
3190	* @param pSession The session to associated the allocation with.
3191	* @param cb Number of bytes to allocate.
3192	* @param ppvR0 Where to store the address of the Ring-0 mapping.
3193	* @param ppvR3 Where to store the address of the Ring-3 mapping.
3194	*/
3195	SUPR0DECL(int) SUPR0MemAlloc(PSUPDRVSESSION pSession, uint32_t cb, PRTR0PTR ppvR0, PRTR3PTR ppvR3)
3196	{
3197	int rc;
3198	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
3199	LogFlow(("SUPR0MemAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p\n", pSession, cb, ppvR0, ppvR3));
3200
3201	/*
3202	* Validate input.
3203	*/
3204	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3205	AssertPtrReturn(ppvR0, VERR_INVALID_POINTER);
3206	AssertPtrReturn(ppvR3, VERR_INVALID_POINTER);
3207	if (cb < 1 \|\| cb >= _4M)
3208	{
3209	Log(("Illegal request cb=%u; must be greater than 0 and smaller than 4MB.\n", cb));
3210	return VERR_INVALID_PARAMETER;
3211	}
3212
3213	/*
3214	* Let IPRT do the work.
3215	*/
3216	rc = RTR0MemObjAllocPage(&Mem.MemObj, cb, true /* executable ring-0 mapping */);
3217	if (RT_SUCCESS(rc))
3218	{
3219	int rc2;
3220	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
3221	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
3222	if (RT_SUCCESS(rc))
3223	{
3224	Mem.eType = MEMREF_TYPE_MEM;
3225	rc = supdrvMemAdd(&Mem, pSession);
3226	if (!rc)
3227	{
3228	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
3229	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
3230	return VINF_SUCCESS;
3231	}
3232
3233	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
3234	AssertRC(rc2);
3235	}
3236
3237	rc2 = RTR0MemObjFree(Mem.MemObj, false);
3238	AssertRC(rc2);
3239	}
3240
3241	return rc;
3242	}
3243
3244
3245	/**
3246	* Get the physical addresses of memory allocated using SUPR0MemAlloc().
3247	*
3248	* @returns IPRT status code.
3249	* @param pSession The session to which the memory was allocated.
3250	* @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
3251	* @param paPages Where to store the physical addresses.
3252	*/
3253	SUPR0DECL(int) SUPR0MemGetPhys(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, PSUPPAGE paPages) /** @todo switch this bugger to RTHCPHYS */
3254	{
3255	PSUPDRVBUNDLE pBundle;
3256	LogFlow(("SUPR0MemGetPhys: pSession=%p uPtr=%p paPages=%p\n", pSession, (void *)uPtr, paPages));
3257
3258	/*
3259	* Validate input.
3260	*/
3261	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3262	AssertPtrReturn(paPages, VERR_INVALID_POINTER);
3263	AssertReturn(uPtr, VERR_INVALID_PARAMETER);
3264
3265	/*
3266	* Search for the address.
3267	*/
3268	RTSpinlockAcquire(pSession->Spinlock);
3269	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3270	{
3271	if (pBundle->cUsed > 0)
3272	{
3273	unsigned i;
3274	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3275	{
3276	if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
3277	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3278	&& ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
3279	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
3280	&& RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr)
3281	)
3282	)
3283	{
3284	const size_t cPages = RTR0MemObjSize(pBundle->aMem[i].MemObj) >> PAGE_SHIFT;
3285	size_t iPage;
3286	for (iPage = 0; iPage < cPages; iPage++)
3287	{
3288	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(pBundle->aMem[i].MemObj, iPage);
3289	paPages[iPage].uReserved = 0;
3290	}
3291	RTSpinlockRelease(pSession->Spinlock);
3292	return VINF_SUCCESS;
3293	}
3294	}
3295	}
3296	}
3297	RTSpinlockRelease(pSession->Spinlock);
3298	Log(("Failed to find %p!!!\n", (void *)uPtr));
3299	return VERR_INVALID_PARAMETER;
3300	}
3301
3302
3303	/**
3304	* Free memory allocated by SUPR0MemAlloc().
3305	*
3306	* @returns IPRT status code.
3307	* @param pSession The session owning the allocation.
3308	* @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
3309	*/
3310	SUPR0DECL(int) SUPR0MemFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
3311	{
3312	LogFlow(("SUPR0MemFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
3313	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3314	return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_MEM);
3315	}
3316
3317
3318	/**
3319	* Allocates a chunk of memory with a kernel or/and a user mode mapping.
3320	*
3321	* The memory is fixed and it's possible to query the physical addresses using
3322	* SUPR0MemGetPhys().
3323	*
3324	* @returns IPRT status code.
3325	* @param pSession The session to associated the allocation with.
3326	* @param cPages The number of pages to allocate.
3327	* @param fFlags Flags, reserved for the future. Must be zero.
3328	* @param ppvR3 Where to store the address of the Ring-3 mapping.
3329	* NULL if no ring-3 mapping.
3330	* @param ppvR3 Where to store the address of the Ring-0 mapping.
3331	* NULL if no ring-0 mapping.
3332	* @param paPages Where to store the addresses of the pages. Optional.
3333	*/
3334	SUPR0DECL(int) SUPR0PageAllocEx(PSUPDRVSESSION pSession, uint32_t cPages, uint32_t fFlags, PRTR3PTR ppvR3, PRTR0PTR ppvR0, PRTHCPHYS paPages)
3335	{
3336	int rc;
3337	SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
3338	LogFlow(("SUPR0PageAlloc: pSession=%p cb=%d ppvR3=%p\n", pSession, cPages, ppvR3));
3339
3340	/*
3341	* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
3342	*/
3343	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3344	AssertPtrNullReturn(ppvR3, VERR_INVALID_POINTER);
3345	AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
3346	AssertReturn(ppvR3 \|\| ppvR0, VERR_INVALID_PARAMETER);
3347	AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
3348	if (cPages < 1 \|\| cPages > VBOX_MAX_ALLOC_PAGE_COUNT)
3349	{
3350	Log(("SUPR0PageAlloc: Illegal request cb=%u; must be greater than 0 and smaller than %uMB (VBOX_MAX_ALLOC_PAGE_COUNT pages).\n", cPages, VBOX_MAX_ALLOC_PAGE_COUNT * (_1M / _4K)));
3351	return VERR_PAGE_COUNT_OUT_OF_RANGE;
3352	}
3353
3354	/*
3355	* Let IPRT do the work.
3356	*/
3357	if (ppvR0)
3358	rc = RTR0MemObjAllocPage(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, true /* fExecutable */);
3359	else
3360	rc = RTR0MemObjAllocPhysNC(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, NIL_RTHCPHYS);
3361	if (RT_SUCCESS(rc))
3362	{
3363	int rc2;
3364	if (ppvR3)
3365	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
3366	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
3367	else
3368	Mem.MapObjR3 = NIL_RTR0MEMOBJ;
3369	if (RT_SUCCESS(rc))
3370	{
3371	Mem.eType = MEMREF_TYPE_PAGE;
3372	rc = supdrvMemAdd(&Mem, pSession);
3373	if (!rc)
3374	{
3375	if (ppvR3)
3376	*ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
3377	if (ppvR0)
3378	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
3379	if (paPages)
3380	{
3381	uint32_t iPage = cPages;
3382	while (iPage-- > 0)
3383	{
3384	paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MapObjR3, iPage);
3385	Assert(paPages[iPage] != NIL_RTHCPHYS);
3386	}
3387	}
3388	return VINF_SUCCESS;
3389	}
3390
3391	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
3392	AssertRC(rc2);
3393	}
3394
3395	rc2 = RTR0MemObjFree(Mem.MemObj, false);
3396	AssertRC(rc2);
3397	}
3398	return rc;
3399	}
3400
3401
3402	/**
3403	* Maps a chunk of memory previously allocated by SUPR0PageAllocEx into kernel
3404	* space.
3405	*
3406	* @returns IPRT status code.
3407	* @param pSession The session to associated the allocation with.
3408	* @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
3409	* @param offSub Where to start mapping. Must be page aligned.
3410	* @param cbSub How much to map. Must be page aligned.
3411	* @param fFlags Flags, MBZ.
3412	* @param ppvR0 Where to return the address of the ring-0 mapping on
3413	* success.
3414	*/
3415	SUPR0DECL(int) SUPR0PageMapKernel(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t offSub, uint32_t cbSub,
3416	uint32_t fFlags, PRTR0PTR ppvR0)
3417	{
3418	int rc;
3419	PSUPDRVBUNDLE pBundle;
3420	RTR0MEMOBJ hMemObj = NIL_RTR0MEMOBJ;
3421	LogFlow(("SUPR0PageMapKernel: pSession=%p pvR3=%p offSub=%#x cbSub=%#x\n", pSession, pvR3, offSub, cbSub));
3422
3423	/*
3424	* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
3425	*/
3426	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3427	AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
3428	AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
3429	AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
3430	AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
3431	AssertReturn(cbSub, VERR_INVALID_PARAMETER);
3432
3433	/*
3434	* Find the memory object.
3435	*/
3436	RTSpinlockAcquire(pSession->Spinlock);
3437	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3438	{
3439	if (pBundle->cUsed > 0)
3440	{
3441	unsigned i;
3442	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3443	{
3444	if ( ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
3445	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3446	&& pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
3447	&& RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3)
3448	\|\| ( pBundle->aMem[i].eType == MEMREF_TYPE_LOCKED
3449	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3450	&& pBundle->aMem[i].MapObjR3 == NIL_RTR0MEMOBJ
3451	&& RTR0MemObjAddressR3(pBundle->aMem[i].MemObj) == pvR3))
3452	{
3453	hMemObj = pBundle->aMem[i].MemObj;
3454	break;
3455	}
3456	}
3457	}
3458	}
3459	RTSpinlockRelease(pSession->Spinlock);
3460
3461	rc = VERR_INVALID_PARAMETER;
3462	if (hMemObj != NIL_RTR0MEMOBJ)
3463	{
3464	/*
3465	* Do some further input validations before calling IPRT.
3466	* (Cleanup is done indirectly by telling RTR0MemObjFree to include mappings.)
3467	*/
3468	size_t cbMemObj = RTR0MemObjSize(hMemObj);
3469	if ( offSub < cbMemObj
3470	&& cbSub <= cbMemObj
3471	&& offSub + cbSub <= cbMemObj)
3472	{
3473	RTR0MEMOBJ hMapObj;
3474	rc = RTR0MemObjMapKernelEx(&hMapObj, hMemObj, (void *)-1, 0,
3475	RTMEM_PROT_READ \| RTMEM_PROT_WRITE, offSub, cbSub);
3476	if (RT_SUCCESS(rc))
3477	*ppvR0 = RTR0MemObjAddress(hMapObj);
3478	}
3479	else
3480	SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
3481
3482	}
3483	return rc;
3484	}
3485
3486
3487	/**
3488	* Changes the page level protection of one or more pages previously allocated
3489	* by SUPR0PageAllocEx.
3490	*
3491	* @returns IPRT status code.
3492	* @param pSession The session to associated the allocation with.
3493	* @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
3494	* NIL_RTR3PTR if the ring-3 mapping should be unaffected.
3495	* @param pvR0 The ring-0 address returned by SUPR0PageAllocEx.
3496	* NIL_RTR0PTR if the ring-0 mapping should be unaffected.
3497	* @param offSub Where to start changing. Must be page aligned.
3498	* @param cbSub How much to change. Must be page aligned.
3499	* @param fProt The new page level protection, see RTMEM_PROT_*.
3500	*/
3501	SUPR0DECL(int) SUPR0PageProtect(PSUPDRVSESSION pSession, RTR3PTR pvR3, RTR0PTR pvR0, uint32_t offSub, uint32_t cbSub, uint32_t fProt)
3502	{
3503	int rc;
3504	PSUPDRVBUNDLE pBundle;
3505	RTR0MEMOBJ hMemObjR0 = NIL_RTR0MEMOBJ;
3506	RTR0MEMOBJ hMemObjR3 = NIL_RTR0MEMOBJ;
3507	LogFlow(("SUPR0PageProtect: pSession=%p pvR3=%p pvR0=%p offSub=%#x cbSub=%#x fProt-%#x\n", pSession, pvR3, pvR0, offSub, cbSub, fProt));
3508
3509	/*
3510	* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
3511	*/
3512	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3513	AssertReturn(!(fProt & ~(RTMEM_PROT_READ \| RTMEM_PROT_WRITE \| RTMEM_PROT_EXEC \| RTMEM_PROT_NONE)), VERR_INVALID_PARAMETER);
3514	AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
3515	AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
3516	AssertReturn(cbSub, VERR_INVALID_PARAMETER);
3517
3518	/*
3519	* Find the memory object.
3520	*/
3521	RTSpinlockAcquire(pSession->Spinlock);
3522	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3523	{
3524	if (pBundle->cUsed > 0)
3525	{
3526	unsigned i;
3527	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3528	{
3529	if ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
3530	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3531	&& ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
3532	\|\| pvR3 == NIL_RTR3PTR)
3533	&& ( pvR0 == NIL_RTR0PTR
3534	\|\| RTR0MemObjAddress(pBundle->aMem[i].MemObj) == pvR0)
3535	&& ( pvR3 == NIL_RTR3PTR
3536	\|\| RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3))
3537	{
3538	if (pvR0 != NIL_RTR0PTR)
3539	hMemObjR0 = pBundle->aMem[i].MemObj;
3540	if (pvR3 != NIL_RTR3PTR)
3541	hMemObjR3 = pBundle->aMem[i].MapObjR3;
3542	break;
3543	}
3544	}
3545	}
3546	}
3547	RTSpinlockRelease(pSession->Spinlock);
3548
3549	rc = VERR_INVALID_PARAMETER;
3550	if ( hMemObjR0 != NIL_RTR0MEMOBJ
3551	\|\| hMemObjR3 != NIL_RTR0MEMOBJ)
3552	{
3553	/*
3554	* Do some further input validations before calling IPRT.
3555	*/
3556	size_t cbMemObj = hMemObjR0 != NIL_RTR0PTR ? RTR0MemObjSize(hMemObjR0) : RTR0MemObjSize(hMemObjR3);
3557	if ( offSub < cbMemObj
3558	&& cbSub <= cbMemObj
3559	&& offSub + cbSub <= cbMemObj)
3560	{
3561	rc = VINF_SUCCESS;
3562	if (hMemObjR3 != NIL_RTR0PTR)
3563	rc = RTR0MemObjProtect(hMemObjR3, offSub, cbSub, fProt);
3564	if (hMemObjR0 != NIL_RTR0PTR && RT_SUCCESS(rc))
3565	rc = RTR0MemObjProtect(hMemObjR0, offSub, cbSub, fProt);
3566	}
3567	else
3568	SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
3569
3570	}
3571	return rc;
3572
3573	}
3574
3575
3576	/**
3577	* Free memory allocated by SUPR0PageAlloc() and SUPR0PageAllocEx().
3578	*
3579	* @returns IPRT status code.
3580	* @param pSession The session owning the allocation.
3581	* @param pvR3 The Ring-3 address returned by SUPR0PageAlloc() or
3582	* SUPR0PageAllocEx().
3583	*/
3584	SUPR0DECL(int) SUPR0PageFree(PSUPDRVSESSION pSession, RTR3PTR pvR3)
3585	{
3586	LogFlow(("SUPR0PageFree: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
3587	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3588	return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_PAGE);
3589	}
3590
3591
3592	/**
3593	* Gets the paging mode of the current CPU.
3594	*
3595	* @returns Paging mode, SUPPAGEINGMODE_INVALID on error.
3596	*/
3597	SUPR0DECL(SUPPAGINGMODE) SUPR0GetPagingMode(void)
3598	{
3599	SUPPAGINGMODE enmMode;
3600
3601	RTR0UINTREG cr0 = ASMGetCR0();
3602	if ((cr0 & (X86_CR0_PG \| X86_CR0_PE)) != (X86_CR0_PG \| X86_CR0_PE))
3603	enmMode = SUPPAGINGMODE_INVALID;
3604	else
3605	{
3606	RTR0UINTREG cr4 = ASMGetCR4();
3607	uint32_t fNXEPlusLMA = 0;
3608	if (cr4 & X86_CR4_PAE)
3609	{
3610	uint32_t fExtFeatures = ASMCpuId_EDX(0x80000001);
3611	if (fExtFeatures & (X86_CPUID_EXT_FEATURE_EDX_NX \| X86_CPUID_EXT_FEATURE_EDX_LONG_MODE))
3612	{
3613	uint64_t efer = ASMRdMsr(MSR_K6_EFER);
3614	if ((fExtFeatures & X86_CPUID_EXT_FEATURE_EDX_NX) && (efer & MSR_K6_EFER_NXE))
3615	fNXEPlusLMA \|= RT_BIT(0);
3616	if ((fExtFeatures & X86_CPUID_EXT_FEATURE_EDX_LONG_MODE) && (efer & MSR_K6_EFER_LMA))
3617	fNXEPlusLMA \|= RT_BIT(1);
3618	}
3619	}
3620
3621	switch ((cr4 & (X86_CR4_PAE \| X86_CR4_PGE)) \| fNXEPlusLMA)
3622	{
3623	case 0:
3624	enmMode = SUPPAGINGMODE_32_BIT;
3625	break;
3626
3627	case X86_CR4_PGE:
3628	enmMode = SUPPAGINGMODE_32_BIT_GLOBAL;
3629	break;
3630
3631	case X86_CR4_PAE:
3632	enmMode = SUPPAGINGMODE_PAE;
3633	break;
3634
3635	case X86_CR4_PAE \| RT_BIT(0):
3636	enmMode = SUPPAGINGMODE_PAE_NX;
3637	break;
3638
3639	case X86_CR4_PAE \| X86_CR4_PGE:
3640	enmMode = SUPPAGINGMODE_PAE_GLOBAL;
3641	break;
3642
3643	case X86_CR4_PAE \| X86_CR4_PGE \| RT_BIT(0):
3644	enmMode = SUPPAGINGMODE_PAE_GLOBAL;
3645	break;
3646
3647	case RT_BIT(1) \| X86_CR4_PAE:
3648	enmMode = SUPPAGINGMODE_AMD64;
3649	break;
3650
3651	case RT_BIT(1) \| X86_CR4_PAE \| RT_BIT(0):
3652	enmMode = SUPPAGINGMODE_AMD64_NX;
3653	break;
3654
3655	case RT_BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE:
3656	enmMode = SUPPAGINGMODE_AMD64_GLOBAL;
3657	break;
3658
3659	case RT_BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE \| RT_BIT(0):
3660	enmMode = SUPPAGINGMODE_AMD64_GLOBAL_NX;
3661	break;
3662
3663	default:
3664	AssertMsgFailed(("Cannot happen! cr4=%#x fNXEPlusLMA=%d\n", cr4, fNXEPlusLMA));
3665	enmMode = SUPPAGINGMODE_INVALID;
3666	break;
3667	}
3668	}
3669	return enmMode;
3670	}
3671
3672
3673	/**
3674	* Change CR4 and take care of the kernel CR4 shadow if applicable.
3675	*
3676	* CR4 shadow handling is required for Linux >= 4.0. Calling this function
3677	* instead of ASMSetCR4() is only necessary for semi-permanent CR4 changes
3678	* for code with interrupts enabled.
3679	*
3680	* @returns the old CR4 value.
3681	*
3682	* @param fOrMask bits to be set in CR4.
3683	* @param fAndMask bits to be cleard in CR4.
3684	*
3685	* @remarks Must be called with preemption/interrupts disabled.
3686	*/
3687	SUPR0DECL(RTCCUINTREG) SUPR0ChangeCR4(RTCCUINTREG fOrMask, RTCCUINTREG fAndMask)
3688	{
3689	#ifdef RT_OS_LINUX
3690	return supdrvOSChangeCR4(fOrMask, fAndMask);
3691	#else
3692	RTCCUINTREG uOld = ASMGetCR4();
3693	RTCCUINTREG uNew = (uOld & fAndMask) \| fOrMask;
3694	if (uNew != uOld)
3695	ASMSetCR4(uNew);
3696	return uOld;
3697	#endif
3698	}
3699
3700
3701	/**
3702	* Enables or disabled hardware virtualization extensions using native OS APIs.
3703	*
3704	* @returns VBox status code.
3705	* @retval VINF_SUCCESS on success.
3706	* @retval VERR_NOT_SUPPORTED if not supported by the native OS.
3707	*
3708	* @param fEnable Whether to enable or disable.
3709	*/
3710	SUPR0DECL(int) SUPR0EnableVTx(bool fEnable)
3711	{
3712	#ifdef RT_OS_DARWIN
3713	return supdrvOSEnableVTx(fEnable);
3714	#else
3715	return VERR_NOT_SUPPORTED;
3716	#endif
3717	}
3718
3719
3720	/**
3721	* Suspends hardware virtualization extensions using the native OS API.
3722	*
3723	* This is called prior to entering raw-mode context.
3724	*
3725	* @returns @c true if suspended, @c false if not.
3726	*/
3727	SUPR0DECL(bool) SUPR0SuspendVTxOnCpu(void)
3728	{
3729	#ifdef RT_OS_DARWIN
3730	return supdrvOSSuspendVTxOnCpu();
3731	#else
3732	return false;
3733	#endif
3734	}
3735
3736
3737	/**
3738	* Resumes hardware virtualization extensions using the native OS API.
3739	*
3740	* This is called after to entering raw-mode context.
3741	*
3742	* @param fSuspended The return value of SUPR0SuspendVTxOnCpu.
3743	*/
3744	SUPR0DECL(void) SUPR0ResumeVTxOnCpu(bool fSuspended)
3745	{
3746	#ifdef RT_OS_DARWIN
3747	supdrvOSResumeVTxOnCpu(fSuspended);
3748	#else
3749	Assert(!fSuspended);
3750	#endif
3751	}
3752
3753
3754	/**
3755	* Checks if Intel VT-x feature is usable on this CPU.
3756	*
3757	* @returns VBox status code.
3758	* @param fIsSmxModeAmbiguous Where to write whether the SMX mode causes
3759	* ambiguity that makes us unsure whether we
3760	* really can use VT-x or not.
3761	*
3762	* @remarks Must be called with preemption disabled.
3763	*/
3764	SUPR0DECL(int) SUPR0GetVmxUsability(bool *pfIsSmxModeAmbiguous)
3765	{
3766	uint64_t u64FeatMsr;
3767	bool fMaybeSmxMode;
3768	bool fMsrLocked;
3769	bool fSmxVmxAllowed;
3770	bool fVmxAllowed;
3771	bool fIsSmxModeAmbiguous;
3772	int rc;
3773
3774	Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
3775
3776	u64FeatMsr = ASMRdMsr(MSR_IA32_FEATURE_CONTROL);
3777	fMaybeSmxMode = RT_BOOL(ASMGetCR4() & X86_CR4_SMXE);
3778	fMsrLocked = RT_BOOL(u64FeatMsr & MSR_IA32_FEATURE_CONTROL_LOCK);
3779	fSmxVmxAllowed = RT_BOOL(u64FeatMsr & MSR_IA32_FEATURE_CONTROL_SMX_VMXON);
3780	fVmxAllowed = RT_BOOL(u64FeatMsr & MSR_IA32_FEATURE_CONTROL_VMXON);
3781	fIsSmxModeAmbiguous = false;
3782	rc = VERR_INTERNAL_ERROR_5;
3783
3784	/* Check if the LOCK bit is set but excludes the required VMXON bit. */
3785	if (fMsrLocked)
3786	{
3787	if (fVmxAllowed && fSmxVmxAllowed)
3788	rc = VINF_SUCCESS;
3789	else if (!fVmxAllowed && !fSmxVmxAllowed)
3790	rc = VERR_VMX_MSR_ALL_VMXON_DISABLED;
3791	else if (!fMaybeSmxMode)
3792	{
3793	if (fVmxAllowed)
3794	rc = VINF_SUCCESS;
3795	else
3796	rc = VERR_VMX_MSR_VMXON_DISABLED;
3797	}
3798	else
3799	{
3800	/*
3801	* CR4.SMXE is set but this doesn't mean the CPU is necessarily in SMX mode. We shall assume
3802	* that it is -not- and that it is a stupid BIOS/OS setting CR4.SMXE for no good reason.
3803	* See @bugref{6873}.
3804	*/
3805	Assert(fMaybeSmxMode == true);
3806	fIsSmxModeAmbiguous = true;
3807	rc = VINF_SUCCESS;
3808	}
3809	}
3810	else
3811	{
3812	/*
3813	* MSR is not yet locked; we can change it ourselves here.
3814	* Once the lock bit is set, this MSR can no longer be modified.
3815	*
3816	* Set both the VMXON and SMX_VMXON bits as we can't determine SMX mode
3817	* accurately. See @bugref{6873}.
3818	*/
3819	u64FeatMsr \|= MSR_IA32_FEATURE_CONTROL_LOCK
3820	\| MSR_IA32_FEATURE_CONTROL_SMX_VMXON
3821	\| MSR_IA32_FEATURE_CONTROL_VMXON;
3822	ASMWrMsr(MSR_IA32_FEATURE_CONTROL, u64FeatMsr);
3823
3824	/* Verify. */
3825	u64FeatMsr = ASMRdMsr(MSR_IA32_FEATURE_CONTROL);
3826	fMsrLocked = RT_BOOL(u64FeatMsr & MSR_IA32_FEATURE_CONTROL_LOCK);
3827	fSmxVmxAllowed = fMsrLocked && RT_BOOL(u64FeatMsr & MSR_IA32_FEATURE_CONTROL_SMX_VMXON);
3828	fVmxAllowed = fMsrLocked && RT_BOOL(u64FeatMsr & MSR_IA32_FEATURE_CONTROL_VMXON);
3829	if (fSmxVmxAllowed && fVmxAllowed)
3830	rc = VINF_SUCCESS;
3831	else
3832	rc = VERR_VMX_MSR_LOCKING_FAILED;
3833	}
3834
3835	if (pfIsSmxModeAmbiguous)
3836	*pfIsSmxModeAmbiguous = fIsSmxModeAmbiguous;
3837
3838	return rc;
3839	}
3840
3841
3842	/**
3843	* Checks if AMD-V SVM feature is usable on this CPU.
3844	*
3845	* @returns VBox status code.
3846	* @param fInitSvm If usable, try to initialize SVM on this CPU.
3847	*
3848	* @remarks Must be called with preemption disabled.
3849	*/
3850	SUPR0DECL(int) SUPR0GetSvmUsability(bool fInitSvm)
3851	{
3852	int rc;
3853	uint64_t fVmCr;
3854	uint64_t fEfer;
3855
3856	Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
3857	fVmCr = ASMRdMsr(MSR_K8_VM_CR);
3858	if (!(fVmCr & MSR_K8_VM_CR_SVM_DISABLE))
3859	{
3860	rc = VINF_SUCCESS;
3861	if (fInitSvm)
3862	{
3863	/* Turn on SVM in the EFER MSR. */
3864	fEfer = ASMRdMsr(MSR_K6_EFER);
3865	if (fEfer & MSR_K6_EFER_SVME)
3866	rc = VERR_SVM_IN_USE;
3867	else
3868	{
3869	ASMWrMsr(MSR_K6_EFER, fEfer \| MSR_K6_EFER_SVME);
3870
3871	/* Paranoia. */
3872	fEfer = ASMRdMsr(MSR_K6_EFER);
3873	if (fEfer & MSR_K6_EFER_SVME)
3874	{
3875	/* Restore previous value. */
3876	ASMWrMsr(MSR_K6_EFER, fEfer & ~MSR_K6_EFER_SVME);
3877	}
3878	else
3879	rc = VERR_SVM_ILLEGAL_EFER_MSR;
3880	}
3881	}
3882	}
3883	else
3884	rc = VERR_SVM_DISABLED;
3885	return rc;
3886	}
3887
3888
3889	/**
3890	* Queries the AMD-V and VT-x capabilities of the calling CPU.
3891	*
3892	* @returns VBox status code.
3893	* @retval VERR_VMX_NO_VMX
3894	* @retval VERR_VMX_MSR_ALL_VMXON_DISABLED
3895	* @retval VERR_VMX_MSR_VMXON_DISABLED
3896	* @retval VERR_VMX_MSR_LOCKING_FAILED
3897	* @retval VERR_SVM_NO_SVM
3898	* @retval VERR_SVM_DISABLED
3899	* @retval VERR_UNSUPPORTED_CPU if not identifiable as an AMD, Intel or VIA
3900	* (centaur) CPU.
3901	*
3902	* @param pSession The session handle.
3903	* @param pfCaps Where to store the capabilities.
3904	*/
3905	SUPR0DECL(int) SUPR0QueryVTCaps(PSUPDRVSESSION pSession, uint32_t *pfCaps)
3906	{
3907	int rc = VERR_UNSUPPORTED_CPU;
3908	bool fIsSmxModeAmbiguous = false;
3909	RTTHREADPREEMPTSTATE PreemptState = RTTHREADPREEMPTSTATE_INITIALIZER;
3910
3911	/*
3912	* Input validation.
3913	*/
3914	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3915	AssertPtrReturn(pfCaps, VERR_INVALID_POINTER);
3916
3917	*pfCaps = 0;
3918	/* We may modify MSRs and re-read them, disable preemption so we make sure we don't migrate CPUs. */
3919	RTThreadPreemptDisable(&PreemptState);
3920	if (ASMHasCpuId())
3921	{
3922	uint32_t fFeaturesECX, fFeaturesEDX, uDummy;
3923	uint32_t uMaxId, uVendorEBX, uVendorECX, uVendorEDX;
3924
3925	ASMCpuId(0, &uMaxId, &uVendorEBX, &uVendorECX, &uVendorEDX);
3926	ASMCpuId(1, &uDummy, &uDummy, &fFeaturesECX, &fFeaturesEDX);
3927
3928	if ( ASMIsValidStdRange(uMaxId)
3929	&& ( ASMIsIntelCpuEx( uVendorEBX, uVendorECX, uVendorEDX)
3930	\|\| ASMIsViaCentaurCpuEx(uVendorEBX, uVendorECX, uVendorEDX) )
3931	)
3932	{
3933	if ( (fFeaturesECX & X86_CPUID_FEATURE_ECX_VMX)
3934	&& (fFeaturesEDX & X86_CPUID_FEATURE_EDX_MSR)
3935	&& (fFeaturesEDX & X86_CPUID_FEATURE_EDX_FXSR)
3936	)
3937	{
3938	rc = SUPR0GetVmxUsability(&fIsSmxModeAmbiguous);
3939	if (rc == VINF_SUCCESS)
3940	{
3941	VMXCAPABILITY vtCaps;
3942
3943	*pfCaps \|= SUPVTCAPS_VT_X;
3944
3945	vtCaps.u = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS);
3946	if (vtCaps.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
3947	{
3948	vtCaps.u = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS2);
3949	if (vtCaps.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_EPT)
3950	*pfCaps \|= SUPVTCAPS_NESTED_PAGING;
3951	if (vtCaps.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_UNRESTRICTED_GUEST)
3952	*pfCaps \|= SUPVTCAPS_VTX_UNRESTRICTED_GUEST;
3953	}
3954	}
3955	}
3956	else
3957	rc = VERR_VMX_NO_VMX;
3958	}
3959	else if ( ASMIsAmdCpuEx(uVendorEBX, uVendorECX, uVendorEDX)
3960	&& ASMIsValidStdRange(uMaxId))
3961	{
3962	uint32_t fExtFeaturesEcx, uExtMaxId;
3963	ASMCpuId(0x80000000, &uExtMaxId, &uDummy, &uDummy, &uDummy);
3964	ASMCpuId(0x80000001, &uDummy, &uDummy, &fExtFeaturesEcx, &uDummy);
3965
3966	/* Check if SVM is available. */
3967	if ( ASMIsValidExtRange(uExtMaxId)
3968	&& uExtMaxId >= 0x8000000a
3969	&& (fExtFeaturesEcx & X86_CPUID_AMD_FEATURE_ECX_SVM)
3970	&& (fFeaturesEDX & X86_CPUID_FEATURE_EDX_MSR)
3971	&& (fFeaturesEDX & X86_CPUID_FEATURE_EDX_FXSR)
3972	)
3973	{
3974	rc = SUPR0GetSvmUsability(false /* fInitSvm */);
3975	if (RT_SUCCESS(rc))
3976	{
3977	uint32_t fSvmFeatures;
3978	*pfCaps \|= SUPVTCAPS_AMD_V;
3979
3980	/* Query AMD-V features. */
3981	ASMCpuId(0x8000000a, &uDummy, &uDummy, &uDummy, &fSvmFeatures);
3982	if (fSvmFeatures & AMD_CPUID_SVM_FEATURE_EDX_NESTED_PAGING)
3983	*pfCaps \|= SUPVTCAPS_NESTED_PAGING;
3984	}
3985	}
3986	else
3987	rc = VERR_SVM_NO_SVM;
3988	}
3989	}
3990
3991	RTThreadPreemptRestore(&PreemptState);
3992	if (fIsSmxModeAmbiguous)
3993	SUPR0Printf(("WARNING! CR4 hints SMX mode but your CPU is too secretive. Proceeding anyway... We wish you good luck!\n"));
3994	return rc;
3995	}
3996
3997
3998	/**
3999	* Register a component factory with the support driver.
4000	*
4001	* This is currently restricted to kernel sessions only.
4002	*
4003	* @returns VBox status code.
4004	* @retval VINF_SUCCESS on success.
4005	* @retval VERR_NO_MEMORY if we're out of memory.
4006	* @retval VERR_ALREADY_EXISTS if the factory has already been registered.
4007	* @retval VERR_ACCESS_DENIED if it isn't a kernel session.
4008	* @retval VERR_INVALID_PARAMETER on invalid parameter.
4009	* @retval VERR_INVALID_POINTER on invalid pointer parameter.
4010	*
4011	* @param pSession The SUPDRV session (must be a ring-0 session).
4012	* @param pFactory Pointer to the component factory registration structure.
4013	*
4014	* @remarks This interface is also available via SUPR0IdcComponentRegisterFactory.
4015	*/
4016	SUPR0DECL(int) SUPR0ComponentRegisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
4017	{
4018	PSUPDRVFACTORYREG pNewReg;
4019	const char *psz;
4020	int rc;
4021
4022	/*
4023	* Validate parameters.
4024	*/
4025	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
4026	AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
4027	AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
4028	AssertPtrReturn(pFactory->pfnQueryFactoryInterface, VERR_INVALID_POINTER);
4029	psz = RTStrEnd(pFactory->szName, sizeof(pFactory->szName));
4030	AssertReturn(psz, VERR_INVALID_PARAMETER);
4031
4032	/*
4033	* Allocate and initialize a new registration structure.
4034	*/
4035	pNewReg = (PSUPDRVFACTORYREG)RTMemAlloc(sizeof(SUPDRVFACTORYREG));
4036	if (pNewReg)
4037	{
4038	pNewReg->pNext = NULL;
4039	pNewReg->pFactory = pFactory;
4040	pNewReg->pSession = pSession;
4041	pNewReg->cchName = psz - &pFactory->szName[0];
4042
4043	/*
4044	* Add it to the tail of the list after checking for prior registration.
4045	*/
4046	rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
4047	if (RT_SUCCESS(rc))
4048	{
4049	PSUPDRVFACTORYREG pPrev = NULL;
4050	PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
4051	while (pCur && pCur->pFactory != pFactory)
4052	{
4053	pPrev = pCur;
4054	pCur = pCur->pNext;
4055	}
4056	if (!pCur)
4057	{
4058	if (pPrev)
4059	pPrev->pNext = pNewReg;
4060	else
4061	pSession->pDevExt->pComponentFactoryHead = pNewReg;
4062	rc = VINF_SUCCESS;
4063	}
4064	else
4065	rc = VERR_ALREADY_EXISTS;
4066
4067	RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
4068	}
4069
4070	if (RT_FAILURE(rc))
4071	RTMemFree(pNewReg);
4072	}
4073	else
4074	rc = VERR_NO_MEMORY;
4075	return rc;
4076	}
4077
4078
4079	/**
4080	* Deregister a component factory.
4081	*
4082	* @returns VBox status code.
4083	* @retval VINF_SUCCESS on success.
4084	* @retval VERR_NOT_FOUND if the factory wasn't registered.
4085	* @retval VERR_ACCESS_DENIED if it isn't a kernel session.
4086	* @retval VERR_INVALID_PARAMETER on invalid parameter.
4087	* @retval VERR_INVALID_POINTER on invalid pointer parameter.
4088	*
4089	* @param pSession The SUPDRV session (must be a ring-0 session).
4090	* @param pFactory Pointer to the component factory registration structure
4091	* previously passed SUPR0ComponentRegisterFactory().
4092	*
4093	* @remarks This interface is also available via SUPR0IdcComponentDeregisterFactory.
4094	*/
4095	SUPR0DECL(int) SUPR0ComponentDeregisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
4096	{
4097	int rc;
4098
4099	/*
4100	* Validate parameters.
4101	*/
4102	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
4103	AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
4104	AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
4105
4106	/*
4107	* Take the lock and look for the registration record.
4108	*/
4109	rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
4110	if (RT_SUCCESS(rc))
4111	{
4112	PSUPDRVFACTORYREG pPrev = NULL;
4113	PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
4114	while (pCur && pCur->pFactory != pFactory)
4115	{
4116	pPrev = pCur;
4117	pCur = pCur->pNext;
4118	}
4119	if (pCur)
4120	{
4121	if (!pPrev)
4122	pSession->pDevExt->pComponentFactoryHead = pCur->pNext;
4123	else
4124	pPrev->pNext = pCur->pNext;
4125
4126	pCur->pNext = NULL;
4127	pCur->pFactory = NULL;
4128	pCur->pSession = NULL;
4129	rc = VINF_SUCCESS;
4130	}
4131	else
4132	rc = VERR_NOT_FOUND;
4133
4134	RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
4135
4136	RTMemFree(pCur);
4137	}
4138	return rc;
4139	}
4140
4141
4142	/**
4143	* Queries a component factory.
4144	*
4145	* @returns VBox status code.
4146	* @retval VERR_INVALID_PARAMETER on invalid parameter.
4147	* @retval VERR_INVALID_POINTER on invalid pointer parameter.
4148	* @retval VERR_SUPDRV_COMPONENT_NOT_FOUND if the component factory wasn't found.
4149	* @retval VERR_SUPDRV_INTERFACE_NOT_SUPPORTED if the interface wasn't supported.
4150	*
4151	* @param pSession The SUPDRV session.
4152	* @param pszName The name of the component factory.
4153	* @param pszInterfaceUuid The UUID of the factory interface (stringified).
4154	* @param ppvFactoryIf Where to store the factory interface.
4155	*/
4156	SUPR0DECL(int) SUPR0ComponentQueryFactory(PSUPDRVSESSION pSession, const char pszName, const char pszInterfaceUuid, void **ppvFactoryIf)
4157	{
4158	const char *pszEnd;
4159	size_t cchName;
4160	int rc;
4161
4162	/*
4163	* Validate parameters.
4164	*/
4165	AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
4166
4167	AssertPtrReturn(pszName, VERR_INVALID_POINTER);
4168	pszEnd = RTStrEnd(pszName, RT_SIZEOFMEMB(SUPDRVFACTORY, szName));
4169	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4170	cchName = pszEnd - pszName;
4171
4172	AssertPtrReturn(pszInterfaceUuid, VERR_INVALID_POINTER);
4173	pszEnd = RTStrEnd(pszInterfaceUuid, RTUUID_STR_LENGTH);
4174	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4175
4176	AssertPtrReturn(ppvFactoryIf, VERR_INVALID_POINTER);
4177	*ppvFactoryIf = NULL;
4178
4179	/*
4180	* Take the lock and try all factories by this name.
4181	*/
4182	rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
4183	if (RT_SUCCESS(rc))
4184	{
4185	PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
4186	rc = VERR_SUPDRV_COMPONENT_NOT_FOUND;
4187	while (pCur)
4188	{
4189	if ( pCur->cchName == cchName
4190	&& !memcmp(pCur->pFactory->szName, pszName, cchName))
4191	{
4192	void *pvFactory = pCur->pFactory->pfnQueryFactoryInterface(pCur->pFactory, pSession, pszInterfaceUuid);
4193	if (pvFactory)
4194	{
4195	*ppvFactoryIf = pvFactory;
4196	rc = VINF_SUCCESS;
4197	break;
4198	}
4199	rc = VERR_SUPDRV_INTERFACE_NOT_SUPPORTED;
4200	}
4201
4202	/* next */
4203	pCur = pCur->pNext;
4204	}
4205
4206	RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
4207	}
4208	return rc;
4209	}
4210
4211
4212	/**
4213	* Adds a memory object to the session.
4214	*
4215	* @returns IPRT status code.
4216	* @param pMem Memory tracking structure containing the
4217	* information to track.
4218	* @param pSession The session.
4219	*/
4220	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession)
4221	{
4222	PSUPDRVBUNDLE pBundle;
4223
4224	/*
4225	* Find free entry and record the allocation.
4226	*/
4227	RTSpinlockAcquire(pSession->Spinlock);
4228	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
4229	{
4230	if (pBundle->cUsed < RT_ELEMENTS(pBundle->aMem))
4231	{
4232	unsigned i;
4233	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
4234	{
4235	if (pBundle->aMem[i].MemObj == NIL_RTR0MEMOBJ)
4236	{
4237	pBundle->cUsed++;
4238	pBundle->aMem[i] = *pMem;
4239	RTSpinlockRelease(pSession->Spinlock);
4240	return VINF_SUCCESS;
4241	}
4242	}
4243	AssertFailed(); /* !!this can't be happening!!! */
4244	}
4245	}
4246	RTSpinlockRelease(pSession->Spinlock);
4247
4248	/*
4249	* Need to allocate a new bundle.
4250	* Insert into the last entry in the bundle.
4251	*/
4252	pBundle = (PSUPDRVBUNDLE)RTMemAllocZ(sizeof(*pBundle));
4253	if (!pBundle)
4254	return VERR_NO_MEMORY;
4255
4256	/* take last entry. */
4257	pBundle->cUsed++;
4258	pBundle->aMem[RT_ELEMENTS(pBundle->aMem) - 1] = *pMem;
4259
4260	/* insert into list. */
4261	RTSpinlockAcquire(pSession->Spinlock);
4262	pBundle->pNext = pSession->Bundle.pNext;
4263	pSession->Bundle.pNext = pBundle;
4264	RTSpinlockRelease(pSession->Spinlock);
4265
4266	return VINF_SUCCESS;
4267	}
4268
4269
4270	/**
4271	* Releases a memory object referenced by pointer and type.
4272	*
4273	* @returns IPRT status code.
4274	* @param pSession Session data.
4275	* @param uPtr Pointer to memory. This is matched against both the R0 and R3 addresses.
4276	* @param eType Memory type.
4277	*/
4278	static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType)
4279	{
4280	PSUPDRVBUNDLE pBundle;
4281
4282	/*
4283	* Validate input.
4284	*/
4285	if (!uPtr)
4286	{
4287	Log(("Illegal address %p\n", (void *)uPtr));
4288	return VERR_INVALID_PARAMETER;
4289	}
4290
4291	/*
4292	* Search for the address.
4293	*/
4294	RTSpinlockAcquire(pSession->Spinlock);
4295	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
4296	{
4297	if (pBundle->cUsed > 0)
4298	{
4299	unsigned i;
4300	for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
4301	{
4302	if ( pBundle->aMem[i].eType == eType
4303	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
4304	&& ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
4305	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
4306	&& RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr))
4307	)
4308	{
4309	/* Make a copy of it and release it outside the spinlock. */
4310	SUPDRVMEMREF Mem = pBundle->aMem[i];
4311	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
4312	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
4313	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
4314	RTSpinlockRelease(pSession->Spinlock);
4315
4316	if (Mem.MapObjR3 != NIL_RTR0MEMOBJ)
4317	{
4318	int rc = RTR0MemObjFree(Mem.MapObjR3, false);
4319	AssertRC(rc); /** @todo figure out how to handle this. */
4320	}
4321	if (Mem.MemObj != NIL_RTR0MEMOBJ)
4322	{
4323	int rc = RTR0MemObjFree(Mem.MemObj, true /* fFreeMappings */);
4324	AssertRC(rc); /** @todo figure out how to handle this. */
4325	}
4326	return VINF_SUCCESS;
4327	}
4328	}
4329	}
4330	}
4331	RTSpinlockRelease(pSession->Spinlock);
4332	Log(("Failed to find %p!!! (eType=%d)\n", (void *)uPtr, eType));
4333	return VERR_INVALID_PARAMETER;
4334	}
4335
4336
4337	/**
4338	* Opens an image. If it's the first time it's opened the call must upload
4339	* the bits using the supdrvIOCtl_LdrLoad() / SUPDRV_IOCTL_LDR_LOAD function.
4340	*
4341	* This is the 1st step of the loading.
4342	*
4343	* @returns IPRT status code.
4344	* @param pDevExt Device globals.
4345	* @param pSession Session data.
4346	* @param pReq The open request.
4347	*/
4348	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq)
4349	{
4350	int rc;
4351	PSUPDRVLDRIMAGE pImage;
4352	void *pv;
4353	size_t cchName = strlen(pReq->u.In.szName); /* (caller checked < 32). */
4354	LogFlow(("supdrvIOCtl_LdrOpen: szName=%s cbImageWithTabs=%d\n", pReq->u.In.szName, pReq->u.In.cbImageWithTabs));
4355
4356	/*
4357	* Check if we got an instance of the image already.
4358	*/
4359	supdrvLdrLock(pDevExt);
4360	for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
4361	{
4362	if ( pImage->szName[cchName] == '\0'
4363	&& !memcmp(pImage->szName, pReq->u.In.szName, cchName))
4364	{
4365	if (RT_LIKELY(pImage->cUsage < UINT32_MAX / 2U))
4366	{
4367	/** @todo check cbImageBits and cbImageWithTabs here, if they differs that indicates that the images are different. */
4368	pImage->cUsage++;
4369	pReq->u.Out.pvImageBase = pImage->pvImage;
4370	pReq->u.Out.fNeedsLoading = pImage->uState == SUP_IOCTL_LDR_OPEN;
4371	pReq->u.Out.fNativeLoader = pImage->fNative;
4372	supdrvLdrAddUsage(pSession, pImage);
4373	supdrvLdrUnlock(pDevExt);
4374	return VINF_SUCCESS;
4375	}
4376	supdrvLdrUnlock(pDevExt);
4377	Log(("supdrvIOCtl_LdrOpen: To many existing references to '%s'!\n", pReq->u.In.szName));
4378	return VERR_INTERNAL_ERROR_3; /** @todo add VERR_TOO_MANY_REFERENCES */
4379	}
4380	}
4381	/* (not found - add it!) */
4382
4383	/* If the loader interface is locked down, make userland fail early */
4384	if (pDevExt->fLdrLockedDown)
4385	{
4386	supdrvLdrUnlock(pDevExt);
4387	Log(("supdrvIOCtl_LdrOpen: Not adding '%s' to image list, loader interface is locked down!\n", pReq->u.In.szName));
4388	return VERR_PERMISSION_DENIED;
4389	}
4390
4391	/*
4392	* Allocate memory.
4393	*/
4394	Assert(cchName < sizeof(pImage->szName));
4395	pv = RTMemAlloc(sizeof(SUPDRVLDRIMAGE));
4396	if (!pv)
4397	{
4398	supdrvLdrUnlock(pDevExt);
4399	Log(("supdrvIOCtl_LdrOpen: RTMemAlloc() failed\n"));
4400	return /VERR_NO_MEMORY/ VERR_INTERNAL_ERROR_2;
4401	}
4402
4403	/*
4404	* Setup and link in the LDR stuff.
4405	*/
4406	pImage = (PSUPDRVLDRIMAGE)pv;
4407	pImage->pvImage = NULL;
4408	pImage->pvImageAlloc = NULL;
4409	pImage->cbImageWithTabs = pReq->u.In.cbImageWithTabs;
4410	pImage->cbImageBits = pReq->u.In.cbImageBits;
4411	pImage->cSymbols = 0;
4412	pImage->paSymbols = NULL;
4413	pImage->pachStrTab = NULL;
4414	pImage->cbStrTab = 0;
4415	pImage->pfnModuleInit = NULL;
4416	pImage->pfnModuleTerm = NULL;
4417	pImage->pfnServiceReqHandler = NULL;
4418	pImage->uState = SUP_IOCTL_LDR_OPEN;
4419	pImage->cUsage = 1;
4420	pImage->pDevExt = pDevExt;
4421	memcpy(pImage->szName, pReq->u.In.szName, cchName + 1);
4422
4423	/*
4424	* Try load it using the native loader, if that isn't supported, fall back
4425	* on the older method.
4426	*/
4427	pImage->fNative = true;
4428	rc = supdrvOSLdrOpen(pDevExt, pImage, pReq->u.In.szFilename);
4429	if (rc == VERR_NOT_SUPPORTED)
4430	{
4431	pImage->pvImageAlloc = RTMemExecAlloc(pImage->cbImageBits + 31);
4432	pImage->pvImage = RT_ALIGN_P(pImage->pvImageAlloc, 32);
4433	pImage->fNative = false;
4434	rc = pImage->pvImageAlloc ? VINF_SUCCESS : VERR_NO_EXEC_MEMORY;
4435	}
4436	if (RT_FAILURE(rc))
4437	{
4438	supdrvLdrUnlock(pDevExt);
4439	RTMemFree(pImage);
4440	Log(("supdrvIOCtl_LdrOpen(%s): failed - %Rrc\n", pReq->u.In.szName, rc));
4441	return rc;
4442	}
4443	Assert(VALID_PTR(pImage->pvImage) \|\| RT_FAILURE(rc));
4444
4445	/*
4446	* Link it.
4447	*/
4448	pImage->pNext = pDevExt->pLdrImages;
4449	pDevExt->pLdrImages = pImage;
4450
4451	supdrvLdrAddUsage(pSession, pImage);
4452
4453	pReq->u.Out.pvImageBase = pImage->pvImage;
4454	pReq->u.Out.fNeedsLoading = true;
4455	pReq->u.Out.fNativeLoader = pImage->fNative;
4456	supdrvOSLdrNotifyOpened(pDevExt, pImage);
4457
4458	supdrvLdrUnlock(pDevExt);
4459	return VINF_SUCCESS;
4460	}
4461
4462
4463	/**
4464	* Worker that validates a pointer to an image entrypoint.
4465	*
4466	* @returns IPRT status code.
4467	* @param pDevExt The device globals.
4468	* @param pImage The loader image.
4469	* @param pv The pointer into the image.
4470	* @param fMayBeNull Whether it may be NULL.
4471	* @param pszWhat What is this entrypoint? (for logging)
4472	* @param pbImageBits The image bits prepared by ring-3.
4473	*
4474	* @remarks Will leave the lock on failure.
4475	*/
4476	static int supdrvLdrValidatePointer(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage, void *pv,
4477	bool fMayBeNull, const uint8_t pbImageBits, const char pszWhat)
4478	{
4479	if (!fMayBeNull \|\| pv)
4480	{
4481	if ((uintptr_t)pv - (uintptr_t)pImage->pvImage >= pImage->cbImageBits)
4482	{
4483	supdrvLdrUnlock(pDevExt);
4484	Log(("Out of range (%p LB %#x): %s=%p\n", pImage->pvImage, pImage->cbImageBits, pszWhat, pv));
4485	return VERR_INVALID_PARAMETER;
4486	}
4487
4488	if (pImage->fNative)
4489	{
4490	int rc = supdrvOSLdrValidatePointer(pDevExt, pImage, pv, pbImageBits);
4491	if (RT_FAILURE(rc))
4492	{
4493	supdrvLdrUnlock(pDevExt);
4494	Log(("Bad entry point address: %s=%p (rc=%Rrc)\n", pszWhat, pv, rc));
4495	return rc;
4496	}
4497	}
4498	}
4499	return VINF_SUCCESS;
4500	}
4501
4502
4503	/**
4504	* Loads the image bits.
4505	*
4506	* This is the 2nd step of the loading.
4507	*
4508	* @returns IPRT status code.
4509	* @param pDevExt Device globals.
4510	* @param pSession Session data.
4511	* @param pReq The request.
4512	*/
4513	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq)
4514	{
4515	PSUPDRVLDRUSAGE pUsage;
4516	PSUPDRVLDRIMAGE pImage;
4517	int rc;
4518	LogFlow(("supdrvIOCtl_LdrLoad: pvImageBase=%p cbImageWithBits=%d\n", pReq->u.In.pvImageBase, pReq->u.In.cbImageWithTabs));
4519
4520	/*
4521	* Find the ldr image.
4522	*/
4523	supdrvLdrLock(pDevExt);
4524	pUsage = pSession->pLdrUsage;
4525	while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
4526	pUsage = pUsage->pNext;
4527	if (!pUsage)
4528	{
4529	supdrvLdrUnlock(pDevExt);
4530	Log(("SUP_IOCTL_LDR_LOAD: couldn't find image!\n"));
4531	return VERR_INVALID_HANDLE;
4532	}
4533	pImage = pUsage->pImage;
4534
4535	/*
4536	* Validate input.
4537	*/
4538	if ( pImage->cbImageWithTabs != pReq->u.In.cbImageWithTabs
4539	\|\| pImage->cbImageBits != pReq->u.In.cbImageBits)
4540	{
4541	supdrvLdrUnlock(pDevExt);
4542	Log(("SUP_IOCTL_LDR_LOAD: image size mismatch!! %d(prep) != %d(load) or %d != %d\n",
4543	pImage->cbImageWithTabs, pReq->u.In.cbImageWithTabs, pImage->cbImageBits, pReq->u.In.cbImageBits));
4544	return VERR_INVALID_HANDLE;
4545	}
4546
4547	if (pImage->uState != SUP_IOCTL_LDR_OPEN)
4548	{
4549	unsigned uState = pImage->uState;
4550	supdrvLdrUnlock(pDevExt);
4551	if (uState != SUP_IOCTL_LDR_LOAD)
4552	AssertMsgFailed(("SUP_IOCTL_LDR_LOAD: invalid image state %d (%#x)!\n", uState, uState));
4553	return VERR_ALREADY_LOADED;
4554	}
4555
4556	/* If the loader interface is locked down, don't load new images */
4557	if (pDevExt->fLdrLockedDown)
4558	{
4559	supdrvLdrUnlock(pDevExt);
4560	Log(("SUP_IOCTL_LDR_LOAD: Not loading '%s' image bits, loader interface is locked down!\n", pImage->szName));
4561	return VERR_PERMISSION_DENIED;
4562	}
4563
4564	switch (pReq->u.In.eEPType)
4565	{
4566	case SUPLDRLOADEP_NOTHING:
4567	break;
4568
4569	case SUPLDRLOADEP_VMMR0:
4570	rc = supdrvLdrValidatePointer( pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0, false, pReq->u.In.abImage, "pvVMMR0");
4571	if (RT_SUCCESS(rc))
4572	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt, false, pReq->u.In.abImage, "pvVMMR0EntryInt");
4573	if (RT_SUCCESS(rc))
4574	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, false, pReq->u.In.abImage, "pvVMMR0EntryFast");
4575	if (RT_SUCCESS(rc))
4576	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx, false, pReq->u.In.abImage, "pvVMMR0EntryEx");
4577	if (RT_FAILURE(rc))
4578	return rc;
4579	break;
4580
4581	case SUPLDRLOADEP_SERVICE:
4582	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.Service.pfnServiceReq, false, pReq->u.In.abImage, "pfnServiceReq");
4583	if (RT_FAILURE(rc))
4584	return rc;
4585	if ( pReq->u.In.EP.Service.apvReserved[0] != NIL_RTR0PTR
4586	\|\| pReq->u.In.EP.Service.apvReserved[1] != NIL_RTR0PTR
4587	\|\| pReq->u.In.EP.Service.apvReserved[2] != NIL_RTR0PTR)
4588	{
4589	supdrvLdrUnlock(pDevExt);
4590	Log(("Out of range (%p LB %#x): apvReserved={%p,%p,%p} MBZ!\n",
4591	pImage->pvImage, pReq->u.In.cbImageWithTabs,
4592	pReq->u.In.EP.Service.apvReserved[0],
4593	pReq->u.In.EP.Service.apvReserved[1],
4594	pReq->u.In.EP.Service.apvReserved[2]));
4595	return VERR_INVALID_PARAMETER;
4596	}
4597	break;
4598
4599	default:
4600	supdrvLdrUnlock(pDevExt);
4601	Log(("Invalid eEPType=%d\n", pReq->u.In.eEPType));
4602	return VERR_INVALID_PARAMETER;
4603	}
4604
4605	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.pfnModuleInit, true, pReq->u.In.abImage, "pfnModuleInit");
4606	if (RT_FAILURE(rc))
4607	return rc;
4608	rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.pfnModuleTerm, true, pReq->u.In.abImage, "pfnModuleTerm");
4609	if (RT_FAILURE(rc))
4610	return rc;
4611
4612	/*
4613	* Allocate and copy the tables.
4614	* (No need to do try/except as this is a buffered request.)
4615	*/
4616	pImage->cbStrTab = pReq->u.In.cbStrTab;
4617	if (pImage->cbStrTab)
4618	{
4619	pImage->pachStrTab = (char *)RTMemAlloc(pImage->cbStrTab);
4620	if (pImage->pachStrTab)
4621	memcpy(pImage->pachStrTab, &pReq->u.In.abImage[pReq->u.In.offStrTab], pImage->cbStrTab);
4622	else
4623	rc = /VERR_NO_MEMORY/ VERR_INTERNAL_ERROR_3;
4624	}
4625
4626	pImage->cSymbols = pReq->u.In.cSymbols;
4627	if (RT_SUCCESS(rc) && pImage->cSymbols)
4628	{
4629	size_t cbSymbols = pImage->cSymbols * sizeof(SUPLDRSYM);
4630	pImage->paSymbols = (PSUPLDRSYM)RTMemAlloc(cbSymbols);
4631	if (pImage->paSymbols)
4632	memcpy(pImage->paSymbols, &pReq->u.In.abImage[pReq->u.In.offSymbols], cbSymbols);
4633	else
4634	rc = /VERR_NO_MEMORY/ VERR_INTERNAL_ERROR_4;
4635	}
4636
4637	/*
4638	* Copy the bits / complete native loading.
4639	*/
4640	if (RT_SUCCESS(rc))
4641	{
4642	pImage->uState = SUP_IOCTL_LDR_LOAD;
4643	pImage->pfnModuleInit = (PFNR0MODULEINIT)pReq->u.In.pfnModuleInit;
4644	pImage->pfnModuleTerm = (PFNR0MODULETERM)pReq->u.In.pfnModuleTerm;
4645
4646	if (pImage->fNative)
4647	rc = supdrvOSLdrLoad(pDevExt, pImage, pReq->u.In.abImage, pReq);
4648	else
4649	{
4650	memcpy(pImage->pvImage, &pReq->u.In.abImage[0], pImage->cbImageBits);
4651	Log(("vboxdrv: Loaded '%s' at %p\n", pImage->szName, pImage->pvImage));
4652	}
4653	}
4654
4655	/*
4656	* Update any entry points.
4657	*/
4658	if (RT_SUCCESS(rc))
4659	{
4660	switch (pReq->u.In.eEPType)
4661	{
4662	default:
4663	case SUPLDRLOADEP_NOTHING:
4664	rc = VINF_SUCCESS;
4665	break;
4666	case SUPLDRLOADEP_VMMR0:
4667	rc = supdrvLdrSetVMMR0EPs(pDevExt, pReq->u.In.EP.VMMR0.pvVMMR0, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt,
4668	pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx);
4669	break;
4670	case SUPLDRLOADEP_SERVICE:
4671	pImage->pfnServiceReqHandler = (PFNSUPR0SERVICEREQHANDLER)pReq->u.In.EP.Service.pfnServiceReq;
4672	rc = VINF_SUCCESS;
4673	break;
4674	}
4675	}
4676
4677	/*
4678	* On success call the module initialization.
4679	*/
4680	LogFlow(("supdrvIOCtl_LdrLoad: pfnModuleInit=%p\n", pImage->pfnModuleInit));
4681	if (RT_SUCCESS(rc) && pImage->pfnModuleInit)
4682	{
4683	Log(("supdrvIOCtl_LdrLoad: calling pfnModuleInit=%p\n", pImage->pfnModuleInit));
4684	pDevExt->pLdrInitImage = pImage;
4685	pDevExt->hLdrInitThread = RTThreadNativeSelf();
4686	rc = pImage->pfnModuleInit(pImage);
4687	pDevExt->pLdrInitImage = NULL;
4688	pDevExt->hLdrInitThread = NIL_RTNATIVETHREAD;
4689	if (RT_FAILURE(rc) && pDevExt->pvVMMR0 == pImage->pvImage)
4690	supdrvLdrUnsetVMMR0EPs(pDevExt);
4691	}
4692	SUPR0Printf("vboxdrv: %p %s\n", pImage->pvImage, pImage->szName);
4693
4694	if (RT_FAILURE(rc))
4695	{
4696	/* Inform the tracing component in case ModuleInit registered TPs. */
4697	supdrvTracerModuleUnloading(pDevExt, pImage);
4698
4699	pImage->uState = SUP_IOCTL_LDR_OPEN;
4700	pImage->pfnModuleInit = NULL;
4701	pImage->pfnModuleTerm = NULL;
4702	pImage->pfnServiceReqHandler= NULL;
4703	pImage->cbStrTab = 0;
4704	RTMemFree(pImage->pachStrTab);
4705	pImage->pachStrTab = NULL;
4706	RTMemFree(pImage->paSymbols);
4707	pImage->paSymbols = NULL;
4708	pImage->cSymbols = 0;
4709	}
4710
4711	supdrvLdrUnlock(pDevExt);
4712	return rc;
4713	}
4714
4715
4716	/**
4717	* Frees a previously loaded (prep'ed) image.
4718	*
4719	* @returns IPRT status code.
4720	* @param pDevExt Device globals.
4721	* @param pSession Session data.
4722	* @param pReq The request.
4723	*/
4724	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq)
4725	{
4726	int rc;
4727	PSUPDRVLDRUSAGE pUsagePrev;
4728	PSUPDRVLDRUSAGE pUsage;
4729	PSUPDRVLDRIMAGE pImage;
4730	LogFlow(("supdrvIOCtl_LdrFree: pvImageBase=%p\n", pReq->u.In.pvImageBase));
4731
4732	/*
4733	* Find the ldr image.
4734	*/
4735	supdrvLdrLock(pDevExt);
4736	pUsagePrev = NULL;
4737	pUsage = pSession->pLdrUsage;
4738	while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
4739	{
4740	pUsagePrev = pUsage;
4741	pUsage = pUsage->pNext;
4742	}
4743	if (!pUsage)
4744	{
4745	supdrvLdrUnlock(pDevExt);
4746	Log(("SUP_IOCTL_LDR_FREE: couldn't find image!\n"));
4747	return VERR_INVALID_HANDLE;
4748	}
4749
4750	/*
4751	* Check if we can remove anything.
4752	*/
4753	rc = VINF_SUCCESS;
4754	pImage = pUsage->pImage;
4755	if (pImage->cUsage <= 1 \|\| pUsage->cUsage <= 1)
4756	{
4757	/*
4758	* Check if there are any objects with destructors in the image, if
4759	* so leave it for the session cleanup routine so we get a chance to
4760	* clean things up in the right order and not leave them all dangling.
4761	*/
4762	RTSpinlockAcquire(pDevExt->Spinlock);
4763	if (pImage->cUsage <= 1)
4764	{
4765	PSUPDRVOBJ pObj;
4766	for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
4767	if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
4768	{
4769	rc = VERR_DANGLING_OBJECTS;
4770	break;
4771	}
4772	}
4773	else
4774	{
4775	PSUPDRVUSAGE pGenUsage;
4776	for (pGenUsage = pSession->pUsage; pGenUsage; pGenUsage = pGenUsage->pNext)
4777	if (RT_UNLIKELY((uintptr_t)pGenUsage->pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
4778	{
4779	rc = VERR_DANGLING_OBJECTS;
4780	break;
4781	}
4782	}
4783	RTSpinlockRelease(pDevExt->Spinlock);
4784	if (rc == VINF_SUCCESS)
4785	{
4786	/* unlink it */
4787	if (pUsagePrev)
4788	pUsagePrev->pNext = pUsage->pNext;
4789	else
4790	pSession->pLdrUsage = pUsage->pNext;
4791
4792	/* free it */
4793	pUsage->pImage = NULL;
4794	pUsage->pNext = NULL;
4795	RTMemFree(pUsage);
4796
4797	/*
4798	* Dereference the image.
4799	*/
4800	if (pImage->cUsage <= 1)
4801	supdrvLdrFree(pDevExt, pImage);
4802	else
4803	pImage->cUsage--;
4804	}
4805	else
4806	{
4807	Log(("supdrvIOCtl_LdrFree: Dangling objects in %p/%s!\n", pImage->pvImage, pImage->szName));
4808	rc = VINF_SUCCESS; /** @todo BRANCH-2.1: remove this after branching. */
4809	}
4810	}
4811	else
4812	{
4813	/*
4814	* Dereference both image and usage.
4815	*/
4816	pImage->cUsage--;
4817	pUsage->cUsage--;
4818	}
4819
4820	supdrvLdrUnlock(pDevExt);
4821	return rc;
4822	}
4823
4824
4825	/**
4826	* Lock down the image loader interface.
4827	*
4828	* @returns IPRT status code.
4829	* @param pDevExt Device globals.
4830	*/
4831	static int supdrvIOCtl_LdrLockDown(PSUPDRVDEVEXT pDevExt)
4832	{
4833	LogFlow(("supdrvIOCtl_LdrLockDown:\n"));
4834
4835	supdrvLdrLock(pDevExt);
4836	if (!pDevExt->fLdrLockedDown)
4837	{
4838	pDevExt->fLdrLockedDown = true;
4839	Log(("supdrvIOCtl_LdrLockDown: Image loader interface locked down\n"));
4840	}
4841	supdrvLdrUnlock(pDevExt);
4842
4843	return VINF_SUCCESS;
4844	}
4845
4846
4847	/**
4848	* Gets the address of a symbol in an open image.
4849	*
4850	* @returns IPRT status code.
4851	* @param pDevExt Device globals.
4852	* @param pSession Session data.
4853	* @param pReq The request buffer.
4854	*/
4855	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq)
4856	{
4857	PSUPDRVLDRIMAGE pImage;
4858	PSUPDRVLDRUSAGE pUsage;
4859	uint32_t i;
4860	PSUPLDRSYM paSyms;
4861	const char *pchStrings;
4862	const size_t cbSymbol = strlen(pReq->u.In.szSymbol) + 1;
4863	void *pvSymbol = NULL;
4864	int rc = VERR_GENERAL_FAILURE;
4865	Log3(("supdrvIOCtl_LdrGetSymbol: pvImageBase=%p szSymbol=\"%s\"\n", pReq->u.In.pvImageBase, pReq->u.In.szSymbol));
4866
4867	/*
4868	* Find the ldr image.
4869	*/
4870	supdrvLdrLock(pDevExt);
4871	pUsage = pSession->pLdrUsage;
4872	while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
4873	pUsage = pUsage->pNext;
4874	if (!pUsage)
4875	{
4876	supdrvLdrUnlock(pDevExt);
4877	Log(("SUP_IOCTL_LDR_GET_SYMBOL: couldn't find image!\n"));
4878	return VERR_INVALID_HANDLE;
4879	}
4880	pImage = pUsage->pImage;
4881	if (pImage->uState != SUP_IOCTL_LDR_LOAD)
4882	{
4883	unsigned uState = pImage->uState;
4884	supdrvLdrUnlock(pDevExt);
4885	Log(("SUP_IOCTL_LDR_GET_SYMBOL: invalid image state %d (%#x)!\n", uState, uState)); NOREF(uState);
4886	return VERR_ALREADY_LOADED;
4887	}
4888
4889	/*
4890	* Search the symbol strings.
4891	*
4892	* Note! The int32_t is for native loading on solaris where the data
4893	* and text segments are in very different places.
4894	*/
4895	pchStrings = pImage->pachStrTab;
4896	paSyms = pImage->paSymbols;
4897	for (i = 0; i < pImage->cSymbols; i++)
4898	{
4899	if ( paSyms[i].offName + cbSymbol <= pImage->cbStrTab
4900	&& !memcmp(pchStrings + paSyms[i].offName, pReq->u.In.szSymbol, cbSymbol))
4901	{
4902	pvSymbol = (uint8_t *)pImage->pvImage + (int32_t)paSyms[i].offSymbol;
4903	rc = VINF_SUCCESS;
4904	break;
4905	}
4906	}
4907	supdrvLdrUnlock(pDevExt);
4908	pReq->u.Out.pvSymbol = pvSymbol;
4909	return rc;
4910	}
4911
4912
4913	/**
4914	* Gets the address of a symbol in an open image or the support driver.
4915	*
4916	* @returns VINF_SUCCESS on success.
4917	* @returns
4918	* @param pDevExt Device globals.
4919	* @param pSession Session data.
4920	* @param pReq The request buffer.
4921	*/
4922	static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq)
4923	{
4924	int rc = VINF_SUCCESS;
4925	const char *pszSymbol = pReq->u.In.pszSymbol;
4926	const char *pszModule = pReq->u.In.pszModule;
4927	size_t cbSymbol;
4928	char const *pszEnd;
4929	uint32_t i;
4930
4931	/*
4932	* Input validation.
4933	*/
4934	AssertPtrReturn(pszSymbol, VERR_INVALID_POINTER);
4935	pszEnd = RTStrEnd(pszSymbol, 512);
4936	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4937	cbSymbol = pszEnd - pszSymbol + 1;
4938
4939	if (pszModule)
4940	{
4941	AssertPtrReturn(pszModule, VERR_INVALID_POINTER);
4942	pszEnd = RTStrEnd(pszModule, 64);
4943	AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4944	}
4945	Log3(("supdrvIDC_LdrGetSymbol: pszModule=%p:{%s} pszSymbol=%p:{%s}\n", pszModule, pszModule, pszSymbol, pszSymbol));
4946
4947
4948	if ( !pszModule
4949	\|\| !strcmp(pszModule, "SupDrv"))
4950	{
4951	/*
4952	* Search the support driver export table.
4953	*/
4954	for (i = 0; i < RT_ELEMENTS(g_aFunctions); i++)
4955	if (!strcmp(g_aFunctions[i].szName, pszSymbol))
4956	{
4957	pReq->u.Out.pfnSymbol = (PFNRT)g_aFunctions[i].pfn;
4958	break;
4959	}
4960	}
4961	else
4962	{
4963	/*
4964	* Find the loader image.
4965	*/
4966	PSUPDRVLDRIMAGE pImage;
4967
4968	supdrvLdrLock(pDevExt);
4969
4970	for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
4971	if (!strcmp(pImage->szName, pszModule))
4972	break;
4973	if (pImage && pImage->uState == SUP_IOCTL_LDR_LOAD)
4974	{
4975	/*
4976	* Search the symbol strings.
4977	*/
4978	const char *pchStrings = pImage->pachStrTab;
4979	PCSUPLDRSYM paSyms = pImage->paSymbols;
4980	for (i = 0; i < pImage->cSymbols; i++)
4981	{
4982	if ( paSyms[i].offName + cbSymbol <= pImage->cbStrTab
4983	&& !memcmp(pchStrings + paSyms[i].offName, pszSymbol, cbSymbol))
4984	{
4985	/*
4986	* Found it! Calc the symbol address and add a reference to the module.
4987	*/
4988	pReq->u.Out.pfnSymbol = (PFNRT)((uint8_t *)pImage->pvImage + (int32_t)paSyms[i].offSymbol);
4989	rc = supdrvLdrAddUsage(pSession, pImage);
4990	break;
4991	}
4992	}
4993	}
4994	else
4995	rc = pImage ? VERR_WRONG_ORDER : VERR_MODULE_NOT_FOUND;
4996
4997	supdrvLdrUnlock(pDevExt);
4998	}
4999	return rc;
5000	}
5001
5002
5003	/**
5004	* Updates the VMMR0 entry point pointers.
5005	*
5006	* @returns IPRT status code.
5007	* @param pDevExt Device globals.
5008	* @param pSession Session data.
5009	* @param pVMMR0 VMMR0 image handle.
5010	* @param pvVMMR0EntryInt VMMR0EntryInt address.
5011	* @param pvVMMR0EntryFast VMMR0EntryFast address.
5012	* @param pvVMMR0EntryEx VMMR0EntryEx address.
5013	* @remark Caller must own the loader mutex.
5014	*/
5015	static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0EntryInt, void pvVMMR0EntryFast, void pvVMMR0EntryEx)
5016	{
5017	int rc = VINF_SUCCESS;
5018	LogFlow(("supdrvLdrSetR0EP pvVMMR0=%p pvVMMR0EntryInt=%p\n", pvVMMR0, pvVMMR0EntryInt));
5019
5020
5021	/*
5022	* Check if not yet set.
5023	*/
5024	if (!pDevExt->pvVMMR0)
5025	{
5026	pDevExt->pvVMMR0 = pvVMMR0;
5027	(void *)&pDevExt->pfnVMMR0EntryInt = pvVMMR0EntryInt;
5028	(void *)&pDevExt->pfnVMMR0EntryFast = pvVMMR0EntryFast;
5029	(void *)&pDevExt->pfnVMMR0EntryEx = pvVMMR0EntryEx;
5030	ASMCompilerBarrier(); /* the above isn't nice, so be careful... */
5031	}
5032	else
5033	{
5034	/*
5035	* Return failure or success depending on whether the values match or not.
5036	*/
5037	if ( pDevExt->pvVMMR0 != pvVMMR0
5038	\|\| (void *)pDevExt->pfnVMMR0EntryInt != pvVMMR0EntryInt
5039	\|\| (void *)pDevExt->pfnVMMR0EntryFast != pvVMMR0EntryFast
5040	\|\| (void *)pDevExt->pfnVMMR0EntryEx != pvVMMR0EntryEx)
5041	{
5042	AssertMsgFailed(("SUP_IOCTL_LDR_SETR0EP: Already set pointing to a different module!\n"));
5043	rc = VERR_INVALID_PARAMETER;
5044	}
5045	}
5046	return rc;
5047	}
5048
5049
5050	/**
5051	* Unsets the VMMR0 entry point installed by supdrvLdrSetR0EP.
5052	*
5053	* @param pDevExt Device globals.
5054	*/
5055	static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt)
5056	{
5057	pDevExt->pvVMMR0 = NULL;
5058	pDevExt->pfnVMMR0EntryInt = NULL;
5059	pDevExt->pfnVMMR0EntryFast = NULL;
5060	pDevExt->pfnVMMR0EntryEx = NULL;
5061	}
5062
5063
5064	/**
5065	* Adds a usage reference in the specified session of an image.
5066	*
5067	* Called while owning the loader semaphore.
5068	*
5069	* @returns VINF_SUCCESS on success and VERR_NO_MEMORY on failure.
5070	* @param pSession Session in question.
5071	* @param pImage Image which the session is using.
5072	*/
5073	static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage)
5074	{
5075	PSUPDRVLDRUSAGE pUsage;
5076	LogFlow(("supdrvLdrAddUsage: pImage=%p\n", pImage));
5077
5078	/*
5079	* Referenced it already?
5080	*/
5081	pUsage = pSession->pLdrUsage;
5082	while (pUsage)
5083	{
5084	if (pUsage->pImage == pImage)
5085	{
5086	pUsage->cUsage++;
5087	return VINF_SUCCESS;
5088	}
5089	pUsage = pUsage->pNext;
5090	}
5091
5092	/*
5093	* Allocate new usage record.
5094	*/
5095	pUsage = (PSUPDRVLDRUSAGE)RTMemAlloc(sizeof(*pUsage));
5096	AssertReturn(pUsage, /VERR_NO_MEMORY/ VERR_INTERNAL_ERROR_5);
5097	pUsage->cUsage = 1;
5098	pUsage->pImage = pImage;
5099	pUsage->pNext = pSession->pLdrUsage;
5100	pSession->pLdrUsage = pUsage;
5101	return VINF_SUCCESS;
5102	}
5103
5104
5105	/**
5106	* Frees a load image.
5107	*
5108	* @param pDevExt Pointer to device extension.
5109	* @param pImage Pointer to the image we're gonna free.
5110	* This image must exit!
5111	* @remark The caller MUST own SUPDRVDEVEXT::mtxLdr!
5112	*/
5113	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage)
5114	{
5115	PSUPDRVLDRIMAGE pImagePrev;
5116	LogFlow(("supdrvLdrFree: pImage=%p\n", pImage));
5117
5118	/*
5119	* Warn if we're releasing images while the image loader interface is
5120	* locked down -- we won't be able to reload them!
5121	*/
5122	if (pDevExt->fLdrLockedDown)
5123	Log(("supdrvLdrFree: Warning: unloading '%s' image, while loader interface is locked down!\n", pImage->szName));
5124
5125	/* find it - arg. should've used doubly linked list. */
5126	Assert(pDevExt->pLdrImages);
5127	pImagePrev = NULL;
5128	if (pDevExt->pLdrImages != pImage)
5129	{
5130	pImagePrev = pDevExt->pLdrImages;
5131	while (pImagePrev->pNext != pImage)
5132	pImagePrev = pImagePrev->pNext;
5133	Assert(pImagePrev->pNext == pImage);
5134	}
5135
5136	/* unlink */
5137	if (pImagePrev)
5138	pImagePrev->pNext = pImage->pNext;
5139	else
5140	pDevExt->pLdrImages = pImage->pNext;
5141
5142	/* check if this is VMMR0.r0 unset its entry point pointers. */
5143	if (pDevExt->pvVMMR0 == pImage->pvImage)
5144	supdrvLdrUnsetVMMR0EPs(pDevExt);
5145
5146	/* check for objects with destructors in this image. (Shouldn't happen.) */
5147	if (pDevExt->pObjs)
5148	{
5149	unsigned cObjs = 0;
5150	PSUPDRVOBJ pObj;
5151	RTSpinlockAcquire(pDevExt->Spinlock);
5152	for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
5153	if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
5154	{
5155	pObj->pfnDestructor = NULL;
5156	cObjs++;
5157	}
5158	RTSpinlockRelease(pDevExt->Spinlock);
5159	if (cObjs)
5160	OSDBGPRINT(("supdrvLdrFree: Image '%s' has %d dangling objects!\n", pImage->szName, cObjs));
5161	}
5162
5163	/* call termination function if fully loaded. */
5164	if ( pImage->pfnModuleTerm
5165	&& pImage->uState == SUP_IOCTL_LDR_LOAD)
5166	{
5167	LogFlow(("supdrvIOCtl_LdrLoad: calling pfnModuleTerm=%p\n", pImage->pfnModuleTerm));
5168	pImage->pfnModuleTerm(pImage);
5169	}
5170
5171	/* Inform the tracing component. */
5172	supdrvTracerModuleUnloading(pDevExt, pImage);
5173
5174	/* do native unload if appropriate. */
5175	if (pImage->fNative)
5176	supdrvOSLdrUnload(pDevExt, pImage);
5177
5178	/* free the image */
5179	pImage->cUsage = 0;
5180	pImage->pDevExt = NULL;
5181	pImage->pNext = NULL;
5182	pImage->uState = SUP_IOCTL_LDR_FREE;
5183	RTMemExecFree(pImage->pvImageAlloc, pImage->cbImageBits + 31);
5184	pImage->pvImageAlloc = NULL;
5185	RTMemFree(pImage->pachStrTab);
5186	pImage->pachStrTab = NULL;
5187	RTMemFree(pImage->paSymbols);
5188	pImage->paSymbols = NULL;
5189	RTMemFree(pImage);
5190	}
5191
5192
5193	/**
5194	* Acquires the loader lock.
5195	*
5196	* @returns IPRT status code.
5197	* @param pDevExt The device extension.
5198	*/
5199	DECLINLINE(int) supdrvLdrLock(PSUPDRVDEVEXT pDevExt)
5200	{
5201	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
5202	int rc = RTSemMutexRequest(pDevExt->mtxLdr, RT_INDEFINITE_WAIT);
5203	#else
5204	int rc = RTSemFastMutexRequest(pDevExt->mtxLdr);
5205	#endif
5206	AssertRC(rc);
5207	return rc;
5208	}
5209
5210
5211	/**
5212	* Releases the loader lock.
5213	*
5214	* @returns IPRT status code.
5215	* @param pDevExt The device extension.
5216	*/
5217	DECLINLINE(int) supdrvLdrUnlock(PSUPDRVDEVEXT pDevExt)
5218	{
5219	#ifdef SUPDRV_USE_MUTEX_FOR_LDR
5220	return RTSemMutexRelease(pDevExt->mtxLdr);
5221	#else
5222	return RTSemFastMutexRelease(pDevExt->mtxLdr);
5223	#endif
5224	}
5225
5226
5227	/**
5228	* Implements the service call request.
5229	*
5230	* @returns VBox status code.
5231	* @param pDevExt The device extension.
5232	* @param pSession The calling session.
5233	* @param pReq The request packet, valid.
5234	*/
5235	static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq)
5236	{
5237	#if !defined(RT_OS_WINDOWS) \|\| defined(RT_ARCH_AMD64) \|\| defined(DEBUG)
5238	int rc;
5239
5240	/*
5241	* Find the module first in the module referenced by the calling session.
5242	*/
5243	rc = supdrvLdrLock(pDevExt);
5244	if (RT_SUCCESS(rc))
5245	{
5246	PFNSUPR0SERVICEREQHANDLER pfnServiceReqHandler = NULL;
5247	PSUPDRVLDRUSAGE pUsage;
5248
5249	for (pUsage = pSession->pLdrUsage; pUsage; pUsage = pUsage->pNext)
5250	if ( pUsage->pImage->pfnServiceReqHandler
5251	&& !strcmp(pUsage->pImage->szName, pReq->u.In.szName))
5252	{
5253	pfnServiceReqHandler = pUsage->pImage->pfnServiceReqHandler;
5254	break;
5255	}
5256	supdrvLdrUnlock(pDevExt);
5257
5258	if (pfnServiceReqHandler)
5259	{
5260	/*
5261	* Call it.
5262	*/
5263	if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
5264	rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, NULL);
5265	else
5266	rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0]);
5267	}
5268	else
5269	rc = VERR_SUPDRV_SERVICE_NOT_FOUND;
5270	}
5271
5272	/* log it */
5273	if ( RT_FAILURE(rc)
5274	&& rc != VERR_INTERRUPTED
5275	&& rc != VERR_TIMEOUT)
5276	Log(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
5277	rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
5278	else
5279	Log4(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
5280	rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
5281	return rc;
5282	#else /* RT_OS_WINDOWS && !RT_ARCH_AMD64 && !DEBUG */
5283	return VERR_NOT_IMPLEMENTED;
5284	#endif /* RT_OS_WINDOWS && !RT_ARCH_AMD64 && !DEBUG */
5285	}
5286
5287
5288	/**
5289	* Implements the logger settings request.
5290	*
5291	* @returns VBox status code.
5292	* @param pDevExt The device extension.
5293	* @param pSession The caller's session.
5294	* @param pReq The request.
5295	*/
5296	static int supdrvIOCtl_LoggerSettings(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLOGGERSETTINGS pReq)
5297	{
5298	const char *pszGroup = &pReq->u.In.szStrings[pReq->u.In.offGroups];
5299	const char *pszFlags = &pReq->u.In.szStrings[pReq->u.In.offFlags];
5300	const char *pszDest = &pReq->u.In.szStrings[pReq->u.In.offDestination];
5301	PRTLOGGER pLogger = NULL;
5302	int rc;
5303
5304	/*
5305	* Some further validation.
5306	*/
5307	switch (pReq->u.In.fWhat)
5308	{
5309	case SUPLOGGERSETTINGS_WHAT_SETTINGS:
5310	case SUPLOGGERSETTINGS_WHAT_CREATE:
5311	break;
5312
5313	case SUPLOGGERSETTINGS_WHAT_DESTROY:
5314	if (pszGroup \|\| pszFlags \|\| *pszDest)
5315	return VERR_INVALID_PARAMETER;
5316	if (pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_RELEASE)
5317	return VERR_ACCESS_DENIED;
5318	break;
5319
5320	default:
5321	return VERR_INTERNAL_ERROR;
5322	}
5323
5324	/*
5325	* Get the logger.
5326	*/
5327	switch (pReq->u.In.fWhich)
5328	{
5329	case SUPLOGGERSETTINGS_WHICH_DEBUG:
5330	pLogger = RTLogGetDefaultInstance();
5331	break;
5332
5333	case SUPLOGGERSETTINGS_WHICH_RELEASE:
5334	pLogger = RTLogRelGetDefaultInstance();
5335	break;
5336
5337	default:
5338	return VERR_INTERNAL_ERROR;
5339	}
5340
5341	/*
5342	* Do the job.
5343	*/
5344	switch (pReq->u.In.fWhat)
5345	{
5346	case SUPLOGGERSETTINGS_WHAT_SETTINGS:
5347	if (pLogger)
5348	{
5349	rc = RTLogFlags(pLogger, pszFlags);
5350	if (RT_SUCCESS(rc))
5351	rc = RTLogGroupSettings(pLogger, pszGroup);
5352	NOREF(pszDest);
5353	}
5354	else
5355	rc = VERR_NOT_FOUND;
5356	break;
5357
5358	case SUPLOGGERSETTINGS_WHAT_CREATE:
5359	{
5360	if (pLogger)
5361	rc = VERR_ALREADY_EXISTS;
5362	else
5363	{
5364	static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
5365
5366	rc = RTLogCreate(&pLogger,
5367	0 /* fFlags */,
5368	pszGroup,
5369	pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_DEBUG
5370	? "VBOX_LOG"
5371	: "VBOX_RELEASE_LOG",
5372	RT_ELEMENTS(s_apszGroups),
5373	s_apszGroups,
5374	RTLOGDEST_STDOUT \| RTLOGDEST_DEBUGGER,
5375	NULL);
5376	if (RT_SUCCESS(rc))
5377	{
5378	rc = RTLogFlags(pLogger, pszFlags);
5379	NOREF(pszDest);
5380	if (RT_SUCCESS(rc))
5381	{
5382	switch (pReq->u.In.fWhich)
5383	{
5384	case SUPLOGGERSETTINGS_WHICH_DEBUG:
5385	pLogger = RTLogSetDefaultInstance(pLogger);
5386	break;
5387	case SUPLOGGERSETTINGS_WHICH_RELEASE:
5388	pLogger = RTLogRelSetDefaultInstance(pLogger);
5389	break;
5390	}
5391	}
5392	RTLogDestroy(pLogger);
5393	}
5394	}
5395	break;
5396	}
5397
5398	case SUPLOGGERSETTINGS_WHAT_DESTROY:
5399	switch (pReq->u.In.fWhich)
5400	{
5401	case SUPLOGGERSETTINGS_WHICH_DEBUG:
5402	pLogger = RTLogSetDefaultInstance(NULL);
5403	break;
5404	case SUPLOGGERSETTINGS_WHICH_RELEASE:
5405	pLogger = RTLogRelSetDefaultInstance(NULL);
5406	break;
5407	}
5408	rc = RTLogDestroy(pLogger);
5409	break;
5410
5411	default:
5412	{
5413	rc = VERR_INTERNAL_ERROR;
5414	break;
5415	}
5416	}
5417
5418	return rc;
5419	}
5420
5421
5422	/**
5423	* Implements the MSR prober operations.
5424	*
5425	* @returns VBox status code.
5426	* @param pDevExt The device extension.
5427	* @param pReq The request.
5428	*/
5429	static int supdrvIOCtl_MsrProber(PSUPDRVDEVEXT pDevExt, PSUPMSRPROBER pReq)
5430	{
5431	#ifdef SUPDRV_WITH_MSR_PROBER
5432	RTCPUID const idCpu = pReq->u.In.idCpu == UINT32_MAX ? NIL_RTCPUID : pReq->u.In.idCpu;
5433	int rc;
5434
5435	switch (pReq->u.In.enmOp)
5436	{
5437	case SUPMSRPROBEROP_READ:
5438	{
5439	uint64_t uValue;
5440	rc = supdrvOSMsrProberRead(pReq->u.In.uMsr, idCpu, &uValue);
5441	if (RT_SUCCESS(rc))
5442	{
5443	pReq->u.Out.uResults.Read.uValue = uValue;
5444	pReq->u.Out.uResults.Read.fGp = false;
5445	}
5446	else if (rc == VERR_ACCESS_DENIED)
5447	{
5448	pReq->u.Out.uResults.Read.uValue = 0;
5449	pReq->u.Out.uResults.Read.fGp = true;
5450	rc = VINF_SUCCESS;
5451	}
5452	break;
5453	}
5454
5455	case SUPMSRPROBEROP_WRITE:
5456	rc = supdrvOSMsrProberWrite(pReq->u.In.uMsr, idCpu, pReq->u.In.uArgs.Write.uToWrite);
5457	if (RT_SUCCESS(rc))
5458	pReq->u.Out.uResults.Write.fGp = false;
5459	else if (rc == VERR_ACCESS_DENIED)
5460	{
5461	pReq->u.Out.uResults.Write.fGp = true;
5462	rc = VINF_SUCCESS;
5463	}
5464	break;
5465
5466	case SUPMSRPROBEROP_MODIFY:
5467	case SUPMSRPROBEROP_MODIFY_FASTER:
5468	rc = supdrvOSMsrProberModify(idCpu, pReq);
5469	break;
5470
5471	default:
5472	return VERR_INVALID_FUNCTION;
5473	}
5474	return rc;
5475	#else
5476	return VERR_NOT_IMPLEMENTED;
5477	#endif
5478	}
5479
5480
5481	/**
5482	* Resume built-in keyboard on MacBook Air and Pro hosts.
5483	* If there is no built-in keyboard device, return success anyway.
5484	*
5485	* @returns 0 on Mac OS X platform, VERR_NOT_IMPLEMENTED on the other ones.
5486	*/
5487	static int supdrvIOCtl_ResumeSuspendedKbds(void)
5488	{
5489	#if defined(RT_OS_DARWIN)
5490	return supdrvDarwinResumeSuspendedKbds();
5491	#else
5492	return VERR_NOT_IMPLEMENTED;
5493	#endif
5494	}
5495

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPDrv.cpp@ 55980

Download in other formats: