[apple/xnu.git] / osfmk / ppc / PseudoKernel.c

/*
 * Copyright (c) 2000 Apple Computer, Inc. All rights reserved.
 *
 * @APPLE_LICENSE_HEADER_START@
 * 
 * The contents of this file constitute Original Code as defined in and
 * are subject to the Apple Public Source License Version 1.1 (the
 * "License").  You may not use this file except in compliance with the
 * License.  Please obtain a copy of the License at
 * http://www.apple.com/publicsource and read it before using this file.
 * 
 * This Original Code and all software distributed under the License are
 * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
 * License for the specific language governing rights and limitations
 * under the License.
 * 
 * @APPLE_LICENSE_HEADER_END@
 */
/*
 	File:		PseudoKernel.c

 	Contains:	BlueBox PseudoKernel calls
	Written by:	Mark Gorlinsky
				Bill Angell

 	Copyright:	1997 by Apple Computer, Inc., all rights reserved

*/

#include <mach/mach_types.h>
#include <mach/kern_return.h>
#include <kern/host.h>
#include <kern/task.h>
#include <kern/thread.h>
#include <ppc/PseudoKernel.h>
#include <ppc/exception.h>
#include <ppc/misc_protos.h>
#include <ppc/proc_reg.h>
#include <vm/vm_kern.h>

void bbSetRupt(ReturnHandler *rh, thread_act_t ct);

/*
** Function:	NotifyInterruption
**
** Inputs:
**		ppcInterrupHandler	- interrupt handler to execute
**		interruptStatePtr	- current interrupt state
**
** Outputs:
**
** Notes:
**
*/
kern_return_t syscall_notify_interrupt ( void ) {
  
    UInt32			interruptState; 
    task_t			task;
	thread_act_t 	act, fact;
	thread_t		thread;
	bbRupt			*bbr;
	BTTD_t			*bttd;
	int				i;

	task = current_task();							/* Figure out who our task is */

	task_lock(task);						/* Lock our task */
	
	fact = (thread_act_t)task->thr_acts.next;		/* Get the first activation on task */
	act = 0;										/* Pretend we didn't find it yet */
	
	for(i = 0; i < task->thr_act_count; i++) {		/* Scan the whole list */
		if(fact->mact.bbDescAddr) {					/* Is this a Blue thread? */
			bttd = (BTTD_t *)(fact->mact.bbDescAddr & -PAGE_SIZE);
			if(bttd->InterruptVector) {				/* Is this the Blue interrupt thread? */
				act = fact;							/* Yeah... */
				break;								/* Found it, Bail the loop... */
			}
		}
		fact = (thread_act_t)fact->thr_acts.next;	/* Go to the next one */
	}

	if(!act) {								/* Couldn't find a bluebox */
		task_unlock(task);					/* Release task lock */
		return KERN_FAILURE;				/* No tickie, no shirtee... */
	}
	
	act_lock_thread(act);							/* Make sure this stays 'round */
	task_unlock(task);								/* Safe to release now */

	/* if the calling thread is the BlueBox thread that handles interrupts
	 * we know that we are in the PsuedoKernel and we can short circuit 
	 * setting up the asynchronous task by setting a pending interrupt.
	 */
	
	if ( (unsigned int)act == (unsigned int)current_act() ) {		
		bttd->InterruptControlWord = bttd->InterruptControlWord | 
			((bttd->postIntMask >> kCR2ToBackupShift) & kBackupCR2Mask);
				
		act_unlock_thread(act);						/* Unlock the activation */
		return KERN_SUCCESS;
	}

	if(act->mact.emPendRupts >= 16) {				/* Have we hit the arbitrary maximum? */
		act_unlock_thread(act);						/* Unlock the activation */
		return KERN_RESOURCE_SHORTAGE;				/* Too many pending right now */
	}
	
	if(!(bbr = (bbRupt *)kalloc(sizeof(bbRupt)))) {	/* Get a return handler control block */
		act_unlock_thread(act);						/* Unlock the activation */
		return KERN_RESOURCE_SHORTAGE;				/* No storage... */
	}
	
	(void)hw_atomic_add(&act->mact.emPendRupts, 1);	/* Count this 'rupt */
	bbr->rh.handler = bbSetRupt;					/* Set interruption routine */

	bbr->rh.next = act->handlers;					/* Put our interrupt at the start of the list */
	act->handlers = &bbr->rh;

	act_set_apc(act);								/* Set an APC AST */

	act_unlock_thread(act);							/* Unlock the activation */
	return KERN_SUCCESS;							/* We're done... */
}

/* 
 *	This guy is fired off asynchronously to actually do the 'rupt.
 *	We will find the user state savearea and modify it.  If we can't,
 *	we just leave after releasing our work area
 */

void bbSetRupt(ReturnHandler *rh, thread_act_t act) {

	savearea 	*sv;
	BTTD_t		*bttd;
	bbRupt		*bbr;
	UInt32		interruptState;
	
	bbr = (bbRupt *)rh;								/* Make our area convenient */

	if(!(act->mact.bbDescAddr)) {					/* Is BlueBox still enabled? */
		kfree((vm_offset_t)bbr, sizeof(bbRupt));	/* No, release the control block */
		return;
	}

	(void)hw_atomic_sub(&act->mact.emPendRupts, 1);	/* Uncount this 'rupt */

	if(!(sv = find_user_regs(act))) {				/* Find the user state registers */
		kfree((vm_offset_t)bbr, sizeof(bbRupt));	/* Couldn't find 'em, release the control block */
		return;
	}

	bttd = (BTTD_t *)(act->mact.bbDescAddr & -PAGE_SIZE);
		
    interruptState = (bttd->InterruptControlWord & kInterruptStateMask) >> kInterruptStateShift; 

    switch (interruptState) {
		
		case kInSystemContext:
			sv->save_cr |= bttd->postIntMask;		/* post int in CR2 */
			break;
			
		case kInAlternateContext:
			bttd->InterruptControlWord = (bttd->InterruptControlWord & ~kInterruptStateMask) | 
				(kInPseudoKernel << kInterruptStateShift);
				
			bttd->exceptionInfo.srr0 = sv->save_srr0;		/* Save the current PC */
			sv->save_srr0 = bttd->InterruptVector;			/* Set the new PC */
			bttd->exceptionInfo.sprg1 = sv->save_r1;		/* Save the original R1 */
			sv->save_r1 = bttd->exceptionInfo.sprg0;		/* Set the new R1 */
			bttd->exceptionInfo.srr1 = sv->save_srr1;		/* Save the original MSR */
			sv->save_srr1 &= ~(MASK(MSR_BE)|MASK(MSR_SE));	/* Clear SE|BE bits in MSR */
			act->mact.specFlags &= ~bbNoMachSC;				/* reactivate Mach SCs */ 
			disable_preemption();							/* Don't move us around */
			per_proc_info[cpu_number()].spcFlags = act->mact.specFlags;	/* Copy the flags */
			enable_preemption();							/* Ok to move us around */
			/* drop through to post int in backup CR2 in ICW */

		case kInExceptionHandler:
		case kInPseudoKernel:
		case kOutsideBlue:
			bttd->InterruptControlWord = bttd->InterruptControlWord | 
				((bttd->postIntMask >> kCR2ToBackupShift) & kBackupCR2Mask);
			break;
				
		default:
			break;
	}

	kfree((vm_offset_t)bbr, sizeof(bbRupt));	/* Release the control block */
	return;

}

/*
 * This function is used to enable the firmware assist code for bluebox traps, system calls
 * and interrupts.
 *
 * The assist code can be called from two types of threads.  The blue thread, which handles 
 * traps, system calls and interrupts and preemptive threads that only issue system calls.
 *
 */ 

kern_return_t enable_bluebox(
      host_t host,
	  void *taskID,								/* opaque task ID */
	  void *TWI_TableStart,						/* Start of TWI table */
	  char *Desc_TableStart						/* Start of descriptor table */
	 ) {
	
	thread_t 		th;
	vm_offset_t		kerndescaddr, physdescaddr, origdescoffset;
	kern_return_t 	ret;
	
	th = current_thread();									/* Get our thread */					

	if ( host == HOST_NULL ) return KERN_INVALID_HOST;
	if ( ! is_suser() ) return KERN_FAILURE;						/* We will only do this for the superuser */
	if ( th->top_act->mact.bbDescAddr ) return KERN_FAILURE;		/* Bail if already authorized... */
	if ( ! (unsigned int) Desc_TableStart ) return KERN_FAILURE;	/* There has to be a descriptor page */ 
	if ( ! TWI_TableStart ) return KERN_FAILURE;					/* There has to be a TWI table */ 

	/* Get the page offset of the descriptor */
	origdescoffset = (vm_offset_t)Desc_TableStart & (PAGE_SIZE - 1);

	/* Align the descriptor to a page */
	Desc_TableStart = (char *)((vm_offset_t)Desc_TableStart & -PAGE_SIZE);

	ret = vm_map_wire(th->top_act->map, 					/* Kernel wire the descriptor in the user's map */
		(vm_offset_t)Desc_TableStart,
		(vm_offset_t)Desc_TableStart + PAGE_SIZE,
		VM_PROT_READ | VM_PROT_WRITE,
		FALSE);															
		
	if(ret != KERN_SUCCESS) {								/* Couldn't wire it, spit on 'em... */
		return KERN_FAILURE;	
	}
		
	physdescaddr = 											/* Get the physical address of the page */
		pmap_extract(th->top_act->map->pmap, (vm_offset_t) Desc_TableStart);

	ret =  kmem_alloc_pageable(kernel_map, &kerndescaddr, PAGE_SIZE);	/* Find a virtual address to use */
	if(ret != KERN_SUCCESS) {								/* Could we get an address? */
		(void) vm_map_unwire(th->top_act->map,				/* No, unwire the descriptor */
			(vm_offset_t)Desc_TableStart,
			(vm_offset_t)Desc_TableStart + PAGE_SIZE,
			TRUE);
		return KERN_FAILURE;								/* Split... */
	}
	
	(void) pmap_enter(kernel_pmap, 							/* Map this into the kernel */
		kerndescaddr, physdescaddr, VM_PROT_READ|VM_PROT_WRITE, 
		VM_WIMG_USE_DEFAULT, TRUE);
	
	th->top_act->mact.bbDescAddr = (unsigned int)kerndescaddr+origdescoffset;	/* Set kernel address of the table */
	th->top_act->mact.bbUserDA = (unsigned int)Desc_TableStart;	/* Set user address of the table */
	th->top_act->mact.bbTableStart = (unsigned int)TWI_TableStart;	/* Set address of the trap table */
	th->top_act->mact.bbTaskID = (unsigned int)taskID;		/* Assign opaque task ID */
	th->top_act->mact.bbTaskEnv = 0;						/* Clean task environment data */
	th->top_act->mact.emPendRupts = 0;						/* Clean pending 'rupt count */
	th->top_act->mact.specFlags &= ~(bbNoMachSC | bbPreemptive);	/* Make sure mach SCs are enabled and we are not marked preemptive */
	th->top_act->mact.specFlags |= bbThread;				/* Set that we are Classic thread */
		
	if(!(((BTTD_t *)kerndescaddr)->InterruptVector)) {		/* See if this is a preemptive (MP) BlueBox thread */
		th->top_act->mact.specFlags |= bbPreemptive;		/* Yes, remember it */
	}
		
	disable_preemption();									/* Don't move us around */
	per_proc_info[cpu_number()].spcFlags = th->top_act->mact.specFlags;	/* Copy the flags */
	enable_preemption();									/* Ok to move us around */
		
	{
		/* mark the proc to indicate that this is a TBE proc */
		extern void tbeproc(void *proc);

		tbeproc(th->top_act->task->bsd_info);
	}

	return KERN_SUCCESS;
}

kern_return_t disable_bluebox( host_t host ) {				/* User call to terminate bluebox */
	
	thread_act_t 	act;
	
	act = current_act();									/* Get our thread */					

	if (host == HOST_NULL) return KERN_INVALID_HOST;
	
	if(!is_suser()) return KERN_FAILURE;					/* We will only do this for the superuser */
	if(!act->mact.bbDescAddr) return KERN_FAILURE;			/* Bail if not authorized... */

	disable_bluebox_internal(act);							/* Clean it all up */
	return KERN_SUCCESS;									/* Leave */
}

void disable_bluebox_internal(thread_act_t act) {			/* Terminate bluebox */
		
	(void) vm_map_unwire(act->map,							/* Unwire the descriptor in user's address space */
		(vm_offset_t)act->mact.bbUserDA,
		(vm_offset_t)act->mact.bbUserDA + PAGE_SIZE,
		FALSE);
		
	kmem_free(kernel_map, (vm_offset_t)act->mact.bbDescAddr & -PAGE_SIZE, PAGE_SIZE);	/* Release the page */
	
	act->mact.bbDescAddr = 0;								/* Clear kernel pointer to it */
	act->mact.bbUserDA = 0;									/* Clear user pointer to it */
	act->mact.bbTableStart = 0;								/* Clear user pointer to TWI table */
	act->mact.bbTaskID = 0;									/* Clear opaque task ID */
	act->mact.bbTaskEnv = 0;								/* Clean task environment data */
	act->mact.emPendRupts = 0;								/* Clean pending 'rupt count */
	act->mact.specFlags &= ~(bbNoMachSC | bbPreemptive | bbThread);	/* Clean up Blue Box enables */
	disable_preemption();								/* Don't move us around */
	per_proc_info[cpu_number()].spcFlags = act->mact.specFlags;	/* Copy the flags */
	enable_preemption();								/* Ok to move us around */
	return;
}

/*
 * Use the new PPCcall method to enable blue box threads
 *
 *	save->r3 = taskID
 *	save->r4 = TWI_TableStart
 *	save->r5 = Desc_TableStart
 *
 */
int bb_enable_bluebox( struct savearea *save )
{
	kern_return_t rc;

	rc = enable_bluebox( (host_t)0xFFFFFFFF, (void *)save->save_r3, (void *)save->save_r4, (char *)save->save_r5 );
	save->save_r3 = rc;
	return 1;										/* Return with normal AST checking */
}

/*
 * Use the new PPCcall method to disable blue box threads
 *
 */
int bb_disable_bluebox( struct savearea *save )
{
	kern_return_t rc;

	rc = disable_bluebox( (host_t)0xFFFFFFFF );
	save->save_r3 = rc;
	return 1;										/* Return with normal AST checking */
}

/*
 * Search through the list of threads to find the matching taskIDs, then
 * set the task environment pointer.  A task in this case is a preemptive thread
 * in MacOS 9.
 *
 *	save->r3 = taskID
 *	save->r4 = taskEnv
 */

int bb_settaskenv( struct savearea *save )
{
	int				i;
    task_t			task;
	thread_act_t	act, fact;


	task = current_task();							/* Figure out who our task is */

	task_lock(task);								/* Lock our task */
	fact = (thread_act_t)task->thr_acts.next;		/* Get the first activation on task */
	act = 0;										/* Pretend we didn't find it yet */
	
	for(i = 0; i < task->thr_act_count; i++) {		/* Scan the whole list */
		if(fact->mact.bbDescAddr) {					/* Is this a Blue thread? */
			if ( fact->mact.bbTaskID == save->save_r3 ) {	/* Is this the task we are looking for? */
				act = fact;							/* Yeah... */
				break;								/* Found it, Bail the loop... */
			}
		}
		fact = (thread_act_t)fact->thr_acts.next;	/* Go to the next one */
	}

	if ( !act || !act->active) {
		task_unlock(task);							/* Release task lock */
		goto failure;
	}

	act_lock_thread(act);							/* Make sure this stays 'round */
	task_unlock(task);								/* Safe to release now */

	act->mact.bbTaskEnv = save->save_r4;
	if(act == current_act()) {						/* Are we setting our own? */
		disable_preemption();						/* Don't move us around */
		per_proc_info[cpu_number()].spcFlags = act->mact.specFlags;	/* Copy the flags */
		enable_preemption();						/* Ok to move us around */
	}

	act_unlock_thread(act);							/* Unlock the activation */
	save->save_r3 = 0;
	return 1;

failure:
	save->save_r3 = -1;								/* we failed to find the taskID */
	return 1;
}
Commit	Line	Data
1c79356b A	1	/*
	2	* Copyright (c) 2000 Apple Computer, Inc. All rights reserved.
	3	*
	4	* @APPLE_LICENSE_HEADER_START@
	5	*
de355530 A	6	* The contents of this file constitute Original Code as defined in and
	7	* are subject to the Apple Public Source License Version 1.1 (the
	8	* "License"). You may not use this file except in compliance with the
	9	* License. Please obtain a copy of the License at
	10	* http://www.apple.com/publicsource and read it before using this file.
1c79356b	11	*
de355530 A	12	* This Original Code and all software distributed under the License are
de355530 A	13	* distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
1c79356b A	14	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
1c79356b A	15	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
de355530 A	16	* FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. Please see the
	17	* License for the specific language governing rights and limitations
	18	* under the License.
1c79356b A	19	*
	20	* @APPLE_LICENSE_HEADER_END@
	21	*/
	22	/*
	23	File: PseudoKernel.c
	24
	25	Contains: BlueBox PseudoKernel calls
	26	Written by: Mark Gorlinsky
	27	Bill Angell
	28
	29	Copyright: 1997 by Apple Computer, Inc., all rights reserved
	30
	31	*/
	32
	33	#include <mach/mach_types.h>
	34	#include <mach/kern_return.h>
	35	#include <kern/host.h>
	36	#include <kern/task.h>
	37	#include <kern/thread.h>
	38	#include <ppc/PseudoKernel.h>
	39	#include <ppc/exception.h>
	40	#include <ppc/misc_protos.h>
	41	#include <ppc/proc_reg.h>
	42	#include <vm/vm_kern.h>
	43
	44	void bbSetRupt(ReturnHandler *rh, thread_act_t ct);
1c79356b A	45
	46	/*
	47	** Function: NotifyInterruption
	48	**
	49	** Inputs:
	50	** ppcInterrupHandler - interrupt handler to execute
	51	** interruptStatePtr - current interrupt state
	52	**
	53	** Outputs:
	54	**
	55	** Notes:
	56	**
	57	*/
	58	kern_return_t syscall_notify_interrupt ( void ) {
	59
	60	UInt32 interruptState;
	61	task_t task;
1c79356b A	62	thread_act_t act, fact;
	63	thread_t thread;
	64	bbRupt *bbr;
	65	BTTD_t *bttd;
	66	int i;
	67
	68	task = current_task(); /* Figure out who our task is */
	69
	70	task_lock(task); /* Lock our task */
	71
	72	fact = (thread_act_t)task->thr_acts.next; /* Get the first activation on task */
	73	act = 0; /* Pretend we didn't find it yet */
	74
	75	for(i = 0; i < task->thr_act_count; i++) { /* Scan the whole list */
	76	if(fact->mact.bbDescAddr) { /* Is this a Blue thread? */
	77	bttd = (BTTD_t *)(fact->mact.bbDescAddr & -PAGE_SIZE);
	78	if(bttd->InterruptVector) { /* Is this the Blue interrupt thread? */
	79	act = fact; /* Yeah... */
	80	break; /* Found it, Bail the loop... */
	81	}
	82	}
	83	fact = (thread_act_t)fact->thr_acts.next; /* Go to the next one */
	84	}
	85
	86	if(!act) { /* Couldn't find a bluebox */
	87	task_unlock(task); /* Release task lock */
	88	return KERN_FAILURE; /* No tickie, no shirtee... */
	89	}
	90
	91	act_lock_thread(act); /* Make sure this stays 'round */
	92	task_unlock(task); /* Safe to release now */
	93
	94	/* if the calling thread is the BlueBox thread that handles interrupts
	95	* we know that we are in the PsuedoKernel and we can short circuit
	96	* setting up the asynchronous task by setting a pending interrupt.
	97	*/
	98
	99	if ( (unsigned int)act == (unsigned int)current_act() ) {
	100	bttd->InterruptControlWord = bttd->InterruptControlWord \|
	101	((bttd->postIntMask >> kCR2ToBackupShift) & kBackupCR2Mask);
	102
	103	act_unlock_thread(act); /* Unlock the activation */
	104	return KERN_SUCCESS;
	105	}
	106
0b4e3aa0	107	if(act->mact.emPendRupts >= 16) { /* Have we hit the arbitrary maximum? */
1c79356b A	108	act_unlock_thread(act); /* Unlock the activation */
	109	return KERN_RESOURCE_SHORTAGE; /* Too many pending right now */
	110	}
	111
	112	if(!(bbr = (bbRupt )kalloc(sizeof(bbRupt)))) { / Get a return handler control block */
	113	act_unlock_thread(act); /* Unlock the activation */
	114	return KERN_RESOURCE_SHORTAGE; /* No storage... */
	115	}
	116
0b4e3aa0	117	(void)hw_atomic_add(&act->mact.emPendRupts, 1); /* Count this 'rupt */
1c79356b A	118	bbr->rh.handler = bbSetRupt; /* Set interruption routine */
	119
	120	bbr->rh.next = act->handlers; /* Put our interrupt at the start of the list */
	121	act->handlers = &bbr->rh;
	122
1c79356b	123	act_set_apc(act); /* Set an APC AST */
1c79356b A	124
	125	act_unlock_thread(act); /* Unlock the activation */
	126	return KERN_SUCCESS; /* We're done... */
	127	}
	128
	129	/*
	130	* This guy is fired off asynchronously to actually do the 'rupt.
	131	* We will find the user state savearea and modify it. If we can't,
	132	* we just leave after releasing our work area
	133	*/
	134
	135	void bbSetRupt(ReturnHandler *rh, thread_act_t act) {
	136
	137	savearea *sv;
	138	BTTD_t *bttd;
	139	bbRupt *bbr;
	140	UInt32 interruptState;
	141
	142	bbr = (bbRupt )rh; / Make our area convenient */
	143
	144	if(!(act->mact.bbDescAddr)) { /* Is BlueBox still enabled? */
	145	kfree((vm_offset_t)bbr, sizeof(bbRupt)); /* No, release the control block */
	146	return;
	147	}
	148
0b4e3aa0	149	(void)hw_atomic_sub(&act->mact.emPendRupts, 1); /* Uncount this 'rupt */
1c79356b	150
9bccf70c	151	if(!(sv = find_user_regs(act))) { /* Find the user state registers */
1c79356b A	152	kfree((vm_offset_t)bbr, sizeof(bbRupt)); /* Couldn't find 'em, release the control block */
	153	return;
	154	}
	155
	156	bttd = (BTTD_t *)(act->mact.bbDescAddr & -PAGE_SIZE);
	157
	158	interruptState = (bttd->InterruptControlWord & kInterruptStateMask) >> kInterruptStateShift;
	159
	160	switch (interruptState) {
	161
	162	case kInSystemContext:
	163	sv->save_cr \|= bttd->postIntMask; /* post int in CR2 */
	164	break;
	165
	166	case kInAlternateContext:
	167	bttd->InterruptControlWord = (bttd->InterruptControlWord & ~kInterruptStateMask) \|
	168	(kInPseudoKernel << kInterruptStateShift);
	169
de355530 A	170	bttd->exceptionInfo.srr0 = sv->save_srr0; /* Save the current PC */
	171	sv->save_srr0 = bttd->InterruptVector; /* Set the new PC */
	172	bttd->exceptionInfo.sprg1 = sv->save_r1; /* Save the original R1 */
	173	sv->save_r1 = bttd->exceptionInfo.sprg0; /* Set the new R1 */
	174	bttd->exceptionInfo.srr1 = sv->save_srr1; /* Save the original MSR */
1c79356b A	175	sv->save_srr1 &= ~(MASK(MSR_BE)\|MASK(MSR_SE)); /* Clear SE\|BE bits in MSR */
1c79356b A	176	act->mact.specFlags &= ~bbNoMachSC; /* reactivate Mach SCs */
0b4e3aa0 A	177	disable_preemption(); /* Don't move us around */
	178	per_proc_info[cpu_number()].spcFlags = act->mact.specFlags; /* Copy the flags */
	179	enable_preemption(); /* Ok to move us around */
1c79356b A	180	/* drop through to post int in backup CR2 in ICW */
	181
	182	case kInExceptionHandler:
	183	case kInPseudoKernel:
	184	case kOutsideBlue:
	185	bttd->InterruptControlWord = bttd->InterruptControlWord \|
	186	((bttd->postIntMask >> kCR2ToBackupShift) & kBackupCR2Mask);
	187	break;
	188
	189	default:
	190	break;
	191	}
	192
	193	kfree((vm_offset_t)bbr, sizeof(bbRupt)); /* Release the control block */
	194	return;
	195
	196	}
	197
	198	/*
	199	* This function is used to enable the firmware assist code for bluebox traps, system calls
	200	* and interrupts.
	201	*
	202	* The assist code can be called from two types of threads. The blue thread, which handles
	203	* traps, system calls and interrupts and preemptive threads that only issue system calls.
	204	*
	205	*/
	206
	207	kern_return_t enable_bluebox(
	208	host_t host,
	209	void taskID, / opaque task ID */
	210	void TWI_TableStart, / Start of TWI table */
	211	char Desc_TableStart / Start of descriptor table */
	212	) {
	213
	214	thread_t th;
de355530	215	vm_offset_t kerndescaddr, physdescaddr, origdescoffset;
1c79356b A	216	kern_return_t ret;
	217
	218	th = current_thread(); /* Get our thread */
	219
	220	if ( host == HOST_NULL ) return KERN_INVALID_HOST;
	221	if ( ! is_suser() ) return KERN_FAILURE; /* We will only do this for the superuser */
	222	if ( th->top_act->mact.bbDescAddr ) return KERN_FAILURE; /* Bail if already authorized... */
	223	if ( ! (unsigned int) Desc_TableStart ) return KERN_FAILURE; /* There has to be a descriptor page */
	224	if ( ! TWI_TableStart ) return KERN_FAILURE; /* There has to be a TWI table */
	225
	226	/* Get the page offset of the descriptor */
	227	origdescoffset = (vm_offset_t)Desc_TableStart & (PAGE_SIZE - 1);
	228
	229	/* Align the descriptor to a page */
	230	Desc_TableStart = (char *)((vm_offset_t)Desc_TableStart & -PAGE_SIZE);
	231
	232	ret = vm_map_wire(th->top_act->map, /* Kernel wire the descriptor in the user's map */
	233	(vm_offset_t)Desc_TableStart,
	234	(vm_offset_t)Desc_TableStart + PAGE_SIZE,
	235	VM_PROT_READ \| VM_PROT_WRITE,
	236	FALSE);
	237
	238	if(ret != KERN_SUCCESS) { /* Couldn't wire it, spit on 'em... */
	239	return KERN_FAILURE;
	240	}
	241
de355530 A	242	physdescaddr = /* Get the physical address of the page */
de355530 A	243	pmap_extract(th->top_act->map->pmap, (vm_offset_t) Desc_TableStart);
1c79356b A	244
	245	ret = kmem_alloc_pageable(kernel_map, &kerndescaddr, PAGE_SIZE); /* Find a virtual address to use */
	246	if(ret != KERN_SUCCESS) { /* Could we get an address? */
	247	(void) vm_map_unwire(th->top_act->map, /* No, unwire the descriptor */
	248	(vm_offset_t)Desc_TableStart,
	249	(vm_offset_t)Desc_TableStart + PAGE_SIZE,
	250	TRUE);
	251	return KERN_FAILURE; /* Split... */
	252	}
	253
	254	(void) pmap_enter(kernel_pmap, /* Map this into the kernel */
de355530	255	kerndescaddr, physdescaddr, VM_PROT_READ\|VM_PROT_WRITE,
9bccf70c	256	VM_WIMG_USE_DEFAULT, TRUE);
1c79356b A	257
1c79356b A	258	th->top_act->mact.bbDescAddr = (unsigned int)kerndescaddr+origdescoffset; /* Set kernel address of the table */
0b4e3aa0 A	259	th->top_act->mact.bbUserDA = (unsigned int)Desc_TableStart; /* Set user address of the table */
	260	th->top_act->mact.bbTableStart = (unsigned int)TWI_TableStart; /* Set address of the trap table */
	261	th->top_act->mact.bbTaskID = (unsigned int)taskID; /* Assign opaque task ID */
	262	th->top_act->mact.bbTaskEnv = 0; /* Clean task environment data */
	263	th->top_act->mact.emPendRupts = 0; /* Clean pending 'rupt count */
	264	th->top_act->mact.specFlags &= ~(bbNoMachSC \| bbPreemptive); /* Make sure mach SCs are enabled and we are not marked preemptive */
	265	th->top_act->mact.specFlags \|= bbThread; /* Set that we are Classic thread */
	266
	267	if(!(((BTTD_t )kerndescaddr)->InterruptVector)) { / See if this is a preemptive (MP) BlueBox thread */
	268	th->top_act->mact.specFlags \|= bbPreemptive; /* Yes, remember it */
	269	}
	270
	271	disable_preemption(); /* Don't move us around */
	272	per_proc_info[cpu_number()].spcFlags = th->top_act->mact.specFlags; /* Copy the flags */
	273	enable_preemption(); /* Ok to move us around */
1c79356b A	274
	275	{
	276	/* mark the proc to indicate that this is a TBE proc */
	277	extern void tbeproc(void *proc);
	278
	279	tbeproc(th->top_act->task->bsd_info);
	280	}
	281
	282	return KERN_SUCCESS;
	283	}
	284
	285	kern_return_t disable_bluebox( host_t host ) { /* User call to terminate bluebox */
	286
	287	thread_act_t act;
	288
	289	act = current_act(); /* Get our thread */
	290
	291	if (host == HOST_NULL) return KERN_INVALID_HOST;
	292
	293	if(!is_suser()) return KERN_FAILURE; /* We will only do this for the superuser */
	294	if(!act->mact.bbDescAddr) return KERN_FAILURE; /* Bail if not authorized... */
	295
	296	disable_bluebox_internal(act); /* Clean it all up */
	297	return KERN_SUCCESS; /* Leave */
	298	}
	299
	300	void disable_bluebox_internal(thread_act_t act) { /* Terminate bluebox */
	301
	302	(void) vm_map_unwire(act->map, /* Unwire the descriptor in user's address space */
	303	(vm_offset_t)act->mact.bbUserDA,
	304	(vm_offset_t)act->mact.bbUserDA + PAGE_SIZE,
	305	FALSE);
	306
	307	kmem_free(kernel_map, (vm_offset_t)act->mact.bbDescAddr & -PAGE_SIZE, PAGE_SIZE); /* Release the page */
	308
	309	act->mact.bbDescAddr = 0; /* Clear kernel pointer to it */
	310	act->mact.bbUserDA = 0; /* Clear user pointer to it */
	311	act->mact.bbTableStart = 0; /* Clear user pointer to TWI table */
	312	act->mact.bbTaskID = 0; /* Clear opaque task ID */
	313	act->mact.bbTaskEnv = 0; /* Clean task environment data */
0b4e3aa0 A	314	act->mact.emPendRupts = 0; /* Clean pending 'rupt count */
	315	act->mact.specFlags &= ~(bbNoMachSC \| bbPreemptive \| bbThread); /* Clean up Blue Box enables */
	316	disable_preemption(); /* Don't move us around */
	317	per_proc_info[cpu_number()].spcFlags = act->mact.specFlags; /* Copy the flags */
	318	enable_preemption(); /* Ok to move us around */
1c79356b A	319	return;
	320	}
	321
	322	/*
	323	* Use the new PPCcall method to enable blue box threads
	324	*
	325	* save->r3 = taskID
	326	* save->r4 = TWI_TableStart
	327	* save->r5 = Desc_TableStart
	328	*
	329	*/
	330	int bb_enable_bluebox( struct savearea *save )
	331	{
	332	kern_return_t rc;
	333
	334	rc = enable_bluebox( (host_t)0xFFFFFFFF, (void )save->save_r3, (void )save->save_r4, (char *)save->save_r5 );
	335	save->save_r3 = rc;
	336	return 1; /* Return with normal AST checking */
	337	}
	338
	339	/*
	340	* Use the new PPCcall method to disable blue box threads
	341	*
	342	*/
	343	int bb_disable_bluebox( struct savearea *save )
	344	{
	345	kern_return_t rc;
	346
	347	rc = disable_bluebox( (host_t)0xFFFFFFFF );
	348	save->save_r3 = rc;
	349	return 1; /* Return with normal AST checking */
	350	}
	351
	352	/*
	353	* Search through the list of threads to find the matching taskIDs, then
	354	* set the task environment pointer. A task in this case is a preemptive thread
	355	* in MacOS 9.
	356	*
	357	* save->r3 = taskID
	358	* save->r4 = taskEnv
	359	*/
	360
	361	int bb_settaskenv( struct savearea *save )
	362	{
	363	int i;
	364	task_t task;
	365	thread_act_t act, fact;
	366
	367
	368	task = current_task(); /* Figure out who our task is */
	369
	370	task_lock(task); /* Lock our task */
	371	fact = (thread_act_t)task->thr_acts.next; /* Get the first activation on task */
	372	act = 0; /* Pretend we didn't find it yet */
	373
	374	for(i = 0; i < task->thr_act_count; i++) { /* Scan the whole list */
	375	if(fact->mact.bbDescAddr) { /* Is this a Blue thread? */
	376	if ( fact->mact.bbTaskID == save->save_r3 ) { /* Is this the task we are looking for? */
	377	act = fact; /* Yeah... */
	378	break; /* Found it, Bail the loop... */
	379	}
	380	}
	381	fact = (thread_act_t)fact->thr_acts.next; /* Go to the next one */
	382	}
383
384	if ( !act \|\| !act->active) {
385	task_unlock(task); /* Release task lock */
386	goto failure;
387	}
388
389	act_lock_thread(act); /* Make sure this stays 'round */
390	task_unlock(task); /* Safe to release now */
391
392	act->mact.bbTaskEnv = save->save_r4;
0b4e3aa0 A	393	if(act == current_act()) { /* Are we setting our own? */
0b4e3aa0 A	394	disable_preemption(); /* Don't move us around */
de355530	395	per_proc_info[cpu_number()].spcFlags = act->mact.specFlags; /* Copy the flags */
0b4e3aa0 A	396	enable_preemption(); /* Ok to move us around */
0b4e3aa0 A	397	}
1c79356b A	398
	399	act_unlock_thread(act); /* Unlock the activation */
	400	save->save_r3 = 0;
0b4e3aa0	401	return 1;
1c79356b A	402
	403	failure:
	404	save->save_r3 = -1; /* we failed to find the taskID */
0b4e3aa0	405	return 1;
1c79356b	406	}