git.oblomov.eu Git - wine/blob - dlls/oleaut32/tmarshal.c

   1 /*
   2  *      TYPELIB Marshaler
   3  *
   4  *      Copyright 2002,2005     Marcus Meissner
   5  *
   6  * The olerelay debug channel allows you to see calls marshalled by
   7  * the typelib marshaller. It is not a generic COM relaying system.
   8  *
   9  * This library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public
  11  * License as published by the Free Software Foundation; either
  12  * version 2.1 of the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  22  */
  23
  24 #include "config.h"
  25
  26 #include <assert.h>
  27 #include <stdlib.h>
  28 #include <string.h>
  29 #include <stdarg.h>
  30 #include <stdio.h>
  31 #include <ctype.h>
  32
  33 #define COBJMACROS
  34 #define NONAMELESSUNION
  35 #define NONAMELESSSTRUCT
  36
  37 #include "winerror.h"
  38 #include "windef.h"
  39 #include "winbase.h"
  40 #include "winnls.h"
  41 #include "winreg.h"
  42 #include "winuser.h"
  43 #include "excpt.h"
  44
  45 #include "ole2.h"
  46 #include "propidl.h" /* for LPSAFEARRAY_User* functions */
  47 #include "typelib.h"
  48 #include "variant.h"
  49 #include "wine/debug.h"
  50 #include "wine/exception.h"
  51
  52 static const WCHAR IDispatchW[] = { 'I','D','i','s','p','a','t','c','h',0};
  53
  54 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  55 WINE_DECLARE_DEBUG_CHANNEL(olerelay);
  56
  57 #define ICOM_THIS_MULTI(impl,field,iface) impl* const This=(impl*)((char*)(iface) - offsetof(impl,field))
  58
  59 static HRESULT TMarshalDispatchChannel_Create(
  60     IRpcChannelBuffer *pDelegateChannel, REFIID tmarshal_riid,
  61     IRpcChannelBuffer **ppChannel);
  62
  63 typedef struct _marshal_state {
  64     LPBYTE      base;
  65     int         size;
  66     int         curoff;
  67 } marshal_state;
  68
  69 /* used in the olerelay code to avoid having the L"" stuff added by debugstr_w */
  70 static char *relaystr(WCHAR *in) {
  71     char *tmp = (char *)debugstr_w(in);
  72     tmp += 2;
  73     tmp[strlen(tmp)-1] = '\0';
  74     return tmp;
  75 }
  76
  77 static HRESULT
  78 xbuf_resize(marshal_state *buf, DWORD newsize)
  79 {
  80     if(buf->size >= newsize)
  81         return S_FALSE;
  82
  83     if(buf->base)
  84     {
  85         buf->base = HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, buf->base, newsize);
  86         if(!buf->base)
  87             return E_OUTOFMEMORY;
  88     }
  89     else
  90     {
  91         buf->base = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, newsize);
  92         if(!buf->base)
  93             return E_OUTOFMEMORY;
  94     }
  95     buf->size = newsize;
  96     return S_OK;
  97 }
  98
  99 static HRESULT
 100 xbuf_add(marshal_state *buf, LPBYTE stuff, DWORD size)
 101 {
 102     HRESULT hr;
 103
 104     if(buf->size - buf->curoff < size)
 105     {
 106         hr = xbuf_resize(buf, buf->size + size + 100);
 107         if(FAILED(hr)) return hr;
 108     }
 109     memcpy(buf->base+buf->curoff,stuff,size);
 110     buf->curoff += size;
 111     return S_OK;
 112 }
 113
 114 static HRESULT
 115 xbuf_get(marshal_state *buf, LPBYTE stuff, DWORD size) {
 116     if (buf->size < buf->curoff+size) return E_FAIL;
 117     memcpy(stuff,buf->base+buf->curoff,size);
 118     buf->curoff += size;
 119     return S_OK;
 120 }
 121
 122 static HRESULT
 123 xbuf_skip(marshal_state *buf, DWORD size) {
 124     if (buf->size < buf->curoff+size) return E_FAIL;
 125     buf->curoff += size;
 126     return S_OK;
 127 }
 128
 129 static HRESULT
 130 _unmarshal_interface(marshal_state *buf, REFIID riid, LPUNKNOWN *pUnk) {
 131     IStream             *pStm;
 132     ULARGE_INTEGER      newpos;
 133     LARGE_INTEGER       seekto;
 134     ULONG               res;
 135     HRESULT             hres;
 136     DWORD               xsize;
 137
 138     TRACE("...%s...\n",debugstr_guid(riid));
 139
 140     *pUnk = NULL;
 141     hres = xbuf_get(buf,(LPBYTE)&xsize,sizeof(xsize));
 142     if (hres) {
 143         ERR("xbuf_get failed\n");
 144         return hres;
 145     }
 146
 147     if (xsize == 0) return S_OK;
 148
 149     hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
 150     if (hres) {
 151         ERR("Stream create failed %x\n",hres);
 152         return hres;
 153     }
 154
 155     hres = IStream_Write(pStm,buf->base+buf->curoff,xsize,&res);
 156     if (hres) {
 157         ERR("stream write %x\n",hres);
 158         return hres;
 159     }
 160
 161     memset(&seekto,0,sizeof(seekto));
 162     hres = IStream_Seek(pStm,seekto,SEEK_SET,&newpos);
 163     if (hres) {
 164         ERR("Failed Seek %x\n",hres);
 165         return hres;
 166     }
 167
 168     hres = CoUnmarshalInterface(pStm,riid,(LPVOID*)pUnk);
 169     if (hres) {
 170         ERR("Unmarshalling interface %s failed with %x\n",debugstr_guid(riid),hres);
 171         return hres;
 172     }
 173
 174     IStream_Release(pStm);
 175     return xbuf_skip(buf,xsize);
 176 }
 177
 178 static HRESULT
 179 _marshal_interface(marshal_state *buf, REFIID riid, LPUNKNOWN pUnk) {
 180     LPBYTE              tempbuf = NULL;
 181     IStream             *pStm = NULL;
 182     STATSTG             ststg;
 183     ULARGE_INTEGER      newpos;
 184     LARGE_INTEGER       seekto;
 185     ULONG               res;
 186     DWORD               xsize;
 187     HRESULT             hres;
 188
 189     if (!pUnk) {
 190         /* this is valid, if for instance we serialize
 191          * a VT_DISPATCH with NULL ptr which apparently
 192          * can happen. S_OK to make sure we continue
 193          * serializing.
 194          */
 195         WARN("pUnk is NULL\n");
 196         xsize = 0;
 197         return xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 198     }
 199
 200     hres = E_FAIL;
 201
 202     TRACE("...%s...\n",debugstr_guid(riid));
 203
 204     hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
 205     if (hres) {
 206         ERR("Stream create failed %x\n",hres);
 207         goto fail;
 208     }
 209
 210     hres = CoMarshalInterface(pStm,riid,pUnk,0,NULL,0);
 211     if (hres) {
 212         ERR("Marshalling interface %s failed with %x\n", debugstr_guid(riid), hres);
 213         goto fail;
 214     }
 215
 216     hres = IStream_Stat(pStm,&ststg,0);
 217     if (hres) {
 218         ERR("Stream stat failed\n");
 219         goto fail;
 220     }
 221
 222     tempbuf = HeapAlloc(GetProcessHeap(), 0, ststg.cbSize.u.LowPart);
 223     memset(&seekto,0,sizeof(seekto));
 224     hres = IStream_Seek(pStm,seekto,SEEK_SET,&newpos);
 225     if (hres) {
 226         ERR("Failed Seek %x\n",hres);
 227         goto fail;
 228     }
 229
 230     hres = IStream_Read(pStm,tempbuf,ststg.cbSize.u.LowPart,&res);
 231     if (hres) {
 232         ERR("Failed Read %x\n",hres);
 233         goto fail;
 234     }
 235
 236     xsize = ststg.cbSize.u.LowPart;
 237     xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 238     hres = xbuf_add(buf,tempbuf,ststg.cbSize.u.LowPart);
 239
 240     HeapFree(GetProcessHeap(),0,tempbuf);
 241     IStream_Release(pStm);
 242
 243     return hres;
 244
 245 fail:
 246     xsize = 0;
 247     xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 248     if (pStm) IUnknown_Release(pStm);
 249     HeapFree(GetProcessHeap(), 0, tempbuf);
 250     return hres;
 251 }
 252
 253 /********************* OLE Proxy/Stub Factory ********************************/
 254 static HRESULT WINAPI
 255 PSFacBuf_QueryInterface(LPPSFACTORYBUFFER iface, REFIID iid, LPVOID *ppv) {
 256     if (IsEqualIID(iid,&IID_IPSFactoryBuffer)||IsEqualIID(iid,&IID_IUnknown)) {
 257         *ppv = (LPVOID)iface;
 258         /* No ref counting, static class */
 259         return S_OK;
 260     }
 261     FIXME("(%s) unknown IID?\n",debugstr_guid(iid));
 262     return E_NOINTERFACE;
 263 }
 264
 265 static ULONG WINAPI PSFacBuf_AddRef(LPPSFACTORYBUFFER iface) { return 2; }
 266 static ULONG WINAPI PSFacBuf_Release(LPPSFACTORYBUFFER iface) { return 1; }
 267
 268 static HRESULT
 269 _get_typeinfo_for_iid(REFIID riid, ITypeInfo**ti) {
 270     HRESULT     hres;
 271     HKEY        ikey;
 272     char        tlguid[200],typelibkey[300],interfacekey[300],ver[100];
 273     char        tlfn[260];
 274     OLECHAR     tlfnW[260];
 275     DWORD       tlguidlen, verlen, type;
 276     LONG        tlfnlen;
 277     ITypeLib    *tl;
 278
 279     sprintf( interfacekey, "Interface\\{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}\\Typelib",
 280         riid->Data1, riid->Data2, riid->Data3,
 281         riid->Data4[0], riid->Data4[1], riid->Data4[2], riid->Data4[3],
 282         riid->Data4[4], riid->Data4[5], riid->Data4[6], riid->Data4[7]
 283     );
 284
 285     if (RegOpenKeyA(HKEY_CLASSES_ROOT,interfacekey,&ikey)) {
 286         ERR("No %s key found.\n",interfacekey);
 287         return E_FAIL;
 288     }
 289     type = (1<<REG_SZ);
 290     tlguidlen = sizeof(tlguid);
 291     if (RegQueryValueExA(ikey,NULL,NULL,&type,(LPBYTE)tlguid,&tlguidlen)) {
 292         ERR("Getting typelib guid failed.\n");
 293         RegCloseKey(ikey);
 294         return E_FAIL;
 295     }
 296     type = (1<<REG_SZ);
 297     verlen = sizeof(ver);
 298     if (RegQueryValueExA(ikey,"Version",NULL,&type,(LPBYTE)ver,&verlen)) {
 299         ERR("Could not get version value?\n");
 300         RegCloseKey(ikey);
 301         return E_FAIL;
 302     }
 303     RegCloseKey(ikey);
 304     sprintf(typelibkey,"Typelib\\%s\\%s\\0\\win32",tlguid,ver);
 305     tlfnlen = sizeof(tlfn);
 306     if (RegQueryValueA(HKEY_CLASSES_ROOT,typelibkey,tlfn,&tlfnlen)) {
 307         ERR("Could not get typelib fn?\n");
 308         return E_FAIL;
 309     }
 310     MultiByteToWideChar(CP_ACP, 0, tlfn, -1, tlfnW, sizeof(tlfnW) / sizeof(tlfnW[0]));
 311     hres = LoadTypeLib(tlfnW,&tl);
 312     if (hres) {
 313         ERR("Failed to load typelib for %s, but it should be there.\n",debugstr_guid(riid));
 314         return hres;
 315     }
 316     hres = ITypeLib_GetTypeInfoOfGuid(tl,riid,ti);
 317     if (hres) {
 318         ERR("typelib does not contain info for %s?\n",debugstr_guid(riid));
 319         ITypeLib_Release(tl);
 320         return hres;
 321     }
 322     ITypeLib_Release(tl);
 323     return hres;
 324 }
 325
 326 /* Determine nr of functions. Since we use the toplevel interface and all
 327  * inherited ones have lower numbers, we are ok to not to descent into
 328  * the inheritance tree I think.
 329  */
 330 static int _nroffuncs(ITypeInfo *tinfo) {
 331     int         n, i, j;
 332     const FUNCDESC *fdesc;
 333     HRESULT     hres;
 334     TYPEATTR *attr;
 335     ITypeInfo *tinfo2;
 336
 337     n=0;
 338     hres = ITypeInfo_GetTypeAttr(tinfo, &attr);
 339     if (hres) {
 340         ERR("GetTypeAttr failed with %x\n",hres);
 341         return hres;
 342     }
 343     /* look in inherited ifaces. */
 344     for (j=0;j<attr->cImplTypes;j++) {
 345         HREFTYPE href;
 346         hres = ITypeInfo_GetRefTypeOfImplType(tinfo, j, &href);
 347         if (hres) {
 348             ERR("Did not find a reftype for interface offset %d?\n",j);
 349             break;
 350         }
 351         hres = ITypeInfo_GetRefTypeInfo(tinfo, href, &tinfo2);
 352         if (hres) {
 353             ERR("Did not find a typeinfo for reftype %d?\n",href);
 354             continue;
 355         }
 356         n += _nroffuncs(tinfo2);
 357         ITypeInfo_Release(tinfo2);
 358     }
 359     ITypeInfo_ReleaseTypeAttr(tinfo, attr);
 360     i = 0;
 361     while (1) {
 362         hres = ITypeInfoImpl_GetInternalFuncDesc(tinfo,i,&fdesc);
 363         if (hres)
 364             return n;
 365         n++;
 366         i++;
 367     }
 368     /*NOTREACHED*/
 369 }
 370
 371 #ifdef __i386__
 372
 373 #include "pshpack1.h"
 374
 375 typedef struct _TMAsmProxy {
 376     BYTE        popleax;
 377     BYTE        pushlval;
 378     BYTE        nr;
 379     BYTE        pushleax;
 380     BYTE        lcall;
 381     DWORD       xcall;
 382     BYTE        lret;
 383     WORD        bytestopop;
 384 } TMAsmProxy;
 385
 386 #include "poppack.h"
 387
 388 #else /* __i386__ */
 389 # warning You need to implement stubless proxies for your architecture
 390 typedef struct _TMAsmProxy {
 391 } TMAsmProxy;
 392 #endif
 393
 394 typedef struct _TMProxyImpl {
 395     LPVOID                             *lpvtbl;
 396     const IRpcProxyBufferVtbl          *lpvtbl2;
 397     LONG                                ref;
 398
 399     TMAsmProxy                          *asmstubs;
 400     ITypeInfo*                          tinfo;
 401     IRpcChannelBuffer*                  chanbuf;
 402     IID                                 iid;
 403     CRITICAL_SECTION    crit;
 404     IUnknown                            *outerunknown;
 405     IDispatch                           *dispatch;
 406     IRpcProxyBuffer                     *dispatch_proxy;
 407 } TMProxyImpl;
 408
 409 static HRESULT WINAPI
 410 TMProxyImpl_QueryInterface(LPRPCPROXYBUFFER iface, REFIID riid, LPVOID *ppv)
 411 {
 412     TRACE("()\n");
 413     if (IsEqualIID(riid,&IID_IUnknown)||IsEqualIID(riid,&IID_IRpcProxyBuffer)) {
 414         *ppv = (LPVOID)iface;
 415         IRpcProxyBuffer_AddRef(iface);
 416         return S_OK;
 417     }
 418     FIXME("no interface for %s\n",debugstr_guid(riid));
 419     return E_NOINTERFACE;
 420 }
 421
 422 static ULONG WINAPI
 423 TMProxyImpl_AddRef(LPRPCPROXYBUFFER iface)
 424 {
 425     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 426     ULONG refCount = InterlockedIncrement(&This->ref);
 427
 428     TRACE("(%p)->(ref before=%u)\n",This, refCount - 1);
 429
 430     return refCount;
 431 }
 432
 433 static ULONG WINAPI
 434 TMProxyImpl_Release(LPRPCPROXYBUFFER iface)
 435 {
 436     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 437     ULONG refCount = InterlockedDecrement(&This->ref);
 438
 439     TRACE("(%p)->(ref before=%u)\n",This, refCount + 1);
 440
 441     if (!refCount)
 442     {
 443         if (This->dispatch_proxy) IRpcProxyBuffer_Release(This->dispatch_proxy);
 444         This->crit.DebugInfo->Spare[0] = 0;
 445         DeleteCriticalSection(&This->crit);
 446         if (This->chanbuf) IRpcChannelBuffer_Release(This->chanbuf);
 447         VirtualFree(This->asmstubs, 0, MEM_RELEASE);
 448         HeapFree(GetProcessHeap(), 0, This->lpvtbl);
 449         ITypeInfo_Release(This->tinfo);
 450         CoTaskMemFree(This);
 451     }
 452     return refCount;
 453 }
 454
 455 static HRESULT WINAPI
 456 TMProxyImpl_Connect(
 457     LPRPCPROXYBUFFER iface,IRpcChannelBuffer* pRpcChannelBuffer)
 458 {
 459     ICOM_THIS_MULTI(TMProxyImpl, lpvtbl2, iface);
 460
 461     TRACE("(%p)\n", pRpcChannelBuffer);
 462
 463     EnterCriticalSection(&This->crit);
 464
 465     IRpcChannelBuffer_AddRef(pRpcChannelBuffer);
 466     This->chanbuf = pRpcChannelBuffer;
 467
 468     LeaveCriticalSection(&This->crit);
 469
 470     if (This->dispatch_proxy)
 471     {
 472         IRpcChannelBuffer *pDelegateChannel;
 473         HRESULT hr = TMarshalDispatchChannel_Create(pRpcChannelBuffer, &This->iid, &pDelegateChannel);
 474         if (FAILED(hr))
 475             return hr;
 476         return IRpcProxyBuffer_Connect(This->dispatch_proxy, pDelegateChannel);
 477     }
 478
 479     return S_OK;
 480 }
 481
 482 static void WINAPI
 483 TMProxyImpl_Disconnect(LPRPCPROXYBUFFER iface)
 484 {
 485     ICOM_THIS_MULTI(TMProxyImpl, lpvtbl2, iface);
 486
 487     TRACE("()\n");
 488
 489     EnterCriticalSection(&This->crit);
 490
 491     IRpcChannelBuffer_Release(This->chanbuf);
 492     This->chanbuf = NULL;
 493
 494     LeaveCriticalSection(&This->crit);
 495
 496     if (This->dispatch_proxy)
 497         IRpcProxyBuffer_Disconnect(This->dispatch_proxy);
 498 }
 499
 500
 501 static const IRpcProxyBufferVtbl tmproxyvtable = {
 502     TMProxyImpl_QueryInterface,
 503     TMProxyImpl_AddRef,
 504     TMProxyImpl_Release,
 505     TMProxyImpl_Connect,
 506     TMProxyImpl_Disconnect
 507 };
 508
 509 /* how much space do we use on stack in DWORD steps. */
 510 int
 511 _argsize(DWORD vt) {
 512     switch (vt) {
 513     case VT_UI8:
 514         return 8/sizeof(DWORD);
 515     case VT_R8:
 516         return sizeof(double)/sizeof(DWORD);
 517     case VT_CY:
 518         return sizeof(CY)/sizeof(DWORD);
 519     case VT_DATE:
 520         return sizeof(DATE)/sizeof(DWORD);
 521     case VT_VARIANT:
 522         return (sizeof(VARIANT)+3)/sizeof(DWORD);
 523     default:
 524         return 1;
 525     }
 526 }
 527
 528 static int
 529 _xsize(TYPEDESC *td) {
 530     switch (td->vt) {
 531     case VT_DATE:
 532         return sizeof(DATE);
 533     case VT_VARIANT:
 534         return sizeof(VARIANT)+3;
 535     case VT_CARRAY: {
 536         int i, arrsize = 1;
 537         ARRAYDESC *adesc = td->u.lpadesc;
 538
 539         for (i=0;i<adesc->cDims;i++)
 540             arrsize *= adesc->rgbounds[i].cElements;
 541         return arrsize*_xsize(&adesc->tdescElem);
 542     }
 543     case VT_UI8:
 544     case VT_I8:
 545         return 8;
 546     case VT_UI2:
 547     case VT_I2:
 548         return 2;
 549     case VT_UI1:
 550     case VT_I1:
 551         return 1;
 552     default:
 553         return 4;
 554     }
 555 }
 556
 557 static HRESULT
 558 serialize_param(
 559     ITypeInfo           *tinfo,
 560     BOOL                writeit,
 561     BOOL                debugout,
 562     BOOL                dealloc,
 563     TYPEDESC            *tdesc,
 564     DWORD               *arg,
 565     marshal_state       *buf)
 566 {
 567     HRESULT hres = S_OK;
 568
 569     TRACE("(tdesc.vt %s)\n",debugstr_vt(tdesc->vt));
 570
 571     switch (tdesc->vt) {
 572     case VT_EMPTY: /* nothing. empty variant for instance */
 573         return S_OK;
 574     case VT_I8:
 575     case VT_UI8:
 576     case VT_CY:
 577         hres = S_OK;
 578         if (debugout) TRACE_(olerelay)("%x%x\n",arg[0],arg[1]);
 579         if (writeit)
 580             hres = xbuf_add(buf,(LPBYTE)arg,8);
 581         return hres;
 582     case VT_BOOL:
 583     case VT_ERROR:
 584     case VT_INT:
 585     case VT_UINT:
 586     case VT_I4:
 587     case VT_R4:
 588     case VT_UI4:
 589         hres = S_OK;
 590         if (debugout) TRACE_(olerelay)("%x\n",*arg);
 591         if (writeit)
 592             hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 593         return hres;
 594     case VT_I2:
 595     case VT_UI2:
 596         hres = S_OK;
 597         if (debugout) TRACE_(olerelay)("%04x\n",*arg & 0xffff);
 598         if (writeit)
 599             hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 600         return hres;
 601     case VT_I1:
 602     case VT_UI1:
 603         hres = S_OK;
 604         if (debugout) TRACE_(olerelay)("%02x\n",*arg & 0xff);
 605         if (writeit)
 606             hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 607         return hres;
 608     case VT_I4|VT_BYREF:
 609         hres = S_OK;
 610         if (debugout) TRACE_(olerelay)("&0x%x\n",*arg);
 611         if (writeit)
 612             hres = xbuf_add(buf,(LPBYTE)(DWORD*)*arg,sizeof(DWORD));
 613         /* do not dealloc at this time */
 614         return hres;
 615     case VT_VARIANT: {
 616         TYPEDESC        tdesc2;
 617         VARIANT         *vt = (VARIANT*)arg;
 618         DWORD           vttype = V_VT(vt);
 619
 620         if (debugout) TRACE_(olerelay)("Vt(%s%s)(",debugstr_vt(vttype),debugstr_vf(vttype));
 621         tdesc2.vt = vttype;
 622         if (writeit) {
 623             hres = xbuf_add(buf,(LPBYTE)&vttype,sizeof(vttype));
 624             if (hres) return hres;
 625         }
 626         /* need to recurse since we need to free the stuff */
 627         hres = serialize_param(tinfo,writeit,debugout,dealloc,&tdesc2,(DWORD*)&(V_I4(vt)),buf);
 628         if (debugout) TRACE_(olerelay)(")");
 629         return hres;
 630     }
 631     case VT_BSTR|VT_BYREF: {
 632         if (debugout) TRACE_(olerelay)("[byref]'%s'", *(BSTR*)*arg ? relaystr(*((BSTR*)*arg)) : "<bstr NULL>");
 633         if (writeit) {
 634             /* ptr to ptr to magic widestring, basically */
 635             BSTR *bstr = (BSTR *) *arg;
 636             DWORD len;
 637             if (!*bstr) {
 638                 /* -1 means "null string" which is equivalent to empty string */
 639                 len = -1;
 640                 hres = xbuf_add(buf, (LPBYTE)&len,sizeof(DWORD));
 641                 if (hres) return hres;
 642             } else {
 643                 len = *((DWORD*)*bstr-1)/sizeof(WCHAR);
 644                 hres = xbuf_add(buf,(LPBYTE)&len,sizeof(DWORD));
 645                 if (hres) return hres;
 646                 hres = xbuf_add(buf,(LPBYTE)*bstr,len * sizeof(WCHAR));
 647                 if (hres) return hres;
 648             }
 649         }
 650
 651         if (dealloc && arg) {
 652             BSTR *str = *((BSTR **)arg);
 653             SysFreeString(*str);
 654         }
 655         return S_OK;
 656     }
 657
 658     case VT_BSTR: {
 659         if (debugout) {
 660             if (*arg)
 661                    TRACE_(olerelay)("%s",relaystr((WCHAR*)*arg));
 662             else
 663                     TRACE_(olerelay)("<bstr NULL>");
 664         }
 665         if (writeit) {
 666             BSTR bstr = (BSTR)*arg;
 667             DWORD len;
 668             if (!bstr) {
 669                 len = -1;
 670                 hres = xbuf_add(buf,(LPBYTE)&len,sizeof(DWORD));
 671                 if (hres) return hres;
 672             } else {
 673                 len = *((DWORD*)bstr-1)/sizeof(WCHAR);
 674                 hres = xbuf_add(buf,(LPBYTE)&len,sizeof(DWORD));
 675                 if (hres) return hres;
 676                 hres = xbuf_add(buf,(LPBYTE)bstr,len * sizeof(WCHAR));
 677                 if (hres) return hres;
 678             }
 679         }
 680
 681         if (dealloc && arg)
 682             SysFreeString((BSTR)*arg);
 683         return S_OK;
 684     }
 685     case VT_PTR: {
 686         DWORD cookie;
 687         BOOL        derefhere = TRUE;
 688
 689         if (tdesc->u.lptdesc->vt == VT_USERDEFINED) {
 690             ITypeInfo   *tinfo2;
 691             TYPEATTR    *tattr;
 692
 693             hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.lptdesc->u.hreftype,&tinfo2);
 694             if (hres) {
 695                 ERR("Could not get typeinfo of hreftype %x for VT_USERDEFINED.\n",tdesc->u.lptdesc->u.hreftype);
 696                 return hres;
 697             }
 698             ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 699             switch (tattr->typekind) {
 700             case TKIND_ENUM:    /* confirmed */
 701             case TKIND_RECORD:  /* FIXME: mostly untested */
 702                 derefhere=TRUE;
 703                 break;
 704             case TKIND_ALIAS:   /* FIXME: untested */
 705             case TKIND_DISPATCH:        /* will be done in VT_USERDEFINED case */
 706             case TKIND_INTERFACE:       /* will be done in VT_USERDEFINED case */
 707                 derefhere=FALSE;
 708                 break;
 709             default:
 710                 FIXME("unhandled switch cases tattr->typekind %d\n", tattr->typekind);
 711                 derefhere=FALSE;
 712                 break;
 713             }
 714             ITypeInfo_ReleaseTypeAttr(tinfo, tattr);
 715             ITypeInfo_Release(tinfo2);
 716         }
 717
 718         if (debugout) TRACE_(olerelay)("*");
 719         /* Write always, so the other side knows when it gets a NULL pointer.
 720          */
 721         cookie = *arg ? 0x42424242 : 0;
 722         hres = xbuf_add(buf,(LPBYTE)&cookie,sizeof(cookie));
 723         if (hres)
 724             return hres;
 725         if (!*arg) {
 726             if (debugout) TRACE_(olerelay)("NULL");
 727             return S_OK;
 728         }
 729         hres = serialize_param(tinfo,writeit,debugout,dealloc,tdesc->u.lptdesc,(DWORD*)*arg,buf);
 730         if (derefhere && dealloc) HeapFree(GetProcessHeap(),0,(LPVOID)*arg);
 731         return hres;
 732     }
 733     case VT_UNKNOWN:
 734         if (debugout) TRACE_(olerelay)("unk(0x%x)",*arg);
 735         if (writeit)
 736             hres = _marshal_interface(buf,&IID_IUnknown,(LPUNKNOWN)*arg);
 737         if (dealloc && *(IUnknown **)arg)
 738             IUnknown_Release((LPUNKNOWN)*arg);
 739         return hres;
 740     case VT_DISPATCH:
 741         if (debugout) TRACE_(olerelay)("idisp(0x%x)",*arg);
 742         if (writeit)
 743             hres = _marshal_interface(buf,&IID_IDispatch,(LPUNKNOWN)*arg);
 744         if (dealloc && *(IUnknown **)arg)
 745             IUnknown_Release((LPUNKNOWN)*arg);
 746         return hres;
 747     case VT_VOID:
 748         if (debugout) TRACE_(olerelay)("<void>");
 749         return S_OK;
 750     case VT_USERDEFINED: {
 751         ITypeInfo       *tinfo2;
 752         TYPEATTR        *tattr;
 753
 754         hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
 755         if (hres) {
 756             ERR("Could not get typeinfo of hreftype %x for VT_USERDEFINED.\n",tdesc->u.hreftype);
 757             return hres;
 758         }
 759         ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 760         switch (tattr->typekind) {
 761         case TKIND_DISPATCH:
 762         case TKIND_INTERFACE:
 763             if (writeit)
 764                hres=_marshal_interface(buf,&(tattr->guid),(LPUNKNOWN)arg);
 765             if (dealloc)
 766                 IUnknown_Release((LPUNKNOWN)arg);
 767             break;
 768         case TKIND_RECORD: {
 769             int i;
 770             if (debugout) TRACE_(olerelay)("{");
 771             for (i=0;i<tattr->cVars;i++) {
 772                 VARDESC *vdesc;
 773                 ELEMDESC *elem2;
 774                 TYPEDESC *tdesc2;
 775
 776                 hres = ITypeInfo2_GetVarDesc(tinfo2, i, &vdesc);
 777                 if (hres) {
 778                     ERR("Could not get vardesc of %d\n",i);
 779                     return hres;
 780                 }
 781                 elem2 = &vdesc->elemdescVar;
 782                 tdesc2 = &elem2->tdesc;
 783                 hres = serialize_param(
 784                     tinfo2,
 785                     writeit,
 786                     debugout,
 787                     dealloc,
 788                     tdesc2,
 789                     (DWORD*)(((LPBYTE)arg)+vdesc->u.oInst),
 790                     buf
 791                 );
 792                 ITypeInfo_ReleaseVarDesc(tinfo2, vdesc);
 793                 if (hres!=S_OK)
 794                     return hres;
 795                 if (debugout && (i<(tattr->cVars-1)))
 796                     TRACE_(olerelay)(",");
 797             }
 798             if (debugout) TRACE_(olerelay)("}");
 799             break;
 800         }
 801         case TKIND_ALIAS:
 802             hres = serialize_param(tinfo2,writeit,debugout,dealloc,&tattr->tdescAlias,arg,buf);
 803             break;
 804         case TKIND_ENUM:
 805             hres = S_OK;
 806             if (debugout) TRACE_(olerelay)("%x",*arg);
 807             if (writeit)
 808                 hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 809             break;
 810         default:
 811             FIXME("Unhandled typekind %d\n",tattr->typekind);
 812             hres = E_FAIL;
 813             break;
 814         }
 815         ITypeInfo_ReleaseTypeAttr(tinfo2, tattr);
 816         ITypeInfo_Release(tinfo2);
 817         return hres;
 818     }
 819     case VT_CARRAY: {
 820         ARRAYDESC *adesc = tdesc->u.lpadesc;
 821         int i, arrsize = 1;
 822
 823         if (debugout) TRACE_(olerelay)("carr");
 824         for (i=0;i<adesc->cDims;i++) {
 825             if (debugout) TRACE_(olerelay)("[%d]",adesc->rgbounds[i].cElements);
 826             arrsize *= adesc->rgbounds[i].cElements;
 827         }
 828         if (debugout) TRACE_(olerelay)("(vt %s)",debugstr_vt(adesc->tdescElem.vt));
 829         if (debugout) TRACE_(olerelay)("[");
 830         for (i=0;i<arrsize;i++) {
 831             hres = serialize_param(tinfo, writeit, debugout, dealloc, &adesc->tdescElem, (DWORD*)((LPBYTE)arg+i*_xsize(&adesc->tdescElem)), buf);
 832             if (hres)
 833                 return hres;
 834             if (debugout && (i<arrsize-1)) TRACE_(olerelay)(",");
 835         }
 836         if (debugout) TRACE_(olerelay)("]");
 837         return S_OK;
 838     }
 839     case VT_SAFEARRAY: {
 840         if (writeit)
 841         {
 842             ULONG flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
 843             ULONG size = LPSAFEARRAY_UserSize(&flags, buf->curoff, (LPSAFEARRAY *)arg);
 844             xbuf_resize(buf, size);
 845             LPSAFEARRAY_UserMarshal(&flags, buf->base + buf->curoff, (LPSAFEARRAY *)arg);
 846             buf->curoff = size;
 847         }
 848         return S_OK;
 849     }
 850     default:
 851         ERR("Unhandled marshal type %d.\n",tdesc->vt);
 852         return S_OK;
 853     }
 854 }
 855
 856 static HRESULT
 857 deserialize_param(
 858     ITypeInfo           *tinfo,
 859     BOOL                readit,
 860     BOOL                debugout,
 861     BOOL                alloc,
 862     TYPEDESC            *tdesc,
 863     DWORD               *arg,
 864     marshal_state       *buf)
 865 {
 866     HRESULT hres = S_OK;
 867
 868     TRACE("vt %s at %p\n",debugstr_vt(tdesc->vt),arg);
 869
 870     while (1) {
 871         switch (tdesc->vt) {
 872         case VT_EMPTY:
 873             if (debugout) TRACE_(olerelay)("<empty>\n");
 874             return S_OK;
 875         case VT_NULL:
 876             if (debugout) TRACE_(olerelay)("<null>\n");
 877             return S_OK;
 878         case VT_VARIANT: {
 879             VARIANT     *vt = (VARIANT*)arg;
 880
 881             if (readit) {
 882                 DWORD   vttype;
 883                 TYPEDESC        tdesc2;
 884                 hres = xbuf_get(buf,(LPBYTE)&vttype,sizeof(vttype));
 885                 if (hres) {
 886                     FIXME("vt type not read?\n");
 887                     return hres;
 888                 }
 889                 memset(&tdesc2,0,sizeof(tdesc2));
 890                 tdesc2.vt = vttype;
 891                 V_VT(vt)  = vttype;
 892                 if (debugout) TRACE_(olerelay)("Vt(%s%s)(",debugstr_vt(vttype),debugstr_vf(vttype));
 893                 hres = deserialize_param(tinfo, readit, debugout, alloc, &tdesc2, (DWORD*)&(V_I4(vt)), buf);
 894                 TRACE_(olerelay)(")");
 895                 return hres;
 896             } else {
 897                 VariantInit(vt);
 898                 return S_OK;
 899             }
 900         }
 901         case VT_I8:
 902         case VT_UI8:
 903         case VT_CY:
 904             if (readit) {
 905                 hres = xbuf_get(buf,(LPBYTE)arg,8);
 906                 if (hres) ERR("Failed to read integer 8 byte\n");
 907             }
 908             if (debugout) TRACE_(olerelay)("%x%x",arg[0],arg[1]);
 909             return hres;
 910         case VT_ERROR:
 911         case VT_BOOL:
 912         case VT_I4:
 913         case VT_INT:
 914         case VT_UINT:
 915         case VT_R4:
 916         case VT_UI4:
 917             if (readit) {
 918                 hres = xbuf_get(buf,(LPBYTE)arg,sizeof(DWORD));
 919                 if (hres) ERR("Failed to read integer 4 byte\n");
 920             }
 921             if (debugout) TRACE_(olerelay)("%x",*arg);
 922             return hres;
 923         case VT_I2:
 924         case VT_UI2:
 925             if (readit) {
 926                 DWORD x;
 927                 hres = xbuf_get(buf,(LPBYTE)&x,sizeof(DWORD));
 928                 if (hres) ERR("Failed to read integer 4 byte\n");
 929                 memcpy(arg,&x,2);
 930             }
 931             if (debugout) TRACE_(olerelay)("%04x",*arg & 0xffff);
 932             return hres;
 933         case VT_I1:
 934         case VT_UI1:
 935             if (readit) {
 936                 DWORD x;
 937                 hres = xbuf_get(buf,(LPBYTE)&x,sizeof(DWORD));
 938                 if (hres) ERR("Failed to read integer 4 byte\n");
 939                 memcpy(arg,&x,1);
 940             }
 941             if (debugout) TRACE_(olerelay)("%02x",*arg & 0xff);
 942             return hres;
 943         case VT_I4|VT_BYREF:
 944             hres = S_OK;
 945             if (alloc)
 946                 *arg = (DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DWORD));
 947             if (readit) {
 948                 hres = xbuf_get(buf,(LPBYTE)*arg,sizeof(DWORD));
 949                 if (hres) ERR("Failed to read integer 4 byte\n");
 950             }
 951             if (debugout) TRACE_(olerelay)("&0x%x",*(DWORD*)*arg);
 952             return hres;
 953         case VT_BSTR|VT_BYREF: {
 954             BSTR **bstr = (BSTR **)arg;
 955             WCHAR       *str;
 956             DWORD       len;
 957
 958             if (readit) {
 959                 hres = xbuf_get(buf,(LPBYTE)&len,sizeof(DWORD));
 960                 if (hres) {
 961                     ERR("failed to read bstr klen\n");
 962                     return hres;
 963                 }
 964                 if (len == -1) {
 965                     *bstr = CoTaskMemAlloc(sizeof(BSTR *));
 966                     **bstr = NULL;
 967                     if (debugout) TRACE_(olerelay)("<bstr NULL>");
 968                 } else {
 969                     str  = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,(len+1)*sizeof(WCHAR));
 970                     hres = xbuf_get(buf,(LPBYTE)str,len*sizeof(WCHAR));
 971                     if (hres) {
 972                         ERR("Failed to read BSTR.\n");
 973                         return hres;
 974                     }
 975                     *bstr = CoTaskMemAlloc(sizeof(BSTR *));
 976                     **bstr = SysAllocStringLen(str,len);
 977                     if (debugout) TRACE_(olerelay)("%s",relaystr(str));
 978                     HeapFree(GetProcessHeap(),0,str);
 979                 }
 980             } else {
 981                 *bstr = NULL;
 982             }
 983             return S_OK;
 984         }
 985         case VT_BSTR: {
 986             WCHAR       *str;
 987             DWORD       len;
 988
 989             if (readit) {
 990                 hres = xbuf_get(buf,(LPBYTE)&len,sizeof(DWORD));
 991                 if (hres) {
 992                     ERR("failed to read bstr klen\n");
 993                     return hres;
 994                 }
 995                 if (len == -1) {
 996                     *arg = 0;
 997                     if (debugout) TRACE_(olerelay)("<bstr NULL>");
 998                 } else {
 999                     str  = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,(len+1)*sizeof(WCHAR));
1000                     hres = xbuf_get(buf,(LPBYTE)str,len*sizeof(WCHAR));
1001                     if (hres) {
1002                         ERR("Failed to read BSTR.\n");
1003                         return hres;
1004                     }
1005                     *arg = (DWORD)SysAllocStringLen(str,len);
1006                     if (debugout) TRACE_(olerelay)("%s",relaystr(str));
1007                     HeapFree(GetProcessHeap(),0,str);
1008                 }
1009             } else {
1010                 *arg = 0;
1011             }
1012             return S_OK;
1013         }
1014         case VT_PTR: {
1015             DWORD       cookie;
1016             BOOL        derefhere = TRUE;
1017
1018             if (tdesc->u.lptdesc->vt == VT_USERDEFINED) {
1019                 ITypeInfo       *tinfo2;
1020                 TYPEATTR        *tattr;
1021
1022                 hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.lptdesc->u.hreftype,&tinfo2);
1023                 if (hres) {
1024                     ERR("Could not get typeinfo of hreftype %x for VT_USERDEFINED.\n",tdesc->u.lptdesc->u.hreftype);
1025                     return hres;
1026                 }
1027                 ITypeInfo_GetTypeAttr(tinfo2,&tattr);
1028                 switch (tattr->typekind) {
1029                 case TKIND_ENUM:        /* confirmed */
1030                 case TKIND_RECORD:      /* FIXME: mostly untested */
1031                     derefhere=TRUE;
1032                     break;
1033                 case TKIND_ALIAS:       /* FIXME: untested */
1034                 case TKIND_DISPATCH:    /* will be done in VT_USERDEFINED case */
1035                 case TKIND_INTERFACE:   /* will be done in VT_USERDEFINED case */
1036                     derefhere=FALSE;
1037                     break;
1038                 default:
1039                     FIXME("unhandled switch cases tattr->typekind %d\n", tattr->typekind);
1040                     derefhere=FALSE;
1041                     break;
1042                 }
1043                 ITypeInfo_ReleaseTypeAttr(tinfo2, tattr);
1044                 ITypeInfo_Release(tinfo2);
1045             }
1046             /* read it in all cases, we need to know if we have
1047              * NULL pointer or not.
1048              */
1049             hres = xbuf_get(buf,(LPBYTE)&cookie,sizeof(cookie));
1050             if (hres) {
1051                 ERR("Failed to load pointer cookie.\n");
1052                 return hres;
1053             }
1054             if (cookie != 0x42424242) {
1055                 /* we read a NULL ptr from the remote side */
1056                 if (debugout) TRACE_(olerelay)("NULL");
1057                 *arg = 0;
1058                 return S_OK;
1059             }
1060             if (debugout) TRACE_(olerelay)("*");
1061             if (alloc) {
1062                 /* Allocate space for the referenced struct */
1063                 if (derefhere)
1064                     *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,_xsize(tdesc->u.lptdesc));
1065             }
1066             if (derefhere)
1067                 return deserialize_param(tinfo, readit, debugout, alloc, tdesc->u.lptdesc, (LPDWORD)*arg, buf);
1068             else
1069                 return deserialize_param(tinfo, readit, debugout, alloc, tdesc->u.lptdesc, arg, buf);
1070         }
1071         case VT_UNKNOWN:
1072             /* FIXME: UNKNOWN is unknown ..., but allocate 4 byte for it */
1073             if (alloc)
1074                 *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DWORD));
1075             hres = S_OK;
1076             if (readit)
1077                 hres = _unmarshal_interface(buf,&IID_IUnknown,(LPUNKNOWN*)arg);
1078             if (debugout)
1079                 TRACE_(olerelay)("unk(%p)",arg);
1080             return hres;
1081         case VT_DISPATCH:
1082             hres = S_OK;
1083             if (readit)
1084                 hres = _unmarshal_interface(buf,&IID_IDispatch,(LPUNKNOWN*)arg);
1085             if (debugout)
1086                 TRACE_(olerelay)("idisp(%p)",arg);
1087             return hres;
1088         case VT_VOID:
1089             if (debugout) TRACE_(olerelay)("<void>");
1090             return S_OK;
1091         case VT_USERDEFINED: {
1092             ITypeInfo   *tinfo2;
1093             TYPEATTR    *tattr;
1094
1095             hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
1096             if (hres) {
1097                 ERR("Could not get typeinfo of hreftype %x for VT_USERDEFINED.\n",tdesc->u.hreftype);
1098                 return hres;
1099             }
1100             hres = ITypeInfo_GetTypeAttr(tinfo2,&tattr);
1101             if (hres) {
1102                 ERR("Could not get typeattr in VT_USERDEFINED.\n");
1103             } else {
1104                 switch (tattr->typekind) {
1105                 case TKIND_DISPATCH:
1106                 case TKIND_INTERFACE:
1107                     if (readit)
1108                         hres = _unmarshal_interface(buf,&(tattr->guid),(LPUNKNOWN*)arg);
1109                     break;
1110                 case TKIND_RECORD: {
1111                     int i;
1112
1113                     if (alloc)
1114                         *arg = (DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,tattr->cbSizeInstance);
1115
1116                     if (debugout) TRACE_(olerelay)("{");
1117                     for (i=0;i<tattr->cVars;i++) {
1118                         VARDESC *vdesc;
1119
1120                         hres = ITypeInfo2_GetVarDesc(tinfo2, i, &vdesc);
1121                         if (hres) {
1122                             ERR("Could not get vardesc of %d\n",i);
1123                             ITypeInfo_ReleaseTypeAttr(tinfo2, tattr);
1124                             ITypeInfo_Release(tinfo2);
1125                             return hres;
1126                         }
1127                         hres = deserialize_param(
1128                             tinfo2,
1129                             readit,
1130                             debugout,
1131                             alloc,
1132                             &vdesc->elemdescVar.tdesc,
1133                             (DWORD*)(((LPBYTE)*arg)+vdesc->u.oInst),
1134                             buf
1135                         );
1136                         ITypeInfo2_ReleaseVarDesc(tinfo2, vdesc);
1137                         if (debugout && (i<tattr->cVars-1)) TRACE_(olerelay)(",");
1138                     }
1139                     if (debugout) TRACE_(olerelay)("}");
1140                     break;
1141                 }
1142                 case TKIND_ALIAS:
1143                     hres = deserialize_param(tinfo2,readit,debugout,alloc,&tattr->tdescAlias,arg,buf);
1144                     break;
1145                 case TKIND_ENUM:
1146                     if (readit) {
1147                         hres = xbuf_get(buf,(LPBYTE)arg,sizeof(DWORD));
1148                         if (hres) ERR("Failed to read enum (4 byte)\n");
1149                     }
1150                     if (debugout) TRACE_(olerelay)("%x",*arg);
1151                     break;
1152                 default:
1153                     ERR("Unhandled typekind %d\n",tattr->typekind);
1154                     hres = E_FAIL;
1155                     break;
1156                 }
1157                 ITypeInfo_ReleaseTypeAttr(tinfo2, tattr);
1158             }
1159             if (hres)
1160                 ERR("failed to stuballoc in TKIND_RECORD.\n");
1161             ITypeInfo_Release(tinfo2);
1162             return hres;
1163         }
1164         case VT_CARRAY: {
1165             /* arg is pointing to the start of the array. */
1166             ARRAYDESC *adesc = tdesc->u.lpadesc;
1167             int         arrsize,i;
1168             arrsize = 1;
1169             if (adesc->cDims > 1) FIXME("cDims > 1 in VT_CARRAY. Does it work?\n");
1170             for (i=0;i<adesc->cDims;i++)
1171                 arrsize *= adesc->rgbounds[i].cElements;
1172             for (i=0;i<arrsize;i++)
1173                 deserialize_param(
1174                     tinfo,
1175                     readit,
1176                     debugout,
1177                     alloc,
1178                     &adesc->tdescElem,
1179                     (DWORD*)((LPBYTE)(arg)+i*_xsize(&adesc->tdescElem)),
1180                     buf
1181                 );
1182             return S_OK;
1183         }
1184     case VT_SAFEARRAY: {
1185             if (readit)
1186             {
1187                 ULONG flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
1188                 unsigned char *buffer;
1189                 buffer = LPSAFEARRAY_UserUnmarshal(&flags, buf->base + buf->curoff, (LPSAFEARRAY *)arg);
1190                 buf->curoff = buffer - buf->base;
1191             }
1192             return S_OK;
1193         }
1194         default:
1195             ERR("No handler for VT type %d!\n",tdesc->vt);
1196             return S_OK;
1197         }
1198     }
1199 }
1200
1201 /* Searches function, also in inherited interfaces */
1202 static HRESULT
1203 _get_funcdesc(
1204     ITypeInfo *tinfo, int iMethod, ITypeInfo **tactual, const FUNCDESC **fdesc, BSTR *iname, BSTR *fname)
1205 {
1206     int i = 0, j = 0;
1207     HRESULT hres;
1208
1209     if (fname) *fname = NULL;
1210     if (iname) *iname = NULL;
1211
1212     while (1) {
1213         hres = ITypeInfoImpl_GetInternalFuncDesc(tinfo, i, fdesc);
1214
1215         if (hres) {
1216             ITypeInfo   *tinfo2;
1217             HREFTYPE    href;
1218             TYPEATTR    *attr;
1219
1220             hres = ITypeInfo_GetTypeAttr(tinfo, &attr);
1221             if (hres) {
1222                 ERR("GetTypeAttr failed with %x\n",hres);
1223                 return hres;
1224             }
1225             /* Not found, so look in inherited ifaces. */
1226             for (j=0;j<attr->cImplTypes;j++) {
1227                 hres = ITypeInfo_GetRefTypeOfImplType(tinfo, j, &href);
1228                 if (hres) {
1229                     ERR("Did not find a reftype for interface offset %d?\n",j);
1230                     break;
1231                 }
1232                 hres = ITypeInfo_GetRefTypeInfo(tinfo, href, &tinfo2);
1233                 if (hres) {
1234                     ERR("Did not find a typeinfo for reftype %d?\n",href);
1235                     continue;
1236                 }
1237                 hres = _get_funcdesc(tinfo2,iMethod,tactual,fdesc,iname,fname);
1238                 ITypeInfo_Release(tinfo2);
1239                 if (!hres) {
1240                     ITypeInfo_ReleaseTypeAttr(tinfo, attr);
1241                     return S_OK;
1242                 }
1243             }
1244             ITypeInfo_ReleaseTypeAttr(tinfo, attr);
1245             return hres;
1246         }
1247         if (((*fdesc)->oVft/4) == iMethod) {
1248             if (fname)
1249                 ITypeInfo_GetDocumentation(tinfo,(*fdesc)->memid,fname,NULL,NULL,NULL);
1250             if (iname)
1251                 ITypeInfo_GetDocumentation(tinfo,-1,iname,NULL,NULL,NULL);
1252             *tactual = tinfo;
1253             ITypeInfo_AddRef(*tactual);
1254             return S_OK;
1255         }
1256         i++;
1257     }
1258 }
1259
1260 static inline BOOL is_in_elem(const ELEMDESC *elem)
1261 {
1262     return (elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN || !elem->u.paramdesc.wParamFlags);
1263 }
1264
1265 static inline BOOL is_out_elem(const ELEMDESC *elem)
1266 {
1267     return (elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT || !elem->u.paramdesc.wParamFlags);
1268 }
1269
1270 static DWORD
1271 xCall(LPVOID retptr, int method, TMProxyImpl *tpinfo /*, args */)
1272 {
1273     DWORD               *args = ((DWORD*)&tpinfo)+1, *xargs;
1274     const FUNCDESC      *fdesc;
1275     HRESULT             hres;
1276     int                 i, relaydeb = TRACE_ON(olerelay);
1277     marshal_state       buf;
1278     RPCOLEMESSAGE       msg;
1279     ULONG               status;
1280     BSTR                fname,iname;
1281     BSTR                names[10];
1282     UINT                nrofnames;
1283     DWORD               remoteresult = 0;
1284     ITypeInfo           *tinfo;
1285     IRpcChannelBuffer *chanbuf;
1286
1287     EnterCriticalSection(&tpinfo->crit);
1288
1289     hres = _get_funcdesc(tpinfo->tinfo,method,&tinfo,&fdesc,&iname,&fname);
1290     if (hres) {
1291         ERR("Did not find typeinfo/funcdesc entry for method %d!\n",method);
1292         ITypeInfo_Release(tinfo);
1293         LeaveCriticalSection(&tpinfo->crit);
1294         return E_FAIL;
1295     }
1296
1297     if (!tpinfo->chanbuf)
1298     {
1299         WARN("Tried to use disconnected proxy\n");
1300         ITypeInfo_Release(tinfo);
1301         LeaveCriticalSection(&tpinfo->crit);
1302         return RPC_E_DISCONNECTED;
1303     }
1304     chanbuf = tpinfo->chanbuf;
1305     IRpcChannelBuffer_AddRef(chanbuf);
1306
1307     LeaveCriticalSection(&tpinfo->crit);
1308
1309     if (relaydeb) {
1310        TRACE_(olerelay)("->");
1311         if (iname)
1312             TRACE_(olerelay)("%s:",relaystr(iname));
1313         if (fname)
1314             TRACE_(olerelay)("%s(%d)",relaystr(fname),method);
1315         else
1316             TRACE_(olerelay)("%d",method);
1317         TRACE_(olerelay)("(");
1318     }
1319
1320     if (iname) SysFreeString(iname);
1321     if (fname) SysFreeString(fname);
1322
1323     memset(&buf,0,sizeof(buf));
1324
1325     /* normal typelib driven serializing */
1326
1327     /* Need them for hack below */
1328     memset(names,0,sizeof(names));
1329     if (ITypeInfo_GetNames(tinfo,fdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames))
1330         nrofnames = 0;
1331     if (nrofnames > sizeof(names)/sizeof(names[0]))
1332         ERR("Need more names!\n");
1333
1334     xargs = args;
1335     for (i=0;i<fdesc->cParams;i++) {
1336         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1337         if (relaydeb) {
1338             if (i) TRACE_(olerelay)(",");
1339             if (i+1<nrofnames && names[i+1])
1340                 TRACE_(olerelay)("%s=",relaystr(names[i+1]));
1341         }
1342         /* No need to marshal other data than FIN and any VT_PTR. */
1343         if (!is_in_elem(elem) && (elem->tdesc.vt != VT_PTR)) {
1344             xargs+=_argsize(elem->tdesc.vt);
1345             if (relaydeb) TRACE_(olerelay)("[out]");
1346             continue;
1347         }
1348         hres = serialize_param(
1349             tinfo,
1350             is_in_elem(elem),
1351             relaydeb,
1352             FALSE,
1353             &elem->tdesc,
1354             xargs,
1355             &buf
1356         );
1357
1358         if (hres) {
1359             ERR("Failed to serialize param, hres %x\n",hres);
1360             break;
1361         }
1362         xargs+=_argsize(elem->tdesc.vt);
1363     }
1364     if (relaydeb) TRACE_(olerelay)(")");
1365
1366     memset(&msg,0,sizeof(msg));
1367     msg.cbBuffer = buf.curoff;
1368     msg.iMethod  = method;
1369     hres = IRpcChannelBuffer_GetBuffer(chanbuf,&msg,&(tpinfo->iid));
1370     if (hres) {
1371         ERR("RpcChannelBuffer GetBuffer failed, %x\n",hres);
1372         goto exit;
1373     }
1374     memcpy(msg.Buffer,buf.base,buf.curoff);
1375     if (relaydeb) TRACE_(olerelay)("\n");
1376     hres = IRpcChannelBuffer_SendReceive(chanbuf,&msg,&status);
1377     if (hres) {
1378         ERR("RpcChannelBuffer SendReceive failed, %x\n",hres);
1379         goto exit;
1380     }
1381
1382     if (relaydeb) TRACE_(olerelay)(" status = %08x (",status);
1383     if (buf.base)
1384         buf.base = HeapReAlloc(GetProcessHeap(),0,buf.base,msg.cbBuffer);
1385     else
1386         buf.base = HeapAlloc(GetProcessHeap(),0,msg.cbBuffer);
1387     buf.size = msg.cbBuffer;
1388     memcpy(buf.base,msg.Buffer,buf.size);
1389     buf.curoff = 0;
1390
1391     /* generic deserializer using typelib description */
1392     xargs = args;
1393     status = S_OK;
1394     for (i=0;i<fdesc->cParams;i++) {
1395         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1396
1397         if (relaydeb) {
1398             if (i) TRACE_(olerelay)(",");
1399             if (i+1<nrofnames && names[i+1]) TRACE_(olerelay)("%s=",relaystr(names[i+1]));
1400         }
1401         /* No need to marshal other data than FOUT and any VT_PTR */
1402         if (!is_out_elem(elem) && (elem->tdesc.vt != VT_PTR)) {
1403             xargs += _argsize(elem->tdesc.vt);
1404             if (relaydeb) TRACE_(olerelay)("[in]");
1405             continue;
1406         }
1407         hres = deserialize_param(
1408             tinfo,
1409             is_out_elem(elem),
1410             relaydeb,
1411             FALSE,
1412             &(elem->tdesc),
1413             xargs,
1414             &buf
1415         );
1416         if (hres) {
1417             ERR("Failed to unmarshall param, hres %x\n",hres);
1418             status = hres;
1419             break;
1420         }
1421         xargs += _argsize(elem->tdesc.vt);
1422     }
1423
1424     hres = xbuf_get(&buf, (LPBYTE)&remoteresult, sizeof(DWORD));
1425     if (hres != S_OK)
1426         goto exit;
1427     if (relaydeb) TRACE_(olerelay)(") = %08x\n", remoteresult);
1428
1429     hres = remoteresult;
1430
1431 exit:
1432     for (i = 0; i < nrofnames; i++)
1433         SysFreeString(names[i]);
1434     HeapFree(GetProcessHeap(),0,buf.base);
1435     IRpcChannelBuffer_Release(chanbuf);
1436     ITypeInfo_Release(tinfo);
1437     TRACE("-- 0x%08x\n", hres);
1438     return hres;
1439 }
1440
1441 static HRESULT WINAPI ProxyIUnknown_QueryInterface(IUnknown *iface, REFIID riid, void **ppv)
1442 {
1443     TMProxyImpl *proxy = (TMProxyImpl *)iface;
1444
1445     TRACE("(%s, %p)\n", debugstr_guid(riid), ppv);
1446
1447     if (proxy->outerunknown)
1448         return IUnknown_QueryInterface(proxy->outerunknown, riid, ppv);
1449
1450     FIXME("No interface\n");
1451     return E_NOINTERFACE;
1452 }
1453
1454 static ULONG WINAPI ProxyIUnknown_AddRef(IUnknown *iface)
1455 {
1456     TMProxyImpl *proxy = (TMProxyImpl *)iface;
1457
1458     TRACE("\n");
1459
1460     if (proxy->outerunknown)
1461         return IUnknown_AddRef(proxy->outerunknown);
1462
1463     return 2; /* FIXME */
1464 }
1465
1466 static ULONG WINAPI ProxyIUnknown_Release(IUnknown *iface)
1467 {
1468     TMProxyImpl *proxy = (TMProxyImpl *)iface;
1469
1470     TRACE("\n");
1471
1472     if (proxy->outerunknown)
1473         return IUnknown_Release(proxy->outerunknown);
1474
1475     return 1; /* FIXME */
1476 }
1477
1478 static HRESULT WINAPI ProxyIDispatch_GetTypeInfoCount(LPDISPATCH iface, UINT * pctinfo)
1479 {
1480     TMProxyImpl *This = (TMProxyImpl *)iface;
1481
1482     TRACE("(%p)\n", pctinfo);
1483
1484     return IDispatch_GetTypeInfoCount(This->dispatch, pctinfo);
1485 }
1486
1487 static HRESULT WINAPI ProxyIDispatch_GetTypeInfo(LPDISPATCH iface, UINT iTInfo, LCID lcid, ITypeInfo** ppTInfo)
1488 {
1489     TMProxyImpl *This = (TMProxyImpl *)iface;
1490
1491     TRACE("(%d, %x, %p)\n", iTInfo, lcid, ppTInfo);
1492
1493     return IDispatch_GetTypeInfo(This->dispatch, iTInfo, lcid, ppTInfo);
1494 }
1495
1496 static HRESULT WINAPI ProxyIDispatch_GetIDsOfNames(LPDISPATCH iface, REFIID riid, LPOLESTR * rgszNames, UINT cNames, LCID lcid, DISPID * rgDispId)
1497 {
1498     TMProxyImpl *This = (TMProxyImpl *)iface;
1499
1500     TRACE("(%s, %p, %d, 0x%x, %p)\n", debugstr_guid(riid), rgszNames, cNames, lcid, rgDispId);
1501
1502     return IDispatch_GetIDsOfNames(This->dispatch, riid, rgszNames,
1503                                    cNames, lcid, rgDispId);
1504 }
1505
1506 static HRESULT WINAPI ProxyIDispatch_Invoke(LPDISPATCH iface, DISPID dispIdMember, REFIID riid, LCID lcid,
1507                                             WORD wFlags, DISPPARAMS * pDispParams, VARIANT * pVarResult,
1508                                             EXCEPINFO * pExcepInfo, UINT * puArgErr)
1509 {
1510     TMProxyImpl *This = (TMProxyImpl *)iface;
1511
1512     TRACE("(%d, %s, 0x%x, 0x%x, %p, %p, %p, %p)\n", dispIdMember,
1513           debugstr_guid(riid), lcid, wFlags, pDispParams, pVarResult,
1514           pExcepInfo, puArgErr);
1515
1516     return IDispatch_Invoke(This->dispatch, dispIdMember, riid, lcid,
1517                             wFlags, pDispParams, pVarResult, pExcepInfo,
1518                             puArgErr);
1519 }
1520
1521 typedef struct
1522 {
1523     const IRpcChannelBufferVtbl *lpVtbl;
1524     LONG                  refs;
1525     /* the IDispatch-derived interface we are handling */
1526         IID                   tmarshal_iid;
1527     IRpcChannelBuffer    *pDelegateChannel;
1528 } TMarshalDispatchChannel;
1529
1530 static HRESULT WINAPI TMarshalDispatchChannel_QueryInterface(LPRPCCHANNELBUFFER iface, REFIID riid, LPVOID *ppv)
1531 {
1532     *ppv = NULL;
1533     if (IsEqualIID(riid,&IID_IRpcChannelBuffer) || IsEqualIID(riid,&IID_IUnknown))
1534     {
1535         *ppv = (LPVOID)iface;
1536         IUnknown_AddRef(iface);
1537         return S_OK;
1538     }
1539     return E_NOINTERFACE;
1540 }
1541
1542 static ULONG WINAPI TMarshalDispatchChannel_AddRef(LPRPCCHANNELBUFFER iface)
1543 {
1544     TMarshalDispatchChannel *This = (TMarshalDispatchChannel *)iface;
1545     return InterlockedIncrement(&This->refs);
1546 }
1547
1548 static ULONG WINAPI TMarshalDispatchChannel_Release(LPRPCCHANNELBUFFER iface)
1549 {
1550     TMarshalDispatchChannel *This = (TMarshalDispatchChannel *)iface;
1551     ULONG ref;
1552
1553     ref = InterlockedDecrement(&This->refs);
1554     if (ref)
1555         return ref;
1556
1557         IRpcChannelBuffer_Release(This->pDelegateChannel);
1558     HeapFree(GetProcessHeap(), 0, This);
1559     return 0;
1560 }
1561
1562 static HRESULT WINAPI TMarshalDispatchChannel_GetBuffer(LPRPCCHANNELBUFFER iface, RPCOLEMESSAGE* olemsg, REFIID riid)
1563 {
1564     TMarshalDispatchChannel *This = (TMarshalDispatchChannel *)iface;
1565     TRACE("(%p, %s)\n", olemsg, debugstr_guid(riid));
1566     /* Note: we are pretending to invoke a method on the interface identified
1567      * by tmarshal_iid so that we can re-use the IDispatch proxy/stub code
1568      * without the RPC runtime getting confused by not exporting an IDispatch interface */
1569     return IRpcChannelBuffer_GetBuffer(This->pDelegateChannel, olemsg, &This->tmarshal_iid);
1570 }
1571
1572 static HRESULT WINAPI TMarshalDispatchChannel_SendReceive(LPRPCCHANNELBUFFER iface, RPCOLEMESSAGE *olemsg, ULONG *pstatus)
1573 {
1574     TMarshalDispatchChannel *This = (TMarshalDispatchChannel *)iface;
1575     TRACE("(%p, %p)\n", olemsg, pstatus);
1576     return IRpcChannelBuffer_SendReceive(This->pDelegateChannel, olemsg, pstatus);
1577 }
1578
1579 static HRESULT WINAPI TMarshalDispatchChannel_FreeBuffer(LPRPCCHANNELBUFFER iface, RPCOLEMESSAGE* olemsg)
1580 {
1581     TMarshalDispatchChannel *This = (TMarshalDispatchChannel *)iface;
1582     TRACE("(%p)\n", olemsg);
1583     return IRpcChannelBuffer_FreeBuffer(This->pDelegateChannel, olemsg);
1584 }
1585
1586 static HRESULT WINAPI TMarshalDispatchChannel_GetDestCtx(LPRPCCHANNELBUFFER iface, DWORD* pdwDestContext, void** ppvDestContext)
1587 {
1588     TMarshalDispatchChannel *This = (TMarshalDispatchChannel *)iface;
1589     TRACE("(%p,%p)\n", pdwDestContext, ppvDestContext);
1590     return IRpcChannelBuffer_GetDestCtx(This->pDelegateChannel, pdwDestContext, ppvDestContext);
1591 }
1592
1593 static HRESULT WINAPI TMarshalDispatchChannel_IsConnected(LPRPCCHANNELBUFFER iface)
1594 {
1595     TMarshalDispatchChannel *This = (TMarshalDispatchChannel *)iface;
1596     TRACE("()\n");
1597     return IRpcChannelBuffer_IsConnected(This->pDelegateChannel);
1598 }
1599
1600 static const IRpcChannelBufferVtbl TMarshalDispatchChannelVtbl =
1601 {
1602     TMarshalDispatchChannel_QueryInterface,
1603     TMarshalDispatchChannel_AddRef,
1604     TMarshalDispatchChannel_Release,
1605     TMarshalDispatchChannel_GetBuffer,
1606     TMarshalDispatchChannel_SendReceive,
1607     TMarshalDispatchChannel_FreeBuffer,
1608     TMarshalDispatchChannel_GetDestCtx,
1609     TMarshalDispatchChannel_IsConnected
1610 };
1611
1612 static HRESULT TMarshalDispatchChannel_Create(
1613     IRpcChannelBuffer *pDelegateChannel, REFIID tmarshal_riid,
1614     IRpcChannelBuffer **ppChannel)
1615 {
1616     TMarshalDispatchChannel *This = HeapAlloc(GetProcessHeap(), 0, sizeof(*This));
1617     if (!This)
1618         return E_OUTOFMEMORY;
1619
1620     This->lpVtbl = &TMarshalDispatchChannelVtbl;
1621     This->refs = 1;
1622     IRpcChannelBuffer_AddRef(pDelegateChannel);
1623     This->pDelegateChannel = pDelegateChannel;
1624     This->tmarshal_iid = *tmarshal_riid;
1625
1626     *ppChannel = (IRpcChannelBuffer *)&This->lpVtbl;
1627     return S_OK;
1628 }
1629
1630
1631 static inline HRESULT get_facbuf_for_iid(REFIID riid, IPSFactoryBuffer **facbuf)
1632 {
1633     HRESULT       hr;
1634     CLSID         clsid;
1635
1636     if ((hr = CoGetPSClsid(riid, &clsid)))
1637         return hr;
1638     return CoGetClassObject(&clsid, CLSCTX_INPROC_SERVER, NULL,
1639                              &IID_IPSFactoryBuffer, (LPVOID*)facbuf);
1640 }
1641
1642 static HRESULT WINAPI
1643 PSFacBuf_CreateProxy(
1644     LPPSFACTORYBUFFER iface, IUnknown* pUnkOuter, REFIID riid,
1645     IRpcProxyBuffer **ppProxy, LPVOID *ppv)
1646 {
1647     HRESULT     hres;
1648     ITypeInfo   *tinfo;
1649     int         i, nroffuncs;
1650     const FUNCDESC *fdesc;
1651     TMProxyImpl *proxy;
1652     TYPEATTR    *typeattr;
1653
1654     TRACE("(...%s...)\n",debugstr_guid(riid));
1655     hres = _get_typeinfo_for_iid(riid,&tinfo);
1656     if (hres) {
1657         ERR("No typeinfo for %s?\n",debugstr_guid(riid));
1658         return hres;
1659     }
1660     nroffuncs = _nroffuncs(tinfo);
1661     proxy = CoTaskMemAlloc(sizeof(TMProxyImpl));
1662     if (!proxy) return E_OUTOFMEMORY;
1663
1664     assert(sizeof(TMAsmProxy) == 12);
1665
1666     proxy->dispatch = NULL;
1667     proxy->dispatch_proxy = NULL;
1668     proxy->outerunknown = pUnkOuter;
1669     proxy->asmstubs = VirtualAlloc(NULL, sizeof(TMAsmProxy) * nroffuncs, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
1670     if (!proxy->asmstubs) {
1671         ERR("Could not commit pages for proxy thunks\n");
1672         CoTaskMemFree(proxy);
1673         return E_OUTOFMEMORY;
1674     }
1675     proxy->lpvtbl2      = &tmproxyvtable;
1676     /* one reference for the proxy */
1677     proxy->ref          = 1;
1678     proxy->tinfo        = tinfo;
1679     memcpy(&proxy->iid,riid,sizeof(*riid));
1680     proxy->chanbuf      = 0;
1681
1682     InitializeCriticalSection(&proxy->crit);
1683     proxy->crit.DebugInfo->Spare[0] = (DWORD_PTR)(__FILE__ ": TMProxyImpl.crit");
1684
1685     proxy->lpvtbl = HeapAlloc(GetProcessHeap(),0,sizeof(LPBYTE)*nroffuncs);
1686     for (i=0;i<nroffuncs;i++) {
1687         TMAsmProxy      *xasm = proxy->asmstubs+i;
1688
1689         switch (i) {
1690         case 0:
1691                 proxy->lpvtbl[i] = ProxyIUnknown_QueryInterface;
1692                 break;
1693         case 1:
1694                 proxy->lpvtbl[i] = ProxyIUnknown_AddRef;
1695                 break;
1696         case 2:
1697                 proxy->lpvtbl[i] = ProxyIUnknown_Release;
1698                 break;
1699         default: {
1700                 int j;
1701                 /* nrofargs without This */
1702                 int nrofargs;
1703                 ITypeInfo *tinfo2;
1704                 hres = _get_funcdesc(tinfo,i,&tinfo2,&fdesc,NULL,NULL);
1705                 ITypeInfo_Release(tinfo2);
1706                 if (hres) {
1707                     ERR("GetFuncDesc %x should not fail here.\n",hres);
1708                     return hres;
1709                 }
1710                 /* some args take more than 4 byte on the stack */
1711                 nrofargs = 0;
1712                 for (j=0;j<fdesc->cParams;j++)
1713                     nrofargs += _argsize(fdesc->lprgelemdescParam[j].tdesc.vt);
1714
1715 #ifdef __i386__
1716                 if (fdesc->callconv != CC_STDCALL) {
1717                     ERR("calling convention is not stdcall????\n");
1718                     return E_FAIL;
1719                 }
1720 /* popl %eax    -       return ptr
1721  * pushl <nr>
1722  * pushl %eax
1723  * call xCall
1724  * lret <nr> (+4)
1725  *
1726  *
1727  * arg3 arg2 arg1 <method> <returnptr>
1728  */
1729                 xasm->popleax   = 0x58;
1730                 xasm->pushlval  = 0x6a;
1731                 xasm->nr        = i;
1732                 xasm->pushleax  = 0x50;
1733                 xasm->lcall     = 0xe8; /* relative jump */
1734                 xasm->xcall     = (DWORD)xCall;
1735                 xasm->xcall     -= (DWORD)&(xasm->lret);
1736                 xasm->lret      = 0xc2;
1737                 xasm->bytestopop= (nrofargs+2)*4; /* pop args, This, iMethod */
1738                 proxy->lpvtbl[i] = xasm;
1739                 break;
1740 #else
1741                 FIXME("not implemented on non i386\n");
1742                 return E_FAIL;
1743 #endif
1744             }
1745         }
1746     }
1747
1748     /* if we derive from IDispatch then defer to its proxy for its methods */
1749     hres = ITypeInfo_GetTypeAttr(tinfo, &typeattr);
1750     if (hres == S_OK)
1751     {
1752         if (typeattr->wTypeFlags & TYPEFLAG_FDISPATCHABLE)
1753         {
1754             IPSFactoryBuffer *factory_buffer;
1755             hres = get_facbuf_for_iid(&IID_IDispatch, &factory_buffer);
1756             if (hres == S_OK)
1757             {
1758                 hres = IPSFactoryBuffer_CreateProxy(factory_buffer, NULL,
1759                     &IID_IDispatch, &proxy->dispatch_proxy,
1760                     (void **)&proxy->dispatch);
1761                 IPSFactoryBuffer_Release(factory_buffer);
1762             }
1763             if ((hres == S_OK) && (nroffuncs < 7))
1764             {
1765                 ERR("nroffuncs calculated incorrectly (%d)\n", nroffuncs);
1766                 hres = E_UNEXPECTED;
1767             }
1768             if (hres == S_OK)
1769             {
1770                 proxy->lpvtbl[3] = ProxyIDispatch_GetTypeInfoCount;
1771                 proxy->lpvtbl[4] = ProxyIDispatch_GetTypeInfo;
1772                 proxy->lpvtbl[5] = ProxyIDispatch_GetIDsOfNames;
1773                 proxy->lpvtbl[6] = ProxyIDispatch_Invoke;
1774             }
1775         }
1776         ITypeInfo_ReleaseTypeAttr(tinfo, typeattr);
1777     }
1778
1779     if (hres == S_OK)
1780     {
1781         *ppv            = (LPVOID)proxy;
1782         *ppProxy                = (IRpcProxyBuffer *)&(proxy->lpvtbl2);
1783         IUnknown_AddRef((IUnknown *)*ppv);
1784         return S_OK;
1785     }
1786     else
1787         TMProxyImpl_Release((IRpcProxyBuffer *)&proxy->lpvtbl2);
1788     return hres;
1789 }
1790
1791 typedef struct _TMStubImpl {
1792     const IRpcStubBufferVtbl   *lpvtbl;
1793     LONG                        ref;
1794
1795     LPUNKNOWN                   pUnk;
1796     ITypeInfo                   *tinfo;
1797     IID                         iid;
1798     IRpcStubBuffer              *dispatch_stub;
1799     BOOL                        dispatch_derivative;
1800 } TMStubImpl;
1801
1802 static HRESULT WINAPI
1803 TMStubImpl_QueryInterface(LPRPCSTUBBUFFER iface, REFIID riid, LPVOID *ppv)
1804 {
1805     if (IsEqualIID(riid,&IID_IRpcStubBuffer)||IsEqualIID(riid,&IID_IUnknown)){
1806         *ppv = (LPVOID)iface;
1807         IRpcStubBuffer_AddRef(iface);
1808         return S_OK;
1809     }
1810     FIXME("%s, not supported IID.\n",debugstr_guid(riid));
1811     return E_NOINTERFACE;
1812 }
1813
1814 static ULONG WINAPI
1815 TMStubImpl_AddRef(LPRPCSTUBBUFFER iface)
1816 {
1817     TMStubImpl *This = (TMStubImpl *)iface;
1818     ULONG refCount = InterlockedIncrement(&This->ref);
1819
1820     TRACE("(%p)->(ref before=%u)\n", This, refCount - 1);
1821
1822     return refCount;
1823 }
1824
1825 static ULONG WINAPI
1826 TMStubImpl_Release(LPRPCSTUBBUFFER iface)
1827 {
1828     TMStubImpl *This = (TMStubImpl *)iface;
1829     ULONG refCount = InterlockedDecrement(&This->ref);
1830
1831     TRACE("(%p)->(ref before=%u)\n", This, refCount + 1);
1832
1833     if (!refCount)
1834     {
1835         IRpcStubBuffer_Disconnect(iface);
1836         ITypeInfo_Release(This->tinfo);
1837         if (This->dispatch_stub)
1838             IRpcStubBuffer_Release(This->dispatch_stub);
1839         CoTaskMemFree(This);
1840     }
1841     return refCount;
1842 }
1843
1844 static HRESULT WINAPI
1845 TMStubImpl_Connect(LPRPCSTUBBUFFER iface, LPUNKNOWN pUnkServer)
1846 {
1847     TMStubImpl *This = (TMStubImpl *)iface;
1848
1849     TRACE("(%p)->(%p)\n", This, pUnkServer);
1850
1851     IUnknown_AddRef(pUnkServer);
1852     This->pUnk = pUnkServer;
1853
1854     if (This->dispatch_stub)
1855         IRpcStubBuffer_Connect(This->dispatch_stub, pUnkServer);
1856
1857     return S_OK;
1858 }
1859
1860 static void WINAPI
1861 TMStubImpl_Disconnect(LPRPCSTUBBUFFER iface)
1862 {
1863     TMStubImpl *This = (TMStubImpl *)iface;
1864
1865     TRACE("(%p)->()\n", This);
1866
1867     if (This->pUnk)
1868     {
1869         IUnknown_Release(This->pUnk);
1870         This->pUnk = NULL;
1871     }
1872
1873     if (This->dispatch_stub)
1874         IRpcStubBuffer_Disconnect(This->dispatch_stub);
1875 }
1876
1877 static HRESULT WINAPI
1878 TMStubImpl_Invoke(
1879     LPRPCSTUBBUFFER iface, RPCOLEMESSAGE* xmsg,IRpcChannelBuffer*rpcchanbuf)
1880 {
1881     int         i;
1882     const FUNCDESC *fdesc;
1883     TMStubImpl *This = (TMStubImpl *)iface;
1884     HRESULT     hres;
1885     DWORD       *args = NULL, res, *xargs, nrofargs;
1886     marshal_state       buf;
1887     UINT        nrofnames = 0;
1888     BSTR        names[10];
1889     BSTR        iname = NULL;
1890     ITypeInfo   *tinfo = NULL;
1891
1892     TRACE("...\n");
1893
1894     if (xmsg->iMethod < 3) {
1895         ERR("IUnknown methods cannot be marshaled by the typelib marshaler\n");
1896         return E_UNEXPECTED;
1897     }
1898
1899     if (This->dispatch_derivative && xmsg->iMethod < sizeof(IDispatchVtbl)/sizeof(void *))
1900     {
1901         IPSFactoryBuffer *factory_buffer;
1902         hres = get_facbuf_for_iid(&IID_IDispatch, &factory_buffer);
1903         if (hres == S_OK)
1904         {
1905             hres = IPSFactoryBuffer_CreateStub(factory_buffer, &IID_IDispatch,
1906                 This->pUnk, &This->dispatch_stub);
1907             IPSFactoryBuffer_Release(factory_buffer);
1908         }
1909         if (hres != S_OK)
1910             return hres;
1911         return IRpcStubBuffer_Invoke(This->dispatch_stub, xmsg, rpcchanbuf);
1912     }
1913
1914     memset(&buf,0,sizeof(buf));
1915     buf.size    = xmsg->cbBuffer;
1916     buf.base    = HeapAlloc(GetProcessHeap(), 0, xmsg->cbBuffer);
1917     memcpy(buf.base, xmsg->Buffer, xmsg->cbBuffer);
1918     buf.curoff  = 0;
1919
1920     hres = _get_funcdesc(This->tinfo,xmsg->iMethod,&tinfo,&fdesc,&iname,NULL);
1921     if (hres) {
1922         ERR("GetFuncDesc on method %d failed with %x\n",xmsg->iMethod,hres);
1923         return hres;
1924     }
1925
1926     if (iname && !lstrcmpW(iname, IDispatchW))
1927     {
1928         ERR("IDispatch cannot be marshaled by the typelib marshaler\n");
1929         hres = E_UNEXPECTED;
1930         SysFreeString (iname);
1931         goto exit;
1932     }
1933
1934     if (iname) SysFreeString (iname);
1935
1936     /* Need them for hack below */
1937     memset(names,0,sizeof(names));
1938     ITypeInfo_GetNames(tinfo,fdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames);
1939     if (nrofnames > sizeof(names)/sizeof(names[0])) {
1940         ERR("Need more names!\n");
1941     }
1942
1943     /*dump_FUNCDESC(fdesc);*/
1944     nrofargs = 0;
1945     for (i=0;i<fdesc->cParams;i++)
1946         nrofargs += _argsize(fdesc->lprgelemdescParam[i].tdesc.vt);
1947     args = HeapAlloc(GetProcessHeap(),0,(nrofargs+1)*sizeof(DWORD));
1948     if (!args)
1949     {
1950         hres = E_OUTOFMEMORY;
1951         goto exit;
1952     }
1953
1954     /* Allocate all stuff used by call. */
1955     xargs = args+1;
1956     for (i=0;i<fdesc->cParams;i++) {
1957         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1958
1959         hres = deserialize_param(
1960            tinfo,
1961            is_in_elem(elem),
1962            FALSE,
1963            TRUE,
1964            &(elem->tdesc),
1965            xargs,
1966            &buf
1967         );
1968         xargs += _argsize(elem->tdesc.vt);
1969         if (hres) {
1970             ERR("Failed to deserialize param %s, hres %x\n",relaystr(names[i+1]),hres);
1971             break;
1972         }
1973     }
1974
1975     args[0] = (DWORD)This->pUnk;
1976
1977     __TRY
1978     {
1979         res = _invoke(
1980             (*((FARPROC**)args[0]))[fdesc->oVft/4],
1981             fdesc->callconv,
1982             (xargs-args),
1983             args
1984         );
1985     }
1986     __EXCEPT(NULL)
1987     {
1988         DWORD dwExceptionCode = GetExceptionCode();
1989         ERR("invoke call failed with exception 0x%08x (%d)\n", dwExceptionCode, dwExceptionCode);
1990         if (FAILED(dwExceptionCode))
1991             hres = dwExceptionCode;
1992         else
1993             hres = HRESULT_FROM_WIN32(dwExceptionCode);
1994     }
1995     __ENDTRY
1996
1997     if (hres != S_OK)
1998         goto exit;
1999
2000     buf.curoff = 0;
2001
2002     xargs = args+1;
2003     for (i=0;i<fdesc->cParams;i++) {
2004         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
2005         hres = serialize_param(
2006            tinfo,
2007            is_out_elem(elem),
2008            FALSE,
2009            TRUE,
2010            &elem->tdesc,
2011            xargs,
2012            &buf
2013         );
2014         xargs += _argsize(elem->tdesc.vt);
2015         if (hres) {
2016             ERR("Failed to stuballoc param, hres %x\n",hres);
2017             break;
2018         }
2019     }
2020
2021     hres = xbuf_add (&buf, (LPBYTE)&res, sizeof(DWORD));
2022
2023     if (hres != S_OK)
2024         goto exit;
2025
2026     xmsg->cbBuffer      = buf.curoff;
2027     hres = IRpcChannelBuffer_GetBuffer(rpcchanbuf, xmsg, &This->iid);
2028     if (hres != S_OK)
2029         ERR("IRpcChannelBuffer_GetBuffer failed with error 0x%08x\n", hres);
2030
2031     if (hres == S_OK)
2032         memcpy(xmsg->Buffer, buf.base, buf.curoff);
2033
2034 exit:
2035     for (i = 0; i < nrofnames; i++)
2036         SysFreeString(names[i]);
2037
2038     ITypeInfo_Release(tinfo);
2039     HeapFree(GetProcessHeap(), 0, args);
2040
2041     HeapFree(GetProcessHeap(), 0, buf.base);
2042
2043     TRACE("returning\n");
2044     return hres;
2045 }
2046
2047 static LPRPCSTUBBUFFER WINAPI
2048 TMStubImpl_IsIIDSupported(LPRPCSTUBBUFFER iface, REFIID riid) {
2049     FIXME("Huh (%s)?\n",debugstr_guid(riid));
2050     return NULL;
2051 }
2052
2053 static ULONG WINAPI
2054 TMStubImpl_CountRefs(LPRPCSTUBBUFFER iface) {
2055     TMStubImpl *This = (TMStubImpl *)iface;
2056
2057     FIXME("()\n");
2058     return This->ref; /*FIXME? */
2059 }
2060
2061 static HRESULT WINAPI
2062 TMStubImpl_DebugServerQueryInterface(LPRPCSTUBBUFFER iface, LPVOID *ppv) {
2063     return E_NOTIMPL;
2064 }
2065
2066 static void WINAPI
2067 TMStubImpl_DebugServerRelease(LPRPCSTUBBUFFER iface, LPVOID ppv) {
2068     return;
2069 }
2070
2071 static const IRpcStubBufferVtbl tmstubvtbl = {
2072     TMStubImpl_QueryInterface,
2073     TMStubImpl_AddRef,
2074     TMStubImpl_Release,
2075     TMStubImpl_Connect,
2076     TMStubImpl_Disconnect,
2077     TMStubImpl_Invoke,
2078     TMStubImpl_IsIIDSupported,
2079     TMStubImpl_CountRefs,
2080     TMStubImpl_DebugServerQueryInterface,
2081     TMStubImpl_DebugServerRelease
2082 };
2083
2084 static HRESULT WINAPI
2085 PSFacBuf_CreateStub(
2086     LPPSFACTORYBUFFER iface, REFIID riid,IUnknown *pUnkServer,
2087     IRpcStubBuffer** ppStub
2088 ) {
2089     HRESULT hres;
2090     ITypeInfo   *tinfo;
2091     TMStubImpl  *stub;
2092     TYPEATTR *typeattr;
2093
2094     TRACE("(%s,%p,%p)\n",debugstr_guid(riid),pUnkServer,ppStub);
2095
2096     hres = _get_typeinfo_for_iid(riid,&tinfo);
2097     if (hres) {
2098         ERR("No typeinfo for %s?\n",debugstr_guid(riid));
2099         return hres;
2100     }
2101
2102     stub = CoTaskMemAlloc(sizeof(TMStubImpl));
2103     if (!stub)
2104         return E_OUTOFMEMORY;
2105     stub->lpvtbl        = &tmstubvtbl;
2106     stub->ref           = 1;
2107     stub->tinfo         = tinfo;
2108     stub->dispatch_stub = NULL;
2109     stub->dispatch_derivative = FALSE;
2110     memcpy(&(stub->iid),riid,sizeof(*riid));
2111     hres = IRpcStubBuffer_Connect((LPRPCSTUBBUFFER)stub,pUnkServer);
2112     *ppStub             = (LPRPCSTUBBUFFER)stub;
2113     TRACE("IRpcStubBuffer: %p\n", stub);
2114     if (hres)
2115         ERR("Connect to pUnkServer failed?\n");
2116
2117     /* if we derive from IDispatch then defer to its stub for some of its methods */
2118     hres = ITypeInfo_GetTypeAttr(tinfo, &typeattr);
2119     if (hres == S_OK)
2120     {
2121         if (typeattr->wTypeFlags & TYPEFLAG_FDISPATCHABLE)
2122             stub->dispatch_derivative = TRUE;
2123         ITypeInfo_ReleaseTypeAttr(tinfo, typeattr);
2124     }
2125
2126     return hres;
2127 }
2128
2129 static const IPSFactoryBufferVtbl psfacbufvtbl = {
2130     PSFacBuf_QueryInterface,
2131     PSFacBuf_AddRef,
2132     PSFacBuf_Release,
2133     PSFacBuf_CreateProxy,
2134     PSFacBuf_CreateStub
2135 };
2136
2137 /* This is the whole PSFactoryBuffer object, just the vtableptr */
2138 static const IPSFactoryBufferVtbl *lppsfac = &psfacbufvtbl;
2139
2140 /***********************************************************************
2141  *           TMARSHAL_DllGetClassObject
2142  */
2143 HRESULT TMARSHAL_DllGetClassObject(REFCLSID rclsid, REFIID iid,LPVOID *ppv)
2144 {
2145     if (IsEqualIID(iid,&IID_IPSFactoryBuffer)) {
2146         *ppv = &lppsfac;
2147         return S_OK;
2148     }
2149     return E_NOINTERFACE;
2150 }