VirtualBox

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPDrv.c@ 28505

Last change on this file since 28505 was 28505, checked in by vboxsync, 15 years ago

SUPDrv: Solaris: fix trunk builds till r0drv sem is implemented.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 193.4 KB
Line 
1/* $Revision: 28505 $ */
2/** @file
3 * VBoxDrv - The VirtualBox Support Driver - Common code.
4 */
5
6/*
7 * Copyright (C) 2006-2009 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 *
26 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
27 * Clara, CA 95054 USA or visit http://www.sun.com if you need
28 * additional information or have any questions.
29 */
30
31/*******************************************************************************
32* Header Files *
33*******************************************************************************/
34#define LOG_GROUP LOG_GROUP_SUP_DRV
35#define SUPDRV_AGNOSTIC
36#include "SUPDrvInternal.h"
37#ifndef PAGE_SHIFT
38# include <iprt/param.h>
39#endif
40#include <iprt/alloc.h>
41#include <iprt/cpuset.h>
42#include <iprt/handletable.h>
43#include <iprt/mp.h>
44#include <iprt/power.h>
45#include <iprt/process.h>
46#include <iprt/semaphore.h>
47#include <iprt/spinlock.h>
48#include <iprt/thread.h>
49#include <iprt/uuid.h>
50#if defined(RT_OS_DARWIN) || defined(RT_OS_SOLARIS) || defined(RT_OS_FREEBSD)
51# include <iprt/crc32.h>
52# include <iprt/net.h>
53# include <iprt/string.h>
54# include <iprt/rand.h>
55# include <iprt/path.h>
56#endif
57
58#include <VBox/param.h>
59#include <VBox/log.h>
60#include <VBox/err.h>
61#include <VBox/hwacc_svm.h>
62#include <VBox/hwacc_vmx.h>
63#include <VBox/x86.h>
64
65/*
66 * Logging assignments:
67 * Log - useful stuff, like failures.
68 * LogFlow - program flow, except the really noisy bits.
69 * Log2 - Cleanup.
70 * Log3 - Loader flow noise.
71 * Log4 - Call VMMR0 flow noise.
72 * Log5 - Native yet-to-be-defined noise.
73 * Log6 - Native ioctl flow noise.
74 *
75 * Logging requires BUILD_TYPE=debug and possibly changes to the logger
76 * instanciation in log-vbox.c(pp).
77 */
78
79
80/*******************************************************************************
81* Defined Constants And Macros *
82*******************************************************************************/
83/** The frequency by which we recalculate the u32UpdateHz and
84 * u32UpdateIntervalNS GIP members. The value must be a power of 2. */
85#define GIP_UPDATEHZ_RECALC_FREQ 0x800
86
87/** @def VBOX_SVN_REV
88 * The makefile should define this if it can. */
89#ifndef VBOX_SVN_REV
90# define VBOX_SVN_REV 0
91#endif
92
93
94/*******************************************************************************
95* Internal Functions *
96*******************************************************************************/
97static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void *pvObj, void *pvCtx, void *pvUser);
98static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void *pvObj, void *pvCtx, void *pvUser);
99static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession);
100static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType);
101static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq);
102static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq);
103static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq);
104static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq);
105static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq);
106static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void *pvVMMR0, void *pvVMMR0EntryInt, void *pvVMMR0EntryFast, void *pvVMMR0EntryEx);
107static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt);
108static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage);
109static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage);
110DECLINLINE(int) supdrvLdrLock(PSUPDRVDEVEXT pDevExt);
111DECLINLINE(int) supdrvLdrUnlock(PSUPDRVDEVEXT pDevExt);
112static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq);
113static int supdrvIOCtl_LoggerSettings(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLOGGERSETTINGS pReq);
114static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt);
115static void supdrvGipDestroy(PSUPDRVDEVEXT pDevExt);
116static DECLCALLBACK(void) supdrvGipSyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick);
117static DECLCALLBACK(void) supdrvGipAsyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick);
118static DECLCALLBACK(void) supdrvGipMpEvent(RTMPEVENT enmEvent, RTCPUID idCpu, void *pvUser);
119static void supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys, uint64_t u64NanoTS, unsigned uUpdateHz);
120static void supdrvGipTerm(PSUPGLOBALINFOPAGE pGip);
121static void supdrvGipUpdate(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, uint64_t u64TSC, uint64_t iTick);
122static void supdrvGipUpdatePerCpu(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, uint64_t u64TSC, unsigned iCpu, uint64_t iTick);
123
124
125/*******************************************************************************
126* Global Variables *
127*******************************************************************************/
128DECLEXPORT(PSUPGLOBALINFOPAGE) g_pSUPGlobalInfoPage = NULL;
129
130/**
131 * Array of the R0 SUP API.
132 */
133static SUPFUNC g_aFunctions[] =
134{
135 /* name function */
136 /* Entries with absolute addresses determined at runtime, fixup
137 code makes ugly ASSUMPTIONS about the order here: */
138 { "SUPR0AbsIs64bit", (void *)0 },
139 { "SUPR0Abs64bitKernelCS", (void *)0 },
140 { "SUPR0Abs64bitKernelSS", (void *)0 },
141 { "SUPR0Abs64bitKernelDS", (void *)0 },
142 { "SUPR0AbsKernelCS", (void *)0 },
143 { "SUPR0AbsKernelSS", (void *)0 },
144 { "SUPR0AbsKernelDS", (void *)0 },
145 { "SUPR0AbsKernelES", (void *)0 },
146 { "SUPR0AbsKernelFS", (void *)0 },
147 { "SUPR0AbsKernelGS", (void *)0 },
148 /* Normal function pointers: */
149 { "SUPR0ComponentRegisterFactory", (void *)SUPR0ComponentRegisterFactory },
150 { "SUPR0ComponentDeregisterFactory", (void *)SUPR0ComponentDeregisterFactory },
151 { "SUPR0ComponentQueryFactory", (void *)SUPR0ComponentQueryFactory },
152 { "SUPR0ObjRegister", (void *)SUPR0ObjRegister },
153 { "SUPR0ObjAddRef", (void *)SUPR0ObjAddRef },
154 { "SUPR0ObjAddRefEx", (void *)SUPR0ObjAddRefEx },
155 { "SUPR0ObjRelease", (void *)SUPR0ObjRelease },
156 { "SUPR0ObjVerifyAccess", (void *)SUPR0ObjVerifyAccess },
157 { "SUPR0LockMem", (void *)SUPR0LockMem },
158 { "SUPR0UnlockMem", (void *)SUPR0UnlockMem },
159 { "SUPR0ContAlloc", (void *)SUPR0ContAlloc },
160 { "SUPR0ContFree", (void *)SUPR0ContFree },
161 { "SUPR0LowAlloc", (void *)SUPR0LowAlloc },
162 { "SUPR0LowFree", (void *)SUPR0LowFree },
163 { "SUPR0MemAlloc", (void *)SUPR0MemAlloc },
164 { "SUPR0MemGetPhys", (void *)SUPR0MemGetPhys },
165 { "SUPR0MemFree", (void *)SUPR0MemFree },
166 { "SUPR0PageAllocEx", (void *)SUPR0PageAllocEx },
167 { "SUPR0PageFree", (void *)SUPR0PageFree },
168 { "SUPR0Printf", (void *)SUPR0Printf }, /** @todo needs wrapping? */
169 { "SUPSemEventCreate", (void *)SUPSemEventCreate },
170 { "SUPSemEventClose", (void *)SUPSemEventClose },
171 { "SUPSemEventSignal", (void *)SUPSemEventSignal },
172 { "SUPSemEventWait", (void *)SUPSemEventWait },
173 { "SUPSemEventWaitNoResume", (void *)SUPSemEventWaitNoResume },
174 { "SUPSemEventMultiCreate", (void *)SUPSemEventMultiCreate },
175 { "SUPSemEventMultiClose", (void *)SUPSemEventMultiClose },
176 { "SUPSemEventMultiSignal", (void *)SUPSemEventMultiSignal },
177 { "SUPSemEventMultiReset", (void *)SUPSemEventMultiReset },
178 { "SUPSemEventMultiWait", (void *)SUPSemEventMultiWait },
179 { "SUPSemEventMultiWaitNoResume", (void *)SUPSemEventMultiWaitNoResume },
180 { "SUPR0GetPagingMode", (void *)SUPR0GetPagingMode },
181 { "SUPR0EnableVTx", (void *)SUPR0EnableVTx },
182 { "SUPGetGIP", (void *)SUPGetGIP },
183 { "g_pSUPGlobalInfoPage", (void *)&g_pSUPGlobalInfoPage },
184 { "RTMemAlloc", (void *)RTMemAlloc },
185 { "RTMemAllocZ", (void *)RTMemAllocZ },
186 { "RTMemFree", (void *)RTMemFree },
187 /*{ "RTMemDup", (void *)RTMemDup },
188 { "RTMemDupEx", (void *)RTMemDupEx },*/
189 { "RTMemRealloc", (void *)RTMemRealloc },
190 { "RTR0MemObjAllocLow", (void *)RTR0MemObjAllocLow },
191 { "RTR0MemObjAllocPage", (void *)RTR0MemObjAllocPage },
192 { "RTR0MemObjAllocPhys", (void *)RTR0MemObjAllocPhys },
193 { "RTR0MemObjAllocPhysEx", (void *)RTR0MemObjAllocPhysEx },
194 { "RTR0MemObjAllocPhysNC", (void *)RTR0MemObjAllocPhysNC },
195 { "RTR0MemObjAllocCont", (void *)RTR0MemObjAllocCont },
196 { "RTR0MemObjEnterPhys", (void *)RTR0MemObjEnterPhys },
197 { "RTR0MemObjLockUser", (void *)RTR0MemObjLockUser },
198 { "RTR0MemObjMapKernel", (void *)RTR0MemObjMapKernel },
199 { "RTR0MemObjMapKernelEx", (void *)RTR0MemObjMapKernelEx },
200 { "RTR0MemObjMapUser", (void *)RTR0MemObjMapUser },
201 { "RTR0MemObjProtect", (void *)RTR0MemObjProtect },
202 { "RTR0MemObjAddress", (void *)RTR0MemObjAddress },
203 { "RTR0MemObjAddressR3", (void *)RTR0MemObjAddressR3 },
204 { "RTR0MemObjSize", (void *)RTR0MemObjSize },
205 { "RTR0MemObjIsMapping", (void *)RTR0MemObjIsMapping },
206 { "RTR0MemObjGetPagePhysAddr", (void *)RTR0MemObjGetPagePhysAddr },
207 { "RTR0MemObjFree", (void *)RTR0MemObjFree },
208 { "RTR0MemUserCopyFrom", (void *)RTR0MemUserCopyFrom },
209 { "RTR0MemUserCopyTo", (void *)RTR0MemUserCopyTo },
210 { "RTR0MemUserIsValidAddr", (void *)RTR0MemUserIsValidAddr },
211 { "RTR0MemKernelIsValidAddr", (void *)RTR0MemKernelIsValidAddr },
212 { "RTR0MemAreKrnlAndUsrDifferent", (void *)RTR0MemAreKrnlAndUsrDifferent },
213#ifndef RT_OS_SOLARIS
214 { "RTSemMutexCreate", (void *)RTSemMutexCreate },
215 { "RTSemMutexRequest", (void *)RTSemMutexRequest },
216 { "RTSemMutexRequestDebug", (void *)RTSemMutexRequestDebug },
217 { "RTSemMutexRequestNoResume", (void *)RTSemMutexRequestNoResume },
218 { "RTSemMutexRequestNoResumeDebug", (void *)RTSemMutexRequestNoResumeDebug },
219 { "RTSemMutexRelease", (void *)RTSemMutexRelease },
220 { "RTSemMutexDestroy", (void *)RTSemMutexDestroy },
221#endif
222 { "RTProcSelf", (void *)RTProcSelf },
223 { "RTR0ProcHandleSelf", (void *)RTR0ProcHandleSelf },
224 { "RTSemFastMutexCreate", (void *)RTSemFastMutexCreate },
225 { "RTSemFastMutexDestroy", (void *)RTSemFastMutexDestroy },
226 { "RTSemFastMutexRequest", (void *)RTSemFastMutexRequest },
227 { "RTSemFastMutexRelease", (void *)RTSemFastMutexRelease },
228 { "RTSemEventCreate", (void *)RTSemEventCreate },
229 { "RTSemEventSignal", (void *)RTSemEventSignal },
230 { "RTSemEventWait", (void *)RTSemEventWait },
231 { "RTSemEventWaitNoResume", (void *)RTSemEventWaitNoResume },
232 { "RTSemEventDestroy", (void *)RTSemEventDestroy },
233 { "RTSemEventMultiCreate", (void *)RTSemEventMultiCreate },
234 { "RTSemEventMultiSignal", (void *)RTSemEventMultiSignal },
235 { "RTSemEventMultiReset", (void *)RTSemEventMultiReset },
236 { "RTSemEventMultiWait", (void *)RTSemEventMultiWait },
237 { "RTSemEventMultiWaitNoResume", (void *)RTSemEventMultiWaitNoResume },
238 { "RTSemEventMultiDestroy", (void *)RTSemEventMultiDestroy },
239 { "RTSpinlockCreate", (void *)RTSpinlockCreate },
240 { "RTSpinlockDestroy", (void *)RTSpinlockDestroy },
241 { "RTSpinlockAcquire", (void *)RTSpinlockAcquire },
242 { "RTSpinlockRelease", (void *)RTSpinlockRelease },
243 { "RTSpinlockAcquireNoInts", (void *)RTSpinlockAcquireNoInts },
244 { "RTSpinlockReleaseNoInts", (void *)RTSpinlockReleaseNoInts },
245 { "RTTimeNanoTS", (void *)RTTimeNanoTS },
246 { "RTTimeMilliTS", (void *)RTTimeMilliTS },
247 { "RTTimeSystemNanoTS", (void *)RTTimeSystemNanoTS },
248 { "RTTimeSystemMilliTS", (void *)RTTimeSystemMilliTS },
249 { "RTThreadNativeSelf", (void *)RTThreadNativeSelf },
250 { "RTThreadSleep", (void *)RTThreadSleep },
251 { "RTThreadYield", (void *)RTThreadYield },
252#if 0 /* Thread APIs, Part 2. */
253 { "RTThreadSelf", (void *)RTThreadSelf },
254 { "RTThreadCreate", (void *)RTThreadCreate },
255 { "RTThreadGetNative", (void *)RTThreadGetNative },
256 { "RTThreadWait", (void *)RTThreadWait },
257 { "RTThreadWaitNoResume", (void *)RTThreadWaitNoResume },
258 { "RTThreadGetName", (void *)RTThreadGetName },
259 { "RTThreadSelfName", (void *)RTThreadSelfName },
260 { "RTThreadGetType", (void *)RTThreadGetType },
261 { "RTThreadUserSignal", (void *)RTThreadUserSignal },
262 { "RTThreadUserReset", (void *)RTThreadUserReset },
263 { "RTThreadUserWait", (void *)RTThreadUserWait },
264 { "RTThreadUserWaitNoResume", (void *)RTThreadUserWaitNoResume },
265#endif
266 { "RTThreadPreemptIsEnabled", (void *)RTThreadPreemptIsEnabled },
267 { "RTThreadPreemptIsPending", (void *)RTThreadPreemptIsPending },
268 { "RTThreadPreemptIsPendingTrusty", (void *)RTThreadPreemptIsPendingTrusty },
269 { "RTThreadPreemptIsPossible", (void *)RTThreadPreemptIsPossible },
270 { "RTThreadPreemptDisable", (void *)RTThreadPreemptDisable },
271 { "RTThreadPreemptRestore", (void *)RTThreadPreemptRestore },
272 { "RTThreadIsInInterrupt", (void *)RTThreadIsInInterrupt },
273
274 { "RTLogDefaultInstance", (void *)RTLogDefaultInstance },
275 { "RTMpCpuId", (void *)RTMpCpuId },
276 { "RTMpCpuIdFromSetIndex", (void *)RTMpCpuIdFromSetIndex },
277 { "RTMpCpuIdToSetIndex", (void *)RTMpCpuIdToSetIndex },
278 { "RTMpIsCpuPossible", (void *)RTMpIsCpuPossible },
279 { "RTMpGetCount", (void *)RTMpGetCount },
280 { "RTMpGetMaxCpuId", (void *)RTMpGetMaxCpuId },
281 { "RTMpGetOnlineCount", (void *)RTMpGetOnlineCount },
282 { "RTMpGetOnlineSet", (void *)RTMpGetOnlineSet },
283 { "RTMpGetSet", (void *)RTMpGetSet },
284 { "RTMpIsCpuOnline", (void *)RTMpIsCpuOnline },
285 { "RTMpIsCpuWorkPending", (void *)RTMpIsCpuWorkPending },
286 { "RTMpOnAll", (void *)RTMpOnAll },
287 { "RTMpOnOthers", (void *)RTMpOnOthers },
288 { "RTMpOnSpecific", (void *)RTMpOnSpecific },
289 { "RTMpPokeCpu", (void *)RTMpPokeCpu },
290 { "RTPowerNotificationRegister", (void *)RTPowerNotificationRegister },
291 { "RTPowerNotificationDeregister", (void *)RTPowerNotificationDeregister },
292 { "RTLogRelDefaultInstance", (void *)RTLogRelDefaultInstance },
293 { "RTLogSetDefaultInstanceThread", (void *)RTLogSetDefaultInstanceThread },
294 { "RTLogLoggerExV", (void *)RTLogLoggerExV },
295 { "RTLogPrintfV", (void *)RTLogPrintfV },
296 { "RTR0AssertPanicSystem", (void *)RTR0AssertPanicSystem },
297 { "RTAssertMsg1", (void *)RTAssertMsg1 },
298 { "RTAssertMsg2V", (void *)RTAssertMsg2V },
299 { "RTAssertSetQuiet", (void *)RTAssertSetQuiet },
300 { "RTAssertMayPanic", (void *)RTAssertMayPanic },
301 { "RTAssertSetMayPanic", (void *)RTAssertSetMayPanic },
302 { "RTAssertAreQuiet", (void *)RTAssertAreQuiet },
303};
304
305#if defined(RT_OS_DARWIN) || defined(RT_OS_SOLARIS) || defined(RT_OS_FREEBSD)
306/**
307 * Drag in the rest of IRPT since we share it with the
308 * rest of the kernel modules on darwin.
309 */
310PFNRT g_apfnVBoxDrvIPRTDeps[] =
311{
312 /* VBoxNetFlt */
313 (PFNRT)RTCrc32,
314 (PFNRT)RTErrConvertFromErrno,
315 (PFNRT)RTNetIPv4IsHdrValid,
316 (PFNRT)RTNetIPv4TCPChecksum,
317 (PFNRT)RTNetIPv4UDPChecksum,
318 (PFNRT)RTUuidCompare,
319 (PFNRT)RTUuidCompareStr,
320 (PFNRT)RTUuidFromStr,
321 (PFNRT)RTStrDup,
322 (PFNRT)RTStrFree,
323 /* VBoxNetAdp */
324 (PFNRT)RTRandBytes,
325 /* VBoxUSB */
326 (PFNRT)RTPathStripFilename,
327 NULL
328};
329#endif /* RT_OS_DARWIN || RT_OS_SOLARIS || RT_OS_SOLARIS */
330
331
332/**
333 * Initializes the device extentsion structure.
334 *
335 * @returns IPRT status code.
336 * @param pDevExt The device extension to initialize.
337 * @param cbSession The size of the session structure. The size of
338 * SUPDRVSESSION may be smaller when SUPDRV_AGNOSTIC is
339 * defined because we're skipping the OS specific members
340 * then.
341 */
342int VBOXCALL supdrvInitDevExt(PSUPDRVDEVEXT pDevExt, size_t cbSession)
343{
344 int rc;
345
346#ifdef SUPDRV_WITH_RELEASE_LOGGER
347 /*
348 * Create the release log.
349 */
350 static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
351 PRTLOGGER pRelLogger;
352 rc = RTLogCreate(&pRelLogger, 0 /* fFlags */, "all",
353 "VBOX_RELEASE_LOG", RT_ELEMENTS(s_apszGroups), s_apszGroups,
354 RTLOGDEST_STDOUT | RTLOGDEST_DEBUGGER, NULL);
355 if (RT_SUCCESS(rc))
356 RTLogRelSetDefaultInstance(pRelLogger);
357 /** @todo Add native hook for getting logger config parameters and setting
358 * them. On linux we should use the module parameter stuff... */
359#endif
360
361 /*
362 * Initialize it.
363 */
364 memset(pDevExt, 0, sizeof(*pDevExt));
365 rc = RTSpinlockCreate(&pDevExt->Spinlock);
366 if (RT_SUCCESS(rc))
367 {
368#ifdef SUPDRV_USE_MUTEX_FOR_LDR
369 rc = RTSemMutexCreate(&pDevExt->mtxLdr);
370#else
371 rc = RTSemFastMutexCreate(&pDevExt->mtxLdr);
372#endif
373 if (RT_SUCCESS(rc))
374 {
375 rc = RTSemFastMutexCreate(&pDevExt->mtxComponentFactory);
376 if (RT_SUCCESS(rc))
377 {
378#ifdef SUPDRV_USE_MUTEX_FOR_LDR
379 rc = RTSemMutexCreate(&pDevExt->mtxGip);
380#else
381 rc = RTSemFastMutexCreate(&pDevExt->mtxGip);
382#endif
383 if (RT_SUCCESS(rc))
384 {
385 rc = supdrvGipCreate(pDevExt);
386 if (RT_SUCCESS(rc))
387 {
388 pDevExt->u32Cookie = BIRD; /** @todo make this random? */
389 pDevExt->cbSession = cbSession;
390
391 /*
392 * Fixup the absolute symbols.
393 *
394 * Because of the table indexing assumptions we'll have a little #ifdef orgy
395 * here rather than distributing this to OS specific files. At least for now.
396 */
397#ifdef RT_OS_DARWIN
398# if ARCH_BITS == 32
399 if (SUPR0GetPagingMode() >= SUPPAGINGMODE_AMD64)
400 {
401 g_aFunctions[0].pfn = (void *)1; /* SUPR0AbsIs64bit */
402 g_aFunctions[1].pfn = (void *)0x80; /* SUPR0Abs64bitKernelCS - KERNEL64_CS, seg.h */
403 g_aFunctions[2].pfn = (void *)0x88; /* SUPR0Abs64bitKernelSS - KERNEL64_SS, seg.h */
404 g_aFunctions[3].pfn = (void *)0x88; /* SUPR0Abs64bitKernelDS - KERNEL64_SS, seg.h */
405 }
406 else
407 g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[4].pfn = (void *)0;
408 g_aFunctions[4].pfn = (void *)0x08; /* SUPR0AbsKernelCS - KERNEL_CS, seg.h */
409 g_aFunctions[5].pfn = (void *)0x10; /* SUPR0AbsKernelSS - KERNEL_DS, seg.h */
410 g_aFunctions[6].pfn = (void *)0x10; /* SUPR0AbsKernelDS - KERNEL_DS, seg.h */
411 g_aFunctions[7].pfn = (void *)0x10; /* SUPR0AbsKernelES - KERNEL_DS, seg.h */
412 g_aFunctions[8].pfn = (void *)0x10; /* SUPR0AbsKernelFS - KERNEL_DS, seg.h */
413 g_aFunctions[9].pfn = (void *)0x48; /* SUPR0AbsKernelGS - CPU_DATA_GS, seg.h */
414# else /* 64-bit darwin: */
415 g_aFunctions[0].pfn = (void *)1; /* SUPR0AbsIs64bit */
416 g_aFunctions[1].pfn = (void *)(uintptr_t)ASMGetCS(); /* SUPR0Abs64bitKernelCS */
417 g_aFunctions[2].pfn = (void *)(uintptr_t)ASMGetSS(); /* SUPR0Abs64bitKernelSS */
418 g_aFunctions[3].pfn = (void *)0; /* SUPR0Abs64bitKernelDS */
419 g_aFunctions[4].pfn = (void *)(uintptr_t)ASMGetCS(); /* SUPR0AbsKernelCS */
420 g_aFunctions[5].pfn = (void *)(uintptr_t)ASMGetSS(); /* SUPR0AbsKernelSS */
421 g_aFunctions[6].pfn = (void *)0; /* SUPR0AbsKernelDS */
422 g_aFunctions[7].pfn = (void *)0; /* SUPR0AbsKernelES */
423 g_aFunctions[8].pfn = (void *)0; /* SUPR0AbsKernelFS */
424 g_aFunctions[9].pfn = (void *)0; /* SUPR0AbsKernelGS */
425
426# endif
427#else /* !RT_OS_DARWIN */
428# if ARCH_BITS == 64
429 g_aFunctions[0].pfn = (void *)1; /* SUPR0AbsIs64bit */
430 g_aFunctions[1].pfn = (void *)(uintptr_t)ASMGetCS(); /* SUPR0Abs64bitKernelCS */
431 g_aFunctions[2].pfn = (void *)(uintptr_t)ASMGetSS(); /* SUPR0Abs64bitKernelSS */
432 g_aFunctions[3].pfn = (void *)(uintptr_t)ASMGetDS(); /* SUPR0Abs64bitKernelDS */
433# else
434 g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[4].pfn = (void *)0;
435# endif
436 g_aFunctions[4].pfn = (void *)(uintptr_t)ASMGetCS(); /* SUPR0AbsKernelCS */
437 g_aFunctions[5].pfn = (void *)(uintptr_t)ASMGetSS(); /* SUPR0AbsKernelSS */
438 g_aFunctions[6].pfn = (void *)(uintptr_t)ASMGetDS(); /* SUPR0AbsKernelDS */
439 g_aFunctions[7].pfn = (void *)(uintptr_t)ASMGetES(); /* SUPR0AbsKernelES */
440 g_aFunctions[8].pfn = (void *)(uintptr_t)ASMGetFS(); /* SUPR0AbsKernelFS */
441 g_aFunctions[9].pfn = (void *)(uintptr_t)ASMGetGS(); /* SUPR0AbsKernelGS */
442#endif /* !RT_OS_DARWIN */
443 return VINF_SUCCESS;
444 }
445
446#ifdef SUPDRV_USE_MUTEX_FOR_GIP
447 RTSemMutexDestroy(pDevExt->mtxGip);
448 pDevExt->mtxGip = NIL_RTSEMMUTEX;
449#else
450 RTSemFastMutexDestroy(pDevExt->mtxGip);
451 pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
452#endif
453 }
454 RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
455 pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
456 }
457#ifdef SUPDRV_USE_MUTEX_FOR_LDR
458 RTSemMutexDestroy(pDevExt->mtxLdr);
459 pDevExt->mtxLdr = NIL_RTSEMMUTEX;
460#else
461 RTSemFastMutexDestroy(pDevExt->mtxLdr);
462 pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
463#endif
464 }
465 RTSpinlockDestroy(pDevExt->Spinlock);
466 pDevExt->Spinlock = NIL_RTSPINLOCK;
467 }
468#ifdef SUPDRV_WITH_RELEASE_LOGGER
469 RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
470 RTLogDestroy(RTLogSetDefaultInstance(NULL));
471#endif
472
473 return rc;
474}
475
476
477/**
478 * Delete the device extension (e.g. cleanup members).
479 *
480 * @param pDevExt The device extension to delete.
481 */
482void VBOXCALL supdrvDeleteDevExt(PSUPDRVDEVEXT pDevExt)
483{
484 PSUPDRVOBJ pObj;
485 PSUPDRVUSAGE pUsage;
486
487 /*
488 * Kill mutexes and spinlocks.
489 */
490#ifdef SUPDRV_USE_MUTEX_FOR_GIP
491 RTSemMutexDestroy(pDevExt->mtxGip);
492 pDevExt->mtxGip = NIL_RTSEMMUTEX;
493#else
494 RTSemFastMutexDestroy(pDevExt->mtxGip);
495 pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
496#endif
497#ifdef SUPDRV_USE_MUTEX_FOR_LDR
498 RTSemMutexDestroy(pDevExt->mtxLdr);
499 pDevExt->mtxLdr = NIL_RTSEMMUTEX;
500#else
501 RTSemFastMutexDestroy(pDevExt->mtxLdr);
502 pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
503#endif
504 RTSpinlockDestroy(pDevExt->Spinlock);
505 pDevExt->Spinlock = NIL_RTSPINLOCK;
506 RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
507 pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
508
509 /*
510 * Free lists.
511 */
512 /* objects. */
513 pObj = pDevExt->pObjs;
514 Assert(!pObj); /* (can trigger on forced unloads) */
515 pDevExt->pObjs = NULL;
516 while (pObj)
517 {
518 void *pvFree = pObj;
519 pObj = pObj->pNext;
520 RTMemFree(pvFree);
521 }
522
523 /* usage records. */
524 pUsage = pDevExt->pUsageFree;
525 pDevExt->pUsageFree = NULL;
526 while (pUsage)
527 {
528 void *pvFree = pUsage;
529 pUsage = pUsage->pNext;
530 RTMemFree(pvFree);
531 }
532
533 /* kill the GIP. */
534 supdrvGipDestroy(pDevExt);
535
536#ifdef SUPDRV_WITH_RELEASE_LOGGER
537 /* destroy the loggers. */
538 RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
539 RTLogDestroy(RTLogSetDefaultInstance(NULL));
540#endif
541}
542
543
544/**
545 * Create session.
546 *
547 * @returns IPRT status code.
548 * @param pDevExt Device extension.
549 * @param fUser Flag indicating whether this is a user or kernel session.
550 * @param ppSession Where to store the pointer to the session data.
551 */
552int VBOXCALL supdrvCreateSession(PSUPDRVDEVEXT pDevExt, bool fUser, PSUPDRVSESSION *ppSession)
553{
554 /*
555 * Allocate memory for the session data.
556 */
557 int rc;
558 PSUPDRVSESSION pSession = *ppSession = (PSUPDRVSESSION)RTMemAllocZ(pDevExt->cbSession);
559 if (pSession)
560 {
561 /* Initialize session data. */
562 rc = RTSpinlockCreate(&pSession->Spinlock);
563 if (!rc)
564 {
565 rc = RTHandleTableCreateEx(&pSession->hHandleTable,
566 RTHANDLETABLE_FLAGS_LOCKED | RTHANDLETABLE_FLAGS_CONTEXT,
567 1 /*uBase*/, 32768 /*cMax*/, supdrvSessionObjHandleRetain, pSession);
568 if (RT_SUCCESS(rc))
569 {
570 Assert(pSession->Spinlock != NIL_RTSPINLOCK);
571 pSession->pDevExt = pDevExt;
572 pSession->u32Cookie = BIRD_INV;
573 /*pSession->pLdrUsage = NULL;
574 pSession->pVM = NULL;
575 pSession->pUsage = NULL;
576 pSession->pGip = NULL;
577 pSession->fGipReferenced = false;
578 pSession->Bundle.cUsed = 0; */
579 pSession->Uid = NIL_RTUID;
580 pSession->Gid = NIL_RTGID;
581 if (fUser)
582 {
583 pSession->Process = RTProcSelf();
584 pSession->R0Process = RTR0ProcHandleSelf();
585 }
586 else
587 {
588 pSession->Process = NIL_RTPROCESS;
589 pSession->R0Process = NIL_RTR0PROCESS;
590 }
591
592 LogFlow(("Created session %p initial cookie=%#x\n", pSession, pSession->u32Cookie));
593 return VINF_SUCCESS;
594 }
595
596 RTSpinlockDestroy(pSession->Spinlock);
597 }
598 RTMemFree(pSession);
599 *ppSession = NULL;
600 Log(("Failed to create spinlock, rc=%d!\n", rc));
601 }
602 else
603 rc = VERR_NO_MEMORY;
604
605 return rc;
606}
607
608
609/**
610 * Shared code for cleaning up a session.
611 *
612 * @param pDevExt Device extension.
613 * @param pSession Session data.
614 * This data will be freed by this routine.
615 */
616void VBOXCALL supdrvCloseSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
617{
618 /*
619 * Cleanup the session first.
620 */
621 supdrvCleanupSession(pDevExt, pSession);
622
623 /*
624 * Free the rest of the session stuff.
625 */
626 RTSpinlockDestroy(pSession->Spinlock);
627 pSession->Spinlock = NIL_RTSPINLOCK;
628 pSession->pDevExt = NULL;
629 RTMemFree(pSession);
630 LogFlow(("supdrvCloseSession: returns\n"));
631}
632
633
634/**
635 * Shared code for cleaning up a session (but not quite freeing it).
636 *
637 * This is primarily intended for MAC OS X where we have to clean up the memory
638 * stuff before the file handle is closed.
639 *
640 * @param pDevExt Device extension.
641 * @param pSession Session data.
642 * This data will be freed by this routine.
643 */
644void VBOXCALL supdrvCleanupSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
645{
646 int rc;
647 PSUPDRVBUNDLE pBundle;
648 LogFlow(("supdrvCleanupSession: pSession=%p\n", pSession));
649
650 /*
651 * Remove logger instances related to this session.
652 */
653 RTLogSetDefaultInstanceThread(NULL, (uintptr_t)pSession);
654
655 /*
656 * Destroy the handle table.
657 */
658 rc = RTHandleTableDestroy(pSession->hHandleTable, supdrvSessionObjHandleDelete, pSession);
659 AssertRC(rc);
660 pSession->hHandleTable = NIL_RTHANDLETABLE;
661
662 /*
663 * Release object references made in this session.
664 * In theory there should be noone racing us in this session.
665 */
666 Log2(("release objects - start\n"));
667 if (pSession->pUsage)
668 {
669 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
670 PSUPDRVUSAGE pUsage;
671 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
672
673 while ((pUsage = pSession->pUsage) != NULL)
674 {
675 PSUPDRVOBJ pObj = pUsage->pObj;
676 pSession->pUsage = pUsage->pNext;
677
678 AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
679 if (pUsage->cUsage < pObj->cUsage)
680 {
681 pObj->cUsage -= pUsage->cUsage;
682 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
683 }
684 else
685 {
686 /* Destroy the object and free the record. */
687 if (pDevExt->pObjs == pObj)
688 pDevExt->pObjs = pObj->pNext;
689 else
690 {
691 PSUPDRVOBJ pObjPrev;
692 for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
693 if (pObjPrev->pNext == pObj)
694 {
695 pObjPrev->pNext = pObj->pNext;
696 break;
697 }
698 Assert(pObjPrev);
699 }
700 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
701
702 Log(("supdrvCleanupSession: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
703 pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
704 if (pObj->pfnDestructor)
705 pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
706 RTMemFree(pObj);
707 }
708
709 /* free it and continue. */
710 RTMemFree(pUsage);
711
712 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
713 }
714
715 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
716 AssertMsg(!pSession->pUsage, ("Some buster reregistered an object during desturction!\n"));
717 }
718 Log2(("release objects - done\n"));
719
720 /*
721 * Release memory allocated in the session.
722 *
723 * We do not serialize this as we assume that the application will
724 * not allocated memory while closing the file handle object.
725 */
726 Log2(("freeing memory:\n"));
727 pBundle = &pSession->Bundle;
728 while (pBundle)
729 {
730 PSUPDRVBUNDLE pToFree;
731 unsigned i;
732
733 /*
734 * Check and unlock all entries in the bundle.
735 */
736 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
737 {
738 if (pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ)
739 {
740 Log2(("eType=%d pvR0=%p pvR3=%p cb=%ld\n", pBundle->aMem[i].eType, RTR0MemObjAddress(pBundle->aMem[i].MemObj),
741 (void *)RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3), (long)RTR0MemObjSize(pBundle->aMem[i].MemObj)));
742 if (pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ)
743 {
744 rc = RTR0MemObjFree(pBundle->aMem[i].MapObjR3, false);
745 AssertRC(rc); /** @todo figure out how to handle this. */
746 pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
747 }
748 rc = RTR0MemObjFree(pBundle->aMem[i].MemObj, true /* fFreeMappings */);
749 AssertRC(rc); /** @todo figure out how to handle this. */
750 pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
751 pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
752 }
753 }
754
755 /*
756 * Advance and free previous bundle.
757 */
758 pToFree = pBundle;
759 pBundle = pBundle->pNext;
760
761 pToFree->pNext = NULL;
762 pToFree->cUsed = 0;
763 if (pToFree != &pSession->Bundle)
764 RTMemFree(pToFree);
765 }
766 Log2(("freeing memory - done\n"));
767
768 /*
769 * Deregister component factories.
770 */
771 RTSemFastMutexRequest(pDevExt->mtxComponentFactory);
772 Log2(("deregistering component factories:\n"));
773 if (pDevExt->pComponentFactoryHead)
774 {
775 PSUPDRVFACTORYREG pPrev = NULL;
776 PSUPDRVFACTORYREG pCur = pDevExt->pComponentFactoryHead;
777 while (pCur)
778 {
779 if (pCur->pSession == pSession)
780 {
781 /* unlink it */
782 PSUPDRVFACTORYREG pNext = pCur->pNext;
783 if (pPrev)
784 pPrev->pNext = pNext;
785 else
786 pDevExt->pComponentFactoryHead = pNext;
787
788 /* free it */
789 pCur->pNext = NULL;
790 pCur->pSession = NULL;
791 pCur->pFactory = NULL;
792 RTMemFree(pCur);
793
794 /* next */
795 pCur = pNext;
796 }
797 else
798 {
799 /* next */
800 pPrev = pCur;
801 pCur = pCur->pNext;
802 }
803 }
804 }
805 RTSemFastMutexRelease(pDevExt->mtxComponentFactory);
806 Log2(("deregistering component factories - done\n"));
807
808 /*
809 * Loaded images needs to be dereferenced and possibly freed up.
810 */
811 supdrvLdrLock(pDevExt);
812 Log2(("freeing images:\n"));
813 if (pSession->pLdrUsage)
814 {
815 PSUPDRVLDRUSAGE pUsage = pSession->pLdrUsage;
816 pSession->pLdrUsage = NULL;
817 while (pUsage)
818 {
819 void *pvFree = pUsage;
820 PSUPDRVLDRIMAGE pImage = pUsage->pImage;
821 if (pImage->cUsage > pUsage->cUsage)
822 pImage->cUsage -= pUsage->cUsage;
823 else
824 supdrvLdrFree(pDevExt, pImage);
825 pUsage->pImage = NULL;
826 pUsage = pUsage->pNext;
827 RTMemFree(pvFree);
828 }
829 }
830 supdrvLdrUnlock(pDevExt);
831 Log2(("freeing images - done\n"));
832
833 /*
834 * Unmap the GIP.
835 */
836 Log2(("umapping GIP:\n"));
837 if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
838 {
839 SUPR0GipUnmap(pSession);
840 pSession->fGipReferenced = 0;
841 }
842 Log2(("umapping GIP - done\n"));
843}
844
845
846/**
847 * RTHandleTableDestroy callback used by supdrvCleanupSession.
848 *
849 * @returns IPRT status code, see SUPR0ObjAddRef.
850 * @param hHandleTable The handle table handle. Ignored.
851 * @param pvObj The object pointer.
852 * @param pvCtx Context, the handle type. Ignored.
853 * @param pvUser Session pointer.
854 */
855static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void *pvObj, void *pvCtx, void *pvUser)
856{
857 NOREF(pvCtx);
858 NOREF(hHandleTable);
859 return SUPR0ObjAddRefEx(pvObj, (PSUPDRVSESSION)pvUser, true /*fNoBlocking*/);
860}
861
862
863/**
864 * RTHandleTableDestroy callback used by supdrvCleanupSession.
865 *
866 * @param hHandleTable The handle table handle. Ignored.
867 * @param h The handle value. Ignored.
868 * @param pvObj The object pointer.
869 * @param pvCtx Context, the handle type. Ignored.
870 * @param pvUser Session pointer.
871 */
872static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void *pvObj, void *pvCtx, void *pvUser)
873{
874 NOREF(pvCtx);
875 NOREF(h);
876 NOREF(hHandleTable);
877 SUPR0ObjRelease(pvObj, (PSUPDRVSESSION)pvUser);
878}
879
880
881/**
882 * Fast path I/O Control worker.
883 *
884 * @returns VBox status code that should be passed down to ring-3 unchanged.
885 * @param uIOCtl Function number.
886 * @param idCpu VMCPU id.
887 * @param pDevExt Device extention.
888 * @param pSession Session data.
889 */
890int VBOXCALL supdrvIOCtlFast(uintptr_t uIOCtl, VMCPUID idCpu, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
891{
892 /*
893 * We check the two prereqs after doing this only to allow the compiler to optimize things better.
894 */
895 if (RT_LIKELY(pSession->pVM && pDevExt->pfnVMMR0EntryFast))
896 {
897 switch (uIOCtl)
898 {
899 case SUP_IOCTL_FAST_DO_RAW_RUN:
900 pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_RAW_RUN);
901 break;
902 case SUP_IOCTL_FAST_DO_HWACC_RUN:
903 pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_HWACC_RUN);
904 break;
905 case SUP_IOCTL_FAST_DO_NOP:
906 pDevExt->pfnVMMR0EntryFast(pSession->pVM, idCpu, SUP_VMMR0_DO_NOP);
907 break;
908 default:
909 return VERR_INTERNAL_ERROR;
910 }
911 return VINF_SUCCESS;
912 }
913 return VERR_INTERNAL_ERROR;
914}
915
916
917/**
918 * Helper for supdrvIOCtl. Check if pszStr contains any character of pszChars.
919 * We would use strpbrk here if this function would be contained in the RedHat kABI white
920 * list, see http://www.kerneldrivers.org/RHEL5.
921 *
922 * @returns 1 if pszStr does contain any character of pszChars, 0 otherwise.
923 * @param pszStr String to check
924 * @param pszChars Character set
925 */
926static int supdrvCheckInvalidChar(const char *pszStr, const char *pszChars)
927{
928 int chCur;
929 while ((chCur = *pszStr++) != '\0')
930 {
931 int ch;
932 const char *psz = pszChars;
933 while ((ch = *psz++) != '\0')
934 if (ch == chCur)
935 return 1;
936
937 }
938 return 0;
939}
940
941
942/**
943 * I/O Control worker.
944 *
945 * @returns IPRT status code.
946 * @retval VERR_INVALID_PARAMETER if the request is invalid.
947 *
948 * @param uIOCtl Function number.
949 * @param pDevExt Device extention.
950 * @param pSession Session data.
951 * @param pReqHdr The request header.
952 */
953int VBOXCALL supdrvIOCtl(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPREQHDR pReqHdr)
954{
955 /*
956 * Validate the request.
957 */
958 /* this first check could probably be omitted as its also done by the OS specific code... */
959 if (RT_UNLIKELY( (pReqHdr->fFlags & SUPREQHDR_FLAGS_MAGIC_MASK) != SUPREQHDR_FLAGS_MAGIC
960 || pReqHdr->cbIn < sizeof(*pReqHdr)
961 || pReqHdr->cbOut < sizeof(*pReqHdr)))
962 {
963 OSDBGPRINT(("vboxdrv: Bad ioctl request header; cbIn=%#lx cbOut=%#lx fFlags=%#lx\n",
964 (long)pReqHdr->cbIn, (long)pReqHdr->cbOut, (long)pReqHdr->fFlags));
965 return VERR_INVALID_PARAMETER;
966 }
967 if (RT_UNLIKELY(uIOCtl == SUP_IOCTL_COOKIE))
968 {
969 if (pReqHdr->u32Cookie != SUPCOOKIE_INITIAL_COOKIE)
970 {
971 OSDBGPRINT(("SUP_IOCTL_COOKIE: bad cookie %#lx\n", (long)pReqHdr->u32Cookie));
972 return VERR_INVALID_PARAMETER;
973 }
974 }
975 else if (RT_UNLIKELY( pReqHdr->u32Cookie != pDevExt->u32Cookie
976 || pReqHdr->u32SessionCookie != pSession->u32Cookie))
977 {
978 OSDBGPRINT(("vboxdrv: bad cookie %#lx / %#lx.\n", (long)pReqHdr->u32Cookie, (long)pReqHdr->u32SessionCookie));
979 return VERR_INVALID_PARAMETER;
980 }
981
982/*
983 * Validation macros
984 */
985#define REQ_CHECK_SIZES_EX(Name, cbInExpect, cbOutExpect) \
986 do { \
987 if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect) || pReqHdr->cbOut != (cbOutExpect))) \
988 { \
989 OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld. cbOut=%ld expected %ld.\n", \
990 (long)pReq->Hdr.cbIn, (long)(cbInExpect), (long)pReq->Hdr.cbOut, (long)(cbOutExpect))); \
991 return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
992 } \
993 } while (0)
994
995#define REQ_CHECK_SIZES(Name) REQ_CHECK_SIZES_EX(Name, Name ## _SIZE_IN, Name ## _SIZE_OUT)
996
997#define REQ_CHECK_SIZE_IN(Name, cbInExpect) \
998 do { \
999 if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect))) \
1000 { \
1001 OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld.\n", \
1002 (long)pReq->Hdr.cbIn, (long)(cbInExpect))); \
1003 return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1004 } \
1005 } while (0)
1006
1007#define REQ_CHECK_SIZE_OUT(Name, cbOutExpect) \
1008 do { \
1009 if (RT_UNLIKELY(pReqHdr->cbOut != (cbOutExpect))) \
1010 { \
1011 OSDBGPRINT(( #Name ": Invalid input/output sizes. cbOut=%ld expected %ld.\n", \
1012 (long)pReq->Hdr.cbOut, (long)(cbOutExpect))); \
1013 return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1014 } \
1015 } while (0)
1016
1017#define REQ_CHECK_EXPR(Name, expr) \
1018 do { \
1019 if (RT_UNLIKELY(!(expr))) \
1020 { \
1021 OSDBGPRINT(( #Name ": %s\n", #expr)); \
1022 return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1023 } \
1024 } while (0)
1025
1026#define REQ_CHECK_EXPR_FMT(expr, fmt) \
1027 do { \
1028 if (RT_UNLIKELY(!(expr))) \
1029 { \
1030 OSDBGPRINT( fmt ); \
1031 return pReq->Hdr.rc = VERR_INVALID_PARAMETER; \
1032 } \
1033 } while (0)
1034
1035
1036 /*
1037 * The switch.
1038 */
1039 switch (SUP_CTL_CODE_NO_SIZE(uIOCtl))
1040 {
1041 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_COOKIE):
1042 {
1043 PSUPCOOKIE pReq = (PSUPCOOKIE)pReqHdr;
1044 REQ_CHECK_SIZES(SUP_IOCTL_COOKIE);
1045 if (strncmp(pReq->u.In.szMagic, SUPCOOKIE_MAGIC, sizeof(pReq->u.In.szMagic)))
1046 {
1047 OSDBGPRINT(("SUP_IOCTL_COOKIE: invalid magic %.16s\n", pReq->u.In.szMagic));
1048 pReq->Hdr.rc = VERR_INVALID_MAGIC;
1049 return 0;
1050 }
1051
1052#if 0
1053 /*
1054 * Call out to the OS specific code and let it do permission checks on the
1055 * client process.
1056 */
1057 if (!supdrvOSValidateClientProcess(pDevExt, pSession))
1058 {
1059 pReq->u.Out.u32Cookie = 0xffffffff;
1060 pReq->u.Out.u32SessionCookie = 0xffffffff;
1061 pReq->u.Out.u32SessionVersion = 0xffffffff;
1062 pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1063 pReq->u.Out.pSession = NULL;
1064 pReq->u.Out.cFunctions = 0;
1065 pReq->Hdr.rc = VERR_PERMISSION_DENIED;
1066 return 0;
1067 }
1068#endif
1069
1070 /*
1071 * Match the version.
1072 * The current logic is very simple, match the major interface version.
1073 */
1074 if ( pReq->u.In.u32MinVersion > SUPDRV_IOC_VERSION
1075 || (pReq->u.In.u32MinVersion & 0xffff0000) != (SUPDRV_IOC_VERSION & 0xffff0000))
1076 {
1077 OSDBGPRINT(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
1078 pReq->u.In.u32ReqVersion, pReq->u.In.u32MinVersion, SUPDRV_IOC_VERSION));
1079 pReq->u.Out.u32Cookie = 0xffffffff;
1080 pReq->u.Out.u32SessionCookie = 0xffffffff;
1081 pReq->u.Out.u32SessionVersion = 0xffffffff;
1082 pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1083 pReq->u.Out.pSession = NULL;
1084 pReq->u.Out.cFunctions = 0;
1085 pReq->Hdr.rc = VERR_VERSION_MISMATCH;
1086 return 0;
1087 }
1088
1089 /*
1090 * Fill in return data and be gone.
1091 * N.B. The first one to change SUPDRV_IOC_VERSION shall makes sure that
1092 * u32SessionVersion <= u32ReqVersion!
1093 */
1094 /** @todo Somehow validate the client and negotiate a secure cookie... */
1095 pReq->u.Out.u32Cookie = pDevExt->u32Cookie;
1096 pReq->u.Out.u32SessionCookie = pSession->u32Cookie;
1097 pReq->u.Out.u32SessionVersion = SUPDRV_IOC_VERSION;
1098 pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1099 pReq->u.Out.pSession = pSession;
1100 pReq->u.Out.cFunctions = sizeof(g_aFunctions) / sizeof(g_aFunctions[0]);
1101 pReq->Hdr.rc = VINF_SUCCESS;
1102 return 0;
1103 }
1104
1105 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_QUERY_FUNCS(0)):
1106 {
1107 /* validate */
1108 PSUPQUERYFUNCS pReq = (PSUPQUERYFUNCS)pReqHdr;
1109 REQ_CHECK_SIZES_EX(SUP_IOCTL_QUERY_FUNCS, SUP_IOCTL_QUERY_FUNCS_SIZE_IN, SUP_IOCTL_QUERY_FUNCS_SIZE_OUT(RT_ELEMENTS(g_aFunctions)));
1110
1111 /* execute */
1112 pReq->u.Out.cFunctions = RT_ELEMENTS(g_aFunctions);
1113 memcpy(&pReq->u.Out.aFunctions[0], g_aFunctions, sizeof(g_aFunctions));
1114 pReq->Hdr.rc = VINF_SUCCESS;
1115 return 0;
1116 }
1117
1118 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_LOCK):
1119 {
1120 /* validate */
1121 PSUPPAGELOCK pReq = (PSUPPAGELOCK)pReqHdr;
1122 REQ_CHECK_SIZE_IN(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_IN);
1123 REQ_CHECK_SIZE_OUT(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_OUT(pReq->u.In.cPages));
1124 REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.cPages > 0);
1125 REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.pvR3 >= PAGE_SIZE);
1126
1127 /* execute */
1128 pReq->Hdr.rc = SUPR0LockMem(pSession, pReq->u.In.pvR3, pReq->u.In.cPages, &pReq->u.Out.aPages[0]);
1129 if (RT_FAILURE(pReq->Hdr.rc))
1130 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1131 return 0;
1132 }
1133
1134 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_UNLOCK):
1135 {
1136 /* validate */
1137 PSUPPAGEUNLOCK pReq = (PSUPPAGEUNLOCK)pReqHdr;
1138 REQ_CHECK_SIZES(SUP_IOCTL_PAGE_UNLOCK);
1139
1140 /* execute */
1141 pReq->Hdr.rc = SUPR0UnlockMem(pSession, pReq->u.In.pvR3);
1142 return 0;
1143 }
1144
1145 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_ALLOC):
1146 {
1147 /* validate */
1148 PSUPCONTALLOC pReq = (PSUPCONTALLOC)pReqHdr;
1149 REQ_CHECK_SIZES(SUP_IOCTL_CONT_ALLOC);
1150
1151 /* execute */
1152 pReq->Hdr.rc = SUPR0ContAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.HCPhys);
1153 if (RT_FAILURE(pReq->Hdr.rc))
1154 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1155 return 0;
1156 }
1157
1158 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_FREE):
1159 {
1160 /* validate */
1161 PSUPCONTFREE pReq = (PSUPCONTFREE)pReqHdr;
1162 REQ_CHECK_SIZES(SUP_IOCTL_CONT_FREE);
1163
1164 /* execute */
1165 pReq->Hdr.rc = SUPR0ContFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1166 return 0;
1167 }
1168
1169 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_OPEN):
1170 {
1171 /* validate */
1172 PSUPLDROPEN pReq = (PSUPLDROPEN)pReqHdr;
1173 REQ_CHECK_SIZES(SUP_IOCTL_LDR_OPEN);
1174 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageWithTabs > 0);
1175 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageWithTabs < 16*_1M);
1176 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits > 0);
1177 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits > 0);
1178 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits < pReq->u.In.cbImageWithTabs);
1179 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.szName[0]);
1180 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, memchr(pReq->u.In.szName, '\0', sizeof(pReq->u.In.szName)));
1181 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, !supdrvCheckInvalidChar(pReq->u.In.szName, ";:()[]{}/\\|&*%#@!~`\"'"));
1182 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, memchr(pReq->u.In.szFilename, '\0', sizeof(pReq->u.In.szFilename)));
1183
1184 /* execute */
1185 pReq->Hdr.rc = supdrvIOCtl_LdrOpen(pDevExt, pSession, pReq);
1186 return 0;
1187 }
1188
1189 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_LOAD):
1190 {
1191 /* validate */
1192 PSUPLDRLOAD pReq = (PSUPLDRLOAD)pReqHdr;
1193 REQ_CHECK_EXPR(Name, pReq->Hdr.cbIn >= sizeof(*pReq));
1194 REQ_CHECK_SIZES_EX(SUP_IOCTL_LDR_LOAD, SUP_IOCTL_LDR_LOAD_SIZE_IN(pReq->u.In.cbImageWithTabs), SUP_IOCTL_LDR_LOAD_SIZE_OUT);
1195 REQ_CHECK_EXPR(SUP_IOCTL_LDR_LOAD, pReq->u.In.cSymbols <= 16384);
1196 REQ_CHECK_EXPR_FMT( !pReq->u.In.cSymbols
1197 || ( pReq->u.In.offSymbols < pReq->u.In.cbImageWithTabs
1198 && pReq->u.In.offSymbols + pReq->u.In.cSymbols * sizeof(SUPLDRSYM) <= pReq->u.In.cbImageWithTabs),
1199 ("SUP_IOCTL_LDR_LOAD: offSymbols=%#lx cSymbols=%#lx cbImageWithTabs=%#lx\n", (long)pReq->u.In.offSymbols,
1200 (long)pReq->u.In.cSymbols, (long)pReq->u.In.cbImageWithTabs));
1201 REQ_CHECK_EXPR_FMT( !pReq->u.In.cbStrTab
1202 || ( pReq->u.In.offStrTab < pReq->u.In.cbImageWithTabs
1203 && pReq->u.In.offStrTab + pReq->u.In.cbStrTab <= pReq->u.In.cbImageWithTabs
1204 && pReq->u.In.cbStrTab <= pReq->u.In.cbImageWithTabs),
1205 ("SUP_IOCTL_LDR_LOAD: offStrTab=%#lx cbStrTab=%#lx cbImageWithTabs=%#lx\n", (long)pReq->u.In.offStrTab,
1206 (long)pReq->u.In.cbStrTab, (long)pReq->u.In.cbImageWithTabs));
1207
1208 if (pReq->u.In.cSymbols)
1209 {
1210 uint32_t i;
1211 PSUPLDRSYM paSyms = (PSUPLDRSYM)&pReq->u.In.abImage[pReq->u.In.offSymbols];
1212 for (i = 0; i < pReq->u.In.cSymbols; i++)
1213 {
1214 REQ_CHECK_EXPR_FMT(paSyms[i].offSymbol < pReq->u.In.cbImageWithTabs,
1215 ("SUP_IOCTL_LDR_LOAD: sym #%ld: symb off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offSymbol, (long)pReq->u.In.cbImageWithTabs));
1216 REQ_CHECK_EXPR_FMT(paSyms[i].offName < pReq->u.In.cbStrTab,
1217 ("SUP_IOCTL_LDR_LOAD: sym #%ld: name off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithTabs));
1218 REQ_CHECK_EXPR_FMT(memchr(&pReq->u.In.abImage[pReq->u.In.offStrTab + paSyms[i].offName], '\0', pReq->u.In.cbStrTab - paSyms[i].offName),
1219 ("SUP_IOCTL_LDR_LOAD: sym #%ld: unterminated name! (%#lx / %#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithTabs));
1220 }
1221 }
1222
1223 /* execute */
1224 pReq->Hdr.rc = supdrvIOCtl_LdrLoad(pDevExt, pSession, pReq);
1225 return 0;
1226 }
1227
1228 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_FREE):
1229 {
1230 /* validate */
1231 PSUPLDRFREE pReq = (PSUPLDRFREE)pReqHdr;
1232 REQ_CHECK_SIZES(SUP_IOCTL_LDR_FREE);
1233
1234 /* execute */
1235 pReq->Hdr.rc = supdrvIOCtl_LdrFree(pDevExt, pSession, pReq);
1236 return 0;
1237 }
1238
1239 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_GET_SYMBOL):
1240 {
1241 /* validate */
1242 PSUPLDRGETSYMBOL pReq = (PSUPLDRGETSYMBOL)pReqHdr;
1243 REQ_CHECK_SIZES(SUP_IOCTL_LDR_GET_SYMBOL);
1244 REQ_CHECK_EXPR(SUP_IOCTL_LDR_GET_SYMBOL, memchr(pReq->u.In.szSymbol, '\0', sizeof(pReq->u.In.szSymbol)));
1245
1246 /* execute */
1247 pReq->Hdr.rc = supdrvIOCtl_LdrGetSymbol(pDevExt, pSession, pReq);
1248 return 0;
1249 }
1250
1251 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_VMMR0(0)):
1252 {
1253 /* validate */
1254 PSUPCALLVMMR0 pReq = (PSUPCALLVMMR0)pReqHdr;
1255 Log4(("SUP_IOCTL_CALL_VMMR0: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1256 pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1257
1258 if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_VMMR0_SIZE(0))
1259 {
1260 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(0), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(0));
1261
1262 /* execute */
1263 if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1264 pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, NULL, pReq->u.In.u64Arg, pSession);
1265 else
1266 pReq->Hdr.rc = VERR_WRONG_ORDER;
1267 }
1268 else
1269 {
1270 PSUPVMMR0REQHDR pVMMReq = (PSUPVMMR0REQHDR)&pReq->abReqPkt[0];
1271 REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR)),
1272 ("SUP_IOCTL_CALL_VMMR0: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR))));
1273 REQ_CHECK_EXPR(SUP_IOCTL_CALL_VMMR0, pVMMReq->u32Magic == SUPVMMR0REQHDR_MAGIC);
1274 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(pVMMReq->cbReq), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(pVMMReq->cbReq));
1275
1276 /* execute */
1277 if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1278 pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pReq->u.In.pVMR0, pReq->u.In.idCpu, pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1279 else
1280 pReq->Hdr.rc = VERR_WRONG_ORDER;
1281 }
1282
1283 if ( RT_FAILURE(pReq->Hdr.rc)
1284 && pReq->Hdr.rc != VERR_INTERRUPTED
1285 && pReq->Hdr.rc != VERR_TIMEOUT)
1286 Log(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1287 pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1288 else
1289 Log4(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1290 pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1291 return 0;
1292 }
1293
1294 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GET_PAGING_MODE):
1295 {
1296 /* validate */
1297 PSUPGETPAGINGMODE pReq = (PSUPGETPAGINGMODE)pReqHdr;
1298 REQ_CHECK_SIZES(SUP_IOCTL_GET_PAGING_MODE);
1299
1300 /* execute */
1301 pReq->Hdr.rc = VINF_SUCCESS;
1302 pReq->u.Out.enmMode = SUPR0GetPagingMode();
1303 return 0;
1304 }
1305
1306 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_ALLOC):
1307 {
1308 /* validate */
1309 PSUPLOWALLOC pReq = (PSUPLOWALLOC)pReqHdr;
1310 REQ_CHECK_EXPR(SUP_IOCTL_LOW_ALLOC, pReq->Hdr.cbIn <= SUP_IOCTL_LOW_ALLOC_SIZE_IN);
1311 REQ_CHECK_SIZES_EX(SUP_IOCTL_LOW_ALLOC, SUP_IOCTL_LOW_ALLOC_SIZE_IN, SUP_IOCTL_LOW_ALLOC_SIZE_OUT(pReq->u.In.cPages));
1312
1313 /* execute */
1314 pReq->Hdr.rc = SUPR0LowAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.aPages[0]);
1315 if (RT_FAILURE(pReq->Hdr.rc))
1316 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1317 return 0;
1318 }
1319
1320 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_FREE):
1321 {
1322 /* validate */
1323 PSUPLOWFREE pReq = (PSUPLOWFREE)pReqHdr;
1324 REQ_CHECK_SIZES(SUP_IOCTL_LOW_FREE);
1325
1326 /* execute */
1327 pReq->Hdr.rc = SUPR0LowFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1328 return 0;
1329 }
1330
1331 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_MAP):
1332 {
1333 /* validate */
1334 PSUPGIPMAP pReq = (PSUPGIPMAP)pReqHdr;
1335 REQ_CHECK_SIZES(SUP_IOCTL_GIP_MAP);
1336
1337 /* execute */
1338 pReq->Hdr.rc = SUPR0GipMap(pSession, &pReq->u.Out.pGipR3, &pReq->u.Out.HCPhysGip);
1339 if (RT_SUCCESS(pReq->Hdr.rc))
1340 pReq->u.Out.pGipR0 = pDevExt->pGip;
1341 return 0;
1342 }
1343
1344 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_UNMAP):
1345 {
1346 /* validate */
1347 PSUPGIPUNMAP pReq = (PSUPGIPUNMAP)pReqHdr;
1348 REQ_CHECK_SIZES(SUP_IOCTL_GIP_UNMAP);
1349
1350 /* execute */
1351 pReq->Hdr.rc = SUPR0GipUnmap(pSession);
1352 return 0;
1353 }
1354
1355 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SET_VM_FOR_FAST):
1356 {
1357 /* validate */
1358 PSUPSETVMFORFAST pReq = (PSUPSETVMFORFAST)pReqHdr;
1359 REQ_CHECK_SIZES(SUP_IOCTL_SET_VM_FOR_FAST);
1360 REQ_CHECK_EXPR_FMT( !pReq->u.In.pVMR0
1361 || ( VALID_PTR(pReq->u.In.pVMR0)
1362 && !((uintptr_t)pReq->u.In.pVMR0 & (PAGE_SIZE - 1))),
1363 ("SUP_IOCTL_SET_VM_FOR_FAST: pVMR0=%p!\n", pReq->u.In.pVMR0));
1364 /* execute */
1365 pSession->pVM = pReq->u.In.pVMR0;
1366 pReq->Hdr.rc = VINF_SUCCESS;
1367 return 0;
1368 }
1369
1370 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_ALLOC_EX):
1371 {
1372 /* validate */
1373 PSUPPAGEALLOCEX pReq = (PSUPPAGEALLOCEX)pReqHdr;
1374 REQ_CHECK_EXPR(SUP_IOCTL_PAGE_ALLOC_EX, pReq->Hdr.cbIn <= SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN);
1375 REQ_CHECK_SIZES_EX(SUP_IOCTL_PAGE_ALLOC_EX, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_OUT(pReq->u.In.cPages));
1376 REQ_CHECK_EXPR_FMT(pReq->u.In.fKernelMapping || pReq->u.In.fUserMapping,
1377 ("SUP_IOCTL_PAGE_ALLOC_EX: No mapping requested!\n"));
1378 REQ_CHECK_EXPR_FMT(pReq->u.In.fUserMapping,
1379 ("SUP_IOCTL_PAGE_ALLOC_EX: Must have user mapping!\n"));
1380 REQ_CHECK_EXPR_FMT(!pReq->u.In.fReserved0 && !pReq->u.In.fReserved1,
1381 ("SUP_IOCTL_PAGE_ALLOC_EX: fReserved0=%d fReserved1=%d\n", pReq->u.In.fReserved0, pReq->u.In.fReserved1));
1382
1383 /* execute */
1384 pReq->Hdr.rc = SUPR0PageAllocEx(pSession, pReq->u.In.cPages, 0 /* fFlags */,
1385 pReq->u.In.fUserMapping ? &pReq->u.Out.pvR3 : NULL,
1386 pReq->u.In.fKernelMapping ? &pReq->u.Out.pvR0 : NULL,
1387 &pReq->u.Out.aPages[0]);
1388 if (RT_FAILURE(pReq->Hdr.rc))
1389 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1390 return 0;
1391 }
1392
1393 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_MAP_KERNEL):
1394 {
1395 /* validate */
1396 PSUPPAGEMAPKERNEL pReq = (PSUPPAGEMAPKERNEL)pReqHdr;
1397 REQ_CHECK_SIZES(SUP_IOCTL_PAGE_MAP_KERNEL);
1398 REQ_CHECK_EXPR_FMT(!pReq->u.In.fFlags, ("SUP_IOCTL_PAGE_MAP_KERNEL: fFlags=%#x! MBZ\n", pReq->u.In.fFlags));
1399 REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_MAP_KERNEL: offSub=%#x\n", pReq->u.In.offSub));
1400 REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
1401 ("SUP_IOCTL_PAGE_MAP_KERNEL: cbSub=%#x\n", pReq->u.In.cbSub));
1402
1403 /* execute */
1404 pReq->Hdr.rc = SUPR0PageMapKernel(pSession, pReq->u.In.pvR3, pReq->u.In.offSub, pReq->u.In.cbSub,
1405 pReq->u.In.fFlags, &pReq->u.Out.pvR0);
1406 if (RT_FAILURE(pReq->Hdr.rc))
1407 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1408 return 0;
1409 }
1410
1411 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_PROTECT):
1412 {
1413 /* validate */
1414 PSUPPAGEPROTECT pReq = (PSUPPAGEPROTECT)pReqHdr;
1415 REQ_CHECK_SIZES(SUP_IOCTL_PAGE_PROTECT);
1416 REQ_CHECK_EXPR_FMT(!(pReq->u.In.fProt & ~(RTMEM_PROT_READ | RTMEM_PROT_WRITE | RTMEM_PROT_EXEC | RTMEM_PROT_NONE)),
1417 ("SUP_IOCTL_PAGE_PROTECT: fProt=%#x!\n", pReq->u.In.fProt));
1418 REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_PROTECT: offSub=%#x\n", pReq->u.In.offSub));
1419 REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
1420 ("SUP_IOCTL_PAGE_PROTECT: cbSub=%#x\n", pReq->u.In.cbSub));
1421
1422 /* execute */
1423 pReq->Hdr.rc = SUPR0PageProtect(pSession, pReq->u.In.pvR3, pReq->u.In.pvR0, pReq->u.In.offSub, pReq->u.In.cbSub, pReq->u.In.fProt);
1424 return 0;
1425 }
1426
1427 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_FREE):
1428 {
1429 /* validate */
1430 PSUPPAGEFREE pReq = (PSUPPAGEFREE)pReqHdr;
1431 REQ_CHECK_SIZES(SUP_IOCTL_PAGE_FREE);
1432
1433 /* execute */
1434 pReq->Hdr.rc = SUPR0PageFree(pSession, pReq->u.In.pvR3);
1435 return 0;
1436 }
1437
1438 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_SERVICE(0)):
1439 {
1440 /* validate */
1441 PSUPCALLSERVICE pReq = (PSUPCALLSERVICE)pReqHdr;
1442 Log4(("SUP_IOCTL_CALL_SERVICE: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1443 pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1444
1445 if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
1446 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(0), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(0));
1447 else
1448 {
1449 PSUPR0SERVICEREQHDR pSrvReq = (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0];
1450 REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR)),
1451 ("SUP_IOCTL_CALL_SERVICE: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR))));
1452 REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, pSrvReq->u32Magic == SUPR0SERVICEREQHDR_MAGIC);
1453 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(pSrvReq->cbReq), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(pSrvReq->cbReq));
1454 }
1455 REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, memchr(pReq->u.In.szName, '\0', sizeof(pReq->u.In.szName)));
1456
1457 /* execute */
1458 pReq->Hdr.rc = supdrvIOCtl_CallServiceModule(pDevExt, pSession, pReq);
1459 return 0;
1460 }
1461
1462 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOGGER_SETTINGS(0)):
1463 {
1464 /* validate */
1465 PSUPLOGGERSETTINGS pReq = (PSUPLOGGERSETTINGS)pReqHdr;
1466 size_t cbStrTab;
1467 REQ_CHECK_SIZE_OUT(SUP_IOCTL_LOGGER_SETTINGS, SUP_IOCTL_LOGGER_SETTINGS_SIZE_OUT);
1468 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->Hdr.cbIn >= SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(1));
1469 cbStrTab = pReq->Hdr.cbIn - SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(0);
1470 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offGroups < cbStrTab);
1471 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offFlags < cbStrTab);
1472 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offDestination < cbStrTab);
1473 REQ_CHECK_EXPR_FMT(pReq->u.In.szStrings[cbStrTab - 1] == '\0',
1474 ("SUP_IOCTL_LOGGER_SETTINGS: cbIn=%#x cbStrTab=%#zx LastChar=%d\n",
1475 pReq->Hdr.cbIn, cbStrTab, pReq->u.In.szStrings[cbStrTab - 1]));
1476 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhich <= SUPLOGGERSETTINGS_WHICH_RELEASE);
1477 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhat <= SUPLOGGERSETTINGS_WHAT_DESTROY);
1478
1479 /* execute */
1480 pReq->Hdr.rc = supdrvIOCtl_LoggerSettings(pDevExt, pSession, pReq);
1481 return 0;
1482 }
1483
1484 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_CREATE):
1485 {
1486 /* validate */
1487 PSUPSEMCREATE pReq = (PSUPSEMCREATE)pReqHdr;
1488 REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_CREATE, SUP_IOCTL_SEM_CREATE_SIZE_IN, SUP_IOCTL_SEM_CREATE_SIZE_OUT);
1489
1490 /* execute */
1491 switch (pReq->u.In.uType)
1492 {
1493 case SUP_SEM_TYPE_EVENT:
1494 {
1495 SUPSEMEVENT hEvent;
1496 pReq->Hdr.rc = SUPSemEventCreate(pSession, &hEvent);
1497 pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEvent;
1498 break;
1499 }
1500
1501 case SUP_SEM_TYPE_EVENT_MULTI:
1502 {
1503 SUPSEMEVENTMULTI hEventMulti;
1504 pReq->Hdr.rc = SUPSemEventMultiCreate(pSession, &hEventMulti);
1505 pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEventMulti;
1506 break;
1507 }
1508
1509 default:
1510 pReq->Hdr.rc = VERR_INVALID_PARAMETER;
1511 break;
1512 }
1513 return 0;
1514 }
1515
1516 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_OP):
1517 {
1518 /* validate */
1519 PSUPSEMOP pReq = (PSUPSEMOP)pReqHdr;
1520 REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_OP, SUP_IOCTL_SEM_OP_SIZE_IN, SUP_IOCTL_SEM_OP_SIZE_OUT);
1521
1522 /* execute */
1523 switch (pReq->u.In.uType)
1524 {
1525 case SUP_SEM_TYPE_EVENT:
1526 {
1527 SUPSEMEVENT hEvent = (SUPSEMEVENT)(uintptr_t)pReq->u.In.hSem;
1528 switch (pReq->u.In.uOp)
1529 {
1530 case SUPSEMOP_WAIT:
1531 pReq->Hdr.rc = SUPSemEventWaitNoResume(pSession, hEvent, pReq->u.In.cMillies);
1532 break;
1533 case SUPSEMOP_SIGNAL:
1534 pReq->Hdr.rc = SUPSemEventSignal(pSession, hEvent);
1535 break;
1536 case SUPSEMOP_CLOSE:
1537 pReq->Hdr.rc = SUPSemEventClose(pSession, hEvent);
1538 break;
1539 case SUPSEMOP_RESET:
1540 default:
1541 pReq->Hdr.rc = VERR_INVALID_FUNCTION;
1542 break;
1543 }
1544 break;
1545 }
1546
1547 case SUP_SEM_TYPE_EVENT_MULTI:
1548 {
1549 SUPSEMEVENTMULTI hEventMulti = (SUPSEMEVENTMULTI)(uintptr_t)pReq->u.In.hSem;
1550 switch (pReq->u.In.uOp)
1551 {
1552 case SUPSEMOP_WAIT:
1553 pReq->Hdr.rc = SUPSemEventMultiWaitNoResume(pSession, hEventMulti, pReq->u.In.cMillies);
1554 break;
1555 case SUPSEMOP_SIGNAL:
1556 pReq->Hdr.rc = SUPSemEventMultiSignal(pSession, hEventMulti);
1557 break;
1558 case SUPSEMOP_CLOSE:
1559 pReq->Hdr.rc = SUPSemEventMultiClose(pSession, hEventMulti);
1560 break;
1561 case SUPSEMOP_RESET:
1562 pReq->Hdr.rc = SUPSemEventMultiReset(pSession, hEventMulti);
1563 break;
1564 default:
1565 pReq->Hdr.rc = VERR_INVALID_FUNCTION;
1566 break;
1567 }
1568 break;
1569 }
1570
1571 default:
1572 pReq->Hdr.rc = VERR_INVALID_PARAMETER;
1573 break;
1574 }
1575 return 0;
1576 }
1577
1578 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_VT_CAPS):
1579 {
1580 /* validate */
1581 PSUPVTCAPS pReq = (PSUPVTCAPS)pReqHdr;
1582 REQ_CHECK_SIZES(SUP_IOCTL_VT_CAPS);
1583 REQ_CHECK_EXPR(SUP_IOCTL_VT_CAPS, pReq->Hdr.cbIn <= SUP_IOCTL_VT_CAPS_SIZE_IN);
1584
1585 /* execute */
1586 pReq->Hdr.rc = SUPR0QueryVTCaps(pSession, &pReq->u.Out.Caps);
1587 if (RT_FAILURE(pReq->Hdr.rc))
1588 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1589 return 0;
1590 }
1591
1592 default:
1593 Log(("Unknown IOCTL %#lx\n", (long)uIOCtl));
1594 break;
1595 }
1596 return VERR_GENERAL_FAILURE;
1597}
1598
1599
1600/**
1601 * Inter-Driver Communcation (IDC) worker.
1602 *
1603 * @returns VBox status code.
1604 * @retval VINF_SUCCESS on success.
1605 * @retval VERR_INVALID_PARAMETER if the request is invalid.
1606 * @retval VERR_NOT_SUPPORTED if the request isn't supported.
1607 *
1608 * @param uReq The request (function) code.
1609 * @param pDevExt Device extention.
1610 * @param pSession Session data.
1611 * @param pReqHdr The request header.
1612 */
1613int VBOXCALL supdrvIDC(uintptr_t uReq, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQHDR pReqHdr)
1614{
1615 /*
1616 * The OS specific code has already validated the pSession
1617 * pointer, and the request size being greater or equal to
1618 * size of the header.
1619 *
1620 * So, just check that pSession is a kernel context session.
1621 */
1622 if (RT_UNLIKELY( pSession
1623 && pSession->R0Process != NIL_RTR0PROCESS))
1624 return VERR_INVALID_PARAMETER;
1625
1626/*
1627 * Validation macro.
1628 */
1629#define REQ_CHECK_IDC_SIZE(Name, cbExpect) \
1630 do { \
1631 if (RT_UNLIKELY(pReqHdr->cb != (cbExpect))) \
1632 { \
1633 OSDBGPRINT(( #Name ": Invalid input/output sizes. cb=%ld expected %ld.\n", \
1634 (long)pReqHdr->cb, (long)(cbExpect))); \
1635 return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1636 } \
1637 } while (0)
1638
1639 switch (uReq)
1640 {
1641 case SUPDRV_IDC_REQ_CONNECT:
1642 {
1643 PSUPDRVIDCREQCONNECT pReq = (PSUPDRVIDCREQCONNECT)pReqHdr;
1644 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_CONNECT, sizeof(*pReq));
1645
1646 /*
1647 * Validate the cookie and other input.
1648 */
1649 if (pReq->Hdr.pSession != NULL)
1650 {
1651 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: pSession=%p expected NULL!\n", pReq->Hdr.pSession));
1652 return pReqHdr->rc = VERR_INVALID_PARAMETER;
1653 }
1654 if (pReq->u.In.u32MagicCookie != SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE)
1655 {
1656 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: u32MagicCookie=%#x expected %#x!\n",
1657 (unsigned)pReq->u.In.u32MagicCookie, (unsigned)SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE));
1658 return pReqHdr->rc = VERR_INVALID_PARAMETER;
1659 }
1660 if ( pReq->u.In.uMinVersion > pReq->u.In.uReqVersion
1661 || (pReq->u.In.uMinVersion & UINT32_C(0xffff0000)) != (pReq->u.In.uReqVersion & UINT32_C(0xffff0000)))
1662 {
1663 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: uMinVersion=%#x uMaxVersion=%#x doesn't match!\n",
1664 pReq->u.In.uMinVersion, pReq->u.In.uReqVersion));
1665 return pReqHdr->rc = VERR_INVALID_PARAMETER;
1666 }
1667
1668 /*
1669 * Match the version.
1670 * The current logic is very simple, match the major interface version.
1671 */
1672 if ( pReq->u.In.uMinVersion > SUPDRV_IDC_VERSION
1673 || (pReq->u.In.uMinVersion & 0xffff0000) != (SUPDRV_IDC_VERSION & 0xffff0000))
1674 {
1675 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
1676 pReq->u.In.uReqVersion, pReq->u.In.uMinVersion, (unsigned)SUPDRV_IDC_VERSION));
1677 pReq->u.Out.pSession = NULL;
1678 pReq->u.Out.uSessionVersion = 0xffffffff;
1679 pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
1680 pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
1681 pReq->Hdr.rc = VERR_VERSION_MISMATCH;
1682 return VINF_SUCCESS;
1683 }
1684
1685 pReq->u.Out.pSession = NULL;
1686 pReq->u.Out.uSessionVersion = SUPDRV_IDC_VERSION;
1687 pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
1688 pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
1689
1690 /*
1691 * On NT we will already have a session associated with the
1692 * client, just like with the SUP_IOCTL_COOKIE request, while
1693 * the other doesn't.
1694 */
1695#ifdef RT_OS_WINDOWS
1696 pReq->Hdr.rc = VINF_SUCCESS;
1697#else
1698 AssertReturn(!pSession, VERR_INTERNAL_ERROR);
1699 pReq->Hdr.rc = supdrvCreateSession(pDevExt, false /* fUser */, &pSession);
1700 if (RT_FAILURE(pReq->Hdr.rc))
1701 {
1702 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: failed to create session, rc=%d\n", pReq->Hdr.rc));
1703 return VINF_SUCCESS;
1704 }
1705#endif
1706
1707 pReq->u.Out.pSession = pSession;
1708 pReq->Hdr.pSession = pSession;
1709
1710 return VINF_SUCCESS;
1711 }
1712
1713 case SUPDRV_IDC_REQ_DISCONNECT:
1714 {
1715 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_DISCONNECT, sizeof(*pReqHdr));
1716
1717#ifdef RT_OS_WINDOWS
1718 /* Windows will destroy the session when the file object is destroyed. */
1719#else
1720 supdrvCloseSession(pDevExt, pSession);
1721#endif
1722 return pReqHdr->rc = VINF_SUCCESS;
1723 }
1724
1725 case SUPDRV_IDC_REQ_GET_SYMBOL:
1726 {
1727 PSUPDRVIDCREQGETSYM pReq = (PSUPDRVIDCREQGETSYM)pReqHdr;
1728 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_GET_SYMBOL, sizeof(*pReq));
1729
1730 pReq->Hdr.rc = supdrvIDC_LdrGetSymbol(pDevExt, pSession, pReq);
1731 return VINF_SUCCESS;
1732 }
1733
1734 case SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY:
1735 {
1736 PSUPDRVIDCREQCOMPREGFACTORY pReq = (PSUPDRVIDCREQCOMPREGFACTORY)pReqHdr;
1737 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY, sizeof(*pReq));
1738
1739 pReq->Hdr.rc = SUPR0ComponentRegisterFactory(pSession, pReq->u.In.pFactory);
1740 return VINF_SUCCESS;
1741 }
1742
1743 case SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY:
1744 {
1745 PSUPDRVIDCREQCOMPDEREGFACTORY pReq = (PSUPDRVIDCREQCOMPDEREGFACTORY)pReqHdr;
1746 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY, sizeof(*pReq));
1747
1748 pReq->Hdr.rc = SUPR0ComponentDeregisterFactory(pSession, pReq->u.In.pFactory);
1749 return VINF_SUCCESS;
1750 }
1751
1752 default:
1753 Log(("Unknown IDC %#lx\n", (long)uReq));
1754 break;
1755 }
1756
1757#undef REQ_CHECK_IDC_SIZE
1758 return VERR_NOT_SUPPORTED;
1759}
1760
1761
1762/**
1763 * Register a object for reference counting.
1764 * The object is registered with one reference in the specified session.
1765 *
1766 * @returns Unique identifier on success (pointer).
1767 * All future reference must use this identifier.
1768 * @returns NULL on failure.
1769 * @param pfnDestructor The destructore function which will be called when the reference count reaches 0.
1770 * @param pvUser1 The first user argument.
1771 * @param pvUser2 The second user argument.
1772 */
1773SUPR0DECL(void *) SUPR0ObjRegister(PSUPDRVSESSION pSession, SUPDRVOBJTYPE enmType, PFNSUPDRVDESTRUCTOR pfnDestructor, void *pvUser1, void *pvUser2)
1774{
1775 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1776 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1777 PSUPDRVOBJ pObj;
1778 PSUPDRVUSAGE pUsage;
1779
1780 /*
1781 * Validate the input.
1782 */
1783 AssertReturn(SUP_IS_SESSION_VALID(pSession), NULL);
1784 AssertReturn(enmType > SUPDRVOBJTYPE_INVALID && enmType < SUPDRVOBJTYPE_END, NULL);
1785 AssertPtrReturn(pfnDestructor, NULL);
1786
1787 /*
1788 * Allocate and initialize the object.
1789 */
1790 pObj = (PSUPDRVOBJ)RTMemAlloc(sizeof(*pObj));
1791 if (!pObj)
1792 return NULL;
1793 pObj->u32Magic = SUPDRVOBJ_MAGIC;
1794 pObj->enmType = enmType;
1795 pObj->pNext = NULL;
1796 pObj->cUsage = 1;
1797 pObj->pfnDestructor = pfnDestructor;
1798 pObj->pvUser1 = pvUser1;
1799 pObj->pvUser2 = pvUser2;
1800 pObj->CreatorUid = pSession->Uid;
1801 pObj->CreatorGid = pSession->Gid;
1802 pObj->CreatorProcess= pSession->Process;
1803 supdrvOSObjInitCreator(pObj, pSession);
1804
1805 /*
1806 * Allocate the usage record.
1807 * (We keep freed usage records around to simplify SUPR0ObjAddRefEx().)
1808 */
1809 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1810
1811 pUsage = pDevExt->pUsageFree;
1812 if (pUsage)
1813 pDevExt->pUsageFree = pUsage->pNext;
1814 else
1815 {
1816 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1817 pUsage = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsage));
1818 if (!pUsage)
1819 {
1820 RTMemFree(pObj);
1821 return NULL;
1822 }
1823 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1824 }
1825
1826 /*
1827 * Insert the object and create the session usage record.
1828 */
1829 /* The object. */
1830 pObj->pNext = pDevExt->pObjs;
1831 pDevExt->pObjs = pObj;
1832
1833 /* The session record. */
1834 pUsage->cUsage = 1;
1835 pUsage->pObj = pObj;
1836 pUsage->pNext = pSession->pUsage;
1837 /* Log2(("SUPR0ObjRegister: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext)); */
1838 pSession->pUsage = pUsage;
1839
1840 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1841
1842 Log(("SUPR0ObjRegister: returns %p (pvUser1=%p, pvUser=%p)\n", pObj, pvUser1, pvUser2));
1843 return pObj;
1844}
1845
1846
1847/**
1848 * Increment the reference counter for the object associating the reference
1849 * with the specified session.
1850 *
1851 * @returns IPRT status code.
1852 * @param pvObj The identifier returned by SUPR0ObjRegister().
1853 * @param pSession The session which is referencing the object.
1854 *
1855 * @remarks The caller should not own any spinlocks and must carefully protect
1856 * itself against potential race with the destructor so freed memory
1857 * isn't accessed here.
1858 */
1859SUPR0DECL(int) SUPR0ObjAddRef(void *pvObj, PSUPDRVSESSION pSession)
1860{
1861 return SUPR0ObjAddRefEx(pvObj, pSession, false /* fNoBlocking */);
1862}
1863
1864
1865/**
1866 * Increment the reference counter for the object associating the reference
1867 * with the specified session.
1868 *
1869 * @returns IPRT status code.
1870 * @retval VERR_TRY_AGAIN if fNoBlocking was set and a new usage record
1871 * couldn't be allocated. (If you see this you're not doing the right
1872 * thing and it won't ever work reliably.)
1873 *
1874 * @param pvObj The identifier returned by SUPR0ObjRegister().
1875 * @param pSession The session which is referencing the object.
1876 * @param fNoBlocking Set if it's not OK to block. Never try to make the
1877 * first reference to an object in a session with this
1878 * argument set.
1879 *
1880 * @remarks The caller should not own any spinlocks and must carefully protect
1881 * itself against potential race with the destructor so freed memory
1882 * isn't accessed here.
1883 */
1884SUPR0DECL(int) SUPR0ObjAddRefEx(void *pvObj, PSUPDRVSESSION pSession, bool fNoBlocking)
1885{
1886 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
1887 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
1888 PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
1889 int rc = VINF_SUCCESS;
1890 PSUPDRVUSAGE pUsagePre;
1891 PSUPDRVUSAGE pUsage;
1892
1893 /*
1894 * Validate the input.
1895 * Be ready for the destruction race (someone might be stuck in the
1896 * destructor waiting a lock we own).
1897 */
1898 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
1899 AssertPtrReturn(pObj, VERR_INVALID_POINTER);
1900 AssertMsgReturn(pObj->u32Magic == SUPDRVOBJ_MAGIC || pObj->u32Magic == SUPDRVOBJ_MAGIC_DEAD,
1901 ("Invalid pvObj=%p magic=%#x (expected %#x or %#x)\n", pvObj, pObj->u32Magic, SUPDRVOBJ_MAGIC, SUPDRVOBJ_MAGIC_DEAD),
1902 VERR_INVALID_PARAMETER);
1903
1904 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1905
1906 if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
1907 {
1908 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1909
1910 AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
1911 return VERR_WRONG_ORDER;
1912 }
1913
1914 /*
1915 * Preallocate the usage record if we can.
1916 */
1917 pUsagePre = pDevExt->pUsageFree;
1918 if (pUsagePre)
1919 pDevExt->pUsageFree = pUsagePre->pNext;
1920 else if (!fNoBlocking)
1921 {
1922 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1923 pUsagePre = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsagePre));
1924 if (!pUsagePre)
1925 return VERR_NO_MEMORY;
1926
1927 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
1928 if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
1929 {
1930 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1931
1932 AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
1933 return VERR_WRONG_ORDER;
1934 }
1935 }
1936
1937 /*
1938 * Reference the object.
1939 */
1940 pObj->cUsage++;
1941
1942 /*
1943 * Look for the session record.
1944 */
1945 for (pUsage = pSession->pUsage; pUsage; pUsage = pUsage->pNext)
1946 {
1947 /*Log(("SUPR0AddRef: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));*/
1948 if (pUsage->pObj == pObj)
1949 break;
1950 }
1951 if (pUsage)
1952 pUsage->cUsage++;
1953 else if (pUsagePre)
1954 {
1955 /* create a new session record. */
1956 pUsagePre->cUsage = 1;
1957 pUsagePre->pObj = pObj;
1958 pUsagePre->pNext = pSession->pUsage;
1959 pSession->pUsage = pUsagePre;
1960 /*Log(("SUPR0AddRef: pUsagePre=%p:{.pObj=%p, .pNext=%p}\n", pUsagePre, pUsagePre->pObj, pUsagePre->pNext));*/
1961
1962 pUsagePre = NULL;
1963 }
1964 else
1965 {
1966 pObj->cUsage--;
1967 rc = VERR_TRY_AGAIN;
1968 }
1969
1970 /*
1971 * Put any unused usage record into the free list..
1972 */
1973 if (pUsagePre)
1974 {
1975 pUsagePre->pNext = pDevExt->pUsageFree;
1976 pDevExt->pUsageFree = pUsagePre;
1977 }
1978
1979 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
1980
1981 return rc;
1982}
1983
1984
1985/**
1986 * Decrement / destroy a reference counter record for an object.
1987 *
1988 * The object is uniquely identified by pfnDestructor+pvUser1+pvUser2.
1989 *
1990 * @returns IPRT status code.
1991 * @retval VINF_SUCCESS if not destroyed.
1992 * @retval VINF_OBJECT_DESTROYED if it's destroyed by this release call.
1993 * @retval VERR_INVALID_PARAMETER if the object isn't valid. Will assert in
1994 * string builds.
1995 *
1996 * @param pvObj The identifier returned by SUPR0ObjRegister().
1997 * @param pSession The session which is referencing the object.
1998 */
1999SUPR0DECL(int) SUPR0ObjRelease(void *pvObj, PSUPDRVSESSION pSession)
2000{
2001 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2002 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2003 PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2004 int rc = VERR_INVALID_PARAMETER;
2005 PSUPDRVUSAGE pUsage;
2006 PSUPDRVUSAGE pUsagePrev;
2007
2008 /*
2009 * Validate the input.
2010 */
2011 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2012 AssertMsgReturn(VALID_PTR(pObj) && pObj->u32Magic == SUPDRVOBJ_MAGIC,
2013 ("Invalid pvObj=%p magic=%#x (exepcted %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
2014 VERR_INVALID_PARAMETER);
2015
2016 /*
2017 * Acquire the spinlock and look for the usage record.
2018 */
2019 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
2020
2021 for (pUsagePrev = NULL, pUsage = pSession->pUsage;
2022 pUsage;
2023 pUsagePrev = pUsage, pUsage = pUsage->pNext)
2024 {
2025 /*Log2(("SUPR0ObjRelease: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));*/
2026 if (pUsage->pObj == pObj)
2027 {
2028 rc = VINF_SUCCESS;
2029 AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
2030 if (pUsage->cUsage > 1)
2031 {
2032 pObj->cUsage--;
2033 pUsage->cUsage--;
2034 }
2035 else
2036 {
2037 /*
2038 * Free the session record.
2039 */
2040 if (pUsagePrev)
2041 pUsagePrev->pNext = pUsage->pNext;
2042 else
2043 pSession->pUsage = pUsage->pNext;
2044 pUsage->pNext = pDevExt->pUsageFree;
2045 pDevExt->pUsageFree = pUsage;
2046
2047 /* What about the object? */
2048 if (pObj->cUsage > 1)
2049 pObj->cUsage--;
2050 else
2051 {
2052 /*
2053 * Object is to be destroyed, unlink it.
2054 */
2055 pObj->u32Magic = SUPDRVOBJ_MAGIC_DEAD;
2056 rc = VINF_OBJECT_DESTROYED;
2057 if (pDevExt->pObjs == pObj)
2058 pDevExt->pObjs = pObj->pNext;
2059 else
2060 {
2061 PSUPDRVOBJ pObjPrev;
2062 for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
2063 if (pObjPrev->pNext == pObj)
2064 {
2065 pObjPrev->pNext = pObj->pNext;
2066 break;
2067 }
2068 Assert(pObjPrev);
2069 }
2070 }
2071 }
2072 break;
2073 }
2074 }
2075
2076 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
2077
2078 /*
2079 * Call the destructor and free the object if required.
2080 */
2081 if (rc == VINF_OBJECT_DESTROYED)
2082 {
2083 Log(("SUPR0ObjRelease: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
2084 pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
2085 if (pObj->pfnDestructor)
2086 pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
2087 RTMemFree(pObj);
2088 }
2089
2090 AssertMsg(pUsage, ("pvObj=%p\n", pvObj));
2091 return rc;
2092}
2093
2094
2095/**
2096 * Verifies that the current process can access the specified object.
2097 *
2098 * @returns The following IPRT status code:
2099 * @retval VINF_SUCCESS if access was granted.
2100 * @retval VERR_PERMISSION_DENIED if denied access.
2101 * @retval VERR_INVALID_PARAMETER if invalid parameter.
2102 *
2103 * @param pvObj The identifier returned by SUPR0ObjRegister().
2104 * @param pSession The session which wishes to access the object.
2105 * @param pszObjName Object string name. This is optional and depends on the object type.
2106 *
2107 * @remark The caller is responsible for making sure the object isn't removed while
2108 * we're inside this function. If uncertain about this, just call AddRef before calling us.
2109 */
2110SUPR0DECL(int) SUPR0ObjVerifyAccess(void *pvObj, PSUPDRVSESSION pSession, const char *pszObjName)
2111{
2112 PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2113 int rc;
2114
2115 /*
2116 * Validate the input.
2117 */
2118 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2119 AssertMsgReturn(VALID_PTR(pObj) && pObj->u32Magic == SUPDRVOBJ_MAGIC,
2120 ("Invalid pvObj=%p magic=%#x (exepcted %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
2121 VERR_INVALID_PARAMETER);
2122
2123 /*
2124 * Check access. (returns true if a decision has been made.)
2125 */
2126 rc = VERR_INTERNAL_ERROR;
2127 if (supdrvOSObjCanAccess(pObj, pSession, pszObjName, &rc))
2128 return rc;
2129
2130 /*
2131 * Default policy is to allow the user to access his own
2132 * stuff but nothing else.
2133 */
2134 if (pObj->CreatorUid == pSession->Uid)
2135 return VINF_SUCCESS;
2136 return VERR_PERMISSION_DENIED;
2137}
2138
2139
2140/**
2141 * Lock pages.
2142 *
2143 * @returns IPRT status code.
2144 * @param pSession Session to which the locked memory should be associated.
2145 * @param pvR3 Start of the memory range to lock.
2146 * This must be page aligned.
2147 * @param cPages Number of pages to lock.
2148 * @param paPages Where to put the physical addresses of locked memory.
2149 */
2150SUPR0DECL(int) SUPR0LockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t cPages, PRTHCPHYS paPages)
2151{
2152 int rc;
2153 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2154 const size_t cb = (size_t)cPages << PAGE_SHIFT;
2155 LogFlow(("SUPR0LockMem: pSession=%p pvR3=%p cPages=%d paPages=%p\n", pSession, (void *)pvR3, cPages, paPages));
2156
2157 /*
2158 * Verify input.
2159 */
2160 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2161 AssertPtrReturn(paPages, VERR_INVALID_PARAMETER);
2162 if ( RT_ALIGN_R3PT(pvR3, PAGE_SIZE, RTR3PTR) != pvR3
2163 || !pvR3)
2164 {
2165 Log(("pvR3 (%p) must be page aligned and not NULL!\n", (void *)pvR3));
2166 return VERR_INVALID_PARAMETER;
2167 }
2168
2169 /*
2170 * Let IPRT do the job.
2171 */
2172 Mem.eType = MEMREF_TYPE_LOCKED;
2173 rc = RTR0MemObjLockUser(&Mem.MemObj, pvR3, cb, RTMEM_PROT_READ | RTMEM_PROT_WRITE, RTR0ProcHandleSelf());
2174 if (RT_SUCCESS(rc))
2175 {
2176 uint32_t iPage = cPages;
2177 AssertMsg(RTR0MemObjAddressR3(Mem.MemObj) == pvR3, ("%p == %p\n", RTR0MemObjAddressR3(Mem.MemObj), pvR3));
2178 AssertMsg(RTR0MemObjSize(Mem.MemObj) == cb, ("%x == %x\n", RTR0MemObjSize(Mem.MemObj), cb));
2179
2180 while (iPage-- > 0)
2181 {
2182 paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
2183 if (RT_UNLIKELY(paPages[iPage] == NIL_RTCCPHYS))
2184 {
2185 AssertMsgFailed(("iPage=%d\n", iPage));
2186 rc = VERR_INTERNAL_ERROR;
2187 break;
2188 }
2189 }
2190 if (RT_SUCCESS(rc))
2191 rc = supdrvMemAdd(&Mem, pSession);
2192 if (RT_FAILURE(rc))
2193 {
2194 int rc2 = RTR0MemObjFree(Mem.MemObj, false);
2195 AssertRC(rc2);
2196 }
2197 }
2198
2199 return rc;
2200}
2201
2202
2203/**
2204 * Unlocks the memory pointed to by pv.
2205 *
2206 * @returns IPRT status code.
2207 * @param pSession Session to which the memory was locked.
2208 * @param pvR3 Memory to unlock.
2209 */
2210SUPR0DECL(int) SUPR0UnlockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3)
2211{
2212 LogFlow(("SUPR0UnlockMem: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
2213 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2214 return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_LOCKED);
2215}
2216
2217
2218/**
2219 * Allocates a chunk of page aligned memory with contiguous and fixed physical
2220 * backing.
2221 *
2222 * @returns IPRT status code.
2223 * @param pSession Session data.
2224 * @param cPages Number of pages to allocate.
2225 * @param ppvR0 Where to put the address of Ring-0 mapping the allocated memory.
2226 * @param ppvR3 Where to put the address of Ring-3 mapping the allocated memory.
2227 * @param pHCPhys Where to put the physical address of allocated memory.
2228 */
2229SUPR0DECL(int) SUPR0ContAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS pHCPhys)
2230{
2231 int rc;
2232 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2233 LogFlow(("SUPR0ContAlloc: pSession=%p cPages=%d ppvR0=%p ppvR3=%p pHCPhys=%p\n", pSession, cPages, ppvR0, ppvR3, pHCPhys));
2234
2235 /*
2236 * Validate input.
2237 */
2238 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2239 if (!ppvR3 || !ppvR0 || !pHCPhys)
2240 {
2241 Log(("Null pointer. All of these should be set: pSession=%p ppvR0=%p ppvR3=%p pHCPhys=%p\n",
2242 pSession, ppvR0, ppvR3, pHCPhys));
2243 return VERR_INVALID_PARAMETER;
2244
2245 }
2246 if (cPages < 1 || cPages >= 256)
2247 {
2248 Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
2249 return VERR_PAGE_COUNT_OUT_OF_RANGE;
2250 }
2251
2252 /*
2253 * Let IPRT do the job.
2254 */
2255 rc = RTR0MemObjAllocCont(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable R0 mapping */);
2256 if (RT_SUCCESS(rc))
2257 {
2258 int rc2;
2259 rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2260 RTMEM_PROT_EXEC | RTMEM_PROT_WRITE | RTMEM_PROT_READ, RTR0ProcHandleSelf());
2261 if (RT_SUCCESS(rc))
2262 {
2263 Mem.eType = MEMREF_TYPE_CONT;
2264 rc = supdrvMemAdd(&Mem, pSession);
2265 if (!rc)
2266 {
2267 *ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2268 *ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2269 *pHCPhys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, 0);
2270 return 0;
2271 }
2272
2273 rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2274 AssertRC(rc2);
2275 }
2276 rc2 = RTR0MemObjFree(Mem.MemObj, false);
2277 AssertRC(rc2);
2278 }
2279
2280 return rc;
2281}
2282
2283
2284/**
2285 * Frees memory allocated using SUPR0ContAlloc().
2286 *
2287 * @returns IPRT status code.
2288 * @param pSession The session to which the memory was allocated.
2289 * @param uPtr Pointer to the memory (ring-3 or ring-0).
2290 */
2291SUPR0DECL(int) SUPR0ContFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2292{
2293 LogFlow(("SUPR0ContFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2294 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2295 return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_CONT);
2296}
2297
2298
2299/**
2300 * Allocates a chunk of page aligned memory with fixed physical backing below 4GB.
2301 *
2302 * The memory isn't zeroed.
2303 *
2304 * @returns IPRT status code.
2305 * @param pSession Session data.
2306 * @param cPages Number of pages to allocate.
2307 * @param ppvR0 Where to put the address of Ring-0 mapping of the allocated memory.
2308 * @param ppvR3 Where to put the address of Ring-3 mapping of the allocated memory.
2309 * @param paPages Where to put the physical addresses of allocated memory.
2310 */
2311SUPR0DECL(int) SUPR0LowAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS paPages)
2312{
2313 unsigned iPage;
2314 int rc;
2315 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2316 LogFlow(("SUPR0LowAlloc: pSession=%p cPages=%d ppvR3=%p ppvR0=%p paPages=%p\n", pSession, cPages, ppvR3, ppvR0, paPages));
2317
2318 /*
2319 * Validate input.
2320 */
2321 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2322 if (!ppvR3 || !ppvR0 || !paPages)
2323 {
2324 Log(("Null pointer. All of these should be set: pSession=%p ppvR3=%p ppvR0=%p paPages=%p\n",
2325 pSession, ppvR3, ppvR0, paPages));
2326 return VERR_INVALID_PARAMETER;
2327
2328 }
2329 if (cPages < 1 || cPages >= 256)
2330 {
2331 Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
2332 return VERR_PAGE_COUNT_OUT_OF_RANGE;
2333 }
2334
2335 /*
2336 * Let IPRT do the work.
2337 */
2338 rc = RTR0MemObjAllocLow(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable ring-0 mapping */);
2339 if (RT_SUCCESS(rc))
2340 {
2341 int rc2;
2342 rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2343 RTMEM_PROT_EXEC | RTMEM_PROT_WRITE | RTMEM_PROT_READ, RTR0ProcHandleSelf());
2344 if (RT_SUCCESS(rc))
2345 {
2346 Mem.eType = MEMREF_TYPE_LOW;
2347 rc = supdrvMemAdd(&Mem, pSession);
2348 if (!rc)
2349 {
2350 for (iPage = 0; iPage < cPages; iPage++)
2351 {
2352 paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
2353 AssertMsg(!(paPages[iPage] & (PAGE_SIZE - 1)), ("iPage=%d Phys=%RHp\n", paPages[iPage]));
2354 }
2355 *ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2356 *ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2357 return 0;
2358 }
2359
2360 rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2361 AssertRC(rc2);
2362 }
2363
2364 rc2 = RTR0MemObjFree(Mem.MemObj, false);
2365 AssertRC(rc2);
2366 }
2367
2368 return rc;
2369}
2370
2371
2372/**
2373 * Frees memory allocated using SUPR0LowAlloc().
2374 *
2375 * @returns IPRT status code.
2376 * @param pSession The session to which the memory was allocated.
2377 * @param uPtr Pointer to the memory (ring-3 or ring-0).
2378 */
2379SUPR0DECL(int) SUPR0LowFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2380{
2381 LogFlow(("SUPR0LowFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2382 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2383 return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_LOW);
2384}
2385
2386
2387
2388/**
2389 * Allocates a chunk of memory with both R0 and R3 mappings.
2390 * The memory is fixed and it's possible to query the physical addresses using SUPR0MemGetPhys().
2391 *
2392 * @returns IPRT status code.
2393 * @param pSession The session to associated the allocation with.
2394 * @param cb Number of bytes to allocate.
2395 * @param ppvR0 Where to store the address of the Ring-0 mapping.
2396 * @param ppvR3 Where to store the address of the Ring-3 mapping.
2397 */
2398SUPR0DECL(int) SUPR0MemAlloc(PSUPDRVSESSION pSession, uint32_t cb, PRTR0PTR ppvR0, PRTR3PTR ppvR3)
2399{
2400 int rc;
2401 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2402 LogFlow(("SUPR0MemAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p\n", pSession, cb, ppvR0, ppvR3));
2403
2404 /*
2405 * Validate input.
2406 */
2407 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2408 AssertPtrReturn(ppvR0, VERR_INVALID_POINTER);
2409 AssertPtrReturn(ppvR3, VERR_INVALID_POINTER);
2410 if (cb < 1 || cb >= _4M)
2411 {
2412 Log(("Illegal request cb=%u; must be greater than 0 and smaller than 4MB.\n", cb));
2413 return VERR_INVALID_PARAMETER;
2414 }
2415
2416 /*
2417 * Let IPRT do the work.
2418 */
2419 rc = RTR0MemObjAllocPage(&Mem.MemObj, cb, true /* executable ring-0 mapping */);
2420 if (RT_SUCCESS(rc))
2421 {
2422 int rc2;
2423 rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2424 RTMEM_PROT_EXEC | RTMEM_PROT_WRITE | RTMEM_PROT_READ, RTR0ProcHandleSelf());
2425 if (RT_SUCCESS(rc))
2426 {
2427 Mem.eType = MEMREF_TYPE_MEM;
2428 rc = supdrvMemAdd(&Mem, pSession);
2429 if (!rc)
2430 {
2431 *ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2432 *ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2433 return VINF_SUCCESS;
2434 }
2435
2436 rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2437 AssertRC(rc2);
2438 }
2439
2440 rc2 = RTR0MemObjFree(Mem.MemObj, false);
2441 AssertRC(rc2);
2442 }
2443
2444 return rc;
2445}
2446
2447
2448/**
2449 * Get the physical addresses of memory allocated using SUPR0MemAlloc().
2450 *
2451 * @returns IPRT status code.
2452 * @param pSession The session to which the memory was allocated.
2453 * @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2454 * @param paPages Where to store the physical addresses.
2455 */
2456SUPR0DECL(int) SUPR0MemGetPhys(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, PSUPPAGE paPages) /** @todo switch this bugger to RTHCPHYS */
2457{
2458 PSUPDRVBUNDLE pBundle;
2459 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2460 LogFlow(("SUPR0MemGetPhys: pSession=%p uPtr=%p paPages=%p\n", pSession, (void *)uPtr, paPages));
2461
2462 /*
2463 * Validate input.
2464 */
2465 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2466 AssertPtrReturn(paPages, VERR_INVALID_POINTER);
2467 AssertReturn(uPtr, VERR_INVALID_PARAMETER);
2468
2469 /*
2470 * Search for the address.
2471 */
2472 RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2473 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2474 {
2475 if (pBundle->cUsed > 0)
2476 {
2477 unsigned i;
2478 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2479 {
2480 if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
2481 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2482 && ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
2483 || ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2484 && RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr)
2485 )
2486 )
2487 {
2488 const size_t cPages = RTR0MemObjSize(pBundle->aMem[i].MemObj) >> PAGE_SHIFT;
2489 size_t iPage;
2490 for (iPage = 0; iPage < cPages; iPage++)
2491 {
2492 paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(pBundle->aMem[i].MemObj, iPage);
2493 paPages[iPage].uReserved = 0;
2494 }
2495 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2496 return VINF_SUCCESS;
2497 }
2498 }
2499 }
2500 }
2501 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2502 Log(("Failed to find %p!!!\n", (void *)uPtr));
2503 return VERR_INVALID_PARAMETER;
2504}
2505
2506
2507/**
2508 * Free memory allocated by SUPR0MemAlloc().
2509 *
2510 * @returns IPRT status code.
2511 * @param pSession The session owning the allocation.
2512 * @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
2513 */
2514SUPR0DECL(int) SUPR0MemFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
2515{
2516 LogFlow(("SUPR0MemFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
2517 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2518 return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_MEM);
2519}
2520
2521
2522/**
2523 * Allocates a chunk of memory with a kernel or/and a user mode mapping.
2524 *
2525 * The memory is fixed and it's possible to query the physical addresses using
2526 * SUPR0MemGetPhys().
2527 *
2528 * @returns IPRT status code.
2529 * @param pSession The session to associated the allocation with.
2530 * @param cPages The number of pages to allocate.
2531 * @param fFlags Flags, reserved for the future. Must be zero.
2532 * @param ppvR3 Where to store the address of the Ring-3 mapping.
2533 * NULL if no ring-3 mapping.
2534 * @param ppvR3 Where to store the address of the Ring-0 mapping.
2535 * NULL if no ring-0 mapping.
2536 * @param paPages Where to store the addresses of the pages. Optional.
2537 */
2538SUPR0DECL(int) SUPR0PageAllocEx(PSUPDRVSESSION pSession, uint32_t cPages, uint32_t fFlags, PRTR3PTR ppvR3, PRTR0PTR ppvR0, PRTHCPHYS paPages)
2539{
2540 int rc;
2541 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
2542 LogFlow(("SUPR0PageAlloc: pSession=%p cb=%d ppvR3=%p\n", pSession, cPages, ppvR3));
2543
2544 /*
2545 * Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2546 */
2547 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2548 AssertPtrNullReturn(ppvR3, VERR_INVALID_POINTER);
2549 AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
2550 AssertReturn(ppvR3 || ppvR0, VERR_INVALID_PARAMETER);
2551 AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
2552 if (cPages < 1 || cPages > VBOX_MAX_ALLOC_PAGE_COUNT)
2553 {
2554 Log(("SUPR0PageAlloc: Illegal request cb=%u; must be greater than 0 and smaller than %uMB (VBOX_MAX_ALLOC_PAGE_COUNT pages).\n", cPages, VBOX_MAX_ALLOC_PAGE_COUNT * (_1M / _4K)));
2555 return VERR_PAGE_COUNT_OUT_OF_RANGE;
2556 }
2557
2558 /*
2559 * Let IPRT do the work.
2560 */
2561 if (ppvR0)
2562 rc = RTR0MemObjAllocPage(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, true /* fExecutable */);
2563 else
2564 rc = RTR0MemObjAllocPhysNC(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, NIL_RTHCPHYS);
2565 if (RT_SUCCESS(rc))
2566 {
2567 int rc2;
2568 if (ppvR3)
2569 rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
2570 RTMEM_PROT_EXEC | RTMEM_PROT_WRITE | RTMEM_PROT_READ, RTR0ProcHandleSelf());
2571 else
2572 Mem.MapObjR3 = NIL_RTR0MEMOBJ;
2573 if (RT_SUCCESS(rc))
2574 {
2575 Mem.eType = MEMREF_TYPE_PAGE;
2576 rc = supdrvMemAdd(&Mem, pSession);
2577 if (!rc)
2578 {
2579 if (ppvR3)
2580 *ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
2581 if (ppvR0)
2582 *ppvR0 = RTR0MemObjAddress(Mem.MemObj);
2583 if (paPages)
2584 {
2585 uint32_t iPage = cPages;
2586 while (iPage-- > 0)
2587 {
2588 paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MapObjR3, iPage);
2589 Assert(paPages[iPage] != NIL_RTHCPHYS);
2590 }
2591 }
2592 return VINF_SUCCESS;
2593 }
2594
2595 rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
2596 AssertRC(rc2);
2597 }
2598
2599 rc2 = RTR0MemObjFree(Mem.MemObj, false);
2600 AssertRC(rc2);
2601 }
2602 return rc;
2603}
2604
2605
2606/**
2607 * Maps a chunk of memory previously allocated by SUPR0PageAllocEx into kernel
2608 * space.
2609 *
2610 * @returns IPRT status code.
2611 * @param pSession The session to associated the allocation with.
2612 * @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
2613 * @param offSub Where to start mapping. Must be page aligned.
2614 * @param cbSub How much to map. Must be page aligned.
2615 * @param fFlags Flags, MBZ.
2616 * @param ppvR0 Where to reutrn the address of the ring-0 mapping on
2617 * success.
2618 */
2619SUPR0DECL(int) SUPR0PageMapKernel(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t offSub, uint32_t cbSub,
2620 uint32_t fFlags, PRTR0PTR ppvR0)
2621{
2622 int rc;
2623 PSUPDRVBUNDLE pBundle;
2624 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2625 RTR0MEMOBJ hMemObj = NIL_RTR0MEMOBJ;
2626 LogFlow(("SUPR0PageMapKernel: pSession=%p pvR3=%p offSub=%#x cbSub=%#x\n", pSession, pvR3, offSub, cbSub));
2627
2628 /*
2629 * Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2630 */
2631 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2632 AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
2633 AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
2634 AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2635 AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2636 AssertReturn(cbSub, VERR_INVALID_PARAMETER);
2637
2638 /*
2639 * Find the memory object.
2640 */
2641 RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2642 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2643 {
2644 if (pBundle->cUsed > 0)
2645 {
2646 unsigned i;
2647 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2648 {
2649 if ( ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
2650 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2651 && pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2652 && RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3)
2653 || ( pBundle->aMem[i].eType == MEMREF_TYPE_LOCKED
2654 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2655 && pBundle->aMem[i].MapObjR3 == NIL_RTR0MEMOBJ
2656 && RTR0MemObjAddressR3(pBundle->aMem[i].MemObj) == pvR3))
2657 {
2658 hMemObj = pBundle->aMem[i].MemObj;
2659 break;
2660 }
2661 }
2662 }
2663 }
2664 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2665
2666 rc = VERR_INVALID_PARAMETER;
2667 if (hMemObj != NIL_RTR0MEMOBJ)
2668 {
2669 /*
2670 * Do some furter input validations before calling IPRT.
2671 * (Cleanup is done indirectly by telling RTR0MemObjFree to include mappings.)
2672 */
2673 size_t cbMemObj = RTR0MemObjSize(hMemObj);
2674 if ( offSub < cbMemObj
2675 && cbSub <= cbMemObj
2676 && offSub + cbSub <= cbMemObj)
2677 {
2678 RTR0MEMOBJ hMapObj;
2679 rc = RTR0MemObjMapKernelEx(&hMapObj, hMemObj, (void *)-1, 0,
2680 RTMEM_PROT_READ | RTMEM_PROT_WRITE, offSub, cbSub);
2681 if (RT_SUCCESS(rc))
2682 *ppvR0 = RTR0MemObjAddress(hMapObj);
2683 }
2684 else
2685 SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
2686
2687 }
2688 return rc;
2689}
2690
2691
2692/**
2693 * Changes the page level protection of one or more pages previously allocated
2694 * by SUPR0PageAllocEx.
2695 *
2696 * @returns IPRT status code.
2697 * @param pSession The session to associated the allocation with.
2698 * @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
2699 * NIL_RTR3PTR if the ring-3 mapping should be unaffected.
2700 * @param pvR0 The ring-0 address returned by SUPR0PageAllocEx.
2701 * NIL_RTR0PTR if the ring-0 mapping should be unaffected.
2702 * @param offSub Where to start changing. Must be page aligned.
2703 * @param cbSub How much to change. Must be page aligned.
2704 * @param fProt The new page level protection, see RTMEM_PROT_*.
2705 */
2706SUPR0DECL(int) SUPR0PageProtect(PSUPDRVSESSION pSession, RTR3PTR pvR3, RTR0PTR pvR0, uint32_t offSub, uint32_t cbSub, uint32_t fProt)
2707{
2708 int rc;
2709 PSUPDRVBUNDLE pBundle;
2710 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
2711 RTR0MEMOBJ hMemObjR0 = NIL_RTR0MEMOBJ;
2712 RTR0MEMOBJ hMemObjR3 = NIL_RTR0MEMOBJ;
2713 LogFlow(("SUPR0PageProtect: pSession=%p pvR3=%p pvR0=%p offSub=%#x cbSub=%#x fProt-%#x\n", pSession, pvR3, pvR0, offSub, cbSub, fProt));
2714
2715 /*
2716 * Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
2717 */
2718 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2719 AssertReturn(!(fProt & ~(RTMEM_PROT_READ | RTMEM_PROT_WRITE | RTMEM_PROT_EXEC | RTMEM_PROT_NONE)), VERR_INVALID_PARAMETER);
2720 AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2721 AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2722 AssertReturn(cbSub, VERR_INVALID_PARAMETER);
2723
2724 /*
2725 * Find the memory object.
2726 */
2727 RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
2728 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
2729 {
2730 if (pBundle->cUsed > 0)
2731 {
2732 unsigned i;
2733 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
2734 {
2735 if ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
2736 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
2737 && ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
2738 || pvR3 == NIL_RTR3PTR)
2739 && ( pvR0 == NIL_RTR0PTR
2740 || RTR0MemObjAddress(pBundle->aMem[i].MemObj) == pvR0)
2741 && ( pvR3 == NIL_RTR3PTR
2742 || RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3))
2743 {
2744 if (pvR0 != NIL_RTR0PTR)
2745 hMemObjR0 = pBundle->aMem[i].MemObj;
2746 if (pvR3 != NIL_RTR3PTR)
2747 hMemObjR3 = pBundle->aMem[i].MapObjR3;
2748 break;
2749 }
2750 }
2751 }
2752 }
2753 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
2754
2755 rc = VERR_INVALID_PARAMETER;
2756 if ( hMemObjR0 != NIL_RTR0MEMOBJ
2757 || hMemObjR3 != NIL_RTR0MEMOBJ)
2758 {
2759 /*
2760 * Do some furter input validations before calling IPRT.
2761 */
2762 size_t cbMemObj = hMemObjR0 != NIL_RTR0PTR ? RTR0MemObjSize(hMemObjR0) : RTR0MemObjSize(hMemObjR3);
2763 if ( offSub < cbMemObj
2764 && cbSub <= cbMemObj
2765 && offSub + cbSub <= cbMemObj)
2766 {
2767 rc = VINF_SUCCESS;
2768 if (hMemObjR3 != NIL_RTR0PTR)
2769 rc = RTR0MemObjProtect(hMemObjR3, offSub, cbSub, fProt);
2770 if (hMemObjR0 != NIL_RTR0PTR && RT_SUCCESS(rc))
2771 rc = RTR0MemObjProtect(hMemObjR0, offSub, cbSub, fProt);
2772 }
2773 else
2774 SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
2775
2776 }
2777 return rc;
2778
2779}
2780
2781
2782/**
2783 * Free memory allocated by SUPR0PageAlloc() and SUPR0PageAllocEx().
2784 *
2785 * @returns IPRT status code.
2786 * @param pSession The session owning the allocation.
2787 * @param pvR3 The Ring-3 address returned by SUPR0PageAlloc() or
2788 * SUPR0PageAllocEx().
2789 */
2790SUPR0DECL(int) SUPR0PageFree(PSUPDRVSESSION pSession, RTR3PTR pvR3)
2791{
2792 LogFlow(("SUPR0PageFree: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
2793 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2794 return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_PAGE);
2795}
2796
2797
2798/**
2799 * Gets the paging mode of the current CPU.
2800 *
2801 * @returns Paging mode, SUPPAGEINGMODE_INVALID on error.
2802 */
2803SUPR0DECL(SUPPAGINGMODE) SUPR0GetPagingMode(void)
2804{
2805 SUPPAGINGMODE enmMode;
2806
2807 RTR0UINTREG cr0 = ASMGetCR0();
2808 if ((cr0 & (X86_CR0_PG | X86_CR0_PE)) != (X86_CR0_PG | X86_CR0_PE))
2809 enmMode = SUPPAGINGMODE_INVALID;
2810 else
2811 {
2812 RTR0UINTREG cr4 = ASMGetCR4();
2813 uint32_t fNXEPlusLMA = 0;
2814 if (cr4 & X86_CR4_PAE)
2815 {
2816 uint32_t fAmdFeatures = ASMCpuId_EDX(0x80000001);
2817 if (fAmdFeatures & (X86_CPUID_AMD_FEATURE_EDX_NX | X86_CPUID_AMD_FEATURE_EDX_LONG_MODE))
2818 {
2819 uint64_t efer = ASMRdMsr(MSR_K6_EFER);
2820 if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_NX) && (efer & MSR_K6_EFER_NXE))
2821 fNXEPlusLMA |= RT_BIT(0);
2822 if ((fAmdFeatures & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE) && (efer & MSR_K6_EFER_LMA))
2823 fNXEPlusLMA |= RT_BIT(1);
2824 }
2825 }
2826
2827 switch ((cr4 & (X86_CR4_PAE | X86_CR4_PGE)) | fNXEPlusLMA)
2828 {
2829 case 0:
2830 enmMode = SUPPAGINGMODE_32_BIT;
2831 break;
2832
2833 case X86_CR4_PGE:
2834 enmMode = SUPPAGINGMODE_32_BIT_GLOBAL;
2835 break;
2836
2837 case X86_CR4_PAE:
2838 enmMode = SUPPAGINGMODE_PAE;
2839 break;
2840
2841 case X86_CR4_PAE | RT_BIT(0):
2842 enmMode = SUPPAGINGMODE_PAE_NX;
2843 break;
2844
2845 case X86_CR4_PAE | X86_CR4_PGE:
2846 enmMode = SUPPAGINGMODE_PAE_GLOBAL;
2847 break;
2848
2849 case X86_CR4_PAE | X86_CR4_PGE | RT_BIT(0):
2850 enmMode = SUPPAGINGMODE_PAE_GLOBAL;
2851 break;
2852
2853 case RT_BIT(1) | X86_CR4_PAE:
2854 enmMode = SUPPAGINGMODE_AMD64;
2855 break;
2856
2857 case RT_BIT(1) | X86_CR4_PAE | RT_BIT(0):
2858 enmMode = SUPPAGINGMODE_AMD64_NX;
2859 break;
2860
2861 case RT_BIT(1) | X86_CR4_PAE | X86_CR4_PGE:
2862 enmMode = SUPPAGINGMODE_AMD64_GLOBAL;
2863 break;
2864
2865 case RT_BIT(1) | X86_CR4_PAE | X86_CR4_PGE | RT_BIT(0):
2866 enmMode = SUPPAGINGMODE_AMD64_GLOBAL_NX;
2867 break;
2868
2869 default:
2870 AssertMsgFailed(("Cannot happen! cr4=%#x fNXEPlusLMA=%d\n", cr4, fNXEPlusLMA));
2871 enmMode = SUPPAGINGMODE_INVALID;
2872 break;
2873 }
2874 }
2875 return enmMode;
2876}
2877
2878
2879/**
2880 * Enables or disabled hardware virtualization extensions using native OS APIs.
2881 *
2882 * @returns VBox status code.
2883 * @retval VINF_SUCCESS on success.
2884 * @retval VERR_NOT_SUPPORTED if not supported by the native OS.
2885 *
2886 * @param fEnable Whether to enable or disable.
2887 */
2888SUPR0DECL(int) SUPR0EnableVTx(bool fEnable)
2889{
2890#ifdef RT_OS_DARWIN
2891 return supdrvOSEnableVTx(fEnable);
2892#else
2893 return VERR_NOT_SUPPORTED;
2894#endif
2895}
2896
2897
2898/** @todo document me */
2899SUPR0DECL(int) SUPR0QueryVTCaps(PSUPDRVSESSION pSession, uint32_t *pfCaps)
2900{
2901 /*
2902 * Input validation.
2903 */
2904 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2905 AssertPtrReturn(pfCaps, VERR_INVALID_POINTER);
2906
2907 *pfCaps = 0;
2908
2909 if (ASMHasCpuId())
2910 {
2911 uint32_t u32FeaturesECX;
2912 uint32_t u32Dummy;
2913 uint32_t u32FeaturesEDX;
2914 uint32_t u32VendorEBX, u32VendorECX, u32VendorEDX, u32AMDFeatureEDX, u32AMDFeatureECX;
2915 uint64_t val;
2916
2917 ASMCpuId(0, &u32Dummy, &u32VendorEBX, &u32VendorECX, &u32VendorEDX);
2918 ASMCpuId(1, &u32Dummy, &u32Dummy, &u32FeaturesECX, &u32FeaturesEDX);
2919 /* Query AMD features. */
2920 ASMCpuId(0x80000001, &u32Dummy, &u32Dummy, &u32AMDFeatureECX, &u32AMDFeatureEDX);
2921
2922 if ( u32VendorEBX == X86_CPUID_VENDOR_INTEL_EBX
2923 && u32VendorECX == X86_CPUID_VENDOR_INTEL_ECX
2924 && u32VendorEDX == X86_CPUID_VENDOR_INTEL_EDX
2925 )
2926 {
2927 if ( (u32FeaturesECX & X86_CPUID_FEATURE_ECX_VMX)
2928 && (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_MSR)
2929 && (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_FXSR)
2930 )
2931 {
2932 val = ASMRdMsr(MSR_IA32_FEATURE_CONTROL);
2933 /*
2934 * Both the LOCK and VMXON bit must be set; otherwise VMXON will generate a #GP.
2935 * Once the lock bit is set, this MSR can no longer be modified.
2936 */
2937 if ( (val & (MSR_IA32_FEATURE_CONTROL_VMXON|MSR_IA32_FEATURE_CONTROL_LOCK))
2938 == (MSR_IA32_FEATURE_CONTROL_VMXON|MSR_IA32_FEATURE_CONTROL_LOCK) /* enabled and locked */
2939 || !(val & MSR_IA32_FEATURE_CONTROL_LOCK) /* not enabled, but not locked either */
2940 )
2941 {
2942 VMX_CAPABILITY vtCaps;
2943
2944 *pfCaps |= SUPVTCAPS_VT_X;
2945
2946 vtCaps.u = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS);
2947 if (vtCaps.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
2948 {
2949 vtCaps.u = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS2);
2950 if (vtCaps.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_EPT)
2951 *pfCaps |= SUPVTCAPS_NESTED_PAGING;
2952 }
2953 return VINF_SUCCESS;
2954 }
2955 return VERR_VMX_MSR_LOCKED_OR_DISABLED;
2956 }
2957 return VERR_VMX_NO_VMX;
2958 }
2959
2960 if ( u32VendorEBX == X86_CPUID_VENDOR_AMD_EBX
2961 && u32VendorECX == X86_CPUID_VENDOR_AMD_ECX
2962 && u32VendorEDX == X86_CPUID_VENDOR_AMD_EDX
2963 )
2964 {
2965 if ( (u32AMDFeatureECX & X86_CPUID_AMD_FEATURE_ECX_SVM)
2966 && (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_MSR)
2967 && (u32FeaturesEDX & X86_CPUID_FEATURE_EDX_FXSR)
2968 )
2969 {
2970 /* Check if SVM is disabled */
2971 val = ASMRdMsr(MSR_K8_VM_CR);
2972 if (!(val & MSR_K8_VM_CR_SVM_DISABLE))
2973 {
2974 *pfCaps |= SUPVTCAPS_AMD_V;
2975
2976 /* Query AMD features. */
2977 ASMCpuId(0x8000000A, &u32Dummy, &u32Dummy, &u32Dummy, &u32FeaturesEDX);
2978
2979 if (u32FeaturesEDX & AMD_CPUID_SVM_FEATURE_EDX_NESTED_PAGING)
2980 *pfCaps |= SUPVTCAPS_NESTED_PAGING;
2981
2982 return VINF_SUCCESS;
2983 }
2984 return VERR_SVM_DISABLED;
2985 }
2986 return VERR_SVM_NO_SVM;
2987 }
2988 }
2989
2990 return VERR_UNSUPPORTED_CPU;
2991}
2992
2993
2994/**
2995 * (Re-)initializes the per-cpu structure prior to starting or resuming the GIP
2996 * updating.
2997 *
2998 * @param pGipCpu The per CPU structure for this CPU.
2999 * @param u64NanoTS The current time.
3000 */
3001static void supdrvGipReInitCpu(PSUPGIPCPU pGipCpu, uint64_t u64NanoTS)
3002{
3003 pGipCpu->u64TSC = ASMReadTSC() - pGipCpu->u32UpdateIntervalTSC;
3004 pGipCpu->u64NanoTS = u64NanoTS;
3005}
3006
3007
3008/**
3009 * Set the current TSC and NanoTS value for the CPU.
3010 *
3011 * @param idCpu The CPU ID. Unused - we have to use the APIC ID.
3012 * @param pvUser1 Pointer to the ring-0 GIP mapping.
3013 * @param pvUser2 Pointer to the variable holding the current time.
3014 */
3015static DECLCALLBACK(void) supdrvGipReInitCpuCallback(RTCPUID idCpu, void *pvUser1, void *pvUser2)
3016{
3017 PSUPGLOBALINFOPAGE pGip = (PSUPGLOBALINFOPAGE)pvUser1;
3018 unsigned iCpu = ASMGetApicId();
3019
3020 if (RT_LIKELY(iCpu < RT_ELEMENTS(pGip->aCPUs)))
3021 supdrvGipReInitCpu(&pGip->aCPUs[iCpu], *(uint64_t *)pvUser2);
3022
3023 NOREF(pvUser2);
3024 NOREF(idCpu);
3025}
3026
3027
3028/**
3029 * Maps the GIP into userspace and/or get the physical address of the GIP.
3030 *
3031 * @returns IPRT status code.
3032 * @param pSession Session to which the GIP mapping should belong.
3033 * @param ppGipR3 Where to store the address of the ring-3 mapping. (optional)
3034 * @param pHCPhysGip Where to store the physical address. (optional)
3035 *
3036 * @remark There is no reference counting on the mapping, so one call to this function
3037 * count globally as one reference. One call to SUPR0GipUnmap() is will unmap GIP
3038 * and remove the session as a GIP user.
3039 */
3040SUPR0DECL(int) SUPR0GipMap(PSUPDRVSESSION pSession, PRTR3PTR ppGipR3, PRTHCPHYS pHCPhysGip)
3041{
3042 int rc;
3043 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
3044 RTR3PTR pGipR3 = NIL_RTR3PTR;
3045 RTHCPHYS HCPhys = NIL_RTHCPHYS;
3046 LogFlow(("SUPR0GipMap: pSession=%p ppGipR3=%p pHCPhysGip=%p\n", pSession, ppGipR3, pHCPhysGip));
3047
3048 /*
3049 * Validate
3050 */
3051 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3052 AssertPtrNullReturn(ppGipR3, VERR_INVALID_POINTER);
3053 AssertPtrNullReturn(pHCPhysGip, VERR_INVALID_POINTER);
3054
3055#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3056 RTSemMutexRequest(pDevExt->mtxGip, RT_INDEFINITE_WAIT);
3057#else
3058 RTSemFastMutexRequest(pDevExt->mtxGip);
3059#endif
3060 if (pDevExt->pGip)
3061 {
3062 /*
3063 * Map it?
3064 */
3065 rc = VINF_SUCCESS;
3066 if (ppGipR3)
3067 {
3068 if (pSession->GipMapObjR3 == NIL_RTR0MEMOBJ)
3069 rc = RTR0MemObjMapUser(&pSession->GipMapObjR3, pDevExt->GipMemObj, (RTR3PTR)-1, 0,
3070 RTMEM_PROT_READ, RTR0ProcHandleSelf());
3071 if (RT_SUCCESS(rc))
3072 pGipR3 = RTR0MemObjAddressR3(pSession->GipMapObjR3);
3073 }
3074
3075 /*
3076 * Get physical address.
3077 */
3078 if (pHCPhysGip && RT_SUCCESS(rc))
3079 HCPhys = pDevExt->HCPhysGip;
3080
3081 /*
3082 * Reference globally.
3083 */
3084 if (!pSession->fGipReferenced && RT_SUCCESS(rc))
3085 {
3086 pSession->fGipReferenced = 1;
3087 pDevExt->cGipUsers++;
3088 if (pDevExt->cGipUsers == 1)
3089 {
3090 PSUPGLOBALINFOPAGE pGipR0 = pDevExt->pGip;
3091 uint64_t u64NanoTS;
3092 unsigned i;
3093
3094 LogFlow(("SUPR0GipMap: Resumes GIP updating\n"));
3095
3096 if (pGipR0->aCPUs[0].u32TransactionId != 2 /* not the first time */)
3097 {
3098 for (i = 0; i < RT_ELEMENTS(pGipR0->aCPUs); i++)
3099 ASMAtomicUoWriteU32(&pGipR0->aCPUs[i].u32TransactionId,
3100 (pGipR0->aCPUs[i].u32TransactionId + GIP_UPDATEHZ_RECALC_FREQ * 2)
3101 & ~(GIP_UPDATEHZ_RECALC_FREQ * 2 - 1));
3102 ASMAtomicWriteU64(&pGipR0->u64NanoTSLastUpdateHz, 0);
3103 }
3104
3105 u64NanoTS = RTTimeSystemNanoTS() - pGipR0->u32UpdateIntervalNS;
3106 if ( pGipR0->u32Mode == SUPGIPMODE_SYNC_TSC
3107 || RTMpGetOnlineCount() == 1)
3108 supdrvGipReInitCpu(&pGipR0->aCPUs[0], u64NanoTS);
3109 else
3110 RTMpOnAll(supdrvGipReInitCpuCallback, pGipR0, &u64NanoTS);
3111
3112 rc = RTTimerStart(pDevExt->pGipTimer, 0);
3113 AssertRC(rc); rc = VINF_SUCCESS;
3114 }
3115 }
3116 }
3117 else
3118 {
3119 rc = VERR_GENERAL_FAILURE;
3120 Log(("SUPR0GipMap: GIP is not available!\n"));
3121 }
3122#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3123 RTSemMutexRelease(pDevExt->mtxGip);
3124#else
3125 RTSemFastMutexRelease(pDevExt->mtxGip);
3126#endif
3127
3128 /*
3129 * Write returns.
3130 */
3131 if (pHCPhysGip)
3132 *pHCPhysGip = HCPhys;
3133 if (ppGipR3)
3134 *ppGipR3 = pGipR3;
3135
3136#ifdef DEBUG_DARWIN_GIP
3137 OSDBGPRINT(("SUPR0GipMap: returns %d *pHCPhysGip=%lx pGipR3=%p\n", rc, (unsigned long)HCPhys, (void *)pGipR3));
3138#else
3139 LogFlow(( "SUPR0GipMap: returns %d *pHCPhysGip=%lx pGipR3=%p\n", rc, (unsigned long)HCPhys, (void *)pGipR3));
3140#endif
3141 return rc;
3142}
3143
3144
3145/**
3146 * Unmaps any user mapping of the GIP and terminates all GIP access
3147 * from this session.
3148 *
3149 * @returns IPRT status code.
3150 * @param pSession Session to which the GIP mapping should belong.
3151 */
3152SUPR0DECL(int) SUPR0GipUnmap(PSUPDRVSESSION pSession)
3153{
3154 int rc = VINF_SUCCESS;
3155 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
3156#ifdef DEBUG_DARWIN_GIP
3157 OSDBGPRINT(("SUPR0GipUnmap: pSession=%p pGip=%p GipMapObjR3=%p\n",
3158 pSession,
3159 pSession->GipMapObjR3 != NIL_RTR0MEMOBJ ? RTR0MemObjAddress(pSession->GipMapObjR3) : NULL,
3160 pSession->GipMapObjR3));
3161#else
3162 LogFlow(("SUPR0GipUnmap: pSession=%p\n", pSession));
3163#endif
3164 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3165
3166#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3167 RTSemMutexRequest(pDevExt->mtxGip, RT_INDEFINITE_WAIT);
3168#else
3169 RTSemFastMutexRequest(pDevExt->mtxGip);
3170#endif
3171
3172 /*
3173 * Unmap anything?
3174 */
3175 if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
3176 {
3177 rc = RTR0MemObjFree(pSession->GipMapObjR3, false);
3178 AssertRC(rc);
3179 if (RT_SUCCESS(rc))
3180 pSession->GipMapObjR3 = NIL_RTR0MEMOBJ;
3181 }
3182
3183 /*
3184 * Dereference global GIP.
3185 */
3186 if (pSession->fGipReferenced && !rc)
3187 {
3188 pSession->fGipReferenced = 0;
3189 if ( pDevExt->cGipUsers > 0
3190 && !--pDevExt->cGipUsers)
3191 {
3192 LogFlow(("SUPR0GipUnmap: Suspends GIP updating\n"));
3193 rc = RTTimerStop(pDevExt->pGipTimer); AssertRC(rc); rc = VINF_SUCCESS;
3194 }
3195 }
3196
3197#ifdef SUPDRV_USE_MUTEX_FOR_GIP
3198 RTSemMutexRelease(pDevExt->mtxGip);
3199#else
3200 RTSemFastMutexRelease(pDevExt->mtxGip);
3201#endif
3202
3203 return rc;
3204}
3205
3206
3207/**
3208 * Gets the GIP pointer.
3209 *
3210 * @returns Pointer to the GIP or NULL.
3211 */
3212SUPDECL(PSUPGLOBALINFOPAGE) SUPGetGIP(void)
3213{
3214 return g_pSUPGlobalInfoPage;
3215}
3216
3217
3218/**
3219 * Register a component factory with the support driver.
3220 *
3221 * This is currently restricted to kernel sessions only.
3222 *
3223 * @returns VBox status code.
3224 * @retval VINF_SUCCESS on success.
3225 * @retval VERR_NO_MEMORY if we're out of memory.
3226 * @retval VERR_ALREADY_EXISTS if the factory has already been registered.
3227 * @retval VERR_ACCESS_DENIED if it isn't a kernel session.
3228 * @retval VERR_INVALID_PARAMETER on invalid parameter.
3229 * @retval VERR_INVALID_POINTER on invalid pointer parameter.
3230 *
3231 * @param pSession The SUPDRV session (must be a ring-0 session).
3232 * @param pFactory Pointer to the component factory registration structure.
3233 *
3234 * @remarks This interface is also available via SUPR0IdcComponentRegisterFactory.
3235 */
3236SUPR0DECL(int) SUPR0ComponentRegisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
3237{
3238 PSUPDRVFACTORYREG pNewReg;
3239 const char *psz;
3240 int rc;
3241
3242 /*
3243 * Validate parameters.
3244 */
3245 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3246 AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
3247 AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
3248 AssertPtrReturn(pFactory->pfnQueryFactoryInterface, VERR_INVALID_POINTER);
3249 psz = (const char *)memchr(pFactory->szName, '\0', sizeof(pFactory->szName));
3250 AssertReturn(psz, VERR_INVALID_PARAMETER);
3251
3252 /*
3253 * Allocate and initialize a new registration structure.
3254 */
3255 pNewReg = (PSUPDRVFACTORYREG)RTMemAlloc(sizeof(SUPDRVFACTORYREG));
3256 if (pNewReg)
3257 {
3258 pNewReg->pNext = NULL;
3259 pNewReg->pFactory = pFactory;
3260 pNewReg->pSession = pSession;
3261 pNewReg->cchName = psz - &pFactory->szName[0];
3262
3263 /*
3264 * Add it to the tail of the list after checking for prior registration.
3265 */
3266 rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3267 if (RT_SUCCESS(rc))
3268 {
3269 PSUPDRVFACTORYREG pPrev = NULL;
3270 PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3271 while (pCur && pCur->pFactory != pFactory)
3272 {
3273 pPrev = pCur;
3274 pCur = pCur->pNext;
3275 }
3276 if (!pCur)
3277 {
3278 if (pPrev)
3279 pPrev->pNext = pNewReg;
3280 else
3281 pSession->pDevExt->pComponentFactoryHead = pNewReg;
3282 rc = VINF_SUCCESS;
3283 }
3284 else
3285 rc = VERR_ALREADY_EXISTS;
3286
3287 RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3288 }
3289
3290 if (RT_FAILURE(rc))
3291 RTMemFree(pNewReg);
3292 }
3293 else
3294 rc = VERR_NO_MEMORY;
3295 return rc;
3296}
3297
3298
3299/**
3300 * Deregister a component factory.
3301 *
3302 * @returns VBox status code.
3303 * @retval VINF_SUCCESS on success.
3304 * @retval VERR_NOT_FOUND if the factory wasn't registered.
3305 * @retval VERR_ACCESS_DENIED if it isn't a kernel session.
3306 * @retval VERR_INVALID_PARAMETER on invalid parameter.
3307 * @retval VERR_INVALID_POINTER on invalid pointer parameter.
3308 *
3309 * @param pSession The SUPDRV session (must be a ring-0 session).
3310 * @param pFactory Pointer to the component factory registration structure
3311 * previously passed SUPR0ComponentRegisterFactory().
3312 *
3313 * @remarks This interface is also available via SUPR0IdcComponentDeregisterFactory.
3314 */
3315SUPR0DECL(int) SUPR0ComponentDeregisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
3316{
3317 int rc;
3318
3319 /*
3320 * Validate parameters.
3321 */
3322 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3323 AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
3324 AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
3325
3326 /*
3327 * Take the lock and look for the registration record.
3328 */
3329 rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3330 if (RT_SUCCESS(rc))
3331 {
3332 PSUPDRVFACTORYREG pPrev = NULL;
3333 PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3334 while (pCur && pCur->pFactory != pFactory)
3335 {
3336 pPrev = pCur;
3337 pCur = pCur->pNext;
3338 }
3339 if (pCur)
3340 {
3341 if (!pPrev)
3342 pSession->pDevExt->pComponentFactoryHead = pCur->pNext;
3343 else
3344 pPrev->pNext = pCur->pNext;
3345
3346 pCur->pNext = NULL;
3347 pCur->pFactory = NULL;
3348 pCur->pSession = NULL;
3349 rc = VINF_SUCCESS;
3350 }
3351 else
3352 rc = VERR_NOT_FOUND;
3353
3354 RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3355
3356 RTMemFree(pCur);
3357 }
3358 return rc;
3359}
3360
3361
3362/**
3363 * Queries a component factory.
3364 *
3365 * @returns VBox status code.
3366 * @retval VERR_INVALID_PARAMETER on invalid parameter.
3367 * @retval VERR_INVALID_POINTER on invalid pointer parameter.
3368 * @retval VERR_SUPDRV_COMPONENT_NOT_FOUND if the component factory wasn't found.
3369 * @retval VERR_SUPDRV_INTERFACE_NOT_SUPPORTED if the interface wasn't supported.
3370 *
3371 * @param pSession The SUPDRV session.
3372 * @param pszName The name of the component factory.
3373 * @param pszInterfaceUuid The UUID of the factory interface (stringified).
3374 * @param ppvFactoryIf Where to store the factory interface.
3375 */
3376SUPR0DECL(int) SUPR0ComponentQueryFactory(PSUPDRVSESSION pSession, const char *pszName, const char *pszInterfaceUuid, void **ppvFactoryIf)
3377{
3378 const char *pszEnd;
3379 size_t cchName;
3380 int rc;
3381
3382 /*
3383 * Validate parameters.
3384 */
3385 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3386
3387 AssertPtrReturn(pszName, VERR_INVALID_POINTER);
3388 pszEnd = memchr(pszName, '\0', RT_SIZEOFMEMB(SUPDRVFACTORY, szName));
3389 AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
3390 cchName = pszEnd - pszName;
3391
3392 AssertPtrReturn(pszInterfaceUuid, VERR_INVALID_POINTER);
3393 pszEnd = memchr(pszInterfaceUuid, '\0', RTUUID_STR_LENGTH);
3394 AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
3395
3396 AssertPtrReturn(ppvFactoryIf, VERR_INVALID_POINTER);
3397 *ppvFactoryIf = NULL;
3398
3399 /*
3400 * Take the lock and try all factories by this name.
3401 */
3402 rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
3403 if (RT_SUCCESS(rc))
3404 {
3405 PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
3406 rc = VERR_SUPDRV_COMPONENT_NOT_FOUND;
3407 while (pCur)
3408 {
3409 if ( pCur->cchName == cchName
3410 && !memcmp(pCur->pFactory->szName, pszName, cchName))
3411 {
3412 void *pvFactory = pCur->pFactory->pfnQueryFactoryInterface(pCur->pFactory, pSession, pszInterfaceUuid);
3413 if (pvFactory)
3414 {
3415 *ppvFactoryIf = pvFactory;
3416 rc = VINF_SUCCESS;
3417 break;
3418 }
3419 rc = VERR_SUPDRV_INTERFACE_NOT_SUPPORTED;
3420 }
3421
3422 /* next */
3423 pCur = pCur->pNext;
3424 }
3425
3426 RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
3427 }
3428 return rc;
3429}
3430
3431
3432/**
3433 * Adds a memory object to the session.
3434 *
3435 * @returns IPRT status code.
3436 * @param pMem Memory tracking structure containing the
3437 * information to track.
3438 * @param pSession The session.
3439 */
3440static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession)
3441{
3442 PSUPDRVBUNDLE pBundle;
3443 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3444
3445 /*
3446 * Find free entry and record the allocation.
3447 */
3448 RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3449 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3450 {
3451 if (pBundle->cUsed < RT_ELEMENTS(pBundle->aMem))
3452 {
3453 unsigned i;
3454 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3455 {
3456 if (pBundle->aMem[i].MemObj == NIL_RTR0MEMOBJ)
3457 {
3458 pBundle->cUsed++;
3459 pBundle->aMem[i] = *pMem;
3460 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3461 return VINF_SUCCESS;
3462 }
3463 }
3464 AssertFailed(); /* !!this can't be happening!!! */
3465 }
3466 }
3467 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3468
3469 /*
3470 * Need to allocate a new bundle.
3471 * Insert into the last entry in the bundle.
3472 */
3473 pBundle = (PSUPDRVBUNDLE)RTMemAllocZ(sizeof(*pBundle));
3474 if (!pBundle)
3475 return VERR_NO_MEMORY;
3476
3477 /* take last entry. */
3478 pBundle->cUsed++;
3479 pBundle->aMem[RT_ELEMENTS(pBundle->aMem) - 1] = *pMem;
3480
3481 /* insert into list. */
3482 RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3483 pBundle->pNext = pSession->Bundle.pNext;
3484 pSession->Bundle.pNext = pBundle;
3485 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3486
3487 return VINF_SUCCESS;
3488}
3489
3490
3491/**
3492 * Releases a memory object referenced by pointer and type.
3493 *
3494 * @returns IPRT status code.
3495 * @param pSession Session data.
3496 * @param uPtr Pointer to memory. This is matched against both the R0 and R3 addresses.
3497 * @param eType Memory type.
3498 */
3499static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType)
3500{
3501 PSUPDRVBUNDLE pBundle;
3502 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3503
3504 /*
3505 * Validate input.
3506 */
3507 if (!uPtr)
3508 {
3509 Log(("Illegal address %p\n", (void *)uPtr));
3510 return VERR_INVALID_PARAMETER;
3511 }
3512
3513 /*
3514 * Search for the address.
3515 */
3516 RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
3517 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3518 {
3519 if (pBundle->cUsed > 0)
3520 {
3521 unsigned i;
3522 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3523 {
3524 if ( pBundle->aMem[i].eType == eType
3525 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3526 && ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
3527 || ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
3528 && RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr))
3529 )
3530 {
3531 /* Make a copy of it and release it outside the spinlock. */
3532 SUPDRVMEMREF Mem = pBundle->aMem[i];
3533 pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
3534 pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
3535 pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
3536 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3537
3538 if (Mem.MapObjR3 != NIL_RTR0MEMOBJ)
3539 {
3540 int rc = RTR0MemObjFree(Mem.MapObjR3, false);
3541 AssertRC(rc); /** @todo figure out how to handle this. */
3542 }
3543 if (Mem.MemObj != NIL_RTR0MEMOBJ)
3544 {
3545 int rc = RTR0MemObjFree(Mem.MemObj, true /* fFreeMappings */);
3546 AssertRC(rc); /** @todo figure out how to handle this. */
3547 }
3548 return VINF_SUCCESS;
3549 }
3550 }
3551 }
3552 }
3553 RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
3554 Log(("Failed to find %p!!! (eType=%d)\n", (void *)uPtr, eType));
3555 return VERR_INVALID_PARAMETER;
3556}
3557
3558
3559/**
3560 * Opens an image. If it's the first time it's opened the call must upload
3561 * the bits using the supdrvIOCtl_LdrLoad() / SUPDRV_IOCTL_LDR_LOAD function.
3562 *
3563 * This is the 1st step of the loading.
3564 *
3565 * @returns IPRT status code.
3566 * @param pDevExt Device globals.
3567 * @param pSession Session data.
3568 * @param pReq The open request.
3569 */
3570static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq)
3571{
3572 int rc;
3573 PSUPDRVLDRIMAGE pImage;
3574 void *pv;
3575 size_t cchName = strlen(pReq->u.In.szName); /* (caller checked < 32). */
3576 LogFlow(("supdrvIOCtl_LdrOpen: szName=%s cbImageWithTabs=%d\n", pReq->u.In.szName, pReq->u.In.cbImageWithTabs));
3577
3578 /*
3579 * Check if we got an instance of the image already.
3580 */
3581 supdrvLdrLock(pDevExt);
3582 for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
3583 {
3584 if ( pImage->szName[cchName] == '\0'
3585 && !memcmp(pImage->szName, pReq->u.In.szName, cchName))
3586 {
3587 /** @todo check cbImageBits and cbImageWithTabs here, if they differs that indicates that the images are different. */
3588 pImage->cUsage++;
3589 pReq->u.Out.pvImageBase = pImage->pvImage;
3590 pReq->u.Out.fNeedsLoading = pImage->uState == SUP_IOCTL_LDR_OPEN;
3591 pReq->u.Out.fNativeLoader = pImage->fNative;
3592 supdrvLdrAddUsage(pSession, pImage);
3593 supdrvLdrUnlock(pDevExt);
3594 return VINF_SUCCESS;
3595 }
3596 }
3597 /* (not found - add it!) */
3598
3599 /*
3600 * Allocate memory.
3601 */
3602 pv = RTMemAlloc(RT_OFFSETOF(SUPDRVLDRIMAGE, szName[cchName + 1]));
3603 if (!pv)
3604 {
3605 supdrvLdrUnlock(pDevExt);
3606 Log(("supdrvIOCtl_LdrOpen: RTMemAlloc() failed\n"));
3607 return VERR_NO_MEMORY;
3608 }
3609
3610 /*
3611 * Setup and link in the LDR stuff.
3612 */
3613 pImage = (PSUPDRVLDRIMAGE)pv;
3614 pImage->pvImage = NULL;
3615 pImage->pvImageAlloc = NULL;
3616 pImage->cbImageWithTabs = pReq->u.In.cbImageWithTabs;
3617 pImage->cbImageBits = pReq->u.In.cbImageBits;
3618 pImage->cSymbols = 0;
3619 pImage->paSymbols = NULL;
3620 pImage->pachStrTab = NULL;
3621 pImage->cbStrTab = 0;
3622 pImage->pfnModuleInit = NULL;
3623 pImage->pfnModuleTerm = NULL;
3624 pImage->pfnServiceReqHandler = NULL;
3625 pImage->uState = SUP_IOCTL_LDR_OPEN;
3626 pImage->cUsage = 1;
3627 memcpy(pImage->szName, pReq->u.In.szName, cchName + 1);
3628
3629 /*
3630 * Try load it using the native loader, if that isn't supported, fall back
3631 * on the older method.
3632 */
3633 pImage->fNative = true;
3634 rc = supdrvOSLdrOpen(pDevExt, pImage, pReq->u.In.szFilename);
3635 if (rc == VERR_NOT_SUPPORTED)
3636 {
3637 pImage->pvImageAlloc = RTMemExecAlloc(pImage->cbImageBits + 31);
3638 pImage->pvImage = RT_ALIGN_P(pImage->pvImageAlloc, 32);
3639 pImage->fNative = false;
3640 rc = pImage->pvImageAlloc ? VINF_SUCCESS : VERR_NO_MEMORY;
3641 }
3642 if (RT_FAILURE(rc))
3643 {
3644 supdrvLdrUnlock(pDevExt);
3645 RTMemFree(pImage);
3646 Log(("supdrvIOCtl_LdrOpen(%s): failed - %Rrc\n", pReq->u.In.szName, rc));
3647 return rc;
3648 }
3649 Assert(VALID_PTR(pImage->pvImage) || RT_FAILURE(rc));
3650
3651 /*
3652 * Link it.
3653 */
3654 pImage->pNext = pDevExt->pLdrImages;
3655 pDevExt->pLdrImages = pImage;
3656
3657 supdrvLdrAddUsage(pSession, pImage);
3658
3659 pReq->u.Out.pvImageBase = pImage->pvImage;
3660 pReq->u.Out.fNeedsLoading = true;
3661 pReq->u.Out.fNativeLoader = pImage->fNative;
3662 supdrvLdrUnlock(pDevExt);
3663
3664#if defined(RT_OS_WINDOWS) && defined(DEBUG)
3665 SUPR0Printf("VBoxDrv: windbg> .reload /f %s=%#p\n", pImage->szName, pImage->pvImage);
3666#endif
3667 return VINF_SUCCESS;
3668}
3669
3670
3671/**
3672 * Worker that validates a pointer to an image entrypoint.
3673 *
3674 * @returns IPRT status code.
3675 * @param pDevExt The device globals.
3676 * @param pImage The loader image.
3677 * @param pv The pointer into the image.
3678 * @param fMayBeNull Whether it may be NULL.
3679 * @param pszWhat What is this entrypoint? (for logging)
3680 * @param pbImageBits The image bits prepared by ring-3.
3681 *
3682 * @remarks Will leave the lock on failure.
3683 */
3684static int supdrvLdrValidatePointer(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage, void *pv,
3685 bool fMayBeNull, const uint8_t *pbImageBits, const char *pszWhat)
3686{
3687 if (!fMayBeNull || pv)
3688 {
3689 if ((uintptr_t)pv - (uintptr_t)pImage->pvImage >= pImage->cbImageBits)
3690 {
3691 supdrvLdrUnlock(pDevExt);
3692 Log(("Out of range (%p LB %#x): %s=%p\n", pImage->pvImage, pImage->cbImageBits, pszWhat, pv));
3693 return VERR_INVALID_PARAMETER;
3694 }
3695
3696 if (pImage->fNative)
3697 {
3698 int rc = supdrvOSLdrValidatePointer(pDevExt, pImage, pv, pbImageBits);
3699 if (RT_FAILURE(rc))
3700 {
3701 supdrvLdrUnlock(pDevExt);
3702 Log(("Bad entry point address: %s=%p (rc=%Rrc)\n", pszWhat, pv, rc));
3703 return rc;
3704 }
3705 }
3706 }
3707 return VINF_SUCCESS;
3708}
3709
3710
3711/**
3712 * Loads the image bits.
3713 *
3714 * This is the 2nd step of the loading.
3715 *
3716 * @returns IPRT status code.
3717 * @param pDevExt Device globals.
3718 * @param pSession Session data.
3719 * @param pReq The request.
3720 */
3721static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq)
3722{
3723 PSUPDRVLDRUSAGE pUsage;
3724 PSUPDRVLDRIMAGE pImage;
3725 int rc;
3726 LogFlow(("supdrvIOCtl_LdrLoad: pvImageBase=%p cbImageWithBits=%d\n", pReq->u.In.pvImageBase, pReq->u.In.cbImageWithTabs));
3727
3728 /*
3729 * Find the ldr image.
3730 */
3731 supdrvLdrLock(pDevExt);
3732 pUsage = pSession->pLdrUsage;
3733 while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
3734 pUsage = pUsage->pNext;
3735 if (!pUsage)
3736 {
3737 supdrvLdrUnlock(pDevExt);
3738 Log(("SUP_IOCTL_LDR_LOAD: couldn't find image!\n"));
3739 return VERR_INVALID_HANDLE;
3740 }
3741 pImage = pUsage->pImage;
3742
3743 /*
3744 * Validate input.
3745 */
3746 if ( pImage->cbImageWithTabs != pReq->u.In.cbImageWithTabs
3747 || pImage->cbImageBits != pReq->u.In.cbImageBits)
3748 {
3749 supdrvLdrUnlock(pDevExt);
3750 Log(("SUP_IOCTL_LDR_LOAD: image size mismatch!! %d(prep) != %d(load) or %d != %d\n",
3751 pImage->cbImageWithTabs, pReq->u.In.cbImageWithTabs, pImage->cbImageBits, pReq->u.In.cbImageBits));
3752 return VERR_INVALID_HANDLE;
3753 }
3754
3755 if (pImage->uState != SUP_IOCTL_LDR_OPEN)
3756 {
3757 unsigned uState = pImage->uState;
3758 supdrvLdrUnlock(pDevExt);
3759 if (uState != SUP_IOCTL_LDR_LOAD)
3760 AssertMsgFailed(("SUP_IOCTL_LDR_LOAD: invalid image state %d (%#x)!\n", uState, uState));
3761 return VERR_ALREADY_LOADED;
3762 }
3763
3764 switch (pReq->u.In.eEPType)
3765 {
3766 case SUPLDRLOADEP_NOTHING:
3767 break;
3768
3769 case SUPLDRLOADEP_VMMR0:
3770 rc = supdrvLdrValidatePointer( pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0, false, pReq->u.In.abImage, "pvVMMR0");
3771 if (RT_SUCCESS(rc))
3772 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt, false, pReq->u.In.abImage, "pvVMMR0EntryInt");
3773 if (RT_SUCCESS(rc))
3774 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, false, pReq->u.In.abImage, "pvVMMR0EntryFast");
3775 if (RT_SUCCESS(rc))
3776 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx, false, pReq->u.In.abImage, "pvVMMR0EntryEx");
3777 if (RT_FAILURE(rc))
3778 return rc;
3779 break;
3780
3781 case SUPLDRLOADEP_SERVICE:
3782 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.Service.pfnServiceReq, false, pReq->u.In.abImage, "pfnServiceReq");
3783 if (RT_FAILURE(rc))
3784 return rc;
3785 if ( pReq->u.In.EP.Service.apvReserved[0] != NIL_RTR0PTR
3786 || pReq->u.In.EP.Service.apvReserved[1] != NIL_RTR0PTR
3787 || pReq->u.In.EP.Service.apvReserved[2] != NIL_RTR0PTR)
3788 {
3789 supdrvLdrUnlock(pDevExt);
3790 Log(("Out of range (%p LB %#x): apvReserved={%p,%p,%p} MBZ!\n",
3791 pImage->pvImage, pReq->u.In.cbImageWithTabs,
3792 pReq->u.In.EP.Service.apvReserved[0],
3793 pReq->u.In.EP.Service.apvReserved[1],
3794 pReq->u.In.EP.Service.apvReserved[2]));
3795 return VERR_INVALID_PARAMETER;
3796 }
3797 break;
3798
3799 default:
3800 supdrvLdrUnlock(pDevExt);
3801 Log(("Invalid eEPType=%d\n", pReq->u.In.eEPType));
3802 return VERR_INVALID_PARAMETER;
3803 }
3804
3805 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.pfnModuleInit, true, pReq->u.In.abImage, "pfnModuleInit");
3806 if (RT_FAILURE(rc))
3807 return rc;
3808 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.pfnModuleTerm, true, pReq->u.In.abImage, "pfnModuleTerm");
3809 if (RT_FAILURE(rc))
3810 return rc;
3811
3812 /*
3813 * Allocate and copy the tables.
3814 * (No need to do try/except as this is a buffered request.)
3815 */
3816 pImage->cbStrTab = pReq->u.In.cbStrTab;
3817 if (pImage->cbStrTab)
3818 {
3819 pImage->pachStrTab = (char *)RTMemAlloc(pImage->cbStrTab);
3820 if (pImage->pachStrTab)
3821 memcpy(pImage->pachStrTab, &pReq->u.In.abImage[pReq->u.In.offStrTab], pImage->cbStrTab);
3822 else
3823 rc = VERR_NO_MEMORY;
3824 }
3825
3826 pImage->cSymbols = pReq->u.In.cSymbols;
3827 if (RT_SUCCESS(rc) && pImage->cSymbols)
3828 {
3829 size_t cbSymbols = pImage->cSymbols * sizeof(SUPLDRSYM);
3830 pImage->paSymbols = (PSUPLDRSYM)RTMemAlloc(cbSymbols);
3831 if (pImage->paSymbols)
3832 memcpy(pImage->paSymbols, &pReq->u.In.abImage[pReq->u.In.offSymbols], cbSymbols);
3833 else
3834 rc = VERR_NO_MEMORY;
3835 }
3836
3837 /*
3838 * Copy the bits / complete native loading.
3839 */
3840 if (RT_SUCCESS(rc))
3841 {
3842 pImage->uState = SUP_IOCTL_LDR_LOAD;
3843 pImage->pfnModuleInit = pReq->u.In.pfnModuleInit;
3844 pImage->pfnModuleTerm = pReq->u.In.pfnModuleTerm;
3845
3846 if (pImage->fNative)
3847 rc = supdrvOSLdrLoad(pDevExt, pImage, pReq->u.In.abImage);
3848 else
3849 memcpy(pImage->pvImage, &pReq->u.In.abImage[0], pImage->cbImageBits);
3850 }
3851
3852 /*
3853 * Update any entry points.
3854 */
3855 if (RT_SUCCESS(rc))
3856 {
3857 switch (pReq->u.In.eEPType)
3858 {
3859 default:
3860 case SUPLDRLOADEP_NOTHING:
3861 rc = VINF_SUCCESS;
3862 break;
3863 case SUPLDRLOADEP_VMMR0:
3864 rc = supdrvLdrSetVMMR0EPs(pDevExt, pReq->u.In.EP.VMMR0.pvVMMR0, pReq->u.In.EP.VMMR0.pvVMMR0EntryInt,
3865 pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx);
3866 break;
3867 case SUPLDRLOADEP_SERVICE:
3868 pImage->pfnServiceReqHandler = pReq->u.In.EP.Service.pfnServiceReq;
3869 rc = VINF_SUCCESS;
3870 break;
3871 }
3872 }
3873
3874 /*
3875 * On success call the module initialization.
3876 */
3877 LogFlow(("supdrvIOCtl_LdrLoad: pfnModuleInit=%p\n", pImage->pfnModuleInit));
3878 if (RT_SUCCESS(rc) && pImage->pfnModuleInit)
3879 {
3880 Log(("supdrvIOCtl_LdrLoad: calling pfnModuleInit=%p\n", pImage->pfnModuleInit));
3881 rc = pImage->pfnModuleInit();
3882 if (rc && pDevExt->pvVMMR0 == pImage->pvImage)
3883 supdrvLdrUnsetVMMR0EPs(pDevExt);
3884 }
3885
3886 if (RT_FAILURE(rc))
3887 {
3888 pImage->uState = SUP_IOCTL_LDR_OPEN;
3889 pImage->pfnModuleInit = NULL;
3890 pImage->pfnModuleTerm = NULL;
3891 pImage->pfnServiceReqHandler= NULL;
3892 pImage->cbStrTab = 0;
3893 RTMemFree(pImage->pachStrTab);
3894 pImage->pachStrTab = NULL;
3895 RTMemFree(pImage->paSymbols);
3896 pImage->paSymbols = NULL;
3897 pImage->cSymbols = 0;
3898 }
3899
3900 supdrvLdrUnlock(pDevExt);
3901 return rc;
3902}
3903
3904
3905/**
3906 * Frees a previously loaded (prep'ed) image.
3907 *
3908 * @returns IPRT status code.
3909 * @param pDevExt Device globals.
3910 * @param pSession Session data.
3911 * @param pReq The request.
3912 */
3913static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq)
3914{
3915 int rc;
3916 PSUPDRVLDRUSAGE pUsagePrev;
3917 PSUPDRVLDRUSAGE pUsage;
3918 PSUPDRVLDRIMAGE pImage;
3919 LogFlow(("supdrvIOCtl_LdrFree: pvImageBase=%p\n", pReq->u.In.pvImageBase));
3920
3921 /*
3922 * Find the ldr image.
3923 */
3924 supdrvLdrLock(pDevExt);
3925 pUsagePrev = NULL;
3926 pUsage = pSession->pLdrUsage;
3927 while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
3928 {
3929 pUsagePrev = pUsage;
3930 pUsage = pUsage->pNext;
3931 }
3932 if (!pUsage)
3933 {
3934 supdrvLdrUnlock(pDevExt);
3935 Log(("SUP_IOCTL_LDR_FREE: couldn't find image!\n"));
3936 return VERR_INVALID_HANDLE;
3937 }
3938
3939 /*
3940 * Check if we can remove anything.
3941 */
3942 rc = VINF_SUCCESS;
3943 pImage = pUsage->pImage;
3944 if (pImage->cUsage <= 1 || pUsage->cUsage <= 1)
3945 {
3946 /*
3947 * Check if there are any objects with destructors in the image, if
3948 * so leave it for the session cleanup routine so we get a chance to
3949 * clean things up in the right order and not leave them all dangling.
3950 */
3951 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
3952 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
3953 if (pImage->cUsage <= 1)
3954 {
3955 PSUPDRVOBJ pObj;
3956 for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
3957 if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
3958 {
3959 rc = VERR_DANGLING_OBJECTS;
3960 break;
3961 }
3962 }
3963 else
3964 {
3965 PSUPDRVUSAGE pGenUsage;
3966 for (pGenUsage = pSession->pUsage; pGenUsage; pGenUsage = pGenUsage->pNext)
3967 if (RT_UNLIKELY((uintptr_t)pGenUsage->pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
3968 {
3969 rc = VERR_DANGLING_OBJECTS;
3970 break;
3971 }
3972 }
3973 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
3974 if (rc == VINF_SUCCESS)
3975 {
3976 /* unlink it */
3977 if (pUsagePrev)
3978 pUsagePrev->pNext = pUsage->pNext;
3979 else
3980 pSession->pLdrUsage = pUsage->pNext;
3981
3982 /* free it */
3983 pUsage->pImage = NULL;
3984 pUsage->pNext = NULL;
3985 RTMemFree(pUsage);
3986
3987 /*
3988 * Dereference the image.
3989 */
3990 if (pImage->cUsage <= 1)
3991 supdrvLdrFree(pDevExt, pImage);
3992 else
3993 pImage->cUsage--;
3994 }
3995 else
3996 {
3997 Log(("supdrvIOCtl_LdrFree: Dangling objects in %p/%s!\n", pImage->pvImage, pImage->szName));
3998 rc = VINF_SUCCESS; /** @todo BRANCH-2.1: remove this after branching. */
3999 }
4000 }
4001 else
4002 {
4003 /*
4004 * Dereference both image and usage.
4005 */
4006 pImage->cUsage--;
4007 pUsage->cUsage--;
4008 }
4009
4010 supdrvLdrUnlock(pDevExt);
4011 return rc;
4012}
4013
4014
4015/**
4016 * Gets the address of a symbol in an open image.
4017 *
4018 * @returns IPRT status code.
4019 * @param pDevExt Device globals.
4020 * @param pSession Session data.
4021 * @param pReq The request buffer.
4022 */
4023static int supdrvIOCtl_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq)
4024{
4025 PSUPDRVLDRIMAGE pImage;
4026 PSUPDRVLDRUSAGE pUsage;
4027 uint32_t i;
4028 PSUPLDRSYM paSyms;
4029 const char *pchStrings;
4030 const size_t cbSymbol = strlen(pReq->u.In.szSymbol) + 1;
4031 void *pvSymbol = NULL;
4032 int rc = VERR_GENERAL_FAILURE;
4033 Log3(("supdrvIOCtl_LdrGetSymbol: pvImageBase=%p szSymbol=\"%s\"\n", pReq->u.In.pvImageBase, pReq->u.In.szSymbol));
4034
4035 /*
4036 * Find the ldr image.
4037 */
4038 supdrvLdrLock(pDevExt);
4039 pUsage = pSession->pLdrUsage;
4040 while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
4041 pUsage = pUsage->pNext;
4042 if (!pUsage)
4043 {
4044 supdrvLdrUnlock(pDevExt);
4045 Log(("SUP_IOCTL_LDR_GET_SYMBOL: couldn't find image!\n"));
4046 return VERR_INVALID_HANDLE;
4047 }
4048 pImage = pUsage->pImage;
4049 if (pImage->uState != SUP_IOCTL_LDR_LOAD)
4050 {
4051 unsigned uState = pImage->uState;
4052 supdrvLdrUnlock(pDevExt);
4053 Log(("SUP_IOCTL_LDR_GET_SYMBOL: invalid image state %d (%#x)!\n", uState, uState)); NOREF(uState);
4054 return VERR_ALREADY_LOADED;
4055 }
4056
4057 /*
4058 * Search the symbol strings.
4059 */
4060 pchStrings = pImage->pachStrTab;
4061 paSyms = pImage->paSymbols;
4062 for (i = 0; i < pImage->cSymbols; i++)
4063 {
4064 if ( paSyms[i].offSymbol < pImage->cbImageBits /* paranoia */
4065 && paSyms[i].offName + cbSymbol <= pImage->cbStrTab
4066 && !memcmp(pchStrings + paSyms[i].offName, pReq->u.In.szSymbol, cbSymbol))
4067 {
4068 pvSymbol = (uint8_t *)pImage->pvImage + paSyms[i].offSymbol;
4069 rc = VINF_SUCCESS;
4070 break;
4071 }
4072 }
4073 supdrvLdrUnlock(pDevExt);
4074 pReq->u.Out.pvSymbol = pvSymbol;
4075 return rc;
4076}
4077
4078
4079/**
4080 * Gets the address of a symbol in an open image or the support driver.
4081 *
4082 * @returns VINF_SUCCESS on success.
4083 * @returns
4084 * @param pDevExt Device globals.
4085 * @param pSession Session data.
4086 * @param pReq The request buffer.
4087 */
4088static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq)
4089{
4090 int rc = VINF_SUCCESS;
4091 const char *pszSymbol = pReq->u.In.pszSymbol;
4092 const char *pszModule = pReq->u.In.pszModule;
4093 size_t cbSymbol;
4094 char const *pszEnd;
4095 uint32_t i;
4096
4097 /*
4098 * Input validation.
4099 */
4100 AssertPtrReturn(pszSymbol, VERR_INVALID_POINTER);
4101 pszEnd = (char *)memchr(pszSymbol, '\0', 512);
4102 AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4103 cbSymbol = pszEnd - pszSymbol + 1;
4104
4105 if (pszModule)
4106 {
4107 AssertPtrReturn(pszModule, VERR_INVALID_POINTER);
4108 pszEnd = (char *)memchr(pszModule, '\0', 64);
4109 AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4110 }
4111 Log3(("supdrvIDC_LdrGetSymbol: pszModule=%p:{%s} pszSymbol=%p:{%s}\n", pszModule, pszModule, pszSymbol, pszSymbol));
4112
4113
4114 if ( !pszModule
4115 || !strcmp(pszModule, "SupDrv"))
4116 {
4117 /*
4118 * Search the support driver export table.
4119 */
4120 for (i = 0; i < RT_ELEMENTS(g_aFunctions); i++)
4121 if (!strcmp(g_aFunctions[i].szName, pszSymbol))
4122 {
4123 pReq->u.Out.pfnSymbol = g_aFunctions[i].pfn;
4124 break;
4125 }
4126 }
4127 else
4128 {
4129 /*
4130 * Find the loader image.
4131 */
4132 PSUPDRVLDRIMAGE pImage;
4133
4134 supdrvLdrLock(pDevExt);
4135
4136 for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
4137 if (!strcmp(pImage->szName, pszModule))
4138 break;
4139 if (pImage && pImage->uState == SUP_IOCTL_LDR_LOAD)
4140 {
4141 /*
4142 * Search the symbol strings.
4143 */
4144 const char *pchStrings = pImage->pachStrTab;
4145 PCSUPLDRSYM paSyms = pImage->paSymbols;
4146 for (i = 0; i < pImage->cSymbols; i++)
4147 {
4148 if ( paSyms[i].offSymbol < pImage->cbImageBits /* paranoia */
4149 && paSyms[i].offName + cbSymbol <= pImage->cbStrTab
4150 && !memcmp(pchStrings + paSyms[i].offName, pszSymbol, cbSymbol))
4151 {
4152 /*
4153 * Found it! Calc the symbol address and add a reference to the module.
4154 */
4155 pReq->u.Out.pfnSymbol = (PFNRT)((uint8_t *)pImage->pvImage + paSyms[i].offSymbol);
4156 rc = supdrvLdrAddUsage(pSession, pImage);
4157 break;
4158 }
4159 }
4160 }
4161 else
4162 rc = pImage ? VERR_WRONG_ORDER : VERR_MODULE_NOT_FOUND;
4163
4164 supdrvLdrUnlock(pDevExt);
4165 }
4166 return rc;
4167}
4168
4169
4170/**
4171 * Updates the VMMR0 entry point pointers.
4172 *
4173 * @returns IPRT status code.
4174 * @param pDevExt Device globals.
4175 * @param pSession Session data.
4176 * @param pVMMR0 VMMR0 image handle.
4177 * @param pvVMMR0EntryInt VMMR0EntryInt address.
4178 * @param pvVMMR0EntryFast VMMR0EntryFast address.
4179 * @param pvVMMR0EntryEx VMMR0EntryEx address.
4180 * @remark Caller must own the loader mutex.
4181 */
4182static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void *pvVMMR0, void *pvVMMR0EntryInt, void *pvVMMR0EntryFast, void *pvVMMR0EntryEx)
4183{
4184 int rc = VINF_SUCCESS;
4185 LogFlow(("supdrvLdrSetR0EP pvVMMR0=%p pvVMMR0EntryInt=%p\n", pvVMMR0, pvVMMR0EntryInt));
4186
4187
4188 /*
4189 * Check if not yet set.
4190 */
4191 if (!pDevExt->pvVMMR0)
4192 {
4193 pDevExt->pvVMMR0 = pvVMMR0;
4194 pDevExt->pfnVMMR0EntryInt = pvVMMR0EntryInt;
4195 pDevExt->pfnVMMR0EntryFast = pvVMMR0EntryFast;
4196 pDevExt->pfnVMMR0EntryEx = pvVMMR0EntryEx;
4197 }
4198 else
4199 {
4200 /*
4201 * Return failure or success depending on whether the values match or not.
4202 */
4203 if ( pDevExt->pvVMMR0 != pvVMMR0
4204 || (void *)pDevExt->pfnVMMR0EntryInt != pvVMMR0EntryInt
4205 || (void *)pDevExt->pfnVMMR0EntryFast != pvVMMR0EntryFast
4206 || (void *)pDevExt->pfnVMMR0EntryEx != pvVMMR0EntryEx)
4207 {
4208 AssertMsgFailed(("SUP_IOCTL_LDR_SETR0EP: Already set pointing to a different module!\n"));
4209 rc = VERR_INVALID_PARAMETER;
4210 }
4211 }
4212 return rc;
4213}
4214
4215
4216/**
4217 * Unsets the VMMR0 entry point installed by supdrvLdrSetR0EP.
4218 *
4219 * @param pDevExt Device globals.
4220 */
4221static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt)
4222{
4223 pDevExt->pvVMMR0 = NULL;
4224 pDevExt->pfnVMMR0EntryInt = NULL;
4225 pDevExt->pfnVMMR0EntryFast = NULL;
4226 pDevExt->pfnVMMR0EntryEx = NULL;
4227}
4228
4229
4230/**
4231 * Adds a usage reference in the specified session of an image.
4232 *
4233 * Called while owning the loader semaphore.
4234 *
4235 * @returns VINF_SUCCESS on success and VERR_NO_MEMORY on failure.
4236 * @param pSession Session in question.
4237 * @param pImage Image which the session is using.
4238 */
4239static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage)
4240{
4241 PSUPDRVLDRUSAGE pUsage;
4242 LogFlow(("supdrvLdrAddUsage: pImage=%p\n", pImage));
4243
4244 /*
4245 * Referenced it already?
4246 */
4247 pUsage = pSession->pLdrUsage;
4248 while (pUsage)
4249 {
4250 if (pUsage->pImage == pImage)
4251 {
4252 pUsage->cUsage++;
4253 return VINF_SUCCESS;
4254 }
4255 pUsage = pUsage->pNext;
4256 }
4257
4258 /*
4259 * Allocate new usage record.
4260 */
4261 pUsage = (PSUPDRVLDRUSAGE)RTMemAlloc(sizeof(*pUsage));
4262 AssertReturn(pUsage, VERR_NO_MEMORY);
4263 pUsage->cUsage = 1;
4264 pUsage->pImage = pImage;
4265 pUsage->pNext = pSession->pLdrUsage;
4266 pSession->pLdrUsage = pUsage;
4267 return VINF_SUCCESS;
4268}
4269
4270
4271/**
4272 * Frees a load image.
4273 *
4274 * @param pDevExt Pointer to device extension.
4275 * @param pImage Pointer to the image we're gonna free.
4276 * This image must exit!
4277 * @remark The caller MUST own SUPDRVDEVEXT::mtxLdr!
4278 */
4279static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage)
4280{
4281 PSUPDRVLDRIMAGE pImagePrev;
4282 LogFlow(("supdrvLdrFree: pImage=%p\n", pImage));
4283
4284 /* find it - arg. should've used doubly linked list. */
4285 Assert(pDevExt->pLdrImages);
4286 pImagePrev = NULL;
4287 if (pDevExt->pLdrImages != pImage)
4288 {
4289 pImagePrev = pDevExt->pLdrImages;
4290 while (pImagePrev->pNext != pImage)
4291 pImagePrev = pImagePrev->pNext;
4292 Assert(pImagePrev->pNext == pImage);
4293 }
4294
4295 /* unlink */
4296 if (pImagePrev)
4297 pImagePrev->pNext = pImage->pNext;
4298 else
4299 pDevExt->pLdrImages = pImage->pNext;
4300
4301 /* check if this is VMMR0.r0 unset its entry point pointers. */
4302 if (pDevExt->pvVMMR0 == pImage->pvImage)
4303 supdrvLdrUnsetVMMR0EPs(pDevExt);
4304
4305 /* check for objects with destructors in this image. (Shouldn't happen.) */
4306 if (pDevExt->pObjs)
4307 {
4308 unsigned cObjs = 0;
4309 PSUPDRVOBJ pObj;
4310 RTSPINLOCKTMP SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
4311 RTSpinlockAcquire(pDevExt->Spinlock, &SpinlockTmp);
4312 for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
4313 if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
4314 {
4315 pObj->pfnDestructor = NULL;
4316 cObjs++;
4317 }
4318 RTSpinlockRelease(pDevExt->Spinlock, &SpinlockTmp);
4319 if (cObjs)
4320 OSDBGPRINT(("supdrvLdrFree: Image '%s' has %d dangling objects!\n", pImage->szName, cObjs));
4321 }
4322
4323 /* call termination function if fully loaded. */
4324 if ( pImage->pfnModuleTerm
4325 && pImage->uState == SUP_IOCTL_LDR_LOAD)
4326 {
4327 LogFlow(("supdrvIOCtl_LdrLoad: calling pfnModuleTerm=%p\n", pImage->pfnModuleTerm));
4328 pImage->pfnModuleTerm();
4329 }
4330
4331 /* do native unload if appropriate. */
4332 if (pImage->fNative)
4333 supdrvOSLdrUnload(pDevExt, pImage);
4334
4335 /* free the image */
4336 pImage->cUsage = 0;
4337 pImage->pNext = 0;
4338 pImage->uState = SUP_IOCTL_LDR_FREE;
4339 RTMemExecFree(pImage->pvImageAlloc);
4340 pImage->pvImageAlloc = NULL;
4341 RTMemFree(pImage->pachStrTab);
4342 pImage->pachStrTab = NULL;
4343 RTMemFree(pImage->paSymbols);
4344 pImage->paSymbols = NULL;
4345 RTMemFree(pImage);
4346}
4347
4348
4349/**
4350 * Acquires the loader lock.
4351 *
4352 * @returns IPRT status code.
4353 * @param pDevExt The device extension.
4354 */
4355DECLINLINE(int) supdrvLdrLock(PSUPDRVDEVEXT pDevExt)
4356{
4357#ifdef SUPDRV_USE_MUTEX_FOR_LDR
4358 int rc = RTSemMutexRequest(pDevExt->mtxLdr, RT_INDEFINITE_WAIT);
4359#else
4360 int rc = RTSemFastMutexRequest(pDevExt->mtxLdr);
4361#endif
4362 AssertRC(rc);
4363 return rc;
4364}
4365
4366
4367/**
4368 * Releases the loader lock.
4369 *
4370 * @returns IPRT status code.
4371 * @param pDevExt The device extension.
4372 */
4373DECLINLINE(int) supdrvLdrUnlock(PSUPDRVDEVEXT pDevExt)
4374{
4375#ifdef SUPDRV_USE_MUTEX_FOR_LDR
4376 return RTSemMutexRelease(pDevExt->mtxLdr);
4377#else
4378 return RTSemFastMutexRelease(pDevExt->mtxLdr);
4379#endif
4380}
4381
4382
4383/**
4384 * Implements the service call request.
4385 *
4386 * @returns VBox status code.
4387 * @param pDevExt The device extension.
4388 * @param pSession The calling session.
4389 * @param pReq The request packet, valid.
4390 */
4391static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq)
4392{
4393#if !defined(RT_OS_WINDOWS) || defined(DEBUG)
4394 int rc;
4395
4396 /*
4397 * Find the module first in the module referenced by the calling session.
4398 */
4399 rc = supdrvLdrLock(pDevExt);
4400 if (RT_SUCCESS(rc))
4401 {
4402 PFNSUPR0SERVICEREQHANDLER pfnServiceReqHandler = NULL;
4403 PSUPDRVLDRUSAGE pUsage;
4404
4405 for (pUsage = pSession->pLdrUsage; pUsage; pUsage = pUsage->pNext)
4406 if ( pUsage->pImage->pfnServiceReqHandler
4407 && !strcmp(pUsage->pImage->szName, pReq->u.In.szName))
4408 {
4409 pfnServiceReqHandler = pUsage->pImage->pfnServiceReqHandler;
4410 break;
4411 }
4412 supdrvLdrUnlock(pDevExt);
4413
4414 if (pfnServiceReqHandler)
4415 {
4416 /*
4417 * Call it.
4418 */
4419 if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
4420 rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, NULL);
4421 else
4422 rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0]);
4423 }
4424 else
4425 rc = VERR_SUPDRV_SERVICE_NOT_FOUND;
4426 }
4427
4428 /* log it */
4429 if ( RT_FAILURE(rc)
4430 && rc != VERR_INTERRUPTED
4431 && rc != VERR_TIMEOUT)
4432 Log(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
4433 rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
4434 else
4435 Log4(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
4436 rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
4437 return rc;
4438#else /* RT_OS_WINDOWS && !DEBUG */
4439 return VERR_NOT_IMPLEMENTED;
4440#endif /* RT_OS_WINDOWS && !DEBUG */
4441}
4442
4443
4444/**
4445 * Implements the logger settings request.
4446 *
4447 * @returns VBox status code.
4448 * @param pDevExt The device extension.
4449 * @param pSession The caller's session.
4450 * @param pReq The request.
4451 */
4452static int supdrvIOCtl_LoggerSettings(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLOGGERSETTINGS pReq)
4453{
4454 const char *pszGroup = &pReq->u.In.szStrings[pReq->u.In.offGroups];
4455 const char *pszFlags = &pReq->u.In.szStrings[pReq->u.In.offFlags];
4456 const char *pszDest = &pReq->u.In.szStrings[pReq->u.In.offDestination];
4457 PRTLOGGER pLogger = NULL;
4458 int rc;
4459
4460 /*
4461 * Some further validation.
4462 */
4463 switch (pReq->u.In.fWhat)
4464 {
4465 case SUPLOGGERSETTINGS_WHAT_SETTINGS:
4466 case SUPLOGGERSETTINGS_WHAT_CREATE:
4467 break;
4468
4469 case SUPLOGGERSETTINGS_WHAT_DESTROY:
4470 if (*pszGroup || *pszFlags || *pszDest)
4471 return VERR_INVALID_PARAMETER;
4472 if (pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_RELEASE)
4473 return VERR_ACCESS_DENIED;
4474 break;
4475
4476 default:
4477 return VERR_INTERNAL_ERROR;
4478 }
4479
4480 /*
4481 * Get the logger.
4482 */
4483 switch (pReq->u.In.fWhich)
4484 {
4485 case SUPLOGGERSETTINGS_WHICH_DEBUG:
4486 pLogger = RTLogGetDefaultInstance();
4487 break;
4488
4489 case SUPLOGGERSETTINGS_WHICH_RELEASE:
4490 pLogger = RTLogRelDefaultInstance();
4491 break;
4492
4493 default:
4494 return VERR_INTERNAL_ERROR;
4495 }
4496
4497 /*
4498 * Do the job.
4499 */
4500 switch (pReq->u.In.fWhat)
4501 {
4502 case SUPLOGGERSETTINGS_WHAT_SETTINGS:
4503 if (pLogger)
4504 {
4505 rc = RTLogFlags(pLogger, pszFlags);
4506 if (RT_SUCCESS(rc))
4507 rc = RTLogGroupSettings(pLogger, pszGroup);
4508 NOREF(pszDest);
4509 }
4510 else
4511 rc = VERR_NOT_FOUND;
4512 break;
4513
4514 case SUPLOGGERSETTINGS_WHAT_CREATE:
4515 {
4516 if (pLogger)
4517 rc = VERR_ALREADY_EXISTS;
4518 else
4519 {
4520 static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
4521
4522 rc = RTLogCreate(&pLogger,
4523 0 /* fFlags */,
4524 pszGroup,
4525 pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_DEBUG
4526 ? "VBOX_LOG"
4527 : "VBOX_RELEASE_LOG",
4528 RT_ELEMENTS(s_apszGroups),
4529 s_apszGroups,
4530 RTLOGDEST_STDOUT | RTLOGDEST_DEBUGGER,
4531 NULL);
4532 if (RT_SUCCESS(rc))
4533 {
4534 rc = RTLogFlags(pLogger, pszFlags);
4535 NOREF(pszDest);
4536 if (RT_SUCCESS(rc))
4537 {
4538 switch (pReq->u.In.fWhich)
4539 {
4540 case SUPLOGGERSETTINGS_WHICH_DEBUG:
4541 pLogger = RTLogSetDefaultInstance(pLogger);
4542 break;
4543 case SUPLOGGERSETTINGS_WHICH_RELEASE:
4544 pLogger = RTLogRelSetDefaultInstance(pLogger);
4545 break;
4546 }
4547 }
4548 RTLogDestroy(pLogger);
4549 }
4550 }
4551 break;
4552 }
4553
4554 case SUPLOGGERSETTINGS_WHAT_DESTROY:
4555 switch (pReq->u.In.fWhich)
4556 {
4557 case SUPLOGGERSETTINGS_WHICH_DEBUG:
4558 pLogger = RTLogSetDefaultInstance(NULL);
4559 break;
4560 case SUPLOGGERSETTINGS_WHICH_RELEASE:
4561 pLogger = RTLogRelSetDefaultInstance(NULL);
4562 break;
4563 }
4564 rc = RTLogDestroy(pLogger);
4565 break;
4566
4567 default:
4568 {
4569 rc = VERR_INTERNAL_ERROR;
4570 break;
4571 }
4572 }
4573
4574 return rc;
4575}
4576
4577
4578/**
4579 * Creates the GIP.
4580 *
4581 * @returns VBox status code.
4582 * @param pDevExt Instance data. GIP stuff may be updated.
4583 */
4584static int supdrvGipCreate(PSUPDRVDEVEXT pDevExt)
4585{
4586 PSUPGLOBALINFOPAGE pGip;
4587 RTHCPHYS HCPhysGip;
4588 uint32_t u32SystemResolution;
4589 uint32_t u32Interval;
4590 int rc;
4591
4592 LogFlow(("supdrvGipCreate:\n"));
4593
4594 /* assert order */
4595 Assert(pDevExt->u32SystemTimerGranularityGrant == 0);
4596 Assert(pDevExt->GipMemObj == NIL_RTR0MEMOBJ);
4597 Assert(!pDevExt->pGipTimer);
4598
4599 /*
4600 * Allocate a suitable page with a default kernel mapping.
4601 */
4602 rc = RTR0MemObjAllocLow(&pDevExt->GipMemObj, PAGE_SIZE, false);
4603 if (RT_FAILURE(rc))
4604 {
4605 OSDBGPRINT(("supdrvGipCreate: failed to allocate the GIP page. rc=%d\n", rc));
4606 return rc;
4607 }
4608 pGip = (PSUPGLOBALINFOPAGE)RTR0MemObjAddress(pDevExt->GipMemObj); AssertPtr(pGip);
4609 HCPhysGip = RTR0MemObjGetPagePhysAddr(pDevExt->GipMemObj, 0); Assert(HCPhysGip != NIL_RTHCPHYS);
4610
4611#if 0 /** @todo Disabled this as we didn't used to do it before and causes unnecessary stress on laptops.
4612 * It only applies to Windows and should probably revisited later, if possible made part of the
4613 * timer code (return min granularity in RTTimerGetSystemGranularity and set it in RTTimerStart). */
4614 /*
4615 * Try bump up the system timer resolution.
4616 * The more interrupts the better...
4617 */
4618 if ( RT_SUCCESS(RTTimerRequestSystemGranularity( 488281 /* 2048 HZ */, &u32SystemResolution))
4619 || RT_SUCCESS(RTTimerRequestSystemGranularity( 500000 /* 2000 HZ */, &u32SystemResolution))
4620 || RT_SUCCESS(RTTimerRequestSystemGranularity( 976563 /* 1024 HZ */, &u32SystemResolution))
4621 || RT_SUCCESS(RTTimerRequestSystemGranularity( 1000000 /* 1000 HZ */, &u32SystemResolution))
4622 || RT_SUCCESS(RTTimerRequestSystemGranularity( 1953125 /* 512 HZ */, &u32SystemResolution))
4623 || RT_SUCCESS(RTTimerRequestSystemGranularity( 2000000 /* 500 HZ */, &u32SystemResolution))
4624 || RT_SUCCESS(RTTimerRequestSystemGranularity( 3906250 /* 256 HZ */, &u32SystemResolution))
4625 || RT_SUCCESS(RTTimerRequestSystemGranularity( 4000000 /* 250 HZ */, &u32SystemResolution))
4626 || RT_SUCCESS(RTTimerRequestSystemGranularity( 7812500 /* 128 HZ */, &u32SystemResolution))
4627 || RT_SUCCESS(RTTimerRequestSystemGranularity(10000000 /* 100 HZ */, &u32SystemResolution))
4628 || RT_SUCCESS(RTTimerRequestSystemGranularity(15625000 /* 64 HZ */, &u32SystemResolution))
4629 || RT_SUCCESS(RTTimerRequestSystemGranularity(31250000 /* 32 HZ */, &u32SystemResolution))
4630 )
4631 {
4632 Assert(RTTimerGetSystemGranularity() <= u32SystemResolution);
4633 pDevExt->u32SystemTimerGranularityGrant = u32SystemResolution;
4634 }
4635#endif
4636
4637 /*
4638 * Find a reasonable update interval and initialize the structure.
4639 */
4640 u32Interval = u32SystemResolution = RTTimerGetSystemGranularity();
4641 while (u32Interval < 10000000 /* 10 ms */)
4642 u32Interval += u32SystemResolution;
4643
4644 supdrvGipInit(pDevExt, pGip, HCPhysGip, RTTimeSystemNanoTS(), 1000000000 / u32Interval /*=Hz*/);
4645
4646 /*
4647 * Create the timer.
4648 * If CPU_ALL isn't supported we'll have to fall back to synchronous mode.
4649 */
4650 if (pGip->u32Mode == SUPGIPMODE_ASYNC_TSC)
4651 {
4652 rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, RTTIMER_FLAGS_CPU_ALL, supdrvGipAsyncTimer, pDevExt);
4653 if (rc == VERR_NOT_SUPPORTED)
4654 {
4655 OSDBGPRINT(("supdrvGipCreate: omni timer not supported, falling back to synchronous mode\n"));
4656 pGip->u32Mode = SUPGIPMODE_SYNC_TSC;
4657 }
4658 }
4659 if (pGip->u32Mode != SUPGIPMODE_ASYNC_TSC)
4660 rc = RTTimerCreateEx(&pDevExt->pGipTimer, u32Interval, 0, supdrvGipSyncTimer, pDevExt);
4661 if (RT_SUCCESS(rc))
4662 {
4663 if (pGip->u32Mode == SUPGIPMODE_ASYNC_TSC)
4664 rc = RTMpNotificationRegister(supdrvGipMpEvent, pDevExt);
4665 if (RT_SUCCESS(rc))
4666 {
4667 /*
4668 * We're good.
4669 */
4670 Log(("supdrvGipCreate: %ld ns interval.\n", (long)u32Interval));
4671 g_pSUPGlobalInfoPage = pGip;
4672 return VINF_SUCCESS;
4673 }
4674
4675 OSDBGPRINT(("supdrvGipCreate: failed register MP event notfication. rc=%d\n", rc));
4676 }
4677 else
4678 {
4679 OSDBGPRINT(("supdrvGipCreate: failed create GIP timer at %ld ns interval. rc=%d\n", (long)u32Interval, rc));
4680 Assert(!pDevExt->pGipTimer);
4681 }
4682 supdrvGipDestroy(pDevExt);
4683 return rc;
4684}
4685
4686
4687/**
4688 * Terminates the GIP.
4689 *
4690 * @param pDevExt Instance data. GIP stuff may be updated.
4691 */
4692static void supdrvGipDestroy(PSUPDRVDEVEXT pDevExt)
4693{
4694 int rc;
4695#ifdef DEBUG_DARWIN_GIP
4696 OSDBGPRINT(("supdrvGipDestroy: pDevExt=%p pGip=%p pGipTimer=%p GipMemObj=%p\n", pDevExt,
4697 pDevExt->GipMemObj != NIL_RTR0MEMOBJ ? RTR0MemObjAddress(pDevExt->GipMemObj) : NULL,
4698 pDevExt->pGipTimer, pDevExt->GipMemObj));
4699#endif
4700
4701 /*
4702 * Invalid the GIP data.
4703 */
4704 if (pDevExt->pGip)
4705 {
4706 supdrvGipTerm(pDevExt->pGip);
4707 pDevExt->pGip = NULL;
4708 }
4709 g_pSUPGlobalInfoPage = NULL;
4710
4711 /*
4712 * Destroy the timer and free the GIP memory object.
4713 */
4714 if (pDevExt->pGipTimer)
4715 {
4716 rc = RTTimerDestroy(pDevExt->pGipTimer); AssertRC(rc);
4717 pDevExt->pGipTimer = NULL;
4718 }
4719
4720 if (pDevExt->GipMemObj != NIL_RTR0MEMOBJ)
4721 {
4722 rc = RTR0MemObjFree(pDevExt->GipMemObj, true /* free mappings */); AssertRC(rc);
4723 pDevExt->GipMemObj = NIL_RTR0MEMOBJ;
4724 }
4725
4726 /*
4727 * Finally, release the system timer resolution request if one succeeded.
4728 */
4729 if (pDevExt->u32SystemTimerGranularityGrant)
4730 {
4731 rc = RTTimerReleaseSystemGranularity(pDevExt->u32SystemTimerGranularityGrant); AssertRC(rc);
4732 pDevExt->u32SystemTimerGranularityGrant = 0;
4733 }
4734}
4735
4736
4737/**
4738 * Timer callback function sync GIP mode.
4739 * @param pTimer The timer.
4740 * @param pvUser The device extension.
4741 */
4742static DECLCALLBACK(void) supdrvGipSyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick)
4743{
4744 RTCCUINTREG fOldFlags = ASMIntDisableFlags(); /* No interruptions please (real problem on S10). */
4745 PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
4746 uint64_t u64TSC = ASMReadTSC();
4747 uint64_t NanoTS = RTTimeSystemNanoTS();
4748
4749 supdrvGipUpdate(pDevExt->pGip, NanoTS, u64TSC, iTick);
4750
4751 ASMSetFlags(fOldFlags);
4752}
4753
4754
4755/**
4756 * Timer callback function for async GIP mode.
4757 * @param pTimer The timer.
4758 * @param pvUser The device extension.
4759 */
4760static DECLCALLBACK(void) supdrvGipAsyncTimer(PRTTIMER pTimer, void *pvUser, uint64_t iTick)
4761{
4762 RTCCUINTREG fOldFlags = ASMIntDisableFlags(); /* No interruptions please (real problem on S10). */
4763 PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
4764 RTCPUID idCpu = RTMpCpuId();
4765 uint64_t u64TSC = ASMReadTSC();
4766 uint64_t NanoTS = RTTimeSystemNanoTS();
4767
4768 /** @todo reset the transaction number and whatnot when iTick == 1. */
4769 if (pDevExt->idGipMaster == idCpu)
4770 supdrvGipUpdate(pDevExt->pGip, NanoTS, u64TSC, iTick);
4771 else
4772 supdrvGipUpdatePerCpu(pDevExt->pGip, NanoTS, u64TSC, ASMGetApicId(), iTick);
4773
4774 ASMSetFlags(fOldFlags);
4775}
4776
4777
4778/**
4779 * Multiprocessor event notification callback.
4780 *
4781 * This is used to make sue that the GIP master gets passed on to
4782 * another CPU.
4783 *
4784 * @param enmEvent The event.
4785 * @param idCpu The cpu it applies to.
4786 * @param pvUser Pointer to the device extension.
4787 */
4788static DECLCALLBACK(void) supdrvGipMpEvent(RTMPEVENT enmEvent, RTCPUID idCpu, void *pvUser)
4789{
4790 PSUPDRVDEVEXT pDevExt = (PSUPDRVDEVEXT)pvUser;
4791 if (enmEvent == RTMPEVENT_OFFLINE)
4792 {
4793 RTCPUID idGipMaster;
4794 ASMAtomicReadSize(&pDevExt->idGipMaster, &idGipMaster);
4795 if (idGipMaster == idCpu)
4796 {
4797 /*
4798 * Find a new GIP master.
4799 */
4800 bool fIgnored;
4801 unsigned i;
4802 RTCPUID idNewGipMaster = NIL_RTCPUID;
4803 RTCPUSET OnlineCpus;
4804 RTMpGetOnlineSet(&OnlineCpus);
4805
4806 for (i = 0; i < RTCPUSET_MAX_CPUS; i++)
4807 {
4808 RTCPUID idCurCpu = RTMpCpuIdFromSetIndex(i);
4809 if ( RTCpuSetIsMember(&OnlineCpus, idCurCpu)
4810 && idCurCpu != idGipMaster)
4811 {
4812 idNewGipMaster = idCurCpu;
4813 break;
4814 }
4815 }
4816
4817 Log(("supdrvGipMpEvent: Gip master %#lx -> %#lx\n", (long)idGipMaster, (long)idNewGipMaster));
4818 ASMAtomicCmpXchgSize(&pDevExt->idGipMaster, idNewGipMaster, idGipMaster, fIgnored);
4819 NOREF(fIgnored);
4820 }
4821 }
4822}
4823
4824
4825/**
4826 * Callback used by supdrvDetermineAsyncTSC to read the TSC on a CPU.
4827 *
4828 * @param idCpu Ignored.
4829 * @param pvUser1 Where to put the TSC.
4830 * @param pvUser2 Ignored.
4831 */
4832static DECLCALLBACK(void) supdrvDetermineAsyncTscWorker(RTCPUID idCpu, void *pvUser1, void *pvUser2)
4833{
4834#if 1
4835 ASMAtomicWriteU64((uint64_t volatile *)pvUser1, ASMReadTSC());
4836#else
4837 *(uint64_t *)pvUser1 = ASMReadTSC();
4838#endif
4839}
4840
4841
4842/**
4843 * Determine if Async GIP mode is required because of TSC drift.
4844 *
4845 * When using the default/normal timer code it is essential that the time stamp counter
4846 * (TSC) runs never backwards, that is, a read operation to the counter should return
4847 * a bigger value than any previous read operation. This is guaranteed by the latest
4848 * AMD CPUs and by newer Intel CPUs which never enter the C2 state (P4). In any other
4849 * case we have to choose the asynchronous timer mode.
4850 *
4851 * @param poffMin Pointer to the determined difference between different cores.
4852 * @return false if the time stamp counters appear to be synchron, true otherwise.
4853 */
4854static bool supdrvDetermineAsyncTsc(uint64_t *poffMin)
4855{
4856 /*
4857 * Just iterate all the cpus 8 times and make sure that the TSC is
4858 * ever increasing. We don't bother taking TSC rollover into account.
4859 */
4860 RTCPUSET CpuSet;
4861 int iLastCpu = RTCpuLastIndex(RTMpGetSet(&CpuSet));
4862 int iCpu;
4863 int cLoops = 8;
4864 bool fAsync = false;
4865 int rc = VINF_SUCCESS;
4866 uint64_t offMax = 0;
4867 uint64_t offMin = ~(uint64_t)0;
4868 uint64_t PrevTsc = ASMReadTSC();
4869
4870 while (cLoops-- > 0)
4871 {
4872 for (iCpu = 0; iCpu <= iLastCpu; iCpu++)
4873 {
4874 uint64_t CurTsc;
4875 rc = RTMpOnSpecific(RTMpCpuIdFromSetIndex(iCpu), supdrvDetermineAsyncTscWorker, &CurTsc, NULL);
4876 if (RT_SUCCESS(rc))
4877 {
4878 if (CurTsc <= PrevTsc)
4879 {
4880 fAsync = true;
4881 offMin = offMax = PrevTsc - CurTsc;
4882 Log(("supdrvDetermineAsyncTsc: iCpu=%d cLoops=%d CurTsc=%llx PrevTsc=%llx\n",
4883 iCpu, cLoops, CurTsc, PrevTsc));
4884 break;
4885 }
4886
4887 /* Gather statistics (except the first time). */
4888 if (iCpu != 0 || cLoops != 7)
4889 {
4890 uint64_t off = CurTsc - PrevTsc;
4891 if (off < offMin)
4892 offMin = off;
4893 if (off > offMax)
4894 offMax = off;
4895 Log2(("%d/%d: off=%llx\n", cLoops, iCpu, off));
4896 }
4897
4898 /* Next */
4899 PrevTsc = CurTsc;
4900 }
4901 else if (rc == VERR_NOT_SUPPORTED)
4902 break;
4903 else
4904 AssertMsg(rc == VERR_CPU_NOT_FOUND || rc == VERR_CPU_OFFLINE, ("%d\n", rc));
4905 }
4906
4907 /* broke out of the loop. */
4908 if (iCpu <= iLastCpu)
4909 break;
4910 }
4911
4912 *poffMin = offMin; /* Almost RTMpOnSpecific profiling. */
4913 Log(("supdrvDetermineAsyncTsc: returns %d; iLastCpu=%d rc=%d offMin=%llx offMax=%llx\n",
4914 fAsync, iLastCpu, rc, offMin, offMax));
4915#if !defined(RT_OS_SOLARIS) && !defined(RT_OS_OS2) && !defined(RT_OS_WINDOWS)
4916 OSDBGPRINT(("vboxdrv: fAsync=%d offMin=%#lx offMax=%#lx\n", fAsync, (long)offMin, (long)offMax));
4917#endif
4918 return fAsync;
4919}
4920
4921
4922/**
4923 * Determin the GIP TSC mode.
4924 *
4925 * @returns The most suitable TSC mode.
4926 * @param pDevExt Pointer to the device instance data.
4927 */
4928static SUPGIPMODE supdrvGipDeterminTscMode(PSUPDRVDEVEXT pDevExt)
4929{
4930 /*
4931 * On SMP we're faced with two problems:
4932 * (1) There might be a skew between the CPU, so that cpu0
4933 * returns a TSC that is sligtly different from cpu1.
4934 * (2) Power management (and other things) may cause the TSC
4935 * to run at a non-constant speed, and cause the speed
4936 * to be different on the cpus. This will result in (1).
4937 *
4938 * So, on SMP systems we'll have to select the ASYNC update method
4939 * if there are symphoms of these problems.
4940 */
4941 if (RTMpGetCount() > 1)
4942 {
4943 uint32_t uEAX, uEBX, uECX, uEDX;
4944 uint64_t u64DiffCoresIgnored;
4945
4946 /* Permit the user and/or the OS specfic bits to force async mode. */
4947 if (supdrvOSGetForcedAsyncTscMode(pDevExt))
4948 return SUPGIPMODE_ASYNC_TSC;
4949
4950 /* Try check for current differences between the cpus. */
4951 if (supdrvDetermineAsyncTsc(&u64DiffCoresIgnored))
4952 return SUPGIPMODE_ASYNC_TSC;
4953
4954 /*
4955 * If the CPU supports power management and is an AMD one we
4956 * won't trust it unless it has the TscInvariant bit is set.
4957 */
4958 /* Check for "AuthenticAMD" */
4959 ASMCpuId(0, &uEAX, &uEBX, &uECX, &uEDX);
4960 if ( uEAX >= 1
4961 && uEBX == X86_CPUID_VENDOR_AMD_EBX
4962 && uECX == X86_CPUID_VENDOR_AMD_ECX
4963 && uEDX == X86_CPUID_VENDOR_AMD_EDX)
4964 {
4965 /* Check for APM support and that TscInvariant is cleared. */
4966 ASMCpuId(0x80000000, &uEAX, &uEBX, &uECX, &uEDX);
4967 if (uEAX >= 0x80000007)
4968 {
4969 ASMCpuId(0x80000007, &uEAX, &uEBX, &uECX, &uEDX);
4970 if ( !(uEDX & RT_BIT(8))/* TscInvariant */
4971 && (uEDX & 0x3e)) /* STC|TM|THERMTRIP|VID|FID. Ignore TS. */
4972 return SUPGIPMODE_ASYNC_TSC;
4973 }
4974 }
4975 }
4976 return SUPGIPMODE_SYNC_TSC;
4977}
4978
4979
4980
4981/**
4982 * Initializes the GIP data.
4983 *
4984 * @param pDevExt Pointer to the device instance data.
4985 * @param pGip Pointer to the read-write kernel mapping of the GIP.
4986 * @param HCPhys The physical address of the GIP.
4987 * @param u64NanoTS The current nanosecond timestamp.
4988 * @param uUpdateHz The update freqence.
4989 */
4990static void supdrvGipInit(PSUPDRVDEVEXT pDevExt, PSUPGLOBALINFOPAGE pGip, RTHCPHYS HCPhys, uint64_t u64NanoTS, unsigned uUpdateHz)
4991{
4992 unsigned i;
4993#ifdef DEBUG_DARWIN_GIP
4994 OSDBGPRINT(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
4995#else
4996 LogFlow(("supdrvGipInit: pGip=%p HCPhys=%lx u64NanoTS=%llu uUpdateHz=%d\n", pGip, (long)HCPhys, u64NanoTS, uUpdateHz));
4997#endif
4998
4999 /*
5000 * Initialize the structure.
5001 */
5002 memset(pGip, 0, PAGE_SIZE);
5003 pGip->u32Magic = SUPGLOBALINFOPAGE_MAGIC;
5004 pGip->u32Version = SUPGLOBALINFOPAGE_VERSION;
5005 pGip->u32Mode = supdrvGipDeterminTscMode(pDevExt);
5006 pGip->u32UpdateHz = uUpdateHz;
5007 pGip->u32UpdateIntervalNS = 1000000000 / uUpdateHz;
5008 pGip->u64NanoTSLastUpdateHz = u64NanoTS;
5009
5010 for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
5011 {
5012 pGip->aCPUs[i].u32TransactionId = 2;
5013 pGip->aCPUs[i].u64NanoTS = u64NanoTS;
5014 pGip->aCPUs[i].u64TSC = ASMReadTSC();
5015
5016 /*
5017 * We don't know the following values until we've executed updates.
5018 * So, we'll just pretend it's a 4 GHz CPU and adjust the history it on
5019 * the 2nd timer callout.
5020 */
5021 pGip->aCPUs[i].u64CpuHz = _4G + 1; /* tstGIP-2 depends on this. */
5022 pGip->aCPUs[i].u32UpdateIntervalTSC
5023 = pGip->aCPUs[i].au32TSCHistory[0]
5024 = pGip->aCPUs[i].au32TSCHistory[1]
5025 = pGip->aCPUs[i].au32TSCHistory[2]
5026 = pGip->aCPUs[i].au32TSCHistory[3]
5027 = pGip->aCPUs[i].au32TSCHistory[4]
5028 = pGip->aCPUs[i].au32TSCHistory[5]
5029 = pGip->aCPUs[i].au32TSCHistory[6]
5030 = pGip->aCPUs[i].au32TSCHistory[7]
5031 = /*pGip->aCPUs[i].u64CpuHz*/ _4G / uUpdateHz;
5032 }
5033
5034 /*
5035 * Link it to the device extension.
5036 */
5037 pDevExt->pGip = pGip;
5038 pDevExt->HCPhysGip = HCPhys;
5039 pDevExt->cGipUsers = 0;
5040}
5041
5042
5043/**
5044 * Invalidates the GIP data upon termination.
5045 *
5046 * @param pGip Pointer to the read-write kernel mapping of the GIP.
5047 */
5048static void supdrvGipTerm(PSUPGLOBALINFOPAGE pGip)
5049{
5050 unsigned i;
5051 pGip->u32Magic = 0;
5052 for (i = 0; i < RT_ELEMENTS(pGip->aCPUs); i++)
5053 {
5054 pGip->aCPUs[i].u64NanoTS = 0;
5055 pGip->aCPUs[i].u64TSC = 0;
5056 pGip->aCPUs[i].iTSCHistoryHead = 0;
5057 }
5058}
5059
5060
5061/**
5062 * Worker routine for supdrvGipUpdate and supdrvGipUpdatePerCpu that
5063 * updates all the per cpu data except the transaction id.
5064 *
5065 * @param pGip The GIP.
5066 * @param pGipCpu Pointer to the per cpu data.
5067 * @param u64NanoTS The current time stamp.
5068 * @param u64TSC The current TSC.
5069 * @param iTick The current timer tick.
5070 */
5071static void supdrvGipDoUpdateCpu(PSUPGLOBALINFOPAGE pGip, PSUPGIPCPU pGipCpu, uint64_t u64NanoTS, uint64_t u64TSC, uint64_t iTick)
5072{
5073 uint64_t u64TSCDelta;
5074 uint32_t u32UpdateIntervalTSC;
5075 uint32_t u32UpdateIntervalTSCSlack;
5076 unsigned iTSCHistoryHead;
5077 uint64_t u64CpuHz;
5078 uint32_t u32TransactionId;
5079
5080 /* Delta between this and the previous update. */
5081 ASMAtomicUoWriteU32(&pGipCpu->u32PrevUpdateIntervalNS, (uint32_t)(u64NanoTS - pGipCpu->u64NanoTS));
5082
5083 /*
5084 * Update the NanoTS.
5085 */
5086 ASMAtomicXchgU64(&pGipCpu->u64NanoTS, u64NanoTS);
5087
5088 /*
5089 * Calc TSC delta.
5090 */
5091 /** @todo validate the NanoTS delta, don't trust the OS to call us when it should... */
5092 u64TSCDelta = u64TSC - pGipCpu->u64TSC;
5093 ASMAtomicXchgU64(&pGipCpu->u64TSC, u64TSC);
5094
5095 if (u64TSCDelta >> 32)
5096 {
5097 u64TSCDelta = pGipCpu->u32UpdateIntervalTSC;
5098 pGipCpu->cErrors++;
5099 }
5100
5101 /*
5102 * On the 2nd and 3rd callout, reset the history with the current TSC
5103 * interval since the values entered by supdrvGipInit are totally off.
5104 * The interval on the 1st callout completely unreliable, the 2nd is a bit
5105 * better, while the 3rd should be most reliable.
5106 */
5107 u32TransactionId = pGipCpu->u32TransactionId;
5108 if (RT_UNLIKELY( ( u32TransactionId == 5
5109 || u32TransactionId == 7)
5110 && ( iTick == 2
5111 || iTick == 3) ))
5112 {
5113 unsigned i;
5114 for (i = 0; i < RT_ELEMENTS(pGipCpu->au32TSCHistory); i++)
5115 ASMAtomicUoWriteU32(&pGipCpu->au32TSCHistory[i], (uint32_t)u64TSCDelta);
5116 }
5117
5118 /*
5119 * TSC History.
5120 */
5121 Assert(RT_ELEMENTS(pGipCpu->au32TSCHistory) == 8);
5122 iTSCHistoryHead = (pGipCpu->iTSCHistoryHead + 1) & 7;
5123 ASMAtomicXchgU32(&pGipCpu->iTSCHistoryHead, iTSCHistoryHead);
5124 ASMAtomicXchgU32(&pGipCpu->au32TSCHistory[iTSCHistoryHead], (uint32_t)u64TSCDelta);
5125
5126 /*
5127 * UpdateIntervalTSC = average of last 8,2,1 intervals depending on update HZ.
5128 */
5129 if (pGip->u32UpdateHz >= 1000)
5130 {
5131 uint32_t u32;
5132 u32 = pGipCpu->au32TSCHistory[0];
5133 u32 += pGipCpu->au32TSCHistory[1];
5134 u32 += pGipCpu->au32TSCHistory[2];
5135 u32 += pGipCpu->au32TSCHistory[3];
5136 u32 >>= 2;
5137 u32UpdateIntervalTSC = pGipCpu->au32TSCHistory[4];
5138 u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[5];
5139 u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[6];
5140 u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[7];
5141 u32UpdateIntervalTSC >>= 2;
5142 u32UpdateIntervalTSC += u32;
5143 u32UpdateIntervalTSC >>= 1;
5144
5145 /* Value choosen for a 2GHz Athlon64 running linux 2.6.10/11, . */
5146 u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 14;
5147 }
5148 else if (pGip->u32UpdateHz >= 90)
5149 {
5150 u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
5151 u32UpdateIntervalTSC += pGipCpu->au32TSCHistory[(iTSCHistoryHead - 1) & 7];
5152 u32UpdateIntervalTSC >>= 1;
5153
5154 /* value choosen on a 2GHz thinkpad running windows */
5155 u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 7;
5156 }
5157 else
5158 {
5159 u32UpdateIntervalTSC = (uint32_t)u64TSCDelta;
5160
5161 /* This value hasn't be checked yet.. waiting for OS/2 and 33Hz timers.. :-) */
5162 u32UpdateIntervalTSCSlack = u32UpdateIntervalTSC >> 6;
5163 }
5164 ASMAtomicXchgU32(&pGipCpu->u32UpdateIntervalTSC, u32UpdateIntervalTSC + u32UpdateIntervalTSCSlack);
5165
5166 /*
5167 * CpuHz.
5168 */
5169 u64CpuHz = ASMMult2xU32RetU64(u32UpdateIntervalTSC, pGip->u32UpdateHz);
5170 ASMAtomicXchgU64(&pGipCpu->u64CpuHz, u64CpuHz);
5171}
5172
5173
5174/**
5175 * Updates the GIP.
5176 *
5177 * @param pGip Pointer to the GIP.
5178 * @param u64NanoTS The current nanosecond timesamp.
5179 * @param u64TSC The current TSC timesamp.
5180 * @param iTick The current timer tick.
5181 */
5182static void supdrvGipUpdate(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, uint64_t u64TSC, uint64_t iTick)
5183{
5184 /*
5185 * Determin the relevant CPU data.
5186 */
5187 PSUPGIPCPU pGipCpu;
5188 if (pGip->u32Mode != SUPGIPMODE_ASYNC_TSC)
5189 pGipCpu = &pGip->aCPUs[0];
5190 else
5191 {
5192 unsigned iCpu = ASMGetApicId();
5193 if (RT_UNLIKELY(iCpu >= RT_ELEMENTS(pGip->aCPUs)))
5194 return;
5195 pGipCpu = &pGip->aCPUs[iCpu];
5196 }
5197
5198 /*
5199 * Start update transaction.
5200 */
5201 if (!(ASMAtomicIncU32(&pGipCpu->u32TransactionId) & 1))
5202 {
5203 /* this can happen on win32 if we're taking to long and there are more CPUs around. shouldn't happen though. */
5204 AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGipCpu->u32TransactionId));
5205 ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5206 pGipCpu->cErrors++;
5207 return;
5208 }
5209
5210 /*
5211 * Recalc the update frequency every 0x800th time.
5212 */
5213 if (!(pGipCpu->u32TransactionId & (GIP_UPDATEHZ_RECALC_FREQ * 2 - 2)))
5214 {
5215 if (pGip->u64NanoTSLastUpdateHz)
5216 {
5217#ifdef RT_ARCH_AMD64 /** @todo fix 64-bit div here to work on x86 linux. */
5218 uint64_t u64Delta = u64NanoTS - pGip->u64NanoTSLastUpdateHz;
5219 uint32_t u32UpdateHz = (uint32_t)((UINT64_C(1000000000) * GIP_UPDATEHZ_RECALC_FREQ) / u64Delta);
5220 if (u32UpdateHz <= 2000 && u32UpdateHz >= 30)
5221 {
5222 ASMAtomicXchgU32(&pGip->u32UpdateHz, u32UpdateHz);
5223 ASMAtomicXchgU32(&pGip->u32UpdateIntervalNS, 1000000000 / u32UpdateHz);
5224 }
5225#endif
5226 }
5227 ASMAtomicXchgU64(&pGip->u64NanoTSLastUpdateHz, u64NanoTS);
5228 }
5229
5230 /*
5231 * Update the data.
5232 */
5233 supdrvGipDoUpdateCpu(pGip, pGipCpu, u64NanoTS, u64TSC, iTick);
5234
5235 /*
5236 * Complete transaction.
5237 */
5238 ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5239}
5240
5241
5242/**
5243 * Updates the per cpu GIP data for the calling cpu.
5244 *
5245 * @param pGip Pointer to the GIP.
5246 * @param u64NanoTS The current nanosecond timesamp.
5247 * @param u64TSC The current TSC timesamp.
5248 * @param iCpu The CPU index.
5249 * @param iTick The current timer tick.
5250 */
5251static void supdrvGipUpdatePerCpu(PSUPGLOBALINFOPAGE pGip, uint64_t u64NanoTS, uint64_t u64TSC, unsigned iCpu, uint64_t iTick)
5252{
5253 PSUPGIPCPU pGipCpu;
5254
5255 if (RT_LIKELY(iCpu < RT_ELEMENTS(pGip->aCPUs)))
5256 {
5257 pGipCpu = &pGip->aCPUs[iCpu];
5258
5259 /*
5260 * Start update transaction.
5261 */
5262 if (!(ASMAtomicIncU32(&pGipCpu->u32TransactionId) & 1))
5263 {
5264 AssertMsgFailed(("Invalid transaction id, %#x, not odd!\n", pGipCpu->u32TransactionId));
5265 ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5266 pGipCpu->cErrors++;
5267 return;
5268 }
5269
5270 /*
5271 * Update the data.
5272 */
5273 supdrvGipDoUpdateCpu(pGip, pGipCpu, u64NanoTS, u64TSC, iTick);
5274
5275 /*
5276 * Complete transaction.
5277 */
5278 ASMAtomicIncU32(&pGipCpu->u32TransactionId);
5279 }
5280}
5281
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette