NTSTATUS
BuildQueryDirectoryIrp(
IN HANDLE FileHandle,
IN HANDLE Event OPTIONAL,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
OUT PVOID FileInformation,
IN ULONG Length,
IN FILE_INFORMATION_CLASS FileInformationClass,
IN BOOLEAN ReturnSingleEntry,
IN PUNICODE_STRING FileName OPTIONAL,
IN BOOLEAN RestartScan,
IN UCHAR MinorFunction,
OUT BOOLEAN *SynchronousIo,
OUT PDEVICE_OBJECT *DeviceObject,
OUT PIRP *Irp,
OUT PFILE_OBJECT *FileObject,
OUT KPROCESSOR_MODE *RequestorMode
)
/*++
Routine Description:
This service operates on a directory file or OLE container specified by the
FileHandle parameter. The service returns information about files in the
directory or embeddings and streams in the container specified by the file
handle. The ReturnSingleEntry parameter specifies that only a single entry
should be returned rather than filling the buffer. The actual number of
files whose information is returned, is the smallest of the following:
o One entry, if the ReturnSingleEntry parameter is TRUE.
o The number of entries whose information fits into the specified
buffer.
o The number of entries that exist.
o One entry if the optional FileName parameter is specified.
If the optional FileName parameter is specified, then the only information
that is returned is for that single entries, if it exists. Note that the
file name may not specify any wildcard characters according to the naming
conventions of the target file system. The ReturnSingleEntry parameter is
simply ignored.
The information that is obtained about the entries in the directory or OLE
container is based on the FileInformationClass parameter. Legal values are
hard coded based on the MinorFunction.
Arguments:
FileHandle - Supplies a handle to the directory file or OLE container for
which information should be returned.
Event - Supplies an optional event to be set to the Signaled state when
the query is complete.
ApcRoutine - Supplies an optional APC routine to be executed when the
query is complete.
ApcContext - Supplies a context parameter to be passed to the ApcRoutine,
if an ApcRoutine was specified.
IoStatusBlock - Address of the caller's I/O status block.
FileInformation - Supplies a buffer to receive the requested information
returned about the contents of the directory.
Length - Supplies the length, in bytes, of the FileInformation buffer.
FileInformationClass - Specfies the type of information that is to be
returned about the files in the specified directory or OLE container.
ReturnSingleEntry - Supplies a BOOLEAN value that, if TRUE, indicates that
only a single entry should be returned.
FileName - Optionally supplies a file name within the specified directory
or OLE container.
RestartScan - Supplies a BOOLEAN value that, if TRUE, indicates that the
scan should be restarted from the beginning. This parameter must be
set to TRUE by the caller the first time the service is invoked.
MinorFunction - IRP_MN_QUERY_DIRECTORY or IRP_MN_QUERY_OLE_DIRECTORY
SynchronousIo - pointer to returned BOOLEAN; TRUE if synchronous I/O
DeviceObject - pointer to returned pointer to device object
Irp - pointer to returned pointer to device object
FileObject - pointer to returned pointer to file object
RequestorMode - pointer to returned requestor mode
Return Value:
The status returned is STATUS_SUCCESS if a valid irp was created for the
query operation.
--*/
{
PIRP irp;
NTSTATUS status;
PFILE_OBJECT fileObject;
PDEVICE_OBJECT deviceObject;
PKEVENT eventObject = (PKEVENT) NULL;
KPROCESSOR_MODE requestorMode;
PCHAR auxiliaryBuffer = (PCHAR) NULL;
PIO_STACK_LOCATION irpSp;
PMDL mdl;
PETHREAD CurrentThread;
PAGED_CODE();
//
// Get the previous mode; i.e., the mode of the caller.
//
CurrentThread = PsGetCurrentThread ();
requestorMode = KeGetPreviousModeByThread(&CurrentThread->Tcb);
*RequestorMode = requestorMode;
try {
if (requestorMode != KernelMode) {
ULONG operationlength = 0; // assume invalid
//
// The caller's access mode is not kernel so probe and validate
// each of the arguments as necessary. If any failures occur,
// the condition handler will be invoked to handle them. It
// will simply cleanup and return an access violation status
// code back to the system service dispatcher.
//
//
// The IoStatusBlock parameter must be writeable by the caller.
//
ProbeForWriteIoStatus(IoStatusBlock);
//
// Ensure that the FileInformationClass parameter is legal for
// querying information about files in the directory or object.
//
if (FileInformationClass == FileDirectoryInformation) {
operationlength = sizeof(FILE_DIRECTORY_INFORMATION);
} else if (MinorFunction == IRP_MN_QUERY_DIRECTORY) {
switch (FileInformationClass)
{
case FileFullDirectoryInformation:
operationlength = sizeof(FILE_FULL_DIR_INFORMATION);
break;
case FileIdFullDirectoryInformation:
operationlength = sizeof(FILE_ID_FULL_DIR_INFORMATION);
break;
case FileBothDirectoryInformation:
operationlength = sizeof(FILE_BOTH_DIR_INFORMATION);
break;
case FileIdBothDirectoryInformation:
operationlength = sizeof(FILE_ID_BOTH_DIR_INFORMATION);
break;
case FileNamesInformation:
operationlength = sizeof(FILE_NAMES_INFORMATION);
break;
case FileObjectIdInformation:
operationlength = sizeof(FILE_OBJECTID_INFORMATION);
break;
case FileQuotaInformation:
operationlength = sizeof(FILE_QUOTA_INFORMATION);
break;
case FileReparsePointInformation:
operationlength = sizeof(FILE_REPARSE_POINT_INFORMATION);
break;
}
}
//
// If the FileInformationClass parameter is illegal, fail now.
//
if (operationlength == 0) {
return STATUS_INVALID_INFO_CLASS;
}
//
// Ensure that the caller's supplied buffer is at least large enough
// to contain the fixed part of the structure required for this
// query.
//
if (Length < operationlength) {
return STATUS_INFO_LENGTH_MISMATCH;
}
//
// The FileInformation buffer must be writeable by the caller.
//
#if defined(_X86_)
ProbeForWrite( FileInformation, Length, sizeof( ULONG ) );
#elif defined(_WIN64)
//
// If we are a wow64 process, follow the X86 rules
//
if (PsGetCurrentProcessByThread(CurrentThread)->Wow64Process) {
ProbeForWrite( FileInformation, Length, sizeof( ULONG ) );
} else {
ProbeForWrite( FileInformation,
Length,
IopQuerySetAlignmentRequirement[FileInformationClass] );
}
#else
ProbeForWrite( FileInformation,
Length,
IopQuerySetAlignmentRequirement[FileInformationClass] );
#endif
}
//
// If the optional FileName parameter was specified, then it must be
// readable by the caller. Capture the file name string in a pool
// block. Note that if an error occurs during the copy, the cleanup
// code in the exception handler will deallocate the pool before
// returning an access violation status.
//
if (ARGUMENT_PRESENT( FileName )) {
UNICODE_STRING fileName;
PUNICODE_STRING nameBuffer;
//
// Capture the string descriptor itself to ensure that the
// string is readable by the caller without the caller being
// able to change the memory while its being checked.
//
if (requestorMode != KernelMode) {
ProbeAndReadUnicodeStringEx( &fileName, FileName );
} else {
fileName = *FileName;
}
//
// If the length is not an even number of bytes
// return an error.
//
if (fileName.Length & (sizeof(WCHAR) - 1)) {
return STATUS_INVALID_PARAMETER;
}
if (fileName.Length) {
//
// The length of the string is non-zero, so probe the
// buffer described by the descriptor if the caller was
// not kernel mode. Likewise, if the caller's mode was
// not kernel, then check the length of the name string
// to ensure that it is not too long.
//
if (requestorMode != KernelMode) {
ProbeForRead( fileName.Buffer,
fileName.Length,
sizeof( UCHAR ) );
//
// account for unicode
//
if (fileName.Length > MAXIMUM_FILENAME_LENGTH<<1) {
ExRaiseStatus( STATUS_INVALID_PARAMETER );
}
}
//
// Allocate an auxiliary buffer large enough to contain
// a file name descriptor and to hold the entire file
// name itself. Copy the body of the string into the
// buffer.
//
auxiliaryBuffer = ExAllocatePoolWithQuota( NonPagedPool,
fileName.Length + sizeof( UNICODE_STRING ) );
RtlCopyMemory( auxiliaryBuffer + sizeof( UNICODE_STRING ),
fileName.Buffer,
fileName.Length );
//
// Finally, build the Unicode string descriptor in the
// auxiliary buffer.
//
nameBuffer = (PUNICODE_STRING) auxiliaryBuffer;
nameBuffer->Length = fileName.Length;
nameBuffer->MaximumLength = fileName.Length;
nameBuffer->Buffer = (PWSTR) (auxiliaryBuffer + sizeof( UNICODE_STRING ) );
}
}
} except(EXCEPTION_EXECUTE_HANDLER) {
//
// An exception was incurred while probing the caller's buffers,
// attempting to allocate a pool buffer, or while trying to copy
// the caller's data. Determine what happened, clean everything
// up, and return an appropriate error status code.
//
if (auxiliaryBuffer) {
ExFreePool( auxiliaryBuffer );
}
return GetExceptionCode();
}
//
// There were no blatant errors so far, so reference the file object so
// the target device object can be found. Note that if the handle does
// not refer to a file object, or if the caller does not have the required
// access to the file, then it will fail.
//
status = ObReferenceObjectByHandle( FileHandle,
FILE_LIST_DIRECTORY,
IoFileObjectType,
requestorMode,
(PVOID *) &fileObject,
(POBJECT_HANDLE_INFORMATION) NULL );
if (!NT_SUCCESS( status )) {
if (auxiliaryBuffer) {
ExFreePool( auxiliaryBuffer );
}
return status;
}
*FileObject = fileObject;
//
// If this file has an I/O completion port associated w/it, then ensure
// that the caller did not supply an APC routine, as the two are mutually
// exclusive methods for I/O completion notification.
//
if (fileObject->CompletionContext && IopApcRoutinePresent( ApcRoutine )) {
ObDereferenceObject( fileObject );
if (auxiliaryBuffer) {
ExFreePool( auxiliaryBuffer );
}
return STATUS_INVALID_PARAMETER;
}
//
// Get the address of the event object and set the event to the Not-
// Signaled state, if an event was specified. Note here, too, that if
// the handle does not refer to an event, or if the event cannot be
// written, then the reference will fail.
//
if (ARGUMENT_PRESENT( Event )) {
status = ObReferenceObjectByHandle( Event,
EVENT_MODIFY_STATE,
ExEventObjectType,
requestorMode,
(PVOID *) &eventObject,
(POBJECT_HANDLE_INFORMATION) NULL );
if (!NT_SUCCESS( status )) {
if (auxiliaryBuffer) {
ExFreePool( auxiliaryBuffer );
}
ObDereferenceObject( fileObject );
return status;
} else {
KeClearEvent( eventObject );
}
}
//
// Make a special check here to determine whether this is a synchronous
// I/O operation. If it is, then wait here until the file is owned by
// the current thread.
//
if (fileObject->Flags & FO_SYNCHRONOUS_IO) {
BOOLEAN interrupted;
if (!IopAcquireFastLock( fileObject )) {
status = IopAcquireFileObjectLock( fileObject,
requestorMode,
(BOOLEAN) ((fileObject->Flags & FO_ALERTABLE_IO) != 0),
&interrupted );
if (interrupted) {
if (auxiliaryBuffer != NULL) {
ExFreePool( auxiliaryBuffer );
}
if (eventObject != NULL) {
ObDereferenceObject( eventObject );
}
ObDereferenceObject( fileObject );
return status;
}
}
*SynchronousIo = TRUE;
} else {
*SynchronousIo = FALSE;
#if defined(_WIN64)
if (requestorMode != KernelMode) {
try {
//
// If this is a 32-bit asynchronous IO, then mark the Iosb being sent as so.
// Note: IopMarkApcRoutineIfAsyncronousIo32 must be called after probing
// the IoStatusBlock structure for write.
//
IopMarkApcRoutineIfAsyncronousIo32(IoStatusBlock,ApcRoutine,FALSE);
} except (EXCEPTION_EXECUTE_HANDLER) {
//
// An IRP could not be allocated. Cleanup and return an appropriate
// error status code.
//
IopAllocateIrpCleanup( fileObject, eventObject );
if (auxiliaryBuffer) {
ExFreePool( auxiliaryBuffer );
}
return GetExceptionCode ();
}
}
#endif
}
//
// Set the file object to the Not-Signaled state.
//
KeClearEvent( &fileObject->Event );
//
// Get the address of the target device object.
//
deviceObject = IoGetRelatedDeviceObject( fileObject );
*DeviceObject = deviceObject;
//
// Allocate and initialize the I/O Request Packet (IRP) for this operation.
// The allocation is performed with an exception handler in case the
// caller does not have enough quota to allocate the packet.
irp = IoAllocateIrp( deviceObject->StackSize, !(*SynchronousIo) );
if (!irp) {
//
// An IRP could not be allocated. Cleanup and return an appropriate
// error status code.
//
IopAllocateIrpCleanup( fileObject, eventObject );
if (auxiliaryBuffer) {
ExFreePool( auxiliaryBuffer );
}
return STATUS_INSUFFICIENT_RESOURCES;
}
*Irp = irp;
irp->Tail.Overlay.OriginalFileObject = fileObject;
irp->Tail.Overlay.Thread = CurrentThread;
irp->RequestorMode = requestorMode;
//
// Fill in the service independent parameters in the IRP.
//
irp->UserEvent = eventObject;
irp->UserIosb = IoStatusBlock;
irp->Overlay.AsynchronousParameters.UserApcRoutine = ApcRoutine;
irp->Overlay.AsynchronousParameters.UserApcContext = ApcContext;
//
// Get a pointer to the stack location for the first driver. This will be
// used to pass the original function codes and parameters.
//
irpSp = IoGetNextIrpStackLocation( irp );
irpSp->MajorFunction = IRP_MJ_DIRECTORY_CONTROL;
irpSp->MinorFunction = MinorFunction;
irpSp->FileObject = fileObject;
// Also, copy the caller's parameters to the service-specific portion of
// the IRP.
//
irp->Tail.Overlay.AuxiliaryBuffer = auxiliaryBuffer;
irp->AssociatedIrp.SystemBuffer = (PVOID) NULL;
irp->MdlAddress = (PMDL) NULL;
//
// Now determine whether this driver expects to have data buffered to it
// or whether it performs direct I/O. This is based on the DO_BUFFERED_IO
// flag in the device object. If the flag is set, then a system buffer is
// allocated and the driver's data will be copied into it. Otherwise, a
// Memory Descriptor List (MDL) is allocated and the caller's buffer is
// locked down using it.
//
if (deviceObject->Flags & DO_BUFFERED_IO) {
//
// The device does not support direct I/O. Allocate a system buffer
// and specify that it should be deallocated on completion. Also
// indicate that this is an input operation so the data will be copied
// into the caller's buffer. This is done using an exception handler
// that will perform cleanup if the operation fails.
//
try {
//
// Allocate the intermediary system buffer from nonpaged pool and
// charge quota for it.
//
irp->AssociatedIrp.SystemBuffer =
ExAllocatePoolWithQuota( NonPagedPool, Length );
} except(EXCEPTION_EXECUTE_HANDLER) {
//
// An exception was incurred while either probing the caller's
// buffer or allocate the system buffer. Determine what actually
// happened, clean everything up, and return an appropriate error
// status code.
//
IopExceptionCleanup( fileObject,
irp,
eventObject,
(PKEVENT) NULL );
if (auxiliaryBuffer != NULL) {
ExFreePool( auxiliaryBuffer );
}
return GetExceptionCode();
}
//
// Remember the address of the caller's buffer so the copy can take
// place during I/O completion. Also, set the flags so that the
// completion code knows to do the copy and to deallocate the buffer.
//
irp->UserBuffer = FileInformation;
irp->Flags = (ULONG) (IRP_BUFFERED_IO |
IRP_DEALLOCATE_BUFFER |
IRP_INPUT_OPERATION);
} else if (deviceObject->Flags & DO_DIRECT_IO) {
NTSTATUS
NtFreeVirtualMemory(
__in HANDLE ProcessHandle,
__inout PVOID *BaseAddress,
__inout PSIZE_T RegionSize,
__in ULONG FreeType
)
/*++
Routine Description:
This function deletes a region of pages within the virtual address
space of a subject process.
Arguments:
ProcessHandle - An open handle to a process object.
BaseAddress - The base address of the region of pages
to be freed. This value is rounded down to the
next host page address boundary.
RegionSize - A pointer to a variable that will receive
the actual size in bytes of the freed region of
pages. The initial value of this argument is
rounded up to the next host page size boundary.
FreeType - A set of flags that describe the type of
free that is to be performed for the specified
region of pages.
FreeType Flags
MEM_DECOMMIT - The specified region of pages is to be decommitted.
MEM_RELEASE - The specified region of pages is to be released.
Return Value:
NTSTATUS.
--*/
{
KAPC_STATE ApcState;
PMMVAD_SHORT Vad;
PMMVAD_SHORT NewVad;
PMMVAD PreviousVad;
PMMVAD NextVad;
PMMVAD ChargedVad;
PEPROCESS Process;
KPROCESSOR_MODE PreviousMode;
PVOID StartingAddress;
PVOID EndingAddress;
NTSTATUS Status;
LOGICAL Attached;
SIZE_T CapturedRegionSize;
PVOID CapturedBase;
PMMPTE StartingPte;
PMMPTE EndingPte;
SIZE_T OldQuota;
SIZE_T QuotaCharge;
SIZE_T CommitReduction;
LOGICAL UserPhysicalPages;
PETHREAD CurrentThread;
PEPROCESS CurrentProcess;
PAGED_CODE();
//
// Check to make sure FreeType is good.
//
if ((FreeType & ~(MEM_DECOMMIT | MEM_RELEASE)) != 0) {
return STATUS_INVALID_PARAMETER_4;
}
//
// One of MEM_DECOMMIT or MEM_RELEASE must be specified, but not both.
//
if (((FreeType & (MEM_DECOMMIT | MEM_RELEASE)) == 0) ||
((FreeType & (MEM_DECOMMIT | MEM_RELEASE)) ==
(MEM_DECOMMIT | MEM_RELEASE))) {
return STATUS_INVALID_PARAMETER_4;
}
CurrentThread = PsGetCurrentThread ();
CurrentProcess = PsGetCurrentProcessByThread (CurrentThread);
PreviousMode = KeGetPreviousModeByThread(&CurrentThread->Tcb);
//
// Establish an exception handler, probe the specified addresses
// for write access and capture the initial values.
//
try {
if (PreviousMode != KernelMode) {
ProbeForWritePointer (BaseAddress);
ProbeForWriteUlong_ptr (RegionSize);
}
//
// Capture the base address.
//
CapturedBase = *BaseAddress;
//
// Capture the region size.
//
CapturedRegionSize = *RegionSize;
}
except (ExSystemExceptionFilter ()) {
//
// If an exception occurs during the probe or capture
// of the initial values, then handle the exception and
// return the exception code as the status value.
//
return GetExceptionCode ();
}
//
// Make sure the specified starting and ending addresses are
// within the user part of the virtual address space.
//
if (CapturedBase > MM_HIGHEST_USER_ADDRESS) {
//
// Invalid base address.
//
return STATUS_INVALID_PARAMETER_2;
}
if ((ULONG_PTR)MM_HIGHEST_USER_ADDRESS - (ULONG_PTR)CapturedBase <
CapturedRegionSize) {
//
// Invalid region size;
//
return STATUS_INVALID_PARAMETER_3;
}
EndingAddress = (PVOID)(((LONG_PTR)CapturedBase + CapturedRegionSize - 1) |
(PAGE_SIZE - 1));
StartingAddress = PAGE_ALIGN(CapturedBase);
Attached = FALSE;
if (ProcessHandle == NtCurrentProcess()) {
Process = CurrentProcess;
}
else {
//
// Reference the specified process handle for VM_OPERATION access.
//
Status = ObReferenceObjectByHandle (ProcessHandle,
PROCESS_VM_OPERATION,
PsProcessType,
PreviousMode,
(PVOID *)&Process,
NULL);
if (!NT_SUCCESS(Status)) {
return Status;
}
//
// If the specified process is not the current process, attach
// to the specified process.
//
if (CurrentProcess != Process) {
KeStackAttachProcess (&Process->Pcb, &ApcState);
Attached = TRUE;
}
}
CommitReduction = 0;
//
// Get the address creation mutex to block multiple threads from
// creating or deleting address space at the same time and
// get the working set mutex so virtual address descriptors can
// be inserted and walked. Block APCs to prevent page faults while
// we own the working set mutex.
//
LOCK_ADDRESS_SPACE (Process);
//
// Make sure the address space was not deleted.
//
if (Process->Flags & PS_PROCESS_FLAGS_VM_DELETED) {
Status = STATUS_PROCESS_IS_TERMINATING;
goto ErrorReturn;
}
Vad = (PMMVAD_SHORT) MiLocateAddress (StartingAddress);
if (Vad == NULL) {
//
// No Virtual Address Descriptor located for Base Address.
//
Status = STATUS_MEMORY_NOT_ALLOCATED;
goto ErrorReturn;
}
//
// Found the associated Virtual Address Descriptor.
//
if (Vad->EndingVpn < MI_VA_TO_VPN (EndingAddress)) {
//
// The entire range to delete is not contained within a single
// virtual address descriptor. Return an error.
//
Status = STATUS_UNABLE_TO_FREE_VM;
goto ErrorReturn;
}
//
// Check to ensure this Vad is deletable. Delete is required
// for both decommit and release.
//
if (((Vad->u.VadFlags.PrivateMemory == 0) &&
(Vad->u.VadFlags.VadType != VadRotatePhysical))
||
(Vad->u.VadFlags.VadType == VadDevicePhysicalMemory)) {
Status = STATUS_UNABLE_TO_DELETE_SECTION;
goto ErrorReturn;
}
if (Vad->u.VadFlags.NoChange == 1) {
//
// An attempt is being made to delete a secured VAD, check
// to see if this deletion is allowed.
//
if (FreeType & MEM_RELEASE) {
//
// Specify the whole range, this solves the problem with
// splitting the VAD and trying to decide where the various
// secure ranges need to go.
//
Status = MiCheckSecuredVad ((PMMVAD)Vad,
MI_VPN_TO_VA (Vad->StartingVpn),
((Vad->EndingVpn - Vad->StartingVpn) << PAGE_SHIFT) +
PAGE_SIZE,
MM_SECURE_DELETE_CHECK);
}
else {
Status = MiCheckSecuredVad ((PMMVAD)Vad,
CapturedBase,
CapturedRegionSize,
MM_SECURE_DELETE_CHECK);
}
if (!NT_SUCCESS (Status)) {
goto ErrorReturn;
}
}
UserPhysicalPages = FALSE;
ChargedVad = NULL;
PreviousVad = MiGetPreviousVad (Vad);
NextVad = MiGetNextVad (Vad);
if (FreeType & MEM_RELEASE) {
//
// *****************************************************************
// MEM_RELEASE was specified.
// *****************************************************************
//
//
// The descriptor for the address range is deletable. Remove or split
// the descriptor.
//
//
// If the region size is zero, remove the whole VAD.
//
if (CapturedRegionSize == 0) {
//
// If the region size is specified as 0, the base address
// must be the starting address for the region.
//
if (MI_VA_TO_VPN (CapturedBase) != Vad->StartingVpn) {
Status = STATUS_FREE_VM_NOT_AT_BASE;
goto ErrorReturn;
}
//
// This Virtual Address Descriptor has been deleted.
//
StartingAddress = MI_VPN_TO_VA (Vad->StartingVpn);
EndingAddress = MI_VPN_TO_VA_ENDING (Vad->EndingVpn);
if (Vad->u.VadFlags.VadType == VadRotatePhysical) {
Status = MiUnmapViewOfSection (Process,
CapturedBase,
UNMAP_ADDRESS_SPACE_HELD | UNMAP_ROTATE_PHYSICAL_OK);
ASSERT (CommitReduction == 0);
Vad = NULL;
CapturedRegionSize = 1 + (PCHAR)EndingAddress - (PCHAR)StartingAddress;
goto AllDone;
}
//
// Free all the physical pages that this VAD might be mapping.
//
if (Vad->u.VadFlags.VadType == VadLargePages) {
MiAweViewRemover (Process, (PMMVAD)Vad);
MiReleasePhysicalCharges (Vad->EndingVpn - Vad->StartingVpn + 1,
Process);
LOCK_WS_UNSAFE (CurrentThread, Process);
MiFreeLargePages (MI_VPN_TO_VA (Vad->StartingVpn),
MI_VPN_TO_VA_ENDING (Vad->EndingVpn),
FALSE);
}
else if (Vad->u.VadFlags.VadType == VadAwe) {
MiAweViewRemover (Process, (PMMVAD)Vad);
MiRemoveUserPhysicalPagesVad (Vad);
UserPhysicalPages = TRUE;
LOCK_WS_UNSAFE (CurrentThread, Process);
}
else if (Vad->u.VadFlags.VadType == VadWriteWatch) {
LOCK_WS_UNSAFE (CurrentThread, Process);
MiPhysicalViewRemover (Process, (PMMVAD)Vad);
}
else {
LOCK_WS_UNSAFE (CurrentThread, Process);
}
ChargedVad = (PMMVAD)Vad;
MiRemoveVad ((PMMVAD)Vad, Process);
//
// Free the VAD pool and release quota after releasing our mutexes
// to reduce contention.
//
}
else {
//
// Region's size was not specified as zero, delete the
// whole VAD or split the VAD.
//
if (MI_VA_TO_VPN (StartingAddress) == Vad->StartingVpn) {
if (MI_VA_TO_VPN (EndingAddress) == Vad->EndingVpn) {
//
// This Virtual Address Descriptor has been deleted.
//
// Free all the physical pages that this VAD might be
// mapping.
//
if (Vad->u.VadFlags.VadType == VadRotatePhysical) {
Status = MiUnmapViewOfSection (Process,
CapturedBase,
UNMAP_ADDRESS_SPACE_HELD | UNMAP_ROTATE_PHYSICAL_OK);
ASSERT (CommitReduction == 0);
Vad = NULL;
CapturedRegionSize = 1 + (PCHAR)EndingAddress - (PCHAR)StartingAddress;
goto AllDone;
}
if (Vad->u.VadFlags.VadType == VadLargePages) {
MiAweViewRemover (Process, (PMMVAD)Vad);
MiReleasePhysicalCharges (Vad->EndingVpn - Vad->StartingVpn + 1,
Process);
LOCK_WS_UNSAFE (CurrentThread, Process);
MiFreeLargePages (MI_VPN_TO_VA (Vad->StartingVpn),
MI_VPN_TO_VA_ENDING (Vad->EndingVpn),
FALSE);
}
else if (Vad->u.VadFlags.VadType == VadAwe) {
MiAweViewRemover (Process, (PMMVAD)Vad);
MiRemoveUserPhysicalPagesVad (Vad);
UserPhysicalPages = TRUE;
LOCK_WS_UNSAFE (CurrentThread, Process);
}
else if (Vad->u.VadFlags.VadType == VadWriteWatch) {
LOCK_WS_UNSAFE (CurrentThread, Process);
MiPhysicalViewRemover (Process, (PMMVAD)Vad);
}
else {
LOCK_WS_UNSAFE (CurrentThread, Process);
}
ChargedVad = (PMMVAD)Vad;
MiRemoveVad ((PMMVAD)Vad, Process);
//
// Free the VAD pool after releasing our mutexes
// to reduce contention.
//
}
else {
if ((Vad->u.VadFlags.VadType == VadAwe) ||
(Vad->u.VadFlags.VadType == VadLargePages) ||
(Vad->u.VadFlags.VadType == VadRotatePhysical) ||
(Vad->u.VadFlags.VadType == VadWriteWatch)) {
//
// Splitting or chopping a physical VAD, large page VAD
// or a write-watch VAD is not allowed.
//
Status = STATUS_FREE_VM_NOT_AT_BASE;
goto ErrorReturn;
}
LOCK_WS_UNSAFE (CurrentThread, Process);
//
// This Virtual Address Descriptor has a new starting
// address.
//
CommitReduction = MiCalculatePageCommitment (
StartingAddress,
EndingAddress,
(PMMVAD)Vad,
Process);
Vad->StartingVpn = MI_VA_TO_VPN ((PCHAR)EndingAddress + 1);
Vad->u.VadFlags.CommitCharge -= CommitReduction;
ASSERT ((SSIZE_T)Vad->u.VadFlags.CommitCharge >= 0);
NextVad = (PMMVAD)Vad;
Vad = NULL;
}
}
else {
if ((Vad->u.VadFlags.VadType == VadAwe) ||
(Vad->u.VadFlags.VadType == VadLargePages) ||
(Vad->u.VadFlags.VadType == VadRotatePhysical) ||
(Vad->u.VadFlags.VadType == VadWriteWatch)) {
//
// Splitting or chopping a physical VAD, large page VAD
// or a write-watch VAD is not allowed.
//
Status = STATUS_FREE_VM_NOT_AT_BASE;
goto ErrorReturn;
}
//
// Starting address is greater than start of VAD.
//
if (MI_VA_TO_VPN (EndingAddress) == Vad->EndingVpn) {
//
// Change the ending address of the VAD.
//
LOCK_WS_UNSAFE (CurrentThread, Process);
CommitReduction = MiCalculatePageCommitment (
StartingAddress,
EndingAddress,
(PMMVAD)Vad,
Process);
Vad->u.VadFlags.CommitCharge -= CommitReduction;
Vad->EndingVpn = MI_VA_TO_VPN ((PCHAR)StartingAddress - 1);
PreviousVad = (PMMVAD)Vad;
}
else {
//
// Split this VAD as the address range is within the VAD.
//
NewVad = ExAllocatePoolWithTag (NonPagedPool,
sizeof(MMVAD_SHORT),
'FdaV');
if (NewVad == NULL) {
Status = STATUS_INSUFFICIENT_RESOURCES;
goto ErrorReturn;
}
*NewVad = *Vad;
NewVad->StartingVpn = MI_VA_TO_VPN ((PCHAR)EndingAddress + 1);
//
// Set the commit charge to zero so MiInsertVad will
// not charge commitment for splitting the VAD.
//
NewVad->u.VadFlags.CommitCharge = 0;
//
// Insert the VAD, this could fail due to quota charges.
//
Status = MiInsertVadCharges ((PMMVAD)NewVad, Process);
if (!NT_SUCCESS(Status)) {
//
// The quota charging failed, free the new VAD
// and return an error.
//
UNLOCK_ADDRESS_SPACE (Process);
ExFreePool (NewVad);
goto ErrorReturn2;
}
LOCK_WS_UNSAFE (CurrentThread, Process);
CommitReduction = MiCalculatePageCommitment (
StartingAddress,
EndingAddress,
(PMMVAD)Vad,
Process);
OldQuota = Vad->u.VadFlags.CommitCharge - CommitReduction;
Vad->EndingVpn = MI_VA_TO_VPN ((PCHAR)StartingAddress - 1);
MiInsertVad ((PMMVAD)NewVad, Process);
//
// As we have split the original VAD into 2 separate VADs
// there is no way of knowing what the commit charge
// is for each VAD. Calculate the charge and reset
// each VAD. Note that we also use the previous value
// to make sure the books stay balanced.
//
QuotaCharge = MiCalculatePageCommitment (MI_VPN_TO_VA (Vad->StartingVpn),
(PCHAR)StartingAddress - 1,
(PMMVAD)Vad,
Process);
Vad->u.VadFlags.CommitCharge = QuotaCharge;
//
// Give the remaining charge to the new VAD.
//
NewVad->u.VadFlags.CommitCharge = OldQuota - QuotaCharge;
PreviousVad = (PMMVAD)Vad;
NextVad = (PMMVAD)NewVad;
}
Vad = NULL;
}
}
if (UserPhysicalPages == TRUE) {
MiDeletePageTablesForPhysicalRange (StartingAddress, EndingAddress);
}
else {
MiDeleteVirtualAddresses (StartingAddress,
EndingAddress,
NULL);
}
UNLOCK_WS_UNSAFE (CurrentThread, Process);
//
// Return commitment for page table pages if possible.
//
MiReturnPageTablePageCommitment (StartingAddress,
EndingAddress,
Process,
PreviousVad,
NextVad);
if (ChargedVad != NULL) {
MiRemoveVadCharges (ChargedVad, Process);
}
CapturedRegionSize = 1 + (PCHAR)EndingAddress - (PCHAR)StartingAddress;
//
// Update the virtual size in the process header.
//
Process->VirtualSize -= CapturedRegionSize;
Process->CommitCharge -= CommitReduction;
Status = STATUS_SUCCESS;
AllDone:
UNLOCK_ADDRESS_SPACE (Process);
if (CommitReduction != 0) {
MI_INCREMENT_TOTAL_PROCESS_COMMIT (0 - CommitReduction);
ASSERT (Vad == NULL);
PsReturnProcessPageFileQuota (Process, CommitReduction);
MiReturnCommitment (CommitReduction);
if (Process->JobStatus & PS_JOB_STATUS_REPORT_COMMIT_CHANGES) {
PsChangeJobMemoryUsage (PS_JOB_STATUS_REPORT_COMMIT_CHANGES, -(SSIZE_T)CommitReduction);
}
MM_TRACK_COMMIT (MM_DBG_COMMIT_RETURN_NTFREEVM1, CommitReduction);
}
else if (Vad != NULL) {
ExFreePool (Vad);
}
if (Attached == TRUE) {
KeUnstackDetachProcess (&ApcState);
}
if (ProcessHandle != NtCurrentProcess ()) {
ObDereferenceObject (Process);
}
//
// Establish an exception handler and write the size and base
// address.
//
try {
*RegionSize = CapturedRegionSize;
*BaseAddress = StartingAddress;
}
except (EXCEPTION_EXECUTE_HANDLER) {
//
// An exception occurred, don't take any action (just handle
// the exception and return success.
}
return Status;
}
//
// **************************************************************
//
// MEM_DECOMMIT was specified.
//
// **************************************************************
//
if (Vad->u.VadFlags.VadType == VadAwe) {
//
// Pages from a physical VAD must be released via
// NtFreeUserPhysicalPages, not this routine.
//
Status = STATUS_MEMORY_NOT_ALLOCATED;
goto ErrorReturn;
}
if ((Vad->u.VadFlags.VadType == VadLargePages) ||
(Vad->u.VadFlags.VadType == VadRotatePhysical)) {
//
// Pages from a large page or rotate physical VAD must be released -
// they cannot be merely decommitted.
//
Status = STATUS_MEMORY_NOT_ALLOCATED;
goto ErrorReturn;
}
//
// Check to ensure the complete range of pages is already committed.
//
if (CapturedRegionSize == 0) {
if (MI_VA_TO_VPN (CapturedBase) != Vad->StartingVpn) {
Status = STATUS_FREE_VM_NOT_AT_BASE;
goto ErrorReturn;
}
EndingAddress = MI_VPN_TO_VA_ENDING (Vad->EndingVpn);
}
//
// The address range is entirely committed, decommit it now.
//
//
// Calculate the initial quotas and commit charges for this VAD.
//
StartingPte = MiGetPteAddress (StartingAddress);
EndingPte = MiGetPteAddress (EndingAddress);
CommitReduction = 1 + EndingPte - StartingPte;
//
// Check to see if the entire range can be decommitted by
// just updating the virtual address descriptor.
//
CommitReduction -= MiDecommitPages (StartingAddress,
EndingPte,
Process,
Vad);
//
// Adjust the quota charges.
//
ASSERT ((LONG)CommitReduction >= 0);
Vad->u.VadFlags.CommitCharge -= CommitReduction;
ASSERT ((LONG)Vad->u.VadFlags.CommitCharge >= 0);
Vad = NULL;
Process->CommitCharge -= CommitReduction;
UNLOCK_ADDRESS_SPACE (Process);
if (CommitReduction != 0) {
MI_INCREMENT_TOTAL_PROCESS_COMMIT (0 - CommitReduction);
PsReturnProcessPageFileQuota (Process, CommitReduction);
MiReturnCommitment (CommitReduction);
if (Process->JobStatus & PS_JOB_STATUS_REPORT_COMMIT_CHANGES) {
PsChangeJobMemoryUsage (PS_JOB_STATUS_REPORT_COMMIT_CHANGES, -(SSIZE_T)CommitReduction);
}
MM_TRACK_COMMIT (MM_DBG_COMMIT_RETURN_NTFREEVM2, CommitReduction);
}
else if (Vad != NULL) {
ExFreePool (Vad);
}
if (Attached == TRUE) {
KeUnstackDetachProcess (&ApcState);
}
if (ProcessHandle != NtCurrentProcess()) {
ObDereferenceObject (Process);
}
//
// Establish an exception handler and write the size and base address.
//
try {
*RegionSize = 1 + (PCHAR)EndingAddress - (PCHAR)StartingAddress;
*BaseAddress = StartingAddress;
}
except (EXCEPTION_EXECUTE_HANDLER) {
NOTHING;
}
return STATUS_SUCCESS;
ErrorReturn:
UNLOCK_ADDRESS_SPACE (Process);
ErrorReturn2:
if (Attached == TRUE) {
KeUnstackDetachProcess (&ApcState);
}
if (ProcessHandle != NtCurrentProcess()) {
ObDereferenceObject (Process);
}
return Status;
}
