SUPDrv.c revision f45a3488706ab0f2c1e2f699bfdc6bf5df0d1122
/* $Revision$ */
/** @file
* VirtualBox Support Driver - Shared code.
*/
/*
* Copyright (C) 2006-2007 Sun Microsystems, Inc.
*
* This file is part of VirtualBox Open Source Edition (OSE), as
* available from http://www.virtualbox.org. This file is free software;
* General Public License (GPL) as published by the Free Software
* Foundation, in version 2 as it comes in the "COPYING" file of the
* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
*
* The contents of this file may alternatively be used under the terms
* of the Common Development and Distribution License Version 1.0
* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
* VirtualBox OSE distribution, in which case the provisions of the
* CDDL are applicable instead of those of the GPL.
*
* You may elect to license modified versions of this file under the
* terms and conditions of either the GPL or the CDDL or both.
*
* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
* Clara, CA 95054 USA or visit http://www.sun.com if you need
* additional information or have any questions.
*/
/*******************************************************************************
* Header Files *
*******************************************************************************/
#include "SUPDrvInternal.h"
#ifndef PAGE_SHIFT
#endif
#include <iprt/semaphore.h>
#include <iprt/spinlock.h>
#ifdef RT_OS_LINUX
# define X86_CPUID_VENDOR_AMD_EBX 0x68747541
# define X86_CPUID_VENDOR_AMD_ECX 0x444d4163
# define X86_CPUID_VENDOR_AMD_EDX 0x69746e65
#else
#endif
/*
* Logging assignments:
* Log - useful stuff, like failures.
* LogFlow - program flow, except the really noisy bits.
* Log2 - Cleanup and IDTE
* Log3 - Loader flow noise.
* Log4 - Call VMMR0 flow noise.
* Log5 - Native yet-to-be-defined noise.
* Log6 - Native ioctl flow noise.
*
* Logging requires BUILD_TYPE=debug and possibly changes to the logger
* instanciation in log-vbox.c(pp).
*/
/*******************************************************************************
* Defined Constants And Macros *
*******************************************************************************/
/* from x86.h - clashes with linux thus this duplication */
#define X86_CR0_PE RT_BIT(0)
#define MSR_K6_EFER 0xc0000080
/** The frequency by which we recalculate the u32UpdateHz and
* u32UpdateIntervalNS GIP members. The value must be a power of 2. */
#define GIP_UPDATEHZ_RECALC_FREQ 0x800
/**
* Validates a session pointer.
*
* @param pSession The session.
*/
#define SUP_IS_SESSION_VALID(pSession) \
/*******************************************************************************
* Global Variables *
*******************************************************************************/
/**
* Array of the R0 SUP API.
*/
static SUPFUNC g_aFunctions[] =
{
/* name function */
{ "SUPR0ObjRegister", (void *)SUPR0ObjRegister },
{ "SUPR0ObjAddRef", (void *)SUPR0ObjAddRef },
{ "SUPR0ObjRelease", (void *)SUPR0ObjRelease },
{ "SUPR0ObjVerifyAccess", (void *)SUPR0ObjVerifyAccess },
{ "SUPR0LockMem", (void *)SUPR0LockMem },
{ "SUPR0UnlockMem", (void *)SUPR0UnlockMem },
{ "SUPR0ContAlloc", (void *)SUPR0ContAlloc },
{ "SUPR0ContFree", (void *)SUPR0ContFree },
{ "SUPR0LowAlloc", (void *)SUPR0LowAlloc },
{ "SUPR0LowFree", (void *)SUPR0LowFree },
{ "SUPR0MemAlloc", (void *)SUPR0MemAlloc },
{ "SUPR0MemGetPhys", (void *)SUPR0MemGetPhys },
{ "SUPR0MemFree", (void *)SUPR0MemFree },
{ "SUPR0PageAlloc", (void *)SUPR0PageAlloc },
{ "SUPR0PageFree", (void *)SUPR0PageFree },
{ "SUPR0Printf", (void *)SUPR0Printf },
{ "RTMemAlloc", (void *)RTMemAlloc },
{ "RTMemAllocZ", (void *)RTMemAllocZ },
{ "RTMemFree", (void *)RTMemFree },
/*{ "RTMemDup", (void *)RTMemDup },*/
{ "RTMemRealloc", (void *)RTMemRealloc },
{ "RTR0MemObjAllocLow", (void *)RTR0MemObjAllocLow },
{ "RTR0MemObjAllocPage", (void *)RTR0MemObjAllocPage },
{ "RTR0MemObjAllocPhys", (void *)RTR0MemObjAllocPhys },
{ "RTR0MemObjAllocPhysNC", (void *)RTR0MemObjAllocPhysNC },
{ "RTR0MemObjAllocCont", (void *)RTR0MemObjAllocCont },
{ "RTR0MemObjLockUser", (void *)RTR0MemObjLockUser },
{ "RTR0MemObjMapKernel", (void *)RTR0MemObjMapKernel },
{ "RTR0MemObjMapUser", (void *)RTR0MemObjMapUser },
{ "RTR0MemObjAddress", (void *)RTR0MemObjAddress },
{ "RTR0MemObjAddressR3", (void *)RTR0MemObjAddressR3 },
{ "RTR0MemObjSize", (void *)RTR0MemObjSize },
{ "RTR0MemObjIsMapping", (void *)RTR0MemObjIsMapping },
{ "RTR0MemObjGetPagePhysAddr", (void *)RTR0MemObjGetPagePhysAddr },
{ "RTR0MemObjFree", (void *)RTR0MemObjFree },
/* These don't work yet on linux - use fast mutexes!
{ "RTSemMutexCreate", (void *)RTSemMutexCreate },
{ "RTSemMutexRequest", (void *)RTSemMutexRequest },
{ "RTSemMutexRelease", (void *)RTSemMutexRelease },
{ "RTSemMutexDestroy", (void *)RTSemMutexDestroy },
*/
{ "RTProcSelf", (void *)RTProcSelf },
{ "RTR0ProcHandleSelf", (void *)RTR0ProcHandleSelf },
{ "RTSemFastMutexCreate", (void *)RTSemFastMutexCreate },
{ "RTSemFastMutexDestroy", (void *)RTSemFastMutexDestroy },
{ "RTSemFastMutexRequest", (void *)RTSemFastMutexRequest },
{ "RTSemFastMutexRelease", (void *)RTSemFastMutexRelease },
{ "RTSemEventCreate", (void *)RTSemEventCreate },
{ "RTSemEventSignal", (void *)RTSemEventSignal },
{ "RTSemEventWait", (void *)RTSemEventWait },
{ "RTSemEventWaitNoResume", (void *)RTSemEventWaitNoResume },
{ "RTSemEventDestroy", (void *)RTSemEventDestroy },
{ "RTSemEventMultiCreate", (void *)RTSemEventMultiCreate },
{ "RTSemEventMultiSignal", (void *)RTSemEventMultiSignal },
{ "RTSemEventMultiReset", (void *)RTSemEventMultiReset },
{ "RTSemEventMultiWait", (void *)RTSemEventMultiWait },
{ "RTSemEventMultiWaitNoResume", (void *)RTSemEventMultiWaitNoResume },
{ "RTSemEventMultiDestroy", (void *)RTSemEventMultiDestroy },
{ "RTSpinlockCreate", (void *)RTSpinlockCreate },
{ "RTSpinlockDestroy", (void *)RTSpinlockDestroy },
{ "RTSpinlockAcquire", (void *)RTSpinlockAcquire },
{ "RTSpinlockRelease", (void *)RTSpinlockRelease },
{ "RTSpinlockAcquireNoInts", (void *)RTSpinlockAcquireNoInts },
{ "RTSpinlockReleaseNoInts", (void *)RTSpinlockReleaseNoInts },
{ "RTThreadNativeSelf", (void *)RTThreadNativeSelf },
{ "RTThreadSleep", (void *)RTThreadSleep },
{ "RTThreadYield", (void *)RTThreadYield },
#if 0 /* Thread APIs, Part 2. */
{ "RTThreadSelf", (void *)RTThreadSelf },
{ "RTThreadCreate", (void *)RTThreadCreate },
{ "RTThreadGetNative", (void *)RTThreadGetNative },
{ "RTThreadWait", (void *)RTThreadWait },
{ "RTThreadWaitNoResume", (void *)RTThreadWaitNoResume },
{ "RTThreadGetName", (void *)RTThreadGetName },
{ "RTThreadSelfName", (void *)RTThreadSelfName },
{ "RTThreadGetType", (void *)RTThreadGetType },
{ "RTThreadUserSignal", (void *)RTThreadUserSignal },
{ "RTThreadUserReset", (void *)RTThreadUserReset },
{ "RTThreadUserWait", (void *)RTThreadUserWait },
{ "RTThreadUserWaitNoResume", (void *)RTThreadUserWaitNoResume },
#endif
{ "RTLogDefaultInstance", (void *)RTLogDefaultInstance },
{ "RTMpCpuId", (void *)RTMpCpuId },
{ "RTMpCpuIdFromSetIndex", (void *)RTMpCpuIdFromSetIndex },
{ "RTMpCpuIdToSetIndex", (void *)RTMpCpuIdToSetIndex },
{ "RTMpIsCpuPossible", (void *)RTMpIsCpuPossible },
{ "RTMpGetCount", (void *)RTMpGetCount },
{ "RTMpGetMaxCpuId", (void *)RTMpGetMaxCpuId },
{ "RTMpGetOnlineCount", (void *)RTMpGetOnlineCount },
{ "RTMpGetOnlineSet", (void *)RTMpGetOnlineSet },
{ "RTMpGetSet", (void *)RTMpGetSet },
{ "RTMpIsCpuOnline", (void *)RTMpIsCpuOnline },
{ "RTMpOnAll", (void *)RTMpOnAll },
{ "RTMpOnOthers", (void *)RTMpOnOthers },
{ "RTMpOnSpecific", (void *)RTMpOnSpecific },
{ "RTLogRelDefaultInstance", (void *)RTLogRelDefaultInstance },
{ "RTLogSetDefaultInstanceThread", (void *)RTLogSetDefaultInstanceThread },
{ "RTLogLogger", (void *)RTLogLogger },
{ "RTLogLoggerEx", (void *)RTLogLoggerEx },
{ "RTLogLoggerExV", (void *)RTLogLoggerExV },
{ "RTLogPrintf", (void *)RTLogPrintf },
{ "RTLogPrintfV", (void *)RTLogPrintfV },
{ "AssertMsg1", (void *)AssertMsg1 },
{ "AssertMsg2", (void *)AssertMsg2 },
};
/*******************************************************************************
* Internal Functions *
*******************************************************************************/
#ifdef VBOX_WITH_IDT_PATCHING
static int supdrvIOCtl_IdtInstall(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPIDTINSTALL pReq);
#endif /* VBOX_WITH_IDT_PATCHING */
static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq);
static int supdrvLdrSetR0EP(PSUPDRVDEVEXT pDevExt, void *pvVMMR0, void *pvVMMR0EntryInt, void *pvVMMR0EntryFast, void *pvVMMR0EntryEx);
static SUPPAGINGMODE supdrvIOCtl_GetPagingMode(void);
#ifdef RT_OS_WINDOWS
static int supdrvPageGetPhys(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t cPages, PRTHCPHYS paPages);
#endif /* RT_OS_WINDOWS */
/**
* Initializes the device extentsion structure.
*
* @returns IPRT status code.
* @param pDevExt The device extension to initialize.
*/
{
/*
* Initialize it.
*/
int rc;
if (!rc)
{
if (!rc)
{
if (!rc)
{
if (RT_SUCCESS(rc))
{
return VINF_SUCCESS;
}
}
}
}
return rc;
}
/**
* Delete the device extension (e.g. cleanup members).
*
* @param pDevExt The device extension to delete.
*/
{
#ifdef VBOX_WITH_IDT_PATCHING
#endif
/*
* Kill mutexes and spinlocks.
*/
/*
* Free lists.
*/
#ifdef VBOX_WITH_IDT_PATCHING
/* patches */
/** @todo make sure we don't uninstall patches which has been patched by someone else. */
while (pPatch)
{
}
#endif /* VBOX_WITH_IDT_PATCHING */
/* objects. */
#endif
while (pObj)
{
}
/* usage records. */
while (pUsage)
{
}
/* kill the GIP */
}
/**
* Create session.
*
* @returns IPRT status code.
* @param pDevExt Device extension.
* @param ppSession Where to store the pointer to the session data.
*/
{
/*
* Allocate memory for the session data.
*/
int rc = VERR_NO_MEMORY;
if (pSession)
{
/* Initialize session data. */
if (!rc)
{
/*pSession->pLdrUsage = NULL;
pSession->pPatchUsage = NULL;
pSession->pUsage = NULL;
pSession->pGip = NULL;
pSession->fGipReferenced = false;
pSession->Bundle.cUsed = 0 */
return VINF_SUCCESS;
}
}
return rc;
}
/**
* Shared code for cleaning up a session.
*
* @param pDevExt Device extension.
* @param pSession Session data.
* This data will be freed by this routine.
*/
{
/*
* Cleanup the session first.
*/
/*
* Free the rest of the session stuff.
*/
LogFlow(("supdrvCloseSession: returns\n"));
}
/**
* Shared code for cleaning up a session (but not quite freeing it).
*
* This is primarily intended for MAC OS X where we have to clean up the memory
* stuff before the file handle is closed.
*
* @param pDevExt Device extension.
* @param pSession Session data.
* This data will be freed by this routine.
*/
{
/*
* Remove logger instances related to this session.
*/
#ifdef VBOX_WITH_IDT_PATCHING
/*
* Uninstall any IDT patches installed for this session.
*/
#endif
/*
* Release object references made in this session.
* In theory there should be noone racing us in this session.
*/
Log2(("release objects - start\n"));
{
{
AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
{
}
else
{
/* Destroy the object and free the record. */
else
{
{
break;
}
}
Log(("supdrvCleanupSession: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
if (pObj->pfnDestructor)
}
/* free it and continue. */
}
}
Log2(("release objects - done\n"));
/*
* Release memory allocated in the session.
*
* We do not serialize this as we assume that the application will
* not allocated memory while closing the file handle object.
*/
Log2(("freeing memory:\n"));
while (pBundle)
{
unsigned i;
/*
* Check and unlock all entries in the bundle.
*/
{
{
int rc;
Log2(("eType=%d pvR0=%p pvR3=%p cb=%ld\n", pBundle->aMem[i].eType, RTR0MemObjAddress(pBundle->aMem[i].MemObj),
(void *)RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3), (long)RTR0MemObjSize(pBundle->aMem[i].MemObj)));
{
}
}
}
/*
* Advance and free previous bundle.
*/
}
Log2(("freeing memory - done\n"));
/*
* Loaded images needs to be dereferenced and possibly freed up.
*/
Log2(("freeing images:\n"));
{
while (pUsage)
{
else
}
}
Log2(("freeing images - done\n"));
/*
* Unmap the GIP.
*/
Log2(("umapping GIP:\n"));
{
pSession->fGipReferenced = 0;
}
Log2(("umapping GIP - done\n"));
}
/**
* Fast path I/O Control worker.
*
* @returns VBox status code that should be passed down to ring-3 unchanged.
* @param uIOCtl Function number.
* @param pDevExt Device extention.
* @param pSession Session data.
*/
{
int rc;
/*
* We check the two prereqs after doing this only to allow the compiler to optimize things better.
*/
{
switch (uIOCtl)
{
break;
break;
case SUP_IOCTL_FAST_DO_NOP:
break;
default:
break;
}
}
else
return rc;
}
/**
* Helper for supdrvIOCtl. Check if pszStr contains any character of pszChars.
* We would use strpbrk here if this function would be contained in the RedHat kABI white
* list, see http://www.kerneldrivers.org/RHEL5.
*
* @return 1 if pszStr does contain any character of pszChars, 0 otherwise.
* @param pszStr String to check
* @param pszChars Character set
*/
{
int chCur;
{
int ch;
return 1;
}
return 0;
}
/**
* I/O Control worker.
*
* @returns 0 on success.
* @returns VERR_INVALID_PARAMETER if the request is invalid.
*
* @param uIOCtl Function number.
* @param pDevExt Device extention.
* @param pSession Session data.
* @param pReqHdr The request header.
*/
int VBOXCALL supdrvIOCtl(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPREQHDR pReqHdr)
{
/*
* Validate the request.
*/
/* this first check could probably be omitted as its also done by the OS specific code... */
{
OSDBGPRINT(("vboxdrv: Bad ioctl request header; cbIn=%#lx cbOut=%#lx fFlags=%#lx\n",
return VERR_INVALID_PARAMETER;
}
{
{
return VERR_INVALID_PARAMETER;
}
}
{
OSDBGPRINT(("vboxdrv: bad cookie %#lx / %#lx.\n", (long)pReqHdr->u32Cookie, (long)pReqHdr->u32SessionCookie));
return VERR_INVALID_PARAMETER;
}
/*
* Validation macros
*/
do { \
{ \
OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld. cbOut=%ld expected %ld.\n", \
} \
} while (0)
do { \
{ \
} \
} while (0)
do { \
{ \
} \
} while (0)
do { \
if (RT_UNLIKELY(!(expr))) \
{ \
} \
} while (0)
do { \
if (RT_UNLIKELY(!(expr))) \
{ \
OSDBGPRINT( fmt ); \
} \
} while (0)
/*
* The switch.
*/
switch (SUP_CTL_CODE_NO_SIZE(uIOCtl))
{
{
{
return 0;
}
#if 0
/*
* Call out to the OS specific code and let it do permission checks on the
* client process.
*/
{
return 0;
}
#endif
/*
* Match the version.
* The current logic is very simple, match the major interface version.
*/
{
OSDBGPRINT(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
return 0;
}
/*
* Fill in return data and be gone.
* N.B. The first one to change SUPDRVIOC_VERSION shall makes sure that
* u32SessionVersion <= u32ReqVersion!
*/
/** @todo Somehow validate the client and negotiate a secure cookie... */
return 0;
}
case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_QUERY_FUNCS(0)):
{
/* validate */
REQ_CHECK_SIZES_EX(SUP_IOCTL_QUERY_FUNCS, SUP_IOCTL_QUERY_FUNCS_SIZE_IN, SUP_IOCTL_QUERY_FUNCS_SIZE_OUT(RT_ELEMENTS(g_aFunctions)));
/* execute */
return 0;
}
{
/* validate */
/* execute */
#ifdef VBOX_WITH_IDT_PATCHING
#else
#endif
return 0;
}
{
/* validate */
/* execute */
#ifdef VBOX_WITH_IDT_PATCHING
#else
#endif
return 0;
}
{
/* validate */
/* execute */
return 0;
}
{
/* validate */
/* execute */
return 0;
}
{
/* validate */
/* execute */
pReq->Hdr.rc = SUPR0ContAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.HCPhys);
return 0;
}
{
/* validate */
/* execute */
return 0;
}
{
/* validate */
REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, !supdrvCheckInvalidChar(pReq->u.In.szName, ";:()[]{}/\\|&*%#@!~`\"'"));
/* execute */
return 0;
}
{
/* validate */
REQ_CHECK_SIZES_EX(SUP_IOCTL_LDR_LOAD, SUP_IOCTL_LDR_LOAD_SIZE_IN(pReq->u.In.cbImage), SUP_IOCTL_LDR_LOAD_SIZE_OUT);
{
uint32_t i;
{
("SUP_IOCTL_LDR_LOAD: sym #%ld: symb off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offSymbol, (long)pReq->u.In.cbImage));
("SUP_IOCTL_LDR_LOAD: sym #%ld: name off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImage));
REQ_CHECK_EXPR_FMT(memchr(&pReq->u.In.achImage[pReq->u.In.offStrTab + paSyms[i].offName], '\0', pReq->u.In.cbStrTab - paSyms[i].offName),
("SUP_IOCTL_LDR_LOAD: sym #%ld: unterminated name! (%#lx / %#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImage));
}
}
/* execute */
return 0;
}
{
/* validate */
/* execute */
return 0;
}
{
/* validate */
REQ_CHECK_EXPR(SUP_IOCTL_LDR_GET_SYMBOL, memchr(pReq->u.In.szSymbol, '\0', sizeof(pReq->u.In.szSymbol)));
/* execute */
return 0;
}
case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_VMMR0(0)):
{
/* validate */
Log4(("SUP_IOCTL_CALL_VMMR0: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
{
REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(0), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(0));
/* execute */
pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.uOperation, NULL, pReq->u.In.u64Arg);
else
}
else
{
("SUP_IOCTL_CALL_VMMR0: cbIn=%#x < %#x\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR))));
REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(pVMMReq->cbReq), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(pVMMReq->cbReq));
/* execute */
pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg);
else
}
Log(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
else
Log4(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
return 0;
}
{
/* validate */
/* execute */
return 0;
}
{
/* validate */
REQ_CHECK_SIZES_EX(SUP_IOCTL_LOW_ALLOC, SUP_IOCTL_LOW_ALLOC_SIZE_IN, SUP_IOCTL_LOW_ALLOC_SIZE_OUT(pReq->u.In.cPages));
/* execute */
pReq->Hdr.rc = SUPR0LowAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.aPages[0]);
return 0;
}
{
/* validate */
/* execute */
return 0;
}
{
/* validate */
/* execute */
return 0;
}
{
/* validate */
/* execute */
return 0;
}
{
/* validate */
/* execute */
return 0;
}
{
/* validate */
REQ_CHECK_SIZES_EX(SUP_IOCTL_PAGE_ALLOC, SUP_IOCTL_PAGE_ALLOC_SIZE_IN, SUP_IOCTL_PAGE_ALLOC_SIZE_OUT(pReq->u.In.cPages));
/* execute */
pReq->Hdr.rc = SUPR0PageAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR3, &pReq->u.Out.aPages[0]);
return 0;
}
{
/* validate */
/* execute */
return 0;
}
default:
break;
}
return SUPDRV_ERR_GENERAL_FAILURE;
}
/**
* Inter-Driver Communcation (IDC) worker.
*
* @returns VBox status code.
* @retval VINF_SUCCESS on success.
* @retval VERR_NOT_SUPPORTED if the request isn't supported.
* @retval VERR_NOT_IMPLEMENTED if during development.
* @retval VERR_INVALID_PARAMETER if the request is invalid.
*
* @param uReq The request (function) code.
* @param pDevExt Device extention.
* @param pSession Session data.
* @param pReqHdr The request header.
*/
int VBOXCALL supdrvIDC(uintptr_t uReq, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQHDR pReqHdr)
{
/*
* The OS specific code has already validated the pSession
* pointer, and the request size being greater or equal to
* size of the header.
*
* So, just check that pSession is a kernel context session.
*/
if (RT_UNLIKELY( pSession
return VERR_INVALID_PARAMETER;
/*
* Validation macro.
*/
do { \
{ \
} \
} while (0)
switch (uReq)
{
case SUPDRV_IDC_REQ_CONNECT:
{
return VERR_NOT_IMPLEMENTED;
}
{
return VERR_NOT_IMPLEMENTED;
}
{
return VERR_NOT_IMPLEMENTED;
}
{
return VERR_NOT_IMPLEMENTED;
}
{
return VERR_NOT_IMPLEMENTED;
}
default:
break;
}
return VERR_NOT_SUPPORTED;
}
/**
* Register a object for reference counting.
* The object is registered with one reference in the specified session.
*
* @returns Unique identifier on success (pointer).
* All future reference must use this identifier.
* @returns NULL on failure.
* @param pfnDestructor The destructore function which will be called when the reference count reaches 0.
* @param pvUser1 The first user argument.
* @param pvUser2 The second user argument.
*/
SUPR0DECL(void *) SUPR0ObjRegister(PSUPDRVSESSION pSession, SUPDRVOBJTYPE enmType, PFNSUPDRVDESTRUCTOR pfnDestructor, void *pvUser1, void *pvUser2)
{
/*
* Validate the input.
*/
/*
* Allocate and initialize the object.
*/
if (!pObj)
return NULL;
/*
* Allocate the usage record.
* (We keep freed usage records around to simplify SUPR0ObjAddRef().)
*/
if (pUsage)
else
{
if (!pUsage)
{
return NULL;
}
}
/*
* Insert the object and create the session usage record.
*/
/* The object. */
/* The session record. */
return pObj;
}
/**
* Increment the reference counter for the object associating the reference
* with the specified session.
*
* @returns IPRT status code.
* @param pvObj The identifier returned by SUPR0ObjRegister().
* @param pSession The session which is referencing the object.
*/
{
/*
* Validate the input.
*/
/*
* Preallocate the usage record.
*/
if (pUsagePre)
else
{
if (!pUsagePre)
return VERR_NO_MEMORY;
}
/*
* Reference the object.
*/
/*
* Look for the session record.
*/
{
break;
}
if (pUsage)
else
{
/* create a new session record. */
Log(("SUPR0AddRef: pUsagePre=%p:{.pObj=%p, .pNext=%p}\n", pUsagePre, pUsagePre->pObj, pUsagePre->pNext));
}
/*
* Put any unused usage record into the free list..
*/
if (pUsagePre)
{
}
return VINF_SUCCESS;
}
/**
* Decrement / destroy a reference counter record for an object.
*
* The object is uniquely identified by pfnDestructor+pvUser1+pvUser2.
*
* @returns IPRT status code.
* @param pvObj The identifier returned by SUPR0ObjRegister().
* @param pSession The session which is referencing the object.
*/
{
bool fDestroy = false;
/*
* Validate the input.
*/
/*
* Acquire the spinlock and look for the usage record.
*/
{
{
AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
{
}
else
{
/*
* Free the session record.
*/
if (pUsagePrev)
else
/* What about the object? */
else
{
/*
* Object is to be destroyed, unlink it.
*/
fDestroy = true;
else
{
{
break;
}
}
}
}
break;
}
}
/*
* Call the destructor and free the object if required.
*/
if (fDestroy)
{
Log(("SUPR0ObjRelease: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
if (pObj->pfnDestructor)
}
}
/**
* Verifies that the current process can access the specified object.
*
* @returns The following IPRT status code:
* @retval VINF_SUCCESS if access was granted.
* @retval VERR_PERMISSION_DENIED if denied access.
* @retval VERR_INVALID_PARAMETER if invalid parameter.
*
* @param pvObj The identifier returned by SUPR0ObjRegister().
* @param pSession The session which wishes to access the object.
* @param pszObjName Object string name. This is optional and depends on the object type.
*
* @remark The caller is responsible for making sure the object isn't removed while
* we're inside this function. If uncertain about this, just call AddRef before calling us.
*/
{
int rc;
/*
* Validate the input.
*/
/*
* Check access. (returns true if a decision has been made.)
*/
return rc;
/*
* Default policy is to allow the user to access his own
* stuff but nothing else.
*/
return VINF_SUCCESS;
return VERR_PERMISSION_DENIED;
}
/**
* Lock pages.
*
* @returns IPRT status code.
* @param pSession Session to which the locked memory should be associated.
* @param pvR3 Start of the memory range to lock.
* This must be page aligned.
* @param cb Size of the memory range to lock.
* This must be page aligned.
*/
SUPR0DECL(int) SUPR0LockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t cPages, PRTHCPHYS paPages)
{
int rc;
SUPDRVMEMREF Mem = {0};
LogFlow(("SUPR0LockMem: pSession=%p pvR3=%p cPages=%d paPages=%p\n", pSession, (void *)pvR3, cPages, paPages));
/*
* Verify input.
*/
|| !pvR3)
{
return VERR_INVALID_PARAMETER;
}
#ifdef RT_OS_WINDOWS /* A temporary hack for windows, will be removed once all ring-3 code has been cleaned up. */
/* First check if we allocated it using SUPPageAlloc; if so then we don't need to lock it again */
if (RT_SUCCESS(rc))
return rc;
#endif
/*
* Let IPRT do the job.
*/
if (RT_SUCCESS(rc))
{
AssertMsg(RTR0MemObjAddressR3(Mem.MemObj) == pvR3, ("%p == %p\n", RTR0MemObjAddressR3(Mem.MemObj), pvR3));
while (iPage-- > 0)
{
{
break;
}
}
if (RT_SUCCESS(rc))
if (RT_FAILURE(rc))
{
}
}
return rc;
}
/**
* Unlocks the memory pointed to by pv.
*
* @returns IPRT status code.
* @param pSession Session to which the memory was locked.
* @param pvR3 Memory to unlock.
*/
{
#ifdef RT_OS_WINDOWS
/*
* Temporary hack for windows - SUPR0PageFree will unlock SUPR0PageAlloc
* allocations; ignore this call.
*/
{
LogFlow(("Page will be unlocked in SUPR0PageFree -> ignore\n"));
return VINF_SUCCESS;
}
#endif
}
/**
* Allocates a chunk of page aligned memory with contiguous and fixed physical
* backing.
*
* @returns IPRT status code.
* @param pSession Session data.
* @param cb Number of bytes to allocate.
* @param ppvR0 Where to put the address of Ring-0 mapping the allocated memory.
* @param ppvR3 Where to put the address of Ring-3 mapping the allocated memory.
* @param pHCPhys Where to put the physical address of allocated memory.
*/
SUPR0DECL(int) SUPR0ContAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS pHCPhys)
{
int rc;
SUPDRVMEMREF Mem = {0};
LogFlow(("SUPR0ContAlloc: pSession=%p cPages=%d ppvR0=%p ppvR3=%p pHCPhys=%p\n", pSession, cPages, ppvR0, ppvR3, pHCPhys));
/*
* Validate input.
*/
{
Log(("Null pointer. All of these should be set: pSession=%p ppvR0=%p ppvR3=%p pHCPhys=%p\n",
return VERR_INVALID_PARAMETER;
}
{
return VERR_INVALID_PARAMETER;
}
/*
* Let IPRT do the job.
*/
if (RT_SUCCESS(rc))
{
int rc2;
if (RT_SUCCESS(rc))
{
if (!rc)
{
return 0;
}
}
}
return rc;
}
/**
* Frees memory allocated using SUPR0ContAlloc().
*
* @returns IPRT status code.
* @param pSession The session to which the memory was allocated.
* @param uPtr Pointer to the memory (ring-3 or ring-0).
*/
{
}
/**
* Allocates a chunk of page aligned memory with fixed physical backing below 4GB.
*
* The memory isn't zeroed.
*
* @returns IPRT status code.
* @param pSession Session data.
* @param cPages Number of pages to allocate.
* @param ppvR0 Where to put the address of Ring-0 mapping of the allocated memory.
* @param ppvR3 Where to put the address of Ring-3 mapping of the allocated memory.
* @param paPages Where to put the physical addresses of allocated memory.
*/
SUPR0DECL(int) SUPR0LowAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS paPages)
{
unsigned iPage;
int rc;
SUPDRVMEMREF Mem = {0};
LogFlow(("SUPR0LowAlloc: pSession=%p cPages=%d ppvR3=%p ppvR0=%p paPages=%p\n", pSession, cPages, ppvR3, ppvR0, paPages));
/*
* Validate input.
*/
{
Log(("Null pointer. All of these should be set: pSession=%p ppvR3=%p ppvR0=%p paPages=%p\n",
return VERR_INVALID_PARAMETER;
}
{
return VERR_INVALID_PARAMETER;
}
/*
* Let IPRT do the work.
*/
if (RT_SUCCESS(rc))
{
int rc2;
if (RT_SUCCESS(rc))
{
if (!rc)
{
{
}
return 0;
}
}
}
return rc;
}
/**
* Frees memory allocated using SUPR0LowAlloc().
*
* @returns IPRT status code.
* @param pSession The session to which the memory was allocated.
* @param uPtr Pointer to the memory (ring-3 or ring-0).
*/
{
}
/**
* Allocates a chunk of memory with both R0 and R3 mappings.
* The memory is fixed and it's possible to query the physical addresses using SUPR0MemGetPhys().
*
* @returns IPRT status code.
* @param pSession The session to associated the allocation with.
* @param cb Number of bytes to allocate.
* @param ppvR0 Where to store the address of the Ring-0 mapping.
* @param ppvR3 Where to store the address of the Ring-3 mapping.
*/
{
int rc;
SUPDRVMEMREF Mem = {0};
/*
* Validate input.
*/
{
return VERR_INVALID_PARAMETER;
}
/*
* Let IPRT do the work.
*/
if (RT_SUCCESS(rc))
{
int rc2;
if (RT_SUCCESS(rc))
{
if (!rc)
{
return VINF_SUCCESS;
}
}
}
return rc;
}
/**
* Get the physical addresses of memory allocated using SUPR0MemAlloc().
*
* @returns IPRT status code.
* @param pSession The session to which the memory was allocated.
* @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
* @param paPages Where to store the physical addresses.
*/
SUPR0DECL(int) SUPR0MemGetPhys(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, PSUPPAGE paPages) /** @todo switch this bugger to RTHCPHYS */
{
/*
* Validate input.
*/
/*
* Search for the address.
*/
{
{
unsigned i;
{
)
)
{
unsigned iPage;
{
}
return VINF_SUCCESS;
}
}
}
}
return VERR_INVALID_PARAMETER;
}
/**
* Free memory allocated by SUPR0MemAlloc().
*
* @returns IPRT status code.
* @param pSession The session owning the allocation.
* @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
*/
{
}
/**
* Allocates a chunk of memory with only a R3 mappings.
* The memory is fixed and it's possible to query the physical addresses using SUPR0MemGetPhys().
*
* @returns IPRT status code.
* @param pSession The session to associated the allocation with.
* @param cPages The number of pages to allocate.
* @param ppvR3 Where to store the address of the Ring-3 mapping.
* @param paPages Where to store the addresses of the pages. Optional.
*/
SUPR0DECL(int) SUPR0PageAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR3PTR ppvR3, PRTHCPHYS paPages)
{
int rc;
SUPDRVMEMREF Mem = {0};
/*
* Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
*/
{
Log(("SUPR0PageAlloc: Illegal request cb=%u; must be greater than 0 and smaller than 128MB.\n", cPages));
return VERR_INVALID_PARAMETER;
}
/*
* Let IPRT do the work.
*/
if (RT_SUCCESS(rc))
{
int rc2;
if (RT_SUCCESS(rc))
{
if (!rc)
{
if (paPages)
{
while (iPage-- > 0)
{
}
}
return VINF_SUCCESS;
}
}
}
return rc;
}
#ifdef RT_OS_WINDOWS
/**
* Check if the pages were locked by SUPR0PageAlloc
*
* we've cleaned up the ring-3 code properly.
*
* @returns boolean
* @param pSession The session to which the memory was allocated.
* @param pvR3 The Ring-3 address returned by SUPR0PageAlloc().
*/
{
/*
* Search for the address.
*/
{
{
unsigned i;
{
{
return true;
}
}
}
}
return false;
}
/**
* Get the physical addresses of memory allocated using SUPR0PageAlloc().
*
* we've cleaned up the ring-3 code properly.
*
* @returns IPRT status code.
* @param pSession The session to which the memory was allocated.
* @param pvR3 The Ring-3 address returned by SUPR0PageAlloc().
* @param cPages Number of pages in paPages
* @param paPages Where to store the physical addresses.
*/
static int supdrvPageGetPhys(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t cPages, PRTHCPHYS paPages)
{
LogFlow(("supdrvPageGetPhys: pSession=%p pvR3=%p cPages=%#lx paPages=%p\n", pSession, (void *)pvR3, (long)cPages, paPages));
/*
* Search for the address.
*/
{
{
unsigned i;
{
{
return VINF_SUCCESS;
}
}
}
}
return VERR_INVALID_PARAMETER;
}
#endif /* RT_OS_WINDOWS */
/**
* Free memory allocated by SUPR0PageAlloc().
*
* @returns IPRT status code.
* @param pSession The session owning the allocation.
* @param pvR3 The Ring-3 address returned by SUPR0PageAlloc().
*/
{
}
/**
*
* @returns IPRT status code.
* @param pSession Session to which the GIP mapping should belong.
* @param ppGipR3 Where to store the address of the ring-3 mapping. (optional)
* @param pHCPhysGip Where to store the physical address. (optional)
*
* @remark There is no reference counting on the mapping, so one call to this function
* count globally as one reference. One call to SUPR0GipUnmap() is will unmap GIP
* and remove the session as a GIP user.
*/
{
int rc = 0;
/*
* Validate
*/
{
/*
* Map it?
*/
if (ppGipR3)
{
if (RT_SUCCESS(rc))
{
}
}
/*
* Get physical address.
*/
if (pHCPhysGip && !rc)
/*
* Reference globally.
*/
{
{
unsigned i;
LogFlow(("SUPR0GipMap: Resumes GIP updating\n"));
ASMAtomicXchgU32(&pGip->aCPUs[i].u32TransactionId, pGip->aCPUs[i].u32TransactionId & ~(GIP_UPDATEHZ_RECALC_FREQ * 2 - 1));
}
}
}
else
{
Log(("SUPR0GipMap: GIP is not available!\n"));
}
/*
* Write returns.
*/
if (pHCPhysGip)
*pHCPhysGip = HCPhys;
if (ppGipR3)
#ifdef DEBUG_DARWIN_GIP
OSDBGPRINT(("SUPR0GipMap: returns %d *pHCPhysGip=%lx *ppGip=%p GipMapObjR3\n", rc, (unsigned long)HCPhys, pGip, pSession->GipMapObjR3));
#else
LogFlow(("SUPR0GipMap: returns %d *pHCPhysGip=%lx *ppGipR3=%p\n", rc, (unsigned long)HCPhys, (void *)(uintptr_t)pGip));
#endif
return rc;
}
/**
* Unmaps any user mapping of the GIP and terminates all GIP access
* from this session.
*
* @returns IPRT status code.
* @param pSession Session to which the GIP mapping should belong.
*/
{
int rc = VINF_SUCCESS;
#ifdef DEBUG_DARWIN_GIP
OSDBGPRINT(("SUPR0GipUnmap: pSession=%p pGip=%p GipMapObjR3=%p\n",
pSession->GipMapObjR3));
#else
#endif
/*
* Unmap anything?
*/
{
if (RT_SUCCESS(rc))
}
/*
* Dereference global GIP.
*/
{
pSession->fGipReferenced = 0;
{
LogFlow(("SUPR0GipUnmap: Suspends GIP updating\n"));
}
}
return rc;
}
/**
* Adds a memory object to the session.
*
* @returns IPRT status code.
* @param pMem Memory tracking structure containing the
* information to track.
* @param pSession The session.
*/
{
/*
* Find free entry and record the allocation.
*/
{
{
unsigned i;
{
{
return VINF_SUCCESS;
}
}
AssertFailed(); /* !!this can't be happening!!! */
}
}
/*
* Need to allocate a new bundle.
* Insert into the last entry in the bundle.
*/
if (!pBundle)
return VERR_NO_MEMORY;
/* take last entry. */
/* insert into list. */
return VINF_SUCCESS;
}
/**
* Releases a memory object referenced by pointer and type.
*
* @returns IPRT status code.
* @param pSession Session data.
* @param uPtr Pointer to memory. This is matched against both the R0 and R3 addresses.
* @param eType Memory type.
*/
{
/*
* Validate input.
*/
if (!uPtr)
{
return VERR_INVALID_PARAMETER;
}
/*
* Search for the address.
*/
{
{
unsigned i;
{
)
{
/* Make a copy of it and release it outside the spinlock. */
{
}
{
}
return VINF_SUCCESS;
}
}
}
}
return VERR_INVALID_PARAMETER;
}
#ifdef VBOX_WITH_IDT_PATCHING
/**
* Install IDT for the current CPU.
*
* @returns One of the following IPRT status codes:
* @retval VINF_SUCCESS on success.
* @retval VERR_IDT_FAILED.
* @retval VERR_NO_MEMORY.
* @param pDevExt The device extension.
* @param pSession The session data.
* @param pReq The request.
*/
static int supdrvIOCtl_IdtInstall(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPIDTINSTALL pReq)
{
LogFlow(("supdrvIOCtl_IdtInstall\n"));
/*
* Preallocate entry for this CPU cause we don't wanna do
* that inside the spinlock!
*/
if (!pUsagePre)
return VERR_NO_MEMORY;
/*
* Take the spinlock and see what we need to do.
*/
/* check if we already got a free patch. */
if (!pDevExt->pIdtPatchesFree)
{
/*
* Allocate a patch - outside the spinlock of course.
*/
if (!pPatchPre)
return VERR_NO_MEMORY;
}
else
{
}
/* look for matching patch entry */
ASMGetIDTR(&Idtr);
if (!pPatch)
{
/*
* Create patch.
*/
if (pPatch)
}
else
{
/*
* Simply increment patch usage.
*/
}
if (pPatch)
{
/*
* Increment and add if need be the session usage record for this patch.
*/
if (!pUsage)
{
/*
* Add usage record.
*/
}
else
{
/*
* Increment usage count.
*/
}
}
/* free patch - we accumulate them for paranoid saftly reasons. */
if (pPatchPre)
{
}
/*
* Free unused preallocated buffers.
*/
if (pUsagePre)
}
/**
* This creates a IDT patch entry.
* If the first patch being installed it'll also determin the IDT entry
* to use.
*
* @returns pPatch on success.
* @returns NULL on failure.
* @param pDevExt Pointer to globals.
* @param pPatch Patch entry to use.
* This will be linked into SUPDRVDEVEXT::pIdtPatches on
* successful return.
* @remark Call must be owning the SUPDRVDEVEXT::Spinlock!
*/
{
/*
* Get IDT.
*/
ASMGetIDTR(&Idtr);
/*
* Recent Linux kernels can be configured to 1G user /3G kernel.
*/
{
return NULL;
}
{
/*
* Test out the alternatives.
*
* At the moment we do not support chaining thus we ASSUME that one of
* these 48 entries is unused (which is not a problem on Win32 and
* Linux to my knowledge).
*/
/** @todo we MUST change this detection to try grab an entry which is NOT in use. This can be
* combined with gathering info about which guest system call gates we can hook up directly. */
unsigned i;
{
#ifdef RT_OS_WINDOWS /* We don't use 0xef and above because they are system stuff on linux (ef is IPI,
* local apic timer, or some other frequently fireing thing). */
0xef, 0xee, 0xed, 0xec,
#endif
0xeb, 0xea, 0xe9, 0xe8,
0xdf, 0xde, 0xdd, 0xdc,
0x7b, 0x7a, 0x79, 0x78,
0xbf, 0xbe, 0xbd, 0xbc,
};
#if defined(RT_ARCH_AMD64) && defined(DEBUG)
static int s_iWobble = 0;
{
Log2(("%#x: %04x:%08x%04x%04x P=%d DPL=%d IST=%d Type1=%#x u32Reserved=%#x u5Reserved=%#x\n",
}
#endif
/* look for entries which are not present or otherwise unused. */
{
break;
u8Idt = 0;
}
if (!u8Idt)
{
/* try again, look for a compatible entry .*/
{
break;
u8Idt = 0;
}
if (!u8Idt)
{
Log(("Failed to find appropirate IDT entry!!\n"));
return NULL;
}
}
}
/*
* Prepare the patch
*/
#ifdef RT_ARCH_AMD64
#endif
#ifdef RT_ARCH_AMD64
#else /* x86 */
#endif /* x86 */
/*
* Generate the patch code.
*/
{
#ifdef RT_ARCH_AMD64
union
{
/* check the cookie */
*u.pb++ = 2;
/* jump to forwarder code. */
*u.pb++ = 0xeb;
uFixJmp = u;
*u.pb++ = 0xfe;
// @VBoxCall:
*u.pb++ = 0x01;
*u.pb++ = 0xf8;
/*
* Call VMMR0Entry
* We don't have to push the arguments here, but we have top
* reserve some stack space for the interrupt forwarding.
*/
# ifdef RT_OS_WINDOWS
*u.pb++ = 0x50;
# else
# endif
*u.pb++ = 0x15;
uFixCall = u;
*u.pu32++ = 0;
*u.pb++ = 0x81;
*u.pb++ = 0xc4;
*u.pu32++ = 0x20;
*u.pb++ = 0x01;
*u.pb++ = 0xf8;
/* Return to R3. */
uNotNested = u;
*u.pb++ = 0xcf;
*u.pb++ = 0xcc;
/* Pointer to the VMMR0Entry. */ // pfnVMMR0EntryInt dq StubVMMR0Entry
/* stub entry. */ // StubVMMR0Entry:
*u.pb++ = 0xc0;
*u.pb++ = 0xff;
*u.pb++ = 0xc8;
/* forward to the original handler using a retf. */
*u.pb++ = 0x44;
*u.pb++ = 0x24;
*u.pb++ = 0x04;
*u.pb++ = 0xcb;
#else /* RT_ARCH_X86 */
union
{
/* check the cookie */
*u.pb++ = 0xfe;
uFixJmp = u;
*u.pb++ = 0;
/* jump (far) to the original handler / not-nested-stub. */
uFixJmpNotNested = u;
*u.pu32++ = 0;
*u.pu16++ = 0;
/* save selector registers. */ // VBoxCall:
*u.pb++ = 0xa0;
/* call frame */
/* load ds, es and perhaps fs before call. */
*u.pb++ = 0xd8;
*u.pb++ = 0xc0;
#ifdef RT_OS_WINDOWS
*u.pb++ = 0xe0;
#endif
/* do the call. */
uFixCall = u;
*u.pu32++ = 0xfffffffb;
*u.pb++ = 0xc4;
*u.pb++ = 0x0c;
/* restore selector registers. */
//
*u.pb++ = 0xa1;
uNotNested = u; // NotNested:
/* the stub VMMR0Entry. */ // StubVMMR0Entry:
*u.pb++ = 0xc0;
/* Fixup the VMMR0Entry call. */
else
/* Fixup the forward / nested far jump. */
{
}
else
{
*uFixJmpNotNested.pu32++ = ((uint32_t)pPatch->SavedIdt.u16OffsetHigh << 16) | pPatch->SavedIdt.u16OffsetLow;
}
#endif /* RT_ARCH_X86 */
#if 0
/* dump the patch code */
#endif
}
/*
* Install the patch.
*/
AssertMsg(!memcmp((void *)pPatch->pIdtEntry, &pPatch->ChangedIdt, sizeof(pPatch->ChangedIdt)), ("The stupid change code didn't work!!!!!\n"));
/*
* Link in the patch.
*/
return pPatch;
}
/**
* Removes the sessions IDT references.
* This will uninstall our IDT patch if we left unreferenced.
*
* @returns VINF_SUCCESS.
* @param pDevExt Device globals.
* @param pSession Session data.
*/
{
/*
* Take the spinlock.
*/
/*
* Walk usage list, removing patches as their usage count reaches zero.
*/
while (pUsage)
{
else
/* next */
}
/*
* Empty the usage chain and we're done inside the spinlock.
*/
/*
* Free usage entries.
*/
while (pUsage)
{
}
return VINF_SUCCESS;
}
/**
* Remove one patch.
*
* Worker for supdrvIOCtl_IdtRemoveAll.
*
* @param pDevExt Device globals.
* @param pPatch Patch entry to remove.
* @remark Caller must own SUPDRVDEVEXT::Spinlock!
*/
{
/*
* If the IDT entry was changed it have to kick around for ever!
* This will be attempted freed again, perhaps next time we'll succeed :-)
*/
{
AssertMsgFailed(("The hijacked IDT entry has CHANGED!!!\n"));
return;
}
/*
* Unlink it.
*/
{
while (pPatchPrev)
{
{
break;
}
}
Assert(!pPatchPrev);
}
else
/*
* Verify and restore the IDT.
*/
AssertMsg(!memcmp((void *)pPatch->pIdtEntry, &pPatch->ChangedIdt, sizeof(pPatch->ChangedIdt)), ("The hijacked IDT entry has CHANGED!!!\n"));
AssertMsg(!memcmp((void *)pPatch->pIdtEntry, &pPatch->SavedIdt, sizeof(pPatch->SavedIdt)), ("The hijacked IDT entry has CHANGED!!!\n"));
/*
* Put it in the free list.
* (This free list stuff is to calm my paranoia.)
*/
}
/**
* Write to an IDT entry.
*
* @param pvIdtEntry Where to write.
* @param pNewIDTEntry What to write.
*/
{
/*
* On SMP machines (P4 hyperthreading included) we must preform a
* 64-bit locked write when updating the IDT entry.
*
* The F00F bugfix for linux (and probably other OSes) causes
* the IDT to be pointing to an readonly mapping. We get around that
* by temporarily turning of WP. Since we're inside a spinlock at this
* point, interrupts are disabled and there isn't any way the WP bit
* flipping can cause any trouble.
*/
/* Save & Clear interrupt flag; Save & clear WP. */
uFlags = ASMGetFlags();
/* Update IDT Entry */
#ifdef RT_ARCH_AMD64
#else
#endif
/* Restore CR0 & Flags */
}
#endif /* VBOX_WITH_IDT_PATCHING */
/**
* Opens an image. If it's the first time it's opened the call must upload
* the bits using the supdrvIOCtl_LdrLoad() / SUPDRV_IOCTL_LDR_LOAD function.
*
* This is the 1st step of the loading.
*
* @returns IPRT status code.
* @param pDevExt Device globals.
* @param pSession Session data.
* @param pReq The open request.
*/
{
unsigned cb;
void *pv;
/*
* Check if we got an instance of the image already.
*/
{
{
return VINF_SUCCESS;
}
}
/* (not found - add it!) */
/*
* Allocate memory.
*/
if (!pv)
{
return VERR_NO_MEMORY;
}
/*
* Setup and link in the LDR stuff.
*/
return VINF_SUCCESS;
}
/**
* Loads the image bits.
*
* This is the 2nd step of the loading.
*
* @returns IPRT status code.
* @param pDevExt Device globals.
* @param pSession Session data.
* @param pReq The request.
*/
{
int rc;
LogFlow(("supdrvIOCtl_LdrLoad: pvImageBase=%p cbImage=%d\n", pReq->u.In.pvImageBase, pReq->u.In.cbImage));
/*
* Find the ldr image.
*/
if (!pUsage)
{
Log(("SUP_IOCTL_LDR_LOAD: couldn't find image!\n"));
return VERR_INVALID_HANDLE;
}
{
Log(("SUP_IOCTL_LDR_LOAD: image size mismatch!! %d(prep) != %d(load)\n", pImage->cbImage, pReq->u.In.cbImage));
return VERR_INVALID_HANDLE;
}
{
if (uState != SUP_IOCTL_LDR_LOAD)
return SUPDRV_ERR_ALREADY_LOADED;
}
{
case SUPLDRLOADEP_NOTHING:
break;
case SUPLDRLOADEP_VMMR0:
{
Log(("NULL pointer: pvVMMR0=%p pvVMMR0EntryInt=%p pvVMMR0EntryFast=%p pvVMMR0EntryEx=%p!\n",
return VERR_INVALID_PARAMETER;
}
if ( (uintptr_t)pReq->u.In.EP.VMMR0.pvVMMR0EntryInt - (uintptr_t)pImage->pvImage >= pReq->u.In.cbImage
|| (uintptr_t)pReq->u.In.EP.VMMR0.pvVMMR0EntryFast - (uintptr_t)pImage->pvImage >= pReq->u.In.cbImage
|| (uintptr_t)pReq->u.In.EP.VMMR0.pvVMMR0EntryEx - (uintptr_t)pImage->pvImage >= pReq->u.In.cbImage)
{
Log(("Out of range (%p LB %#x): pvVMMR0EntryInt=%p, pvVMMR0EntryFast=%p or pvVMMR0EntryEx=%p is NULL!\n",
return VERR_INVALID_PARAMETER;
}
break;
default:
return VERR_INVALID_PARAMETER;
}
{
Log(("SUP_IOCTL_LDR_LOAD: pfnModuleInit=%p is outside the image (%p %d bytes)\n",
return VERR_INVALID_PARAMETER;
}
{
Log(("SUP_IOCTL_LDR_LOAD: pfnModuleTerm=%p is outside the image (%p %d bytes)\n",
return VERR_INVALID_PARAMETER;
}
/*
* Copy the memory.
*/
/*
* Update any entry points.
*/
{
default:
case SUPLDRLOADEP_NOTHING:
rc = VINF_SUCCESS;
break;
case SUPLDRLOADEP_VMMR0:
break;
}
/*
* On success call the module initialization.
*/
{
}
if (rc)
return rc;
}
/**
* Frees a previously loaded (prep'ed) image.
*
* @returns IPRT status code.
* @param pDevExt Device globals.
* @param pSession Session data.
* @param pReq The request.
*/
{
int rc;
/*
* Find the ldr image.
*/
pUsagePrev = NULL;
{
pUsagePrev = pUsage;
}
if (!pUsage)
{
Log(("SUP_IOCTL_LDR_FREE: couldn't find image!\n"));
return VERR_INVALID_HANDLE;
}
/*
* Check if we can remove anything.
*/
rc = VINF_SUCCESS;
{
/*
* Check if there are any objects with destructors in the image, if
* so leave it for the session cleanup routine so we get a chance to
* clean things up in the right order and not leave them all dangling.
*/
{
{
break;
}
}
else
{
if (RT_UNLIKELY((uintptr_t)pGenUsage->pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImage))
{
break;
}
}
if (rc == VINF_SUCCESS)
{
/* unlink it */
if (pUsagePrev)
else
/* free it */
/*
* Derefrence the image.
*/
else
}
else
}
else
{
/*
* Dereference both image and usage.
*/
}
return VINF_SUCCESS;
}
/**
* Gets the address of a symbol in an open image.
*
* @returns 0 on success.
* @returns SUPDRV_ERR_* on failure.
* @param pDevExt Device globals.
* @param pSession Session data.
* @param pReq The request buffer.
*/
static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq)
{
uint32_t i;
const char *pchStrings;
int rc = VERR_GENERAL_FAILURE;
Log3(("supdrvIOCtl_LdrGetSymbol: pvImageBase=%p szSymbol=\"%s\"\n", pReq->u.In.pvImageBase, pReq->u.In.szSymbol));
/*
* Find the ldr image.
*/
if (!pUsage)
{
Log(("SUP_IOCTL_LDR_GET_SYMBOL: couldn't find image!\n"));
return VERR_INVALID_HANDLE;
}
{
return VERR_ALREADY_LOADED;
}
/*
* Search the symbol string.
*/
{
{
rc = VINF_SUCCESS;
break;
}
}
return rc;
}
/**
* Updates the IDT patches to point to the specified VMM R0 entry
* point (i.e. VMMR0Enter()).
*
* @returns IPRT status code.
* @param pDevExt Device globals.
* @param pSession Session data.
* @param pVMMR0 VMMR0 image handle.
* @param pvVMMR0EntryInt VMMR0EntryInt address.
* @param pvVMMR0EntryFast VMMR0EntryFast address.
* @param pvVMMR0EntryEx VMMR0EntryEx address.
* @remark Caller must own the loader mutex.
*/
static int supdrvLdrSetR0EP(PSUPDRVDEVEXT pDevExt, void *pvVMMR0, void *pvVMMR0EntryInt, void *pvVMMR0EntryFast, void *pvVMMR0EntryEx)
{
int rc = VINF_SUCCESS;
/*
* Check if not yet set.
*/
{
#ifdef VBOX_WITH_IDT_PATCHING
#endif
/*
* Set it and update IDT patch code.
*/
#ifdef VBOX_WITH_IDT_PATCHING
{
# ifdef RT_ARCH_AMD64
ASMAtomicXchgU64((volatile uint64_t *)&pPatch->auCode[pPatch->offVMMR0EntryFixup], (uint64_t)pvVMMR0);
# else /* RT_ARCH_X86 */
# endif
}
#endif /* VBOX_WITH_IDT_PATCHING */
}
else
{
/*
* Return failure or success depending on whether the values match or not.
*/
{
AssertMsgFailed(("SUP_IOCTL_LDR_SETR0EP: Already set pointing to a different module!\n"));
}
}
return rc;
}
/**
* Unsets the R0 entry point installed by supdrvLdrSetR0EP.
*
* @param pDevExt Device globals.
*/
{
#ifdef VBOX_WITH_IDT_PATCHING
#endif
#ifdef VBOX_WITH_IDT_PATCHING
{
# ifdef RT_ARCH_AMD64
# else /* RT_ARCH_X86 */
(uint32_t)&pPatch->auCode[pPatch->offStub] - (uint32_t)&pPatch->auCode[pPatch->offVMMR0EntryFixup + 4]);
# endif
}
#endif /* VBOX_WITH_IDT_PATCHING */
}
/**
* Adds a usage reference in the specified session of an image.
*
* @param pSession Session in question.
* @param pImage Image which the session is using.
*/
{
/*
* Referenced it already?
*/
while (pUsage)
{
{
return;
}
}
/*
* Allocate new usage record.
*/
if (pUsage)
{
}
/* ignore errors... */
}
/**
* Frees a load image.
*
* @param pDevExt Pointer to device extension.
* @param pImage Pointer to the image we're gonna free.
* This image must exit!
* @remark The caller MUST own SUPDRVDEVEXT::mtxLdr!
*/
{
/* find it - arg. should've used doubly linked list. */
pImagePrev = NULL;
{
}
/* unlink */
if (pImagePrev)
else
/* check if this is VMMR0.r0 and fix the Idt patches if it is. */
/* check for objects with destructors in this image. (Shouldn't happen.) */
{
unsigned cObjs = 0;
{
cObjs++;
}
if (cObjs)
}
/* call termination function if fully loaded. */
if ( pImage->pfnModuleTerm
{
pImage->pfnModuleTerm();
}
/* free the image */
}
/**
* Gets the current paging mode of the CPU and stores in in pOut.
*/
static SUPPAGINGMODE supdrvIOCtl_GetPagingMode(void)
{
else
{
uint32_t fNXEPlusLMA = 0;
if (cr4 & X86_CR4_PAE)
{
{
fNXEPlusLMA |= RT_BIT(0);
}
}
{
case 0:
break;
case X86_CR4_PGE:
break;
case X86_CR4_PAE:
break;
case X86_CR4_PAE | RT_BIT(0):
break;
case X86_CR4_PAE | X86_CR4_PGE:
break;
break;
break;
break;
break;
break;
default:
break;
}
}
return enmMode;
}
/**
* Creates the GIP.
*
* @returns negative errno.
* @param pDevExt Instance data. GIP stuff may be updated.
*/
{
int rc;
LogFlow(("supdrvGipCreate:\n"));
/* assert order */
/*
* Allocate a suitable page with a default kernel mapping.
*/
if (RT_FAILURE(rc))
{
return rc;
}
#if 0 /** @todo Disabled this as we didn't used to do it before and causes unnecessary stress on laptops.
* It only applies to Windows and should probably revisited later, if possible made part of the
* timer code (return min granularity in RTTimerGetSystemGranularity and set it in RTTimerStart). */
/*
* Try bump up the system timer resolution.
* The more interrupts the better...
*/
)
{
}
#endif
/*
* Find a reasonable update interval and initialize the structure.
*/
/*
* Create the timer.
* If CPU_ALL isn't supported we'll have to fall back to synchronous mode.
*/
{
rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, RTTIMER_FLAGS_CPU_ALL, supdrvGipAsyncTimer, pDevExt);
if (rc == VERR_NOT_SUPPORTED)
{
OSDBGPRINT(("supdrvGipCreate: omni timer not supported, falling back to synchronous mode\n"));
}
}
if (RT_SUCCESS(rc))
{
if (RT_SUCCESS(rc))
{
/*
* We're good.
*/
return VINF_SUCCESS;
}
}
else
{
OSDBGPRINT(("supdrvGipCreate: failed create GIP timer at %ld ns interval. rc=%d\n", (long)u32Interval, rc));
}
return rc;
}
/**
* Terminates the GIP.
*
* @param pDevExt Instance data. GIP stuff may be updated.
*/
{
int rc;
#ifdef DEBUG_DARWIN_GIP
#endif
/*
* Invalid the GIP data.
*/
{
}
/*
* Destroy the timer and free the GIP memory object.
*/
{
}
{
}
/*
* Finally, release the system timer resolution request if one succeeded.
*/
{
}
}
/**
* Timer callback function sync GIP mode.
* @param pTimer The timer.
* @param pvUser The device extension.
*/
{
}
/**
* Timer callback function for async GIP mode.
* @param pTimer The timer.
* @param pvUser The device extension.
*/
{
/** @todo reset the transaction number and whatnot when iTick == 1. */
else
}
/**
* Multiprocessor event notification callback.
*
* This is used to make sue that the GIP master gets passed on to
* another CPU.
*
* @param enmEvent The event.
* @param idCpu The cpu it applies to.
* @param pvUser Pointer to the device extension.
*/
{
if (enmEvent == RTMPEVENT_OFFLINE)
{
if (idGipMaster == idCpu)
{
/*
* Find a new GIP master.
*/
bool fIgnored;
unsigned i;
for (i = 0; i < RTCPUSET_MAX_CPUS; i++)
{
&& idCurCpu != idGipMaster)
{
break;
}
}
}
}
}
/**
* Initializes the GIP data.
*
* @returns IPRT status code.
* @param pDevExt Pointer to the device instance data.
* @param pGip Pointer to the read-write kernel mapping of the GIP.
* @param HCPhys The physical address of the GIP.
* @param u64NanoTS The current nanosecond timestamp.
* @param uUpdateHz The update freqence.
*/
int VBOXCALL supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys, uint64_t u64NanoTS, unsigned uUpdateHz)
{
unsigned i;
#ifdef DEBUG_DARWIN_GIP
OSDBGPRINT(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
#else
LogFlow(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
#endif
/*
* Initialize the structure.
*/
{
/*
* We don't know the following values until we've executed updates.
* So, we'll just insert very high values.
*/
}
/*
* Link it to the device extension.
*/
return VINF_SUCCESS;
}
/**
* Callback used by supdrvDetermineAsyncTSC to read the TSC on a CPU.
*
* @param idCpu Ignored.
* @param pvUser1 Where to put the TSC.
* @param pvUser2 Ignored.
*/
static DECLCALLBACK(void) supdrvDetermineAsyncTscWorker(RTCPUID idCpu, void *pvUser1, void *pvUser2)
{
#if 1
#else
#endif
}
/**
* Determine if Async GIP mode is required because of TSC drift.
*
* (TSC) runs never backwards, that is, a read operation to the counter should return
* a bigger value than any previous read operation. This is guaranteed by the latest
* AMD CPUs and by newer Intel CPUs which never enter the C2 state (P4). In any other
* case we have to choose the asynchronous timer mode.
*
* @param poffMin Pointer to the determined difference between different cores.
* @return false if the time stamp counters appear to be synchron, true otherwise.
*/
{
/*
* Just iterate all the cpus 8 times and make sure that the TSC is
* ever increasing. We don't bother taking TSC rollover into account.
*/
int iCpu;
int cLoops = 8;
bool fAsync = false;
int rc;
while (cLoops-- > 0)
{
{
if (RT_SUCCESS(rc))
{
{
fAsync = true;
dprintf(("supdrvDetermineAsyncTsc: iCpu=%d cLoops=%d CurTsc=%llx PrevTsc=%llx\n",
break;
}
/* Gather statistics (except the first time). */
{
}
/* Next */
}
else if (rc == VERR_NOT_SUPPORTED)
break;
else
}
/* broke out of the loop. */
break;
}
dprintf(("supdrvDetermineAsyncTsc: returns %d; iLastCpu=%d rc=%d offMin=%llx offMax=%llx\n",
#endif
return fAsync;
}
/**
* Determin the GIP TSC mode.
*
* @returns The most suitable TSC mode.
* @param pDevExt Pointer to the device instance data.
*/
{
/*
* On SMP we're faced with two problems:
* (1) There might be a skew between the CPU, so that cpu0
* returns a TSC that is sligtly different from cpu1.
* (2) Power management (and other things) may cause the TSC
* to run at a non-constant speed, and cause the speed
* to be different on the cpus. This will result in (1).
*
* So, on SMP systems we'll have to select the ASYNC update method
* if there are symphoms of these problems.
*/
if (RTMpGetCount() > 1)
{
return SUPGIPMODE_ASYNC_TSC;
/* Try check for current differences between the cpus. */
return SUPGIPMODE_ASYNC_TSC;
/*
* If the CPU supports power management and is an AMD one we
* won't trust it unless it has the TscInvariant bit is set.
*/
/* Check for "AuthenticAMD" */
if ( uEAX >= 1
&& uEBX == X86_CPUID_VENDOR_AMD_EBX
&& uECX == X86_CPUID_VENDOR_AMD_ECX
&& uEDX == X86_CPUID_VENDOR_AMD_EDX)
{
/* Check for APM support and that TscInvariant is cleared. */
if (uEAX >= 0x80000007)
{
return SUPGIPMODE_ASYNC_TSC;
}
}
}
return SUPGIPMODE_SYNC_TSC;
}
/**
* Invalidates the GIP data upon termination.
*
* @param pGip Pointer to the read-write kernel mapping of the GIP.
*/
{
unsigned i;
{
}
}
/**
* Worker routine for supdrvGipUpdate and supdrvGipUpdatePerCpu that
* updates all the per cpu data except the transaction id.
*
* @param pGip The GIP.
* @param pGipCpu Pointer to the per cpu data.
* @param u64NanoTS The current time stamp.
*/
{
unsigned iTSCHistoryHead;
/*
* Update the NanoTS.
*/
/*
* Calc TSC delta.
*/
/** @todo validate the NanoTS delta, don't trust the OS to call us when it should... */
u64TSC = ASMReadTSC();
if (u64TSCDelta >> 32)
{
}
/*
* TSC History.
*/
/*
* UpdateIntervalTSC = average of last 8,2,1 intervals depending on update HZ.
*/
{
u32 >>= 2;
u32UpdateIntervalTSC >>= 2;
u32UpdateIntervalTSC >>= 1;
/* Value choosen for a 2GHz Athlon64 running linux 2.6.10/11, . */
}
{
u32UpdateIntervalTSC >>= 1;
/* value choosen on a 2GHz thinkpad running windows */
}
else
{
/* This value hasn't be checked yet.. waiting for OS/2 and 33Hz timers.. :-) */
}
/*
* CpuHz.
*/
}
/**
* Updates the GIP.
*
* @param pGip Pointer to the GIP.
* @param u64NanoTS The current nanosecond timesamp.
*/
{
/*
* Determin the relevant CPU data.
*/
else
{
unsigned iCpu = ASMGetApicId();
return;
}
/*
* Start update transaction.
*/
{
/* this can happen on win32 if we're taking to long and there are more CPUs around. shouldn't happen though. */
return;
}
/*
* Recalc the update frequency every 0x800th time.
*/
{
if (pGip->u64NanoTSLastUpdateHz)
{
#ifdef RT_ARCH_AMD64 /** @todo fix 64-bit div here to work on x86 linux. */
{
}
#endif
}
}
/*
* Update the data.
*/
/*
* Complete transaction.
*/
}
/**
* Updates the per cpu GIP data for the calling cpu.
*
* @param pGip Pointer to the GIP.
* @param u64NanoTS The current nanosecond timesamp.
* @param iCpu The CPU index.
*/
{
{
/*
* Start update transaction.
*/
{
return;
}
/*
* Update the data.
*/
/*
* Complete transaction.
*/
}
}
#ifndef DEBUG /** @todo change #ifndef DEBUG -> #ifdef LOG_ENABLED */
/**
* Stub function for non-debug builds.
*/
{
return NULL;
}
{
return NULL;
}
/**
* Stub function for non-debug builds.
*/
{
return 0;
}
/**
* Stub function for non-debug builds.
*/
{
}
/**
* Stub function for non-debug builds.
*/
RTDECL(void) RTLogLoggerEx(PRTLOGGER pLogger, unsigned fFlags, unsigned iGroup, const char *pszFormat, ...)
{
}
/**
* Stub function for non-debug builds.
*/
RTDECL(void) RTLogLoggerExV(PRTLOGGER pLogger, unsigned fFlags, unsigned iGroup, const char *pszFormat, va_list args)
{
}
/**
* Stub function for non-debug builds.
*/
{
}
/**
* Stub function for non-debug builds.
*/
{
}
#endif /* !DEBUG */