[PATCH 0/1] MR10985: ntdll: Notify ARM64EC memory tracking for non-image section maps

[Daniel Lu (＠dllu)]

NtMapViewOfSection reports ARM64EC image mappings through NotifyMapViewOfSection, but executable non-image section mappings currently return before any ARM64EC memory notification is sent. Those mappings can replace a previously tracked executable range. This patch reports non-image mappings through the existing memory-protection notification callback so the ARM64EC runtime sees the final mapped protection. This fixes a reduced FEX repro where an executable pagefile section is mapped over a previously executed allocation and then executed.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10985

[PATCH 1/1] ntdll: Notify ARM64EC memory tracking for non-image section maps.

[Daniel Lu]

From: Daniel Lu <[e-mail]>

NtMapViewOfSection currently notifies the ARM64EC runtime about image mappings through NotifyMapViewOfSection, but non-image section mappings return before any notification is sent.

Those mappings can still create executable views and can replace a previously tracked executable range. Report them through the existing memory-protection notification callback so the ARM64EC runtime sees the final mapped protection.
---
 dlls/ntdll/signal_arm64ec.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/dlls/ntdll/signal_arm64ec.c b/dlls/ntdll/signal_arm64ec.c
index c0bfab1157e..4af3cca2d85 100644
--- a/dlls/ntdll/signal_arm64ec.c
+++ b/dlls/ntdll/signal_arm64ec.c
@@ -725,9 +725,17 @@ static void notify_map_view_of_section( HANDLE handle, void *addr, SIZE_T size,
     SECTION_IMAGE_INFORMATION info;
     NTSTATUS status;
 
+    if (NtQuerySection( handle, SectionImageInformation, &info, sizeof(info), NULL ))
+    {
+        if (pNotifyMemoryProtect)
+        {
+            pNotifyMemoryProtect( addr, size, protect, FALSE, 0 );
+            pNotifyMemoryProtect( addr, size, protect, TRUE, STATUS_SUCCESS );
+        }
+        return;
+    }
     if (!pNotifyMapViewOfSection) return;
     if (!NtCurrentTeb()->Tib.ArbitraryUserPointer) return;
-    if (NtQuerySection( handle, SectionImageInformation, &info, sizeof(info), NULL )) return;
     status = pNotifyMapViewOfSection( NULL, addr, NULL, size, alloc, protect );
     if (NT_SUCCESS(status)) return;
     NtUnmapViewOfSection( GetCurrentProcess(), addr );
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/10985

[Alexandre Julliard (＠julliard)]

I doubt that this is what Windows does. It would need some tests.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10985#note_141234

[PATCH 0/1] MR10985: Draft: ntdll: Notify ARM64EC memory tracking for non-image section maps - closed

[Daniel Lu (＠dllu)]

This merge request was closed by Daniel Lu.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10985

[PATCH 0/1] MR10985: Draft: ntdll: Notify ARM64EC memory tracking for non-image section maps

[Daniel Lu (＠dllu)]

I'm closing this MR because:

1. Upon more careful review of https://gitlab.winehq.org/wine/wine/-/wikis/Developer-FAQ#can-i-contribute-c... I realized that LLM-generated code is not allowed and this MR contains some LLM-generated code (as disclosed in the last sentence of my MR).
2. I was able to verify that Alexandre's concern is right. Indeed, this isn't what Windows does.

I'll continue debugging the SC2 x64 crash on ARM64 and I will be mindful of the LLM thing going forward and refrain from using AI to write code for my future MRs.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10985#note_141473