pagfault.c File Reference

#include "mi.h"

Go to the source code of this file.

Defines
#define	STATUS_ISSUE_PAGING_IO   (0xC0033333)
#define	STATUS_PTE_CHANGED   0x87303000
#define	STATUS_REFAULT   0xC7303001
#define	MI_PROTOTYPE_WSINDEX   ((ULONG)-1)
#define	MMMAX_INPAGE_SUPPORT   4
Functions
VOID	MiHandleBankedSection (IN PVOID VirtualAddress, IN PMMVAD Vad)
NTSTATUS	MiCompleteProtoPteFault (IN BOOLEAN StoreInstruction, IN PVOID FaultingAddress, IN PMMPTE PointerPte, IN PMMPTE PointerProtoPte)
NTSTATUS	MiDispatchFault (IN BOOLEAN StoreInstruction, IN PVOID VirtualAddress, IN PMMPTE PointerPte, IN PMMPTE PointerProtoPte, IN PEPROCESS Process, OUT PLOGICAL ApcNeeded)
NTSTATUS	MiResolveDemandZeroFault (IN PVOID VirtualAddress, IN PMMPTE PointerPte, IN PEPROCESS Process, IN ULONG PrototypePte)
NTSTATUS	MiResolveTransitionFault (IN PVOID FaultingAddress, IN PMMPTE PointerPte, IN PEPROCESS CurrentProcess, IN ULONG PfnLockHeld, OUT PLOGICAL ApcNeeded)
NTSTATUS	MiResolvePageFileFault (IN PVOID FaultingAddress, IN PMMPTE PointerPte, OUT PMMINPAGE_SUPPORT *ReadBlock, IN PEPROCESS Process)
NTSTATUS	MiResolveProtoPteFault (IN BOOLEAN StoreInstruction, IN PVOID FaultingAddress, IN PMMPTE PointerPte, IN PMMPTE PointerProtoPte, OUT PMMINPAGE_SUPPORT *ReadBlock, IN PEPROCESS Process, OUT PLOGICAL ApcNeeded)
NTSTATUS	MiResolveMappedFileFault (IN PVOID FaultingAddress, IN PMMPTE PointerPte, OUT PMMINPAGE_SUPPORT *ReadBlock, IN PEPROCESS Process)
NTSTATUS	MiWaitForInPageComplete (IN PMMPFN Pfn2, IN PMMPTE PointerPte, IN PVOID FaultingAddress, IN PMMPTE PointerPteContents, IN PMMINPAGE_SUPPORT InPageSupport, IN PEPROCESS CurrentProcess)
PMMPTE	MiFindActualFaultingPte (IN PVOID FaultingAddress)
PMMPTE	MiCheckVirtualAddress (IN PVOID VirtualAddress, OUT PULONG ProtectCode)
NTSTATUS FASTCALL	MiCheckPdeForPagedPool (IN PVOID VirtualAddress)
NTSTATUS FASTCALL	MiCheckPdeForSessionSpace (IN PVOID VirtualAddress)
VOID	MiInitializePfn (IN PFN_NUMBER PageFrameIndex, IN PMMPTE PointerPte, IN ULONG ModifiedState)
VOID	MiInitializeReadInProgressPfn (IN PMDL Mdl, IN PMMPTE BasePte, IN PKEVENT Event, IN WSLE_NUMBER WorkingSetIndex)
VOID	MiInitializeTransitionPfn (IN PFN_NUMBER PageFrameIndex, IN PMMPTE PointerPte, IN WSLE_NUMBER WorkingSetIndex)
VOID	MiInitializeCopyOnWritePfn (IN PFN_NUMBER PageFrameIndex, IN PMMPTE PointerPte, IN WSLE_NUMBER WorkingSetIndex, IN PVOID SessionPointer)
BOOLEAN	MmIsAddressValid (IN PVOID VirtualAddress)
VOID	MiInitializePfnForOtherProcess (IN PFN_NUMBER PageFrameIndex, IN PMMPTE PointerPte, IN PFN_NUMBER ContainingPageFrame)
VOID	MiAddValidPageToWorkingSet (IN PVOID VirtualAddress, IN PMMPTE PointerPte, IN PMMPFN Pfn1, IN ULONG WsleMask)
PMMINPAGE_SUPPORT	MiGetInPageSupportBlock (VOID)
VOID	MiFreeInPageSupportBlock (IN PMMINPAGE_SUPPORT Support)
VOID	MiFlushInPageSupportBlock ()
NTSTATUS	MiSessionCopyOnWrite (IN PMM_SESSION_SPACE SessionSpace, IN PVOID FaultingAddress, IN PMMPTE PointerPte)
Variables
MMPTE	MmSharedUserDataPte
PVOID	MmSpecialPoolStart
PVOID	MmSpecialPoolEnd
MMINPAGE_SUPPORT_LIST	MmInPageSupportList

---

Define Documentation

#define MI_PROTOTYPE_WSINDEX   ((ULONG)-1)

Definition at line 43 of file pagfault.c. Referenced by MiInitializeReadInProgressPfn(), MiInitializeTransitionPfn(), MiResolveMappedFileFault(), and MiResolvePageFileFault().

#define MMMAX_INPAGE_SUPPORT   4

Referenced by MiFlushInPageSupportBlock().

#define STATUS_ISSUE_PAGING_IO   (0xC0033333)

Definition at line 34 of file pagfault.c. Referenced by MiDispatchFault(), MiResolveMappedFileFault(), and MiResolvePageFileFault().

#define STATUS_PTE_CHANGED   0x87303000

Definition at line 35 of file pagfault.c. Referenced by MiDispatchFault(), and MiWaitForInPageComplete().

#define STATUS_REFAULT   0xC7303001

Definition at line 36 of file pagfault.c. Referenced by MiDispatchFault(), MiResolveDemandZeroFault(), MiResolveMappedFileFault(), MiResolvePageFileFault(), MiResolveProtoPteFault(), MiResolveTransitionFault(), and MiWaitForInPageComplete().

---

Function Documentation

VOID MiAddValidPageToWorkingSet (  IN PVOID  VirtualAddress, IN PMMPTE  PointerPte, IN PMMPFN  Pfn1, IN ULONG  WsleMask )

Definition at line 4056 of file pagfault.c. References ASSERT, _MMWSLE::e1, FALSE, MI_IS_PAGE_TABLE_ADDRESS, MI_IS_PROCESS_SPACE_ADDRESS, MI_IS_SESSION_ADDRESS, MI_IS_SESSION_PTE, MI_IS_SYSTEM_CACHE_ADDRESS, MI_SET_PTE_IN_WORKING_SET, MiLocateAndReserveWsle(), MiUpdateWsle(), MmSessionSpace, MmSystemCacheWs, MmSystemCacheWsle, MmWsle, PERFINFO_ADDTOWS, PsGetCurrentProcess, _MMWSLENTRY::SameProtectAsProto, _MMWSLE::u1, _EPROCESS::UniqueProcessId, _EPROCESS::Vm, _MM_SESSION_SPACE::Vm, _MMSUPPORT::VmWorkingSetList, _MM_SESSION_SPACE::Wsle, and WSLE_NUMBER. Referenced by MiAllocatePoolPages(), MiCompleteProtoPteFault(), MiDispatchFault(), MiMakeSpecialPoolPagable(), MiResolveDemandZeroFault(), MiResolveTransitionFault(), and MiSessionCommitPageTables(). 04065 : 04066 04067 This routine adds the specified virtual address into the 04068 appropriate working set list. 04069 04070 Arguments: 04071 04072 VirtualAddress - Supplies the address to add to the working set list. 04073 04074 PointerPte - Supplies a pointer to the pte that is now valid. 04075 04076 Pfn1 - Supplies the PFN database element for the physical page 04077 mapped by the virtual address. 04078 04079 WsleMask - Supplies a mask (protection and flags) to OR into the 04080 working set list entry. 04081 04082 Return Value: 04083 04084 None. 04085 04086 Environment: 04087 04088 Kernel mode, APCs disabled, working set lock. PFN lock NOT held. 04089 04090 --*/ 04091 04092 { 04093 WSLE_NUMBER WorkingSetIndex; 04094 PEPROCESS Process; 04095 PMMSUPPORT WsInfo; 04096 PMMWSLE Wsle; 04097 04098 ASSERT (MI_IS_PAGE_TABLE_ADDRESS(PointerPte)); 04099 ASSERT (PointerPte->u.Hard.Valid == 1); 04100 04101 if (MI_IS_SESSION_ADDRESS (VirtualAddress) || MI_IS_SESSION_PTE (VirtualAddress)) { 04102 // 04103 // Current process's session space working set. 04104 // 04105 04106 WsInfo = &MmSessionSpace->Vm; 04107 Wsle = MmSessionSpace->Wsle; 04108 } 04109 else if (MI_IS_PROCESS_SPACE_ADDRESS(VirtualAddress)) { 04110 04111 // 04112 // Per process working set. 04113 // 04114 04115 Process = PsGetCurrentProcess(); 04116 WsInfo = &Process->Vm; 04117 Wsle = MmWsle; 04118 04119 PERFINFO_ADDTOWS(Pfn1, VirtualAddress, Process->UniqueProcessId) 04120 } else { 04121 04122 // 04123 // System cache working set. 04124 // 04125 04126 WsInfo = &MmSystemCacheWs; 04127 Wsle = MmSystemCacheWsle; 04128 04129 PERFINFO_ADDTOWS(Pfn1, VirtualAddress, (HANDLE) -1); 04130 } 04131 04132 WorkingSetIndex = MiLocateAndReserveWsle (WsInfo); 04133 MiUpdateWsle (&WorkingSetIndex, 04134 VirtualAddress, 04135 WsInfo->VmWorkingSetList, 04136 Pfn1); 04137 Wsle[WorkingSetIndex].u1.Long |= WsleMask; 04138 04139 #if DBG 04140 if (MI_IS_SYSTEM_CACHE_ADDRESS(VirtualAddress)) { 04141 ASSERT (MmSystemCacheWsle[WorkingSetIndex].u1.e1.SameProtectAsProto); 04142 } 04143 #endif //DBG 04144 04145 MI_SET_PTE_IN_WORKING_SET (PointerPte, WorkingSetIndex); 04146 04147 KeFillEntryTb ((PHARDWARE_PTE)PointerPte, VirtualAddress, FALSE); 04148 return; 04149 }

NTSTATUS FASTCALL MiCheckPdeForPagedPool (  IN PVOID  VirtualAddress  )

Definition at line 3125 of file pagfault.c. References FALSE, MI_IS_KERNEL_PAGE_TABLE_ADDRESS, MI_IS_SESSION_ADDRESS, MI_IS_SESSION_PTE, MI_WRITE_VALID_PTE, MiCheckPdeForSessionSpace(), MiGetPdeAddress, MiGetPteAddress, MiGetVirtualAddressMappedByPte, MiHydra, MMPTE, MmSystemPagePtes, MmSystemRangeStart, NTSTATUS(), PDE_PER_PAGE, TRUE, and _MMPTE::u. Referenced by MiCheckProtoPtePageState(), MiCloneProcessAddressSpace(), MiDeletePte(), MiDeleteSystemPagableVm(), MiEliminateWorkingSetEntry(), MiHandleForkTransitionPte(), MiInitializeCopyOnWritePfn(), MiInitializePfn(), MiInitializeReadInProgressPfn(), MiInitializeTransitionPfn(), and MmAccessFault(). : This function copies the Page Table Entry for the corresponding virtual address from the system process's page directory. This allows page table pages to be lazily evaluated for things like paged pool and per-session mappings. Arguments: VirtualAddress - Supplies the virtual address in question. Return Value: Either success or access violation. Environment: Kernel mode, DISPATCH level or below. --*/ { PMMPTE PointerPde; PMMPTE PointerPte; NTSTATUS status; if (MiHydra == TRUE) { if (MI_IS_SESSION_ADDRESS (VirtualAddress) == TRUE) { // // Virtual address in the session space range. // return MiCheckPdeForSessionSpace (VirtualAddress); } if (MI_IS_SESSION_PTE (VirtualAddress) == TRUE) { // // PTE for the session space range. // return MiCheckPdeForSessionSpace (VirtualAddress); } } status = STATUS_SUCCESS; if (MI_IS_KERNEL_PAGE_TABLE_ADDRESS(VirtualAddress)) { // // PTE for paged pool. // PointerPde = MiGetPteAddress (VirtualAddress); status = STATUS_WAIT_1; } else if (VirtualAddress < MmSystemRangeStart) { return STATUS_ACCESS_VIOLATION; } else { // // Virtual address in paged pool range. // PointerPde = MiGetPdeAddress (VirtualAddress); } // // Locate the PDE for this page and make it valid. // if (PointerPde->u.Hard.Valid == 0) { PointerPte = MiGetVirtualAddressMappedByPte (PointerPde); #if !defined (_X86PAE_) MI_WRITE_VALID_PTE (PointerPde, MmSystemPagePtes [((ULONG_PTR)PointerPde & ((sizeof(MMPTE) * PDE_PER_PAGE) - 1)) / sizeof(MMPTE)]); #else MI_WRITE_VALID_PTE (PointerPde, MmSystemPagePtes [((ULONG_PTR)PointerPde & (PD_PER_SYSTEM * (sizeof(MMPTE) * PDE_PER_PAGE) - 1)) / sizeof(MMPTE)]); #endif KeFillEntryTb ((PHARDWARE_PTE)PointerPde, PointerPte, FALSE); } return status; }

NTSTATUS FASTCALL MiCheckPdeForSessionSpace (  IN PVOID  VirtualAddress  )

Definition at line 3224 of file pagfault.c. References ASSERT, DbgPrint, FALSE, Index, MI_IS_SESSION_ADDRESS, MI_IS_SESSION_PTE, MiGetPdeAddress, MiGetPdeSessionIndex, MiGetPteAddress, MiGetVirtualAddressMappedByPte, MiHydra, MmSessionSpace, _MM_SESSION_SPACE::PageTables, TRUE, and _MMPTE::u. Referenced by MiCheckPdeForPagedPool(), and MmAccessFault(). 03230 : 03231 03232 This function copies the Page Table Entry for the corresponding 03233 session virtual address from the current session's data structures. 03234 03235 This allows page table pages to be lazily evaluated for session mappings. 03236 The caller must check for the current process having a session space. 03237 03238 Arguments: 03239 03240 VirtualAddress - Supplies the virtual address in question. 03241 03242 Return Value: 03243 03244 STATUS_WAIT_1 - The mapping has been made valid, retry the fault. 03245 03246 STATUS_SUCCESS - Did not handle the fault, continue further processing. 03247 03248 !STATUS_SUCCESS - An access violation has occurred - raise an exception. 03249 03250 Environment: 03251 03252 Kernel mode, DISPATCH level or below. 03253 03254 --*/ 03255 03256 { 03257 PMMPTE PointerPde; 03258 PVOID SessionVirtualAddress; 03259 ULONG Index; 03260 03261 // 03262 // Caller should have checked for this. 03263 // 03264 03265 ASSERT (MiHydra == TRUE); 03266 03267 // 03268 // First check whether the reference was to a page table page which maps 03269 // session space. If so, the PDE is retrieved from the session space 03270 // data structure and made valid. 03271 // 03272 03273 if (MI_IS_SESSION_PTE (VirtualAddress) == TRUE) { 03274 03275 // 03276 // Verify that the current process has a session space. 03277 // 03278 03279 PointerPde = MiGetPdeAddress (MmSessionSpace); 03280 03281 if (PointerPde->u.Hard.Valid == 0) { 03282 03283 #if DBG 03284 DbgPrint("MiCheckPdeForSessionSpace: No current session for PTE %p\n", 03285 VirtualAddress); 03286 03287 DbgBreakPoint(); 03288 #endif 03289 return STATUS_ACCESS_VIOLATION; 03290 } 03291 03292 SessionVirtualAddress = MiGetVirtualAddressMappedByPte ((PMMPTE) VirtualAddress); 03293 03294 PointerPde = MiGetPteAddress (VirtualAddress); 03295 03296 if (PointerPde->u.Hard.Valid == 1) { 03297 03298 // 03299 // The PDE is already valid - another thread must have 03300 // won the race. Just return. 03301 // 03302 03303 return STATUS_WAIT_1; 03304 } 03305 03306 // 03307 // Calculate the session space PDE index and load the 03308 // PDE from the session space table for this session. 03309 // 03310 03311 Index = MiGetPdeSessionIndex (SessionVirtualAddress); 03312 03313 PointerPde->u.Long = MmSessionSpace->PageTables[Index].u.Long; 03314 03315 if (PointerPde->u.Hard.Valid == 1) { 03316 KeFillEntryTb ((PHARDWARE_PTE)PointerPde, VirtualAddress, FALSE); 03317 return STATUS_WAIT_1; 03318 } 03319 03320 #if DBG 03321 DbgPrint("MiCheckPdeForSessionSpace: No Session PDE for PTE %p, %p\n", 03322 PointerPde->u.Long, SessionVirtualAddress); 03323 03324 DbgBreakPoint(); 03325 #endif 03326 return STATUS_ACCESS_VIOLATION; 03327 } 03328 03329 if (MI_IS_SESSION_ADDRESS (VirtualAddress) == FALSE) { 03330 03331 // 03332 // Not a session space fault - tell the caller to try other handlers. 03333 // 03334 03335 return STATUS_SUCCESS; 03336 } 03337 03338 // 03339 // Handle PDE faults for references in the session space. 03340 // Verify that the current process has a session space. 03341 // 03342 03343 PointerPde = MiGetPdeAddress (MmSessionSpace); 03344 03345 if (PointerPde->u.Hard.Valid == 0) { 03346 03347 #if DBG 03348 DbgPrint("MiCheckPdeForSessionSpace: No current session for VA %p\n", 03349 VirtualAddress); 03350 03351 DbgBreakPoint(); 03352 #endif 03353 return STATUS_ACCESS_VIOLATION; 03354 } 03355 03356 PointerPde = MiGetPdeAddress (VirtualAddress); 03357 03358 if (PointerPde->u.Hard.Valid == 0) { 03359 03360 // 03361 // Calculate the session space PDE index and load the 03362 // PDE from the session space table for this session. 03363 // 03364 03365 Index = MiGetPdeSessionIndex (VirtualAddress); 03366 03367 PointerPde->u.Long = MmSessionSpace->PageTables[Index].u.Long; 03368 03369 if (PointerPde->u.Hard.Valid == 1) { 03370 03371 KeFillEntryTb ((PHARDWARE_PTE)PointerPde, 03372 MiGetPteAddress(VirtualAddress), 03373 FALSE); 03374 03375 return STATUS_WAIT_1; 03376 } 03377 03378 #if DBG 03379 DbgPrint("MiCheckPdeForSessionSpace: No Session PDE for VA %p, %p\n", 03380 PointerPde->u.Long, VirtualAddress); 03381 03382 DbgBreakPoint(); 03383 #endif 03384 03385 return STATUS_ACCESS_VIOLATION; 03386 } 03387 03388 // 03389 // Tell the caller to continue with other fault handlers. 03390 // 03391 03392 return STATUS_SUCCESS; 03393 } #endif

PMMPTE MiCheckVirtualAddress (  IN PVOID  VirtualAddress, OUT PULONG  ProtectCode )

Definition at line 2880 of file pagfault.c. References _IMAGE_ENTRY_IN_SESSION::Address, ASSERT, DISPATCH_LEVEL, _MMVAD::FirstPrototypePte, _MM_SESSION_SPACE::ImageList, KeFlushEntireTb(), KeLowerIrql(), KeRaiseIrql(), _IMAGE_ENTRY_IN_SESSION::LastAddress, MI_GET_PROTECTION_FROM_VAD, MI_IS_PAGE_TABLE_ADDRESS, MI_IS_SESSION_ADDRESS, MI_VA_TO_VPN, MiGetProtoPteAddress, MiGetPteAddress, MiHandleBankedSection(), MiLocateAddress(), MM_EXECUTE_WRITECOPY, MM_LARGE_PAGES, MM_NOACCESS, MM_PAGED_POOL_START, MM_READONLY, MM_READWRITE, MM_SESSION_SPACE_WS_LOCK_ASSERT, MM_UNKNOWN_PROTECTION, MmPagedPoolInfo, MmSessionSpace, MmSharedUserDataPte, NULL, PAGE_ALIGN, PAGE_SHIFT, _IMAGE_ENTRY_IN_SESSION::PrototypePtes, _MMVAD::StartingVpn, TRUE, _MMPTE::u, _SUBSECTION::u, _MMVAD::u, _MMVAD::u2, _MMVAD::u4, and ZeroPte. Referenced by MiFindActualFaultingPte(), MiWaitForInPageComplete(), and MmAccessFault(). : This function examines the virtual address descriptors to see if the specified virtual address is contained within any of the descriptors. If a virtual address descriptor is found which contains the specified virtual address, a PTE is built from information within the virtual address descriptor and returned to the caller. Arguments: VirtualAddress - Supplies the virtual address to locate within a virtual address descriptor. Return Value: Returns the PTE which corresponds to the supplied virtual address. If no virtual address descriptor is found, a zero pte is returned. Environment: Kernel mode, APCs disabled, working set mutex held. --*/ { PMMVAD Vad; PMMPTE PointerPte; PLIST_ENTRY NextEntry; PIMAGE_ENTRY_IN_SESSION Image; if (VirtualAddress <= MM_HIGHEST_USER_ADDRESS) { #if defined(MM_SHARED_USER_DATA_VA) if (PAGE_ALIGN(VirtualAddress) == (PVOID) MM_SHARED_USER_DATA_VA) { // // This is the page that is double mapped between // user mode and kernel mode. Map in as read only. // On MIPS this is hardwired in the TB. // *ProtectCode = MM_READONLY; return &MmSharedUserDataPte; } #endif Vad = MiLocateAddress (VirtualAddress); if (Vad == (PMMVAD)NULL) { *ProtectCode = MM_NOACCESS; return NULL; } // // A virtual address descriptor which contains the virtual address // has been located. Build the PTE from the information within // the virtual address descriptor. // #ifdef LARGE_PAGES if (Vad->u.VadFlags.LargePages == 1) { KIRQL OldIrql; PSUBSECTION Subsection; // // The first prototype PTE points to the subsection for the // large page mapping. Subsection = (PSUBSECTION)Vad->FirstPrototypePte; ASSERT (Subsection->u.SubsectionFlags.LargePages == 1); KeRaiseIrql (DISPATCH_LEVEL, &OldIrql); KeFlushEntireTb (TRUE, TRUE); KeFillLargeEntryTb ((PHARDWARE_PTE)(Subsection + 1), VirtualAddress, Subsection->StartingSector); KeLowerIrql (OldIrql); *ProtectCode = MM_LARGE_PAGES; return NULL; } #endif //LARGE_PAGES if (Vad->u.VadFlags.PhysicalMapping == 1) { // // This is a banked section. // MiHandleBankedSection (VirtualAddress, Vad); *ProtectCode = MM_NOACCESS; return NULL; } if (Vad->u.VadFlags.PrivateMemory == 1) { // // This is a private region of memory. Check to make // sure the virtual address has been committed. Note that // addresses are dense from the bottom up. // if (Vad->u.VadFlags.UserPhysicalPages == 1) { // // These mappings only fault if the access is bad. // ASSERT (MiGetPteAddress(VirtualAddress)->u.Long == ZeroPte.u.Long); *ProtectCode = MM_NOACCESS; return NULL; } if (Vad->u.VadFlags.MemCommit == 1) { *ProtectCode = MI_GET_PROTECTION_FROM_VAD(Vad); return NULL; } // // The address is reserved but not committed. // *ProtectCode = MM_NOACCESS; return NULL; } else { // // This virtual address descriptor refers to a // section, calculate the address of the prototype PTE // and construct a pointer to the PTE. // //******************************************************* //******************************************************* // well here's an interesting problem, how do we know // how to set the attributes on the PTE we are creating // when we can't look at the prototype PTE without // potentially incurring a page fault. In this case // PteTemplate would be zero. //******************************************************* //******************************************************* // if (Vad->u.VadFlags.ImageMap == 1) { // // PTE and proto PTEs have the same protection for images. // *ProtectCode = MM_UNKNOWN_PROTECTION; } else { *ProtectCode = MI_GET_PROTECTION_FROM_VAD(Vad); } PointerPte = (PMMPTE)MiGetProtoPteAddress(Vad, MI_VA_TO_VPN (VirtualAddress)); if (PointerPte == NULL) { *ProtectCode = MM_NOACCESS; } if (Vad->u2.VadFlags2.ExtendableFile) { // // Make sure the data has been committed. // if ((MI_VA_TO_VPN (VirtualAddress) - Vad->StartingVpn) > (ULONG_PTR)((Vad->u4.ExtendedInfo->CommittedSize - 1) >> PAGE_SHIFT)) { *ProtectCode = MM_NOACCESS; } } return PointerPte; } } else if (MI_IS_PAGE_TABLE_ADDRESS(VirtualAddress)) { // // The virtual address is within the space occupied by PDEs, // make the PDE valid. // if (((PMMPTE)VirtualAddress >= MiGetPteAddress (MM_PAGED_POOL_START)) && ((PMMPTE)VirtualAddress <= MmPagedPoolInfo.LastPteForPagedPool)) { *ProtectCode = MM_NOACCESS; return NULL; } *ProtectCode = MM_READWRITE; return NULL; } else if (MI_IS_SESSION_ADDRESS (VirtualAddress) == TRUE) { // // See if the session space address is copy on write. // MM_SESSION_SPACE_WS_LOCK_ASSERT (); PointerPte = NULL; *ProtectCode = MM_NOACCESS; NextEntry = MmSessionSpace->ImageList.Flink; while (NextEntry != &MmSessionSpace->ImageList) { Image = CONTAINING_RECORD(NextEntry, IMAGE_ENTRY_IN_SESSION, Link); if ((VirtualAddress >= Image->Address) && (VirtualAddress <= Image->LastAddress)) { PointerPte = Image->PrototypePtes + (((PCHAR)VirtualAddress - (PCHAR)Image->Address) >> PAGE_SHIFT); *ProtectCode = MM_EXECUTE_WRITECOPY; break; } NextEntry = NextEntry->Flink; } return PointerPte; } // // Address is in system space. // *ProtectCode = MM_NOACCESS; return NULL; }

NTSTATUS MiCompleteProtoPteFault (  IN BOOLEAN  StoreInstruction, IN PVOID  FaultingAddress, IN PMMPTE  PointerPte, IN PMMPTE  PointerProtoPte )

Definition at line 1762 of file pagfault.c. References APC_LEVEL, ASSERT, _SUBSECTION::ControlArea, DbgPrint, FALSE, _FILE_OBJECT::FileName, _CONTROL_AREA::FilePointer, MI_GET_PAGE_FRAME_FROM_PTE, MI_GET_PROTECTION_FROM_SOFT_PTE, MI_IS_SESSION_IMAGE_ADDRESS, MI_MAKE_VALID_PTE, MI_PFN_ELEMENT, MI_PTE_LOOKUP_NEEDED, MI_SET_PTE_DIRTY, MI_STARTING_OFFSET, MI_WRITE_VALID_PTE, MiAddValidPageToWorkingSet(), MiGetPteAddress, MiGetSubsectionAddress, MiGetVirtualAddressMappedByPte, MiHydra, MiReleasePageFileSpace(), MM_PFN_LOCK_ASSERT, MM_PROTECTION_WRITE_MASK, NULL, _MMPFN::OriginalPte, PERFINFO_SOFTFAULT, PsGetCurrentProcess, PsGetCurrentThread, TRUE, _CONTROL_AREA::u, _MMPTE::u, _MMPFN::u1, _MMWSLE::u1, _MMPFN::u2, _MMPFN::u3, and UNLOCK_PFN. Referenced by MiDispatchFault(), and MiResolveProtoPteFault(). : This routine completes a prototype PTE fault. It is invoked after a read operation has completed bringing the data into memory. Arguments: StoreInstruction - Supplies TRUE if the instruction is trying to modify the faulting address (i.e. write access required). FaultingAddress - Supplies the faulting address. PointerPte - Supplies the PTE for the faulting address. PointerProtoPte - Supplies a pointer to the prototype PTE to fault in, NULL if no prototype PTE exists. Return Value: status. Environment: Kernel mode, PFN lock held. --*/ { MMPTE TempPte; MMWSLE ProtoProtect; PFN_NUMBER PageFrameIndex; PMMPFN Pfn1; PMMPFN Pfn2; PMMPTE ContainingPageTablePointer; #if defined(_PREFETCH_) PFILE_OBJECT FileObject; LONGLONG FileOffset; PSUBSECTION Subsection; #endif MM_PFN_LOCK_ASSERT(); PageFrameIndex = MI_GET_PAGE_FRAME_FROM_PTE (PointerProtoPte); Pfn1 = MI_PFN_ELEMENT(PageFrameIndex); Pfn1->u3.e1.PrototypePte = 1; #if defined(_PREFETCH_) // // Capture prefetch fault information. // FileObject = NULL; if (CCPF_IS_PREFETCHER_ACTIVE()) { if (FaultingAddress < MM_HIGHEST_USER_ADDRESS) { TempPte = Pfn1->OriginalPte; if (TempPte.u.Soft.Prototype == 1) { Subsection = MiGetSubsectionAddress (&TempPte); if (Subsection->ControlArea->u.Flags.Image) { FileObject = Subsection->ControlArea->FilePointer; ASSERT (FileObject->FileName.Length > 0); FileOffset = MI_STARTING_OFFSET (Subsection, PointerProtoPte); } } } } #endif // // Prototype PTE is now valid, make the PTE valid. // ASSERT (PointerProtoPte->u.Hard.Valid == 1); // // A PTE just went from not present, not transition to // present. The share count and valid count must be // updated in the page table page which contains this // PTE. // ContainingPageTablePointer = MiGetPteAddress(PointerPte); Pfn2 = MI_PFN_ELEMENT(ContainingPageTablePointer->u.Hard.PageFrameNumber); Pfn2->u2.ShareCount += 1; ProtoProtect.u1.Long = 0; if (PointerPte->u.Soft.PageFileHigh == MI_PTE_LOOKUP_NEEDED) { // // The protection code for the prototype PTE comes from this // PTE. // ProtoProtect.u1.e1.Protection = MI_GET_PROTECTION_FROM_SOFT_PTE(PointerPte); } else { // // Take the protection from the prototype PTE. // ProtoProtect.u1.e1.Protection = MI_GET_PROTECTION_FROM_SOFT_PTE(&Pfn1->OriginalPte); ProtoProtect.u1.e1.SameProtectAsProto = 1; if (StoreInstruction == TRUE && (ProtoProtect.u1.e1.Protection & MM_PROTECTION_WRITE_MASK) == 0) { // // This is the errant case where the user is trying to write // to a readonly subsection in the image. Since we're more than // halfway through the fault, take the easy way to clean this up - // treat the access as a read for the rest of this trip through // the fault. We'll then immediately refault when the instruction // is rerun (because it's really a write), and then we'll notice // that the user's PTE is not copy-on-write (or even writable!) // and return a clean access violation. // #if DBG DbgPrint("MM: user tried to write to a readonly subsection in the image! %p %p %p\n", FaultingAddress, PointerPte, PointerProtoPte); #endif StoreInstruction = FALSE; } } MI_MAKE_VALID_PTE (TempPte, PageFrameIndex, ProtoProtect.u1.e1.Protection, PointerPte); // // If this is a store instruction and the page is not copy on // write, then set the modified bit in the PFN database and // the dirty bit in the PTE. The PTE is not set dirty even // if the modified bit is set so writes to the page can be // tracked for FlushVirtualMemory. // if ((StoreInstruction) && (TempPte.u.Hard.CopyOnWrite == 0)) { #if DBG if (MiHydra == TRUE) { PVOID Va; Va = MiGetVirtualAddressMappedByPte (PointerPte); // // Session space backed by the filesystem should not be writable. // ASSERT (!MI_IS_SESSION_IMAGE_ADDRESS (Va)); } #endif Pfn1->u3.e1.Modified = 1; MI_SET_PTE_DIRTY (TempPte); if ((Pfn1->OriginalPte.u.Soft.Prototype == 0) && (Pfn1->u3.e1.WriteInProgress == 0)) { MiReleasePageFileSpace (Pfn1->OriginalPte); Pfn1->OriginalPte.u.Soft.PageFileHigh = 0; } } MI_WRITE_VALID_PTE (PointerPte, TempPte); if (Pfn1->u1.Event == NULL) { Pfn1->u1.Event = (PVOID)PsGetCurrentThread(); } UNLOCK_PFN (APC_LEVEL); PERFINFO_SOFTFAULT(Pfn1, FaultingAddress, PERFINFO_LOG_TYPE_PROTOPTEFAULT); MiAddValidPageToWorkingSet (FaultingAddress, PointerPte, Pfn1, (ULONG) ProtoProtect.u1.Long); #if defined(_PREFETCH_) // // Log prefetch fault information now that thw PFN lock has been released // and the PTE has been made valid. This minimizes PFN lock contention, // allows CcPfLogPageFault to allocate (and fault on) pool, and allows other // threads in this process to execute without faulting on this address. // // Note that the process' working set mutex is still held so any other // faults or operations on user addresses by other threads in this process // will block for the duration of this call. // if (FileObject != NULL) { CcPfLogPageFault (FileObject, FileOffset, PsGetCurrentProcess()); } #endif ASSERT (PointerPte == MiGetPteAddress(FaultingAddress)); return STATUS_SUCCESS; }

NTSTATUS MiDispatchFault (  IN BOOLEAN  StoreInstruction, IN PVOID  VirtualAddress, IN PMMPTE  PointerPte, IN PMMPTE  PointerProtoPte, IN PEPROCESS  Process, OUT PLOGICAL  ApcNeeded )

Definition at line 68 of file pagfault.c. References ActiveAndValid, APC_LEVEL, _ETHREAD::ApcNeeded, ASSERT, _MMINPAGE_SUPPORT::BasePte, _MDL::ByteCount, DbgPrint, _MMINPAGE_SUPPORT::Event, FALSE, _FILE_OBJECT::FileName, _MMINPAGE_SUPPORT::FilePointer, FreePageList, HYDRA_PROCESS, IoPageRead(), _MMINPAGE_SUPPORT::IoStatus, KeDelayExecutionThread(), KeEnterCriticalRegion, KeLeaveCriticalRegion, KernelMode, KeSetEvent(), LOCK_PFN, LOCK_SESSION_SPACE_WS, LOCK_SYSTEM_WS, _MMINPAGE_SUPPORT::Mdl, MI_IS_PHYSICAL_ADDRESS, MI_IS_SESSION_ADDRESS, MI_MAGIC_AWE_PTEFRAME, MI_MAKE_TRANSITION_PTE_VALID, MI_PFN_ELEMENT, MI_REMOVE_LOCKED_PAGE_CHARGE, MI_SET_PTE_DIRTY, MI_WRITE_VALID_PTE, MiAddValidPageToWorkingSet(), MiCompleteProtoPteFault(), MiDecrementReferenceCount(), MiFlushInPageSupportBlock(), MiGetPdeAddress, MiGetPteAddress, MiHydra, MiInsertPageInList(), MiResolveDemandZeroFault(), MiResolvePageFileFault(), MiResolveProtoPteFault(), MiResolveTransitionFault(), MiRestoreTransitionPte(), MiUnlinkPageFromList(), MiWaitForInPageComplete(), MM_DBG_PAGEFAULT, MmHardFaultNotifyRoutine, MmIsRetryIoStatus, MmPageLocationList, MmShortTime, _ETHREAD::NestedFaultCount, NT_SUCCESS, NTSTATUS(), NULL, _MMINPAGE_SUPPORT::Page, PAGE_SIZE, PERFINFO_DISPATCHFAULT_DECL, PERFINFO_HARDFAULT, PERFINFO_HARDFAULT_INFO, PERFINFO_HARDFAULT_IOTIME, _MMINPAGE_SUPPORT::Pfn, PHARD_FAULT_NOTIFY_ROUTINE, PsGetCurrentThread, _MMPFN::PteFrame, _MMINPAGE_SUPPORT::ReadOffset, StandbyPageList, STATUS_ISSUE_PAGING_IO, STATUS_PTE_CHANGED, STATUS_REFAULT, TRUE, _MMPTE::u, _MMPFN::u1, _MMPFN::u2, _MMPFN::u3, UNLOCK_PFN, UNLOCK_SESSION_SPACE_WS, UNLOCK_SYSTEM_WS, and UNLOCK_WS. Referenced by MmAccessFault(). : This routine dispatches a page fault to the appropriate routine to complete the fault. Arguments: StoreInstruction - Supplies TRUE if the instruction is trying to modify the faulting address (i.e. write access required). VirtualAddress - Supplies the faulting address. PointerPte - Supplies the PTE for the faulting address. PointerProtoPte - Supplies a pointer to the prototype PTE to fault in, NULL if no prototype PTE exists. Process - Supplies a pointer to the process object. If this parameter is NULL, then the fault is for system space and the process's working set lock is not held. If this parameter is HYDRA_PROCESS, then the fault is for session space and the process's working set lock is not held - rather the session space's working set lock is held. ApcNeeded - Supplies a pointer to a location set to TRUE if an I/O completion APC is needed to complete partial IRPs that collided. It is the caller's responsibility to initialize this (usually to FALSE) on entry. However, since this routine may be called multiple times for a single fault (for the page directory, page table and the page itself), it is possible for it to occasionally be TRUE on entry. If it is FALSE on exit, no completion APC is needed. Return Value: status. Environment: Kernel mode, working set lock held. --*/ { MMPTE TempPte; NTSTATUS status; PMMINPAGE_SUPPORT ReadBlock; MMPTE SavedPte; PMMINPAGE_SUPPORT CapturedEvent; KIRQL OldIrql; PPFN_NUMBER Page; PFN_NUMBER PageFrameIndex; LONG NumberOfBytes; PMMPTE CheckPte; PMMPTE ReadPte; PMMPFN PfnClusterPage; PMMPFN Pfn1; PHARD_FAULT_NOTIFY_ROUTINE NotifyRoutine; KIRQL PreviousIrql; LOGICAL WsLockChanged; PETHREAD CurrentThread; PERFINFO_DISPATCHFAULT_DECL(); WsLockChanged = FALSE; ProtoPteNotResident: if (PointerProtoPte != NULL) { // // Acquire the PFN lock to synchronize access to prototype PTEs. // This is required as the working set lock will not prevent // multiple processes from operating on the same prototype PTE. // LOCK_PFN (OldIrql); // // Make sure the protoptes are in memory. For // user mode faults, this should already be the case. // if (!MI_IS_PHYSICAL_ADDRESS(PointerProtoPte)) { CheckPte = MiGetPteAddress (PointerProtoPte); if (CheckPte->u.Hard.Valid == 0) { ASSERT (Process == NULL || (MiHydra == TRUE && Process == HYDRA_PROCESS)); // // The page that contains the prototype PTE is not in memory. // VirtualAddress = PointerProtoPte; PointerPte = CheckPte; PointerProtoPte = NULL; UNLOCK_PFN (OldIrql); if (Process == HYDRA_PROCESS) { // // We were called while holding this session space's // working set lock. But we need to fault in a // prototype PTE which is in system paged pool. This // must be done under the system working set lock. // // So we release the session space WSL lock and get // the system working set lock. When done // we return STATUS_MORE_PROCESSING_REQUIRED // so our caller will call us again to handle the // actual prototype PTE fault. // ASSERT (MiHydra == TRUE); UNLOCK_SESSION_SPACE_WS (APC_LEVEL); // // Lock the system working set for paged pool // LOCK_SYSTEM_WS (PreviousIrql); // // System working set is locked so set Process to show it. // Process = NULL; WsLockChanged = TRUE; ASSERT (MI_IS_SESSION_ADDRESS (VirtualAddress) == FALSE); } else { ASSERT (Process == NULL); } goto ProtoPteNotResident; } } if (PointerPte->u.Hard.Valid == 1) { // // PTE was already made valid by the cache manager support // routines. // UNLOCK_PFN (OldIrql); if (WsLockChanged == TRUE) { UNLOCK_SYSTEM_WS (APC_LEVEL); LOCK_SESSION_SPACE_WS (PreviousIrql); } return STATUS_SUCCESS; } ReadPte = PointerProtoPte; PERFINFO_HARDFAULT_INFO(PointerProtoPte); status = MiResolveProtoPteFault (StoreInstruction, VirtualAddress, PointerPte, PointerProtoPte, &ReadBlock, Process, ApcNeeded); // // Returns with PFN lock released. // ASSERT (KeGetCurrentIrql() == APC_LEVEL); } else { TempPte = *PointerPte; ASSERT (TempPte.u.Long != 0); if (TempPte.u.Soft.Transition != 0) { // // This is a transition page. // status = MiResolveTransitionFault (VirtualAddress, PointerPte, Process, FALSE, ApcNeeded); } else if (TempPte.u.Soft.PageFileHigh == 0) { // // Demand zero fault. // status = MiResolveDemandZeroFault (VirtualAddress, PointerPte, Process, FALSE); } else { // // Page resides in paging file. // ReadPte = PointerPte; LOCK_PFN (OldIrql); status = MiResolvePageFileFault (VirtualAddress, PointerPte, &ReadBlock, Process); } } ASSERT (KeGetCurrentIrql() == APC_LEVEL); if (NT_SUCCESS(status)) { if (WsLockChanged == TRUE) { UNLOCK_SYSTEM_WS (APC_LEVEL); LOCK_SESSION_SPACE_WS (OldIrql); } return status; } if (status == STATUS_ISSUE_PAGING_IO) { SavedPte = *ReadPte; CapturedEvent = (PMMINPAGE_SUPPORT)ReadBlock->Pfn->u1.Event; CurrentThread = NULL; if (Process == HYDRA_PROCESS) { UNLOCK_SESSION_SPACE_WS(APC_LEVEL); } else if (Process != NULL) { // // APCs must be explicitly disabled to prevent suspend APCs from // interrupting this thread before the I/O has been issued. // Otherwise a shared page I/O can stop any other thread that // references it indefinitely until the suspend is released. // CurrentThread = PsGetCurrentThread(); ASSERT (CurrentThread->NestedFaultCount <= 2); CurrentThread->NestedFaultCount += 1; KeEnterCriticalRegion(); UNLOCK_WS (Process); } else { UNLOCK_SYSTEM_WS(APC_LEVEL); } #if DBG if (MmDebug & MM_DBG_PAGEFAULT) { DbgPrint ("MMFAULT: va: %p size: %lx process: %s file: %Z\n", VirtualAddress, ReadBlock->Mdl.ByteCount, Process == HYDRA_PROCESS ? (PUCHAR)"Session Space" : (Process ? Process->ImageFileName : (PUCHAR)"SystemVa"), &ReadBlock->FilePointer->FileName ); } #endif //DBG PERFINFO_HARDFAULT(VirtualAddress, ReadBlock); #if defined(_PREFETCH_) // // Assert no reads issued here are marked as prefetched. // ASSERT (ReadBlock->PrefetchMdl == NULL); #endif // // Issue the read request. // status = IoPageRead ( ReadBlock->FilePointer, &ReadBlock->Mdl, &ReadBlock->ReadOffset, &ReadBlock->Event, &ReadBlock->IoStatus); if (!NT_SUCCESS(status)) { // // Set the event as the I/O system doesn't set it on errors. // ReadBlock->IoStatus.Status = status; ReadBlock->IoStatus.Information = 0; KeSetEvent (&ReadBlock->Event, 0, FALSE); } // // Wait for the I/O operation. // status = MiWaitForInPageComplete (ReadBlock->Pfn, ReadPte, VirtualAddress, &SavedPte, CapturedEvent, Process); if (CurrentThread != NULL) { KeLeaveCriticalRegion(); ASSERT (CurrentThread->NestedFaultCount <= 3); ASSERT (CurrentThread->NestedFaultCount != 0); CurrentThread->NestedFaultCount -= 1; if ((CurrentThread->ApcNeeded == 1) && (CurrentThread->NestedFaultCount == 0)) { *ApcNeeded = TRUE; CurrentThread->ApcNeeded = 0; } } PERFINFO_HARDFAULT_IOTIME(); // // MiWaitForInPageComplete RETURNS WITH THE WORKING SET LOCK // AND PFN LOCK HELD!!! // // // This is the thread which owns the event, clear the event field // in the PFN database. // Pfn1 = ReadBlock->Pfn; Page = &ReadBlock->Page[0]; NumberOfBytes = (LONG)ReadBlock->Mdl.ByteCount; CheckPte = ReadBlock->BasePte; while (NumberOfBytes > 0) { // // Don't remove the page we just brought in to // satisfy this page fault. // if (CheckPte != ReadPte) { PfnClusterPage = MI_PFN_ELEMENT (*Page); ASSERT (PfnClusterPage->PteFrame == Pfn1->PteFrame); #if DBG if (PfnClusterPage->u3.e1.InPageError) { ASSERT (status != STATUS_SUCCESS); } #endif //DBG if (PfnClusterPage->u3.e1.ReadInProgress != 0) { ASSERT (PfnClusterPage->PteFrame != MI_MAGIC_AWE_PTEFRAME); PfnClusterPage->u3.e1.ReadInProgress = 0; if (PfnClusterPage->u3.e1.InPageError == 0) { PfnClusterPage->u1.Event = (PKEVENT)NULL; } } MI_REMOVE_LOCKED_PAGE_CHARGE(PfnClusterPage, 9); MiDecrementReferenceCount (*Page); } else { PageFrameIndex = *Page; } CheckPte += 1; Page += 1; NumberOfBytes -= PAGE_SIZE; } if (status != STATUS_SUCCESS) { MI_REMOVE_LOCKED_PAGE_CHARGE(MI_PFN_ELEMENT(PageFrameIndex), 9); MiDecrementReferenceCount (PageFrameIndex); if (status == STATUS_PTE_CHANGED) { // // State of PTE changed during I/O operation, just // return success and refault. // UNLOCK_PFN (APC_LEVEL); if (WsLockChanged == TRUE) { UNLOCK_SYSTEM_WS (APC_LEVEL); LOCK_SESSION_SPACE_WS (OldIrql); } return STATUS_SUCCESS; } // // An I/O error occurred during the page read // operation. All the pages which were just // put into transition should be put onto the // free list if InPageError is set, and their // PTEs restored to the proper contents. // Page = &ReadBlock->Page[0]; NumberOfBytes = ReadBlock->Mdl.ByteCount; while (NumberOfBytes > 0) { PfnClusterPage = MI_PFN_ELEMENT (*Page); if (PfnClusterPage->u3.e1.InPageError == 1) { if (PfnClusterPage->u3.e2.ReferenceCount == 0) { PfnClusterPage->u3.e1.InPageError = 0; // // Only restore the transition PTE if the address // space still exists. Another thread may have // deleted the VAD while this thread waited for the // fault to complete - in this case, the frame // will be marked as free already. // if (PfnClusterPage->u3.e1.PageLocation != FreePageList) { ASSERT (PfnClusterPage->u3.e1.PageLocation == StandbyPageList); MiUnlinkPageFromList (PfnClusterPage); MiRestoreTransitionPte (*Page); MiInsertPageInList (MmPageLocationList[FreePageList], *Page); } } } Page += 1; NumberOfBytes -= PAGE_SIZE; } UNLOCK_PFN (APC_LEVEL); if (WsLockChanged == TRUE) { UNLOCK_SYSTEM_WS (APC_LEVEL); LOCK_SESSION_SPACE_WS (OldIrql); } if (status == STATUS_REFAULT) { // // The I/O operation to bring in a system page failed // due to insufficent resources. Delay a bit, then // return success and refault. // KeDelayExecutionThread (KernelMode, FALSE, (PLARGE_INTEGER)&MmShortTime); return STATUS_SUCCESS; } return status; } // // PTE is still in transition state, same protection, etc. // ASSERT (Pfn1->u3.e1.InPageError == 0); if (Pfn1->u2.ShareCount == 0) { MI_REMOVE_LOCKED_PAGE_CHARGE (Pfn1, 9); } Pfn1->u2.ShareCount += 1; Pfn1->u3.e1.PageLocation = ActiveAndValid; MI_MAKE_TRANSITION_PTE_VALID (TempPte, ReadPte); if (StoreInstruction && TempPte.u.Hard.Write) { MI_SET_PTE_DIRTY (TempPte); } MI_WRITE_VALID_PTE (ReadPte, TempPte); if (PointerProtoPte != NULL) { // // The prototype PTE has been made valid, now make the // original PTE valid. // if (PointerPte->u.Hard.Valid == 0) { #if DBG NTSTATUS oldstatus = status; #endif //DBG // // PTE is not valid, continue with operation. // status = MiCompleteProtoPteFault (StoreInstruction, VirtualAddress, PointerPte, PointerProtoPte); // // Returns with PFN lock released! // #if DBG if (PointerPte->u.Hard.Valid == 0) { DbgPrint ("MM:PAGFAULT - va %p %p %p status:%lx\n", VirtualAddress, PointerPte, PointerProtoPte, oldstatus); } #endif //DBG } } else { #if PFN_CONSISTENCY if (MiGetPteAddress(ReadPte) == MiGetPdeAddress(PTE_BASE)) { Pfn1->u3.e1.PageTablePage = 1; } #endif if (Pfn1->u1.Event == 0) { Pfn1->u1.Event = (PVOID)PsGetCurrentThread(); } UNLOCK_PFN (APC_LEVEL); MiAddValidPageToWorkingSet (VirtualAddress, ReadPte, Pfn1, 0); } // // Note this routine could release and reacquire the PFN lock! // LOCK_PFN (OldIrql); MiFlushInPageSupportBlock(); UNLOCK_PFN (APC_LEVEL); if (status == STATUS_SUCCESS) { status = STATUS_PAGE_FAULT_PAGING_FILE; } NotifyRoutine = MmHardFaultNotifyRoutine; if (NotifyRoutine) { (*NotifyRoutine) ( ReadBlock->FilePointer, VirtualAddress ); } } // // Stop high priority threads from consuming the CPU on collided // faults for pages that are still marked with inpage errors. All // the threads must let go of the page so it can be freed and the // inpage I/O reissued to the filesystem. // if (MmIsRetryIoStatus(status)) { KeDelayExecutionThread (KernelMode, FALSE, (PLARGE_INTEGER)&MmShortTime); status = STATUS_SUCCESS; } if ((status == STATUS_REFAULT) || (status == STATUS_PTE_CHANGED)) { status = STATUS_SUCCESS; } ASSERT (KeGetCurrentIrql() == APC_LEVEL); if (WsLockChanged == TRUE) { UNLOCK_SYSTEM_WS (APC_LEVEL); LOCK_SESSION_SPACE_WS (OldIrql); } return status; }

PMMPTE MiFindActualFaultingPte (  IN PVOID  FaultingAddress  )

Definition at line 2749 of file pagfault.c. References MI_IS_PHYSICAL_ADDRESS, MI_PTE_LOOKUP_NEEDED, MiCheckVirtualAddress(), MiGetPdeAddress, MiGetPpeAddress, MiGetPteAddress, MiPteToProto, NULL, and _MMPTE::u. Referenced by MiWaitForInPageComplete(). 02755 : 02756 02757 This routine locates the actual PTE which must be made resident in order 02758 to complete this fault. Note that for certain cases multiple faults 02759 are required to make the final page resident. 02760 02761 Arguments: 02762 02763 FaultingAddress - Supplies the virtual address which caused the 02764 fault. 02765 02766 PointerPte - Supplies the pointer to the PTE which is in prototype 02767 PTE format. 02768 02769 02770 Return Value: 02771 02772 02773 Environment: 02774 02775 Kernel mode, APCs disabled, working set mutex held. 02776 02777 --*/ 02778 02779 { 02780 PMMPTE ProtoPteAddress; 02781 PMMPTE PointerPte; 02782 PMMPTE PointerFaultingPte; 02783 ULONG Protection; 02784 02785 if (MI_IS_PHYSICAL_ADDRESS(FaultingAddress)) { 02786 return NULL; 02787 } 02788 02789 #if defined (_WIN64) 02790 02791 PointerPte = MiGetPpeAddress (FaultingAddress); 02792 02793 if (PointerPte->u.Hard.Valid == 0) { 02794 02795 // 02796 // Page directory page is not valid. 02797 // 02798 02799 return PointerPte; 02800 } 02801 02802 #endif 02803 02804 PointerPte = MiGetPdeAddress (FaultingAddress); 02805 02806 if (PointerPte->u.Hard.Valid == 0) { 02807 02808 // 02809 // Page table page is not valid. 02810 // 02811 02812 return PointerPte; 02813 } 02814 02815 PointerPte = MiGetPteAddress (FaultingAddress); 02816 02817 if (PointerPte->u.Hard.Valid == 1) { 02818 02819 // 02820 // Page is already valid, no need to fault it in. 02821 // 02822 02823 return (PMMPTE)NULL; 02824 } 02825 02826 if (PointerPte->u.Soft.Prototype == 0) { 02827 02828 // 02829 // Page is not a prototype PTE, make this PTE valid. 02830 // 02831 02832 return PointerPte; 02833 } 02834 02835 // 02836 // Check to see if the PTE which maps the prototype PTE is valid. 02837 // 02838 02839 if (PointerPte->u.Soft.PageFileHigh == MI_PTE_LOOKUP_NEEDED) { 02840 02841 // 02842 // Protection is here, PTE must be located in VAD. 02843 // 02844 02845 ProtoPteAddress = MiCheckVirtualAddress (FaultingAddress, 02846 &Protection); 02847 02848 if (ProtoPteAddress == NULL) { 02849 02850 // 02851 // No prototype PTE means another thread has deleted the VAD while 02852 // this thread waited for the inpage to complete. Certainly NULL 02853 // must be returned so a stale PTE is not modified - the instruction 02854 // will then be reexecuted and an access violation delivered. 02855 // 02856 02857 return (PMMPTE)NULL; 02858 } 02859 02860 } else { 02861 02862 // 02863 // Protection is in ProtoPte. 02864 // 02865 02866 ProtoPteAddress = MiPteToProto (PointerPte); 02867 } 02868 02869 PointerFaultingPte = MiFindActualFaultingPte (ProtoPteAddress); 02870 02871 if (PointerFaultingPte == (PMMPTE)NULL) { 02872 return PointerPte; 02873 } else { 02874 return PointerFaultingPte; 02875 } 02876 02877 }

VOID MiFlushInPageSupportBlock (   )

Definition at line 4301 of file pagfault.c. References APC_LEVEL, _MMINPAGE_SUPPORT_LIST::Count, ExFreePool(), _MMINPAGE_SUPPORT::ListEntry, _MMINPAGE_SUPPORT_LIST::ListHead, LOCK_PFN, _MMINPAGE_SUPPORT::Mdl, MM_PFN_LOCK_ASSERT, MmInPageSupportList, MMMAX_INPAGE_SUPPORT, NULL, and UNLOCK_PFN. Referenced by MiDispatchFault(). 04306 : 04307 04308 This routine examines the number of freed in page support blocks, 04309 and if more than 4, frees the blocks back to the NonPagedPool. 04310 04311 04312 ****** NB: The PFN LOCK is RELEASED and reacquired during this call ****** 04313 04314 04315 Arguments: 04316 04317 None. 04318 04319 Return Value: 04320 04321 None. 04322 04323 Environment: 04324 04325 Kernel mode, PFN lock held. 04326 04327 --*/ 04328 04329 #define MMMAX_INPAGE_SUPPORT 4 04330 04331 { 04332 KIRQL OldIrql; 04333 PMMINPAGE_SUPPORT Support[10]; 04334 ULONG i = 0; 04335 PLIST_ENTRY NextEntry; 04336 04337 MM_PFN_LOCK_ASSERT(); 04338 04339 while ((MmInPageSupportList.Count > MMMAX_INPAGE_SUPPORT) && (i < 10)) { 04340 NextEntry = RemoveHeadList (&MmInPageSupportList.ListHead); 04341 Support[i] = CONTAINING_RECORD (NextEntry, 04342 MMINPAGE_SUPPORT, 04343 ListEntry ); 04344 Support[i]->ListEntry.Flink = NULL; 04345 i += 1; 04346 MmInPageSupportList.Count -= 1; 04347 } 04348 04349 if (i == 0) { 04350 return; 04351 } 04352 04353 UNLOCK_PFN (APC_LEVEL); 04354 04355 do { 04356 i -= 1; 04357 04358 #if defined (_PREFETCH_) 04359 if ((Support[i]->PrefetchMdl != NULL) && 04360 (Support[i]->PrefetchMdl != &Support[i]->Mdl)) { 04361 ExFreePool (Support[i]->PrefetchMdl); 04362 } 04363 #endif 04364 04365 ExFreePool(Support[i]); 04366 } while (i > 0); 04367 04368 LOCK_PFN (OldIrql); 04369 04370 return; 04371 }

VOID MiFreeInPageSupportBlock (  IN PMMINPAGE_SUPPORT  Support  )

Definition at line 4252 of file pagfault.c. References ASSERT, _MMINPAGE_SUPPORT_LIST::Count, _MMINPAGE_SUPPORT_LIST::ListHead, MM_PFN_LOCK_ASSERT, MmInPageSupportList, and NULL. Referenced by MiWaitForInPageComplete(), and MmCopyToCachedPage(). : This routine returns the in page support block to a list of freed blocks. Arguments: Support - Supplies the in page support block to put on the free list. Return Value: None. Environment: Kernel mode, PFN lock held. --*/ { MM_PFN_LOCK_ASSERT(); ASSERT (Support->u.Thread != NULL); ASSERT (Support->WaitCount != 0); #if defined (_PREFETCH_) ASSERT ((Support->ListEntry.Flink == NULL) || (Support->PrefetchMdl != NULL)); #else ASSERT (Support->ListEntry.Flink == NULL); #endif Support->WaitCount -= 1; if (Support->WaitCount == 0) { Support->u.Thread = NULL; InsertTailList (&MmInPageSupportList.ListHead, &Support->ListEntry); MmInPageSupportList.Count += 1; } return; }

PMMINPAGE_SUPPORT MiGetInPageSupportBlock (  VOID   )

Definition at line 4152 of file pagfault.c. References APC_LEVEL, ASSERT, _MMINPAGE_SUPPORT::Completed, _MMINPAGE_SUPPORT_LIST::Count, _MMINPAGE_SUPPORT::Event, ExAllocatePoolWithTag, ExFreePool(), FALSE, KeClearEvent, KeInitializeEvent, _MMINPAGE_SUPPORT::ListEntry, _MMINPAGE_SUPPORT_LIST::ListHead, LOCK_PFN, _MMINPAGE_SUPPORT::Mdl, MM_PFN_LOCK_ASSERT, MmInPageSupportList, NonPagedPool, NULL, PsGetCurrentThread, _MMINPAGE_SUPPORT::u, UNLOCK_PFN, and _MMINPAGE_SUPPORT::WaitCount. Referenced by MiResolveMappedFileFault(), MiResolvePageFileFault(), and MmCopyToCachedPage(). : This routine acquires an inpage support block. If none are available, the PFN lock will be released and reacquired to add an entry to the list. FALSE will then be returned. Arguments: None. Return Value: A non-null pointer to an inpage block if one is already available. The PFN lock is not released in this path. NULL is returned if no inpage blocks were available. In this path, the PFN lock is released and an entry is added - but NULL is still returned so the caller is aware that the state has changed due to the lock release and reacquisition. Environment: Kernel mode, PFN lock held. --*/ { KIRQL OldIrql; PMMINPAGE_SUPPORT Support; PLIST_ENTRY NextEntry; MM_PFN_LOCK_ASSERT(); if (MmInPageSupportList.Count == 0) { ASSERT (IsListEmpty(&MmInPageSupportList.ListHead)); UNLOCK_PFN (APC_LEVEL); Support = ExAllocatePoolWithTag (NonPagedPool, sizeof(MMINPAGE_SUPPORT), 'nImM'); if (Support == NULL) { LOCK_PFN (OldIrql); return NULL; } KeInitializeEvent (&Support->Event, NotificationEvent, FALSE); LOCK_PFN (OldIrql); MmInPageSupportList.Count += 1; Support->u.Thread = NULL; #if defined(_PREFETCH_) Support->PrefetchMdl = NULL; #endif InsertTailList (&MmInPageSupportList.ListHead, &Support->ListEntry); return NULL; } ASSERT (!IsListEmpty(&MmInPageSupportList.ListHead)); MmInPageSupportList.Count -= 1; NextEntry = RemoveHeadList (&MmInPageSupportList.ListHead); Support = CONTAINING_RECORD (NextEntry, MMINPAGE_SUPPORT, ListEntry ); #if defined(_PREFETCH_) if ((Support->PrefetchMdl != NULL) && (Support->PrefetchMdl != &Support->Mdl)) { UNLOCK_PFN (APC_LEVEL); ExFreePool (Support->PrefetchMdl); ExFreePool (Support); LOCK_PFN (OldIrql); return NULL; } #endif Support->Completed = FALSE; Support->WaitCount = 1; Support->u.Thread = PsGetCurrentThread(); Support->ListEntry.Flink = NULL; #if defined(_PREFETCH_) Support->PrefetchMdl = NULL; #endif #if defined (_WIN64) Support->UsedPageTableEntries = 0; #endif KeClearEvent (&Support->Event); return Support; }

VOID MiHandleBankedSection (  IN PVOID  VirtualAddress, IN PMMVAD  Vad )

Definition at line 4374 of file pagfault.c. References _MMBANKED_SECTION::BankedRoutine, _MMBANKED_SECTION::BankShift, _MMBANKED_SECTION::BankSize, _MMBANKED_SECTION::BankTemplate, _MMBANKED_SECTION::BasedPte, _MMBANKED_SECTION::Context, _MMBANKED_SECTION::CurrentMappedPte, FALSE, KeFlushEntireTb(), MiGetPteAddress, PAGE_SHIFT, PTE_SHIFT, TRUE, _MMPTE::u, and ZeroPte. Referenced by MiCheckVirtualAddress(). : This routine invalidates a bank of video memory, calls out to the video driver and then enables the next bank of video memory. Arguments: VirtualAddress - Supplies the address of the faulting page. Vad - Supplies the VAD which maps the range. Return Value: None. Environment: Kernel mode, PFN lock held. --*/ { PMMBANKED_SECTION Bank; PMMPTE PointerPte; ULONG BankNumber; ULONG size; Bank = Vad->u4.Banked; size = Bank->BankSize; RtlFillMemory (Bank->CurrentMappedPte, size >> (PAGE_SHIFT - PTE_SHIFT), (UCHAR)ZeroPte.u.Long); // // Flush the TB as we have invalidated all the PTEs in this range // KeFlushEntireTb (TRUE, FALSE); // // Calculate new bank address and bank number. // PointerPte = MiGetPteAddress ( (PVOID)((ULONG_PTR)VirtualAddress & ~((LONG)size - 1))); Bank->CurrentMappedPte = PointerPte; BankNumber = (ULONG)(((PCHAR)PointerPte - (PCHAR)Bank->BasedPte) >> Bank->BankShift); (Bank->BankedRoutine)(BankNumber, BankNumber, Bank->Context); // // Set the new range valid. // RtlMoveMemory (PointerPte, &Bank->BankTemplate[0], size >> (PAGE_SHIFT - PTE_SHIFT)); return; }

VOID MiInitializeCopyOnWritePfn (  IN PFN_NUMBER  PageFrameIndex, IN PMMPTE  PointerPte, IN WSLE_NUMBER  WorkingSetIndex, IN PVOID  SessionPointer )

Definition at line 3764 of file pagfault.c. References ActiveAndValid, ASSERT, _MMWSLE::e1, KeBugCheckEx(), MI_GET_PAGE_FRAME_FROM_PTE, MI_MAKE_PROTECT_NOT_WRITE_COPY, MI_PFN_ELEMENT, MiCheckPdeForPagedPool(), MiGetPteAddress, MiGetVirtualAddressMappedByPte, MM_EXECUTE_READWRITE, MM_PFN_LOCK_ASSERT, MmWsle, NT_SUCCESS, _MMPFN::OriginalPte, _MMWSLENTRY::Protection, _MMPFN::PteAddress, _MMPFN::PteFrame, _MMPTE::u, _MMPFN::u1, _MMWSLE::u1, _MMPFN::u2, _MMPFN::u3, and _MM_SESSION_SPACE::Wsle. Referenced by MiCopyOnWrite(), and MiSessionCopyOnWrite(). 03773 : 03774 03775 This function initializes the specified PFN element to the 03776 active and valid state for a copy on write operation. 03777 03778 In this case the page table page which contains the PTE has 03779 the proper ShareCount. 03780 03781 Arguments: 03782 03783 PageFrameIndex - Supplies the page frame number to initialize. 03784 03785 PointerPte - Supplies the pointer to the PTE which caused the 03786 page fault. 03787 03788 WorkingSetIndex - Supplies the working set index for the corresponding 03789 virtual address. 03790 03791 SessionPointer - Supplies the session space pointer if this fault is for 03792 a session space page or NULL if this is for a user page. 03793 03794 03795 Return Value: 03796 03797 None. 03798 03799 Environment: 03800 03801 Kernel mode, APCs disabled, PFN mutex held. 03802 03803 --*/ 03804 03805 { 03806 PMMPFN Pfn1; 03807 PMMPTE PteFramePointer; 03808 PFN_NUMBER PteFramePage; 03809 PVOID VirtualAddress; 03810 PMM_SESSION_SPACE SessionSpace; 03811 03812 Pfn1 = MI_PFN_ELEMENT (PageFrameIndex); 03813 Pfn1->PteAddress = PointerPte; 03814 03815 // 03816 // Get the protection for the page. 03817 // 03818 03819 VirtualAddress = MiGetVirtualAddressMappedByPte (PointerPte); 03820 03821 Pfn1->OriginalPte.u.Long = 0; 03822 03823 if (SessionPointer) { 03824 Pfn1->OriginalPte.u.Soft.Protection = MM_EXECUTE_READWRITE; 03825 SessionSpace = (PMM_SESSION_SPACE) SessionPointer; 03826 SessionSpace->Wsle[WorkingSetIndex].u1.e1.Protection = 03827 MM_EXECUTE_READWRITE; 03828 } 03829 else { 03830 Pfn1->OriginalPte.u.Soft.Protection = 03831 MI_MAKE_PROTECT_NOT_WRITE_COPY ( 03832 MmWsle[WorkingSetIndex].u1.e1.Protection); 03833 } 03834 03835 ASSERT (Pfn1->u3.e2.ReferenceCount == 0); 03836 Pfn1->u3.e2.ReferenceCount += 1; 03837 Pfn1->u2.ShareCount += 1; 03838 Pfn1->u3.e1.PageLocation = ActiveAndValid; 03839 Pfn1->u1.WsIndex = WorkingSetIndex; 03840 03841 // 03842 // Determine the page frame number of the page table page which 03843 // contains this PTE. 03844 // 03845 03846 PteFramePointer = MiGetPteAddress(PointerPte); 03847 if (PteFramePointer->u.Hard.Valid == 0) { 03848 #if !defined (_WIN64) 03849 if (!NT_SUCCESS(MiCheckPdeForPagedPool (PointerPte))) { 03850 #endif 03851 KeBugCheckEx (MEMORY_MANAGEMENT, 03852 0x61940, 03853 (ULONG_PTR)PointerPte, 03854 (ULONG_PTR)PteFramePointer->u.Long, 03855 (ULONG_PTR)MiGetVirtualAddressMappedByPte(PointerPte)); 03856 #if !defined (_WIN64) 03857 } 03858 #endif 03859 } 03860 03861 PteFramePage = MI_GET_PAGE_FRAME_FROM_PTE (PteFramePointer); 03862 ASSERT (PteFramePage != 0); 03863 03864 Pfn1->PteFrame = PteFramePage; 03865 03866 #if PFN_CONSISTENCY 03867 MM_PFN_LOCK_ASSERT(); 03868 03869 Pfn1->u3.e1.PageTablePage = 0; 03870 #endif 03871 03872 // 03873 // Set the modified flag in the PFN database as we are writing 03874 // into this page and the dirty bit is already set in the PTE. 03875 // 03876 03877 Pfn1->u3.e1.Modified = 1; 03878 03879 return; 03880 }

VOID MiInitializePfn (  IN PFN_NUMBER  PageFrameIndex, IN PMMPTE  PointerPte, IN ULONG  ModifiedState )

Definition at line 3398 of file pagfault.c. References ActiveAndValid, ASSERT, DbgPrint, KeBugCheckEx(), MI_GET_PAGE_FRAME_FROM_PTE, MI_IS_CACHING_DISABLED, MI_PFN_ELEMENT, MiCheckPdeForPagedPool(), MiFormatPfn(), MiFormatPte(), MiGetPteAddress, MiGetVirtualAddressMappedByPte, MM_DEMAND_ZERO_WRITE_PTE, MM_EXECUTE_READWRITE, MM_NOCACHE, MM_PFN_LOCK_ASSERT, MM_READWRITE, NT_SUCCESS, _MMPFN::OriginalPte, _MMPFN::PteAddress, _MMPFN::PteFrame, _MMPTE::u, _MMPFN::u2, and _MMPFN::u3. Referenced by ExAllocatePool(), MiAddWorkingSetPage(), MiAddWsleHash(), MiAllocatePoolPages(), MiAllocateSpecialPool(), MiFillSystemPageDirectory(), MiInitializeSystemCache(), MiInitializeWorkingSetList(), MiLoadImageSection(), MiReloadBootLoadedDrivers(), MiResolveDemandZeroFault(), MiSessionCommitImagePages(), MiSessionCreateInternal(), MiSessionInitializeWorkingSetList(), MmAccessFault(), MmAddPhysicalMemory(), MmAllocateIndependentPages(), MmAllocateNonCachedMemory(), MmCheckCachedPageState(), MmCreateKernelStack(), MmGrowKernelStack(), MmInitializeProcessAddressSpace(), and MmInitSystem(). 03406 : 03407 03408 This function initializes the specified PFN element to the 03409 active and valid state. 03410 03411 Arguments: 03412 03413 PageFrameIndex - Supplies the page frame number to initialize. 03414 03415 PointerPte - Supplies the pointer to the PTE which caused the 03416 page fault. 03417 03418 ModifiedState - Supplies the state to set the modified field in the PFN 03419 element for this page, either 0 or 1. 03420 03421 Return Value: 03422 03423 None. 03424 03425 Environment: 03426 03427 Kernel mode, APCs disabled, PFN mutex held. 03428 03429 --*/ 03430 03431 { 03432 PMMPFN Pfn1; 03433 PMMPFN Pfn2; 03434 PMMPTE PteFramePointer; 03435 PFN_NUMBER PteFramePage; 03436 03437 MM_PFN_LOCK_ASSERT(); 03438 03439 Pfn1 = MI_PFN_ELEMENT (PageFrameIndex); 03440 Pfn1->PteAddress = PointerPte; 03441 03442 // 03443 // If the PTE is currently valid, an address space is being built, 03444 // just make the original PTE demand zero. 03445 // 03446 03447 if (PointerPte->u.Hard.Valid == 1) { 03448 Pfn1->OriginalPte.u.Long = MM_DEMAND_ZERO_WRITE_PTE; 03449 03450 #if defined(_IA64_) 03451 if (PointerPte->u.Hard.Execute == 1) { 03452 Pfn1->OriginalPte.u.Soft.Protection = MM_EXECUTE_READWRITE; 03453 } 03454 #endif 03455 03456 if (MI_IS_CACHING_DISABLED (PointerPte)) { 03457 Pfn1->OriginalPte.u.Soft.Protection = MM_READWRITE | MM_NOCACHE; 03458 } 03459 03460 } else { 03461 Pfn1->OriginalPte = *PointerPte; 03462 ASSERT (!((Pfn1->OriginalPte.u.Soft.Prototype == 0) && 03463 (Pfn1->OriginalPte.u.Soft.Transition == 1))); 03464 } 03465 03466 Pfn1->u3.e2.ReferenceCount += 1; 03467 03468 #if DBG 03469 if (Pfn1->u3.e2.ReferenceCount > 1) { 03470 DbgPrint("MM:incrementing ref count > 1 \n"); 03471 MiFormatPfn(Pfn1); 03472 MiFormatPte(PointerPte); 03473 } 03474 #endif 03475 03476 Pfn1->u2.ShareCount += 1; 03477 Pfn1->u3.e1.PageLocation = ActiveAndValid; 03478 Pfn1->u3.e1.Modified = ModifiedState; 03479 03480 #if defined (_WIN64) 03481 Pfn1->UsedPageTableEntries = 0; 03482 #endif 03483 03484 #if PFN_CONSISTENCY 03485 Pfn1->u3.e1.PageTablePage = 0; 03486 #endif 03487 // 03488 // Determine the page frame number of the page table page which 03489 // contains this PTE. 03490 // 03491 03492 PteFramePointer = MiGetPteAddress(PointerPte); 03493 if (PteFramePointer->u.Hard.Valid == 0) { 03494 #if !defined (_WIN64) 03495 if (!NT_SUCCESS(MiCheckPdeForPagedPool (PointerPte))) { 03496 #endif 03497 KeBugCheckEx (MEMORY_MANAGEMENT, 03498 0x61940, 03499 (ULONG_PTR)PointerPte, 03500 (ULONG_PTR)PteFramePointer->u.Long, 03501 (ULONG_PTR)MiGetVirtualAddressMappedByPte(PointerPte)); 03502 #if !defined (_WIN64) 03503 } 03504 #endif 03505 } 03506 PteFramePage = MI_GET_PAGE_FRAME_FROM_PTE (PteFramePointer); 03507 ASSERT (PteFramePage != 0); 03508 Pfn1->PteFrame = PteFramePage; 03509 03510 // 03511 // Increment the share count for the page table page containing 03512 // this PTE. 03513 // 03514 03515 Pfn2 = MI_PFN_ELEMENT (PteFramePage); 03516 03517 Pfn2->u2.ShareCount += 1; 03518 03519 return; 03520 }

VOID MiInitializePfnForOtherProcess (  IN PFN_NUMBER  PageFrameIndex, IN PMMPTE  PointerPte, IN PFN_NUMBER  ContainingPageFrame )

Definition at line 3973 of file pagfault.c. References ActiveAndValid, ASSERT, DbgPrint, MI_PFN_ELEMENT, MiFormatPfn(), MiFormatPte(), MM_DEMAND_ZERO_WRITE_PTE, MM_PFN_LOCK_ASSERT, _MMPFN::OriginalPte, _MMPFN::PteAddress, _MMPFN::PteFrame, _MMPTE::u, _MMPFN::u2, and _MMPFN::u3. Referenced by MiAllocatePoolPages(), MiFillSystemPageDirectory(), MiInitializeSessionPool(), MiMakeOutswappedPageResident(), MiSessionCommitPageTables(), MiSessionCreateInternal(), and MiSessionInitializeWorkingSetList(). 03981 : 03982 03983 This function initializes the specified PFN element to the 03984 active and valid state with the dirty bit on in the PTE and 03985 the PFN database marked as modified. 03986 03987 As this PTE is not visible from the current process, the containing 03988 page frame must be supplied at the PTE contents field for the 03989 PFN database element are set to demand zero. 03990 03991 Arguments: 03992 03993 PageFrameIndex - Supplies the page frame number of which to initialize. 03994 03995 PointerPte - Supplies the pointer to the PTE which caused the 03996 page fault. 03997 03998 ContainingPageFrame - Supplies the page frame number of the page 03999 table page which contains this PTE. 04000 If the ContainingPageFrame is 0, then 04001 the ShareCount for the 04002 containing page is not incremented. 04003 04004 Return Value: 04005 04006 None. 04007 04008 Environment: 04009 04010 Kernel mode, APCs disabled, PFN mutex held. 04011 04012 --*/ 04013 04014 { 04015 PMMPFN Pfn1; 04016 PMMPFN Pfn2; 04017 04018 Pfn1 = MI_PFN_ELEMENT (PageFrameIndex); 04019 Pfn1->PteAddress = PointerPte; 04020 Pfn1->OriginalPte.u.Long = MM_DEMAND_ZERO_WRITE_PTE; 04021 ASSERT (Pfn1->u3.e2.ReferenceCount == 0); 04022 Pfn1->u3.e2.ReferenceCount += 1; 04023 04024 #if DBG 04025 if (Pfn1->u3.e2.ReferenceCount > 1) { 04026 DbgPrint("MM:incrementing ref count > 1 \n"); 04027 MiFormatPfn(Pfn1); 04028 MiFormatPte(PointerPte); 04029 } 04030 #endif 04031 04032 Pfn1->u2.ShareCount += 1; 04033 Pfn1->u3.e1.PageLocation = ActiveAndValid; 04034 Pfn1->u3.e1.Modified = 1; 04035 04036 #if PFN_CONSISTENCY 04037 MM_PFN_LOCK_ASSERT(); 04038 04039 Pfn1->u3.e1.PageTablePage = 0; 04040 #endif 04041 04042 // 04043 // Increment the share count for the page table page containing 04044 // this PTE. 04045 // 04046 04047 if (ContainingPageFrame != 0) { 04048 Pfn1->PteFrame = ContainingPageFrame; 04049 Pfn2 = MI_PFN_ELEMENT (ContainingPageFrame); 04050 Pfn2->u2.ShareCount += 1; 04051 } 04052 return; 04053 }

VOID MiInitializeReadInProgressPfn (  IN PMDL  Mdl, IN PMMPTE  BasePte, IN PKEVENT  Event, IN WSLE_NUMBER  WorkingSetIndex )

Definition at line 3523 of file pagfault.c. References ASSERT, Event(), KeBugCheckEx(), MI_ADD_LOCKED_PAGE_CHARGE_FOR_MODIFIED_PAGE, MI_GET_PAGE_FRAME_FROM_PTE, MI_MAKE_TRANSITION_PTE, MI_PFN_ELEMENT, MI_PROTOTYPE_WSINDEX, MI_WRITE_INVALID_PTE, MiCheckPdeForPagedPool(), MiGetPteAddress, MiGetVirtualAddressMappedByPte, MM_PFN_LOCK_ASSERT, NT_SUCCESS, _MMPFN::OriginalPte, PAGE_SIZE, _MMPFN::PteAddress, _MMPFN::PteFrame, _MMPTE::u, _MMPFN::u1, _MMPFN::u2, and _MMPFN::u3. Referenced by MiResolveMappedFileFault(), and MiResolvePageFileFault(). 03532 : 03533 03534 This function initializes the specified PFN element to the 03535 transition / read-in-progress state for an in-page operation. 03536 03537 03538 Arguments: 03539 03540 Mdl - Supplies a pointer to the MDL. 03541 03542 BasePte - Supplies the pointer to the PTE which the first page in 03543 the MDL maps. 03544 03545 Event - Supplies the event which is to be set when the I/O operation 03546 completes. 03547 03548 WorkingSetIndex - Supplies the working set index flag, a value of 03549 -1 indicates no WSLE is required because 03550 this is a prototype PTE. 03551 03552 Return Value: 03553 03554 None. 03555 03556 Environment: 03557 03558 Kernel mode, APCs disabled, PFN mutex held. 03559 03560 --*/ 03561 03562 { 03563 PMMPFN Pfn1; 03564 PMMPFN Pfn2; 03565 PMMPTE PteFramePointer; 03566 PFN_NUMBER PteFramePage; 03567 MMPTE TempPte; 03568 LONG NumberOfBytes; 03569 PPFN_NUMBER Page; 03570 03571 MM_PFN_LOCK_ASSERT(); 03572 03573 Page = (PPFN_NUMBER)(Mdl + 1); 03574 03575 NumberOfBytes = Mdl->ByteCount; 03576 03577 while (NumberOfBytes > 0) { 03578 03579 Pfn1 = MI_PFN_ELEMENT (*Page); 03580 Pfn1->u1.Event = Event; 03581 Pfn1->PteAddress = BasePte; 03582 Pfn1->OriginalPte = *BasePte; 03583 ASSERT (Pfn1->u3.e2.ReferenceCount == 0); 03584 MI_ADD_LOCKED_PAGE_CHARGE_FOR_MODIFIED_PAGE (Pfn1, 10); 03585 Pfn1->u3.e2.ReferenceCount += 1; 03586 03587 Pfn1->u2.ShareCount = 0; 03588 Pfn1->u3.e1.ReadInProgress = 1; 03589 Pfn1->u3.e1.InPageError = 0; 03590 03591 #if PFN_CONSISTENCY 03592 Pfn1->u3.e1.PageTablePage = 0; 03593 #endif 03594 if (WorkingSetIndex == MI_PROTOTYPE_WSINDEX) { 03595 Pfn1->u3.e1.PrototypePte = 1; 03596 } 03597 03598 // 03599 // Determine the page frame number of the page table page which 03600 // contains this PTE. 03601 // 03602 03603 PteFramePointer = MiGetPteAddress(BasePte); 03604 if (PteFramePointer->u.Hard.Valid == 0) { 03605 #if !defined (_WIN64) 03606 if (!NT_SUCCESS(MiCheckPdeForPagedPool (BasePte))) { 03607 #endif 03608 KeBugCheckEx (MEMORY_MANAGEMENT, 03609 0x61940, 03610 (ULONG_PTR)BasePte, 03611 (ULONG_PTR)PteFramePointer->u.Long, 03612 (ULONG_PTR)MiGetVirtualAddressMappedByPte(BasePte)); 03613 #if !defined (_WIN64) 03614 } 03615 #endif 03616 } 03617 03618 PteFramePage = MI_GET_PAGE_FRAME_FROM_PTE (PteFramePointer); 03619 Pfn1->PteFrame = PteFramePage; 03620 03621 // 03622 // Put the PTE into the transition state, no cache flush needed as 03623 // PTE is still not valid. 03624 // 03625 03626 MI_MAKE_TRANSITION_PTE (TempPte, 03627 *Page, 03628 BasePte->u.Soft.Protection, 03629 BasePte); 03630 MI_WRITE_INVALID_PTE (BasePte, TempPte); 03631 03632 // 03633 // Increment the share count for the page table page containing 03634 // this PTE as the PTE just went into the transition state. 03635 // 03636 03637 ASSERT (PteFramePage != 0); 03638 Pfn2 = MI_PFN_ELEMENT (PteFramePage); 03639 Pfn2->u2.ShareCount += 1; 03640 03641 NumberOfBytes -= PAGE_SIZE; 03642 Page += 1; 03643 BasePte += 1; 03644 } 03645 03646 return; 03647 }

VOID MiInitializeTransitionPfn (  IN PFN_NUMBER  PageFrameIndex, IN PMMPTE  PointerPte, IN WSLE_NUMBER  WorkingSetIndex )

Definition at line 3650 of file pagfault.c. References ASSERT, KeBugCheckEx(), MI_GET_PAGE_FRAME_FROM_PTE, MI_MAKE_TRANSITION_PTE, MI_PFN_ELEMENT, MI_PROTOTYPE_WSINDEX, MI_WRITE_INVALID_PTE, MiCheckPdeForPagedPool(), MiGetPteAddress, MiGetVirtualAddressMappedByPte, MM_PFN_LOCK_ASSERT, NT_SUCCESS, NULL, _MMPFN::OriginalPte, _MMPFN::PteAddress, _MMPFN::PteFrame, TransitionPage, _MMPTE::u, _MMPFN::u1, _MMPFN::u2, and _MMPFN::u3. Referenced by MiUpdateImageHeaderPage(), and MmCopyToCachedPage(). 03658 : 03659 03660 This function initializes the specified PFN element to the 03661 transition state. Main use is by MapImageFile to make the 03662 page which contains the image header transition in the 03663 prototype PTEs. 03664 03665 Arguments: 03666 03667 PageFrameIndex - Supplies the page frame index to be initialized. 03668 03669 PointerPte - Supplies an invalid, non-transition PTE to initialize. 03670 03671 WorkingSetIndex - Supplies the working set index flag, a value of 03672 MI_PROTOTYPE_WSINDEX indicates no WSLE is required 03673 because this is a prototype PTE. 03674 03675 Return Value: 03676 03677 None. 03678 03679 Environment: 03680 03681 Kernel mode, APCs disabled, PFN mutex held. 03682 03683 --*/ 03684 03685 { 03686 PMMPFN Pfn1; 03687 PMMPFN Pfn2; 03688 PMMPTE PteFramePointer; 03689 PFN_NUMBER PteFramePage; 03690 MMPTE TempPte; 03691 03692 MM_PFN_LOCK_ASSERT(); 03693 Pfn1 = MI_PFN_ELEMENT (PageFrameIndex); 03694 Pfn1->u1.Event = NULL; 03695 Pfn1->PteAddress = PointerPte; 03696 Pfn1->OriginalPte = *PointerPte; 03697 ASSERT (!((Pfn1->OriginalPte.u.Soft.Prototype == 0) && 03698 (Pfn1->OriginalPte.u.Soft.Transition == 1))); 03699 03700 // 03701 // Don't change the reference count (it should already be 1). 03702 // 03703 03704 Pfn1->u2.ShareCount = 0; 03705 03706 if (WorkingSetIndex == MI_PROTOTYPE_WSINDEX) { 03707 Pfn1->u3.e1.PrototypePte = 1; 03708 } 03709 03710 Pfn1->u3.e1.PageLocation = TransitionPage; 03711 03712 // 03713 // Determine the page frame number of the page table page which 03714 // contains this PTE. 03715 // 03716 03717 PteFramePointer = MiGetPteAddress(PointerPte); 03718 if (PteFramePointer->u.Hard.Valid == 0) { 03719 #if !defined (_WIN64) 03720 if (!NT_SUCCESS(MiCheckPdeForPagedPool (PointerPte))) { 03721 #endif 03722 KeBugCheckEx (MEMORY_MANAGEMENT, 03723 0x61940, 03724 (ULONG_PTR)PointerPte, 03725 (ULONG_PTR)PteFramePointer->u.Long, 03726 (ULONG_PTR)MiGetVirtualAddressMappedByPte(PointerPte)); 03727 #if !defined (_WIN64) 03728 } 03729 #endif 03730 } 03731 03732 PteFramePage = MI_GET_PAGE_FRAME_FROM_PTE (PteFramePointer); 03733 Pfn1->PteFrame = PteFramePage; 03734 03735 #if PFN_CONSISTENCY 03736 Pfn1->u3.e1.PageTablePage = 0; 03737 #endif 03738 03739 // 03740 // Put the PTE into the transition state, no cache flush needed as 03741 // PTE is still not valid. 03742 // 03743 03744 MI_MAKE_TRANSITION_PTE (TempPte, 03745 PageFrameIndex, 03746 PointerPte->u.Soft.Protection, 03747 PointerPte); 03748 03749 MI_WRITE_INVALID_PTE (PointerPte, TempPte); 03750 03751 // 03752 // Increment the share count for the page table page containing 03753 // this PTE as the PTE just went into the transition state. 03754 // 03755 03756 Pfn2 = MI_PFN_ELEMENT (PteFramePage); 03757 ASSERT (PteFramePage != 0); 03758 Pfn2->u2.ShareCount += 1; 03759 03760 return; 03761 }

NTSTATUS MiResolveDemandZeroFault (  IN PVOID  VirtualAddress, IN PMMPTE  PointerPte, IN PEPROCESS  Process, IN ULONG  PrototypePte )

Definition at line 674 of file pagfault.c. References APC_LEVEL, ASSERT, CONSISTENCY_LOCK_PFN, CONSISTENCY_UNLOCK_PFN, _MMINFO_COUNTERS::DemandZeroCount, FALSE, HYDRA_PROCESS, LOCK_PFN, MI_BARRIER_STAMP_ZEROED_PAGE, MI_BARRIER_SYNCHRONIZE, MI_IS_PAGE_TABLE_ADDRESS, MI_MAKE_VALID_PTE, MI_PAGE_COLOR_VA_PROCESS, MI_PFN_ELEMENT, MI_SET_PTE_DIRTY, MI_WRITE_VALID_PTE, MiAddValidPageToWorkingSet(), MiEnsureAvailablePageOrWait(), MiInitializePfn(), MiRemoveAnyPage(), MiRemoveZeroPage(), MiRemoveZeroPageIfAny, MiWaitForForkToComplete(), MiZeroPhysicalPage(), MM_PFN_LOCK_ASSERT, MmInfoCounters, MmSystemPageColor, NULL, PERFINFO_PRIVATE_PAGE_DEMAND_ZERO, PERFINFO_SOFTFAULT, PrototypePte, PsGetCurrentThread, _MMPFN::PteFrame, STATUS_REFAULT, TRUE, _MMPTE::u, _MMPFN::u1, and UNLOCK_PFN. Referenced by MiDispatchFault(), MiResolveProtoPteFault(), and MmAccessFault(). : This routine resolves a demand zero page fault. If the PrototypePte argument is TRUE, the PFN lock is held, the lock cannot be dropped, and the page should not be added to the working set at this time. Arguments: VirtualAddress - Supplies the faulting address. PointerPte - Supplies the PTE for the faulting address. Process - Supplies a pointer to the process object. If this parameter is NULL, then the fault is for system space and the process's working set lock is not held. PrototypePte - Supplies TRUE if this is a prototype PTE. Return Value: status, either STATUS_SUCCESS or STATUS_REFAULT. Environment: Kernel mode, PFN lock held conditionally. --*/ { PMMPFN Pfn1; PFN_NUMBER PageFrameIndex; MMPTE TempPte; ULONG PageColor; KIRQL OldIrql; LOGICAL NeedToZero; LOGICAL BarrierNeeded; ULONG BarrierStamp; NeedToZero = FALSE; BarrierNeeded = FALSE; PERFINFO_PRIVATE_PAGE_DEMAND_ZERO(VirtualAddress); // // Check to see if a page is available, if a wait is // returned, do not continue, just return success. // if (!PrototypePte) { LOCK_PFN (OldIrql); } MM_PFN_LOCK_ASSERT(); if (PointerPte->u.Hard.Valid == 0) { if (!MiEnsureAvailablePageOrWait (Process, VirtualAddress)) { if (Process != NULL && Process != HYDRA_PROCESS && (!PrototypePte)) { // // If a fork operation is in progress and the faulting thread // is not the thread performing the fork operation, block until // the fork is completed. // if ((Process->ForkInProgress != NULL) && (Process->ForkInProgress != PsGetCurrentThread())) { MiWaitForForkToComplete (Process); UNLOCK_PFN (APC_LEVEL); return STATUS_REFAULT; } Process->NumberOfPrivatePages += 1; PageColor = MI_PAGE_COLOR_VA_PROCESS (VirtualAddress, &Process->NextPageColor); ASSERT (MI_IS_PAGE_TABLE_ADDRESS(PointerPte)); PageFrameIndex = MiRemoveZeroPageIfAny (PageColor); if (PageFrameIndex) { // // This barrier check is needed after zeroing the page // and before setting the PTE valid. Note since the PFN // database entry is used to hold the sequence timestamp, // it must be captured now. Check it at the last possible // moment. // Pfn1 = MI_PFN_ELEMENT (PageFrameIndex); BarrierStamp = (ULONG)Pfn1->PteFrame; } else { PageFrameIndex = MiRemoveAnyPage (PageColor); NeedToZero = TRUE; } BarrierNeeded = TRUE; } else { PageColor = MI_PAGE_COLOR_VA_PROCESS (VirtualAddress, &MmSystemPageColor); // // As this is a system page, there is no need to // remove a page of zeroes, it must be initialized by // the system before being used. // if (PrototypePte) { PageFrameIndex = MiRemoveZeroPage (PageColor); } else { PageFrameIndex = MiRemoveAnyPage (PageColor); } } MmInfoCounters.DemandZeroCount += 1; MiInitializePfn (PageFrameIndex, PointerPte, 1); if (!PrototypePte) { UNLOCK_PFN (APC_LEVEL); } Pfn1 = MI_PFN_ELEMENT (PageFrameIndex); if (NeedToZero) { MiZeroPhysicalPage (PageFrameIndex, PageColor); // // Note the stamping must occur after the page is zeroed. // MI_BARRIER_STAMP_ZEROED_PAGE (&BarrierStamp); } // // As this page is demand zero, set the modified bit in the // PFN database element and set the dirty bit in the PTE. // PERFINFO_SOFTFAULT(Pfn1, VirtualAddress, PERFINFO_LOG_TYPE_DEMANDZEROFAULT) MI_MAKE_VALID_PTE (TempPte, PageFrameIndex, PointerPte->u.Soft.Protection, PointerPte); if (TempPte.u.Hard.Write != 0) { MI_SET_PTE_DIRTY (TempPte); } if (BarrierNeeded) { MI_BARRIER_SYNCHRONIZE (BarrierStamp); } MI_WRITE_VALID_PTE (PointerPte, TempPte); if (!PrototypePte) { ASSERT (Pfn1->u1.Event == 0); CONSISTENCY_LOCK_PFN (OldIrql); Pfn1->u1.Event = (PVOID)PsGetCurrentThread(); CONSISTENCY_UNLOCK_PFN (OldIrql); MiAddValidPageToWorkingSet (VirtualAddress, PointerPte, Pfn1, 0); } return STATUS_PAGE_FAULT_DEMAND_ZERO; } } if (!PrototypePte) { UNLOCK_PFN (APC_LEVEL); } return STATUS_REFAULT; }

NTSTATUS MiResolveMappedFileFault (  IN PVOID  FaultingAddress, IN PMMPTE  PointerPte, OUT PMMINPAGE_SUPPORT *  ReadBlock, IN PEPROCESS  Process )

Definition at line 1989 of file pagfault.c. References ASSERT, _SUBSECTION::ControlArea, _ETHREAD::DisablePageFaultClustering, _CONTROL_AREA::FilePointer, _ETHREAD::ForwardClusterOnly, HYDRA_PROCESS, KeBugCheckEx(), KeFlushEntireTb(), MDL_IO_PAGE_READ, MDL_PAGES_LOCKED, _MDL::MdlFlags, MI_GET_PAGE_COLOR_FROM_PTE, MI_GET_PAGE_COLOR_FROM_SESSION, MI_PAGE_COLOR_PTE_PROCESS, MI_PFN_ELEMENT, MI_PROTOTYPE_WSINDEX, MI_ZERO_USED_PAGETABLE_ENTRIES_IN_INPAGE_SUPPORT, MiEndingOffset(), MiEnsureAvailablePageOrWait(), MiFormatPte(), MiGetInPageSupportBlock(), MiGetSubsectionAddress, MiGetVirtualAddressMappedByPte, MiInitializeReadInProgressPfn(), MiIsPteOnPdeBoundary, MiRemoveAnyPage(), MiRemoveZeroPage(), MiStartingOffset(), MM_DBG_PTE_UPDATE, MM_MAXIMUM_READ_CLUSTER_SIZE, MM_PROTECTION_EXECUTE_MASK, MmAvailablePages, MmCodeClusterSize, MmDataClusterSize, MmFreeGoal, MmInfoCounters, MmInitializeMdl, MmSessionSpace, NULL, _CONTROL_AREA::NumberOfPfnReferences, PAGE_SHIFT, PAGE_SIZE, _MMINFO_COUNTERS::PageReadCount, _MMINFO_COUNTERS::PageReadIoCount, PERFINFO_DO_PAGEFAULT_CLUSTERING, PsGetCurrentThread, _SUBSECTION::PtesInSubsection, _ETHREAD::ReadClusterSize, STATUS_ISSUE_PAGING_IO, STATUS_REFAULT, _SUBSECTION::SubsectionBase, TRUE, _MMPTE::u, _CONTROL_AREA::u, and _SUBSECTION::u. Referenced by MiResolveProtoPteFault(). 01998 : 01999 02000 This routine builds the MDL and other structures to allow a 02001 read operation on a mapped file for a page fault. 02002 02003 Arguments: 02004 02005 FaultingAddress - Supplies the faulting address. 02006 02007 PointerPte - Supplies the PTE for the faulting address. 02008 02009 ReadBlock - Supplies a pointer to put the address of the read block which 02010 needs to be completed before an I/O can be issued. 02011 02012 Process - Supplies a pointer to the process object. If this 02013 parameter is NULL, then the fault is for system 02014 space and the process's working set lock is not held. 02015 02016 Return Value: 02017 02018 status. A status value of STATUS_ISSUE_PAGING_IO is returned 02019 if this function completes successfully. 02020 02021 Environment: 02022 02023 Kernel mode, PFN lock held. 02024 02025 --*/ 02026 02027 { 02028 PFN_NUMBER PageFrameIndex; 02029 PMMPFN Pfn1; 02030 PSUBSECTION Subsection; 02031 PMDL Mdl; 02032 ULONG ReadSize; 02033 PETHREAD CurrentThread; 02034 PPFN_NUMBER Page; 02035 PPFN_NUMBER EndPage; 02036 PMMPTE BasePte; 02037 PMMPTE CheckPte; 02038 LARGE_INTEGER StartingOffset; 02039 LARGE_INTEGER TempOffset; 02040 PPFN_NUMBER FirstMdlPage; 02041 PMMINPAGE_SUPPORT ReadBlockLocal; 02042 ULONG PageColor; 02043 ULONG ClusterSize; 02044 ULONG Result; 02045 02046 ClusterSize = 0; 02047 02048 ASSERT (PointerPte->u.Soft.Prototype == 1); 02049 02050 // ********************************************* 02051 // Mapped File (subsection format) 02052 // ********************************************* 02053 02054 if (Process == HYDRA_PROCESS) { 02055 Result = MiEnsureAvailablePageOrWait (NULL, FaultingAddress); 02056 } 02057 else { 02058 Result = MiEnsureAvailablePageOrWait (Process, FaultingAddress); 02059 } 02060 02061 if (Result) { 02062 02063 // 02064 // A wait operation was performed which dropped the locks, 02065 // repeat this fault. 02066 // 02067 02068 return STATUS_REFAULT; 02069 } 02070 02071 #if DBG 02072 if (MmDebug & MM_DBG_PTE_UPDATE) { 02073 MiFormatPte (PointerPte); 02074 } 02075 #endif //DBG 02076 02077 // 02078 // Calculate address of subsection for this prototype PTE. 02079 // 02080 02081 Subsection = MiGetSubsectionAddress (PointerPte); 02082 02083 #ifdef LARGE_PAGES 02084 02085 // 02086 // Check to see if this subsection maps a large page, if 02087 // so, just fill the TB and return a status of PTE_CHANGED. 02088 // 02089 02090 if (Subsection->u.SubsectionFlags.LargePages == 1) { 02091 KeFlushEntireTb (TRUE, TRUE); 02092 KeFillLargeEntryTb ((PHARDWARE_PTE)(Subsection + 1), 02093 FaultingAddress, 02094 Subsection->StartingSector); 02095 02096 return STATUS_REFAULT; 02097 } 02098 #endif //LARGE_PAGES 02099 02100 if (Subsection->ControlArea->u.Flags.FailAllIo) { 02101 return STATUS_IN_PAGE_ERROR; 02102 } 02103 02104 if (PointerPte >= &Subsection->SubsectionBase[Subsection->PtesInSubsection]) { 02105 02106 // 02107 // Attempt to read past the end of this subsection. 02108 // 02109 02110 return STATUS_ACCESS_VIOLATION; 02111 } 02112 02113 CurrentThread = PsGetCurrentThread(); 02114 02115 ReadBlockLocal = MiGetInPageSupportBlock (); 02116 if (ReadBlockLocal == NULL) { 02117 return STATUS_REFAULT; 02118 } 02119 *ReadBlock = ReadBlockLocal; 02120 02121 // 02122 // Build MDL for request. 02123 // 02124 02125 Mdl = &ReadBlockLocal->Mdl; 02126 02127 FirstMdlPage = &ReadBlockLocal->Page[0]; 02128 Page = FirstMdlPage; 02129 02130 #if DBG 02131 RtlFillMemoryUlong( Page, (MM_MAXIMUM_READ_CLUSTER_SIZE+1) * sizeof(PFN_NUMBER), 0xf1f1f1f1); 02132 #endif //DBG 02133 02134 ReadSize = PAGE_SIZE; 02135 BasePte = PointerPte; 02136 02137 // 02138 // Should we attempt to perform page fault clustering? 02139 // 02140 02141 if ((!CurrentThread->DisablePageFaultClustering) && 02142 PERFINFO_DO_PAGEFAULT_CLUSTERING() && 02143 (Subsection->ControlArea->u.Flags.NoModifiedWriting == 0)) { 02144 02145 if ((MmAvailablePages > (MmFreeGoal * 2)) 02146 || 02147 (((Subsection->ControlArea->u.Flags.Image != 0) || 02148 (CurrentThread->ForwardClusterOnly)) && 02149 (MmAvailablePages > (MM_MAXIMUM_READ_CLUSTER_SIZE + 16)))) { 02150 02151 // 02152 // Cluster up to n pages. This one + n-1. 02153 // 02154 02155 if (Subsection->ControlArea->u.Flags.Image == 0) { 02156 ASSERT (CurrentThread->ReadClusterSize <= 02157 MM_MAXIMUM_READ_CLUSTER_SIZE); 02158 ClusterSize = CurrentThread->ReadClusterSize; 02159 } else { 02160 ClusterSize = MmDataClusterSize; 02161 if (Subsection->u.SubsectionFlags.Protection & 02162 MM_PROTECTION_EXECUTE_MASK ) { 02163 ClusterSize = MmCodeClusterSize; 02164 } 02165 } 02166 EndPage = Page + ClusterSize; 02167 02168 CheckPte = PointerPte + 1; 02169 02170 // 02171 // Try to cluster within the page of PTEs. 02172 // 02173 02174 while ((MiIsPteOnPdeBoundary(CheckPte) == 0) && 02175 (Page < EndPage) && 02176 (CheckPte < 02177 &Subsection->SubsectionBase[Subsection->PtesInSubsection]) 02178 && (CheckPte->u.Long == BasePte->u.Long)) { 02179 02180 Subsection->ControlArea->NumberOfPfnReferences += 1; 02181 ReadSize += PAGE_SIZE; 02182 Page += 1; 02183 CheckPte += 1; 02184 } 02185 02186 if ((Page < EndPage) && (!CurrentThread->ForwardClusterOnly)) { 02187 02188 // 02189 // Attempt to cluster going backwards from the PTE. 02190 // 02191 02192 CheckPte = PointerPte - 1; 02193 02194 while ((((ULONG_PTR)CheckPte & (PAGE_SIZE - 1)) != 02195 (PAGE_SIZE - sizeof(MMPTE))) && 02196 (Page < EndPage) && 02197 (CheckPte >= Subsection->SubsectionBase) && 02198 (CheckPte->u.Long == BasePte->u.Long)) { 02199 02200 Subsection->ControlArea->NumberOfPfnReferences += 1; 02201 ReadSize += PAGE_SIZE; 02202 Page += 1; 02203 CheckPte -= 1; 02204 } 02205 BasePte = CheckPte + 1; 02206 } 02207 } 02208 } 02209 02210 // 02211 // 02212 // Calculate the offset to read into the file. 02213 // offset = base + ((thispte - basepte) << PAGE_SHIFT) 02214 // 02215 02216 StartingOffset.QuadPart = MiStartingOffset (Subsection, BasePte); 02217 02218 TempOffset = MiEndingOffset(Subsection); 02219 02220 ASSERT (StartingOffset.QuadPart < TempOffset.QuadPart); 02221 02222 // 02223 // Remove pages to fill in the MDL. This is done here as the 02224 // base PTE has been determined and can be used for virtual 02225 // aliasing checks. 02226 // 02227 02228 EndPage = FirstMdlPage; 02229 CheckPte = BasePte; 02230 02231 while (EndPage < Page) { 02232 if (Process == HYDRA_PROCESS) { 02233 PageColor = MI_GET_PAGE_COLOR_FROM_SESSION (MmSessionSpace); 02234 } 02235 else if (Process == NULL) { 02236 PageColor = MI_GET_PAGE_COLOR_FROM_PTE (CheckPte); 02237 } 02238 else { 02239 PageColor = MI_PAGE_COLOR_PTE_PROCESS (CheckPte, 02240 &Process->NextPageColor); 02241 } 02242 *EndPage = MiRemoveAnyPage (PageColor); 02243 02244 EndPage += 1; 02245 CheckPte += 1; 02246 } 02247 02248 if (Process == HYDRA_PROCESS) { 02249 PageColor = MI_GET_PAGE_COLOR_FROM_SESSION (MmSessionSpace); 02250 } 02251 else if (Process == NULL) { 02252 PageColor = MI_GET_PAGE_COLOR_FROM_PTE (CheckPte); 02253 } 02254 else { 02255 PageColor = MI_PAGE_COLOR_PTE_PROCESS (CheckPte, 02256 &Process->NextPageColor); 02257 } 02258 02259 // 02260 // Check to see if the read will go past the end of the file, 02261 // if so, correct the read size and get a zeroed page. 02262 // 02263 02264 MmInfoCounters.PageReadIoCount += 1; 02265 MmInfoCounters.PageReadCount += ReadSize >> PAGE_SHIFT; 02266 02267 if ((Subsection->ControlArea->u.Flags.Image) && 02268 (((UINT64)StartingOffset.QuadPart + ReadSize) > (UINT64)TempOffset.QuadPart)) { 02269 02270 ASSERT ((ULONG)(TempOffset.QuadPart - StartingOffset.QuadPart) 02271 > (ReadSize - PAGE_SIZE)); 02272 02273 ReadSize = (ULONG)(TempOffset.QuadPart - StartingOffset.QuadPart); 02274 02275 PageFrameIndex = MiRemoveZeroPage (PageColor); 02276 02277 } else { 02278 02279 // 02280 // We are reading a complete page, no need to get a zeroed page. 02281 // 02282 02283 PageFrameIndex = MiRemoveAnyPage (PageColor); 02284 } 02285 02286 // 02287 // Increment the PFN reference count in the control area for 02288 // the subsection (PFN MUTEX is required to modify this field). 02289 // 02290 02291 Subsection->ControlArea->NumberOfPfnReferences += 1; 02292 *Page = PageFrameIndex; 02293 02294 PageFrameIndex = *(FirstMdlPage + (PointerPte - BasePte)); 02295 02296 // 02297 // Get a page and put the PTE into the transition state with the 02298 // read-in-progress flag set. 02299 // 02300 02301 Pfn1 = MI_PFN_ELEMENT (PageFrameIndex); 02302 02303 // 02304 // Initialize MDL for request. 02305 // 02306 02307 MmInitializeMdl(Mdl, 02308 MiGetVirtualAddressMappedByPte (BasePte), 02309 ReadSize); 02310 Mdl->MdlFlags |= (MDL_PAGES_LOCKED | MDL_IO_PAGE_READ); 02311 02312 #if DBG 02313 if (ReadSize > ((ClusterSize + 1) << PAGE_SHIFT)) { 02314 KeBugCheckEx (MEMORY_MANAGEMENT, 0x777,(ULONG_PTR)Mdl, (ULONG_PTR)Subsection, 02315 (ULONG)TempOffset.LowPart); 02316 } 02317 #endif //DBG 02318 02319 MiInitializeReadInProgressPfn (Mdl, 02320 BasePte, 02321 &ReadBlockLocal->Event, 02322 MI_PROTOTYPE_WSINDEX); 02323 02324 MI_ZERO_USED_PAGETABLE_ENTRIES_IN_INPAGE_SUPPORT(ReadBlockLocal); 02325 02326 ReadBlockLocal->ReadOffset = StartingOffset; 02327 ReadBlockLocal->FilePointer = Subsection->ControlArea->FilePointer; 02328 ReadBlockLocal->BasePte = BasePte; 02329 ReadBlockLocal->Pfn = Pfn1; 02330 02331 return STATUS_ISSUE_PAGING_IO; 02332 }

NTSTATUS MiResolvePageFileFault (  IN PVOID  FaultingAddress, IN PMMPTE  PointerPte, OUT PMMINPAGE_SUPPORT *  ReadBlock, IN PEPROCESS  Process )

Definition at line 1272 of file pagfault.c. References APC_LEVEL, ASSERT, DbgPrint, _MMPAGING_FILE::File, _MMINPAGE_SUPPORT::FilePointer, GET_PAGING_FILE_NUMBER, GET_PAGING_FILE_OFFSET, HYDRA_PROCESS, MDL_IO_PAGE_READ, MDL_PAGES_LOCKED, MI_GET_PAGE_COLOR_FROM_SESSION, MI_GET_PAGE_COLOR_FROM_VA, MI_IS_PAGE_TABLE_ADDRESS, MI_PAGE_COLOR_VA_PROCESS, MI_PFN_ELEMENT, MI_PROTOTYPE_WSINDEX, MI_RETRIEVE_USED_PAGETABLE_ENTRIES_FROM_PTE, MiEnsureAvailablePageOrWait(), MiGetInPageSupportBlock(), MiGetPteAddress, MiInitializeReadInProgressPfn(), MiRemoveAnyPage(), MM_PFN_LOCK_ASSERT, MmInfoCounters, MmInitializeMdl, MmPagingFile, MmPagingFileDebug, MmSessionSpace, NULL, PAGE_ALIGN, PAGE_SHIFT, PAGE_SIZE, _MMINFO_COUNTERS::PageReadCount, _MMINFO_COUNTERS::PageReadIoCount, PsGetCurrentThread, _MMPAGING_FILE::Size, STATUS_ISSUE_PAGING_IO, STATUS_REFAULT, _MMPTE::u, and UNLOCK_PFN. Referenced by MiDispatchFault(), and MiResolveProtoPteFault(). 01281 : 01282 01283 This routine builds the MDL and other structures to allow a 01284 read operation on a page file for a page fault. 01285 01286 Arguments: 01287 01288 FaultingAddress - Supplies the faulting address. 01289 01290 PointerPte - Supplies the PTE for the faulting address. 01291 01292 ReadBlock - Supplies a pointer to put the address of the read block which 01293 needs to be completed before an I/O can be issued. 01294 01295 Process - Supplies a pointer to the process object. If this 01296 parameter is NULL, then the fault is for system 01297 space and the process's working set lock is not held. 01298 01299 Return Value: 01300 01301 status. A status value of STATUS_ISSUE_PAGING_IO is returned 01302 if this function completes successfully. 01303 01304 Environment: 01305 01306 Kernel mode, PFN lock held. 01307 01308 --*/ 01309 01310 { 01311 LARGE_INTEGER StartingOffset; 01312 PFN_NUMBER PageFrameIndex; 01313 ULONG PageFileNumber; 01314 ULONG WorkingSetIndex; 01315 ULONG PageColor; 01316 MMPTE TempPte; 01317 PETHREAD CurrentThread; 01318 PMMINPAGE_SUPPORT ReadBlockLocal; 01319 01320 // ************************************************** 01321 // Page File Read 01322 // ************************************************** 01323 01324 // 01325 // Calculate the VBN for the in-page operation. 01326 // 01327 01328 CurrentThread = PsGetCurrentThread(); 01329 TempPte = *PointerPte; 01330 01331 if (TempPte.u.Hard.Valid == 1) { 01332 UNLOCK_PFN (APC_LEVEL); 01333 return STATUS_REFAULT; 01334 } 01335 01336 ASSERT (TempPte.u.Soft.Prototype == 0); 01337 ASSERT (TempPte.u.Soft.Transition == 0); 01338 01339 PageFileNumber = GET_PAGING_FILE_NUMBER (TempPte); 01340 StartingOffset.LowPart = GET_PAGING_FILE_OFFSET (TempPte); 01341 01342 ASSERT (StartingOffset.LowPart <= MmPagingFile[PageFileNumber]->Size); 01343 01344 StartingOffset.HighPart = 0; 01345 StartingOffset.QuadPart = StartingOffset.QuadPart << PAGE_SHIFT; 01346 01347 MM_PFN_LOCK_ASSERT(); 01348 if (MiEnsureAvailablePageOrWait (Process, 01349 FaultingAddress)) { 01350 01351 // 01352 // A wait operation was performed which dropped the locks, 01353 // repeat this fault. 01354 // 01355 01356 UNLOCK_PFN (APC_LEVEL); 01357 return STATUS_REFAULT; 01358 } 01359 01360 ReadBlockLocal = MiGetInPageSupportBlock (); 01361 if (ReadBlockLocal == NULL) { 01362 UNLOCK_PFN (APC_LEVEL); 01363 return STATUS_REFAULT; 01364 } 01365 MmInfoCounters.PageReadCount += 1; 01366 MmInfoCounters.PageReadIoCount += 1; 01367 01368 *ReadBlock = ReadBlockLocal; 01369 01370 //fixfix can any of this be moved to after PFN lock released? 01371 01372 ReadBlockLocal->FilePointer = MmPagingFile[PageFileNumber]->File; 01373 01374 #if DBG 01375 01376 if (((StartingOffset.QuadPart >> PAGE_SHIFT) < 8192) && (PageFileNumber == 0)) { 01377 if ((MmPagingFileDebug[StartingOffset.QuadPart >> PAGE_SHIFT] & ~0x1f) != 01378 ((ULONG_PTR)PointerPte << 3)) { 01379 if ((MmPagingFileDebug[StartingOffset.QuadPart >> PAGE_SHIFT] & ~0x1f) != 01380 ((ULONG_PTR)(MiGetPteAddress(FaultingAddress)) << 3)) { 01381 01382 DbgPrint("MMINPAGE: Mismatch PointerPte %p Offset %I64X info %p\n", 01383 PointerPte, 01384 StartingOffset.QuadPart >> PAGE_SHIFT, 01385 MmPagingFileDebug[StartingOffset.QuadPart >> PAGE_SHIFT]); 01386 01387 DbgBreakPoint(); 01388 } 01389 } 01390 } 01391 01392 #endif //DBG 01393 01394 ReadBlockLocal->ReadOffset = StartingOffset; 01395 01396 // 01397 // Get a page and put the PTE into the transition state with the 01398 // read-in-progress flag set. 01399 // 01400 01401 if (Process == HYDRA_PROCESS) { 01402 PageColor = MI_GET_PAGE_COLOR_FROM_SESSION (MmSessionSpace); 01403 } 01404 else if (Process == NULL) { 01405 PageColor = MI_GET_PAGE_COLOR_FROM_VA(FaultingAddress); 01406 } 01407 else { 01408 PageColor = MI_PAGE_COLOR_VA_PROCESS (FaultingAddress, 01409 &Process->NextPageColor); 01410 } 01411 01412 ReadBlockLocal->BasePte = PointerPte; 01413 01414 // 01415 // Build MDL for request. 01416 // 01417 01418 MmInitializeMdl(&ReadBlockLocal->Mdl, PAGE_ALIGN(FaultingAddress), PAGE_SIZE); 01419 ReadBlockLocal->Mdl.MdlFlags |= (MDL_PAGES_LOCKED | MDL_IO_PAGE_READ); 01420 01421 if (MI_IS_PAGE_TABLE_ADDRESS(PointerPte)) { 01422 WorkingSetIndex = 1; 01423 } else { 01424 WorkingSetIndex = MI_PROTOTYPE_WSINDEX; 01425 } 01426 01427 PageFrameIndex = MiRemoveAnyPage (PageColor); 01428 01429 ReadBlockLocal->Pfn = MI_PFN_ELEMENT (PageFrameIndex); 01430 ReadBlockLocal->Page[0] = PageFrameIndex; 01431 01432 MiInitializeReadInProgressPfn ( 01433 &ReadBlockLocal->Mdl, 01434 PointerPte, 01435 &ReadBlockLocal->Event, 01436 WorkingSetIndex); 01437 01438 MI_RETRIEVE_USED_PAGETABLE_ENTRIES_FROM_PTE (ReadBlockLocal, &TempPte); 01439 01440 UNLOCK_PFN (APC_LEVEL); 01441 01442 return STATUS_ISSUE_PAGING_IO; 01443 }

NTSTATUS MiResolveProtoPteFault (  IN BOOLEAN  StoreInstruction, IN PVOID  FaultingAddress, IN PMMPTE  PointerPte, IN PMMPTE  PointerProtoPte, OUT PMMINPAGE_SUPPORT *  ReadBlock, IN PEPROCESS  Process, OUT PLOGICAL  ApcNeeded )

Definition at line 1446 of file pagfault.c. References APC_LEVEL, ASSERT, DbgPrint, FALSE, IS_PTE_NOT_DEMAND_ZERO, KeDelayExecutionThread(), KernelMode, MI_GET_PAGE_FRAME_FROM_PTE, MI_GET_PROTECTION_FROM_SOFT_PTE, MI_PFN_ELEMENT, MI_PTE_LOOKUP_NEEDED, MiAccessCheck(), MiCompleteProtoPteFault(), MiFormatPte(), MiGetSubsectionAddress, MiResolveDemandZeroFault(), MiResolveMappedFileFault(), MiResolvePageFileFault(), MiResolveTransitionFault(), MM_COPY_ON_WRITE_MASK, MM_DBG_PTE_UPDATE, MM_DBG_STOP_ON_ACCVIO, MM_DEMAND_ZERO_WRITE_PTE, MM_PFN_LOCK_ASSERT, MmInfoCounters, MmIsRetryIoStatus, MmShortTime, NT_SUCCESS, NTSTATUS(), NULL, PERFINFO_SOFTFAULT, STATUS_REFAULT, _MMINFO_COUNTERS::TransitionCount, TRUE, _SUBSECTION::u, _MMPTE::u, _MMPFN::u2, and UNLOCK_PFN. Referenced by MiDispatchFault(). : This routine resolves a prototype PTE fault. Arguments: StoreInstruction - Supplies TRUE if the instruction is trying to modify the faulting address (i.e. write access required). FaultingAddress - Supplies the faulting address. PointerPte - Supplies the PTE for the faulting address. PointerProtoPte - Supplies a pointer to the prototype PTE to fault in. ReadBlock - Supplies a pointer to put the address of the read block which needs to be completed before an I/O can be issued. Process - Supplies a pointer to the process object. If this parameter is NULL, then the fault is for system space and the process's working set lock is not held. ApcNeeded - Supplies a pointer to a location set to TRUE if an I/O completion APC is needed to complete partial IRPs that collided. Return Value: status, either STATUS_SUCCESS, STATUS_REFAULT, or an I/O status code. Environment: Kernel mode, PFN lock held. --*/ { MMPTE TempPte; PFN_NUMBER PageFrameIndex; PMMPFN Pfn1; NTSTATUS status; ULONG CopyOnWrite; LOGICAL PfnHeld; PfnHeld = FALSE; // // Acquire the PFN database mutex as the routine to locate a working // set entry decrements the share count of PFN elements. // MM_PFN_LOCK_ASSERT(); #if DBG if (MmDebug & MM_DBG_PTE_UPDATE) { DbgPrint("MM:actual fault %p va %p\n",PointerPte, FaultingAddress); MiFormatPte(PointerPte); } #endif //DBG ASSERT (PointerPte->u.Soft.Prototype == 1); TempPte = *PointerProtoPte; // // The page containing the prototype PTE is resident, // handle the fault referring to the prototype PTE. // If the prototype PTE is already valid, make this // PTE valid and up the share count etc. // if (TempPte.u.Hard.Valid) { // // Prototype PTE is valid. // PageFrameIndex = MI_GET_PAGE_FRAME_FROM_PTE (&TempPte); Pfn1 = MI_PFN_ELEMENT(PageFrameIndex); Pfn1->u2.ShareCount += 1; status = STATUS_SUCCESS; // // Count this as a transition fault. // MmInfoCounters.TransitionCount += 1; PfnHeld = TRUE; PERFINFO_SOFTFAULT(Pfn1, FaultingAddress, PERFINFO_LOG_TYPE_ADDVALIDPAGETOWS) } else { // // Check to make sure the prototype PTE is committed. // if (TempPte.u.Long == 0) { #if DBG if (MmDebug & MM_DBG_STOP_ON_ACCVIO) { DbgPrint("MM:access vio2 - %p\n",FaultingAddress); MiFormatPte(PointerPte); DbgBreakPoint(); } #endif //DEBUG UNLOCK_PFN (APC_LEVEL); return STATUS_ACCESS_VIOLATION; } // // If the PTE indicates that the protection field to be // checked is in the prototype PTE, check it now. // CopyOnWrite = FALSE; if (PointerPte->u.Soft.PageFileHigh != MI_PTE_LOOKUP_NEEDED) { if (PointerPte->u.Proto.ReadOnly == 0) { // // Check for kernel mode access, we have already verified // that the user has access to the virtual address. // #if 0 // removed this assert since mapping drivers via MmMapViewInSystemSpace // file violates the assert. { PSUBSECTION Sub; if (PointerProtoPte->u.Soft.Prototype == 1) { Sub = MiGetSubsectionAddress (PointerProtoPte); ASSERT (Sub->u.SubsectionFlags.Protection == PointerProtoPte->u.Soft.Protection); } } #endif //DBG status = MiAccessCheck (PointerProtoPte, StoreInstruction, KernelMode, MI_GET_PROTECTION_FROM_SOFT_PTE (PointerProtoPte), TRUE); if (status != STATUS_SUCCESS) { #if DBG if (MmDebug & MM_DBG_STOP_ON_ACCVIO) { DbgPrint("MM:access vio3 - %p\n",FaultingAddress); MiFormatPte(PointerPte); MiFormatPte(PointerProtoPte); DbgBreakPoint(); } #endif UNLOCK_PFN (APC_LEVEL); return status; } if ((PointerProtoPte->u.Soft.Protection & MM_COPY_ON_WRITE_MASK) == MM_COPY_ON_WRITE_MASK) { CopyOnWrite = TRUE; } } } else { if ((PointerPte->u.Soft.Protection & MM_COPY_ON_WRITE_MASK) == MM_COPY_ON_WRITE_MASK) { CopyOnWrite = TRUE; } } if ((!IS_PTE_NOT_DEMAND_ZERO(TempPte)) && (CopyOnWrite)) { // // The prototype PTE is demand zero and copy on // write. Make this PTE a private demand zero PTE. // ASSERT (Process != NULL); PointerPte->u.Long = MM_DEMAND_ZERO_WRITE_PTE; UNLOCK_PFN (APC_LEVEL); status = MiResolveDemandZeroFault (FaultingAddress, PointerPte, Process, FALSE); return status; } // // Make the prototype PTE valid, the prototype PTE is in // one of 4 case: // demand zero // transition // paging file // mapped file // if (TempPte.u.Soft.Prototype == 1) { // // Mapped File. // status = MiResolveMappedFileFault (FaultingAddress, PointerProtoPte, ReadBlock, Process); // // Returns with PFN lock held. // PfnHeld = TRUE; } else if (TempPte.u.Soft.Transition == 1) { // // Transition. // status = MiResolveTransitionFault (FaultingAddress, PointerProtoPte, Process, TRUE, ApcNeeded); // // Returns with PFN lock held. // PfnHeld = TRUE; } else if (TempPte.u.Soft.PageFileHigh == 0) { // // Demand Zero // status = MiResolveDemandZeroFault (FaultingAddress, PointerProtoPte, Process, TRUE); // // Returns with PFN lock held! // PfnHeld = TRUE; } else { // // Paging file. // status = MiResolvePageFileFault (FaultingAddress, PointerProtoPte, ReadBlock, Process); // // Returns with PFN lock released. // ASSERT (KeGetCurrentIrql() == APC_LEVEL); } } if (NT_SUCCESS(status)) { ASSERT (PointerPte->u.Hard.Valid == 0); MiCompleteProtoPteFault (StoreInstruction, FaultingAddress, PointerPte, PointerProtoPte); } else { if (PfnHeld) { UNLOCK_PFN (APC_LEVEL); } ASSERT (KeGetCurrentIrql() == APC_LEVEL); // // Stop high priority threads from consuming the CPU on collided // faults for pages that are still marked with inpage errors. All // the threads must let go of the page so it can be freed and the // inpage I/O reissued to the filesystem. // if (MmIsRetryIoStatus(status)) { KeDelayExecutionThread (KernelMode, FALSE, (PLARGE_INTEGER)&MmShortTime); status = STATUS_REFAULT; } } return status; }

NTSTATUS MiResolveTransitionFault (  IN PVOID  FaultingAddress, IN PMMPTE  PointerPte, IN PEPROCESS  CurrentProcess, IN ULONG  PfnLockHeld, OUT PLOGICAL  ApcNeeded )

Definition at line 868 of file pagfault.c. References ActiveAndValid, APC_LEVEL, _ETHREAD::ApcNeeded, ASSERT, DbgPrint, FreePageList, HYDRA_PROCESS, KeEnterCriticalRegion, KeLeaveCriticalRegion, LOCK_PFN, MI_ADD_LOCKED_PAGE_CHARGE_FOR_MODIFIED_PAGE, MI_GET_PAGE_FRAME_FROM_TRANSITION_PTE, MI_MAKE_TRANSITION_PTE_VALID, MI_PFN_ELEMENT, MI_REMOVE_LOCKED_PAGE_CHARGE, MI_SET_PTE_CLEAN, MI_SET_PTE_DIRTY, MI_WRITE_VALID_PTE, MiAddValidPageToWorkingSet(), MiDecrementReferenceCount(), MiFormatPfn(), MiGetPteAddress, MiInsertPageInList(), MiRestoreTransitionPte(), MiUnlinkPageFromList(), MiWaitForInPageComplete(), MM_DBG_COLLIDED_PAGE, MmInfoCounters, MmPagedPoolEnd, MmPagedPoolStart, MmPageLocationList, MmSpecialPoolEnd, MmSpecialPoolStart, _ETHREAD::NestedFaultCount, NT_SUCCESS, NTSTATUS(), NULL, PERFINFO_SOFTFAULT, PsGetCurrentThread, _MMPFN::PteAddress, StandbyPageList, STATUS_REFAULT, _MMINFO_COUNTERS::TransitionCount, TRUE, _MMINPAGE_SUPPORT::u, _MMPTE::u, _MMPFN::u1, _MMPFN::u2, _MMPFN::u3, UNLOCK_PFN, UNLOCK_SESSION_SPACE_WS, UNLOCK_SYSTEM_WS, UNLOCK_WS, and _MMINPAGE_SUPPORT::WaitCount. Referenced by MiDispatchFault(), and MiResolveProtoPteFault(). : This routine resolves a transition page fault. Arguments: FaultingAddress - Supplies the faulting address. PointerPte - Supplies the PTE for the faulting address. CurrentProcess - Supplies a pointer to the process object. If this parameter is NULL, then the fault is for system space and the process's working set lock is not held. PfnLockHeld - Supplies TRUE if the PFN lock is held, FALSE if not. ApcNeeded - Supplies a pointer to a location set to TRUE if an I/O completion APC is needed to complete partial IRPs that collided. It is the caller's responsibility to initialize this (usually to FALSE) on entry. However, since this routine may be called multiple times for a single fault (for the page directory, page table and the page itself), it is possible for it to occasionally be TRUE on entry. If it is FALSE on exit, no completion APC is needed. Return Value: status, either STATUS_SUCCESS, STATUS_REFAULT or an I/O status code. Environment: Kernel mode, PFN lock may optionally be held. --*/ { PFN_NUMBER PageFrameIndex; PMMPFN Pfn1; MMPTE TempPte; NTSTATUS status; NTSTATUS PfnStatus; PMMINPAGE_SUPPORT CapturedEvent; KIRQL OldIrql; PETHREAD CurrentThread; // // *********************************************************** // Transition PTE. // *********************************************************** // // // A transition PTE is either on the free or modified list, // on neither list because of its ReferenceCount // or currently being read in from the disk (read in progress). // If the page is read in progress, this is a collided page // and must be handled accordingly. // if (!PfnLockHeld) { LOCK_PFN (OldIrql); } TempPte = *PointerPte; if ((TempPte.u.Soft.Valid == 0) && (TempPte.u.Soft.Prototype == 0) && (TempPte.u.Soft.Transition == 1)) { // // Still in transition format. // MmInfoCounters.TransitionCount += 1; PageFrameIndex = MI_GET_PAGE_FRAME_FROM_TRANSITION_PTE (&TempPte); Pfn1 = MI_PFN_ELEMENT (PageFrameIndex); if (Pfn1->u3.e1.InPageError) { // // There was an in-page read error and there are other // threads colliding for this page, delay to let the // other threads complete and return. // ASSERT (!NT_SUCCESS(Pfn1->u1.ReadStatus)); if (!PfnLockHeld) { UNLOCK_PFN (APC_LEVEL); } return Pfn1->u1.ReadStatus; } if (Pfn1->u3.e1.ReadInProgress) { // // Collided page fault. // #if DBG if (MmDebug & MM_DBG_COLLIDED_PAGE) { DbgPrint("MM:collided page fault\n"); } #endif CapturedEvent = (PMMINPAGE_SUPPORT)Pfn1->u1.Event; CurrentThread = PsGetCurrentThread(); if (CapturedEvent->u.Thread == CurrentThread) { // // This detects MmCopyToCachedPage deadlocks where both the // user and system address point at the same physical page. // // It also detects when the Io APC completion routine accesses // the same user page (ie: during an overlapped I/O) that // the user thread has already faulted on. // // Both cases above can result in fatal deadlocks and so must // be detected here. Return a unique status code so the // (legitimate) callers know this has happened so it can be // handled properly. In the first case above this means // restarting the entire operation immediately. In the second // case above it means requesting a callback from the Mm // once the first fault has completed. // // Note that non-legitimate callers must get back a failure // status so the thread can be terminated. // ASSERT ((CurrentThread->NestedFaultCount == 1) || (CurrentThread->NestedFaultCount == 2)); CurrentThread->ApcNeeded = 1; if (!PfnLockHeld) { UNLOCK_PFN (APC_LEVEL); } return STATUS_MULTIPLE_FAULT_VIOLATION; } // // Increment the reference count for the page so it won't be // reused until all collisions have been completed. // ASSERT (Pfn1->u2.ShareCount == 0); ASSERT (Pfn1->u3.e2.ReferenceCount != 0); ASSERT (Pfn1->u3.e1.LockCharged == 1); Pfn1->u3.e2.ReferenceCount += 1; CapturedEvent->WaitCount += 1; UNLOCK_PFN (APC_LEVEL); if (CurrentProcess == HYDRA_PROCESS) { CurrentThread = NULL; UNLOCK_SESSION_SPACE_WS (APC_LEVEL); } else if (CurrentProcess != NULL) { // // APCs must be explicitly disabled to prevent suspend APCs from // interrupting this thread before the wait has been issued. // Otherwise the APC can result in this page being locked // indefinitely until the suspend is released. // ASSERT (CurrentThread->NestedFaultCount <= 2); CurrentThread->NestedFaultCount += 1; KeEnterCriticalRegion(); UNLOCK_WS (CurrentProcess); } else { CurrentThread = NULL; UNLOCK_SYSTEM_WS (APC_LEVEL); } status = MiWaitForInPageComplete (Pfn1, PointerPte, FaultingAddress, &TempPte, CapturedEvent, CurrentProcess); // // MiWaitForInPageComplete RETURNS WITH THE WORKING SET LOCK // AND PFN LOCK HELD!!! // if (CurrentThread != NULL) { KeLeaveCriticalRegion(); ASSERT (CurrentThread->NestedFaultCount <= 3); ASSERT (CurrentThread->NestedFaultCount != 0); CurrentThread->NestedFaultCount -= 1; if ((CurrentThread->ApcNeeded == 1) && (CurrentThread->NestedFaultCount == 0)) { *ApcNeeded = TRUE; CurrentThread->ApcNeeded = 0; } } ASSERT (Pfn1->u3.e1.ReadInProgress == 0); if (status != STATUS_SUCCESS) { PfnStatus = Pfn1->u1.ReadStatus; MI_REMOVE_LOCKED_PAGE_CHARGE(Pfn1, 9); MiDecrementReferenceCount (PageFrameIndex); // // Check to see if an I/O error occurred on this page. // If so, try to free the physical page, wait a // half second and return a status of PTE_CHANGED. // This will result in success being returned to // the user and the fault will occur again and should // not be a transition fault this time. // if (Pfn1->u3.e1.InPageError == 1) { ASSERT (!NT_SUCCESS(PfnStatus)); status = PfnStatus; if (Pfn1->u3.e2.ReferenceCount == 0) { Pfn1->u3.e1.InPageError = 0; // // Only restore the transition PTE if the address // space still exists. Another thread may have // deleted the VAD while this thread waited for the // fault to complete - in this case, the frame // will be marked as free already. // if (Pfn1->u3.e1.PageLocation != FreePageList) { ASSERT (Pfn1->u3.e1.PageLocation == StandbyPageList); MiUnlinkPageFromList (Pfn1); MiRestoreTransitionPte (PageFrameIndex); MiInsertPageInList(MmPageLocationList[FreePageList], PageFrameIndex); } } } #if DBG if (MmDebug & MM_DBG_COLLIDED_PAGE) { DbgPrint("MM:decrement ref count - pte changed\n"); MiFormatPfn(Pfn1); } #endif if (!PfnLockHeld) { UNLOCK_PFN (APC_LEVEL); } // // Instead of returning status, always return STATUS_REFAULT. // This is to support filesystems that save state in the // ETHREAD of the thread that serviced the fault ! Since // collided threads never enter the filesystem, their ETHREADs // haven't been hacked up. Since this only matters when // errors occur (specifically STATUS_VERIFY_REQUIRED today), // retry any failed I/O in the context of each collider // to give the filesystems ample opportunity. // return STATUS_REFAULT; } } else { // // PTE refers to a normal transition PTE. // ASSERT (Pfn1->u3.e1.InPageError == 0); if (Pfn1->u3.e1.PageLocation == ActiveAndValid) { // // This page must contain an MmSt allocation of prototype PTEs. // Because these types of pages reside in paged pool (or special // pool) and are part of the system working set, they can be // trimmed at any time regardless of the share count. However, // if the share count is nonzero, then the page state will // remain active and the page will remain in memory - but the // PTE will be set to the transition state. Make the page // valid without incrementing the reference count, but // increment the share count. // ASSERT (((Pfn1->PteAddress >= MiGetPteAddress(MmPagedPoolStart)) && (Pfn1->PteAddress <= MiGetPteAddress(MmPagedPoolEnd))) || ((Pfn1->PteAddress >= MiGetPteAddress(MmSpecialPoolStart)) && (Pfn1->PteAddress <= MiGetPteAddress(MmSpecialPoolEnd)))); // // Don't increment the valid PTE count for the // page table page. // ASSERT (Pfn1->u2.ShareCount != 0); ASSERT (Pfn1->u3.e2.ReferenceCount != 0); } else { MiUnlinkPageFromList (Pfn1); // // Update the PFN database - the reference count must be // incremented as the share count is going to go from zero to 1. // ASSERT (Pfn1->u2.ShareCount == 0); // // The PFN reference count will be 1 already here if the // modified writer has begun a write of this page. Otherwise // it's ordinarily 0. // MI_ADD_LOCKED_PAGE_CHARGE_FOR_MODIFIED_PAGE (Pfn1, 8); Pfn1->u3.e2.ReferenceCount += 1; } } // // Join with collided page fault code to handle updating // the transition PTE. // ASSERT (Pfn1->u3.e1.InPageError == 0); if (Pfn1->u2.ShareCount == 0) { MI_REMOVE_LOCKED_PAGE_CHARGE (Pfn1, 9); } Pfn1->u2.ShareCount += 1; Pfn1->u3.e1.PageLocation = ActiveAndValid; MI_MAKE_TRANSITION_PTE_VALID (TempPte, PointerPte); // // If the modified field is set in the PFN database and this // page is not copy on modify, then set the dirty bit. // This can be done as the modified page will not be // written to the paging file until this PTE is made invalid. // if (Pfn1->u3.e1.Modified && TempPte.u.Hard.Write && (TempPte.u.Hard.CopyOnWrite == 0)) { MI_SET_PTE_DIRTY (TempPte); } else { MI_SET_PTE_CLEAN (TempPte); } MI_WRITE_VALID_PTE (PointerPte, TempPte); if (!PfnLockHeld) { if (Pfn1->u1.Event == 0) { Pfn1->u1.Event = (PVOID)PsGetCurrentThread(); } UNLOCK_PFN (APC_LEVEL); PERFINFO_SOFTFAULT(Pfn1, FaultingAddress, PERFINFO_LOG_TYPE_TRANSITIONFAULT) MiAddValidPageToWorkingSet (FaultingAddress, PointerPte, Pfn1, 0); } return STATUS_PAGE_FAULT_TRANSITION; } else { if (!PfnLockHeld) { UNLOCK_PFN (APC_LEVEL); } } return STATUS_REFAULT; }

NTSTATUS MiSessionCopyOnWrite (  IN PMM_SESSION_SPACE  SessionSpace, IN PVOID  FaultingAddress, IN PMMPTE  PointerPte )

Definition at line 4446 of file pagfault.c. References ASSERT, _MM_SESSION_SPACE::CopyOnWriteCount, _MMINFO_COUNTERS::CopyOnWriteCount, HYDRA_PROCESS, LOCK_PFN, MI_FLUSH_SINGLE_SESSION_TB, MI_GET_PAGE_FRAME_FROM_PTE, MI_GET_SECONDARY_COLOR, MI_IS_PTE_DIRTY, MI_PFN_ELEMENT, MI_SET_ACCESSED_IN_PTE, MI_SET_PTE_DIRTY, MiDecrementShareCount(), MiEnsureAvailablePageOrWait(), MiGetVirtualAddressMappedByPte, MiInitializeCopyOnWritePfn(), MiLocateWsle(), MiMapPageInHyperSpace(), MiRemoveAnyPage(), MiUnmapPageInHyperSpace, MmInfoCounters, MmSessionSpace, NULL, PAGE_SIZE, TRUE, _MMPTE::u, _MMPFN::u1, _MMPFN::u3, UNLOCK_PFN, and WSLE_NUMBER. Referenced by MmAccessFault(). : This function handles copy on write for image mapped session space. Arguments: SessionSpace - Supplies the session space being referenced. FaultingAddress - Supplies the address which caused the page fault. PointerPte - Supplies the pointer to the PTE which caused the page fault. Return Value: STATUS_SUCCESS. Environment: Kernel mode, APCs disabled, session WSL held. --*/ { MMPTE TempPte; MMPTE PreviousPte; PFN_NUMBER PageFrameIndex; PFN_NUMBER NewPageIndex; PULONG CopyTo; KIRQL OldIrql; PMMPFN Pfn1; PVOID VirtualAddress; WSLE_NUMBER WorkingSetIndex; #if defined(_IA64_) UNREFERENCED_PARAMETER (FaultingAddress); #endif PageFrameIndex = MI_GET_PAGE_FRAME_FROM_PTE (PointerPte); Pfn1 = MI_PFN_ELEMENT (PageFrameIndex); ASSERT (Pfn1->u3.e1.PrototypePte == 1); // // Acquire the PFN mutex. // VirtualAddress = MiGetVirtualAddressMappedByPte (PointerPte); WorkingSetIndex = MiLocateWsle (VirtualAddress, SessionSpace->Vm.VmWorkingSetList, Pfn1->u1.WsIndex); LOCK_PFN (OldIrql); // // The page must be copied into a new page. // if (MiEnsureAvailablePageOrWait(HYDRA_PROCESS, NULL)) { // // A wait operation was performed to obtain an available // page and the working set mutex and PFN mutexes have // been released and various things may have changed for // the worse. Rather than examine all the conditions again, // return and if things are still proper, the fault will // be taken again. // UNLOCK_PFN (OldIrql); return STATUS_SUCCESS; } // // Verify that the page did not go into transition while the // PFN lock was released. If it changed state, refault it in. // TempPte = *(volatile MMPTE *)PointerPte; if (!(TempPte.u.Hard.Valid && TempPte.u.Hard.Write == 0)) { UNLOCK_PFN (OldIrql); return STATUS_SUCCESS; } // // Increment the number of private pages. // MmInfoCounters.CopyOnWriteCount += 1; MmSessionSpace->CopyOnWriteCount += 1; // // A page is being copied and made private, the global state of // the shared page does not need to be updated at this point because // it is guaranteed to be clean - no POSIX-style forking is allowed on // session addresses. // ASSERT (Pfn1->u3.e1.Modified == 0); ASSERT (!MI_IS_PTE_DIRTY(*PointerPte)); // // Get a new page with the same color as this page. // NewPageIndex = MiRemoveAnyPage (MI_GET_SECONDARY_COLOR (PageFrameIndex, Pfn1)); MiInitializeCopyOnWritePfn (NewPageIndex, PointerPte, WorkingSetIndex, SessionSpace); UNLOCK_PFN (OldIrql); // // Copy the accessed readonly page into the newly allocated writable page. // CopyTo = (PULONG)MiMapPageInHyperSpace (NewPageIndex, &OldIrql); RtlCopyMemory (CopyTo, VirtualAddress, PAGE_SIZE); MiUnmapPageInHyperSpace (OldIrql); // // Since the page was a copy on write page, make it // accessed, dirty and writable. Also clear the copy-on-write // bit in the PTE. // MI_SET_PTE_DIRTY (TempPte); TempPte.u.Hard.Write = 1; MI_SET_ACCESSED_IN_PTE (&TempPte, 1); TempPte.u.Hard.CopyOnWrite = 0; TempPte.u.Hard.PageFrameNumber = NewPageIndex; // // If the modify bit is set in the PFN database for the // page, the data cache must be flushed. This is due to the // fact that this process may have been cloned and the cache // still contains stale data destined for the page we are // going to remove. // ASSERT (TempPte.u.Hard.Valid == 1); LOCK_PFN (OldIrql); // // Flush the TB entry for this page. // MI_FLUSH_SINGLE_SESSION_TB (FaultingAddress, TRUE, TRUE, (PHARDWARE_PTE)PointerPte, TempPte.u.Flush, PreviousPte); ASSERT (Pfn1->u3.e1.PrototypePte == 1); // // Decrement the share count for the page which was copied // as this PTE no longer refers to it. // MiDecrementShareCount (PageFrameIndex); UNLOCK_PFN (OldIrql); return STATUS_SUCCESS; }

NTSTATUS MiWaitForInPageComplete (  IN PMMPFN  Pfn2, IN PMMPTE  PointerPte, IN PVOID  FaultingAddress, IN PMMPTE  PointerPteContents, IN PMMINPAGE_SUPPORT  InPageSupport, IN PEPROCESS  CurrentProcess )

Definition at line 2335 of file pagfault.c. References ASSERT, BYTE_OFFSET, _MDL::ByteCount, DbgPrint, FALSE, HYDRA_PROCESS, KeBugCheckEx(), KernelMode, KeWaitForSingleObject(), LOCK_PFN, LOCK_SESSION_SPACE_WS, LOCK_SYSTEM_WS, LOCK_WS, _MDL::MappedSystemVa, MDL_LOCK_HELD, MDL_MAPPED_TO_SYSTEM_VA, _MDL::MdlFlags, MI_INSERT_USED_PAGETABLE_ENTRIES_IN_PFN, MI_IS_SYSTEM_CACHE_ADDRESS, MI_MAGIC_AWE_PTEFRAME, MI_PFN_ELEMENT, MI_PTE_LOOKUP_NEEDED, MI_ZERO_USED_PAGETABLE_ENTRIES_IN_PFN, MiCheckVirtualAddress(), MiFaultRetries, MiFindActualFaultingPte(), MiFreeInPageSupportBlock(), MiIoRetryLevel, MiMapPageInHyperSpace(), MiPteToProto, MiUnmapPageInHyperSpace, MiUserFaultRetries, MiUserIoRetryLevel, MiZeroPhysicalPage(), MmIsAddressValid(), MmIsRetryIoStatus, MmUnmapLockedPages(), NT_SUCCESS, NTSTATUS(), NULL, Offset, PAGE_SHIFT, PAGE_SIZE, _MMPFN::PteAddress, _MMPFN::PteFrame, STATUS_PTE_CHANGED, STATUS_REFAULT, TRUE, _MMPTE::u, _MMPFN::u1, _MMPFN::u3, and WrPageIn. Referenced by MiDispatchFault(), and MiResolveTransitionFault(). 02346 : 02347 02348 Waits for a page read to complete. 02349 02350 Arguments: 02351 02352 Pfn - Supplies a pointer to the PFN element for the page being read. 02353 02354 PointerPte - Supplies a pointer to the pte that is in the transition 02355 state. 02356 02357 FaultingAddress - Supplies the faulting address. 02358 02359 PointerPteContents - Supplies the contents of the PTE before the 02360 working set lock was released. 02361 02362 InPageSupport - Supplies a pointer to the inpage support structure 02363 for this read operation. 02364 02365 Return Value: 02366 02367 Returns the status of the in page. 02368 02369 Note that the working set lock is held upon return !!! 02370 02371 Environment: 02372 02373 Kernel mode, APCs disabled. Neither the working set lock nor 02374 the PFN lock may be held. 02375 02376 --*/ 02377 02378 { 02379 PMMPTE NewPointerPte; 02380 PMMPTE ProtoPte; 02381 PMMPFN Pfn1; 02382 PMMPFN Pfn; 02383 PULONG Va; 02384 PPFN_NUMBER Page; 02385 PPFN_NUMBER LastPage; 02386 ULONG Offset; 02387 ULONG Protection; 02388 PMDL Mdl; 02389 KIRQL OldIrql; 02390 NTSTATUS status; 02391 NTSTATUS status2; 02392 02393 // 02394 // Wait for the I/O to complete. Note that we can't wait for all 02395 // the objects simultaneously as other threads/processes could be 02396 // waiting for the same event. The first thread which completes 02397 // the wait and gets the PFN mutex may reuse the event for another 02398 // fault before this thread completes its wait. 02399 // 02400 02401 KeWaitForSingleObject( &InPageSupport->Event, 02402 WrPageIn, 02403 KernelMode, 02404 FALSE, 02405 (PLARGE_INTEGER)NULL); 02406 02407 if (CurrentProcess == HYDRA_PROCESS) { 02408 LOCK_SESSION_SPACE_WS (OldIrql); 02409 } 02410 else if (CurrentProcess != NULL) { 02411 LOCK_WS (CurrentProcess); 02412 } 02413 else { 02414 LOCK_SYSTEM_WS (OldIrql); 02415 } 02416 02417 LOCK_PFN (OldIrql); 02418 02419 ASSERT (Pfn2->u3.e2.ReferenceCount != 0); 02420 02421 // 02422 // Check to see if this is the first thread to complete the in-page 02423 // operation. 02424 // 02425 02426 Pfn = InPageSupport->Pfn; 02427 if (Pfn2 != Pfn) { 02428 ASSERT (Pfn2->PteFrame != MI_MAGIC_AWE_PTEFRAME); 02429 Pfn2->u3.e1.ReadInProgress = 0; 02430 } 02431 02432 // 02433 // Another thread has already serviced the read, check the 02434 // io-error flag in the PFN database to ensure the in-page 02435 // was successful. 02436 // 02437 02438 if (Pfn2->u3.e1.InPageError == 1) { 02439 ASSERT (!NT_SUCCESS(Pfn2->u1.ReadStatus)); 02440 MiFreeInPageSupportBlock (InPageSupport); 02441 02442 if (MmIsRetryIoStatus(Pfn2->u1.ReadStatus)) { 02443 return STATUS_REFAULT; 02444 } 02445 return Pfn2->u1.ReadStatus; 02446 } 02447 02448 if (InPageSupport->Completed == FALSE) { 02449 02450 #if defined(_PREFETCH_) 02451 02452 // 02453 // The ReadInProgress bit for the dummy page is constantly cleared 02454 // below as there are generally multiple inpage blocks pointing to 02455 // the same dummy page. 02456 // 02457 02458 ASSERT ((Pfn->u3.e1.ReadInProgress == 1) || 02459 (Pfn->PteAddress == MI_PF_DUMMY_PAGE_PTE)); 02460 #else 02461 ASSERT (Pfn->u3.e1.ReadInProgress == 1); 02462 #endif 02463 02464 InPageSupport->Completed = TRUE; 02465 02466 Mdl = &InPageSupport->Mdl; 02467 02468 #if defined(_PREFETCH_) 02469 02470 if (InPageSupport->PrefetchMdl != NULL) { 02471 02472 // 02473 // This is a prefetcher-issued read. 02474 // 02475 02476 Mdl = InPageSupport->PrefetchMdl; 02477 } 02478 02479 #endif 02480 02481 if (Mdl->MdlFlags & MDL_MAPPED_TO_SYSTEM_VA) { 02482 #if DBG 02483 Mdl->MdlFlags |= MDL_LOCK_HELD; 02484 #endif //DBG 02485 02486 MmUnmapLockedPages (Mdl->MappedSystemVa, Mdl); 02487 02488 #if DBG 02489 Mdl->MdlFlags &= ~MDL_LOCK_HELD; 02490 #endif //DBG 02491 } 02492 02493 ASSERT (Pfn->PteFrame != MI_MAGIC_AWE_PTEFRAME); 02494 02495 Pfn->u3.e1.ReadInProgress = 0; 02496 Pfn->u1.Event = (PKEVENT)NULL; 02497 02498 #if defined (_WIN64) 02499 // 02500 // Page directory and page table pages are never clustered, 02501 // ensure this is never violated as only one UsedPageTableEntries 02502 // is kept in the inpage support block. 02503 // 02504 02505 if (InPageSupport->UsedPageTableEntries) { 02506 Page = (PPFN_NUMBER)(Mdl + 1); 02507 LastPage = Page + ((Mdl->ByteCount - 1) >> PAGE_SHIFT); 02508 ASSERT (Page == LastPage); 02509 } 02510 02511 #if DBGXX 02512 MiCheckPageTableInPage (Pfn, InPageSupport); 02513 #endif 02514 #endif 02515 02516 MI_INSERT_USED_PAGETABLE_ENTRIES_IN_PFN(Pfn, InPageSupport); 02517 02518 // 02519 // Check the IO_STATUS_BLOCK to ensure the in-page completed successfully. 02520 // 02521 02522 if (!NT_SUCCESS(InPageSupport->IoStatus.Status)) { 02523 02524 if (InPageSupport->IoStatus.Status == STATUS_END_OF_FILE) { 02525 02526 // 02527 // An attempt was made to read past the end of file 02528 // zero all the remaining bytes in the read. 02529 // 02530 02531 Page = (PPFN_NUMBER)(Mdl + 1); 02532 LastPage = Page + ((Mdl->ByteCount - 1) >> PAGE_SHIFT); 02533 02534 while (Page <= LastPage) { 02535 MiZeroPhysicalPage (*Page, 0); 02536 02537 MI_ZERO_USED_PAGETABLE_ENTRIES_IN_PFN(MI_PFN_ELEMENT(*Page)); 02538 02539 Page += 1; 02540 } 02541 02542 } else { 02543 02544 // 02545 // In page io error occurred. 02546 // 02547 02548 status = InPageSupport->IoStatus.Status; 02549 status2 = InPageSupport->IoStatus.Status; 02550 02551 if (status != STATUS_VERIFY_REQUIRED) { 02552 02553 LOGICAL Retry; 02554 02555 Retry = FALSE; 02556 #if DBG 02557 DbgPrint ("MM: inpage I/O error %X\n", 02558 InPageSupport->IoStatus.Status); 02559 #endif 02560 02561 // 02562 // If this page is for paged pool or for paged 02563 // kernel code or page table pages, bugcheck. 02564 // 02565 02566 if ((FaultingAddress > MM_HIGHEST_USER_ADDRESS) && 02567 (!MI_IS_SYSTEM_CACHE_ADDRESS(FaultingAddress))) { 02568 02569 if (MmIsRetryIoStatus(status)) { 02570 02571 MiFaultRetries -= 1; 02572 if (MiFaultRetries != 0) { 02573 Retry = TRUE; 02574 } else { 02575 MiFaultRetries = MiIoRetryLevel; 02576 } 02577 } 02578 02579 if (Retry == FALSE) { 02580 02581 ULONG_PTR PteContents; 02582 02583 // 02584 // The prototype PTE resides in paged pool which may 02585 // not be resident at this point. Check first. 02586 // 02587 02588 if (MmIsAddressValid (PointerPte) == TRUE) { 02589 PteContents = *(PULONG_PTR)PointerPte; 02590 } 02591 else { 02592 PteContents = (ULONG_PTR)-1; 02593 } 02594 02595 KeBugCheckEx (KERNEL_DATA_INPAGE_ERROR, 02596 (ULONG_PTR)PointerPte, 02597 status, 02598 (ULONG_PTR)FaultingAddress, 02599 PteContents); 02600 } 02601 status2 = STATUS_REFAULT; 02602 } 02603 else { 02604 02605 if (MmIsRetryIoStatus(status)) { 02606 02607 MiUserFaultRetries -= 1; 02608 if (MiUserFaultRetries != 0) { 02609 Retry = TRUE; 02610 } else { 02611 MiUserFaultRetries = MiUserIoRetryLevel; 02612 } 02613 } 02614 02615 if (Retry == TRUE) { 02616 status2 = STATUS_REFAULT; 02617 } 02618 } 02619 } 02620 02621 Page = (PPFN_NUMBER)(Mdl + 1); 02622 LastPage = Page + ((Mdl->ByteCount - 1) >> PAGE_SHIFT); 02623 02624 while (Page <= LastPage) { 02625 Pfn1 = MI_PFN_ELEMENT (*Page); 02626 ASSERT (Pfn1->u3.e2.ReferenceCount != 0); 02627 Pfn1->u3.e1.InPageError = 1; 02628 Pfn1->u1.ReadStatus = status; 02629 02630 #if DBG 02631 { 02632 KIRQL Old; 02633 Va = (PULONG)MiMapPageInHyperSpace (*Page,&Old); 02634 RtlFillMemoryUlong (Va, PAGE_SIZE, 0x50444142); 02635 MiUnmapPageInHyperSpace (Old); 02636 } 02637 #endif //DBG 02638 Page += 1; 02639 } 02640 02641 MiFreeInPageSupportBlock (InPageSupport); 02642 return status2; 02643 } 02644 } else { 02645 02646 MiFaultRetries = MiIoRetryLevel; 02647 MiUserFaultRetries = MiUserIoRetryLevel; 02648 02649 if (InPageSupport->IoStatus.Information != Mdl->ByteCount) { 02650 02651 ASSERT (InPageSupport->IoStatus.Information != 0); 02652 02653 // 02654 // Less than a full page was read - zero the remainder 02655 // of the page. 02656 // 02657 02658 Page = (PPFN_NUMBER)(Mdl + 1); 02659 LastPage = Page + ((Mdl->ByteCount - 1) >> PAGE_SHIFT); 02660 Page += ((InPageSupport->IoStatus.Information - 1) >> PAGE_SHIFT); 02661 02662 Offset = BYTE_OFFSET (InPageSupport->IoStatus.Information); 02663 02664 if (Offset != 0) { 02665 KIRQL Old; 02666 Va = (PULONG)((PCHAR)MiMapPageInHyperSpace (*Page, &Old) 02667 + Offset); 02668 02669 RtlZeroMemory (Va, PAGE_SIZE - Offset); 02670 MiUnmapPageInHyperSpace (Old); 02671 } 02672 02673 // 02674 // Zero any remaining pages within the MDL. 02675 // 02676 02677 Page += 1; 02678 02679 while (Page <= LastPage) { 02680 MiZeroPhysicalPage (*Page, 0); 02681 Page += 1; 02682 } 02683 } 02684 } 02685 } 02686 02687 MiFreeInPageSupportBlock (InPageSupport); 02688 02689 // 02690 // Check to see if the faulting PTE has changed. 02691 // 02692 02693 NewPointerPte = MiFindActualFaultingPte (FaultingAddress); 02694 02695 // 02696 // If this PTE is in prototype PTE format, make the pointer to the 02697 // PTE point to the prototype PTE. 02698 // 02699 02700 if (NewPointerPte == (PMMPTE)NULL) { 02701 return STATUS_PTE_CHANGED; 02702 } 02703 02704 if (NewPointerPte != PointerPte) { 02705 02706 // 02707 // Check to make sure the NewPointerPte is not a prototype PTE 02708 // which refers to the page being made valid. 02709 // 02710 02711 if (NewPointerPte->u.Soft.Prototype == 1) { 02712 if (NewPointerPte->u.Soft.PageFileHigh == MI_PTE_LOOKUP_NEEDED) { 02713 02714 ProtoPte = MiCheckVirtualAddress (FaultingAddress, 02715 &Protection); 02716 02717 } else { 02718 ProtoPte = MiPteToProto (NewPointerPte); 02719 } 02720 02721 // 02722 // Make sure the prototype PTE refers to the PTE made valid. 02723 // 02724 02725 if (ProtoPte != PointerPte) { 02726 return STATUS_PTE_CHANGED; 02727 } 02728 02729 // 02730 // If the only difference is the owner mask, everything is okay. 02731 // 02732 02733 if (ProtoPte->u.Long != PointerPteContents->u.Long) { 02734 return STATUS_PTE_CHANGED; 02735 } 02736 } else { 02737 return STATUS_PTE_CHANGED; 02738 } 02739 } else { 02740 02741 if (NewPointerPte->u.Long != PointerPteContents->u.Long) { 02742 return STATUS_PTE_CHANGED; 02743 } 02744 } 02745 return STATUS_SUCCESS; 02746 }

BOOLEAN MmIsAddressValid (  IN PVOID  VirtualAddress  )

Definition at line 3883 of file pagfault.c. References FALSE, MI_IS_PHYSICAL_ADDRESS, MiGetPdeAddress, MiGetPpeAddress, MiGetPteAddress, MiGetVirtualAddressMappedByPde, TRUE, and _MMPTE::u. Referenced by IoFreeDumpRange(), IopCreateSummaryDump(), IopDriverCorrectnessProcessParams(), IopIsAddressRangeValid(), IopIsMemoryRangeReadable(), IoSetDumpRange(), IovpSeedStack(), MiDecrementShareCount(), MiDetachSession(), MiGatherMappedPages(), MiInitMachineDependent(), MiInsertPageInList(), MiInsertStandbyListAtFront(), MiLoadSystemImage(), MiMakeSystemAddressValid(), MiMakeSystemAddressValidPfn(), MiMakeSystemAddressValidPfnSystemWs(), MiMakeSystemAddressValidPfnWs(), MiRemoveImageSessionWide(), MiRestoreTransitionPte(), MiSegmentDelete(), MiSessionAddProcess(), MiSessionCommitImagePages(), MiSessionCommitPageTables(), MiSessionCreateInternal(), MiSessionRemoveProcess(), MiSessionWideReserveImageAddress(), MiSetPagingOfDriver(), MiShareSessionImage(), MiWaitForInPageComplete(), MmDbgReadCheck(), MmDbgReleaseAddress(), MmDbgTranslatePhysicalAddress(), MmDbgTranslatePhysicalAddress64(), MmDbgWriteCheck(), MmMapViewInSessionSpace(), MmSessionCreate(), MmSessionDelete(), MmSessionSetUnloadAddress(), MmSetKernelDumpRange(), MmUnmapViewInSessionSpace(), MmWorkingSetManager(), NtLockVirtualMemory(), NtUnlockVirtualMemory(), RtlWalkFrameChain(), and VerifierFreeTrackedPool(). 03889 : 03890 03891 For a given virtual address this function returns TRUE if no page fault 03892 will occur for a read operation on the address, FALSE otherwise. 03893 03894 Note that after this routine was called, if appropriate locks are not 03895 held, a non-faulting address could fault. 03896 03897 Arguments: 03898 03899 VirtualAddress - Supplies the virtual address to check. 03900 03901 Return Value: 03902 03903 TRUE if a no page fault would be generated reading the virtual address, 03904 FALSE otherwise. 03905 03906 Environment: 03907 03908 Kernel mode. 03909 03910 --*/ 03911 03912 { 03913 PMMPTE PointerPte; 03914 03915 #if defined(_ALPHA_) || defined(_IA64_) 03916 03917 // 03918 // If this is within the physical addressing range, just return TRUE. 03919 // 03920 03921 if (MI_IS_PHYSICAL_ADDRESS(VirtualAddress)) { 03922 return TRUE; 03923 } 03924 03925 #endif // _ALPHA_ || _IA64_ 03926 03927 #if defined (_WIN64) 03928 PointerPte = MiGetPpeAddress (VirtualAddress); 03929 if (PointerPte->u.Hard.Valid == 0) { 03930 return FALSE; 03931 } 03932 #endif 03933 03934 PointerPte = MiGetPdeAddress (VirtualAddress); 03935 if (PointerPte->u.Hard.Valid == 0) { 03936 return FALSE; 03937 } 03938 #ifdef _X86_ 03939 if (PointerPte->u.Hard.LargePage == 1) { 03940 return TRUE; 03941 } 03942 #endif //_X86_ 03943 03944 PointerPte = MiGetPteAddress (VirtualAddress); 03945 if (PointerPte->u.Hard.Valid == 0) { 03946 return FALSE; 03947 } 03948 03949 #ifdef _X86_ 03950 // 03951 // Make sure we're not treating a page directory as a page table here for 03952 // the case where the page directory is mapping a large page. This is 03953 // because the large page bit is valid in PDE formats, but reserved in 03954 // PTE formats and will cause a trap. A virtual address like c0200000 03955 // triggers this case. It's not enough to just check the large page bit 03956 // in the PTE below because of course that bit's been reused by other 03957 // steppings of the processor so we have to look at the address too. 03958 // 03959 if (PointerPte->u.Hard.LargePage == 1) { 03960 PVOID Va; 03961 03962 Va = MiGetVirtualAddressMappedByPde (PointerPte); 03963 if (MI_IS_PHYSICAL_ADDRESS(Va)) { 03964 return FALSE; 03965 } 03966 } 03967 #endif 03968 03969 return TRUE; 03970 }

---

Variable Documentation

MMINPAGE_SUPPORT_LIST MmInPageSupportList

Definition at line 45 of file pagfault.c. Referenced by MiFlushInPageSupportBlock(), MiFreeInPageSupportBlock(), MiGetInPageSupportBlock(), and MmInitSystem().

MMPTE MmSharedUserDataPte

Definition at line 38 of file pagfault.c. Referenced by MiCheckVirtualAddress(), and MmInitSystem().

PVOID MmSpecialPoolEnd

Definition at line 41 of file pagfault.c.

PVOID MmSpecialPoolStart

Definition at line 40 of file pagfault.c.

---