verifier.cpp File Reference

#include "vfpriv.hpp"

Include dependency graph for verifier.cpp:

Go to the source code of this file.

Functions
_Must_inspect_result_ NTSTATUS	AddEventHooksWdfDeviceCreate (__inout PVF_HOOK_PROCESS_INFO HookProcessInfo, __in PWDF_DRIVER_GLOBALS DriverGlobals, __in PWDFDEVICE_INIT *DeviceInit, __in PWDF_OBJECT_ATTRIBUTES DeviceAttributes, __out WDFDEVICE *Device)
_Must_inspect_result_ NTSTATUS	AddEventHooksWdfIoQueueCreate (__inout PVF_HOOK_PROCESS_INFO HookProcessInfo, __in PWDF_DRIVER_GLOBALS DriverGlobals, __in WDFDEVICE Device, __in PWDF_IO_QUEUE_CONFIG Config, __in PWDF_OBJECT_ATTRIBUTES QueueAttributes, __out WDFQUEUE *Queue)
_Must_inspect_result_ PVOID FASTCALL	VfWdfObjectGetTypedContext (__in WDFOBJECT Handle, __in PCWDF_OBJECT_CONTEXT_TYPE_INFO TypeInfo)
_Must_inspect_result_ NTSTATUS	VfAllocateContext (__in PWDF_DRIVER_GLOBALS DriverGlobals, __in PWDF_OBJECT_ATTRIBUTES Attributes, __out PVOID *ContextHeader)
_Must_inspect_result_ NTSTATUS	VfAddContextToHandle (__in PVOID ContextHeader, __in PWDF_OBJECT_ATTRIBUTES Attributes, __in WDFOBJECT Handle, __out_opt PVOID *Context)

Variables
WDFVERSION	WdfVersion

Function Documentation

AddEventHooksWdfDeviceCreate()

_Must_inspect_result_ NTSTATUS AddEventHooksWdfDeviceCreate	(	__inout PVF_HOOK_PROCESS_INFO	HookProcessInfo,
		__in PWDF_DRIVER_GLOBALS	DriverGlobals,
		__in PWDFDEVICE_INIT *	DeviceInit,
		__in PWDF_OBJECT_ATTRIBUTES	DeviceAttributes,
		__out WDFDEVICE *	Device
	)

Definition at line 52 of file verifier.cpp.

{
    NTSTATUS status;
    PWDFDEVICE_INIT deviceInit = *DeviceInit;
    WDF_PNPPOWER_EVENT_CALLBACKS pnpPowerEvtsOriginal;
    WDF_PNPPOWER_EVENT_CALLBACKS *pnpPowerEvts;
    PFX_DRIVER_GLOBALS pFxDriverGlobals;
    PVOID contextHeader = NULL;
    WDF_OBJECT_ATTRIBUTES  attributes;
 
    PAGED_CODE_LOCKED();
 
    pFxDriverGlobals = GetFxDriverGlobals(DriverGlobals);
 
    FxPointerNotNull(pFxDriverGlobals, DeviceInit);
    FxPointerNotNull(pFxDriverGlobals, *DeviceInit);
    FxPointerNotNull(pFxDriverGlobals, Device);
 
    //
    // Check if there are any callbacks set by the client driver. If not, we
    // don't need any callback hooking.
    //
    if (deviceInit->PnpPower.PnpPowerEventCallbacks.Size !=
        sizeof(WDF_PNPPOWER_EVENT_CALLBACKS)) {
        //
        // no hooking required.
        //
        status = STATUS_SUCCESS;
        HookProcessInfo->DonotCallKmdfLib = FALSE;
        return status;
    }
 
    //
    // Hooking can be done only if we are able to allocate context memory.
    // Try to allocate a context
    //
    WDF_OBJECT_ATTRIBUTES_INIT_CONTEXT_TYPE(
                                            &attributes,
                                            VF_WDFDEVICECREATE_CONTEXT
                                            );
 
    status = VfAllocateContext(DriverGlobals, &attributes, &contextHeader);
 
    if (!NT_SUCCESS(status)) {
        //
        // couldn't allocate context. hooking not possible
        //
        HookProcessInfo->DonotCallKmdfLib = FALSE;
        return status;
    }
 
    //
    // store original driver callbacks to local variable
    //
    RtlCopyMemory(&pnpPowerEvtsOriginal,
        &deviceInit->PnpPower.PnpPowerEventCallbacks,
        sizeof(WDF_PNPPOWER_EVENT_CALLBACKS)
        );
 
    //
    // Set callback hooks
    //
    // Normally override the hooks on local copy of stucture (not the original
    // structure itself) and then pass the local struture to DDI call and
    // copy back the original poniter when returning back to caller. In this case
    // device_init is null'ed out by fx when returning to caller so we can
    // directly override the original
    //
    pnpPowerEvts = &deviceInit->PnpPower.PnpPowerEventCallbacks;
 
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceD0Entry);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceD0EntryPostInterruptsEnabled);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceD0Exit);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceD0ExitPreInterruptsDisabled);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDevicePrepareHardware);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceReleaseHardware);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceSelfManagedIoCleanup);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceSelfManagedIoFlush);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceSelfManagedIoInit);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceSelfManagedIoSuspend);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceSelfManagedIoRestart);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceSurpriseRemoval);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceQueryRemove);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceQueryStop);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceUsageNotification);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceUsageNotificationEx);
    SET_HOOK_IF_CALLBACK_PRESENT(pnpPowerEvts, pnpPowerEvts, EvtDeviceRelationsQuery);
 
    //
    // Call the DDI on behalf of driver.
    //
    status = ((PFN_WDFDEVICECREATE)WdfVersion.Functions.pfnWdfDeviceCreate)(
                DriverGlobals,
                DeviceInit,
                DeviceAttributes,
                Device
                );
    //
    // Tell main hook routine not to call the DDI in kmdf lib since we
    // already called it
    //
    HookProcessInfo->DonotCallKmdfLib = TRUE;
    HookProcessInfo->DdiCallStatus = status;
 
    //
    // if DDI Succeeds, add context
    //
    if (NT_SUCCESS(status)) {
        PVF_WDFDEVICECREATE_CONTEXT context = NULL;
 
        //
        // add the already allocated context to the object.
        //
        status = VfAddContextToHandle(contextHeader,
                                      &attributes,
                                      *Device,
                                      (PVOID *)&context);
 
        if (NT_SUCCESS(status)) {
            //
            // store the DriverGlobals pointer used to associate the driver
            // with its client driver callback later in the callback hooks
            //
            context->CommonHeader.DriverGlobals = DriverGlobals;
 
            //
            // store original client driver callbacks in context
            //
            RtlCopyMemory(
                &context->PnpPowerEventCallbacksOriginal,
                &pnpPowerEvtsOriginal,
                sizeof(WDF_PNPPOWER_EVENT_CALLBACKS)
                );
        }
        else {
            //
            // For some reason adding context to handle failed. This should be
            // rare failure, because context allocation was already successful,
            // only adding to handle failed.
            //
            // Hooking failed if adding context is unsuccessful. This means
            // kmdf has callbacks hooks but verifier cannot assiociate client
            // driver callbacks with callback hooks. This would be a fatal error.
            //
            ASSERTMSG("KMDF Enhanced Verifier failed to add context to object "
                "handle\n", FALSE);
 
            if (contextHeader != NULL) {
                FxPoolFree(contextHeader);
            }
        }
    }
    else {
        //
        // KMDF DDI call failed. In case of failure, DeviceInit is not NULL'ed
        // so the driver could potentially call WdfDeviceCreate again with this
        // DeviceInit that contains callback hooks, and result in infinite
        // callback loop. So put original callbacks back
        //
        if ((*DeviceInit) != NULL) {
            //
            // we overwrote only the pnppower callbacks. Put the original back.
            //
            deviceInit = *DeviceInit;
            RtlCopyMemory(&deviceInit->PnpPower.PnpPowerEventCallbacks,
                &pnpPowerEvtsOriginal,
                sizeof(WDF_PNPPOWER_EVENT_CALLBACKS)
                );
        }
 
        if (contextHeader != NULL) {
            FxPoolFree(contextHeader);
        }
    }
 
    return status;
}

AddEventHooksWdfIoQueueCreate()

_Must_inspect_result_ NTSTATUS AddEventHooksWdfIoQueueCreate	(	__inout PVF_HOOK_PROCESS_INFO	HookProcessInfo,
		__in PWDF_DRIVER_GLOBALS	DriverGlobals,
		__in WDFDEVICE	Device,
		__in PWDF_IO_QUEUE_CONFIG	Config,
		__in PWDF_OBJECT_ATTRIBUTES	QueueAttributes,
		__out WDFQUEUE *	Queue
	)

Definition at line 250 of file verifier.cpp.

{
    NTSTATUS status;
    WDF_IO_QUEUE_CONFIG  configNew;
    PFX_DRIVER_GLOBALS pFxDriverGlobals;
    WDFQUEUE *pQueue;
    WDFQUEUE queue;
    PVOID contextHeader = NULL;
    WDF_OBJECT_ATTRIBUTES  attributes;
 
    PAGED_CODE_LOCKED();
 
    pFxDriverGlobals = GetFxDriverGlobals(DriverGlobals);
 
    FxPointerNotNull(pFxDriverGlobals, Config);
 
    //
    // Check if there are any callbacks set by the client driver. If not, we
    // don't need any callback hooking.
    //
    if (Config->Size != sizeof(WDF_IO_QUEUE_CONFIG)) {
        //
        // no hooking required.
        //
        status = STATUS_SUCCESS;
        HookProcessInfo->DonotCallKmdfLib = FALSE;
        return status;
    }
 
    //
    // Hooking can be done only if we are able to allocate context memory.
    // Try to allocate a context
    //
    WDF_OBJECT_ATTRIBUTES_INIT_CONTEXT_TYPE(&attributes,
                                            VF_WDFIOQUEUECREATE_CONTEXT);
 
    status = VfAllocateContext(DriverGlobals, &attributes, &contextHeader);
 
    if (!NT_SUCCESS(status)) {
        //
        // couldn't allocate context. hooking not possible
        //
        HookProcessInfo->DonotCallKmdfLib = FALSE;
        return status;
    }
 
    //
    // create a local copy of config
    //
    RtlCopyMemory(&configNew,
        Config,
        sizeof(configNew)
        );
 
    //
    // Override local copy with event callback hooks.
    //
    SET_HOOK_IF_CALLBACK_PRESENT(Config, &configNew, EvtIoDefault);
    SET_HOOK_IF_CALLBACK_PRESENT(Config, &configNew, EvtIoRead);
    SET_HOOK_IF_CALLBACK_PRESENT(Config, &configNew, EvtIoWrite);
    SET_HOOK_IF_CALLBACK_PRESENT(Config, &configNew, EvtIoDeviceControl);
    SET_HOOK_IF_CALLBACK_PRESENT(Config, &configNew, EvtIoInternalDeviceControl);
    SET_HOOK_IF_CALLBACK_PRESENT(Config, &configNew, EvtIoStop);
    SET_HOOK_IF_CALLBACK_PRESENT(Config, &configNew, EvtIoResume);
    SET_HOOK_IF_CALLBACK_PRESENT(Config, &configNew, EvtIoCanceledOnQueue);
 
    //
    // Queue handle is an optional parameter
    //
    if (Queue == NULL) {
        pQueue = &queue;
    }
    else {
        pQueue = Queue;
    }
 
    //
    // call the DDI
    //
    status = WdfVersion.Functions.pfnWdfIoQueueCreate(
                DriverGlobals,
                Device,
                &configNew,
                QueueAttributes,
                pQueue
                );
 
    //
    // Tell main hook routine not to call the DDI in kmdf lib since we
    // already called it
    //
    HookProcessInfo->DonotCallKmdfLib = TRUE;
    HookProcessInfo->DdiCallStatus = status;
 
    //
    // if DDI Succeeds, add context
    //
    if (NT_SUCCESS(status)) {
        PVF_WDFIOQUEUECREATE_CONTEXT  context = NULL;
 
        //
        // add the already allocated context to the object.
        //
        status = VfAddContextToHandle(contextHeader,
                                      &attributes,
                                      *pQueue,
                                      (PVOID *)&context);
 
        if (NT_SUCCESS(status)) {
            //
            // store the DriverGlobals pointer used to associate the driver
            // with its client driver callback later in the callback hooks
            //
            context->CommonHeader.DriverGlobals = DriverGlobals;
 
            //
            // add stored original callbacks to context
            //
            RtlCopyMemory(
                &context->IoQueueConfigOriginal,
                Config,
                sizeof(WDF_IO_QUEUE_CONFIG)
                );
        }
        else {
            //
            // For some reason adding context to handle failed. This should be
            // rare failure, because context allocation was already successful,
            // only adding to handle failed.
            //
            // Hooking failed if adding context is unsuccessful. This means
            // kmdf has callbacks hooks but verifier cannot assiociate client
            // driver callbacks with callback hooks. This would be a fatal error.
            //
            ASSERTMSG("KMDF Enhanced Verifier failed to add context to object "
                "handle\n", FALSE);
 
            if (contextHeader != NULL) {
                FxPoolFree(contextHeader);
            }
        }
    }
    else {
        //
        // DDI call to KMDF failed. Nothing to do by verifier. Just return
        // kmdf's status after freeing context header memory.
        //
        if (contextHeader != NULL) {
            FxPoolFree(contextHeader);
        }
    }
 
    return status;
}

VfAddContextToHandle()

_Must_inspect_result_ NTSTATUS VfAddContextToHandle	(	__in PVOID	ContextHeader,
		__in PWDF_OBJECT_ATTRIBUTES	Attributes,
		__in WDFOBJECT	Handle,
		__out_opt PVOID *	Context
	)

Definition at line 576 of file verifier.cpp.

{
    PFX_DRIVER_GLOBALS pFxDriverGlobals;
    NTSTATUS status = STATUS_SUCCESS;
    FxObject* pObject;
    FxContextHeader *pHeader;
    WDFOBJECT_OFFSET offset;
 
    PAGED_CODE_LOCKED();
 
    pHeader = (FxContextHeader *)ContextHeader;
 
    if (pHeader == NULL) {
        return STATUS_INVALID_PARAMETER;
    }
 
    //
    // No need to call FxObjectHandleGetPtr( , , FX_TYPE_OBJECT) because
    // we assume that the object handle will point back to an FxObject.  (The
    // call to FxObjectHandleGetPtr will just make needless virtual call into
    // FxObject anyways).
    //
    offset = 0;
    pObject = FxObject::_GetObjectFromHandle(Handle, &offset);
 
    pFxDriverGlobals = pObject->GetDriverGlobals();
 
    if (offset != 0) {
        //
        // for lack of a better error code
        //
        status = STATUS_OBJECT_PATH_INVALID;
 
        DoTraceLevelMessage(
            pFxDriverGlobals, TRACE_LEVEL_WARNING, TRACINGHANDLE,
            "WDFHANDLE %p cannot have contexts added to it, %!STATUS!",
            Handle, status);
 
        goto cleanup;
    }
 
    pObject->ADDREF(&status);
 
    FxContextHeaderInit(pHeader, pObject, Attributes);
 
    status = pObject->AddContext(pHeader, Context, Attributes);
 
    //
    // STATUS_OBJECT_NAME_EXISTS will not fail NT_SUCCESS, so check
    // explicitly for STATUS_SUCCESS.
    //
    if (status != STATUS_SUCCESS) {
        DoTraceLevelMessage(
            pFxDriverGlobals, TRACE_LEVEL_WARNING, TRACINGHANDLE,
            "WDFHANDLE %p failed to add context, %!STATUS!",
            Handle, status);
    }
 
    pObject->RELEASE(&status);
 
cleanup:
 
    if (status != STATUS_SUCCESS && pHeader != NULL) {
        FxPoolFree(pHeader);
    }
 
    return status;
}

Referenced by AddEventHooksWdfDeviceCreate(), and AddEventHooksWdfIoQueueCreate().

VfAllocateContext()

_Must_inspect_result_ NTSTATUS VfAllocateContext	(	__in PWDF_DRIVER_GLOBALS	DriverGlobals,
		__in PWDF_OBJECT_ATTRIBUTES	Attributes,
		__out PVOID *	ContextHeader
	)

Definition at line 502 of file verifier.cpp.

{
    PFX_DRIVER_GLOBALS pFxDriverGlobals;
    NTSTATUS status;
    FxContextHeader *pHeader;
    size_t size;
 
    PAGED_CODE_LOCKED();
 
    pFxDriverGlobals = GetFxDriverGlobals(DriverGlobals);
 
    status = FxValidateObjectAttributes(
        pFxDriverGlobals, Attributes, FX_VALIDATE_OPTION_ATTRIBUTES_REQUIRED);
    if (!NT_SUCCESS(status)) {
        return status;
    }
 
    //
    // Must have a context type!
    //
    if (Attributes->ContextTypeInfo == NULL) {
        status = STATUS_OBJECT_NAME_INVALID;
        DoTraceLevelMessage(
            pFxDriverGlobals, TRACE_LEVEL_WARNING, TRACINGHANDLE,
            "Attributes %p ContextTypeInfo is NULL, %!STATUS!",
            Attributes, status);
        return status;
    }
 
    //
    // By passing 0's for raw object size and extra size, we can compute the
    // size of only the header and its contents.
    //
    status = FxCalculateObjectTotalSize(pFxDriverGlobals, 0, 0, Attributes, &size);
    if (!NT_SUCCESS(status)) {
        return status;
    }
 
    pHeader = (FxContextHeader*)
         FxPoolAllocate(pFxDriverGlobals, NonPagedPool, size);
 
    if (pHeader != NULL) {
        *ContextHeader = pHeader;
        status = STATUS_SUCCESS;
    }
    else {
        status = STATUS_INSUFFICIENT_RESOURCES;
    }
 
    return status;
}

Referenced by AddEventHooksWdfDeviceCreate(), and AddEventHooksWdfIoQueueCreate().

VfWdfObjectGetTypedContext()

_Must_inspect_result_ PVOID FASTCALL VfWdfObjectGetTypedContext	(	__in WDFOBJECT	Handle,
		__in PCWDF_OBJECT_CONTEXT_TYPE_INFO	TypeInfo
	)

Definition at line 424 of file verifier.cpp.

{
    FxContextHeader* pHeader;
    FxObject* pObject;
    PFX_DRIVER_GLOBALS pFxDriverGlobals;
    WDFOBJECT_OFFSET offset;
 
    PAGED_CODE_LOCKED();
 
    //
    // Do not call FxObjectHandleGetPtr( , , FX_TYPE_OBJECT) because this is a
    // hot spot / workhorse function that should be as efficient as possible.
    //
    // A call to FxObjectHandleGetPtr would :
    // 1)  invoke a virtual call to QueryInterface
    //
    // 2)  ASSERT that the ref count of the object is > zero.  Since this is one
    //     of the few functions that can be called in EvtObjectDestroy where the
    //     ref count is zero, that is not a good side affect.
    //
    offset = 0;
    pObject = FxObject::_GetObjectFromHandle(Handle, &offset);
 
    //
    // Use the object's globals, not the caller's
    //
    pFxDriverGlobals = pObject->GetDriverGlobals();
 
    FxPointerNotNull(pFxDriverGlobals, Handle);
    FxPointerNotNull(pFxDriverGlobals, TypeInfo);
 
    pHeader = pObject->GetContextHeader();
 
    for ( ; pHeader != NULL; pHeader = pHeader->NextHeader) {
        if (pHeader->ContextTypeInfo == TypeInfo) {
            return &pHeader->Context[0];
        }
    }
 
    PCHAR pGivenName;
 
    if (TypeInfo->ContextName != NULL) {
        pGivenName = TypeInfo->ContextName;
    }
    else {
        pGivenName = "<no typename given>";
    }
 
    DoTraceLevelMessage(pFxDriverGlobals, TRACE_LEVEL_WARNING, TRACINGDEVICE,
                        "Attempting to get context type %s from WDFOBJECT 0x%p",
                        pGivenName, Handle);
 
    return NULL;
}

Variable Documentation

WdfVersion

WDFVERSION WdfVersion

extern

Referenced by AddEventHooksWdfDeviceCreate(), and AddEventHooksWdfIoQueueCreate().