RegisterPort

Purpose

Registers a sequence of I/O ports.

Parameters

• [in] base – address of the first I/O port in the sequence.
• [in] size – number of I/O ports in the sequence.
• [out] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the sequence of I/O ports.
• [out] rc – return code.

Allows the following:

• Hijack I/O ports (it is recommended to monitor the address of the first I/O port and the number of I/O ports in the sequence).
• Exhaust the kernel memory by creating a multitude of objects within it.

RegisterMmio

Purpose

Registers an MMIO memory region.

Parameters

• [in] base – base address of the MMIO memory region.
• [in] size – size of the MMIO memory region in bytes.
• [out] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MMIO memory region.
• [out] rc – return code.

Allows the kernel memory to be used up by creating a multitude of objects within it.

RegisterDma

Purpose

Creates a DMA buffer.

Parameters

• [in] size – size of the DMA buffer in bytes.
• [in] flags – flags defining the DMA buffer parameters.
• [in] order – parameter defining the minimum number of memory pages (2^order) in a block.
• [out] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the DMA buffer.
• [out] rc – return code.

Allows the following:

• Exhaust the kernel memory by creating a multitude of objects within it.
• Exhaust the RAM.

RegisterIrq

Purpose

Registers an interrupt.

Parameters

• [in] irq – interrupt number.
• [out] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the interrupt.
• [out] rc – return code.

Allows the kernel memory to be used up by creating a multitude of objects within it.

MapMem

Purpose

Reserves the virtual memory region and maps the MMIO memory region to it.

Parameters

• [in] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MMIO memory region.
• [in] prot – flags defining the access rights to the virtual memory region.
• [in] attr – flags defining the parameters of the virtual memory region (for example, use of caching).
• [out] address – base address of the virtual memory region.
• [out] mapping – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is used to free the virtual memory region.
• [out] rc – return code.

Allows the following:

• Take control of a device when mapping an MMIO memory region to a virtual memory region (it is recommended to monitor the base address and size of the MMIO memory region when the RegisterMmio method is called).
• Create shared memory for interprocess communication concealed from the security module if multiple processes own the handles of one MMIO memory region (the handle permissions masks must allow mapping of the MMIO memory region).
• Exhaust the kernel memory by creating a multitude of objects within it.

PermitPort

Purpose

Opens access to I/O ports.

Parameters

• [in] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the sequence of I/O ports.
• [out] access – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is used to close access to I/O ports.
• [out] rc – return code.

Allows the following:

• Take control of a device (it is recommended to monitor the address of the first I/O port and the number of I/O ports in the sequence when the RegisterPort method is called).
• Exhaust the kernel memory by creating a multitude of objects within it.

AttachIrq

Purpose

Attaches the calling thread to an interrupt.

Parameters

• [in] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the interrupt.
• [in] flags – flags defining the interrupt parameters.
• [out] delivery – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is the client IPC handle that is used by the interrupt handler.
• [out] rc – return code.

Allows the following:

• Take CPU time from all other threads, including from other processes (the thread that attached to the interrupt will become a real-time thread).
• Make it impossible to terminate a process from another process (the process whose thread was attached to the interrupt cannot be terminated from another process).
• Stop the operating system (if an unhandled exception occurs in the thread handling an interrupt, the operating system stops).
• Lock, delay, or incorrectly handle an interrupt (it is recommended to monitor the interrupt number when the RegisterIrq method is called).
• Exhaust the kernel memory by creating a multitude of objects within it.

DetachIrq

Purpose

Sends a request to a thread. When this request is fulfilled, the thread must detach from the interrupt.

Parameters

• [in] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the interrupt.
• [out] rc – return code.

Stops interrupt handling in another process.

EnableIrq

Purpose

Allows (unmasks) an interrupt.

Parameters

• [in] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the interrupt.
• [out] rc – return code.

Allows an interrupt at the system level.

DisableIrq

Purpose

Denies (masks) an interrupt.

Parameters

• [in] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the interrupt.
• [out] rc – return code.

Denies an interrupt at the system level.

ModifyDma

Purpose

Modifies the DMA buffer cache settings.

Parameters

• [in] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the DMA buffer.
• [in] flags – flags defining the DMA buffer caching parameters.
• [out] rc – return code.

N/A

MapDma

Purpose

Reserves a virtual memory region and maps the DMA buffer to it.

Parameters

• [in] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the DMA buffer.
• [in] offset – offset (in bytes) in the DMA buffer where mapping should start.
• [in] length – size (in bytes) of the part of the DMA buffer that needs to be mapped.
• [in] hint – preferred base address of the virtual memory region, or 0 for the base address to be selected automatically.
• [in] prot – flags defining the access rights to the virtual memory region.
• [out] address – base address of the virtual memory region.
• [out] mapping – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle is used to free the virtual memory region.
• [out] rc – return code.

Allows the following:

• Create shared memory for interprocess communication concealed from the security module if multiple processes own the handles of one DMA buffer (the handle permissions masks must allow mapping of the DMA buffer).
• Exhaust the kernel memory by creating a multitude of objects within it.

DmaGetInfo

Purpose

Gets information about a DMA buffer.

Parameters

• [in] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the DMA buffer.
• [out] flags – flags indicating the DMA parameters.
• [out] order – parameter indicating the minimum number of memory pages (2^order) in a block.
• [out] size – size of the DMA buffer in bytes.
• [out] count – number of blocks.
• [out] frames – sequence containing the addresses and sizes of blocks.
• [out] rc – return code.

N/A

DmaGetPhysInfo

Purpose

Gets information about the physical memory that was used to create a DMA buffer.

Parameters

• [in] handle – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the DMA buffer.
• [out] count – number of blocks.
• [out] frames – sequence containing the addresses and sizes of blocks.
• [out] rc – return code.

N/A

BeginDma

Purpose

Opens access to a DMA buffer for a device.

Parameters

• [in] resource – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the DMA buffer.
• [out] iomapping – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the kernel object that contains the addresses and sizes of blocks required by the device to use the DMA buffer. The memory addresses used by the device can be physical addresses or virtual addresses depending on whether the IOMMU is enabled.
• [out] rc – return code.

Allows the kernel memory to be used up by creating a multitude of objects within it.