21628ddbd6
First and most importantly, I threw out the thread priority-twiddling implementation of KeRaiseIrql()/KeLowerIrq()/KeGetCurrentIrql() in favor of a new scheme that uses sleep mutexes. The old scheme was really very naughty and sought to provide the same behavior as Windows spinlocks (i.e. blocking pre-emption) but in a way that wouldn't raise the ire of WITNESS. The new scheme represents 'DISPATCH_LEVEL' as the acquisition of a per-cpu sleep mutex. If a thread on cpu0 acquires the 'dispatcher mutex,' it will block any other thread on the same processor that tries to acquire it, in effect only allowing one thread on the processor to be at 'DISPATCH_LEVEL' at any given time. It can then do the 'atomic sit and spin' routine on the spinlock variable itself. If a thread on cpu1 wants to acquire the same spinlock, it acquires the 'dispatcher mutex' for cpu1 and then it too does an atomic sit and spin to try acquiring the spinlock. Unlike real spinlocks, this does not disable pre-emption of all threads on the CPU, but it does put any threads involved with the NDISulator to sleep, which is just as good for our purposes. This means I can now play nice with WITNESS, and I can safely do things like call malloc() when I'm at 'DISPATCH_LEVEL,' which you're allowed to do in Windows. Next, I completely re-wrote most of the event/timer/mutex handling and wait code. KeWaitForSingleObject() and KeWaitForMultipleObjects() have been re-written to use condition variables instead of msleep(). This allows us to use the Windows convention whereby thread A can tell thread B "wake up with a boosted priority." (With msleep(), you instead have thread B saying "when I get woken up, I'll use this priority here," and thread A can't tell it to do otherwise.) The new KeWaitForMultipleObjects() has been better tested and better duplicates the semantics of its Windows counterpart. I also overhauled the IoQueueWorkItem() API and underlying code. Like KeInsertQueueDpc(), IoQueueWorkItem() must insure that the same work item isn't put on the queue twice. ExQueueWorkItem(), which in my implementation is built on top of IoQueueWorkItem(), was also modified to perform a similar test. I renamed the doubly-linked list macros to give them the same names as their Windows counterparts and fixed RemoveListTail() and RemoveListHead() so they properly return the removed item. I also corrected the list handling code in ntoskrnl_dpc_thread() and ntoskrnl_workitem_thread(). I realized that the original logic did not correctly handle the case where a DPC callout tries to queue up another DPC. It works correctly now. I implemented IoConnectInterrupt() and IoDisconnectInterrupt() and modified NdisMRegisterInterrupt() and NdisMDisconnectInterrupt() to use them. I also tried to duplicate the interrupt handling scheme used in Windows. The interrupt handling is now internal to ndis.ko, and the ndis_intr() function has been removed from if_ndis.c. (In the USB case, interrupt handling isn't needed in if_ndis.c anyway.) NdisMSleep() has been rewritten to use a KeWaitForSingleObject() and a KeTimer, which is how it works in Windows. (This is mainly to insure that the NDISulator uses the KeTimer API so I can spot any problems with it that may arise.) KeCancelTimer() has been changed so that it only cancels timers, and does not attempt to cancel a DPC if the timer managed to fire and queue one up before KeCancelTimer() was called. The Windows DDK documentation seems to imply that KeCantelTimer() will also call KeRemoveQueueDpc() if necessary, but it really doesn't. The KeTimer implementation has been rewritten to use the callout API directly instead of timeout()/untimeout(). I still cheat a little in that I have to manage my own small callout timer wheel, but the timer code works more smoothly now. I discovered a race condition using timeout()/untimeout() with periodic timers where untimeout() fails to actually cancel a timer. I don't quite understand where the race is, using callout_init()/callout_reset()/callout_stop() directly seems to fix it. I also discovered and fixed a bug in winx32_wrap.S related to translating _stdcall calls. There are a couple of routines (i.e. the 64-bit arithmetic intrinsics in subr_ntoskrnl) that return 64-bit quantities. On the x86 arch, 64-bit values are returned in the %eax and %edx registers. However, it happens that the ctxsw_utow() routine uses %edx as a scratch register, and x86_stdcall_wrap() and x86_stdcall_call() were only preserving %eax before branching to ctxsw_utow(). This means %edx was getting clobbered in some cases. Curiously, the most noticeable effect of this bug is that the driver for the TI AXC110 chipset would constantly drop and reacquire its link for no apparent reason. Both %eax and %edx are preserved on the stack now. The _fastcall and _regparm wrappers already handled everything correctly. I changed if_ndis to use IoAllocateWorkItem() and IoQueueWorkItem() instead of the NdisScheduleWorkItem() API. This is to avoid possible deadlocks with any drivers that use NdisScheduleWorkItem() themselves. The unicode/ansi conversion handling code has been cleaned up. The internal routines have been moved to subr_ntoskrnl and the RtlXXX routines have been exported so that subr_ndis can call them. This removes the incestuous relationship between the two modules regarding this code and fixes the implementation so that it honors the 'maxlen' fields correctly. (Previously it was possible for NdisUnicodeStringToAnsiString() to possibly clobber memory it didn't own, which was causing many mysterious crashes in the Marvell 8335 driver.) The registry handling code (NdisOpen/Close/ReadConfiguration()) has been fixed to allocate memory for all the parameters it hands out to callers and delete whem when NdisCloseConfiguration() is called. (Previously, it would secretly use a single static buffer.) I also substantially updated if_ndis so that the source can now be built on FreeBSD 7, 6 and 5 without any changes. On FreeBSD 5, only WEP support is enabled. On FreeBSD 6 and 7, WPA-PSK support is enabled. The original WPA code has been updated to fit in more cleanly with the net80211 API, and to eleminate the use of magic numbers. The ndis_80211_setstate() routine now sets a default authmode of OPEN and initializes the RTS threshold and fragmentation threshold. The WPA routines were changed so that the authentication mode is always set first, followed by the cipher. Some drivers depend on the operations being performed in this order. I also added passthrough ioctls that allow application code to directly call the MiniportSetInformation()/MiniportQueryInformation() methods via ndis_set_info() and ndis_get_info(). The ndis_linksts() routine also caches the last 4 events signalled by the driver via NdisMIndicateStatus(), and they can be queried by an application via a separate ioctl. This is done to allow wpa_supplicant to directly program the various crypto and key management options in the driver, allowing things like WPA2 support to work. Whew.
373 lines
12 KiB
ArmAsm
373 lines
12 KiB
ArmAsm
/*-
|
|
* Copyright (c) 2005
|
|
* Bill Paul <wpaul@windriver.com>. All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. All advertising materials mentioning features or use of this software
|
|
* must display the following acknowledgement:
|
|
* This product includes software developed by Bill Paul.
|
|
* 4. Neither the name of the author nor the names of any co-contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
|
|
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
|
|
* THE POSSIBILITY OF SUCH DAMAGE.
|
|
*
|
|
* $FreeBSD$
|
|
*/
|
|
|
|
#include <machine/asmacros.h>
|
|
|
|
/*
|
|
* This file contains assembly language wrappers for the different
|
|
* calling conventions supported by Windows on the i386 architecture.
|
|
* In FreeBSD, the whole OS typically use same C calling convention
|
|
* everywhere, namely _cdecl. Windows, on the other hand, uses several
|
|
* different C calling conventions depending on the circumstances:
|
|
*
|
|
* _stdcall: Used for most ordinary Windows APIs. With _stdcall,
|
|
* arguments are passed on the stack, and the callee unwinds the stack
|
|
* before returning control to the caller. Not suitable for variadic
|
|
* functions.
|
|
*
|
|
* _fastcall: Used for some APIs that may be invoked frequently and
|
|
* where speed is a critical factor (e.g. KeAcquireSpinLock() and
|
|
* KeReleaseSpinLock()) Similar to _stdcall, except the first 2 32-bit
|
|
* or smaller arguments are passed in the %ecx and %edx registers
|
|
* instead of on the stack. Not suitable for variadic functions.
|
|
*
|
|
* _cdecl: Used for standard C library routines and for variadic
|
|
* functions.
|
|
*
|
|
* _regparm(3): Used for certain assembly routines. All arguments
|
|
* passed in %eax, %ecx and %edx.
|
|
*
|
|
* Furthermore, there is an additional wrinkle that's not obvious
|
|
* with all code: Microsoft supports the use of exceptions in C
|
|
* (__try/__except) both in user _and_ kernel mode. Sadly, Windows
|
|
* structured exception handling uses machine-specific features
|
|
* that conflict rather badly with FreeBSD. (See utility routines
|
|
* at the end of this module for more details.)
|
|
*
|
|
* We want to support these calling conventions in as portable a manner
|
|
* as possible. The trick is doing it not only with different versions
|
|
* of GNU C, but with compilers other than GNU C (e.g. the Solaris
|
|
* SunOne C compiler). The only sure fire method is with assembly
|
|
* language trampoline code which both fixes up the argument passing,
|
|
* stack unwinding and exception/thread context all at once.
|
|
*
|
|
* You'll notice that we call the thunk/unthunk routines in the
|
|
* *_wrap() functions in an awkward way. Rather than branching
|
|
* directly to the address, we load the address into a register
|
|
* first as a literal value, then we branch to it. This is done
|
|
* to insure that the assembler doesn't translate the branch into
|
|
* a relative branch. We use the *_wrap() routines here as templates
|
|
* and create the actual trampolines at run time, at which point
|
|
* we only know the absolute addresses of the thunk and unthunk
|
|
* routines. So we need to make sure the templates have enough
|
|
* room in them for the full address.
|
|
*
|
|
* Also note that when we call the a thunk/unthunk routine after
|
|
* invoking a wrapped function, we have to make sure to preserve
|
|
* the value returned from that function. Most functions return
|
|
* a 32-bit value in %eax, however some routines return 64-bit
|
|
* values, which span both %eax and %edx. Consequently, we have
|
|
* to preserve both registers.
|
|
*/
|
|
|
|
/*
|
|
* Handle _stdcall going from Windows to UNIX.
|
|
* This is frustrating, because to do it right you have to
|
|
* know how many arguments the called function takes, and there's
|
|
* no way to figure this out on the fly: you just have to be told
|
|
* ahead of time. We assume there will be 16 arguments. I don't
|
|
* think there are any Windows APIs that require this many.
|
|
*/
|
|
|
|
.globl x86_stdcall_wrap_call
|
|
.globl x86_stdcall_wrap_arg
|
|
.globl x86_stdcall_wrap_end
|
|
|
|
ENTRY(x86_stdcall_wrap)
|
|
push %esi
|
|
push %edi
|
|
sub $64,%esp
|
|
mov %esp,%esi
|
|
add $64+8+4,%esi
|
|
mov %esp,%edi
|
|
mov $16,%ecx # handle up to 16 args
|
|
rep
|
|
movsl
|
|
|
|
movl $ctxsw_wtou, %eax
|
|
call *%eax # unthunk
|
|
|
|
x86_stdcall_wrap_call:
|
|
movl $0,%eax
|
|
call *%eax # jump to routine
|
|
push %eax # preserve return val
|
|
push %edx
|
|
|
|
movl $ctxsw_utow, %eax
|
|
call *%eax # thunk
|
|
|
|
pop %edx
|
|
pop %eax # restore return val
|
|
|
|
add $64,%esp # clean the stack
|
|
pop %edi
|
|
pop %esi
|
|
x86_stdcall_wrap_arg:
|
|
ret $0xFF
|
|
x86_stdcall_wrap_end:
|
|
|
|
|
|
/*
|
|
* Handle _stdcall going from UNIX to Windows. This routine
|
|
* expects to be passed the function to be called, number of
|
|
* args and the arguments for the Windows function on the stack.
|
|
*/
|
|
|
|
ENTRY(x86_stdcall_call)
|
|
push %esi # must preserve %esi
|
|
push %edi # and %edi
|
|
|
|
mov 16(%esp),%eax # get arg cnt
|
|
mov %eax,%ecx # save as copy count
|
|
mov %esp,%esi # Set source address register to point to
|
|
add $20,%esi # first agument to be forwarded.
|
|
shl $2,%eax # turn arg cnt into offset
|
|
sub %eax,%esp # shift stack to new location
|
|
mov %esp,%edi # store dest copy addr
|
|
rep # do the copy
|
|
movsl
|
|
|
|
call ctxsw_utow # thunk
|
|
|
|
call *12(%edi) # branch to stdcall routine
|
|
push %eax # preserve return val
|
|
push %edx
|
|
|
|
call ctxsw_wtou # unthunk
|
|
|
|
pop %edx
|
|
pop %eax # restore return val
|
|
mov %edi,%esp # restore stack
|
|
pop %edi # restore %edi
|
|
pop %esi # and %esi
|
|
ret
|
|
|
|
/*
|
|
* Fastcall support. Similar to _stdcall, except the first
|
|
* two arguments are passed in %ecx and %edx. It happens we
|
|
* only support a small number of _fastcall APIs, none of them
|
|
* take more than three arguments. So to keep the code size
|
|
* and complexity down, we only handle 3 arguments here.
|
|
*/
|
|
|
|
/* Call _fastcall function going from Windows to UNIX. */
|
|
|
|
.globl x86_fastcall_wrap_call
|
|
.globl x86_fastcall_wrap_arg
|
|
.globl x86_fastcall_wrap_end
|
|
|
|
ENTRY(x86_fastcall_wrap)
|
|
mov 4(%esp),%eax
|
|
push %eax
|
|
push %edx
|
|
push %ecx
|
|
|
|
movl $ctxsw_wtou, %eax
|
|
call *%eax # unthunk
|
|
|
|
x86_fastcall_wrap_call:
|
|
mov $0,%eax
|
|
call *%eax # branch to fastcall routine
|
|
push %eax # preserve return val
|
|
push %edx
|
|
|
|
movl $ctxsw_utow, %eax
|
|
call *%eax # thunk
|
|
|
|
pop %edx
|
|
pop %eax # restore return val
|
|
add $12,%esp # clean the stack
|
|
x86_fastcall_wrap_arg:
|
|
ret $0xFF
|
|
x86_fastcall_wrap_end:
|
|
|
|
/*
|
|
* Call _fastcall function going from UNIX to Windows.
|
|
* This routine isn't normally used since NDIS miniport drivers
|
|
* only have _stdcall entry points, but it's provided anyway
|
|
* to round out the API, and for testing purposes.
|
|
*/
|
|
|
|
ENTRY(x86_fastcall_call)
|
|
mov 4(%esp),%eax
|
|
push 16(%esp)
|
|
|
|
call ctxsw_utow # thunk
|
|
|
|
mov 12(%esp),%ecx
|
|
mov 16(%esp),%edx
|
|
call *8(%esp) # branch to fastcall routine
|
|
push %eax # preserve return val
|
|
push %edx
|
|
|
|
call ctxsw_wtou # unthunk
|
|
|
|
pop %edx
|
|
pop %eax # restore return val
|
|
add $4,%esp # clean the stack
|
|
ret
|
|
|
|
/*
|
|
* Call regparm(3) function going from Windows to UNIX. Arguments
|
|
* are passed in %eax, %edx and %ecx. Note that while additional
|
|
* arguments are passed on the stack, we never bother when them,
|
|
* since the only regparm(3) routines we need to wrap never take
|
|
* more than 3 arguments.
|
|
*/
|
|
|
|
.globl x86_regparm_wrap_call
|
|
.globl x86_regparm_wrap_end
|
|
|
|
ENTRY(x86_regparm_wrap)
|
|
push %ecx
|
|
push %edx
|
|
push %eax
|
|
|
|
movl $ctxsw_wtou, %eax
|
|
call *%eax # unthunk
|
|
|
|
x86_regparm_wrap_call:
|
|
movl $0,%eax
|
|
call *%eax # jump to routine
|
|
push %eax # preserve return val
|
|
push %edx # preserve return val
|
|
|
|
movl $ctxsw_utow, %eax
|
|
call *%eax # thunk
|
|
|
|
pop %edx # restore return val
|
|
pop %eax # restore return val
|
|
add $12,%esp # restore stack
|
|
ret
|
|
x86_regparm_wrap_end:
|
|
|
|
/*
|
|
* Call regparm(3) function going from UNIX to Windows.
|
|
* This routine isn't normally used since NDIS miniport drivers
|
|
* only have _stdcall entry points, but it's provided anyway
|
|
* to round out the API, and for testing purposes.
|
|
*/
|
|
|
|
ENTRY(x86_regparm_call)
|
|
call ctxsw_utow # thunk
|
|
|
|
mov 8(%esp),%eax
|
|
mov 12(%esp),%edx
|
|
mov 16(%esp),%ecx
|
|
call *4(%esp) # branch to fastcall routine
|
|
push %eax # preserve return val
|
|
push %edx # preserve return val
|
|
|
|
call ctxsw_wtou # unthunk
|
|
|
|
pop %edx # restore return val
|
|
pop %eax # restore return val
|
|
ret
|
|
|
|
/*
|
|
* Ugly hack alert:
|
|
*
|
|
* On Win32/i386, using __try/__except results in code that tries to
|
|
* manipulate what's supposed to be the Windows Threada Environment
|
|
* Block (TEB), which one accesses via the %fs register. In particular,
|
|
* %fs:0 (the first DWORD in the TEB) points to the exception
|
|
* registration list. Unfortunately, FreeBSD uses %fs for the
|
|
* per-cpu data structure (pcpu), and we can't allow Windows code
|
|
* to muck with that. I don't even know what Solaris uses %fs for
|
|
* (or if it even uses it at all).
|
|
*
|
|
* Even worse, in 32-bit protected mode, %fs is a selector that
|
|
* refers to an entry in either the GDT or the LDT. Ideally, we would
|
|
* like to be able to temporarily point it at another descriptor
|
|
* while Windows code executes, but to do that we need a separate
|
|
* descriptor entry of our own to play with.
|
|
*
|
|
* Therefore, we go to some trouble to learn the existing layout of
|
|
* the GDT and update it to include an extra entry that we can use.
|
|
* We need the following utility routines to help us do that. On
|
|
* FreeBSD, index #7 in the GDT happens to be unused, so we turn
|
|
* this into our own data segment descriptor. It would be better
|
|
* if we could use a private LDT entry, but there's no easy way to
|
|
* do that in SMP mode because of the way FreeBSD handles user LDTs.
|
|
*
|
|
* Once we have a custom descriptor, we have to thunk/unthunk whenever
|
|
* we cross between FreeBSD code and Windows code. The thunking is
|
|
* based on the premise that when executing instructions in the
|
|
* Windows binary itself, we won't go to sleep. This is because in
|
|
* order to yield the CPU, the code has to call back out to a FreeBSD
|
|
* routine first, and when that happens we can unthunk in order to
|
|
* restore FreeBSD context. What we're desperately trying to avoid is
|
|
* being involuntarily pre-empted with the %fs register still pointing
|
|
* to our fake TIB: if FreeBSD code runs with %fs pointing at our
|
|
* Windows TIB instead of pcpu, we'll panic the kernel. Fortunately,
|
|
* the only way involuntary preemption can occur is if an interrupt
|
|
* fires, and the trap handler saves/restores %fs for us.
|
|
*
|
|
* The thunking routines themselves, ctxsw_utow() (Context SWitch UNIX
|
|
* to Windows) and ctxsw_wtou() (Context SWitch Windows to UNIX), are
|
|
* external to this module. This is done simply because it's easier
|
|
* to manipulate data structures in C rather than assembly.
|
|
*/
|
|
|
|
ENTRY(x86_getldt)
|
|
movl 4(%esp),%eax
|
|
sgdtl (%eax)
|
|
movl 8(%esp),%eax
|
|
sldt (%eax)
|
|
xor %eax,%eax
|
|
ret
|
|
|
|
ENTRY(x86_setldt)
|
|
movl 4(%esp),%eax
|
|
lgdt (%eax)
|
|
jmp 1f
|
|
nop
|
|
1:
|
|
movl 8(%esp),%eax
|
|
lldt %ax
|
|
xor %eax,%eax
|
|
ret
|
|
|
|
ENTRY(x86_getfs)
|
|
mov %fs,%ax
|
|
ret
|
|
|
|
ENTRY(x86_setfs)
|
|
movl 4(%esp),%fs
|
|
ret
|
|
|
|
ENTRY(x86_gettid)
|
|
mov %fs:12,%eax
|
|
ret
|