August 2006 - Wine-Devel - list.winehq.org

Re: urlmon: Delay-load cabinet.dll as native urlmon doesn't import it.
by Alexandre Julliard Aug. 4, 2006

Aug. 4, 2006

Robert Shearman <rob(a)codeweavers.com> writes: > + if (!hCabinet) return HRESULT_FROM_WIN32(GetLastError()); > + pExtract = GetProcAddress(hCabinet, "Extract"); > + if (!pExtract) return HRESULT_FROM_WIN32(GetLastError()); > + > + hr = pExtract(dest, szCabName); > + FreeLibrary(hCabinet); > + return hr; > +} Unless the app depends on it, it's usually better to not free the library on each call, otherwise repeated calls to the function will be very expensive. You can free the library in PROCESS_DETACH. -- Alexandre Julliard julliard(a)winehq.org

1 0

Re: msi: The input buffer length is the number of characters excluding the NULL terminator, so fix an off by one error [RESEND]
by Alexandre Julliard Aug. 4, 2006

Aug. 4, 2006

"James Hawkins" <truiken(a)gmail.com> writes: > Is there anything wrong with this patch? Yes, the length does include the terminating null. That's what the rest of the function expects, and AFAICT it's what the callers expect too (and it's the standard behavior of API functions that take a buffer length). -- Alexandre Julliard julliard(a)winehq.org

1 0

ntdll: CreateRemoteThread and friends for remote processes, take 3, via APCs
by tkho＠ucla.edu Aug. 4, 2006

Aug. 4, 2006

ntdll: CreateRemoteThread and friends for remote processes, take 3, via APCs Hello, Much thanks for the comments on yesterday's patch of a service thread implementation for remote process operations. This patch uses APCs to implement CreateRemoteThread/RtlCreateUserThread, VirtualAllocEx/NtAllocateVirtualMemory and VirtualQueryEx/NtQueryVirtualMemory. APCs are queued per-thread, so I made minimal changes to add a per-process APC queue. Of course, this implementation suffers from the limitation that the remote process must go into an interuptible wait for the operation to succeed; an operation targeting a suspended process would block. Stefan Siebert mentioned that VirtualQueryEx is necessary for Lotus Notes Software Diagnostics (nsd.exe). I successfully tested this function with a simple program that prints a process' memory map: http://www.codecomments.com/archive371-2005-3-421246.html Lastly, I should mention that I have two pending patches to add conformance tests for remote processes operations: http://www.winehq.org/pipermail/wine-patches/2006-July/029259.html http://www.winehq.org/pipermail/wine-patches/2006-July/029260.html Thanks, Thomas Kho --- include/wine/server_protocol.h | 2 +- server/process.c | 1 + server/process.h | 1 + server/thread.c | 50 ++++++++++++++++++++++++---------------- server/thread.h | 23 +++++++++++++++++- server/timer.c | 2 +- 6 files changed, 55 insertions(+), 24 deletions(-) diff --git a/server/process.c b/server/process.c index 3e5ef97..75ca490 100644 --- a/server/process.c +++ b/server/process.c @@ -254,6 +254,7 @@ struct thread *create_process( int fd, s list_init( &process->locks ); list_init( &process->classes ); list_init( &process->dlls ); + list_init( &process->system_apc ); gettimeofday( &process->start_time, NULL ); process->end_time.tv_sec = process->end_time.tv_usec = 0; diff --git a/server/process.h b/server/process.h index 6edb1e6..2e9c9b8 100644 --- a/server/process.h +++ b/server/process.h @@ -78,6 +78,7 @@ struct process struct list dlls; /* list of loaded dlls */ void *peb; /* PEB address in client address space */ void *ldt_copy; /* pointer to LDT copy in client addr space */ + struct list system_apc; /* queue of system aync procedure calls */ }; struct process_snapshot diff --git a/server/thread.c b/server/thread.c index 60b74c9..d21df7f 100644 --- a/server/thread.c +++ b/server/thread.c @@ -64,19 +64,6 @@ struct thread_wait struct wait_queue_entry queues[1]; }; -/* asynchronous procedure calls */ - -struct thread_apc -{ - struct list entry; /* queue linked list */ - struct object *owner; /* object that queued this apc */ - void *func; /* function to call in client */ - enum apc_type type; /* type of apc function */ - void *arg1; /* function arguments */ - void *arg2; - void *arg3; -}; - /* thread operations */ @@ -464,6 +451,8 @@ static int check_wait( struct thread *th } other_checks: + /* FIXME remote operations will block on suspended threads */ + if ((wait->flags & SELECT_INTERRUPTIBLE) && !list_empty(&thread->process->system_apc)) return STATUS_USER_APC; if ((wait->flags & SELECT_INTERRUPTIBLE) && !list_empty(&thread->system_apc)) return STATUS_USER_APC; if ((wait->flags & SELECT_ALERTABLE) && !list_empty(&thread->user_apc)) return STATUS_USER_APC; if (wait->flags & SELECT_TIMEOUT) @@ -622,15 +611,32 @@ void wake_up( struct object *obj, int ma } } +/* return a pointer to the correct queue */ +static struct list *get_apc_queue( struct thread *thread, + enum apc_queue apc_queue ) +{ + switch (apc_queue) + { + case APC_PROCESS_QUEUE_SYSTEM: + return &thread->process->system_apc; + case APC_THREAD_QUEUE_SYSTEM: + return &thread->system_apc; + case APC_THREAD_QUEUE_USER: + default: + return &thread->user_apc; + } +} + /* queue an async procedure call */ int thread_queue_apc( struct thread *thread, struct object *owner, void *func, - enum apc_type type, int system, void *arg1, void *arg2, void *arg3 ) + enum apc_type type, enum apc_queue apc_queue, void *arg1, + void *arg2, void *arg3 ) { struct thread_apc *apc; - struct list *queue = system ? &thread->system_apc : &thread->user_apc; + struct list *queue = get_apc_queue( thread, apc_queue ); /* cancel a possible previous APC with the same owner */ - if (owner) thread_cancel_apc( thread, owner, system ); + if (owner) thread_cancel_apc( thread, owner, apc_queue ); if (thread->state == TERMINATED) return 0; if (!(apc = mem_alloc( sizeof(*apc) ))) return 0; @@ -648,10 +654,11 @@ int thread_queue_apc( struct thread *thr } /* cancel the async procedure call owned by a specific object */ -void thread_cancel_apc( struct thread *thread, struct object *owner, int system ) +void thread_cancel_apc( struct thread *thread, struct object *owner, + enum apc_queue apc_queue ) { struct thread_apc *apc; - struct list *queue = system ? &thread->system_apc : &thread->user_apc; + struct list *queue = get_apc_queue( thread, apc_queue ); LIST_FOR_EACH_ENTRY( apc, queue, struct thread_apc, entry ) { if (apc->owner != owner) continue; @@ -665,8 +672,9 @@ void thread_cancel_apc( struct thread *t static struct thread_apc *thread_dequeue_apc( struct thread *thread, int system_only ) { struct thread_apc *apc = NULL; - struct list *ptr = list_head( &thread->system_apc ); + struct list *ptr = list_head( &thread->process->system_apc ); + if (!ptr) ptr = list_head( &thread->system_apc ); if (!ptr && !system_only) ptr = list_head( &thread->user_apc ); if (ptr) { @@ -1007,7 +1015,9 @@ DECL_HANDLER(queue_apc) struct thread *thread; if ((thread = get_thread_from_handle( req->handle, THREAD_SET_CONTEXT ))) { - thread_queue_apc( thread, NULL, req->func, APC_USER, !req->user, + enum apc_queue queue; + queue = req->user ? APC_THREAD_QUEUE_USER : APC_THREAD_QUEUE_SYSTEM; + thread_queue_apc( thread, NULL, req->func, APC_USER, queue, req->arg1, req->arg2, req->arg3 ); release_object( thread ); } diff --git a/server/thread.h b/server/thread.h index 61911cd..b8b6cf0 100644 --- a/server/thread.h +++ b/server/thread.h @@ -96,6 +96,25 @@ struct thread_snapshot int priority; /* priority class */ }; +/* asynchronous procedure calls */ +struct thread_apc +{ + struct list entry; /* queue linked list */ + struct object *owner; /* object that queued this apc */ + void *func; /* function to call in client */ + enum apc_type type; /* type of apc function */ + void *arg1; /* function arguments */ + void *arg2; + void *arg3; +}; + +enum apc_queue +{ + APC_THREAD_QUEUE_USER, + APC_THREAD_QUEUE_SYSTEM, + APC_PROCESS_QUEUE_SYSTEM +}; + extern struct thread *current; /* thread functions */ @@ -112,8 +131,8 @@ extern void kill_thread( struct thread * extern void break_thread( struct thread *thread ); extern void wake_up( struct object *obj, int max ); extern int thread_queue_apc( struct thread *thread, struct object *owner, void *func, - enum apc_type type, int system, void *arg1, void *arg2, void *arg3 ); -extern void thread_cancel_apc( struct thread *thread, struct object *owner, int system ); + enum apc_type type, enum apc_queue apc_queue, void *arg1, void *arg2, void *arg3 ); +extern void thread_cancel_apc( struct thread *thread, struct object *owner, enum apc_queue apc_queue ); extern int thread_add_inflight_fd( struct thread *thread, int client, int server ); extern int thread_get_inflight_fd( struct thread *thread, int client ); extern struct thread_snapshot *thread_snap( int *count ); diff --git a/server/timer.c b/server/timer.c index d1c035b..f6e23c8 100644 --- a/server/timer.c +++ b/server/timer.c @@ -136,7 +136,7 @@ static int cancel_timer( struct timer *t } if (timer->thread) { - thread_cancel_apc( timer->thread, &timer->obj, 0 ); + thread_cancel_apc( timer->thread, &timer->obj, APC_THREAD_QUEUE_USER ); release_object( timer->thread ); timer->thread = NULL; } --- dlls/kernel/kernel32.spec | 3 + dlls/kernel/process.c | 108 ++++++++++++++++++++++++++++++++++++++++ dlls/kernel/thread.c | 24 +++++++-- dlls/ntdll/ntdll_misc.h | 2 + dlls/ntdll/thread.c | 85 +++++++++++++++++++++++++++++++ dlls/ntdll/virtual.c | 37 ++++++++++++-- include/wine/server_protocol.h | 31 +++++++++++ include/winternl.h | 58 +++++++++++++++++++++ server/process.c | 67 +++++++++++++++++++++++++ server/protocol.def | 21 ++++++++ server/request.h | 2 + server/trace.c | 12 ++++ 12 files changed, 436 insertions(+), 14 deletions(-) diff --git a/dlls/kernel/kernel32.spec b/dlls/kernel/kernel32.spec index 7369b59..80fcba4 100644 --- a/dlls/kernel/kernel32.spec +++ b/dlls/kernel/kernel32.spec @@ -1239,3 +1239,6 @@ # Unix files # Init code @ cdecl __wine_kernel_init() + +# Remote process operations +@ cdecl __wine_RemoteProcessOperation(ptr ptr ptr) diff --git a/dlls/kernel/process.c b/dlls/kernel/process.c index 7092d2c..07fa4ef 100644 --- a/dlls/kernel/process.c +++ b/dlls/kernel/process.c @@ -2827,3 +2827,111 @@ BOOL WINAPI CmdBatNotification( BOOL bBa FIXME("%d\n", bBatchRunning); return FALSE; } + +/*********************************************************************** + * __wine_RemoteProcessOperation (KERNEL32.@) Not a Windows API + * + * Execute a remote operation. + * arg1 is an all-access handle to the requesting process. + * arg2 is a pointer to the RemoteOp structure in the requesting process. + * arg3 is an event to notify the requesting process of completion. + */ +void WINAPI CALLBACK __wine_RemoteProcessOperation( ULONG_PTR arg1, + ULONG_PTR arg2, + ULONG_PTR arg3 ) +{ + HANDLE hProcess = (HANDLE) arg1; + void *args = (void *) arg2; + HANDLE hEvent = (HANDLE) arg3; + struct RemoteOp ro; + + NtReadVirtualMemory( hProcess, args, &ro, sizeof(ro), NULL ); + + switch( ro.op ) + { + case RO_NEW_THREAD: + { + CLIENT_ID cidLocal; + HANDLE hThread; + NTSTATUS ret; + + ro.status = RtlCreateUserThread( NtCurrentProcess(), NULL, + ro.thread.suspended, + ro.thread.stack_addr, + ro.thread.stack_reserve, + ro.thread.stack_commit, + ro.thread.start, + ro.thread.param, + ro.thread.handle_ptr ? &hThread : 0, + ro.thread.id_ptr ? &cidLocal : 0); + if (ro.status) break; + + if (ro.thread.handle_ptr) + { + HANDLE hRemoteNewThread; + if ((ret = NtDuplicateObject( NtCurrentProcess(), hThread, + hProcess, &hRemoteNewThread, 0, 0, + DUPLICATE_SAME_ACCESS| + DUPLICATE_CLOSE_SOURCE ))) + ERR("Cannot duplicate handle in remote process, error %lu\n", + ret); + else + { + if ((ret = NtWriteVirtualMemory( hProcess, + ro.thread.handle_ptr, + &hRemoteNewThread, + sizeof(HANDLE), NULL ))) + ERR("Cannot write back handle, error %lu\n", ret); + } + } + if (ro.thread.id_ptr) + if ((ret = NtWriteVirtualMemory( hProcess, ro.thread.id_ptr, + &cidLocal, sizeof(CLIENT_ID), + NULL ))) + ERR("Cannot write back thread id, error %lu\n", ret); + + break; + } + case RO_ALLOCATE: + { + ro.status = NtAllocateVirtualMemory( NtCurrentProcess(), + &ro.alloc.ret, + ro.alloc.zero_bits, + &ro.alloc.size, + ro.alloc.type, + ro.alloc.protect ); + break; + } + case RO_QUERY: + { + void *res; + NTSTATUS ret; + SIZE_T res_len; + + if (!(res = HeapAlloc( GetProcessHeap(), 0, ro.query.len ))) + { + ro.status = STATUS_NO_MEMORY; + break; + } + ro.status = NtQueryVirtualMemory( NtCurrentProcess(), ro.query.addr, + ro.query.info_class, res, + ro.query.len, &res_len ); + if (ro.query.res_len) + if ((ret = NtWriteVirtualMemory( hProcess, ro.query.res_len, + &res_len, sizeof(SIZE_T), NULL ))) + ERR("Cannot write back thread id, error %lu\n", ret); + if (ro.query.buffer) + if ((ret = NtWriteVirtualMemory( hProcess, ro.query.buffer, + res, ro.query.len, NULL ))) + ERR("Cannot write back thread id, error %lu\n", ret); + HeapFree( GetProcessHeap(), 0, res ); + } + } + + /* FIXME optimize write back */ + NtWriteVirtualMemory( hProcess, args, &ro, sizeof(ro), NULL ); + + NtSetEvent( hEvent, NULL ); + NtClose( hEvent ); + NtClose( hProcess ); +} diff --git a/dlls/kernel/thread.c b/dlls/kernel/thread.c index bf29aac..bfa8ef4 100644 --- a/dlls/kernel/thread.c +++ b/dlls/kernel/thread.c @@ -66,7 +66,7 @@ static void CALLBACK THREAD_Start( void LPTHREAD_START_ROUTINE func = info->func; void *arg = info->arg; - RtlFreeHeap( GetProcessHeap(), 0, info ); + VirtualFreeEx( GetCurrentProcess(), info, 0, MEM_RELEASE ); if (TRACE_ON(relay)) DPRINTF("%04lx:Starting thread (entryproc=%p)\n", GetCurrentThreadId(), func ); @@ -122,13 +122,25 @@ HANDLE WINAPI CreateRemoteThread( HANDLE SIZE_T stack_reserve = 0, stack_commit = 0; struct new_thread_info *info; - if (!(info = RtlAllocateHeap( GetProcessHeap(), 0, sizeof(*info) ))) + if (!(info = VirtualAllocEx( hProcess, NULL, sizeof(*info), + MEM_COMMIT|MEM_RESERVE, + PAGE_EXECUTE_READWRITE ))) { SetLastError( ERROR_NOT_ENOUGH_MEMORY ); return 0; } - info->func = start; - info->arg = param; + + /* FIXME sub with is_current_process() in ntdll */ + if (hProcess != GetCurrentProcess()) + { + struct new_thread_info nti = { start, param }; + WriteProcessMemory( hProcess, info, &nti, sizeof(nti), NULL ); + } + else + { + info->func = start; + info->arg = param; + } if (flags & STACK_SIZE_PARAM_IS_A_RESERVATION) stack_reserve = stack; else stack_commit = stack; @@ -147,7 +159,7 @@ HANDLE WINAPI CreateRemoteThread( HANDLE if (NtResumeThread( handle, &ret )) { NtClose( handle ); - RtlFreeHeap( GetProcessHeap(), 0, info ); + VirtualFreeEx( hProcess, info, 0, MEM_RELEASE ); SetLastError( ERROR_NOT_ENOUGH_MEMORY ); handle = 0; } @@ -155,7 +167,7 @@ HANDLE WINAPI CreateRemoteThread( HANDLE } else { - RtlFreeHeap( GetProcessHeap(), 0, info ); + VirtualFreeEx( hProcess, info, 0, MEM_RELEASE ); SetLastError( RtlNtStatusToDosError(status) ); handle = 0; } diff --git a/dlls/ntdll/ntdll_misc.h b/dlls/ntdll/ntdll_misc.h index 03110a4..cdf6c63 100644 --- a/dlls/ntdll/ntdll_misc.h +++ b/dlls/ntdll/ntdll_misc.h @@ -61,6 +61,8 @@ extern void DECLSPEC_NORETURN server_pro extern void DECLSPEC_NORETURN server_protocol_perror( const char *err ); extern void DECLSPEC_NORETURN server_exit_thread( int status ); extern void DECLSPEC_NORETURN server_abort_thread( int status ); +extern NTSTATUS NTDLL_remote_call( HANDLE process, struct RemoteOp *ro ); + /* module handling */ extern NTSTATUS MODULE_DllThreadAttach( LPVOID lpReserved ); diff --git a/dlls/ntdll/thread.c b/dlls/ntdll/thread.c index dbcc5a6..94c146b 100644 --- a/dlls/ntdll/thread.c +++ b/dlls/ntdll/thread.c @@ -385,6 +385,73 @@ static void start_thread( struct wine_pt func( arg ); } +/*********************************************************************** + * get_remote_call_handler + */ +static NTSTATUS get_remote_call_handler( void **func ) +{ + static void *handler = NULL; + HMODULE hkernel32; + UNICODE_STRING module; + ANSI_STRING function; + WCHAR kernel32W[] = {'k','e','r','n','e','l','3','2','.','d','l','l',0}; + NTSTATUS ret; + + if (handler != NULL) + { + *func = handler; + return STATUS_SUCCESS; + } + + RtlInitUnicodeString(&module, kernel32W); + RtlInitAnsiString(&function, "__wine_RemoteProcessOperation"); + if ((ret = LdrGetDllHandle(0, 0, &module, &hkernel32))) + return ret; + if ((ret = LdrGetProcedureAddress(hkernel32, &function, 0, &handler))) + return ret; + *func = handler; + return STATUS_SUCCESS; +} + +/*********************************************************************** + * NTDLL_remote_call + */ +NTSTATUS NTDLL_remote_call( HANDLE process, struct RemoteOp *ro ) +{ + NTSTATUS ret; + HANDLE done_event; + void *func; + + /* FIXME check this */ + if ((ret = NtCreateEvent(&done_event, EVENT_ALL_ACCESS, NULL, FALSE, + FALSE))) + return ret; + + if ((ret = get_remote_call_handler(&func))) + { + ERR("Cannot locate remote call handler\n"); + return ret; + } + + SERVER_START_REQ( remote_op ) + { + req->handle = process; + req->op = ro->op; + req->event = done_event; + req->args = ro; + req->func = func; + + ret = wine_server_call( req ); + } + SERVER_END_REQ; + + if (ret) return ret; + + NtWaitForSingleObject( done_event, FALSE, NULL ); + NtClose( done_event ); + + return STATUS_SUCCESS; +} /*********************************************************************** * RtlCreateUserThread (NTDLL.@) @@ -408,8 +475,22 @@ NTSTATUS WINAPI RtlCreateUserThread( HAN if( ! is_current_process( process ) ) { - ERR("Unsupported on other process\n"); - return STATUS_ACCESS_DENIED; + struct RemoteOp ro; + + ro.op = RO_NEW_THREAD; + ro.thread.suspended = suspended; + ro.thread.stack_addr = stack_addr; + ro.thread.stack_reserve = stack_reserve; + ro.thread.stack_commit = stack_commit; + ro.thread.start = start; + ro.thread.param = param; + ro.thread.handle_ptr = handle_ptr; + ro.thread.id_ptr = id; + + if ((status = NTDLL_remote_call( process, &ro ))) + return status; + + return ro.status; } if (pipe( request_pipe ) == -1) return STATUS_TOO_MANY_OPENED_FILES; diff --git a/dlls/ntdll/virtual.c b/dlls/ntdll/virtual.c index f7b829f..ee6a196 100644 --- a/dlls/ntdll/virtual.c +++ b/dlls/ntdll/virtual.c @@ -1317,8 +1317,25 @@ NTSTATUS WINAPI NtAllocateVirtualMemory( if (!is_current_process( process )) { - ERR("Unsupported on other process\n"); - return STATUS_ACCESS_DENIED; + struct RemoteOp ro; + + ro.op = RO_ALLOCATE; + ro.alloc.ret = *ret; + ro.alloc.zero_bits = zero_bits; + ro.alloc.size = *size_ptr; + ro.alloc.type = type; + ro.alloc.protect = protect; + + if ((status = NTDLL_remote_call( process, &ro ))) + return status; + + TRACE("NtAllocateVirtualMemory addr=%x, status=%x\n", ro.alloc.ret, + (unsigned) status); + + *ret = ro.alloc.ret; + *size_ptr = ro.alloc.size; + + return ro.status; } /* Round parameters to a page boundary */ @@ -1578,8 +1595,20 @@ NTSTATUS WINAPI NtQueryVirtualMemory( HA if (!is_current_process( process )) { - ERR("Unsupported on other process\n"); - return STATUS_ACCESS_DENIED; + struct RemoteOp ro; + NTSTATUS status; + + ro.op = RO_QUERY; + ro.query.addr = (void *) addr; + ro.query.info_class = info_class; + ro.query.buffer = buffer; + ro.query.len = len; + ro.query.res_len = res_len; + + if ((status = NTDLL_remote_call( process, &ro ))) + return status; + + return ro.status; } base = ROUND_ADDR( addr, page_mask ); diff --git a/include/winternl.h b/include/winternl.h index 5177348..4d92e42 100644 --- a/include/winternl.h +++ b/include/winternl.h @@ -2243,7 +2243,6 @@ extern NTSTATUS wine_nt_to_unix_file_nam UINT disposition, BOOLEAN check_case ); extern NTSTATUS wine_unix_to_nt_file_name( const ANSI_STRING *name, UNICODE_STRING *nt ); - /*********************************************************************** * Inline functions */ @@ -2396,6 +2395,63 @@ static inline PLIST_ENTRY RemoveTailList return e; } +struct RemoteOp { + int op; /* in, FIXME enum remote_op */ + NTSTATUS status; /* out */ + + union { + struct { + /* in */ + ULONG zero_bits; + ULONG type; + ULONG protect; + /* in/out */ + PVOID ret; + SIZE_T size; + } alloc; + struct { + PVOID addr; + SIZE_T size; + ULONG type; + } free; + struct { + PVOID addr; + SIZE_T size; + ULONG new_prot; + ULONG old_prot; + } protect; + struct { + LPVOID addr; + MEMORY_INFORMATION_CLASS info_class; + PVOID buffer; + SIZE_T len; + SIZE_T *res_len; + } query; + struct { + PVOID addr; + SIZE_T size; + ULONG unknown; + } lock; + struct { + PVOID addr; + SIZE_T size; + ULONG unknown; + } unlock; + struct { + /* in */ + BOOLEAN suspended; + PVOID stack_addr; + SIZE_T stack_reserve; + SIZE_T stack_commit; + PRTL_THREAD_START_ROUTINE start; + void *param; + /* out */ + HANDLE *handle_ptr; + CLIENT_ID *id_ptr; + } thread; + }; +}; + #ifdef __cplusplus } /* extern "C" */ #endif /* defined(__cplusplus) */ diff --git a/server/process.c b/server/process.c index 75ca490..6ecc7b7 100644 --- a/server/process.c +++ b/server/process.c @@ -1056,3 +1056,70 @@ DECL_HANDLER(get_process_idle_event) release_object( process ); } } + +/* Signal a remote operation it */ +DECL_HANDLER(remote_op) +{ + int access; + struct process *src = NULL, *dst = NULL; + struct thread *thread; + obj_handle_t dupevent = NULL, dupprocess = NULL; + + switch ( req->op ) + { + case RO_NEW_THREAD: + access = PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION + | PROCESS_VM_OPERATION | PROCESS_VM_READ + | PROCESS_VM_WRITE; + break; + case RO_ALLOCATE: + case RO_FREE: + case RO_PROTECT: + case RO_LOCK: /* FIXME check */ + case RO_UNLOCK: /* FIXME check */ + access = PROCESS_VM_OPERATION; + break; + case RO_QUERY: + access = PROCESS_QUERY_INFORMATION; + break; + default: + set_error( STATUS_INVALID_PARAMETER ); + return; + } + + if (!(src = get_process_from_handle( (obj_handle_t) 0xffffffff, 0 ))) + goto cleanup; + if (!(dst = get_process_from_handle( req->handle, access ))) + goto cleanup; + if (!(thread = get_process_first_thread( dst ))) + { + /* FIXME check if this can even happen */ + set_error( STATUS_ACCESS_DENIED ); + goto cleanup; + } + + /* duplicate done event handle */ + dupevent = duplicate_handle(src, req->event, dst, 0, 0, + DUPLICATE_SAME_ACCESS); + if (!dupevent) goto cleanup; + /* duplicate an all-access handle to requesting process */ + dupprocess = duplicate_handle(src, (obj_handle_t) 0xffffffff, dst, 0, 0, + DUPLICATE_SAME_ACCESS); + if (!dupprocess) + { + close_handle( dst, dupevent, 0 ); + goto cleanup; + } + + /* queue remote_op on the remote process' apc queue */ + if (!thread_queue_apc( thread, NULL, req->func, APC_USER, + APC_PROCESS_QUEUE_SYSTEM, + dupprocess, req->args, dupevent )) + set_error( STATUS_INVALID_HANDLE ); + +cleanup: + if (src) + release_object( src ); + if (dst) + release_object( dst ); +} diff --git a/server/protocol.def b/server/protocol.def index e64cf43..98671ae 100644 --- a/server/protocol.def +++ b/server/protocol.def @@ -2618,3 +2618,24 @@ #define MAILSLOT_SET_READ_TIMEOUT 1 @REPLY VARARG(target_name,unicode_str); /* target name */ @END + + +/* Signal a remote operation */ +(a)REQ(remote_op) + obj_handle_t handle; /* handle to target process */ + int op; /* remote operation */ + obj_handle_t event; /* completion event */ + void* args; /* pointer to arguments in requesting process */ + void* func; /* pointer to remote op handler in kernel32 */ +(a)REPLY +(a)END +enum remote_op +{ + RO_NEW_THREAD, + RO_ALLOCATE, + RO_FREE, + RO_LOCK, + RO_PROTECT, + RO_QUERY, + RO_UNLOCK +};

5 5

Re: msi: The input buffer length is the number of characters excluding the NULL terminator, so fix an off by one error [RESEND]
by Mike McCormack Aug. 4, 2006

Aug. 4, 2006

James Hawkins wrote: > Is there anything wrong with this patch? > > This fixes bug 5768. > http://bugs.winehq.org/show_bug.cgi?id=5768 > > Changelog: > * The input buffer length is the number of characters excluding the > NULL terminator, so fix an off by one error. msi_strcpy_to_awstring is used by many functions to return strings, so how about a test case? Mike

1 0

Re: widl: Write forward declarations for coclass definitions
by Alexandre Julliard Aug. 3, 2006

Aug. 3, 2006

Dan Hipschman <dsh(a)linux.ucla.edu> writes: > diff --git a/dlls/mshtml/mshtml_private.h b/dlls/mshtml/mshtml_private.h > index e0c1c3c..262ed37 100644 > --- a/dlls/mshtml/mshtml_private.h > +++ b/dlls/mshtml/mshtml_private.h > @@ -53,7 +53,8 @@ typedef enum { > EDITMODE > } USERMODE; > > -typedef struct { > +/* "typedef struct HTMLDocument HTMLDocument;" is in mshtml.h */ > +struct HTMLDocument { > const IHTMLDocument2Vtbl *lpHTMLDocument2Vtbl; It would be better to rename the types instead of depending on having a typedef in a system header for an unrelated type. -- Alexandre Julliard julliard(a)winehq.org

3 4

null dereference in dbghelp
by Jan Zerebecki Aug. 3, 2006

Aug. 3, 2006

I tried to hack on http://bugs.winehq.org/show_bug.cgi?id=4848 and dbghelp failed on me. Log about the failure: http://bugs.winehq.org/attachment.cgi?id=3151&action=view Jan

2 1

Re: Implement SetThreadPriority
by Chris Robinson Aug. 3, 2006

Aug. 3, 2006

Is there anything still wrong with this patch? I believe I've addressed the concerns brought up before. If this patch is still unacceptable, what needs to be done to make it acceptable?

2 2

Re: usp10: resend Remove a test that fails on Windows
by Alexandre Julliard Aug. 3, 2006

Aug. 3, 2006

Jeff L <lats(a)yless4u.com.au> writes: > Hans and I have worked this one a fair bit and think it looks to be > the final. Can you apply this? It would be a lot cleaner to create the DC in the caller and pass it to the functions that need it. -- Alexandre Julliard julliard(a)winehq.org

1 0

ntdll: CreateRemoteThread and RtlCreateUserThread for remote processes, take 2
by tkho＠ucla.edu Aug. 3, 2006

Aug. 3, 2006

ntdll: CreateRemoteThread and RtlCreateUserThread for remote processes, take 2 Hello, This is an implementation of CreateRemoteThread and RtlCreateUserThread for remote processes that re-introduces a service thread for each process and uses a signal to flag pending operations. Operations are guarded by a global mutex for each process. A recent thread for the implementation of the functions via thread hijacking with ptrace is at http://winehq.org/pipermail/wine-devel/2006-July/049593.html I have created a wiki page at http://wiki.winehq.org/RemoteProcessOperations to document the discussion of this class of functions. Note: With the service thread, this mutex-and-signals approach could be exchanged for queued APCs on the service thread. In addition, there are unaddressed issues with this implementation (thread attach notifications, etc). Is this a step in the right direction? Thomas Kho --- dlls/kernel/thread.c | 42 +++++- dlls/ntdll/Makefile.in | 1 dlls/ntdll/loader.c | 1 dlls/ntdll/ntdll.spec | 4 + dlls/ntdll/ntdll_misc.h | 73 +++++++++++ dlls/ntdll/server.c | 3 dlls/ntdll/service.c | 267 ++++++++++++++++++++++++++++++++++++++++ dlls/ntdll/signal_i386.c | 19 +++ dlls/ntdll/thread.c | 102 +++++++++++++++ dlls/ntdll/virtual.c | 55 ++++++++ include/thread.h | 3 include/wine/server_protocol.h | 54 ++++++++ include/winternl.h | 1 server/handle.c | 2 server/process.c | 97 +++++++++++++++ server/process.h | 1 server/protocol.def | 28 ++++ server/request.h | 6 + server/thread.c | 9 + server/trace.c | 36 +++++ 20 files changed, 788 insertions(+), 16 deletions(-) diff --git a/dlls/kernel/thread.c b/dlls/kernel/thread.c index bf29aac..162b898 100644 --- a/dlls/kernel/thread.c +++ b/dlls/kernel/thread.c @@ -47,12 +47,12 @@ #include "kernel_private.h" WINE_DEFAULT_DEBUG_CHANNEL(thread); WINE_DECLARE_DEBUG_CHANNEL(relay); - struct new_thread_info { LPTHREAD_START_ROUTINE func; void *arg; }; +static struct new_thread_info threadInfo; /*********************************************************************** @@ -62,11 +62,12 @@ struct new_thread_info */ static void CALLBACK THREAD_Start( void *ptr ) { - struct new_thread_info *info = ptr; + struct new_thread_info *info = ptr ? ptr : &threadInfo; LPTHREAD_START_ROUTINE func = info->func; void *arg = info->arg; - RtlFreeHeap( GetProcessHeap(), 0, info ); + if (ptr) + RtlFreeHeap( GetProcessHeap(), 0, info ); if (TRACE_ON(relay)) DPRINTF("%04lx:Starting thread (entryproc=%p)\n", GetCurrentThreadId(), func ); @@ -116,11 +117,11 @@ HANDLE WINAPI CreateRemoteThread( HANDLE LPTHREAD_START_ROUTINE start, LPVOID param, DWORD flags, LPDWORD id ) { - HANDLE handle; + HANDLE handle, hServiceThreadMutex; CLIENT_ID client_id; NTSTATUS status; SIZE_T stack_reserve = 0, stack_commit = 0; - struct new_thread_info *info; + struct new_thread_info *info = NULL; if (!(info = RtlAllocateHeap( GetProcessHeap(), 0, sizeof(*info) ))) { @@ -130,12 +131,29 @@ HANDLE WINAPI CreateRemoteThread( HANDLE info->func = start; info->arg = param; + if (hProcess != GetCurrentProcess()) + { + status = __wine_get_remote_op_mutex(hProcess, &hServiceThreadMutex); + if (status) return status; + + WriteProcessMemory(hProcess, &threadInfo, info, + sizeof(struct new_thread_info), NULL); + } + if (flags & STACK_SIZE_PARAM_IS_A_RESERVATION) stack_reserve = stack; else stack_commit = stack; - status = RtlCreateUserThread( hProcess, NULL, TRUE, - NULL, stack_reserve, stack_commit, - THREAD_Start, info, &handle, &client_id ); + if (hProcess != GetCurrentProcess()) + status = RtlCreateUserThread( hProcess, NULL, TRUE, + NULL, stack_reserve, stack_commit, + THREAD_Start, NULL, &handle, + &client_id ); + else + status = RtlCreateUserThread( hProcess, NULL, TRUE, + NULL, stack_reserve, stack_commit, + THREAD_Start, info, &handle, + &client_id ); + if (status == STATUS_SUCCESS) { if (id) *id = (DWORD)client_id.UniqueThread; @@ -149,6 +167,7 @@ HANDLE WINAPI CreateRemoteThread( HANDLE NtClose( handle ); RtlFreeHeap( GetProcessHeap(), 0, info ); SetLastError( ERROR_NOT_ENOUGH_MEMORY ); + if (hProcess != GetCurrentProcess()) handle = 0; } } @@ -157,8 +176,15 @@ HANDLE WINAPI CreateRemoteThread( HANDLE { RtlFreeHeap( GetProcessHeap(), 0, info ); SetLastError( RtlNtStatusToDosError(status) ); + if (hProcess != GetCurrentProcess()) handle = 0; } + + if (hProcess != GetCurrentProcess()) + { + RtlFreeHeap( GetProcessHeap(), 0, info ); + __wine_release_remote_op_mutex(hServiceThreadMutex); + } return handle; } diff --git a/dlls/ntdll/Makefile.in b/dlls/ntdll/Makefile.in index 646808f..ea843d2 100644 --- a/dlls/ntdll/Makefile.in +++ b/dlls/ntdll/Makefile.in @@ -38,6 +38,7 @@ C_SRCS = \ sec.c \ serial.c \ server.c \ + service.c \ signal_i386.c \ signal_powerpc.c \ signal_sparc.c \ diff --git a/dlls/ntdll/loader.c b/dlls/ntdll/loader.c index 184f64f..d093e59 100644 --- a/dlls/ntdll/loader.c +++ b/dlls/ntdll/loader.c @@ -2151,6 +2151,7 @@ void WINAPI LdrInitializeThunk( ULONG un RtlLeaveCriticalSection( &loader_section ); if (nt->FileHeader.Characteristics & IMAGE_FILE_LARGE_ADDRESS_AWARE) VIRTUAL_UseLargeAddressSpace(); + SERVICE_init(); return; error: diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec index 4b5549f..2e26a6e 100644 --- a/dlls/ntdll/ntdll.spec +++ b/dlls/ntdll/ntdll.spec @@ -1390,3 +1390,7 @@ # Filesystem @ cdecl wine_nt_to_unix_file_name(ptr ptr long long) @ cdecl wine_unix_to_nt_file_name(ptr ptr) @ cdecl __wine_init_windows_dir(wstr wstr) + +# Remote process locking +@ cdecl __wine_get_remote_op_mutex(long ptr) +@ cdecl __wine_release_remote_op_mutex(long) diff --git a/dlls/ntdll/ntdll_misc.h b/dlls/ntdll/ntdll_misc.h index 03110a4..cfd37e7 100644 --- a/dlls/ntdll/ntdll_misc.h +++ b/dlls/ntdll/ntdll_misc.h @@ -177,4 +177,77 @@ static inline struct ntdll_thread_regs * return (struct ntdll_thread_regs *)NtCurrentTeb()->SpareBytes1; } +extern void SERVICE_init(void); + +struct RemoteOp { + enum enum_op { + RO_NEW_THREAD, + RO_ALLOCATE, + RO_FREE, + RO_LOCK, + RO_PROTECT, + RO_QUERY, + RO_UNLOCK + } op; + + /* in */ + HANDLE hDoneEvent; + /* out */ + NTSTATUS status; + + union { + struct { + PVOID ret; + ULONG zero_bits; + SIZE_T size; + ULONG type; + ULONG protect; + } alloc; + struct { + PVOID addr; + SIZE_T size; + ULONG type; + } free; + struct { + PVOID addr; + SIZE_T size; + ULONG new_prot; + ULONG old_prot; + } protect; + struct { + LPVOID addr; + MEMORY_INFORMATION_CLASS info_class; + PVOID buffer; + SIZE_T len; + SIZE_T res_len; + } query; + struct { + PVOID addr; + SIZE_T size; + ULONG unknown; + } lock; + struct { + PVOID addr; + SIZE_T size; + ULONG unknown; + } unlock; + struct { + /* in */ + HANDLE src_process; + BOOLEAN suspended; + PVOID stack_addr; + SIZE_T stack_reserve; + SIZE_T stack_commit; + PRTL_THREAD_START_ROUTINE start; + void *param; + /* out */ + HANDLE *handle_ptr; + CLIENT_ID *id_ptr; + } thread; + }; +}; + +extern struct RemoteOp ro; +extern volatile int pending_service_req; + #endif diff --git a/dlls/ntdll/server.c b/dlls/ntdll/server.c index 841604a..9124751 100644 --- a/dlls/ntdll/server.c +++ b/dlls/ntdll/server.c @@ -880,6 +880,7 @@ void server_init_process(void) sigaddset( &block_set, SIGUSR1 ); sigaddset( &block_set, SIGUSR2 ); sigaddset( &block_set, SIGCHLD ); + sigaddset( &block_set, SIGRTMIN ); /* receive the first thread request fd on the main socket */ ntdll_get_thread_data()->request_fd = receive_fd( &dummy_handle ); @@ -934,6 +935,8 @@ #endif req->reply_fd = reply_pipe[1]; req->wait_fd = ntdll_get_thread_data()->wait_fd[1]; req->debug_level = (TRACE_ON(server) != 0); + req->event = ro.hDoneEvent; + ro.hDoneEvent = 0; /* creation mutex released after server call */ ret = wine_server_call( req ); NtCurrentTeb()->ClientId.UniqueProcess = (HANDLE)reply->pid; NtCurrentTeb()->ClientId.UniqueThread = (HANDLE)reply->tid; diff --git a/dlls/ntdll/service.c b/dlls/ntdll/service.c new file mode 100644 index 0000000..ba6c895 --- /dev/null +++ b/dlls/ntdll/service.c @@ -0,0 +1,267 @@ +/* + * Service thread + * + * Copyright 2006 Google (Thomas Kho) + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* FIXME remove extraneous includes */ +#include "config.h" +#include "wine/port.h" + +#include <sys/types.h> +#ifdef HAVE_SYS_MMAN_H +#include <sys/mman.h> +#endif +#ifdef HAVE_SYS_TIMES_H +#include <sys/times.h> +#endif + +#define NONAMELESSUNION +#include "ntstatus.h" +#define WIN32_NO_STATUS +#include "thread.h" +#include "winternl.h" +#include "wine/library.h" +#include "wine/server.h" +#include "wine/pthread.h" +#include "wine/debug.h" +#include "ntdll_misc.h" +#include "wine/exception.h" + +WINE_DEFAULT_DEBUG_CHANNEL(thread); + + +#define IS_OPTION_TRUE(ch) ((ch) == 'y' || (ch) == 'Y' || (ch) == 't' || (ch) == 'T' || (ch) == '1') + +volatile int pending_service_req = 0; + +/*********************************************************************** + * use_service_thread + */ +static BOOL use_service_thread(void) +{ + static const WCHAR WineW[] = {'S','o','f','t','w','a','r','e','\\', + 'W','i','n','e',0}; + static const WCHAR UseServiceThreadW[] = {'U','s','e', + 'S','e','r','v','i','c','e', 'T','h','r','e','a','d',0}; + + char tmp[80]; + HANDLE root, hkey; + DWORD dummy; + OBJECT_ATTRIBUTES attr; + UNICODE_STRING nameW; + BOOL ret = FALSE; + + attr.Length = sizeof (OBJECT_ATTRIBUTES); + attr.RootDirectory = 0; + attr.ObjectName = &nameW; + attr.Attributes = 0; + attr.SecurityDescriptor = NULL; + attr.SecurityQualityOfService = NULL; + RtlOpenCurrentUser( KEY_ALL_ACCESS, &root ); + attr.RootDirectory = root; + RtlInitUnicodeString( &nameW, WineW ); + + /* @@ Wine registry key: HKCU\Software\Wine\Network */ + if (!NtOpenKey( &hkey, KEY_ALL_ACCESS, &attr )) + { + RtlInitUnicodeString( &nameW, UseServiceThreadW ); + if (!NtQueryValueKey( hkey, &nameW, KeyValuePartialInformation, tmp, + sizeof(tmp), &dummy )) + { + WCHAR *str = (WCHAR *)((KEY_VALUE_PARTIAL_INFORMATION *)tmp)->Data; + ret = IS_OPTION_TRUE( str[0] ); + } + NtClose( hkey ); + } + NtClose( root ); + return ret; +} + + +/*********************************************************************** + * create_global_mutex + */ +static HANDLE create_global_mutex(void) +{ + HANDLE hServiceThreadMutex = NULL; + HANDLE hGlobalServiceThreadMutex = NULL; + NTSTATUS status; + OBJECT_ATTRIBUTES attr; + + attr.Length = sizeof(attr); + attr.RootDirectory = 0; + attr.ObjectName = NULL; + attr.Attributes = OBJ_CASE_INSENSITIVE | OBJ_OPENIF; + attr.SecurityDescriptor = NULL; + attr.SecurityQualityOfService = NULL; + status = NtCreateMutant (&hServiceThreadMutex, MUTEX_ALL_ACCESS, &attr, + FALSE); + //printf("created mutant %x, status=%x\n", hServiceThreadMutex, status); + NtDuplicateObject(NtCurrentProcess(), hServiceThreadMutex, + NULL, &hGlobalServiceThreadMutex, + 0, FALSE, DUPLICATE_CLOSE_SOURCE|DUPLICATE_SAME_ACCESS| + DUP_HANDLE_MAKE_GLOBAL); + //printf("new mutant %x, status=%x\n", hGlobalServiceThreadMutex, status); + return hGlobalServiceThreadMutex; +} + + +/*********************************************************************** + * SERVICE_thread + * + * Service thread loop + */ +static DWORD WINAPI SERVICE_thread(LPVOID arg) +{ + static unsigned int i = 0; + sigset_t sigset; + + /* unblock SIGRTMIN only for service thread */ + sigemptyset( &sigset ); + sigaddset( &sigset, SIGRTMIN ); + sigprocmask( SIG_UNBLOCK, &sigset, NULL ); + + //printf("setting event inside SERVICE_thread\n"); + /* signal that the service thread has been created */ + NtSetEvent(*(HANDLE *) arg, NULL); + + /* all work for this thread is done in the rt0 signal handler in + * signal_i386.c */ + while (TRUE) + { + struct timeval timeout = {1, 0}; + + select(0, NULL, NULL, NULL, &timeout); + + if (!pending_service_req) + continue; + pending_service_req = 0; + + switch( ro.op ) + { + case RO_NEW_THREAD: + { + HANDLE hNewThread; + CLIENT_ID cidLocal; + NTSTATUS ret; + HANDLE hServiceThreadMutex = NULL; + /* + printf("inside wine_cloned_thread_creator, " + "params (%x, %x, %x, %x, %x, %x, %x, %x, %x, %x)\n", + ro.thread.suspended, ro.thread.stack_addr, + ro.thread.stack_reserve, ro.thread.stack_commit, + ro.thread.start, ro.thread.param, + ro.hDoneEvent, ro.thread.src_process, + ro.thread.handle_ptr, ro.thread.id_ptr); + */ + + ret = RtlCreateUserThread( NtCurrentProcess(), NULL, + ro.thread.suspended, + ro.thread.stack_addr, + ro.thread.stack_reserve, + ro.thread.stack_commit, ro.thread.start, + ro.thread.param, + ro.thread.handle_ptr ? &hNewThread : 0, + ro.thread.id_ptr ? &cidLocal : 0); + //printf("RtlCreateUserThread status %x in service thread\n", ret); + + if (ro.thread.handle_ptr) + { + HANDLE hRemoteNewThread; + ret = NtDuplicateObject(NtCurrentProcess(), hNewThread, + ro.thread.src_process, + &hRemoteNewThread, 0, 0, + DUPLICATE_SAME_ACCESS| + DUPLICATE_CLOSE_SOURCE); + if (ret) printf("error 1 %x\n", ret); + /* + printf("writing handle %x (dup of %x)\n", hRemoteNewThread, + hNewThread); + */ + ret = NtWriteVirtualMemory(ro.thread.src_process, + ro.thread.handle_ptr, + &hRemoteNewThread, sizeof(HANDLE), + NULL); + if (ret) printf("error 2 %x\n", ret); + } + if (ro.thread.id_ptr) + { + ret = NtWriteVirtualMemory(ro.thread.src_process, ro.thread.id_ptr, + &cidLocal, + sizeof(CLIENT_ID), NULL); + if (ret) printf("error 5 %x\n", ret); + } + + NtClose(ro.thread.src_process); + break; + } + case RO_ALLOCATE: + { + ro.status = NtAllocateVirtualMemory( NtCurrentProcess(), + &ro.alloc.ret, + ro.alloc.zero_bits, + &ro.alloc.size, + ro.alloc.type, + ro.alloc.protect ); + NtSetEvent( ro.hDoneEvent, NULL ); + NtClose( ro.hDoneEvent ); + break; + } + } + } +} + + +/*********************************************************************** + * SERVICE_init + * + * Initialize the service thread + * + * FIXME check return codes + */ +void SERVICE_init() +{ + HANDLE hNewThread, hGlobalServiceThreadMutex, hThreadCreatedEvent; + + if (!use_service_thread()) + { + ERR("service thread disabled\n"); + return; + } + + hGlobalServiceThreadMutex = create_global_mutex(); + + NtCreateEvent(&hThreadCreatedEvent, EVENT_ALL_ACCESS, + NULL, FALSE, FALSE); + + RtlCreateUserThread( NtCurrentProcess(), NULL, FALSE, NULL, + 0, 0, SERVICE_thread, &hThreadCreatedEvent, + &hNewThread, NULL ); + NtClose(hNewThread); + + NtWaitForSingleObject(hThreadCreatedEvent, FALSE, NULL); + NtClose(hThreadCreatedEvent); + + //ERR("hNewThread=%x, mutex=%x\n", hNewThread, hGlobalServiceThreadMutex); + SERVER_START_REQ( set_remote_op_mutex ) + { + req->mutex = hGlobalServiceThreadMutex; + wine_server_call( req ); + } + SERVER_END_REQ; +} diff --git a/dlls/ntdll/signal_i386.c b/dlls/ntdll/signal_i386.c index 99685f3..508b4dd 100644 --- a/dlls/ntdll/signal_i386.c +++ b/dlls/ntdll/signal_i386.c @@ -1209,6 +1209,17 @@ #endif /* __HAVE_VM86 */ /********************************************************************** + * rt0_handler + * + * Handler for SIGRTMIN. + */ +static HANDLER_DEF(rt0_handler) +{ + pending_service_req = 1; +} + + +/********************************************************************** * segv_handler * * Handler for SIGSEGV and related errors. @@ -1439,6 +1450,7 @@ #endif /* linux */ sigaddset( &sig_act.sa_mask, SIGINT ); sigaddset( &sig_act.sa_mask, SIGUSR1 ); sigaddset( &sig_act.sa_mask, SIGUSR2 ); + sigaddset( &sig_act.sa_mask, SIGRTMIN ); #if defined(linux) || defined(__NetBSD__) || defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__OpenBSD__) sig_act.sa_flags = SA_RESTART; @@ -1473,6 +1485,7 @@ int __wine_set_signal_handler(unsigned i BOOL SIGNAL_Init(void) { int have_sigaltstack = 0; + sigset_t sigset; #ifdef HAVE_SIGALTSTACK struct sigaltstack ss; @@ -1505,6 +1518,12 @@ #endif #ifdef __HAVE_VM86 if (set_handler( SIGUSR2, have_sigaltstack, (void (*)())usr2_handler ) == -1) goto error; #endif + if (set_handler( SIGRTMIN, 0, (void (*)())rt0_handler ) == -1) goto error; + + /* block SIGRTMIN by default */ + sigemptyset( &sigset ); + sigaddset( &sigset, SIGRTMIN ); + sigprocmask( SIG_BLOCK, &sigset, NULL ); return TRUE; diff --git a/dlls/ntdll/thread.c b/dlls/ntdll/thread.c index dbcc5a6..9cf8407 100644 --- a/dlls/ntdll/thread.c +++ b/dlls/ntdll/thread.c @@ -62,6 +62,7 @@ static size_t sigstack_total_size; static ULONG sigstack_zero_bits; struct wine_pthread_functions pthread_functions = { NULL }; +struct RemoteOp ro = { 0 }; /*********************************************************************** * init_teb @@ -76,6 +77,7 @@ static inline NTSTATUS init_teb( TEB *te teb->Tib.Self = &teb->Tib; teb->StaticUnicodeString.Buffer = teb->StaticUnicodeBuffer; teb->StaticUnicodeString.MaximumLength = sizeof(teb->StaticUnicodeBuffer); + teb->GotThreadMutex = 0; if (!(thread_regs->fs = wine_ldt_alloc_fs())) return STATUS_TOO_MANY_THREADS; thread_data->request_fd = -1; @@ -385,6 +387,52 @@ static void start_thread( struct wine_pt func( arg ); } +/*********************************************************************** + * __wine_get_remote_op_mutex (NTDLL.@) Not a Windows API + * + * return the service mutex, or a null handle with success if the thread + * already has the mutex + */ +NTSTATUS WINAPI __wine_get_remote_op_mutex(HANDLE hProcess, HANDLE *hMutex) +{ + NTSTATUS status; + + if (NtCurrentTeb()->GotThreadMutex) + { + *hMutex = NULL; + return STATUS_SUCCESS; + } + + SERVER_START_REQ( get_remote_op_mutex ) + { + req->process = hProcess; + if (!(status = wine_server_call( req ))) + *hMutex = reply->mutex; + } + SERVER_END_REQ; + + if (status || *hMutex == NULL) + return status ? status : STATUS_NOT_IMPLEMENTED; + + status = NtWaitForSingleObject(*hMutex, FALSE, 0); + NtCurrentTeb()->GotThreadMutex = 1; + + return STATUS_SUCCESS; +} + +/*********************************************************************** + * __wine_release_remote_op_mutex (NTDLL.@) Not a Windows API + */ +NTSTATUS WINAPI __wine_release_remote_op_mutex(HANDLE hMutex) +{ + NTSTATUS status; + + if (hMutex == NULL) return STATUS_SUCCESS; + + NtCurrentTeb()->GotThreadMutex = 0; + status = NtReleaseMutant(hMutex, NULL); + return status; +} /*********************************************************************** * RtlCreateUserThread (NTDLL.@) @@ -408,8 +456,58 @@ NTSTATUS WINAPI RtlCreateUserThread( HAN if( ! is_current_process( process ) ) { - ERR("Unsupported on other process\n"); - return STATUS_ACCESS_DENIED; + HANDLE hThreadCreatedEvent; + HANDLE hServiceThreadMutex; + struct RemoteOp n; + + status = __wine_get_remote_op_mutex(process, &hServiceThreadMutex); + if (status) return status; + + status = NtCreateEvent(&hThreadCreatedEvent, EVENT_ALL_ACCESS, NULL, + FALSE, FALSE); /* FIXME check this */ + + n.op = RO_NEW_THREAD; + n.thread.suspended = suspended; + n.thread.stack_addr = stack_addr; + n.thread.stack_reserve = stack_reserve; + n.thread.stack_commit = stack_commit; + n.thread.start = start; + n.thread.param = param; + n.thread.handle_ptr = handle_ptr; + n.thread.id_ptr = id; + n.thread.src_process = NULL; + n.hDoneEvent = NULL; + + status = NtWriteVirtualMemory(process, &ro, &n, + sizeof(struct RemoteOp), NULL); + if (status) + { + NtClose( hThreadCreatedEvent ); + return status; + } + + SERVER_START_REQ( remote_op ) + { + req->handle = process; + /* This pair of handles is duplicated and forwarded to the remote + * process. The done event is actually set in the remote process + * during the init_thread server call because it is right after + * this that the thread is suspended. */ + req->event = hThreadCreatedEvent; + req->event_ptr = &ro.hDoneEvent; + req->src_process = NtCurrentProcess(); + req->src_process_ptr = &ro.thread.src_process; + + status = wine_server_call( req ); + } + SERVER_END_REQ; + if (status) return status; + + NtWaitForSingleObject(hThreadCreatedEvent, FALSE, NULL); + __wine_release_remote_op_mutex(hServiceThreadMutex); + + NtClose(hThreadCreatedEvent); + return status; } if (pipe( request_pipe ) == -1) return STATUS_TOO_MANY_OPENED_FILES; diff --git a/dlls/ntdll/virtual.c b/dlls/ntdll/virtual.c index f7b829f..0600170 100644 --- a/dlls/ntdll/virtual.c +++ b/dlls/ntdll/virtual.c @@ -1317,8 +1317,59 @@ NTSTATUS WINAPI NtAllocateVirtualMemory( if (!is_current_process( process )) { - ERR("Unsupported on other process\n"); - return STATUS_ACCESS_DENIED; + HANDLE hThreadCreatedEvent; + HANDLE hServiceThreadMutex; + struct RemoteOp n; + + status = __wine_get_remote_op_mutex(process, &hServiceThreadMutex); + if (status) return status; + + status = NtCreateEvent(&hThreadCreatedEvent, EVENT_ALL_ACCESS, NULL, + FALSE, FALSE); /* FIXME check this */ + + n.op = RO_ALLOCATE; + n.alloc.ret = *ret; + n.alloc.zero_bits = zero_bits; + n.alloc.size = *size_ptr; + n.alloc.type = type; + n.alloc.protect = protect; + n.hDoneEvent = NULL; + + status = NtWriteVirtualMemory(process, &ro, &n, + sizeof(struct RemoteOp), NULL); + if (status) + { + NtClose( hThreadCreatedEvent ); + return status; + } + + SERVER_START_REQ( remote_op ) + { + req->handle = process; + + req->event = hThreadCreatedEvent; + req->event_ptr = &ro.hDoneEvent; + req->src_process = NULL; + req->src_process_ptr = NULL; + + status = wine_server_call( req ); + } + SERVER_END_REQ; + + if (status) return status; + + NtWaitForSingleObject(hThreadCreatedEvent, FALSE, NULL); + + NtReadVirtualMemory(process, &ro, &n, sizeof(struct RemoteOp), + NULL); + + *ret = n.alloc.ret; + *size_ptr = n.alloc.size; + + __wine_release_remote_op_mutex(hServiceThreadMutex); + + NtClose(hThreadCreatedEvent); + return n.status; } /* Round parameters to a page boundary */ diff --git a/include/thread.h b/include/thread.h index 68d7ae2..d6a36e5 100644 --- a/include/thread.h +++ b/include/thread.h @@ -57,7 +57,8 @@ typedef struct _TEB ULONG_PTR dpmi_vif; /* 200 protected mode virtual interrupt flag */ DWORD vm86_pending; /* 204 data for vm86 mode */ /* here is plenty space for wine specific fields (don't forget to change pad6!!) */ - DWORD pad6[309]; /* 208 */ + DWORD GotThreadMutex; /* 208 */ + DWORD pad6[308]; /* 20c */ ULONG gdiRgn; /* 6dc */ ULONG gdiPen; /* 6e0 */ diff --git a/server/process.c b/server/process.c index 3e5ef97..651ded6 100644 --- a/server/process.c +++ b/server/process.c @@ -22,12 +22,15 @@ #include "config.h" #include "wine/port.h" #include <assert.h> +#include <errno.h> #include <limits.h> +#include <linux/user.h> #include <signal.h> #include <string.h> #include <stdarg.h> #include <stdio.h> #include <stdlib.h> +#include <sys/ptrace.h> #include <sys/time.h> #ifdef HAVE_SYS_SOCKET_H # include <sys/socket.h> @@ -36,6 +39,10 @@ #include <unistd.h> #ifdef HAVE_POLL_H #include <poll.h> #endif +#include <sys/wait.h> +#include <sys/types.h> +#include <linux/unistd.h> +#include <errno.h> #include "ntstatus.h" #define WIN32_NO_STATUS @@ -250,6 +257,7 @@ struct thread *create_process( int fd, s process->winstation = 0; process->desktop = 0; process->token = token_create_admin(); + process->service_mutex = NULL; list_init( &process->thread_list ); list_init( &process->locks ); list_init( &process->classes ); @@ -1055,3 +1063,92 @@ DECL_HANDLER(get_process_idle_event) release_object( process ); } } + +/* Signal a remote operation it */ +DECL_HANDLER(remote_op) +{ + int access; + struct process *src = NULL, *dst = NULL; + struct thread *thread = NULL; + int pid; + obj_handle_t dupevent = NULL, dupprocess = NULL; + + /* get process object */ + access = PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION + | PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE; + if (!(dst = get_process_from_handle( req->handle, access ))) + { + set_error( STATUS_ACCESS_DENIED ); + goto cleanup; + } + + if (!(thread = get_process_first_thread( dst ))) + { + set_error( STATUS_ACCESS_DENIED ); + goto cleanup; + } + + pid = thread->unix_pid; + + /* clone event and process handles and write to target process */ + if (!(src = get_process_from_handle((obj_handle_t) 0xffffffff, 0))) + { + set_error( STATUS_ACCESS_DENIED ); + goto cleanup; + } + if (req->event) + { + dupevent = duplicate_handle(src, req->event, dst, 0, 0, + DUPLICATE_SAME_ACCESS); + write_process_memory(dst, req->event_ptr, sizeof(obj_handle_t), + (char *) &dupevent); + } + if (req->src_process) + { + dupprocess = duplicate_handle(src, req->src_process, dst, 0, 0, + DUPLICATE_SAME_ACCESS); + write_process_memory(dst, req->src_process_ptr, + sizeof(obj_handle_t), (char *) &dupprocess); + } + + kill(pid, SIGRTMIN); + +cleanup: + if (src) + release_object( src ); + if (dst) + release_object( dst ); +} + +/* FIXME We can actually put the mutex data in a specific place and read + * from it. */ + +/* Set service thread mutex */ +DECL_HANDLER(set_remote_op_mutex) +{ + struct process *p; + if (!(p = get_process_from_handle((obj_handle_t) 0xffffffff, 0))) + { + set_error( STATUS_INVALID_HANDLE ); + return; + } + p->service_mutex = req->mutex; + release_object( p ); +} + +/* Get service thread mutex */ +DECL_HANDLER(get_remote_op_mutex) +{ + struct process *p; + if (!(p = get_process_from_handle(req->process, 0))) + { + set_error( STATUS_INVALID_HANDLE ); + return; + } + if (!(reply->mutex = p->service_mutex)) + { + set_error( STATUS_NOT_IMPLEMENTED ); + return; + } + release_object( p ); +} diff --git a/server/process.h b/server/process.h index 6edb1e6..eb13043 100644 --- a/server/process.h +++ b/server/process.h @@ -78,6 +78,7 @@ struct process struct list dlls; /* list of loaded dlls */ void *peb; /* PEB address in client address space */ void *ldt_copy; /* pointer to LDT copy in client addr space */ + obj_handle_t service_mutex; /* mutex of service thread */ }; struct process_snapshot diff --git a/server/protocol.def b/server/protocol.def index e64cf43..3dcf500 100644 --- a/server/protocol.def +++ b/server/protocol.def @@ -280,6 +280,7 @@ struct token_groups int reply_fd; /* fd for reply pipe */ int wait_fd; /* fd for blocking calls pipe */ int debug_level; /* new debug level */ + obj_handle_t event; /* set to notify remote process */ @REPLY process_id_t pid; /* process id of the new thread's process */ thread_id_t tid; /* thread id of the new thread */ @@ -2618,3 +2619,30 @@ #define MAILSLOT_SET_READ_TIMEOUT 1 @REPLY VARARG(target_name,unicode_str); /* target name */ @END + + +/* Signal a remote operation */ +(a)REQ(remote_op) + obj_handle_t handle; /* process handle */ + + obj_handle_t event; + void* event_ptr; + obj_handle_t src_process; + void* src_process_ptr; +(a)REPLY +(a)END + + +/* Set current process service thread */ +(a)REQ(set_remote_op_mutex) + obj_handle_t mutex; /* global handle for mutex */ +(a)REPLY +(a)END + + +/* Get service thread mutex */ +(a)REQ(get_remote_op_mutex) + obj_handle_t process; +(a)REPLY + obj_handle_t mutex; +(a)END diff --git a/server/thread.c b/server/thread.c index feb3259..f610d28 100644 --- a/server/thread.c +++ b/server/thread.c @@ -886,6 +886,15 @@ DECL_HANDLER(init_thread) } debug_level = max( debug_level, req->debug_level ); + if (req->event) + { + struct event *event; + if (event = get_event_obj( current->process, req->event, + EVENT_MODIFY_STATE )) + set_event( event ); + close_handle( current->process, req->event, NULL ); + } + reply->pid = get_process_id( process ); reply->tid = get_thread_id( current ); reply->version = SERVER_PROTOCOL_VERSION;

4 6

Re: Problem with ValidateInUseArena
by Diego A. Degese Aug. 3, 2006

Aug. 3, 2006

The problem is: when in directx.c (Line 787, into the loop) try to Call function HeapAlloc in the first iteration, it crash with the error invalid in-use arena magic. I found this errors: stateLookup isn't allocated. It is a dword * []. minLookup and maxLookup isn't initialized. I copy the code for more information. --- CUT HERE --- /* Load all the lookup tables TODO: It may be a good idea to make minLookup and maxLookup const and populate them in wined3d_private.h where they are declared */ minLookup[WINELOOKUP_WARPPARAM] = D3DTADDRESS_WRAP; maxLookup[WINELOOKUP_WARPPARAM] = D3DTADDRESS_MIRRORONCE; minLookup[WINELOOKUP_MAGFILTER] = WINED3DTEXF_NONE; maxLookup[WINELOOKUP_MAGFILTER] = WINED3DTEXF_ANISOTROPIC; for (i = 0; i < MAX_LOOKUPS; i++) { // THIS IS THE LINE stateLookup[i] = HeapAlloc(GetProcessHeap(), 0, sizeof(*stateLookup[i]) * (1 + maxLookup[i] - minLookup[i]) ); // THIS IS THE LINE } --- CUT HERE --- Regards Diego Diego A. Degese wrote: > Ok.... this is the complete trace.... > I try to find more information about it > > Diego > > Andreas Mohr wrote: >> Hi, >> >> On Tue, Aug 01, 2006 at 05:40:24PM -0300, Diego A. Degese wrote: >> >>> 0009:Call ntdll.RtlAllocateHeap(00110000,00000000,00000014) >>> ret=7ec142bc >>> 0009:err:heap:HEAP_ValidateInUseArena Heap 0x110000: invalid in-use >>> arena magic for 0x17c228 >>> Heap: 0x110000 >>> Next: 0x3e30000 Sub-heaps: 0x110000 >>> Free lists: >>> Block Stat Size Id >>> 0x110038 free 00000010 prev=0x17c228 next=0x110048 >>> 0x110048 free 00000020 prev=0x110038 next=0x110058 >>> 0x110058 free 00000030 prev=0x110048 next=0x110068 >>> 0x110068 free 00000040 prev=0x110058 next=0x110078 >>> 0x110078 free 00000060 prev=0x110068 next=0x110088 >>> 0x110088 free 00000080 prev=0x110078 next=0x110098 >>> 0x110098 free 00000100 prev=0x110088 next=0x1100a8 >>> 0x1100a8 free 00000200 prev=0x110098 next=0x1100b8 >>> 0x1100b8 free 00000400 prev=0x1100a8 next=0x17aa60 >>> 0x1100c8 free 00001000 prev=0x17aa60 next=0x1100d8 >>> 0x1100d8 free ffffffff prev=0x1100c8 next=0x17c228 >>> >> >> This probably means that either the block directly before the >> 0x17c228 block >> or the block right at 0x17c228 got corrupted (overwritten with excessive >> length or maybe some random access to the arena flags area by a >> rogue pointer). >> Try to figure out via wine debug channels or additional manually >> inserted >> source traces, which pointer variable the previous block gets >> allocated for >> and where it's being written to (most likely incorrectly). >> You could also figure out which address the arena magic for 0x17c228 >> resides at and do a character/hex dump of the surrounding area to >> find out >> what kind of data is corrupting this area... (maybe a text string or >> characteristic numbers?). >> >> Andreas >> >>

1 0