VirtualBox

source: vbox/trunk/src/VBox/HostDrivers/Support/SUPDrv.cpp@ 85129

Last change on this file since 85129 was 85041, checked in by vboxsync, 4 years ago

SUPDrv,RuntimeR0: There must be no duplicates here, so RTStrCopy should be taken from SUPDrv while RTTimeMilliTS and RTTimeNanoTS should not (we'll be using the SUP version from timesup.cpp).
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 249.0 KB
Line 
1/* $Id: SUPDrv.cpp 85041 2020-07-02 21:13:04Z vboxsync $ */
2/** @file
3 * VBoxDrv - The VirtualBox Support Driver - Common code.
4 */
5
6/*
7 * Copyright (C) 2006-2020 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 */
26
27
28/*********************************************************************************************************************************
29* Header Files *
30*********************************************************************************************************************************/
31#define LOG_GROUP LOG_GROUP_SUP_DRV
32#define SUPDRV_AGNOSTIC
33#include "SUPDrvInternal.h"
34#ifndef PAGE_SHIFT
35# include <iprt/param.h>
36#endif
37#include <iprt/asm.h>
38#include <iprt/asm-amd64-x86.h>
39#include <iprt/asm-math.h>
40#include <iprt/cpuset.h>
41#if defined(RT_OS_DARWIN) || defined(RT_OS_SOLARIS) || defined(RT_OS_WINDOWS)
42# include <iprt/dbg.h>
43#endif
44#include <iprt/handletable.h>
45#include <iprt/mem.h>
46#include <iprt/mp.h>
47#include <iprt/power.h>
48#include <iprt/process.h>
49#include <iprt/semaphore.h>
50#include <iprt/spinlock.h>
51#include <iprt/thread.h>
52#include <iprt/uuid.h>
53#include <iprt/net.h>
54#include <iprt/crc.h>
55#include <iprt/string.h>
56#include <iprt/timer.h>
57#if defined(RT_OS_DARWIN) || defined(RT_OS_SOLARIS) || defined(RT_OS_FREEBSD)
58# include <iprt/rand.h>
59# include <iprt/path.h>
60#endif
61#include <iprt/uint128.h>
62#include <iprt/x86.h>
63
64#include <VBox/param.h>
65#include <VBox/log.h>
66#include <VBox/err.h>
67#include <VBox/vmm/hm_vmx.h>
68
69#if defined(RT_OS_SOLARIS) || defined(RT_OS_DARWIN)
70# include "dtrace/SUPDrv.h"
71#else
72# define VBOXDRV_SESSION_CREATE(pvSession, fUser) do { } while (0)
73# define VBOXDRV_SESSION_CLOSE(pvSession) do { } while (0)
74# define VBOXDRV_IOCTL_ENTRY(pvSession, uIOCtl, pvReqHdr) do { } while (0)
75# define VBOXDRV_IOCTL_RETURN(pvSession, uIOCtl, pvReqHdr, rcRet, rcReq) do { } while (0)
76#endif
77
78/*
79 * Logging assignments:
80 * Log - useful stuff, like failures.
81 * LogFlow - program flow, except the really noisy bits.
82 * Log2 - Cleanup.
83 * Log3 - Loader flow noise.
84 * Log4 - Call VMMR0 flow noise.
85 * Log5 - Native yet-to-be-defined noise.
86 * Log6 - Native ioctl flow noise.
87 *
88 * Logging requires KBUILD_TYPE=debug and possibly changes to the logger
89 * instantiation in log-vbox.c(pp).
90 */
91
92
93/*********************************************************************************************************************************
94* Defined Constants And Macros *
95*********************************************************************************************************************************/
96/** @def VBOX_SVN_REV
97 * The makefile should define this if it can. */
98#ifndef VBOX_SVN_REV
99# define VBOX_SVN_REV 0
100#endif
101
102/** @ SUPDRV_CHECK_SMAP_SETUP
103 * SMAP check setup. */
104/** @def SUPDRV_CHECK_SMAP_CHECK
105 * Checks that the AC flag is set if SMAP is enabled. If AC is not set, it
106 * will be logged and @a a_BadExpr is executed. */
107#if (defined(RT_OS_DARWIN) || defined(RT_OS_LINUX)) && !defined(VBOX_WITHOUT_EFLAGS_AC_SET_IN_VBOXDRV)
108# define SUPDRV_CHECK_SMAP_SETUP() uint32_t const fKernelFeatures = SUPR0GetKernelFeatures()
109# define SUPDRV_CHECK_SMAP_CHECK(a_pDevExt, a_BadExpr) \
110 do { \
111 if (fKernelFeatures & SUPKERNELFEATURES_SMAP) \
112 { \
113 RTCCUINTREG fEfl = ASMGetFlags(); \
114 if (RT_LIKELY(fEfl & X86_EFL_AC)) \
115 { /* likely */ } \
116 else \
117 { \
118 supdrvBadContext(a_pDevExt, "SUPDrv.cpp", __LINE__, "EFLAGS.AC is 0!"); \
119 a_BadExpr; \
120 } \
121 } \
122 } while (0)
123#else
124# define SUPDRV_CHECK_SMAP_SETUP() uint32_t const fKernelFeatures = 0
125# define SUPDRV_CHECK_SMAP_CHECK(a_pDevExt, a_BadExpr) NOREF(fKernelFeatures)
126#endif
127
128
129/*********************************************************************************************************************************
130* Internal Functions *
131*********************************************************************************************************************************/
132static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void *pvObj, void *pvCtx, void *pvUser);
133static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void *pvObj, void *pvCtx, void *pvUser);
134static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession);
135static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType);
136static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq);
137static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq);
138static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq);
139static int supdrvIOCtl_LdrLockDown(PSUPDRVDEVEXT pDevExt);
140static int supdrvIOCtl_LdrQuerySymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq);
141static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq);
142static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void *pvVMMR0, void *pvVMMR0EntryFast, void *pvVMMR0EntryEx);
143static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt);
144static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage, bool fRing3Usage);
145static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage);
146DECLINLINE(int) supdrvLdrLock(PSUPDRVDEVEXT pDevExt);
147DECLINLINE(int) supdrvLdrUnlock(PSUPDRVDEVEXT pDevExt);
148static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq);
149static int supdrvIOCtl_LoggerSettings(PSUPLOGGERSETTINGS pReq);
150static int supdrvIOCtl_MsrProber(PSUPDRVDEVEXT pDevExt, PSUPMSRPROBER pReq);
151static int supdrvIOCtl_ResumeSuspendedKbds(void);
152
153
154/*********************************************************************************************************************************
155* Global Variables *
156*********************************************************************************************************************************/
157/**
158 * Array of the R0 SUP API.
159 *
160 * While making changes to these exports, make sure to update the IOC
161 * minor version (SUPDRV_IOC_VERSION).
162 *
163 * @remarks This array is processed by SUPR0-def-pe.sed and SUPR0-def-lx.sed to
164 * produce definition files from which import libraries are generated.
165 * Take care when commenting things and especially with \#ifdef'ing.
166 */
167static SUPFUNC g_aFunctions[] =
168{
169/* SED: START */
170 /* name function */
171 /* Entries with absolute addresses determined at runtime, fixup
172 code makes ugly ASSUMPTIONS about the order here: */
173 { "SUPR0AbsIs64bit", (void *)0 },
174 { "SUPR0Abs64bitKernelCS", (void *)0 },
175 { "SUPR0Abs64bitKernelSS", (void *)0 },
176 { "SUPR0Abs64bitKernelDS", (void *)0 },
177 { "SUPR0AbsKernelCS", (void *)0 },
178 { "SUPR0AbsKernelSS", (void *)0 },
179 { "SUPR0AbsKernelDS", (void *)0 },
180 { "SUPR0AbsKernelES", (void *)0 },
181 { "SUPR0AbsKernelFS", (void *)0 },
182 { "SUPR0AbsKernelGS", (void *)0 },
183 /* Normal function pointers: */
184 { "g_pSUPGlobalInfoPage", (void *)&g_pSUPGlobalInfoPage }, /* SED: DATA */
185 { "SUPGetGIP", (void *)(uintptr_t)SUPGetGIP },
186 { "SUPReadTscWithDelta", (void *)(uintptr_t)SUPReadTscWithDelta },
187 { "SUPGetTscDeltaSlow", (void *)(uintptr_t)SUPGetTscDeltaSlow },
188 { "SUPGetCpuHzFromGipForAsyncMode", (void *)(uintptr_t)SUPGetCpuHzFromGipForAsyncMode },
189 { "SUPIsTscFreqCompatible", (void *)(uintptr_t)SUPIsTscFreqCompatible },
190 { "SUPIsTscFreqCompatibleEx", (void *)(uintptr_t)SUPIsTscFreqCompatibleEx },
191 { "SUPR0BadContext", (void *)(uintptr_t)SUPR0BadContext },
192 { "SUPR0ComponentDeregisterFactory", (void *)(uintptr_t)SUPR0ComponentDeregisterFactory },
193 { "SUPR0ComponentQueryFactory", (void *)(uintptr_t)SUPR0ComponentQueryFactory },
194 { "SUPR0ComponentRegisterFactory", (void *)(uintptr_t)SUPR0ComponentRegisterFactory },
195 { "SUPR0ContAlloc", (void *)(uintptr_t)SUPR0ContAlloc },
196 { "SUPR0ContFree", (void *)(uintptr_t)SUPR0ContFree },
197 { "SUPR0ChangeCR4", (void *)(uintptr_t)SUPR0ChangeCR4 },
198 { "SUPR0EnableVTx", (void *)(uintptr_t)SUPR0EnableVTx },
199 { "SUPR0SuspendVTxOnCpu", (void *)(uintptr_t)SUPR0SuspendVTxOnCpu },
200 { "SUPR0ResumeVTxOnCpu", (void *)(uintptr_t)SUPR0ResumeVTxOnCpu },
201 { "SUPR0GetCurrentGdtRw", (void *)(uintptr_t)SUPR0GetCurrentGdtRw },
202 { "SUPR0GetKernelFeatures", (void *)(uintptr_t)SUPR0GetKernelFeatures },
203 { "SUPR0GetHwvirtMsrs", (void *)(uintptr_t)SUPR0GetHwvirtMsrs },
204 { "SUPR0GetPagingMode", (void *)(uintptr_t)SUPR0GetPagingMode },
205 { "SUPR0GetSvmUsability", (void *)(uintptr_t)SUPR0GetSvmUsability },
206 { "SUPR0GetVTSupport", (void *)(uintptr_t)SUPR0GetVTSupport },
207 { "SUPR0GetVmxUsability", (void *)(uintptr_t)SUPR0GetVmxUsability },
208 { "SUPR0LdrIsLockOwnerByMod", (void *)(uintptr_t)SUPR0LdrIsLockOwnerByMod },
209 { "SUPR0LdrLock", (void *)(uintptr_t)SUPR0LdrLock },
210 { "SUPR0LdrUnlock", (void *)(uintptr_t)SUPR0LdrUnlock },
211 { "SUPR0LdrModByName", (void *)(uintptr_t)SUPR0LdrModByName },
212 { "SUPR0LdrModRelease", (void *)(uintptr_t)SUPR0LdrModRelease },
213 { "SUPR0LdrModRetain", (void *)(uintptr_t)SUPR0LdrModRetain },
214 { "SUPR0LockMem", (void *)(uintptr_t)SUPR0LockMem },
215 { "SUPR0LowAlloc", (void *)(uintptr_t)SUPR0LowAlloc },
216 { "SUPR0LowFree", (void *)(uintptr_t)SUPR0LowFree },
217 { "SUPR0MemAlloc", (void *)(uintptr_t)SUPR0MemAlloc },
218 { "SUPR0MemFree", (void *)(uintptr_t)SUPR0MemFree },
219 { "SUPR0MemGetPhys", (void *)(uintptr_t)SUPR0MemGetPhys },
220 { "SUPR0ObjAddRef", (void *)(uintptr_t)SUPR0ObjAddRef },
221 { "SUPR0ObjAddRefEx", (void *)(uintptr_t)SUPR0ObjAddRefEx },
222 { "SUPR0ObjRegister", (void *)(uintptr_t)SUPR0ObjRegister },
223 { "SUPR0ObjRelease", (void *)(uintptr_t)SUPR0ObjRelease },
224 { "SUPR0ObjVerifyAccess", (void *)(uintptr_t)SUPR0ObjVerifyAccess },
225 { "SUPR0PageAllocEx", (void *)(uintptr_t)SUPR0PageAllocEx },
226 { "SUPR0PageFree", (void *)(uintptr_t)SUPR0PageFree },
227 { "SUPR0PageMapKernel", (void *)(uintptr_t)SUPR0PageMapKernel },
228 { "SUPR0PageProtect", (void *)(uintptr_t)SUPR0PageProtect },
229#if defined(RT_OS_LINUX) || defined(RT_OS_SOLARIS)
230 { "SUPR0HCPhysToVirt", (void *)(uintptr_t)SUPR0HCPhysToVirt }, /* only-linux, only solaris */
231#endif
232 { "SUPR0Printf", (void *)(uintptr_t)SUPR0Printf },
233 { "SUPR0GetSessionGVM", (void *)(uintptr_t)SUPR0GetSessionGVM },
234 { "SUPR0GetSessionVM", (void *)(uintptr_t)SUPR0GetSessionVM },
235 { "SUPR0SetSessionVM", (void *)(uintptr_t)SUPR0SetSessionVM },
236 { "SUPR0TscDeltaMeasureBySetIndex", (void *)(uintptr_t)SUPR0TscDeltaMeasureBySetIndex },
237 { "SUPR0TracerDeregisterDrv", (void *)(uintptr_t)SUPR0TracerDeregisterDrv },
238 { "SUPR0TracerDeregisterImpl", (void *)(uintptr_t)SUPR0TracerDeregisterImpl },
239 { "SUPR0TracerFireProbe", (void *)(uintptr_t)SUPR0TracerFireProbe },
240 { "SUPR0TracerRegisterDrv", (void *)(uintptr_t)SUPR0TracerRegisterDrv },
241 { "SUPR0TracerRegisterImpl", (void *)(uintptr_t)SUPR0TracerRegisterImpl },
242 { "SUPR0TracerRegisterModule", (void *)(uintptr_t)SUPR0TracerRegisterModule },
243 { "SUPR0TracerUmodProbeFire", (void *)(uintptr_t)SUPR0TracerUmodProbeFire },
244 { "SUPR0UnlockMem", (void *)(uintptr_t)SUPR0UnlockMem },
245#ifdef RT_OS_WINDOWS
246 { "SUPR0IoCtlSetupForHandle", (void *)(uintptr_t)SUPR0IoCtlSetupForHandle }, /* only-windows */
247 { "SUPR0IoCtlPerform", (void *)(uintptr_t)SUPR0IoCtlPerform }, /* only-windows */
248 { "SUPR0IoCtlCleanup", (void *)(uintptr_t)SUPR0IoCtlCleanup }, /* only-windows */
249#endif
250 { "SUPSemEventClose", (void *)(uintptr_t)SUPSemEventClose },
251 { "SUPSemEventCreate", (void *)(uintptr_t)SUPSemEventCreate },
252 { "SUPSemEventGetResolution", (void *)(uintptr_t)SUPSemEventGetResolution },
253 { "SUPSemEventMultiClose", (void *)(uintptr_t)SUPSemEventMultiClose },
254 { "SUPSemEventMultiCreate", (void *)(uintptr_t)SUPSemEventMultiCreate },
255 { "SUPSemEventMultiGetResolution", (void *)(uintptr_t)SUPSemEventMultiGetResolution },
256 { "SUPSemEventMultiReset", (void *)(uintptr_t)SUPSemEventMultiReset },
257 { "SUPSemEventMultiSignal", (void *)(uintptr_t)SUPSemEventMultiSignal },
258 { "SUPSemEventMultiWait", (void *)(uintptr_t)SUPSemEventMultiWait },
259 { "SUPSemEventMultiWaitNoResume", (void *)(uintptr_t)SUPSemEventMultiWaitNoResume },
260 { "SUPSemEventMultiWaitNsAbsIntr", (void *)(uintptr_t)SUPSemEventMultiWaitNsAbsIntr },
261 { "SUPSemEventMultiWaitNsRelIntr", (void *)(uintptr_t)SUPSemEventMultiWaitNsRelIntr },
262 { "SUPSemEventSignal", (void *)(uintptr_t)SUPSemEventSignal },
263 { "SUPSemEventWait", (void *)(uintptr_t)SUPSemEventWait },
264 { "SUPSemEventWaitNoResume", (void *)(uintptr_t)SUPSemEventWaitNoResume },
265 { "SUPSemEventWaitNsAbsIntr", (void *)(uintptr_t)SUPSemEventWaitNsAbsIntr },
266 { "SUPSemEventWaitNsRelIntr", (void *)(uintptr_t)SUPSemEventWaitNsRelIntr },
267
268 { "RTAssertAreQuiet", (void *)(uintptr_t)RTAssertAreQuiet },
269 { "RTAssertMayPanic", (void *)(uintptr_t)RTAssertMayPanic },
270 { "RTAssertMsg1", (void *)(uintptr_t)RTAssertMsg1 },
271 { "RTAssertMsg2AddV", (void *)(uintptr_t)RTAssertMsg2AddV },
272 { "RTAssertMsg2V", (void *)(uintptr_t)RTAssertMsg2V },
273 { "RTAssertSetMayPanic", (void *)(uintptr_t)RTAssertSetMayPanic },
274 { "RTAssertSetQuiet", (void *)(uintptr_t)RTAssertSetQuiet },
275 { "RTCrc32", (void *)(uintptr_t)RTCrc32 },
276 { "RTCrc32Finish", (void *)(uintptr_t)RTCrc32Finish },
277 { "RTCrc32Process", (void *)(uintptr_t)RTCrc32Process },
278 { "RTCrc32Start", (void *)(uintptr_t)RTCrc32Start },
279 { "RTErrConvertFromErrno", (void *)(uintptr_t)RTErrConvertFromErrno },
280 { "RTErrConvertToErrno", (void *)(uintptr_t)RTErrConvertToErrno },
281 { "RTHandleTableAllocWithCtx", (void *)(uintptr_t)RTHandleTableAllocWithCtx },
282 { "RTHandleTableCreate", (void *)(uintptr_t)RTHandleTableCreate },
283 { "RTHandleTableCreateEx", (void *)(uintptr_t)RTHandleTableCreateEx },
284 { "RTHandleTableDestroy", (void *)(uintptr_t)RTHandleTableDestroy },
285 { "RTHandleTableFreeWithCtx", (void *)(uintptr_t)RTHandleTableFreeWithCtx },
286 { "RTHandleTableLookupWithCtx", (void *)(uintptr_t)RTHandleTableLookupWithCtx },
287 { "RTLogDefaultInstance", (void *)(uintptr_t)RTLogDefaultInstance },
288 { "RTLogDefaultInstanceEx", (void *)(uintptr_t)RTLogDefaultInstanceEx },
289 { "RTLogGetDefaultInstance", (void *)(uintptr_t)RTLogGetDefaultInstance },
290 { "RTLogGetDefaultInstanceEx", (void *)(uintptr_t)RTLogGetDefaultInstanceEx },
291 { "SUPR0GetDefaultLogInstanceEx", (void *)(uintptr_t)SUPR0GetDefaultLogInstanceEx },
292 { "RTLogLoggerExV", (void *)(uintptr_t)RTLogLoggerExV },
293 { "RTLogPrintfV", (void *)(uintptr_t)RTLogPrintfV },
294 { "RTLogRelGetDefaultInstance", (void *)(uintptr_t)RTLogRelGetDefaultInstance },
295 { "RTLogRelGetDefaultInstanceEx", (void *)(uintptr_t)RTLogRelGetDefaultInstanceEx },
296 { "SUPR0GetDefaultLogRelInstanceEx", (void *)(uintptr_t)SUPR0GetDefaultLogRelInstanceEx },
297 { "RTLogSetDefaultInstanceThread", (void *)(uintptr_t)RTLogSetDefaultInstanceThread },
298 { "RTMemAllocExTag", (void *)(uintptr_t)RTMemAllocExTag },
299 { "RTMemAllocTag", (void *)(uintptr_t)RTMemAllocTag },
300 { "RTMemAllocVarTag", (void *)(uintptr_t)RTMemAllocVarTag },
301 { "RTMemAllocZTag", (void *)(uintptr_t)RTMemAllocZTag },
302 { "RTMemAllocZVarTag", (void *)(uintptr_t)RTMemAllocZVarTag },
303 { "RTMemDupExTag", (void *)(uintptr_t)RTMemDupExTag },
304 { "RTMemDupTag", (void *)(uintptr_t)RTMemDupTag },
305 { "RTMemFree", (void *)(uintptr_t)RTMemFree },
306 { "RTMemFreeEx", (void *)(uintptr_t)RTMemFreeEx },
307 { "RTMemReallocTag", (void *)(uintptr_t)RTMemReallocTag },
308 { "RTMpCpuId", (void *)(uintptr_t)RTMpCpuId },
309 { "RTMpCpuIdFromSetIndex", (void *)(uintptr_t)RTMpCpuIdFromSetIndex },
310 { "RTMpCpuIdToSetIndex", (void *)(uintptr_t)RTMpCpuIdToSetIndex },
311 { "RTMpCurSetIndex", (void *)(uintptr_t)RTMpCurSetIndex },
312 { "RTMpCurSetIndexAndId", (void *)(uintptr_t)RTMpCurSetIndexAndId },
313 { "RTMpGetArraySize", (void *)(uintptr_t)RTMpGetArraySize },
314 { "RTMpGetCount", (void *)(uintptr_t)RTMpGetCount },
315 { "RTMpGetMaxCpuId", (void *)(uintptr_t)RTMpGetMaxCpuId },
316 { "RTMpGetOnlineCount", (void *)(uintptr_t)RTMpGetOnlineCount },
317 { "RTMpGetOnlineSet", (void *)(uintptr_t)RTMpGetOnlineSet },
318 { "RTMpGetSet", (void *)(uintptr_t)RTMpGetSet },
319 { "RTMpIsCpuOnline", (void *)(uintptr_t)RTMpIsCpuOnline },
320 { "RTMpIsCpuPossible", (void *)(uintptr_t)RTMpIsCpuPossible },
321 { "RTMpIsCpuWorkPending", (void *)(uintptr_t)RTMpIsCpuWorkPending },
322 { "RTMpNotificationDeregister", (void *)(uintptr_t)RTMpNotificationDeregister },
323 { "RTMpNotificationRegister", (void *)(uintptr_t)RTMpNotificationRegister },
324 { "RTMpOnAll", (void *)(uintptr_t)RTMpOnAll },
325 { "RTMpOnOthers", (void *)(uintptr_t)RTMpOnOthers },
326 { "RTMpOnSpecific", (void *)(uintptr_t)RTMpOnSpecific },
327 { "RTMpPokeCpu", (void *)(uintptr_t)RTMpPokeCpu },
328 { "RTNetIPv4AddDataChecksum", (void *)(uintptr_t)RTNetIPv4AddDataChecksum },
329 { "RTNetIPv4AddTCPChecksum", (void *)(uintptr_t)RTNetIPv4AddTCPChecksum },
330 { "RTNetIPv4AddUDPChecksum", (void *)(uintptr_t)RTNetIPv4AddUDPChecksum },
331 { "RTNetIPv4FinalizeChecksum", (void *)(uintptr_t)RTNetIPv4FinalizeChecksum },
332 { "RTNetIPv4HdrChecksum", (void *)(uintptr_t)RTNetIPv4HdrChecksum },
333 { "RTNetIPv4IsDHCPValid", (void *)(uintptr_t)RTNetIPv4IsDHCPValid },
334 { "RTNetIPv4IsHdrValid", (void *)(uintptr_t)RTNetIPv4IsHdrValid },
335 { "RTNetIPv4IsTCPSizeValid", (void *)(uintptr_t)RTNetIPv4IsTCPSizeValid },
336 { "RTNetIPv4IsTCPValid", (void *)(uintptr_t)RTNetIPv4IsTCPValid },
337 { "RTNetIPv4IsUDPSizeValid", (void *)(uintptr_t)RTNetIPv4IsUDPSizeValid },
338 { "RTNetIPv4IsUDPValid", (void *)(uintptr_t)RTNetIPv4IsUDPValid },
339 { "RTNetIPv4PseudoChecksum", (void *)(uintptr_t)RTNetIPv4PseudoChecksum },
340 { "RTNetIPv4PseudoChecksumBits", (void *)(uintptr_t)RTNetIPv4PseudoChecksumBits },
341 { "RTNetIPv4TCPChecksum", (void *)(uintptr_t)RTNetIPv4TCPChecksum },
342 { "RTNetIPv4UDPChecksum", (void *)(uintptr_t)RTNetIPv4UDPChecksum },
343 { "RTNetIPv6PseudoChecksum", (void *)(uintptr_t)RTNetIPv6PseudoChecksum },
344 { "RTNetIPv6PseudoChecksumBits", (void *)(uintptr_t)RTNetIPv6PseudoChecksumBits },
345 { "RTNetIPv6PseudoChecksumEx", (void *)(uintptr_t)RTNetIPv6PseudoChecksumEx },
346 { "RTNetTCPChecksum", (void *)(uintptr_t)RTNetTCPChecksum },
347 { "RTNetUDPChecksum", (void *)(uintptr_t)RTNetUDPChecksum },
348 { "RTPowerNotificationDeregister", (void *)(uintptr_t)RTPowerNotificationDeregister },
349 { "RTPowerNotificationRegister", (void *)(uintptr_t)RTPowerNotificationRegister },
350 { "RTProcSelf", (void *)(uintptr_t)RTProcSelf },
351 { "RTR0AssertPanicSystem", (void *)(uintptr_t)RTR0AssertPanicSystem },
352#if defined(RT_OS_DARWIN) || defined(RT_OS_SOLARIS) || defined(RT_OS_WINDOWS)
353 { "RTR0DbgKrnlInfoOpen", (void *)(uintptr_t)RTR0DbgKrnlInfoOpen }, /* only-darwin, only-solaris, only-windows */
354 { "RTR0DbgKrnlInfoQueryMember", (void *)(uintptr_t)RTR0DbgKrnlInfoQueryMember }, /* only-darwin, only-solaris, only-windows */
355# if defined(RT_OS_SOLARIS)
356 { "RTR0DbgKrnlInfoQuerySize", (void *)(uintptr_t)RTR0DbgKrnlInfoQuerySize }, /* only-solaris */
357# endif
358 { "RTR0DbgKrnlInfoQuerySymbol", (void *)(uintptr_t)RTR0DbgKrnlInfoQuerySymbol }, /* only-darwin, only-solaris, only-windows */
359 { "RTR0DbgKrnlInfoRelease", (void *)(uintptr_t)RTR0DbgKrnlInfoRelease }, /* only-darwin, only-solaris, only-windows */
360 { "RTR0DbgKrnlInfoRetain", (void *)(uintptr_t)RTR0DbgKrnlInfoRetain }, /* only-darwin, only-solaris, only-windows */
361#endif
362 { "RTR0MemAreKrnlAndUsrDifferent", (void *)(uintptr_t)RTR0MemAreKrnlAndUsrDifferent },
363 { "RTR0MemKernelIsValidAddr", (void *)(uintptr_t)RTR0MemKernelIsValidAddr },
364 { "RTR0MemKernelCopyFrom", (void *)(uintptr_t)RTR0MemKernelCopyFrom },
365 { "RTR0MemKernelCopyTo", (void *)(uintptr_t)RTR0MemKernelCopyTo },
366 { "RTR0MemObjAddress", (void *)(uintptr_t)RTR0MemObjAddress },
367 { "RTR0MemObjAddressR3", (void *)(uintptr_t)RTR0MemObjAddressR3 },
368 { "RTR0MemObjAllocContTag", (void *)(uintptr_t)RTR0MemObjAllocContTag },
369 { "RTR0MemObjAllocLowTag", (void *)(uintptr_t)RTR0MemObjAllocLowTag },
370 { "RTR0MemObjAllocPageTag", (void *)(uintptr_t)RTR0MemObjAllocPageTag },
371 { "RTR0MemObjAllocPhysExTag", (void *)(uintptr_t)RTR0MemObjAllocPhysExTag },
372 { "RTR0MemObjAllocPhysNCTag", (void *)(uintptr_t)RTR0MemObjAllocPhysNCTag },
373 { "RTR0MemObjAllocPhysTag", (void *)(uintptr_t)RTR0MemObjAllocPhysTag },
374 { "RTR0MemObjEnterPhysTag", (void *)(uintptr_t)RTR0MemObjEnterPhysTag },
375 { "RTR0MemObjFree", (void *)(uintptr_t)RTR0MemObjFree },
376 { "RTR0MemObjGetPagePhysAddr", (void *)(uintptr_t)RTR0MemObjGetPagePhysAddr },
377 { "RTR0MemObjIsMapping", (void *)(uintptr_t)RTR0MemObjIsMapping },
378 { "RTR0MemObjLockUserTag", (void *)(uintptr_t)RTR0MemObjLockUserTag },
379 { "RTR0MemObjMapKernelExTag", (void *)(uintptr_t)RTR0MemObjMapKernelExTag },
380 { "RTR0MemObjMapKernelTag", (void *)(uintptr_t)RTR0MemObjMapKernelTag },
381 { "RTR0MemObjMapUserTag", (void *)(uintptr_t)RTR0MemObjMapUserTag },
382 { "RTR0MemObjMapUserExTag", (void *)(uintptr_t)RTR0MemObjMapUserExTag },
383 { "RTR0MemObjProtect", (void *)(uintptr_t)RTR0MemObjProtect },
384 { "RTR0MemObjSize", (void *)(uintptr_t)RTR0MemObjSize },
385 { "RTR0MemUserCopyFrom", (void *)(uintptr_t)RTR0MemUserCopyFrom },
386 { "RTR0MemUserCopyTo", (void *)(uintptr_t)RTR0MemUserCopyTo },
387 { "RTR0MemUserIsValidAddr", (void *)(uintptr_t)RTR0MemUserIsValidAddr },
388 { "RTR0ProcHandleSelf", (void *)(uintptr_t)RTR0ProcHandleSelf },
389 { "RTSemEventCreate", (void *)(uintptr_t)RTSemEventCreate },
390 { "RTSemEventDestroy", (void *)(uintptr_t)RTSemEventDestroy },
391 { "RTSemEventGetResolution", (void *)(uintptr_t)RTSemEventGetResolution },
392 { "RTSemEventMultiCreate", (void *)(uintptr_t)RTSemEventMultiCreate },
393 { "RTSemEventMultiDestroy", (void *)(uintptr_t)RTSemEventMultiDestroy },
394 { "RTSemEventMultiGetResolution", (void *)(uintptr_t)RTSemEventMultiGetResolution },
395 { "RTSemEventMultiReset", (void *)(uintptr_t)RTSemEventMultiReset },
396 { "RTSemEventMultiSignal", (void *)(uintptr_t)RTSemEventMultiSignal },
397 { "RTSemEventMultiWait", (void *)(uintptr_t)RTSemEventMultiWait },
398 { "RTSemEventMultiWaitEx", (void *)(uintptr_t)RTSemEventMultiWaitEx },
399 { "RTSemEventMultiWaitExDebug", (void *)(uintptr_t)RTSemEventMultiWaitExDebug },
400 { "RTSemEventMultiWaitNoResume", (void *)(uintptr_t)RTSemEventMultiWaitNoResume },
401 { "RTSemEventSignal", (void *)(uintptr_t)RTSemEventSignal },
402 { "RTSemEventWait", (void *)(uintptr_t)RTSemEventWait },
403 { "RTSemEventWaitEx", (void *)(uintptr_t)RTSemEventWaitEx },
404 { "RTSemEventWaitExDebug", (void *)(uintptr_t)RTSemEventWaitExDebug },
405 { "RTSemEventWaitNoResume", (void *)(uintptr_t)RTSemEventWaitNoResume },
406 { "RTSemFastMutexCreate", (void *)(uintptr_t)RTSemFastMutexCreate },
407 { "RTSemFastMutexDestroy", (void *)(uintptr_t)RTSemFastMutexDestroy },
408 { "RTSemFastMutexRelease", (void *)(uintptr_t)RTSemFastMutexRelease },
409 { "RTSemFastMutexRequest", (void *)(uintptr_t)RTSemFastMutexRequest },
410 { "RTSemMutexCreate", (void *)(uintptr_t)RTSemMutexCreate },
411 { "RTSemMutexDestroy", (void *)(uintptr_t)RTSemMutexDestroy },
412 { "RTSemMutexRelease", (void *)(uintptr_t)RTSemMutexRelease },
413 { "RTSemMutexRequest", (void *)(uintptr_t)RTSemMutexRequest },
414 { "RTSemMutexRequestDebug", (void *)(uintptr_t)RTSemMutexRequestDebug },
415 { "RTSemMutexRequestNoResume", (void *)(uintptr_t)RTSemMutexRequestNoResume },
416 { "RTSemMutexRequestNoResumeDebug", (void *)(uintptr_t)RTSemMutexRequestNoResumeDebug },
417 { "RTSpinlockAcquire", (void *)(uintptr_t)RTSpinlockAcquire },
418 { "RTSpinlockCreate", (void *)(uintptr_t)RTSpinlockCreate },
419 { "RTSpinlockDestroy", (void *)(uintptr_t)RTSpinlockDestroy },
420 { "RTSpinlockRelease", (void *)(uintptr_t)RTSpinlockRelease },
421 { "RTStrCopy", (void *)(uintptr_t)RTStrCopy },
422 { "RTStrDupTag", (void *)(uintptr_t)RTStrDupTag },
423 { "RTStrFormat", (void *)(uintptr_t)RTStrFormat },
424 { "RTStrFormatNumber", (void *)(uintptr_t)RTStrFormatNumber },
425 { "RTStrFormatTypeDeregister", (void *)(uintptr_t)RTStrFormatTypeDeregister },
426 { "RTStrFormatTypeRegister", (void *)(uintptr_t)RTStrFormatTypeRegister },
427 { "RTStrFormatTypeSetUser", (void *)(uintptr_t)RTStrFormatTypeSetUser },
428 { "RTStrFormatV", (void *)(uintptr_t)RTStrFormatV },
429 { "RTStrFree", (void *)(uintptr_t)RTStrFree },
430 { "RTStrNCmp", (void *)(uintptr_t)RTStrNCmp },
431 { "RTStrPrintf", (void *)(uintptr_t)RTStrPrintf },
432 { "RTStrPrintfEx", (void *)(uintptr_t)RTStrPrintfEx },
433 { "RTStrPrintfExV", (void *)(uintptr_t)RTStrPrintfExV },
434 { "RTStrPrintfV", (void *)(uintptr_t)RTStrPrintfV },
435 { "RTThreadCreate", (void *)(uintptr_t)RTThreadCreate },
436 { "RTThreadCtxHookIsEnabled", (void *)(uintptr_t)RTThreadCtxHookIsEnabled },
437 { "RTThreadCtxHookCreate", (void *)(uintptr_t)RTThreadCtxHookCreate },
438 { "RTThreadCtxHookDestroy", (void *)(uintptr_t)RTThreadCtxHookDestroy },
439 { "RTThreadCtxHookDisable", (void *)(uintptr_t)RTThreadCtxHookDisable },
440 { "RTThreadCtxHookEnable", (void *)(uintptr_t)RTThreadCtxHookEnable },
441 { "RTThreadGetName", (void *)(uintptr_t)RTThreadGetName },
442 { "RTThreadGetNative", (void *)(uintptr_t)RTThreadGetNative },
443 { "RTThreadGetType", (void *)(uintptr_t)RTThreadGetType },
444 { "RTThreadIsInInterrupt", (void *)(uintptr_t)RTThreadIsInInterrupt },
445 { "RTThreadNativeSelf", (void *)(uintptr_t)RTThreadNativeSelf },
446 { "RTThreadPreemptDisable", (void *)(uintptr_t)RTThreadPreemptDisable },
447 { "RTThreadPreemptIsEnabled", (void *)(uintptr_t)RTThreadPreemptIsEnabled },
448 { "RTThreadPreemptIsPending", (void *)(uintptr_t)RTThreadPreemptIsPending },
449 { "RTThreadPreemptIsPendingTrusty", (void *)(uintptr_t)RTThreadPreemptIsPendingTrusty },
450 { "RTThreadPreemptIsPossible", (void *)(uintptr_t)RTThreadPreemptIsPossible },
451 { "RTThreadPreemptRestore", (void *)(uintptr_t)RTThreadPreemptRestore },
452 { "RTThreadSelf", (void *)(uintptr_t)RTThreadSelf },
453 { "RTThreadSelfName", (void *)(uintptr_t)RTThreadSelfName },
454 { "RTThreadSleep", (void *)(uintptr_t)RTThreadSleep },
455 { "RTThreadUserReset", (void *)(uintptr_t)RTThreadUserReset },
456 { "RTThreadUserSignal", (void *)(uintptr_t)RTThreadUserSignal },
457 { "RTThreadUserWait", (void *)(uintptr_t)RTThreadUserWait },
458 { "RTThreadUserWaitNoResume", (void *)(uintptr_t)RTThreadUserWaitNoResume },
459 { "RTThreadWait", (void *)(uintptr_t)RTThreadWait },
460 { "RTThreadWaitNoResume", (void *)(uintptr_t)RTThreadWaitNoResume },
461 { "RTThreadYield", (void *)(uintptr_t)RTThreadYield },
462 { "RTTimeNow", (void *)(uintptr_t)RTTimeNow },
463 { "RTTimerCanDoHighResolution", (void *)(uintptr_t)RTTimerCanDoHighResolution },
464 { "RTTimerChangeInterval", (void *)(uintptr_t)RTTimerChangeInterval },
465 { "RTTimerCreate", (void *)(uintptr_t)RTTimerCreate },
466 { "RTTimerCreateEx", (void *)(uintptr_t)RTTimerCreateEx },
467 { "RTTimerDestroy", (void *)(uintptr_t)RTTimerDestroy },
468 { "RTTimerGetSystemGranularity", (void *)(uintptr_t)RTTimerGetSystemGranularity },
469 { "RTTimerReleaseSystemGranularity", (void *)(uintptr_t)RTTimerReleaseSystemGranularity },
470 { "RTTimerRequestSystemGranularity", (void *)(uintptr_t)RTTimerRequestSystemGranularity },
471 { "RTTimerStart", (void *)(uintptr_t)RTTimerStart },
472 { "RTTimerStop", (void *)(uintptr_t)RTTimerStop },
473 { "RTTimeSystemMilliTS", (void *)(uintptr_t)RTTimeSystemMilliTS },
474 { "RTTimeSystemNanoTS", (void *)(uintptr_t)RTTimeSystemNanoTS },
475 { "RTUuidCompare", (void *)(uintptr_t)RTUuidCompare },
476 { "RTUuidCompareStr", (void *)(uintptr_t)RTUuidCompareStr },
477 { "RTUuidFromStr", (void *)(uintptr_t)RTUuidFromStr },
478/* SED: END */
479};
480
481#if defined(RT_OS_DARWIN) || defined(RT_OS_SOLARIS) || defined(RT_OS_FREEBSD)
482/**
483 * Drag in the rest of IRPT since we share it with the
484 * rest of the kernel modules on darwin.
485 */
486PFNRT g_apfnVBoxDrvIPRTDeps[] =
487{
488 /* VBoxNetAdp */
489 (PFNRT)RTRandBytes,
490 /* VBoxUSB */
491 (PFNRT)RTPathStripFilename,
492#if !defined(RT_OS_FREEBSD)
493 (PFNRT)RTHandleTableAlloc,
494 (PFNRT)RTStrPurgeEncoding,
495#endif
496 NULL
497};
498#endif /* RT_OS_DARWIN || RT_OS_SOLARIS || RT_OS_FREEBSD */
499
500
501
502/**
503 * Initializes the device extentsion structure.
504 *
505 * @returns IPRT status code.
506 * @param pDevExt The device extension to initialize.
507 * @param cbSession The size of the session structure. The size of
508 * SUPDRVSESSION may be smaller when SUPDRV_AGNOSTIC is
509 * defined because we're skipping the OS specific members
510 * then.
511 */
512int VBOXCALL supdrvInitDevExt(PSUPDRVDEVEXT pDevExt, size_t cbSession)
513{
514 int rc;
515
516#ifdef SUPDRV_WITH_RELEASE_LOGGER
517 /*
518 * Create the release log.
519 */
520 static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
521 PRTLOGGER pRelLogger;
522 rc = RTLogCreate(&pRelLogger, 0 /* fFlags */, "all",
523 "VBOX_RELEASE_LOG", RT_ELEMENTS(s_apszGroups), s_apszGroups, RTLOGDEST_STDOUT | RTLOGDEST_DEBUGGER, NULL);
524 if (RT_SUCCESS(rc))
525 RTLogRelSetDefaultInstance(pRelLogger);
526 /** @todo Add native hook for getting logger config parameters and setting
527 * them. On linux we should use the module parameter stuff... */
528#endif
529
530#if (defined(RT_ARCH_AMD64) || defined(RT_ARCH_X86)) && !defined(VBOX_WITH_OLD_CPU_SUPPORT)
531 /*
532 * Require SSE2 to be present.
533 */
534 if (!(ASMCpuId_EDX(1) & X86_CPUID_FEATURE_EDX_SSE2))
535 {
536 SUPR0Printf("vboxdrv: Requires SSE2 (cpuid(0).EDX=%#x)\n", ASMCpuId_EDX(1));
537 return VERR_UNSUPPORTED_CPU;
538 }
539#endif
540
541 /*
542 * Initialize it.
543 */
544 memset(pDevExt, 0, sizeof(*pDevExt)); /* Does not wipe OS specific tail section of the structure. */
545 pDevExt->Spinlock = NIL_RTSPINLOCK;
546 pDevExt->hGipSpinlock = NIL_RTSPINLOCK;
547 pDevExt->hSessionHashTabSpinlock = NIL_RTSPINLOCK;
548#ifdef SUPDRV_USE_MUTEX_FOR_LDR
549 pDevExt->mtxLdr = NIL_RTSEMMUTEX;
550#else
551 pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
552#endif
553#ifdef SUPDRV_USE_MUTEX_FOR_GIP
554 pDevExt->mtxGip = NIL_RTSEMMUTEX;
555 pDevExt->mtxTscDelta = NIL_RTSEMMUTEX;
556#else
557 pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
558 pDevExt->mtxTscDelta = NIL_RTSEMFASTMUTEX;
559#endif
560
561 rc = RTSpinlockCreate(&pDevExt->Spinlock, RTSPINLOCK_FLAGS_INTERRUPT_SAFE, "SUPDrvDevExt");
562 if (RT_SUCCESS(rc))
563 rc = RTSpinlockCreate(&pDevExt->hGipSpinlock, RTSPINLOCK_FLAGS_INTERRUPT_SAFE, "SUPDrvGip");
564 if (RT_SUCCESS(rc))
565 rc = RTSpinlockCreate(&pDevExt->hSessionHashTabSpinlock, RTSPINLOCK_FLAGS_INTERRUPT_SAFE, "SUPDrvSession");
566
567 if (RT_SUCCESS(rc))
568#ifdef SUPDRV_USE_MUTEX_FOR_LDR
569 rc = RTSemMutexCreate(&pDevExt->mtxLdr);
570#else
571 rc = RTSemFastMutexCreate(&pDevExt->mtxLdr);
572#endif
573 if (RT_SUCCESS(rc))
574#ifdef SUPDRV_USE_MUTEX_FOR_GIP
575 rc = RTSemMutexCreate(&pDevExt->mtxTscDelta);
576#else
577 rc = RTSemFastMutexCreate(&pDevExt->mtxTscDelta);
578#endif
579 if (RT_SUCCESS(rc))
580 {
581 rc = RTSemFastMutexCreate(&pDevExt->mtxComponentFactory);
582 if (RT_SUCCESS(rc))
583 {
584#ifdef SUPDRV_USE_MUTEX_FOR_GIP
585 rc = RTSemMutexCreate(&pDevExt->mtxGip);
586#else
587 rc = RTSemFastMutexCreate(&pDevExt->mtxGip);
588#endif
589 if (RT_SUCCESS(rc))
590 {
591 rc = supdrvGipCreate(pDevExt);
592 if (RT_SUCCESS(rc))
593 {
594 rc = supdrvTracerInit(pDevExt);
595 if (RT_SUCCESS(rc))
596 {
597 pDevExt->pLdrInitImage = NULL;
598 pDevExt->hLdrInitThread = NIL_RTNATIVETHREAD;
599 pDevExt->hLdrTermThread = NIL_RTNATIVETHREAD;
600 pDevExt->u32Cookie = BIRD; /** @todo make this random? */
601 pDevExt->cbSession = (uint32_t)cbSession;
602
603 /*
604 * Fixup the absolute symbols.
605 *
606 * Because of the table indexing assumptions we'll have a little #ifdef orgy
607 * here rather than distributing this to OS specific files. At least for now.
608 */
609#ifdef RT_OS_DARWIN
610# if ARCH_BITS == 32
611 if (SUPR0GetPagingMode() >= SUPPAGINGMODE_AMD64)
612 {
613 g_aFunctions[0].pfn = (void *)1; /* SUPR0AbsIs64bit */
614 g_aFunctions[1].pfn = (void *)0x80; /* SUPR0Abs64bitKernelCS - KERNEL64_CS, seg.h */
615 g_aFunctions[2].pfn = (void *)0x88; /* SUPR0Abs64bitKernelSS - KERNEL64_SS, seg.h */
616 g_aFunctions[3].pfn = (void *)0x88; /* SUPR0Abs64bitKernelDS - KERNEL64_SS, seg.h */
617 }
618 else
619 g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[3].pfn = (void *)0;
620 g_aFunctions[4].pfn = (void *)0x08; /* SUPR0AbsKernelCS - KERNEL_CS, seg.h */
621 g_aFunctions[5].pfn = (void *)0x10; /* SUPR0AbsKernelSS - KERNEL_DS, seg.h */
622 g_aFunctions[6].pfn = (void *)0x10; /* SUPR0AbsKernelDS - KERNEL_DS, seg.h */
623 g_aFunctions[7].pfn = (void *)0x10; /* SUPR0AbsKernelES - KERNEL_DS, seg.h */
624 g_aFunctions[8].pfn = (void *)0x10; /* SUPR0AbsKernelFS - KERNEL_DS, seg.h */
625 g_aFunctions[9].pfn = (void *)0x48; /* SUPR0AbsKernelGS - CPU_DATA_GS, seg.h */
626# else /* 64-bit darwin: */
627 g_aFunctions[0].pfn = (void *)1; /* SUPR0AbsIs64bit */
628 g_aFunctions[1].pfn = (void *)(uintptr_t)ASMGetCS(); /* SUPR0Abs64bitKernelCS */
629 g_aFunctions[2].pfn = (void *)(uintptr_t)ASMGetSS(); /* SUPR0Abs64bitKernelSS */
630 g_aFunctions[3].pfn = (void *)0; /* SUPR0Abs64bitKernelDS */
631 g_aFunctions[4].pfn = (void *)(uintptr_t)ASMGetCS(); /* SUPR0AbsKernelCS */
632 g_aFunctions[5].pfn = (void *)(uintptr_t)ASMGetSS(); /* SUPR0AbsKernelSS */
633 g_aFunctions[6].pfn = (void *)0; /* SUPR0AbsKernelDS */
634 g_aFunctions[7].pfn = (void *)0; /* SUPR0AbsKernelES */
635 g_aFunctions[8].pfn = (void *)0; /* SUPR0AbsKernelFS */
636 g_aFunctions[9].pfn = (void *)0; /* SUPR0AbsKernelGS */
637
638# endif
639#else /* !RT_OS_DARWIN */
640# if ARCH_BITS == 64
641 g_aFunctions[0].pfn = (void *)1; /* SUPR0AbsIs64bit */
642 g_aFunctions[1].pfn = (void *)(uintptr_t)ASMGetCS(); /* SUPR0Abs64bitKernelCS */
643 g_aFunctions[2].pfn = (void *)(uintptr_t)ASMGetSS(); /* SUPR0Abs64bitKernelSS */
644 g_aFunctions[3].pfn = (void *)(uintptr_t)ASMGetDS(); /* SUPR0Abs64bitKernelDS */
645# else
646 g_aFunctions[0].pfn = g_aFunctions[1].pfn = g_aFunctions[2].pfn = g_aFunctions[3].pfn = (void *)0;
647# endif
648 g_aFunctions[4].pfn = (void *)(uintptr_t)ASMGetCS(); /* SUPR0AbsKernelCS */
649 g_aFunctions[5].pfn = (void *)(uintptr_t)ASMGetSS(); /* SUPR0AbsKernelSS */
650 g_aFunctions[6].pfn = (void *)(uintptr_t)ASMGetDS(); /* SUPR0AbsKernelDS */
651 g_aFunctions[7].pfn = (void *)(uintptr_t)ASMGetES(); /* SUPR0AbsKernelES */
652 g_aFunctions[8].pfn = (void *)(uintptr_t)ASMGetFS(); /* SUPR0AbsKernelFS */
653 g_aFunctions[9].pfn = (void *)(uintptr_t)ASMGetGS(); /* SUPR0AbsKernelGS */
654#endif /* !RT_OS_DARWIN */
655 return VINF_SUCCESS;
656 }
657
658 supdrvGipDestroy(pDevExt);
659 }
660
661#ifdef SUPDRV_USE_MUTEX_FOR_GIP
662 RTSemMutexDestroy(pDevExt->mtxGip);
663 pDevExt->mtxGip = NIL_RTSEMMUTEX;
664#else
665 RTSemFastMutexDestroy(pDevExt->mtxGip);
666 pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
667#endif
668 }
669 RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
670 pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
671 }
672 }
673
674#ifdef SUPDRV_USE_MUTEX_FOR_GIP
675 RTSemMutexDestroy(pDevExt->mtxTscDelta);
676 pDevExt->mtxTscDelta = NIL_RTSEMMUTEX;
677#else
678 RTSemFastMutexDestroy(pDevExt->mtxTscDelta);
679 pDevExt->mtxTscDelta = NIL_RTSEMFASTMUTEX;
680#endif
681#ifdef SUPDRV_USE_MUTEX_FOR_LDR
682 RTSemMutexDestroy(pDevExt->mtxLdr);
683 pDevExt->mtxLdr = NIL_RTSEMMUTEX;
684#else
685 RTSemFastMutexDestroy(pDevExt->mtxLdr);
686 pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
687#endif
688 RTSpinlockDestroy(pDevExt->Spinlock);
689 pDevExt->Spinlock = NIL_RTSPINLOCK;
690 RTSpinlockDestroy(pDevExt->hGipSpinlock);
691 pDevExt->hGipSpinlock = NIL_RTSPINLOCK;
692 RTSpinlockDestroy(pDevExt->hSessionHashTabSpinlock);
693 pDevExt->hSessionHashTabSpinlock = NIL_RTSPINLOCK;
694
695#ifdef SUPDRV_WITH_RELEASE_LOGGER
696 RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
697 RTLogDestroy(RTLogSetDefaultInstance(NULL));
698#endif
699
700 return rc;
701}
702
703
704/**
705 * Delete the device extension (e.g. cleanup members).
706 *
707 * @param pDevExt The device extension to delete.
708 */
709void VBOXCALL supdrvDeleteDevExt(PSUPDRVDEVEXT pDevExt)
710{
711 PSUPDRVOBJ pObj;
712 PSUPDRVUSAGE pUsage;
713
714 /*
715 * Kill mutexes and spinlocks.
716 */
717#ifdef SUPDRV_USE_MUTEX_FOR_GIP
718 RTSemMutexDestroy(pDevExt->mtxGip);
719 pDevExt->mtxGip = NIL_RTSEMMUTEX;
720 RTSemMutexDestroy(pDevExt->mtxTscDelta);
721 pDevExt->mtxTscDelta = NIL_RTSEMMUTEX;
722#else
723 RTSemFastMutexDestroy(pDevExt->mtxGip);
724 pDevExt->mtxGip = NIL_RTSEMFASTMUTEX;
725 RTSemFastMutexDestroy(pDevExt->mtxTscDelta);
726 pDevExt->mtxTscDelta = NIL_RTSEMFASTMUTEX;
727#endif
728#ifdef SUPDRV_USE_MUTEX_FOR_LDR
729 RTSemMutexDestroy(pDevExt->mtxLdr);
730 pDevExt->mtxLdr = NIL_RTSEMMUTEX;
731#else
732 RTSemFastMutexDestroy(pDevExt->mtxLdr);
733 pDevExt->mtxLdr = NIL_RTSEMFASTMUTEX;
734#endif
735 RTSpinlockDestroy(pDevExt->Spinlock);
736 pDevExt->Spinlock = NIL_RTSPINLOCK;
737 RTSemFastMutexDestroy(pDevExt->mtxComponentFactory);
738 pDevExt->mtxComponentFactory = NIL_RTSEMFASTMUTEX;
739 RTSpinlockDestroy(pDevExt->hSessionHashTabSpinlock);
740 pDevExt->hSessionHashTabSpinlock = NIL_RTSPINLOCK;
741
742 /*
743 * Free lists.
744 */
745 /* objects. */
746 pObj = pDevExt->pObjs;
747 Assert(!pObj); /* (can trigger on forced unloads) */
748 pDevExt->pObjs = NULL;
749 while (pObj)
750 {
751 void *pvFree = pObj;
752 pObj = pObj->pNext;
753 RTMemFree(pvFree);
754 }
755
756 /* usage records. */
757 pUsage = pDevExt->pUsageFree;
758 pDevExt->pUsageFree = NULL;
759 while (pUsage)
760 {
761 void *pvFree = pUsage;
762 pUsage = pUsage->pNext;
763 RTMemFree(pvFree);
764 }
765
766 /* kill the GIP. */
767 supdrvGipDestroy(pDevExt);
768 RTSpinlockDestroy(pDevExt->hGipSpinlock);
769 pDevExt->hGipSpinlock = NIL_RTSPINLOCK;
770
771 supdrvTracerTerm(pDevExt);
772
773#ifdef SUPDRV_WITH_RELEASE_LOGGER
774 /* destroy the loggers. */
775 RTLogDestroy(RTLogRelSetDefaultInstance(NULL));
776 RTLogDestroy(RTLogSetDefaultInstance(NULL));
777#endif
778}
779
780
781/**
782 * Create session.
783 *
784 * @returns IPRT status code.
785 * @param pDevExt Device extension.
786 * @param fUser Flag indicating whether this is a user or kernel
787 * session.
788 * @param fUnrestricted Unrestricted access (system) or restricted access
789 * (user)?
790 * @param ppSession Where to store the pointer to the session data.
791 */
792int VBOXCALL supdrvCreateSession(PSUPDRVDEVEXT pDevExt, bool fUser, bool fUnrestricted, PSUPDRVSESSION *ppSession)
793{
794 int rc;
795 PSUPDRVSESSION pSession;
796
797 if (!SUP_IS_DEVEXT_VALID(pDevExt))
798 return VERR_INVALID_PARAMETER;
799
800 /*
801 * Allocate memory for the session data.
802 */
803 pSession = *ppSession = (PSUPDRVSESSION)RTMemAllocZ(pDevExt->cbSession);
804 if (pSession)
805 {
806 /* Initialize session data. */
807 rc = RTSpinlockCreate(&pSession->Spinlock, RTSPINLOCK_FLAGS_INTERRUPT_UNSAFE, "SUPDrvSession");
808 if (!rc)
809 {
810 rc = RTHandleTableCreateEx(&pSession->hHandleTable,
811 RTHANDLETABLE_FLAGS_LOCKED_IRQ_SAFE | RTHANDLETABLE_FLAGS_CONTEXT,
812 1 /*uBase*/, 32768 /*cMax*/, supdrvSessionObjHandleRetain, pSession);
813 if (RT_SUCCESS(rc))
814 {
815 Assert(pSession->Spinlock != NIL_RTSPINLOCK);
816 pSession->pDevExt = pDevExt;
817 pSession->u32Cookie = BIRD_INV;
818 pSession->fUnrestricted = fUnrestricted;
819 /*pSession->fInHashTable = false; */
820 pSession->cRefs = 1;
821 /*pSession->pCommonNextHash = NULL;
822 pSession->ppOsSessionPtr = NULL; */
823 if (fUser)
824 {
825 pSession->Process = RTProcSelf();
826 pSession->R0Process = RTR0ProcHandleSelf();
827 }
828 else
829 {
830 pSession->Process = NIL_RTPROCESS;
831 pSession->R0Process = NIL_RTR0PROCESS;
832 }
833 /*pSession->pLdrUsage = NULL;
834 pSession->pVM = NULL;
835 pSession->pUsage = NULL;
836 pSession->pGip = NULL;
837 pSession->fGipReferenced = false;
838 pSession->Bundle.cUsed = 0; */
839 pSession->Uid = NIL_RTUID;
840 pSession->Gid = NIL_RTGID;
841 /*pSession->uTracerData = 0;*/
842 pSession->hTracerCaller = NIL_RTNATIVETHREAD;
843 RTListInit(&pSession->TpProviders);
844 /*pSession->cTpProviders = 0;*/
845 /*pSession->cTpProbesFiring = 0;*/
846 RTListInit(&pSession->TpUmods);
847 /*RT_ZERO(pSession->apTpLookupTable);*/
848
849 VBOXDRV_SESSION_CREATE(pSession, fUser);
850 LogFlow(("Created session %p initial cookie=%#x\n", pSession, pSession->u32Cookie));
851 return VINF_SUCCESS;
852 }
853
854 RTSpinlockDestroy(pSession->Spinlock);
855 }
856 RTMemFree(pSession);
857 *ppSession = NULL;
858 Log(("Failed to create spinlock, rc=%d!\n", rc));
859 }
860 else
861 rc = VERR_NO_MEMORY;
862
863 return rc;
864}
865
866
867/**
868 * Cleans up the session in the context of the process to which it belongs, the
869 * caller will free the session and the session spinlock.
870 *
871 * This should normally occur when the session is closed or as the process
872 * exits. Careful reference counting in the OS specfic code makes sure that
873 * there cannot be any races between process/handle cleanup callbacks and
874 * threads doing I/O control calls.
875 *
876 * @param pDevExt The device extension.
877 * @param pSession Session data.
878 */
879static void supdrvCleanupSession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
880{
881 int rc;
882 PSUPDRVBUNDLE pBundle;
883 LogFlow(("supdrvCleanupSession: pSession=%p\n", pSession));
884
885 Assert(!pSession->fInHashTable);
886 Assert(!pSession->ppOsSessionPtr);
887 AssertLogRelMsg(pSession->R0Process == RTR0ProcHandleSelf() || pSession->R0Process == NIL_RTR0PROCESS,
888 ("R0Process=%p cur=%p; curpid=%u\n",
889 pSession->R0Process, RTR0ProcHandleSelf(), RTProcSelf()));
890
891 /*
892 * Remove logger instances related to this session.
893 */
894 RTLogSetDefaultInstanceThread(NULL, (uintptr_t)pSession);
895
896 /*
897 * Destroy the handle table.
898 */
899 rc = RTHandleTableDestroy(pSession->hHandleTable, supdrvSessionObjHandleDelete, pSession);
900 AssertRC(rc);
901 pSession->hHandleTable = NIL_RTHANDLETABLE;
902
903 /*
904 * Release object references made in this session.
905 * In theory there should be noone racing us in this session.
906 */
907 Log2(("release objects - start\n"));
908 if (pSession->pUsage)
909 {
910 PSUPDRVUSAGE pUsage;
911 RTSpinlockAcquire(pDevExt->Spinlock);
912
913 while ((pUsage = pSession->pUsage) != NULL)
914 {
915 PSUPDRVOBJ pObj = pUsage->pObj;
916 pSession->pUsage = pUsage->pNext;
917
918 AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
919 if (pUsage->cUsage < pObj->cUsage)
920 {
921 pObj->cUsage -= pUsage->cUsage;
922 RTSpinlockRelease(pDevExt->Spinlock);
923 }
924 else
925 {
926 /* Destroy the object and free the record. */
927 if (pDevExt->pObjs == pObj)
928 pDevExt->pObjs = pObj->pNext;
929 else
930 {
931 PSUPDRVOBJ pObjPrev;
932 for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
933 if (pObjPrev->pNext == pObj)
934 {
935 pObjPrev->pNext = pObj->pNext;
936 break;
937 }
938 Assert(pObjPrev);
939 }
940 RTSpinlockRelease(pDevExt->Spinlock);
941
942 Log(("supdrvCleanupSession: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
943 pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
944 if (pObj->pfnDestructor)
945 pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
946 RTMemFree(pObj);
947 }
948
949 /* free it and continue. */
950 RTMemFree(pUsage);
951
952 RTSpinlockAcquire(pDevExt->Spinlock);
953 }
954
955 RTSpinlockRelease(pDevExt->Spinlock);
956 AssertMsg(!pSession->pUsage, ("Some buster reregistered an object during desturction!\n"));
957 }
958 Log2(("release objects - done\n"));
959
960 /*
961 * Make sure the associated VM pointers are NULL.
962 */
963 if (pSession->pSessionGVM || pSession->pSessionVM || pSession->pFastIoCtrlVM)
964 {
965 SUPR0Printf("supdrvCleanupSession: VM not disassociated! pSessionGVM=%p pSessionVM=%p pFastIoCtrlVM=%p\n",
966 pSession->pSessionGVM, pSession->pSessionVM, pSession->pFastIoCtrlVM);
967 pSession->pSessionGVM = NULL;
968 pSession->pSessionVM = NULL;
969 pSession->pFastIoCtrlVM = NULL;
970 }
971
972 /*
973 * Do tracer cleanups related to this session.
974 */
975 Log2(("release tracer stuff - start\n"));
976 supdrvTracerCleanupSession(pDevExt, pSession);
977 Log2(("release tracer stuff - end\n"));
978
979 /*
980 * Release memory allocated in the session.
981 *
982 * We do not serialize this as we assume that the application will
983 * not allocated memory while closing the file handle object.
984 */
985 Log2(("freeing memory:\n"));
986 pBundle = &pSession->Bundle;
987 while (pBundle)
988 {
989 PSUPDRVBUNDLE pToFree;
990 unsigned i;
991
992 /*
993 * Check and unlock all entries in the bundle.
994 */
995 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
996 {
997 if (pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ)
998 {
999 Log2(("eType=%d pvR0=%p pvR3=%p cb=%ld\n", pBundle->aMem[i].eType, RTR0MemObjAddress(pBundle->aMem[i].MemObj),
1000 (void *)RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3), (long)RTR0MemObjSize(pBundle->aMem[i].MemObj)));
1001 if (pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ)
1002 {
1003 rc = RTR0MemObjFree(pBundle->aMem[i].MapObjR3, false);
1004 AssertRC(rc); /** @todo figure out how to handle this. */
1005 pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
1006 }
1007 rc = RTR0MemObjFree(pBundle->aMem[i].MemObj, true /* fFreeMappings */);
1008 AssertRC(rc); /** @todo figure out how to handle this. */
1009 pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
1010 pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
1011 }
1012 }
1013
1014 /*
1015 * Advance and free previous bundle.
1016 */
1017 pToFree = pBundle;
1018 pBundle = pBundle->pNext;
1019
1020 pToFree->pNext = NULL;
1021 pToFree->cUsed = 0;
1022 if (pToFree != &pSession->Bundle)
1023 RTMemFree(pToFree);
1024 }
1025 Log2(("freeing memory - done\n"));
1026
1027 /*
1028 * Deregister component factories.
1029 */
1030 RTSemFastMutexRequest(pDevExt->mtxComponentFactory);
1031 Log2(("deregistering component factories:\n"));
1032 if (pDevExt->pComponentFactoryHead)
1033 {
1034 PSUPDRVFACTORYREG pPrev = NULL;
1035 PSUPDRVFACTORYREG pCur = pDevExt->pComponentFactoryHead;
1036 while (pCur)
1037 {
1038 if (pCur->pSession == pSession)
1039 {
1040 /* unlink it */
1041 PSUPDRVFACTORYREG pNext = pCur->pNext;
1042 if (pPrev)
1043 pPrev->pNext = pNext;
1044 else
1045 pDevExt->pComponentFactoryHead = pNext;
1046
1047 /* free it */
1048 pCur->pNext = NULL;
1049 pCur->pSession = NULL;
1050 pCur->pFactory = NULL;
1051 RTMemFree(pCur);
1052
1053 /* next */
1054 pCur = pNext;
1055 }
1056 else
1057 {
1058 /* next */
1059 pPrev = pCur;
1060 pCur = pCur->pNext;
1061 }
1062 }
1063 }
1064 RTSemFastMutexRelease(pDevExt->mtxComponentFactory);
1065 Log2(("deregistering component factories - done\n"));
1066
1067 /*
1068 * Loaded images needs to be dereferenced and possibly freed up.
1069 */
1070 supdrvLdrLock(pDevExt);
1071 Log2(("freeing images:\n"));
1072 if (pSession->pLdrUsage)
1073 {
1074 PSUPDRVLDRUSAGE pUsage = pSession->pLdrUsage;
1075 pSession->pLdrUsage = NULL;
1076 while (pUsage)
1077 {
1078 void *pvFree = pUsage;
1079 PSUPDRVLDRIMAGE pImage = pUsage->pImage;
1080 uint32_t cUsage = pUsage->cRing0Usage + pUsage->cRing3Usage;
1081 if (pImage->cUsage > cUsage)
1082 pImage->cUsage -= cUsage;
1083 else
1084 supdrvLdrFree(pDevExt, pImage);
1085 pUsage->pImage = NULL;
1086 pUsage = pUsage->pNext;
1087 RTMemFree(pvFree);
1088 }
1089 }
1090 supdrvLdrUnlock(pDevExt);
1091 Log2(("freeing images - done\n"));
1092
1093 /*
1094 * Unmap the GIP.
1095 */
1096 Log2(("umapping GIP:\n"));
1097 if (pSession->GipMapObjR3 != NIL_RTR0MEMOBJ)
1098 {
1099 SUPR0GipUnmap(pSession);
1100 pSession->fGipReferenced = 0;
1101 }
1102 Log2(("umapping GIP - done\n"));
1103}
1104
1105
1106/**
1107 * Common code for freeing a session when the reference count reaches zero.
1108 *
1109 * @param pDevExt Device extension.
1110 * @param pSession Session data.
1111 * This data will be freed by this routine.
1112 */
1113static void supdrvDestroySession(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
1114{
1115 VBOXDRV_SESSION_CLOSE(pSession);
1116
1117 /*
1118 * Cleanup the session first.
1119 */
1120 supdrvCleanupSession(pDevExt, pSession);
1121 supdrvOSCleanupSession(pDevExt, pSession);
1122
1123 /*
1124 * Free the rest of the session stuff.
1125 */
1126 RTSpinlockDestroy(pSession->Spinlock);
1127 pSession->Spinlock = NIL_RTSPINLOCK;
1128 pSession->pDevExt = NULL;
1129 RTMemFree(pSession);
1130 LogFlow(("supdrvDestroySession: returns\n"));
1131}
1132
1133
1134/**
1135 * Inserts the session into the global hash table.
1136 *
1137 * @retval VINF_SUCCESS on success.
1138 * @retval VERR_WRONG_ORDER if the session was already inserted (asserted).
1139 * @retval VERR_INVALID_PARAMETER if the session handle is invalid or a ring-0
1140 * session (asserted).
1141 * @retval VERR_DUPLICATE if there is already a session for that pid.
1142 *
1143 * @param pDevExt The device extension.
1144 * @param pSession The session.
1145 * @param ppOsSessionPtr Pointer to the OS session pointer, if any is
1146 * available and used. This will set to point to the
1147 * session while under the protection of the session
1148 * hash table spinlock. It will also be kept in
1149 * PSUPDRVSESSION::ppOsSessionPtr for lookup and
1150 * cleanup use.
1151 * @param pvUser Argument for supdrvOSSessionHashTabInserted.
1152 */
1153int VBOXCALL supdrvSessionHashTabInsert(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVSESSION *ppOsSessionPtr,
1154 void *pvUser)
1155{
1156 PSUPDRVSESSION pCur;
1157 unsigned iHash;
1158
1159 /*
1160 * Validate input.
1161 */
1162 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
1163 AssertReturn(pSession->R0Process != NIL_RTR0PROCESS, VERR_INVALID_PARAMETER);
1164
1165 /*
1166 * Calculate the hash table index and acquire the spinlock.
1167 */
1168 iHash = SUPDRV_SESSION_HASH(pSession->Process);
1169
1170 RTSpinlockAcquire(pDevExt->hSessionHashTabSpinlock);
1171
1172 /*
1173 * If there are a collisions, we need to carefully check if we got a
1174 * duplicate. There can only be one open session per process.
1175 */
1176 pCur = pDevExt->apSessionHashTab[iHash];
1177 if (pCur)
1178 {
1179 while (pCur && pCur->Process != pSession->Process)
1180 pCur = pCur->pCommonNextHash;
1181
1182 if (pCur)
1183 {
1184 RTSpinlockRelease(pDevExt->hSessionHashTabSpinlock);
1185 if (pCur == pSession)
1186 {
1187 Assert(pSession->fInHashTable);
1188 AssertFailed();
1189 return VERR_WRONG_ORDER;
1190 }
1191 Assert(!pSession->fInHashTable);
1192 if (pCur->R0Process == pSession->R0Process)
1193 return VERR_RESOURCE_IN_USE;
1194 return VERR_DUPLICATE;
1195 }
1196 }
1197 Assert(!pSession->fInHashTable);
1198 Assert(!pSession->ppOsSessionPtr);
1199
1200 /*
1201 * Insert it, doing a callout to the OS specific code in case it has
1202 * anything it wishes to do while we're holding the spinlock.
1203 */
1204 pSession->pCommonNextHash = pDevExt->apSessionHashTab[iHash];
1205 pDevExt->apSessionHashTab[iHash] = pSession;
1206 pSession->fInHashTable = true;
1207 ASMAtomicIncS32(&pDevExt->cSessions);
1208
1209 pSession->ppOsSessionPtr = ppOsSessionPtr;
1210 if (ppOsSessionPtr)
1211 ASMAtomicWritePtr(ppOsSessionPtr, pSession);
1212
1213 supdrvOSSessionHashTabInserted(pDevExt, pSession, pvUser);
1214
1215 /*
1216 * Retain a reference for the pointer in the session table.
1217 */
1218 ASMAtomicIncU32(&pSession->cRefs);
1219
1220 RTSpinlockRelease(pDevExt->hSessionHashTabSpinlock);
1221 return VINF_SUCCESS;
1222}
1223
1224
1225/**
1226 * Removes the session from the global hash table.
1227 *
1228 * @retval VINF_SUCCESS on success.
1229 * @retval VERR_NOT_FOUND if the session was already removed (asserted).
1230 * @retval VERR_INVALID_PARAMETER if the session handle is invalid or a ring-0
1231 * session (asserted).
1232 *
1233 * @param pDevExt The device extension.
1234 * @param pSession The session. The caller is expected to have a reference
1235 * to this so it won't croak on us when we release the hash
1236 * table reference.
1237 * @param pvUser OS specific context value for the
1238 * supdrvOSSessionHashTabInserted callback.
1239 */
1240int VBOXCALL supdrvSessionHashTabRemove(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, void *pvUser)
1241{
1242 PSUPDRVSESSION pCur;
1243 unsigned iHash;
1244 int32_t cRefs;
1245
1246 /*
1247 * Validate input.
1248 */
1249 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
1250 AssertReturn(pSession->R0Process != NIL_RTR0PROCESS, VERR_INVALID_PARAMETER);
1251
1252 /*
1253 * Calculate the hash table index and acquire the spinlock.
1254 */
1255 iHash = SUPDRV_SESSION_HASH(pSession->Process);
1256
1257 RTSpinlockAcquire(pDevExt->hSessionHashTabSpinlock);
1258
1259 /*
1260 * Unlink it.
1261 */
1262 pCur = pDevExt->apSessionHashTab[iHash];
1263 if (pCur == pSession)
1264 pDevExt->apSessionHashTab[iHash] = pSession->pCommonNextHash;
1265 else
1266 {
1267 PSUPDRVSESSION pPrev = pCur;
1268 while (pCur && pCur != pSession)
1269 {
1270 pPrev = pCur;
1271 pCur = pCur->pCommonNextHash;
1272 }
1273 if (pCur)
1274 pPrev->pCommonNextHash = pCur->pCommonNextHash;
1275 else
1276 {
1277 Assert(!pSession->fInHashTable);
1278 RTSpinlockRelease(pDevExt->hSessionHashTabSpinlock);
1279 return VERR_NOT_FOUND;
1280 }
1281 }
1282
1283 pSession->pCommonNextHash = NULL;
1284 pSession->fInHashTable = false;
1285
1286 ASMAtomicDecS32(&pDevExt->cSessions);
1287
1288 /*
1289 * Clear OS specific session pointer if available and do the OS callback.
1290 */
1291 if (pSession->ppOsSessionPtr)
1292 {
1293 ASMAtomicCmpXchgPtr(pSession->ppOsSessionPtr, NULL, pSession);
1294 pSession->ppOsSessionPtr = NULL;
1295 }
1296
1297 supdrvOSSessionHashTabRemoved(pDevExt, pSession, pvUser);
1298
1299 RTSpinlockRelease(pDevExt->hSessionHashTabSpinlock);
1300
1301 /*
1302 * Drop the reference the hash table had to the session. This shouldn't
1303 * be the last reference!
1304 */
1305 cRefs = ASMAtomicDecU32(&pSession->cRefs);
1306 Assert(cRefs > 0 && cRefs < _1M);
1307 if (cRefs == 0)
1308 supdrvDestroySession(pDevExt, pSession);
1309
1310 return VINF_SUCCESS;
1311}
1312
1313
1314/**
1315 * Looks up the session for the current process in the global hash table or in
1316 * OS specific pointer.
1317 *
1318 * @returns Pointer to the session with a reference that the caller must
1319 * release. If no valid session was found, NULL is returned.
1320 *
1321 * @param pDevExt The device extension.
1322 * @param Process The process ID.
1323 * @param R0Process The ring-0 process handle.
1324 * @param ppOsSessionPtr The OS session pointer if available. If not NULL,
1325 * this is used instead of the hash table. For
1326 * additional safety it must then be equal to the
1327 * SUPDRVSESSION::ppOsSessionPtr member.
1328 * This can be NULL even if the OS has a session
1329 * pointer.
1330 */
1331PSUPDRVSESSION VBOXCALL supdrvSessionHashTabLookup(PSUPDRVDEVEXT pDevExt, RTPROCESS Process, RTR0PROCESS R0Process,
1332 PSUPDRVSESSION *ppOsSessionPtr)
1333{
1334 PSUPDRVSESSION pCur;
1335 unsigned iHash;
1336
1337 /*
1338 * Validate input.
1339 */
1340 AssertReturn(R0Process != NIL_RTR0PROCESS, NULL);
1341
1342 /*
1343 * Calculate the hash table index and acquire the spinlock.
1344 */
1345 iHash = SUPDRV_SESSION_HASH(Process);
1346
1347 RTSpinlockAcquire(pDevExt->hSessionHashTabSpinlock);
1348
1349 /*
1350 * If an OS session pointer is provided, always use it.
1351 */
1352 if (ppOsSessionPtr)
1353 {
1354 pCur = *ppOsSessionPtr;
1355 if ( pCur
1356 && ( pCur->ppOsSessionPtr != ppOsSessionPtr
1357 || pCur->Process != Process
1358 || pCur->R0Process != R0Process) )
1359 pCur = NULL;
1360 }
1361 else
1362 {
1363 /*
1364 * Otherwise, do the hash table lookup.
1365 */
1366 pCur = pDevExt->apSessionHashTab[iHash];
1367 while ( pCur
1368 && ( pCur->Process != Process
1369 || pCur->R0Process != R0Process) )
1370 pCur = pCur->pCommonNextHash;
1371 }
1372
1373 /*
1374 * Retain the session.
1375 */
1376 if (pCur)
1377 {
1378 uint32_t cRefs = ASMAtomicIncU32(&pCur->cRefs);
1379 NOREF(cRefs);
1380 Assert(cRefs > 1 && cRefs < _1M);
1381 }
1382
1383 RTSpinlockRelease(pDevExt->hSessionHashTabSpinlock);
1384
1385 return pCur;
1386}
1387
1388
1389/**
1390 * Retain a session to make sure it doesn't go away while it is in use.
1391 *
1392 * @returns New reference count on success, UINT32_MAX on failure.
1393 * @param pSession Session data.
1394 */
1395uint32_t VBOXCALL supdrvSessionRetain(PSUPDRVSESSION pSession)
1396{
1397 uint32_t cRefs;
1398 AssertPtrReturn(pSession, UINT32_MAX);
1399 AssertReturn(SUP_IS_SESSION_VALID(pSession), UINT32_MAX);
1400
1401 cRefs = ASMAtomicIncU32(&pSession->cRefs);
1402 AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pSession));
1403 return cRefs;
1404}
1405
1406
1407/**
1408 * Releases a given session.
1409 *
1410 * @returns New reference count on success (0 if closed), UINT32_MAX on failure.
1411 * @param pSession Session data.
1412 */
1413uint32_t VBOXCALL supdrvSessionRelease(PSUPDRVSESSION pSession)
1414{
1415 uint32_t cRefs;
1416 AssertPtrReturn(pSession, UINT32_MAX);
1417 AssertReturn(SUP_IS_SESSION_VALID(pSession), UINT32_MAX);
1418
1419 cRefs = ASMAtomicDecU32(&pSession->cRefs);
1420 AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pSession));
1421 if (cRefs == 0)
1422 supdrvDestroySession(pSession->pDevExt, pSession);
1423 return cRefs;
1424}
1425
1426
1427/**
1428 * RTHandleTableDestroy callback used by supdrvCleanupSession.
1429 *
1430 * @returns IPRT status code, see SUPR0ObjAddRef.
1431 * @param hHandleTable The handle table handle. Ignored.
1432 * @param pvObj The object pointer.
1433 * @param pvCtx Context, the handle type. Ignored.
1434 * @param pvUser Session pointer.
1435 */
1436static DECLCALLBACK(int) supdrvSessionObjHandleRetain(RTHANDLETABLE hHandleTable, void *pvObj, void *pvCtx, void *pvUser)
1437{
1438 NOREF(pvCtx);
1439 NOREF(hHandleTable);
1440 return SUPR0ObjAddRefEx(pvObj, (PSUPDRVSESSION)pvUser, true /*fNoBlocking*/);
1441}
1442
1443
1444/**
1445 * RTHandleTableDestroy callback used by supdrvCleanupSession.
1446 *
1447 * @param hHandleTable The handle table handle. Ignored.
1448 * @param h The handle value. Ignored.
1449 * @param pvObj The object pointer.
1450 * @param pvCtx Context, the handle type. Ignored.
1451 * @param pvUser Session pointer.
1452 */
1453static DECLCALLBACK(void) supdrvSessionObjHandleDelete(RTHANDLETABLE hHandleTable, uint32_t h, void *pvObj, void *pvCtx, void *pvUser)
1454{
1455 NOREF(pvCtx);
1456 NOREF(h);
1457 NOREF(hHandleTable);
1458 SUPR0ObjRelease(pvObj, (PSUPDRVSESSION)pvUser);
1459}
1460
1461
1462/**
1463 * Fast path I/O Control worker.
1464 *
1465 * @returns VBox status code that should be passed down to ring-3 unchanged.
1466 * @param uOperation SUP_VMMR0_DO_XXX (not the I/O control number!).
1467 * @param idCpu VMCPU id.
1468 * @param pDevExt Device extention.
1469 * @param pSession Session data.
1470 */
1471int VBOXCALL supdrvIOCtlFast(uintptr_t uOperation, VMCPUID idCpu, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession)
1472{
1473 /*
1474 * Validate input and check that the VM has a session.
1475 */
1476 if (RT_LIKELY(RT_VALID_PTR(pSession)))
1477 {
1478 PVM pVM = pSession->pSessionVM;
1479 PGVM pGVM = pSession->pSessionGVM;
1480 if (RT_LIKELY( pGVM != NULL
1481 && pVM != NULL
1482 && pVM == pSession->pFastIoCtrlVM))
1483 {
1484 if (RT_LIKELY(pDevExt->pfnVMMR0EntryFast))
1485 {
1486 /*
1487 * Make the call.
1488 */
1489 pDevExt->pfnVMMR0EntryFast(pGVM, pVM, idCpu, uOperation);
1490 return VINF_SUCCESS;
1491 }
1492
1493 SUPR0Printf("supdrvIOCtlFast: pfnVMMR0EntryFast is NULL\n");
1494 }
1495 else
1496 SUPR0Printf("supdrvIOCtlFast: Misconfig session: pGVM=%p pVM=%p pFastIoCtrlVM=%p\n",
1497 pGVM, pVM, pSession->pFastIoCtrlVM);
1498 }
1499 else
1500 SUPR0Printf("supdrvIOCtlFast: Bad session pointer %p\n", pSession);
1501 return VERR_INTERNAL_ERROR;
1502}
1503
1504
1505/**
1506 * Helper for supdrvIOCtl used to validate module names passed to SUP_IOCTL_LDR_OPEN.
1507 *
1508 * Check if pszStr contains any character of pszChars. We would use strpbrk
1509 * here if this function would be contained in the RedHat kABI white list, see
1510 * http://www.kerneldrivers.org/RHEL5.
1511 *
1512 * @returns true if fine, false if not.
1513 * @param pszName The module name to check.
1514 */
1515static bool supdrvIsLdrModuleNameValid(const char *pszName)
1516{
1517 int chCur;
1518 while ((chCur = *pszName++) != '\0')
1519 {
1520 static const char s_szInvalidChars[] = ";:()[]{}/\\|&*%#@!~`\"'";
1521 unsigned offInv = RT_ELEMENTS(s_szInvalidChars);
1522 while (offInv-- > 0)
1523 if (s_szInvalidChars[offInv] == chCur)
1524 return false;
1525 }
1526 return true;
1527}
1528
1529
1530
1531/**
1532 * I/O Control inner worker (tracing reasons).
1533 *
1534 * @returns IPRT status code.
1535 * @retval VERR_INVALID_PARAMETER if the request is invalid.
1536 *
1537 * @param uIOCtl Function number.
1538 * @param pDevExt Device extention.
1539 * @param pSession Session data.
1540 * @param pReqHdr The request header.
1541 */
1542static int supdrvIOCtlInnerUnrestricted(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPREQHDR pReqHdr)
1543{
1544 /*
1545 * Validation macros
1546 */
1547#define REQ_CHECK_SIZES_EX(Name, cbInExpect, cbOutExpect) \
1548 do { \
1549 if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect) || pReqHdr->cbOut != (cbOutExpect))) \
1550 { \
1551 OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld. cbOut=%ld expected %ld.\n", \
1552 (long)pReqHdr->cbIn, (long)(cbInExpect), (long)pReqHdr->cbOut, (long)(cbOutExpect))); \
1553 return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1554 } \
1555 } while (0)
1556
1557#define REQ_CHECK_SIZES(Name) REQ_CHECK_SIZES_EX(Name, Name ## _SIZE_IN, Name ## _SIZE_OUT)
1558
1559#define REQ_CHECK_SIZE_IN(Name, cbInExpect) \
1560 do { \
1561 if (RT_UNLIKELY(pReqHdr->cbIn != (cbInExpect))) \
1562 { \
1563 OSDBGPRINT(( #Name ": Invalid input/output sizes. cbIn=%ld expected %ld.\n", \
1564 (long)pReqHdr->cbIn, (long)(cbInExpect))); \
1565 return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1566 } \
1567 } while (0)
1568
1569#define REQ_CHECK_SIZE_OUT(Name, cbOutExpect) \
1570 do { \
1571 if (RT_UNLIKELY(pReqHdr->cbOut != (cbOutExpect))) \
1572 { \
1573 OSDBGPRINT(( #Name ": Invalid input/output sizes. cbOut=%ld expected %ld.\n", \
1574 (long)pReqHdr->cbOut, (long)(cbOutExpect))); \
1575 return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1576 } \
1577 } while (0)
1578
1579#define REQ_CHECK_EXPR(Name, expr) \
1580 do { \
1581 if (RT_UNLIKELY(!(expr))) \
1582 { \
1583 OSDBGPRINT(( #Name ": %s\n", #expr)); \
1584 return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1585 } \
1586 } while (0)
1587
1588#define REQ_CHECK_EXPR_FMT(expr, fmt) \
1589 do { \
1590 if (RT_UNLIKELY(!(expr))) \
1591 { \
1592 OSDBGPRINT( fmt ); \
1593 return pReqHdr->rc = VERR_INVALID_PARAMETER; \
1594 } \
1595 } while (0)
1596
1597 /*
1598 * The switch.
1599 */
1600 switch (SUP_CTL_CODE_NO_SIZE(uIOCtl))
1601 {
1602 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_COOKIE):
1603 {
1604 PSUPCOOKIE pReq = (PSUPCOOKIE)pReqHdr;
1605 REQ_CHECK_SIZES(SUP_IOCTL_COOKIE);
1606 if (strncmp(pReq->u.In.szMagic, SUPCOOKIE_MAGIC, sizeof(pReq->u.In.szMagic)))
1607 {
1608 OSDBGPRINT(("SUP_IOCTL_COOKIE: invalid magic %.16s\n", pReq->u.In.szMagic));
1609 pReq->Hdr.rc = VERR_INVALID_MAGIC;
1610 return 0;
1611 }
1612
1613#if 0
1614 /*
1615 * Call out to the OS specific code and let it do permission checks on the
1616 * client process.
1617 */
1618 if (!supdrvOSValidateClientProcess(pDevExt, pSession))
1619 {
1620 pReq->u.Out.u32Cookie = 0xffffffff;
1621 pReq->u.Out.u32SessionCookie = 0xffffffff;
1622 pReq->u.Out.u32SessionVersion = 0xffffffff;
1623 pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1624 pReq->u.Out.pSession = NULL;
1625 pReq->u.Out.cFunctions = 0;
1626 pReq->Hdr.rc = VERR_PERMISSION_DENIED;
1627 return 0;
1628 }
1629#endif
1630
1631 /*
1632 * Match the version.
1633 * The current logic is very simple, match the major interface version.
1634 */
1635 if ( pReq->u.In.u32MinVersion > SUPDRV_IOC_VERSION
1636 || (pReq->u.In.u32MinVersion & 0xffff0000) != (SUPDRV_IOC_VERSION & 0xffff0000))
1637 {
1638 OSDBGPRINT(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
1639 pReq->u.In.u32ReqVersion, pReq->u.In.u32MinVersion, SUPDRV_IOC_VERSION));
1640 pReq->u.Out.u32Cookie = 0xffffffff;
1641 pReq->u.Out.u32SessionCookie = 0xffffffff;
1642 pReq->u.Out.u32SessionVersion = 0xffffffff;
1643 pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1644 pReq->u.Out.pSession = NULL;
1645 pReq->u.Out.cFunctions = 0;
1646 pReq->Hdr.rc = VERR_VERSION_MISMATCH;
1647 return 0;
1648 }
1649
1650 /*
1651 * Fill in return data and be gone.
1652 * N.B. The first one to change SUPDRV_IOC_VERSION shall makes sure that
1653 * u32SessionVersion <= u32ReqVersion!
1654 */
1655 /** @todo Somehow validate the client and negotiate a secure cookie... */
1656 pReq->u.Out.u32Cookie = pDevExt->u32Cookie;
1657 pReq->u.Out.u32SessionCookie = pSession->u32Cookie;
1658 pReq->u.Out.u32SessionVersion = SUPDRV_IOC_VERSION;
1659 pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
1660 pReq->u.Out.pSession = pSession;
1661 pReq->u.Out.cFunctions = sizeof(g_aFunctions) / sizeof(g_aFunctions[0]);
1662 pReq->Hdr.rc = VINF_SUCCESS;
1663 return 0;
1664 }
1665
1666 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_QUERY_FUNCS(0)):
1667 {
1668 /* validate */
1669 PSUPQUERYFUNCS pReq = (PSUPQUERYFUNCS)pReqHdr;
1670 REQ_CHECK_SIZES_EX(SUP_IOCTL_QUERY_FUNCS, SUP_IOCTL_QUERY_FUNCS_SIZE_IN, SUP_IOCTL_QUERY_FUNCS_SIZE_OUT(RT_ELEMENTS(g_aFunctions)));
1671
1672 /* execute */
1673 pReq->u.Out.cFunctions = RT_ELEMENTS(g_aFunctions);
1674 memcpy(&pReq->u.Out.aFunctions[0], g_aFunctions, sizeof(g_aFunctions));
1675 pReq->Hdr.rc = VINF_SUCCESS;
1676 return 0;
1677 }
1678
1679 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_LOCK):
1680 {
1681 /* validate */
1682 PSUPPAGELOCK pReq = (PSUPPAGELOCK)pReqHdr;
1683 REQ_CHECK_SIZE_IN(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_IN);
1684 REQ_CHECK_SIZE_OUT(SUP_IOCTL_PAGE_LOCK, SUP_IOCTL_PAGE_LOCK_SIZE_OUT(pReq->u.In.cPages));
1685 REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.cPages > 0);
1686 REQ_CHECK_EXPR(SUP_IOCTL_PAGE_LOCK, pReq->u.In.pvR3 >= PAGE_SIZE);
1687
1688 /* execute */
1689 pReq->Hdr.rc = SUPR0LockMem(pSession, pReq->u.In.pvR3, pReq->u.In.cPages, &pReq->u.Out.aPages[0]);
1690 if (RT_FAILURE(pReq->Hdr.rc))
1691 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1692 return 0;
1693 }
1694
1695 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_UNLOCK):
1696 {
1697 /* validate */
1698 PSUPPAGEUNLOCK pReq = (PSUPPAGEUNLOCK)pReqHdr;
1699 REQ_CHECK_SIZES(SUP_IOCTL_PAGE_UNLOCK);
1700
1701 /* execute */
1702 pReq->Hdr.rc = SUPR0UnlockMem(pSession, pReq->u.In.pvR3);
1703 return 0;
1704 }
1705
1706 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_ALLOC):
1707 {
1708 /* validate */
1709 PSUPCONTALLOC pReq = (PSUPCONTALLOC)pReqHdr;
1710 REQ_CHECK_SIZES(SUP_IOCTL_CONT_ALLOC);
1711
1712 /* execute */
1713 pReq->Hdr.rc = SUPR0ContAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.HCPhys);
1714 if (RT_FAILURE(pReq->Hdr.rc))
1715 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1716 return 0;
1717 }
1718
1719 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CONT_FREE):
1720 {
1721 /* validate */
1722 PSUPCONTFREE pReq = (PSUPCONTFREE)pReqHdr;
1723 REQ_CHECK_SIZES(SUP_IOCTL_CONT_FREE);
1724
1725 /* execute */
1726 pReq->Hdr.rc = SUPR0ContFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1727 return 0;
1728 }
1729
1730 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_OPEN):
1731 {
1732 /* validate */
1733 PSUPLDROPEN pReq = (PSUPLDROPEN)pReqHdr;
1734 REQ_CHECK_SIZES(SUP_IOCTL_LDR_OPEN);
1735 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageWithTabs > 0);
1736 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageWithTabs < 16*_1M);
1737 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits > 0);
1738 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits > 0);
1739 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.cbImageBits < pReq->u.In.cbImageWithTabs);
1740 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, pReq->u.In.szName[0]);
1741 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, RTStrEnd(pReq->u.In.szName, sizeof(pReq->u.In.szName)));
1742 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, supdrvIsLdrModuleNameValid(pReq->u.In.szName));
1743 REQ_CHECK_EXPR(SUP_IOCTL_LDR_OPEN, RTStrEnd(pReq->u.In.szFilename, sizeof(pReq->u.In.szFilename)));
1744
1745 /* execute */
1746 pReq->Hdr.rc = supdrvIOCtl_LdrOpen(pDevExt, pSession, pReq);
1747 return 0;
1748 }
1749
1750 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_LOAD):
1751 {
1752 /* validate */
1753 PSUPLDRLOAD pReq = (PSUPLDRLOAD)pReqHdr;
1754 REQ_CHECK_EXPR(Name, pReq->Hdr.cbIn >= SUP_IOCTL_LDR_LOAD_SIZE_IN(32));
1755 REQ_CHECK_SIZES_EX(SUP_IOCTL_LDR_LOAD, SUP_IOCTL_LDR_LOAD_SIZE_IN(pReq->u.In.cbImageWithTabs), SUP_IOCTL_LDR_LOAD_SIZE_OUT);
1756 REQ_CHECK_EXPR(SUP_IOCTL_LDR_LOAD, pReq->u.In.cSymbols <= 16384);
1757 REQ_CHECK_EXPR_FMT( !pReq->u.In.cSymbols
1758 || ( pReq->u.In.offSymbols < pReq->u.In.cbImageWithTabs
1759 && pReq->u.In.offSymbols + pReq->u.In.cSymbols * sizeof(SUPLDRSYM) <= pReq->u.In.cbImageWithTabs),
1760 ("SUP_IOCTL_LDR_LOAD: offSymbols=%#lx cSymbols=%#lx cbImageWithTabs=%#lx\n", (long)pReq->u.In.offSymbols,
1761 (long)pReq->u.In.cSymbols, (long)pReq->u.In.cbImageWithTabs));
1762 REQ_CHECK_EXPR_FMT( !pReq->u.In.cbStrTab
1763 || ( pReq->u.In.offStrTab < pReq->u.In.cbImageWithTabs
1764 && pReq->u.In.offStrTab + pReq->u.In.cbStrTab <= pReq->u.In.cbImageWithTabs
1765 && pReq->u.In.cbStrTab <= pReq->u.In.cbImageWithTabs),
1766 ("SUP_IOCTL_LDR_LOAD: offStrTab=%#lx cbStrTab=%#lx cbImageWithTabs=%#lx\n", (long)pReq->u.In.offStrTab,
1767 (long)pReq->u.In.cbStrTab, (long)pReq->u.In.cbImageWithTabs));
1768
1769 if (pReq->u.In.cSymbols)
1770 {
1771 uint32_t i;
1772 PSUPLDRSYM paSyms = (PSUPLDRSYM)&pReq->u.In.abImage[pReq->u.In.offSymbols];
1773 for (i = 0; i < pReq->u.In.cSymbols; i++)
1774 {
1775 REQ_CHECK_EXPR_FMT(paSyms[i].offSymbol < pReq->u.In.cbImageWithTabs,
1776 ("SUP_IOCTL_LDR_LOAD: sym #%ld: symb off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offSymbol, (long)pReq->u.In.cbImageWithTabs));
1777 REQ_CHECK_EXPR_FMT(paSyms[i].offName < pReq->u.In.cbStrTab,
1778 ("SUP_IOCTL_LDR_LOAD: sym #%ld: name off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithTabs));
1779 REQ_CHECK_EXPR_FMT(RTStrEnd((char const *)&pReq->u.In.abImage[pReq->u.In.offStrTab + paSyms[i].offName],
1780 pReq->u.In.cbStrTab - paSyms[i].offName),
1781 ("SUP_IOCTL_LDR_LOAD: sym #%ld: unterminated name! (%#lx / %#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithTabs));
1782 }
1783 }
1784
1785 /* execute */
1786 pReq->Hdr.rc = supdrvIOCtl_LdrLoad(pDevExt, pSession, pReq);
1787 return 0;
1788 }
1789
1790 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_FREE):
1791 {
1792 /* validate */
1793 PSUPLDRFREE pReq = (PSUPLDRFREE)pReqHdr;
1794 REQ_CHECK_SIZES(SUP_IOCTL_LDR_FREE);
1795
1796 /* execute */
1797 pReq->Hdr.rc = supdrvIOCtl_LdrFree(pDevExt, pSession, pReq);
1798 return 0;
1799 }
1800
1801 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_LOCK_DOWN):
1802 {
1803 /* validate */
1804 REQ_CHECK_SIZES(SUP_IOCTL_LDR_LOCK_DOWN);
1805
1806 /* execute */
1807 pReqHdr->rc = supdrvIOCtl_LdrLockDown(pDevExt);
1808 return 0;
1809 }
1810
1811 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LDR_GET_SYMBOL):
1812 {
1813 /* validate */
1814 PSUPLDRGETSYMBOL pReq = (PSUPLDRGETSYMBOL)pReqHdr;
1815 REQ_CHECK_SIZES(SUP_IOCTL_LDR_GET_SYMBOL);
1816 REQ_CHECK_EXPR(SUP_IOCTL_LDR_GET_SYMBOL, RTStrEnd(pReq->u.In.szSymbol, sizeof(pReq->u.In.szSymbol)));
1817
1818 /* execute */
1819 pReq->Hdr.rc = supdrvIOCtl_LdrQuerySymbol(pDevExt, pSession, pReq);
1820 return 0;
1821 }
1822
1823 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_VMMR0_NO_SIZE()):
1824 {
1825 /* validate */
1826 PSUPCALLVMMR0 pReq = (PSUPCALLVMMR0)pReqHdr;
1827 Log4(("SUP_IOCTL_CALL_VMMR0: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1828 pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1829
1830 if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_VMMR0_SIZE(0))
1831 {
1832 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(0), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(0));
1833
1834 /* execute */
1835 if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1836 {
1837 if (pReq->u.In.pVMR0 == NULL)
1838 pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(NULL, NULL, pReq->u.In.idCpu,
1839 pReq->u.In.uOperation, NULL, pReq->u.In.u64Arg, pSession);
1840 else if (pReq->u.In.pVMR0 == pSession->pSessionVM)
1841 pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pSession->pSessionGVM, pSession->pSessionVM, pReq->u.In.idCpu,
1842 pReq->u.In.uOperation, NULL, pReq->u.In.u64Arg, pSession);
1843 else
1844 pReq->Hdr.rc = VERR_INVALID_VM_HANDLE;
1845 }
1846 else
1847 pReq->Hdr.rc = VERR_WRONG_ORDER;
1848 }
1849 else
1850 {
1851 PSUPVMMR0REQHDR pVMMReq = (PSUPVMMR0REQHDR)&pReq->abReqPkt[0];
1852 REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR)),
1853 ("SUP_IOCTL_CALL_VMMR0: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_VMMR0_SIZE(sizeof(SUPVMMR0REQHDR))));
1854 REQ_CHECK_EXPR(SUP_IOCTL_CALL_VMMR0, pVMMReq->u32Magic == SUPVMMR0REQHDR_MAGIC);
1855 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0, SUP_IOCTL_CALL_VMMR0_SIZE_IN(pVMMReq->cbReq), SUP_IOCTL_CALL_VMMR0_SIZE_OUT(pVMMReq->cbReq));
1856
1857 /* execute */
1858 if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1859 {
1860 if (pReq->u.In.pVMR0 == NULL)
1861 pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(NULL, NULL, pReq->u.In.idCpu,
1862 pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1863 else if (pReq->u.In.pVMR0 == pSession->pSessionVM)
1864 pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pSession->pSessionGVM, pSession->pSessionVM, pReq->u.In.idCpu,
1865 pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1866 else
1867 pReq->Hdr.rc = VERR_INVALID_VM_HANDLE;
1868 }
1869 else
1870 pReq->Hdr.rc = VERR_WRONG_ORDER;
1871 }
1872
1873 if ( RT_FAILURE(pReq->Hdr.rc)
1874 && pReq->Hdr.rc != VERR_INTERRUPTED
1875 && pReq->Hdr.rc != VERR_TIMEOUT)
1876 Log(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1877 pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1878 else
1879 Log4(("SUP_IOCTL_CALL_VMMR0: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1880 pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1881 return 0;
1882 }
1883
1884 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_VMMR0_BIG):
1885 {
1886 /* validate */
1887 PSUPCALLVMMR0 pReq = (PSUPCALLVMMR0)pReqHdr;
1888 PSUPVMMR0REQHDR pVMMReq;
1889 Log4(("SUP_IOCTL_CALL_VMMR0_BIG: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1890 pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1891
1892 pVMMReq = (PSUPVMMR0REQHDR)&pReq->abReqPkt[0];
1893 REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_VMMR0_BIG_SIZE(sizeof(SUPVMMR0REQHDR)),
1894 ("SUP_IOCTL_CALL_VMMR0_BIG: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_VMMR0_BIG_SIZE(sizeof(SUPVMMR0REQHDR))));
1895 REQ_CHECK_EXPR(SUP_IOCTL_CALL_VMMR0_BIG, pVMMReq->u32Magic == SUPVMMR0REQHDR_MAGIC);
1896 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_VMMR0_BIG, SUP_IOCTL_CALL_VMMR0_BIG_SIZE_IN(pVMMReq->cbReq), SUP_IOCTL_CALL_VMMR0_BIG_SIZE_OUT(pVMMReq->cbReq));
1897
1898 /* execute */
1899 if (RT_LIKELY(pDevExt->pfnVMMR0EntryEx))
1900 {
1901 if (pReq->u.In.pVMR0 == NULL)
1902 pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(NULL, NULL, pReq->u.In.idCpu, pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1903 else if (pReq->u.In.pVMR0 == pSession->pSessionVM)
1904 pReq->Hdr.rc = pDevExt->pfnVMMR0EntryEx(pSession->pSessionGVM, pSession->pSessionVM, pReq->u.In.idCpu,
1905 pReq->u.In.uOperation, pVMMReq, pReq->u.In.u64Arg, pSession);
1906 else
1907 pReq->Hdr.rc = VERR_INVALID_VM_HANDLE;
1908 }
1909 else
1910 pReq->Hdr.rc = VERR_WRONG_ORDER;
1911
1912 if ( RT_FAILURE(pReq->Hdr.rc)
1913 && pReq->Hdr.rc != VERR_INTERRUPTED
1914 && pReq->Hdr.rc != VERR_TIMEOUT)
1915 Log(("SUP_IOCTL_CALL_VMMR0_BIG: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1916 pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1917 else
1918 Log4(("SUP_IOCTL_CALL_VMMR0_BIG: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
1919 pReq->Hdr.rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
1920 return 0;
1921 }
1922
1923 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GET_PAGING_MODE):
1924 {
1925 /* validate */
1926 PSUPGETPAGINGMODE pReq = (PSUPGETPAGINGMODE)pReqHdr;
1927 REQ_CHECK_SIZES(SUP_IOCTL_GET_PAGING_MODE);
1928
1929 /* execute */
1930 pReq->Hdr.rc = VINF_SUCCESS;
1931 pReq->u.Out.enmMode = SUPR0GetPagingMode();
1932 return 0;
1933 }
1934
1935 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_ALLOC):
1936 {
1937 /* validate */
1938 PSUPLOWALLOC pReq = (PSUPLOWALLOC)pReqHdr;
1939 REQ_CHECK_EXPR(SUP_IOCTL_LOW_ALLOC, pReq->Hdr.cbIn <= SUP_IOCTL_LOW_ALLOC_SIZE_IN);
1940 REQ_CHECK_SIZES_EX(SUP_IOCTL_LOW_ALLOC, SUP_IOCTL_LOW_ALLOC_SIZE_IN, SUP_IOCTL_LOW_ALLOC_SIZE_OUT(pReq->u.In.cPages));
1941
1942 /* execute */
1943 pReq->Hdr.rc = SUPR0LowAlloc(pSession, pReq->u.In.cPages, &pReq->u.Out.pvR0, &pReq->u.Out.pvR3, &pReq->u.Out.aPages[0]);
1944 if (RT_FAILURE(pReq->Hdr.rc))
1945 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
1946 return 0;
1947 }
1948
1949 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOW_FREE):
1950 {
1951 /* validate */
1952 PSUPLOWFREE pReq = (PSUPLOWFREE)pReqHdr;
1953 REQ_CHECK_SIZES(SUP_IOCTL_LOW_FREE);
1954
1955 /* execute */
1956 pReq->Hdr.rc = SUPR0LowFree(pSession, (RTHCUINTPTR)pReq->u.In.pvR3);
1957 return 0;
1958 }
1959
1960 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_MAP):
1961 {
1962 /* validate */
1963 PSUPGIPMAP pReq = (PSUPGIPMAP)pReqHdr;
1964 REQ_CHECK_SIZES(SUP_IOCTL_GIP_MAP);
1965
1966 /* execute */
1967 pReq->Hdr.rc = SUPR0GipMap(pSession, &pReq->u.Out.pGipR3, &pReq->u.Out.HCPhysGip);
1968 if (RT_SUCCESS(pReq->Hdr.rc))
1969 pReq->u.Out.pGipR0 = pDevExt->pGip;
1970 return 0;
1971 }
1972
1973 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_UNMAP):
1974 {
1975 /* validate */
1976 PSUPGIPUNMAP pReq = (PSUPGIPUNMAP)pReqHdr;
1977 REQ_CHECK_SIZES(SUP_IOCTL_GIP_UNMAP);
1978
1979 /* execute */
1980 pReq->Hdr.rc = SUPR0GipUnmap(pSession);
1981 return 0;
1982 }
1983
1984 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SET_VM_FOR_FAST):
1985 {
1986 /* validate */
1987 PSUPSETVMFORFAST pReq = (PSUPSETVMFORFAST)pReqHdr;
1988 REQ_CHECK_SIZES(SUP_IOCTL_SET_VM_FOR_FAST);
1989 REQ_CHECK_EXPR_FMT( !pReq->u.In.pVMR0
1990 || ( VALID_PTR(pReq->u.In.pVMR0)
1991 && !((uintptr_t)pReq->u.In.pVMR0 & (PAGE_SIZE - 1))),
1992 ("SUP_IOCTL_SET_VM_FOR_FAST: pVMR0=%p!\n", pReq->u.In.pVMR0));
1993
1994 /* execute */
1995 RTSpinlockAcquire(pDevExt->Spinlock);
1996 if (pSession->pSessionVM == pReq->u.In.pVMR0)
1997 {
1998 if (pSession->pFastIoCtrlVM == NULL)
1999 {
2000 pSession->pFastIoCtrlVM = pSession->pSessionVM;
2001 RTSpinlockRelease(pDevExt->Spinlock);
2002 pReq->Hdr.rc = VINF_SUCCESS;
2003 }
2004 else
2005 {
2006 RTSpinlockRelease(pDevExt->Spinlock);
2007 OSDBGPRINT(("SUP_IOCTL_SET_VM_FOR_FAST: pSession->pFastIoCtrlVM=%p! (pVMR0=%p)\n",
2008 pSession->pFastIoCtrlVM, pReq->u.In.pVMR0));
2009 pReq->Hdr.rc = VERR_ALREADY_EXISTS;
2010 }
2011 }
2012 else
2013 {
2014 RTSpinlockRelease(pDevExt->Spinlock);
2015 OSDBGPRINT(("SUP_IOCTL_SET_VM_FOR_FAST: pSession->pSessionVM=%p vs pVMR0=%p)\n",
2016 pSession->pSessionVM, pReq->u.In.pVMR0));
2017 pReq->Hdr.rc = pSession->pSessionVM ? VERR_ACCESS_DENIED : VERR_WRONG_ORDER;
2018 }
2019 return 0;
2020 }
2021
2022 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_ALLOC_EX):
2023 {
2024 /* validate */
2025 PSUPPAGEALLOCEX pReq = (PSUPPAGEALLOCEX)pReqHdr;
2026 REQ_CHECK_EXPR(SUP_IOCTL_PAGE_ALLOC_EX, pReq->Hdr.cbIn <= SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN);
2027 REQ_CHECK_SIZES_EX(SUP_IOCTL_PAGE_ALLOC_EX, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_IN, SUP_IOCTL_PAGE_ALLOC_EX_SIZE_OUT(pReq->u.In.cPages));
2028 REQ_CHECK_EXPR_FMT(pReq->u.In.fKernelMapping || pReq->u.In.fUserMapping,
2029 ("SUP_IOCTL_PAGE_ALLOC_EX: No mapping requested!\n"));
2030 REQ_CHECK_EXPR_FMT(pReq->u.In.fUserMapping,
2031 ("SUP_IOCTL_PAGE_ALLOC_EX: Must have user mapping!\n"));
2032 REQ_CHECK_EXPR_FMT(!pReq->u.In.fReserved0 && !pReq->u.In.fReserved1,
2033 ("SUP_IOCTL_PAGE_ALLOC_EX: fReserved0=%d fReserved1=%d\n", pReq->u.In.fReserved0, pReq->u.In.fReserved1));
2034
2035 /* execute */
2036 pReq->Hdr.rc = SUPR0PageAllocEx(pSession, pReq->u.In.cPages, 0 /* fFlags */,
2037 pReq->u.In.fUserMapping ? &pReq->u.Out.pvR3 : NULL,
2038 pReq->u.In.fKernelMapping ? &pReq->u.Out.pvR0 : NULL,
2039 &pReq->u.Out.aPages[0]);
2040 if (RT_FAILURE(pReq->Hdr.rc))
2041 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
2042 return 0;
2043 }
2044
2045 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_MAP_KERNEL):
2046 {
2047 /* validate */
2048 PSUPPAGEMAPKERNEL pReq = (PSUPPAGEMAPKERNEL)pReqHdr;
2049 REQ_CHECK_SIZES(SUP_IOCTL_PAGE_MAP_KERNEL);
2050 REQ_CHECK_EXPR_FMT(!pReq->u.In.fFlags, ("SUP_IOCTL_PAGE_MAP_KERNEL: fFlags=%#x! MBZ\n", pReq->u.In.fFlags));
2051 REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_MAP_KERNEL: offSub=%#x\n", pReq->u.In.offSub));
2052 REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
2053 ("SUP_IOCTL_PAGE_MAP_KERNEL: cbSub=%#x\n", pReq->u.In.cbSub));
2054
2055 /* execute */
2056 pReq->Hdr.rc = SUPR0PageMapKernel(pSession, pReq->u.In.pvR3, pReq->u.In.offSub, pReq->u.In.cbSub,
2057 pReq->u.In.fFlags, &pReq->u.Out.pvR0);
2058 if (RT_FAILURE(pReq->Hdr.rc))
2059 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
2060 return 0;
2061 }
2062
2063 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_PROTECT):
2064 {
2065 /* validate */
2066 PSUPPAGEPROTECT pReq = (PSUPPAGEPROTECT)pReqHdr;
2067 REQ_CHECK_SIZES(SUP_IOCTL_PAGE_PROTECT);
2068 REQ_CHECK_EXPR_FMT(!(pReq->u.In.fProt & ~(RTMEM_PROT_READ | RTMEM_PROT_WRITE | RTMEM_PROT_EXEC | RTMEM_PROT_NONE)),
2069 ("SUP_IOCTL_PAGE_PROTECT: fProt=%#x!\n", pReq->u.In.fProt));
2070 REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_PROTECT: offSub=%#x\n", pReq->u.In.offSub));
2071 REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
2072 ("SUP_IOCTL_PAGE_PROTECT: cbSub=%#x\n", pReq->u.In.cbSub));
2073
2074 /* execute */
2075 pReq->Hdr.rc = SUPR0PageProtect(pSession, pReq->u.In.pvR3, pReq->u.In.pvR0, pReq->u.In.offSub, pReq->u.In.cbSub, pReq->u.In.fProt);
2076 return 0;
2077 }
2078
2079 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_FREE):
2080 {
2081 /* validate */
2082 PSUPPAGEFREE pReq = (PSUPPAGEFREE)pReqHdr;
2083 REQ_CHECK_SIZES(SUP_IOCTL_PAGE_FREE);
2084
2085 /* execute */
2086 pReq->Hdr.rc = SUPR0PageFree(pSession, pReq->u.In.pvR3);
2087 return 0;
2088 }
2089
2090 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_CALL_SERVICE_NO_SIZE()):
2091 {
2092 /* validate */
2093 PSUPCALLSERVICE pReq = (PSUPCALLSERVICE)pReqHdr;
2094 Log4(("SUP_IOCTL_CALL_SERVICE: op=%u in=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
2095 pReq->u.In.uOperation, pReq->Hdr.cbIn, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
2096
2097 if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
2098 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(0), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(0));
2099 else
2100 {
2101 PSUPR0SERVICEREQHDR pSrvReq = (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0];
2102 REQ_CHECK_EXPR_FMT(pReq->Hdr.cbIn >= SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR)),
2103 ("SUP_IOCTL_CALL_SERVICE: cbIn=%#x < %#lx\n", pReq->Hdr.cbIn, SUP_IOCTL_CALL_SERVICE_SIZE(sizeof(SUPR0SERVICEREQHDR))));
2104 REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, pSrvReq->u32Magic == SUPR0SERVICEREQHDR_MAGIC);
2105 REQ_CHECK_SIZES_EX(SUP_IOCTL_CALL_SERVICE, SUP_IOCTL_CALL_SERVICE_SIZE_IN(pSrvReq->cbReq), SUP_IOCTL_CALL_SERVICE_SIZE_OUT(pSrvReq->cbReq));
2106 }
2107 REQ_CHECK_EXPR(SUP_IOCTL_CALL_SERVICE, RTStrEnd(pReq->u.In.szName, sizeof(pReq->u.In.szName)));
2108
2109 /* execute */
2110 pReq->Hdr.rc = supdrvIOCtl_CallServiceModule(pDevExt, pSession, pReq);
2111 return 0;
2112 }
2113
2114 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_LOGGER_SETTINGS_NO_SIZE()):
2115 {
2116 /* validate */
2117 PSUPLOGGERSETTINGS pReq = (PSUPLOGGERSETTINGS)pReqHdr;
2118 size_t cbStrTab;
2119 REQ_CHECK_SIZE_OUT(SUP_IOCTL_LOGGER_SETTINGS, SUP_IOCTL_LOGGER_SETTINGS_SIZE_OUT);
2120 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->Hdr.cbIn >= SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(1));
2121 cbStrTab = pReq->Hdr.cbIn - SUP_IOCTL_LOGGER_SETTINGS_SIZE_IN(0);
2122 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offGroups < cbStrTab);
2123 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offFlags < cbStrTab);
2124 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.offDestination < cbStrTab);
2125 REQ_CHECK_EXPR_FMT(pReq->u.In.szStrings[cbStrTab - 1] == '\0',
2126 ("SUP_IOCTL_LOGGER_SETTINGS: cbIn=%#x cbStrTab=%#zx LastChar=%d\n",
2127 pReq->Hdr.cbIn, cbStrTab, pReq->u.In.szStrings[cbStrTab - 1]));
2128 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhich <= SUPLOGGERSETTINGS_WHICH_RELEASE);
2129 REQ_CHECK_EXPR(SUP_IOCTL_LOGGER_SETTINGS, pReq->u.In.fWhat <= SUPLOGGERSETTINGS_WHAT_DESTROY);
2130
2131 /* execute */
2132 pReq->Hdr.rc = supdrvIOCtl_LoggerSettings(pReq);
2133 return 0;
2134 }
2135
2136 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_OP2):
2137 {
2138 /* validate */
2139 PSUPSEMOP2 pReq = (PSUPSEMOP2)pReqHdr;
2140 REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_OP2, SUP_IOCTL_SEM_OP2_SIZE_IN, SUP_IOCTL_SEM_OP2_SIZE_OUT);
2141 REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP2, pReq->u.In.uReserved == 0);
2142
2143 /* execute */
2144 switch (pReq->u.In.uType)
2145 {
2146 case SUP_SEM_TYPE_EVENT:
2147 {
2148 SUPSEMEVENT hEvent = (SUPSEMEVENT)(uintptr_t)pReq->u.In.hSem;
2149 switch (pReq->u.In.uOp)
2150 {
2151 case SUPSEMOP2_WAIT_MS_REL:
2152 pReq->Hdr.rc = SUPSemEventWaitNoResume(pSession, hEvent, pReq->u.In.uArg.cRelMsTimeout);
2153 break;
2154 case SUPSEMOP2_WAIT_NS_ABS:
2155 pReq->Hdr.rc = SUPSemEventWaitNsAbsIntr(pSession, hEvent, pReq->u.In.uArg.uAbsNsTimeout);
2156 break;
2157 case SUPSEMOP2_WAIT_NS_REL:
2158 pReq->Hdr.rc = SUPSemEventWaitNsRelIntr(pSession, hEvent, pReq->u.In.uArg.cRelNsTimeout);
2159 break;
2160 case SUPSEMOP2_SIGNAL:
2161 pReq->Hdr.rc = SUPSemEventSignal(pSession, hEvent);
2162 break;
2163 case SUPSEMOP2_CLOSE:
2164 pReq->Hdr.rc = SUPSemEventClose(pSession, hEvent);
2165 break;
2166 case SUPSEMOP2_RESET:
2167 default:
2168 pReq->Hdr.rc = VERR_INVALID_FUNCTION;
2169 break;
2170 }
2171 break;
2172 }
2173
2174 case SUP_SEM_TYPE_EVENT_MULTI:
2175 {
2176 SUPSEMEVENTMULTI hEventMulti = (SUPSEMEVENTMULTI)(uintptr_t)pReq->u.In.hSem;
2177 switch (pReq->u.In.uOp)
2178 {
2179 case SUPSEMOP2_WAIT_MS_REL:
2180 pReq->Hdr.rc = SUPSemEventMultiWaitNoResume(pSession, hEventMulti, pReq->u.In.uArg.cRelMsTimeout);
2181 break;
2182 case SUPSEMOP2_WAIT_NS_ABS:
2183 pReq->Hdr.rc = SUPSemEventMultiWaitNsAbsIntr(pSession, hEventMulti, pReq->u.In.uArg.uAbsNsTimeout);
2184 break;
2185 case SUPSEMOP2_WAIT_NS_REL:
2186 pReq->Hdr.rc = SUPSemEventMultiWaitNsRelIntr(pSession, hEventMulti, pReq->u.In.uArg.cRelNsTimeout);
2187 break;
2188 case SUPSEMOP2_SIGNAL:
2189 pReq->Hdr.rc = SUPSemEventMultiSignal(pSession, hEventMulti);
2190 break;
2191 case SUPSEMOP2_CLOSE:
2192 pReq->Hdr.rc = SUPSemEventMultiClose(pSession, hEventMulti);
2193 break;
2194 case SUPSEMOP2_RESET:
2195 pReq->Hdr.rc = SUPSemEventMultiReset(pSession, hEventMulti);
2196 break;
2197 default:
2198 pReq->Hdr.rc = VERR_INVALID_FUNCTION;
2199 break;
2200 }
2201 break;
2202 }
2203
2204 default:
2205 pReq->Hdr.rc = VERR_INVALID_PARAMETER;
2206 break;
2207 }
2208 return 0;
2209 }
2210
2211 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_SEM_OP3):
2212 {
2213 /* validate */
2214 PSUPSEMOP3 pReq = (PSUPSEMOP3)pReqHdr;
2215 REQ_CHECK_SIZES_EX(SUP_IOCTL_SEM_OP3, SUP_IOCTL_SEM_OP3_SIZE_IN, SUP_IOCTL_SEM_OP3_SIZE_OUT);
2216 REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, pReq->u.In.u32Reserved == 0 && pReq->u.In.u64Reserved == 0);
2217
2218 /* execute */
2219 switch (pReq->u.In.uType)
2220 {
2221 case SUP_SEM_TYPE_EVENT:
2222 {
2223 SUPSEMEVENT hEvent = (SUPSEMEVENT)(uintptr_t)pReq->u.In.hSem;
2224 switch (pReq->u.In.uOp)
2225 {
2226 case SUPSEMOP3_CREATE:
2227 REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, hEvent == NIL_SUPSEMEVENT);
2228 pReq->Hdr.rc = SUPSemEventCreate(pSession, &hEvent);
2229 pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEvent;
2230 break;
2231 case SUPSEMOP3_GET_RESOLUTION:
2232 REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, hEvent == NIL_SUPSEMEVENT);
2233 pReq->Hdr.rc = VINF_SUCCESS;
2234 pReq->Hdr.cbOut = sizeof(*pReq);
2235 pReq->u.Out.cNsResolution = SUPSemEventGetResolution(pSession);
2236 break;
2237 default:
2238 pReq->Hdr.rc = VERR_INVALID_FUNCTION;
2239 break;
2240 }
2241 break;
2242 }
2243
2244 case SUP_SEM_TYPE_EVENT_MULTI:
2245 {
2246 SUPSEMEVENTMULTI hEventMulti = (SUPSEMEVENTMULTI)(uintptr_t)pReq->u.In.hSem;
2247 switch (pReq->u.In.uOp)
2248 {
2249 case SUPSEMOP3_CREATE:
2250 REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, hEventMulti == NIL_SUPSEMEVENTMULTI);
2251 pReq->Hdr.rc = SUPSemEventMultiCreate(pSession, &hEventMulti);
2252 pReq->u.Out.hSem = (uint32_t)(uintptr_t)hEventMulti;
2253 break;
2254 case SUPSEMOP3_GET_RESOLUTION:
2255 REQ_CHECK_EXPR(SUP_IOCTL_SEM_OP3, hEventMulti == NIL_SUPSEMEVENTMULTI);
2256 pReq->Hdr.rc = VINF_SUCCESS;
2257 pReq->u.Out.cNsResolution = SUPSemEventMultiGetResolution(pSession);
2258 break;
2259 default:
2260 pReq->Hdr.rc = VERR_INVALID_FUNCTION;
2261 break;
2262 }
2263 break;
2264 }
2265
2266 default:
2267 pReq->Hdr.rc = VERR_INVALID_PARAMETER;
2268 break;
2269 }
2270 return 0;
2271 }
2272
2273 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_VT_CAPS):
2274 {
2275 /* validate */
2276 PSUPVTCAPS pReq = (PSUPVTCAPS)pReqHdr;
2277 REQ_CHECK_SIZES(SUP_IOCTL_VT_CAPS);
2278
2279 /* execute */
2280 pReq->Hdr.rc = SUPR0QueryVTCaps(pSession, &pReq->u.Out.fCaps);
2281 if (RT_FAILURE(pReq->Hdr.rc))
2282 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
2283 return 0;
2284 }
2285
2286 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TRACER_OPEN):
2287 {
2288 /* validate */
2289 PSUPTRACEROPEN pReq = (PSUPTRACEROPEN)pReqHdr;
2290 REQ_CHECK_SIZES(SUP_IOCTL_TRACER_OPEN);
2291
2292 /* execute */
2293 pReq->Hdr.rc = supdrvIOCtl_TracerOpen(pDevExt, pSession, pReq->u.In.uCookie, pReq->u.In.uArg);
2294 return 0;
2295 }
2296
2297 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TRACER_CLOSE):
2298 {
2299 /* validate */
2300 REQ_CHECK_SIZES(SUP_IOCTL_TRACER_CLOSE);
2301
2302 /* execute */
2303 pReqHdr->rc = supdrvIOCtl_TracerClose(pDevExt, pSession);
2304 return 0;
2305 }
2306
2307 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TRACER_IOCTL):
2308 {
2309 /* validate */
2310 PSUPTRACERIOCTL pReq = (PSUPTRACERIOCTL)pReqHdr;
2311 REQ_CHECK_SIZES(SUP_IOCTL_TRACER_IOCTL);
2312
2313 /* execute */
2314 pReqHdr->rc = supdrvIOCtl_TracerIOCtl(pDevExt, pSession, pReq->u.In.uCmd, pReq->u.In.uArg, &pReq->u.Out.iRetVal);
2315 return 0;
2316 }
2317
2318 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TRACER_UMOD_REG):
2319 {
2320 /* validate */
2321 PSUPTRACERUMODREG pReq = (PSUPTRACERUMODREG)pReqHdr;
2322 REQ_CHECK_SIZES(SUP_IOCTL_TRACER_UMOD_REG);
2323 if (!RTStrEnd(pReq->u.In.szName, sizeof(pReq->u.In.szName)))
2324 return VERR_INVALID_PARAMETER;
2325
2326 /* execute */
2327 pReqHdr->rc = supdrvIOCtl_TracerUmodRegister(pDevExt, pSession,
2328 pReq->u.In.R3PtrVtgHdr, pReq->u.In.uVtgHdrAddr,
2329 pReq->u.In.R3PtrStrTab, pReq->u.In.cbStrTab,
2330 pReq->u.In.szName, pReq->u.In.fFlags);
2331 return 0;
2332 }
2333
2334 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TRACER_UMOD_DEREG):
2335 {
2336 /* validate */
2337 PSUPTRACERUMODDEREG pReq = (PSUPTRACERUMODDEREG)pReqHdr;
2338 REQ_CHECK_SIZES(SUP_IOCTL_TRACER_UMOD_DEREG);
2339
2340 /* execute */
2341 pReqHdr->rc = supdrvIOCtl_TracerUmodDeregister(pDevExt, pSession, pReq->u.In.pVtgHdr);
2342 return 0;
2343 }
2344
2345 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TRACER_UMOD_FIRE_PROBE):
2346 {
2347 /* validate */
2348 PSUPTRACERUMODFIREPROBE pReq = (PSUPTRACERUMODFIREPROBE)pReqHdr;
2349 REQ_CHECK_SIZES(SUP_IOCTL_TRACER_UMOD_FIRE_PROBE);
2350
2351 supdrvIOCtl_TracerUmodProbeFire(pDevExt, pSession, &pReq->u.In);
2352 pReqHdr->rc = VINF_SUCCESS;
2353 return 0;
2354 }
2355
2356 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_MSR_PROBER):
2357 {
2358 /* validate */
2359 PSUPMSRPROBER pReq = (PSUPMSRPROBER)pReqHdr;
2360 REQ_CHECK_SIZES(SUP_IOCTL_MSR_PROBER);
2361 REQ_CHECK_EXPR(SUP_IOCTL_MSR_PROBER,
2362 pReq->u.In.enmOp > SUPMSRPROBEROP_INVALID && pReq->u.In.enmOp < SUPMSRPROBEROP_END);
2363
2364 pReqHdr->rc = supdrvIOCtl_MsrProber(pDevExt, pReq);
2365 return 0;
2366 }
2367
2368 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_RESUME_SUSPENDED_KBDS):
2369 {
2370 /* validate */
2371 REQ_CHECK_SIZES(SUP_IOCTL_RESUME_SUSPENDED_KBDS);
2372
2373 pReqHdr->rc = supdrvIOCtl_ResumeSuspendedKbds();
2374 return 0;
2375 }
2376
2377 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TSC_DELTA_MEASURE):
2378 {
2379 /* validate */
2380 PSUPTSCDELTAMEASURE pReq = (PSUPTSCDELTAMEASURE)pReqHdr;
2381 REQ_CHECK_SIZES(SUP_IOCTL_TSC_DELTA_MEASURE);
2382
2383 pReqHdr->rc = supdrvIOCtl_TscDeltaMeasure(pDevExt, pSession, pReq);
2384 return 0;
2385 }
2386
2387 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_TSC_READ):
2388 {
2389 /* validate */
2390 PSUPTSCREAD pReq = (PSUPTSCREAD)pReqHdr;
2391 REQ_CHECK_SIZES(SUP_IOCTL_TSC_READ);
2392
2393 pReqHdr->rc = supdrvIOCtl_TscRead(pDevExt, pSession, pReq);
2394 return 0;
2395 }
2396
2397 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GIP_SET_FLAGS):
2398 {
2399 /* validate */
2400 PSUPGIPSETFLAGS pReq = (PSUPGIPSETFLAGS)pReqHdr;
2401 REQ_CHECK_SIZES(SUP_IOCTL_GIP_SET_FLAGS);
2402
2403 pReqHdr->rc = supdrvIOCtl_GipSetFlags(pDevExt, pSession, pReq->u.In.fOrMask, pReq->u.In.fAndMask);
2404 return 0;
2405 }
2406
2407 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_UCODE_REV):
2408 {
2409 /* validate */
2410 PSUPUCODEREV pReq = (PSUPUCODEREV)pReqHdr;
2411 REQ_CHECK_SIZES(SUP_IOCTL_UCODE_REV);
2412
2413 /* execute */
2414 pReq->Hdr.rc = SUPR0QueryUcodeRev(pSession, &pReq->u.Out.MicrocodeRev);
2415 if (RT_FAILURE(pReq->Hdr.rc))
2416 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
2417 return 0;
2418 }
2419
2420 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_GET_HWVIRT_MSRS):
2421 {
2422 /* validate */
2423 PSUPGETHWVIRTMSRS pReq = (PSUPGETHWVIRTMSRS)pReqHdr;
2424 REQ_CHECK_SIZES(SUP_IOCTL_GET_HWVIRT_MSRS);
2425 REQ_CHECK_EXPR_FMT(!pReq->u.In.fReserved0 && !pReq->u.In.fReserved1 && !pReq->u.In.fReserved2,
2426 ("SUP_IOCTL_GET_HWVIRT_MSRS: fReserved0=%d fReserved1=%d fReserved2=%d\n", pReq->u.In.fReserved0,
2427 pReq->u.In.fReserved1, pReq->u.In.fReserved2));
2428
2429 /* execute */
2430 pReq->Hdr.rc = SUPR0GetHwvirtMsrs(&pReq->u.Out.HwvirtMsrs, 0 /* fCaps */, pReq->u.In.fForce);
2431 if (RT_FAILURE(pReq->Hdr.rc))
2432 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
2433 return 0;
2434 }
2435
2436 default:
2437 Log(("Unknown IOCTL %#lx\n", (long)uIOCtl));
2438 break;
2439 }
2440 return VERR_GENERAL_FAILURE;
2441}
2442
2443
2444/**
2445 * I/O Control inner worker for the restricted operations.
2446 *
2447 * @returns IPRT status code.
2448 * @retval VERR_INVALID_PARAMETER if the request is invalid.
2449 *
2450 * @param uIOCtl Function number.
2451 * @param pDevExt Device extention.
2452 * @param pSession Session data.
2453 * @param pReqHdr The request header.
2454 */
2455static int supdrvIOCtlInnerRestricted(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPREQHDR pReqHdr)
2456{
2457 /*
2458 * The switch.
2459 */
2460 switch (SUP_CTL_CODE_NO_SIZE(uIOCtl))
2461 {
2462 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_COOKIE):
2463 {
2464 PSUPCOOKIE pReq = (PSUPCOOKIE)pReqHdr;
2465 REQ_CHECK_SIZES(SUP_IOCTL_COOKIE);
2466 if (strncmp(pReq->u.In.szMagic, SUPCOOKIE_MAGIC, sizeof(pReq->u.In.szMagic)))
2467 {
2468 OSDBGPRINT(("SUP_IOCTL_COOKIE: invalid magic %.16s\n", pReq->u.In.szMagic));
2469 pReq->Hdr.rc = VERR_INVALID_MAGIC;
2470 return 0;
2471 }
2472
2473 /*
2474 * Match the version.
2475 * The current logic is very simple, match the major interface version.
2476 */
2477 if ( pReq->u.In.u32MinVersion > SUPDRV_IOC_VERSION
2478 || (pReq->u.In.u32MinVersion & 0xffff0000) != (SUPDRV_IOC_VERSION & 0xffff0000))
2479 {
2480 OSDBGPRINT(("SUP_IOCTL_COOKIE: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
2481 pReq->u.In.u32ReqVersion, pReq->u.In.u32MinVersion, SUPDRV_IOC_VERSION));
2482 pReq->u.Out.u32Cookie = 0xffffffff;
2483 pReq->u.Out.u32SessionCookie = 0xffffffff;
2484 pReq->u.Out.u32SessionVersion = 0xffffffff;
2485 pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
2486 pReq->u.Out.pSession = NULL;
2487 pReq->u.Out.cFunctions = 0;
2488 pReq->Hdr.rc = VERR_VERSION_MISMATCH;
2489 return 0;
2490 }
2491
2492 /*
2493 * Fill in return data and be gone.
2494 * N.B. The first one to change SUPDRV_IOC_VERSION shall makes sure that
2495 * u32SessionVersion <= u32ReqVersion!
2496 */
2497 /** @todo Somehow validate the client and negotiate a secure cookie... */
2498 pReq->u.Out.u32Cookie = pDevExt->u32Cookie;
2499 pReq->u.Out.u32SessionCookie = pSession->u32Cookie;
2500 pReq->u.Out.u32SessionVersion = SUPDRV_IOC_VERSION;
2501 pReq->u.Out.u32DriverVersion = SUPDRV_IOC_VERSION;
2502 pReq->u.Out.pSession = pSession;
2503 pReq->u.Out.cFunctions = 0;
2504 pReq->Hdr.rc = VINF_SUCCESS;
2505 return 0;
2506 }
2507
2508 case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_VT_CAPS):
2509 {
2510 /* validate */
2511 PSUPVTCAPS pReq = (PSUPVTCAPS)pReqHdr;
2512 REQ_CHECK_SIZES(SUP_IOCTL_VT_CAPS);
2513
2514 /* execute */
2515 pReq->Hdr.rc = SUPR0QueryVTCaps(pSession, &pReq->u.Out.fCaps);
2516 if (RT_FAILURE(pReq->Hdr.rc))
2517 pReq->Hdr.cbOut = sizeof(pReq->Hdr);
2518 return 0;
2519 }
2520
2521 default:
2522 Log(("Unknown IOCTL %#lx\n", (long)uIOCtl));
2523 break;
2524 }
2525 return VERR_GENERAL_FAILURE;
2526}
2527
2528
2529/**
2530 * I/O Control worker.
2531 *
2532 * @returns IPRT status code.
2533 * @retval VERR_INVALID_PARAMETER if the request is invalid.
2534 *
2535 * @param uIOCtl Function number.
2536 * @param pDevExt Device extention.
2537 * @param pSession Session data.
2538 * @param pReqHdr The request header.
2539 * @param cbReq The size of the request buffer.
2540 */
2541int VBOXCALL supdrvIOCtl(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPREQHDR pReqHdr, size_t cbReq)
2542{
2543 int rc;
2544 VBOXDRV_IOCTL_ENTRY(pSession, uIOCtl, pReqHdr);
2545
2546 /*
2547 * Validate the request.
2548 */
2549 if (RT_UNLIKELY(cbReq < sizeof(*pReqHdr)))
2550 {
2551 OSDBGPRINT(("vboxdrv: Bad ioctl request size; cbReq=%#lx\n", (long)cbReq));
2552 VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
2553 return VERR_INVALID_PARAMETER;
2554 }
2555 if (RT_UNLIKELY( (pReqHdr->fFlags & SUPREQHDR_FLAGS_MAGIC_MASK) != SUPREQHDR_FLAGS_MAGIC
2556 || pReqHdr->cbIn < sizeof(*pReqHdr)
2557 || pReqHdr->cbIn > cbReq
2558 || pReqHdr->cbOut < sizeof(*pReqHdr)
2559 || pReqHdr->cbOut > cbReq))
2560 {
2561 OSDBGPRINT(("vboxdrv: Bad ioctl request header; cbIn=%#lx cbOut=%#lx fFlags=%#lx\n",
2562 (long)pReqHdr->cbIn, (long)pReqHdr->cbOut, (long)pReqHdr->fFlags));
2563 VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
2564 return VERR_INVALID_PARAMETER;
2565 }
2566 if (RT_UNLIKELY(!RT_VALID_PTR(pSession)))
2567 {
2568 OSDBGPRINT(("vboxdrv: Invalid pSession value %p (ioctl=%p)\n", pSession, (void *)uIOCtl));
2569 VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
2570 return VERR_INVALID_PARAMETER;
2571 }
2572 if (RT_UNLIKELY(uIOCtl == SUP_IOCTL_COOKIE))
2573 {
2574 if (pReqHdr->u32Cookie != SUPCOOKIE_INITIAL_COOKIE)
2575 {
2576 OSDBGPRINT(("SUP_IOCTL_COOKIE: bad cookie %#lx\n", (long)pReqHdr->u32Cookie));
2577 VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
2578 return VERR_INVALID_PARAMETER;
2579 }
2580 }
2581 else if (RT_UNLIKELY( pReqHdr->u32Cookie != pDevExt->u32Cookie
2582 || pReqHdr->u32SessionCookie != pSession->u32Cookie))
2583 {
2584 OSDBGPRINT(("vboxdrv: bad cookie %#lx / %#lx.\n", (long)pReqHdr->u32Cookie, (long)pReqHdr->u32SessionCookie));
2585 VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, VERR_INVALID_PARAMETER, VINF_SUCCESS);
2586 return VERR_INVALID_PARAMETER;
2587 }
2588
2589 /*
2590 * Hand it to an inner function to avoid lots of unnecessary return tracepoints.
2591 */
2592 if (pSession->fUnrestricted)
2593 rc = supdrvIOCtlInnerUnrestricted(uIOCtl, pDevExt, pSession, pReqHdr);
2594 else
2595 rc = supdrvIOCtlInnerRestricted(uIOCtl, pDevExt, pSession, pReqHdr);
2596
2597 VBOXDRV_IOCTL_RETURN(pSession, uIOCtl, pReqHdr, pReqHdr->rc, rc);
2598 return rc;
2599}
2600
2601
2602/**
2603 * Inter-Driver Communication (IDC) worker.
2604 *
2605 * @returns VBox status code.
2606 * @retval VINF_SUCCESS on success.
2607 * @retval VERR_INVALID_PARAMETER if the request is invalid.
2608 * @retval VERR_NOT_SUPPORTED if the request isn't supported.
2609 *
2610 * @param uReq The request (function) code.
2611 * @param pDevExt Device extention.
2612 * @param pSession Session data.
2613 * @param pReqHdr The request header.
2614 */
2615int VBOXCALL supdrvIDC(uintptr_t uReq, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQHDR pReqHdr)
2616{
2617 /*
2618 * The OS specific code has already validated the pSession
2619 * pointer, and the request size being greater or equal to
2620 * size of the header.
2621 *
2622 * So, just check that pSession is a kernel context session.
2623 */
2624 if (RT_UNLIKELY( pSession
2625 && pSession->R0Process != NIL_RTR0PROCESS))
2626 return VERR_INVALID_PARAMETER;
2627
2628/*
2629 * Validation macro.
2630 */
2631#define REQ_CHECK_IDC_SIZE(Name, cbExpect) \
2632 do { \
2633 if (RT_UNLIKELY(pReqHdr->cb != (cbExpect))) \
2634 { \
2635 OSDBGPRINT(( #Name ": Invalid input/output sizes. cb=%ld expected %ld.\n", \
2636 (long)pReqHdr->cb, (long)(cbExpect))); \
2637 return pReqHdr->rc = VERR_INVALID_PARAMETER; \
2638 } \
2639 } while (0)
2640
2641 switch (uReq)
2642 {
2643 case SUPDRV_IDC_REQ_CONNECT:
2644 {
2645 PSUPDRVIDCREQCONNECT pReq = (PSUPDRVIDCREQCONNECT)pReqHdr;
2646 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_CONNECT, sizeof(*pReq));
2647
2648 /*
2649 * Validate the cookie and other input.
2650 */
2651 if (pReq->Hdr.pSession != NULL)
2652 {
2653 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: Hdr.pSession=%p expected NULL!\n", pReq->Hdr.pSession));
2654 return pReqHdr->rc = VERR_INVALID_PARAMETER;
2655 }
2656 if (pReq->u.In.u32MagicCookie != SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE)
2657 {
2658 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: u32MagicCookie=%#x expected %#x!\n",
2659 (unsigned)pReq->u.In.u32MagicCookie, (unsigned)SUPDRVIDCREQ_CONNECT_MAGIC_COOKIE));
2660 return pReqHdr->rc = VERR_INVALID_PARAMETER;
2661 }
2662 if ( pReq->u.In.uMinVersion > pReq->u.In.uReqVersion
2663 || (pReq->u.In.uMinVersion & UINT32_C(0xffff0000)) != (pReq->u.In.uReqVersion & UINT32_C(0xffff0000)))
2664 {
2665 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: uMinVersion=%#x uMaxVersion=%#x doesn't match!\n",
2666 pReq->u.In.uMinVersion, pReq->u.In.uReqVersion));
2667 return pReqHdr->rc = VERR_INVALID_PARAMETER;
2668 }
2669 if (pSession != NULL)
2670 {
2671 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: pSession=%p expected NULL!\n", pSession));
2672 return pReqHdr->rc = VERR_INVALID_PARAMETER;
2673 }
2674
2675 /*
2676 * Match the version.
2677 * The current logic is very simple, match the major interface version.
2678 */
2679 if ( pReq->u.In.uMinVersion > SUPDRV_IDC_VERSION
2680 || (pReq->u.In.uMinVersion & 0xffff0000) != (SUPDRV_IDC_VERSION & 0xffff0000))
2681 {
2682 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: Version mismatch. Requested: %#x Min: %#x Current: %#x\n",
2683 pReq->u.In.uReqVersion, pReq->u.In.uMinVersion, (unsigned)SUPDRV_IDC_VERSION));
2684 pReq->u.Out.pSession = NULL;
2685 pReq->u.Out.uSessionVersion = 0xffffffff;
2686 pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
2687 pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
2688 pReq->Hdr.rc = VERR_VERSION_MISMATCH;
2689 return VINF_SUCCESS;
2690 }
2691
2692 pReq->u.Out.pSession = NULL;
2693 pReq->u.Out.uSessionVersion = SUPDRV_IDC_VERSION;
2694 pReq->u.Out.uDriverVersion = SUPDRV_IDC_VERSION;
2695 pReq->u.Out.uDriverRevision = VBOX_SVN_REV;
2696
2697 pReq->Hdr.rc = supdrvCreateSession(pDevExt, false /* fUser */, true /*fUnrestricted*/, &pSession);
2698 if (RT_FAILURE(pReq->Hdr.rc))
2699 {
2700 OSDBGPRINT(("SUPDRV_IDC_REQ_CONNECT: failed to create session, rc=%d\n", pReq->Hdr.rc));
2701 return VINF_SUCCESS;
2702 }
2703
2704 pReq->u.Out.pSession = pSession;
2705 pReq->Hdr.pSession = pSession;
2706
2707 return VINF_SUCCESS;
2708 }
2709
2710 case SUPDRV_IDC_REQ_DISCONNECT:
2711 {
2712 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_DISCONNECT, sizeof(*pReqHdr));
2713
2714 supdrvSessionRelease(pSession);
2715 return pReqHdr->rc = VINF_SUCCESS;
2716 }
2717
2718 case SUPDRV_IDC_REQ_GET_SYMBOL:
2719 {
2720 PSUPDRVIDCREQGETSYM pReq = (PSUPDRVIDCREQGETSYM)pReqHdr;
2721 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_GET_SYMBOL, sizeof(*pReq));
2722
2723 pReq->Hdr.rc = supdrvIDC_LdrGetSymbol(pDevExt, pSession, pReq);
2724 return VINF_SUCCESS;
2725 }
2726
2727 case SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY:
2728 {
2729 PSUPDRVIDCREQCOMPREGFACTORY pReq = (PSUPDRVIDCREQCOMPREGFACTORY)pReqHdr;
2730 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_REGISTER_FACTORY, sizeof(*pReq));
2731
2732 pReq->Hdr.rc = SUPR0ComponentRegisterFactory(pSession, pReq->u.In.pFactory);
2733 return VINF_SUCCESS;
2734 }
2735
2736 case SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY:
2737 {
2738 PSUPDRVIDCREQCOMPDEREGFACTORY pReq = (PSUPDRVIDCREQCOMPDEREGFACTORY)pReqHdr;
2739 REQ_CHECK_IDC_SIZE(SUPDRV_IDC_REQ_COMPONENT_DEREGISTER_FACTORY, sizeof(*pReq));
2740
2741 pReq->Hdr.rc = SUPR0ComponentDeregisterFactory(pSession, pReq->u.In.pFactory);
2742 return VINF_SUCCESS;
2743 }
2744
2745 default:
2746 Log(("Unknown IDC %#lx\n", (long)uReq));
2747 break;
2748 }
2749
2750#undef REQ_CHECK_IDC_SIZE
2751 return VERR_NOT_SUPPORTED;
2752}
2753
2754
2755/**
2756 * Register a object for reference counting.
2757 * The object is registered with one reference in the specified session.
2758 *
2759 * @returns Unique identifier on success (pointer).
2760 * All future reference must use this identifier.
2761 * @returns NULL on failure.
2762 * @param pSession The caller's session.
2763 * @param enmType The object type.
2764 * @param pfnDestructor The destructore function which will be called when the reference count reaches 0.
2765 * @param pvUser1 The first user argument.
2766 * @param pvUser2 The second user argument.
2767 */
2768SUPR0DECL(void *) SUPR0ObjRegister(PSUPDRVSESSION pSession, SUPDRVOBJTYPE enmType, PFNSUPDRVDESTRUCTOR pfnDestructor, void *pvUser1, void *pvUser2)
2769{
2770 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2771 PSUPDRVOBJ pObj;
2772 PSUPDRVUSAGE pUsage;
2773
2774 /*
2775 * Validate the input.
2776 */
2777 AssertReturn(SUP_IS_SESSION_VALID(pSession), NULL);
2778 AssertReturn(enmType > SUPDRVOBJTYPE_INVALID && enmType < SUPDRVOBJTYPE_END, NULL);
2779 AssertPtrReturn(pfnDestructor, NULL);
2780
2781 /*
2782 * Allocate and initialize the object.
2783 */
2784 pObj = (PSUPDRVOBJ)RTMemAlloc(sizeof(*pObj));
2785 if (!pObj)
2786 return NULL;
2787 pObj->u32Magic = SUPDRVOBJ_MAGIC;
2788 pObj->enmType = enmType;
2789 pObj->pNext = NULL;
2790 pObj->cUsage = 1;
2791 pObj->pfnDestructor = pfnDestructor;
2792 pObj->pvUser1 = pvUser1;
2793 pObj->pvUser2 = pvUser2;
2794 pObj->CreatorUid = pSession->Uid;
2795 pObj->CreatorGid = pSession->Gid;
2796 pObj->CreatorProcess= pSession->Process;
2797 supdrvOSObjInitCreator(pObj, pSession);
2798
2799 /*
2800 * Allocate the usage record.
2801 * (We keep freed usage records around to simplify SUPR0ObjAddRefEx().)
2802 */
2803 RTSpinlockAcquire(pDevExt->Spinlock);
2804
2805 pUsage = pDevExt->pUsageFree;
2806 if (pUsage)
2807 pDevExt->pUsageFree = pUsage->pNext;
2808 else
2809 {
2810 RTSpinlockRelease(pDevExt->Spinlock);
2811 pUsage = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsage));
2812 if (!pUsage)
2813 {
2814 RTMemFree(pObj);
2815 return NULL;
2816 }
2817 RTSpinlockAcquire(pDevExt->Spinlock);
2818 }
2819
2820 /*
2821 * Insert the object and create the session usage record.
2822 */
2823 /* The object. */
2824 pObj->pNext = pDevExt->pObjs;
2825 pDevExt->pObjs = pObj;
2826
2827 /* The session record. */
2828 pUsage->cUsage = 1;
2829 pUsage->pObj = pObj;
2830 pUsage->pNext = pSession->pUsage;
2831 /* Log2(("SUPR0ObjRegister: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext)); */
2832 pSession->pUsage = pUsage;
2833
2834 RTSpinlockRelease(pDevExt->Spinlock);
2835
2836 Log(("SUPR0ObjRegister: returns %p (pvUser1=%p, pvUser=%p)\n", pObj, pvUser1, pvUser2));
2837 return pObj;
2838}
2839
2840
2841/**
2842 * Increment the reference counter for the object associating the reference
2843 * with the specified session.
2844 *
2845 * @returns IPRT status code.
2846 * @param pvObj The identifier returned by SUPR0ObjRegister().
2847 * @param pSession The session which is referencing the object.
2848 *
2849 * @remarks The caller should not own any spinlocks and must carefully protect
2850 * itself against potential race with the destructor so freed memory
2851 * isn't accessed here.
2852 */
2853SUPR0DECL(int) SUPR0ObjAddRef(void *pvObj, PSUPDRVSESSION pSession)
2854{
2855 return SUPR0ObjAddRefEx(pvObj, pSession, false /* fNoBlocking */);
2856}
2857
2858
2859/**
2860 * Increment the reference counter for the object associating the reference
2861 * with the specified session.
2862 *
2863 * @returns IPRT status code.
2864 * @retval VERR_TRY_AGAIN if fNoBlocking was set and a new usage record
2865 * couldn't be allocated. (If you see this you're not doing the right
2866 * thing and it won't ever work reliably.)
2867 *
2868 * @param pvObj The identifier returned by SUPR0ObjRegister().
2869 * @param pSession The session which is referencing the object.
2870 * @param fNoBlocking Set if it's not OK to block. Never try to make the
2871 * first reference to an object in a session with this
2872 * argument set.
2873 *
2874 * @remarks The caller should not own any spinlocks and must carefully protect
2875 * itself against potential race with the destructor so freed memory
2876 * isn't accessed here.
2877 */
2878SUPR0DECL(int) SUPR0ObjAddRefEx(void *pvObj, PSUPDRVSESSION pSession, bool fNoBlocking)
2879{
2880 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2881 PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2882 int rc = VINF_SUCCESS;
2883 PSUPDRVUSAGE pUsagePre;
2884 PSUPDRVUSAGE pUsage;
2885
2886 /*
2887 * Validate the input.
2888 * Be ready for the destruction race (someone might be stuck in the
2889 * destructor waiting a lock we own).
2890 */
2891 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
2892 AssertPtrReturn(pObj, VERR_INVALID_POINTER);
2893 AssertMsgReturn(pObj->u32Magic == SUPDRVOBJ_MAGIC || pObj->u32Magic == SUPDRVOBJ_MAGIC_DEAD,
2894 ("Invalid pvObj=%p magic=%#x (expected %#x or %#x)\n", pvObj, pObj->u32Magic, SUPDRVOBJ_MAGIC, SUPDRVOBJ_MAGIC_DEAD),
2895 VERR_INVALID_PARAMETER);
2896
2897 RTSpinlockAcquire(pDevExt->Spinlock);
2898
2899 if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
2900 {
2901 RTSpinlockRelease(pDevExt->Spinlock);
2902
2903 AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
2904 return VERR_WRONG_ORDER;
2905 }
2906
2907 /*
2908 * Preallocate the usage record if we can.
2909 */
2910 pUsagePre = pDevExt->pUsageFree;
2911 if (pUsagePre)
2912 pDevExt->pUsageFree = pUsagePre->pNext;
2913 else if (!fNoBlocking)
2914 {
2915 RTSpinlockRelease(pDevExt->Spinlock);
2916 pUsagePre = (PSUPDRVUSAGE)RTMemAlloc(sizeof(*pUsagePre));
2917 if (!pUsagePre)
2918 return VERR_NO_MEMORY;
2919
2920 RTSpinlockAcquire(pDevExt->Spinlock);
2921 if (RT_UNLIKELY(pObj->u32Magic != SUPDRVOBJ_MAGIC))
2922 {
2923 RTSpinlockRelease(pDevExt->Spinlock);
2924
2925 AssertMsgFailed(("pvObj=%p magic=%#x\n", pvObj, pObj->u32Magic));
2926 return VERR_WRONG_ORDER;
2927 }
2928 }
2929
2930 /*
2931 * Reference the object.
2932 */
2933 pObj->cUsage++;
2934
2935 /*
2936 * Look for the session record.
2937 */
2938 for (pUsage = pSession->pUsage; pUsage; pUsage = pUsage->pNext)
2939 {
2940 /*Log(("SUPR0AddRef: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));*/
2941 if (pUsage->pObj == pObj)
2942 break;
2943 }
2944 if (pUsage)
2945 pUsage->cUsage++;
2946 else if (pUsagePre)
2947 {
2948 /* create a new session record. */
2949 pUsagePre->cUsage = 1;
2950 pUsagePre->pObj = pObj;
2951 pUsagePre->pNext = pSession->pUsage;
2952 pSession->pUsage = pUsagePre;
2953 /*Log(("SUPR0AddRef: pUsagePre=%p:{.pObj=%p, .pNext=%p}\n", pUsagePre, pUsagePre->pObj, pUsagePre->pNext));*/
2954
2955 pUsagePre = NULL;
2956 }
2957 else
2958 {
2959 pObj->cUsage--;
2960 rc = VERR_TRY_AGAIN;
2961 }
2962
2963 /*
2964 * Put any unused usage record into the free list..
2965 */
2966 if (pUsagePre)
2967 {
2968 pUsagePre->pNext = pDevExt->pUsageFree;
2969 pDevExt->pUsageFree = pUsagePre;
2970 }
2971
2972 RTSpinlockRelease(pDevExt->Spinlock);
2973
2974 return rc;
2975}
2976
2977
2978/**
2979 * Decrement / destroy a reference counter record for an object.
2980 *
2981 * The object is uniquely identified by pfnDestructor+pvUser1+pvUser2.
2982 *
2983 * @returns IPRT status code.
2984 * @retval VINF_SUCCESS if not destroyed.
2985 * @retval VINF_OBJECT_DESTROYED if it's destroyed by this release call.
2986 * @retval VERR_INVALID_PARAMETER if the object isn't valid. Will assert in
2987 * string builds.
2988 *
2989 * @param pvObj The identifier returned by SUPR0ObjRegister().
2990 * @param pSession The session which is referencing the object.
2991 */
2992SUPR0DECL(int) SUPR0ObjRelease(void *pvObj, PSUPDRVSESSION pSession)
2993{
2994 PSUPDRVDEVEXT pDevExt = pSession->pDevExt;
2995 PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
2996 int rc = VERR_INVALID_PARAMETER;
2997 PSUPDRVUSAGE pUsage;
2998 PSUPDRVUSAGE pUsagePrev;
2999
3000 /*
3001 * Validate the input.
3002 */
3003 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3004 AssertMsgReturn(VALID_PTR(pObj)&& pObj->u32Magic == SUPDRVOBJ_MAGIC,
3005 ("Invalid pvObj=%p magic=%#x (expected %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
3006 VERR_INVALID_PARAMETER);
3007
3008 /*
3009 * Acquire the spinlock and look for the usage record.
3010 */
3011 RTSpinlockAcquire(pDevExt->Spinlock);
3012
3013 for (pUsagePrev = NULL, pUsage = pSession->pUsage;
3014 pUsage;
3015 pUsagePrev = pUsage, pUsage = pUsage->pNext)
3016 {
3017 /*Log2(("SUPR0ObjRelease: pUsage=%p:{.pObj=%p, .pNext=%p}\n", pUsage, pUsage->pObj, pUsage->pNext));*/
3018 if (pUsage->pObj == pObj)
3019 {
3020 rc = VINF_SUCCESS;
3021 AssertMsg(pUsage->cUsage >= 1 && pObj->cUsage >= pUsage->cUsage, ("glob %d; sess %d\n", pObj->cUsage, pUsage->cUsage));
3022 if (pUsage->cUsage > 1)
3023 {
3024 pObj->cUsage--;
3025 pUsage->cUsage--;
3026 }
3027 else
3028 {
3029 /*
3030 * Free the session record.
3031 */
3032 if (pUsagePrev)
3033 pUsagePrev->pNext = pUsage->pNext;
3034 else
3035 pSession->pUsage = pUsage->pNext;
3036 pUsage->pNext = pDevExt->pUsageFree;
3037 pDevExt->pUsageFree = pUsage;
3038
3039 /* What about the object? */
3040 if (pObj->cUsage > 1)
3041 pObj->cUsage--;
3042 else
3043 {
3044 /*
3045 * Object is to be destroyed, unlink it.
3046 */
3047 pObj->u32Magic = SUPDRVOBJ_MAGIC_DEAD;
3048 rc = VINF_OBJECT_DESTROYED;
3049 if (pDevExt->pObjs == pObj)
3050 pDevExt->pObjs = pObj->pNext;
3051 else
3052 {
3053 PSUPDRVOBJ pObjPrev;
3054 for (pObjPrev = pDevExt->pObjs; pObjPrev; pObjPrev = pObjPrev->pNext)
3055 if (pObjPrev->pNext == pObj)
3056 {
3057 pObjPrev->pNext = pObj->pNext;
3058 break;
3059 }
3060 Assert(pObjPrev);
3061 }
3062 }
3063 }
3064 break;
3065 }
3066 }
3067
3068 RTSpinlockRelease(pDevExt->Spinlock);
3069
3070 /*
3071 * Call the destructor and free the object if required.
3072 */
3073 if (rc == VINF_OBJECT_DESTROYED)
3074 {
3075 Log(("SUPR0ObjRelease: destroying %p/%d (%p/%p) cpid=%RTproc pid=%RTproc dtor=%p\n",
3076 pObj, pObj->enmType, pObj->pvUser1, pObj->pvUser2, pObj->CreatorProcess, RTProcSelf(), pObj->pfnDestructor));
3077 if (pObj->pfnDestructor)
3078 pObj->pfnDestructor(pObj, pObj->pvUser1, pObj->pvUser2);
3079 RTMemFree(pObj);
3080 }
3081
3082 AssertMsg(pUsage, ("pvObj=%p\n", pvObj));
3083 return rc;
3084}
3085
3086
3087/**
3088 * Verifies that the current process can access the specified object.
3089 *
3090 * @returns The following IPRT status code:
3091 * @retval VINF_SUCCESS if access was granted.
3092 * @retval VERR_PERMISSION_DENIED if denied access.
3093 * @retval VERR_INVALID_PARAMETER if invalid parameter.
3094 *
3095 * @param pvObj The identifier returned by SUPR0ObjRegister().
3096 * @param pSession The session which wishes to access the object.
3097 * @param pszObjName Object string name. This is optional and depends on the object type.
3098 *
3099 * @remark The caller is responsible for making sure the object isn't removed while
3100 * we're inside this function. If uncertain about this, just call AddRef before calling us.
3101 */
3102SUPR0DECL(int) SUPR0ObjVerifyAccess(void *pvObj, PSUPDRVSESSION pSession, const char *pszObjName)
3103{
3104 PSUPDRVOBJ pObj = (PSUPDRVOBJ)pvObj;
3105 int rc;
3106
3107 /*
3108 * Validate the input.
3109 */
3110 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3111 AssertMsgReturn(VALID_PTR(pObj) && pObj->u32Magic == SUPDRVOBJ_MAGIC,
3112 ("Invalid pvObj=%p magic=%#x (exepcted %#x)\n", pvObj, pObj ? pObj->u32Magic : 0, SUPDRVOBJ_MAGIC),
3113 VERR_INVALID_PARAMETER);
3114
3115 /*
3116 * Check access. (returns true if a decision has been made.)
3117 */
3118 rc = VERR_INTERNAL_ERROR;
3119 if (supdrvOSObjCanAccess(pObj, pSession, pszObjName, &rc))
3120 return rc;
3121
3122 /*
3123 * Default policy is to allow the user to access his own
3124 * stuff but nothing else.
3125 */
3126 if (pObj->CreatorUid == pSession->Uid)
3127 return VINF_SUCCESS;
3128 return VERR_PERMISSION_DENIED;
3129}
3130
3131
3132/**
3133 * API for the VMMR0 module to get the SUPDRVSESSION::pSessionVM member.
3134 *
3135 * @returns The associated VM pointer.
3136 * @param pSession The session of the current thread.
3137 */
3138SUPR0DECL(PVM) SUPR0GetSessionVM(PSUPDRVSESSION pSession)
3139{
3140 AssertReturn(SUP_IS_SESSION_VALID(pSession), NULL);
3141 return pSession->pSessionVM;
3142}
3143
3144
3145/**
3146 * API for the VMMR0 module to get the SUPDRVSESSION::pSessionGVM member.
3147 *
3148 * @returns The associated GVM pointer.
3149 * @param pSession The session of the current thread.
3150 */
3151SUPR0DECL(PGVM) SUPR0GetSessionGVM(PSUPDRVSESSION pSession)
3152{
3153 AssertReturn(SUP_IS_SESSION_VALID(pSession), NULL);
3154 return pSession->pSessionGVM;
3155}
3156
3157
3158/**
3159 * API for the VMMR0 module to work the SUPDRVSESSION::pSessionVM member.
3160 *
3161 * This will fail if there is already a VM associated with the session and pVM
3162 * isn't NULL.
3163 *
3164 * @retval VINF_SUCCESS
3165 * @retval VERR_ALREADY_EXISTS if there already is a VM associated with the
3166 * session.
3167 * @retval VERR_INVALID_PARAMETER if only one of the parameters are NULL or if
3168 * the session is invalid.
3169 *
3170 * @param pSession The session of the current thread.
3171 * @param pGVM The GVM to associate with the session. Pass NULL to
3172 * dissassociate.
3173 * @param pVM The VM to associate with the session. Pass NULL to
3174 * dissassociate.
3175 */
3176SUPR0DECL(int) SUPR0SetSessionVM(PSUPDRVSESSION pSession, PGVM pGVM, PVM pVM)
3177{
3178 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3179 AssertReturn((pGVM != NULL) == (pVM != NULL), VERR_INVALID_PARAMETER);
3180
3181 RTSpinlockAcquire(pSession->pDevExt->Spinlock);
3182 if (pGVM)
3183 {
3184 if (!pSession->pSessionGVM)
3185 {
3186 pSession->pSessionGVM = pGVM;
3187 pSession->pSessionVM = pVM;
3188 pSession->pFastIoCtrlVM = NULL;
3189 }
3190 else
3191 {
3192 RTSpinlockRelease(pSession->pDevExt->Spinlock);
3193 SUPR0Printf("SUPR0SetSessionVM: Unable to associated GVM/VM %p/%p with session %p as it has %p/%p already!\n",
3194 pGVM, pVM, pSession, pSession->pSessionGVM, pSession->pSessionVM);
3195 return VERR_ALREADY_EXISTS;
3196 }
3197 }
3198 else
3199 {
3200 pSession->pSessionGVM = NULL;
3201 pSession->pSessionVM = NULL;
3202 pSession->pFastIoCtrlVM = NULL;
3203 }
3204 RTSpinlockRelease(pSession->pDevExt->Spinlock);
3205 return VINF_SUCCESS;
3206}
3207
3208
3209/** @copydoc RTLogGetDefaultInstanceEx
3210 * @remarks To allow overriding RTLogGetDefaultInstanceEx locally. */
3211SUPR0DECL(struct RTLOGGER *) SUPR0GetDefaultLogInstanceEx(uint32_t fFlagsAndGroup)
3212{
3213 return RTLogGetDefaultInstanceEx(fFlagsAndGroup);
3214}
3215
3216
3217/** @copydoc RTLogRelGetDefaultInstanceEx
3218 * @remarks To allow overriding RTLogRelGetDefaultInstanceEx locally. */
3219SUPR0DECL(struct RTLOGGER *) SUPR0GetDefaultLogRelInstanceEx(uint32_t fFlagsAndGroup)
3220{
3221 return RTLogRelGetDefaultInstanceEx(fFlagsAndGroup);
3222}
3223
3224
3225/**
3226 * Lock pages.
3227 *
3228 * @returns IPRT status code.
3229 * @param pSession Session to which the locked memory should be associated.
3230 * @param pvR3 Start of the memory range to lock.
3231 * This must be page aligned.
3232 * @param cPages Number of pages to lock.
3233 * @param paPages Where to put the physical addresses of locked memory.
3234 */
3235SUPR0DECL(int) SUPR0LockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t cPages, PRTHCPHYS paPages)
3236{
3237 int rc;
3238 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
3239 const size_t cb = (size_t)cPages << PAGE_SHIFT;
3240 LogFlow(("SUPR0LockMem: pSession=%p pvR3=%p cPages=%d paPages=%p\n", pSession, (void *)pvR3, cPages, paPages));
3241
3242 /*
3243 * Verify input.
3244 */
3245 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3246 AssertPtrReturn(paPages, VERR_INVALID_PARAMETER);
3247 if ( RT_ALIGN_R3PT(pvR3, PAGE_SIZE, RTR3PTR) != pvR3
3248 || !pvR3)
3249 {
3250 Log(("pvR3 (%p) must be page aligned and not NULL!\n", (void *)pvR3));
3251 return VERR_INVALID_PARAMETER;
3252 }
3253
3254 /*
3255 * Let IPRT do the job.
3256 */
3257 Mem.eType = MEMREF_TYPE_LOCKED;
3258 rc = RTR0MemObjLockUser(&Mem.MemObj, pvR3, cb, RTMEM_PROT_READ | RTMEM_PROT_WRITE, NIL_RTR0PROCESS);
3259 if (RT_SUCCESS(rc))
3260 {
3261 uint32_t iPage = cPages;
3262 AssertMsg(RTR0MemObjAddressR3(Mem.MemObj) == pvR3, ("%p == %p\n", RTR0MemObjAddressR3(Mem.MemObj), pvR3));
3263 AssertMsg(RTR0MemObjSize(Mem.MemObj) == cb, ("%x == %x\n", RTR0MemObjSize(Mem.MemObj), cb));
3264
3265 while (iPage-- > 0)
3266 {
3267 paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
3268 if (RT_UNLIKELY(paPages[iPage] == NIL_RTCCPHYS))
3269 {
3270 AssertMsgFailed(("iPage=%d\n", iPage));
3271 rc = VERR_INTERNAL_ERROR;
3272 break;
3273 }
3274 }
3275 if (RT_SUCCESS(rc))
3276 rc = supdrvMemAdd(&Mem, pSession);
3277 if (RT_FAILURE(rc))
3278 {
3279 int rc2 = RTR0MemObjFree(Mem.MemObj, false);
3280 AssertRC(rc2);
3281 }
3282 }
3283
3284 return rc;
3285}
3286
3287
3288/**
3289 * Unlocks the memory pointed to by pv.
3290 *
3291 * @returns IPRT status code.
3292 * @param pSession Session to which the memory was locked.
3293 * @param pvR3 Memory to unlock.
3294 */
3295SUPR0DECL(int) SUPR0UnlockMem(PSUPDRVSESSION pSession, RTR3PTR pvR3)
3296{
3297 LogFlow(("SUPR0UnlockMem: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
3298 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3299 return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_LOCKED);
3300}
3301
3302
3303/**
3304 * Allocates a chunk of page aligned memory with contiguous and fixed physical
3305 * backing.
3306 *
3307 * @returns IPRT status code.
3308 * @param pSession Session data.
3309 * @param cPages Number of pages to allocate.
3310 * @param ppvR0 Where to put the address of Ring-0 mapping the allocated memory.
3311 * @param ppvR3 Where to put the address of Ring-3 mapping the allocated memory.
3312 * @param pHCPhys Where to put the physical address of allocated memory.
3313 */
3314SUPR0DECL(int) SUPR0ContAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS pHCPhys)
3315{
3316 int rc;
3317 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
3318 LogFlow(("SUPR0ContAlloc: pSession=%p cPages=%d ppvR0=%p ppvR3=%p pHCPhys=%p\n", pSession, cPages, ppvR0, ppvR3, pHCPhys));
3319
3320 /*
3321 * Validate input.
3322 */
3323 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3324 if (!ppvR3 || !ppvR0 || !pHCPhys)
3325 {
3326 Log(("Null pointer. All of these should be set: pSession=%p ppvR0=%p ppvR3=%p pHCPhys=%p\n",
3327 pSession, ppvR0, ppvR3, pHCPhys));
3328 return VERR_INVALID_PARAMETER;
3329
3330 }
3331 if (cPages < 1 || cPages >= 256)
3332 {
3333 Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
3334 return VERR_PAGE_COUNT_OUT_OF_RANGE;
3335 }
3336
3337 /*
3338 * Let IPRT do the job.
3339 */
3340 rc = RTR0MemObjAllocCont(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable R0 mapping */);
3341 if (RT_SUCCESS(rc))
3342 {
3343 int rc2;
3344 rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
3345 RTMEM_PROT_EXEC | RTMEM_PROT_WRITE | RTMEM_PROT_READ, NIL_RTR0PROCESS);
3346 if (RT_SUCCESS(rc))
3347 {
3348 Mem.eType = MEMREF_TYPE_CONT;
3349 rc = supdrvMemAdd(&Mem, pSession);
3350 if (!rc)
3351 {
3352 *ppvR0 = RTR0MemObjAddress(Mem.MemObj);
3353 *ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
3354 *pHCPhys = RTR0MemObjGetPagePhysAddr(Mem.MemObj, 0);
3355 return 0;
3356 }
3357
3358 rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
3359 AssertRC(rc2);
3360 }
3361 rc2 = RTR0MemObjFree(Mem.MemObj, false);
3362 AssertRC(rc2);
3363 }
3364
3365 return rc;
3366}
3367
3368
3369/**
3370 * Frees memory allocated using SUPR0ContAlloc().
3371 *
3372 * @returns IPRT status code.
3373 * @param pSession The session to which the memory was allocated.
3374 * @param uPtr Pointer to the memory (ring-3 or ring-0).
3375 */
3376SUPR0DECL(int) SUPR0ContFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
3377{
3378 LogFlow(("SUPR0ContFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
3379 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3380 return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_CONT);
3381}
3382
3383
3384/**
3385 * Allocates a chunk of page aligned memory with fixed physical backing below 4GB.
3386 *
3387 * The memory isn't zeroed.
3388 *
3389 * @returns IPRT status code.
3390 * @param pSession Session data.
3391 * @param cPages Number of pages to allocate.
3392 * @param ppvR0 Where to put the address of Ring-0 mapping of the allocated memory.
3393 * @param ppvR3 Where to put the address of Ring-3 mapping of the allocated memory.
3394 * @param paPages Where to put the physical addresses of allocated memory.
3395 */
3396SUPR0DECL(int) SUPR0LowAlloc(PSUPDRVSESSION pSession, uint32_t cPages, PRTR0PTR ppvR0, PRTR3PTR ppvR3, PRTHCPHYS paPages)
3397{
3398 unsigned iPage;
3399 int rc;
3400 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
3401 LogFlow(("SUPR0LowAlloc: pSession=%p cPages=%d ppvR3=%p ppvR0=%p paPages=%p\n", pSession, cPages, ppvR3, ppvR0, paPages));
3402
3403 /*
3404 * Validate input.
3405 */
3406 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3407 if (!ppvR3 || !ppvR0 || !paPages)
3408 {
3409 Log(("Null pointer. All of these should be set: pSession=%p ppvR3=%p ppvR0=%p paPages=%p\n",
3410 pSession, ppvR3, ppvR0, paPages));
3411 return VERR_INVALID_PARAMETER;
3412
3413 }
3414 if (cPages < 1 || cPages >= 256)
3415 {
3416 Log(("Illegal request cPages=%d, must be greater than 0 and smaller than 256.\n", cPages));
3417 return VERR_PAGE_COUNT_OUT_OF_RANGE;
3418 }
3419
3420 /*
3421 * Let IPRT do the work.
3422 */
3423 rc = RTR0MemObjAllocLow(&Mem.MemObj, cPages << PAGE_SHIFT, true /* executable ring-0 mapping */);
3424 if (RT_SUCCESS(rc))
3425 {
3426 int rc2;
3427 rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
3428 RTMEM_PROT_EXEC | RTMEM_PROT_WRITE | RTMEM_PROT_READ, NIL_RTR0PROCESS);
3429 if (RT_SUCCESS(rc))
3430 {
3431 Mem.eType = MEMREF_TYPE_LOW;
3432 rc = supdrvMemAdd(&Mem, pSession);
3433 if (!rc)
3434 {
3435 for (iPage = 0; iPage < cPages; iPage++)
3436 {
3437 paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MemObj, iPage);
3438 AssertMsg(!(paPages[iPage] & (PAGE_SIZE - 1)), ("iPage=%d Phys=%RHp\n", paPages[iPage]));
3439 }
3440 *ppvR0 = RTR0MemObjAddress(Mem.MemObj);
3441 *ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
3442 return 0;
3443 }
3444
3445 rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
3446 AssertRC(rc2);
3447 }
3448
3449 rc2 = RTR0MemObjFree(Mem.MemObj, false);
3450 AssertRC(rc2);
3451 }
3452
3453 return rc;
3454}
3455
3456
3457/**
3458 * Frees memory allocated using SUPR0LowAlloc().
3459 *
3460 * @returns IPRT status code.
3461 * @param pSession The session to which the memory was allocated.
3462 * @param uPtr Pointer to the memory (ring-3 or ring-0).
3463 */
3464SUPR0DECL(int) SUPR0LowFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
3465{
3466 LogFlow(("SUPR0LowFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
3467 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3468 return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_LOW);
3469}
3470
3471
3472
3473/**
3474 * Allocates a chunk of memory with both R0 and R3 mappings.
3475 * The memory is fixed and it's possible to query the physical addresses using SUPR0MemGetPhys().
3476 *
3477 * @returns IPRT status code.
3478 * @param pSession The session to associated the allocation with.
3479 * @param cb Number of bytes to allocate.
3480 * @param ppvR0 Where to store the address of the Ring-0 mapping.
3481 * @param ppvR3 Where to store the address of the Ring-3 mapping.
3482 */
3483SUPR0DECL(int) SUPR0MemAlloc(PSUPDRVSESSION pSession, uint32_t cb, PRTR0PTR ppvR0, PRTR3PTR ppvR3)
3484{
3485 int rc;
3486 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
3487 LogFlow(("SUPR0MemAlloc: pSession=%p cb=%d ppvR0=%p ppvR3=%p\n", pSession, cb, ppvR0, ppvR3));
3488
3489 /*
3490 * Validate input.
3491 */
3492 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3493 AssertPtrReturn(ppvR0, VERR_INVALID_POINTER);
3494 AssertPtrReturn(ppvR3, VERR_INVALID_POINTER);
3495 if (cb < 1 || cb >= _4M)
3496 {
3497 Log(("Illegal request cb=%u; must be greater than 0 and smaller than 4MB.\n", cb));
3498 return VERR_INVALID_PARAMETER;
3499 }
3500
3501 /*
3502 * Let IPRT do the work.
3503 */
3504 rc = RTR0MemObjAllocPage(&Mem.MemObj, cb, true /* executable ring-0 mapping */);
3505 if (RT_SUCCESS(rc))
3506 {
3507 int rc2;
3508 rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0,
3509 RTMEM_PROT_EXEC | RTMEM_PROT_WRITE | RTMEM_PROT_READ, NIL_RTR0PROCESS);
3510 if (RT_SUCCESS(rc))
3511 {
3512 Mem.eType = MEMREF_TYPE_MEM;
3513 rc = supdrvMemAdd(&Mem, pSession);
3514 if (!rc)
3515 {
3516 *ppvR0 = RTR0MemObjAddress(Mem.MemObj);
3517 *ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
3518 return VINF_SUCCESS;
3519 }
3520
3521 rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
3522 AssertRC(rc2);
3523 }
3524
3525 rc2 = RTR0MemObjFree(Mem.MemObj, false);
3526 AssertRC(rc2);
3527 }
3528
3529 return rc;
3530}
3531
3532
3533/**
3534 * Get the physical addresses of memory allocated using SUPR0MemAlloc().
3535 *
3536 * @returns IPRT status code.
3537 * @param pSession The session to which the memory was allocated.
3538 * @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
3539 * @param paPages Where to store the physical addresses.
3540 */
3541SUPR0DECL(int) SUPR0MemGetPhys(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, PSUPPAGE paPages) /** @todo switch this bugger to RTHCPHYS */
3542{
3543 PSUPDRVBUNDLE pBundle;
3544 LogFlow(("SUPR0MemGetPhys: pSession=%p uPtr=%p paPages=%p\n", pSession, (void *)uPtr, paPages));
3545
3546 /*
3547 * Validate input.
3548 */
3549 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3550 AssertPtrReturn(paPages, VERR_INVALID_POINTER);
3551 AssertReturn(uPtr, VERR_INVALID_PARAMETER);
3552
3553 /*
3554 * Search for the address.
3555 */
3556 RTSpinlockAcquire(pSession->Spinlock);
3557 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3558 {
3559 if (pBundle->cUsed > 0)
3560 {
3561 unsigned i;
3562 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3563 {
3564 if ( pBundle->aMem[i].eType == MEMREF_TYPE_MEM
3565 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3566 && ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
3567 || ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
3568 && RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr)
3569 )
3570 )
3571 {
3572 const size_t cPages = RTR0MemObjSize(pBundle->aMem[i].MemObj) >> PAGE_SHIFT;
3573 size_t iPage;
3574 for (iPage = 0; iPage < cPages; iPage++)
3575 {
3576 paPages[iPage].Phys = RTR0MemObjGetPagePhysAddr(pBundle->aMem[i].MemObj, iPage);
3577 paPages[iPage].uReserved = 0;
3578 }
3579 RTSpinlockRelease(pSession->Spinlock);
3580 return VINF_SUCCESS;
3581 }
3582 }
3583 }
3584 }
3585 RTSpinlockRelease(pSession->Spinlock);
3586 Log(("Failed to find %p!!!\n", (void *)uPtr));
3587 return VERR_INVALID_PARAMETER;
3588}
3589
3590
3591/**
3592 * Free memory allocated by SUPR0MemAlloc().
3593 *
3594 * @returns IPRT status code.
3595 * @param pSession The session owning the allocation.
3596 * @param uPtr The Ring-0 or Ring-3 address returned by SUPR0MemAlloc().
3597 */
3598SUPR0DECL(int) SUPR0MemFree(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr)
3599{
3600 LogFlow(("SUPR0MemFree: pSession=%p uPtr=%p\n", pSession, (void *)uPtr));
3601 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3602 return supdrvMemRelease(pSession, uPtr, MEMREF_TYPE_MEM);
3603}
3604
3605
3606/**
3607 * Allocates a chunk of memory with a kernel or/and a user mode mapping.
3608 *
3609 * The memory is fixed and it's possible to query the physical addresses using
3610 * SUPR0MemGetPhys().
3611 *
3612 * @returns IPRT status code.
3613 * @param pSession The session to associated the allocation with.
3614 * @param cPages The number of pages to allocate.
3615 * @param fFlags Flags, reserved for the future. Must be zero.
3616 * @param ppvR3 Where to store the address of the Ring-3 mapping.
3617 * NULL if no ring-3 mapping.
3618 * @param ppvR0 Where to store the address of the Ring-0 mapping.
3619 * NULL if no ring-0 mapping.
3620 * @param paPages Where to store the addresses of the pages. Optional.
3621 */
3622SUPR0DECL(int) SUPR0PageAllocEx(PSUPDRVSESSION pSession, uint32_t cPages, uint32_t fFlags, PRTR3PTR ppvR3, PRTR0PTR ppvR0, PRTHCPHYS paPages)
3623{
3624 int rc;
3625 SUPDRVMEMREF Mem = { NIL_RTR0MEMOBJ, NIL_RTR0MEMOBJ, MEMREF_TYPE_UNUSED };
3626 LogFlow(("SUPR0PageAlloc: pSession=%p cb=%d ppvR3=%p\n", pSession, cPages, ppvR3));
3627
3628 /*
3629 * Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
3630 */
3631 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3632 AssertPtrNullReturn(ppvR3, VERR_INVALID_POINTER);
3633 AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
3634 AssertReturn(ppvR3 || ppvR0, VERR_INVALID_PARAMETER);
3635 AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
3636 if (cPages < 1 || cPages > VBOX_MAX_ALLOC_PAGE_COUNT)
3637 {
3638 Log(("SUPR0PageAlloc: Illegal request cb=%u; must be greater than 0 and smaller than %uMB (VBOX_MAX_ALLOC_PAGE_COUNT pages).\n", cPages, VBOX_MAX_ALLOC_PAGE_COUNT * (_1M / _4K)));
3639 return VERR_PAGE_COUNT_OUT_OF_RANGE;
3640 }
3641
3642 /*
3643 * Let IPRT do the work.
3644 */
3645 if (ppvR0)
3646 rc = RTR0MemObjAllocPage(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, true /* fExecutable */);
3647 else
3648 rc = RTR0MemObjAllocPhysNC(&Mem.MemObj, (size_t)cPages * PAGE_SIZE, NIL_RTHCPHYS);
3649 if (RT_SUCCESS(rc))
3650 {
3651 int rc2;
3652 if (ppvR3)
3653 rc = RTR0MemObjMapUser(&Mem.MapObjR3, Mem.MemObj, (RTR3PTR)-1, 0, RTMEM_PROT_WRITE | RTMEM_PROT_READ, NIL_RTR0PROCESS);
3654 else
3655 Mem.MapObjR3 = NIL_RTR0MEMOBJ;
3656 if (RT_SUCCESS(rc))
3657 {
3658 Mem.eType = MEMREF_TYPE_PAGE;
3659 rc = supdrvMemAdd(&Mem, pSession);
3660 if (!rc)
3661 {
3662 if (ppvR3)
3663 *ppvR3 = RTR0MemObjAddressR3(Mem.MapObjR3);
3664 if (ppvR0)
3665 *ppvR0 = RTR0MemObjAddress(Mem.MemObj);
3666 if (paPages)
3667 {
3668 uint32_t iPage = cPages;
3669 while (iPage-- > 0)
3670 {
3671 paPages[iPage] = RTR0MemObjGetPagePhysAddr(Mem.MapObjR3, iPage);
3672 Assert(paPages[iPage] != NIL_RTHCPHYS);
3673 }
3674 }
3675 return VINF_SUCCESS;
3676 }
3677
3678 rc2 = RTR0MemObjFree(Mem.MapObjR3, false);
3679 AssertRC(rc2);
3680 }
3681
3682 rc2 = RTR0MemObjFree(Mem.MemObj, false);
3683 AssertRC(rc2);
3684 }
3685 return rc;
3686}
3687
3688
3689/**
3690 * Maps a chunk of memory previously allocated by SUPR0PageAllocEx into kernel
3691 * space.
3692 *
3693 * @returns IPRT status code.
3694 * @param pSession The session to associated the allocation with.
3695 * @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
3696 * @param offSub Where to start mapping. Must be page aligned.
3697 * @param cbSub How much to map. Must be page aligned.
3698 * @param fFlags Flags, MBZ.
3699 * @param ppvR0 Where to return the address of the ring-0 mapping on
3700 * success.
3701 */
3702SUPR0DECL(int) SUPR0PageMapKernel(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t offSub, uint32_t cbSub,
3703 uint32_t fFlags, PRTR0PTR ppvR0)
3704{
3705 int rc;
3706 PSUPDRVBUNDLE pBundle;
3707 RTR0MEMOBJ hMemObj = NIL_RTR0MEMOBJ;
3708 LogFlow(("SUPR0PageMapKernel: pSession=%p pvR3=%p offSub=%#x cbSub=%#x\n", pSession, pvR3, offSub, cbSub));
3709
3710 /*
3711 * Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
3712 */
3713 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3714 AssertPtrNullReturn(ppvR0, VERR_INVALID_POINTER);
3715 AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
3716 AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
3717 AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
3718 AssertReturn(cbSub, VERR_INVALID_PARAMETER);
3719
3720 /*
3721 * Find the memory object.
3722 */
3723 RTSpinlockAcquire(pSession->Spinlock);
3724 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3725 {
3726 if (pBundle->cUsed > 0)
3727 {
3728 unsigned i;
3729 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3730 {
3731 if ( ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
3732 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3733 && pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
3734 && RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3)
3735 || ( pBundle->aMem[i].eType == MEMREF_TYPE_LOCKED
3736 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3737 && pBundle->aMem[i].MapObjR3 == NIL_RTR0MEMOBJ
3738 && RTR0MemObjAddressR3(pBundle->aMem[i].MemObj) == pvR3))
3739 {
3740 hMemObj = pBundle->aMem[i].MemObj;
3741 break;
3742 }
3743 }
3744 }
3745 }
3746 RTSpinlockRelease(pSession->Spinlock);
3747
3748 rc = VERR_INVALID_PARAMETER;
3749 if (hMemObj != NIL_RTR0MEMOBJ)
3750 {
3751 /*
3752 * Do some further input validations before calling IPRT.
3753 * (Cleanup is done indirectly by telling RTR0MemObjFree to include mappings.)
3754 */
3755 size_t cbMemObj = RTR0MemObjSize(hMemObj);
3756 if ( offSub < cbMemObj
3757 && cbSub <= cbMemObj
3758 && offSub + cbSub <= cbMemObj)
3759 {
3760 RTR0MEMOBJ hMapObj;
3761 rc = RTR0MemObjMapKernelEx(&hMapObj, hMemObj, (void *)-1, 0,
3762 RTMEM_PROT_READ | RTMEM_PROT_WRITE, offSub, cbSub);
3763 if (RT_SUCCESS(rc))
3764 *ppvR0 = RTR0MemObjAddress(hMapObj);
3765 }
3766 else
3767 SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
3768
3769 }
3770 return rc;
3771}
3772
3773
3774/**
3775 * Changes the page level protection of one or more pages previously allocated
3776 * by SUPR0PageAllocEx.
3777 *
3778 * @returns IPRT status code.
3779 * @param pSession The session to associated the allocation with.
3780 * @param pvR3 The ring-3 address returned by SUPR0PageAllocEx.
3781 * NIL_RTR3PTR if the ring-3 mapping should be unaffected.
3782 * @param pvR0 The ring-0 address returned by SUPR0PageAllocEx.
3783 * NIL_RTR0PTR if the ring-0 mapping should be unaffected.
3784 * @param offSub Where to start changing. Must be page aligned.
3785 * @param cbSub How much to change. Must be page aligned.
3786 * @param fProt The new page level protection, see RTMEM_PROT_*.
3787 */
3788SUPR0DECL(int) SUPR0PageProtect(PSUPDRVSESSION pSession, RTR3PTR pvR3, RTR0PTR pvR0, uint32_t offSub, uint32_t cbSub, uint32_t fProt)
3789{
3790 int rc;
3791 PSUPDRVBUNDLE pBundle;
3792 RTR0MEMOBJ hMemObjR0 = NIL_RTR0MEMOBJ;
3793 RTR0MEMOBJ hMemObjR3 = NIL_RTR0MEMOBJ;
3794 LogFlow(("SUPR0PageProtect: pSession=%p pvR3=%p pvR0=%p offSub=%#x cbSub=%#x fProt-%#x\n", pSession, pvR3, pvR0, offSub, cbSub, fProt));
3795
3796 /*
3797 * Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
3798 */
3799 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3800 AssertReturn(!(fProt & ~(RTMEM_PROT_READ | RTMEM_PROT_WRITE | RTMEM_PROT_EXEC | RTMEM_PROT_NONE)), VERR_INVALID_PARAMETER);
3801 AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
3802 AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
3803 AssertReturn(cbSub, VERR_INVALID_PARAMETER);
3804
3805 /*
3806 * Find the memory object.
3807 */
3808 RTSpinlockAcquire(pSession->Spinlock);
3809 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
3810 {
3811 if (pBundle->cUsed > 0)
3812 {
3813 unsigned i;
3814 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
3815 {
3816 if ( pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
3817 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
3818 && ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
3819 || pvR3 == NIL_RTR3PTR)
3820 && ( pvR0 == NIL_RTR0PTR
3821 || RTR0MemObjAddress(pBundle->aMem[i].MemObj) == pvR0)
3822 && ( pvR3 == NIL_RTR3PTR
3823 || RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3))
3824 {
3825 if (pvR0 != NIL_RTR0PTR)
3826 hMemObjR0 = pBundle->aMem[i].MemObj;
3827 if (pvR3 != NIL_RTR3PTR)
3828 hMemObjR3 = pBundle->aMem[i].MapObjR3;
3829 break;
3830 }
3831 }
3832 }
3833 }
3834 RTSpinlockRelease(pSession->Spinlock);
3835
3836 rc = VERR_INVALID_PARAMETER;
3837 if ( hMemObjR0 != NIL_RTR0MEMOBJ
3838 || hMemObjR3 != NIL_RTR0MEMOBJ)
3839 {
3840 /*
3841 * Do some further input validations before calling IPRT.
3842 */
3843 size_t cbMemObj = hMemObjR0 != NIL_RTR0PTR ? RTR0MemObjSize(hMemObjR0) : RTR0MemObjSize(hMemObjR3);
3844 if ( offSub < cbMemObj
3845 && cbSub <= cbMemObj
3846 && offSub + cbSub <= cbMemObj)
3847 {
3848 rc = VINF_SUCCESS;
3849 if (hMemObjR3 != NIL_RTR0PTR)
3850 rc = RTR0MemObjProtect(hMemObjR3, offSub, cbSub, fProt);
3851 if (hMemObjR0 != NIL_RTR0PTR && RT_SUCCESS(rc))
3852 rc = RTR0MemObjProtect(hMemObjR0, offSub, cbSub, fProt);
3853 }
3854 else
3855 SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
3856
3857 }
3858 return rc;
3859
3860}
3861
3862
3863/**
3864 * Free memory allocated by SUPR0PageAlloc() and SUPR0PageAllocEx().
3865 *
3866 * @returns IPRT status code.
3867 * @param pSession The session owning the allocation.
3868 * @param pvR3 The Ring-3 address returned by SUPR0PageAlloc() or
3869 * SUPR0PageAllocEx().
3870 */
3871SUPR0DECL(int) SUPR0PageFree(PSUPDRVSESSION pSession, RTR3PTR pvR3)
3872{
3873 LogFlow(("SUPR0PageFree: pSession=%p pvR3=%p\n", pSession, (void *)pvR3));
3874 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
3875 return supdrvMemRelease(pSession, (RTHCUINTPTR)pvR3, MEMREF_TYPE_PAGE);
3876}
3877
3878
3879/**
3880 * Reports a bad context, currenctly that means EFLAGS.AC is 0 instead of 1.
3881 *
3882 * @param pDevExt The device extension.
3883 * @param pszFile The source file where the caller detected the bad
3884 * context.
3885 * @param uLine The line number in @a pszFile.
3886 * @param pszExtra Optional additional message to give further hints.
3887 */
3888void VBOXCALL supdrvBadContext(PSUPDRVDEVEXT pDevExt, const char *pszFile, uint32_t uLine, const char *pszExtra)
3889{
3890 uint32_t cCalls;
3891
3892 /*
3893 * Shorten the filename before displaying the message.
3894 */
3895 for (;;)
3896 {
3897 const char *pszTmp = strchr(pszFile, '/');
3898 if (!pszTmp)
3899 pszTmp = strchr(pszFile, '\\');
3900 if (!pszTmp)
3901 break;
3902 pszFile = pszTmp + 1;
3903 }
3904 if (RT_VALID_PTR(pszExtra) && *pszExtra)
3905 SUPR0Printf("vboxdrv: Bad CPU context error at line %u in %s: %s\n", uLine, pszFile, pszExtra);
3906 else
3907 SUPR0Printf("vboxdrv: Bad CPU context error at line %u in %s!\n", uLine, pszFile);
3908
3909 /*
3910 * Record the incident so that we stand a chance of blocking I/O controls
3911 * before panicing the system.
3912 */
3913 cCalls = ASMAtomicIncU32(&pDevExt->cBadContextCalls);
3914 if (cCalls > UINT32_MAX - _1K)
3915 ASMAtomicWriteU32(&pDevExt->cBadContextCalls, UINT32_MAX - _1K);
3916}
3917
3918
3919/**
3920 * Reports a bad context, currenctly that means EFLAGS.AC is 0 instead of 1.
3921 *
3922 * @param pSession The session of the caller.
3923 * @param pszFile The source file where the caller detected the bad
3924 * context.
3925 * @param uLine The line number in @a pszFile.
3926 * @param pszExtra Optional additional message to give further hints.
3927 */
3928SUPR0DECL(void) SUPR0BadContext(PSUPDRVSESSION pSession, const char *pszFile, uint32_t uLine, const char *pszExtra)
3929{
3930 PSUPDRVDEVEXT pDevExt;
3931
3932 AssertReturnVoid(SUP_IS_SESSION_VALID(pSession));
3933 pDevExt = pSession->pDevExt;
3934
3935 supdrvBadContext(pDevExt, pszFile, uLine, pszExtra);
3936}
3937
3938
3939/**
3940 * Gets the paging mode of the current CPU.
3941 *
3942 * @returns Paging mode, SUPPAGEINGMODE_INVALID on error.
3943 */
3944SUPR0DECL(SUPPAGINGMODE) SUPR0GetPagingMode(void)
3945{
3946 SUPPAGINGMODE enmMode;
3947
3948 RTR0UINTREG cr0 = ASMGetCR0();
3949 if ((cr0 & (X86_CR0_PG | X86_CR0_PE)) != (X86_CR0_PG | X86_CR0_PE))
3950 enmMode = SUPPAGINGMODE_INVALID;
3951 else
3952 {
3953 RTR0UINTREG cr4 = ASMGetCR4();
3954 uint32_t fNXEPlusLMA = 0;
3955 if (cr4 & X86_CR4_PAE)
3956 {
3957 uint32_t fExtFeatures = ASMCpuId_EDX(0x80000001);
3958 if (fExtFeatures & (X86_CPUID_EXT_FEATURE_EDX_NX | X86_CPUID_EXT_FEATURE_EDX_LONG_MODE))
3959 {
3960 uint64_t efer = ASMRdMsr(MSR_K6_EFER);
3961 if ((fExtFeatures & X86_CPUID_EXT_FEATURE_EDX_NX) && (efer & MSR_K6_EFER_NXE))
3962 fNXEPlusLMA |= RT_BIT(0);
3963 if ((fExtFeatures & X86_CPUID_EXT_FEATURE_EDX_LONG_MODE) && (efer & MSR_K6_EFER_LMA))
3964 fNXEPlusLMA |= RT_BIT(1);
3965 }
3966 }
3967
3968 switch ((cr4 & (X86_CR4_PAE | X86_CR4_PGE)) | fNXEPlusLMA)
3969 {
3970 case 0:
3971 enmMode = SUPPAGINGMODE_32_BIT;
3972 break;
3973
3974 case X86_CR4_PGE:
3975 enmMode = SUPPAGINGMODE_32_BIT_GLOBAL;
3976 break;
3977
3978 case X86_CR4_PAE:
3979 enmMode = SUPPAGINGMODE_PAE;
3980 break;
3981
3982 case X86_CR4_PAE | RT_BIT(0):
3983 enmMode = SUPPAGINGMODE_PAE_NX;
3984 break;
3985
3986 case X86_CR4_PAE | X86_CR4_PGE:
3987 enmMode = SUPPAGINGMODE_PAE_GLOBAL;
3988 break;
3989
3990 case X86_CR4_PAE | X86_CR4_PGE | RT_BIT(0):
3991 enmMode = SUPPAGINGMODE_PAE_GLOBAL;
3992 break;
3993
3994 case RT_BIT(1) | X86_CR4_PAE:
3995 enmMode = SUPPAGINGMODE_AMD64;
3996 break;
3997
3998 case RT_BIT(1) | X86_CR4_PAE | RT_BIT(0):
3999 enmMode = SUPPAGINGMODE_AMD64_NX;
4000 break;
4001
4002 case RT_BIT(1) | X86_CR4_PAE | X86_CR4_PGE:
4003 enmMode = SUPPAGINGMODE_AMD64_GLOBAL;
4004 break;
4005
4006 case RT_BIT(1) | X86_CR4_PAE | X86_CR4_PGE | RT_BIT(0):
4007 enmMode = SUPPAGINGMODE_AMD64_GLOBAL_NX;
4008 break;
4009
4010 default:
4011 AssertMsgFailed(("Cannot happen! cr4=%#x fNXEPlusLMA=%d\n", cr4, fNXEPlusLMA));
4012 enmMode = SUPPAGINGMODE_INVALID;
4013 break;
4014 }
4015 }
4016 return enmMode;
4017}
4018
4019
4020/**
4021 * Change CR4 and take care of the kernel CR4 shadow if applicable.
4022 *
4023 * CR4 shadow handling is required for Linux >= 4.0. Calling this function
4024 * instead of ASMSetCR4() is only necessary for semi-permanent CR4 changes
4025 * for code with interrupts enabled.
4026 *
4027 * @returns the old CR4 value.
4028 *
4029 * @param fOrMask bits to be set in CR4.
4030 * @param fAndMask bits to be cleard in CR4.
4031 *
4032 * @remarks Must be called with preemption/interrupts disabled.
4033 */
4034SUPR0DECL(RTCCUINTREG) SUPR0ChangeCR4(RTCCUINTREG fOrMask, RTCCUINTREG fAndMask)
4035{
4036#ifdef RT_OS_LINUX
4037 return supdrvOSChangeCR4(fOrMask, fAndMask);
4038#else
4039 RTCCUINTREG uOld = ASMGetCR4();
4040 RTCCUINTREG uNew = (uOld & fAndMask) | fOrMask;
4041 if (uNew != uOld)
4042 ASMSetCR4(uNew);
4043 return uOld;
4044#endif
4045}
4046
4047
4048/**
4049 * Enables or disabled hardware virtualization extensions using native OS APIs.
4050 *
4051 * @returns VBox status code.
4052 * @retval VINF_SUCCESS on success.
4053 * @retval VERR_NOT_SUPPORTED if not supported by the native OS.
4054 *
4055 * @param fEnable Whether to enable or disable.
4056 */
4057SUPR0DECL(int) SUPR0EnableVTx(bool fEnable)
4058{
4059#ifdef RT_OS_DARWIN
4060 return supdrvOSEnableVTx(fEnable);
4061#else
4062 RT_NOREF1(fEnable);
4063 return VERR_NOT_SUPPORTED;
4064#endif
4065}
4066
4067
4068/**
4069 * Suspends hardware virtualization extensions using the native OS API.
4070 *
4071 * This is called prior to entering raw-mode context.
4072 *
4073 * @returns @c true if suspended, @c false if not.
4074 */
4075SUPR0DECL(bool) SUPR0SuspendVTxOnCpu(void)
4076{
4077#ifdef RT_OS_DARWIN
4078 return supdrvOSSuspendVTxOnCpu();
4079#else
4080 return false;
4081#endif
4082}
4083
4084
4085/**
4086 * Resumes hardware virtualization extensions using the native OS API.
4087 *
4088 * This is called after to entering raw-mode context.
4089 *
4090 * @param fSuspended The return value of SUPR0SuspendVTxOnCpu.
4091 */
4092SUPR0DECL(void) SUPR0ResumeVTxOnCpu(bool fSuspended)
4093{
4094#ifdef RT_OS_DARWIN
4095 supdrvOSResumeVTxOnCpu(fSuspended);
4096#else
4097 RT_NOREF1(fSuspended);
4098 Assert(!fSuspended);
4099#endif
4100}
4101
4102
4103SUPR0DECL(int) SUPR0GetCurrentGdtRw(RTHCUINTPTR *pGdtRw)
4104{
4105#ifdef RT_OS_LINUX
4106 return supdrvOSGetCurrentGdtRw(pGdtRw);
4107#else
4108 NOREF(pGdtRw);
4109 return VERR_NOT_IMPLEMENTED;
4110#endif
4111}
4112
4113
4114/**
4115 * Gets AMD-V and VT-x support for the calling CPU.
4116 *
4117 * @returns VBox status code.
4118 * @param pfCaps Where to store whether VT-x (SUPVTCAPS_VT_X) or AMD-V
4119 * (SUPVTCAPS_AMD_V) is supported.
4120 */
4121SUPR0DECL(int) SUPR0GetVTSupport(uint32_t *pfCaps)
4122{
4123 Assert(pfCaps);
4124 *pfCaps = 0;
4125
4126 /* Check if the CPU even supports CPUID (extremely ancient CPUs). */
4127 if (ASMHasCpuId())
4128 {
4129 /* Check the range of standard CPUID leafs. */
4130 uint32_t uMaxLeaf, uVendorEbx, uVendorEcx, uVendorEdx;
4131 ASMCpuId(0, &uMaxLeaf, &uVendorEbx, &uVendorEcx, &uVendorEdx);
4132 if (ASMIsValidStdRange(uMaxLeaf))
4133 {
4134 /* Query the standard CPUID leaf. */
4135 uint32_t fFeatEcx, fFeatEdx, uDummy;
4136 ASMCpuId(1, &uDummy, &uDummy, &fFeatEcx, &fFeatEdx);
4137
4138 /* Check if the vendor is Intel (or compatible). */
4139 if ( ASMIsIntelCpuEx(uVendorEbx, uVendorEcx, uVendorEdx)
4140 || ASMIsViaCentaurCpuEx(uVendorEbx, uVendorEcx, uVendorEdx)
4141 || ASMIsShanghaiCpuEx(uVendorEbx, uVendorEcx, uVendorEdx))
4142 {
4143 /* Check VT-x support. In addition, VirtualBox requires MSR and FXSAVE/FXRSTOR to function. */
4144 if ( (fFeatEcx & X86_CPUID_FEATURE_ECX_VMX)
4145 && (fFeatEdx & X86_CPUID_FEATURE_EDX_MSR)
4146 && (fFeatEdx & X86_CPUID_FEATURE_EDX_FXSR))
4147 {
4148 *pfCaps = SUPVTCAPS_VT_X;
4149 return VINF_SUCCESS;
4150 }
4151 return VERR_VMX_NO_VMX;
4152 }
4153
4154 /* Check if the vendor is AMD (or compatible). */
4155 if ( ASMIsAmdCpuEx(uVendorEbx, uVendorEcx, uVendorEdx)
4156 || ASMIsHygonCpuEx(uVendorEbx, uVendorEcx, uVendorEdx))
4157 {
4158 uint32_t fExtFeatEcx, uExtMaxId;
4159 ASMCpuId(0x80000000, &uExtMaxId, &uDummy, &uDummy, &uDummy);
4160 ASMCpuId(0x80000001, &uDummy, &uDummy, &fExtFeatEcx, &uDummy);
4161
4162 /* Check AMD-V support. In addition, VirtualBox requires MSR and FXSAVE/FXRSTOR to function. */
4163 if ( ASMIsValidExtRange(uExtMaxId)
4164 && uExtMaxId >= 0x8000000a
4165 && (fExtFeatEcx & X86_CPUID_AMD_FEATURE_ECX_SVM)
4166 && (fFeatEdx & X86_CPUID_FEATURE_EDX_MSR)
4167 && (fFeatEdx & X86_CPUID_FEATURE_EDX_FXSR))
4168 {
4169 *pfCaps = SUPVTCAPS_AMD_V;
4170 return VINF_SUCCESS;
4171 }
4172 return VERR_SVM_NO_SVM;
4173 }
4174 }
4175 }
4176 return VERR_UNSUPPORTED_CPU;
4177}
4178
4179
4180/**
4181 * Checks if Intel VT-x feature is usable on this CPU.
4182 *
4183 * @returns VBox status code.
4184 * @param pfIsSmxModeAmbiguous Where to return whether the SMX mode causes
4185 * ambiguity that makes us unsure whether we
4186 * really can use VT-x or not.
4187 *
4188 * @remarks Must be called with preemption disabled.
4189 * The caller is also expected to check that the CPU is an Intel (or
4190 * VIA/Shanghai) CPU -and- that it supports VT-x. Otherwise, this
4191 * function might throw a \#GP fault as it tries to read/write MSRs
4192 * that may not be present!
4193 */
4194SUPR0DECL(int) SUPR0GetVmxUsability(bool *pfIsSmxModeAmbiguous)
4195{
4196 uint64_t fFeatMsr;
4197 bool fMaybeSmxMode;
4198 bool fMsrLocked;
4199 bool fSmxVmxAllowed;
4200 bool fVmxAllowed;
4201 bool fIsSmxModeAmbiguous;
4202 int rc;
4203
4204 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
4205
4206 fFeatMsr = ASMRdMsr(MSR_IA32_FEATURE_CONTROL);
4207 fMaybeSmxMode = RT_BOOL(ASMGetCR4() & X86_CR4_SMXE);
4208 fMsrLocked = RT_BOOL(fFeatMsr & MSR_IA32_FEATURE_CONTROL_LOCK);
4209 fSmxVmxAllowed = RT_BOOL(fFeatMsr & MSR_IA32_FEATURE_CONTROL_SMX_VMXON);
4210 fVmxAllowed = RT_BOOL(fFeatMsr & MSR_IA32_FEATURE_CONTROL_VMXON);
4211 fIsSmxModeAmbiguous = false;
4212 rc = VERR_INTERNAL_ERROR_5;
4213
4214 /* Check if the LOCK bit is set but excludes the required VMXON bit. */
4215 if (fMsrLocked)
4216 {
4217 if (fVmxAllowed && fSmxVmxAllowed)
4218 rc = VINF_SUCCESS;
4219 else if (!fVmxAllowed && !fSmxVmxAllowed)
4220 rc = VERR_VMX_MSR_ALL_VMX_DISABLED;
4221 else if (!fMaybeSmxMode)
4222 {
4223 if (fVmxAllowed)
4224 rc = VINF_SUCCESS;
4225 else
4226 rc = VERR_VMX_MSR_VMX_DISABLED;
4227 }
4228 else
4229 {
4230 /*
4231 * CR4.SMXE is set but this doesn't mean the CPU is necessarily in SMX mode. We shall assume
4232 * that it is -not- and that it is a stupid BIOS/OS setting CR4.SMXE for no good reason.
4233 * See @bugref{6873}.
4234 */
4235 Assert(fMaybeSmxMode == true);
4236 fIsSmxModeAmbiguous = true;
4237 rc = VINF_SUCCESS;
4238 }
4239 }
4240 else
4241 {
4242 /*
4243 * MSR is not yet locked; we can change it ourselves here. Once the lock bit is set,
4244 * this MSR can no longer be modified.
4245 *
4246 * Set both the VMX and SMX_VMX bits (if supported) as we can't determine SMX mode
4247 * accurately. See @bugref{6873}.
4248 *
4249 * We need to check for SMX hardware support here, before writing the MSR as
4250 * otherwise we will #GP fault on CPUs that do not support it. Callers do not check
4251 * for it.
4252 */
4253 uint32_t fFeaturesECX, uDummy;
4254#ifdef VBOX_STRICT
4255 /* Callers should have verified these at some point. */
4256 uint32_t uMaxId, uVendorEBX, uVendorECX, uVendorEDX;
4257 ASMCpuId(0, &uMaxId, &uVendorEBX, &uVendorECX, &uVendorEDX);
4258 Assert(ASMIsValidStdRange(uMaxId));
4259 Assert( ASMIsIntelCpuEx( uVendorEBX, uVendorECX, uVendorEDX)
4260 || ASMIsViaCentaurCpuEx(uVendorEBX, uVendorECX, uVendorEDX)
4261 || ASMIsShanghaiCpuEx( uVendorEBX, uVendorECX, uVendorEDX));
4262#endif
4263 ASMCpuId(1, &uDummy, &uDummy, &fFeaturesECX, &uDummy);
4264 bool fSmxVmxHwSupport = false;
4265 if ( (fFeaturesECX & X86_CPUID_FEATURE_ECX_VMX)
4266 && (fFeaturesECX & X86_CPUID_FEATURE_ECX_SMX))
4267 fSmxVmxHwSupport = true;
4268
4269 fFeatMsr |= MSR_IA32_FEATURE_CONTROL_LOCK
4270 | MSR_IA32_FEATURE_CONTROL_VMXON;
4271 if (fSmxVmxHwSupport)
4272 fFeatMsr |= MSR_IA32_FEATURE_CONTROL_SMX_VMXON;
4273
4274 /*
4275 * Commit.
4276 */
4277 ASMWrMsr(MSR_IA32_FEATURE_CONTROL, fFeatMsr);
4278
4279 /*
4280 * Verify.
4281 */
4282 fFeatMsr = ASMRdMsr(MSR_IA32_FEATURE_CONTROL);
4283 fMsrLocked = RT_BOOL(fFeatMsr & MSR_IA32_FEATURE_CONTROL_LOCK);
4284 if (fMsrLocked)
4285 {
4286 fSmxVmxAllowed = RT_BOOL(fFeatMsr & MSR_IA32_FEATURE_CONTROL_SMX_VMXON);
4287 fVmxAllowed = RT_BOOL(fFeatMsr & MSR_IA32_FEATURE_CONTROL_VMXON);
4288 if ( fVmxAllowed
4289 && ( !fSmxVmxHwSupport
4290 || fSmxVmxAllowed))
4291 rc = VINF_SUCCESS;
4292 else
4293 rc = !fSmxVmxHwSupport ? VERR_VMX_MSR_VMX_ENABLE_FAILED : VERR_VMX_MSR_SMX_VMX_ENABLE_FAILED;
4294 }
4295 else
4296 rc = VERR_VMX_MSR_LOCKING_FAILED;
4297 }
4298
4299 if (pfIsSmxModeAmbiguous)
4300 *pfIsSmxModeAmbiguous = fIsSmxModeAmbiguous;
4301
4302 return rc;
4303}
4304
4305
4306/**
4307 * Checks if AMD-V SVM feature is usable on this CPU.
4308 *
4309 * @returns VBox status code.
4310 * @param fInitSvm If usable, try to initialize SVM on this CPU.
4311 *
4312 * @remarks Must be called with preemption disabled.
4313 */
4314SUPR0DECL(int) SUPR0GetSvmUsability(bool fInitSvm)
4315{
4316 int rc;
4317 uint64_t fVmCr;
4318 uint64_t fEfer;
4319
4320 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
4321 fVmCr = ASMRdMsr(MSR_K8_VM_CR);
4322 if (!(fVmCr & MSR_K8_VM_CR_SVM_DISABLE))
4323 {
4324 rc = VINF_SUCCESS;
4325 if (fInitSvm)
4326 {
4327 /* Turn on SVM in the EFER MSR. */
4328 fEfer = ASMRdMsr(MSR_K6_EFER);
4329 if (fEfer & MSR_K6_EFER_SVME)
4330 rc = VERR_SVM_IN_USE;
4331 else
4332 {
4333 ASMWrMsr(MSR_K6_EFER, fEfer | MSR_K6_EFER_SVME);
4334
4335 /* Paranoia. */
4336 fEfer = ASMRdMsr(MSR_K6_EFER);
4337 if (fEfer & MSR_K6_EFER_SVME)
4338 {
4339 /* Restore previous value. */
4340 ASMWrMsr(MSR_K6_EFER, fEfer & ~MSR_K6_EFER_SVME);
4341 }
4342 else
4343 rc = VERR_SVM_ILLEGAL_EFER_MSR;
4344 }
4345 }
4346 }
4347 else
4348 rc = VERR_SVM_DISABLED;
4349 return rc;
4350}
4351
4352
4353/**
4354 * Queries the AMD-V and VT-x capabilities of the calling CPU.
4355 *
4356 * @returns VBox status code.
4357 * @retval VERR_VMX_NO_VMX
4358 * @retval VERR_VMX_MSR_ALL_VMX_DISABLED
4359 * @retval VERR_VMX_MSR_VMX_DISABLED
4360 * @retval VERR_VMX_MSR_LOCKING_FAILED
4361 * @retval VERR_VMX_MSR_VMX_ENABLE_FAILED
4362 * @retval VERR_VMX_MSR_SMX_VMX_ENABLE_FAILED
4363 * @retval VERR_SVM_NO_SVM
4364 * @retval VERR_SVM_DISABLED
4365 * @retval VERR_UNSUPPORTED_CPU if not identifiable as an AMD, Intel or VIA
4366 * (centaur)/Shanghai CPU.
4367 *
4368 * @param pfCaps Where to store the capabilities.
4369 */
4370int VBOXCALL supdrvQueryVTCapsInternal(uint32_t *pfCaps)
4371{
4372 int rc = VERR_UNSUPPORTED_CPU;
4373 bool fIsSmxModeAmbiguous = false;
4374 RTTHREADPREEMPTSTATE PreemptState = RTTHREADPREEMPTSTATE_INITIALIZER;
4375
4376 /*
4377 * Input validation.
4378 */
4379 AssertPtrReturn(pfCaps, VERR_INVALID_POINTER);
4380 *pfCaps = 0;
4381
4382 /* We may modify MSRs and re-read them, disable preemption so we make sure we don't migrate CPUs. */
4383 RTThreadPreemptDisable(&PreemptState);
4384
4385 /* Check if VT-x/AMD-V is supported. */
4386 rc = SUPR0GetVTSupport(pfCaps);
4387 if (RT_SUCCESS(rc))
4388 {
4389 /* Check if VT-x is supported. */
4390 if (*pfCaps & SUPVTCAPS_VT_X)
4391 {
4392 /* Check if VT-x is usable. */
4393 rc = SUPR0GetVmxUsability(&fIsSmxModeAmbiguous);
4394 if (RT_SUCCESS(rc))
4395 {
4396 /* Query some basic VT-x capabilities (mainly required by our GUI). */
4397 VMXCTLSMSR vtCaps;
4398 vtCaps.u = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS);
4399 if (vtCaps.n.allowed1 & VMX_PROC_CTLS_USE_SECONDARY_CTLS)
4400 {
4401 vtCaps.u = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS2);
4402 if (vtCaps.n.allowed1 & VMX_PROC_CTLS2_EPT)
4403 *pfCaps |= SUPVTCAPS_NESTED_PAGING;
4404 if (vtCaps.n.allowed1 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST)
4405 *pfCaps |= SUPVTCAPS_VTX_UNRESTRICTED_GUEST;
4406 if (vtCaps.n.allowed1 & VMX_PROC_CTLS2_VMCS_SHADOWING)
4407 *pfCaps |= SUPVTCAPS_VTX_VMCS_SHADOWING;
4408 }
4409 }
4410 }
4411 /* Check if AMD-V is supported. */
4412 else if (*pfCaps & SUPVTCAPS_AMD_V)
4413 {
4414 /* Check is SVM is usable. */
4415 rc = SUPR0GetSvmUsability(false /* fInitSvm */);
4416 if (RT_SUCCESS(rc))
4417 {
4418 /* Query some basic AMD-V capabilities (mainly required by our GUI). */
4419 uint32_t uDummy, fSvmFeatures;
4420 ASMCpuId(0x8000000a, &uDummy, &uDummy, &uDummy, &fSvmFeatures);
4421 if (fSvmFeatures & X86_CPUID_SVM_FEATURE_EDX_NESTED_PAGING)
4422 *pfCaps |= SUPVTCAPS_NESTED_PAGING;
4423 }
4424 }
4425 }
4426
4427 /* Restore preemption. */
4428 RTThreadPreemptRestore(&PreemptState);
4429
4430 /* After restoring preemption, if we may be in SMX mode, print a warning as it's difficult to debug such problems. */
4431 if (fIsSmxModeAmbiguous)
4432 SUPR0Printf(("WARNING! CR4 hints SMX mode but your CPU is too secretive. Proceeding anyway... We wish you good luck!\n"));
4433
4434 return rc;
4435}
4436
4437
4438/**
4439 * Queries the AMD-V and VT-x capabilities of the calling CPU.
4440 *
4441 * @returns VBox status code.
4442 * @retval VERR_VMX_NO_VMX
4443 * @retval VERR_VMX_MSR_ALL_VMX_DISABLED
4444 * @retval VERR_VMX_MSR_VMX_DISABLED
4445 * @retval VERR_VMX_MSR_LOCKING_FAILED
4446 * @retval VERR_VMX_MSR_VMX_ENABLE_FAILED
4447 * @retval VERR_VMX_MSR_SMX_VMX_ENABLE_FAILED
4448 * @retval VERR_SVM_NO_SVM
4449 * @retval VERR_SVM_DISABLED
4450 * @retval VERR_UNSUPPORTED_CPU if not identifiable as an AMD, Intel or VIA
4451 * (centaur)/Shanghai CPU.
4452 *
4453 * @param pSession The session handle.
4454 * @param pfCaps Where to store the capabilities.
4455 */
4456SUPR0DECL(int) SUPR0QueryVTCaps(PSUPDRVSESSION pSession, uint32_t *pfCaps)
4457{
4458 /*
4459 * Input validation.
4460 */
4461 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
4462 AssertPtrReturn(pfCaps, VERR_INVALID_POINTER);
4463
4464 /*
4465 * Call common worker.
4466 */
4467 return supdrvQueryVTCapsInternal(pfCaps);
4468}
4469
4470
4471/**
4472 * Queries the CPU microcode revision.
4473 *
4474 * @returns VBox status code.
4475 * @retval VERR_UNSUPPORTED_CPU if not identifiable as a processor with
4476 * readable microcode rev.
4477 *
4478 * @param puRevision Where to store the microcode revision.
4479 */
4480static int VBOXCALL supdrvQueryUcodeRev(uint32_t *puRevision)
4481{
4482 int rc = VERR_UNSUPPORTED_CPU;
4483 RTTHREADPREEMPTSTATE PreemptState = RTTHREADPREEMPTSTATE_INITIALIZER;
4484
4485 /*
4486 * Input validation.
4487 */
4488 AssertPtrReturn(puRevision, VERR_INVALID_POINTER);
4489
4490 *puRevision = 0;
4491
4492 /* Disable preemption so we make sure we don't migrate CPUs, just in case. */
4493 /* NB: We assume that there aren't mismatched microcode revs in the system. */
4494 RTThreadPreemptDisable(&PreemptState);
4495
4496 if (ASMHasCpuId())
4497 {
4498 uint32_t uDummy, uTFMSEAX;
4499 uint32_t uMaxId, uVendorEBX, uVendorECX, uVendorEDX;
4500
4501 ASMCpuId(0, &uMaxId, &uVendorEBX, &uVendorECX, &uVendorEDX);
4502 ASMCpuId(1, &uTFMSEAX, &uDummy, &uDummy, &uDummy);
4503
4504 if (ASMIsValidStdRange(uMaxId))
4505 {
4506 uint64_t uRevMsr;
4507 if (ASMIsIntelCpuEx(uVendorEBX, uVendorECX, uVendorEDX))
4508 {
4509 /* Architectural MSR available on Pentium Pro and later. */
4510 if (ASMGetCpuFamily(uTFMSEAX) >= 6)
4511 {
4512 /* Revision is in the high dword. */
4513 uRevMsr = ASMRdMsr(MSR_IA32_BIOS_SIGN_ID);
4514 *puRevision = RT_HIDWORD(uRevMsr);
4515 rc = VINF_SUCCESS;
4516 }
4517 }
4518 else if ( ASMIsAmdCpuEx(uVendorEBX, uVendorECX, uVendorEDX)
4519 || ASMIsHygonCpuEx(uVendorEBX, uVendorECX, uVendorEDX))
4520 {
4521 /* Not well documented, but at least all AMD64 CPUs support this. */
4522 if (ASMGetCpuFamily(uTFMSEAX) >= 15)
4523 {
4524 /* Revision is in the low dword. */
4525 uRevMsr = ASMRdMsr(MSR_IA32_BIOS_SIGN_ID); /* Same MSR as Intel. */
4526 *puRevision = RT_LODWORD(uRevMsr);
4527 rc = VINF_SUCCESS;
4528 }
4529 }
4530 }
4531 }
4532
4533 RTThreadPreemptRestore(&PreemptState);
4534
4535 return rc;
4536}
4537
4538/**
4539 * Queries the CPU microcode revision.
4540 *
4541 * @returns VBox status code.
4542 * @retval VERR_UNSUPPORTED_CPU if not identifiable as a processor with
4543 * readable microcode rev.
4544 *
4545 * @param pSession The session handle.
4546 * @param puRevision Where to store the microcode revision.
4547 */
4548SUPR0DECL(int) SUPR0QueryUcodeRev(PSUPDRVSESSION pSession, uint32_t *puRevision)
4549{
4550 /*
4551 * Input validation.
4552 */
4553 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
4554 AssertPtrReturn(puRevision, VERR_INVALID_POINTER);
4555
4556 /*
4557 * Call common worker.
4558 */
4559 return supdrvQueryUcodeRev(puRevision);
4560}
4561
4562
4563/**
4564 * Gets hardware-virtualization MSRs of the calling CPU.
4565 *
4566 * @returns VBox status code.
4567 * @param pMsrs Where to store the hardware-virtualization MSRs.
4568 * @param fCaps Hardware virtualization capabilities (SUPVTCAPS_XXX). Pass 0
4569 * to explicitly check for the presence of VT-x/AMD-V before
4570 * querying MSRs.
4571 * @param fForce Force querying of MSRs from the hardware.
4572 */
4573SUPR0DECL(int) SUPR0GetHwvirtMsrs(PSUPHWVIRTMSRS pMsrs, uint32_t fCaps, bool fForce)
4574{
4575 NOREF(fForce);
4576
4577 int rc;
4578 RTTHREADPREEMPTSTATE PreemptState = RTTHREADPREEMPTSTATE_INITIALIZER;
4579
4580 /*
4581 * Input validation.
4582 */
4583 AssertPtrReturn(pMsrs, VERR_INVALID_POINTER);
4584
4585 /*
4586 * Disable preemption so we make sure we don't migrate CPUs and because
4587 * we access global data.
4588 */
4589 RTThreadPreemptDisable(&PreemptState);
4590
4591 /*
4592 * Query the MSRs from the hardware.
4593 */
4594 /** @todo Cache MSR values so future accesses can avoid querying the hardware as
4595 * it may be expensive (esp. in nested virtualization scenarios). Do this
4596 * with proper locking and race safety. */
4597 SUPHWVIRTMSRS Msrs;
4598 RT_ZERO(Msrs);
4599
4600 /* If the caller claims VT-x/AMD-V is supported, don't need to recheck it. */
4601 if (!(fCaps & (SUPVTCAPS_VT_X | SUPVTCAPS_AMD_V)))
4602 rc = SUPR0GetVTSupport(&fCaps);
4603 else
4604 rc = VINF_SUCCESS;
4605 if (RT_SUCCESS(rc))
4606 {
4607 if (fCaps & SUPVTCAPS_VT_X)
4608 {
4609 Msrs.u.vmx.u64FeatCtrl = ASMRdMsr(MSR_IA32_FEATURE_CONTROL);
4610 Msrs.u.vmx.u64Basic = ASMRdMsr(MSR_IA32_VMX_BASIC);
4611 Msrs.u.vmx.u64PinCtls = ASMRdMsr(MSR_IA32_VMX_PINBASED_CTLS);
4612 Msrs.u.vmx.u64ProcCtls = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS);
4613 Msrs.u.vmx.u64ExitCtls = ASMRdMsr(MSR_IA32_VMX_EXIT_CTLS);
4614 Msrs.u.vmx.u64EntryCtls = ASMRdMsr(MSR_IA32_VMX_ENTRY_CTLS);
4615 Msrs.u.vmx.u64Misc = ASMRdMsr(MSR_IA32_VMX_MISC);
4616 Msrs.u.vmx.u64Cr0Fixed0 = ASMRdMsr(MSR_IA32_VMX_CR0_FIXED0);
4617 Msrs.u.vmx.u64Cr0Fixed1 = ASMRdMsr(MSR_IA32_VMX_CR0_FIXED1);
4618 Msrs.u.vmx.u64Cr4Fixed0 = ASMRdMsr(MSR_IA32_VMX_CR4_FIXED0);
4619 Msrs.u.vmx.u64Cr4Fixed1 = ASMRdMsr(MSR_IA32_VMX_CR4_FIXED1);
4620 Msrs.u.vmx.u64VmcsEnum = ASMRdMsr(MSR_IA32_VMX_VMCS_ENUM);
4621
4622 if (RT_BF_GET(Msrs.u.vmx.u64Basic, VMX_BF_BASIC_TRUE_CTLS))
4623 {
4624 Msrs.u.vmx.u64TruePinCtls = ASMRdMsr(MSR_IA32_VMX_TRUE_PINBASED_CTLS);
4625 Msrs.u.vmx.u64TrueProcCtls = ASMRdMsr(MSR_IA32_VMX_TRUE_PROCBASED_CTLS);
4626 Msrs.u.vmx.u64TrueEntryCtls = ASMRdMsr(MSR_IA32_VMX_TRUE_ENTRY_CTLS);
4627 Msrs.u.vmx.u64TrueExitCtls = ASMRdMsr(MSR_IA32_VMX_TRUE_EXIT_CTLS);
4628 }
4629
4630 uint32_t const fProcCtlsAllowed1 = RT_HI_U32(Msrs.u.vmx.u64ProcCtls);
4631 if (fProcCtlsAllowed1 & VMX_PROC_CTLS_USE_SECONDARY_CTLS)
4632 {
4633 Msrs.u.vmx.u64ProcCtls2 = ASMRdMsr(MSR_IA32_VMX_PROCBASED_CTLS2);
4634
4635 uint32_t const fProcCtls2Allowed1 = RT_HI_U32(Msrs.u.vmx.u64ProcCtls2);
4636 if (fProcCtls2Allowed1 & (VMX_PROC_CTLS2_EPT | VMX_PROC_CTLS2_VPID))
4637 Msrs.u.vmx.u64EptVpidCaps = ASMRdMsr(MSR_IA32_VMX_EPT_VPID_CAP);
4638
4639 if (fProcCtls2Allowed1 & VMX_PROC_CTLS2_VMFUNC)
4640 Msrs.u.vmx.u64VmFunc = ASMRdMsr(MSR_IA32_VMX_VMFUNC);
4641 }
4642 }
4643 else if (fCaps & SUPVTCAPS_AMD_V)
4644 Msrs.u.svm.u64MsrHwcr = ASMRdMsr(MSR_K8_HWCR);
4645 else
4646 {
4647 RTThreadPreemptRestore(&PreemptState);
4648 AssertMsgFailedReturn(("SUPR0GetVTSupport returns success but neither VT-x nor AMD-V reported!\n"),
4649 VERR_INTERNAL_ERROR_2);
4650 }
4651
4652 /*
4653 * Copy the MSRs out.
4654 */
4655 memcpy(pMsrs, &Msrs, sizeof(*pMsrs));
4656 }
4657
4658 RTThreadPreemptRestore(&PreemptState);
4659
4660 return rc;
4661}
4662
4663
4664/**
4665 * Register a component factory with the support driver.
4666 *
4667 * This is currently restricted to kernel sessions only.
4668 *
4669 * @returns VBox status code.
4670 * @retval VINF_SUCCESS on success.
4671 * @retval VERR_NO_MEMORY if we're out of memory.
4672 * @retval VERR_ALREADY_EXISTS if the factory has already been registered.
4673 * @retval VERR_ACCESS_DENIED if it isn't a kernel session.
4674 * @retval VERR_INVALID_PARAMETER on invalid parameter.
4675 * @retval VERR_INVALID_POINTER on invalid pointer parameter.
4676 *
4677 * @param pSession The SUPDRV session (must be a ring-0 session).
4678 * @param pFactory Pointer to the component factory registration structure.
4679 *
4680 * @remarks This interface is also available via SUPR0IdcComponentRegisterFactory.
4681 */
4682SUPR0DECL(int) SUPR0ComponentRegisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
4683{
4684 PSUPDRVFACTORYREG pNewReg;
4685 const char *psz;
4686 int rc;
4687
4688 /*
4689 * Validate parameters.
4690 */
4691 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
4692 AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
4693 AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
4694 AssertPtrReturn(pFactory->pfnQueryFactoryInterface, VERR_INVALID_POINTER);
4695 psz = RTStrEnd(pFactory->szName, sizeof(pFactory->szName));
4696 AssertReturn(psz, VERR_INVALID_PARAMETER);
4697
4698 /*
4699 * Allocate and initialize a new registration structure.
4700 */
4701 pNewReg = (PSUPDRVFACTORYREG)RTMemAlloc(sizeof(SUPDRVFACTORYREG));
4702 if (pNewReg)
4703 {
4704 pNewReg->pNext = NULL;
4705 pNewReg->pFactory = pFactory;
4706 pNewReg->pSession = pSession;
4707 pNewReg->cchName = psz - &pFactory->szName[0];
4708
4709 /*
4710 * Add it to the tail of the list after checking for prior registration.
4711 */
4712 rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
4713 if (RT_SUCCESS(rc))
4714 {
4715 PSUPDRVFACTORYREG pPrev = NULL;
4716 PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
4717 while (pCur && pCur->pFactory != pFactory)
4718 {
4719 pPrev = pCur;
4720 pCur = pCur->pNext;
4721 }
4722 if (!pCur)
4723 {
4724 if (pPrev)
4725 pPrev->pNext = pNewReg;
4726 else
4727 pSession->pDevExt->pComponentFactoryHead = pNewReg;
4728 rc = VINF_SUCCESS;
4729 }
4730 else
4731 rc = VERR_ALREADY_EXISTS;
4732
4733 RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
4734 }
4735
4736 if (RT_FAILURE(rc))
4737 RTMemFree(pNewReg);
4738 }
4739 else
4740 rc = VERR_NO_MEMORY;
4741 return rc;
4742}
4743
4744
4745/**
4746 * Deregister a component factory.
4747 *
4748 * @returns VBox status code.
4749 * @retval VINF_SUCCESS on success.
4750 * @retval VERR_NOT_FOUND if the factory wasn't registered.
4751 * @retval VERR_ACCESS_DENIED if it isn't a kernel session.
4752 * @retval VERR_INVALID_PARAMETER on invalid parameter.
4753 * @retval VERR_INVALID_POINTER on invalid pointer parameter.
4754 *
4755 * @param pSession The SUPDRV session (must be a ring-0 session).
4756 * @param pFactory Pointer to the component factory registration structure
4757 * previously passed SUPR0ComponentRegisterFactory().
4758 *
4759 * @remarks This interface is also available via SUPR0IdcComponentDeregisterFactory.
4760 */
4761SUPR0DECL(int) SUPR0ComponentDeregisterFactory(PSUPDRVSESSION pSession, PCSUPDRVFACTORY pFactory)
4762{
4763 int rc;
4764
4765 /*
4766 * Validate parameters.
4767 */
4768 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
4769 AssertReturn(pSession->R0Process == NIL_RTR0PROCESS, VERR_ACCESS_DENIED);
4770 AssertPtrReturn(pFactory, VERR_INVALID_POINTER);
4771
4772 /*
4773 * Take the lock and look for the registration record.
4774 */
4775 rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
4776 if (RT_SUCCESS(rc))
4777 {
4778 PSUPDRVFACTORYREG pPrev = NULL;
4779 PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
4780 while (pCur && pCur->pFactory != pFactory)
4781 {
4782 pPrev = pCur;
4783 pCur = pCur->pNext;
4784 }
4785 if (pCur)
4786 {
4787 if (!pPrev)
4788 pSession->pDevExt->pComponentFactoryHead = pCur->pNext;
4789 else
4790 pPrev->pNext = pCur->pNext;
4791
4792 pCur->pNext = NULL;
4793 pCur->pFactory = NULL;
4794 pCur->pSession = NULL;
4795 rc = VINF_SUCCESS;
4796 }
4797 else
4798 rc = VERR_NOT_FOUND;
4799
4800 RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
4801
4802 RTMemFree(pCur);
4803 }
4804 return rc;
4805}
4806
4807
4808/**
4809 * Queries a component factory.
4810 *
4811 * @returns VBox status code.
4812 * @retval VERR_INVALID_PARAMETER on invalid parameter.
4813 * @retval VERR_INVALID_POINTER on invalid pointer parameter.
4814 * @retval VERR_SUPDRV_COMPONENT_NOT_FOUND if the component factory wasn't found.
4815 * @retval VERR_SUPDRV_INTERFACE_NOT_SUPPORTED if the interface wasn't supported.
4816 *
4817 * @param pSession The SUPDRV session.
4818 * @param pszName The name of the component factory.
4819 * @param pszInterfaceUuid The UUID of the factory interface (stringified).
4820 * @param ppvFactoryIf Where to store the factory interface.
4821 */
4822SUPR0DECL(int) SUPR0ComponentQueryFactory(PSUPDRVSESSION pSession, const char *pszName, const char *pszInterfaceUuid, void **ppvFactoryIf)
4823{
4824 const char *pszEnd;
4825 size_t cchName;
4826 int rc;
4827
4828 /*
4829 * Validate parameters.
4830 */
4831 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
4832
4833 AssertPtrReturn(pszName, VERR_INVALID_POINTER);
4834 pszEnd = RTStrEnd(pszName, RT_SIZEOFMEMB(SUPDRVFACTORY, szName));
4835 AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4836 cchName = pszEnd - pszName;
4837
4838 AssertPtrReturn(pszInterfaceUuid, VERR_INVALID_POINTER);
4839 pszEnd = RTStrEnd(pszInterfaceUuid, RTUUID_STR_LENGTH);
4840 AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
4841
4842 AssertPtrReturn(ppvFactoryIf, VERR_INVALID_POINTER);
4843 *ppvFactoryIf = NULL;
4844
4845 /*
4846 * Take the lock and try all factories by this name.
4847 */
4848 rc = RTSemFastMutexRequest(pSession->pDevExt->mtxComponentFactory);
4849 if (RT_SUCCESS(rc))
4850 {
4851 PSUPDRVFACTORYREG pCur = pSession->pDevExt->pComponentFactoryHead;
4852 rc = VERR_SUPDRV_COMPONENT_NOT_FOUND;
4853 while (pCur)
4854 {
4855 if ( pCur->cchName == cchName
4856 && !memcmp(pCur->pFactory->szName, pszName, cchName))
4857 {
4858 void *pvFactory = pCur->pFactory->pfnQueryFactoryInterface(pCur->pFactory, pSession, pszInterfaceUuid);
4859 if (pvFactory)
4860 {
4861 *ppvFactoryIf = pvFactory;
4862 rc = VINF_SUCCESS;
4863 break;
4864 }
4865 rc = VERR_SUPDRV_INTERFACE_NOT_SUPPORTED;
4866 }
4867
4868 /* next */
4869 pCur = pCur->pNext;
4870 }
4871
4872 RTSemFastMutexRelease(pSession->pDevExt->mtxComponentFactory);
4873 }
4874 return rc;
4875}
4876
4877
4878/**
4879 * Adds a memory object to the session.
4880 *
4881 * @returns IPRT status code.
4882 * @param pMem Memory tracking structure containing the
4883 * information to track.
4884 * @param pSession The session.
4885 */
4886static int supdrvMemAdd(PSUPDRVMEMREF pMem, PSUPDRVSESSION pSession)
4887{
4888 PSUPDRVBUNDLE pBundle;
4889
4890 /*
4891 * Find free entry and record the allocation.
4892 */
4893 RTSpinlockAcquire(pSession->Spinlock);
4894 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
4895 {
4896 if (pBundle->cUsed < RT_ELEMENTS(pBundle->aMem))
4897 {
4898 unsigned i;
4899 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
4900 {
4901 if (pBundle->aMem[i].MemObj == NIL_RTR0MEMOBJ)
4902 {
4903 pBundle->cUsed++;
4904 pBundle->aMem[i] = *pMem;
4905 RTSpinlockRelease(pSession->Spinlock);
4906 return VINF_SUCCESS;
4907 }
4908 }
4909 AssertFailed(); /* !!this can't be happening!!! */
4910 }
4911 }
4912 RTSpinlockRelease(pSession->Spinlock);
4913
4914 /*
4915 * Need to allocate a new bundle.
4916 * Insert into the last entry in the bundle.
4917 */
4918 pBundle = (PSUPDRVBUNDLE)RTMemAllocZ(sizeof(*pBundle));
4919 if (!pBundle)
4920 return VERR_NO_MEMORY;
4921
4922 /* take last entry. */
4923 pBundle->cUsed++;
4924 pBundle->aMem[RT_ELEMENTS(pBundle->aMem) - 1] = *pMem;
4925
4926 /* insert into list. */
4927 RTSpinlockAcquire(pSession->Spinlock);
4928 pBundle->pNext = pSession->Bundle.pNext;
4929 pSession->Bundle.pNext = pBundle;
4930 RTSpinlockRelease(pSession->Spinlock);
4931
4932 return VINF_SUCCESS;
4933}
4934
4935
4936/**
4937 * Releases a memory object referenced by pointer and type.
4938 *
4939 * @returns IPRT status code.
4940 * @param pSession Session data.
4941 * @param uPtr Pointer to memory. This is matched against both the R0 and R3 addresses.
4942 * @param eType Memory type.
4943 */
4944static int supdrvMemRelease(PSUPDRVSESSION pSession, RTHCUINTPTR uPtr, SUPDRVMEMREFTYPE eType)
4945{
4946 PSUPDRVBUNDLE pBundle;
4947
4948 /*
4949 * Validate input.
4950 */
4951 if (!uPtr)
4952 {
4953 Log(("Illegal address %p\n", (void *)uPtr));
4954 return VERR_INVALID_PARAMETER;
4955 }
4956
4957 /*
4958 * Search for the address.
4959 */
4960 RTSpinlockAcquire(pSession->Spinlock);
4961 for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
4962 {
4963 if (pBundle->cUsed > 0)
4964 {
4965 unsigned i;
4966 for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
4967 {
4968 if ( pBundle->aMem[i].eType == eType
4969 && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
4970 && ( (RTHCUINTPTR)RTR0MemObjAddress(pBundle->aMem[i].MemObj) == uPtr
4971 || ( pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
4972 && RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == uPtr))
4973 )
4974 {
4975 /* Make a copy of it and release it outside the spinlock. */
4976 SUPDRVMEMREF Mem = pBundle->aMem[i];
4977 pBundle->aMem[i].eType = MEMREF_TYPE_UNUSED;
4978 pBundle->aMem[i].MemObj = NIL_RTR0MEMOBJ;
4979 pBundle->aMem[i].MapObjR3 = NIL_RTR0MEMOBJ;
4980 RTSpinlockRelease(pSession->Spinlock);
4981
4982 if (Mem.MapObjR3 != NIL_RTR0MEMOBJ)
4983 {
4984 int rc = RTR0MemObjFree(Mem.MapObjR3, false);
4985 AssertRC(rc); /** @todo figure out how to handle this. */
4986 }
4987 if (Mem.MemObj != NIL_RTR0MEMOBJ)
4988 {
4989 int rc = RTR0MemObjFree(Mem.MemObj, true /* fFreeMappings */);
4990 AssertRC(rc); /** @todo figure out how to handle this. */
4991 }
4992 return VINF_SUCCESS;
4993 }
4994 }
4995 }
4996 }
4997 RTSpinlockRelease(pSession->Spinlock);
4998 Log(("Failed to find %p!!! (eType=%d)\n", (void *)uPtr, eType));
4999 return VERR_INVALID_PARAMETER;
5000}
5001
5002
5003/**
5004 * Opens an image. If it's the first time it's opened the call must upload
5005 * the bits using the supdrvIOCtl_LdrLoad() / SUPDRV_IOCTL_LDR_LOAD function.
5006 *
5007 * This is the 1st step of the loading.
5008 *
5009 * @returns IPRT status code.
5010 * @param pDevExt Device globals.
5011 * @param pSession Session data.
5012 * @param pReq The open request.
5013 */
5014static int supdrvIOCtl_LdrOpen(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDROPEN pReq)
5015{
5016 int rc;
5017 PSUPDRVLDRIMAGE pImage;
5018 void *pv;
5019 size_t cchName = strlen(pReq->u.In.szName); /* (caller checked < 32). */
5020 SUPDRV_CHECK_SMAP_SETUP();
5021 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5022 LogFlow(("supdrvIOCtl_LdrOpen: szName=%s cbImageWithTabs=%d\n", pReq->u.In.szName, pReq->u.In.cbImageWithTabs));
5023
5024 /*
5025 * Check if we got an instance of the image already.
5026 */
5027 supdrvLdrLock(pDevExt);
5028 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5029 for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
5030 {
5031 if ( pImage->szName[cchName] == '\0'
5032 && !memcmp(pImage->szName, pReq->u.In.szName, cchName))
5033 {
5034 if (RT_LIKELY(pImage->cUsage < UINT32_MAX / 2U))
5035 {
5036 /** @todo check cbImageBits and cbImageWithTabs here, if they differs that indicates that the images are different. */
5037 pImage->cUsage++;
5038 pReq->u.Out.pvImageBase = pImage->pvImage;
5039 pReq->u.Out.fNeedsLoading = pImage->uState == SUP_IOCTL_LDR_OPEN;
5040 pReq->u.Out.fNativeLoader = pImage->fNative;
5041 supdrvLdrAddUsage(pSession, pImage, true /*fRing3Usage*/);
5042 supdrvLdrUnlock(pDevExt);
5043 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5044 return VINF_SUCCESS;
5045 }
5046 supdrvLdrUnlock(pDevExt);
5047 Log(("supdrvIOCtl_LdrOpen: Too many existing references to '%s'!\n", pReq->u.In.szName));
5048 return VERR_TOO_MANY_REFERENCES;
5049 }
5050 }
5051 /* (not found - add it!) */
5052
5053 /* If the loader interface is locked down, make userland fail early */
5054 if (pDevExt->fLdrLockedDown)
5055 {
5056 supdrvLdrUnlock(pDevExt);
5057 Log(("supdrvIOCtl_LdrOpen: Not adding '%s' to image list, loader interface is locked down!\n", pReq->u.In.szName));
5058 return VERR_PERMISSION_DENIED;
5059 }
5060
5061 /*
5062 * Allocate memory.
5063 */
5064 Assert(cchName < sizeof(pImage->szName));
5065 pv = RTMemAlloc(sizeof(SUPDRVLDRIMAGE));
5066 if (!pv)
5067 {
5068 supdrvLdrUnlock(pDevExt);
5069 Log(("supdrvIOCtl_LdrOpen: RTMemAlloc() failed\n"));
5070 return /*VERR_NO_MEMORY*/ VERR_INTERNAL_ERROR_2;
5071 }
5072 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5073
5074 /*
5075 * Setup and link in the LDR stuff.
5076 */
5077 pImage = (PSUPDRVLDRIMAGE)pv;
5078 pImage->pvImage = NULL;
5079 pImage->pvImageAlloc = NULL;
5080 pImage->cbImageWithTabs = pReq->u.In.cbImageWithTabs;
5081 pImage->cbImageBits = pReq->u.In.cbImageBits;
5082 pImage->cSymbols = 0;
5083 pImage->paSymbols = NULL;
5084 pImage->pachStrTab = NULL;
5085 pImage->cbStrTab = 0;
5086 pImage->pfnModuleInit = NULL;
5087 pImage->pfnModuleTerm = NULL;
5088 pImage->pfnServiceReqHandler = NULL;
5089 pImage->uState = SUP_IOCTL_LDR_OPEN;
5090 pImage->cUsage = 1;
5091 pImage->pDevExt = pDevExt;
5092 pImage->uMagic = SUPDRVLDRIMAGE_MAGIC;
5093 memcpy(pImage->szName, pReq->u.In.szName, cchName + 1);
5094
5095 /*
5096 * Try load it using the native loader, if that isn't supported, fall back
5097 * on the older method.
5098 */
5099 pImage->fNative = true;
5100 rc = supdrvOSLdrOpen(pDevExt, pImage, pReq->u.In.szFilename);
5101 if (rc == VERR_NOT_SUPPORTED)
5102 {
5103 pImage->pvImageAlloc = RTMemExecAlloc(pImage->cbImageBits + 31);
5104 pImage->pvImage = RT_ALIGN_P(pImage->pvImageAlloc, 32);
5105 pImage->fNative = false;
5106 rc = pImage->pvImageAlloc ? VINF_SUCCESS : VERR_NO_EXEC_MEMORY;
5107 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5108 }
5109 if (RT_FAILURE(rc))
5110 {
5111 supdrvLdrUnlock(pDevExt);
5112 pImage->uMagic = SUPDRVLDRIMAGE_MAGIC_DEAD;
5113 RTMemFree(pImage);
5114 Log(("supdrvIOCtl_LdrOpen(%s): failed - %Rrc\n", pReq->u.In.szName, rc));
5115 return rc;
5116 }
5117 Assert(VALID_PTR(pImage->pvImage) || RT_FAILURE(rc));
5118
5119 /*
5120 * Link it.
5121 */
5122 pImage->pNext = pDevExt->pLdrImages;
5123 pDevExt->pLdrImages = pImage;
5124
5125 supdrvLdrAddUsage(pSession, pImage, true /*fRing3Usage*/);
5126
5127 pReq->u.Out.pvImageBase = pImage->pvImage;
5128 pReq->u.Out.fNeedsLoading = true;
5129 pReq->u.Out.fNativeLoader = pImage->fNative;
5130 supdrvOSLdrNotifyOpened(pDevExt, pImage, pReq->u.In.szFilename);
5131
5132 supdrvLdrUnlock(pDevExt);
5133 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5134 return VINF_SUCCESS;
5135}
5136
5137
5138/**
5139 * Worker that validates a pointer to an image entrypoint.
5140 *
5141 * @returns IPRT status code.
5142 * @param pDevExt The device globals.
5143 * @param pImage The loader image.
5144 * @param pv The pointer into the image.
5145 * @param fMayBeNull Whether it may be NULL.
5146 * @param fCheckNative Whether to check with the native loaders.
5147 * @param pszSymbol The entrypoint name or log name. If the symbol
5148 * capitalized it signifies a specific symbol, otherwise it
5149 * for logging.
5150 * @param pbImageBits The image bits prepared by ring-3.
5151 *
5152 * @remarks Will leave the lock on failure.
5153 */
5154static int supdrvLdrValidatePointer(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage, void *pv, bool fMayBeNull,
5155 bool fCheckNative, const uint8_t *pbImageBits, const char *pszSymbol)
5156{
5157 if (!fMayBeNull || pv)
5158 {
5159 if ((uintptr_t)pv - (uintptr_t)pImage->pvImage >= pImage->cbImageBits)
5160 {
5161 supdrvLdrUnlock(pDevExt);
5162 Log(("Out of range (%p LB %#x): %s=%p\n", pImage->pvImage, pImage->cbImageBits, pszSymbol, pv));
5163 return VERR_INVALID_PARAMETER;
5164 }
5165
5166 if (pImage->fNative && fCheckNative)
5167 {
5168 int rc = supdrvOSLdrValidatePointer(pDevExt, pImage, pv, pbImageBits, pszSymbol);
5169 if (RT_FAILURE(rc))
5170 {
5171 supdrvLdrUnlock(pDevExt);
5172 Log(("Bad entry point address: %s=%p (rc=%Rrc)\n", pszSymbol, pv, rc));
5173 return rc;
5174 }
5175 }
5176 }
5177 return VINF_SUCCESS;
5178}
5179
5180
5181/**
5182 * Formats a load error message.
5183 *
5184 * @returns @a rc
5185 * @param rc Return code.
5186 * @param pReq The request.
5187 * @param pszFormat The error message format string.
5188 * @param ... Argument to the format string.
5189 */
5190int VBOXCALL supdrvLdrLoadError(int rc, PSUPLDRLOAD pReq, const char *pszFormat, ...)
5191{
5192 va_list va;
5193 va_start(va, pszFormat);
5194 pReq->u.Out.uErrorMagic = SUPLDRLOAD_ERROR_MAGIC;
5195 RTStrPrintfV(pReq->u.Out.szError, sizeof(pReq->u.Out.szError), pszFormat, va);
5196 va_end(va);
5197 Log(("SUP_IOCTL_LDR_LOAD: %s [rc=%Rrc]\n", pReq->u.Out.szError, rc));
5198 return rc;
5199}
5200
5201
5202/**
5203 * Loads the image bits.
5204 *
5205 * This is the 2nd step of the loading.
5206 *
5207 * @returns IPRT status code.
5208 * @param pDevExt Device globals.
5209 * @param pSession Session data.
5210 * @param pReq The request.
5211 */
5212static int supdrvIOCtl_LdrLoad(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRLOAD pReq)
5213{
5214 PSUPDRVLDRUSAGE pUsage;
5215 PSUPDRVLDRIMAGE pImage;
5216 int rc;
5217 SUPDRV_CHECK_SMAP_SETUP();
5218 LogFlow(("supdrvIOCtl_LdrLoad: pvImageBase=%p cbImageWithBits=%d\n", pReq->u.In.pvImageBase, pReq->u.In.cbImageWithTabs));
5219 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5220
5221 /*
5222 * Find the ldr image.
5223 */
5224 supdrvLdrLock(pDevExt);
5225 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5226
5227 pUsage = pSession->pLdrUsage;
5228 while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
5229 pUsage = pUsage->pNext;
5230 if (!pUsage)
5231 {
5232 supdrvLdrUnlock(pDevExt);
5233 return supdrvLdrLoadError(VERR_INVALID_HANDLE, pReq, "Image not found");
5234 }
5235 pImage = pUsage->pImage;
5236
5237 /*
5238 * Validate input.
5239 */
5240 if ( pImage->cbImageWithTabs != pReq->u.In.cbImageWithTabs
5241 || pImage->cbImageBits != pReq->u.In.cbImageBits)
5242 {
5243 supdrvLdrUnlock(pDevExt);
5244 return supdrvLdrLoadError(VERR_INVALID_HANDLE, pReq, "Image size mismatch found: %d(prep) != %d(load) or %d != %d",
5245 pImage->cbImageWithTabs, pReq->u.In.cbImageWithTabs, pImage->cbImageBits, pReq->u.In.cbImageBits);
5246 }
5247
5248 if (pImage->uState != SUP_IOCTL_LDR_OPEN)
5249 {
5250 unsigned uState = pImage->uState;
5251 supdrvLdrUnlock(pDevExt);
5252 if (uState != SUP_IOCTL_LDR_LOAD)
5253 AssertMsgFailed(("SUP_IOCTL_LDR_LOAD: invalid image state %d (%#x)!\n", uState, uState));
5254 pReq->u.Out.uErrorMagic = 0;
5255 return VERR_ALREADY_LOADED;
5256 }
5257
5258 /* If the loader interface is locked down, don't load new images */
5259 if (pDevExt->fLdrLockedDown)
5260 {
5261 supdrvLdrUnlock(pDevExt);
5262 return supdrvLdrLoadError(VERR_PERMISSION_DENIED, pReq, "Loader is locked down");
5263 }
5264
5265 switch (pReq->u.In.eEPType)
5266 {
5267 case SUPLDRLOADEP_NOTHING:
5268 break;
5269
5270 case SUPLDRLOADEP_VMMR0:
5271 rc = supdrvLdrValidatePointer( pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0, false, false, pReq->u.In.abImage, "pvVMMR0");
5272 if (RT_SUCCESS(rc))
5273 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, false, true, pReq->u.In.abImage, "VMMR0EntryFast");
5274 if (RT_SUCCESS(rc))
5275 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx, false, true, pReq->u.In.abImage, "VMMR0EntryEx");
5276 if (RT_FAILURE(rc))
5277 return supdrvLdrLoadError(rc, pReq, "Invalid VMMR0 pointer");
5278 break;
5279
5280 case SUPLDRLOADEP_SERVICE:
5281 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.EP.Service.pfnServiceReq, false, true, pReq->u.In.abImage, "pfnServiceReq");
5282 if (RT_FAILURE(rc))
5283 return supdrvLdrLoadError(rc, pReq, "Invalid pfnServiceReq pointer: %p", pReq->u.In.EP.Service.pfnServiceReq);
5284 if ( pReq->u.In.EP.Service.apvReserved[0] != NIL_RTR0PTR
5285 || pReq->u.In.EP.Service.apvReserved[1] != NIL_RTR0PTR
5286 || pReq->u.In.EP.Service.apvReserved[2] != NIL_RTR0PTR)
5287 {
5288 supdrvLdrUnlock(pDevExt);
5289 return supdrvLdrLoadError(VERR_INVALID_PARAMETER, pReq,
5290 "Out of range (%p LB %#x): apvReserved={%p,%p,%p} MBZ!",
5291 pImage->pvImage, pReq->u.In.cbImageWithTabs,
5292 pReq->u.In.EP.Service.apvReserved[0],
5293 pReq->u.In.EP.Service.apvReserved[1],
5294 pReq->u.In.EP.Service.apvReserved[2]);
5295 }
5296 break;
5297
5298 default:
5299 supdrvLdrUnlock(pDevExt);
5300 return supdrvLdrLoadError(VERR_INVALID_PARAMETER, pReq, "Invalid eEPType=%d", pReq->u.In.eEPType);
5301 }
5302
5303 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.pfnModuleInit, true, true, pReq->u.In.abImage, "ModuleInit");
5304 if (RT_FAILURE(rc))
5305 return supdrvLdrLoadError(rc, pReq, "Invalid pfnModuleInit pointer: %p", pReq->u.In.pfnModuleInit);
5306 rc = supdrvLdrValidatePointer(pDevExt, pImage, pReq->u.In.pfnModuleTerm, true, true, pReq->u.In.abImage, "ModuleTerm");
5307 if (RT_FAILURE(rc))
5308 return supdrvLdrLoadError(rc, pReq, "Invalid pfnModuleTerm pointer: %p", pReq->u.In.pfnModuleTerm);
5309 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5310
5311 /*
5312 * Allocate and copy the tables if non-native.
5313 * (No need to do try/except as this is a buffered request.)
5314 */
5315 if (!pImage->fNative)
5316 {
5317 pImage->cbStrTab = pReq->u.In.cbStrTab;
5318 if (pImage->cbStrTab)
5319 {
5320 pImage->pachStrTab = (char *)RTMemAlloc(pImage->cbStrTab);
5321 if (pImage->pachStrTab)
5322 memcpy(pImage->pachStrTab, &pReq->u.In.abImage[pReq->u.In.offStrTab], pImage->cbStrTab);
5323 else
5324 rc = supdrvLdrLoadError(VERR_NO_MEMORY, pReq, "Out of memory for string table: %#x", pImage->cbStrTab);
5325 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5326 }
5327
5328 pImage->cSymbols = pReq->u.In.cSymbols;
5329 if (RT_SUCCESS(rc) && pImage->cSymbols)
5330 {
5331 size_t cbSymbols = pImage->cSymbols * sizeof(SUPLDRSYM);
5332 pImage->paSymbols = (PSUPLDRSYM)RTMemAlloc(cbSymbols);
5333 if (pImage->paSymbols)
5334 memcpy(pImage->paSymbols, &pReq->u.In.abImage[pReq->u.In.offSymbols], cbSymbols);
5335 else
5336 rc = supdrvLdrLoadError(VERR_NO_MEMORY, pReq, "Out of memory for symbol table: %#x", cbSymbols);
5337 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5338 }
5339 }
5340
5341 /*
5342 * Copy the bits / complete native loading.
5343 */
5344 if (RT_SUCCESS(rc))
5345 {
5346 pImage->uState = SUP_IOCTL_LDR_LOAD;
5347 pImage->pfnModuleInit = (PFNR0MODULEINIT)(uintptr_t)pReq->u.In.pfnModuleInit;
5348 pImage->pfnModuleTerm = (PFNR0MODULETERM)(uintptr_t)pReq->u.In.pfnModuleTerm;
5349
5350 if (pImage->fNative)
5351 rc = supdrvOSLdrLoad(pDevExt, pImage, pReq->u.In.abImage, pReq);
5352 else
5353 {
5354 memcpy(pImage->pvImage, &pReq->u.In.abImage[0], pImage->cbImageBits);
5355 Log(("vboxdrv: Loaded '%s' at %p\n", pImage->szName, pImage->pvImage));
5356 }
5357 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5358 }
5359
5360 /*
5361 * Update any entry points.
5362 */
5363 if (RT_SUCCESS(rc))
5364 {
5365 switch (pReq->u.In.eEPType)
5366 {
5367 default:
5368 case SUPLDRLOADEP_NOTHING:
5369 rc = VINF_SUCCESS;
5370 break;
5371 case SUPLDRLOADEP_VMMR0:
5372 rc = supdrvLdrSetVMMR0EPs(pDevExt, pReq->u.In.EP.VMMR0.pvVMMR0,
5373 pReq->u.In.EP.VMMR0.pvVMMR0EntryFast, pReq->u.In.EP.VMMR0.pvVMMR0EntryEx);
5374 break;
5375 case SUPLDRLOADEP_SERVICE:
5376 pImage->pfnServiceReqHandler = (PFNSUPR0SERVICEREQHANDLER)(uintptr_t)pReq->u.In.EP.Service.pfnServiceReq;
5377 rc = VINF_SUCCESS;
5378 break;
5379 }
5380 }
5381
5382 /*
5383 * On success call the module initialization.
5384 */
5385 LogFlow(("supdrvIOCtl_LdrLoad: pfnModuleInit=%p\n", pImage->pfnModuleInit));
5386 if (RT_SUCCESS(rc) && pImage->pfnModuleInit)
5387 {
5388 Log(("supdrvIOCtl_LdrLoad: calling pfnModuleInit=%p\n", pImage->pfnModuleInit));
5389 pDevExt->pLdrInitImage = pImage;
5390 pDevExt->hLdrInitThread = RTThreadNativeSelf();
5391 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5392 rc = pImage->pfnModuleInit(pImage);
5393 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5394 pDevExt->pLdrInitImage = NULL;
5395 pDevExt->hLdrInitThread = NIL_RTNATIVETHREAD;
5396 if (RT_FAILURE(rc))
5397 {
5398 if (pDevExt->pvVMMR0 == pImage->pvImage)
5399 supdrvLdrUnsetVMMR0EPs(pDevExt);
5400 supdrvLdrLoadError(rc, pReq, "ModuleInit failed: %Rrc", rc);
5401 }
5402 }
5403 if (RT_SUCCESS(rc))
5404 {
5405 SUPR0Printf("vboxdrv: %RKv %s\n", pImage->pvImage, pImage->szName);
5406 pReq->u.Out.uErrorMagic = 0;
5407 pReq->u.Out.szError[0] = '\0';
5408 }
5409 else
5410 {
5411 /* Inform the tracing component in case ModuleInit registered TPs. */
5412 supdrvTracerModuleUnloading(pDevExt, pImage);
5413
5414 pImage->uState = SUP_IOCTL_LDR_OPEN;
5415 pImage->pfnModuleInit = NULL;
5416 pImage->pfnModuleTerm = NULL;
5417 pImage->pfnServiceReqHandler= NULL;
5418 pImage->cbStrTab = 0;
5419 RTMemFree(pImage->pachStrTab);
5420 pImage->pachStrTab = NULL;
5421 RTMemFree(pImage->paSymbols);
5422 pImage->paSymbols = NULL;
5423 pImage->cSymbols = 0;
5424 }
5425
5426 supdrvLdrUnlock(pDevExt);
5427 SUPDRV_CHECK_SMAP_CHECK(pDevExt, RT_NOTHING);
5428 return rc;
5429}
5430
5431
5432/**
5433 * Frees a previously loaded (prep'ed) image.
5434 *
5435 * @returns IPRT status code.
5436 * @param pDevExt Device globals.
5437 * @param pSession Session data.
5438 * @param pReq The request.
5439 */
5440static int supdrvIOCtl_LdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRFREE pReq)
5441{
5442 int rc;
5443 PSUPDRVLDRUSAGE pUsagePrev;
5444 PSUPDRVLDRUSAGE pUsage;
5445 PSUPDRVLDRIMAGE pImage;
5446 LogFlow(("supdrvIOCtl_LdrFree: pvImageBase=%p\n", pReq->u.In.pvImageBase));
5447
5448 /*
5449 * Find the ldr image.
5450 */
5451 supdrvLdrLock(pDevExt);
5452 pUsagePrev = NULL;
5453 pUsage = pSession->pLdrUsage;
5454 while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
5455 {
5456 pUsagePrev = pUsage;
5457 pUsage = pUsage->pNext;
5458 }
5459 if (!pUsage)
5460 {
5461 supdrvLdrUnlock(pDevExt);
5462 Log(("SUP_IOCTL_LDR_FREE: couldn't find image!\n"));
5463 return VERR_INVALID_HANDLE;
5464 }
5465 if (pUsage->cRing3Usage == 0)
5466 {
5467 supdrvLdrUnlock(pDevExt);
5468 Log(("SUP_IOCTL_LDR_FREE: No ring-3 reference to the image!\n"));
5469 return VERR_CALLER_NO_REFERENCE;
5470 }
5471
5472 /*
5473 * Check if we can remove anything.
5474 */
5475 rc = VINF_SUCCESS;
5476 pImage = pUsage->pImage;
5477 if (pImage->cUsage <= 1 || pUsage->cRing3Usage + pUsage->cRing0Usage <= 1)
5478 {
5479 /*
5480 * Check if there are any objects with destructors in the image, if
5481 * so leave it for the session cleanup routine so we get a chance to
5482 * clean things up in the right order and not leave them all dangling.
5483 */
5484 RTSpinlockAcquire(pDevExt->Spinlock);
5485 if (pImage->cUsage <= 1)
5486 {
5487 PSUPDRVOBJ pObj;
5488 for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
5489 if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
5490 {
5491 rc = VERR_DANGLING_OBJECTS;
5492 break;
5493 }
5494 }
5495 else
5496 {
5497 PSUPDRVUSAGE pGenUsage;
5498 for (pGenUsage = pSession->pUsage; pGenUsage; pGenUsage = pGenUsage->pNext)
5499 if (RT_UNLIKELY((uintptr_t)pGenUsage->pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
5500 {
5501 rc = VERR_DANGLING_OBJECTS;
5502 break;
5503 }
5504 }
5505 RTSpinlockRelease(pDevExt->Spinlock);
5506 if (rc == VINF_SUCCESS)
5507 {
5508 /* unlink it */
5509 if (pUsagePrev)
5510 pUsagePrev->pNext = pUsage->pNext;
5511 else
5512 pSession->pLdrUsage = pUsage->pNext;
5513
5514 /* free it */
5515 pUsage->pImage = NULL;
5516 pUsage->pNext = NULL;
5517 RTMemFree(pUsage);
5518
5519 /*
5520 * Dereference the image.
5521 */
5522 if (pImage->cUsage <= 1)
5523 supdrvLdrFree(pDevExt, pImage);
5524 else
5525 pImage->cUsage--;
5526 }
5527 else
5528 Log(("supdrvIOCtl_LdrFree: Dangling objects in %p/%s!\n", pImage->pvImage, pImage->szName));
5529 }
5530 else
5531 {
5532 /*
5533 * Dereference both image and usage.
5534 */
5535 pImage->cUsage--;
5536 pUsage->cRing3Usage--;
5537 }
5538
5539 supdrvLdrUnlock(pDevExt);
5540 return rc;
5541}
5542
5543
5544/**
5545 * Lock down the image loader interface.
5546 *
5547 * @returns IPRT status code.
5548 * @param pDevExt Device globals.
5549 */
5550static int supdrvIOCtl_LdrLockDown(PSUPDRVDEVEXT pDevExt)
5551{
5552 LogFlow(("supdrvIOCtl_LdrLockDown:\n"));
5553
5554 supdrvLdrLock(pDevExt);
5555 if (!pDevExt->fLdrLockedDown)
5556 {
5557 pDevExt->fLdrLockedDown = true;
5558 Log(("supdrvIOCtl_LdrLockDown: Image loader interface locked down\n"));
5559 }
5560 supdrvLdrUnlock(pDevExt);
5561
5562 return VINF_SUCCESS;
5563}
5564
5565
5566/**
5567 * Queries the address of a symbol in an open image.
5568 *
5569 * @returns IPRT status code.
5570 * @param pDevExt Device globals.
5571 * @param pSession Session data.
5572 * @param pReq The request buffer.
5573 */
5574static int supdrvIOCtl_LdrQuerySymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPLDRGETSYMBOL pReq)
5575{
5576 PSUPDRVLDRIMAGE pImage;
5577 PSUPDRVLDRUSAGE pUsage;
5578 uint32_t i;
5579 PSUPLDRSYM paSyms;
5580 const char *pchStrings;
5581 const size_t cbSymbol = strlen(pReq->u.In.szSymbol) + 1;
5582 void *pvSymbol = NULL;
5583 int rc = VERR_SYMBOL_NOT_FOUND;
5584 Log3(("supdrvIOCtl_LdrQuerySymbol: pvImageBase=%p szSymbol=\"%s\"\n", pReq->u.In.pvImageBase, pReq->u.In.szSymbol));
5585
5586 /*
5587 * Find the ldr image.
5588 */
5589 supdrvLdrLock(pDevExt);
5590 pUsage = pSession->pLdrUsage;
5591 while (pUsage && pUsage->pImage->pvImage != pReq->u.In.pvImageBase)
5592 pUsage = pUsage->pNext;
5593 if (!pUsage)
5594 {
5595 supdrvLdrUnlock(pDevExt);
5596 Log(("SUP_IOCTL_LDR_GET_SYMBOL: couldn't find image!\n"));
5597 return VERR_INVALID_HANDLE;
5598 }
5599 pImage = pUsage->pImage;
5600 if (pImage->uState != SUP_IOCTL_LDR_LOAD)
5601 {
5602 unsigned uState = pImage->uState;
5603 supdrvLdrUnlock(pDevExt);
5604 Log(("SUP_IOCTL_LDR_GET_SYMBOL: invalid image state %d (%#x)!\n", uState, uState)); NOREF(uState);
5605 return VERR_ALREADY_LOADED;
5606 }
5607
5608 /*
5609 * Search the image exports / symbol strings.
5610 *
5611 * Note! The int32_t is for native loading on solaris where the data
5612 * and text segments are in very different places.
5613 */
5614 if (pImage->fNative)
5615 rc = supdrvOSLdrQuerySymbol(pDevExt, pImage, pReq->u.In.szSymbol, cbSymbol - 1, &pvSymbol);
5616 else
5617 {
5618 pchStrings = pImage->pachStrTab;
5619 paSyms = pImage->paSymbols;
5620 for (i = 0; i < pImage->cSymbols; i++)
5621 {
5622 if ( paSyms[i].offName + cbSymbol <= pImage->cbStrTab
5623 && !memcmp(pchStrings + paSyms[i].offName, pReq->u.In.szSymbol, cbSymbol))
5624 {
5625 pvSymbol = (uint8_t *)pImage->pvImage + (int32_t)paSyms[i].offSymbol;
5626 rc = VINF_SUCCESS;
5627 break;
5628 }
5629 }
5630 }
5631 supdrvLdrUnlock(pDevExt);
5632 pReq->u.Out.pvSymbol = pvSymbol;
5633 return rc;
5634}
5635
5636
5637/**
5638 * Gets the address of a symbol in an open image or the support driver.
5639 *
5640 * @returns VINF_SUCCESS on success.
5641 * @returns
5642 * @param pDevExt Device globals.
5643 * @param pSession Session data.
5644 * @param pReq The request buffer.
5645 */
5646static int supdrvIDC_LdrGetSymbol(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQGETSYM pReq)
5647{
5648 int rc = VINF_SUCCESS;
5649 const char *pszSymbol = pReq->u.In.pszSymbol;
5650 const char *pszModule = pReq->u.In.pszModule;
5651 size_t cbSymbol;
5652 char const *pszEnd;
5653 uint32_t i;
5654
5655 /*
5656 * Input validation.
5657 */
5658 AssertPtrReturn(pszSymbol, VERR_INVALID_POINTER);
5659 pszEnd = RTStrEnd(pszSymbol, 512);
5660 AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
5661 cbSymbol = pszEnd - pszSymbol + 1;
5662
5663 if (pszModule)
5664 {
5665 AssertPtrReturn(pszModule, VERR_INVALID_POINTER);
5666 pszEnd = RTStrEnd(pszModule, 64);
5667 AssertReturn(pszEnd, VERR_INVALID_PARAMETER);
5668 }
5669 Log3(("supdrvIDC_LdrGetSymbol: pszModule=%p:{%s} pszSymbol=%p:{%s}\n", pszModule, pszModule, pszSymbol, pszSymbol));
5670
5671
5672 if ( !pszModule
5673 || !strcmp(pszModule, "SupDrv"))
5674 {
5675 /*
5676 * Search the support driver export table.
5677 */
5678 for (i = 0; i < RT_ELEMENTS(g_aFunctions); i++)
5679 if (!strcmp(g_aFunctions[i].szName, pszSymbol))
5680 {
5681 pReq->u.Out.pfnSymbol = (PFNRT)(uintptr_t)g_aFunctions[i].pfn;
5682 break;
5683 }
5684 }
5685 else
5686 {
5687 /*
5688 * Find the loader image.
5689 */
5690 PSUPDRVLDRIMAGE pImage;
5691
5692 supdrvLdrLock(pDevExt);
5693
5694 for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
5695 if (!strcmp(pImage->szName, pszModule))
5696 break;
5697 if (pImage && pImage->uState == SUP_IOCTL_LDR_LOAD)
5698 {
5699 /*
5700 * Search the image exports / symbol strings.
5701 */
5702 if (pImage->fNative)
5703 {
5704 rc = supdrvOSLdrQuerySymbol(pDevExt, pImage, pszSymbol, cbSymbol - 1, (void **)&pReq->u.Out.pfnSymbol);
5705 if (RT_SUCCESS(rc))
5706 rc = supdrvLdrAddUsage(pSession, pImage, true /*fRing3Usage*/);
5707 }
5708 else
5709 {
5710 const char *pchStrings = pImage->pachStrTab;
5711 PCSUPLDRSYM paSyms = pImage->paSymbols;
5712 rc = VERR_SYMBOL_NOT_FOUND;
5713 for (i = 0; i < pImage->cSymbols; i++)
5714 {
5715 if ( paSyms[i].offName + cbSymbol <= pImage->cbStrTab
5716 && !memcmp(pchStrings + paSyms[i].offName, pszSymbol, cbSymbol))
5717 {
5718 /*
5719 * Found it! Calc the symbol address and add a reference to the module.
5720 */
5721 pReq->u.Out.pfnSymbol = (PFNRT)((uintptr_t)pImage->pvImage + (int32_t)paSyms[i].offSymbol);
5722 rc = supdrvLdrAddUsage(pSession, pImage, true /*fRing3Usage*/);
5723 break;
5724 }
5725 }
5726 }
5727 }
5728 else
5729 rc = pImage ? VERR_WRONG_ORDER : VERR_MODULE_NOT_FOUND;
5730
5731 supdrvLdrUnlock(pDevExt);
5732 }
5733 return rc;
5734}
5735
5736
5737/**
5738 * Looks up a symbol in g_aFunctions
5739 *
5740 * @returns VINF_SUCCESS on success, VERR_SYMBOL_NOT_FOUND on failure.
5741 * @param pszSymbol The symbol to look up.
5742 * @param puValue Where to return the value.
5743 */
5744int VBOXCALL supdrvLdrGetExportedSymbol(const char *pszSymbol, uintptr_t *puValue)
5745{
5746 uint32_t i;
5747 for (i = 0; i < RT_ELEMENTS(g_aFunctions); i++)
5748 if (!strcmp(g_aFunctions[i].szName, pszSymbol))
5749 {
5750 *puValue = (uintptr_t)g_aFunctions[i].pfn;
5751 return VINF_SUCCESS;
5752 }
5753
5754 if (!strcmp(pszSymbol, "g_SUPGlobalInfoPage"))
5755 {
5756 *puValue = (uintptr_t)g_pSUPGlobalInfoPage;
5757 return VINF_SUCCESS;
5758 }
5759
5760 return VERR_SYMBOL_NOT_FOUND;
5761}
5762
5763
5764/**
5765 * Updates the VMMR0 entry point pointers.
5766 *
5767 * @returns IPRT status code.
5768 * @param pDevExt Device globals.
5769 * @param pvVMMR0 VMMR0 image handle.
5770 * @param pvVMMR0EntryFast VMMR0EntryFast address.
5771 * @param pvVMMR0EntryEx VMMR0EntryEx address.
5772 * @remark Caller must own the loader mutex.
5773 */
5774static int supdrvLdrSetVMMR0EPs(PSUPDRVDEVEXT pDevExt, void *pvVMMR0, void *pvVMMR0EntryFast, void *pvVMMR0EntryEx)
5775{
5776 int rc = VINF_SUCCESS;
5777 LogFlow(("supdrvLdrSetR0EP pvVMMR0=%p pvVMMR0EntryFast=%p\n", pvVMMR0, pvVMMR0EntryFast));
5778
5779
5780 /*
5781 * Check if not yet set.
5782 */
5783 if (!pDevExt->pvVMMR0)
5784 {
5785 pDevExt->pvVMMR0 = pvVMMR0;
5786 *(void **)&pDevExt->pfnVMMR0EntryFast = pvVMMR0EntryFast;
5787 *(void **)&pDevExt->pfnVMMR0EntryEx = pvVMMR0EntryEx;
5788 ASMCompilerBarrier(); /* the above isn't nice, so be careful... */
5789 }
5790 else
5791 {
5792 /*
5793 * Return failure or success depending on whether the values match or not.
5794 */
5795 if ( pDevExt->pvVMMR0 != pvVMMR0
5796 || (uintptr_t)pDevExt->pfnVMMR0EntryFast != (uintptr_t)pvVMMR0EntryFast
5797 || (uintptr_t)pDevExt->pfnVMMR0EntryEx != (uintptr_t)pvVMMR0EntryEx)
5798 {
5799 AssertMsgFailed(("SUP_IOCTL_LDR_SETR0EP: Already set pointing to a different module!\n"));
5800 rc = VERR_INVALID_PARAMETER;
5801 }
5802 }
5803 return rc;
5804}
5805
5806
5807/**
5808 * Unsets the VMMR0 entry point installed by supdrvLdrSetR0EP.
5809 *
5810 * @param pDevExt Device globals.
5811 */
5812static void supdrvLdrUnsetVMMR0EPs(PSUPDRVDEVEXT pDevExt)
5813{
5814 pDevExt->pvVMMR0 = NULL;
5815 pDevExt->pfnVMMR0EntryFast = NULL;
5816 pDevExt->pfnVMMR0EntryEx = NULL;
5817}
5818
5819
5820/**
5821 * Adds a usage reference in the specified session of an image.
5822 *
5823 * Called while owning the loader semaphore.
5824 *
5825 * @returns VINF_SUCCESS on success and VERR_NO_MEMORY on failure.
5826 * @param pSession Session in question.
5827 * @param pImage Image which the session is using.
5828 * @param fRing3Usage Set if it's ring-3 usage, clear if ring-0.
5829 */
5830static int supdrvLdrAddUsage(PSUPDRVSESSION pSession, PSUPDRVLDRIMAGE pImage, bool fRing3Usage)
5831{
5832 PSUPDRVLDRUSAGE pUsage;
5833 LogFlow(("supdrvLdrAddUsage: pImage=%p %d\n", pImage, fRing3Usage));
5834
5835 /*
5836 * Referenced it already?
5837 */
5838 pUsage = pSession->pLdrUsage;
5839 while (pUsage)
5840 {
5841 if (pUsage->pImage == pImage)
5842 {
5843 if (fRing3Usage)
5844 pUsage->cRing3Usage++;
5845 else
5846 pUsage->cRing0Usage++;
5847 return VINF_SUCCESS;
5848 }
5849 pUsage = pUsage->pNext;
5850 }
5851
5852 /*
5853 * Allocate new usage record.
5854 */
5855 pUsage = (PSUPDRVLDRUSAGE)RTMemAlloc(sizeof(*pUsage));
5856 AssertReturn(pUsage, /*VERR_NO_MEMORY*/ VERR_INTERNAL_ERROR_5);
5857 pUsage->cRing3Usage = fRing3Usage ? 1 : 0;
5858 pUsage->cRing0Usage = fRing3Usage ? 0 : 1;
5859 pUsage->pImage = pImage;
5860 pUsage->pNext = pSession->pLdrUsage;
5861 pSession->pLdrUsage = pUsage;
5862 return VINF_SUCCESS;
5863}
5864
5865
5866/**
5867 * Frees a load image.
5868 *
5869 * @param pDevExt Pointer to device extension.
5870 * @param pImage Pointer to the image we're gonna free.
5871 * This image must exit!
5872 * @remark The caller MUST own SUPDRVDEVEXT::mtxLdr!
5873 */
5874static void supdrvLdrFree(PSUPDRVDEVEXT pDevExt, PSUPDRVLDRIMAGE pImage)
5875{
5876 PSUPDRVLDRIMAGE pImagePrev;
5877 LogFlow(("supdrvLdrFree: pImage=%p\n", pImage));
5878
5879 /*
5880 * Warn if we're releasing images while the image loader interface is
5881 * locked down -- we won't be able to reload them!
5882 */
5883 if (pDevExt->fLdrLockedDown)
5884 Log(("supdrvLdrFree: Warning: unloading '%s' image, while loader interface is locked down!\n", pImage->szName));
5885
5886 /* find it - arg. should've used doubly linked list. */
5887 Assert(pDevExt->pLdrImages);
5888 pImagePrev = NULL;
5889 if (pDevExt->pLdrImages != pImage)
5890 {
5891 pImagePrev = pDevExt->pLdrImages;
5892 while (pImagePrev->pNext != pImage)
5893 pImagePrev = pImagePrev->pNext;
5894 Assert(pImagePrev->pNext == pImage);
5895 }
5896
5897 /* unlink */
5898 if (pImagePrev)
5899 pImagePrev->pNext = pImage->pNext;
5900 else
5901 pDevExt->pLdrImages = pImage->pNext;
5902
5903 /* check if this is VMMR0.r0 unset its entry point pointers. */
5904 if (pDevExt->pvVMMR0 == pImage->pvImage)
5905 supdrvLdrUnsetVMMR0EPs(pDevExt);
5906
5907 /* check for objects with destructors in this image. (Shouldn't happen.) */
5908 if (pDevExt->pObjs)
5909 {
5910 unsigned cObjs = 0;
5911 PSUPDRVOBJ pObj;
5912 RTSpinlockAcquire(pDevExt->Spinlock);
5913 for (pObj = pDevExt->pObjs; pObj; pObj = pObj->pNext)
5914 if (RT_UNLIKELY((uintptr_t)pObj->pfnDestructor - (uintptr_t)pImage->pvImage < pImage->cbImageBits))
5915 {
5916 pObj->pfnDestructor = NULL;
5917 cObjs++;
5918 }
5919 RTSpinlockRelease(pDevExt->Spinlock);
5920 if (cObjs)
5921 OSDBGPRINT(("supdrvLdrFree: Image '%s' has %d dangling objects!\n", pImage->szName, cObjs));
5922 }
5923
5924 /* call termination function if fully loaded. */
5925 if ( pImage->pfnModuleTerm
5926 && pImage->uState == SUP_IOCTL_LDR_LOAD)
5927 {
5928 LogFlow(("supdrvIOCtl_LdrLoad: calling pfnModuleTerm=%p\n", pImage->pfnModuleTerm));
5929 pDevExt->hLdrTermThread = RTThreadNativeSelf();
5930 pImage->pfnModuleTerm(pImage);
5931 pDevExt->hLdrTermThread = NIL_RTNATIVETHREAD;
5932 }
5933
5934 /* Inform the tracing component. */
5935 supdrvTracerModuleUnloading(pDevExt, pImage);
5936
5937 /* Do native unload if appropriate, then inform the native code about the
5938 unloading (mainly for non-native loading case). */
5939 if (pImage->fNative)
5940 supdrvOSLdrUnload(pDevExt, pImage);
5941 supdrvOSLdrNotifyUnloaded(pDevExt, pImage);
5942
5943 /* free the image */
5944 pImage->uMagic = SUPDRVLDRIMAGE_MAGIC_DEAD;
5945 pImage->cUsage = 0;
5946 pImage->pDevExt = NULL;
5947 pImage->pNext = NULL;
5948 pImage->uState = SUP_IOCTL_LDR_FREE;
5949 RTMemExecFree(pImage->pvImageAlloc, pImage->cbImageBits + 31);
5950 pImage->pvImageAlloc = NULL;
5951 RTMemFree(pImage->pachStrTab);
5952 pImage->pachStrTab = NULL;
5953 RTMemFree(pImage->paSymbols);
5954 pImage->paSymbols = NULL;
5955 RTMemFree(pImage);
5956}
5957
5958
5959/**
5960 * Acquires the loader lock.
5961 *
5962 * @returns IPRT status code.
5963 * @param pDevExt The device extension.
5964 * @note Not recursive on all platforms yet.
5965 */
5966DECLINLINE(int) supdrvLdrLock(PSUPDRVDEVEXT pDevExt)
5967{
5968#ifdef SUPDRV_USE_MUTEX_FOR_LDR
5969 int rc = RTSemMutexRequest(pDevExt->mtxLdr, RT_INDEFINITE_WAIT);
5970#else
5971 int rc = RTSemFastMutexRequest(pDevExt->mtxLdr);
5972#endif
5973 AssertRC(rc);
5974 return rc;
5975}
5976
5977
5978/**
5979 * Releases the loader lock.
5980 *
5981 * @returns IPRT status code.
5982 * @param pDevExt The device extension.
5983 */
5984DECLINLINE(int) supdrvLdrUnlock(PSUPDRVDEVEXT pDevExt)
5985{
5986#ifdef SUPDRV_USE_MUTEX_FOR_LDR
5987 return RTSemMutexRelease(pDevExt->mtxLdr);
5988#else
5989 return RTSemFastMutexRelease(pDevExt->mtxLdr);
5990#endif
5991}
5992
5993
5994/**
5995 * Acquires the global loader lock.
5996 *
5997 * This can be useful when accessing structures being modified by the ModuleInit
5998 * and ModuleTerm. Use SUPR0LdrUnlock() to unlock.
5999 *
6000 * @returns VBox status code.
6001 * @param pSession The session doing the locking.
6002 *
6003 * @note Cannot be used during ModuleInit or ModuleTerm callbacks.
6004 */
6005SUPR0DECL(int) SUPR0LdrLock(PSUPDRVSESSION pSession)
6006{
6007 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
6008 return supdrvLdrLock(pSession->pDevExt);
6009}
6010
6011
6012/**
6013 * Releases the global loader lock.
6014 *
6015 * Must correspond to a SUPR0LdrLock call!
6016 *
6017 * @returns VBox status code.
6018 * @param pSession The session doing the locking.
6019 *
6020 * @note Cannot be used during ModuleInit or ModuleTerm callbacks.
6021 */
6022SUPR0DECL(int) SUPR0LdrUnlock(PSUPDRVSESSION pSession)
6023{
6024 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
6025 return supdrvLdrUnlock(pSession->pDevExt);
6026}
6027
6028
6029/**
6030 * For checking lock ownership in Assert() statements during ModuleInit and
6031 * ModuleTerm.
6032 *
6033 * @returns Whether we own the loader lock or not.
6034 * @param hMod The module in question.
6035 * @param fWantToHear For hosts where it is difficult to know who owns the
6036 * lock, this will be returned instead.
6037 */
6038SUPR0DECL(bool) SUPR0LdrIsLockOwnerByMod(void *hMod, bool fWantToHear)
6039{
6040 PSUPDRVDEVEXT pDevExt;
6041 RTNATIVETHREAD hOwner;
6042
6043 PSUPDRVLDRIMAGE pImage = (PSUPDRVLDRIMAGE)hMod;
6044 AssertPtrReturn(pImage, fWantToHear);
6045 AssertReturn(pImage->uMagic == SUPDRVLDRIMAGE_MAGIC, fWantToHear);
6046
6047 pDevExt = pImage->pDevExt;
6048 AssertPtrReturn(pDevExt, fWantToHear);
6049
6050 /*
6051 * Expecting this to be called at init/term time only, so this will be sufficient.
6052 */
6053 hOwner = pDevExt->hLdrInitThread;
6054 if (hOwner == NIL_RTNATIVETHREAD)
6055 hOwner = pDevExt->hLdrTermThread;
6056 if (hOwner != NIL_RTNATIVETHREAD)
6057 return hOwner == RTThreadNativeSelf();
6058
6059 /*
6060 * Neither of the two semaphore variants currently offers very good
6061 * introspection, so we wing it for now. This API is VBOX_STRICT only.
6062 */
6063#ifdef SUPDRV_USE_MUTEX_FOR_LDR
6064 return RTSemMutexIsOwned(pDevExt->mtxLdr) && fWantToHear;
6065#else
6066 return fWantToHear;
6067#endif
6068}
6069
6070
6071/**
6072 * Locates and retains the given module for ring-0 usage.
6073 *
6074 * @returns VBox status code.
6075 * @param pSession The session to associate the module reference with.
6076 * @param pszName The module name (no path).
6077 * @param phMod Where to return the module handle. The module is
6078 * referenced and a call to SUPR0LdrModRelease() is
6079 * necessary when done with it.
6080 */
6081SUPR0DECL(int) SUPR0LdrModByName(PSUPDRVSESSION pSession, const char *pszName, void **phMod)
6082{
6083 int rc;
6084 size_t cchName;
6085 PSUPDRVDEVEXT pDevExt;
6086
6087 /*
6088 * Validate input.
6089 */
6090 AssertPtrReturn(phMod, VERR_INVALID_POINTER);
6091 *phMod = NULL;
6092 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
6093 AssertPtrReturn(pszName, VERR_INVALID_POINTER);
6094 cchName = strlen(pszName);
6095 AssertReturn(cchName > 0, VERR_EMPTY_STRING);
6096 AssertReturn(cchName < RT_SIZEOFMEMB(SUPDRVLDRIMAGE, szName), VERR_MODULE_NOT_FOUND);
6097
6098 /*
6099 * Do the lookup.
6100 */
6101 pDevExt = pSession->pDevExt;
6102 rc = supdrvLdrLock(pDevExt);
6103 if (RT_SUCCESS(rc))
6104 {
6105 PSUPDRVLDRIMAGE pImage;
6106 for (pImage = pDevExt->pLdrImages; pImage; pImage = pImage->pNext)
6107 {
6108 if ( pImage->szName[cchName] == '\0'
6109 && !memcmp(pImage->szName, pszName, cchName))
6110 {
6111 /*
6112 * Check the state and make sure we don't overflow the reference counter before return it.
6113 */
6114 uint32_t uState = pImage->uState;
6115 if (uState == SUP_IOCTL_LDR_LOAD)
6116 {
6117 if (RT_LIKELY(pImage->cUsage < UINT32_MAX / 2U))
6118 {
6119 pImage->cUsage++;
6120 supdrvLdrAddUsage(pSession, pImage, false /*fRing3Usage*/);
6121 *phMod = pImage;
6122 supdrvLdrUnlock(pDevExt);
6123 return VINF_SUCCESS;
6124 }
6125 supdrvLdrUnlock(pDevExt);
6126 Log(("SUPR0LdrModByName: Too many existing references to '%s'!\n", pszName));
6127 return VERR_TOO_MANY_REFERENCES;
6128 }
6129 supdrvLdrUnlock(pDevExt);
6130 Log(("SUPR0LdrModByName: Module '%s' is not in the loaded state (%d)!\n", pszName, uState));
6131 return VERR_INVALID_STATE;
6132 }
6133 }
6134 supdrvLdrUnlock(pDevExt);
6135 Log(("SUPR0LdrModByName: Module '%s' not found!\n", pszName));
6136 rc = VERR_MODULE_NOT_FOUND;
6137 }
6138 return rc;
6139}
6140
6141
6142/**
6143 * Retains a ring-0 module reference.
6144 *
6145 * Release reference when done by calling SUPR0LdrModRelease().
6146 *
6147 * @returns VBox status code.
6148 * @param pSession The session to reference the module in. A usage
6149 * record is added if needed.
6150 * @param hMod The handle to the module to retain.
6151 */
6152SUPR0DECL(int) SUPR0LdrModRetain(PSUPDRVSESSION pSession, void *hMod)
6153{
6154 PSUPDRVDEVEXT pDevExt;
6155 PSUPDRVLDRIMAGE pImage;
6156 int rc;
6157
6158 /* Validate input a little. */
6159 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
6160 AssertPtrReturn(hMod, VERR_INVALID_HANDLE);
6161 pImage = (PSUPDRVLDRIMAGE)hMod;
6162 AssertReturn(pImage->uMagic == SUPDRVLDRIMAGE_MAGIC, VERR_INVALID_HANDLE);
6163
6164 /* Reference the module: */
6165 pDevExt = pSession->pDevExt;
6166 rc = supdrvLdrLock(pDevExt);
6167 if (RT_SUCCESS(rc))
6168 {
6169 if (pImage->uMagic == SUPDRVLDRIMAGE_MAGIC)
6170 {
6171 if (RT_LIKELY(pImage->cUsage < UINT32_MAX / 2U))
6172 {
6173 rc = supdrvLdrAddUsage(pSession, pImage, false /*fRing3Usage*/);
6174 if (RT_SUCCESS(rc))
6175 {
6176 pImage->cUsage++;
6177 rc = VINF_SUCCESS;
6178 }
6179 }
6180 else
6181 AssertFailedStmt(rc = VERR_TOO_MANY_REFERENCES);
6182 }
6183 else
6184 AssertFailedStmt(rc = VERR_INVALID_HANDLE);
6185 supdrvLdrUnlock(pDevExt);
6186 }
6187 return rc;
6188}
6189
6190
6191/**
6192 * Releases a ring-0 module reference retained by SUPR0LdrModByName() or
6193 * SUPR0LdrModRetain().
6194 *
6195 * @returns VBox status code.
6196 * @param pSession The session that the module was retained in.
6197 * @param hMod The module handle. NULL is silently ignored.
6198 */
6199SUPR0DECL(int) SUPR0LdrModRelease(PSUPDRVSESSION pSession, void *hMod)
6200{
6201 PSUPDRVDEVEXT pDevExt;
6202 PSUPDRVLDRIMAGE pImage;
6203 int rc;
6204
6205 /*
6206 * Validate input.
6207 */
6208 AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
6209 if (!hMod)
6210 return VINF_SUCCESS;
6211 AssertPtrReturn(hMod, VERR_INVALID_HANDLE);
6212 pImage = (PSUPDRVLDRIMAGE)hMod;
6213 AssertReturn(pImage->uMagic == SUPDRVLDRIMAGE_MAGIC, VERR_INVALID_HANDLE);
6214
6215 /*
6216 * Take the loader lock and revalidate the module:
6217 */
6218 pDevExt = pSession->pDevExt;
6219 rc = supdrvLdrLock(pDevExt);
6220 if (RT_SUCCESS(rc))
6221 {
6222 if (pImage->uMagic == SUPDRVLDRIMAGE_MAGIC)
6223 {
6224 /*
6225 * Find the usage record for the module:
6226 */
6227 PSUPDRVLDRUSAGE pPrevUsage = NULL;
6228 PSUPDRVLDRUSAGE pUsage;
6229
6230 rc = VERR_MODULE_NOT_FOUND;
6231 for (pUsage = pSession->pLdrUsage; pUsage; pUsage = pUsage->pNext)
6232 {
6233 if (pUsage->pImage == pImage)
6234 {
6235 /*
6236 * Drop a ring-0 reference:
6237 */
6238 Assert(pImage->cUsage >= pUsage->cRing0Usage + pUsage->cRing3Usage);
6239 if (pUsage->cRing0Usage > 0)
6240 {
6241 if (pImage->cUsage > 1)
6242 {
6243 pImage->cUsage -= 1;
6244 pUsage->cRing0Usage -= 1;
6245 rc = VINF_SUCCESS;
6246 }
6247 else
6248 {
6249 supdrvLdrFree(pDevExt, pImage);
6250
6251 if (pPrevUsage)
6252 pPrevUsage->pNext = pUsage->pNext;
6253 else
6254 pSession->pLdrUsage = pUsage->pNext;
6255 pUsage->pNext = NULL;
6256 pUsage->pImage = NULL;
6257 pUsage->cRing0Usage = 0;
6258 pUsage->cRing3Usage = 0;
6259 RTMemFree(pUsage);
6260
6261 rc = VINF_OBJECT_DESTROYED;
6262 }
6263 }
6264 else
6265 AssertFailedStmt(rc = VERR_CALLER_NO_REFERENCE);
6266 break;
6267 }
6268 pPrevUsage = pUsage;
6269 }
6270 }
6271 else
6272 AssertFailedStmt(rc = VERR_INVALID_HANDLE);
6273 supdrvLdrUnlock(pDevExt);
6274 }
6275 return rc;
6276
6277}
6278
6279
6280/**
6281 * Implements the service call request.
6282 *
6283 * @returns VBox status code.
6284 * @param pDevExt The device extension.
6285 * @param pSession The calling session.
6286 * @param pReq The request packet, valid.
6287 */
6288static int supdrvIOCtl_CallServiceModule(PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPCALLSERVICE pReq)
6289{
6290#if !defined(RT_OS_WINDOWS) || defined(RT_ARCH_AMD64) || defined(DEBUG)
6291 int rc;
6292
6293 /*
6294 * Find the module first in the module referenced by the calling session.
6295 */
6296 rc = supdrvLdrLock(pDevExt);
6297 if (RT_SUCCESS(rc))
6298 {
6299 PFNSUPR0SERVICEREQHANDLER pfnServiceReqHandler = NULL;
6300 PSUPDRVLDRUSAGE pUsage;
6301
6302 for (pUsage = pSession->pLdrUsage; pUsage; pUsage = pUsage->pNext)
6303 if ( pUsage->pImage->pfnServiceReqHandler
6304 && !strcmp(pUsage->pImage->szName, pReq->u.In.szName))
6305 {
6306 pfnServiceReqHandler = pUsage->pImage->pfnServiceReqHandler;
6307 break;
6308 }
6309 supdrvLdrUnlock(pDevExt);
6310
6311 if (pfnServiceReqHandler)
6312 {
6313 /*
6314 * Call it.
6315 */
6316 if (pReq->Hdr.cbIn == SUP_IOCTL_CALL_SERVICE_SIZE(0))
6317 rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, NULL);
6318 else
6319 rc = pfnServiceReqHandler(pSession, pReq->u.In.uOperation, pReq->u.In.u64Arg, (PSUPR0SERVICEREQHDR)&pReq->abReqPkt[0]);
6320 }
6321 else
6322 rc = VERR_SUPDRV_SERVICE_NOT_FOUND;
6323 }
6324
6325 /* log it */
6326 if ( RT_FAILURE(rc)
6327 && rc != VERR_INTERRUPTED
6328 && rc != VERR_TIMEOUT)
6329 Log(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
6330 rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
6331 else
6332 Log4(("SUP_IOCTL_CALL_SERVICE: rc=%Rrc op=%u out=%u arg=%RX64 p/t=%RTproc/%RTthrd\n",
6333 rc, pReq->u.In.uOperation, pReq->Hdr.cbOut, pReq->u.In.u64Arg, RTProcSelf(), RTThreadNativeSelf()));
6334 return rc;
6335#else /* RT_OS_WINDOWS && !RT_ARCH_AMD64 && !DEBUG */
6336 RT_NOREF3(pDevExt, pSession, pReq);
6337 return VERR_NOT_IMPLEMENTED;
6338#endif /* RT_OS_WINDOWS && !RT_ARCH_AMD64 && !DEBUG */
6339}
6340
6341
6342/**
6343 * Implements the logger settings request.
6344 *
6345 * @returns VBox status code.
6346 * @param pReq The request.
6347 */
6348static int supdrvIOCtl_LoggerSettings(PSUPLOGGERSETTINGS pReq)
6349{
6350 const char *pszGroup = &pReq->u.In.szStrings[pReq->u.In.offGroups];
6351 const char *pszFlags = &pReq->u.In.szStrings[pReq->u.In.offFlags];
6352 const char *pszDest = &pReq->u.In.szStrings[pReq->u.In.offDestination];
6353 PRTLOGGER pLogger = NULL;
6354 int rc;
6355
6356 /*
6357 * Some further validation.
6358 */
6359 switch (pReq->u.In.fWhat)
6360 {
6361 case SUPLOGGERSETTINGS_WHAT_SETTINGS:
6362 case SUPLOGGERSETTINGS_WHAT_CREATE:
6363 break;
6364
6365 case SUPLOGGERSETTINGS_WHAT_DESTROY:
6366 if (*pszGroup || *pszFlags || *pszDest)
6367 return VERR_INVALID_PARAMETER;
6368 if (pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_RELEASE)
6369 return VERR_ACCESS_DENIED;
6370 break;
6371
6372 default:
6373 return VERR_INTERNAL_ERROR;
6374 }
6375
6376 /*
6377 * Get the logger.
6378 */
6379 switch (pReq->u.In.fWhich)
6380 {
6381 case SUPLOGGERSETTINGS_WHICH_DEBUG:
6382 pLogger = RTLogGetDefaultInstance();
6383 break;
6384
6385 case SUPLOGGERSETTINGS_WHICH_RELEASE:
6386 pLogger = RTLogRelGetDefaultInstance();
6387 break;
6388
6389 default:
6390 return VERR_INTERNAL_ERROR;
6391 }
6392
6393 /*
6394 * Do the job.
6395 */
6396 switch (pReq->u.In.fWhat)
6397 {
6398 case SUPLOGGERSETTINGS_WHAT_SETTINGS:
6399 if (pLogger)
6400 {
6401 rc = RTLogFlags(pLogger, pszFlags);
6402 if (RT_SUCCESS(rc))
6403 rc = RTLogGroupSettings(pLogger, pszGroup);
6404 NOREF(pszDest);
6405 }
6406 else
6407 rc = VERR_NOT_FOUND;
6408 break;
6409
6410 case SUPLOGGERSETTINGS_WHAT_CREATE:
6411 {
6412 if (pLogger)
6413 rc = VERR_ALREADY_EXISTS;
6414 else
6415 {
6416 static const char * const s_apszGroups[] = VBOX_LOGGROUP_NAMES;
6417
6418 rc = RTLogCreate(&pLogger,
6419 0 /* fFlags */,
6420 pszGroup,
6421 pReq->u.In.fWhich == SUPLOGGERSETTINGS_WHICH_DEBUG
6422 ? "VBOX_LOG"
6423 : "VBOX_RELEASE_LOG",
6424 RT_ELEMENTS(s_apszGroups),
6425 s_apszGroups,
6426 RTLOGDEST_STDOUT | RTLOGDEST_DEBUGGER,
6427 NULL);
6428 if (RT_SUCCESS(rc))
6429 {
6430 rc = RTLogFlags(pLogger, pszFlags);
6431 NOREF(pszDest);
6432 if (RT_SUCCESS(rc))
6433 {
6434 switch (pReq->u.In.fWhich)
6435 {
6436 case SUPLOGGERSETTINGS_WHICH_DEBUG:
6437 pLogger = RTLogSetDefaultInstance(pLogger);
6438 break;
6439 case SUPLOGGERSETTINGS_WHICH_RELEASE:
6440 pLogger = RTLogRelSetDefaultInstance(pLogger);
6441 break;
6442 }
6443 }
6444 RTLogDestroy(pLogger);
6445 }
6446 }
6447 break;
6448 }
6449
6450 case SUPLOGGERSETTINGS_WHAT_DESTROY:
6451 switch (pReq->u.In.fWhich)
6452 {
6453 case SUPLOGGERSETTINGS_WHICH_DEBUG:
6454 pLogger = RTLogSetDefaultInstance(NULL);
6455 break;
6456 case SUPLOGGERSETTINGS_WHICH_RELEASE:
6457 pLogger = RTLogRelSetDefaultInstance(NULL);
6458 break;
6459 }
6460 rc = RTLogDestroy(pLogger);
6461 break;
6462
6463 default:
6464 {
6465 rc = VERR_INTERNAL_ERROR;
6466 break;
6467 }
6468 }
6469
6470 return rc;
6471}
6472
6473
6474/**
6475 * Implements the MSR prober operations.
6476 *
6477 * @returns VBox status code.
6478 * @param pDevExt The device extension.
6479 * @param pReq The request.
6480 */
6481static int supdrvIOCtl_MsrProber(PSUPDRVDEVEXT pDevExt, PSUPMSRPROBER pReq)
6482{
6483#ifdef SUPDRV_WITH_MSR_PROBER
6484 RTCPUID const idCpu = pReq->u.In.idCpu == UINT32_MAX ? NIL_RTCPUID : pReq->u.In.idCpu;
6485 int rc;
6486
6487 switch (pReq->u.In.enmOp)
6488 {
6489 case SUPMSRPROBEROP_READ:
6490 {
6491 uint64_t uValue;
6492 rc = supdrvOSMsrProberRead(pReq->u.In.uMsr, idCpu, &uValue);
6493 if (RT_SUCCESS(rc))
6494 {
6495 pReq->u.Out.uResults.Read.uValue = uValue;
6496 pReq->u.Out.uResults.Read.fGp = false;
6497 }
6498 else if (rc == VERR_ACCESS_DENIED)
6499 {
6500 pReq->u.Out.uResults.Read.uValue = 0;
6501 pReq->u.Out.uResults.Read.fGp = true;
6502 rc = VINF_SUCCESS;
6503 }
6504 break;
6505 }
6506
6507 case SUPMSRPROBEROP_WRITE:
6508 rc = supdrvOSMsrProberWrite(pReq->u.In.uMsr, idCpu, pReq->u.In.uArgs.Write.uToWrite);
6509 if (RT_SUCCESS(rc))
6510 pReq->u.Out.uResults.Write.fGp = false;
6511 else if (rc == VERR_ACCESS_DENIED)
6512 {
6513 pReq->u.Out.uResults.Write.fGp = true;
6514 rc = VINF_SUCCESS;
6515 }
6516 break;
6517
6518 case SUPMSRPROBEROP_MODIFY:
6519 case SUPMSRPROBEROP_MODIFY_FASTER:
6520 rc = supdrvOSMsrProberModify(idCpu, pReq);
6521 break;
6522
6523 default:
6524 return VERR_INVALID_FUNCTION;
6525 }
6526 RT_NOREF1(pDevExt);
6527 return rc;
6528#else
6529 RT_NOREF2(pDevExt, pReq);
6530 return VERR_NOT_IMPLEMENTED;
6531#endif
6532}
6533
6534
6535/**
6536 * Resume built-in keyboard on MacBook Air and Pro hosts.
6537 * If there is no built-in keyboard device, return success anyway.
6538 *
6539 * @returns 0 on Mac OS X platform, VERR_NOT_IMPLEMENTED on the other ones.
6540 */
6541static int supdrvIOCtl_ResumeSuspendedKbds(void)
6542{
6543#if defined(RT_OS_DARWIN)
6544 return supdrvDarwinResumeSuspendedKbds();
6545#else
6546 return VERR_NOT_IMPLEMENTED;
6547#endif
6548}
6549
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette