1 | /* $Id: initterm-r0drv-nt.cpp 70341 2017-12-26 14:42:28Z vboxsync $ */
|
---|
2 | /** @file
|
---|
3 | * IPRT - Initialization & Termination, R0 Driver, NT.
|
---|
4 | */
|
---|
5 |
|
---|
6 | /*
|
---|
7 | * Copyright (C) 2006-2017 Oracle Corporation
|
---|
8 | *
|
---|
9 | * This file is part of VirtualBox Open Source Edition (OSE), as
|
---|
10 | * available from http://www.virtualbox.org. This file is free software;
|
---|
11 | * you can redistribute it and/or modify it under the terms of the GNU
|
---|
12 | * General Public License (GPL) as published by the Free Software
|
---|
13 | * Foundation, in version 2 as it comes in the "COPYING" file of the
|
---|
14 | * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
|
---|
15 | * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
|
---|
16 | *
|
---|
17 | * The contents of this file may alternatively be used under the terms
|
---|
18 | * of the Common Development and Distribution License Version 1.0
|
---|
19 | * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
|
---|
20 | * VirtualBox OSE distribution, in which case the provisions of the
|
---|
21 | * CDDL are applicable instead of those of the GPL.
|
---|
22 | *
|
---|
23 | * You may elect to license modified versions of this file under the
|
---|
24 | * terms and conditions of either the GPL or the CDDL or both.
|
---|
25 | */
|
---|
26 |
|
---|
27 |
|
---|
28 | /*********************************************************************************************************************************
|
---|
29 | * Header Files *
|
---|
30 | *********************************************************************************************************************************/
|
---|
31 | #include "the-nt-kernel.h"
|
---|
32 | #include <iprt/asm-amd64-x86.h>
|
---|
33 | #include <iprt/dbg.h>
|
---|
34 | #include <iprt/err.h>
|
---|
35 | #include <iprt/string.h>
|
---|
36 | #include "internal/initterm.h"
|
---|
37 | #include "internal-r0drv-nt.h"
|
---|
38 | #include "symdb.h"
|
---|
39 | #include "symdbdata.h"
|
---|
40 |
|
---|
41 |
|
---|
42 | /*********************************************************************************************************************************
|
---|
43 | * Global Variables *
|
---|
44 | *********************************************************************************************************************************/
|
---|
45 | /** ExAllocatePoolWithTag, introduced in W2K. */
|
---|
46 | decltype(ExAllocatePoolWithTag) *g_pfnrtExAllocatePoolWithTag;
|
---|
47 | /** ExFreePoolWithTag, introduced in W2K. */
|
---|
48 | decltype(ExFreePoolWithTag) *g_pfnrtExFreePoolWithTag;
|
---|
49 | /** ExSetTimerResolution, introduced in W2K. */
|
---|
50 | PFNMYEXSETTIMERRESOLUTION g_pfnrtNtExSetTimerResolution;
|
---|
51 | /** KeFlushQueuedDpcs, introduced in XP. */
|
---|
52 | PFNMYKEFLUSHQUEUEDDPCS g_pfnrtNtKeFlushQueuedDpcs;
|
---|
53 | /** HalRequestIpi, version introduced with windows 7. */
|
---|
54 | PFNHALREQUESTIPI_W7PLUS g_pfnrtHalRequestIpiW7Plus;
|
---|
55 | /** HalRequestIpi, version valid up to windows vista?? */
|
---|
56 | PFNHALREQUESTIPI_PRE_W7 g_pfnrtHalRequestIpiPreW7;
|
---|
57 | /** Worker for RTMpPokeCpu. */
|
---|
58 | PFNRTSENDIPI g_pfnrtMpPokeCpuWorker;
|
---|
59 | /** KeIpiGenericCall - Introduced in Windows Server 2003. */
|
---|
60 | PFNRTKEIPIGENERICCALL g_pfnrtKeIpiGenericCall;
|
---|
61 | /** KeSetTargetProcessorDpcEx - Introduced in Windows 7. */
|
---|
62 | PFNKESETTARGETPROCESSORDPCEX g_pfnrtKeSetTargetProcessorDpcEx;
|
---|
63 | /** KeInitializeAffinityEx - Introducted in Windows 7. */
|
---|
64 | PFNKEINITIALIZEAFFINITYEX g_pfnrtKeInitializeAffinityEx;
|
---|
65 | /** KeAddProcessorAffinityEx - Introducted in Windows 7. */
|
---|
66 | PFNKEADDPROCESSORAFFINITYEX g_pfnrtKeAddProcessorAffinityEx;
|
---|
67 | /** KeGetProcessorIndexFromNumber - Introducted in Windows 7. */
|
---|
68 | PFNKEGETPROCESSORINDEXFROMNUMBER g_pfnrtKeGetProcessorIndexFromNumber;
|
---|
69 | /** KeGetProcessorNumberFromIndex - Introducted in Windows 7. */
|
---|
70 | PFNKEGETPROCESSORNUMBERFROMINDEX g_pfnrtKeGetProcessorNumberFromIndex;
|
---|
71 | /** KeGetCurrentProcessorNumberEx - Introducted in Windows 7. */
|
---|
72 | PFNKEGETCURRENTPROCESSORNUMBEREX g_pfnrtKeGetCurrentProcessorNumberEx;
|
---|
73 | /** KeQueryActiveProcessors - Introducted in Windows 2000. */
|
---|
74 | PFNKEQUERYACTIVEPROCESSORS g_pfnrtKeQueryActiveProcessors;
|
---|
75 | /** KeQueryMaximumProcessorCount - Introducted in Vista and obsoleted W7. */
|
---|
76 | PFNKEQUERYMAXIMUMPROCESSORCOUNT g_pfnrtKeQueryMaximumProcessorCount;
|
---|
77 | /** KeQueryMaximumProcessorCountEx - Introducted in Windows 7. */
|
---|
78 | PFNKEQUERYMAXIMUMPROCESSORCOUNTEX g_pfnrtKeQueryMaximumProcessorCountEx;
|
---|
79 | /** KeQueryMaximumGroupCount - Introducted in Windows 7. */
|
---|
80 | PFNKEQUERYMAXIMUMGROUPCOUNT g_pfnrtKeQueryMaximumGroupCount;
|
---|
81 | /** KeQueryActiveProcessorCount - Introducted in Vista and obsoleted W7. */
|
---|
82 | PFNKEQUERYACTIVEPROCESSORCOUNT g_pfnrtKeQueryActiveProcessorCount;
|
---|
83 | /** KeQueryActiveProcessorCountEx - Introducted in Windows 7. */
|
---|
84 | PFNKEQUERYACTIVEPROCESSORCOUNTEX g_pfnrtKeQueryActiveProcessorCountEx;
|
---|
85 | /** KeQueryLogicalProcessorRelationship - Introducted in Windows 7. */
|
---|
86 | PFNKEQUERYLOGICALPROCESSORRELATIONSHIP g_pfnrtKeQueryLogicalProcessorRelationship;
|
---|
87 | /** KeRegisterProcessorChangeCallback - Introducted in Windows 7. */
|
---|
88 | PFNKEREGISTERPROCESSORCHANGECALLBACK g_pfnrtKeRegisterProcessorChangeCallback;
|
---|
89 | /** KeDeregisterProcessorChangeCallback - Introducted in Windows 7. */
|
---|
90 | PFNKEDEREGISTERPROCESSORCHANGECALLBACK g_pfnrtKeDeregisterProcessorChangeCallback;
|
---|
91 | /** KeSetImportanceDpc - Introducted in NT 3.51. */
|
---|
92 | decltype(KeSetImportanceDpc) *g_pfnrtKeSetImportanceDpc;
|
---|
93 | /** KeSetTargetProcessorDpc - Introducted in NT 3.51. */
|
---|
94 | decltype(KeSetTargetProcessorDpc) *g_pfnrtKeSetTargetProcessorDpc;
|
---|
95 | /** KeInitializeTimerEx - Introduced in NT 4. */
|
---|
96 | decltype(KeInitializeTimerEx) *g_pfnrtKeInitializeTimerEx;
|
---|
97 | /** Pointer to the MmProtectMdlSystemAddress kernel function if it's available.
|
---|
98 | * This API was introduced in XP. */
|
---|
99 | decltype(MmProtectMdlSystemAddress) *g_pfnrtMmProtectMdlSystemAddress;
|
---|
100 | /** MmAllocatePagesForMdl - Introduced in Windows 2000. */
|
---|
101 | decltype(MmAllocatePagesForMdl) *g_pfnrtMmAllocatePagesForMdl;
|
---|
102 | /** MmFreePagesFromMdl - Introduced in Windows 2000. */
|
---|
103 | decltype(MmFreePagesFromMdl) *g_pfnrtMmFreePagesFromMdl;
|
---|
104 | /** MmMapLockedPagesSpecifyCache - Introduced in Windows NT4 SP4. */
|
---|
105 | decltype(MmMapLockedPagesSpecifyCache) *g_pfnrtMmMapLockedPagesSpecifyCache;
|
---|
106 | /** MmAllocateContiguousMemorySpecifyCache - Introduced in Windows 2000. */
|
---|
107 | decltype(MmAllocateContiguousMemorySpecifyCache) *g_pfnrtMmAllocateContiguousMemorySpecifyCache;
|
---|
108 | /** MmSecureVirtualMemory - Introduced in NT 3.51. */
|
---|
109 | decltype(MmSecureVirtualMemory) *g_pfnrtMmSecureVirtualMemory;
|
---|
110 | /** MmUnsecureVirtualMemory - Introduced in NT 3.51. */
|
---|
111 | decltype(MmUnsecureVirtualMemory) *g_pfnrtMmUnsecureVirtualMemory;
|
---|
112 | /** RtlGetVersion, introduced in ??. */
|
---|
113 | PFNRTRTLGETVERSION g_pfnrtRtlGetVersion;
|
---|
114 | #ifdef RT_ARCH_X86
|
---|
115 | /** KeQueryInterruptTime - exported/new in Windows 2000. */
|
---|
116 | PFNRTKEQUERYINTERRUPTTIME g_pfnrtKeQueryInterruptTime;
|
---|
117 | #endif
|
---|
118 | /** KeQueryInterruptTimePrecise - new in Windows 8. */
|
---|
119 | PFNRTKEQUERYINTERRUPTTIMEPRECISE g_pfnrtKeQueryInterruptTimePrecise;
|
---|
120 | /** KeQuerySystemTimePrecise - new in Windows 8. */
|
---|
121 | PFNRTKEQUERYSYSTEMTIMEPRECISE g_pfnrtKeQuerySystemTimePrecise;
|
---|
122 |
|
---|
123 | /** Offset of the _KPRCB::QuantumEnd field. 0 if not found. */
|
---|
124 | uint32_t g_offrtNtPbQuantumEnd;
|
---|
125 | /** Size of the _KPRCB::QuantumEnd field. 0 if not found. */
|
---|
126 | uint32_t g_cbrtNtPbQuantumEnd;
|
---|
127 | /** Offset of the _KPRCB::DpcQueueDepth field. 0 if not found. */
|
---|
128 | uint32_t g_offrtNtPbDpcQueueDepth;
|
---|
129 |
|
---|
130 | /** The combined NT version, see RTNT_MAKE_VERSION. */
|
---|
131 | uint32_t g_uRtNtVersion = RTNT_MAKE_VERSION(4, 0);
|
---|
132 | /** The major version number. */
|
---|
133 | uint8_t g_uRtNtMajorVer;
|
---|
134 | /** The minor version number. */
|
---|
135 | uint8_t g_uRtNtMinorVer;
|
---|
136 | /** The build number. */
|
---|
137 | uint32_t g_uRtNtBuildNo;
|
---|
138 |
|
---|
139 | /** Pointer to the MmHighestUserAddress kernel variable - can be NULL. */
|
---|
140 | uintptr_t const *g_puRtMmHighestUserAddress;
|
---|
141 | /** Pointer to the MmSystemRangeStart kernel variable - can be NULL. */
|
---|
142 | uintptr_t const *g_puRtMmSystemRangeStart;
|
---|
143 |
|
---|
144 |
|
---|
145 | /**
|
---|
146 | * Determines the NT kernel verison information.
|
---|
147 | *
|
---|
148 | * @param pOsVerInfo Where to return the version information.
|
---|
149 | *
|
---|
150 | * @remarks pOsVerInfo->fSmp is only definitive if @c true.
|
---|
151 | * @remarks pOsVerInfo->uCsdNo is set to MY_NIL_CSD if it cannot be determined.
|
---|
152 | */
|
---|
153 | static void rtR0NtGetOsVersionInfo(PRTNTSDBOSVER pOsVerInfo)
|
---|
154 | {
|
---|
155 | ULONG ulMajorVersion = 0;
|
---|
156 | ULONG ulMinorVersion = 0;
|
---|
157 | ULONG ulBuildNumber = 0;
|
---|
158 |
|
---|
159 | pOsVerInfo->fChecked = PsGetVersion(&ulMajorVersion, &ulMinorVersion, &ulBuildNumber, NULL) == TRUE;
|
---|
160 | pOsVerInfo->uMajorVer = (uint8_t)ulMajorVersion;
|
---|
161 | pOsVerInfo->uMinorVer = (uint8_t)ulMinorVersion;
|
---|
162 | pOsVerInfo->uBuildNo = ulBuildNumber;
|
---|
163 | #define MY_NIL_CSD 0x3f
|
---|
164 | pOsVerInfo->uCsdNo = MY_NIL_CSD;
|
---|
165 |
|
---|
166 | if (g_pfnrtRtlGetVersion)
|
---|
167 | {
|
---|
168 | RTL_OSVERSIONINFOEXW VerInfo;
|
---|
169 | RT_ZERO(VerInfo);
|
---|
170 | VerInfo.dwOSVersionInfoSize = sizeof(VerInfo);
|
---|
171 |
|
---|
172 | NTSTATUS rcNt = g_pfnrtRtlGetVersion(&VerInfo);
|
---|
173 | if (NT_SUCCESS(rcNt))
|
---|
174 | pOsVerInfo->uCsdNo = VerInfo.wServicePackMajor;
|
---|
175 | }
|
---|
176 |
|
---|
177 | /* Note! We cannot quite say if something is MP or UNI. So, fSmp is
|
---|
178 | redefined to indicate that it must be MP.
|
---|
179 | Note! RTMpGetCount is not available here. */
|
---|
180 | pOsVerInfo->fSmp = ulMajorVersion >= 6; /* Vista and later has no UNI kernel AFAIK. */
|
---|
181 | if (!pOsVerInfo->fSmp)
|
---|
182 | {
|
---|
183 | if ( g_pfnrtKeQueryMaximumProcessorCountEx
|
---|
184 | && g_pfnrtKeQueryMaximumProcessorCountEx(ALL_PROCESSOR_GROUPS) > 1)
|
---|
185 | pOsVerInfo->fSmp = true;
|
---|
186 | else if ( g_pfnrtKeQueryMaximumProcessorCount
|
---|
187 | && g_pfnrtKeQueryMaximumProcessorCount() > 1)
|
---|
188 | pOsVerInfo->fSmp = true;
|
---|
189 | else if ( g_pfnrtKeQueryActiveProcessors
|
---|
190 | && g_pfnrtKeQueryActiveProcessors() > 1)
|
---|
191 | pOsVerInfo->fSmp = true;
|
---|
192 | else if (KeNumberProcessors > 1)
|
---|
193 | pOsVerInfo->fSmp = true;
|
---|
194 | }
|
---|
195 | }
|
---|
196 |
|
---|
197 |
|
---|
198 | /**
|
---|
199 | * Tries a set against the current kernel.
|
---|
200 | *
|
---|
201 | * @retval true if it matched up, global variables are updated.
|
---|
202 | * @retval false otherwise (no globals updated).
|
---|
203 | * @param pSet The data set.
|
---|
204 | * @param pbPrcb Pointer to the processor control block.
|
---|
205 | * @param pszVendor Pointer to the processor vendor string.
|
---|
206 | * @param pOsVerInfo The OS version info.
|
---|
207 | */
|
---|
208 | static bool rtR0NtTryMatchSymSet(PCRTNTSDBSET pSet, uint8_t *pbPrcb, const char *pszVendor, PCRTNTSDBOSVER pOsVerInfo)
|
---|
209 | {
|
---|
210 | /*
|
---|
211 | * Don't bother trying stuff where the NT kernel version number differs, or
|
---|
212 | * if the build type or SMPness doesn't match up.
|
---|
213 | */
|
---|
214 | if ( pSet->OsVerInfo.uMajorVer != pOsVerInfo->uMajorVer
|
---|
215 | || pSet->OsVerInfo.uMinorVer != pOsVerInfo->uMinorVer
|
---|
216 | || pSet->OsVerInfo.fChecked != pOsVerInfo->fChecked
|
---|
217 | || (!pSet->OsVerInfo.fSmp && pOsVerInfo->fSmp /*must-be-smp*/) )
|
---|
218 | {
|
---|
219 | //DbgPrint("IPRT: #%d Version/type mismatch.\n", pSet - &g_artNtSdbSets[0]);
|
---|
220 | return false;
|
---|
221 | }
|
---|
222 |
|
---|
223 | /*
|
---|
224 | * Do the CPU vendor test.
|
---|
225 | *
|
---|
226 | * Note! The MmIsAddressValid call is the real #PF security here as the
|
---|
227 | * __try/__except has limited/no ability to catch everything we need.
|
---|
228 | */
|
---|
229 | char *pszPrcbVendorString = (char *)&pbPrcb[pSet->KPRCB.offVendorString];
|
---|
230 | if (!MmIsAddressValid(&pszPrcbVendorString[4 * 3 - 1]))
|
---|
231 | {
|
---|
232 | //DbgPrint("IPRT: #%d invalid vendor string address.\n", pSet - &g_artNtSdbSets[0]);
|
---|
233 | return false;
|
---|
234 | }
|
---|
235 | __try
|
---|
236 | {
|
---|
237 | if (memcmp(pszPrcbVendorString, pszVendor, RT_MIN(4 * 3, pSet->KPRCB.cbVendorString)) != 0)
|
---|
238 | {
|
---|
239 | //DbgPrint("IPRT: #%d Vendor string mismatch.\n", pSet - &g_artNtSdbSets[0]);
|
---|
240 | return false;
|
---|
241 | }
|
---|
242 | }
|
---|
243 | __except(EXCEPTION_EXECUTE_HANDLER)
|
---|
244 | {
|
---|
245 | DbgPrint("IPRT: %#d Exception\n", pSet - &g_artNtSdbSets[0]);
|
---|
246 | return false;
|
---|
247 | }
|
---|
248 |
|
---|
249 | /*
|
---|
250 | * Got a match, update the global variables and report succcess.
|
---|
251 | */
|
---|
252 | g_offrtNtPbQuantumEnd = pSet->KPRCB.offQuantumEnd;
|
---|
253 | g_cbrtNtPbQuantumEnd = pSet->KPRCB.cbQuantumEnd;
|
---|
254 | g_offrtNtPbDpcQueueDepth = pSet->KPRCB.offDpcQueueDepth;
|
---|
255 |
|
---|
256 | #if 0
|
---|
257 | DbgPrint("IPRT: Using data set #%u for %u.%usp%u build %u %s %s.\n",
|
---|
258 | pSet - &g_artNtSdbSets[0],
|
---|
259 | pSet->OsVerInfo.uMajorVer,
|
---|
260 | pSet->OsVerInfo.uMinorVer,
|
---|
261 | pSet->OsVerInfo.uCsdNo,
|
---|
262 | pSet->OsVerInfo.uBuildNo,
|
---|
263 | pSet->OsVerInfo.fSmp ? "smp" : "uni",
|
---|
264 | pSet->OsVerInfo.fChecked ? "checked" : "free");
|
---|
265 | #endif
|
---|
266 | return true;
|
---|
267 | }
|
---|
268 |
|
---|
269 |
|
---|
270 | DECLHIDDEN(int) rtR0InitNative(void)
|
---|
271 | {
|
---|
272 | /*
|
---|
273 | * Initialize the function pointers.
|
---|
274 | */
|
---|
275 | RTDBGKRNLINFO hKrnlInfo;
|
---|
276 | int rc = RTR0DbgKrnlInfoOpen(&hKrnlInfo, 0/*fFlags*/);
|
---|
277 | AssertRCReturn(rc, rc);
|
---|
278 |
|
---|
279 | #define GET_SYSTEM_ROUTINE_EX(a_Prf, a_Name, a_pfnType) \
|
---|
280 | do { RT_CONCAT3(g_pfnrt, a_Prf, a_Name) = (a_pfnType)RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, #a_Name); } while (0)
|
---|
281 | #define GET_SYSTEM_ROUTINE(a_Name) GET_SYSTEM_ROUTINE_EX(RT_NOTHING, a_Name, decltype(a_Name) *)
|
---|
282 | #define GET_SYSTEM_ROUTINE_PRF(a_Prf,a_Name) GET_SYSTEM_ROUTINE_EX(a_Prf, a_Name, decltype(a_Name) *)
|
---|
283 | #define GET_SYSTEM_ROUTINE_TYPE(a_Name, a_pfnType) GET_SYSTEM_ROUTINE_EX(RT_NOTHING, a_Name, a_pfnType)
|
---|
284 |
|
---|
285 | GET_SYSTEM_ROUTINE(ExAllocatePoolWithTag);
|
---|
286 | GET_SYSTEM_ROUTINE(ExFreePoolWithTag);
|
---|
287 | GET_SYSTEM_ROUTINE_PRF(Nt,ExSetTimerResolution);
|
---|
288 | GET_SYSTEM_ROUTINE_PRF(Nt,KeFlushQueuedDpcs);
|
---|
289 | GET_SYSTEM_ROUTINE(KeIpiGenericCall);
|
---|
290 | GET_SYSTEM_ROUTINE(KeSetTargetProcessorDpcEx);
|
---|
291 | GET_SYSTEM_ROUTINE(KeInitializeAffinityEx);
|
---|
292 | GET_SYSTEM_ROUTINE(KeAddProcessorAffinityEx);
|
---|
293 | GET_SYSTEM_ROUTINE_TYPE(KeGetProcessorIndexFromNumber, PFNKEGETPROCESSORINDEXFROMNUMBER);
|
---|
294 | GET_SYSTEM_ROUTINE(KeGetProcessorNumberFromIndex);
|
---|
295 | GET_SYSTEM_ROUTINE_TYPE(KeGetCurrentProcessorNumberEx, PFNKEGETCURRENTPROCESSORNUMBEREX);
|
---|
296 | GET_SYSTEM_ROUTINE(KeQueryActiveProcessors);
|
---|
297 | GET_SYSTEM_ROUTINE(KeQueryMaximumProcessorCount);
|
---|
298 | GET_SYSTEM_ROUTINE(KeQueryMaximumProcessorCountEx);
|
---|
299 | GET_SYSTEM_ROUTINE(KeQueryMaximumGroupCount);
|
---|
300 | GET_SYSTEM_ROUTINE(KeQueryActiveProcessorCount);
|
---|
301 | GET_SYSTEM_ROUTINE(KeQueryActiveProcessorCountEx);
|
---|
302 | GET_SYSTEM_ROUTINE(KeQueryLogicalProcessorRelationship);
|
---|
303 | GET_SYSTEM_ROUTINE(KeRegisterProcessorChangeCallback);
|
---|
304 | GET_SYSTEM_ROUTINE(KeDeregisterProcessorChangeCallback);
|
---|
305 | GET_SYSTEM_ROUTINE(KeSetImportanceDpc);
|
---|
306 | GET_SYSTEM_ROUTINE(KeSetTargetProcessorDpc);
|
---|
307 | GET_SYSTEM_ROUTINE(KeInitializeTimerEx);
|
---|
308 | GET_SYSTEM_ROUTINE(MmProtectMdlSystemAddress);
|
---|
309 | GET_SYSTEM_ROUTINE(MmAllocatePagesForMdl);
|
---|
310 | GET_SYSTEM_ROUTINE(MmFreePagesFromMdl);
|
---|
311 | GET_SYSTEM_ROUTINE(MmMapLockedPagesSpecifyCache);
|
---|
312 | GET_SYSTEM_ROUTINE(MmAllocateContiguousMemorySpecifyCache);
|
---|
313 | GET_SYSTEM_ROUTINE(MmSecureVirtualMemory);
|
---|
314 | GET_SYSTEM_ROUTINE(MmUnsecureVirtualMemory);
|
---|
315 |
|
---|
316 | GET_SYSTEM_ROUTINE_TYPE(RtlGetVersion, PFNRTRTLGETVERSION);
|
---|
317 | #ifdef RT_ARCH_X86
|
---|
318 | GET_SYSTEM_ROUTINE(KeQueryInterruptTime);
|
---|
319 | #endif
|
---|
320 | GET_SYSTEM_ROUTINE_TYPE(KeQueryInterruptTimePrecise, PFNRTKEQUERYINTERRUPTTIMEPRECISE);
|
---|
321 | GET_SYSTEM_ROUTINE_TYPE(KeQuerySystemTimePrecise, PFNRTKEQUERYSYSTEMTIMEPRECISE);
|
---|
322 |
|
---|
323 | g_pfnrtHalRequestIpiW7Plus = (PFNHALREQUESTIPI_W7PLUS)RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, "HalRequestIpi");
|
---|
324 | g_pfnrtHalRequestIpiPreW7 = (PFNHALREQUESTIPI_PRE_W7)g_pfnrtHalRequestIpiW7Plus;
|
---|
325 |
|
---|
326 | g_puRtMmHighestUserAddress = (uintptr_t const *)RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, "MmHighestUserAddress");
|
---|
327 | g_puRtMmSystemRangeStart = (uintptr_t const *)RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL, "MmSystemRangeStart");
|
---|
328 |
|
---|
329 | #ifdef RT_ARCH_X86
|
---|
330 | rc = rtR0Nt3InitSymbols(hKrnlInfo);
|
---|
331 | RTR0DbgKrnlInfoRelease(hKrnlInfo);
|
---|
332 | if (RT_FAILURE(rc))
|
---|
333 | return rc;
|
---|
334 | #else
|
---|
335 | RTR0DbgKrnlInfoRelease(hKrnlInfo);
|
---|
336 | #endif
|
---|
337 |
|
---|
338 | /*
|
---|
339 | * HACK ALERT! (and déjà vu warning - remember win32k.sys?)
|
---|
340 | *
|
---|
341 | * Try find _KPRCB::QuantumEnd and _KPRCB::[DpcData.]DpcQueueDepth.
|
---|
342 | * For purpose of verification we use the VendorString member (12+1 chars).
|
---|
343 | *
|
---|
344 | * The offsets was initially derived by poking around with windbg
|
---|
345 | * (dt _KPRCB, !prcb ++, and such like). Systematic harvesting was then
|
---|
346 | * planned using dia2dump, grep and the symbol pack in a manner like this:
|
---|
347 | * dia2dump -type _KDPC_DATA -type _KPRCB EXE\ntkrnlmp.pdb | grep -wE "QuantumEnd|DpcData|DpcQueueDepth|VendorString"
|
---|
348 | *
|
---|
349 | * The final solution ended up using a custom harvester program called
|
---|
350 | * ntBldSymDb that recursively searches thru unpacked symbol packages for
|
---|
351 | * the desired structure offsets. The program assumes that the packages
|
---|
352 | * are unpacked into directories with the same name as the package, with
|
---|
353 | * exception of some of the w2k packages which requires a 'w2k' prefix to
|
---|
354 | * be distinguishable from another.
|
---|
355 | */
|
---|
356 |
|
---|
357 | RTNTSDBOSVER OsVerInfo;
|
---|
358 | rtR0NtGetOsVersionInfo(&OsVerInfo);
|
---|
359 |
|
---|
360 | /* Publish the version info in globals. */
|
---|
361 | g_uRtNtVersion = RTNT_MAKE_VERSION(OsVerInfo.uMajorVer, OsVerInfo.uMinorVer);
|
---|
362 | g_uRtNtMinorVer = OsVerInfo.uMinorVer;
|
---|
363 | g_uRtNtMajorVer = OsVerInfo.uMajorVer;
|
---|
364 | g_uRtNtBuildNo = OsVerInfo.uBuildNo;
|
---|
365 |
|
---|
366 | /*
|
---|
367 | * Gather consistent CPU vendor string and PRCB pointers.
|
---|
368 | */
|
---|
369 | KIRQL OldIrql;
|
---|
370 | KeRaiseIrql(DISPATCH_LEVEL, &OldIrql); /* make sure we stay on the same cpu */
|
---|
371 |
|
---|
372 | union
|
---|
373 | {
|
---|
374 | uint32_t auRegs[4];
|
---|
375 | char szVendor[4*3+1];
|
---|
376 | } u;
|
---|
377 | ASMCpuId(0, &u.auRegs[3], &u.auRegs[0], &u.auRegs[2], &u.auRegs[1]);
|
---|
378 | u.szVendor[4*3] = '\0';
|
---|
379 |
|
---|
380 | uint8_t *pbPrcb;
|
---|
381 | __try /* Warning. This try/except statement may provide some false safety. */
|
---|
382 | {
|
---|
383 | #if defined(RT_ARCH_X86)
|
---|
384 | PKPCR pPcr = (PKPCR)__readfsdword(RT_OFFSETOF(KPCR,SelfPcr));
|
---|
385 | pbPrcb = (uint8_t *)pPcr->Prcb;
|
---|
386 | #elif defined(RT_ARCH_AMD64)
|
---|
387 | PKPCR pPcr = (PKPCR)__readgsqword(RT_OFFSETOF(KPCR,Self));
|
---|
388 | pbPrcb = (uint8_t *)pPcr->CurrentPrcb;
|
---|
389 | #else
|
---|
390 | # error "port me"
|
---|
391 | pbPrcb = NULL;
|
---|
392 | #endif
|
---|
393 | }
|
---|
394 | __except(EXCEPTION_EXECUTE_HANDLER)
|
---|
395 | {
|
---|
396 | pbPrcb = NULL;
|
---|
397 | }
|
---|
398 |
|
---|
399 | /*
|
---|
400 | * Search the database
|
---|
401 | */
|
---|
402 | if (pbPrcb)
|
---|
403 | {
|
---|
404 | /* Find the best matching kernel version based on build number. */
|
---|
405 | uint32_t iBest = UINT32_MAX;
|
---|
406 | int32_t iBestDelta = INT32_MAX;
|
---|
407 | for (uint32_t i = 0; i < RT_ELEMENTS(g_artNtSdbSets); i++)
|
---|
408 | {
|
---|
409 | if (g_artNtSdbSets[i].OsVerInfo.fChecked != OsVerInfo.fChecked)
|
---|
410 | continue;
|
---|
411 | if (OsVerInfo.fSmp /*must-be-smp*/ && !g_artNtSdbSets[i].OsVerInfo.fSmp)
|
---|
412 | continue;
|
---|
413 |
|
---|
414 | int32_t iDelta = RT_ABS((int32_t)OsVerInfo.uBuildNo - (int32_t)g_artNtSdbSets[i].OsVerInfo.uBuildNo);
|
---|
415 | if ( iDelta == 0
|
---|
416 | && (g_artNtSdbSets[i].OsVerInfo.uCsdNo == OsVerInfo.uCsdNo || OsVerInfo.uCsdNo == MY_NIL_CSD))
|
---|
417 | {
|
---|
418 | /* prefect */
|
---|
419 | iBestDelta = iDelta;
|
---|
420 | iBest = i;
|
---|
421 | break;
|
---|
422 | }
|
---|
423 | if ( iDelta < iBestDelta
|
---|
424 | || iBest == UINT32_MAX
|
---|
425 | || ( iDelta == iBestDelta
|
---|
426 | && OsVerInfo.uCsdNo != MY_NIL_CSD
|
---|
427 | && RT_ABS(g_artNtSdbSets[i ].OsVerInfo.uCsdNo - (int32_t)OsVerInfo.uCsdNo)
|
---|
428 | < RT_ABS(g_artNtSdbSets[iBest].OsVerInfo.uCsdNo - (int32_t)OsVerInfo.uCsdNo)
|
---|
429 | )
|
---|
430 | )
|
---|
431 | {
|
---|
432 | iBestDelta = iDelta;
|
---|
433 | iBest = i;
|
---|
434 | }
|
---|
435 | }
|
---|
436 | if (iBest < RT_ELEMENTS(g_artNtSdbSets))
|
---|
437 | {
|
---|
438 | /* Try all sets: iBest -> End; iBest -> Start. */
|
---|
439 | bool fDone = false;
|
---|
440 | int32_t i = iBest;
|
---|
441 | while ( i < RT_ELEMENTS(g_artNtSdbSets)
|
---|
442 | && !(fDone = rtR0NtTryMatchSymSet(&g_artNtSdbSets[i], pbPrcb, u.szVendor, &OsVerInfo)))
|
---|
443 | i++;
|
---|
444 | if (!fDone)
|
---|
445 | {
|
---|
446 | i = (int32_t)iBest - 1;
|
---|
447 | while ( i >= 0
|
---|
448 | && !(fDone = rtR0NtTryMatchSymSet(&g_artNtSdbSets[i], pbPrcb, u.szVendor, &OsVerInfo)))
|
---|
449 | i--;
|
---|
450 | }
|
---|
451 | }
|
---|
452 | else
|
---|
453 | DbgPrint("IPRT: Failed to locate data set.\n");
|
---|
454 | }
|
---|
455 | else
|
---|
456 | DbgPrint("IPRT: Failed to get PCBR pointer.\n");
|
---|
457 |
|
---|
458 | KeLowerIrql(OldIrql); /* Lowering the IRQL early in the hope that we may catch exceptions below. */
|
---|
459 |
|
---|
460 | #ifndef IN_GUEST
|
---|
461 | if (!g_offrtNtPbQuantumEnd && !g_offrtNtPbDpcQueueDepth)
|
---|
462 | DbgPrint("IPRT: Neither _KPRCB::QuantumEnd nor _KPRCB::DpcQueueDepth was not found! Kernel %u.%u %u %s\n",
|
---|
463 | OsVerInfo.uMajorVer, OsVerInfo.uMinorVer, OsVerInfo.uBuildNo, OsVerInfo.fChecked ? "checked" : "free");
|
---|
464 | # ifdef DEBUG
|
---|
465 | else
|
---|
466 | DbgPrint("IPRT: _KPRCB:{.QuantumEnd=%x/%d, .DpcQueueDepth=%x/%d} Kernel %u.%u %u %s\n",
|
---|
467 | g_offrtNtPbQuantumEnd, g_cbrtNtPbQuantumEnd, g_offrtNtPbDpcQueueDepth, g_offrtNtPbDpcQueueDepth,
|
---|
468 | OsVerInfo.uMajorVer, OsVerInfo.uMinorVer, OsVerInfo.uBuildNo, OsVerInfo.fChecked ? "checked" : "free");
|
---|
469 | # endif
|
---|
470 | #endif
|
---|
471 |
|
---|
472 | /*
|
---|
473 | * Initialize multi processor stuff. This registers a callback, so
|
---|
474 | * we call rtR0TermNative to do the deregistration on failure.
|
---|
475 | */
|
---|
476 | rc = rtR0MpNtInit(&OsVerInfo);
|
---|
477 | if (RT_FAILURE(rc))
|
---|
478 | {
|
---|
479 | rtR0TermNative();
|
---|
480 | DbgPrint("IPRT: Fatal: rtR0MpNtInit failed: %d\n", rc);
|
---|
481 | return rc;
|
---|
482 | }
|
---|
483 |
|
---|
484 | return VINF_SUCCESS;
|
---|
485 | }
|
---|
486 |
|
---|
487 |
|
---|
488 | DECLHIDDEN(void) rtR0TermNative(void)
|
---|
489 | {
|
---|
490 | rtR0MpNtTerm();
|
---|
491 | }
|
---|
492 |
|
---|