forked from KolibriOS/kolibrios
1936 lines
47 KiB
PHP
1936 lines
47 KiB
PHP
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
;; ;;
|
|
;; Copyright (C) KolibriOS team 2004-2020. All rights reserved. ;;
|
|
;; Distributed under terms of the GNU General Public License ;;
|
|
;; ;;
|
|
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
|
|
$Revision$
|
|
|
|
|
|
align 4
|
|
proc alloc_page
|
|
|
|
pushfd
|
|
cli
|
|
push ebx
|
|
|
|
cmp [pg_data.pages_free], 1
|
|
jle .out_of_memory
|
|
|
|
|
|
mov ebx, [page_start]
|
|
mov ecx, [page_end]
|
|
.l1:
|
|
bsf eax, [ebx];
|
|
jnz .found
|
|
add ebx, 4
|
|
cmp ebx, ecx
|
|
jb .l1
|
|
pop ebx
|
|
popfd
|
|
xor eax, eax
|
|
ret
|
|
.found:
|
|
|
|
dec [pg_data.pages_free]
|
|
jz .out_of_memory
|
|
|
|
btr [ebx], eax
|
|
mov [page_start], ebx
|
|
sub ebx, sys_pgmap
|
|
lea eax, [eax+ebx*8]
|
|
shl eax, 12
|
|
; dec [pg_data.pages_free]
|
|
pop ebx
|
|
popfd
|
|
ret
|
|
|
|
.out_of_memory:
|
|
mov [pg_data.pages_free], 1
|
|
xor eax, eax
|
|
pop ebx
|
|
popfd
|
|
ret
|
|
|
|
endp
|
|
|
|
align 4
|
|
proc alloc_pages stdcall, count:dword
|
|
pushfd
|
|
push ebx
|
|
push edi
|
|
cli
|
|
mov eax, [count]
|
|
add eax, 7
|
|
shr eax, 3
|
|
mov [count], eax
|
|
|
|
mov ebx, [pg_data.pages_free]
|
|
sub ebx, 9
|
|
js .out_of_memory
|
|
shr ebx, 3
|
|
cmp eax, ebx
|
|
jg .out_of_memory
|
|
|
|
mov ecx, [page_start]
|
|
mov ebx, [page_end]
|
|
.find:
|
|
mov edx, [count]
|
|
mov edi, ecx
|
|
.match:
|
|
cmp byte [ecx], 0xFF
|
|
jne .next
|
|
dec edx
|
|
jz .ok
|
|
inc ecx
|
|
cmp ecx, ebx
|
|
jb .match
|
|
.out_of_memory:
|
|
.fail:
|
|
xor eax, eax
|
|
pop edi
|
|
pop ebx
|
|
popfd
|
|
ret
|
|
.next:
|
|
inc ecx
|
|
cmp ecx, ebx
|
|
jb .find
|
|
pop edi
|
|
pop ebx
|
|
popfd
|
|
xor eax, eax
|
|
ret
|
|
.ok:
|
|
sub ecx, edi
|
|
inc ecx
|
|
push esi
|
|
mov esi, edi
|
|
xor eax, eax
|
|
rep stosb
|
|
sub esi, sys_pgmap
|
|
shl esi, 3+12
|
|
mov eax, esi
|
|
mov ebx, [count]
|
|
shl ebx, 3
|
|
sub [pg_data.pages_free], ebx
|
|
pop esi
|
|
pop edi
|
|
pop ebx
|
|
popfd
|
|
ret
|
|
endp
|
|
|
|
align 4
|
|
;proc map_page stdcall,lin_addr:dword,phis_addr:dword,flags:dword
|
|
map_page:
|
|
push ebx
|
|
mov eax, [esp+12] ; phis_addr
|
|
or eax, [esp+16] ; flags
|
|
and eax, [pte_valid_mask]
|
|
mov ebx, [esp+8] ; lin_addr
|
|
shr ebx, 12
|
|
mov [page_tabs+ebx*4], eax
|
|
mov eax, [esp+8] ; lin_addr
|
|
pop ebx
|
|
invlpg [eax]
|
|
ret 12
|
|
|
|
align 4
|
|
map_space: ;not implemented
|
|
|
|
|
|
ret
|
|
|
|
|
|
align 4
|
|
proc free_page
|
|
;arg: eax page address
|
|
pushfd
|
|
cli
|
|
shr eax, 12 ;page index
|
|
bts dword [sys_pgmap], eax ;that's all!
|
|
cmc
|
|
adc [pg_data.pages_free], 0
|
|
shr eax, 3
|
|
and eax, not 3 ;dword offset from page_map
|
|
add eax, sys_pgmap
|
|
cmp [page_start], eax
|
|
ja @f
|
|
popfd
|
|
ret
|
|
@@:
|
|
mov [page_start], eax
|
|
popfd
|
|
ret
|
|
endp
|
|
|
|
align 4
|
|
proc map_io_mem stdcall, base:dword, size:dword, flags:dword
|
|
|
|
push ebx
|
|
push edi
|
|
mov eax, [size]
|
|
add eax, [base]
|
|
add eax, 4095
|
|
and eax, -4096
|
|
mov ecx, [base]
|
|
and ecx, -4096
|
|
sub eax, ecx
|
|
mov [size], eax
|
|
|
|
stdcall alloc_kernel_space, eax
|
|
test eax, eax
|
|
jz .fail
|
|
push eax
|
|
|
|
mov edi, 0x1000
|
|
mov ebx, eax
|
|
mov ecx, [size]
|
|
mov edx, [base]
|
|
shr eax, 12
|
|
shr ecx, 12
|
|
or edx, [flags]
|
|
and edx, [pte_valid_mask]
|
|
@@:
|
|
mov [page_tabs+eax*4], edx
|
|
invlpg [ebx]
|
|
inc eax
|
|
add ebx, edi
|
|
add edx, edi
|
|
loop @B
|
|
|
|
pop eax
|
|
mov edx, [base]
|
|
and edx, 4095
|
|
add eax, edx
|
|
.fail:
|
|
pop edi
|
|
pop ebx
|
|
ret
|
|
endp
|
|
|
|
; param
|
|
; eax= page base + page flags
|
|
; ebx= linear address
|
|
; ecx= count
|
|
|
|
align 4
|
|
commit_pages:
|
|
test ecx, ecx
|
|
jz .fail
|
|
|
|
push edi
|
|
push eax
|
|
push ecx
|
|
mov ecx, pg_data.mutex
|
|
call mutex_lock
|
|
pop ecx
|
|
pop eax
|
|
|
|
and eax, [pte_valid_mask ]
|
|
mov edi, ebx
|
|
shr edi, 12
|
|
lea edi, [page_tabs+edi*4]
|
|
@@:
|
|
stosd
|
|
invlpg [ebx]
|
|
add eax, 0x1000
|
|
add ebx, 0x1000
|
|
loop @B
|
|
|
|
pop edi
|
|
|
|
mov ecx, pg_data.mutex
|
|
call mutex_unlock
|
|
.fail:
|
|
ret
|
|
|
|
|
|
; param
|
|
; eax= base
|
|
; ecx= count
|
|
|
|
align 4
|
|
release_pages:
|
|
|
|
push ebp
|
|
push esi
|
|
push edi
|
|
push ebx
|
|
|
|
mov esi, eax
|
|
mov edi, eax
|
|
|
|
shr esi, 12
|
|
lea esi, [page_tabs+esi*4]
|
|
|
|
push ecx
|
|
mov ecx, pg_data.mutex
|
|
call mutex_lock
|
|
pop ecx
|
|
|
|
mov ebp, [pg_data.pages_free]
|
|
mov ebx, [page_start]
|
|
mov edx, sys_pgmap
|
|
@@:
|
|
xor eax, eax
|
|
xchg eax, [esi]
|
|
invlpg [edi]
|
|
|
|
test eax, 1
|
|
jz .next
|
|
|
|
shr eax, 12
|
|
bts [edx], eax
|
|
cmc
|
|
adc ebp, 0
|
|
shr eax, 3
|
|
and eax, -4
|
|
add eax, edx
|
|
cmp eax, ebx
|
|
jae .next
|
|
|
|
mov ebx, eax
|
|
.next:
|
|
add edi, 0x1000
|
|
add esi, 4
|
|
loop @B
|
|
|
|
mov [pg_data.pages_free], ebp
|
|
mov ecx, pg_data.mutex
|
|
call mutex_unlock
|
|
|
|
pop ebx
|
|
pop edi
|
|
pop esi
|
|
pop ebp
|
|
ret
|
|
|
|
; param
|
|
; eax= base
|
|
; ecx= count
|
|
|
|
align 4
|
|
unmap_pages:
|
|
|
|
push edi
|
|
|
|
mov edi, eax
|
|
mov edx, eax
|
|
|
|
shr edi, 10
|
|
add edi, page_tabs
|
|
|
|
xor eax, eax
|
|
@@:
|
|
stosd
|
|
invlpg [edx]
|
|
add edx, 0x1000
|
|
loop @b
|
|
|
|
pop edi
|
|
ret
|
|
|
|
|
|
align 4
|
|
proc map_page_table stdcall, lin_addr:dword, phis_addr:dword
|
|
push ebx
|
|
mov ebx, [lin_addr]
|
|
shr ebx, 22
|
|
mov eax, [phis_addr]
|
|
and eax, not 0xFFF
|
|
or eax, PG_UWR
|
|
mov dword [master_tab+ebx*4], eax
|
|
mov eax, [lin_addr]
|
|
shr eax, 10
|
|
add eax, page_tabs
|
|
invlpg [eax]
|
|
pop ebx
|
|
ret
|
|
endp
|
|
|
|
uglobal
|
|
sb16_buffer_allocated db 0
|
|
endg
|
|
|
|
; Allocates [.size] bytes so that the target memory block
|
|
; is inside one 64K page for 24-bit DMA controller,
|
|
; that is, somewhere between 00xx0000h and 00xxFFFFh.
|
|
proc alloc_dma24
|
|
; Implementation note.
|
|
; The only user of that function is SB16 driver,
|
|
; so just return a statically allocated buffer.
|
|
virtual at esp
|
|
dd ? ; return address
|
|
.size dd ?
|
|
end virtual
|
|
cmp [sb16_buffer_allocated], 0
|
|
jnz .fail
|
|
inc [sb16_buffer_allocated]
|
|
mov eax, SB16Buffer
|
|
ret 4
|
|
.fail:
|
|
xor eax, eax
|
|
ret 4
|
|
endp
|
|
|
|
; Allocates a physical page for master page table
|
|
; that duplicates first Mb of OS_BASE at address 0;
|
|
; used for starting APs and for shutting down,
|
|
; where it is important to execute code in trivial-mapped pages.
|
|
; Returns eax = allocated physical page.
|
|
proc create_trampoline_pgmap
|
|
; The only non-trivial moment:
|
|
; we need a linear address to fill information,
|
|
; but we don't need it outside of this function,
|
|
; so we're returning physical address.
|
|
; Therefore, allocate memory with kernel_alloc,
|
|
; this will allocate physical page and a linear address somewhere,
|
|
; and deallocate only linear address with free_kernel_space.
|
|
stdcall kernel_alloc, 0x1000
|
|
mov edi, eax
|
|
mov esi, master_tab
|
|
mov ecx, 1024
|
|
rep movsd
|
|
mov ecx, [master_tab+(OS_BASE shr 20)]
|
|
mov [eax], ecx
|
|
mov edi, eax
|
|
call get_pg_addr
|
|
push eax
|
|
stdcall free_kernel_space, edi
|
|
pop eax
|
|
ret
|
|
endp
|
|
|
|
align 4
|
|
proc new_mem_resize stdcall, new_size:dword
|
|
|
|
push ebx
|
|
push esi
|
|
push edi
|
|
|
|
mov edx, [current_slot]
|
|
mov ebx, [edx+APPDATA.process]
|
|
|
|
cmp [ebx+PROC.heap_base], 0
|
|
jne .exit
|
|
|
|
mov edi, [new_size]
|
|
add edi, 4095
|
|
and edi, not 4095
|
|
mov [new_size], edi
|
|
|
|
mov esi, [ebx+PROC.mem_used]
|
|
add esi, 4095
|
|
and esi, not 4095
|
|
|
|
cmp edi, esi
|
|
ja .expand
|
|
je .exit
|
|
|
|
mov ebx, edi
|
|
shr edi, 12
|
|
shr esi, 12
|
|
|
|
mov ecx, pg_data.mutex
|
|
call mutex_lock
|
|
@@:
|
|
mov eax, [app_page_tabs+edi*4]
|
|
test eax, 1
|
|
jz .next
|
|
|
|
mov dword [app_page_tabs+edi*4], 0
|
|
invlpg [ebx]
|
|
call free_page
|
|
|
|
.next:
|
|
inc edi
|
|
add ebx, 0x1000
|
|
cmp edi, esi
|
|
jb @B
|
|
|
|
mov ecx, pg_data.mutex
|
|
call mutex_unlock
|
|
|
|
.update_size:
|
|
mov edx, [current_slot]
|
|
mov ebx, [new_size]
|
|
mov edx, [edx+APPDATA.process]
|
|
mov [edx+PROC.mem_used], ebx
|
|
.exit:
|
|
pop edi
|
|
pop esi
|
|
pop ebx
|
|
xor eax, eax
|
|
ret
|
|
|
|
.expand:
|
|
|
|
mov ecx, pg_data.mutex
|
|
call mutex_lock
|
|
|
|
xchg esi, edi
|
|
|
|
push esi ;new size
|
|
push edi ;old size
|
|
|
|
add edi, 0x3FFFFF
|
|
and edi, not(0x3FFFFF)
|
|
add esi, 0x3FFFFF
|
|
and esi, not(0x3FFFFF)
|
|
|
|
cmp edi, esi
|
|
jae .grow
|
|
@@:
|
|
call alloc_page
|
|
test eax, eax
|
|
jz .exit_fail
|
|
|
|
stdcall map_page_table, edi, eax
|
|
|
|
push edi
|
|
shr edi, 10
|
|
add edi, page_tabs
|
|
mov ecx, 1024
|
|
xor eax, eax
|
|
cld
|
|
rep stosd
|
|
pop edi
|
|
|
|
add edi, 0x00400000
|
|
cmp edi, esi
|
|
jb @B
|
|
.grow:
|
|
pop edi ;old size
|
|
pop ecx ;new size
|
|
|
|
shr edi, 10
|
|
shr ecx, 10
|
|
sub ecx, edi
|
|
shr ecx, 2 ;pages count
|
|
mov eax, 2
|
|
|
|
add edi, app_page_tabs
|
|
rep stosd
|
|
|
|
mov ecx, pg_data.mutex
|
|
call mutex_unlock
|
|
|
|
jmp .update_size
|
|
|
|
.exit_fail:
|
|
mov ecx, pg_data.mutex
|
|
call mutex_unlock
|
|
|
|
add esp, 8
|
|
pop edi
|
|
pop esi
|
|
pop ebx
|
|
xor eax, eax
|
|
inc eax
|
|
ret
|
|
endp
|
|
|
|
|
|
; param
|
|
; eax= linear address
|
|
;
|
|
; retval
|
|
; eax= physical page address
|
|
|
|
align 4
|
|
get_pg_addr:
|
|
sub eax, OS_BASE
|
|
cmp eax, 0x400000
|
|
jb @f
|
|
shr eax, 12
|
|
mov eax, [page_tabs+(eax+(OS_BASE shr 12))*4]
|
|
@@:
|
|
and eax, 0xFFFFF000
|
|
ret
|
|
|
|
|
|
align 4
|
|
; Now it is called from core/sys32::exc_c (see stack frame there)
|
|
proc page_fault_handler
|
|
|
|
.err_addr equ ebp-4
|
|
|
|
push ebx ;save exception number (#PF)
|
|
mov ebp, esp
|
|
mov ebx, cr2
|
|
push ebx ;that is locals: .err_addr = cr2
|
|
inc [pg_data.pages_faults]
|
|
|
|
mov esi, [pf_err_code]
|
|
|
|
cmp ebx, OS_BASE ;ebx == .err_addr
|
|
jb .user_space ;page in application memory
|
|
|
|
cmp ebx, page_tabs
|
|
jb .kernel_space ;page in kernel memory
|
|
|
|
xor eax, eax
|
|
cmp ebx, kernel_tabs
|
|
jb .alloc;.app_tabs ;page tables of application ;
|
|
;simply create one
|
|
.core_tabs:
|
|
.fail: ;simply return to caller
|
|
mov esp, ebp
|
|
pop ebx ;restore exception number (#PF)
|
|
ret
|
|
.fail_maybe_unlock:
|
|
test esi, esi
|
|
jz .fail
|
|
.fail_unlock:
|
|
mov ecx, [current_process]
|
|
add ecx, PROC.heap_lock
|
|
call mutex_unlock
|
|
jmp .fail
|
|
|
|
.user_space:
|
|
; PF entry in IDT is interrupt gate, so up to this moment
|
|
; atomicity was guaranteed by cleared IF.
|
|
; It is inpractical to guard all modifications in the page table by cli/sti,
|
|
; so enable interrupts and acquire the address space lock.
|
|
; Unfortunately, that enables the scenario when the fault of current thread
|
|
; is resolved by another thread when the current thread waits in mutex_lock,
|
|
; so watch out: in lock-protected section we can find out that
|
|
; there is no error already.
|
|
sti
|
|
mov ecx, [current_process]
|
|
add ecx, PROC.heap_lock
|
|
call mutex_lock
|
|
test esi, PG_READ
|
|
jnz .err_access ;Page is present
|
|
;Access error ?
|
|
|
|
shr ebx, 12
|
|
mov ecx, ebx
|
|
shr ecx, 10
|
|
test dword [master_tab+ecx*4], PG_READ
|
|
jz .fail_unlock ;page table is not created
|
|
;incorrect address in program
|
|
|
|
mov eax, [page_tabs+ebx*4]
|
|
test eax, PG_READ
|
|
jnz .exit_unlock ; already resolved by a parallel thread
|
|
test eax, LAZY_ALLOC_PAGE
|
|
jz .fail_unlock ;address is not reserved for use, error
|
|
test eax, LAZY_ALLOC_UNREADABLE
|
|
jnz .fail_unlock
|
|
.alloc:
|
|
mov esi, eax
|
|
call alloc_zero_page
|
|
test eax, eax
|
|
jz .fail_maybe_unlock
|
|
|
|
mov edx, PG_UWR
|
|
test esi, LAZY_ALLOC_UNWRITABLE
|
|
jz @f
|
|
mov edx, PG_UR
|
|
@@:
|
|
stdcall map_page, [.err_addr], eax, edx
|
|
mov ecx, [current_process]
|
|
add [ecx+PROC.mem_used], 0x1000
|
|
.exit_unlock:
|
|
mov ecx, [current_process]
|
|
add ecx, PROC.heap_lock
|
|
call mutex_unlock
|
|
.exit: ;iret with repeat fault instruction
|
|
add esp, 12;clear in stack: locals(.err_addr) + #PF + ret_to_caller
|
|
restore_ring3_context
|
|
iretd
|
|
|
|
.err_access:
|
|
; access denied? this may be a result of copy-on-write protection
|
|
; Check whether the problem has already been resolved
|
|
; while we were waiting in mutex_lock.
|
|
mov eax, ebx
|
|
shr eax, 12
|
|
mov eax, [page_tabs+eax*4]
|
|
test eax, PG_READ
|
|
jz .fail_unlock ; someone has free'd the page
|
|
test eax, PG_USER
|
|
jz .fail_unlock ; page is mprotect'ed without PROT_READ
|
|
test eax, PG_WRITE
|
|
jnz .exit_unlock ; someone has enabled write
|
|
test eax, PG_SHARED
|
|
jz .fail_unlock ; only shared pages can be copy-on-write
|
|
; check list of mapped data
|
|
and ebx, not 0xFFF
|
|
call find_smap_by_address
|
|
test esi, esi
|
|
jz .fail_unlock
|
|
; ignore children of SMEM, only children of PEDESCR can have copy-on-write data
|
|
cmp [esi+SMAP.type], SMAP_TYPE_PE
|
|
jnz .fail_unlock
|
|
shr edi, 12
|
|
; lock page array in PEDESCR
|
|
mov esi, [esi+SMAP.parent]
|
|
lea ecx, [esi+PEDESCR.page_array_lock]
|
|
push eax
|
|
call mutex_lock
|
|
pop eax
|
|
; check whether the page is shared
|
|
; PG_SHARED flag could be set by lock_and_map_page
|
|
xor eax, [esi+sizeof.PEDESCR+edi*4]
|
|
test eax, not 0xFFF
|
|
jnz .fail_unlock2
|
|
; check whether write is allowed by section attributes
|
|
mov eax, [esi+sizeof.PEDESCR+edi*4]
|
|
test eax, IMAGE_SCN_MEM_WRITE shr 20
|
|
jz .fail_unlock2
|
|
; if we're faulting on the page which was originally shareable writable,
|
|
; it means that someone has disabled writing with mprotect; fail
|
|
test eax, IMAGE_SCN_MEM_SHARED shr 20
|
|
jnz .fail_unlock2
|
|
stdcall pe_copy_on_write, PG_UWR
|
|
jc .fail_unlock2
|
|
.exit_unlock2:
|
|
lea ecx, [esi+PEDESCR.page_array_lock]
|
|
call mutex_unlock
|
|
jmp .exit_unlock
|
|
.fail_unlock2:
|
|
lea ecx, [esi+PEDESCR.page_array_lock]
|
|
call mutex_unlock
|
|
jmp .fail_unlock
|
|
|
|
.kernel_space:
|
|
test esi, PG_READ
|
|
jz .fail ;page does not present
|
|
|
|
test esi, 12 ;U/S (+below)
|
|
jnz .fail ;application requested kernel memory
|
|
|
|
;test esi, 8
|
|
;jnz .fail ;the reserved bit is set in page tables
|
|
;added in P4/Xeon
|
|
|
|
;an attempt to write to a protected kernel page
|
|
|
|
cmp ebx, tss._io_map_0
|
|
jb .fail
|
|
|
|
cmp ebx, tss._io_map_0+8192
|
|
jae .fail
|
|
|
|
; io permission map
|
|
; copy-on-write protection
|
|
|
|
call alloc_page
|
|
test eax, eax
|
|
jz .fail
|
|
|
|
push eax
|
|
stdcall map_page, [.err_addr], eax, PG_SWR
|
|
pop eax
|
|
mov edi, [.err_addr]
|
|
and edi, -4096
|
|
lea esi, [edi+(not tss._io_map_0)+1]; -tss._io_map_0
|
|
|
|
mov ebx, esi
|
|
shr ebx, 12
|
|
mov edx, [current_slot]
|
|
or eax, PG_SWR
|
|
mov [edx+APPDATA.io_map+ebx*4], eax
|
|
|
|
add esi, [default_io_map]
|
|
mov ecx, 4096/4
|
|
;cld ;caller is duty for this
|
|
rep movsd
|
|
jmp .exit
|
|
endp
|
|
|
|
; Sometimes we can just allocate a page and let the caller fill it.
|
|
; Sometimes we need a zero-filled page, but we can zero it at the target.
|
|
; Sometimes we need a zero-filled page before mapping to the target.
|
|
; This function is for the last case.
|
|
; out: eax = physical page
|
|
; destroys: nothing
|
|
proc alloc_zero_page
|
|
call alloc_page
|
|
test eax, eax
|
|
jz .nothing
|
|
spin_lock_irqsave zero_page_spinlock
|
|
push ecx edx edi eax
|
|
mov edi, [zero_page_tab]
|
|
stdcall map_page, edi, [esp+4], PG_SWR
|
|
pushd 0 [esp+4] edi ; for map_page
|
|
mov ecx, 0x1000/4
|
|
xor eax, eax
|
|
rep stosd
|
|
call map_page
|
|
pop eax edi edx ecx
|
|
spin_unlock_irqrestore zero_page_spinlock
|
|
.nothing:
|
|
ret
|
|
endp
|
|
|
|
; in: ebx = address
|
|
; out if SMAP exists for this address: esi -> SMAP, edi = ebx - SMAP.base
|
|
; out if SMAP does not exist: esi = 0
|
|
proc find_smap_by_address
|
|
mov edx, [current_process]
|
|
add edx, PROC.smap_list
|
|
mov esi, [edx+SMAP.fd]
|
|
.scan:
|
|
cmp esi, edx
|
|
jz .fail
|
|
mov edi, ebx
|
|
sub edi, [esi+SMAP.base]
|
|
cmp edi, [esi+SMAP.size]
|
|
jb .exit
|
|
mov esi, [esi+SMAP.fd]
|
|
jmp .scan
|
|
.fail:
|
|
xor esi, esi
|
|
.exit:
|
|
ret
|
|
endp
|
|
|
|
; Someone is about to write to copy-on-write page inside mapped PE.
|
|
; Provide a page that can be written to.
|
|
; in: esi -> PEDESCR
|
|
; in: edi = page number inside PE
|
|
; in: eax = [esi+sizeof.PEDESCR+edi*4]
|
|
; in: ebx = address in process, must be page-aligned
|
|
; in: [esp+4] = access rights for the new page
|
|
; out: CF=0 - ok, CF=1 - error, no memory
|
|
proc pe_copy_on_write
|
|
; 1. Decrement reference counter unless it is 0xFF.
|
|
mov edx, eax
|
|
and edx, 0xFF
|
|
cmp edx, 0xFF
|
|
jz @f
|
|
dec eax
|
|
@@:
|
|
; 2. If reference counter is zero now, transfer ownership from PEDESCR to the process.
|
|
test eax, 0xFF
|
|
jnz .alloc_copy
|
|
mov dword [esi+sizeof.PEDESCR+edi*4], 0
|
|
and eax, not 0xFFF
|
|
.remap:
|
|
stdcall map_page, ebx, eax, [esp+4]
|
|
clc
|
|
ret 4
|
|
.alloc_copy:
|
|
; 3. Otherwise, store updated reference counter to PEDESCR,
|
|
; allocate new page, map it as rw and copy data.
|
|
mov [esi+sizeof.PEDESCR+edi*4], eax
|
|
stdcall kernel_alloc, 0x1000
|
|
test eax, eax
|
|
jz .error
|
|
push esi
|
|
mov esi, ebx
|
|
mov edi, eax
|
|
mov ecx, 0x1000/4
|
|
rep movsd
|
|
mov esi, eax
|
|
call get_pg_addr
|
|
push eax
|
|
stdcall free_kernel_space, esi
|
|
pop eax
|
|
pop esi
|
|
jmp .remap
|
|
.error:
|
|
stc
|
|
ret 4
|
|
endp
|
|
|
|
PROT_READ = 1
|
|
PROT_WRITE = 2
|
|
PROT_EXEC = 4
|
|
proc mprotect stdcall uses ebx esi edi, address:dword, size:dword, access:dword
|
|
locals
|
|
retval dd -1
|
|
smap_ptr dd 0
|
|
endl
|
|
mov ecx, [current_process]
|
|
add ecx, PROC.heap_lock
|
|
call mutex_lock
|
|
test [access], not (PROT_READ+PROT_WRITE+PROT_EXEC)
|
|
jnz .error
|
|
cmp [size], 0
|
|
jz .error
|
|
mov eax, [address]
|
|
add [size], eax
|
|
and eax, not 0xFFF
|
|
.addrloop:
|
|
mov [address], eax
|
|
mov ecx, eax
|
|
cmp eax, OS_BASE
|
|
jae .error
|
|
shr eax, 22
|
|
test byte [master_tab+eax*4], PG_READ
|
|
jz .error
|
|
shr ecx, 12
|
|
mov eax, [page_tabs+ecx*4]
|
|
test al, PG_READ
|
|
jnz .page_present
|
|
test al, LAZY_ALLOC_PAGE
|
|
jz .error
|
|
cmp [retval], -1
|
|
jnz .skip_query
|
|
inc [retval]
|
|
test al, LAZY_ALLOC_UNREADABLE
|
|
jnz @f
|
|
or [retval], PROT_READ+PROT_EXEC
|
|
@@:
|
|
test al, LAZY_ALLOC_UNWRITABLE
|
|
jnz @f
|
|
or [retval], PROT_WRITE
|
|
@@:
|
|
.skip_query:
|
|
and al, not (LAZY_ALLOC_UNREADABLE+LAZY_ALLOC_UNWRITABLE)
|
|
test [access], PROT_READ
|
|
jnz @f
|
|
or al, LAZY_ALLOC_UNREADABLE
|
|
@@:
|
|
test [access], PROT_WRITE
|
|
jnz @f
|
|
or al, LAZY_ALLOC_UNWRITABLE
|
|
@@:
|
|
mov [page_tabs+ecx*4], eax
|
|
jmp .nextpage
|
|
.page_present:
|
|
test eax, PG_SHARED
|
|
jnz .page_shared
|
|
.normal_page:
|
|
cmp [retval], -1
|
|
jnz .skip_query2
|
|
inc [retval]
|
|
test al, PG_USER
|
|
jz @f
|
|
or [retval], PROT_READ+PROT_EXEC
|
|
@@:
|
|
test al, PG_WRITE
|
|
jz @f
|
|
or [retval], PROT_WRITE
|
|
@@:
|
|
.skip_query2:
|
|
and al, not (PG_USER+PG_WRITE)
|
|
test [access], PROT_READ
|
|
jz @f
|
|
or al, PG_USER
|
|
@@:
|
|
test [access], PROT_WRITE
|
|
jz @f
|
|
or al, PG_WRITE
|
|
@@:
|
|
mov [page_tabs+ecx*4], eax
|
|
mov eax, [address]
|
|
invlpg [eax]
|
|
jmp .nextpage
|
|
.page_shared:
|
|
mov esi, [smap_ptr]
|
|
test esi, esi
|
|
jz .find_smap
|
|
mov edx, [address]
|
|
sub edx, [esi+SMAP.base]
|
|
cmp edx, [esi+SMAP.size]
|
|
jb .found_smap
|
|
.find_smap:
|
|
mov ebx, [address]
|
|
call find_smap_by_address
|
|
mov [smap_ptr], esi
|
|
test esi, esi
|
|
jz .normal_page
|
|
.found_smap:
|
|
cmp [esi+SMAP.type], SMAP_TYPE_PE
|
|
jnz .error
|
|
shr edi, 12
|
|
mov esi, [esi+SMAP.parent]
|
|
lea ecx, [esi+PEDESCR.page_array_lock]
|
|
push eax
|
|
call mutex_lock
|
|
pop eax
|
|
xor eax, [esi+sizeof.PEDESCR+edi*4]
|
|
test eax, not 0xFFF
|
|
jnz .normal_page_unlock
|
|
mov eax, [esi+sizeof.PEDESCR+edi*4]
|
|
test eax, IMAGE_SCN_MEM_SHARED shr 20
|
|
jnz .normal_page_unlock
|
|
cmp [retval], -1
|
|
jnz .skip_query3
|
|
mov edx, [address]
|
|
shr edx, 12
|
|
inc [retval]
|
|
test byte [page_tabs+edx*4], PG_USER
|
|
jz @f
|
|
or [retval], PROT_READ+PROT_EXEC
|
|
@@:
|
|
test eax, IMAGE_SCN_MEM_WRITE shr 20
|
|
jz @f
|
|
or [retval], PROT_WRITE
|
|
@@:
|
|
.skip_query3:
|
|
test [access], PROT_WRITE
|
|
jz .no_write
|
|
push PG_SWR
|
|
test [access], PROT_READ
|
|
jz @f
|
|
pop edx
|
|
push PG_UWR
|
|
@@:
|
|
call pe_copy_on_write
|
|
lea ecx, [esi+PEDESCR.page_array_lock]
|
|
call mutex_unlock
|
|
jmp .nextpage
|
|
.normal_page_unlock:
|
|
lea ecx, [esi+PEDESCR.page_array_lock]
|
|
call mutex_unlock
|
|
mov ecx, [address]
|
|
shr ecx, 12
|
|
mov eax, [page_tabs+ecx*4]
|
|
jmp .normal_page
|
|
.no_write:
|
|
lea ecx, [esi+PEDESCR.page_array_lock]
|
|
call mutex_unlock
|
|
mov ecx, [address]
|
|
shr ecx, 12
|
|
mov eax, [page_tabs+ecx*4]
|
|
jmp .skip_query2
|
|
.nextpage:
|
|
mov eax, [address]
|
|
add eax, 0x1000
|
|
cmp eax, [size]
|
|
jb .addrloop
|
|
.exit:
|
|
mov ecx, [current_process]
|
|
add ecx, PROC.heap_lock
|
|
call mutex_unlock
|
|
mov eax, [retval]
|
|
ret
|
|
.error:
|
|
or [retval], -1
|
|
jmp .exit
|
|
endp
|
|
|
|
; returns number of mapped bytes
|
|
proc map_memEx stdcall uses ebx esi edi, lin_addr:dword,slot:dword,\
|
|
ofs:dword,buf_size:dword,req_access:dword,where:dword
|
|
locals
|
|
count dd ?
|
|
process dd ?
|
|
endl
|
|
|
|
mov [count], 0
|
|
cmp [buf_size], 0
|
|
jz .exit
|
|
|
|
mov eax, [slot]
|
|
shl eax, 8
|
|
mov ecx, [SLOT_BASE+eax+APPDATA.process]
|
|
test ecx, ecx
|
|
jz .exit
|
|
|
|
mov [process], ecx
|
|
add ecx, PROC.heap_lock
|
|
call mutex_lock
|
|
mov eax, [process]
|
|
mov ebx, [ofs]
|
|
shr ebx, 22
|
|
mov eax, [eax+PROC.pdt_0+ebx*4] ;get page table
|
|
mov esi, [where]
|
|
and eax, 0xFFFFF000
|
|
jz .unlock_exit
|
|
stdcall map_page, esi, eax, PG_SWR
|
|
@@:
|
|
mov edi, [lin_addr]
|
|
and edi, 0xFFFFF000
|
|
mov ecx, [buf_size]
|
|
add ecx, 4095
|
|
shr ecx, 12
|
|
|
|
mov edx, [ofs]
|
|
shr edx, 12
|
|
and edx, 0x3FF
|
|
.map:
|
|
stdcall lock_and_map_page, [slot], [req_access], [ofs]
|
|
jnc .unlock_exit
|
|
add [count], PAGE_SIZE
|
|
add [ofs], PAGE_SIZE
|
|
dec ecx
|
|
jz .unlock_exit
|
|
|
|
add edi, PAGE_SIZE
|
|
inc edx
|
|
cmp edx, 1024
|
|
jnz .map
|
|
|
|
inc ebx
|
|
mov eax, [process]
|
|
mov eax, [eax+PROC.pdt_0+ebx*4]
|
|
and eax, 0xFFFFF000
|
|
jz .unlock_exit
|
|
|
|
stdcall map_page, esi, eax, PG_SWR
|
|
xor edx, edx
|
|
jmp .map
|
|
.unlock_exit:
|
|
mov ecx, [process]
|
|
add ecx, PROC.heap_lock
|
|
call mutex_unlock
|
|
.exit:
|
|
mov eax, [count]
|
|
ret
|
|
endp
|
|
|
|
proc unmap_memEx stdcall uses ebx esi edi, lin_addr:dword,slot:dword,\
|
|
ofs:dword,mapped_size:dword,pagedir:dword
|
|
locals
|
|
process dd ?
|
|
endl
|
|
|
|
cmp [mapped_size], 0
|
|
jz .exit
|
|
|
|
mov eax, [slot]
|
|
shl eax, 8
|
|
mov ecx, [SLOT_BASE+eax+APPDATA.process]
|
|
mov [process], ecx
|
|
xor eax, eax
|
|
test ecx, ecx
|
|
jz @f
|
|
add ecx, PROC.heap_lock
|
|
call mutex_lock
|
|
mov ebx, [ofs]
|
|
shr ebx, 22
|
|
mov eax, [process]
|
|
mov eax, [eax+PROC.pdt_0+ebx*4] ;get page table
|
|
@@:
|
|
xor esi, esi
|
|
and eax, 0xFFFFF000
|
|
jz @f
|
|
mov esi, [pagedir]
|
|
stdcall map_page, esi, eax, PG_SWR
|
|
@@:
|
|
mov ecx, shared_locked_mutex
|
|
call mutex_lock
|
|
mov edi, [lin_addr]
|
|
shr edi, 12
|
|
mov ecx, [mapped_size]
|
|
add ecx, 4095
|
|
shr ecx, 12
|
|
mov [mapped_size], ecx
|
|
|
|
mov edx, [ofs]
|
|
shr edx, 12
|
|
and edx, 0x3FF
|
|
lea esi, [esi+edx*4]
|
|
.map:
|
|
call unlock_and_unmap_page
|
|
dec [mapped_size]
|
|
jz .done
|
|
|
|
inc edi
|
|
add esi, 4
|
|
test esi, 0xFFF
|
|
jnz .map
|
|
|
|
inc ebx
|
|
xor esi, esi
|
|
cmp [process], 0
|
|
jz .map
|
|
mov eax, [process]
|
|
mov eax, [eax+PROC.pdt_0+ebx*4]
|
|
and eax, 0xFFFFF000
|
|
jz .map
|
|
|
|
mov esi, [pagedir]
|
|
stdcall map_page, esi, eax, PG_SWR
|
|
jmp .map
|
|
.done:
|
|
mov ecx, shared_locked_mutex
|
|
call mutex_unlock
|
|
cmp [process], 0
|
|
jz .exit
|
|
mov ecx, [process]
|
|
add ecx, PROC.heap_lock
|
|
call mutex_unlock
|
|
.exit:
|
|
mov eax, [pagedir]
|
|
mov ecx, eax
|
|
shr ecx, 12
|
|
mov dword [page_tabs+ecx*4], 0
|
|
invlpg [eax]
|
|
ret
|
|
endp
|
|
|
|
; in: esi+edx*4 = pointer to page table entry
|
|
; in: [slot], [req_access], [ofs] on the stack
|
|
; in: edi = linear address to map
|
|
; in: address space lock must be held
|
|
; out: CF cleared <=> failed
|
|
; destroys: only eax
|
|
proc lock_and_map_page stdcall, slot:dword, req_access:dword, ofs:dword
|
|
locals
|
|
locked_descr dd ?
|
|
endl
|
|
|
|
mov eax, [esi+edx*4]
|
|
test eax, PG_READ
|
|
jz .not_present
|
|
test eax, PG_SHARED
|
|
jnz .resolve_shared
|
|
; normal case: not shared allocated page, mark as shared and map with requested access
|
|
or dword [esi+edx*4], PG_SHARED
|
|
.map:
|
|
and eax, not 0xFFF
|
|
stdcall map_page, edi, eax, [req_access]
|
|
stc
|
|
.fail:
|
|
ret
|
|
.not_present:
|
|
; check for alloc-on-demand page
|
|
test eax, LAZY_ALLOC_PAGE
|
|
jz .fail
|
|
; allocate new page, save it to source page table
|
|
push ecx
|
|
call alloc_zero_page
|
|
pop ecx
|
|
test eax, eax
|
|
jz .fail
|
|
or eax, PG_READ+PG_SHARED
|
|
test dword [esi+edx*4], LAZY_ALLOC_UNREADABLE
|
|
jnz @f
|
|
or eax, PG_USER
|
|
@@:
|
|
test dword [esi+edx*4], LAZY_ALLOC_UNWRITABLE
|
|
jnz @f
|
|
or eax, PG_WRITE
|
|
@@:
|
|
mov [esi+edx*4], eax
|
|
jmp .map
|
|
.resolve_shared:
|
|
push ecx edx eax
|
|
mov eax, sizeof.SHARED_LOCKED_PAGE
|
|
call malloc
|
|
mov [locked_descr], eax
|
|
test eax, eax
|
|
jz .fail_pop
|
|
mov edx, [esp]
|
|
and edx, not 0xFFF
|
|
mov [eax+SHARED_LOCKED_PAGE.address], edx
|
|
mov eax, [slot]
|
|
shl eax, 8
|
|
mov eax, [SLOT_BASE+eax+APPDATA.process]
|
|
mov ecx, [eax+PROC.smap_list]
|
|
add eax, PROC.smap_list
|
|
.find_shared_parent:
|
|
cmp ecx, eax
|
|
jz .shared_orphan
|
|
mov edx, [ofs]
|
|
sub edx, [ecx+SMAP.base]
|
|
cmp edx, [ecx+SMAP.size]
|
|
jb .found_shared_parent
|
|
mov ecx, [ecx+SMAP.fd]
|
|
jmp .find_shared_parent
|
|
.shared_abandoned:
|
|
call mutex_unlock
|
|
.shared_orphan:
|
|
; no copy-on-write for orphans
|
|
test dword [esp], PG_WRITE
|
|
jnz @f
|
|
test [req_access], PG_WRITE
|
|
jnz .shared_forbidden
|
|
@@:
|
|
; locking the same normal page for second time:
|
|
; the first lock_and_map_page has set PG_SHARED,
|
|
; now we must cooperate with that other thread.
|
|
mov ecx, shared_locked_mutex
|
|
call mutex_lock
|
|
mov eax, [locked_descr]
|
|
mov [eax+SHARED_LOCKED_PAGE.parent], 0
|
|
.shared_common:
|
|
mov edx, [shared_locked_list+SHARED_LOCKED_PAGE.bk]
|
|
mov [eax+SHARED_LOCKED_PAGE.fd], shared_locked_list
|
|
mov [eax+SHARED_LOCKED_PAGE.bk], edx
|
|
mov [edx+SHARED_LOCKED_PAGE.fd], eax
|
|
mov [shared_locked_list+SHARED_LOCKED_PAGE.bk], edx
|
|
call mutex_unlock
|
|
pop eax edx ecx
|
|
jmp .map
|
|
.shared_forbidden_unlock:
|
|
call mutex_unlock
|
|
.shared_forbidden:
|
|
mov eax, [locked_descr]
|
|
call free
|
|
.fail_pop:
|
|
pop eax edx ecx
|
|
clc
|
|
ret
|
|
.found_shared_parent:
|
|
shr edx, 12
|
|
mov eax, [locked_descr]
|
|
mov [eax+SHARED_LOCKED_PAGE.offs], edx
|
|
cmp [ecx+SMAP.type], SMAP_TYPE_PE
|
|
jnz .parent_smap
|
|
push edx
|
|
mov ecx, [ecx+SMAP.parent]
|
|
add ecx, PEDESCR.page_array_lock
|
|
call mutex_lock
|
|
pop edx
|
|
mov eax, [esp]
|
|
xor eax, [ecx+sizeof.PEDESCR-PEDESCR.page_array_lock+edx*4]
|
|
test eax, not 0xFFF
|
|
jnz .shared_abandoned
|
|
test dword [esp], PG_WRITE
|
|
jnz @f
|
|
test [req_access], PG_WRITE
|
|
jnz .pedescr_try_cow
|
|
@@:
|
|
mov eax, [ecx+sizeof.PEDESCR-PEDESCR.page_array_lock+edx*4]
|
|
inc eax
|
|
test eax, 0xFF
|
|
jnz @f
|
|
dec eax
|
|
@@:
|
|
mov [ecx+sizeof.PEDESCR-PEDESCR.page_array_lock+edx*4], eax
|
|
push ecx
|
|
mov ecx, pe_list_mutex
|
|
call mutex_lock
|
|
mov eax, [esp]
|
|
inc dword [eax+PEDESCR.refcount-PEDESCR.page_array_lock]
|
|
call mutex_unlock
|
|
pop ecx
|
|
call mutex_unlock
|
|
sub ecx, PEDESCR.page_array_lock
|
|
push ecx
|
|
.shared_common2:
|
|
mov ecx, shared_locked_mutex
|
|
call mutex_lock
|
|
mov eax, [locked_descr]
|
|
pop [eax+SHARED_LOCKED_PAGE.parent]
|
|
jmp .shared_common
|
|
.pedescr_try_cow:
|
|
mov eax, [ecx+sizeof.PEDESCR-PEDESCR.page_array_lock+edx*4]
|
|
test eax, IMAGE_SCN_MEM_WRITE shr 20
|
|
jz @f
|
|
or dword [esp], PG_WRITE
|
|
@@:
|
|
dec eax
|
|
test eax, 0xFF
|
|
jnz .pedescr_alloc_copy
|
|
mov dword [ecx+sizeof.PEDESCR-PEDESCR.page_array_lock+edx*4], 0
|
|
call mutex_unlock
|
|
mov eax, [locked_descr]
|
|
call free
|
|
pop eax edx ecx
|
|
or eax, PG_SHARED
|
|
mov [esi+edx*4], eax
|
|
jmp .map
|
|
.pedescr_alloc_copy:
|
|
push ecx edx
|
|
stdcall kernel_alloc, 0x1000
|
|
pop edx ecx
|
|
test eax, eax
|
|
jz .shared_forbidden_unlock
|
|
dec dword [ecx+sizeof.PEDESCR-PEDESCR.page_array_lock+edx*4]
|
|
push ecx esi edi
|
|
mov esi, edi
|
|
mov edi, eax
|
|
stdcall map_page, esi, [ecx+sizeof.PEDESCR-PEDESCR.page_array_lock+edx*4], PG_READ
|
|
mov ecx, 0x1000/4
|
|
rep movsd
|
|
sub esi, 0x1000
|
|
sub edi, 0x1000
|
|
mov eax, edi
|
|
call get_pg_addr
|
|
and dword [esp+12], 0xFFF
|
|
or dword [esp+12], eax
|
|
stdcall map_page, esi, eax, [req_access]
|
|
stdcall free_kernel_space, edi
|
|
pop edi esi ecx
|
|
call mutex_unlock
|
|
mov eax, [locked_descr]
|
|
call free
|
|
pop eax edx ecx
|
|
or eax, PG_SHARED
|
|
mov [esi+edx*4], eax
|
|
stc
|
|
ret
|
|
.parent_smap:
|
|
test dword [esp], PG_WRITE
|
|
jnz @f
|
|
test [req_access], PG_WRITE
|
|
jz .shared_forbidden
|
|
@@:
|
|
push [ecx+SMAP.parent]
|
|
mov ecx, shmem_list_mutex
|
|
call mutex_lock
|
|
mov eax, [esp]
|
|
inc dword [esp]
|
|
inc [eax+SMEM.refcount]
|
|
call mutex_unlock
|
|
jmp .shared_common2
|
|
endp
|
|
|
|
; in: esi -> process page table entry or esi < 0x1000 if no page table entry
|
|
; in: edi = page number for mapped copy
|
|
; in: shared_locked_mutex is held
|
|
; destroys eax, ecx, edx
|
|
proc unlock_and_unmap_page
|
|
mov edx, [page_tabs+edi*4]
|
|
and edx, not 0xFFF
|
|
mov dword [page_tabs+edi*4], 0
|
|
mov eax, edi
|
|
shl eax, 12
|
|
invlpg [eax]
|
|
mov eax, [shared_locked_list+SHARED_LOCKED_PAGE.fd]
|
|
.check_list:
|
|
cmp eax, shared_locked_list
|
|
jz .not_in_list
|
|
cmp edx, [eax+SHARED_LOCKED_PAGE.address]
|
|
jz .found_in_list
|
|
mov eax, [eax+SHARED_LOCKED_PAGE.fd]
|
|
jmp .check_list
|
|
.found_in_list:
|
|
push esi
|
|
mov esi, [eax+SHARED_LOCKED_PAGE.parent]
|
|
mov edx, [eax+SHARED_LOCKED_PAGE.fd]
|
|
mov ecx, [eax+SHARED_LOCKED_PAGE.bk]
|
|
mov [edx+SHARED_LOCKED_PAGE.bk], ecx
|
|
mov [ecx+SHARED_LOCKED_PAGE.fd], edx
|
|
test esi, esi
|
|
jz .orphan
|
|
btr esi, 0
|
|
jc .parent_smap
|
|
push eax
|
|
lea ecx, [esi+PEDESCR.page_array_lock]
|
|
call mutex_lock
|
|
mov edx, [esp]
|
|
mov edx, [edx+SHARED_LOCKED_PAGE.offs]
|
|
mov eax, [esi+sizeof.PEDESCR+edx*4]
|
|
and eax, 0xFF
|
|
cmp eax, 0xFF
|
|
jz .no_deref
|
|
mov eax, [esi+sizeof.PEDESCR+edx*4]
|
|
dec eax
|
|
test eax, 0xFF
|
|
jnz @f
|
|
call free_page
|
|
xor eax, eax
|
|
@@:
|
|
mov [esi+sizeof.PEDESCR+edx*4], eax
|
|
.no_deref:
|
|
lea ecx, [esi+PEDESCR.page_array_lock]
|
|
call mutex_unlock
|
|
call dereference_pe
|
|
pop eax
|
|
call free
|
|
pop esi
|
|
ret
|
|
.parent_smap:
|
|
call free
|
|
call dereference_smem
|
|
pop esi
|
|
ret
|
|
.orphan:
|
|
call free
|
|
pop esi
|
|
ret
|
|
.not_in_list:
|
|
cmp esi, 0x1000
|
|
jb .just_free
|
|
mov eax, [esi]
|
|
and eax, not 0xFFF
|
|
cmp eax, edx
|
|
jnz .just_free
|
|
and dword [esi], not PG_SHARED
|
|
ret
|
|
.just_free:
|
|
mov eax, edx
|
|
call free_page
|
|
ret
|
|
endp
|
|
|
|
sys_IPC:
|
|
;input:
|
|
; ebx=1 - set ipc buffer area
|
|
; ecx=address of buffer
|
|
; edx=size of buffer
|
|
; eax=2 - send message
|
|
; ebx=PID
|
|
; ecx=address of message
|
|
; edx=size of message
|
|
|
|
dec ebx
|
|
jnz @f
|
|
|
|
mov eax, [current_slot]
|
|
pushf
|
|
cli
|
|
mov [eax+APPDATA.ipc_start], ecx ;set fields in extended information area
|
|
mov [eax+APPDATA.ipc_size], edx
|
|
|
|
add edx, ecx
|
|
add edx, 4095
|
|
and edx, not 4095
|
|
|
|
.touch:
|
|
mov eax, [ecx]
|
|
add ecx, 0x1000
|
|
cmp ecx, edx
|
|
jb .touch
|
|
|
|
popf
|
|
mov [esp+32], ebx ;ebx=0
|
|
ret
|
|
|
|
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
;2
|
|
@@:
|
|
dec ebx
|
|
jnz @f
|
|
|
|
stdcall sys_ipc_send, ecx, edx, esi
|
|
mov [esp+32], eax
|
|
ret
|
|
@@:
|
|
or eax, -1
|
|
mov [esp+32], eax
|
|
ret
|
|
|
|
proc sys_ipc_send stdcall, PID:dword, msg_addr:dword, msg_size:dword
|
|
locals
|
|
dst_slot dd ?
|
|
dst_offset dd ?
|
|
dst_ptr dd ?
|
|
buf_size dd ?
|
|
used_buf dd ?
|
|
mapped_size dd ?
|
|
result dd ?
|
|
endl
|
|
|
|
mov ecx, ipc_mutex
|
|
call mutex_lock
|
|
|
|
mov eax, [PID]
|
|
call pid_to_slot
|
|
test eax, eax
|
|
jz .no_pid
|
|
|
|
mov [dst_slot], eax
|
|
shl eax, 8
|
|
mov edi, [eax+SLOT_BASE+APPDATA.ipc_start] ;is ipc area defined?
|
|
test edi, edi
|
|
jz .no_ipc_area
|
|
mov [dst_ptr], edi
|
|
|
|
mov ebx, edi
|
|
and ebx, 0xFFF
|
|
mov [dst_offset], ebx
|
|
|
|
mov esi, [eax+SLOT_BASE+APPDATA.ipc_size]
|
|
mov [buf_size], esi
|
|
|
|
mov ecx, [ipc_tmp]
|
|
cmp esi, 0x40000-0x1000; size of [ipc_tmp] minus one page
|
|
jbe @f
|
|
push esi edi
|
|
add esi, 0x1000
|
|
stdcall alloc_kernel_space, esi
|
|
mov ecx, eax
|
|
pop edi esi
|
|
@@:
|
|
mov [used_buf], ecx
|
|
stdcall map_memEx, ecx, [dst_slot], \
|
|
edi, esi, PG_SWR, [ipc_ptab]
|
|
mov [mapped_size], eax
|
|
mov [result], 3 ; buffer overflow
|
|
sub eax, [dst_offset]
|
|
jc .no_copy_data
|
|
cmp [buf_size], eax
|
|
jb @f
|
|
mov [buf_size], eax
|
|
@@:
|
|
cmp [buf_size], 8
|
|
jb .no_copy_data
|
|
|
|
mov [result], 2 ; ipc blocked
|
|
mov edi, [dst_offset]
|
|
add edi, [used_buf]
|
|
cmp dword [edi], 0
|
|
jnz .no_copy_data ;if dword [buffer]<>0 - ipc blocked now
|
|
|
|
mov [result], 3 ; buffer overflow
|
|
mov edx, dword [edi+4]
|
|
lea ebx, [edx+8]
|
|
add ebx, [msg_size]
|
|
cmp ebx, [buf_size]
|
|
ja .no_copy_data ;esi<0 - not enough memory in buffer
|
|
|
|
mov [result], 0
|
|
mov dword [edi+4], ebx
|
|
mov eax, [TASK_BASE]
|
|
mov eax, [eax+TASKDATA.pid] ;eax - our PID
|
|
add edi, edx
|
|
mov [edi], eax
|
|
mov ecx, [msg_size]
|
|
|
|
mov [edi+4], ecx
|
|
add edi, 8
|
|
mov esi, [msg_addr]
|
|
; add esi, new_app_base
|
|
cld
|
|
rep movsb
|
|
.no_copy_data:
|
|
stdcall unmap_memEx, [used_buf], [dst_slot], [dst_ptr], [mapped_size], [ipc_ptab]
|
|
|
|
cmp [result], 0
|
|
jnz @f
|
|
mov eax, [dst_slot]
|
|
shl eax, BSF sizeof.APPDATA
|
|
or [eax+SLOT_BASE+APPDATA.occurred_events], EVENT_IPC
|
|
@@:
|
|
mov eax, [used_buf]
|
|
cmp eax, [ipc_tmp]
|
|
je @f
|
|
stdcall free_kernel_space, eax
|
|
@@:
|
|
mov ecx, ipc_mutex
|
|
call mutex_unlock
|
|
mov eax, [result]
|
|
ret
|
|
.no_pid:
|
|
mov ecx, ipc_mutex
|
|
call mutex_unlock
|
|
mov eax, 4
|
|
ret
|
|
.no_ipc_area:
|
|
mov ecx, ipc_mutex
|
|
call mutex_unlock
|
|
xor eax, eax
|
|
inc eax
|
|
ret
|
|
endp
|
|
|
|
align 4
|
|
sysfn_meminfo:
|
|
cmp ecx, OS_BASE
|
|
jae .fail
|
|
|
|
mov eax, [pg_data.pages_count]
|
|
mov [ecx], eax
|
|
shl eax, 12
|
|
mov [esp+32], eax
|
|
mov eax, [pg_data.pages_free]
|
|
mov [ecx+4], eax
|
|
mov eax, [pg_data.pages_faults]
|
|
mov [ecx+8], eax
|
|
mov eax, [heap_size]
|
|
mov [ecx+12], eax
|
|
mov eax, [heap_free]
|
|
mov [ecx+16], eax
|
|
mov eax, [heap_blocks]
|
|
mov [ecx+20], eax
|
|
mov eax, [free_blocks]
|
|
mov [ecx+24], eax
|
|
ret
|
|
.fail:
|
|
or dword [esp+32], -1
|
|
ret
|
|
|
|
align 4
|
|
f68:
|
|
cmp ebx, 4
|
|
jbe sys_sheduler
|
|
cmp ebx, 11
|
|
jb undefined_syscall
|
|
cmp ebx, 32
|
|
ja undefined_syscall
|
|
xor eax, eax
|
|
jmp dword [f68call+ebx*4-11*4]
|
|
.11:
|
|
call init_heap
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.12:
|
|
stdcall user_alloc, ecx
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.13:
|
|
stdcall user_free, ecx
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.14:
|
|
cmp ecx, OS_BASE
|
|
jae .fail
|
|
mov edi, ecx
|
|
call get_event_ex
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.16:
|
|
test ecx, ecx
|
|
jz .fail
|
|
cmp ecx, OS_BASE
|
|
jae .fail
|
|
stdcall get_service, ecx
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.17:
|
|
call srv_handlerEx ;ecx
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.18:
|
|
mov eax, edx
|
|
.19:
|
|
cmp ecx, OS_BASE
|
|
jae .fail
|
|
stdcall load_library, ecx, eax
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.20:
|
|
mov eax, edx
|
|
mov ebx, ecx
|
|
call user_realloc ;in: eax = pointer, ebx = new size
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.21:
|
|
cmp ecx, OS_BASE
|
|
jae .fail
|
|
cmp edx, OS_BASE
|
|
jae .fail
|
|
stdcall load_pe_driver, ecx, edx
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.22:
|
|
cmp ecx, OS_BASE
|
|
jae .fail
|
|
stdcall shmem_open, ecx, edx, esi
|
|
mov [esp+SYSCALL_STACK._edx], edx
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.23:
|
|
cmp ecx, OS_BASE
|
|
jae .fail
|
|
stdcall shmem_close, ecx
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.24:
|
|
mov eax, [current_slot]
|
|
xchg ecx, [eax+APPDATA.exc_handler]
|
|
xchg edx, [eax+APPDATA.except_mask]
|
|
mov [esp+SYSCALL_STACK._ebx], edx
|
|
mov [esp+SYSCALL_STACK._eax], ecx
|
|
ret
|
|
.25:
|
|
cmp ecx, 32
|
|
jae .fail
|
|
mov eax, [current_slot]
|
|
btr [eax+APPDATA.except_mask], ecx
|
|
setc byte[esp+SYSCALL_STACK._eax]
|
|
jecxz @f
|
|
bts [eax+APPDATA.except_mask], ecx
|
|
@@:
|
|
ret
|
|
.26:
|
|
stdcall user_unmap, ecx, edx, esi
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.27:
|
|
cmp ecx, OS_BASE
|
|
jae .fail
|
|
stdcall load_file_umode, ecx
|
|
mov [esp+SYSCALL_STACK._edx], edx
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.28:
|
|
cmp ecx, OS_BASE
|
|
jae .fail
|
|
push ecx edx
|
|
stdcall kernel_alloc, maxPathLength
|
|
mov edi, eax
|
|
pop eax esi
|
|
push edi
|
|
call getFullPath
|
|
pop ebp
|
|
test eax, eax
|
|
jz @f
|
|
stdcall load_file_umode, ebp
|
|
mov [esp+SYSCALL_STACK._edx], edx
|
|
@@:
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
stdcall kernel_free, ebp
|
|
ret
|
|
|
|
.29:
|
|
stdcall user_ring, ecx
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
.30:
|
|
cmp ecx, OS_BASE
|
|
jae .fail
|
|
stdcall load_file_maybe_pe, ecx
|
|
test esi, esi
|
|
jz .30.not_pe
|
|
stdcall map_pe_usermode, esi, eax, ebx
|
|
mov [esp+32], eax
|
|
ret
|
|
.30.resolve_fail:
|
|
movi eax, -5
|
|
jmp .30.error
|
|
.30.not_pe:
|
|
cmp eax, -0x1000
|
|
ja .30.error
|
|
stdcall kernel_free, eax
|
|
movi eax, -31
|
|
.30.error:
|
|
mov [esp+32], eax
|
|
ret
|
|
|
|
.31:
|
|
stdcall unmap_pe_usermode, ecx
|
|
mov [esp+32], eax
|
|
ret
|
|
|
|
.32:
|
|
stdcall mprotect, edx, esi, ecx
|
|
mov [esp+32], eax
|
|
ret
|
|
|
|
.fail:
|
|
mov [esp+SYSCALL_STACK._eax], eax
|
|
ret
|
|
|
|
align 4
|
|
f68call: ; keep this table closer to main code
|
|
|
|
dd f68.11 ; init_heap
|
|
dd f68.12 ; user_alloc
|
|
dd f68.13 ; user_free
|
|
dd f68.14 ; get_event_ex
|
|
dd f68.fail ; moved to f68.24
|
|
dd f68.16 ; get_service
|
|
dd f68.17 ; call_service
|
|
dd f68.18 ; loadLibUnicode
|
|
dd f68.19 ; load_dll
|
|
dd f68.20 ; user_realloc
|
|
dd f68.21 ; load_driver
|
|
dd f68.22 ; shmem_open
|
|
dd f68.23 ; shmem_close
|
|
dd f68.24 ; set exception handler
|
|
dd f68.25 ; unmask exception
|
|
dd f68.26 ; user_unmap
|
|
dd f68.27 ; load_file_umode
|
|
dd f68.28 ; loadFileUnicode
|
|
dd f68.29 ; user_ring
|
|
dd f68.30 ; map_pe_usermode
|
|
dd f68.31 ; unmap_pe_usermode
|
|
dd f68.32 ; mprotect
|
|
|
|
align 4
|
|
proc load_pe_driver stdcall, file:dword, cmdline:dword
|
|
push esi
|
|
|
|
stdcall load_PE, [file]
|
|
test eax, eax
|
|
jz .fail
|
|
|
|
mov esi, eax
|
|
push [cmdline]
|
|
push DRV_ENTRY
|
|
call eax
|
|
pop ecx
|
|
pop ecx
|
|
test eax, eax
|
|
jz .fail
|
|
|
|
mov [eax+SRV.entry], esi
|
|
pop esi
|
|
ret
|
|
|
|
.fail:
|
|
xor eax, eax
|
|
pop esi
|
|
ret
|
|
endp
|
|
|
|
align 4
|
|
proc create_ring_buffer stdcall, size:dword, flags:dword
|
|
locals
|
|
buf_ptr dd ?
|
|
endl
|
|
|
|
mov eax, [size]
|
|
test eax, eax
|
|
jz .fail
|
|
|
|
add eax, eax
|
|
stdcall alloc_kernel_space, eax
|
|
test eax, eax
|
|
jz .fail
|
|
|
|
push ebx
|
|
|
|
mov [buf_ptr], eax
|
|
|
|
mov ebx, [size]
|
|
shr ebx, 12
|
|
push ebx
|
|
|
|
stdcall alloc_pages, ebx
|
|
pop ecx
|
|
|
|
test eax, eax
|
|
jz .mm_fail
|
|
|
|
push edi
|
|
|
|
or eax, [flags]
|
|
mov edi, [buf_ptr]
|
|
mov ebx, [buf_ptr]
|
|
mov edx, ecx
|
|
shl edx, 2
|
|
shr edi, 10
|
|
@@:
|
|
mov [page_tabs+edi], eax
|
|
mov [page_tabs+edi+edx], eax
|
|
invlpg [ebx]
|
|
invlpg [ebx+0x10000]
|
|
add eax, 0x1000
|
|
add ebx, 0x1000
|
|
add edi, 4
|
|
dec ecx
|
|
jnz @B
|
|
|
|
mov eax, [buf_ptr]
|
|
pop edi
|
|
pop ebx
|
|
ret
|
|
.mm_fail:
|
|
stdcall free_kernel_space, [buf_ptr]
|
|
xor eax, eax
|
|
pop ebx
|
|
.fail:
|
|
ret
|
|
endp
|
|
|
|
|
|
align 4
|
|
proc print_mem
|
|
mov edi, BOOT.memmap_blocks
|
|
mov ecx, [edi-4]
|
|
test ecx, ecx
|
|
jz .done
|
|
|
|
@@:
|
|
mov eax, [edi]
|
|
mov edx, [edi+4]
|
|
add eax, [edi+8]
|
|
adc edx, [edi+12]
|
|
|
|
DEBUGF 1, "K : E820 %x%x - %x%x type %d\n", \
|
|
[edi+4], [edi],\
|
|
edx, eax, [edi+16]
|
|
add edi, 20
|
|
dec ecx
|
|
jnz @b
|
|
.done:
|
|
ret
|
|
endp
|