[ros-arm-bringup] 32371: Fixed several off-by-one errors when playing with the PFN database array size. Among other things, certain valid pages would be considered invalid, and also the PFN database wouldn't be properly erased on startup (which would result in a crash after a warm reboot or restarting the emulator).

Author: ros-arm-bringup
Date: Fri Feb 15 04:04:22 2008
New Revision: 32371

URL: http://svn.reactos.org/svn/reactos?rev=32371&view=rev
Log:
Fixed several off-by-one errors when playing with the PFN database array size. Among other
things, certain valid pages would be considered invalid, and also the PFN database
wouldn't be properly erased on startup (which would result in a crash after a warm
reboot or restarting the emulator).

Modified:
    trunk/reactos/ntoskrnl/mm/freelist.c

Modified: trunk/reactos/ntoskrnl/mm/freelist.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/ntoskrnl/mm/freelist.c?rev…
==============================================================================
--- trunk/reactos/ntoskrnl/mm/freelist.c (original)
+++ trunk/reactos/ntoskrnl/mm/freelist.c Fri Feb 15 04:04:22 2008
@@ -337,7 +337,7 @@
     }
     
     /* Clear the PFN database */
-    RtlZeroMemory(MmPageArray, MmPageArraySize * sizeof(PHYSICAL_PAGE));
+    RtlZeroMemory(MmPageArray, (MmPageArraySize + 1) * sizeof(PHYSICAL_PAGE));
 
     /* This is what a used page looks like */
     RtlZeroMemory(&UsedPage, sizeof(UsedPage));
@@ -436,6 +436,7 @@
                  * Descriptor List, why bother, right?
                  */
                 MmPageArray[i].Flags.Type = MM_PHYSICAL_PAGE_FREE;
+                MmPageArray[i].ReferenceCount = 0;
                 InsertTailList(&FreeUnzeroedPageListHead,
                                &MmPageArray[i].ListEntry);
                 UnzeroedPageCount++;
@@ -501,7 +502,7 @@
    KIRQL oldIrql;
    PPHYSICAL_PAGE Page;
 
-   if (Pfn < MmPageArraySize)
+   if (Pfn <= MmPageArraySize)
    {
       KeAcquireSpinLock(&PageListLock, &oldIrql);
       Page = MiGetPfnEntry(Pfn);
@@ -523,7 +524,7 @@
    KIRQL oldIrql;
    PPHYSICAL_PAGE Page;
 
-   if (Pfn < MmPageArraySize)
+   if (Pfn <= MmPageArraySize)
    {
       KeAcquireSpinLock(&PageListLock, &oldIrql);
       Page = MiGetPfnEntry(Pfn);
@@ -592,7 +593,7 @@
 
    DPRINT("MmReferencePageUnsafe(PysicalAddress %x)\n", Pfn <<
PAGE_SHIFT);
 
-   if (Pfn == 0 || Pfn >= MmPageArraySize)
+   if (Pfn == 0 || Pfn > MmPageArraySize)
    {
       return;
    }
@@ -616,11 +617,6 @@
 {
    DPRINT("MmReferencePage(PysicalAddress %x)\n", Pfn << PAGE_SHIFT);
 
-   if (Pfn == 0 || Pfn >= MmPageArraySize)
-   {
-      KEBUGCHECK(0);
-   }
-
    MmReferencePageUnsafe(Pfn);
 }
 
@@ -633,11 +629,6 @@
    PPHYSICAL_PAGE Page;
 
    DPRINT("MmGetReferenceCountPage(PhysicalAddress %x)\n", Pfn <<
PAGE_SHIFT);
-
-   if (Pfn == 0 || Pfn >= MmPageArraySize)
-   {
-      KEBUGCHECK(0);
-   }
 
    KeAcquireSpinLock(&PageListLock, &oldIrql);
    Page = MiGetPfnEntry(Pfn);

[Pablo Menichini]

The off-by-one errors are because MmPageArraySize is:
      MmPageArraySize = MmHighestPhysicalPage;
and not
      MmPageArraySize = MmHighestPhysicalPage + 1;

Just my 2 cents,
Pablo

On Fri, 15 Feb 2008, ros-arm-bringup(a)svn.reactos.org wrote:

>   Author: ros-arm-bringup
>  Date: Fri Feb 15 04:04:22 2008
>  New Revision: 32371
>
>  URL: http://svn.reactos.org/svn/reactos?rev=32371&view=rev
>  Log:
>  Fixed several off-by-one errors when playing with the PFN database array size. Among
> other things, certain valid pages would be considered invalid, and also the PFN database
> wouldn't be properly erased on startup (which would result in a crash after a warm
> reboot or restarting the emulator).
>
>  Modified:
>     trunk/reactos/ntoskrnl/mm/freelist.c