MiInsertPageInFreeOrZeroedList

VOID __stdcall MiInsertPageInFreeOrZeroedList(
        UINT64 PageFrameIndex,
        UINT64 Flags,
        INT64 a3,
        UINT64 a4,
        UINT64 a5,
        UINT64 a6){
  __int16 v6; 
  UINT64 v7; 
  _MMPFN *v8; 
  unsigned __int64 EntireField; 
  unsigned int v10; 
  _MI_PARTITION *v11; 
  unsigned int v12; 
  __int64 v13; 
  NTSTATUS PagePrivilege; 
  INT16 v15; 
  __int64 v16; 
  __int64 v17; 
  char v18; 
  bool v19; 
  int v20; 
  __int64 v21; 
  int v22; 
  int v23; 
  int v24; 
  NTSTATUS v25; 
  unsigned int v26; 
  char v27; 
  unsigned __int64 v28; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v29; 
  unsigned __int64 v30; 
  __int64 v31; 
  unsigned __int16 v32; 
  __int64 v33; 
  __int64 v34; 
  unsigned __int64 v35; 
  __int64 v36; 
  __int64 v37; 
  __int64 v38; 
  __int64 v39; 
  __int64 v40; 
  __int64 v41; 
  __int64 *v42; 
  __int64 v43; 
  __int64 *v44; 
  _QWORD *v45; 
  __int64 v46; 
  __int64 v47; 
  unsigned __int64 AvailablePages; 
  _SLIST_HEADER **FreePageSlist; 
  __int64 v50; 
  _SLIST_HEADER *v51; 
  unsigned int v52; 
  char v53; 
  unsigned __int64 v54; 
  unsigned __int64 v55; 
  __int64 v56; 
  unsigned __int64 v57; 
  __int64 v58; 
  _KEVENT *v59; 
  unsigned __int64 v60; 
  unsigned __int64 v61; 
  __int64 v62; 
  unsigned __int64 v63; 
  _MMPFNLIST *v64; 
  _MMPFNLIST *v65; 
  unsigned __int64 Flink; 
  _MMPFN *v67; 
  signed __int64 bf_0; 
  signed __int64 v69; 
  signed __int64 v70; 
  unsigned __int64 Blink; 
  _MMPFN *v72; 
  _KSPIN_LOCK_QUEUE *volatile Next; 
  __int64 v74; 
  unsigned __int64 v75; 
  _SLIST_HEADER **v76; 
  __int64 v77; 
  _SLIST_HEADER *v78; 
  unsigned int v79; 
  unsigned __int64 v80; 
  unsigned __int8 CurrentIrql; 
  unsigned __int64 NodeInformation; 
  unsigned __int64 v83; 
  _BYTE *i; 
  unsigned __int64 v85; 
  unsigned __int64 v86; 
  INT64 v87; 
  int v88[8]; 
  _MI_PARTITION *v89; 
  _KSPIN_LOCK_QUEUE v90; 
  __int64 v91; 
  int v92; 
  unsigned __int64 v93; 
  _KLOCK_QUEUE_HANDLE LockHandle; 
  __int64 v95; 
  unsigned __int64 v96; 
  __int64 v97; 
  __int64 v98; 
  __int64 v99; 
  __int64 v100; 
  unsigned __int16 *v101; 
  volatile signed __int64 *v102; 
  _KLOCK_QUEUE_HANDLE LockQueue; 
  _KE_PRIVILEGED_PAGE_IDENTITY PrivilegedIdentity[4]; 
  unsigned int v106; 
  unsigned int v107; 

  v91 = 0i64;
  v6 = Flags;
  v7 = PageFrameIndex;
  v90 = 0i64;
  v8 = &MmGetPfnDb()[PageFrameIndex];
  EntireField = v8->u4.EntireField;
  if( (EntireField & 0x2000000000000i64) != 0 )
  {
    MiClearPfnImageVerified(v8, 0xCui64);
    MiClearFileOnlyPfn(v8);
    return;
  }
  v10 = 0;
  v11 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * ((EntireField >> 39) & 0x3FF));
  v89 = v11;
  if( (v6 & 1) != 0 )
  {
    if( (MiFlags & 0x80u) != 0 && (++*(&stru_140C4DB30 + 631) & MmPageValidationFrequency) == 0 )
    {
      MiArePageContentsZero((PVOID)PageFrameIndex);
      EntireField = v8->u4.EntireField;
    }
    v12 = 0;
    v106 = 0;
    v13 = 2240i64;
  }
  else
  {
    if( (v6 & 0x100) != 0 )
    {
      v8->u2._bf_0 &= ~0x4000000000000000ui64;
      *((_BYTE *)&v8->u3 + 2) = *(_BYTE *)(&v8->u3 + 1) & 0xF8 | 5;
      *((_BYTE *)&v8->u3 + 3) |= 0x10u;
      MiInsertPageInList(v8, 0x100ui64, a3);
      return;
    }
    v12 = 1;
    v13 = 2304i64;
    v106 = 1;
  }
  v102 = (volatile signed __int64 *)((char *)v11 + v13);
  *(_OWORD *)PrivilegedIdentity = 0i64;
  if( ((EntireField >> 60) & 7) == 3 )
  {
    PagePrivilege = MiGetPagePrivilege((ULONG_PTR)v8, 1ui64, PrivilegedIdentity);
    if( PagePrivilege )
    {
      v15 = 512;
      if( (PagePrivilege & 0x20) == 0 )
        v15 = 16;
      if( (int)KeSetPagePrivilege((_PREFIX_TABLE *)v7, (_STRING *)PrivilegedIdentity, v15) < 0 )
        KeBugCheckEx(0x1Au, (PVOID)0x5150B, (PVOID)v7, 0i64, 0i64);
    }
    v8->u4._bf_0 &= 0x8FFFFFFFFFFFFFFFui64;
  }
  v8->u2._bf_0 &= ~0x4000000000000000ui64;
  _InterlockedOr(v88, 0);
  v16 = (unsigned int)KiTbFlushTimeStamp;
  *((_BYTE *)&v8->u3 + 3) &= 0xF8u;
  v17 = (v8->u2._bf_0 ^ (v16 << 56)) & 0xF00000000000000i64;
  v8->PteLong |= 0x8000000000000000ui64;
  v8->u4._bf_0 &= 0xFFFFFFFFFFFFFFFui64;
  v18 = *((_BYTE *)&v8->u3 + 2);
  v8->u2._bf_0 ^= v17;
  *((_BYTE *)&v8->u3 + 2) = v18 & 0xC7;
  v19 = *(&stru_140C50B28 + 4726) == 0;
  *((_BYTE *)&v8->u3 + 3) &= ~0x20u;
  if( !v19 && _bittest64(*(&stru_140C50B28 + 756), v7 >> 9) )
  {
    if( (v6 & 0x800) == 0 )
      MiFreeSlabPage((INT64)v8);
    return;
  }
  if( (*((_BYTE *)&v8->u3 + 3) & 0x40) != 0 )
  {
    MiInsertPageInList(v8, 0x20ui64, a3);
    return;
  }
  v20 = *(&stru_140C4DB30 + 38);
  if( *(&stru_140C4DB30 + 37) <= *(&stru_140C4DB30 + 38) )
  {
    v21 = *(&stru_140C4DB30 + 27) + 16i64 * *(&stru_140C4DB30 + 37);
    if( v7 >= *(_QWORD *)v21 && (*(&stru_140C4DB30 + 37) == *(&stru_140C4DB30 + 38) || v7 < *(_QWORD *)(v21 + 16)) )
      goto LABEL_37;
  }
  v22 = 0;
  if( *(&stru_140C4DB30 + 38) < 0 )
LABEL_154:
    KeBugCheckEx(0x1Au, (PVOID)0x6201, (PVOID)v7, 0i64, 0i64);
  while( 1 )
  {
    v23 = (v22 + v20) >> 1;
    v21 = *(&stru_140C4DB30 + 27) + 16i64 * v23;
    if( v7 < *(_QWORD *)v21 )
    {
      if( !v23 )
        KeBugCheckEx(0x1Au, (PVOID)0x6200, (PVOID)v7, *(&stru_140C4DB30 + 27), 0i64);
      v20 = v23 - 1;
      goto LABEL_34;
    }
    if( v23 == *(&stru_140C4DB30 + 38) || v7 < *(_QWORD *)(v21 + 16) )
      break;
    v22 = v23 + 1;
LABEL_34:
    if( v20 < v22 )
      goto LABEL_154;
  }
  *(&stru_140C4DB30 + 37) = (v22 + v20) >> 1;
LABEL_37:
  v24 = *(_DWORD *)(v21 + 8);
  if( *(&stru_140C4DB30 + 28) )
    v25 = MiPageToChannel(v7);
  else
    v25 = 0;
  v26 = *(&stru_140C4DB30 + 66) & v7 | (v24 << *(&stru_140C4DB30 + 156)) | (v25 << *(&stru_140C4DB30 + 157));
  v27 = v12 | *(_BYTE *)(&v8->u3 + 1) & 0xF8;
  v96 = (unsigned __int64)&v11->Core.NodeInformation[(unsigned __int64)v26 >> *(&stru_140C4DB30 + 156)];
  *((_BYTE *)&v8->u3 + 2) = v27;
  v28 = v26;
  v107 = v26;
  v93 = v26;
  v92 = v6 & 0x400;
  v29.Long = (unsigned __int64)v8->OriginalPte.u;
  if( v29.Long )
  {
    if( *(&stru_140C4DB30 + 42) )
    {
      if( (v29.Long & 0x10) != 0 )
        LODWORD(v29.Long) &= ~0x10u;
      else
        LODWORD(v29.Long) &= ~*(&stru_140C4DB30 + 84);
    }
  }
  else
  {
    LODWORD(v29.Long) = 0;
  }
  v30 = -(__int64)((v6 & 0x400) != 0) & 0xFFFFFFFD00000000ui64 | LODWORD(v29.Long);
  if( *(&stru_140C4DB30 + 42) )
  {
    if( (v30 & *(&stru_140C4DB30 + 42)) != 0 )
      v30 |= 0x10ui64;
    else
      v30 |= *(&stru_140C4DB30 + 42);
  }
  v8->OriginalPte.u.Long = v30;
  if( (v6 & 0x40) == 0 )
  {
    if( (v6 & 0x200) == 0 )
    {
      if( MiCoalesceFreePages(v7) != 1 )
      {
        v26 = v107;
        v28 = v93;
        goto LABEL_54;
      }
      return;
    }
LABEL_54:
    if( (v6 & 0x400) == 0 && (v11->Core.u.LongFlags & 0x20) == 0 )
    {
      v31 = (__int64)&v11->Core.NodeInformation[v28 >> *(&stru_140C4DB30 + 156)];
      v32 = (unsigned __int8)MiChannelMaximumPowerOf2Mask & (unsigned __int16)(v26 >> *(&stru_140C4DB30 + 157));
      v33 = v106 + 525i64;
      v34 = *((_QWORD *)&v89->Core.PartitionId + v33);
      v101 = &v89->Core.PartitionId + 4 * v33;
      v97 = 16 * v28;
      if( *(unsigned __int16 *)(v34 + 16 * v28) >= v89->Zeroing.ZeroFreePageSlistMinimum )
      {
        v11 = v89;
      }
      else
      {
        v35 = 0i64;
        v36 = 0i64;
        v100 = (~(2 * (v106 ^ 1) + 4096) >> 1) & 1;
        do
        {
          v37 = v32;
          if( (unsigned int)MmNumberOfChannels <= 1 )
            v38 = *(_QWORD *)(v31 + 8 * v36 + 4128);
          else
            v38 = *(_QWORD *)(v31 + 8 * (v36 + 2i64 * v32) + 4216);
          v39 = v35 + v38;
          v40 = 0i64;
          v41 = 3i64;
          v99 = v39;
          v95 = 3i64;
          v42 = MiLargePageSizes;
          v43 = 0i64;
          v44 = (__int64 *)(v31 + 8 * v36);
          v45 = (_QWORD *)v31;
          do
          {
            v98 = *v42;
            if( v32 == 4 )
            {
              if( v36 == 2 )
                v46 = *v45 + v45[1];
              else
                v46 = *v44;
              v37 = 4i64;
            }
            else
            {
              v47 = v43 + 4 * (v37 + 4 * v36);
              v46 = *(_QWORD *)(v31 + 8 * v47 + 48)
                  + *(_QWORD *)(v31 + 8 * v47 + 56)
                  + *(_QWORD *)(v31 + 8 * v47 + 72)
                  + *(_QWORD *)(v31 + 8 * v47 + 304)
                  + *(_QWORD *)(v31 + 8 * v47 + 312)
                  + *(_QWORD *)(v31 + 8 * v47 + 328)
                  + *(_QWORD *)(v31 + 8 * v47 + 64)
                  + *(_QWORD *)(v31 + 8 * v47 + 320);
              v41 = v95;
            }
            ++v42;
            v45 += 134;
            v40 += v98 * v46;
            v43 += 134i64;
            v44 += 134;
            v95 = --v41;
          }
          while( v41 );
          ++v36;
          v35 = v40 + v99;
        }
        while( v36 <= v100 );
        v11 = v89;
        if( v35 > 0x40 )
        {
          AvailablePages = v89->Vp.AvailablePages;
          if( AvailablePages < 0x420 )
          {
            FreePageSlist = v89->PageLists.FreePageSlist;
            v50 = 0i64;
            while( 1 )
            {
              v51 = *FreePageSlist;
              v52 = 0;
              if( *(&stru_140C4DB30 + 67) )
                break;
LABEL_76:
              ++v50;
              ++FreePageSlist;
              if( v50 > 1 )
                goto LABEL_77;
            }
            while( 1 )
            {
              AvailablePages += LOWORD(v51->Alignment);
              if( AvailablePages >= 0x420 )
                break;
              ++v52;
              ++v51;
              if( v52 >= *(&stru_140C4DB30 + 67) )
                goto LABEL_76;
            }
          }
          v53 = *((_BYTE *)&v8->u3 + 2);
          if( (v53 & 7) != 5 )
            *((_BYTE *)&v8->u3 + 2) = v53 & 0xF8 | 5;
          v54 = ((unsigned __int64)v106 << 12) | v8->OriginalPte.u.Long & 0xFFFFFFFFFFFF0FFFui64;
          if( v54 )
          {
            v10 = (v106 << 12) | *(_DWORD *)(&v8->3 + 1) & 0xFFFF0FFF;
            if( *(&stru_140C4DB30 + 42) )
            {
              if( (v8->TreeNode.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 & 0x10) != 0 )
                v10 = (v106 << 12) | *(_DWORD *)(&v8->3 + 1) & 0xFFFF0FEF;
              else
                v10 = v54 & ~*(&stru_140C4DB30 + 84);
            }
          }
          v55 = v10 | 0xFFFFFFFE00000000ui64;
          if( *(&stru_140C4DB30 + 42) )
          {
            if( (*(&stru_140C4DB30 + 42) & v55) != 0 )
              v55 = v10 | 0xFFFFFFFE00000010ui64;
            else
              v55 |= *(&stru_140C4DB30 + 42);
          }
          v56 = v97;
          v8->OriginalPte.u.Long = v55;
          RtlpInterlockedPushEntrySList((PSLIST_HEADER)(*(_QWORD *)v101 + v56), (PSLIST_ENTRY)v8);
          return;
        }
LABEL_77:
        v7 = PageFrameIndex;
      }
      v12 = v106;
    }
  }
  memset(&LockQueue, 0, sizeof(LockQueue));
  v57 = _InterlockedIncrement64((volatile signed __int64 *)&v11->Vp.AvailablePages);
  if( v57 <= 0x420 )
  {
    switch( v57 )
    {
      case 0xA0ui64:
        v58 = 4968i64;
        goto LABEL_100;
      case 0x420ui64:
        v58 = 5000i64;
        goto LABEL_100;
      case 0x22ui64:
        v58 = 4936i64;
LABEL_100:
        LockQueue.LockQueue.Next = 0i64;
        LockQueue.LockQueue.Lock = &v11->PageLists.AvailableEventsLock;
        v59 = (_KEVENT *)((char *)v11 + v58);
        KxAcquireQueuedSpinLock(&LockQueue.LockQueue, &v11->PageLists.AvailableEventsLock);
        KeSetEvent(v59, 0, 0);
        ++*((_DWORD *)v59 + 6);
        KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockQueue);
        break;
    }
  }
  v60 = v57 - 1;
  if( v60 == v11->PageLists.LowMemoryThreshold || v60 == v11->PageLists.HighMemoryThreshold )
    MiUpdateAvailableEvents(v11);
  v61 = v96;
  v62 = v12;
  v63 = _InterlockedIncrement64((volatile signed __int64 *)(v96 + 8i64 * v12 + 4128));
  if( (unsigned int)MmNumberOfChannels > 1 )
    _InterlockedIncrement64((volatile signed __int64 *)(v61
                                                      + 8
                                                      * (v62
                                                       + 2i64
                                                       * ((unsigned __int8)MiChannelMaximumPowerOf2Mask & (unsigned __int16)(v107 >> *(&stru_140C4DB30 + 157))))
                                                      + 4216));
  v64 = v89->PageLists.FreePagesByColor[v62];
  v90.Next = 0i64;
  v65 = &v64[v93];
  v90.Lock = &v65->Lock;
  if( _InterlockedExchange64((volatile __int64 *)&v65->Lock, (__int64)&v90) )
    KxWaitForLockOwnerShip((INT64)&v90);
  Flink = v65->Flink;
  if( Flink == 0xFFFFFFFFFi64 )
  {
    _InterlockedOr(
      (volatile signed __int32 *)&v89->Core.NodeInformation[v93 >> *(&stru_140C4DB30 + 156)].FreePageListHeadsBitmap[v62].Buffer[(unsigned __int64)(v107 & *(&stru_140C4DB30 + 66)) >> 5],
      1 << (v107 & *(&stru_140C4DB30 + 264) & 0x1F));
    v8->u2._bf_0 |= 0xFFFFFFFFFui64;
    v8->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 |= 0xFFFFFFFFFui64;
    v65->Flink = v7;
    v65->Blink = v7;
  }
  else if( v106 == 1 || v92 )
  {
    Blink = v65->Blink;
    v72 = &MmGetPfnDb()[Blink];
    v8->u2._bf_0 ^= (v8->u2._bf_0 ^ ((__int64)(Blink * 48) / 48)) & 0xFFFFFFFFFi64;
    v72->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 ^= (v7 ^ v72->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0) & 0xFFFFFFFFFi64;
    v65->Blink = v7;
    v8->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 |= 0xFFFFFFFFFui64;
  }
  else
  {
    v8->u2._bf_0 |= 0xFFFFFFFFFui64;
    v67 = &MmGetPfnDb()[Flink];
    bf_0 = v67->u2._bf_0;
    v69 = _InterlockedCompareExchange64(&v67->u2.Lock, v7 & 0xFFFFFFFFFi64 | bf_0 & 0xFFFFFFF000000000ui64, bf_0);
    if( bf_0 != v69 )
    {
      do
      {
        v70 = v69;
        v69 = _InterlockedCompareExchange64(&v67->u2.Lock, v7 & 0xFFFFFFFFFi64 | v69 & 0xFFFFFFF000000000ui64, v69);
      }
      while( v70 != v69 );
    }
    v65->Flink = v7;
    v8->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 ^= (v8->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 ^ ((__int64)(48 * Flink) / 48)) & 0xFFFFFFFFFi64;
  }
  ++v65->Total;
  _InterlockedIncrement64(v102);
  _m_prefetchw(&v90);
  Next = v90.Next;
  if( v90.Next )
  {
LABEL_119:
    v90.Next = 0i64;
    _InterlockedXor64((volatile signed __int64 *)&Next->Lock, 1ui64);
  }
  else if( (_KSPIN_LOCK_QUEUE *)_InterlockedCompareExchange64(
                                   (volatile signed __int64 *)v90.Lock,
                                   0i64,
                                   (signed __int64)&v90) != &v90 )
  {
    Next = KxWaitForLockChainValid(&v90);
    goto LABEL_119;
  }
  if( v106 == 1 && v63 >= 0x40 )
  {
    v74 = (__int64)v89;
    v75 = v89->Vp.AvailablePages;
    if( v75 < 0xA0 )
    {
      v76 = v89->PageLists.FreePageSlist;
      v77 = 0i64;
      while( 1 )
      {
        v78 = *v76;
        v79 = 0;
        if( *(&stru_140C4DB30 + 67) )
          break;
LABEL_127:
        ++v77;
        ++v76;
        if( v77 > 1 )
          return;
      }
      while( 1 )
      {
        v75 += LOWORD(v78->Alignment);
        if( v75 >= 0xA0 )
          break;
        ++v79;
        ++v78;
        if( v79 >= *(&stru_140C4DB30 + 67) )
          goto LABEL_127;
      }
    }
    v80 = v96;
    CurrentIrql = 17;
    memset(&LockHandle, 0, sizeof(LockHandle));
    if( v96 )
    {
      if( (v89->Core.u.LongFlags & 0x40) != 0 )
        return;
      NodeInformation = v96;
      v83 = v96 + 4544;
    }
    else
    {
      NodeInformation = (unsigned __int64)v89->Core.NodeInformation;
      v83 = NodeInformation + 4544i64 * (unsigned __int16)KeNumberNodes;
    }
    if( !v89->Zeroing.BackgroundZeroingDisabled && NodeInformation < v83 )
    {
      for( i = (_BYTE *)(NodeInformation + 4490); (unsigned __int64)(i - 4490) < v83; i += 4544 )
      {
        if( !*i )
        {
          if( !v80 )
          {
            CurrentIrql = KeGetCurrentIrql();
            __writecr8(2ui64);
LABEL_142:
            if( *(_BYTE *)(v74 + 6297) )
            {
              v87 = *(_QWORD *)(i - 58);
              KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)(v87 + 24), &LockHandle);
              if( !*i )
              {
                *i = 1;
                MiWakeZeroingThreads(v87, 2);
              }
              KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
              __writecr8(LockHandle.OldIrql);
            }
            else
            {
              LockHandle.LockQueue.Next = 0i64;
              LockHandle.LockQueue.Lock = (unsigned __int64 *volatile)(v74 + 4928);
              KxAcquireQueuedSpinLock(&LockHandle.LockQueue, (UINT64 *)(v74 + 4928));
              if( !*i )
              {
                *i = 1;
                KeSetEvent((PRKEVENT)(v74 + 6272), 0, 0);
              }
              KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
            }
            if( !v80 )
              __writecr8(CurrentIrql);
            continue;
          }
          LODWORD(v85) = MiNodeLargeFreeZeroPages((_MI_NODE_INFORMATION *)(i - 4490), 4ui64, FreePageList);
          if( v85 >= 0x400 )
          {
            LODWORD(v86) = MiNodeLargeFreeZeroPages((_MI_NODE_INFORMATION *)(i - 4490), 4ui64, ZeroedPageList);
            if( v86 < 0x100000 )
              goto LABEL_142;
          }
        }
      }
    }
  }
}

Referenced by: