SUPDRVShared.c@ 1197

最後變更在這個檔案從1197是 1193,由 vboxsync 提交於 18 年前
Ported the support driver to OS/2.
屬性 svn:eol-style 設為 `native` 屬性 svn:keywords 設為 `Author Date Id Revision`
檔案大小: 142.9 KB

行
1	/** @file
2	*
3	* VBox host drivers - Ring-0 support drivers - Shared code:
4	* Driver code for all host platforms
5	*/
6
7	/*
8	* Copyright (C) 2006 InnoTek Systemberatung GmbH
9	*
10	* This file is part of VirtualBox Open Source Edition (OSE), as
11	* available from http://www.alldomusa.eu.org. This file is free software;
12	* you can redistribute it and/or modify it under the terms of the GNU
13	* General Public License as published by the Free Software Foundation,
14	* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
15	* distribution. VirtualBox OSE is distributed in the hope that it will
16	* be useful, but WITHOUT ANY WARRANTY of any kind.
17	*
18	* If you received this file as part of a commercial VirtualBox
19	* distribution, then only the terms of your commercial VirtualBox
20	* license agreement apply instead of the previous paragraph.
21	*/
22
23
24	/*******************************************************************************
25	* Header Files *
26	*******************************************************************************/
27	#include "SUPDRV.h"
28	#ifndef PAGE_SHIFT
29	# include <iprt/param.h>
30	#endif
31	#include <iprt/alloc.h>
32	#include <iprt/semaphore.h>
33	#include <iprt/spinlock.h>
34	#include <iprt/thread.h>
35	#include <iprt/process.h>
36	#include <iprt/log.h>
37	#ifdef VBOX_WITHOUT_IDT_PATCHING
38	# include <VBox/vmm.h>
39	#endif
40
41
42	/*******************************************************************************
43	* Defined Constants And Macros *
44	*******************************************************************************/
45	/* from x86.h - clashes with linux thus this duplication */
46	#undef X86_CR0_PG
47	#define X86_CR0_PG BIT(31)
48	#undef X86_CR0_PE
49	#define X86_CR0_PE BIT(0)
50	#undef X86_CPUID_AMD_FEATURE_EDX_NX
51	#define X86_CPUID_AMD_FEATURE_EDX_NX BIT(20)
52	#undef MSR_K6_EFER
53	#define MSR_K6_EFER 0xc0000080
54	#undef MSR_K6_EFER_NXE
55	#define MSR_K6_EFER_NXE BIT(11)
56	#undef MSR_K6_EFER_LMA
57	#define MSR_K6_EFER_LMA BIT(10)
58	#undef X86_CR4_PGE
59	#define X86_CR4_PGE BIT(7)
60	#undef X86_CR4_PAE
61	#define X86_CR4_PAE BIT(5)
62	#undef X86_CPUID_AMD_FEATURE_EDX_LONG_MODE
63	#define X86_CPUID_AMD_FEATURE_EDX_LONG_MODE BIT(29)
64
65
66	/** The frequency by which we recalculate the u32UpdateHz and
67	* u32UpdateIntervalNS GIP members. The value must be a power of 2. */
68	#define GIP_UPDATEHZ_RECALC_FREQ 0x800
69
70
71	/*******************************************************************************
72	* Global Variables *
73	*******************************************************************************/
74	/**
75	* Array of the R0 SUP API.
76	*/
77	static SUPFUNC g_aFunctions[] =
78	{
79	/* name function */
80	{ "SUPR0ObjRegister", (void *)SUPR0ObjRegister },
81	{ "SUPR0ObjAddRef", (void *)SUPR0ObjAddRef },
82	{ "SUPR0ObjRelease", (void *)SUPR0ObjRelease },
83	{ "SUPR0ObjVerifyAccess", (void *)SUPR0ObjVerifyAccess },
84	{ "SUPR0LockMem", (void *)SUPR0LockMem },
85	{ "SUPR0UnlockMem", (void *)SUPR0UnlockMem },
86	{ "SUPR0ContAlloc", (void *)SUPR0ContAlloc },
87	{ "SUPR0ContFree", (void *)SUPR0ContFree },
88	{ "SUPR0MemAlloc", (void *)SUPR0MemAlloc },
89	{ "SUPR0MemGetPhys", (void *)SUPR0MemGetPhys },
90	{ "SUPR0MemFree", (void *)SUPR0MemFree },
91	{ "SUPR0Printf", (void *)SUPR0Printf },
92	{ "RTMemAlloc", (void *)RTMemAlloc },
93	{ "RTMemAllocZ", (void *)RTMemAllocZ },
94	{ "RTMemFree", (void *)RTMemFree },
95	/* These doesn't work yet on linux - use fast mutexes!
96	{ "RTSemMutexCreate", (void *)RTSemMutexCreate },
97	{ "RTSemMutexRequest", (void *)RTSemMutexRequest },
98	{ "RTSemMutexRelease", (void *)RTSemMutexRelease },
99	{ "RTSemMutexDestroy", (void *)RTSemMutexDestroy },
100	*/
101	{ "RTSemFastMutexCreate", (void *)RTSemFastMutexCreate },
102	{ "RTSemFastMutexDestroy", (void *)RTSemFastMutexDestroy },
103	{ "RTSemFastMutexRequest", (void *)RTSemFastMutexRequest },
104	{ "RTSemFastMutexRelease", (void *)RTSemFastMutexRelease },
105	{ "RTSemEventCreate", (void *)RTSemEventCreate },
106	{ "RTSemEventSignal", (void *)RTSemEventSignal },
107	{ "RTSemEventWait", (void *)RTSemEventWait },
108	{ "RTSemEventDestroy", (void *)RTSemEventDestroy },
109	{ "RTSpinlockCreate", (void *)RTSpinlockCreate },
110	{ "RTSpinlockDestroy", (void *)RTSpinlockDestroy },
111	{ "RTSpinlockAcquire", (void *)RTSpinlockAcquire },
112	{ "RTSpinlockRelease", (void *)RTSpinlockRelease },
113	{ "RTSpinlockAcquireNoInts", (void *)RTSpinlockAcquireNoInts },
114	{ "RTSpinlockReleaseNoInts", (void *)RTSpinlockReleaseNoInts },
115	{ "RTThreadNativeSelf", (void *)RTThreadNativeSelf },
116	{ "RTThreadSleep", (void *)RTThreadSleep },
117	{ "RTThreadYield", (void *)RTThreadYield },
118	#if 0 /* Thread APIs, Part 2. */
119	{ "RTThreadSelf", (void *)RTThreadSelf },
120	{ "RTThreadCreate", (void *)RTThreadCreate },
121	{ "RTThreadGetNative", (void *)RTThreadGetNative },
122	{ "RTThreadWait", (void *)RTThreadWait },
123	{ "RTThreadWaitNoResume", (void *)RTThreadWaitNoResume },
124	{ "RTThreadGetName", (void *)RTThreadGetName },
125	{ "RTThreadSelfName", (void *)RTThreadSelfName },
126	{ "RTThreadGetType", (void *)RTThreadGetType },
127	{ "RTThreadUserSignal", (void *)RTThreadUserSignal },
128	{ "RTThreadUserReset", (void *)RTThreadUserReset },
129	{ "RTThreadUserWait", (void *)RTThreadUserWait },
130	{ "RTThreadUserWaitNoResume", (void *)RTThreadUserWaitNoResume },
131	#endif
132	{ "RTLogDefaultInstance", (void *)RTLogDefaultInstance },
133	{ "RTLogRelDefaultInstance", (void *)RTLogRelDefaultInstance },
134	{ "RTLogSetDefaultInstanceThread", (void *)RTLogSetDefaultInstanceThread },
135	{ "RTLogLogger", (void *)RTLogLogger },
136	{ "RTLogLoggerEx", (void *)RTLogLoggerEx },
137	{ "RTLogLoggerExV", (void *)RTLogLoggerExV },
138	{ "AssertMsg1", (void *)AssertMsg1 },
139	{ "AssertMsg2", (void *)AssertMsg2 },
140	};
141
142
143	/*******************************************************************************
144	* Internal Functions *
145	*******************************************************************************/
146	__BEGIN_DECLS
147	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession);
148	static int supdrvMemRelease(PSUPDRVSESSION pSession, void *pv, SUPDRVMEMREFTYPE eType);
149	#ifndef VBOX_WITHOUT_IDT_PATCHING
150	static int supdrvIOCtl_IdtInstall(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPIDTINSTALL_IN pIn, PSUPIDTINSTALL_OUT pOut);
151	static PSUPDRVPATCH supdrvIdtPatchOne(PSUPDRVDEVEXT pDevExt, PSUPDRVPATCH pPatch);
152	static int supdrvIOCtl_IdtRemoveAll(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession);
153	static void supdrvIdtRemoveOne(PSUPDRVDEVEXT pDevExt, PSUPDRVPATCH pPatch);
154	static void supdrvIdtWrite(volatile void pvIdtEntry, const SUPDRVIDTE pNewIDTEntry);
155	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
156	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN_IN pIn, PSUPLDROPEN_OUT pOut);
157	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD_IN pIn);
158	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE_IN pIn);
159	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL_IN pIn, PSUPLDRGETSYMBOL_OUT pOut);
160	static int supdrvLdrSetR0EP(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0Entry);
161	static void supdrvLdrUnsetR0EP(PSUPDRVDEVEXT pDevExt);
162	static void supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage);
163	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage);
164	static int supdrvIOCtl_GetPagingMode(PSUPGETPAGINGMODE_OUT pOut);
165	static SUPGIPMODE supdrvGipDeterminTscMode(void);
166	#ifdef USE_NEW_OS_INTERFACE
167	static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt);
168	static int supdrvGipDestroy(PSUPDRVDEVEXT pDevExt);
169	static DECLCALLBACK(void) supdrvGipTimer(PRTTIMER pTimer, void *pvUser);
170	#endif
171
172	__END_DECLS
173
174
175	/**
176	* Initializes the device extentsion structure.
177	*
178	* @returns 0 on success.
179	* @returns SUPDRV_ERR_ on failure.
180	* @param pDevExt The device extension to initialize.
181	*/
182	int VBOXCALL supdrvInitDevExt(PSUPDRVDEVEXT pDevExt)
183	{
184	/*
185	* Initialize it.
186	*/
187	int rc;
188	memset(pDevExt, 0, sizeof(*pDevExt));
189	rc = RTSpinlockCreate(&pDevExt->Spinlock);
190	if (!rc)
191	{
192	rc = RTSemFastMutexCreate(&pDevExt->mtxLdr);
193	if (!rc)
194	{
195	rc = RTSemFastMutexCreate(&pDevExt->mtxGip);
196	if (!rc)
197	{
198	#ifdef USE_NEW_OS_INTERFACE
199	rc = supdrvGipCreate(pDevExt);
200	if (RT_SUCCESS(rc))
201	{
202	pDevExt->u32Cookie = BIRD;
203	return 0;
204	}
205	#else
206	pDevExt->u32Cookie = BIRD;
207	return 0;
208	#endif
209	}
210	RTSemFastMutexDestroy(pDevExt->mtxLdr);
211	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
212	}
213	RTSpinlockDestroy(pDevExt->Spinlock);
214	pDevExt->Spinlock = NIL_RTSPINLOCK;
215	}
216	return rc;
217	}
218
219	/**
220	* Delete the device extension (e.g. cleanup members).
221	*
222	* @returns 0.
223	* @param pDevExt The device extension to delete.
224	*/
225	int VBOXCALL supdrvDeleteDevExt(PSUPDRVDEVEXT pDevExt)
226	{
227	#ifndef VBOX_WITHOUT_IDT_PATCHING
228	PSUPDRVPATCH pPatch;
229	#endif
230	PSUPDRVOBJ pObj;
231	PSUPDRVUSAGE pUsage;
232
233	/*
234	* Kill mutexes and spinlocks.
235	*/
236	RTSemFastMutexDestroy(pDevExt->mtxGip);
237	pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
238	RTSemFastMutexDestroy(pDevExt->mtxLdr);
239	pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
240	RTSpinlockDestroy(pDevExt->Spinlock);
241	pDevExt->Spinlock = NIL_RTSPINLOCK;
242
243	/*
244	* Free lists.
245	*/
246
247	#ifndef VBOX_WITHOUT_IDT_PATCHING
248	/* patches */
249	/** @todo make sure we don't uninstall patches which has been patched by someone else. */
250	pPatch = pDevExt->pIdtPatchesFree;
251	pDevExt->pIdtPatchesFree = NULL;
252	while (pPatch)
253	{
254	void *pvFree = pPatch;
255	pPatch = pPatch->pNext;
256	RTMemExecFree(pvFree);
257	}
258	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
259
260	/* objects. */
261	pObj = pDevExt->pObjs;
262	#if !defined(DEBUG_bird) \|\| !defined(__LINUX__) /* breaks unloading, temporary, remove me! */
263	Assert(!pObj); /* (can trigger on forced unloads) */
264	#endif
265	pDevExt->pObjs = NULL;
266	while (pObj)
267	{
268	void *pvFree = pObj;
269	pObj = pObj->pNext;
270	RTMemFree(pvFree);
271	}
272
273	/* usage records. */
274	pUsage = pDevExt->pUsageFree;
275	pDevExt->pUsageFree = NULL;
276	while (pUsage)
277	{
278	void *pvFree = pUsage;
279	pUsage = pUsage->pNext;
280	RTMemFree(pvFree);
281	}
282
283	#ifdef USE_NEW_OS_INTERFACE
284	/* kill the GIP */
285	supdrvGipDestroy(pDevExt);
286	#endif
287
288	return 0;
289	}
290
291
292	/**
293	* Create session.
294	*
295	* @returns 0 on success.
296	* @returns SUPDRV_ERR_ on failure.
297	* @param pDevExt Device extension.
298	* @param ppSession Where to store the pointer to the session data.
299	*/
300	int VBOXCALL supdrvCreateSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION *ppSession)
301	{
302	/*
303	* Allocate memory for the session data.
304	*/
305	int rc = SUPDRV_ERR_NO_MEMORY;
306	PSUPDRVSESSION pSession = ppSession = (PSUPDRVSESSION)RTMemAllocZ(sizeof(pSession));
307	if (pSession)
308	{
309	/* Initialize session data. */
310	rc = RTSpinlockCreate(&pSession->Spinlock);
311	if (!rc)
312	{
313	Assert(pSession->Spinlock != NIL_RTSPINLOCK);
314	pSession->pDevExt = pDevExt;
315	pSession->u32Cookie = BIRD_INV;
316	/*pSession->pLdrUsage = NULL;
317	pSession->pPatchUsage = NULL;
318	pSession->pUsage = NULL;
319	pSession->pGip = NULL;
320	pSession->fGipReferenced = false;
321	pSession->Bundle.cUsed = 0 */
322
323	dprintf(("Created session %p initial cookie=%#x\n", pSession, pSession->u32Cookie));
324	return 0;
325	}
326
327	RTMemFree(pSession);
328	*ppSession = NULL;
329	}
330
331	dprintf(("Failed to create spinlock, rc=%d!\n", rc));
332	return rc;
333	}
334
335
336	/**
337	* Shared code for cleaning up a session.
338	*
339	* @param pDevExt Device extension.
340	* @param pSession Session data.
341	* This data will be freed by this routine.
342	*/
343	void VBOXCALL supdrvCloseSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
344	{
345	/*
346	* Cleanup the session first.
347	*/
348	supdrvCleanupSession(pDevExt, pSession);
349
350	/*
351	* Free the rest of the session stuff.
352	*/
353	RTSpinlockDestroy(pSession->Spinlock);
354	pSession->Spinlock = NIL_RTSPINLOCK;
355	pSession->pDevExt = NULL;
356	RTMemFree(pSession);
357	dprintf2(("supdrvCloseSession: returns\n"));
358	}
359
360
361	/**
362	* Shared code for cleaning up a session (but not quite freeing it).
363	*
364	* This is primarily intended for MAC OS X where we have to clean up the memory
365	* stuff before the file handle is closed.
366	*
367	* @param pDevExt Device extension.
368	* @param pSession Session data.
369	* This data will be freed by this routine.
370	*/
371	void VBOXCALL supdrvCleanupSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
372	{
373	PSUPDRVBUNDLE pBundle;
374	dprintf(("supdrvCleanupSession: pSession=%p\n", pSession));
375
376	/*
377	* Remove logger instances related to this session.
378	* (This assumes the dprintf and dprintf2 macros doesn't use the normal logging.)
379	*/
380	RTLogSetDefaultInstanceThread(NULL, (uintptr_t)pSession);
381
382	#ifndef VBOX_WITHOUT_IDT_PATCHING
383	/*
384	* Uninstall any IDT patches installed for this session.
385	*/
386	supdrvIOCtl_IdtRemoveAll(pDevExt, pSession);
387	#endif
388
389	/*
390	* Release object references made in this session.
391	* In theory there should be noone racing us in this session.
392	*/
393	dprintf2(("release objects - start\n"));
394	if (pSession->pUsage)
395	{
396	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
397	PSUPDRVUSAGE pUsage;
398	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
399
400	while ((pUsage = pSession->pUsage) != NULL)
401	{
402	PSUPDRVOBJ pObj = pUsage->pObj;
403	pSession->pUsage = pUsage->pNext;
404
405	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
406	if (pUsage->cUsage < pObj->cUsage)
407	{
408	pObj->cUsage -= pUsage->cUsage;
409	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
410	}
411	else
412	{
413	/* Destroy the object and free the record. */
414	if (pDevExt->pObjs == pObj)
415	pDevExt->pObjs = pObj->pNext;
416	else
417	{
418	PSUPDRVOBJ pObjPrev;
419	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
420	if (pObjPrev->pNext == pObj)
421	{
422	pObjPrev->pNext = pObj->pNext;
423	break;
424	}
425	Assert(pObjPrev);
426	}
427	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
428
429	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
430	RTMemFree(pObj);
431	}
432
433	/* free it and continue. */
434	RTMemFree(pUsage);
435
436	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
437	}
438
439	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
440	AssertMsg(!pSession->pUsage, ("Some buster reregistered an object during desturction!\n"));
441	}
442	dprintf2(("release objects - done\n"));
443
444	/*
445	* Release memory allocated in the session.
446	*
447	* We do not serialize this as we assume that the application will
448	* not allocated memory while closing the file handle object.
449	*/
450	dprintf2(("freeing memory:\n"));
451	pBundle = &pSession->Bundle;
452	while (pBundle)
453	{
454	PSUPDRVBUNDLE pToFree;
455	unsigned i;
456
457	/*
458	* Check and unlock all entries in the bundle.
459	*/
460	for (i = 0; i < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]); i++)
461	{
462	#ifdef USE_NEW_OS_INTERFACE
463	if (pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ)
464	{
465	int rc;
466	if (pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ)
467	{
468	rc = RTR0MemObjFree(pBundle->aMem[i].MapObjR3, false);
469	AssertRC(rc); /** @todo figure out how to handle this. */
470	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
471	}
472	rc = RTR0MemObjFree(pBundle->aMem[i].MemObj, false);
473	AssertRC(rc); /** @todo figure out how to handle this. */
474	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
475	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
476	}
477
478	#else /* !USE_NEW_OS_INTERFACE */
479	if ( pBundle->aMem[i].pvR0
480	\|\| pBundle->aMem[i].pvR3)
481	{
482	dprintf2(("eType=%d pvR0=%p pvR3=%p cb=%d\n", pBundle->aMem[i].eType,
483	pBundle->aMem[i].pvR0, pBundle->aMem[i].pvR3, pBundle->aMem[i].cb));
484	switch (pBundle->aMem[i].eType)
485	{
486	case MEMREF_TYPE_LOCKED:
487	supdrvOSUnlockMemOne(&pBundle->aMem[i]);
488	break;
489	case MEMREF_TYPE_CONT:
490	supdrvOSContFreeOne(&pBundle->aMem[i]);
491	break;
492	case MEMREF_TYPE_LOW:
493	supdrvOSLowFreeOne(&pBundle->aMem[i]);
494	break;
495	case MEMREF_TYPE_MEM:
496	supdrvOSMemFreeOne(&pBundle->aMem[i]);
497	break;
498	default:
499	break;
500	}
501	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
502	}
503	#endif /* !USE_NEW_OS_INTERFACE */
504	}
505
506	/*
507	* Advance and free previous bundle.
508	*/
509	pToFree = pBundle;
510	pBundle = pBundle->pNext;
511
512	pToFree->pNext = NULL;
513	pToFree->cUsed = 0;
514	if (pToFree != &pSession->Bundle)
515	RTMemFree(pToFree);
516	}
517	dprintf2(("freeing memory - done\n"));
518
519	/*
520	* Loaded images needs to be dereferenced and possibly freed up.
521	*/
522	RTSemFastMutexRequest(pDevExt->mtxLdr);
523	dprintf2(("freeing images:\n"));
524	if (pSession->pLdrUsage)
525	{
526	PSUPDRVLDRUSAGE pUsage = pSession->pLdrUsage;
527	pSession->pLdrUsage = NULL;
528	while (pUsage)
529	{
530	void *pvFree = pUsage;
531	PSUPDRVLDRIMAGE pImage = pUsage->pImage;
532	if (pImage->cUsage > pUsage->cUsage)
533	pImage->cUsage -= pUsage->cUsage;
534	else
535	supdrvLdrFree(pDevExt, pImage);
536	pUsage->pImage = NULL;
537	pUsage = pUsage->pNext;
538	RTMemFree(pvFree);
539	}
540	}
541	RTSemFastMutexRelease(pDevExt->mtxLdr);
542	dprintf2(("freeing images - done\n"));
543
544	/*
545	* Unmap the GIP.
546	*/
547	dprintf2(("umapping GIP:\n"));
548	#ifdef USE_NEW_OS_INTERFACE
549	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
550	#else
551	if (pSession->pGip)
552	#endif
553	{
554	SUPR0GipUnmap(pSession);
555	#ifndef USE_NEW_OS_INTERFACE
556	pSession->pGip = NULL;
557	#endif
558	pSession->fGipReferenced = 0;
559	}
560	dprintf2(("umapping GIP - done\n"));
561	}
562
563
564	#ifdef VBOX_WITHOUT_IDT_PATCHING
565	/**
566	* Fast path I/O Control worker.
567	*
568	* @returns 0 on success.
569	* @returns One of the SUPDRV_ERR_* on failure.
570	* @param uIOCtl Function number.
571	* @param pDevExt Device extention.
572	* @param pSession Session data.
573	*/
574	int VBOXCALL supdrvIOCtlFast(unsigned uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
575	{
576	/*
577	* Disable interrupts before invoking VMMR0Entry() because it ASSUMES
578	* that interrupts are disabled. (We check the two prereqs after doing
579	* this only to allow the compiler to optimize things better.)
580	*/
581	int rc;
582	RTCCUINTREG uFlags = ASMGetFlags();
583	ASMIntDisable();
584
585	if (RT_LIKELY(pSession->pVM && pDevExt->pfnVMMR0Entry))
586	{
587	switch (uIOCtl)
588	{
589	case SUP_IOCTL_FAST_DO_RAW_RUN:
590	rc = pDevExt->pfnVMMR0Entry(pSession->pVM, VMMR0_DO_RAW_RUN, NULL);
591	break;
592	case SUP_IOCTL_FAST_DO_HWACC_RUN:
593	rc = pDevExt->pfnVMMR0Entry(pSession->pVM, VMMR0_DO_HWACC_RUN, NULL);
594	break;
595	case SUP_IOCTL_FAST_DO_NOP:
596	rc = pDevExt->pfnVMMR0Entry(pSession->pVM, VMMR0_DO_NOP, NULL);
597	break;
598	default:
599	rc = VERR_INTERNAL_ERROR;
600	break;
601	}
602	}
603	else
604	rc = VERR_INTERNAL_ERROR;
605
606	ASMSetFlags(uFlags);
607	return rc;
608	}
609	#endif /* VBOX_WITHOUT_IDT_PATCHING */
610
611
612	/**
613	* I/O Control worker.
614	*
615	* @returns 0 on success.
616	* @returns One of the SUPDRV_ERR_* on failure.
617	* @param uIOCtl Function number.
618	* @param pDevExt Device extention.
619	* @param pSession Session data.
620	* @param pvIn Input data.
621	* @param cbIn Size of input data.
622	* @param pvOut Output data.
623	* IMPORTANT! This buffer may be shared with the input
624	* data, thus no writing before done reading
625	* input data!!!
626	* @param cbOut Size of output data.
627	* @param pcbReturned Size of the returned data.
628	*/
629	int VBOXCALL supdrvIOCtl(unsigned int uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession,
630	void pvIn, unsigned cbIn, void pvOut, unsigned cbOut, unsigned *pcbReturned)
631	{
632	*pcbReturned = 0;
633	switch (uIOCtl)
634	{
635	case SUP_IOCTL_COOKIE:
636	{
637	PSUPCOOKIE_IN pIn = (PSUPCOOKIE_IN)pvIn;
638	PSUPCOOKIE_OUT pOut = (PSUPCOOKIE_OUT)pvOut;
639
640	/*
641	* Validate.
642	*/
643	if ( cbIn != sizeof(*pIn)
644	\|\| cbOut != sizeof(*pOut))
645	{
646	dprintf(("SUP_IOCTL_COOKIE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
647	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
648	return SUPDRV_ERR_INVALID_PARAM;
649	}
650	if (strncmp(pIn->szMagic, SUPCOOKIE_MAGIC, sizeof(pIn->szMagic)))
651	{
652	dprintf(("SUP_IOCTL_COOKIE: invalid magic %.16s\n", pIn->szMagic));
653	return SUPDRV_ERR_INVALID_MAGIC;
654	}
655	if (pIn->u32Version != SUPDRVIOC_VERSION)
656	{
657	dprintf(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Current: %#x\n", pIn->u32Version, SUPDRVIOC_VERSION));
658	return SUPDRV_ERR_VERSION_MISMATCH;
659	}
660
661	/*
662	* Fill in return data and be gone.
663	*/
664	/** @todo secure cookie negotiation? */
665	pOut->u32Cookie = pDevExt->u32Cookie;
666	pOut->u32SessionCookie = pSession->u32Cookie;
667	pOut->u32Version = SUPDRVIOC_VERSION;
668	pOut->pSession = pSession;
669	pOut->cFunctions = sizeof(g_aFunctions) / sizeof(g_aFunctions[0]);
670	pcbReturned = sizeof(pOut);
671	return 0;
672	}
673
674
675	case SUP_IOCTL_QUERY_FUNCS:
676	{
677	unsigned cFunctions;
678	PSUPQUERYFUNCS_IN pIn = (PSUPQUERYFUNCS_IN)pvIn;
679	PSUPQUERYFUNCS_OUT pOut = (PSUPQUERYFUNCS_OUT)pvOut;
680
681	/*
682	* Validate.
683	*/
684	if ( cbIn != sizeof(*pIn)
685	\|\| cbOut < sizeof(*pOut))
686	{
687	dprintf(("SUP_IOCTL_QUERY_FUNCS: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
688	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
689	return SUPDRV_ERR_INVALID_PARAM;
690	}
691	if ( pIn->u32Cookie != pDevExt->u32Cookie
692	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
693	{
694	dprintf(("SUP_IOCTL_QUERY_FUNCS: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
695	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
696	return SUPDRV_ERR_INVALID_MAGIC;
697	}
698
699	/*
700	* Copy the functions.
701	*/
702	cFunctions = (cbOut - RT_OFFSETOF(SUPQUERYFUNCS_OUT, aFunctions)) / sizeof(pOut->aFunctions[0]);
703	cFunctions = RT_MIN(cFunctions, ELEMENTS(g_aFunctions));
704	AssertMsg(cFunctions == ELEMENTS(g_aFunctions),
705	("Why aren't R3 querying all the functions!?! cFunctions=%d while there are %d available\n",
706	cFunctions, ELEMENTS(g_aFunctions)));
707	pOut->cFunctions = cFunctions;
708	memcpy(&pOut->aFunctions[0], g_aFunctions, sizeof(pOut->aFunctions[0]) * cFunctions);
709	*pcbReturned = RT_OFFSETOF(SUPQUERYFUNCS_OUT, aFunctions[cFunctions]);
710	return 0;
711	}
712
713
714	case SUP_IOCTL_IDT_INSTALL:
715	{
716	PSUPIDTINSTALL_IN pIn = (PSUPIDTINSTALL_IN)pvIn;
717	PSUPIDTINSTALL_OUT pOut = (PSUPIDTINSTALL_OUT)pvOut;
718
719	/*
720	* Validate.
721	*/
722	if ( cbIn != sizeof(*pIn)
723	\|\| cbOut != sizeof(*pOut))
724	{
725	dprintf(("SUP_IOCTL_INSTALL: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
726	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
727	return SUPDRV_ERR_INVALID_PARAM;
728	}
729	if ( pIn->u32Cookie != pDevExt->u32Cookie
730	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
731	{
732	dprintf(("SUP_IOCTL_INSTALL: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
733	pIn->u32Cookie, pDevExt->u32Cookie,
734	pIn->u32SessionCookie, pSession->u32Cookie));
735	return SUPDRV_ERR_INVALID_MAGIC;
736	}
737
738	pcbReturned = sizeof(pOut);
739	#ifndef VBOX_WITHOUT_IDT_PATCHING
740	return supdrvIOCtl_IdtInstall(pDevExt, pSession, pIn, pOut);
741	#else
742	pOut->u8Idt = 3;
743	return 0;
744	#endif
745	}
746
747
748	case SUP_IOCTL_IDT_REMOVE:
749	{
750	PSUPIDTREMOVE_IN pIn = (PSUPIDTREMOVE_IN)pvIn;
751
752	/*
753	* Validate.
754	*/
755	if ( cbIn != sizeof(*pIn)
756	\|\| cbOut != 0)
757	{
758	dprintf(("SUP_IOCTL_REMOVE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
759	cbIn, sizeof(*pIn), cbOut, 0));
760	return SUPDRV_ERR_INVALID_PARAM;
761	}
762	if ( pIn->u32Cookie != pDevExt->u32Cookie
763	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
764	{
765	dprintf(("SUP_IOCTL_REMOVE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
766	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
767	return SUPDRV_ERR_INVALID_MAGIC;
768	}
769
770	#ifndef VBOX_WITHOUT_IDT_PATCHING
771	return supdrvIOCtl_IdtRemoveAll(pDevExt, pSession);
772	#else
773	return 0;
774	#endif
775	}
776
777
778	case SUP_IOCTL_PINPAGES:
779	{
780	int rc;
781	PSUPPINPAGES_IN pIn = (PSUPPINPAGES_IN)pvIn;
782	PSUPPINPAGES_OUT pOut = (PSUPPINPAGES_OUT)pvOut;
783
784	/*
785	* Validate.
786	*/
787	if ( cbIn != sizeof(*pIn)
788	\|\| cbOut < sizeof(*pOut))
789	{
790	dprintf(("SUP_IOCTL_PINPAGES: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
791	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
792	return SUPDRV_ERR_INVALID_PARAM;
793	}
794	if ( pIn->u32Cookie != pDevExt->u32Cookie
795	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
796	{
797	dprintf(("SUP_IOCTL_PINPAGES: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
798	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
799	return SUPDRV_ERR_INVALID_MAGIC;
800	}
801	if (pIn->cb <= 0 \|\| !pIn->pv)
802	{
803	dprintf(("SUP_IOCTL_PINPAGES: Illegal request %p %d\n", pIn->pv, pIn->cb));
804	return SUPDRV_ERR_INVALID_PARAM;
805	}
806	if ((unsigned)RT_OFFSETOF(SUPPINPAGES_OUT, aPages[pIn->cb >> PAGE_SHIFT]) > cbOut)
807	{
808	dprintf(("SUP_IOCTL_PINPAGES: Output buffer is too small! %d required %d passed in.\n",
809	RT_OFFSETOF(SUPPINPAGES_OUT, aPages[pIn->cb >> PAGE_SHIFT]), cbOut));
810	return SUPDRV_ERR_INVALID_PARAM;
811	}
812
813	/*
814	* Execute.
815	*/
816	*pcbReturned = RT_OFFSETOF(SUPPINPAGES_OUT, aPages[pIn->cb >> PAGE_SHIFT]);
817	rc = SUPR0LockMem(pSession, pIn->pv, pIn->cb, &pOut->aPages[0]);
818	if (rc)
819	*pcbReturned = 0;
820	return rc;
821	}
822
823
824	case SUP_IOCTL_UNPINPAGES:
825	{
826	PSUPUNPINPAGES_IN pIn = (PSUPUNPINPAGES_IN)pvIn;
827
828	/*
829	* Validate.
830	*/
831	if ( cbIn != sizeof(*pIn)
832	\|\| cbOut != 0)
833	{
834	dprintf(("SUP_IOCTL_UNPINPAGES: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
835	cbIn, sizeof(*pIn), cbOut, 0));
836	return SUPDRV_ERR_INVALID_PARAM;
837	}
838	if ( pIn->u32Cookie != pDevExt->u32Cookie
839	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
840	{
841	dprintf(("SUP_IOCTL_UNPINPAGES: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
842	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
843	return SUPDRV_ERR_INVALID_MAGIC;
844	}
845
846	/*
847	* Execute.
848	*/
849	return SUPR0UnlockMem(pSession, pIn->pv);
850	}
851
852	case SUP_IOCTL_CONT_ALLOC:
853	{
854	int rc;
855	PSUPCONTALLOC_IN pIn = (PSUPCONTALLOC_IN)pvIn;
856	PSUPCONTALLOC_OUT pOut = (PSUPCONTALLOC_OUT)pvOut;
857
858	/*
859	* Validate.
860	*/
861	if ( cbIn != sizeof(*pIn)
862	\|\| cbOut < sizeof(*pOut))
863	{
864	dprintf(("SUP_IOCTL_CONT_ALLOC: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
865	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
866	return SUPDRV_ERR_INVALID_PARAM;
867	}
868	if ( pIn->u32Cookie != pDevExt->u32Cookie
869	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
870	{
871	dprintf(("SUP_IOCTL_CONT_ALLOC: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
872	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
873	return SUPDRV_ERR_INVALID_MAGIC;
874	}
875
876	/*
877	* Execute.
878	*/
879	rc = SUPR0ContAlloc(pSession, pIn->cb, &pOut->pvR0, &pOut->pvR3, &pOut->HCPhys);
880	if (!rc)
881	pcbReturned = sizeof(pOut);
882	return rc;
883	}
884
885
886	case SUP_IOCTL_CONT_FREE:
887	{
888	PSUPCONTFREE_IN pIn = (PSUPCONTFREE_IN)pvIn;
889
890	/*
891	* Validate.
892	*/
893	if ( cbIn != sizeof(*pIn)
894	\|\| cbOut != 0)
895	{
896	dprintf(("SUP_IOCTL_CONT_FREE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
897	cbIn, sizeof(*pIn), cbOut, 0));
898	return SUPDRV_ERR_INVALID_PARAM;
899	}
900	if ( pIn->u32Cookie != pDevExt->u32Cookie
901	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
902	{
903	dprintf(("SUP_IOCTL_CONT_FREE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
904	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
905	return SUPDRV_ERR_INVALID_MAGIC;
906	}
907
908	/*
909	* Execute.
910	*/
911	return SUPR0ContFree(pSession, pIn->pv);
912	}
913
914
915	case SUP_IOCTL_LDR_OPEN:
916	{
917	PSUPLDROPEN_IN pIn = (PSUPLDROPEN_IN)pvIn;
918	PSUPLDROPEN_OUT pOut = (PSUPLDROPEN_OUT)pvOut;
919
920	/*
921	* Validate.
922	*/
923	if ( cbIn != sizeof(*pIn)
924	\|\| cbOut != sizeof(*pOut))
925	{
926	dprintf(("SUP_IOCTL_LDR_OPEN: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
927	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
928	return SUPDRV_ERR_INVALID_PARAM;
929	}
930	if ( pIn->u32Cookie != pDevExt->u32Cookie
931	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
932	{
933	dprintf(("SUP_IOCTL_LDR_OPEN: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
934	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
935	return SUPDRV_ERR_INVALID_MAGIC;
936	}
937	if ( pIn->cbImage <= 0
938	\|\| pIn->cbImage >= 1610241024 /16MB/)
939	{
940	dprintf(("SUP_IOCTL_LDR_OPEN: Invalid size %d. (max is 16MB)\n", pIn->cbImage));
941	return SUPDRV_ERR_INVALID_PARAM;
942	}
943	if (!memchr(pIn->szName, '\0', sizeof(pIn->szName)))
944	{
945	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: The image name isn't terminated!\n"));
946	return SUPDRV_ERR_INVALID_PARAM;
947	}
948	if (!pIn->szName[0])
949	{
950	dprintf(("SUP_IOCTL_LDR_OPEN: The image name is too short\n"));
951	return SUPDRV_ERR_INVALID_PARAM;
952	}
953	if (strpbrk(pIn->szName, ";:()[]{}/\\\|&*%#@!~`\"'"))
954	{
955	dprintf(("SUP_IOCTL_LDR_OPEN: The name is invalid '%s'\n", pIn->szName));
956	return SUPDRV_ERR_INVALID_PARAM;
957	}
958
959	pcbReturned = sizeof(pOut);
960	return supdrvIOCtl_LdrOpen(pDevExt, pSession, pIn, pOut);
961	}
962
963
964	case SUP_IOCTL_LDR_LOAD:
965	{
966	PSUPLDRLOAD_IN pIn = (PSUPLDRLOAD_IN)pvIn;
967
968	/*
969	* Validate.
970	*/
971	if ( cbIn <= sizeof(*pIn)
972	\|\| cbOut != 0)
973	{
974	dprintf(("SUP_IOCTL_LDR_LOAD: Invalid input/output sizes. cbIn=%d expected greater than %d. cbOut=%d expected %d.\n",
975	cbIn, sizeof(*pIn), cbOut, 0));
976	return SUPDRV_ERR_INVALID_PARAM;
977	}
978	if ( pIn->u32Cookie != pDevExt->u32Cookie
979	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
980	{
981	dprintf(("SUP_IOCTL_LDR_LOAD: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
982	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
983	return SUPDRV_ERR_INVALID_MAGIC;
984	}
985	if ((unsigned)RT_OFFSETOF(SUPLDRLOAD_IN, achImage[pIn->cbImage]) > cbIn)
986	{
987	dprintf(("SUP_IOCTL_LDR_LOAD: Invalid size %d. InputBufferLength=%d\n",
988	pIn->cbImage, cbIn));
989	return SUPDRV_ERR_INVALID_PARAM;
990	}
991	if (pIn->cSymbols > 16384)
992	{
993	dprintf(("SUP_IOCTL_LDR_LOAD: Too many symbols. cSymbols=%u max=16384\n", pIn->cSymbols));
994	return SUPDRV_ERR_INVALID_PARAM;
995	}
996	if ( pIn->cSymbols
997	&& ( pIn->offSymbols >= pIn->cbImage
998	\|\| pIn->offSymbols + pIn->cSymbols * sizeof(SUPLDRSYM) > pIn->cbImage)
999	)
1000	{
1001	dprintf(("SUP_IOCTL_LDR_LOAD: symbol table is outside the image bits! offSymbols=%u cSymbols=%d cbImage=%d\n",
1002	pIn->offSymbols, pIn->cSymbols, pIn->cbImage));
1003	return SUPDRV_ERR_INVALID_PARAM;
1004	}
1005	if ( pIn->cbStrTab
1006	&& ( pIn->offStrTab >= pIn->cbImage
1007	\|\| pIn->offStrTab + pIn->cbStrTab > pIn->cbImage
1008	\|\| pIn->offStrTab + pIn->cbStrTab < pIn->offStrTab)
1009	)
1010	{
1011	dprintf(("SUP_IOCTL_LDR_LOAD: string table is outside the image bits! offStrTab=%u cbStrTab=%d cbImage=%d\n",
1012	pIn->offStrTab, pIn->cbStrTab, pIn->cbImage));
1013	return SUPDRV_ERR_INVALID_PARAM;
1014	}
1015
1016	if (pIn->cSymbols)
1017	{
1018	uint32_t i;
1019	PSUPLDRSYM paSyms = (PSUPLDRSYM)&pIn->achImage[pIn->offSymbols];
1020	for (i = 0; i < pIn->cSymbols; i++)
1021	{
1022	if (paSyms[i].offSymbol >= pIn->cbImage)
1023	{
1024	dprintf(("SUP_IOCTL_LDR_LOAD: symbol i=%d has an invalid symbol offset: %#x (max=%#x)\n",
1025	i, paSyms[i].offSymbol, pIn->cbImage));
1026	return SUPDRV_ERR_INVALID_PARAM;
1027	}
1028	if (paSyms[i].offName >= pIn->cbStrTab)
1029	{
1030	dprintf(("SUP_IOCTL_LDR_LOAD: symbol i=%d has an invalid name offset: %#x (max=%#x)\n",
1031	i, paSyms[i].offName, pIn->cbStrTab));
1032	return SUPDRV_ERR_INVALID_PARAM;
1033	}
1034	if (!memchr(&pIn->achImage[pIn->offStrTab + paSyms[i].offName], '\0', pIn->cbStrTab - paSyms[i].offName))
1035	{
1036	dprintf(("SUP_IOCTL_LDR_LOAD: symbol i=%d has an unterminated name! offName=%#x (max=%#x)\n",
1037	i, paSyms[i].offName, pIn->cbStrTab));
1038	return SUPDRV_ERR_INVALID_PARAM;
1039	}
1040	}
1041	}
1042
1043	return supdrvIOCtl_LdrLoad(pDevExt, pSession, pIn);
1044	}
1045
1046
1047	case SUP_IOCTL_LDR_FREE:
1048	{
1049	PSUPLDRFREE_IN pIn = (PSUPLDRFREE_IN)pvIn;
1050
1051	/*
1052	* Validate.
1053	*/
1054	if ( cbIn != sizeof(*pIn)
1055	\|\| cbOut != 0)
1056	{
1057	dprintf(("SUP_IOCTL_LDR_FREE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1058	cbIn, sizeof(*pIn), cbOut, 0));
1059	return SUPDRV_ERR_INVALID_PARAM;
1060	}
1061	if ( pIn->u32Cookie != pDevExt->u32Cookie
1062	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1063	{
1064	dprintf(("SUP_IOCTL_LDR_FREE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1065	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1066	return SUPDRV_ERR_INVALID_MAGIC;
1067	}
1068
1069	return supdrvIOCtl_LdrFree(pDevExt, pSession, pIn);
1070	}
1071
1072
1073	case SUP_IOCTL_LDR_GET_SYMBOL:
1074	{
1075	PSUPLDRGETSYMBOL_IN pIn = (PSUPLDRGETSYMBOL_IN)pvIn;
1076	PSUPLDRGETSYMBOL_OUT pOut = (PSUPLDRGETSYMBOL_OUT)pvOut;
1077	char *pszEnd;
1078
1079	/*
1080	* Validate.
1081	*/
1082	if ( cbIn < (unsigned)RT_OFFSETOF(SUPLDRGETSYMBOL_IN, szSymbol[2])
1083	\|\| cbOut != sizeof(*pOut))
1084	{
1085	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: Invalid input/output sizes. cbIn=%d expected >=%d. cbOut=%d expected at%d.\n",
1086	cbIn, RT_OFFSETOF(SUPLDRGETSYMBOL_IN, szSymbol[2]), cbOut, 0));
1087	return SUPDRV_ERR_INVALID_PARAM;
1088	}
1089	if ( pIn->u32Cookie != pDevExt->u32Cookie
1090	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1091	{
1092	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1093	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1094	return SUPDRV_ERR_INVALID_MAGIC;
1095	}
1096	pszEnd = memchr(pIn->szSymbol, '\0', cbIn - RT_OFFSETOF(SUPLDRGETSYMBOL_IN, szSymbol));
1097	if (!pszEnd)
1098	{
1099	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: The symbol name isn't terminated!\n"));
1100	return SUPDRV_ERR_INVALID_PARAM;
1101	}
1102	if (pszEnd - &pIn->szSymbol[0] >= 1024)
1103	{
1104	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: The symbol name too long (%d chars, max is %d)!\n",
1105	pszEnd - &pIn->szSymbol[0], 1024));
1106	return SUPDRV_ERR_INVALID_PARAM;
1107	}
1108
1109	pOut->pvSymbol = NULL;
1110	pcbReturned = sizeof(pOut);
1111	return supdrvIOCtl_LdrGetSymbol(pDevExt, pSession, pIn, pOut);
1112	}
1113
1114
1115	/** @todo this interface needs re-doing, we're accessing Ring-3 buffers directly here! */
1116	case SUP_IOCTL_CALL_VMMR0:
1117	{
1118	PSUPCALLVMMR0_IN pIn = (PSUPCALLVMMR0_IN)pvIn;
1119	PSUPCALLVMMR0_OUT pOut = (PSUPCALLVMMR0_OUT)pvOut;
1120
1121	/*
1122	* Validate.
1123	*/
1124	if ( cbIn != sizeof(*pIn)
1125	\|\| cbOut != sizeof(*pOut))
1126	{
1127	dprintf(("SUP_IOCTL_CALL_VMMR0: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1128	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
1129	return SUPDRV_ERR_INVALID_PARAM;
1130	}
1131	if ( pIn->u32Cookie != pDevExt->u32Cookie
1132	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
1133	{
1134	dprintf(("SUP_IOCTL_CALL_VMMR0: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1135	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1136	return SUPDRV_ERR_INVALID_MAGIC;
1137	}
1138
1139	/*
1140	* Do we have an entrypoint?
1141	*/
1142	if (!pDevExt->pfnVMMR0Entry)
1143	return SUPDRV_ERR_GENERAL_FAILURE;
1144
1145	/*
1146	* Execute.
1147	*/
1148	pOut->rc = pDevExt->pfnVMMR0Entry(pIn->pVMR0, pIn->uOperation, pIn->pvArg);
1149	pcbReturned = sizeof(pOut);
1150	return 0;
1151	}
1152
1153
1154	case SUP_IOCTL_GET_PAGING_MODE:
1155	{
1156	int rc;
1157	PSUPGETPAGINGMODE_IN pIn = (PSUPGETPAGINGMODE_IN)pvIn;
1158	PSUPGETPAGINGMODE_OUT pOut = (PSUPGETPAGINGMODE_OUT)pvOut;
1159
1160	/*
1161	* Validate.
1162	*/
1163	if ( cbIn != sizeof(*pIn)
1164	\|\| cbOut != sizeof(*pOut))
1165	{
1166	dprintf(("SUP_IOCTL_GET_PAGING_MODE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1167	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
1168	return SUPDRV_ERR_INVALID_PARAM;
1169	}
1170	if ( pIn->u32Cookie != pDevExt->u32Cookie
1171	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
1172	{
1173	dprintf(("SUP_IOCTL_GET_PAGING_MODE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1174	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1175	return SUPDRV_ERR_INVALID_MAGIC;
1176	}
1177
1178	/*
1179	* Execute.
1180	*/
1181	pcbReturned = sizeof(pOut);
1182	rc = supdrvIOCtl_GetPagingMode(pOut);
1183	if (rc)
1184	*pcbReturned = 0;
1185	return rc;
1186	}
1187
1188
1189	case SUP_IOCTL_LOW_ALLOC:
1190	{
1191	int rc;
1192	PSUPLOWALLOC_IN pIn = (PSUPLOWALLOC_IN)pvIn;
1193	PSUPLOWALLOC_OUT pOut = (PSUPLOWALLOC_OUT)pvOut;
1194
1195	/*
1196	* Validate.
1197	*/
1198	if ( cbIn != sizeof(*pIn)
1199	\|\| cbOut < sizeof(*pOut))
1200	{
1201	dprintf(("SUP_IOCTL_LOW_ALLOC: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1202	cbIn, sizeof(pIn), cbOut, sizeof(pOut)));
1203	return SUPDRV_ERR_INVALID_PARAM;
1204	}
1205	if ( pIn->u32Cookie != pDevExt->u32Cookie
1206	\|\| pIn->u32SessionCookie != pSession->u32Cookie )
1207	{
1208	dprintf(("SUP_IOCTL_LOW_ALLOC: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1209	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1210	return SUPDRV_ERR_INVALID_MAGIC;
1211	}
1212	if ((unsigned)RT_OFFSETOF(SUPLOWALLOC_OUT, aPages[pIn->cPages]) > cbOut)
1213	{
1214	dprintf(("SUP_IOCTL_LOW_ALLOC: Output buffer is too small! %d required %d passed in.\n",
1215	RT_OFFSETOF(SUPLOWALLOC_OUT, aPages[pIn->cPages]), cbOut));
1216	return SUPDRV_ERR_INVALID_PARAM;
1217	}
1218
1219	/*
1220	* Execute.
1221	*/
1222	*pcbReturned = RT_OFFSETOF(SUPLOWALLOC_OUT, aPages[pIn->cPages]);
1223	rc = SUPR0LowAlloc(pSession, pIn->cPages, &pOut->pvVirt, &pOut->aPages[0]);
1224	if (rc)
1225	*pcbReturned = 0;
1226	return rc;
1227	}
1228
1229
1230	case SUP_IOCTL_LOW_FREE:
1231	{
1232	PSUPLOWFREE_IN pIn = (PSUPLOWFREE_IN)pvIn;
1233
1234	/*
1235	* Validate.
1236	*/
1237	if ( cbIn != sizeof(*pIn)
1238	\|\| cbOut != 0)
1239	{
1240	dprintf(("SUP_IOCTL_LOW_FREE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1241	cbIn, sizeof(*pIn), cbOut, 0));
1242	return SUPDRV_ERR_INVALID_PARAM;
1243	}
1244	if ( pIn->u32Cookie != pDevExt->u32Cookie
1245	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1246	{
1247	dprintf(("SUP_IOCTL_LOW_FREE: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1248	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1249	return SUPDRV_ERR_INVALID_MAGIC;
1250	}
1251
1252	/*
1253	* Execute.
1254	*/
1255	return SUPR0LowFree(pSession, pIn->pv);
1256	}
1257
1258
1259	case SUP_IOCTL_GIP_MAP:
1260	{
1261	int rc;
1262	PSUPGIPMAP_IN pIn = (PSUPGIPMAP_IN)pvIn;
1263	PSUPGIPMAP_OUT pOut = (PSUPGIPMAP_OUT)pvOut;
1264
1265	/*
1266	* Validate.
1267	*/
1268	if ( cbIn != sizeof(*pIn)
1269	\|\| cbOut != sizeof(*pOut))
1270	{
1271	dprintf(("SUP_IOCTL_GIP_MAP: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1272	cbIn, sizeof(*pIn), cbOut, 0));
1273	return SUPDRV_ERR_INVALID_PARAM;
1274	}
1275	if ( pIn->u32Cookie != pDevExt->u32Cookie
1276	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1277	{
1278	dprintf(("SUP_IOCTL_GIP_MAP: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1279	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1280	return SUPDRV_ERR_INVALID_MAGIC;
1281	}
1282
1283	/*
1284	* Execute.
1285	*/
1286	rc = SUPR0GipMap(pSession, &pOut->pGipR3, &pOut->HCPhysGip);
1287	if (!rc)
1288	{
1289	pOut->pGipR0 = pDevExt->pGip;
1290	pcbReturned = sizeof(pOut);
1291	}
1292	return rc;
1293	}
1294
1295
1296	case SUP_IOCTL_GIP_UNMAP:
1297	{
1298	PSUPGIPUNMAP_IN pIn = (PSUPGIPUNMAP_IN)pvIn;
1299
1300	/*
1301	* Validate.
1302	*/
1303	if ( cbIn != sizeof(*pIn)
1304	\|\| cbOut != 0)
1305	{
1306	dprintf(("SUP_IOCTL_GIP_UNMAP: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1307	cbIn, sizeof(*pIn), cbOut, 0));
1308	return SUPDRV_ERR_INVALID_PARAM;
1309	}
1310	if ( pIn->u32Cookie != pDevExt->u32Cookie
1311	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1312	{
1313	dprintf(("SUP_IOCTL_GIP_UNMAP: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1314	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1315	return SUPDRV_ERR_INVALID_MAGIC;
1316	}
1317
1318	/*
1319	* Execute.
1320	*/
1321	return SUPR0GipUnmap(pSession);
1322	}
1323
1324
1325	case SUP_IOCTL_SET_VM_FOR_FAST:
1326	{
1327	PSUPSETVMFORFAST_IN pIn = (PSUPSETVMFORFAST_IN)pvIn;
1328
1329	/*
1330	* Validate.
1331	*/
1332	if ( cbIn != sizeof(*pIn)
1333	\|\| cbOut != 0)
1334	{
1335	dprintf(("SUP_IOCTL_SET_VM_FOR_FAST: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.\n",
1336	cbIn, sizeof(*pIn), cbOut, 0));
1337	return SUPDRV_ERR_INVALID_PARAM;
1338	}
1339	if ( pIn->u32Cookie != pDevExt->u32Cookie
1340	\|\| pIn->u32SessionCookie != pSession->u32Cookie)
1341	{
1342	dprintf(("SUP_IOCTL_SET_VM_FOR_FAST: Cookie mismatch {%#x,%#x} != {%#x,%#x}!\n",
1343	pIn->u32Cookie, pDevExt->u32Cookie, pIn->u32SessionCookie, pSession->u32Cookie));
1344	return SUPDRV_ERR_INVALID_MAGIC;
1345	}
1346	if ( pIn->pVMR0 != NULL
1347	&& ( !VALID_PTR(pIn->pVMR0)
1348	\|\| ((uintptr_t)pIn->pVMR0 & (PAGE_SIZE - 1))
1349	)
1350	)
1351	{
1352	dprintf(("SUP_IOCTL_SET_VM_FOR_FAST: pVMR0=%p! Must be a valid, page aligned, pointer.\n", pIn->pVMR0));
1353	return SUPDRV_ERR_INVALID_POINTER;
1354	}
1355
1356	/*
1357	* Execute.
1358	*/
1359	#ifndef VBOX_WITHOUT_IDT_PATCHING
1360	OSDBGPRINT(("SUP_IOCTL_SET_VM_FOR_FAST: !VBOX_WITHOUT_IDT_PATCHING\n"));
1361	return SUPDRV_ERR_GENERAL_FAILURE;
1362	#else
1363	pSession->pVM = pIn->pVMR0;
1364	return 0;
1365	#endif
1366	}
1367
1368
1369	default:
1370	dprintf(("Unknown IOCTL %#x\n", uIOCtl));
1371	break;
1372	}
1373	return SUPDRV_ERR_GENERAL_FAILURE;
1374	}
1375
1376
1377	/**
1378	* Register a object for reference counting.
1379	* The object is registered with one reference in the specified session.
1380	*
1381	* @returns Unique identifier on success (pointer).
1382	* All future reference must use this identifier.
1383	* @returns NULL on failure.
1384	* @param pfnDestructor The destructore function which will be called when the reference count reaches 0.
1385	* @param pvUser1 The first user argument.
1386	* @param pvUser2 The second user argument.
1387	*/
1388	SUPR0DECL(void ) SUPR0ObjRegister(PSUPDRVSESSION pSession, SUPDRVOBJTYPE enmType, PFNSUPDRVDESTRUCTOR pfnDestructor, void pvUser1, void *pvUser2)
1389	{
1390	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1391	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1392	PSUPDRVOBJ pObj;
1393	PSUPDRVUSAGE pUsage;
1394
1395	/*
1396	* Validate the input.
1397	*/
1398	if (!pSession)
1399	{
1400	AssertMsgFailed(("Invalid pSession=%p\n", pSession));
1401	return NULL;
1402	}
1403	if ( enmType <= SUPDRVOBJTYPE_INVALID
1404	\|\| enmType >= SUPDRVOBJTYPE_END)
1405	{
1406	AssertMsgFailed(("Invalid enmType=%d\n", enmType));
1407	return NULL;
1408	}
1409	if (!pfnDestructor)
1410	{
1411	AssertMsgFailed(("Invalid pfnDestructor=%d\n", pfnDestructor));
1412	return NULL;
1413	}
1414
1415	/*
1416	* Allocate and initialize the object.
1417	*/
1418	pObj = (PSUPDRVOBJ)RTMemAlloc(sizeof(*pObj));
1419	if (!pObj)
1420	return NULL;
1421	pObj->u32Magic = SUPDRVOBJ_MAGIC;
1422	pObj->enmType = enmType;
1423	pObj->pNext = NULL;
1424	pObj->cUsage = 1;
1425	pObj->pfnDestructor = pfnDestructor;
1426	pObj->pvUser1 = pvUser1;
1427	pObj->pvUser2 = pvUser2;
1428	pObj->CreatorUid = pSession->Uid;
1429	pObj->CreatorGid = pSession->Gid;
1430	pObj->CreatorProcess= pSession->Process;
1431	supdrvOSObjInitCreator(pObj, pSession);
1432
1433	/*
1434	* Allocate the usage record.
1435	* (We keep freed usage records around to simplity SUPR0ObjAddRef().)
1436	*/
1437	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1438
1439	pUsage = pDevExt->pUsageFree;
1440	if (pUsage)
1441	pDevExt->pUsageFree = pUsage->pNext;
1442	else
1443	{
1444	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1445	pUsage = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsage));
1446	if (!pUsage)
1447	{
1448	RTMemFree(pObj);
1449	return NULL;
1450	}
1451	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1452	}
1453
1454	/*
1455	* Insert the object and create the session usage record.
1456	*/
1457	/* The object. */
1458	pObj->pNext = pDevExt->pObjs;
1459	pDevExt->pObjs = pObj;
1460
1461	/* The session record. */
1462	pUsage->cUsage = 1;
1463	pUsage->pObj = pObj;
1464	pUsage->pNext = pSession->pUsage;
1465	dprintf(("SUPR0ObjRegister: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));
1466	pSession->pUsage = pUsage;
1467
1468	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1469
1470	dprintf(("SUPR0ObjRegister: returns %p (pvUser1=%p, pvUser=%p)\n", pObj, pvUser1, pvUser2));
1471	return pObj;
1472	}
1473
1474
1475	/**
1476	* Increment the reference counter for the object associating the reference
1477	* with the specified session.
1478	*
1479	* @returns 0 on success.
1480	* @returns SUPDRV_ERR_* on failure.
1481	* @param pvObj The identifier returned by SUPR0ObjRegister().
1482	* @param pSession The session which is referencing the object.
1483	*/
1484	SUPR0DECL(int) SUPR0ObjAddRef(void *pvObj, PSUPDRVSESSION pSession)
1485	{
1486	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1487	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1488	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
1489	PSUPDRVUSAGE pUsagePre;
1490	PSUPDRVUSAGE pUsage;
1491
1492	/*
1493	* Validate the input.
1494	*/
1495	if (!pSession)
1496	{
1497	AssertMsgFailed(("Invalid pSession=%p\n", pSession));
1498	return SUPDRV_ERR_INVALID_PARAM;
1499	}
1500	if (!pObj \|\| pObj->u32Magic != SUPDRVOBJ_MAGIC)
1501	{
1502	AssertMsgFailed(("Invalid pvObj=%p magic=%#x (exepcted %#x)\n",
1503	pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC));
1504	return SUPDRV_ERR_INVALID_PARAM;
1505	}
1506
1507	/*
1508	* Preallocate the usage record.
1509	*/
1510	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1511
1512	pUsagePre = pDevExt->pUsageFree;
1513	if (pUsagePre)
1514	pDevExt->pUsageFree = pUsagePre->pNext;
1515	else
1516	{
1517	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1518	pUsagePre = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsagePre));
1519	if (!pUsagePre)
1520	return SUPDRV_ERR_NO_MEMORY;
1521	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1522	}
1523
1524	/*
1525	* Reference the object.
1526	*/
1527	pObj->cUsage++;
1528
1529	/*
1530	* Look for the session record.
1531	*/
1532	for (pUsage = pSession->pUsage; pUsage; pUsage = pUsage->pNext)
1533	{
1534	dprintf(("SUPR0AddRef: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));
1535	if (pUsage->pObj == pObj)
1536	break;
1537	}
1538	if (pUsage)
1539	pUsage->cUsage++;
1540	else
1541	{
1542	/* create a new session record. */
1543	pUsagePre->cUsage = 1;
1544	pUsagePre->pObj = pObj;
1545	pUsagePre->pNext = pSession->pUsage;
1546	pSession->pUsage = pUsagePre;
1547	dprintf(("SUPR0ObjRelease: pUsagePre=%p:{.pObj=%p, .pNext=%p}\n", pUsagePre, pUsagePre->pObj, pUsagePre->pNext));
1548
1549	pUsagePre = NULL;
1550	}
1551
1552	/*
1553	* Put any unused usage record into the free list..
1554	*/
1555	if (pUsagePre)
1556	{
1557	pUsagePre->pNext = pDevExt->pUsageFree;
1558	pDevExt->pUsageFree = pUsagePre;
1559	}
1560
1561	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1562
1563	return 0;
1564	}
1565
1566
1567	/**
1568	* Decrement / destroy a reference counter record for an object.
1569	*
1570	* The object is uniquely identified by pfnDestructor+pvUser1+pvUser2.
1571	*
1572	* @returns 0 on success.
1573	* @returns SUPDRV_ERR_* on failure.
1574	* @param pvObj The identifier returned by SUPR0ObjRegister().
1575	* @param pSession The session which is referencing the object.
1576	*/
1577	SUPR0DECL(int) SUPR0ObjRelease(void *pvObj, PSUPDRVSESSION pSession)
1578	{
1579	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1580	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1581	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
1582	bool fDestroy = false;
1583	PSUPDRVUSAGE pUsage;
1584	PSUPDRVUSAGE pUsagePrev;
1585
1586	/*
1587	* Validate the input.
1588	*/
1589	if (!pSession)
1590	{
1591	AssertMsgFailed(("Invalid pSession=%p\n", pSession));
1592	return SUPDRV_ERR_INVALID_PARAM;
1593	}
1594	if (!pObj \|\| pObj->u32Magic != SUPDRVOBJ_MAGIC)
1595	{
1596	AssertMsgFailed(("Invalid pvObj=%p magic=%#x (exepcted %#x)\n",
1597	pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC));
1598	return SUPDRV_ERR_INVALID_PARAM;
1599	}
1600
1601	/*
1602	* Acquire the spinlock and look for the usage record.
1603	*/
1604	RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1605
1606	for (pUsagePrev = NULL, pUsage = pSession->pUsage;
1607	pUsage;
1608	pUsagePrev = pUsage, pUsage = pUsage->pNext)
1609	{
1610	dprintf(("SUPR0ObjRelease: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));
1611	if (pUsage->pObj == pObj)
1612	{
1613	AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
1614	if (pUsage->cUsage > 1)
1615	{
1616	pObj->cUsage--;
1617	pUsage->cUsage--;
1618	}
1619	else
1620	{
1621	/*
1622	* Free the session record.
1623	*/
1624	if (pUsagePrev)
1625	pUsagePrev->pNext = pUsage->pNext;
1626	else
1627	pSession->pUsage = pUsage->pNext;
1628	pUsage->pNext = pDevExt->pUsageFree;
1629	pDevExt->pUsageFree = pUsage;
1630
1631	/* What about the object? */
1632	if (pObj->cUsage > 1)
1633	pObj->cUsage--;
1634	else
1635	{
1636	/*
1637	* Object is to be destroyed, unlink it.
1638	*/
1639	fDestroy = true;
1640	if (pDevExt->pObjs == pObj)
1641	pDevExt->pObjs = pObj->pNext;
1642	else
1643	{
1644	PSUPDRVOBJ pObjPrev;
1645	for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
1646	if (pObjPrev->pNext == pObj)
1647	{
1648	pObjPrev->pNext = pObj->pNext;
1649	break;
1650	}
1651	Assert(pObjPrev);
1652	}
1653	}
1654	}
1655	break;
1656	}
1657	}
1658
1659	RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1660
1661	/*
1662	* Call the destructor and free the object if required.
1663	*/
1664	if (fDestroy)
1665	{
1666	pObj->u32Magic++;
1667	pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
1668	RTMemFree(pObj);
1669	}
1670
1671	AssertMsg(pUsage, ("pvObj=%p\n", pvObj));
1672	return pUsage ? 0 : SUPDRV_ERR_INVALID_PARAM;
1673	}
1674
1675	/**
1676	* Verifies that the current process can access the specified object.
1677	*
1678	* @returns 0 if access is granted.
1679	* @returns SUPDRV_ERR_PERMISSION_DENIED if denied access.
1680	* @returns SUPDRV_ERR_INVALID_PARAM if invalid parameter.
1681	*
1682	* @param pvObj The identifier returned by SUPR0ObjRegister().
1683	* @param pSession The session which wishes to access the object.
1684	* @param pszObjName Object string name. This is optional and depends on the object type.
1685	*
1686	* @remark The caller is responsible for making sure the object isn't removed while
1687	* we're inside this function. If uncertain about this, just call AddRef before calling us.
1688	*/
1689	SUPR0DECL(int) SUPR0ObjVerifyAccess(void pvObj, PSUPDRVSESSION pSession, const char pszObjName)
1690	{
1691	PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
1692	int rc = SUPDRV_ERR_GENERAL_FAILURE;
1693
1694	/*
1695	* Validate the input.
1696	*/
1697	if (!pSession)
1698	{
1699	AssertMsgFailed(("Invalid pSession=%p\n", pSession));
1700	return SUPDRV_ERR_INVALID_PARAM;
1701	}
1702	if (!pObj \|\| pObj->u32Magic != SUPDRVOBJ_MAGIC)
1703	{
1704	AssertMsgFailed(("Invalid pvObj=%p magic=%#x (exepcted %#x)\n",
1705	pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC));
1706	return SUPDRV_ERR_INVALID_PARAM;
1707	}
1708
1709	/*
1710	* Check access. (returns true if a decision has been made.)
1711	*/
1712	if (supdrvOSObjCanAccess(pObj, pSession, pszObjName, &rc))
1713	return rc;
1714
1715	/*
1716	* Default policy is to allow the user to access his own
1717	* stuff but nothing else.
1718	*/
1719	if (pObj->CreatorUid == pSession->Uid)
1720	return 0;
1721	return SUPDRV_ERR_PERMISSION_DENIED;
1722	}
1723
1724
1725	/**
1726	* Lock pages.
1727	*
1728	* @param pSession Session to which the locked memory should be associated.
1729	* @param pvR3 Start of the memory range to lock.
1730	* This must be page aligned.
1731	* @param cb Size of the memory range to lock.
1732	* This must be page aligned.
1733	*/
1734	SUPR0DECL(int) SUPR0LockMem(PSUPDRVSESSION pSession, void *pvR3, unsigned cb, PSUPPAGE paPages)
1735	{
1736	int rc;
1737	SUPDRVMEMREF Mem = {0};
1738	dprintf(("SUPR0LockMem: pSession=%p pvR3=%p cb=%d paPages=%p\n",
1739	pSession, pvR3, cb, paPages));
1740
1741	/*
1742	* Verify input.
1743	*/
1744	if (RT_ALIGN_R3PT(pvR3, PAGE_SIZE, void *) != pvR3 \|\| !pvR3)
1745	{
1746	dprintf(("pvR3 (%p) must be page aligned and not NULL!\n", pvR3));
1747	return SUPDRV_ERR_INVALID_PARAM;
1748	}
1749	if (RT_ALIGN(cb, PAGE_SIZE) != cb)
1750	{
1751	dprintf(("cb (%u) must be page aligned!\n", cb));
1752	return SUPDRV_ERR_INVALID_PARAM;
1753	}
1754	if (!paPages)
1755	{
1756	dprintf(("paPages is NULL!\n"));
1757	return SUPDRV_ERR_INVALID_PARAM;
1758	}
1759
1760	#ifdef USE_NEW_OS_INTERFACE
1761	/*
1762	* Let IPRT do the job.
1763	*/
1764	Mem.eType = MEMREF_TYPE_LOCKED;
1765	rc = RTR0MemObjLockUser(&Mem.MemObj, pvR3, cb, RTR0ProcHandleSelf());
1766	if (RT_SUCCESS(rc))
1767	{
1768	AssertMsg(RTR0MemObjAddress(Mem.MemObj) == pvR3, ("%p == %p\n", RTR0MemObjAddress(Mem.MemObj), pvR3));
1769	AssertMsg(RTR0MemObjSize(Mem.MemObj) == cb, ("%x == %x\n", RTR0MemObjSize(Mem.MemObj), cb));
1770
1771	unsigned iPage = cb >> PAGE_SHIFT;
1772	while (iPage-- > 0)
1773	{
1774	paPages[iPage].uReserved = 0;
1775	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
1776	if (RT_UNLIKELY(paPages[iPage].Phys == NIL_RTCCPHYS))
1777	{
1778	AssertMsgFailed(("iPage=%d\n", iPage));
1779	rc = VERR_INTERNAL_ERROR;
1780	break;
1781	}
1782	}
1783	if (RT_SUCCESS(rc))
1784	rc = supdrvMemAdd(&Mem, pSession);
1785	if (RT_FAILURE(rc))
1786	{
1787	int rc2 = RTR0MemObjFree(Mem.MemObj, false);
1788	AssertRC(rc2);
1789	}
1790	}
1791
1792	#else /* !USE_NEW_OS_INTERFACE */
1793
1794	/*
1795	* Let the OS specific code have a go.
1796	*/
1797	Mem.pvR0 = NULL;
1798	Mem.pvR3 = pvR3;
1799	Mem.eType = MEMREF_TYPE_LOCKED;
1800	Mem.cb = cb;
1801	rc = supdrvOSLockMemOne(&Mem, paPages);
1802	if (rc)
1803	return rc;
1804
1805	/*
1806	* Everything when fine, add the memory reference to the session.
1807	*/
1808	rc = supdrvMemAdd(&Mem, pSession);
1809	if (rc)
1810	supdrvOSUnlockMemOne(&Mem);
1811	#endif /* !USE_NEW_OS_INTERFACE */
1812	return rc;
1813	}
1814
1815
1816	/**
1817	* Unlocks the memory pointed to by pv.
1818	*
1819	* @returns 0 on success.
1820	* @returns SUPDRV_ERR_* on failure
1821	* @param pSession Session to which the memory was locked.
1822	* @param pvR3 Memory to unlock.
1823	*/
1824	SUPR0DECL(int) SUPR0UnlockMem(PSUPDRVSESSION pSession, void *pvR3)
1825	{
1826	dprintf(("SUPR0UnlockMem: pSession=%p pvR3=%p\n", pSession, pvR3));
1827	return supdrvMemRelease(pSession, pvR3, MEMREF_TYPE_LOCKED);
1828	}
1829
1830
1831	/**
1832	* Allocates a chunk of page aligned memory with contiguous and fixed physical
1833	* backing.
1834	*
1835	* @returns 0 on success.
1836	* @returns SUPDRV_ERR_* on failure.
1837	* @param pSession Session data.
1838	* @param cb Number of bytes to allocate.
1839	* @param ppvR0 Where to put the address of Ring-0 mapping the allocated memory. optional
1840	* @param ppvR3 Where to put the address of Ring-3 mapping the allocated memory.
1841	* @param pHCPhys Where to put the physical address of allocated memory.
1842	*/
1843	SUPR0DECL(int) SUPR0ContAlloc(PSUPDRVSESSION pSession, unsigned cb, void **ppvR0, PRTR3PTR ppvR3, PRTHCPHYS pHCPhys)
1844	{
1845	int rc;
1846	SUPDRVMEMREF Mem = {0};
1847	dprintf(("SUPR0ContAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p pHCPhys=%p\n", pSession, cb, ppvR0, ppvR3, pHCPhys));
1848
1849	/*
1850	* Validate input.
1851	*/
1852	if (!pSession \|\| !ppvR3 \|\| !pHCPhys)
1853	{
1854	dprintf(("Null pointer. All of these should be set: pSession=%p ppvR3=%p pHCPhys=%p\n",
1855	pSession, ppvR3, pHCPhys));
1856	return SUPDRV_ERR_INVALID_PARAM;
1857
1858	}
1859	if (cb <= 64 \|\| cb >= PAGE_SIZE * 256)
1860	{
1861	dprintf(("Illegal request cb=%d, must be greater than 64 and smaller than PAGE_SIZE*256\n", cb));
1862	return SUPDRV_ERR_INVALID_PARAM;
1863	}
1864
1865	#ifdef USE_NEW_OS_INTERFACE
1866	/*
1867	* Let IPRT do the job.
1868	*/
1869	rc = RTR0MemObjAllocCont(&Mem.MemObj, cb, true /* executable R0 mapping */);
1870	if (RT_SUCCESS(rc))
1871	{
1872	int rc2;
1873	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (void *)-1, 0,
1874	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
1875	if (RT_SUCCESS(rc))
1876	{
1877	Mem.eType = MEMREF_TYPE_CONT;
1878	rc = supdrvMemAdd(&Mem, pSession);
1879	if (!rc)
1880	{
1881	if (ppvR0)
1882	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
1883	*ppvR3 = RTR0MemObjAddress(Mem.MapObjR3);
1884	*pHCPhys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, 0);
1885	return 0;
1886	}
1887
1888	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
1889	AssertRC(rc2);
1890	}
1891	rc2 = RTR0MemObjFree(Mem.MemObj, false);
1892	AssertRC(rc2);
1893	}
1894
1895	#else /* !USE_NEW_OS_INTERFACE */
1896
1897	/*
1898	* Let the OS specific code have a go.
1899	*/
1900	Mem.pvR0 = NULL;
1901	Mem.pvR3 = NULL;
1902	Mem.eType = MEMREF_TYPE_CONT;
1903	Mem.cb = cb;
1904	rc = supdrvOSContAllocOne(&Mem, ppvR0, ppvR3, pHCPhys);
1905	if (rc)
1906	return rc;
1907	AssertMsg(!((uintptr_t)ppvR3 & (PAGE_SIZE - 1)) \|\| !(pHCPhys & (PAGE_SIZE - 1)),
1908	("Memory is not page aligned! ppvR0=%p ppvR3=%p phys=%VHp\n", ppvR0 ? ppvR0 : NULL, ppvR3, *pHCPhys));
1909
1910	/*
1911	* Everything when fine, add the memory reference to the session.
1912	*/
1913	rc = supdrvMemAdd(&Mem, pSession);
1914	if (rc)
1915	supdrvOSContFreeOne(&Mem);
1916	#endif /* !USE_NEW_OS_INTERFACE */
1917
1918	return rc;
1919	}
1920
1921
1922	/**
1923	* Frees memory allocated using SUPR0ContAlloc().
1924	*
1925	* @returns 0 on success.
1926	* @returns SUPDRV_ERR_* on failure.
1927	* @param pSession The session to which the memory was allocated.
1928	* @param pv Pointer to the memory.
1929	*/
1930	SUPR0DECL(int) SUPR0ContFree(PSUPDRVSESSION pSession, void *pv)
1931	{
1932	dprintf(("SUPR0ContFree: pSession=%p pv=%p\n", pSession, pv));
1933	return supdrvMemRelease(pSession, pv, MEMREF_TYPE_CONT);
1934	}
1935
1936
1937	/**
1938	* Allocates a chunk of page aligned memory with fixed physical backing below 4GB.
1939	*
1940	* @returns 0 on success.
1941	* @returns SUPDRV_ERR_* on failure.
1942	* @param pSession Session data.
1943	* @param cPages Number of pages to allocate.
1944	* @param ppvR3 Where to put the address of Ring-3 mapping of the allocated memory.
1945	* @param paPages Where to put the physical addresses of allocated memory.
1946	*/
1947	SUPR0DECL(int) SUPR0LowAlloc(PSUPDRVSESSION pSession, unsigned cPages, void **ppvR3, PSUPPAGE paPages)
1948	{
1949	unsigned iPage;
1950	int rc;
1951	SUPDRVMEMREF Mem = {0};
1952	dprintf(("SUPR0LowAlloc: pSession=%p cPages=%d ppvR3=%p paPages=%p\n", pSession, cPages, ppvR3, paPages));
1953
1954	/*
1955	* Validate input.
1956	*/
1957	if (!pSession \|\| !ppvR3 \|\| !paPages)
1958	{
1959	dprintf(("Null pointer. All of these should be set: pSession=%p ppvR3=%p paPages=%p\n",
1960	pSession, ppvR3, paPages));
1961	return SUPDRV_ERR_INVALID_PARAM;
1962
1963	}
1964	if (cPages < 1 \|\| cPages > 256)
1965	{
1966	dprintf(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
1967	return SUPDRV_ERR_INVALID_PARAM;
1968	}
1969
1970	#ifdef USE_NEW_OS_INTERFACE
1971	/*
1972	* Let IPRT do the work.
1973	*/
1974	rc = RTR0MemObjAllocLow(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable ring-0 mapping */);
1975	if (RT_SUCCESS(rc))
1976	{
1977	int rc2;
1978	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (void *)-1, 0,
1979	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
1980	if (RT_SUCCESS(rc))
1981	{
1982	Mem.eType = MEMREF_TYPE_LOW;
1983	rc = supdrvMemAdd(&Mem, pSession);
1984	if (!rc)
1985	{
1986	for (iPage = 0; iPage < cPages; iPage++)
1987	{
1988	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
1989	paPages[iPage].uReserved = 0;
1990	AssertMsg(!(paPages[iPage].Phys & (PAGE_SIZE - 1)), ("iPage=%d Phys=%VHp\n", paPages[iPage].Phys));
1991	}
1992	/*if (ppvR0)
1993	ppvR0 = RTR0MemObjAddress(Mem.MemObj); /
1994	*ppvR3 = RTR0MemObjAddress(Mem.MapObjR3);
1995	return 0;
1996	}
1997
1998	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
1999	AssertRC(rc2);
2000	}
2001
2002	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2003	AssertRC(rc2);
2004	}
2005
2006	#else /* !USE_NEW_OS_INTERFACE */
2007
2008	/*
2009	* Let the OS specific code have a go.
2010	*/
2011	Mem.pvR0 = NULL;
2012	Mem.pvR3 = NULL;
2013	Mem.eType = MEMREF_TYPE_LOW;
2014	Mem.cb = cPages << PAGE_SHIFT;
2015	rc = supdrvOSLowAllocOne(&Mem, ppvR3, paPages);
2016	if (rc)
2017	return rc;
2018	AssertMsg(!((uintptr_t)ppvR3 & (PAGE_SIZE - 1)), ("Memory is not page aligned! virt=%p\n", ppvR3));
2019	for (iPage = 0; iPage < cPages; iPage++)
2020	AssertMsg(!(paPages[iPage].Phys & (PAGE_SIZE - 1)), ("iPage=%d Phys=%VHp\n", paPages[iPage].Phys));
2021
2022	/*
2023	* Everything when fine, add the memory reference to the session.
2024	*/
2025	rc = supdrvMemAdd(&Mem, pSession);
2026	if (rc)
2027	supdrvOSLowFreeOne(&Mem);
2028	#endif /* !USE_NEW_OS_INTERFACE */
2029	return rc;
2030	}
2031
2032
2033	/**
2034	* Frees memory allocated using SUPR0LowAlloc().
2035	*
2036	* @returns 0 on success.
2037	* @returns SUPDRV_ERR_* on failure.
2038	* @param pSession The session to which the memory was allocated.
2039	* @param pv Pointer to the memory.
2040	*/
2041	SUPR0DECL(int) SUPR0LowFree(PSUPDRVSESSION pSession, void *pv)
2042	{
2043	dprintf(("SUPR0LowFree: pSession=%p pv=%p\n", pSession, pv));
2044	return supdrvMemRelease(pSession, pv, MEMREF_TYPE_LOW);
2045	}
2046
2047
2048	/**
2049	* Allocates a chunk of memory with both R0 and R3 mappings.
2050	* The memory is fixed and it's possible to query the physical addresses using SUPR0MemGetPhys().
2051	*
2052	* @returns 0 on success.
2053	* @returns SUPDRV_ERR_* on failure.
2054	* @param pSession The session to associated the allocation with.
2055	* @param cb Number of bytes to allocate.
2056	* @param ppvR0 Where to store the address of the Ring-0 mapping.
2057	* @param ppvR3 Where to store the address of the Ring-3 mapping.
2058	*/
2059	SUPR0DECL(int) SUPR0MemAlloc(PSUPDRVSESSION pSession, unsigned cb, void ppvR0, void ppvR3)
2060	{
2061	int rc;
2062	SUPDRVMEMREF Mem = {0};
2063	dprintf(("SUPR0MemAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p\n", pSession, cb, ppvR0, ppvR3));
2064
2065	/*
2066	* Validate input.
2067	*/
2068	if (!pSession \|\| !ppvR0 \|\| !ppvR3)
2069	{
2070	dprintf(("Null pointer. All of these should be set: pSession=%p ppvR0=%p ppvR3=%p\n",
2071	pSession, ppvR0, ppvR3));
2072	return SUPDRV_ERR_INVALID_PARAM;
2073
2074	}
2075	if (cb < 1 \|\| cb >= PAGE_SIZE * 256)
2076	{
2077	dprintf(("Illegal request cb=%u; must be greater than 0 and smaller than 4MB.\n", cb));
2078	return SUPDRV_ERR_INVALID_PARAM;
2079	}
2080
2081	#ifdef USE_NEW_OS_INTERFACE
2082	/*
2083	* Let IPRT do the work.
2084	*/
2085	rc = RTR0MemObjAllocPage(&Mem.MemObj, cb, true /* executable ring-0 mapping */);
2086	if (RT_SUCCESS(rc))
2087	{
2088	int rc2;
2089	rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (void*)-1, 0,
2090	RTMEM_PROT_EXEC \| RTMEM_PROT_WRITE \| RTMEM_PROT_READ, RTR0ProcHandleSelf());
2091	if (RT_SUCCESS(rc))
2092	{
2093	Mem.eType = MEMREF_TYPE_MEM;
2094	rc = supdrvMemAdd(&Mem, pSession);
2095	if (!rc)
2096	{
2097	*ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2098	*ppvR3 = RTR0MemObjAddress(Mem.MapObjR3);
2099	return 0;
2100	}
2101	rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2102	AssertRC(rc2);
2103	}
2104
2105	rc2 = RTR0MemObjFree(Mem.MemObj, false);
2106	AssertRC(rc2);
2107	}
2108
2109	#else /* !USE_NEW_OS_INTERFACE */
2110
2111	/*
2112	* Let the OS specific code have a go.
2113	*/
2114	Mem.pvR0 = NULL;
2115	Mem.pvR3 = NULL;
2116	Mem.eType = MEMREF_TYPE_MEM;
2117	Mem.cb = cb;
2118	rc = supdrvOSMemAllocOne(&Mem, ppvR0, ppvR3);
2119	if (rc)
2120	return rc;
2121	AssertMsg(!((uintptr_t)ppvR0 & (PAGE_SIZE - 1)), ("Memory is not page aligned! pvR0=%p\n", ppvR0));
2122	AssertMsg(!((uintptr_t)ppvR3 & (PAGE_SIZE - 1)), ("Memory is not page aligned! pvR3=%p\n", ppvR3));
2123
2124	/*
2125	* Everything when fine, add the memory reference to the session.
2126	*/
2127	rc = supdrvMemAdd(&Mem, pSession);
2128	if (rc)
2129	supdrvOSMemFreeOne(&Mem);
2130	#endif /* !USE_NEW_OS_INTERFACE */
2131	return rc;
2132	}
2133
2134
2135	/**
2136	* Get the physical addresses of memory allocated using SUPR0MemAlloc().
2137	*
2138	* @returns 0 on success.
2139	* @returns SUPDRV_ERR_* on failure.
2140	* @param pSession The session to which the memory was allocated.
2141	* @param pv The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2142	*/
2143	SUPR0DECL(int) SUPR0MemGetPhys(PSUPDRVSESSION pSession, void *pv, PSUPPAGE paPages)
2144	{
2145	PSUPDRVBUNDLE pBundle;
2146	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2147	dprintf(("SUPR0MemGetPhys: pSession=%p pv=%p paPages=%p\n", pSession, pv, paPages));
2148
2149	/*
2150	* Validate input.
2151	*/
2152	if (!pSession)
2153	{
2154	dprintf(("pSession must not be NULL!"));
2155	return SUPDRV_ERR_INVALID_PARAM;
2156	}
2157	if (!pv \|\| !paPages)
2158	{
2159	dprintf(("Illegal address pv=%p or/and paPages=%p\n", pv, paPages));
2160	return SUPDRV_ERR_INVALID_PARAM;
2161	}
2162
2163	/*
2164	* Search for the address.
2165	*/
2166	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2167	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2168	{
2169	if (pBundle->cUsed > 0)
2170	{
2171	unsigned i;
2172	for (i = 0; i < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]); i++)
2173	{
2174	#ifdef USE_NEW_OS_INTERFACE
2175	if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
2176	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2177	&& ( RTR0MemObjAddress(pBundle->aMem[i].MemObj) == pv
2178	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2179	&& RTR0MemObjAddress(pBundle->aMem[i].MapObjR3) == pv)
2180	)
2181	)
2182	{
2183	const unsigned cPages = RTR0MemObjSize(pBundle->aMem[i].MemObj) >> PAGE_SHIFT;
2184	unsigned iPage;
2185	for (iPage = 0; iPage < cPages; iPage++)
2186	{
2187	paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(pBundle->aMem[i].MemObj, iPage);
2188	paPages[iPage].uReserved = 0;
2189	}
2190	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2191	return 0;
2192	}
2193	#else /* !USE_NEW_OS_INTERFACE */
2194	if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
2195	&& ( pBundle->aMem[i].pvR0 == pv
2196	\|\| pBundle->aMem[i].pvR3 == pv))
2197	{
2198	supdrvOSMemGetPages(&pBundle->aMem[i], paPages);
2199	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2200	return 0;
2201	}
2202	#endif
2203	}
2204	}
2205	}
2206	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2207	dprintf(("Failed to find %p!!!\n", pv));
2208	return SUPDRV_ERR_INVALID_PARAM;
2209	}
2210
2211
2212	/**
2213	* Free memory allocated by SUPR0MemAlloc().
2214	*
2215	* @returns 0 on success.
2216	* @returns SUPDRV_ERR_* on failure.
2217	* @param pSession The session owning the allocation.
2218	* @param pv The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2219	*/
2220	SUPR0DECL(int) SUPR0MemFree(PSUPDRVSESSION pSession, void *pv)
2221	{
2222	dprintf(("SUPR0MemFree: pSession=%p pv=%p\n", pSession, pv));
2223	return supdrvMemRelease(pSession, pv, MEMREF_TYPE_MEM);
2224	}
2225
2226
2227	/**
2228	* Maps the GIP into userspace and/or get the physical address of the GIP.
2229	*
2230	* @returns 0 on success.
2231	* @returns SUPDRV_ERR_* on failure.
2232	* @param pSession Session to which the GIP mapping should belong.
2233	* @param ppGip Where to store the address of the mapping. (optional)
2234	* @param pHCPhysGip Where to store the physical address. (optional)
2235	*
2236	* @remark There is no reference counting on the mapping, so one call to this function
2237	* count globally as one reference. One call to SUPR0GipUnmap() is will unmap GIP
2238	* and remove the session as a GIP user.
2239	*/
2240	SUPR0DECL(int) SUPR0GipMap(PSUPDRVSESSION pSession, PCSUPGLOBALINFOPAGE ppGip, RTHCPHYS pHCPhysGid)
2241	{
2242	int rc = 0;
2243	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2244	PCSUPGLOBALINFOPAGE pGip = NULL;
2245	RTHCPHYS HCPhys = NIL_RTHCPHYS;
2246	dprintf(("SUPR0GipMap: pSession=%p ppGip=%p pHCPhysGid=%p\n", pSession, ppGip, pHCPhysGid));
2247
2248	/*
2249	* Validate
2250	*/
2251	if (!ppGip && !pHCPhysGid)
2252	return 0;
2253
2254	RTSemFastMutexRequest(pDevExt->mtxGip);
2255	if (pDevExt->pGip)
2256	{
2257	/*
2258	* Map it?
2259	*/
2260	if (ppGip)
2261	{
2262	#ifdef USE_NEW_OS_INTERFACE
2263	if (pSession->GipMapObjR3 == NIL_RTR0MEMOBJ)
2264	rc = RTR0MemObjMapUser(&pSession->GipMapObjR3, pDevExt->GipMemObj, (void*)-1, 0,
2265	RTMEM_PROT_READ, RTR0ProcHandleSelf());
2266	if (RT_SUCCESS(rc))
2267	{
2268	pGip = (PCSUPGLOBALINFOPAGE)RTR0MemObjAddress(pSession->GipMapObjR3);
2269	rc = VINF_SUCCESS; /** @todo remove this and replace the !rc below with RT_SUCCESS(rc). */
2270	}
2271	#else /* !USE_NEW_OS_INTERFACE */
2272	if (!pSession->pGip)
2273	rc = supdrvOSGipMap(pSession->pDevExt, &pSession->pGip);
2274	if (!rc)
2275	pGip = pSession->pGip;
2276	#endif /* !USE_NEW_OS_INTERFACE */
2277	}
2278
2279	/*
2280	* Get physical address.
2281	*/
2282	if (pHCPhysGid && !rc)
2283	HCPhys = pDevExt->HCPhysGip;
2284
2285	/*
2286	* Reference globally.
2287	*/
2288	if (!pSession->fGipReferenced && !rc)
2289	{
2290	pSession->fGipReferenced = 1;
2291	pDevExt->cGipUsers++;
2292	if (pDevExt->cGipUsers == 1)
2293	{
2294	PSUPGLOBALINFOPAGE pGip = pDevExt->pGip;
2295	unsigned i;
2296
2297	dprintf(("SUPR0GipMap: Resumes GIP updating\n"));
2298
2299	for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
2300	ASMAtomicXchgU32(&pGip->aCPUs[i].u32TransactionId, pGip->aCPUs[i].u32TransactionId & ~(GIP_UPDATEHZ_RECALC_FREQ * 2 - 1));
2301	ASMAtomicXchgU64(&pGip->u64NanoTSLastUpdateHz, 0);
2302
2303	#ifdef USE_NEW_OS_INTERFACE
2304	rc = RTTimerStart(pDevExt->pGipTimer, 0);
2305	AssertRC(rc); rc = 0;
2306	#else
2307	supdrvOSGipResume(pDevExt);
2308	#endif
2309	}
2310	}
2311	}
2312	else
2313	{
2314	rc = SUPDRV_ERR_GENERAL_FAILURE;
2315	dprintf(("SUPR0GipMap: GIP is not available!\n"));
2316	}
2317	RTSemFastMutexRelease(pDevExt->mtxGip);
2318
2319	/*
2320	* Write returns.
2321	*/
2322	if (pHCPhysGid)
2323	*pHCPhysGid = HCPhys;
2324	if (ppGip)
2325	*ppGip = pGip;
2326
2327	dprintf(("SUPR0GipMap: returns %d pHCPhysGid=%lx ppGip=%p\n", rc, (unsigned long)HCPhys, pGip));
2328	return rc;
2329	}
2330
2331
2332	/**
2333	* Unmaps any user mapping of the GIP and terminates all GIP access
2334	* from this session.
2335	*
2336	* @returns 0 on success.
2337	* @returns SUPDRV_ERR_* on failure.
2338	* @param pSession Session to which the GIP mapping should belong.
2339	*/
2340	SUPR0DECL(int) SUPR0GipUnmap(PSUPDRVSESSION pSession)
2341	{
2342	int rc = 0;
2343	PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2344	dprintf(("SUPR0GipUnmap: pSession=%p\n", pSession));
2345
2346	RTSemFastMutexRequest(pDevExt->mtxGip);
2347
2348	/*
2349	* Unmap anything?
2350	*/
2351	#ifdef USE_NEW_OS_INTERFACE
2352	if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
2353	{
2354	rc = RTR0MemObjFree(pSession->GipMapObjR3, false);
2355	AssertRC(rc);
2356	if (RT_SUCCESS(rc))
2357	pSession->GipMapObjR3 = NIL_RTR0MEMOBJ;
2358	}
2359	#else
2360	if (pSession->pGip)
2361	{
2362	rc = supdrvOSGipUnmap(pDevExt, pSession->pGip);
2363	if (!rc)
2364	pSession->pGip = NULL;
2365	}
2366	#endif
2367
2368	/*
2369	* Dereference global GIP.
2370	*/
2371	if (pSession->fGipReferenced && !rc)
2372	{
2373	pSession->fGipReferenced = 0;
2374	if ( pDevExt->cGipUsers > 0
2375	&& !--pDevExt->cGipUsers)
2376	{
2377	dprintf(("SUPR0GipUnmap: Suspends GIP updating\n"));
2378	#ifdef USE_NEW_OS_INTERFACE
2379	rc = RTTimerStop(pDevExt->pGipTimer); AssertRC(rc); rc = 0;
2380	#else
2381	supdrvOSGipSuspend(pDevExt);
2382	#endif
2383	}
2384	}
2385
2386	RTSemFastMutexRelease(pDevExt->mtxGip);
2387
2388	return rc;
2389	}
2390
2391
2392	/**
2393	* Adds a memory object to the session.
2394	*
2395	* @returns 0 on success.
2396	* @returns SUPDRV_ERR_* on failure.
2397	* @param pMem Memory tracking structure containing the
2398	* information to track.
2399	* @param pSession The session.
2400	*/
2401	static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession)
2402	{
2403	PSUPDRVBUNDLE pBundle;
2404	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2405
2406	/*
2407	* Find free entry and record the allocation.
2408	*/
2409	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2410	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2411	{
2412	if (pBundle->cUsed < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]))
2413	{
2414	unsigned i;
2415	for (i = 0; i < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]); i++)
2416	{
2417	#ifdef USE_NEW_OS_INTERFACE
2418	if (pBundle->aMem[i].MemObj == NIL_RTR0MEMOBJ)
2419	#else /* !USE_NEW_OS_INTERFACE */
2420	if ( !pBundle->aMem[i].pvR0
2421	&& !pBundle->aMem[i].pvR3)
2422	#endif /* !USE_NEW_OS_INTERFACE */
2423	{
2424	pBundle->cUsed++;
2425	pBundle->aMem[i] = *pMem;
2426	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2427	return 0;
2428	}
2429	}
2430	AssertFailed(); /* !!this can't be happening!!! */
2431	}
2432	}
2433	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2434
2435	/*
2436	* Need to allocate a new bundle.
2437	* Insert into the last entry in the bundle.
2438	*/
2439	pBundle = (PSUPDRVBUNDLE)RTMemAllocZ(sizeof(*pBundle));
2440	if (!pBundle)
2441	return SUPDRV_ERR_NO_MEMORY;
2442
2443	/* take last entry. */
2444	pBundle->cUsed++;
2445	pBundle->aMem[sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]) - 1] = *pMem;
2446
2447	/* insert into list. */
2448	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2449	pBundle->pNext = pSession->Bundle.pNext;
2450	pSession->Bundle.pNext = pBundle;
2451	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2452
2453	return 0;
2454	}
2455
2456
2457	/**
2458	* Releases a memory object referenced by pointer and type.
2459	*
2460	* @returns 0 on success.
2461	* @returns SUPDRV_ERR_INVALID_PARAM on failure.
2462	* @param pSession Session data.
2463	* @param pv Pointer to memory. This is matched against both the R0 and R3 addresses.
2464	* @param eType Memory type.
2465	*/
2466	static int supdrvMemRelease(PSUPDRVSESSION pSession, void *pv, SUPDRVMEMREFTYPE eType)
2467	{
2468	PSUPDRVBUNDLE pBundle;
2469	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2470
2471	/*
2472	* Validate input.
2473	*/
2474	if (!pSession)
2475	{
2476	dprintf(("pSession must not be NULL!"));
2477	return SUPDRV_ERR_INVALID_PARAM;
2478	}
2479	if (!pv)
2480	{
2481	dprintf(("Illegal address %p\n", pv));
2482	return SUPDRV_ERR_INVALID_PARAM;
2483	}
2484
2485	/*
2486	* Search for the address.
2487	*/
2488	RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2489	for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2490	{
2491	if (pBundle->cUsed > 0)
2492	{
2493	unsigned i;
2494	for (i = 0; i < sizeof(pBundle->aMem) / sizeof(pBundle->aMem[0]); i++)
2495	{
2496	#ifdef USE_NEW_OS_INTERFACE
2497	if ( pBundle->aMem[i].eType == eType
2498	&& pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2499	&& ( RTR0MemObjAddress(pBundle->aMem[i].MemObj) == pv
2500	\|\| ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2501	&& RTR0MemObjAddress(pBundle->aMem[i].MapObjR3) == pv))
2502	)
2503	{
2504	/* Make a copy of it and release it outside the spinlock. */
2505	SUPDRVMEMREF Mem = pBundle->aMem[i];
2506	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
2507	pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
2508	pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
2509	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2510
2511	if (Mem.MapObjR3)
2512	{
2513	int rc = RTR0MemObjFree(Mem.MapObjR3, false);
2514	AssertRC(rc); /** @todo figure out how to handle this. */
2515	}
2516	if (Mem.MemObj)
2517	{
2518	int rc = RTR0MemObjFree(Mem.MemObj, false);
2519	AssertRC(rc); /** @todo figure out how to handle this. */
2520	}
2521	return 0;
2522	}
2523	#else /* !USE_NEW_OS_INTERFACE */
2524	if ( pBundle->aMem[i].eType == eType
2525	&& ( pBundle->aMem[i].pvR0 == pv
2526	\|\| pBundle->aMem[i].pvR3 == pv))
2527	{
2528	/* Make a copy of it and release it outside the spinlock. */
2529	SUPDRVMEMREF Mem = pBundle->aMem[i];
2530	pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
2531	pBundle->aMem[i].pvR0 = NULL;
2532	pBundle->aMem[i].pvR3 = NULL;
2533	pBundle->aMem[i].cb = 0;
2534	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2535
2536	/* Type specific free operation. */
2537	switch (Mem.eType)
2538	{
2539	case MEMREF_TYPE_LOCKED:
2540	supdrvOSUnlockMemOne(&Mem);
2541	break;
2542	case MEMREF_TYPE_CONT:
2543	supdrvOSContFreeOne(&Mem);
2544	break;
2545	case MEMREF_TYPE_LOW:
2546	supdrvOSLowFreeOne(&Mem);
2547	break;
2548	case MEMREF_TYPE_MEM:
2549	supdrvOSMemFreeOne(&Mem);
2550	break;
2551	default:
2552	case MEMREF_TYPE_UNUSED:
2553	break;
2554	}
2555	return 0;
2556	}
2557	#endif /* !USE_NEW_OS_INTERFACE */
2558	}
2559	}
2560	}
2561	RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2562	dprintf(("Failed to find %p!!! (eType=%d)\n", pv, eType));
2563	return SUPDRV_ERR_INVALID_PARAM;
2564	}
2565
2566
2567	#ifndef VBOX_WITHOUT_IDT_PATCHING
2568	/**
2569	* Install IDT for the current CPU.
2570	*
2571	* @returns 0 on success.
2572	* @returns SUPDRV_ERR_NO_MEMORY or SUPDRV_ERROR_IDT_FAILED on failure.
2573	* @param pIn Input data.
2574	* @param pOut Output data.
2575	*/
2576	static int supdrvIOCtl_IdtInstall(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPIDTINSTALL_IN pIn, PSUPIDTINSTALL_OUT pOut)
2577	{
2578	PSUPDRVPATCHUSAGE pUsagePre;
2579	PSUPDRVPATCH pPatchPre;
2580	RTIDTR Idtr;
2581	PSUPDRVPATCH pPatch;
2582	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2583	dprintf(("supdrvIOCtl_IdtInstall\n"));
2584
2585	/*
2586	* Preallocate entry for this CPU cause we don't wanna do
2587	* that inside the spinlock!
2588	*/
2589	pUsagePre = (PSUPDRVPATCHUSAGE)RTMemAlloc(sizeof(*pUsagePre));
2590	if (!pUsagePre)
2591	return SUPDRV_ERR_NO_MEMORY;
2592
2593	/*
2594	* Take the spinlock and see what we need to do.
2595	*/
2596	RTSpinlockAcquireNoInts(pDevExt->Spinlock, &SpinlockTmp);
2597
2598	/* check if we already got a free patch. */
2599	if (!pDevExt->pIdtPatchesFree)
2600	{
2601	/*
2602	* Allocate a patch - outside the spinlock of course.
2603	*/
2604	RTSpinlockReleaseNoInts(pDevExt->Spinlock, &SpinlockTmp);
2605
2606	pPatchPre = (PSUPDRVPATCH)RTMemExecAlloc(sizeof(*pPatchPre));
2607	if (!pPatchPre)
2608	return SUPDRV_ERR_NO_MEMORY;
2609
2610	RTSpinlockAcquireNoInts(pDevExt->Spinlock, &SpinlockTmp);
2611	}
2612	else
2613	{
2614	pPatchPre = pDevExt->pIdtPatchesFree;
2615	pDevExt->pIdtPatchesFree = pPatchPre->pNext;
2616	}
2617
2618	/* look for matching patch entry */
2619	ASMGetIDTR(&Idtr);
2620	pPatch = pDevExt->pIdtPatches;
2621	while (pPatch && pPatch->pvIdt != (void *)Idtr.pIdt)
2622	pPatch = pPatch->pNext;
2623
2624	if (!pPatch)
2625	{
2626	/*
2627	* Create patch.
2628	*/
2629	pPatch = supdrvIdtPatchOne(pDevExt, pPatchPre);
2630	if (pPatch)
2631	pPatchPre = NULL; /* mark as used. */
2632	}
2633	else
2634	{
2635	/*
2636	* Simply increment patch usage.
2637	*/
2638	pPatch->cUsage++;
2639	}
2640
2641	if (pPatch)
2642	{
2643	/*
2644	* Increment and add if need be the session usage record for this patch.
2645	*/
2646	PSUPDRVPATCHUSAGE pUsage = pSession->pPatchUsage;
2647	while (pUsage && pUsage->pPatch != pPatch)
2648	pUsage = pUsage->pNext;
2649
2650	if (!pUsage)
2651	{
2652	/*
2653	* Add usage record.
2654	*/
2655	pUsagePre->cUsage = 1;
2656	pUsagePre->pPatch = pPatch;
2657	pUsagePre->pNext = pSession->pPatchUsage;
2658	pSession->pPatchUsage = pUsagePre;
2659	pUsagePre = NULL; /* mark as used. */
2660	}
2661	else
2662	{
2663	/*
2664	* Increment usage count.
2665	*/
2666	pUsage->cUsage++;
2667	}
2668	}
2669
2670	/* free patch - we accumulate them for paranoid saftly reasons. */
2671	if (pPatchPre)
2672	{
2673	pPatchPre->pNext = pDevExt->pIdtPatchesFree;
2674	pDevExt->pIdtPatchesFree = pPatchPre;
2675	}
2676
2677	RTSpinlockReleaseNoInts(pDevExt->Spinlock, &SpinlockTmp);
2678
2679	/*
2680	* Free unused preallocated buffers.
2681	*/
2682	if (pUsagePre)
2683	RTMemFree(pUsagePre);
2684
2685	pOut->u8Idt = pDevExt->u8Idt;
2686
2687	return pPatch ? 0 : SUPDRV_ERR_IDT_FAILED;
2688	}
2689
2690
2691	/**
2692	* This creates a IDT patch entry.
2693	* If the first patch being installed it'll also determin the IDT entry
2694	* to use.
2695	*
2696	* @returns pPatch on success.
2697	* @returns NULL on failure.
2698	* @param pDevExt Pointer to globals.
2699	* @param pPatch Patch entry to use.
2700	* This will be linked into SUPDRVDEVEXT::pIdtPatches on
2701	* successful return.
2702	* @remark Call must be owning the SUPDRVDEVEXT::Spinlock!
2703	*/
2704	static PSUPDRVPATCH supdrvIdtPatchOne(PSUPDRVDEVEXT pDevExt, PSUPDRVPATCH pPatch)
2705	{
2706	RTIDTR Idtr;
2707	PSUPDRVIDTE paIdt;
2708	dprintf(("supdrvIOCtl_IdtPatchOne: pPatch=%p\n", pPatch));
2709
2710	/*
2711	* Get IDT.
2712	*/
2713	ASMGetIDTR(&Idtr);
2714	paIdt = (PSUPDRVIDTE)Idtr.pIdt;
2715	if ((uintptr_t)paIdt < 0x80000000)
2716	{
2717	AssertMsgFailed(("bad paIdt=%p\n", paIdt));
2718	return NULL;
2719	}
2720
2721	if (!pDevExt->u8Idt)
2722	{
2723	/*
2724	* Test out the alternatives.
2725	*
2726	* At the moment we do not support chaining thus we ASSUME that one of
2727	* these 48 entries is unused (which is not a problem on Win32 and
2728	* Linux to my knowledge).
2729	*/
2730	/** @todo we MUST change this detection to try grab an entry which is NOT in use. This can be
2731	* combined with gathering info about which guest system call gates we can hook up directly. */
2732	unsigned i;
2733	uint8_t u8Idt = 0;
2734	static uint8_t au8Ints[] =
2735	{
2736	#ifdef __WIN__ /* We don't use 0xef and above because they are system stuff on linux (ef is IPI,
2737	* local apic timer, or some other frequently fireing thing). */
2738	0xef, 0xee, 0xed, 0xec,
2739	#endif
2740	0xeb, 0xea, 0xe9, 0xe8,
2741	0xdf, 0xde, 0xdd, 0xdc,
2742	0x7b, 0x7a, 0x79, 0x78,
2743	0xbf, 0xbe, 0xbd, 0xbc,
2744	};
2745	#if defined(__AMD64__) && defined(DEBUG)
2746	static int s_iWobble = 0;
2747	unsigned iMax = !(s_iWobble++ % 2) ? 0x80 : 0x100;
2748	dprintf(("IDT: Idtr=%p:%#x\n", (void *)Idtr.pIdt, (unsigned)Idtr.cbIdt));
2749	for (i = iMax - 0x80; i*16+15 < Idtr.cbIdt && i < iMax; i++)
2750	{
2751	dprintf(("%#x: %04x:%08x%04x%04x P=%d DPL=%d IST=%d Type1=%#x u32Reserved=%#x u5Reserved=%#x\n",
2752	i, paIdt[i].u16SegSel, paIdt[i].u32OffsetTop, paIdt[i].u16OffsetHigh, paIdt[i].u16OffsetLow,
2753	paIdt[i].u1Present, paIdt[i].u2DPL, paIdt[i].u3IST, paIdt[i].u5Type2,
2754	paIdt[i].u32Reserved, paIdt[i].u5Reserved));
2755	}
2756	#endif
2757	/* look for entries which are not present or otherwise unused. */
2758	for (i = 0; i < sizeof(au8Ints) / sizeof(au8Ints[0]); i++)
2759	{
2760	u8Idt = au8Ints[i];
2761	if ( u8Idt * sizeof(SUPDRVIDTE) < Idtr.cbIdt
2762	&& ( !paIdt[u8Idt].u1Present
2763	\|\| paIdt[u8Idt].u5Type2 == 0))
2764	break;
2765	u8Idt = 0;
2766	}
2767	if (!u8Idt)
2768	{
2769	/* try again, look for a compatible entry .*/
2770	for (i = 0; i < sizeof(au8Ints) / sizeof(au8Ints[0]); i++)
2771	{
2772	u8Idt = au8Ints[i];
2773	if ( u8Idt * sizeof(SUPDRVIDTE) < Idtr.cbIdt
2774	&& paIdt[u8Idt].u1Present
2775	&& paIdt[u8Idt].u5Type2 == SUPDRV_IDTE_TYPE2_INTERRUPT_GATE
2776	&& !(paIdt[u8Idt].u16SegSel & 3))
2777	break;
2778	u8Idt = 0;
2779	}
2780	if (!u8Idt)
2781	{
2782	dprintf(("Failed to find appropirate IDT entry!!\n"));
2783	return NULL;
2784	}
2785	}
2786	pDevExt->u8Idt = u8Idt;
2787	dprintf(("supdrvIOCtl_IdtPatchOne: u8Idt=%x\n", u8Idt));
2788	}
2789
2790	/*
2791	* Prepare the patch
2792	*/
2793	memset(pPatch, 0, sizeof(*pPatch));
2794	pPatch->pvIdt = paIdt;
2795	pPatch->cUsage = 1;
2796	pPatch->pIdtEntry = &paIdt[pDevExt->u8Idt];
2797	pPatch->SavedIdt = paIdt[pDevExt->u8Idt];
2798	pPatch->ChangedIdt.u16OffsetLow = (uint32_t)((uintptr_t)&pPatch->auCode[0] & 0xffff);
2799	pPatch->ChangedIdt.u16OffsetHigh = (uint32_t)((uintptr_t)&pPatch->auCode[0] >> 16);
2800	#ifdef __AMD64__
2801	pPatch->ChangedIdt.u32OffsetTop = (uint32_t)((uintptr_t)&pPatch->auCode[0] >> 32);
2802	#endif
2803	pPatch->ChangedIdt.u16SegSel = ASMGetCS();
2804	#ifdef __AMD64__
2805	pPatch->ChangedIdt.u3IST = 0;
2806	pPatch->ChangedIdt.u5Reserved = 0;
2807	#else /* x86 */
2808	pPatch->ChangedIdt.u5Reserved = 0;
2809	pPatch->ChangedIdt.u3Type1 = 0;
2810	#endif /* x86 */
2811	pPatch->ChangedIdt.u5Type2 = SUPDRV_IDTE_TYPE2_INTERRUPT_GATE;
2812	pPatch->ChangedIdt.u2DPL = 3;
2813	pPatch->ChangedIdt.u1Present = 1;
2814
2815	/*
2816	* Generate the patch code.
2817	*/
2818	{
2819	#ifdef __AMD64__
2820	union
2821	{
2822	uint8_t *pb;
2823	uint32_t *pu32;
2824	uint64_t *pu64;
2825	} u, uFixJmp, uFixCall, uNotNested;
2826	u.pb = &pPatch->auCode[0];
2827
2828	/* check the cookie */
2829	*u.pb++ = 0x3d; // cmp eax, GLOBALCOOKIE
2830	*u.pu32++ = pDevExt->u32Cookie;
2831
2832	*u.pb++ = 0x74; // jz @VBoxCall
2833	*u.pb++ = 2;
2834
2835	/* jump to forwarder code. */
2836	*u.pb++ = 0xeb;
2837	uFixJmp = u;
2838	*u.pb++ = 0xfe;
2839
2840	// @VBoxCall:
2841	*u.pb++ = 0x0f; // swapgs
2842	*u.pb++ = 0x01;
2843	*u.pb++ = 0xf8;
2844
2845	/*
2846	* Call VMMR0Entry
2847	* We don't have to push the arguments here, but we have to
2848	* reserve some stack space for the interrupt forwarding.
2849	*/
2850	# ifdef __WIN__
2851	*u.pb++ = 0x50; // push rax ; alignment filler.
2852	*u.pb++ = 0x41; // push r8 ; uArg
2853	*u.pb++ = 0x50;
2854	*u.pb++ = 0x52; // push rdx ; uOperation
2855	*u.pb++ = 0x51; // push rcx ; pVM
2856	# else
2857	*u.pb++ = 0x51; // push rcx ; alignment filler.
2858	*u.pb++ = 0x52; // push rdx ; uArg
2859	*u.pb++ = 0x56; // push rsi ; uOperation
2860	*u.pb++ = 0x57; // push rdi ; pVM
2861	# endif
2862
2863	*u.pb++ = 0xff; // call qword [pfnVMMR0Entry wrt rip]
2864	*u.pb++ = 0x15;
2865	uFixCall = u;
2866	*u.pu32++ = 0;
2867
2868	*u.pb++ = 0x48; // add rsp, 20h ; remove call frame.
2869	*u.pb++ = 0x81;
2870	*u.pb++ = 0xc4;
2871	*u.pu32++ = 0x20;
2872
2873	*u.pb++ = 0x0f; // swapgs
2874	*u.pb++ = 0x01;
2875	*u.pb++ = 0xf8;
2876
2877	/* Return to R3. */
2878	uNotNested = u;
2879	*u.pb++ = 0x48; // iretq
2880	*u.pb++ = 0xcf;
2881
2882	while ((uintptr_t)u.pb & 0x7) // align 8
2883	*u.pb++ = 0xcc;
2884
2885	/* Pointer to the VMMR0Entry. */ // pfnVMMR0Entry dq StubVMMR0Entry
2886	*uFixCall.pu32 = (uint32_t)(u.pb - uFixCall.pb - 4); uFixCall.pb = NULL;
2887	pPatch->offVMMR0EntryFixup = (uint16_t)(u.pb - &pPatch->auCode[0]);
2888	*u.pu64++ = pDevExt->pvVMMR0 ? (uint64_t)pDevExt->pfnVMMR0Entry : (uint64_t)u.pb + 8;
2889
2890	/* stub entry. */ // StubVMMR0Entry:
2891	pPatch->offStub = (uint16_t)(u.pb - &pPatch->auCode[0]);
2892	*u.pb++ = 0x33; // xor eax, eax
2893	*u.pb++ = 0xc0;
2894
2895	*u.pb++ = 0x48; // dec rax
2896	*u.pb++ = 0xff;
2897	*u.pb++ = 0xc8;
2898
2899	*u.pb++ = 0xc3; // ret
2900
2901	/* forward to the original handler using a retf. */
2902	*uFixJmp.pb = (uint8_t)(u.pb - uFixJmp.pb - 1); uFixJmp.pb = NULL;
2903
2904	*u.pb++ = 0x68; // push <target cs>
2905	*u.pu32++ = !pPatch->SavedIdt.u5Type2 ? ASMGetCS() : pPatch->SavedIdt.u16SegSel;
2906
2907	*u.pb++ = 0x68; // push <low target rip>
2908	*u.pu32++ = !pPatch->SavedIdt.u5Type2
2909	? (uint32_t)(uintptr_t)uNotNested.pb
2910	: (uint32_t)pPatch->SavedIdt.u16OffsetLow
2911	\| (uint32_t)pPatch->SavedIdt.u16OffsetHigh << 16;
2912
2913	*u.pb++ = 0xc7; // mov dword [rsp + 4], <high target rip>
2914	*u.pb++ = 0x44;
2915	*u.pb++ = 0x24;
2916	*u.pb++ = 0x04;
2917	*u.pu32++ = !pPatch->SavedIdt.u5Type2
2918	? (uint32_t)((uint64_t)uNotNested.pb >> 32)
2919	: pPatch->SavedIdt.u32OffsetTop;
2920
2921	*u.pb++ = 0x48; // retf ; does this require prefix?
2922	*u.pb++ = 0xcb;
2923
2924	#else /* __X86__ */
2925
2926	union
2927	{
2928	uint8_t *pb;
2929	uint16_t *pu16;
2930	uint32_t *pu32;
2931	} u, uFixJmpNotNested, uFixJmp, uFixCall, uNotNested;
2932	u.pb = &pPatch->auCode[0];
2933
2934	/* check the cookie */
2935	*u.pb++ = 0x81; // cmp esi, GLOBALCOOKIE
2936	*u.pb++ = 0xfe;
2937	*u.pu32++ = pDevExt->u32Cookie;
2938
2939	*u.pb++ = 0x74; // jz VBoxCall
2940	uFixJmp = u;
2941	*u.pb++ = 0;
2942
2943	/* jump (far) to the original handler / not-nested-stub. */
2944	*u.pb++ = 0xea; // jmp far NotNested
2945	uFixJmpNotNested = u;
2946	*u.pu32++ = 0;
2947	*u.pu16++ = 0;
2948
2949	/* save selector registers. */ // VBoxCall:
2950	*uFixJmp.pb = (uint8_t)(u.pb - uFixJmp.pb - 1);
2951	*u.pb++ = 0x0f; // push fs
2952	*u.pb++ = 0xa0;
2953
2954	*u.pb++ = 0x1e; // push ds
2955
2956	*u.pb++ = 0x06; // push es
2957
2958	/* call frame */
2959	*u.pb++ = 0x51; // push ecx
2960
2961	*u.pb++ = 0x52; // push edx
2962
2963	*u.pb++ = 0x50; // push eax
2964
2965	/* load ds, es and perhaps fs before call. */
2966	*u.pb++ = 0xb8; // mov eax, KernelDS
2967	*u.pu32++ = ASMGetDS();
2968
2969	*u.pb++ = 0x8e; // mov ds, eax
2970	*u.pb++ = 0xd8;
2971
2972	*u.pb++ = 0x8e; // mov es, eax
2973	*u.pb++ = 0xc0;
2974
2975	#ifdef __WIN__
2976	*u.pb++ = 0xb8; // mov eax, KernelFS
2977	*u.pu32++ = ASMGetFS();
2978
2979	*u.pb++ = 0x8e; // mov fs, eax
2980	*u.pb++ = 0xe0;
2981	#endif
2982
2983	/* do the call. */
2984	*u.pb++ = 0xe8; // call _VMMR0Entry / StubVMMR0Entry
2985	uFixCall = u;
2986	pPatch->offVMMR0EntryFixup = (uint16_t)(u.pb - &pPatch->auCode[0]);
2987	*u.pu32++ = 0xfffffffb;
2988
2989	*u.pb++ = 0x83; // add esp, 0ch ; cdecl
2990	*u.pb++ = 0xc4;
2991	*u.pb++ = 0x0c;
2992
2993	/* restore selector registers. */
2994	*u.pb++ = 0x07; // pop es
2995	//
2996	*u.pb++ = 0x1f; // pop ds
2997
2998	*u.pb++ = 0x0f; // pop fs
2999	*u.pb++ = 0xa1;
3000
3001	uNotNested = u; // NotNested:
3002	*u.pb++ = 0xcf; // iretd
3003
3004	/* the stub VMMR0Entry. */ // StubVMMR0Entry:
3005	pPatch->offStub = (uint16_t)(u.pb - &pPatch->auCode[0]);
3006	*u.pb++ = 0x33; // xor eax, eax
3007	*u.pb++ = 0xc0;
3008
3009	*u.pb++ = 0x48; // dec eax
3010
3011	*u.pb++ = 0xc3; // ret
3012
3013	/* Fixup the VMMR0Entry call. */
3014	if (pDevExt->pvVMMR0)
3015	*uFixCall.pu32 = (uint32_t)pDevExt->pfnVMMR0Entry - (uint32_t)(uFixCall.pu32 + 1);
3016	else
3017	*uFixCall.pu32 = (uint32_t)&pPatch->auCode[pPatch->offStub] - (uint32_t)(uFixCall.pu32 + 1);
3018
3019	/* Fixup the forward / nested far jump. */
3020	if (!pPatch->SavedIdt.u5Type2)
3021	{
3022	*uFixJmpNotNested.pu32++ = (uint32_t)uNotNested.pb;
3023	*uFixJmpNotNested.pu16++ = ASMGetCS();
3024	}
3025	else
3026	{
3027	*uFixJmpNotNested.pu32++ = ((uint32_t)pPatch->SavedIdt.u16OffsetHigh << 16) \| pPatch->SavedIdt.u16OffsetLow;
3028	*uFixJmpNotNested.pu16++ = pPatch->SavedIdt.u16SegSel;
3029	}
3030	#endif /* __X86__ */
3031	Assert(u.pb <= &pPatch->auCode[sizeof(pPatch->auCode)]);
3032	#if 0
3033	/* dump the patch code */
3034	dprintf(("patch code: %p\n", &pPatch->auCode[0]));
3035	for (uFixCall.pb = &pPatch->auCode[0]; uFixCall.pb < u.pb; uFixCall.pb++)
3036	dprintf(("0x%02x,\n", *uFixCall.pb));
3037	#endif
3038	}
3039
3040	/*
3041	* Install the patch.
3042	*/
3043	supdrvIdtWrite(pPatch->pIdtEntry, &pPatch->ChangedIdt);
3044	AssertMsg(!memcmp((void *)pPatch->pIdtEntry, &pPatch->ChangedIdt, sizeof(pPatch->ChangedIdt)), ("The stupid change code didn't work!!!!!\n"));
3045
3046	/*
3047	* Link in the patch.
3048	*/
3049	pPatch->pNext = pDevExt->pIdtPatches;
3050	pDevExt->pIdtPatches = pPatch;
3051
3052	return pPatch;
3053	}
3054
3055
3056	/**
3057	* Removes the sessions IDT references.
3058	* This will uninstall our IDT patch if we left unreferenced.
3059	*
3060	* @returns 0 indicating success.
3061	* @param pDevExt Device globals.
3062	* @param pSession Session data.
3063	*/
3064	static int supdrvIOCtl_IdtRemoveAll(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
3065	{
3066	PSUPDRVPATCHUSAGE pUsage;
3067	RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3068	dprintf(("supdrvIOCtl_IdtRemoveAll: pSession=%p\n", pSession));
3069
3070	/*
3071	* Take the spinlock.
3072	*/
3073	RTSpinlockAcquireNoInts(pDevExt->Spinlock, &SpinlockTmp);
3074
3075	/*
3076	* Walk usage list.
3077	*/
3078	pUsage = pSession->pPatchUsage;
3079	while (pUsage)
3080	{
3081	if (pUsage->pPatch->cUsage <= pUsage->cUsage)
3082	supdrvIdtRemoveOne(pDevExt, pUsage->pPatch);
3083	else
3084	pUsage->pPatch->cUsage -= pUsage->cUsage;
3085
3086	/* next */
3087	pUsage = pUsage->pNext;
3088	}
3089
3090	/*
3091	* Empty the usage chain and we're done inside the spinlock.
3092	*/
3093	pUsage = pSession->pPatchUsage;
3094	pSession->pPatchUsage = NULL;
3095
3096	RTSpinlockReleaseNoInts(pDevExt->Spinlock, &SpinlockTmp);
3097
3098	/*
3099	* Free usage entries.
3100	*/
3101	while (pUsage)
3102	{
3103	void *pvToFree = pUsage;
3104	pUsage->cUsage = 0;
3105	pUsage->pPatch = NULL;
3106	pUsage = pUsage->pNext;
3107	RTMemFree(pvToFree);
3108	}
3109
3110	return 0;
3111	}
3112
3113
3114	/**
3115	* Remove one patch.
3116	*
3117	* @param pDevExt Device globals.
3118	* @param pPatch Patch entry to remove.
3119	* @remark Caller must own SUPDRVDEVEXT::Spinlock!
3120	*/
3121	static void supdrvIdtRemoveOne(PSUPDRVDEVEXT pDevExt, PSUPDRVPATCH pPatch)
3122	{
3123	dprintf(("supdrvIdtRemoveOne: pPatch=%p\n", pPatch));
3124
3125	pPatch->cUsage = 0;
3126
3127	/*
3128	* If the IDT entry was changed it have to kick around for ever!
3129	* This will be attempted freed again, perhaps next time we'll succeed :-)
3130	*/
3131	if (memcmp((void *)pPatch->pIdtEntry, &pPatch->ChangedIdt, sizeof(pPatch->ChangedIdt)))
3132	{
3133	AssertMsgFailed(("The hijacked IDT entry has CHANGED!!!\n"));
3134	return;
3135	}
3136
3137	/*
3138	* Unlink it.
3139	*/
3140	if (pDevExt->pIdtPatches != pPatch)
3141	{
3142	PSUPDRVPATCH pPatchPrev = pDevExt->pIdtPatches;
3143	while (pPatchPrev)
3144	{
3145	if (pPatchPrev->pNext == pPatch)
3146	{
3147	pPatchPrev->pNext = pPatch->pNext;
3148	break;
3149	}
3150	pPatchPrev = pPatchPrev->pNext;
3151	}
3152	Assert(!pPatchPrev);
3153	}
3154	else
3155	pDevExt->pIdtPatches = pPatch->pNext;
3156	pPatch->pNext = NULL;
3157
3158
3159	/*
3160	* Verify and restore the IDT.
3161	*/
3162	AssertMsg(!memcmp((void *)pPatch->pIdtEntry, &pPatch->ChangedIdt, sizeof(pPatch->ChangedIdt)), ("The hijacked IDT entry has CHANGED!!!\n"));
3163	supdrvIdtWrite(pPatch->pIdtEntry, &pPatch->SavedIdt);
3164	AssertMsg(!memcmp((void *)pPatch->pIdtEntry, &pPatch->SavedIdt, sizeof(pPatch->SavedIdt)), ("The hijacked IDT entry has CHANGED!!!\n"));
3165
3166	/*
3167	* Put it in the free list.
3168	* (This free list stuff is to calm my paranoia.)
3169	*/
3170	pPatch->pvIdt = NULL;
3171	pPatch->pIdtEntry = NULL;
3172
3173	pPatch->pNext = pDevExt->pIdtPatchesFree;
3174	pDevExt->pIdtPatchesFree = pPatch;
3175	}
3176
3177
3178	/**
3179	* Write to an IDT entry.
3180	*
3181	* @param pvIdtEntry Where to write.
3182	* @param pNewIDTEntry What to write.
3183	*/
3184	static void supdrvIdtWrite(volatile void pvIdtEntry, const SUPDRVIDTE pNewIDTEntry)
3185	{
3186	RTUINTREG uCR0;
3187	RTUINTREG uFlags;
3188
3189	/*
3190	* On SMP machines (P4 hyperthreading included) we must preform a
3191	* 64-bit locked write when updating the IDT entry.
3192	*
3193	* The F00F bugfix for linux (and probably other OSes) causes
3194	* the IDT to be pointing to an readonly mapping. We get around that
3195	* by temporarily turning of WP. Since we're inside a spinlock at this
3196	* point, interrupts are disabled and there isn't any way the WP bit
3197	* flipping can cause any trouble.
3198	*/
3199
3200	/* Save & Clear interrupt flag; Save & clear WP. */
3201	uFlags = ASMGetFlags();
3202	ASMSetFlags(uFlags & ~(RTUINTREG)(1 << 9)); /X86_EFL_IF/
3203	Assert(!(ASMGetFlags() & (1 << 9)));
3204	uCR0 = ASMGetCR0();
3205	ASMSetCR0(uCR0 & ~(RTUINTREG)(1 << 16)); /X86_CR0_WP/
3206
3207	/* Update IDT Entry */
3208	#ifdef __AMD64__
3209	ASMAtomicXchgU128((volatile uint128_t )pvIdtEntry, (uint128_t *)(uintptr_t)pNewIDTEntry);
3210	#else
3211	ASMAtomicXchgU64((volatile uint64_t )pvIdtEntry, (uint64_t *)(uintptr_t)pNewIDTEntry);
3212	#endif
3213
3214	/* Restore CR0 & Flags */
3215	ASMSetCR0(uCR0);
3216	ASMSetFlags(uFlags);
3217	}
3218	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
3219
3220
3221	/**
3222	* Opens an image. If it's the first time it's opened the call must upload
3223	* the bits using the supdrvIOCtl_LdrLoad() / SUPDRV_IOCTL_LDR_LOAD function.
3224	*
3225	* This is the 1st step of the loading.
3226	*
3227	* @returns 0 on success.
3228	* @returns SUPDRV_ERR_* on failure.
3229	* @param pDevExt Device globals.
3230	* @param pSession Session data.
3231	* @param pIn Input.
3232	* @param pOut Output. (May overlap pIn.)
3233	*/
3234	static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN_IN pIn, PSUPLDROPEN_OUT pOut)
3235	{
3236	PSUPDRVLDRIMAGE pImage;
3237	unsigned cb;
3238	void *pv;
3239	dprintf(("supdrvIOCtl_LdrOpen: szName=%s cbImage=%d\n", pIn->szName, pIn->cbImage));
3240
3241	/*
3242	* Check if we got an instance of the image already.
3243	*/
3244	RTSemFastMutexRequest(pDevExt->mtxLdr);
3245	for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
3246	{
3247	if (!strcmp(pImage->szName, pIn->szName))
3248	{
3249	pImage->cUsage++;
3250	pOut->pvImageBase = pImage->pvImage;
3251	pOut->fNeedsLoading = pImage->uState == SUP_IOCTL_LDR_OPEN;
3252	supdrvLdrAddUsage(pSession, pImage);
3253	RTSemFastMutexRelease(pDevExt->mtxLdr);
3254	return 0;
3255	}
3256	}
3257	/* (not found - add it!) */
3258
3259	/*
3260	* Allocate memory.
3261	*/
3262	cb = pIn->cbImage + sizeof(SUPDRVLDRIMAGE) + 31;
3263	pv = RTMemExecAlloc(cb);
3264	if (!pv)
3265	{
3266	RTSemFastMutexRelease(pDevExt->mtxLdr);
3267	return SUPDRV_ERR_NO_MEMORY;
3268	}
3269
3270	/*
3271	* Setup and link in the LDR stuff.
3272	*/
3273	pImage = (PSUPDRVLDRIMAGE)pv;
3274	pImage->pvImage = ALIGNP(pImage + 1, 32);
3275	pImage->cbImage = pIn->cbImage;
3276	pImage->pfnModuleInit = NULL;
3277	pImage->pfnModuleTerm = NULL;
3278	pImage->uState = SUP_IOCTL_LDR_OPEN;
3279	pImage->cUsage = 1;
3280	strcpy(pImage->szName, pIn->szName);
3281
3282	pImage->pNext = pDevExt->pLdrImages;
3283	pDevExt->pLdrImages = pImage;
3284
3285	supdrvLdrAddUsage(pSession, pImage);
3286
3287	pOut->pvImageBase = pImage->pvImage;
3288	pOut->fNeedsLoading = 1;
3289	RTSemFastMutexRelease(pDevExt->mtxLdr);
3290	return 0;
3291	}
3292
3293
3294	/**
3295	* Loads the image bits.
3296	*
3297	* This is the 2nd step of the loading.
3298	*
3299	* @returns 0 on success.
3300	* @returns SUPDRV_ERR_* on failure.
3301	* @param pDevExt Device globals.
3302	* @param pSession Session data.
3303	* @param pIn Input.
3304	*/
3305	static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD_IN pIn)
3306	{
3307	PSUPDRVLDRUSAGE pUsage;
3308	PSUPDRVLDRIMAGE pImage;
3309	int rc;
3310	dprintf(("supdrvIOCtl_LdrLoad: pvImageBase=%p cbImage=%d\n", pIn->pvImageBase, pIn->cbImage));
3311
3312	/*
3313	* Find the ldr image.
3314	*/
3315	RTSemFastMutexRequest(pDevExt->mtxLdr);
3316	pUsage = pSession->pLdrUsage;
3317	while (pUsage && pUsage->pImage->pvImage != pIn->pvImageBase)
3318	pUsage = pUsage->pNext;
3319	if (!pUsage)
3320	{
3321	RTSemFastMutexRelease(pDevExt->mtxLdr);
3322	dprintf(("SUP_IOCTL_LDR_LOAD: couldn't find image!\n"));
3323	return SUPDRV_ERR_INVALID_HANDLE;
3324	}
3325	pImage = pUsage->pImage;
3326	if (pImage->cbImage != pIn->cbImage)
3327	{
3328	RTSemFastMutexRelease(pDevExt->mtxLdr);
3329	dprintf(("SUP_IOCTL_LDR_LOAD: image size mismatch!! %d(prep) != %d(load)\n", pImage->cbImage, pIn->cbImage));
3330	return SUPDRV_ERR_INVALID_HANDLE;
3331	}
3332	if (pImage->uState != SUP_IOCTL_LDR_OPEN)
3333	{
3334	unsigned uState = pImage->uState;
3335	RTSemFastMutexRelease(pDevExt->mtxLdr);
3336	if (uState != SUP_IOCTL_LDR_LOAD)
3337	AssertMsgFailed(("SUP_IOCTL_LDR_LOAD: invalid image state %d (%#x)!\n", uState, uState));
3338	return SUPDRV_ERR_ALREADY_LOADED;
3339	}
3340	switch (pIn->eEPType)
3341	{
3342	case EP_NOTHING:
3343	break;
3344	case EP_VMMR0:
3345	if (!pIn->EP.VMMR0.pvVMMR0 \|\| !pIn->EP.VMMR0.pvVMMR0Entry)
3346	{
3347	RTSemFastMutexRelease(pDevExt->mtxLdr);
3348	dprintf(("pvVMMR0=%p or pIn->EP.VMMR0.pvVMMR0Entry=%p is NULL!\n",
3349	pIn->EP.VMMR0.pvVMMR0, pIn->EP.VMMR0.pvVMMR0Entry));
3350	return SUPDRV_ERR_INVALID_PARAM;
3351	}
3352	if ((uintptr_t)pIn->EP.VMMR0.pvVMMR0Entry - (uintptr_t)pImage->pvImage >= pIn->cbImage)
3353	{
3354	RTSemFastMutexRelease(pDevExt->mtxLdr);
3355	dprintf(("SUP_IOCTL_LDR_LOAD: pvVMMR0Entry=%p is outside the image (%p %d bytes)\n",
3356	pIn->EP.VMMR0.pvVMMR0Entry, pImage->pvImage, pIn->cbImage));
3357	return SUPDRV_ERR_INVALID_PARAM;
3358	}
3359	break;
3360	default:
3361	RTSemFastMutexRelease(pDevExt->mtxLdr);
3362	dprintf(("Invalid eEPType=%d\n", pIn->eEPType));
3363	return SUPDRV_ERR_INVALID_PARAM;
3364	}
3365	if ( pIn->pfnModuleInit
3366	&& (uintptr_t)pIn->pfnModuleInit - (uintptr_t)pImage->pvImage >= pIn->cbImage)
3367	{
3368	RTSemFastMutexRelease(pDevExt->mtxLdr);
3369	dprintf(("SUP_IOCTL_LDR_LOAD: pfnModuleInit=%p is outside the image (%p %d bytes)\n",
3370	pIn->pfnModuleInit, pImage->pvImage, pIn->cbImage));
3371	return SUPDRV_ERR_INVALID_PARAM;
3372	}
3373	if ( pIn->pfnModuleTerm
3374	&& (uintptr_t)pIn->pfnModuleTerm - (uintptr_t)pImage->pvImage >= pIn->cbImage)
3375	{
3376	RTSemFastMutexRelease(pDevExt->mtxLdr);
3377	dprintf(("SUP_IOCTL_LDR_LOAD: pfnModuleTerm=%p is outside the image (%p %d bytes)\n",
3378	pIn->pfnModuleTerm, pImage->pvImage, pIn->cbImage));
3379	return SUPDRV_ERR_INVALID_PARAM;
3380	}
3381
3382	/*
3383	* Copy the memory.
3384	*/
3385	/* no need to do try/except as this is a buffered request. */
3386	memcpy(pImage->pvImage, &pIn->achImage[0], pImage->cbImage);
3387	pImage->uState = SUP_IOCTL_LDR_LOAD;
3388	pImage->pfnModuleInit = pIn->pfnModuleInit;
3389	pImage->pfnModuleTerm = pIn->pfnModuleTerm;
3390	pImage->offSymbols = pIn->offSymbols;
3391	pImage->cSymbols = pIn->cSymbols;
3392	pImage->offStrTab = pIn->offStrTab;
3393	pImage->cbStrTab = pIn->cbStrTab;
3394
3395	/*
3396	* Update any entry points.
3397	*/
3398	switch (pIn->eEPType)
3399	{
3400	default:
3401	case EP_NOTHING:
3402	rc = 0;
3403	break;
3404	case EP_VMMR0:
3405	rc = supdrvLdrSetR0EP(pDevExt, pIn->EP.VMMR0.pvVMMR0, pIn->EP.VMMR0.pvVMMR0Entry);
3406	break;
3407	}
3408
3409	/*
3410	* On success call the module initialization.
3411	*/
3412	dprintf(("supdrvIOCtl_LdrLoad: pfnModuleInit=%p\n", pImage->pfnModuleInit));
3413	if (!rc && pImage->pfnModuleInit)
3414	{
3415	dprintf(("supdrvIOCtl_LdrLoad: calling pfnModuleInit=%p\n", pImage->pfnModuleInit));
3416	rc = pImage->pfnModuleInit();
3417	if (rc && pDevExt->pvVMMR0 == pImage->pvImage)
3418	supdrvLdrUnsetR0EP(pDevExt);
3419	}
3420
3421	if (rc)
3422	pImage->uState = SUP_IOCTL_LDR_OPEN;
3423
3424	RTSemFastMutexRelease(pDevExt->mtxLdr);
3425	return rc;
3426	}
3427
3428
3429	/**
3430	* Frees a previously loaded (prep'ed) image.
3431	*
3432	* @returns 0 on success.
3433	* @returns SUPDRV_ERR_* on failure.
3434	* @param pDevExt Device globals.
3435	* @param pSession Session data.
3436	* @param pIn Input.
3437	*/
3438	static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE_IN pIn)
3439	{
3440	PSUPDRVLDRUSAGE pUsagePrev;
3441	PSUPDRVLDRUSAGE pUsage;
3442	PSUPDRVLDRIMAGE pImage;
3443	dprintf(("supdrvIOCtl_LdrFree: pvImageBase=%p\n", pIn->pvImageBase));
3444
3445	/*
3446	* Find the ldr image.
3447	*/
3448	RTSemFastMutexRequest(pDevExt->mtxLdr);
3449	pUsagePrev = NULL;
3450	pUsage = pSession->pLdrUsage;
3451	while (pUsage && pUsage->pImage->pvImage != pIn->pvImageBase)
3452	{
3453	pUsagePrev = pUsage;
3454	pUsage = pUsage->pNext;
3455	}
3456	if (!pUsage)
3457	{
3458	RTSemFastMutexRelease(pDevExt->mtxLdr);
3459	dprintf(("SUP_IOCTL_LDR_FREE: couldn't find image!\n"));
3460	return SUPDRV_ERR_INVALID_HANDLE;
3461	}
3462
3463	/*
3464	* Check if we can remove anything.
3465	*/
3466	pImage = pUsage->pImage;
3467	if (pImage->cUsage <= 1 \|\| pUsage->cUsage <= 1)
3468	{
3469	/* unlink it */
3470	if (pUsagePrev)
3471	pUsagePrev->pNext = pUsage->pNext;
3472	else
3473	pSession->pLdrUsage = pUsage->pNext;
3474	/* free it */
3475	pUsage->pImage = NULL;
3476	pUsage->pNext = NULL;
3477	RTMemFree(pUsage);
3478
3479	/*
3480	* Derefrence the image.
3481	*/
3482	if (pImage->cUsage <= 1)
3483	supdrvLdrFree(pDevExt, pImage);
3484	else
3485	pImage->cUsage--;
3486	}
3487	else
3488	{
3489	/*
3490	* Dereference both image and usage.
3491	*/
3492	pImage->cUsage--;
3493	pUsage->cUsage--;
3494	}
3495
3496	RTSemFastMutexRelease(pDevExt->mtxLdr);
3497	return 0;
3498	}
3499
3500
3501	/**
3502	* Gets the address of a symbol in an open image.
3503	*
3504	* @returns 0 on success.
3505	* @returns SUPDRV_ERR_* on failure.
3506	* @param pDevExt Device globals.
3507	* @param pSession Session data.
3508	* @param pIn Input.
3509	* @param pOut Output. (May overlap pIn.)
3510	*/
3511	static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL_IN pIn, PSUPLDRGETSYMBOL_OUT pOut)
3512	{
3513	PSUPDRVLDRIMAGE pImage;
3514	PSUPDRVLDRUSAGE pUsage;
3515	uint32_t i;
3516	PSUPLDRSYM paSyms;
3517	const char *pchStrings;
3518	const size_t cbSymbol = strlen(pIn->szSymbol) + 1;
3519	void *pvSymbol = NULL;
3520	int rc = SUPDRV_ERR_GENERAL_FAILURE; /** @todo better error code. */
3521	dprintf2(("supdrvIOCtl_LdrGetSymbol: pvImageBase=%p szSymbol=\"%s\"\n", pIn->pvImageBase, pIn->szSymbol));
3522
3523	/*
3524	* Find the ldr image.
3525	*/
3526	RTSemFastMutexRequest(pDevExt->mtxLdr);
3527	pUsage = pSession->pLdrUsage;
3528	while (pUsage && pUsage->pImage->pvImage != pIn->pvImageBase)
3529	pUsage = pUsage->pNext;
3530	if (!pUsage)
3531	{
3532	RTSemFastMutexRelease(pDevExt->mtxLdr);
3533	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: couldn't find image!\n"));
3534	return SUPDRV_ERR_INVALID_HANDLE;
3535	}
3536	pImage = pUsage->pImage;
3537	if (pImage->uState != SUP_IOCTL_LDR_LOAD)
3538	{
3539	unsigned uState = pImage->uState;
3540	RTSemFastMutexRelease(pDevExt->mtxLdr);
3541	dprintf(("SUP_IOCTL_LDR_GET_SYMBOL: invalid image state %d (%#x)!\n", uState, uState)); NOREF(uState);
3542	return SUPDRV_ERR_ALREADY_LOADED;
3543	}
3544
3545	/*
3546	* Search the symbol string.
3547	*/
3548	pchStrings = (const char )((uint8_t )pImage->pvImage + pImage->offStrTab);
3549	paSyms = (PSUPLDRSYM)((uint8_t *)pImage->pvImage + pImage->offSymbols);
3550	for (i = 0; i < pImage->cSymbols; i++)
3551	{
3552	if ( paSyms[i].offSymbol < pImage->cbImage /* paranoia */
3553	&& paSyms[i].offName + cbSymbol <= pImage->cbStrTab
3554	&& !memcmp(pchStrings + paSyms[i].offName, pIn->szSymbol, cbSymbol))
3555	{
3556	pvSymbol = (uint8_t *)pImage->pvImage + paSyms[i].offSymbol;
3557	rc = 0;
3558	break;
3559	}
3560	}
3561	RTSemFastMutexRelease(pDevExt->mtxLdr);
3562	pOut->pvSymbol = pvSymbol;
3563	return rc;
3564	}
3565
3566
3567	/**
3568	* Updates the IDT patches to point to the specified VMM R0 entry
3569	* point (i.e. VMMR0Enter()).
3570	*
3571	* @returns 0 on success.
3572	* @returns SUPDRV_ERR_* on failure.
3573	* @param pDevExt Device globals.
3574	* @param pSession Session data.
3575	* @param pVMMR0 VMMR0 image handle.
3576	* @param pVMMR0Entry VMMR0Entry address.
3577	* @remark Caller must own the loader mutex.
3578	*/
3579	static int supdrvLdrSetR0EP(PSUPDRVDEVEXT pDevExt, void pvVMMR0, void pvVMMR0Entry)
3580	{
3581	int rc;
3582	dprintf(("supdrvLdrSetR0EP pvVMMR0=%p pvVMMR0Entry=%p\n", pvVMMR0, pvVMMR0Entry));
3583
3584
3585	/*
3586	* Check if not yet set.
3587	*/
3588	rc = 0;
3589	if (!pDevExt->pvVMMR0)
3590	{
3591	#ifndef VBOX_WITHOUT_IDT_PATCHING
3592	PSUPDRVPATCH pPatch;
3593	#endif
3594
3595	/*
3596	* Set it and update IDT patch code.
3597	*/
3598	pDevExt->pvVMMR0 = pvVMMR0;
3599	pDevExt->pfnVMMR0Entry = pvVMMR0Entry;
3600	#ifndef VBOX_WITHOUT_IDT_PATCHING
3601	for (pPatch = pDevExt->pIdtPatches; pPatch; pPatch = pPatch->pNext)
3602	{
3603	# ifdef __AMD64__
3604	ASMAtomicXchgU64((volatile uint64_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup], (uint64_t)pvVMMR0);
3605	# else /* __X86__ */
3606	ASMAtomicXchgU32((volatile uint32_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup],
3607	(uint32_t)pvVMMR0 - (uint32_t)&pPatch->auCode[pPatch->offVMMR0EntryFixup + 4]);
3608	# endif
3609	}
3610	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
3611	}
3612	else
3613	{
3614	/*
3615	* Return failure or success depending on whether the
3616	* values match or not.
3617	*/
3618	if ( pDevExt->pvVMMR0 != pvVMMR0
3619	\|\| (void *)pDevExt->pfnVMMR0Entry != pvVMMR0Entry)
3620	{
3621	AssertMsgFailed(("SUP_IOCTL_LDR_SETR0EP: Already set pointing to a different module!\n"));
3622	rc = SUPDRV_ERR_INVALID_PARAM;
3623	}
3624	}
3625	return rc;
3626	}
3627
3628
3629	/**
3630	* Unsets the R0 entry point installed by supdrvLdrSetR0EP.
3631	*
3632	* @param pDevExt Device globals.
3633	*/
3634	static void supdrvLdrUnsetR0EP(PSUPDRVDEVEXT pDevExt)
3635	{
3636	#ifndef VBOX_WITHOUT_IDT_PATCHING
3637	PSUPDRVPATCH pPatch;
3638	#endif
3639
3640	pDevExt->pvVMMR0 = NULL;
3641	pDevExt->pfnVMMR0Entry = NULL;
3642
3643	#ifndef VBOX_WITHOUT_IDT_PATCHING
3644	for (pPatch = pDevExt->pIdtPatches; pPatch; pPatch = pPatch->pNext)
3645	{
3646	# ifdef __AMD64__
3647	ASMAtomicXchgU64((volatile uint64_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup],
3648	(uint64_t)&pPatch->auCode[pPatch->offStub]);
3649	# else /* __X86__ */
3650	ASMAtomicXchgU32((volatile uint32_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup],
3651	(uint32_t)&pPatch->auCode[pPatch->offStub] - (uint32_t)&pPatch->auCode[pPatch->offVMMR0EntryFixup + 4]);
3652	# endif
3653	}
3654	#endif /* !VBOX_WITHOUT_IDT_PATCHING */
3655	}
3656
3657
3658	/**
3659	* Adds a usage reference in the specified session of an image.
3660	*
3661	* @param pSession Session in question.
3662	* @param pImage Image which the session is using.
3663	*/
3664	static void supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage)
3665	{
3666	PSUPDRVLDRUSAGE pUsage;
3667	dprintf(("supdrvLdrAddUsage: pImage=%p\n", pImage));
3668
3669	/*
3670	* Referenced it already?
3671	*/
3672	pUsage = pSession->pLdrUsage;
3673	while (pUsage)
3674	{
3675	if (pUsage->pImage == pImage)
3676	{
3677	pUsage->cUsage++;
3678	return;
3679	}
3680	pUsage = pUsage->pNext;
3681	}
3682
3683	/*
3684	* Allocate new usage record.
3685	*/
3686	pUsage = (PSUPDRVLDRUSAGE)RTMemAlloc(sizeof(*pUsage));
3687	Assert(pUsage);
3688	if (pUsage)
3689	{
3690	pUsage->cUsage = 1;
3691	pUsage->pImage = pImage;
3692	pUsage->pNext = pSession->pLdrUsage;
3693	pSession->pLdrUsage = pUsage;
3694	}
3695	/* ignore errors... */
3696	}
3697
3698
3699	/**
3700	* Frees a load image.
3701	*
3702	* @param pDevExt Pointer to device extension.
3703	* @param pImage Pointer to the image we're gonna free.
3704	* This image must exit!
3705	* @remark The caller MUST own SUPDRVDEVEXT::mtxLdr!
3706	*/
3707	static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage)
3708	{
3709	PSUPDRVLDRIMAGE pImagePrev;
3710	dprintf(("supdrvLdrFree: pImage=%p\n", pImage));
3711
3712	/* find it - arg. should've used doubly linked list. */
3713	Assert(pDevExt->pLdrImages);
3714	pImagePrev = NULL;
3715	if (pDevExt->pLdrImages != pImage)
3716	{
3717	pImagePrev = pDevExt->pLdrImages;
3718	while (pImagePrev->pNext != pImage)
3719	pImagePrev = pImagePrev->pNext;
3720	Assert(pImagePrev->pNext == pImage);
3721	}
3722
3723	/* unlink */
3724	if (pImagePrev)
3725	pImagePrev->pNext = pImage->pNext;
3726	else
3727	pDevExt->pLdrImages = pImage->pNext;
3728
3729	/* check if this is VMMR0.r0 and fix the Idt patches if it is. */
3730	if (pDevExt->pvVMMR0 == pImage->pvImage)
3731	supdrvLdrUnsetR0EP(pDevExt);
3732
3733	/* call termination function if fully loaded. */
3734	if ( pImage->pfnModuleTerm
3735	&& pImage->uState == SUP_IOCTL_LDR_LOAD)
3736	{
3737	dprintf(("supdrvIOCtl_LdrLoad: calling pfnModuleTerm=%p\n", pImage->pfnModuleTerm));
3738	pImage->pfnModuleTerm();
3739	}
3740
3741	/* free the image */
3742	pImage->cUsage = 0;
3743	pImage->pNext = 0;
3744	pImage->uState = SUP_IOCTL_LDR_FREE;
3745	RTMemExecFree(pImage);
3746	}
3747
3748
3749	/**
3750	* Gets the current paging mode of the CPU and stores in in pOut.
3751	*/
3752	static int supdrvIOCtl_GetPagingMode(PSUPGETPAGINGMODE_OUT pOut)
3753	{
3754	RTUINTREG cr0 = ASMGetCR0();
3755	if ((cr0 & (X86_CR0_PG \| X86_CR0_PE)) != (X86_CR0_PG \| X86_CR0_PE))
3756	pOut->enmMode = SUPPAGINGMODE_INVALID;
3757	else
3758	{
3759	RTUINTREG cr4 = ASMGetCR4();
3760	uint32_t fNXEPlusLMA = 0;
3761	if (cr4 & X86_CR4_PAE)
3762	{
3763	uint32_t fAmdFeatures = ASMCpuId_EDX(0x80000001);
3764	if (fAmdFeatures & (X86_CPUID_AMD_FEATURE_EDX_NX \| X86_CPUID_AMD_FEATURE_EDX_LONG_MODE))
3765	{
3766	uint64_t efer = ASMRdMsr(MSR_K6_EFER);
3767	if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_NX) && (efer & MSR_K6_EFER_NXE))
3768	fNXEPlusLMA \|= BIT(0);
3769	if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE) && (efer & MSR_K6_EFER_LMA))
3770	fNXEPlusLMA \|= BIT(1);
3771	}
3772	}
3773
3774	switch ((cr4 & (X86_CR4_PAE \| X86_CR4_PGE)) \| fNXEPlusLMA)
3775	{
3776	case 0:
3777	pOut->enmMode = SUPPAGINGMODE_32_BIT;
3778	break;
3779
3780	case X86_CR4_PGE:
3781	pOut->enmMode = SUPPAGINGMODE_32_BIT_GLOBAL;
3782	break;
3783
3784	case X86_CR4_PAE:
3785	pOut->enmMode = SUPPAGINGMODE_PAE;
3786	break;
3787
3788	case X86_CR4_PAE \| BIT(0):
3789	pOut->enmMode = SUPPAGINGMODE_PAE_NX;
3790	break;
3791
3792	case X86_CR4_PAE \| X86_CR4_PGE:
3793	pOut->enmMode = SUPPAGINGMODE_PAE_GLOBAL;
3794	break;
3795
3796	case X86_CR4_PAE \| X86_CR4_PGE \| BIT(0):
3797	pOut->enmMode = SUPPAGINGMODE_PAE_GLOBAL;
3798	break;
3799
3800	case BIT(1) \| X86_CR4_PAE:
3801	pOut->enmMode = SUPPAGINGMODE_AMD64;
3802	break;
3803
3804	case BIT(1) \| X86_CR4_PAE \| BIT(0):
3805	pOut->enmMode = SUPPAGINGMODE_AMD64_NX;
3806	break;
3807
3808	case BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE:
3809	pOut->enmMode = SUPPAGINGMODE_AMD64_GLOBAL;
3810	break;
3811
3812	case BIT(1) \| X86_CR4_PAE \| X86_CR4_PGE \| BIT(0):
3813	pOut->enmMode = SUPPAGINGMODE_AMD64_GLOBAL_NX;
3814	break;
3815
3816	default:
3817	AssertMsgFailed(("Cannot happen! cr4=%#x fNXEPlusLMA=%d\n", cr4, fNXEPlusLMA));
3818	pOut->enmMode = SUPPAGINGMODE_INVALID;
3819	break;
3820	}
3821	}
3822	return 0;
3823	}
3824
3825
3826	#if !defined(SUPDRV_OS_HAVE_LOW) && !defined(USE_NEW_OS_INTERFACE) /* Use same backend as the contiguous stuff */
3827	/**
3828	* OS Specific code for allocating page aligned memory with fixed
3829	* physical backing below 4GB.
3830	*
3831	* @returns 0 on success.
3832	* @returns SUPDRV_ERR_* on failure.
3833	* @param pMem Memory reference record of the memory to be allocated.
3834	* (This is not linked in anywhere.)
3835	* @param ppvR3 Where to store the Ring-3 mapping of the allocated memory.
3836	* @param paPagesOut Where to store the physical addresss.
3837	*/
3838	int VBOXCALL supdrvOSLowAllocOne(PSUPDRVMEMREF pMem, void **ppvR3, PSUPPAGE paPagesOut)
3839	{
3840	RTHCPHYS HCPhys;
3841	int rc = supdrvOSContAllocOne(pMem, NULL, ppvR3, &HCPhys);
3842	if (!rc)
3843	{
3844	unsigned iPage = pMem->cb >> PAGE_SHIFT;
3845	while (iPage-- > 0)
3846	{
3847	paPagesOut[iPage].Phys = HCPhys + (iPage << PAGE_SHIFT);
3848	paPagesOut[iPage].uReserved = 0;
3849	}
3850	}
3851	return rc;
3852	}
3853
3854
3855	/**
3856	* Frees low memory.
3857	*
3858	* @param pMem Memory reference record of the memory to be freed.
3859	*/
3860	void VBOXCALL supdrvOSLowFreeOne(PSUPDRVMEMREF pMem)
3861	{
3862	supdrvOSContFreeOne(pMem);
3863	}
3864	#endif /* !SUPDRV_OS_HAVE_LOW */
3865
3866
3867	#ifdef USE_NEW_OS_INTERFACE
3868	/**
3869	* Creates the GIP.
3870	*
3871	* @returns negative errno.
3872	* @param pDevExt Instance data. GIP stuff may be updated.
3873	*/
3874	static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt)
3875	{
3876	PSUPGLOBALINFOPAGE pGip;
3877	RTHCPHYS HCPhysGip;
3878	uint32_t u32SystemResolution;
3879	uint32_t u32Interval;
3880	int rc;
3881
3882	dprintf(("supdrvGipCreate:\n"));
3883
3884	/* assert order */
3885	Assert(pDevExt->u32SystemTimerGranularityGrant == 0);
3886	Assert(pDevExt->GipMemObj == NIL_RTR0MEMOBJ);
3887	Assert(!pDevExt->pGipTimer);
3888
3889	/*
3890	* Allocate a suitable page with a default kernel mapping.
3891	*/
3892	rc = RTR0MemObjAllocLow(&pDevExt->GipMemObj, PAGE_SIZE, false);
3893	if (RT_FAILURE(rc))
3894	{
3895	OSDBGPRINT(("supdrvGipCreate: failed to allocate the GIP page. rc=%d\n", rc));
3896	return rc;
3897	}
3898	pGip = (PSUPGLOBALINFOPAGE)RTR0MemObjAddress(pDevExt->GipMemObj); AssertPtr(pGip);
3899	HCPhysGip = RTR0MemObjGetPagePhysAddr(pDevExt->GipMemObj, 0); Assert(HCPhysGip != NIL_RTHCPHYS);
3900
3901	/*
3902	* Try bump up the system timer resolution.
3903	* The more interrupts the better...
3904	*/
3905	if ( RT_SUCCESS(RTTimerRequestSystemGranularity( 976563 /* 1024 HZ */, &u32SystemResolution))
3906	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 1000000 /* 1000 HZ */, &u32SystemResolution))
3907	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 3906250 /* 256 HZ */, &u32SystemResolution))
3908	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 4000000 /* 250 HZ */, &u32SystemResolution))
3909	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity( 7812500 /* 128 HZ */, &u32SystemResolution))
3910	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(10000000 /* 100 HZ */, &u32SystemResolution))
3911	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(15625000 /* 64 HZ */, &u32SystemResolution))
3912	\|\| RT_SUCCESS(RTTimerRequestSystemGranularity(31250000 /* 32 HZ */, &u32SystemResolution))
3913	)
3914	{
3915	Assert(RTTimerGetSystemGranularity() <= u32SystemResolution);
3916	pDevExt->u32SystemTimerGranularityGrant = u32SystemResolution;
3917	}
3918
3919	/*
3920	* Find a reasonable update interval, something close to 10ms would be nice,
3921	* and create a recurring timer.
3922	*/
3923	u32Interval = u32SystemResolution = RTTimerGetSystemGranularity();
3924	while (u32Interval < 10000000 /* 10 ms */)
3925	u32Interval += u32SystemResolution;
3926
3927	rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, 0, supdrvGipTimer, pDevExt);
3928	if (RT_FAILURE(rc))
3929	{
3930	OSDBGPRINT(("supdrvGipCreate: failed create GIP timer at %RU32 ns interval. rc=%d\n", u32Interval, rc));
3931	Assert(!pDevExt->pGipTimer);
3932	supdrvGipDestroy(pDevExt);
3933	return rc;
3934	}
3935
3936	/*
3937	* We're good.
3938	*/
3939	supdrvGipInit(pDevExt, pGip, HCPhysGip, RTTimeSystemNanoTS(), 1000000000 / u32Interval /=Hz/);
3940	return 0;
3941	}
3942
3943
3944	/**
3945	* Terminates the GIP.
3946	*
3947	* @returns negative errno.
3948	* @param pDevExt Instance data. GIP stuff may be updated.
3949	*/
3950	static int supdrvGipDestroy(PSUPDRVDEVEXT pDevExt)
3951	{
3952	int rc;
3953
3954	/*
3955	* Invalid the GIP data.
3956	*/
3957	if (pDevExt->pGip)
3958	{
3959	supdrvGipTerm(pDevExt->pGip);
3960	pDevExt->pGip = 0;
3961	}
3962
3963	/*
3964	* Destroy the timer and free the GIP memory object.
3965	*/
3966	if (pDevExt->pGipTimer)
3967	{
3968	rc = RTTimerDestroy(pDevExt->pGipTimer); AssertRC(rc);
3969	pDevExt->pGipTimer = NULL;
3970	}
3971
3972	if (pDevExt->GipMemObj != NIL_RTR0MEMOBJ)
3973	{
3974	rc = RTR0MemObjFree(pDevExt->GipMemObj, true /* free mappings */); AssertRC(rc);
3975	pDevExt->GipMemObj = NIL_RTR0MEMOBJ;
3976	}
3977
3978	/*
3979	* Finally, release the system timer resolution request if one succeeded.
3980	*/
3981	if (pDevExt->u32SystemTimerGranularityGrant)
3982	{
3983	rc = RTTimerReleaseSystemGranularity(pDevExt->u32SystemTimerGranularityGrant); AssertRC(rc);
3984	pDevExt->u32SystemTimerGranularityGrant = 0;
3985	}
3986
3987	return 0;
3988	}
3989
3990
3991	/**
3992	* Timer callback function.
3993	* @param pTimer The timer.
3994	* @param pvUser The device extension.
3995	*/
3996	static DECLCALLBACK(void) supdrvGipTimer(PRTTIMER pTimer, void *pvUser)
3997	{
3998	PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
3999	supdrvGipUpdate(pDevExt->pGip, RTTimeSystemNanoTS());
4000	}
4001	#endif /* USE_NEW_OS_INTERFACE */
4002
4003
4004	/**
4005	* Initializes the GIP data.
4006	*
4007	* @returns VBox status code.
4008	* @param pDevExt Pointer to the device instance data.
4009	* @param pGip Pointer to the read-write kernel mapping of the GIP.
4010	* @param HCPhys The physical address of the GIP.
4011	* @param u64NanoTS The current nanosecond timestamp.
4012	* @param uUpdateHz The update freqence.
4013	*/
4014	int VBOXCALL supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys, uint64_t u64NanoTS, unsigned uUpdateHz)
4015	{
4016	unsigned i;
4017	dprintf(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
4018
4019	/*
4020	* Initialize the structure.
4021	*/
4022	memset(pGip, 0, PAGE_SIZE);
4023	pGip->u32Magic = SUPGLOBALINFOPAGE_MAGIC;
4024	pGip->u32Mode = supdrvGipDeterminTscMode();
4025	pGip->u32UpdateHz = uUpdateHz;
4026	pGip->u32UpdateIntervalNS = 1000000000 / uUpdateHz;
4027	pGip->u64NanoTSLastUpdateHz = u64NanoTS;
4028
4029	for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
4030	{
4031	pGip->aCPUs[i].u32TransactionId = 2;
4032	pGip->aCPUs[i].u64NanoTS = u64NanoTS;
4033	pGip->aCPUs[i].u64TSC = ASMReadTSC();
4034
4035	/*
4036	* We don't know the following values until we've executed updates.
4037	* So, we'll just insert very high values.
4038	*/
4039	pGip->aCPUs[i].u64CpuHz = _4G + 1;
4040	pGip->aCPUs[i].u32UpdateIntervalTSC = _2G / 4;
4041	pGip->aCPUs[i].au32TSCHistory[0] = _2G / 4;
4042	pGip->aCPUs[i].au32TSCHistory[1] = _2G / 4;
4043	pGip->aCPUs[i].au32TSCHistory[2] = _2G / 4;
4044	pGip->aCPUs[i].au32TSCHistory[3] = _2G / 4;
4045	pGip->aCPUs[i].au32TSCHistory[4] = _2G / 4;
4046	pGip->aCPUs[i].au32TSCHistory[5] = _2G / 4;
4047	pGip->aCPUs[i].au32TSCHistory[6] = _2G / 4;
4048	pGip->aCPUs[i].au32TSCHistory[7] = _2G / 4;
4049	}
4050
4051	/*
4052	* Link it to the device extension.
4053	*/
4054	pDevExt->pGip = pGip;
4055	pDevExt->HCPhysGip = HCPhys;
4056	pDevExt->cGipUsers = 0;
4057
4058	return 0;
4059	}
4060
4061
4062	/**
4063	* Determin the GIP TSC mode.
4064	*
4065	* @returns The most suitable TSC mode.
4066	*/
4067	static SUPGIPMODE supdrvGipDeterminTscMode(void)
4068	{
4069	#ifndef USE_NEW_OS_INTERFACE
4070	if (supdrvOSGetCPUCount() > 1)
4071	{
4072	uint32_t uEAX, uEBX, uECX, uEDX;
4073
4074	/* Check for "AuthenticAMD" */
4075	ASMCpuId(0, &uEAX, &uEBX, &uECX, &uEDX);
4076	if (uEAX >= 1 && uEBX == 0x68747541 && uECX == 0x444d4163 && uEDX == 0x69746e65)
4077	{
4078	/* Check for family 15 and the RDTSCP feature - hope that's is sufficient. */
4079	/* r=frank: The test for TscInvariant should be sufficient */
4080	ASMCpuId(0x80000001, &uEAX, &uEBX, &uECX, &uEDX);
4081	if ( ((uEAX >> 8) & 0xf) == 0xf && ((uEAX >> 20) & 0x7f) == 0 /* family=15 */
4082	&& (uEDX & BIT(27) /RDTSCP/))
4083	{
4084	/* Check the power specs for Advanced Power Management Information */
4085	ASMCpuId(0x80000000, &uEAX, &uEBX, &uECX, &uEDX);
4086	if (uEAX < 0x80000007)
4087	return SUPGIPMODE_ASYNC_TSC;
4088	ASMCpuId(0x80000007, &uEAX, &uEBX, &uECX, &uEDX);
4089	/* TscInvariant 1=The TSC rate is ensured to be invariant across all P-States,
4090	* C-States, and stop-grant transitions (such as STPCLK Throttling); therefore
4091	* the TSC is suitable for use as a source of time. 0=No such guarantee is made
4092	* and software should avoid attempting to use the TSC as a source of time. */
4093	if (!(uEDX & BIT(8)))
4094	return SUPGIPMODE_ASYNC_TSC;
4095	}
4096	}
4097	}
4098	#endif
4099	return SUPGIPMODE_SYNC_TSC;
4100	}
4101
4102
4103	/**
4104	* Invalidates the GIP data upon termination.
4105	*
4106	* @param pGip Pointer to the read-write kernel mapping of the GIP.
4107	*/
4108	void VBOXCALL supdrvGipTerm(PSUPGLOBALINFOPAGE pGip)
4109	{
4110	unsigned i;
4111	pGip->u32Magic = 0;
4112	for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
4113	{
4114	pGip->aCPUs[i].u64NanoTS = 0;
4115	pGip->aCPUs[i].u64TSC = 0;
4116	pGip->aCPUs[i].iTSCHistoryHead = 0;
4117	}
4118	}
4119
4120
4121	/**
4122	* Worker routine for supdrvGipUpdate and supdrvGipUpdatePerCpu that
4123	* updates all the per cpu data except the transaction id.
4124	*
4125	* @param pGip The GIP.
4126	* @param pGipCpu Pointer to the per cpu data.
4127	* @param u64NanoTS The current time stamp.
4128	*/
4129	static void supdrvGipDoUpdateCpu(PSUPGLOBALINFOPAGE pGip, PSUPGIPCPU pGipCpu, uint64_t u64NanoTS)
4130	{
4131	uint64_t u64TSC;
4132	uint64_t u64TSCDelta;
4133	uint32_t u32UpdateIntervalTSC;
4134	uint32_t u32UpdateIntervalTSCSlack;
4135	unsigned iTSCHistoryHead;
4136	uint64_t u64CpuHz;
4137
4138	/*
4139	* Update the NanoTS.
4140	*/
4141	ASMAtomicXchgU64(&pGipCpu->u64NanoTS, u64NanoTS);
4142
4143	/*
4144	* Calc TSC delta.
4145	*/
4146	/** @todo validate the NanoTS delta, don't trust the OS to call us when it should... */
4147	u64TSC = ASMReadTSC();
4148	u64TSCDelta = u64TSC - pGipCpu->u64TSC;
4149	ASMAtomicXchgU64(&pGipCpu->u64TSC, u64TSC);
4150
4151	if (u64TSCDelta >> 32)
4152	{
4153	u64TSCDelta = pGipCpu->u32UpdateIntervalTSC;
4154	pGipCpu->cErrors++;
4155	}
4156
4157	/*
4158	* TSC History.
4159	*/
4160	Assert(ELEMENTS(pGipCpu->au32TSCHistory) == 8);
4161
4162	iTSCHistoryHead = (pGipCpu->iTSCHistoryHead + 1) & 7;
4163	ASMAtomicXchgU32(&pGipCpu->iTSCHistoryHead, iTSCHistoryHead);
4164	ASMAtomicXchgU32(&pGipCpu->au32TSCHistory[iTSCHistoryHead], (uint32_t)u64TSCDelta);
4165
4166	/*
4167	* UpdateIntervalTSC = average of last 8,2,1 intervals depending on update HZ.
4168	*/
4169	if (pGip->u32UpdateHz >= 1000)
4170	{
4171	uint32_t u32;
4172	u32 = pGipCpu->au32TSCHistory[0];
4173	u32 += pGipCpu->au32TSCHistory[1];
4174	u32 += pGipCpu->au32TSCHistory[2];
4175	u32 += pGipCpu->au32TSCHistory[3];
4176	u32 >>= 2;
4177	u32UpdateIntervalTSC = pGipCpu->au32TSCHistory[4];
4178	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[5];
4179	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[6];
4180	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[7];
4181	u32UpdateIntervalTSC >>= 2;
4182	u32UpdateIntervalTSC += u32;
4183	u32UpdateIntervalTSC >>= 1;
4184
4185	/* Value choosen for a 2GHz Athlon64 running linux 2.6.10/11, . */
4186	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 14;
4187	}
4188	else if (pGip->u32UpdateHz >= 90)
4189	{
4190	u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
4191	u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[(iTSCHistoryHead - 1) & 7];
4192	u32UpdateIntervalTSC >>= 1;
4193
4194	/* value choosen on a 2GHz thinkpad running windows */
4195	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 7;
4196	}
4197	else
4198	{
4199	u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
4200
4201	/* This value hasn't be checked yet.. waiting for OS/2 and 33Hz timers.. :-) */
4202	u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 6;
4203	}
4204	ASMAtomicXchgU32(&pGipCpu->u32UpdateIntervalTSC, u32UpdateIntervalTSC + u32UpdateIntervalTSCSlack);
4205
4206	/*
4207	* CpuHz.
4208	*/
4209	u64CpuHz = ASMMult2xU32RetU64(u32UpdateIntervalTSC, pGip->u32UpdateHz);
4210	ASMAtomicXchgU64(&pGipCpu->u64CpuHz, u64CpuHz);
4211	}
4212
4213
4214	/**
4215	* Updates the GIP.
4216	*
4217	* @param pGip Pointer to the GIP.
4218	* @param u64NanoTS The current nanosecond timesamp.
4219	*/
4220	void VBOXCALL supdrvGipUpdate(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS)
4221	{
4222	/*
4223	* Determin the relevant CPU data.
4224	*/
4225	PSUPGIPCPU pGipCpu;
4226	if (pGip->u32Mode != SUPGIPMODE_ASYNC_TSC)
4227	pGipCpu = &pGip->aCPUs[0];
4228	else
4229	{
4230	unsigned iCpu = ASMGetApicId();
4231	if (RT_LIKELY(iCpu >= RT_ELEMENTS(pGip->aCPUs)))
4232	return;
4233	pGipCpu = &pGip->aCPUs[iCpu];
4234	}
4235
4236	/*
4237	* Start update transaction.
4238	*/
4239	if (!(ASMAtomicIncU32(&pGipCpu->u32TransactionId) & 1))
4240	{
4241	/* this can happen on win32 if we're taking to long and there are more CPUs around. shouldn't happen though. */
4242	AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGipCpu->u32TransactionId));
4243	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
4244	pGipCpu->cErrors++;
4245	return;
4246	}
4247
4248	/*
4249	* Recalc the update frequency every 0x800th time.
4250	*/
4251	if (!(pGipCpu->u32TransactionId & (GIP_UPDATEHZ_RECALC_FREQ * 2 - 2)))
4252	{
4253	if (pGip->u64NanoTSLastUpdateHz)
4254	{
4255	#ifdef __AMD64__ /** @todo fix 64-bit div here to work on x86 linux. */
4256	uint64_t u64Delta = u64NanoTS - pGip->u64NanoTSLastUpdateHz;
4257	uint32_t u32UpdateHz = (uint32_t)((UINT64_C(1000000000) * GIP_UPDATEHZ_RECALC_FREQ) / u64Delta);
4258	if (u32UpdateHz <= 2000 && u32UpdateHz >= 30)
4259	{
4260	ASMAtomicXchgU32(&pGip->u32UpdateHz, u32UpdateHz);
4261	ASMAtomicXchgU32(&pGip->u32UpdateIntervalNS, 1000000000 / u32UpdateHz);
4262	}
4263	#endif
4264	}
4265	ASMAtomicXchgU64(&pGip->u64NanoTSLastUpdateHz, u64NanoTS);
4266	}
4267
4268	/*
4269	* Update the data.
4270	*/
4271	supdrvGipDoUpdateCpu(pGip, pGipCpu, u64NanoTS);
4272
4273	/*
4274	* Complete transaction.
4275	*/
4276	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
4277	}
4278
4279
4280	/**
4281	* Updates the per cpu GIP data for the calling cpu.
4282	*
4283	* @param pGip Pointer to the GIP.
4284	* @param u64NanoTS The current nanosecond timesamp.
4285	* @param iCpu The CPU index.
4286	*/
4287	void VBOXCALL supdrvGipUpdatePerCpu(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, unsigned iCpu)
4288	{
4289	PSUPGIPCPU pGipCpu;
4290
4291	if (RT_LIKELY(iCpu <= RT_ELEMENTS(pGip->aCPUs)))
4292	{
4293	pGipCpu = &pGip->aCPUs[iCpu];
4294
4295	/*
4296	* Start update transaction.
4297	*/
4298	if (!(ASMAtomicIncU32(&pGipCpu->u32TransactionId) & 1))
4299	{
4300	AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGipCpu->u32TransactionId));
4301	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
4302	pGipCpu->cErrors++;
4303	return;
4304	}
4305
4306	/*
4307	* Update the data.
4308	*/
4309	supdrvGipDoUpdateCpu(pGip, pGipCpu, u64NanoTS);
4310
4311	/*
4312	* Complete transaction.
4313	*/
4314	ASMAtomicIncU32(&pGipCpu->u32TransactionId);
4315	}
4316	}
4317
4318
4319	#ifndef DEBUG /** @todo change #ifndef DEBUG -> #ifdef LOG_ENABLED */
4320	/**
4321	* Stub function for non-debug builds.
4322	*/
4323	RTDECL(PRTLOGGER) RTLogDefaultInstance(void)
4324	{
4325	return NULL;
4326	}
4327
4328	RTDECL(PRTLOGGER) RTLogRelDefaultInstance(void)
4329	{
4330	return NULL;
4331	}
4332
4333	/**
4334	* Stub function for non-debug builds.
4335	*/
4336	RTDECL(int) RTLogSetDefaultInstanceThread(PRTLOGGER pLogger, uintptr_t uKey)
4337	{
4338	return 0;
4339	}
4340
4341	/**
4342	* Stub function for non-debug builds.
4343	*/
4344	RTDECL(void) RTLogLogger(PRTLOGGER pLogger, void pvCallerRet, const char pszFormat, ...)
4345	{
4346	}
4347
4348	/**
4349	* Stub function for non-debug builds.
4350	*/
4351	RTDECL(void) RTLogLoggerEx(PRTLOGGER pLogger, unsigned fFlags, unsigned iGroup, const char *pszFormat, ...)
4352	{
4353	}
4354
4355	/**
4356	* Stub function for non-debug builds.
4357	*/
4358	RTDECL(void) RTLogLoggerExV(PRTLOGGER pLogger, unsigned fFlags, unsigned iGroup, const char *pszFormat, va_list args)
4359	{
4360	}
4361	#endif /* !DEBUG */
4362

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPDRVShared.c@ 1197

以其他格式下載: