MiIdealClusterPage
_MMPFN *__stdcall MiIdealClusterPage(
VOID *VirtualAddress,
_MMVAD *Vad,
_MMPTE *PointerPte,
_MMPTE ComparePte,
_MMSUPPORT_INSTANCE *Vm,
_MMPFN *Pfn1,
_MMPFN *LockedProtoPfn,
CHAR PreviousMode,
UINT8 *ReturnedPageIsIdeal){
unsigned int v11;
_MMSUPPORT_INSTANCE *v12;
__int64 v13;
unsigned __int64 v14;
bool v15;
unsigned __int64 v16;
char *v17;
__int64 v18;
unsigned __int64 v19;
_MI_PARTITION *v20;
_MMPTE *v21;
__int64 v22;
_MMPFN *PfnDb;
unsigned __int64 v24;
__int64 v25;
UINT64 *v26;
unsigned int v27;
UINT64 v28;
UINT64 v29;
int v30;
unsigned int v31;
signed __int32 v32;
__int64 v34;
struct _KPRCB *CurrentPrcb;
__int64 CachedResidentAvailable;
signed __int32 v37;
__int128 v38;
__int128 v39;
__int128 v40;
__int128 v41;
unsigned __int8 CurrentIrql;
_MI_PFN_CACHE_ATTRIBUTE v43;
__int64 a6;
unsigned int v45;
_MMPFN *LargePage;
_MMPFN *v47;
struct _KPRCB *v48;
__int64 v49;
__int64 v50;
signed __int32 v51;
_MMPFN *v52;
__int64 v53;
__int64 v54;
__int64 v55;
_MMSUPPORT_INSTANCE *v56;
_MMPFN *v57;
int v58;
char v59;
_MMPFN *v60;
_MMPFN *v61;
_MMPFN *v62;
_MMPTE *v63;
unsigned __int64 v64;
struct _KPRCB *v65;
__int64 v66;
signed __int32 v67;
struct _KPRCB *v68;
__int64 v69;
signed __int32 v70;
_LIST_ENTRY **EntryArray;
UINT64 PreferredNode;
UINT64 Flags;
UINT64 *StartingPfn;
char v75;
char v76[7];
_MMVAD *v77;
_MMPFN *v78;
_MMPFN *NewPfn;
_MMPFN *ProtoPfn;
__int64 v81;
UINT64 SpinCount;
UINT64 v83;
UINT64 v84;
VOID *FaultingAddress;
unsigned __int64 Long;
_MMSUPPORT_INSTANCE *v87;
__int64 v88;
__int64 v89;
__int64 v90;
UINT64 SourcePage;
_MMPFN *v92;
_MI_COLOR_BASE ColorBase[4];
INT16 v94[4];
_MMPTE *PointerPteContents;
_LIST_ENTRY buf1;
__int128 v97;
__int128 v98;
__int128 v99[3];
char v100[128];
v77 = Vad;
FaultingAddress = VirtualAddress;
Long = ComparePte.u.Long;
ProtoPfn = Pfn1;
v11 = *((_DWORD *)VirtualAddress + 20);
v12 = (_MMSUPPORT_INSTANCE *)*((_QWORD *)VirtualAddress + 7);
v13 = *(_QWORD *)VirtualAddress;
LODWORD(v78) = v11 >> 6;
LockedProtoPfn->$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::gap0[0] = 0;
v92 = LockedProtoPfn;
PointerPteContents = PointerPte;
v14 = ((v13 & 0xFFFFFFFFFFFFF000ui64) - (v13 & 0xFFFFFFFFFFFF0000ui64)) >> 12;
v15 = (Vad->Core.u.LongFlags & 0x100000) == 0;
v76[0] = 0;
v89 = 0i64;
v81 = 0i64;
buf1 = 0i64;
v87 = v12;
v97 = 0i64;
v88 = v14;
v98 = 0i64;
v90 = 16i64;
*(_OWORD *)ColorBase = 0i64;
if( v15 )
{
MiGetProtoPteAddress();
return(_MMPFN *)Vm;
}
v16 = Vm->TrimmedPageCount | 0x8000000000000000ui64;
if( v16 < (unsigned __int64)MmGetPteBase() || v16 > (unsigned __int64)MmGetPteLimit() )
return(_MMPFN *)Vm;
v17 = v100;
v18 = 16i64;
v19 = 1i64;
v20 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8i64 * v12->PartitionId);
v21 = &PointerPte[-v14];
do
{
LODWORD(v22) = MI_READ_PTE_LOCK_FREE((INT64)v21++);
*(_QWORD *)v17 = v22;
v17 += 8;
--v18;
}
while( v18 );
PfnDb = MmGetPfnDb();
v24 = -1i64;
v25 = ((char *)Vm - (char *)PfnDb) / 48;
v26 = (UINT64 *)v100;
SourcePage = v25;
v27 = 0;
while( 1 )
{
v28 = *v26;
NewPfn = (_MMPFN *)v28;
v84 = v28;
if( (v28 & 1) != 0 )
break;
++v27;
++v26;
if( v27 >= 0x10 )
goto LABEL_13;
}
v29 = v28;
MiPteInShadowRange((UINT64)&v84);
v24 = (v29 >> 12) & 0xFFFFFFFFFi64;
if( (v24 & 0xF) != v27 )
return(_MMPFN *)Vm;
LOBYTE(v25) = SourcePage;
PfnDb = MmGetPfnDb();
LABEL_13:
NewPfn = 0i64;
v75 = 0;
if( v27 != 16 )
{
v24 += v14 - v27;
if( v24 > 0xFFFFFFFFFi64 || (MmGetPfnDb()[v24].u4._bf_0 & 0x4000000000000i64) == 0 )
return(_MMPFN *)Vm;
NewPfn = &PfnDb[v24];
if( NewPfn != (_MMPFN *)Vm )
{
LODWORD(v34) = MiSearchNumaNodeTable((PVOID)v24);
v31 = *(_DWORD *)(v34 + 8);
LODWORD(v77) = *(&stru_140C4DB30 + 66) & v24;
goto LABEL_23;
}
LABEL_20:
v92->$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::gap0[0] = 1;
return(_MMPFN *)Vm;
}
if( (v25 & 0xF) == v14 )
goto LABEL_20;
MiAcquireNonPagedResources(v20, 1ui64);
if( v30 < 0 )
return(_MMPFN *)Vm;
v75 = 1;
MiInitializePageColorBase(v87, (v77->Core.u.LongFlags >> 12) & 0x3F, ColorBase);
v31 = (unsigned int)ColorBase[3] >> *(&stru_140C4DB30 + 156);
v32 = _InterlockedExchangeAdd(*(volatile signed __int32 **)ColorBase, 1u);
LODWORD(v77) = ColorBase[3] | ColorBase[2] & v32;
LABEL_23:
v20->Core.NodeInformation[v31].LargePageRebuildTimer.LargeSubPagesActive = 1;
Vm->WorkingSetExpansionLinks.Flink = (_LIST_ENTRY *)((unsigned __int64)Vm->WorkingSetExpansionLinks.Flink & 0xC000000000000000ui64);
if( MiAddLockedPageCharge((_MMPFN *)Vm, 0i64) == MiChargeFailed )
{
if( v75 == 1 )
{
MiReturnCommit(v20, 1ui64);
if( v20 != &Irp )
goto LABEL_36;
CurrentPrcb = KeGetCurrentPrcb();
CachedResidentAvailable = (int)CurrentPrcb->CachedResidentAvailable;
if( (_DWORD)CachedResidentAvailable == -1 )
goto LABEL_36;
if( (unsigned __int64)(CachedResidentAvailable + 1) <= 0x100 )
{
do
{
v37 = _InterlockedCompareExchange(
(volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
CachedResidentAvailable + 1,
CachedResidentAvailable);
v15 = (_DWORD)CachedResidentAvailable == v37;
LODWORD(CachedResidentAvailable) = v37;
if( v15 )
return(_MMPFN *)Vm;
}
while( v37 != -1 && (unsigned __int64)(v37 + 1i64) <= 0x100 );
}
if( (int)CachedResidentAvailable > 192
&& (_DWORD)CachedResidentAvailable != -1
&& (_DWORD)CachedResidentAvailable == _InterlockedCompareExchange(
(volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
192,
CachedResidentAvailable) )
{
v19 = (int)CachedResidentAvailable - 192 + 1i64;
}
if( v19 )
LABEL_36:
_InterlockedExchangeAdd64((volatile signed __int64 *)&v20->Vp.ResidentAvailablePages, v19);
}
return(_MMPFN *)Vm;
}
v38 = *(_OWORD *)&Vm->VmWorkingSetList;
v99[0] = *(_OWORD *)&Vm->NextPageColor;
v39 = *(_OWORD *)&Vm->WorkingSetExpansionLinks.Blink;
v99[1] = v38;
v99[2] = v39;
_InterlockedAnd64((volatile signed __int64 *)&Vm->WorkingSetExpansionLinks, 0x7FFFFFFFFFFFFFFFui64);
if( ProtoPfn )
{
MiObtainProtoReference(ProtoPfn, 0i64);
v40 = *((_OWORD *)&ProtoPfn->3 + 1);
buf1 = ProtoPfn->ListEntry;
v41 = *(_OWORD *)&ProtoPfn->u3.ReferenceCount;
v97 = v40;
v98 = v41;
MiUnlockProtoPoolPage((ULONG_PTR)ProtoPfn, 0x11u);
}
*(_QWORD *)v94 = MiReleaseFaultState((INT64)FaultingAddress + 56, 1u, v76);
if( v75 == 1 )
{
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
v76[0] = CurrentIrql;
v43 = MiProtectionToCacheAttribute((Long >> 5) & 0x1F);
LargePage = (_MMPFN *)MiGetLargePage((INT64)v20, v45, v43, (unsigned int)v77, 4, a6);
v78 = LargePage;
v47 = LargePage;
if( LargePage )
{
MiConvertEntireLargePageToSmall((_KQUEUE *)LargePage, 2, 2u, (_LARGE_INTEGER *)1, 0i64, 0i64);
v52 = v47;
v53 = v88;
v54 = (unsigned __int128)(((char *)v52 - (char *)MmGetPfnDb()) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64;
v55 = ((unsigned __int64)v54 >> 63) + (v54 >> 3);
v56 = (_MMSUPPORT_INSTANCE *)NewPfn;
v81 = v55;
do
{
v87 = v56;
if( (MiFlags & 0x80u) != 0 && (++*(&stru_140C4DB30 + 631) & MmPageValidationFrequency) == 0 )
{
MiArePageContentsZero((PVOID)v55);
v55 = v81;
}
v88 = v55 & 0xF;
if( v88 == v53 )
{
v24 = v55;
}
else
{
MiReleaseFreshPage(v78);
v55 = v81;
}
v56 = (_MMSUPPORT_INSTANCE *)v78;
if( v88 != v53 )
v56 = v87;
v81 = ++v55;
v15 = v90-- == 1;
++v78;
}
while( !v15 );
NewPfn = (_MMPFN *)v56;
__writecr8(CurrentIrql);
LODWORD(v77) = 0;
goto LABEL_65;
}
__writecr8(CurrentIrql);
MiReturnCommit(v20, 1ui64);
v49 = 1i64;
if( v20 != &Irp )
goto LABEL_52;
v48 = KeGetCurrentPrcb();
v50 = (int)v48->CachedResidentAvailable;
if( (_DWORD)v50 == -1 )
goto LABEL_52;
if( (unsigned __int64)(v50 + 1) <= 0x100 )
{
do
{
v51 = _InterlockedCompareExchange((volatile signed __int32 *)&v48->CachedResidentAvailable, v50 + 1, v50);
v15 = (_DWORD)v50 == v51;
LODWORD(v50) = v51;
if( v15 )
goto LABEL_53;
}
while( v51 != -1 && (unsigned __int64)(v51 + 1i64) <= 0x100 );
}
if( (int)v50 > 192
&& (_DWORD)v50 != -1
&& (_DWORD)v50 == _InterlockedCompareExchange((volatile signed __int32 *)&v48->CachedResidentAvailable, 192, v50) )
{
v49 = (int)v50 - 192 + 1i64;
}
if( v49 )
LABEL_52:
v49 = _InterlockedExchangeAdd64((volatile signed __int64 *)&v20->Vp.ResidentAvailablePages, v49);
LABEL_53:
LODWORD(v77) = -1073741801;
LABEL_65:
v57 = NewPfn;
goto LABEL_69;
}
v57 = &MmGetPfnDb()[v24];
v58 = (((((unsigned __int8)v78 & 1) == 0) + 0x2000) << 17) | 8;
if( (VOID(__stdcall *)(VOID *))KeGetCurrentThread()[1].ApcState.ApcListHead[0].Blink != KeSwapProcessOrStack )
v58 = ((((unsigned __int8)v78 & 1) == 0) + 0x2000) << 17;
LODWORD(StartingPfn) = v58;
LODWORD(Flags) = 0x80000000;
LODWORD(PreferredNode) = v31;
LODWORD(v77) = MiFindContiguousPages(
v20,
v24,
v24,
0i64,
1ui64,
(_MI_PFN_CACHE_ATTRIBUTE)(BYTE2(Vm->WorkingSetExpansionLinks.Blink) >> 6),
PreferredNode,
Flags,
StartingPfn);
LABEL_69:
v59 = 0;
MiRelockFaultState((INT16 *)FaultingAddress + 28, v94[0], v49, (INT64)v48, (INT64)EntryArray);
if( ProtoPfn )
{
*((_QWORD *)&v97 + 1) |= 0x8000000000000000ui64;
MiRelockProtoPoolPage(ProtoPfn, 0i64);
v60 = ProtoPfn;
LODWORD(SpinCount) = 0;
if( _interlockedbittestandset64((volatile signed __int32 *)&ProtoPfn->u2, 0x3Fui64) )
{
v61 = v60;
do
{
do
KeYieldProcessorEx(&SpinCount);
while( v61->u2._bf_0 < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)&v61->u2, 0x3Fui64) );
v60 = ProtoPfn;
}
v15 = memcmp(&buf1, v60, 0x30ui64) == 0;
v59 = 0;
v62 = ProtoPfn;
if( !v15 )
v59 = 1;
_InterlockedAnd64(&ProtoPfn->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
MiReturnPfnReferenceCount(v62);
}
HIDWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&Vm->WorkingSetExpansionLinks, 0x3Fui64) )
{
do
KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
while( (__int64)Vm->WorkingSetExpansionLinks.Flink < 0 );
}
if( !v59 && !memcmp(v99, Vm, 0x30ui64) && ((__int64)Vm->WorkingSetExpansionLinks.Flink & 0x4000000000000000i64) == 0 )
{
v63 = PointerPteContents;
if( MiIsFaultPteIntact(FaultingAddress, *(_MMPTE **)FaultingAddress, PointerPteContents) )
{
if( (int)v77 < 0 )
{
MiRemoveLockedPageCharge((_MMPFN *)Vm);
return(_MMPFN *)Vm;
}
MiCopyPage(v24, SourcePage, 0i64, (Long & 0x40) != 0 ? 16 : 8);
MiSwapHardFaultPage(v63, Vm, v57);
v57->u3.ReferenceCount = 0;
v64 = 1i64;
if( v20 != &Irp )
goto LABEL_99;
v65 = KeGetCurrentPrcb();
v66 = (int)v65->CachedResidentAvailable;
if( (_DWORD)v66 == -1 )
goto LABEL_99;
if( (unsigned __int64)(v66 + 1) <= 0x100 )
{
do
{
v67 = _InterlockedCompareExchange((volatile signed __int32 *)&v65->CachedResidentAvailable, v66 + 1, v66);
v15 = (_DWORD)v66 == v67;
LODWORD(v66) = v67;
if( v15 )
goto LABEL_100;
}
while( v67 != -1 && (unsigned __int64)(v67 + 1i64) <= 0x100 );
}
if( (int)v66 > 192
&& (_DWORD)v66 != -1
&& (_DWORD)v66 == _InterlockedCompareExchange(
(volatile signed __int32 *)&v65->CachedResidentAvailable,
192,
v66) )
{
v64 = (int)v66 - 192 + 1i64;
}
if( v64 )
LABEL_99:
_InterlockedExchangeAdd64((volatile signed __int64 *)&v20->Vp.ResidentAvailablePages, v64);
LABEL_100:
v92->$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::gap0[0] = 1;
return v57;
}
}
if( (int)v77 >= 0 )
{
_InterlockedAnd64((volatile signed __int64 *)&Vm->WorkingSetExpansionLinks, 0x7FFFFFFFFFFFFFFFui64);
MiReleaseFreshPage(v57);
MiReturnCommit(v20, 1ui64);
if( v20 != &Irp )
goto LABEL_113;
v68 = KeGetCurrentPrcb();
v69 = (int)v68->CachedResidentAvailable;
if( (_DWORD)v69 == -1 )
goto LABEL_113;
if( (unsigned __int64)(v69 + 1) <= 0x100 )
{
do
{
v70 = _InterlockedCompareExchange((volatile signed __int32 *)&v68->CachedResidentAvailable, v69 + 1, v69);
v15 = (_DWORD)v69 == v70;
LODWORD(v69) = v70;
if( v15 )
goto LABEL_114;
}
while( v70 != -1 && (unsigned __int64)(v70 + 1i64) <= 0x100 );
}
if( (int)v69 > 192
&& (_DWORD)v69 != -1
&& (_DWORD)v69 == _InterlockedCompareExchange((volatile signed __int32 *)&v68->CachedResidentAvailable, 192, v69) )
{
v19 = (int)v69 - 192 + 1i64;
}
if( v19 )
LABEL_113:
_InterlockedExchangeAdd64((volatile signed __int64 *)&v20->Vp.ResidentAvailablePages, v19);
LABEL_114:
LODWORD(v83) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&Vm->WorkingSetExpansionLinks, 0x3Fui64) )
{
do
KeYieldProcessorEx(&v83);
while( (__int64)Vm->WorkingSetExpansionLinks.Flink < 0 );
}
}
MiRemoveLockedPageChargeAndDecRef((_MMPFN *)Vm);
return 0i64;
}Referenced by:
MiHandleTransitionFault