Implements EPT functions. More...

#include "ept.h"
#include "asm.h"
#include "common.h"
#include "log.h"
#include "util.h"
#include "performance.h"
#include <pshpack1.h>
#include <poppack.h>

Include dependency graph for ept.cpp:

Go to the source code of this file.

Classes
struct	MtrrData

struct	EptData

Functions
static memory_type	EptpGetMemoryType (_In_ ULONG64 physical_address)

static EptCommonEntry *	EptpConstructTables (_In_ EptCommonEntry table, _In_ ULONG table_level, _In_ ULONG64 physical_address, _In_opt_ EptData ept_data)

static void	EptpDestructTables (_In_ EptCommonEntry *table, _In_ ULONG table_level)

static EptCommonEntry *	EptpAllocateEptEntry (_In_opt_ EptData *ept_data)

static EptCommonEntry *	EptpAllocateEptEntryFromPreAllocated (_In_ EptData *ept_data)

static EptCommonEntry *	EptpAllocateEptEntryFromPool ()

static void	EptpInitTableEntry (_In_ EptCommonEntry *Entry, _In_ ULONG table_level, _In_ ULONG64 physical_address)

static ULONG64	EptpAddressToPxeIndex (_In_ ULONG64 physical_address)

static ULONG64	EptpAddressToPpeIndex (_In_ ULONG64 physical_address)

static ULONG64	EptpAddressToPdeIndex (_In_ ULONG64 physical_address)

static ULONG64	EptpAddressToPteIndex (_In_ ULONG64 physical_address)

static bool	EptpIsDeviceMemory (_In_ ULONG64 physical_address)

static EptCommonEntry *	EptpGetEptPtEntry (_In_ EptCommonEntry *table, _In_ ULONG table_level, _In_ ULONG64 physical_address)

static void	EptpFreeUnusedPreAllocatedEntries (_Pre_notnull_ __drv_freesMem(Mem) EptCommonEntry **preallocated_entries, _In_ long used_count)

bool	EptIsEptAvailable ()
	Checks if the system supports EPT technology sufficient enough. More...

ULONG64	EptGetEptPointer (EptData *ept_data)

void	EptInitializeMtrrEntries ()
	Reads and stores all MTRRs to set a correct memory type for EPT. More...

static memory_type	EptpGetMemoryType (ULONG64 physical_address)

EptData *	EptInitialization ()
	Builds EPT, allocates pre-allocated entires, initializes and returns EptData. More...

static EptCommonEntry *	EptpConstructTables (EptCommonEntry table, ULONG table_level, ULONG64 physical_address, EptData ept_data)

static EptCommonEntry *	EptpAllocateEptEntry (EptData *ept_data)

static EptCommonEntry *	EptpAllocateEptEntryFromPreAllocated (EptData *ept_data)

static void	EptpInitTableEntry (EptCommonEntry *entry, ULONG table_level, ULONG64 physical_address)

static ULONG64	EptpAddressToPxeIndex (ULONG64 physical_address)

static ULONG64	EptpAddressToPpeIndex (ULONG64 physical_address)

static ULONG64	EptpAddressToPdeIndex (ULONG64 physical_address)

static ULONG64	EptpAddressToPteIndex (ULONG64 physical_address)

void	EptHandleEptViolation (EptData *ept_data)

static bool	EptpIsDeviceMemory (ULONG64 physical_address)

EptCommonEntry *	EptGetEptPtEntry (EptData *ept_data, ULONG64 physical_address)

static EptCommonEntry *	EptpGetEptPtEntry (EptCommonEntry *table, ULONG table_level, ULONG64 physical_address)

void	EptTermination (EptData *ept_data)

static void	EptpFreeUnusedPreAllocatedEntries (EptCommonEntry **preallocated_entries, long used_count)

static void	EptpDestructTables (EptCommonEntry *table, ULONG table_level)

Variables
static const auto	kEptpPxiShift = 39ull

static const auto	kEptpPpiShift = 30ull

static const auto	kEptpPdiShift = 21ull

static const auto	kEptpPtiShift = 12ull

static const auto	kEptpPtxMask = 0x1ffull

static const auto	kEptpNumberOfPreallocatedEntries = 50

static const auto	kEptpNumOfMaxVariableRangeMtrrs = 255

static const auto	kEptpNumOfFixedRangeMtrrs

static const auto	kEptpMtrrEntriesSize

static MtrrData	g_eptp_mtrr_entries [kEptpMtrrEntriesSize]

static UCHAR	g_eptp_mtrr_default_type

Detailed Description

Implements EPT functions.

Definition in file ept.cpp.

Function Documentation

◆ EptGetEptPointer()

ULONG64 EptGetEptPointer ( EptData * ept_data )

Definition at line 188 of file ept.cpp.

Here is the caller graph for this function:

◆ EptGetEptPtEntry()

EptCommonEntry* EptGetEptPtEntry	(	EptData *	ept_data,
		ULONG64	physical_address
	)

Definition at line 702 of file ept.cpp.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ EptHandleEptViolation()

void EptHandleEptViolation ( EptData * ept_data )

Definition at line 647 of file ept.cpp.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ EptInitialization()

EptData* EptInitialization ( )

Builds EPT, allocates pre-allocated entires, initializes and returns EptData.

Returns: An allocated EptData on success, or nullptr

A driver must call EptTermination() with a returned value when this function succeeded.

Definition at line 399 of file ept.cpp.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ EptInitializeMtrrEntries()

void EptInitializeMtrrEntries ( )

Reads and stores all MTRRs to set a correct memory type for EPT.

Definition at line 193 of file ept.cpp.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ EptIsEptAvailable()

bool EptIsEptAvailable ( )

Checks if the system supports EPT technology sufficient enough.

Returns: true if the system supports EPT

Definition at line 163 of file ept.cpp.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ EptpAddressToPdeIndex() [1/2]

static ULONG64 EptpAddressToPdeIndex ( _In_ ULONG64 physical_address )

static

Here is the caller graph for this function:

◆ EptpAddressToPdeIndex() [2/2]

static ULONG64 EptpAddressToPdeIndex ( ULONG64 physical_address )

static

Definition at line 633 of file ept.cpp.

◆ EptpAddressToPpeIndex() [1/2]

static ULONG64 EptpAddressToPpeIndex ( _In_ ULONG64 physical_address )

static

Here is the caller graph for this function:

◆ EptpAddressToPpeIndex() [2/2]

static ULONG64 EptpAddressToPpeIndex ( ULONG64 physical_address )

static

Definition at line 626 of file ept.cpp.

◆ EptpAddressToPteIndex() [1/2]

static ULONG64 EptpAddressToPteIndex ( _In_ ULONG64 physical_address )

static

Here is the caller graph for this function:

◆ EptpAddressToPteIndex() [2/2]

static ULONG64 EptpAddressToPteIndex ( ULONG64 physical_address )

static

Definition at line 640 of file ept.cpp.

◆ EptpAddressToPxeIndex() [1/2]

static ULONG64 EptpAddressToPxeIndex ( _In_ ULONG64 physical_address )

static

Here is the caller graph for this function:

◆ EptpAddressToPxeIndex() [2/2]

static ULONG64 EptpAddressToPxeIndex ( ULONG64 physical_address )

static

Definition at line 619 of file ept.cpp.

◆ EptpAllocateEptEntry() [1/2]

static EptCommonEntry* EptpAllocateEptEntry ( _In_opt_ EptData * ept_data )

static

Here is the caller graph for this function:

◆ EptpAllocateEptEntry() [2/2]

static EptCommonEntry* EptpAllocateEptEntry ( EptData * ept_data )

static

Definition at line 569 of file ept.cpp.

Here is the call graph for this function:

◆ EptpAllocateEptEntryFromPool()

static EptCommonEntry * EptpAllocateEptEntryFromPool ( )

static

Definition at line 592 of file ept.cpp.

Here is the caller graph for this function:

◆ EptpAllocateEptEntryFromPreAllocated() [1/2]

static EptCommonEntry* EptpAllocateEptEntryFromPreAllocated ( _In_ EptData * ept_data )

static

Here is the caller graph for this function:

◆ EptpAllocateEptEntryFromPreAllocated() [2/2]

static EptCommonEntry* EptpAllocateEptEntryFromPreAllocated ( EptData * ept_data )

static

Definition at line 580 of file ept.cpp.

◆ EptpConstructTables() [1/2]

static EptCommonEntry* EptpConstructTables	(	_In_ EptCommonEntry *	table,
		_In_ ULONG	table_level,
		_In_ ULONG64	physical_address,
		_In_opt_ EptData *	ept_data
	)

static

Here is the caller graph for this function:

◆ EptpConstructTables() [2/2]

static EptCommonEntry* EptpConstructTables	(	EptCommonEntry *	table,
		ULONG	table_level,
		ULONG64	physical_address,
		EptData *	ept_data
	)

static

Definition at line 502 of file ept.cpp.

Here is the call graph for this function:

◆ EptpDestructTables() [1/2]

static void EptpDestructTables	(	_In_ EptCommonEntry *	table,
		_In_ ULONG	table_level
	)

static

Here is the caller graph for this function:

◆ EptpDestructTables() [2/2]

static void EptpDestructTables	(	EptCommonEntry *	table,
		ULONG	table_level
	)

static

Definition at line 789 of file ept.cpp.

Here is the call graph for this function:

◆ EptpFreeUnusedPreAllocatedEntries() [1/2]

static void EptpFreeUnusedPreAllocatedEntries	(	_Pre_notnull_ __drv_freesMem(Mem) EptCommonEntry **	preallocated_entries,
		_In_ long	used_count
	)

static

Here is the caller graph for this function:

◆ EptpFreeUnusedPreAllocatedEntries() [2/2]

static void EptpFreeUnusedPreAllocatedEntries	(	EptCommonEntry **	preallocated_entries,
		long	used_count
	)

static

Definition at line 774 of file ept.cpp.

◆ EptpGetEptPtEntry() [1/2]

static EptCommonEntry* EptpGetEptPtEntry	(	_In_ EptCommonEntry *	table,
		_In_ ULONG	table_level,
		_In_ ULONG64	physical_address
	)

static

Here is the caller graph for this function:

◆ EptpGetEptPtEntry() [2/2]

static EptCommonEntry* EptpGetEptPtEntry	(	EptCommonEntry *	table,
		ULONG	table_level,
		ULONG64	physical_address
	)

static

Definition at line 708 of file ept.cpp.

Here is the call graph for this function:

◆ EptpGetMemoryType() [1/2]

static memory_type EptpGetMemoryType ( _In_ ULONG64 physical_address )

static

Here is the caller graph for this function:

◆ EptpGetMemoryType() [2/2]

static memory_type EptpGetMemoryType ( ULONG64 physical_address )

static

Definition at line 341 of file ept.cpp.

Here is the call graph for this function:

◆ EptpInitTableEntry() [1/2]

static void EptpInitTableEntry	(	_In_ EptCommonEntry *	Entry,
		_In_ ULONG	table_level,
		_In_ ULONG64	physical_address
	)

static

Here is the caller graph for this function:

◆ EptpInitTableEntry() [2/2]

static void EptpInitTableEntry	(	EptCommonEntry *	entry,
		ULONG	table_level,
		ULONG64	physical_address
	)

static

Definition at line 606 of file ept.cpp.

Here is the call graph for this function:

◆ EptpIsDeviceMemory() [1/2]

static bool EptpIsDeviceMemory ( _In_ ULONG64 physical_address )

static

Here is the caller graph for this function:

◆ EptpIsDeviceMemory() [2/2]

static bool EptpIsDeviceMemory ( ULONG64 physical_address )

static

Definition at line 686 of file ept.cpp.

Here is the call graph for this function:

◆ EptTermination()

void EptTermination ( EptData * ept_data )

Definition at line 760 of file ept.cpp.

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

◆ g_eptp_mtrr_default_type

UCHAR g_eptp_mtrr_default_type

static

Definition at line 155 of file ept.cpp.

◆ g_eptp_mtrr_entries

MtrrData g_eptp_mtrr_entries[kEptpMtrrEntriesSize]

static

Definition at line 154 of file ept.cpp.

◆ kEptpMtrrEntriesSize

const auto kEptpMtrrEntriesSize

static

Initial value:

=

kEptpNumOfMaxVariableRangeMtrrs + kEptpNumOfFixedRangeMtrrs

kEptpNumOfFixedRangeMtrrs

static const auto kEptpNumOfFixedRangeMtrrs

Definition: ept.cpp:60

kEptpNumOfMaxVariableRangeMtrrs

static const auto kEptpNumOfMaxVariableRangeMtrrs

Definition: ept.cpp:55

Definition at line 64 of file ept.cpp.

◆ kEptpNumberOfPreallocatedEntries

const auto kEptpNumberOfPreallocatedEntries = 50

static

Definition at line 52 of file ept.cpp.

◆ kEptpNumOfFixedRangeMtrrs

const auto kEptpNumOfFixedRangeMtrrs

static

Initial value:

=

(1 + 2 + 8) * RTL_NUMBER_OF_FIELD(Ia32MtrrFixedRangeMsr, fields.types)

Ia32MtrrFixedRangeMsr::types

UCHAR types[8]

Definition: ia32_type.h:532

Ia32MtrrFixedRangeMsr

See: Fixed Range MTRRs.

Definition: ia32_type.h:529

Definition at line 60 of file ept.cpp.

◆ kEptpNumOfMaxVariableRangeMtrrs

const auto kEptpNumOfMaxVariableRangeMtrrs = 255

static

Definition at line 55 of file ept.cpp.

◆ kEptpPdiShift

const auto kEptpPdiShift = 21ull

static

Definition at line 42 of file ept.cpp.

◆ kEptpPpiShift

const auto kEptpPpiShift = 30ull

static

Definition at line 39 of file ept.cpp.

◆ kEptpPtiShift

const auto kEptpPtiShift = 12ull

static

Definition at line 45 of file ept.cpp.

◆ kEptpPtxMask

const auto kEptpPtxMask = 0x1ffull

static

Definition at line 48 of file ept.cpp.

◆ kEptpPxiShift

const auto kEptpPxiShift = 39ull

static

Definition at line 36 of file ept.cpp.

Classes

Functions

Variables

Detailed Description

Function Documentation

◆ EptGetEptPointer()

◆ EptGetEptPtEntry()

◆ EptHandleEptViolation()

◆ EptInitialization()

◆ EptInitializeMtrrEntries()

◆ EptIsEptAvailable()

◆ EptpAddressToPdeIndex() [1/2]

◆ EptpAddressToPdeIndex() [2/2]

◆ EptpAddressToPpeIndex() [1/2]

◆ EptpAddressToPpeIndex() [2/2]

◆ EptpAddressToPteIndex() [1/2]

◆ EptpAddressToPteIndex() [2/2]

◆ EptpAddressToPxeIndex() [1/2]

◆ EptpAddressToPxeIndex() [2/2]

◆ EptpAllocateEptEntry() [1/2]

◆ EptpAllocateEptEntry() [2/2]

◆ EptpAllocateEptEntryFromPool()

◆ EptpAllocateEptEntryFromPreAllocated() [1/2]

◆ EptpAllocateEptEntryFromPreAllocated() [2/2]

◆ EptpConstructTables() [1/2]

◆ EptpConstructTables() [2/2]

◆ EptpDestructTables() [1/2]

◆ EptpDestructTables() [2/2]

◆ EptpFreeUnusedPreAllocatedEntries() [1/2]

◆ EptpFreeUnusedPreAllocatedEntries() [2/2]

◆ EptpGetEptPtEntry() [1/2]

◆ EptpGetEptPtEntry() [2/2]

◆ EptpGetMemoryType() [1/2]

◆ EptpGetMemoryType() [2/2]

◆ EptpInitTableEntry() [1/2]

◆ EptpInitTableEntry() [2/2]

◆ EptpIsDeviceMemory() [1/2]

◆ EptpIsDeviceMemory() [2/2]

◆ EptTermination()

Variable Documentation

◆ g_eptp_mtrr_default_type

◆ g_eptp_mtrr_entries

◆ kEptpMtrrEntriesSize

◆ kEptpNumberOfPreallocatedEntries

◆ kEptpNumOfFixedRangeMtrrs

◆ kEptpNumOfMaxVariableRangeMtrrs

◆ kEptpPdiShift

◆ kEptpPpiShift

◆ kEptpPtiShift

◆ kEptpPtxMask

◆ kEptpPxiShift