VMMDevHGCM.cpp@ 95506

Last change on this file since 95506 was 93944, checked in by vboxsync, 3 years ago
Devices: Must not use PAGE_SIZE, PAGE_SHIFT, PAGE_OFFSET_MASK, PAGE_ADDRESS or PHYS_PAGE_ADDRESS here either. bugref:9898
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 113.8 KB

Line
1	/* $Id: VMMDevHGCM.cpp 93944 2022-02-24 21:15:14Z vboxsync $ */
2	/** @file
3	* VMMDev - HGCM - Host-Guest Communication Manager Device.
4	*/
5
6	/*
7	* Copyright (C) 2006-2022 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_DEV_VMM
23	#include <iprt/alloc.h>
24	#include <iprt/asm.h>
25	#include <iprt/assert.h>
26	#include <iprt/param.h>
27	#include <iprt/string.h>
28
29	#include <VBox/AssertGuest.h>
30	#include <VBox/err.h>
31	#include <VBox/hgcmsvc.h>
32	#include <VBox/log.h>
33
34	#include "VMMDevHGCM.h"
35
36	#ifdef DEBUG
37	# define VBOX_STRICT_GUEST
38	#endif
39
40	#ifdef VBOX_WITH_DTRACE
41	# include "dtrace/VBoxDD.h"
42	#else
43	# define VBOXDD_HGCMCALL_ENTER(a,b,c,d) do { } while (0)
44	# define VBOXDD_HGCMCALL_COMPLETED_REQ(a,b) do { } while (0)
45	# define VBOXDD_HGCMCALL_COMPLETED_EMT(a,b) do { } while (0)
46	# define VBOXDD_HGCMCALL_COMPLETED_DONE(a,b,c,d) do { } while (0)
47	#endif
48
49
50	/*********************************************************************************************************************************
51	* Structures and Typedefs *
52	*********************************************************************************************************************************/
53	typedef enum VBOXHGCMCMDTYPE
54	{
55	VBOXHGCMCMDTYPE_LOADSTATE = 0,
56	VBOXHGCMCMDTYPE_CONNECT,
57	VBOXHGCMCMDTYPE_DISCONNECT,
58	VBOXHGCMCMDTYPE_CALL,
59	VBOXHGCMCMDTYPE_SizeHack = 0x7fffffff
60	} VBOXHGCMCMDTYPE;
61
62	/**
63	* Information about a 32 or 64 bit parameter.
64	*/
65	typedef struct VBOXHGCMPARMVAL
66	{
67	/** Actual value. Both 32 and 64 bit is saved here. */
68	uint64_t u64Value;
69
70	/** Offset from the start of the request where the value is stored. */
71	uint32_t offValue;
72
73	/** Size of the value: 4 for 32 bit and 8 for 64 bit. */
74	uint32_t cbValue;
75
76	} VBOXHGCMPARMVAL;
77
78	/**
79	* Information about a pointer parameter.
80	*/
81	typedef struct VBOXHGCMPARMPTR
82	{
83	/** Size of the buffer described by the pointer parameter. */
84	uint32_t cbData;
85
86	/** @todo save 8 bytes here by putting offFirstPage, cPages, and f32Direction
87	* into a bitfields like in VBOXHGCMPARMPAGES. */
88	/** Offset in the first physical page of the region. */
89	uint32_t offFirstPage;
90
91	/** How many pages. */
92	uint32_t cPages;
93
94	/** How the buffer should be copied VBOX_HGCM_F_PARM_. /
95	uint32_t fu32Direction;
96
97	/** Pointer to array of the GC physical addresses for these pages.
98	* It is assumed that the physical address of the locked resident guest page
99	* does not change. */
100	RTGCPHYS *paPages;
101
102	/** For single page requests. */
103	RTGCPHYS GCPhysSinglePage;
104
105	} VBOXHGCMPARMPTR;
106
107
108	/**
109	* Pages w/o bounce buffering.
110	*/
111	typedef struct VBOXHGCMPARMPAGES
112	{
113	/** The buffer size. */
114	uint32_t cbData;
115	/** Start of buffer offset into the first page. */
116	uint32_t offFirstPage : 12;
117	/** VBOX_HGCM_F_PARM_XXX flags. */
118	uint32_t fFlags : 3;
119	/** Set if we've locked all the pages. */
120	uint32_t fLocked : 1;
121	/** Number of pages. */
122	uint32_t cPages : 16;
123	/**< Array of page locks followed by array of page pointers, the first page
124	* pointer is adjusted by offFirstPage. */
125	PPGMPAGEMAPLOCK paPgLocks;
126	} VBOXHGCMPARMPAGES;
127
128	/**
129	* Information about a guest HGCM parameter.
130	*/
131	typedef struct VBOXHGCMGUESTPARM
132	{
133	/** The parameter type. */
134	HGCMFunctionParameterType enmType;
135
136	union
137	{
138	VBOXHGCMPARMVAL val;
139	VBOXHGCMPARMPTR ptr;
140	VBOXHGCMPARMPAGES Pages;
141	} u;
142
143	} VBOXHGCMGUESTPARM;
144
145	typedef struct VBOXHGCMCMD
146	{
147	/** Active commands, list is protected by critsectHGCMCmdList. */
148	RTLISTNODE node;
149
150	/** The type of the command (VBOXHGCMCMDTYPE). */
151	uint8_t enmCmdType;
152
153	/** Whether the command was cancelled by the guest. */
154	bool fCancelled;
155
156	/** Set if allocated from the memory cache, clear if heap. */
157	bool fMemCache;
158
159	/** Whether the command was restored from saved state. */
160	bool fRestored : 1;
161	/** Whether this command has a no-bounce page list and needs to be restored
162	* from guest memory the old fashioned way. */
163	bool fRestoreFromGuestMem : 1;
164
165	/** Copy of VMMDevRequestHeader::fRequestor.
166	* @note Only valid if VBOXGSTINFO2_F_REQUESTOR_INFO is set in
167	* VMMDevState.guestInfo2.fFeatures. */
168	uint32_t fRequestor;
169
170	/** GC physical address of the guest request. */
171	RTGCPHYS GCPhys;
172
173	/** Request packet size. */
174	uint32_t cbRequest;
175
176	/** The type of the guest request. */
177	VMMDevRequestType enmRequestType;
178
179	/** Pointer to the locked request, NULL if not locked. */
180	void *pvReqLocked;
181	/** The PGM lock for GCPhys if pvReqLocked is not NULL. */
182	PGMPAGEMAPLOCK ReqMapLock;
183
184	/** The accounting index (into VMMDEVR3::aHgcmAcc). */
185	uint8_t idxHeapAcc;
186	uint8_t abPadding[3];
187	/** The heap cost of this command. */
188	uint32_t cbHeapCost;
189
190	/** The STAM_GET_TS() value when the request arrived. */
191	uint64_t tsArrival;
192	/** The STAM_GET_TS() value when the hgcmR3Completed() is called. */
193	uint64_t tsComplete;
194
195	union
196	{
197	struct
198	{
199	uint32_t u32ClientID;
200	HGCMServiceLocation pLoc; /< Allocated after this structure. /
201	} connect;
202
203	struct
204	{
205	uint32_t u32ClientID;
206	} disconnect;
207
208	struct
209	{
210	/* Number of elements in paGuestParms and paHostParms arrays. */
211	uint32_t cParms;
212
213	uint32_t u32ClientID;
214
215	uint32_t u32Function;
216
217	/** Pointer to information about guest parameters in case of a Call request.
218	* Follows this structure in the same memory block.
219	*/
220	VBOXHGCMGUESTPARM *paGuestParms;
221
222	/** Pointer to converted host parameters in case of a Call request.
223	* Follows this structure in the same memory block.
224	*/
225	VBOXHGCMSVCPARM *paHostParms;
226
227	/* VBOXHGCMGUESTPARM[] */
228	/* VBOXHGCMSVCPARM[] */
229	} call;
230	} u;
231	} VBOXHGCMCMD;
232
233
234	/**
235	* Version for the memory cache.
236	*/
237	typedef struct VBOXHGCMCMDCACHED
238	{
239	VBOXHGCMCMD Core; /*< 120 /
240	VBOXHGCMGUESTPARM aGuestParms[6]; /*< 40 6 = 240 */
241	VBOXHGCMSVCPARM aHostParms[6]; /*< 24 6 = 144 */
242	} VBOXHGCMCMDCACHED; /*< 120+240+144 = 504 /
243	AssertCompile(sizeof(VBOXHGCMCMD) <= 120);
244	AssertCompile(sizeof(VBOXHGCMGUESTPARM) <= 40);
245	AssertCompile(sizeof(VBOXHGCMSVCPARM) <= 24);
246	AssertCompile(sizeof(VBOXHGCMCMDCACHED) <= 512);
247	AssertCompile(sizeof(VBOXHGCMCMDCACHED) > sizeof(VBOXHGCMCMD) + sizeof(HGCMServiceLocation));
248
249
250	/*********************************************************************************************************************************
251	* Internal Functions *
252	*********************************************************************************************************************************/
253	DECLINLINE(void *) vmmdevR3HgcmCallMemAllocZ(PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd, size_t cbRequested);
254
255
256
257	DECLINLINE(int) vmmdevR3HgcmCmdListLock(PVMMDEVCC pThisCC)
258	{
259	int rc = RTCritSectEnter(&pThisCC->critsectHGCMCmdList);
260	AssertRC(rc);
261	return rc;
262	}
263
264	DECLINLINE(void) vmmdevR3HgcmCmdListUnlock(PVMMDEVCC pThisCC)
265	{
266	int rc = RTCritSectLeave(&pThisCC->critsectHGCMCmdList);
267	AssertRC(rc);
268	}
269
270	/** Allocate and initialize VBOXHGCMCMD structure for HGCM request.
271	*
272	* @returns Pointer to the command on success, NULL otherwise.
273	* @param pThisCC The VMMDev ring-3 instance data.
274	* @param enmCmdType Type of the command.
275	* @param GCPhys The guest physical address of the HGCM request.
276	* @param cbRequest The size of the HGCM request.
277	* @param cParms Number of HGCM parameters for VBOXHGCMCMDTYPE_CALL command.
278	* @param fRequestor The VMMDevRequestHeader::fRequestor value.
279	*/
280	static PVBOXHGCMCMD vmmdevR3HgcmCmdAlloc(PVMMDEVCC pThisCC, VBOXHGCMCMDTYPE enmCmdType, RTGCPHYS GCPhys,
281	uint32_t cbRequest, uint32_t cParms, uint32_t fRequestor)
282	{
283	/*
284	* Pick the heap accounting category.
285	*
286	* Initial idea was to just use what VMMDEV_REQUESTOR_USR_MASK yields directly,
287	* but there are so many unused categories then (DRV, RESERVED1, GUEST). Better
288	* to have fewer and more heap available in each.
289	*/
290	uintptr_t idxHeapAcc;
291	if (fRequestor != VMMDEV_REQUESTOR_LEGACY)
292	switch (fRequestor & VMMDEV_REQUESTOR_USR_MASK)
293	{
294	case VMMDEV_REQUESTOR_USR_NOT_GIVEN:
295	case VMMDEV_REQUESTOR_USR_DRV:
296	case VMMDEV_REQUESTOR_USR_DRV_OTHER:
297	idxHeapAcc = VMMDEV_HGCM_CATEGORY_KERNEL;
298	break;
299	case VMMDEV_REQUESTOR_USR_ROOT:
300	case VMMDEV_REQUESTOR_USR_SYSTEM:
301	idxHeapAcc = VMMDEV_HGCM_CATEGORY_ROOT;
302	break;
303	default:
304	AssertFailed(); RT_FALL_THRU();
305	case VMMDEV_REQUESTOR_USR_RESERVED1:
306	case VMMDEV_REQUESTOR_USR_USER:
307	case VMMDEV_REQUESTOR_USR_GUEST:
308	idxHeapAcc = VMMDEV_HGCM_CATEGORY_USER;
309	break;
310	}
311	else
312	idxHeapAcc = VMMDEV_HGCM_CATEGORY_KERNEL;
313
314	#if 1
315	/*
316	* Try use the cache.
317	*/
318	VBOXHGCMCMDCACHED *pCmdCached;
319	AssertCompile(sizeof(*pCmdCached) >= sizeof(VBOXHGCMCMD) + sizeof(HGCMServiceLocation));
320	if (cParms <= RT_ELEMENTS(pCmdCached->aGuestParms))
321	{
322	if (sizeof(*pCmdCached) <= pThisCC->aHgcmAcc[idxHeapAcc].cbHeapBudget)
323	{
324	int rc = RTMemCacheAllocEx(pThisCC->hHgcmCmdCache, (void **)&pCmdCached);
325	if (RT_SUCCESS(rc))
326	{
327	RT_ZERO(*pCmdCached);
328	pCmdCached->Core.fMemCache = true;
329	pCmdCached->Core.GCPhys = GCPhys;
330	pCmdCached->Core.cbRequest = cbRequest;
331	pCmdCached->Core.enmCmdType = enmCmdType;
332	pCmdCached->Core.fRequestor = fRequestor;
333	pCmdCached->Core.idxHeapAcc = (uint8_t)idxHeapAcc;
334	pCmdCached->Core.cbHeapCost = sizeof(*pCmdCached);
335	Log5Func(("aHgcmAcc[%zu] %#RX64 -= %#zx (%p)\n",
336	idxHeapAcc, pThisCC->aHgcmAcc[idxHeapAcc].cbHeapBudget, sizeof(*pCmdCached), &pCmdCached->Core));
337	pThisCC->aHgcmAcc[idxHeapAcc].cbHeapBudget -= sizeof(*pCmdCached);
338
339	if (enmCmdType == VBOXHGCMCMDTYPE_CALL)
340	{
341	pCmdCached->Core.u.call.cParms = cParms;
342	pCmdCached->Core.u.call.paGuestParms = pCmdCached->aGuestParms;
343	pCmdCached->Core.u.call.paHostParms = pCmdCached->aHostParms;
344	}
345	else if (enmCmdType == VBOXHGCMCMDTYPE_CONNECT)
346	pCmdCached->Core.u.connect.pLoc = (HGCMServiceLocation *)(&pCmdCached->Core + 1);
347
348	Assert(!pCmdCached->Core.pvReqLocked);
349
350	Log3Func(("returns %p (enmCmdType=%d GCPhys=%RGp)\n", &pCmdCached->Core, enmCmdType, GCPhys));
351	return &pCmdCached->Core;
352	}
353	}
354	else
355	LogFunc(("Heap budget overrun: sizeof(*pCmdCached)=%#zx aHgcmAcc[%zu].cbHeapBudget=%#RX64 - enmCmdType=%d\n",
356	sizeof(*pCmdCached), idxHeapAcc, pThisCC->aHgcmAcc[idxHeapAcc].cbHeapBudget, enmCmdType));
357	STAM_REL_COUNTER_INC(&pThisCC->aHgcmAcc[idxHeapAcc].StatBudgetOverruns);
358	return NULL;
359	}
360	STAM_REL_COUNTER_INC(&pThisCC->StatHgcmLargeCmdAllocs);
361
362	#else
363	RT_NOREF(pThisCC);
364	#endif
365
366	/* Size of required memory buffer. */
367	const uint32_t cbCmd = sizeof(VBOXHGCMCMD) + cParms * (sizeof(VBOXHGCMGUESTPARM) + sizeof(VBOXHGCMSVCPARM))
368	+ (enmCmdType == VBOXHGCMCMDTYPE_CONNECT ? sizeof(HGCMServiceLocation) : 0);
369	if (cbCmd <= pThisCC->aHgcmAcc[idxHeapAcc].cbHeapBudget)
370	{
371	PVBOXHGCMCMD pCmd = (PVBOXHGCMCMD)RTMemAllocZ(cbCmd);
372	if (pCmd)
373	{
374	pCmd->enmCmdType = enmCmdType;
375	pCmd->GCPhys = GCPhys;
376	pCmd->cbRequest = cbRequest;
377	pCmd->fRequestor = fRequestor;
378	pCmd->idxHeapAcc = (uint8_t)idxHeapAcc;
379	pCmd->cbHeapCost = cbCmd;
380	Log5Func(("aHgcmAcc[%zu] %#RX64 -= %#x (%p)\n", idxHeapAcc, pThisCC->aHgcmAcc[idxHeapAcc].cbHeapBudget, cbCmd, pCmd));
381	pThisCC->aHgcmAcc[idxHeapAcc].cbHeapBudget -= cbCmd;
382
383	if (enmCmdType == VBOXHGCMCMDTYPE_CALL)
384	{
385	pCmd->u.call.cParms = cParms;
386	if (cParms)
387	{
388	pCmd->u.call.paGuestParms = (VBOXHGCMGUESTPARM )((uint8_t )pCmd
389	+ sizeof(struct VBOXHGCMCMD));
390	pCmd->u.call.paHostParms = (VBOXHGCMSVCPARM )((uint8_t )pCmd->u.call.paGuestParms
391	+ cParms * sizeof(VBOXHGCMGUESTPARM));
392	}
393	}
394	else if (enmCmdType == VBOXHGCMCMDTYPE_CONNECT)
395	pCmd->u.connect.pLoc = (HGCMServiceLocation *)(pCmd + 1);
396	}
397	Log3Func(("returns %p (enmCmdType=%d GCPhys=%RGp cbCmd=%#x)\n", pCmd, enmCmdType, GCPhys, cbCmd));
398	return pCmd;
399	}
400	STAM_REL_COUNTER_INC(&pThisCC->aHgcmAcc[idxHeapAcc].StatBudgetOverruns);
401	LogFunc(("Heap budget overrun: cbCmd=%#x aHgcmAcc[%zu].cbHeapBudget=%#RX64 - enmCmdType=%d\n",
402	cbCmd, idxHeapAcc, pThisCC->aHgcmAcc[idxHeapAcc].cbHeapBudget, enmCmdType));
403	return NULL;
404	}
405
406	/** Deallocate VBOXHGCMCMD memory.
407	*
408	* @param pDevIns The device instance.
409	* @param pThis The VMMDev shared instance data.
410	* @param pThisCC The VMMDev ring-3 instance data.
411	* @param pCmd Command to deallocate.
412	*/
413	static void vmmdevR3HgcmCmdFree(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd)
414	{
415	if (pCmd)
416	{
417	Assert( pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL
418	\|\| pCmd->enmCmdType == VBOXHGCMCMDTYPE_CONNECT
419	\|\| pCmd->enmCmdType == VBOXHGCMCMDTYPE_DISCONNECT
420	\|\| pCmd->enmCmdType == VBOXHGCMCMDTYPE_LOADSTATE);
421	if (pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL)
422	{
423	uint32_t i;
424	for (i = 0; i < pCmd->u.call.cParms; ++i)
425	{
426	VBOXHGCMSVCPARM * const pHostParm = &pCmd->u.call.paHostParms[i];
427	VBOXHGCMGUESTPARM * const pGuestParm = &pCmd->u.call.paGuestParms[i];
428
429	if ( pGuestParm->enmType == VMMDevHGCMParmType_LinAddr_In
430	\|\| pGuestParm->enmType == VMMDevHGCMParmType_LinAddr_Out
431	\|\| pGuestParm->enmType == VMMDevHGCMParmType_LinAddr
432	\|\| pGuestParm->enmType == VMMDevHGCMParmType_PageList
433	\|\| pGuestParm->enmType == VMMDevHGCMParmType_ContiguousPageList)
434	{
435	Assert(pHostParm->type == VBOX_HGCM_SVC_PARM_PTR);
436	if (pGuestParm->u.ptr.paPages != &pGuestParm->u.ptr.GCPhysSinglePage)
437	RTMemFree(pGuestParm->u.ptr.paPages);
438	RTMemFreeZ(pHostParm->u.pointer.addr, pGuestParm->u.ptr.cbData);
439	}
440	else if (pGuestParm->enmType == VMMDevHGCMParmType_Embedded)
441	{
442	Assert(pHostParm->type == VBOX_HGCM_SVC_PARM_PTR);
443	RTMemFreeZ(pHostParm->u.pointer.addr, pGuestParm->u.ptr.cbData);
444	}
445	else if (pGuestParm->enmType == VMMDevHGCMParmType_NoBouncePageList)
446	{
447	Assert(pHostParm->type == VBOX_HGCM_SVC_PARM_PAGES);
448	if (pGuestParm->u.Pages.paPgLocks)
449	{
450	if (pGuestParm->u.Pages.fLocked)
451	PDMDevHlpPhysBulkReleasePageMappingLocks(pDevIns, pGuestParm->u.Pages.cPages,
452	pGuestParm->u.Pages.paPgLocks);
453	RTMemFree(pGuestParm->u.Pages.paPgLocks);
454	pGuestParm->u.Pages.paPgLocks = NULL;
455	}
456	}
457	else
458	Assert(pHostParm->type != VBOX_HGCM_SVC_PARM_PTR && pHostParm->type != VBOX_HGCM_SVC_PARM_PAGES);
459	}
460	}
461
462	if (pCmd->pvReqLocked)
463	{
464	PDMDevHlpPhysReleasePageMappingLock(pDevIns, &pCmd->ReqMapLock);
465	pCmd->pvReqLocked = NULL;
466	}
467
468	pCmd->enmCmdType = UINT8_MAX; /* poison */
469
470	/* Update heap budget. Need the critsect to do this safely. */
471	Assert(pCmd->cbHeapCost != 0);
472	uintptr_t idx = pCmd->idxHeapAcc;
473	AssertStmt(idx < RT_ELEMENTS(pThisCC->aHgcmAcc), idx %= RT_ELEMENTS(pThisCC->aHgcmAcc));
474
475	int const rcLock = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
476	PDM_CRITSECT_RELEASE_ASSERT_RC_DEV(pDevIns, &pThis->CritSect, rcLock);
477
478	Log5Func(("aHgcmAcc[%zu] %#RX64 += %#x (%p)\n", idx, pThisCC->aHgcmAcc[idx].cbHeapBudget, pCmd->cbHeapCost, pCmd));
479	pThisCC->aHgcmAcc[idx].cbHeapBudget += pCmd->cbHeapCost;
480	AssertMsg(pThisCC->aHgcmAcc[idx].cbHeapBudget <= pThisCC->aHgcmAcc[idx].cbHeapBudgetConfig,
481	("idx=%d (%d) fRequestor=%#x pCmd=%p: %#RX64 vs %#RX64 -> %#RX64\n", idx, pCmd->idxHeapAcc, pCmd->fRequestor, pCmd,
482	pThisCC->aHgcmAcc[idx].cbHeapBudget, pThisCC->aHgcmAcc[idx].cbHeapBudgetConfig,
483	pThisCC->aHgcmAcc[idx].cbHeapBudget - pThisCC->aHgcmAcc[idx].cbHeapBudgetConfig));
484	pCmd->cbHeapCost = 0;
485
486	#if 1
487	if (pCmd->fMemCache)
488	{
489	RTMemCacheFree(pThisCC->hHgcmCmdCache, pCmd);
490	PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect); /* releasing it after just to be on the safe side. */
491	}
492	else
493	#endif
494	{
495	PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
496	RTMemFree(pCmd);
497	}
498	}
499	}
500
501	/** Add VBOXHGCMCMD to the list of pending commands.
502	*
503	* @returns VBox status code.
504	* @param pDevIns The device instance.
505	* @param pThis The VMMDev shared instance data.
506	* @param pThisCC The VMMDev ring-3 instance data.
507	* @param pCmd Command to add.
508	*/
509	static int vmmdevR3HgcmAddCommand(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd)
510	{
511	int rc = vmmdevR3HgcmCmdListLock(pThisCC);
512	AssertRCReturn(rc, rc);
513
514	LogFlowFunc(("%p type %d\n", pCmd, pCmd->enmCmdType));
515
516	RTListPrepend(&pThisCC->listHGCMCmd, &pCmd->node);
517
518	/* stats */
519	uintptr_t idx = pCmd->idxHeapAcc;
520	AssertStmt(idx < RT_ELEMENTS(pThisCC->aHgcmAcc), idx %= RT_ELEMENTS(pThisCC->aHgcmAcc));
521	STAM_REL_PROFILE_ADD_PERIOD(&pThisCC->aHgcmAcc[idx].StateMsgHeapUsage, pCmd->cbHeapCost);
522
523	/* Automatically enable HGCM events, if there are HGCM commands. */
524	if ( pCmd->enmCmdType == VBOXHGCMCMDTYPE_CONNECT
525	\|\| pCmd->enmCmdType == VBOXHGCMCMDTYPE_DISCONNECT
526	\|\| pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL)
527	{
528	LogFunc(("u32HGCMEnabled = %d\n", pThisCC->u32HGCMEnabled));
529	if (ASMAtomicCmpXchgU32(&pThisCC->u32HGCMEnabled, 1, 0))
530	VMMDevCtlSetGuestFilterMask(pDevIns, pThis, pThisCC, VMMDEV_EVENT_HGCM, 0);
531	}
532
533	vmmdevR3HgcmCmdListUnlock(pThisCC);
534	return rc;
535	}
536
537	/** Remove VBOXHGCMCMD from the list of pending commands.
538	*
539	* @returns VBox status code.
540	* @param pThisCC The VMMDev ring-3 instance data.
541	* @param pCmd Command to remove.
542	*/
543	static int vmmdevR3HgcmRemoveCommand(PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd)
544	{
545	int rc = vmmdevR3HgcmCmdListLock(pThisCC);
546	AssertRCReturn(rc, rc);
547
548	LogFlowFunc(("%p\n", pCmd));
549
550	RTListNodeRemove(&pCmd->node);
551
552	vmmdevR3HgcmCmdListUnlock(pThisCC);
553	return rc;
554	}
555
556	/**
557	* Find a HGCM command by its physical address.
558	*
559	* The caller is responsible for taking the command list lock before calling
560	* this function.
561	*
562	* @returns Pointer to the command on success, NULL otherwise.
563	* @param pThisCC The VMMDev ring-3 instance data.
564	* @param GCPhys The physical address of the command we're looking for.
565	*/
566	DECLINLINE(PVBOXHGCMCMD) vmmdevR3HgcmFindCommandLocked(PVMMDEVCC pThisCC, RTGCPHYS GCPhys)
567	{
568	PVBOXHGCMCMD pCmd;
569	RTListForEach(&pThisCC->listHGCMCmd, pCmd, VBOXHGCMCMD, node)
570	{
571	if (pCmd->GCPhys == GCPhys)
572	return pCmd;
573	}
574	return NULL;
575	}
576
577	/** Copy VMMDevHGCMConnect request data from the guest to VBOXHGCMCMD command.
578	*
579	* @param pHGCMConnect The source guest request (cached in host memory).
580	* @param pCmd Destination command.
581	*/
582	static void vmmdevR3HgcmConnectFetch(const VMMDevHGCMConnect *pHGCMConnect, PVBOXHGCMCMD pCmd)
583	{
584	pCmd->enmRequestType = pHGCMConnect->header.header.requestType;
585	pCmd->u.connect.u32ClientID = pHGCMConnect->u32ClientID;
586	*pCmd->u.connect.pLoc = pHGCMConnect->loc;
587	}
588
589	/** Handle VMMDevHGCMConnect request.
590	*
591	* @param pDevIns The device instance.
592	* @param pThis The VMMDev shared instance data.
593	* @param pThisCC The VMMDev ring-3 instance data.
594	* @param pHGCMConnect The guest request (cached in host memory).
595	* @param GCPhys The physical address of the request.
596	*/
597	int vmmdevR3HgcmConnect(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC,
598	const VMMDevHGCMConnect *pHGCMConnect, RTGCPHYS GCPhys)
599	{
600	int rc;
601	PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, VBOXHGCMCMDTYPE_CONNECT, GCPhys, pHGCMConnect->header.header.size, 0,
602	pHGCMConnect->header.header.fRequestor);
603	if (pCmd)
604	{
605	vmmdevR3HgcmConnectFetch(pHGCMConnect, pCmd);
606
607	/* Only allow the guest to use existing services! */
608	ASSERT_GUEST(pHGCMConnect->loc.type == VMMDevHGCMLoc_LocalHost_Existing);
609	pCmd->u.connect.pLoc->type = VMMDevHGCMLoc_LocalHost_Existing;
610
611	vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
612	rc = pThisCC->pHGCMDrv->pfnConnect(pThisCC->pHGCMDrv, pCmd, pCmd->u.connect.pLoc, &pCmd->u.connect.u32ClientID);
613	if (RT_FAILURE(rc))
614	vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
615	}
616	else
617	rc = VERR_NO_MEMORY;
618
619	return rc;
620	}
621
622	/** Copy VMMDevHGCMDisconnect request data from the guest to VBOXHGCMCMD command.
623	*
624	* @param pHGCMDisconnect The source guest request (cached in host memory).
625	* @param pCmd Destination command.
626	*/
627	static void vmmdevR3HgcmDisconnectFetch(const VMMDevHGCMDisconnect *pHGCMDisconnect, PVBOXHGCMCMD pCmd)
628	{
629	pCmd->enmRequestType = pHGCMDisconnect->header.header.requestType;
630	pCmd->u.disconnect.u32ClientID = pHGCMDisconnect->u32ClientID;
631	}
632
633	/** Handle VMMDevHGCMDisconnect request.
634	*
635	* @param pDevIns The device instance.
636	* @param pThis The VMMDev shared instance data.
637	* @param pThisCC The VMMDev ring-3 instance data.
638	* @param pHGCMDisconnect The guest request (cached in host memory).
639	* @param GCPhys The physical address of the request.
640	*/
641	int vmmdevR3HgcmDisconnect(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC,
642	const VMMDevHGCMDisconnect *pHGCMDisconnect, RTGCPHYS GCPhys)
643	{
644	int rc;
645	PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, VBOXHGCMCMDTYPE_DISCONNECT, GCPhys, pHGCMDisconnect->header.header.size, 0,
646	pHGCMDisconnect->header.header.fRequestor);
647	if (pCmd)
648	{
649	vmmdevR3HgcmDisconnectFetch(pHGCMDisconnect, pCmd);
650
651	vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
652	rc = pThisCC->pHGCMDrv->pfnDisconnect(pThisCC->pHGCMDrv, pCmd, pCmd->u.disconnect.u32ClientID);
653	if (RT_FAILURE(rc))
654	vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
655	}
656	else
657	rc = VERR_NO_MEMORY;
658
659	return rc;
660	}
661
662	/** Translate LinAddr parameter type to the direction of data transfer.
663	*
664	* @returns VBOX_HGCM_F_PARM_DIRECTION_* flags.
665	* @param enmType Type of the LinAddr parameter.
666	*/
667	static uint32_t vmmdevR3HgcmParmTypeToDirection(HGCMFunctionParameterType enmType)
668	{
669	if (enmType == VMMDevHGCMParmType_LinAddr_In) return VBOX_HGCM_F_PARM_DIRECTION_TO_HOST;
670	if (enmType == VMMDevHGCMParmType_LinAddr_Out) return VBOX_HGCM_F_PARM_DIRECTION_FROM_HOST;
671	return VBOX_HGCM_F_PARM_DIRECTION_BOTH;
672	}
673
674	/** Check if list of pages in a HGCM pointer parameter corresponds to a contiguous buffer.
675	*
676	* @returns true if pages are contiguous, false otherwise.
677	* @param pPtr Information about a pointer HGCM parameter.
678	*/
679	DECLINLINE(bool) vmmdevR3HgcmGuestBufferIsContiguous(const VBOXHGCMPARMPTR *pPtr)
680	{
681	if (pPtr->cPages == 1)
682	return true;
683	RTGCPHYS64 Phys = pPtr->paPages[0] + GUEST_PAGE_SIZE;
684	if (Phys != pPtr->paPages[1])
685	return false;
686	if (pPtr->cPages > 2)
687	{
688	uint32_t iPage = 2;
689	do
690	{
691	Phys += GUEST_PAGE_SIZE;
692	if (Phys != pPtr->paPages[iPage])
693	return false;
694	++iPage;
695	} while (iPage < pPtr->cPages);
696	}
697	return true;
698	}
699
700	/** Copy data from guest memory to the host buffer.
701	*
702	* @returns VBox status code.
703	* @param pDevIns The device instance for PDMDevHlp.
704	* @param pvDst The destination host buffer.
705	* @param cbDst Size of the destination host buffer.
706	* @param pPtr Description of the source HGCM pointer parameter.
707	*/
708	static int vmmdevR3HgcmGuestBufferRead(PPDMDEVINSR3 pDevIns, void pvDst, uint32_t cbDst, const VBOXHGCMPARMPTR pPtr)
709	{
710	/*
711	* Try detect contiguous buffers.
712	*/
713	/** @todo We need a flag for indicating this. */
714	if (vmmdevR3HgcmGuestBufferIsContiguous(pPtr))
715	return PDMDevHlpPhysRead(pDevIns, pPtr->paPages[0] \| pPtr->offFirstPage, pvDst, cbDst);
716
717	/*
718	* Page by page fallback.
719	*/
720	uint8_t pu8Dst = (uint8_t )pvDst;
721	uint32_t offPage = pPtr->offFirstPage;
722	uint32_t cbRemaining = cbDst;
723
724	for (uint32_t iPage = 0; iPage < pPtr->cPages && cbRemaining > 0; ++iPage)
725	{
726	uint32_t cbToRead = GUEST_PAGE_SIZE - offPage;
727	if (cbToRead > cbRemaining)
728	cbToRead = cbRemaining;
729
730	/* Skip invalid pages. */
731	const RTGCPHYS GCPhys = pPtr->paPages[iPage];
732	if (GCPhys != NIL_RTGCPHYS)
733	{
734	int rc = PDMDevHlpPhysRead(pDevIns, GCPhys + offPage, pu8Dst, cbToRead);
735	AssertMsgReturn(RT_SUCCESS(rc), ("rc=%Rrc GCPhys=%RGp offPage=%#x cbToRead=%#x\n", rc, GCPhys, offPage, cbToRead), rc);
736	}
737
738	offPage = 0; /* A next page is read from 0 offset. */
739	cbRemaining -= cbToRead;
740	pu8Dst += cbToRead;
741	}
742
743	return VINF_SUCCESS;
744	}
745
746	/** Copy data from the host buffer to guest memory.
747	*
748	* @returns VBox status code.
749	* @param pDevIns The device instance for PDMDevHlp.
750	* @param pPtr Description of the destination HGCM pointer parameter.
751	* @param pvSrc The source host buffer.
752	* @param cbSrc Size of the source host buffer.
753	*/
754	static int vmmdevR3HgcmGuestBufferWrite(PPDMDEVINSR3 pDevIns, const VBOXHGCMPARMPTR pPtr, const void pvSrc, uint32_t cbSrc)
755	{
756	int rc = VINF_SUCCESS;
757
758	uint8_t pu8Src = (uint8_t )pvSrc;
759	uint32_t offPage = pPtr->offFirstPage;
760	uint32_t cbRemaining = RT_MIN(cbSrc, pPtr->cbData);
761
762	uint32_t iPage;
763	for (iPage = 0; iPage < pPtr->cPages && cbRemaining > 0; ++iPage)
764	{
765	uint32_t cbToWrite = GUEST_PAGE_SIZE - offPage;
766	if (cbToWrite > cbRemaining)
767	cbToWrite = cbRemaining;
768
769	/* Skip invalid pages. */
770	const RTGCPHYS GCPhys = pPtr->paPages[iPage];
771	if (GCPhys != NIL_RTGCPHYS)
772	{
773	rc = PDMDevHlpPhysWrite(pDevIns, GCPhys + offPage, pu8Src, cbToWrite);
774	AssertRCBreak(rc);
775	}
776
777	offPage = 0; /* A next page is written at 0 offset. */
778	cbRemaining -= cbToWrite;
779	pu8Src += cbToWrite;
780	}
781
782	return rc;
783	}
784
785	/** Initializes pCmd->paHostParms from already initialized pCmd->paGuestParms.
786	* Allocates memory for pointer parameters and copies data from the guest.
787	*
788	* @returns VBox status code that the guest should see.
789	* @param pDevIns The device instance.
790	* @param pThisCC The VMMDev ring-3 instance data.
791	* @param pCmd Command structure where host parameters needs initialization.
792	* @param pbReq The request buffer.
793	*/
794	static int vmmdevR3HgcmInitHostParameters(PPDMDEVINS pDevIns, PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd, uint8_t const *pbReq)
795	{
796	AssertReturn(pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL, VERR_INTERNAL_ERROR);
797
798	for (uint32_t i = 0; i < pCmd->u.call.cParms; ++i)
799	{
800	VBOXHGCMGUESTPARM * const pGuestParm = &pCmd->u.call.paGuestParms[i];
801	VBOXHGCMSVCPARM * const pHostParm = &pCmd->u.call.paHostParms[i];
802
803	switch (pGuestParm->enmType)
804	{
805	case VMMDevHGCMParmType_32bit:
806	{
807	pHostParm->type = VBOX_HGCM_SVC_PARM_32BIT;
808	pHostParm->u.uint32 = (uint32_t)pGuestParm->u.val.u64Value;
809
810	break;
811	}
812
813	case VMMDevHGCMParmType_64bit:
814	{
815	pHostParm->type = VBOX_HGCM_SVC_PARM_64BIT;
816	pHostParm->u.uint64 = pGuestParm->u.val.u64Value;
817
818	break;
819	}
820
821	case VMMDevHGCMParmType_PageList:
822	case VMMDevHGCMParmType_LinAddr_In:
823	case VMMDevHGCMParmType_LinAddr_Out:
824	case VMMDevHGCMParmType_LinAddr:
825	case VMMDevHGCMParmType_Embedded:
826	case VMMDevHGCMParmType_ContiguousPageList:
827	{
828	const uint32_t cbData = pGuestParm->u.ptr.cbData;
829
830	pHostParm->type = VBOX_HGCM_SVC_PARM_PTR;
831	pHostParm->u.pointer.size = cbData;
832
833	if (cbData)
834	{
835	/* Zero memory, the buffer content is potentially copied to the guest. */
836	void *pv = vmmdevR3HgcmCallMemAllocZ(pThisCC, pCmd, cbData);
837	AssertReturn(pv, VERR_NO_MEMORY);
838	pHostParm->u.pointer.addr = pv;
839
840	if (pGuestParm->u.ptr.fu32Direction & VBOX_HGCM_F_PARM_DIRECTION_TO_HOST)
841	{
842	if (pGuestParm->enmType != VMMDevHGCMParmType_Embedded)
843	{
844	if (pGuestParm->enmType != VMMDevHGCMParmType_ContiguousPageList)
845	{
846	int rc = vmmdevR3HgcmGuestBufferRead(pDevIns, pv, cbData, &pGuestParm->u.ptr);
847	ASSERT_GUEST_RETURN(RT_SUCCESS(rc), rc);
848	RT_UNTRUSTED_NONVOLATILE_COPY_FENCE();
849	}
850	else
851	{
852	int rc = PDMDevHlpPhysRead(pDevIns,
853	pGuestParm->u.ptr.paPages[0] \| pGuestParm->u.ptr.offFirstPage,
854	pv, cbData);
855	ASSERT_GUEST_RETURN(RT_SUCCESS(rc), rc);
856	RT_UNTRUSTED_NONVOLATILE_COPY_FENCE();
857	}
858	}
859	else
860	{
861	memcpy(pv, &pbReq[pGuestParm->u.ptr.offFirstPage], cbData);
862	RT_UNTRUSTED_NONVOLATILE_COPY_FENCE();
863	}
864	}
865	}
866	else
867	{
868	pHostParm->u.pointer.addr = NULL;
869	}
870
871	break;
872	}
873
874	case VMMDevHGCMParmType_NoBouncePageList:
875	{
876	pHostParm->type = VBOX_HGCM_SVC_PARM_PAGES;
877	pHostParm->u.Pages.cb = pGuestParm->u.Pages.cbData;
878	pHostParm->u.Pages.cPages = pGuestParm->u.Pages.cPages;
879	pHostParm->u.Pages.papvPages = (void **)&pGuestParm->u.Pages.paPgLocks[pGuestParm->u.Pages.cPages];
880
881	break;
882	}
883
884	default:
885	ASSERT_GUEST_FAILED_RETURN(VERR_INVALID_PARAMETER);
886	}
887	}
888
889	return VINF_SUCCESS;
890	}
891
892
893	/** Allocate and initialize VBOXHGCMCMD structure for a HGCMCall request.
894	*
895	* @returns VBox status code that the guest should see.
896	* @param pThisCC The VMMDev ring-3 instance data.
897	* @param pHGCMCall The HGCMCall request (cached in host memory).
898	* @param cbHGCMCall Size of the request.
899	* @param GCPhys Guest physical address of the request.
900	* @param enmRequestType The request type. Distinguishes 64 and 32 bit calls.
901	* @param ppCmd Where to store pointer to allocated command.
902	* @param pcbHGCMParmStruct Where to store size of used HGCM parameter structure.
903	*/
904	static int vmmdevR3HgcmCallAlloc(PVMMDEVCC pThisCC, const VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall, RTGCPHYS GCPhys,
905	VMMDevRequestType enmRequestType, PVBOXHGCMCMD ppCmd, uint32_t pcbHGCMParmStruct)
906	{
907	#ifdef VBOX_WITH_64_BITS_GUESTS
908	const uint32_t cbHGCMParmStruct = enmRequestType == VMMDevReq_HGCMCall64 ? sizeof(HGCMFunctionParameter64)
909	: sizeof(HGCMFunctionParameter32);
910	#else
911	const uint32_t cbHGCMParmStruct = sizeof(HGCMFunctionParameter);
912	#endif
913
914	const uint32_t cParms = pHGCMCall->cParms;
915
916	/* Whether there is enough space for parameters and sane upper limit. */
917	ASSERT_GUEST_STMT_RETURN( cParms <= (cbHGCMCall - sizeof(VMMDevHGCMCall)) / cbHGCMParmStruct
918	&& cParms <= VMMDEV_MAX_HGCM_PARMS,
919	LogRelMax(50, ("VMMDev: request packet with invalid number of HGCM parameters: %d vs %d. Refusing operation.\n",
920	(cbHGCMCall - sizeof(VMMDevHGCMCall)) / cbHGCMParmStruct, cParms)),
921	VERR_INVALID_PARAMETER);
922	RT_UNTRUSTED_VALIDATED_FENCE();
923
924	PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, VBOXHGCMCMDTYPE_CALL, GCPhys, cbHGCMCall, cParms,
925	pHGCMCall->header.header.fRequestor);
926	if (pCmd == NULL)
927	return VERR_NO_MEMORY;
928
929	/* Request type has been validated in vmmdevReqDispatcher. */
930	pCmd->enmRequestType = enmRequestType;
931	pCmd->u.call.u32ClientID = pHGCMCall->u32ClientID;
932	pCmd->u.call.u32Function = pHGCMCall->u32Function;
933
934	*ppCmd = pCmd;
935	*pcbHGCMParmStruct = cbHGCMParmStruct;
936	return VINF_SUCCESS;
937	}
938
939	/**
940	* Heap budget wrapper around RTMemAlloc and RTMemAllocZ.
941	*/
942	static void *vmmdevR3HgcmCallMemAllocEx(PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd, size_t cbRequested, bool fZero)
943	{
944	uintptr_t idx = pCmd->idxHeapAcc;
945	AssertStmt(idx < RT_ELEMENTS(pThisCC->aHgcmAcc), idx %= RT_ELEMENTS(pThisCC->aHgcmAcc));
946
947	/* Check against max heap costs for this request. */
948	Assert(pCmd->cbHeapCost <= VMMDEV_MAX_HGCM_DATA_SIZE);
949	if (cbRequested <= VMMDEV_MAX_HGCM_DATA_SIZE - pCmd->cbHeapCost)
950	{
951	/* Check heap budget (we're under lock). */
952	if (cbRequested <= pThisCC->aHgcmAcc[idx].cbHeapBudget)
953	{
954	/* Do the actual allocation. */
955	void *pv = fZero ? RTMemAllocZ(cbRequested) : RTMemAlloc(cbRequested);
956	if (pv)
957	{
958	/* Update the request cost and heap budget. */
959	Log5Func(("aHgcmAcc[%zu] %#RX64 += %#x (%p)\n", idx, pThisCC->aHgcmAcc[idx].cbHeapBudget, cbRequested, pCmd));
960	pThisCC->aHgcmAcc[idx].cbHeapBudget -= cbRequested;
961	pCmd->cbHeapCost += (uint32_t)cbRequested;
962	return pv;
963	}
964	LogFunc(("Heap alloc failed: cbRequested=%#zx - enmCmdType=%d\n", cbRequested, pCmd->enmCmdType));
965	}
966	else
967	LogFunc(("Heap budget overrun: cbRequested=%#zx cbHeapCost=%#x aHgcmAcc[%u].cbHeapBudget=%#RX64 - enmCmdType=%d\n",
968	cbRequested, pCmd->cbHeapCost, pCmd->idxHeapAcc, pThisCC->aHgcmAcc[idx].cbHeapBudget, pCmd->enmCmdType));
969	}
970	else
971	LogFunc(("Request too big: cbRequested=%#zx cbHeapCost=%#x - enmCmdType=%d\n",
972	cbRequested, pCmd->cbHeapCost, pCmd->enmCmdType));
973	STAM_REL_COUNTER_INC(&pThisCC->aHgcmAcc[idx].StatBudgetOverruns);
974	return NULL;
975	}
976
977	/**
978	* Heap budget wrapper around RTMemAlloc.
979	*/
980	DECLINLINE(void *) vmmdevR3HgcmCallMemAlloc(PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd, size_t cbRequested)
981	{
982	return vmmdevR3HgcmCallMemAllocEx(pThisCC, pCmd, cbRequested, false /fZero/);
983	}
984
985	/**
986	* Heap budget wrapper around RTMemAllocZ.
987	*/
988	DECLINLINE(void *) vmmdevR3HgcmCallMemAllocZ(PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd, size_t cbRequested)
989	{
990	return vmmdevR3HgcmCallMemAllocEx(pThisCC, pCmd, cbRequested, true /fZero/);
991	}
992
993	/** Copy VMMDevHGCMCall request data from the guest to VBOXHGCMCMD command.
994	*
995	* @returns VBox status code that the guest should see.
996	* @param pDevIns The device instance.
997	* @param pThisCC The VMMDev ring-3 instance data.
998	* @param pCmd The destination command.
999	* @param pHGCMCall The HGCMCall request (cached in host memory).
1000	* @param cbHGCMCall Size of the request.
1001	* @param enmRequestType The request type. Distinguishes 64 and 32 bit calls.
1002	* @param cbHGCMParmStruct Size of used HGCM parameter structure.
1003	*/
1004	static int vmmdevR3HgcmCallFetchGuestParms(PPDMDEVINS pDevIns, PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd,
1005	const VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall,
1006	VMMDevRequestType enmRequestType, uint32_t cbHGCMParmStruct)
1007	{
1008	/*
1009	* Go over all guest parameters and initialize relevant VBOXHGCMCMD fields.
1010	* VBOXHGCMCMD must contain all information about the request,
1011	* the request will be not read from the guest memory again.
1012	*/
1013	#ifdef VBOX_WITH_64_BITS_GUESTS
1014	const bool f64Bits = (enmRequestType == VMMDevReq_HGCMCall64);
1015	#endif
1016
1017	const uint32_t cParms = pCmd->u.call.cParms;
1018
1019	/* Offsets in the request buffer to HGCM parameters and additional data. */
1020	const uint32_t offHGCMParms = sizeof(VMMDevHGCMCall);
1021	const uint32_t offExtra = offHGCMParms + cParms * cbHGCMParmStruct;
1022
1023	/* Pointer to the next HGCM parameter of the request. */
1024	const uint8_t pu8HGCMParm = (uint8_t )pHGCMCall + offHGCMParms;
1025
1026	for (uint32_t i = 0; i < cParms; ++i, pu8HGCMParm += cbHGCMParmStruct)
1027	{
1028	VBOXHGCMGUESTPARM * const pGuestParm = &pCmd->u.call.paGuestParms[i];
1029
1030	#ifdef VBOX_WITH_64_BITS_GUESTS
1031	AssertCompileMembersSameSizeAndOffset(HGCMFunctionParameter64, type, HGCMFunctionParameter32, type);
1032	pGuestParm->enmType = ((HGCMFunctionParameter64 *)pu8HGCMParm)->type;
1033	#else
1034	pGuestParm->enmType = ((HGCMFunctionParameter *)pu8HGCMParm)->type;
1035	#endif
1036
1037	switch (pGuestParm->enmType)
1038	{
1039	case VMMDevHGCMParmType_32bit:
1040	{
1041	#ifdef VBOX_WITH_64_BITS_GUESTS
1042	AssertCompileMembersSameSizeAndOffset(HGCMFunctionParameter64, u.value32, HGCMFunctionParameter32, u.value32);
1043	uint32_t pu32 = &((HGCMFunctionParameter64 )pu8HGCMParm)->u.value32;
1044	#else
1045	uint32_t pu32 = &((HGCMFunctionParameter )pu8HGCMParm)->u.value32;
1046	#endif
1047	LogFunc(("uint32 guest parameter %RI32\n", *pu32));
1048
1049	pGuestParm->u.val.u64Value = *pu32;
1050	pGuestParm->u.val.offValue = (uint32_t)((uintptr_t)pu32 - (uintptr_t)pHGCMCall);
1051	pGuestParm->u.val.cbValue = sizeof(uint32_t);
1052
1053	break;
1054	}
1055
1056	case VMMDevHGCMParmType_64bit:
1057	{
1058	#ifdef VBOX_WITH_64_BITS_GUESTS
1059	AssertCompileMembersSameSizeAndOffset(HGCMFunctionParameter64, u.value64, HGCMFunctionParameter32, u.value64);
1060	uint64_t pu64 = (uint64_t )(uintptr_t)&((HGCMFunctionParameter64 )pu8HGCMParm)->u.value64; / MSC detect misalignment, thus casts. */
1061	#else
1062	uint64_t pu64 = &((HGCMFunctionParameter )pu8HGCMParm)->u.value64;
1063	#endif
1064	LogFunc(("uint64 guest parameter %RI64\n", *pu64));
1065
1066	pGuestParm->u.val.u64Value = *pu64;
1067	pGuestParm->u.val.offValue = (uint32_t)((uintptr_t)pu64 - (uintptr_t)pHGCMCall);
1068	pGuestParm->u.val.cbValue = sizeof(uint64_t);
1069
1070	break;
1071	}
1072
1073	case VMMDevHGCMParmType_LinAddr_In: /* In (read) */
1074	case VMMDevHGCMParmType_LinAddr_Out: /* Out (write) */
1075	case VMMDevHGCMParmType_LinAddr: /* In & Out */
1076	{
1077	#ifdef VBOX_WITH_64_BITS_GUESTS
1078	uint32_t cbData = f64Bits ? ((HGCMFunctionParameter64 *)pu8HGCMParm)->u.Pointer.size
1079	: ((HGCMFunctionParameter32 *)pu8HGCMParm)->u.Pointer.size;
1080	RTGCPTR GCPtr = f64Bits ? ((HGCMFunctionParameter64 *)pu8HGCMParm)->u.Pointer.u.linearAddr
1081	: ((HGCMFunctionParameter32 *)pu8HGCMParm)->u.Pointer.u.linearAddr;
1082	#else
1083	uint32_t cbData = ((HGCMFunctionParameter *)pu8HGCMParm)->u.Pointer.size;
1084	RTGCPTR GCPtr = ((HGCMFunctionParameter *)pu8HGCMParm)->u.Pointer.u.linearAddr;
1085	#endif
1086	LogFunc(("LinAddr guest parameter %RGv, cb %u\n", GCPtr, cbData));
1087
1088	ASSERT_GUEST_RETURN(cbData <= VMMDEV_MAX_HGCM_DATA_SIZE, VERR_INVALID_PARAMETER);
1089
1090	const uint32_t offFirstPage = cbData > 0 ? GCPtr & GUEST_PAGE_OFFSET_MASK : 0;
1091	const uint32_t cPages = cbData > 0 ? (offFirstPage + cbData + GUEST_PAGE_SIZE - 1) / GUEST_PAGE_SIZE : 0;
1092
1093	pGuestParm->u.ptr.cbData = cbData;
1094	pGuestParm->u.ptr.offFirstPage = offFirstPage;
1095	pGuestParm->u.ptr.cPages = cPages;
1096	pGuestParm->u.ptr.fu32Direction = vmmdevR3HgcmParmTypeToDirection(pGuestParm->enmType);
1097
1098	if (cbData > 0)
1099	{
1100	if (cPages == 1)
1101	pGuestParm->u.ptr.paPages = &pGuestParm->u.ptr.GCPhysSinglePage;
1102	else
1103	{
1104	/* (Max 262144 bytes with current limits.) */
1105	pGuestParm->u.ptr.paPages = (RTGCPHYS *)vmmdevR3HgcmCallMemAlloc(pThisCC, pCmd,
1106	cPages * sizeof(RTGCPHYS));
1107	AssertReturn(pGuestParm->u.ptr.paPages, VERR_NO_MEMORY);
1108	}
1109
1110	/* Gonvert the guest linear pointers of pages to physical addresses. */
1111	GCPtr &= ~(RTGCPTR)GUEST_PAGE_OFFSET_MASK;
1112	for (uint32_t iPage = 0; iPage < cPages; ++iPage)
1113	{
1114	/* The guest might specify invalid GCPtr, just skip such addresses.
1115	* Also if the guest parameters are fetched when restoring an old saved state,
1116	* then GCPtr may become invalid and do not have a corresponding GCPhys.
1117	* The command restoration routine will take care of this.
1118	*/
1119	RTGCPHYS GCPhys;
1120	int rc2 = PDMDevHlpPhysGCPtr2GCPhys(pDevIns, GCPtr, &GCPhys);
1121	if (RT_FAILURE(rc2))
1122	GCPhys = NIL_RTGCPHYS;
1123	LogFunc(("Page %d: %RGv -> %RGp. %Rrc\n", iPage, GCPtr, GCPhys, rc2));
1124
1125	pGuestParm->u.ptr.paPages[iPage] = GCPhys;
1126	GCPtr += GUEST_PAGE_SIZE;
1127	}
1128	}
1129
1130	break;
1131	}
1132
1133	case VMMDevHGCMParmType_PageList:
1134	case VMMDevHGCMParmType_ContiguousPageList:
1135	case VMMDevHGCMParmType_NoBouncePageList:
1136	{
1137	#ifdef VBOX_WITH_64_BITS_GUESTS
1138	AssertCompileMembersSameSizeAndOffset(HGCMFunctionParameter64, u.PageList.size, HGCMFunctionParameter32, u.PageList.size);
1139	AssertCompileMembersSameSizeAndOffset(HGCMFunctionParameter64, u.PageList.offset, HGCMFunctionParameter32, u.PageList.offset);
1140	uint32_t cbData = ((HGCMFunctionParameter64 *)pu8HGCMParm)->u.PageList.size;
1141	uint32_t offPageListInfo = ((HGCMFunctionParameter64 *)pu8HGCMParm)->u.PageList.offset;
1142	#else
1143	uint32_t cbData = ((HGCMFunctionParameter *)pu8HGCMParm)->u.PageList.size;
1144	uint32_t offPageListInfo = ((HGCMFunctionParameter *)pu8HGCMParm)->u.PageList.offset;
1145	#endif
1146	LogFunc(("PageList guest parameter cb %u, offset %u\n", cbData, offPageListInfo));
1147
1148	ASSERT_GUEST_RETURN(cbData <= VMMDEV_MAX_HGCM_DATA_SIZE, VERR_INVALID_PARAMETER);
1149
1150	/** @todo respect zero byte page lists... */
1151	/* Check that the page list info is within the request. */
1152	ASSERT_GUEST_RETURN( offPageListInfo >= offExtra
1153	&& cbHGCMCall >= sizeof(HGCMPageListInfo)
1154	&& offPageListInfo <= cbHGCMCall - sizeof(HGCMPageListInfo),
1155	VERR_INVALID_PARAMETER);
1156	RT_UNTRUSTED_VALIDATED_FENCE();
1157
1158	/* The HGCMPageListInfo structure is within the request. */
1159	const HGCMPageListInfo pPageListInfo = (HGCMPageListInfo )((uint8_t *)pHGCMCall + offPageListInfo);
1160
1161	/* Enough space for page pointers? */
1162	const uint32_t cMaxPages = 1 + (cbHGCMCall - offPageListInfo - sizeof(HGCMPageListInfo)) / sizeof(RTGCPHYS);
1163	ASSERT_GUEST_RETURN( pPageListInfo->cPages > 0
1164	&& pPageListInfo->cPages <= cMaxPages,
1165	VERR_INVALID_PARAMETER);
1166
1167	/* Flags. */
1168	ASSERT_GUEST_MSG_RETURN(VBOX_HGCM_F_PARM_ARE_VALID(pPageListInfo->flags),
1169	("%#x\n", pPageListInfo->flags), VERR_INVALID_FLAGS);
1170	/* First page offset. */
1171	ASSERT_GUEST_MSG_RETURN(pPageListInfo->offFirstPage < GUEST_PAGE_SIZE,
1172	("%#x\n", pPageListInfo->offFirstPage), VERR_INVALID_PARAMETER);
1173
1174	/* Contiguous page lists only ever have a single page and
1175	no-bounce page list requires cPages to match the size exactly.
1176	Plain page list does not impose any restrictions on cPages currently. */
1177	ASSERT_GUEST_MSG_RETURN( pPageListInfo->cPages
1178	== (pGuestParm->enmType == VMMDevHGCMParmType_ContiguousPageList ? 1
1179	: RT_ALIGN_32(pPageListInfo->offFirstPage + cbData, GUEST_PAGE_SIZE)
1180	>> GUEST_PAGE_SHIFT)
1181	\|\| pGuestParm->enmType == VMMDevHGCMParmType_PageList,
1182	("offFirstPage=%#x cbData=%#x cPages=%#x enmType=%d\n",
1183	pPageListInfo->offFirstPage, cbData, pPageListInfo->cPages, pGuestParm->enmType),
1184	VERR_INVALID_PARAMETER);
1185
1186	RT_UNTRUSTED_VALIDATED_FENCE();
1187
1188	/*
1189	* Deal with no-bounce buffers first, as
1190	* VMMDevHGCMParmType_PageList is the fallback.
1191	*/
1192	if (pGuestParm->enmType == VMMDevHGCMParmType_NoBouncePageList)
1193	{
1194	/* Validate page offsets */
1195	ASSERT_GUEST_MSG_RETURN( !(pPageListInfo->aPages[0] & GUEST_PAGE_OFFSET_MASK)
1196	\|\| (pPageListInfo->aPages[0] & GUEST_PAGE_OFFSET_MASK) == pPageListInfo->offFirstPage,
1197	("%#RX64 offFirstPage=%#x\n", pPageListInfo->aPages[0], pPageListInfo->offFirstPage),
1198	VERR_INVALID_POINTER);
1199	uint32_t const cPages = pPageListInfo->cPages;
1200	for (uint32_t iPage = 1; iPage < cPages; iPage++)
1201	ASSERT_GUEST_MSG_RETURN(!(pPageListInfo->aPages[iPage] & GUEST_PAGE_OFFSET_MASK),
1202	("[%#zx]=%#RX64\n", iPage, pPageListInfo->aPages[iPage]), VERR_INVALID_POINTER);
1203	RT_UNTRUSTED_VALIDATED_FENCE();
1204
1205	pGuestParm->u.Pages.cbData = cbData;
1206	pGuestParm->u.Pages.offFirstPage = pPageListInfo->offFirstPage;
1207	pGuestParm->u.Pages.fFlags = pPageListInfo->flags;
1208	pGuestParm->u.Pages.cPages = (uint16_t)cPages;
1209	pGuestParm->u.Pages.fLocked = false;
1210	pGuestParm->u.Pages.paPgLocks = (PPGMPAGEMAPLOCK)vmmdevR3HgcmCallMemAllocZ(pThisCC, pCmd,
1211	( sizeof(PGMPAGEMAPLOCK)
1212	+ sizeof(void )) cPages);
1213	AssertReturn(pGuestParm->u.Pages.paPgLocks, VERR_NO_MEMORY);
1214
1215	/* Make sure the page offsets are sensible. */
1216	int rc = VINF_SUCCESS;
1217	void papvPages = (void )&pGuestParm->u.Pages.paPgLocks[cPages];
1218	if (pPageListInfo->flags & VBOX_HGCM_F_PARM_DIRECTION_FROM_HOST)
1219	rc = PDMDevHlpPhysBulkGCPhys2CCPtr(pDevIns, cPages, pPageListInfo->aPages, 0 /fFlags/,
1220	papvPages, pGuestParm->u.Pages.paPgLocks);
1221	else
1222	rc = PDMDevHlpPhysBulkGCPhys2CCPtrReadOnly(pDevIns, cPages, pPageListInfo->aPages, 0 /fFlags/,
1223	(void const **)papvPages, pGuestParm->u.Pages.paPgLocks);
1224	if (RT_SUCCESS(rc))
1225	{
1226	papvPages[0] = (void *)((uintptr_t)papvPages[0] \| pPageListInfo->offFirstPage);
1227	pGuestParm->u.Pages.fLocked = true;
1228	break;
1229	}
1230
1231	/* Locking failed, bail out. In case of MMIO we fall back on regular page list handling. */
1232	RTMemFree(pGuestParm->u.Pages.paPgLocks);
1233	pGuestParm->u.Pages.paPgLocks = NULL;
1234	STAM_REL_COUNTER_INC(&pThisCC->StatHgcmFailedPageListLocking);
1235	ASSERT_GUEST_MSG_RETURN(rc == VERR_PGM_PHYS_PAGE_RESERVED, ("cPages=%u %Rrc\n", cPages, rc), rc);
1236	pGuestParm->enmType = VMMDevHGCMParmType_PageList;
1237	}
1238
1239	/*
1240	* Regular page list or contiguous page list.
1241	*/
1242	pGuestParm->u.ptr.cbData = cbData;
1243	pGuestParm->u.ptr.offFirstPage = pPageListInfo->offFirstPage;
1244	pGuestParm->u.ptr.cPages = pPageListInfo->cPages;
1245	pGuestParm->u.ptr.fu32Direction = pPageListInfo->flags;
1246	if (pPageListInfo->cPages == 1)
1247	{
1248	pGuestParm->u.ptr.paPages = &pGuestParm->u.ptr.GCPhysSinglePage;
1249	pGuestParm->u.ptr.GCPhysSinglePage = pPageListInfo->aPages[0];
1250	}
1251	else
1252	{
1253	pGuestParm->u.ptr.paPages = (RTGCPHYS *)vmmdevR3HgcmCallMemAlloc(pThisCC, pCmd,
1254	pPageListInfo->cPages * sizeof(RTGCPHYS));
1255	AssertReturn(pGuestParm->u.ptr.paPages, VERR_NO_MEMORY);
1256
1257	for (uint32_t iPage = 0; iPage < pGuestParm->u.ptr.cPages; ++iPage)
1258	pGuestParm->u.ptr.paPages[iPage] = pPageListInfo->aPages[iPage];
1259	}
1260	break;
1261	}
1262
1263	case VMMDevHGCMParmType_Embedded:
1264	{
1265	#ifdef VBOX_WITH_64_BITS_GUESTS
1266	AssertCompileMembersSameSizeAndOffset(HGCMFunctionParameter64, u.Embedded.cbData, HGCMFunctionParameter32, u.Embedded.cbData);
1267	uint32_t const cbData = ((HGCMFunctionParameter64 *)pu8HGCMParm)->u.Embedded.cbData;
1268	uint32_t const offData = ((HGCMFunctionParameter64 *)pu8HGCMParm)->u.Embedded.offData;
1269	uint32_t const fFlags = ((HGCMFunctionParameter64 *)pu8HGCMParm)->u.Embedded.fFlags;
1270	#else
1271	uint32_t const cbData = ((HGCMFunctionParameter *)pu8HGCMParm)->u.Embedded.cbData;
1272	uint32_t const offData = ((HGCMFunctionParameter *)pu8HGCMParm)->u.Embedded.offData;
1273	uint32_t const fFlags = ((HGCMFunctionParameter *)pu8HGCMParm)->u.Embedded.fFlags;
1274	#endif
1275	LogFunc(("Embedded guest parameter cb %u, offset %u, flags %#x\n", cbData, offData, fFlags));
1276
1277	ASSERT_GUEST_RETURN(cbData <= VMMDEV_MAX_HGCM_DATA_SIZE, VERR_INVALID_PARAMETER);
1278
1279	/* Check flags and buffer range. */
1280	ASSERT_GUEST_MSG_RETURN(VBOX_HGCM_F_PARM_ARE_VALID(fFlags), ("%#x\n", fFlags), VERR_INVALID_FLAGS);
1281	ASSERT_GUEST_MSG_RETURN( offData >= offExtra
1282	&& offData <= cbHGCMCall
1283	&& cbData <= cbHGCMCall - offData,
1284	("offData=%#x cbData=%#x cbHGCMCall=%#x offExtra=%#x\n", offData, cbData, cbHGCMCall, offExtra),
1285	VERR_INVALID_PARAMETER);
1286	RT_UNTRUSTED_VALIDATED_FENCE();
1287
1288	/* We use part of the ptr member. */
1289	pGuestParm->u.ptr.fu32Direction = fFlags;
1290	pGuestParm->u.ptr.cbData = cbData;
1291	pGuestParm->u.ptr.offFirstPage = offData;
1292	pGuestParm->u.ptr.GCPhysSinglePage = pCmd->GCPhys + offData;
1293	pGuestParm->u.ptr.cPages = 1;
1294	pGuestParm->u.ptr.paPages = &pGuestParm->u.ptr.GCPhysSinglePage;
1295	break;
1296	}
1297
1298	default:
1299	ASSERT_GUEST_FAILED_RETURN(VERR_INVALID_PARAMETER);
1300	}
1301	}
1302
1303	return VINF_SUCCESS;
1304	}
1305
1306	/**
1307	* Handles VMMDevHGCMCall request.
1308	*
1309	* @returns VBox status code that the guest should see.
1310	* @param pDevIns The device instance.
1311	* @param pThis The VMMDev shared instance data.
1312	* @param pThisCC The VMMDev ring-3 instance data.
1313	* @param pHGCMCall The request to handle (cached in host memory).
1314	* @param cbHGCMCall Size of the entire request (including HGCM parameters).
1315	* @param GCPhys The guest physical address of the request.
1316	* @param enmRequestType The request type. Distinguishes 64 and 32 bit calls.
1317	* @param tsArrival The STAM_GET_TS() value when the request arrived.
1318	* @param ppLock Pointer to the lock info pointer (latter can be
1319	* NULL). Set to NULL if HGCM takes lock ownership.
1320	*/
1321	int vmmdevR3HgcmCall(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, const VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall,
1322	RTGCPHYS GCPhys, VMMDevRequestType enmRequestType, uint64_t tsArrival, PVMMDEVREQLOCK *ppLock)
1323	{
1324	LogFunc(("client id = %d, function = %d, cParms = %d, enmRequestType = %d, fRequestor = %#x\n", pHGCMCall->u32ClientID,
1325	pHGCMCall->u32Function, pHGCMCall->cParms, enmRequestType, pHGCMCall->header.header.fRequestor));
1326
1327	/*
1328	* Validation.
1329	*/
1330	ASSERT_GUEST_RETURN(cbHGCMCall >= sizeof(VMMDevHGCMCall), VERR_INVALID_PARAMETER);
1331	#ifdef VBOX_WITH_64_BITS_GUESTS
1332	ASSERT_GUEST_RETURN( enmRequestType == VMMDevReq_HGCMCall32
1333	\|\| enmRequestType == VMMDevReq_HGCMCall64, VERR_INVALID_PARAMETER);
1334	#else
1335	ASSERT_GUEST_RETURN(enmRequestType == VMMDevReq_HGCMCall32, VERR_INVALID_PARAMETER);
1336	#endif
1337	RT_UNTRUSTED_VALIDATED_FENCE();
1338
1339	/*
1340	* Create a command structure.
1341	*/
1342	PVBOXHGCMCMD pCmd;
1343	uint32_t cbHGCMParmStruct;
1344	int rc = vmmdevR3HgcmCallAlloc(pThisCC, pHGCMCall, cbHGCMCall, GCPhys, enmRequestType, &pCmd, &cbHGCMParmStruct);
1345	if (RT_SUCCESS(rc))
1346	{
1347	pCmd->tsArrival = tsArrival;
1348	PVMMDEVREQLOCK pLock = *ppLock;
1349	if (pLock)
1350	{
1351	pCmd->ReqMapLock = pLock->Lock;
1352	pCmd->pvReqLocked = pLock->pvReq;
1353	*ppLock = NULL;
1354	}
1355
1356	rc = vmmdevR3HgcmCallFetchGuestParms(pDevIns, pThisCC, pCmd, pHGCMCall, cbHGCMCall, enmRequestType, cbHGCMParmStruct);
1357	if (RT_SUCCESS(rc))
1358	{
1359	/* Copy guest data to host parameters, so HGCM services can use the data. */
1360	rc = vmmdevR3HgcmInitHostParameters(pDevIns, pThisCC, pCmd, (uint8_t const *)pHGCMCall);
1361	if (RT_SUCCESS(rc))
1362	{
1363	/*
1364	* Pass the function call to HGCM connector for actual processing
1365	*/
1366	vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
1367
1368	#if 0 /* DONT ENABLE - for performance hacking. */
1369	if ( pCmd->u.call.u32Function == 9
1370	&& pCmd->u.call.cParms == 5)
1371	{
1372	vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
1373
1374	if (pCmd->pvReqLocked)
1375	{
1376	VMMDevHGCMRequestHeader volatile pHeader = (VMMDevHGCMRequestHeader volatile )pCmd->pvReqLocked;
1377	pHeader->header.rc = VINF_SUCCESS;
1378	pHeader->result = VINF_SUCCESS;
1379	pHeader->fu32Flags \|= VBOX_HGCM_REQ_DONE;
1380	}
1381	else
1382	{
1383	VMMDevHGCMRequestHeader pHeader = (VMMDevHGCMRequestHeader )pHGCMCall;
1384	pHeader->header.rc = VINF_SUCCESS;
1385	pHeader->result = VINF_SUCCESS;
1386	pHeader->fu32Flags \|= VBOX_HGCM_REQ_DONE;
1387	PDMDevHlpPhysWrite(pDevIns, GCPhys, pHeader, sizeof(*pHeader));
1388	}
1389	vmmdevR3HgcmCmdFree(pDevIns, pThisCC, pCmd);
1390	return VINF_HGCM_ASYNC_EXECUTE; /* ignored, but avoids assertions. */
1391	}
1392	#endif
1393
1394	rc = pThisCC->pHGCMDrv->pfnCall(pThisCC->pHGCMDrv, pCmd,
1395	pCmd->u.call.u32ClientID, pCmd->u.call.u32Function,
1396	pCmd->u.call.cParms, pCmd->u.call.paHostParms, tsArrival);
1397
1398	if (rc == VINF_HGCM_ASYNC_EXECUTE)
1399	{
1400	/*
1401	* Done. Just update statistics and return.
1402	*/
1403	#ifndef VBOX_WITHOUT_RELEASE_STATISTICS
1404	uint64_t tsNow;
1405	STAM_GET_TS(tsNow);
1406	STAM_REL_PROFILE_ADD_PERIOD(&pThisCC->StatHgcmCmdArrival, tsNow - tsArrival);
1407	#endif
1408	return rc;
1409	}
1410
1411	/*
1412	* Failed, bail out.
1413	*/
1414	LogFunc(("pfnCall rc = %Rrc\n", rc));
1415	vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
1416	}
1417	}
1418	vmmdevR3HgcmCmdFree(pDevIns, pThis, pThisCC, pCmd);
1419	}
1420	return rc;
1421	}
1422
1423	/**
1424	* VMMDevReq_HGCMCancel worker.
1425	*
1426	* @returns VBox status code that the guest should see.
1427	* @param pThisCC The VMMDev ring-3 instance data.
1428	* @param pHGCMCancel The request to handle (cached in host memory).
1429	* @param GCPhys The address of the request.
1430	*
1431	* @thread EMT
1432	*/
1433	int vmmdevR3HgcmCancel(PVMMDEVCC pThisCC, const VMMDevHGCMCancel *pHGCMCancel, RTGCPHYS GCPhys)
1434	{
1435	NOREF(pHGCMCancel);
1436	int rc = vmmdevR3HgcmCancel2(pThisCC, GCPhys);
1437	return rc == VERR_NOT_FOUND ? VERR_INVALID_PARAMETER : rc;
1438	}
1439
1440	/**
1441	* VMMDevReq_HGCMCancel2 worker.
1442	*
1443	* @retval VINF_SUCCESS on success.
1444	* @retval VERR_NOT_FOUND if the request was not found.
1445	* @retval VERR_INVALID_PARAMETER if the request address is invalid.
1446	*
1447	* @param pThisCC The VMMDev ring-3 instance data.
1448	* @param GCPhys The address of the request that should be cancelled.
1449	*
1450	* @thread EMT
1451	*/
1452	int vmmdevR3HgcmCancel2(PVMMDEVCC pThisCC, RTGCPHYS GCPhys)
1453	{
1454	if ( GCPhys == 0
1455	\|\| GCPhys == NIL_RTGCPHYS
1456	\|\| GCPhys == NIL_RTGCPHYS32)
1457	{
1458	Log(("vmmdevR3HgcmCancel2: GCPhys=%#x\n", GCPhys));
1459	return VERR_INVALID_PARAMETER;
1460	}
1461
1462	/*
1463	* Locate the command and cancel it while under the protection of
1464	* the lock. hgcmCompletedWorker makes assumptions about this.
1465	*/
1466	int rc = vmmdevR3HgcmCmdListLock(pThisCC);
1467	AssertRCReturn(rc, rc);
1468
1469	PVBOXHGCMCMD pCmd = vmmdevR3HgcmFindCommandLocked(pThisCC, GCPhys);
1470	if (pCmd)
1471	{
1472	pCmd->fCancelled = true;
1473
1474	Log(("vmmdevR3HgcmCancel2: Cancelled pCmd=%p / GCPhys=%#x\n", pCmd, GCPhys));
1475	if (pThisCC->pHGCMDrv)
1476	pThisCC->pHGCMDrv->pfnCancelled(pThisCC->pHGCMDrv, pCmd,
1477	pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL ? pCmd->u.call.u32ClientID
1478	: pCmd->enmCmdType == VBOXHGCMCMDTYPE_CONNECT ? pCmd->u.connect.u32ClientID
1479	: pCmd->enmCmdType == VBOXHGCMCMDTYPE_DISCONNECT ? pCmd->u.disconnect.u32ClientID
1480	: 0);
1481	}
1482	else
1483	rc = VERR_NOT_FOUND;
1484
1485	vmmdevR3HgcmCmdListUnlock(pThisCC);
1486	return rc;
1487	}
1488
1489	/** Write HGCM call parameters and buffers back to the guest request and memory.
1490	*
1491	* @returns VBox status code that the guest should see.
1492	* @param pDevIns The device instance.
1493	* @param pCmd Completed call command.
1494	* @param pHGCMCall The guestrequest which needs updating (cached in the host memory).
1495	* @param pbReq The request copy or locked memory for handling
1496	* embedded buffers.
1497	*/
1498	static int vmmdevR3HgcmCompleteCallRequest(PPDMDEVINS pDevIns, PVBOXHGCMCMD pCmd, VMMDevHGCMCall pHGCMCall, uint8_t pbReq)
1499	{
1500	AssertReturn(pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL, VERR_INTERNAL_ERROR);
1501
1502	/*
1503	* Go over parameter descriptions saved in pCmd.
1504	*/
1505	#ifdef VBOX_WITH_64_BITS_GUESTS
1506	HGCMFunctionParameter64 pReqParm = (HGCMFunctionParameter64 )(pbReq + sizeof(VMMDevHGCMCall));
1507	size_t const cbHGCMParmStruct = pCmd->enmRequestType == VMMDevReq_HGCMCall64
1508	? sizeof(HGCMFunctionParameter64) : sizeof(HGCMFunctionParameter32);
1509	#else
1510	HGCMFunctionParameter pReqParm = (HGCMFunctionParameter )(pbReq + sizeof(VMMDevHGCMCall));
1511	size_t const cbHGCMParmStruct = sizeof(HGCMFunctionParameter);
1512	#endif
1513	for (uint32_t i = 0;
1514	i < pCmd->u.call.cParms;
1515	#ifdef VBOX_WITH_64_BITS_GUESTS
1516	++i, pReqParm = (HGCMFunctionParameter64 )((uint8_t )pReqParm + cbHGCMParmStruct)
1517	#else
1518	++i, pReqParm = (HGCMFunctionParameter )((uint8_t )pReqParm + cbHGCMParmStruct)
1519	#endif
1520	)
1521	{
1522	VBOXHGCMGUESTPARM * const pGuestParm = &pCmd->u.call.paGuestParms[i];
1523	VBOXHGCMSVCPARM * const pHostParm = &pCmd->u.call.paHostParms[i];
1524
1525	const HGCMFunctionParameterType enmType = pGuestParm->enmType;
1526	switch (enmType)
1527	{
1528	case VMMDevHGCMParmType_32bit:
1529	case VMMDevHGCMParmType_64bit:
1530	{
1531	const VBOXHGCMPARMVAL * const pVal = &pGuestParm->u.val;
1532	const void pvSrc = enmType == VMMDevHGCMParmType_32bit ? (void )&pHostParm->u.uint32
1533	: (void *)&pHostParm->u.uint64;
1534	/** @todo optimize memcpy away here. */
1535	memcpy((uint8_t *)pHGCMCall + pVal->offValue, pvSrc, pVal->cbValue);
1536	break;
1537	}
1538
1539	case VMMDevHGCMParmType_LinAddr_In:
1540	case VMMDevHGCMParmType_LinAddr_Out:
1541	case VMMDevHGCMParmType_LinAddr:
1542	case VMMDevHGCMParmType_PageList:
1543	{
1544	/** @todo Update the return buffer size? */
1545	const VBOXHGCMPARMPTR * const pPtr = &pGuestParm->u.ptr;
1546	if ( pPtr->cbData > 0
1547	&& (pPtr->fu32Direction & VBOX_HGCM_F_PARM_DIRECTION_FROM_HOST))
1548	{
1549	const void *pvSrc = pHostParm->u.pointer.addr;
1550	uint32_t cbSrc = pHostParm->u.pointer.size;
1551	int rc = vmmdevR3HgcmGuestBufferWrite(pDevIns, pPtr, pvSrc, cbSrc);
1552	if (RT_FAILURE(rc))
1553	break;
1554	}
1555	break;
1556	}
1557
1558	case VMMDevHGCMParmType_Embedded:
1559	{
1560	const VBOXHGCMPARMPTR * const pPtr = &pGuestParm->u.ptr;
1561
1562	/* Update size. */
1563	#ifdef VBOX_WITH_64_BITS_GUESTS
1564	AssertCompileMembersSameSizeAndOffset(HGCMFunctionParameter64, u.Embedded.cbData, HGCMFunctionParameter32, u.Embedded.cbData);
1565	#endif
1566	pReqParm->u.Embedded.cbData = pHostParm->u.pointer.size;
1567
1568	/* Copy out data. */
1569	if ( pPtr->cbData > 0
1570	&& (pPtr->fu32Direction & VBOX_HGCM_F_PARM_DIRECTION_FROM_HOST))
1571	{
1572	const void *pvSrc = pHostParm->u.pointer.addr;
1573	uint32_t cbSrc = pHostParm->u.pointer.size;
1574	uint32_t cbToCopy = RT_MIN(cbSrc, pPtr->cbData);
1575	memcpy(pbReq + pPtr->offFirstPage, pvSrc, cbToCopy);
1576	}
1577	break;
1578	}
1579
1580	case VMMDevHGCMParmType_ContiguousPageList:
1581	{
1582	const VBOXHGCMPARMPTR * const pPtr = &pGuestParm->u.ptr;
1583
1584	/* Update size. */
1585	#ifdef VBOX_WITH_64_BITS_GUESTS
1586	AssertCompileMembersSameSizeAndOffset(HGCMFunctionParameter64, u.PageList.size, HGCMFunctionParameter32, u.PageList.size);
1587	#endif
1588	pReqParm->u.PageList.size = pHostParm->u.pointer.size;
1589
1590	/* Copy out data. */
1591	if ( pPtr->cbData > 0
1592	&& (pPtr->fu32Direction & VBOX_HGCM_F_PARM_DIRECTION_FROM_HOST))
1593	{
1594	const void *pvSrc = pHostParm->u.pointer.addr;
1595	uint32_t cbSrc = pHostParm->u.pointer.size;
1596	uint32_t cbToCopy = RT_MIN(cbSrc, pPtr->cbData);
1597	int rc = PDMDevHlpPhysWrite(pDevIns, pGuestParm->u.ptr.paPages[0] \| pGuestParm->u.ptr.offFirstPage,
1598	pvSrc, cbToCopy);
1599	if (RT_FAILURE(rc))
1600	break;
1601	}
1602	break;
1603	}
1604
1605	case VMMDevHGCMParmType_NoBouncePageList:
1606	{
1607	/* Update size. */
1608	#ifdef VBOX_WITH_64_BITS_GUESTS
1609	AssertCompileMembersSameSizeAndOffset(HGCMFunctionParameter64, u.PageList.size, HGCMFunctionParameter32, u.PageList.size);
1610	#endif
1611	pReqParm->u.PageList.size = pHostParm->u.Pages.cb;
1612
1613	/* unlock early. */
1614	if (pGuestParm->u.Pages.fLocked)
1615	{
1616	PDMDevHlpPhysBulkReleasePageMappingLocks(pDevIns, pGuestParm->u.Pages.cPages,
1617	pGuestParm->u.Pages.paPgLocks);
1618	pGuestParm->u.Pages.fLocked = false;
1619	}
1620	break;
1621	}
1622
1623	default:
1624	break;
1625	}
1626	}
1627
1628	return VINF_SUCCESS;
1629	}
1630
1631	/** Update HGCM request in the guest memory and mark it as completed.
1632	*
1633	* @returns VINF_SUCCESS or VERR_CANCELLED.
1634	* @param pInterface Pointer to this PDM interface.
1635	* @param result HGCM completion status code (VBox status code).
1636	* @param pCmd Completed command, which contains updated host parameters.
1637	*
1638	* @thread EMT
1639	*/
1640	static int hgcmCompletedWorker(PPDMIHGCMPORT pInterface, int32_t result, PVBOXHGCMCMD pCmd)
1641	{
1642	PVMMDEVCC pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IHGCMPort);
1643	PPDMDEVINS pDevIns = pThisCC->pDevIns;
1644	PVMMDEV pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
1645	#ifdef VBOX_WITH_DTRACE
1646	uint32_t idFunction = 0;
1647	uint32_t idClient = 0;
1648	#endif
1649
1650	if (result == VINF_HGCM_SAVE_STATE)
1651	{
1652	/* If the completion routine was called while the HGCM service saves its state,
1653	* then currently nothing to be done here. The pCmd stays in the list and will
1654	* be saved later when the VMMDev state will be saved and re-submitted on load.
1655	*
1656	* It it assumed that VMMDev saves state after the HGCM services (VMMDev driver
1657	* attached by constructor before it registers its SSM state), and, therefore,
1658	* VBOXHGCMCMD structures are not removed by vmmdevR3HgcmSaveState from the list,
1659	* while HGCM uses them.
1660	*/
1661	LogFlowFunc(("VINF_HGCM_SAVE_STATE for command %p\n", pCmd));
1662	return VINF_SUCCESS;
1663	}
1664
1665	VBOXDD_HGCMCALL_COMPLETED_EMT(pCmd, result);
1666
1667	int rc = VINF_SUCCESS;
1668
1669	/*
1670	* The cancellation protocol requires us to remove the command here
1671	* and then check the flag. Cancelled commands must not be written
1672	* back to guest memory.
1673	*/
1674	vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
1675
1676	if (RT_LIKELY(!pCmd->fCancelled))
1677	{
1678	if (!pCmd->pvReqLocked)
1679	{
1680	/*
1681	* Request is not locked:
1682	*/
1683	VMMDevHGCMRequestHeader pHeader = (VMMDevHGCMRequestHeader )RTMemAlloc(pCmd->cbRequest);
1684	if (pHeader)
1685	{
1686	/*
1687	* Read the request from the guest memory for updating.
1688	* The request data is not be used for anything but checking the request type.
1689	*/
1690	PDMDevHlpPhysRead(pDevIns, pCmd->GCPhys, pHeader, pCmd->cbRequest);
1691	RT_UNTRUSTED_NONVOLATILE_COPY_FENCE();
1692
1693	/* Verify the request type. This is the only field which is used from the guest memory. */
1694	const VMMDevRequestType enmRequestType = pHeader->header.requestType;
1695	if ( enmRequestType == pCmd->enmRequestType
1696	\|\| enmRequestType == VMMDevReq_HGCMCancel)
1697	{
1698	RT_UNTRUSTED_VALIDATED_FENCE();
1699
1700	/*
1701	* Update parameters and data buffers.
1702	*/
1703	switch (enmRequestType)
1704	{
1705	#ifdef VBOX_WITH_64_BITS_GUESTS
1706	case VMMDevReq_HGCMCall64:
1707	#endif
1708	case VMMDevReq_HGCMCall32:
1709	{
1710	VMMDevHGCMCall pHGCMCall = (VMMDevHGCMCall )pHeader;
1711	rc = vmmdevR3HgcmCompleteCallRequest(pDevIns, pCmd, pHGCMCall, (uint8_t *)pHeader);
1712	#ifdef VBOX_WITH_DTRACE
1713	idFunction = pCmd->u.call.u32Function;
1714	idClient = pCmd->u.call.u32ClientID;
1715	#endif
1716	break;
1717	}
1718
1719	case VMMDevReq_HGCMConnect:
1720	{
1721	/* save the client id in the guest request packet */
1722	VMMDevHGCMConnect pHGCMConnect = (VMMDevHGCMConnect )pHeader;
1723	pHGCMConnect->u32ClientID = pCmd->u.connect.u32ClientID;
1724	break;
1725	}
1726
1727	default:
1728	/* make compiler happy */
1729	break;
1730	}
1731	}
1732	else
1733	{
1734	/* Guest has changed the command type. */
1735	LogRelMax(50, ("VMMDEV: Invalid HGCM command: pCmd->enmCmdType = 0x%08X, pHeader->header.requestType = 0x%08X\n",
1736	pCmd->enmCmdType, pHeader->header.requestType));
1737
1738	ASSERT_GUEST_FAILED_STMT(rc = VERR_INVALID_PARAMETER);
1739	}
1740
1741	/* Setup return code for the guest. */
1742	if (RT_SUCCESS(rc))
1743	pHeader->result = result;
1744	else
1745	pHeader->result = rc;
1746
1747	/* First write back the request. */
1748	PDMDevHlpPhysWrite(pDevIns, pCmd->GCPhys, pHeader, pCmd->cbRequest);
1749
1750	/* Mark request as processed. */
1751	pHeader->fu32Flags \|= VBOX_HGCM_REQ_DONE;
1752
1753	/* Second write the flags to mark the request as processed. */
1754	PDMDevHlpPhysWrite(pDevIns, pCmd->GCPhys + RT_UOFFSETOF(VMMDevHGCMRequestHeader, fu32Flags),
1755	&pHeader->fu32Flags, sizeof(pHeader->fu32Flags));
1756
1757	/* Now, when the command was removed from the internal list, notify the guest. */
1758	VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_HGCM);
1759
1760	RTMemFreeZ(pHeader, pCmd->cbRequest);
1761	}
1762	else
1763	{
1764	LogRelMax(10, ("VMMDev: Failed to allocate %u bytes for HGCM request completion!!!\n", pCmd->cbRequest));
1765	}
1766	}
1767	/*
1768	* Request was locked:
1769	*/
1770	else
1771	{
1772	VMMDevHGCMRequestHeader volatile pHeader = (VMMDevHGCMRequestHeader volatile )pCmd->pvReqLocked;
1773
1774	/* Verify the request type. This is the only field which is used from the guest memory. */
1775	const VMMDevRequestType enmRequestType = pHeader->header.requestType;
1776	if ( enmRequestType == pCmd->enmRequestType
1777	\|\| enmRequestType == VMMDevReq_HGCMCancel)
1778	{
1779	RT_UNTRUSTED_VALIDATED_FENCE();
1780
1781	/*
1782	* Update parameters and data buffers.
1783	*/
1784	switch (enmRequestType)
1785	{
1786	#ifdef VBOX_WITH_64_BITS_GUESTS
1787	case VMMDevReq_HGCMCall64:
1788	#endif
1789	case VMMDevReq_HGCMCall32:
1790	{
1791	VMMDevHGCMCall pHGCMCall = (VMMDevHGCMCall )pHeader;
1792	rc = vmmdevR3HgcmCompleteCallRequest(pDevIns, pCmd, pHGCMCall, (uint8_t *)pHeader);
1793	#ifdef VBOX_WITH_DTRACE
1794	idFunction = pCmd->u.call.u32Function;
1795	idClient = pCmd->u.call.u32ClientID;
1796	#endif
1797	break;
1798	}
1799
1800	case VMMDevReq_HGCMConnect:
1801	{
1802	/* save the client id in the guest request packet */
1803	VMMDevHGCMConnect pHGCMConnect = (VMMDevHGCMConnect )pHeader;
1804	pHGCMConnect->u32ClientID = pCmd->u.connect.u32ClientID;
1805	break;
1806	}
1807
1808	default:
1809	/* make compiler happy */
1810	break;
1811	}
1812	}
1813	else
1814	{
1815	/* Guest has changed the command type. */
1816	LogRelMax(50, ("VMMDEV: Invalid HGCM command: pCmd->enmCmdType = 0x%08X, pHeader->header.requestType = 0x%08X\n",
1817	pCmd->enmCmdType, pHeader->header.requestType));
1818
1819	ASSERT_GUEST_FAILED_STMT(rc = VERR_INVALID_PARAMETER);
1820	}
1821
1822	/* Setup return code for the guest. */
1823	if (RT_SUCCESS(rc))
1824	pHeader->result = result;
1825	else
1826	pHeader->result = rc;
1827
1828	/* Mark request as processed. */
1829	ASMAtomicOrU32(&pHeader->fu32Flags, VBOX_HGCM_REQ_DONE);
1830
1831	/* Now, when the command was removed from the internal list, notify the guest. */
1832	VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_HGCM);
1833	}
1834
1835	/* Set the status to success for now, though we might consider passing
1836	along the vmmdevR3HgcmCompleteCallRequest errors... */
1837	rc = VINF_SUCCESS;
1838	}
1839	else
1840	{
1841	LogFlowFunc(("Cancelled command %p\n", pCmd));
1842	rc = VERR_CANCELLED;
1843	}
1844
1845	#ifndef VBOX_WITHOUT_RELEASE_STATISTICS
1846	/* Save for final stats. */
1847	uint64_t const tsArrival = pCmd->tsArrival;
1848	uint64_t const tsComplete = pCmd->tsComplete;
1849	#endif
1850
1851	/* Deallocate the command memory. Enter the critsect for proper */
1852	VBOXDD_HGCMCALL_COMPLETED_DONE(pCmd, idFunction, idClient, result);
1853	vmmdevR3HgcmCmdFree(pDevIns, pThis, pThisCC, pCmd);
1854
1855	#ifndef VBOX_WITHOUT_RELEASE_STATISTICS
1856	/* Update stats. */
1857	uint64_t tsNow;
1858	STAM_GET_TS(tsNow);
1859	STAM_REL_PROFILE_ADD_PERIOD(&pThisCC->StatHgcmCmdCompletion, tsNow - tsComplete);
1860	if (tsArrival != 0)
1861	STAM_REL_PROFILE_ADD_PERIOD(&pThisCC->StatHgcmCmdTotal, tsNow - tsArrival);
1862	#endif
1863
1864	return rc;
1865	}
1866
1867	/**
1868	* HGCM callback for request completion. Forwards to hgcmCompletedWorker.
1869	*
1870	* @returns VINF_SUCCESS or VERR_CANCELLED.
1871	* @param pInterface Pointer to this PDM interface.
1872	* @param result HGCM completion status code (VBox status code).
1873	* @param pCmd Completed command, which contains updated host parameters.
1874	*/
1875	DECLCALLBACK(int) hgcmR3Completed(PPDMIHGCMPORT pInterface, int32_t result, PVBOXHGCMCMD pCmd)
1876	{
1877	#if 0 /* This seems to be significantly slower. Half of MsgTotal time seems to be spend here. */
1878	PVMMDEVCC pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IHGCMPort);
1879	STAM_GET_TS(pCmd->tsComplete);
1880
1881	VBOXDD_HGCMCALL_COMPLETED_REQ(pCmd, result);
1882
1883	/** @todo no longer necessary to forward to EMT, but it might be more
1884	* efficient...? */
1885	/* Not safe to execute asynchronously; forward to EMT */
1886	int rc = VMR3ReqCallVoidNoWait(PDMDevHlpGetVM(pDevIns), VMCPUID_ANY,
1887	(PFNRT)hgcmCompletedWorker, 3, pInterface, result, pCmd);
1888	AssertRC(rc);
1889	return VINF_SUCCESS; /* cannot tell if canceled or not... */
1890	#else
1891	STAM_GET_TS(pCmd->tsComplete);
1892	VBOXDD_HGCMCALL_COMPLETED_REQ(pCmd, result);
1893	return hgcmCompletedWorker(pInterface, result, pCmd);
1894	#endif
1895	}
1896
1897	/**
1898	* @interface_method_impl{PDMIHGCMPORT,pfnIsCmdRestored}
1899	*/
1900	DECLCALLBACK(bool) hgcmR3IsCmdRestored(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd)
1901	{
1902	RT_NOREF(pInterface);
1903	return pCmd && pCmd->fRestored;
1904	}
1905
1906	/**
1907	* @interface_method_impl{PDMIHGCMPORT,pfnIsCmdCancelled}
1908	*/
1909	DECLCALLBACK(bool) hgcmR3IsCmdCancelled(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd)
1910	{
1911	RT_NOREF(pInterface);
1912	return pCmd && pCmd->fCancelled;
1913	}
1914
1915	/**
1916	* @interface_method_impl{PDMIHGCMPORT,pfnGetRequestor}
1917	*/
1918	DECLCALLBACK(uint32_t) hgcmR3GetRequestor(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd)
1919	{
1920	PVMMDEVCC pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IHGCMPort);
1921	PVMMDEV pThis = PDMDEVINS_2_DATA(pThisCC->pDevIns, PVMMDEV);
1922	AssertPtrReturn(pCmd, VMMDEV_REQUESTOR_LOWEST);
1923	if (pThis->guestInfo2.fFeatures & VBOXGSTINFO2_F_REQUESTOR_INFO)
1924	return pCmd->fRequestor;
1925	return VMMDEV_REQUESTOR_LEGACY;
1926	}
1927
1928	/**
1929	* @interface_method_impl{PDMIHGCMPORT,pfnGetVMMDevSessionId}
1930	*/
1931	DECLCALLBACK(uint64_t) hgcmR3GetVMMDevSessionId(PPDMIHGCMPORT pInterface)
1932	{
1933	PVMMDEVCC pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IHGCMPort);
1934	PVMMDEV pThis = PDMDEVINS_2_DATA(pThisCC->pDevIns, PVMMDEV);
1935	return pThis->idSession;
1936	}
1937
1938	/** Save information about pending HGCM requests from pThisCC->listHGCMCmd.
1939	*
1940	* @returns VBox status code that the guest should see.
1941	* @param pThisCC The VMMDev ring-3 instance data.
1942	* @param pSSM SSM handle for SSM functions.
1943	*
1944	* @thread EMT
1945	*/
1946	int vmmdevR3HgcmSaveState(PVMMDEVCC pThisCC, PSSMHANDLE pSSM)
1947	{
1948	PCPDMDEVHLPR3 pHlp = pThisCC->pDevIns->pHlpR3;
1949
1950	LogFlowFunc(("\n"));
1951
1952	/* Compute how many commands are pending. */
1953	uint32_t cCmds = 0;
1954	PVBOXHGCMCMD pCmd;
1955	RTListForEach(&pThisCC->listHGCMCmd, pCmd, VBOXHGCMCMD, node)
1956	{
1957	LogFlowFunc(("pCmd %p\n", pCmd));
1958	++cCmds;
1959	}
1960	LogFlowFunc(("cCmds = %d\n", cCmds));
1961
1962	/* Save number of commands. */
1963	int rc = pHlp->pfnSSMPutU32(pSSM, cCmds);
1964	AssertRCReturn(rc, rc);
1965
1966	if (cCmds > 0)
1967	{
1968	RTListForEach(&pThisCC->listHGCMCmd, pCmd, VBOXHGCMCMD, node)
1969	{
1970	LogFlowFunc(("Saving %RGp, size %d\n", pCmd->GCPhys, pCmd->cbRequest));
1971
1972	/** @todo Don't save cancelled requests! It serves no purpose. See restore and
1973	* @bugref{4032#c4} for details. */
1974	pHlp->pfnSSMPutU32 (pSSM, (uint32_t)pCmd->enmCmdType);
1975	pHlp->pfnSSMPutBool (pSSM, pCmd->fCancelled);
1976	pHlp->pfnSSMPutGCPhys (pSSM, pCmd->GCPhys);
1977	pHlp->pfnSSMPutU32 (pSSM, pCmd->cbRequest);
1978	pHlp->pfnSSMPutU32 (pSSM, (uint32_t)pCmd->enmRequestType);
1979	const uint32_t cParms = pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL ? pCmd->u.call.cParms : 0;
1980	rc = pHlp->pfnSSMPutU32(pSSM, cParms);
1981	AssertRCReturn(rc, rc);
1982
1983	if (pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL)
1984	{
1985	pHlp->pfnSSMPutU32 (pSSM, pCmd->u.call.u32ClientID);
1986	rc = pHlp->pfnSSMPutU32(pSSM, pCmd->u.call.u32Function);
1987	AssertRCReturn(rc, rc);
1988
1989	/* Guest parameters. */
1990	uint32_t i;
1991	for (i = 0; i < pCmd->u.call.cParms; ++i)
1992	{
1993	VBOXHGCMGUESTPARM * const pGuestParm = &pCmd->u.call.paGuestParms[i];
1994
1995	rc = pHlp->pfnSSMPutU32(pSSM, (uint32_t)pGuestParm->enmType);
1996	AssertRCReturn(rc, rc);
1997
1998	if ( pGuestParm->enmType == VMMDevHGCMParmType_32bit
1999	\|\| pGuestParm->enmType == VMMDevHGCMParmType_64bit)
2000	{
2001	const VBOXHGCMPARMVAL * const pVal = &pGuestParm->u.val;
2002	pHlp->pfnSSMPutU64 (pSSM, pVal->u64Value);
2003	pHlp->pfnSSMPutU32 (pSSM, pVal->offValue);
2004	rc = pHlp->pfnSSMPutU32(pSSM, pVal->cbValue);
2005	}
2006	else if ( pGuestParm->enmType == VMMDevHGCMParmType_LinAddr_In
2007	\|\| pGuestParm->enmType == VMMDevHGCMParmType_LinAddr_Out
2008	\|\| pGuestParm->enmType == VMMDevHGCMParmType_LinAddr
2009	\|\| pGuestParm->enmType == VMMDevHGCMParmType_PageList
2010	\|\| pGuestParm->enmType == VMMDevHGCMParmType_Embedded
2011	\|\| pGuestParm->enmType == VMMDevHGCMParmType_ContiguousPageList)
2012	{
2013	const VBOXHGCMPARMPTR * const pPtr = &pGuestParm->u.ptr;
2014	pHlp->pfnSSMPutU32 (pSSM, pPtr->cbData);
2015	pHlp->pfnSSMPutU32 (pSSM, pPtr->offFirstPage);
2016	pHlp->pfnSSMPutU32 (pSSM, pPtr->cPages);
2017	rc = pHlp->pfnSSMPutU32(pSSM, pPtr->fu32Direction);
2018
2019	uint32_t iPage;
2020	for (iPage = 0; RT_SUCCESS(rc) && iPage < pPtr->cPages; ++iPage)
2021	rc = pHlp->pfnSSMPutGCPhys(pSSM, pPtr->paPages[iPage]);
2022	}
2023	else if (pGuestParm->enmType == VMMDevHGCMParmType_NoBouncePageList)
2024	{
2025	/* We don't have the page addresses here, so it will need to be
2026	restored from guest memory. This isn't an issue as it is only
2027	use with services which won't survive a save/restore anyway. */
2028	}
2029	else
2030	{
2031	AssertFailedStmt(rc = VERR_INTERNAL_ERROR);
2032	}
2033	AssertRCReturn(rc, rc);
2034	}
2035	}
2036	else if (pCmd->enmCmdType == VBOXHGCMCMDTYPE_CONNECT)
2037	{
2038	pHlp->pfnSSMPutU32(pSSM, pCmd->u.connect.u32ClientID);
2039	pHlp->pfnSSMPutMem(pSSM, pCmd->u.connect.pLoc, sizeof(*pCmd->u.connect.pLoc));
2040	}
2041	else if (pCmd->enmCmdType == VBOXHGCMCMDTYPE_DISCONNECT)
2042	{
2043	pHlp->pfnSSMPutU32(pSSM, pCmd->u.disconnect.u32ClientID);
2044	}
2045	else
2046	{
2047	AssertFailedReturn(VERR_INTERNAL_ERROR);
2048	}
2049
2050	/* A reserved field, will allow to extend saved data for a command. */
2051	rc = pHlp->pfnSSMPutU32(pSSM, 0);
2052	AssertRCReturn(rc, rc);
2053	}
2054	}
2055
2056	/* A reserved field, will allow to extend saved data for VMMDevHGCM. */
2057	rc = pHlp->pfnSSMPutU32(pSSM, 0);
2058	AssertRCReturn(rc, rc);
2059
2060	return rc;
2061	}
2062
2063	/** Load information about pending HGCM requests.
2064	*
2065	* Allocate VBOXHGCMCMD commands and add them to pThisCC->listHGCMCmd
2066	* temporarily. vmmdevR3HgcmLoadStateDone will process the temporary list. This
2067	* includes loading the correct fRequestor fields.
2068	*
2069	* @returns VBox status code that the guest should see.
2070	* @param pDevIns The device instance.
2071	* @param pThis The VMMDev shared instance data.
2072	* @param pThisCC The VMMDev ring-3 instance data.
2073	* @param pSSM SSM handle for SSM functions.
2074	* @param uVersion Saved state version.
2075	*
2076	* @thread EMT
2077	*/
2078	int vmmdevR3HgcmLoadState(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, PSSMHANDLE pSSM, uint32_t uVersion)
2079	{
2080	PCPDMDEVHLPR3 pHlp = pDevIns->pHlpR3;
2081
2082	LogFlowFunc(("\n"));
2083
2084	pThisCC->uSavedStateVersion = uVersion; /* For vmmdevR3HgcmLoadStateDone */
2085
2086	/* Read how many commands were pending. */
2087	uint32_t cCmds = 0;
2088	int rc = pHlp->pfnSSMGetU32(pSSM, &cCmds);
2089	AssertRCReturn(rc, rc);
2090
2091	LogFlowFunc(("cCmds = %d\n", cCmds));
2092
2093	if (uVersion >= VMMDEV_SAVED_STATE_VERSION_HGCM_PARAMS)
2094	{
2095	/* Saved information about all HGCM parameters. */
2096	uint32_t u32;
2097
2098	uint32_t iCmd;
2099	for (iCmd = 0; iCmd < cCmds; ++iCmd)
2100	{
2101	/* Command fields. */
2102	VBOXHGCMCMDTYPE enmCmdType;
2103	bool fCancelled;
2104	RTGCPHYS GCPhys;
2105	uint32_t cbRequest;
2106	VMMDevRequestType enmRequestType;
2107	uint32_t cParms;
2108
2109	pHlp->pfnSSMGetU32 (pSSM, &u32);
2110	enmCmdType = (VBOXHGCMCMDTYPE)u32;
2111	pHlp->pfnSSMGetBool (pSSM, &fCancelled);
2112	pHlp->pfnSSMGetGCPhys (pSSM, &GCPhys);
2113	pHlp->pfnSSMGetU32 (pSSM, &cbRequest);
2114	pHlp->pfnSSMGetU32 (pSSM, &u32);
2115	enmRequestType = (VMMDevRequestType)u32;
2116	rc = pHlp->pfnSSMGetU32(pSSM, &cParms);
2117	AssertRCReturn(rc, rc);
2118
2119	PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, enmCmdType, GCPhys, cbRequest, cParms, 0 /fRequestor/);
2120	AssertReturn(pCmd, VERR_NO_MEMORY);
2121
2122	pCmd->fCancelled = fCancelled;
2123	pCmd->GCPhys = GCPhys;
2124	pCmd->cbRequest = cbRequest;
2125	pCmd->enmRequestType = enmRequestType;
2126
2127	if (enmCmdType == VBOXHGCMCMDTYPE_CALL)
2128	{
2129	pHlp->pfnSSMGetU32 (pSSM, &pCmd->u.call.u32ClientID);
2130	rc = pHlp->pfnSSMGetU32(pSSM, &pCmd->u.call.u32Function);
2131	AssertRCReturn(rc, rc);
2132
2133	/* Guest parameters. */
2134	uint32_t i;
2135	for (i = 0; i < cParms; ++i)
2136	{
2137	VBOXHGCMGUESTPARM * const pGuestParm = &pCmd->u.call.paGuestParms[i];
2138
2139	rc = pHlp->pfnSSMGetU32(pSSM, &u32);
2140	AssertRCReturn(rc, rc);
2141	pGuestParm->enmType = (HGCMFunctionParameterType)u32;
2142
2143	if ( pGuestParm->enmType == VMMDevHGCMParmType_32bit
2144	\|\| pGuestParm->enmType == VMMDevHGCMParmType_64bit)
2145	{
2146	VBOXHGCMPARMVAL * const pVal = &pGuestParm->u.val;
2147	pHlp->pfnSSMGetU64 (pSSM, &pVal->u64Value);
2148	pHlp->pfnSSMGetU32 (pSSM, &pVal->offValue);
2149	rc = pHlp->pfnSSMGetU32(pSSM, &pVal->cbValue);
2150	}
2151	else if ( pGuestParm->enmType == VMMDevHGCMParmType_LinAddr_In
2152	\|\| pGuestParm->enmType == VMMDevHGCMParmType_LinAddr_Out
2153	\|\| pGuestParm->enmType == VMMDevHGCMParmType_LinAddr
2154	\|\| pGuestParm->enmType == VMMDevHGCMParmType_PageList
2155	\|\| pGuestParm->enmType == VMMDevHGCMParmType_Embedded
2156	\|\| pGuestParm->enmType == VMMDevHGCMParmType_ContiguousPageList)
2157	{
2158	VBOXHGCMPARMPTR * const pPtr = &pGuestParm->u.ptr;
2159	pHlp->pfnSSMGetU32 (pSSM, &pPtr->cbData);
2160	pHlp->pfnSSMGetU32 (pSSM, &pPtr->offFirstPage);
2161	pHlp->pfnSSMGetU32 (pSSM, &pPtr->cPages);
2162	rc = pHlp->pfnSSMGetU32(pSSM, &pPtr->fu32Direction);
2163	if (RT_SUCCESS(rc))
2164	{
2165	if (pPtr->cPages == 1)
2166	pPtr->paPages = &pPtr->GCPhysSinglePage;
2167	else
2168	{
2169	AssertReturn( pGuestParm->enmType != VMMDevHGCMParmType_Embedded
2170	&& pGuestParm->enmType != VMMDevHGCMParmType_ContiguousPageList, VERR_INTERNAL_ERROR_3);
2171	pPtr->paPages = (RTGCPHYS *)vmmdevR3HgcmCallMemAlloc(pThisCC, pCmd,
2172	pPtr->cPages * sizeof(RTGCPHYS));
2173	AssertStmt(pPtr->paPages, rc = VERR_NO_MEMORY);
2174	}
2175
2176	if (RT_SUCCESS(rc))
2177	{
2178	uint32_t iPage;
2179	for (iPage = 0; iPage < pPtr->cPages; ++iPage)
2180	rc = pHlp->pfnSSMGetGCPhys(pSSM, &pPtr->paPages[iPage]);
2181	}
2182	}
2183	}
2184	else if (pGuestParm->enmType == VMMDevHGCMParmType_NoBouncePageList)
2185	{
2186	/* This request type can only be stored from guest memory for now. */
2187	pCmd->fRestoreFromGuestMem = true;
2188	}
2189	else
2190	{
2191	AssertFailedStmt(rc = VERR_INTERNAL_ERROR);
2192	}
2193	AssertRCReturn(rc, rc);
2194	}
2195	}
2196	else if (enmCmdType == VBOXHGCMCMDTYPE_CONNECT)
2197	{
2198	pHlp->pfnSSMGetU32(pSSM, &pCmd->u.connect.u32ClientID);
2199	rc = pHlp->pfnSSMGetMem(pSSM, pCmd->u.connect.pLoc, sizeof(*pCmd->u.connect.pLoc));
2200	AssertRCReturn(rc, rc);
2201	}
2202	else if (enmCmdType == VBOXHGCMCMDTYPE_DISCONNECT)
2203	{
2204	rc = pHlp->pfnSSMGetU32(pSSM, &pCmd->u.disconnect.u32ClientID);
2205	AssertRCReturn(rc, rc);
2206	}
2207	else
2208	{
2209	AssertFailedReturn(VERR_INTERNAL_ERROR);
2210	}
2211
2212	/* A reserved field, will allow to extend saved data for a command. */
2213	rc = pHlp->pfnSSMGetU32(pSSM, &u32);
2214	AssertRCReturn(rc, rc);
2215
2216	/*
2217	* Do not restore cancelled calls. Why do we save them to start with?
2218	*
2219	* The guest memory no longer contains a valid request! So, it is not
2220	* possible to restore it. The memory is often reused for a new request
2221	* by now and we will end up trying to complete that more than once if
2222	* we restore a cancelled call. In some cases VERR_HGCM_INVALID_CLIENT_ID
2223	* is returned, though it might just be silent memory corruption.
2224	*/
2225	/* See current version above. */
2226	if (!fCancelled)
2227	vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
2228	else
2229	{
2230	Log(("vmmdevR3HgcmLoadState: Skipping cancelled request: enmCmdType=%d GCPhys=%#RX32 LB %#x\n",
2231	enmCmdType, GCPhys, cbRequest));
2232	vmmdevR3HgcmCmdFree(pDevIns, pThis, pThisCC, pCmd);
2233	}
2234	}
2235
2236	/* A reserved field, will allow to extend saved data for VMMDevHGCM. */
2237	rc = pHlp->pfnSSMGetU32(pSSM, &u32);
2238	AssertRCReturn(rc, rc);
2239	}
2240	else if (uVersion >= 9)
2241	{
2242	/* Version 9+: Load information about commands. Pre-rewrite. */
2243	uint32_t u32;
2244
2245	uint32_t iCmd;
2246	for (iCmd = 0; iCmd < cCmds; ++iCmd)
2247	{
2248	VBOXHGCMCMDTYPE enmCmdType;
2249	bool fCancelled;
2250	RTGCPHYS GCPhys;
2251	uint32_t cbRequest;
2252	uint32_t cLinAddrs;
2253
2254	pHlp->pfnSSMGetGCPhys (pSSM, &GCPhys);
2255	rc = pHlp->pfnSSMGetU32(pSSM, &cbRequest);
2256	AssertRCReturn(rc, rc);
2257
2258	LogFlowFunc(("Restoring %RGp size %x bytes\n", GCPhys, cbRequest));
2259
2260	/* For uVersion <= 12, this was the size of entire command.
2261	* Now the command is reconstructed in vmmdevR3HgcmLoadStateDone.
2262	*/
2263	if (uVersion <= 12)
2264	pHlp->pfnSSMSkip(pSSM, sizeof (uint32_t));
2265
2266	pHlp->pfnSSMGetU32 (pSSM, &u32);
2267	enmCmdType = (VBOXHGCMCMDTYPE)u32;
2268	pHlp->pfnSSMGetBool (pSSM, &fCancelled);
2269	/* How many linear pointers. Always 0 if not a call command. */
2270	rc = pHlp->pfnSSMGetU32(pSSM, &cLinAddrs);
2271	AssertRCReturn(rc, rc);
2272
2273	PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, enmCmdType, GCPhys, cbRequest, cLinAddrs, 0 /fRequestor/);
2274	AssertReturn(pCmd, VERR_NO_MEMORY);
2275
2276	pCmd->fCancelled = fCancelled;
2277	pCmd->GCPhys = GCPhys;
2278	pCmd->cbRequest = cbRequest;
2279
2280	if (cLinAddrs > 0)
2281	{
2282	/* Skip number of pages for all LinAddrs in this command. */
2283	pHlp->pfnSSMSkip(pSSM, sizeof(uint32_t));
2284
2285	uint32_t i;
2286	for (i = 0; i < cLinAddrs; ++i)
2287	{
2288	VBOXHGCMPARMPTR * const pPtr = &pCmd->u.call.paGuestParms[i].u.ptr;
2289
2290	/* Index of the parameter. Use cbData field to store the index. */
2291	pHlp->pfnSSMGetU32 (pSSM, &pPtr->cbData);
2292	pHlp->pfnSSMGetU32 (pSSM, &pPtr->offFirstPage);
2293	rc = pHlp->pfnSSMGetU32(pSSM, &pPtr->cPages);
2294	AssertRCReturn(rc, rc);
2295
2296	pPtr->paPages = (RTGCPHYS )vmmdevR3HgcmCallMemAlloc(pThisCC, pCmd, pPtr->cPages sizeof(RTGCPHYS));
2297	AssertReturn(pPtr->paPages, VERR_NO_MEMORY);
2298
2299	uint32_t iPage;
2300	for (iPage = 0; iPage < pPtr->cPages; ++iPage)
2301	rc = pHlp->pfnSSMGetGCPhys(pSSM, &pPtr->paPages[iPage]);
2302	}
2303	}
2304
2305	/* A reserved field, will allow to extend saved data for a command. */
2306	rc = pHlp->pfnSSMGetU32(pSSM, &u32);
2307	AssertRCReturn(rc, rc);
2308
2309	/* See current version above. */
2310	if (!fCancelled)
2311	vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
2312	else
2313	{
2314	Log(("vmmdevR3HgcmLoadState: Skipping cancelled request: enmCmdType=%d GCPhys=%#RX32 LB %#x\n",
2315	enmCmdType, GCPhys, cbRequest));
2316	vmmdevR3HgcmCmdFree(pDevIns, pThis, pThisCC, pCmd);
2317	}
2318	}
2319
2320	/* A reserved field, will allow to extend saved data for VMMDevHGCM. */
2321	rc = pHlp->pfnSSMGetU32(pSSM, &u32);
2322	AssertRCReturn(rc, rc);
2323	}
2324	else
2325	{
2326	/* Ancient. Only the guest physical address is saved. */
2327	uint32_t iCmd;
2328	for (iCmd = 0; iCmd < cCmds; ++iCmd)
2329	{
2330	RTGCPHYS GCPhys;
2331	uint32_t cbRequest;
2332
2333	pHlp->pfnSSMGetGCPhys(pSSM, &GCPhys);
2334	rc = pHlp->pfnSSMGetU32(pSSM, &cbRequest);
2335	AssertRCReturn(rc, rc);
2336
2337	LogFlowFunc(("Restoring %RGp size %x bytes\n", GCPhys, cbRequest));
2338
2339	PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, VBOXHGCMCMDTYPE_LOADSTATE, GCPhys, cbRequest, 0, 0 /fRequestor/);
2340	AssertReturn(pCmd, VERR_NO_MEMORY);
2341
2342	vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
2343	}
2344	}
2345
2346	return rc;
2347	}
2348
2349	/** Restore HGCM connect command loaded from old saved state.
2350	*
2351	* @returns VBox status code that the guest should see.
2352	* @param pThisCC The VMMDev ring-3 instance data.
2353	* @param uSavedStateVersion The saved state version the command has been loaded from.
2354	* @param pLoadedCmd Command loaded from saved state, it is imcomplete and needs restoration.
2355	* @param pReq The guest request (cached in host memory).
2356	* @param cbReq Size of the guest request.
2357	* @param enmRequestType Type of the HGCM request.
2358	* @param ppRestoredCmd Where to store pointer to newly allocated restored command.
2359	*/
2360	static int vmmdevR3HgcmRestoreConnect(PVMMDEVCC pThisCC, uint32_t uSavedStateVersion, const VBOXHGCMCMD *pLoadedCmd,
2361	VMMDevHGCMConnect *pReq, uint32_t cbReq, VMMDevRequestType enmRequestType,
2362	VBOXHGCMCMD **ppRestoredCmd)
2363	{
2364	/* Verify the request. */
2365	ASSERT_GUEST_RETURN(cbReq >= sizeof(*pReq), VERR_MISMATCH);
2366	if (uSavedStateVersion >= 9)
2367	ASSERT_GUEST_RETURN(pLoadedCmd->enmCmdType == VBOXHGCMCMDTYPE_CONNECT, VERR_MISMATCH);
2368
2369	PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, VBOXHGCMCMDTYPE_CONNECT, pLoadedCmd->GCPhys, cbReq, 0,
2370	pReq->header.header.fRequestor);
2371	AssertReturn(pCmd, VERR_NO_MEMORY);
2372
2373	Assert(pLoadedCmd->fCancelled == false);
2374	pCmd->fCancelled = false;
2375	pCmd->fRestored = true;
2376	pCmd->enmRequestType = enmRequestType;
2377
2378	vmmdevR3HgcmConnectFetch(pReq, pCmd);
2379
2380	*ppRestoredCmd = pCmd;
2381	return VINF_SUCCESS;
2382	}
2383
2384	/** Restore HGCM disconnect command loaded from old saved state.
2385	*
2386	* @returns VBox status code that the guest should see.
2387	* @param pThisCC The VMMDev ring-3 instance data.
2388	* @param uSavedStateVersion The saved state version the command has been loaded from.
2389	* @param pLoadedCmd Command loaded from saved state, it is imcomplete and needs restoration.
2390	* @param pReq The guest request (cached in host memory).
2391	* @param cbReq Size of the guest request.
2392	* @param enmRequestType Type of the HGCM request.
2393	* @param ppRestoredCmd Where to store pointer to newly allocated restored command.
2394	*/
2395	static int vmmdevR3HgcmRestoreDisconnect(PVMMDEVCC pThisCC, uint32_t uSavedStateVersion, const VBOXHGCMCMD *pLoadedCmd,
2396	VMMDevHGCMDisconnect *pReq, uint32_t cbReq, VMMDevRequestType enmRequestType,
2397	VBOXHGCMCMD **ppRestoredCmd)
2398	{
2399	/* Verify the request. */
2400	ASSERT_GUEST_RETURN(cbReq >= sizeof(*pReq), VERR_MISMATCH);
2401	if (uSavedStateVersion >= 9)
2402	ASSERT_GUEST_RETURN(pLoadedCmd->enmCmdType == VBOXHGCMCMDTYPE_DISCONNECT, VERR_MISMATCH);
2403
2404	PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, VBOXHGCMCMDTYPE_DISCONNECT, pLoadedCmd->GCPhys, cbReq, 0,
2405	pReq->header.header.fRequestor);
2406	AssertReturn(pCmd, VERR_NO_MEMORY);
2407
2408	Assert(pLoadedCmd->fCancelled == false);
2409	pCmd->fCancelled = false;
2410	pCmd->fRestored = true;
2411	pCmd->enmRequestType = enmRequestType;
2412
2413	vmmdevR3HgcmDisconnectFetch(pReq, pCmd);
2414
2415	*ppRestoredCmd = pCmd;
2416	return VINF_SUCCESS;
2417	}
2418
2419	/** Restore HGCM call command loaded from old saved state.
2420	*
2421	* @returns VBox status code that the guest should see.
2422	* @param pDevIns The device instance.
2423	* @param pThis The VMMDev shared instance data.
2424	* @param pThisCC The VMMDev ring-3 instance data.
2425	* @param uSavedStateVersion The saved state version the command has been loaded from.
2426	* @param pLoadedCmd Command loaded from saved state, it is imcomplete and needs restoration.
2427	* @param pReq The guest request (cached in host memory).
2428	* @param cbReq Size of the guest request.
2429	* @param enmRequestType Type of the HGCM request.
2430	* @param ppRestoredCmd Where to store pointer to newly allocated restored command.
2431	*/
2432	static int vmmdevR3HgcmRestoreCall(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, uint32_t uSavedStateVersion,
2433	const VBOXHGCMCMD pLoadedCmd, VMMDevHGCMCall pReq, uint32_t cbReq,
2434	VMMDevRequestType enmRequestType, VBOXHGCMCMD **ppRestoredCmd)
2435	{
2436	/* Verify the request. */
2437	ASSERT_GUEST_RETURN(cbReq >= sizeof(*pReq), VERR_MISMATCH);
2438	if (uSavedStateVersion >= 9)
2439	{
2440	ASSERT_GUEST_RETURN(pLoadedCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL, VERR_MISMATCH);
2441	Assert(pLoadedCmd->fCancelled == false);
2442	}
2443
2444	PVBOXHGCMCMD pCmd;
2445	uint32_t cbHGCMParmStruct;
2446	int rc = vmmdevR3HgcmCallAlloc(pThisCC, pReq, cbReq, pLoadedCmd->GCPhys, enmRequestType, &pCmd, &cbHGCMParmStruct);
2447	if (RT_FAILURE(rc))
2448	return rc;
2449
2450	/* pLoadedCmd is fake, it does not contain actual call parameters. Only pagelists for LinAddr. */
2451	pCmd->fCancelled = false;
2452	pCmd->fRestored = true;
2453	pCmd->enmRequestType = enmRequestType;
2454
2455	rc = vmmdevR3HgcmCallFetchGuestParms(pDevIns, pThisCC, pCmd, pReq, cbReq, enmRequestType, cbHGCMParmStruct);
2456	if (RT_SUCCESS(rc))
2457	{
2458	/* Update LinAddr parameters from pLoadedCmd.
2459	* pLoadedCmd->u.call.cParms is actually the number of LinAddrs, see vmmdevR3HgcmLoadState.
2460	*/
2461	uint32_t iLinAddr;
2462	for (iLinAddr = 0; iLinAddr < pLoadedCmd->u.call.cParms; ++iLinAddr)
2463	{
2464	VBOXHGCMGUESTPARM * const pLoadedParm = &pLoadedCmd->u.call.paGuestParms[iLinAddr];
2465	/* pLoadedParm->cbData is actually index of the LinAddr parameter, see vmmdevR3HgcmLoadState. */
2466	const uint32_t iParm = pLoadedParm->u.ptr.cbData;
2467	ASSERT_GUEST_STMT_BREAK(iParm < pCmd->u.call.cParms, rc = VERR_MISMATCH);
2468
2469	VBOXHGCMGUESTPARM * const pGuestParm = &pCmd->u.call.paGuestParms[iParm];
2470	ASSERT_GUEST_STMT_BREAK( pGuestParm->enmType == VMMDevHGCMParmType_LinAddr_In
2471	\|\| pGuestParm->enmType == VMMDevHGCMParmType_LinAddr_Out
2472	\|\| pGuestParm->enmType == VMMDevHGCMParmType_LinAddr,
2473	rc = VERR_MISMATCH);
2474	ASSERT_GUEST_STMT_BREAK( pLoadedParm->u.ptr.offFirstPage == pGuestParm->u.ptr.offFirstPage
2475	&& pLoadedParm->u.ptr.cPages == pGuestParm->u.ptr.cPages,
2476	rc = VERR_MISMATCH);
2477	memcpy(pGuestParm->u.ptr.paPages, pLoadedParm->u.ptr.paPages, pGuestParm->u.ptr.cPages * sizeof(RTGCPHYS));
2478	}
2479	}
2480
2481	if (RT_SUCCESS(rc))
2482	*ppRestoredCmd = pCmd;
2483	else
2484	vmmdevR3HgcmCmdFree(pDevIns, pThis, pThisCC, pCmd);
2485
2486	return rc;
2487	}
2488
2489	/** Allocate and initialize a HGCM command using the given request (pReqHdr)
2490	* and command loaded from saved state (pCmd).
2491	*
2492	* @returns VBox status code that the guest should see.
2493	* @param pDevIns The device instance.
2494	* @param pThis The VMMDev shared instance data.
2495	* @param pThisCC The VMMDev ring-3 instance data.
2496	* @param uSavedStateVersion Saved state version.
2497	* @param pLoadedCmd HGCM command which needs restoration.
2498	* @param pReqHdr The request (cached in host memory).
2499	* @param cbReq Size of the entire request (including HGCM parameters).
2500	* @param ppRestoredCmd Where to store pointer to restored command.
2501	*/
2502	static int vmmdevR3HgcmRestoreCommand(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, uint32_t uSavedStateVersion,
2503	const VBOXHGCMCMD pLoadedCmd, const VMMDevHGCMRequestHeader pReqHdr, uint32_t cbReq,
2504	VBOXHGCMCMD **ppRestoredCmd)
2505	{
2506	int rc;
2507
2508	/* Verify the request. */
2509	ASSERT_GUEST_RETURN(cbReq >= sizeof(VMMDevHGCMRequestHeader), VERR_MISMATCH);
2510	ASSERT_GUEST_RETURN(cbReq == pReqHdr->header.size, VERR_MISMATCH);
2511
2512	const VMMDevRequestType enmRequestType = pReqHdr->header.requestType;
2513	switch (enmRequestType)
2514	{
2515	case VMMDevReq_HGCMConnect:
2516	{
2517	VMMDevHGCMConnect pReq = (VMMDevHGCMConnect )pReqHdr;
2518	rc = vmmdevR3HgcmRestoreConnect(pThisCC, uSavedStateVersion, pLoadedCmd, pReq, cbReq, enmRequestType, ppRestoredCmd);
2519	break;
2520	}
2521
2522	case VMMDevReq_HGCMDisconnect:
2523	{
2524	VMMDevHGCMDisconnect pReq = (VMMDevHGCMDisconnect )pReqHdr;
2525	rc = vmmdevR3HgcmRestoreDisconnect(pThisCC, uSavedStateVersion, pLoadedCmd, pReq, cbReq, enmRequestType, ppRestoredCmd);
2526	break;
2527	}
2528
2529	#ifdef VBOX_WITH_64_BITS_GUESTS
2530	case VMMDevReq_HGCMCall64:
2531	#endif
2532	case VMMDevReq_HGCMCall32:
2533	{
2534	VMMDevHGCMCall pReq = (VMMDevHGCMCall )pReqHdr;
2535	rc = vmmdevR3HgcmRestoreCall(pDevIns, pThis, pThisCC, uSavedStateVersion, pLoadedCmd,
2536	pReq, cbReq, enmRequestType, ppRestoredCmd);
2537	break;
2538	}
2539
2540	default:
2541	ASSERT_GUEST_FAILED_RETURN(VERR_MISMATCH);
2542	}
2543
2544	return rc;
2545	}
2546
2547	/** Resubmit pending HGCM commands which were loaded form saved state.
2548	*
2549	* @returns VBox status code.
2550	* @param pDevIns The device instance.
2551	* @param pThis The VMMDev shared instance data.
2552	* @param pThisCC The VMMDev ring-3 instance data.
2553	*
2554	* @thread EMT
2555	*/
2556	int vmmdevR3HgcmLoadStateDone(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC)
2557	{
2558	/*
2559	* Resubmit pending HGCM commands to services.
2560	*
2561	* pThisCC->pHGCMCmdList contains commands loaded by vmmdevR3HgcmLoadState.
2562	*
2563	* Legacy saved states (pre VMMDEV_SAVED_STATE_VERSION_HGCM_PARAMS)
2564	* do not have enough information about the command parameters,
2565	* therefore it is necessary to reload at least some data from the
2566	* guest memory to construct commands.
2567	*
2568	* There are two types of legacy saved states which contain:
2569	* 1) the guest physical address and size of request;
2570	* 2) additionally page lists for LinAddr parameters.
2571	*
2572	* Legacy commands have enmCmdType = VBOXHGCMCMDTYPE_LOADSTATE?
2573	*/
2574
2575	int rcFunc = VINF_SUCCESS; /* This status code will make the function fail. I.e. VM will not start. */
2576
2577	/* Get local copy of the list of loaded commands. */
2578	RTLISTANCHOR listLoadedCommands;
2579	RTListMove(&listLoadedCommands, &pThisCC->listHGCMCmd);
2580
2581	/* Resubmit commands. */
2582	PVBOXHGCMCMD pCmd, pNext;
2583	RTListForEachSafe(&listLoadedCommands, pCmd, pNext, VBOXHGCMCMD, node)
2584	{
2585	int rcCmd = VINF_SUCCESS; /* This status code will make the HGCM command fail for the guest. */
2586
2587	RTListNodeRemove(&pCmd->node);
2588
2589	/*
2590	* Re-read the request from the guest memory.
2591	* It will be used to:
2592	* * reconstruct commands if legacy saved state has been restored;
2593	* * report an error to the guest if resubmit failed.
2594	*/
2595	VMMDevHGCMRequestHeader pReqHdr = (VMMDevHGCMRequestHeader )RTMemAlloc(pCmd->cbRequest);
2596	AssertBreakStmt(pReqHdr, vmmdevR3HgcmCmdFree(pDevIns, pThis, pThisCC, pCmd); rcFunc = VERR_NO_MEMORY);
2597
2598	PDMDevHlpPhysRead(pDevIns, pCmd->GCPhys, pReqHdr, pCmd->cbRequest);
2599	RT_UNTRUSTED_NONVOLATILE_COPY_FENCE();
2600
2601	if (pThisCC->pHGCMDrv)
2602	{
2603	/*
2604	* Reconstruct legacy commands.
2605	*/
2606	if (RT_LIKELY( pThisCC->uSavedStateVersion >= VMMDEV_SAVED_STATE_VERSION_HGCM_PARAMS
2607	&& !pCmd->fRestoreFromGuestMem))
2608	{ /* likely */ }
2609	else
2610	{
2611	PVBOXHGCMCMD pRestoredCmd = NULL;
2612	rcCmd = vmmdevR3HgcmRestoreCommand(pDevIns, pThis, pThisCC, pThisCC->uSavedStateVersion, pCmd,
2613	pReqHdr, pCmd->cbRequest, &pRestoredCmd);
2614	if (RT_SUCCESS(rcCmd))
2615	{
2616	Assert(pCmd != pRestoredCmd); /* vmmdevR3HgcmRestoreCommand must allocate restored command. */
2617	vmmdevR3HgcmCmdFree(pDevIns, pThis, pThisCC, pCmd);
2618	pCmd = pRestoredCmd;
2619	}
2620	}
2621
2622	/* Resubmit commands. */
2623	if (RT_SUCCESS(rcCmd))
2624	{
2625	switch (pCmd->enmCmdType)
2626	{
2627	case VBOXHGCMCMDTYPE_CONNECT:
2628	{
2629	vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
2630	rcCmd = pThisCC->pHGCMDrv->pfnConnect(pThisCC->pHGCMDrv, pCmd, pCmd->u.connect.pLoc,
2631	&pCmd->u.connect.u32ClientID);
2632	if (RT_FAILURE(rcCmd))
2633	vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
2634	break;
2635	}
2636
2637	case VBOXHGCMCMDTYPE_DISCONNECT:
2638	{
2639	vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
2640	rcCmd = pThisCC->pHGCMDrv->pfnDisconnect(pThisCC->pHGCMDrv, pCmd, pCmd->u.disconnect.u32ClientID);
2641	if (RT_FAILURE(rcCmd))
2642	vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
2643	break;
2644	}
2645
2646	case VBOXHGCMCMDTYPE_CALL:
2647	{
2648	rcCmd = vmmdevR3HgcmInitHostParameters(pDevIns, pThisCC, pCmd, (uint8_t const *)pReqHdr);
2649	if (RT_SUCCESS(rcCmd))
2650	{
2651	vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
2652
2653	/* Pass the function call to HGCM connector for actual processing */
2654	uint64_t tsNow;
2655	STAM_GET_TS(tsNow);
2656	rcCmd = pThisCC->pHGCMDrv->pfnCall(pThisCC->pHGCMDrv, pCmd,
2657	pCmd->u.call.u32ClientID, pCmd->u.call.u32Function,
2658	pCmd->u.call.cParms, pCmd->u.call.paHostParms, tsNow);
2659	if (RT_FAILURE(rcCmd))
2660	{
2661	LogFunc(("pfnCall rc = %Rrc\n", rcCmd));
2662	vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
2663	}
2664	}
2665	break;
2666	}
2667
2668	default:
2669	AssertFailedStmt(rcCmd = VERR_INTERNAL_ERROR);
2670	}
2671	}
2672	}
2673	else
2674	AssertFailedStmt(rcCmd = VERR_INTERNAL_ERROR);
2675
2676	if (RT_SUCCESS(rcCmd))
2677	{ /* likely */ }
2678	else
2679	{
2680	/* Return the error to the guest. Guest may try to repeat the call. */
2681	pReqHdr->result = rcCmd;
2682	pReqHdr->header.rc = rcCmd;
2683	pReqHdr->fu32Flags \|= VBOX_HGCM_REQ_DONE;
2684
2685	/* Write back only the header. */
2686	PDMDevHlpPhysWrite(pDevIns, pCmd->GCPhys, pReqHdr, sizeof(*pReqHdr));
2687
2688	VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_HGCM);
2689
2690	/* Deallocate the command memory. */
2691	vmmdevR3HgcmCmdFree(pDevIns, pThis, pThisCC, pCmd);
2692	}
2693
2694	RTMemFree(pReqHdr);
2695	}
2696
2697	if (RT_FAILURE(rcFunc))
2698	{
2699	RTListForEachSafe(&listLoadedCommands, pCmd, pNext, VBOXHGCMCMD, node)
2700	{
2701	RTListNodeRemove(&pCmd->node);
2702	vmmdevR3HgcmCmdFree(pDevIns, pThis, pThisCC, pCmd);
2703	}
2704	}
2705
2706	return rcFunc;
2707	}
2708
2709
2710	/**
2711	* Counterpart to vmmdevR3HgcmInit().
2712	*
2713	* @param pDevIns The device instance.
2714	* @param pThis The VMMDev shared instance data.
2715	* @param pThisCC The VMMDev ring-3 instance data.
2716	*/
2717	void vmmdevR3HgcmDestroy(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC)
2718	{
2719	LogFlowFunc(("\n"));
2720
2721	if (RTCritSectIsInitialized(&pThisCC->critsectHGCMCmdList))
2722	{
2723	PVBOXHGCMCMD pCmd, pNext;
2724	RTListForEachSafe(&pThisCC->listHGCMCmd, pCmd, pNext, VBOXHGCMCMD, node)
2725	{
2726	vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
2727	vmmdevR3HgcmCmdFree(pDevIns, pThis, pThisCC, pCmd);
2728	}
2729
2730	RTCritSectDelete(&pThisCC->critsectHGCMCmdList);
2731	}
2732
2733	AssertCompile(NIL_RTMEMCACHE == (RTMEMCACHE)0);
2734	if (pThisCC->hHgcmCmdCache != NIL_RTMEMCACHE)
2735	{
2736	RTMemCacheDestroy(pThisCC->hHgcmCmdCache);
2737	pThisCC->hHgcmCmdCache = NIL_RTMEMCACHE;
2738	}
2739	}
2740
2741
2742	/**
2743	* Initializes the HGCM specific state.
2744	*
2745	* Keeps VBOXHGCMCMDCACHED and friends local.
2746	*
2747	* @returns VBox status code.
2748	* @param pThisCC The VMMDev ring-3 instance data.
2749	*/
2750	int vmmdevR3HgcmInit(PVMMDEVCC pThisCC)
2751	{
2752	LogFlowFunc(("\n"));
2753
2754	RTListInit(&pThisCC->listHGCMCmd);
2755
2756	int rc = RTCritSectInit(&pThisCC->critsectHGCMCmdList);
2757	AssertLogRelRCReturn(rc, rc);
2758
2759	rc = RTMemCacheCreate(&pThisCC->hHgcmCmdCache, sizeof(VBOXHGCMCMDCACHED), 64, _1M, NULL, NULL, NULL, 0);
2760	AssertLogRelRCReturn(rc, rc);
2761
2762	pThisCC->u32HGCMEnabled = 0;
2763
2764	return VINF_SUCCESS;
2765	}
2766

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp@ 95506

Download in other formats: