Changeset 20528 in vbox for trunk/src

Timestamp:

Jun 13, 2009 8:21:48 PM (16 years ago)

Author:

vboxsync

Message:

SUP: SUPR0PageProtect & SUPR0PageProtect - for creating guard (hyper) heap/stack pages.

Location:

trunk/src/VBox/HostDrivers/Support

Files:

• SUPDrv.c (modified) (5 diffs)
• SUPDrvIOC.h (modified) (2 diffs)
• SUPLib.cpp (modified) (2 diffs)
• win/SUPDrvA-win.asm (modified) (1 diff)

trunk/src/VBox/HostDrivers/Support/SUPDrv.c

@@ -209 +209 @@
 DECLASM(int)    UNWIND_WRAP(RTR0MemObjMapKernelEx)(PRTR0MEMOBJ pMemObj, RTR0MEMOBJ MemObjToMap, void *pvFixed, size_t uAlignment, unsigned fProt, size_t offSub, size_t cbSub);
 DECLASM(int)    UNWIND_WRAP(RTR0MemObjMapUser)(PRTR0MEMOBJ pMemObj, RTR0MEMOBJ MemObjToMap, RTR3PTR R3PtrFixed, size_t uAlignment, unsigned fProt, RTR0PROCESS R0Process);
+DECLASM(int)    UNWIND_WRAP(RTR0MemObjProtect)(RTR0MEMOBJ hMemObj, size_t offsub, size_t cbSub, uint32_t fProt);
 /*DECLASM(void *) UNWIND_WRAP(RTR0MemObjAddress)(RTR0MEMOBJ MemObj); - not necessary */
 /*DECLASM(RTR3PTR) UNWIND_WRAP(RTR0MemObjAddressR3)(RTR0MEMOBJ MemObj); - not necessary */
@@ -364 +365 @@
     { "RTR0MemObjMapKernelEx",                  (void *)UNWIND_WRAP(RTR0MemObjMapKernelEx) },
     { "RTR0MemObjMapUser",                      (void *)UNWIND_WRAP(RTR0MemObjMapUser) },
+    { "RTR0MemObjProtect",                      (void *)UNWIND_WRAP(RTR0MemObjProtect) },
     { "RTR0MemObjAddress",                      (void *)RTR0MemObjAddress },
     { "RTR0MemObjAddressR3",                    (void *)RTR0MemObjAddressR3 },
@@ -1587 +1589 @@
         }
 
+        case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_PROTECT):
+        {
+            /* validate */
+            PSUPPAGEPROTECT pReq = (PSUPPAGEPROTECT)pReqHdr;
+            REQ_CHECK_SIZES(SUP_IOCTL_PAGE_PROTECT);
+            REQ_CHECK_EXPR_FMT(!(pReq->u.In.fProt & ~(RTMEM_PROT_READ | RTMEM_PROT_WRITE | RTMEM_PROT_EXEC | RTMEM_PROT_NONE)),
+                               ("SUP_IOCTL_PAGE_PROTECT: fProt=%#x!\n", pReq->u.In.fProt));
+            REQ_CHECK_EXPR_FMT(!(pReq->u.In.offSub & PAGE_OFFSET_MASK), ("SUP_IOCTL_PAGE_PROTECT: offSub=%#x\n", pReq->u.In.offSub));
+            REQ_CHECK_EXPR_FMT(pReq->u.In.cbSub && !(pReq->u.In.cbSub & PAGE_OFFSET_MASK),
+                               ("SUP_IOCTL_PAGE_PROTECT: cbSub=%#x\n", pReq->u.In.cbSub));
+
+            /* execute */
+            pReq->Hdr.rc = SUPR0PageProtect(pSession, pReq->u.In.pvR3, pReq->u.In.pvR0, pReq->u.In.offSub, pReq->u.In.cbSub, pReq->u.In.fProt);
+            return 0;
+        }
+
         case SUP_CTL_CODE_NO_SIZE(SUP_IOCTL_PAGE_FREE):
         {
@@ -2794 +2812 @@
 
 /**
- * Allocates a chunk of memory with a kernel or/and a user mode mapping.
- *
- * The memory is fixed and it's possible to query the physical addresses using
- * SUPR0MemGetPhys().
+ * Maps a chunk of memory previously allocated by SUPR0PageAllocEx into kernel
+ * space.
  *
  * @returns IPRT status code.
  * @param   pSession    The session to associated the allocation with.
- * @param   cPages      The number of pages to allocate.
- * @param   fFlags      Flags, reserved for the future. Must be zero.
- * @param   ppvR3       Where to store the address of the Ring-3 mapping.
- *                      NULL if no ring-3 mapping.
- * @param   ppvR3       Where to store the address of the Ring-0 mapping.
- *                      NULL if no ring-0 mapping.
- * @param   paPages     Where to store the addresses of the pages. Optional.
+ * @param   pvR3        The ring-3 address returned by SUPR0PageAllocEx.
+ * @param   offSub      Where to start mapping. Must be page aligned.
+ * @param   cbSub       How much to map. Must be page aligned.
+ * @param   fFlags      Flags, MBZ.
+ * @param   ppvR0       Where to reutrn the address of the ring-0 mapping on
+ *                      success.
  */
 SUPR0DECL(int) SUPR0PageMapKernel(PSUPDRVSESSION pSession, RTR3PTR pvR3, uint32_t offSub, uint32_t cbSub,
@@ -2879 +2894 @@
     }
     return rc;
+}
+
+
+/**
+ * Changes the page level protection of one or more pages previously allocated
+ * by SUPR0PageAllocEx.
+ *
+ * @returns IPRT status code.
+ * @param   pSession    The session to associated the allocation with.
+ * @param   pvR3        The ring-3 address returned by SUPR0PageAllocEx.
+ *                      NIL_RTR3PTR if the ring-3 mapping should be unaffected.
+ * @param   pvR0        The ring-0 address returned by SUPR0PageAllocEx.
+ *                      NIL_RTR0PTR if the ring-0 mapping should be unaffected.
+ * @param   offSub      Where to start changing. Must be page aligned.
+ * @param   cbSub       How much to change. Must be page aligned.
+ * @param   fProt       The new page level protection, see RTMEM_PROT_*.
+ */
+SUPR0DECL(int) SUPR0PageProtect(PSUPDRVSESSION pSession, RTR3PTR pvR3, RTR0PTR pvR0, uint32_t offSub, uint32_t cbSub, uint32_t fProt)
+{
+    int             rc;
+    PSUPDRVBUNDLE   pBundle;
+    RTSPINLOCKTMP   SpinlockTmp = RTSPINLOCKTMP_INITIALIZER;
+    RTR0MEMOBJ      hMemObjR0 = NIL_RTR0MEMOBJ;
+    RTR0MEMOBJ      hMemObjR3 = NIL_RTR0MEMOBJ;
+    LogFlow(("SUPR0PageProtect: pSession=%p pvR3=%p pvR0=%p offSub=%#x cbSub=%#x fProt-%#x\n", pSession, pvR3, pvR0, offSub, cbSub, fProt));
+
+    /*
+     * Validate input. The allowed allocation size must be at least equal to the maximum guest VRAM size.
+     */
+    AssertReturn(SUP_IS_SESSION_VALID(pSession), VERR_INVALID_PARAMETER);
+    AssertReturn(!(fProt & ~(RTMEM_PROT_READ | RTMEM_PROT_WRITE | RTMEM_PROT_EXEC | RTMEM_PROT_NONE)), VERR_INVALID_PARAMETER);
+    AssertReturn(!(offSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
+    AssertReturn(!(cbSub & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
+    AssertReturn(cbSub, VERR_INVALID_PARAMETER);
+
+    /*
+     * Find the memory object.
+     */
+    RTSpinlockAcquire(pSession->Spinlock, &SpinlockTmp);
+    for (pBundle = &pSession->Bundle; pBundle; pBundle = pBundle->pNext)
+    {
+        if (pBundle->cUsed > 0)
+        {
+            unsigned i;
+            for (i = 0; i < RT_ELEMENTS(pBundle->aMem); i++)
+            {
+                if (   pBundle->aMem[i].eType == MEMREF_TYPE_PAGE
+                    && pBundle->aMem[i].MemObj != NIL_RTR0MEMOBJ
+                    && (   pBundle->aMem[i].MapObjR3 != NIL_RTR0MEMOBJ
+                        || pvR3 == NIL_RTR3PTR)
+                    && (   pvR0 != NIL_RTR0PTR
+                        || RTR0MemObjAddress(pBundle->aMem[i].MemObj))
+                    && (   pvR3 != NIL_RTR3PTR
+                        || RTR0MemObjAddressR3(pBundle->aMem[i].MapObjR3) == pvR3))
+                {
+                    if (pvR0 != NIL_RTR0PTR)
+                        hMemObjR0 = pBundle->aMem[i].MemObj;
+                    if (pvR3 != NIL_RTR3PTR)
+                        hMemObjR3 = pBundle->aMem[i].MapObjR3;
+                    break;
+                }
+            }
+        }
+    }
+    RTSpinlockRelease(pSession->Spinlock, &SpinlockTmp);
+
+    rc = VERR_INVALID_PARAMETER;
+    if (    hMemObjR0 != NIL_RTR0MEMOBJ
+        ||  hMemObjR3 != NIL_RTR0MEMOBJ)
+    {
+        /*
+         * Do some furter input validations before calling IPRT.
+         */
+        size_t cbMemObj = hMemObjR0 != NIL_RTR0PTR ? RTR0MemObjSize(hMemObjR0) : RTR0MemObjSize(hMemObjR3);
+        if (    offSub < cbMemObj
+            &&  cbSub <= cbMemObj
+            &&  offSub + cbSub <= cbMemObj)
+        {
+            rc = VINF_SUCCESS;
+            if (hMemObjR3 != NIL_RTR0PTR)
+                rc = RTR0MemObjProtect(hMemObjR3, offSub, cbSub, fProt);
+            if (hMemObjR0 != NIL_RTR0PTR && RT_SUCCESS(rc))
+                rc = RTR0MemObjProtect(hMemObjR0, offSub, cbSub, fProt);
+        }
+        else
+            SUPR0Printf("SUPR0PageMapKernel: cbMemObj=%#x offSub=%#x cbSub=%#x\n", cbMemObj, offSub, cbSub);
+
+    }
+    return rc;
+
 }
 

trunk/src/VBox/HostDrivers/Support/SUPDrvIOC.h

@@ -196 +196 @@
  *            and renaming the related IOCtls too.
  */
-#define SUPDRV_IOC_VERSION                              0x000d0000
+#define SUPDRV_IOC_VERSION                              0x000d0001
 
 /** SUP_IOCTL_COOKIE. */
@@ -1113 +1113 @@
 
 
+/** @name SUP_IOCTL_PAGE_PROTECT
+ * Changes the page level protection of the user and/or kernel mappings of
+ * memory previously allocated by SUPR0PageAllocEx.
+ *
+ * @remarks Not necessarily supported on all platforms.
+ *
+ * @{
+ */
+#define SUP_IOCTL_PAGE_PROTECT                          SUP_CTL_CODE_SIZE(28, SUP_IOCTL_PAGE_PROTECT_SIZE)
+#define SUP_IOCTL_PAGE_PROTECT_SIZE                     sizeof(SUPPAGEPROTECT)
+#define SUP_IOCTL_PAGE_PROTECT_SIZE_IN                  sizeof(SUPPAGEPROTECT)
+#define SUP_IOCTL_PAGE_PROTECT_SIZE_OUT                 sizeof(SUPPAGEPROTECT)
+typedef struct SUPPAGEPROTECT
+{
+    /** The header. */
+    SUPREQHDR               Hdr;
+    union
+    {
+        struct
+        {
+            /** The pointer of to the previously allocated memory.
+             * Pass NIL_RTR3PTR if the ring-0 mapping should remain unaffected. */
+            RTR3PTR         pvR3;
+            /** The pointer of to the previously allocated memory.
+             * Pass NIL_RTR0PTR if the ring-0 mapping should remain unaffected. */
+            RTR0PTR         pvR0;
+            /** The offset to start changing protection at. */
+            uint32_t        offSub;
+            /** Size of the portion that should be changed. */
+            uint32_t        cbSub;
+            /** Protection flags, RTMEM_PROT_*. */
+            uint32_t        fProt;
+        } In;
+    } u;
+} SUPPAGEPROTECT, *PSUPPAGEPROTECT;
+/** @} */
+
+
 #pragma pack()                          /* paranoia */
 

trunk/src/VBox/HostDrivers/Support/SUPLib.cpp

@@ -260 +260 @@
         strcpy(CookieReq.u.In.szMagic, SUPCOOKIE_MAGIC);
         CookieReq.u.In.u32ReqVersion = SUPDRV_IOC_VERSION;
-        const uint32_t MinVersion = (SUPDRV_IOC_VERSION & 0xffff0000) >= 0x000d0000
-                                  ? 0x000d0000
+        const uint32_t MinVersion = (SUPDRV_IOC_VERSION & 0xffff0000) == 0x000d0000
+                                  ?  0x000d0001
                                   :  SUPDRV_IOC_VERSION & 0xffff0000;
         CookieReq.u.In.u32MinVersion = MinVersion;
@@ -1145 +1145 @@
 
 
+SUPR3DECL(int) SUPR3PageProtect(void *pvR3, RTR0PTR R0Ptr, uint32_t off, uint32_t cb, uint32_t fProt)
+{
+    /*
+     * Validate.
+     */
+    AssertPtrReturn(pvR3, VERR_INVALID_POINTER);
+    Assert(!(off & PAGE_OFFSET_MASK));
+    Assert(!(cb & PAGE_OFFSET_MASK) && cb);
+    AssertReturn(!(fProt & ~(RTMEM_PROT_NONE | RTMEM_PROT_READ | RTMEM_PROT_WRITE | RTMEM_PROT_EXEC)), VERR_INVALID_PARAMETER);
+
+    /* fake */
+    if (RT_UNLIKELY(g_u32FakeMode))
+        return RTMemProtect((uint8_t *)pvR3 + off, cb, fProt);
+
+    /*
+     * Some OSes can do this from ring-3, so try that before we
+     * issue the IOCtl to the SUPDRV kernel module.
+     * (Yea, this isn't very nice, but just try get the job done for now.)
+     */
+    RTMemProtect((uint8_t *)pvR3 + off, cb, fProt);
+
+    SUPPAGEPROTECT Req;
+    Req.Hdr.u32Cookie = g_u32Cookie;
+    Req.Hdr.u32SessionCookie = g_u32SessionCookie;
+    Req.Hdr.cbIn = SUP_IOCTL_PAGE_PROTECT_SIZE_IN;
+    Req.Hdr.cbOut = SUP_IOCTL_PAGE_PROTECT_SIZE_OUT;
+    Req.Hdr.fFlags = SUPREQHDR_FLAGS_DEFAULT;
+    Req.Hdr.rc = VERR_INTERNAL_ERROR;
+    Req.u.In.pvR3 = pvR3;
+    Req.u.In.pvR0 = R0Ptr;
+    Req.u.In.offSub = off;
+    Req.u.In.cbSub = cb;
+    Req.u.In.fProt = fProt;
+    int rc = suplibOsIOCtl(&g_supLibData, SUP_IOCTL_PAGE_PROTECT, &Req, SUP_IOCTL_PAGE_PROTECT_SIZE);
+    if (RT_SUCCESS(rc))
+        rc = Req.Hdr.rc;
+    return rc;
+}
+
+
 SUPR3DECL(int) SUPR3PageFreeEx(void *pvPages, size_t cPages)
 {

trunk/src/VBox/HostDrivers/Support/win/SUPDrvA-win.asm

@@ -103 +103 @@
 NtWrapDyn2DrvFunctionWith7Params       supdrvNtWrap, RTR0MemObjMapKernelEx
 NtWrapDyn2DrvFunctionWith6Params       supdrvNtWrap, RTR0MemObjMapUser
+NtWrapDyn2DrvFunctionWithAllRegParams  supdrvNtWrap, RTR0MemObjProtect
 ;NtWrapDyn2DrvFunctionWithAllRegParams  supdrvNtWrap, RTR0MemObjAddress      - not necessary
 ;NtWrapDyn2DrvFunctionWithAllRegParams  supdrvNtWrap, RTR0MemObjAddressR3    - not necessary