浅谈MDL(壹)(Windows内核学习笔记)

    //Win10下的定义
    //0x1c bytes (sizeof)
    struct _MDL
    {
    struct _MDL* Next;     		//0x0	MDL队列中的下一个成员
    SHORT Size;            		//0x4	整个MDL列表的长度，包括MDL结构体和物理页帧号所占的内存 物理页帧号起始地址紧跟在结构体后
    SHORT MdlFlags;        		//0x6	标志，设置一些内存属性
    struct _EPROCESS* Process;	//0x8	缓冲区所属进程
    VOID* MappedSystemVa;    	//0xc	映射之后的系统空间虚拟地址
    VOID* StartVa;       	 	//0x10	缓冲区所在第一个页面的虚拟地址
    ULONG ByteCount;       		//0x14	字节数，虚拟地址的大小
    ULONG ByteOffset;     	 	//0x18	StartVa + ByteOffset缓冲区开始的地址
    }; 
    //Win7的Windbg版本
    0: kd> dt nt!_MDL
       +0x000 Next             : Ptr32 _MDL
       +0x004 Size             : Int2B
       +0x006 MdlFlags         : Int2B
       +0x008 Process          : Ptr32 _EPROCESS
       +0x00c MappedSystemVa   : Ptr32 Void
       +0x010 StartVa          : Ptr32 Void
       +0x014 ByteCount        : Uint4B
       +0x018 ByteOffset       : Uint4B

    //该宏未初始化MappedSystemVa，因为还没有进行映射
    #define MmInitializeMdl(_MemoryDescriptorList, \
                        _BaseVa, \
                        _Length) \
    { \
      (_MemoryDescriptorList)->Next = (PMDL) NULL; \
      (_MemoryDescriptorList)->Size = (CSHORT) (sizeof(MDL) + \
    (sizeof(PFN_NUMBER) * ADDRESS_AND_SIZE_TO_SPAN_PAGES(_BaseVa, _Length))); \
      (_MemoryDescriptorList)->MdlFlags = 0; \
      (_MemoryDescriptorList)->StartVa = (PVOID) PAGE_ALIGN(_BaseVa); \
      (_MemoryDescriptorList)->ByteOffset = BYTE_OFFSET(_BaseVa); \
      (_MemoryDescriptorList)->ByteCount = (ULONG) _Length; \
    }
    PMDL
    NTAPI
    IoAllocateMdl(IN PVOID VirtualAddress,
              IN ULONG Length,
              IN BOOLEAN SecondaryBuffer,
              IN BOOLEAN ChargeQuota,
              IN PIRP Irp)
    {
    PMDL Mdl = NULL, p;
    ULONG Flags = 0;
    ULONG Size;
    
    /*断言长度有效*/
    ASSERT(Length != 0);
    
    /*超过地址空间的一半，肯定无法映射，因为MDL存在于内核中，且不能被换出*/
    if (Length & 0x80000000) return NULL;
    
    /*计算缓冲区跨过的页面数量*/
    Size = ADDRESS_AND_SIZE_TO_SPAN_PAGES(VirtualAddress, Length);
    if (Size > 23)
    {
        /*超过23个页面，根据实际大小估算MDL的大小*/
        Size *= sizeof(PFN_NUMBER);//sizeof(PFN_NUMBER)物理页帧号的大小
        Size += sizeof(MDL);
        if (Size > MAXUSHORT) return NULL;
    }
    else
    {
        /*不超过23，按照标准大小23计算大小*/
        Size = (23 * sizeof(PFN_NUMBER)) + sizeof(MDL);
        Flags |= MDL_ALLOCATED_FIXED_SIZE;
    
        /*Lookaside防止内存空洞，相当于一个内存管理器一样*/
        Mdl = IopAllocateMdlFromLookaside(LookasideMdlList);//现成的数据结构分配内存，效率较高
    }
    
    /**/
    if (!Mdl)
    {
        /*若失败，非分页内存池中申请内存*/
        Mdl = ExAllocatePoolWithTag(NonPagedPool, Size, TAG_MDL);
        if (!Mdl) return NULL;
    }
    
    /*初始化MDL*/
    MmInitializeMdl(Mdl, VirtualAddress, Length);
    Mdl->MdlFlags |= Flags;
    
    /* Check if an IRP was given too */
    if (Irp)
    {
        /* Check if it came with a secondary buffer */
        if (SecondaryBuffer)
        {
            /* Insert the MDL at the end */
            p = Irp->MdlAddress;
            while (p->Next) p = p->Next;
            p->Next = Mdl;
      }
      else
      {
            /* Otherwise, insert it directly */
            Irp->MdlAddress = Mdl;
      }
       }
    
    /* Return the allocated mdl */
    return Mdl;
    }