MiCommitExistingVad
NTSTATUS __stdcall MiCommitExistingVad(
_MMVAD_SHORT *Vad,
VOID *StartingAddress,
UINT64 NonRoundedRegionSize,
UINT64 Protect,
UINT64 *ChangeProtection,
INT64 a6,
INT64 a7,
INT64 a8,
INT64 a9,
INT64 a10,
INT64 a11,
INT64 a12){
_MMVAD_SHORT *v13;
int v15;
char v16;
unsigned int v17;
unsigned int v18;
int v19;
int v20;
_MMPTE *PteBase;
_EPROCESS *Process;
unsigned __int64 v23;
__int64 v24;
unsigned __int64 v25;
_MMPTE *v26;
unsigned __int64 v27;
unsigned __int64 v28;
__int64 v29;
unsigned __int64 v30;
__int64 v31;
__int64 v32;
unsigned int v33;
NTSTATUS result;
__int64 v35;
UINT8 v36;
UINT8 v37;
__int64 v38;
__int64 v39;
bool v40;
UINT64 v41;
UINT64 v42;
__int64 ********LockedVadEvent;
INT64 v44;
INT64 *v45;
INT64 v46;
int LargePfnList;
union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v48;
int v49;
_MMPFN *v50;
UINT64 v51;
int v52;
unsigned int v53;
INT64 v54;
__int64 v55;
_MMSUPPORT_INSTANCE *v56;
UINT8 v57;
void *ExtraCreateInfo;
_EX_PUSH_LOCK *p_PageTableCommitmentLock;
int v60;
unsigned __int64 v61;
UINT64 v62;
unsigned int v63;
_MMSUPPORT_INSTANCE *v64;
unsigned __int64 v65;
NTSTATUS v66;
_MMPTE *i;
_MMPTE *v68;
NTSTATUS v69;
void *v70;
_MMSUPPORT_SHARED *SharedVm;
_MMPTE *Pml4eBase;
INT64 v73;
_MMPTE *PxeUserLimit;
unsigned __int64 v75;
int v76;
unsigned __int64 v77;
union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v78;
unsigned __int64 v79;
char *v80;
CHAR *v81;
_MMPFN *PfnDb;
__int64 v83;
__int64 v84;
NTSTATUS PageProtection;
_ETHREAD *v86;
UINT64 v87;
UINT64 v88;
union {unsigned int LongFlags1;_MMVAD_FLAGS1 VadFlags1;} v89;
__int64 LongFlags1;
UINT64 v91;
UINT64 *ReducedCommitClonePages;
NTSTATUS ProtectionMask;
__int64 v94;
int v95;
_EPROCESS *TargetProcess;
unsigned int v97;
int v98;
_MMSUPPORT_INSTANCE *Vm;
PVOID BugCheckParameter3;
int WsExclusive;
int WsExclusive_4;
int v103;
UINT64 v104;
UINT64 v105;
UINT64 a2;
UINT64 SpinCount;
unsigned __int64 v108;
UINT64 v109;
unsigned __int64 v110;
__int64 v111;
_ETHREAD *CurrentThread;
UINT64 QuotaCharge;
unsigned __int64 v114;
_MMPFN *v115;
UINT8 WsIrql[8];
INT64 *v117;
__int64 v118;
CHAR v119[16];
__int128 v120;
UINT8 v122;
v13 = Vad;
*(_QWORD *)WsIrql = 0i64;
WsExclusive = 0;
*(_OWORD *)v119 = 0i64;
v120 = 0i64;
ProtectionMask = MiMakeProtectionMask((unsigned int)Protect);
v18 = ProtectionMask;
if( ProtectionMask == 24 )
goto LABEL_17;
if( v15 == 24 )
{
if( (v17 & 0x100000) == 0 )
v15 = (*((unsigned __int16 *)v13[1].ExtraCreateInfo + 16) >> 1) & 0x1F;
if( v15 == 24 )
LOBYTE(v15) = 0;
}
v19 = v15 & 0x18;
if( v19 )
{
if( v19 != 16 )
{
if( v19 == 8 )
{
v18 = ProtectionMask & 0xFFFFFFE7 | 8;
}
else
{
if( v19 != 24 )
goto LABEL_18;
v18 = ProtectionMask | 0x18;
}
goto LABEL_17;
}
goto LABEL_16;
}
v20 = ProtectionMask & 0x18;
if( v20 != 24 )
{
if( v20 != 8 )
goto LABEL_18;
LABEL_16:
v18 = ProtectionMask & 0xFFFFFFF7;
goto LABEL_17;
}
v18 = ProtectionMask & 0xFFFFFFE7;
LABEL_17:
ProtectionMask = v18;
LABEL_18:
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
PteBase = MmGetPteBase();
Process = CurrentThread->Tcb.ApcState.Process;
TargetProcess = Process;
if( (v13->u1.LongFlags1 & 0x80000000) == 0 )
v23 = 0i64;
else
v23 = (unsigned __int64)&PteBase[(v13->EndingVpn | ((unsigned __int64)v13->EndingVpnHigh << 32)) & 0xFFFFFFFFFi64];
v110 = v23;
v118 = 32i64 * (v18 & 0x1F);
v24 = v118;
if( *(&stru_140C4DB30 + 42) )
{
if( (v118 & *(&stru_140C4DB30 + 42)) != 0 )
v24 = v118 | 0x10;
else
v24 = *(&stru_140C4DB30 + 42) | v118;
}
if( (v17 & 0x100000) != 0 && (v17 & 0x1000000) == 0 && (v17 & 0x4000000) != 0 )
v24 |= 0x4000000ui64;
a2 = (UINT64)PteBase + (((unsigned __int64)StartingAddress >> 9) & 0x7FFFFFFFF8i64);
v25 = ((unsigned __int64)StartingAddress + NonRoundedRegionSize - 1) | 0xFFF;
v26 = MmGetPteBase();
v27 = a2;
v28 = (unsigned __int64)v26 + ((v25 >> 9) & 0x7FFFFFFFF8i64);
v29 = v16 & 0x1A;
v114 = v28;
Vm = &Process->Vm.Instance;
QuotaCharge = ((__int64)(v28 - a2) >> 3) + 1;
if( (v17 & 0x500000) == 5242880 )
{
v30 = ((unsigned __int64)v17 >> 18) & 3;
v31 = 16i64;
v32 = MiVadPageSizes[v30];
v33 = MiVadPageIndices[v30];
v94 = v32;
if( v32 != 16 )
v31 = 1i64;
v97 = v33;
v111 = v31;
if( v33 > 1 )
{
if( v29 == 2 )
goto LABEL_40;
}
else
{
if( v33 == 1 )
{
if( v29 != 8 )
return -1073741811;
goto LABEL_37;
}
if( v29 == 16 )
{
LABEL_37:
v35 = 2 - v33;
do
{
v27 = (unsigned __int64)v26 + ((v27 >> 9) & 0x7FFFFFFFF8i64);
v28 = (unsigned __int64)v26 + ((v28 >> 9) & 0x7FFFFFFFF8i64);
v23 = (unsigned __int64)v26 + ((v23 >> 9) & 0x7FFFFFFFF8i64);
--v35;
}
while( v35 );
v110 = v23;
v114 = v28;
goto LABEL_40;
}
}
return -1073741811;
}
if( v29 )
return -1073741811;
v94 = 1i64;
v32 = 1i64;
v111 = 1i64;
v97 = 3;
if( MiChargeFullProcessCommitment(
(ULONG_PTR)TargetProcess,
((__int64)((__int64)v26 + ((v25 >> 9) & 0x7FFFFFFFF8i64) - a2) >> 3) + 1) >= 0 )
{
v42 = QuotaCharge;
v105 = QuotaCharge;
v103 = 1;
LABEL_71:
v48.LongFlags = (unsigned int)v13->u;
WsExclusive_4 = 0;
if( (v48.LongFlags & 0x100000) != 0 )
{
if( (v48.LongFlags & 0x70) != 0 || (v13->u1.LongFlags1 & 0x80000000) != 0 )
goto LABEL_74;
}
else
{
if( (v48.LongFlags & 0xF80) != 3072 )
goto LABEL_74;
ExtraCreateInfo = v13[1].ExtraCreateInfo;
if( *(_QWORD *)(*(_QWORD *)ExtraCreateInfo + 64i64)
|| (*(_DWORD *)(*(_QWORD *)ExtraCreateInfo + 56i64) & 0x1000) == 0 )
{
goto LABEL_74;
}
}
WsExclusive_4 = 1;
--CurrentThread->Tcb.SpecialApcDisable;
p_PageTableCommitmentLock = &TargetProcess->PageTableCommitmentLock;
ExAcquirePushLockExclusiveEx(&TargetProcess->PageTableCommitmentLock, 0i64);
if( MiCommitPageTablesForVad(v13, StartingAddress, (VOID *)v25) >= 0 )
{
LABEL_74:
v49 = 0;
v104 = 0i64;
v98 = 0;
v50 = 0i64;
v115 = 0i64;
while( 1 )
{
v51 = 0i64;
v52 = 0;
v95 = 0;
if( !v97 )
{
v53 = MiComputePreferredNode((INT64)Vad);
v95 = 1;
v122 = MiLockWorkingSetForLargeMapping(Vm, v54, v53);
if( v122 != 17 )
goto LABEL_87;
}
v56 = Vm;
MiLockWorkingSetShared();
v122 = v57;
while( 2 )
{
if( v27 > v114 )
{
if( (_WORD)v49 )
{
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&v50->u2, 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( v50->u2._bf_0 < 0 );
}
v50->OriginalPte.u.Long ^= ((unsigned int)v50->OriginalPte.u.Long ^ ((unsigned int)v50->OriginalPte.u.Long
+ ((unsigned __int16)v49 << 16))) & 0x3FF0000;
_InterlockedAnd64(&v50->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
if( (unsigned __int16)v49 <= 1u )
MmIsAddressValidEx(v50->PteLong | 0x8000000000000000ui64);
}
if( v95 == 1 )
{
MiUnlockWorkingSetExclusive(v56, v122);
}
else
{
if( v51 )
MiUnlockPageTableInternal((INT64)v56, v51);
MiUnlockWorkingSetShared(v56, v122);
}
if( WsExclusive_4 == 1 )
{
if( (_InterlockedExchangeAdd64(&TargetProcess->PageTableCommitmentLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&TargetProcess->PageTableCommitmentLock);
KeAbPostRelease(&TargetProcess->PageTableCommitmentLock);
v86 = CurrentThread;
v40 = CurrentThread->Tcb.SpecialApcDisable++ == -1;
if( v40 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v86->Tcb.ApcState.ApcListHead[0].Flink != &v86->Tcb.152 )
KiCheckForKernelApcDelivery();
}
if( v103 == 1 )
{
v87 = v104;
if( v104 )
MiReturnFullProcessCommitment(TargetProcess, v104);
v88 = QuotaCharge - v87;
}
else
{
v88 = v105;
}
v89.LongFlags1 = (unsigned int)Vad->u1;
LongFlags1 = v89.LongFlags1;
LODWORD(LongFlags1) = v89.LongFlags1 & 0x7FFFFFFF;
v91 = v88 + (((unsigned __int64)Vad->CommitChargeHigh << 31) | LongFlags1);
Vad->CommitChargeHigh = v91 >> 31;
Vad->u1.LongFlags1 = v89.LongFlags1 ^ (v91 ^ v89.LongFlags1) & 0x7FFFFFFF;
return 0;
}
if( v52 && (v27 & 0xFFF) != 0 )
{
Pml4eBase = MmGetPml4eBase();
goto LABEL_119;
}
if( (_WORD)v49 )
{
MiIncreaseUsedPtesCount(v50, (VOID *)(unsigned __int16)v49);
v60 = 0;
v98 = 0;
}
else
{
v60 = 0;
}
if( v51 )
MiUnlockPageTableInternal((INT64)v56, v51);
v61 = (unsigned __int64)MmGetPteBase();
v62 = v61 + ((v27 >> 9) & 0x7FFFFFFFF8i64);
v117 = 0i64;
v109 = v62;
v63 = (Vad->u.LongFlags >> 12) & 0x3F;
BugCheckParameter3 = KeGetCurrentThread()->ApcState.Process;
v64 = (_MMSUPPORT_INSTANCE *)((char *)BugCheckParameter3 + 1664);
v65 = (__int64)((v27 << 25) - (v61 << 25)) >> 16;
if( v65 < v61 || v65 > (unsigned __int64)MmGetPteLimit() )
v60 = 1;
while( 1 )
{
if( v95 )
{
if( MmIsAddressValidEx(v27) )
goto LABEL_114;
MiUnlockWorkingSetExclusive(v64, v122);
goto LABEL_109;
}
if( v60 )
{
v66 = MiFastLockLeafPageTable((INT64)v64, v65);
if( v66 )
break;
}
v68 = MiLockLowestValidPageTable((INT64)v64, (INT64 *)v27, &v117);
if( v68 == (_MMPTE *)v62 )
goto LABEL_114;
MiUnlockPageTableInternal((INT64)v64, (UINT64)v68);
MiUnlockWorkingSetShared(v64, v122);
LABEL_109:
v69 = MmAccessFault(((unsigned __int64)v63 << 57) | 0x100000000000002i64, (PVOID)v27, 0, 0i64);
v70 = (void *)v69;
if( v69 < 0 )
{
MiFlushAllFilesystemPages();
KeBugCheckEx(0x7Au, (PVOID)1, v70, BugCheckParameter3, (PVOID)v27);
}
if( v95 )
{
SharedVm = MiGetSharedVm(v64);
ExAcquireSpinLockExclusive((INT64 *)&SharedVm->WorkingSetLock);
SharedVm->GoodCitizenWaiting = 0;
}
else
{
MiLockWorkingSetShared();
}
v62 = v109;
}
if( v66 != 1 )
{
for( i = MmGetPteBase(); ; v62 = (UINT64)i + ((v62 >> 9) & 0x7FFFFFFFF8i64) )
;
}
LABEL_114:
Pml4eBase = MmGetPml4eBase();
if( v27 >= (unsigned __int64)Pml4eBase && v27 <= (unsigned __int64)MmGetPml4eLimit() )
{
v50 = v115;
v52 = 1;
v51 = v109;
v49 = v98;
}
else
{
v55 = (__int64)MmGetPdeBase() + ((v65 >> 18) & 0x3FFFFFF8);
v108 = *(_QWORD *)v55;
v51 = v109;
v50 = &MmGetPfnDb()[(v108 >> 12) & 0xFFFFFFFFFi64];
v49 = v98;
v52 = 1;
v115 = v50;
}
LABEL_119:
v73 = *(_QWORD *)v27;
PxeUserLimit = MmGetPxeUserLimit();
BugCheckParameter3 = (PVOID)v73;
if( !v73 )
{
if( v27 <= v110 )
v104 += v94;
if( v94 == 1 )
{
if( v27 < (unsigned __int64)Pml4eBase || v27 > (unsigned __int64)MmGetPml4eLimit() )
{
LOWORD(v49) = v111 + v49;
v98 = v49;
}
v75 = v24;
if( v27 >= (unsigned __int64)Pml4eBase
&& v27 <= (unsigned __int64)PxeUserLimit
&& (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0
&& (v24 & 1) != 0 )
{
v75 = v24 | 0x8000000000000000ui64;
}
*(_QWORD *)v27 = v75;
goto LABEL_159;
}
LABEL_151:
v80 = *(char **)&v119[8 * v97];
v81 = &v119[8 * v97];
if( !v80 )
{
MiDemotePfnListChain((INT64)v119, v97);
v80 = *(char **)v81;
}
*(_QWORD *)v81 = *(_QWORD *)v80;
PfnDb = MmGetPfnDb();
v83 = (v80 - (char *)PfnDb) / 48;
MiInitializeLargeUserBasePfn(&PfnDb[v83], a2, (UINT64)TargetProcess);
MiInsertLargeUserMapping(Vad, (_MMPTE)a2, v83, v97);
goto LABEL_159;
}
if( &BugCheckParameter3 < (PVOID *)Pml4eBase || &BugCheckParameter3 > (PVOID *)PxeUserLimit )
v55 = v73;
if( (v55 & 0x3E0) == 512 && (v55 & 1) == 0 )
{
if( (v55 & 0x400) == 0 || (LOBYTE(v76) = MiIsPrototypePteVadLookup(v55), v76) )
{
if( v94 != 1 )
goto LABEL_151;
v77 = v118 | v73 & 0xFFFFFFFFFFFFFC1Fui64;
BugCheckParameter3 = (PVOID)v77;
v55 = v77;
v78.LongFlags = (unsigned int)Vad->u;
if( (v78.LongFlags & 0x100000) != 0
&& (v78.LongFlags & 0x1000000) == 0
&& (v78.LongFlags & 0x4000000) != 0 )
{
v55 = v77 | 0x4000000;
BugCheckParameter3 = (PVOID)(v77 | 0x4000000);
}
if( v27 >= (unsigned __int64)Pml4eBase
&& v27 <= (unsigned __int64)PxeUserLimit
&& (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 )
{
v79 = v55 | 0x8000000000000000ui64;
if( (v55 & 1) == 0 )
v79 = v55;
*(_QWORD *)v27 = v79;
}
else
{
*(_QWORD *)v27 = v55;
}
LABEL_159:
v84 = v94;
LABEL_160:
v27 += 8 * v111;
a2 += 8 * v84;
LABEL_87:
v56 = Vm;
continue;
}
}
break;
}
v84 = v94;
v104 += v94;
if( *(_DWORD *)a9 )
goto LABEL_160;
PageProtection = MiGetPageProtection(Vad, (PVOID)v27, (UINT8)WsIrql, (UINT64)&WsExclusive);
if( !*(_QWORD *)WsIrql )
{
if( ProtectionMask != PageProtection || WsExclusive != (_DWORD)ChangeProtection )
*(_DWORD *)a9 = 1;
goto LABEL_159;
}
if( (_WORD)v49 )
{
MiIncreaseUsedPtesCount(v50, (VOID *)(unsigned __int16)v49);
v49 = 0;
v98 = 0;
}
if( v95 == 1 )
{
MiUnlockWorkingSetExclusive(Vm, v122);
}
else
{
MiUnlockPageTableInternal((INT64)Vm, v51);
MiUnlockWorkingSetShared(Vm, v122);
}
}
}
if( (_InterlockedExchangeAdd64(&p_PageTableCommitmentLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(p_PageTableCommitmentLock);
KeAbPostRelease(p_PageTableCommitmentLock);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
if( v42 )
MiReturnFullProcessCommitment(TargetProcess, v42);
return -1073741523;
}
LABEL_40:
v103 = 0;
MiLockWorkingSetShared();
LODWORD(ReducedCommitClonePages) = 0;
v37 = v36;
LODWORD(v38) = MiComputePageCommitment(
(VOID *)((unsigned __int64)StartingAddress & 0xFFFFFFFFFFFFF000ui64),
(VOID *)v25,
Vad,
v36,
ReducedCommitClonePages);
v39 = v38;
MiUnlockWorkingSetShared(Vm, v37);
v105 = QuotaCharge - v39;
if( QuotaCharge == v39 )
{
v42 = QuotaCharge - v39;
goto LABEL_70;
}
v40 = v32 == 1;
v41 = QuotaCharge - v39;
v42 = QuotaCharge - v39;
if( v40 )
{
result = MiChargeFullProcessCommitment((ULONG_PTR)TargetProcess, v41);
if( result < 0 )
return result;
goto LABEL_70;
}
if( !MiChargeProcessPhysicalPages(TargetProcess, v41) )
return -1073741523;
LockedVadEvent = MiLocateLockedVadEvent((__int64)Vad, 16);
if( LockedVadEvent )
v45 = (INT64 *)LockedVadEvent[3];
else
v45 = 0i64;
if( a8 != 1 && (INT64 *)a8 != v45 )
{
MiReturnProcessPhysicalPages(v44, v42);
return -1073741811;
}
if( v45 )
{
if( !PsReferencePartitionSafe((INT64)v45) )
{
MiReturnProcessPhysicalPages(v46, v42);
return -1073740640;
}
*(_WORD *)a10 = *(_WORD *)*v45;
}
else if( MiChargeFullProcessCommitment(v44, v42) < 0 )
{
MiReturnProcessPhysicalPages((INT64)TargetProcess, v42);
return result;
}
LargePfnList = MiCreateLargePfnList((INT64)Vad, v42, a7, v45, v119);
if( v45 )
PsDereferencePartition((INT64)v45);
if( LargePfnList >= 0 )
{
LABEL_70:
v13 = Vad;
goto LABEL_71;
}
if( !v45 )
MiReturnFullProcessCommitment(TargetProcess, v42);
MiReturnProcessPhysicalPages((INT64)TargetProcess, v42);
return LargePfnList;
}Referenced by:
MiAllocateFromSubAllocatedRegion
MiLoadDataIntoVsmEnclave
MiLoadSectionIntoVsmEnclave