ntoskrnl-METHOD_OUT_DIRECT: Update patchset.

This commit is contained in:
Sebastian Lackner 2016-10-16 15:28:18 +02:00
parent 54cc9a694c
commit 15a0c7553d
6 changed files with 238 additions and 7 deletions

View File

@ -1,8 +1,9 @@
From 48fd497bca17fc444f06573af31c8562d8274ddd Mon Sep 17 00:00:00 2001
From d8778f1eb6857e13cf2835af713adccd77e2f573 Mon Sep 17 00:00:00 2001
From: Sebastian Lackner <sebastian@fds-team.de>
Date: Fri, 14 Oct 2016 21:10:36 +0200
Date: Sun, 16 Oct 2016 08:48:55 +0200
Subject: ntoskrnl.exe: Defer deallocation of in_buff in dispatch_ioctl.
Signed-off-by: Sebastian Lackner <sebastian@fds-team.de>
---
dlls/ntoskrnl.exe/ntoskrnl.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

View File

@ -1,9 +1,10 @@
From b839b21ed37ea38c1cce82e4c45f5762492742cd Mon Sep 17 00:00:00 2001
From 9dd951a6b25ae670de5c9390ad83cf688b6975f8 Mon Sep 17 00:00:00 2001
From: Sebastian Lackner <sebastian@fds-team.de>
Date: Fri, 14 Oct 2016 22:19:27 +0200
Subject: ntoskrnl.exe: Add support for METHOD_IN_DIRECT and METHOD_OUT_DIRECT
Date: Sun, 16 Oct 2016 08:51:06 +0200
Subject: ntoskrnl.exe: Add support for METHOD_IN_DIRECT/METHOD_OUT_DIRECT
ioctls.
Signed-off-by: Sebastian Lackner <sebastian@fds-team.de>
---
dlls/ntdll/file.c | 2 ++
dlls/ntoskrnl.exe/ntoskrnl.c | 21 +++++++++++++++++----

View File

@ -0,0 +1,92 @@
From 0de56912047ef60aba3a80845fc2eeb0cce7188b Mon Sep 17 00:00:00 2001
From: Sebastian Lackner <sebastian@fds-team.de>
Date: Sun, 16 Oct 2016 08:53:29 +0200
Subject: ntoskrnl.exe: Use MmInitializeMdl in IoAllocateMdl.
Signed-off-by: Sebastian Lackner <sebastian@fds-team.de>
---
dlls/ntoskrnl.exe/ntoskrnl.c | 19 ++++---------------
include/ddk/wdm.h | 20 ++++++++++++++++++++
2 files changed, 24 insertions(+), 15 deletions(-)
diff --git a/dlls/ntoskrnl.exe/ntoskrnl.c b/dlls/ntoskrnl.exe/ntoskrnl.c
index 912d084..eac81f7 100644
--- a/dlls/ntoskrnl.exe/ntoskrnl.c
+++ b/dlls/ntoskrnl.exe/ntoskrnl.c
@@ -744,31 +744,20 @@ PVOID WINAPI IoAllocateErrorLogEntry( PVOID IoObject, UCHAR EntrySize )
*/
PMDL WINAPI IoAllocateMdl( PVOID va, ULONG length, BOOLEAN secondary, BOOLEAN charge_quota, IRP *irp )
{
+ SIZE_T mdl_size;
PMDL mdl;
- ULONG_PTR address = (ULONG_PTR)va;
- ULONG_PTR page_address;
- SIZE_T nb_pages, mdl_size;
TRACE("(%p, %u, %i, %i, %p)\n", va, length, secondary, charge_quota, irp);
if (charge_quota)
FIXME("Charge quota is not yet supported\n");
- /* FIXME: We suppose that page size is 4096 */
- page_address = address & ~(4096 - 1);
- nb_pages = (((address + length - 1) & ~(4096 - 1)) - page_address) / 4096 + 1;
-
- mdl_size = sizeof(MDL) + nb_pages * sizeof(PVOID);
-
- mdl = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, mdl_size);
+ mdl_size = sizeof(MDL) + sizeof(PFN_NUMBER) * ADDRESS_AND_SIZE_TO_SPAN_PAGES(va, length);
+ mdl = HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, mdl_size );
if (!mdl)
return NULL;
- mdl->Size = mdl_size;
- mdl->Process = NULL; /* FIXME: IoGetCurrentProcess */
- mdl->StartVa = (PVOID)page_address;
- mdl->ByteCount = length;
- mdl->ByteOffset = address - page_address;
+ MmInitializeMdl( mdl, va, length );
if (!irp) return mdl;
diff --git a/include/ddk/wdm.h b/include/ddk/wdm.h
index 3e93469..61de490 100644
--- a/include/ddk/wdm.h
+++ b/include/ddk/wdm.h
@@ -28,6 +28,15 @@
#define POINTER_ALIGNMENT
#endif
+/* FIXME: We suppose that page size is 4096 */
+#define PAGE_SIZE 0x1000
+#define PAGE_SHIFT 12
+
+#define BYTE_OFFSET(va) ((ULONG)((ULONG_PTR)(va) & (PAGE_SIZE - 1)))
+#define PAGE_ALIGN(va) ((PVOID)((ULONG_PTR)(va) & ~(PAGE_SIZE - 1)))
+#define ADDRESS_AND_SIZE_TO_SPAN_PAGES(va, length) \
+ ((BYTE_OFFSET(va) + ((SIZE_T)(length)) + (PAGE_SIZE - 1)) >> PAGE_SHIFT)
+
typedef LONG KPRIORITY;
typedef ULONG_PTR KSPIN_LOCK, *PKSPIN_LOCK;
@@ -1035,6 +1044,17 @@ typedef struct _MDL {
} MDL, *PMDL;
typedef MDL *PMDLX;
+typedef ULONG PFN_NUMBER, *PPFN_NUMBER;
+
+static inline void MmInitializeMdl(MDL *mdl, void *va, SIZE_T length)
+{
+ mdl->Next = NULL;
+ mdl->Size = sizeof(MDL) + sizeof(PFN_NUMBER) * ADDRESS_AND_SIZE_TO_SPAN_PAGES(va, length);
+ mdl->MdlFlags = 0;
+ mdl->StartVa = (void *)PAGE_ALIGN(va);
+ mdl->ByteOffset = BYTE_OFFSET(va);
+ mdl->ByteCount = length;
+}
typedef struct _KTIMER {
DISPATCHER_HEADER Header;
--
2.9.0

View File

@ -0,0 +1,87 @@
From 2c548bab5f9a4f94a47052a67ef8cb6958f08de4 Mon Sep 17 00:00:00 2001
From: Sebastian Lackner <sebastian@fds-team.de>
Date: Sun, 16 Oct 2016 08:57:21 +0200
Subject: ntoskrnl.exe: Explicitly set MappedSystemVa for MDLs.
Signed-off-by: Sebastian Lackner <sebastian@fds-team.de>
---
dlls/ntoskrnl.exe/ntoskrnl.c | 26 ++++++++++++++++++++++++--
include/ddk/wdm.h | 9 +++++++++
2 files changed, 33 insertions(+), 2 deletions(-)
diff --git a/dlls/ntoskrnl.exe/ntoskrnl.c b/dlls/ntoskrnl.exe/ntoskrnl.c
index eac81f7..854d68d 100644
--- a/dlls/ntoskrnl.exe/ntoskrnl.c
+++ b/dlls/ntoskrnl.exe/ntoskrnl.c
@@ -820,6 +820,7 @@ PIRP WINAPI IoBuildDeviceIoControlRequest( ULONG code, PDEVICE_OBJECT device,
{
PIRP irp;
PIO_STACK_LOCATION irpsp;
+ MDL *mdl;
TRACE( "%x, %p, %p, %u, %p, %u, %u, %p, %p\n",
code, device, in_buff, in_len, out_buff, out_len, internal, event, iosb );
@@ -847,7 +848,16 @@ PIRP WINAPI IoBuildDeviceIoControlRequest( ULONG code, PDEVICE_OBJECT device,
case METHOD_IN_DIRECT:
case METHOD_OUT_DIRECT:
irp->AssociatedIrp.SystemBuffer = in_buff;
- IoAllocateMdl( out_buff, out_len, FALSE, FALSE, irp );
+
+ mdl = IoAllocateMdl( out_buff, out_len, FALSE, FALSE, irp );
+ if (!mdl)
+ {
+ IoFreeIrp( irp );
+ return NULL;
+ }
+
+ mdl->MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA;
+ mdl->MappedSystemVa = out_buff;
break;
case METHOD_NEITHER:
irpsp->Parameters.DeviceIoControl.Type3InputBuffer = in_buff;
@@ -882,7 +892,19 @@ PIRP WINAPI IoBuildSynchronousFsdRequest(ULONG majorfunc, PDEVICE_OBJECT device,
irpsp->CompletionRoutine = NULL;
irp->AssociatedIrp.SystemBuffer = buffer;
- if (device->Flags & DO_DIRECT_IO) IoAllocateMdl( buffer, length, FALSE, FALSE, irp );
+
+ if (device->Flags & DO_DIRECT_IO)
+ {
+ MDL *mdl = IoAllocateMdl( buffer, length, FALSE, FALSE, irp );
+ if (!mdl)
+ {
+ IoFreeIrp( irp );
+ return NULL;
+ }
+
+ mdl->MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA;
+ mdl->MappedSystemVa = buffer;
+ }
switch (majorfunc)
{
diff --git a/include/ddk/wdm.h b/include/ddk/wdm.h
index 61de490..3dda667 100644
--- a/include/ddk/wdm.h
+++ b/include/ddk/wdm.h
@@ -1305,8 +1305,17 @@ PVOID WINAPI MmAllocateContiguousMemory(SIZE_T,PHYSICAL_ADDRESS);
PVOID WINAPI MmAllocateNonCachedMemory(SIZE_T);
PMDL WINAPI MmAllocatePagesForMdl(PHYSICAL_ADDRESS,PHYSICAL_ADDRESS,PHYSICAL_ADDRESS,SIZE_T);
void WINAPI MmFreeNonCachedMemory(PVOID,SIZE_T);
+PVOID WINAPI MmMapLockedPagesSpecifyCache(PMDL,KPROCESSOR_MODE,MEMORY_CACHING_TYPE,PVOID,ULONG,ULONG);
MM_SYSTEMSIZE WINAPI MmQuerySystemSize(void);
+static inline void *MmGetSystemAddressForMdlSafe(MDL *mdl, ULONG priority)
+{
+ if (mdl->MdlFlags & (MDL_MAPPED_TO_SYSTEM_VA | MDL_SOURCE_IS_NONPAGED_POOL))
+ return mdl->MappedSystemVa;
+ else
+ return MmMapLockedPagesSpecifyCache(mdl, KernelMode, MmCached, NULL, FALSE, priority);
+}
+
void WINAPI ObDereferenceObject(void*);
NTSTATUS WINAPI ObReferenceObjectByHandle(HANDLE,ACCESS_MASK,POBJECT_TYPE,KPROCESSOR_MODE,PVOID*,POBJECT_HANDLE_INFORMATION);
NTSTATUS WINAPI ObReferenceObjectByName(UNICODE_STRING*,ULONG,ACCESS_STATE*,ACCESS_MASK,POBJECT_TYPE,KPROCESSOR_MODE,void*,void**);
--
2.9.0

View File

@ -0,0 +1,44 @@
From b7076ee4183b3e1da97374eabe04344569c55a66 Mon Sep 17 00:00:00 2001
From: Sebastian Lackner <sebastian@fds-team.de>
Date: Sun, 16 Oct 2016 08:59:23 +0200
Subject: hidclass.sys: Use MmGetSystemAddressForMdlSafe to access MDL data.
Signed-off-by: Sebastian Lackner <sebastian@fds-team.de>
---
dlls/hidclass.sys/device.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/dlls/hidclass.sys/device.c b/dlls/hidclass.sys/device.c
index d2a4710..189cd2e 100644
--- a/dlls/hidclass.sys/device.c
+++ b/dlls/hidclass.sys/device.c
@@ -419,7 +419,7 @@ static NTSTATUS handle_minidriver_string(DEVICE_OBJECT *device, IRP *irp, SHORT
if (status == STATUS_SUCCESS)
{
- WCHAR *out_buffer = (WCHAR*)(((BYTE*)irp->MdlAddress->StartVa) + irp->MdlAddress->ByteOffset);
+ WCHAR *out_buffer = MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority);
int length = irpsp->Parameters.DeviceIoControl.OutputBufferLength/sizeof(WCHAR);
TRACE("got string %s from minidriver\n",debugstr_w(buffer));
lstrcpynW(out_buffer, buffer, length);
@@ -440,7 +440,7 @@ static NTSTATUS HID_get_feature(DEVICE_OBJECT *device, IRP *irp)
irp->IoStatus.Information = 0;
- out_buffer = (((BYTE*)irp->MdlAddress->StartVa) + irp->MdlAddress->ByteOffset);
+ out_buffer = MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority);
TRACE_(hid_report)("Device %p Buffer length %i Buffer %p\n", device, irpsp->Parameters.DeviceIoControl.OutputBufferLength, out_buffer);
len = sizeof(*packet) + irpsp->Parameters.DeviceIoControl.OutputBufferLength;
@@ -569,7 +569,7 @@ NTSTATUS WINAPI HID_Device_ioctl(DEVICE_OBJECT *device, IRP *irp)
case IOCTL_HID_GET_INPUT_REPORT:
{
HID_XFER_PACKET packet;
- BYTE* buffer = ((BYTE*)irp->MdlAddress->StartVa) + irp->MdlAddress->ByteOffset;
+ BYTE *buffer = MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority);
if (extension->preparseData->InputReports[0].reportID)
packet.reportId = buffer[0];
--
2.9.0

View File

@ -5450,14 +5450,20 @@ fi
# Patchset ntoskrnl-METHOD_OUT_DIRECT
# |
# | Modified files:
# | * dlls/ntdll/file.c, dlls/ntoskrnl.exe/ntoskrnl.c
# | * dlls/hidclass.sys/device.c, dlls/ntdll/file.c, dlls/ntoskrnl.exe/ntoskrnl.c, include/ddk/wdm.h
# |
if test "$enable_ntoskrnl_METHOD_OUT_DIRECT" -eq 1; then
patch_apply ntoskrnl-METHOD_OUT_DIRECT/0001-ntoskrnl.exe-Defer-deallocation-of-in_buff-in-dispat.patch
patch_apply ntoskrnl-METHOD_OUT_DIRECT/0002-ntoskrnl.exe-Add-support-for-METHOD_IN_DIRECT-and-ME.patch
patch_apply ntoskrnl-METHOD_OUT_DIRECT/0003-ntoskrnl.exe-Use-MmInitializeMdl-in-IoAllocateMdl.patch
patch_apply ntoskrnl-METHOD_OUT_DIRECT/0004-ntoskrnl.exe-Explicitly-set-MappedSystemVa-for-MDLs.patch
patch_apply ntoskrnl-METHOD_OUT_DIRECT/0005-hidclass.sys-Use-MmGetSystemAddressForMdlSafe-to-acc.patch
(
echo '+ { "Sebastian Lackner", "ntoskrnl.exe: Defer deallocation of in_buff in dispatch_ioctl.", 1 },';
echo '+ { "Sebastian Lackner", "ntoskrnl.exe: Add support for METHOD_IN_DIRECT and METHOD_OUT_DIRECT ioctls.", 1 },';
echo '+ { "Sebastian Lackner", "ntoskrnl.exe: Add support for METHOD_IN_DIRECT/METHOD_OUT_DIRECT ioctls.", 1 },';
echo '+ { "Sebastian Lackner", "ntoskrnl.exe: Use MmInitializeMdl in IoAllocateMdl.", 1 },';
echo '+ { "Sebastian Lackner", "ntoskrnl.exe: Explicitly set MappedSystemVa for MDLs.", 1 },';
echo '+ { "Sebastian Lackner", "hidclass.sys: Use MmGetSystemAddressForMdlSafe to access MDL data.", 1 },';
) >> "$patchlist"
fi