protect.c File Reference

#include "mi.h"

Go to the source code of this file.

Functions
HARDWARE_PTE	MiFlushTbAndCapture (IN PMMPTE PtePointer, IN HARDWARE_PTE TempPte, IN PMMPFN Pfn1)
ULONG	MiSetProtectionOnTransitionPte (IN PMMPTE PointerPte, IN ULONG ProtectionMask)
MMPTE	MiCaptureSystemPte (IN PMMPTE PointerProtoPte, IN PEPROCESS Process)
NTSTATUS	NtProtectVirtualMemory (IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN OUT PSIZE_T RegionSize, IN ULONG NewProtect, OUT PULONG OldProtect)
NTSTATUS	MiProtectVirtualMemory (IN PEPROCESS Process, IN PVOID *BaseAddress, IN PSIZE_T RegionSize, IN ULONG NewProtect, IN PULONG LastProtect)
ULONG	MiSetProtectionOnSection (IN PEPROCESS Process, IN PMMVAD FoundVad, IN PVOID StartingAddress, IN PVOID EndingAddress, IN ULONG NewProtect, OUT PULONG CapturedOldProtect, IN ULONG DontCharge)
ULONG	MiGetPageProtection (IN PMMPTE PointerPte, IN PEPROCESS Process)
ULONG	MiChangeNoAccessForkPte (IN PMMPTE PointerPte, IN ULONG ProtectionMask)
NTSTATUS	MiCheckSecuredVad (IN PMMVAD Vad, IN PVOID Base, IN SIZE_T Size, IN ULONG ProtectionMask)
Variables
CCHAR	MmReadWrite [32]

---

Function Documentation

MMPTE MiCaptureSystemPte (  IN PMMPTE  PointerProtoPte, IN PEPROCESS  Process )

Definition at line 2204 of file protect.c. References LOCK_PFN, MiMakeSystemAddressValidPfnWs(), and UNLOCK_PFN. 02211 : 02212 02213 Nonpagable helper routine to capture the contents of a pagable PTE. 02214 02215 Arguments: 02216 02217 PointerProtoPte - Supplies a pointer to the prototype PTE. 02218 02219 Process - Supplies the relevant process. 02220 02221 Return Value: 02222 02223 PTE contents. 02224 02225 Environment: 02226 02227 Kernel mode. Caller holds address space and working set mutexes if 02228 Process is set. Working set mutex was acquired unsafe. 02229 02230 --*/ 02231 02232 { 02233 MMPTE TempPte; 02234 KIRQL OldIrql; 02235 02236 LOCK_PFN (OldIrql); 02237 MiMakeSystemAddressValidPfnWs (PointerProtoPte, Process); 02238 TempPte = *PointerProtoPte; 02239 UNLOCK_PFN (OldIrql); 02240 return TempPte; 02241 }

ULONG MiChangeNoAccessForkPte (  IN PMMPTE  PointerPte, IN ULONG  ProtectionMask )

Definition at line 2032 of file protect.c. References FALSE, MM_NOACCESS, PAGED_CODE, and TRUE. Referenced by MiProtectVirtualMemory(), and MiSetProtectionOnSection(). : Arguments: PointerPte - Supplies a pointer to the current PTE. ProtectionMask - Supplies the protection mask to set. Return Value: FALSE if the loop should be repeated for this PTE, TRUE if protection has been set. Environment: Kernel mode, address creation mutex held, APCs disabled. --*/ { PAGED_CODE(); if (ProtectionMask == MM_NOACCESS) { // // No need to change the page protection. // return TRUE; } PointerPte->u.Proto.ReadOnly = 1; return FALSE; }

NTSTATUS MiCheckSecuredVad (  IN PMMVAD  Vad, IN PVOID  Base, IN SIZE_T  Size, IN ULONG  ProtectionMask )

Definition at line 2244 of file protect.c. References End, _MMSECURE_ENTRY::EndVpn, _MMSECURE_ENTRY::List, List, MM_GUARD_PAGE, MM_SECURE_DELETE_CHECK, MmReadWrite, NTSTATUS(), Size, _MMSECURE_ENTRY::StartVpn, Status, and _MMSECURE_ENTRY::u2. Referenced by MiProtectVirtualMemory(), MmUnmapViewOfSection(), NtAllocateVirtualMemory(), and NtFreeVirtualMemory(). : This routine checks to see if the specified VAD is secured in such a way as to conflict with the address range and protection mask specified. Arguments: Vad - Supplies a pointer to the VAD containing the address range. Base - Supplies the base of the range the protection starts at. Size - Supplies the size of the range. ProtectionMask - Supplies the protection mask being set. Return Value: Status value. Environment: Kernel mode. --*/ { PVOID End; PLIST_ENTRY Next; PMMSECURE_ENTRY Entry; NTSTATUS Status = STATUS_SUCCESS; End = (PVOID)((PCHAR)Base + Size); if (ProtectionMask < MM_SECURE_DELETE_CHECK) { if ((Vad->u.VadFlags.NoChange == 1) && (Vad->u2.VadFlags2.SecNoChange == 1) && (Vad->u.VadFlags.Protection != ProtectionMask)) { // // An attempt is made at changing the protection // of a SEC_NO_CHANGE section - return an error. // Status = STATUS_INVALID_PAGE_PROTECTION; goto done; } } else { // // Deletion - set to no-access for check. SEC_NOCHANGE allows // deletion, but does not allow page protection changes. // ProtectionMask = 0; } if (Vad->u2.VadFlags2.OneSecured) { if (((ULONG_PTR)Base <= Vad->u3.Secured.EndVpn) && ((ULONG_PTR)End >= Vad->u3.Secured.StartVpn)) { // // This region conflicts, check the protections. // if (ProtectionMask & MM_GUARD_PAGE) { Status = STATUS_INVALID_PAGE_PROTECTION; goto done; } if (Vad->u2.VadFlags2.ReadOnly) { if (MmReadWrite[ProtectionMask] < 10) { Status = STATUS_INVALID_PAGE_PROTECTION; goto done; } } else { if (MmReadWrite[ProtectionMask] < 11) { Status = STATUS_INVALID_PAGE_PROTECTION; goto done; } } } } else if (Vad->u2.VadFlags2.MultipleSecured) { Next = Vad->u3.List.Flink; do { Entry = CONTAINING_RECORD( Next, MMSECURE_ENTRY, List); if (((ULONG_PTR)Base <= Entry->EndVpn) && ((ULONG_PTR)End >= Entry->StartVpn)) { // // This region conflicts, check the protections. // if (ProtectionMask & MM_GUARD_PAGE) { Status = STATUS_INVALID_PAGE_PROTECTION; goto done; } if (Entry->u2.VadFlags2.ReadOnly) { if (MmReadWrite[ProtectionMask] < 10) { Status = STATUS_INVALID_PAGE_PROTECTION; goto done; } } else { if (MmReadWrite[ProtectionMask] < 11) { Status = STATUS_INVALID_PAGE_PROTECTION; goto done; } } } Next = Entry->List.Flink; } while (Entry->List.Flink != &Vad->u3.List); } done: return Status; }

HARDWARE_PTE MiFlushTbAndCapture (  IN PMMPTE  PtePointer, IN HARDWARE_PTE  TempPte, IN PMMPFN  Pfn1 )

Definition at line 2079 of file protect.c. References ASSERT, FALSE, KeFlushSingleTb(), LOCK_PFN, MI_CAPTURE_DIRTY_BIT_TO_PFN, MI_IS_PTE_DIRTY, MiActiveWriteWatch, MiCaptureWriteWatchDirtyBit(), MiGetVirtualAddressMappedByPte, PsGetCurrentProcess, _MMSUPPORT::u, _MMPTE::u, UNLOCK_PFN, and _EPROCESS::Vm. Referenced by MiProtectVirtualMemory(), and MiSetProtectionOnSection(). { MMPTE PreviousPte; KIRQL OldIrql; PEPROCESS Process; PVOID VirtualAddress; // // Flush the TB as we have changed the protection // of a valid PTE. // LOCK_PFN (OldIrql); PreviousPte.u.Flush = KeFlushSingleTb ( MiGetVirtualAddressMappedByPte (PointerPte), FALSE, FALSE, (PHARDWARE_PTE)PointerPte, TempPte); ASSERT (PreviousPte.u.Hard.Valid == 1); // // A page protection is being changed, on certain // hardware the dirty bit should be ORed into the // modify bit in the PFN element. // MI_CAPTURE_DIRTY_BIT_TO_PFN (&PreviousPte, Pfn1); // // If the PTE indicates the page has been modified (this is different // from the PFN indicating this), then ripple it back to the write watch // bitmap now since we are still in the correct process context. // if (MiActiveWriteWatch != 0) { if ((Pfn1->u3.e1.PrototypePte == 0) && (MI_IS_PTE_DIRTY(PreviousPte))) { Process = PsGetCurrentProcess(); if (Process->Vm.u.Flags.WriteWatch == 1) { // // This process has (or had) write watch VADs. Search now // for a write watch region encapsulating the PTE being // invalidated. // VirtualAddress = MiGetVirtualAddressMappedByPte (PointerPte); MiCaptureWriteWatchDirtyBit (Process, VirtualAddress); } } } #if DBG else { Process = PsGetCurrentProcess(); ASSERT (Process->Vm.u.Flags.WriteWatch == 0); } #endif UNLOCK_PFN (OldIrql); return PreviousPte.u.Flush; }

ULONG MiGetPageProtection (  IN PMMPTE  PointerPte, IN PEPROCESS  Process )

Definition at line 1874 of file protect.c. References Index, KSTACK_POOL_START, MI_CONVERT_FROM_PTE_PROTECTION, MI_IS_PTE_PROTOTYPE, MI_PFN_ELEMENT, MI_PTE_LOOKUP_NEEDED, MiCaptureSystemPte(), MiGetVirtualAddressMappedByPte, MiLocateWsle(), MiNumberOfExtraSystemPdes, MiPteToProto, MM_VA_MAPPED_BY_PDE, MmWorkingSetList, MmWsle, _MMPFN::OriginalPte, PAGED_CODE, _MMPTE::u, _MMPFN::u1, and _MMPFN::u3. Referenced by MiProtectVirtualMemory(), MiQueryAddressState(), MiSetProtectionOnSection(), and NtAllocateVirtualMemory(). 01881 : 01882 01883 This routine returns the page protection of a non-zero PTE. 01884 It may release and reacquire the working set mutex. 01885 01886 Arguments: 01887 01888 PointerPte - Supplies a pointer to a non-zero PTE. 01889 01890 Return Value: 01891 01892 Returns the protection code. 01893 01894 Environment: 01895 01896 Kernel mode, working set and address creation mutex held. 01897 Note, that the address creation mutex does not need to be held 01898 if the working set mutex does not need to be released in the 01899 case of a prototype PTE. 01900 01901 --*/ 01902 01903 { 01904 01905 MMPTE PteContents; 01906 MMPTE ProtoPteContents; 01907 PMMPFN Pfn1; 01908 PMMPTE ProtoPteAddress; 01909 PVOID Va; 01910 ULONG Index; 01911 01912 PAGED_CODE(); 01913 01914 PteContents = *PointerPte; 01915 01916 if ((PteContents.u.Soft.Valid == 0) && (PteContents.u.Soft.Prototype == 1)) { 01917 01918 // 01919 // This pte is in prototype format, the protection is 01920 // stored in the prototype PTE. 01921 // 01922 01923 if (MI_IS_PTE_PROTOTYPE(PointerPte) || 01924 #ifdef _X86_ 01925 (MiNumberOfExtraSystemPdes && (PointerPte >= (PMMPTE)KSTACK_POOL_START && PointerPte < (PMMPTE)(KSTACK_POOL_START + MiNumberOfExtraSystemPdes * MM_VA_MAPPED_BY_PDE))) || 01926 #endif 01927 (PteContents.u.Soft.PageFileHigh == MI_PTE_LOOKUP_NEEDED)) { 01928 01929 // 01930 // The protection is within this PTE. 01931 // 01932 01933 return MI_CONVERT_FROM_PTE_PROTECTION ( 01934 PteContents.u.Soft.Protection); 01935 } 01936 01937 ProtoPteAddress = MiPteToProto (PointerPte); 01938 01939 // 01940 // Capture protopte PTE contents. 01941 // 01942 01943 ProtoPteContents = MiCaptureSystemPte (ProtoPteAddress, Process); 01944 01945 // 01946 // The working set mutex may have been released and the 01947 // page may no longer be in prototype format, get the 01948 // new contents of the PTE and obtain the protection mask. 01949 // 01950 01951 PteContents = MiCaptureSystemPte (PointerPte, Process); 01952 } 01953 01954 if ((PteContents.u.Soft.Valid == 0) && (PteContents.u.Soft.Prototype == 1)) { 01955 01956 // 01957 // Pte is still prototype, return the protection captured 01958 // from the prototype PTE. 01959 // 01960 01961 if (ProtoPteContents.u.Hard.Valid == 1) { 01962 01963 // 01964 // The prototype PTE is valid, get the protection from 01965 // the PFN database. 01966 // 01967 01968 Pfn1 = MI_PFN_ELEMENT (ProtoPteContents.u.Hard.PageFrameNumber); 01969 return MI_CONVERT_FROM_PTE_PROTECTION( 01970 Pfn1->OriginalPte.u.Soft.Protection); 01971 01972 } else { 01973 01974 // 01975 // The prototype PTE is not valid, return the protection from the 01976 // PTE. 01977 // 01978 01979 return MI_CONVERT_FROM_PTE_PROTECTION ( 01980 ProtoPteContents.u.Soft.Protection); 01981 } 01982 } 01983 01984 if (PteContents.u.Hard.Valid == 1) { 01985 01986 // 01987 // The page is valid, the protection field is either in the 01988 // PFN database original PTE element or the WSLE. If 01989 // the page is private, get it from the PFN original PTE 01990 // element, else use the WSLE. 01991 // 01992 01993 Pfn1 = MI_PFN_ELEMENT (PteContents.u.Hard.PageFrameNumber); 01994 01995 if ((Pfn1->u3.e1.PrototypePte == 0) || 01996 #ifdef _X86_ 01997 (MiNumberOfExtraSystemPdes && (PointerPte >= (PMMPTE)KSTACK_POOL_START && PointerPte < (PMMPTE)(KSTACK_POOL_START + MiNumberOfExtraSystemPdes * MM_VA_MAPPED_BY_PDE))) || 01998 #endif 01999 (MI_IS_PTE_PROTOTYPE(PointerPte))) { 02000 02001 // 02002 // This is a private PTE or the PTE address is that of a 02003 // prototype PTE, hence the protection is in 02004 // the original PTE. 02005 // 02006 02007 return MI_CONVERT_FROM_PTE_PROTECTION( 02008 Pfn1->OriginalPte.u.Soft.Protection); 02009 } 02010 02011 // 02012 // The PTE was a hardware PTE, get the protection 02013 // from the WSLE. 02014 02015 Va = (PULONG)MiGetVirtualAddressMappedByPte (PointerPte); 02016 Index = MiLocateWsle ((PVOID)Va, MmWorkingSetList, 02017 Pfn1->u1.WsIndex); 02018 02019 return MI_CONVERT_FROM_PTE_PROTECTION (MmWsle[Index].u1.e1.Protection); 02020 } 02021 02022 // 02023 // PTE is either demand zero or transition, in either 02024 // case protection is in PTE. 02025 // 02026 02027 return MI_CONVERT_FROM_PTE_PROTECTION (PteContents.u.Soft.Protection); 02028 02029 }

NTSTATUS MiProtectVirtualMemory (  IN PEPROCESS  Process, IN PVOID *  BaseAddress, IN PSIZE_T  RegionSize, IN ULONG  NewProtect, IN PULONG  LastProtect )

Definition at line 344 of file protect.c. References ALT_CHANGE, ASSERT, _MMVAD::ControlArea, _MMVAD::EndingVpn, ExAcquireFastMutexUnsafe(), EXCEPTION_EXECUTE_HANDLER, ExReleaseFastMutexUnsafe(), FALSE, L, LOCK_WS_AND_ADDRESS_SPACE, LOCK_WS_UNSAFE, MI_CONVERT_FROM_PTE_PROTECTION, MI_GET_USED_PTES_HANDLE, MI_GET_WORKING_SET_FROM_PTE, MI_INCREMENT_USED_PTES_BY_HANDLE, MI_MAKE_VALID_PTE, MI_PFN_ELEMENT, MI_SET_PTE_IN_WORKING_SET, MI_VA_TO_VPN, MiChangeNoAccessForkPte(), MiCheckForConflictingVad, MiCheckSecuredVad(), MiCopyOnWrite(), MiDoesPdeExistAndMakeValid(), MiDoesPpeExistAndMakeValid, MiFlushTbAndCapture(), MiGetPageProtection(), MiGetPdeAddress, MiGetPpeAddress, MiGetProtoPteAddress, MiGetPteAddress, MiGetVirtualAddressMappedByPte, MiIsEntireRangeCommitted(), MiIsPteOnPdeBoundary, MiMakePdeExistAndMakeValid(), MiMakePpeExistAndMakeValid, MiMakeProtectForNativePage(), MiMakeProtectionMask(), MiProtectFor4kPage(), MiQueryProtectionFor4kPage(), MiRemovePageFromWorkingSet(), MiSetProtectionOnSection(), MiSetProtectionOnTransitionPte(), MM_PROTECTION_COPY_MASK, MmSectionCommitMutex, NT_SUCCESS, NTSTATUS(), NULL, _MMPFN::OriginalPte, PAGE_4K, PAGE_4K_ALIGN, PAGE_ALIGN, PAGE_SIZE, _MMVAD::StartingVpn, Status, TRUE, _MMPTE::u, _CONTROL_AREA::u, _MMVAD::u, _MMVAD::u2, _MMPFN::u3, UNLOCK_ADDRESS_SPACE, UNLOCK_WS_AND_ADDRESS_SPACE, UNLOCK_WS_UNSAFE, and VOID(). Referenced by NtAllocateVirtualMemory(), and NtProtectVirtualMemory(). : This routine changes the protection on a region of committed pages within the virtual address space of the subject process. Setting the protection on a range of pages causes the old protection to be replaced by the specified protection value. Arguments: Process - Supplies a pointer to the current process. BaseAddress - Supplies the starting address to protect. RegionsSize - Supplies the size of the region to protect. NewProtect - Supplies the new protection to set. LastProtect - Supplies the address of a kernel owned pointer to store (without probing) the old protection into. Return Value: the status of the protect operation. Environment: Kernel mode --*/ { PMMVAD FoundVad; PVOID StartingAddress; PVOID EndingAddress; PVOID CapturedBase; SIZE_T CapturedRegionSize; NTSTATUS Status; ULONG Attached; PMMPTE PointerPte; PMMPTE LastPte; PMMPTE PointerPde; PMMPTE PointerPpe; PMMPTE PointerProtoPte; PMMPTE LastProtoPte; PMMPFN Pfn1; ULONG CapturedOldProtect; ULONG ProtectionMask; MMPTE TempPte; MMPTE PteContents; MMPTE PreviousPte; ULONG Locked; PVOID Va; ULONG DoAgain; ULONG Waited; PVOID UsedPageTableHandle; PVOID UsedPageDirectoryHandle; ULONG WorkingSetIndex; #if defined(_MIALT4K_) PVOID OriginalBase; SIZE_T OriginalRegionSize; ULONG OriginalProtectionMask; PVOID StartingAddressFor4k; PVOID EndingAddressFor4k; SIZE_T CapturedRegionSizeFor4k; ULONG CapturedOldProtectFor4k; BOOLEAN EmulationFor4kPage = FALSE; #endif Attached = FALSE; Locked = FALSE; // // Get the address creation mutex to block multiple threads from // creating or deleting address space at the same time. // Get the working set mutex so PTEs can be modified. // Block APCs so an APC which takes a page // fault does not corrupt various structures. // CapturedBase = *BaseAddress; CapturedRegionSize = *RegionSize; #if defined(_MIALT4K_) OriginalBase = CapturedBase; OriginalRegionSize = CapturedRegionSize; if (Process->Wow64Process != NULL) { StartingAddressFor4k = (PVOID)PAGE_4K_ALIGN(OriginalBase); EndingAddressFor4k = (PVOID)(((ULONG_PTR)OriginalBase + OriginalRegionSize - 1) | (PAGE_4K - 1)); CapturedRegionSizeFor4k = (ULONG_PTR)EndingAddressFor4k - (ULONG_PTR)StartingAddressFor4k + 1L; OriginalProtectionMask = MiMakeProtectionMask(NewProtect); EmulationFor4kPage = TRUE; } #endif try { ProtectionMask = MiMakeProtectionMask (NewProtect); } except (EXCEPTION_EXECUTE_HANDLER) { return GetExceptionCode(); } LOCK_WS_AND_ADDRESS_SPACE (Process); // // Make sure the address space was not deleted, if so, return an error. // if (Process->AddressSpaceDeleted != 0) { Status = STATUS_PROCESS_IS_TERMINATING; goto ErrorFound; } EndingAddress = (PVOID)(((ULONG_PTR)CapturedBase + CapturedRegionSize - 1L) | (PAGE_SIZE - 1L)); StartingAddress = (PVOID)PAGE_ALIGN(CapturedBase); FoundVad = MiCheckForConflictingVad (StartingAddress, EndingAddress); if (FoundVad == (PMMVAD)NULL) { // // No virtual address is reserved at the specified base address, // return an error. // Status = STATUS_CONFLICTING_ADDRESSES; goto ErrorFound; } // // Ensure that the starting and ending addresses are all within // the same virtual address descriptor. // if ((MI_VA_TO_VPN (StartingAddress) < FoundVad->StartingVpn) || (MI_VA_TO_VPN (EndingAddress) > FoundVad->EndingVpn)) { // // Not within the section virtual address descriptor, // return an error. // Status = STATUS_CONFLICTING_ADDRESSES; goto ErrorFound; } if (FoundVad->u.VadFlags.UserPhysicalPages == 1) { // // These must always be readwrite. // Status = STATUS_CONFLICTING_ADDRESSES; goto ErrorFound; } if (FoundVad->u.VadFlags.PhysicalMapping == 1) { // // Setting the protection of a physically mapped section is // not allowed as there is no corresponding PFN database element. // Status = STATUS_CONFLICTING_ADDRESSES; goto ErrorFound; } if (FoundVad->u.VadFlags.NoChange == 1) { // // An attempt is made at changing the protection // of a secured VAD, check to see if the address range // to change allows the change. // Status = MiCheckSecuredVad (FoundVad, CapturedBase, CapturedRegionSize, ProtectionMask); if (!NT_SUCCESS (Status)) { goto ErrorFound; } } #if defined(_MIALT4K_) else if (EmulationFor4kPage == TRUE) { // // if not secured, relax the protection // NewProtect = MiMakeProtectForNativePage(StartingAddressFor4k, NewProtect, Process); ProtectionMask = MiMakeProtectionMask (NewProtect); } #endif if (FoundVad->u.VadFlags.PrivateMemory == 0) { // // For mapped sections, the NO_CACHE attribute is not allowed. // if (NewProtect & PAGE_NOCACHE) { // // Not allowed. // Status = STATUS_INVALID_PARAMETER_4; goto ErrorFound; } // // If this is a file mapping, then all pages must be // committed as there can be no sparse file maps. Images // can have non-committed pages if the alignment is greater // than the page size. // if ((FoundVad->ControlArea->u.Flags.File == 0) || (FoundVad->ControlArea->u.Flags.Image == 1)) { PointerProtoPte = MiGetProtoPteAddress (FoundVad, MI_VA_TO_VPN (StartingAddress)); LastProtoPte = MiGetProtoPteAddress (FoundVad, MI_VA_TO_VPN (EndingAddress)); // // Release the working set mutex and acquire the section // commit mutex. Check all the prototype PTEs described by // the virtual address range to ensure they are committed. // UNLOCK_WS_UNSAFE (Process); ExAcquireFastMutexUnsafe (&MmSectionCommitMutex); while (PointerProtoPte <= LastProtoPte) { // // Check to see if the prototype PTE is committed, if // not return an error. // if (PointerProtoPte->u.Long == 0) { // // Error, this prototype PTE is not committed. // ExReleaseFastMutexUnsafe (&MmSectionCommitMutex); Status = STATUS_NOT_COMMITTED; UNLOCK_ADDRESS_SPACE (Process); goto ErrorFoundNoWs; } PointerProtoPte += 1; } // // The range is committed, release the section commitment // mutex, acquire the working set mutex and update the local PTEs. // ExReleaseFastMutexUnsafe (&MmSectionCommitMutex); // // Set the protection on the section pages. This could // get a quota exceeded exception. // LOCK_WS_UNSAFE (Process); } #if defined(_MIALT4K_) // // We need to change the alternate table before PTEs are created for the protection // change. // if (EmulationFor4kPage == TRUE) { // // Before accessing Alternate Table, unlock the working set mutex // UNLOCK_WS_UNSAFE (Process); // // Get the old protection // CapturedOldProtectFor4k = MiQueryProtectionFor4kPage(StartingAddressFor4k, Process); if (CapturedOldProtectFor4k != 0) { CapturedOldProtectFor4k = MI_CONVERT_FROM_PTE_PROTECTION(CapturedOldProtectFor4k); } // // Set the alternate permission table // if ((FoundVad->u.VadFlags.ImageMap == 1) || (FoundVad->u2.VadFlags2.CopyOnWrite == 1)) { OriginalProtectionMask |= MM_PROTECTION_COPY_MASK; } MiProtectFor4kPage (StartingAddressFor4k, CapturedRegionSizeFor4k, OriginalProtectionMask, ALT_CHANGE, Process); LOCK_WS_UNSAFE (Process); } #endif try { Locked = MiSetProtectionOnSection ( Process, FoundVad, StartingAddress, EndingAddress, NewProtect, &CapturedOldProtect, FALSE ); } except (EXCEPTION_EXECUTE_HANDLER) { Status = GetExceptionCode(); goto ErrorFound; } } else { // // Not a section, private. // For private pages, the WRITECOPY attribute is not allowed. // if ((NewProtect & PAGE_WRITECOPY) || (NewProtect & PAGE_EXECUTE_WRITECOPY)) { // // Not allowed. // Status = STATUS_INVALID_PARAMETER_4; goto ErrorFound; } // // Ensure all of the pages are already committed as described // in the virtual address descriptor. // if ( !MiIsEntireRangeCommitted(StartingAddress, EndingAddress, FoundVad, Process)) { // // Previously reserved pages have been decommitted, or an error // occurred, release mutex and return status. // Status = STATUS_NOT_COMMITTED; goto ErrorFound; } #if defined(_MIALT4K_) // // We need to change the alternate table before PTEs are created for the protection // change. // if (EmulationFor4kPage == TRUE) { // // Before accessing Alternate Table, unlock the working set mutex // UNLOCK_WS_UNSAFE (Process); // // Get the old protection // CapturedOldProtectFor4k = MiQueryProtectionFor4kPage(StartingAddressFor4k, Process); if (CapturedOldProtectFor4k != 0) { CapturedOldProtectFor4k = MI_CONVERT_FROM_PTE_PROTECTION(CapturedOldProtectFor4k); } // // Set the alternate permission table // MiProtectFor4kPage (StartingAddressFor4k, CapturedRegionSizeFor4k, OriginalProtectionMask, ALT_CHANGE, Process); LOCK_WS_UNSAFE (Process); } #endif // // The address range is committed, change the protection. // PointerPpe = MiGetPpeAddress (StartingAddress); PointerPde = MiGetPdeAddress (StartingAddress); PointerPte = MiGetPteAddress (StartingAddress); LastPte = MiGetPteAddress (EndingAddress); #if defined (_WIN64) MiMakePpeExistAndMakeValid (PointerPpe, Process, FALSE); if (PointerPde->u.Long == 0) { UsedPageDirectoryHandle = MI_GET_USED_PTES_HANDLE (PointerPte); MI_INCREMENT_USED_PTES_BY_HANDLE (UsedPageDirectoryHandle); } #endif MiMakePdeExistAndMakeValid(PointerPde, Process, FALSE); // // Capture the protection for the first page. // if (PointerPte->u.Long != 0) { CapturedOldProtect = MiGetPageProtection (PointerPte, Process); // // Make sure the page directory & table pages are still resident. // #if defined (_WIN64) MiMakePpeExistAndMakeValid (PointerPpe, Process, FALSE); if (PointerPde->u.Long == 0) { UsedPageDirectoryHandle = MI_GET_USED_PTES_HANDLE (PointerPte); MI_INCREMENT_USED_PTES_BY_HANDLE (UsedPageDirectoryHandle); } #endif (VOID) MiMakePdeExistAndMakeValid(PointerPde, Process, FALSE); } else { // // Get the protection from the VAD. // CapturedOldProtect = MI_CONVERT_FROM_PTE_PROTECTION(FoundVad->u.VadFlags.Protection); } // // For all the PTEs in the specified address range, set the // protection depending on the state of the PTE. // while (PointerPte <= LastPte) { if (MiIsPteOnPdeBoundary (PointerPte)) { PointerPde = MiGetPteAddress (PointerPte); PointerPpe = MiGetPdeAddress (PointerPte); #if defined (_WIN64) MiMakePpeExistAndMakeValid (PointerPpe, Process, FALSE); if (PointerPde->u.Long == 0) { UsedPageDirectoryHandle = MI_GET_USED_PTES_HANDLE (PointerPte); MI_INCREMENT_USED_PTES_BY_HANDLE (UsedPageDirectoryHandle); } #endif MiMakePdeExistAndMakeValid(PointerPde, Process, FALSE); } PteContents = *PointerPte; if (PteContents.u.Long == 0) { // // Increment the count of non-zero page table entries // for this page table and the number of private pages // for the process. The protection will be set as // if the PTE was demand zero. // UsedPageTableHandle = MI_GET_USED_PTES_HANDLE (MiGetVirtualAddressMappedByPte (PointerPte)); MI_INCREMENT_USED_PTES_BY_HANDLE (UsedPageTableHandle); } if (PteContents.u.Hard.Valid == 1) { // // Set the protection into both the PTE and the original PTE // in the PFN database. // Pfn1 = MI_PFN_ELEMENT (PteContents.u.Hard.PageFrameNumber); if (Pfn1->u3.e1.PrototypePte == 1) { // // This PTE refers to a fork prototype PTE, make it // private. // MiCopyOnWrite (MiGetVirtualAddressMappedByPte (PointerPte), PointerPte); // // This may have released the working set mutex and // the page directory and table pages may no longer be // in memory. // do { (VOID)MiDoesPpeExistAndMakeValid (MiGetPteAddress (PointerPde), Process, FALSE, &Waited); Waited = 0; (VOID)MiDoesPdeExistAndMakeValid (PointerPde, Process, FALSE, &Waited); } while (Waited != 0); // // Do the loop again for the same PTE. // continue; } else { // // The PTE is a private page which is valid, if the // specified protection is no-access or guard page // remove the PTE from the working set. // if ((NewProtect & PAGE_NOACCESS) || (NewProtect & PAGE_GUARD)) { // // Remove the page from the working set. // Locked = MiRemovePageFromWorkingSet (PointerPte, Pfn1, &Process->Vm); continue; } else { #if PFN_CONSISTENCY MiSetOriginalPteProtection (Pfn1, ProtectionMask); #else Pfn1->OriginalPte.u.Soft.Protection = ProtectionMask; #endif MI_MAKE_VALID_PTE (TempPte, PointerPte->u.Hard.PageFrameNumber, ProtectionMask, PointerPte); WorkingSetIndex = MI_GET_WORKING_SET_FROM_PTE (&PteContents); MI_SET_PTE_IN_WORKING_SET (&TempPte, WorkingSetIndex); // // Flush the TB as we have changed the protection // of a valid PTE. // PreviousPte.u.Flush = MiFlushTbAndCapture (PointerPte, TempPte.u.Flush, Pfn1); } } } else { if (PteContents.u.Soft.Prototype == 1) { // // This PTE refers to a fork prototype PTE, make the // page private. This is accomplished by releasing // the working set mutex, reading the page thereby // causing a fault, and re-executing the loop, hopefully, // this time, we'll find the page present and will // turn it into a private page. // // Note, that a TRY is used to catch guard // page exceptions and no-access exceptions. // Va = MiGetVirtualAddressMappedByPte (PointerPte); DoAgain = TRUE; while (PteContents.u.Hard.Valid == 0) { UNLOCK_WS_UNSAFE (Process); try { *(volatile ULONG *)Va; } except (EXCEPTION_EXECUTE_HANDLER) { if (GetExceptionCode() == STATUS_ACCESS_VIOLATION) { // // The prototype PTE must be noaccess. // DoAgain = MiChangeNoAccessForkPte (PointerPte, ProtectionMask); } else if (GetExceptionCode() == STATUS_IN_PAGE_ERROR) { // // Ignore this page and go onto the next one. // PointerPte += 1; DoAgain = TRUE; if (PointerPte > LastPte) { LOCK_WS_UNSAFE (Process); break; } } } LOCK_WS_UNSAFE (Process); do { (VOID)MiDoesPpeExistAndMakeValid (MiGetPteAddress (PointerPde), Process, FALSE, &Waited); Waited = 0; (VOID)MiDoesPdeExistAndMakeValid (PointerPde, Process, FALSE, &Waited); } while (Waited != 0); PteContents = *(volatile MMPTE *)PointerPte; } if (DoAgain) { continue; } } else { if (PteContents.u.Soft.Transition == 1) { if (MiSetProtectionOnTransitionPte ( PointerPte, ProtectionMask)) { continue; } } else { // // Must be page file space or demand zero. // PointerPte->u.Soft.Protection = ProtectionMask; ASSERT (PointerPte->u.Long != 0); } } } PointerPte += 1; } //end while } // // Common completion code. // #if defined(_MIALT4K_) if (EmulationFor4kPage == TRUE) { StartingAddress = StartingAddressFor4k; EndingAddress = EndingAddressFor4k; if (CapturedOldProtectFor4k != 0) { // // change CapturedOldProtect when CapturedOldProtectFor4k // contains the true protection for the 4k page // CapturedOldProtect = CapturedOldProtectFor4k; } } #endif *RegionSize = (PCHAR)EndingAddress - (PCHAR)StartingAddress + 1L; *BaseAddress = StartingAddress; *LastProtect = CapturedOldProtect; if (Locked) { Status = STATUS_WAS_UNLOCKED; } else { Status = STATUS_SUCCESS; } ErrorFound: UNLOCK_WS_AND_ADDRESS_SPACE (Process); ErrorFoundNoWs: return Status; }

ULONG MiSetProtectionOnSection (  IN PEPROCESS  Process, IN PMMVAD  FoundVad, IN PVOID  StartingAddress, IN PVOID  EndingAddress, IN ULONG  NewProtect, OUT PULONG  CapturedOldProtect, IN ULONG  DontCharge )

Definition at line 1110 of file protect.c. References ASSERT, EXCEPTION_EXECUTE_HANDLER, ExRaiseStatus(), FALSE, Index, LOCK_WS_UNSAFE, MI_CONVERT_FROM_PTE_PROTECTION, MI_GET_USED_PTES_HANDLE, MI_GET_WORKING_SET_FROM_PTE, MI_INCREMENT_USED_PTES_BY_HANDLE, MI_IS_PTE_PROTECTION_COPY_WRITE, MI_MAKE_VALID_PTE, MI_PFN_ELEMENT, MI_PTE_LOOKUP_NEEDED, MI_SET_PTE_IN_WORKING_SET, MI_VA_TO_VPN, MI_WRITE_INVALID_PTE, MiCaptureSystemPte(), MiChangeNoAccessForkPte(), MiChargeCommitment(), MiChargePageFileQuota(), MiCopyOnWrite(), MiDoesPdeExistAndMakeValid(), MiDoesPpeExistAndMakeValid, MiFlushTbAndCapture(), MiGetPageProtection(), MiGetPdeAddress, MiGetPpeAddress, MiGetProtoPteAddress, MiGetPteAddress, MiGetVirtualAddressMappedByPte, MiIsPteOnPdeBoundary, MiLocateWsle(), MiMakePdeExistAndMakeValid(), MiMakePpeExistAndMakeValid, MiMakeProtectionMask(), MiPteToProto, MiRemovePageFromWorkingSet(), MiReturnCommitment(), MiReturnPageFileQuota(), MiSetProtectionOnTransitionPte(), MM_COPY_ON_WRITE_MASK, MM_DBG_COMMIT_RETURN_PROTECTION, MM_DBG_COMMIT_SET_PROTECTION, MM_PROTECTION_COPY_MASK, MM_TRACK_COMMIT, MmWorkingSetList, MmWsle, NTSTATUS(), NULL, _MMPFN::OriginalPte, PAGED_CODE, PrototypePte, PS_JOB_STATUS_REPORT_COMMIT_CHANGES, PsChangeJobMemoryUsage(), PsReportProcessMemoryLimitViolation(), _MMPFN::PteAddress, TRUE, _MMPTE::u, _MMWSLE::u1, _MMPFN::u1, _MMPFN::u3, UNLOCK_WS_UNSAFE, and VOID(). Referenced by MiProtectVirtualMemory(), and NtAllocateVirtualMemory(). 01122 : 01123 01124 This routine changes the protection on a region of committed pages 01125 within the virtual address space of the subject process. Setting 01126 the protection on a range of pages causes the old protection to be 01127 replaced by the specified protection value. 01128 01129 Arguments: 01130 01131 Process - Supplies a pointer to the current process. 01132 01133 FoundVad - Supplies a pointer to the VAD containing the range to protect. 01134 01135 StartingAddress - Supplies the starting address to protect. 01136 01137 EndingAddress - Supplies the ending address to protect. 01138 01139 NewProtect - Supplies the new protection to set. 01140 01141 CapturedOldProtect - Supplies the address of a kernel owned pointer to 01142 store (without probing) the old protection into. 01143 01144 DontCharge - Supplies TRUE if no quota or commitment should be charged. 01145 01146 Return Value: 01147 01148 Returns TRUE if a locked page was removed from the working set (protection 01149 was guard page or no-access, FALSE otherwise. 01150 01151 Exceptions raised for page file quota or commitment violations. 01152 01153 Environment: 01154 01155 Kernel mode, working set mutex held, address creation mutex held 01156 APCs disabled. 01157 01158 --*/ 01159 01160 { 01161 PMMPTE PointerPte; 01162 PMMPTE LastPte; 01163 PMMPTE PointerPde; 01164 PMMPTE PointerPpe; 01165 PMMPTE PointerProtoPte; 01166 PMMPFN Pfn1; 01167 MMPTE TempPte; 01168 MMPTE PreviousPte; 01169 ULONG Locked; 01170 ULONG ProtectionMask; 01171 ULONG ProtectionMaskNotCopy; 01172 ULONG NewProtectionMask; 01173 MMPTE PteContents; 01174 ULONG Index; 01175 PULONG Va; 01176 ULONG WriteCopy; 01177 ULONG DoAgain; 01178 ULONG Waited; 01179 SIZE_T QuotaCharge; 01180 PVOID UsedPageTableHandle; 01181 PVOID UsedPageDirectoryHandle; 01182 ULONG WorkingSetIndex; 01183 01184 PAGED_CODE(); 01185 01186 Locked = FALSE; 01187 WriteCopy = FALSE; 01188 QuotaCharge = 0; 01189 01190 // 01191 // Make the protection field. 01192 // 01193 01194 ASSERT (FoundVad->u.VadFlags.PrivateMemory == 0); 01195 01196 if ((FoundVad->u.VadFlags.ImageMap == 1) || 01197 (FoundVad->u2.VadFlags2.CopyOnWrite == 1)) { 01198 01199 if (NewProtect & PAGE_READWRITE) { 01200 NewProtect &= ~PAGE_READWRITE; 01201 NewProtect |= PAGE_WRITECOPY; 01202 } 01203 01204 if (NewProtect & PAGE_EXECUTE_READWRITE) { 01205 NewProtect &= ~PAGE_EXECUTE_READWRITE; 01206 NewProtect |= PAGE_EXECUTE_WRITECOPY; 01207 } 01208 } 01209 01210 ProtectionMask = MiMakeProtectionMask (NewProtect); 01211 01212 // 01213 // Determine if copy on write is being set. 01214 // 01215 01216 ProtectionMaskNotCopy = ProtectionMask; 01217 if ((ProtectionMask & MM_COPY_ON_WRITE_MASK) == MM_COPY_ON_WRITE_MASK) { 01218 WriteCopy = TRUE; 01219 ProtectionMaskNotCopy &= ~MM_PROTECTION_COPY_MASK; 01220 } 01221 01222 #if defined(_MIALT4K_) 01223 01224 if ((Process->Wow64Process != NULL) && 01225 (FoundVad->u.VadFlags.ImageMap == 0) && 01226 (FoundVad->u2.VadFlags2.CopyOnWrite == 0) && 01227 (WriteCopy)) { 01228 01229 NTSTATUS status; 01230 01231 status = MiSetCopyPagesFor4kPage(Process, 01232 &FoundVad, 01233 &StartingAddress, 01234 &EndingAddress, 01235 ProtectionMask); 01236 01237 if (status != STATUS_SUCCESS) { 01238 ExRaiseStatus (status); 01239 } 01240 01241 } 01242 01243 #endif 01244 01245 PointerPpe = MiGetPpeAddress (StartingAddress); 01246 PointerPde = MiGetPdeAddress (StartingAddress); 01247 PointerPte = MiGetPteAddress (StartingAddress); 01248 LastPte = MiGetPteAddress (EndingAddress); 01249 01250 #if defined (_WIN64) 01251 MiMakePpeExistAndMakeValid (PointerPpe, Process, FALSE); 01252 if (PointerPde->u.Long == 0) { 01253 UsedPageDirectoryHandle = MI_GET_USED_PTES_HANDLE (PointerPte); 01254 MI_INCREMENT_USED_PTES_BY_HANDLE (UsedPageDirectoryHandle); 01255 } 01256 #endif 01257 01258 MiMakePdeExistAndMakeValid(PointerPde, Process, FALSE); 01259 01260 // 01261 // Capture the protection for the first page. 01262 // 01263 01264 if (PointerPte->u.Long != 0) { 01265 01266 *CapturedOldProtect = MiGetPageProtection (PointerPte, Process); 01267 01268 // 01269 // Make sure the Page table page is still resident. 01270 // 01271 01272 PointerPpe = MiGetPteAddress (PointerPde); 01273 01274 do { 01275 01276 (VOID)MiDoesPpeExistAndMakeValid (PointerPpe, Process, FALSE, &Waited); 01277 Waited = 0; 01278 01279 (VOID)MiDoesPdeExistAndMakeValid (PointerPde, Process, FALSE, &Waited); 01280 } while (Waited != 0); 01281 01282 } else { 01283 01284 // 01285 // Get the protection from the VAD, unless image file. 01286 // 01287 01288 if (FoundVad->u.VadFlags.ImageMap == 0) { 01289 01290 // 01291 // This is not an image file, the protection is in the VAD. 01292 // 01293 01294 *CapturedOldProtect = 01295 MI_CONVERT_FROM_PTE_PROTECTION(FoundVad->u.VadFlags.Protection); 01296 } else { 01297 01298 // 01299 // This is an image file, the protection is in the 01300 // prototype PTE. 01301 // 01302 01303 PointerProtoPte = MiGetProtoPteAddress (FoundVad, 01304 MI_VA_TO_VPN ( 01305 MiGetVirtualAddressMappedByPte (PointerPte))); 01306 01307 TempPte = MiCaptureSystemPte (PointerProtoPte, Process); 01308 01309 *CapturedOldProtect = MiGetPageProtection (&TempPte, 01310 Process); 01311 01312 // 01313 // Make sure the Page directory and table pages are still resident. 01314 // 01315 01316 PointerPpe = MiGetPteAddress (PointerPde); 01317 01318 do { 01319 01320 (VOID)MiDoesPpeExistAndMakeValid(PointerPpe, Process, FALSE, &Waited); 01321 Waited = 0; 01322 01323 (VOID)MiDoesPdeExistAndMakeValid(PointerPde, Process, FALSE, &Waited); 01324 } while (Waited != 0); 01325 } 01326 } 01327 01328 // 01329 // If the page protection is being change to be copy-on-write, the 01330 // commitment and page file quota for the potentially dirty private pages 01331 // must be calculated and charged. This must be done before any 01332 // protections are changed as the changes cannot be undone. 01333 // 01334 01335 if (WriteCopy) { 01336 01337 // 01338 // Calculate the charges. If the page is shared and not write copy 01339 // it is counted as a charged page. 01340 // 01341 01342 while (PointerPte <= LastPte) { 01343 01344 if (MiIsPteOnPdeBoundary (PointerPte)) { 01345 01346 PointerPde = MiGetPteAddress (PointerPte); 01347 PointerPpe = MiGetPteAddress (PointerPde); 01348 01349 do { 01350 01351 while (!MiDoesPpeExistAndMakeValid(PointerPpe, Process, FALSE, &Waited)) { 01352 01353 // 01354 // No PPE exists for this address. Therefore 01355 // all the PTEs are shared and not copy on write. 01356 // go to the next PPE. 01357 // 01358 01359 PointerPpe += 1; 01360 PointerPde = MiGetVirtualAddressMappedByPte (PointerPpe); 01361 PointerProtoPte = PointerPte; 01362 PointerPte = MiGetVirtualAddressMappedByPte (PointerPde); 01363 01364 if (PointerPte > LastPte) { 01365 QuotaCharge += 1 + LastPte - PointerProtoPte; 01366 goto Done; 01367 } 01368 QuotaCharge += PointerPte - PointerProtoPte; 01369 } 01370 01371 Waited = 0; 01372 01373 while (!MiDoesPdeExistAndMakeValid(PointerPde, Process, FALSE, &Waited)) { 01374 01375 // 01376 // No PDE exists for this address. Therefore 01377 // all the PTEs are shared and not copy on write. 01378 // go to the next PDE. 01379 // 01380 01381 PointerPde += 1; 01382 PointerProtoPte = PointerPte; 01383 PointerPpe = MiGetPteAddress (PointerPde); 01384 PointerPte = MiGetVirtualAddressMappedByPte (PointerPde); 01385 01386 if (PointerPte > LastPte) { 01387 QuotaCharge += 1 + LastPte - PointerProtoPte; 01388 goto Done; 01389 } 01390 QuotaCharge += PointerPte - PointerProtoPte; 01391 #if defined (_WIN64) 01392 if (MiIsPteOnPdeBoundary (PointerPde)) { 01393 Waited = 1; 01394 break; 01395 } 01396 #endif 01397 } 01398 } while (Waited != 0); 01399 } 01400 01401 PteContents = *PointerPte; 01402 01403 if (PteContents.u.Long == 0) { 01404 01405 // 01406 // The PTE has not been evaluated, assume copy on write. 01407 // 01408 01409 QuotaCharge += 1; 01410 01411 } else if ((PteContents.u.Hard.Valid == 1) && 01412 (PteContents.u.Hard.CopyOnWrite == 0)) { 01413 01414 // 01415 // See if this is a prototype PTE, if so charge it. 01416 // 01417 01418 Pfn1 = MI_PFN_ELEMENT (PteContents.u.Hard.PageFrameNumber); 01419 01420 if (Pfn1->u3.e1.PrototypePte == 1) { 01421 QuotaCharge += 1; 01422 } 01423 } else { 01424 01425 if (PteContents.u.Soft.Prototype == 1) { 01426 01427 // 01428 // This is a prototype PTE. Charge if it is not 01429 // in copy on write format. 01430 // 01431 01432 if (PteContents.u.Soft.PageFileHigh == MI_PTE_LOOKUP_NEEDED) { 01433 01434 // 01435 // Page protection is within the PTE. 01436 // 01437 01438 if (!MI_IS_PTE_PROTECTION_COPY_WRITE(PteContents.u.Soft.Protection)) { 01439 QuotaCharge += 1; 01440 } 01441 } else { 01442 01443 // 01444 // The PTE references the prototype directly, therefore 01445 // it can't be copy on write. Charge. 01446 // 01447 01448 QuotaCharge += 1; 01449 } 01450 } 01451 } 01452 PointerPte += 1; 01453 } 01454 01455 Done: 01456 NOTHING; 01457 01458 // 01459 // Charge for the quota. 01460 // 01461 01462 if (!DontCharge) { 01463 MiChargePageFileQuota (QuotaCharge, Process); 01464 01465 if (Process->CommitChargeLimit) { 01466 if (Process->CommitCharge + QuotaCharge > Process->CommitChargeLimit) { 01467 MiReturnPageFileQuota (QuotaCharge, Process); 01468 if (Process->Job) { 01469 PsReportProcessMemoryLimitViolation (); 01470 } 01471 ExRaiseStatus (STATUS_COMMITMENT_LIMIT); 01472 } 01473 } 01474 if (Process->JobStatus & PS_JOB_STATUS_REPORT_COMMIT_CHANGES) { 01475 if (PsChangeJobMemoryUsage(QuotaCharge) == FALSE) { 01476 MiReturnPageFileQuota (QuotaCharge, Process); 01477 ExRaiseStatus (STATUS_COMMITMENT_LIMIT); 01478 } 01479 } 01480 01481 if (MiChargeCommitment (QuotaCharge, Process) == FALSE) { 01482 if (Process->JobStatus & PS_JOB_STATUS_REPORT_COMMIT_CHANGES) { 01483 01484 // 01485 // Temporarily up the process commit charge as the 01486 // job code will be referencing it as though everything 01487 // has succeeded. 01488 // 01489 01490 Process->CommitCharge += QuotaCharge; 01491 PsChangeJobMemoryUsage(-(SSIZE_T)QuotaCharge); 01492 Process->CommitCharge -= QuotaCharge; 01493 } 01494 MiReturnPageFileQuota (QuotaCharge, Process); 01495 ExRaiseStatus STATUS_COMMITMENT_LIMIT; 01496 } 01497 01498 // 01499 // Add the quota into the charge to the VAD. 01500 // 01501 01502 MM_TRACK_COMMIT (MM_DBG_COMMIT_SET_PROTECTION, QuotaCharge); 01503 FoundVad->u.VadFlags.CommitCharge += QuotaCharge; 01504 Process->CommitCharge += QuotaCharge; 01505 if (Process->CommitCharge > Process->CommitChargePeak) { 01506 Process->CommitChargePeak = Process->CommitCharge; 01507 } 01508 } 01509 } 01510 01511 // 01512 // For all the PTEs in the specified address range, set the 01513 // protection depending on the state of the PTE. 01514 // 01515 01516 // 01517 // If the PTE was copy on write (but not written) and the 01518 // new protection is NOT copy-on-write, return page file quota 01519 // and commitment. 01520 // 01521 01522 PointerPpe = MiGetPpeAddress (StartingAddress); 01523 PointerPde = MiGetPdeAddress (StartingAddress); 01524 PointerPte = MiGetPteAddress (StartingAddress); 01525 01526 do { 01527 01528 MiDoesPpeExistAndMakeValid (PointerPpe, Process, FALSE, &Waited); 01529 01530 Waited = 0; 01531 01532 MiDoesPdeExistAndMakeValid (PointerPde, Process, FALSE, &Waited); 01533 01534 } while (Waited != 0); 01535 01536 QuotaCharge = 0; 01537 01538 while (PointerPte <= LastPte) { 01539 01540 if (MiIsPteOnPdeBoundary (PointerPte)) { 01541 PointerPde = MiGetPteAddress (PointerPte); 01542 PointerPpe = MiGetPdeAddress (PointerPte); 01543 01544 #if defined (_WIN64) 01545 MiMakePpeExistAndMakeValid (PointerPpe, Process, FALSE); 01546 if (PointerPde->u.Long == 0) { 01547 UsedPageDirectoryHandle = MI_GET_USED_PTES_HANDLE (PointerPte); 01548 MI_INCREMENT_USED_PTES_BY_HANDLE (UsedPageDirectoryHandle); 01549 } 01550 #endif 01551 01552 MiMakePdeExistAndMakeValid (PointerPde, Process, FALSE); 01553 } 01554 01555 PteContents = *PointerPte; 01556 01557 if (PteContents.u.Long == 0) { 01558 01559 // 01560 // The PTE is zero, set it into prototype PTE format 01561 // with the protection in the prototype PTE. 01562 // 01563 01564 TempPte = PrototypePte; 01565 TempPte.u.Soft.Protection = ProtectionMask; 01566 MI_WRITE_INVALID_PTE (PointerPte, TempPte); 01567 01568 // 01569 // Increment the count of non-zero page table entries 01570 // for this page table and the number of private pages 01571 // for the process. 01572 // 01573 01574 UsedPageTableHandle = MI_GET_USED_PTES_HANDLE (MiGetVirtualAddressMappedByPte (PointerPte)); 01575 01576 MI_INCREMENT_USED_PTES_BY_HANDLE (UsedPageTableHandle); 01577 01578 } else if (PteContents.u.Hard.Valid == 1) { 01579 01580 // 01581 // Set the protection into both the PTE and the original PTE 01582 // in the PFN database for private pages only. 01583 // 01584 01585 NewProtectionMask = ProtectionMask; 01586 01587 Pfn1 = MI_PFN_ELEMENT (PteContents.u.Hard.PageFrameNumber); 01588 01589 if ((NewProtect & PAGE_NOACCESS) || 01590 (NewProtect & PAGE_GUARD)) { 01591 01592 Locked = MiRemovePageFromWorkingSet (PointerPte, 01593 Pfn1, 01594 &Process->Vm ); 01595 continue; 01596 01597 } else { 01598 01599 if (Pfn1->u3.e1.PrototypePte == 1) { 01600 01601 // 01602 // The true protection may be in the WSLE, locate 01603 // the WSLE. 01604 // 01605 01606 Va = (PULONG)MiGetVirtualAddressMappedByPte (PointerPte); 01607 Index = MiLocateWsle ((PVOID)Va, MmWorkingSetList, 01608 Pfn1->u1.WsIndex); 01609 01610 // 01611 // Check to see if this is a prototype PTE. This 01612 // is done by comparing the PTE address in the 01613 // PFN database to the PTE address indicated by the 01614 // VAD. If they are not equal, this is a prototype 01615 // PTE. 01616 // 01617 01618 if (Pfn1->PteAddress != 01619 MiGetProtoPteAddress (FoundVad, 01620 MI_VA_TO_VPN ((PVOID)Va))) { 01621 01622 // 01623 // This PTE refers to a fork prototype PTE, make it 01624 // private. 01625 // 01626 01627 MiCopyOnWrite ((PVOID)Va, PointerPte); 01628 01629 if (WriteCopy) { 01630 QuotaCharge += 1; 01631 } 01632 01633 // 01634 // This may have released the working set mutex and 01635 // the page table page may no longer be in memory. 01636 // 01637 01638 PointerPpe = MiGetPteAddress (PointerPde); 01639 01640 do { 01641 01642 (VOID)MiDoesPpeExistAndMakeValid (PointerPpe, 01643 Process, 01644 FALSE, 01645 &Waited); 01646 01647 Waited = 0; 01648 01649 (VOID)MiDoesPdeExistAndMakeValid (PointerPde, 01650 Process, 01651 FALSE, 01652 &Waited); 01653 01654 } while (Waited != 0); 01655 01656 // 01657 // Do the loop again. 01658 // 01659 01660 continue; 01661 01662 } else { 01663 01664 // 01665 // Update the protection field in the WSLE and 01666 // the PTE. 01667 // 01668 // 01669 // If the PTE is copy on write uncharge the 01670 // previously charged quota. 01671 // 01672 01673 if ((!WriteCopy) && (PteContents.u.Hard.CopyOnWrite == 1)) { 01674 QuotaCharge += 1; 01675 } 01676 01677 MmWsle[Index].u1.e1.Protection = ProtectionMask; 01678 MmWsle[Index].u1.e1.SameProtectAsProto = 0; 01679 } 01680 01681 } else { 01682 01683 // 01684 // Page is private (copy on written), protection mask 01685 // is stored in the original pte field. 01686 // 01687 01688 #if PFN_CONSISTENCY 01689 MiSetOriginalPteProtection (Pfn1, ProtectionMaskNotCopy); 01690 #else 01691 Pfn1->OriginalPte.u.Soft.Protection = ProtectionMaskNotCopy; 01692 #endif 01693 NewProtectionMask = ProtectionMaskNotCopy; 01694 } 01695 01696 MI_MAKE_VALID_PTE (TempPte, 01697 PteContents.u.Hard.PageFrameNumber, 01698 NewProtectionMask, 01699 PointerPte); 01700 01701 WorkingSetIndex = MI_GET_WORKING_SET_FROM_PTE (&PteContents); 01702 01703 MI_SET_PTE_IN_WORKING_SET (&TempPte, WorkingSetIndex); 01704 } 01705 01706 // 01707 // Flush the TB as we have changed the protection 01708 // of a valid PTE. 01709 // 01710 01711 PreviousPte.u.Flush = MiFlushTbAndCapture (PointerPte, 01712 TempPte.u.Flush, 01713 Pfn1); 01714 } else { 01715 01716 if (PteContents.u.Soft.Prototype == 1) { 01717 01718 // 01719 // The PTE is in prototype PTE format. 01720 // 01721 01722 // 01723 // Is it a fork prototype PTE? 01724 // 01725 01726 Va = (PULONG)MiGetVirtualAddressMappedByPte (PointerPte); 01727 01728 if ((PteContents.u.Soft.PageFileHigh != MI_PTE_LOOKUP_NEEDED) && 01729 (MiPteToProto (PointerPte) != 01730 MiGetProtoPteAddress (FoundVad, 01731 MI_VA_TO_VPN ((PVOID)Va)))) { 01732 01733 // 01734 // This PTE refers to a fork prototype PTE, make the 01735 // page private. This is accomplished by releasing 01736 // the working set mutex, reading the page thereby 01737 // causing a fault, and re-executing the loop, hopefully, 01738 // this time, we'll find the page present and will 01739 // turn it into a private page. 01740 // 01741 // Note, that page with prototype = 1 cannot be 01742 // no-access. 01743 // 01744 01745 DoAgain = TRUE; 01746 01747 while (PteContents.u.Hard.Valid == 0) { 01748 01749 UNLOCK_WS_UNSAFE (Process); 01750 01751 try { 01752 01753 *(volatile ULONG *)Va; 01754 } except (EXCEPTION_EXECUTE_HANDLER) { 01755 01756 if (GetExceptionCode() != 01757 STATUS_GUARD_PAGE_VIOLATION) { 01758 01759 // 01760 // The prototype PTE must be noaccess. 01761 // 01762 01763 DoAgain = MiChangeNoAccessForkPte (PointerPte, 01764 ProtectionMask); 01765 } 01766 } 01767 01768 PointerPpe = MiGetPteAddress (PointerPde); 01769 01770 LOCK_WS_UNSAFE (Process); 01771 01772 do { 01773 01774 (VOID)MiDoesPpeExistAndMakeValid (PointerPpe, 01775 Process, 01776 FALSE, 01777 &Waited); 01778 01779 Waited = 0; 01780 01781 (VOID)MiDoesPdeExistAndMakeValid (PointerPde, 01782 Process, 01783 FALSE, 01784 &Waited); 01785 01786 } while (Waited != 0); 01787 01788 PteContents = *(volatile MMPTE *)PointerPte; 01789 } 01790 01791 if (DoAgain) { 01792 continue; 01793 } 01794 01795 } else { 01796 01797 // 01798 // If the new protection is not write-copy, the PTE 01799 // protection is not in the prototype PTE (can't be 01800 // write copy for sections), and the protection in 01801 // the PTE is write-copy, release the page file 01802 // quota and commitment for this page. 01803 // 01804 01805 if ((!WriteCopy) && 01806 (PteContents.u.Soft.PageFileHigh == MI_PTE_LOOKUP_NEEDED)) { 01807 if (MI_IS_PTE_PROTECTION_COPY_WRITE(PteContents.u.Soft.Protection)) { 01808 QuotaCharge += 1; 01809 } 01810 01811 } 01812 01813 // 01814 // The PTE is a prototype PTE. Make the high part 01815 // of the PTE indicate that the protection field 01816 // is in the PTE itself. 01817 // 01818 01819 MI_WRITE_INVALID_PTE (PointerPte, PrototypePte); 01820 PointerPte->u.Soft.Protection = ProtectionMask; 01821 } 01822 01823 } else { 01824 01825 if (PteContents.u.Soft.Transition == 1) { 01826 01827 // 01828 // This is a transition PTE. (Page is private) 01829 // 01830 01831 if (MiSetProtectionOnTransitionPte ( 01832 PointerPte, 01833 ProtectionMaskNotCopy)) { 01834 continue; 01835 } 01836 01837 } else { 01838 01839 // 01840 // Must be page file space or demand zero. 01841 // 01842 01843 PointerPte->u.Soft.Protection = ProtectionMaskNotCopy; 01844 } 01845 } 01846 } 01847 01848 PointerPte += 1; 01849 } 01850 01851 // 01852 // Return the quota charge and the commitment, if any. 01853 // 01854 01855 if ((QuotaCharge > 0) && (!DontCharge)) { 01856 01857 MiReturnCommitment (QuotaCharge); 01858 MM_TRACK_COMMIT (MM_DBG_COMMIT_RETURN_PROTECTION, QuotaCharge); 01859 MiReturnPageFileQuota (QuotaCharge, Process); 01860 01861 ASSERT (QuotaCharge <= FoundVad->u.VadFlags.CommitCharge); 01862 01863 FoundVad->u.VadFlags.CommitCharge -= QuotaCharge; 01864 if (Process->JobStatus & PS_JOB_STATUS_REPORT_COMMIT_CHANGES) { 01865 PsChangeJobMemoryUsage(-(SSIZE_T)QuotaCharge); 01866 } 01867 Process->CommitCharge -= QuotaCharge; 01868 } 01869 01870 return Locked; 01871 }

ULONG MiSetProtectionOnTransitionPte (  IN PMMPTE  PointerPte, IN ULONG  ProtectionMask )

Definition at line 2154 of file protect.c. References FALSE, LOCK_PFN, MI_PFN_ELEMENT, _MMPFN::OriginalPte, TRUE, _MMPTE::u, and UNLOCK_PFN. { KIRQL OldIrql; MMPTE PteContents; PMMPFN Pfn1; // // This is a transition PTE. (Page is private) // // // Need pfn mutex to ensure page doesn't become // non-transition. // LOCK_PFN (OldIrql); // // Make sure the page is still a transition page. // PteContents = *(volatile MMPTE *)PointerPte; if ((PteContents.u.Soft.Prototype == 0) && (PointerPte->u.Soft.Transition == 1)) { Pfn1 = MI_PFN_ELEMENT ( PteContents.u.Trans.PageFrameNumber); Pfn1->OriginalPte.u.Soft.Protection = ProtectionMask; PointerPte->u.Soft.Protection = ProtectionMask; UNLOCK_PFN (OldIrql); return FALSE; } // // Do this loop again for the same PTE. // UNLOCK_PFN (OldIrql); return TRUE; }

NTSTATUS NtProtectVirtualMemory (  IN HANDLE  ProcessHandle, IN OUT PVOID *  BaseAddress, IN OUT PSIZE_T  RegionSize, IN ULONG  NewProtect, OUT PULONG  OldProtect )

Definition at line 69 of file protect.c. References DbgPrint, EXCEPTION_EXECUTE_HANDLER, FALSE, KeAttachProcess(), KeDetachProcess(), KernelMode, KPROCESSOR_MODE, MiMakeProtectionMask(), MiProtectVirtualMemory(), MM_DBG_SHOW_NT_CALLS, NT_SUCCESS, NTSTATUS(), NULL, ObDereferenceObject, ObReferenceObjectByHandle(), PAGED_CODE, ProbeForWritePointer, ProbeForWriteUlong, ProbeForWriteUlong_ptr, PsGetCurrentProcess, PsProcessType, Status, and TRUE. Referenced by LdrpDphSnapImports(), LdrpSetProtection(), LdrpSnapIAT(), LdrpWalkImportDescriptor(), and main(). : This routine changes the protection on a region of committed pages within the virtual address space of the subject process. Setting the protection on a range of pages causes the old protection to be replaced by the specified protection value. Arguments: ProcessHandle - An open handle to a process object. BaseAddress - The base address of the region of pages whose protection is to be changed. This value is rounded down to the next host page address boundary. RegionSize - A pointer to a variable that will receive the actual size in bytes of the protected region of pages. The initial value of this argument is rounded up to the next host page size boundary. NewProtect - The new protection desired for the specified region of pages. Protect Values PAGE_NOACCESS - No access to the specified region of pages is allowed. An attempt to read, write, or execute the specified region results in an access violation (i.e. a GP fault). PAGE_EXECUTE - Execute access to the specified region of pages is allowed. An attempt to read or write the specified region results in an access violation. PAGE_READONLY - Read only and execute access to the specified region of pages is allowed. An attempt to write the specified region results in an access violation. PAGE_READWRITE - Read, write, and execute access to the specified region of pages is allowed. If write access to the underlying section is allowed, then a single copy of the pages are shared. Otherwise the pages are shared read only/copy on write. PAGE_GUARD - Read, write, and execute access to the specified region of pages is allowed, however, access to the region causes a "guard region entered" condition to be raised in the subject process. If write access to the underlying section is allowed, then a single copy of the pages are shared. Otherwise the pages are shared read only/copy on write. PAGE_NOCACHE - The page should be treated as uncached. This is only valid for non-shared pages. OldProtect - A pointer to a variable that will receive the old protection of the first page within the specified region of pages. Return Value: Returns the status TBS Environment: Kernel mode. --*/ { // // note - special treatment for the following cases... // // if a page is locked in the working set (memory?) and the // protection is changed to no access, the page should be // removed from the working set... valid pages can't be no access. // // if page is going to be read only or no access? and is demand // zero, make sure it is changed to a page of zeroes. // // update the vm spec to explain locked pages are unlocked when // freed or protection is changed to no-access (this may be a nasty // problem if we don't want to do this!! // PEPROCESS Process; KPROCESSOR_MODE PreviousMode; NTSTATUS Status; ULONG Attached = FALSE; PVOID CapturedBase; SIZE_T CapturedRegionSize; ULONG ProtectionMask; ULONG LastProtect; PAGED_CODE(); // // Check the protection field. This could raise an exception. // try { ProtectionMask = MiMakeProtectionMask (NewProtect); } except (EXCEPTION_EXECUTE_HANDLER) { return GetExceptionCode(); } PreviousMode = KeGetPreviousMode(); if (PreviousMode != KernelMode) { // // Capture the region size and base address under an exception handler. // try { ProbeForWritePointer (BaseAddress); ProbeForWriteUlong_ptr (RegionSize); ProbeForWriteUlong (OldProtect); // // Capture the region size and base address. // CapturedBase = *BaseAddress; CapturedRegionSize = *RegionSize; } except (EXCEPTION_EXECUTE_HANDLER) { // // If an exception occurs during the probe or capture // of the initial values, then handle the exception and // return the exception code as the status value. // return GetExceptionCode(); } } else { // // Capture the region size and base address. // CapturedRegionSize = *RegionSize; CapturedBase = *BaseAddress; } #if DBG if (MmDebug & MM_DBG_SHOW_NT_CALLS) { if ( !MmWatchProcess ) { DbgPrint("protectvm process handle %lx base address %lx size %lx protect %lx\n", ProcessHandle, CapturedBase, CapturedRegionSize, NewProtect); } } #endif // // Make sure the specified starting and ending addresses are // within the user part of the virtual address space. // if (CapturedBase > MM_HIGHEST_USER_ADDRESS) { // // Invalid base address. // return STATUS_INVALID_PARAMETER_2; } if ((ULONG_PTR)MM_HIGHEST_USER_ADDRESS - (ULONG_PTR)CapturedBase < CapturedRegionSize) { // // Invalid region size; // return STATUS_INVALID_PARAMETER_3; } if (CapturedRegionSize == 0) { return STATUS_INVALID_PARAMETER_3; } Status = ObReferenceObjectByHandle ( ProcessHandle, PROCESS_VM_OPERATION, PsProcessType, PreviousMode, (PVOID *)&Process, NULL ); if (!NT_SUCCESS(Status)) { return Status; } // // If the specified process is not the current process, attach // to the specified process. // if (PsGetCurrentProcess() != Process) { KeAttachProcess (&Process->Pcb); Attached = TRUE; } Status = MiProtectVirtualMemory (Process, &CapturedBase, &CapturedRegionSize, NewProtect, &LastProtect); if (Attached) { KeDetachProcess(); } ObDereferenceObject (Process); // // Establish an exception handler and write the size and base // address. // try { // // Reprobe the addresses as certain architectures (intel 386 for one) // do not trap kernel writes. This is the one service which allows // the protection of the page to change between the initial probe // and the final argument update. // if (PreviousMode != KernelMode) { ProbeForWritePointer (BaseAddress); ProbeForWriteUlong_ptr (RegionSize); ProbeForWriteUlong (OldProtect); } *RegionSize = CapturedRegionSize; *BaseAddress = CapturedBase; *OldProtect = LastProtect; } except (EXCEPTION_EXECUTE_HANDLER) { NOTHING; } return Status; }

---

Variable Documentation

CCHAR MmReadWrite[32]

Definition at line 57 of file protect.c. Referenced by MiAccessCheck(), and MiCheckSecuredVad().

---