WpdBaseDriver::WpdBaseDriver() :
m_cRef(1)
{
}
WpdBaseDriver::~WpdBaseDriver()
{
}
ULONG __stdcall WpdBaseDriver::AddRef()
{
InterlockedIncrement((long*) &m_cRef);
return m_cRef;
}
__drv_at(this, __drv_freesMem(Mem))
ULONG __stdcall WpdBaseDriver::Release()
{
ULONG ulRefCount = m_cRef - 1;
if (InterlockedDecrement((long*) &m_cRef) == 0)
{
delete this;
return 0;
}
return ulRefCount;
}
HRESULT __stdcall WpdBaseDriver::QueryInterface(
REFIID riid,
void** ppv)
#endif /// DBG
return;
}
/**
@kernel_helper_function="KrnlHlprWorkItemDataDestroy"
Purpose: Cleanup and free a WORKITEM_DATA object. <br>
<br>
Notes: <br>
<br>
MSDN_Ref: <br>
*/
_At_(*ppWorkItemData, _Pre_ _Notnull_)
_At_(*ppWorkItemData, _Post_ _Null_ __drv_freesMem(Pool))
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_max_(DISPATCH_LEVEL)
_IRQL_requires_same_
_Success_(*ppWorkItemData == 0)
inline VOID KrnlHlprWorkItemDataDestroy(_Inout_ WORKITEM_DATA** ppWorkItemData)
{
#if DBG
DbgPrintEx(DPFLTR_IHVNETWORK_ID,
DPFLTR_INFO_LEVEL,
" ---> KrnlHlprWorkItemDataDestroy()\n");
#endif /// DBG
NT_ASSERT(ppWorkItemData);
reinterpret_cast<IUnknown*>(*ppv)->AddRef();
return S_OK;
}
ULONG __stdcall
COemUni2::
AddRef(
VOID
)
{
VERBOSE("COemUni2::AddRef() entry.");
return InterlockedIncrement(&m_cRef);
}
_At_(this, __drv_freesMem(object))
ULONG __stdcall
COemUni2::
Release(
VOID
)
{
VERBOSE("COemUni2::Release() entry.");
ULONG cRef = InterlockedDecrement(&m_cRef);
if (cRef == 0)
{
delete this;
return 0;
}
return cRef;
}
else
{
DoTraceMessage(TRACE_FLOW_ESTABLISHED, "Unable to create flow, driver shutting down.\r\n");
// Our driver is shutting down.
status = STATUS_SHUTDOWN_IN_PROGRESS;
}
KeReleaseInStackQueuedSpinLock(&lockHandle);
return status;
}
void
MonitorCoCleanupFlowContext(
_In_ __drv_freesMem(Mem) FLOW_DATA* flowContext
)
/*
Routine Description
Called to cleanup a flow context on flow deletion. ProcessPath is passed
as a second parameter so Prefast can see that it's being freed here.
*/
{
if (flowContext->processPath)
{
ExFreePoolWithTag(flowContext->processPath, TAG_NAME_CALLOUT);
}
ExFreePoolWithTag(flowContext, TAG_NAME_CALLOUT);
}
return STATUS_SUCCESS;
}
#define FreeW32Process(/*Process*/ W32Process) \
do { \
/*PPROCESSINFO W32Process = PsGetProcessWin32Process(Process);*/ \
/*ASSERT(W32Process);*/ \
IntDereferenceProcessInfo(W32Process); \
} while(0)
/*
* Called from IntDereferenceProcessInfo
*/
VOID
UserDeleteW32Process(
_Pre_notnull_ __drv_freesMem(Mem) PPROCESSINFO ppiCurrent)
{
if (ppiCurrent->InputIdleEvent)
{
/* Free the allocated memory */
ExFreePoolWithTag(ppiCurrent->InputIdleEvent, USERTAG_EVENT);
}
/* Close the startup desktop */
if (ppiCurrent->rpdeskStartup)
ObDereferenceObject(ppiCurrent->rpdeskStartup);
#if DBG
if (DBG_IS_CHANNEL_ENABLED(ppiCurrent, DbgChUserObj, WARN_LEVEL))
{
TRACE_PPI(ppiCurrent, UserObj, "Dumping user handles now that process info %p is gets freed.\n", ppiCurrent);
Pointer to allocated memory if successful, else NULL.
--*/
{
UNREFERENCED_PARAMETER (Table);
return ExAllocatePoolWithTag(PagedPool, ByteSize, AV_TABLE_ENTRY_TAG);
}
VOID
NTAPI
AvFreeGenericTableEntry (
_In_ PRTL_GENERIC_TABLE Table,
_In_ __drv_freesMem(Mem) _Post_invalid_ PVOID Entry
)
/*++
Routine Description:
This routine is the callback for releasing memory for entries in the generic
table.
Arguments:
Table - Table for which this is invoked.
Entry - Entry to free.
Return Value:
if (ndisStatus != NDIS_STATUS_SUCCESS)
{
if (newPort != NULL)
{
BasePortFreePort(newPort);
}
}
return ndisStatus;
}
VOID
BasePortFreePort(
_In_ __drv_freesMem(Mem) PMP_PORT Port
)
{
if (Port->VNic != NULL)
{
VNic11Free(Port->VNic);
}
NdisFreeSpinLock(&(Port->Lock));
MP_FREE_MEMORY(Port);
}
NDIS_STATUS
BasePortInitializePort(
_In_ PMP_PORT Port,
{
*ppv = NULL ;
VERBOSE(DLLTEXT("IOemUI:No Interface. Return NULL.\r\n"));
return E_NOINTERFACE ;
}
reinterpret_cast<IUnknown*>(*ppv)->AddRef() ;
return S_OK ;
}
ULONG __stdcall IOemUI::AddRef()
{
VERBOSE(DLLTEXT("IOemUI:AddRef entry.\r\n"));
return InterlockedIncrement(&m_cRef) ;
}
__drv_at(this, __drv_freesMem(object))
ULONG __stdcall IOemUI::Release()
{
VERBOSE(DLLTEXT("IOemUI:Release entry.\r\n"));
ASSERT( 0 != m_cRef);
ULONG cRef = InterlockedDecrement(&m_cRef);
if (0 == cRef)
{
delete this;
}
return cRef;
}
//
//(Implamentation is required) Supplies a pointer to UNIDRIVE /PScript IPrintOemDriverUI
...
)
{
va_list Args;
PCHAR Str;
va_start(Args, Format);
Str = __DriverFormatV(Format, Args);
va_end(Args);
return Str;
}
VOID
#pragma warning(suppress: 28197)
DriverFormatFree(
__in __drv_freesMem(mem) PCHAR Buffer
)
{
if (Buffer)
__FreePoolWithTag(Buffer, FORMAT_POOL_TAG);
}
//=============================================================================
// StorPort redirections
static FORCEINLINE PCHAR
__ScsiAdapterControlTypeName(
__in SCSI_ADAPTER_CONTROL_TYPE ControlType
)
{
switch (ControlType) {
case ScsiQuerySupportedControlTypes: return "QuerySupportedControlTypes";
Arguments:
None.
Return Value:
ULONG - new ref count.
--*/
{
LONG cRefs = InterlockedIncrement( &m_cRefs );
return cRefs;
}
__drv_arg(this, __drv_freesMem(object))
ULONG CQueue::Release()
/*++
Routine Description:
Decrements the ref count on this object.
Arguments:
None.
Return Value:
ULONG - new ref count.
RtlUshortByteSwap(
inFixedValues->incomingValue[localPortIndex].value.uint16
);
packet->remotePort =
RtlUshortByteSwap(
inFixedValues->incomingValue[remotePortIndex].value.uint16
);
packet->protocol = inFixedValues->incomingValue[protocolIndex].value.uint8;
return;
}
void
FreePendedPacket(
_Inout_ __drv_freesMem(Mem) TL_INSPECT_PENDED_PACKET* packet
)
{
if (packet->netBufferList != NULL)
{
FwpsDereferenceNetBufferList(packet->netBufferList, FALSE);
}
if (packet->controlData != NULL)
{
ExFreePoolWithTag(packet->controlData, TL_INSPECT_CONTROL_DATA_POOL_TAG);
}
if (packet->completionContext != NULL)
{
NT_ASSERT(packet->type == TL_INSPECT_CONNECT_PACKET);
NT_ASSERT(packet->direction == FWP_DIRECTION_INBOUND); // complete for ALE connect
// is done prior to freeing
#endif /// DBG
return;
}
/**
@kernel_helper_function="KrnlHlprNDISPoolDataDestroy"
Purpose: Cleanup a NDIS_POOL_DATA object. <br>
<br>
Notes: <br>
<br>
MSDN_Ref: <br>
*/
_At_(*ppNDISPoolData, _Pre_ _Notnull_)
_At_(*ppNDISPoolData, _Post_ _Null_ __drv_freesMem(Pool))
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_max_(DISPATCH_LEVEL)
_IRQL_requires_same_
_Success_(*ppNDISPoolData == 0)
inline VOID KrnlHlprNDISPoolDataDestroy(_Inout_ NDIS_POOL_DATA** ppNDISPoolData)
{
#if DBG
DbgPrintEx(DPFLTR_IHVNETWORK_ID,
DPFLTR_INFO_LEVEL,
" ---> KrnlHlprNDISPoolDataDestroy()\n");
#endif /// DBG
NT_ASSERT(ppNDISPoolData);
#endif /// DBG
return;
}
/**
@kernel_helper_function="KrnlHlprPendDataDestroy"
Purpose: Cleanup and free a PEND_DATA object. <br>
<br>
Notes: <br>
<br>
MSDN_Ref: <br>
*/
_At_(ppPendData, _Pre_ _Notnull_)
_At_(*ppPendData, _Post_ _Null_ __drv_freesMem(Pool))
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_max_(DISPATCH_LEVEL)
_IRQL_requires_same_
_Success_(*ppPendData == 0)
inline VOID KrnlHlprPendDataDestroy(_Inout_ PEND_DATA** ppPendData)
{
#if DBG
DbgPrintEx(DPFLTR_IHVNETWORK_ID,
DPFLTR_INFO_LEVEL,
" ---> KrnlHlprPendDataDestroy()\n");
#endif /// DBG
NT_ASSERT(ppPendData);
return;
}
#endif /// DBG
/**
@private_function="BasicPacketInjectionCompletionDataDestroy"
Purpose: <br>
<br>
Notes: <br>
<br>
MSDN_Ref: <br>
*/
_At_(*ppCompletionData, _Pre_ _Notnull_)
_At_(*ppCompletionData, _Post_ _Null_ __drv_freesMem(Pool))
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_max_(DISPATCH_LEVEL)
_IRQL_requires_same_
_Success_(*ppCompletionData == 0)
VOID BasicPacketInjectionCompletionDataDestroy(_Inout_ BASIC_PACKET_INJECTION_COMPLETION_DATA** ppCompletionData,
_In_ BOOLEAN override) /* FALSE */
{
#if DBG
DbgPrintEx(DPFLTR_IHVNETWORK_ID,
DPFLTR_INFO_LEVEL,
" ---> BasicPacketInjectionCompletionDataDestroy()\n");
#endif /// DBG
static FORCEINLINE PVOID
#pragma warning(suppress: 28195)
___FrontendAlloc(
__in PCHAR Caller,
__in ULONG Line,
__in ULONG Size
)
{
return __AllocateNonPagedPoolWithTag(Caller, Line, Size, FRONTEND_POOL_TAG);
}
#define __FrontendAlloc(Size) ___FrontendAlloc(__FUNCTION__, __LINE__, Size)
static FORCEINLINE VOID
#pragma warning(suppress: 28197)
__FrontendFree(
__in __drv_freesMem(mem) PVOID Buffer
)
{
if (Buffer)
__FreePoolWithTag(Buffer, FRONTEND_POOL_TAG);
}
//=============================================================================
// Accessors
VOID
FrontendRemoveFeature(
IN PXENVBD_FRONTEND Frontend,
IN UCHAR BlkifOperation
)
{
switch (BlkifOperation) {
#endif /// DBG
return;
}
/**
@kernel_helper_function="KrnlHlprRedirectDataDestroy"
Purpose: Cleanup and free a REDIRECT_DATA object. <br>
<br>
Notes: <br>
<br>
MSDN_Ref: <br>
*/
_At_(*ppRedirectData, _Pre_ _Notnull_)
_At_(*ppRedirectData, _Post_ _Null_ __drv_freesMem(Pool))
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_max_(DISPATCH_LEVEL)
_IRQL_requires_same_
_Success_(*ppRedirectData == 0)
inline VOID KrnlHlprRedirectDataDestroy(_Inout_ REDIRECT_DATA** ppRedirectData)
{
#if DBG
DbgPrintEx(DPFLTR_IHVNETWORK_ID,
DPFLTR_INFO_LEVEL,
" ---> KrnlHlprRedirectDataDestroy()\n");
#endif /// DBG
NT_ASSERT(ppRedirectData);
/* TYPES ********************************************************************/
/* GLOBALS ******************************************************************/
static NPAGED_LOOKASIDE_LIST RmapLookasideList;
FAST_MUTEX RmapListLock;
/* FUNCTIONS ****************************************************************/
_IRQL_requires_max_(DISPATCH_LEVEL)
static
VOID
NTAPI
RmapListFree(
_In_ __drv_freesMem(Mem) PVOID P)
{
ExFreePoolWithTag(P, TAG_RMAP);
}
VOID
INIT_FUNCTION
NTAPI
MmInitializeRmapList(VOID)
{
ExInitializeFastMutex(&RmapListLock);
ExInitializeNPagedLookasideList (&RmapLookasideList,
NULL,
RmapListFree,
0,
sizeof(MM_RMAP_ENTRY),
#endif /// DBG
return;
}
/**
@kernel_helper_function="KrnlHlprDPCDataDestroy"
Purpose: Cleanup and free a DPC_DATA object. <br>
<br>
Notes: <br>
<br>
MSDN_Ref: <br>
*/
_At_(*ppDPCData, _Pre_ _Notnull_)
_At_(*ppDPCData, _Post_ _Null_ __drv_freesMem(Pool))
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_max_(DISPATCH_LEVEL)
_IRQL_requires_same_
_Success_(*ppDPCData == 0)
inline VOID KrnlHlprDPCDataDestroy(_Inout_ DPC_DATA** ppDPCData)
{
#if DBG
DbgPrintEx(DPFLTR_IHVNETWORK_ID,
DPFLTR_INFO_LEVEL,
" ---> KrnlHlprDPCDataDestroy()\n");
#endif /// DBG
NT_ASSERT(ppDPCData);
m_cRef(1)
{
}
WpdBaseDriver::~WpdBaseDriver()
{
}
ULONG __stdcall WpdBaseDriver::AddRef()
{
InterlockedIncrement((long*) &m_cRef);
return m_cRef;
}
_At_(this, __drv_freesMem(Mem))
ULONG __stdcall WpdBaseDriver::Release()
{
ULONG ulRefCount = m_cRef - 1;
if (InterlockedDecrement((long*) &m_cRef) == 0)
{
delete this;
return 0;
}
return ulRefCount;
}
HRESULT __stdcall WpdBaseDriver::QueryInterface(
REFIID riid,
void** ppv)
{
VERBOSE("IOemUI::QueryInterface IID not supported.\r\n");
*ppv = NULL ;
return E_NOINTERFACE ;
}
reinterpret_cast<IUnknown*>(*ppv)->AddRef() ;
return S_OK ;
}
ULONG __stdcall IOemUI::AddRef()
{
VERBOSE("IOemUI:AddRef entry.\r\n");
return InterlockedIncrement(&m_cRef) ;
}
_At_(this, __drv_freesMem(object))
ULONG __stdcall IOemUI::Release()
{
VERBOSE("IOemUI:Release entry.\r\n");
ASSERT( 0 != m_cRef);
ULONG cRef = InterlockedDecrement(&m_cRef);
if (0 == cRef)
{
delete this;
}
return cRef;
}
HRESULT __stdcall IOemUI::PublishDriverInterface(
IUnknown *pIUnknown)
#endif /// DBG
return;
}
/**
@kernel_helper_function="KrnlHlprClassifyDataDestroyLocalCopy"
Purpose: Release reference on packet and cleanup and free a local copy of CLASSIFY_DATA. <br>
<br>
Notes: <br>
<br>
MSDN_Ref: <br>
*/
_At_(*ppClassifyData, _Pre_ _Notnull_)
_At_(*ppClassifyData, _Post_ _Null_ __drv_freesMem(Pool))
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_max_(DISPATCH_LEVEL)
_IRQL_requires_same_
_Success_(*ppClassifyData == 0)
inline VOID KrnlHlprClassifyDataDestroyLocalCopy(_Inout_ CLASSIFY_DATA** ppClassifyData)
{
#if DBG
DbgPrintEx(DPFLTR_IHVNETWORK_ID,
DPFLTR_INFO_LEVEL,
" ---> KrnlHlprClassifyDataDestroyLocalCopy()\n");
#endif /// DBG
NT_ASSERT(ppClassifyData);
static ULONG64 EptpAddressToPxeIndex(_In_ ULONG64 physical_address);
static ULONG64 EptpAddressToPpeIndex(_In_ ULONG64 physical_address);
static ULONG64 EptpAddressToPdeIndex(_In_ ULONG64 physical_address);
static ULONG64 EptpAddressToPteIndex(_In_ ULONG64 physical_address);
static bool EptpIsDeviceMemory(_In_ ULONG64 physical_address);
static EptCommonEntry *EptpGetEptPtEntry(_In_ EptCommonEntry *table,
_In_ ULONG table_level,
_In_ ULONG64 physical_address);
static void EptpFreeUnusedPreAllocatedEntries(
_Pre_notnull_ __drv_freesMem(Mem) EptCommonEntry **preallocated_entries,
_In_ long used_count);
_Use_decl_annotations_ void EptHandleEptViolationEx(EptData *ept_data, EptData *ept_data02, ULONG_PTR guest_pa, bool is_range_of_ept12);
#if defined(ALLOC_PRAGMA)
#pragma alloc_text(PAGE, EptIsEptAvailable)
#pragma alloc_text(PAGE, EptInitialization)
#pragma alloc_text(PAGE, EptInitializeMtrrEntries)
#endif
////////////////////////////////////////////////////////////////////////////////
//
// variables
//
#pragma warning(push)
#pragma warning(disable:4201) // unnamed struct/union
#include <fwpsk.h>
#pragma warning(pop)
#include <fwpmk.h>
#include "DD_proxy.h"
__inline
void
DDProxyFreePendedPacket(
_Inout_ __drv_freesMem(Mem) DD_PROXY_PENDED_PACKET* packet,
_Inout_opt_ __drv_freesMem(Mem) WSACMSGHDR* controlData
)
{
FwpsDereferenceNetBufferList(packet->netBufferList, FALSE);
DDProxyDereferenceFlowContext(packet->belongingFlow);
if (controlData != NULL)
{
ExFreePoolWithTag(controlData, DD_PROXY_CONTROL_DATA_POOL_TAG);
}
ExFreePoolWithTag(packet, DD_PROXY_PENDED_PACKET_POOL_TAG);
}
#if(NTDDI_VERSION >= NTDDI_WIN7)
void
return array;
}
}
failed:
if (buffer)
{
free(buffer);
}
return NULL;
}
/*
* Frees array allocated by GetDevMultiSz()
*/
static void DelMultiSz(__in_opt __drv_freesMem(object) LPTSTR* Array)
{
if(Array)
{
Array--;
if(Array[0])
{
free(Array[0]);
}
free(Array);
}
}
void find_non_standard_hwids(HDEVINFO devs,
PSP_DEVINFO_DATA devInfo,
/**
* This routine is called to free memory which was previously allocated using MpAllocateMemory function.
* Before freeing the memory, this function checks and makes sure that no overflow or underflows have
* happened and will also try to detect multiple frees of the same memory chunk.
*
* \warning Do not use this function directly. Using MP_FREE_MEMORY ensures that
* this function gets called for debug version of the driver. Retail builds will use Ndis API
* for freeing of memory
* \param Memory Pointer to memory allocated using MP_FREE_MEMORY
* \sa MpAllocateMemory, MP_ALLOCATE_MEMORY, MP_FREE_MEMORY, NdisFreeMemory, MpFreeAllocatedBlocks
*/
VOID
MpFreeMemory (
_In_ __drv_freesMem(Mem) PVOID Memory
)
{
PMP_MEMORY_BLOCK memoryBlockHeader;
MPASSERTMSG ("NULL memory being freed", Memory);
MPASSERTMSG ("Allocated blocks list is empty. This is an extra free\n", !IsListEmpty(&GlobalMemoryList));
// Jump back by memory header size so we can get to the header
memoryBlockHeader = (PMP_MEMORY_BLOCK) (((PUCHAR)Memory) - sizeof(MP_MEMORY_BLOCK));
//
// Check that header was not corrupted
//
if (memoryBlockHeader->HeaderPattern != MP_HEADER_PATTERN)
{
