VirtualBox

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPDrv.c@ 26512

Last change on this file since 26512 was 26430, checked in by vboxsync, 15 years ago

Introducing RTR0MemObjAllocPhysEx
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 193.1 KB
Line 
1/* $Revision: 26430 $ */
2/** @file
3 * VBoxDrv - The VirtualBox Support Driver - Common code.
4 */
5
6/*
7 * Copyright (C) 2006-2009 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 *
26 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
27 * Clara, CA 95054 USA or visit http://www.sun.com if you need
28 * additional information or have any questions.
29 */
30
31/*******************************************************************************
32* Header Files *
33*******************************************************************************/
34#define LOG_GROUP LOG_GROUP_SUP_DRV
35#define SUPDRV_AGNOSTIC
36#include "SUPDrvInternal.h"
37#ifndef PAGE_SHIFT
38# include <iprt/param.h>
39#endif
40#include <iprt/alloc.h>
41#include <iprt/cpuset.h>
42#include <iprt/handletable.h>
43#include <iprt/mp.h>
44#include <iprt/power.h>
45#include <iprt/process.h>
46#include <iprt/semaphore.h>
47#include <iprt/spinlock.h>
48#include <iprt/thread.h>
49#include <iprt/uuid.h>
50#if defined(RT_OS_DARWIN) || defined(RT_OS_SOLARIS) || defined(RT_OS_FREEBSD)
51# include <iprt/crc32.h>
52# include <iprt/net.h>
53# include <iprt/string.h>
54# include <iprt/rand.h>
55# include <iprt/path.h>
56#endif
57
58#include <VBox/param.h>
59#include <VBox/log.h>
60#include <VBox/err.h>
61#include <VBox/hwacc_svm.h>
62#include <VBox/hwacc_vmx.h>
63#include <VBox/x86.h>
64
65/*
66 * Logging assignments:
67 * Log - useful stuff, like failures.
68 * LogFlow - program flow, except the really noisy bits.
69 * Log2 - Cleanup.
70 * Log3 - Loader flow noise.
71 * Log4 - Call VMMR0 flow noise.
72 * Log5 - Native yet-to-be-defined noise.
73 * Log6 - Native ioctl flow noise.
74 *
75 * Logging requires BUILD_TYPE=debug and possibly changes to the logger
76 * instanciation in log-vbox.c(pp).
77 */
78
79
80/*******************************************************************************
81* Defined Constants And Macros *
82*******************************************************************************/
83/** The frequency by which we recalculate the u32UpdateHz and
84 * u32UpdateIntervalNS GIP members. The value must be a power of 2. */
85#define GIP_UPDATEHZ_RECALC_FREQ 0x800
86
87/** @def VBOX_SVN_REV
88 * The makefile should define this if it can. */
89#ifndef VBOX_SVN_REV
90# define VBOX_SVN_REV 0
91#endif
92
93
94/*******************************************************************************
95* Internal Functions *
96*******************************************************************************/
97static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void *pvObj, void *pvCtx, void *pvUser);
98static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void *pvObj, void *pvCtx, void *pvUser);
99static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession);
100static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType);
101static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq);
102static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq);
103static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq);
104static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq);
105static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq);
106static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void *pvVMMR0, void *pvVMMR0EntryInt, void *pvVMMR0EntryFast, void *pvVMMR0EntryEx);
107static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt);
108static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage);
109static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage);
110DECLINLINE(int) supdrvLdrLock(PSUPDRVDEVEXT pDevExt);
111DECLINLINE(int) supdrvLdrUnlock(PSUPDRVDEVEXT pDevExt);
112static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq);
113static int supdrvIOCtl_LoggerSettings(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLOGGERSETTINGS pReq);
114static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt);
115static void supdrvGipDestroy(PSUPDRVDEVEXT pDevExt);
116static DECLCALLBACK(void) supdrvGipSyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick);
117static DECLCALLBACK(void) supdrvGipAsyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick);
118static DECLCALLBACK(void) supdrvGipMpEvent(RTMPEVENT enmEvent, RTCPUID idCpu, void *pvUser);
119static void supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys, uint64_t u64NanoTS, unsigned uUpdateHz);
120static void supdrvGipTerm(PSUPGLOBALINFOPAGE pGip);
121static void supdrvGipUpdate(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, uint64_t u64TSC, uint64_t iTick);
122static void supdrvGipUpdatePerCpu(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, uint64_t u64TSC, unsigned iCpu, uint64_t iTick);
123
124
125/*******************************************************************************
126* Global Variables *
127*******************************************************************************/
128DECLEXPORT(PSUPGLOBALINFOPAGE) g_pSUPGlobalInfoPage = NULL;
129
130/**
131 * Array of the R0 SUP API.
132 */
133static SUPFUNC g_aFunctions[] =
134{
135 /* name function */
136 /* Entries with absolute addresses determined at runtime, fixup
137 code makes ugly ASSUMPTIONS about the order here: */
138 { "SUPR0AbsIs64bit", (void *)0 },
139 { "SUPR0Abs64bitKernelCS", (void *)0 },
140 { "SUPR0Abs64bitKernelSS", (void *)0 },
141 { "SUPR0Abs64bitKernelDS", (void *)0 },
142 { "SUPR0AbsKernelCS", (void *)0 },
143 { "SUPR0AbsKernelSS", (void *)0 },
144 { "SUPR0AbsKernelDS", (void *)0 },
145 { "SUPR0AbsKernelES", (void *)0 },
146 { "SUPR0AbsKernelFS", (void *)0 },
147 { "SUPR0AbsKernelGS", (void *)0 },
148 /* Normal function pointers: */
149 { "SUPR0ComponentRegisterFactory", (void *)SUPR0ComponentRegisterFactory },
150 { "SUPR0ComponentDeregisterFactory", (void *)SUPR0ComponentDeregisterFactory },
151 { "SUPR0ComponentQueryFactory", (void *)SUPR0ComponentQueryFactory },
152 { "SUPR0ObjRegister", (void *)SUPR0ObjRegister },
153 { "SUPR0ObjAddRef", (void *)SUPR0ObjAddRef },
154 { "SUPR0ObjAddRefEx", (void *)SUPR0ObjAddRefEx },
155 { "SUPR0ObjRelease", (void *)SUPR0ObjRelease },
156 { "SUPR0ObjVerifyAccess", (void *)SUPR0ObjVerifyAccess },
157 { "SUPR0LockMem", (void *)SUPR0LockMem },
158 { "SUPR0UnlockMem", (void *)SUPR0UnlockMem },
159 { "SUPR0ContAlloc", (void *)SUPR0ContAlloc },
160 { "SUPR0ContFree", (void *)SUPR0ContFree },
161 { "SUPR0LowAlloc", (void *)SUPR0LowAlloc },
162 { "SUPR0LowFree", (void *)SUPR0LowFree },
163 { "SUPR0MemAlloc", (void *)SUPR0MemAlloc },
164 { "SUPR0MemGetPhys", (void *)SUPR0MemGetPhys },
165 { "SUPR0MemFree", (void *)SUPR0MemFree },
166 { "SUPR0PageAllocEx", (void *)SUPR0PageAllocEx },
167 { "SUPR0PageFree", (void *)SUPR0PageFree },
168 { "SUPR0Printf", (void *)SUPR0Printf }, /** @todo needs wrapping? */
169 { "SUPSemEventCreate", (void *)SUPSemEventCreate },
170 { "SUPSemEventClose", (void *)SUPSemEventClose },
171 { "SUPSemEventSignal", (void *)SUPSemEventSignal },
172 { "SUPSemEventWait", (void *)SUPSemEventWait },
173 { "SUPSemEventWaitNoResume", (void *)SUPSemEventWaitNoResume },
174 { "SUPSemEventMultiCreate", (void *)SUPSemEventMultiCreate },
175 { "SUPSemEventMultiClose", (void *)SUPSemEventMultiClose },
176 { "SUPSemEventMultiSignal", (void *)SUPSemEventMultiSignal },
177 { "SUPSemEventMultiReset", (void *)SUPSemEventMultiReset },
178 { "SUPSemEventMultiWait", (void *)SUPSemEventMultiWait },
179 { "SUPSemEventMultiWaitNoResume", (void *)SUPSemEventMultiWaitNoResume },
180 { "SUPR0GetPagingMode", (void *)SUPR0GetPagingMode },
181 { "SUPR0EnableVTx", (void *)SUPR0EnableVTx },
182 { "SUPGetGIP", (void *)SUPGetGIP },
183 { "g_pSUPGlobalInfoPage", (void *)&g_pSUPGlobalInfoPage },
184 { "RTMemAlloc", (void *)RTMemAlloc },
185 { "RTMemAllocZ", (void *)RTMemAllocZ },
186 { "RTMemFree", (void *)RTMemFree },
187 /*{ "RTMemDup", (void *)RTMemDup },
188 { "RTMemDupEx", (void *)RTMemDupEx },*/
189 { "RTMemRealloc", (void *)RTMemRealloc },
190 { "RTR0MemObjAllocLow", (void *)RTR0MemObjAllocLow },
191 { "RTR0MemObjAllocPage", (void *)RTR0MemObjAllocPage },
192 { "RTR0MemObjAllocPhys", (void *)RTR0MemObjAllocPhys },
193 { "RTR0MemObjAllocPhysEx", (void *)RTR0MemObjAllocPhysEx },
194 { "RTR0MemObjAllocPhysNC", (void *)RTR0MemObjAllocPhysNC },
195 { "RTR0MemObjAllocCont", (void *)RTR0MemObjAllocCont },
196 { "RTR0MemObjEnterPhys", (void *)RTR0MemObjEnterPhys },
197 { "RTR0MemObjLockUser", (void *)RTR0MemObjLockUser },
198 { "RTR0MemObjMapKernel", (void *)RTR0MemObjMapKernel },
199 { "RTR0MemObjMapKernelEx", (void *)RTR0MemObjMapKernelEx },
200 { "RTR0MemObjMapUser", (void *)RTR0MemObjMapUser },
201 { "RTR0MemObjProtect", (void *)RTR0MemObjProtect },
202 { "RTR0MemObjAddress", (void *)RTR0MemObjAddress },
203 { "RTR0MemObjAddressR3", (void *)RTR0MemObjAddressR3 },
204 { "RTR0MemObjSize", (void *)RTR0MemObjSize },
205 { "RTR0MemObjIsMapping", (void *)RTR0MemObjIsMapping },
206 { "RTR0MemObjGetPagePhysAddr", (void *)RTR0MemObjGetPagePhysAddr },
207 { "RTR0MemObjFree", (void *)RTR0MemObjFree },
208 { "RTR0MemUserCopyFrom", (void *)RTR0MemUserCopyFrom },
209 { "RTR0MemUserCopyTo", (void *)RTR0MemUserCopyTo },
210 { "RTR0MemUserIsValidAddr", (void *)RTR0MemUserIsValidAddr },
211 { "RTR0MemKernelIsValidAddr", (void *)RTR0MemKernelIsValidAddr },
212 { "RTR0MemAreKrnlAndUsrDifferent", (void *)RTR0MemAreKrnlAndUsrDifferent },
213/* These don't work yet on linux - use fast mutexes!
214 { "RTSemMutexCreate", (void *)RTSemMutexCreate },
215 { "RTSemMutexRequest", (void *)RTSemMutexRequest },
216 { "RTSemMutexRelease", (void *)RTSemMutexRelease },
217 { "RTSemMutexDestroy", (void *)RTSemMutexDestroy },
218*/
219 { "RTProcSelf", (void *)RTProcSelf },
220 { "RTR0ProcHandleSelf", (void *)RTR0ProcHandleSelf },
221 { "RTSemFastMutexCreate", (void *)RTSemFastMutexCreate },
222 { "RTSemFastMutexDestroy", (void *)RTSemFastMutexDestroy },
223 { "RTSemFastMutexRequest", (void *)RTSemFastMutexRequest },
224 { "RTSemFastMutexRelease", (void *)RTSemFastMutexRelease },
225 { "RTSemEventCreate", (void *)RTSemEventCreate },
226 { "RTSemEventSignal", (void *)RTSemEventSignal },
227 { "RTSemEventWait", (void *)RTSemEventWait },
228 { "RTSemEventWaitNoResume", (void *)RTSemEventWaitNoResume },
229 { "RTSemEventDestroy", (void *)RTSemEventDestroy },
230 { "RTSemEventMultiCreate", (void *)RTSemEventMultiCreate },
231 { "RTSemEventMultiSignal", (void *)RTSemEventMultiSignal },
232 { "RTSemEventMultiReset", (void *)RTSemEventMultiReset },
233 { "RTSemEventMultiWait", (void *)RTSemEventMultiWait },
234 { "RTSemEventMultiWaitNoResume", (void *)RTSemEventMultiWaitNoResume },
235 { "RTSemEventMultiDestroy", (void *)RTSemEventMultiDestroy },
236 { "RTSpinlockCreate", (void *)RTSpinlockCreate },
237 { "RTSpinlockDestroy", (void *)RTSpinlockDestroy },
238 { "RTSpinlockAcquire", (void *)RTSpinlockAcquire },
239 { "RTSpinlockRelease", (void *)RTSpinlockRelease },
240 { "RTSpinlockAcquireNoInts", (void *)RTSpinlockAcquireNoInts },
241 { "RTSpinlockReleaseNoInts", (void *)RTSpinlockReleaseNoInts },
242 { "RTTimeNanoTS", (void *)RTTimeNanoTS },
243 { "RTTimeMilliTS", (void *)RTTimeMilliTS },
244 { "RTTimeSystemNanoTS", (void *)RTTimeSystemNanoTS },
245 { "RTTimeSystemMilliTS", (void *)RTTimeSystemMilliTS },
246 { "RTThreadNativeSelf", (void *)RTThreadNativeSelf },
247 { "RTThreadSleep", (void *)RTThreadSleep },
248 { "RTThreadYield", (void *)RTThreadYield },
249#if 0 /* Thread APIs, Part 2. */
250 { "RTThreadSelf", (void *)RTThreadSelf },
251 { "RTThreadCreate", (void *)RTThreadCreate },
252 { "RTThreadGetNative", (void *)RTThreadGetNative },
253 { "RTThreadWait", (void *)RTThreadWait },
254 { "RTThreadWaitNoResume", (void *)RTThreadWaitNoResume },
255 { "RTThreadGetName", (void *)RTThreadGetName },
256 { "RTThreadSelfName", (void *)RTThreadSelfName },
257 { "RTThreadGetType", (void *)RTThreadGetType },
258 { "RTThreadUserSignal", (void *)RTThreadUserSignal },
259 { "RTThreadUserReset", (void *)RTThreadUserReset },
260 { "RTThreadUserWait", (void *)RTThreadUserWait },
261 { "RTThreadUserWaitNoResume", (void *)RTThreadUserWaitNoResume },
262#endif
263 { "RTThreadPreemptIsEnabled", (void *)RTThreadPreemptIsEnabled },
264 { "RTThreadPreemptIsPending", (void *)RTThreadPreemptIsPending },
265 { "RTThreadPreemptIsPendingTrusty", (void *)RTThreadPreemptIsPendingTrusty },
266 { "RTThreadPreemptIsPossible", (void *)RTThreadPreemptIsPossible },
267 { "RTThreadPreemptDisable", (void *)RTThreadPreemptDisable },
268 { "RTThreadPreemptRestore", (void *)RTThreadPreemptRestore },
269 { "RTThreadIsInInterrupt", (void *)RTThreadIsInInterrupt },
270
271 { "RTLogDefaultInstance", (void *)RTLogDefaultInstance },
272 { "RTMpCpuId", (void *)RTMpCpuId },
273 { "RTMpCpuIdFromSetIndex", (void *)RTMpCpuIdFromSetIndex },
274 { "RTMpCpuIdToSetIndex", (void *)RTMpCpuIdToSetIndex },
275 { "RTMpIsCpuPossible", (void *)RTMpIsCpuPossible },
276 { "RTMpGetCount", (void *)RTMpGetCount },
277 { "RTMpGetMaxCpuId", (void *)RTMpGetMaxCpuId },
278 { "RTMpGetOnlineCount", (void *)RTMpGetOnlineCount },
279 { "RTMpGetOnlineSet", (void *)RTMpGetOnlineSet },
280 { "RTMpGetSet", (void *)RTMpGetSet },
281 { "RTMpIsCpuOnline", (void *)RTMpIsCpuOnline },
282 { "RTMpIsCpuWorkPending", (void *)RTMpIsCpuWorkPending },
283 { "RTMpOnAll", (void *)RTMpOnAll },
284 { "RTMpOnOthers", (void *)RTMpOnOthers },
285 { "RTMpOnSpecific", (void *)RTMpOnSpecific },
286 { "RTMpPokeCpu", (void *)RTMpPokeCpu },
287 { "RTPowerNotificationRegister", (void *)RTPowerNotificationRegister },
288 { "RTPowerNotificationDeregister", (void *)RTPowerNotificationDeregister },
289 { "RTLogRelDefaultInstance", (void *)RTLogRelDefaultInstance },
290 { "RTLogSetDefaultInstanceThread", (void *)RTLogSetDefaultInstanceThread },
291 { "RTLogLoggerExV", (void *)RTLogLoggerExV },
292 { "RTLogPrintfV", (void *)RTLogPrintfV },
293 { "RTR0AssertPanicSystem", (void *)RTR0AssertPanicSystem },
294 { "RTAssertMsg1", (void *)RTAssertMsg1 },
295 { "RTAssertMsg2V", (void *)RTAssertMsg2V },
296 { "RTAssertSetQuiet", (void *)RTAssertSetQuiet },
297 { "RTAssertMayPanic", (void *)RTAssertMayPanic },
298 { "RTAssertSetMayPanic", (void *)RTAssertSetMayPanic },
299 { "RTAssertAreQuiet", (void *)RTAssertAreQuiet },
300};
301
302#if defined(RT_OS_DARWIN) || defined(RT_OS_SOLARIS) || defined(RT_OS_FREEBSD)
303/**
304 * Drag in the rest of IRPT since we share it with the
305 * rest of the kernel modules on darwin.
306 */
307PFNRT g_apfnVBoxDrvIPRTDeps[] =
308{
309 /* VBoxNetFlt */
310 (PFNRT)RTCrc32,
311 (PFNRT)RTErrConvertFromErrno,
312 (PFNRT)RTNetIPv4IsHdrValid,
313 (PFNRT)RTNetIPv4TCPChecksum,
314 (PFNRT)RTNetIPv4UDPChecksum,
315 (PFNRT)RTUuidCompare,
316 (PFNRT)RTUuidCompareStr,
317 (PFNRT)RTUuidFromStr,
318 (PFNRT)RTStrDup,
319 (PFNRT)RTStrFree,
320 /* VBoxNetAdp */
321 (PFNRT)RTRandBytes,
322 /* VBoxUSB */
323 (PFNRT)RTPathStripFilename,
324 NULL
325};
326#endif /* RT_OS_DARWIN || RT_OS_SOLARIS || RT_OS_SOLARIS */
327
328
329/**
330 * Initializes the device extentsion structure.
331 *
332 * @returns IPRT status code.
333 * @param pDevExt The device extension to initialize.
334 * @param cbSession The size of the session structure. The size of
335 * SUPDRVSESSION may be smaller when SUPDRV_AGNOSTIC is
336 * defined because we're skipping the OS specific members
337 * then.
338 */
339int VBOXCALL supdrvInitDevExt(PSUPDRVDEVEXT pDevExt, size_t cbSession)
340{
341 int rc;
342
343#ifdef SUPDRV_WITH_RELEASE_LOGGER
344 /*
345 * Create the release log.
346 */
347 static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
348 PRTLOGGER pRelLogger;
349 rc = RTLogCreate(&pRelLogger, 0 /* fFlags */, "all",
350 "VBOX_RELEASE_LOG", RT_ELEMENTS(s_apszGroups), s_apszGroups,
351 RTLOGDEST_STDOUT | RTLOGDEST_DEBUGGER, NULL);
352 if (RT_SUCCESS(rc))
353 RTLogRelSetDefaultInstance(pRelLogger);
354 /** @todo Add native hook for getting logger config parameters and setting
355 * them. On linux we should use the module parameter stuff... */
356#endif
357
358 /*
359 * Initialize it.
360 */
361 memset(pDevExt, 0, sizeof(*pDevExt));
362 rc = RTSpinlockCreate(&pDevExt->Spinlock);
363 if (RT_SUCCESS(rc))
364 {
365#ifdef SUPDRV_USE_MUTEX_FOR_LDR
366 rc = RTSemMutexCreate(&pDevExt->mtxLdr);
367#else
368 rc = RTSemFastMutexCreate(&pDevExt->mtxLdr);
369#endif
370 if (RT_SUCCESS(rc))
371 {
372 rc = RTSemFastMutexCreate(&pDevExt->mtxComponentFactory);
373 if (RT_SUCCESS(rc))
374 {
375#ifdef SUPDRV_USE_MUTEX_FOR_LDR
376 rc = RTSemMutexCreate(&pDevExt->mtxGip);
377#else
378 rc = RTSemFastMutexCreate(&pDevExt->mtxGip);
379#endif
380 if (RT_SUCCESS(rc))
381 {
382 rc = supdrvGipCreate(pDevExt);
383 if (RT_SUCCESS(rc))
384 {
385 pDevExt->u32Cookie = BIRD; /** @todo make this random? */
386 pDevExt->cbSession = cbSession;
387
388 /*
389 * Fixup the absolute symbols.
390 *
391 * Because of the table indexing assumptions we'll have a little #ifdef orgy
392 * here rather than distributing this to OS specific files. At least for now.
393 */
394#ifdef RT_OS_DARWIN
395# if ARCH_BITS == 32
396 if (SUPR0GetPagingMode() >= SUPPAGINGMODE_AMD64)
397 {
398 g_aFunctions[0].pfn = (void *)1; /* SUPR0AbsIs64bit */
399 g_aFunctions[1].pfn = (void *)0x80; /* SUPR0Abs64bitKernelCS - KERNEL64_CS, seg.h */
400 g_aFunctions[2].pfn = (void *)0x88; /* SUPR0Abs64bitKernelSS - KERNEL64_SS, seg.h */
401 g_aFunctions[3].pfn = (void *)0x88; /* SUPR0Abs64bitKernelDS - KERNEL64_SS, seg.h */
402 }
403 else
404 g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[4].pfn = (void *)0;
405 g_aFunctions[4].pfn = (void *)0x08; /* SUPR0AbsKernelCS - KERNEL_CS, seg.h */
406 g_aFunctions[5].pfn = (void *)0x10; /* SUPR0AbsKernelSS - KERNEL_DS, seg.h */
407 g_aFunctions[6].pfn = (void *)0x10; /* SUPR0AbsKernelDS - KERNEL_DS, seg.h */
408 g_aFunctions[7].pfn = (void *)0x10; /* SUPR0AbsKernelES - KERNEL_DS, seg.h */
409 g_aFunctions[8].pfn = (void *)0x10; /* SUPR0AbsKernelFS - KERNEL_DS, seg.h */
410 g_aFunctions[9].pfn = (void *)0x48; /* SUPR0AbsKernelGS - CPU_DATA_GS, seg.h */
411# else /* 64-bit darwin: */
412 g_aFunctions[0].pfn = (void *)1; /* SUPR0AbsIs64bit */
413 g_aFunctions[1].pfn = (void *)(uintptr_t)ASMGetCS(); /* SUPR0Abs64bitKernelCS */
414 g_aFunctions[2].pfn = (void *)(uintptr_t)ASMGetSS(); /* SUPR0Abs64bitKernelSS */
415 g_aFunctions[3].pfn = (void *)0; /* SUPR0Abs64bitKernelDS */
416 g_aFunctions[4].pfn = (void *)(uintptr_t)ASMGetCS(); /* SUPR0AbsKernelCS */
417 g_aFunctions[5].pfn = (void *)(uintptr_t)ASMGetSS(); /* SUPR0AbsKernelSS */
418 g_aFunctions[6].pfn = (void *)0; /* SUPR0AbsKernelDS */
419 g_aFunctions[7].pfn = (void *)0; /* SUPR0AbsKernelES */
420 g_aFunctions[8].pfn = (void *)0; /* SUPR0AbsKernelFS */
421 g_aFunctions[9].pfn = (void *)0; /* SUPR0AbsKernelGS */
422
423# endif
424#else /* !RT_OS_DARWIN */
425# if ARCH_BITS == 64
426 g_aFunctions[0].pfn = (void *)1; /* SUPR0AbsIs64bit */
427 g_aFunctions[1].pfn = (void *)(uintptr_t)ASMGetCS(); /* SUPR0Abs64bitKernelCS */
428 g_aFunctions[2].pfn = (void *)(uintptr_t)ASMGetSS(); /* SUPR0Abs64bitKernelSS */
429 g_aFunctions[3].pfn = (void *)(uintptr_t)ASMGetDS(); /* SUPR0Abs64bitKernelDS */
430# else
431 g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[4].pfn = (void *)0;
432# endif
433 g_aFunctions[4].pfn = (void *)(uintptr_t)ASMGetCS(); /* SUPR0AbsKernelCS */
434 g_aFunctions[5].pfn = (void *)(uintptr_t)ASMGetSS(); /* SUPR0AbsKernelSS */
435 g_aFunctions[6].pfn = (void *)(uintptr_t)ASMGetDS(); /* SUPR0AbsKernelDS */
436 g_aFunctions[7].pfn = (void *)(uintptr_t)ASMGetES(); /* SUPR0AbsKernelES */
437 g_aFunctions[8].pfn = (void *)(uintptr_t)ASMGetFS(); /* SUPR0AbsKernelFS */
438 g_aFunctions[9].pfn = (void *)(uintptr_t)ASMGetGS(); /* SUPR0AbsKernelGS */
439#endif /* !RT_OS_DARWIN */
440 return VINF_SUCCESS;
441 }
442
443#ifdef SUPDRV_USE_MUTEX_FOR_GIP
444 RTSemMutexDestroy(pDevExt->mtxGip);
445 pDevExt->mtxGip = NIL_RTSEMMUTEX;
446#else
447 RTSemFastMutexDestroy(pDevExt->mtxGip);
448 pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
449#endif
450 }
451 RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
452 pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
453 }
454#ifdef SUPDRV_USE_MUTEX_FOR_LDR
455 RTSemMutexDestroy(pDevExt->mtxLdr);
456 pDevExt->mtxLdr = NIL_RTSEMMUTEX;
457#else
458 RTSemFastMutexDestroy(pDevExt->mtxLdr);
459 pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
460#endif
461 }
462 RTSpinlockDestroy(pDevExt->Spinlock);
463 pDevExt->Spinlock = NIL_RTSPINLOCK;
464 }
465#ifdef SUPDRV_WITH_RELEASE_LOGGER
466 RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
467 RTLogDestroy(RTLogSetDefaultInstance(NULL));
468#endif
469
470 return rc;
471}
472
473
474/**
475 * Delete the device extension (e.g. cleanup members).
476 *
477 * @param pDevExt The device extension to delete.
478 */
479void VBOXCALL supdrvDeleteDevExt(PSUPDRVDEVEXT pDevExt)
480{
481 PSUPDRVOBJ pObj;
482 PSUPDRVUSAGE pUsage;
483
484 /*
485 * Kill mutexes and spinlocks.
486 */
487#ifdef SUPDRV_USE_MUTEX_FOR_GIP
488 RTSemMutexDestroy(pDevExt->mtxGip);
489 pDevExt->mtxGip = NIL_RTSEMMUTEX;
490#else
491 RTSemFastMutexDestroy(pDevExt->mtxGip);
492 pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
493#endif
494#ifdef SUPDRV_USE_MUTEX_FOR_LDR
495 RTSemMutexDestroy(pDevExt->mtxLdr);
496 pDevExt->mtxLdr = NIL_RTSEMMUTEX;
497#else
498 RTSemFastMutexDestroy(pDevExt->mtxLdr);
499 pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
500#endif
501 RTSpinlockDestroy(pDevExt->Spinlock);
502 pDevExt->Spinlock = NIL_RTSPINLOCK;
503 RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
504 pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
505
506 /*
507 * Free lists.
508 */
509 /* objects. */
510 pObj = pDevExt->pObjs;
511 Assert(!pObj); /* (can trigger on forced unloads) */
512 pDevExt->pObjs = NULL;
513 while (pObj)
514 {
515 void *pvFree = pObj;
516 pObj = pObj->pNext;
517 RTMemFree(pvFree);
518 }
519
520 /* usage records. */
521 pUsage = pDevExt->pUsageFree;
522 pDevExt->pUsageFree = NULL;
523 while (pUsage)
524 {
525 void *pvFree = pUsage;
526 pUsage = pUsage->pNext;
527 RTMemFree(pvFree);
528 }
529
530 /* kill the GIP. */
531 supdrvGipDestroy(pDevExt);
532
533#ifdef SUPDRV_WITH_RELEASE_LOGGER
534 /* destroy the loggers. */
535 RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
536 RTLogDestroy(RTLogSetDefaultInstance(NULL));
537#endif
538}
539
540
541/**
542 * Create session.
543 *
544 * @returns IPRT status code.
545 * @param pDevExt Device extension.
546 * @param fUser Flag indicating whether this is a user or kernel session.
547 * @param ppSession Where to store the pointer to the session data.
548 */
549int VBOXCALL supdrvCreateSession(PSUPDRVDEVEXT pDevExt, bool fUser, PSUPDRVSESSION *ppSession)
550{
551 /*
552 * Allocate memory for the session data.
553 */
554 int rc;
555 PSUPDRVSESSION pSession = *ppSession = (PSUPDRVSESSION)RTMemAllocZ(pDevExt->cbSession);
556 if (pSession)
557 {
558 /* Initialize session data. */
559 rc = RTSpinlockCreate(&pSession->Spinlock);
560 if (!rc)
561 {
562 rc = RTHandleTableCreateEx(&pSession->hHandleTable,
563 RTHANDLETABLE_FLAGS_LOCKED | RTHANDLETABLE_FLAGS_CONTEXT,
564 1 /*uBase*/, 32768 /*cMax*/, supdrvSessionObjHandleRetain, pSession);
565 if (RT_SUCCESS(rc))
566 {
567 Assert(pSession->Spinlock != NIL_RTSPINLOCK);
568 pSession->pDevExt = pDevExt;
569 pSession->u32Cookie = BIRD_INV;
570 /*pSession->pLdrUsage = NULL;
571 pSession->pVM = NULL;
572 pSession->pUsage = NULL;
573 pSession->pGip = NULL;
574 pSession->fGipReferenced = false;
575 pSession->Bundle.cUsed = 0; */
576 pSession->Uid = NIL_RTUID;
577 pSession->Gid = NIL_RTGID;
578 if (fUser)
579 {
580 pSession->Process = RTProcSelf();
581 pSession->R0Process = RTR0ProcHandleSelf();
582 }
583 else
584 {
585 pSession->Process = NIL_RTPROCESS;
586 pSession->R0Process = NIL_RTR0PROCESS;
587 }
588
589 LogFlow(("Created session %p initial cookie=%#x\n", pSession, pSession->u32Cookie));
590 return VINF_SUCCESS;
591 }
592
593 RTSpinlockDestroy(pSession->Spinlock);
594 }
595 RTMemFree(pSession);
596 *ppSession = NULL;
597 Log(("Failed to create spinlock, rc=%d!\n", rc));
598 }
599 else
600 rc = VERR_NO_MEMORY;
601
602 return rc;
603}
604
605
606/**
607 * Shared code for cleaning up a session.
608 *
609 * @param pDevExt Device extension.
610 * @param pSession Session data.
611 * This data will be freed by this routine.
612 */
613void VBOXCALL supdrvCloseSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
614{
615 /*
616 * Cleanup the session first.
617 */
618 supdrvCleanupSession(pDevExt, pSession);
619
620 /*
621 * Free the rest of the session stuff.
622 */
623 RTSpinlockDestroy(pSession->Spinlock);
624 pSession->Spinlock = NIL_RTSPINLOCK;
625 pSession->pDevExt = NULL;
626 RTMemFree(pSession);
627 LogFlow(("supdrvCloseSession: returns\n"));
628}
629
630
631/**
632 * Shared code for cleaning up a session (but not quite freeing it).
633 *
634 * This is primarily intended for MAC OS X where we have to clean up the memory
635 * stuff before the file handle is closed.
636 *
637 * @param pDevExt Device extension.
638 * @param pSession Session data.
639 * This data will be freed by this routine.
640 */
641void VBOXCALL supdrvCleanupSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
642{
643 int rc;
644 PSUPDRVBUNDLE pBundle;
645 LogFlow(("supdrvCleanupSession: pSession=%p\n", pSession));
646
647 /*
648 * Remove logger instances related to this session.
649 */
650 RTLogSetDefaultInstanceThread(NULL, (uintptr_t)pSession);
651
652 /*
653 * Destroy the handle table.
654 */
655 rc = RTHandleTableDestroy(pSession->hHandleTable, supdrvSessionObjHandleDelete, pSession);
656 AssertRC(rc);
657 pSession->hHandleTable = NIL_RTHANDLETABLE;
658
659 /*
660 * Release object references made in this session.
661 * In theory there should be noone racing us in this session.
662 */
663 Log2(("release objects - start\n"));
664 if (pSession->pUsage)
665 {
666 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
667 PSUPDRVUSAGE pUsage;
668 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
669
670 while ((pUsage = pSession->pUsage) != NULL)
671 {
672 PSUPDRVOBJ pObj = pUsage->pObj;
673 pSession->pUsage = pUsage->pNext;
674
675 AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
676 if (pUsage->cUsage < pObj->cUsage)
677 {
678 pObj->cUsage -= pUsage->cUsage;
679 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
680 }
681 else
682 {
683 /* Destroy the object and free the record. */
684 if (pDevExt->pObjs == pObj)
685 pDevExt->pObjs = pObj->pNext;
686 else
687 {
688 PSUPDRVOBJ pObjPrev;
689 for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
690 if (pObjPrev->pNext == pObj)
691 {
692 pObjPrev->pNext = pObj->pNext;
693 break;
694 }
695 Assert(pObjPrev);
696 }
697 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
698
699 Log(("supdrvCleanupSession: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
700 pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
701 if (pObj->pfnDestructor)
702 pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
703 RTMemFree(pObj);
704 }
705
706 /* free it and continue. */
707 RTMemFree(pUsage);
708
709 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
710 }
711
712 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
713 AssertMsg(!pSession->pUsage, ("Some buster reregistered an object during desturction!\n"));
714 }
715 Log2(("release objects - done\n"));
716
717 /*
718 * Release memory allocated in the session.
719 *
720 * We do not serialize this as we assume that the application will
721 * not allocated memory while closing the file handle object.
722 */
723 Log2(("freeing memory:\n"));
724 pBundle = &pSession->Bundle;
725 while (pBundle)
726 {
727 PSUPDRVBUNDLE pToFree;
728 unsigned i;
729
730 /*
731 * Check and unlock all entries in the bundle.
732 */
733 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
734 {
735 if (pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ)
736 {
737 Log2(("eType=%d pvR0=%p pvR3=%p cb=%ld\n", pBundle->aMem[i].eType, RTR0MemObjAddress(pBundle->aMem[i].MemObj),
738 (void *)RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3), (long)RTR0MemObjSize(pBundle->aMem[i].MemObj)));
739 if (pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ)
740 {
741 rc = RTR0MemObjFree(pBundle->aMem[i].MapObjR3, false);
742 AssertRC(rc); /** @todo figure out how to handle this. */
743 pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
744 }
745 rc = RTR0MemObjFree(pBundle->aMem[i].MemObj, true /* fFreeMappings */);
746 AssertRC(rc); /** @todo figure out how to handle this. */
747 pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
748 pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
749 }
750 }
751
752 /*
753 * Advance and free previous bundle.
754 */
755 pToFree = pBundle;
756 pBundle = pBundle->pNext;
757
758 pToFree->pNext = NULL;
759 pToFree->cUsed = 0;
760 if (pToFree != &pSession->Bundle)
761 RTMemFree(pToFree);
762 }
763 Log2(("freeing memory - done\n"));
764
765 /*
766 * Deregister component factories.
767 */
768 RTSemFastMutexRequest(pDevExt->mtxComponentFactory);
769 Log2(("deregistering component factories:\n"));
770 if (pDevExt->pComponentFactoryHead)
771 {
772 PSUPDRVFACTORYREG pPrev = NULL;
773 PSUPDRVFACTORYREG pCur = pDevExt->pComponentFactoryHead;
774 while (pCur)
775 {
776 if (pCur->pSession == pSession)
777 {
778 /* unlink it */
779 PSUPDRVFACTORYREG pNext = pCur->pNext;
780 if (pPrev)
781 pPrev->pNext = pNext;
782 else
783 pDevExt->pComponentFactoryHead = pNext;
784
785 /* free it */
786 pCur->pNext = NULL;
787 pCur->pSession = NULL;
788 pCur->pFactory = NULL;
789 RTMemFree(pCur);
790
791 /* next */
792 pCur = pNext;
793 }
794 else
795 {
796 /* next */
797 pPrev = pCur;
798 pCur = pCur->pNext;
799 }
800 }
801 }
802 RTSemFastMutexRelease(pDevExt->mtxComponentFactory);
803 Log2(("deregistering component factories - done\n"));
804
805 /*
806 * Loaded images needs to be dereferenced and possibly freed up.
807 */
808 supdrvLdrLock(pDevExt);
809 Log2(("freeing images:\n"));
810 if (pSession->pLdrUsage)
811 {
812 PSUPDRVLDRUSAGE pUsage = pSession->pLdrUsage;
813 pSession->pLdrUsage = NULL;
814 while (pUsage)
815 {
816 void *pvFree = pUsage;
817 PSUPDRVLDRIMAGE pImage = pUsage->pImage;
818 if (pImage->cUsage > pUsage->cUsage)
819 pImage->cUsage -= pUsage->cUsage;
820 else
821 supdrvLdrFree(pDevExt, pImage);
822 pUsage->pImage = NULL;
823 pUsage = pUsage->pNext;
824 RTMemFree(pvFree);
825 }
826 }
827 supdrvLdrUnlock(pDevExt);
828 Log2(("freeing images - done\n"));
829
830 /*
831 * Unmap the GIP.
832 */
833 Log2(("umapping GIP:\n"));
834 if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
835 {
836 SUPR0GipUnmap(pSession);
837 pSession->fGipReferenced = 0;
838 }
839 Log2(("umapping GIP - done\n"));
840}
841
842
843/**
844 * RTHandleTableDestroy callback used by supdrvCleanupSession.
845 *
846 * @returns IPRT status code, see SUPR0ObjAddRef.
847 * @param hHandleTable The handle table handle. Ignored.
848 * @param pvObj The object pointer.
849 * @param pvCtx Context, the handle type. Ignored.
850 * @param pvUser Session pointer.
851 */
852static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void *pvObj, void *pvCtx, void *pvUser)
853{
854 NOREF(pvCtx);
855 NOREF(hHandleTable);
856 return SUPR0ObjAddRefEx(pvObj, (PSUPDRVSESSION)pvUser, true /*fNoBlocking*/);
857}
858
859
860/**
861 * RTHandleTableDestroy callback used by supdrvCleanupSession.
862 *
863 * @param hHandleTable The handle table handle. Ignored.
864 * @param h The handle value. Ignored.
865 * @param pvObj The object pointer.
866 * @param pvCtx Context, the handle type. Ignored.
867 * @param pvUser Session pointer.
868 */
869static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void *pvObj, void *pvCtx, void *pvUser)
870{
871 NOREF(pvCtx);
872 NOREF(h);
873 NOREF(hHandleTable);
874 SUPR0ObjRelease(pvObj, (PSUPDRVSESSION)pvUser);
875}
876
877
878/**
879 * Fast path I/O Control worker.
880 *
881 * @returns VBox status code that should be passed down to ring-3 unchanged.
882 * @param uIOCtl Function number.
883 * @param idCpu VMCPU id.
884 * @param pDevExt Device extention.
885 * @param pSession Session data.
886 */
887int VBOXCALL supdrvIOCtlFast(uintptr_t uIOCtl, VMCPUID idCpu, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
888{
889 /*
890 * We check the two prereqs after doing this only to allow the compiler to optimize things better.
891 */
892 if (RT_LIKELY(pSession->pVM && pDevExt->pfnVMMR0EntryFast))
893 {
894 switch (uIOCtl)
895 {
896 case SUP_IOCTL_FAST_DO_RAW_RUN:
897 pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_RAW_RUN);
898 break;
899 case SUP_IOCTL_FAST_DO_HWACC_RUN:
900 pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_HWACC_RUN);
901 break;
902 case SUP_IOCTL_FAST_DO_NOP:
903 pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_NOP);
904 break;
905 default:
906 return VERR_INTERNAL_ERROR;
907 }
908 return VINF_SUCCESS;
909 }
910 return VERR_INTERNAL_ERROR;
911}
912
913
914/**
915 * Helper for supdrvIOCtl. Check if pszStr contains any character of pszChars.
916 * We would use strpbrk here if this function would be contained in the RedHat kABI white
917 * list, see http://www.kerneldrivers.org/RHEL5.
918 *
919 * @returns 1 if pszStr does contain any character of pszChars, 0 otherwise.
920 * @param pszStr String to check
921 * @param pszChars Character set
922 */
923static int supdrvCheckInvalidChar(const char *pszStr, const char *pszChars)
924{
925 int chCur;
926 while ((chCur = *pszStr++) != '\0')
927 {
928 int ch;
929 const char *psz = pszChars;
930 while ((ch = *psz++) != '\0')
931 if (ch == chCur)
932 return 1;
933
934 }
935 return 0;
936}
937
938
939/**
940 * I/O Control worker.
941 *
942 * @returns IPRT status code.
943 * @retval VERR_INVALID_PARAMETER if the request is invalid.
944 *
945 * @param uIOCtl Function number.
946 * @param pDevExt Device extention.
947 * @param pSession Session data.
948 * @param pReqHdr The request header.
949 */
950int VBOXCALL supdrvIOCtl(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPREQHDR pReqHdr)
951{
952 /*
953 * Validate the request.
954 */
955 /* this first check could probably be omitted as its also done by the OS specific code... */
956 if (RT_UNLIKELY( (pReqHdr->fFlags & SUPREQHDR_FLAGS_MAGIC_MASK) != SUPREQHDR_FLAGS_MAGIC
957 || pReqHdr->cbIn < sizeof(*pReqHdr)
958 || pReqHdr->cbOut < sizeof(*pReqHdr)))
959 {
960 OSDBGPRINT(("vboxdrv: Bad ioctl request header; cbIn=%#lx cbOut=%#lx fFlags=%#lx\n",
961 (long)pReqHdr->cbIn, (long)pReqHdr->cbOut, (long)pReqHdr->fFlags));
962 return VERR_INVALID_PARAMETER;
963 }
964 if (RT_UNLIKELY(uIOCtl == SUP_IOCTL_COOKIE))
965 {
966 if (pReqHdr->u32Cookie != SUPCOOKIE_INITIAL_COOKIE)
967 {
968 OSDBGPRINT(("SUP_IOCTL_COOKIE: bad cookie %#lx\n", (long)pReqHdr->u32Cookie));
969 return VERR_INVALID_PARAMETER;
970 }
971 }
972 else if (RT_UNLIKELY( pReqHdr->u32Cookie != pDevExt->u32Cookie
973 || pReqHdr->u32SessionCookie != pSession->u32Cookie))
974 {
975 OSDBGPRINT(("vboxdrv: bad cookie %#lx / %#lx.\n", (long)pReqHdr->u32Cookie, (long)pReqHdr->u32SessionCookie));
976 return VERR_INVALID_PARAMETER;
977 }
978
979/*
980 * Validation macros
981 */
982#define REQ_CHECK_SIZES_EX(Name, cbInExpect, cbOutExpect) \
983 do { \
984 if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect) || pReqHdr->cbOut != (cbOutExpect))) \
985 { \
986 OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld. cbOut=%ld expected %ld.\n", \
987 (long)pReq->Hdr.cbIn, (long)(cbInExpect), (long)pReq->Hdr.cbOut, (long)(cbOutExpect))); \
988 return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
989 } \
990 } while (0)
991
992#define REQ_CHECK_SIZES(Name) REQ_CHECK_SIZES_EX(Name, Name ## _SIZE_IN, Name ## _SIZE_OUT)
993
994#define REQ_CHECK_SIZE_IN(Name, cbInExpect) \
995 do { \
996 if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect))) \
997 { \
998 OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld.\n", \
999 (long)pReq->Hdr.cbIn, (long)(cbInExpect))); \
1000 return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1001 } \
1002 } while (0)
1003
1004#define REQ_CHECK_SIZE_OUT(Name, cbOutExpect) \
1005 do { \
1006 if (RT_UNLIKELY(pReqHdr->cbOut != (cbOutExpect))) \
1007 { \
1008 OSDBGPRINT(( #Name ": Invalid input/output sizes. cbOut=%ld expected %ld.\n", \
1009 (long)pReq->Hdr.cbOut, (long)(cbOutExpect))); \
1010 return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1011 } \
1012 } while (0)
1013
1014#define REQ_CHECK_EXPR(Name, expr) \
1015 do { \
1016 if (RT_UNLIKELY(!(expr))) \
1017 { \
1018 OSDBGPRINT(( #Name ": %s\n", #expr)); \
1019 return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1020 } \
1021 } while (0)
1022
1023#define REQ_CHECK_EXPR_FMT(expr, fmt) \
1024 do { \
1025 if (RT_UNLIKELY(!(expr))) \
1026 { \
1027 OSDBGPRINT( fmt ); \
1028 return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1029 } \
1030 } while (0)
1031
1032
1033 /*
1034 * The switch.
1035 */
1036 switch (SUP_CTL_CODE_NO_SIZE(uIOCtl))
1037 {
1038 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_COOKIE):
1039 {
1040 PSUPCOOKIE pReq = (PSUPCOOKIE)pReqHdr;
1041 REQ_CHECK_SIZES(SUP_IOCTL_COOKIE);
1042 if (strncmp(pReq->u.In.szMagic, SUPCOOKIE_MAGIC, sizeof(pReq->u.In.szMagic)))
1043 {
1044 OSDBGPRINT(("SUP_IOCTL_COOKIE: invalid magic %.16s\n", pReq->u.In.szMagic));
1045 pReq->Hdr.rc = VERR_INVALID_MAGIC;
1046 return 0;
1047 }
1048
1049#if 0
1050 /*
1051 * Call out to the OS specific code and let it do permission checks on the
1052 * client process.
1053 */
1054 if (!supdrvOSValidateClientProcess(pDevExt, pSession))
1055 {
1056 pReq->u.Out.u32Cookie = 0xffffffff;
1057 pReq->u.Out.u32SessionCookie = 0xffffffff;
1058 pReq->u.Out.u32SessionVersion = 0xffffffff;
1059 pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1060 pReq->u.Out.pSession = NULL;
1061 pReq->u.Out.cFunctions = 0;
1062 pReq->Hdr.rc = VERR_PERMISSION_DENIED;
1063 return 0;
1064 }
1065#endif
1066
1067 /*
1068 * Match the version.
1069 * The current logic is very simple, match the major interface version.
1070 */
1071 if ( pReq->u.In.u32MinVersion > SUPDRV_IOC_VERSION
1072 || (pReq->u.In.u32MinVersion & 0xffff0000) != (SUPDRV_IOC_VERSION & 0xffff0000))
1073 {
1074 OSDBGPRINT(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
1075 pReq->u.In.u32ReqVersion, pReq->u.In.u32MinVersion, SUPDRV_IOC_VERSION));
1076 pReq->u.Out.u32Cookie = 0xffffffff;
1077 pReq->u.Out.u32SessionCookie = 0xffffffff;
1078 pReq->u.Out.u32SessionVersion = 0xffffffff;
1079 pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1080 pReq->u.Out.pSession = NULL;
1081 pReq->u.Out.cFunctions = 0;
1082 pReq->Hdr.rc = VERR_VERSION_MISMATCH;
1083 return 0;
1084 }
1085
1086 /*
1087 * Fill in return data and be gone.
1088 * N.B. The first one to change SUPDRV_IOC_VERSION shall makes sure that
1089 * u32SessionVersion <= u32ReqVersion!
1090 */
1091 /** @todo Somehow validate the client and negotiate a secure cookie... */
1092 pReq->u.Out.u32Cookie = pDevExt->u32Cookie;
1093 pReq->u.Out.u32SessionCookie = pSession->u32Cookie;
1094 pReq->u.Out.u32SessionVersion = SUPDRV_IOC_VERSION;
1095 pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1096 pReq->u.Out.pSession = pSession;
1097 pReq->u.Out.cFunctions = sizeof(g_aFunctions) / sizeof(g_aFunctions[0]);
1098 pReq->Hdr.rc = VINF_SUCCESS;
1099 return 0;
1100 }
1101
1102 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_QUERY_FUNCS(0)):
1103 {
1104 /* validate */
1105 PSUPQUERYFUNCS pReq = (PSUPQUERYFUNCS)pReqHdr;
1106 REQ_CHECK_SIZES_EX(SUP_IOCTL_QUERY_FUNCS, SUP_IOCTL_QUERY_FUNCS_SIZE_IN, SUP_IOCTL_QUERY_FUNCS_SIZE_OUT(RT_ELEMENTS(g_aFunctions)));
1107
1108 /* execute */
1109 pReq->u.Out.cFunctions = RT_ELEMENTS(g_aFunctions);
1110 memcpy(&pReq->u.Out.aFunctions[0], g_aFunctions, sizeof(g_aFunctions));
1111 pReq->Hdr.rc = VINF_SUCCESS;
1112 return 0;
1113 }
1114
1115 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_LOCK):
1116 {
1117 /* validate */
1118 PSUPPAGELOCK pReq = (PSUPPAGELOCK)pReqHdr;
1119 REQ_CHECK_SIZE_IN(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_IN);
1120 REQ_CHECK_SIZE_OUT(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_OUT(pReq->u.In.cPages));
1121 REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.cPages > 0);
1122 REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.pvR3 >= PAGE_SIZE);
1123
1124 /* execute */
1125 pReq->Hdr.rc = SUPR0LockMem(pSession, pReq->u.In.pvR3, pReq->u.In.cPages, &pReq->u.Out.aPages[0]);
1126 if (RT_FAILURE(pReq->Hdr.rc))
1127 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1128 return 0;
1129 }
1130
1131 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_UNLOCK):
1132 {
1133 /* validate */
1134 PSUPPAGEUNLOCK pReq = (PSUPPAGEUNLOCK)pReqHdr;
1135 REQ_CHECK_SIZES(SUP_IOCTL_PAGE_UNLOCK);
1136
1137 /* execute */
1138 pReq->Hdr.rc = SUPR0UnlockMem(pSession, pReq->u.In.pvR3);
1139 return 0;
1140 }
1141
1142 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_ALLOC):
1143 {
1144 /* validate */
1145 PSUPCONTALLOC pReq = (PSUPCONTALLOC)pReqHdr;
1146 REQ_CHECK_SIZES(SUP_IOCTL_CONT_ALLOC);
1147
1148 /* execute */
1149 pReq->Hdr.rc = SUPR0ContAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.HCPhys);
1150 if (RT_FAILURE(pReq->Hdr.rc))
1151 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1152 return 0;
1153 }
1154
1155 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_FREE):
1156 {
1157 /* validate */
1158 PSUPCONTFREE pReq = (PSUPCONTFREE)pReqHdr;
1159 REQ_CHECK_SIZES(SUP_IOCTL_CONT_FREE);
1160
1161 /* execute */
1162 pReq->Hdr.rc = SUPR0ContFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1163 return 0;
1164 }
1165
1166 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_OPEN):
1167 {
1168 /* validate */
1169 PSUPLDROPEN pReq = (PSUPLDROPEN)pReqHdr;
1170 REQ_CHECK_SIZES(SUP_IOCTL_LDR_OPEN);
1171 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageWithTabs > 0);
1172 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageWithTabs < 16*_1M);
1173 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits > 0);
1174 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits > 0);
1175 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits < pReq->u.In.cbImageWithTabs);
1176 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.szName[0]);
1177 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, memchr(pReq->u.In.szName, '\0', sizeof(pReq->u.In.szName)));
1178 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, !supdrvCheckInvalidChar(pReq->u.In.szName, ";:()[]{}/\\|&*%#@!~`\"'"));
1179 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, memchr(pReq->u.In.szFilename, '\0', sizeof(pReq->u.In.szFilename)));
1180
1181 /* execute */
1182 pReq->Hdr.rc = supdrvIOCtl_LdrOpen(pDevExt, pSession, pReq);
1183 return 0;
1184 }
1185
1186 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_LOAD):
1187 {
1188 /* validate */
1189 PSUPLDRLOAD pReq = (PSUPLDRLOAD)pReqHdr;
1190 REQ_CHECK_EXPR(Name, pReq->Hdr.cbIn >= sizeof(*pReq));
1191 REQ_CHECK_SIZES_EX(SUP_IOCTL_LDR_LOAD, SUP_IOCTL_LDR_LOAD_SIZE_IN(pReq->u.In.cbImageWithTabs), SUP_IOCTL_LDR_LOAD_SIZE_OUT);
1192 REQ_CHECK_EXPR(SUP_IOCTL_LDR_LOAD, pReq->u.In.cSymbols <= 16384);
1193 REQ_CHECK_EXPR_FMT( !pReq->u.In.cSymbols
1194 || ( pReq->u.In.offSymbols < pReq->u.In.cbImageWithTabs
1195 && pReq->u.In.offSymbols + pReq->u.In.cSymbols * sizeof(SUPLDRSYM) <= pReq->u.In.cbImageWithTabs),
1196 ("SUP_IOCTL_LDR_LOAD: offSymbols=%#lx cSymbols=%#lx cbImageWithTabs=%#lx\n", (long)pReq->u.In.offSymbols,
1197 (long)pReq->u.In.cSymbols, (long)pReq->u.In.cbImageWithTabs));
1198 REQ_CHECK_EXPR_FMT( !pReq->u.In.cbStrTab
1199 || ( pReq->u.In.offStrTab < pReq->u.In.cbImageWithTabs
1200 && pReq->u.In.offStrTab + pReq->u.In.cbStrTab <= pReq->u.In.cbImageWithTabs
1201 && pReq->u.In.cbStrTab <= pReq->u.In.cbImageWithTabs),
1202 ("SUP_IOCTL_LDR_LOAD: offStrTab=%#lx cbStrTab=%#lx cbImageWithTabs=%#lx\n", (long)pReq->u.In.offStrTab,
1203 (long)pReq->u.In.cbStrTab, (long)pReq->u.In.cbImageWithTabs));
1204
1205 if (pReq->u.In.cSymbols)
1206 {
1207 uint32_t i;
1208 PSUPLDRSYM paSyms = (PSUPLDRSYM)&pReq->u.In.abImage[pReq->u.In.offSymbols];
1209 for (i = 0; i < pReq->u.In.cSymbols; i++)
1210 {
1211 REQ_CHECK_EXPR_FMT(paSyms[i].offSymbol < pReq->u.In.cbImageWithTabs,
1212 ("SUP_IOCTL_LDR_LOAD: sym #%ld: symb off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offSymbol, (long)pReq->u.In.cbImageWithTabs));
1213 REQ_CHECK_EXPR_FMT(paSyms[i].offName < pReq->u.In.cbStrTab,
1214 ("SUP_IOCTL_LDR_LOAD: sym #%ld: name off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithTabs));
1215 REQ_CHECK_EXPR_FMT(memchr(&pReq->u.In.abImage[pReq->u.In.offStrTab + paSyms[i].offName], '\0', pReq->u.In.cbStrTab - paSyms[i].offName),
1216 ("SUP_IOCTL_LDR_LOAD: sym #%ld: unterminated name! (%#lx / %#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithTabs));
1217 }
1218 }
1219
1220 /* execute */
1221 pReq->Hdr.rc = supdrvIOCtl_LdrLoad(pDevExt, pSession, pReq);
1222 return 0;
1223 }
1224
1225 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_FREE):
1226 {
1227 /* validate */
1228 PSUPLDRFREE pReq = (PSUPLDRFREE)pReqHdr;
1229 REQ_CHECK_SIZES(SUP_IOCTL_LDR_FREE);
1230
1231 /* execute */
1232 pReq->Hdr.rc = supdrvIOCtl_LdrFree(pDevExt, pSession, pReq);
1233 return 0;
1234 }
1235
1236 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_GET_SYMBOL):
1237 {
1238 /* validate */
1239 PSUPLDRGETSYMBOL pReq = (PSUPLDRGETSYMBOL)pReqHdr;
1240 REQ_CHECK_SIZES(SUP_IOCTL_LDR_GET_SYMBOL);
1241 REQ_CHECK_EXPR(SUP_IOCTL_LDR_GET_SYMBOL, memchr(pReq->u.In.szSymbol, '\0', sizeof(pReq->u.In.szSymbol)));
1242
1243 /* execute */
1244 pReq->Hdr.rc = supdrvIOCtl_LdrGetSymbol(pDevExt, pSession, pReq);
1245 return 0;
1246 }
1247
1248 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_VMMR0(0)):
1249 {
1250 /* validate */
1251 PSUPCALLVMMR0 pReq = (PSUPCALLVMMR0)pReqHdr;
1252 Log4(("SUP_IOCTL_CALL_VMMR0: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1253 pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1254
1255 if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_VMMR0_SIZE(0))
1256 {
1257 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(0), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(0));
1258
1259 /* execute */
1260 if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1261 pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, NULL, pReq->u.In.u64Arg, pSession);
1262 else
1263 pReq->Hdr.rc = VERR_WRONG_ORDER;
1264 }
1265 else
1266 {
1267 PSUPVMMR0REQHDR pVMMReq = (PSUPVMMR0REQHDR)&pReq->abReqPkt[0];
1268 REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR)),
1269 ("SUP_IOCTL_CALL_VMMR0: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR))));
1270 REQ_CHECK_EXPR(SUP_IOCTL_CALL_VMMR0, pVMMReq->u32Magic == SUPVMMR0REQHDR_MAGIC);
1271 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(pVMMReq->cbReq), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(pVMMReq->cbReq));
1272
1273 /* execute */
1274 if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1275 pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1276 else
1277 pReq->Hdr.rc = VERR_WRONG_ORDER;
1278 }
1279
1280 if ( RT_FAILURE(pReq->Hdr.rc)
1281 && pReq->Hdr.rc != VERR_INTERRUPTED
1282 && pReq->Hdr.rc != VERR_TIMEOUT)
1283 Log(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1284 pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1285 else
1286 Log4(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1287 pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1288 return 0;
1289 }
1290
1291 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GET_PAGING_MODE):
1292 {
1293 /* validate */
1294 PSUPGETPAGINGMODE pReq = (PSUPGETPAGINGMODE)pReqHdr;
1295 REQ_CHECK_SIZES(SUP_IOCTL_GET_PAGING_MODE);
1296
1297 /* execute */
1298 pReq->Hdr.rc = VINF_SUCCESS;
1299 pReq->u.Out.enmMode = SUPR0GetPagingMode();
1300 return 0;
1301 }
1302
1303 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_ALLOC):
1304 {
1305 /* validate */
1306 PSUPLOWALLOC pReq = (PSUPLOWALLOC)pReqHdr;
1307 REQ_CHECK_EXPR(SUP_IOCTL_LOW_ALLOC, pReq->Hdr.cbIn <= SUP_IOCTL_LOW_ALLOC_SIZE_IN);
1308 REQ_CHECK_SIZES_EX(SUP_IOCTL_LOW_ALLOC, SUP_IOCTL_LOW_ALLOC_SIZE_IN, SUP_IOCTL_LOW_ALLOC_SIZE_OUT(pReq->u.In.cPages));
1309
1310 /* execute */
1311 pReq->Hdr.rc = SUPR0LowAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.aPages[0]);
1312 if (RT_FAILURE(pReq->Hdr.rc))
1313 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1314 return 0;
1315 }
1316
1317 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_FREE):
1318 {
1319 /* validate */
1320 PSUPLOWFREE pReq = (PSUPLOWFREE)pReqHdr;
1321 REQ_CHECK_SIZES(SUP_IOCTL_LOW_FREE);
1322
1323 /* execute */
1324 pReq->Hdr.rc = SUPR0LowFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1325 return 0;
1326 }
1327
1328 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_MAP):
1329 {
1330 /* validate */
1331 PSUPGIPMAP pReq = (PSUPGIPMAP)pReqHdr;
1332 REQ_CHECK_SIZES(SUP_IOCTL_GIP_MAP);
1333
1334 /* execute */
1335 pReq->Hdr.rc = SUPR0GipMap(pSession, &pReq->u.Out.pGipR3, &pReq->u.Out.HCPhysGip);
1336 if (RT_SUCCESS(pReq->Hdr.rc))
1337 pReq->u.Out.pGipR0 = pDevExt->pGip;
1338 return 0;
1339 }
1340
1341 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_UNMAP):
1342 {
1343 /* validate */
1344 PSUPGIPUNMAP pReq = (PSUPGIPUNMAP)pReqHdr;
1345 REQ_CHECK_SIZES(SUP_IOCTL_GIP_UNMAP);
1346
1347 /* execute */
1348 pReq->Hdr.rc = SUPR0GipUnmap(pSession);
1349 return 0;
1350 }
1351
1352 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SET_VM_FOR_FAST):
1353 {
1354 /* validate */
1355 PSUPSETVMFORFAST pReq = (PSUPSETVMFORFAST)pReqHdr;
1356 REQ_CHECK_SIZES(SUP_IOCTL_SET_VM_FOR_FAST);
1357 REQ_CHECK_EXPR_FMT( !pReq->u.In.pVMR0
1358 || ( VALID_PTR(pReq->u.In.pVMR0)
1359 && !((uintptr_t)pReq->u.In.pVMR0 & (PAGE_SIZE - 1))),
1360 ("SUP_IOCTL_SET_VM_FOR_FAST: pVMR0=%p!\n", pReq->u.In.pVMR0));
1361 /* execute */
1362 pSession->pVM = pReq->u.In.pVMR0;
1363 pReq->Hdr.rc = VINF_SUCCESS;
1364 return 0;
1365 }
1366
1367 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_ALLOC_EX):
1368 {
1369 /* validate */
1370 PSUPPAGEALLOCEX pReq = (PSUPPAGEALLOCEX)pReqHdr;
1371 REQ_CHECK_EXPR(SUP_IOCTL_PAGE_ALLOC_EX, pReq->Hdr.cbIn <= SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN);
1372 REQ_CHECK_SIZES_EX(SUP_IOCTL_PAGE_ALLOC_EX, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_OUT(pReq->u.In.cPages));
1373 REQ_CHECK_EXPR_FMT(pReq->u.In.fKernelMapping || pReq->u.In.fUserMapping,
1374 ("SUP_IOCTL_PAGE_ALLOC_EX: No mapping requested!\n"));
1375 REQ_CHECK_EXPR_FMT(pReq->u.In.fUserMapping,
1376 ("SUP_IOCTL_PAGE_ALLOC_EX: Must have user mapping!\n"));
1377 REQ_CHECK_EXPR_FMT(!pReq->u.In.fReserved0 && !pReq->u.In.fReserved1,
1378 ("SUP_IOCTL_PAGE_ALLOC_EX: fReserved0=%d fReserved1=%d\n", pReq->u.In.fReserved0, pReq->u.In.fReserved1));
1379
1380 /* execute */
1381 pReq->Hdr.rc = SUPR0PageAllocEx(pSession, pReq->u.In.cPages, 0 /* fFlags */,
1382 pReq->u.In.fUserMapping ? &pReq->u.Out.pvR3 : NULL,
1383 pReq->u.In.fKernelMapping ? &pReq->u.Out.pvR0 : NULL,
1384 &pReq->u.Out.aPages[0]);
1385 if (RT_FAILURE(pReq->Hdr.rc))
1386 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1387 return 0;
1388 }
1389
1390 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_MAP_KERNEL):
1391 {
1392 /* validate */
1393 PSUPPAGEMAPKERNEL pReq = (PSUPPAGEMAPKERNEL)pReqHdr;
1394 REQ_CHECK_SIZES(SUP_IOCTL_PAGE_MAP_KERNEL);
1395 REQ_CHECK_EXPR_FMT(!pReq->u.In.fFlags, ("SUP_IOCTL_PAGE_MAP_KERNEL: fFlags=%#x! MBZ\n", pReq->u.In.fFlags));
1396 REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_MAP_KERNEL: offSub=%#x\n", pReq->u.In.offSub));
1397 REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
1398 ("SUP_IOCTL_PAGE_MAP_KERNEL: cbSub=%#x\n", pReq->u.In.cbSub));
1399
1400 /* execute */
1401 pReq->Hdr.rc = SUPR0PageMapKernel(pSession, pReq->u.In.pvR3, pReq->u.In.offSub, pReq->u.In.cbSub,
1402 pReq->u.In.fFlags, &pReq->u.Out.pvR0);
1403 if (RT_FAILURE(pReq->Hdr.rc))
1404 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1405 return 0;
1406 }
1407
1408 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_PROTECT):
1409 {
1410 /* validate */
1411 PSUPPAGEPROTECT pReq = (PSUPPAGEPROTECT)pReqHdr;
1412 REQ_CHECK_SIZES(SUP_IOCTL_PAGE_PROTECT);
1413 REQ_CHECK_EXPR_FMT(!(pReq->u.In.fProt & ~(RTMEM_PROT_READ | RTMEM_PROT_WRITE | RTMEM_PROT_EXEC | RTMEM_PROT_NONE)),
1414 ("SUP_IOCTL_PAGE_PROTECT: fProt=%#x!\n", pReq->u.In.fProt));
1415 REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_PROTECT: offSub=%#x\n", pReq->u.In.offSub));
1416 REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
1417 ("SUP_IOCTL_PAGE_PROTECT: cbSub=%#x\n", pReq->u.In.cbSub));
1418
1419 /* execute */
1420 pReq->Hdr.rc = SUPR0PageProtect(pSession, pReq->u.In.pvR3, pReq->u.In.pvR0, pReq->u.In.offSub, pReq->u.In.cbSub, pReq->u.In.fProt);
1421 return 0;
1422 }
1423
1424 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_FREE):
1425 {
1426 /* validate */
1427 PSUPPAGEFREE pReq = (PSUPPAGEFREE)pReqHdr;
1428 REQ_CHECK_SIZES(SUP_IOCTL_PAGE_FREE);
1429
1430 /* execute */
1431 pReq->Hdr.rc = SUPR0PageFree(pSession, pReq->u.In.pvR3);
1432 return 0;
1433 }
1434
1435 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_SERVICE(0)):
1436 {
1437 /* validate */
1438 PSUPCALLSERVICE pReq = (PSUPCALLSERVICE)pReqHdr;
1439 Log4(("SUP_IOCTL_CALL_SERVICE: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1440 pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1441
1442 if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
1443 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(0), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(0));
1444 else
1445 {
1446 PSUPR0SERVICEREQHDR pSrvReq = (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0];
1447 REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR)),
1448 ("SUP_IOCTL_CALL_SERVICE: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR))));
1449 REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, pSrvReq->u32Magic == SUPR0SERVICEREQHDR_MAGIC);
1450 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(pSrvReq->cbReq), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(pSrvReq->cbReq));
1451 }
1452 REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, memchr(pReq->u.In.szName, '\0', sizeof(pReq->u.In.szName)));
1453
1454 /* execute */
1455 pReq->Hdr.rc = supdrvIOCtl_CallServiceModule(pDevExt, pSession, pReq);
1456 return 0;
1457 }
1458
1459 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOGGER_SETTINGS(0)):
1460 {
1461 /* validate */
1462 PSUPLOGGERSETTINGS pReq = (PSUPLOGGERSETTINGS)pReqHdr;
1463 size_t cbStrTab;
1464 REQ_CHECK_SIZE_OUT(SUP_IOCTL_LOGGER_SETTINGS, SUP_IOCTL_LOGGER_SETTINGS_SIZE_OUT);
1465 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->Hdr.cbIn >= SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(1));
1466 cbStrTab = pReq->Hdr.cbIn - SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(0);
1467 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offGroups < cbStrTab);
1468 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offFlags < cbStrTab);
1469 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offDestination < cbStrTab);
1470 REQ_CHECK_EXPR_FMT(pReq->u.In.szStrings[cbStrTab - 1] == '\0',
1471 ("SUP_IOCTL_LOGGER_SETTINGS: cbIn=%#x cbStrTab=%#zx LastChar=%d\n",
1472 pReq->Hdr.cbIn, cbStrTab, pReq->u.In.szStrings[cbStrTab - 1]));
1473 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhich <= SUPLOGGERSETTINGS_WHICH_RELEASE);
1474 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhat <= SUPLOGGERSETTINGS_WHAT_DESTROY);
1475
1476 /* execute */
1477 pReq->Hdr.rc = supdrvIOCtl_LoggerSettings(pDevExt, pSession, pReq);
1478 return 0;
1479 }
1480
1481 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_CREATE):
1482 {
1483 /* validate */
1484 PSUPSEMCREATE pReq = (PSUPSEMCREATE)pReqHdr;
1485 REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_CREATE, SUP_IOCTL_SEM_CREATE_SIZE_IN, SUP_IOCTL_SEM_CREATE_SIZE_OUT);
1486
1487 /* execute */
1488 switch (pReq->u.In.uType)
1489 {
1490 case SUP_SEM_TYPE_EVENT:
1491 {
1492 SUPSEMEVENT hEvent;
1493 pReq->Hdr.rc = SUPSemEventCreate(pSession, &hEvent);
1494 pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEvent;
1495 break;
1496 }
1497
1498 case SUP_SEM_TYPE_EVENT_MULTI:
1499 {
1500 SUPSEMEVENTMULTI hEventMulti;
1501 pReq->Hdr.rc = SUPSemEventMultiCreate(pSession, &hEventMulti);
1502 pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEventMulti;
1503 break;
1504 }
1505
1506 default:
1507 pReq->Hdr.rc = VERR_INVALID_PARAMETER;
1508 break;
1509 }
1510 return 0;
1511 }
1512
1513 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_OP):
1514 {
1515 /* validate */
1516 PSUPSEMOP pReq = (PSUPSEMOP)pReqHdr;
1517 REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_OP, SUP_IOCTL_SEM_OP_SIZE_IN, SUP_IOCTL_SEM_OP_SIZE_OUT);
1518
1519 /* execute */
1520 switch (pReq->u.In.uType)
1521 {
1522 case SUP_SEM_TYPE_EVENT:
1523 {
1524 SUPSEMEVENT hEvent = (SUPSEMEVENT)(uintptr_t)pReq->u.In.hSem;
1525 switch (pReq->u.In.uOp)
1526 {
1527 case SUPSEMOP_WAIT:
1528 pReq->Hdr.rc = SUPSemEventWaitNoResume(pSession, hEvent, pReq->u.In.cMillies);
1529 break;
1530 case SUPSEMOP_SIGNAL:
1531 pReq->Hdr.rc = SUPSemEventSignal(pSession, hEvent);
1532 break;
1533 case SUPSEMOP_CLOSE:
1534 pReq->Hdr.rc = SUPSemEventClose(pSession, hEvent);
1535 break;
1536 case SUPSEMOP_RESET:
1537 default:
1538 pReq->Hdr.rc = VERR_INVALID_FUNCTION;
1539 break;
1540 }
1541 break;
1542 }
1543
1544 case SUP_SEM_TYPE_EVENT_MULTI:
1545 {
1546 SUPSEMEVENTMULTI hEventMulti = (SUPSEMEVENTMULTI)(uintptr_t)pReq->u.In.hSem;
1547 switch (pReq->u.In.uOp)
1548 {
1549 case SUPSEMOP_WAIT:
1550 pReq->Hdr.rc = SUPSemEventMultiWaitNoResume(pSession, hEventMulti, pReq->u.In.cMillies);
1551 break;
1552 case SUPSEMOP_SIGNAL:
1553 pReq->Hdr.rc = SUPSemEventMultiSignal(pSession, hEventMulti);
1554 break;
1555 case SUPSEMOP_CLOSE:
1556 pReq->Hdr.rc = SUPSemEventMultiClose(pSession, hEventMulti);
1557 break;
1558 case SUPSEMOP_RESET:
1559 pReq->Hdr.rc = SUPSemEventMultiReset(pSession, hEventMulti);
1560 break;
1561 default:
1562 pReq->Hdr.rc = VERR_INVALID_FUNCTION;
1563 break;
1564 }
1565 break;
1566 }
1567
1568 default:
1569 pReq->Hdr.rc = VERR_INVALID_PARAMETER;
1570 break;
1571 }
1572 return 0;
1573 }
1574
1575 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_VT_CAPS):
1576 {
1577 /* validate */
1578 PSUPVTCAPS pReq = (PSUPVTCAPS)pReqHdr;
1579 REQ_CHECK_SIZES(SUP_IOCTL_VT_CAPS);
1580 REQ_CHECK_EXPR(SUP_IOCTL_VT_CAPS, pReq->Hdr.cbIn <= SUP_IOCTL_VT_CAPS_SIZE_IN);
1581
1582 /* execute */
1583 pReq->Hdr.rc = SUPR0QueryVTCaps(pSession, &pReq->u.Out.Caps);
1584 if (RT_FAILURE(pReq->Hdr.rc))
1585 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1586 return 0;
1587 }
1588
1589 default:
1590 Log(("Unknown IOCTL %#lx\n", (long)uIOCtl));
1591 break;
1592 }
1593 return VERR_GENERAL_FAILURE;
1594}
1595
1596
1597/**
1598 * Inter-Driver Communcation (IDC) worker.
1599 *
1600 * @returns VBox status code.
1601 * @retval VINF_SUCCESS on success.
1602 * @retval VERR_INVALID_PARAMETER if the request is invalid.
1603 * @retval VERR_NOT_SUPPORTED if the request isn't supported.
1604 *
1605 * @param uReq The request (function) code.
1606 * @param pDevExt Device extention.
1607 * @param pSession Session data.
1608 * @param pReqHdr The request header.
1609 */
1610int VBOXCALL supdrvIDC(uintptr_t uReq, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQHDR pReqHdr)
1611{
1612 /*
1613 * The OS specific code has already validated the pSession
1614 * pointer, and the request size being greater or equal to
1615 * size of the header.
1616 *
1617 * So, just check that pSession is a kernel context session.
1618 */
1619 if (RT_UNLIKELY( pSession
1620 && pSession->R0Process != NIL_RTR0PROCESS))
1621 return VERR_INVALID_PARAMETER;
1622
1623/*
1624 * Validation macro.
1625 */
1626#define REQ_CHECK_IDC_SIZE(Name, cbExpect) \
1627 do { \
1628 if (RT_UNLIKELY(pReqHdr->cb != (cbExpect))) \
1629 { \
1630 OSDBGPRINT(( #Name ": Invalid input/output sizes. cb=%ld expected %ld.\n", \
1631 (long)pReqHdr->cb, (long)(cbExpect))); \
1632 return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1633 } \
1634 } while (0)
1635
1636 switch (uReq)
1637 {
1638 case SUPDRV_IDC_REQ_CONNECT:
1639 {
1640 PSUPDRVIDCREQCONNECT pReq = (PSUPDRVIDCREQCONNECT)pReqHdr;
1641 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_CONNECT, sizeof(*pReq));
1642
1643 /*
1644 * Validate the cookie and other input.
1645 */
1646 if (pReq->Hdr.pSession != NULL)
1647 {
1648 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: pSession=%p expected NULL!\n", pReq->Hdr.pSession));
1649 return pReqHdr->rc = VERR_INVALID_PARAMETER;
1650 }
1651 if (pReq->u.In.u32MagicCookie != SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE)
1652 {
1653 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: u32MagicCookie=%#x expected %#x!\n",
1654 (unsigned)pReq->u.In.u32MagicCookie, (unsigned)SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE));
1655 return pReqHdr->rc = VERR_INVALID_PARAMETER;
1656 }
1657 if ( pReq->u.In.uMinVersion > pReq->u.In.uReqVersion
1658 || (pReq->u.In.uMinVersion & UINT32_C(0xffff0000)) != (pReq->u.In.uReqVersion & UINT32_C(0xffff0000)))
1659 {
1660 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: uMinVersion=%#x uMaxVersion=%#x doesn't match!\n",
1661 pReq->u.In.uMinVersion, pReq->u.In.uReqVersion));
1662 return pReqHdr->rc = VERR_INVALID_PARAMETER;
1663 }
1664
1665 /*
1666 * Match the version.
1667 * The current logic is very simple, match the major interface version.
1668 */
1669 if ( pReq->u.In.uMinVersion > SUPDRV_IDC_VERSION
1670 || (pReq->u.In.uMinVersion & 0xffff0000) != (SUPDRV_IDC_VERSION & 0xffff0000))
1671 {
1672 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
1673 pReq->u.In.uReqVersion, pReq->u.In.uMinVersion, (unsigned)SUPDRV_IDC_VERSION));
1674 pReq->u.Out.pSession = NULL;
1675 pReq->u.Out.uSessionVersion = 0xffffffff;
1676 pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
1677 pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
1678 pReq->Hdr.rc = VERR_VERSION_MISMATCH;
1679 return VINF_SUCCESS;
1680 }
1681
1682 pReq->u.Out.pSession = NULL;
1683 pReq->u.Out.uSessionVersion = SUPDRV_IDC_VERSION;
1684 pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
1685 pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
1686
1687 /*
1688 * On NT we will already have a session associated with the
1689 * client, just like with the SUP_IOCTL_COOKIE request, while
1690 * the other doesn't.
1691 */
1692#ifdef RT_OS_WINDOWS
1693 pReq->Hdr.rc = VINF_SUCCESS;
1694#else
1695 AssertReturn(!pSession, VERR_INTERNAL_ERROR);
1696 pReq->Hdr.rc = supdrvCreateSession(pDevExt, false /* fUser */, &pSession);
1697 if (RT_FAILURE(pReq->Hdr.rc))
1698 {
1699 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: failed to create session, rc=%d\n", pReq->Hdr.rc));
1700 return VINF_SUCCESS;
1701 }
1702#endif
1703
1704 pReq->u.Out.pSession = pSession;
1705 pReq->Hdr.pSession = pSession;
1706
1707 return VINF_SUCCESS;
1708 }
1709
1710 case SUPDRV_IDC_REQ_DISCONNECT:
1711 {
1712 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_DISCONNECT, sizeof(*pReqHdr));
1713
1714#ifdef RT_OS_WINDOWS
1715 /* Windows will destroy the session when the file object is destroyed. */
1716#else
1717 supdrvCloseSession(pDevExt, pSession);
1718#endif
1719 return pReqHdr->rc = VINF_SUCCESS;
1720 }
1721
1722 case SUPDRV_IDC_REQ_GET_SYMBOL:
1723 {
1724 PSUPDRVIDCREQGETSYM pReq = (PSUPDRVIDCREQGETSYM)pReqHdr;
1725 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_GET_SYMBOL, sizeof(*pReq));
1726
1727 pReq->Hdr.rc = supdrvIDC_LdrGetSymbol(pDevExt, pSession, pReq);
1728 return VINF_SUCCESS;
1729 }
1730
1731 case SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY:
1732 {
1733 PSUPDRVIDCREQCOMPREGFACTORY pReq = (PSUPDRVIDCREQCOMPREGFACTORY)pReqHdr;
1734 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY, sizeof(*pReq));
1735
1736 pReq->Hdr.rc = SUPR0ComponentRegisterFactory(pSession, pReq->u.In.pFactory);
1737 return VINF_SUCCESS;
1738 }
1739
1740 case SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY:
1741 {
1742 PSUPDRVIDCREQCOMPDEREGFACTORY pReq = (PSUPDRVIDCREQCOMPDEREGFACTORY)pReqHdr;
1743 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY, sizeof(*pReq));
1744
1745 pReq->Hdr.rc = SUPR0ComponentDeregisterFactory(pSession, pReq->u.In.pFactory);
1746 return VINF_SUCCESS;
1747 }
1748
1749 default:
1750 Log(("Unknown IDC %#lx\n", (long)uReq));
1751 break;
1752 }
1753
1754#undef REQ_CHECK_IDC_SIZE
1755 return VERR_NOT_SUPPORTED;
1756}
1757
1758
1759/**
1760 * Register a object for reference counting.
1761 * The object is registered with one reference in the specified session.
1762 *
1763 * @returns Unique identifier on success (pointer).
1764 * All future reference must use this identifier.
1765 * @returns NULL on failure.
1766 * @param pfnDestructor The destructore function which will be called when the reference count reaches 0.
1767 * @param pvUser1 The first user argument.
1768 * @param pvUser2 The second user argument.
1769 */
1770SUPR0DECL(void *) SUPR0ObjRegister(PSUPDRVSESSION pSession, SUPDRVOBJTYPE enmType, PFNSUPDRVDESTRUCTOR pfnDestructor, void *pvUser1, void *pvUser2)
1771{
1772 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1773 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1774 PSUPDRVOBJ pObj;
1775 PSUPDRVUSAGE pUsage;
1776
1777 /*
1778 * Validate the input.
1779 */
1780 AssertReturn(SUP_IS_SESSION_VALID(pSession), NULL);
1781 AssertReturn(enmType > SUPDRVOBJTYPE_INVALID && enmType < SUPDRVOBJTYPE_END, NULL);
1782 AssertPtrReturn(pfnDestructor, NULL);
1783
1784 /*
1785 * Allocate and initialize the object.
1786 */
1787 pObj = (PSUPDRVOBJ)RTMemAlloc(sizeof(*pObj));
1788 if (!pObj)
1789 return NULL;
1790 pObj->u32Magic = SUPDRVOBJ_MAGIC;
1791 pObj->enmType = enmType;
1792 pObj->pNext = NULL;
1793 pObj->cUsage = 1;
1794 pObj->pfnDestructor = pfnDestructor;
1795 pObj->pvUser1 = pvUser1;
1796 pObj->pvUser2 = pvUser2;
1797 pObj->CreatorUid = pSession->Uid;
1798 pObj->CreatorGid = pSession->Gid;
1799 pObj->CreatorProcess= pSession->Process;
1800 supdrvOSObjInitCreator(pObj, pSession);
1801
1802 /*
1803 * Allocate the usage record.
1804 * (We keep freed usage records around to simplify SUPR0ObjAddRefEx().)
1805 */
1806 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1807
1808 pUsage = pDevExt->pUsageFree;
1809 if (pUsage)
1810 pDevExt->pUsageFree = pUsage->pNext;
1811 else
1812 {
1813 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1814 pUsage = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsage));
1815 if (!pUsage)
1816 {
1817 RTMemFree(pObj);
1818 return NULL;
1819 }
1820 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1821 }
1822
1823 /*
1824 * Insert the object and create the session usage record.
1825 */
1826 /* The object. */
1827 pObj->pNext = pDevExt->pObjs;
1828 pDevExt->pObjs = pObj;
1829
1830 /* The session record. */
1831 pUsage->cUsage = 1;
1832 pUsage->pObj = pObj;
1833 pUsage->pNext = pSession->pUsage;
1834 /* Log2(("SUPR0ObjRegister: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext)); */
1835 pSession->pUsage = pUsage;
1836
1837 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1838
1839 Log(("SUPR0ObjRegister: returns %p (pvUser1=%p, pvUser=%p)\n", pObj, pvUser1, pvUser2));
1840 return pObj;
1841}
1842
1843
1844/**
1845 * Increment the reference counter for the object associating the reference
1846 * with the specified session.
1847 *
1848 * @returns IPRT status code.
1849 * @param pvObj The identifier returned by SUPR0ObjRegister().
1850 * @param pSession The session which is referencing the object.
1851 *
1852 * @remarks The caller should not own any spinlocks and must carefully protect
1853 * itself against potential race with the destructor so freed memory
1854 * isn't accessed here.
1855 */
1856SUPR0DECL(int) SUPR0ObjAddRef(void *pvObj, PSUPDRVSESSION pSession)
1857{
1858 return SUPR0ObjAddRefEx(pvObj, pSession, false /* fNoBlocking */);
1859}
1860
1861
1862/**
1863 * Increment the reference counter for the object associating the reference
1864 * with the specified session.
1865 *
1866 * @returns IPRT status code.
1867 * @retval VERR_TRY_AGAIN if fNoBlocking was set and a new usage record
1868 * couldn't be allocated. (If you see this you're not doing the right
1869 * thing and it won't ever work reliably.)
1870 *
1871 * @param pvObj The identifier returned by SUPR0ObjRegister().
1872 * @param pSession The session which is referencing the object.
1873 * @param fNoBlocking Set if it's not OK to block. Never try to make the
1874 * first reference to an object in a session with this
1875 * argument set.
1876 *
1877 * @remarks The caller should not own any spinlocks and must carefully protect
1878 * itself against potential race with the destructor so freed memory
1879 * isn't accessed here.
1880 */
1881SUPR0DECL(int) SUPR0ObjAddRefEx(void *pvObj, PSUPDRVSESSION pSession, bool fNoBlocking)
1882{
1883 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1884 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1885 PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
1886 int rc = VINF_SUCCESS;
1887 PSUPDRVUSAGE pUsagePre;
1888 PSUPDRVUSAGE pUsage;
1889
1890 /*
1891 * Validate the input.
1892 * Be ready for the destruction race (someone might be stuck in the
1893 * destructor waiting a lock we own).
1894 */
1895 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
1896 AssertPtrReturn(pObj, VERR_INVALID_POINTER);
1897 AssertMsgReturn(pObj->u32Magic == SUPDRVOBJ_MAGIC || pObj->u32Magic == SUPDRVOBJ_MAGIC_DEAD,
1898 ("Invalid pvObj=%p magic=%#x (expected %#x or %#x)\n", pvObj, pObj->u32Magic, SUPDRVOBJ_MAGIC, SUPDRVOBJ_MAGIC_DEAD),
1899 VERR_INVALID_PARAMETER);
1900
1901 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1902
1903 if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
1904 {
1905 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1906
1907 AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
1908 return VERR_WRONG_ORDER;
1909 }
1910
1911 /*
1912 * Preallocate the usage record if we can.
1913 */
1914 pUsagePre = pDevExt->pUsageFree;
1915 if (pUsagePre)
1916 pDevExt->pUsageFree = pUsagePre->pNext;
1917 else if (!fNoBlocking)
1918 {
1919 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1920 pUsagePre = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsagePre));
1921 if (!pUsagePre)
1922 return VERR_NO_MEMORY;
1923
1924 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1925 if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
1926 {
1927 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1928
1929 AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
1930 return VERR_WRONG_ORDER;
1931 }
1932 }
1933
1934 /*
1935 * Reference the object.
1936 */
1937 pObj->cUsage++;
1938
1939 /*
1940 * Look for the session record.
1941 */
1942 for (pUsage = pSession->pUsage; pUsage; pUsage = pUsage->pNext)
1943 {
1944 /*Log(("SUPR0AddRef: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));*/
1945 if (pUsage->pObj == pObj)
1946 break;
1947 }
1948 if (pUsage)
1949 pUsage->cUsage++;
1950 else if (pUsagePre)
1951 {
1952 /* create a new session record. */
1953 pUsagePre->cUsage = 1;
1954 pUsagePre->pObj = pObj;
1955 pUsagePre->pNext = pSession->pUsage;
1956 pSession->pUsage = pUsagePre;
1957 /*Log(("SUPR0AddRef: pUsagePre=%p:{.pObj=%p, .pNext=%p}\n", pUsagePre, pUsagePre->pObj, pUsagePre->pNext));*/
1958
1959 pUsagePre = NULL;
1960 }
1961 else
1962 {
1963 pObj->cUsage--;
1964 rc = VERR_TRY_AGAIN;
1965 }
1966
1967 /*
1968 * Put any unused usage record into the free list..
1969 */
1970 if (pUsagePre)
1971 {
1972 pUsagePre->pNext = pDevExt->pUsageFree;
1973 pDevExt->pUsageFree = pUsagePre;
1974 }
1975
1976 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1977
1978 return rc;
1979}
1980
1981
1982/**
1983 * Decrement / destroy a reference counter record for an object.
1984 *
1985 * The object is uniquely identified by pfnDestructor+pvUser1+pvUser2.
1986 *
1987 * @returns IPRT status code.
1988 * @retval VINF_SUCCESS if not destroyed.
1989 * @retval VINF_OBJECT_DESTROYED if it's destroyed by this release call.
1990 * @retval VERR_INVALID_PARAMETER if the object isn't valid. Will assert in
1991 * string builds.
1992 *
1993 * @param pvObj The identifier returned by SUPR0ObjRegister().
1994 * @param pSession The session which is referencing the object.
1995 */
1996SUPR0DECL(int) SUPR0ObjRelease(void *pvObj, PSUPDRVSESSION pSession)
1997{
1998 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1999 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2000 PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2001 int rc = VERR_INVALID_PARAMETER;
2002 PSUPDRVUSAGE pUsage;
2003 PSUPDRVUSAGE pUsagePrev;
2004
2005 /*
2006 * Validate the input.
2007 */
2008 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2009 AssertMsgReturn(VALID_PTR(pObj) && pObj->u32Magic == SUPDRVOBJ_MAGIC,
2010 ("Invalid pvObj=%p magic=%#x (exepcted %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
2011 VERR_INVALID_PARAMETER);
2012
2013 /*
2014 * Acquire the spinlock and look for the usage record.
2015 */
2016 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
2017
2018 for (pUsagePrev = NULL, pUsage = pSession->pUsage;
2019 pUsage;
2020 pUsagePrev = pUsage, pUsage = pUsage->pNext)
2021 {
2022 /*Log2(("SUPR0ObjRelease: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));*/
2023 if (pUsage->pObj == pObj)
2024 {
2025 rc = VINF_SUCCESS;
2026 AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
2027 if (pUsage->cUsage > 1)
2028 {
2029 pObj->cUsage--;
2030 pUsage->cUsage--;
2031 }
2032 else
2033 {
2034 /*
2035 * Free the session record.
2036 */
2037 if (pUsagePrev)
2038 pUsagePrev->pNext = pUsage->pNext;
2039 else
2040 pSession->pUsage = pUsage->pNext;
2041 pUsage->pNext = pDevExt->pUsageFree;
2042 pDevExt->pUsageFree = pUsage;
2043
2044 /* What about the object? */
2045 if (pObj->cUsage > 1)
2046 pObj->cUsage--;
2047 else
2048 {
2049 /*
2050 * Object is to be destroyed, unlink it.
2051 */
2052 pObj->u32Magic = SUPDRVOBJ_MAGIC_DEAD;
2053 rc = VINF_OBJECT_DESTROYED;
2054 if (pDevExt->pObjs == pObj)
2055 pDevExt->pObjs = pObj->pNext;
2056 else
2057 {
2058 PSUPDRVOBJ pObjPrev;
2059 for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
2060 if (pObjPrev->pNext == pObj)
2061 {
2062 pObjPrev->pNext = pObj->pNext;
2063 break;
2064 }
2065 Assert(pObjPrev);
2066 }
2067 }
2068 }
2069 break;
2070 }
2071 }
2072
2073 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2074
2075 /*
2076 * Call the destructor and free the object if required.
2077 */
2078 if (rc == VINF_OBJECT_DESTROYED)
2079 {
2080 Log(("SUPR0ObjRelease: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
2081 pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
2082 if (pObj->pfnDestructor)
2083 pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
2084 RTMemFree(pObj);
2085 }
2086
2087 AssertMsg(pUsage, ("pvObj=%p\n", pvObj));
2088 return rc;
2089}
2090
2091
2092/**
2093 * Verifies that the current process can access the specified object.
2094 *
2095 * @returns The following IPRT status code:
2096 * @retval VINF_SUCCESS if access was granted.
2097 * @retval VERR_PERMISSION_DENIED if denied access.
2098 * @retval VERR_INVALID_PARAMETER if invalid parameter.
2099 *
2100 * @param pvObj The identifier returned by SUPR0ObjRegister().
2101 * @param pSession The session which wishes to access the object.
2102 * @param pszObjName Object string name. This is optional and depends on the object type.
2103 *
2104 * @remark The caller is responsible for making sure the object isn't removed while
2105 * we're inside this function. If uncertain about this, just call AddRef before calling us.
2106 */
2107SUPR0DECL(int) SUPR0ObjVerifyAccess(void *pvObj, PSUPDRVSESSION pSession, const char *pszObjName)
2108{
2109 PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2110 int rc;
2111
2112 /*
2113 * Validate the input.
2114 */
2115 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2116 AssertMsgReturn(VALID_PTR(pObj) && pObj->u32Magic == SUPDRVOBJ_MAGIC,
2117 ("Invalid pvObj=%p magic=%#x (exepcted %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
2118 VERR_INVALID_PARAMETER);
2119
2120 /*
2121 * Check access. (returns true if a decision has been made.)
2122 */
2123 rc = VERR_INTERNAL_ERROR;
2124 if (supdrvOSObjCanAccess(pObj, pSession, pszObjName, &rc))
2125 return rc;
2126
2127 /*
2128 * Default policy is to allow the user to access his own
2129 * stuff but nothing else.
2130 */
2131 if (pObj->CreatorUid == pSession->Uid)
2132 return VINF_SUCCESS;
2133 return VERR_PERMISSION_DENIED;
2134}
2135
2136
2137/**
2138 * Lock pages.
2139 *
2140 * @returns IPRT status code.
2141 * @param pSession Session to which the locked memory should be associated.
2142 * @param pvR3 Start of the memory range to lock.
2143 * This must be page aligned.
2144 * @param cPages Number of pages to lock.
2145 * @param paPages Where to put the physical addresses of locked memory.
2146 */
2147SUPR0DECL(int) SUPR0LockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t cPages, PRTHCPHYS paPages)
2148{
2149 int rc;
2150 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2151 const size_t cb = (size_t)cPages << PAGE_SHIFT;
2152 LogFlow(("SUPR0LockMem: pSession=%p pvR3=%p cPages=%d paPages=%p\n", pSession, (void *)pvR3, cPages, paPages));
2153
2154 /*
2155 * Verify input.
2156 */
2157 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2158 AssertPtrReturn(paPages, VERR_INVALID_PARAMETER);
2159 if ( RT_ALIGN_R3PT(pvR3, PAGE_SIZE, RTR3PTR) != pvR3
2160 || !pvR3)
2161 {
2162 Log(("pvR3 (%p) must be page aligned and not NULL!\n", (void *)pvR3));
2163 return VERR_INVALID_PARAMETER;
2164 }
2165
2166 /*
2167 * Let IPRT do the job.
2168 */
2169 Mem.eType = MEMREF_TYPE_LOCKED;
2170 rc = RTR0MemObjLockUser(&Mem.MemObj, pvR3, cb, RTMEM_PROT_READ | RTMEM_PROT_WRITE, RTR0ProcHandleSelf());
2171 if (RT_SUCCESS(rc))
2172 {
2173 uint32_t iPage = cPages;
2174 AssertMsg(RTR0MemObjAddressR3(Mem.MemObj) == pvR3, ("%p == %p\n", RTR0MemObjAddressR3(Mem.MemObj), pvR3));
2175 AssertMsg(RTR0MemObjSize(Mem.MemObj) == cb, ("%x == %x\n", RTR0MemObjSize(Mem.MemObj), cb));
2176
2177 while (iPage-- > 0)
2178 {
2179 paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
2180 if (RT_UNLIKELY(paPages[iPage] == NIL_RTCCPHYS))
2181 {
2182 AssertMsgFailed(("iPage=%d\n", iPage));
2183 rc = VERR_INTERNAL_ERROR;
2184 break;
2185 }
2186 }
2187 if (RT_SUCCESS(rc))
2188 rc = supdrvMemAdd(&Mem, pSession);
2189 if (RT_FAILURE(rc))
2190 {
2191 int rc2 = RTR0MemObjFree(Mem.MemObj, false);
2192 AssertRC(rc2);
2193 }
2194 }
2195
2196 return rc;
2197}
2198
2199
2200/**
2201 * Unlocks the memory pointed to by pv.
2202 *
2203 * @returns IPRT status code.
2204 * @param pSession Session to which the memory was locked.
2205 * @param pvR3 Memory to unlock.
2206 */
2207SUPR0DECL(int) SUPR0UnlockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3)
2208{
2209 LogFlow(("SUPR0UnlockMem: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
2210 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2211 return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_LOCKED);
2212}
2213
2214
2215/**
2216 * Allocates a chunk of page aligned memory with contiguous and fixed physical
2217 * backing.
2218 *
2219 * @returns IPRT status code.
2220 * @param pSession Session data.
2221 * @param cPages Number of pages to allocate.
2222 * @param ppvR0 Where to put the address of Ring-0 mapping the allocated memory.
2223 * @param ppvR3 Where to put the address of Ring-3 mapping the allocated memory.
2224 * @param pHCPhys Where to put the physical address of allocated memory.
2225 */
2226SUPR0DECL(int) SUPR0ContAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS pHCPhys)
2227{
2228 int rc;
2229 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2230 LogFlow(("SUPR0ContAlloc: pSession=%p cPages=%d ppvR0=%p ppvR3=%p pHCPhys=%p\n", pSession, cPages, ppvR0, ppvR3, pHCPhys));
2231
2232 /*
2233 * Validate input.
2234 */
2235 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2236 if (!ppvR3 || !ppvR0 || !pHCPhys)
2237 {
2238 Log(("Null pointer. All of these should be set: pSession=%p ppvR0=%p ppvR3=%p pHCPhys=%p\n",
2239 pSession, ppvR0, ppvR3, pHCPhys));
2240 return VERR_INVALID_PARAMETER;
2241
2242 }
2243 if (cPages < 1 || cPages >= 256)
2244 {
2245 Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
2246 return VERR_PAGE_COUNT_OUT_OF_RANGE;
2247 }
2248
2249 /*
2250 * Let IPRT do the job.
2251 */
2252 rc = RTR0MemObjAllocCont(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable R0 mapping */);
2253 if (RT_SUCCESS(rc))
2254 {
2255 int rc2;
2256 rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2257 RTMEM_PROT_EXEC | RTMEM_PROT_WRITE | RTMEM_PROT_READ, RTR0ProcHandleSelf());
2258 if (RT_SUCCESS(rc))
2259 {
2260 Mem.eType = MEMREF_TYPE_CONT;
2261 rc = supdrvMemAdd(&Mem, pSession);
2262 if (!rc)
2263 {
2264 *ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2265 *ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2266 *pHCPhys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, 0);
2267 return 0;
2268 }
2269
2270 rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2271 AssertRC(rc2);
2272 }
2273 rc2 = RTR0MemObjFree(Mem.MemObj, false);
2274 AssertRC(rc2);
2275 }
2276
2277 return rc;
2278}
2279
2280
2281/**
2282 * Frees memory allocated using SUPR0ContAlloc().
2283 *
2284 * @returns IPRT status code.
2285 * @param pSession The session to which the memory was allocated.
2286 * @param uPtr Pointer to the memory (ring-3 or ring-0).
2287 */
2288SUPR0DECL(int) SUPR0ContFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2289{
2290 LogFlow(("SUPR0ContFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2291 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2292 return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_CONT);
2293}
2294
2295
2296/**
2297 * Allocates a chunk of page aligned memory with fixed physical backing below 4GB.
2298 *
2299 * The memory isn't zeroed.
2300 *
2301 * @returns IPRT status code.
2302 * @param pSession Session data.
2303 * @param cPages Number of pages to allocate.
2304 * @param ppvR0 Where to put the address of Ring-0 mapping of the allocated memory.
2305 * @param ppvR3 Where to put the address of Ring-3 mapping of the allocated memory.
2306 * @param paPages Where to put the physical addresses of allocated memory.
2307 */
2308SUPR0DECL(int) SUPR0LowAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS paPages)
2309{
2310 unsigned iPage;
2311 int rc;
2312 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2313 LogFlow(("SUPR0LowAlloc: pSession=%p cPages=%d ppvR3=%p ppvR0=%p paPages=%p\n", pSession, cPages, ppvR3, ppvR0, paPages));
2314
2315 /*
2316 * Validate input.
2317 */
2318 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2319 if (!ppvR3 || !ppvR0 || !paPages)
2320 {
2321 Log(("Null pointer. All of these should be set: pSession=%p ppvR3=%p ppvR0=%p paPages=%p\n",
2322 pSession, ppvR3, ppvR0, paPages));
2323 return VERR_INVALID_PARAMETER;
2324
2325 }
2326 if (cPages < 1 || cPages >= 256)
2327 {
2328 Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
2329 return VERR_PAGE_COUNT_OUT_OF_RANGE;
2330 }
2331
2332 /*
2333 * Let IPRT do the work.
2334 */
2335 rc = RTR0MemObjAllocLow(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable ring-0 mapping */);
2336 if (RT_SUCCESS(rc))
2337 {
2338 int rc2;
2339 rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2340 RTMEM_PROT_EXEC | RTMEM_PROT_WRITE | RTMEM_PROT_READ, RTR0ProcHandleSelf());
2341 if (RT_SUCCESS(rc))
2342 {
2343 Mem.eType = MEMREF_TYPE_LOW;
2344 rc = supdrvMemAdd(&Mem, pSession);
2345 if (!rc)
2346 {
2347 for (iPage = 0; iPage < cPages; iPage++)
2348 {
2349 paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
2350 AssertMsg(!(paPages[iPage] & (PAGE_SIZE - 1)), ("iPage=%d Phys=%RHp\n", paPages[iPage]));
2351 }
2352 *ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2353 *ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2354 return 0;
2355 }
2356
2357 rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2358 AssertRC(rc2);
2359 }
2360
2361 rc2 = RTR0MemObjFree(Mem.MemObj, false);
2362 AssertRC(rc2);
2363 }
2364
2365 return rc;
2366}
2367
2368
2369/**
2370 * Frees memory allocated using SUPR0LowAlloc().
2371 *
2372 * @returns IPRT status code.
2373 * @param pSession The session to which the memory was allocated.
2374 * @param uPtr Pointer to the memory (ring-3 or ring-0).
2375 */
2376SUPR0DECL(int) SUPR0LowFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2377{
2378 LogFlow(("SUPR0LowFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2379 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2380 return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_LOW);
2381}
2382
2383
2384
2385/**
2386 * Allocates a chunk of memory with both R0 and R3 mappings.
2387 * The memory is fixed and it's possible to query the physical addresses using SUPR0MemGetPhys().
2388 *
2389 * @returns IPRT status code.
2390 * @param pSession The session to associated the allocation with.
2391 * @param cb Number of bytes to allocate.
2392 * @param ppvR0 Where to store the address of the Ring-0 mapping.
2393 * @param ppvR3 Where to store the address of the Ring-3 mapping.
2394 */
2395SUPR0DECL(int) SUPR0MemAlloc(PSUPDRVSESSION pSession, uint32_t cb, PRTR0PTR ppvR0, PRTR3PTR ppvR3)
2396{
2397 int rc;
2398 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2399 LogFlow(("SUPR0MemAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p\n", pSession, cb, ppvR0, ppvR3));
2400
2401 /*
2402 * Validate input.
2403 */
2404 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2405 AssertPtrReturn(ppvR0, VERR_INVALID_POINTER);
2406 AssertPtrReturn(ppvR3, VERR_INVALID_POINTER);
2407 if (cb < 1 || cb >= _4M)
2408 {
2409 Log(("Illegal request cb=%u; must be greater than 0 and smaller than 4MB.\n", cb));
2410 return VERR_INVALID_PARAMETER;
2411 }
2412
2413 /*
2414 * Let IPRT do the work.
2415 */
2416 rc = RTR0MemObjAllocPage(&Mem.MemObj, cb, true /* executable ring-0 mapping */);
2417 if (RT_SUCCESS(rc))
2418 {
2419 int rc2;
2420 rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2421 RTMEM_PROT_EXEC | RTMEM_PROT_WRITE | RTMEM_PROT_READ, RTR0ProcHandleSelf());
2422 if (RT_SUCCESS(rc))
2423 {
2424 Mem.eType = MEMREF_TYPE_MEM;
2425 rc = supdrvMemAdd(&Mem, pSession);
2426 if (!rc)
2427 {
2428 *ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2429 *ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2430 return VINF_SUCCESS;
2431 }
2432
2433 rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2434 AssertRC(rc2);
2435 }
2436
2437 rc2 = RTR0MemObjFree(Mem.MemObj, false);
2438 AssertRC(rc2);
2439 }
2440
2441 return rc;
2442}
2443
2444
2445/**
2446 * Get the physical addresses of memory allocated using SUPR0MemAlloc().
2447 *
2448 * @returns IPRT status code.
2449 * @param pSession The session to which the memory was allocated.
2450 * @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2451 * @param paPages Where to store the physical addresses.
2452 */
2453SUPR0DECL(int) SUPR0MemGetPhys(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, PSUPPAGE paPages) /** @todo switch this bugger to RTHCPHYS */
2454{
2455 PSUPDRVBUNDLE pBundle;
2456 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2457 LogFlow(("SUPR0MemGetPhys: pSession=%p uPtr=%p paPages=%p\n", pSession, (void *)uPtr, paPages));
2458
2459 /*
2460 * Validate input.
2461 */
2462 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2463 AssertPtrReturn(paPages, VERR_INVALID_POINTER);
2464 AssertReturn(uPtr, VERR_INVALID_PARAMETER);
2465
2466 /*
2467 * Search for the address.
2468 */
2469 RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2470 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2471 {
2472 if (pBundle->cUsed > 0)
2473 {
2474 unsigned i;
2475 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2476 {
2477 if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
2478 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2479 && ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
2480 || ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2481 && RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr)
2482 )
2483 )
2484 {
2485 const size_t cPages = RTR0MemObjSize(pBundle->aMem[i].MemObj) >> PAGE_SHIFT;
2486 size_t iPage;
2487 for (iPage = 0; iPage < cPages; iPage++)
2488 {
2489 paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(pBundle->aMem[i].MemObj, iPage);
2490 paPages[iPage].uReserved = 0;
2491 }
2492 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2493 return VINF_SUCCESS;
2494 }
2495 }
2496 }
2497 }
2498 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2499 Log(("Failed to find %p!!!\n", (void *)uPtr));
2500 return VERR_INVALID_PARAMETER;
2501}
2502
2503
2504/**
2505 * Free memory allocated by SUPR0MemAlloc().
2506 *
2507 * @returns IPRT status code.
2508 * @param pSession The session owning the allocation.
2509 * @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2510 */
2511SUPR0DECL(int) SUPR0MemFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2512{
2513 LogFlow(("SUPR0MemFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2514 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2515 return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_MEM);
2516}
2517
2518
2519/**
2520 * Allocates a chunk of memory with a kernel or/and a user mode mapping.
2521 *
2522 * The memory is fixed and it's possible to query the physical addresses using
2523 * SUPR0MemGetPhys().
2524 *
2525 * @returns IPRT status code.
2526 * @param pSession The session to associated the allocation with.
2527 * @param cPages The number of pages to allocate.
2528 * @param fFlags Flags, reserved for the future. Must be zero.
2529 * @param ppvR3 Where to store the address of the Ring-3 mapping.
2530 * NULL if no ring-3 mapping.
2531 * @param ppvR3 Where to store the address of the Ring-0 mapping.
2532 * NULL if no ring-0 mapping.
2533 * @param paPages Where to store the addresses of the pages. Optional.
2534 */
2535SUPR0DECL(int) SUPR0PageAllocEx(PSUPDRVSESSION pSession, uint32_t cPages, uint32_t fFlags, PRTR3PTR ppvR3, PRTR0PTR ppvR0, PRTHCPHYS paPages)
2536{
2537 int rc;
2538 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2539 LogFlow(("SUPR0PageAlloc: pSession=%p cb=%d ppvR3=%p\n", pSession, cPages, ppvR3));
2540
2541 /*
2542 * Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2543 */
2544 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2545 AssertPtrNullReturn(ppvR3, VERR_INVALID_POINTER);
2546 AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
2547 AssertReturn(ppvR3 || ppvR0, VERR_INVALID_PARAMETER);
2548 AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
2549 if (cPages < 1 || cPages > VBOX_MAX_ALLOC_PAGE_COUNT)
2550 {
2551 Log(("SUPR0PageAlloc: Illegal request cb=%u; must be greater than 0 and smaller than 128MB.\n", cPages));
2552 return VERR_PAGE_COUNT_OUT_OF_RANGE;
2553 }
2554
2555 /*
2556 * Let IPRT do the work.
2557 */
2558 if (ppvR0)
2559 rc = RTR0MemObjAllocPage(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, true /* fExecutable */);
2560 else
2561 rc = RTR0MemObjAllocPhysNC(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, NIL_RTHCPHYS);
2562 if (RT_SUCCESS(rc))
2563 {
2564 int rc2;
2565 if (ppvR3)
2566 rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2567 RTMEM_PROT_EXEC | RTMEM_PROT_WRITE | RTMEM_PROT_READ, RTR0ProcHandleSelf());
2568 else
2569 Mem.MapObjR3 = NIL_RTR0MEMOBJ;
2570 if (RT_SUCCESS(rc))
2571 {
2572 Mem.eType = MEMREF_TYPE_PAGE;
2573 rc = supdrvMemAdd(&Mem, pSession);
2574 if (!rc)
2575 {
2576 if (ppvR3)
2577 *ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2578 if (ppvR0)
2579 *ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2580 if (paPages)
2581 {
2582 uint32_t iPage = cPages;
2583 while (iPage-- > 0)
2584 {
2585 paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MapObjR3, iPage);
2586 Assert(paPages[iPage] != NIL_RTHCPHYS);
2587 }
2588 }
2589 return VINF_SUCCESS;
2590 }
2591
2592 rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2593 AssertRC(rc2);
2594 }
2595
2596 rc2 = RTR0MemObjFree(Mem.MemObj, false);
2597 AssertRC(rc2);
2598 }
2599 return rc;
2600}
2601
2602
2603/**
2604 * Maps a chunk of memory previously allocated by SUPR0PageAllocEx into kernel
2605 * space.
2606 *
2607 * @returns IPRT status code.
2608 * @param pSession The session to associated the allocation with.
2609 * @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
2610 * @param offSub Where to start mapping. Must be page aligned.
2611 * @param cbSub How much to map. Must be page aligned.
2612 * @param fFlags Flags, MBZ.
2613 * @param ppvR0 Where to reutrn the address of the ring-0 mapping on
2614 * success.
2615 */
2616SUPR0DECL(int) SUPR0PageMapKernel(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t offSub, uint32_t cbSub,
2617 uint32_t fFlags, PRTR0PTR ppvR0)
2618{
2619 int rc;
2620 PSUPDRVBUNDLE pBundle;
2621 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2622 RTR0MEMOBJ hMemObj = NIL_RTR0MEMOBJ;
2623 LogFlow(("SUPR0PageMapKernel: pSession=%p pvR3=%p offSub=%#x cbSub=%#x\n", pSession, pvR3, offSub, cbSub));
2624
2625 /*
2626 * Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2627 */
2628 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2629 AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
2630 AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
2631 AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2632 AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2633 AssertReturn(cbSub, VERR_INVALID_PARAMETER);
2634
2635 /*
2636 * Find the memory object.
2637 */
2638 RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2639 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2640 {
2641 if (pBundle->cUsed > 0)
2642 {
2643 unsigned i;
2644 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2645 {
2646 if ( ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
2647 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2648 && pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2649 && RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3)
2650 || ( pBundle->aMem[i].eType == MEMREF_TYPE_LOCKED
2651 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2652 && pBundle->aMem[i].MapObjR3 == NIL_RTR0MEMOBJ
2653 && RTR0MemObjAddressR3(pBundle->aMem[i].MemObj) == pvR3))
2654 {
2655 hMemObj = pBundle->aMem[i].MemObj;
2656 break;
2657 }
2658 }
2659 }
2660 }
2661 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2662
2663 rc = VERR_INVALID_PARAMETER;
2664 if (hMemObj != NIL_RTR0MEMOBJ)
2665 {
2666 /*
2667 * Do some furter input validations before calling IPRT.
2668 * (Cleanup is done indirectly by telling RTR0MemObjFree to include mappings.)
2669 */
2670 size_t cbMemObj = RTR0MemObjSize(hMemObj);
2671 if ( offSub < cbMemObj
2672 && cbSub <= cbMemObj
2673 && offSub + cbSub <= cbMemObj)
2674 {
2675 RTR0MEMOBJ hMapObj;
2676 rc = RTR0MemObjMapKernelEx(&hMapObj, hMemObj, (void *)-1, 0,
2677 RTMEM_PROT_READ | RTMEM_PROT_WRITE, offSub, cbSub);
2678 if (RT_SUCCESS(rc))
2679 *ppvR0 = RTR0MemObjAddress(hMapObj);
2680 }
2681 else
2682 SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
2683
2684 }
2685 return rc;
2686}
2687
2688
2689/**
2690 * Changes the page level protection of one or more pages previously allocated
2691 * by SUPR0PageAllocEx.
2692 *
2693 * @returns IPRT status code.
2694 * @param pSession The session to associated the allocation with.
2695 * @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
2696 * NIL_RTR3PTR if the ring-3 mapping should be unaffected.
2697 * @param pvR0 The ring-0 address returned by SUPR0PageAllocEx.
2698 * NIL_RTR0PTR if the ring-0 mapping should be unaffected.
2699 * @param offSub Where to start changing. Must be page aligned.
2700 * @param cbSub How much to change. Must be page aligned.
2701 * @param fProt The new page level protection, see RTMEM_PROT_*.
2702 */
2703SUPR0DECL(int) SUPR0PageProtect(PSUPDRVSESSION pSession, RTR3PTR pvR3, RTR0PTR pvR0, uint32_t offSub, uint32_t cbSub, uint32_t fProt)
2704{
2705 int rc;
2706 PSUPDRVBUNDLE pBundle;
2707 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2708 RTR0MEMOBJ hMemObjR0 = NIL_RTR0MEMOBJ;
2709 RTR0MEMOBJ hMemObjR3 = NIL_RTR0MEMOBJ;
2710 LogFlow(("SUPR0PageProtect: pSession=%p pvR3=%p pvR0=%p offSub=%#x cbSub=%#x fProt-%#x\n", pSession, pvR3, pvR0, offSub, cbSub, fProt));
2711
2712 /*
2713 * Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2714 */
2715 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2716 AssertReturn(!(fProt & ~(RTMEM_PROT_READ | RTMEM_PROT_WRITE | RTMEM_PROT_EXEC | RTMEM_PROT_NONE)), VERR_INVALID_PARAMETER);
2717 AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2718 AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2719 AssertReturn(cbSub, VERR_INVALID_PARAMETER);
2720
2721 /*
2722 * Find the memory object.
2723 */
2724 RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2725 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2726 {
2727 if (pBundle->cUsed > 0)
2728 {
2729 unsigned i;
2730 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2731 {
2732 if ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
2733 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2734 && ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2735 || pvR3 == NIL_RTR3PTR)
2736 && ( pvR0 == NIL_RTR0PTR
2737 || RTR0MemObjAddress(pBundle->aMem[i].MemObj) == pvR0)
2738 && ( pvR3 == NIL_RTR3PTR
2739 || RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3))
2740 {
2741 if (pvR0 != NIL_RTR0PTR)
2742 hMemObjR0 = pBundle->aMem[i].MemObj;
2743 if (pvR3 != NIL_RTR3PTR)
2744 hMemObjR3 = pBundle->aMem[i].MapObjR3;
2745 break;
2746 }
2747 }
2748 }
2749 }
2750 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2751
2752 rc = VERR_INVALID_PARAMETER;
2753 if ( hMemObjR0 != NIL_RTR0MEMOBJ
2754 || hMemObjR3 != NIL_RTR0MEMOBJ)
2755 {
2756 /*
2757 * Do some furter input validations before calling IPRT.
2758 */
2759 size_t cbMemObj = hMemObjR0 != NIL_RTR0PTR ? RTR0MemObjSize(hMemObjR0) : RTR0MemObjSize(hMemObjR3);
2760 if ( offSub < cbMemObj
2761 && cbSub <= cbMemObj
2762 && offSub + cbSub <= cbMemObj)
2763 {
2764 rc = VINF_SUCCESS;
2765 if (hMemObjR3 != NIL_RTR0PTR)
2766 rc = RTR0MemObjProtect(hMemObjR3, offSub, cbSub, fProt);
2767 if (hMemObjR0 != NIL_RTR0PTR && RT_SUCCESS(rc))
2768 rc = RTR0MemObjProtect(hMemObjR0, offSub, cbSub, fProt);
2769 }
2770 else
2771 SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
2772
2773 }
2774 return rc;
2775
2776}
2777
2778
2779/**
2780 * Free memory allocated by SUPR0PageAlloc() and SUPR0PageAllocEx().
2781 *
2782 * @returns IPRT status code.
2783 * @param pSession The session owning the allocation.
2784 * @param pvR3 The Ring-3 address returned by SUPR0PageAlloc() or
2785 * SUPR0PageAllocEx().
2786 */
2787SUPR0DECL(int) SUPR0PageFree(PSUPDRVSESSION pSession, RTR3PTR pvR3)
2788{
2789 LogFlow(("SUPR0PageFree: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
2790 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2791 return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_PAGE);
2792}
2793
2794
2795/**
2796 * Gets the paging mode of the current CPU.
2797 *
2798 * @returns Paging mode, SUPPAGEINGMODE_INVALID on error.
2799 */
2800SUPR0DECL(SUPPAGINGMODE) SUPR0GetPagingMode(void)
2801{
2802 SUPPAGINGMODE enmMode;
2803
2804 RTR0UINTREG cr0 = ASMGetCR0();
2805 if ((cr0 & (X86_CR0_PG | X86_CR0_PE)) != (X86_CR0_PG | X86_CR0_PE))
2806 enmMode = SUPPAGINGMODE_INVALID;
2807 else
2808 {
2809 RTR0UINTREG cr4 = ASMGetCR4();
2810 uint32_t fNXEPlusLMA = 0;
2811 if (cr4 & X86_CR4_PAE)
2812 {
2813 uint32_t fAmdFeatures = ASMCpuId_EDX(0x80000001);
2814 if (fAmdFeatures & (X86_CPUID_AMD_FEATURE_EDX_NX | X86_CPUID_AMD_FEATURE_EDX_LONG_MODE))
2815 {
2816 uint64_t efer = ASMRdMsr(MSR_K6_EFER);
2817 if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_NX) && (efer & MSR_K6_EFER_NXE))
2818 fNXEPlusLMA |= RT_BIT(0);
2819 if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE) && (efer & MSR_K6_EFER_LMA))
2820 fNXEPlusLMA |= RT_BIT(1);
2821 }
2822 }
2823
2824 switch ((cr4 & (X86_CR4_PAE | X86_CR4_PGE)) | fNXEPlusLMA)
2825 {
2826 case 0:
2827 enmMode = SUPPAGINGMODE_32_BIT;
2828 break;
2829
2830 case X86_CR4_PGE:
2831 enmMode = SUPPAGINGMODE_32_BIT_GLOBAL;
2832 break;
2833
2834 case X86_CR4_PAE:
2835 enmMode = SUPPAGINGMODE_PAE;
2836 break;
2837
2838 case X86_CR4_PAE | RT_BIT(0):
2839 enmMode = SUPPAGINGMODE_PAE_NX;
2840 break;
2841
2842 case X86_CR4_PAE | X86_CR4_PGE:
2843 enmMode = SUPPAGINGMODE_PAE_GLOBAL;
2844 break;
2845
2846 case X86_CR4_PAE | X86_CR4_PGE | RT_BIT(0):
2847 enmMode = SUPPAGINGMODE_PAE_GLOBAL;
2848 break;
2849
2850 case RT_BIT(1) | X86_CR4_PAE:
2851 enmMode = SUPPAGINGMODE_AMD64;
2852 break;
2853
2854 case RT_BIT(1) | X86_CR4_PAE | RT_BIT(0):
2855 enmMode = SUPPAGINGMODE_AMD64_NX;
2856 break;
2857
2858 case RT_BIT(1) | X86_CR4_PAE | X86_CR4_PGE:
2859 enmMode = SUPPAGINGMODE_AMD64_GLOBAL;
2860 break;
2861
2862 case RT_BIT(1) | X86_CR4_PAE | X86_CR4_PGE | RT_BIT(0):
2863 enmMode = SUPPAGINGMODE_AMD64_GLOBAL_NX;
2864 break;
2865
2866 default:
2867 AssertMsgFailed(("Cannot happen! cr4=%#x fNXEPlusLMA=%d\n", cr4, fNXEPlusLMA));
2868 enmMode = SUPPAGINGMODE_INVALID;
2869 break;
2870 }
2871 }
2872 return enmMode;
2873}
2874
2875
2876/**
2877 * Enables or disabled hardware virtualization extensions using native OS APIs.
2878 *
2879 * @returns VBox status code.
2880 * @retval VINF_SUCCESS on success.
2881 * @retval VERR_NOT_SUPPORTED if not supported by the native OS.
2882 *
2883 * @param fEnable Whether to enable or disable.
2884 */
2885SUPR0DECL(int) SUPR0EnableVTx(bool fEnable)
2886{
2887#ifdef RT_OS_DARWIN
2888 return supdrvOSEnableVTx(fEnable);
2889#else
2890 return VERR_NOT_SUPPORTED;
2891#endif
2892}
2893
2894
2895/** @todo document me */
2896SUPR0DECL(int) SUPR0QueryVTCaps(PSUPDRVSESSION pSession, uint32_t *pfCaps)
2897{
2898 /*
2899 * Input validation.
2900 */
2901 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2902 AssertPtrReturn(pfCaps, VERR_INVALID_POINTER);
2903
2904 *pfCaps = 0;
2905
2906 if (ASMHasCpuId())
2907 {
2908 uint32_t u32FeaturesECX;
2909 uint32_t u32Dummy;
2910 uint32_t u32FeaturesEDX;
2911 uint32_t u32VendorEBX, u32VendorECX, u32VendorEDX, u32AMDFeatureEDX, u32AMDFeatureECX;
2912 uint64_t val;
2913
2914 ASMCpuId(0, &u32Dummy, &u32VendorEBX, &u32VendorECX, &u32VendorEDX);
2915 ASMCpuId(1, &u32Dummy, &u32Dummy, &u32FeaturesECX, &u32FeaturesEDX);
2916 /* Query AMD features. */
2917 ASMCpuId(0x80000001, &u32Dummy, &u32Dummy, &u32AMDFeatureECX, &u32AMDFeatureEDX);
2918
2919 if ( u32VendorEBX == X86_CPUID_VENDOR_INTEL_EBX
2920 && u32VendorECX == X86_CPUID_VENDOR_INTEL_ECX
2921 && u32VendorEDX == X86_CPUID_VENDOR_INTEL_EDX
2922 )
2923 {
2924 if ( (u32FeaturesECX & X86_CPUID_FEATURE_ECX_VMX)
2925 && (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_MSR)
2926 && (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_FXSR)
2927 )
2928 {
2929 val = ASMRdMsr(MSR_IA32_FEATURE_CONTROL);
2930 /*
2931 * Both the LOCK and VMXON bit must be set; otherwise VMXON will generate a #GP.
2932 * Once the lock bit is set, this MSR can no longer be modified.
2933 */
2934 if ( (val & (MSR_IA32_FEATURE_CONTROL_VMXON|MSR_IA32_FEATURE_CONTROL_LOCK))
2935 == (MSR_IA32_FEATURE_CONTROL_VMXON|MSR_IA32_FEATURE_CONTROL_LOCK) /* enabled and locked */
2936 || !(val & MSR_IA32_FEATURE_CONTROL_LOCK) /* not enabled, but not locked either */
2937 )
2938 {
2939 VMX_CAPABILITY vtCaps;
2940
2941 *pfCaps |= SUPVTCAPS_VT_X;
2942
2943 vtCaps.u = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS);
2944 if (vtCaps.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
2945 {
2946 vtCaps.u = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS2);
2947 if (vtCaps.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_EPT)
2948 *pfCaps |= SUPVTCAPS_NESTED_PAGING;
2949 }
2950 return VINF_SUCCESS;
2951 }
2952 return VERR_VMX_MSR_LOCKED_OR_DISABLED;
2953 }
2954 return VERR_VMX_NO_VMX;
2955 }
2956
2957 if ( u32VendorEBX == X86_CPUID_VENDOR_AMD_EBX
2958 && u32VendorECX == X86_CPUID_VENDOR_AMD_ECX
2959 && u32VendorEDX == X86_CPUID_VENDOR_AMD_EDX
2960 )
2961 {
2962 if ( (u32AMDFeatureECX & X86_CPUID_AMD_FEATURE_ECX_SVM)
2963 && (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_MSR)
2964 && (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_FXSR)
2965 )
2966 {
2967 /* Check if SVM is disabled */
2968 val = ASMRdMsr(MSR_K8_VM_CR);
2969 if (!(val & MSR_K8_VM_CR_SVM_DISABLE))
2970 {
2971 *pfCaps |= SUPVTCAPS_AMD_V;
2972
2973 /* Query AMD features. */
2974 ASMCpuId(0x8000000A, &u32Dummy, &u32Dummy, &u32Dummy, &u32FeaturesEDX);
2975
2976 if (u32FeaturesEDX & AMD_CPUID_SVM_FEATURE_EDX_NESTED_PAGING)
2977 *pfCaps |= SUPVTCAPS_NESTED_PAGING;
2978
2979 return VINF_SUCCESS;
2980 }
2981 return VERR_SVM_DISABLED;
2982 }
2983 return VERR_SVM_NO_SVM;
2984 }
2985 }
2986
2987 return VERR_UNSUPPORTED_CPU;
2988}
2989
2990
2991/**
2992 * (Re-)initializes the per-cpu structure prior to starting or resuming the GIP
2993 * updating.
2994 *
2995 * @param pGipCpu The per CPU structure for this CPU.
2996 * @param u64NanoTS The current time.
2997 */
2998static void supdrvGipReInitCpu(PSUPGIPCPU pGipCpu, uint64_t u64NanoTS)
2999{
3000 pGipCpu->u64TSC = ASMReadTSC() - pGipCpu->u32UpdateIntervalTSC;
3001 pGipCpu->u64NanoTS = u64NanoTS;
3002}
3003
3004
3005/**
3006 * Set the current TSC and NanoTS value for the CPU.
3007 *
3008 * @param idCpu The CPU ID. Unused - we have to use the APIC ID.
3009 * @param pvUser1 Pointer to the ring-0 GIP mapping.
3010 * @param pvUser2 Pointer to the variable holding the current time.
3011 */
3012static DECLCALLBACK(void) supdrvGipReInitCpuCallback(RTCPUID idCpu, void *pvUser1, void *pvUser2)
3013{
3014 PSUPGLOBALINFOPAGE pGip = (PSUPGLOBALINFOPAGE)pvUser1;
3015 unsigned iCpu = ASMGetApicId();
3016
3017 if (RT_LIKELY(iCpu < RT_ELEMENTS(pGip->aCPUs)))
3018 supdrvGipReInitCpu(&pGip->aCPUs[iCpu], *(uint64_t *)pvUser2);
3019
3020 NOREF(pvUser2);
3021 NOREF(idCpu);
3022}
3023
3024
3025/**
3026 * Maps the GIP into userspace and/or get the physical address of the GIP.
3027 *
3028 * @returns IPRT status code.
3029 * @param pSession Session to which the GIP mapping should belong.
3030 * @param ppGipR3 Where to store the address of the ring-3 mapping. (optional)
3031 * @param pHCPhysGip Where to store the physical address. (optional)
3032 *
3033 * @remark There is no reference counting on the mapping, so one call to this function
3034 * count globally as one reference. One call to SUPR0GipUnmap() is will unmap GIP
3035 * and remove the session as a GIP user.
3036 */
3037SUPR0DECL(int) SUPR0GipMap(PSUPDRVSESSION pSession, PRTR3PTR ppGipR3, PRTHCPHYS pHCPhysGip)
3038{
3039 int rc;
3040 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
3041 RTR3PTR pGipR3 = NIL_RTR3PTR;
3042 RTHCPHYS HCPhys = NIL_RTHCPHYS;
3043 LogFlow(("SUPR0GipMap: pSession=%p ppGipR3=%p pHCPhysGip=%p\n", pSession, ppGipR3, pHCPhysGip));
3044
3045 /*
3046 * Validate
3047 */
3048 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3049 AssertPtrNullReturn(ppGipR3, VERR_INVALID_POINTER);
3050 AssertPtrNullReturn(pHCPhysGip, VERR_INVALID_POINTER);
3051
3052#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3053 RTSemMutexRequest(pDevExt->mtxGip, RT_INDEFINITE_WAIT);
3054#else
3055 RTSemFastMutexRequest(pDevExt->mtxGip);
3056#endif
3057 if (pDevExt->pGip)
3058 {
3059 /*
3060 * Map it?
3061 */
3062 rc = VINF_SUCCESS;
3063 if (ppGipR3)
3064 {
3065 if (pSession->GipMapObjR3 == NIL_RTR0MEMOBJ)
3066 rc = RTR0MemObjMapUser(&pSession->GipMapObjR3, pDevExt->GipMemObj, (RTR3PTR)-1, 0,
3067 RTMEM_PROT_READ, RTR0ProcHandleSelf());
3068 if (RT_SUCCESS(rc))
3069 pGipR3 = RTR0MemObjAddressR3(pSession->GipMapObjR3);
3070 }
3071
3072 /*
3073 * Get physical address.
3074 */
3075 if (pHCPhysGip && RT_SUCCESS(rc))
3076 HCPhys = pDevExt->HCPhysGip;
3077
3078 /*
3079 * Reference globally.
3080 */
3081 if (!pSession->fGipReferenced && RT_SUCCESS(rc))
3082 {
3083 pSession->fGipReferenced = 1;
3084 pDevExt->cGipUsers++;
3085 if (pDevExt->cGipUsers == 1)
3086 {
3087 PSUPGLOBALINFOPAGE pGipR0 = pDevExt->pGip;
3088 uint64_t u64NanoTS;
3089 unsigned i;
3090
3091 LogFlow(("SUPR0GipMap: Resumes GIP updating\n"));
3092
3093 if (pGipR0->aCPUs[0].u32TransactionId != 2 /* not the first time */)
3094 {
3095 for (i = 0; i < RT_ELEMENTS(pGipR0->aCPUs); i++)
3096 ASMAtomicUoWriteU32(&pGipR0->aCPUs[i].u32TransactionId,
3097 (pGipR0->aCPUs[i].u32TransactionId + GIP_UPDATEHZ_RECALC_FREQ * 2)
3098 & ~(GIP_UPDATEHZ_RECALC_FREQ * 2 - 1));
3099 ASMAtomicWriteU64(&pGipR0->u64NanoTSLastUpdateHz, 0);
3100 }
3101
3102 u64NanoTS = RTTimeSystemNanoTS() - pGipR0->u32UpdateIntervalNS;
3103 if ( pGipR0->u32Mode == SUPGIPMODE_SYNC_TSC
3104 || RTMpGetOnlineCount() == 1)
3105 supdrvGipReInitCpu(&pGipR0->aCPUs[0], u64NanoTS);
3106 else
3107 RTMpOnAll(supdrvGipReInitCpuCallback, pGipR0, &u64NanoTS);
3108
3109 rc = RTTimerStart(pDevExt->pGipTimer, 0);
3110 AssertRC(rc); rc = VINF_SUCCESS;
3111 }
3112 }
3113 }
3114 else
3115 {
3116 rc = VERR_GENERAL_FAILURE;
3117 Log(("SUPR0GipMap: GIP is not available!\n"));
3118 }
3119#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3120 RTSemMutexRelease(pDevExt->mtxGip);
3121#else
3122 RTSemFastMutexRelease(pDevExt->mtxGip);
3123#endif
3124
3125 /*
3126 * Write returns.
3127 */
3128 if (pHCPhysGip)
3129 *pHCPhysGip = HCPhys;
3130 if (ppGipR3)
3131 *ppGipR3 = pGipR3;
3132
3133#ifdef DEBUG_DARWIN_GIP
3134 OSDBGPRINT(("SUPR0GipMap: returns %d *pHCPhysGip=%lx pGipR3=%p\n", rc, (unsigned long)HCPhys, (void *)pGipR3));
3135#else
3136 LogFlow(( "SUPR0GipMap: returns %d *pHCPhysGip=%lx pGipR3=%p\n", rc, (unsigned long)HCPhys, (void *)pGipR3));
3137#endif
3138 return rc;
3139}
3140
3141
3142/**
3143 * Unmaps any user mapping of the GIP and terminates all GIP access
3144 * from this session.
3145 *
3146 * @returns IPRT status code.
3147 * @param pSession Session to which the GIP mapping should belong.
3148 */
3149SUPR0DECL(int) SUPR0GipUnmap(PSUPDRVSESSION pSession)
3150{
3151 int rc = VINF_SUCCESS;
3152 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
3153#ifdef DEBUG_DARWIN_GIP
3154 OSDBGPRINT(("SUPR0GipUnmap: pSession=%p pGip=%p GipMapObjR3=%p\n",
3155 pSession,
3156 pSession->GipMapObjR3 != NIL_RTR0MEMOBJ ? RTR0MemObjAddress(pSession->GipMapObjR3) : NULL,
3157 pSession->GipMapObjR3));
3158#else
3159 LogFlow(("SUPR0GipUnmap: pSession=%p\n", pSession));
3160#endif
3161 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3162
3163#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3164 RTSemMutexRequest(pDevExt->mtxGip, RT_INDEFINITE_WAIT);
3165#else
3166 RTSemFastMutexRequest(pDevExt->mtxGip);
3167#endif
3168
3169 /*
3170 * Unmap anything?
3171 */
3172 if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
3173 {
3174 rc = RTR0MemObjFree(pSession->GipMapObjR3, false);
3175 AssertRC(rc);
3176 if (RT_SUCCESS(rc))
3177 pSession->GipMapObjR3 = NIL_RTR0MEMOBJ;
3178 }
3179
3180 /*
3181 * Dereference global GIP.
3182 */
3183 if (pSession->fGipReferenced && !rc)
3184 {
3185 pSession->fGipReferenced = 0;
3186 if ( pDevExt->cGipUsers > 0
3187 && !--pDevExt->cGipUsers)
3188 {
3189 LogFlow(("SUPR0GipUnmap: Suspends GIP updating\n"));
3190 rc = RTTimerStop(pDevExt->pGipTimer); AssertRC(rc); rc = VINF_SUCCESS;
3191 }
3192 }
3193
3194#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3195 RTSemMutexRelease(pDevExt->mtxGip);
3196#else
3197 RTSemFastMutexRelease(pDevExt->mtxGip);
3198#endif
3199
3200 return rc;
3201}
3202
3203
3204/**
3205 * Gets the GIP pointer.
3206 *
3207 * @returns Pointer to the GIP or NULL.
3208 */
3209SUPDECL(PSUPGLOBALINFOPAGE) SUPGetGIP(void)
3210{
3211 return g_pSUPGlobalInfoPage;
3212}
3213
3214
3215/**
3216 * Register a component factory with the support driver.
3217 *
3218 * This is currently restricted to kernel sessions only.
3219 *
3220 * @returns VBox status code.
3221 * @retval VINF_SUCCESS on success.
3222 * @retval VERR_NO_MEMORY if we're out of memory.
3223 * @retval VERR_ALREADY_EXISTS if the factory has already been registered.
3224 * @retval VERR_ACCESS_DENIED if it isn't a kernel session.
3225 * @retval VERR_INVALID_PARAMETER on invalid parameter.
3226 * @retval VERR_INVALID_POINTER on invalid pointer parameter.
3227 *
3228 * @param pSession The SUPDRV session (must be a ring-0 session).
3229 * @param pFactory Pointer to the component factory registration structure.
3230 *
3231 * @remarks This interface is also available via SUPR0IdcComponentRegisterFactory.
3232 */
3233SUPR0DECL(int) SUPR0ComponentRegisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
3234{
3235 PSUPDRVFACTORYREG pNewReg;
3236 const char *psz;
3237 int rc;
3238
3239 /*
3240 * Validate parameters.
3241 */
3242 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3243 AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
3244 AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
3245 AssertPtrReturn(pFactory->pfnQueryFactoryInterface, VERR_INVALID_POINTER);
3246 psz = (const char *)memchr(pFactory->szName, '\0', sizeof(pFactory->szName));
3247 AssertReturn(psz, VERR_INVALID_PARAMETER);
3248
3249 /*
3250 * Allocate and initialize a new registration structure.
3251 */
3252 pNewReg = (PSUPDRVFACTORYREG)RTMemAlloc(sizeof(SUPDRVFACTORYREG));
3253 if (pNewReg)
3254 {
3255 pNewReg->pNext = NULL;
3256 pNewReg->pFactory = pFactory;
3257 pNewReg->pSession = pSession;
3258 pNewReg->cchName = psz - &pFactory->szName[0];
3259
3260 /*
3261 * Add it to the tail of the list after checking for prior registration.
3262 */
3263 rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3264 if (RT_SUCCESS(rc))
3265 {
3266 PSUPDRVFACTORYREG pPrev = NULL;
3267 PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3268 while (pCur && pCur->pFactory != pFactory)
3269 {
3270 pPrev = pCur;
3271 pCur = pCur->pNext;
3272 }
3273 if (!pCur)
3274 {
3275 if (pPrev)
3276 pPrev->pNext = pNewReg;
3277 else
3278 pSession->pDevExt->pComponentFactoryHead = pNewReg;
3279 rc = VINF_SUCCESS;
3280 }
3281 else
3282 rc = VERR_ALREADY_EXISTS;
3283
3284 RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3285 }
3286
3287 if (RT_FAILURE(rc))
3288 RTMemFree(pNewReg);
3289 }
3290 else
3291 rc = VERR_NO_MEMORY;
3292 return rc;
3293}
3294
3295
3296/**
3297 * Deregister a component factory.
3298 *
3299 * @returns VBox status code.
3300 * @retval VINF_SUCCESS on success.
3301 * @retval VERR_NOT_FOUND if the factory wasn't registered.
3302 * @retval VERR_ACCESS_DENIED if it isn't a kernel session.
3303 * @retval VERR_INVALID_PARAMETER on invalid parameter.
3304 * @retval VERR_INVALID_POINTER on invalid pointer parameter.
3305 *
3306 * @param pSession The SUPDRV session (must be a ring-0 session).
3307 * @param pFactory Pointer to the component factory registration structure
3308 * previously passed SUPR0ComponentRegisterFactory().
3309 *
3310 * @remarks This interface is also available via SUPR0IdcComponentDeregisterFactory.
3311 */
3312SUPR0DECL(int) SUPR0ComponentDeregisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
3313{
3314 int rc;
3315
3316 /*
3317 * Validate parameters.
3318 */
3319 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3320 AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
3321 AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
3322
3323 /*
3324 * Take the lock and look for the registration record.
3325 */
3326 rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3327 if (RT_SUCCESS(rc))
3328 {
3329 PSUPDRVFACTORYREG pPrev = NULL;
3330 PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3331 while (pCur && pCur->pFactory != pFactory)
3332 {
3333 pPrev = pCur;
3334 pCur = pCur->pNext;
3335 }
3336 if (pCur)
3337 {
3338 if (!pPrev)
3339 pSession->pDevExt->pComponentFactoryHead = pCur->pNext;
3340 else
3341 pPrev->pNext = pCur->pNext;
3342
3343 pCur->pNext = NULL;
3344 pCur->pFactory = NULL;
3345 pCur->pSession = NULL;
3346 rc = VINF_SUCCESS;
3347 }
3348 else
3349 rc = VERR_NOT_FOUND;
3350
3351 RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3352
3353 RTMemFree(pCur);
3354 }
3355 return rc;
3356}
3357
3358
3359/**
3360 * Queries a component factory.
3361 *
3362 * @returns VBox status code.
3363 * @retval VERR_INVALID_PARAMETER on invalid parameter.
3364 * @retval VERR_INVALID_POINTER on invalid pointer parameter.
3365 * @retval VERR_SUPDRV_COMPONENT_NOT_FOUND if the component factory wasn't found.
3366 * @retval VERR_SUPDRV_INTERFACE_NOT_SUPPORTED if the interface wasn't supported.
3367 *
3368 * @param pSession The SUPDRV session.
3369 * @param pszName The name of the component factory.
3370 * @param pszInterfaceUuid The UUID of the factory interface (stringified).
3371 * @param ppvFactoryIf Where to store the factory interface.
3372 */
3373SUPR0DECL(int) SUPR0ComponentQueryFactory(PSUPDRVSESSION pSession, const char *pszName, const char *pszInterfaceUuid, void **ppvFactoryIf)
3374{
3375 const char *pszEnd;
3376 size_t cchName;
3377 int rc;
3378
3379 /*
3380 * Validate parameters.
3381 */
3382 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3383
3384 AssertPtrReturn(pszName, VERR_INVALID_POINTER);
3385 pszEnd = memchr(pszName, '\0', RT_SIZEOFMEMB(SUPDRVFACTORY, szName));
3386 AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
3387 cchName = pszEnd - pszName;
3388
3389 AssertPtrReturn(pszInterfaceUuid, VERR_INVALID_POINTER);
3390 pszEnd = memchr(pszInterfaceUuid, '\0', RTUUID_STR_LENGTH);
3391 AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
3392
3393 AssertPtrReturn(ppvFactoryIf, VERR_INVALID_POINTER);
3394 *ppvFactoryIf = NULL;
3395
3396 /*
3397 * Take the lock and try all factories by this name.
3398 */
3399 rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3400 if (RT_SUCCESS(rc))
3401 {
3402 PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3403 rc = VERR_SUPDRV_COMPONENT_NOT_FOUND;
3404 while (pCur)
3405 {
3406 if ( pCur->cchName == cchName
3407 && !memcmp(pCur->pFactory->szName, pszName, cchName))
3408 {
3409 void *pvFactory = pCur->pFactory->pfnQueryFactoryInterface(pCur->pFactory, pSession, pszInterfaceUuid);
3410 if (pvFactory)
3411 {
3412 *ppvFactoryIf = pvFactory;
3413 rc = VINF_SUCCESS;
3414 break;
3415 }
3416 rc = VERR_SUPDRV_INTERFACE_NOT_SUPPORTED;
3417 }
3418
3419 /* next */
3420 pCur = pCur->pNext;
3421 }
3422
3423 RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3424 }
3425 return rc;
3426}
3427
3428
3429/**
3430 * Adds a memory object to the session.
3431 *
3432 * @returns IPRT status code.
3433 * @param pMem Memory tracking structure containing the
3434 * information to track.
3435 * @param pSession The session.
3436 */
3437static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession)
3438{
3439 PSUPDRVBUNDLE pBundle;
3440 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3441
3442 /*
3443 * Find free entry and record the allocation.
3444 */
3445 RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3446 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3447 {
3448 if (pBundle->cUsed < RT_ELEMENTS(pBundle->aMem))
3449 {
3450 unsigned i;
3451 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3452 {
3453 if (pBundle->aMem[i].MemObj == NIL_RTR0MEMOBJ)
3454 {
3455 pBundle->cUsed++;
3456 pBundle->aMem[i] = *pMem;
3457 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3458 return VINF_SUCCESS;
3459 }
3460 }
3461 AssertFailed(); /* !!this can't be happening!!! */
3462 }
3463 }
3464 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3465
3466 /*
3467 * Need to allocate a new bundle.
3468 * Insert into the last entry in the bundle.
3469 */
3470 pBundle = (PSUPDRVBUNDLE)RTMemAllocZ(sizeof(*pBundle));
3471 if (!pBundle)
3472 return VERR_NO_MEMORY;
3473
3474 /* take last entry. */
3475 pBundle->cUsed++;
3476 pBundle->aMem[RT_ELEMENTS(pBundle->aMem) - 1] = *pMem;
3477
3478 /* insert into list. */
3479 RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3480 pBundle->pNext = pSession->Bundle.pNext;
3481 pSession->Bundle.pNext = pBundle;
3482 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3483
3484 return VINF_SUCCESS;
3485}
3486
3487
3488/**
3489 * Releases a memory object referenced by pointer and type.
3490 *
3491 * @returns IPRT status code.
3492 * @param pSession Session data.
3493 * @param uPtr Pointer to memory. This is matched against both the R0 and R3 addresses.
3494 * @param eType Memory type.
3495 */
3496static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType)
3497{
3498 PSUPDRVBUNDLE pBundle;
3499 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3500
3501 /*
3502 * Validate input.
3503 */
3504 if (!uPtr)
3505 {
3506 Log(("Illegal address %p\n", (void *)uPtr));
3507 return VERR_INVALID_PARAMETER;
3508 }
3509
3510 /*
3511 * Search for the address.
3512 */
3513 RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3514 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3515 {
3516 if (pBundle->cUsed > 0)
3517 {
3518 unsigned i;
3519 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3520 {
3521 if ( pBundle->aMem[i].eType == eType
3522 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3523 && ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
3524 || ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
3525 && RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr))
3526 )
3527 {
3528 /* Make a copy of it and release it outside the spinlock. */
3529 SUPDRVMEMREF Mem = pBundle->aMem[i];
3530 pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
3531 pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
3532 pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
3533 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3534
3535 if (Mem.MapObjR3 != NIL_RTR0MEMOBJ)
3536 {
3537 int rc = RTR0MemObjFree(Mem.MapObjR3, false);
3538 AssertRC(rc); /** @todo figure out how to handle this. */
3539 }
3540 if (Mem.MemObj != NIL_RTR0MEMOBJ)
3541 {
3542 int rc = RTR0MemObjFree(Mem.MemObj, true /* fFreeMappings */);
3543 AssertRC(rc); /** @todo figure out how to handle this. */
3544 }
3545 return VINF_SUCCESS;
3546 }
3547 }
3548 }
3549 }
3550 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3551 Log(("Failed to find %p!!! (eType=%d)\n", (void *)uPtr, eType));
3552 return VERR_INVALID_PARAMETER;
3553}
3554
3555
3556/**
3557 * Opens an image. If it's the first time it's opened the call must upload
3558 * the bits using the supdrvIOCtl_LdrLoad() / SUPDRV_IOCTL_LDR_LOAD function.
3559 *
3560 * This is the 1st step of the loading.
3561 *
3562 * @returns IPRT status code.
3563 * @param pDevExt Device globals.
3564 * @param pSession Session data.
3565 * @param pReq The open request.
3566 */
3567static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq)
3568{
3569 int rc;
3570 PSUPDRVLDRIMAGE pImage;
3571 void *pv;
3572 size_t cchName = strlen(pReq->u.In.szName); /* (caller checked < 32). */
3573 LogFlow(("supdrvIOCtl_LdrOpen: szName=%s cbImageWithTabs=%d\n", pReq->u.In.szName, pReq->u.In.cbImageWithTabs));
3574
3575 /*
3576 * Check if we got an instance of the image already.
3577 */
3578 supdrvLdrLock(pDevExt);
3579 for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
3580 {
3581 if ( pImage->szName[cchName] == '\0'
3582 && !memcmp(pImage->szName, pReq->u.In.szName, cchName))
3583 {
3584 /** @todo check cbImageBits and cbImageWithTabs here, if they differs that indicates that the images are different. */
3585 pImage->cUsage++;
3586 pReq->u.Out.pvImageBase = pImage->pvImage;
3587 pReq->u.Out.fNeedsLoading = pImage->uState == SUP_IOCTL_LDR_OPEN;
3588 pReq->u.Out.fNativeLoader = pImage->fNative;
3589 supdrvLdrAddUsage(pSession, pImage);
3590 supdrvLdrUnlock(pDevExt);
3591 return VINF_SUCCESS;
3592 }
3593 }
3594 /* (not found - add it!) */
3595
3596 /*
3597 * Allocate memory.
3598 */
3599 pv = RTMemAlloc(RT_OFFSETOF(SUPDRVLDRIMAGE, szName[cchName + 1]));
3600 if (!pv)
3601 {
3602 supdrvLdrUnlock(pDevExt);
3603 Log(("supdrvIOCtl_LdrOpen: RTMemAlloc() failed\n"));
3604 return VERR_NO_MEMORY;
3605 }
3606
3607 /*
3608 * Setup and link in the LDR stuff.
3609 */
3610 pImage = (PSUPDRVLDRIMAGE)pv;
3611 pImage->pvImage = NULL;
3612 pImage->pvImageAlloc = NULL;
3613 pImage->cbImageWithTabs = pReq->u.In.cbImageWithTabs;
3614 pImage->cbImageBits = pReq->u.In.cbImageBits;
3615 pImage->cSymbols = 0;
3616 pImage->paSymbols = NULL;
3617 pImage->pachStrTab = NULL;
3618 pImage->cbStrTab = 0;
3619 pImage->pfnModuleInit = NULL;
3620 pImage->pfnModuleTerm = NULL;
3621 pImage->pfnServiceReqHandler = NULL;
3622 pImage->uState = SUP_IOCTL_LDR_OPEN;
3623 pImage->cUsage = 1;
3624 memcpy(pImage->szName, pReq->u.In.szName, cchName + 1);
3625
3626 /*
3627 * Try load it using the native loader, if that isn't supported, fall back
3628 * on the older method.
3629 */
3630 pImage->fNative = true;
3631 rc = supdrvOSLdrOpen(pDevExt, pImage, pReq->u.In.szFilename);
3632 if (rc == VERR_NOT_SUPPORTED)
3633 {
3634 pImage->pvImageAlloc = RTMemExecAlloc(pImage->cbImageBits + 31);
3635 pImage->pvImage = RT_ALIGN_P(pImage->pvImageAlloc, 32);
3636 pImage->fNative = false;
3637 rc = pImage->pvImageAlloc ? VINF_SUCCESS : VERR_NO_MEMORY;
3638 }
3639 if (RT_FAILURE(rc))
3640 {
3641 supdrvLdrUnlock(pDevExt);
3642 RTMemFree(pImage);
3643 Log(("supdrvIOCtl_LdrOpen(%s): failed - %Rrc\n", pReq->u.In.szName, rc));
3644 return rc;
3645 }
3646 Assert(VALID_PTR(pImage->pvImage) || RT_FAILURE(rc));
3647
3648 /*
3649 * Link it.
3650 */
3651 pImage->pNext = pDevExt->pLdrImages;
3652 pDevExt->pLdrImages = pImage;
3653
3654 supdrvLdrAddUsage(pSession, pImage);
3655
3656 pReq->u.Out.pvImageBase = pImage->pvImage;
3657 pReq->u.Out.fNeedsLoading = true;
3658 pReq->u.Out.fNativeLoader = pImage->fNative;
3659 supdrvLdrUnlock(pDevExt);
3660
3661#if defined(RT_OS_WINDOWS) && defined(DEBUG)
3662 SUPR0Printf("VBoxDrv: windbg> .reload /f %s=%#p\n", pImage->szName, pImage->pvImage);
3663#endif
3664 return VINF_SUCCESS;
3665}
3666
3667
3668/**
3669 * Worker that validates a pointer to an image entrypoint.
3670 *
3671 * @returns IPRT status code.
3672 * @param pDevExt The device globals.
3673 * @param pImage The loader image.
3674 * @param pv The pointer into the image.
3675 * @param fMayBeNull Whether it may be NULL.
3676 * @param pszWhat What is this entrypoint? (for logging)
3677 * @param pbImageBits The image bits prepared by ring-3.
3678 *
3679 * @remarks Will leave the lock on failure.
3680 */
3681static int supdrvLdrValidatePointer(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage, void *pv,
3682 bool fMayBeNull, const uint8_t *pbImageBits, const char *pszWhat)
3683{
3684 if (!fMayBeNull || pv)
3685 {
3686 if ((uintptr_t)pv - (uintptr_t)pImage->pvImage >= pImage->cbImageBits)
3687 {
3688 supdrvLdrUnlock(pDevExt);
3689 Log(("Out of range (%p LB %#x): %s=%p\n", pImage->pvImage, pImage->cbImageBits, pszWhat, pv));
3690 return VERR_INVALID_PARAMETER;
3691 }
3692
3693 if (pImage->fNative)
3694 {
3695 int rc = supdrvOSLdrValidatePointer(pDevExt, pImage, pv, pbImageBits);
3696 if (RT_FAILURE(rc))
3697 {
3698 supdrvLdrUnlock(pDevExt);
3699 Log(("Bad entry point address: %s=%p (rc=%Rrc)\n", pszWhat, pv, rc));
3700 return rc;
3701 }
3702 }
3703 }
3704 return VINF_SUCCESS;
3705}
3706
3707
3708/**
3709 * Loads the image bits.
3710 *
3711 * This is the 2nd step of the loading.
3712 *
3713 * @returns IPRT status code.
3714 * @param pDevExt Device globals.
3715 * @param pSession Session data.
3716 * @param pReq The request.
3717 */
3718static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq)
3719{
3720 PSUPDRVLDRUSAGE pUsage;
3721 PSUPDRVLDRIMAGE pImage;
3722 int rc;
3723 LogFlow(("supdrvIOCtl_LdrLoad: pvImageBase=%p cbImageWithBits=%d\n", pReq->u.In.pvImageBase, pReq->u.In.cbImageWithTabs));
3724
3725 /*
3726 * Find the ldr image.
3727 */
3728 supdrvLdrLock(pDevExt);
3729 pUsage = pSession->pLdrUsage;
3730 while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
3731 pUsage = pUsage->pNext;
3732 if (!pUsage)
3733 {
3734 supdrvLdrUnlock(pDevExt);
3735 Log(("SUP_IOCTL_LDR_LOAD: couldn't find image!\n"));
3736 return VERR_INVALID_HANDLE;
3737 }
3738 pImage = pUsage->pImage;
3739
3740 /*
3741 * Validate input.
3742 */
3743 if ( pImage->cbImageWithTabs != pReq->u.In.cbImageWithTabs
3744 || pImage->cbImageBits != pReq->u.In.cbImageBits)
3745 {
3746 supdrvLdrUnlock(pDevExt);
3747 Log(("SUP_IOCTL_LDR_LOAD: image size mismatch!! %d(prep) != %d(load) or %d != %d\n",
3748 pImage->cbImageWithTabs, pReq->u.In.cbImageWithTabs, pImage->cbImageBits, pReq->u.In.cbImageBits));
3749 return VERR_INVALID_HANDLE;
3750 }
3751
3752 if (pImage->uState != SUP_IOCTL_LDR_OPEN)
3753 {
3754 unsigned uState = pImage->uState;
3755 supdrvLdrUnlock(pDevExt);
3756 if (uState != SUP_IOCTL_LDR_LOAD)
3757 AssertMsgFailed(("SUP_IOCTL_LDR_LOAD: invalid image state %d (%#x)!\n", uState, uState));
3758 return VERR_ALREADY_LOADED;
3759 }
3760
3761 switch (pReq->u.In.eEPType)
3762 {
3763 case SUPLDRLOADEP_NOTHING:
3764 break;
3765
3766 case SUPLDRLOADEP_VMMR0:
3767 rc = supdrvLdrValidatePointer( pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0, false, pReq->u.In.abImage, "pvVMMR0");
3768 if (RT_SUCCESS(rc))
3769 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt, false, pReq->u.In.abImage, "pvVMMR0EntryInt");
3770 if (RT_SUCCESS(rc))
3771 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, false, pReq->u.In.abImage, "pvVMMR0EntryFast");
3772 if (RT_SUCCESS(rc))
3773 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx, false, pReq->u.In.abImage, "pvVMMR0EntryEx");
3774 if (RT_FAILURE(rc))
3775 return rc;
3776 break;
3777
3778 case SUPLDRLOADEP_SERVICE:
3779 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.Service.pfnServiceReq, false, pReq->u.In.abImage, "pfnServiceReq");
3780 if (RT_FAILURE(rc))
3781 return rc;
3782 if ( pReq->u.In.EP.Service.apvReserved[0] != NIL_RTR0PTR
3783 || pReq->u.In.EP.Service.apvReserved[1] != NIL_RTR0PTR
3784 || pReq->u.In.EP.Service.apvReserved[2] != NIL_RTR0PTR)
3785 {
3786 supdrvLdrUnlock(pDevExt);
3787 Log(("Out of range (%p LB %#x): apvReserved={%p,%p,%p} MBZ!\n",
3788 pImage->pvImage, pReq->u.In.cbImageWithTabs,
3789 pReq->u.In.EP.Service.apvReserved[0],
3790 pReq->u.In.EP.Service.apvReserved[1],
3791 pReq->u.In.EP.Service.apvReserved[2]));
3792 return VERR_INVALID_PARAMETER;
3793 }
3794 break;
3795
3796 default:
3797 supdrvLdrUnlock(pDevExt);
3798 Log(("Invalid eEPType=%d\n", pReq->u.In.eEPType));
3799 return VERR_INVALID_PARAMETER;
3800 }
3801
3802 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.pfnModuleInit, true, pReq->u.In.abImage, "pfnModuleInit");
3803 if (RT_FAILURE(rc))
3804 return rc;
3805 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.pfnModuleTerm, true, pReq->u.In.abImage, "pfnModuleTerm");
3806 if (RT_FAILURE(rc))
3807 return rc;
3808
3809 /*
3810 * Allocate and copy the tables.
3811 * (No need to do try/except as this is a buffered request.)
3812 */
3813 pImage->cbStrTab = pReq->u.In.cbStrTab;
3814 if (pImage->cbStrTab)
3815 {
3816 pImage->pachStrTab = (char *)RTMemAlloc(pImage->cbStrTab);
3817 if (pImage->pachStrTab)
3818 memcpy(pImage->pachStrTab, &pReq->u.In.abImage[pReq->u.In.offStrTab], pImage->cbStrTab);
3819 else
3820 rc = VERR_NO_MEMORY;
3821 }
3822
3823 pImage->cSymbols = pReq->u.In.cSymbols;
3824 if (RT_SUCCESS(rc) && pImage->cSymbols)
3825 {
3826 size_t cbSymbols = pImage->cSymbols * sizeof(SUPLDRSYM);
3827 pImage->paSymbols = (PSUPLDRSYM)RTMemAlloc(cbSymbols);
3828 if (pImage->paSymbols)
3829 memcpy(pImage->paSymbols, &pReq->u.In.abImage[pReq->u.In.offSymbols], cbSymbols);
3830 else
3831 rc = VERR_NO_MEMORY;
3832 }
3833
3834 /*
3835 * Copy the bits / complete native loading.
3836 */
3837 if (RT_SUCCESS(rc))
3838 {
3839 pImage->uState = SUP_IOCTL_LDR_LOAD;
3840 pImage->pfnModuleInit = pReq->u.In.pfnModuleInit;
3841 pImage->pfnModuleTerm = pReq->u.In.pfnModuleTerm;
3842
3843 if (pImage->fNative)
3844 rc = supdrvOSLdrLoad(pDevExt, pImage, pReq->u.In.abImage);
3845 else
3846 memcpy(pImage->pvImage, &pReq->u.In.abImage[0], pImage->cbImageBits);
3847 }
3848
3849 /*
3850 * Update any entry points.
3851 */
3852 if (RT_SUCCESS(rc))
3853 {
3854 switch (pReq->u.In.eEPType)
3855 {
3856 default:
3857 case SUPLDRLOADEP_NOTHING:
3858 rc = VINF_SUCCESS;
3859 break;
3860 case SUPLDRLOADEP_VMMR0:
3861 rc = supdrvLdrSetVMMR0EPs(pDevExt, pReq->u.In.EP.VMMR0.pvVMMR0, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt,
3862 pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx);
3863 break;
3864 case SUPLDRLOADEP_SERVICE:
3865 pImage->pfnServiceReqHandler = pReq->u.In.EP.Service.pfnServiceReq;
3866 rc = VINF_SUCCESS;
3867 break;
3868 }
3869 }
3870
3871 /*
3872 * On success call the module initialization.
3873 */
3874 LogFlow(("supdrvIOCtl_LdrLoad: pfnModuleInit=%p\n", pImage->pfnModuleInit));
3875 if (RT_SUCCESS(rc) && pImage->pfnModuleInit)
3876 {
3877 Log(("supdrvIOCtl_LdrLoad: calling pfnModuleInit=%p\n", pImage->pfnModuleInit));
3878 rc = pImage->pfnModuleInit();
3879 if (rc && pDevExt->pvVMMR0 == pImage->pvImage)
3880 supdrvLdrUnsetVMMR0EPs(pDevExt);
3881 }
3882
3883 if (RT_FAILURE(rc))
3884 {
3885 pImage->uState = SUP_IOCTL_LDR_OPEN;
3886 pImage->pfnModuleInit = NULL;
3887 pImage->pfnModuleTerm = NULL;
3888 pImage->pfnServiceReqHandler= NULL;
3889 pImage->cbStrTab = 0;
3890 RTMemFree(pImage->pachStrTab);
3891 pImage->pachStrTab = NULL;
3892 RTMemFree(pImage->paSymbols);
3893 pImage->paSymbols = NULL;
3894 pImage->cSymbols = 0;
3895 }
3896
3897 supdrvLdrUnlock(pDevExt);
3898 return rc;
3899}
3900
3901
3902/**
3903 * Frees a previously loaded (prep'ed) image.
3904 *
3905 * @returns IPRT status code.
3906 * @param pDevExt Device globals.
3907 * @param pSession Session data.
3908 * @param pReq The request.
3909 */
3910static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq)
3911{
3912 int rc;
3913 PSUPDRVLDRUSAGE pUsagePrev;
3914 PSUPDRVLDRUSAGE pUsage;
3915 PSUPDRVLDRIMAGE pImage;
3916 LogFlow(("supdrvIOCtl_LdrFree: pvImageBase=%p\n", pReq->u.In.pvImageBase));
3917
3918 /*
3919 * Find the ldr image.
3920 */
3921 supdrvLdrLock(pDevExt);
3922 pUsagePrev = NULL;
3923 pUsage = pSession->pLdrUsage;
3924 while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
3925 {
3926 pUsagePrev = pUsage;
3927 pUsage = pUsage->pNext;
3928 }
3929 if (!pUsage)
3930 {
3931 supdrvLdrUnlock(pDevExt);
3932 Log(("SUP_IOCTL_LDR_FREE: couldn't find image!\n"));
3933 return VERR_INVALID_HANDLE;
3934 }
3935
3936 /*
3937 * Check if we can remove anything.
3938 */
3939 rc = VINF_SUCCESS;
3940 pImage = pUsage->pImage;
3941 if (pImage->cUsage <= 1 || pUsage->cUsage <= 1)
3942 {
3943 /*
3944 * Check if there are any objects with destructors in the image, if
3945 * so leave it for the session cleanup routine so we get a chance to
3946 * clean things up in the right order and not leave them all dangling.
3947 */
3948 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3949 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
3950 if (pImage->cUsage <= 1)
3951 {
3952 PSUPDRVOBJ pObj;
3953 for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
3954 if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
3955 {
3956 rc = VERR_DANGLING_OBJECTS;
3957 break;
3958 }
3959 }
3960 else
3961 {
3962 PSUPDRVUSAGE pGenUsage;
3963 for (pGenUsage = pSession->pUsage; pGenUsage; pGenUsage = pGenUsage->pNext)
3964 if (RT_UNLIKELY((uintptr_t)pGenUsage->pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
3965 {
3966 rc = VERR_DANGLING_OBJECTS;
3967 break;
3968 }
3969 }
3970 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
3971 if (rc == VINF_SUCCESS)
3972 {
3973 /* unlink it */
3974 if (pUsagePrev)
3975 pUsagePrev->pNext = pUsage->pNext;
3976 else
3977 pSession->pLdrUsage = pUsage->pNext;
3978
3979 /* free it */
3980 pUsage->pImage = NULL;
3981 pUsage->pNext = NULL;
3982 RTMemFree(pUsage);
3983
3984 /*
3985 * Dereference the image.
3986 */
3987 if (pImage->cUsage <= 1)
3988 supdrvLdrFree(pDevExt, pImage);
3989 else
3990 pImage->cUsage--;
3991 }
3992 else
3993 {
3994 Log(("supdrvIOCtl_LdrFree: Dangling objects in %p/%s!\n", pImage->pvImage, pImage->szName));
3995 rc = VINF_SUCCESS; /** @todo BRANCH-2.1: remove this after branching. */
3996 }
3997 }
3998 else
3999 {
4000 /*
4001 * Dereference both image and usage.
4002 */
4003 pImage->cUsage--;
4004 pUsage->cUsage--;
4005 }
4006
4007 supdrvLdrUnlock(pDevExt);
4008 return rc;
4009}
4010
4011
4012/**
4013 * Gets the address of a symbol in an open image.
4014 *
4015 * @returns IPRT status code.
4016 * @param pDevExt Device globals.
4017 * @param pSession Session data.
4018 * @param pReq The request buffer.
4019 */
4020static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq)
4021{
4022 PSUPDRVLDRIMAGE pImage;
4023 PSUPDRVLDRUSAGE pUsage;
4024 uint32_t i;
4025 PSUPLDRSYM paSyms;
4026 const char *pchStrings;
4027 const size_t cbSymbol = strlen(pReq->u.In.szSymbol) + 1;
4028 void *pvSymbol = NULL;
4029 int rc = VERR_GENERAL_FAILURE;
4030 Log3(("supdrvIOCtl_LdrGetSymbol: pvImageBase=%p szSymbol=\"%s\"\n", pReq->u.In.pvImageBase, pReq->u.In.szSymbol));
4031
4032 /*
4033 * Find the ldr image.
4034 */
4035 supdrvLdrLock(pDevExt);
4036 pUsage = pSession->pLdrUsage;
4037 while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
4038 pUsage = pUsage->pNext;
4039 if (!pUsage)
4040 {
4041 supdrvLdrUnlock(pDevExt);
4042 Log(("SUP_IOCTL_LDR_GET_SYMBOL: couldn't find image!\n"));
4043 return VERR_INVALID_HANDLE;
4044 }
4045 pImage = pUsage->pImage;
4046 if (pImage->uState != SUP_IOCTL_LDR_LOAD)
4047 {
4048 unsigned uState = pImage->uState;
4049 supdrvLdrUnlock(pDevExt);
4050 Log(("SUP_IOCTL_LDR_GET_SYMBOL: invalid image state %d (%#x)!\n", uState, uState)); NOREF(uState);
4051 return VERR_ALREADY_LOADED;
4052 }
4053
4054 /*
4055 * Search the symbol strings.
4056 */
4057 pchStrings = pImage->pachStrTab;
4058 paSyms = pImage->paSymbols;
4059 for (i = 0; i < pImage->cSymbols; i++)
4060 {
4061 if ( paSyms[i].offSymbol < pImage->cbImageBits /* paranoia */
4062 && paSyms[i].offName + cbSymbol <= pImage->cbStrTab
4063 && !memcmp(pchStrings + paSyms[i].offName, pReq->u.In.szSymbol, cbSymbol))
4064 {
4065 pvSymbol = (uint8_t *)pImage->pvImage + paSyms[i].offSymbol;
4066 rc = VINF_SUCCESS;
4067 break;
4068 }
4069 }
4070 supdrvLdrUnlock(pDevExt);
4071 pReq->u.Out.pvSymbol = pvSymbol;
4072 return rc;
4073}
4074
4075
4076/**
4077 * Gets the address of a symbol in an open image or the support driver.
4078 *
4079 * @returns VINF_SUCCESS on success.
4080 * @returns
4081 * @param pDevExt Device globals.
4082 * @param pSession Session data.
4083 * @param pReq The request buffer.
4084 */
4085static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq)
4086{
4087 int rc = VINF_SUCCESS;
4088 const char *pszSymbol = pReq->u.In.pszSymbol;
4089 const char *pszModule = pReq->u.In.pszModule;
4090 size_t cbSymbol;
4091 char const *pszEnd;
4092 uint32_t i;
4093
4094 /*
4095 * Input validation.
4096 */
4097 AssertPtrReturn(pszSymbol, VERR_INVALID_POINTER);
4098 pszEnd = (char *)memchr(pszSymbol, '\0', 512);
4099 AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4100 cbSymbol = pszEnd - pszSymbol + 1;
4101
4102 if (pszModule)
4103 {
4104 AssertPtrReturn(pszModule, VERR_INVALID_POINTER);
4105 pszEnd = (char *)memchr(pszModule, '\0', 64);
4106 AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4107 }
4108 Log3(("supdrvIDC_LdrGetSymbol: pszModule=%p:{%s} pszSymbol=%p:{%s}\n", pszModule, pszModule, pszSymbol, pszSymbol));
4109
4110
4111 if ( !pszModule
4112 || !strcmp(pszModule, "SupDrv"))
4113 {
4114 /*
4115 * Search the support driver export table.
4116 */
4117 for (i = 0; i < RT_ELEMENTS(g_aFunctions); i++)
4118 if (!strcmp(g_aFunctions[i].szName, pszSymbol))
4119 {
4120 pReq->u.Out.pfnSymbol = g_aFunctions[i].pfn;
4121 break;
4122 }
4123 }
4124 else
4125 {
4126 /*
4127 * Find the loader image.
4128 */
4129 PSUPDRVLDRIMAGE pImage;
4130
4131 supdrvLdrLock(pDevExt);
4132
4133 for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
4134 if (!strcmp(pImage->szName, pszModule))
4135 break;
4136 if (pImage && pImage->uState == SUP_IOCTL_LDR_LOAD)
4137 {
4138 /*
4139 * Search the symbol strings.
4140 */
4141 const char *pchStrings = pImage->pachStrTab;
4142 PCSUPLDRSYM paSyms = pImage->paSymbols;
4143 for (i = 0; i < pImage->cSymbols; i++)
4144 {
4145 if ( paSyms[i].offSymbol < pImage->cbImageBits /* paranoia */
4146 && paSyms[i].offName + cbSymbol <= pImage->cbStrTab
4147 && !memcmp(pchStrings + paSyms[i].offName, pszSymbol, cbSymbol))
4148 {
4149 /*
4150 * Found it! Calc the symbol address and add a reference to the module.
4151 */
4152 pReq->u.Out.pfnSymbol = (PFNRT)((uint8_t *)pImage->pvImage + paSyms[i].offSymbol);
4153 rc = supdrvLdrAddUsage(pSession, pImage);
4154 break;
4155 }
4156 }
4157 }
4158 else
4159 rc = pImage ? VERR_WRONG_ORDER : VERR_MODULE_NOT_FOUND;
4160
4161 supdrvLdrUnlock(pDevExt);
4162 }
4163 return rc;
4164}
4165
4166
4167/**
4168 * Updates the VMMR0 entry point pointers.
4169 *
4170 * @returns IPRT status code.
4171 * @param pDevExt Device globals.
4172 * @param pSession Session data.
4173 * @param pVMMR0 VMMR0 image handle.
4174 * @param pvVMMR0EntryInt VMMR0EntryInt address.
4175 * @param pvVMMR0EntryFast VMMR0EntryFast address.
4176 * @param pvVMMR0EntryEx VMMR0EntryEx address.
4177 * @remark Caller must own the loader mutex.
4178 */
4179static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void *pvVMMR0, void *pvVMMR0EntryInt, void *pvVMMR0EntryFast, void *pvVMMR0EntryEx)
4180{
4181 int rc = VINF_SUCCESS;
4182 LogFlow(("supdrvLdrSetR0EP pvVMMR0=%p pvVMMR0EntryInt=%p\n", pvVMMR0, pvVMMR0EntryInt));
4183
4184
4185 /*
4186 * Check if not yet set.
4187 */
4188 if (!pDevExt->pvVMMR0)
4189 {
4190 pDevExt->pvVMMR0 = pvVMMR0;
4191 pDevExt->pfnVMMR0EntryInt = pvVMMR0EntryInt;
4192 pDevExt->pfnVMMR0EntryFast = pvVMMR0EntryFast;
4193 pDevExt->pfnVMMR0EntryEx = pvVMMR0EntryEx;
4194 }
4195 else
4196 {
4197 /*
4198 * Return failure or success depending on whether the values match or not.
4199 */
4200 if ( pDevExt->pvVMMR0 != pvVMMR0
4201 || (void *)pDevExt->pfnVMMR0EntryInt != pvVMMR0EntryInt
4202 || (void *)pDevExt->pfnVMMR0EntryFast != pvVMMR0EntryFast
4203 || (void *)pDevExt->pfnVMMR0EntryEx != pvVMMR0EntryEx)
4204 {
4205 AssertMsgFailed(("SUP_IOCTL_LDR_SETR0EP: Already set pointing to a different module!\n"));
4206 rc = VERR_INVALID_PARAMETER;
4207 }
4208 }
4209 return rc;
4210}
4211
4212
4213/**
4214 * Unsets the VMMR0 entry point installed by supdrvLdrSetR0EP.
4215 *
4216 * @param pDevExt Device globals.
4217 */
4218static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt)
4219{
4220 pDevExt->pvVMMR0 = NULL;
4221 pDevExt->pfnVMMR0EntryInt = NULL;
4222 pDevExt->pfnVMMR0EntryFast = NULL;
4223 pDevExt->pfnVMMR0EntryEx = NULL;
4224}
4225
4226
4227/**
4228 * Adds a usage reference in the specified session of an image.
4229 *
4230 * Called while owning the loader semaphore.
4231 *
4232 * @returns VINF_SUCCESS on success and VERR_NO_MEMORY on failure.
4233 * @param pSession Session in question.
4234 * @param pImage Image which the session is using.
4235 */
4236static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage)
4237{
4238 PSUPDRVLDRUSAGE pUsage;
4239 LogFlow(("supdrvLdrAddUsage: pImage=%p\n", pImage));
4240
4241 /*
4242 * Referenced it already?
4243 */
4244 pUsage = pSession->pLdrUsage;
4245 while (pUsage)
4246 {
4247 if (pUsage->pImage == pImage)
4248 {
4249 pUsage->cUsage++;
4250 return VINF_SUCCESS;
4251 }
4252 pUsage = pUsage->pNext;
4253 }
4254
4255 /*
4256 * Allocate new usage record.
4257 */
4258 pUsage = (PSUPDRVLDRUSAGE)RTMemAlloc(sizeof(*pUsage));
4259 AssertReturn(pUsage, VERR_NO_MEMORY);
4260 pUsage->cUsage = 1;
4261 pUsage->pImage = pImage;
4262 pUsage->pNext = pSession->pLdrUsage;
4263 pSession->pLdrUsage = pUsage;
4264 return VINF_SUCCESS;
4265}
4266
4267
4268/**
4269 * Frees a load image.
4270 *
4271 * @param pDevExt Pointer to device extension.
4272 * @param pImage Pointer to the image we're gonna free.
4273 * This image must exit!
4274 * @remark The caller MUST own SUPDRVDEVEXT::mtxLdr!
4275 */
4276static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage)
4277{
4278 PSUPDRVLDRIMAGE pImagePrev;
4279 LogFlow(("supdrvLdrFree: pImage=%p\n", pImage));
4280
4281 /* find it - arg. should've used doubly linked list. */
4282 Assert(pDevExt->pLdrImages);
4283 pImagePrev = NULL;
4284 if (pDevExt->pLdrImages != pImage)
4285 {
4286 pImagePrev = pDevExt->pLdrImages;
4287 while (pImagePrev->pNext != pImage)
4288 pImagePrev = pImagePrev->pNext;
4289 Assert(pImagePrev->pNext == pImage);
4290 }
4291
4292 /* unlink */
4293 if (pImagePrev)
4294 pImagePrev->pNext = pImage->pNext;
4295 else
4296 pDevExt->pLdrImages = pImage->pNext;
4297
4298 /* check if this is VMMR0.r0 unset its entry point pointers. */
4299 if (pDevExt->pvVMMR0 == pImage->pvImage)
4300 supdrvLdrUnsetVMMR0EPs(pDevExt);
4301
4302 /* check for objects with destructors in this image. (Shouldn't happen.) */
4303 if (pDevExt->pObjs)
4304 {
4305 unsigned cObjs = 0;
4306 PSUPDRVOBJ pObj;
4307 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
4308 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
4309 for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
4310 if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
4311 {
4312 pObj->pfnDestructor = NULL;
4313 cObjs++;
4314 }
4315 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
4316 if (cObjs)
4317 OSDBGPRINT(("supdrvLdrFree: Image '%s' has %d dangling objects!\n", pImage->szName, cObjs));
4318 }
4319
4320 /* call termination function if fully loaded. */
4321 if ( pImage->pfnModuleTerm
4322 && pImage->uState == SUP_IOCTL_LDR_LOAD)
4323 {
4324 LogFlow(("supdrvIOCtl_LdrLoad: calling pfnModuleTerm=%p\n", pImage->pfnModuleTerm));
4325 pImage->pfnModuleTerm();
4326 }
4327
4328 /* do native unload if appropriate. */
4329 if (pImage->fNative)
4330 supdrvOSLdrUnload(pDevExt, pImage);
4331
4332 /* free the image */
4333 pImage->cUsage = 0;
4334 pImage->pNext = 0;
4335 pImage->uState = SUP_IOCTL_LDR_FREE;
4336 RTMemExecFree(pImage->pvImageAlloc);
4337 pImage->pvImageAlloc = NULL;
4338 RTMemFree(pImage->pachStrTab);
4339 pImage->pachStrTab = NULL;
4340 RTMemFree(pImage->paSymbols);
4341 pImage->paSymbols = NULL;
4342 RTMemFree(pImage);
4343}
4344
4345
4346/**
4347 * Acquires the loader lock.
4348 *
4349 * @returns IPRT status code.
4350 * @param pDevExt The device extension.
4351 */
4352DECLINLINE(int) supdrvLdrLock(PSUPDRVDEVEXT pDevExt)
4353{
4354#ifdef SUPDRV_USE_MUTEX_FOR_LDR
4355 int rc = RTSemMutexRequest(pDevExt->mtxLdr, RT_INDEFINITE_WAIT);
4356#else
4357 int rc = RTSemFastMutexRequest(pDevExt->mtxLdr);
4358#endif
4359 AssertRC(rc);
4360 return rc;
4361}
4362
4363
4364/**
4365 * Releases the loader lock.
4366 *
4367 * @returns IPRT status code.
4368 * @param pDevExt The device extension.
4369 */
4370DECLINLINE(int) supdrvLdrUnlock(PSUPDRVDEVEXT pDevExt)
4371{
4372#ifdef SUPDRV_USE_MUTEX_FOR_LDR
4373 return RTSemMutexRelease(pDevExt->mtxLdr);
4374#else
4375 return RTSemFastMutexRelease(pDevExt->mtxLdr);
4376#endif
4377}
4378
4379
4380/**
4381 * Implements the service call request.
4382 *
4383 * @returns VBox status code.
4384 * @param pDevExt The device extension.
4385 * @param pSession The calling session.
4386 * @param pReq The request packet, valid.
4387 */
4388static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq)
4389{
4390#if !defined(RT_OS_WINDOWS) || defined(DEBUG)
4391 int rc;
4392
4393 /*
4394 * Find the module first in the module referenced by the calling session.
4395 */
4396 rc = supdrvLdrLock(pDevExt);
4397 if (RT_SUCCESS(rc))
4398 {
4399 PFNSUPR0SERVICEREQHANDLER pfnServiceReqHandler = NULL;
4400 PSUPDRVLDRUSAGE pUsage;
4401
4402 for (pUsage = pSession->pLdrUsage; pUsage; pUsage = pUsage->pNext)
4403 if ( pUsage->pImage->pfnServiceReqHandler
4404 && !strcmp(pUsage->pImage->szName, pReq->u.In.szName))
4405 {
4406 pfnServiceReqHandler = pUsage->pImage->pfnServiceReqHandler;
4407 break;
4408 }
4409 supdrvLdrUnlock(pDevExt);
4410
4411 if (pfnServiceReqHandler)
4412 {
4413 /*
4414 * Call it.
4415 */
4416 if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
4417 rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, NULL);
4418 else
4419 rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0]);
4420 }
4421 else
4422 rc = VERR_SUPDRV_SERVICE_NOT_FOUND;
4423 }
4424
4425 /* log it */
4426 if ( RT_FAILURE(rc)
4427 && rc != VERR_INTERRUPTED
4428 && rc != VERR_TIMEOUT)
4429 Log(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
4430 rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
4431 else
4432 Log4(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
4433 rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
4434 return rc;
4435#else /* RT_OS_WINDOWS && !DEBUG */
4436 return VERR_NOT_IMPLEMENTED;
4437#endif /* RT_OS_WINDOWS && !DEBUG */
4438}
4439
4440
4441/**
4442 * Implements the logger settings request.
4443 *
4444 * @returns VBox status code.
4445 * @param pDevExt The device extension.
4446 * @param pSession The caller's session.
4447 * @param pReq The request.
4448 */
4449static int supdrvIOCtl_LoggerSettings(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLOGGERSETTINGS pReq)
4450{
4451 const char *pszGroup = &pReq->u.In.szStrings[pReq->u.In.offGroups];
4452 const char *pszFlags = &pReq->u.In.szStrings[pReq->u.In.offFlags];
4453 const char *pszDest = &pReq->u.In.szStrings[pReq->u.In.offDestination];
4454 PRTLOGGER pLogger = NULL;
4455 int rc;
4456
4457 /*
4458 * Some further validation.
4459 */
4460 switch (pReq->u.In.fWhat)
4461 {
4462 case SUPLOGGERSETTINGS_WHAT_SETTINGS:
4463 case SUPLOGGERSETTINGS_WHAT_CREATE:
4464 break;
4465
4466 case SUPLOGGERSETTINGS_WHAT_DESTROY:
4467 if (*pszGroup || *pszFlags || *pszDest)
4468 return VERR_INVALID_PARAMETER;
4469 if (pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_RELEASE)
4470 return VERR_ACCESS_DENIED;
4471 break;
4472
4473 default:
4474 return VERR_INTERNAL_ERROR;
4475 }
4476
4477 /*
4478 * Get the logger.
4479 */
4480 switch (pReq->u.In.fWhich)
4481 {
4482 case SUPLOGGERSETTINGS_WHICH_DEBUG:
4483 pLogger = RTLogGetDefaultInstance();
4484 break;
4485
4486 case SUPLOGGERSETTINGS_WHICH_RELEASE:
4487 pLogger = RTLogRelDefaultInstance();
4488 break;
4489
4490 default:
4491 return VERR_INTERNAL_ERROR;
4492 }
4493
4494 /*
4495 * Do the job.
4496 */
4497 switch (pReq->u.In.fWhat)
4498 {
4499 case SUPLOGGERSETTINGS_WHAT_SETTINGS:
4500 if (pLogger)
4501 {
4502 rc = RTLogFlags(pLogger, pszFlags);
4503 if (RT_SUCCESS(rc))
4504 rc = RTLogGroupSettings(pLogger, pszGroup);
4505 NOREF(pszDest);
4506 }
4507 else
4508 rc = VERR_NOT_FOUND;
4509 break;
4510
4511 case SUPLOGGERSETTINGS_WHAT_CREATE:
4512 {
4513 if (pLogger)
4514 rc = VERR_ALREADY_EXISTS;
4515 else
4516 {
4517 static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
4518
4519 rc = RTLogCreate(&pLogger,
4520 0 /* fFlags */,
4521 pszGroup,
4522 pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_DEBUG
4523 ? "VBOX_LOG"
4524 : "VBOX_RELEASE_LOG",
4525 RT_ELEMENTS(s_apszGroups),
4526 s_apszGroups,
4527 RTLOGDEST_STDOUT | RTLOGDEST_DEBUGGER,
4528 NULL);
4529 if (RT_SUCCESS(rc))
4530 {
4531 rc = RTLogFlags(pLogger, pszFlags);
4532 NOREF(pszDest);
4533 if (RT_SUCCESS(rc))
4534 {
4535 switch (pReq->u.In.fWhich)
4536 {
4537 case SUPLOGGERSETTINGS_WHICH_DEBUG:
4538 pLogger = RTLogSetDefaultInstance(pLogger);
4539 break;
4540 case SUPLOGGERSETTINGS_WHICH_RELEASE:
4541 pLogger = RTLogRelSetDefaultInstance(pLogger);
4542 break;
4543 }
4544 }
4545 RTLogDestroy(pLogger);
4546 }
4547 }
4548 break;
4549 }
4550
4551 case SUPLOGGERSETTINGS_WHAT_DESTROY:
4552 switch (pReq->u.In.fWhich)
4553 {
4554 case SUPLOGGERSETTINGS_WHICH_DEBUG:
4555 pLogger = RTLogSetDefaultInstance(NULL);
4556 break;
4557 case SUPLOGGERSETTINGS_WHICH_RELEASE:
4558 pLogger = RTLogRelSetDefaultInstance(NULL);
4559 break;
4560 }
4561 rc = RTLogDestroy(pLogger);
4562 break;
4563
4564 default:
4565 {
4566 rc = VERR_INTERNAL_ERROR;
4567 break;
4568 }
4569 }
4570
4571 return rc;
4572}
4573
4574
4575/**
4576 * Creates the GIP.
4577 *
4578 * @returns VBox status code.
4579 * @param pDevExt Instance data. GIP stuff may be updated.
4580 */
4581static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt)
4582{
4583 PSUPGLOBALINFOPAGE pGip;
4584 RTHCPHYS HCPhysGip;
4585 uint32_t u32SystemResolution;
4586 uint32_t u32Interval;
4587 int rc;
4588
4589 LogFlow(("supdrvGipCreate:\n"));
4590
4591 /* assert order */
4592 Assert(pDevExt->u32SystemTimerGranularityGrant == 0);
4593 Assert(pDevExt->GipMemObj == NIL_RTR0MEMOBJ);
4594 Assert(!pDevExt->pGipTimer);
4595
4596 /*
4597 * Allocate a suitable page with a default kernel mapping.
4598 */
4599 rc = RTR0MemObjAllocLow(&pDevExt->GipMemObj, PAGE_SIZE, false);
4600 if (RT_FAILURE(rc))
4601 {
4602 OSDBGPRINT(("supdrvGipCreate: failed to allocate the GIP page. rc=%d\n", rc));
4603 return rc;
4604 }
4605 pGip = (PSUPGLOBALINFOPAGE)RTR0MemObjAddress(pDevExt->GipMemObj); AssertPtr(pGip);
4606 HCPhysGip = RTR0MemObjGetPagePhysAddr(pDevExt->GipMemObj, 0); Assert(HCPhysGip != NIL_RTHCPHYS);
4607
4608#if 0 /** @todo Disabled this as we didn't used to do it before and causes unnecessary stress on laptops.
4609 * It only applies to Windows and should probably revisited later, if possible made part of the
4610 * timer code (return min granularity in RTTimerGetSystemGranularity and set it in RTTimerStart). */
4611 /*
4612 * Try bump up the system timer resolution.
4613 * The more interrupts the better...
4614 */
4615 if ( RT_SUCCESS(RTTimerRequestSystemGranularity( 488281 /* 2048 HZ */, &u32SystemResolution))
4616 || RT_SUCCESS(RTTimerRequestSystemGranularity( 500000 /* 2000 HZ */, &u32SystemResolution))
4617 || RT_SUCCESS(RTTimerRequestSystemGranularity( 976563 /* 1024 HZ */, &u32SystemResolution))
4618 || RT_SUCCESS(RTTimerRequestSystemGranularity( 1000000 /* 1000 HZ */, &u32SystemResolution))
4619 || RT_SUCCESS(RTTimerRequestSystemGranularity( 1953125 /* 512 HZ */, &u32SystemResolution))
4620 || RT_SUCCESS(RTTimerRequestSystemGranularity( 2000000 /* 500 HZ */, &u32SystemResolution))
4621 || RT_SUCCESS(RTTimerRequestSystemGranularity( 3906250 /* 256 HZ */, &u32SystemResolution))
4622 || RT_SUCCESS(RTTimerRequestSystemGranularity( 4000000 /* 250 HZ */, &u32SystemResolution))
4623 || RT_SUCCESS(RTTimerRequestSystemGranularity( 7812500 /* 128 HZ */, &u32SystemResolution))
4624 || RT_SUCCESS(RTTimerRequestSystemGranularity(10000000 /* 100 HZ */, &u32SystemResolution))
4625 || RT_SUCCESS(RTTimerRequestSystemGranularity(15625000 /* 64 HZ */, &u32SystemResolution))
4626 || RT_SUCCESS(RTTimerRequestSystemGranularity(31250000 /* 32 HZ */, &u32SystemResolution))
4627 )
4628 {
4629 Assert(RTTimerGetSystemGranularity() <= u32SystemResolution);
4630 pDevExt->u32SystemTimerGranularityGrant = u32SystemResolution;
4631 }
4632#endif
4633
4634 /*
4635 * Find a reasonable update interval and initialize the structure.
4636 */
4637 u32Interval = u32SystemResolution = RTTimerGetSystemGranularity();
4638 while (u32Interval < 10000000 /* 10 ms */)
4639 u32Interval += u32SystemResolution;
4640
4641 supdrvGipInit(pDevExt, pGip, HCPhysGip, RTTimeSystemNanoTS(), 1000000000 / u32Interval /*=Hz*/);
4642
4643 /*
4644 * Create the timer.
4645 * If CPU_ALL isn't supported we'll have to fall back to synchronous mode.
4646 */
4647 if (pGip->u32Mode == SUPGIPMODE_ASYNC_TSC)
4648 {
4649 rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, RTTIMER_FLAGS_CPU_ALL, supdrvGipAsyncTimer, pDevExt);
4650 if (rc == VERR_NOT_SUPPORTED)
4651 {
4652 OSDBGPRINT(("supdrvGipCreate: omni timer not supported, falling back to synchronous mode\n"));
4653 pGip->u32Mode = SUPGIPMODE_SYNC_TSC;
4654 }
4655 }
4656 if (pGip->u32Mode != SUPGIPMODE_ASYNC_TSC)
4657 rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, 0, supdrvGipSyncTimer, pDevExt);
4658 if (RT_SUCCESS(rc))
4659 {
4660 if (pGip->u32Mode == SUPGIPMODE_ASYNC_TSC)
4661 rc = RTMpNotificationRegister(supdrvGipMpEvent, pDevExt);
4662 if (RT_SUCCESS(rc))
4663 {
4664 /*
4665 * We're good.
4666 */
4667 Log(("supdrvGipCreate: %ld ns interval.\n", (long)u32Interval));
4668 g_pSUPGlobalInfoPage = pGip;
4669 return VINF_SUCCESS;
4670 }
4671
4672 OSDBGPRINT(("supdrvGipCreate: failed register MP event notfication. rc=%d\n", rc));
4673 }
4674 else
4675 {
4676 OSDBGPRINT(("supdrvGipCreate: failed create GIP timer at %ld ns interval. rc=%d\n", (long)u32Interval, rc));
4677 Assert(!pDevExt->pGipTimer);
4678 }
4679 supdrvGipDestroy(pDevExt);
4680 return rc;
4681}
4682
4683
4684/**
4685 * Terminates the GIP.
4686 *
4687 * @param pDevExt Instance data. GIP stuff may be updated.
4688 */
4689static void supdrvGipDestroy(PSUPDRVDEVEXT pDevExt)
4690{
4691 int rc;
4692#ifdef DEBUG_DARWIN_GIP
4693 OSDBGPRINT(("supdrvGipDestroy: pDevExt=%p pGip=%p pGipTimer=%p GipMemObj=%p\n", pDevExt,
4694 pDevExt->GipMemObj != NIL_RTR0MEMOBJ ? RTR0MemObjAddress(pDevExt->GipMemObj) : NULL,
4695 pDevExt->pGipTimer, pDevExt->GipMemObj));
4696#endif
4697
4698 /*
4699 * Invalid the GIP data.
4700 */
4701 if (pDevExt->pGip)
4702 {
4703 supdrvGipTerm(pDevExt->pGip);
4704 pDevExt->pGip = NULL;
4705 }
4706 g_pSUPGlobalInfoPage = NULL;
4707
4708 /*
4709 * Destroy the timer and free the GIP memory object.
4710 */
4711 if (pDevExt->pGipTimer)
4712 {
4713 rc = RTTimerDestroy(pDevExt->pGipTimer); AssertRC(rc);
4714 pDevExt->pGipTimer = NULL;
4715 }
4716
4717 if (pDevExt->GipMemObj != NIL_RTR0MEMOBJ)
4718 {
4719 rc = RTR0MemObjFree(pDevExt->GipMemObj, true /* free mappings */); AssertRC(rc);
4720 pDevExt->GipMemObj = NIL_RTR0MEMOBJ;
4721 }
4722
4723 /*
4724 * Finally, release the system timer resolution request if one succeeded.
4725 */
4726 if (pDevExt->u32SystemTimerGranularityGrant)
4727 {
4728 rc = RTTimerReleaseSystemGranularity(pDevExt->u32SystemTimerGranularityGrant); AssertRC(rc);
4729 pDevExt->u32SystemTimerGranularityGrant = 0;
4730 }
4731}
4732
4733
4734/**
4735 * Timer callback function sync GIP mode.
4736 * @param pTimer The timer.
4737 * @param pvUser The device extension.
4738 */
4739static DECLCALLBACK(void) supdrvGipSyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick)
4740{
4741 RTCCUINTREG fOldFlags = ASMIntDisableFlags(); /* No interruptions please (real problem on S10). */
4742 PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
4743 uint64_t u64TSC = ASMReadTSC();
4744 uint64_t NanoTS = RTTimeSystemNanoTS();
4745
4746 supdrvGipUpdate(pDevExt->pGip, NanoTS, u64TSC, iTick);
4747
4748 ASMSetFlags(fOldFlags);
4749}
4750
4751
4752/**
4753 * Timer callback function for async GIP mode.
4754 * @param pTimer The timer.
4755 * @param pvUser The device extension.
4756 */
4757static DECLCALLBACK(void) supdrvGipAsyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick)
4758{
4759 RTCCUINTREG fOldFlags = ASMIntDisableFlags(); /* No interruptions please (real problem on S10). */
4760 PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
4761 RTCPUID idCpu = RTMpCpuId();
4762 uint64_t u64TSC = ASMReadTSC();
4763 uint64_t NanoTS = RTTimeSystemNanoTS();
4764
4765 /** @todo reset the transaction number and whatnot when iTick == 1. */
4766 if (pDevExt->idGipMaster == idCpu)
4767 supdrvGipUpdate(pDevExt->pGip, NanoTS, u64TSC, iTick);
4768 else
4769 supdrvGipUpdatePerCpu(pDevExt->pGip, NanoTS, u64TSC, ASMGetApicId(), iTick);
4770
4771 ASMSetFlags(fOldFlags);
4772}
4773
4774
4775/**
4776 * Multiprocessor event notification callback.
4777 *
4778 * This is used to make sue that the GIP master gets passed on to
4779 * another CPU.
4780 *
4781 * @param enmEvent The event.
4782 * @param idCpu The cpu it applies to.
4783 * @param pvUser Pointer to the device extension.
4784 */
4785static DECLCALLBACK(void) supdrvGipMpEvent(RTMPEVENT enmEvent, RTCPUID idCpu, void *pvUser)
4786{
4787 PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
4788 if (enmEvent == RTMPEVENT_OFFLINE)
4789 {
4790 RTCPUID idGipMaster;
4791 ASMAtomicReadSize(&pDevExt->idGipMaster, &idGipMaster);
4792 if (idGipMaster == idCpu)
4793 {
4794 /*
4795 * Find a new GIP master.
4796 */
4797 bool fIgnored;
4798 unsigned i;
4799 RTCPUID idNewGipMaster = NIL_RTCPUID;
4800 RTCPUSET OnlineCpus;
4801 RTMpGetOnlineSet(&OnlineCpus);
4802
4803 for (i = 0; i < RTCPUSET_MAX_CPUS; i++)
4804 {
4805 RTCPUID idCurCpu = RTMpCpuIdFromSetIndex(i);
4806 if ( RTCpuSetIsMember(&OnlineCpus, idCurCpu)
4807 && idCurCpu != idGipMaster)
4808 {
4809 idNewGipMaster = idCurCpu;
4810 break;
4811 }
4812 }
4813
4814 Log(("supdrvGipMpEvent: Gip master %#lx -> %#lx\n", (long)idGipMaster, (long)idNewGipMaster));
4815 ASMAtomicCmpXchgSize(&pDevExt->idGipMaster, idNewGipMaster, idGipMaster, fIgnored);
4816 NOREF(fIgnored);
4817 }
4818 }
4819}
4820
4821
4822/**
4823 * Callback used by supdrvDetermineAsyncTSC to read the TSC on a CPU.
4824 *
4825 * @param idCpu Ignored.
4826 * @param pvUser1 Where to put the TSC.
4827 * @param pvUser2 Ignored.
4828 */
4829static DECLCALLBACK(void) supdrvDetermineAsyncTscWorker(RTCPUID idCpu, void *pvUser1, void *pvUser2)
4830{
4831#if 1
4832 ASMAtomicWriteU64((uint64_t volatile *)pvUser1, ASMReadTSC());
4833#else
4834 *(uint64_t *)pvUser1 = ASMReadTSC();
4835#endif
4836}
4837
4838
4839/**
4840 * Determine if Async GIP mode is required because of TSC drift.
4841 *
4842 * When using the default/normal timer code it is essential that the time stamp counter
4843 * (TSC) runs never backwards, that is, a read operation to the counter should return
4844 * a bigger value than any previous read operation. This is guaranteed by the latest
4845 * AMD CPUs and by newer Intel CPUs which never enter the C2 state (P4). In any other
4846 * case we have to choose the asynchronous timer mode.
4847 *
4848 * @param poffMin Pointer to the determined difference between different cores.
4849 * @return false if the time stamp counters appear to be synchron, true otherwise.
4850 */
4851static bool supdrvDetermineAsyncTsc(uint64_t *poffMin)
4852{
4853 /*
4854 * Just iterate all the cpus 8 times and make sure that the TSC is
4855 * ever increasing. We don't bother taking TSC rollover into account.
4856 */
4857 RTCPUSET CpuSet;
4858 int iLastCpu = RTCpuLastIndex(RTMpGetSet(&CpuSet));
4859 int iCpu;
4860 int cLoops = 8;
4861 bool fAsync = false;
4862 int rc = VINF_SUCCESS;
4863 uint64_t offMax = 0;
4864 uint64_t offMin = ~(uint64_t)0;
4865 uint64_t PrevTsc = ASMReadTSC();
4866
4867 while (cLoops-- > 0)
4868 {
4869 for (iCpu = 0; iCpu <= iLastCpu; iCpu++)
4870 {
4871 uint64_t CurTsc;
4872 rc = RTMpOnSpecific(RTMpCpuIdFromSetIndex(iCpu), supdrvDetermineAsyncTscWorker, &CurTsc, NULL);
4873 if (RT_SUCCESS(rc))
4874 {
4875 if (CurTsc <= PrevTsc)
4876 {
4877 fAsync = true;
4878 offMin = offMax = PrevTsc - CurTsc;
4879 Log(("supdrvDetermineAsyncTsc: iCpu=%d cLoops=%d CurTsc=%llx PrevTsc=%llx\n",
4880 iCpu, cLoops, CurTsc, PrevTsc));
4881 break;
4882 }
4883
4884 /* Gather statistics (except the first time). */
4885 if (iCpu != 0 || cLoops != 7)
4886 {
4887 uint64_t off = CurTsc - PrevTsc;
4888 if (off < offMin)
4889 offMin = off;
4890 if (off > offMax)
4891 offMax = off;
4892 Log2(("%d/%d: off=%llx\n", cLoops, iCpu, off));
4893 }
4894
4895 /* Next */
4896 PrevTsc = CurTsc;
4897 }
4898 else if (rc == VERR_NOT_SUPPORTED)
4899 break;
4900 else
4901 AssertMsg(rc == VERR_CPU_NOT_FOUND || rc == VERR_CPU_OFFLINE, ("%d\n", rc));
4902 }
4903
4904 /* broke out of the loop. */
4905 if (iCpu <= iLastCpu)
4906 break;
4907 }
4908
4909 *poffMin = offMin; /* Almost RTMpOnSpecific profiling. */
4910 Log(("supdrvDetermineAsyncTsc: returns %d; iLastCpu=%d rc=%d offMin=%llx offMax=%llx\n",
4911 fAsync, iLastCpu, rc, offMin, offMax));
4912#if !defined(RT_OS_SOLARIS) && !defined(RT_OS_OS2) && !defined(RT_OS_WINDOWS)
4913 OSDBGPRINT(("vboxdrv: fAsync=%d offMin=%#lx offMax=%#lx\n", fAsync, (long)offMin, (long)offMax));
4914#endif
4915 return fAsync;
4916}
4917
4918
4919/**
4920 * Determin the GIP TSC mode.
4921 *
4922 * @returns The most suitable TSC mode.
4923 * @param pDevExt Pointer to the device instance data.
4924 */
4925static SUPGIPMODE supdrvGipDeterminTscMode(PSUPDRVDEVEXT pDevExt)
4926{
4927 /*
4928 * On SMP we're faced with two problems:
4929 * (1) There might be a skew between the CPU, so that cpu0
4930 * returns a TSC that is sligtly different from cpu1.
4931 * (2) Power management (and other things) may cause the TSC
4932 * to run at a non-constant speed, and cause the speed
4933 * to be different on the cpus. This will result in (1).
4934 *
4935 * So, on SMP systems we'll have to select the ASYNC update method
4936 * if there are symphoms of these problems.
4937 */
4938 if (RTMpGetCount() > 1)
4939 {
4940 uint32_t uEAX, uEBX, uECX, uEDX;
4941 uint64_t u64DiffCoresIgnored;
4942
4943 /* Permit the user and/or the OS specfic bits to force async mode. */
4944 if (supdrvOSGetForcedAsyncTscMode(pDevExt))
4945 return SUPGIPMODE_ASYNC_TSC;
4946
4947 /* Try check for current differences between the cpus. */
4948 if (supdrvDetermineAsyncTsc(&u64DiffCoresIgnored))
4949 return SUPGIPMODE_ASYNC_TSC;
4950
4951 /*
4952 * If the CPU supports power management and is an AMD one we
4953 * won't trust it unless it has the TscInvariant bit is set.
4954 */
4955 /* Check for "AuthenticAMD" */
4956 ASMCpuId(0, &uEAX, &uEBX, &uECX, &uEDX);
4957 if ( uEAX >= 1
4958 && uEBX == X86_CPUID_VENDOR_AMD_EBX
4959 && uECX == X86_CPUID_VENDOR_AMD_ECX
4960 && uEDX == X86_CPUID_VENDOR_AMD_EDX)
4961 {
4962 /* Check for APM support and that TscInvariant is cleared. */
4963 ASMCpuId(0x80000000, &uEAX, &uEBX, &uECX, &uEDX);
4964 if (uEAX >= 0x80000007)
4965 {
4966 ASMCpuId(0x80000007, &uEAX, &uEBX, &uECX, &uEDX);
4967 if ( !(uEDX & RT_BIT(8))/* TscInvariant */
4968 && (uEDX & 0x3e)) /* STC|TM|THERMTRIP|VID|FID. Ignore TS. */
4969 return SUPGIPMODE_ASYNC_TSC;
4970 }
4971 }
4972 }
4973 return SUPGIPMODE_SYNC_TSC;
4974}
4975
4976
4977
4978/**
4979 * Initializes the GIP data.
4980 *
4981 * @param pDevExt Pointer to the device instance data.
4982 * @param pGip Pointer to the read-write kernel mapping of the GIP.
4983 * @param HCPhys The physical address of the GIP.
4984 * @param u64NanoTS The current nanosecond timestamp.
4985 * @param uUpdateHz The update freqence.
4986 */
4987static void supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys, uint64_t u64NanoTS, unsigned uUpdateHz)
4988{
4989 unsigned i;
4990#ifdef DEBUG_DARWIN_GIP
4991 OSDBGPRINT(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
4992#else
4993 LogFlow(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
4994#endif
4995
4996 /*
4997 * Initialize the structure.
4998 */
4999 memset(pGip, 0, PAGE_SIZE);
5000 pGip->u32Magic = SUPGLOBALINFOPAGE_MAGIC;
5001 pGip->u32Version = SUPGLOBALINFOPAGE_VERSION;
5002 pGip->u32Mode = supdrvGipDeterminTscMode(pDevExt);
5003 pGip->u32UpdateHz = uUpdateHz;
5004 pGip->u32UpdateIntervalNS = 1000000000 / uUpdateHz;
5005 pGip->u64NanoTSLastUpdateHz = u64NanoTS;
5006
5007 for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
5008 {
5009 pGip->aCPUs[i].u32TransactionId = 2;
5010 pGip->aCPUs[i].u64NanoTS = u64NanoTS;
5011 pGip->aCPUs[i].u64TSC = ASMReadTSC();
5012
5013 /*
5014 * We don't know the following values until we've executed updates.
5015 * So, we'll just pretend it's a 4 GHz CPU and adjust the history it on
5016 * the 2nd timer callout.
5017 */
5018 pGip->aCPUs[i].u64CpuHz = _4G + 1; /* tstGIP-2 depends on this. */
5019 pGip->aCPUs[i].u32UpdateIntervalTSC
5020 = pGip->aCPUs[i].au32TSCHistory[0]
5021 = pGip->aCPUs[i].au32TSCHistory[1]
5022 = pGip->aCPUs[i].au32TSCHistory[2]
5023 = pGip->aCPUs[i].au32TSCHistory[3]
5024 = pGip->aCPUs[i].au32TSCHistory[4]
5025 = pGip->aCPUs[i].au32TSCHistory[5]
5026 = pGip->aCPUs[i].au32TSCHistory[6]
5027 = pGip->aCPUs[i].au32TSCHistory[7]
5028 = /*pGip->aCPUs[i].u64CpuHz*/ _4G / uUpdateHz;
5029 }
5030
5031 /*
5032 * Link it to the device extension.
5033 */
5034 pDevExt->pGip = pGip;
5035 pDevExt->HCPhysGip = HCPhys;
5036 pDevExt->cGipUsers = 0;
5037}
5038
5039
5040/**
5041 * Invalidates the GIP data upon termination.
5042 *
5043 * @param pGip Pointer to the read-write kernel mapping of the GIP.
5044 */
5045static void supdrvGipTerm(PSUPGLOBALINFOPAGE pGip)
5046{
5047 unsigned i;
5048 pGip->u32Magic = 0;
5049 for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
5050 {
5051 pGip->aCPUs[i].u64NanoTS = 0;
5052 pGip->aCPUs[i].u64TSC = 0;
5053 pGip->aCPUs[i].iTSCHistoryHead = 0;
5054 }
5055}
5056
5057
5058/**
5059 * Worker routine for supdrvGipUpdate and supdrvGipUpdatePerCpu that
5060 * updates all the per cpu data except the transaction id.
5061 *
5062 * @param pGip The GIP.
5063 * @param pGipCpu Pointer to the per cpu data.
5064 * @param u64NanoTS The current time stamp.
5065 * @param u64TSC The current TSC.
5066 * @param iTick The current timer tick.
5067 */
5068static void supdrvGipDoUpdateCpu(PSUPGLOBALINFOPAGE pGip, PSUPGIPCPU pGipCpu, uint64_t u64NanoTS, uint64_t u64TSC, uint64_t iTick)
5069{
5070 uint64_t u64TSCDelta;
5071 uint32_t u32UpdateIntervalTSC;
5072 uint32_t u32UpdateIntervalTSCSlack;
5073 unsigned iTSCHistoryHead;
5074 uint64_t u64CpuHz;
5075 uint32_t u32TransactionId;
5076
5077 /* Delta between this and the previous update. */
5078 ASMAtomicUoWriteU32(&pGipCpu->u32PrevUpdateIntervalNS, (uint32_t)(u64NanoTS - pGipCpu->u64NanoTS));
5079
5080 /*
5081 * Update the NanoTS.
5082 */
5083 ASMAtomicXchgU64(&pGipCpu->u64NanoTS, u64NanoTS);
5084
5085 /*
5086 * Calc TSC delta.
5087 */
5088 /** @todo validate the NanoTS delta, don't trust the OS to call us when it should... */
5089 u64TSCDelta = u64TSC - pGipCpu->u64TSC;
5090 ASMAtomicXchgU64(&pGipCpu->u64TSC, u64TSC);
5091
5092 if (u64TSCDelta >> 32)
5093 {
5094 u64TSCDelta = pGipCpu->u32UpdateIntervalTSC;
5095 pGipCpu->cErrors++;
5096 }
5097
5098 /*
5099 * On the 2nd and 3rd callout, reset the history with the current TSC
5100 * interval since the values entered by supdrvGipInit are totally off.
5101 * The interval on the 1st callout completely unreliable, the 2nd is a bit
5102 * better, while the 3rd should be most reliable.
5103 */
5104 u32TransactionId = pGipCpu->u32TransactionId;
5105 if (RT_UNLIKELY( ( u32TransactionId == 5
5106 || u32TransactionId == 7)
5107 && ( iTick == 2
5108 || iTick == 3) ))
5109 {
5110 unsigned i;
5111 for (i = 0; i < RT_ELEMENTS(pGipCpu->au32TSCHistory); i++)
5112 ASMAtomicUoWriteU32(&pGipCpu->au32TSCHistory[i], (uint32_t)u64TSCDelta);
5113 }
5114
5115 /*
5116 * TSC History.
5117 */
5118 Assert(RT_ELEMENTS(pGipCpu->au32TSCHistory) == 8);
5119 iTSCHistoryHead = (pGipCpu->iTSCHistoryHead + 1) & 7;
5120 ASMAtomicXchgU32(&pGipCpu->iTSCHistoryHead, iTSCHistoryHead);
5121 ASMAtomicXchgU32(&pGipCpu->au32TSCHistory[iTSCHistoryHead], (uint32_t)u64TSCDelta);
5122
5123 /*
5124 * UpdateIntervalTSC = average of last 8,2,1 intervals depending on update HZ.
5125 */
5126 if (pGip->u32UpdateHz >= 1000)
5127 {
5128 uint32_t u32;
5129 u32 = pGipCpu->au32TSCHistory[0];
5130 u32 += pGipCpu->au32TSCHistory[1];
5131 u32 += pGipCpu->au32TSCHistory[2];
5132 u32 += pGipCpu->au32TSCHistory[3];
5133 u32 >>= 2;
5134 u32UpdateIntervalTSC = pGipCpu->au32TSCHistory[4];
5135 u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[5];
5136 u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[6];
5137 u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[7];
5138 u32UpdateIntervalTSC >>= 2;
5139 u32UpdateIntervalTSC += u32;
5140 u32UpdateIntervalTSC >>= 1;
5141
5142 /* Value choosen for a 2GHz Athlon64 running linux 2.6.10/11, . */
5143 u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 14;
5144 }
5145 else if (pGip->u32UpdateHz >= 90)
5146 {
5147 u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
5148 u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[(iTSCHistoryHead - 1) & 7];
5149 u32UpdateIntervalTSC >>= 1;
5150
5151 /* value choosen on a 2GHz thinkpad running windows */
5152 u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 7;
5153 }
5154 else
5155 {
5156 u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
5157
5158 /* This value hasn't be checked yet.. waiting for OS/2 and 33Hz timers.. :-) */
5159 u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 6;
5160 }
5161 ASMAtomicXchgU32(&pGipCpu->u32UpdateIntervalTSC, u32UpdateIntervalTSC + u32UpdateIntervalTSCSlack);
5162
5163 /*
5164 * CpuHz.
5165 */
5166 u64CpuHz = ASMMult2xU32RetU64(u32UpdateIntervalTSC, pGip->u32UpdateHz);
5167 ASMAtomicXchgU64(&pGipCpu->u64CpuHz, u64CpuHz);
5168}
5169
5170
5171/**
5172 * Updates the GIP.
5173 *
5174 * @param pGip Pointer to the GIP.
5175 * @param u64NanoTS The current nanosecond timesamp.
5176 * @param u64TSC The current TSC timesamp.
5177 * @param iTick The current timer tick.
5178 */
5179static void supdrvGipUpdate(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, uint64_t u64TSC, uint64_t iTick)
5180{
5181 /*
5182 * Determin the relevant CPU data.
5183 */
5184 PSUPGIPCPU pGipCpu;
5185 if (pGip->u32Mode != SUPGIPMODE_ASYNC_TSC)
5186 pGipCpu = &pGip->aCPUs[0];
5187 else
5188 {
5189 unsigned iCpu = ASMGetApicId();
5190 if (RT_UNLIKELY(iCpu >= RT_ELEMENTS(pGip->aCPUs)))
5191 return;
5192 pGipCpu = &pGip->aCPUs[iCpu];
5193 }
5194
5195 /*
5196 * Start update transaction.
5197 */
5198 if (!(ASMAtomicIncU32(&pGipCpu->u32TransactionId) & 1))
5199 {
5200 /* this can happen on win32 if we're taking to long and there are more CPUs around. shouldn't happen though. */
5201 AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGipCpu->u32TransactionId));
5202 ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5203 pGipCpu->cErrors++;
5204 return;
5205 }
5206
5207 /*
5208 * Recalc the update frequency every 0x800th time.
5209 */
5210 if (!(pGipCpu->u32TransactionId & (GIP_UPDATEHZ_RECALC_FREQ * 2 - 2)))
5211 {
5212 if (pGip->u64NanoTSLastUpdateHz)
5213 {
5214#ifdef RT_ARCH_AMD64 /** @todo fix 64-bit div here to work on x86 linux. */
5215 uint64_t u64Delta = u64NanoTS - pGip->u64NanoTSLastUpdateHz;
5216 uint32_t u32UpdateHz = (uint32_t)((UINT64_C(1000000000) * GIP_UPDATEHZ_RECALC_FREQ) / u64Delta);
5217 if (u32UpdateHz <= 2000 && u32UpdateHz >= 30)
5218 {
5219 ASMAtomicXchgU32(&pGip->u32UpdateHz, u32UpdateHz);
5220 ASMAtomicXchgU32(&pGip->u32UpdateIntervalNS, 1000000000 / u32UpdateHz);
5221 }
5222#endif
5223 }
5224 ASMAtomicXchgU64(&pGip->u64NanoTSLastUpdateHz, u64NanoTS);
5225 }
5226
5227 /*
5228 * Update the data.
5229 */
5230 supdrvGipDoUpdateCpu(pGip, pGipCpu, u64NanoTS, u64TSC, iTick);
5231
5232 /*
5233 * Complete transaction.
5234 */
5235 ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5236}
5237
5238
5239/**
5240 * Updates the per cpu GIP data for the calling cpu.
5241 *
5242 * @param pGip Pointer to the GIP.
5243 * @param u64NanoTS The current nanosecond timesamp.
5244 * @param u64TSC The current TSC timesamp.
5245 * @param iCpu The CPU index.
5246 * @param iTick The current timer tick.
5247 */
5248static void supdrvGipUpdatePerCpu(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, uint64_t u64TSC, unsigned iCpu, uint64_t iTick)
5249{
5250 PSUPGIPCPU pGipCpu;
5251
5252 if (RT_LIKELY(iCpu < RT_ELEMENTS(pGip->aCPUs)))
5253 {
5254 pGipCpu = &pGip->aCPUs[iCpu];
5255
5256 /*
5257 * Start update transaction.
5258 */
5259 if (!(ASMAtomicIncU32(&pGipCpu->u32TransactionId) & 1))
5260 {
5261 AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGipCpu->u32TransactionId));
5262 ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5263 pGipCpu->cErrors++;
5264 return;
5265 }
5266
5267 /*
5268 * Update the data.
5269 */
5270 supdrvGipDoUpdateCpu(pGip, pGipCpu, u64NanoTS, u64TSC, iTick);
5271
5272 /*
5273 * Complete transaction.
5274 */
5275 ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5276 }
5277}
5278
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette