Main Page | Class Hierarchy | Class List | File List | Class Members | File Members

verifier.c File Reference

#include "mi.h"

Go to the source code of this file.

Classes

struct  _VERIFIER_THUNKS
struct  _DRIVER_SPECIFIED_VERIFIER_THUNKS
struct  _VERIFIER_STRING_INFO

Defines

#define THUNKED_API
#define VI_BAD_MAPPERS_MAX   100
#define VI_POOL_ENTRIES_PER_PAGE   (PAGE_SIZE / sizeof(VI_POOL_ENTRY))
#define UNICODE_TAB   0x0009
#define UNICODE_LF   0x000A
#define UNICODE_CR   0x000D
#define UNICODE_SPACE   0x0020
#define UNICODE_CJK_SPACE   0x3000
#define UNICODE_WHITESPACE(_ch)
#define MM_BOOT_IMAGE_SIZE   (16 * 1024 * 1024)
#define ROUND_UP(VALUE, ROUND)
#define X86_HAL_ROUTINE   0
#define POOL_ROUTINE   2
#define VERIFIER_THUNK_IN_HAL(Flag)   (Flag & X86_HAL_ROUTINE)
#define VERIFIER_POOL_ROUTINE(Flag)   (Flag & POOL_ROUTINE)

Typedefs

typedef _VERIFIER_THUNKS VERIFIER_THUNKS
typedef _VERIFIER_THUNKS * PVERIFIER_THUNKS
typedef _DRIVER_SPECIFIED_VERIFIER_THUNKS DRIVER_SPECIFIED_VERIFIER_THUNKS
typedef _DRIVER_SPECIFIED_VERIFIER_THUNKS * PDRIVER_SPECIFIED_VERIFIER_THUNKS
typedef VOID(* PKE_ACQUIRE_SPINLOCK )(IN PKSPIN_LOCK SpinLock, OUT PKIRQL OldIrql)
typedef VOID(* PKE_RELEASE_SPINLOCK )(IN PKSPIN_LOCK SpinLock, IN KIRQL NewIrql)
typedef VOID(* PKE_RAISE_IRQL )(IN KIRQL NewIrql, OUT PKIRQL OldIrql)
typedef VOID(* PKE_LOWER_IRQL )(IN KIRQL NewIrql)
typedef _VERIFIER_STRING_INFO VERIFIER_STRING_INFO
typedef _VERIFIER_STRING_INFO * PVERIFIER_STRING_INFO

Functions

THUNKED_API PVOID VerifierAllocatePool (IN POOL_TYPE PoolType, IN SIZE_T NumberOfBytes)
THUNKED_API PVOID VerifierAllocatePoolWithTag (IN POOL_TYPE PoolType, IN SIZE_T NumberOfBytes, IN ULONG Tag)
THUNKED_API PVOID VerifierAllocatePoolWithQuotaTag (IN POOL_TYPE PoolType, IN SIZE_T NumberOfBytes, IN ULONG Tag)
THUNKED_API PVOID VerifierAllocatePoolWithTagPriority (IN POOL_TYPE PoolType, IN SIZE_T NumberOfBytes, IN ULONG Tag, IN EX_POOL_PRIORITY Priority)
PVOID VeAllocatePoolWithTagPriority (IN POOL_TYPE PoolType, IN SIZE_T NumberOfBytes, IN ULONG Tag, IN EX_POOL_PRIORITY Priority, IN PVOID CallingAddress)
VOID VerifierFreePool (IN PVOID P)
THUNKED_API VOID VerifierFreePoolWithTag (IN PVOID P, IN ULONG TagToFree)
THUNKED_API LONG VerifierSetEvent (IN PRKEVENT Event, IN KPRIORITY Increment, IN BOOLEAN Wait)
THUNKED_API KIRQL FASTCALL VerifierKfRaiseIrql (IN KIRQL NewIrql)
THUNKED_API VOID FASTCALL VerifierKfLowerIrql (IN KIRQL NewIrql)
THUNKED_API VOID VerifierKeRaiseIrql (IN KIRQL NewIrql, OUT PKIRQL OldIrql)
THUNKED_API VOID VerifierKeLowerIrql (IN KIRQL NewIrql)
THUNKED_API VOID VerifierKeAcquireSpinLock (IN PKSPIN_LOCK SpinLock, OUT PKIRQL OldIrql)
THUNKED_API VOID VerifierKeReleaseSpinLock (IN PKSPIN_LOCK SpinLock, IN KIRQL NewIrql)
THUNKED_API KIRQL FASTCALL VerifierKfAcquireSpinLock (IN PKSPIN_LOCK SpinLock)
THUNKED_API VOID FASTCALL VerifierKfReleaseSpinLock (IN PKSPIN_LOCK SpinLock, IN KIRQL NewIrql)
THUNKED_API VOID VerifierKeInitializeTimerEx (IN PKTIMER Timer, IN TIMER_TYPE Type)
THUNKED_API VOID VerifierKeInitializeTimer (IN PKTIMER Timer)
THUNKED_API BOOLEAN FASTCALL VerifierExTryToAcquireFastMutex (IN PFAST_MUTEX FastMutex)
THUNKED_API VOID FASTCALL VerifierExAcquireFastMutex (IN PFAST_MUTEX FastMutex)
THUNKED_API VOID FASTCALL VerifierExReleaseFastMutex (IN PFAST_MUTEX FastMutex)
THUNKED_API VOID FASTCALL VerifierExAcquireFastMutexUnsafe (IN PFAST_MUTEX FastMutex)
THUNKED_API VOID FASTCALL VerifierExReleaseFastMutexUnsafe (IN PFAST_MUTEX FastMutex)
THUNKED_API BOOLEAN VerifierExAcquireResourceExclusive (IN PERESOURCE Resource, IN BOOLEAN Wait)
THUNKED_API VOID FASTCALL VerifierExReleaseResource (IN PERESOURCE Resource)
THUNKED_API KIRQL FASTCALL VerifierKeAcquireQueuedSpinLock (IN KSPIN_LOCK_QUEUE_NUMBER Number)
THUNKED_API VOID FASTCALL VerifierKeReleaseQueuedSpinLock (IN KSPIN_LOCK_QUEUE_NUMBER Number, IN KIRQL OldIrql)
THUNKED_API BOOLEAN VerifierSynchronizeExecution (IN PKINTERRUPT Interrupt, IN PKSYNCHRONIZE_ROUTINE SynchronizeRoutine, IN PVOID SynchronizeContext)
THUNKED_API VOID VerifierProbeAndLockPages (IN OUT PMDL MemoryDescriptorList, IN KPROCESSOR_MODE AccessMode, IN LOCK_OPERATION Operation)
THUNKED_API VOID VerifierProbeAndLockProcessPages (IN OUT PMDL MemoryDescriptorList, IN PEPROCESS Process, IN KPROCESSOR_MODE AccessMode, IN LOCK_OPERATION Operation)
THUNKED_API VOID VerifierProbeAndLockSelectedPages (IN OUT PMDL MemoryDescriptorList, IN PFILE_SEGMENT_ELEMENT SegmentArray, IN KPROCESSOR_MODE AccessMode, IN LOCK_OPERATION Operation)
VOID VerifierUnlockPages (IN OUT PMDL MemoryDescriptorList)
VOID VerifierUnmapLockedPages (IN PVOID BaseAddress, IN PMDL MemoryDescriptorList)
VOID VerifierUnmapIoSpace (IN PVOID BaseAddress, IN SIZE_T NumberOfBytes)
THUNKED_API PVOID VerifierMapIoSpace (IN PHYSICAL_ADDRESS PhysicalAddress, IN SIZE_T NumberOfBytes, IN MEMORY_CACHING_TYPE CacheType)
THUNKED_API PVOID VerifierMapLockedPages (IN PMDL MemoryDescriptorList, IN KPROCESSOR_MODE AccessMode)
THUNKED_API PVOID VerifierMapLockedPagesSpecifyCache (IN PMDL MemoryDescriptorList, IN KPROCESSOR_MODE AccessMode, IN MEMORY_CACHING_TYPE CacheType, IN PVOID RequestedAddress, IN ULONG BugCheckOnFailure, IN MM_PAGE_PRIORITY Priority)
VOID VerifierFreeTrackedPool (IN PVOID VirtualAddress, IN SIZE_T ChargedBytes, IN LOGICAL CheckType, IN LOGICAL SpecialPool)
VOID ViPrintString (IN PUNICODE_STRING DriverName)
LOGICAL ViInjectResourceFailure (VOID)
VOID ViTrimAllSystemPagableMemory (VOID)
VOID ViInitializeEntry (IN PMI_VERIFIER_DRIVER_ENTRY Verifier, IN LOGICAL FirstLoad)
LOGICAL ViReservePoolAllocation (IN PMI_VERIFIER_DRIVER_ENTRY Verifier)
ULONG_PTR ViInsertPoolAllocation (IN PMI_VERIFIER_DRIVER_ENTRY Verifier, IN PVOID VirtualAddress, IN PVOID CallingAddress, IN SIZE_T NumberOfBytes, IN ULONG Tag)
VOID ViCancelPoolAllocation (IN PMI_VERIFIER_DRIVER_ENTRY Verifier)
VOID ViReleasePoolAllocation (IN PMI_VERIFIER_DRIVER_ENTRY Verifier, IN PVOID VirtualAddress, IN ULONG_PTR ListIndex, IN SIZE_T ChargedBytes)
VOID KfSanityCheckRaiseIrql (IN KIRQL NewIrql)
VOID KfSanityCheckLowerIrql (IN KIRQL NewIrql)
LOGICAL MiEnableVerifier (IN PLDR_DATA_TABLE_ENTRY DataTableEntry)
VOID ViInsertVerifierEntry (IN PMI_VERIFIER_DRIVER_ENTRY Verifier)
PVOID ViPostPoolAllocation (IN PVOID VirtualAddress, IN SIZE_T NumberOfBytes, IN POOL_TYPE PoolType, IN ULONG Tag, IN PVOID CallingAddress)
PMI_VERIFIER_DRIVER_ENTRY ViLocateVerifierEntry (IN PVOID SystemAddress)
VOID MiVerifierCheckThunks (IN PLDR_DATA_TABLE_ENTRY DataTableEntry)
LOGICAL ViAddBadMapper (IN PVOID BadMapper)
THUNKED_API PVOID VerifierAllocatePoolWithQuota (IN POOL_TYPE PoolType, IN SIZE_T NumberOfBytes)
LOGICAL MiInitializeDriverVerifierList (IN PLOADER_PARAMETER_BLOCK LoaderBlock)
LOGICAL MiApplyDriverVerifier (IN PLDR_DATA_TABLE_ENTRY DataTableEntry, IN PMI_VERIFIER_DRIVER_ENTRY Verifier)
VOID MiVerifyingDriverUnloading (IN PLDR_DATA_TABLE_ENTRY DataTableEntry)
NTKERNELAPI LOGICAL MmIsDriverVerifying (IN PDRIVER_OBJECT DriverObject)
NTSTATUS MmAddVerifierThunks (IN PVOID ThunkBuffer, IN ULONG ThunkBufferSize)
NTSTATUS MmGetVerifierInformation (OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG Length)
NTSTATUS MmSetVerifierInformation (IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength)
VOID KeRaiseIrql (IN KIRQL NewIrql, OUT PKIRQL OldIrql)
VOID KeLowerIrql (IN KIRQL NewIrql)
VOID KeAcquireSpinLock (IN PKSPIN_LOCK SpinLock, OUT PKIRQL OldIrql)
VOID KeReleaseSpinLock (IN PKSPIN_LOCK SpinLock, IN KIRQL NewIrql)
BOOLEAN ExAcquireResourceExclusive (IN PERESOURCE Resource, IN BOOLEAN Wait)

Variables

MM_DRIVER_VERIFIER_DATA MmVerifierData
ULONG VerifierModifyableOptions
ULONG VerifierOptionChanges
LIST_ENTRY MiSuspectDriverList
LOGICAL MiVerifyAllDrivers
WCHAR MiVerifyRandomDrivers
ULONG MiActiveVerifies
ULONG MiActiveVerifierThunks
ULONG MiNoPageOnRaiseIrql
ULONG MiVerifierStackProtectTime
LOGICAL MmDontVerifyRandomDrivers = TRUE
LOGICAL VerifierSystemSufficientlyBooted
LARGE_INTEGER VerifierRequiredTimeSinceBoot = {(ULONG)(40 * 1000 * 1000 * 10), 1}
LOGICAL VerifierIsTrackingPool = FALSE
KSPIN_LOCK VerifierListLock
KSPIN_LOCK VerifierPoolLock
FAST_MUTEX VerifierPoolMutex
PRTL_BITMAP VerifierLargePagedPoolMap
LIST_ENTRY MiVerifierDriverAddedThunkListHead
LOGICAL MmSpecialPoolCatchOverruns
LOGICAL KernelVerifier = FALSE
ULONG KernelVerifierTickPage = 0x7
KSPIN_LOCK ViBadMapperLock
PVOID ViBadMappers [VI_BAD_MAPPERS_MAX]
int VerifierIrqlData [0x10]
PUNICODE_STRING ViBadDriver
WCHAR Printable [] = L"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
ULONG PrintableChars = sizeof (Printable) / sizeof (Printable[0]) - 1
VERIFIER_THUNKS MiVerifierThunks []

Define Documentation

#define MM_BOOT_IMAGE_SIZE   (16 * 1024 * 1024)
 

Definition at line 3843 of file verifier.c.

#define POOL_ROUTINE   2
 

Definition at line 4511 of file verifier.c.

#define ROUND_UP (  VALUE,
ROUND   ) 
 

Value:

((ULONG)(((ULONG)VALUE + \
                               ((ULONG)ROUND - 1L)) & (~((ULONG)ROUND - 1L))))

Definition at line 4042 of file verifier.c.

#define THUNKED_API
 

Definition at line 22 of file verifier.c.

#define UNICODE_CJK_SPACE   0x3000
 

Definition at line 3112 of file verifier.c.

Referenced by RtlIsTextUnicode().

#define UNICODE_CR   0x000D
 

Definition at line 3110 of file verifier.c.

Referenced by RtlIsTextUnicode().

#define UNICODE_LF   0x000A
 

Definition at line 3109 of file verifier.c.

Referenced by RtlIsTextUnicode().

#define UNICODE_SPACE   0x0020
 

Definition at line 3111 of file verifier.c.

Referenced by CharHandlerToConsole(), FastStreamWrite(), FE_StreamWriteToScreenBuffer(), FE_TranslateOutputToAnsiUnicodeInternal(), GetSystemLineJ(), GetSystemLineP(), GetSystemLineT(), ImeUIComposition(), ImeUIEndComposition(), ImeUIStartComposition(), IncludeCandidateP(), InitConsoleIME(), MakeInfoStringKorea(), MakeStatusStrPRC1(), MakeStatusStrPRC2(), MakeStatusStrTaiwan1(), MakeStatusStrTaiwan2(), NumString(), ReadOutputString(), ReadRectFromScreenBuffer(), RtlIsTextUnicode(), StoreSelection(), WWSB_DoWriteConsole(), WWSB_FillOutput(), WWSB_FillRectangle(), WWSB_WriteChars(), WWSB_WriteOutputString(), WWSB_WriteRectToScreenBuffer(), and WWSB_WriteRegionToScreen().

#define UNICODE_TAB   0x0009
 

Definition at line 3108 of file verifier.c.

Referenced by ECInsertText(), RetrieveNumberOfSpaces(), RetrieveTotalNumberOfSpaces(), RtlIsTextUnicode(), and WWSB_WriteChars().

#define UNICODE_WHITESPACE (  _ch   ) 
 

Value:

(((_ch) == UNICODE_TAB) || \
                                     ((_ch) == UNICODE_LF) || \
                                     ((_ch) == UNICODE_CR) || \
                                     ((_ch) == UNICODE_SPACE) || \
                                     ((_ch) == UNICODE_CJK_SPACE))

Definition at line 3114 of file verifier.c.

Referenced by MiInitializeDriverVerifierList().

#define VERIFIER_POOL_ROUTINE (  Flag   )     (Flag & POOL_ROUTINE)
 

Definition at line 4514 of file verifier.c.

Referenced by MiEnableVerifier().

#define VERIFIER_THUNK_IN_HAL (  Flag   )     (Flag & X86_HAL_ROUTINE)
 

Definition at line 4513 of file verifier.c.

Referenced by MiEnableVerifier().

#define VI_BAD_MAPPERS_MAX   100
 

Definition at line 626 of file verifier.c.

Referenced by ViAddBadMapper().

#define VI_POOL_ENTRIES_PER_PAGE   (PAGE_SIZE / sizeof(VI_POOL_ENTRY))
 

Referenced by ViReservePoolAllocation().

#define X86_HAL_ROUTINE   0
 

Definition at line 4508 of file verifier.c.

Typedef Documentation

typedef struct _DRIVER_SPECIFIED_VERIFIER_THUNKS DRIVER_SPECIFIED_VERIFIER_THUNKS
 

typedef struct _DRIVER_SPECIFIED_VERIFIER_THUNKS * PDRIVER_SPECIFIED_VERIFIER_THUNKS
 

Referenced by MiEnableVerifier(), MiVerifierCheckThunks(), and MmAddVerifierThunks().

typedef VOID(* PKE_ACQUIRE_SPINLOCK)(IN PKSPIN_LOCK SpinLock, OUT PKIRQL OldIrql)
 

Definition at line 2358 of file verifier.c.

Referenced by VerifierKeAcquireSpinLock().

typedef VOID(* PKE_LOWER_IRQL)(IN KIRQL NewIrql)
 

Definition at line 2966 of file verifier.c.

Referenced by VerifierKeLowerIrql().

typedef VOID(* PKE_RAISE_IRQL)(IN KIRQL NewIrql, OUT PKIRQL OldIrql)
 

Definition at line 2927 of file verifier.c.

Referenced by VerifierKeRaiseIrql().

typedef VOID(* PKE_RELEASE_SPINLOCK)(IN PKSPIN_LOCK SpinLock, IN KIRQL NewIrql)
 

Definition at line 2399 of file verifier.c.

Referenced by VerifierKeReleaseSpinLock().

typedef struct _VERIFIER_STRING_INFO * PVERIFIER_STRING_INFO
 

typedef struct _VERIFIER_THUNKS * PVERIFIER_THUNKS
 

Referenced by MiEnableVerifier().

typedef struct _VERIFIER_STRING_INFO VERIFIER_STRING_INFO
 

typedef struct _VERIFIER_THUNKS VERIFIER_THUNKS
 

Function Documentation

BOOLEAN ExAcquireResourceExclusive (  IN PERESOURCE  Resource,
IN BOOLEAN  Wait
) 
 

VOID KeAcquireSpinLock (  IN PKSPIN_LOCK  SpinLock,
OUT PKIRQL  OldIrql
) 
 

VOID KeLowerIrql (  IN KIRQL  NewIrql  ) 
 

Referenced by CmNotifyRunDown(), CmpNotifyChangeKey(), CmpPostApcRunDown(), CmpPostNotify(), CmpReportNotifyHelper(), ExAllocatePool(), ExFreePool(), ExUnlockPool(), IoCancelFileOpen(), IoCancelThreadIo(), IopCancelAlertedRequest(), IopCloseFile(), IopDeleteFile(), IopDisassociateThreadIrp(), IopParseDevice(), IopSynchronousServiceTail(), IoStartPacket(), IovpCompleteRequest5(), KdDisableDebugger(), KdEnableDebugger(), KdLogDbgPrint(), KdPollBreakIn(), KeChangeColorPage(), KeConnectInterrupt(), KeContextToKframes(), KeDeregisterBugCheckCallback(), KeDisconnectInterrupt(), KeFlushEntireTb(), KeFlushIoBuffers(), KeFlushMultipleTb(), KeFlushMultipleTb64(), KeFlushSingleTb(), KeFlushSingleTb64(), KeInsertQueueDpc(), KeRegisterBugCheckCallback(), KeSetAutoAlignmentThread(), KeSetSystemTime(), KeStartProfile(), KeStopProfile(), KeSweepCacheRange(), KeSweepDcache(), KeSweepDcacheRange(), KeSweepIcache(), KeSweepIcacheRange(), KeSynchronizeMemoryAccess(), KeThawExecution(), KiContinue(), KiDeliverApc(), KiEmulateByteWord(), KiEmulateReference(), KiFreezeTargetExecution(), KiInitializeKernel(), KiIpiGenericCall(), KiTimerListExpire(), MiCheckVirtualAddress(), MiEmptyWorkingSet(), MiGatherMappedPages(), MiGatherPagefilePages(), MiInitMachineDependent(), MiMappedPageWriter(), MiReleaseSystemPtes(), MiReserveSystemPtes2(), MmAccessFault(), MmCopyToCachedPage(), MmTrimAllSystemPagableMemory(), MmWorkingSetManager(), NtCancelIoFile(), NTFastDOSIO(), NtGetContextThread(), NtNotifyChangeMultipleKeys(), NtQueryInformationFile(), NtQueryInformationThread(), NtSetContextThread(), NtSetInformationFile(), Ps386GetVdmIoHandler(), Psp386CreateVdmIoListHead(), Psp386InstallIoHandler(), Psp386RemoveIoHandler(), PspExitThread(), PspSystemThreadStartup(), PspUserThreadStartup(), VdmDispatchPageFault(), VdmFlushPrinterWriteData(), VdmPrinterStatus(), VdmpStartExecution(), VdmQueryDirectoryFile(), VdmTraceEvent(), and VerifierKeLowerIrql().

VOID KeRaiseIrql (  IN KIRQL  NewIrql,
OUT PKIRQL  OldIrql
) 
 

Referenced by CmNotifyRunDown(), CmpNotifyChangeKey(), CmpPostApcRunDown(), CmpPostNotify(), CmpReportNotifyHelper(), ExAllocatePool(), ExFreePool(), ExLockPool(), IoCancelFileOpen(), IoCancelThreadIo(), IopCancelAlertedRequest(), IopCloseFile(), IopDeleteFile(), IopDisassociateThreadIrp(), IopParseDevice(), IopSynchronousServiceTail(), IoStartPacket(), IovpCompleteRequest2(), KdDisableDebugger(), KdEnableDebugger(), KdLogDbgPrint(), KdPollBreakIn(), KeBugCheckEx(), KeConnectInterrupt(), KeDeregisterBugCheckCallback(), KeDisconnectInterrupt(), KeEnterKernelDebugger(), KeFreezeExecution(), KeInsertQueueDpc(), KeRegisterBugCheckCallback(), KeSetAutoAlignmentThread(), KeSetSystemTime(), KeStartProfile(), KeStopProfile(), KiCompleteEffectiveRangeChange(), KiContinue(), KiDeliverApc(), KiEmulateByteWord(), KiEmulateReference(), KiFreezeTargetExecution(), KiInitializeKernel(), KiInitializePAT(), KiIpiGenericCall(), MiCheckVirtualAddress(), MiEmptyWorkingSet(), MiGatherMappedPages(), MiGatherPagefilePages(), MiInitMachineDependent(), MiMappedPageWriter(), MiReleaseSystemPtes(), MiReserveSystemPtes2(), MmAccessFault(), MmCopyToCachedPage(), MmWorkingSetManager(), NtCancelIoFile(), NTFastDOSIO(), NtGetContextThread(), NtNotifyChangeMultipleKeys(), NtQueryInformationFile(), NtQueryInformationThread(), NtSetContextThread(), NtSetInformationFile(), Ps386GetVdmIoHandler(), Psp386CreateVdmIoListHead(), Psp386InstallIoHandler(), Psp386RemoveIoHandler(), VdmDispatchPageFault(), VdmFlushPrinterWriteData(), VdmPrinterStatus(), VdmpStartExecution(), VdmQueryDirectoryFile(), VdmTraceEvent(), and VerifierKeRaiseIrql().

VOID KeReleaseSpinLock (  IN PKSPIN_LOCK  SpinLock,
IN KIRQL  NewIrql
) 
 

Referenced by ExAllocatePool(), ExFreePool(), ExNotifyCallback(), ExRegisterCallback(), ExUnlockPool(), ExUnregisterCallback(), KdDeregisterDebuggerDataBlock(), KdpTimeSlipWork(), KdRegisterDebuggerDataBlock(), KdUpdateTimeSlipEvent(), KeRestoreMtrr(), KeSetPhysicalCacheTypeRange(), KeSweepDcache(), KeSweepIcache(), KiAmdK6InitializeMTRR(), KiAmdK6MtrrSetMemoryType(), KiInitializeKernel(), MemPrint(), MemPrintFlush(), MemPrintWriteCompleteApc(), MemPrintWriteThread(), PspDeleteVdmObjects(), RtlAcquireRemoveLockEx(), RtlReleaseRemoveLock(), UdfAddToWorkque(), UdfFspDispatch(), VdmpDelayIntApcRoutine(), VdmpDelayIntDpcRoutine(), VdmpDelayInterrupt(), and VerifierKeReleaseSpinLock().

VOID KfSanityCheckLowerIrql (  IN KIRQL  NewIrql  ) 
 

Definition at line 2283 of file verifier.c.

References APC_LEVEL, DISPATCH_LEVEL, HIGH_LEVEL, KeBugCheckEx(), and VerifierIrqlData.

Referenced by VerifierKeLowerIrql(), and VerifierKeReleaseSpinLock(). 

02286 {
02287     KIRQL CurrentIrql;
02288 
02289     //
02290     // Check for the caller inadvertently lowering.
02291     //
02292 
02293     CurrentIrql = KeGetCurrentIrql ();
02294 
02295     if (CurrentIrql == NewIrql) {
02296         VerifierIrqlData[8] += 1;
02297         if (CurrentIrql == APC_LEVEL) {
02298             VerifierIrqlData[9] += 1;
02299         }
02300         else if (CurrentIrql == DISPATCH_LEVEL) {
02301             VerifierIrqlData[10] += 1;
02302         }
02303         else {
02304             VerifierIrqlData[11] += 1;
02305         }
02306     }
02307     else {
02308         VerifierIrqlData[12] += 1;
02309     }
02310 
02311     if (CurrentIrql < NewIrql) {
02312         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02313                       0x31,
02314                       CurrentIrql,
02315                       NewIrql,
02316                       0);
02317     }
02318 
02319     //
02320     // Check for the caller using an uninitialized variable.
02321     //
02322 
02323     if (NewIrql > HIGH_LEVEL) {
02324         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02325                       0x31,
02326                       CurrentIrql,
02327                       NewIrql,
02328                       0);
02329     }
02330 }

VOID KfSanityCheckRaiseIrql (  IN KIRQL  NewIrql  ) 
 

Definition at line 2233 of file verifier.c.

References APC_LEVEL, DISPATCH_LEVEL, HIGH_LEVEL, KeBugCheckEx(), and VerifierIrqlData.

Referenced by VerifierKeAcquireSpinLock(), VerifierKeRaiseIrql(), and VerifierSynchronizeExecution(). 

02236 {
02237     KIRQL CurrentIrql;
02238 
02239     //
02240     // Check for the caller inadvertently lowering.
02241     //
02242 
02243     CurrentIrql = KeGetCurrentIrql ();
02244 
02245     if (CurrentIrql == NewIrql) {
02246         VerifierIrqlData[0] += 1;
02247         if (CurrentIrql == APC_LEVEL) {
02248             VerifierIrqlData[1] += 1;
02249         }
02250         else if (CurrentIrql == DISPATCH_LEVEL) {
02251             VerifierIrqlData[2] += 1;
02252         }
02253         else {
02254             VerifierIrqlData[3] += 1;
02255         }
02256     }
02257     else {
02258         VerifierIrqlData[4] += 1;
02259     }
02260 
02261     if (CurrentIrql > NewIrql) {
02262         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02263                       0x30,
02264                       CurrentIrql,
02265                       NewIrql,
02266                       0);
02267     }
02268 
02269     //
02270     // Check for the caller using an uninitialized variable.
02271     //
02272 
02273     if (NewIrql > HIGH_LEVEL) {
02274         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02275                       0x30,
02276                       CurrentIrql,
02277                       NewIrql,
02278                       0);
02279     }
02280 }

LOGICAL MiApplyDriverVerifier (  IN PLDR_DATA_TABLE_ENTRY  DataTableEntry,
IN PMI_VERIFIER_DRIVER_ENTRY  Verifier
) 
 

Definition at line 3448 of file verifier.c.

References ExAllocatePoolWithTag, FALSE, KernelVerifier, KiStackProtectTime, MI_VERIFIER_DRIVER_ENTRY, MiActiveVerifies, MiEnableRandomSpecialPool(), MiEnableVerifier(), MiFaultRetries, MiIoRetryLevel, MiSuspectDriverList, MiUserFaultRetries, MiUserIoRetryLevel, MiVerifierStackProtectTime, MiVerifyAllDrivers, MiVerifyRandomDrivers, MmVerifierData, NonPagedPool, NULL, RtlEqualUnicodeString(), RtlUpcaseUnicodeChar(), TRUE, VI_VERIFYING_DIRECTLY, VI_VERIFYING_INVERSELY, ViInitializeEntry(), ViInsertVerifierEntry(), and ViPrintString().

Referenced by MiInitializeDriverVerifierList(), and MiLoadSystemImage(). 

03455                    :
03456 
03457     This function is called as each module is loaded.  If the module being
03458     loaded is in the suspect list, thunk it here.
03459 
03460 Arguments:
03461 
03462     DataTableEntry - Supplies the data table entry for the module.
03463 
03464     Verifier - Non-NULL if verification must be applied.  FALSE indicates
03465                       that the driver name must match for verification to be
03466                       applied.
03467 
03468 Return Value:
03469 
03470     TRUE if thunking was applied, FALSE if not.
03471 
03472 Environment:
03473 
03474     Kernel mode, Phase 0 Initialization and normal runtime.
03475     Non paged pool exists in Phase0, but paged pool does not.
03476     Post-Phase0 serialization is provided by the MmSystemLoadLock.
03477 
03478 --*/
03479 
03480 {
03481     WCHAR FirstChar;
03482     LOGICAL Found;
03483     PLIST_ENTRY NextEntry;
03484     ULONG VerifierFlags;
03485 
03486     if (Verifier != NULL) {
03487         Found = TRUE;
03488     }
03489     else {
03490         Found = FALSE;
03491         NextEntry = MiSuspectDriverList.Flink;
03492         while (NextEntry != &MiSuspectDriverList) {
03493 
03494             Verifier = CONTAINING_RECORD(NextEntry,
03495                                          MI_VERIFIER_DRIVER_ENTRY,
03496                                          Links);
03497 
03498             if (RtlEqualUnicodeString (&Verifier->BaseName,
03499                                        &DataTableEntry->BaseDllName,
03500                                        TRUE)) {
03501 
03502                 Found = TRUE;
03503                 ViInitializeEntry (Verifier, FALSE);
03504                 break;
03505             }
03506             NextEntry = NextEntry->Flink;
03507         }
03508     }
03509 
03510     if (Found == FALSE) {
03511         VerifierFlags = VI_VERIFYING_DIRECTLY;
03512         if (MiVerifyAllDrivers == TRUE) {
03513             if (KernelVerifier == TRUE) {
03514                 VerifierFlags = VI_VERIFYING_INVERSELY;
03515             }
03516             Found = TRUE;
03517         }
03518         else if (MiVerifyRandomDrivers != (WCHAR)0) {
03519 
03520             //
03521             // Wildcard match drivers randomly.
03522             //
03523 
03524             FirstChar = RtlUpcaseUnicodeChar(DataTableEntry->BaseDllName.Buffer[0]);
03525 
03526             if (MiVerifyRandomDrivers == FirstChar) {
03527                 Found = TRUE;
03528             }
03529             else if (MiVerifyRandomDrivers == (WCHAR)'X') {
03530                 if ((FirstChar >= (WCHAR)'0') && (FirstChar <= (WCHAR)'9')) {
03531                     Found = TRUE;
03532                 }
03533             }
03534         }
03535 
03536         if (Found == FALSE) {
03537             return FALSE;
03538         }
03539 
03540         Verifier = (PMI_VERIFIER_DRIVER_ENTRY)ExAllocatePoolWithTag (
03541                                     NonPagedPool,
03542                                     sizeof (MI_VERIFIER_DRIVER_ENTRY) +
03543                                         DataTableEntry->BaseDllName.MaximumLength,
03544                                     'dLmM');
03545 
03546         if (Verifier == NULL) {
03547             return FALSE;
03548         }
03549 
03550         Verifier->BaseName.Buffer = (PWSTR)((PCHAR)Verifier +
03551                                         sizeof (MI_VERIFIER_DRIVER_ENTRY));
03552         Verifier->BaseName.Length = DataTableEntry->BaseDllName.Length;
03553         Verifier->BaseName.MaximumLength = DataTableEntry->BaseDllName.MaximumLength;
03554 
03555         RtlMoveMemory (Verifier->BaseName.Buffer,
03556                        DataTableEntry->BaseDllName.Buffer,
03557                        DataTableEntry->BaseDllName.Length);
03558 
03559         ViInitializeEntry (Verifier, TRUE);
03560 
03561         Verifier->Flags = VerifierFlags;
03562 
03563         ViInsertVerifierEntry (Verifier);
03564     }
03565 
03566     Verifier->StartAddress = DataTableEntry->DllBase;
03567     Verifier->EndAddress = (PVOID)((ULONG_PTR)DataTableEntry->DllBase + DataTableEntry->SizeOfImage);
03568 
03569     if (MiEnableVerifier (DataTableEntry) == TRUE) {
03570 
03571         if (Verifier->Flags & VI_VERIFYING_DIRECTLY) {
03572             ViPrintString (&DataTableEntry->BaseDllName);
03573         }
03574 
03575         MmVerifierData.Loads += 1;
03576 
03577         Verifier->Loads += 1;
03578 
03579         DataTableEntry->Flags |= LDRP_IMAGE_VERIFYING;
03580         MiActiveVerifies += 1;
03581 
03582         if (MiActiveVerifies == 1) {
03583 
03584             //
03585             // Up the retry mechanism for potential injection failures.
03586             //
03587 
03588             MiIoRetryLevel = (ULONG)-1;
03589             MiFaultRetries = MiIoRetryLevel;
03590             MiUserIoRetryLevel = (ULONG)-1;
03591             MiUserFaultRetries = MiUserIoRetryLevel;
03592 
03593 #ifndef NO_POOL_CHECKS
03594 
03595             //
03596             // If a loaded driver(s) is undergoing validation, the default
03597             // special pool randomizer is disabled as the precious virtual
03598             // address space and physical memory is being put to specific
03599             // use.
03600             //
03601 
03602             MiEnableRandomSpecialPool (FALSE);
03603 #endif
03604             if (MmVerifierData.Level & DRIVER_VERIFIER_FORCE_IRQL_CHECKING) {
03605 
03606                 //
03607                 // Page out all thread stacks as soon as possible to
03608                 // catch drivers using local events that do usermode waits.
03609                 //
03610 
03611                 if (KernelVerifier == FALSE) {
03612                     MiVerifierStackProtectTime = KiStackProtectTime;
03613                     KiStackProtectTime = 0;
03614                 }
03615             }
03616         }
03617     }
03618 
03619     return Found;
03620 }

LOGICAL MiEnableVerifier (  IN PLDR_DATA_TABLE_ENTRY  DataTableEntry  ) 
 

Definition at line 4712 of file verifier.c.

References FALSE, _VERIFIER_THUNKS::Flag, KernelVerifier, MiVerifierDriverAddedThunkListHead, MiVerifierThunks, _VERIFIER_THUNKS::NewRoutine, NULL, _DRIVER_SPECIFIED_VERIFIER_THUNKS::NumberOfThunks, PDRIVER_SPECIFIED_VERIFIER_THUNKS, _VERIFIER_THUNKS::PristineRoutine, PVERIFIER_THUNKS, RtlImageDirectoryEntryToData(), TRUE, VERIFIER_POOL_ROUTINE, and VERIFIER_THUNK_IN_HAL.

Referenced by MiApplyDriverVerifier(). 

04718                    :
04719 
04720     This function enables the verifier for the argument driver by thunking
04721     relevant system APIs in the argument driver import table.
04722 
04723 Arguments:
04724 
04725     DataTableEntry - Supplies the data table entry for the driver.
04726 
04727 Return Value:
04728 
04729     TRUE if thunking was applied, FALSE if not.
04730 
04731 Environment:
04732 
04733     Kernel mode, Phase 0 Initialization and normal runtime.
04734     Non paged pool exists in Phase0, but paged pool does not.
04735 
04736 --*/
04737 
04738 {
04739     ULONG i;
04740     ULONG j;
04741     PULONG_PTR ImportThunk;
04742     ULONG ImportSize;
04743     PVERIFIER_THUNKS VerifierThunk;
04744     ULONG ThunkCount;
04745     LOGICAL Found;
04746     ULONG_PTR RealRoutine;
04747     PULONG_PTR PointerRealRoutine;
04748     PLIST_ENTRY NextEntry;
04749     PDRIVER_VERIFIER_THUNK_PAIRS ThunkTable;
04750     PDRIVER_SPECIFIED_VERIFIER_THUNKS ThunkTableBase;
04751 
04752     ImportThunk = (PULONG_PTR)RtlImageDirectoryEntryToData(
04753                                                DataTableEntry->DllBase,
04754                                                TRUE,
04755                                                IMAGE_DIRECTORY_ENTRY_IAT,
04756                                                &ImportSize);
04757 
04758     if (ImportThunk == NULL) {
04759         return FALSE;
04760     }
04761 
04762     ImportSize /= sizeof(PULONG_PTR);
04763 
04764     for (i = 0; i < ImportSize; i += 1, ImportThunk += 1) {
04765 
04766         Found = FALSE;
04767 
04768         VerifierThunk = MiVerifierThunks;
04769 
04770         for (ThunkCount = 0; ThunkCount < sizeof (MiVerifierThunks) / sizeof (VERIFIER_THUNKS); ThunkCount += 1) {
04771 
04772             if (KernelVerifier == TRUE) {
04773                 if (VERIFIER_POOL_ROUTINE (VerifierThunk->Flag) == 0) {
04774                     VerifierThunk += 1;
04775                     continue;
04776                 }
04777             }
04778 
04779             if (VERIFIER_THUNK_IN_HAL (VerifierThunk->Flag) == 0) {
04780                 RealRoutine = (ULONG_PTR)VerifierThunk->PristineRoutine;
04781             }
04782             else {
04783 
04784                 //
04785                 // Only the x86 has/needs this oddity - take the kernel address,
04786                 // knowing that it points at a 2 byte jmp opcode followed by
04787                 // a 4-byte indirect pointer to a destination address.
04788                 //
04789 
04790                 PointerRealRoutine = (PULONG_PTR)*((PULONG_PTR)((PCHAR)VerifierThunk->PristineRoutine + 2));
04791                 RealRoutine = *PointerRealRoutine;
04792             }
04793 
04794             if (*ImportThunk == RealRoutine) {
04795                 *ImportThunk = (ULONG_PTR)(VerifierThunk->NewRoutine);
04796                 Found = TRUE;
04797                 break;
04798             }
04799             VerifierThunk += 1;
04800         }
04801 
04802         if (Found == FALSE) {
04803 
04804             NextEntry = MiVerifierDriverAddedThunkListHead.Flink;
04805             while (NextEntry != &MiVerifierDriverAddedThunkListHead) {
04806 
04807                 ThunkTableBase = CONTAINING_RECORD(NextEntry,
04808                                                    DRIVER_SPECIFIED_VERIFIER_THUNKS,
04809                                                    ListEntry);
04810 
04811                 ThunkTable = (PDRIVER_VERIFIER_THUNK_PAIRS)(ThunkTableBase + 1);
04812 
04813                 for (j = 0; j < ThunkTableBase->NumberOfThunks; j += 1) {
04814 
04815                     if (*ImportThunk == (ULONG_PTR)ThunkTable->PristineRoutine) {
04816                         *ImportThunk = (ULONG_PTR)(ThunkTable->NewRoutine);
04817                         Found = TRUE;
04818                         break;
04819                     }
04820                     ThunkTable += 1;
04821                 }
04822 
04823                 if (Found == TRUE) {
04824                     break;
04825                 }
04826 
04827                 NextEntry = NextEntry->Flink;
04828             }
04829         }
04830     }
04831     return TRUE;
04832 }

LOGICAL MiInitializeDriverVerifierList (  IN PLOADER_PARAMETER_BLOCK  LoaderBlock  ) 
 

Definition at line 3121 of file verifier.c.

References _MI_VERIFIER_DRIVER_ENTRY::BaseName, End, ExAllocatePoolWithTag, ExInitializeFastMutex, FALSE, _MI_VERIFIER_DRIVER_ENTRY::Flags, IoVerifierInit(), IOVERIFIERINIT_EVERYTHING_TRACKED, IOVERIFIERINIT_PHASE0, IOVERIFIERINIT_VERIFIER_DRIVER_LIST, KeInitializeSpinLock(), KeQueryPerformanceCounter(), KernelVerifier, L, MI_VERIFIER_DRIVER_ENTRY, MiApplyDriverVerifier(), MiSuspectDriverList, MiTriageAddDrivers(), MiVerifierDriverAddedThunkListHead, MiVerifyAllDrivers, MiVerifyRandomDrivers, MmDontVerifyRandomDrivers, MmVerifierData, MmVerifyDriverBuffer, MmVerifyDriverBufferLength, MmVerifyDriverLevel, NonPagedPool, NULL, RtlEqualUnicodeString(), RtlInitUnicodeString(), Start, TRUE, UNICODE_WHITESPACE, USHORT, VerifierListLock, VerifierModifyableOptions, VerifierPoolLock, VerifierPoolMutex, VI_VERIFYING_DIRECTLY, ViBadMapperLock, ViInitializeEntry(), and ViInsertVerifierEntry().

Referenced by MmInitSystem(). 

03127                    :
03128 
03129     Parse the registry setting and set up the list of driver names that will
03130     be put through the validation process.
03131 
03132     Walk the loaded module list and thunk any drivers that need/deserve it.
03133 
03134 Arguments:
03135 
03136     None.
03137 
03138 Return Value:
03139 
03140     TRUE if successful, FALSE if not.
03141 
03142 Environment:
03143 
03144     Kernel mode, Phase 0 Initialization.
03145 
03146     Nonpaged (but not paged) pool exists.
03147 
03148     The PsLoadedModuleList has not been set up yet although the boot drivers
03149     have been relocated to their final resting places.
03150 
03151 --*/
03152 
03153 {
03154     ULONG i;
03155     PLIST_ENTRY NextEntry;
03156     PLDR_DATA_TABLE_ENTRY DataTableEntry;
03157     PWCHAR Start;
03158     PWCHAR End;
03159     PWCHAR Walk;
03160     ULONG NameLength;
03161     PMI_VERIFIER_DRIVER_ENTRY Verifier;
03162     LARGE_INTEGER CurrentTime;
03163     UNICODE_STRING KernelString;
03164     UNICODE_STRING HalString;
03165     PMI_VERIFIER_DRIVER_ENTRY KernelEntry;
03166     PMI_VERIFIER_DRIVER_ENTRY HalEntry;
03167 
03168     InitializeListHead (&MiSuspectDriverList);
03169 
03170     if (MmVerifyDriverLevel != (ULONG)-1) {
03171         if (MmVerifyDriverLevel & DRIVER_VERIFIER_IO_CHECKING) {
03172             if (MmVerifyDriverBufferLength == (ULONG)-1) {
03173                 MmVerifyDriverBufferLength = 0;     // Mm will not page out verifier pages.
03174             }
03175         }
03176     }
03177 
03178     if (MmVerifyDriverBufferLength == (ULONG)-1) {
03179 
03180         if (MmDontVerifyRandomDrivers == TRUE) {
03181             return FALSE;
03182         }
03183 
03184         MmVerifyDriverBufferLength = 0;
03185 
03186         CurrentTime = KeQueryPerformanceCounter (NULL);
03187         CurrentTime.LowPart = (CurrentTime.LowPart % 26);
03188 
03189         MiVerifyRandomDrivers = (WCHAR)'A' + (WCHAR)CurrentTime.LowPart;
03190 
03191         if ((MiVerifyRandomDrivers == (WCHAR)'H') ||
03192             (MiVerifyRandomDrivers == (WCHAR)'J') ||
03193             (MiVerifyRandomDrivers == (WCHAR)'X') ||
03194             (MiVerifyRandomDrivers == (WCHAR)'Y') ||
03195             (MiVerifyRandomDrivers == (WCHAR)'Z')) {
03196                 MiVerifyRandomDrivers = (WCHAR)'X';
03197         }
03198     }
03199 
03200     KeInitializeSpinLock (&ViBadMapperLock);
03201     KeInitializeSpinLock (&VerifierListLock);
03202 
03203     KeInitializeSpinLock (&VerifierPoolLock);
03204     ExInitializeFastMutex (&VerifierPoolMutex);
03205 
03206     InitializeListHead (&MiVerifierDriverAddedThunkListHead);
03207 
03208     //
03209     // If no default is specified, then special pool, pagable code/data
03210     // flushing and pool leak detection are enabled.
03211     //
03212 
03213     if (MmVerifyDriverLevel == (ULONG)-1) {
03214         MmVerifierData.Level = DRIVER_VERIFIER_SPECIAL_POOLING |
03215                                DRIVER_VERIFIER_FORCE_IRQL_CHECKING |
03216                                DRIVER_VERIFIER_TRACK_POOL_ALLOCATIONS;
03217     }
03218     else {
03219         MmVerifierData.Level = MmVerifyDriverLevel;
03220     }
03221 
03222     VerifierModifyableOptions = (DRIVER_VERIFIER_SPECIAL_POOLING |
03223                                  DRIVER_VERIFIER_FORCE_IRQL_CHECKING |
03224                                  DRIVER_VERIFIER_INJECT_ALLOCATION_FAILURES);
03225 
03226     IoVerifierInit (MmVerifierData.Level, IOVERIFIERINIT_PHASE0 |
03227                                           IOVERIFIERINIT_EVERYTHING_TRACKED |
03228                                           IOVERIFIERINIT_VERIFIER_DRIVER_LIST);
03229 
03230     KernelEntry = NULL;
03231     HalEntry = NULL;
03232 
03233     if (MiVerifyRandomDrivers == (WCHAR)0) {
03234 
03235         RtlInitUnicodeString (&KernelString, L"ntoskrnl.exe");
03236         RtlInitUnicodeString (&HalString, L"hal.dll");
03237 
03238         Start = MmVerifyDriverBuffer;
03239         End = MmVerifyDriverBuffer + (MmVerifyDriverBufferLength - sizeof(WCHAR)) / sizeof(WCHAR);
03240 
03241         while (Start < End) {
03242             if (UNICODE_WHITESPACE(*Start)) {
03243                 Start += 1;
03244                 continue;
03245             }
03246 
03247             if (*Start == (WCHAR)'*') {
03248                 MiVerifyAllDrivers = TRUE;
03249                 break;
03250             }
03251 
03252             for (Walk = Start; Walk < End; Walk += 1) {
03253                 if (UNICODE_WHITESPACE(*Walk)) {
03254                     break;
03255                 }
03256             }
03257 
03258             //
03259             // Got a string.  Save it.
03260             //
03261 
03262             NameLength = (ULONG)(Walk - Start + 1) * sizeof (WCHAR);
03263 
03264             Verifier = (PMI_VERIFIER_DRIVER_ENTRY)ExAllocatePoolWithTag (
03265                                         NonPagedPool,
03266                                         sizeof (MI_VERIFIER_DRIVER_ENTRY) +
03267                                                             NameLength,
03268                                         'dLmM');
03269 
03270             if (Verifier == NULL) {
03271                 break;
03272             }
03273 
03274             Verifier->BaseName.Buffer = (PWSTR)((PCHAR)Verifier +
03275                                                 sizeof (MI_VERIFIER_DRIVER_ENTRY));
03276             Verifier->BaseName.Length = (USHORT)NameLength - sizeof (UNICODE_NULL);
03277             Verifier->BaseName.MaximumLength = (USHORT)NameLength;
03278 
03279             RtlMoveMemory (Verifier->BaseName.Buffer,
03280                            Start,
03281                            NameLength - sizeof (UNICODE_NULL));
03282 
03283             ViInitializeEntry (Verifier, TRUE);
03284 
03285             Verifier->Flags |= VI_VERIFYING_DIRECTLY;
03286 
03287             ViInsertVerifierEntry (Verifier);
03288 
03289             if (RtlEqualUnicodeString (&KernelString,
03290                                        &Verifier->BaseName,
03291                                        TRUE)) {
03292 
03293                 //
03294                 // All driver pool allocation calls must be intercepted so
03295                 // they are not mistaken for kernel pool allocations.
03296                 //
03297 
03298                 MiVerifyAllDrivers = TRUE;
03299 
03300                 KernelVerifier = TRUE;
03301                 KernelEntry = Verifier;
03302 
03303             }
03304             else if (RtlEqualUnicodeString (&HalString,
03305                                             &Verifier->BaseName,
03306                                             TRUE)) {
03307                 HalEntry = Verifier;
03308             }
03309 
03310             Start = Walk + 1;
03311         }
03312     }
03313 
03314     if (MiTriageAddDrivers (LoaderBlock) == TRUE) {
03315 
03316         //
03317         // Disable random driver verification if triage has picked driver(s).
03318         //
03319 
03320         MiVerifyRandomDrivers = (WCHAR)0;
03321     }
03322 
03323     //
03324     // Process the boot-loaded drivers now.
03325     //
03326 
03327     i = 0;
03328     NextEntry = LoaderBlock->LoadOrderListHead.Flink;
03329 
03330     for ( ; NextEntry != &LoaderBlock->LoadOrderListHead; NextEntry = NextEntry->Flink) {
03331 
03332         DataTableEntry = CONTAINING_RECORD(NextEntry,
03333                                            LDR_DATA_TABLE_ENTRY,
03334                                            InLoadOrderLinks);
03335 
03336         //
03337         // Process the kernel and HAL specially.
03338         //
03339 
03340         if (i == 0) {
03341             if (KernelEntry != NULL) {
03342                 MiApplyDriverVerifier (DataTableEntry, KernelEntry);
03343             }
03344         }
03345         else if (i == 1) {
03346             if (HalEntry != NULL) {
03347                 MiApplyDriverVerifier (DataTableEntry, HalEntry);
03348             }
03349         }
03350         else {
03351             MiApplyDriverVerifier (DataTableEntry, NULL);
03352         }
03353         i += 1;
03354     }
03355 
03356     return TRUE;
03357 }

VOID MiVerifierCheckThunks (  IN PLDR_DATA_TABLE_ENTRY  DataTableEntry  ) 
 

Referenced by MmUnloadSystemImage().

VOID MiVerifyingDriverUnloading (  IN PLDR_DATA_TABLE_ENTRY  DataTableEntry  ) 
 

Definition at line 3625 of file verifier.c.

References ASSERT, _MI_VERIFIER_DRIVER_ENTRY::BaseName, _MI_VERIFIER_DRIVER_ENTRY::CurrentNonPagedPoolAllocations, _MI_VERIFIER_DRIVER_ENTRY::CurrentPagedPoolAllocations, DbgPrint, _MI_VERIFIER_DRIVER_ENTRY::EndAddress, ExFreePool(), FALSE, KeBugCheckEx(), KernelVerifier, KiStackProtectTime, MiActiveVerifies, MiEnableRandomSpecialPool(), MiNoPageOnRaiseIrql, MiSuspectDriverList, MiVerifierStackProtectTime, MmVerifierData, _MI_VERIFIER_DRIVER_ENTRY::NonPagedBytes, NULL, _MI_VERIFIER_DRIVER_ENTRY::PagedBytes, _MI_VERIFIER_DRIVER_ENTRY::PoolHash, _MI_VERIFIER_DRIVER_ENTRY::PoolHashFree, _MI_VERIFIER_DRIVER_ENTRY::PoolHashReserved, _MI_VERIFIER_DRIVER_ENTRY::PoolHashSize, RtlEqualUnicodeString(), _MI_VERIFIER_DRIVER_ENTRY::StartAddress, TRUE, _MI_VERIFIER_DRIVER_ENTRY::Unloads, VerifierListLock, _MI_VERIFIER_DRIVER_ENTRY::VerifierPoolLock, VI_POOL_FREELIST_END, and ViBadDriver.

Referenced by MmUnloadSystemImage(). 

03631                    :
03632 
03633     This function is called as a driver that was being verified is now being
03634     unloaded.
03635 
03636 Arguments:
03637 
03638     DataTableEntry - Supplies the data table entry for the driver.
03639 
03640 Return Value:
03641 
03642     TRUE if thunking was applied, FALSE if not.
03643 
03644 Environment:
03645 
03646     Kernel mode, Phase 0 Initialization and normal runtime.
03647     Non paged pool exists in Phase0, but paged pool does not.
03648     Post-Phase0 serialization is provided by the MmSystemLoadLock.
03649 
03650 --*/
03651 
03652 {
03653     KIRQL OldIrql;
03654     LOGICAL Found;
03655     PLIST_ENTRY NextEntry;
03656     PMI_VERIFIER_DRIVER_ENTRY Verifier;
03657     PVI_POOL_ENTRY OldHashTable;
03658 
03659     Found = FALSE;
03660     NextEntry = MiSuspectDriverList.Flink;
03661     while (NextEntry != &MiSuspectDriverList) {
03662 
03663         Verifier = CONTAINING_RECORD(NextEntry,
03664                                           MI_VERIFIER_DRIVER_ENTRY,
03665                                           Links);
03666 
03667         if (RtlEqualUnicodeString (&Verifier->BaseName,
03668                                    &DataTableEntry->BaseDllName,
03669                                    TRUE)) {
03670 
03671             Found = TRUE;
03672             break;
03673         }
03674         NextEntry = NextEntry->Flink;
03675     }
03676 
03677     ASSERT (Found == TRUE);
03678 
03679     if (MmVerifierData.Level & DRIVER_VERIFIER_TRACK_POOL_ALLOCATIONS) {
03680 
03681         //
03682         // Better not be any pool left that wasn't freed.  Walk the pagable
03683         // allocations in an attempt to make them all resident for a
03684         // kernel debugger session.
03685         //
03686 
03687         if (Verifier->PagedBytes) {
03688 
03689 #if DBG
03690             DbgPrint ("Driver %wZ leaked %d paged pool allocations (0x%x bytes)\n",
03691                 &DataTableEntry->FullDllName,
03692                 Verifier->CurrentPagedPoolAllocations,
03693                 Verifier->PagedBytes);
03694 #endif
03695 
03696             //
03697             // It would be nice to fault in the driver's paged pool allocations
03698             // now to make debugging easier, but this cannot be easily done
03699             // in a deadlock free manner.
03700             //
03701             // At least disable the paging of pool on IRQL raising in attempt
03702             // to keep some of these allocations resident for debugging.
03703             // No need to undo the increment as we're about to bugcheck anyway.
03704             //
03705 
03706             InterlockedIncrement ((PLONG)&MiNoPageOnRaiseIrql);
03707         }
03708 
03709 #if DBG
03710         if (Verifier->NonPagedBytes) {
03711             DbgPrint ("Driver %wZ leaked %d nonpaged pool allocations (0x%x bytes)\n",
03712                 &DataTableEntry->FullDllName,
03713                 Verifier->CurrentNonPagedPoolAllocations,
03714                 Verifier->NonPagedBytes);
03715         }
03716 #endif
03717 
03718         if (Verifier->PagedBytes || Verifier->NonPagedBytes) {
03719 #if 0
03720             DbgBreakPoint ();
03721             InterlockedDecrement (&MiNoPageOnRaiseIrql);
03722 #else
03723             //
03724             // Snap this so the build/BVT lab can easily triage the culprit.
03725             //
03726 
03727             ViBadDriver = &Verifier->BaseName;
03728 
03729             KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
03730                           0x60,
03731                           Verifier->PagedBytes,
03732                           Verifier->NonPagedBytes,
03733                           Verifier->CurrentPagedPoolAllocations +
03734                             Verifier->CurrentNonPagedPoolAllocations);
03735 #endif
03736         }
03737 
03738         ExAcquireSpinLock (&Verifier->VerifierPoolLock, &OldIrql);
03739 
03740         if (Verifier->PoolHashReserved != 0) {
03741             KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
03742                           0x61,
03743                           Verifier->PagedBytes,
03744                           Verifier->NonPagedBytes,
03745                           Verifier->CurrentPagedPoolAllocations +
03746                             Verifier->CurrentNonPagedPoolAllocations);
03747         }
03748 
03749         OldHashTable = Verifier->PoolHash;
03750         if (OldHashTable != NULL) {
03751             Verifier->PoolHashSize = 0;
03752             Verifier->PoolHashFree = VI_POOL_FREELIST_END;
03753             Verifier->PoolHash = NULL;
03754         }
03755         else {
03756             ASSERT (Verifier->PoolHashSize == 0);
03757             ASSERT (Verifier->PoolHashFree == VI_POOL_FREELIST_END);
03758         }
03759 
03760         ExReleaseSpinLock (&Verifier->VerifierPoolLock, OldIrql);
03761 
03762         if (OldHashTable != NULL) {
03763             ExFreePool (OldHashTable);
03764         }
03765 
03766         //
03767         // Clear these fields so reuse of stale addresses don't trigger
03768         // erroneous bucket fills.
03769         //
03770 
03771         ExAcquireSpinLock (&VerifierListLock, &OldIrql);
03772         Verifier->StartAddress = NULL;
03773         Verifier->EndAddress = NULL;
03774         ExReleaseSpinLock (&VerifierListLock, OldIrql);
03775     }
03776 
03777     Verifier->Unloads += 1;
03778     MmVerifierData.Unloads += 1;
03779     MiActiveVerifies -= 1;
03780 
03781     if (MiActiveVerifies == 0) {
03782 
03783         if (MmVerifierData.Level & DRIVER_VERIFIER_FORCE_IRQL_CHECKING) {
03784 
03785             //
03786             // Return to normal thread stack protection.
03787             //
03788 
03789             if (KernelVerifier == FALSE) {
03790                 KiStackProtectTime = MiVerifierStackProtectTime;
03791             }
03792         }
03793 
03794 #ifndef NO_POOL_CHECKS
03795         MiEnableRandomSpecialPool (TRUE);
03796 #endif
03797     }
03798 }

NTSTATUS MmAddVerifierThunks (  IN PVOID  ThunkBuffer,
IN ULONG  ThunkBufferSize
) 
 

Definition at line 3846 of file verifier.c.

References _DRIVER_SPECIFIED_VERIFIER_THUNKS::DataTableEntry, ExAllocatePoolWithTag, ExFreePool(), FALSE, KeEnterCriticalRegion, KeLeaveCriticalRegion, KeReleaseMutant(), KernelMode, KeWaitForSingleObject(), KSEG0_BASE, _DRIVER_SPECIFIED_VERIFIER_THUNKS::ListEntry, MiActiveVerifierThunks, MiLookupDataTableEntry(), MiVerifierDriverAddedThunkListHead, MM_BOOT_IMAGE_SIZE, MmSystemLoadLock, NULL, _DRIVER_SPECIFIED_VERIFIER_THUNKS::NumberOfThunks, PAGED_CODE, PagedPool, PDRIVER_SPECIFIED_VERIFIER_THUNKS, TRUE, and WrVirtualMemory.

Referenced by NtSetSystemInformation(). 

03853                    :
03854 
03855     This routine adds another set of thunks to the verifier list.
03856 
03857 Arguments:
03858 
03859     ThunkBuffer - Supplies the buffer containing the thunk pairs.
03860 
03861     ThunkBufferSize - Supplies the number of bytes in the thunk buffer.
03862 
03863 Return Value:
03864 
03865     Returns the status of the operation.
03866 
03867 Environment:
03868 
03869     Kernel mode.  APC_LEVEL and below.
03870 
03871 --*/
03872 
03873 {
03874     ULONG i;
03875     ULONG NumberOfThunkPairs;
03876     PDRIVER_VERIFIER_THUNK_PAIRS ThunkPairs;
03877     PDRIVER_VERIFIER_THUNK_PAIRS ThunkTable;
03878     PDRIVER_SPECIFIED_VERIFIER_THUNKS ThunkTableBase;
03879     PLDR_DATA_TABLE_ENTRY DataTableEntry;
03880     PVOID DriverStartAddress;
03881     PVOID DriverEndAddress;
03882 
03883     PAGED_CODE();
03884 
03885     if (MiVerifierDriverAddedThunkListHead.Flink == NULL) {
03886         return STATUS_NOT_SUPPORTED;
03887     }
03888 
03889     ThunkPairs = (PDRIVER_VERIFIER_THUNK_PAIRS)ThunkBuffer;
03890     NumberOfThunkPairs = ThunkBufferSize / sizeof(DRIVER_VERIFIER_THUNK_PAIRS);
03891 
03892     if (NumberOfThunkPairs == 0) {
03893         return STATUS_INVALID_PARAMETER_1;
03894     }
03895 
03896     ThunkTableBase = (PDRIVER_SPECIFIED_VERIFIER_THUNKS) ExAllocatePoolWithTag (
03897                             PagedPool,
03898                             sizeof (DRIVER_SPECIFIED_VERIFIER_THUNKS) + NumberOfThunkPairs * sizeof (DRIVER_VERIFIER_THUNK_PAIRS),
03899                             'tVmM');
03900 
03901     if (ThunkTableBase == NULL) {
03902         return STATUS_INSUFFICIENT_RESOURCES;
03903     }
03904 
03905     ThunkTable = (PDRIVER_VERIFIER_THUNK_PAIRS)(ThunkTableBase + 1);
03906 
03907     RtlCopyMemory (ThunkTable,
03908                    ThunkPairs,
03909                    NumberOfThunkPairs * sizeof(DRIVER_VERIFIER_THUNK_PAIRS));
03910 
03911     KeEnterCriticalRegion();
03912 
03913     KeWaitForSingleObject (&MmSystemLoadLock,
03914                            WrVirtualMemory,
03915                            KernelMode,
03916                            FALSE,
03917                            (PLARGE_INTEGER)NULL);
03918 
03919     //
03920     // Find and validate the image that contains the routines to be thunked.
03921     //
03922 
03923     DataTableEntry = MiLookupDataTableEntry (ThunkTable->PristineRoutine,
03924                                              TRUE);
03925 
03926     if (DataTableEntry == NULL) {
03927         KeReleaseMutant (&MmSystemLoadLock, 1, FALSE, FALSE);
03928         KeLeaveCriticalRegion();
03929         ExFreePool (ThunkTableBase);
03930         return STATUS_INVALID_PARAMETER_2;
03931     }
03932 
03933     DriverStartAddress = (PVOID)(DataTableEntry->DllBase);
03934     DriverEndAddress = (PVOID)((PCHAR)DataTableEntry->DllBase + DataTableEntry->SizeOfImage);
03935 
03936     //
03937     // Don't let drivers hook calls to kernel or HAL routines.
03938     //
03939 
03940     if (DriverStartAddress < (PVOID)(KSEG0_BASE + MM_BOOT_IMAGE_SIZE)) {
03941         KeReleaseMutant (&MmSystemLoadLock, 1, FALSE, FALSE);
03942         KeLeaveCriticalRegion();
03943         ExFreePool (ThunkTableBase);
03944         return STATUS_INVALID_PARAMETER_2;
03945     }
03946 
03947     for (i = 0; i < NumberOfThunkPairs; i += 1) {
03948 
03949         //
03950         // Ensure all the routines being thunked are in the same driver.
03951         //
03952 
03953         if (((ULONG_PTR)ThunkTable->PristineRoutine < (ULONG_PTR)DriverStartAddress) ||
03954             ((ULONG_PTR)ThunkTable->PristineRoutine >= (ULONG_PTR)DriverEndAddress)) {
03955 
03956             KeReleaseMutant (&MmSystemLoadLock, 1, FALSE, FALSE);
03957             KeLeaveCriticalRegion();
03958             ExFreePool (ThunkTableBase);
03959             return STATUS_INVALID_PARAMETER_2;
03960         }
03961         ThunkTable += 1;
03962     }
03963 
03964     //
03965     // Add the validated thunk table to the verifier's global list.
03966     //
03967 
03968     ThunkTableBase->DataTableEntry = DataTableEntry;
03969     ThunkTableBase->NumberOfThunks = NumberOfThunkPairs;
03970     MiActiveVerifierThunks += 1;
03971 
03972     InsertTailList (&MiVerifierDriverAddedThunkListHead,
03973                     &ThunkTableBase->ListEntry);
03974 
03975     KeReleaseMutant (&MmSystemLoadLock, 1, FALSE, FALSE);
03976     KeLeaveCriticalRegion();
03977 
03978     return STATUS_SUCCESS;
03979 }

NTSTATUS MmGetVerifierInformation (  OUT PVOID  SystemInformation,
IN ULONG  SystemInformationLength,
OUT PULONG  Length
) 
 

Definition at line 4046 of file verifier.c.

References _MI_VERIFIER_DRIVER_ENTRY::BaseName, _MI_VERIFIER_DRIVER_ENTRY::CurrentNonPagedPoolAllocations, _MI_VERIFIER_DRIVER_ENTRY::CurrentPagedPoolAllocations, EXCEPTION_EXECUTE_HANDLER, ExRaiseStatus(), FALSE, _MI_VERIFIER_DRIVER_ENTRY::Flags, KeEnterCriticalRegion, KeLeaveCriticalRegion, KeReleaseMutant(), KernelMode, KeWaitForSingleObject(), _MI_VERIFIER_DRIVER_ENTRY::Loads, MiSuspectDriverList, MmSystemLoadLock, MmVerifierData, _MI_VERIFIER_DRIVER_ENTRY::NonPagedBytes, NTSTATUS(), NULL, PAGED_CODE, _MI_VERIFIER_DRIVER_ENTRY::PagedBytes, _MI_VERIFIER_DRIVER_ENTRY::PeakNonPagedBytes, _MI_VERIFIER_DRIVER_ENTRY::PeakNonPagedPoolAllocations, _MI_VERIFIER_DRIVER_ENTRY::PeakPagedBytes, _MI_VERIFIER_DRIVER_ENTRY::PeakPagedPoolAllocations, ROUND_UP, Status, _MI_VERIFIER_DRIVER_ENTRY::Unloads, VI_VERIFYING_DIRECTLY, and WrVirtualMemory.

Referenced by NtQuerySystemInformation(). 

04054                    :
04055 
04056     This routine returns information about drivers undergoing verification.
04057 
04058 Arguments:
04059 
04060     SystemInformation - Returns the driver verification information.
04061 
04062     SystemInformationLength - Supplies the length of the SystemInformation
04063                               buffer.
04064 
04065     Length - Returns the length of the driver verification file information
04066              placed in the buffer.
04067 
04068 Return Value:
04069 
04070     Returns the status of the operation.
04071 
04072 Environment:
04073 
04074     The SystemInformation buffer is in user space and our caller has wrapped
04075     a try-except around this entire routine.  Capture any exceptions here and
04076     release resources accordingly.
04077 
04078 --*/
04079 
04080 {
04081     PSYSTEM_VERIFIER_INFORMATION UserVerifyBuffer;
04082     ULONG NextEntryOffset;
04083     ULONG TotalSize;
04084     NTSTATUS Status;
04085     PLIST_ENTRY NextEntry;
04086     PMI_VERIFIER_DRIVER_ENTRY Verifier;
04087     UNICODE_STRING UserBufferDriverName;
04088 
04089     PAGED_CODE();
04090 
04091     NextEntryOffset = 0;
04092     TotalSize = 0;
04093 
04094     *Length = 0;
04095     UserVerifyBuffer = (PSYSTEM_VERIFIER_INFORMATION)SystemInformation;
04096 
04097     //
04098     // Capture the number of verifying drivers and the relevant data while
04099     // synchronized.  Then return it to our caller.
04100     //
04101 
04102     Status = STATUS_SUCCESS;
04103 
04104     KeEnterCriticalRegion();
04105 
04106     KeWaitForSingleObject (&MmSystemLoadLock,
04107                            WrVirtualMemory,
04108                            KernelMode,
04109                            FALSE,
04110                            (PLARGE_INTEGER)NULL);
04111 
04112     try {
04113 
04114         NextEntry = MiSuspectDriverList.Flink;
04115         while (NextEntry != &MiSuspectDriverList) {
04116 
04117             Verifier = CONTAINING_RECORD(NextEntry,
04118                                               MI_VERIFIER_DRIVER_ENTRY,
04119                                               Links);
04120 
04121             if ((Verifier->Flags & VI_VERIFYING_DIRECTLY) == 0) {
04122                 NextEntry = NextEntry->Flink;
04123                 continue;
04124             }
04125 
04126             UserVerifyBuffer = (PSYSTEM_VERIFIER_INFORMATION)(
04127                                     (PUCHAR)UserVerifyBuffer + NextEntryOffset);
04128             NextEntryOffset = sizeof(SYSTEM_VERIFIER_INFORMATION);
04129             TotalSize += sizeof(SYSTEM_VERIFIER_INFORMATION);
04130 
04131             if (TotalSize > SystemInformationLength) {
04132                 ExRaiseStatus (STATUS_INFO_LENGTH_MISMATCH);
04133             }
04134 
04135             //
04136             // This data is cumulative for all drivers.
04137             //
04138 
04139             UserVerifyBuffer->Level = MmVerifierData.Level;
04140             UserVerifyBuffer->RaiseIrqls = MmVerifierData.RaiseIrqls;
04141             UserVerifyBuffer->AcquireSpinLocks = MmVerifierData.AcquireSpinLocks;
04142 
04143             UserVerifyBuffer->UnTrackedPool = MmVerifierData.UnTrackedPool;
04144             UserVerifyBuffer->SynchronizeExecutions = MmVerifierData.SynchronizeExecutions;
04145 
04146             UserVerifyBuffer->AllocationsAttempted = MmVerifierData.AllocationsAttempted;
04147             UserVerifyBuffer->AllocationsSucceeded = MmVerifierData.AllocationsSucceeded;
04148             UserVerifyBuffer->AllocationsSucceededSpecialPool = MmVerifierData.AllocationsSucceededSpecialPool;
04149             UserVerifyBuffer->AllocationsWithNoTag = MmVerifierData.AllocationsWithNoTag;
04150 
04151             UserVerifyBuffer->TrimRequests = MmVerifierData.TrimRequests;
04152             UserVerifyBuffer->Trims = MmVerifierData.Trims;
04153             UserVerifyBuffer->AllocationsFailed = MmVerifierData.AllocationsFailed;
04154             UserVerifyBuffer->AllocationsFailedDeliberately = MmVerifierData.AllocationsFailedDeliberately;
04155 
04156             //
04157             // This data is kept on a per-driver basis.
04158             //
04159 
04160             UserVerifyBuffer->CurrentPagedPoolAllocations = Verifier->CurrentPagedPoolAllocations;
04161             UserVerifyBuffer->CurrentNonPagedPoolAllocations = Verifier->CurrentNonPagedPoolAllocations;
04162             UserVerifyBuffer->PeakPagedPoolAllocations = Verifier->PeakPagedPoolAllocations;
04163             UserVerifyBuffer->PeakNonPagedPoolAllocations = Verifier->PeakNonPagedPoolAllocations;
04164 
04165             UserVerifyBuffer->PagedPoolUsageInBytes = Verifier->PagedBytes;
04166             UserVerifyBuffer->NonPagedPoolUsageInBytes = Verifier->NonPagedBytes;
04167             UserVerifyBuffer->PeakPagedPoolUsageInBytes = Verifier->PeakPagedBytes;
04168             UserVerifyBuffer->PeakNonPagedPoolUsageInBytes = Verifier->PeakNonPagedBytes;
04169 
04170             UserVerifyBuffer->Loads = Verifier->Loads;
04171             UserVerifyBuffer->Unloads = Verifier->Unloads;
04172 
04173             //
04174             // The DriverName portion of the UserVerifyBuffer must be saved
04175             // locally to protect against a malicious thread changing the
04176             // contents.  This is because we will reference the contents
04177             // ourselves when the actual string is copied out carefully below.
04178             //
04179 
04180             UserBufferDriverName.Length = Verifier->BaseName.Length;
04181             UserBufferDriverName.MaximumLength = Verifier->BaseName.Length + sizeof (WCHAR);
04182             UserBufferDriverName.Buffer = (PWCHAR)(UserVerifyBuffer + 1);
04183 
04184             UserVerifyBuffer->DriverName = UserBufferDriverName;
04185 
04186             TotalSize += ROUND_UP (UserBufferDriverName.MaximumLength,
04187                                    sizeof(ULONG));
04188             NextEntryOffset += ROUND_UP (UserBufferDriverName.MaximumLength,
04189                                          sizeof(ULONG));
04190 
04191             if (TotalSize > SystemInformationLength) {
04192                 ExRaiseStatus (STATUS_INFO_LENGTH_MISMATCH);
04193             }
04194 
04195             //
04196             // Carefully reference the UserVerifyBuffer here.
04197             //
04198 
04199             RtlMoveMemory(UserBufferDriverName.Buffer,
04200                           Verifier->BaseName.Buffer,
04201                           Verifier->BaseName.Length);
04202 
04203             UserBufferDriverName.Buffer[
04204                         Verifier->BaseName.Length/sizeof(WCHAR)] = UNICODE_NULL;
04205             UserVerifyBuffer->NextEntryOffset = NextEntryOffset;
04206 
04207             NextEntry = NextEntry->Flink;
04208         }
04209     } except (EXCEPTION_EXECUTE_HANDLER) {
04210         Status = GetExceptionCode();
04211     }
04212 
04213     KeReleaseMutant (&MmSystemLoadLock, 1, FALSE, FALSE);
04214 
04215     KeLeaveCriticalRegion();
04216 
04217     if (Status != STATUS_INFO_LENGTH_MISMATCH) {
04218         UserVerifyBuffer->NextEntryOffset = 0;
04219         *Length = TotalSize;
04220     }
04221 
04222     return Status;
04223 }

NTKERNELAPI LOGICAL MmIsDriverVerifying (  IN PDRIVER_OBJECT  DriverObject  ) 
 

Definition at line 3802 of file verifier.c.

References FALSE, NULL, and TRUE.

Referenced by IovpIsInterestingDriver(). 

03808                    :
03809 
03810     This function informs the caller if the argument driver is being verified.
03811 
03812 Arguments:
03813 
03814     DriverObject - Supplies the driver object.
03815 
03816 Return Value:
03817 
03818     TRUE if this driver is being verified, FALSE if not.
03819 
03820 Environment:
03821 
03822     Kernel mode, any IRQL, any needed synchronization must be provided by the
03823     caller.
03824 
03825 --*/
03826 
03827 {
03828     PLDR_DATA_TABLE_ENTRY DataTableEntry;
03829 
03830     DataTableEntry = (PLDR_DATA_TABLE_ENTRY)DriverObject->DriverSection;
03831 
03832     if (DataTableEntry == NULL) {
03833         return FALSE;
03834     }
03835 
03836     if ((DataTableEntry->Flags & LDRP_IMAGE_VERIFYING) == 0) {
03837         return FALSE;
03838     }
03839 
03840     return TRUE;
03841 }

NTSTATUS MmSetVerifierInformation (  IN OUT PVOID  SystemInformation,
IN ULONG  SystemInformationLength
) 
 

Definition at line 4226 of file verifier.c.

References EXCEPTION_EXECUTE_HANDLER, ExRaiseStatus(), FALSE, KeEnterCriticalRegion, KeLeaveCriticalRegion, KeReleaseMutant(), KernelMode, KeWaitForSingleObject(), MmSystemLoadLock, MmVerifierData, NTSTATUS(), NULL, PAGED_CODE, Status, VerifierModifyableOptions, VerifierOptionChanges, and WrVirtualMemory.

Referenced by NtSetSystemInformation(). 

04233                    :
04234 
04235     This routine sets any driver verifier flags that can be done without
04236     rebooting.
04237 
04238 Arguments:
04239 
04240     SystemInformation - Gets and returns the driver verification flags.
04241 
04242     SystemInformationLength - Supplies the length of the SystemInformation
04243                               buffer.
04244 
04245 Return Value:
04246 
04247     Returns the status of the operation.
04248 
04249 Environment:
04250 
04251     The SystemInformation buffer is in user space and our caller has wrapped
04252     a try-except around this entire routine.  Capture any exceptions here and
04253     release resources accordingly.
04254 
04255 --*/
04256 
04257 {
04258     ULONG UserFlags;
04259     ULONG NewFlags;
04260     ULONG NewFlagsOn;
04261     ULONG NewFlagsOff;
04262     NTSTATUS Status;
04263     PULONG UserVerifyBuffer;
04264 
04265     PAGED_CODE();
04266 
04267     if (SystemInformationLength < sizeof (ULONG)) {
04268         ExRaiseStatus (STATUS_INFO_LENGTH_MISMATCH);
04269     }
04270 
04271     UserVerifyBuffer = (PULONG)SystemInformation;
04272 
04273     //
04274     // Synchronize all changes to the flags here.
04275     //
04276 
04277     Status = STATUS_SUCCESS;
04278 
04279     KeEnterCriticalRegion();
04280 
04281     KeWaitForSingleObject (&MmSystemLoadLock,
04282                            WrVirtualMemory,
04283                            KernelMode,
04284                            FALSE,
04285                            (PLARGE_INTEGER)NULL);
04286 
04287     try {
04288 
04289         UserFlags = *UserVerifyBuffer;
04290 
04291         //
04292         // Ensure nothing is being set or cleared that isn't supported.
04293         //
04294         //
04295 
04296         NewFlagsOn = UserFlags & VerifierModifyableOptions;
04297 
04298         NewFlags = MmVerifierData.Level | NewFlagsOn;
04299 
04300         //
04301         // Any bits set in NewFlagsOff must be zeroed in the NewFlags.
04302         //
04303 
04304         NewFlagsOff = ((~UserFlags) & VerifierModifyableOptions);
04305 
04306         NewFlags &= ~NewFlagsOff;
04307 
04308         if (NewFlags != MmVerifierData.Level) {
04309             VerifierOptionChanges += 1;
04310             MmVerifierData.Level = NewFlags;
04311             *UserVerifyBuffer = NewFlags;
04312         }
04313 
04314     } except (EXCEPTION_EXECUTE_HANDLER) {
04315         Status = GetExceptionCode();
04316     }
04317 
04318     KeReleaseMutant (&MmSystemLoadLock, 1, FALSE, FALSE);
04319 
04320     KeLeaveCriticalRegion();
04321 
04322     return Status;
04323 }

PVOID VeAllocatePoolWithTagPriority (  IN POOL_TYPE  PoolType,
IN SIZE_T  NumberOfBytes,
IN ULONG  Tag,
IN EX_POOL_PRIORITY  Priority,
IN PVOID  CallingAddress
) 
 

Referenced by ExAllocatePoolWithTag(), VerifierAllocatePool(), VerifierAllocatePoolWithQuota(), VerifierAllocatePoolWithQuotaTag(), VerifierAllocatePoolWithTag(), and VerifierAllocatePoolWithTagPriority().

THUNKED_API PVOID VerifierAllocatePool (  IN POOL_TYPE  PoolType,
IN SIZE_T  NumberOfBytes
) 
 

Definition at line 927 of file verifier.c.

References ExAllocatePool, _MI_VERIFIER_DRIVER_ENTRY::Flags, HighPoolPriority, KernelVerifier, MmVerifierData, NULL, POOL_DRIVER_MASK, RtlGetCallersAddress(), TRUE, VeAllocatePoolWithTagPriority(), VI_VERIFYING_DIRECTLY, and ViLocateVerifierEntry(). 

00931 {
00932     PVOID CallingAddress;
00933     PVOID CallersCaller;
00934     PMI_VERIFIER_DRIVER_ENTRY Verifier;
00935 
00936 #if defined (_X86_)
00937     RtlGetCallersAddress(&CallingAddress, &CallersCaller);
00938 #else
00939     CallingAddress = (PVOID)_ReturnAddress();
00940 #endif
00941 
00942     if (KernelVerifier == TRUE) {
00943 
00944         Verifier = ViLocateVerifierEntry (CallingAddress);
00945 
00946         if ((Verifier == NULL) ||
00947             ((Verifier->Flags & VI_VERIFYING_DIRECTLY) == 0)) {
00948 
00949             return ExAllocatePool (PoolType | POOL_DRIVER_MASK, NumberOfBytes);
00950         }
00951         PoolType |= POOL_DRIVER_MASK;
00952     }
00953 
00954     MmVerifierData.AllocationsWithNoTag += 1;
00955 
00956     return VeAllocatePoolWithTagPriority (PoolType,
00957                                           NumberOfBytes,
00958                                           'parW',
00959                                           HighPoolPriority,
00960                                           CallingAddress);
00961 }

THUNKED_API PVOID VerifierAllocatePoolWithQuota (  IN POOL_TYPE  PoolType,
IN SIZE_T  NumberOfBytes
) 
 

Definition at line 1003 of file verifier.c.

References ExAllocatePoolWithQuota, ExRaiseStatus(), FALSE, _MI_VERIFIER_DRIVER_ENTRY::Flags, HighPoolPriority, KernelVerifier, MmVerifierData, NULL, POOL_DRIVER_MASK, POOL_QUOTA_FAIL_INSTEAD_OF_RAISE, RtlGetCallersAddress(), TRUE, VeAllocatePoolWithTagPriority(), VI_VERIFYING_DIRECTLY, and ViLocateVerifierEntry(). 

01007 {
01008     PVOID Va;
01009     LOGICAL RaiseOnQuotaFailure;
01010     PVOID CallingAddress;
01011     PVOID CallersCaller;
01012     PMI_VERIFIER_DRIVER_ENTRY Verifier;
01013 
01014 #if defined (_X86_)
01015     RtlGetCallersAddress(&CallingAddress, &CallersCaller);
01016 #else
01017     CallingAddress = (PVOID)_ReturnAddress();
01018 #endif
01019 
01020     if (KernelVerifier == TRUE) {
01021         Verifier = ViLocateVerifierEntry (CallingAddress);
01022 
01023         if ((Verifier == NULL) ||
01024             ((Verifier->Flags & VI_VERIFYING_DIRECTLY) == 0)) {
01025 
01026             return ExAllocatePoolWithQuota (PoolType | POOL_DRIVER_MASK,
01027                                             NumberOfBytes);
01028         }
01029         PoolType |= POOL_DRIVER_MASK;
01030     }
01031 
01032     MmVerifierData.AllocationsWithNoTag += 1;
01033 
01034     if (PoolType & POOL_QUOTA_FAIL_INSTEAD_OF_RAISE) {
01035         RaiseOnQuotaFailure = FALSE;
01036         PoolType &= ~POOL_QUOTA_FAIL_INSTEAD_OF_RAISE;
01037     }
01038     else {
01039         RaiseOnQuotaFailure = TRUE;
01040     }
01041 
01042     Va = VeAllocatePoolWithTagPriority (PoolType,
01043                                         NumberOfBytes,
01044                                         'parW',
01045                                         HighPoolPriority,
01046                                         CallingAddress);
01047 
01048     if (Va == NULL) {
01049         if (RaiseOnQuotaFailure == TRUE) {
01050             ExRaiseStatus (STATUS_INSUFFICIENT_RESOURCES);
01051         }
01052     }
01053 
01054     return Va;
01055 }

THUNKED_API PVOID VerifierAllocatePoolWithQuotaTag (  IN POOL_TYPE  PoolType,
IN SIZE_T  NumberOfBytes,
IN ULONG  Tag
) 
 

THUNKED_API PVOID VerifierAllocatePoolWithTag (  IN POOL_TYPE  PoolType,
IN SIZE_T  NumberOfBytes,
IN ULONG  Tag
) 
 

Definition at line 965 of file verifier.c.

References ExAllocatePoolWithTag, _MI_VERIFIER_DRIVER_ENTRY::Flags, HighPoolPriority, KernelVerifier, NULL, POOL_DRIVER_MASK, RtlGetCallersAddress(), TRUE, VeAllocatePoolWithTagPriority(), VI_VERIFYING_DIRECTLY, and ViLocateVerifierEntry(). 

00970 {
00971     PVOID CallingAddress;
00972     PVOID CallersCaller;
00973     PMI_VERIFIER_DRIVER_ENTRY Verifier;
00974 
00975 #if defined (_X86_)
00976     RtlGetCallersAddress(&CallingAddress, &CallersCaller);
00977 #else
00978     CallingAddress = (PVOID)_ReturnAddress();
00979 #endif
00980 
00981     if (KernelVerifier == TRUE) {
00982         Verifier = ViLocateVerifierEntry (CallingAddress);
00983 
00984         if ((Verifier == NULL) ||
00985             ((Verifier->Flags & VI_VERIFYING_DIRECTLY) == 0)) {
00986 
00987             return ExAllocatePoolWithTag (PoolType | POOL_DRIVER_MASK,
00988                                           NumberOfBytes,
00989                                           Tag);
00990         }
00991         PoolType |= POOL_DRIVER_MASK;
00992     }
00993 
00994     return VeAllocatePoolWithTagPriority (PoolType,
00995                                           NumberOfBytes,
00996                                           Tag,
00997                                           HighPoolPriority,
00998                                           CallingAddress);
00999 }

THUNKED_API PVOID VerifierAllocatePoolWithTagPriority (  IN POOL_TYPE  PoolType,
IN SIZE_T  NumberOfBytes,
IN ULONG  Tag,
IN EX_POOL_PRIORITY  Priority
) 
 

Definition at line 1115 of file verifier.c.

References ExAllocatePoolWithTagPriority(), _MI_VERIFIER_DRIVER_ENTRY::Flags, KernelVerifier, NULL, POOL_DRIVER_MASK, RtlGetCallersAddress(), TRUE, VeAllocatePoolWithTagPriority(), VI_VERIFYING_DIRECTLY, and ViLocateVerifierEntry(). 

01124                    :
01125 
01126     This thunked-in function:
01127 
01128         - Performs sanity checks on the caller.
01129         - Can optionally provide allocation failures to the caller.
01130         - Attempts to provide the allocation from special pool.
01131         - Tracks pool to ensure callers free everything they allocate.
01132 
01133 --*/
01134 
01135 {
01136     PVOID CallingAddress;
01137     PVOID CallersCaller;
01138     PMI_VERIFIER_DRIVER_ENTRY Verifier;
01139 
01140 #if defined (_X86_)
01141     RtlGetCallersAddress(&CallingAddress, &CallersCaller);
01142 #else
01143     CallingAddress = (PVOID)_ReturnAddress();
01144 #endif
01145 
01146     if (KernelVerifier == TRUE) {
01147         Verifier = ViLocateVerifierEntry (CallingAddress);
01148 
01149         if ((Verifier == NULL) ||
01150             ((Verifier->Flags & VI_VERIFYING_DIRECTLY) == 0)) {
01151 
01152             return ExAllocatePoolWithTagPriority (PoolType | POOL_DRIVER_MASK,
01153                                                   NumberOfBytes,
01154                                                   Tag,
01155                                                   Priority);
01156         }
01157         PoolType |= POOL_DRIVER_MASK;
01158     }
01159 
01160     return VeAllocatePoolWithTagPriority (PoolType,
01161                                           NumberOfBytes,
01162                                           Tag,
01163                                           Priority,
01164                                           CallingAddress);
01165 }

THUNKED_API VOID FASTCALL VerifierExAcquireFastMutex (  IN PFAST_MUTEX  FastMutex  ) 
 

Definition at line 2815 of file verifier.c.

References APC_LEVEL, and KeBugCheckEx(). 

02818 {
02819     KIRQL CurrentIrql;
02820 
02821     CurrentIrql = KeGetCurrentIrql ();
02822 
02823     //
02824     // Caller better be at or below APC_LEVEL or have APCs blocked.
02825     //
02826 
02827     if (CurrentIrql > APC_LEVEL) {
02828         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02829                       0x33,
02830                       CurrentIrql,
02831                       (ULONG_PTR)FastMutex,
02832                       0);
02833     }
02834 
02835     ExAcquireFastMutex (FastMutex);
02836 }

THUNKED_API VOID FASTCALL VerifierExAcquireFastMutexUnsafe (  IN PFAST_MUTEX  FastMutex  ) 
 

Definition at line 2841 of file verifier.c.

References APC_LEVEL, ExAcquireFastMutexUnsafe(), IS_SYSTEM_THREAD, KeBugCheckEx(), KeGetCurrentThread, and PsGetCurrentThread. 

02844 {
02845     KIRQL CurrentIrql;
02846 
02847     CurrentIrql = KeGetCurrentIrql ();
02848 
02849     //
02850     // Caller better be at APC_LEVEL or have APCs blocked.
02851     //
02852 
02853     if ((CurrentIrql != APC_LEVEL) &&
02854         (!IS_SYSTEM_THREAD(PsGetCurrentThread())) &&
02855         (KeGetCurrentThread()->KernelApcDisable == 0)) {
02856 
02857         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02858                       0x39,
02859                       CurrentIrql,
02860                       (ULONG_PTR)(KeGetCurrentThread()->KernelApcDisable),
02861                       (ULONG_PTR)FastMutex);
02862     }
02863 
02864     ExAcquireFastMutexUnsafe (FastMutex);
02865 }

THUNKED_API BOOLEAN VerifierExAcquireResourceExclusive (  IN PERESOURCE  Resource,
IN BOOLEAN  Wait
) 
 

Definition at line 2182 of file verifier.c.

References APC_LEVEL, ExAcquireResourceExclusiveLite(), IS_SYSTEM_THREAD, KeBugCheckEx(), KeGetCurrentThread, PsGetCurrentThread, and Resource. 

02186 {
02187     KIRQL CurrentIrql;
02188 
02189     CurrentIrql = KeGetCurrentIrql ();
02190 
02191     if ((CurrentIrql != APC_LEVEL) &&
02192         (!IS_SYSTEM_THREAD(PsGetCurrentThread())) &&
02193         (KeGetCurrentThread()->KernelApcDisable == 0)) {
02194 
02195             KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02196                           0x37,
02197                           CurrentIrql,
02198                           (ULONG_PTR)(KeGetCurrentThread()->KernelApcDisable),
02199                           (ULONG_PTR)Resource);
02200     }
02201 
02202     return ExAcquireResourceExclusiveLite (Resource, Wait);
02203 }

THUNKED_API VOID FASTCALL VerifierExReleaseFastMutex (  IN PFAST_MUTEX  FastMutex  ) 
 

Definition at line 2870 of file verifier.c.

References APC_LEVEL, IS_SYSTEM_THREAD, KeBugCheckEx(), KeGetCurrentThread, and PsGetCurrentThread. 

02873 {
02874     KIRQL CurrentIrql;
02875 
02876     CurrentIrql = KeGetCurrentIrql ();
02877 
02878     //
02879     // Caller better be at APC_LEVEL or have APCs blocked.
02880     //
02881 
02882     if ((CurrentIrql != APC_LEVEL) &&
02883         (!IS_SYSTEM_THREAD(PsGetCurrentThread())) &&
02884         (KeGetCurrentThread()->KernelApcDisable == 0)) {
02885 
02886         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02887                       0x34,
02888                       CurrentIrql,
02889                       (ULONG_PTR)(KeGetCurrentThread()->KernelApcDisable),
02890                       (ULONG_PTR)FastMutex);
02891     }
02892 
02893     ExReleaseFastMutex (FastMutex);
02894 }

THUNKED_API VOID FASTCALL VerifierExReleaseFastMutexUnsafe (  IN PFAST_MUTEX  FastMutex  ) 
 

Definition at line 2899 of file verifier.c.

References APC_LEVEL, ExReleaseFastMutexUnsafe(), IS_SYSTEM_THREAD, KeBugCheckEx(), KeGetCurrentThread, and PsGetCurrentThread. 

02902 {
02903     KIRQL CurrentIrql;
02904 
02905     CurrentIrql = KeGetCurrentIrql ();
02906 
02907     //
02908     // Caller better be at APC_LEVEL or have APCs blocked.
02909     //
02910 
02911     if ((CurrentIrql != APC_LEVEL) &&
02912         (!IS_SYSTEM_THREAD(PsGetCurrentThread())) &&
02913         (KeGetCurrentThread()->KernelApcDisable == 0)) {
02914 
02915         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02916                       0x3A,
02917                       CurrentIrql,
02918                       (ULONG_PTR)(KeGetCurrentThread()->KernelApcDisable),
02919                       (ULONG_PTR)FastMutex);
02920     }
02921 
02922     ExReleaseFastMutexUnsafe (FastMutex);
02923 }

THUNKED_API VOID FASTCALL VerifierExReleaseResource (  IN PERESOURCE  Resource  ) 
 

Definition at line 2208 of file verifier.c.

References APC_LEVEL, ExReleaseResourceLite(), IS_SYSTEM_THREAD, KeBugCheckEx(), KeGetCurrentThread, PsGetCurrentThread, and Resource. 

02211 {
02212     KIRQL CurrentIrql;
02213 
02214     CurrentIrql = KeGetCurrentIrql ();
02215 
02216     if ((CurrentIrql != APC_LEVEL) &&
02217         (!IS_SYSTEM_THREAD(PsGetCurrentThread())) &&
02218         (KeGetCurrentThread()->KernelApcDisable == 0)) {
02219 
02220             KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02221                           0x38,
02222                           CurrentIrql,
02223                           (ULONG_PTR)(KeGetCurrentThread()->KernelApcDisable),
02224                           (ULONG_PTR)Resource);
02225     }
02226 
02227     ExReleaseResourceLite (Resource);
02228 }

THUNKED_API BOOLEAN FASTCALL VerifierExTryToAcquireFastMutex (  IN PFAST_MUTEX  FastMutex  ) 
 

Definition at line 2789 of file verifier.c.

References APC_LEVEL, and KeBugCheckEx(). 

02792 {
02793     KIRQL CurrentIrql;
02794 
02795     CurrentIrql = KeGetCurrentIrql ();
02796 
02797     //
02798     // Caller better be at or below APC_LEVEL or have APCs blocked.
02799     //
02800 
02801     if (CurrentIrql > APC_LEVEL) {
02802         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02803                       0x33,
02804                       CurrentIrql,
02805                       (ULONG_PTR)FastMutex,
02806                       0);
02807     }
02808 
02809     return ExTryToAcquireFastMutex (FastMutex);
02810 }

THUNKED_API VOID VerifierFreePool (  IN PVOID  P  ) 
 

Definition at line 2129 of file verifier.c.

References ExFreePool(), KernelVerifier, TRUE, and VerifierFreePoolWithTag(). 

02132 {
02133     if (KernelVerifier == TRUE) {
02134         ExFreePool (P);
02135         return;
02136     }
02137 
02138     VerifierFreePoolWithTag (P, 0);
02139 }

THUNKED_API VOID VerifierFreePoolWithTag (  IN PVOID  P,
IN ULONG  TagToFree
) 
 

Definition at line 2143 of file verifier.c.

References ExFreePoolSanityChecks(), ExFreePoolWithTag, KernelVerifier, and TRUE.

Referenced by VerifierFreePool(). 

02147 {
02148     if (KernelVerifier == TRUE) {
02149         ExFreePoolWithTag (P, TagToFree);
02150         return;
02151     }
02152 
02153     ExFreePoolSanityChecks (P);
02154 
02155     ExFreePoolWithTag (P, TagToFree);
02156 }

VOID VerifierFreeTrackedPool (  IN PVOID  VirtualAddress,
IN SIZE_T  ChargedBytes,
IN LOGICAL  CheckType,
IN LOGICAL  SpecialPool
) 
 

Referenced by ExFreePoolWithTag(), MiFreePoolPages(), and MmFreeSpecialPool().

THUNKED_API KIRQL FASTCALL VerifierKeAcquireQueuedSpinLock (  IN KSPIN_LOCK_QUEUE_NUMBER  Number  ) 
 

THUNKED_API VOID VerifierKeAcquireSpinLock (  IN PKSPIN_LOCK  SpinLock,
OUT PKIRQL  OldIrql
) 
 

Definition at line 2365 of file verifier.c.

References DISPATCH_LEVEL, KeAcquireSpinLock, KfSanityCheckRaiseIrql(), MmVerifierData, PKE_ACQUIRE_SPINLOCK, and ViTrimAllSystemPagableMemory(). 

02369 {
02370     KIRQL CurrentIrql;
02371     PKE_ACQUIRE_SPINLOCK HalRoutine;
02372 
02373     CurrentIrql = KeGetCurrentIrql ();
02374 
02375     KfSanityCheckRaiseIrql (DISPATCH_LEVEL);
02376 
02377     MmVerifierData.AcquireSpinLocks += 1;
02378 
02379     if (MmVerifierData.Level & DRIVER_VERIFIER_FORCE_IRQL_CHECKING) {
02380         if (CurrentIrql < DISPATCH_LEVEL) {
02381             ViTrimAllSystemPagableMemory ();
02382         }
02383     }
02384 
02385 #if defined (_X86_)
02386     HalRoutine = (PKE_ACQUIRE_SPINLOCK) (ULONG_PTR) MiKernelVerifierOriginalCalls[VI_KE_ACQUIRE_SPINLOCK];
02387 
02388     if (HalRoutine) {
02389         (*HalRoutine)(SpinLock, OldIrql);
02390         return;
02391     }
02392 #endif
02393 
02394     KeAcquireSpinLock (SpinLock, OldIrql);
02395 }

THUNKED_API VOID VerifierKeInitializeTimer (  IN PKTIMER  Timer  ) 
 

Definition at line 3039 of file verifier.c.

References VerifierKeInitializeTimerEx(). 

03042 {
03043     VerifierKeInitializeTimerEx(Timer, NotificationTimer);
03044 }

THUNKED_API VOID VerifierKeInitializeTimerEx (  IN PKTIMER  Timer,
IN TIMER_TYPE  Type
) 
 

Definition at line 3020 of file verifier.c.

References KeCheckForTimer(), KeInitializeTimerEx(), KiTimerTableListHead, and NULL.

Referenced by VerifierKeInitializeTimer(). 

03024 {
03025     //
03026     // Check the object being initialized isn't already an
03027     // active timer.  Make sure the timer table list is initialized.
03028     //
03029 
03030     if (KiTimerTableListHead[0].Flink != NULL) {
03031         KeCheckForTimer(Timer, sizeof(KTIMER));
03032     }
03033 
03034     KeInitializeTimerEx(Timer, Type);
03035 }

THUNKED_API VOID VerifierKeLowerIrql (  IN KIRQL  NewIrql  ) 
 

Definition at line 2972 of file verifier.c.

References KeLowerIrql(), KfSanityCheckLowerIrql(), and PKE_LOWER_IRQL. 

02975 {
02976     PKE_LOWER_IRQL HalRoutine;
02977 
02978     KfSanityCheckLowerIrql (NewIrql);
02979 
02980 #if defined (_X86_)
02981     HalRoutine = (PKE_LOWER_IRQL) (ULONG_PTR) MiKernelVerifierOriginalCalls[VI_KE_LOWER_IRQL];
02982     if (HalRoutine) {
02983         (*HalRoutine)(NewIrql);
02984         return;
02985     }
02986 #endif
02987 
02988     KeLowerIrql (NewIrql);
02989 }

THUNKED_API VOID VerifierKeRaiseIrql (  IN KIRQL  NewIrql,
OUT PKIRQL  OldIrql
) 
 

Definition at line 2934 of file verifier.c.

References DISPATCH_LEVEL, KeRaiseIrql(), KfSanityCheckRaiseIrql(), MmVerifierData, PKE_RAISE_IRQL, and ViTrimAllSystemPagableMemory(). 

02938 {
02939     PKE_RAISE_IRQL HalRoutine;
02940 
02941     *OldIrql = KeGetCurrentIrql ();
02942 
02943     KfSanityCheckRaiseIrql (NewIrql);
02944 
02945     MmVerifierData.RaiseIrqls += 1;
02946 
02947     if (MmVerifierData.Level & DRIVER_VERIFIER_FORCE_IRQL_CHECKING) {
02948         if ((*OldIrql < DISPATCH_LEVEL) && (NewIrql >= DISPATCH_LEVEL)) {
02949             ViTrimAllSystemPagableMemory ();
02950         }
02951     }
02952 
02953 #if defined (_X86_)
02954     HalRoutine = (PKE_RAISE_IRQL) (ULONG_PTR) MiKernelVerifierOriginalCalls[VI_KE_RAISE_IRQL];
02955     if (HalRoutine) {
02956         (*HalRoutine)(NewIrql, OldIrql);
02957         return;
02958     }
02959 #endif
02960 
02961     KeRaiseIrql (NewIrql, OldIrql);
02962 }

THUNKED_API VOID FASTCALL VerifierKeReleaseQueuedSpinLock (  IN KSPIN_LOCK_QUEUE_NUMBER  Number,
IN KIRQL  OldIrql
) 
 

THUNKED_API VOID VerifierKeReleaseSpinLock (  IN PKSPIN_LOCK  SpinLock,
IN KIRQL  NewIrql
) 
 

Definition at line 2406 of file verifier.c.

References DISPATCH_LEVEL, KeBugCheckEx(), KeReleaseSpinLock(), KfSanityCheckLowerIrql(), and PKE_RELEASE_SPINLOCK. 

02410 {
02411     KIRQL CurrentIrql;
02412     PKE_RELEASE_SPINLOCK HalRoutine;
02413 
02414     CurrentIrql = KeGetCurrentIrql ();
02415 
02416     //
02417     // Caller better still be at DISPATCH_LEVEL when releasing the spinlock
02418     //
02419 
02420     if (CurrentIrql != DISPATCH_LEVEL) {
02421         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02422                       0x32,
02423                       CurrentIrql,
02424                       (ULONG_PTR)SpinLock,
02425                       0);
02426     }
02427 
02428     KfSanityCheckLowerIrql (NewIrql);
02429 
02430 #if defined (_X86_)
02431     HalRoutine = (PKE_RELEASE_SPINLOCK) (ULONG_PTR) MiKernelVerifierOriginalCalls[VI_KE_RELEASE_SPINLOCK];
02432 
02433     if (HalRoutine) {
02434         (*HalRoutine)(SpinLock, NewIrql);
02435         return;
02436     }
02437 #endif
02438 
02439     KeReleaseSpinLock (SpinLock, NewIrql);
02440 }

THUNKED_API KIRQL FASTCALL VerifierKfAcquireSpinLock (  IN PKSPIN_LOCK  SpinLock  ) 
 

THUNKED_API VOID FASTCALL VerifierKfLowerIrql (  IN KIRQL  NewIrql  ) 
 

THUNKED_API KIRQL FASTCALL VerifierKfRaiseIrql (  IN KIRQL  NewIrql  ) 
 

THUNKED_API VOID FASTCALL VerifierKfReleaseSpinLock (  IN PKSPIN_LOCK  SpinLock,
IN KIRQL  NewIrql
) 
 

THUNKED_API PVOID VerifierMapIoSpace (  IN PHYSICAL_ADDRESS  PhysicalAddress,
IN SIZE_T  NumberOfBytes,
IN MEMORY_CACHING_TYPE  CacheType
) 
 

Definition at line 662 of file verifier.c.

References DISPATCH_LEVEL, KeBugCheckEx(), MmMapIoSpace(), NULL, TRUE, and ViInjectResourceFailure(). 

00667 {
00668     KIRQL CurrentIrql;
00669 
00670     CurrentIrql = KeGetCurrentIrql();
00671     if (CurrentIrql > DISPATCH_LEVEL) {
00672         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00673                       0x73,
00674                       CurrentIrql,
00675                       (ULONG_PTR)PhysicalAddress.LowPart,
00676                       NumberOfBytes);
00677     }
00678 
00679     if (ViInjectResourceFailure () == TRUE) {
00680         return NULL;
00681     }
00682 
00683     return MmMapIoSpace (PhysicalAddress, NumberOfBytes, CacheType);
00684 }

THUNKED_API PVOID VerifierMapLockedPages (  IN PMDL  MemoryDescriptorList,
IN KPROCESSOR_MODE  AccessMode
) 
 

Definition at line 688 of file verifier.c.

References APC_LEVEL, DbgPrint, DISPATCH_LEVEL, KeBugCheckEx(), KernelMode, MDL_MAPPING_CAN_FAIL, MmMapLockedPages(), RtlGetCallersAddress(), TRUE, and ViAddBadMapper(). 

00692 {
00693     PVOID CallingAddress;
00694     PVOID CallersCaller;
00695     KIRQL CurrentIrql;
00696 
00697 #if defined (_X86_)
00698     RtlGetCallersAddress(&CallingAddress, &CallersCaller);
00699 #else
00700     CallingAddress = (PVOID)_ReturnAddress();
00701 #endif
00702 
00703     CurrentIrql = KeGetCurrentIrql();
00704 
00705     if (AccessMode == KernelMode) {
00706         if (CurrentIrql > DISPATCH_LEVEL) {
00707             KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00708                           0x74,
00709                           CurrentIrql,
00710                           (ULONG_PTR)MemoryDescriptorList,
00711                           (ULONG_PTR)AccessMode);
00712         }
00713     }
00714     else {
00715         if (CurrentIrql > APC_LEVEL) {
00716             KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00717                           0x75,
00718                           CurrentIrql,
00719                           (ULONG_PTR)MemoryDescriptorList,
00720                           (ULONG_PTR)AccessMode);
00721         }
00722     }
00723 
00724     if ((MemoryDescriptorList->MdlFlags & MDL_MAPPING_CAN_FAIL) == 0) {
00725 
00726         if (ViAddBadMapper (CallingAddress) == TRUE) {
00727 
00728             //
00729             // All drivers must specify can fail.  We'd really like to bugcheck
00730             // here to get drivers to convert but cut them some slack for now.
00731             //
00732 
00733             DbgPrint ("*******************************************************************************\n");
00734             DbgPrint ("*                                                                             *\n");
00735 
00736             DbgPrint ("* The Driver Verifier has detected the driver at address %p\n", CallingAddress);
00737             DbgPrint ("* is calling MmMapLockedPages instead of MmMapLockedPagesSpecifyCache.\n");
00738             DbgPrint ("* This can cause the system to needlessly bugcheck whenever system\n");
00739             DbgPrint ("* resources are low.  This driver needs to be fixed.\n");
00740 
00741             DbgPrint ("*                                                                             *\n");
00742             DbgPrint ("*******************************************************************************\n");
00743         }
00744     }
00745 
00746     return MmMapLockedPages (MemoryDescriptorList, AccessMode);
00747 }

THUNKED_API PVOID VerifierMapLockedPagesSpecifyCache (  IN PMDL  MemoryDescriptorList,
IN KPROCESSOR_MODE  AccessMode,
IN MEMORY_CACHING_TYPE  CacheType,
IN PVOID  RequestedAddress,
IN ULONG  BugCheckOnFailure,
IN MM_PAGE_PRIORITY  Priority
) 
 

Definition at line 751 of file verifier.c.

References APC_LEVEL, DbgPrint, DISPATCH_LEVEL, KeBugCheckEx(), KernelMode, MDL_MAPPING_CAN_FAIL, MmMapLockedPagesSpecifyCache(), NULL, RtlGetCallersAddress(), TRUE, ViAddBadMapper(), and ViInjectResourceFailure(). 

00759 {
00760     PVOID CallingAddress;
00761     PVOID CallersCaller;
00762     KIRQL CurrentIrql;
00763 
00764 #if defined (_X86_)
00765     RtlGetCallersAddress(&CallingAddress, &CallersCaller);
00766 #else
00767     CallingAddress = (PVOID)_ReturnAddress();
00768 #endif
00769 
00770     CurrentIrql = KeGetCurrentIrql();
00771     if (AccessMode == KernelMode) {
00772         if (CurrentIrql > DISPATCH_LEVEL) {
00773             KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00774                           0x76,
00775                           CurrentIrql,
00776                           (ULONG_PTR)MemoryDescriptorList,
00777                           (ULONG_PTR)AccessMode);
00778         }
00779     }
00780     else {
00781         if (CurrentIrql > APC_LEVEL) {
00782             KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00783                           0x77,
00784                           CurrentIrql,
00785                           (ULONG_PTR)MemoryDescriptorList,
00786                           (ULONG_PTR)AccessMode);
00787         }
00788     }
00789 
00790     if ((MemoryDescriptorList->MdlFlags & MDL_MAPPING_CAN_FAIL) ||
00791         (BugCheckOnFailure == 0)) {
00792 
00793         if (ViInjectResourceFailure () == TRUE) {
00794             return NULL;
00795         }
00796     }
00797     else {
00798 
00799         //
00800         // All drivers must specify can fail or don't bugcheck.  We'd
00801         // really like to bugcheck here to get drivers to convert but
00802         // cut them some slack for now.
00803         //
00804 
00805         if (ViAddBadMapper (CallingAddress) == TRUE) {
00806 
00807             DbgPrint ("*******************************************************************************\n");
00808             DbgPrint ("*                                                                             *\n");
00809 
00810             DbgPrint ("* The Driver Verifier has detected the driver at address %p\n", CallingAddress);
00811             DbgPrint ("* is not calling the safe version of MmMapLockedPagesSpecifyCache.\n");
00812             DbgPrint ("* This can cause the system to needlessly bugcheck whenever system\n");
00813             DbgPrint ("* resources are low.  This driver needs to be fixed.\n");
00814 
00815             DbgPrint ("*                                                                             *\n");
00816             DbgPrint ("*******************************************************************************\n");
00817         }
00818     }
00819 
00820     return MmMapLockedPagesSpecifyCache (MemoryDescriptorList,
00821                                          AccessMode,
00822                                          CacheType,
00823                                          RequestedAddress,
00824                                          BugCheckOnFailure,
00825                                          Priority);
00826 }

THUNKED_API VOID VerifierProbeAndLockPages (  IN OUT PMDL  MemoryDescriptorList,
IN KPROCESSOR_MODE  AccessMode,
IN LOCK_OPERATION  Operation
) 
 

Definition at line 537 of file verifier.c.

References DISPATCH_LEVEL, ExRaiseStatus(), KeBugCheckEx(), MmProbeAndLockPages(), TRUE, and ViInjectResourceFailure(). 

00542 {
00543     KIRQL CurrentIrql;
00544 
00545     CurrentIrql = KeGetCurrentIrql();
00546     if (CurrentIrql > DISPATCH_LEVEL) {
00547         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00548                       0x70,
00549                       CurrentIrql,
00550                       (ULONG_PTR)MemoryDescriptorList,
00551                       (ULONG_PTR)AccessMode);
00552     }
00553 
00554     if (ViInjectResourceFailure () == TRUE) {
00555         ExRaiseStatus (STATUS_WORKING_SET_QUOTA);
00556     }
00557 
00558     MmProbeAndLockPages (MemoryDescriptorList, AccessMode, Operation);
00559 }

THUNKED_API VOID VerifierProbeAndLockProcessPages (  IN OUT PMDL  MemoryDescriptorList,
IN PEPROCESS  Process,
IN KPROCESSOR_MODE  AccessMode,
IN LOCK_OPERATION  Operation
) 
 

Definition at line 563 of file verifier.c.

References DISPATCH_LEVEL, ExRaiseStatus(), KeBugCheckEx(), MmProbeAndLockProcessPages(), TRUE, and ViInjectResourceFailure(). 

00569 {
00570     KIRQL CurrentIrql;
00571 
00572     CurrentIrql = KeGetCurrentIrql();
00573     if (CurrentIrql > DISPATCH_LEVEL) {
00574         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00575                       0x71,
00576                       CurrentIrql,
00577                       (ULONG_PTR)MemoryDescriptorList,
00578                       (ULONG_PTR)Process);
00579     }
00580 
00581     if (ViInjectResourceFailure () == TRUE) {
00582         ExRaiseStatus (STATUS_WORKING_SET_QUOTA);
00583     }
00584 
00585     MmProbeAndLockProcessPages (MemoryDescriptorList,
00586                                 Process,
00587                                 AccessMode,
00588                                 Operation);
00589 }

THUNKED_API VOID VerifierProbeAndLockSelectedPages (  IN OUT PMDL  MemoryDescriptorList,
IN PFILE_SEGMENT_ELEMENT  SegmentArray,
IN KPROCESSOR_MODE  AccessMode,
IN LOCK_OPERATION  Operation
) 
 

Definition at line 593 of file verifier.c.

References APC_LEVEL, ExRaiseStatus(), KeBugCheckEx(), MmProbeAndLockSelectedPages(), TRUE, and ViInjectResourceFailure(). 

00599 {
00600     KIRQL CurrentIrql;
00601 
00602     CurrentIrql = KeGetCurrentIrql();
00603     if (CurrentIrql > APC_LEVEL) {
00604         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00605                       0x72,
00606                       CurrentIrql,
00607                       (ULONG_PTR)MemoryDescriptorList,
00608                       (ULONG_PTR)AccessMode);
00609     }
00610 
00611     if (ViInjectResourceFailure () == TRUE) {
00612         ExRaiseStatus (STATUS_WORKING_SET_QUOTA);
00613     }
00614 
00615     MmProbeAndLockSelectedPages (MemoryDescriptorList,
00616                                  SegmentArray,
00617                                  AccessMode,
00618                                  Operation);
00619 }

THUNKED_API LONG VerifierSetEvent (  IN PRKEVENT  Event,
IN KPRIORITY  Increment,
IN BOOLEAN  Wait
) 
 

Definition at line 2160 of file verifier.c.

References DISPATCH_LEVEL, Event(), Increment, KeBugCheckEx(), and KeSetEvent(). 

02165 {
02166     KIRQL CurrentIrql;
02167 
02168     CurrentIrql = KeGetCurrentIrql();
02169     if (CurrentIrql > DISPATCH_LEVEL) {
02170         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
02171                       0x80,
02172                       CurrentIrql,
02173                       (ULONG_PTR)Event,
02174                       (ULONG_PTR)0);
02175     }
02176 
02177     return KeSetEvent (Event, Increment, Wait);
02178 }

THUNKED_API BOOLEAN VerifierSynchronizeExecution (  IN PKINTERRUPT  Interrupt,
IN PKSYNCHRONIZE_ROUTINE  SynchronizeRoutine,
IN PVOID  SynchronizeContext
) 
 

Definition at line 2993 of file verifier.c.

References DISPATCH_LEVEL, KeSynchronizeExecution(), KfSanityCheckRaiseIrql(), MmVerifierData, and ViTrimAllSystemPagableMemory(). 

02998 {
02999     KIRQL OldIrql;
03000 
03001     OldIrql = KeGetCurrentIrql ();
03002 
03003     KfSanityCheckRaiseIrql (Interrupt->SynchronizeIrql);
03004 
03005     MmVerifierData.SynchronizeExecutions += 1;
03006 
03007     if (MmVerifierData.Level & DRIVER_VERIFIER_FORCE_IRQL_CHECKING) {
03008         if ((OldIrql < DISPATCH_LEVEL) && (Interrupt->SynchronizeIrql >= DISPATCH_LEVEL)) {
03009             ViTrimAllSystemPagableMemory ();
03010         }
03011     }
03012 
03013     return KeSynchronizeExecution (Interrupt,
03014                                    SynchronizeRoutine,
03015                                    SynchronizeContext);
03016 }

VOID VerifierUnlockPages (  IN OUT PMDL  MemoryDescriptorList  ) 
 

Definition at line 829 of file verifier.c.

References DISPATCH_LEVEL, KeBugCheckEx(), MDL_PAGES_LOCKED, MDL_SOURCE_IS_NONPAGED_POOL, and MmUnlockPages(). 

00832 {
00833     KIRQL CurrentIrql;
00834 
00835     CurrentIrql = KeGetCurrentIrql();
00836     if (CurrentIrql > DISPATCH_LEVEL) {
00837         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00838                       0x78,
00839                       CurrentIrql,
00840                       (ULONG_PTR)MemoryDescriptorList,
00841                       0);
00842     }
00843 
00844     if ((MemoryDescriptorList->MdlFlags & MDL_PAGES_LOCKED) == 0) {
00845 
00846         //
00847         // The caller is trying to unlock an MDL that was never locked down.
00848         //
00849 
00850         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00851                       0x7C,
00852                       (ULONG_PTR)MemoryDescriptorList,
00853                       (ULONG_PTR)MemoryDescriptorList->MdlFlags,
00854                       0);
00855     }
00856 
00857     if (MemoryDescriptorList->MdlFlags & MDL_SOURCE_IS_NONPAGED_POOL) {
00858 
00859         //
00860         // Nonpaged pool should never be locked down.
00861         //
00862 
00863         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00864                       0x7D,
00865                       (ULONG_PTR)MemoryDescriptorList,
00866                       (ULONG_PTR)MemoryDescriptorList->MdlFlags,
00867                       0);
00868     }
00869 
00870     MmUnlockPages (MemoryDescriptorList);
00871 }

VOID VerifierUnmapIoSpace (  IN PVOID  BaseAddress,
IN SIZE_T  NumberOfBytes
) 
 

Definition at line 906 of file verifier.c.

References DISPATCH_LEVEL, KeBugCheckEx(), and MmUnmapIoSpace(). 

00910 {
00911     KIRQL CurrentIrql;
00912 
00913     CurrentIrql = KeGetCurrentIrql();
00914     if (CurrentIrql > DISPATCH_LEVEL) {
00915         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00916                       0x7B,
00917                       CurrentIrql,
00918                       (ULONG_PTR)BaseAddress,
00919                       (ULONG_PTR)NumberOfBytes);
00920     }
00921 
00922     MmUnmapIoSpace (BaseAddress, NumberOfBytes);
00923 }

VOID VerifierUnmapLockedPages (  IN PVOID  BaseAddress,
IN PMDL  MemoryDescriptorList
) 
 

Definition at line 874 of file verifier.c.

References APC_LEVEL, DISPATCH_LEVEL, KeBugCheckEx(), and MmUnmapLockedPages(). 

00878 {
00879     KIRQL CurrentIrql;
00880 
00881     CurrentIrql = KeGetCurrentIrql();
00882 
00883     if (BaseAddress > MM_HIGHEST_USER_ADDRESS) {
00884         if (CurrentIrql > DISPATCH_LEVEL) {
00885             KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00886                           0x79,
00887                           CurrentIrql,
00888                           (ULONG_PTR)BaseAddress,
00889                           (ULONG_PTR)MemoryDescriptorList);
00890         }
00891     }
00892     else {
00893         if (CurrentIrql > APC_LEVEL) {
00894             KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
00895                           0x7A,
00896                           CurrentIrql,
00897                           (ULONG_PTR)BaseAddress,
00898                           (ULONG_PTR)MemoryDescriptorList);
00899         }
00900     }
00901 
00902     MmUnmapLockedPages (BaseAddress, MemoryDescriptorList);
00903 }

LOGICAL ViAddBadMapper (  IN PVOID  BadMapper  ) 
 

Definition at line 632 of file verifier.c.

References FALSE, NULL, TRUE, VI_BAD_MAPPERS_MAX, ViBadMapperLock, and ViBadMappers.

Referenced by VerifierMapLockedPages(), and VerifierMapLockedPagesSpecifyCache(). 

00635 {
00636     ULONG i;
00637     KIRQL OldIrql;
00638     LOGICAL Added;
00639 
00640     Added = FALSE;
00641     ExAcquireSpinLock (&ViBadMapperLock, &OldIrql);
00642 
00643     for (i = 0; i < VI_BAD_MAPPERS_MAX; i += 1) {
00644         if (ViBadMappers[i] == BadMapper) {
00645             break;
00646         }
00647 
00648         if (ViBadMappers[i] == NULL) {
00649             ViBadMappers[i] = BadMapper;
00650             Added = TRUE;
00651             break;
00652         }
00653     }
00654 
00655     ExReleaseSpinLock (&ViBadMapperLock, OldIrql);
00656 
00657     return Added;
00658 }

VOID ViCancelPoolAllocation (  IN PMI_VERIFIER_DRIVER_ENTRY  Verifier  ) 
 

Definition at line 1566 of file verifier.c.

References ASSERT, and VI_POOL_FREELIST_END.

Referenced by VeAllocatePoolWithTagPriority(). 

01572                    :
01573 
01574     This function removes a reservation from the verifier list for this driver.
01575     All reservations must be made in advance.  This routine is used when an
01576     earlier reservation is not going to be used (ie: the actual pool
01577     allocation failed so no reservation will be needed after all).
01578 
01579 Arguments:
01580 
01581     Verifier - Supplies the verifier entry to update.
01582 
01583 Return Value:
01584 
01585     None.
01586 
01587 Environment:
01588 
01589     Kernel mode, DISPATCH_LEVEL or below, no verifier mutexes held.
01590 
01591 --*/
01592 
01593 {
01594     KIRQL OldIrql;
01595 
01596     ExAcquireSpinLock (&Verifier->VerifierPoolLock, &OldIrql);
01597 
01598     //
01599     // The hash entry reserved earlier is not going to be used after all.
01600     //
01601 
01602     ASSERT (Verifier->PoolHashReserved != 0);
01603 
01604     ASSERT (Verifier->PoolHashSize >= Verifier->CurrentPagedPoolAllocations + Verifier->CurrentNonPagedPoolAllocations + Verifier->PoolHashReserved);
01605 
01606     ASSERT (Verifier->PoolHashFree != VI_POOL_FREELIST_END);
01607 
01608     Verifier->PoolHashReserved -= 1;
01609 
01610     ExReleaseSpinLock (&Verifier->VerifierPoolLock, OldIrql);
01611 }

VOID ViInitializeEntry (  IN PMI_VERIFIER_DRIVER_ENTRY  Verifier,
IN LOGICAL  FirstLoad
) 
 

Definition at line 3047 of file verifier.c.

References KeInitializeSpinLock(), MI_VERIFIER_ENTRY_SIGNATURE, NULL, TRUE, VerifierListLock, and VI_POOL_FREELIST_END.

Referenced by MiApplyDriverVerifier(), and MiInitializeDriverVerifierList(). 

03054                    :
03055 
03056     Initialize various verifier fields as the driver is being (re)loaded now.
03057 
03058 Arguments:
03059 
03060     Verifier - Supplies the verifier entry to be initialized.
03061 
03062     FirstLoad - Supplies TRUE if this is the first load of this driver.
03063 
03064 Return Value:
03065 
03066     None.
03067 
03068 --*/
03069 
03070 {
03071     KIRQL OldIrql;
03072 
03073     //
03074     // Only the BaseName field is initialized on entry.
03075     //
03076 
03077     KeInitializeSpinLock (&Verifier->VerifierPoolLock);
03078 
03079     Verifier->CurrentPagedPoolAllocations = 0;
03080     Verifier->CurrentNonPagedPoolAllocations = 0;
03081     Verifier->PeakPagedPoolAllocations = 0;
03082     Verifier->PeakNonPagedPoolAllocations = 0;
03083 
03084     Verifier->PagedBytes = 0;
03085     Verifier->NonPagedBytes = 0;
03086     Verifier->PeakPagedBytes = 0;
03087     Verifier->PeakNonPagedBytes = 0;
03088 
03089     Verifier->PoolHash = NULL;
03090     Verifier->PoolHashSize = 0;
03091     Verifier->PoolHashFree = VI_POOL_FREELIST_END;
03092     Verifier->PoolHashReserved = 0;
03093 
03094     Verifier->Signature = MI_VERIFIER_ENTRY_SIGNATURE;
03095 
03096     if (FirstLoad == TRUE) {
03097         Verifier->Flags = 0;
03098         Verifier->Loads = 0;
03099         Verifier->Unloads = 0;
03100     }
03101 
03102     ExAcquireSpinLock (&VerifierListLock, &OldIrql);
03103     Verifier->StartAddress = NULL;
03104     Verifier->EndAddress = NULL;
03105     ExReleaseSpinLock (&VerifierListLock, OldIrql);
03106 }

LOGICAL ViInjectResourceFailure (  VOID   ) 
 

Definition at line 1168 of file verifier.c.

References FALSE, KeBootTime, KeQuerySystemTime(), KeQueryTickCount(), MmVerifierData, TRUE, VerifierRequiredTimeSinceBoot, and VerifierSystemSufficientlyBooted.

Referenced by VeAllocatePoolWithTagPriority(), VerifierMapIoSpace(), VerifierMapLockedPagesSpecifyCache(), VerifierProbeAndLockPages(), VerifierProbeAndLockProcessPages(), and VerifierProbeAndLockSelectedPages(). 

01174                    :
01175 
01176     This function determines whether a resource allocation should be
01177     deliberately failed.  This may be a pool allocation, MDL creation,
01178     system PTE allocation, etc.
01179 
01180 Arguments:
01181 
01182     None.
01183 
01184 Return Value:
01185 
01186     TRUE if the allocation should be failed.  FALSE otherwise.
01187 
01188 Environment:
01189 
01190     Kernel mode.  DISPATCH_LEVEL or below.
01191 
01192 --*/
01193 
01194 {
01195     LARGE_INTEGER CurrentTime;
01196 
01197     if ((MmVerifierData.Level & DRIVER_VERIFIER_INJECT_ALLOCATION_FAILURES) == 0) {
01198         return FALSE;
01199     }
01200 
01201     //
01202     // Don't fail any requests in the first 7 or 8 minutes as we want to
01203     // give the system enough time to boot.
01204     //
01205 
01206     if (VerifierSystemSufficientlyBooted == FALSE) {
01207         KeQuerySystemTime (&CurrentTime);
01208         if (CurrentTime.QuadPart > KeBootTime.QuadPart + VerifierRequiredTimeSinceBoot.QuadPart) {
01209             VerifierSystemSufficientlyBooted = TRUE;
01210         }
01211     }
01212 
01213     if (VerifierSystemSufficientlyBooted == TRUE) {
01214 
01215         KeQueryTickCount(&CurrentTime);
01216 
01217         if ((CurrentTime.LowPart & 0xF) == 0) {
01218 
01219             MmVerifierData.AllocationsFailedDeliberately += 1;
01220 
01221             //
01222             // Deliberately fail this request.
01223             //
01224 
01225             return TRUE;
01226         }
01227     }
01228 
01229     return FALSE;
01230 }

ULONG_PTR ViInsertPoolAllocation (  IN PMI_VERIFIER_DRIVER_ENTRY  Verifier,
IN PVOID  VirtualAddress,
IN PVOID  CallingAddress,
IN SIZE_T  NumberOfBytes,
IN ULONG  Tag
) 
 

Definition at line 1369 of file verifier.c.

References ASSERT, _VI_POOL_ENTRY_INUSE::CallingAddress, DISPATCH_LEVEL, _VI_POOL_ENTRY::FreeListNext, Index, _VI_POOL_ENTRY::InUse, _VI_POOL_ENTRY_INUSE::NumberOfBytes, _VI_POOL_ENTRY_INUSE::Tag, VI_POOL_FREELIST_END, and _VI_POOL_ENTRY_INUSE::VirtualAddress.

Referenced by ViPostPoolAllocation(). 

01379                    :
01380 
01381     This function inserts the specified virtual address into the verifier
01382     list for this driver.
01383 
01384 Arguments:
01385 
01386     Verifier - Supplies the verifier entry to update.
01387 
01388     VirtualAddress - Supplies the virtual address to insert.
01389 
01390     CallingAddress - Supplies the caller's address.
01391 
01392     NumberOfBytes - Supplies the number of bytes to allocate.
01393 
01394     Tag - Supplies the tag for the pool being allocated.
01395 
01396 Return Value:
01397 
01398     The list index this virtual address was inserted at.
01399 
01400 Environment:
01401 
01402     Kernel mode, DISPATCH_LEVEL.  The Verifier->VerifierPoolLock must be held.
01403 
01404 --*/
01405 
01406 {
01407     ULONG_PTR Index;
01408     PVI_POOL_ENTRY HashEntry;
01409 
01410     ASSERT (KeGetCurrentIrql() == DISPATCH_LEVEL);
01411 
01412     //
01413     // The list entry must be reserved in advance.
01414     //
01415 
01416     ASSERT (Verifier->PoolHashReserved != 0);
01417 
01418     ASSERT (Verifier->PoolHashSize >= Verifier->CurrentPagedPoolAllocations + Verifier->CurrentNonPagedPoolAllocations + Verifier->PoolHashReserved);
01419 
01420     //
01421     // Use the next free list entry.
01422     //
01423 
01424     Index = Verifier->PoolHashFree;
01425     ASSERT (Index != VI_POOL_FREELIST_END);
01426 
01427     HashEntry = Verifier->PoolHash + Index;
01428 
01429     Verifier->PoolHashFree = HashEntry->FreeListNext;
01430 
01431     Verifier->PoolHashReserved -= 1;
01432 
01433     ASSERT (((HashEntry->FreeListNext & MINLONG_PTR) == 0) ||
01434             (HashEntry->FreeListNext == VI_POOL_FREELIST_END));
01435 
01436     HashEntry->InUse.VirtualAddress = VirtualAddress;
01437     HashEntry->InUse.CallingAddress = CallingAddress;
01438     HashEntry->InUse.NumberOfBytes = NumberOfBytes;
01439     HashEntry->InUse.Tag = Tag;
01440 
01441     ASSERT ((HashEntry->FreeListNext & MINLONG_PTR) != 0);
01442 
01443     return Index;
01444 }

VOID ViInsertVerifierEntry (  IN PMI_VERIFIER_DRIVER_ENTRY  Verifier  ) 
 

Definition at line 3360 of file verifier.c.

References MiSuspectDriverList, and VerifierListLock.

Referenced by MiApplyDriverVerifier(), and MiInitializeDriverVerifierList(). 

03366                    :
03367 
03368     Nonpagable wrapper to insert a new verifier entry.
03369 
03370     Note that the system load mutant or the verifier load spinlock is sufficient
03371     for readers to access the list.  This is because the insertion path
03372     acquires both.
03373 
03374     Lock synchronization is needed because pool allocators walk the
03375     verifier list at DISPATCH_LEVEL.
03376 
03377 Arguments:
03378 
03379     Verifier - Supplies a caller-initialized entry for the driver.
03380 
03381 Return Value:
03382 
03383     None.
03384 
03385 --*/
03386 
03387 {
03388     KIRQL OldIrql;
03389 
03390     ExAcquireSpinLock (&VerifierListLock, &OldIrql);
03391     InsertTailList (&MiSuspectDriverList, &Verifier->Links);
03392     ExReleaseSpinLock (&VerifierListLock, OldIrql);
03393 }

PMI_VERIFIER_DRIVER_ENTRY ViLocateVerifierEntry (  IN PVOID  SystemAddress  ) 
 

Definition at line 3396 of file verifier.c.

References _MI_VERIFIER_DRIVER_ENTRY::EndAddress, MiSuspectDriverList, NULL, _MI_VERIFIER_DRIVER_ENTRY::StartAddress, and VerifierListLock.

Referenced by VeAllocatePoolWithTagPriority(), VerifierAllocatePool(), VerifierAllocatePoolWithQuota(), VerifierAllocatePoolWithQuotaTag(), VerifierAllocatePoolWithTag(), VerifierAllocatePoolWithTagPriority(), and ViPostPoolAllocation(). 

03402                    :
03403 
03404     Locate the Driver Verifier entry for the specified system address.
03405 
03406 Arguments:
03407 
03408     SystemAddress - Supplies a code or data address within a driver.
03409 
03410 Return Value:
03411 
03412     The Verifier entry corresponding to the driver or NULL.
03413 
03414 Environment:
03415 
03416     The caller may be at DISPATCH_LEVEL and does not hold the MmSystemLoadLock.
03417 
03418 --*/
03419 
03420 {
03421     KIRQL OldIrql;
03422     PLIST_ENTRY NextEntry;
03423     PMI_VERIFIER_DRIVER_ENTRY Verifier;
03424 
03425     ExAcquireSpinLock (&VerifierListLock, &OldIrql);
03426 
03427     NextEntry = MiSuspectDriverList.Flink;
03428     while (NextEntry != &MiSuspectDriverList) {
03429 
03430         Verifier = CONTAINING_RECORD(NextEntry,
03431                                      MI_VERIFIER_DRIVER_ENTRY,
03432                                      Links);
03433 
03434         if ((SystemAddress >= Verifier->StartAddress) &&
03435             (SystemAddress < Verifier->EndAddress)) {
03436 
03437             ExReleaseSpinLock (&VerifierListLock, OldIrql);
03438             return Verifier;
03439         }
03440         NextEntry = NextEntry->Flink;
03441     }
03442 
03443     ExReleaseSpinLock (&VerifierListLock, OldIrql);
03444     return NULL;
03445 }

PVOID ViPostPoolAllocation (  IN PVOID  VirtualAddress,
IN SIZE_T  NumberOfBytes,
IN POOL_TYPE  PoolType,
IN ULONG  Tag,
IN PVOID  CallingAddress
) 
 

Definition at line 1614 of file verifier.c.

References ASSERT, BASE_POOL_TYPE_MASK, BYTE_OFFSET, _MI_VERIFIER_DRIVER_ENTRY::CurrentNonPagedPoolAllocations, _MI_VERIFIER_DRIVER_ENTRY::CurrentPagedPoolAllocations, EX_REAL_POOL_USAGE, FALSE, Header, MI_SPECIAL_POOL_VERIFIER, MI_VERIFIER_POOL_HEADER, MmSpecialPoolEnd, MmSpecialPoolStart, MmVerifierData, _MI_VERIFIER_DRIVER_ENTRY::NonPagedBytes, NULL, PAGE_ALIGN, PAGE_SIZE, _MI_VERIFIER_DRIVER_ENTRY::PagedBytes, PagedPool, _MI_VERIFIER_DRIVER_ENTRY::PeakNonPagedBytes, _MI_VERIFIER_DRIVER_ENTRY::PeakNonPagedPoolAllocations, _MI_VERIFIER_DRIVER_ENTRY::PeakPagedBytes, _MI_VERIFIER_DRIVER_ENTRY::PeakPagedPoolAllocations, PMI_VERIFIER_POOL_HEADER, POOL_BUDDY_MAX, POOL_OVERHEAD, POOL_VERIFIER_MASK, TRUE, _POOL_HEADER::Ulong1, VerifierIsTrackingPool, VerifierPoolLock, _MI_VERIFIER_DRIVER_ENTRY::VerifierPoolLock, VerifierPoolMutex, ViInsertPoolAllocation(), and ViLocateVerifierEntry().

Referenced by VeAllocatePoolWithTagPriority(). 

01624                    :
01625 
01626     This function performs verifier book-keeping on the allocation attempt.
01627 
01628 Arguments:
01629 
01630     VirtualAddress - Supplies the virtual address that should be allocated.
01631 
01632     NumberOfBytes - Supplies the number of bytes to allocate.
01633 
01634     PoolType - Supplies the type of pool being allocated.
01635 
01636     Tag - Supplies the tag for the pool being allocated.
01637 
01638     CallingAddress - Supplies the caller's address.
01639 
01640 Return Value:
01641 
01642     The virtual address the caller should use.
01643 
01644 Environment:
01645 
01646     Kernel mode.  DISPATCH_LEVEL or below.
01647 
01648 --*/
01649 
01650 {
01651     KIRQL OldIrql;
01652     PMI_VERIFIER_POOL_HEADER Header;
01653     SIZE_T ChargedBytes;
01654     PMI_VERIFIER_DRIVER_ENTRY Verifier;
01655     ULONG_PTR InsertedIndex;
01656     LOGICAL SpecialPoolAllocation;
01657     PPOOL_HEADER PoolHeader;
01658 
01659     InterlockedIncrement ((PLONG)&MmVerifierData.AllocationsSucceeded);
01660     ChargedBytes = EX_REAL_POOL_USAGE(NumberOfBytes);
01661     SpecialPoolAllocation = FALSE;
01662 
01663     if (VirtualAddress >= MmSpecialPoolStart && VirtualAddress < MmSpecialPoolEnd) {
01664         ChargedBytes = NumberOfBytes;
01665         InterlockedIncrement ((PLONG)&MmVerifierData.AllocationsSucceededSpecialPool);
01666         SpecialPoolAllocation = TRUE;
01667     }
01668     else if (NumberOfBytes <= POOL_BUDDY_MAX) {
01669         ChargedBytes -= POOL_OVERHEAD;
01670     }
01671     else {
01672 
01673         //
01674         // This isn't exactly true but it does give the user a way to see
01675         // if this machine is large enough to support special pool 100%.
01676         //
01677 
01678         InterlockedIncrement ((PLONG)&MmVerifierData.AllocationsSucceededSpecialPool);
01679     }
01680 
01681     if ((PoolType & POOL_VERIFIER_MASK) == 0) {
01682         return VirtualAddress;
01683     }
01684 
01685     if (NumberOfBytes > POOL_BUDDY_MAX) {
01686         ASSERT (BYTE_OFFSET(VirtualAddress) == 0);
01687     }
01688 
01689     Verifier = ViLocateVerifierEntry (CallingAddress);
01690     ASSERT (Verifier != NULL);
01691     VerifierIsTrackingPool = TRUE;
01692 
01693     if (SpecialPoolAllocation == TRUE) {
01694 
01695         //
01696         // Carefully adjust the special pool page to move the verifier tracking
01697         // header to the front.  This allows the allocation to remain butted
01698         // against the end of the page so overruns can be detected immediately.
01699         //
01700 
01701         if (((ULONG_PTR)VirtualAddress & (PAGE_SIZE - 1))) {
01702             PoolHeader = (PPOOL_HEADER)(PAGE_ALIGN (VirtualAddress));
01703             Header = (PMI_VERIFIER_POOL_HEADER) (PoolHeader + 1);
01704             VirtualAddress = (PVOID) ((PCHAR)VirtualAddress + sizeof (MI_VERIFIER_POOL_HEADER));
01705         }
01706         else {
01707             PoolHeader = (PPOOL_HEADER)((PCHAR)PAGE_ALIGN (VirtualAddress) + PAGE_SIZE - POOL_OVERHEAD);
01708             Header = (PMI_VERIFIER_POOL_HEADER) (PoolHeader - 1);
01709         }
01710         // ASSERT (PoolHeader->Ulong1 & MI_SPECIAL_POOL_VERIFIER);
01711         PoolHeader->Ulong1 -= sizeof (MI_VERIFIER_POOL_HEADER);
01712         ChargedBytes -= sizeof (MI_VERIFIER_POOL_HEADER);
01713         PoolHeader->Ulong1 |= MI_SPECIAL_POOL_VERIFIER;
01714     }
01715     else {
01716         Header = (PMI_VERIFIER_POOL_HEADER)((PCHAR)VirtualAddress +
01717                          ChargedBytes -
01718                          sizeof(MI_VERIFIER_POOL_HEADER));
01719     }
01720 
01721     ASSERT (((ULONG_PTR)Header & (sizeof(ULONG) - 1)) == 0);
01722 
01723 
01724     Header->Verifier = Verifier;
01725 
01726     //
01727     // Enqueue the entry and update per-driver counters.
01728     // Note that paged pool allocations must be chained using nonpaged
01729     // pool to prevent deadlocks.
01730     //
01731 
01732     ExAcquireSpinLock (&Verifier->VerifierPoolLock, &OldIrql);
01733 
01734     InsertedIndex = ViInsertPoolAllocation (Verifier,
01735                                             VirtualAddress,
01736                                             CallingAddress,
01737                                             ChargedBytes,
01738                                             Tag);
01739 
01740     if ((PoolType & BASE_POOL_TYPE_MASK) == PagedPool) {
01741 
01742         Verifier->PagedBytes += ChargedBytes;
01743         if (Verifier->PagedBytes > Verifier->PeakPagedBytes) {
01744             Verifier->PeakPagedBytes = Verifier->PagedBytes;
01745         }
01746 
01747         Verifier->CurrentPagedPoolAllocations += 1;
01748         if (Verifier->CurrentPagedPoolAllocations > Verifier->PeakPagedPoolAllocations) {
01749             Verifier->PeakPagedPoolAllocations = Verifier->CurrentPagedPoolAllocations;
01750         }
01751     }
01752     else {
01753         Verifier->NonPagedBytes += ChargedBytes;
01754         if (Verifier->NonPagedBytes > Verifier->PeakNonPagedBytes) {
01755             Verifier->PeakNonPagedBytes = Verifier->NonPagedBytes;
01756         }
01757 
01758         Verifier->CurrentNonPagedPoolAllocations += 1;
01759         if (Verifier->CurrentNonPagedPoolAllocations > Verifier->PeakNonPagedPoolAllocations) {
01760             Verifier->PeakNonPagedPoolAllocations = Verifier->CurrentNonPagedPoolAllocations;
01761         }
01762     }
01763 
01764     ExReleaseSpinLock (&Verifier->VerifierPoolLock, OldIrql);
01765 
01766     //
01767     // Since the header for paged pool is paged, don't initialize it until the
01768     // spinlock above is released.
01769     //
01770 
01771     Header->ListIndex = InsertedIndex;
01772 
01773     //
01774     // Update systemwide counters.
01775     //
01776 
01777     if ((PoolType & BASE_POOL_TYPE_MASK) == PagedPool) {
01778         ExAcquireFastMutex (&VerifierPoolMutex);
01779 
01780         MmVerifierData.PagedBytes += ChargedBytes;
01781         if (MmVerifierData.PagedBytes > MmVerifierData.PeakPagedBytes) {
01782             MmVerifierData.PeakPagedBytes = MmVerifierData.PagedBytes;
01783         }
01784 
01785         MmVerifierData.CurrentPagedPoolAllocations += 1;
01786         if (MmVerifierData.CurrentPagedPoolAllocations > MmVerifierData.PeakPagedPoolAllocations) {
01787             MmVerifierData.PeakPagedPoolAllocations = MmVerifierData.CurrentPagedPoolAllocations;
01788         }
01789 
01790         ExReleaseFastMutex (&VerifierPoolMutex);
01791     }
01792     else {
01793         ExAcquireSpinLock (&VerifierPoolLock, &OldIrql);
01794 
01795         MmVerifierData.NonPagedBytes += ChargedBytes;
01796         if (MmVerifierData.NonPagedBytes > MmVerifierData.PeakNonPagedBytes) {
01797             MmVerifierData.PeakNonPagedBytes = MmVerifierData.NonPagedBytes;
01798         }
01799 
01800         MmVerifierData.CurrentNonPagedPoolAllocations += 1;
01801         if (MmVerifierData.CurrentNonPagedPoolAllocations > MmVerifierData.PeakNonPagedPoolAllocations) {
01802             MmVerifierData.PeakNonPagedPoolAllocations = MmVerifierData.CurrentNonPagedPoolAllocations;
01803         }
01804 
01805         ExReleaseSpinLock (&VerifierPoolLock, OldIrql);
01806     }
01807 
01808     return VirtualAddress;
01809 }

VOID ViPrintString (  IN PUNICODE_STRING  DriverName  ) 
 

Definition at line 4336 of file verifier.c.

References _VERIFIER_STRING_INFO::BuildNumber, _VERIFIER_STRING_INFO::Check, DbgPrint, _VERIFIER_STRING_INFO::DriverVerifierLevel, FALSE, _VERIFIER_STRING_INFO::Flags, L, MmVerifierData, NtBuildNumber, Printable, PrintableChars, RtlUpcaseUnicodeChar(), TRUE, and USHORT.

Referenced by MiApplyDriverVerifier(). 

04342                    :
04343 
04344     This routine does a really bad hash of build number, verifier level and
04345     flags by using the driver name as a stream of bytes to XOR into the flags,
04346     etc.
04347 
04348     This is a Neill Clift special.
04349 
04350 Arguments:
04351 
04352     DriverName - Supplies the name of the driver.
04353 
04354 Return Value:
04355 
04356     None.
04357 
04358 --*/
04359 
04360 {
04361     VERIFIER_STRING_INFO Bld;
04362     PUCHAR BufPtr;
04363     PWCHAR DriverPtr;
04364     ULONG BufLen;
04365     ULONG i;
04366     ULONG j;
04367     ULONG DriverChars;
04368     ULONG MaxChars;
04369     WCHAR OutBuf[sizeof (VERIFIER_STRING_INFO) * 2 + 1];
04370     UNICODE_STRING OutBufU;
04371     ULONG Rem;
04372     ULONG LastRem;
04373     LOGICAL Done;
04374 
04375     Bld.BuildNumber = NtBuildNumber;
04376     Bld.DriverVerifierLevel = MmVerifierData.Level;
04377 
04378     //
04379     // Unloads and other actions could be encoded in the Flags field here.
04380     //
04381 
04382     Bld.Flags = 0;
04383 
04384     //
04385     // Make the last ULONG a weird function of the others.
04386     //
04387 
04388     Bld.Check = ((Bld.Flags + 1) * Bld.BuildNumber * (Bld.DriverVerifierLevel + 1)) * 123456789;
04389 
04390     BufPtr = (PUCHAR) &Bld;
04391     BufLen = sizeof (Bld);
04392 
04393     DriverChars = DriverName->Length / sizeof (DriverName->Buffer[0]);
04394     DriverPtr = DriverName->Buffer;
04395     MaxChars = DriverChars;
04396 
04397     if (DriverChars < sizeof (VERIFIER_STRING_INFO)) {
04398         MaxChars = sizeof (VERIFIER_STRING_INFO);
04399     }
04400 
04401     //
04402     // Xor each character in the driver name into the buffer.
04403     //
04404 
04405     for (i = 0; i < MaxChars; i += 1) {
04406         BufPtr[i % BufLen] ^= (UCHAR) RtlUpcaseUnicodeChar(DriverPtr[i % DriverChars]);
04407     }
04408 
04409     //
04410     // Produce a base N decoding of the binary buffer using the printable
04411     // characters defines. Treat the binary as a byte array and do the
04412     // division for each, tracking the carry.
04413     //
04414 
04415     j = 0;
04416     do {
04417         Done = TRUE;
04418 
04419         for (i = 0, LastRem = 0; i < sizeof (VERIFIER_STRING_INFO); i += 1) {
04420             Rem = BufPtr[i] + 256 * LastRem;
04421             BufPtr[i] = (UCHAR) (Rem / PrintableChars);
04422             LastRem = Rem % PrintableChars;
04423             if (BufPtr[i]) {
04424                 Done = FALSE;
04425             }
04426         }
04427         OutBuf[j++] = Printable[LastRem];
04428 
04429         if (j >= sizeof (OutBuf) / sizeof (OutBuf[0])) {
04430 
04431             //
04432             // The stack buffer isn't big enough.
04433             //
04434 
04435             return;
04436         }
04437 
04438     } while (Done == FALSE);
04439 
04440     OutBuf[j] = L'\0';
04441 
04442     OutBufU.Length = OutBufU.MaximumLength = (USHORT) j * sizeof (WCHAR);
04443     OutBufU.Buffer = OutBuf;
04444 
04445     DbgPrint ("*******************************************************************************\n");
04446     DbgPrint ("*                                                                             *\n");
04447 
04448     DbgPrint ("* This is the string to paste into your build mail\n");
04449 
04450     DbgPrint ("* Driver Verifier: Enabled for %Z on Build %ld %wZ\n",
04451               DriverName, NtBuildNumber & 0xFFFFFFF, &OutBufU);
04452 
04453     DbgPrint ("*                                                                             *\n");
04454     DbgPrint ("*******************************************************************************\n");
04455 
04456     return;
04457 }

VOID ViReleasePoolAllocation (  IN PMI_VERIFIER_DRIVER_ENTRY  Verifier,
IN PVOID  VirtualAddress,
IN ULONG_PTR  ListIndex,
IN SIZE_T  ChargedBytes
) 
 

Definition at line 1447 of file verifier.c.

References ASSERT, DISPATCH_LEVEL, _VI_POOL_ENTRY::FreeListNext, _VI_POOL_ENTRY::InUse, KeBugCheckEx(), MI_CONVERT_PHYSICAL_TO_PFN, MI_GET_PAGE_FRAME_FROM_PTE, MI_IS_PHYSICAL_ADDRESS, MiGetPteAddress, NULL, _VI_POOL_ENTRY_INUSE::NumberOfBytes, _MMPTE::u, and _VI_POOL_ENTRY_INUSE::VirtualAddress.

Referenced by VerifierFreeTrackedPool(). 

01456                    :
01457 
01458     This function removes the specified virtual address from the verifier
01459     list for this driver.
01460 
01461 Arguments:
01462 
01463     Verifier - Supplies the verifier entry to update.
01464 
01465     VirtualAddress - Supplies the virtual address to release.
01466 
01467     ListIndex - Supplies the verifier pool hash index for the address being
01468                 released.
01469 
01470     ChargedBytes - Supplies the bytes charged for this allocation.
01471 
01472 Return Value:
01473 
01474     None.
01475 
01476 Environment:
01477 
01478     Kernel mode, DISPATCH_LEVEL.  The Verifier->VerifierPoolLock must be held.
01479 
01480 --*/
01481 
01482 {
01483     PFN_NUMBER PageFrameIndex;
01484     PFN_NUMBER PageFrameIndex2;
01485     PVI_POOL_ENTRY HashEntry;
01486     PMMPTE PointerPte;
01487 
01488     ASSERT (KeGetCurrentIrql() == DISPATCH_LEVEL);
01489 
01490     if (Verifier->PoolHash == NULL) {
01491         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
01492                       0x59,
01493                       (ULONG_PTR)VirtualAddress,
01494                       ListIndex,
01495                       (ULONG_PTR)Verifier);
01496     }
01497 
01498     //
01499     // Ensure that the list pointer has not been overrun and still
01500     // points at something decent.
01501     //
01502 
01503     HashEntry = Verifier->PoolHash + ListIndex;
01504 
01505     if (ListIndex >= Verifier->PoolHashSize) {
01506         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
01507                       0x54,
01508                       (ULONG_PTR)VirtualAddress,
01509                       Verifier->PoolHashSize,
01510                       ListIndex);
01511     }
01512 
01513     if (HashEntry->InUse.VirtualAddress != VirtualAddress) {
01514 
01515         PageFrameIndex = 0;
01516         PageFrameIndex2 = 1;
01517 
01518         if ((!MI_IS_PHYSICAL_ADDRESS(VirtualAddress)) &&
01519             (MI_IS_PHYSICAL_ADDRESS(HashEntry->InUse.VirtualAddress))) {
01520 
01521             PointerPte = MiGetPteAddress(VirtualAddress);
01522             if (PointerPte->u.Hard.Valid == 1) {
01523                 PageFrameIndex = MI_GET_PAGE_FRAME_FROM_PTE (PointerPte);
01524 
01525                 PageFrameIndex2 = MI_CONVERT_PHYSICAL_TO_PFN (HashEntry->InUse.VirtualAddress);
01526             }
01527         }
01528 
01529         //
01530         // Caller overran and corrupted the virtual address - the linked
01531         // list cannot be counted on either.
01532         //
01533 
01534         if (PageFrameIndex != PageFrameIndex2) {
01535             KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
01536                           0x52,
01537                           (ULONG_PTR)VirtualAddress,
01538                           (ULONG_PTR)HashEntry->InUse.VirtualAddress,
01539                           ChargedBytes);
01540         }
01541     }
01542 
01543     if (HashEntry->InUse.NumberOfBytes != ChargedBytes) {
01544 
01545         //
01546         // Caller overran and corrupted the byte count - the linked
01547         // list cannot be counted on either.
01548         //
01549 
01550         KeBugCheckEx (DRIVER_VERIFIER_DETECTED_VIOLATION,
01551                       0x51,
01552                       (ULONG_PTR)VirtualAddress,
01553                       (ULONG_PTR)HashEntry,
01554                       ChargedBytes);
01555     }
01556 
01557     //
01558     // Put this list entry into the freelist.
01559     //
01560 
01561     HashEntry->FreeListNext = Verifier->PoolHashFree;
01562     Verifier->PoolHashFree = HashEntry - Verifier->PoolHash;
01563 }

LOGICAL ViReservePoolAllocation (  IN PMI_VERIFIER_DRIVER_ENTRY  Verifier  ) 
 

Definition at line 1233 of file verifier.c.

References ASSERT, ExAllocatePoolWithTagPriority(), ExFreePool(), FALSE, _VI_POOL_ENTRY::FreeListNext, HighPoolPriority, Increment, NonPagedPool, NULL, PAGE_SIZE, POOL_DRIVER_MASK, PVI_POOL_ENTRY, TRUE, VI_POOL_ENTRIES_PER_PAGE, and VI_POOL_ENTRY.

Referenced by VeAllocatePoolWithTagPriority(). 

01236 {
01237     ULONG_PTR OldSize;
01238     ULONG_PTR NewSize;
01239     ULONG_PTR NewHashOffset;
01240     ULONG_PTR Increment;
01241     ULONG_PTR Entries;
01242     ULONG_PTR i;
01243     KIRQL OldIrql;
01244     PVOID NewHashTable;
01245     PVI_POOL_ENTRY HashEntry;
01246     PVI_POOL_ENTRY OldHashTable;
01247 
01248     ExAcquireSpinLock (&Verifier->VerifierPoolLock, &OldIrql);
01249 
01250     while (Verifier->PoolHashSize <= Verifier->CurrentPagedPoolAllocations + Verifier->CurrentNonPagedPoolAllocations + Verifier->PoolHashReserved) {
01251 
01252         //
01253         // More space is needed.  Try for it now.
01254         //
01255 
01256 #define VI_POOL_ENTRIES_PER_PAGE (PAGE_SIZE / sizeof(VI_POOL_ENTRY))
01257 
01258         OldSize = Verifier->PoolHashSize * sizeof(VI_POOL_ENTRY);
01259 
01260         if (Verifier->PoolHashSize >= VI_POOL_ENTRIES_PER_PAGE) {
01261             Increment = PAGE_SIZE;
01262         }
01263         else {
01264             Increment = 16 * sizeof (VI_POOL_ENTRY);
01265         }
01266 
01267         ExReleaseSpinLock (&Verifier->VerifierPoolLock, OldIrql);
01268 
01269         NewSize = OldSize + Increment;
01270 
01271         if (NewSize < OldSize) {
01272             return FALSE;
01273         }
01274 
01275         //
01276         // Note POOL_DRIVER_MASK must be set to stop the recursion loop
01277         // when using the kernel verifier.
01278         //
01279 
01280         NewHashTable = ExAllocatePoolWithTagPriority (NonPagedPool | POOL_DRIVER_MASK,
01281                                                       NewSize,
01282                                                       'ppeV',
01283                                                       HighPoolPriority);
01284 
01285         ExAcquireSpinLock (&Verifier->VerifierPoolLock, &OldIrql);
01286 
01287         OldSize = Verifier->PoolHashSize * sizeof(VI_POOL_ENTRY);
01288 
01289         if (NewHashTable == NULL) {
01290             if (Verifier->PoolHashSize <= Verifier->CurrentPagedPoolAllocations + Verifier->CurrentNonPagedPoolAllocations + Verifier->PoolHashReserved) {
01291                 ExReleaseSpinLock (&Verifier->VerifierPoolLock, OldIrql);
01292                 return FALSE;
01293             }
01294 
01295             //
01296             // Another thread got here before us and space is available.
01297             //
01298 
01299             break;
01300         }
01301 
01302         if (NewSize != OldSize + Increment) {
01303 
01304             //
01305             // Another thread got here before us.
01306             //
01307 
01308             ExReleaseSpinLock (&Verifier->VerifierPoolLock, OldIrql);
01309             ExFreePool (NewHashTable);
01310             ExAcquireSpinLock (&Verifier->VerifierPoolLock, &OldIrql);
01311         }
01312         else {
01313 
01314             //
01315             // Rebuild the list into the new table.
01316             //
01317 
01318             OldHashTable = Verifier->PoolHash;
01319             if (OldHashTable != NULL) {
01320                 RtlCopyMemory (NewHashTable, OldHashTable, OldSize);
01321             }
01322 
01323             //
01324             // Construct the freelist chaining it through any existing
01325             // list (any free entries must be already reserved).
01326             //
01327 
01328             HashEntry = (PVI_POOL_ENTRY) ((PCHAR)NewHashTable + OldSize);
01329             Entries = Increment / sizeof (VI_POOL_ENTRY);
01330             NewHashOffset = HashEntry - (PVI_POOL_ENTRY)NewHashTable;
01331 
01332             //
01333             // If list compaction becomes important then chaining it on the
01334             // end here will need to be revisited.
01335             //
01336 
01337             for (i = 0; i < Entries; i += 1) {
01338                 HashEntry->FreeListNext = NewHashOffset + i + 1;
01339                 HashEntry += 1;
01340             }
01341             HashEntry -= 1;
01342             HashEntry->FreeListNext = Verifier->PoolHashFree;
01343             Verifier->PoolHashFree = NewHashOffset;
01344             Verifier->PoolHash = NewHashTable;
01345             Verifier->PoolHashSize += Entries;
01346 
01347             //
01348             // Free the old table.
01349             //
01350 
01351             if (OldHashTable != NULL) {
01352                 ExReleaseSpinLock (&Verifier->VerifierPoolLock, OldIrql);
01353                 ExFreePool (OldHashTable);
01354                 ExAcquireSpinLock (&Verifier->VerifierPoolLock, &OldIrql);
01355             }
01356         }
01357     }
01358 
01359     Verifier->PoolHashReserved += 1;
01360 
01361     ASSERT (Verifier->PoolHashSize >= Verifier->CurrentPagedPoolAllocations + Verifier->CurrentNonPagedPoolAllocations + Verifier->PoolHashReserved);
01362 
01363     ExReleaseSpinLock (&Verifier->VerifierPoolLock, OldIrql);
01364 
01365     return TRUE;
01366 }

VOID ViTrimAllSystemPagableMemory (  VOID   ) 
 

Definition at line 2333 of file verifier.c.

References FALSE, KeQueryTickCount(), KernelVerifier, KernelVerifierTickPage, MiNoPageOnRaiseIrql, MmTrimAllSystemPagableMemory(), MmVerifierData, and TRUE.

Referenced by VerifierKeAcquireSpinLock(), VerifierKeRaiseIrql(), and VerifierSynchronizeExecution(). 

02336 {
02337     LARGE_INTEGER CurrentTime;
02338     LOGICAL PageOut;
02339 
02340     PageOut = TRUE;
02341     if (KernelVerifier == TRUE) {
02342         KeQueryTickCount(&CurrentTime);
02343         if ((CurrentTime.LowPart & KernelVerifierTickPage) != 0) {
02344             PageOut = FALSE;
02345         }
02346     }
02347 
02348     if ((PageOut == TRUE) && (MiNoPageOnRaiseIrql == 0)) {
02349         MmVerifierData.TrimRequests += 1;
02350         if (MmTrimAllSystemPagableMemory (FALSE) == TRUE) {
02351             MmVerifierData.Trims += 1;
02352         }
02353     }
02354 }

Variable Documentation

LOGICAL KernelVerifier = FALSE
 

Definition at line 404 of file verifier.c.

ULONG KernelVerifierTickPage = 0x7
 

Definition at line 406 of file verifier.c.

Referenced by ViTrimAllSystemPagableMemory().

ULONG MiActiveVerifierThunks
 

Definition at line 378 of file verifier.c.

Referenced by MiVerifierCheckThunks(), MmAddVerifierThunks(), and MmUnloadSystemImage().

ULONG MiActiveVerifies
 

Definition at line 376 of file verifier.c.

Referenced by MiApplyDriverVerifier(), and MiVerifyingDriverUnloading().

ULONG MiNoPageOnRaiseIrql
 

Definition at line 380 of file verifier.c.

Referenced by MiVerifyingDriverUnloading(), and ViTrimAllSystemPagableMemory().

LIST_ENTRY MiSuspectDriverList
 

Definition at line 370 of file verifier.c.

Referenced by MiApplyDriverVerifier(), MiInitializeDriverVerifierList(), MiVerifyingDriverUnloading(), MmGetVerifierInformation(), ViInsertVerifierEntry(), and ViLocateVerifierEntry().

LIST_ENTRY MiVerifierDriverAddedThunkListHead
 

Definition at line 400 of file verifier.c.

Referenced by MiEnableVerifier(), MiInitializeDriverVerifierList(), MiVerifierCheckThunks(), and MmAddVerifierThunks().

ULONG MiVerifierStackProtectTime
 

Definition at line 382 of file verifier.c.

Referenced by MiApplyDriverVerifier(), and MiVerifyingDriverUnloading().

VERIFIER_THUNKS MiVerifierThunks[]
 

Definition at line 4516 of file verifier.c.

Referenced by MiEnableVerifier().

LOGICAL MiVerifyAllDrivers
 

Definition at line 372 of file verifier.c.

Referenced by MiApplyDriverVerifier(), and MiInitializeDriverVerifierList().

WCHAR MiVerifyRandomDrivers
 

Definition at line 374 of file verifier.c.

Referenced by MiApplyDriverVerifier(), and MiInitializeDriverVerifierList().

LOGICAL MmDontVerifyRandomDrivers = TRUE
 

Definition at line 384 of file verifier.c.

LOGICAL MmSpecialPoolCatchOverruns
 

Definition at line 402 of file verifier.c.

MM_DRIVER_VERIFIER_DATA MmVerifierData
 

Definition at line 361 of file verifier.c.

WCHAR Printable[] = L"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" [static]
 

Definition at line 4332 of file verifier.c.

Referenced by ViPrintString().

ULONG PrintableChars = sizeof (Printable) / sizeof (Printable[0]) - 1 [static]
 

Definition at line 4333 of file verifier.c.

Referenced by ViPrintString().

int VerifierIrqlData[0x10]
 

Definition at line 2230 of file verifier.c.

Referenced by KfSanityCheckLowerIrql(), and KfSanityCheckRaiseIrql().

LOGICAL VerifierIsTrackingPool = FALSE
 

Definition at line 390 of file verifier.c.

Referenced by VerifierFreeTrackedPool(), and ViPostPoolAllocation().

PRTL_BITMAP VerifierLargePagedPoolMap
 

Definition at line 398 of file verifier.c.

Referenced by MiAllocatePoolPages(), MiBuildPagedPool(), and MiFreePoolPages().

KSPIN_LOCK VerifierListLock
 

Definition at line 392 of file verifier.c.

Referenced by MiInitializeDriverVerifierList(), MiVerifyingDriverUnloading(), ViInitializeEntry(), ViInsertVerifierEntry(), and ViLocateVerifierEntry().

ULONG VerifierModifyableOptions
 

Definition at line 367 of file verifier.c.

Referenced by MiInitializeDriverVerifierList(), and MmSetVerifierInformation().

ULONG VerifierOptionChanges
 

Definition at line 368 of file verifier.c.

Referenced by MmSetVerifierInformation().

KSPIN_LOCK VerifierPoolLock
 

Definition at line 394 of file verifier.c.

Referenced by MiInitializeDriverVerifierList(), VerifierFreeTrackedPool(), and ViPostPoolAllocation().

FAST_MUTEX VerifierPoolMutex
 

Definition at line 396 of file verifier.c.

Referenced by MiInitializeDriverVerifierList(), VerifierFreeTrackedPool(), and ViPostPoolAllocation().

LARGE_INTEGER VerifierRequiredTimeSinceBoot = {(ULONG)(40 * 1000 * 1000 * 10), 1}
 

Definition at line 388 of file verifier.c.

Referenced by ViInjectResourceFailure().

LOGICAL VerifierSystemSufficientlyBooted
 

Definition at line 386 of file verifier.c.

Referenced by ViInjectResourceFailure().

PUNICODE_STRING ViBadDriver
 

Definition at line 3622 of file verifier.c.

Referenced by MiVerifyingDriverUnloading().

KSPIN_LOCK ViBadMapperLock
 

Definition at line 628 of file verifier.c.

Referenced by MiInitializeDriverVerifierList(), and ViAddBadMapper().

PVOID ViBadMappers[VI_BAD_MAPPERS_MAX]
 

Definition at line 629 of file verifier.c.

Referenced by ViAddBadMapper().

Generated on Sat May 15 19:46:08 2004 for test by doxygen 1.3.7