Shared Memory between user and core states through MDL in Windows drivers

The Windows Driver runs in the kernel mode, and the caller of the driver runs in the user mode. How can user-State processes share memory with core-state drivers?
?

In 32-bit windows, the virtual space is 4 GB by default, and the first 2 GB is private to each process. That is to say, the virtual space changes during process switching and the last 2 GB is the operating system, so it is fixed. Since the user-state process and the core-state driver are in the same process space, is it possible to directly transmit a memory address? Theoretically, but not actually, because user-State processes are constantly switching, the driver cannot guarantee which user-state process is in the front, if you are not sure about the ing of the first 2G virtual address space, the address sent from the user-state process may not be legal.

 

A common practice is to perform memory re ing through MDL. Simply put, the same physical memory is mapped to both the user-state space and the core-state space.

Specifically, there are two methods: User-state process allocation space and kernel-state ing. The other is to allocate space in the kernel state and map user State processes.

Pseudo Code of the former:

// assume uva is a virtual address in user space, uva_size is its sizeMDL * mdl = IoAllocateMdl(uva, uva_size, FALSE, FALSE, NULL);ASSERT(mdl);__try {MmProbeAndLockPages(mdl, UserMode, IoReadAccess);} __except(EXCEPTION_EXECUTE_HANDLER) {DbgPrint("error code = %d", GetExceptionCode);}PVOID kva = MmGetSystemAddressForMdlSafe(mdl, NormalPagePriority);// use kva // …MmUnlockPages(mdl);IoFreeMdl(mdl);

* Remember to set the MDL before the driver unload
Unlock and free, otherwise bsod will occur.

The latter pseudo code:

PVOID kva = ExAllocatePoolWithTag(NonPagedPool, 1024, (ULONG)'PMET');MDL * mdl = IoAllocateMdl(uva, uva_size, FALSE, FALSE, NULL);ASSERT(mdl);__try {MmBuildMdlForNonPagedPool(mdl);} __except(EXCEPTION_EXECUTE_HANDLER) {DbgPrint("error code = %d", GetExceptionCode);}PVOID uva = MmMapLockedPagesSpecifyCache(mdl, UserMode, MmCached, NULL, FALSE, NormalPagePriority); 

* If KVA is allocated to the nonpagedpool, the physical pages are locked. Therefore, mmbuildmdlfornonpagedpool is used.
Pool.

In addition to this primitive approach, windows also provides two methods called do_buffered_io and do_direct_io, in which the system automatically copies the user-state space memory to the core State Space (Associated-Irp.SystemBuffer ), the latter is automatically generated by the system MDL (IRP-> mdladdress ). In fact, the essence of these two methods is that the system helps with the above part of the process, so that programmers can save those operations.

As mentioned above, a key data structure MDL (memorydescriptor
List), the system uses it to describe the layout of the virtual space corresponding to the physical memory. MDL is divided into two parts: Fixed Length and variable length. The fixed length structure is as follows:

typedef struct _MDL {  struct _MDL *Next;  CSHORT Size;  CSHORT MdlFlags;  struct _EPROCESS *Process;  PVOID MappedSystemVa;  PVOID StartVa;  ULONG ByteCount;  ULONG ByteOffset;} MDL, *PMDL;

Next: point to the next MDL structure to form a linked list. Sometimes an IRP contains multiple MDL

Size: the size of the MDL. Note that the size includes the fixed length and the variable length.

Mdlflags: Property tag, such as whether the physical page is locked.

Process: As the name implies, it points to the corresponding process structure of the address space containing the virtual address.

Mappedsystemva: Address corresponding to the kernel state space

Startva: the virtual address in the user or kernel address space depends on the allocate. The value is page-aligned.

Bytecount: the size of the virtual address segment described by MDL, in bytes

Byteoffset: the intra-page offset of the starting address, because the address segment described by MDL is not necessarily page aligned.

If the virtual address of allocate is 0xac004010, startva is 0xac004000, byteoffset is 0x10, and mmgetmdlvirtualaddress provides startva + byteoffset.

 

The extended part contains an array of physical page numbers. You can use

Ppfn_number PFN = mmgetmdlpfnarray (MDL)

Note that only PFN is included, and the offset is not included in the page. The number of elements in the array can be obtained by address_and_size_to_span_pages.