ff3c28e40b7314c3ca4a416ac217dfba10a3fcf3
[reactos.git] / reactos / ntoskrnl / mm / ARM3 / pagfault.c
1 /*
2 * PROJECT: ReactOS Kernel
3 * LICENSE: BSD - See COPYING.ARM in the top level directory
4 * FILE: ntoskrnl/mm/ARM3/pagfault.c
5 * PURPOSE: ARM Memory Manager Page Fault Handling
6 * PROGRAMMERS: ReactOS Portable Systems Group
7 */
8
9 /* INCLUDES *******************************************************************/
10
11 #include <ntoskrnl.h>
12 #define NDEBUG
13 #include <debug.h>
14
15 #define MODULE_INVOLVED_IN_ARM3
16 #include "../ARM3/miarm.h"
17
18 /* GLOBALS ********************************************************************/
19
20 #define HYDRA_PROCESS (PEPROCESS)1
21 #if MI_TRACE_PFNS
22 BOOLEAN UserPdeFault = FALSE;
23 #endif
24
25 /* PRIVATE FUNCTIONS **********************************************************/
26
27 NTSTATUS
28 NTAPI
29 MiCheckForUserStackOverflow(IN PVOID Address,
30 IN PVOID TrapInformation)
31 {
32 PETHREAD CurrentThread = PsGetCurrentThread();
33 PTEB Teb = CurrentThread->Tcb.Teb;
34 PVOID StackBase, DeallocationStack, NextStackAddress;
35 SIZE_T GuranteedSize;
36 NTSTATUS Status;
37
38 /* Do we own the address space lock? */
39 if (CurrentThread->AddressSpaceOwner == 1)
40 {
41 /* This isn't valid */
42 DPRINT1("Process owns address space lock\n");
43 ASSERT(KeAreAllApcsDisabled() == TRUE);
44 return STATUS_GUARD_PAGE_VIOLATION;
45 }
46
47 /* Are we attached? */
48 if (KeIsAttachedProcess())
49 {
50 /* This isn't valid */
51 DPRINT1("Process is attached\n");
52 return STATUS_GUARD_PAGE_VIOLATION;
53 }
54
55 /* Read the current settings */
56 StackBase = Teb->NtTib.StackBase;
57 DeallocationStack = Teb->DeallocationStack;
58 GuranteedSize = Teb->GuaranteedStackBytes;
59 DPRINT("Handling guard page fault with Stacks Addresses 0x%p and 0x%p, guarantee: %lx\n",
60 StackBase, DeallocationStack, GuranteedSize);
61
62 /* Guarantees make this code harder, for now, assume there aren't any */
63 ASSERT(GuranteedSize == 0);
64
65 /* So allocate only the minimum guard page size */
66 GuranteedSize = PAGE_SIZE;
67
68 /* Does this faulting stack address actually exist in the stack? */
69 if ((Address >= StackBase) || (Address < DeallocationStack))
70 {
71 /* That's odd... */
72 DPRINT1("Faulting address outside of stack bounds. Address=%p, StackBase=%p, DeallocationStack=%p\n",
73 Address, StackBase, DeallocationStack);
74 return STATUS_GUARD_PAGE_VIOLATION;
75 }
76
77 /* This is where the stack will start now */
78 NextStackAddress = (PVOID)((ULONG_PTR)PAGE_ALIGN(Address) - GuranteedSize);
79
80 /* Do we have at least one page between here and the end of the stack? */
81 if (((ULONG_PTR)NextStackAddress - PAGE_SIZE) <= (ULONG_PTR)DeallocationStack)
82 {
83 /* We don't -- Windows would try to make this guard page valid now */
84 DPRINT1("Close to our death...\n");
85 return STATUS_STACK_OVERFLOW;
86 }
87
88 /* Don't handle this flag yet */
89 ASSERT((PsGetCurrentProcess()->Peb->NtGlobalFlag & FLG_DISABLE_STACK_EXTENSION) == 0);
90
91 /* Update the stack limit */
92 Teb->NtTib.StackLimit = (PVOID)((ULONG_PTR)NextStackAddress + GuranteedSize);
93
94 /* Now move the guard page to the next page */
95 Status = ZwAllocateVirtualMemory(NtCurrentProcess(),
96 &NextStackAddress,
97 0,
98 &GuranteedSize,
99 MEM_COMMIT,
100 PAGE_READWRITE | PAGE_GUARD);
101 if ((NT_SUCCESS(Status) || (Status == STATUS_ALREADY_COMMITTED)))
102 {
103 /* We did it! */
104 DPRINT("Guard page handled successfully for %p\n", Address);
105 return STATUS_PAGE_FAULT_GUARD_PAGE;
106 }
107
108 /* Fail, we couldn't move the guard page */
109 DPRINT1("Guard page failure: %lx\n", Status);
110 ASSERT(FALSE);
111 return STATUS_STACK_OVERFLOW;
112 }
113
114 FORCEINLINE
115 BOOLEAN
116 MiIsAccessAllowed(
117 _In_ ULONG ProtectionMask,
118 _In_ BOOLEAN Write,
119 _In_ BOOLEAN Execute)
120 {
121 #define _BYTE_MASK(Bit0, Bit1, Bit2, Bit3, Bit4, Bit5, Bit6, Bit7) \
122 (Bit0) | ((Bit1) << 1) | ((Bit2) << 2) | ((Bit3) << 3) | \
123 ((Bit4) << 4) | ((Bit5) << 5) | ((Bit6) << 6) | ((Bit7) << 7)
124 static const UCHAR AccessAllowedMask[2][2] =
125 {
126 { // Protect 0 1 2 3 4 5 6 7
127 _BYTE_MASK(0, 1, 1, 1, 1, 1, 1, 1), // READ
128 _BYTE_MASK(0, 0, 1, 1, 0, 0, 1, 1), // EXECUTE READ
129 },
130 {
131 _BYTE_MASK(0, 0, 0, 0, 1, 1, 1, 1), // WRITE
132 _BYTE_MASK(0, 0, 0, 0, 0, 0, 1, 1), // EXECUTE WRITE
133 }
134 };
135
136 /* We want only the lower access bits */
137 ProtectionMask &= MM_PROTECT_ACCESS;
138
139 /* Look it up in the table */
140 return (AccessAllowedMask[Write != 0][Execute != 0] >> ProtectionMask) & 1;
141 }
142
143 NTSTATUS
144 NTAPI
145 MiAccessCheck(IN PMMPTE PointerPte,
146 IN BOOLEAN StoreInstruction,
147 IN KPROCESSOR_MODE PreviousMode,
148 IN ULONG_PTR ProtectionMask,
149 IN PVOID TrapFrame,
150 IN BOOLEAN LockHeld)
151 {
152 MMPTE TempPte;
153
154 /* Check for invalid user-mode access */
155 if ((PreviousMode == UserMode) && (PointerPte > MiHighestUserPte))
156 {
157 return STATUS_ACCESS_VIOLATION;
158 }
159
160 /* Capture the PTE -- is it valid? */
161 TempPte = *PointerPte;
162 if (TempPte.u.Hard.Valid)
163 {
164 /* Was someone trying to write to it? */
165 if (StoreInstruction)
166 {
167 /* Is it writable?*/
168 if ((TempPte.u.Hard.Write) || (TempPte.u.Hard.CopyOnWrite))
169 {
170 /* Then there's nothing to worry about */
171 return STATUS_SUCCESS;
172 }
173
174 /* Oops! This isn't allowed */
175 return STATUS_ACCESS_VIOLATION;
176 }
177
178 /* Someone was trying to read from a valid PTE, that's fine too */
179 return STATUS_SUCCESS;
180 }
181
182 /* Check if the protection on the page allows what is being attempted */
183 if (!MiIsAccessAllowed(ProtectionMask, StoreInstruction, FALSE))
184 {
185 return STATUS_ACCESS_VIOLATION;
186 }
187
188 /* Check if this is a guard page */
189 if ((ProtectionMask & MM_PROTECT_SPECIAL) == MM_GUARDPAGE)
190 {
191 NT_ASSERT(ProtectionMask != MM_DECOMMIT);
192
193 /* Attached processes can't expand their stack */
194 if (KeIsAttachedProcess()) return STATUS_ACCESS_VIOLATION;
195
196 /* No support for transition PTEs yet */
197 ASSERT(((TempPte.u.Soft.Transition == 1) &&
198 (TempPte.u.Soft.Prototype == 0)) == FALSE);
199
200 /* Remove the guard page bit, and return a guard page violation */
201 TempPte.u.Soft.Protection = ProtectionMask & ~MM_GUARDPAGE;
202 NT_ASSERT(TempPte.u.Long != 0);
203 MI_WRITE_INVALID_PTE(PointerPte, TempPte);
204 return STATUS_GUARD_PAGE_VIOLATION;
205 }
206
207 /* Nothing to do */
208 return STATUS_SUCCESS;
209 }
210
211 PMMPTE
212 NTAPI
213 MiCheckVirtualAddress(IN PVOID VirtualAddress,
214 OUT PULONG ProtectCode,
215 OUT PMMVAD *ProtoVad)
216 {
217 PMMVAD Vad;
218 PMMPTE PointerPte;
219
220 /* No prototype/section support for now */
221 *ProtoVad = NULL;
222
223 /* User or kernel fault? */
224 if (VirtualAddress <= MM_HIGHEST_USER_ADDRESS)
225 {
226 /* Special case for shared data */
227 if (PAGE_ALIGN(VirtualAddress) == (PVOID)MM_SHARED_USER_DATA_VA)
228 {
229 /* It's a read-only page */
230 *ProtectCode = MM_READONLY;
231 return MmSharedUserDataPte;
232 }
233
234 /* Find the VAD, it might not exist if the address is bogus */
235 Vad = MiLocateAddress(VirtualAddress);
236 if (!Vad)
237 {
238 /* Bogus virtual address */
239 *ProtectCode = MM_NOACCESS;
240 return NULL;
241 }
242
243 /* ReactOS does not handle physical memory VADs yet */
244 ASSERT(Vad->u.VadFlags.VadType != VadDevicePhysicalMemory);
245
246 /* Check if it's a section, or just an allocation */
247 if (Vad->u.VadFlags.PrivateMemory)
248 {
249 /* ReactOS does not handle AWE VADs yet */
250 ASSERT(Vad->u.VadFlags.VadType != VadAwe);
251
252 /* This must be a TEB/PEB VAD */
253 if (Vad->u.VadFlags.MemCommit)
254 {
255 /* It's committed, so return the VAD protection */
256 *ProtectCode = (ULONG)Vad->u.VadFlags.Protection;
257 }
258 else
259 {
260 /* It has not yet been committed, so return no access */
261 *ProtectCode = MM_NOACCESS;
262 }
263
264 /* In both cases, return no PTE */
265 return NULL;
266 }
267 else
268 {
269 /* ReactOS does not supoprt these VADs yet */
270 ASSERT(Vad->u.VadFlags.VadType != VadImageMap);
271 ASSERT(Vad->u2.VadFlags2.ExtendableFile == 0);
272
273 /* Return the proto VAD */
274 *ProtoVad = Vad;
275
276 /* Get the prototype PTE for this page */
277 PointerPte = (((ULONG_PTR)VirtualAddress >> PAGE_SHIFT) - Vad->StartingVpn) + Vad->FirstPrototypePte;
278 ASSERT(PointerPte != NULL);
279 ASSERT(PointerPte <= Vad->LastContiguousPte);
280
281 /* Return the Prototype PTE and the protection for the page mapping */
282 *ProtectCode = (ULONG)Vad->u.VadFlags.Protection;
283 return PointerPte;
284 }
285 }
286 else if (MI_IS_PAGE_TABLE_ADDRESS(VirtualAddress))
287 {
288 /* This should never happen, as these addresses are handled by the double-maping */
289 if (((PMMPTE)VirtualAddress >= MiAddressToPte(MmPagedPoolStart)) &&
290 ((PMMPTE)VirtualAddress <= MmPagedPoolInfo.LastPteForPagedPool))
291 {
292 /* Fail such access */
293 *ProtectCode = MM_NOACCESS;
294 return NULL;
295 }
296
297 /* Return full access rights */
298 *ProtectCode = MM_READWRITE;
299 return NULL;
300 }
301 else if (MI_IS_SESSION_ADDRESS(VirtualAddress))
302 {
303 /* ReactOS does not have an image list yet, so bail out to failure case */
304 ASSERT(IsListEmpty(&MmSessionSpace->ImageList));
305 }
306
307 /* Default case -- failure */
308 *ProtectCode = MM_NOACCESS;
309 return NULL;
310 }
311
312 #if (_MI_PAGING_LEVELS == 2)
313 FORCEINLINE
314 BOOLEAN
315 MiSynchronizeSystemPde(PMMPDE PointerPde)
316 {
317 MMPDE SystemPde;
318 ULONG Index;
319
320 /* Get the Index from the PDE */
321 Index = ((ULONG_PTR)PointerPde & (SYSTEM_PD_SIZE - 1)) / sizeof(MMPTE);
322
323 /* Copy the PDE from the double-mapped system page directory */
324 SystemPde = MmSystemPagePtes[Index];
325 *PointerPde = SystemPde;
326
327 /* Make sure we re-read the PDE and PTE */
328 KeMemoryBarrierWithoutFence();
329
330 /* Return, if we had success */
331 return (BOOLEAN)SystemPde.u.Hard.Valid;
332 }
333
334 NTSTATUS
335 FASTCALL
336 MiCheckPdeForSessionSpace(IN PVOID Address)
337 {
338 MMPTE TempPde;
339 PMMPTE PointerPde;
340 PVOID SessionAddress;
341 ULONG Index;
342
343 /* Is this a session PTE? */
344 if (MI_IS_SESSION_PTE(Address))
345 {
346 /* Make sure the PDE for session space is valid */
347 PointerPde = MiAddressToPde(MmSessionSpace);
348 if (!PointerPde->u.Hard.Valid)
349 {
350 /* This means there's no valid session, bail out */
351 DbgPrint("MiCheckPdeForSessionSpace: No current session for PTE %p\n",
352 Address);
353 DbgBreakPoint();
354 return STATUS_ACCESS_VIOLATION;
355 }
356
357 /* Now get the session-specific page table for this address */
358 SessionAddress = MiPteToAddress(Address);
359 PointerPde = MiAddressToPte(Address);
360 if (PointerPde->u.Hard.Valid) return STATUS_WAIT_1;
361
362 /* It's not valid, so find it in the page table array */
363 Index = ((ULONG_PTR)SessionAddress - (ULONG_PTR)MmSessionBase) >> 22;
364 TempPde.u.Long = MmSessionSpace->PageTables[Index].u.Long;
365 if (TempPde.u.Hard.Valid)
366 {
367 /* The copy is valid, so swap it in */
368 InterlockedExchange((PLONG)PointerPde, TempPde.u.Long);
369 return STATUS_WAIT_1;
370 }
371
372 /* We don't seem to have allocated a page table for this address yet? */
373 DbgPrint("MiCheckPdeForSessionSpace: No Session PDE for PTE %p, %p\n",
374 PointerPde->u.Long, SessionAddress);
375 DbgBreakPoint();
376 return STATUS_ACCESS_VIOLATION;
377 }
378
379 /* Is the address also a session address? If not, we're done */
380 if (!MI_IS_SESSION_ADDRESS(Address)) return STATUS_SUCCESS;
381
382 /* It is, so again get the PDE for session space */
383 PointerPde = MiAddressToPde(MmSessionSpace);
384 if (!PointerPde->u.Hard.Valid)
385 {
386 /* This means there's no valid session, bail out */
387 DbgPrint("MiCheckPdeForSessionSpace: No current session for VA %p\n",
388 Address);
389 DbgBreakPoint();
390 return STATUS_ACCESS_VIOLATION;
391 }
392
393 /* Now get the PDE for the address itself */
394 PointerPde = MiAddressToPde(Address);
395 if (!PointerPde->u.Hard.Valid)
396 {
397 /* Do the swap, we should be good to go */
398 Index = ((ULONG_PTR)Address - (ULONG_PTR)MmSessionBase) >> 22;
399 PointerPde->u.Long = MmSessionSpace->PageTables[Index].u.Long;
400 if (PointerPde->u.Hard.Valid) return STATUS_WAIT_1;
401
402 /* We had not allocated a page table for this session address yet, fail! */
403 DbgPrint("MiCheckPdeForSessionSpace: No Session PDE for VA %p, %p\n",
404 PointerPde->u.Long, Address);
405 DbgBreakPoint();
406 return STATUS_ACCESS_VIOLATION;
407 }
408
409 /* It's valid, so there's nothing to do */
410 return STATUS_SUCCESS;
411 }
412
413 NTSTATUS
414 FASTCALL
415 MiCheckPdeForPagedPool(IN PVOID Address)
416 {
417 PMMPDE PointerPde;
418 NTSTATUS Status = STATUS_SUCCESS;
419
420 /* Check session PDE */
421 if (MI_IS_SESSION_ADDRESS(Address)) return MiCheckPdeForSessionSpace(Address);
422 if (MI_IS_SESSION_PTE(Address)) return MiCheckPdeForSessionSpace(Address);
423
424 //
425 // Check if this is a fault while trying to access the page table itself
426 //
427 if (MI_IS_SYSTEM_PAGE_TABLE_ADDRESS(Address))
428 {
429 //
430 // Send a hint to the page fault handler that this is only a valid fault
431 // if we already detected this was access within the page table range
432 //
433 PointerPde = (PMMPDE)MiAddressToPte(Address);
434 Status = STATUS_WAIT_1;
435 }
436 else if (Address < MmSystemRangeStart)
437 {
438 //
439 // This is totally illegal
440 //
441 return STATUS_ACCESS_VIOLATION;
442 }
443 else
444 {
445 //
446 // Get the PDE for the address
447 //
448 PointerPde = MiAddressToPde(Address);
449 }
450
451 //
452 // Check if it's not valid
453 //
454 if (PointerPde->u.Hard.Valid == 0)
455 {
456 //
457 // Copy it from our double-mapped system page directory
458 //
459 InterlockedExchangePte(PointerPde,
460 MmSystemPagePtes[((ULONG_PTR)PointerPde & (SYSTEM_PD_SIZE - 1)) / sizeof(MMPTE)].u.Long);
461 }
462
463 //
464 // Return status
465 //
466 return Status;
467 }
468 #else
469 NTSTATUS
470 FASTCALL
471 MiCheckPdeForPagedPool(IN PVOID Address)
472 {
473 return STATUS_ACCESS_VIOLATION;
474 }
475 #endif
476
477 VOID
478 NTAPI
479 MiZeroPfn(IN PFN_NUMBER PageFrameNumber)
480 {
481 PMMPTE ZeroPte;
482 MMPTE TempPte;
483 PMMPFN Pfn1;
484 PVOID ZeroAddress;
485
486 /* Get the PFN for this page */
487 Pfn1 = MiGetPfnEntry(PageFrameNumber);
488 ASSERT(Pfn1);
489
490 /* Grab a system PTE we can use to zero the page */
491 ZeroPte = MiReserveSystemPtes(1, SystemPteSpace);
492 ASSERT(ZeroPte);
493
494 /* Initialize the PTE for it */
495 TempPte = ValidKernelPte;
496 TempPte.u.Hard.PageFrameNumber = PageFrameNumber;
497
498 /* Setup caching */
499 if (Pfn1->u3.e1.CacheAttribute == MiWriteCombined)
500 {
501 /* Write combining, no caching */
502 MI_PAGE_DISABLE_CACHE(&TempPte);
503 MI_PAGE_WRITE_COMBINED(&TempPte);
504 }
505 else if (Pfn1->u3.e1.CacheAttribute == MiNonCached)
506 {
507 /* Write through, no caching */
508 MI_PAGE_DISABLE_CACHE(&TempPte);
509 MI_PAGE_WRITE_THROUGH(&TempPte);
510 }
511
512 /* Make the system PTE valid with our PFN */
513 MI_WRITE_VALID_PTE(ZeroPte, TempPte);
514
515 /* Get the address it maps to, and zero it out */
516 ZeroAddress = MiPteToAddress(ZeroPte);
517 KeZeroPages(ZeroAddress, PAGE_SIZE);
518
519 /* Now get rid of it */
520 MiReleaseSystemPtes(ZeroPte, 1, SystemPteSpace);
521 }
522
523 NTSTATUS
524 NTAPI
525 MiResolveDemandZeroFault(IN PVOID Address,
526 IN PMMPTE PointerPte,
527 IN PEPROCESS Process,
528 IN KIRQL OldIrql)
529 {
530 PFN_NUMBER PageFrameNumber = 0;
531 MMPTE TempPte;
532 BOOLEAN NeedZero = FALSE, HaveLock = FALSE;
533 ULONG Color;
534 PMMPFN Pfn1;
535 DPRINT("ARM3 Demand Zero Page Fault Handler for address: %p in process: %p\n",
536 Address,
537 Process);
538
539 /* Must currently only be called by paging path */
540 if ((Process > HYDRA_PROCESS) && (OldIrql == MM_NOIRQL))
541 {
542 /* Sanity check */
543 ASSERT(MI_IS_PAGE_TABLE_ADDRESS(PointerPte));
544
545 /* No forking yet */
546 ASSERT(Process->ForkInProgress == NULL);
547
548 /* Get process color */
549 Color = MI_GET_NEXT_PROCESS_COLOR(Process);
550 ASSERT(Color != 0xFFFFFFFF);
551
552 /* We'll need a zero page */
553 NeedZero = TRUE;
554 }
555 else
556 {
557 /* Check if we need a zero page */
558 NeedZero = (OldIrql != MM_NOIRQL);
559
560 /* Session-backed image views must be zeroed */
561 if ((Process == HYDRA_PROCESS) &&
562 ((MI_IS_SESSION_IMAGE_ADDRESS(Address)) ||
563 ((Address >= MiSessionViewStart) && (Address < MiSessionSpaceWs))))
564 {
565 NeedZero = TRUE;
566 }
567
568 /* Hardcode unknown color */
569 Color = 0xFFFFFFFF;
570 }
571
572 /* Check if the PFN database should be acquired */
573 if (OldIrql == MM_NOIRQL)
574 {
575 /* Acquire it and remember we should release it after */
576 OldIrql = KeAcquireQueuedSpinLock(LockQueuePfnLock);
577 HaveLock = TRUE;
578 }
579
580 /* We either manually locked the PFN DB, or already came with it locked */
581 ASSERT(KeGetCurrentIrql() == DISPATCH_LEVEL);
582 ASSERT(PointerPte->u.Hard.Valid == 0);
583
584 /* Assert we have enough pages */
585 ASSERT(MmAvailablePages >= 32);
586
587 #if MI_TRACE_PFNS
588 if (UserPdeFault) MI_SET_USAGE(MI_USAGE_PAGE_TABLE);
589 if (!UserPdeFault) MI_SET_USAGE(MI_USAGE_DEMAND_ZERO);
590 #endif
591 if (Process) MI_SET_PROCESS2(Process->ImageFileName);
592 if (!Process) MI_SET_PROCESS2("Kernel Demand 0");
593
594 /* Do we need a zero page? */
595 if (Color != 0xFFFFFFFF)
596 {
597 /* Try to get one, if we couldn't grab a free page and zero it */
598 PageFrameNumber = MiRemoveZeroPageSafe(Color);
599 if (!PageFrameNumber)
600 {
601 /* We'll need a free page and zero it manually */
602 PageFrameNumber = MiRemoveAnyPage(Color);
603 NeedZero = TRUE;
604 }
605 }
606 else
607 {
608 /* Get a color, and see if we should grab a zero or non-zero page */
609 Color = MI_GET_NEXT_COLOR();
610 if (!NeedZero)
611 {
612 /* Process or system doesn't want a zero page, grab anything */
613 PageFrameNumber = MiRemoveAnyPage(Color);
614 }
615 else
616 {
617 /* System wants a zero page, obtain one */
618 PageFrameNumber = MiRemoveZeroPage(Color);
619 }
620 }
621
622 /* Initialize it */
623 MiInitializePfn(PageFrameNumber, PointerPte, TRUE);
624
625 /* Do we have the lock? */
626 if (HaveLock)
627 {
628 /* Release it */
629 KeReleaseQueuedSpinLock(LockQueuePfnLock, OldIrql);
630
631 /* Update performance counters */
632 if (Process > HYDRA_PROCESS) Process->NumberOfPrivatePages++;
633 }
634
635 /* Increment demand zero faults */
636 InterlockedIncrement(&KeGetCurrentPrcb()->MmDemandZeroCount);
637
638 /* Zero the page if need be */
639 if (NeedZero) MiZeroPfn(PageFrameNumber);
640
641 /* Fault on user PDE, or fault on user PTE? */
642 if (PointerPte <= MiHighestUserPte)
643 {
644 /* User fault, build a user PTE */
645 MI_MAKE_HARDWARE_PTE_USER(&TempPte,
646 PointerPte,
647 PointerPte->u.Soft.Protection,
648 PageFrameNumber);
649 }
650 else
651 {
652 /* This is a user-mode PDE, create a kernel PTE for it */
653 MI_MAKE_HARDWARE_PTE(&TempPte,
654 PointerPte,
655 PointerPte->u.Soft.Protection,
656 PageFrameNumber);
657 }
658
659 /* Set it dirty if it's a writable page */
660 if (MI_IS_PAGE_WRITEABLE(&TempPte)) MI_MAKE_DIRTY_PAGE(&TempPte);
661
662 /* Write it */
663 MI_WRITE_VALID_PTE(PointerPte, TempPte);
664
665 /* Did we manually acquire the lock */
666 if (HaveLock)
667 {
668 /* Get the PFN entry */
669 Pfn1 = MI_PFN_ELEMENT(PageFrameNumber);
670
671 /* Windows does these sanity checks */
672 ASSERT(Pfn1->u1.Event == 0);
673 ASSERT(Pfn1->u3.e1.PrototypePte == 0);
674 }
675
676 //
677 // It's all good now
678 //
679 DPRINT("Demand zero page has now been paged in\n");
680 return STATUS_PAGE_FAULT_DEMAND_ZERO;
681 }
682
683 NTSTATUS
684 NTAPI
685 MiCompleteProtoPteFault(IN BOOLEAN StoreInstruction,
686 IN PVOID Address,
687 IN PMMPTE PointerPte,
688 IN PMMPTE PointerProtoPte,
689 IN KIRQL OldIrql,
690 IN PMMPFN* LockedProtoPfn)
691 {
692 MMPTE TempPte;
693 PMMPTE OriginalPte, PageTablePte;
694 ULONG_PTR Protection;
695 PFN_NUMBER PageFrameIndex;
696 PMMPFN Pfn1, Pfn2;
697 BOOLEAN OriginalProtection, DirtyPage;
698
699 /* Must be called with an valid prototype PTE, with the PFN lock held */
700 ASSERT(KeGetCurrentIrql() == DISPATCH_LEVEL);
701 ASSERT(PointerProtoPte->u.Hard.Valid == 1);
702
703 /* Get the page */
704 PageFrameIndex = PFN_FROM_PTE(PointerProtoPte);
705
706 /* Get the PFN entry and set it as a prototype PTE */
707 Pfn1 = MiGetPfnEntry(PageFrameIndex);
708 Pfn1->u3.e1.PrototypePte = 1;
709
710 /* Increment the share count for the page table */
711 PageTablePte = MiAddressToPte(PointerPte);
712 Pfn2 = MiGetPfnEntry(PageTablePte->u.Hard.PageFrameNumber);
713 Pfn2->u2.ShareCount++;
714
715 /* Check where we should be getting the protection information from */
716 if (PointerPte->u.Soft.PageFileHigh == MI_PTE_LOOKUP_NEEDED)
717 {
718 /* Get the protection from the PTE, there's no real Proto PTE data */
719 Protection = PointerPte->u.Soft.Protection;
720
721 /* Remember that we did not use the proto protection */
722 OriginalProtection = FALSE;
723 }
724 else
725 {
726 /* Get the protection from the original PTE link */
727 OriginalPte = &Pfn1->OriginalPte;
728 Protection = OriginalPte->u.Soft.Protection;
729
730 /* Remember that we used the original protection */
731 OriginalProtection = TRUE;
732
733 /* Check if this was a write on a read only proto */
734 if ((StoreInstruction) && !(Protection & MM_READWRITE))
735 {
736 /* Clear the flag */
737 StoreInstruction = 0;
738 }
739 }
740
741 /* Check if this was a write on a non-COW page */
742 DirtyPage = FALSE;
743 if ((StoreInstruction) && ((Protection & MM_WRITECOPY) != MM_WRITECOPY))
744 {
745 /* Then the page should be marked dirty */
746 DirtyPage = TRUE;
747
748 /* ReactOS check */
749 ASSERT(Pfn1->OriginalPte.u.Soft.Prototype != 0);
750 }
751
752 /* Did we get a locked incoming PFN? */
753 if (*LockedProtoPfn)
754 {
755 /* Drop a reference */
756 ASSERT((*LockedProtoPfn)->u3.e2.ReferenceCount >= 1);
757 MiDereferencePfnAndDropLockCount(*LockedProtoPfn);
758 *LockedProtoPfn = NULL;
759 }
760
761 /* Release the PFN lock */
762 KeReleaseQueuedSpinLock(LockQueuePfnLock, OldIrql);
763
764 /* Remove special/caching bits */
765 Protection &= ~MM_PROTECT_SPECIAL;
766
767 /* Setup caching */
768 if (Pfn1->u3.e1.CacheAttribute == MiWriteCombined)
769 {
770 /* Write combining, no caching */
771 MI_PAGE_DISABLE_CACHE(&TempPte);
772 MI_PAGE_WRITE_COMBINED(&TempPte);
773 }
774 else if (Pfn1->u3.e1.CacheAttribute == MiNonCached)
775 {
776 /* Write through, no caching */
777 MI_PAGE_DISABLE_CACHE(&TempPte);
778 MI_PAGE_WRITE_THROUGH(&TempPte);
779 }
780
781 /* Check if this is a kernel or user address */
782 if (Address < MmSystemRangeStart)
783 {
784 /* Build the user PTE */
785 MI_MAKE_HARDWARE_PTE_USER(&TempPte, PointerPte, Protection, PageFrameIndex);
786 }
787 else
788 {
789 /* Build the kernel PTE */
790 MI_MAKE_HARDWARE_PTE(&TempPte, PointerPte, Protection, PageFrameIndex);
791 }
792
793 /* Set the dirty flag if needed */
794 if (DirtyPage) TempPte.u.Hard.Dirty = TRUE;
795
796 /* Write the PTE */
797 MI_WRITE_VALID_PTE(PointerPte, TempPte);
798
799 /* Reset the protection if needed */
800 if (OriginalProtection) Protection = MM_ZERO_ACCESS;
801
802 /* Return success */
803 ASSERT(PointerPte == MiAddressToPte(Address));
804 return STATUS_SUCCESS;
805 }
806
807 NTSTATUS
808 NTAPI
809 MiResolvePageFileFault(_In_ BOOLEAN StoreInstruction,
810 _In_ PVOID FaultingAddress,
811 _In_ PMMPTE PointerPte,
812 _In_ PEPROCESS CurrentProcess,
813 _Inout_ KIRQL *OldIrql)
814 {
815 ULONG Color;
816 PFN_NUMBER Page;
817 NTSTATUS Status;
818 MMPTE TempPte = *PointerPte;
819 KEVENT Event;
820 PMMPFN Pfn1;
821 ULONG PageFileIndex = TempPte.u.Soft.PageFileLow;
822 ULONG_PTR PageFileOffset = TempPte.u.Soft.PageFileHigh;
823
824 /* Things we don't support yet */
825 ASSERT(CurrentProcess > HYDRA_PROCESS);
826 ASSERT(*OldIrql != MM_NOIRQL);
827
828 /* We must hold the PFN lock */
829 ASSERT(KeGetCurrentIrql() == DISPATCH_LEVEL);
830
831 /* Some sanity checks */
832 ASSERT(TempPte.u.Hard.Valid == 0);
833 ASSERT(TempPte.u.Soft.PageFileHigh != 0);
834 ASSERT(TempPte.u.Soft.PageFileHigh != MI_PTE_LOOKUP_NEEDED);
835
836 /* Get any page, it will be overwritten */
837 Color = MI_GET_NEXT_PROCESS_COLOR(CurrentProcess);
838 Page = MiRemoveAnyPage(Color);
839
840 /* Initialize this PFN */
841 MiInitializePfn(Page, PointerPte, StoreInstruction);
842
843 /* Sets the PFN as being in IO operation */
844 Pfn1 = MI_PFN_ELEMENT(Page);
845 ASSERT(Pfn1->u1.Event == NULL);
846 ASSERT(Pfn1->u3.e1.ReadInProgress == 0);
847 ASSERT(Pfn1->u3.e1.WriteInProgress == 0);
848
849 KeInitializeEvent(&Event, NotificationEvent, FALSE);
850 Pfn1->u1.Event = &Event;
851 Pfn1->u3.e1.ReadInProgress = 1;
852
853 /* We must write the PTE now as the PFN lock will be released while performing the IO operation */
854 TempPte.u.Soft.Transition = 1;
855 TempPte.u.Soft.PageFileLow = 0;
856 TempPte.u.Soft.Prototype = 0;
857 TempPte.u.Trans.PageFrameNumber = Page;
858
859 MI_WRITE_INVALID_PTE(PointerPte, TempPte);
860
861 /* Release the PFN lock while we proceed */
862 KeReleaseQueuedSpinLock(LockQueuePfnLock, *OldIrql);
863
864 /* Do the paging IO */
865 Status = MiReadPageFile(Page, PageFileIndex, PageFileOffset);
866
867 /* Lock the PFN database again */
868 *OldIrql = KeAcquireQueuedSpinLock(LockQueuePfnLock);
869
870 /* Nobody should have changed that while we were not looking */
871 ASSERT(Pfn1->u1.Event == &Event);
872 ASSERT(Pfn1->u3.e1.ReadInProgress == 1);
873 ASSERT(Pfn1->u3.e1.WriteInProgress == 0);
874
875 if (!NT_SUCCESS(Status))
876 {
877 /* Malheur! */
878 ASSERT(FALSE);
879 Pfn1->u4.InPageError = 1;
880 Pfn1->u1.ReadStatus = Status;
881 }
882
883 /* This is now a nice and normal PFN */
884 Pfn1->u1.Event = NULL;
885 Pfn1->u3.e1.ReadInProgress = 0;
886
887 /* And the PTE can finally be valid */
888 MI_MAKE_HARDWARE_PTE(&TempPte, PointerPte, TempPte.u.Trans.Protection, Page);
889 MI_WRITE_VALID_PTE(PointerPte, TempPte);
890
891 /* Waiters gonna wait */
892 KeSetEvent(&Event, IO_NO_INCREMENT, FALSE);
893
894 return Status;
895 }
896
897 NTSTATUS
898 NTAPI
899 MiResolveTransitionFault(IN PVOID FaultingAddress,
900 IN PMMPTE PointerPte,
901 IN PEPROCESS CurrentProcess,
902 IN KIRQL OldIrql,
903 OUT PVOID *InPageBlock)
904 {
905 PFN_NUMBER PageFrameIndex;
906 PMMPFN Pfn1;
907 MMPTE TempPte;
908 PMMPTE PointerToPteForProtoPage;
909 DPRINT("Transition fault on 0x%p with PTE 0x%p in process %s\n",
910 FaultingAddress, PointerPte, CurrentProcess->ImageFileName);
911
912 /* Windowss does this check */
913 ASSERT(*InPageBlock == NULL);
914
915 /* ARM3 doesn't support this path */
916 ASSERT(OldIrql != MM_NOIRQL);
917
918 /* Capture the PTE and make sure it's in transition format */
919 TempPte = *PointerPte;
920 ASSERT((TempPte.u.Soft.Valid == 0) &&
921 (TempPte.u.Soft.Prototype == 0) &&
922 (TempPte.u.Soft.Transition == 1));
923
924 /* Get the PFN and the PFN entry */
925 PageFrameIndex = TempPte.u.Trans.PageFrameNumber;
926 DPRINT("Transition PFN: %lx\n", PageFrameIndex);
927 Pfn1 = MiGetPfnEntry(PageFrameIndex);
928
929 /* One more transition fault! */
930 InterlockedIncrement(&KeGetCurrentPrcb()->MmTransitionCount);
931
932 /* This is from ARM3 -- Windows normally handles this here */
933 ASSERT(Pfn1->u4.InPageError == 0);
934
935 /* See if we should wait before terminating the fault */
936 if (Pfn1->u3.e1.ReadInProgress == 1)
937 {
938 DPRINT1("The page is currently being read!\n");
939 ASSERT(Pfn1->u1.Event != NULL);
940 *InPageBlock = Pfn1->u1.Event;
941 if (PointerPte == Pfn1->PteAddress)
942 {
943 DPRINT1("And this if for this particular PTE.\n");
944 /* The PTE will be made valid by the thread serving the fault */
945 return STATUS_SUCCESS; // FIXME: Maybe something more descriptive
946 }
947 }
948
949 /* Windows checks there's some free pages and this isn't an in-page error */
950 ASSERT(MmAvailablePages > 0);
951 ASSERT(Pfn1->u4.InPageError == 0);
952
953 /* ReactOS checks for this */
954 ASSERT(MmAvailablePages > 32);
955
956 /* Was this a transition page in the valid list, or free/zero list? */
957 if (Pfn1->u3.e1.PageLocation == ActiveAndValid)
958 {
959 /* All Windows does here is a bunch of sanity checks */
960 DPRINT("Transition in active list\n");
961 ASSERT((Pfn1->PteAddress >= MiAddressToPte(MmPagedPoolStart)) &&
962 (Pfn1->PteAddress <= MiAddressToPte(MmPagedPoolEnd)));
963 ASSERT(Pfn1->u2.ShareCount != 0);
964 ASSERT(Pfn1->u3.e2.ReferenceCount != 0);
965 }
966 else
967 {
968 /* Otherwise, the page is removed from its list */
969 DPRINT("Transition page in free/zero list\n");
970 MiUnlinkPageFromList(Pfn1);
971 MiReferenceUnusedPageAndBumpLockCount(Pfn1);
972 }
973
974 /* At this point, there should no longer be any in-page errors */
975 ASSERT(Pfn1->u4.InPageError == 0);
976
977 /* Check if this was a PFN with no more share references */
978 if (Pfn1->u2.ShareCount == 0) MiDropLockCount(Pfn1);
979
980 /* Bump the share count and make the page valid */
981 Pfn1->u2.ShareCount++;
982 Pfn1->u3.e1.PageLocation = ActiveAndValid;
983
984 /* Prototype PTEs are in paged pool, which itself might be in transition */
985 if (FaultingAddress >= MmSystemRangeStart)
986 {
987 /* Check if this is a paged pool PTE in transition state */
988 PointerToPteForProtoPage = MiAddressToPte(PointerPte);
989 TempPte = *PointerToPteForProtoPage;
990 if ((TempPte.u.Hard.Valid == 0) && (TempPte.u.Soft.Transition == 1))
991 {
992 /* This isn't yet supported */
993 DPRINT1("Double transition fault not yet supported\n");
994 ASSERT(FALSE);
995 }
996 }
997
998 /* Build the transition PTE -- maybe a macro? */
999 ASSERT(PointerPte->u.Hard.Valid == 0);
1000 ASSERT(PointerPte->u.Trans.Prototype == 0);
1001 ASSERT(PointerPte->u.Trans.Transition == 1);
1002 TempPte.u.Long = (PointerPte->u.Long & ~0xFFF) |
1003 (MmProtectToPteMask[PointerPte->u.Trans.Protection]) |
1004 MiDetermineUserGlobalPteMask(PointerPte);
1005
1006 /* Is the PTE writeable? */
1007 if (((Pfn1->u3.e1.Modified) && (TempPte.u.Hard.Write)) &&
1008 (TempPte.u.Hard.CopyOnWrite == 0))
1009 {
1010 /* Make it dirty */
1011 TempPte.u.Hard.Dirty = TRUE;
1012 }
1013 else
1014 {
1015 /* Make it clean */
1016 TempPte.u.Hard.Dirty = FALSE;
1017 }
1018
1019 /* Write the valid PTE */
1020 MI_WRITE_VALID_PTE(PointerPte, TempPte);
1021
1022 /* Return success */
1023 return STATUS_PAGE_FAULT_TRANSITION;
1024 }
1025
1026 NTSTATUS
1027 NTAPI
1028 MiResolveProtoPteFault(IN BOOLEAN StoreInstruction,
1029 IN PVOID Address,
1030 IN PMMPTE PointerPte,
1031 IN PMMPTE PointerProtoPte,
1032 IN OUT PMMPFN *OutPfn,
1033 OUT PVOID *PageFileData,
1034 OUT PMMPTE PteValue,
1035 IN PEPROCESS Process,
1036 IN KIRQL OldIrql,
1037 IN PVOID TrapInformation)
1038 {
1039 MMPTE TempPte, PteContents;
1040 PMMPFN Pfn1;
1041 PFN_NUMBER PageFrameIndex;
1042 NTSTATUS Status;
1043 PVOID InPageBlock = NULL;
1044
1045 /* Must be called with an invalid, prototype PTE, with the PFN lock held */
1046 ASSERT(KeGetCurrentIrql() == DISPATCH_LEVEL);
1047 ASSERT(PointerPte->u.Hard.Valid == 0);
1048 ASSERT(PointerPte->u.Soft.Prototype == 1);
1049
1050 /* Read the prototype PTE and check if it's valid */
1051 TempPte = *PointerProtoPte;
1052 if (TempPte.u.Hard.Valid == 1)
1053 {
1054 /* One more user of this mapped page */
1055 PageFrameIndex = PFN_FROM_PTE(&TempPte);
1056 Pfn1 = MiGetPfnEntry(PageFrameIndex);
1057 Pfn1->u2.ShareCount++;
1058
1059 /* Call it a transition */
1060 InterlockedIncrement(&KeGetCurrentPrcb()->MmTransitionCount);
1061
1062 /* Complete the prototype PTE fault -- this will release the PFN lock */
1063 return MiCompleteProtoPteFault(StoreInstruction,
1064 Address,
1065 PointerPte,
1066 PointerProtoPte,
1067 OldIrql,
1068 OutPfn);
1069 }
1070
1071 /* Make sure there's some protection mask */
1072 if (TempPte.u.Long == 0)
1073 {
1074 /* Release the lock */
1075 DPRINT1("Access on reserved section?\n");
1076 KeReleaseQueuedSpinLock(LockQueuePfnLock, OldIrql);
1077 return STATUS_ACCESS_VIOLATION;
1078 }
1079
1080 /* There is no such thing as a decommitted prototype PTE */
1081 NT_ASSERT(TempPte.u.Long != MmDecommittedPte.u.Long);
1082
1083 /* Check for access rights on the PTE proper */
1084 PteContents = *PointerPte;
1085 if (PteContents.u.Soft.PageFileHigh != MI_PTE_LOOKUP_NEEDED)
1086 {
1087 if (!PteContents.u.Proto.ReadOnly)
1088 {
1089 /* Check for page acess in software */
1090 Status = MiAccessCheck(PointerProtoPte,
1091 StoreInstruction,
1092 KernelMode,
1093 TempPte.u.Soft.Protection,
1094 TrapInformation,
1095 TRUE);
1096 ASSERT(Status == STATUS_SUCCESS);
1097
1098 /* Check for copy on write page */
1099 if ((TempPte.u.Soft.Protection & MM_WRITECOPY) == MM_WRITECOPY)
1100 {
1101 /* Not yet supported */
1102 ASSERT(FALSE);
1103 }
1104 }
1105 }
1106 else
1107 {
1108 /* Check for copy on write page */
1109 if ((PteContents.u.Soft.Protection & MM_WRITECOPY) == MM_WRITECOPY)
1110 {
1111 /* Not yet supported */
1112 ASSERT(FALSE);
1113 }
1114 }
1115
1116 /* Check for clone PTEs */
1117 if (PointerPte <= MiHighestUserPte) ASSERT(Process->CloneRoot == NULL);
1118
1119 /* We don't support mapped files yet */
1120 ASSERT(TempPte.u.Soft.Prototype == 0);
1121
1122 /* We might however have transition PTEs */
1123 if (TempPte.u.Soft.Transition == 1)
1124 {
1125 /* Resolve the transition fault */
1126 ASSERT(OldIrql != MM_NOIRQL);
1127 Status = MiResolveTransitionFault(Address,
1128 PointerProtoPte,
1129 Process,
1130 OldIrql,
1131 &InPageBlock);
1132 ASSERT(NT_SUCCESS(Status));
1133 }
1134 else
1135 {
1136 /* We also don't support paged out pages */
1137 ASSERT(TempPte.u.Soft.PageFileHigh == 0);
1138
1139 /* Resolve the demand zero fault */
1140 Status = MiResolveDemandZeroFault(Address,
1141 PointerProtoPte,
1142 Process,
1143 OldIrql);
1144 ASSERT(NT_SUCCESS(Status));
1145 }
1146
1147 /* Complete the prototype PTE fault -- this will release the PFN lock */
1148 ASSERT(PointerPte->u.Hard.Valid == 0);
1149 return MiCompleteProtoPteFault(StoreInstruction,
1150 Address,
1151 PointerPte,
1152 PointerProtoPte,
1153 OldIrql,
1154 OutPfn);
1155 }
1156
1157 NTSTATUS
1158 NTAPI
1159 MiDispatchFault(IN BOOLEAN StoreInstruction,
1160 IN PVOID Address,
1161 IN PMMPTE PointerPte,
1162 IN PMMPTE PointerProtoPte,
1163 IN BOOLEAN Recursive,
1164 IN PEPROCESS Process,
1165 IN PVOID TrapInformation,
1166 IN PMMVAD Vad)
1167 {
1168 MMPTE TempPte;
1169 KIRQL OldIrql, LockIrql;
1170 NTSTATUS Status;
1171 PMMPTE SuperProtoPte;
1172 PMMPFN Pfn1, OutPfn = NULL;
1173 PFN_NUMBER PageFrameIndex;
1174 PFN_COUNT PteCount, ProcessedPtes;
1175 DPRINT("ARM3 Page Fault Dispatcher for address: %p in process: %p\n",
1176 Address,
1177 Process);
1178
1179 /* Make sure the addresses are ok */
1180 ASSERT(PointerPte == MiAddressToPte(Address));
1181
1182 //
1183 // Make sure APCs are off and we're not at dispatch
1184 //
1185 OldIrql = KeGetCurrentIrql();
1186 ASSERT(OldIrql <= APC_LEVEL);
1187 ASSERT(KeAreAllApcsDisabled() == TRUE);
1188
1189 //
1190 // Grab a copy of the PTE
1191 //
1192 TempPte = *PointerPte;
1193
1194 /* Do we have a prototype PTE? */
1195 if (PointerProtoPte)
1196 {
1197 /* This should never happen */
1198 ASSERT(!MI_IS_PHYSICAL_ADDRESS(PointerProtoPte));
1199
1200 /* Check if this is a kernel-mode address */
1201 SuperProtoPte = MiAddressToPte(PointerProtoPte);
1202 if (Address >= MmSystemRangeStart)
1203 {
1204 /* Lock the PFN database */
1205 LockIrql = KeAcquireQueuedSpinLock(LockQueuePfnLock);
1206
1207 /* Has the PTE been made valid yet? */
1208 if (!SuperProtoPte->u.Hard.Valid)
1209 {
1210 ASSERT(FALSE);
1211 }
1212 else if (PointerPte->u.Hard.Valid == 1)
1213 {
1214 ASSERT(FALSE);
1215 }
1216
1217 /* Resolve the fault -- this will release the PFN lock */
1218 Status = MiResolveProtoPteFault(StoreInstruction,
1219 Address,
1220 PointerPte,
1221 PointerProtoPte,
1222 &OutPfn,
1223 NULL,
1224 NULL,
1225 Process,
1226 LockIrql,
1227 TrapInformation);
1228 ASSERT(Status == STATUS_SUCCESS);
1229
1230 /* Complete this as a transition fault */
1231 ASSERT(OldIrql == KeGetCurrentIrql());
1232 ASSERT(OldIrql <= APC_LEVEL);
1233 ASSERT(KeAreAllApcsDisabled() == TRUE);
1234 return Status;
1235 }
1236 else
1237 {
1238 /* We only handle the lookup path */
1239 ASSERT(PointerPte->u.Soft.PageFileHigh == MI_PTE_LOOKUP_NEEDED);
1240
1241 /* Is there a non-image VAD? */
1242 if ((Vad) &&
1243 (Vad->u.VadFlags.VadType != VadImageMap) &&
1244 !(Vad->u2.VadFlags2.ExtendableFile))
1245 {
1246 /* One day, ReactOS will cluster faults */
1247 ASSERT(Address <= MM_HIGHEST_USER_ADDRESS);
1248 DPRINT("Should cluster fault, but won't\n");
1249 }
1250
1251 /* Only one PTE to handle for now */
1252 PteCount = 1;
1253 ProcessedPtes = 0;
1254
1255 /* Lock the PFN database */
1256 LockIrql = KeAcquireQueuedSpinLock(LockQueuePfnLock);
1257
1258 /* We only handle the valid path */
1259 ASSERT(SuperProtoPte->u.Hard.Valid == 1);
1260
1261 /* Capture the PTE */
1262 TempPte = *PointerProtoPte;
1263
1264 /* Loop to handle future case of clustered faults */
1265 while (TRUE)
1266 {
1267 /* For our current usage, this should be true */
1268 if (TempPte.u.Hard.Valid == 1)
1269 {
1270 /* Bump the share count on the PTE */
1271 PageFrameIndex = PFN_FROM_PTE(&TempPte);
1272 Pfn1 = MI_PFN_ELEMENT(PageFrameIndex);
1273 Pfn1->u2.ShareCount++;
1274 }
1275 else if ((TempPte.u.Soft.Prototype == 0) &&
1276 (TempPte.u.Soft.Transition == 1))
1277 {
1278 /* This is a standby page, bring it back from the cache */
1279 PageFrameIndex = TempPte.u.Trans.PageFrameNumber;
1280 DPRINT("oooh, shiny, a soft fault! 0x%lx\n", PageFrameIndex);
1281 Pfn1 = MI_PFN_ELEMENT(PageFrameIndex);
1282 ASSERT(Pfn1->u3.e1.PageLocation != ActiveAndValid);
1283
1284 /* Should not yet happen in ReactOS */
1285 ASSERT(Pfn1->u3.e1.ReadInProgress == 0);
1286 ASSERT(Pfn1->u4.InPageError == 0);
1287
1288 /* Get the page */
1289 MiUnlinkPageFromList(Pfn1);
1290
1291 /* Bump its reference count */
1292 ASSERT(Pfn1->u2.ShareCount == 0);
1293 InterlockedIncrement16((PSHORT)&Pfn1->u3.e2.ReferenceCount);
1294 Pfn1->u2.ShareCount++;
1295
1296 /* Make it valid again */
1297 /* This looks like another macro.... */
1298 Pfn1->u3.e1.PageLocation = ActiveAndValid;
1299 ASSERT(PointerProtoPte->u.Hard.Valid == 0);
1300 ASSERT(PointerProtoPte->u.Trans.Prototype == 0);
1301 ASSERT(PointerProtoPte->u.Trans.Transition == 1);
1302 TempPte.u.Long = (PointerProtoPte->u.Long & ~0xFFF) |
1303 MmProtectToPteMask[PointerProtoPte->u.Trans.Protection];
1304 TempPte.u.Hard.Valid = 1;
1305 TempPte.u.Hard.Accessed = 1;
1306
1307 /* Is the PTE writeable? */
1308 if (((Pfn1->u3.e1.Modified) && (TempPte.u.Hard.Write)) &&
1309 (TempPte.u.Hard.CopyOnWrite == 0))
1310 {
1311 /* Make it dirty */
1312 TempPte.u.Hard.Dirty = TRUE;
1313 }
1314 else
1315 {
1316 /* Make it clean */
1317 TempPte.u.Hard.Dirty = FALSE;
1318 }
1319
1320 /* Write the valid PTE */
1321 MI_WRITE_VALID_PTE(PointerProtoPte, TempPte);
1322 ASSERT(PointerPte->u.Hard.Valid == 0);
1323 }
1324 else
1325 {
1326 /* Page is invalid, get out of the loop */
1327 break;
1328 }
1329
1330 /* One more done, was it the last? */
1331 if (++ProcessedPtes == PteCount)
1332 {
1333 /* Complete the fault */
1334 MiCompleteProtoPteFault(StoreInstruction,
1335 Address,
1336 PointerPte,
1337 PointerProtoPte,
1338 LockIrql,
1339 &OutPfn);
1340
1341 /* THIS RELEASES THE PFN LOCK! */
1342 break;
1343 }
1344
1345 /* No clustered faults yet */
1346 ASSERT(FALSE);
1347 }
1348
1349 /* Did we resolve the fault? */
1350 if (ProcessedPtes)
1351 {
1352 /* Bump the transition count */
1353 InterlockedExchangeAddSizeT(&KeGetCurrentPrcb()->MmTransitionCount, ProcessedPtes);
1354 ProcessedPtes--;
1355
1356 /* Loop all the processing we did */
1357 ASSERT(ProcessedPtes == 0);
1358
1359 /* Complete this as a transition fault */
1360 ASSERT(OldIrql == KeGetCurrentIrql());
1361 ASSERT(OldIrql <= APC_LEVEL);
1362 ASSERT(KeAreAllApcsDisabled() == TRUE);
1363 return STATUS_PAGE_FAULT_TRANSITION;
1364 }
1365
1366 /* We did not -- PFN lock is still held, prepare to resolve prototype PTE fault */
1367 OutPfn = MI_PFN_ELEMENT(SuperProtoPte->u.Hard.PageFrameNumber);
1368 MiReferenceUsedPageAndBumpLockCount(OutPfn);
1369 ASSERT(OutPfn->u3.e2.ReferenceCount > 1);
1370 ASSERT(PointerPte->u.Hard.Valid == 0);
1371
1372 /* Resolve the fault -- this will release the PFN lock */
1373 Status = MiResolveProtoPteFault(StoreInstruction,
1374 Address,
1375 PointerPte,
1376 PointerProtoPte,
1377 &OutPfn,
1378 NULL,
1379 NULL,
1380 Process,
1381 LockIrql,
1382 TrapInformation);
1383 //ASSERT(Status != STATUS_ISSUE_PAGING_IO);
1384 //ASSERT(Status != STATUS_REFAULT);
1385 //ASSERT(Status != STATUS_PTE_CHANGED);
1386
1387 /* Did the routine clean out the PFN or should we? */
1388 if (OutPfn)
1389 {
1390 /* We had a locked PFN, so acquire the PFN lock to dereference it */
1391 ASSERT(PointerProtoPte != NULL);
1392 OldIrql = KeAcquireQueuedSpinLock(LockQueuePfnLock);
1393
1394 /* Dereference the locked PFN */
1395 MiDereferencePfnAndDropLockCount(OutPfn);
1396 ASSERT(OutPfn->u3.e2.ReferenceCount >= 1);
1397
1398 /* And now release the lock */
1399 KeReleaseQueuedSpinLock(LockQueuePfnLock, OldIrql);
1400 }
1401
1402 /* Complete this as a transition fault */
1403 ASSERT(OldIrql == KeGetCurrentIrql());
1404 ASSERT(OldIrql <= APC_LEVEL);
1405 ASSERT(KeAreAllApcsDisabled() == TRUE);
1406 return Status;
1407 }
1408 }
1409
1410 /* Is this a transition PTE */
1411 if (TempPte.u.Soft.Transition)
1412 {
1413 PVOID InPageBlock = NULL;
1414 /* Lock the PFN database */
1415 LockIrql = KeAcquireQueuedSpinLock(LockQueuePfnLock);
1416
1417 /* Resolve */
1418 Status = MiResolveTransitionFault(Address, PointerPte, Process, LockIrql, &InPageBlock);
1419
1420 NT_ASSERT(NT_SUCCESS(Status));
1421
1422 /* And now release the lock and leave*/
1423 KeReleaseQueuedSpinLock(LockQueuePfnLock, LockIrql);
1424
1425 if (InPageBlock != NULL)
1426 {
1427 /* The page is being paged in by another process */
1428 KeWaitForSingleObject(InPageBlock, WrPageIn, KernelMode, FALSE, NULL);
1429 }
1430
1431 ASSERT(OldIrql == KeGetCurrentIrql());
1432 ASSERT(OldIrql <= APC_LEVEL);
1433 ASSERT(KeAreAllApcsDisabled() == TRUE);
1434 return Status;
1435 }
1436
1437 /* Should we page the data back in ? */
1438 if (TempPte.u.Soft.PageFileHigh != 0)
1439 {
1440 /* Lock the PFN database */
1441 LockIrql = KeAcquireQueuedSpinLock(LockQueuePfnLock);
1442
1443 /* Resolve */
1444 Status = MiResolvePageFileFault(StoreInstruction, Address, PointerPte, Process, &LockIrql);
1445
1446 /* And now release the lock and leave*/
1447 KeReleaseQueuedSpinLock(LockQueuePfnLock, LockIrql);
1448
1449 ASSERT(OldIrql == KeGetCurrentIrql());
1450 ASSERT(OldIrql <= APC_LEVEL);
1451 ASSERT(KeAreAllApcsDisabled() == TRUE);
1452 return Status;
1453 }
1454
1455 //
1456 // The PTE must be invalid but not completely empty. It must also not be a
1457 // prototype a transition or a paged-out PTE as those scenarii should've been handled above.
1458 // These are all Windows checks
1459 //
1460 ASSERT(TempPte.u.Hard.Valid == 0);
1461 ASSERT(TempPte.u.Soft.Prototype == 0);
1462 ASSERT(TempPte.u.Soft.Transition == 0);
1463 ASSERT(TempPte.u.Soft.PageFileHigh == 0);
1464 ASSERT(TempPte.u.Long != 0);
1465
1466 //
1467 // If we got this far, the PTE can only be a demand zero PTE, which is what
1468 // we want. Go handle it!
1469 //
1470 Status = MiResolveDemandZeroFault(Address,
1471 PointerPte,
1472 Process,
1473 MM_NOIRQL);
1474 ASSERT(KeAreAllApcsDisabled() == TRUE);
1475 if (NT_SUCCESS(Status))
1476 {
1477 //
1478 // Make sure we're returning in a sane state and pass the status down
1479 //
1480 ASSERT(OldIrql == KeGetCurrentIrql());
1481 ASSERT(KeGetCurrentIrql() <= APC_LEVEL);
1482 return Status;
1483 }
1484
1485 //
1486 // Generate an access fault
1487 //
1488 return STATUS_ACCESS_VIOLATION;
1489 }
1490
1491 NTSTATUS
1492 NTAPI
1493 MmArmAccessFault(IN BOOLEAN StoreInstruction,
1494 IN PVOID Address,
1495 IN KPROCESSOR_MODE Mode,
1496 IN PVOID TrapInformation)
1497 {
1498 KIRQL OldIrql = KeGetCurrentIrql(), LockIrql;
1499 PMMPTE ProtoPte = NULL;
1500 PMMPTE PointerPte = MiAddressToPte(Address);
1501 PMMPDE PointerPde = MiAddressToPde(Address);
1502 #if (_MI_PAGING_LEVELS >= 3)
1503 PMMPDE PointerPpe = MiAddressToPpe(Address);
1504 #if (_MI_PAGING_LEVELS == 4)
1505 PMMPDE PointerPxe = MiAddressToPxe(Address);
1506 #endif
1507 #endif
1508 MMPTE TempPte;
1509 PETHREAD CurrentThread;
1510 PEPROCESS CurrentProcess;
1511 NTSTATUS Status;
1512 PMMSUPPORT WorkingSet;
1513 ULONG ProtectionCode;
1514 PMMVAD Vad;
1515 PFN_NUMBER PageFrameIndex;
1516 ULONG Color;
1517 BOOLEAN IsSessionAddress;
1518 PMMPFN Pfn1;
1519 DPRINT("ARM3 FAULT AT: %p\n", Address);
1520
1521 /* Check for page fault on high IRQL */
1522 if (OldIrql > APC_LEVEL)
1523 {
1524 #if (_MI_PAGING_LEVELS < 3)
1525 /* Could be a page table for paged pool, which we'll allow */
1526 if (MI_IS_SYSTEM_PAGE_TABLE_ADDRESS(Address)) MiSynchronizeSystemPde((PMMPDE)PointerPte);
1527 MiCheckPdeForPagedPool(Address);
1528 #endif
1529 /* Check if any of the top-level pages are invalid */
1530 if (
1531 #if (_MI_PAGING_LEVELS == 4)
1532 (PointerPxe->u.Hard.Valid == 0) ||
1533 #endif
1534 #if (_MI_PAGING_LEVELS >= 3)
1535 (PointerPpe->u.Hard.Valid == 0) ||
1536 #endif
1537 (PointerPde->u.Hard.Valid == 0) ||
1538 (PointerPte->u.Hard.Valid == 0))
1539 {
1540 /* This fault is not valid, print out some debugging help */
1541 DbgPrint("MM:***PAGE FAULT AT IRQL > 1 Va %p, IRQL %lx\n",
1542 Address,
1543 OldIrql);
1544 if (TrapInformation)
1545 {
1546 PKTRAP_FRAME TrapFrame = TrapInformation;
1547 #ifdef _M_IX86
1548 DbgPrint("MM:***EIP %p, EFL %p\n", TrapFrame->Eip, TrapFrame->EFlags);
1549 DbgPrint("MM:***EAX %p, ECX %p EDX %p\n", TrapFrame->Eax, TrapFrame->Ecx, TrapFrame->Edx);
1550 DbgPrint("MM:***EBX %p, ESI %p EDI %p\n", TrapFrame->Ebx, TrapFrame->Esi, TrapFrame->Edi);
1551 #elif defined(_M_AMD64)
1552 DbgPrint("MM:***RIP %p, EFL %p\n", TrapFrame->Rip, TrapFrame->EFlags);
1553 DbgPrint("MM:***RAX %p, RCX %p RDX %p\n", TrapFrame->Rax, TrapFrame->Rcx, TrapFrame->Rdx);
1554 DbgPrint("MM:***RBX %p, RSI %p RDI %p\n", TrapFrame->Rbx, TrapFrame->Rsi, TrapFrame->Rdi);
1555 #endif
1556 }
1557
1558 /* Tell the trap handler to fail */
1559 return STATUS_IN_PAGE_ERROR | 0x10000000;
1560 }
1561
1562 /* Not yet implemented in ReactOS */
1563 ASSERT(MI_IS_PAGE_LARGE(PointerPde) == FALSE);
1564 ASSERT(((StoreInstruction) && (PointerPte->u.Hard.CopyOnWrite)) == FALSE);
1565
1566 /* Check if this was a write */
1567 if (StoreInstruction)
1568 {
1569 /* Was it to a read-only page? */
1570 Pfn1 = MI_PFN_ELEMENT(PointerPte->u.Hard.PageFrameNumber);
1571 if (!(PointerPte->u.Long & PTE_READWRITE) &&
1572 !(Pfn1->OriginalPte.u.Soft.Protection & MM_READWRITE))
1573 {
1574 /* Crash with distinguished bugcheck code */
1575 KeBugCheckEx(ATTEMPTED_WRITE_TO_READONLY_MEMORY,
1576 (ULONG_PTR)Address,
1577 PointerPte->u.Long,
1578 (ULONG_PTR)TrapInformation,
1579 10);
1580 }
1581 }
1582
1583 /* Nothing is actually wrong */
1584 DPRINT1("Fault at IRQL %u is ok (%p)\n", OldIrql, Address);
1585 return STATUS_SUCCESS;
1586 }
1587
1588 /* Check for kernel fault address */
1589 if (Address >= MmSystemRangeStart)
1590 {
1591 /* Bail out, if the fault came from user mode */
1592 if (Mode == UserMode) return STATUS_ACCESS_VIOLATION;
1593
1594 #if (_MI_PAGING_LEVELS == 2)
1595 if (MI_IS_SYSTEM_PAGE_TABLE_ADDRESS(Address)) MiSynchronizeSystemPde((PMMPDE)PointerPte);
1596 MiCheckPdeForPagedPool(Address);
1597 #endif
1598
1599 /* Check if the higher page table entries are invalid */
1600 if (
1601 #if (_MI_PAGING_LEVELS == 4)
1602 /* AMD64 system, check if PXE is invalid */
1603 (PointerPxe->u.Hard.Valid == 0) ||
1604 #endif
1605 #if (_MI_PAGING_LEVELS >= 3)
1606 /* PAE/AMD64 system, check if PPE is invalid */
1607 (PointerPpe->u.Hard.Valid == 0) ||
1608 #endif
1609 /* Always check if the PDE is valid */
1610 (PointerPde->u.Hard.Valid == 0))
1611 {
1612 /* PXE/PPE/PDE (still) not valid, kill the system */
1613 KeBugCheckEx(PAGE_FAULT_IN_NONPAGED_AREA,
1614 (ULONG_PTR)Address,
1615 StoreInstruction,
1616 (ULONG_PTR)TrapInformation,
1617 2);
1618 }
1619
1620 /* Not handling session faults yet */
1621 IsSessionAddress = MI_IS_SESSION_ADDRESS(Address);
1622
1623 /* The PDE is valid, so read the PTE */
1624 TempPte = *PointerPte;
1625 if (TempPte.u.Hard.Valid == 1)
1626 {
1627 /* Check if this was system space or session space */
1628 if (!IsSessionAddress)
1629 {
1630 /* Check if the PTE is still valid under PFN lock */
1631 OldIrql = KeAcquireQueuedSpinLock(LockQueuePfnLock);
1632 TempPte = *PointerPte;
1633 if (TempPte.u.Hard.Valid)
1634 {
1635 /* Check if this was a write */
1636 if (StoreInstruction)
1637 {
1638 /* Was it to a read-only page? */
1639 Pfn1 = MI_PFN_ELEMENT(PointerPte->u.Hard.PageFrameNumber);
1640 if (!(PointerPte->u.Long & PTE_READWRITE) &&
1641 !(Pfn1->OriginalPte.u.Soft.Protection & MM_READWRITE))
1642 {
1643 /* Crash with distinguished bugcheck code */
1644 KeBugCheckEx(ATTEMPTED_WRITE_TO_READONLY_MEMORY,
1645 (ULONG_PTR)Address,
1646 PointerPte->u.Long,
1647 (ULONG_PTR)TrapInformation,
1648 11);
1649 }
1650 }
1651 }
1652
1653 /* Release PFN lock and return all good */
1654 KeReleaseQueuedSpinLock(LockQueuePfnLock, OldIrql);
1655 return STATUS_SUCCESS;
1656 }
1657 }
1658 #if (_MI_PAGING_LEVELS == 2)
1659 /* Check if this was a session PTE that needs to remap the session PDE */
1660 if (MI_IS_SESSION_PTE(Address))
1661 {
1662 /* Do the remapping */
1663 Status = MiCheckPdeForSessionSpace(Address);
1664 if (!NT_SUCCESS(Status))
1665 {
1666 /* It failed, this address is invalid */
1667 KeBugCheckEx(PAGE_FAULT_IN_NONPAGED_AREA,
1668 (ULONG_PTR)Address,
1669 StoreInstruction,
1670 (ULONG_PTR)TrapInformation,
1671 6);
1672 }
1673 }
1674 #else
1675
1676 _WARN("Session space stuff is not implemented yet!")
1677
1678 #endif
1679
1680 /* Check for a fault on the page table or hyperspace */
1681 if (MI_IS_PAGE_TABLE_OR_HYPER_ADDRESS(Address))
1682 {
1683 #if (_MI_PAGING_LEVELS < 3)
1684 /* Windows does this check but I don't understand why -- it's done above! */
1685 ASSERT(MiCheckPdeForPagedPool(Address) != STATUS_WAIT_1);
1686 #endif
1687 /* Handle this as a user mode fault */
1688 goto UserFault;
1689 }
1690
1691 /* Get the current thread */
1692 CurrentThread = PsGetCurrentThread();
1693
1694 /* What kind of address is this */
1695 if (!IsSessionAddress)
1696 {
1697 /* Use the system working set */
1698 WorkingSet = &MmSystemCacheWs;
1699 CurrentProcess = NULL;
1700
1701 /* Make sure we don't have a recursive working set lock */
1702 if ((CurrentThread->OwnsProcessWorkingSetExclusive) ||
1703 (CurrentThread->OwnsProcessWorkingSetShared) ||
1704 (CurrentThread->OwnsSystemWorkingSetExclusive) ||
1705 (CurrentThread->OwnsSystemWorkingSetShared) ||
1706 (CurrentThread->OwnsSessionWorkingSetExclusive) ||
1707 (CurrentThread->OwnsSessionWorkingSetShared))
1708 {
1709 /* Fail */
1710 return STATUS_IN_PAGE_ERROR | 0x10000000;
1711 }
1712 }
1713 else
1714 {
1715 /* Use the session process and working set */
1716 CurrentProcess = HYDRA_PROCESS;
1717 WorkingSet = &MmSessionSpace->GlobalVirtualAddress->Vm;
1718
1719 /* Make sure we don't have a recursive working set lock */
1720 if ((CurrentThread->OwnsSessionWorkingSetExclusive) ||
1721 (CurrentThread->OwnsSessionWorkingSetShared))
1722 {
1723 /* Fail */
1724 return STATUS_IN_PAGE_ERROR | 0x10000000;
1725 }
1726 }
1727
1728 /* Acquire the working set lock */
1729 KeRaiseIrql(APC_LEVEL, &LockIrql);
1730 MiLockWorkingSet(CurrentThread, WorkingSet);
1731
1732 /* Re-read PTE now that we own the lock */
1733 TempPte = *PointerPte;
1734 if (TempPte.u.Hard.Valid == 1)
1735 {
1736 /* Check if this was a write */
1737 if (StoreInstruction)
1738 {
1739 /* Was it to a read-only page that is not copy on write? */
1740 Pfn1 = MI_PFN_ELEMENT(PointerPte->u.Hard.PageFrameNumber);
1741 if (!(TempPte.u.Long & PTE_READWRITE) &&
1742 !(Pfn1->OriginalPte.u.Soft.Protection & MM_READWRITE) &&
1743 !(TempPte.u.Hard.CopyOnWrite))
1744 {
1745 /* Case not yet handled */
1746 ASSERT(!IsSessionAddress);
1747
1748 /* Crash with distinguished bugcheck code */
1749 KeBugCheckEx(ATTEMPTED_WRITE_TO_READONLY_MEMORY,
1750 (ULONG_PTR)Address,
1751 TempPte.u.Long,
1752 (ULONG_PTR)TrapInformation,
1753 12);
1754 }
1755 }
1756
1757 /* Check for read-only write in session space */
1758 if ((IsSessionAddress) &&
1759 (StoreInstruction) &&
1760 !(TempPte.u.Hard.Write))
1761 {
1762 /* Sanity check */
1763 ASSERT(MI_IS_SESSION_IMAGE_ADDRESS(Address));
1764
1765 /* Was this COW? */
1766 if (TempPte.u.Hard.CopyOnWrite == 0)
1767 {
1768 /* Then this is not allowed */
1769 KeBugCheckEx(ATTEMPTED_WRITE_TO_READONLY_MEMORY,
1770 (ULONG_PTR)Address,
1771 (ULONG_PTR)TempPte.u.Long,
1772 (ULONG_PTR)TrapInformation,
1773 13);
1774 }
1775
1776 /* Otherwise, handle COW */
1777 ASSERT(FALSE);
1778 }
1779
1780 /* Release the working set */
1781 MiUnlockWorkingSet(CurrentThread, WorkingSet);
1782 KeLowerIrql(LockIrql);
1783
1784 /* Otherwise, the PDE was probably invalid, and all is good now */
1785 return STATUS_SUCCESS;
1786 }
1787
1788 /* Check one kind of prototype PTE */
1789 if (TempPte.u.Soft.Prototype)
1790 {
1791 /* Make sure protected pool is on, and that this is a pool address */
1792 if ((MmProtectFreedNonPagedPool) &&
1793 (((Address >= MmNonPagedPoolStart) &&
1794 (Address < (PVOID)((ULONG_PTR)MmNonPagedPoolStart +
1795 MmSizeOfNonPagedPoolInBytes))) ||
1796 ((Address >= MmNonPagedPoolExpansionStart) &&
1797 (Address < MmNonPagedPoolEnd))))
1798 {
1799 /* Bad boy, bad boy, whatcha gonna do, whatcha gonna do when ARM3 comes for you! */
1800 KeBugCheckEx(DRIVER_CAUGHT_MODIFYING_FREED_POOL,
1801 (ULONG_PTR)Address,
1802 StoreInstruction,
1803 Mode,
1804 4);
1805 }
1806
1807 /* Get the prototype PTE! */
1808 ProtoPte = MiProtoPteToPte(&TempPte);
1809
1810 /* Do we need to locate the prototype PTE in session space? */
1811 if ((IsSessionAddress) &&
1812 (TempPte.u.Soft.PageFileHigh == MI_PTE_LOOKUP_NEEDED))
1813 {
1814 /* Yep, go find it as well as the VAD for it */
1815 ProtoPte = MiCheckVirtualAddress(Address,
1816 &ProtectionCode,
1817 &Vad);
1818 ASSERT(ProtoPte != NULL);
1819 }
1820 }
1821 else
1822 {
1823 /* We don't implement transition PTEs */
1824 ASSERT(TempPte.u.Soft.Transition == 0);
1825
1826 /* Check for no-access PTE */
1827 if (TempPte.u.Soft.Protection == MM_NOACCESS)
1828 {
1829 /* Bugcheck the system! */
1830 KeBugCheckEx(PAGE_FAULT_IN_NONPAGED_AREA,
1831 (ULONG_PTR)Address,
1832 StoreInstruction,
1833 (ULONG_PTR)TrapInformation,
1834 1);
1835 }
1836 }
1837
1838 /* Check for demand page */
1839 if ((StoreInstruction) &&
1840 !(ProtoPte) &&
1841 !(IsSessionAddress) &&
1842 !(TempPte.u.Hard.Valid))
1843 {
1844 /* Get the protection code */
1845 ASSERT(TempPte.u.Soft.Transition == 0);
1846 if (!(TempPte.u.Soft.Protection & MM_READWRITE))
1847 {
1848 /* Bugcheck the system! */
1849 KeBugCheckEx(ATTEMPTED_WRITE_TO_READONLY_MEMORY,
1850 (ULONG_PTR)Address,
1851 TempPte.u.Long,
1852 (ULONG_PTR)TrapInformation,
1853 14);
1854 }
1855 }
1856
1857 /* Now do the real fault handling */
1858 Status = MiDispatchFault(StoreInstruction,
1859 Address,
1860 PointerPte,
1861 ProtoPte,
1862 FALSE,
1863 CurrentProcess,
1864 TrapInformation,
1865 NULL);
1866
1867 /* Release the working set */
1868 ASSERT(KeAreAllApcsDisabled() == TRUE);
1869 MiUnlockWorkingSet(CurrentThread, WorkingSet);
1870 KeLowerIrql(LockIrql);
1871
1872 /* We are done! */
1873 DPRINT("Fault resolved with status: %lx\n", Status);
1874 return Status;
1875 }
1876
1877 /* This is a user fault */
1878 UserFault:
1879 CurrentThread = PsGetCurrentThread();
1880 CurrentProcess = (PEPROCESS)CurrentThread->Tcb.ApcState.Process;
1881
1882 /* Lock the working set */
1883 MiLockProcessWorkingSet(CurrentProcess, CurrentThread);
1884
1885 #if (_MI_PAGING_LEVELS == 4)
1886 // Note to Timo: You should call MiCheckVirtualAddress and also check if it's zero pte
1887 // also this is missing the page count increment
1888 /* Check if the PXE is valid */
1889 if (PointerPxe->u.Hard.Valid == 0)
1890 {
1891 /* Right now, we only handle scenarios where the PXE is totally empty */
1892 ASSERT(PointerPxe->u.Long == 0);
1893 #if 0
1894 /* Resolve a demand zero fault */
1895 Status = MiResolveDemandZeroFault(PointerPpe,
1896 MM_READWRITE,
1897 CurrentProcess,
1898 MM_NOIRQL);
1899 #endif
1900 /* We should come back with a valid PXE */
1901 ASSERT(PointerPxe->u.Hard.Valid == 1);
1902 }
1903 #endif
1904
1905 #if (_MI_PAGING_LEVELS >= 3)
1906 // Note to Timo: You should call MiCheckVirtualAddress and also check if it's zero pte
1907 // also this is missing the page count increment
1908 /* Check if the PPE is valid */
1909 if (PointerPpe->u.Hard.Valid == 0)
1910 {
1911 /* Right now, we only handle scenarios where the PPE is totally empty */
1912 ASSERT(PointerPpe->u.Long == 0);
1913 #if 0
1914 /* Resolve a demand zero fault */
1915 Status = MiResolveDemandZeroFault(PointerPde,
1916 MM_READWRITE,
1917 CurrentProcess,
1918 MM_NOIRQL);
1919 #endif
1920 /* We should come back with a valid PPE */
1921 ASSERT(PointerPpe->u.Hard.Valid == 1);
1922 }
1923 #endif
1924
1925 /* Check if the PDE is valid */
1926 if (PointerPde->u.Hard.Valid == 0)
1927 {
1928 /* Right now, we only handle scenarios where the PDE is totally empty */
1929 ASSERT(PointerPde->u.Long == 0);
1930
1931 /* And go dispatch the fault on the PDE. This should handle the demand-zero */
1932 #if MI_TRACE_PFNS
1933 UserPdeFault = TRUE;
1934 #endif
1935 MiCheckVirtualAddress(Address, &ProtectionCode, &Vad);
1936 if (ProtectionCode == MM_NOACCESS)
1937 {
1938 #if (_MI_PAGING_LEVELS == 2)
1939 /* Could be a page table for paged pool */
1940 MiCheckPdeForPagedPool(Address);
1941 #endif
1942 /* Has the code above changed anything -- is this now a valid PTE? */
1943 Status = (PointerPde->u.Hard.Valid == 1) ? STATUS_SUCCESS : STATUS_ACCESS_VIOLATION;
1944
1945 /* Either this was a bogus VA or we've fixed up a paged pool PDE */
1946 MiUnlockProcessWorkingSet(CurrentProcess, CurrentThread);
1947 return Status;
1948 }
1949
1950 /* Write a demand-zero PDE */
1951 MI_WRITE_INVALID_PTE(PointerPde, DemandZeroPde);
1952
1953 /* Dispatch the fault */
1954 Status = MiDispatchFault(TRUE,
1955 PointerPte,
1956 PointerPde,
1957 NULL,
1958 FALSE,
1959 PsGetCurrentProcess(),
1960 TrapInformation,
1961 NULL);
1962 #if MI_TRACE_PFNS
1963 UserPdeFault = FALSE;
1964 #endif
1965 /* We should come back with APCs enabled, and with a valid PDE */
1966 ASSERT(KeAreAllApcsDisabled() == TRUE);
1967 ASSERT(PointerPde->u.Hard.Valid == 1);
1968 }
1969 else
1970 {
1971 /* Not yet implemented in ReactOS */
1972 ASSERT(MI_IS_PAGE_LARGE(PointerPde) == FALSE);
1973 }
1974
1975 /* Now capture the PTE. */
1976 TempPte = *PointerPte;
1977
1978 /* Check if the PTE is valid */
1979 if (TempPte.u.Hard.Valid)
1980 {
1981 /* Check if this is a write on a readonly PTE */
1982 if (StoreInstruction)
1983 {
1984 /* Is this a copy on write PTE? */
1985 if (TempPte.u.Hard.CopyOnWrite)
1986 {
1987 /* Not supported yet */
1988 ASSERT(FALSE);
1989 }
1990
1991 /* Is this a read-only PTE? */
1992 if (!TempPte.u.Hard.Write)
1993 {
1994 /* Return the status */
1995 MiUnlockProcessWorkingSet(CurrentProcess, CurrentThread);
1996 return STATUS_ACCESS_VIOLATION;
1997 }
1998 }
1999
2000 /* FIXME: Execution is ignored for now, since we don't have no-execute pages yet */
2001
2002 /* The fault has already been resolved by a different thread */
2003 MiUnlockProcessWorkingSet(CurrentProcess, CurrentThread);
2004 return STATUS_SUCCESS;
2005 }
2006
2007 /* Quick check for demand-zero */
2008 if (TempPte.u.Long == (MM_READWRITE << MM_PTE_SOFTWARE_PROTECTION_BITS))
2009 {
2010 /* Resolve the fault */
2011 MiResolveDemandZeroFault(Address,
2012 PointerPte,
2013 CurrentProcess,
2014 MM_NOIRQL);
2015
2016 /* Return the status */
2017 MiUnlockProcessWorkingSet(CurrentProcess, CurrentThread);
2018 return STATUS_PAGE_FAULT_DEMAND_ZERO;
2019 }
2020
2021 /* Check for zero PTE */
2022 if (TempPte.u.Long == 0)
2023 {
2024 /* Check if this address range belongs to a valid allocation (VAD) */
2025 ProtoPte = MiCheckVirtualAddress(Address, &ProtectionCode, &Vad);
2026 if (ProtectionCode == MM_NOACCESS)
2027 {
2028 #if (_MI_PAGING_LEVELS == 2)
2029 /* Could be a page table for paged pool */
2030 MiCheckPdeForPagedPool(Address);
2031 #endif
2032 /* Has the code above changed anything -- is this now a valid PTE? */
2033 Status = (PointerPte->u.Hard.Valid == 1) ? STATUS_SUCCESS : STATUS_ACCESS_VIOLATION;
2034
2035 /* Either this was a bogus VA or we've fixed up a paged pool PDE */
2036 MiUnlockProcessWorkingSet(CurrentProcess, CurrentThread);
2037 return Status;
2038 }
2039
2040 /*
2041 * Check if this is a real user-mode address or actually a kernel-mode
2042 * page table for a user mode address
2043 */
2044 if (Address <= MM_HIGHEST_USER_ADDRESS)
2045 {
2046 /* Add an additional page table reference */
2047 MiIncrementPageTableReferences(Address);
2048 }
2049
2050 /* Is this a guard page? */
2051 if ((ProtectionCode & MM_PROTECT_SPECIAL) == MM_GUARDPAGE)
2052 {
2053 /* The VAD protection cannot be MM_DECOMMIT! */
2054 NT_ASSERT(ProtectionCode != MM_DECOMMIT);
2055
2056 /* Remove the bit */
2057 TempPte.u.Soft.Protection = ProtectionCode & ~MM_GUARDPAGE;
2058 MI_WRITE_INVALID_PTE(PointerPte, TempPte);
2059
2060 /* Not supported */
2061 ASSERT(ProtoPte == NULL);
2062 ASSERT(CurrentThread->ApcNeeded == 0);
2063
2064 /* Drop the working set lock */
2065 MiUnlockProcessWorkingSet(CurrentProcess, CurrentThread);
2066 ASSERT(KeGetCurrentIrql() == OldIrql);
2067
2068 /* Handle stack expansion */
2069 return MiCheckForUserStackOverflow(Address, TrapInformation);
2070 }
2071
2072 /* Did we get a prototype PTE back? */
2073 if (!ProtoPte)
2074 {
2075 /* Is this PTE actually part of the PDE-PTE self-mapping directory? */
2076 if (PointerPde == MiAddressToPde(PTE_BASE))
2077 {
2078 /* Then it's really a demand-zero PDE (on behalf of user-mode) */
2079 MI_WRITE_INVALID_PTE(PointerPte, DemandZeroPde);
2080 }
2081 else
2082 {
2083 /* No, create a new PTE. First, write the protection */
2084 TempPte.u.Soft.Protection = ProtectionCode;
2085 MI_WRITE_INVALID_PTE(PointerPte, TempPte);
2086 }
2087
2088 /* Lock the PFN database since we're going to grab a page */
2089 OldIrql = KeAcquireQueuedSpinLock(LockQueuePfnLock);
2090
2091 /* Make sure we have enough pages */
2092 ASSERT(MmAvailablePages >= 32);
2093
2094 /* Try to get a zero page */
2095 MI_SET_USAGE(MI_USAGE_PEB_TEB);
2096 MI_SET_PROCESS2(CurrentProcess->ImageFileName);
2097 Color = MI_GET_NEXT_PROCESS_COLOR(CurrentProcess);
2098 PageFrameIndex = MiRemoveZeroPageSafe(Color);
2099 if (!PageFrameIndex)
2100 {
2101 /* Grab a page out of there. Later we should grab a colored zero page */
2102 PageFrameIndex = MiRemoveAnyPage(Color);
2103 ASSERT(PageFrameIndex);
2104
2105 /* Release the lock since we need to do some zeroing */
2106 KeReleaseQueuedSpinLock(LockQueuePfnLock, OldIrql);
2107
2108 /* Zero out the page, since it's for user-mode */
2109 MiZeroPfn(PageFrameIndex);
2110
2111 /* Grab the lock again so we can initialize the PFN entry */
2112 OldIrql = KeAcquireQueuedSpinLock(LockQueuePfnLock);
2113 }
2114
2115 /* Initialize the PFN entry now */
2116 MiInitializePfn(PageFrameIndex, PointerPte, 1);
2117
2118 /* And we're done with the lock */
2119 KeReleaseQueuedSpinLock(LockQueuePfnLock, OldIrql);
2120
2121 /* Increment the count of pages in the process */
2122 CurrentProcess->NumberOfPrivatePages++;
2123
2124 /* One more demand-zero fault */
2125 InterlockedIncrement(&KeGetCurrentPrcb()->MmDemandZeroCount);
2126
2127 /* Fault on user PDE, or fault on user PTE? */
2128 if (PointerPte <= MiHighestUserPte)
2129 {
2130 /* User fault, build a user PTE */
2131 MI_MAKE_HARDWARE_PTE_USER(&TempPte,
2132 PointerPte,
2133 PointerPte->u.Soft.Protection,
2134 PageFrameIndex);
2135 }
2136 else
2137 {
2138 /* This is a user-mode PDE, create a kernel PTE for it */
2139 MI_MAKE_HARDWARE_PTE(&TempPte,
2140 PointerPte,
2141 PointerPte->u.Soft.Protection,
2142 PageFrameIndex);
2143 }
2144
2145 /* Write the dirty bit for writeable pages */
2146 if (MI_IS_PAGE_WRITEABLE(&TempPte)) MI_MAKE_DIRTY_PAGE(&TempPte);
2147
2148 /* And now write down the PTE, making the address valid */
2149 MI_WRITE_VALID_PTE(PointerPte, TempPte);
2150 Pfn1 = MI_PFN_ELEMENT(PageFrameIndex);
2151 ASSERT(Pfn1->u1.Event == NULL);
2152
2153 /* Demand zero */
2154 ASSERT(KeGetCurrentIrql() <= APC_LEVEL);
2155 MiUnlockProcessWorkingSet(CurrentProcess, CurrentThread);
2156 return STATUS_PAGE_FAULT_DEMAND_ZERO;
2157 }
2158
2159 /* We should have a valid protection here */
2160 ASSERT(ProtectionCode != 0x100);
2161
2162 /* Write the prototype PTE */
2163 TempPte = PrototypePte;
2164 TempPte.u.Soft.Protection = ProtectionCode;
2165 NT_ASSERT(TempPte.u.Long != 0);
2166 MI_WRITE_INVALID_PTE(PointerPte, TempPte);
2167 }
2168 else
2169 {
2170 /* Get the protection code and check if this is a proto PTE */
2171 ProtectionCode = (ULONG)TempPte.u.Soft.Protection;
2172 if (TempPte.u.Soft.Prototype)
2173 {
2174 /* Do we need to go find the real PTE? */
2175 if (TempPte.u.Soft.PageFileHigh == MI_PTE_LOOKUP_NEEDED)
2176 {
2177 /* Get the prototype pte and VAD for it */
2178 ProtoPte = MiCheckVirtualAddress(Address,
2179 &ProtectionCode,
2180 &Vad);
2181 if (!ProtoPte)
2182 {
2183 ASSERT(KeGetCurrentIrql() <= APC_LEVEL);
2184 MiUnlockProcessWorkingSet(CurrentProcess, CurrentThread);
2185 return STATUS_ACCESS_VIOLATION;
2186 }
2187 }
2188 else
2189 {
2190 /* Get the prototype PTE! */
2191 ProtoPte = MiProtoPteToPte(&TempPte);
2192
2193 /* Is it read-only */
2194 if (TempPte.u.Proto.ReadOnly)
2195 {
2196 /* Set read-only code */
2197 ProtectionCode = MM_READONLY;
2198 }
2199 else
2200 {
2201 /* Set unknown protection */
2202 ProtectionCode = 0x100;
2203 ASSERT(CurrentProcess->CloneRoot != NULL);
2204 }
2205 }
2206 }
2207 }
2208
2209 /* Do we have a valid protection code? */
2210 if (ProtectionCode != 0x100)
2211 {
2212 /* Run a software access check first, including to detect guard pages */
2213 Status = MiAccessCheck(PointerPte,
2214 StoreInstruction,
2215 Mode,
2216 ProtectionCode,
2217 TrapInformation,
2218 FALSE);
2219 if (Status != STATUS_SUCCESS)
2220 {
2221 /* Not supported */
2222 ASSERT(CurrentThread->ApcNeeded == 0);
2223
2224 /* Drop the working set lock */
2225 MiUnlockProcessWorkingSet(CurrentProcess, CurrentThread);
2226 ASSERT(KeGetCurrentIrql() == OldIrql);
2227
2228 /* Did we hit a guard page? */
2229 if (Status == STATUS_GUARD_PAGE_VIOLATION)
2230 {
2231 /* Handle stack expansion */
2232 return MiCheckForUserStackOverflow(Address, TrapInformation);
2233 }
2234
2235 /* Otherwise, fail back to the caller directly */
2236 return Status;
2237 }
2238 }
2239
2240 /* Dispatch the fault */
2241 Status = MiDispatchFault(StoreInstruction,
2242 Address,
2243 PointerPte,
2244 ProtoPte,
2245 FALSE,
2246 CurrentProcess,
2247 TrapInformation,
2248 Vad);
2249
2250 /* Return the status */
2251 ASSERT(KeGetCurrentIrql() <= APC_LEVEL);
2252 MiUnlockProcessWorkingSet(CurrentProcess, CurrentThread);
2253 return Status;
2254 }
2255
2256 NTSTATUS
2257 NTAPI
2258 MmGetExecuteOptions(IN PULONG ExecuteOptions)
2259 {
2260 PKPROCESS CurrentProcess = &PsGetCurrentProcess()->Pcb;
2261 ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL);
2262
2263 *ExecuteOptions = 0;
2264
2265 if (CurrentProcess->Flags.ExecuteDisable)
2266 {
2267 *ExecuteOptions |= MEM_EXECUTE_OPTION_DISABLE;
2268 }
2269
2270 if (CurrentProcess->Flags.ExecuteEnable)
2271 {
2272 *ExecuteOptions |= MEM_EXECUTE_OPTION_ENABLE;
2273 }
2274
2275 if (CurrentProcess->Flags.DisableThunkEmulation)
2276 {
2277 *ExecuteOptions |= MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION;
2278 }
2279
2280 if (CurrentProcess->Flags.Permanent)
2281 {
2282 *ExecuteOptions |= MEM_EXECUTE_OPTION_PERMANENT;
2283 }
2284
2285 if (CurrentProcess->Flags.ExecuteDispatchEnable)
2286 {
2287 *ExecuteOptions |= MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE;
2288 }
2289
2290 if (CurrentProcess->Flags.ImageDispatchEnable)
2291 {
2292 *ExecuteOptions |= MEM_EXECUTE_OPTION_IMAGE_DISPATCH_ENABLE;
2293 }
2294
2295 return STATUS_SUCCESS;
2296 }
2297
2298 NTSTATUS
2299 NTAPI
2300 MmSetExecuteOptions(IN ULONG ExecuteOptions)
2301 {
2302 PKPROCESS CurrentProcess = &PsGetCurrentProcess()->Pcb;
2303 KLOCK_QUEUE_HANDLE ProcessLock;
2304 NTSTATUS Status = STATUS_ACCESS_DENIED;
2305 ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL);
2306
2307 /* Only accept valid flags */
2308 if (ExecuteOptions & ~MEM_EXECUTE_OPTION_VALID_FLAGS)
2309 {
2310 /* Fail */
2311 DPRINT1("Invalid no-execute options\n");
2312 return STATUS_INVALID_PARAMETER;
2313 }
2314
2315 /* Change the NX state in the process lock */
2316 KiAcquireProcessLock(CurrentProcess, &ProcessLock);
2317
2318 /* Don't change anything if the permanent flag was set */
2319 if (!CurrentProcess->Flags.Permanent)
2320 {
2321 /* Start by assuming it's not disabled */
2322 CurrentProcess->Flags.ExecuteDisable = FALSE;
2323
2324 /* Now process each flag and turn the equivalent bit on */
2325 if (ExecuteOptions & MEM_EXECUTE_OPTION_DISABLE)
2326 {
2327 CurrentProcess->Flags.ExecuteDisable = TRUE;
2328 }
2329 if (ExecuteOptions & MEM_EXECUTE_OPTION_ENABLE)
2330 {
2331 CurrentProcess->Flags.ExecuteEnable = TRUE;
2332 }
2333 if (ExecuteOptions & MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION)
2334 {
2335 CurrentProcess->Flags.DisableThunkEmulation = TRUE;
2336 }
2337 if (ExecuteOptions & MEM_EXECUTE_OPTION_PERMANENT)
2338 {
2339 CurrentProcess->Flags.Permanent = TRUE;
2340 }
2341 if (ExecuteOptions & MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE)
2342 {
2343 CurrentProcess->Flags.ExecuteDispatchEnable = TRUE;
2344 }
2345 if (ExecuteOptions & MEM_EXECUTE_OPTION_IMAGE_DISPATCH_ENABLE)
2346 {
2347 CurrentProcess->Flags.ImageDispatchEnable = TRUE;
2348 }
2349
2350 /* These are turned on by default if no-execution is also eanbled */
2351 if (CurrentProcess->Flags.ExecuteEnable)
2352 {
2353 CurrentProcess->Flags.ExecuteDispatchEnable = TRUE;
2354 CurrentProcess->Flags.ImageDispatchEnable = TRUE;
2355 }
2356
2357 /* All good */
2358 Status = STATUS_SUCCESS;
2359 }
2360
2361 /* Release the lock and return status */
2362 KiReleaseProcessLock(&ProcessLock);
2363 return Status;
2364 }
2365
2366 /* EOF */